From 122a16fb95e480126319844d94196ea3327b71e8 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@hp.com>
Date: Thu, 14 Aug 2014 08:18:40 +0100
Subject: [PATCH 0001/3333] Tempest allow_tenant_isolation in auth section

Tempest change 107685 moves allow_tenant_isolation from compute
group to auth group, making the old format deprecated.
Switching to the new format.

Change-Id: Iff79986c2564610efde4791b7e61df3db859e199
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d6d6020adf..4fc064c56d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -272,8 +272,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
 
+    # Auth
+    iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+
     # Compute
-    iniset $TEMPEST_CONFIG compute allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
     iniset $TEMPEST_CONFIG compute network_for_ssh $PRIVATE_NETWORK_NAME
     iniset $TEMPEST_CONFIG compute ip_version_for_ssh 4

From ac937bc06eb68cb1c94804995325b9fa8b850959 Mon Sep 17 00:00:00 2001
From: Julie Pichon <jpichon@redhat.com>
Date: Mon, 29 Sep 2014 04:55:21 +0100
Subject: [PATCH 0002/3333] Install ldappool when LDAP is enabled

Keystone expects ldappool to be installed when using the LDAP backend.

Change-Id: I35e6585ec8416153ed6d0c6fa8c10c992bf0de6d
Closes-Bug: #1373750
---
 lib/ldap | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/ldap b/lib/ldap
index 2bb8a4cc9c..a6fb82f6f2 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -139,6 +139,8 @@ function install_ldap {
         sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
     fi
 
+    pip_install ldappool
+
     rm -rf $tmp_ldap_dir
 }
 

From 062a3c3e707e69778d2bb95e3e861e7bd65114b7 Mon Sep 17 00:00:00 2001
From: Kenneth Giusti <kgiusti@gmail.com>
Date: Tue, 30 Sep 2014 10:14:08 -0400
Subject: [PATCH 0003/3333] Configure an authorized user for the QPID broker

If QPID_USERNAME is set, add the user to the QPID broker's
authentication database.  Use the value of QPID_PASSWORD as the
password for the user, prompting for a password if QPID_PASSWORD is
not set.  This requires that all clients provide this username and
password when connecting to the QPID broker, or the connection will be
rejected.

If QPID_USERNAME is not set (the default), disable QPID broker
authentication. This allows any client to connect to the QPID broker
without needing authentication.

Change-Id: Ibd79873379740930ce5f598018c1ca1fffda7c31
Closes-Bug: 1272399
---
 files/apts/qpid |   1 +
 files/rpms/qpid |   1 +
 lib/rpc_backend | 109 +++++++++++++++++++++++++++++++++++-------------
 3 files changed, 82 insertions(+), 29 deletions(-)
 create mode 100644 files/apts/qpid

diff --git a/files/apts/qpid b/files/apts/qpid
new file mode 100644
index 0000000000..e3bbf0961c
--- /dev/null
+++ b/files/apts/qpid
@@ -0,0 +1 @@
+sasl2-bin # NOPRIME
diff --git a/files/rpms/qpid b/files/rpms/qpid
index 62148ba231..9e3f10af13 100644
--- a/files/rpms/qpid
+++ b/files/rpms/qpid
@@ -1,3 +1,4 @@
 qpid-proton-c-devel # NOPRIME
 python-qpid-proton # NOPRIME
+cyrus-sasl-lib # NOPRIME
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index de82fe115e..14c78fbf7b 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -132,39 +132,14 @@ function install_rpc_backend {
         # Install rabbitmq-server
         install_package rabbitmq-server
     elif is_service_enabled qpid; then
-        local qpid_conf_file=/etc/qpid/qpidd.conf
         if is_fedora; then
             install_package qpid-cpp-server
-            if [[ $DISTRO =~ (rhel6) ]]; then
-                qpid_conf_file=/etc/qpidd.conf
-                # RHEL6 leaves "auth=yes" in /etc/qpidd.conf, it needs to
-                # be no or you get GSS authentication errors as it
-                # attempts to default to this.
-                sudo sed -i.bak 's/^auth=yes$/auth=no/' $qpid_conf_file
-            fi
         elif is_ubuntu; then
             install_package qpidd
-            sudo sed -i '/PLAIN/!s/mech_list: /mech_list: PLAIN /' /etc/sasl2/qpidd.conf
-            sudo chmod o+r /etc/qpid/qpidd.sasldb
         else
             exit_distro_not_supported "qpid installation"
         fi
-        # If AMQP 1.0 is specified, ensure that the version of the
-        # broker can support AMQP 1.0 and configure the queue and
-        # topic address patterns used by oslo.messaging.
-        if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
-            QPIDD=$(type -p qpidd)
-            if ! $QPIDD --help | grep -q "queue-patterns"; then
-                exit_distro_not_supported "qpidd with AMQP 1.0 support"
-            fi
-            if ! grep -q "queue-patterns=exclusive" $qpid_conf_file; then
-                cat <<EOF | sudo tee --append $qpid_conf_file
-queue-patterns=exclusive
-queue-patterns=unicast
-topic-patterns=broadcast
-EOF
-            fi
-        fi
+        _configure_qpid
     elif is_service_enabled zeromq; then
         # NOTE(ewindisch): Redis is not strictly necessary
         # but there is a matchmaker driver that works
@@ -240,10 +215,9 @@ function iniset_rpc_backend {
             iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_qpid
         fi
         iniset $file $section qpid_hostname ${QPID_HOST:-$SERVICE_HOST}
-        if is_ubuntu; then
-            QPID_PASSWORD=`sudo strings /etc/qpid/qpidd.sasldb | grep -B1 admin | head -1`
+        if [ -n "$QPID_USERNAME" ]; then
+            iniset $file $section qpid_username $QPID_USERNAME
             iniset $file $section qpid_password $QPID_PASSWORD
-            iniset $file $section qpid_username admin
         fi
     elif is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
         iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_kombu
@@ -263,6 +237,83 @@ function qpid_is_supported {
     ( ! is_suse )
 }
 
+# Set up the various configuration files used by the qpidd broker
+function _configure_qpid {
+
+    # the location of the configuration files have changed since qpidd 0.14
+    local qpid_conf_file
+    if [ -e /etc/qpid/qpidd.conf ]; then
+        qpid_conf_file=/etc/qpid/qpidd.conf
+    elif [ -e /etc/qpidd.conf ]; then
+        qpid_conf_file=/etc/qpidd.conf
+    else
+        exit_distro_not_supported "qpidd.conf file not found!"
+    fi
+
+    # force the ACL file to a known location
+    local qpid_acl_file=/etc/qpid/qpidd.acl
+    if [ ! -e $qpid_acl_file ]; then
+        sudo mkdir -p -m 755 `dirname $qpid_acl_file`
+        sudo touch $qpid_acl_file
+        sudo chmod o+r $qpid_acl_file
+    fi
+    sudo sed -i.bak '/^acl-file=/d' $qpid_conf_file
+    echo "acl-file=$qpid_acl_file" | sudo tee --append $qpid_conf_file
+
+    sudo sed -i '/^auth=/d' $qpid_conf_file
+    if [ -z "$QPID_USERNAME" ]; then
+        # no QPID user configured, so disable authentication
+        # and access control
+        echo "auth=no" | sudo tee --append $qpid_conf_file
+        cat <<EOF | sudo tee $qpid_acl_file
+acl allow all all
+EOF
+    else
+        # Configure qpidd to use PLAIN authentication, and add
+        # QPID_USERNAME to the ACL:
+        echo "auth=yes" | sudo tee --append $qpid_conf_file
+        if [ -z "$QPID_PASSWORD" ]; then
+            read_password QPID_PASSWORD "ENTER A PASSWORD FOR QPID USER $QPID_USERNAME"
+        fi
+        # Create ACL to allow $QPID_USERNAME full access
+        cat <<EOF | sudo tee $qpid_acl_file
+group admin ${QPID_USERNAME}@QPID
+acl allow admin all
+acl deny all all
+EOF
+        # Add user to SASL database
+        if is_ubuntu; then
+            install_package sasl2-bin
+        elif is_fedora; then
+            install_package cyrus-sasl-lib
+        fi
+        local sasl_conf_file=/etc/sasl2/qpidd.conf
+        sudo sed -i.bak '/PLAIN/!s/mech_list: /mech_list: PLAIN /' $sasl_conf_file
+        local sasl_db=`sudo grep sasldb_path $sasl_conf_file | cut -f 2 -d ":" | tr -d [:blank:]`
+        if [ ! -e $sasl_db ]; then
+            sudo mkdir -p -m 755 `dirname $sasl_db`
+        fi
+        echo $QPID_PASSWORD | sudo saslpasswd2 -c -p -f $sasl_db -u QPID $QPID_USERNAME
+        sudo chmod o+r $sasl_db
+    fi
+
+    # If AMQP 1.0 is specified, ensure that the version of the
+    # broker can support AMQP 1.0 and configure the queue and
+    # topic address patterns used by oslo.messaging.
+    if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
+        QPIDD=$(type -p qpidd)
+        if ! $QPIDD --help | grep -q "queue-patterns"; then
+            exit_distro_not_supported "qpidd with AMQP 1.0 support"
+        fi
+        if ! grep -q "queue-patterns=exclusive" $qpid_conf_file; then
+            cat <<EOF | sudo tee --append $qpid_conf_file
+queue-patterns=exclusive
+queue-patterns=unicast
+topic-patterns=broadcast
+EOF
+        fi
+    fi
+}
 
 # Restore xtrace
 $XTRACE

From a08ba1c5e362fe294759339ffe3fdf3408149788 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 12 Jun 2014 18:45:42 -0500
Subject: [PATCH 0004/3333] Add NetApp Cinder backend support

Supports both iSCSI and NFS, and now both 7mode and cluster mode

Change-Id: If590a7a255268fcce4770c94956607251c36fdf5
---
 lib/cinder_backends/netapp_iscsi | 64 +++++++++++++++++++++++++++
 lib/cinder_backends/netapp_nfs   | 75 ++++++++++++++++++++++++++++++++
 2 files changed, 139 insertions(+)
 create mode 100644 lib/cinder_backends/netapp_iscsi
 create mode 100644 lib/cinder_backends/netapp_nfs

diff --git a/lib/cinder_backends/netapp_iscsi b/lib/cinder_backends/netapp_iscsi
new file mode 100644
index 0000000000..7a67da7a26
--- /dev/null
+++ b/lib/cinder_backends/netapp_iscsi
@@ -0,0 +1,64 @@
+# lib/cinder_backends/netapp_iscsi
+# Configure the NetApp iSCSI driver
+
+# Enable with:
+#
+#  iSCSI:
+#   CINDER_ENABLED_BACKENDS+=,netapp_iscsi:<volume-type-name>
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# ``CINDER_CONF``
+# ``CINDER_CONF_DIR``
+# ``CINDER_ENABLED_BACKENDS``
+
+# configure_cinder_backend_netapp_iscsi - configure iSCSI
+
+# Save trace setting
+MY_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Entry Points
+# ------------
+
+# configure_cinder_backend_netapp_iscsi - Set config files, create data dirs, etc
+function configure_cinder_backend_netapp_iscsi {
+    # To use NetApp, set the following in local.conf:
+    # CINDER_ENABLED_BACKENDS+=,netapp_iscsi:<volume-type-name>
+    # NETAPP_MODE=ontap_7mode|ontap_cluster
+    # NETAPP_IP=<mgmt-ip>
+    # NETAPP_LOGIN=<admin-account>
+    # NETAPP_PASSWORD=<admin-password>
+    # NETAPP_ISCSI_VOLUME_LIST=<volumes>
+
+    # In ontap_cluster mode, the following also needs to be defined:
+    # NETAPP_ISCSI_VSERVER=<vserver-name>
+
+    local be_name=$1
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.netapp.common.NetAppDriver"
+    iniset $CINDER_CONF $be_name netapp_storage_family ${NETAPP_MODE:-ontap_7mode}
+    iniset $CINDER_CONF $be_name netapp_server_hostname $NETAPP_IP
+    iniset $CINDER_CONF $be_name netapp_login $NETAPP_LOGIN
+    iniset $CINDER_CONF $be_name netapp_password $NETAPP_PASSWORD
+    iniset $CINDER_CONF $be_name netapp_volume_list $NETAPP_ISCSI_VOLUME_LIST
+
+    iniset $CINDER_CONF $be_name netapp_storage_protocol iscsi
+    iniset $CINDER_CONF $be_name netapp_transport_type https
+
+    if [[ "$NETAPP_MODE" == "ontap_cluster" ]]; then
+        iniset $CINDER_CONF $be_name netapp_vserver $NETAPP_ISCSI_VSERVER
+    fi
+}
+
+
+# Restore xtrace
+$MY_XTRACE
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backends/netapp_nfs b/lib/cinder_backends/netapp_nfs
new file mode 100644
index 0000000000..d90b7f7d19
--- /dev/null
+++ b/lib/cinder_backends/netapp_nfs
@@ -0,0 +1,75 @@
+# lib/cinder_backends/netapp_nfs
+# Configure the NetApp NFS driver
+
+# Enable with:
+#
+#  NFS:
+#   CINDER_ENABLED_BACKENDS+=,netapp_nfs:<volume-type-name>
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# ``CINDER_CONF``
+# ``CINDER_CONF_DIR``
+# ``CINDER_ENABLED_BACKENDS``
+
+# configure_cinder_backend_netapp_nfs - configure NFS
+
+# Save trace setting
+MY_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Entry Points
+# ------------
+
+# configure_cinder_backend_netapp_nfs - Set config files, create data dirs, etc
+function configure_cinder_backend_netapp_nfs {
+    # To use NetApp, set the following in local.conf:
+    # CINDER_ENABLED_BACKENDS+=,netapp_nfs:<volume-type-name>
+    # NETAPP_MODE=ontap_7mode|ontap_cluster
+    # NETAPP_IP=<mgmt-ip>
+    # NETAPP_LOGIN=<admin-account>
+    # NETAPP_PASSWORD=<admin-password>
+    # NETAPP_NFS_VOLUME_LIST=<export-volumes>
+
+    # In ontap_cluster mode, the following also needs to be defined:
+    # NETAPP_NFS_VSERVER=<vserver-name>
+
+    local be_name=$1
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.netapp.common.NetAppDriver"
+    iniset $CINDER_CONF $be_name netapp_storage_family ${NETAPP_MODE:-ontap_7mode}
+    iniset $CINDER_CONF $be_name netapp_server_hostname $NETAPP_IP
+    iniset $CINDER_CONF $be_name netapp_login $NETAPP_LOGIN
+    iniset $CINDER_CONF $be_name netapp_password $NETAPP_PASSWORD
+
+    iniset $CINDER_CONF $be_name netapp_storage_protocol nfs
+    iniset $CINDER_CONF $be_name netapp_transport_type https
+    iniset $CINDER_CONF $be_name nfs_shares_config $CINDER_CONF_DIR/netapp_shares.conf
+
+    echo "$NETAPP_NFS_VOLUME_LIST" | tee "$CINDER_CONF_DIR/netapp_shares.conf"
+
+    if [[ "$NETAPP_MODE" == "ontap_cluster" ]]; then
+        iniset $CINDER_CONF $be_name netapp_vserver $NETAPP_NFS_VSERVER
+    fi
+}
+
+function cleanup_cinder_backend_netapp_nfs {
+    # Clean up remaining NFS mounts
+    # Be blunt and do them all
+    local m
+    for m in $CINDER_STATE_PATH/mnt/*; do
+        sudo umount $m
+    done
+}
+
+
+# Restore xtrace
+$MY_XTRACE
+
+# Local variables:
+# mode: shell-script
+# End:

From 608f884edb2faff59100bb5aa84e8d59e5d3e6d8 Mon Sep 17 00:00:00 2001
From: Kirill Shileev <kshileev@gmail.com>
Date: Fri, 3 Oct 2014 22:48:58 +0400
Subject: [PATCH 0005/3333] Use ALT_INSTANCE_USER for image_alt_ssh_user

Change-Id: Ib9cfb6e989575d62c493cbe92fdefd8c90256bcd
Closes-Bug: 1377914
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d677c7e33c..3e55d792ff 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -284,7 +284,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt
-    iniset $TEMPEST_CONFIG compute image_alt_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
+    iniset $TEMPEST_CONFIG compute image_alt_ssh_user ${ALT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method

From d03915f9c08ff91c5d39f8cadb064718079bdb4b Mon Sep 17 00:00:00 2001
From: Daisuke Morita <morita.daisuke@lab.ntt.co.jp>
Date: Wed, 8 Oct 2014 06:52:21 +0000
Subject: [PATCH 0006/3333] Enable Swift's newer feature of container-sync

Newer version of container-sync feature is introduced in Swift ver. 1.12.0.

The spec:
http://docs.openstack.org/developer/swift/overview_container_sync.html

Before this commit, Devstack does not configure any realm used in
container-sync, therefore this feature does not work.
To test this feature in CI system, moreover to show the sample
configuration of realms, Devstack now edits realms configuration file.

Change-Id: I9f1e3224403e08e725a989162729470357fe90b0
Closes-Bug: 1378646
---
 lib/swift | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 21ed920149..d8c790a201 100644
--- a/lib/swift
+++ b/lib/swift
@@ -330,7 +330,12 @@ function configure_swift {
     SWIFT_CONFIG_PROXY_SERVER=${SWIFT_CONF_DIR}/proxy-server.conf
     cp ${SWIFT_DIR}/etc/proxy-server.conf-sample ${SWIFT_CONFIG_PROXY_SERVER}
 
-    cp ${SWIFT_DIR}/etc/container-sync-realms.conf-sample ${SWIFT_CONF_DIR}/container-sync-realms.conf
+    # To run container sync feature introduced in Swift ver 1.12.0,
+    # container sync "realm" is added in container-sync-realms.conf
+    local csyncfile=${SWIFT_CONF_DIR}/container-sync-realms.conf
+    cp ${SWIFT_DIR}/etc/container-sync-realms.conf-sample ${csyncfile}
+    iniset ${csyncfile} realm1 key realm1key
+    iniset ${csyncfile} realm1 cluster_name1 "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/"
 
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT user
     iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT user ${STACK_USER}

From bf1b8ed4707e6ee3588c5b5237317325fe2d57c4 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 6 Oct 2014 03:36:20 -0400
Subject: [PATCH 0007/3333] Move swift CLI commands to OSC commands

Only a few instances in exercises/swift.sh

Change-Id: I0a39b11f660453a378d44e4f9f28a4a57352f4a8
---
 exercises/swift.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/exercises/swift.sh b/exercises/swift.sh
index 25ea6719c1..afcede81cd 100755
--- a/exercises/swift.sh
+++ b/exercises/swift.sh
@@ -45,16 +45,16 @@ CONTAINER=ex-swift
 # =============
 
 # Check if we have to swift via keystone
-swift stat || die $LINENO "Failure geting status"
+swift stat || die $LINENO "Failure getting status"
 
 # We start by creating a test container
-swift post $CONTAINER || die $LINENO "Failure creating container $CONTAINER"
+openstack container create $CONTAINER || die $LINENO "Failure creating container $CONTAINER"
 
 # add some files into it.
-swift upload $CONTAINER /etc/issue || die $LINENO "Failure uploading file to container $CONTAINER"
+openstack object create $CONTAINER /etc/issue || die $LINENO "Failure uploading file to container $CONTAINER"
 
 # list them
-swift list $CONTAINER || die $LINENO "Failure listing contents of container $CONTAINER"
+openstack object list $CONTAINER || die $LINENO "Failure listing contents of container $CONTAINER"
 
 # And we may want to delete them now that we have tested that
 # everything works.

From fa16ae92cd7339a830851dea17ce263205b78865 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <sebastien.han@enovance.com>
Date: Mon, 6 Oct 2014 00:15:33 +0200
Subject: [PATCH 0008/3333] Add the ability to activate Nova ceph without
 Cinder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prior to this patch, if we wanted to boot a VM in Ceph using
libvirt_image_type we must had Cinder enabled. This patch allows you to
use libvirt_image_type without having Cinder enabled.

Change-Id: Ia61e6effc5a4ccba69f4fa48f6e9984f15bb8979
Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
---
 extras.d/60-ceph.sh | 5 +++--
 lib/ceph            | 5 +++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/extras.d/60-ceph.sh b/extras.d/60-ceph.sh
index 5fb34ea89b..50bdfaee3b 100644
--- a/extras.d/60-ceph.sh
+++ b/extras.d/60-ceph.sh
@@ -26,8 +26,9 @@ if is_service_enabled ceph; then
         if is_service_enabled cinder; then
             echo_summary "Configuring Cinder for Ceph"
             configure_ceph_cinder
-            # NOTE (leseb): the part below is a requirement from Cinder in order to attach volumes
-            # so we should run the following within the if statement.
+        fi
+        if is_service_enabled cinder || is_service_enabled nova; then
+            # NOTE (leseb): the part below is a requirement to attach Ceph block devices
             echo_summary "Configuring libvirt secret"
             import_libvirt_secret_ceph
         fi
diff --git a/lib/ceph b/lib/ceph
index 30ca903a8d..55e110bead 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -221,6 +221,11 @@ function configure_ceph_nova {
     iniset $NOVA_CONF libvirt images_type rbd
     iniset $NOVA_CONF libvirt images_rbd_pool ${NOVA_CEPH_POOL}
     iniset $NOVA_CONF libvirt images_rbd_ceph_conf ${CEPH_CONF_FILE}
+
+    if ! is_service_enabled cinder; then
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
+        sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
+    fi
 }
 
 # configure_ceph_cinder() - Cinder config needs to come after Cinder is set up

From efdaafc0f973acdb3fc878434acb3b982e35ccaf Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Tue, 14 Oct 2014 21:08:32 +0100
Subject: [PATCH 0009/3333] Use $() instead of ``

There are other instances of this in other files, just tidying
ceilometer at the moment.

Change-Id: I136a20d7ac50fdf02cbd1102613e324e313b7b0a
---
 lib/ceilometer | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 9bb31218a0..26c698cf5c 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -178,7 +178,7 @@ function configure_ceilometer {
     configure_auth_token_middleware $CEILOMETER_CONF ceilometer $CEILOMETER_AUTH_CACHE_DIR
 
     if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] ; then
-        iniset $CEILOMETER_CONF database connection `database_connection_url ceilometer`
+        iniset $CEILOMETER_CONF database connection $(database_connection_url ceilometer)
         iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
     else
         iniset $CEILOMETER_CONF database connection mongodb://localhost:27017/ceilometer

From 014564873e98f521338f8bf3ac97e1a7e96ecc9c Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Tue, 14 Oct 2014 18:53:53 -0400
Subject: [PATCH 0010/3333] Set Tempest storage protocol and vendor w/o setting
 driver

Set TEMPEST_STORAGE_PROTOCOL and TEMPEST_VOLUME_VENDOR if
they are changed from their defaults, or if
TEMPEST_VOLUME_DRIVER is changed.

This maintains the current behavior of setting these options if
TEMPEST_VOLUME_DRIVER is set to something other than "default".

Change-Id: I1fb7f5db0446f97de48b97a6f451882cc51c51a4
---
 lib/tempest | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d677c7e33c..3c37918018 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -64,8 +64,10 @@ BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
 
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}
-TEMPEST_VOLUME_VENDOR=${TEMPEST_VOLUME_VENDOR:-"Open Source"}
-TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-iSCSI}
+TEMPEST_DEFAULT_VOLUME_VENDOR="Open Source"
+TEMPEST_VOLUME_VENDOR=${TEMPEST_VOLUME_VENDOR:-$TEMPEST_DEFAULT_VOLUME_VENDOR}
+TEMPEST_DEFAULT_STORAGE_PROTOCOL="iSCSI"
+TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-$TEMPEST_DEFAULT_STORAGE_PROTOCOL}
 
 # Neutron/Network variables
 IPV6_ENABLED=$(trueorfalse True $IPV6_ENABLED)
@@ -369,8 +371,12 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume backend2_name "LVM_iSCSI_2"
     fi
 
-    if [ $TEMPEST_VOLUME_DRIVER != "default" ]; then
+    if [ $TEMPEST_VOLUME_DRIVER != "default" -o \
+        $TEMPEST_VOLUME_VENDOR != $TEMPEST_DEFAULT_VOLUME_VENDOR ]; then
         iniset $TEMPEST_CONFIG volume vendor_name "$TEMPEST_VOLUME_VENDOR"
+    fi
+    if [ $TEMPEST_VOLUME_DRIVER != "default" -o \
+        $TEMPEST_STORAGE_PROTOCOL != $TEMPEST_DEFAULT_STORAGE_PROTOCOL ]; then
         iniset $TEMPEST_CONFIG volume storage_protocol $TEMPEST_STORAGE_PROTOCOL
     fi
 

From 2a324dd2ec51be4485eafe10a31c75bcc238144d Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Wed, 15 Oct 2014 17:40:41 +0200
Subject: [PATCH 0011/3333] XenAPI: Add exit point after JEOS installation

If the user only want to run the installation of Ubuntu - to export the
template as an xva, it just needs to specify a non-empty value for:

EXIT_AFTER_JEOS_INSTALLATION

And the script will exit after the jeos template has been created.

Change-Id: I558e2f2b18ee23c15c7e46e2f7e74543cf26b750
---
 tools/xen/install_os_domU.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 75d56a8465..439db68120 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -244,6 +244,11 @@ else
     vm_uuid=$(xe vm-install template="$TNAME" new-name-label="$GUEST_NAME")
 fi
 
+if [ -n "${EXIT_AFTER_JEOS_INSTALLATION:-}" ]; then
+    echo "User requested to quit after JEOS instalation"
+    exit 0
+fi
+
 #
 # Prepare VM for DevStack
 #

From a1707c7ef0a580bb8f5323ea3d060d0e82d831d7 Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Wed, 15 Oct 2014 16:56:23 +0200
Subject: [PATCH 0012/3333] XenAPI: Fix vimrc

DevStack installs a default minimal .vimrc file for the stack user.
Unfortunately the `syntax on` config line is not recognised by the vim
installed in DomU. It results in an annoying message being displayed
whenever the user is using vi. To avoid this issue, removing the `syntax
on` line.

Change-Id: I224465cc3cdba3464ea0a9a751f250ecb6ddc9f3
---
 tools/xen/prepare_guest.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/xen/prepare_guest.sh b/tools/xen/prepare_guest.sh
index cd189db803..7383c91e37 100755
--- a/tools/xen/prepare_guest.sh
+++ b/tools/xen/prepare_guest.sh
@@ -114,7 +114,6 @@ function setup_vimrc {
     if [ ! -e $1 ]; then
         # Simple but usable vimrc
         cat > $1 <<EOF
-syntax on
 se ts=4
 se expandtab
 se shiftwidth=4

From fff07e864ed9b7c57c067457546e4e8c2985ba47 Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Wed, 15 Oct 2014 16:42:40 +0200
Subject: [PATCH 0013/3333] XenAPI: Always update apt sources

If an appliance is used as a base OS, the user might want to use that in
a different region. With this change we always update the used mirrors
in the template.

Change-Id: I7a119664efac1124e54064311c243c63c2a7944b
---
 tools/xen/prepare_guest_template.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tools/xen/prepare_guest_template.sh b/tools/xen/prepare_guest_template.sh
index e6a7e025b0..2d3b89821f 100755
--- a/tools/xen/prepare_guest_template.sh
+++ b/tools/xen/prepare_guest_template.sh
@@ -93,3 +93,28 @@ EOF
 # Need to set barrier=0 to avoid a Xen bug
 # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/824089
 sed -i -e 's/errors=/barrier=0,errors=/' $STAGING_DIR/etc/fstab
+
+# Update ubuntu repositories
+cat > $STAGING_DIR/etc/apt/sources.list << EOF
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates main restricted
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates main restricted
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} universe
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} universe
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates universe
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates universe
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} multiverse
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} multiverse
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates multiverse
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates multiverse
+deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-backports main restricted universe multiverse
+deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-backports main restricted universe multiverse
+
+deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security main restricted
+deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security main restricted
+deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security universe
+deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security universe
+deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
+deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
+EOF

From 751ad1aadf8447c2b6945b6ae4ab73bf71a244ca Mon Sep 17 00:00:00 2001
From: Robert Li <baoli@cisco.com>
Date: Wed, 15 Oct 2014 21:40:53 -0400
Subject: [PATCH 0014/3333] Allow multi-line config items in meta-section of
 local.conf

It would behave such as the contents from each meta-section in
local.conf is copied to the destination files. One exception is the multiline
options not grouped together. In that case, the contents will be grouped
together in its destination config file.

Check tests/test_config.sh for examples.

This was originally committed in https://review.openstack.org/128805.
But the original change used AWK syntax that is not supported in AWK
3.1.8, and caused syntax error on servers with that AWK version. This
patch makes the necessary change so that it's compatible with AWK
3.1.8.

Change-Id: Id1e1fe01f05bd0f19ea6e89c4f4c0f8be695dfce
Partial-Bug: #1374118
---
 functions-common     | 27 ++++++++++++++++++++
 lib/config           | 48 +++++++++++++++++++++++++++++++---
 tests/test_config.sh | 61 +++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 129 insertions(+), 7 deletions(-)

diff --git a/functions-common b/functions-common
index 9f4acfec1e..333f31da02 100644
--- a/functions-common
+++ b/functions-common
@@ -119,6 +119,33 @@ function ini_has_option {
     [ -n "$line" ]
 }
 
+# Add another config line for a multi-line option.
+# It's normally called after iniset of the same option and assumes
+# that the section already exists.
+#
+# Note that iniset_multiline requires all the 'lines' to be supplied
+# in the argument list. Doing that will cause incorrect configuration
+# if spaces are used in the config values.
+#
+# iniadd_literal config-file section option value
+function iniadd_literal {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    local value=$4
+
+    [[ -z $section || -z $option ]] && return
+
+    # Add it
+    sed -i -e "/^\[$section\]/ a\\
+$option = $value
+" "$file"
+
+    $xtrace
+}
+
 # Set an option in an INI file
 # iniset config-file section option value
 function iniset {
diff --git a/lib/config b/lib/config
index b44e79aa3d..a4d59a31c9 100644
--- a/lib/config
+++ b/lib/config
@@ -86,7 +86,11 @@ function merge_config_file {
     # having to do nasty quoting games
     get_meta_section $file $matchgroup $configfile | \
     $CONFIG_AWK_CMD -v configfile=$configfile '
-        BEGIN { section = "" }
+        BEGIN {
+            section = ""
+            last_section = ""
+            section_count = 0
+        }
         /^\[.+\]/ {
             gsub("[][]", "", $1);
             section=$1
@@ -106,10 +110,48 @@ function merge_config_file {
             # need to strip leading & trailing whitespace from value
             sub(/^[ \t]*/, "", value)
             sub(/[ \t]*$/, "", value)
-            print "iniset " configfile " " section " " attr " \x27" value "\x27"
+
+            # cfg_attr_count: number of config lines per [section, attr]
+            # cfg_attr: three dimensional array to keep all the config lines per [section, attr]
+            # cfg_section: keep the section names in the same order as they appear in local.conf
+            # cfg_sec_attr_name: keep the attr names in the same order as they appear in local.conf
+            if (! (section, attr) in cfg_attr_count) {
+                if (section != last_section) {
+                    cfg_section[section_count++] = section
+                    last_section = section
+                }
+                attr_count = cfg_sec_attr_count[section_count - 1]++
+                cfg_sec_attr_name[section_count - 1, attr_count] = attr
+
+                cfg_attr[section, attr, 0] = value
+                cfg_attr_count[section, attr] = 1
+            } else {
+                lno = cfg_attr_count[section, attr]++
+                cfg_attr[section, attr, lno] = value
+            }
+        }
+        END {
+            # Process each section in order
+            for (sno = 0; sno < section_count; sno++) {
+                section = cfg_section[sno]
+                # The ini routines simply append a config item immediately
+                # after the section header. To keep the same order as defined
+                # in local.conf, invoke the ini routines in the reverse order
+                for (attr_no = cfg_sec_attr_count[sno] - 1; attr_no >=0; attr_no--) {
+                    attr = cfg_sec_attr_name[sno, attr_no]
+                    if (cfg_attr_count[section, attr] == 1)
+                        print "iniset " configfile " " section " " attr " \x27" cfg_attr[section, attr, 0] "\x27"
+                    else {
+                        # For multiline, invoke the ini routines in the reverse order
+                        count = cfg_attr_count[section, attr]
+                        print "iniset " configfile " " section " " attr " \x27" cfg_attr[section, attr, count - 1] "\x27"
+                        for (l = count -2; l >= 0; l--)
+                            print "iniadd_literal " configfile " " section " " attr " \x27" cfg_attr[section, attr, l] "\x27"
+                    }
+                }
+            }
         }
     ' | while read a; do eval "$a"; done
-
 }
 
 
diff --git a/tests/test_config.sh b/tests/test_config.sh
index 50e8d7b2e6..cd74cee6f0 100755
--- a/tests/test_config.sh
+++ b/tests/test_config.sh
@@ -108,6 +108,27 @@ attr = strip_trailing_space
 [[test7|test-colon.conf]]
 [DEFAULT]
 servers=10.11.12.13:80
+
+[[test-multi-sections|test-multi-sections.conf]]
+[sec-1]
+cfg_item1 = abcd
+cfg_item2 = efgh
+
+[sec-2]
+cfg_item1 = abcd
+cfg_item3 = /1/2/3/4:5
+cfg_item4 = end
+
+[sec-3]
+cfg_item5 = 5555
+cfg_item6 = 6666
+cfg_item5 = 5555another
+
+[[test-multiline|test-multiline.conf]]
+[multi]
+cfg_item1 = "ab":"cd", "ef":   "gh"
+cfg_item1 = abcd
+cfg_item2 = efgh
 EOF
 
 echo -n "get_meta_section_files: test0 doesn't exist: "
@@ -189,8 +210,39 @@ VAL=$(cat test2a.conf)
 # iniset adds a blank line if it creates the file...
 EXPECT_VAL="
 [ddd]
-additional = true
-type = new"
+type = new
+additional = true"
+check_result "$VAL" "$EXPECT_VAL"
+
+echo -n "merge_config_file test-multi-sections: "
+rm -f test-multi-sections.conf
+merge_config_file test.conf test-multi-sections test-multi-sections.conf
+VAL=$(cat test-multi-sections.conf)
+EXPECT_VAL='
+[sec-1]
+cfg_item1 = abcd
+cfg_item2 = efgh
+
+[sec-2]
+cfg_item1 = abcd
+cfg_item3 = /1/2/3/4:5
+cfg_item4 = end
+
+[sec-3]
+cfg_item5 = 5555
+cfg_item5 = 5555another
+cfg_item6 = 6666'
+check_result "$VAL" "$EXPECT_VAL"
+
+echo -n "merge_config_file test-multiline: "
+rm -f test-multiline.conf
+merge_config_file test.conf test-multiline test-multiline.conf
+VAL=$(cat test-multiline.conf)
+EXPECT_VAL='
+[multi]
+cfg_item1 = "ab":"cd", "ef":   "gh"
+cfg_item1 = abcd
+cfg_item2 = efgh'
 check_result "$VAL" "$EXPECT_VAL"
 
 echo -n "merge_config_group test2: "
@@ -200,8 +252,8 @@ VAL=$(cat test2a.conf)
 # iniset adds a blank line if it creates the file...
 EXPECT_VAL="
 [ddd]
-additional = true
-type = new"
+type = new
+additional = true"
 check_result "$VAL" "$EXPECT_VAL"
 
 echo -n "merge_config_group test2 no conf file: "
@@ -281,4 +333,5 @@ servers = 10.11.12.13:80"
 check_result "$VAL" "$EXPECT_VAL"
 
 rm -f test.conf test1c.conf test2a.conf test-quote.conf test-space.conf test-equals.conf test-strip.conf test-colon.conf
+rm -f test-multiline.conf test-multi-sections.conf
 rm -rf test-etc

From 09fb7baff50cfa2d7ca4b5678d3a535842f019c5 Mon Sep 17 00:00:00 2001
From: Swapnil Kulkarni <coolsvap@redhat.com>
Date: Thu, 16 Oct 2014 06:30:28 +0000
Subject: [PATCH 0015/3333] Update multiple backend configuration in tempest
 script

Currently when we configure the tempest with multiple LVM
backends the backend names are created as LVM_iSCSI and
LVM_iSCSI_2 which fails since the backends created by cinder
are lvmdriver-1 and lvmdriver-2.

This patch updates the backend names. Added support for
CINDER_ENABLED_BACKENDS and added todo to remove
CINDER_MULTI_LVM_BACKEND once its formally removed

Closes-Bug:#1369946
Closes-Bug:#1369942

Change-Id: If44f5eb206616afb0fbaf333f3fa6a296d4650cd
---
 lib/tempest | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d677c7e33c..40d223bd91 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -28,6 +28,7 @@
 # - ``DEFAULT_INSTANCE_TYPE``
 # - ``DEFAULT_INSTANCE_USER``
 # - ``CINDER_MULTI_LVM_BACKEND``
+# - ``CINDER_ENABLED_BACKENDS``
 #
 # ``stack.sh`` calls the entry points in this order:
 #
@@ -362,11 +363,17 @@ function configure_tempest {
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi
-    CINDER_MULTI_LVM_BACKEND=$(trueorfalse False $CINDER_MULTI_LVM_BACKEND)
-    if [ $CINDER_MULTI_LVM_BACKEND == "True" ]; then
+
+    # Using CINDER_ENABLED_BACKENDS
+    if [[ -n "$CINDER_ENABLED_BACKENDS" ]] && [[ $CINDER_ENABLED_BACKENDS =~ .*,.* ]]; then
         iniset $TEMPEST_CONFIG volume-feature-enabled multi_backend "True"
-        iniset $TEMPEST_CONFIG volume backend1_name "LVM_iSCSI"
-        iniset $TEMPEST_CONFIG volume backend2_name "LVM_iSCSI_2"
+        local i=1
+        local be
+        for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+            local be_name=${be##*:}
+            iniset $TEMPEST_CONFIG volume "backend${i}_name" "$be_name"
+            i=$(( i + 1 ))
+        done
     fi
 
     if [ $TEMPEST_VOLUME_DRIVER != "default" ]; then

From 3d6d89935f13635d3fe982ccf870c017155ea903 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Wed, 15 Oct 2014 16:30:15 +0000
Subject: [PATCH 0016/3333] Update the OpenDaylight support to the Helium
 release

The OpenDaylight project recently released their latest release, codenamed
Helium. This commit updates the devstack support for OpenDaylight to this
new version, which includes changes to configuration files as well as the
startup of OpenDaylight itself.

Also update my email address in MAINTAINERS.rst.

Change-Id: I124b5e7e8ef7feb6c90de907916a9530409c4ad4
---
 MAINTAINERS.rst  |  2 +-
 lib/opendaylight | 36 ++++++++++++++++++++++++++----------
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index d754c08e74..d55135de64 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -48,7 +48,7 @@ Neutron
 OpenDaylight
 ~~~~~~~~~~~~
 
-* Kyle Mestery <kmestery@cisco.com>
+* Kyle Mestery <mestery@mestery.com>
 
 OpenFlow Agent (ofagent)
 ~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/lib/opendaylight b/lib/opendaylight
index cc29debd05..374de953c6 100644
--- a/lib/opendaylight
+++ b/lib/opendaylight
@@ -48,10 +48,10 @@ ODL_PASSWORD=${ODL_PASSWORD:-admin}
 ODL_DIR=$DEST/opendaylight
 
 # The OpenDaylight Package, currently using 'Hydrogen' release
-ODL_PKG=${ODL_PKG:-distributions-virtualization-0.1.1-osgipackage.zip}
+ODL_PKG=${ODL_PKG:-distribution-karaf-0.2.0-Helium.zip}
 
 # The OpenDaylight URL
-ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/repositories/opendaylight.release/org/opendaylight/integration/distributions-virtualization/0.1.1}
+ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/groups/public/org/opendaylight/integration/distribution-karaf/0.2.0-Helium}
 
 # Default arguments for OpenDaylight. This is typically used to set
 # Java memory options.
@@ -59,11 +59,14 @@ ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/repositories/opendayli
 ODL_ARGS=${ODL_ARGS:-"-XX:MaxPermSize=384m"}
 
 # How long to pause after ODL starts to let it complete booting
-ODL_BOOT_WAIT=${ODL_BOOT_WAIT:-60}
+ODL_BOOT_WAIT=${ODL_BOOT_WAIT:-20}
 
 # The physical provider network to device mapping
 ODL_PROVIDER_MAPPINGS=${ODL_PROVIDER_MAPPINGS:-physnet1:eth1}
 
+# Enable OpenDaylight l3 forwarding
+ODL_L3=${ODL_L3:-False}
+
 
 # Entry Points
 # ------------
@@ -83,11 +86,26 @@ function cleanup_opendaylight {
 
 # configure_opendaylight() - Set config files, create data dirs, etc
 function configure_opendaylight {
-    # Remove simple forwarder
-    rm -f $ODL_DIR/opendaylight/plugins/org.opendaylight.controller.samples.simpleforwarding*
+    # Add odl-ovsdb-openstack if it's not already there
+    local ODLOVSDB=$(cat $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/org.apache.karaf.features.cfg | grep featuresBoot= | grep odl)
+    if [ "$ODLOVSDB" == "" ]; then
+        sed -i '/^featuresBoot=/ s/$/,odl-ovsdb-openstack/' $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/org.apache.karaf.features.cfg
+    fi
 
-    # Configure OpenFlow 1.3
-    echo "ovsdb.of.version=1.3" >> $ODL_DIR/opendaylight/configuration/config.ini
+    # Configure OpenFlow 1.3 if it's not there
+    local OFLOW13=$(cat $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties | grep ^of.version)
+    if [ "$OFLOW13" == "" ]; then
+        echo "ovsdb.of.version=1.3" >> $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties
+    fi
+
+    # Configure L3 if the user wants it
+    if [ "${ODL_L3}" == "True" ]; then
+        # Configure L3 FWD if it's not there
+        local L3FWD=$(cat $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties | grep ^ovsdb.l3.fwd.enabled)
+        if [ "$L3FWD" == "" ]; then
+            echo "ovsdb.l3.fwd.enabled=yes" >> $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties
+        fi
+    fi
 }
 
 function configure_ml2_odl {
@@ -138,9 +156,7 @@ function start_opendaylight {
     #   -of13: runs ODL using OpenFlow 1.3 protocol support.
     #   -virt ovsdb: Runs ODL in "virtualization" mode with OVSDB support
 
-    # NOTE(chdent): Leaving this as screen_it instead of run_process until
-    # the right thing for this service is determined.
-    screen_it odl-server "cd $ODL_DIR/opendaylight && JAVA_HOME=$JHOME ./run.sh $ODL_ARGS -of13 -virt ovsdb"
+    run_process odl-server "cd $ODL_DIR/distribution-karaf-0.2.0-Helium && JAVA_HOME=$JHOME bin/karaf"
 
     # Sleep a bit to let OpenDaylight finish starting up
     sleep $ODL_BOOT_WAIT

From 0f18c23de880a38c15aa4bb5d3a8f114f48dfe20 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Fri, 12 Sep 2014 23:44:58 +0900
Subject: [PATCH 0017/3333] ofagent: Support physical_interface_mappings

Also, add a knob to create a veth pair instead of a bridge
to provide host connectivity for l3-agent.  (Q_USE_PUBLIC_VETH)

Related: blueprint ofagent-physical-interface-mappings
Change-Id: I4c2538f0fd3fb05bfdb69e7e4c3a8462af42ba10
---
 lib/neutron                       | 39 ++++++++++++++++++++++++-------
 lib/neutron_plugins/ofagent_agent |  4 ++++
 lib/neutron_plugins/ovs_base      | 19 +++++++++++----
 3 files changed, 49 insertions(+), 13 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 2253eda772..ca9b16cd8c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -148,16 +148,31 @@ PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
 # If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
 # for external interface of neutron l3-agent.  In that case,
 # PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
-# used for the network.  In case of openvswitch agent, you should
-# add the corresponding entry to your OVS_BRIDGE_MAPPINGS.
+# used for the network.  In case of ofagent, you should add the
+# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
+# For openvswitch agent, you should add the corresponding entry to
+# your OVS_BRIDGE_MAPPINGS.
 #
-# eg.
+# eg.  (ofagent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    Q_USE_PUBLIC_VETH=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
+#
+# eg.  (openvswitch agent)
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
 Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
+# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
+# PUBLIC_BRIDGE.  This is intended to be used with
+# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
+Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
+Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
+Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
+
 # The next two variables are configured by plugin
 # e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
 #
@@ -543,12 +558,20 @@ function create_neutron_initial_network {
         if is_service_enabled q-l3; then
             # logic is specific to using the l3-agent for l3
             if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-                # Disable in-band as we are going to use local port
-                # to communicate with VMs
-                sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE other_config:disable-in-band=true
+                local ext_gw_interface
+
+                if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
+                    ext_gw_interface=$Q_PUBLIC_VETH_EX
+                else
+                    # Disable in-band as we are going to use local port
+                    # to communicate with VMs
+                    sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+                        other_config:disable-in-band=true
+                    ext_gw_interface=$PUBLIC_BRIDGE
+                fi
                 CIDR_LEN=${FLOATING_RANGE#*/}
-                sudo ip addr add $EXT_GW_IP/$CIDR_LEN dev $PUBLIC_BRIDGE
-                sudo ip link set $PUBLIC_BRIDGE up
+                sudo ip addr add $EXT_GW_IP/$CIDR_LEN dev $ext_gw_interface
+                sudo ip link set $ext_gw_interface up
                 ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' '{ print $8; }'`
                 die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
                 sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP
diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index a5a58f4c27..1c04f2f64e 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -77,6 +77,10 @@ function neutron_plugin_configure_plugin_agent {
     if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS
     fi
+    if [[ "$OFAGENT_PHYSICAL_INTERFACE_MAPPINGS" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE agent physical_interface_mappings \
+            $OFAGENT_PHYSICAL_INTERFACE_MAPPINGS
+    fi
     AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-ofagent-agent"
 
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index d913f7c3cc..f0ef194569 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -79,11 +79,20 @@ function _neutron_ovs_base_configure_l3_agent {
     fi
 
     neutron-ovs-cleanup
-    # --no-wait causes a race condition if $PUBLIC_BRIDGE is not up when ip addr flush is called
-    sudo ovs-vsctl -- --may-exist add-br $PUBLIC_BRIDGE
-    sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
-    # ensure no IP is configured on the public bridge
-    sudo ip addr flush dev $PUBLIC_BRIDGE
+    if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
+        ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||
+        sudo ip link add $Q_PUBLIC_VETH_INT type veth \
+            peer name $Q_PUBLIC_VETH_EX
+        sudo ip link set $Q_PUBLIC_VETH_INT up
+        sudo ip link set $Q_PUBLIC_VETH_EX up
+        sudo ip addr flush dev $Q_PUBLIC_VETH_EX
+    else
+        # --no-wait causes a race condition if $PUBLIC_BRIDGE is not up when ip addr flush is called
+        sudo ovs-vsctl -- --may-exist add-br $PUBLIC_BRIDGE
+        sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
+        # ensure no IP is configured on the public bridge
+        sudo ip addr flush dev $PUBLIC_BRIDGE
+    fi
 }
 
 function _neutron_ovs_base_configure_nova_vif_driver {

From e35785d910995c05a3e43af51080c6c6c5631ec7 Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Thu, 16 Oct 2014 15:40:03 +0200
Subject: [PATCH 0018/3333] XenAPI: Always update proxy settings

If a user wants to re-use an xva just with different proxy settings, he
can now do it, as this change will always update /etc/apt/apt.conf to
reflect the settings in the user's localrc.

Change-Id: I8a6e9c88304bc887ea8269d946e89a5ba258b126
---
 tools/xen/prepare_guest_template.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/xen/prepare_guest_template.sh b/tools/xen/prepare_guest_template.sh
index 2d3b89821f..50f2b6a825 100755
--- a/tools/xen/prepare_guest_template.sh
+++ b/tools/xen/prepare_guest_template.sh
@@ -118,3 +118,10 @@ deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security univer
 deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
 deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
 EOF
+
+rm -f $STAGING_DIR/etc/apt/apt.conf
+if [ -n "$UBUNTU_INST_HTTP_PROXY" ]; then
+    cat > $STAGING_DIR/etc/apt/apt.conf << EOF
+Acquire::http::Proxy "$UBUNTU_INST_HTTP_PROXY";
+EOF
+fi

From 6518c0b88ea52e93513fa34dd63eeb4596875212 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 15 Oct 2014 17:26:59 +0900
Subject: [PATCH 0019/3333] Compile Horizon message catalogs during stack.sh

Recently compiled message catalogs (mo files) were removed
in Horizon and django_openstack_auth repositories.
We need to compile message catalogs to make translations
available for Horizon users. It is useful for developers too.

Change-Id: I0831e8308205c116d8e3bb8b43be7f0dd6fa0c0a
---
 files/apts/general |  1 +
 files/rpms/general |  1 +
 lib/horizon        | 22 ++++++++++++++++++++++
 3 files changed, 24 insertions(+)

diff --git a/files/apts/general b/files/apts/general
index c308c466e3..3fe7863de2 100644
--- a/files/apts/general
+++ b/files/apts/general
@@ -27,3 +27,4 @@ bc
 libyaml-dev
 libffi-dev
 libssl-dev # for pyOpenSSL
+gettext  # used for compiling message catalogs
diff --git a/files/rpms/general b/files/rpms/general
index 7a35961bc2..d4a9fcba55 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,6 +26,7 @@ wget
 which
 bc
 libyaml-devel
+gettext  # used for compiling message catalogs
 
 # [1] : some of installed tools have unversioned dependencies on this,
 # but others have versioned (<=0.7).  So if a later version (0.7.1)
diff --git a/lib/horizon b/lib/horizon
index 755be18f3c..0213948633 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -84,6 +84,14 @@ function cleanup_horizon {
 # configure_horizon() - Set config files, create data dirs, etc
 function configure_horizon {
     setup_develop $HORIZON_DIR
+
+    # Compile message catalogs.
+    # Horizon is installed as develop mode, so we can compile here.
+    # Message catalog compilation is handled by Django admin script,
+    # so compiling them after the installation avoids Django installation twice.
+    cd $HORIZON_DIR
+    ./run_tests.sh -N --compilemessages
+    cd -
 }
 
 # init_horizon() - Initialize databases, etc.
@@ -138,6 +146,13 @@ function init_horizon {
 # install_django_openstack_auth() - Collect source and prepare
 function install_django_openstack_auth {
     git_clone $HORIZONAUTH_REPO $HORIZONAUTH_DIR $HORIZONAUTH_BRANCH
+
+    # Compile message catalogs before installation
+    _prepare_message_catalog_compilation
+    cd $HORIZONAUTH_DIR
+    python setup.py compile_catalog
+    cd -
+
     setup_install $HORIZONAUTH_DIR
 }
 
@@ -160,6 +175,13 @@ function stop_horizon {
     stop_apache_server
 }
 
+# NOTE: It can be moved to common functions, but it is only used by compilation
+# of django_openstack_auth catalogs at the moment.
+function _prepare_message_catalog_compilation {
+    local babel_package=$(grep ^Babel $REQUIREMENTS_DIR/global-requirements.txt)
+    pip_install "$babel_package"
+}
+
 
 # Restore xtrace
 $XTRACE

From 8abd8598b3ba7dce126db7553dfc704e5a343966 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 8 Oct 2014 15:24:25 +0100
Subject: [PATCH 0020/3333] Allow use of ceilometer agent coordination

Juno brings tooz-based coordination of ceilometer central, compute
and alarm agents. If CEILOMETER_COORDINATION_URL is set it will be
used as the value for a tooz coordination backend. If memcached is
chosen, its package will be installed. Other backends, such as
zookeeper can be configured, but installation is left as an exercise
for the devstacker.

In the default devstack setup having coordination will do little as
there are only one of each agent, but this makes it a bit easier for
multi-node or multi-agent setups.

Change-Id: Ib85ccd435de3bc0ae56b5fe8c2fce6c2af9ff8d0
---
 lib/ceilometer | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/ceilometer b/lib/ceilometer
index db0c457262..9046b9d3d9 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -155,6 +155,11 @@ function configure_ceilometer {
     iniset $CEILOMETER_CONF DEFAULT verbose True
     iniset $CEILOMETER_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
 
+    if [[ -n "$CEILOMETER_COORDINATION_URL" ]]; then
+        iniset $CEILOMETER_CONF coordination backend_url $CEILOMETER_COORDINATION_URL
+        iniset $CEILOMETER_CONF compute workload_partitioning True
+    fi
+
     # Install the policy file for the API server
     cp $CEILOMETER_DIR/etc/ceilometer/policy.json $CEILOMETER_CONF_DIR
     iniset $CEILOMETER_CONF DEFAULT policy_file $CEILOMETER_CONF_DIR/policy.json
@@ -242,6 +247,9 @@ function install_ceilometer {
     git_clone $CEILOMETER_REPO $CEILOMETER_DIR $CEILOMETER_BRANCH
     setup_develop $CEILOMETER_DIR
 
+    if echo $CEILOMETER_COORDINATION_URL | grep -q '^memcached:'; then
+        install_package memcached
+    fi
 }
 
 # install_ceilometerclient() - Collect source and prepare

From 2a6215dd11400b74b7e5d6db96b44e6a74cfe291 Mon Sep 17 00:00:00 2001
From: Rob <rcresswe@cisco.com>
Date: Mon, 20 Oct 2014 13:28:47 +0100
Subject: [PATCH 0021/3333] Fix empty functions causing stack failure

This patch adds a return value to several empty functions that are causing stack.sh to fail when the
Cisco Neutron plugin is enabled.

Change-Id: I43987d9cc5edc53de41c27354c3a737643d1cd43
Closes-bug: 1383273
---
 lib/neutron_plugins/cisco | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index 1406e3790c..95e0ab3368 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -82,6 +82,7 @@ function neutron_plugin_configure_common {
 }
 
 function neutron_plugin_configure_debug_command {
+    :
 }
 
 function neutron_plugin_configure_dhcp_agent {
@@ -89,6 +90,7 @@ function neutron_plugin_configure_dhcp_agent {
 }
 
 function neutron_plugin_configure_l3_agent {
+    :
 }
 
 # Configure n1kv plugin
@@ -111,6 +113,7 @@ function _configure_n1kv_subplugin {
 }
 
 function neutron_plugin_configure_plugin_agent {
+    :
 }
 
 function neutron_plugin_configure_service {

From 22ec45e63a45bb38f63ca995446338859dacb207 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Thu, 16 Oct 2014 17:41:22 -0700
Subject: [PATCH 0022/3333] Move generation of baremetal VM names to lib/ironic

The create-nodes script currently receives a total # of VMs to create
and creates them all, generating their names on the fly.  This moves
that name generation to lib/ironic and makes the script create only
single VMs as directed.  This centralizes the naming of things to
lib/ironic and will make it easier to reference these things elsewhere.

Change-Id: I98e61f7188e027e690303e32aff7cd2347f6d2c2
---
 lib/ironic                                    | 27 ++++++--
 tools/ironic/scripts/cleanup-node             | 25 ++++++++
 tools/ironic/scripts/cleanup-nodes            | 28 ---------
 .../scripts/{create-nodes => create-node}     | 63 +++++++++----------
 4 files changed, 76 insertions(+), 67 deletions(-)
 create mode 100755 tools/ironic/scripts/cleanup-node
 delete mode 100755 tools/ironic/scripts/cleanup-nodes
 rename tools/ironic/scripts/{create-nodes => create-node} (52%)

diff --git a/lib/ironic b/lib/ironic
index 5f3ebcd354..1541dcfb33 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -354,6 +354,15 @@ function init_ironic {
     create_ironic_cache_dir
 }
 
+# _ironic_bm_vm_names() - Generates list of names for baremetal VMs.
+function _ironic_bm_vm_names {
+    local idx
+    local num_vms=$(($IRONIC_VM_COUNT - 1))
+    for idx in $(seq 0 $num_vms); do
+        echo "baremetal${IRONIC_VM_NETWORK_BRIDGE}_${idx}"
+    done
+}
+
 # start_ironic() - Start running processes, including screen
 function start_ironic {
     # Start Ironic API server, if enabled.
@@ -449,10 +458,13 @@ function create_bridge_and_vms {
     else
         local log_arg=""
     fi
-    sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/create-nodes \
-        $IRONIC_VM_SPECS_CPU $IRONIC_VM_SPECS_RAM $IRONIC_VM_SPECS_DISK \
-        amd64 $IRONIC_VM_COUNT $IRONIC_VM_NETWORK_BRIDGE $IRONIC_VM_EMULATOR \
-        $log_arg" >> $IRONIC_VM_MACS_CSV_FILE
+    local vm_name
+    for vm_name in $(_ironic_bm_vm_names); do
+        sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/create-node $vm_name \
+            $IRONIC_VM_SPECS_CPU $IRONIC_VM_SPECS_RAM $IRONIC_VM_SPECS_DISK \
+            amd64 $IRONIC_VM_NETWORK_BRIDGE $IRONIC_VM_EMULATOR \
+            $log_arg" >> $IRONIC_VM_MACS_CSV_FILE
+    done
     create_ovs_taps
 }
 
@@ -655,7 +667,12 @@ function cleanup_baremetal_basic_ops {
         chmod 0600 $IRONIC_AUTHORIZED_KEYS_FILE
     fi
     sudo rm -rf $IRONIC_DATA_DIR $IRONIC_STATE_PATH
-    sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/cleanup-nodes $IRONIC_VM_COUNT $IRONIC_VM_NETWORK_BRIDGE"
+
+    local vm_name
+    for vm_name in $(_ironic_bm_vm_names); do
+        sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/cleanup-node $vm_name $IRONIC_VM_NETWORK_BRIDGE"
+    done
+
     sudo rm -rf /etc/xinetd.d/tftp /etc/init/tftpd-hpa.override
     restart_service xinetd
     sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
diff --git a/tools/ironic/scripts/cleanup-node b/tools/ironic/scripts/cleanup-node
new file mode 100755
index 0000000000..c4e4e706f4
--- /dev/null
+++ b/tools/ironic/scripts/cleanup-node
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+# **cleanup-nodes**
+
+# Cleans up baremetal poseur nodes and volumes created during ironic setup
+# Assumes calling user has proper libvirt group membership and access.
+
+set -exu
+
+LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
+LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
+
+NAME=$1
+NETWORK_BRIDGE=$2
+
+export VIRSH_DEFAULT_CONNECT_URI=$LIBVIRT_CONNECT_URI
+
+VOL_NAME="$NAME.qcow2"
+virsh list | grep -q $NAME && virsh destroy $NAME
+virsh list --inactive | grep -q $NAME && virsh undefine $NAME
+
+if virsh pool-list | grep -q $LIBVIRT_STORAGE_POOL ; then
+  virsh vol-list $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
+      virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL
+fi
diff --git a/tools/ironic/scripts/cleanup-nodes b/tools/ironic/scripts/cleanup-nodes
deleted file mode 100755
index adeca5cd9e..0000000000
--- a/tools/ironic/scripts/cleanup-nodes
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-# **cleanup-nodes**
-
-# Cleans up baremetal poseur nodes and volumes created during ironic setup
-# Assumes calling user has proper libvirt group membership and access.
-
-set -exu
-
-LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-VM_COUNT=$1
-NETWORK_BRIDGE=$2
-
-export VIRSH_DEFAULT_CONNECT_URI=$LIBVIRT_CONNECT_URI
-
-for (( idx=0; idx<$VM_COUNT; idx++ )); do
-    NAME="baremetal${NETWORK_BRIDGE}_${idx}"
-    VOL_NAME="baremetal${NETWORK_BRIDGE}-${idx}.qcow2"
-    virsh list | grep -q $NAME && virsh destroy $NAME
-    virsh list --inactive | grep -q $NAME && virsh undefine $NAME
-
-    if virsh pool-list | grep -q $LIBVIRT_STORAGE_POOL ; then
-      virsh vol-list $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
-          virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL
-    fi
-done
diff --git a/tools/ironic/scripts/create-nodes b/tools/ironic/scripts/create-node
similarity index 52%
rename from tools/ironic/scripts/create-nodes
rename to tools/ironic/scripts/create-node
index 140bffe46f..25b53d47f3 100755
--- a/tools/ironic/scripts/create-nodes
+++ b/tools/ironic/scripts/create-node
@@ -9,19 +9,19 @@ set -ex
 # Keep track of the devstack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
-CPU=$1
-MEM=$(( 1024 * $2 ))
+NAME=$1
+CPU=$2
+MEM=$(( 1024 * $3 ))
 # extra G to allow fuzz for partition table : flavor size and registered size
 # need to be different to actual size.
-DISK=$(( $3 + 1))
+DISK=$(( $4 + 1))
 
-case $4 in
+case $5 in
     i386) ARCH='i686' ;;
     amd64) ARCH='x86_64' ;;
     *) echo "Unsupported arch $4!" ; exit 1 ;;
 esac
 
-TOTAL=$(($5 - 1))
 BRIDGE=$6
 EMULATOR=$7
 LOGDIR=$8
@@ -53,32 +53,27 @@ if [ -f /etc/debian_version ]; then
     PREALLOC="--prealloc-metadata"
 fi
 
-DOMS=""
-for idx in $(seq 0 $TOTAL) ; do
-    NAME="baremetal${BRIDGE}_${idx}"
-    if [ -n "$LOGDIR" ] ; then
-      VM_LOGGING="--console-log $LOGDIR/${NAME}_console.log"
-    else
-      VM_LOGGING=""
-    fi
-    DOMS="$DOMS $NAME"
-    VOL_NAME="baremetal${BRIDGE}-${idx}.qcow2"
-    (virsh list --all | grep -q $NAME) && continue
-
-    virsh vol-list --pool $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
-        virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL >&2
-    virsh vol-create-as $LIBVIRT_STORAGE_POOL ${VOL_NAME} ${DISK}G --format qcow2 $PREALLOC >&2
-    volume_path=$(virsh vol-path --pool $LIBVIRT_STORAGE_POOL $VOL_NAME)
-    # Pre-touch the VM to set +C, as it can only be set on empty files.
-    sudo touch "$volume_path"
-    sudo chattr +C "$volume_path" || true
-    $TOP_DIR/scripts/configure-vm \
-      --bootdev network --name $NAME --image "$volume_path" \
-      --arch $ARCH --cpus $CPU --memory $MEM --libvirt-nic-driver $LIBVIRT_NIC_DRIVER \
-      --emulator $EMULATOR --network $BRIDGE $VM_LOGGING >&2
-done
-
-for dom in $DOMS ; do
-    # echo mac
-    virsh dumpxml $dom | grep "mac address" | head -1 | cut -d\' -f2
-done
+if [ -n "$LOGDIR" ] ; then
+  VM_LOGGING="--console-log $LOGDIR/${NAME}_console.log"
+else
+  VM_LOGGING=""
+fi
+VOL_NAME="${NAME}.qcow2"
+
+if ! virsh list --all | grep -q $NAME; then
+  virsh vol-list --pool $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
+      virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL >&2
+  virsh vol-create-as $LIBVIRT_STORAGE_POOL ${VOL_NAME} ${DISK}G --format qcow2 $PREALLOC >&2
+  volume_path=$(virsh vol-path --pool $LIBVIRT_STORAGE_POOL $VOL_NAME)
+  # Pre-touch the VM to set +C, as it can only be set on empty files.
+  sudo touch "$volume_path"
+  sudo chattr +C "$volume_path" || true
+  $TOP_DIR/scripts/configure-vm \
+    --bootdev network --name $NAME --image "$volume_path" \
+    --arch $ARCH --cpus $CPU --memory $MEM --libvirt-nic-driver $LIBVIRT_NIC_DRIVER \
+    --emulator $EMULATOR --network $BRIDGE $VM_LOGGING >&2
+
+fi
+
+# echo mac
+virsh dumpxml $NAME | grep "mac address" | head -1 | cut -d\' -f2

From 8543a0f763c1f4fcc3ca7e13efece54a0ff7fbb6 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Thu, 16 Oct 2014 17:42:33 -0700
Subject: [PATCH 0023/3333] Make screen_service() useful for more than services

screen_service() can currently only be used to launch things that
pass the 'is_service_enabled' check, even though its calling functions
will have already done this.  This removes such check, renames it
to screen_process() and updates its usage elsewhere.

Change-Id: I480a4560a45b131a95c1b2d2d2379aeba542a9bc
---
 functions-common | 72 +++++++++++++++++++++++-------------------------
 1 file changed, 35 insertions(+), 37 deletions(-)

diff --git a/functions-common b/functions-common
index 333f31da02..e6f425f4a1 100644
--- a/functions-common
+++ b/functions-common
@@ -1251,7 +1251,7 @@ function run_process {
 
     if is_service_enabled $service; then
         if [[ "$USE_SCREEN" = "True" ]]; then
-            screen_service "$service" "$command" "$group"
+            screen_process "$service" "$command" "$group"
         else
             # Spawn directly without screen
             _run_process "$service" "$command" "$group" &
@@ -1259,14 +1259,14 @@ function run_process {
     fi
 }
 
-# Helper to launch a service in a named screen
+# Helper to launch a process in a named screen
 # Uses globals ``CURRENT_LOG_TIME``, ``SCREEN_NAME``, ``SCREEN_LOGDIR``,
 # ``SERVICE_DIR``, ``USE_SCREEN``
-# screen_service service "command-line" [group]
+# screen_process name "command-line" [group]
 # Run a command in a shell in a screen window, if an optional group
 # is provided, use sg to set the group of the command.
-function screen_service {
-    local service=$1
+function screen_process {
+    local name=$1
     local command="$2"
     local group=$3
 
@@ -1274,38 +1274,36 @@ function screen_service {
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
     USE_SCREEN=$(trueorfalse True $USE_SCREEN)
 
-    if is_service_enabled $service; then
-        # Append the service to the screen rc file
-        screen_rc "$service" "$command"
-
-        screen -S $SCREEN_NAME -X screen -t $service
-
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            screen -S $SCREEN_NAME -p $service -X logfile ${SCREEN_LOGDIR}/screen-${service}.${CURRENT_LOG_TIME}.log
-            screen -S $SCREEN_NAME -p $service -X log on
-            ln -sf ${SCREEN_LOGDIR}/screen-${service}.${CURRENT_LOG_TIME}.log ${SCREEN_LOGDIR}/screen-${service}.log
-        fi
+    # Append the process to the screen rc file
+    screen_rc "$name" "$command"
 
-        # sleep to allow bash to be ready to be send the command - we are
-        # creating a new window in screen and then sends characters, so if
-        # bash isn't running by the time we send the command, nothing happens
-        sleep 3
+    screen -S $SCREEN_NAME -X screen -t $name
 
-        NL=`echo -ne '\015'`
-        # This fun command does the following:
-        # - the passed server command is backgrounded
-        # - the pid of the background process is saved in the usual place
-        # - the server process is brought back to the foreground
-        # - if the server process exits prematurely the fg command errors
-        # and a message is written to stdout and the service failure file
-        #
-        # The pid saved can be used in stop_process() as a process group
-        # id to kill off all child processes
-        if [[ -n "$group" ]]; then
-            command="sg $group '$command'"
-        fi
-        screen -S $SCREEN_NAME -p $service -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${service}.pid; fg || echo \"$service failed to start\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${service}.failure\"$NL"
+    if [[ -n ${SCREEN_LOGDIR} ]]; then
+        screen -S $SCREEN_NAME -p $name -X logfile ${SCREEN_LOGDIR}/screen-${name}.${CURRENT_LOG_TIME}.log
+        screen -S $SCREEN_NAME -p $name -X log on
+        ln -sf ${SCREEN_LOGDIR}/screen-${name}.${CURRENT_LOG_TIME}.log ${SCREEN_LOGDIR}/screen-${name}.log
+    fi
+
+    # sleep to allow bash to be ready to be send the command - we are
+    # creating a new window in screen and then sends characters, so if
+    # bash isn't running by the time we send the command, nothing happens
+    sleep 3
+
+    NL=`echo -ne '\015'`
+    # This fun command does the following:
+    # - the passed server command is backgrounded
+    # - the pid of the background process is saved in the usual place
+    # - the server process is brought back to the foreground
+    # - if the server process exits prematurely the fg command errors
+    # and a message is written to stdout and the process failure file
+    #
+    # The pid saved can be used in stop_process() as a process group
+    # id to kill off all child processes
+    if [[ -n "$group" ]]; then
+        command="sg $group '$command'"
     fi
+    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
 }
 
 # Screen rc file builder
@@ -1412,12 +1410,12 @@ function service_check {
 
 # Tail a log file in a screen if USE_SCREEN is true.
 function tail_log {
-    local service=$1
+    local name=$1
     local logfile=$2
 
     USE_SCREEN=$(trueorfalse True $USE_SCREEN)
     if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_service "$service" "sudo tail -f $logfile"
+        screen_process "$name" "sudo tail -f $logfile"
     fi
 }
 
@@ -1476,7 +1474,7 @@ function screen_it {
         screen_rc "$1" "$2"
 
         if [[ "$USE_SCREEN" = "True" ]]; then
-            screen_service "$1" "$2"
+            screen_process "$1" "$2"
         else
             # Spawn directly without screen
             old_run_process "$1" "$2" >$SERVICE_DIR/$SCREEN_NAME/$1.pid

From 761c456a4e89802d2f78a8dbdc5f20d71716f7dd Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 21 Oct 2014 11:41:37 +1100
Subject: [PATCH 0024/3333] Remove usage of $[ for arithmetic, take 2

I did a similar change in I8ba180be036836f37ebdbb6da36ff0be486c043e
but I guess somehow missed these ... maybe I forgot to add them to the
change.

As described originally, this causes TOT bashate to fail, so fix this
up before it gets released.

Change-Id: I5580cb46f1c8bd71c631549aab78428d95a6dc51
---
 lib/swift | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/swift b/lib/swift
index 15bd2a9471..0b9b89369e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -196,9 +196,9 @@ function _config_swift_apache_wsgi {
     # copy apache vhost file and set name and port
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do
-        local object_port=$[OBJECT_PORT_BASE + 10 * ($node_number - 1)]
-        local container_port=$[CONTAINER_PORT_BASE + 10 * ($node_number - 1)]
-        local account_port=$[ACCOUNT_PORT_BASE + 10 * ($node_number - 1)]
+        local object_port=$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))
+        local container_port=$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))
+        local account_port=$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))
 
         sudo cp ${SWIFT_DIR}/examples/apache2/object-server.template $(apache_site_config_for object-server-${node_number})
         sudo sed -e "
@@ -257,7 +257,7 @@ function generate_swift_config_services {
     local bind_port=$3
     local server_type=$4
 
-    log_facility=$[ node_id - 1 ]
+    log_facility=$(( node_id - 1 ))
     local node_path=${SWIFT_DATA_DIR}/${node_number}
 
     iniuncomment ${swift_node_config} DEFAULT user

From eaff3e1b8c7133e4a5ea8a783e23536871be409a Mon Sep 17 00:00:00 2001
From: Adrien Cunin <adrien.cunin@osones.com>
Date: Tue, 21 Oct 2014 13:46:54 +0200
Subject: [PATCH 0025/3333] Reference git.o.o DevStack repo rather than GitHub

In docs, use git.o.o URLs rather than GitHub URLs for the DevStack repo,
and don't mention GitHub when git.o.o is more appropriate.
Also, replaced GitHub logo with Git logo in quickstart.png.

Change-Id: Iab0006144f008963b8cb5be2d10ce0f360c0e6ca
---
 HACKING.rst                             |   4 ++--
 doc/source/assets/css/local.css         |   4 ++--
 doc/source/assets/images/quickstart.png | Bin 12375 -> 9491 bytes
 doc/source/changes.html                 |   2 +-
 doc/source/configuration.html           |   2 +-
 doc/source/contributing.html            |   4 ++--
 doc/source/eucarc.html                  |   2 +-
 doc/source/exerciserc.html              |   2 +-
 doc/source/faq.html                     |   4 ++--
 doc/source/guides/multinode-lab.html    |   6 +++---
 doc/source/guides/pxe-boot.html         |   2 +-
 doc/source/guides/ramdisk.html          |   4 ++--
 doc/source/guides/single-machine.html   |   4 ++--
 doc/source/guides/single-vm.html        |   4 ++--
 doc/source/guides/usb-boot.html         |   2 +-
 doc/source/index.html                   |  10 +++++-----
 doc/source/local.conf.html              |   2 +-
 doc/source/localrc.html                 |   2 +-
 doc/source/openrc.html                  |   2 +-
 doc/source/overview.html                |   2 +-
 doc/source/plugins.html                 |   2 +-
 doc/source/stackrc.html                 |   2 +-
 22 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d69bb49286..3b86529ec0 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -10,8 +10,8 @@ and so is limited to Bash (version 3 and up) and compatible shells.
 Shell script was chosen because it best illustrates the steps used to
 set up and interact with OpenStack components.
 
-DevStack's official repository is located on GitHub at
-https://github.com/openstack-dev/devstack.git.  Besides the master branch that
+DevStack's official repository is located on git.openstack.org at
+https://git.openstack.org/openstack-dev/devstack.  Besides the master branch that
 tracks the OpenStack trunk branches a separate branch is maintained for all
 OpenStack releases starting with Diablo (stable/diablo).
 
diff --git a/doc/source/assets/css/local.css b/doc/source/assets/css/local.css
index 5c703af3e4..c8667c45ff 100644
--- a/doc/source/assets/css/local.css
+++ b/doc/source/assets/css/local.css
@@ -71,7 +71,7 @@ li#ubuntu {
 	margin-bottom: 14px;
 }
 
-li#github {
+li#git {
 	background-position: left -70px !important;
 	height: 61px;
 	padding: ;
@@ -119,4 +119,4 @@ footer {
 
 .wat {
 	margin-top: 33px;
-}
\ No newline at end of file
+}
diff --git a/doc/source/assets/images/quickstart.png b/doc/source/assets/images/quickstart.png
index 5400a6f4df111ce1f9bc92bf285cae540840fb9f..735617b8cd4845e1afa9b85524c96d9015fbc410 100644
GIT binary patch
literal 9491
zcmXY11yCGK6WzltcyM=!AVCjz3-0a~oWu2k1PyXPfN;1&&>+D{fP)0r1b5fq65zkD
z>aX42shZm9s+sA2ue)brHPscL;ZWfK0Psv%NlqKt$|Ge23j_H*cI$*A8w_hzMLFQ<
zzbC)5EEU;<?V)4@0RUW*{{#elhEpIrF};=5<T00Vp5xNLQd69{1po#>Sx#ElfBwiU
zz+ZP}DReA{^_~w~nE~ww6(P?{>^P?U7~Ht>>8&b5SLMFG+NRkOy{c-T+HW&sNyP&7
zzarxD#TqJJ#xbP#qp=c7C9`4^Dk%-}DYK<!iLB6H`@vHGjt=MiWRaE_JzsQyWwqyA
zKh9qN8*RngQ5qWLw7g(1QsY;rjywO_nhU9ipy6Rifh>zhq@LOxA%Mpu`!zbgC?=o<
zWCEF>$VoDp6$s!9R0GDlQ}{hw&nSHH0c#9G3<fHxi$zKs1$9-8oYi$xE1<UAjU&kS
z@26^DAH<L1$mAi0at^_e2Z-@|ynMEki3o;U9nA|_t&{J&)S8>`!fLo4f8Set3MI%V
zgQi0#bXj}H3{~)ox#|rZ@LN~i{WOBaz)ZzSvyb*gj2Ey8&eRdM-k-Gh8gP_x1wn+K
zQR5l=J@uG10gBLnuQiKiA$=xfLM&Aa`_kvpr0ioGWaHXS@)KRP8=JD{;Lfp+CQB`2
zZd)DETbLzVt1dZUprHO<6$^mYwZ1_lOlwnClM%g(%L>}cRHfry^oQToI7uXQqD9Kk
zlE0p2d2mmbB3ARQ{?YjvBxhTCNxd~Dj(1Eh3TGKsx?VecuF1lKhGqXV>chA_n@7U+
zQl>~aq$Xx#jDP;~CzqG6n5A4Ac>ya%Hk)F}Yhn^Q>j|vWKzVI62FA@-On}@+3c{5g
z#80Op#p1psrI?Sq88q}F<5SplU9QB3_zuoyMb&42_7D-O-ShV&A957;sj^Lu9v78D
zAP1Bpzm9k{`SD8M7c<aEEvEXZw+8<^?MlUDQ%Jhl=|C<X%LFkm$A7{%oc7IXC#A&X
zN|&b7>xbpij<B|oUvk2iRNaPq>6CCTqIdD#vL|i(Kfa$ksQH7ZT@nuVeK1)2%>f4M
znc0Z4<5ss|d9S>3P*<W8<eSS$NWH@g`4-pQV);D;$D8oNVZ%E-i^kBFnR)A4Ttw3_
zTf}Wedzm>#&*|{`tEwY>hpJi|GWS0ZzIzk<skW&!xl+7nl!T~rA31>fJz1Fca^UIR
z;zfZnk;S2yHfj$I-MePH;>#f{ga9UM|5a7FoABf1@tID#z-+G*>N-hbuWVrx(|kYm
zRY#|X{DdIj0Py1~Pv9&YCWClM7(Bb-5`iwW!=8Q!g%4M*Zmy!K4`=)6n29rj0M^59
zZFi<*xx0%oPmQZPWIoThF<`E(uy+f%@gaY95Tv)gngU0S`*D-<t8L@Su**g?>beP_
ziY)dvIcBa%NKU>nDKq0)BWN*&I}1|D^o1^5(XL!92uWCgdII)#)24+&gGM60!?c64
zr@CrxPMgb?mpVR9%TQ>tQ|i5df?+TPl>R+zQdvS!EZVptE+L?#97ET*<LKig?;~p?
z?-SuOyxLa>ik+zV4)j}U;yH2tt#}d$@xGI1P9?!$k&DJZp(lSM5MudcVV0g7dh!KZ
zM-|`TLDOtykqJGlW^;HBtMX0>l$8a<b|0N-Q4;)HFMRUFlxrjrm_3`*2)<zh7RGH=
z57!6W0vE*{L_FK-3k&8#OPlLU5_zEzhSyv#1;L9h6B|}yP2j4dP4}mrbA#)Q-!!bT
zPE60e(5XpD0w`6DRTjtn9{KM%HJ~w9kK{oT{+C5ZD}bZP&3%@E2F0@9_T$;-lUWzZ
zo1+G``$R%)mIlMuTQY1w0l|tOr_JJc7kMHLMc(m=cwYUyy4mGmP#CHQY`Vfo^`jyA
z3>zL4U8-AeZ0XUlTX>A9!f~XzxefkXGQ{3}ZZCD(lhN}vN|BmZhUwiBM+pW|@0|(p
zN%w7G)oa=uzL~rrZV}TapXG2pbf7ZEzoAuCRZ5Um1k%h@rM8UvCQQUy>YuRqz~_Vy
z<1DJ1v17h8T&zXE-xj)*jM>M6Nwd}N8bOW~u8ji0%^TzIAD#;Yu_r32<Kptl@3w}*
zSgoOjb*b{0TrZTlXn$sX75&TgQi_u|dA?7BUUK(`!;aabqQyJr`MY&yRk{~9Ug)g@
z_CoI8#p|u8(3%E|tbso6(8JP~om?}v&Q*C=(eg>4^5Xlt=Q|FfsGmq-#Hpu(V|Het
z2G%ZeVd4Wdb5|Q@?2ivK4#i{of!d?%|6C00CREh3x9ij8UuYRM!q^=~w~61J5DGfp
zetNk7z+&=N_Ri?T{$PQO4soF?bvL)D4DlZ})%Z#DBofd5Z`0qA_GEKO)9!WfUgPoZ
zxO9v)ae6IY@Atd@+c_B+yjVpayi=jLa(9+W&-G5_0`BncuBS@wZcSYn9d?gJ#dDT>
zFfcX==@BX!5R~lPJ!k^db>!x7@<%MB7QZw4I5P`;LG=hcKF=eCm)C!~2TSk`(>z?%
zmYGTCN22h=94_xNUuGQPXIzMQ_d#zYBJL1(Zy%hgjVq7CAV&khyU3;!E{5YC+f7p8
zLE+yZp3V;MgL`g!jj(YSzRXTqNhjSWPGEK-g7~WXYccXK9x5>5hnES-cxBz_s$^c*
zGkaNq2?vvE_xf6On{Re@Wk`spQ1Y!H%C||PVPdT_zok93tYW7I2viCrvLXQvx(3sf
zs{zzqSrf4dAO-lLP;y1NaZt$q?#mW>UZ}xK@mN9k1Or0dpXzR%Yc1}<kFj*%wYK<Z
zyX3n}G&%)r!nqN7P)r8|5#_{7#Ha;mu1wE=^Y1;D-IS0WHFWji#GWwc{^n#bN5&T^
z!yh1|q%6wQcM*?PS8yY>b)~8hKyZw4{gIZ9WR6k<eRx*^Paae!7CNx`q9#k&TV1Z4
zQ$gap`0u1ziw>*nhL+i2zf&RZYUB3xtObm#6O#18tX43*y7uKlb3`t@GkaR0N(3u&
z+b;VmWCJ%X^lwT9v6CAx&W12T3wswJaS&$&DNXqIQIx@YadX*-q=7z9Gyn(a4eS1U
z>lKu(lPWCXy*><rCF{GtG!QCJQ6e`M%t$jZG&y|M<-bzJhr#}<mn)9OZ!zq=FZMsW
z9{JtBV=Cx1i-b;95&b302m6!ylcp;X|Bfp{O8s`B<HGEcl0943siZF7E)ON`1h@ky
zu?<;h|BdvU3-ilk=gBgVM@T-t@l$cm7uQNygPDOw0i$v}Ep*1-4}Re@oE%!u+rUp<
zg2(SIC3Aru$SuJ?$43ghkkB+*7+;*Hpsk^@oxs<fhJOO~lsVrQ%Z%iO1v$F@T+_ic
zK1>`Jj2_zbY9(bVg|iiXrz5g%$N}4kzlCkVq_t3Jjx7OGpV_?dvzeNPDPjikXDXsR
zs)C>NH8sf<s0x(2<E?WsZb4KftL%T6UK8YB>yy-HFjORH6CW0<(dAhKnJGOUD0M<}
z^ZQL5iTcjE)nH6Zs!WQU!^fb}XC#wn21jCSpxz(~JZ9*)&`G!NcAf3e7Jk{#>bm8s
zX^2vSXVDK+g@|?Gz{<y=+uE92Is9e07?=Bk!tDj@-ur#N=9MRZF9Kju)H&S#k%Z`7
zA}m*3Lp9!mE`^azRwXa<lyTX2x$b-r=bFa?50(GH<~C8lM?YJ`*=%84`!YJ}KnR7$
zG-zV{ZFPuts<rkmBEbt|erd!tlCjX;w0NwzX=IJBZGaQLsHKDCWt;B%ye94-)Y67o
z<Iu4xXB<%D!`~}a1cA~`#Xit82>Q$X^IO*VS05fGif16gifEzGqm3g>*649_RHl82
z{p<8R3GhbBb*`aBu&uJZPj6Rh(`>_k61V>$<RA{8yK`-fzDwJ;vTMKeCo{48XR&ph
zBuYnb!}aNl_ngE$Dt@Z*X}wuMq@?#jajZm1SAB^J(~w@q+gQ@wXto0Nr02n{G(BaL
zI=<r)IMA5euWZ8?{RWGCm*GFNReuo>Nxyn$7(hVrhX+WRLX?_sA3)<OKlrL>^SqDK
zAC<BlccP-NC_Z8#l79xc%=oCW2b=Lg<htXduai`nxR{DXOXOiNO+X9jARRp>M9Gel
zG*!3KDE)J>8jQy}fDLnn6AM(%swN-gl6NHBsD>#`bJm{CZZ0eKHWDj0{8@rRf5g`B
z-wB-)zde1Uzh0KGn)qP}YT}=Z6A3c)OtgJ-{fU^2IJZx%j*G`pz3^RARV;g(^Tuwo
zX3OFv!&&AK>HjsBEU|9WiY(A?8QT^js!3@y;zlibbfIN|=~6KVzGNW_%NrI4A`A|*
zkqgn6EqIaO&lLQz6P5m%Z|rRE>})Vh3wCahAkjiaYqxil)nSo8E`8*5Yq30cQNrCN
z<6jtcJ=P)liuH9m6r23JHbak+X+vznJ3Ocak~FmGyId!OE${&#w7i^i?j~eTD;90T
zjB<SyR`%|Xsdkt7n6&4FRjm7R*byo-CZa4kGrlKLi#-H|<^6=ZAK@T&%iB(djUz>S
z@nXN?hSjMPedQwD9Hlxb%s)|DUjZfa%f+LlJ#1LaLG?fX^RAAl7x8|-7OT_Jzyf^E
zt$Yg{%1WfbP(+J*+u<ipX7>qZMnKc+X1X~5SN|zq>>Vo5E;dN#Sj<_Omkoj&A@NYL
zJ8z@)wY(b=cpsQ#M(Qupo@wv2lFI!QOE7hHg0Zl8IX0B6tQ_b1#!K2!&XNW7u4K5F
zscTOb%BN%K`e+(867!eh0vzJTu4-y=R=qmw!Ji`Oh4sH46#RQe4RCzrR-?WduTHHI
z_g;Ui>J#!cvxP(@&w7|Md|FM{7@?s?pLw;JqvO`<huja?Iuq=n_4>Eua=izVZ3r|6
z3XL1fCu=rYtl=e;Jz3oyU!9KX9zA8JwAT><@wmDE_f^j?c$gp#4x21}kpxB;yB}L<
z#f|({H?vBAnMJG9iur$O-mfyVn~~8j{ivp<q#CRGmL8TV$iy0IYub3t)1!0mGEiWr
zDs;3YU!1C@J(CyNZ{`!r7T8t~z?PrR)kJbJmV^$)8jdGgx=e9<(gh%kQLSI!Z2KsB
zo0zSb+I$r??j2TuAdy4@sH@pMogBaw3T0E=%Eh|0)K%ot?y>?U-#q5IxBaHgod58t
zvg+yL@rCyrtAoeTfr$4Kp4GER2)>!Sk~NY1W7zg&=o697(u19U)LlbC+iq*)#95Ir
z_V>_I*EIf*Jf4Ta(%(h)Tg;^2q3kCY6Wbv#9O-*W{LFowctD)UfbFS<+~6_j`((BJ
zKqWQR;-FU<KWZQ2M6&tUUzS^RULUAXd(N(dN-acOUG_%?G=z>H`*r9ar~&H9F<9Nr
zUuyc_)Ec`WTV&Yx0wlaWO7X_=iq(mHN=ddo(rqayc*tU9sWBI}2==c?z@y@z>WPH?
z#tPb<RhDf&tSDdZI`Mx4Jq;80f8f5<&h0V|(CdvA2{UV^fZ9wH35{L}?po;m4&F=&
zbMr5{aJ<w)DeX^H!=8^s=S*>7{{p~6?dF=-kM0xcQOCU(8nq_&WQo}^4?d4|w%7>(
z_g~Ln=WSNuF!2fopCS{r+vm!jnL=aK(?&E@7ZK&bE-2%T-c!pB$njx@E7QhvGtM)D
zjk?e2%fHZMQqb~+{9`baA~<l*;_*XdY7tWpiq$VmySvE;ok1y{{w>Jb#m}byD=V0L
zw6V?1%1Tg)S@zOsbzRiEnnRonB`$}I{Lv!$a7|lvEu1<r-WIs<eW_T&6&XK<SsS#a
zYm(im_%Ig=j-coJAQ9>a$$*~#EH%~GmbdhIVE@DM;x%=0p<=dvJd9~#Zv=qMYxIqr
zs~cNHs-s_w(S)3*77~Lsl#EqOVUpMUJdA-@U^cz0Wfz@_d_-d6+Ap@0AsS(Qosd<-
z5hB1sRmjC-!vjw2I-xM2Kux-hclB`fXFNi;kzHlvXqTdaUx~7gX%4)NKxr#R8^!A}
z46Q5(UdMXa(+KeCwUX8jVwwmFZfM>_$pPT77tz!V#?pmwk#>N;_GVk^=d%oa_ZjNz
z;Li3ArFBhH2XqbzVJowUe`v+1P*-=O%L@1FJVVidVdz{};sT`jF8f;Wkkf~~vVDg2
znkPB@h1<=;Q_X!ba)ZM<Xmzxf>Q1)oOeDQGw8m{-x3U|1ZM$ThdWD|l(O+e$ec14v
zSexLT+^6u-U-&t~y5+px-Da<)X9h{H#S<yF3U%lID6@;jR4TI@RMvMJBh`?Tdb9@a
zI6n#&T^Vi3b%&p8!OxrE=ST2!>(N_gI7HQbh5SHXN&(gI<wPXB0~1*MPVwR)3>{}D
zm=r31;ht^6!L4w6Y@Kj)^zmLN5R~i*;Ox%(evGy)TfuQ$fl!l<-m(JbWx&w3v^M1f
z8UCsdczaQYezcXcM;8b~NmfcJsddJs)_Jx{iTG0rQPU;{E#fkuzl)`qy6yR#uRaw7
zhe&LgqLz^Lh-%{EFz0v6z_b*yfmN%~+nJrT>$P`k|M-D1scI(2zvp-M<q<};Jc!wc
zm#k3`i3mt;zeo}QASf{FD0`SS17-<t40N2?^#UUyp<83>+QK^-Apb<&trcL|I$>^4
z2))N2c#^@~!I5Mw1@)vR)W4F%)fC<#NA-WkwQ$U2zL5tkW31XHcxsn;q8Z*Nyp;T$
z65b`rgJ{m1$@dr?(6MAw1&T5^o&)ie2NbYXxC0^2Yj1P@)B`jHQ1S@H{qYyHC`c~;
zs<>B?aZUr^Pt_Cc)<XgEKxC#uBtShR0LHHF3k5E42Cu%C{(Bi{uvFXeD+*QM)BzY8
zJPib|v;(i9Nnqj%dDI)bIw;ckvgAqAZWnV<TG_EE%Az43fEyaFlgi(+^4i36c6!=v
zScCnxvY-F?V+jBa`Llxo&O<*94_wvK<jfbH^OF}so;{9<;)71XHeV3TUI|SohKv(f
z<D5~if!c}A%a<IaV&bwIlPki#=$0I;vCGD!V7AbGSNygzhc@C>P7vTF09E|?O$6mz
zDQ(XY3-7Wq?$+Bi5J2*5bwUcl$_hx)F<rkS&^_OEx~m+m0Zu8VtwynK@`w!qF;Xm^
zVFD?8z&~@bQXH%K5D#hqqPgxH(B2H9ggR8D>fhwa>7)8*@isG-!+wb5Da4vu69PoO
z{W4l^pV~Xu;nAuVA+q%&SpX|r3T)6x8Z~OShkb9enL%O7nkqhMITe*5p2@6!ML*7U
zAEl00u<e@tQad}2Knel!f3J(Mc$BRT@jS7lhTZ}V6I##LQ0mZoEb`S)@&5Lr4a&{n
z1`c}k<1!QhFN+zfu*DUXVvFl&DG(H8t|ZX1!RA3{4hnBzN-o4mDdhaK(>o9!RZlyb
z@teTVV5Rbz;I=#&L?#9OJep-9X)iy@ASw?=&OmY_)airqv#uCOXbU@Pt$%WIKTP6k
zmZMNdyCmSp4IhFgp`HryhZAA=+~!LZ@0Bya3fB9nVA(Y$k~CQ*QCnbx6Xs5S8N)Yq
z3%ov?H$iOgVPT>36uSEzptB10C^fZzE_b()fQL)I=U{H<*Wl)O+@==CR<Cm+%rMvd
zght46na1U_<>v>L1qD};r=f7lNn}I+3RHYAJP(z(i;&^Xbl0S?aR3&jpFZTW_ILo@
zJ8+9bH&Nl8f=zj{JtgVLNPw%>q(;=A`6+}PtnhSeln*8Y+yVbsNbaZz{dW<1tW`f?
zR<rL{2*6ZHdwix(YJ0K1e&scK5@8Is+FL81CE>yA*#c@l9m{tF_iUjiW2tb_pX%Wi
z-<&?Ikd$dXds5nTE8rdv_>27ltgm~`%4jtmJy5P;HUy)zF)7ea(t}B0R5^{zYlgo}
zDeyiS)3gZhEz@LbhN`>aPmUlRK<msGS&H*VeX?)cL4PED*zFSLHK>(&70rV#ErSob
zN&OJo4OqGp7Ej7u-&IO}F_F?@@XSpDVh&Jn$uWH7-064Vtx05FqnN3-_)?a*A)gCi
z%eW{Nc7ILY?lE!8&@u^NaIgk}(k5=dAp{bE8%5}(b#YJ-@A!Hy)cyl6qH7i2g5r<;
znDh_{_(${39@=zQ0(74_CU&)tRC+KzzP^hFI^?OLMsSEl?TQOtPtyxcXZ>dHnbiW^
z9+zkp%DXpn^B_y&4xIvC&1eDRf5RUeBDDIZ?0zd2{eu)F{<<ZJT-vkA<2|h<wQ;M9
z^9yWn9C&DZ4OCIujOoDGyKtHBn3SV;M1tadSu7iWwRZ^A^M5uZETji-Kir~R9de(*
zpeeW@+R)1S<;-FeTu_9$qN>oXqRQ+=DcWmEfOo3(=?^W`8<zvt9{Q<JMTbzswGbk)
zU?$MGgb{~z%As3}txfDy3VD?e*>J#&OC#=(G5yeOx6^QsUjXqAG7D{?FeX6wVSrUc
z{!x~bqopW430?F(Ty4HgbkbA>6MKBp2;bKlP2ZO_hk|kTTvyGLhkZ0T`>MqQ^2F8U
zbV3GY3eg)ePFpV)LIQ<n^29mN5;DVI#5mrXMR!V|x3sW3he<uf5npMZ#Xy1}4ZgL4
zqXEJ@V%d<cRET+>$XF4m=KrL2eq`z<{+F1^llCtkkP^f9F(~=>IQc)7vJBjdzBrRF
z)b9zMW#a4x`q;w8_@z=-8W|kb>V3G(B)eJWZhgCQ+@DT5H2{pyPX6qFYx-D#h=Ma7
z=J>OQzHEyR6QRnQ10Mm)FnhPP@b!O(OK?a;+3i@aaZ9!0kca_=O-%wkoX{IDG`l>)
z+E|4JDxF3<@O;azWL%=Ryw?hVJ#_LzapTS!%tz32?Gr-On3ES5z6316*1cLY3pq^p
zIfjN`k-D#wrK0{Qp<scVI&g_MeJbqu!n^BV_FL1dLU~;AGj3N@d#igX(azvX>+V0-
ztk$S8@*RiT(%YB>-fbKTQY|YvYjNUtdRlydjh4ASeT9we#9w^BPI*D5<I`y^$~q}U
znm*^S1wIJwlQ}%EQ|8kulr?HLsI!%W`@o8}lC8AB(dXBKjy$kmaM@DU#S4hNX*n%H
zPB&>2ldfFt=gVJ1foYG;%2sV<qfx#EseuRk&q9T9Fm?60JCG`bvMRx~sH>+K3EY}}
zqH`t>yLGwjoGxe?;GLw;(<!!ejC+mJ)y-(rj45x>2A$6It!z8ehZkk^;d!t0@BeBb
zSz5*3tw1^296})FA=zp2>U|hh59j_g_P!+vw5T!f`Nc0R6dSA~XSDH*&;!}rSG4=W
zsURtD<YXy!f+yuH8Ep=~u{%xJuwU?N<j?3hh(OJDGcS!)5VsW5f33*D%RL9kA~?q<
zV&#$(#pHSi+tYqkg+kVAIu*eGmC(KKn%Hl-RdkL1nC~$<ra)J;F-Bmf++Ak2=<|Iq
z#@HbG{cq?!Qu~H9;O)am6(b)GT54h_`??#~yuz9s*Lx~mO*!@h&==U`9Vziz*F}qe
zB@^_G@^67}o-f}AGPo~KFA?z|D1>)Lk7FGBqpZhyt#IgKm~WeWjdem>gL{{9a=lG!
z?tcVpDCl=NMGRz<WCIaCVO$EZ$?AMGuE!kdRT|Aedshu{Sm8IV81V)Fv9Ga#y3>Em
z+Nw;nbvf5SN{%f8MJ&AP+<!3%!jC2r?VqEsnu<wp&wApA^ovWQE2k`19ly4J9mf_`
zk4H*z%{nHBgN&j`F*p)<(R1cPD3i(J?2}OcU|2Fop|t0BofsYtwTAj^2C~Xmg@7#i
zp+>uzN4F%sTk;yM3$3lBP5L^97K&Els2)sjTE@Ae?s490%Mxt!1LkQNmuUSmL%^bx
zT)L|4yqI!mOv?irs{IAbj*cm|{#$%y5<Byi_@^wB8%Ccl99kP8eeVtmwc%OEvx|3X
zv7<cFIahp?J?ShW86<jpPK;ew23}gL`uN;m=f%QdDLRC>tAR{O|7KRM#wCzO+JrRH
zk<f2%Ulmq7h+Cx<$KBJ)?|t_wpR!|9y8TS%uwj|di4d_M$e+-W;ZQheWa-yS%Mggo
z9mIi=p+n;#$Eqru*%ib_Ezuu;W;aeJ>&%-L(=EQTbYT>@dk&4zG`J(?^7}A-Bs?v!
zaRvGVFr@PeE-vgAa%WE}X!PQ&G6TO0Z5oQ!`~73DzecM7du)jh7rC$3!`y*7y8XiL
zAWqI_?3z@ZkecYW(5DL|SnwhKIBBr!dCQfMYjJhc^^hX|c#O8H;(S;v8_oh;FzXU8
z$d`bamq)Jy0U?wd7~ZwqFT}?_-uPircscIzQ0Yxv{Sh#Ubu<F(Q`&4y@Um?rmxmjJ
z-ASQm$i-l@fIAY(_(e?*p<9AokFDN&oGg-S*iKV2#$~`RF+H9^(=Yfd_fVeqg$qdM
zJW?q`x9m4bNqG?XXw(!Uq{+p4<uy~Uwzb9sI%044ztGv65hB#Ji!5Z#*8Vx4-LA1z
zu4x*GB$b_%0sh_55Q?G<!iYTq-ADciQiny=?AqD5JR@9h46x!rkpDN9W-qj=e4DJi
zJX#JhXomt`&ad|{<=$`T%vpy5%4>AQt@^au8-72Y<B2Zhup4xI;}Eqga9Efk)1G&|
zE>Ze$&i>QV-py)b4h?4qjy$Xoa@Zz|i=A6)IQ%?t+an)f<d7cutzVd4CL|VyniFji
zff2VV^sh;z69q5D`eASRbJOuhzm)s*Uhh}i)uYkUM_MyPXj)q4vp#9QhT_U`_%#Dz
zn&s7uzEun4bKb3{Z@o<mN#{8+ykGCOCKvAL5zCf2EM~XLpPA3}PGOVmex=)Yv}9oM
zyf0@I7vCN&Yl}YAE+NWL;%2N?CMEe;VCpOYJ;+Z~Yu_ZsRmaXC)s6cJZ#r$ji>()y
z%yvK?E;RKCylLUdy-DQ||Ctq?*zDw!Hd?DhfI#cXOwsA#^z$0`(J4p8hMx<=VBX-9
z{<Oeg97{G3o22mdm?NNy1n`U>L(YC;DmY6Xe6c%Vrp!#y?<~;qaVt+|Y-A~K##>hF
zB4lNF@dp-=f?S`U(<#D*Y?;%ogd2Qk8vuZo_TOCq6{(y?$5PW>hx}E()UJCtB=i{+
z%VQbmlGd&oelCbGBvDpo_T-#FDxe84`h4lW>_v}sYym8;)F-;>>m$<_d$k<B-t;EP
z?6ed}qTE*1Fw>QlPqxjp3s;3B)N&%p2LGl}5c4YcZ~)825>15FjI&?K21E+<`PD{-
zU%liU9h2D8((X7-54Y=%N|;vxzE1pY(3dZKPP!j{FLleo&9%eiYo?TsOZ7aJw8)X@
z5QPGBTDuVyps_r}k3(QeRm;{VTj>LRWLtK$W5cf&pDTTGky8}V!kV_5lVo$}$CNbN
zE2Na7p1yR+7TFObUU;-6UyR3!%61*A6c8qE)qRVRr21|X#c~xM-_nFv9KAcj$=@^N
zb=D;nn|8+V25ONUGKZC3QVUqxBp4wzc)wJmP|)^;Cbq78#Pn6pJI3o&)z*k$iB*W5
znut>t_7RNJ9j{4gT~LlXTDImcB9P&n{AjA3UxVI`xi9DZruBzMd4$#)i(Vm{E74w)
z?4&d5ZZ$SCn%FH)d<Ru&3w=HpFL+lI%exIVwkAVaW!nSCk>3gAgN?6w?X4t{Nj3%I
z&(H<S+i6bJekQNvCi62cW2+$AosLh%`@$eYHP6V1Lz%BE$3HL3(3Y~(N8R(Iz21a?
z#V^zhfc^M@4RaJ;T=6A!=lOVcb*3DZ+<2miB^8i?fKMB`6e*=P>Rcqa!LERmCz07x
zBY)*1OOE}Wq{5j3#!oXpYT63_6sBY4fv76Bh(#<*b}$ZlZ+TJ5biMFh0xLF8p-l&Z
zz9CjNDEW1HzHo7QQu~{|v~2$d^z|Vgpmo>ZDrFAyMXkVsZtkCaJ;%ZDoW?-06zZ&^
zszJj9-gfyGbz)Cu@EFZ=TwhTZ*_Xc;`C{!zBK9%7x^sx-Ia4m8M{PqRWL!z6>uKMB
zGeQH`MHiQf?{|x&y=uK2KEhfw`B{occ8y8j|J$nqpi<tq)e@w}d825#-2a6w5Q&ea
zIRR$x^om%%zL+u$m!|Qdy4ite4;BgBKf~!K!U3IIYnhWp8`Df-Q@m>b5pGCufR1-;
zAMwq0)lPu_+nn&*j+3KW&>vSHpAX}I49hH*qrFHdDF}J+k!3NmIR+5p@0wPA@Cl5`
z6m?5JuH~Tp!55{+7^sRr|7yk<VDyqO<0Yz2Dt3nyF$5hDwHf{*PwTjtKeSZkF>3bq
zxnjVQQh?mV?vR^SRYCHy!uuQ|sb@PKR8Xh&5cj--6}aYszRG{9%(Bq7@ZVM!t4x6!
zc@S@jJ^NxGVDEX9F7l+~xyBtwE_9zG3|~#lNMS;MApt=DuAPV$J<64oBF?A2AI?xB
zEV;1v-5f*AY?OpY#=2(ONfk}rBfNY>Uz3*rIz@64)DAnAkG!rXU5F796d*hm1Wd<%
z5KMcP;i34o89F;xjiD4u&5n?N)wDtS{P724)=ikqt&S!xFjOw9?)}ByC0(vHx664d
z@H5!(;cB#1BZQfq$V2>X#uwzho%gGzk(GZOBWfo#S`xXIt@Dq+goBY4sh))=&@N52
V6fLn*CGz?bpe(O0S0iH?{y%IZ@nHY}

literal 12375
zcmWk#bzBr(6rH6@I;A@$m2T-y=|(_6x^t0`?rx+Tq*F>tTDrTXJHPq<nBDzt%*=c5
z-gC}9_idPplJpytw<rJrypffWPy?SO!DAE&0en2M>&OJ3kR4=noB;q8=l=r&q-PR>
zZz8(LDoP@*B9h?oGNt$5`T+n1AS)rJ;j#G7*V9L1X5saAEPaS3!TjebDrL|+7UT>W
zQ3*H+xUyy~8x`5|Y3rkLHJeKNe|jmcnr}3JB!BxUizQ)>g~pJ9EKh-qtasy^r9fA=
zwnpx(w7b1K79R`TT>A*$a_O98d7s`2?&);y@r`es8BI-TRcs8#knmY;4F!Cg`QvHd
z8S%&l352D9P*8tQe6pkejt7nMxybI?ctHi?fLK@+;EeKn{8JX9F@iD7gre{$aC`#&
z|3g(k1u_9lEQ?qw9FElAg}G&?H~>a71?6{tT2G^aeP9APHv+naol4HdfQxAah&gk`
zO9?i(Tu_^c9l~w27)Z$vh`8hWoE^OUPzQ7&`^fA+KFU5&Cu1`bF$Mhp<(K=swDR}X
zpF`*GQPQR@7xz;SP+IC=?phWR0Q?_j$FBEFkC|+3(eIGp@Zn%ksi<?UvUU0Iv04;1
zw+<dp)A<eqV2hbpag%t6LJPDPPCIvV**^u|@Xuh8P<NA<sr>_v5141?O94P-1sp}$
zd@PoYHMwWkGfzxfBh#(u8&7xDYsxk$QJKLAbsQ#3zZ6c2$^P_D)`ob%G!bK5{=+3&
zSX@AFSkTa*^L!OD0~#SN9K4x$(zXhwgZZy^YBRX;OKdM+z2aJ%-hdw{FrjfIBtViH
z>*djS9o!vLpae;~4HY9UCT%UgHSj`h8u;-fHJj5*Lg6fQLe$k<qsAz+obB%4&r){1
zuSGXXW(Ka#d-sZK_~fhZn@--v-R39bfi8p!Un^3)XGF17Q`M;8JArzCALITC<X-Bc
zf#5G{kCz=NX&OZM1xiS$YV>!d+a`}n`m0wf3uPA>^mJa&q$x*><2bZ7)E}Mp#Y{4p
z4z2&@`1<+%neQ9GSMnK>ru=Jo;EUY@D-EM^%Inm*F$s@T_Cx&1Ovu2jb}{Pc7oT^K
zM-#r*6cv#;o4R8Ai0H*Zo7*W-N9WSAFyXD*U|~1``EWZH^vZwM_qK4sn#;4*Vx^Od
z950Dy1}Dqh6+YZ077~Zuv4KIs{*F;_x3}2-j}kF{)yr<*4nBZlL>|l`M9b;Rev*bs
zMyLZu7oSVf&%7#0e@0qvUX88t=}^!5qnoVf{b#m|7#J&9<J@?v-FC-7w9s$Bj}G^n
zeMg<k0TImoJscBuoyFu|FFQ7$XDaytVZE2Dx&dq|7<GiLRf~wxr_IH{jN5IaGPo|b
z)Jzgbc_~w-aae5R0i!CLYESQ@bF;n<d-&Y^cuw<L3@-DMAh@*;&f9%!%Y3wYlnG1+
zp3?Hx7ug<rM{K~n9U&>s>ljXxu#mQzb>sYqHwr7M@3|3TOuUI0UP%;#rV!MPiZ%-l
zH-lNFAP^~(9E!;y3Q*8#Bses-mzI>t&Vd8{8zYOR{yXH$CL%0usRor|7;^M4%bWfB
zp;Fbn+Pt?p8<UIBk^1I+M0;6zZ=a36kskS|LPgRLyZ-w+>CY@Zx#;Bml<JtG-%>{3
zCcR9L)4j?eA$@Il_b@CuZtp_?b=1~SS#MoqGo+2wvCa@EcR_I0v$1p+7=Q?3SUqb7
zyfu=H<-zaQw3#D5%DEeuv(GHIWu(XcD;W~&TO$^S!;F)Nolkl*^s0CDgIUz-@hYP(
zr=xaf-ULX#^%wF#>D$1%9M^2jT=qPE!pOLkW5vM^m8uoQK^=nJJ-IDRU!C_-^%wQS
z7hm6|EnW48==n9hj01;54xFKHs83M7N1=#fLI+9N)}HkXW*emCGP<q47@f~*y{hX^
z>MI*&%4KFjO-x2;$DfS)gAfk4_j7BK<muL&diPUDUIe{23j3*J+8fQ@K&8Y5iGrs%
zDYCGWYGr!RGct>J*954zJ=%HZhCi$2oKgH*G#FsR$11d>_)$ThgAl@B@ICJSJ<Pt{
zzxRi3q`$P?s>%vIrb0__lhmqic3(Ec4z<IA%E#Ht%c<4AL=9_CM`&#zFwm-T+J3WC
zmLYshk+u*z`Z7P!*tC8TvR1wD3eORP5YVu0P-{X3_aQ1D27s%6eBNZS|E`fTImL0w
zW8;sJ8!h;~*7(|K2}&C*6PBr)ky2;zEXbll`fs#BAjWY1;b~y)glbDi*=zVyjaN$t
ztG|FU`lQX#MN>Zbl02z4)H2nRc}7g{mw;A0E*_0?INIA?NwggtoH7nFUQNd|ncUzc
z{2@GTl554SEgW^zZv&pr|8A&1FTGq<w^tKIPalS964=0(r>M*RjLR#aUt2g^{{GmM
z^r->Y>ryD~i(}Ko*+&`PH#9eS?{nAkn-sP8N8!Imlwow%-%Qv6qkZ}BAvIS7n3TNc
z%{qhZwuloxuSQLkrC%qtyjoY43n$vI&PFnj7=(d>_pK?ONY6SQy<A%hmJ+rOGU5`s
z0~5bA=T@38R#tLgt@0LM<RDlu37w`<Nep{#z{MO7>HU@cA4`$SSb4mYsvLeMF9fJi
zL4Jwf(K|*E!X3;Hp-h~3VpAzk3ObxSAD#blwyRcUT*$d$S`L|wIKoHCDewR*-95vo
z^sLk5=Pq%xMtI!b;^JtY^n7?gSOh~#$a6O!K8U4Y1&9D;s^^quf-Cinl144N<q7Z#
z%G%2uhJoyfBYhP||L6GE)d^(OBAVia4eDZ#K|)b&u04#d(*Qm*b(m>6e_(%~)3s{J
zeV2+OXPCRAR)|hx>n6mrn7NZWJT{z81Ws)V7R}`03sAz$P%gmzHPL&Im4k{sjrQkX
zketn7Ob5wDC(0g+)?AJXOyp;TFMu0VvW~Cf1FgQ6-2Tm%+xJH8t!B3buXQY}{Cy%)
z@0}VJ75vwHu6PglE-~K_*ILka5pwS(k=($^nb#NzeoU8#XzvT6?kESoq`Us@DdbY~
zr-Ta{%Mk2z*u2oZRnCEkK9sw6u7X%45w;c4@b$BVxWb8c6(yn6d;NW3ZEc;xQ|=?d
z^UkIM`jFbcOxUxh+AZc&1uaCfe*{;24x&m?2^5r~OYNo(FbK4Aum$#f6pti-Xpf#W
zM^GjwS3S&Dp=K+QW#E!^_3L1Va9nnL5$_?fKYf^}{K5s97jah5z5Q}sX%MAQZ}Usn
ziharyA(tn;@;bXpHXIGjxKO8GB3HOJFFkH`)kj-nf*sHo(=jL?Gd`TY<HzOv`dRbc
zC>n*9x?C3;W$&Db{<48bX<o&W?RBm8Kc}`8R?5CaMb?D$8M&6)JVpO7ndB^ZNzSeV
zbaZHk!5TrLy|UJOE~x%j6))(5LvBepuPYNL70t-&7tWaIf1*TNPiT#ybvXNTWvXit
z@fw_TNR4rUSvi}411C(#8)(ZPs{_nBe$&doc{85CMKil%;@K;+T~6vxuYoXY1i}}l
zKuXy4%adWx%Y^)I7CK+uO0y6Vv)x^=2hKT>EmLG^XD>pcpJO^|or#ayRS6cfb!RSm
zLGUzWTv8`E9Ea)JLZuJy7qKP}7WpfnrKekRex^QL$UzC|ls!=bb-)FII8TletV>77
z_1&0T$7Ft^-Ha>G%kFarA|SJ;NR~|LrsU%xiss2qL>z$biZjAqLS64i7WgS*h85?5
zQIJF0KypWMM)}3;_UHs!YBQrH{Lnw94<uWjW^+?=*Pl*6pwsi~8b6k|n_E5Er-?LS
z&MrfE{4Oue_J{%}5@5wIh56-}GXCs6**#x+qq5qUSWhKQHytt`>Rsb$Dz?T8-KTJ`
zynK)HueRE^(iilVnBP30wsRs1u+}gEfrSH&Jw7iPpDrW;_RM#;sx(1R&ezhN`eU+y
z0w;2T=*y(!_rIre$7?9-%ta}c+a$=qwHYe?*lnNIavGo01DMniLAgbI6;GNfHB5jX
z*TC<!{ey31QU(~bvT34W+9RTaxfYxvYSPhO;<yI@Va8&cwa^N?nZ$M?$e|A6k__L~
zbO{;HA?v?fqz+}=Wku_gJ~btB=FWSaGX^~tbP<M4yI@1DOj!#dk!{gNf`{;86+TWw
z1$xLB`9))YjbW+d&oQsgDz{F~T(Urg)6u#y=s1k<)2@@bCxoBZl!wQTSH<Ne?tbfS
z!%G>vJ5Q&Hi^A>{QE71#8UMg;P%4=AwHQ*d47tKjfR&N&@ow;{jI5{cBj410$Au<>
zxc+U;zI22Qx~Fq@crebXQZ#yapc%L01dSBSmdQcnbUpDv-|F`0HTj9)J#FTf1EDyd
zU!s%**FigMKJiU!I7VXcCLfvisujW}`*DnYO6%TZ8WXbWC?#40(Aa{(+`Bc_jE7Wu
zSO6&0d>4$Uq?yP?L+DSdP9kVl>Vk;MeCy>L_bDI6+kL0KSZ(W@S!k;IKr}Vm0Tu;9
zBw1@9l*G$&ckn94uj!1)-jZp~$JGgut8F3zj(8tVK+{?b_~F*>b9>t17>_ikcYEI*
zpLyFvkZIhaN5{|*CNXPk(HI$r=?{o0uYI`g7qBc?J%|bdL^ldU@?+X>b`bl190I8e
zvNr)<>F*yGfZVU3eAM&nn07TpS%R4!mT8EgioN=o=;@j5_(Pj4WVA7n3wx7?g^A%}
z9AmV-PUH*GgI(Q8(i`bUY{mopd^yBKSCy1sq~=NlfQrUyK@0}QddPs4P*G5dW>co0
z#dW7IKoemn6Xp%Z;w9^BqbrXq;eIPA`GxFW=Cpb9q{5$dP<JJY2(xdE4G<{l<5y`)
zU+*ofJv`k#f|Dh`ks5IbUZ$FcF7J{B0r>j=8VK;|3b4>h39M!rojpmf`HAuOvU#gM
zgiio#1r6gXwH5819TlCG<tJCaLoWBq^@x878B9vhe%@`qn@A-5s;#T0Jsg_4u2I?F
zLA+k}kKfPnvZ#IYZ;%To=f{Q^J)c54RV6PTOwqeyf9>|3nS#eooRnL^+l`kM;26}u
zF{6fwFM}!`O`tx+&tI@sV>Azs1=cWu`2_zjf6JC(+qA2f@$!TT7viw#R*_&ZZw|=u
zMOfjAKu+epef52CzhEyDs$Ram67|-vI6x~JGZ<hcyFV74Y&oRM%9eq?f$n5yNFjo8
zt|1W;IdFg6J=k2-iJG-;*M7S5wS0W8KHFS*(Wzz|)hYVw9?`DdgdM`zKJ9U`=fCuF
zZj%wct;KWT0`qgZzXGV`d|$9s;#6ab!7cs<z`PpHud~nQWA&3&blywL>1f_D1N7C*
zRrXso-779;bIuTAr45&ANuk#-d}i4Ait=gV7H_?1u4EiX-Tfc5Rt>SY8+#QkwsQlh
zU?MSU-<DaPq^JL1{}h?gen0>^$pw9vI#$)Pvvoh`SGgVJa96_`8$2$PMl35n@H7&$
zzMkYft}-&&Gtqasv`sMvHW~*Y(|98>1EV12)~{>JDt>@geddz>G8NxbgfS~*Wca$0
z0*v^3n$Kz|>tLD$bcX$3kOfMFYo4&2=2mTD=8;?Nnh`*&6g_|A4aiw@ySbztR$UoZ
zwx0BV``Oys%pT=*69iWc1@k=J<292bpO8D&`L`E_7Y@z8S{&0Skm4$|+ltS;v$}n{
zl?&ImIm4!wT$CG0c@1ihx=O<@zT1)VSZ|(%I<6Yhr^qTAkqP;SppnZPyxa(TeU?G~
z%x@^WiZrTN2h08y1SVUsG!+Mg89BPe>gfCEqlxi_mo4@R&o>}pP-^(BEuikVMTO1G
zT-rPC=fc*;3-_iSg7{O_qCTtM$4dprymT5~0!_oVnIZ-8D59~0Vb-^Q5;dFNCuuh6
zBRGV58ka(QYdPwJgZ0bf<an2iMNTy{yo}>-tjb!5#u()paUk-91_Q|2q5?QwjKClh
zu}e~dln42X2KNE0YWyNznBNS64Hw-6LRWvP6B2;sjJ+_pfZlcXd*f%%l0Bi_#q23q
z5_0Bjs2tD1Gm!C`RMXuf$9@9(H^YlU$j4?*vW4l~;);*P4DI;a{ni$!C{=|D=<b<d
zWm`;Fs@In4DoffAyxr$CJ{-syuKAefL#4YlxrVgzB|o#6BC{<up32MPI(>=yv{jC5
zTxM2(6m<<|xx4U9|5!uRzYr;9tc%>%`?()sG~(sR9ECLgO&pmRt~B1fI$F7dXIplH
z`Rt_xD?{2G5B{x-6_&pj{6F7Q5_B`@xdoYp5D2x)*>$G#QH!1?vW2blc@XS28SM-r
z<U49X;2Kv06wcZvW_IC)Y|PNz9?WFKHbZ107t(E<y1Vh?Oe76>Z_Pem0oTyVNJBzS
zXvjCu{BrRmhgpM5NN)RH(PWsTN%~n(XqQ!?{vk1bLG-%k9+v}&he1kdNB*Db*<}+e
z#xkq2d5_#?lCj{Vm637WlI-oBZkX@H671Xi9a1t`*!gcfjmPG%CXw^Zr~;oi5#_{Y
z8xEPlx(@f0-*2PuC1FQ1((^Ow;v1{`mE3?HC?(!Rj34lRe3k3#aN_j-5Ew;_fkLZ#
z0&T=GxHCSl2QPI4^5wd3*Y#WFZGPyVW2XnOcH^-I&HzXr2ODX1Tz@xr?@Dpg^BOTN
z%12!e#d{~4n#f*T>&t@2kdM-uExOct-(X@kzBlO#U!u2Q$%<>8SBDu_38<@HzZfGB
z9(qI=`|ODzwRWXv-RuV=o>cNyv@3LeJrz_ljV{YIXG5!<qR!IpW}d#@EkmY9Oyzc^
z8@yF}0iM}=KR!MM27V}8m#H+8kb&AaH>qjOl~wyV|Ecvq718kvfPR#xyz%CBd<KG;
z)IN~lu}>wl5&GxQA56GsxDwbbje)p)KA#*&n?iVQQHM&gu5R@b#>w@L)p}!kV`~5d
zHK$~zL|iD~CFf(Ip5c-U4aOJ@=gKpD$PqooTcCS<Rp{&NCb9JL!C3lq<9<0h{wESI
z-@lXO>k1U_k%9BX?^I?AZ4YB3af}hgF{w#!2?S?XxX4AcGH(AgxqpQ^FWCQ@Wp^?}
zCnATD8I;Eu&ulW5yHInFueDoScxThe?}<GYDMyWycpWZDsQhUkzHXg?u<#@&4L_wB
zR5P^5SOL8TLee^}e-0iES8phxbi99A^~X@W;8F557%B4Dgan;C1w^Bhr%8M^v#MWV
zEz`(9@q5wqW~`cu!*fgIs%>FVoE@|kDgEN&at&h+qwVqmq;)XU{Y;2dc1+{&O7g%V
z{@eXrC$+-n=4aW|a`|sOrh4hd_X|fRUlR+3n|{D4MTv?6se}jsk&O$8vwwCvVf&$9
z;q|WEPRMud&#TUx+<-|AySevr1~s}@5FdyYXl{Ji*znvUi<hJEy-WFI;QrUl{@CXf
zME}pcTyOqSbzN3jQxsNf_k!uX`GXVR@%VLUjTR;*Z8j|tBAT&k^#rom0nryntUO4k
zZ=zp~6do4drv3AcizMFBeXAF~s;tRXC<@dKEL1l|{OgR9Qoq=O0{io?j-w8+RC*)9
zq|Kc@#^|097^NOm-Y-#}!bLi8h-(Cdf43(kAb7iebh%hWO}m|a_)Cc2do?pGtSPi(
zpP3l_R~=t9P0oHQD`#Z8#pQzQaKQf&P|7UocRe<Ds$cOnAJ4`Iz2ka<nW>Ov(6oV=
zZLTQ^-_Tm{xoI4ooVvF(BaSLrZGCwH(N;W`A5;@TL}q5iG!k${YC=;JtJlMeLcxW=
z$hdE_zx0Vc0Yd1#;;&Zftqss8Y5;Yf5I?K$@3-SSnM9Z6FqltwJz;<G6=V%*EKJD!
zkII`^r|UJbSGq?>W#m$MzRddov2wgRHT^uM8b15Yk9(0Fs;miwN}1I>oUNj;1IPXp
z&@Qan?hTxHYE!nEhQAt4{!VZJQaT4W>wSmOxL#ZuK97L*7I8PaS&M@8vg7s>(eN)j
z5q&pdu6M%RG+j+|E@k4Znsn0eUmD3-nJrlIDp~#828MrYq?AD5mfbH2Cxe$>=Wlu!
zQ9pcj!K25ZFrIC`n>5{v*F4p6rlT_)VXhG5^3(QE2%2RRq!Gp2ogM#jQek(>>9*hY
zE*Uh<SQAjq#Gevm_oiB`+pkUoiPwCc41*>Xh<R9iE`FxvN81iFpHSBPE|8>)#nx3=
zdM*5Jxk}SG==3^tA(TTd=pNz`X<%OAtQ*DDmjzFRkM}-ul>LG?7;BS!Yxqaa=q|%9
zv&nA2G3YL8k{=7UY_xdWd#HK51Ue6}E+lFx5HO`u#8WbE%O2d#m>2yX#rjJ<?sqn-
z<xnJZT@kl&Z&Q0kNI`>FzWfGQY$9Rd^Dby^9sd>%f|35sk1J${ItOv8SZrG0`v1(P
zEz;*9XIW4J@|ZhHZgyKE@wYyR2fGz%015*lFPFV`weWa6(P3F~E-5jowQ)#^RoGCk
z!;*dC-==98?%9Gv{Gzs)TKcQg9`D#WQY-LznRjHmr}-Gl?JAf2%buWT>EL31siUXq
z`=+zTfFP$Fe|C(FTx%M48cqGVXHn8Nica#QcgnRcG@gVsvDxDx)SNeETb77i_H}CU
zqo*mJ`>wLm*clv3)H{t!dU|DCu5Pe6(Ft9>R`D8fmy6^!--#b`Uw_+Rd75?;@qge<
z*HZfz&B_?*ulneEj5eE?;A~X*PuQ%~OVqRu(|=&~NR(mlOO$9kw)Gu%@IJIuw?n=$
z_6_;TXs)(Xoubs4bjK}+gr9dhcG|Y8dQ^=fA2w-Cbg<b+BZ=N6ZM!mtQP{9YXgc4Y
z>YOv(ygqS0wDH#=YUytK>`SR*w@Kv1ahlO;rk0bK!Uk)nW1mcDBAKx#swX(}s-_<;
zoehU*A>>mZ1%=oxj|;kovpdzk{LhPMSFFlX^m9>rHoEe`b2LGS{XJ=U6j<M=U@4TN
zQ4ZDNnp%1%x>Q2BAp?1#C^yH(29;9TlHF*COz(=)cgNmt+}E0<OY~<tn`V|Ml*V2U
zSytK~m6?g#9b(_gXldu#Z(qZpc;dGJxXggOs;7F+RM-oXB*g<A`AxXm{|XJc2bFEE
zVNTTN8WvHs$4L5s#K)c~A*#6&G+dd2_HYn259KCN)TuKo(!0%##qWjn(F6#5M#VO~
z&)?hng}<qCUVhMkHKh&4@f90rN0Vp2r3&Ol7p$tDy{u5!rN!u4EjzNi2(e0N5&!f1
zx0;$*zI53Le#SXJZ15qX&O`VI!L3@S6^rsAVig)z22m**&*<76Tf4A6EF4#EeKxE2
z^#@1rWM0)IMC8FE15xJJFv0FTxE0(2dcpd?Nl<`zFq^OEP#F;Ne@Cur{`F3Za@}xk
zGhfwDet)Ss`~mcv`bP+fQ}$2G+2v@l1;#J+Qzm~{9lbBB<ZgRzh5R=E=jZ!7vlMv)
z(g}8mhGltIZEJ_XY{+@|)G-o;e%RYSDYD4)mVY?d?qxZ$Kz5Sy<x|I`J}Z~3IZDg4
z6y8sb;RRQOh^nHNI)47`MSe%H6X26q)Np7eJF4^3;7yhR*y9og7kzsH2m8U}2(utO
zAPmbEsGzHBC}(@XxAFU8puXGOd^WEVm7~B^>kQa$d5)Pj4C%V8+)R}vZ`!<(tE*}=
zSu9CS1>G{;V14U2Sz5QYtQ5l0Pc6T#=N3J^bE1;@Nxk3b1hXP0f$RJyc(Ji8ZOiMF
zh*MBEgPo4?{loE25tnjD(;iwT^RI<c%zqD>5!6zBH~!3_VsY5zqgM|_)H$Rq6@rMC
z>3j`>Z-I>*!M2j|9tX9UA*Mv!GOMou3*QoI_-{L}3m@OD^lGI~-Dxul7_fPCOGXd3
zdE<*${WhjyH(AY3w53L(rE0J^GfNPMb1aB2O-p-TNBG9~WAOyrd^Y{L#isU$dQ}ct
z7+`^|wpUfLW<v|K@uYprJ2$OiejeTZe#hpM*@W70sp_RlB5$vtc&5ep6g+45SXB?#
zar@!`?a?^lgs^9q+a6HA<B5z;lTgS^oSe5cuw?{nbX;wEdqiw~F3Zgb8oks5_T+T`
zKk>Dq^xEAPXnzNpF(ukrNHC(yr7(e1b)w!-(@@t|ThZEpNA;IPE!Q$F6b-s;(R2xh
z&FKDb&A~!BvJyVW&d%gzTp-cgu;bL-ef;f*=iRWdNwDjs_jai*5>No`4*dsn_l>+%
z_9!vRgkhLxpKplr?jZj%FW&er+!Q<C*a_>cx*(5rcqu6Od{mc#Q8TS~jA6~JQAj0m
zs4uvgSp6nnT!L<TyJ`H4iwbQ0FN!O(R(#8xR)pVuW;MBNJ80k*V0&|+RVZckT=Xl`
z_3!>TM)L99Ty_tqxPe>end2&f1MbnSx0T)E9jMo7qN=G}cAGt_)nviW$jKJ%hdqH-
zg=>&m2%3D2bWzS%3|K}SEO4TpPSS*Q6XBLzpTq-1PeYX)uN=}rqp0&pe*NyZu-8%$
zauA{>(Dk$@tmnJywABP)mVA;DdC&7NFV2yYayySjqF@QAf3Z>CC>5y|@|a)KI=JpB
zrw}36RR5m$Zzf6_-Ttw&9<w9jY_k5{hSGx2l51g~6}4rI^1k{|`H#GOTaX;(LIjUc
zQR<!|KkYnxQlMW>;&Z|xNm%VHkY-_CeX_m{yS#q%@!bwkEA6{g78!3R=!jUku9#@{
zA4{DN>!l94wj5;1;Im$=DWOm~2;}-a0vBH;nSA#%OsW%r$=2sQ_*5&~(E*>*8O-%>
z<dBI1&MW0<0u1-%x$ls<67e+yK6~WaXSr`qbD;8Dwqw^_1TAwYQl*zRsCt9}3T#mZ
z;2nvp=97I+I%nb9a=Ct4v(4@xO~1G<$|traRd%Q$(Yg>Ljk`rO3D;MR5wwll8L-CD
zI^}i5wreCkRTYN&$}hWe-$U<-*!Q!zI687npP%}AWcK483gN+&zk8$gDTpm?PZ}tS
zrsnH|u=av?-!Eq>Kd;b5a15@|v%gm%#R6rZ+6EcF`U1O|ZRWo9RbOZqA!Um~2E-T-
z9sn>7|KAIsofZ#zJ;!EEip|o;Z7&^rBmNXJw664w#-XdM0BOz%+ak@)Z{`#QFLpkD
z2K?xIZAM@VG;h}4Mkc!f6L(C{&zdN&+a<YJW;nh5QQ;V*?^5J6j@>hPjn;ZzR;Nwa
zCvyIj=`Gr%3kZ0V4T~9F$(~^W;_ksHo*UgGZNHuDl#Oh8I~l8+Ly7#d<%5x!UR-_7
zcEZSq%k-2Y95YU<Ghh48tiG~Ll9B+uhiu9fpusLwkRVlg^|vI+4*;92Tg+#40^UMM
z1J?{~v4GJI$huKf<|-JkOfWJO(247Ed^UnVbu(bSRBd<6_<1(iuS));A#NgPj%<;l
z$fe<}=Ds)cUL_57K7#Qp*iqag^K*TSAh2Fk@>=8whP6EX7wLN7-MM5`xY>1HMaUT!
z^*Im-dfpn+J9WeJ@3@tGp$DaHgZX~yhK1NiauvAblDhh`!rf;!6k&XC*-9zAhnL}d
zWg1C@-?6JdQ$97kU%gDJ<l_;%AL6q2^E+->HYgVMaMycTj67a;2Z`e_Yuf(Qu*`1C
z^|~lT(mPJG#HCvT2|5UlM1-kG8?yc<f3NB57&Bu~T~G8<huAU}n-JbB_YPi;QYg|q
zRkCzBSn`QHtn?JGg8tyc*R_=7u9ll7o9E8D%5Ab2K)kBv8~jn?<jOyo`20ZAwZZH*
zL8f_S7oI;q4`=_fy&SFE@w(StHXlp6=zgrpktBf5YVnZW-~11e;aR7}YF63)>;1>>
z+0ECiRKtm=9}=<;V2ooOGUrA_1nP|IF4cGm%n-5F$*)HY)a`XZU#nancFO6YGv)OX
zLIPjLzrv^$lN$=;BTig^0dCX=69N~_)#<y{O_0o%%8nPEmH)Ic0*OO+VeJEHZ9Xp^
z6!LD5MkjtZs|)$3*RkJTC?N&K=_NcmYj#>SIBUVW)TBWBnd~a7Z&S<C3=_IYl6c+b
zO;`*|D`g?msmpKo|2tK<Sng4v+z*rec6Ybq{lb<c^Bxc<P>?0_8&}Myj|s;h`gfum
zr%6I~9XglG-laWQ%?~vGKk%aVy!@dRubdL&U-RCUF`e!k^&6-We==B~RdnY@`0cY0
z)Y+a*_wEhHe;jdMYZqT74kl*#chK_-%8+g|hLc5J3md{)7L+lxK^N6DR;Rt5^uMY)
zX~fcrAMH5}$QA0BMIz5gC@4i8He3hBh|{4WpIt+sb_p|HrHzU_j31a3j$b)TB@T<#
zN|uGq$~!NrkA4|-ykykf?;DUiS$zs=Im7VN{m1|_qFk<M0B0gnDSv~R_p)Z#eFDj3
zE_0ojpVhSgIp6AE-+;ahb*9zin7^P9SuG=E?K0_oer>x}Z-*PokQ3+#cR>Guq=koz
z#a^H=vSa;B!OQ_QR=u48z7va6%v1JQ;30pHp8p{y;58Rs@ZFaI_el9)@s0Xp>9bYk
zI6x|r=la8wV*|hri^xgONsx5+lcn1W?&V-c2KG3AIvX)-cRZnuU#dkPk@E<eH&A<m
zn|DYom5pkphVE#cF21?=Mv+6|uo0{-oqw7R@(no@c}ZR0&H_@qd*&T+koG>uWy;lB
zg_OPa?a&pu@D;l~8f@9>3sItl780B#U~I^Z@qPh?BKu0$-A`$jkoWfLt(1Z_Z+m&L
z{9dldRb>>#m2=Sj9X5~*CfYCj3d0v#+4x=FXkw3N-0VHR=&gNQKPIU5l+Dkl%nHoi
z-yz+6wg0w0+pGQRor(AfeN!LHzH&1cAD8tg*L}ESRD&&OEK7N9n6kZR{yZCzCza-3
zo8mNAPS|yZ`M5CC<_O$@*U>`##J1Msb|>m8Ck5V>^R^}RR#BT5Uk<Z}?CKxq!e@5e
zPvYYD;1HjwdO0$0ftps>ejElDWjA#Z!}*NtZFn(?xp9*zC7MglI3;Rm#I}DuLIPei
zA33b*{189`4qhL;8$nQ}{-O=u^OTixt6Gk59Bl)>off<1r-hF?B%=I;DGBD9tj^3V
zwk(mRhSE4yp^3uX8zI%&esLI~lY>}YIRDfT99PbQYae&ik7E9EE~V`8S3h7@%rF_z
zAzem-07~^EvwR~px~8`Uwi-{AkmPSZMe+!OF`ViRiRzupu4-?pyIc0c=f{m_>Ei_G
z>kjW2yM|vlDQK_$23WD;s_;|Q`Sts;9Wf}`$lxfV+X)q6w>I?k6l5LI$0X;UXS9wn
z8!+9evZ4GXxf3bJKusX>ky$8`bZpL-YBfZqv1Ki$b!`OefMp%^Jj!+6XxQ<~#=JAD
zgD4nad9MdeTogMDooiLcBY2Cq>enrKXtB^X*bAfmBV0ed(>odXt^18HgA~nY88M=g
zyIX{SJ;>0^0;HE%HV%oQuY9RWY>3J}q{OzQziKXiGZxzqz~(ns?3algje70I_;!MI
zYe9=GjS!QM$k!clX$W*-aLZs9$t0<a9QS1u3_Im^A-U`SpllD?;zdT3;f==mglG;q
zpj)+l1I-7}F}2p;lSB}BSr9y`ibdXjQtMmf0i<BHkt|mdg~R`h^6pIXyykdSD)v>{
z)7uFl=5kXDXpJ{NV#COx9;8|TK49Qn_7N<it-Fb9EJzlNCT%mXWJwdTr)4l)QpKfG
z<dt~s6M5OWO1Yg#U0g&tjIHc%jGPqNgtiLeO)7#3hAv&S<pS{F45dky$Z0)7uWg4U
zNt)zBcF)KXukdVOAj?vN`7hCHWOKsQ0=J{!COwRsUh{A)MWM%_IEp0UQwD4@TX=T7
zE{Q8cG+Lie%ma@07lOYCM2pLzu~~N~`KVw76~&X?f0K!TgJ$h{Dy#JfD^N$Z8jz59
zJCF<{^!AguaSD0_^v)}WOa=mDu)HH^E!>>T)_?|t0aAk@DmdWSyE4k^HN}WOMeGIW
z0VC9LWd_@C4cU*;6xhGNU=BRjXS?;huA&>WL1SbcbQKHQL(q6Ws7|B-7RA-t>fMg|
zb>(bH9vewYba_vP02i3pW0&n&jv+yecuv5;y0(b6>=-eVvZ6Tj9O8foeU@-krkZSy
zbQpPmaYH)|e=1w-aZx)8s39#PLR=h3cpx23xj!@@88JpWHC~=6^hz$6`tHa?hHgOJ
z5Ty%hiRYfsxdbPhkVGq^&U>gH#FoBeQo>F}QoDwg_b2W%lJNq#O{4;JdTnb0Obj4W
zx(5>tdG@Sm0&9JqUOM)vu5yG+gX~^}T_PLv5s5`nA+h7<4%<7-kP+bQKr`CJ+)f{D
zOiywqhwk%J<iOBIY1$dJ%})puclJIJa(+z(3`Vkrg}h&6?ip;T&Hgmw5yOyV;*v33
z!kmJd2SGsQ5Nhdxd)Eg-FE@r?`kVa{X|lLp9oO7RQ<UDU$oagFaDgCrWX<6)2#!00
zn{bFhj7A;G!Toq{i`{*9`sJQaXD%rS$tN=k5DwsS4j{KxS)S2MG*FK3DF~5Bu;dCA
zT1rYTw_I`I*sWX%6z?ee_#ImU{1vLqe4aZkqoIS)Gh%RkR?tfPn}+)Ne{Rv8ydN2_
zRM7UbCb*J4#svsN#xgwZmDY#aNXe=?WARn@p=R6;6f}<G6_f`;N`u8H25xkJLoH?4
zm?}5==-+-ctz?6+K+WtH$BMMiXx2?L<zQR<%Tc#BfnY|gDQSJKpU#2E{+p+Y4!fI@
z?@Za`I*oc<B1y)EbGs$Ho;Okx8X-tKo`&)TG*LdMxY%Ak@W#Rrh2~en$5KcQCAEM%
z4zm6uJ>zyjeyGO@B^(YtO)3K>m07B=j1_1*C~gNl4Xsgwvor%df#LpRFv4o1qDIU}
zNft(hc>MBZKWm?!c8s=i<od(-WfP1_;GW_-FBgC_eu*EwW%Z_5si*M$&Yt=C;1Kqx
zzcaz(88}zS4(#_w5FbTo9DCQ9gt!Nm-z>WH)Vi5M^<P_t4{>Pl@(z>LSZMV8DBAwv
zN@0UU#x%ex?di0l)f-)+SVPM|>U>5nYJsL2<Le8rl=#h%>H?O>EQ!*uh&7>t05Rsx
zbn(9rCMPs025<NTOy)}A7AfO7WPNZszGcCf1ykcyqCxRU+{w@T5B!M5Bsk;&IFN~E
z%+2?*$z&2)0=Y6|kc}Ck<6$3khnpAc`IwX(^oaowd!?uvCneaB5|B#M{)LrE@?vvq
zM#9HfhQyIV6ZbrsiGDa1;H(hAlg_xpLVm}D1>ypJQdfT<yxI>;fK>F>mEbtBZ1snP
z)dM=ATP}bZUXWeSRCREo?lD-FNH&opGdfkdCn4pU{^JA-c1y+(CU@IqhdCJ%tq7!r
z2EtCzr32((<@SVH(Zws%X7YWp+0fUuH|vxib|e|U6g1F3P~;XRZSkj`B*4FDVvXLa
za41M+gs@ngP&<D7h0YN3iFZKZ`g_pcJqO7^2l^h0nga<vZ70%^`M=K<;i*fjW0yY6
zab<5|jB(DXD<s$m2_0jo{M8dI|0bNK#4G8D3x8!@{i;%CdS*vbOEJ~P?RGpxMo&em
z%t9a?YKP<4oW5ScxTlO;nz$e2_T!IFXfJPes5is?uSl6<m@$LHdAtfYeOanFf?Szp
z8LU(5NOg5ZTqk-cjsqP^*<i#&9KqjsWnD=X1aMQ6{~#UNW`au~N_f)wg9l}Tk|~Z>
zEA&Mbo`N`<QK2F9_u*Cok|E}PM~xWEWGwM<?u@}bW%9^5(@^Rd2Wq<>F_t3{XoeNK
znpN(%`E#OvgBeRYRWtSTh7VVuSRm(5IO1U_*y-kI%7+g6`JQ-XA-@D=G}L-i)Menx
zOuE}BE1|h?ghQXN5&==s`djZi%(+%R*gKp5#f;$iIL)6iniCa#*`fCM&n$srB-iP8
zd!B|$Ea`b`xtJp2;?R3NKP7w&X(t6X<Gw2tp3wUmyDm(-%pNY3Y|;?5fau-=BR>};
z=)(Le>oqc3{q>)R*!duM1UN#FV>myVBO)VlyN|M7T)6f3CdD_)Y@WP)d!2!qf3yAv
zWT}6{nJjh`bZPKKw6J$ZR2)1Ic4v}e%zShSvI*9DCc*I~zVEz0gP#_NB-7|SBy~|8
z52E^N6ChR_o}I{0pD8vG>%h8Me-7x6|4*j%6G;w9ftf4O0(O6wS7{7WTF~T|Hbnv2
zGd*5DibQ(ARawwh^Cw<xNF{Ix;=q@HQzc#;ly`j`wluj@AH=X5bDKns&^=l*nT<>O
zmX8Zr^Kix9<#8)g3<(11^v@Uh{1+_K9XwcTA=GRo)Lq0IpF3zTHo5WPRxS1v=n@9t
zsO*67m@4r%BjZC}NYN~m0$am8U2%Z6nBkz5zBk#}p)NNJI)+-dCs5%x{s%dw6N{Q-
z-6xg#orWYI0l&t+8}3=+1EYs(m;kvILtU<)wMaui(<_Fw@7;O$&AT!1PXU0eq>@CH
Ixbe6D0Bn)wGXMYp

diff --git a/doc/source/changes.html b/doc/source/changes.html
index 966b0c97b2..028e1cf9e5 100644
--- a/doc/source/changes.html
+++ b/doc/source/changes.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/configuration.html b/doc/source/configuration.html
index 044bafc70d..88d7476bec 100644
--- a/doc/source/configuration.html
+++ b/doc/source/configuration.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/contributing.html b/doc/source/contributing.html
index f3d4b5a4dc..9826fc7f4c 100644
--- a/doc/source/contributing.html
+++ b/doc/source/contributing.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -52,7 +52,7 @@ <h2>Contributing <small>Help us help you</small></h2>
           <h3>Things To Know</h3>
 
           <br /><strong>Where Things Are</strong>
-          <p>The official DevStack repository is located at <code>git://github.com/openstack-dev/devstack.git</code> and <code>git://git.openstack.org/openstack-dev/devstack.git</code>, both mirrors of the official repo maintained by Gerrit.</p>
+          <p>The official DevStack repository is located at <code>git://git.openstack.org/openstack-dev/devstack.git</code>, replicated from the repo maintained by Gerrit. GitHub also has a mirror at <code>git://github.com/openstack-dev/devstack.git</code>.</p>
           <p>The <a href="https://blueprints.launchpad.net/devstack">blueprint</a> and <a href="https://bugs.launchpad.net/devstack">bug trackers</a> are on Launchpad.  It should be noted that DevStack generally does not use these as strongly as other projects, but we're trying to change that.</p>
           <p>The <a href="https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z">Gerrit review queue</a> is, however, used for all commits except for the text of this website.  That should also change in the near future.</p>
 
diff --git a/doc/source/eucarc.html b/doc/source/eucarc.html
index df5297294a..1dd80968d2 100644
--- a/doc/source/eucarc.html
+++ b/doc/source/eucarc.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/exerciserc.html b/doc/source/exerciserc.html
index 7e4dd54f42..313b0a1daf 100644
--- a/doc/source/exerciserc.html
+++ b/doc/source/exerciserc.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/faq.html b/doc/source/faq.html
index 2c74a66a46..7cbb9d2fc5 100644
--- a/doc/source/faq.html
+++ b/doc/source/faq.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -73,7 +73,7 @@ <h3><a name="general">General Questions</a></h3>
             <dd>A: DevStack is optimized for documentation &amp; developers.  As some of us use <a href="https://github.com/dellcloudedge/crowbar">Crowbar</a> for production deployments, we hope developers documenting how they setup systems for new features supports projects like Crowbar.</dd>
 
             <dt>Q: I'd like to help!</dt>
-            <dd>A: That isn't a question, but please do!  The source for DevStack is <a href="http://github.com/openstack-dev/devstack">github</a> and bug reports go to <a href="http://bugs.launchpad.net/devstack/">LaunchPad</a>.  Contributions follow the usual process as described in the <a href="http://wiki.openstack.org/HowToContribute">OpenStack wiki</a> even though DevStack is not an official OpenStack project.  This site is housed in the CloudBuilder's <a href="http://github.com/cloudbuilders/devstack">github</a> in the gh-pages branch.</dd>
+            <dd>A: That isn't a question, but please do!  The source for DevStack is at <a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a> and bug reports go to <a href="http://bugs.launchpad.net/devstack/">LaunchPad</a>.  Contributions follow the usual process as described in the <a href="http://wiki.openstack.org/HowToContribute">OpenStack wiki</a> even though DevStack is not an official OpenStack project.  This site is housed in the CloudBuilder's <a href="http://github.com/cloudbuilders/devstack">github</a> in the gh-pages branch.</dd>
 
             <dt>Q: Why not use packages?</dt>
             <dd>A: Unlike packages, DevStack leaves your cloud ready to develop - checkouts of the code and services running in screen. However, many people are doing the hard work of packaging and recipes for production deployments.  We hope this script serves as a way to communicate configuration changes between developers and packagers.</dd>
diff --git a/doc/source/guides/multinode-lab.html b/doc/source/guides/multinode-lab.html
index 62232efcd2..6a5f98c11d 100644
--- a/doc/source/guides/multinode-lab.html
+++ b/doc/source/guides/multinode-lab.html
@@ -34,7 +34,7 @@
             <li><a href="../overview.html">Overview</a></li>
             <li><a href="../changes.html">Changes</a></li>
             <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -129,8 +129,8 @@ <h3>Set Up Ssh</h3>
 echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyYjfgyPazTvGpd8OaAvtU2utL8W6gWC4JdRS1J95GhNNfQd657yO6s1AH5KYQWktcE6FO/xNUC2reEXSGC7ezy+sGO1kj9Limv5vrvNHvF1+wts0Cmyx61D2nQw35/Qz8BvpdJANL7VwP/cFI/p3yhvx2lsnjFE3hN8xRB2LtLUopUSVdBwACOVUmH2G+2BWMJDjVINd2DPqRIA4Zhy09KJ3O1Joabr0XpQL0yt/I9x8BVHdAx6l9U0tMg9dj5+tAjZvMAFfye3PJcYwwsfJoFxC8w/SLtqlFX7Ehw++8RtvomvuipLdmWCy+T9hIkl+gHYE4cS3OIqXH7f49jdJf jesse@spacey.local" > ~/.ssh/authorized_keys</pre>
 
         <h3>Download DevStack</h3>
-        <p>Grab the latest version of DevStack from github:</p>
-        <pre>git clone https://github.com/openstack-dev/devstack.git
+        <p>Grab the latest version of DevStack:</p>
+        <pre>git clone https://git.openstack.org/openstack-dev/devstack
 cd devstack</pre>
 
         <p>Up to this point all of the steps apply to each node in the cluster.  From here on
diff --git a/doc/source/guides/pxe-boot.html b/doc/source/guides/pxe-boot.html
index 4dc61a344c..d52b25f276 100644
--- a/doc/source/guides/pxe-boot.html
+++ b/doc/source/guides/pxe-boot.html
@@ -34,7 +34,7 @@
             <li><a href="../overview.html">Overview</a></li>
             <li><a href="../changes.html">Changes</a></li>
             <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/guides/ramdisk.html b/doc/source/guides/ramdisk.html
index eaef16edaa..23239e2b60 100644
--- a/doc/source/guides/ramdisk.html
+++ b/doc/source/guides/ramdisk.html
@@ -34,7 +34,7 @@
             <li><a href="../overview.html">Overview</a></li>
             <li><a href="../changes.html">Changes</a></li>
             <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -74,7 +74,7 @@ <h2>Installation <small>bit blasting</small></h2>
         <h3>Install DevStack</h3>
         <p>Grab the latest version of DevStack via https:</p>
 		<pre>sudo apt-get install git -y
-git clone https://github.com/openstack-dev/devstack.git
+git clone https://git.openstack.org/openstack-dev/devstack
 cd devstack</pre>
 
         <h3>Prepare the Boot RAMdisk</h3>
diff --git a/doc/source/guides/single-machine.html b/doc/source/guides/single-machine.html
index 9471972382..06cc981275 100644
--- a/doc/source/guides/single-machine.html
+++ b/doc/source/guides/single-machine.html
@@ -34,7 +34,7 @@
             <li><a href="../overview.html">Overview</a></li>
             <li><a href="../changes.html">Changes</a></li>
             <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -79,7 +79,7 @@ <h3>Add your user</h3>
         <h3>Download DevStack</h3>
         <p>We'll grab the latest version of DevStack via https:</p>
         <pre>sudo apt-get install git -y || yum install -y git
-git clone https://github.com/openstack-dev/devstack.git
+git clone https://git.openstack.org/openstack-dev/devstack
 cd devstack</pre>
 
         <h3>Run DevStack</h3>
diff --git a/doc/source/guides/single-vm.html b/doc/source/guides/single-vm.html
index 2f1990a943..d189319623 100644
--- a/doc/source/guides/single-vm.html
+++ b/doc/source/guides/single-vm.html
@@ -34,7 +34,7 @@
             <li><a href="../overview.html">Overview</a></li>
             <li><a href="../changes.html">Changes</a></li>
             <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -96,7 +96,7 @@ <h3>Launching With Cloud-Init</h3>
         DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
         sudo chown stack:stack /home/stack
         cd /home/stack
-        git clone https://github.com/openstack-dev/devstack.git
+        git clone https://git.openstack.org/openstack-dev/devstack
         cd devstack
         echo '[[local|localrc]]' > local.conf
         echo ADMIN_PASSWORD=password >> local.conf
diff --git a/doc/source/guides/usb-boot.html b/doc/source/guides/usb-boot.html
index 75adc6f865..2a05f89d89 100644
--- a/doc/source/guides/usb-boot.html
+++ b/doc/source/guides/usb-boot.html
@@ -34,7 +34,7 @@
             <li><a href="../overview.html">Overview</a></li>
             <li><a href="../changes.html">Changes</a></li>
             <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/index.html b/doc/source/index.html
index dada57dd53..5f1efd77fb 100644
--- a/doc/source/index.html
+++ b/doc/source/index.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
@@ -55,9 +55,9 @@ <h1 id="main_header">DevStack - an OpenStack Community Production</h1>
         <div class="pull-left">
           <ol id="getting_started">
             <li id="ubuntu">Setup a fresh supported Linux installation.</li>
-            <li id="github">
-              Clone devstack from devstack.
-              <pre>git clone https://github.com/openstack-dev/devstack.git</pre>
+            <li id="git">
+              Clone devstack from git.openstack.org.
+              <pre>git clone https://git.openstack.org/openstack-dev/devstack</pre>
             </li>
             <li id="install">
               Deploy your OpenStack Cloud
@@ -84,7 +84,7 @@ <h3>Install Selected OS</h3>
             </li>
             <li>
               <h3>Download DevStack</h3>
-              <pre>git clone https://github.com/openstack-dev/devstack.git</pre>
+              <pre>git clone https://git.openstack.org/openstack-dev/devstack</pre>
               <p>The <code>devstack</code> repo contains a script that installs OpenStack and templates for configuration files</p>
             </li>
             <li>
diff --git a/doc/source/local.conf.html b/doc/source/local.conf.html
index ed53adfdb0..2635ac6694 100644
--- a/doc/source/local.conf.html
+++ b/doc/source/local.conf.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/localrc.html b/doc/source/localrc.html
index 0f669bd679..40a20043a2 100644
--- a/doc/source/localrc.html
+++ b/doc/source/localrc.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/openrc.html b/doc/source/openrc.html
index da6697fb92..94b253dfe1 100644
--- a/doc/source/openrc.html
+++ b/doc/source/openrc.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/overview.html b/doc/source/overview.html
index baee400806..9cee052129 100644
--- a/doc/source/overview.html
+++ b/doc/source/overview.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/plugins.html b/doc/source/plugins.html
index 3327128dff..700a209ac9 100644
--- a/doc/source/plugins.html
+++ b/doc/source/plugins.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>
diff --git a/doc/source/stackrc.html b/doc/source/stackrc.html
index d83fbc164c..2df9d385f7 100644
--- a/doc/source/stackrc.html
+++ b/doc/source/stackrc.html
@@ -34,7 +34,7 @@
             <li><a href="overview.html">Overview</a></li>
             <li><a href="changes.html">Changes</a></li>
             <li><a href="faq.html">FAQ</a></li>
-            <li><a href="http://github.com/openstack-dev/devstack">GitHub</a></li>
+            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
             <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
           </ul>
         </div>

From 50e9b9e25b94b6a088680d93b8873c0368a974b4 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 17 Oct 2014 11:04:48 -0500
Subject: [PATCH 0026/3333] Remove internal bash8

We use the one installed from pypi in the tox venv, so dump
the original.  Fix up run_tests.sh.

Change-Id: I6b0aa1da9bfa4d742a7210e6ff800d72492a2178
---
 run_tests.sh   |   2 +-
 tools/bash8.py | 215 -------------------------------------------------
 2 files changed, 1 insertion(+), 216 deletions(-)
 delete mode 100755 tools/bash8.py

diff --git a/run_tests.sh b/run_tests.sh
index b1aef4f81f..bf90332698 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -43,7 +43,7 @@ fi
 
 echo "Running bash8..."
 
-./tools/bash8.py -v $FILES
+tox -ebashate
 pass_fail $? 0 bash8
 
 
diff --git a/tools/bash8.py b/tools/bash8.py
deleted file mode 100755
index 3abf87b484..0000000000
--- a/tools/bash8.py
+++ /dev/null
@@ -1,215 +0,0 @@
-#!/usr/bin/env python
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-# bash8 - a pep8 equivalent for bash scripts
-#
-# this program attempts to be an automated style checker for bash scripts
-# to fill the same part of code review that pep8 does in most OpenStack
-# projects. It starts from humble beginnings, and will evolve over time.
-#
-# Currently Supported checks
-#
-# Errors
-# Basic white space errors, for consistent indenting
-# - E001: check that lines do not end with trailing whitespace
-# - E002: ensure that indents are only spaces, and not hard tabs
-# - E003: ensure all indents are a multiple of 4 spaces
-# - E004: file did not end with a newline
-#
-# Structure errors
-#
-# A set of rules that help keep things consistent in control blocks.
-# These are ignored on long lines that have a continuation, because
-# unrolling that is kind of "interesting"
-#
-# - E010: *do* not on the same line as *for*
-# - E011: *then* not on the same line as *if*
-# - E012: heredoc didn't end before EOF
-
-import argparse
-import fileinput
-import re
-import sys
-
-ERRORS = 0
-IGNORE = None
-
-
-def register_ignores(ignores):
-    global IGNORE
-    if ignores:
-        IGNORE = '^(' + '|'.join(ignores.split(',')) + ')'
-
-
-def should_ignore(error):
-    return IGNORE and re.search(IGNORE, error)
-
-
-def print_error(error, line,
-                filename=None, filelineno=None):
-    if not filename:
-        filename = fileinput.filename()
-    if not filelineno:
-        filelineno = fileinput.filelineno()
-    global ERRORS
-    ERRORS = ERRORS + 1
-    print("%s: '%s'" % (error, line.rstrip('\n')))
-    print(" - %s: L%s" % (filename, filelineno))
-
-
-def not_continuation(line):
-    return not re.search('\\\\$', line)
-
-
-def check_for_do(line):
-    if not_continuation(line):
-        match = re.match('^\s*(for|while|until)\s', line)
-        if match:
-            operator = match.group(1).strip()
-            if not re.search(';\s*do(\b|$)', line):
-                print_error('E010: Do not on same line as %s' % operator,
-                            line)
-
-
-def check_if_then(line):
-    if not_continuation(line):
-        if re.search('^\s*if \[', line):
-            if not re.search(';\s*then(\b|$)', line):
-                print_error('E011: Then non on same line as if', line)
-
-
-def check_no_trailing_whitespace(line):
-    if re.search('[ \t]+$', line):
-        print_error('E001: Trailing Whitespace', line)
-
-
-def check_indents(line):
-    m = re.search('^(?P<indent>[ \t]+)', line)
-    if m:
-        if re.search('\t', m.group('indent')):
-            print_error('E002: Tab indents', line)
-        if (len(m.group('indent')) % 4) != 0:
-            print_error('E003: Indent not multiple of 4', line)
-
-def check_function_decl(line):
-    failed = False
-    if line.startswith("function"):
-        if not re.search('^function [\w-]* \{$', line):
-            failed = True
-    else:
-        # catch the case without "function", e.g.
-        # things like '^foo() {'
-        if re.search('^\s*?\(\)\s*?\{', line):
-            failed = True
-
-    if failed:
-        print_error('E020: Function declaration not in format '
-                    ' "^function name {$"', line)
-
-
-def starts_multiline(line):
-    m = re.search("[^<]<<\s*(?P<token>\w+)", line)
-    if m:
-        return m.group('token')
-    else:
-        return False
-
-
-def end_of_multiline(line, token):
-    if token:
-        return re.search("^%s\s*$" % token, line) is not None
-    return False
-
-
-def check_files(files, verbose):
-    in_multiline = False
-    multiline_start = 0
-    multiline_line = ""
-    logical_line = ""
-    token = False
-    prev_file = None
-    prev_line = ""
-    prev_lineno = 0
-
-    for line in fileinput.input(files):
-        if fileinput.isfirstline():
-            # if in_multiline when the new file starts then we didn't
-            # find the end of a heredoc in the last file.
-            if in_multiline:
-                print_error('E012: heredoc did not end before EOF',
-                            multiline_line,
-                            filename=prev_file, filelineno=multiline_start)
-                in_multiline = False
-
-            # last line of a previous file should always end with a
-            # newline
-            if prev_file and not prev_line.endswith('\n'):
-                print_error('E004: file did not end with a newline',
-                            prev_line,
-                            filename=prev_file, filelineno=prev_lineno)
-
-            prev_file = fileinput.filename()
-
-            if verbose:
-                print "Running bash8 on %s" % fileinput.filename()
-
-        # NOTE(sdague): multiline processing of heredocs is interesting
-        if not in_multiline:
-            logical_line = line
-            token = starts_multiline(line)
-            if token:
-                in_multiline = True
-                multiline_start = fileinput.filelineno()
-                multiline_line = line
-                continue
-        else:
-            logical_line = logical_line + line
-            if not end_of_multiline(line, token):
-                continue
-            else:
-                in_multiline = False
-
-        check_no_trailing_whitespace(logical_line)
-        check_indents(logical_line)
-        check_for_do(logical_line)
-        check_if_then(logical_line)
-        check_function_decl(logical_line)
-
-        prev_line = logical_line
-        prev_lineno = fileinput.filelineno()
-
-def get_options():
-    parser = argparse.ArgumentParser(
-        description='A bash script style checker')
-    parser.add_argument('files', metavar='file', nargs='+',
-                        help='files to scan for errors')
-    parser.add_argument('-i', '--ignore', help='Rules to ignore')
-    parser.add_argument('-v', '--verbose', action='store_true', default=False)
-    return parser.parse_args()
-
-
-def main():
-    opts = get_options()
-    register_ignores(opts.ignore)
-    check_files(opts.files, opts.verbose)
-
-    if ERRORS > 0:
-        print("%d bash8 error(s) found" % ERRORS)
-        return 1
-    else:
-        return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

From 24779f65a675f2e78c09b2520ebefcd52b4f0be0 Mon Sep 17 00:00:00 2001
From: Alistair Coles <alistair.coles@hp.com>
Date: Wed, 15 Oct 2014 18:57:59 +0100
Subject: [PATCH 0027/3333] Add swift user and project in non-default domain

Swift has functional tests that check access controls
between users and projects in differing domains. Those tests
are currently skipped by default since swift tests are
configured to use keystone v2 API. In order for those
tests to pass when using keystone v3 API, a user and
project must be setup in a non-default domain.

This patch creates a domain, and a user and project in
that domain, in support of swift functional tests moving
to using keystone v3 API.

Changes:
lib/swift
    - create a new domain, project and user for
      swift testing
    - add new project and user credentials to swift
      test config file
    - set correct identity service url in swift test
      config file according to kesytone API version

functions-common
    - add function get_or_create_domain
    - modify get_or_create_user and get_or_create_project
      functions to optionally specify a domain

Change-Id: I557de01bf196075f2f3adcdf4dd1b43756d8a0ae
---
 functions-common | 44 ++++++++++++++++++++++++++++++++++++++------
 lib/swift        | 33 +++++++++++++++++++++++++++------
 2 files changed, 65 insertions(+), 12 deletions(-)

diff --git a/functions-common b/functions-common
index 333f31da02..4b41bedbbd 100644
--- a/functions-common
+++ b/functions-common
@@ -790,38 +790,70 @@ function policy_add {
     mv ${tmpfile} ${policy_file}
 }
 
+# Gets or creates a domain
+# Usage: get_or_create_domain <name> <description>
+function get_or_create_domain {
+    local os_url="$KEYSTONE_SERVICE_URI/v3"
+    # Gets domain id
+    local domain_id=$(
+        # Gets domain id
+        openstack --os-token=$OS_TOKEN --os-url=$os_url \
+            --os-identity-api-version=3 domain show $1 \
+            -f value -c id 2>/dev/null ||
+        # Creates new domain
+        openstack --os-token=$OS_TOKEN --os-url=$os_url \
+            --os-identity-api-version=3 domain create $1 \
+            --description "$2" \
+            -f value -c id
+    )
+    echo $domain_id
+}
+
 # Gets or creates user
-# Usage: get_or_create_user <username> <password> <project> [<email>]
+# Usage: get_or_create_user <username> <password> <project> [<email> [<domain>]]
 function get_or_create_user {
     if [[ ! -z "$4" ]]; then
         local email="--email=$4"
     else
         local email=""
     fi
+    local os_cmd="openstack"
+    local domain=""
+    if [[ ! -z "$5" ]]; then
+        domain="--domain=$5"
+        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI/v3 --os-identity-api-version=3"
+    fi
     # Gets user id
     local user_id=$(
         # Gets user id
-        openstack user show $1 -f value -c id 2>/dev/null ||
+        $os_cmd user show $1 $domain -f value -c id 2>/dev/null ||
         # Creates new user
-        openstack user create \
+        $os_cmd user create \
             $1 \
             --password "$2" \
             --project $3 \
             $email \
+            $domain \
             -f value -c id
     )
     echo $user_id
 }
 
 # Gets or creates project
-# Usage: get_or_create_project <name>
+# Usage: get_or_create_project <name> [<domain>]
 function get_or_create_project {
     # Gets project id
+    local os_cmd="openstack"
+    local domain=""
+    if [[ ! -z "$2" ]]; then
+        domain="--domain=$2"
+        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI/v3 --os-identity-api-version=3"
+    fi
     local project_id=$(
         # Gets project id
-        openstack project show $1 -f value -c id 2>/dev/null ||
+        $os_cmd project show $1 $domain -f value -c id 2>/dev/null ||
         # Creates new project if not exists
-        openstack project create $1 -f value -c id
+        $os_cmd project create $1 $domain -f value -c id
     )
     echo $project_id
 }
diff --git a/lib/swift b/lib/swift
index 15bd2a9471..c8780ba322 100644
--- a/lib/swift
+++ b/lib/swift
@@ -468,12 +468,21 @@ EOF
     iniset ${testfile} func_test username3 swiftusertest3
     iniset ${testfile} func_test account2 swifttenanttest2
     iniset ${testfile} func_test username2 swiftusertest2
+    iniset ${testfile} func_test account4 swifttenanttest4
+    iniset ${testfile} func_test username4 swiftusertest4
+    iniset ${testfile} func_test password4 testing4
+    iniset ${testfile} func_test domain4 swift_test
 
     if is_service_enabled key;then
         iniuncomment ${testfile} func_test auth_version
+        local auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
         iniset ${testfile} func_test auth_port ${KEYSTONE_AUTH_PORT}
-        iniset ${testfile} func_test auth_prefix /v2.0/
+        if [[ $auth_vers == "3" ]]; then
+            iniset ${testfile} func_test auth_prefix /v3/
+        else
+            iniset ${testfile} func_test auth_prefix /v2.0/
+        fi
     fi
 
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
@@ -548,12 +557,13 @@ function create_swift_disk {
 # since we want to make it compatible with tempauth which use
 # underscores for separators.
 
-# Tenant               User       Roles
+# Tenant             User               Roles          Domain
 # ------------------------------------------------------------------
-# service            swift              service
-# swifttenanttest1   swiftusertest1     admin
-# swifttenanttest1   swiftusertest3     anotherrole
-# swifttenanttest2   swiftusertest2     admin
+# service            swift              service        default
+# swifttenanttest1   swiftusertest1     admin          default
+# swifttenanttest1   swiftusertest3     anotherrole    default
+# swifttenanttest2   swiftusertest2     admin          default
+# swifttenanttest4   swiftusertest4     admin          swift_test
 
 function create_swift_accounts {
     # Defines specific passwords used by tools/create_userrc.sh
@@ -562,6 +572,7 @@ function create_swift_accounts {
     export swiftusertest1_password=testing
     export swiftusertest2_password=testing2
     export swiftusertest3_password=testing3
+    export swiftusertest4_password=testing4
 
     KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
 
@@ -603,6 +614,16 @@ function create_swift_accounts {
         "$swift_tenant_test2" "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
     get_or_add_user_role $admin_role $swift_user_test2 $swift_tenant_test2
+
+    local swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
+    die_if_not_set $LINENO swift_domain "Failure creating swift_test domain"
+
+    local swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
+    die_if_not_set $LINENO swift_tenant_test4 "Failure creating swift_tenant_test4"
+    local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
+        $swift_tenant_test4 "test4@example.com" $swift_domain)
+    die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
+    get_or_add_user_role $admin_role $swift_user_test4 $swift_tenant_test4
 }
 
 # init_swift() - Initialize rings

From 4b109297d5b3dcdcdc2c7e4df1a1571cc674ee9f Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 21 Oct 2014 18:17:48 -0400
Subject: [PATCH 0028/3333] Configure glance CA certificate path in cinder

A new configuration option is available in cinder for setting
the CA path. Configure this option in devstack when native SSL
or TLS proxy is configured.

Change-Id: I2cf9a3b8ba8e4896bd98efe0fb6f7d62fb279d90
Closes-Bug: 1384267
---
 lib/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cinder b/lib/cinder
index b30a036d16..29cda42eb2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -306,6 +306,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
     if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
+        iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
     # Register SSL certificates if provided

From ed077b2846af2b412247208316e6881bed65e6bb Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 22 Oct 2014 11:35:29 +1100
Subject: [PATCH 0029/3333] Always install latest EPEL

Having issues with the centos7 job, that seem to be because they use
an old snapshot that hasn't updated to the latest EPEL.  Thus we
re-install it to ensure we're getting the latest.

Change-Id: I7930f3e05ee953dab80b06142c17d6aa70f2c2d1
---
 stack.sh | 51 ++++++++++++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/stack.sh b/stack.sh
index 3b5fb7459b..ec13338948 100755
--- a/stack.sh
+++ b/stack.sh
@@ -234,36 +234,41 @@ fi
 
 if [[ is_fedora && ( $DISTRO == "rhel6" || $DISTRO == "rhel7" ) ]]; then
     # RHEL requires EPEL for many Open Stack dependencies
-    if ! sudo yum repolist enabled epel | grep -q 'epel'; then
-        echo "EPEL not detected; installing"
-        # This trick installs the latest epel-release from a bootstrap
-        # repo, then removes itself (as epel-release installed the
-        # "real" repo).
-        #
-        # you would think that rather than this, you could use
-        # $releasever directly in .repo file we create below.  However
-        # RHEL gives a $releasever of "6Server" which breaks the path;
-        # see https://bugzilla.redhat.com/show_bug.cgi?id=1150759
-        if [[ $DISTRO == "rhel7" ]]; then
-            epel_ver="7"
-        elif [[ $DISTRO == "rhel6" ]]; then
-            epel_ver="6"
-        fi
 
-        cat <<EOF | sudo tee /etc/yum.repos.d/epel-bootstrap.repo
-[epel]
+    # note we always remove and install latest -- some environments
+    # use snapshot images, and if EPEL version updates they break
+    # unless we update them to latest version.
+    if sudo yum repolist enabled epel | grep -q 'epel'; then
+        uninstall_package epel-release || true
+    fi
+
+    # This trick installs the latest epel-release from a bootstrap
+    # repo, then removes itself (as epel-release installed the
+    # "real" repo).
+    #
+    # you would think that rather than this, you could use
+    # $releasever directly in .repo file we create below.  However
+    # RHEL gives a $releasever of "6Server" which breaks the path;
+    # see https://bugzilla.redhat.com/show_bug.cgi?id=1150759
+    if [[ $DISTRO == "rhel7" ]]; then
+        epel_ver="7"
+    elif [[ $DISTRO == "rhel6" ]]; then
+        epel_ver="6"
+    fi
+
+    cat <<EOF | sudo tee /etc/yum.repos.d/epel-bootstrap.repo
+[epel-bootstrap]
 name=Bootstrap EPEL
 mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-$epel_ver&arch=\$basearch
 failovermethod=priority
 enabled=0
 gpgcheck=0
 EOF
-        # bare yum call due to --enablerepo
-        sudo yum --enablerepo=epel -y install epel-release || \
-            die $LINENO "Error installing EPEL repo, cannot continue"
-        # epel rpm has installed it's version
-        sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
-    fi
+    # bare yum call due to --enablerepo
+    sudo yum --enablerepo=epel-bootstrap -y install epel-release || \
+        die $LINENO "Error installing EPEL repo, cannot continue"
+    # epel rpm has installed it's version
+    sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
 
     # ... and also optional to be enabled
     is_package_installed yum-utils || install_package yum-utils

From 09e550c370cc79442236f8b05d00a7554bec9505 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean_collins2@cable.comcast.com>
Date: Tue, 21 Oct 2014 11:40:08 -0400
Subject: [PATCH 0030/3333] Convert all HTML doc to RST

The motivation for this conversion is to have DevStack's docs be
generated using a more familair workflow for OpenStack projects, using
Sphinx.

Changing from raw HTML to RST will also make it easier to contribute
more documentation, as well as making edits less of a hassle.

The majority of the work was done by using Pandoc to convert from HTML
to RST, with minor edits to the output to remove errors in Sphinx.

Change-Id: I9636017965aeade37b950ddf5bdb0c22ab9004bd
---
 doc/source/changes.html               |  70 ----
 doc/source/changes.rst                |  18 +
 doc/source/conf.py                    | 263 ++++++++++++
 doc/source/configuration.html         | 237 -----------
 doc/source/configuration.rst          | 360 +++++++++++++++++
 doc/source/contributing.html          |  88 ----
 doc/source/contributing.rst           | 105 +++++
 doc/source/eucarc.html                |  94 -----
 doc/source/eucarc.rst                 |  57 +++
 doc/source/exerciserc.html            |  88 ----
 doc/source/exerciserc.rst             |  54 +++
 doc/source/faq.html                   | 169 --------
 doc/source/faq.rst                    | 184 +++++++++
 doc/source/guides/multinode-lab.html  | 336 ---------------
 doc/source/guides/multinode-lab.rst   | 382 +++++++++++++++++
 doc/source/guides/pxe-boot.html       | 147 -------
 doc/source/guides/pxe-boot.rst        | 143 +++++++
 doc/source/guides/ramdisk.html        | 119 ------
 doc/source/guides/ramdisk.rst         |  89 ++++
 doc/source/guides/single-machine.html | 131 ------
 doc/source/guides/single-machine.rst  | 145 +++++++
 doc/source/guides/single-vm.html      | 137 -------
 doc/source/guides/single-vm.rst       | 110 +++++
 doc/source/guides/usb-boot.html       |  99 -----
 doc/source/guides/usb-boot.rst        |  60 +++
 doc/source/index.html                 | 562 --------------------------
 doc/source/index.rst                  | 383 ++++++++++++++++++
 doc/source/local.conf.html            |  64 ---
 doc/source/local.conf.rst             |  20 +
 doc/source/localrc.html               |  60 ---
 doc/source/localrc.rst                |  20 +
 doc/source/openrc.html                | 115 ------
 doc/source/openrc.rst                 |  88 ++++
 doc/source/overview.html              | 118 ------
 doc/source/overview.rst               | 103 +++++
 doc/source/plugins.html               | 142 -------
 doc/source/plugins.rst                | 124 ++++++
 doc/source/stackrc.html               | 101 -----
 doc/source/stackrc.rst                |  77 ++++
 setup.cfg                             |  23 ++
 setup.py                              |  22 +
 tox.ini                               |   7 +-
 42 files changed, 2836 insertions(+), 2878 deletions(-)
 delete mode 100644 doc/source/changes.html
 create mode 100644 doc/source/changes.rst
 create mode 100644 doc/source/conf.py
 delete mode 100644 doc/source/configuration.html
 create mode 100644 doc/source/configuration.rst
 delete mode 100644 doc/source/contributing.html
 create mode 100644 doc/source/contributing.rst
 delete mode 100644 doc/source/eucarc.html
 create mode 100644 doc/source/eucarc.rst
 delete mode 100644 doc/source/exerciserc.html
 create mode 100644 doc/source/exerciserc.rst
 delete mode 100644 doc/source/faq.html
 create mode 100644 doc/source/faq.rst
 delete mode 100644 doc/source/guides/multinode-lab.html
 create mode 100644 doc/source/guides/multinode-lab.rst
 delete mode 100644 doc/source/guides/pxe-boot.html
 create mode 100644 doc/source/guides/pxe-boot.rst
 delete mode 100644 doc/source/guides/ramdisk.html
 create mode 100644 doc/source/guides/ramdisk.rst
 delete mode 100644 doc/source/guides/single-machine.html
 create mode 100644 doc/source/guides/single-machine.rst
 delete mode 100644 doc/source/guides/single-vm.html
 create mode 100644 doc/source/guides/single-vm.rst
 delete mode 100644 doc/source/guides/usb-boot.html
 create mode 100644 doc/source/guides/usb-boot.rst
 delete mode 100644 doc/source/index.html
 create mode 100644 doc/source/index.rst
 delete mode 100644 doc/source/local.conf.html
 create mode 100644 doc/source/local.conf.rst
 delete mode 100644 doc/source/localrc.html
 create mode 100644 doc/source/localrc.rst
 delete mode 100644 doc/source/openrc.html
 create mode 100644 doc/source/openrc.rst
 delete mode 100644 doc/source/overview.html
 create mode 100644 doc/source/overview.rst
 delete mode 100644 doc/source/plugins.html
 create mode 100644 doc/source/plugins.rst
 delete mode 100644 doc/source/stackrc.html
 create mode 100644 doc/source/stackrc.rst
 create mode 100644 setup.cfg
 create mode 100755 setup.py

diff --git a/doc/source/changes.html b/doc/source/changes.html
deleted file mode 100644
index 028e1cf9e5..0000000000
--- a/doc/source/changes.html
+++ /dev/null
@@ -1,70 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Recent Changes</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-      
-      <section id="faq" class="span12">
-
-        <div class='row pull-left'>
-          <h2>Recent Changes <small>What's been happening?</small></h2>
-          <p>These are the commits to DevStack for the last six months.  For the complete list see <a href="https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack,n,z">the DevStack project in Gerrit</a>.</p>
-
-          <ul class='pull-left'>
-            <!--
-              This list is generated by:
-              git log --pretty=format:'            <li>%s - <em>Commit <a href="https://review.openstack.org/#q,%h,n,z">%h</a> %cd</em></li>' --date=short --since 2014-01-01 | grep -v Merge
-            -->
-            <!-- Begin git log %GIT_LOG% -->
-            <!-- End git log -->
-          </ul>
-        </div>        
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/changes.rst b/doc/source/changes.rst
new file mode 100644
index 0000000000..7ce629faa9
--- /dev/null
+++ b/doc/source/changes.rst
@@ -0,0 +1,18 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Recent Changes What's been happening?
+-------------------------------------
+
+These are the commits to DevStack for the last six months. For the
+complete list see `the DevStack project in
+Gerrit <https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack,n,z>`__.
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/conf.py b/doc/source/conf.py
new file mode 100644
index 0000000000..3e9aa45911
--- /dev/null
+++ b/doc/source/conf.py
@@ -0,0 +1,263 @@
+# -*- coding: utf-8 -*-
+#
+# Tempest documentation build configuration file, created by
+# sphinx-quickstart on Tue May 21 17:43:32 2013.
+#
+# This file is execfile()d with the current directory set to its containing dir.
+#
+# Note that not all possible configuration values are present in this
+# autogenerated file.
+#
+# All configuration values have a default; values that are commented out
+# serve to show the default.
+
+import sys
+import os
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#sys.path.insert(0, os.path.abspath('.'))
+
+# -- General configuration -----------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+#needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be extensions
+# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
+extensions = [ 'oslosphinx' ]
+
+todo_include_todos = True
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The encoding of source files.
+#source_encoding = 'utf-8-sig'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = u'DevStack'
+copyright = u'2014, OpenStack Foundation'
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+#language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+#today = ''
+# Else, today_fmt is used as the format for a strftime call.
+#today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+exclude_patterns = ['_build']
+
+# The reST default role (used for this markup: `text`) to use for all documents.
+#default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+#add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+add_module_names = False
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# A list of ignored prefixes for module index sorting.
+modindex_common_prefix = ['DevStack-doc.']
+
+# -- Options for man page output ----------------------------------------------
+man_pages = []
+
+# -- Options for HTML output ---------------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+html_theme = 'nature'
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+#html_theme_options = {}
+
+# Add any paths that contain custom themes here, relative to this directory.
+#html_theme_path = []
+
+# The name for this set of Sphinx documents.  If None, it defaults to
+# "<project> v<release> documentation".
+#html_title = None
+
+# A shorter title for the navigation bar.  Default is the same as html_title.
+#html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+#html_logo = None
+
+# The name of an image file (within the static path) to use as favicon of the
+# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+#html_favicon = None
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+git_cmd = "git log --pretty=format:'%ad, commit %h' --date=local -n1"
+html_last_updated_fmt = os.popen(git_cmd).read()
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+#html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+#html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+#html_additional_pages = {}
+
+# If false, no module index is generated.
+html_domain_indices = False
+
+# If false, no index is generated.
+html_use_index = False
+
+# If true, the index is split into individual pages for each letter.
+#html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+#html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+#html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+#html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it.  The value of this option must be the
+# base URL from which the finished HTML is served.
+#html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+#html_file_suffix = None
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'DevStack-doc'
+
+
+# -- Options for LaTeX output --------------------------------------------------
+
+latex_elements = {
+# The paper size ('letterpaper' or 'a4paper').
+#'papersize': 'letterpaper',
+
+# The font size ('10pt', '11pt' or '12pt').
+#'pointsize': '10pt',
+
+# Additional stuff for the LaTeX preamble.
+#'preamble': '',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title, author, documentclass [howto/manual]).
+latex_documents = [
+  ('index', 'DevStack-doc.tex', u'DevStack Docs',
+   u'OpenStack DevStack Team', 'manual'),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+#latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+#latex_use_parts = False
+
+# If true, show page references after internal links.
+#latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+#latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+#latex_appendices = []
+
+# If false, no module index is generated.
+#latex_domain_indices = True
+
+# -- Options for Texinfo output ------------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+  ('index', 'DevStack-doc', u'DevStack Docs',
+   u'OpenStack DevStack Team', 'DevStack-doc', 'DevStack documentation',
+   'Miscellaneous'),
+]
+
+# Documents to append as an appendix to all manuals.
+#texinfo_appendices = []
+
+# If false, no module index is generated.
+#texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+#texinfo_show_urls = 'footnote'
+
+
+# -- Options for Epub output ---------------------------------------------------
+
+# Bibliographic Dublin Core info.
+epub_title = u'DevStack Documentation'
+epub_author = u'OpenStack DevStack Team'
+epub_publisher = u'OpenStack DevStack Team'
+epub_copyright = u'2014, OpenStack DevStack Team'
+
+# The language of the text. It defaults to the language option
+# or en if the language is not set.
+#epub_language = ''
+
+# The scheme of the identifier. Typical schemes are ISBN or URL.
+#epub_scheme = ''
+
+# The unique identifier of the text. This can be a ISBN number
+# or the project homepage.
+#epub_identifier = ''
+
+# A unique identification for the text.
+#epub_uid = ''
+
+# A tuple containing the cover image and cover page html template filenames.
+#epub_cover = ()
+
+# HTML files that should be inserted before the pages created by sphinx.
+# The format is a list of tuples containing the path and title.
+#epub_pre_files = []
+
+# HTML files shat should be inserted after the pages created by sphinx.
+# The format is a list of tuples containing the path and title.
+#epub_post_files = []
+
+# A list of files that should not be packed into the epub file.
+#epub_exclude_files = []
+
+# The depth of the table of contents in toc.ncx.
+#epub_tocdepth = 3
+
+# Allow duplicate toc entries.
+#epub_tocdup = True
diff --git a/doc/source/configuration.html b/doc/source/configuration.html
deleted file mode 100644
index 88d7476bec..0000000000
--- a/doc/source/configuration.html
+++ /dev/null
@@ -1,237 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Overview</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-
-      <section id="overview" class="span12">
-
-        <div class='row pull-left'>
-          <h2>Configuration <small>Making it go my way</small></h2>
-          <p>DevStack has always tried to be mostly-functional with a minimal amount of configuration.  The number of options has ballooned as projects add features, new projects added and more combinations need to be tested.  Historically DevStack obtained all local configuration and customizations from a <code>localrc</code> file.  The number of configuration variables that are simply passed-through to the individual project configuration files is also increasing.  The old mechanism for this (<code>EXTRAS_OPTS</code> and friends) required specific code for each file and did not scale well.</p>
-          <p>In Oct 2013 a new configuration method was introduced (in <a href="https://review.openstack.org/#/c/46768/">review 46768</a>) to hopefully simplify this process and meet the following goals:</p>
-          <ul>
-            <li>contain all non-default local configuration in a single file</li>
-            <li>be backward-compatible with <code>localrc</code> to smooth the transition process</li>
-            <li>allow settings in arbitrary configuration files to be changed</li>
-          </ul>
-
-          <h3>local.conf</h3>
-          <p>The new configuration file is <code>local.conf</code> and resides in the root DevStack directory like the old <code>localrc</code> file.  It is a modified INI format file that introduces a meta-section header to carry additional information regarding the configuration files to be changed.</p>
-
-          <p>The new header is similar to a normal INI section header but with double brackets (<code>[[ ... ]]</code>) and two internal fields separated by a pipe (<code>|</code>):</p>
-<pre>[[ &lt;phase&gt; | &lt;config-file-name&gt; ]]
-</pre>
-
-          <p>where <code>&lt;phase&gt;</code> is one of a set of phase names defined by <code>stack.sh</code> and <code>&lt;config-file-name&gt;</code> is the configuration filename.  The filename is eval'ed in the <code>stack.sh</code> context so all environment variables are available and may be used.  Using the project config file variables in the header is strongly suggested (see the <code>NOVA_CONF</code> example below).  If the path of the config file does not exist it is skipped.</p>
-
-          <p>The defined phases are:</p>
-          <ul>
-            <li><strong>local</strong> - extracts <code>localrc</code> from <code>local.conf</code> before <code>stackrc</code> is sourced</li>
-            <li><strong>pre-install</strong> - runs after the system packages are installed but before any of the source repositories are installed</li>
-            <li><strong>install</strong> - runs immediately after the repo installations are complete</li>
-            <li><strong>post-config</strong> - runs after the layer 2 services are configured and before they are started</li>
-            <li><strong>extra</strong> - runs after services are started and before any files in <code>extra.d</code> are executed
-          </ul>
-
-          <p>The file is processed strictly in sequence; meta-sections may be specified more than once but if any settings are duplicated the last to appear in the file will be used.</p>
-<pre>[[post-config|$NOVA_CONF]]
-[DEFAULT]
-use_syslog = True
-
-[osapi_v3]
-enabled = False
-</pre>
-
-          <p>A specific meta-section <code>local|localrc</code> is used to
-          provide a default <code>localrc</code> file (actually
-          <code>.localrc.auto</code>).  This allows all custom settings
-          for DevStack to be contained in a single file.  If <code>localrc</code>
-          exists it will be used instead to preserve backward-compatibility.  More
-          details on the <a href="localrc.html">contents of localrc</a> are available.</p>
-<pre>[[local|localrc]]
-FIXED_RANGE=10.254.1.0/24
-ADMIN_PASSWORD=speciale
-LOGFILE=$DEST/logs/stack.sh.log
-</pre>
-
-          <p>Note that <code>Q_PLUGIN_CONF_FILE</code> is unique in that it is assumed to <em>NOT</em> start with a <code>/</code> (slash) character.  A slash will need to be added:</p>
-<pre>[[post-config|/$Q_PLUGIN_CONF_FILE]]
-</pre>
-
-          <p>Also note that the <code>localrc</code> section is sourced as a shell script fragment amd <string>MUST</strong> conform to the shell requirements, specifically no whitespace around <code>=</code> (equals).</p>
-
-          <a id="minimal"></a>
-          <h3>Minimal Configuration</h3>
-          <p>While <code>stack.sh</code> is happy to run without a <code>localrc</code> section in <code>local.conf</code>, devlife is better when there are a few minimal variables set. This is an example of a minimal configuration that touches the values that most often need to be set.</p>
-          <ul>
-            <li>no logging</li>
-            <li>pre-set the passwords to prevent interactive prompts</li>
-            <li>move network ranges away from the local network (<code>FIXED_RANGE</code> and <code>FLOATING_RANGE</code>, commented out below)</li>
-            <li>set the host IP if detection is unreliable (<code>HOST_IP</code>, commented out below)</li>
-          </ul>
-          <pre>[[local|localrc]]
-ADMIN_PASSWORD=secrete
-DATABASE_PASSWORD=$ADMIN_PASSWORD
-RABBIT_PASSWORD=$ADMIN_PASSWORD
-SERVICE_PASSWORD=$ADMIN_PASSWORD
-SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
-#FIXED_RANGE=172.31.1.0/24
-#FLOATING_RANGE=192.168.20.0/25
-#HOST_IP=10.3.4.5</pre>
-          <p>If the <code>*_PASSWORD</code> variables are not set here you will be prompted to enter values for them by <code>stack.sh</code>.</p>
-          <p>The network ranges must not overlap with any networks in use on the host.  Overlap is not uncommon as RFC-1918 'private' ranges are commonly used for both the local networking and Nova's fixed and floating ranges.</p>
-          <p><code>HOST_IP</code> is normally detected on the first run of <code>stack.sh</code> but often is indeterminate on later runs due to the IP being moved from an Ethernet integace to a bridge on the host.  Setting it here also makes it available for <code>openrc</code> to set <code>OS_AUTH_URL</code>.  <code>HOST_IP</code> is not set by default.</p>
-
-          <h3>Common Configuration Variables</h3>
-          <dl>
-            <dt>Set DevStack install directory</dt>
-            <dd><em>Default: <code>DEST=/opt/stack</code></em><br />
-            The DevStack install directory is set by the <code>DEST</code> variable. By setting it early in the <code>localrc</code> section you can reference it in later variables.  It can be useful to set it even though it is not changed from the default value.
-            <pre>DEST=/opt/stack</pre></dd>
-
-            <dt>stack.sh logging</dt>
-            <dd><em>Defaults: <code>LOGFILE="" LOGDAYS=7 LOG_COLOR=True</code></em><br />
-            By default <code>stack.sh</code> output is only written to the console where is runs.  It can be sent to a file in addition to the console by setting <code>LOGFILE</code> to the fully-qualified name of the destination log file.  A timestamp will be appended to the given filename for each run of <code>stack.sh</code>.
-            <pre>LOGFILE=$DEST/logs/stack.sh.log</pre>
-            Old log files are cleaned automatically if <code>LOGDAYS</code> is set to the number of days of old log files to keep.
-            <pre>LOGDAYS=1</pre>
-            The some of the project logs (Nova, Cinder, etc) will be colorized by default (if <code>SYSLOG</code> is not set below); this can be turned off by setting <code>LOG_COLOR</code> False.
-            <pre>LOG_COLOR=False</pre></dd>
-
-            <dt>Screen logging</dt>
-            <dd><em>Default: <code>SCREEN_LOGDIR=""</code></em><br />
-            By default DevStack runs the OpenStack services using <code>screen</code> which is useful for watching log and debug output.  However, in automated testing the interactive <code>screen</code> sessions may not be available after the fact; setting <code>SCREEN_LOGDIR</code> enables logging of the <code>screen</code> sessions in the specified diretory.  There will be one file per <code>screen</code> session named for the session name and a timestamp.  
-            <pre>SCREEN_LOGDIR=$DEST/logs/screen</pre>
-            <em>Note the use of <code>DEST</code> to locate the main install directory; this is why we suggest setting it in <code>local.conf</code>.</em></dd><br />
-
-            <dt>One syslog to bind them all</dt>
-            <dd><em>Default: <code>SYSLOG=False SYSLOG_HOST=$HOST_IP SYSLOG_PORT=516</code></em><br />
-            Logging all services to a single syslog can be convenient.  Enable syslogging by setting <code>SYSLOG</code> to <code>True</code>. If the destination log host is not localhost <code>SYSLOG_HOST</code> and <code>SYSLOG_PORT</code> can be used to direct the message stream to the log host.
-            <pre>SYSLOG=True
-SYSLOG_HOST=$HOST_IP
-SYSLOG_PORT=516</pre></dd>
-
-            <dt>A clean install every time</dt>
-            <dd><em>Default: <code>RECLONE=""</code></em><br />
-            By default <code>stack.sh</code> only clones the project repos if they do not exist in <code>$DEST</code>.  <code>stack.sh</code> will freshen each repo on each run if <code>RECLONE</code> is set to <code>yes</code>. This avoids having to manually remove repos in order to get the current branch from <code>$GIT_BASE</code>.
-            <pre>RECLONE=yes</code></dd>
-
-            <dt>Swift</dt>
-            <dd><em>Default: <code>SWIFT_HASH="" SWIFT_REPLICAS=1 SWIFT_DATA_DIR=$DEST/data/swift</code></em><br />
-            Swift is now used as the back-end for the S3-like object store.  When enabled Nova's objectstore (n-obj in <code>ENABLED_SERVICES</code>) is automatically disabled. Enable Swift by adding it services to <code>ENABLED_SERVICES</code>:
-            <pre>enable_service s-proxy s-object s-container s-account</pre>
-            Setting Swift's hash value is required and you will be prompted for it if Swift is enabled so just set it to something already:
-            <pre>SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5</pre>
-            For development purposes the default number of replicas is set to <code>1</code> to reduce the overhead required.  To better simulate a production deployment set this to <code>3</code> or more.
-            <pre>SWIFT_REPLICAS=3</pre>
-            The data for Swift is stored in the source tree by default
-            (in <code>$DEST/swift/data</code>) and can be moved by setting
-            <code>SWIFT_DATA_DIR</code>.  The specified directory will be created if it does not exist.
-            <pre>SWIFT_DATA_DIR=$DEST/data/swift</pre>
-            <em>Note: Previously just enabling <code>swift</code> was sufficient to start the Swift services.  That does not provide proper service granularity, particularly in multi-host configurations, and is considered deprecated.  Some service combination tests now check for specific Swift services and the old blanket acceptance will longer work correctly.</em>
-            </dd>
-
-            <dt>Service Catalog Backend</dt>
-            <dd><em>Default: <code>KEYSTONE_CATALOG_BACKEND=sql</code></em><br />
-            DevStack uses Keystone's <code>sql</code> service catalog backend.  An alternate <code>template</code> backend is also available.  However, it does not support the <code>service-*</code> and <code>endpoint-*</code> commands of the <code>keystone</code> CLI.  To
-            do so requires the <code>sql</code> backend be enabled:
-            <pre>KEYSTONE_CATALOG_BACKEND=template</pre>
-            DevStack's default configuration in <code>sql</code> mode is set in
-            <code>files/keystone_data.sh</code></dd>
-
-            <dt>Cinder</dt>
-            <dd><em>Default: <code>VOLUME_GROUP="stack-volumes" VOLUME_NAME_PREFIX="volume-" VOLUME_BACKING_FILE_SIZE=10250M</code></em><br />
-            The logical volume group used to hold the Cinder-managed volumes is set by <code>VOLUME_GROUP</code>, the logical volume name prefix is set with <code>VOLUME_NAME_PREFIX</code> and the size of the volume backing file is set with <code>VOLUME_BACKING_FILE_SIZE</code>.
-            <pre>VOLUME_GROUP="stack-volumes"
-VOLUME_NAME_PREFIX="volume-"
-VOLUME_BACKING_FILE_SIZE=10250M</pre></dd>
-
-            <dt>Multi-host DevStack</dt>
-            <dd><em>Default: <code>MULTI_HOST=False</code></em><br />
-            Running DevStack with multiple hosts requires a custom <code>local.conf</code> section for each host.  The master is the same as a single host installation with <code>MULTI_HOST=True</code>.  The slaves have fewer services enabled and a couple of host variables pointing to the master.  
-            <br /><br />
-            <strong>Master</strong>
-            <pre>MULTI_HOST=True</pre>
-
-            <strong>Slave</strong>
-            <pre>MYSQL_HOST=w.x.y.z
-RABBIT_HOST=w.x.y.z
-GLANCE_HOSTPORT=w.x.y.z:9292
-ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api</pre></dd>
-
-            <dt>API rate limits</dt>
-            <dd><em>Default: <code>API_RATE_LIMIT=True</code><br />
-            Integration tests such as Tempest will likely run afoul of the default rate limits configured for Nova.  Turn off rate limiting during testing by setting <code>API_RATE_LIMIT=False</code>.
-            <pre>API_RATE_LIMIT=False</pre></dd>
-          </dl>
-
-          <h3>Examples</h3>
-          <ul>
-            <li>Eliminate a Cinder pass-through (<code>CINDER_PERIODIC_INTERVAL</code>):
-<pre>[[post-config|$CINDER_CONF]]
-[DEFAULT]
-periodic_interval = 60
-</pre></li>
-            <li>Sample <code>local.conf</code> with screen logging enabled:
-<pre>[[local|localrc]]
-FIXED_RANGE=10.254.1.0/24
-NETWORK_GATEWAY=10.254.1.1
-LOGDAYS=1
-LOGFILE=$DEST/logs/stack.sh.log
-SCREEN_LOGDIR=$DEST/logs/screen
-ADMIN_PASSWORD=quiet
-DATABASE_PASSWORD=$ADMIN_PASSWORD
-RABBIT_PASSWORD=$ADMIN_PASSWORD
-SERVICE_PASSWORD=$ADMIN_PASSWORD
-SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50</pre></li>
-          </ul>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
new file mode 100644
index 0000000000..694ad62844
--- /dev/null
+++ b/doc/source/configuration.rst
@@ -0,0 +1,360 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Configuration Making it go my way
+---------------------------------
+
+DevStack has always tried to be mostly-functional with a minimal amount
+of configuration. The number of options has ballooned as projects add
+features, new projects added and more combinations need to be tested.
+Historically DevStack obtained all local configuration and
+customizations from a ``localrc`` file. The number of configuration
+variables that are simply passed-through to the individual project
+configuration files is also increasing. The old mechanism for this
+(``EXTRAS_OPTS`` and friends) required specific code for each file and
+did not scale well.
+
+In Oct 2013 a new configuration method was introduced (in `review
+46768 <https://review.openstack.org/#/c/46768/>`__) to hopefully
+simplify this process and meet the following goals:
+
+-  contain all non-default local configuration in a single file
+-  be backward-compatible with ``localrc`` to smooth the transition
+   process
+-  allow settings in arbitrary configuration files to be changed
+
+local.conf
+~~~~~~~~~~
+
+The new configuration file is ``local.conf`` and resides in the root
+DevStack directory like the old ``localrc`` file. It is a modified INI
+format file that introduces a meta-section header to carry additional
+information regarding the configuration files to be changed.
+
+The new header is similar to a normal INI section header but with double
+brackets (``[[ ... ]]``) and two internal fields separated by a pipe
+(``|``):
+
+::
+
+    [[ <phase> | <config-file-name> ]]
+
+where ``<phase>`` is one of a set of phase names defined by ``stack.sh``
+and ``<config-file-name>`` is the configuration filename. The filename
+is eval'ed in the ``stack.sh`` context so all environment variables are
+available and may be used. Using the project config file variables in
+the header is strongly suggested (see the ``NOVA_CONF`` example below).
+If the path of the config file does not exist it is skipped.
+
+The defined phases are:
+
+-  **local** - extracts ``localrc`` from ``local.conf`` before
+   ``stackrc`` is sourced
+-  **pre-install** - runs after the system packages are installed but
+   before any of the source repositories are installed
+-  **install** - runs immediately after the repo installations are
+   complete
+-  **post-config** - runs after the layer 2 services are configured and
+   before they are started
+-  **extra** - runs after services are started and before any files in
+   ``extra.d`` are executed
+
+The file is processed strictly in sequence; meta-sections may be
+specified more than once but if any settings are duplicated the last to
+appear in the file will be used.
+
+::
+
+    [[post-config|$NOVA_CONF]]
+    [DEFAULT]
+    use_syslog = True
+
+    [osapi_v3]
+    enabled = False
+
+A specific meta-section ``local|localrc`` is used to provide a default
+``localrc`` file (actually ``.localrc.auto``). This allows all custom
+settings for DevStack to be contained in a single file. If ``localrc``
+exists it will be used instead to preserve backward-compatibility. More
+details on the `contents of localrc <localrc.html>`__ are available.
+
+::
+
+    [[local|localrc]]
+    FIXED_RANGE=10.254.1.0/24
+    ADMIN_PASSWORD=speciale
+    LOGFILE=$DEST/logs/stack.sh.log
+
+Note that ``Q_PLUGIN_CONF_FILE`` is unique in that it is assumed to
+*NOT* start with a ``/`` (slash) character. A slash will need to be
+added:
+
+::
+
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+
+Also note that the ``localrc`` section is sourced as a shell script
+fragment amd MUST conform to the shell requirements, specifically no
+whitespace around ``=`` (equals).
+
+Minimal Configuration
+~~~~~~~~~~~~~~~~~~~~~
+
+While ``stack.sh`` is happy to run without a ``localrc`` section in
+``local.conf``, devlife is better when there are a few minimal variables
+set. This is an example of a minimal configuration that touches the
+values that most often need to be set.
+
+-  no logging
+-  pre-set the passwords to prevent interactive prompts
+-  move network ranges away from the local network (``FIXED_RANGE`` and
+   ``FLOATING_RANGE``, commented out below)
+-  set the host IP if detection is unreliable (``HOST_IP``, commented
+   out below)
+
+::
+
+    [[local|localrc]]
+    ADMIN_PASSWORD=secrete
+    DATABASE_PASSWORD=$ADMIN_PASSWORD
+    RABBIT_PASSWORD=$ADMIN_PASSWORD
+    SERVICE_PASSWORD=$ADMIN_PASSWORD
+    SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
+    #FIXED_RANGE=172.31.1.0/24
+    #FLOATING_RANGE=192.168.20.0/25
+    #HOST_IP=10.3.4.5
+
+If the ``*_PASSWORD`` variables are not set here you will be prompted to
+enter values for them by ``stack.sh``.
+
+The network ranges must not overlap with any networks in use on the
+host. Overlap is not uncommon as RFC-1918 'private' ranges are commonly
+used for both the local networking and Nova's fixed and floating ranges.
+
+``HOST_IP`` is normally detected on the first run of ``stack.sh`` but
+often is indeterminate on later runs due to the IP being moved from an
+Ethernet integace to a bridge on the host. Setting it here also makes it
+available for ``openrc`` to set ``OS_AUTH_URL``. ``HOST_IP`` is not set
+by default.
+
+Common Configuration Variables
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Set DevStack install directory
+    | *Default: ``DEST=/opt/stack``*
+    |  The DevStack install directory is set by the ``DEST`` variable.
+    |  By setting it early in the ``localrc`` section you can reference it
+       in later variables. It can be useful to set it even though it is not
+       changed from the default value.
+    |
+
+    ::
+
+        DEST=/opt/stack
+
+stack.sh logging
+    | *Defaults: ``LOGFILE="" LOGDAYS=7 LOG_COLOR=True``*
+    |  By default ``stack.sh`` output is only written to the console
+       where is runs. It can be sent to a file in addition to the console
+       by setting ``LOGFILE`` to the fully-qualified name of the
+       destination log file. A timestamp will be appended to the given
+       filename for each run of ``stack.sh``.
+    |
+
+    ::
+
+        LOGFILE=$DEST/logs/stack.sh.log
+
+    Old log files are cleaned automatically if ``LOGDAYS`` is set to the
+    number of days of old log files to keep.
+
+    ::
+
+        LOGDAYS=1
+
+    The some of the project logs (Nova, Cinder, etc) will be colorized
+    by default (if ``SYSLOG`` is not set below); this can be turned off
+    by setting ``LOG_COLOR`` False.
+
+    ::
+
+        LOG_COLOR=False
+
+Screen logging
+    | *Default: ``SCREEN_LOGDIR=""``*
+    |  By default DevStack runs the OpenStack services using ``screen``
+       which is useful for watching log and debug output. However, in
+       automated testing the interactive ``screen`` sessions may not be
+       available after the fact; setting ``SCREEN_LOGDIR`` enables logging
+       of the ``screen`` sessions in the specified diretory. There will be
+       one file per ``screen`` session named for the session name and a
+       timestamp.
+    |
+
+    ::
+
+        SCREEN_LOGDIR=$DEST/logs/screen
+
+    *Note the use of ``DEST`` to locate the main install directory; this
+    is why we suggest setting it in ``local.conf``.*
+
+One syslog to bind them all
+    | *Default: ``SYSLOG=False SYSLOG_HOST=$HOST_IP SYSLOG_PORT=516``*
+    |  Logging all services to a single syslog can be convenient. Enable
+       syslogging by setting ``SYSLOG`` to ``True``. If the destination log
+       host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be
+       used to direct the message stream to the log host.
+    |
+
+    ::
+
+        SYSLOG=True
+        SYSLOG_HOST=$HOST_IP
+        SYSLOG_PORT=516
+
+A clean install every time
+    | *Default: ``RECLONE=""``*
+    |  By default ``stack.sh`` only clones the project repos if they do
+       not exist in ``$DEST``. ``stack.sh`` will freshen each repo on each
+       run if ``RECLONE`` is set to ``yes``. This avoids having to manually
+       remove repos in order to get the current branch from ``$GIT_BASE``.
+    |
+
+    ::
+
+        RECLONE=yes
+
+                    Swift
+                    Default: SWIFT_HASH="" SWIFT_REPLICAS=1 SWIFT_DATA_DIR=$DEST/data/swift
+                    Swift is now used as the back-end for the S3-like object store.  When enabled Nova's objectstore (n-obj in ENABLED_SERVICES) is automatically disabled. Enable Swift by adding it services to ENABLED_SERVICES:
+                    enable_service s-proxy s-object s-container s-account
+
+    Setting Swift's hash value is required and you will be prompted for
+    it if Swift is enabled so just set it to something already:
+
+    ::
+
+        SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5
+
+    For development purposes the default number of replicas is set to
+    ``1`` to reduce the overhead required. To better simulate a
+    production deployment set this to ``3`` or more.
+
+    ::
+
+        SWIFT_REPLICAS=3
+
+    The data for Swift is stored in the source tree by default (in
+    ``$DEST/swift/data``) and can be moved by setting
+    ``SWIFT_DATA_DIR``. The specified directory will be created if it
+    does not exist.
+
+    ::
+
+        SWIFT_DATA_DIR=$DEST/data/swift
+
+    *Note: Previously just enabling ``swift`` was sufficient to start
+    the Swift services. That does not provide proper service
+    granularity, particularly in multi-host configurations, and is
+    considered deprecated. Some service combination tests now check for
+    specific Swift services and the old blanket acceptance will longer
+    work correctly.*
+
+Service Catalog Backend
+    | *Default: ``KEYSTONE_CATALOG_BACKEND=sql``*
+    |  DevStack uses Keystone's ``sql`` service catalog backend. An
+       alternate ``template`` backend is also available. However, it does
+       not support the ``service-*`` and ``endpoint-*`` commands of the
+       ``keystone`` CLI. To do so requires the ``sql`` backend be enabled:
+    |
+
+    ::
+
+        KEYSTONE_CATALOG_BACKEND=template
+
+    DevStack's default configuration in ``sql`` mode is set in
+    ``files/keystone_data.sh``
+
+Cinder
+    | Default:
+    | VOLUME_GROUP="stack-volumes" VOLUME_NAME_PREFIX="volume-" VOLUME_BACKING_FILE_SIZE=10250M
+    |  The logical volume group used to hold the Cinder-managed volumes
+       is set by ``VOLUME_GROUP``, the logical volume name prefix is set
+       with ``VOLUME_NAME_PREFIX`` and the size of the volume backing file
+       is set with ``VOLUME_BACKING_FILE_SIZE``.
+    |
+
+    ::
+
+        VOLUME_GROUP="stack-volumes"
+        VOLUME_NAME_PREFIX="volume-"
+        VOLUME_BACKING_FILE_SIZE=10250M
+
+Multi-host DevStack
+    | *Default: ``MULTI_HOST=False``*
+    |  Running DevStack with multiple hosts requires a custom
+       ``local.conf`` section for each host. The master is the same as a
+       single host installation with ``MULTI_HOST=True``. The slaves have
+       fewer services enabled and a couple of host variables pointing to
+       the master.
+    |  **Master**
+
+    ::
+
+        MULTI_HOST=True
+
+    **Slave**
+
+    ::
+
+        MYSQL_HOST=w.x.y.z
+        RABBIT_HOST=w.x.y.z
+        GLANCE_HOSTPORT=w.x.y.z:9292
+        ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
+
+API rate limits
+    | Default: ``API_RATE_LIMIT=True``
+    | Integration tests such as Tempest will likely run afoul of the
+      default rate limits configured for Nova. Turn off rate limiting
+      during testing by setting ``API_RATE_LIMIT=False``.*
+    |
+
+    ::
+
+        API_RATE_LIMIT=False
+
+Examples
+~~~~~~~~
+
+-  Eliminate a Cinder pass-through (``CINDER_PERIODIC_INTERVAL``):
+
+   ::
+
+       [[post-config|$CINDER_CONF]]
+       [DEFAULT]
+       periodic_interval = 60
+
+-  Sample ``local.conf`` with screen logging enabled:
+
+   ::
+
+       [[local|localrc]]
+       FIXED_RANGE=10.254.1.0/24
+       NETWORK_GATEWAY=10.254.1.1
+       LOGDAYS=1
+       LOGFILE=$DEST/logs/stack.sh.log
+       SCREEN_LOGDIR=$DEST/logs/screen
+       ADMIN_PASSWORD=quiet
+       DATABASE_PASSWORD=$ADMIN_PASSWORD
+       RABBIT_PASSWORD=$ADMIN_PASSWORD
+       SERVICE_PASSWORD=$ADMIN_PASSWORD
+       SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/contributing.html b/doc/source/contributing.html
deleted file mode 100644
index 9826fc7f4c..0000000000
--- a/doc/source/contributing.html
+++ /dev/null
@@ -1,88 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Overview</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-
-      <section id="overview" class="span12">
-
-        <div class='row pull-left'>
-          <h2>Contributing <small>Help us help you</small></h2>
-          <p>DevStack uses the standard OpenStack contribution process as outlined in <a href="https://wiki.openstack.org/wiki/How_To_Contribute">the OpenStack wiki 'How To Contribute'</a>.  This means that you will need to meet the requirements of the Contribututors License Agreement (CLA).  If you have already done that for another OpenStack project you are good to go.</p>
-
-          <h3>Things To Know</h3>
-
-          <br /><strong>Where Things Are</strong>
-          <p>The official DevStack repository is located at <code>git://git.openstack.org/openstack-dev/devstack.git</code>, replicated from the repo maintained by Gerrit. GitHub also has a mirror at <code>git://github.com/openstack-dev/devstack.git</code>.</p>
-          <p>The <a href="https://blueprints.launchpad.net/devstack">blueprint</a> and <a href="https://bugs.launchpad.net/devstack">bug trackers</a> are on Launchpad.  It should be noted that DevStack generally does not use these as strongly as other projects, but we're trying to change that.</p>
-          <p>The <a href="https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z">Gerrit review queue</a> is, however, used for all commits except for the text of this website.  That should also change in the near future.</p>
-
-          <br /><strong>HACKING.rst</strong>
-          <p>Like most OpenStack projects, DevStack includes a <code>HACKING.rst</code> file that describes the layout, style and conventions of the project.  Because <code>HACKING.rst</code> is in the main DevStack repo it is considered authoritative.  Much of the content on this page is taken from there.</p>
-
-          <br /><strong>bashate Formatting</strong>
-          <p>Around the time of the OpenStack Havana release we added a tool to do style checking in DevStack similar to what pep8/flake8 do for Python projects.  It is still _very_ simplistic, focusing mostly on stray whitespace to help prevent -1 on reviews that are otherwise acceptable.  Oddly enough it is called <code>bashate</code>.  It will be expanded to enforce some of the documentation rules in comments that are used in formatting the script pages for devstack.org and possibly even simple code formatting.  Run it on the entire project with <code>./run_tests.sh</code>.</p>
-
-          <h3>Code</h3>
-
-          <br /><strong>Repo Layout</strong>
-          <p>The DevStack repo generally keeps all of the primary scripts at the root level.</p>
-          <p><code>docs</code> - Contains the source for this website.  It is built using <code>tools/build_docs.sh</code>.</p>
-          <p><code>exercises</code> - Contains the test scripts used to validate and demonstrate some OpenStack functions.  These scripts know how to exit early or skip services that are not enabled.</p>
-          <p><code>extras.d</code> - Contains the dispatch scripts called by the hooks in <code>stack.sh</code>, <code>unstack.sh</code> and <code>clean.sh</code>.  See <a href="plugins.html">the plugins docs</a> for more information.</p>
-          <p><code>files</code> - Contains a variety of otherwise lost files used in configuring and operating DevStack.  This includes templates for configuration files and the system dependency information.  This is also where image files are downloaded and expanded if necessary.</p>
-          <p><code>lib</code> - Contains the sub-scripts specific to each project.  This is where the work of managing a project's services is located.  Each top-level project (Keystone, Nova, etc) has a file here.  Additionally there are some for system services and project plugins.</p>
-          <p><code>samples</code> - Contains a sample of the local files not included in the DevStack repo.</p>
-          <p><code>tests</code> - the DevStack test suite is rather sparse, mostly consisting of test of specific fragile functions in the <code>functions</code> file.</p>
-          <p><code>tools</code> - Contains a collection of stand-alone scripts, some of which have aged a bit (does anyone still do ramdisk installs?).  While these may reference the top-level DevStack configuration they can generally be run alone.  There are also some sub-directories to support specific environments such as XenServer.</p>
-          
-
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; An <a href="https://wiki.openstack.org/wiki/Programs">OpenStack program</a> created by <a href="http://www.rackspace.com/cloud/private_edition/">Rackspace Cloud Builders</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
new file mode 100644
index 0000000000..e37c06b6a9
--- /dev/null
+++ b/doc/source/contributing.rst
@@ -0,0 +1,105 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Contributing Help us help you
+-----------------------------
+
+DevStack uses the standard OpenStack contribution process as outlined in
+`the OpenStack wiki 'How To
+Contribute' <https://wiki.openstack.org/wiki/How_To_Contribute>`__. This
+means that you will need to meet the requirements of the Contribututors
+License Agreement (CLA). If you have already done that for another
+OpenStack project you are good to go.
+
+Things To Know
+~~~~~~~~~~~~~~
+
+| 
+| **Where Things Are**
+
+The official DevStack repository is located at
+``git://git.openstack.org/openstack-dev/devstack.git``, replicated from
+the repo maintained by Gerrit. GitHub also has a mirror at
+``git://github.com/openstack-dev/devstack.git``.
+
+The `blueprint <https://blueprints.launchpad.net/devstack>`__ and `bug
+trackers <https://bugs.launchpad.net/devstack>`__ are on Launchpad. It
+should be noted that DevStack generally does not use these as strongly
+as other projects, but we're trying to change that.
+
+The `Gerrit review
+queue <https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z>`__
+is, however, used for all commits except for the text of this website.
+That should also change in the near future.
+
+| 
+| **HACKING.rst**
+
+Like most OpenStack projects, DevStack includes a ``HACKING.rst`` file
+that describes the layout, style and conventions of the project. Because
+``HACKING.rst`` is in the main DevStack repo it is considered
+authoritative. Much of the content on this page is taken from there.
+
+| 
+| **bashate Formatting**
+
+Around the time of the OpenStack Havana release we added a tool to do
+style checking in DevStack similar to what pep8/flake8 do for Python
+projects. It is still \_very\_ simplistic, focusing mostly on stray
+whitespace to help prevent -1 on reviews that are otherwise acceptable.
+Oddly enough it is called ``bashate``. It will be expanded to enforce
+some of the documentation rules in comments that are used in formatting
+the script pages for devstack.org and possibly even simple code
+formatting. Run it on the entire project with ``./run_tests.sh``.
+
+Code
+~~~~
+
+| 
+| **Repo Layout**
+
+The DevStack repo generally keeps all of the primary scripts at the root
+level.
+
+``docs`` - Contains the source for this website. It is built using
+``tools/build_docs.sh``.
+
+``exercises`` - Contains the test scripts used to validate and
+demonstrate some OpenStack functions. These scripts know how to exit
+early or skip services that are not enabled.
+
+``extras.d`` - Contains the dispatch scripts called by the hooks in
+``stack.sh``, ``unstack.sh`` and ``clean.sh``. See `the plugins
+docs <plugins.html>`__ for more information.
+
+``files`` - Contains a variety of otherwise lost files used in
+configuring and operating DevStack. This includes templates for
+configuration files and the system dependency information. This is also
+where image files are downloaded and expanded if necessary.
+
+``lib`` - Contains the sub-scripts specific to each project. This is
+where the work of managing a project's services is located. Each
+top-level project (Keystone, Nova, etc) has a file here. Additionally
+there are some for system services and project plugins.
+
+``samples`` - Contains a sample of the local files not included in the
+DevStack repo.
+
+``tests`` - the DevStack test suite is rather sparse, mostly consisting
+of test of specific fragile functions in the ``functions`` file.
+
+``tools`` - Contains a collection of stand-alone scripts, some of which
+have aged a bit (does anyone still do ramdisk installs?). While these
+may reference the top-level DevStack configuration they can generally be
+run alone. There are also some sub-directories to support specific
+environments such as XenServer.
+
+© Openstack Foundation 2011-2013 — An `OpenStack
+program <https://wiki.openstack.org/wiki/Programs>`__ created by
+`Rackspace Cloud
+Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/eucarc.html b/doc/source/eucarc.html
deleted file mode 100644
index 1dd80968d2..0000000000
--- a/doc/source/eucarc.html
+++ /dev/null
@@ -1,94 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - eucarc</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section class="span12">
-        <div class="page-header">
-          <h2>eucarc <small>EC2 settings</small></h2>
-          <p><code>eucarc</code> creates EC2 credentials for the current user as
-            defined by <code>OS_TENANT_NAME:OS_USERNAME</code>.
-            <code>eucarc</code> sources <code>openrc</code> at the beginning
-            (which in turn sources <code>stackrc</code> and <code>localrc</code>)
-            in order to set credentials to create EC2 credentials in Keystone.
-        </div>
-        <dl>
-
-          <dt>EC2_URL</dt>
-          <dd>Set the EC2 url for euca2ools.  The endpoint is extracted from the
-            service catalog for <code>OS_TENANT_NAME:OS_USERNAME</code>.
-            <pre>EC2_URL=$(keystone catalog --service ec2 | awk '/ publicURL / { print $4 }')</pre></dd>
-
-          <dt>S3_URL</dt>
-          <dd>Set the S3 endpoint for euca2ools.  The endpoint is extracted from the
-            service catalog for <code>OS_TENANT_NAME:OS_USERNAME</code>.
-            <pre>export S3_URL=$(keystone catalog --service s3 | awk '/ publicURL / { print $4 }')</pre></dd>
-
-          <dt>EC2_ACCESS_KEY, EC2_SECRET_KEY</dt>
-          <dd>Create EC2 credentials for the current tenant:user in Keystone.
-            <pre>CREDS=$(keystone ec2-credentials-create)
-export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
-export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')</pre></dd>
-
-          <dt>Certificates for Bundling</dt>
-          <dd>Euca2ools requires certificate files to enable bundle uploading.
-            The exercise script <code>exercises/bundle.sh</code> demonstrated
-            retrieving certificates using the Nova CLI.
-            <pre>EC2_PRIVATE_KEY=pk.pem
-EC2_CERT=cert.pem
-NOVA_CERT=cacert.pem
-EUCALYPTUS_CERT=${NOVA_CERT}</pre></dd>
-
-        </dl>
-      </section
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; An
-        <a href="https://wiki.openstack.org/wiki/Programs">OpenStack program</a>
-        created by <a href="http://www.rackspace.com/cloud/private_edition/">Rackspace Cloud Builders</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/eucarc.rst b/doc/source/eucarc.rst
new file mode 100644
index 0000000000..c1065e6f61
--- /dev/null
+++ b/doc/source/eucarc.rst
@@ -0,0 +1,57 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+eucarc EC2 settings
+-------------------
+
+``eucarc`` creates EC2 credentials for the current user as defined by
+``OS_TENANT_NAME:OS_USERNAME``. ``eucarc`` sources ``openrc`` at the
+beginning (which in turn sources ``stackrc`` and ``localrc``) in order
+to set credentials to create EC2 credentials in Keystone.
+
+EC2\_URL
+    Set the EC2 url for euca2ools. The endpoint is extracted from the
+    service catalog for ``OS_TENANT_NAME:OS_USERNAME``.
+
+    ::
+
+        EC2_URL=$(keystone catalog --service ec2 | awk '/ publicURL / { print $4 }')
+
+S3\_URL
+    Set the S3 endpoint for euca2ools. The endpoint is extracted from
+    the service catalog for ``OS_TENANT_NAME:OS_USERNAME``.
+
+    ::
+
+        export S3_URL=$(keystone catalog --service s3 | awk '/ publicURL / { print $4 }')
+
+EC2\_ACCESS\_KEY, EC2\_SECRET\_KEY
+    Create EC2 credentials for the current tenant:user in Keystone.
+
+    ::
+
+        CREDS=$(keystone ec2-credentials-create)
+        export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
+        export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
+
+Certificates for Bundling
+    Euca2ools requires certificate files to enable bundle uploading. The
+    exercise script ``exercises/bundle.sh`` demonstrated retrieving
+    certificates using the Nova CLI.
+
+    ::
+
+        EC2_PRIVATE_KEY=pk.pem
+        EC2_CERT=cert.pem
+        NOVA_CERT=cacert.pem
+        EUCALYPTUS_CERT=${NOVA_CERT}
+
+© Openstack Foundation 2011-2013 — An `OpenStack
+program <https://wiki.openstack.org/wiki/Programs>`__ created by
+`Rackspace Cloud
+Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/exerciserc.html b/doc/source/exerciserc.html
deleted file mode 100644
index 313b0a1daf..0000000000
--- a/doc/source/exerciserc.html
+++ /dev/null
@@ -1,88 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - exerciserc</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section class="span12">
-        <div class="page-header">
-          <h2>exerciserc <small>Exercise settings</small></h2>
-          <p><code>exerciserc</code> is used to configure settings for the
-          exercise scripts.  The values shown below are the default values.
-          Thse can all be overridden by setting them in the <code>localrc</code>
-          section.</p>
-        </div>
-        <dl>
-
-          <dt>ACTIVE_TIMEOUT</dt>
-          <dd>Max time to wait while vm goes from build to active state
-            <pre>ACTIVE_TIMEOUT==30</pre></dd>
-
-          <dt>ASSOCIATE_TIMEOUT</dt>
-          <dd>Max time to wait for proper IP association and dis-association.
-            <pre>ASSOCIATE_TIMEOUT=15</pre></dd>
-
-          <dt>BOOT_TIMEOUT</dt>
-          <dd>Max time till the vm is bootable
-            <pre>BOOT_TIMEOUT=30</pre></dd>
-
-          <dt>RUNNING_TIMEOUT</dt>
-          <dd>Max time from run instance command until it is running
-            <pre>RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))</pre></dd>
-
-          <dt>TERMINATE_TIMEOUT</dt>
-          <dd>Max time to wait for a vm to terminate
-            <pre>TERMINATE_TIMEOUT=30</pre></dd>
-
-        </dl>
-      </section
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; An
-        <a href="https://wiki.openstack.org/wiki/Programs">OpenStack program</a>
-        created by <a href="http://www.rackspace.com/cloud/private_edition/">Rackspace Cloud Builders</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/exerciserc.rst b/doc/source/exerciserc.rst
new file mode 100644
index 0000000000..22aff9a9e2
--- /dev/null
+++ b/doc/source/exerciserc.rst
@@ -0,0 +1,54 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+exerciserc Exercise settings
+----------------------------
+
+``exerciserc`` is used to configure settings for the exercise scripts.
+The values shown below are the default values. Thse can all be
+overridden by setting them in the ``localrc`` section.
+
+ACTIVE\_TIMEOUT
+    Max time to wait while vm goes from build to active state
+
+    ::
+
+        ACTIVE_TIMEOUT==30
+
+ASSOCIATE\_TIMEOUT
+    Max time to wait for proper IP association and dis-association.
+
+    ::
+
+        ASSOCIATE_TIMEOUT=15
+
+BOOT\_TIMEOUT
+    Max time till the vm is bootable
+
+    ::
+
+        BOOT_TIMEOUT=30
+
+RUNNING\_TIMEOUT
+    Max time from run instance command until it is running
+
+    ::
+
+        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
+
+TERMINATE\_TIMEOUT
+    Max time to wait for a vm to terminate
+
+    ::
+
+        TERMINATE_TIMEOUT=30
+
+© Openstack Foundation 2011-2013 — An `OpenStack
+program <https://wiki.openstack.org/wiki/Programs>`__ created by
+`Rackspace Cloud
+Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/faq.html b/doc/source/faq.html
deleted file mode 100644
index 7cbb9d2fc5..0000000000
--- a/doc/source/faq.html
+++ /dev/null
@@ -1,169 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Frequently Asked Questions</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-
-      <section id="faq" class="span12">
-
-        <div class='row pull-left'>
-          <h2>FAQ: Using DevStack <small>Making to behave</small></h2>
-
-          <ul>
-            <li><a href="#general">General Questions</a></li>
-            <li><a href="#ops_conf">Operation and Configuration</a></li>
-            <li><a href="#misc">Miscellaneous</a></li>
-          </ul>
-
-          <h3><a name="general">General Questions</a></h3>
-
-          <dl class='pull-left'>
-            <dt>Q: Can I use DevStack for production?</dt>
-            <dd>A: No.  We mean it.  Really.  DevStack makes some implementation choices that are not appropriate for production deployments.  We warned you!</dd>
-
-            <dt>Q: Then why selinux in enforcing mode?</dt>
-            <dd>A: That is the default on current Fedora and RHEL releases.  DevStack has (rightly so) a bad reputation for its security practices; it has always been meant as a development tool first and system integration later.  This is changing as the security issues around OpenStack's use of root (for example) have been tightened and developers need to be better equipped to work in these environments.  <code>stack.sh</code>'s use of root is primarily to support the activities that would be handled by packaging in "real" deployments.  To remove additional protections that will be desired/required in production would be a step backward.</dd>
-
-            <dt>Q: But selinux is disabled in RHEL 6!</dt>
-            <dd>A: Today it is, yes.  That is a specific exception that certain DevStack contributors fought strongly against.  The primary reason it was allowed was to support using RHEL6 as the Python 2.6 test platform and that took priority time-wise.  This will not be the case with RHEL 7.</dd>
-
-            <dt>Q: Why a shell script, why not chef/puppet/...</dt>
-            <dd>A: The script is meant to be read by humans (as well as ran by computers); it is the primary documentation after all.  Using a recipe system requires everyone to agree and understand chef or puppet.</dd>
-
-            <dt>Q: Why not use Crowbar?</dt>
-            <dd>A: DevStack is optimized for documentation &amp; developers.  As some of us use <a href="https://github.com/dellcloudedge/crowbar">Crowbar</a> for production deployments, we hope developers documenting how they setup systems for new features supports projects like Crowbar.</dd>
-
-            <dt>Q: I'd like to help!</dt>
-            <dd>A: That isn't a question, but please do!  The source for DevStack is at <a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a> and bug reports go to <a href="http://bugs.launchpad.net/devstack/">LaunchPad</a>.  Contributions follow the usual process as described in the <a href="http://wiki.openstack.org/HowToContribute">OpenStack wiki</a> even though DevStack is not an official OpenStack project.  This site is housed in the CloudBuilder's <a href="http://github.com/cloudbuilders/devstack">github</a> in the gh-pages branch.</dd>
-
-            <dt>Q: Why not use packages?</dt>
-            <dd>A: Unlike packages, DevStack leaves your cloud ready to develop - checkouts of the code and services running in screen. However, many people are doing the hard work of packaging and recipes for production deployments.  We hope this script serves as a way to communicate configuration changes between developers and packagers.</dd>
-
-            <dt>Q: Why isn't $MY_FAVORITE_DISTRO supported?</dt>
-            <dd>A: DevStack is meant for developers and those who want to see how OpenStack really works.  DevStack is known to run on the distro/release combinations listed in <code>README.md</code>.  DevStack is only supported on releases other than those documented in <code>README.md</code> on a best-effort basis.</dd>
-
-            <dt>Q: What about Fedora/RHEL/CentOS?</dt>
-            <dd>A: Fedora and CentOS/RHEL are supported via rpm dependency files and specific checks in <code>stack.sh</code>.  Support will follow the pattern set with the Ubuntu testing, i.e. only a single release of the distro will receive regular testing, others will be handled on a best-effort basis.</dd>
-
-            <dt>Q: Are there any differences between Ubuntu and Fedora support?</dt>
-            <dd>A: Neutron is not fully supported prior to Fedora 18 due lack of OpenVSwitch packages.</dd>
-
-            <dt>Q: How about RHEL 6?</dt>
-            <dd>A: RHEL 6 has Python 2.6 and many old modules packaged and is a challenge to support.  There are a number of specific RHEL6 work-arounds in <code>stack.sh</code> to handle this.  But the testing on py26 is valuable so we do it...</dd>
-          </dl>
-
-          <h3><a name="ops_conf">Operation and Configuration</a></h3>
-
-          <dl class='pull-left'>
-            <dt>Q: Can DevStack handle a multi-node installation?</dt>
-            <dd>A: Indirectly, yes.  You run DevStack on each node with the appropriate configuration in <code>local.conf</code>.  The primary considerations are turning off the services not required on the secondary nodes, making sure the passwords match and setting the various API URLs to the right place.</dd>
-
-            <dt>Q: How can I document the environment that DevStack is using?</dt>
-            <dd>A: DevStack includes a script (<code>tools/info.sh</code>) that gathers the versions of the relevant installed apt packages, pip packages and git repos.  This is a good way to verify what Python modules are installed.</dd>
-
-            <dt>Q: How do I turn off a service that is enabled by default?</dt>
-            <dd>A: Services can be turned off by adding <code>disable_service xxx</code> to <code>local.conf</code> (using <code>n-vol</code> in this example):
-              <pre>disable_service n-vol</pre>
-            </dd>
-
-            <dt>Q: Is enabling a service that defaults to off done with the reverse of the above?</dt>
-            <dd>A: Of course!
-              <pre>enable_service qpid</pre>
-            </dd>
-
-            <dt>Q: How do I run a specific OpenStack milestone?</dt>
-            <dd>A: OpenStack milestones have tags set in the git repo.  Set the appropriate tag in the <code>*_BRANCH</code> variables in <code>local.conf</code>.  Swift is on its own release schedule so pick a tag in the Swift repo that is just before the milestone release.  For example:
-              <pre>[[local|localrc]]
-GLANCE_BRANCH=stable/grizzly
-HORIZON_BRANCH=stable/grizzly
-KEYSTONE_BRANCH=stable/grizzly
-NOVA_BRANCH=stable/grizzly
-GLANCE_BRANCH=stable/grizzly
-NEUTRON_BRANCH=stable/grizzly
-SWIFT_BRANCH=1.10.0</pre>
-            </dd>
-<!---  this is incomplete, remove it until populating the sql catalog is complete
-            <dt>Q: How do I use the SQL catalog backend in Keystone?</dt>
-            <dd>A: Comment out the template backend lines in the <code>[catalog]</code> section of <code>keystone/etc/keystone.conf</code> and add the SQL backend config like this:
-              <pre>[catalog]
-#driver = keystone.catalog.backends.templated.TemplatedCatalog
-#template_file = ./etc/default_catalog.templates
-driver = keystone.catalog.backends.sql.Catalog</pre>
-            </dd>
--->
-            <dt>Q: Why not use <strike><code>tools/pip-requires</code></strike><code>requirements.txt</code> to grab project dependencies?</dt>
-            <dd><strike>The majority of deployments will use packages to install OpenStack that will have distro-based packages as dependencies.  DevStack installs as many of these Python packages as possible to mimic the expected production environemnt.</strike> Certain Linux distributions have a 'lack of workaround' in their Python configurations that installs vendor packaged Python modules and pip-installed modules to the SAME DIRECTORY TREE.  This is causing heartache and moving us in the direction of installing more modules from PyPI than vendor packages.  However, that is only being done as necessary as the packaging needs to catch up to the development cycle anyway so this is kept to a minimum.</dd>
-
-            <dt>Q: What can I do about RabbitMQ not wanting to start on my fresh new VM?</dt>
-            <dd>A: This is often caused by <code>erlang</code> not being happy with the hostname resolving to a reachable IP address.  Make sure your hostname resolves to a working IP address; setting it to 127.0.0.1 in <code>/etc/hosts</code> is often good enough for a single-node installation.  And in an extreme case, use <code>clean.sh</code> to eradicate it and try again.</dd>
-
-            <dt>Q: How can I set up Heat in stand-alone configuration?</dt>
-            <dd>A: Configure <code>local.conf</code> thusly:
-              <pre>[[local|localrc]]
-HEAT_STANDALONE=True
-ENABLED_SERVICES=rabbit,mysql,heat,h-api,h-api-cfn,h-api-cw,h-eng
-KEYSTONE_SERVICE_HOST=&lt;keystone-host&gt;
-KEYSTONE_AUTH_HOST=&lt;keystone-host&gt;</pre>
-            </dd>
-
-            <dt>Q: Why are my configuration changes ignored?</dt>
-            <dd>A: You may have run into the package prerequisite installation timeout.  <code>tools/install_prereqs.sh</code> has a timer that skips the package installation checks if it was run within the last <code>PREREQ_RERUN_HOURS</code> hours (default is 2).  To override this, set <code>FORCE_PREREQ=1</code> and the package checks will never be skipped.
-            </dd>
-          </dl>
-
-          <h3><a name="misc">Miscellaneous</a></h3>
-
-          <dl class='pull-left'>
-            <dt>Q: <code>tools/fixup_stuff.sh</code> is broken and shouldn't 'fix' just one version of packages.</dt>
-            <dd>A: [Another not-a-question]  No it isn't.  Stuff in there is to correct problems in an environment that need to be fixed elsewhere or may/will be fixed in a future release.  In the case of <code>httplib2</code> and <code>prettytable</code> specific problems with specific versions are being worked around.  If later releases have those problems than we'll add them to the script.  Knowing about the broken future releases is valuable rather than polling to see if it has been fixed.</dd>
-          </dl>
-        </div>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
new file mode 100644
index 0000000000..9adc58ed1c
--- /dev/null
+++ b/doc/source/faq.rst
@@ -0,0 +1,184 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+FAQ: Using DevStack Making to behave
+------------------------------------
+
+-  `General Questions <#general>`__
+-  `Operation and Configuration <#ops_conf>`__
+-  `Miscellaneous <#misc>`__
+
+General Questions
+~~~~~~~~~~~~~~~~~
+
+Q: Can I use DevStack for production?
+    A: No. We mean it. Really. DevStack makes some implementation
+    choices that are not appropriate for production deployments. We
+    warned you!
+Q: Then why selinux in enforcing mode?
+    A: That is the default on current Fedora and RHEL releases. DevStack
+    has (rightly so) a bad reputation for its security practices; it has
+    always been meant as a development tool first and system integration
+    later. This is changing as the security issues around OpenStack's
+    use of root (for example) have been tightened and developers need to
+    be better equipped to work in these environments. ``stack.sh``'s use
+    of root is primarily to support the activities that would be handled
+    by packaging in "real" deployments. To remove additional protections
+    that will be desired/required in production would be a step
+    backward.
+Q: But selinux is disabled in RHEL 6!
+    A: Today it is, yes. That is a specific exception that certain
+    DevStack contributors fought strongly against. The primary reason it
+    was allowed was to support using RHEL6 as the Python 2.6 test
+    platform and that took priority time-wise. This will not be the case
+    with RHEL 7.
+Q: Why a shell script, why not chef/puppet/...
+    A: The script is meant to be read by humans (as well as ran by
+    computers); it is the primary documentation after all. Using a
+    recipe system requires everyone to agree and understand chef or
+    puppet.
+Q: Why not use Crowbar?
+    A: DevStack is optimized for documentation & developers. As some of
+    us use `Crowbar <https://github.com/dellcloudedge/crowbar>`__ for
+    production deployments, we hope developers documenting how they
+    setup systems for new features supports projects like Crowbar.
+Q: I'd like to help!
+    A: That isn't a question, but please do! The source for DevStack is
+    at
+    `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+    and bug reports go to
+    `LaunchPad <http://bugs.launchpad.net/devstack/>`__. Contributions
+    follow the usual process as described in the `OpenStack
+    wiki <http://wiki.openstack.org/HowToContribute>`__ even though
+    DevStack is not an official OpenStack project. This site is housed
+    in the CloudBuilder's
+    `github <http://github.com/cloudbuilders/devstack>`__ in the
+    gh-pages branch.
+Q: Why not use packages?
+    A: Unlike packages, DevStack leaves your cloud ready to develop -
+    checkouts of the code and services running in screen. However, many
+    people are doing the hard work of packaging and recipes for
+    production deployments. We hope this script serves as a way to
+    communicate configuration changes between developers and packagers.
+Q: Why isn't $MY\_FAVORITE\_DISTRO supported?
+    A: DevStack is meant for developers and those who want to see how
+    OpenStack really works. DevStack is known to run on the
+    distro/release combinations listed in ``README.md``. DevStack is
+    only supported on releases other than those documented in
+    ``README.md`` on a best-effort basis.
+Q: What about Fedora/RHEL/CentOS?
+    A: Fedora and CentOS/RHEL are supported via rpm dependency files and
+    specific checks in ``stack.sh``. Support will follow the pattern set
+    with the Ubuntu testing, i.e. only a single release of the distro
+    will receive regular testing, others will be handled on a
+    best-effort basis.
+Q: Are there any differences between Ubuntu and Fedora support?
+    A: Neutron is not fully supported prior to Fedora 18 due lack of
+    OpenVSwitch packages.
+Q: How about RHEL 6?
+    A: RHEL 6 has Python 2.6 and many old modules packaged and is a
+    challenge to support. There are a number of specific RHEL6
+    work-arounds in ``stack.sh`` to handle this. But the testing on py26
+    is valuable so we do it...
+
+Operation and Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Q: Can DevStack handle a multi-node installation?
+    A: Indirectly, yes. You run DevStack on each node with the
+    appropriate configuration in ``local.conf``. The primary
+    considerations are turning off the services not required on the
+    secondary nodes, making sure the passwords match and setting the
+    various API URLs to the right place.
+Q: How can I document the environment that DevStack is using?
+    A: DevStack includes a script (``tools/info.sh``) that gathers the
+    versions of the relevant installed apt packages, pip packages and
+    git repos. This is a good way to verify what Python modules are
+    installed.
+Q: How do I turn off a service that is enabled by default?
+    A: Services can be turned off by adding ``disable_service xxx`` to
+    ``local.conf`` (using ``n-vol`` in this example):
+
+    ::
+
+        disable_service n-vol
+
+Q: Is enabling a service that defaults to off done with the reverse of the above?
+    A: Of course!
+
+    ::
+
+        enable_service qpid
+
+Q: How do I run a specific OpenStack milestone?
+    A: OpenStack milestones have tags set in the git repo. Set the appropriate tag in the ``*_BRANCH`` variables in ``local.conf``.  Swift is on its own release schedule so pick a tag in the Swift repo that is just before the milestone release. For example:
+
+    ::
+
+        [[local|localrc]]
+        GLANCE_BRANCH=stable/grizzly
+        HORIZON_BRANCH=stable/grizzly
+        KEYSTONE_BRANCH=stable/grizzly
+        NOVA_BRANCH=stable/grizzly
+        GLANCE_BRANCH=stable/grizzly
+        NEUTRON_BRANCH=stable/grizzly
+        SWIFT_BRANCH=1.10.0
+
+Q: Why not use [STRIKEOUT:``tools/pip-requires``]\ ``requirements.txt`` to grab project dependencies?
+    [STRIKEOUT:The majority of deployments will use packages to install
+    OpenStack that will have distro-based packages as dependencies.
+    DevStack installs as many of these Python packages as possible to
+    mimic the expected production environemnt.] Certain Linux
+    distributions have a 'lack of workaround' in their Python
+    configurations that installs vendor packaged Python modules and
+    pip-installed modules to the SAME DIRECTORY TREE. This is causing
+    heartache and moving us in the direction of installing more modules
+    from PyPI than vendor packages. However, that is only being done as
+    necessary as the packaging needs to catch up to the development
+    cycle anyway so this is kept to a minimum.
+Q: What can I do about RabbitMQ not wanting to start on my fresh new VM?
+    A: This is often caused by ``erlang`` not being happy with the
+    hostname resolving to a reachable IP address. Make sure your
+    hostname resolves to a working IP address; setting it to 127.0.0.1
+    in ``/etc/hosts`` is often good enough for a single-node
+    installation. And in an extreme case, use ``clean.sh`` to eradicate
+    it and try again.
+Q: How can I set up Heat in stand-alone configuration?
+    A: Configure ``local.conf`` thusly:
+
+    ::
+
+        [[local|localrc]]
+        HEAT_STANDALONE=True
+        ENABLED_SERVICES=rabbit,mysql,heat,h-api,h-api-cfn,h-api-cw,h-eng
+        KEYSTONE_SERVICE_HOST=<keystone-host>
+        KEYSTONE_AUTH_HOST=<keystone-host>
+
+Q: Why are my configuration changes ignored?
+    A: You may have run into the package prerequisite installation
+    timeout. ``tools/install_prereqs.sh`` has a timer that skips the
+    package installation checks if it was run within the last
+    ``PREREQ_RERUN_HOURS`` hours (default is 2). To override this, set
+    ``FORCE_PREREQ=1`` and the package checks will never be skipped.
+
+Miscellaneous
+~~~~~~~~~~~~~
+
+Q: ``tools/fixup_stuff.sh`` is broken and shouldn't 'fix' just one version of packages.
+    A: [Another not-a-question] No it isn't. Stuff in there is to
+    correct problems in an environment that need to be fixed elsewhere
+    or may/will be fixed in a future release. In the case of
+    ``httplib2`` and ``prettytable`` specific problems with specific
+    versions are being worked around. If later releases have those
+    problems than we'll add them to the script. Knowing about the broken
+    future releases is valuable rather than polling to see if it has
+    been fixed.
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/guides/multinode-lab.html b/doc/source/guides/multinode-lab.html
deleted file mode 100644
index 6a5f98c11d..0000000000
--- a/doc/source/guides/multinode-lab.html
+++ /dev/null
@@ -1,336 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>Multi-Node Lab Server Guide - DevStack</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="../assets/css/bootstrap.css" rel="stylesheet">
-    <link href="../assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="../overview.html">Overview</a></li>
-            <li><a href="../changes.html">Changes</a></li>
-            <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section id="overview">
-        <h1>Multi-Node Lab: Serious Stuff</h1>
-        <p>Here is OpenStack in a realistic test configuration with multiple physical servers.</p>
-      </section>
-
-      <section id="prerequisites">
-        <div class="page-header">
-          <h2>Prerequisites <small>Linux & Network</small></h2>
-        </div>
-        
-        <h3>Minimal Install</h3>
-        <p>You need to have a system with a fresh install of Linux.  You can download the <a href="https://help.ubuntu.com/community/Installation/MinimalCD">Minimal CD</a> for Ubuntu releases since DevStack will download &amp; install all the additional dependencies.  The netinstall ISO is available for <a href="http://mirrors.kernel.org/fedora/releases/18/Fedora/x86_64/iso/Fedora-20-x86_64-netinst.iso">Fedora</a> and <a href="http://mirrors.kernel.org/centos/6.5/isos/x86_64/CentOS-6.5-x86_64-netinstall.iso">CentOS/RHEL</a>.</p>
-
-        <p>Install a couple of packages to bootstrap configuration:</p>
-        <pre>apt-get install -y git sudo || yum install -y git sudo</pre>
-
-        <h3>Network Configuration</h3>
-        <p>The first iteration of the lab uses OpenStack's FlatDHCP network controller so
-        only a single network will be required.  It should be on its own subnet without DHCP;
-        the host IPs and floating IP pool(s) will come out of this block. This example 
-        uses the following:</p>
-        <ul>
-          <li>Gateway: 192.168.42.1</li>
-          <li>Physical nodes: 192.168.42.11-192.168.42.99</li>
-          <li>Floating IPs: 192.168.42.128-192.168.42.254</li>
-        </ul>
-        <p>Configure each node with a static IP.
-        For Ubuntu edit <code>/etc/network/interfaces</code>:</p>
-
-        <pre>auto eth0
-iface eth0 inet static
-    address 192.168.42.11
-    netmask 255.255.255.0
-    gateway 192.168.42.1
-</pre>
-        <p>For Fedora and CentOS/RHEL edit
-        <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code>:</p>
-
-        <pre>BOOTPROTO=static
-IPADDR=192.168.42.11
-NETMASK=255.255.255.0
-GATEWAY=192.168.42.1
-</pre>
-
-<!-- save these for the VLAN version
-   auto eth0.926
-   iface eth0.926 inet static
-           address 10.4.144.3
-           netmask 255.255.240.0
-           #gateway 10.4.144.1
-           up ifconfig eth0.926
-   
-   auto eth0.605
-   iface eth0.605 inet static
-           address 172.16.103.3
-           netmask 255.255.255.0
-           #gateway 172.16.103.1
-           up ifconfig eth0.605 up
--->
-
-      </section>
-
-      <section id="installation">
-        <div class="page-header">
-          <h2>Installation <small>shake and bake</small></h2>
-        </div>
-
-        <h3>Add the DevStack User</h3>
-        <p>OpenStack runs as a non-root user that has sudo access to root.  There is nothing special
-        about the name, we'll use <code>stack</code> here. Every node must use the same name and
-        preferably uid. If you created a user during the OS install you can use it and give it
-        sudo privileges below.  Otherwise create the stack user:</p>
-        <pre>groupadd stack
-useradd -g stack -s /bin/bash -d /opt/stack -m stack</pre>
-        <p>This user will be making many changes to your system during installation and operation
-        so it needs to have sudo privileges to root without a password:</p>
-        <pre>echo "stack ALL=(ALL) NOPASSWD: ALL" &gt;&gt; /etc/sudoers</pre>
-        <p>From here on use the <code>stack</code> user.  <b>Logout</b> and <b>login</b> as the 
-        <code>stack</code> user.</p>
-
-        <h3>Set Up Ssh</h3>
-        <p>Set up the stack user on each node with an ssh key for access:</p>
-        <pre>mkdir ~/.ssh; chmod 700 ~/.ssh
-echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyYjfgyPazTvGpd8OaAvtU2utL8W6gWC4JdRS1J95GhNNfQd657yO6s1AH5KYQWktcE6FO/xNUC2reEXSGC7ezy+sGO1kj9Limv5vrvNHvF1+wts0Cmyx61D2nQw35/Qz8BvpdJANL7VwP/cFI/p3yhvx2lsnjFE3hN8xRB2LtLUopUSVdBwACOVUmH2G+2BWMJDjVINd2DPqRIA4Zhy09KJ3O1Joabr0XpQL0yt/I9x8BVHdAx6l9U0tMg9dj5+tAjZvMAFfye3PJcYwwsfJoFxC8w/SLtqlFX7Ehw++8RtvomvuipLdmWCy+T9hIkl+gHYE4cS3OIqXH7f49jdJf jesse@spacey.local" > ~/.ssh/authorized_keys</pre>
-
-        <h3>Download DevStack</h3>
-        <p>Grab the latest version of DevStack:</p>
-        <pre>git clone https://git.openstack.org/openstack-dev/devstack
-cd devstack</pre>
-
-        <p>Up to this point all of the steps apply to each node in the cluster.  From here on
-        there are some differences between the cluster controller (aka 'head node') and the
-        compute nodes.</p>
-
-        <h3>Configure Cluster Controller</h3>
-        <p>The cluster controller runs all OpenStack services.  Configure the cluster controller's DevStack in <code>local.conf</code>:</p>
-        <pre>[[local|localrc]]
-HOST_IP=192.168.42.11
-FLAT_INTERFACE=eth0
-FIXED_RANGE=10.4.128.0/20
-FIXED_NETWORK_SIZE=4096
-FLOATING_RANGE=192.168.42.128/25
-MULTI_HOST=1
-LOGFILE=/opt/stack/logs/stack.sh.log
-ADMIN_PASSWORD=labstack
-MYSQL_PASSWORD=supersecret
-RABBIT_PASSWORD=supersecrete
-SERVICE_PASSWORD=supersecrete
-SERVICE_TOKEN=xyzpdqlazydog</pre>
-<!-- save for vlan
-FLAT_INTERFACE=eth0.926
--->
-
-        <p>In the multi-node configuration the first 10 or so IPs in the private subnet are usually reserved.  Add this to <code>local.sh</code> to have it run after every <code>stack.sh</code> run:</p>
-        <pre>for i in `seq 2 10`; do /opt/stack/nova/bin/nova-manage fixed reserve 10.4.128.$i; done</pre>
-
-        <p>Fire up OpenStack:</p>
-        <pre>./stack.sh</pre>
-        <p>A stream of activity ensues.  When complete you will see a summary of
-        <code>stack.sh</code>'s work, including the relevant URLs, accounts and passwords to poke at your
-        shiny new OpenStack.  The most recent log file is available in <code>stack.sh.log</code>.</p>
-
-        <h3>Configure Compute Nodes</h3>
-        <p>The compute nodes only run the OpenStack worker services.  For additional machines, create a <code>local.conf</code> with:</p>
-        <pre>HOST_IP=192.168.42.12 # change this per compute node
-FLAT_INTERFACE=eth0
-FIXED_RANGE=10.4.128.0/20
-FIXED_NETWORK_SIZE=4096
-FLOATING_RANGE=192.168.42.128/25
-MULTI_HOST=1
-LOGFILE=/opt/stack/logs/stack.sh.log
-ADMIN_PASSWORD=labstack
-MYSQL_PASSWORD=supersecret
-RABBIT_PASSWORD=supersecrete
-SERVICE_PASSWORD=supersecrete
-SERVICE_TOKEN=xyzpdqlazydog
-DATABASE_TYPE=mysql
-SERVICE_HOST=192.168.42.11
-MYSQL_HOST=192.168.42.11
-RABBIT_HOST=192.168.42.11
-GLANCE_HOSTPORT=192.168.42.11:9292
-ENABLED_SERVICES=n-cpu,n-net,n-api,c-sch,c-api,c-vol
-NOVA_VNC_ENABLED=True
-NOVNCPROXY_URL="http://192.168.42.11:6080/vnc_auto.html"
-VNCSERVER_LISTEN=$HOST_IP
-VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
-</pre>
-
-<!-- save for vlan
-FLAT_INTERFACE=eth0.926
--->
-
-        <p>Fire up OpenStack:</p>
-        <pre>./stack.sh</pre>
-        <p>A stream of activity ensues.  When complete you will see a summary of
-        <code>stack.sh</code>'s work, including the relevant URLs, accounts and passwords to poke at your
-        shiny new OpenStack.  The most recent log file is available in <code>stack.sh.log</code>.</p>
-
-        <h3>Cleaning Up After DevStack</h3>
-        <p>Shutting down OpenStack is now as simple as running the included <code>unstack.sh</code> script:</p>
-        <pre>./unstack.sh</pre>
-
-        <p>A more aggressive cleanup can be performed using <code>clean.sh</code>.  It removes certain troublesome packages and attempts to leave the system in a state where changing the database or queue manager can be reliably performed.
-        <pre>./clean.sh</pre>
-
-        <p>Sometimes running instances are not cleaned up.  DevStack attempts to do this when it
-        runs but there are times it needs to still be done by hand:</p>
-        <pre>sudo rm -rf /etc/libvirt/qemu/inst*
-sudo virsh list | grep inst | awk '{print $1}' | xargs -n1 virsh destroy</pre>
-
-      </section>
-
-      <section id="options">
-        <div class="page-header">
-          <h2>Options <small>pimp your stack</small></h2>
-        </div>
-
-        <h3>Additional Users</h3>
-        <p>DevStack creates two OpenStack users (<code>admin</code> and <code>demo</code>) and two tenants (also <code>admin</code> and <code>demo</code>).  <code>admin</code> is exactly what it sounds like, a privileged administrative account that is a member of both the <code>admin</code> and <code>demo</code> tenants.  <code>demo</code> is a normal user account that is only a member of the <code>demo</code> tenant.  Creating additional OpenStack users can be done through the dashboard, sometimes it is easier to do them in bulk from a script, especially since they get blown away every time
-        <code>stack.sh</code> runs.  The following steps are ripe for scripting:</p>
-        <pre># Get admin creds
-. openrc admin admin
-        
-# List existing tenants
-keystone tenant-list
-
-# List existing users
-keystone user-list
-
-# Add a user and tenant
-NAME=bob
-PASSWORD=BigSecrete
-TENANT=$NAME
-keystone tenant-create --name=$NAME
-keystone user-create --name=$NAME --pass=$PASSWORD
-keystone user-role-add --user-id=&lt;bob-user-id&gt; --tenant-id=&lt;bob-tenant-id&gt; --role-id=&lt;member-role-id&gt;
-# member-role-id comes from the existing member role created by stack.sh
-# keystone role-list</pre>
-
-        <h3>Swift</h3>
-        <p>Swift requires a significant amount of resources and is disabled by default in DevStack.
-        The support in DevStack is geared toward a minimal installation but can be used for
-        testing.  To implement a true multi-node test of Swift required more than DevStack provides.  
-        Enabling it is as simple as enabling the <code>swift</code> service in <code>local.conf</code>:
-        <pre>enable_service s-proxy s-object s-container s-account</pre>
-
-        <p>Swift will put its data files in <code>SWIFT_DATA_DIR</code> (default <code>/opt/stack/data/swift</code>).
-        The size of the data 'partition' created (really a loop-mounted file) is set by
-        <code>SWIFT_LOOPBACK_DISK_SIZE</code>.  The Swift config files are located in 
-        <code>SWIFT_CONFIG_DIR</code> (default <code>/etc/swift</code>).  All of these settings can be overridden in
-        (wait for it...) <code>local.conf</code>.</p>
-
-        <h3>Volumes</h3>
-        <p>DevStack will automatically use an existing LVM volume group named <code>stack-volumes</code> 
-        to store cloud-created volumes. If <code>stack-volumes</code> doesn't exist, DevStack 
-        will set up a 5Gb loop-mounted file to contain it.  This obviously limits the
-        number and size of volumes that can be created inside OpenStack.  The size can be
-        overridden by setting <code>VOLUME_BACKING_FILE_SIZE</code> in <code>local.conf</code>.</p>
-
-        <p><code>stack-volumes</code> can be pre-created on any physical volume supported by
-        Linux's LVM.  The name of the volume group can be changed by setting <code>VOLUME_GROUP</code>
-        in <code>localrc</code>. <code>stack.sh</code> deletes
-        all logical volumes in <code>VOLUME_GROUP</code> that begin with 
-        <code>VOLUME_NAME_PREFIX</code> as part of cleaning up from previous runs.
-        It is recommended to not use the root volume group as <code>VOLUME_GROUP</code>.</p>
-
-        <p>The details of creating the volume group depends on the server hardware involved 
-        but looks something like this:</p>
-        <pre>pvcreate /dev/sdc
-vgcreate stack-volumes /dev/sdc</pre>
-
-        <h3>Syslog</h3>
-        <p>DevStack is capable of using <code>rsyslog</code> to aggregate logging across the cluster.
-        It is off by default; to turn it on set <code>SYSLOG=True</code> in <code>local.conf</code>.
-        <code>SYSLOG_HOST</code> defaults to <code>HOST_IP</code>; on the compute nodes it 
-        must be set to the IP of the cluster controller to send syslog output there.  In the example
-        above, add this to the compute node <code>local.conf</code>:</p>
-        <pre>SYSLOG_HOST=192.168.42.11</pre>
-
-        <h3>Using Alternate Repositories/Branches</h3>
-        <p>The git repositories for all of the OpenStack services are defined in <code>stackrc</code>.
-        Since this file is a part of the DevStack package changes to it will probably be overwritten
-        as updates are applied.  Every setting in <code>stackrc</code> can be redefined in
-        <code>local.conf</code>.</p>
-
-        <p>To change the repository or branch that a particular OpenStack service is created from,
-        simply change the value of <code>*_REPO</code> or <code>*_BRANCH</code> corresponding to
-        that service.</p>
-
-        <p>After making changes to the repository or branch, if <code>RECLONE</code> is not set
-        in <code>localrc</code> it may be necessary to remove the corresponding directory from
-        <code>/opt/stack</code> to force git to re-clone the repository.</p>
-
-        <p>For example, to pull Nova from a proposed release candidate in the primary Nova 
-        repository:</p>
-        <pre>NOVA_BRANCH=rc-proposed</pre>
-
-        <p>To pull Glance from an experimental fork:</p>
-        <pre>GLANCE_BRANCH=try-something-big
-GLANCE_REPO=https://github.com/mcuser/glance.git</pre>
-
-      </section>
-
-      <section id="Notes">
-        <div class="page-header">
-          <h2>Notes <small>stuff you might need to know</small></h2>
-        </div>
-
-        <h3>Reset the Bridge</h3>
-        <p>How to reset the bridge configuration:</p>
-        <pre>sudo brctl delif br100 eth0.926
-sudo ip link set dev br100 down
-sudo brctl delbr br100</pre>
-<!--
-   sudo rm /etc/libvirt/qemu/*.xml
--->
-
-        <h3>Set MySQL Password</h3>
-        <p>If you forgot to set the root password you can do this:</p>
-        <pre>mysqladmin -u root -pnova password 'supersecret'</pre>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
new file mode 100644
index 0000000000..c7901a21fb
--- /dev/null
+++ b/doc/source/guides/multinode-lab.rst
@@ -0,0 +1,382 @@
+`DevStack </>`__
+
+-  `Overview <../overview.html>`__
+-  `Changes <../changes.html>`__
+-  `FAQ <../faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Multi-Node Lab: Serious Stuff
+=============================
+
+Here is OpenStack in a realistic test configuration with multiple
+physical servers.
+
+Prerequisites Linux & Network
+-----------------------------
+
+Minimal Install
+~~~~~~~~~~~~~~~
+
+You need to have a system with a fresh install of Linux. You can
+download the `Minimal
+CD <https://help.ubuntu.com/community/Installation/MinimalCD>`__ for
+Ubuntu releases since DevStack will download & install all the
+additional dependencies. The netinstall ISO is available for
+`Fedora <http://mirrors.kernel.org/fedora/releases/18/Fedora/x86_64/iso/Fedora-20-x86_64-netinst.iso>`__
+and
+`CentOS/RHEL <http://mirrors.kernel.org/centos/6.5/isos/x86_64/CentOS-6.5-x86_64-netinstall.iso>`__.
+
+Install a couple of packages to bootstrap configuration:
+
+::
+
+    apt-get install -y git sudo || yum install -y git sudo
+
+Network Configuration
+~~~~~~~~~~~~~~~~~~~~~
+
+The first iteration of the lab uses OpenStack's FlatDHCP network
+controller so only a single network will be required. It should be on
+its own subnet without DHCP; the host IPs and floating IP pool(s) will
+come out of this block. This example uses the following:
+
+-  Gateway: 192.168.42.1
+-  Physical nodes: 192.168.42.11-192.168.42.99
+-  Floating IPs: 192.168.42.128-192.168.42.254
+
+Configure each node with a static IP. For Ubuntu edit
+``/etc/network/interfaces``:
+
+::
+
+    auto eth0
+    iface eth0 inet static
+        address 192.168.42.11
+        netmask 255.255.255.0
+        gateway 192.168.42.1
+
+For Fedora and CentOS/RHEL edit
+``/etc/sysconfig/network-scripts/ifcfg-eth0``:
+
+::
+
+    BOOTPROTO=static
+    IPADDR=192.168.42.11
+    NETMASK=255.255.255.0
+    GATEWAY=192.168.42.1
+
+Installation shake and bake
+---------------------------
+
+Add the DevStack User
+~~~~~~~~~~~~~~~~~~~~~
+
+OpenStack runs as a non-root user that has sudo access to root. There is
+nothing special about the name, we'll use ``stack`` here. Every node
+must use the same name and preferably uid. If you created a user during
+the OS install you can use it and give it sudo privileges below.
+Otherwise create the stack user:
+
+::
+
+    groupadd stack
+    useradd -g stack -s /bin/bash -d /opt/stack -m stack
+
+This user will be making many changes to your system during installation
+and operation so it needs to have sudo privileges to root without a
+password:
+
+::
+
+    echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+
+From here on use the ``stack`` user. **Logout** and **login** as the
+``stack`` user.
+
+Set Up Ssh
+~~~~~~~~~~
+
+Set up the stack user on each node with an ssh key for access:
+
+::
+
+    mkdir ~/.ssh; chmod 700 ~/.ssh
+    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyYjfgyPazTvGpd8OaAvtU2utL8W6gWC4JdRS1J95GhNNfQd657yO6s1AH5KYQWktcE6FO/xNUC2reEXSGC7ezy+sGO1kj9Limv5vrvNHvF1+wts0Cmyx61D2nQw35/Qz8BvpdJANL7VwP/cFI/p3yhvx2lsnjFE3hN8xRB2LtLUopUSVdBwACOVUmH2G+2BWMJDjVINd2DPqRIA4Zhy09KJ3O1Joabr0XpQL0yt/I9x8BVHdAx6l9U0tMg9dj5+tAjZvMAFfye3PJcYwwsfJoFxC8w/SLtqlFX7Ehw++8RtvomvuipLdmWCy+T9hIkl+gHYE4cS3OIqXH7f49jdJf jesse@spacey.local" > ~/.ssh/authorized_keys
+
+Download DevStack
+~~~~~~~~~~~~~~~~~
+
+Grab the latest version of DevStack:
+
+::
+
+    git clone https://git.openstack.org/openstack-dev/devstack
+    cd devstack
+
+Up to this point all of the steps apply to each node in the cluster.
+From here on there are some differences between the cluster controller
+(aka 'head node') and the compute nodes.
+
+Configure Cluster Controller
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The cluster controller runs all OpenStack services. Configure the
+cluster controller's DevStack in ``local.conf``:
+
+::
+
+    [[local|localrc]]
+    HOST_IP=192.168.42.11
+    FLAT_INTERFACE=eth0
+    FIXED_RANGE=10.4.128.0/20
+    FIXED_NETWORK_SIZE=4096
+    FLOATING_RANGE=192.168.42.128/25
+    MULTI_HOST=1
+    LOGFILE=/opt/stack/logs/stack.sh.log
+    ADMIN_PASSWORD=labstack
+    MYSQL_PASSWORD=supersecret
+    RABBIT_PASSWORD=supersecrete
+    SERVICE_PASSWORD=supersecrete
+    SERVICE_TOKEN=xyzpdqlazydog
+
+In the multi-node configuration the first 10 or so IPs in the private
+subnet are usually reserved. Add this to ``local.sh`` to have it run
+after every ``stack.sh`` run:
+
+::
+
+    for i in `seq 2 10`; do /opt/stack/nova/bin/nova-manage fixed reserve 10.4.128.$i; done
+
+Fire up OpenStack:
+
+::
+
+    ./stack.sh
+
+A stream of activity ensues. When complete you will see a summary of
+``stack.sh``'s work, including the relevant URLs, accounts and passwords
+to poke at your shiny new OpenStack. The most recent log file is
+available in ``stack.sh.log``.
+
+Configure Compute Nodes
+~~~~~~~~~~~~~~~~~~~~~~~
+
+The compute nodes only run the OpenStack worker services. For additional
+machines, create a ``local.conf`` with:
+
+::
+
+    HOST_IP=192.168.42.12 # change this per compute node
+    FLAT_INTERFACE=eth0
+    FIXED_RANGE=10.4.128.0/20
+    FIXED_NETWORK_SIZE=4096
+    FLOATING_RANGE=192.168.42.128/25
+    MULTI_HOST=1
+    LOGFILE=/opt/stack/logs/stack.sh.log
+    ADMIN_PASSWORD=labstack
+    MYSQL_PASSWORD=supersecret
+    RABBIT_PASSWORD=supersecrete
+    SERVICE_PASSWORD=supersecrete
+    SERVICE_TOKEN=xyzpdqlazydog
+    DATABASE_TYPE=mysql
+    SERVICE_HOST=192.168.42.11
+    MYSQL_HOST=192.168.42.11
+    RABBIT_HOST=192.168.42.11
+    GLANCE_HOSTPORT=192.168.42.11:9292
+    ENABLED_SERVICES=n-cpu,n-net,n-api,c-sch,c-api,c-vol
+    NOVA_VNC_ENABLED=True
+    NOVNCPROXY_URL="http://192.168.42.11:6080/vnc_auto.html"
+    VNCSERVER_LISTEN=$HOST_IP
+    VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
+
+Fire up OpenStack:
+
+::
+
+    ./stack.sh
+
+A stream of activity ensues. When complete you will see a summary of
+``stack.sh``'s work, including the relevant URLs, accounts and passwords
+to poke at your shiny new OpenStack. The most recent log file is
+available in ``stack.sh.log``.
+
+Cleaning Up After DevStack
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Shutting down OpenStack is now as simple as running the included
+``unstack.sh`` script:
+
+::
+
+    ./unstack.sh
+
+A more aggressive cleanup can be performed using ``clean.sh``. It
+removes certain troublesome packages and attempts to leave the system in
+a state where changing the database or queue manager can be reliably
+performed.
+
+::
+
+    ./clean.sh
+
+Sometimes running instances are not cleaned up. DevStack attempts to do
+this when it runs but there are times it needs to still be done by hand:
+
+::
+
+    sudo rm -rf /etc/libvirt/qemu/inst*
+    sudo virsh list | grep inst | awk '{print $1}' | xargs -n1 virsh destroy
+
+Options pimp your stack
+-----------------------
+
+Additional Users
+~~~~~~~~~~~~~~~~
+
+DevStack creates two OpenStack users (``admin`` and ``demo``) and two
+tenants (also ``admin`` and ``demo``). ``admin`` is exactly what it
+sounds like, a privileged administrative account that is a member of
+both the ``admin`` and ``demo`` tenants. ``demo`` is a normal user
+account that is only a member of the ``demo`` tenant. Creating
+additional OpenStack users can be done through the dashboard, sometimes
+it is easier to do them in bulk from a script, especially since they get
+blown away every time ``stack.sh`` runs. The following steps are ripe
+for scripting:
+
+::
+
+    # Get admin creds
+    . openrc admin admin
+            
+    # List existing tenants
+    keystone tenant-list
+
+    # List existing users
+    keystone user-list
+
+    # Add a user and tenant
+    NAME=bob
+    PASSWORD=BigSecrete
+    TENANT=$NAME
+    keystone tenant-create --name=$NAME
+    keystone user-create --name=$NAME --pass=$PASSWORD
+    keystone user-role-add --user-id=<bob-user-id> --tenant-id=<bob-tenant-id> --role-id=<member-role-id>
+    # member-role-id comes from the existing member role created by stack.sh
+    # keystone role-list
+
+Swift
+~~~~~
+
+Swift requires a significant amount of resources and is disabled by
+default in DevStack. The support in DevStack is geared toward a minimal
+installation but can be used for testing. To implement a true multi-node
+test of Swift required more than DevStack provides. Enabling it is as
+simple as enabling the ``swift`` service in ``local.conf``:
+
+::
+
+    enable_service s-proxy s-object s-container s-account
+
+Swift will put its data files in ``SWIFT_DATA_DIR`` (default
+``/opt/stack/data/swift``). The size of the data 'partition' created
+(really a loop-mounted file) is set by ``SWIFT_LOOPBACK_DISK_SIZE``. The
+Swift config files are located in ``SWIFT_CONFIG_DIR`` (default
+``/etc/swift``). All of these settings can be overridden in (wait for
+it...) ``local.conf``.
+
+Volumes
+~~~~~~~
+
+DevStack will automatically use an existing LVM volume group named
+``stack-volumes`` to store cloud-created volumes. If ``stack-volumes``
+doesn't exist, DevStack will set up a 5Gb loop-mounted file to contain
+it. This obviously limits the number and size of volumes that can be
+created inside OpenStack. The size can be overridden by setting
+``VOLUME_BACKING_FILE_SIZE`` in ``local.conf``.
+
+``stack-volumes`` can be pre-created on any physical volume supported by
+Linux's LVM. The name of the volume group can be changed by setting
+``VOLUME_GROUP`` in ``localrc``. ``stack.sh`` deletes all logical
+volumes in ``VOLUME_GROUP`` that begin with ``VOLUME_NAME_PREFIX`` as
+part of cleaning up from previous runs. It is recommended to not use the
+root volume group as ``VOLUME_GROUP``.
+
+The details of creating the volume group depends on the server hardware
+involved but looks something like this:
+
+::
+
+    pvcreate /dev/sdc
+    vgcreate stack-volumes /dev/sdc
+
+Syslog
+~~~~~~
+
+DevStack is capable of using ``rsyslog`` to aggregate logging across the
+cluster. It is off by default; to turn it on set ``SYSLOG=True`` in
+``local.conf``. ``SYSLOG_HOST`` defaults to ``HOST_IP``; on the compute
+nodes it must be set to the IP of the cluster controller to send syslog
+output there. In the example above, add this to the compute node
+``local.conf``:
+
+::
+
+    SYSLOG_HOST=192.168.42.11
+
+Using Alternate Repositories/Branches
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The git repositories for all of the OpenStack services are defined in
+``stackrc``. Since this file is a part of the DevStack package changes
+to it will probably be overwritten as updates are applied. Every setting
+in ``stackrc`` can be redefined in ``local.conf``.
+
+To change the repository or branch that a particular OpenStack service
+is created from, simply change the value of ``*_REPO`` or ``*_BRANCH``
+corresponding to that service.
+
+After making changes to the repository or branch, if ``RECLONE`` is not
+set in ``localrc`` it may be necessary to remove the corresponding
+directory from ``/opt/stack`` to force git to re-clone the repository.
+
+For example, to pull Nova from a proposed release candidate in the
+primary Nova repository:
+
+::
+
+    NOVA_BRANCH=rc-proposed
+
+To pull Glance from an experimental fork:
+
+::
+
+    GLANCE_BRANCH=try-something-big
+    GLANCE_REPO=https://github.com/mcuser/glance.git
+
+Notes stuff you might need to know
+----------------------------------
+
+Reset the Bridge
+~~~~~~~~~~~~~~~~
+
+How to reset the bridge configuration:
+
+::
+
+    sudo brctl delif br100 eth0.926
+    sudo ip link set dev br100 down
+    sudo brctl delbr br100
+
+Set MySQL Password
+~~~~~~~~~~~~~~~~~~
+
+If you forgot to set the root password you can do this:
+
+::
+
+    mysqladmin -u root -pnova password 'supersecret'
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/guides/pxe-boot.html b/doc/source/guides/pxe-boot.html
deleted file mode 100644
index d52b25f276..0000000000
--- a/doc/source/guides/pxe-boot.html
+++ /dev/null
@@ -1,147 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>PXE Boot Server Guide - DevStack</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="../assets/css/bootstrap.css" rel="stylesheet">
-    <link href="../assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="../overview.html">Overview</a></li>
-            <li><a href="../changes.html">Changes</a></li>
-            <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-      <section id="overview">
-        <h1>PXE Boot Server Guide: Magic Dust for Network Boot</h1>
-        <p>Boot DevStack from a PXE server to a RAM disk.</p>
-      </section>
-
-      <section id="requirements">
-        <div class="page-header">
-          <h2>Prerequisites <small>Hardware & OpenWRT</small></h2>
-        </div>
-        
-        <h3>Hardware</h3>
-        <p>The whole point of this exercise is to have a highly portable boot server, so using a small router with a USB port is the desired platform.  This guide uses a Buffalo WZR-HP-G300NH as an example, but it is easily generalized for other supported platforms. See openwrt.org for more.</p>
-        
-        <h3>OpenWRT</h3>
-        <p>Any recent 'Backfire' build of OpenWRT will work for the boot server project.  We build from trunk and have made the images available at <a href="http://openwrt.xr7.org/openwrt">http://openwrt.xr7.org/openwrt</a>.</p>
-      </section>
-
-      <section id="installation">
-        <div class="page-header">
-          <h2>Installation <small>bit blasting</small></h2>
-        </div>
-
-        <h3>Install the Image</h3>
-        <p>This process follows <a href="http://wiki.openwrt.org/toh/buffalo/wzr-hp-g300h">the OpenWRT doc OEM Install</a> to tftp the new image onto the router.  You need a computer to set up the router, we assume it is a recent Linux or OS/X installation.</p>
-        <ul>
-          <li>Get openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
-            <pre>wget http://openwrt.xr7.org/openwrt/ar71xx/openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin</pre>
-          </li>
-          <li>Connect computer to LAN port 4 (closest to WAN port)</li>
-          <li>Set computer interface to IP address in the 192.168.11.2</li>
-          <li>Add static arp entry for router
-            <pre>arp -s 192.168.11.1 &lt;mac-address&gt;</pre>
-          </li>
-          <li>Start TFTP transfer attempt
-            <pre>tftp 192.168.11.1
-binary
-rexmt 1
-timeout 60
-put openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin</pre>
-          </li>
-          <li>Power on router. Router will reboot and initialize on 192.168.1.1.</li>
-          <li>Delete static arp entry for router
-            <pre>arp -d 192.168.11.1</pre>
-          </li>
-          <li>Set computer to DHCP, connect and telnet to router and set root password.</li>
-        </ul>
-
-        <h3>Configure the Router</h3>
-        <ul>
-          <li>Update <code>/etc/opkg.conf</code> to point to our repo:
-            <pre>src/gz packages http://192.168.5.13/openwrt/build/ar71xx/packages</pre>
-          </li>
-          <li>Configure anon mounts:
-            <pre>uci delete fstab.@mount[0]
-uci commit fstab
-/etc/init.d/fstab restart</pre>
-          </li>
-          <li>Reset the DHCP address range.  DevStack will claim the upper 
-            /25 of the router's LAN address space for floating IPs so the
-            default DHCP address range needs to be moved:
-            <pre>uci set dhcp.lan.start=65
-uci set dhcp.lan.limit=60
-uci commit dhcp</pre>
-          </li>
-          <li>Enable TFTP:
-            <pre>uci set dhcp.@dnsmasq[0].enable_tftp=1
-uci set dhcp.@dnsmasq[0].tftp_root=/mnt/sda1/tftpboot
-uci set dhcp.@dnsmasq[0].dhcp_boot=pxelinux.0
-uci commit dhcp
-/etc/init.d/dnsmasq restart</pre>
-          </li>
-        </ul>
-
-        <h3>Set Up tftpboot</h3>
-        <ul>
-          <li>Create the <code>/tmp/tftpboot</code> structure and populate it:
-            <pre>cd ~/devstack
-tools/build_pxe_boot.sh /tmp</pre>
-            This calls <code>tools/build_ramdisk.sh</code> to create a 2GB ramdisk 
-            containing a complete development Oneiric OS plus the 
-            OpenStack code checkouts.
-          </li>
-          <li>Copy <code>tftpboot</code> to a USB drive:
-            <pre>mount /dev/sdb1 /mnt/tmp
-rsync -a /tmp/tftpboot/ /mnt/tmp/tftpboot/
-umount /mnt/tmp</pre>
-          </li>
-          <li>Plug USB drive into router.  It will be automounted and is ready to serve content.</li>
-        </ul>
-
-        <p>Now <a href="ramdisk.html">return</a> to the RAM disk Guide to kick
-           off your DevStack experience.</p>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; this is not an official OpenStack project...</p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/guides/pxe-boot.rst b/doc/source/guides/pxe-boot.rst
new file mode 100644
index 0000000000..584e5581fd
--- /dev/null
+++ b/doc/source/guides/pxe-boot.rst
@@ -0,0 +1,143 @@
+`DevStack </>`__
+
+-  `Overview <../overview.html>`__
+-  `Changes <../changes.html>`__
+-  `FAQ <../faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+PXE Boot Server Guide: Magic Dust for Network Boot
+==================================================
+
+Boot DevStack from a PXE server to a RAM disk.
+
+Prerequisites Hardware & OpenWRT
+--------------------------------
+
+Hardware
+~~~~~~~~
+
+The whole point of this exercise is to have a highly portable boot
+server, so using a small router with a USB port is the desired platform.
+This guide uses a Buffalo WZR-HP-G300NH as an example, but it is easily
+generalized for other supported platforms. See openwrt.org for more.
+
+OpenWRT
+~~~~~~~
+
+Any recent 'Backfire' build of OpenWRT will work for the boot server
+project. We build from trunk and have made the images available at
+`http://openwrt.xr7.org/openwrt <http://openwrt.xr7.org/openwrt>`__.
+
+Installation bit blasting
+-------------------------
+
+Install the Image
+~~~~~~~~~~~~~~~~~
+
+This process follows `the OpenWRT doc OEM
+Install <http://wiki.openwrt.org/toh/buffalo/wzr-hp-g300h>`__ to tftp
+the new image onto the router. You need a computer to set up the router,
+we assume it is a recent Linux or OS/X installation.
+
+-  Get openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
+
+   ::
+
+       wget http://openwrt.xr7.org/openwrt/ar71xx/openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
+
+-  Connect computer to LAN port 4 (closest to WAN port)
+-  Set computer interface to IP address in the 192.168.11.2
+-  Add static arp entry for router
+
+   ::
+
+       arp -s 192.168.11.1 <mac-address>
+
+-  Start TFTP transfer attempt
+
+   ::
+
+       tftp 192.168.11.1
+       binary
+       rexmt 1
+       timeout 60
+       put openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
+
+-  Power on router. Router will reboot and initialize on 192.168.1.1.
+-  Delete static arp entry for router
+
+   ::
+
+       arp -d 192.168.11.1
+
+-  Set computer to DHCP, connect and telnet to router and set root
+   password.
+
+Configure the Router
+~~~~~~~~~~~~~~~~~~~~
+
+-  Update ``/etc/opkg.conf`` to point to our repo:
+
+   ::
+
+       src/gz packages http://192.168.5.13/openwrt/build/ar71xx/packages
+
+-  Configure anon mounts:
+
+   ::
+
+       uci delete fstab.@mount[0]
+       uci commit fstab
+       /etc/init.d/fstab restart
+
+-  Reset the DHCP address range. DevStack will claim the upper /25 of
+   the router's LAN address space for floating IPs so the default DHCP
+   address range needs to be moved:
+
+   ::
+
+       uci set dhcp.lan.start=65
+       uci set dhcp.lan.limit=60
+       uci commit dhcp
+
+-  Enable TFTP:
+
+   ::
+
+       uci set dhcp.@dnsmasq[0].enable_tftp=1
+       uci set dhcp.@dnsmasq[0].tftp_root=/mnt/sda1/tftpboot
+       uci set dhcp.@dnsmasq[0].dhcp_boot=pxelinux.0
+       uci commit dhcp
+       /etc/init.d/dnsmasq restart
+
+Set Up tftpboot
+~~~~~~~~~~~~~~~
+
+-  Create the ``/tmp/tftpboot`` structure and populate it:
+
+   ::
+
+       cd ~/devstack
+       tools/build_pxe_boot.sh /tmp
+
+   This calls ``tools/build_ramdisk.sh`` to create a 2GB ramdisk
+   containing a complete development Oneiric OS plus the OpenStack code
+   checkouts.
+
+-  Copy ``tftpboot`` to a USB drive:
+
+   ::
+
+       mount /dev/sdb1 /mnt/tmp
+       rsync -a /tmp/tftpboot/ /mnt/tmp/tftpboot/
+       umount /mnt/tmp
+
+-  Plug USB drive into router. It will be automounted and is ready to
+   serve content.
+
+Now `return <ramdisk.html>`__ to the RAM disk Guide to kick off your
+DevStack experience.
+
+© Openstack Foundation 2011-2013 — this is not an official OpenStack
+project...
diff --git a/doc/source/guides/ramdisk.html b/doc/source/guides/ramdisk.html
deleted file mode 100644
index 23239e2b60..0000000000
--- a/doc/source/guides/ramdisk.html
+++ /dev/null
@@ -1,119 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>RAMdisk Boot Guide - DevStack</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="../assets/css/bootstrap.css" rel="stylesheet">
-    <link href="../assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="../overview.html">Overview</a></li>
-            <li><a href="../changes.html">Changes</a></li>
-            <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-      <section id="overview">
-        <h1>Stack-in-a-Box: Try before you mkfs</h1>
-        <p>Run DevStack from a RAM disk to give it a whirl before making the 
-           commitment to install it.  We'll cover booting from a USB drive or 
-           over the network via PXE.  We'll even thow in configuring a home
-           router to handle the PXE boot.  You will need a minimum of 3GB 
-           for both of these configurations as the RAM disk itself is 2GB.</p>
-      </section>
-
-      <section id="requirements">
-        <div class="page-header">
-          <h2>Prerequisites <small>Hardware</small></h2>
-        </div>
-        
-        <h3>USB Boot</h3>
-        <p><a href="usb-boot.html">This guide</a> covers the creation of a bootable USB drive.  Your 
-        computer BIOS must support booting from USB.</p>
-        
-        <h3>PXE Boot</h3>
-        <p><a href="pxe-boot.html">This guide</a> covers the installation of OpenWRT on a home router
-        and configuring it as a PXE server, plus the creation of the
-        boot images and PXE support files.
-      </section>
-
-      <section id="installation">
-        <div class="page-header">
-          <h2>Installation <small>bit blasting</small></h2>
-        </div>
-
-        <h3>Install DevStack</h3>
-        <p>Grab the latest version of DevStack via https:</p>
-		<pre>sudo apt-get install git -y
-git clone https://git.openstack.org/openstack-dev/devstack
-cd devstack</pre>
-
-        <h3>Prepare the Boot RAMdisk</h3>
-        <p>Pick your boot method and follow the guide to prepare to build
-           the RAM disk and set up the boot process:</p>
-        <ul>
-          <li><a href="usb-boot.html">USB boot</a></li>
-          <li><a href="pxe-boot.html">PXE boot</a></li>
-        </ul>
-
-        <h3>Fire It Up</h3>
-        <ul>
-          <li>Boot the computer into the RAM disk.  The details will vary from
-              machine to machine but most BIOSes have a method to select the
-              boot device, often by pressing F12 during POST.</li>
-          <li>Select 'DevStack' from the Boot Menu.</li>
-          <li>Log in with the 'stack' user and 'pass' password.</li>
-          <li>Create <code>devstack/localrc</code> if you wish to change any 
-              of the configuration variables.  You will probably want to at 
-              least set the admin login password to something memorable rather 
-              than the default 20 random characters:
-            <pre>ADMIN_PASSWORD=openstack</pre>
-          </li>
-          <li>Fire up OpenStack!
-            <pre>./run.sh</pre>
-          </li>
-          <li>See the processes running in screen:
-            <pre>screen -x</pre>
-          </li>
-          <li>Connect to the dashboard at <code>http://&lt;ip-address&gt;/</code></li>
-        </ul>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; this is not an official OpenStack project...</p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/guides/ramdisk.rst b/doc/source/guides/ramdisk.rst
new file mode 100644
index 0000000000..82147a8c1b
--- /dev/null
+++ b/doc/source/guides/ramdisk.rst
@@ -0,0 +1,89 @@
+`DevStack </>`__
+
+-  `Overview <../overview.html>`__
+-  `Changes <../changes.html>`__
+-  `FAQ <../faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Stack-in-a-Box: Try before you mkfs
+===================================
+
+Run DevStack from a RAM disk to give it a whirl before making the
+commitment to install it. We'll cover booting from a USB drive or over
+the network via PXE. We'll even thow in configuring a home router to
+handle the PXE boot. You will need a minimum of 3GB for both of these
+configurations as the RAM disk itself is 2GB.
+
+Prerequisites Hardware
+----------------------
+
+USB Boot
+~~~~~~~~
+
+`This guide <usb-boot.html>`__ covers the creation of a bootable USB
+drive. Your computer BIOS must support booting from USB.
+
+PXE Boot
+~~~~~~~~
+
+`This guide <pxe-boot.html>`__ covers the installation of OpenWRT on a
+home router and configuring it as a PXE server, plus the creation of the
+boot images and PXE support files.
+
+Installation bit blasting
+-------------------------
+
+Install DevStack
+~~~~~~~~~~~~~~~~
+
+Grab the latest version of DevStack via https:
+
+::
+
+    sudo apt-get install git -y
+    git clone https://git.openstack.org/openstack-dev/devstack
+    cd devstack
+
+Prepare the Boot RAMdisk
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+Pick your boot method and follow the guide to prepare to build the RAM
+disk and set up the boot process:
+
+-  `USB boot <usb-boot.html>`__
+-  `PXE boot <pxe-boot.html>`__
+
+Fire It Up
+~~~~~~~~~~
+
+-  Boot the computer into the RAM disk. The details will vary from
+   machine to machine but most BIOSes have a method to select the boot
+   device, often by pressing F12 during POST.
+-  Select 'DevStack' from the Boot Menu.
+-  Log in with the 'stack' user and 'pass' password.
+-  Create ``devstack/localrc`` if you wish to change any of the
+   configuration variables. You will probably want to at least set the
+   admin login password to something memorable rather than the default
+   20 random characters:
+
+   ::
+
+       ADMIN_PASSWORD=openstack
+
+-  Fire up OpenStack!
+
+   ::
+
+       ./run.sh
+
+-  See the processes running in screen:
+
+   ::
+
+       screen -x
+
+-  Connect to the dashboard at ``http://<ip-address>/``
+
+© Openstack Foundation 2011-2013 — this is not an official OpenStack
+project...
diff --git a/doc/source/guides/single-machine.html b/doc/source/guides/single-machine.html
deleted file mode 100644
index 06cc981275..0000000000
--- a/doc/source/guides/single-machine.html
+++ /dev/null
@@ -1,131 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>Single Machine Guide - DevStack</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="../assets/css/bootstrap.css" rel="stylesheet">
-    <link href="../assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="../overview.html">Overview</a></li>
-            <li><a href="../changes.html">Changes</a></li>
-            <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-      <section id="overview">
-        <h1>All-In-One: Dedicated Hardware</h1>
-        <p>Things are about to get real!  Using OpenStack in containers or VMs is nice for kicking the tires, but doesn't compare to the feeling you get with hardware.</p>
-      </section>
-
-      <section id="prerequisites">
-        <div class="page-header">
-          <h2>Prerequisites <small>Linux & Network</small></h2>
-        </div>
-        
-        <h3>Minimal Install</h3>
-        <p>You need to have a system with a fresh install of Linux.  You can download the <a href="https://help.ubuntu.com/community/Installation/MinimalCD">Minimal CD</a> for Ubuntu releases since DevStack will download &amp; install all the additional dependencies.  The netinstall ISO is available for <a href="http://mirrors.kernel.org/fedora/releases/18/Fedora/x86_64/iso/Fedora-20-x86_64-netinst.iso">Fedora</a> and <a href="http://mirrors.kernel.org/centos/6.5/isos/x86_64/CentOS-6.5-x86_64-netinstall.iso">CentOS/RHEL</a>.  You may be tempted to use a desktop distro on a laptop, it will probably work but you may need to tell Network Manager to keep its fingers off the interface(s) that OpenStack uses for bridging.</p>
-        
-        <h3>Network Configuration</h3>
-        <p>Determine the network configuration on the interface used to integrate your 
-        OpenStack cloud with your existing network. For example, if the IPs given out on your network 
-        by DHCP are 192.168.1.X - where X is between 100 and 200 you will be able to use IPs 
-        201-254 for <b>floating ips</b>.</p>
-        <p>To make things easier later change your host to use a static IP instead of DHCP (i.e. 192.168.1.201).</p>
-      </section>
-
-      <section id="installation">
-        <div class="page-header">
-          <h2>Installation <small>shake and bake</small></h2>
-        </div>
-
-        <h3>Add your user</h3>
-        <p>We need to add a user to install DevStack.  (if you created a user during install you can skip this step and just give the user sudo privileges below)</p>
-        <pre>adduser stack</pre>
-        <p>Since this user will be making many changes to your system, it will need to have sudo privileges:</p>
-        <pre>apt-get install sudo -y || yum install -y sudo
-echo "stack ALL=(ALL) NOPASSWD: ALL" &gt;&gt; /etc/sudoers</pre>
-        <p>From here on you should use the user you created.  <b>Logout</b> and <b>login</b> as that user.</p>
-
-        <h3>Download DevStack</h3>
-        <p>We'll grab the latest version of DevStack via https:</p>
-        <pre>sudo apt-get install git -y || yum install -y git
-git clone https://git.openstack.org/openstack-dev/devstack
-cd devstack</pre>
-
-        <h3>Run DevStack</h3>
-        <p>Now to configure <code>stack.sh</code>.  DevStack includes a sample in <code>devstack/samples/local.conf</code>.  Create <code>local.conf</code> as shown below to do the following:</p>
-        <ul>
-          <li>Set <code>FLOATING_RANGE</code> to a range not used on the local network, i.e. 192.168.1.224/27.  This configures IP addresses ending in 225-254 to be used as floating IPs.</li>
-          <li>Set <code>FIXED_RANGE</code> and <code>FIXED_NETWORK_SIZE</code> to configure the internal address space used by the instances.</li>
-          <li>Set <code>FLAT_INTERFACE</code> to the Ethernet interface that connects the host to your local network.  This is the interface that should be configured with the static IP address mentioned above.</li>
-          <li>Set the administrative password.  This password is used for the <b>admin</b> and <b>demo</b> accounts set up as OpenStack users.</li>
-          <li>Set the MySQL administrative password.  The default here is a random hex string which is inconvenient if you need to look at the database directly for anything.</li>
-          <li>Set the RabbitMQ password.</li>
-          <li>Set the service password.  This is used by the OpenStack services (Nova, Glance, etc) to authenticate with Keystone.</li>
-        </ul>
-        <p><code>local.conf</code> should look something like this:</p>
-        <pre>[[local|localrc]]
-FLOATING_RANGE=192.168.1.224/27
-FIXED_RANGE=10.11.12.0/24
-FIXED_NETWORK_SIZE=256
-FLAT_INTERFACE=eth0
-ADMIN_PASSWORD=supersecret
-MYSQL_PASSWORD=iheartdatabases
-RABBIT_PASSWORD=flopsymopsy
-SERVICE_PASSWORD=iheartksl</pre>
-
-        <p>Run DevStack:</p>
-        <pre>./stack.sh</pre>
-        <p>A seemingly endless stream of activity ensues.  When complete you will see a summary of
-        <code>stack.sh</code>'s work, including the relevant URLs, accounts and passwords to poke at your
-        shiny new OpenStack.</p>
-
-        <h3>Using OpenStack</h3>
-        <p>At this point you should be able to access the dashboard from other computers on the 
-        local network.  In this example that would be http://192.168.1.201/ for the dashboard (aka Horizon).
-        Launch VMs and if you give them floating IPs and security group access those VMs will be accessible from other machines on your network.</p>
-
-        <p>Some examples of using the OpenStack command-line clients <code>nova</code> and <code>glance</code>
-        are in the shakedown scripts in <code>devstack/exercises</code>.  <code>exercise.sh</code>
-        will run all of those scripts and report on the results.</p>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; An <a href="https://wiki.openstack.org/wiki/Programs">OpenStack program</a> created by <a href="http://www.rackspace.com/cloud/private_edition/">Rackspace Cloud Builders</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
new file mode 100644
index 0000000000..0db0466281
--- /dev/null
+++ b/doc/source/guides/single-machine.rst
@@ -0,0 +1,145 @@
+`DevStack </>`__
+
+-  `Overview <../overview.html>`__
+-  `Changes <../changes.html>`__
+-  `FAQ <../faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+All-In-One: Dedicated Hardware
+==============================
+
+Things are about to get real! Using OpenStack in containers or VMs is
+nice for kicking the tires, but doesn't compare to the feeling you get
+with hardware.
+
+Prerequisites Linux & Network
+-----------------------------
+
+Minimal Install
+~~~~~~~~~~~~~~~
+
+You need to have a system with a fresh install of Linux. You can
+download the `Minimal
+CD <https://help.ubuntu.com/community/Installation/MinimalCD>`__ for
+Ubuntu releases since DevStack will download & install all the
+additional dependencies. The netinstall ISO is available for
+`Fedora <http://mirrors.kernel.org/fedora/releases/18/Fedora/x86_64/iso/Fedora-20-x86_64-netinst.iso>`__
+and
+`CentOS/RHEL <http://mirrors.kernel.org/centos/6.5/isos/x86_64/CentOS-6.5-x86_64-netinstall.iso>`__.
+You may be tempted to use a desktop distro on a laptop, it will probably
+work but you may need to tell Network Manager to keep its fingers off
+the interface(s) that OpenStack uses for bridging.
+
+Network Configuration
+~~~~~~~~~~~~~~~~~~~~~
+
+Determine the network configuration on the interface used to integrate
+your OpenStack cloud with your existing network. For example, if the IPs
+given out on your network by DHCP are 192.168.1.X - where X is between
+100 and 200 you will be able to use IPs 201-254 for **floating ips**.
+
+To make things easier later change your host to use a static IP instead
+of DHCP (i.e. 192.168.1.201).
+
+Installation shake and bake
+---------------------------
+
+Add your user
+~~~~~~~~~~~~~
+
+We need to add a user to install DevStack. (if you created a user during
+install you can skip this step and just give the user sudo privileges
+below)
+
+::
+
+    adduser stack
+
+Since this user will be making many changes to your system, it will need
+to have sudo privileges:
+
+::
+
+    apt-get install sudo -y || yum install -y sudo
+    echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+
+From here on you should use the user you created. **Logout** and
+**login** as that user.
+
+Download DevStack
+~~~~~~~~~~~~~~~~~
+
+We'll grab the latest version of DevStack via https:
+
+::
+
+    sudo apt-get install git -y || yum install -y git
+    git clone https://git.openstack.org/openstack-dev/devstack
+    cd devstack
+
+Run DevStack
+~~~~~~~~~~~~
+
+Now to configure ``stack.sh``. DevStack includes a sample in
+``devstack/samples/local.conf``. Create ``local.conf`` as shown below to
+do the following:
+
+-  Set ``FLOATING_RANGE`` to a range not used on the local network, i.e.
+   192.168.1.224/27. This configures IP addresses ending in 225-254 to
+   be used as floating IPs.
+-  Set ``FIXED_RANGE`` and ``FIXED_NETWORK_SIZE`` to configure the
+   internal address space used by the instances.
+-  Set ``FLAT_INTERFACE`` to the Ethernet interface that connects the
+   host to your local network. This is the interface that should be
+   configured with the static IP address mentioned above.
+-  Set the administrative password. This password is used for the
+   **admin** and **demo** accounts set up as OpenStack users.
+-  Set the MySQL administrative password. The default here is a random
+   hex string which is inconvenient if you need to look at the database
+   directly for anything.
+-  Set the RabbitMQ password.
+-  Set the service password. This is used by the OpenStack services
+   (Nova, Glance, etc) to authenticate with Keystone.
+
+``local.conf`` should look something like this:
+
+::
+
+    [[local|localrc]]
+    FLOATING_RANGE=192.168.1.224/27
+    FIXED_RANGE=10.11.12.0/24
+    FIXED_NETWORK_SIZE=256
+    FLAT_INTERFACE=eth0
+    ADMIN_PASSWORD=supersecret
+    MYSQL_PASSWORD=iheartdatabases
+    RABBIT_PASSWORD=flopsymopsy
+    SERVICE_PASSWORD=iheartksl
+
+Run DevStack:
+
+::
+
+    ./stack.sh
+
+A seemingly endless stream of activity ensues. When complete you will
+see a summary of ``stack.sh``'s work, including the relevant URLs,
+accounts and passwords to poke at your shiny new OpenStack.
+
+Using OpenStack
+~~~~~~~~~~~~~~~
+
+At this point you should be able to access the dashboard from other
+computers on the local network. In this example that would be
+http://192.168.1.201/ for the dashboard (aka Horizon). Launch VMs and if
+you give them floating IPs and security group access those VMs will be
+accessible from other machines on your network.
+
+Some examples of using the OpenStack command-line clients ``nova`` and
+``glance`` are in the shakedown scripts in ``devstack/exercises``.
+``exercise.sh`` will run all of those scripts and report on the results.
+
+© Openstack Foundation 2011-2013 — An `OpenStack
+program <https://wiki.openstack.org/wiki/Programs>`__ created by
+`Rackspace Cloud
+Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/guides/single-vm.html b/doc/source/guides/single-vm.html
deleted file mode 100644
index d189319623..0000000000
--- a/doc/source/guides/single-vm.html
+++ /dev/null
@@ -1,137 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>Single Machine Guide - DevStack</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="../assets/css/bootstrap.css" rel="stylesheet">
-    <link href="../assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="../overview.html">Overview</a></li>
-            <li><a href="../changes.html">Changes</a></li>
-            <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-      <section id="overview">
-        <h1>Running a Cloud in a VM</h1>
-        <p>Use the cloud to build the cloud! Use your cloud to launch new versions of OpenStack 
-        in about 5 minutes.  When you break it, start over!  The VMs launched in the cloud will 
-        be slow as they are running in QEMU (emulation), but their primary use is testing
-        OpenStack development and operation.  Speed not required.</p>
-      </section>
-
-      <section id="prerequisites">
-        <div class="page-header">
-          <h2>Prerequisites <small>Cloud & Image</small></h2>
-        </div>
-
-        <h3>Virtual Machine</h3>
-        <p>DevStack should run in any virtual machine running a supported Linux release.  It will perform best with 2Gb or more of RAM.</p>
-
-        <h3>OpenStack Deployment &amp; cloud-init</h3>
-        <p>If the cloud service has an image with <code>cloud-init</code> pre-installed, use it.  You can
-        get one from <a href="http://uec-images.ubuntu.com">Ubuntu's Daily Build</a>
-        site if necessary.  This will enable you to launch VMs with userdata that installs 
-        everything at boot time.  The userdata script below will install and run
-        DevStack with a minimal configuration.  The use of <code>cloud-init</code>
-        is outside the scope of this document, refer to <a href"http://cloudinit.readthedocs.org/en/latest/index.html">the
-        <code>cloud-init</code> docs</a> for more information.</p>
-
-        <p>If you are directly using a hypervisor like Xen, kvm or VirtualBox you can manually kick off
-        the script below as a non-root user in a bare-bones server installation.</p>
-      </section>
-
-      <section id="requirements">
-        <div class="page-header">
-          <h2>Installation <small>shake and bake</small></h2>
-        </div>
-
-        <h3>Launching With Cloud-Init</h3>
-        <p>This cloud config grabs the latest version of DevStack via git, creates a minimal 
-        <code>local.conf</code> file and kicks off <code>stack.sh</code>.  It should
-        be passed as the user-data file when booting the VM.</p>
-        <pre>#cloud-config
-
-users:
-  - default
-  - name: stack
-    lock_passwd: False
-    sudo: ["ALL=(ALL) NOPASSWD:ALL\nDefaults:stack !requiretty"]
-    shell: /bin/bash
-
-write_files:
-  - content: |
-        #!/bin/sh
-        DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo yum update -qy
-        DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
-        sudo chown stack:stack /home/stack
-        cd /home/stack
-        git clone https://git.openstack.org/openstack-dev/devstack
-        cd devstack
-        echo '[[local|localrc]]' > local.conf
-        echo ADMIN_PASSWORD=password >> local.conf
-        echo MYSQL_PASSWORD=password >> local.conf
-        echo RABBIT_PASSWORD=password >> local.conf
-        echo SERVICE_PASSWORD=password >> local.conf
-        echo SERVICE_TOKEN=tokentoken >> local.conf
-        ./stack.sh
-    path: /home/stack/start.sh
-    permissions: 0755
-
-runcmd:
-  - su -l stack ./start.sh</pre>
-        <p>As DevStack will refuse to run as root, this configures <code>cloud-init</code>
-        to create a non-root user and run the <code>start.sh</code> script as that user.</p>
-
-        <h3>Launching By Hand</h3>
-        <p>Using a hypervisor directly, launch the VM and either manually perform the steps in the 
-        embedded shell script above or copy it into the VM.</p>
-
-        <h3>Using OpenStack</h3>
-        <p>At this point you should be able to access the dashboard.  Launch VMs and if you give them floating IPs access those VMs from other machines on your network.</p>
-
-        <p>One interesting use case is for developers working on a VM on their laptop.  Once
-        <code>stack.sh</code> has completed once, all of the pre-requisite packages are installed
-        in the VM and the source trees checked out.  Setting <code>OFFLINE=True</code> in
-        <code>local.conf</code> enables <code>stack.sh</code> to run multiple times without an Internet
-        connection.  DevStack, making hacking at the lake possible since 2012!</p>
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
new file mode 100644
index 0000000000..0e2d1573aa
--- /dev/null
+++ b/doc/source/guides/single-vm.rst
@@ -0,0 +1,110 @@
+`DevStack </>`__
+
+-  `Overview <../overview.html>`__
+-  `Changes <../changes.html>`__
+-  `FAQ <../faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Running a Cloud in a VM
+=======================
+
+Use the cloud to build the cloud! Use your cloud to launch new versions
+of OpenStack in about 5 minutes. When you break it, start over! The VMs
+launched in the cloud will be slow as they are running in QEMU
+(emulation), but their primary use is testing OpenStack development and
+operation. Speed not required.
+
+Prerequisites Cloud & Image
+---------------------------
+
+Virtual Machine
+~~~~~~~~~~~~~~~
+
+DevStack should run in any virtual machine running a supported Linux
+release. It will perform best with 2Gb or more of RAM.
+
+OpenStack Deployment & cloud-init
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If the cloud service has an image with ``cloud-init`` pre-installed, use
+it. You can get one from `Ubuntu's Daily
+Build <http://uec-images.ubuntu.com>`__ site if necessary. This will
+enable you to launch VMs with userdata that installs everything at boot
+time. The userdata script below will install and run DevStack with a
+minimal configuration. The use of ``cloud-init`` is outside the scope of
+this document, refer to the ``cloud-init`` docs for more information.
+
+If you are directly using a hypervisor like Xen, kvm or VirtualBox you
+can manually kick off the script below as a non-root user in a
+bare-bones server installation.
+
+Installation shake and bake
+---------------------------
+
+Launching With Cloud-Init
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This cloud config grabs the latest version of DevStack via git, creates
+a minimal ``local.conf`` file and kicks off ``stack.sh``. It should be
+passed as the user-data file when booting the VM.
+
+::
+
+    #cloud-config
+
+    users:
+      - default
+      - name: stack
+        lock_passwd: False
+        sudo: ["ALL=(ALL) NOPASSWD:ALL\nDefaults:stack !requiretty"]
+        shell: /bin/bash
+
+    write_files:
+      - content: |
+            #!/bin/sh
+            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo yum update -qy
+            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
+            sudo chown stack:stack /home/stack
+            cd /home/stack
+            git clone https://git.openstack.org/openstack-dev/devstack
+            cd devstack
+            echo '[[local|localrc]]' > local.conf
+            echo ADMIN_PASSWORD=password >> local.conf
+            echo MYSQL_PASSWORD=password >> local.conf
+            echo RABBIT_PASSWORD=password >> local.conf
+            echo SERVICE_PASSWORD=password >> local.conf
+            echo SERVICE_TOKEN=tokentoken >> local.conf
+            ./stack.sh
+        path: /home/stack/start.sh
+        permissions: 0755
+
+    runcmd:
+      - su -l stack ./start.sh
+
+As DevStack will refuse to run as root, this configures ``cloud-init``
+to create a non-root user and run the ``start.sh`` script as that user.
+
+Launching By Hand
+~~~~~~~~~~~~~~~~~
+
+Using a hypervisor directly, launch the VM and either manually perform
+the steps in the embedded shell script above or copy it into the VM.
+
+Using OpenStack
+~~~~~~~~~~~~~~~
+
+At this point you should be able to access the dashboard. Launch VMs and
+if you give them floating IPs access those VMs from other machines on
+your network.
+
+One interesting use case is for developers working on a VM on their
+laptop. Once ``stack.sh`` has completed once, all of the pre-requisite
+packages are installed in the VM and the source trees checked out.
+Setting ``OFFLINE=True`` in ``local.conf`` enables ``stack.sh`` to run
+multiple times without an Internet connection. DevStack, making hacking
+at the lake possible since 2012!
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/guides/usb-boot.html b/doc/source/guides/usb-boot.html
deleted file mode 100644
index 2a05f89d89..0000000000
--- a/doc/source/guides/usb-boot.html
+++ /dev/null
@@ -1,99 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>USB Boot Server Guide - DevStack</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="../assets/css/bootstrap.css" rel="stylesheet">
-    <link href="../assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="../overview.html">Overview</a></li>
-            <li><a href="../changes.html">Changes</a></li>
-            <li><a href="../faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-      <section id="overview">
-        <h1>USB Boot: Undoable Stack Boot</h1>
-        <p>Boot DevStack from a USB disk into a RAM disk.</p>
-      </section>
-
-      <section id="requirements">
-        <div class="page-header">
-          <h2>Prerequisites</h2>
-        </div>
-        
-        <h3>Hardware</h3>
-        <p>This guide covers the creation of a bootable USB drive.  Your 
-           computer BIOS must support booting from USB and You will want at least 3GB of 
-           RAM.  You also will need a USB drive of at least 2GB.</p>
-
-        <h3>Software</h3>
-        <p>Ubuntu 11.10 (Oneiric Ocelot) is required on host to create images.</p>
-      </section>
-
-      <section id="installation">
-        <div class="page-header">
-          <h2>Installation <small>bit blasting</small></h2>
-        </div>
-
-        <h3>Set Up USB Drive</h3>
-        <ul>
-          <li>Insert the USB drive into the computer.  Make a note of the device name, such as 
-          <code>sdb</code>. Do not mount the device.</li>
-          <li>Install the boot system:
-            <pre>tools/build_usb_boot.sh /dev/sdb1</pre>
-            <p>This calls tools/build_ramdisk.sh to create a 2GB ramdisk 
-               containing a complete development Oneiric OS plus the 
-               OpenStack code checkouts.  It then writes a syslinux boot sector
-               to the specified device and creates <code>/syslinux</code>.</p>
-          </li>
-          <li>If desired, you may now mount the device:
-            <pre>mount /dev/sdb1 /mnt/tmp
-# foo
-umount /mnt/tmp</pre>
-          </li>
-        </ul>
-
-        <p>Now <a href="ramdisk.html">return</a> to the RAM disk Guide to kick
-           off your DevStack experience.</p>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; this is not an official OpenStack project...</p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/guides/usb-boot.rst b/doc/source/guides/usb-boot.rst
new file mode 100644
index 0000000000..888e14feb3
--- /dev/null
+++ b/doc/source/guides/usb-boot.rst
@@ -0,0 +1,60 @@
+`DevStack </>`__
+
+-  `Overview <../overview.html>`__
+-  `Changes <../changes.html>`__
+-  `FAQ <../faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+USB Boot: Undoable Stack Boot
+=============================
+
+Boot DevStack from a USB disk into a RAM disk.
+
+Prerequisites
+-------------
+
+Hardware
+~~~~~~~~
+
+This guide covers the creation of a bootable USB drive. Your computer
+BIOS must support booting from USB and You will want at least 3GB of
+RAM. You also will need a USB drive of at least 2GB.
+
+Software
+~~~~~~~~
+
+Ubuntu 11.10 (Oneiric Ocelot) is required on host to create images.
+
+Installation bit blasting
+-------------------------
+
+Set Up USB Drive
+~~~~~~~~~~~~~~~~
+
+-  Insert the USB drive into the computer. Make a note of the device
+   name, such as ``sdb``. Do not mount the device.
+-  Install the boot system:
+
+   ::
+
+       tools/build_usb_boot.sh /dev/sdb1
+
+   This calls tools/build\_ramdisk.sh to create a 2GB ramdisk containing
+   a complete development Oneiric OS plus the OpenStack code checkouts.
+   It then writes a syslinux boot sector to the specified device and
+   creates ``/syslinux``.
+
+-  If desired, you may now mount the device:
+
+   ::
+
+       mount /dev/sdb1 /mnt/tmp
+       # foo
+       umount /mnt/tmp
+
+Now `return <ramdisk.html>`__ to the RAM disk Guide to kick off your
+DevStack experience.
+
+© Openstack Foundation 2011-2013 — this is not an official OpenStack
+project...
diff --git a/doc/source/index.html b/doc/source/index.html
deleted file mode 100644
index 5f1efd77fb..0000000000
--- a/doc/source/index.html
+++ /dev/null
@@ -1,562 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Deploying OpenStack for Developers</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-
-      <div class="hero-unit">
-        <div class="pull-left">
-          <h1 id="main_header">DevStack - an OpenStack Community Production</h1>
-          <div class="sub_header">
-            <p></p>
-            <p>A documented shell script to build complete OpenStack development environments. <br /><br />
-              An OpenStack program maintained by the developer community.</p>
-          </div>
-        </div>
-        <div class="pull-left">
-          <ol id="getting_started">
-            <li id="ubuntu">Setup a fresh supported Linux installation.</li>
-            <li id="git">
-              Clone devstack from git.openstack.org.
-              <pre>git clone https://git.openstack.org/openstack-dev/devstack</pre>
-            </li>
-            <li id="install">
-              Deploy your OpenStack Cloud
-              <pre>cd devstack &amp;&amp; ./stack.sh</pre>
-            </li>
-          </ol>
-        </div>
-        <div class="clear">&nbsp;</div>
-      </div>
-
-
-      <section id="quickstart" class="span12">
-        <div class="page-header">
-          <h2>Quick Start <small>This ain't your first rodeo</small></h2>
-        </div>
-        <ol>
-            <li value="0">
-              <h3>Select a Linux Distribution</h3>
-              <p>Only Ubuntu 14.04 (Trusty), Fedora 20 and CentOS/RHEL 6.5 are documented here.  OpenStack also runs and is packaged on other flavors of Linux such as OpenSUSE and Debian.</p>
-            </li>
-            <li>
-              <h3>Install Selected OS</h3>
-              <p>In order to correctly install all the dependencies, we assume a specific minimal version of the supported distributions to make it as easy as possible.  We recommend using a minimal install of Ubuntu or Fedora server in a VM if this is your first time.</p>
-            </li>
-            <li>
-              <h3>Download DevStack</h3>
-              <pre>git clone https://git.openstack.org/openstack-dev/devstack</pre>
-              <p>The <code>devstack</code> repo contains a script that installs OpenStack and templates for configuration files</p>
-            </li>
-            <li>
-              <h3>Configure</h3>
-              <p>We recommend at least a <a href="configuration.html">minimal configuration</a> be set up.</p>
-            </li>
-            <li>
-              <h3>Start the install</h3>
-              <pre>cd devstack; ./stack.sh</pre>
-              <p>It takes a few minutes, we recommend <a href="stack.sh.html">reading the script</a> while it is building.</p>
-            </li>
-        </ol>
-      </section>
-
-      <section id="guides" class='span12'>
-        <div class="page-header">
-          <h2>Guides <small>Walk through various setups used by stackers</small></h2>
-        </div>
-
-        <div class='row span8'>
-          <h2>OpenStack on VMs</h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Title</th>
-                <th>Description</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>Virtual Machine</td>
-                <td>Run OpenStack in a VM.  The VMs launched in your cloud will be slow as they are running in QEMU (emulation), but it is useful if you don't have spare hardware laying around.</td>
-                <td><a class="btn btn-small btn-primary table-action" href="guides/single-vm.html">Read &raquo;</a></td>
-              </tr>
-
-<!--
-              <tr>
-                <td>LXC Containers</td>
-                <td>Already running Ubuntu on your machine?  Using containers lets you build even faster.</td>
-                <td>Coming soon!</td>
-              </tr>
--->
-            </tbody>
-            <tfoot>
-              <td colspan="3">1 Guide</td>
-            </tfoot>
-          </table>
-        </div>
-        <div class="wat span3 pull-right">
-          <h4>What is this?</h4>
-          <p>These guides tell you how to virtualize your OpenStack cloud in virtual machines. This means that you can get started without having to purchase any hardware.</p>
-        </div>
-
-        <div class='row span8'>
-          <h2>OpenStack on Hardware</h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Title</th>
-                <th>Description</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>All-In-One</td>
-                <td>Run OpenStack on dedicated hardware to get real performance in your VMs.  This can include a server-class machine or a laptop at home.</td>
-                <td><a class="btn btn-small btn-primary table-action" href="guides/single-machine.html">Read &raquo;</a></td>
-              </tr>
-
-              <tr>
-                <td>Multi-Node + VLANs</td>
-                <td>Setup a multi-node cluster with dedicated VLANs for VMs &amp; Management.</td>
-                <td><a class="btn btn-small btn-primary table-action" href="guides/multinode-lab.html">Read &raquo;</a></td>
-              </tr>
-
-<!--
-              <tr>
-                <td>Stack-in-a-Box</td>
-                <td>Run OpenStack from a RAM disk to give it a spin without touching your existing OS installation.  Includes PXE and USB boot methods.</td>
-                <td><a class="btn btn-small btn-primary table-action" href="guides/ramdisk.html">Read &raquo;</a></td>
-              </tr>
--->
-            </tbody>
-            <tfoot>
-              <td colspan="3">2 Guides</td>
-            </tfoot>
-          </table>
-        </div>
-        <div class="wat span3 pull-right">
-          <h4>What is this?</h4>
-          <p>These guides tell you how to deploy a development environment on real hardware. Guides range from running OpenStack on a single laptop to running a multi-node deployment on datacenter hardware.</p>
-        </div>
-
-      </section>
-
-      <section id="docs" class="span12">
-        <div class="page-header">
-          <h2>Documentation <small>Help yourself to stack</small></h2>
-        </div>
-
-        <div class='row span5 pull-left'>
-          <h2>Overview</h2>
-          <p><a href="overview.html">An overview of DevStack goals and priorities</a></p>
-          <h2>Configuration</h2>
-          <p><a href="configuration.html">Configuring and customizing the stack</a></p>
-          <h2>Plugins</h2>
-          <p><a href="plugins.html">Extending DevStack with new features</a></p>
-        </div>
-
-        <div class='span5 pull-right'>
-          <h2>Recent Changes</h2>
-          <p><a href="changes.html">An incomplete summary of recent changes</a></p>
-          <h2>FAQ</h2>
-          <p><a href="faq.html">The DevStack FAQ</a></p>
-          <h2>Contributing</h2>
-          <p><a href="contributing.html">Pitching in to make DevStack a better place</a></p>
-        </div>
-
-      </section>
-
-      <section id="docs" class="span12">
-        <div class="page-header">
-          <h2>Code <small>A look at the bits that make it all go</small></h2>
-        </div>
-
-        <div class='row span5 pull-left'>
-          <h2>Scripts <small>Generated documentation of DevStack scripts.</small></h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Filename</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>stack.sh</td>
-                <td><a href="stack.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>functions</td>
-                <td><a href="functions.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>functions-common</td>
-                <td><a href="functions-common.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/apache</td>
-                <td><a href="lib/apache.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/baremetal</td>
-                <td><a href="lib/baremetal.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/ceilometer</td>
-                <td><a href="lib/ceilometer.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/cinder</td>
-                <td><a href="lib/cinder.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/config</td>
-                <td><a href="lib/config.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/database</td>
-                <td><a href="lib/database.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/glance</td>
-                <td><a href="lib/glance.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/heat</td>
-                <td><a href="lib/heat.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/horizon</td>
-                <td><a href="lib/horizon.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/infra</td>
-                <td><a href="lib/infra.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/ironic</td>
-                <td><a href="lib/ironic.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/keystone</td>
-                <td><a href="lib/keystone.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/ldap</td>
-                <td><a href="lib/ldap.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/zaqar</td>
-                <td><a href="lib/zaqar.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/neutron</td>
-                <td><a href="lib/neutron.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/nova</td>
-                <td><a href="lib/nova.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/oslo</td>
-                <td><a href="lib/oslo.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/rpc_backend</td>
-                <td><a href="lib/rpc_backend.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/sahara</td>
-                <td><a href="lib/sahara.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/savanna</td>
-                <td><a href="lib/savanna.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/stackforge</td>
-                <td><a href="lib/stackforge.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/swift</td>
-                <td><a href="lib/swift.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/tempest</td>
-                <td><a href="lib/tempest.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/tls</td>
-                <td><a href="lib/tls.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>lib/trove</td>
-                <td><a href="lib/trove.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>unstack.sh</td>
-                <td><a href="unstack.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>clean.sh</td>
-                <td><a href="clean.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>run_tests.sh</td>
-                <td><a href="run_tests.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/50-ironic.sh</td>
-                <td><a href="extras.d/50-ironic.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/70-zaqar.sh</td>
-                <td><a href="extras.d/70-zaqar.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/70-sahara.sh</td>
-                <td><a href="extras.d/70-sahara.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/70-savanna.sh</td>
-                <td><a href="extras.d/70-savanna.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/70-trove.sh</td>
-                <td><a href="extras.d/70-trove.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/80-opendaylight.sh</td>
-                <td><a href="extras.d/80-opendaylight.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>extras.d/80-tempest.sh</td>
-                <td><a href="extras.d/80-tempest.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-            </tbody>
-          </table>
-        </div>
-
-        <div class='span5 pull-right'>
-          <h2>Configuration <small>Setting the table</small></h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Filename</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>local.conf</td>
-                <td><a href="local.conf.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>stackrc</td>
-                <td><a href="stackrc.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>openrc</td>
-                <td><a href="openrc.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exerciserc</td>
-                <td><a href="exerciserc.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>eucarc</td>
-                <td><a href="eucarc.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-            </tbody>
-          </table>
-
-          <h2>Tools <small>Support scripts</small></h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Filename</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>tools/info.sh</td>
-                <td><a href="tools/info.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>tools/build_docs.sh</td>
-                <td><a href="tools/build_docs.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>tools/create_userrc.sh</td>
-                <td><a href="tools/create_userrc.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>tools/fixup_stuff.sh</td>
-                <td><a href="tools/fixup_stuff.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>tools/install_prereqs.sh</td>
-                <td><a href="tools/install_prereqs.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>tools/install_pip.sh</td>
-                <td><a href="tools/install_pip.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>tools/upload_image.sh</td>
-                <td><a href="tools/upload_image.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-            </tbody>
-          </table>
-
-          <h2>Samples <small>Generated documentation of DevStack sample files.</small></h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Filename</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>local.sh</td>
-                <td><a href="samples/local.sh.html" class="btn btn-small btn-success table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>localrc</td>
-                <td><a href="samples/localrc.html" class="btn btn-small btn-success table-action">Read &raquo;</a></td>
-              </tr>
-            </tbody>
-          </table>
-
-        <div class='row span5 pull-right'>
-          <h2>Exercises <small>Generated documentation of DevStack scripts.</small></h2>
-          <table class='table table-striped table-bordered'>
-            <thead>
-              <tr>
-                <th>Filename</th>
-                <th>Link</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr>
-                <td>exercise.sh</td>
-                <td><a href="exercise.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/aggregates.sh</td>
-                <td><a href="exercises/aggregates.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/boot_from_volume.sh</td>
-                <td><a href="exercises/boot_from_volume.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/bundle.sh</td>
-                <td><a href="exercises/bundle.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/client-args.sh</td>
-                <td><a href="exercises/client-args.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/client-env.sh</td>
-                <td><a href="exercises/client-env.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/euca.sh</td>
-                <td><a href="exercises/euca.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/floating_ips.sh</td>
-                <td><a href="exercises/floating_ips.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/horizon.sh</td>
-                <td><a href="exercises/horizon.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/neutron-adv-test.sh</td>
-                <td><a href="exercises/neutron-adv-test.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-                <td>exercises/sahara.sh</td>
-                <td><a href="exercises/sahara.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-                <td>exercises/savanna.sh</td>
-                <td><a href="exercises/savanna.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/sec_groups.sh</td>
-                <td><a href="exercises/sec_groups.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/swift.sh</td>
-                <td><a href="exercises/swift.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-                <td>exercises/trove.sh</td>
-                <td><a href="exercises/trove.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/volumes.sh</td>
-                <td><a href="exercises/volumes.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-              <tr>
-                <td>exercises/zaqar.sh</td>
-                <td><a href="exercises/zaqar.sh.html" class="btn btn-small btn-primary table-action">Read &raquo;</a></td>
-              </tr>
-            </tbody>
-          </table>
-
-        </div>
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/index.rst b/doc/source/index.rst
new file mode 100644
index 0000000000..6e5105dcff
--- /dev/null
+++ b/doc/source/index.rst
@@ -0,0 +1,383 @@
+`DevStack </>`__
+
+-  `Overview <overview.rst>`__
+-  `Changes <changes.rst>`__
+-  `FAQ <faq.rst>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+.. toctree::
+   :glob:
+   :maxdepth: 2
+
+   *
+   guides/*
+   
+
+
+DevStack - an OpenStack Community Production
+============================================
+
+| A documented shell script to build complete OpenStack development environments.
+|  An OpenStack program maintained by the developer community.
+
+#. Setup a fresh supported Linux installation.
+#. Clone devstack from git.openstack.org.
+
+   ::
+
+       git clone https://git.openstack.org/openstack-dev/devstack
+
+#. Deploy your OpenStack Cloud
+
+   ::
+
+       cd devstack && ./stack.sh
+
+ 
+
+Quick Start This ain't your first rodeo
+---------------------------------------
+
+#. Select a Linux Distribution
+
+   Only Ubuntu 14.04 (Trusty), Fedora 20 and CentOS/RHEL 6.5 are
+   documented here. OpenStack also runs and is packaged on other flavors
+   of Linux such as OpenSUSE and Debian.
+
+#. Install Selected OS
+
+   In order to correctly install all the dependencies, we assume a
+   specific minimal version of the supported distributions to make it as
+   easy as possible. We recommend using a minimal install of Ubuntu or
+   Fedora server in a VM if this is your first time.
+
+#. Download DevStack
+
+   ::
+
+       git clone https://git.openstack.org/openstack-dev/devstack
+
+   The ``devstack`` repo contains a script that installs OpenStack and
+   templates for configuration files
+
+#. Configure
+
+   We recommend at least a `minimal
+   configuration <configuration.html>`__ be set up.
+
+#. Start the install
+
+   ::
+
+       cd devstack; ./stack.sh
+
+   It takes a few minutes, we recommend `reading the
+   script <stack.sh.html>`__ while it is building.
+
+Guides Walk through various setups used by stackers
+---------------------------------------------------
+
+OpenStack on VMs
+----------------
+
+Title
+
+Description
+
+Link
+
+Virtual Machine
+
+Run OpenStack in a VM. The VMs launched in your cloud will be slow as
+they are running in QEMU (emulation), but it is useful if you don't have
+spare hardware laying around.
+
+`Read » <guides/single-vm.html>`__
+
+1 Guide
+
+What is this?
+^^^^^^^^^^^^^
+
+These guides tell you how to virtualize your OpenStack cloud in virtual
+machines. This means that you can get started without having to purchase
+any hardware.
+
+OpenStack on Hardware
+---------------------
+
+Title
+
+Description
+
+Link
+
+All-In-One
+
+Run OpenStack on dedicated hardware to get real performance in your VMs.
+This can include a server-class machine or a laptop at home.
+
+`Read » <guides/single-machine.html>`__
+
+Multi-Node + VLANs
+
+Setup a multi-node cluster with dedicated VLANs for VMs & Management.
+
+`Read » <guides/multinode-lab.html>`__
+
+2 Guides
+
+What is this?
+^^^^^^^^^^^^^
+
+These guides tell you how to deploy a development environment on real
+hardware. Guides range from running OpenStack on a single laptop to
+running a multi-node deployment on datacenter hardware.
+
+Documentation Help yourself to stack
+------------------------------------
+
+Overview
+--------
+
+`An overview of DevStack goals and priorities <overview.html>`__
+
+Configuration
+-------------
+
+`Configuring and customizing the stack <configuration.html>`__
+
+Plugins
+-------
+
+`Extending DevStack with new features <plugins.html>`__
+
+Recent Changes
+--------------
+
+`An incomplete summary of recent changes <changes.html>`__
+
+FAQ
+---
+
+`The DevStack FAQ <faq.html>`__
+
+Contributing
+------------
+
+`Pitching in to make DevStack a better place <contributing.html>`__
+
+Code A look at the bits that make it all go
+-------------------------------------------
+
+Scripts Generated documentation of DevStack scripts.
+----------------------------------------------------
+
++-------------------------------+----------------------------------------------+
+| Filename                      | Link                                         |
++===============================+==============================================+
+| stack.sh                      | `Read » <stack.sh.html>`__                   |
++-------------------------------+----------------------------------------------+
+| functions                     | `Read » <functions.html>`__                  |
++-------------------------------+----------------------------------------------+
+| functions-common              | `Read » <functions-common.html>`__           |
++-------------------------------+----------------------------------------------+
+| lib/apache                    | `Read » <lib/apache.html>`__                 |
++-------------------------------+----------------------------------------------+
+| lib/baremetal                 | `Read » <lib/baremetal.html>`__              |
++-------------------------------+----------------------------------------------+
+| lib/ceilometer                | `Read » <lib/ceilometer.html>`__             |
++-------------------------------+----------------------------------------------+
+| lib/cinder                    | `Read » <lib/cinder.html>`__                 |
++-------------------------------+----------------------------------------------+
+| lib/config                    | `Read » <lib/config.html>`__                 |
++-------------------------------+----------------------------------------------+
+| lib/database                  | `Read » <lib/database.html>`__               |
++-------------------------------+----------------------------------------------+
+| lib/glance                    | `Read » <lib/glance.html>`__                 |
++-------------------------------+----------------------------------------------+
+| lib/heat                      | `Read » <lib/heat.html>`__                   |
++-------------------------------+----------------------------------------------+
+| lib/horizon                   | `Read » <lib/horizon.html>`__                |
++-------------------------------+----------------------------------------------+
+| lib/infra                     | `Read » <lib/infra.html>`__                  |
++-------------------------------+----------------------------------------------+
+| lib/ironic                    | `Read » <lib/ironic.html>`__                 |
++-------------------------------+----------------------------------------------+
+| lib/keystone                  | `Read » <lib/keystone.html>`__               |
++-------------------------------+----------------------------------------------+
+| lib/ldap                      | `Read » <lib/ldap.html>`__                   |
++-------------------------------+----------------------------------------------+
+| lib/zaqar                     | `Read » <lib/zaqar.html>`__                  |
++-------------------------------+----------------------------------------------+
+| lib/neutron                   | `Read » <lib/neutron.html>`__                |
++-------------------------------+----------------------------------------------+
+| lib/nova                      | `Read » <lib/nova.html>`__                   |
++-------------------------------+----------------------------------------------+
+| lib/oslo                      | `Read » <lib/oslo.html>`__                   |
++-------------------------------+----------------------------------------------+
+| lib/rpc\_backend              | `Read » <lib/rpc_backend.html>`__            |
++-------------------------------+----------------------------------------------+
+| lib/sahara                    | `Read » <lib/sahara.html>`__                 |
++-------------------------------+----------------------------------------------+
+| lib/savanna                   | `Read » <lib/savanna.html>`__                |
++-------------------------------+----------------------------------------------+
+| lib/stackforge                | `Read » <lib/stackforge.html>`__             |
++-------------------------------+----------------------------------------------+
+| lib/swift                     | `Read » <lib/swift.html>`__                  |
++-------------------------------+----------------------------------------------+
+| lib/tempest                   | `Read » <lib/tempest.html>`__                |
++-------------------------------+----------------------------------------------+
+| lib/tls                       | `Read » <lib/tls.html>`__                    |
++-------------------------------+----------------------------------------------+
+| lib/trove                     | `Read » <lib/trove.html>`__                  |
++-------------------------------+----------------------------------------------+
+| unstack.sh                    | `Read » <unstack.sh.html>`__                 |
++-------------------------------+----------------------------------------------+
+| clean.sh                      | `Read » <clean.sh.html>`__                   |
++-------------------------------+----------------------------------------------+
+| run\_tests.sh                 | `Read » <run_tests.sh.html>`__               |
++-------------------------------+----------------------------------------------+
+| extras.d/50-ironic.sh         | `Read » <extras.d/50-ironic.html>`__         |
++-------------------------------+----------------------------------------------+
+| extras.d/70-zaqar.sh          | `Read » <extras.d/70-zaqar.html>`__          |
++-------------------------------+----------------------------------------------+
+| extras.d/70-sahara.sh         | `Read » <extras.d/70-sahara.html>`__         |
++-------------------------------+----------------------------------------------+
+| extras.d/70-savanna.sh        | `Read » <extras.d/70-savanna.html>`__        |
++-------------------------------+----------------------------------------------+
+| extras.d/70-trove.sh          | `Read » <extras.d/70-trove.html>`__          |
++-------------------------------+----------------------------------------------+
+| extras.d/80-opendaylight.sh   | `Read » <extras.d/80-opendaylight.html>`__   |
++-------------------------------+----------------------------------------------+
+| extras.d/80-tempest.sh        | `Read » <extras.d/80-tempest.html>`__        |
++-------------------------------+----------------------------------------------+
+
+Configuration Setting the table
+-------------------------------
+
++--------------+--------------------------------+
+| Filename     | Link                           |
++==============+================================+
+| local.conf   | `Read » <local.conf.html>`__   |
++--------------+--------------------------------+
+| stackrc      | `Read » <stackrc.html>`__      |
++--------------+--------------------------------+
+| openrc       | `Read » <openrc.html>`__       |
++--------------+--------------------------------+
+| exerciserc   | `Read » <exerciserc.html>`__   |
++--------------+--------------------------------+
+| eucarc       | `Read » <eucarc.html>`__       |
++--------------+--------------------------------+
+
+Tools Support scripts
+---------------------
+
++-----------------------------+----------------------------------------------+
+| Filename                    | Link                                         |
++=============================+==============================================+
+| tools/info.sh               | `Read » <tools/info.sh.html>`__              |
++-----------------------------+----------------------------------------------+
+| tools/build\_docs.sh        | `Read » <tools/build_docs.sh.html>`__        |
++-----------------------------+----------------------------------------------+
+| tools/create\_userrc.sh     | `Read » <tools/create_userrc.sh.html>`__     |
++-----------------------------+----------------------------------------------+
+| tools/fixup\_stuff.sh       | `Read » <tools/fixup_stuff.sh.html>`__       |
++-----------------------------+----------------------------------------------+
+| tools/install\_prereqs.sh   | `Read » <tools/install_prereqs.sh.html>`__   |
++-----------------------------+----------------------------------------------+
+| tools/install\_pip.sh       | `Read » <tools/install_pip.sh.html>`__       |
++-----------------------------+----------------------------------------------+
+| tools/upload\_image.sh      | `Read » <tools/upload_image.sh.html>`__      |
++-----------------------------+----------------------------------------------+
+
+Samples Generated documentation of DevStack sample files.
+---------------------------------------------------------
+
++------------+--------------------------------------+
+| Filename   | Link                                 |
++============+======================================+
+| local.sh   | `Read » <samples/local.sh.html>`__   |
++------------+--------------------------------------+
+| localrc    | `Read » <samples/localrc.html>`__    |
++------------+--------------------------------------+
+
+Exercises Generated documentation of DevStack scripts.
+------------------------------------------------------
+
+Filename
+
+Link
+
+exercise.sh
+
+`Read » <exercise.sh.html>`__
+
+exercises/aggregates.sh
+
+`Read » <exercises/aggregates.sh.html>`__
+
+exercises/boot\_from\_volume.sh
+
+`Read » <exercises/boot_from_volume.sh.html>`__
+
+exercises/bundle.sh
+
+`Read » <exercises/bundle.sh.html>`__
+
+exercises/client-args.sh
+
+`Read » <exercises/client-args.sh.html>`__
+
+exercises/client-env.sh
+
+`Read » <exercises/client-env.sh.html>`__
+
+exercises/euca.sh
+
+`Read » <exercises/euca.sh.html>`__
+
+exercises/floating\_ips.sh
+
+`Read » <exercises/floating_ips.sh.html>`__
+
+exercises/horizon.sh
+
+`Read » <exercises/horizon.sh.html>`__
+
+exercises/neutron-adv-test.sh
+
+`Read » <exercises/neutron-adv-test.sh.html>`__
+
+exercises/sahara.sh
+
+`Read » <exercises/sahara.sh.html>`__
+
+exercises/savanna.sh
+
+`Read » <exercises/savanna.sh.html>`__
+
+exercises/sec\_groups.sh
+
+`Read » <exercises/sec_groups.sh.html>`__
+
+exercises/swift.sh
+
+`Read » <exercises/swift.sh.html>`__
+
+exercises/trove.sh
+
+`Read » <exercises/trove.sh.html>`__
+
+exercises/volumes.sh
+
+`Read » <exercises/volumes.sh.html>`__
+
+exercises/zaqar.sh
+
+`Read » <exercises/zaqar.sh.html>`__
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/local.conf.html b/doc/source/local.conf.html
deleted file mode 100644
index 2635ac6694..0000000000
--- a/doc/source/local.conf.html
+++ /dev/null
@@ -1,64 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - local.conf</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section class="span12">
-        <div class="page-header">
-          <h2>local.conf <small>User settings</small></h2>
-          <p><code>local.conf</code> is a user-maintained setings file that is
-          sourced in <code>stackrc</code>.  It contains a section that replaces
-          the historical <code>localrc</code> file.  See
-          <a href="configuration.html">the description of local.conf</a> for
-          more details about the mechanics of the file.</p>
-        </div>
-      </section
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
new file mode 100644
index 0000000000..40d0e0f57a
--- /dev/null
+++ b/doc/source/local.conf.rst
@@ -0,0 +1,20 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+local.conf User settings
+------------------------
+
+``local.conf`` is a user-maintained setings file that is sourced in
+``stackrc``. It contains a section that replaces the historical
+``localrc`` file. See `the description of
+local.conf <configuration.html>`__ for more details about the mechanics
+of the file.
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/localrc.html b/doc/source/localrc.html
deleted file mode 100644
index 40a20043a2..0000000000
--- a/doc/source/localrc.html
+++ /dev/null
@@ -1,60 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - localrc</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section class="span12">
-        <div class="page-header">
-          <h2>localrc <small>User settings</small></h2>
-          <p><code>localrc</code> is the old file used to configure DevStack.  It is deprecated and has been replaced by <a href="local.conf.html"><code>local.conf</code></a>.  DevStack will continue to use <code>localrc</code> if it is present and ignore the <code>localrc</code> section in <code>local.conf.</code>.   Remove <code>localrc</code> to switch to using the new file.</p>
-        </div>
-      </section
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/localrc.rst b/doc/source/localrc.rst
new file mode 100644
index 0000000000..910e274209
--- /dev/null
+++ b/doc/source/localrc.rst
@@ -0,0 +1,20 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+localrc User settings
+---------------------
+
+``localrc`` is the old file used to configure DevStack. It is deprecated
+and has been replaced by ```local.conf`` <local.conf.html>`__. DevStack
+will continue to use ``localrc`` if it is present and ignore the
+``localrc`` section in ``local.conf.``. Remove ``localrc`` to switch to
+using the new file.
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/openrc.html b/doc/source/openrc.html
deleted file mode 100644
index 94b253dfe1..0000000000
--- a/doc/source/openrc.html
+++ /dev/null
@@ -1,115 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - openrc</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section class="span12">
-        <div class="page-header">
-          <h2>openrc <small>User authentication settings</small></h2>
-          <p><code>openrc</code> configures login credentials suitable for use
-          with the OpenStack command-line tools.  <code>openrc</code> sources
-          <code>stackrc</code> at the beginning (which in turn sources
-          the <code>localrc</code> setion of <code>local.conf</code>) in
-          order to pick up <code>HOST_IP</code>
-          and/or <code>SERVICE_HOST</code> to use in the endpoints.
-          The values shown below are the default values.</p>
-        </div>
-        <dl>
-
-          <dt>OS_TENANT_NAME</dt>
-          <dd>The introduction of Keystone to the OpenStack ecosystem has standardized the
-            term <em>tenant</em> as the entity that owns resources.  In some places references
-            still exist to the original Nova term <em>project</em> for this use.  Also,
-            <em>tenant_name</em> is preferred to <em>tenant_id</em>.
-            <pre>OS_TENANT_NAME=demo</pre></dd>
-
-          <dt>OS_USERNAME</dt>
-          <dd>In addition to the owning entity (tenant), Nova stores the entity performing
-            the action as the <em>user</em>.
-            <pre>OS_USERNAME=demo</pre></dd>
-
-          <dt>OS_PASSWORD</dt>
-          <dd>With Keystone you pass the keystone password instead of an api key.
-            Recent versions of novaclient use OS_PASSWORD instead of NOVA_API_KEYs
-            or NOVA_PASSWORD.
-            <pre>OS_PASSWORD=secrete</pre></dd>
-
-          <dt>HOST_IP, SERVICE_HOST</dt>
-          <dd>Set API endpoint host using <code>HOST_IP</code>.  <code>SERVICE_HOST</code>
-            may also be used to specify the endpoint, which is convenient for
-            some <code>localrc</code> configurations.  Typically, <code>HOST_IP</code>
-            is set in the <code>localrc</code> section.
-            <pre>HOST_IP=127.0.0.1
-SERVICE_HOST=$HOST_IP</pre></dd>
-
-          <dt>OS_AUTH_URL</dt>
-          <dd>Authenticating against an OpenStack cloud using Keystone returns a <em>Token</em>
-            and <em>Service Catalog</em>.  The catalog contains the endpoints for all services
-            the user/tenant has access to - including Nova, Glance, Keystone and Swift.
-            <pre>OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0</pre></dd>
-
-          <dt>GLANCE_HOST</dt>
-          <dd>Some exercises call Glance directly.  On a single-node installation, Glance
-            should be listening on <code>HOST_IP</code>.  If its running elsewhere
-            it can be set here.
-            <pre>GLANCE_HOST=$HOST_IP</pre></dd>
-
-          <dt>KEYSTONECLIENT_DEBUG, NOVACLIENT_DEBUG</dt>
-          <dd>Set command-line client log level to <code>DEBUG</code>.  These are
-            commented out by default.
-            <pre># export KEYSTONECLIENT_DEBUG=1
-# export NOVACLIENT_DEBUG=1</pre></dd>
-
-        </dl>
-      </section
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; An
-        <a href="https://wiki.openstack.org/wiki/Programs">OpenStack program</a>
-        created by <a href="http://www.rackspace.com/cloud/private_edition/">Rackspace Cloud Builders</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
new file mode 100644
index 0000000000..b8759ecb49
--- /dev/null
+++ b/doc/source/openrc.rst
@@ -0,0 +1,88 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+openrc User authentication settings
+-----------------------------------
+
+``openrc`` configures login credentials suitable for use with the
+OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
+beginning (which in turn sources the ``localrc`` setion of
+``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
+to use in the endpoints. The values shown below are the default values.
+
+OS\_TENANT\_NAME
+    The introduction of Keystone to the OpenStack ecosystem has
+    standardized the term *tenant* as the entity that owns resources. In
+    some places references still exist to the original Nova term
+    *project* for this use. Also, *tenant\_name* is preferred to
+    *tenant\_id*.
+
+    ::
+
+        OS_TENANT_NAME=demo
+
+OS\_USERNAME
+    In addition to the owning entity (tenant), Nova stores the entity
+    performing the action as the *user*.
+
+    ::
+
+        OS_USERNAME=demo
+
+OS\_PASSWORD
+    With Keystone you pass the keystone password instead of an api key.
+    Recent versions of novaclient use OS\_PASSWORD instead of
+    NOVA\_API\_KEYs or NOVA\_PASSWORD.
+
+    ::
+
+        OS_PASSWORD=secrete
+
+HOST\_IP, SERVICE\_HOST
+    Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
+    be used to specify the endpoint, which is convenient for some
+    ``localrc`` configurations. Typically, ``HOST_IP`` is set in the
+    ``localrc`` section.
+
+    ::
+
+        HOST_IP=127.0.0.1
+        SERVICE_HOST=$HOST_IP
+
+OS\_AUTH\_URL
+    Authenticating against an OpenStack cloud using Keystone returns a
+    *Token* and *Service Catalog*. The catalog contains the endpoints
+    for all services the user/tenant has access to - including Nova,
+    Glance, Keystone and Swift.
+
+    ::
+
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
+
+GLANCE\_HOST
+    Some exercises call Glance directly. On a single-node installation,
+    Glance should be listening on ``HOST_IP``. If its running elsewhere
+    it can be set here.
+
+    ::
+
+        GLANCE_HOST=$HOST_IP
+
+KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
+    Set command-line client log level to ``DEBUG``. These are commented
+    out by default.
+
+    ::
+
+        # export KEYSTONECLIENT_DEBUG=1
+        # export NOVACLIENT_DEBUG=1
+
+© Openstack Foundation 2011-2013 — An `OpenStack
+program <https://wiki.openstack.org/wiki/Programs>`__ created by
+`Rackspace Cloud
+Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/overview.html b/doc/source/overview.html
deleted file mode 100644
index 9cee052129..0000000000
--- a/doc/source/overview.html
+++ /dev/null
@@ -1,118 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Overview</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-      
-      <section id="overview" class="span12">
-
-        <div class='row pull-left'>
-          <h2>Overview <small>DevStack from a cloud-height view</small></h2>
-          <p>DevStack has evolved to support a large number of configuration options and alternative platforms and support services.  That evolution has grown well beyond what was originally intended and the majority of configuration combinations are rarely, if ever, tested.  DevStack is not a general OpenStack installer and was never meant to be everything to everyone..</p>
-          <p>Below is a list of what is specifically is supported (read that as "tested") going forward.</p>
-
-          <h2>Supported Components</h2>
-
-          <h3>Base OS</h3>
-          <p><em>The OpenStack Technical Committee (TC) has defined the current CI strategy to include the latest Ubuntu release and the latest RHEL release (for Python 2.6 testing).</em></p>
-          <ul>
-            <li>Ubuntu: current LTS release plus current development release</li>
-            <li>Fedora: current release plus previous release</li>
-            <li>RHEL: current major release</li>
-            <li>Other OS platforms may continue to be included but the maintenance of those platforms shall not be assumed simply due to their presence.  Having a listed point-of-contact for each additional OS will greatly increase its chance of being well-maintained.</li>
-            <li>Patches for Ubuntu and/or Fedora will not be held up due to side-effects on other OS platforms.</li>
-          </ul>
-
-          <h3>Databases</h3>
-          <p><em>As packaged by the host OS</em></p>
-          <ul>
-            <li>MySQL</li>
-            <li>PostgreSQL</li>
-          </ul>
-
-          <h3>Queues</h3>
-          <p><em>As packaged by the host OS</em></p>
-          <ul>
-            <li>Rabbit</li>
-            <li>Qpid</li>
-<!--
-            <li>ZeroMQ</li>
--->
-          </ul>
-
-          <h3>Web Server</h3>
-          <p><em>As packaged by the host OS</em></p>
-          <ul>
-            <li>Apache</li>
-          </ul>
-
-          <h3>OpenStack Network</h3>
-          <p><em>Default to Nova Network, optionally use Neutron</em></p>
-          <ul>
-            <li>Nova Network: FlatDHCP</li>
-            <li>Neutron: A basic configuration approximating the original FlatDHCP mode using linuxbridge or OpenVSwitch.</li>
-          </ul>
-
-          <h3>Services</h3>
-          <p>The default services configured by DevStack are Identity (Keystone), Object Storage (Swift), Image Storage (Glance), Block Storage (Cinder), Compute (Nova), Network (Nova), Dashboard (Horizon), Orchestration (Heat)</p>
-          <p>Additional services not included directly in DevStack can be tied in to <code>stack.sh</code> using the <a href="plugins.html">plugin mechanism</a> to call scripts that perform the configuration and startup of the service.</p>
-
-          <h3>Node Configurations</h3>
-          <ul>
-            <li>single node</li>
-            <li>multi-node is not tested regularly by the core team, and even then only minimal configurations are reviewed</li>
-          </ul>
-
-          <h3>Exercises</h3>
-          <p>The DevStack exercise scripts are no longer used as integration and gate testing as that job has transitioned to Tempest.  They are still maintained as a demonstrations of using OpenStack from the command line and for quick operational testing.</p>
-
-        </div>        
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
new file mode 100644
index 0000000000..953938baaf
--- /dev/null
+++ b/doc/source/overview.rst
@@ -0,0 +1,103 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Overview DevStack from a cloud-height view
+------------------------------------------
+
+DevStack has evolved to support a large number of configuration options
+and alternative platforms and support services. That evolution has grown
+well beyond what was originally intended and the majority of
+configuration combinations are rarely, if ever, tested. DevStack is not
+a general OpenStack installer and was never meant to be everything to
+everyone..
+
+Below is a list of what is specifically is supported (read that as
+"tested") going forward.
+
+Supported Components
+--------------------
+
+Base OS
+~~~~~~~
+
+*The OpenStack Technical Committee (TC) has defined the current CI
+strategy to include the latest Ubuntu release and the latest RHEL
+release (for Python 2.6 testing).*
+
+-  Ubuntu: current LTS release plus current development release
+-  Fedora: current release plus previous release
+-  RHEL: current major release
+-  Other OS platforms may continue to be included but the maintenance of
+   those platforms shall not be assumed simply due to their presence.
+   Having a listed point-of-contact for each additional OS will greatly
+   increase its chance of being well-maintained.
+-  Patches for Ubuntu and/or Fedora will not be held up due to
+   side-effects on other OS platforms.
+
+Databases
+~~~~~~~~~
+
+*As packaged by the host OS*
+
+-  MySQL
+-  PostgreSQL
+
+Queues
+~~~~~~
+
+*As packaged by the host OS*
+
+-  Rabbit
+-  Qpid
+
+Web Server
+~~~~~~~~~~
+
+*As packaged by the host OS*
+
+-  Apache
+
+OpenStack Network
+~~~~~~~~~~~~~~~~~
+
+*Default to Nova Network, optionally use Neutron*
+
+-  Nova Network: FlatDHCP
+-  Neutron: A basic configuration approximating the original FlatDHCP
+   mode using linuxbridge or OpenVSwitch.
+
+Services
+~~~~~~~~
+
+The default services configured by DevStack are Identity (Keystone),
+Object Storage (Swift), Image Storage (Glance), Block Storage (Cinder),
+Compute (Nova), Network (Nova), Dashboard (Horizon), Orchestration
+(Heat)
+
+Additional services not included directly in DevStack can be tied in to
+``stack.sh`` using the `plugin mechanism <plugins.html>`__ to call
+scripts that perform the configuration and startup of the service.
+
+Node Configurations
+~~~~~~~~~~~~~~~~~~~
+
+-  single node
+-  multi-node is not tested regularly by the core team, and even then
+   only minimal configurations are reviewed
+
+Exercises
+~~~~~~~~~
+
+The DevStack exercise scripts are no longer used as integration and gate
+testing as that job has transitioned to Tempest. They are still
+maintained as a demonstrations of using OpenStack from the command line
+and for quick operational testing.
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/plugins.html b/doc/source/plugins.html
deleted file mode 100644
index 700a209ac9..0000000000
--- a/doc/source/plugins.html
+++ /dev/null
@@ -1,142 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - Plugins</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container" id="home">
-      
-      <section id="faq" class="span12">
-
-        <div class='row pull-left'>
-          <h2>Plugins <small>Add stuff</small></h2>
-          <p>DevStack has a couple of plugin mechanisms to allow easily adding support for additional projects and features.</p>
-
-          <h3>Extras.d Hooks</h3>
-          <p>These relatively new hooks are an extension of the existing calls from <code>stack.sh</code> at the end of its run, plus <code>unstack.sh</code> and <code>clean.sh</code>.  A number of the higher-layer projects are implemented in DevStack using this mechanism.</p>
-
-          <p>The script in <code>extras.d</code> is expected to be mostly a dispatcher to functions in a <code>lib/*</code> script.  The scripts are named with a zero-padded two digits sequence number prefix to control the order that the scripts are called, and with a suffix of <code>.sh</code>.  DevSack reserves for itself the sequence numbers 00 through 09 and 90 through 99.</p>
-
-          <p>Below is a template that shows handlers for the possible command-line arguments:</p>
-
-<pre>
-# template.sh - DevStack extras.d dispatch script template
-
-# check for service enabled
-if is_service_enabled template; then
-
-    if [[ "$1" == "source" ]]; then
-        # Initial source of lib script
-        source $TOP_DIR/lib/template
-    fi
-
-    if [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
-        # Set up system services
-        echo_summary "Configuring system services Template"
-        install_package cowsay
-
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        # Perform installation of service source
-        echo_summary "Installing Template"
-        install_template
-
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        # Configure after the other layer 1 and 2 services have been configured
-        echo_summary "Configuring Template"
-        configure_template
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        # Initialize and start the template service
-        echo_summary "Initializing Template"
-        ##init_template
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        # Shut down template services
-        # no-op
-        :
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        # Remove state and transient data
-        # Remember clean.sh first calls unstack.sh
-        # no-op
-        :
-    fi
-fi
-</pre>
-
-          <p>The arguments are:
-          <ul>
-            <li><strong>source</strong> - Called by each script that utilizes <code>extras.d</code> hooks; this replaces directly sourcing the <code>lib/*</code> script.</li>
-            <li><strong>stack</strong> - Called by <code>stack.sh</code> three times for different phases of its run:
-              <ul>
-                <li><strong>pre-install</strong> - Called after system (OS) setup is complete and before project source is installed.</li>
-                <li><strong>install</strong> - Called after the layer 1 and 2 projects source and their dependencies have been installed.</li>
-                <li><strong>post-config</strong> - Called after the layer 1 and 2 services have been configured.  All configuration files for enabled services should exist at this point.</li>
-                <li><strong>extra</strong> - Called near the end after layer 1 and 2 services have been started.  This is the existing hook and has not otherwise changed.</li>
-              </ul></li>
-            <li><strong>unstack</strong> - Called by <code>unstack.sh</code> before other services are shut down.</li>
-            <li><strong>clean</strong> - Called by <code>clean.sh</code> before other services are cleaned, but after <code>unstack.sh</code> has been called.
-          </ul></p>
-
-
-          <h3>Hypervisor</h3>
-          <p>Hypervisor plugins are fairly new and condense most hypervisor configuration into one place.</p>
-
-          <p>The initial plugin implemented was for Docker support and is a useful template for the required support.  Plugins are placed in <code>lib/nova_plugins</code> and named <code>hypervisor-&lt;name&gt;</code> where <code>&lt;name&gt;</code> is the value of <code>VIRT_DRIVER</code>.  Plugins must define the following functions:</p>
-            <ul>
-              <li><code>install_nova_hypervisor</code> - install any external requirements</li>
-              <li><code>configure_nova_hypervisor</code> - make configuration changes, including those to other services</li>
-              <li><code>start_nova_hypervisor</code> - start any external services</li>
-              <li><code>stop_nova_hypervisor</code> - stop any external services</li>
-              <li><code>cleanup_nova_hypervisor</code> - remove transient data and cache</li>
-            </ul>
-        </div>        
-
-      </section>
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2013 &mdash; An <a href="https://wiki.openstack.org/wiki/Programs">OpenStack program</a> created by <a href="http://www.rackspace.com/cloud/private_edition/">Rackspace Cloud Builders</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-  </body>
-</html>
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
new file mode 100644
index 0000000000..db695d3e84
--- /dev/null
+++ b/doc/source/plugins.rst
@@ -0,0 +1,124 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+Plugins Add stuff
+-----------------
+
+DevStack has a couple of plugin mechanisms to allow easily adding
+support for additional projects and features.
+
+Extras.d Hooks
+~~~~~~~~~~~~~~
+
+These relatively new hooks are an extension of the existing calls from
+``stack.sh`` at the end of its run, plus ``unstack.sh`` and
+``clean.sh``. A number of the higher-layer projects are implemented in
+DevStack using this mechanism.
+
+The script in ``extras.d`` is expected to be mostly a dispatcher to
+functions in a ``lib/*`` script. The scripts are named with a
+zero-padded two digits sequence number prefix to control the order that
+the scripts are called, and with a suffix of ``.sh``. DevSack reserves
+for itself the sequence numbers 00 through 09 and 90 through 99.
+
+Below is a template that shows handlers for the possible command-line
+arguments:
+
+::
+
+    # template.sh - DevStack extras.d dispatch script template
+
+    # check for service enabled
+    if is_service_enabled template; then
+
+        if [[ "$1" == "source" ]]; then
+            # Initial source of lib script
+            source $TOP_DIR/lib/template
+        fi
+
+        if [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
+            # Set up system services
+            echo_summary "Configuring system services Template"
+            install_package cowsay
+
+        elif [[ "$1" == "stack" && "$2" == "install" ]]; then
+            # Perform installation of service source
+            echo_summary "Installing Template"
+            install_template
+
+        elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
+            # Configure after the other layer 1 and 2 services have been configured
+            echo_summary "Configuring Template"
+            configure_template
+
+        elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
+            # Initialize and start the template service
+            echo_summary "Initializing Template"
+            ##init_template
+        fi
+
+        if [[ "$1" == "unstack" ]]; then
+            # Shut down template services
+            # no-op
+            :
+        fi
+
+        if [[ "$1" == "clean" ]]; then
+            # Remove state and transient data
+            # Remember clean.sh first calls unstack.sh
+            # no-op
+            :
+        fi
+    fi
+
+The arguments are:
+
+-  **source** - Called by each script that utilizes ``extras.d`` hooks;
+   this replaces directly sourcing the ``lib/*`` script.
+-  **stack** - Called by ``stack.sh`` three times for different phases
+   of its run:
+
+   -  **pre-install** - Called after system (OS) setup is complete and
+      before project source is installed.
+   -  **install** - Called after the layer 1 and 2 projects source and
+      their dependencies have been installed.
+   -  **post-config** - Called after the layer 1 and 2 services have
+      been configured. All configuration files for enabled services
+      should exist at this point.
+   -  **extra** - Called near the end after layer 1 and 2 services have
+      been started. This is the existing hook and has not otherwise
+      changed.
+
+-  **unstack** - Called by ``unstack.sh`` before other services are shut
+   down.
+-  **clean** - Called by ``clean.sh`` before other services are cleaned,
+   but after ``unstack.sh`` has been called.
+
+Hypervisor
+~~~~~~~~~~
+
+Hypervisor plugins are fairly new and condense most hypervisor
+configuration into one place.
+
+The initial plugin implemented was for Docker support and is a useful
+template for the required support. Plugins are placed in
+``lib/nova_plugins`` and named ``hypervisor-<name>`` where ``<name>`` is
+the value of ``VIRT_DRIVER``. Plugins must define the following
+functions:
+
+-  ``install_nova_hypervisor`` - install any external requirements
+-  ``configure_nova_hypervisor`` - make configuration changes, including
+   those to other services
+-  ``start_nova_hypervisor`` - start any external services
+-  ``stop_nova_hypervisor`` - stop any external services
+-  ``cleanup_nova_hypervisor`` - remove transient data and cache
+
+© Openstack Foundation 2011-2013 — An `OpenStack
+program <https://wiki.openstack.org/wiki/Programs>`__ created by
+`Rackspace Cloud
+Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/stackrc.html b/doc/source/stackrc.html
deleted file mode 100644
index 2df9d385f7..0000000000
--- a/doc/source/stackrc.html
+++ /dev/null
@@ -1,101 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <title>DevStack - stackrc</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
-    <!--[if lt IE 9]>
-      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- Le styles -->
-    <link href="assets/css/bootstrap.css" rel="stylesheet">
-    <link href="assets/css/local.css" rel="stylesheet">
-    <style type="text/css">
-      body { padding-top: 60px; }
-      dd { padding: 10px; }
-    </style>
-    
-    <!-- Le javascripts -->
-    <script src="../assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
-    <script src="../assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
-  </head>
-
-  <body>
-
-    <div class="navbar navbar-fixed-top">
-      <div class="navbar-inner">
-        <div class="container">
-          <a class="brand" href="/">DevStack</a>
-          <ul class="nav pull-right">
-            <li><a href="overview.html">Overview</a></li>
-            <li><a href="changes.html">Changes</a></li>
-            <li><a href="faq.html">FAQ</a></li>
-            <li><a href="https://git.openstack.org/cgit/openstack-dev/devstack">git.openstack.org</a></li>
-            <li><a href="https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z">Gerrit</a></li>
-          </ul>
-        </div>
-      </div>
-    </div>
-
-    <div class="container">
-
-      <section class="span12">
-        <div class="page-header">
-          <h2>stackrc <small>DevStack settings</small></h2>
-          <p><code>stackrc</code> is the primary configuration file for DevStack.
-          It contains all of the settings that control the services started
-          and the repositories used to download the source for those services.
-          <code>stackrc</code> sources the <code>localrc</code> section of
-          <code>local.conf</code> to perform the default overrides.</p>
-        </div>
-        <dl>
-
-          <dt>DATABASE_TYPE</dt>
-          <dd>Select the database backend to use.  The default is <code>mysql</code>,
-          <code>postgresql</code> is also available.</dd>
-
-          <dt>ENABLED_SERVICES</dt>
-          <dd>Specify which services to launch.  These generally correspond to
-            screen tabs. 
-            The default includes: Glance (API and Registry), Keystone, Nova (API,
-            Certificate, Object Store, Compute, Network, Scheduler, VNC proxies,
-            Certificate Authentication), Cinder (Scheduler, API, Volume), Horizon, MySQL, RabbitMQ, Tempest.
-            <pre>ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,cinder,c-sch,c-api,c-vol,n-sch,n-novnc,n-xvnc,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE</pre>
-            Other services that are not enabled by default can be enabled in
-            <code>localrc</code>. For example, to add Swift, use the following service names:
-            <pre>enable_service s-proxy s-object s-container s-account</pre>
-            A service can similarly be disabled:
-            <pre>disable_service horizon</pre></dd>
-
-          <dt>Service Repos</dt>
-          <dd>The Git repositories used to check out the source for each service
-            are controlled by a pair of variables set for each service.  
-            <code>*_REPO</code> points to the repository and <code>*_BRANCH</code>
-            selects which branch to check out.  These may be overridden in
-            <code>local.conf</code> to pull source from a different repo for testing,
-            such as a Gerrit branch proposal.  <code>GIT_BASE</code> points to the primary repository server.
-            <pre>NOVA_REPO=$GIT_BASE/openstack/nova.git
-NOVA_BRANCH=master</pre>
-            To pull a branch directly from Gerrit, get the repo and branch from the 
-            Gerrit review page:
-            <pre>git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD</pre>
-            The repo is the stanza following <code>fetch</code> and the branch
-            is the stanza following that:
-            <pre>NOVA_REPO=https://review.openstack.org/p/openstack/nova
-NOVA_BRANCH=refs/changes/50/5050/1</pre></dd>
-
-        </dl>
-      </section
-
-      <footer>
-        <p>&copy; Openstack Foundation 2011-2014 &mdash; An <a href="https://www.openstack.org/">OpenStack</a> <a href="https://wiki.openstack.org/wiki/Programs">program</a></p>
-      </footer>
-
-    </div> <!-- /container -->
-
-  </body>
-</html>
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
new file mode 100644
index 0000000000..b2766cb971
--- /dev/null
+++ b/doc/source/stackrc.rst
@@ -0,0 +1,77 @@
+`DevStack </>`__
+
+-  `Overview <overview.html>`__
+-  `Changes <changes.html>`__
+-  `FAQ <faq.html>`__
+-  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
+-  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+
+stackrc DevStack settings
+-------------------------
+
+``stackrc`` is the primary configuration file for DevStack. It contains
+all of the settings that control the services started and the
+repositories used to download the source for those services. ``stackrc``
+sources the ``localrc`` section of ``local.conf`` to perform the default
+overrides.
+
+DATABASE\_TYPE
+    Select the database backend to use. The default is ``mysql``,
+    ``postgresql`` is also available.
+ENABLED\_SERVICES
+    Specify which services to launch. These generally correspond to
+    screen tabs. The default includes: Glance (API and Registry),
+    Keystone, Nova (API, Certificate, Object Store, Compute, Network,
+    Scheduler, VNC proxies, Certificate Authentication), Cinder
+    (Scheduler, API, Volume), Horizon, MySQL, RabbitMQ, Tempest.
+
+    ::
+
+        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,cinder,c-sch,c-api,c-vol,n-sch,n-novnc,n-xvnc,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
+
+    Other services that are not enabled by default can be enabled in
+    ``localrc``. For example, to add Swift, use the following service
+    names:
+
+    ::
+
+        enable_service s-proxy s-object s-container s-account
+
+    A service can similarly be disabled:
+
+    ::
+
+        disable_service horizon
+
+Service Repos
+    The Git repositories used to check out the source for each service
+    are controlled by a pair of variables set for each service.
+    ``*_REPO`` points to the repository and ``*_BRANCH`` selects which
+    branch to check out. These may be overridden in ``local.conf`` to
+    pull source from a different repo for testing, such as a Gerrit
+    branch proposal. ``GIT_BASE`` points to the primary repository
+    server.
+
+    ::
+
+        NOVA_REPO=$GIT_BASE/openstack/nova.git
+        NOVA_BRANCH=master
+
+    To pull a branch directly from Gerrit, get the repo and branch from
+    the Gerrit review page:
+
+    ::
+
+        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
+
+    The repo is the stanza following ``fetch`` and the branch is the
+    stanza following that:
+
+    ::
+
+        NOVA_REPO=https://review.openstack.org/p/openstack/nova
+        NOVA_BRANCH=refs/changes/50/5050/1
+
+© Openstack Foundation 2011-2014 — An
+`OpenStack <https://www.openstack.org/>`__
+`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 0000000000..58871344aa
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,23 @@
+[metadata]
+name = DevStack
+summary = OpenStack DevStack
+description-file =
+    README.md
+author = OpenStack
+author-email = openstack-dev@lists.openstack.org
+home-page = http://devstack.org
+classifier =
+    Intended Audience :: Developers
+    License :: OSI Approved :: Apache Software License
+    Operating System :: POSIX :: Linux
+
+[build_sphinx]
+all_files = 1
+build-dir = doc/build
+source-dir = doc/source
+
+[pbr]
+warnerrors = True
+
+[wheel]
+universal = 1
diff --git a/setup.py b/setup.py
new file mode 100755
index 0000000000..70c2b3f32b
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+# Copyright (c) 2013 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# THIS FILE IS MANAGED BY THE GLOBAL REQUIREMENTS REPO - DO NOT EDIT
+import setuptools
+
+setuptools.setup(
+    setup_requires=['pbr'],
+    pbr=True)
diff --git a/tox.ini b/tox.ini
index 3677631c5e..b6f2d9655e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -16,8 +16,13 @@ commands = bash -c "find {toxinidir} -not -wholename \*.tox/\* -and \( -name \*.
 deps =
    Pygments
    docutils
+   sphinx>=1.1.2,<1.2
+   pbr>=0.6,!=0.7,<1.0
+   oslosphinx
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
   INSTALL_SHOCCO=true
-commands = bash tools/build_docs.sh
+commands = 
+	bash tools/build_docs.sh
+	python setup.py build_sphinx

From ab50c702a770fa9d7fd0ff533566fc7a1775dde5 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Wed, 22 Oct 2014 13:21:22 -0700
Subject: [PATCH 0031/3333] Use service tenant id for Ironic agent swift auth

Config of ironic conductor currently references a non-existent variable.
This corrects it by obtaining and using the correct tenant id.

Change-Id: I4340f75b2b22a8fd3fd8dd5cb30d7e91bce4f654
---
 lib/ironic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 1541dcfb33..0a84e47ebc 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -281,7 +281,8 @@ function configure_ironic_conductor {
         fi
         iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:8080
         iniset $IRONIC_CONF_FILE glance swift_api_version v1
-        iniset $IRONIC_CONF_FILE glance swift_account AUTH_${SERVICE_TENANT}
+        local tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME)
+        iniset $IRONIC_CONF_FILE glance swift_account AUTH_${tenant_id}
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
         iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30

From 1c0628f83ce2dbf27dc0c916a53d915b20233890 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Wed, 22 Oct 2014 16:22:47 -0700
Subject: [PATCH 0032/3333] Fix an issue with setting tempest volume
 vendor_name with spaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the volume vendor has spaces in it, for example “Open Source”, we
need to have quotes around the uses of the variables or the behavior
will not be as expected.

Change-Id: Ie1e99b6d6de2313e5b5b5a5d3057c136c9b34601
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 3c37918018..350d08c331 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -372,7 +372,7 @@ function configure_tempest {
     fi
 
     if [ $TEMPEST_VOLUME_DRIVER != "default" -o \
-        $TEMPEST_VOLUME_VENDOR != $TEMPEST_DEFAULT_VOLUME_VENDOR ]; then
+        "$TEMPEST_VOLUME_VENDOR" != "$TEMPEST_DEFAULT_VOLUME_VENDOR" ]; then
         iniset $TEMPEST_CONFIG volume vendor_name "$TEMPEST_VOLUME_VENDOR"
     fi
     if [ $TEMPEST_VOLUME_DRIVER != "default" -o \

From cac1317676dcb0efa489dd667793cf4f6b366170 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Thu, 23 Oct 2014 10:52:40 -0700
Subject: [PATCH 0033/3333] Move to download.fedoraproject.org

download.fedoraproject.org is the mirror system, while
dl.fedoraproject.org is just one system. We have seen performance issues
with dl.fedoraproject.org and using download.fedoraproject.org was a
recommended as a solution by the folks at #fedora-admin.

Local testing on a rackspace server with dl.fedoraproject.org got about
70K/s while download.fedoraproject.org got over 1M/s

Move over to https as well.

Related-Bug: #1383928
Change-Id: I318d8844cfcfbc42c1e552e443c6b793d20f321f
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 389952508d..6cec8e85fb 100644
--- a/stackrc
+++ b/stackrc
@@ -514,7 +514,7 @@ esac
 if [[ "$ENABLED_SERVICES" =~ 'h-api' ]]; then
     case "$VIRT_DRIVER" in
         libvirt|baremetal|ironic)
-            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"http://dl.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"}
+            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"}
             IMAGE_URLS+=",$HEAT_CFN_IMAGE_URL"
             ;;
         *)
@@ -539,7 +539,7 @@ fi
 PRECACHE_IMAGES=$(trueorfalse False $PRECACHE_IMAGES)
 if [[ "$PRECACHE_IMAGES" == "True" ]]; then
     # staging in update for nodepool
-    IMAGE_URL="http://dl.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"
+    IMAGE_URL="https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"
     if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
         IMAGE_URLS+=",$IMAGE_URL"
     fi

From 51f0de5c5d5aa779db0ed647804d7d9488a9122b Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Mon, 20 Oct 2014 16:32:34 +0200
Subject: [PATCH 0034/3333] Allow depth limiting git clones

Depending on how you are using devstack you probably don't need the
entire history of a project so we should allow people to specify a clone
depth to speed up the devstack process.

Change-Id: I804a5abcc80f6a81e915c0bb4dceae72486441a7
Blueprint: git-depth
---
 functions-common | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index e6f425f4a1..bf25c25052 100644
--- a/functions-common
+++ b/functions-common
@@ -19,6 +19,7 @@
 #
 # The following variables are assumed to be defined by certain functions:
 #
+# - ``GIT_DEPTH``
 # - ``ENABLED_SERVICES``
 # - ``ERROR_ON_CLONE``
 # - ``FILES``
@@ -562,16 +563,22 @@ function get_release_name_from_branch {
 # Set global ``RECLONE=yes`` to simulate a clone when dest-dir exists
 # Set global ``ERROR_ON_CLONE=True`` to abort execution with an error if the git repo
 # does not exist (default is False, meaning the repo will be cloned).
-# Uses globals ``ERROR_ON_CLONE``, ``OFFLINE``, ``RECLONE``
+# Set global ``GIT_DEPTH=<number>`` to limit the history depth of the git clone
+# Uses globals ``ERROR_ON_CLONE``, ``OFFLINE``, ``RECLONE``, ``GIT_DEPTH``
 # git_clone remote dest-dir branch
 function git_clone {
     local git_remote=$1
     local git_dest=$2
     local git_ref=$3
     local orig_dir=$(pwd)
+    local git_clone_flags=""
 
     RECLONE=$(trueorfalse False $RECLONE)
 
+    if [[ "$GIT_DEPTH" ]]; then
+        git_clone_flags="$git_clone_flags --depth $GIT_DEPTH"
+    fi
+
     if [[ "$OFFLINE" = "True" ]]; then
         echo "Running in offline mode, clones already exist"
         # print out the results so we know what change was used in the logs
@@ -586,7 +593,7 @@ function git_clone {
         if [[ ! -d $git_dest ]]; then
             [[ "$ERROR_ON_CLONE" = "True" ]] && \
                 die $LINENO "Cloning not allowed in this configuration"
-            git_timed clone $git_remote $git_dest
+            git_timed clone $git_clone_flags $git_remote $git_dest
         fi
         cd $git_dest
         git_timed fetch $git_remote $git_ref && git checkout FETCH_HEAD
@@ -595,7 +602,7 @@ function git_clone {
         if [[ ! -d $git_dest ]]; then
             [[ "$ERROR_ON_CLONE" = "True" ]] && \
                 die $LINENO "Cloning not allowed in this configuration"
-            git_timed clone $git_remote $git_dest
+            git_timed clone $git_clone_flags $git_remote $git_dest
             cd $git_dest
             # This checkout syntax works for both branches and tags
             git checkout $git_ref

From 0f3bafc74edce5fbc091b3cacf27f916ebf04fc7 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean_collins2@cable.comcast.com>
Date: Fri, 24 Oct 2014 10:48:46 -0400
Subject: [PATCH 0035/3333] Remove copyright footer from RST docs

Change-Id: I2fe6aac7caec21af26983636d6ec827b3525ee15
---
 doc/source/changes.rst               | 4 ----
 doc/source/configuration.rst         | 4 ----
 doc/source/contributing.rst          | 5 -----
 doc/source/eucarc.rst                | 5 -----
 doc/source/exerciserc.rst            | 5 -----
 doc/source/faq.rst                   | 4 ----
 doc/source/guides/multinode-lab.rst  | 4 ----
 doc/source/guides/pxe-boot.rst       | 3 ---
 doc/source/guides/ramdisk.rst        | 3 ---
 doc/source/guides/single-machine.rst | 5 -----
 doc/source/guides/single-vm.rst      | 4 ----
 doc/source/guides/usb-boot.rst       | 3 ---
 doc/source/index.rst                 | 4 ----
 doc/source/local.conf.rst            | 4 ----
 doc/source/localrc.rst               | 4 ----
 doc/source/openrc.rst                | 5 -----
 doc/source/overview.rst              | 4 ----
 doc/source/plugins.rst               | 5 -----
 doc/source/stackrc.rst               | 4 ----
 19 files changed, 79 deletions(-)

diff --git a/doc/source/changes.rst b/doc/source/changes.rst
index 7ce629faa9..ccd96e8a7e 100644
--- a/doc/source/changes.rst
+++ b/doc/source/changes.rst
@@ -12,7 +12,3 @@ Recent Changes What's been happening?
 These are the commits to DevStack for the last six months. For the
 complete list see `the DevStack project in
 Gerrit <https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack,n,z>`__.
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 694ad62844..9befc908ea 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -354,7 +354,3 @@ Examples
        RABBIT_PASSWORD=$ADMIN_PASSWORD
        SERVICE_PASSWORD=$ADMIN_PASSWORD
        SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
index e37c06b6a9..73069e788b 100644
--- a/doc/source/contributing.rst
+++ b/doc/source/contributing.rst
@@ -98,8 +98,3 @@ have aged a bit (does anyone still do ramdisk installs?). While these
 may reference the top-level DevStack configuration they can generally be
 run alone. There are also some sub-directories to support specific
 environments such as XenServer.
-
-© Openstack Foundation 2011-2013 — An `OpenStack
-program <https://wiki.openstack.org/wiki/Programs>`__ created by
-`Rackspace Cloud
-Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/eucarc.rst b/doc/source/eucarc.rst
index c1065e6f61..c91d3417de 100644
--- a/doc/source/eucarc.rst
+++ b/doc/source/eucarc.rst
@@ -50,8 +50,3 @@ Certificates for Bundling
         EC2_CERT=cert.pem
         NOVA_CERT=cacert.pem
         EUCALYPTUS_CERT=${NOVA_CERT}
-
-© Openstack Foundation 2011-2013 — An `OpenStack
-program <https://wiki.openstack.org/wiki/Programs>`__ created by
-`Rackspace Cloud
-Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/exerciserc.rst b/doc/source/exerciserc.rst
index 22aff9a9e2..ed3f2e87b6 100644
--- a/doc/source/exerciserc.rst
+++ b/doc/source/exerciserc.rst
@@ -47,8 +47,3 @@ TERMINATE\_TIMEOUT
     ::
 
         TERMINATE_TIMEOUT=30
-
-© Openstack Foundation 2011-2013 — An `OpenStack
-program <https://wiki.openstack.org/wiki/Programs>`__ created by
-`Rackspace Cloud
-Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 9adc58ed1c..36b25b3039 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -178,7 +178,3 @@ Q: ``tools/fixup_stuff.sh`` is broken and shouldn't 'fix' just one version of pa
     problems than we'll add them to the script. Knowing about the broken
     future releases is valuable rather than polling to see if it has
     been fixed.
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c7901a21fb..a63260fe6f 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -376,7 +376,3 @@ If you forgot to set the root password you can do this:
 ::
 
     mysqladmin -u root -pnova password 'supersecret'
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/guides/pxe-boot.rst b/doc/source/guides/pxe-boot.rst
index 584e5581fd..f745abb7e4 100644
--- a/doc/source/guides/pxe-boot.rst
+++ b/doc/source/guides/pxe-boot.rst
@@ -138,6 +138,3 @@ Set Up tftpboot
 
 Now `return <ramdisk.html>`__ to the RAM disk Guide to kick off your
 DevStack experience.
-
-© Openstack Foundation 2011-2013 — this is not an official OpenStack
-project...
diff --git a/doc/source/guides/ramdisk.rst b/doc/source/guides/ramdisk.rst
index 82147a8c1b..1ba74f2322 100644
--- a/doc/source/guides/ramdisk.rst
+++ b/doc/source/guides/ramdisk.rst
@@ -84,6 +84,3 @@ Fire It Up
        screen -x
 
 -  Connect to the dashboard at ``http://<ip-address>/``
-
-© Openstack Foundation 2011-2013 — this is not an official OpenStack
-project...
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 0db0466281..3e0a39cad5 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -138,8 +138,3 @@ accessible from other machines on your network.
 Some examples of using the OpenStack command-line clients ``nova`` and
 ``glance`` are in the shakedown scripts in ``devstack/exercises``.
 ``exercise.sh`` will run all of those scripts and report on the results.
-
-© Openstack Foundation 2011-2013 — An `OpenStack
-program <https://wiki.openstack.org/wiki/Programs>`__ created by
-`Rackspace Cloud
-Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 0e2d1573aa..35efb14939 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -104,7 +104,3 @@ packages are installed in the VM and the source trees checked out.
 Setting ``OFFLINE=True`` in ``local.conf`` enables ``stack.sh`` to run
 multiple times without an Internet connection. DevStack, making hacking
 at the lake possible since 2012!
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/guides/usb-boot.rst b/doc/source/guides/usb-boot.rst
index 888e14feb3..4f7a49425b 100644
--- a/doc/source/guides/usb-boot.rst
+++ b/doc/source/guides/usb-boot.rst
@@ -55,6 +55,3 @@ Set Up USB Drive
 
 Now `return <ramdisk.html>`__ to the RAM disk Guide to kick off your
 DevStack experience.
-
-© Openstack Foundation 2011-2013 — this is not an official OpenStack
-project...
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6e5105dcff..6f7cab65a3 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -377,7 +377,3 @@ exercises/volumes.sh
 exercises/zaqar.sh
 
 `Read » <exercises/zaqar.sh.html>`__
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
index 40d0e0f57a..e1de44c2c7 100644
--- a/doc/source/local.conf.rst
+++ b/doc/source/local.conf.rst
@@ -14,7 +14,3 @@ local.conf User settings
 ``localrc`` file. See `the description of
 local.conf <configuration.html>`__ for more details about the mechanics
 of the file.
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/localrc.rst b/doc/source/localrc.rst
index 910e274209..487280bae5 100644
--- a/doc/source/localrc.rst
+++ b/doc/source/localrc.rst
@@ -14,7 +14,3 @@ and has been replaced by ```local.conf`` <local.conf.html>`__. DevStack
 will continue to use ``localrc`` if it is present and ignore the
 ``localrc`` section in ``local.conf.``. Remove ``localrc`` to switch to
 using the new file.
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index b8759ecb49..ce5765aa60 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -81,8 +81,3 @@ KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
 
         # export KEYSTONECLIENT_DEBUG=1
         # export NOVACLIENT_DEBUG=1
-
-© Openstack Foundation 2011-2013 — An `OpenStack
-program <https://wiki.openstack.org/wiki/Programs>`__ created by
-`Rackspace Cloud
-Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 953938baaf..cedf941bcd 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -97,7 +97,3 @@ The DevStack exercise scripts are no longer used as integration and gate
 testing as that job has transitioned to Tempest. They are still
 maintained as a demonstrations of using OpenStack from the command line
 and for quick operational testing.
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index db695d3e84..0747b59f3c 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -117,8 +117,3 @@ functions:
 -  ``start_nova_hypervisor`` - start any external services
 -  ``stop_nova_hypervisor`` - stop any external services
 -  ``cleanup_nova_hypervisor`` - remove transient data and cache
-
-© Openstack Foundation 2011-2013 — An `OpenStack
-program <https://wiki.openstack.org/wiki/Programs>`__ created by
-`Rackspace Cloud
-Builders <http://www.rackspace.com/cloud/private_edition/>`__
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
index b2766cb971..5d9d2218c6 100644
--- a/doc/source/stackrc.rst
+++ b/doc/source/stackrc.rst
@@ -71,7 +71,3 @@ Service Repos
 
         NOVA_REPO=https://review.openstack.org/p/openstack/nova
         NOVA_BRANCH=refs/changes/50/5050/1
-
-© Openstack Foundation 2011-2014 — An
-`OpenStack <https://www.openstack.org/>`__
-`program <https://wiki.openstack.org/wiki/Programs>`__

From f5cb1ce4c6f1733c3a5276dcf58f99c2984adafb Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Tue, 21 Oct 2014 11:16:58 -0500
Subject: [PATCH 0036/3333] Update docs section for new build

The devstack.org build process was recently changed to run as a CI post
job, publishing the site after every commit.

Change-Id: I05ddb353fae524178a25f28f2437d4fc635167f9
---
 HACKING.rst | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d69bb49286..cbba310ee3 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -126,14 +126,9 @@ and can stay in the project file.
 Documentation
 -------------
 
-The official DevStack repo on GitHub does not include a gh-pages branch that
-GitHub uses to create static web sites.  That branch is maintained in the
-`CloudBuilders DevStack repo`__ mirror that supports the
-http://devstack.org site.  This is the primary DevStack
-documentation along with the DevStack scripts themselves.
-
-__ repo_
-.. _repo: https://github.com/cloudbuilders/devstack
+The DevStack repo now contains all of the static pages of devstack.org in
+the ``doc/source`` directory. The OpenStack CI system rebuilds the docs after every
+commit and updates devstack.org (now a redirect to docs.openstack.org/developer/devstack).
 
 All of the scripts are processed with shocco_ to render them with the comments
 as text describing the script below.  For this reason we tend to be a little
@@ -144,6 +139,8 @@ uses Markdown headers to divide the script into logical sections.
 .. _shocco: https://github.com/dtroyer/shocco/tree/rst_support
 
 The script used to drive <code>shocco</code> is <code>tools/build_docs.sh</code>.
+The complete docs build is also handled with <code>tox -edocs</code> per the
+OpenStack project standard.
 
 
 Exercises
@@ -235,8 +232,12 @@ DevStack defines a bash set of best practices for maintaining large
 collections of bash scripts. These should be considered as part of the
 review process.
 
-We have a preliminary enforcing script for this called bash8 (only a
-small number of these rules are enforced).
+DevStack uses the bashate_ style checker
+to enforce basic guidelines, similar to pep8 and flake8 tools for Python. The
+list below is not complete for what bashate checks, nor is it all checked
+by bashate.  So many lines of code, so little time.
+
+.. _bashate: https://pypi.python.org/pypi/bashate
 
 Whitespace Rules
 ----------------

From 0d6e992d90b84bcafe16468b0a2aec903e3b7aa0 Mon Sep 17 00:00:00 2001
From: yunhong jiang <yunhong.jiang@intel.com>
Date: Fri, 10 Oct 2014 06:12:47 -0700
Subject: [PATCH 0037/3333] Fix a minor comments

A minor mismatch in lib/neutron since now unstack.sh invokes
three functions and also start_neutron_agents() is called before
create_neutron_initial_network().

Change-Id: Ibbe68501cce4c062a9ac610cbc44188dc9bab6c8
---
 lib/neutron | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index ca9b16cd8c..d05dcc806f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -20,13 +20,15 @@
 # - create_neutron_cache_dir
 # - create_nova_conf_neutron
 # - start_neutron_service_and_check
+# - start_neutron_agents
 # - create_neutron_initial_network
 # - setup_neutron_debug
-# - start_neutron_agents
 #
 # ``unstack.sh`` calls the entry points in this order:
 #
 # - stop_neutron
+# - stop_neutron_third_party
+# - cleanup_neutron
 
 # Functions in lib/neutron are classified into the following categories:
 #

From f76ed01665d8718641a1c5e421571bd165486d24 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean_collins2@cable.comcast.com>
Date: Mon, 27 Oct 2014 11:36:41 -0400
Subject: [PATCH 0038/3333] Docs: Fix exercise table in index.rst

Change-Id: I305414a5a38c6837a765110e726771ba2f94fe45
---
 doc/source/index.rst | 108 +++++++++++++++----------------------------
 1 file changed, 37 insertions(+), 71 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6f7cab65a3..37b365d11a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -306,74 +306,40 @@ Samples Generated documentation of DevStack sample files.
 Exercises Generated documentation of DevStack scripts.
 ------------------------------------------------------
 
-Filename
-
-Link
-
-exercise.sh
-
-`Read » <exercise.sh.html>`__
-
-exercises/aggregates.sh
-
-`Read » <exercises/aggregates.sh.html>`__
-
-exercises/boot\_from\_volume.sh
-
-`Read » <exercises/boot_from_volume.sh.html>`__
-
-exercises/bundle.sh
-
-`Read » <exercises/bundle.sh.html>`__
-
-exercises/client-args.sh
-
-`Read » <exercises/client-args.sh.html>`__
-
-exercises/client-env.sh
-
-`Read » <exercises/client-env.sh.html>`__
-
-exercises/euca.sh
-
-`Read » <exercises/euca.sh.html>`__
-
-exercises/floating\_ips.sh
-
-`Read » <exercises/floating_ips.sh.html>`__
-
-exercises/horizon.sh
-
-`Read » <exercises/horizon.sh.html>`__
-
-exercises/neutron-adv-test.sh
-
-`Read » <exercises/neutron-adv-test.sh.html>`__
-
-exercises/sahara.sh
-
-`Read » <exercises/sahara.sh.html>`__
-
-exercises/savanna.sh
-
-`Read » <exercises/savanna.sh.html>`__
-
-exercises/sec\_groups.sh
-
-`Read » <exercises/sec_groups.sh.html>`__
-
-exercises/swift.sh
-
-`Read » <exercises/swift.sh.html>`__
-
-exercises/trove.sh
-
-`Read » <exercises/trove.sh.html>`__
-
-exercises/volumes.sh
-
-`Read » <exercises/volumes.sh.html>`__
-
-exercises/zaqar.sh
-
-`Read » <exercises/zaqar.sh.html>`__
++---------------------------------+-------------------------------------------------+
+| Filename                        | Link                                            |
++=================================+=================================================+
+| exercise.sh                     | `Read » <exercise.sh.html>`__                   |
++---------------------------------+-------------------------------------------------+
+| exercises/aggregates.sh         | `Read » <exercises/aggregates.sh.html>`__       |
++---------------------------------+-------------------------------------------------+
+| exercises/boot\_from\_volume.sh | `Read » <exercises/boot_from_volume.sh.html>`__ |
++---------------------------------+-------------------------------------------------+
+| exercises/bundle.sh             | `Read » <exercises/bundle.sh.html>`__           |
++---------------------------------+-------------------------------------------------+
+| exercises/client-args.sh        | `Read » <exercises/client-args.sh.html>`__      |
++---------------------------------+-------------------------------------------------+
+| exercises/client-env.sh         | `Read » <exercises/client-env.sh.html>`__       |
++---------------------------------+-------------------------------------------------+
+| exercises/euca.sh               | `Read » <exercises/euca.sh.html>`__             |
++---------------------------------+-------------------------------------------------+
+| exercises/floating\_ips.sh      | `Read » <exercises/floating_ips.sh.html>`__     |
++---------------------------------+-------------------------------------------------+
+| exercises/horizon.sh            | `Read » <exercises/horizon.sh.html>`__          |
++---------------------------------+-------------------------------------------------+
+| exercises/neutron-adv-test.sh   | `Read » <exercises/neutron-adv-test.sh.html>`__ |
++---------------------------------+-------------------------------------------------+
+| exercises/sahara.sh             | `Read » <exercises/sahara.sh.html>`__           |
++---------------------------------+-------------------------------------------------+
+| exercises/savanna.sh            | `Read » <exercises/savanna.sh.html>`__          |
++---------------------------------+-------------------------------------------------+
+| exercises/sec\_groups.sh        | `Read » <exercises/sec_groups.sh.html>`__       |
++---------------------------------+-------------------------------------------------+
+| exercises/swift.sh              | `Read » <exercises/swift.sh.html>`__            |
++---------------------------------+-------------------------------------------------+
+| exercises/trove.sh              | `Read » <exercises/trove.sh.html>`__            |
++---------------------------------+-------------------------------------------------+
+| exercises/volumes.sh            | `Read » <exercises/volumes.sh.html>`__          |
++---------------------------------+-------------------------------------------------+
+| exercises/zaqar.sh              | `Read » <exercises/zaqar.sh.html>`__            |
++---------------------------------+-------------------------------------------------+

From def1534ce06409c4c70d6569ea6314a82897e28b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 27 Oct 2014 12:26:04 -0400
Subject: [PATCH 0039/3333] allow for soft updating of global-requirements

This creates a devstack REQUIREMENTS_MODE which is how we handle
syncing of global requirements. The default is 'strict', which is
current behavior. There is a new 'soft' mode which does a
--soft-update for projects *not* found in projects.txt, which lets
them specify additional requirements.

Change-Id: I4aa606514131b5dde67d87f5c8db5a3f3e50fc03
Depends-On: I1f195ef9ff1509659848e14ec9936ff6f66a6496
---
 functions-common | 25 +++++++++++++++++++++++--
 stackrc          | 11 +++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index e6f425f4a1..9041439dee 100644
--- a/functions-common
+++ b/functions-common
@@ -1606,6 +1606,16 @@ function setup_develop {
     setup_package_with_req_sync $project_dir -e
 }
 
+# determine if a project as specified by directory is in
+# projects.txt. This will not be an exact match because we throw away
+# the namespacing when we clone, but it should be good enough in all
+# practical ways.
+function is_in_projects_txt {
+    local project_dir=$1
+    local project_name=$(basename $project_dir)
+    return grep "/$project_name\$" $REQUIREMENTS_DIR/projects.txt >/dev/null
+}
+
 # ``pip install -e`` the package, which processes the dependencies
 # using pip before running `setup.py develop`
 #
@@ -1624,8 +1634,19 @@ function setup_package_with_req_sync {
     local update_requirements=$(cd $project_dir && git diff --exit-code >/dev/null || echo "changed")
 
     if [[ $update_requirements != "changed" ]]; then
-        (cd $REQUIREMENTS_DIR; \
-            python update.py $project_dir)
+        if [[ "$REQUIREMENTS_MODE" == "soft" ]]; then
+            if is_in_projects_txt $project_dir; then
+                (cd $REQUIREMENTS_DIR; \
+                    python update.py $project_dir)
+            else
+                # soft update projects not found in requirements project.txt
+                (cd $REQUIREMENTS_DIR; \
+                    python update.py -s $project_dir)
+            fi
+        else
+            (cd $REQUIREMENTS_DIR; \
+                python update.py $project_dir)
+        fi
     fi
 
     setup_package $project_dir $flags
diff --git a/stackrc b/stackrc
index 6cec8e85fb..d97dba826a 100644
--- a/stackrc
+++ b/stackrc
@@ -116,6 +116,17 @@ DATABASE_QUERY_LOGGING=$(trueorfalse True $DATABASE_QUERY_LOGGING)
 # Zero disables timeouts
 GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 
+# Requirements enforcing mode
+#
+# - strict (default) : ensure all project requirements files match
+#   what's in global requirements.
+#
+# - soft : enforce requirements on everything in
+#   requirements/projects.txt, but do soft updates on all other
+#   repositories (i.e. sync versions for requirements that are in g-r,
+#   but pass through any extras)
+REQUIREMENTS_MODE=${REQUIREMENTS_MODE:-strict}
+
 # Repositories
 # ------------
 

From e7f071b49fa0a4cb695220a2d159214779803cd8 Mon Sep 17 00:00:00 2001
From: taturiello <salv.orlando@gmail.com>
Date: Wed, 15 Oct 2014 05:09:45 -0700
Subject: [PATCH 0040/3333] Remove no_wait ovs flag from vmw_nsx 3rd party lib

The no_wait flag can trigger a race conditon with ip addr flush
if the public bridge is not yet up. Due to this race condition
the local route for the external subnet might not be added.

The patch also renames br-ex to $PUBLIC_BRIDGE in some places

Change-Id: I11335c99dba580e7ca26b0b15b0df8dead367fdc
---
 lib/neutron_thirdparty/vmware_nsx | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
index 7a76570775..7a20c64afb 100644
--- a/lib/neutron_thirdparty/vmware_nsx
+++ b/lib/neutron_thirdparty/vmware_nsx
@@ -8,7 +8,7 @@
 # * enable_service vmware_nsx        --> to execute this third-party addition
 # * PUBLIC_BRIDGE                    --> bridge used for external connectivity, typically br-ex
 # * NSX_GATEWAY_NETWORK_INTERFACE    --> interface used to communicate with the NSX Gateway
-# * NSX_GATEWAY_NETWORK_CIDR         --> CIDR to configure br-ex, e.g. 172.24.4.211/24
+# * NSX_GATEWAY_NETWORK_CIDR         --> CIDR to configure $PUBLIC_BRIDGE, e.g. 172.24.4.211/24
 
 # Save trace setting
 NSX3_XTRACE=$(set +o | grep xtrace)
@@ -29,7 +29,7 @@ function configure_vmware_nsx {
 function init_vmware_nsx {
     if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
         NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
-        echo "The IP address to set on br-ex was not specified. "
+        echo "The IP address to set on $PUBLIC_BRIDGE was not specified. "
         echo "Defaulting to "$NSX_GATEWAY_NETWORK_CIDR
     fi
     # Make sure the interface is up, but not configured
@@ -42,14 +42,15 @@ function init_vmware_nsx {
     # only with mac learning enabled, portsecurity and security profiles disabled
     # The public bridge might not exist for the NSX plugin if Q_USE_DEBUG_COMMAND is off
     # Try to create it anyway
-    sudo ovs-vsctl --no-wait -- --may-exist add-br $PUBLIC_BRIDGE
-    sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_INTERFACE
+    sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE
+    sudo ovs-vsctl --may-exist add-port $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_INTERFACE
     nsx_gw_net_if_mac=$(ip link show $NSX_GATEWAY_NETWORK_INTERFACE | awk '/ether/ {print $2}')
     sudo ip link set address $nsx_gw_net_if_mac dev $PUBLIC_BRIDGE
     for address in $addresses; do
         sudo ip addr add dev $PUBLIC_BRIDGE $address
     done
     sudo ip addr add dev $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_CIDR
+    sudo ip link set $PUBLIC_BRIDGE up
 }
 
 function install_vmware_nsx {
@@ -63,7 +64,7 @@ function start_vmware_nsx {
 function stop_vmware_nsx {
     if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
         NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
-        echo "The IP address expected on br-ex was not specified. "
+        echo "The IP address expected on $PUBLIC_BRIDGE was not specified. "
         echo "Defaulting to "$NSX_GATEWAY_NETWORK_CIDR
     fi
     sudo ip addr del $NSX_GATEWAY_NETWORK_CIDR dev $PUBLIC_BRIDGE

From 15130cd5fd1688b8984d78136b97bb8de7c32b64 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Tue, 28 Oct 2014 11:49:58 +0900
Subject: [PATCH 0041/3333] Desupport neutron openvswitch and linuxbridge
 monolithic plugins

These plugins were removed in Juno.
Note: this doesn't affect the corresponding ML2 mechanism drivers.

Partial-Bug: #1323729
Change-Id: Ia8da1e20a03fef5657ba1584bf83ddd224b5d5f2
---
 lib/neutron                           | 29 ++++------
 lib/neutron_plugins/linuxbridge       | 55 -------------------
 lib/neutron_plugins/linuxbridge_agent | 77 ---------------------------
 lib/neutron_plugins/openvswitch       |  7 ++-
 4 files changed, 14 insertions(+), 154 deletions(-)
 delete mode 100644 lib/neutron_plugins/linuxbridge
 delete mode 100644 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron b/lib/neutron
index ca9b16cd8c..5b3ac9f42e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -43,21 +43,11 @@
 # to run Neutron on this host, make sure that q-svc is also in
 # ``ENABLED_SERVICES``.
 #
-# If you're planning to use the Neutron openvswitch plugin, set
-# ``Q_PLUGIN`` to "openvswitch" and make sure the q-agt service is enabled
-# in ``ENABLED_SERVICES``.  If you're planning to use the Neutron
-# linuxbridge plugin, set ``Q_PLUGIN`` to "linuxbridge" and make sure the
-# q-agt service is enabled in ``ENABLED_SERVICES``.
-#
 # See "Neutron Network Configuration" below for additional variables
 # that must be set in localrc for connectivity across hosts with
 # Neutron.
 #
 # With Neutron networking the NETWORK_MANAGER variable is ignored.
-#
-# To enable specific configuration options for either the Open vSwitch or
-# LinuxBridge plugin, please see the top level README file under the
-# Neutron section.
 
 
 # Neutron Network Configuration
@@ -213,12 +203,11 @@ fi
 # Provider Network Configurations
 # --------------------------------
 
-# The following variables control the Neutron openvswitch and
-# linuxbridge plugins' allocation of tenant networks and
-# availability of provider networks. If these are not configured
-# in ``localrc``, tenant networks will be local to the host (with no
-# remote connectivity), and no physical resources will be
-# available for the allocation of provider networks.
+# The following variables control the Neutron ML2 plugins' allocation
+# of tenant networks and availability of provider networks. If these
+# are not configured in ``localrc``, tenant networks will be local to
+# the host (with no remote connectivity), and no physical resources
+# will be available for the allocation of provider networks.
 
 # To disable tunnels (GRE or VXLAN) for tenant networks,
 # set to False in ``local.conf``.
@@ -231,8 +220,8 @@ ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
 TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
 
 # To use VLANs for tenant networks, set to True in localrc. VLANs
-# are supported by the openvswitch and linuxbridge plugins, each
-# requiring additional configuration described below.
+# are supported by the ML2 plugins, requiring additional configuration
+# described below.
 ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
 
 # If using VLANs for tenant networks, set in ``localrc`` to specify
@@ -252,7 +241,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # Example: ``PHYSICAL_NETWORK=default``
 PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 
-# With the openvswitch plugin, if using VLANs for tenant networks,
+# With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the OVS bridge to use for the physical network. The
 # bridge will be created if it does not already exist, but a
@@ -262,7 +251,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
 
-# With the linuxbridge plugin, if using VLANs for tenant networks,
+# With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the network interface to use for the physical
 # network.
diff --git a/lib/neutron_plugins/linuxbridge b/lib/neutron_plugins/linuxbridge
deleted file mode 100644
index 5f989ae0ad..0000000000
--- a/lib/neutron_plugins/linuxbridge
+++ /dev/null
@@ -1,55 +0,0 @@
-# Neutron Linux Bridge plugin
-# ---------------------------
-
-# Save trace setting
-LBRIDGE_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/linuxbridge_agent
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/linuxbridge
-    Q_PLUGIN_CONF_FILENAME=linuxbridge_conf.ini
-    Q_PLUGIN_CLASS="neutron.plugins.linuxbridge.lb_neutron_plugin.LinuxBridgePluginV2"
-}
-
-function neutron_plugin_configure_service {
-    if [[ "$ENABLE_TENANT_VLANS" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE vlans tenant_network_type vlan
-    else
-        echo "WARNING - The linuxbridge plugin is using local tenant networks, with no connectivity between hosts."
-    fi
-
-    # Override ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc``
-    # for more complex physical network configurations.
-    if [[ "$LB_VLAN_RANGES" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]]; then
-        LB_VLAN_RANGES=$PHYSICAL_NETWORK
-        if [[ "$TENANT_VLAN_RANGE" != "" ]]; then
-            LB_VLAN_RANGES=$LB_VLAN_RANGES:$TENANT_VLAN_RANGE
-        fi
-    fi
-    if [[ "$LB_VLAN_RANGES" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE vlans network_vlan_ranges $LB_VLAN_RANGES
-    fi
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
-
-    # Define extra "LINUX_BRIDGE" configuration options when q-svc is configured by defining
-    # the array ``Q_SRV_EXTRA_OPTS``.
-    # For Example: ``Q_SRV_EXTRA_OPTS=(foo=true bar=2)``
-    for I in "${Q_SRV_EXTRA_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge ${I/=/ }
-    done
-}
-
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
-
-# Restore xtrace
-$LBRIDGE_XTRACE
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
deleted file mode 100644
index 2638dd3725..0000000000
--- a/lib/neutron_plugins/linuxbridge_agent
+++ /dev/null
@@ -1,77 +0,0 @@
-# Neutron Linux Bridge L2 agent
-# -----------------------------
-
-# Save trace setting
-PLUGIN_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-function is_neutron_ovs_base_plugin {
-    # linuxbridge doesn't use OVS
-    return 1
-}
-
-function neutron_plugin_create_nova_conf {
-    :
-}
-
-function neutron_plugin_install_agent_packages {
-    install_package bridge-utils
-}
-
-function neutron_plugin_configure_debug_command {
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
-}
-
-function neutron_plugin_configure_l3_agent {
-    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # Setup physical network interface mappings.  Override
-    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
-        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
-    fi
-    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
-    fi
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
-    iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-    # Define extra "AGENT" configuration options when q-agt is configured by defining
-    # the array ``Q_AGENT_EXTRA_AGENT_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_AGENT_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_AGENT_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE agent ${I/=/ }
-    done
-    # Define extra "LINUX_BRIDGE" configuration options when q-agt is configured by defining
-    # the array ``Q_AGENT_EXTRA_SRV_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_SRV_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_SRV_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge ${I/=/ }
-    done
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
-}
-
-# Restore xtrace
-$PLUGIN_XTRACE
diff --git a/lib/neutron_plugins/openvswitch b/lib/neutron_plugins/openvswitch
index c468132bbb..e9bc5f9a78 100644
--- a/lib/neutron_plugins/openvswitch
+++ b/lib/neutron_plugins/openvswitch
@@ -1,5 +1,8 @@
-# Neutron Open vSwitch plugin
-# ---------------------------
+# Common code used by cisco and embrane plugins
+# ---------------------------------------------
+
+# This module used to be for Open vSwitch monolithic plugin,
+# which has been removed in Juno.
 
 # Save trace setting
 OVS_XTRACE=$(set +o | grep xtrace)

From 3ec8a9032724a5ad86d80b3ac3ef7143c6c68890 Mon Sep 17 00:00:00 2001
From: Nikhil Manchanda <SlickNik@gmail.com>
Date: Sun, 26 Oct 2014 15:41:15 -0700
Subject: [PATCH 0042/3333] Use updated trove mysql image location

Use the updated trove mysql image at:
tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2
instead of the older deprecated image at:
tarballs.openstack.org/trove/images/ubuntu_mysql.qcow2/ubuntu_mysql.qcow2

Change-Id: If76f25dfe0f975faf1883f0a6d993c21b26e1b29
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 6cec8e85fb..fd84598c5f 100644
--- a/stackrc
+++ b/stackrc
@@ -522,11 +522,11 @@ if [[ "$ENABLED_SERVICES" =~ 'h-api' ]]; then
     esac
 fi
 
-# Trove needs a custom image for it's work
+# Trove needs a custom image for its work
 if [[ "$ENABLED_SERVICES" =~ 'tr-api' ]]; then
     case "$VIRT_DRIVER" in
         libvirt|baremetal|ironic|xenapi)
-            TROVE_GUEST_IMAGE_URL=${TROVE_GUEST_IMAGE_URL:-"http://tarballs.openstack.org/trove/images/ubuntu_mysql.qcow2/ubuntu_mysql.qcow2"}
+            TROVE_GUEST_IMAGE_URL=${TROVE_GUEST_IMAGE_URL:-"http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"}
             IMAGE_URLS+=",${TROVE_GUEST_IMAGE_URL}"
             ;;
         *)

From 7fb5082c5c7abff95eb46dd9a92c5fd8fc63ddd2 Mon Sep 17 00:00:00 2001
From: wanghong <w.wanghong@huawei.com>
Date: Tue, 28 Oct 2014 19:09:04 +0800
Subject: [PATCH 0043/3333] correct templated catalog driver class

Now the templated catalog driver class "TemplatedCatalog" is removed
in this patch https://review.openstack.org/#/c/125708/2 use
"keystone.catalog.backends.templated.Catalog" instead.

Change-Id: Ib9c8ea557e7171ff0c78a1e10d752ed564aff9e7
Closes-Bug: #1386562
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 1c67835a12..276e9718a6 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -287,7 +287,7 @@ function configure_keystone {
         " -i $KEYSTONE_CATALOG
 
         # Configure ``keystone.conf`` to use templates
-        iniset $KEYSTONE_CONF catalog driver "keystone.catalog.backends.templated.TemplatedCatalog"
+        iniset $KEYSTONE_CONF catalog driver "keystone.catalog.backends.templated.Catalog"
         iniset $KEYSTONE_CONF catalog template_file "$KEYSTONE_CATALOG"
     fi
 

From 2112743b10fb522e86380fad5bf5a9e72b73721f Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Tue, 21 Oct 2014 20:19:23 +0100
Subject: [PATCH 0044/3333] Allow ceilometer to use redis for coordination

If redis is desired by local.conf via CEILOMETER_COORDINATION_URL
then make sure redis is installed and restarted.

Change-Id: Idfb7b902478049fbc240bf416db6c7d6acd67a51
---
 lib/ceilometer | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/ceilometer b/lib/ceilometer
index 9046b9d3d9..483cd277c8 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -242,6 +242,18 @@ function init_ceilometer {
     fi
 }
 
+# install_redis() - Install the redis server.
+function install_redis {
+    if is_ubuntu; then
+        install_package redis-server
+    else
+        # This will fail (correctly) where a redis package is unavailable
+        install_package redis
+    fi
+
+    restart_service redis
+}
+
 # install_ceilometer() - Collect source and prepare
 function install_ceilometer {
     git_clone $CEILOMETER_REPO $CEILOMETER_DIR $CEILOMETER_BRANCH
@@ -249,6 +261,8 @@ function install_ceilometer {
 
     if echo $CEILOMETER_COORDINATION_URL | grep -q '^memcached:'; then
         install_package memcached
+    elif echo $CEILOMETER_COORDINATION_URL | grep -q '^redis:'; then
+        install_redis
     fi
 }
 

From d16197b689e9087d6c22e0488c0aa671578a927d Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Tue, 28 Oct 2014 12:21:38 +0900
Subject: [PATCH 0045/3333] Stop setting deprecated OVS.enable_tunneling option

The option has been deprecated in IceHouse and now being removed.

Related-Bug: #1195374
Change-Id: I38d962551173892144c369df71e0524b43e1fc89
---
 lib/neutron_plugins/ofagent_agent     | 1 -
 lib/neutron_plugins/openvswitch       | 5 -----
 lib/neutron_plugins/openvswitch_agent | 1 -
 3 files changed, 7 deletions(-)

diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index 1c04f2f64e..55f3f72056 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -61,7 +61,6 @@ function neutron_plugin_configure_plugin_agent {
         if [ `vercmp_numbers "$OVS_VERSION" "1.4"` -lt "0" ]; then
             die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
         fi
-        iniset /$Q_PLUGIN_CONF_FILE ovs enable_tunneling True
         iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
     fi
 
diff --git a/lib/neutron_plugins/openvswitch b/lib/neutron_plugins/openvswitch
index e9bc5f9a78..3b6567cd0a 100644
--- a/lib/neutron_plugins/openvswitch
+++ b/lib/neutron_plugins/openvswitch
@@ -38,11 +38,6 @@ function neutron_plugin_configure_service {
         iniset /$Q_PLUGIN_CONF_FILE ovs network_vlan_ranges $OVS_VLAN_RANGES
     fi
 
-    # Enable tunnel networks if selected
-    if [[ $OVS_ENABLE_TUNNELING == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE ovs enable_tunneling True
-    fi
-
     _neutron_ovs_base_configure_firewall_driver
 
     # Define extra "OVS" configuration options when q-svc is configured by defining
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 835f645b8c..e1a6f4a47f 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -47,7 +47,6 @@ function neutron_plugin_configure_plugin_agent {
         if [ `vercmp_numbers "$OVS_VERSION" "1.4"` -lt "0" ] && ! is_service_enabled q-svc ; then
             die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
         fi
-        iniset /$Q_PLUGIN_CONF_FILE ovs enable_tunneling True
         iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
     fi
 

From f3bf8b6cc0dc94684a3bbecc4cc1e2169506f804 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 29 Oct 2014 21:53:56 +1100
Subject: [PATCH 0046/3333] Revert "Single quote iniset argument in
 merge_config_file"

This reverts commit e2c9fee8ed846aba124a2fc1bba245790ed7ba90.

We have decided that we don't want to support the json-style argument
as described by bug#1374118 (see thread at [1]).

This restores the old behavior of sending the argument in
double-quotes so environment variables get expanded.  As a bonus,
tests for this are added.

[1] http://lists.openstack.org/pipermail/openstack-dev/2014-October/049341.html

Change-Id: I9fc99f3716cc53366907878adb00ae6cf3898f14
Closes-Bug:#1386413
---
 lib/config           |  8 +++-----
 tests/test_config.sh | 33 +++++++++++++++++++++------------
 2 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/lib/config b/lib/config
index a4d59a31c9..a4d032864b 100644
--- a/lib/config
+++ b/lib/config
@@ -82,8 +82,6 @@ function merge_config_file {
     local matchgroup=$2
     local configfile=$3
 
-    # note in the awk below, \x27 is ascii for ' -- this avoids
-    # having to do nasty quoting games
     get_meta_section $file $matchgroup $configfile | \
     $CONFIG_AWK_CMD -v configfile=$configfile '
         BEGIN {
@@ -140,13 +138,13 @@ function merge_config_file {
                 for (attr_no = cfg_sec_attr_count[sno] - 1; attr_no >=0; attr_no--) {
                     attr = cfg_sec_attr_name[sno, attr_no]
                     if (cfg_attr_count[section, attr] == 1)
-                        print "iniset " configfile " " section " " attr " \x27" cfg_attr[section, attr, 0] "\x27"
+                        print "iniset " configfile " " section " " attr " \"" cfg_attr[section, attr, 0] "\""
                     else {
                         # For multiline, invoke the ini routines in the reverse order
                         count = cfg_attr_count[section, attr]
-                        print "iniset " configfile " " section " " attr " \x27" cfg_attr[section, attr, count - 1] "\x27"
+                        print "iniset " configfile " " section " " attr " \"" cfg_attr[section, attr, count - 1] "\""
                         for (l = count -2; l >= 0; l--)
-                            print "iniadd_literal " configfile " " section " " attr " \x27" cfg_attr[section, attr, l] "\x27"
+                            print "iniadd_literal " configfile " " section " " attr " \"" cfg_attr[section, attr, l] "\""
                     }
                 }
             }
diff --git a/tests/test_config.sh b/tests/test_config.sh
index cd74cee6f0..3252104bf1 100755
--- a/tests/test_config.sh
+++ b/tests/test_config.sh
@@ -92,9 +92,9 @@ attribute=value
 [fff]
 type=new
 
-[[test-quote|test-quote.conf]]
+[[test-env|test-env.conf]]
 [foo]
-foo="foo bar" "baz"
+foo=\${FOO_BAR_BAZ}
 
 [[test5|test-equals.conf]]
 [DEFAULT]
@@ -126,9 +126,11 @@ cfg_item5 = 5555another
 
 [[test-multiline|test-multiline.conf]]
 [multi]
-cfg_item1 = "ab":"cd", "ef":   "gh"
+cfg_item1 = ab:cd:ef:gh
 cfg_item1 = abcd
 cfg_item2 = efgh
+cfg_item2 = \${FOO_BAR_BAZ}
+
 EOF
 
 echo -n "get_meta_section_files: test0 doesn't exist: "
@@ -236,14 +238,17 @@ check_result "$VAL" "$EXPECT_VAL"
 
 echo -n "merge_config_file test-multiline: "
 rm -f test-multiline.conf
+FOO_BAR_BAZ="foo bar baz"
 merge_config_file test.conf test-multiline test-multiline.conf
 VAL=$(cat test-multiline.conf)
 EXPECT_VAL='
 [multi]
-cfg_item1 = "ab":"cd", "ef":   "gh"
+cfg_item1 = ab:cd:ef:gh
 cfg_item1 = abcd
-cfg_item2 = efgh'
+cfg_item2 = efgh
+cfg_item2 = foo bar baz'
 check_result "$VAL" "$EXPECT_VAL"
+unset FOO_BAR_BAZ
 
 echo -n "merge_config_group test2: "
 rm test2a.conf
@@ -275,14 +280,16 @@ EXPECT_VAL="
 attribute = value"
 check_result "$VAL" "$EXPECT_VAL"
 
-echo -n "merge_config_file test-quote: "
-rm -f test-quote.conf
-merge_config_file test.conf test-quote test-quote.conf
-VAL=$(cat test-quote.conf)
+echo -n "merge_config_file test-env: "
+rm -f test-env.conf
+FOO_BAR_BAZ="foo bar baz"
+merge_config_file test.conf test-env test-env.conf
+VAL=$(cat test-env.conf)
 EXPECT_VAL='
 [foo]
-foo = "foo bar" "baz"'
+foo = foo bar baz'
 check_result "$VAL" "$EXPECT_VAL"
+unset FOO_BAR_BAZ
 
 echo -n "merge_config_group test4 variable filename: "
 setup_test4
@@ -332,6 +339,8 @@ EXPECT_VAL="
 servers = 10.11.12.13:80"
 check_result "$VAL" "$EXPECT_VAL"
 
-rm -f test.conf test1c.conf test2a.conf test-quote.conf test-space.conf test-equals.conf test-strip.conf test-colon.conf
-rm -f test-multiline.conf test-multi-sections.conf
+rm -f test.conf test1c.conf test2a.conf \
+    test-space.conf test-equals.conf test-strip.conf \
+    test-colon.conf test-env.conf test-multiline.conf \
+    test-multi-sections.conf
 rm -rf test-etc

From 46b0be31372e2f1aa9c2e55f3112b65a76167f8e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Oct 2014 13:15:51 +1100
Subject: [PATCH 0047/3333] Fix up file-matching in bashate tox test

The current test does not match file files in /lib/* because the
-wholename command is missing the preceeding \*.  The whole command is
a little difficult to understand.

This re-lays the find command, using -prune to skip dot directories
and keeping a hopefully clearer flow of what is being matched.

Change-Id: Idd856e897ff97095fb116294a9187ff4b198fa26
---
 tox.ini | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index b6f2d9655e..c8d3909805 100644
--- a/tox.ini
+++ b/tox.ini
@@ -10,7 +10,19 @@ install_command = pip install {opts} {packages}
 [testenv:bashate]
 deps = bashate
 whitelist_externals = bash
-commands = bash -c "find {toxinidir} -not -wholename \*.tox/\* -and \( -name \*.sh -or -name \*rc -or -name functions\* -or \( -wholename lib/\* -and -not -name \*.md \) \) -print0 | xargs -0 bashate -v"
+commands = bash -c "find {toxinidir}          \
+         -not \( -type d -name .?\* -prune \) \ # prune all 'dot' dirs
+         -not \( -type d -name doc -prune \)  \ # skip documentation
+         -type f                              \ # only files
+         -not -name \*~                       \ # skip editors, readme, etc
+         -not -name \*.md                     \
+         \(                                   \
+          -name \*.sh -or                     \
+          -name \*rc -or                      \
+          -name functions\* -or               \
+          -wholename \*/lib/\*                \ # /lib files are shell, but
+         \)                                   \ #   have no extension
+         -print0 | xargs -0 bashate -v"
 
 [testenv:docs]
 deps =

From 6df648920c0d15c1b79f8592bb99b98282005794 Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Fri, 17 Oct 2014 13:09:49 +0200
Subject: [PATCH 0048/3333] XenAPI: move Neutron plugin install to domU

Use the same mechanism as used for nova plugin installation, thus
avoiding the need for variables in dom0. This change will also help to
move XenServer CI to neutron in the future, as the dom0 part of the
script is not executed there.

With this change, the neutron related network will always be created and
attached even if the user wants to use nova-network.

Change-Id: I8669c94e9f0aacce2990469dbabde1ff702a2769
---
 lib/neutron                  | 18 ++++++++++++++++++
 tools/xen/install_os_domU.sh | 26 ++++++--------------------
 2 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index ca9b16cd8c..43167d8206 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -595,6 +595,24 @@ function init_neutron {
 function install_neutron {
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
+
+    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
+        local dom0_ip
+        dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
+
+        local ssh_dom0
+        ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
+
+        # Find where the plugins should go in dom0
+        local xen_functions
+        xen_functions=$(cat $TOP_DIR/tools/xen/functions)
+        local plugin_dir
+        plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
+
+        # install neutron plugins to dom0
+        tar -czf - -C $NEUTRON_DIR/neutron/plugins/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
+            $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
+    fi
 }
 
 # install_neutronclient() - Collect source and prepare
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 439db68120..ff7e6fbc88 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -65,16 +65,6 @@ EOF
     exit 1
 fi
 
-# Install plugins
-
-## Install the netwrap xapi plugin to support agent control of dom0 networking
-if [[ "$ENABLED_SERVICES" =~ "q-agt" && "$Q_PLUGIN" = "openvswitch" ]]; then
-    NEUTRON_ZIPBALL_URL=${NEUTRON_ZIPBALL_URL:-$(zip_snapshot_location $NEUTRON_REPO $NEUTRON_BRANCH)}
-    EXTRACTED_NEUTRON=$(extract_remote_zipball "$NEUTRON_ZIPBALL_URL")
-    install_xapi_plugins_from "$EXTRACTED_NEUTRON"
-    rm -rf "$EXTRACTED_NEUTRON"
-fi
-
 #
 # Configure Networking
 #
@@ -88,9 +78,7 @@ setup_network "$PUB_BRIDGE_OR_NET_NAME"
 
 # With neutron, one more network is required, which is internal to the
 # hypervisor, and used by the VMs
-if is_service_enabled neutron; then
-    setup_network "$XEN_INT_BRIDGE_OR_NET_NAME"
-fi
+setup_network "$XEN_INT_BRIDGE_OR_NET_NAME"
 
 if parameter_is_specified "FLAT_NETWORK_BRIDGE"; then
     if [ "$(bridge_for "$VM_BRIDGE_OR_NET_NAME")" != "$(bridge_for "$FLAT_NETWORK_BRIDGE")" ]; then
@@ -292,14 +280,12 @@ $THIS_DIR/build_xva.sh "$GUEST_NAME"
 # Attach a network interface for the integration network (so that the bridge
 # is created by XenServer). This is required for Neutron. Also pass that as a
 # kernel parameter for DomU
-if is_service_enabled neutron; then
-    attach_network "$XEN_INT_BRIDGE_OR_NET_NAME"
+attach_network "$XEN_INT_BRIDGE_OR_NET_NAME"
 
-    XEN_INTEGRATION_BRIDGE=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
-    append_kernel_cmdline \
-        "$GUEST_NAME" \
-        "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE}"
-fi
+XEN_INTEGRATION_BRIDGE=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
+append_kernel_cmdline \
+    "$GUEST_NAME" \
+    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE}"
 
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"

From dec5ca0f201eaaa996b929aa36f2db5d9fb91aac Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Fri, 17 Oct 2014 13:13:35 +0200
Subject: [PATCH 0049/3333] XenAPI: Remove non-used functions

Remove the no-longer used functions that were used to download plugins
to dom0.

Change-Id: I8dfd476781b683a8378efdae45d3cb1b46e7063c
---
 tools/xen/functions         | 40 ----------------------------------
 tools/xen/test_functions.sh | 43 -------------------------------------
 2 files changed, 83 deletions(-)

diff --git a/tools/xen/functions b/tools/xen/functions
index 4317796e39..c8efd57d88 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -19,10 +19,6 @@ function xapi_plugin_location {
     return 1
 }
 
-function zip_snapshot_location {
-    echo $1 | sed "s,^git://,http://,g;s:\.git$::;s:$:/zipball/$2:g"
-}
-
 function create_directory_for_kernels {
     if [ -d "/boot/guest" ]; then
         echo "INFO: /boot/guest directory already exists, using that" >&2
@@ -43,42 +39,6 @@ function create_directory_for_images {
     fi
 }
 
-function extract_remote_zipball {
-    local ZIPBALL_URL=$1
-
-    local LOCAL_ZIPBALL=$(mktemp)
-    local EXTRACTED_FILES=$(mktemp -d)
-
-    {
-        if ! wget -nv $ZIPBALL_URL -O $LOCAL_ZIPBALL --no-check-certificate; then
-            die_with_error "Failed to download [$ZIPBALL_URL]"
-        fi
-        unzip -q -o $LOCAL_ZIPBALL -d $EXTRACTED_FILES
-        rm -f $LOCAL_ZIPBALL
-    } >&2
-
-    echo "$EXTRACTED_FILES"
-}
-
-function find_xapi_plugins_dir {
-    find $1 -path '*/xapi.d/plugins' -type d -print
-}
-
-function install_xapi_plugins_from {
-    local XAPI_PLUGIN_DIR
-    local EXTRACTED_FILES
-    local EXTRACTED_PLUGINS_DIR
-
-    EXTRACTED_FILES="$1"
-
-    XAPI_PLUGIN_DIR=$(xapi_plugin_location)
-
-    EXTRACTED_PLUGINS_DIR=$(find_xapi_plugins_dir $EXTRACTED_FILES)
-
-    cp -pr $EXTRACTED_PLUGINS_DIR/* $XAPI_PLUGIN_DIR
-    chmod a+x ${XAPI_PLUGIN_DIR}*
-}
-
 function get_local_sr {
     xe pool-list params=default-SR minimal=true
 }
diff --git a/tools/xen/test_functions.sh b/tools/xen/test_functions.sh
index 838f86a525..924e773c00 100755
--- a/tools/xen/test_functions.sh
+++ b/tools/xen/test_functions.sh
@@ -116,18 +116,6 @@ function test_no_plugin_directory_found {
     grep "[ -d /usr/lib/xcp/plugins/ ]" $LIST_OF_ACTIONS
 }
 
-function test_zip_snapshot_location_http {
-    diff \
-    <(zip_snapshot_location "http://github.com/openstack/nova.git" "master") \
-    <(echo "http://github.com/openstack/nova/zipball/master")
-}
-
-function test_zip_snapsot_location_git {
-    diff \
-    <(zip_snapshot_location "git://github.com/openstack/nova.git" "master") \
-    <(echo "http://github.com/openstack/nova/zipball/master")
-}
-
 function test_create_directory_for_kernels {
     (
         . mocks
@@ -174,37 +162,6 @@ function test_create_directory_for_images_existing_dir {
 EOF
 }
 
-function test_extract_remote_zipball {
-    local RESULT=$(. mocks && extract_remote_zipball "someurl")
-
-    diff <(cat $LIST_OF_ACTIONS) - << EOF
-wget -nv someurl -O tempfile --no-check-certificate
-unzip -q -o tempfile -d tempdir
-rm -f tempfile
-EOF
-
-    [ "$RESULT" = "tempdir" ]
-}
-
-function test_extract_remote_zipball_wget_fail {
-    set +e
-
-    local IGNORE
-    IGNORE=$(. mocks && extract_remote_zipball "failurl")
-
-    assert_died_with "Failed to download [failurl]"
-}
-
-function test_find_nova_plugins {
-    local tmpdir=$(mktemp -d)
-
-    mkdir -p "$tmpdir/blah/blah/u/xapi.d/plugins"
-
-    [ "$tmpdir/blah/blah/u/xapi.d/plugins" = $(find_xapi_plugins_dir $tmpdir) ]
-
-    rm -rf $tmpdir
-}
-
 function test_get_local_sr {
     setup_xe_response "uuid123"
 

From 518fb760d3cfa47c94400ef664f0daa14b99c003 Mon Sep 17 00:00:00 2001
From: Mate Lakat <mate.lakat@citrix.com>
Date: Fri, 17 Oct 2014 13:14:49 +0200
Subject: [PATCH 0050/3333] XenAPI: workaround for unsupp. associative arrays

Dom0's bash does not support associative arrays, however we source
`functions` and therefore our scripts fail. This change breaks the
dependency of dom0 tools on domU functions.

Fixes bug: 1379804

Change-Id: I229e2d5f07070a9236ec612d4032c94c4361a9f6
---
 tools/xen/build_xva.sh                       |  7 -------
 tools/xen/install_os_domU.sh                 |  7 -------
 tools/xen/prepare_guest_template.sh          |  7 -------
 tools/xen/scripts/install_ubuntu_template.sh |  3 ---
 tools/xen/xenrc                              | 21 ++++++++++++++++++--
 5 files changed, 19 insertions(+), 26 deletions(-)

diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
index cc3cbe18d1..7c8e620f44 100755
--- a/tools/xen/build_xva.sh
+++ b/tools/xen/build_xva.sh
@@ -21,19 +21,12 @@ set -o xtrace
 # This directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 
-# Source lower level functions
-. $TOP_DIR/../../functions
-
 # Include onexit commands
 . $TOP_DIR/scripts/on_exit.sh
 
 # xapi functions
 . $TOP_DIR/functions
 
-# Determine what system we are running on.
-# Might not be XenServer if we're using xenserver-core
-GetDistro
-
 # Source params - override xenrc params in your localrc to suite your taste
 source xenrc
 
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index ff7e6fbc88..3a63473d40 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -22,19 +22,12 @@ fi
 # This directory
 THIS_DIR=$(cd $(dirname "$0") && pwd)
 
-# Source lower level functions
-. $THIS_DIR/../../functions
-
 # Include onexit commands
 . $THIS_DIR/scripts/on_exit.sh
 
 # xapi functions
 . $THIS_DIR/functions
 
-# Determine what system we are running on.
-# Might not be XenServer if we're using xenserver-core
-GetDistro
-
 #
 # Get Settings
 #
diff --git a/tools/xen/prepare_guest_template.sh b/tools/xen/prepare_guest_template.sh
index 2d3b89821f..a7a60ca5e6 100755
--- a/tools/xen/prepare_guest_template.sh
+++ b/tools/xen/prepare_guest_template.sh
@@ -22,19 +22,12 @@ set -o xtrace
 # This directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 
-# Source lower level functions
-. $TOP_DIR/../../functions
-
 # Include onexit commands
 . $TOP_DIR/scripts/on_exit.sh
 
 # xapi functions
 . $TOP_DIR/functions
 
-# Determine what system we are running on.
-# Might not be XenServer if we're using xenserver-core
-GetDistro
-
 # Source params - override xenrc params in your localrc to suite your taste
 source xenrc
 
diff --git a/tools/xen/scripts/install_ubuntu_template.sh b/tools/xen/scripts/install_ubuntu_template.sh
index d4d6567a40..d80ed095e8 100755
--- a/tools/xen/scripts/install_ubuntu_template.sh
+++ b/tools/xen/scripts/install_ubuntu_template.sh
@@ -14,9 +14,6 @@ set -o xtrace
 # This directory
 BASE_DIR=$(cd $(dirname "$0") && pwd)
 
-# Source the top level functions
-source $BASE_DIR/../../../functions
-
 # For default setings see xenrc
 source $BASE_DIR/../xenrc
 
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 510c5f9c46..0cbf86118d 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -91,7 +91,24 @@ UBUNTU_INST_GATEWAY=""
 # Set the size to 0 to avoid creation of additional disk.
 XEN_XVDB_SIZE_GB=0
 
-restore_nounset=`set +o | grep nounset`
+STACK_USER=stack
+DOMZERO_USER=domzero
+
+RC_DIR="../.."
+
+restore_nounset=$(set +o | grep nounset)
 set +u
-source ../../stackrc
+
+## Note that the lines below are coming from stackrc to support
+## new-style config files
+
+# allow local overrides of env variables, including repo config
+if [[ -f $RC_DIR/localrc ]]; then
+    # Old-style user-supplied config
+    source $RC_DIR/localrc
+elif [[ -f $RC_DIR/.localrc.auto ]]; then
+    # New-style user-supplied config extracted from local.conf
+    source $RC_DIR/.localrc.auto
+fi
+
 $restore_nounset

From 20522e3b0e69c1f37ebeb7b4a66d9ced9e2a4236 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 15 Oct 2014 19:53:11 +0900
Subject: [PATCH 0051/3333] Add pcre devel package for Horizon

pyScss python module uses pcre if available for performance
and it is better to be installed.
This commit adds it for files/{apts,rpms}/horizon.

Change-Id: If711fa222d3f395efd670334c8a84f35d195dc25
---
 files/apts/horizon | 1 +
 files/rpms/horizon | 1 +
 2 files changed, 2 insertions(+)

diff --git a/files/apts/horizon b/files/apts/horizon
index 03df3cba97..5d06928c7b 100644
--- a/files/apts/horizon
+++ b/files/apts/horizon
@@ -17,3 +17,4 @@ python-mox
 python-coverage
 python-cherrypy3 # why?
 python-migrate
+libpcre3-dev  # pyScss
diff --git a/files/rpms/horizon b/files/rpms/horizon
index fe3a2f40c0..7add23a549 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -19,3 +19,4 @@ python-sphinx
 python-sqlalchemy
 python-webob
 pyxattr
+pcre-devel  # pyScss

From 18d6298ea1eb0ff9697258dc323f1aba2b9b3d46 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Tue, 28 Oct 2014 13:37:15 -0700
Subject: [PATCH 0052/3333] Make allow_{resize|migrate}_to_same_host
 configurable

In preparation for supporting 2 node devstack jobs, where the first node
is an all in one and the second is a compute node. Make nova config
options allow_resize_to_same_host and allow_migrate_to_same_host
configurable so we can turn them off when we have two compute nodes.

Change-Id: If6989200b56c4597d6e8506d0dda2cc75d0881f1
---
 lib/nova | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index f47dc9798c..0f838072c1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -137,6 +137,10 @@ FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 # running the VM - removing a SPOF and bandwidth bottleneck.
 MULTI_HOST=`trueorfalse False $MULTI_HOST`
 
+# ``NOVA_ALLOW_MOVE_TO_SAME_HOST` can be set to False in multi node devstack,
+# where there are at least two nova-computes.
+NOVA_ALLOW_MOVE_TO_SAME_HOST=`trueorfalse True $NOVA_ALLOW_MOVE_TO_SAME_HOST`
+
 # Test floating pool and range are used for testing.  They are defined
 # here until the admin APIs can replace nova-manage
 TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
@@ -411,8 +415,10 @@ function create_nova_conf {
     rm -f $NOVA_CONF
     iniset $NOVA_CONF DEFAULT verbose "True"
     iniset $NOVA_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
-    iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
-    iniset $NOVA_CONF DEFAULT allow_migrate_to_same_host "True"
+    if [ "$NOVA_ALLOW_MOVE_TO_SAME_HOST" == "True" ]; then
+        iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
+        iniset $NOVA_CONF DEFAULT allow_migrate_to_same_host "True"
+    fi
     iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"

From 627ca74b51d68651a6cd042d83a0386713f15b39 Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Wed, 29 Oct 2014 17:01:15 -0700
Subject: [PATCH 0053/3333] [Sahara] Copy policy.json if it exists

To enable policy check in Sahara we need gate tests passed.
Tests will not pass until Sahara has default policy.json (
e.g. http://logs.openstack.org/09/131609/1/check/check-tempest-dsvm-full/536d5e7/console.html).
New code will copy of policy.json if it exists.

So, for now this code will do nothing.
Once policy.json appears in etc/sahara, the code will start coping
it to sahara conf dir. This will allow to merge auth support with
gate tests passed.

Related blueprint: auth-policy

Change-Id: I98e108ff02aacb91570f97e457d67dd02779ae3d
---
 lib/sahara | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/sahara b/lib/sahara
index 5c7c2534e2..7f59cc1f2e 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -98,6 +98,10 @@ function configure_sahara {
     fi
     sudo chown $STACK_USER $SAHARA_CONF_DIR
 
+    if [[ -f $SAHARA_DIR/etc/sahara/policy.json ]]; then
+        cp -p $SAHARA_DIR/etc/sahara/policy.json $SAHARA_CONF_DIR
+    fi
+
     # Copy over sahara configuration file and configure common parameters.
     cp $SAHARA_DIR/etc/sahara/sahara.conf.sample $SAHARA_CONF_FILE
 

From 17314d242e1fea5a5ebc602c2a72fc28fb5473b4 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 29 Oct 2014 22:11:05 -0500
Subject: [PATCH 0054/3333] Remove old guides

Change-Id: I2f8cd36aef1e0018ed4d5619c934dc9772823656
---
 doc/source/guides/pxe-boot.rst | 140 ---------------------------------
 doc/source/guides/ramdisk.rst  |  86 --------------------
 doc/source/guides/usb-boot.rst |  57 --------------
 3 files changed, 283 deletions(-)
 delete mode 100644 doc/source/guides/pxe-boot.rst
 delete mode 100644 doc/source/guides/ramdisk.rst
 delete mode 100644 doc/source/guides/usb-boot.rst

diff --git a/doc/source/guides/pxe-boot.rst b/doc/source/guides/pxe-boot.rst
deleted file mode 100644
index f745abb7e4..0000000000
--- a/doc/source/guides/pxe-boot.rst
+++ /dev/null
@@ -1,140 +0,0 @@
-`DevStack </>`__
-
--  `Overview <../overview.html>`__
--  `Changes <../changes.html>`__
--  `FAQ <../faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-PXE Boot Server Guide: Magic Dust for Network Boot
-==================================================
-
-Boot DevStack from a PXE server to a RAM disk.
-
-Prerequisites Hardware & OpenWRT
---------------------------------
-
-Hardware
-~~~~~~~~
-
-The whole point of this exercise is to have a highly portable boot
-server, so using a small router with a USB port is the desired platform.
-This guide uses a Buffalo WZR-HP-G300NH as an example, but it is easily
-generalized for other supported platforms. See openwrt.org for more.
-
-OpenWRT
-~~~~~~~
-
-Any recent 'Backfire' build of OpenWRT will work for the boot server
-project. We build from trunk and have made the images available at
-`http://openwrt.xr7.org/openwrt <http://openwrt.xr7.org/openwrt>`__.
-
-Installation bit blasting
--------------------------
-
-Install the Image
-~~~~~~~~~~~~~~~~~
-
-This process follows `the OpenWRT doc OEM
-Install <http://wiki.openwrt.org/toh/buffalo/wzr-hp-g300h>`__ to tftp
-the new image onto the router. You need a computer to set up the router,
-we assume it is a recent Linux or OS/X installation.
-
--  Get openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
-
-   ::
-
-       wget http://openwrt.xr7.org/openwrt/ar71xx/openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
-
--  Connect computer to LAN port 4 (closest to WAN port)
--  Set computer interface to IP address in the 192.168.11.2
--  Add static arp entry for router
-
-   ::
-
-       arp -s 192.168.11.1 <mac-address>
-
--  Start TFTP transfer attempt
-
-   ::
-
-       tftp 192.168.11.1
-       binary
-       rexmt 1
-       timeout 60
-       put openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
-
--  Power on router. Router will reboot and initialize on 192.168.1.1.
--  Delete static arp entry for router
-
-   ::
-
-       arp -d 192.168.11.1
-
--  Set computer to DHCP, connect and telnet to router and set root
-   password.
-
-Configure the Router
-~~~~~~~~~~~~~~~~~~~~
-
--  Update ``/etc/opkg.conf`` to point to our repo:
-
-   ::
-
-       src/gz packages http://192.168.5.13/openwrt/build/ar71xx/packages
-
--  Configure anon mounts:
-
-   ::
-
-       uci delete fstab.@mount[0]
-       uci commit fstab
-       /etc/init.d/fstab restart
-
--  Reset the DHCP address range. DevStack will claim the upper /25 of
-   the router's LAN address space for floating IPs so the default DHCP
-   address range needs to be moved:
-
-   ::
-
-       uci set dhcp.lan.start=65
-       uci set dhcp.lan.limit=60
-       uci commit dhcp
-
--  Enable TFTP:
-
-   ::
-
-       uci set dhcp.@dnsmasq[0].enable_tftp=1
-       uci set dhcp.@dnsmasq[0].tftp_root=/mnt/sda1/tftpboot
-       uci set dhcp.@dnsmasq[0].dhcp_boot=pxelinux.0
-       uci commit dhcp
-       /etc/init.d/dnsmasq restart
-
-Set Up tftpboot
-~~~~~~~~~~~~~~~
-
--  Create the ``/tmp/tftpboot`` structure and populate it:
-
-   ::
-
-       cd ~/devstack
-       tools/build_pxe_boot.sh /tmp
-
-   This calls ``tools/build_ramdisk.sh`` to create a 2GB ramdisk
-   containing a complete development Oneiric OS plus the OpenStack code
-   checkouts.
-
--  Copy ``tftpboot`` to a USB drive:
-
-   ::
-
-       mount /dev/sdb1 /mnt/tmp
-       rsync -a /tmp/tftpboot/ /mnt/tmp/tftpboot/
-       umount /mnt/tmp
-
--  Plug USB drive into router. It will be automounted and is ready to
-   serve content.
-
-Now `return <ramdisk.html>`__ to the RAM disk Guide to kick off your
-DevStack experience.
diff --git a/doc/source/guides/ramdisk.rst b/doc/source/guides/ramdisk.rst
deleted file mode 100644
index 1ba74f2322..0000000000
--- a/doc/source/guides/ramdisk.rst
+++ /dev/null
@@ -1,86 +0,0 @@
-`DevStack </>`__
-
--  `Overview <../overview.html>`__
--  `Changes <../changes.html>`__
--  `FAQ <../faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Stack-in-a-Box: Try before you mkfs
-===================================
-
-Run DevStack from a RAM disk to give it a whirl before making the
-commitment to install it. We'll cover booting from a USB drive or over
-the network via PXE. We'll even thow in configuring a home router to
-handle the PXE boot. You will need a minimum of 3GB for both of these
-configurations as the RAM disk itself is 2GB.
-
-Prerequisites Hardware
-----------------------
-
-USB Boot
-~~~~~~~~
-
-`This guide <usb-boot.html>`__ covers the creation of a bootable USB
-drive. Your computer BIOS must support booting from USB.
-
-PXE Boot
-~~~~~~~~
-
-`This guide <pxe-boot.html>`__ covers the installation of OpenWRT on a
-home router and configuring it as a PXE server, plus the creation of the
-boot images and PXE support files.
-
-Installation bit blasting
--------------------------
-
-Install DevStack
-~~~~~~~~~~~~~~~~
-
-Grab the latest version of DevStack via https:
-
-::
-
-    sudo apt-get install git -y
-    git clone https://git.openstack.org/openstack-dev/devstack
-    cd devstack
-
-Prepare the Boot RAMdisk
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-Pick your boot method and follow the guide to prepare to build the RAM
-disk and set up the boot process:
-
--  `USB boot <usb-boot.html>`__
--  `PXE boot <pxe-boot.html>`__
-
-Fire It Up
-~~~~~~~~~~
-
--  Boot the computer into the RAM disk. The details will vary from
-   machine to machine but most BIOSes have a method to select the boot
-   device, often by pressing F12 during POST.
--  Select 'DevStack' from the Boot Menu.
--  Log in with the 'stack' user and 'pass' password.
--  Create ``devstack/localrc`` if you wish to change any of the
-   configuration variables. You will probably want to at least set the
-   admin login password to something memorable rather than the default
-   20 random characters:
-
-   ::
-
-       ADMIN_PASSWORD=openstack
-
--  Fire up OpenStack!
-
-   ::
-
-       ./run.sh
-
--  See the processes running in screen:
-
-   ::
-
-       screen -x
-
--  Connect to the dashboard at ``http://<ip-address>/``
diff --git a/doc/source/guides/usb-boot.rst b/doc/source/guides/usb-boot.rst
deleted file mode 100644
index 4f7a49425b..0000000000
--- a/doc/source/guides/usb-boot.rst
+++ /dev/null
@@ -1,57 +0,0 @@
-`DevStack </>`__
-
--  `Overview <../overview.html>`__
--  `Changes <../changes.html>`__
--  `FAQ <../faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-USB Boot: Undoable Stack Boot
-=============================
-
-Boot DevStack from a USB disk into a RAM disk.
-
-Prerequisites
--------------
-
-Hardware
-~~~~~~~~
-
-This guide covers the creation of a bootable USB drive. Your computer
-BIOS must support booting from USB and You will want at least 3GB of
-RAM. You also will need a USB drive of at least 2GB.
-
-Software
-~~~~~~~~
-
-Ubuntu 11.10 (Oneiric Ocelot) is required on host to create images.
-
-Installation bit blasting
--------------------------
-
-Set Up USB Drive
-~~~~~~~~~~~~~~~~
-
--  Insert the USB drive into the computer. Make a note of the device
-   name, such as ``sdb``. Do not mount the device.
--  Install the boot system:
-
-   ::
-
-       tools/build_usb_boot.sh /dev/sdb1
-
-   This calls tools/build\_ramdisk.sh to create a 2GB ramdisk containing
-   a complete development Oneiric OS plus the OpenStack code checkouts.
-   It then writes a syslinux boot sector to the specified device and
-   creates ``/syslinux``.
-
--  If desired, you may now mount the device:
-
-   ::
-
-       mount /dev/sdb1 /mnt/tmp
-       # foo
-       umount /mnt/tmp
-
-Now `return <ramdisk.html>`__ to the RAM disk Guide to kick off your
-DevStack experience.

From 28d4392d56c6a493dd71c4a5a5f64f6dee36dd01 Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Wed, 29 Oct 2014 17:25:12 -0700
Subject: [PATCH 0055/3333] Set permissions on sahara cache

Signing certificate directory should have 700 mode.
Before the change it was created with 755.

As a visual impact this CR removes warning from
keystonemiddleware.

Change-Id: I8483e73447348b9a9e33dfd382543978a70a9d43
Closes-Bug: #1387416
---
 lib/sahara | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/sahara b/lib/sahara
index 5c7c2534e2..42e8e016d8 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -104,6 +104,7 @@ function configure_sahara {
     # Create auth cache dir
     sudo mkdir -p $SAHARA_AUTH_CACHE_DIR
     sudo chown $STACK_USER $SAHARA_AUTH_CACHE_DIR
+    sudo chmod 700 $SAHARA_AUTH_CACHE_DIR
     rm -rf $SAHARA_AUTH_CACHE_DIR/*
 
     configure_auth_token_middleware $SAHARA_CONF_FILE sahara $SAHARA_AUTH_CACHE_DIR

From 74b28bc43b9570496f2b67688e0c4c04aa273733 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Wed, 29 Oct 2014 14:15:22 -0700
Subject: [PATCH 0056/3333] Add iptables rule for Ironic VMs -> Swift

The agent ramdisk gets instance images from swift, set firewall
rules to allow this.

Also configure Ironic API port using the correct variable, and
use SWIFT_DEFAULT_BIND_PORT for Swift ports everywhere.

Change-Id: Ieec8cc64e504b04a21daa49e90e2d4925f4838ee
---
 lib/ironic | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 0a84e47ebc..cf005a74d6 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -279,7 +279,7 @@ function configure_ironic_conductor {
         else
             die $LINENO "SWIFT_ENABLE_TEMPURLS must be True to use agent_ssh driver in Ironic."
         fi
-        iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:8080
+        iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:${SWIFT_DEFAULT_BIND_PORT:-8080}
         iniset $IRONIC_CONF_FILE glance swift_api_version v1
         local tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME)
         iniset $IRONIC_CONF_FILE glance swift_account AUTH_${tenant_id}
@@ -523,7 +523,11 @@ function configure_iptables {
     sudo modprobe nf_nat_tftp
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 6385 -j ACCEPT || true
+    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HOSTPORT -j ACCEPT || true
+    if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
+        # agent ramdisk gets instance image from swift
+        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
+    fi
 }
 
 function configure_tftpd {
@@ -678,6 +682,10 @@ function cleanup_baremetal_basic_ops {
     restart_service xinetd
     sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
     sudo iptables -D INPUT -d $HOST_IP -p tcp --dport 6385 -j ACCEPT || true
+    if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
+        # agent ramdisk gets instance image from swift
+        sudo iptables -D INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
+    fi
     sudo rmmod nf_conntrack_tftp || true
     sudo rmmod nf_nat_tftp || true
 }

From 292b2a7ee61f9b034230e8c99d2e5c7154dcf79b Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Fri, 31 Oct 2014 13:48:58 +0900
Subject: [PATCH 0057/3333] Workaround openrc failure on zsh

The recent GIT_DEPTH change introduced a [[ ]] construct
which doesn't work for zsh 5.0.2.  Workaround it by tweaking the test.

The following is a demonstration to show how zsh behaves:

    % if [[ "" ]];then echo hoge;fi
    zsh: parse error near `]]'
    % if [[ "x" ]];then echo hoge;fi
    zsh: parse error near `]]'
    % if [[ -n "" ]];then echo hoge;fi
    % if [[ -n "x" ]];then echo hoge;fi
    hoge
    %

Closes-Bug: #1387943
Change-Id: Ia88de876dacb3664a7c3d8f5a035e8e50fddb678
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 48edba8da6..818e165df7 100644
--- a/functions-common
+++ b/functions-common
@@ -575,7 +575,7 @@ function git_clone {
 
     RECLONE=$(trueorfalse False $RECLONE)
 
-    if [[ "$GIT_DEPTH" ]]; then
+    if [[ -n "${GIT_DEPTH}" ]]; then
         git_clone_flags="$git_clone_flags --depth $GIT_DEPTH"
     fi
 

From cd1c3c7adb45e6fda75df48d0313aad8836a7453 Mon Sep 17 00:00:00 2001
From: Kashyap Kopparam <kashyapk@thoughtworks.com>
Date: Fri, 31 Oct 2014 17:32:57 +0530
Subject: [PATCH 0058/3333] added the localrc section to the local.conf

Change-Id: Iffcc61ca886df96e1dc7c0df3c02125cb2b4a7dc
---
 doc/source/guides/multinode-lab.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index a63260fe6f..0b1ebb931b 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -167,6 +167,7 @@ machines, create a ``local.conf`` with:
 
 ::
 
+    [[local|localrc]]
     HOST_IP=192.168.42.12 # change this per compute node
     FLAT_INTERFACE=eth0
     FIXED_RANGE=10.4.128.0/20

From 8fceb49820cb299ad2957b280724e10bb8f1196d Mon Sep 17 00:00:00 2001
From: Chmouel Boudjnah <chmouel@enovance.com>
Date: Thu, 2 Oct 2014 20:58:20 +0200
Subject: [PATCH 0059/3333] Only sysctl reserverd ports when available.

Only set the keystone reserved ports when available, on some system
(like when running under containers) where this sysfs interface is not
exposed we are almost pretty sure these ports would be exclusive for our
devstack.

Change-Id: I06d7d227ae94d564c91c16119e4bbbcc6564a280
---
 tools/fixup_stuff.sh | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 1732eccdbe..b8beb01583 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -50,17 +50,24 @@ fi
 # exception into the Kernel for the Keystone AUTH ports.
 keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
 
-# Get any currently reserved ports, strip off leading whitespace
-reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-if [[ -z "${reserved_ports}" ]]; then
-    # If there are no currently reserved ports, reserve the keystone ports
-    sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+# only do the reserved ports when available, on some system (like containers)
+# where it's not exposed we are almost pretty sure these ports would be
+# exclusive for our devstack.
+if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
+    # Get any currently reserved ports, strip off leading whitespace
+    reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
+
+    if [[ -z "${reserved_ports}" ]]; then
+        # If there are no currently reserved ports, reserve the keystone ports
+        sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+    else
+        # If there are currently reserved ports, keep those and also reserve the
+        # keystone specific ports. Duplicate reservations are merged into a single
+        # reservation (or range) automatically by the kernel.
+        sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+    fi
 else
-    # If there are currently reserved ports, keep those and also reserve the
-    # keystone specific ports. Duplicate reservations are merged into a single
-    # reservation (or range) automatically by the kernel.
-    sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+    echo_summary "WARNING: unable to reserve keystone ports"
 fi
 
 

From 5a91c3548370d3de856e5522f2d11775278115cf Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Fri, 31 Oct 2014 18:48:00 +0100
Subject: [PATCH 0060/3333] USe `trueorfalse` for INSTALL_TESTONLY_PACKAGES

INSTALL_TESTONLY_PACKAGES is assumed to be set to `True` or `False`.
However, in devstack-gate this variable is set to 0 or 1. The patch uses
the already existing `trueorfalse` function to evaluate
INSTALL_TESTONLY_PACKAGES and normalize its value.

Change-Id: I0e4a31e422bad2a31d919d9f871e24833a0faa99
---
 functions-common | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/functions-common b/functions-common
index 48edba8da6..b9eaae5db3 100644
--- a/functions-common
+++ b/functions-common
@@ -993,6 +993,8 @@ function get_packages {
     local file_to_parse
     local service
 
+    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False $INSTALL_TESTONLY_PACKAGES)
+
     if [[ -z "$package_dir" ]]; then
         echo "No package directory supplied"
         return 1
@@ -1599,6 +1601,7 @@ function pip_install {
         $cmd_pip install \
         $pip_mirror_opt $@
 
+    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False $INSTALL_TESTONLY_PACKAGES)
     if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
         local test_req="$@/test-requirements.txt"
         if [[ -e "$test_req" ]]; then

From 213f13a28399657955be263c936db0a87310b5b1 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 30 Oct 2014 19:49:20 -0400
Subject: [PATCH 0061/3333] Don't hardcode glance protocol when finding trove
 guest image

This allows configuration of trove when devstack is configured
for SSL or tls-proxy.

Change-Id: I680effda94926951f9068e2df1e354c708aa4495
---
 lib/trove | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/trove b/lib/trove
index 1d1b5f406b..4ac7293fbd 100644
--- a/lib/trove
+++ b/lib/trove
@@ -207,7 +207,7 @@ function init_trove {
     # The image is uploaded by stack.sh -- see $IMAGE_URLS handling
     GUEST_IMAGE_NAME=$(basename "$TROVE_GUEST_IMAGE_URL")
     GUEST_IMAGE_NAME=${GUEST_IMAGE_NAME%.*}
-    TROVE_GUEST_IMAGE_ID=$(openstack --os-token $TOKEN --os-url http://$GLANCE_HOSTPORT image list | grep "${GUEST_IMAGE_NAME}" | get_field 1)
+    TROVE_GUEST_IMAGE_ID=$(openstack --os-token $TOKEN --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image list | grep "${GUEST_IMAGE_NAME}" | get_field 1)
     if [ -z "$TROVE_GUEST_IMAGE_ID" ]; then
         # If no glance id is found, skip remaining setup
         echo "Datastore ${TROVE_DATASTORE_TYPE} will not be created: guest image ${GUEST_IMAGE_NAME} not found."

From 27a196e26064aba615b0177435071d569b82389b Mon Sep 17 00:00:00 2001
From: Tan Lin <tan.lin.good@gmail.com>
Date: Fri, 31 Oct 2014 15:44:34 +0800
Subject: [PATCH 0062/3333] Add options to enable using DHCP agent
 Metadata-proxy

Add options to support DHCP agent providing metadata-proxy.
In some cases, users have to disable L3 Agent. But people still
need metadata services.

Change-Id: I4664fc3a4937c3b7b5c27e74f509b683ffbedd09
---
 lib/neutron | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 98636b4b41..573fd6fbb0 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -229,6 +229,14 @@ TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-$HOST_IP}
 # Example: ``OVS_ENABLE_TUNNELING=True``
 OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
 
+# Use DHCP agent for providing metadata service in the case of
+# without L3 agent (No Route Agent), set to True in localrc.
+ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
+
+# Add a static route as dhcp option, so the request to 169.254.169.254
+# will be able to reach through a route(DHCP agent)
+# This option require ENABLE_ISOLATED_METADATA = True
+ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
 # Neutron plugin specific functions
 # ---------------------------------
 
@@ -687,6 +695,17 @@ function _configure_neutron_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_DHCP_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
 
+    if ! is_service_enabled q-l3; then
+        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
+        else
+            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
+                die "$LINENO" "Enable isolated metadata is a must for metadata network"
+            fi
+        fi
+    fi
+
     _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
 
     neutron_plugin_configure_dhcp_agent

From 5cb190697c1bce5dcd2ad843922813b0cc74bd24 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Sat, 1 Nov 2014 01:37:45 +0100
Subject: [PATCH 0063/3333] support installing clients at released versions

expand the devstack support for libraries from released versions to
support python-* clients and tempest_lib.

Depends-On: I81b0d228e7769758c61e5b0323ecfce8c8886d39

Change-Id: I26fac0ccf8fd4818e24618d56bf04b32306f88f6
---
 extras.d/70-trove.sh |  1 -
 functions-common     |  1 +
 lib/ceilometer       | 11 ++++++----
 lib/cinder           | 11 ++++++----
 lib/glance           |  9 ++++++---
 lib/heat             | 11 ++++++----
 lib/ironic           | 14 +++++++++----
 lib/keystone         | 11 ++++++----
 lib/neutron          | 12 +++++++----
 lib/nova             | 12 +++++++----
 lib/swift            | 10 ++++++---
 lib/tempest          |  9 ++++++---
 lib/trove            | 12 +++++------
 stack.sh             | 12 ++++++++---
 stackrc              | 48 ++++++++++++++++++++++----------------------
 15 files changed, 113 insertions(+), 71 deletions(-)

diff --git a/extras.d/70-trove.sh b/extras.d/70-trove.sh
index a4dc7fbc5b..f284354e1f 100644
--- a/extras.d/70-trove.sh
+++ b/extras.d/70-trove.sh
@@ -11,7 +11,6 @@ if is_service_enabled trove; then
         cleanup_trove
     elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
         echo_summary "Configuring Trove"
-        configure_troveclient
         configure_trove
 
         if is_service_enabled key; then
diff --git a/functions-common b/functions-common
index 48edba8da6..4e6ad14437 100644
--- a/functions-common
+++ b/functions-common
@@ -1621,6 +1621,7 @@ function use_library_from_git {
     return $enabled
 }
 
+
 # setup a library by name. If we are trying to use the library from
 # git, we'll do a git based install, otherwise we'll punt and the
 # library should be installed by a requirements pull from another
diff --git a/lib/ceilometer b/lib/ceilometer
index 9046b9d3d9..b1ff8b4157 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -35,8 +35,9 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["ceilometerclient"]=$DEST/python-ceilometerclient
+
 CEILOMETER_DIR=$DEST/ceilometer
-CEILOMETERCLIENT_DIR=$DEST/python-ceilometerclient
 CEILOMETER_CONF_DIR=/etc/ceilometer
 CEILOMETER_CONF=$CEILOMETER_CONF_DIR/ceilometer.conf
 CEILOMETER_API_LOG_DIR=/var/log/ceilometer-api
@@ -254,9 +255,11 @@ function install_ceilometer {
 
 # install_ceilometerclient() - Collect source and prepare
 function install_ceilometerclient {
-    git_clone $CEILOMETERCLIENT_REPO $CEILOMETERCLIENT_DIR $CEILOMETERCLIENT_BRANCH
-    setup_develop $CEILOMETERCLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$CEILOMETERCLIENT_DIR/tools/,/etc/bash_completion.d/}ceilometer.bash_completion
+    if use_library_from_git "ceilometerclient"; then
+        git_clone_by_name "ceilometerclient"
+        setup_develop "ceilometerclient"
+        sudo install -D -m 0644 -o $STACK_USER {$CEILOMETERCLIENT_DIR/tools/,/etc/bash_completion.d/}ceilometer.bash_completion
+    fi
 }
 
 # start_ceilometer() - Start running processes, including screen
diff --git a/lib/cinder b/lib/cinder
index 29cda42eb2..56878642e3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -36,8 +36,9 @@ if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
 fi
 
 # set up default directories
+GITDIR["cinderclient"]=$DEST/python-cinderclient
+
 CINDER_DIR=$DEST/cinder
-CINDERCLIENT_DIR=$DEST/python-cinderclient
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
 CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
@@ -402,9 +403,11 @@ function install_cinder {
 
 # install_cinderclient() - Collect source and prepare
 function install_cinderclient {
-    git_clone $CINDERCLIENT_REPO $CINDERCLIENT_DIR $CINDERCLIENT_BRANCH
-    setup_develop $CINDERCLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$CINDERCLIENT_DIR/tools/,/etc/bash_completion.d/}cinder.bash_completion
+    if use_library_from_git "cinderclient"; then
+        git_clone_by_name "cinderclient"
+        setup_develop "cinderclient"
+        sudo install -D -m 0644 -o $STACK_USER {$CINDERCLIENT_DIR/tools/,/etc/bash_completion.d/}cinder.bash_completion
+    fi
 }
 
 # apply config.d approach for cinder volumes directory
diff --git a/lib/glance b/lib/glance
index 4194842407..8cd48b13f9 100644
--- a/lib/glance
+++ b/lib/glance
@@ -27,9 +27,10 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["glanceclient"]=$DEST/python-glanceclient
+
 GLANCE_DIR=$DEST/glance
 GLANCE_STORE_DIR=$DEST/glance_store
-GLANCECLIENT_DIR=$DEST/python-glanceclient
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
@@ -286,8 +287,10 @@ function init_glance {
 
 # install_glanceclient() - Collect source and prepare
 function install_glanceclient {
-    git_clone $GLANCECLIENT_REPO $GLANCECLIENT_DIR $GLANCECLIENT_BRANCH
-    setup_develop $GLANCECLIENT_DIR
+    if use_library_from_git "glanceclient"; then
+        git_clone_by_name "glanceclient"
+        setup_develop "glanceclient"
+    fi
 }
 
 # install_glance() - Collect source and prepare
diff --git a/lib/heat b/lib/heat
index 53eca25450..ed5181b2b8 100644
--- a/lib/heat
+++ b/lib/heat
@@ -29,8 +29,9 @@ set +o xtrace
 # --------
 
 # set up default directories
+GITDIR["heatclient"]=$DEST/python-heatclient
+
 HEAT_DIR=$DEST/heat
-HEATCLIENT_DIR=$DEST/python-heatclient
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
 HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
@@ -183,9 +184,11 @@ function create_heat_cache_dir {
 
 # install_heatclient() - Collect source and prepare
 function install_heatclient {
-    git_clone $HEATCLIENT_REPO $HEATCLIENT_DIR $HEATCLIENT_BRANCH
-    setup_develop $HEATCLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$HEATCLIENT_DIR/tools/,/etc/bash_completion.d/}heat.bash_completion
+    if use_library_from_git "heatclient"; then
+        git_clone_by_name "heatclient"
+        setup_develop "heatclient"
+        sudo install -D -m 0644 -o $STACK_USER {$HEATCLIENT_DIR/tools/,/etc/bash_completion.d/}heat.bash_completion
+    fi
 }
 
 # install_heat() - Collect source and prepare
diff --git a/lib/ironic b/lib/ironic
index 0a84e47ebc..0fadb8d0a1 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -28,11 +28,12 @@ set +o pipefail
 # --------
 
 # Set up default directories
+GITDIR["ironicclient"]=$DEST/python-ironicclient
+
 IRONIC_DIR=$DEST/ironic
 IRONIC_PYTHON_AGENT_DIR=$DEST/ironic-python-agent
 IRONIC_DATA_DIR=$DATA_DIR/ironic
 IRONIC_STATE_PATH=/var/lib/ironic
-IRONICCLIENT_DIR=$DEST/python-ironicclient
 IRONIC_AUTH_CACHE_DIR=${IRONIC_AUTH_CACHE_DIR:-/var/cache/ironic}
 IRONIC_CONF_DIR=${IRONIC_CONF_DIR:-/etc/ironic}
 IRONIC_CONF_FILE=$IRONIC_CONF_DIR/ironic.conf
@@ -150,9 +151,14 @@ function install_ironic {
 
 # install_ironicclient() - Collect sources and prepare
 function install_ironicclient {
-    git_clone $IRONICCLIENT_REPO $IRONICCLIENT_DIR $IRONICCLIENT_BRANCH
-    setup_develop $IRONICCLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$IRONICCLIENT_DIR/tools/,/etc/bash_completion.d/}ironic.bash_completion
+    if use_library_from_git "ironicclient"; then
+        git_clone_by_name "ironicclient"
+        setup_develop "ironicclient"
+        sudo install -D -m 0644 -o $STACK_USER {$IRONICCLIENT_DIR/tools/,/etc/bash_completion.d/}ironic.bash_completion
+    else
+        # nothing actually "requires" ironicclient, so force instally from pypi
+        pip_install python-ironicclient
+    fi
 }
 
 # _cleanup_ironic_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
diff --git a/lib/keystone b/lib/keystone
index 276e9718a6..6341ce2eea 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -33,6 +33,8 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["keystoneclient"]=$DEST/python-keystoneclient
+
 KEYSTONE_DIR=$DEST/keystone
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
@@ -45,7 +47,6 @@ else
 fi
 
 KEYSTONEMIDDLEWARE_DIR=$DEST/keystonemiddleware
-KEYSTONECLIENT_DIR=$DEST/python-keystoneclient
 
 # Set up additional extensions, such as oauth1, federation
 # Example of KEYSTONE_EXTENSIONS=oauth1,federation
@@ -479,9 +480,11 @@ function init_keystone {
 
 # install_keystoneclient() - Collect source and prepare
 function install_keystoneclient {
-    git_clone $KEYSTONECLIENT_REPO $KEYSTONECLIENT_DIR $KEYSTONECLIENT_BRANCH
-    setup_develop $KEYSTONECLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$KEYSTONECLIENT_DIR/tools/,/etc/bash_completion.d/}keystone.bash_completion
+    if use_library_from_git "keystoneclient"; then
+        git_clone_by_name "keystoneclient"
+        setup_develop "keystoneclient"
+        sudo install -D -m 0644 -o $STACK_USER {$KEYSTONECLIENT_DIR/tools/,/etc/bash_completion.d/}keystone.bash_completion
+    fi
 }
 
 # install_keystonemiddleware() - Collect source and prepare
diff --git a/lib/neutron b/lib/neutron
index d05dcc806f..faca3e0da2 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -77,8 +77,10 @@ fi
 
 
 # Set up default directories
+GITDIR["neutronclient"]=$DEST/python-neutronclient
+
+
 NEUTRON_DIR=$DEST/neutron
-NEUTRONCLIENT_DIR=$DEST/python-neutronclient
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
@@ -601,9 +603,11 @@ function install_neutron {
 
 # install_neutronclient() - Collect source and prepare
 function install_neutronclient {
-    git_clone $NEUTRONCLIENT_REPO $NEUTRONCLIENT_DIR $NEUTRONCLIENT_BRANCH
-    setup_develop $NEUTRONCLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$NEUTRONCLIENT_DIR/tools/,/etc/bash_completion.d/}neutron.bash_completion
+    if use_library_from_git "neutronclient"; then
+        git_clone_by_name "neutronclient"
+        setup_develop "neutronclient"
+        sudo install -D -m 0644 -o $STACK_USER {$NEUTRONCLIENT_DIR/tools/,/etc/bash_completion.d/}neutron.bash_completion
+    fi
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
diff --git a/lib/nova b/lib/nova
index 0f838072c1..d5f11928e5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -29,8 +29,10 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["novaclient"]=$DEST/python-novaclient
+
+
 NOVA_DIR=$DEST/nova
-NOVACLIENT_DIR=$DEST/python-novaclient
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
@@ -637,9 +639,11 @@ function init_nova {
 
 # install_novaclient() - Collect source and prepare
 function install_novaclient {
-    git_clone $NOVACLIENT_REPO $NOVACLIENT_DIR $NOVACLIENT_BRANCH
-    setup_develop $NOVACLIENT_DIR
-    sudo install -D -m 0644 -o $STACK_USER {$NOVACLIENT_DIR/tools/,/etc/bash_completion.d/}nova.bash_completion
+    if use_library_from_git "novaclient"; then
+        git_clone_by_name "novaclient"
+        setup_develop "novaclient"
+        sudo install -D -m 0644 -o $STACK_USER {$NOVACLIENT_DIR/tools/,/etc/bash_completion.d/}nova.bash_completion
+    fi
 }
 
 # install_nova() - Collect source and prepare
diff --git a/lib/swift b/lib/swift
index 7ef44969b6..801628241a 100644
--- a/lib/swift
+++ b/lib/swift
@@ -34,8 +34,10 @@ if is_ssl_enabled_service "s-proxy" || is_service_enabled tls-proxy; then
 fi
 
 # Set up default directories
+GITDIR["swiftclient"]=$DEST/python-swiftclient
+
+
 SWIFT_DIR=$DEST/swift
-SWIFTCLIENT_DIR=$DEST/python-swiftclient
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
@@ -675,8 +677,10 @@ function install_swift {
 }
 
 function install_swiftclient {
-    git_clone $SWIFTCLIENT_REPO $SWIFTCLIENT_DIR $SWIFTCLIENT_BRANCH
-    setup_develop $SWIFTCLIENT_DIR
+    if use_library_from_git "swiftclient"; then
+        git_clone_by_name "swiftclient"
+        setup_develop "swiftclient"
+    fi
 }
 
 # start_swift() - Start running processes, including screen
diff --git a/lib/tempest b/lib/tempest
index 66f1a788f1..25dc171fe2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -45,11 +45,12 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["tempest_lib"]=$DEST/tempest-lib
+
 TEMPEST_DIR=$DEST/tempest
 TEMPEST_CONFIG_DIR=${TEMPEST_CONFIG_DIR:-$TEMPEST_DIR/etc}
 TEMPEST_CONFIG=$TEMPEST_CONFIG_DIR/tempest.conf
 TEMPEST_STATE_PATH=${TEMPEST_STATE_PATH:=$DATA_DIR/tempest}
-TEMPEST_LIB_DIR=$DEST/tempest-lib
 
 NOVA_SOURCE_DIR=$DEST/nova
 
@@ -441,8 +442,10 @@ function create_tempest_accounts {
 
 # install_tempest_lib() - Collect source, prepare, and install tempest-lib
 function install_tempest_lib {
-    git_clone $TEMPEST_LIB_REPO $TEMPEST_LIB_DIR $TEMPEST_LIB_BRANCH
-    setup_develop $TEMPEST_LIB_DIR
+    if use_library_from_git "tempest_lib"; then
+        git_clone_by_name "tempest_lib"
+        setup_develop "tempest_lib"
+    fi
 }
 
 # install_tempest() - Collect source and prepare
diff --git a/lib/trove b/lib/trove
index 1d1b5f406b..2f8b696924 100644
--- a/lib/trove
+++ b/lib/trove
@@ -28,8 +28,9 @@ else
 fi
 
 # Set up default configuration
+GITDIR["troveclient"]=$DEST/python-troveclient
+
 TROVE_DIR=$DEST/trove
-TROVECLIENT_DIR=$DEST/python-troveclient
 TROVE_CONF_DIR=/etc/trove
 TROVE_LOCAL_CONF_DIR=$TROVE_DIR/etc/trove
 TROVE_AUTH_CACHE_DIR=${TROVE_AUTH_CACHE_DIR:-/var/cache/trove}
@@ -109,10 +110,6 @@ function cleanup_trove {
     rm -fr $TROVE_CONF_DIR/*
 }
 
-# configure_troveclient() - Set config files, create data dirs, etc
-function configure_troveclient {
-    setup_develop $TROVECLIENT_DIR
-}
 
 # configure_trove() - Set config files, create data dirs, etc
 function configure_trove {
@@ -184,7 +181,10 @@ function configure_trove {
 
 # install_troveclient() - Collect source and prepare
 function install_troveclient {
-    git_clone $TROVECLIENT_REPO $TROVECLIENT_DIR $TROVECLIENT_BRANCH
+    if use_library_from_git "troveclient"; then
+        git_clone_by_name "troveclient"
+        setup_develop "troveclient"
+    fi
 }
 
 # install_trove() - Collect source and prepare
diff --git a/stack.sh b/stack.sh
index ec13338948..5f87a904c3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -585,7 +585,7 @@ if [[ -d $TOP_DIR/extras.d ]]; then
 fi
 
 # Set the destination directories for other OpenStack projects
-OPENSTACKCLIENT_DIR=$DEST/python-openstackclient
+GITDIR["openstackclient"]=$DEST/python-openstackclient
 
 # Interactive Configuration
 # -------------------------
@@ -788,8 +788,14 @@ fi
 # Install middleware
 install_keystonemiddleware
 
-git_clone $OPENSTACKCLIENT_REPO $OPENSTACKCLIENT_DIR $OPENSTACKCLIENT_BRANCH
-setup_develop $OPENSTACKCLIENT_DIR
+# install the OpenStack client, needed for most setup commands
+if use_library_from_git "openstackclient"; then
+    git_clone_by_name "openstackclient"
+    setup_develop "openstackclient"
+else
+    pip_install python-openstackclient
+fi
+
 
 if is_service_enabled key; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
diff --git a/stackrc b/stackrc
index 15b0951a1a..2f08c730be 100644
--- a/stackrc
+++ b/stackrc
@@ -199,8 +199,8 @@ TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 
 # TODO(sdague): this should end up as a library component like below
-TEMPEST_LIB_REPO=${TEMPEST_LIB_REPO:-${GIT_BASE}/openstack/tempest-lib.git}
-TEMPEST_LIB_BRANCH=${TEMPEST_LIB_BRANCH:-master}
+GITREPO["tempest_lib"]=${TEMPEST_LIB_REPO:-${GIT_BASE}/openstack/tempest-lib.git}
+GITBRANCH["tempest_lib"]=${TEMPEST_LIB_BRANCH:-master}
 
 
 ##############
@@ -210,48 +210,48 @@ TEMPEST_LIB_BRANCH=${TEMPEST_LIB_BRANCH:-master}
 ##############
 
 # ceilometer client library
-CEILOMETERCLIENT_REPO=${CEILOMETERCLIENT_REPO:-${GIT_BASE}/openstack/python-ceilometerclient.git}
-CEILOMETERCLIENT_BRANCH=${CEILOMETERCLIENT_BRANCH:-master}
+GITREPO["ceilometerclient"]=${CEILOMETERCLIENT_REPO:-${GIT_BASE}/openstack/python-ceilometerclient.git}
+GITBRANCH["ceilometerclient"]=${CEILOMETERCLIENT_BRANCH:-master}
 
 # volume client
-CINDERCLIENT_REPO=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
-CINDERCLIENT_BRANCH=${CINDERCLIENT_BRANCH:-master}
+GITREPO["cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
+GITBRACH["cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
 # python glance client library
-GLANCECLIENT_REPO=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
-GLANCECLIENT_BRANCH=${GLANCECLIENT_BRANCH:-master}
+GITREPO["glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
+GITBRANCH["glanceclient"]=${GLANCECLIENT_BRANCH:-master}
 
 # python heat client library
-HEATCLIENT_REPO=${HEATCLIENT_REPO:-${GIT_BASE}/openstack/python-heatclient.git}
-HEATCLIENT_BRANCH=${HEATCLIENT_BRANCH:-master}
+GITREPO["heatclient"]=${HEATCLIENT_REPO:-${GIT_BASE}/openstack/python-heatclient.git}
+GITBRANCH["heatclient"]=${HEATCLIENT_BRANCH:-master}
 
 # ironic client
-IRONICCLIENT_REPO=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
-IRONICCLIENT_BRANCH=${IRONICCLIENT_BRANCH:-master}
+GITREPO["ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
+GITBRANCH["ironicclient"]=${IRONICCLIENT_BRANCH:-master}
 
 # python keystone client library to nova that horizon uses
-KEYSTONECLIENT_REPO=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
-KEYSTONECLIENT_BRANCH=${KEYSTONECLIENT_BRANCH:-master}
+GITREPO["keystoneclient"]=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
+GITBRANCH["keystoneclient"]=${KEYSTONECLIENT_BRANCH:-master}
 
 # neutron client
-NEUTRONCLIENT_REPO=${NEUTRONCLIENT_REPO:-${GIT_BASE}/openstack/python-neutronclient.git}
-NEUTRONCLIENT_BRANCH=${NEUTRONCLIENT_BRANCH:-master}
+GITREPO["neutronclient"]=${NEUTRONCLIENT_REPO:-${GIT_BASE}/openstack/python-neutronclient.git}
+GITBRANCH["neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
 
 # python client library to nova that horizon (and others) use
-NOVACLIENT_REPO=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
-NOVACLIENT_BRANCH=${NOVACLIENT_BRANCH:-master}
+GITREPO["novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
+GITBRANCH["novaclient"]=${NOVACLIENT_BRANCH:-master}
 
 # python swift client library
-SWIFTCLIENT_REPO=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
-SWIFTCLIENT_BRANCH=${SWIFTCLIENT_BRANCH:-master}
+GITREPO["swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
+GITBRANCH["swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
 
 # trove client library test
-TROVECLIENT_REPO=${TROVECLIENT_REPO:-${GIT_BASE}/openstack/python-troveclient.git}
-TROVECLIENT_BRANCH=${TROVECLIENT_BRANCH:-master}
+GITREPO["troveclient"]=${TROVECLIENT_REPO:-${GIT_BASE}/openstack/python-troveclient.git}
+GITBRANCH["troveclient"]=${TROVECLIENT_BRANCH:-master}
 
 # consolidated openstack python client
-OPENSTACKCLIENT_REPO=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
-OPENSTACKCLIENT_BRANCH=${OPENSTACKCLIENT_BRANCH:-master}
+GITREPO["openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
+GITBRANCH["openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
 
 ###################
 #

From c973e6c96ce0d37bc22877f3af65135989c469e4 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 5 Nov 2014 09:52:27 +1100
Subject: [PATCH 0064/3333] Move platform check after localrc

This got moved around with some of the recent cleanups I think.  My CI
was putting FORCE=yes into localrc which used to work.  Noticed doing
some bring-up on F21

Change-Id: I7c0ea6b67b42b768278de0fd41d0c0bfbb572387
---
 stack.sh | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/stack.sh b/stack.sh
index ec13338948..38ecceb717 100755
--- a/stack.sh
+++ b/stack.sh
@@ -90,16 +90,6 @@ source $TOP_DIR/lib/config
 # and ``DISTRO``
 GetDistro
 
-# Warn users who aren't on an explicitly supported distro, but allow them to
-# override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f19|f20|rhel6|rhel7) ]]; then
-    echo "WARNING: this script has not been tested on $DISTRO"
-    if [[ "$FORCE" != "yes" ]]; then
-        die $LINENO "If you wish to run this script anyway run with FORCE=yes"
-    fi
-fi
-
-
 # Global Settings
 # ---------------
 
@@ -151,6 +141,15 @@ if [[ ! -r $TOP_DIR/stackrc ]]; then
 fi
 source $TOP_DIR/stackrc
 
+# Warn users who aren't on an explicitly supported distro, but allow them to
+# override check and attempt installation with ``FORCE=yes ./stack``
+if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f19|f20|rhel6|rhel7) ]]; then
+    echo "WARNING: this script has not been tested on $DISTRO"
+    if [[ "$FORCE" != "yes" ]]; then
+        die $LINENO "If you wish to run this script anyway run with FORCE=yes"
+    fi
+fi
+
 # Check to see if we are already running DevStack
 # Note that this may fail if USE_SCREEN=False
 if type -p screen > /dev/null && screen -ls | egrep -q "[0-9]\.$SCREEN_NAME"; then

From 73d32161df5bc0255d32b1ce1eefb4068d09596b Mon Sep 17 00:00:00 2001
From: yunhong jiang <yunhong.jiang@intel.com>
Date: Mon, 6 Oct 2014 09:34:35 -0700
Subject: [PATCH 0065/3333] Passing config for flat type network

Add support to passing the flat_network configuration. User can
either passing the physical network name, or use the physical
network definition

Change-Id: Ie42679f207eb14620883778314f74abf378b5cbc
---
 lib/neutron_plugins/ml2 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 44b947f380..f9a9774e98 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -84,6 +84,11 @@ function neutron_plugin_configure_service {
         fi
     fi
 
+
+    # Allow for setup the flat type network
+    if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" && -n "$PHYSICAL_NETWORK" ]]; then
+            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$Q_ML2_FLAT_PHYSNET_OPTIONS"
+    fi
     # REVISIT(rkukura): Setting firewall_driver here for
     # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
     # used in the server, in case no L2 agent is configured on the
@@ -110,6 +115,8 @@ function neutron_plugin_configure_service {
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_vxlan $Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS
 
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_flat $Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS
+
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_vlan $Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS
 
     if [[ "$Q_DVR_MODE" != "legacy" ]]; then

From 7bce8fa3171801db9bf2261b65b1f5b8978bb46e Mon Sep 17 00:00:00 2001
From: Edgar Magana <emagana@gmail.com>
Date: Tue, 4 Nov 2014 17:32:54 +0100
Subject: [PATCH 0066/3333] Includes a validation to disable creating initial
 networks for Neutron

Neutron external and internal networks are created by default
This commit let developers by configuration to decide if those
networks needs to be created. This is needed to test Neutron DVR
in a distributed Multi-node environment

Change-Id: I17d891d072f189925676b4557094cde1c7a71579
Closes-Bug: 1389288
---
 lib/neutron | 2 ++
 stack.sh    | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index eb07f402d0..a3f9192869 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -131,6 +131,8 @@ Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
+# Specify if the initial private and external networks should be created
+NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 ## Provider Network Information
 PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
diff --git a/stack.sh b/stack.sh
index ec13338948..ed6a4e3936 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1275,7 +1275,7 @@ if is_service_enabled neutron; then
     start_neutron_agents
 fi
 # Once neutron agents are started setup initial network elements
-if is_service_enabled q-svc; then
+if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
     create_neutron_initial_network
     setup_neutron_debug

From 63baba2711552e0f818ad2482281d93dc11e7212 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 29 Oct 2014 21:57:31 -0500
Subject: [PATCH 0067/3333] Clean up index page

There were a lot of artifacts left from the HTML translation.

The toctree at the end is to suppress the errors until the remaining
docs are cleaned up.

Change-Id: I4a8f29f0be524d0a15c7c6f590ffc3ceed6ff811
---
 doc/source/index.rst | 140 +++++++++++++++++--------------------------
 1 file changed, 54 insertions(+), 86 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 37b365d11a..6c38216d26 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -1,40 +1,19 @@
-`DevStack </>`__
-
--  `Overview <overview.rst>`__
--  `Changes <changes.rst>`__
--  `FAQ <faq.rst>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-.. toctree::
-   :glob:
-   :maxdepth: 2
-
-   *
-   guides/*
-   
-
-
 DevStack - an OpenStack Community Production
 ============================================
 
-| A documented shell script to build complete OpenStack development environments.
-|  An OpenStack program maintained by the developer community.
-
-#. Setup a fresh supported Linux installation.
-#. Clone devstack from git.openstack.org.
-
-   ::
-
-       git clone https://git.openstack.org/openstack-dev/devstack
-
-#. Deploy your OpenStack Cloud
+.. toctree::
+   :glob:
+   :maxdepth: 1
 
-   ::
+   overview
+   configuration
+   plugins
+   faq
+   changes
+   contributing
 
-       cd devstack && ./stack.sh
+   guides/*
 
- 
 
 Quick Start This ain't your first rodeo
 ---------------------------------------
@@ -75,68 +54,45 @@ Quick Start This ain't your first rodeo
    It takes a few minutes, we recommend `reading the
    script <stack.sh.html>`__ while it is building.
 
-Guides Walk through various setups used by stackers
----------------------------------------------------
+Guides
+======
+
+Walk through various setups used by stackers
 
 OpenStack on VMs
 ----------------
 
-Title
-
-Description
-
-Link
+These guides tell you how to virtualize your OpenStack cloud in virtual
+machines. This means that you can get started without having to purchase
+any hardware.
 
 Virtual Machine
+~~~~~~~~~~~~~~~
 
-Run OpenStack in a VM. The VMs launched in your cloud will be slow as
+`Run OpenStack in a VM <guides/single-vm.html>`__. The VMs launched in your cloud will be slow as
 they are running in QEMU (emulation), but it is useful if you don't have
-spare hardware laying around.
-
-`Read » <guides/single-vm.html>`__
-
-1 Guide
-
-What is this?
-^^^^^^^^^^^^^
-
-These guides tell you how to virtualize your OpenStack cloud in virtual
-machines. This means that you can get started without having to purchase
-any hardware.
+spare hardware laying around. `[Read] <guides/single-vm.html>`__
 
 OpenStack on Hardware
 ---------------------
 
-Title
-
-Description
-
-Link
+These guides tell you how to deploy a development environment on real
+hardware. Guides range from running OpenStack on a single laptop to
+running a multi-node deployment on datacenter hardware.
 
 All-In-One
+~~~~~~~~~~
 
-Run OpenStack on dedicated hardware to get real performance in your VMs.
-This can include a server-class machine or a laptop at home.
-
-`Read » <guides/single-machine.html>`__
+`Run OpenStack on dedicated hardware <guides/single-machine.html>`__ to get real performance in your VMs.
+This can include a server-class machine or a laptop at home. `[Read] <guides/single-machine.html>`__
 
 Multi-Node + VLANs
+~~~~~~~~~~~~~~~~~~
 
-Setup a multi-node cluster with dedicated VLANs for VMs & Management.
-
-`Read » <guides/multinode-lab.html>`__
-
-2 Guides
-
-What is this?
-^^^^^^^^^^^^^
+`Setup a multi-node cluster <guides/multinode-lab.html>`__ with dedicated VLANs for VMs & Management. `[Read] <guides/multinode-lab.html>`__
 
-These guides tell you how to deploy a development environment on real
-hardware. Guides range from running OpenStack on a single laptop to
-running a multi-node deployment on datacenter hardware.
-
-Documentation Help yourself to stack
-------------------------------------
+Documentation
+=============
 
 Overview
 --------
@@ -168,11 +124,15 @@ Contributing
 
 `Pitching in to make DevStack a better place <contributing.html>`__
 
-Code A look at the bits that make it all go
--------------------------------------------
+Code
+====
+
+A look at the bits that make it all go
+
+Scripts
+-------
 
-Scripts Generated documentation of DevStack scripts.
-----------------------------------------------------
+Generated documentation of DevStack scripts.
 
 +-------------------------------+----------------------------------------------+
 | Filename                      | Link                                         |
@@ -254,8 +214,8 @@ Scripts Generated documentation of DevStack scripts.
 | extras.d/80-tempest.sh        | `Read » <extras.d/80-tempest.html>`__        |
 +-------------------------------+----------------------------------------------+
 
-Configuration Setting the table
--------------------------------
+Configuration
+-------------
 
 +--------------+--------------------------------+
 | Filename     | Link                           |
@@ -271,8 +231,8 @@ Configuration Setting the table
 | eucarc       | `Read » <eucarc.html>`__       |
 +--------------+--------------------------------+
 
-Tools Support scripts
----------------------
+Tools
+-----
 
 +-----------------------------+----------------------------------------------+
 | Filename                    | Link                                         |
@@ -292,8 +252,10 @@ Tools Support scripts
 | tools/upload\_image.sh      | `Read » <tools/upload_image.sh.html>`__      |
 +-----------------------------+----------------------------------------------+
 
-Samples Generated documentation of DevStack sample files.
----------------------------------------------------------
+Samples
+-------
+
+Generated documentation of DevStack sample files.
 
 +------------+--------------------------------------+
 | Filename   | Link                                 |
@@ -303,8 +265,8 @@ Samples Generated documentation of DevStack sample files.
 | localrc    | `Read » <samples/localrc.html>`__    |
 +------------+--------------------------------------+
 
-Exercises Generated documentation of DevStack scripts.
-------------------------------------------------------
+Exercises
+---------
 
 +---------------------------------+-------------------------------------------------+
 | Filename                        | Link                                            |
@@ -343,3 +305,9 @@ Exercises Generated documentation of DevStack scripts.
 +---------------------------------+-------------------------------------------------+
 | exercises/zaqar.sh              | `Read » <exercises/zaqar.sh.html>`__            |
 +---------------------------------+-------------------------------------------------+
+
+.. toctree::
+   :glob:
+   :maxdepth: 1
+
+   *

From 0986a7b760e34741d4df6f97851f6d98fec4f99c Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 29 Oct 2014 22:08:13 -0500
Subject: [PATCH 0068/3333] Remove old HTML headers

Change-Id: I39107df88aeb89d3364ad479d8c313b7a79b9440
---
 doc/source/changes.rst               | 10 +++-------
 doc/source/configuration.rst         | 13 +++----------
 doc/source/contributing.rst          | 13 +++----------
 doc/source/eucarc.rst                | 13 +++----------
 doc/source/exerciserc.rst            | 13 +++----------
 doc/source/faq.rst                   | 13 +++----------
 doc/source/guides/multinode-lab.rst  | 13 +++----------
 doc/source/guides/single-machine.rst | 13 +++----------
 doc/source/guides/single-vm.rst      | 13 +++----------
 doc/source/local.conf.rst            | 13 +++----------
 doc/source/localrc.rst               | 13 +++----------
 doc/source/openrc.rst                | 13 +++----------
 doc/source/overview.rst              | 13 +++----------
 doc/source/plugins.rst               | 13 +++----------
 doc/source/stackrc.rst               | 13 +++----------
 15 files changed, 45 insertions(+), 147 deletions(-)

diff --git a/doc/source/changes.rst b/doc/source/changes.rst
index ccd96e8a7e..f4a326d60e 100644
--- a/doc/source/changes.rst
+++ b/doc/source/changes.rst
@@ -1,10 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
+=======
+Changes
+=======
 
 Recent Changes What's been happening?
 -------------------------------------
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 9befc908ea..eba295622b 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Configuration Making it go my way
----------------------------------
+=============
+Configuration
+=============
 
 DevStack has always tried to be mostly-functional with a minimal amount
 of configuration. The number of options has ballooned as projects add
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
index 73069e788b..b4f9f37902 100644
--- a/doc/source/contributing.rst
+++ b/doc/source/contributing.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Contributing Help us help you
------------------------------
+============
+Contributing
+============
 
 DevStack uses the standard OpenStack contribution process as outlined in
 `the OpenStack wiki 'How To
diff --git a/doc/source/eucarc.rst b/doc/source/eucarc.rst
index c91d3417de..1284b8883b 100644
--- a/doc/source/eucarc.rst
+++ b/doc/source/eucarc.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-eucarc EC2 settings
--------------------
+=====================
+eucarc - EC2 Settings
+=====================
 
 ``eucarc`` creates EC2 credentials for the current user as defined by
 ``OS_TENANT_NAME:OS_USERNAME``. ``eucarc`` sources ``openrc`` at the
diff --git a/doc/source/exerciserc.rst b/doc/source/exerciserc.rst
index ed3f2e87b6..f3780c34c5 100644
--- a/doc/source/exerciserc.rst
+++ b/doc/source/exerciserc.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-exerciserc Exercise settings
-----------------------------
+==============================
+exerciserc - Exercise Settings
+==============================
 
 ``exerciserc`` is used to configure settings for the exercise scripts.
 The values shown below are the default values. Thse can all be
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 36b25b3039..7b33b41741 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-FAQ: Using DevStack Making to behave
-------------------------------------
+===
+FAQ
+===
 
 -  `General Questions <#general>`__
 -  `Operation and Configuration <#ops_conf>`__
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 0b1ebb931b..1c53227835 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <../overview.html>`__
--  `Changes <../changes.html>`__
--  `FAQ <../faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Multi-Node Lab: Serious Stuff
-=============================
+==============
+Multi-Node Lab
+==============
 
 Here is OpenStack in a realistic test configuration with multiple
 physical servers.
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 3e0a39cad5..60595118ee 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <../overview.html>`__
--  `Changes <../changes.html>`__
--  `FAQ <../faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-All-In-One: Dedicated Hardware
-==============================
+==========
+All-In-One
+==========
 
 Things are about to get real! Using OpenStack in containers or VMs is
 nice for kicking the tires, but doesn't compare to the feeling you get
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 35efb14939..d296db6298 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <../overview.html>`__
--  `Changes <../changes.html>`__
--  `FAQ <../faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Running a Cloud in a VM
-=======================
+=============
+Cloud in a VM
+=============
 
 Use the cloud to build the cloud! Use your cloud to launch new versions
 of OpenStack in about 5 minutes. When you break it, start over! The VMs
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
index e1de44c2c7..a9dfcb0ac7 100644
--- a/doc/source/local.conf.rst
+++ b/doc/source/local.conf.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-local.conf User settings
-------------------------
+==========================
+local.conf - User Settings
+==========================
 
 ``local.conf`` is a user-maintained setings file that is sourced in
 ``stackrc``. It contains a section that replaces the historical
diff --git a/doc/source/localrc.rst b/doc/source/localrc.rst
index 487280bae5..98f308302f 100644
--- a/doc/source/localrc.rst
+++ b/doc/source/localrc.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-localrc User settings
----------------------
+=====================
+localrc - The Old Way
+=====================
 
 ``localrc`` is the old file used to configure DevStack. It is deprecated
 and has been replaced by ```local.conf`` <local.conf.html>`__. DevStack
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index ce5765aa60..dc12f76b84 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-openrc User authentication settings
------------------------------------
+=====================================
+openrc - User Authentication Settings
+=====================================
 
 ``openrc`` configures login credentials suitable for use with the
 OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index cedf941bcd..e3cf75dd29 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Overview DevStack from a cloud-height view
-------------------------------------------
+========
+Overview
+========
 
 DevStack has evolved to support a large number of configuration options
 and alternative platforms and support services. That evolution has grown
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 0747b59f3c..282c1a4a3b 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-Plugins Add stuff
------------------
+=======
+Plugins
+=======
 
 DevStack has a couple of plugin mechanisms to allow easily adding
 support for additional projects and features.
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
index 5d9d2218c6..0faab45c2f 100644
--- a/doc/source/stackrc.rst
+++ b/doc/source/stackrc.rst
@@ -1,13 +1,6 @@
-`DevStack </>`__
-
--  `Overview <overview.html>`__
--  `Changes <changes.html>`__
--  `FAQ <faq.html>`__
--  `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
--  `Gerrit <https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack,n,z>`__
-
-stackrc DevStack settings
--------------------------
+===========================
+stackrc - DevStack Settings
+===========================
 
 ``stackrc`` is the primary configuration file for DevStack. It contains
 all of the settings that control the services started and the

From 6a709ab25a294d03009936322d753ce13ead1204 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Thu, 6 Nov 2014 08:36:09 +0000
Subject: [PATCH 0069/3333] Add ODL_NAME variable for OpenDaylight
 configuration

This makes the name of the unzipped package configurable so you can run
with releases other than the default specified in lib/opendaylight.

Change-Id: Iad879c558d742da03375cb61b0c2ef141573ffec
---
 lib/opendaylight | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/lib/opendaylight b/lib/opendaylight
index 374de953c6..bdebe5846d 100644
--- a/lib/opendaylight
+++ b/lib/opendaylight
@@ -44,6 +44,9 @@ ODL_USERNAME=${ODL_USERNAME:-admin}
 # The ODL password
 ODL_PASSWORD=${ODL_PASSWORD:-admin}
 
+# Short name of ODL package
+ODL_NAME=${ODL_NAME:-distribution-karaf-0.2.0-Helium}
+
 # <define global variables here that belong to this project>
 ODL_DIR=$DEST/opendaylight
 
@@ -87,23 +90,23 @@ function cleanup_opendaylight {
 # configure_opendaylight() - Set config files, create data dirs, etc
 function configure_opendaylight {
     # Add odl-ovsdb-openstack if it's not already there
-    local ODLOVSDB=$(cat $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/org.apache.karaf.features.cfg | grep featuresBoot= | grep odl)
+    local ODLOVSDB=$(cat $ODL_DIR/$ODL_NAME/etc/org.apache.karaf.features.cfg | grep featuresBoot= | grep odl)
     if [ "$ODLOVSDB" == "" ]; then
-        sed -i '/^featuresBoot=/ s/$/,odl-ovsdb-openstack/' $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/org.apache.karaf.features.cfg
+        sed -i '/^featuresBoot=/ s/$/,odl-ovsdb-openstack/' $ODL_DIR/$ODL_NAME/etc/org.apache.karaf.features.cfg
     fi
 
     # Configure OpenFlow 1.3 if it's not there
-    local OFLOW13=$(cat $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties | grep ^of.version)
+    local OFLOW13=$(cat $ODL_DIR/$ODL_NAME/etc/custom.properties | grep ^of.version)
     if [ "$OFLOW13" == "" ]; then
-        echo "ovsdb.of.version=1.3" >> $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties
+        echo "ovsdb.of.version=1.3" >> $ODL_DIR/$ODL_NAME/etc/custom.properties
     fi
 
     # Configure L3 if the user wants it
     if [ "${ODL_L3}" == "True" ]; then
         # Configure L3 FWD if it's not there
-        local L3FWD=$(cat $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties | grep ^ovsdb.l3.fwd.enabled)
+        local L3FWD=$(cat $ODL_DIR/$ODL_NAME/etc/custom.properties | grep ^ovsdb.l3.fwd.enabled)
         if [ "$L3FWD" == "" ]; then
-            echo "ovsdb.l3.fwd.enabled=yes" >> $ODL_DIR/distribution-karaf-0.2.0-Helium/etc/custom.properties
+            echo "ovsdb.l3.fwd.enabled=yes" >> $ODL_DIR/$ODL_NAME/etc/custom.properties
         fi
     fi
 }
@@ -156,7 +159,7 @@ function start_opendaylight {
     #   -of13: runs ODL using OpenFlow 1.3 protocol support.
     #   -virt ovsdb: Runs ODL in "virtualization" mode with OVSDB support
 
-    run_process odl-server "cd $ODL_DIR/distribution-karaf-0.2.0-Helium && JAVA_HOME=$JHOME bin/karaf"
+    run_process odl-server "cd $ODL_DIR/$ODL_NAME && JAVA_HOME=$JHOME bin/karaf"
 
     # Sleep a bit to let OpenDaylight finish starting up
     sleep $ODL_BOOT_WAIT

From d224ae1086c7641726a961208cab8af350a81b51 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 6 Nov 2014 09:33:02 -0600
Subject: [PATCH 0070/3333] Update index page doc links

This updates the form of the links to other documents in the tree;
the generated HTML links must remain in the original form.

Change-Id: I6c2179e3b7cb5b8e2589ede84ab7d02340812e80
---
 doc/source/index.rst | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6c38216d26..2128620ffd 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -42,8 +42,8 @@ Quick Start This ain't your first rodeo
 
 #. Configure
 
-   We recommend at least a `minimal
-   configuration <configuration.html>`__ be set up.
+   We recommend at least a :doc:`minimal
+   configuration <configuration>` be set up.
 
 #. Start the install
 
@@ -69,9 +69,9 @@ any hardware.
 Virtual Machine
 ~~~~~~~~~~~~~~~
 
-`Run OpenStack in a VM <guides/single-vm.html>`__. The VMs launched in your cloud will be slow as
+:doc:`Run OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
 they are running in QEMU (emulation), but it is useful if you don't have
-spare hardware laying around. `[Read] <guides/single-vm.html>`__
+spare hardware laying around. :doc:`[Read] <guides/single-vm>`
 
 OpenStack on Hardware
 ---------------------
@@ -83,13 +83,13 @@ running a multi-node deployment on datacenter hardware.
 All-In-One
 ~~~~~~~~~~
 
-`Run OpenStack on dedicated hardware <guides/single-machine.html>`__ to get real performance in your VMs.
-This can include a server-class machine or a laptop at home. `[Read] <guides/single-machine.html>`__
+:doc:`Run OpenStack on dedicated hardware <guides/single-machine>` to get real performance in your VMs.
+This can include a server-class machine or a laptop at home. :doc:`[Read] <guides/single-machine>`
 
 Multi-Node + VLANs
 ~~~~~~~~~~~~~~~~~~
 
-`Setup a multi-node cluster <guides/multinode-lab.html>`__ with dedicated VLANs for VMs & Management. `[Read] <guides/multinode-lab.html>`__
+:doc:`Setup a multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management. :doc:`[Read] <guides/multinode-lab>`
 
 Documentation
 =============
@@ -97,32 +97,32 @@ Documentation
 Overview
 --------
 
-`An overview of DevStack goals and priorities <overview.html>`__
+:doc:`An overview of DevStack goals and priorities <overview>`
 
 Configuration
 -------------
 
-`Configuring and customizing the stack <configuration.html>`__
+:doc:`Configuring and customizing the stack <configuration>`
 
 Plugins
 -------
 
-`Extending DevStack with new features <plugins.html>`__
+:doc:`Extending DevStack with new features <plugins>`
 
 Recent Changes
 --------------
 
-`An incomplete summary of recent changes <changes.html>`__
+:doc:`An incomplete summary of recent changes <changes>`
 
 FAQ
 ---
 
-`The DevStack FAQ <faq.html>`__
+:doc:`The DevStack FAQ <faq>`
 
 Contributing
 ------------
 
-`Pitching in to make DevStack a better place <contributing.html>`__
+:doc:`Pitching in to make DevStack a better place <contributing>`
 
 Code
 ====

From a12dee433c12c336d804ebe36a6a36f7d3c85f65 Mon Sep 17 00:00:00 2001
From: sailajay <y.sailaja@gmail.com>
Date: Thu, 6 Nov 2014 16:14:32 -0800
Subject: [PATCH 0071/3333] Devstack Nuage Plugin correct the ovs_bridge
 parameter

This commit fixes the name of ovs_bridge parameter and the section it is set in nova.conf by the nuage plugin

Closes-Bug: 1390256

Change-Id: I63c929e827db10d0cf5450907a273d880fc757f6
---
 lib/neutron_plugins/nuage | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 52d85a26cc..70de8fad01 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -7,7 +7,7 @@ set +o xtrace
 
 function neutron_plugin_create_nova_conf {
     NOVA_OVS_BRIDGE=${NOVA_OVS_BRIDGE:-"br-int"}
-    iniset $NOVA_CONF DEFAULT neutron_ovs_bridge $NOVA_OVS_BRIDGE
+    iniset $NOVA_CONF neutron ovs_bridge $NOVA_OVS_BRIDGE
     NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
     LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER

From 26dd21be8cbf789a8774c9a1941b364a497c4643 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 6 Nov 2014 09:33:02 -0600
Subject: [PATCH 0072/3333] One last format and content cleanup for the index
 page

Update the form of the links to other documents in the tree;
the generated HTML links must remain in the original form.
The layout is changed from the previous tables to a more Sphinx-y
TOC-like list.

Also editorial changes to the index page and guide titles

Change-Id: I52df0cc542754c386fb3c99d9efdf2524c11bf48
---
 doc/source/guides/single-machine.rst |   6 +-
 doc/source/guides/single-vm.rst      |   6 +-
 doc/source/index.rst                 | 294 +++++++++------------------
 doc/source/localrc.rst               |   9 -
 4 files changed, 107 insertions(+), 208 deletions(-)
 delete mode 100644 doc/source/localrc.rst

diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 60595118ee..9eaa38a49a 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -1,6 +1,6 @@
-==========
-All-In-One
-==========
+=========================
+All-In-One Single Machine
+=========================
 
 Things are about to get real! Using OpenStack in containers or VMs is
 nice for kicking the tires, but doesn't compare to the feeling you get
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index d296db6298..ef59953eb6 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -1,6 +1,6 @@
-=============
-Cloud in a VM
-=============
+====================
+All-In-One Single VM
+====================
 
 Use the cloud to build the cloud! Use your cloud to launch new versions
 of OpenStack in about 5 minutes. When you break it, start over! The VMs
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2128620ffd..dbefdec144 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -12,11 +12,8 @@ DevStack - an OpenStack Community Production
    changes
    contributing
 
-   guides/*
-
-
-Quick Start This ain't your first rodeo
----------------------------------------
+Quick Start
+-----------
 
 #. Select a Linux Distribution
 
@@ -59,40 +56,36 @@ Guides
 
 Walk through various setups used by stackers
 
-OpenStack on VMs
-----------------
+.. toctree::
+   :glob:
+   :maxdepth: 1
 
-These guides tell you how to virtualize your OpenStack cloud in virtual
-machines. This means that you can get started without having to purchase
-any hardware.
+   guides/single-vm
+   guides/single-machine
+   guides/multinode-lab
 
-Virtual Machine
-~~~~~~~~~~~~~~~
+All-In-One Single VM
+--------------------
 
-:doc:`Run OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
+Run :doc:`OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
 they are running in QEMU (emulation), but it is useful if you don't have
 spare hardware laying around. :doc:`[Read] <guides/single-vm>`
 
-OpenStack on Hardware
----------------------
+All-In-One Single Machine
+-------------------------
 
-These guides tell you how to deploy a development environment on real
-hardware. Guides range from running OpenStack on a single laptop to
-running a multi-node deployment on datacenter hardware.
+Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can include a
+server-class machine or a laptop at home.
+:doc:`[Read] <guides/single-machine>`
 
-All-In-One
-~~~~~~~~~~
-
-:doc:`Run OpenStack on dedicated hardware <guides/single-machine>` to get real performance in your VMs.
-This can include a server-class machine or a laptop at home. :doc:`[Read] <guides/single-machine>`
-
-Multi-Node + VLANs
-~~~~~~~~~~~~~~~~~~
+Multi-Node Lab
+--------------
 
-:doc:`Setup a multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management. :doc:`[Read] <guides/multinode-lab>`
+Setup a :doc:`multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management.
+:doc:`[Read] <guides/multinode-lab>`
 
-Documentation
-=============
+DevStack Documentation
+======================
 
 Overview
 --------
@@ -127,187 +120,102 @@ Contributing
 Code
 ====
 
-A look at the bits that make it all go
+*A look at the bits that make it all go*
 
 Scripts
 -------
 
-Generated documentation of DevStack scripts.
-
-+-------------------------------+----------------------------------------------+
-| Filename                      | Link                                         |
-+===============================+==============================================+
-| stack.sh                      | `Read » <stack.sh.html>`__                   |
-+-------------------------------+----------------------------------------------+
-| functions                     | `Read » <functions.html>`__                  |
-+-------------------------------+----------------------------------------------+
-| functions-common              | `Read » <functions-common.html>`__           |
-+-------------------------------+----------------------------------------------+
-| lib/apache                    | `Read » <lib/apache.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| lib/baremetal                 | `Read » <lib/baremetal.html>`__              |
-+-------------------------------+----------------------------------------------+
-| lib/ceilometer                | `Read » <lib/ceilometer.html>`__             |
-+-------------------------------+----------------------------------------------+
-| lib/cinder                    | `Read » <lib/cinder.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| lib/config                    | `Read » <lib/config.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| lib/database                  | `Read » <lib/database.html>`__               |
-+-------------------------------+----------------------------------------------+
-| lib/glance                    | `Read » <lib/glance.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| lib/heat                      | `Read » <lib/heat.html>`__                   |
-+-------------------------------+----------------------------------------------+
-| lib/horizon                   | `Read » <lib/horizon.html>`__                |
-+-------------------------------+----------------------------------------------+
-| lib/infra                     | `Read » <lib/infra.html>`__                  |
-+-------------------------------+----------------------------------------------+
-| lib/ironic                    | `Read » <lib/ironic.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| lib/keystone                  | `Read » <lib/keystone.html>`__               |
-+-------------------------------+----------------------------------------------+
-| lib/ldap                      | `Read » <lib/ldap.html>`__                   |
-+-------------------------------+----------------------------------------------+
-| lib/zaqar                     | `Read » <lib/zaqar.html>`__                  |
-+-------------------------------+----------------------------------------------+
-| lib/neutron                   | `Read » <lib/neutron.html>`__                |
-+-------------------------------+----------------------------------------------+
-| lib/nova                      | `Read » <lib/nova.html>`__                   |
-+-------------------------------+----------------------------------------------+
-| lib/oslo                      | `Read » <lib/oslo.html>`__                   |
-+-------------------------------+----------------------------------------------+
-| lib/rpc\_backend              | `Read » <lib/rpc_backend.html>`__            |
-+-------------------------------+----------------------------------------------+
-| lib/sahara                    | `Read » <lib/sahara.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| lib/savanna                   | `Read » <lib/savanna.html>`__                |
-+-------------------------------+----------------------------------------------+
-| lib/stackforge                | `Read » <lib/stackforge.html>`__             |
-+-------------------------------+----------------------------------------------+
-| lib/swift                     | `Read » <lib/swift.html>`__                  |
-+-------------------------------+----------------------------------------------+
-| lib/tempest                   | `Read » <lib/tempest.html>`__                |
-+-------------------------------+----------------------------------------------+
-| lib/tls                       | `Read » <lib/tls.html>`__                    |
-+-------------------------------+----------------------------------------------+
-| lib/trove                     | `Read » <lib/trove.html>`__                  |
-+-------------------------------+----------------------------------------------+
-| unstack.sh                    | `Read » <unstack.sh.html>`__                 |
-+-------------------------------+----------------------------------------------+
-| clean.sh                      | `Read » <clean.sh.html>`__                   |
-+-------------------------------+----------------------------------------------+
-| run\_tests.sh                 | `Read » <run_tests.sh.html>`__               |
-+-------------------------------+----------------------------------------------+
-| extras.d/50-ironic.sh         | `Read » <extras.d/50-ironic.html>`__         |
-+-------------------------------+----------------------------------------------+
-| extras.d/70-zaqar.sh          | `Read » <extras.d/70-zaqar.html>`__          |
-+-------------------------------+----------------------------------------------+
-| extras.d/70-sahara.sh         | `Read » <extras.d/70-sahara.html>`__         |
-+-------------------------------+----------------------------------------------+
-| extras.d/70-savanna.sh        | `Read » <extras.d/70-savanna.html>`__        |
-+-------------------------------+----------------------------------------------+
-| extras.d/70-trove.sh          | `Read » <extras.d/70-trove.html>`__          |
-+-------------------------------+----------------------------------------------+
-| extras.d/80-opendaylight.sh   | `Read » <extras.d/80-opendaylight.html>`__   |
-+-------------------------------+----------------------------------------------+
-| extras.d/80-tempest.sh        | `Read » <extras.d/80-tempest.html>`__        |
-+-------------------------------+----------------------------------------------+
+* `stack.sh <stack.sh.html>`__ - The main script
+* `functions <functions.html>`__ - DevStack-specific functions
+* `functions-common <functions-common.html>`__ - Functions shared with other projects
+* `lib/apache <lib/apache.html>`__
+* `lib/baremetal <lib/baremetal.html>`__
+* `lib/ceilometer <lib/ceilometer.html>`__
+* `lib/ceph <lib/ceph.html>`__
+* `lib/cinder <lib/cinder.html>`__
+* `lib/config <lib/config.html>`__
+* `lib/database <lib/database.html>`__
+* `lib/dib <lib/dib.html>`__
+* `lib/dstat <lib/dstat.html>`__
+* `lib/glance <lib/glance.html>`__
+* `lib/heat <lib/heat.html>`__
+* `lib/horizon <lib/horizon.html>`__
+* `lib/infra <lib/infra.html>`__
+* `lib/ironic <lib/ironic.html>`__
+* `lib/keystone <lib/keystone.html>`__
+* `lib/ldap <lib/ldap.html>`__
+* `lib/neutron <lib/neutron.html>`__
+* `lib/nova <lib/nova.html>`__
+* `lib/opendaylight <lib/opendaylight.html>`__
+* `lib/oslo <lib/oslo.html>`__
+* `lib/rpc\_backend <lib/rpc_backend.html>`__
+* `lib/sahara <lib/sahara.html>`__
+* `lib/stackforge <lib/stackforge.html>`__
+* `lib/swift <lib/swift.html>`__
+* `lib/tempest <lib/tempest.html>`__
+* `lib/tls <lib/tls.html>`__
+* `lib/trove <lib/trove.html>`__
+* `lib/zaqar <lib/zaqar.html>`__
+* `unstack.sh <unstack.sh.html>`__
+* `clean.sh <clean.sh.html>`__
+* `run\_tests.sh <run_tests.sh.html>`__
+
+* `extras.d/40-dib.sh <extras.d/40-dib.sh.html>`__
+* `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
+* `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
+* `extras.d/70-sahara.sh <extras.d/70-sahara.sh.html>`__
+* `extras.d/70-trove.sh <extras.d/70-trove.sh.html>`__
+* `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
+* `extras.d/80-opendaylight.sh <extras.d/80-opendaylight.sh.html>`__
+* `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
 
 Configuration
 -------------
 
-+--------------+--------------------------------+
-| Filename     | Link                           |
-+==============+================================+
-| local.conf   | `Read » <local.conf.html>`__   |
-+--------------+--------------------------------+
-| stackrc      | `Read » <stackrc.html>`__      |
-+--------------+--------------------------------+
-| openrc       | `Read » <openrc.html>`__       |
-+--------------+--------------------------------+
-| exerciserc   | `Read » <exerciserc.html>`__   |
-+--------------+--------------------------------+
-| eucarc       | `Read » <eucarc.html>`__       |
-+--------------+--------------------------------+
+.. toctree::
+   :glob:
+   :maxdepth: 1
+
+   local.conf
+   stackrc
+   openrc
+   exerciserc
+   eucarc
 
 Tools
 -----
 
-+-----------------------------+----------------------------------------------+
-| Filename                    | Link                                         |
-+=============================+==============================================+
-| tools/info.sh               | `Read » <tools/info.sh.html>`__              |
-+-----------------------------+----------------------------------------------+
-| tools/build\_docs.sh        | `Read » <tools/build_docs.sh.html>`__        |
-+-----------------------------+----------------------------------------------+
-| tools/create\_userrc.sh     | `Read » <tools/create_userrc.sh.html>`__     |
-+-----------------------------+----------------------------------------------+
-| tools/fixup\_stuff.sh       | `Read » <tools/fixup_stuff.sh.html>`__       |
-+-----------------------------+----------------------------------------------+
-| tools/install\_prereqs.sh   | `Read » <tools/install_prereqs.sh.html>`__   |
-+-----------------------------+----------------------------------------------+
-| tools/install\_pip.sh       | `Read » <tools/install_pip.sh.html>`__       |
-+-----------------------------+----------------------------------------------+
-| tools/upload\_image.sh      | `Read » <tools/upload_image.sh.html>`__      |
-+-----------------------------+----------------------------------------------+
+* `tools/build\_docs.sh <tools/build_docs.sh.html>`__
+* `tools/create-stack-user.sh <tools/create-stack-user.sh.html>`__
+* `tools/create\_userrc.sh <tools/create_userrc.sh.html>`__
+* `tools/fixup\_stuff.sh <tools/fixup_stuff.sh.html>`__
+* `tools/info.sh <tools/info.sh.html>`__
+* `tools/install\_pip.sh <tools/install_pip.sh.html>`__
+* `tools/install\_prereqs.sh <tools/install_prereqs.sh.html>`__
+* `tools/make\_cert.sh <tools/make_cert.sh.html>`__
+* `tools/upload\_image.sh <tools/upload_image.sh.html>`__
 
 Samples
 -------
 
-Generated documentation of DevStack sample files.
-
-+------------+--------------------------------------+
-| Filename   | Link                                 |
-+============+======================================+
-| local.sh   | `Read » <samples/local.sh.html>`__   |
-+------------+--------------------------------------+
-| localrc    | `Read » <samples/localrc.html>`__    |
-+------------+--------------------------------------+
+* `local.sh <samples/local.sh.html>`__
 
 Exercises
 ---------
 
-+---------------------------------+-------------------------------------------------+
-| Filename                        | Link                                            |
-+=================================+=================================================+
-| exercise.sh                     | `Read » <exercise.sh.html>`__                   |
-+---------------------------------+-------------------------------------------------+
-| exercises/aggregates.sh         | `Read » <exercises/aggregates.sh.html>`__       |
-+---------------------------------+-------------------------------------------------+
-| exercises/boot\_from\_volume.sh | `Read » <exercises/boot_from_volume.sh.html>`__ |
-+---------------------------------+-------------------------------------------------+
-| exercises/bundle.sh             | `Read » <exercises/bundle.sh.html>`__           |
-+---------------------------------+-------------------------------------------------+
-| exercises/client-args.sh        | `Read » <exercises/client-args.sh.html>`__      |
-+---------------------------------+-------------------------------------------------+
-| exercises/client-env.sh         | `Read » <exercises/client-env.sh.html>`__       |
-+---------------------------------+-------------------------------------------------+
-| exercises/euca.sh               | `Read » <exercises/euca.sh.html>`__             |
-+---------------------------------+-------------------------------------------------+
-| exercises/floating\_ips.sh      | `Read » <exercises/floating_ips.sh.html>`__     |
-+---------------------------------+-------------------------------------------------+
-| exercises/horizon.sh            | `Read » <exercises/horizon.sh.html>`__          |
-+---------------------------------+-------------------------------------------------+
-| exercises/neutron-adv-test.sh   | `Read » <exercises/neutron-adv-test.sh.html>`__ |
-+---------------------------------+-------------------------------------------------+
-| exercises/sahara.sh             | `Read » <exercises/sahara.sh.html>`__           |
-+---------------------------------+-------------------------------------------------+
-| exercises/savanna.sh            | `Read » <exercises/savanna.sh.html>`__          |
-+---------------------------------+-------------------------------------------------+
-| exercises/sec\_groups.sh        | `Read » <exercises/sec_groups.sh.html>`__       |
-+---------------------------------+-------------------------------------------------+
-| exercises/swift.sh              | `Read » <exercises/swift.sh.html>`__            |
-+---------------------------------+-------------------------------------------------+
-| exercises/trove.sh              | `Read » <exercises/trove.sh.html>`__            |
-+---------------------------------+-------------------------------------------------+
-| exercises/volumes.sh            | `Read » <exercises/volumes.sh.html>`__          |
-+---------------------------------+-------------------------------------------------+
-| exercises/zaqar.sh              | `Read » <exercises/zaqar.sh.html>`__            |
-+---------------------------------+-------------------------------------------------+
-
-.. toctree::
-   :glob:
-   :maxdepth: 1
-
-   *
+* `exercise.sh <exercise.sh.html>`__
+* `exercises/aggregates.sh <exercises/aggregates.sh.html>`__
+* `exercises/boot\_from\_volume.sh <exercises/boot_from_volume.sh.html>`__
+* `exercises/bundle.sh <exercises/bundle.sh.html>`__
+* `exercises/client-args.sh <exercises/client-args.sh.html>`__
+* `exercises/client-env.sh <exercises/client-env.sh.html>`__
+* `exercises/euca.sh <exercises/euca.sh.html>`__
+* `exercises/floating\_ips.sh <exercises/floating_ips.sh.html>`__
+* `exercises/horizon.sh <exercises/horizon.sh.html>`__
+* `exercises/neutron-adv-test.sh <exercises/neutron-adv-test.sh.html>`__
+* `exercises/sahara.sh <exercises/sahara.sh.html>`__
+* `exercises/sec\_groups.sh <exercises/sec_groups.sh.html>`__
+* `exercises/swift.sh <exercises/swift.sh.html>`__
+* `exercises/trove.sh <exercises/trove.sh.html>`__
+* `exercises/volumes.sh <exercises/volumes.sh.html>`__
+* `exercises/zaqar.sh <exercises/zaqar.sh.html>`__
diff --git a/doc/source/localrc.rst b/doc/source/localrc.rst
deleted file mode 100644
index 98f308302f..0000000000
--- a/doc/source/localrc.rst
+++ /dev/null
@@ -1,9 +0,0 @@
-=====================
-localrc - The Old Way
-=====================
-
-``localrc`` is the old file used to configure DevStack. It is deprecated
-and has been replaced by ```local.conf`` <local.conf.html>`__. DevStack
-will continue to use ``localrc`` if it is present and ignore the
-``localrc`` section in ``local.conf.``. Remove ``localrc`` to switch to
-using the new file.

From ea3cdfad1fe6f63c8a6acdd4df4b5c4db85fabb5 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 8 Nov 2014 08:29:16 -0600
Subject: [PATCH 0073/3333] Pass through the rest of the docs

Do the link cleanups and update a handful of things that were
out of date.

Change-Id: I758027bf3577c66cfb13df963516823a5c247080
---
 doc/source/configuration.rst         |  2 +-
 doc/source/contributing.rst          | 17 ++++++-------
 doc/source/faq.rst                   |  7 ++----
 doc/source/guides/multinode-lab.rst  |  6 ++---
 doc/source/guides/single-machine.rst |  4 ++--
 doc/source/local.conf.rst            |  4 ++--
 doc/source/openrc.rst                | 36 +++++++++++-----------------
 doc/source/overview.rst              |  2 +-
 doc/source/plugins.rst               |  4 ++--
 doc/source/stackrc.rst               |  4 ++--
 10 files changed, 38 insertions(+), 48 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index eba295622b..a4d940d762 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -74,7 +74,7 @@ A specific meta-section ``local|localrc`` is used to provide a default
 ``localrc`` file (actually ``.localrc.auto``). This allows all custom
 settings for DevStack to be contained in a single file. If ``localrc``
 exists it will be used instead to preserve backward-compatibility. More
-details on the `contents of localrc <localrc.html>`__ are available.
+details on the :doc:`contents of local.conf <local.conf>` are available.
 
 ::
 
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
index b4f9f37902..7ca3d64afd 100644
--- a/doc/source/contributing.rst
+++ b/doc/source/contributing.rst
@@ -59,16 +59,17 @@ Code
 The DevStack repo generally keeps all of the primary scripts at the root
 level.
 
-``docs`` - Contains the source for this website. It is built using
-``tools/build_docs.sh``.
+``doc`` - Contains the Sphinx source for the documentation.
+``tools/build_docs.sh`` is used to generate the HTML versions of the
+DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
 
-``exercises`` - Contains the test scripts used to validate and
+``exercises`` - Contains the test scripts used to sanity-check and
 demonstrate some OpenStack functions. These scripts know how to exit
 early or skip services that are not enabled.
 
 ``extras.d`` - Contains the dispatch scripts called by the hooks in
-``stack.sh``, ``unstack.sh`` and ``clean.sh``. See `the plugins
-docs <plugins.html>`__ for more information.
+``stack.sh``, ``unstack.sh`` and ``clean.sh``. See :doc:`the plugins
+docs <plugins>` for more information.
 
 ``files`` - Contains a variety of otherwise lost files used in
 configuring and operating DevStack. This includes templates for
@@ -84,10 +85,10 @@ there are some for system services and project plugins.
 DevStack repo.
 
 ``tests`` - the DevStack test suite is rather sparse, mostly consisting
-of test of specific fragile functions in the ``functions`` file.
+of test of specific fragile functions in the ``functions`` and
+``functions-common`` files.
 
-``tools`` - Contains a collection of stand-alone scripts, some of which
-have aged a bit (does anyone still do ramdisk installs?). While these
+``tools`` - Contains a collection of stand-alone scripts. While these
 may reference the top-level DevStack configuration they can generally be
 run alone. There are also some sub-directories to support specific
 environments such as XenServer.
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7b33b41741..b7943ba130 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -47,11 +47,8 @@ Q: I'd like to help!
     and bug reports go to
     `LaunchPad <http://bugs.launchpad.net/devstack/>`__. Contributions
     follow the usual process as described in the `OpenStack
-    wiki <http://wiki.openstack.org/HowToContribute>`__ even though
-    DevStack is not an official OpenStack project. This site is housed
-    in the CloudBuilder's
-    `github <http://github.com/cloudbuilders/devstack>`__ in the
-    gh-pages branch.
+    wiki <http://wiki.openstack.org/HowToContribute>`__. This Sphinx
+    documentation is housed in the doc directory.
 Q: Why not use packages?
     A: Unlike packages, DevStack leaves your cloud ready to develop -
     checkouts of the code and services running in screen. However, many
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 1c53227835..4c60b6a745 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -16,9 +16,9 @@ download the `Minimal
 CD <https://help.ubuntu.com/community/Installation/MinimalCD>`__ for
 Ubuntu releases since DevStack will download & install all the
 additional dependencies. The netinstall ISO is available for
-`Fedora <http://mirrors.kernel.org/fedora/releases/18/Fedora/x86_64/iso/Fedora-20-x86_64-netinst.iso>`__
+`Fedora <http://mirrors.kernel.org/fedora/releases/>`__
 and
-`CentOS/RHEL <http://mirrors.kernel.org/centos/6.5/isos/x86_64/CentOS-6.5-x86_64-netinstall.iso>`__.
+`CentOS/RHEL <http://mirrors.kernel.org/centos/>`__.
 
 Install a couple of packages to bootstrap configuration:
 
@@ -284,7 +284,7 @@ Volumes
 
 DevStack will automatically use an existing LVM volume group named
 ``stack-volumes`` to store cloud-created volumes. If ``stack-volumes``
-doesn't exist, DevStack will set up a 5Gb loop-mounted file to contain
+doesn't exist, DevStack will set up a 10Gb loop-mounted file to contain
 it. This obviously limits the number and size of volumes that can be
 created inside OpenStack. The size can be overridden by setting
 ``VOLUME_BACKING_FILE_SIZE`` in ``local.conf``.
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 9eaa38a49a..a7a1099bc7 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -17,9 +17,9 @@ download the `Minimal
 CD <https://help.ubuntu.com/community/Installation/MinimalCD>`__ for
 Ubuntu releases since DevStack will download & install all the
 additional dependencies. The netinstall ISO is available for
-`Fedora <http://mirrors.kernel.org/fedora/releases/18/Fedora/x86_64/iso/Fedora-20-x86_64-netinst.iso>`__
+`Fedora <http://mirrors.kernel.org/fedora/releases/>`__
 and
-`CentOS/RHEL <http://mirrors.kernel.org/centos/6.5/isos/x86_64/CentOS-6.5-x86_64-netinstall.iso>`__.
+`CentOS/RHEL <http://mirrors.kernel.org/centos/>`__.
 You may be tempted to use a desktop distro on a laptop, it will probably
 work but you may need to tell Network Manager to keep its fingers off
 the interface(s) that OpenStack uses for bridging.
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
index a9dfcb0ac7..b2f7557e6d 100644
--- a/doc/source/local.conf.rst
+++ b/doc/source/local.conf.rst
@@ -4,6 +4,6 @@ local.conf - User Settings
 
 ``local.conf`` is a user-maintained setings file that is sourced in
 ``stackrc``. It contains a section that replaces the historical
-``localrc`` file. See `the description of
-local.conf <configuration.html>`__ for more details about the mechanics
+``localrc`` file. See the description of
+:doc:`local.conf <configuration>` for more details about the mechanics
 of the file.
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index dc12f76b84..56ff5c2edb 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -8,29 +8,30 @@ beginning (which in turn sources the ``localrc`` setion of
 ``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
 to use in the endpoints. The values shown below are the default values.
 
-OS\_TENANT\_NAME
-    The introduction of Keystone to the OpenStack ecosystem has
-    standardized the term *tenant* as the entity that owns resources. In
-    some places references still exist to the original Nova term
-    *project* for this use. Also, *tenant\_name* is preferred to
-    *tenant\_id*.
+OS\_PROJECT\_NAME (OS\_TENANT\_NAME)
+    Keystone has
+    standardized the term *project* as the entity that owns resources. In
+    some places references still exist to the previous term
+    *tenant* for this use. Also, *project\_name* is preferred to
+    *project\_id*.  OS\_TENANT\_NAME remains supported for compatibility
+    with older tools.
 
     ::
 
-        OS_TENANT_NAME=demo
+        OS_PROJECT_NAME=demo
 
 OS\_USERNAME
-    In addition to the owning entity (tenant), Nova stores the entity
-    performing the action as the *user*.
+    In addition to the owning entity (project), OpenStack calls the entity
+    performing the action *user*.
 
     ::
 
         OS_USERNAME=demo
 
 OS\_PASSWORD
-    With Keystone you pass the keystone password instead of an api key.
-    Recent versions of novaclient use OS\_PASSWORD instead of
-    NOVA\_API\_KEYs or NOVA\_PASSWORD.
+    Keystone's default authentication requires a password be provided.
+    The usual cautions about putting passwords in environment variables
+    apply, for most DevStack uses this may be an acceptable tradeoff.
 
     ::
 
@@ -39,7 +40,7 @@ OS\_PASSWORD
 HOST\_IP, SERVICE\_HOST
     Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
     be used to specify the endpoint, which is convenient for some
-    ``localrc`` configurations. Typically, ``HOST_IP`` is set in the
+    ``local.conf`` configurations. Typically, ``HOST_IP`` is set in the
     ``localrc`` section.
 
     ::
@@ -57,15 +58,6 @@ OS\_AUTH\_URL
 
         OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
 
-GLANCE\_HOST
-    Some exercises call Glance directly. On a single-node installation,
-    Glance should be listening on ``HOST_IP``. If its running elsewhere
-    it can be set here.
-
-    ::
-
-        GLANCE_HOST=$HOST_IP
-
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented
     out by default.
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index e3cf75dd29..40782403fa 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -73,7 +73,7 @@ Compute (Nova), Network (Nova), Dashboard (Horizon), Orchestration
 (Heat)
 
 Additional services not included directly in DevStack can be tied in to
-``stack.sh`` using the `plugin mechanism <plugins.html>`__ to call
+``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call
 scripts that perform the configuration and startup of the service.
 
 Node Configurations
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 282c1a4a3b..b4136c4653 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -8,8 +8,8 @@ support for additional projects and features.
 Extras.d Hooks
 ~~~~~~~~~~~~~~
 
-These relatively new hooks are an extension of the existing calls from
-``stack.sh`` at the end of its run, plus ``unstack.sh`` and
+These hooks are an extension of the service calls in
+``stack.sh`` at specific points in its run, plus ``unstack.sh`` and
 ``clean.sh``. A number of the higher-layer projects are implemented in
 DevStack using this mechanism.
 
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
index 0faab45c2f..b21f74f761 100644
--- a/doc/source/stackrc.rst
+++ b/doc/source/stackrc.rst
@@ -15,12 +15,12 @@ ENABLED\_SERVICES
     Specify which services to launch. These generally correspond to
     screen tabs. The default includes: Glance (API and Registry),
     Keystone, Nova (API, Certificate, Object Store, Compute, Network,
-    Scheduler, VNC proxies, Certificate Authentication), Cinder
+    Scheduler, Certificate Authentication), Cinder
     (Scheduler, API, Volume), Horizon, MySQL, RabbitMQ, Tempest.
 
     ::
 
-        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,cinder,c-sch,c-api,c-vol,n-sch,n-novnc,n-xvnc,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
+        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
 
     Other services that are not enabled by default can be enabled in
     ``localrc``. For example, to add Swift, use the following service

From 90f77fb01579b1859199b451d090170d4752a3e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <sebastien.han@enovance.com>
Date: Fri, 31 Oct 2014 12:05:20 +0100
Subject: [PATCH 0074/3333] Fix DevStack Ceph on the Giant release
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As of the Ceph Giant release, pools 'data' and 'metadata' (used for
CephFS) were removed. Thus applying the pool change command fails on
Giant since those pools don't exist anymore. Now we are checking for
every release prior to Giant and apply proper commands accordingly.

Change-Id: Ia12042899c0e6809f5b98c2e0de177bb61c8a790
Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
---
 lib/ceph | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index e55738c0d2..2ddf5dbb6a 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -71,6 +71,11 @@ CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
 # Functions
 # ------------
 
+function get_ceph_version {
+    local ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4)
+    echo $ceph_version_str
+}
+
 # import_libvirt_secret_ceph() - Imports Cinder user key into libvirt
 # so it can connect to the Ceph cluster while attaching a Cinder block device
 function import_libvirt_secret_ceph {
@@ -154,10 +159,16 @@ EOF
         sleep 5
     done
 
+    # pools data and metadata were removed in the Giant release so depending on the version we apply different commands
+    local ceph_version=$(get_ceph_version)
     # change pool replica size according to the CEPH_REPLICAS set by the user
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set data size ${CEPH_REPLICAS}
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata size ${CEPH_REPLICAS}
+    if [[ ${ceph_version%.*} -eq 0 ]] && [[ ${ceph_version##*.} -lt 87 ]]; then
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set data size ${CEPH_REPLICAS}
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata size ${CEPH_REPLICAS}
+    else
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
+    fi
 
     # create a simple rule to take OSDs instead of host with CRUSH
     # then apply this rules to the default pool

From af81d672937fb4cefb7d723769af232cac714c22 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 10 Nov 2014 09:04:54 +0100
Subject: [PATCH 0075/3333] Drop PIP_USE_MIRRORS environment variable

The PIP_USE_MIRRORS does not do anything else than adding
 the --use-mirrors option to the pip command line.

The --use-mirrors is deprecated since pip-1.5,
and does not do anything else than printing a warning message.

For using alternate pypi index url this option is not required and
not sufficient. The current way for using alternate mirrors
is to defining them in the .pip/pip.conf either manually (before
devstack), or by using the PYPI_ALTERNATIVE_URL and PYPI_OVERRIDE
environment variables.

Change-Id: Ia33e783360e5661c2ef03b77e9f7af32b2633f2f
---
 functions-common | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/functions-common b/functions-common
index 9f8476e841..b9d9114512 100644
--- a/functions-common
+++ b/functions-common
@@ -25,7 +25,6 @@
 # - ``FILES``
 # - ``OFFLINE``
 # - ``PIP_DOWNLOAD_CACHE``
-# - ``PIP_USE_MIRRORS``
 # - ``RECLONE``
 # - ``REQUIREMENTS_DIR``
 # - ``STACK_USER``
@@ -1559,7 +1558,7 @@ function get_python_exec_prefix {
 }
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
-# Uses globals ``OFFLINE``, ``PIP_DOWNLOAD_CACHE``, ``PIP_USE_MIRRORS``,
+# Uses globals ``OFFLINE``, ``PIP_DOWNLOAD_CACHE``,
 # ``TRACK_DEPENDS``, ``*_proxy``
 # pip_install package [package ...]
 function pip_install {
@@ -1585,21 +1584,13 @@ function pip_install {
         local sudo_pip="sudo"
     fi
 
-    # Mirror option not needed anymore because pypi has CDN available,
-    # but it's useful in certain circumstances
-    PIP_USE_MIRRORS=${PIP_USE_MIRRORS:-False}
-    local pip_mirror_opt=""
-    if [[ "$PIP_USE_MIRRORS" != "False" ]]; then
-        pip_mirror_opt="--use-mirrors"
-    fi
-
     $xtrace
     $sudo_pip PIP_DOWNLOAD_CACHE=${PIP_DOWNLOAD_CACHE:-/var/cache/pip} \
         http_proxy=$http_proxy \
         https_proxy=$https_proxy \
         no_proxy=$no_proxy \
         $cmd_pip install \
-        $pip_mirror_opt $@
+        $@
 
     INSTALL_TESTONLY_PACKAGES=$(trueorfalse False $INSTALL_TESTONLY_PACKAGES)
     if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
@@ -1610,7 +1601,7 @@ function pip_install {
                 https_proxy=$https_proxy \
                 no_proxy=$no_proxy \
                 $cmd_pip install \
-                $pip_mirror_opt -r $test_req
+                -r $test_req
         fi
     fi
 }

From c411fcfc9224894db55d82b8ce4fa4a2b68de89d Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 19 Aug 2014 16:48:14 +0200
Subject: [PATCH 0076/3333] Allow installing tempest only with keystone

Modify the lib/tempest to not fail
 if no nova or glance available.

* This allows performance test of keystone and neutron with
  tempest (or tempest stress runner) without having system
  noise from another components.
* Depending on not required components for tempest is bad practice,
  tempest service decorators expected to allow tempest,
  to run in more minimal system out-of-the-box.

Change-Id: Ifc40b1eb5c4b79d96a5fae919b88afecca642ca0
---
 lib/tempest | 196 +++++++++++++++++++++++++++-------------------------
 1 file changed, 101 insertions(+), 95 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 66f1a788f1..3996cd1a62 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -110,34 +110,36 @@ function configure_tempest {
     # ... Also ensure we only take active images, so we don't get snapshots in process
     declare -a images
 
-    while read -r IMAGE_NAME IMAGE_UUID; do
-        if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
-            image_uuid="$IMAGE_UUID"
-            image_uuid_alt="$IMAGE_UUID"
-        fi
-        images+=($IMAGE_UUID)
-    # TODO(stevemar): update this command to use openstackclient's `openstack image list`
-    # when it supports listing by status.
-    done < <(glance image-list --status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
-
-    case "${#images[*]}" in
-        0)
-            echo "Found no valid images to use!"
-            exit 1
-            ;;
-        1)
-            if [ -z "$image_uuid" ]; then
-                image_uuid=${images[0]}
-                image_uuid_alt=${images[0]}
-            fi
-            ;;
-        *)
-            if [ -z "$image_uuid" ]; then
-                image_uuid=${images[0]}
-                image_uuid_alt=${images[1]}
+    if is_service_enabled glance; then
+        while read -r IMAGE_NAME IMAGE_UUID; do
+            if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
+                image_uuid="$IMAGE_UUID"
+                image_uuid_alt="$IMAGE_UUID"
             fi
-            ;;
-    esac
+            images+=($IMAGE_UUID)
+        # TODO(stevemar): update this command to use openstackclient's `openstack image list`
+        # when it supports listing by status.
+        done < <(glance image-list --status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+
+        case "${#images[*]}" in
+            0)
+                echo "Found no valid images to use!"
+                exit 1
+                ;;
+            1)
+                if [ -z "$image_uuid" ]; then
+                    image_uuid=${images[0]}
+                    image_uuid_alt=${images[0]}
+                fi
+                ;;
+            *)
+                if [ -z "$image_uuid" ]; then
+                    image_uuid=${images[0]}
+                    image_uuid_alt=${images[1]}
+                fi
+                ;;
+        esac
+    fi
 
     # Create tempest.conf from tempest.conf.sample
     # copy every time, because the image UUIDS are going to change
@@ -161,63 +163,65 @@ function configure_tempest {
     ALT_TENANT_NAME=${ALT_TENANT_NAME:-alt_demo}
     ADMIN_TENANT_ID=$(openstack project list | awk "/ admin / { print \$2 }")
 
-    # If the ``DEFAULT_INSTANCE_TYPE`` not declared, use the new behavior
-    # Tempest creates instane types for himself
-    if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
-        available_flavors=$(nova flavor-list)
-        if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
-            if is_arch "ppc64"; then
-                # qemu needs at least 128MB of memory to boot on ppc64
-                nova flavor-create m1.nano 42 128 0 1
-            else
-                nova flavor-create m1.nano 42 64 0 1
+    if is_service_enabled nova; then
+        # If the ``DEFAULT_INSTANCE_TYPE`` not declared, use the new behavior
+        # Tempest creates instane types for himself
+        if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
+            available_flavors=$(nova flavor-list)
+            if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
+                if is_arch "ppc64"; then
+                    # qemu needs at least 128MB of memory to boot on ppc64
+                    nova flavor-create m1.nano 42 128 0 1
+                else
+                    nova flavor-create m1.nano 42 64 0 1
+                fi
             fi
-        fi
-        flavor_ref=42
-        boto_instance_type=m1.nano
-        if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
-            if is_arch "ppc64"; then
-                nova flavor-create m1.micro 84 256 0 1
-            else
-                nova flavor-create m1.micro 84 128 0 1
+            flavor_ref=42
+            boto_instance_type=m1.nano
+            if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
+                if is_arch "ppc64"; then
+                    nova flavor-create m1.micro 84 256 0 1
+                else
+                    nova flavor-create m1.micro 84 128 0 1
+                fi
             fi
-        fi
-        flavor_ref_alt=84
-    else
-        # Check Nova for existing flavors and, if set, look for the
-        # ``DEFAULT_INSTANCE_TYPE`` and use that.
-        boto_instance_type=$DEFAULT_INSTANCE_TYPE
-        flavor_lines=`nova flavor-list`
-        IFS=$'\r\n'
-        flavors=""
-        for line in $flavor_lines; do
-            f=$(echo $line | awk "/ $DEFAULT_INSTANCE_TYPE / { print \$2 }")
-            flavors="$flavors $f"
-        done
-
-        for line in $flavor_lines; do
-            flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | cut -d' ' -f2`"
-        done
-
-        IFS=" "
-        flavors=($flavors)
-        num_flavors=${#flavors[*]}
-        echo "Found $num_flavors flavors"
-        if [[ $num_flavors -eq 0 ]]; then
-            echo "Found no valid flavors to use!"
-            exit 1
-        fi
-        flavor_ref=${flavors[0]}
-        flavor_ref_alt=$flavor_ref
-
-        # ensure flavor_ref and flavor_ref_alt have different values
-        # some resize instance in tempest tests depends on this.
-        for f in ${flavors[@]:1}; do
-            if [[ $f -ne $flavor_ref ]]; then
-                flavor_ref_alt=$f
-                break
+            flavor_ref_alt=84
+        else
+            # Check Nova for existing flavors and, if set, look for the
+            # ``DEFAULT_INSTANCE_TYPE`` and use that.
+            boto_instance_type=$DEFAULT_INSTANCE_TYPE
+            flavor_lines=`nova flavor-list`
+            IFS=$'\r\n'
+            flavors=""
+            for line in $flavor_lines; do
+                f=$(echo $line | awk "/ $DEFAULT_INSTANCE_TYPE / { print \$2 }")
+                flavors="$flavors $f"
+            done
+
+            for line in $flavor_lines; do
+                flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | cut -d' ' -f2`"
+            done
+
+            IFS=" "
+            flavors=($flavors)
+            num_flavors=${#flavors[*]}
+            echo "Found $num_flavors flavors"
+            if [[ $num_flavors -eq 0 ]]; then
+                echo "Found no valid flavors to use!"
+                exit 1
             fi
-        done
+            flavor_ref=${flavors[0]}
+            flavor_ref_alt=$flavor_ref
+
+            # ensure flavor_ref and flavor_ref_alt have different values
+            # some resize instance in tempest tests depends on this.
+            for f in ${flavors[@]:1}; do
+                if [[ $f -ne $flavor_ref ]]; then
+                    flavor_ref_alt=$f
+                    break
+                fi
+            done
+        fi
     fi
 
     if [ "$Q_USE_NAMESPACE" != "False" ]; then
@@ -460,20 +464,22 @@ function init_tempest {
     local kernel="$image_dir/${base_image_name}-vmlinuz"
     local ramdisk="$image_dir/${base_image_name}-initrd"
     local disk_image="$image_dir/${base_image_name}-blank.img"
-    # if the cirros uec downloaded and the system is uec capable
-    if [ -f "$kernel" -a -f "$ramdisk" -a -f "$disk_image" -a  "$VIRT_DRIVER" != "openvz" \
-        -a \( "$LIBVIRT_TYPE" != "lxc" -o "$VIRT_DRIVER" != "libvirt" \) ]; then
-        echo "Prepare aki/ari/ami Images"
-        mkdir -p $BOTO_MATERIALS_PATH
-        ( #new namespace
-            # tenant:demo ; user: demo
-            source $TOP_DIR/accrc/demo/demo
-            euca-bundle-image -r ${CIRROS_ARCH} -i "$kernel" --kernel true -d "$BOTO_MATERIALS_PATH"
-            euca-bundle-image -r ${CIRROS_ARCH} -i "$ramdisk" --ramdisk true -d "$BOTO_MATERIALS_PATH"
-            euca-bundle-image -r ${CIRROS_ARCH} -i "$disk_image" -d "$BOTO_MATERIALS_PATH"
-        ) 2>&1 </dev/null | cat
-    else
-        echo "Boto materials are not prepared"
+    if is_service_enabled nova; then
+        # if the cirros uec downloaded and the system is uec capable
+        if [ -f "$kernel" -a -f "$ramdisk" -a -f "$disk_image" -a  "$VIRT_DRIVER" != "openvz" \
+            -a \( "$LIBVIRT_TYPE" != "lxc" -o "$VIRT_DRIVER" != "libvirt" \) ]; then
+            echo "Prepare aki/ari/ami Images"
+            mkdir -p $BOTO_MATERIALS_PATH
+            ( #new namespace
+                # tenant:demo ; user: demo
+                source $TOP_DIR/accrc/demo/demo
+                euca-bundle-image -r ${CIRROS_ARCH} -i "$kernel" --kernel true -d "$BOTO_MATERIALS_PATH"
+                euca-bundle-image -r ${CIRROS_ARCH} -i "$ramdisk" --ramdisk true -d "$BOTO_MATERIALS_PATH"
+                euca-bundle-image -r ${CIRROS_ARCH} -i "$disk_image" -d "$BOTO_MATERIALS_PATH"
+            ) 2>&1 </dev/null | cat
+        else
+            echo "Boto materials are not prepared"
+        fi
     fi
 }
 

From b2631211abf752afad85b18ff479e0d76f4097fa Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Tue, 11 Nov 2014 11:11:00 +0900
Subject: [PATCH 0077/3333] Remove neutron ryu-plugin support

Ryu plugin was marked deprecated in Juno and will be removed for Kilo.

We (Ryu team) recommend users to migrate to ofagent, on which
we aim to concentrate our development resources by this deprecation.

Partial-Bug: #1391714
Change-Id: I1ef28818e9400664ae3d83758dc2dcf71c02f185
---
 MAINTAINERS.rst                   |  6 ---
 lib/neutron_plugins/ofagent_agent |  1 -
 lib/neutron_plugins/ryu           | 79 -------------------------------
 lib/neutron_thirdparty/ryu        | 63 ++----------------------
 4 files changed, 5 insertions(+), 144 deletions(-)
 delete mode 100644 lib/neutron_plugins/ryu

diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index d55135de64..a376eb0428 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -56,12 +56,6 @@ OpenFlow Agent (ofagent)
 * YAMAMOTO Takashi <yamamoto@valinux.co.jp>
 * Fumihiko Kakuma <kakuma@valinux.co.jp>
 
-Ryu
-~~~
-
-* YAMAMOTO Takashi <yamamoto@valinux.co.jp>
-* Fumihiko Kakuma <kakuma@valinux.co.jp>
-
 Sahara
 ~~~~~~
 
diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index 55f3f72056..90b37f1be9 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -18,7 +18,6 @@ function neutron_plugin_install_agent_packages {
     # This agent uses ryu to talk with switches
     install_package $(get_packages "ryu")
     install_ryu
-    configure_ryu
 }
 
 function neutron_plugin_configure_debug_command {
diff --git a/lib/neutron_plugins/ryu b/lib/neutron_plugins/ryu
deleted file mode 100644
index f45a7972e8..0000000000
--- a/lib/neutron_plugins/ryu
+++ /dev/null
@@ -1,79 +0,0 @@
-# Neutron Ryu plugin
-# ------------------
-
-# Save trace setting
-RYU_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-source $TOP_DIR/lib/neutron_thirdparty/ryu      # for configuration value
-
-function neutron_plugin_create_nova_conf {
-    _neutron_ovs_base_configure_nova_vif_driver
-    iniset $NOVA_CONF DEFAULT libvirt_ovs_integration_bridge "$OVS_BRIDGE"
-}
-
-function neutron_plugin_install_agent_packages {
-    _neutron_ovs_base_install_agent_packages
-
-    # neutron_ryu_agent requires ryu module
-    install_package $(get_packages "ryu")
-    install_ryu
-    configure_ryu
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/ryu
-    Q_PLUGIN_CONF_FILENAME=ryu.ini
-    Q_PLUGIN_CLASS="neutron.plugins.ryu.ryu_neutron_plugin.RyuNeutronPluginV2"
-}
-
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
-}
-
-function neutron_plugin_configure_l3_agent {
-    iniset $Q_L3_CONF_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
-    _neutron_ovs_base_configure_l3_agent
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # Set up integration bridge
-    _neutron_ovs_base_setup_bridge $OVS_BRIDGE
-    if [ -n "$RYU_INTERNAL_INTERFACE" ]; then
-        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_BRIDGE $RYU_INTERNAL_INTERFACE
-    fi
-    iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $OVS_BRIDGE
-    AGENT_BINARY="$NEUTRON_DIR/neutron/plugins/ryu/agent/ryu_neutron_agent.py"
-
-    _neutron_ovs_base_configure_firewall_driver
-}
-
-function neutron_plugin_configure_service {
-    iniset /$Q_PLUGIN_CONF_FILE ovs openflow_rest_api $RYU_API_HOST:$RYU_API_PORT
-
-    _neutron_ovs_base_configure_firewall_driver
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
-    iniset $conf_file DEFAULT ovs_use_veth True
-}
-
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
-}
-
-# Restore xtrace
-$RYU_XTRACE
diff --git a/lib/neutron_thirdparty/ryu b/lib/neutron_thirdparty/ryu
index 233f3aacdf..eaf088b797 100644
--- a/lib/neutron_thirdparty/ryu
+++ b/lib/neutron_thirdparty/ryu
@@ -1,56 +1,15 @@
-# Ryu OpenFlow Controller
-# -----------------------
+# Ryu SDN Framework
+# -----------------
+
+# Used by ofagent.
+# TODO(yamamoto): Switch to pip_install once the development was settled
 
 # Save trace setting
 RYU3_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-
 RYU_DIR=$DEST/ryu
-# Ryu API Host
-RYU_API_HOST=${RYU_API_HOST:-127.0.0.1}
-# Ryu API Port
-RYU_API_PORT=${RYU_API_PORT:-8080}
-# Ryu OFP Host
-RYU_OFP_HOST=${RYU_OFP_HOST:-127.0.0.1}
-# Ryu OFP Port
-RYU_OFP_PORT=${RYU_OFP_PORT:-6633}
-# Ryu Applications
-RYU_APPS=${RYU_APPS:-ryu.app.simple_isolation,ryu.app.rest}
-
-function configure_ryu {
-    :
-}
-
-function init_ryu {
-    RYU_CONF_DIR=/etc/ryu
-    if [[ ! -d $RYU_CONF_DIR ]]; then
-        sudo mkdir -p $RYU_CONF_DIR
-    fi
-    sudo chown $STACK_USER $RYU_CONF_DIR
-    RYU_CONF=$RYU_CONF_DIR/ryu.conf
-    sudo rm -rf $RYU_CONF
-
-    # Ryu configuration
-    RYU_CONF_CONTENTS=${RYU_CONF_CONTENTS:-"[DEFAULT]
-app_lists=$RYU_APPS
-wsapi_host=$RYU_API_HOST
-wsapi_port=$RYU_API_PORT
-ofp_listen_host=$RYU_OFP_HOST
-ofp_tcp_listen_port=$RYU_OFP_PORT
-neutron_url=http://$Q_HOST:$Q_PORT
-neutron_admin_username=$Q_ADMIN_USERNAME
-neutron_admin_password=$SERVICE_PASSWORD
-neutron_admin_tenant_name=$SERVICE_TENANT_NAME
-neutron_admin_auth_url=$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0
-neutron_auth_strategy=$Q_AUTH_STRATEGY
-neutron_controller_addr=tcp:$RYU_OFP_HOST:$RYU_OFP_PORT
-"}
-    echo "${RYU_CONF_CONTENTS}" > $RYU_CONF
-}
 
-# install_ryu can be called multiple times as neutron_pluing/ryu may call
-# this function for neutron-ryu-agent
 # Make this function idempotent and avoid cloning same repo many times
 # with RECLONE=yes
 _RYU_INSTALLED=${_RYU_INSTALLED:-False}
@@ -63,17 +22,5 @@ function install_ryu {
     fi
 }
 
-function start_ryu {
-    run_process ryu "$RYU_DIR/bin/ryu-manager --config-file $RYU_CONF"
-}
-
-function stop_ryu {
-    :
-}
-
-function check_ryu {
-    :
-}
-
 # Restore xtrace
 $RYU3_XTRACE

From 52f13a4087ef8b49640053bebd6a5046d55c63fe Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 12 Nov 2014 06:33:36 -0500
Subject: [PATCH 0078/3333] remove the trove exercise

The trove cli has been changed in an incompatible way. Exercises
are the requirements of projects to keep functioning, if they aren't
we should fast delete them.

Related-Bug: #1391840

Change-Id: I3b61194ff220525aed202c7f7851faa0be446646
---
 exercises/trove.sh | 49 ----------------------------------------------
 1 file changed, 49 deletions(-)
 delete mode 100755 exercises/trove.sh

diff --git a/exercises/trove.sh b/exercises/trove.sh
deleted file mode 100755
index 053f872361..0000000000
--- a/exercises/trove.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-
-# **trove.sh**
-
-# Sanity check that trove started if enabled
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-is_service_enabled trove || exit 55
-
-# can try to get datastore id
-DSTORE_ID=$(trove datastore-list | tail -n +4 |head -3 | get_field 1)
-die_if_not_set $LINENO  DSTORE_ID "Trove API not functioning!"
-
-DV_ID=$(trove datastore-version-list $DSTORE_ID | tail -n +4 | get_field 1)
-die_if_not_set $LINENO DV_ID "Trove API not functioning!"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
-

From 6d20f09045dba237caf50d8d55dcc90a9f105ee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20Sedl=C3=A1k?= <psedlak@redhat.com>
Date: Wed, 22 Oct 2014 15:34:46 +0200
Subject: [PATCH 0079/3333] Initial support for Fedora 21

Initial support for Fedora 21.  Add f21 to the distribution lists for
rpms, ensure "mariadb" is used over "mysqld" and enable it in the
distro check, as we have several reports of it working.

Tested with [1]

[1] http://download.fedoraproject.org/pub/fedora/linux/releases/test/21-Beta/Cloud/Images/x86_64/Fedora-Cloud-Base-20141029-21_Beta.x86_64.qcow2

Change-Id: I97cbede806e5c00363c7174fa1e9f286de96aab6
---
 files/rpms/cinder   |  2 +-
 files/rpms/glance   |  6 +++---
 files/rpms/horizon  |  4 ++--
 files/rpms/keystone | 10 +++++-----
 files/rpms/neutron  |  4 ++--
 files/rpms/nova     |  6 +++---
 files/rpms/swift    |  2 +-
 lib/databases/mysql | 18 +++++++++---------
 stack.sh            |  2 +-
 9 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index ce6181eedf..eedff184dd 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -3,4 +3,4 @@ scsi-target-utils
 qemu-img
 postgresql-devel
 iscsi-initiator-utils
-python-lxml         #dist:f19,f20,rhel7
+python-lxml         #dist:f19,f20,f21,rhel7
diff --git a/files/rpms/glance b/files/rpms/glance
index 5a7f073f35..d2792cf987 100644
--- a/files/rpms/glance
+++ b/files/rpms/glance
@@ -6,10 +6,10 @@ postgresql-devel    # testonly
 python-argparse
 python-eventlet
 python-greenlet
-python-lxml         #dist:f19,f20,rhel7
-python-paste-deploy #dist:f19,f20,rhel7
+python-lxml         #dist:f19,f20,f21,rhel7
+python-paste-deploy #dist:f19,f20,f21,rhel7
 python-routes
 python-sqlalchemy
-python-wsgiref      #dist:f18,f19,f20
+python-wsgiref      #dist:f18,f19,f20,f21
 pyxattr
 zlib-devel          # testonly
diff --git a/files/rpms/horizon b/files/rpms/horizon
index 7add23a549..1d06ac278b 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -12,8 +12,8 @@ python-httplib2
 python-migrate
 python-mox
 python-nose
-python-paste        #dist:f19,f20
-python-paste-deploy #dist:f19,f20
+python-paste        #dist:f19,f20,f21
+python-paste-deploy #dist:f19,f20,f21
 python-routes
 python-sphinx
 python-sqlalchemy
diff --git a/files/rpms/keystone b/files/rpms/keystone
index ce41ee598b..8b0953dd69 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,10 +1,10 @@
 MySQL-python
 python-greenlet
-libxslt-devel       # dist:f20
-python-lxml         #dist:f19,f20
-python-paste        #dist:f19,f20
-python-paste-deploy #dist:f19,f20
-python-paste-script #dist:f19,f20
+libxslt-devel       # dist:f20,f21
+python-lxml         #dist:f19,f20,f21
+python-paste        #dist:f19,f20,f21
+python-paste-deploy #dist:f19,f20,f21
+python-paste-script #dist:f19,f20,f21
 python-routes
 python-sqlalchemy
 python-webob
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 2c9dd3d5e8..f2473fb20d 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -12,8 +12,8 @@ python-eventlet
 python-greenlet
 python-iso8601
 #rhel6 gets via pip
-python-paste        # dist:f19,f20,rhel7
-python-paste-deploy # dist:f19,f20,rhel7
+python-paste        # dist:f19,f20,f21,rhel7
+python-paste-deploy # dist:f19,f20,f21,rhel7
 python-qpid # NOPRIME
 python-routes
 python-sqlalchemy
diff --git a/files/rpms/nova b/files/rpms/nova
index f3261c6ae0..07f13c7071 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -29,11 +29,11 @@ python-iso8601
 python-lockfile
 python-migrate
 python-mox
-python-paramiko # dist:f19,f20,rhel7
+python-paramiko # dist:f19,f20,f21,rhel7
 # ^ on RHEL6, brings in python-crypto which conflicts with version from
 # pip we need
-python-paste        # dist:f19,f20,rhel7
-python-paste-deploy # dist:f19,f20,rhel7
+python-paste        # dist:f19,f20,f21,rhel7
+python-paste-deploy # dist:f19,f20,f21,rhel7
 python-qpid # NOPRIME
 python-routes
 python-sqlalchemy
diff --git a/files/rpms/swift b/files/rpms/swift
index 9ec4aab8ce..ccda22bcc8 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -6,7 +6,7 @@ python-eventlet
 python-greenlet
 python-netifaces
 python-nose
-python-paste-deploy # dist:f19,f20,rhel7
+python-paste-deploy # dist:f19,f20,f21,rhel7
 python-simplejson
 python-webob
 pyxattr
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 67bf85ac97..7a444a3140 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -26,10 +26,10 @@ function cleanup_database_mysql {
         sudo rm -rf /etc/mysql
         return
     elif is_fedora; then
-        if [[ $DISTRO =~ (rhel7) ]]; then
-            MYSQL=mariadb
-        else
+        if [[ $DISTRO =~ (rhel6) ]]; then
             MYSQL=mysqld
+        else
+            MYSQL=mariadb
         fi
     elif is_suse; then
         MYSQL=mysql
@@ -54,10 +54,10 @@ function configure_database_mysql {
         my_conf=/etc/mysql/my.cnf
         mysql=mysql
     elif is_fedora; then
-        if [[ $DISTRO =~ (rhel7) ]]; then
-            mysql=mariadb
-        else
+        if [[ $DISTRO =~ (rhel6) ]]; then
             mysql=mysqld
+        else
+            mysql=mariadb
         fi
         my_conf=/etc/my.cnf
     elif is_suse; then
@@ -142,10 +142,10 @@ EOF
     fi
     # Install mysql-server
     if is_ubuntu || is_fedora; then
-        if [[ $DISTRO =~ (rhel7) ]]; then
-            install_package mariadb-server
-        else
+        if [[ $DISTRO =~ (rhel6) ]]; then
             install_package mysql-server
+        else
+            install_package mariadb-server
         fi
     elif is_suse; then
         if ! is_package_installed mariadb; then
diff --git a/stack.sh b/stack.sh
index 38ecceb717..8e05ae6322 100755
--- a/stack.sh
+++ b/stack.sh
@@ -143,7 +143,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f19|f20|rhel6|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f19|f20|f21|rhel6|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 91e4018afd98e454a0d56a69271e089ac97aab5c Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Thu, 13 Nov 2014 12:18:33 +0100
Subject: [PATCH 0080/3333] Add 'net-tools' package dependency

Noticed this on a freshly installed, minimal Fedora-21 (from
development repos):

  $ ./stack.sh
  [. . .]
  2014-11-13 10:56:22.442 | + local exitcode=0
  2014-11-13 10:56:22.453 | + sudo route add -net 10.1.0.0/24 gw 172.24.4.2
  2014-11-13 10:56:22.479 | sudo: route: command not found
  2014-11-13 10:56:22.488 | + exit_trap
  [. . .]

Also added it to files/rpms-suse/general, just in case.

Change-Id: I77954d97e654e8f384a2016631df14e73be927fe
---
 files/rpms-suse/general | 1 +
 files/rpms/general      | 1 +
 2 files changed, 2 insertions(+)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0a4746f185..f1f7e8f173 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -22,3 +22,4 @@ tar
 tcpdump
 unzip
 wget
+net-tools
diff --git a/files/rpms/general b/files/rpms/general
index d4a9fcba55..d7ace9b990 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,6 +27,7 @@ which
 bc
 libyaml-devel
 gettext  # used for compiling message catalogs
+net-tools
 
 # [1] : some of installed tools have unversioned dependencies on this,
 # but others have versioned (<=0.7).  So if a later version (0.7.1)

From e08ab104e62da041fcc6b2aafba4349326f4a969 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Nov 2014 17:09:28 -0500
Subject: [PATCH 0081/3333] fix python-* lib from git installation

We're using all the magic variables based on python-fooclient, however
all the inline code was using fooclient for variables. So we had a
mismatch, which was kindly pointed out by some of the 3rd party ci
testers.

Change-Id: I27a56222c7e8e610fba8bf97672d2a42f5cf14ca
---
 functions-common | 12 +++++++++++-
 lib/ceilometer   | 10 +++++-----
 lib/cinder       | 10 +++++-----
 lib/glance       |  8 ++++----
 lib/heat         | 10 +++++-----
 lib/ironic       | 10 +++++-----
 lib/keystone     | 10 +++++-----
 lib/neutron      | 10 +++++-----
 lib/nova         | 10 +++++-----
 lib/swift        |  8 ++++----
 lib/trove        |  8 ++++----
 stack.sh         |  8 ++++----
 stackrc          | 44 ++++++++++++++++++++++----------------------
 13 files changed, 84 insertions(+), 74 deletions(-)

diff --git a/functions-common b/functions-common
index 996d79ba6f..e890b75d13 100644
--- a/functions-common
+++ b/functions-common
@@ -1615,7 +1615,6 @@ function use_library_from_git {
     return $enabled
 }
 
-
 # setup a library by name. If we are trying to use the library from
 # git, we'll do a git based install, otherwise we'll punt and the
 # library should be installed by a requirements pull from another
@@ -1626,6 +1625,17 @@ function setup_lib {
     setup_install $dir
 }
 
+# setup a library by name in editiable mode. If we are trying to use
+# the library from git, we'll do a git based install, otherwise we'll
+# punt and the library should be installed by a requirements pull from
+# another project.
+#
+# use this for non namespaced libraries
+function setup_dev_lib {
+    local name=$1
+    local dir=${GITDIR[$name]}
+    setup_develop $dir
+}
 
 # this should be used if you want to install globally, all libraries should
 # use this, especially *oslo* ones
diff --git a/lib/ceilometer b/lib/ceilometer
index eee3e8f35d..c4377e04c0 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -35,7 +35,7 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["ceilometerclient"]=$DEST/python-ceilometerclient
+GITDIR["python-ceilometerclient"]=$DEST/python-ceilometerclient
 
 CEILOMETER_DIR=$DEST/ceilometer
 CEILOMETER_CONF_DIR=/etc/ceilometer
@@ -269,10 +269,10 @@ function install_ceilometer {
 
 # install_ceilometerclient() - Collect source and prepare
 function install_ceilometerclient {
-    if use_library_from_git "ceilometerclient"; then
-        git_clone_by_name "ceilometerclient"
-        setup_develop "ceilometerclient"
-        sudo install -D -m 0644 -o $STACK_USER {$CEILOMETERCLIENT_DIR/tools/,/etc/bash_completion.d/}ceilometer.bash_completion
+    if use_library_from_git "python-ceilometerclient"; then
+        git_clone_by_name "python-ceilometerclient"
+        setup_dev_lib "python-ceilometerclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-ceilometerclient"]}/tools/,/etc/bash_completion.d/}ceilometer.bash_completion
     fi
 }
 
diff --git a/lib/cinder b/lib/cinder
index 56878642e3..eb3cbe86cf 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -36,7 +36,7 @@ if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
 fi
 
 # set up default directories
-GITDIR["cinderclient"]=$DEST/python-cinderclient
+GITDIR["python-cinderclient"]=$DEST/python-cinderclient
 
 CINDER_DIR=$DEST/cinder
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
@@ -403,10 +403,10 @@ function install_cinder {
 
 # install_cinderclient() - Collect source and prepare
 function install_cinderclient {
-    if use_library_from_git "cinderclient"; then
-        git_clone_by_name "cinderclient"
-        setup_develop "cinderclient"
-        sudo install -D -m 0644 -o $STACK_USER {$CINDERCLIENT_DIR/tools/,/etc/bash_completion.d/}cinder.bash_completion
+    if use_library_from_git "python-cinderclient"; then
+        git_clone_by_name "python-cinderclient"
+        setup_dev_lib "python-cinderclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-cinderclient"]}/tools/,/etc/bash_completion.d/}cinder.bash_completion
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index 8cd48b13f9..3a4ccd8132 100644
--- a/lib/glance
+++ b/lib/glance
@@ -27,7 +27,7 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["glanceclient"]=$DEST/python-glanceclient
+GITDIR["python-glanceclient"]=$DEST/python-glanceclient
 
 GLANCE_DIR=$DEST/glance
 GLANCE_STORE_DIR=$DEST/glance_store
@@ -287,9 +287,9 @@ function init_glance {
 
 # install_glanceclient() - Collect source and prepare
 function install_glanceclient {
-    if use_library_from_git "glanceclient"; then
-        git_clone_by_name "glanceclient"
-        setup_develop "glanceclient"
+    if use_library_from_git "python-glanceclient"; then
+        git_clone_by_name "python-glanceclient"
+        setup_dev_lib "python-glanceclient"
     fi
 }
 
diff --git a/lib/heat b/lib/heat
index ed5181b2b8..2b55cf0f6a 100644
--- a/lib/heat
+++ b/lib/heat
@@ -29,7 +29,7 @@ set +o xtrace
 # --------
 
 # set up default directories
-GITDIR["heatclient"]=$DEST/python-heatclient
+GITDIR["python-heatclient"]=$DEST/python-heatclient
 
 HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
@@ -184,10 +184,10 @@ function create_heat_cache_dir {
 
 # install_heatclient() - Collect source and prepare
 function install_heatclient {
-    if use_library_from_git "heatclient"; then
-        git_clone_by_name "heatclient"
-        setup_develop "heatclient"
-        sudo install -D -m 0644 -o $STACK_USER {$HEATCLIENT_DIR/tools/,/etc/bash_completion.d/}heat.bash_completion
+    if use_library_from_git "python-heatclient"; then
+        git_clone_by_name "python-heatclient"
+        setup_dev_lib "python-heatclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-heatclient"]}/tools/,/etc/bash_completion.d/}heat.bash_completion
     fi
 }
 
diff --git a/lib/ironic b/lib/ironic
index c90482a00b..afe69f2df8 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -28,7 +28,7 @@ set +o pipefail
 # --------
 
 # Set up default directories
-GITDIR["ironicclient"]=$DEST/python-ironicclient
+GITDIR["python-ironicclient"]=$DEST/python-ironicclient
 
 IRONIC_DIR=$DEST/ironic
 IRONIC_PYTHON_AGENT_DIR=$DEST/ironic-python-agent
@@ -151,10 +151,10 @@ function install_ironic {
 
 # install_ironicclient() - Collect sources and prepare
 function install_ironicclient {
-    if use_library_from_git "ironicclient"; then
-        git_clone_by_name "ironicclient"
-        setup_develop "ironicclient"
-        sudo install -D -m 0644 -o $STACK_USER {$IRONICCLIENT_DIR/tools/,/etc/bash_completion.d/}ironic.bash_completion
+    if use_library_from_git "python-ironicclient"; then
+        git_clone_by_name "python-ironicclient"
+        setup_dev_lib "python-ironicclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-ironicclient"]}/tools/,/etc/bash_completion.d/}ironic.bash_completion
     else
         # nothing actually "requires" ironicclient, so force instally from pypi
         pip_install python-ironicclient
diff --git a/lib/keystone b/lib/keystone
index 6341ce2eea..e2c823a89e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -33,7 +33,7 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["keystoneclient"]=$DEST/python-keystoneclient
+GITDIR["python-keystoneclient"]=$DEST/python-keystoneclient
 
 KEYSTONE_DIR=$DEST/keystone
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
@@ -480,10 +480,10 @@ function init_keystone {
 
 # install_keystoneclient() - Collect source and prepare
 function install_keystoneclient {
-    if use_library_from_git "keystoneclient"; then
-        git_clone_by_name "keystoneclient"
-        setup_develop "keystoneclient"
-        sudo install -D -m 0644 -o $STACK_USER {$KEYSTONECLIENT_DIR/tools/,/etc/bash_completion.d/}keystone.bash_completion
+    if use_library_from_git "python-keystoneclient"; then
+        git_clone_by_name "python-keystoneclient"
+        setup_dev_lib "python-keystoneclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-keystoneclient"]}/tools/,/etc/bash_completion.d/}keystone.bash_completion
     fi
 }
 
diff --git a/lib/neutron b/lib/neutron
index 8f1bbf2b93..8295a738b7 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -67,7 +67,7 @@ fi
 
 
 # Set up default directories
-GITDIR["neutronclient"]=$DEST/python-neutronclient
+GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 
 NEUTRON_DIR=$DEST/neutron
@@ -620,10 +620,10 @@ function install_neutron {
 
 # install_neutronclient() - Collect source and prepare
 function install_neutronclient {
-    if use_library_from_git "neutronclient"; then
-        git_clone_by_name "neutronclient"
-        setup_develop "neutronclient"
-        sudo install -D -m 0644 -o $STACK_USER {$NEUTRONCLIENT_DIR/tools/,/etc/bash_completion.d/}neutron.bash_completion
+    if use_library_from_git "python-neutronclient"; then
+        git_clone_by_name "python-neutronclient"
+        setup_dev_lib "python-neutronclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index d5f11928e5..78906f7210 100644
--- a/lib/nova
+++ b/lib/nova
@@ -29,7 +29,7 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["novaclient"]=$DEST/python-novaclient
+GITDIR["python-novaclient"]=$DEST/python-novaclient
 
 
 NOVA_DIR=$DEST/nova
@@ -639,10 +639,10 @@ function init_nova {
 
 # install_novaclient() - Collect source and prepare
 function install_novaclient {
-    if use_library_from_git "novaclient"; then
-        git_clone_by_name "novaclient"
-        setup_develop "novaclient"
-        sudo install -D -m 0644 -o $STACK_USER {$NOVACLIENT_DIR/tools/,/etc/bash_completion.d/}nova.bash_completion
+    if use_library_from_git "python-novaclient"; then
+        git_clone_by_name "python-novaclient"
+        setup_dev_lib "python-novaclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-novaclient"]}/tools/,/etc/bash_completion.d/}nova.bash_completion
     fi
 }
 
diff --git a/lib/swift b/lib/swift
index 801628241a..ae0874ebdf 100644
--- a/lib/swift
+++ b/lib/swift
@@ -34,7 +34,7 @@ if is_ssl_enabled_service "s-proxy" || is_service_enabled tls-proxy; then
 fi
 
 # Set up default directories
-GITDIR["swiftclient"]=$DEST/python-swiftclient
+GITDIR["python-swiftclient"]=$DEST/python-swiftclient
 
 
 SWIFT_DIR=$DEST/swift
@@ -677,9 +677,9 @@ function install_swift {
 }
 
 function install_swiftclient {
-    if use_library_from_git "swiftclient"; then
-        git_clone_by_name "swiftclient"
-        setup_develop "swiftclient"
+    if use_library_from_git "python-swiftclient"; then
+        git_clone_by_name "python-swiftclient"
+        setup_dev_lib "python-swiftclient"
     fi
 }
 
diff --git a/lib/trove b/lib/trove
index 50bd684745..60b2bdba22 100644
--- a/lib/trove
+++ b/lib/trove
@@ -28,7 +28,7 @@ else
 fi
 
 # Set up default configuration
-GITDIR["troveclient"]=$DEST/python-troveclient
+GITDIR["python-troveclient"]=$DEST/python-troveclient
 
 TROVE_DIR=$DEST/trove
 TROVE_CONF_DIR=/etc/trove
@@ -181,9 +181,9 @@ function configure_trove {
 
 # install_troveclient() - Collect source and prepare
 function install_troveclient {
-    if use_library_from_git "troveclient"; then
-        git_clone_by_name "troveclient"
-        setup_develop "troveclient"
+    if use_library_from_git "python-troveclient"; then
+        git_clone_by_name "python-troveclient"
+        setup_dev_lib "python-troveclient"
     fi
 }
 
diff --git a/stack.sh b/stack.sh
index 2f045119bc..54444ad80c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -584,7 +584,7 @@ if [[ -d $TOP_DIR/extras.d ]]; then
 fi
 
 # Set the destination directories for other OpenStack projects
-GITDIR["openstackclient"]=$DEST/python-openstackclient
+GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
 # Interactive Configuration
 # -------------------------
@@ -788,9 +788,9 @@ fi
 install_keystonemiddleware
 
 # install the OpenStack client, needed for most setup commands
-if use_library_from_git "openstackclient"; then
-    git_clone_by_name "openstackclient"
-    setup_develop "openstackclient"
+if use_library_from_git "python-openstackclient"; then
+    git_clone_by_name "python-openstackclient"
+    setup_dev_lib "python-openstackclient"
 else
     pip_install python-openstackclient
 fi
diff --git a/stackrc b/stackrc
index 2f08c730be..c7bad78c0e 100644
--- a/stackrc
+++ b/stackrc
@@ -210,48 +210,48 @@ GITBRANCH["tempest_lib"]=${TEMPEST_LIB_BRANCH:-master}
 ##############
 
 # ceilometer client library
-GITREPO["ceilometerclient"]=${CEILOMETERCLIENT_REPO:-${GIT_BASE}/openstack/python-ceilometerclient.git}
-GITBRANCH["ceilometerclient"]=${CEILOMETERCLIENT_BRANCH:-master}
+GITREPO["python-ceilometerclient"]=${CEILOMETERCLIENT_REPO:-${GIT_BASE}/openstack/python-ceilometerclient.git}
+GITBRANCH["python-ceilometerclient"]=${CEILOMETERCLIENT_BRANCH:-master}
 
 # volume client
-GITREPO["cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
-GITBRACH["cinderclient"]=${CINDERCLIENT_BRANCH:-master}
+GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
+GITBRACH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
 # python glance client library
-GITREPO["glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
-GITBRANCH["glanceclient"]=${GLANCECLIENT_BRANCH:-master}
+GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
+GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
 
 # python heat client library
-GITREPO["heatclient"]=${HEATCLIENT_REPO:-${GIT_BASE}/openstack/python-heatclient.git}
-GITBRANCH["heatclient"]=${HEATCLIENT_BRANCH:-master}
+GITREPO["python-heatclient"]=${HEATCLIENT_REPO:-${GIT_BASE}/openstack/python-heatclient.git}
+GITBRANCH["python-heatclient"]=${HEATCLIENT_BRANCH:-master}
 
 # ironic client
-GITREPO["ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
-GITBRANCH["ironicclient"]=${IRONICCLIENT_BRANCH:-master}
+GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
+GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
 
 # python keystone client library to nova that horizon uses
-GITREPO["keystoneclient"]=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
-GITBRANCH["keystoneclient"]=${KEYSTONECLIENT_BRANCH:-master}
+GITREPO["python-keystoneclient"]=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
+GITBRANCH["python-keystoneclient"]=${KEYSTONECLIENT_BRANCH:-master}
 
 # neutron client
-GITREPO["neutronclient"]=${NEUTRONCLIENT_REPO:-${GIT_BASE}/openstack/python-neutronclient.git}
-GITBRANCH["neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
+GITREPO["python-neutronclient"]=${NEUTRONCLIENT_REPO:-${GIT_BASE}/openstack/python-neutronclient.git}
+GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
 
 # python client library to nova that horizon (and others) use
-GITREPO["novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
-GITBRANCH["novaclient"]=${NOVACLIENT_BRANCH:-master}
+GITREPO["python-novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
+GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-master}
 
 # python swift client library
-GITREPO["swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
-GITBRANCH["swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
+GITREPO["python-swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
+GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
 
 # trove client library test
-GITREPO["troveclient"]=${TROVECLIENT_REPO:-${GIT_BASE}/openstack/python-troveclient.git}
-GITBRANCH["troveclient"]=${TROVECLIENT_BRANCH:-master}
+GITREPO["python-troveclient"]=${TROVECLIENT_REPO:-${GIT_BASE}/openstack/python-troveclient.git}
+GITBRANCH["python-troveclient"]=${TROVECLIENT_BRANCH:-master}
 
 # consolidated openstack python client
-GITREPO["openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
-GITBRANCH["openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
+GITREPO["python-openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
+GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
 
 ###################
 #

From ee5ae7b92369484007d8deb249f6c941d422123c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Nov 2014 13:23:27 -0500
Subject: [PATCH 0082/3333] further pypi libs conversions

glance_store and saharaclient were missed in the last round, make
them install from released clients in this patch.

Change-Id: I2e0ed2b7fb5994ae6abd92612a67ce5fd82b3f7e
---
 lib/glance |  8 +++++---
 lib/sahara | 13 +++++--------
 stackrc    | 16 ++++++++++++----
 3 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/lib/glance b/lib/glance
index 3a4ccd8132..04c088aa6d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -28,9 +28,9 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-glanceclient"]=$DEST/python-glanceclient
+GIRDIR["glance_store"]=$DEST/glance_store
 
 GLANCE_DIR=$DEST/glance
-GLANCE_STORE_DIR=$DEST/glance_store
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
@@ -297,8 +297,10 @@ function install_glanceclient {
 function install_glance {
     # Install glance_store from git so we make sure we're testing
     # the latest code.
-    git_clone $GLANCE_STORE_REPO $GLANCE_STORE_DIR $GLANCE_STORE_BRANCH
-    setup_develop $GLANCE_STORE_DIR
+    if use_library_from_git "glance_store"; then
+        git_clone_by_name "glance_store"
+        setup_dev_lib "glance_store"
+    fi
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
     setup_develop $GLANCE_DIR
diff --git a/lib/sahara b/lib/sahara
index 6d1bef571a..4f1ba22c67 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -22,15 +22,10 @@ set +o xtrace
 # --------
 
 # Set up default repos
-SAHARA_REPO=${SAHARA_REPO:-${GIT_BASE}/openstack/sahara.git}
-SAHARA_BRANCH=${SAHARA_BRANCH:-master}
-
-SAHARA_PYTHONCLIENT_REPO=${SAHARA_PYTHONCLIENT_REPO:-${GIT_BASE}/openstack/python-saharaclient.git}
-SAHARA_PYTHONCLIENT_BRANCH=${SAHARA_PYTHONCLIENT_BRANCH:-master}
 
 # Set up default directories
+GITDIR["python-saharaclient"]=$DEST/python-saharaclient
 SAHARA_DIR=$DEST/sahara
-SAHARA_PYTHONCLIENT_DIR=$DEST/python-saharaclient
 
 SAHARA_CONF_DIR=${SAHARA_CONF_DIR:-/etc/sahara}
 SAHARA_CONF_FILE=${SAHARA_CONF_DIR}/sahara.conf
@@ -158,8 +153,10 @@ function install_sahara {
 
 # install_python_saharaclient() - Collect source and prepare
 function install_python_saharaclient {
-    git_clone $SAHARA_PYTHONCLIENT_REPO $SAHARA_PYTHONCLIENT_DIR $SAHARA_PYTHONCLIENT_BRANCH
-    setup_develop $SAHARA_PYTHONCLIENT_DIR
+    if use_library_from_git "python-saharaclient"; then
+        git_clone_by_name "python-saharaclient"
+        setup_dev_lib "python-saharaclient"
+    fi
 }
 
 # start_sahara() - Start running processes, including screen
diff --git a/stackrc b/stackrc
index c7bad78c0e..75f606f382 100644
--- a/stackrc
+++ b/stackrc
@@ -144,7 +144,7 @@ GIT_BASE=${GIT_BASE:-git://git.openstack.org}
 CEILOMETER_REPO=${CEILOMETER_REPO:-${GIT_BASE}/openstack/ceilometer.git}
 CEILOMETER_BRANCH=${CEILOMETER_BRANCH:-master}
 
-# volume service
+# block storage service
 CINDER_REPO=${CINDER_REPO:-${GIT_BASE}/openstack/cinder.git}
 CINDER_BRANCH=${CINDER_BRANCH:-master}
 
@@ -176,7 +176,11 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}
 
-# storage service
+# data processing service
+SAHARA_REPO=${SAHARA_REPO:-${GIT_BASE}/openstack/sahara.git}
+SAHARA_BRANCH=${SAHARA_BRANCH:-master}
+
+# object storage service
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
 SWIFT_BRANCH=${SWIFT_BRANCH:-master}
 
@@ -241,6 +245,10 @@ GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
 GITREPO["python-novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
 GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-master}
 
+# python saharaclient
+GITREPO["python-saharaclient"]=${SAHARACLIENT_REPO:-${GIT_BASE}/openstack/python-saharaclient.git}
+GITBRANCH["python-saharaclient"]=${SAHARACLIENT_BRANCH:-master}
+
 # python swift client library
 GITREPO["python-swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
 GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
@@ -330,8 +338,8 @@ GITBRANCH["pbr"]=${PBR_BRANCH:-master}
 ##################
 
 # glance store library
-GLANCE_STORE_REPO=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
-GLANCE_STORE_BRANCH=${GLANCE_STORE_BRANCH:-master}
+GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
+GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
 
 # heat-cfntools server agent
 HEAT_CFNTOOLS_REPO=${HEAT_CFNTOOLS_REPO:-${GIT_BASE}/openstack/heat-cfntools.git}

From ae9ee6bf97c721e43f468b70eb6fb5c234e3eeba Mon Sep 17 00:00:00 2001
From: yunhong jiang <yunhong.jiang@intel.com>
Date: Wed, 8 Oct 2014 07:01:02 -0700
Subject: [PATCH 0083/3333] Add Ironic hardware deployment support

Currently devstack create VMs and then deploy Ironic on these VMs.
Sometimes developer may want to deploy on real platform.

A separated file is required to provide the baremetal compute node
information, which includes four fields for each hardware platform,
the ipmi address, the mac address, the ipmi user name and the
password.

Change-Id: I422b43eae6edc95f15b8c40383d0ba7fbcd9b1ff
---
 lib/ironic  | 89 ++++++++++++++++++++++++++++++++++++++++++-----------
 lib/neutron | 17 +++++++++-
 2 files changed, 87 insertions(+), 19 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index afe69f2df8..a0a93d5deb 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -40,6 +40,18 @@ IRONIC_CONF_FILE=$IRONIC_CONF_DIR/ironic.conf
 IRONIC_ROOTWRAP_CONF=$IRONIC_CONF_DIR/rootwrap.conf
 IRONIC_POLICY_JSON=$IRONIC_CONF_DIR/policy.json
 
+# Deploy to hardware platform
+IRONIC_HW_NODE_CPU=${IRONIC_HW_NODE_CPU:-1}
+IRONIC_HW_NODE_RAM=${IRONIC_HW_NODE_RAM:-512}
+IRONIC_HW_NODE_DISK=${IRONIC_HW_NODE_DISK:-10}
+IRONIC_HW_EPHEMERAL_DISK=${IRONIC_HW_EPHEMERAL_DISK:-0}
+# The file is composed of multiple lines, each line includes four field
+# separated by white space: IPMI address, MAC address, IPMI username
+# and IPMI password.
+# An example:
+#   192.168.110.107 00:1e:67:57:50:4c root otc123
+IRONIC_IPMIINFO_FILE=${IRONIC_IPMIINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
+
 # Set up defaults for functional / integration testing
 IRONIC_SCRIPTS_DIR=${IRONIC_SCRIPTS_DIR:-$TOP_DIR/tools/ironic/scripts}
 IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$TOP_DIR/tools/ironic/templates}
@@ -51,6 +63,7 @@ IRONIC_SSH_KEY_FILENAME=${IRONIC_SSH_KEY_FILENAME:-ironic_key}
 IRONIC_KEY_FILE=$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME
 IRONIC_SSH_VIRT_TYPE=${IRONIC_SSH_VIRT_TYPE:-virsh}
 IRONIC_TFTPBOOT_DIR=${IRONIC_TFTPBOOT_DIR:-$IRONIC_DATA_DIR/tftpboot}
+IRONIC_TFTPSERVER_IP=${IRONIC_TFTPSERVER_IP:-$HOST_IP}
 IRONIC_VM_SSH_PORT=${IRONIC_VM_SSH_PORT:-22}
 IRONIC_VM_SSH_ADDRESS=${IRONIC_VM_SSH_ADDRESS:-$HOST_IP}
 IRONIC_VM_COUNT=${IRONIC_VM_COUNT:-1}
@@ -80,7 +93,7 @@ IRONIC_AGENT_KERNEL_URL=${IRONIC_AGENT_KERNEL_URL:-http://tarballs.openstack.org
 IRONIC_AGENT_RAMDISK_URL=${IRONIC_AGENT_RAMDISK_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe_image-oem.cpio.gz}
 
 # Which deploy driver to use - valid choices right now
-# are 'pxe_ssh' and 'agent_ssh'.
+# are 'pxe_ssh', 'pxe_ipmitool' and 'agent_ssh'.
 IRONIC_DEPLOY_DRIVER=${IRONIC_DEPLOY_DRIVER:-pxe_ssh}
 
 #TODO(agordeev): replace 'ubuntu' with host distro name getting
@@ -133,6 +146,11 @@ function is_ironic_enabled {
     return 1
 }
 
+function is_ironic_hardware {
+    is_ironic_enabled && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
+    return 1
+}
+
 # install_ironic() - Collect source and prepare
 function install_ironic {
     # make sure all needed service were enabled
@@ -273,7 +291,7 @@ function configure_ironic_conductor {
     iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF
     iniset $IRONIC_CONF_FILE DEFAULT enabled_drivers $IRONIC_ENABLED_DRIVERS
     iniset $IRONIC_CONF_FILE conductor api_url http://$HOST_IP:6385
-    iniset $IRONIC_CONF_FILE pxe tftp_server $HOST_IP
+    iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
     iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
     iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
     if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
@@ -475,7 +493,7 @@ function create_bridge_and_vms {
     create_ovs_taps
 }
 
-function enroll_vms {
+function enroll_nodes {
     local chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
     local idx=0
 
@@ -487,34 +505,65 @@ function enroll_vms {
         local _IRONIC_DEPLOY_RAMDISK_KEY=deploy_ramdisk
     fi
 
-    while read MAC; do
-
-        local node_id=$(ironic node-create --chassis_uuid $chassis_id \
-            --driver $IRONIC_DEPLOY_DRIVER \
+    if ! is_ironic_hardware; then
+        local ironic_node_cpu=$IRONIC_VM_SPECS_CPU
+        local ironic_node_ram=$IRONIC_VM_SPECS_RAM
+        local ironic_node_disk=$IRONIC_VM_SPECS_DISK
+        local ironic_ephemeral_disk=$IRONIC_VM_EPHEMERAL_DISK
+        local ironic_hwinfo_file=$IRONIC_VM_MACS_CSV_FILE
+        local node_options="\
             -i $_IRONIC_DEPLOY_KERNEL_KEY=$IRONIC_DEPLOY_KERNEL_ID \
             -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID \
             -i ssh_virt_type=$IRONIC_SSH_VIRT_TYPE \
             -i ssh_address=$IRONIC_VM_SSH_ADDRESS \
             -i ssh_port=$IRONIC_VM_SSH_PORT \
             -i ssh_username=$IRONIC_SSH_USERNAME \
-            -i ssh_key_filename=$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME \
-            -p cpus=$IRONIC_VM_SPECS_CPU \
-            -p memory_mb=$IRONIC_VM_SPECS_RAM \
-            -p local_gb=$IRONIC_VM_SPECS_DISK \
+            -i ssh_key_filename=$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME"
+    else
+        local ironic_node_cpu=$IRONIC_HW_NODE_CPU
+        local ironic_node_ram=$IRONIC_HW_NODE_RAM
+        local ironic_node_disk=$IRONIC_HW_NODE_DISK
+        local ironic_ephemeral_disk=$IRONIC_HW_EPHEMERAL_DISK
+        if [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
+            local ironic_hwinfo_file=$IRONIC_IPMIINFO_FILE
+        fi
+    fi
+
+    while read hardware_info; do
+        if ! is_ironic_hardware; then
+            local mac_address=$hardware_info
+        elif [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
+            local ipmi_address=$(echo $hardware_info |awk  '{print $1}')
+            local mac_address=$(echo $hardware_info |awk '{print $2}')
+            local ironic_ipmi_username=$(echo $hardware_info |awk '{print $3}')
+            local ironic_ipmi_passwd=$(echo $hardware_info |awk '{print $4}')
+            # Currently we require all hardware platform have same CPU/RAM/DISK info
+            # in future, this can be enhanced to support different type, and then
+            # we create the bare metal flavor with minimum value
+            local node_options="-i ipmi_address=$ipmi_address -i ipmi_password=$ironic_ipmi_passwd\
+                -i ipmi_username=$ironic_ipmi_username"
+        fi
+
+        local node_id=$(ironic node-create --chassis_uuid $chassis_id \
+            --driver $IRONIC_DEPLOY_DRIVER \
+            -p cpus=$ironic_node_cpu\
+            -p memory_mb=$ironic_node_ram\
+            -p local_gb=$ironic_node_disk\
             -p cpu_arch=x86_64 \
+            $node_options \
             | grep " uuid " | get_field 2)
 
-        ironic port-create --address $MAC --node_uuid $node_id
+        ironic port-create --address $mac_address --node_uuid $node_id
 
         idx=$((idx+1))
-    done < $IRONIC_VM_MACS_CSV_FILE
+    done < $ironic_hwinfo_file
 
     # create the nova flavor
     # NOTE(adam_g): Attempting to use an autogenerated UUID for flavor id here uncovered
     # bug (LP: #1333852) in Trove.  This can be changed to use an auto flavor id when the
     # bug is fixed in Juno.
-    local adjusted_disk=$(($IRONIC_VM_SPECS_DISK - $IRONIC_VM_EPHEMERAL_DISK))
-    nova flavor-create --ephemeral $IRONIC_VM_EPHEMERAL_DISK baremetal 551 $IRONIC_VM_SPECS_RAM $adjusted_disk $IRONIC_VM_SPECS_CPU
+    local adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
+    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal 551 $ironic_node_ram $adjusted_disk $ironic_node_cpu
 
     # TODO(lucasagomes): Remove the 'baremetal:deploy_kernel_id'
     # and 'baremetal:deploy_ramdisk_id' parameters
@@ -662,11 +711,15 @@ function upload_baremetal_ironic_deploy {
 
 function prepare_baremetal_basic_ops {
     upload_baremetal_ironic_deploy
-    create_bridge_and_vms
-    enroll_vms
+    if ! is_ironic_hardware; then
+        create_bridge_and_vms
+    fi
+    enroll_nodes
     configure_tftpd
     configure_iptables
-    configure_ironic_auxiliary
+    if ! is_ironic_hardware; then
+        configure_ironic_auxiliary
+    fi
 }
 
 function cleanup_baremetal_basic_ops {
diff --git a/lib/neutron b/lib/neutron
index 8295a738b7..db6bd47ced 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -523,7 +523,7 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
         NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+        SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
         SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
         sudo ip link set $OVS_PHYSICAL_BRIDGE up
         sudo ip link set br-int up
@@ -678,6 +678,13 @@ function start_neutron_agents {
         sudo ip link set $OVS_PHYSICAL_BRIDGE up
         sudo ip link set br-int up
         sudo ip link set $PUBLIC_INTERFACE up
+        if is_ironic_hardware; then
+            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $PUBLIC_INTERFACE
+                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
+            done
+            sudo route add -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+        fi
     fi
 
     if is_service_enabled q-vpn; then
@@ -729,6 +736,14 @@ function stop_neutron {
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
+    if [[ is_provider_network && is_ironic_hardware ]]; then
+        for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
+            sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
+            sudo ip addr add $IP dev $PUBLIC_INTERFACE
+        done
+        sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+    fi
+
     if is_neutron_ovs_base_plugin; then
         neutron_ovs_base_cleanup
     fi

From 425e8447f1db92af03c02c1bf42456773206c8a9 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Fri, 14 Nov 2014 11:09:16 +0000
Subject: [PATCH 0084/3333] Fix a typo of python-cinderclient GITBRANCH

A left out N. Causes various failures in shell evaluation.

Change-Id: Icc09998c645ef2b975cb24b56d0f71c60289c188
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index c7bad78c0e..d59166ebae 100644
--- a/stackrc
+++ b/stackrc
@@ -215,7 +215,7 @@ GITBRANCH["python-ceilometerclient"]=${CEILOMETERCLIENT_BRANCH:-master}
 
 # volume client
 GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
-GITBRACH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
+GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}

From 3c8973a90abc7601e46e2fcaf3d50343338e24d8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 14 Nov 2014 09:31:02 -0500
Subject: [PATCH 0085/3333] support installing django_openstack_auth from pypi

Part of the libs from pypi conversion, convert django_openstack_auth
to this format.

Change-Id: I97c8ea19d8aed1e0bdd62c06cfadd1d616573d76
---
 lib/horizon | 26 +++++++++++++-------------
 stackrc     |  4 ++--
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 0213948633..1b53831135 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -25,8 +25,9 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["django_openstack_auth"]=$DEST/django_openstack_auth
+
 HORIZON_DIR=$DEST/horizon
-HORIZONAUTH_DIR=$DEST/django_openstack_auth
 
 # local_settings.py is used to customize Dashboard settings.
 # The example file in Horizon repo is used by default.
@@ -89,9 +90,7 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    cd $HORIZON_DIR
-    ./run_tests.sh -N --compilemessages
-    cd -
+    (cd $HORIZON_DIR; ./run_tests.sh -N --compilemessages)
 }
 
 # init_horizon() - Initialize databases, etc.
@@ -145,15 +144,16 @@ function init_horizon {
 
 # install_django_openstack_auth() - Collect source and prepare
 function install_django_openstack_auth {
-    git_clone $HORIZONAUTH_REPO $HORIZONAUTH_DIR $HORIZONAUTH_BRANCH
-
-    # Compile message catalogs before installation
-    _prepare_message_catalog_compilation
-    cd $HORIZONAUTH_DIR
-    python setup.py compile_catalog
-    cd -
-
-    setup_install $HORIZONAUTH_DIR
+    if use_library_from_git "django_openstack_auth"; then
+        local dir=${GITDIR["django_openstack_auth"]}
+        git_clone_by_name "django_openstack_auth"
+        # Compile message catalogs before installation
+        _prepare_message_catalog_compilation
+        (cd $dir; python setup.py compile_catalog)
+        setup_dev_lib "django_openstack_auth"
+    fi
+    # if we aren't using this library from git, then we just let it
+    # get dragged in by the horizon setup.
 }
 
 # install_horizon() - Collect source and prepare
diff --git a/stackrc b/stackrc
index 75f606f382..a404ad88f4 100644
--- a/stackrc
+++ b/stackrc
@@ -350,8 +350,8 @@ HEAT_TEMPLATES_REPO=${HEAT_TEMPLATES_REPO:-${GIT_BASE}/openstack/heat-templates.
 HEAT_TEMPLATES_BRANCH=${HEAT_TEMPLATES_BRANCH:-master}
 
 # django openstack_auth library
-HORIZONAUTH_REPO=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/django_openstack_auth.git}
-HORIZONAUTH_BRANCH=${HORIZONAUTH_BRANCH:-master}
+GITREPO["django_openstack_auth"]=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/django_openstack_auth.git}
+GITBRANCH["django_openstack_auth"]=${HORIZONAUTH_BRANCH:-master}
 
 # keystone middleware
 KEYSTONEMIDDLEWARE_REPO=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}

From 658312ca2f54aaabd43f91d2fca73cbee0319735 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 14 Nov 2014 11:35:56 -0500
Subject: [PATCH 0086/3333] move keystonemiddleware to pypi libs

Make keystonemiddleware install from pypi releases by default

Change-Id: I3dc4b096b4184f4cf00fb0df66b76fcc8f19785b
---
 lib/keystone | 9 +++++----
 stackrc      | 4 ++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index e2c823a89e..72a79be44d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -34,6 +34,7 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-keystoneclient"]=$DEST/python-keystoneclient
+GITDIR["keystonemiddleware"]=$DEST/keystonemiddleware
 
 KEYSTONE_DIR=$DEST/keystone
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
@@ -46,8 +47,6 @@ else
     KEYSTONE_WSGI_DIR=${KEYSTONE_WSGI_DIR:-/var/www/keystone}
 fi
 
-KEYSTONEMIDDLEWARE_DIR=$DEST/keystonemiddleware
-
 # Set up additional extensions, such as oauth1, federation
 # Example of KEYSTONE_EXTENSIONS=oauth1,federation
 KEYSTONE_EXTENSIONS=${KEYSTONE_EXTENSIONS:-}
@@ -489,8 +488,10 @@ function install_keystoneclient {
 
 # install_keystonemiddleware() - Collect source and prepare
 function install_keystonemiddleware {
-    git_clone $KEYSTONEMIDDLEWARE_REPO $KEYSTONEMIDDLEWARE_DIR $KEYSTONEMIDDLEWARE_BRANCH
-    setup_install $KEYSTONEMIDDLEWARE_DIR
+    if use_library_from_git "keystonemiddleware"; then
+        git_clone_by_name "keystonemiddleware"
+        setup_dev_lib "keystonemiddleware"
+    fi
 }
 
 # install_keystone() - Collect source and prepare
diff --git a/stackrc b/stackrc
index a404ad88f4..d54a497bb0 100644
--- a/stackrc
+++ b/stackrc
@@ -354,8 +354,8 @@ GITREPO["django_openstack_auth"]=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/djang
 GITBRANCH["django_openstack_auth"]=${HORIZONAUTH_BRANCH:-master}
 
 # keystone middleware
-KEYSTONEMIDDLEWARE_REPO=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
-KEYSTONEMIDDLEWARE_BRANCH=${KEYSTONEMIDDLEWARE_BRANCH:-master}
+GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
+GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
 
 # s3 support for swift
 SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/stackforge/swift3.git}

From 6a41ba20e7978c5f62a125412a9489d59e520a43 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 17 Nov 2014 10:46:56 +1100
Subject: [PATCH 0087/3333] Remove rackspace/centos7 work-around

The current centos 7 images from rackspace do not have cloud-init
installed via pip, so this is no longer needed.  This work around is
actually a little wrong too, see the bug.

Change-Id: I6642593ca2248d9e01f653cc8e70c70ba8372e50
Partial-bug: #1393073
---
 stack.sh | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/stack.sh b/stack.sh
index 7635f32298..ef4591e232 100755
--- a/stack.sh
+++ b/stack.sh
@@ -209,14 +209,6 @@ if is_ubuntu; then
     echo 'APT::Acquire::Retries "20";' | sudo tee /etc/apt/apt.conf.d/80retry  >/dev/null
 fi
 
-# upstream Rackspace centos7 images have an issue where cloud-init is
-# installed via pip because there were not official packages when the
-# image was created (fix in the works).  Remove all pip packages
-# before we do anything else
-if [[ $DISTRO = "rhel7" && is_rackspace ]]; then
-    (sudo pip freeze | xargs sudo pip uninstall -y) || true
-fi
-
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 

From 0eed532ce392f7db7cc004ca4b28c22407499d1d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 15 Nov 2014 17:15:49 -0300
Subject: [PATCH 0088/3333] Remove nose things

We don't use nose anywhere in anything related to devstack. The only
legitimate OpenStack things that are still nose are horizon and swift
unittests, and it turns out we don't really run those in devstack.

Change-Id: I215e0f3664f269e0e1b8f5d5f9c70553dededddd
---
 tools/fixup_stuff.sh | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index b8beb01583..ca465339b7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -18,7 +18,6 @@
 #   - (re)start messagebus daemon
 #   - remove distro packages python-crypto and python-lxml
 #   - pre-install hgtools to work around a bug in RHEL6 distribute
-#   - install nose 1.1 from EPEL
 
 # If TOP_DIR is set we're being sourced rather than running stand-alone
 # or in a sub-shell
@@ -179,14 +178,6 @@ if [[ $DISTRO =~ (rhel6) ]]; then
     # Note we do this before the track-depends in ``stack.sh``.
     pip_install hgtools
 
-
-    # RHEL6's version of ``python-nose`` is incompatible with Tempest.
-    # Install nose 1.1 (Tempest-compatible) from EPEL
-    install_package python-nose1.1
-    # Add a symlink for the new nosetests to allow tox for Tempest to
-    # work unmolested.
-    sudo ln -sf /usr/bin/nosetests1.1 /usr/local/bin/nosetests
-
     # workaround for https://code.google.com/p/unittest-ext/issues/detail?id=79
     install_package python-unittest2 patch
     pip_install discover

From dc73d39a3006f92b2902a08279377634efb03094 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Date: Mon, 17 Nov 2014 03:54:58 +0000
Subject: [PATCH 0089/3333] Add TEMPEST_ENABLE_NOVA_XML_API option

XML support of Nova API has been deprecated with the following
message:
  XML support has been deprecated and may be removed as early
  as the Juno release.
Now Kilo development cycle started, so we should disable Nova
API XML tests on Tempest.

This patch adds TEMPEST_ENABLE_NOVA_XML_API option for setting
Tempest test by devstack-gate. The default value is True because
of keeping the test coverage. After merging a devstack-gate patch
which specifes True for stable/icehouse and stable/juno, we will
set False for the master blanch.

I4acc15ce5f487738bb34a95c2261a5d05d827d8d is a Nova patch which
removes XML API support.

Change-Id: I2ab8f5c3d15b496e0b639c99bb8592533a69a265
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 9e025a1096..7ef8a308e3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -303,6 +303,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions ${COMPUTE_API_EXTENSIONS:-"all"}
+    iniset $TEMPEST_CONFIG compute-feature-enabled xml_api_v2 ${TEMPEST_ENABLE_NOVA_XML_API:-True}
     iniset $TEMPEST_CONFIG compute-feature-disabled api_extensions ${DISABLE_COMPUTE_API_EXTENSIONS}
 
     # Compute admin

From 7d0a0f7d48222369f36a1a5a27a39c45430c9615 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Mon, 17 Nov 2014 00:03:47 -0500
Subject: [PATCH 0090/3333] Remove hardcoded protocol from backup_swift_url

Use SWIFT_SERVICE_PROTOCOL when configuring backup_swift_url for
cinder configuration.

Change-Id: I09de62e8deca86b473cee969ba2c5919d4f9892d
Closes-Bug: #1393554
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index eb3cbe86cf..611e1ca5d9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -258,7 +258,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled swift; then
-        iniset $CINDER_CONF DEFAULT backup_swift_url "http://$SERVICE_HOST:8080/v1/AUTH_"
+        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_"
     fi
 
     if is_service_enabled ceilometer; then

From 21529a50e3b49ce378da88ce10ce903933fa3a02 Mon Sep 17 00:00:00 2001
From: John Davidge <jodavidg@cisco.com>
Date: Mon, 30 Jun 2014 09:55:11 -0400
Subject: [PATCH 0091/3333] Add IPv6 support for tenant data network

Define IP_VERSION with one of the three values 4, 6, or 4+6 in
your localrc to indicate if you intend to run your tenant data network
as either IPv4, IPv6, or dual stack respectively. Default value is 4.

If your IP_VERSION is set to 6 or 4+6, then the following variables
should be defined in your localrc:
  - FIXED_RANGE_V6: The IPv6 prefix for your tenant network
  - IPV6_PRIVATE_NETWORK_GATEWAY: The gateway IP with the same prefix
  - IPV6_RA_MODE (with default as slaac)
  - IPV6_ADDRESS_MODE (with default as slaac)

If you're going to use IPV6_RA_MODE/IPV6_ADDRESS_MODE settings other
than the defaults then you should make sure your VM image has dhcpv6
client enabled at bootup, otherwise you'll need to run it manually
after the VM is booted.

It's recommended to run the latest version of dnsmasq 2.68.
If you intend to enable internet access in your VM, make sure
your network node has IPv6 internet access, and the IPv6 prefix for
your tenant network is a GUA and routable.

Implements: blueprint ipv6-support
Change-Id: I848abf18e00e2a869697c5ef6366bc567dde448a
Co-Authored-By: John Davidge <jodavidg@cisco.com>
---
 doc/source/configuration.rst |  29 +++++
 lib/neutron                  | 244 ++++++++++++++++++++++++++++++-----
 2 files changed, 242 insertions(+), 31 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index a4d940d762..ba36ebd1b8 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -321,6 +321,35 @@ API rate limits
 
         API_RATE_LIMIT=False
 
+IP Version
+    | Default: ``IP_VERSION=4``
+    | This setting can be used to configure DevStack to create either an IPv4,
+      IPv6, or dual stack tenant data network by setting ``IP_VERSION`` to
+      either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
+      respectively. This functionality requires that the Neutron networking
+      service is enabled by setting the following options:
+    |
+
+    ::
+
+        disable_service n-net
+        enable_service q-svc q-agt q-dhcp q-l3
+
+    | The following optional variables can be used to alter the default IPv6
+      behavior:
+    |
+
+    ::
+
+        IPV6_RA_MODE=slaac
+        IPV6_ADDRESS_MODE=slaac
+        FIXED_RANGE_V6=fd$IPV6_GLOBAL_ID::/64
+        IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
+
+    | *Note: ``FIXED_RANGE_V6`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
+      can be configured with any valid IPv6 prefix. The default values make
+      use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC 4193.*
+
 Examples
 ~~~~~~~~
 
diff --git a/lib/neutron b/lib/neutron
index 8295a738b7..8bf4310a27 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -51,10 +51,22 @@
 #
 # With Neutron networking the NETWORK_MANAGER variable is ignored.
 
+# Settings
+# --------
+
+# Timeout value in seconds to wait for IPv6 gateway configuration
+GATEWAY_TIMEOUT=30
+
 
 # Neutron Network Configuration
 # -----------------------------
 
+# Subnet IP version
+IP_VERSION=${IP_VERSION:-4}
+# Validate IP_VERSION
+if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
+    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
+fi
 # Gateway and subnet defaults, in case they are not customized in localrc
 NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
 PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
@@ -65,6 +77,22 @@ if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
+# Generate 40-bit IPv6 Global ID to comply with RFC 4193
+IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
+
+# IPv6 gateway and subnet defaults, in case they are not customized in localrc
+IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
+IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
+IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
+IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
+IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
+IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-fe80:cafe:cafe::/64}
+IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-fe80:cafe:cafe::2}
+# IPV6_ROUTER_GW_IP must be defined when IP_VERSION=4+6 as it cannot be
+# obtained conventionally until the l3-agent has support for dual-stack
+# TODO (john-davidge) Remove once l3-agent supports dual-stack
+IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-fe80:cafe:cafe::1}
 
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
@@ -531,8 +559,16 @@ function create_neutron_initial_network {
     else
         NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
-        SUBNET_ID=$(neutron subnet-create --tenant-id $TENANT_ID --ip_version 4 --gateway $NETWORK_GATEWAY --name $PRIVATE_SUBNET_NAME $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $TENANT_ID"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Create IPv4 private subnet
+            SUBNET_ID=$(_neutron_create_private_subnet_v4)
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Create IPv6 private subnet
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
+        fi
     fi
 
     if [[ "$Q_L3_ENABLED" == "True" ]]; then
@@ -546,7 +582,7 @@ function create_neutron_initial_network {
             ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
-        neutron router-interface-add $ROUTER_ID $SUBNET_ID
+
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
             EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
@@ -554,35 +590,15 @@ function create_neutron_initial_network {
             EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
-        EXT_GW_IP=$(neutron subnet-create --ip_version 4 ${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} --gateway $PUBLIC_NETWORK_GATEWAY --name $PUBLIC_SUBNET_NAME $EXT_NET_ID $FLOATING_RANGE -- --enable_dhcp=False | grep 'gateway_ip' | get_field 2)
-        die_if_not_set $LINENO EXT_GW_IP "Failure creating EXT_GW_IP"
-        neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
 
-        if is_service_enabled q-l3; then
-            # logic is specific to using the l3-agent for l3
-            if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-                local ext_gw_interface
-
-                if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
-                    ext_gw_interface=$Q_PUBLIC_VETH_EX
-                else
-                    # Disable in-band as we are going to use local port
-                    # to communicate with VMs
-                    sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
-                        other_config:disable-in-band=true
-                    ext_gw_interface=$PUBLIC_BRIDGE
-                fi
-                CIDR_LEN=${FLOATING_RANGE#*/}
-                sudo ip addr add $EXT_GW_IP/$CIDR_LEN dev $ext_gw_interface
-                sudo ip link set $ext_gw_interface up
-                ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' '{ print $8; }'`
-                die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-                sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP
-            fi
-            if [[ "$Q_USE_NAMESPACE" == "False" ]]; then
-                # Explicitly set router id in l3 agent configuration
-                iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
-            fi
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Configure router for IPv4 public access
+            _neutron_configure_router_v4
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Configure router for IPv6 public access
+            _neutron_configure_router_v6
         fi
     fi
 }
@@ -1050,6 +1066,172 @@ function _neutron_setup_interface_driver {
     neutron_plugin_setup_interface_driver $1
 }
 
+# Create private IPv4 subnet
+function _neutron_create_private_subnet_v4 {
+    local subnet_params="--tenant-id $TENANT_ID "
+    subnet_params+="--ip_version 4 "
+    subnet_params+="--gateway $NETWORK_GATEWAY "
+    subnet_params+="--name $PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE"
+    local subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $TENANT_ID"
+    echo $subnet_id
+}
+
+# Create private IPv6 subnet
+function _neutron_create_private_subnet_v6 {
+    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
+    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
+    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
+    local subnet_params="--tenant-id $TENANT_ID "
+    subnet_params+="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
+    local ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $TENANT_ID"
+    echo $ipv6_subnet_id
+}
+
+# Create public IPv4 subnet
+function _neutron_create_public_subnet_v4 {
+    local subnet_params+="--ip_version 4 "
+    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
+    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
+    echo $id_and_ext_gw_ip
+}
+
+# Create public IPv6 subnet
+function _neutron_create_public_subnet_v6 {
+    local subnet_params="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
+    echo $ipv6_id_and_ext_gw_ip
+}
+
+# Configure neutron router for IPv4 public access
+function _neutron_configure_router_v4 {
+    neutron router-interface-add $ROUTER_ID $SUBNET_ID
+    # Create a public subnet on the external network
+    local id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
+    local ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
+    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
+    # Configure the external network as the default router gateway
+    neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        # Configure and enable public bridge
+        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local cidr_len=${FLOATING_RANGE#*/}
+            sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+            sudo ip link set $ext_gw_interface up
+            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
+            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
+            sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP
+        fi
+        _neutron_set_router_id
+    fi
+}
+
+# Configure neutron router for IPv6 public access
+function _neutron_configure_router_v6 {
+    neutron router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    # Create a public subnet on the external network
+    local ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
+    local ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
+    local ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
+
+    # If the external network has not already been set as the default router
+    # gateway when configuring an IPv4 public subnet, do so now
+    if [[ "$IP_VERSION" == "6" ]]; then
+        neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+    fi
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        local ipv6_router_gw_port
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
+        # Configure and enable public bridge
+        if [[ "$IP_VERSION" = "6" ]]; then
+            # Override global IPV6_ROUTER_GW_IP with the true value from neutron
+            IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
+            die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
+            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
+            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
+        else
+            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
+            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
+        fi
+
+        # The ovs_base_configure_l3_agent function flushes the public
+        # bridge's ip addresses, so turn IPv6 support in the host off
+        # and then on to recover the public bridge's link local address
+        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=1
+        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=0
+        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
+
+            # Define router_ns based on whether DVR is enabled
+            local router_ns=qrouter
+            if [[ "$Q_DVR_MODE" == "dvr_snat" ]]; then
+                router_ns=snat
+            fi
+
+            # Configure interface for public bridge
+            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+
+            # Wait until layer 3 agent has configured the gateway port on
+            # the public bridge, then add gateway address to the interface
+            # TODO (john-davidge) Remove once l3-agent supports dual-stack
+            if [[ "$IP_VERSION" == "4+6" ]]; then
+                if ! timeout $GATEWAY_TIMEOUT sh -c "until sudo ip netns exec $router_ns-$ROUTER_ID ip addr show qg-${ipv6_router_gw_port:0:11} | grep $ROUTER_GW_IP; do sleep 1; done"; then
+                    die $LINENO "Timeout retrieving ROUTER_GW_IP"
+                fi
+                # Configure the gateway port with the public IPv6 adress
+                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 addr add $IPV6_ROUTER_GW_IP/$ipv6_cidr_len dev qg-${ipv6_router_gw_port:0:11}
+                # Add a default IPv6 route to the neutron router as the
+                # l3-agent does not add one in the dual-stack case
+                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 route replace default via $ipv6_ext_gw_ip dev qg-${ipv6_router_gw_port:0:11}
+            fi
+            sudo ip -6 route add $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+        fi
+        _neutron_set_router_id
+    fi
+}
+
+# Explicitly set router id in l3 agent configuration
+function _neutron_set_router_id {
+    if [[ "$Q_USE_NAMESPACE" == "False" ]]; then
+        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
+    fi
+}
+
+# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
+function _neutron_get_ext_gw_interface {
+    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
+        echo $Q_PUBLIC_VETH_EX
+    else
+        # Disable in-band as we are going to use local port
+        # to communicate with VMs
+        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+            other_config:disable-in-band=true
+        echo $PUBLIC_BRIDGE
+    fi
+}
+
 # Functions for Neutron Exercises
 #--------------------------------
 

From b3fdb1c93593faa6fb674937155f911beb2f0200 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Mon, 17 Nov 2014 12:45:09 -0600
Subject: [PATCH 0092/3333] Simplify docs build

Remove unnecessary old code from tools/build_docs.sh; it now only builds
docs for the current branch in the current working directory.

Fix the merging if the git log changes into changes.html.

Change-Id: I965dc3383b6317807ca0d47fe42648a19e96b57b
---
 doc/source/changes.rst |  2 +
 tools/build_docs.sh    | 87 ++++--------------------------------------
 tox.ini                |  2 +-
 3 files changed, 11 insertions(+), 80 deletions(-)

diff --git a/doc/source/changes.rst b/doc/source/changes.rst
index f4a326d60e..abe132c31c 100644
--- a/doc/source/changes.rst
+++ b/doc/source/changes.rst
@@ -8,3 +8,5 @@ Recent Changes What's been happening?
 These are the commits to DevStack for the last six months. For the
 complete list see `the DevStack project in
 Gerrit <https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack,n,z>`__.
+
+%GIT_LOG%
diff --git a/tools/build_docs.sh b/tools/build_docs.sh
index f52b179b7e..929d1e0e6c 100755
--- a/tools/build_docs.sh
+++ b/tools/build_docs.sh
@@ -1,35 +1,19 @@
 #!/usr/bin/env bash
 
-# **build_docs.sh** - Build the gh-pages docs for DevStack
+# **build_docs.sh** - Build the docs for DevStack
 #
 # - Install shocco if not found on PATH and INSTALL_SHOCCO is set
 # - Clone MASTER_REPO branch MASTER_BRANCH
 # - Re-creates ``doc/build/html`` directory from existing repo + new generated script docs
 
 # Usage:
-## build_docs.sh [-o <out-dir>] [-g] [master|<repo> [<branch>]]
-## <repo>           The DevStack repository to clone (default is DevStack github repo)
-##                  If a repo is not supplied use the current directory
-##                  (assumed to be a DevStack checkout) as the source.
-## <branch>         The DevStack branch to check out (default is master; ignored if
-##                  repo is not specified)
-## .                Use the current repo and branch (do not use with -p to
-##                  prevent stray files in the workspace being added tot he docs)
+## build_docs.sh [-o <out-dir>]
 ## -o <out-dir>     Write the static HTML output to <out-dir>
 ##                  (Note that <out-dir> will be deleted and re-created to ensure it is clean)
-## -g               Update the old gh-pages repo  (set PUSH=1 to actually push up to RCB)
 
 # Defaults
 # --------
 
-# Source repo/branch for DevStack
-MASTER_REPO=${MASTER_REPO:-git://git.openstack.org/openstack-dev/devstack}
-MASTER_BRANCH=${MASTER_BRANCH:-master}
-
-# http://devstack.org is a GitHub gh-pages site in the https://github.com/cloudbuilders/devtack.git repo
-GH_PAGES_REPO=git@github.com:cloudbuilders/devstack.git
-
-DOCS_SOURCE=doc/source
 HTML_BUILD=doc/build/html
 
 # Keep track of the devstack directory
@@ -60,10 +44,8 @@ if ! which shocco; then
 fi
 
 # Process command-line args
-while getopts go: c; do
+while getopts o: c; do
     case $c in
-        g)  GH_UPDATE=1
-            ;;
         o)  HTML_BUILD=$OPTARG
             ;;
     esac
@@ -71,55 +53,24 @@ done
 shift `expr $OPTIND - 1`
 
 
-if [[ -n "$1" ]]; then
-    master="master"
-    if [[ "${master/#$1}" != "master" ]]; then
-        # Partial match on "master"
-        REPO=$MASTER_REPO
-    else
-        REPO=$1
-    fi
-    REPO_BRANCH=${2:-$MASTER_BRANCH}
-fi
-
-# Check out a specific DevStack branch
-if [[ -n $REPO ]]; then
-    # Make a workspace
-    TMP_ROOT=$(mktemp -d work-docs-XXXX)
-    echo "Building docs in $TMP_ROOT"
-    cd $TMP_ROOT
-
-    # Get the master branch
-    git clone $REPO devstack
-    cd devstack
-    if [[ -n "$REPO_BRANCH" ]]; then
-        git checkout $REPO_BRANCH
-    fi
-fi
-
-# Assumption is we are now in the DevStack workspace to be processed
-
 # Processing
 # ----------
 
-# Clean up build dir
-rm -rf $HTML_BUILD
+# Ensure build dir exists
 mkdir -p $HTML_BUILD
 
 # Get fully qualified dirs
-FQ_DOCS_SOURCE=$(cd $DOCS_SOURCE && pwd)
 FQ_HTML_BUILD=$(cd $HTML_BUILD && pwd)
 
-# Get repo static
-cp -pr $FQ_DOCS_SOURCE/* $FQ_HTML_BUILD
-
 # Insert automated bits
 GLOG=$(mktemp gitlogXXXX)
+echo "<ul>" >$GLOG
 git log \
     --pretty=format:'            <li>%s - <em>Commit <a href="https://review.openstack.org/#q,%h,n,z">%h</a> %cd</em></li>' \
     --date=short \
-    --since '6 months ago' | grep -v Merge >$GLOG
-sed -e $"/%GIT_LOG%/r $GLOG" $FQ_DOCS_SOURCE/changes.html >$FQ_HTML_BUILD/changes.html
+    --since '6 months ago' | grep -v Merge >>$GLOG
+echo "</ul>" >>$GLOG
+sed -i~ -e $"/^.*%GIT_LOG%.*$/r $GLOG" -e $"/^.*%GIT_LOG%.*$/s/^.*%GIT_LOG%.*$//" $FQ_HTML_BUILD/changes.html
 rm -f $GLOG
 
 # Build list of scripts to process
@@ -138,28 +89,6 @@ for f in $(find functions functions-common lib samples -type f -name \*); do
 done
 echo "$FILES" >doc/files
 
-if [[ -n $GH_UPDATE ]]; then
-    GH_ROOT=$(mktemp -d work-gh-XXXX)
-    cd $GH_ROOT
-
-    # Pull the latest docs branch from devstack.org repo
-    git clone -b gh-pages $GH_PAGES_REPO gh-docs
-
-    # Get the generated files
-    cp -pr $FQ_HTML_BUILD/* gh-docs
-
-    # Collect the new generated pages
-    (cd gh-docs; find . -name \*.html -print0 | xargs -0 git add)
-
-    # Push our changes back up to the docs branch
-    if ! git diff-index HEAD --quiet; then
-        git commit -a -m "Update script docs"
-        if [[ -n $PUSH ]]; then
-            git push
-        fi
-    fi
-fi
-
 # Clean up or report the temp workspace
 if [[ -n REPO && -n $PUSH_REPO ]]; then
     echo rm -rf $TMP_ROOT
diff --git a/tox.ini b/tox.ini
index c8d3909805..a958ae7ba4 100644
--- a/tox.ini
+++ b/tox.ini
@@ -36,5 +36,5 @@ setenv =
   TOP_DIR={toxinidir}
   INSTALL_SHOCCO=true
 commands = 
-	bash tools/build_docs.sh
 	python setup.py build_sphinx
+	bash tools/build_docs.sh

From ffd66ad77ff07fff9812836b832bbcd952a61fff Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Mon, 17 Nov 2014 12:26:08 -0800
Subject: [PATCH 0093/3333] Log early boot of Ironic VMs to serial with sgabios

This adds sgabios to the list of packages for Ironic and configures
the libvirt domain to redirect BIOS messages to serial via sgabios,
when console logging is enabled.  The sgabios package in Ubuntu
currently has an apparmor bug, so that is worked around here.

This allows visibility into early boot of Ironic nodes and should
help get to the bottom of a frequent failure we're seeing in the gate.

Change-Id: Ifd18851e2d23d198d36e67883a81afc6a92d2a58
Related-Bug: #1393099
---
 files/apts/ironic                 | 1 +
 files/rpms/ironic                 | 1 +
 lib/ironic                        | 8 ++++++++
 tools/ironic/scripts/configure-vm | 2 ++
 tools/ironic/templates/vm.xml     | 1 +
 5 files changed, 13 insertions(+)

diff --git a/files/apts/ironic b/files/apts/ironic
index 45fdeccbb4..f6c7b74494 100644
--- a/files/apts/ironic
+++ b/files/apts/ironic
@@ -12,6 +12,7 @@ python-libvirt
 qemu
 qemu-kvm
 qemu-utils
+sgabios
 syslinux
 tftpd-hpa
 xinetd
diff --git a/files/rpms/ironic b/files/rpms/ironic
index e646f3a8aa..0a46314964 100644
--- a/files/rpms/ironic
+++ b/files/rpms/ironic
@@ -9,6 +9,7 @@ net-tools
 openssh-clients
 openvswitch
 python-libguestfs
+sgabios
 syslinux
 tftp-server
 xinetd
diff --git a/lib/ironic b/lib/ironic
index afe69f2df8..a8a78d42b2 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -147,6 +147,14 @@ function install_ironic {
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
         install_apache_wsgi
     fi
+
+    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] && is_ubuntu; then
+        # Ubuntu packaging+apparmor issue prevents libvirt from loading
+        # the ROM from /usr/share/misc.  Workaround by installing it directly
+        # to a directory that it can read from. (LP: #1393548)
+        sudo rm -rf /usr/share/qemu/sgabios.bin
+        sudo cp /usr/share/misc/sgabios.bin /usr/share/qemu/sgabios.bin
+    fi
 }
 
 # install_ironicclient() - Collect sources and prepare
diff --git a/tools/ironic/scripts/configure-vm b/tools/ironic/scripts/configure-vm
index 4c42c491c5..378fcb85ad 100755
--- a/tools/ironic/scripts/configure-vm
+++ b/tools/ironic/scripts/configure-vm
@@ -78,8 +78,10 @@ def main():
             params['emulator'] = "/usr/bin/qemu-kvm"
 
     if args.console_log:
+        params['bios_serial'] = "<bios useserial='yes'/>"
         params['console_log'] = CONSOLE_LOG % {'console_log': args.console_log}
     else:
+        params['bios_serial'] = ''
         params['console_log'] = ''
     libvirt_template = source_template % params
     conn = libvirt.open("qemu:///system")
diff --git a/tools/ironic/templates/vm.xml b/tools/ironic/templates/vm.xml
index 4f40334b7d..ae7d685256 100644
--- a/tools/ironic/templates/vm.xml
+++ b/tools/ironic/templates/vm.xml
@@ -6,6 +6,7 @@
     <type arch='%(arch)s' machine='pc-1.0'>hvm</type>
     <boot dev='%(bootdev)s'/>
     <bootmenu enable='no'/>
+    %(bios_serial)s
   </os>
   <features>
     <acpi/>

From 958111e188eab1023cea8a499eeb90bfe7164b23 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <dims@linux.vnet.ibm.com>
Date: Mon, 17 Nov 2014 17:35:40 -0500
Subject: [PATCH 0094/3333] Add oslo.context

Treat the new oslo.context library just like the other Oslo
libraries. i.e. make it possible to either test with upstream
released library, or with git versions of oslo.context.

Change-Id: I2dc498324d6c405655a8e2e249465c5b351ca960
---
 lib/oslo | 1 +
 stackrc  | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/lib/oslo b/lib/oslo
index a20aa1450f..d00580b14a 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -23,6 +23,7 @@ set +o xtrace
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
+GITDIR["oslo.context"]=$DEST/oslo.context
 GITDIR["oslo.db"]=$DEST/oslo.db
 GITDIR["oslo.i18n"]=$DEST/oslo.i18n
 GITDIR["oslo.log"]=$DEST/oslo.log
diff --git a/stackrc b/stackrc
index 18e1de3b19..bd9548f730 100644
--- a/stackrc
+++ b/stackrc
@@ -279,6 +279,10 @@ GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-master}
 GITREPO["oslo.config"]=${OSLOCFG_REPO:-${GIT_BASE}/openstack/oslo.config.git}
 GITBRANCH["oslo.config"]=${OSLOCFG_BRANCH:-master}
 
+# oslo.context
+GITREPO["oslo.context"]=${OSLOCTX_REPO:-${GIT_BASE}/openstack/oslo.context.git}
+GITBRANCH["oslo.context"]=${OSLOCTX_BRANCH:-master}
+
 # oslo.db
 GITREPO["oslo.db"]=${OSLODB_REPO:-${GIT_BASE}/openstack/oslo.db.git}
 GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-master}

From 42373c7bfe68302922feb76015534a16d8c00bf5 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Tue, 18 Nov 2014 12:30:16 +0900
Subject: [PATCH 0095/3333] lib/dstat: Fix a comment

Apparently this file was copied from lib/apache.

Change-Id: Ie89d423ca225c697122820a1d9e859769aea9f86
---
 lib/dstat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dstat b/lib/dstat
index a2c522c02a..a6990bbca9 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -1,4 +1,4 @@
-# lib/apache
+# lib/dstat
 # Functions to start and stop dstat
 
 # Dependencies:

From 44f4e205aa81f8fdb0b47b354192b4bb44efad56 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Tue, 18 Nov 2014 13:03:08 +0900
Subject: [PATCH 0096/3333] lib/dstat: Include page stats

Add -g option for dstat.

From the man page:

       -g, --page
              enable page stats (page in, page out)

Change-Id: I865304483af0a529ea8722ed0a9f35ab350670d2
---
 lib/dstat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dstat b/lib/dstat
index a2c522c02a..3852652c8f 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -24,7 +24,7 @@ DSTAT_FILE=${DSTAT_FILE:-"dstat.txt"}
 # start_dstat() - Start running processes, including screen
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
-    DSTAT_OPTS="-tcmndrylp --top-cpu-adv"
+    DSTAT_OPTS="-tcmndrylpg --top-cpu-adv"
     if [[ -n ${SCREEN_LOGDIR} ]]; then
         screen_it dstat "cd $TOP_DIR; dstat $DSTAT_OPTS | tee $SCREEN_LOGDIR/$DSTAT_FILE"
     else

From 45ce98275c15472f0b6c92b75088064cd3763ff1 Mon Sep 17 00:00:00 2001
From: David Lyle <david.lyle@hp.com>
Date: Thu, 11 Sep 2014 17:50:08 -0600
Subject: [PATCH 0097/3333] Moving horizon compression offline

Making the horizon scss compilation and compression happen offline.
Potentially fixing an issue with parallel compression in devstack.

Related-Bug: #1345955
Change-Id: I066c80e06a92302a3f8dc5fd45d127fbde6cf99c
---
 lib/horizon | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 1b53831135..872e77a040 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -99,6 +99,8 @@ function init_horizon {
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
     cp $HORIZON_SETTINGS $local_settings
 
+    _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
+
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
     if [[ -n "$KEYSTONE_TOKEN_HASH_ALGORITHM" ]]; then
@@ -140,6 +142,9 @@ function init_horizon {
     # and run_process
     sudo rm -f /var/log/$APACHE_NAME/horizon_*
 
+    DJANGO_SETTINGS_MODULE=openstack_dashboard.settings django-admin.py collectstatic --noinput
+    DJANGO_SETTINGS_MODULE=openstack_dashboard.settings django-admin.py compress --force
+
 }
 
 # install_django_openstack_auth() - Collect source and prepare

From 8f003ef9bf466f931cecfc5a34b51a40b2203f43 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Tue, 18 Nov 2014 13:41:58 +0900
Subject: [PATCH 0098/3333] Use mysql in Ubuntu 12.04 (precise)

After commit 6d20f090, devstack does not work on Ubuntu 12.04
because Ubuntu 12.04 does not provide mariadb but devstack expects it.

Change-Id: Iae9a7a1c09f1fc83573c3926b3470955c244c401
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7a444a3140..bbf2fd0861 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -142,7 +142,7 @@ EOF
     fi
     # Install mysql-server
     if is_ubuntu || is_fedora; then
-        if [[ $DISTRO =~ (rhel6) ]]; then
+        if [[ $DISTRO =~ (rhel6|precise) ]]; then
             install_package mysql-server
         else
             install_package mariadb-server

From 683ed9eeb2dedddb5053b09ded060a276bed928c Mon Sep 17 00:00:00 2001
From: lokesh <lokesh.s@hp.com>
Date: Mon, 10 Nov 2014 15:07:59 +0530
Subject: [PATCH 0099/3333] fixes cleaning up of ironic directory from /etc

Closes-Bug: 1391083

Change-Id: Ic47161ab375716cc39ee1a7dd57034782717e323
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index cf005a74d6..ffbfc727be 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -177,7 +177,7 @@ function _config_ironic_apache_wsgi {
 # cleanup_ironic() - Remove residual data files, anything left over from previous
 # runs that would need to clean up.
 function cleanup_ironic {
-    sudo rm -rf $IRONIC_AUTH_CACHE_DIR
+    sudo rm -rf $IRONIC_AUTH_CACHE_DIR $IRONIC_CONF_DIR
 }
 
 # configure_ironic_dirs() - Create all directories required by Ironic and

From 1f26c0ef61e4e37bacac68014d993df108f70296 Mon Sep 17 00:00:00 2001
From: Oleg Gashev <oleg@gashev.net>
Date: Tue, 18 Nov 2014 02:16:01 -0500
Subject: [PATCH 0100/3333] Fixed conditions to determine if current
 distribution is a Fedora based distribution

stack.sh line 223:
if [[ is_fedora && $DISTRO == "rhel6" ]]; then

stack.sh line 234:
if [[ is_fedora && ( $DISTRO == "rhel6" || $DISTRO == "rhel7" ) ]]; then

stack.sh line 358:
if [[ is_fedora && $DISTRO == "rhel6" ]]; then

Condition [[ is_fedora && $DISTRO == "rhel6" ]] return wrong result.
This condition is equivalent to the
[[ -n is_fedora && $DISTRO == "rhel6" ]]. First expression -n is_fedora
always not null, therefore this condition the same is
[[ $DISTRO = "rhel6" ]].

Change-Id: Ida9eaa7950554bcd2f183dede7ad19522f9ca558
Closes-Bug: #1393684
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 7635f32298..940c4e50e9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -220,7 +220,7 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-if [[ is_fedora && $DISTRO == "rhel6" ]]; then
+if is_fedora && [ $DISTRO == "rhel6" ]; then
     # Installing Open vSwitch on RHEL requires enabling the RDO repo.
     RHEL6_RDO_REPO_RPM=${RHEL6_RDO_REPO_RPM:-"http://rdo.fedorapeople.org/openstack-icehouse/rdo-release-icehouse.rpm"}
     RHEL6_RDO_REPO_ID=${RHEL6_RDO_REPO_ID:-"openstack-icehouse"}
@@ -231,7 +231,7 @@ if [[ is_fedora && $DISTRO == "rhel6" ]]; then
     fi
 fi
 
-if [[ is_fedora && ( $DISTRO == "rhel6" || $DISTRO == "rhel7" ) ]]; then
+if is_fedora && [[ $DISTRO == "rhel6" || $DISTRO == "rhel7" ]]; then
     # RHEL requires EPEL for many Open Stack dependencies
 
     # note we always remove and install latest -- some environments
@@ -355,7 +355,7 @@ function echo_nolog {
     echo $@ >&3
 }
 
-if [[ is_fedora && $DISTRO == "rhel6" ]]; then
+if is_fedora && [ $DISTRO == "rhel6" ]; then
     # poor old python2.6 doesn't have argparse by default, which
     # outfilter.py uses
     is_package_installed python-argparse || install_package python-argparse

From 9f20ea13826234ac2c508ea1d50a0822b68d42dc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 17 Nov 2014 15:14:49 -0500
Subject: [PATCH 0101/3333] make run_tests.sh run devstack unit tests

run_tests.sh was created as an entry point for bashate. We stopped
using it now that we know how to run bashate directly in the gate.
We lost running an unrelated bashate test when that happened.

Devstack does have unit tests. We don't run them. We should.
Especially when working on things like the LIBS_FROM_GIT which is
sufficiently tricky that we really need to add unit tests to ensure
that we don't break it.

Change-Id: Ife067855569e2eae4c085471d326e8086de37332
---
 run_tests.sh       | 45 ++++++++-------------------------------------
 tests/test_refs.sh | 24 ++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 37 deletions(-)
 create mode 100755 tests/test_refs.sh

diff --git a/run_tests.sh b/run_tests.sh
index bf90332698..3ba7e1023d 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -18,47 +18,18 @@
 PASSES=""
 FAILURES=""
 
-# Check the return code and add the test to PASSES or FAILURES as appropriate
-# pass_fail <result> <expected> <name>
-function pass_fail {
-    local result=$1
-    local expected=$2
-    local test_name=$3
+# Test that no one is trying to land crazy refs as branches
 
-    if [[ $result -ne $expected ]]; then
-        FAILURES="$FAILURES $test_name"
+for testfile in tests/test_*.sh; do
+    $testfile
+    if [[ $? -eq 0 ]]; then
+        PASSES="$PASSES $testfile"
     else
-        PASSES="$PASSES $test_name"
+        FAILURES="$FAILURES $testfile"
     fi
-}
-
-if [[ -n $@ ]]; then
-    FILES=$@
-else
-    LIBS=`find lib -type f | grep -v \.md`
-    SCRIPTS=`find . -type f -name \*\.sh`
-    EXTRA="functions functions-common stackrc openrc exerciserc eucarc"
-    FILES="$SCRIPTS $LIBS $EXTRA"
-fi
-
-echo "Running bash8..."
-
-tox -ebashate
-pass_fail $? 0 bash8
-
-
-# Test that no one is trying to land crazy refs as branches
-
-echo "Ensuring we don't have crazy refs"
-
-REFS=`grep BRANCH stackrc | grep -v -- '-master'`
-rc=$?
-pass_fail $rc 1 crazy-refs
-if [[ $rc -eq 0 ]]; then
-    echo "Branch defaults must be master. Found:"
-    echo $REFS
-fi
+done
 
+# Summary display now that all is said and done
 echo "====================================================================="
 for script in $PASSES; do
     echo PASS $script
diff --git a/tests/test_refs.sh b/tests/test_refs.sh
new file mode 100755
index 0000000000..bccca5dff7
--- /dev/null
+++ b/tests/test_refs.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+echo "Ensuring we don't have crazy refs"
+
+REFS=`grep BRANCH stackrc | grep -v -- '-master'`
+rc=$?
+if [[ $rc -eq 0 ]]; then
+    echo "Branch defaults must be master. Found:"
+    echo $REFS
+    exit 1
+fi

From 07d7e5b1f9b2201da006201f99a9b357a45b9b37 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 17 Nov 2014 07:10:14 -0500
Subject: [PATCH 0102/3333] add LIBS_FROM_GIT to docs

Also reformat common configuration variables to have an additional
header level which makes it easy to direct link to specific
configuration vars when directing someone.

Reformat header markup to us a more standard == = - for h1, h2, h3

Change-Id: I10bac5a93529cdfbcde0a05f9ebdbc1799d403cd
---
 doc/source/configuration.rst | 68 +++++++++++++++++++++++++++++-------
 stackrc                      | 13 +++++++
 2 files changed, 69 insertions(+), 12 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index a4d940d762..869908fa81 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -22,7 +22,7 @@ simplify this process and meet the following goals:
 -  allow settings in arbitrary configuration files to be changed
 
 local.conf
-~~~~~~~~~~
+==========
 
 The new configuration file is ``local.conf`` and resides in the root
 DevStack directory like the old ``localrc`` file. It is a modified INI
@@ -96,7 +96,7 @@ fragment amd MUST conform to the shell requirements, specifically no
 whitespace around ``=`` (equals).
 
 Minimal Configuration
-~~~~~~~~~~~~~~~~~~~~~
+=====================
 
 While ``stack.sh`` is happy to run without a ``localrc`` section in
 ``local.conf``, devlife is better when there are a few minimal variables
@@ -136,9 +136,11 @@ available for ``openrc`` to set ``OS_AUTH_URL``. ``HOST_IP`` is not set
 by default.
 
 Common Configuration Variables
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+==============================
+
+Installation Directory
+----------------------
 
-Set DevStack install directory
     | *Default: ``DEST=/opt/stack``*
     |  The DevStack install directory is set by the ``DEST`` variable.
     |  By setting it early in the ``localrc`` section you can reference it
@@ -150,7 +152,27 @@ Set DevStack install directory
 
         DEST=/opt/stack
 
-stack.sh logging
+Libraries from Git
+------------------
+
+   | *Default: ``LIBS_FROM_GIT=""``*
+
+   | By default devstack installs OpenStack server components from
+     git, however it installs client libraries from released versions
+     on pypi. This is appropriate if you are working on server
+     development, but if you want to see how an unreleased version of
+     the client affects the system you can have devstack install it
+     from upstream, or from local git trees.
+   | Multiple libraries can be specified as a comma separated list.
+   |
+
+   ::
+
+      LIBS_FROM_GIT=python-keystoneclient,oslo.config
+
+Enable Logging
+--------------
+
     | *Defaults: ``LOGFILE="" LOGDAYS=7 LOG_COLOR=True``*
     |  By default ``stack.sh`` output is only written to the console
        where is runs. It can be sent to a file in addition to the console
@@ -178,7 +200,9 @@ stack.sh logging
 
         LOG_COLOR=False
 
-Screen logging
+Logging the Screen Output
+-------------------------
+
     | *Default: ``SCREEN_LOGDIR=""``*
     |  By default DevStack runs the OpenStack services using ``screen``
        which is useful for watching log and debug output. However, in
@@ -196,7 +220,9 @@ Screen logging
     *Note the use of ``DEST`` to locate the main install directory; this
     is why we suggest setting it in ``local.conf``.*
 
-One syslog to bind them all
+Enabling Syslog
+---------------
+
     | *Default: ``SYSLOG=False SYSLOG_HOST=$HOST_IP SYSLOG_PORT=516``*
     |  Logging all services to a single syslog can be convenient. Enable
        syslogging by setting ``SYSLOG`` to ``True``. If the destination log
@@ -211,6 +237,8 @@ One syslog to bind them all
         SYSLOG_PORT=516
 
 A clean install every time
+--------------------------
+
     | *Default: ``RECLONE=""``*
     |  By default ``stack.sh`` only clones the project repos if they do
        not exist in ``$DEST``. ``stack.sh`` will freshen each repo on each
@@ -222,10 +250,18 @@ A clean install every time
 
         RECLONE=yes
 
-                    Swift
-                    Default: SWIFT_HASH="" SWIFT_REPLICAS=1 SWIFT_DATA_DIR=$DEST/data/swift
-                    Swift is now used as the back-end for the S3-like object store.  When enabled Nova's objectstore (n-obj in ENABLED_SERVICES) is automatically disabled. Enable Swift by adding it services to ENABLED_SERVICES:
-                    enable_service s-proxy s-object s-container s-account
+Swift
+-----
+
+    | Default: SWIFT_HASH=""
+    | SWIFT_REPLICAS=1
+    | SWIFT_DATA_DIR=$DEST/data/swift
+
+    | Swift is now used as the back-end for the S3-like object store.
+      When enabled Nova's objectstore (n-obj in ENABLED_SERVICES) is
+      automatically disabled. Enable Swift by adding it services to
+      ENABLED_SERVICES: enable_service s-proxy s-object s-container
+      s-account
 
     Setting Swift's hash value is required and you will be prompted for
     it if Swift is enabled so just set it to something already:
@@ -259,6 +295,8 @@ A clean install every time
     work correctly.*
 
 Service Catalog Backend
+-----------------------
+
     | *Default: ``KEYSTONE_CATALOG_BACKEND=sql``*
     |  DevStack uses Keystone's ``sql`` service catalog backend. An
        alternate ``template`` backend is also available. However, it does
@@ -274,6 +312,8 @@ Service Catalog Backend
     ``files/keystone_data.sh``
 
 Cinder
+------
+
     | Default:
     | VOLUME_GROUP="stack-volumes" VOLUME_NAME_PREFIX="volume-" VOLUME_BACKING_FILE_SIZE=10250M
     |  The logical volume group used to hold the Cinder-managed volumes
@@ -289,6 +329,8 @@ Cinder
         VOLUME_BACKING_FILE_SIZE=10250M
 
 Multi-host DevStack
+-------------------
+
     | *Default: ``MULTI_HOST=False``*
     |  Running DevStack with multiple hosts requires a custom
        ``local.conf`` section for each host. The master is the same as a
@@ -311,6 +353,8 @@ Multi-host DevStack
         ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
 
 API rate limits
+---------------
+
     | Default: ``API_RATE_LIMIT=True``
     | Integration tests such as Tempest will likely run afoul of the
       default rate limits configured for Nova. Turn off rate limiting
@@ -322,7 +366,7 @@ API rate limits
         API_RATE_LIMIT=False
 
 Examples
-~~~~~~~~
+========
 
 -  Eliminate a Cinder pass-through (``CINDER_PERIODIC_INTERVAL``):
 
diff --git a/stackrc b/stackrc
index 18e1de3b19..b1a9e20a97 100644
--- a/stackrc
+++ b/stackrc
@@ -134,6 +134,19 @@ REQUIREMENTS_MODE=${REQUIREMENTS_MODE:-strict}
 # Another option is https://git.openstack.org
 GIT_BASE=${GIT_BASE:-git://git.openstack.org}
 
+# Which libraries should we install from git instead of using released
+# versions on pypi?
+#
+# By default devstack is now installing libraries from pypi instead of
+# from git repositories by default. This works great if you are
+# developing server components, but if you want to develop libraries
+# and see them live in devstack you need to tell devstack it should
+# install them from git.
+#
+# ex: LIBS_FROM_GIT=python-keystoneclient,oslo.config
+#
+# Will install those 2 libraries from git, the rest from pypi.
+
 ##############
 #
 #  OpenStack Server Components

From 3293046d3091e7017beafe92bfe361e6d204bfb1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 18 Nov 2014 06:51:16 -0500
Subject: [PATCH 0103/3333] use a more common rst header hiearchy

While rst doesn't actually care about the order of headers, reviewers
sometimes do. And the build in emacs mode has a certain order
specified that it can easily rotate between.

Standardize on == h1, = h2, - h3, ~ h4 in the code.

Change-Id: I80ff6df6ef0703a3c3005809069428018bb355d4
---
 doc/source/changes.rst               |  2 +-
 doc/source/contributing.rst          | 12 ++++-----
 doc/source/faq.rst                   |  6 ++---
 doc/source/guides/multinode-lab.rst  | 40 ++++++++++++++--------------
 doc/source/guides/single-machine.rst | 16 +++++------
 doc/source/guides/single-vm.rst      | 14 +++++-----
 doc/source/overview.rst              | 18 ++++++-------
 doc/source/plugins.rst               |  4 +--
 8 files changed, 56 insertions(+), 56 deletions(-)

diff --git a/doc/source/changes.rst b/doc/source/changes.rst
index f4a326d60e..7b753753e5 100644
--- a/doc/source/changes.rst
+++ b/doc/source/changes.rst
@@ -3,7 +3,7 @@ Changes
 =======
 
 Recent Changes What's been happening?
--------------------------------------
+=====================================
 
 These are the commits to DevStack for the last six months. For the
 complete list see `the DevStack project in
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
index 7ca3d64afd..8c9e6584ec 100644
--- a/doc/source/contributing.rst
+++ b/doc/source/contributing.rst
@@ -10,9 +10,9 @@ License Agreement (CLA). If you have already done that for another
 OpenStack project you are good to go.
 
 Things To Know
-~~~~~~~~~~~~~~
+==============
 
-| 
+|
 | **Where Things Are**
 
 The official DevStack repository is located at
@@ -30,7 +30,7 @@ queue <https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z>`__
 is, however, used for all commits except for the text of this website.
 That should also change in the near future.
 
-| 
+|
 | **HACKING.rst**
 
 Like most OpenStack projects, DevStack includes a ``HACKING.rst`` file
@@ -38,7 +38,7 @@ that describes the layout, style and conventions of the project. Because
 ``HACKING.rst`` is in the main DevStack repo it is considered
 authoritative. Much of the content on this page is taken from there.
 
-| 
+|
 | **bashate Formatting**
 
 Around the time of the OpenStack Havana release we added a tool to do
@@ -51,9 +51,9 @@ the script pages for devstack.org and possibly even simple code
 formatting. Run it on the entire project with ``./run_tests.sh``.
 
 Code
-~~~~
+====
 
-| 
+|
 | **Repo Layout**
 
 The DevStack repo generally keeps all of the primary scripts at the root
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index b7943ba130..f39471cb4e 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -7,7 +7,7 @@ FAQ
 -  `Miscellaneous <#misc>`__
 
 General Questions
-~~~~~~~~~~~~~~~~~
+=================
 
 Q: Can I use DevStack for production?
     A: No. We mean it. Really. DevStack makes some implementation
@@ -77,7 +77,7 @@ Q: How about RHEL 6?
     is valuable so we do it...
 
 Operation and Configuration
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
+===========================
 
 Q: Can DevStack handle a multi-node installation?
     A: Indirectly, yes. You run DevStack on each node with the
@@ -157,7 +157,7 @@ Q: Why are my configuration changes ignored?
     ``FORCE_PREREQ=1`` and the package checks will never be skipped.
 
 Miscellaneous
-~~~~~~~~~~~~~
+=============
 
 Q: ``tools/fixup_stuff.sh`` is broken and shouldn't 'fix' just one version of packages.
     A: [Another not-a-question] No it isn't. Stuff in there is to
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 4c60b6a745..44601d8713 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -6,10 +6,10 @@ Here is OpenStack in a realistic test configuration with multiple
 physical servers.
 
 Prerequisites Linux & Network
------------------------------
+=============================
 
 Minimal Install
-~~~~~~~~~~~~~~~
+---------------
 
 You need to have a system with a fresh install of Linux. You can
 download the `Minimal
@@ -27,7 +27,7 @@ Install a couple of packages to bootstrap configuration:
     apt-get install -y git sudo || yum install -y git sudo
 
 Network Configuration
-~~~~~~~~~~~~~~~~~~~~~
+---------------------
 
 The first iteration of the lab uses OpenStack's FlatDHCP network
 controller so only a single network will be required. It should be on
@@ -60,10 +60,10 @@ For Fedora and CentOS/RHEL edit
     GATEWAY=192.168.42.1
 
 Installation shake and bake
----------------------------
+===========================
 
 Add the DevStack User
-~~~~~~~~~~~~~~~~~~~~~
+---------------------
 
 OpenStack runs as a non-root user that has sudo access to root. There is
 nothing special about the name, we'll use ``stack`` here. Every node
@@ -88,7 +88,7 @@ From here on use the ``stack`` user. **Logout** and **login** as the
 ``stack`` user.
 
 Set Up Ssh
-~~~~~~~~~~
+----------
 
 Set up the stack user on each node with an ssh key for access:
 
@@ -98,7 +98,7 @@ Set up the stack user on each node with an ssh key for access:
     echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyYjfgyPazTvGpd8OaAvtU2utL8W6gWC4JdRS1J95GhNNfQd657yO6s1AH5KYQWktcE6FO/xNUC2reEXSGC7ezy+sGO1kj9Limv5vrvNHvF1+wts0Cmyx61D2nQw35/Qz8BvpdJANL7VwP/cFI/p3yhvx2lsnjFE3hN8xRB2LtLUopUSVdBwACOVUmH2G+2BWMJDjVINd2DPqRIA4Zhy09KJ3O1Joabr0XpQL0yt/I9x8BVHdAx6l9U0tMg9dj5+tAjZvMAFfye3PJcYwwsfJoFxC8w/SLtqlFX7Ehw++8RtvomvuipLdmWCy+T9hIkl+gHYE4cS3OIqXH7f49jdJf jesse@spacey.local" > ~/.ssh/authorized_keys
 
 Download DevStack
-~~~~~~~~~~~~~~~~~
+-----------------
 
 Grab the latest version of DevStack:
 
@@ -112,7 +112,7 @@ From here on there are some differences between the cluster controller
 (aka 'head node') and the compute nodes.
 
 Configure Cluster Controller
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+----------------------------
 
 The cluster controller runs all OpenStack services. Configure the
 cluster controller's DevStack in ``local.conf``:
@@ -153,7 +153,7 @@ to poke at your shiny new OpenStack. The most recent log file is
 available in ``stack.sh.log``.
 
 Configure Compute Nodes
-~~~~~~~~~~~~~~~~~~~~~~~
+-----------------------
 
 The compute nodes only run the OpenStack worker services. For additional
 machines, create a ``local.conf`` with:
@@ -196,7 +196,7 @@ to poke at your shiny new OpenStack. The most recent log file is
 available in ``stack.sh.log``.
 
 Cleaning Up After DevStack
-~~~~~~~~~~~~~~~~~~~~~~~~~~
+--------------------------
 
 Shutting down OpenStack is now as simple as running the included
 ``unstack.sh`` script:
@@ -223,10 +223,10 @@ this when it runs but there are times it needs to still be done by hand:
     sudo virsh list | grep inst | awk '{print $1}' | xargs -n1 virsh destroy
 
 Options pimp your stack
------------------------
+=======================
 
 Additional Users
-~~~~~~~~~~~~~~~~
+----------------
 
 DevStack creates two OpenStack users (``admin`` and ``demo``) and two
 tenants (also ``admin`` and ``demo``). ``admin`` is exactly what it
@@ -242,7 +242,7 @@ for scripting:
 
     # Get admin creds
     . openrc admin admin
-            
+
     # List existing tenants
     keystone tenant-list
 
@@ -260,7 +260,7 @@ for scripting:
     # keystone role-list
 
 Swift
-~~~~~
+-----
 
 Swift requires a significant amount of resources and is disabled by
 default in DevStack. The support in DevStack is geared toward a minimal
@@ -280,7 +280,7 @@ Swift config files are located in ``SWIFT_CONFIG_DIR`` (default
 it...) ``local.conf``.
 
 Volumes
-~~~~~~~
+-------
 
 DevStack will automatically use an existing LVM volume group named
 ``stack-volumes`` to store cloud-created volumes. If ``stack-volumes``
@@ -305,7 +305,7 @@ involved but looks something like this:
     vgcreate stack-volumes /dev/sdc
 
 Syslog
-~~~~~~
+------
 
 DevStack is capable of using ``rsyslog`` to aggregate logging across the
 cluster. It is off by default; to turn it on set ``SYSLOG=True`` in
@@ -319,7 +319,7 @@ output there. In the example above, add this to the compute node
     SYSLOG_HOST=192.168.42.11
 
 Using Alternate Repositories/Branches
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+-------------------------------------
 
 The git repositories for all of the OpenStack services are defined in
 ``stackrc``. Since this file is a part of the DevStack package changes
@@ -349,10 +349,10 @@ To pull Glance from an experimental fork:
     GLANCE_REPO=https://github.com/mcuser/glance.git
 
 Notes stuff you might need to know
-----------------------------------
+==================================
 
 Reset the Bridge
-~~~~~~~~~~~~~~~~
+----------------
 
 How to reset the bridge configuration:
 
@@ -363,7 +363,7 @@ How to reset the bridge configuration:
     sudo brctl delbr br100
 
 Set MySQL Password
-~~~~~~~~~~~~~~~~~~
+------------------
 
 If you forgot to set the root password you can do this:
 
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a7a1099bc7..17e9b9e153 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -7,10 +7,10 @@ nice for kicking the tires, but doesn't compare to the feeling you get
 with hardware.
 
 Prerequisites Linux & Network
------------------------------
+=============================
 
 Minimal Install
-~~~~~~~~~~~~~~~
+---------------
 
 You need to have a system with a fresh install of Linux. You can
 download the `Minimal
@@ -25,7 +25,7 @@ work but you may need to tell Network Manager to keep its fingers off
 the interface(s) that OpenStack uses for bridging.
 
 Network Configuration
-~~~~~~~~~~~~~~~~~~~~~
+---------------------
 
 Determine the network configuration on the interface used to integrate
 your OpenStack cloud with your existing network. For example, if the IPs
@@ -36,10 +36,10 @@ To make things easier later change your host to use a static IP instead
 of DHCP (i.e. 192.168.1.201).
 
 Installation shake and bake
----------------------------
+===========================
 
 Add your user
-~~~~~~~~~~~~~
+-------------
 
 We need to add a user to install DevStack. (if you created a user during
 install you can skip this step and just give the user sudo privileges
@@ -61,7 +61,7 @@ From here on you should use the user you created. **Logout** and
 **login** as that user.
 
 Download DevStack
-~~~~~~~~~~~~~~~~~
+-----------------
 
 We'll grab the latest version of DevStack via https:
 
@@ -72,7 +72,7 @@ We'll grab the latest version of DevStack via https:
     cd devstack
 
 Run DevStack
-~~~~~~~~~~~~
+------------
 
 Now to configure ``stack.sh``. DevStack includes a sample in
 ``devstack/samples/local.conf``. Create ``local.conf`` as shown below to
@@ -120,7 +120,7 @@ see a summary of ``stack.sh``'s work, including the relevant URLs,
 accounts and passwords to poke at your shiny new OpenStack.
 
 Using OpenStack
-~~~~~~~~~~~~~~~
+---------------
 
 At this point you should be able to access the dashboard from other
 computers on the local network. In this example that would be
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index ef59953eb6..a41c4e14f1 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -9,16 +9,16 @@ launched in the cloud will be slow as they are running in QEMU
 operation. Speed not required.
 
 Prerequisites Cloud & Image
----------------------------
+===========================
 
 Virtual Machine
-~~~~~~~~~~~~~~~
+---------------
 
 DevStack should run in any virtual machine running a supported Linux
 release. It will perform best with 2Gb or more of RAM.
 
 OpenStack Deployment & cloud-init
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+---------------------------------
 
 If the cloud service has an image with ``cloud-init`` pre-installed, use
 it. You can get one from `Ubuntu's Daily
@@ -33,10 +33,10 @@ can manually kick off the script below as a non-root user in a
 bare-bones server installation.
 
 Installation shake and bake
----------------------------
+===========================
 
 Launching With Cloud-Init
-~~~~~~~~~~~~~~~~~~~~~~~~~
+-------------------------
 
 This cloud config grabs the latest version of DevStack via git, creates
 a minimal ``local.conf`` file and kicks off ``stack.sh``. It should be
@@ -79,13 +79,13 @@ As DevStack will refuse to run as root, this configures ``cloud-init``
 to create a non-root user and run the ``start.sh`` script as that user.
 
 Launching By Hand
-~~~~~~~~~~~~~~~~~
+-----------------
 
 Using a hypervisor directly, launch the VM and either manually perform
 the steps in the embedded shell script above or copy it into the VM.
 
 Using OpenStack
-~~~~~~~~~~~~~~~
+---------------
 
 At this point you should be able to access the dashboard. Launch VMs and
 if you give them floating IPs access those VMs from other machines on
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 40782403fa..23ccf27d0a 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -13,10 +13,10 @@ Below is a list of what is specifically is supported (read that as
 "tested") going forward.
 
 Supported Components
---------------------
+====================
 
 Base OS
-~~~~~~~
+-------
 
 *The OpenStack Technical Committee (TC) has defined the current CI
 strategy to include the latest Ubuntu release and the latest RHEL
@@ -33,7 +33,7 @@ release (for Python 2.6 testing).*
    side-effects on other OS platforms.
 
 Databases
-~~~~~~~~~
+---------
 
 *As packaged by the host OS*
 
@@ -41,7 +41,7 @@ Databases
 -  PostgreSQL
 
 Queues
-~~~~~~
+------
 
 *As packaged by the host OS*
 
@@ -49,14 +49,14 @@ Queues
 -  Qpid
 
 Web Server
-~~~~~~~~~~
+----------
 
 *As packaged by the host OS*
 
 -  Apache
 
 OpenStack Network
-~~~~~~~~~~~~~~~~~
+-----------------
 
 *Default to Nova Network, optionally use Neutron*
 
@@ -65,7 +65,7 @@ OpenStack Network
    mode using linuxbridge or OpenVSwitch.
 
 Services
-~~~~~~~~
+--------
 
 The default services configured by DevStack are Identity (Keystone),
 Object Storage (Swift), Image Storage (Glance), Block Storage (Cinder),
@@ -77,14 +77,14 @@ Additional services not included directly in DevStack can be tied in to
 scripts that perform the configuration and startup of the service.
 
 Node Configurations
-~~~~~~~~~~~~~~~~~~~
+-------------------
 
 -  single node
 -  multi-node is not tested regularly by the core team, and even then
    only minimal configurations are reviewed
 
 Exercises
-~~~~~~~~~
+---------
 
 The DevStack exercise scripts are no longer used as integration and gate
 testing as that job has transitioned to Tempest. They are still
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index b4136c4653..485cd0f04e 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -6,7 +6,7 @@ DevStack has a couple of plugin mechanisms to allow easily adding
 support for additional projects and features.
 
 Extras.d Hooks
-~~~~~~~~~~~~~~
+==============
 
 These hooks are an extension of the service calls in
 ``stack.sh`` at specific points in its run, plus ``unstack.sh`` and
@@ -93,7 +93,7 @@ The arguments are:
    but after ``unstack.sh`` has been called.
 
 Hypervisor
-~~~~~~~~~~
+==========
 
 Hypervisor plugins are fairly new and condense most hypervisor
 configuration into one place.

From 91b229058cd8204d0c3a038d24aa09d1baadef2f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 18 Nov 2014 07:13:35 -0500
Subject: [PATCH 0104/3333] apparently the upstream naming is tempest-lib

tempest_lib was how this was generally referred to, however that meant
that the job naming wasn't specifying the correctly src
library. Change to tempest-lib to actually test these things before
release.

Change-Id: I4c0712156d7ff71ee43747f30ab940e249d12ebc
---
 lib/tempest | 8 ++++----
 stackrc     | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 9e025a1096..e903ec3bc1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -45,7 +45,7 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["tempest_lib"]=$DEST/tempest-lib
+GITDIR["tempest-lib"]=$DEST/tempest-lib
 
 TEMPEST_DIR=$DEST/tempest
 TEMPEST_CONFIG_DIR=${TEMPEST_CONFIG_DIR:-$TEMPEST_DIR/etc}
@@ -446,9 +446,9 @@ function create_tempest_accounts {
 
 # install_tempest_lib() - Collect source, prepare, and install tempest-lib
 function install_tempest_lib {
-    if use_library_from_git "tempest_lib"; then
-        git_clone_by_name "tempest_lib"
-        setup_develop "tempest_lib"
+    if use_library_from_git "tempest-lib"; then
+        git_clone_by_name "tempest-lib"
+        setup_develop "tempest-lib"
     fi
 }
 
diff --git a/stackrc b/stackrc
index 18e1de3b19..8497f0f627 100644
--- a/stackrc
+++ b/stackrc
@@ -203,8 +203,8 @@ TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 
 # TODO(sdague): this should end up as a library component like below
-GITREPO["tempest_lib"]=${TEMPEST_LIB_REPO:-${GIT_BASE}/openstack/tempest-lib.git}
-GITBRANCH["tempest_lib"]=${TEMPEST_LIB_BRANCH:-master}
+GITREPO["tempest-lib"]=${TEMPEST_LIB_REPO:-${GIT_BASE}/openstack/tempest-lib.git}
+GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
 
 
 ##############

From d591a25e424ea8cec4d67854fcce236671210139 Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Mon, 27 Oct 2014 17:22:17 +0000
Subject: [PATCH 0105/3333] Add support for tuskar-api service

Adds initial support for configuring and starting the tuskar-api
service.

To enable, add the following to your localrc:

enable_service tuskar
enable_service tuskar-api

The aim of this addition is to provide a more accessible (non devtest)
way for developers to run up tuskar in a familiar devstack environment.

See the official repos for more information:
https://github.com/openstack/tuskar/
https://github.com/openstack/python-tuskarclient

Change-Id: Id0c3c0d3a38100c66dbe6e3adf1f715162f99742
---
 doc/source/index.rst  |   1 +
 extras.d/70-tuskar.sh | 205 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 206 insertions(+)
 create mode 100644 extras.d/70-tuskar.sh

diff --git a/doc/source/index.rst b/doc/source/index.rst
index dbefdec144..17499c520d 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -165,6 +165,7 @@ Scripts
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
 * `extras.d/70-sahara.sh <extras.d/70-sahara.sh.html>`__
 * `extras.d/70-trove.sh <extras.d/70-trove.sh.html>`__
+* `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
 * `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
 * `extras.d/80-opendaylight.sh <extras.d/80-opendaylight.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
diff --git a/extras.d/70-tuskar.sh b/extras.d/70-tuskar.sh
new file mode 100644
index 0000000000..e77c504db0
--- /dev/null
+++ b/extras.d/70-tuskar.sh
@@ -0,0 +1,205 @@
+# Install and start the **Tuskar** service
+#
+# To enable, add the following to your localrc
+#
+# enable_service tuskar
+# enable_service tuskar-api
+
+
+if is_service_enabled tuskar; then
+    if [[ "$1" == "source" ]]; then
+        # Initial source, do nothing as functions sourced
+        # are below rather than in lib/tuskar
+        echo_summary "source extras tuskar"
+    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
+        echo_summary "Installing Tuskar"
+        install_tuskarclient
+        install_tuskar
+    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
+        echo_summary "Configuring Tuskar"
+        configure_tuskar
+        configure_tuskarclient
+
+        if is_service_enabled key; then
+            create_tuskar_accounts
+        fi
+
+    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
+        echo_summary "Initializing Tuskar"
+        init_tuskar
+        start_tuskar
+    fi
+
+    if [[ "$1" == "unstack" ]]; then
+        stop_tuskar
+    fi
+fi
+
+# library code (equivalent to lib/tuskar)
+# ---------
+# - install_tuskarclient
+# - install_tuskar
+# - configure_tuskarclient
+# - configure_tuskar
+# - init_tuskar
+# - start_tuskar
+# - stop_tuskar
+# - cleanup_tuskar
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# tuskar repos
+TUSKAR_REPO=${TUSKAR_REPO:-${GIT_BASE}/openstack/tuskar.git}
+TUSKAR_BRANCH=${TUSKAR_BRANCH:-master}
+
+TUSKARCLIENT_REPO=${TUSKARCLIENT_REPO:-${GIT_BASE}/openstack/python-tuskarclient.git}
+TUSKARCLIENT_BRANCH=${TUSKARCLIENT_BRANCH:-master}
+
+# set up default directories
+TUSKAR_DIR=$DEST/tuskar
+TUSKARCLIENT_DIR=$DEST/python-tuskarclient
+TUSKAR_AUTH_CACHE_DIR=${TUSKAR_AUTH_CACHE_DIR:-/var/cache/tuskar}
+TUSKAR_STANDALONE=`trueorfalse False $TUSKAR_STANDALONE`
+TUSKAR_CONF_DIR=/etc/tuskar
+TUSKAR_CONF=$TUSKAR_CONF_DIR/tuskar.conf
+TUSKAR_API_HOST=${TUSKAR_API_HOST:-$HOST_IP}
+TUSKAR_API_PORT=${TUSKAR_API_PORT:-8585}
+
+# Tell Tempest this project is present
+TEMPEST_SERVICES+=,tuskar
+
+# Functions
+# ---------
+
+# Test if any Tuskar services are enabled
+# is_tuskar_enabled
+function is_tuskar_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"tuskar-" ]] && return 0
+    return 1
+}
+
+# cleanup_tuskar() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_tuskar {
+    sudo rm -rf $TUSKAR_AUTH_CACHE_DIR
+}
+
+# configure_tuskar() - Set config files, create data dirs, etc
+function configure_tuskar {
+    setup_develop $TUSKAR_DIR
+
+    if [[ ! -d $TUSKAR_CONF_DIR ]]; then
+        sudo mkdir -p $TUSKAR_CONF_DIR
+    fi
+    sudo chown $STACK_USER $TUSKAR_CONF_DIR
+    # remove old config files
+    rm -f $TUSKAR_CONF_DIR/tuskar-*.conf
+
+    TUSKAR_POLICY_FILE=$TUSKAR_CONF_DIR/policy.json
+
+    cp $TUSKAR_DIR/etc/tuskar/policy.json $TUSKAR_POLICY_FILE
+    cp $TUSKAR_DIR/etc/tuskar/tuskar.conf.sample $TUSKAR_CONF
+
+    # common options
+    iniset $TUSKAR_CONF database connection `database_connection_url tuskar`
+
+    # logging
+    iniset $TUSKAR_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $TUSKAR_CONF DEFAULT use_syslog $SYSLOG
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+        # Add color to logging output
+        setup_colorized_logging $TUSKAR_CONF DEFAULT tenant user
+    fi
+
+    configure_auth_token_middleware $TUSKAR_CONF tuskar $TUSKAR_AUTH_CACHE_DIR
+
+    if is_ssl_enabled_service "key"; then
+        iniset $TUSKAR_CONF clients_keystone ca_file $SSL_BUNDLE_FILE
+    fi
+
+    iniset $TUSKAR_CONF tuskar_api bind_port $TUSKAR_API_PORT
+
+}
+
+# init_tuskar() - Initialize database
+function init_tuskar {
+
+    # (re)create tuskar database
+    recreate_database tuskar utf8
+
+    tuskar-dbsync --config-file $TUSKAR_CONF
+    create_tuskar_cache_dir
+}
+
+# create_tuskar_cache_dir() - Part of the init_tuskar() process
+function create_tuskar_cache_dir {
+    # Create cache dirs
+    sudo mkdir -p $TUSKAR_AUTH_CACHE_DIR
+    sudo chown $STACK_USER $TUSKAR_AUTH_CACHE_DIR
+}
+
+# install_tuskarclient() - Collect source and prepare
+function install_tuskarclient {
+    git_clone $TUSKARCLIENT_REPO $TUSKARCLIENT_DIR $TUSKARCLIENT_BRANCH
+    setup_develop $TUSKARCLIENT_DIR
+}
+
+# configure_tuskarclient() - Set config files, create data dirs, etc
+function configure_tuskarclient {
+    setup_develop $TUSKARCLIENT_DIR
+}
+
+# install_tuskar() - Collect source and prepare
+function install_tuskar {
+    git_clone $TUSKAR_REPO $TUSKAR_DIR $TUSKAR_BRANCH
+}
+
+# start_tuskar() - Start running processes, including screen
+function start_tuskar {
+    run_process tuskar-api "tuskar-api --config-file=$TUSKAR_CONF"
+}
+
+# stop_tuskar() - Stop running processes
+function stop_tuskar {
+    # Kill the screen windows
+    local serv
+    for serv in tuskar-api; do
+        stop_process $serv
+    done
+}
+
+# create_tuskar_accounts() - Set up common required tuskar accounts
+function create_tuskar_accounts {
+    # migrated from files/keystone_data.sh
+    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
+    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
+
+    local tuskar_user=$(get_or_create_user "tuskar" \
+        "$SERVICE_PASSWORD" $service_tenant)
+    get_or_add_user_role $admin_role $tuskar_user $service_tenant
+
+    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
+
+        local tuskar_service=$(get_or_create_service "tuskar" \
+                "management" "Tuskar Management Service")
+        get_or_create_endpoint $tuskar_service \
+            "$REGION_NAME" \
+            "$SERVICE_PROTOCOL://$TUSKAR_API_HOST:$TUSKAR_API_PORT" \
+            "$SERVICE_PROTOCOL://$TUSKAR_API_HOST:$TUSKAR_API_PORT" \
+            "$SERVICE_PROTOCOL://$TUSKAR_API_HOST:$TUSKAR_API_PORT"
+    fi
+}
+
+# Restore xtrace
+$XTRACE
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:

From 4b45fca7bb3ad93d7ee3fb0f121eb715798044f4 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Mon, 17 Nov 2014 09:59:23 -0800
Subject: [PATCH 0106/3333] Do not hardcode ironic svc port, protocol

The Ironic API server's port and protocol are hardcoded in various
places.  This updates the ironic bits to use configured values instead
and fixes a bug around iptables rule creationl.

Change-Id: I1ace68affff3afdbc0058be4d32f8044a24e9338
Closes-bug: #1393498
---
 lib/ironic                         | 12 +++++++-----
 lib/nova_plugins/hypervisor-ironic |  2 +-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index a56ab7ae65..30ae9e9500 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -104,7 +104,8 @@ IRONIC_BIN_DIR=$(get_python_exec_prefix)
 
 # Ironic connection info.  Note the port must be specified.
 IRONIC_SERVICE_PROTOCOL=http
-IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST:6385}
+IRONIC_SERVICE_PORT=${IRONIC_SERVICE_PORT:-6385}
+IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST:$IRONIC_SERVICE_PORT}
 
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,ironic
@@ -277,6 +278,7 @@ function configure_ironic_api {
     iniset $IRONIC_CONF_FILE DEFAULT policy_file $IRONIC_POLICY_JSON
     configure_auth_token_middleware $IRONIC_CONF_FILE ironic $IRONIC_AUTH_CACHE_DIR/api
     iniset_rpc_backend ironic $IRONIC_CONF_FILE DEFAULT
+    iniset $IRONIC_CONF_FILE api port $IRONIC_SERVICE_PORT
 
     cp -p $IRONIC_DIR/etc/ironic/policy.json $IRONIC_POLICY_JSON
 }
@@ -298,7 +300,7 @@ function configure_ironic_conductor {
 
     iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF
     iniset $IRONIC_CONF_FILE DEFAULT enabled_drivers $IRONIC_ENABLED_DRIVERS
-    iniset $IRONIC_CONF_FILE conductor api_url http://$HOST_IP:6385
+    iniset $IRONIC_CONF_FILE conductor api_url $IRONIC_SERVICE_PROTOCOL://$HOST_IP:$IRONIC_SERVICE_PORT
     iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
     iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
     iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
@@ -419,7 +421,7 @@ function start_ironic {
 function start_ironic_api {
     run_process ir-api "$IRONIC_BIN_DIR/ironic-api --config-file=$IRONIC_CONF_FILE"
     echo "Waiting for ir-api ($IRONIC_HOSTPORT) to start..."
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget --no-proxy -q -O- http://$IRONIC_HOSTPORT; do sleep 1; done"; then
+    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget --no-proxy -q -O- $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT; do sleep 1; done"; then
         die $LINENO "ir-api did not start"
     fi
 }
@@ -586,7 +588,7 @@ function configure_iptables {
     sudo modprobe nf_nat_tftp
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HOSTPORT -j ACCEPT || true
+    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
     if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
         # agent ramdisk gets instance image from swift
         sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
@@ -748,7 +750,7 @@ function cleanup_baremetal_basic_ops {
     sudo rm -rf /etc/xinetd.d/tftp /etc/init/tftpd-hpa.override
     restart_service xinetd
     sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -D INPUT -d $HOST_IP -p tcp --dport 6385 -j ACCEPT || true
+    sudo iptables -D INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
     if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
         # agent ramdisk gets instance image from swift
         sudo iptables -D INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 4004cc935a..420950328e 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,7 +47,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
     iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
     iniset $NOVA_CONF ironic admin_tenant_name demo
-    iniset $NOVA_CONF ironic api_endpoint http://$SERVICE_HOST:6385/v1
+    iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
 
 # install_nova_hypervisor() - Install external components

From 849d0b8ebb9aff4a2106c01a691112578f25281c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <sebastien.han@enovance.com>
Date: Tue, 18 Nov 2014 11:10:11 -0800
Subject: [PATCH 0107/3333] Fix the variable substitution
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prior to that commit if ceph_version was equal to 0.80.5, the variable
substitution ${ceph_version%.*} was returning 0.80 and not 0. Using
${ceph_version%%.*} returns the desired value.
Also refactoring the version output to get a X.X format since only
major and minor are important.

Change-Id: Iab50f3c4b24a01a68acda417eae0501f00038f54
Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
---
 lib/ceph | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index 2ddf5dbb6a..bfad3dcf60 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -72,7 +72,7 @@ CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
 # ------------
 
 function get_ceph_version {
-    local ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4)
+    local ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4 | cut -f 1,2 -d '.')
     echo $ceph_version_str
 }
 
@@ -162,7 +162,7 @@ EOF
     # pools data and metadata were removed in the Giant release so depending on the version we apply different commands
     local ceph_version=$(get_ceph_version)
     # change pool replica size according to the CEPH_REPLICAS set by the user
-    if [[ ${ceph_version%.*} -eq 0 ]] && [[ ${ceph_version##*.} -lt 87 ]]; then
+    if [[ ${ceph_version%%.*} -eq 0 ]] && [[ ${ceph_version##*.} -lt 87 ]]; then
         sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
         sudo ceph -c ${CEPH_CONF_FILE} osd pool set data size ${CEPH_REPLICAS}
         sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata size ${CEPH_REPLICAS}

From 088e66028c4eb41cf583a76409febce13475b66c Mon Sep 17 00:00:00 2001
From: Mikhail S Medvedev <mmedvede@us.ibm.com>
Date: Tue, 18 Nov 2014 12:11:26 -0600
Subject: [PATCH 0108/3333] Deal with different django-admin executables

After the recent patch [1] the devstack is broken for Fedora 20 with
the error "django-admin.py: command not found" during horizon setup.

This is due to differences in how django currently packaged for Fedora,
where we should use "django-admin", without the .py

This patch sets up executable alias by checking if "django-admin"
exists, and falling back on "django-admin.py".

[1] https://review.openstack.org/#/c/120940/

Change-Id: I2b6de25fe32446edbdc0418674fea8579ec739d9
---
 lib/horizon | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 872e77a040..9fd1b854c8 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -142,8 +142,16 @@ function init_horizon {
     # and run_process
     sudo rm -f /var/log/$APACHE_NAME/horizon_*
 
-    DJANGO_SETTINGS_MODULE=openstack_dashboard.settings django-admin.py collectstatic --noinput
-    DJANGO_SETTINGS_MODULE=openstack_dashboard.settings django-admin.py compress --force
+    # Setup alias for django-admin which could be different depending on distro
+    local django_admin
+    if type -p django-admin > /dev/null; then
+        django_admin=django-admin
+    else
+        django_admin=django-admin.py
+    fi
+
+    DJANGO_SETTINGS_MODULE=openstack_dashboard.settings $django_admin collectstatic --noinput
+    DJANGO_SETTINGS_MODULE=openstack_dashboard.settings $django_admin compress --force
 
 }
 

From fe96ed66f5fea37484dfaae597c43756c16e5779 Mon Sep 17 00:00:00 2001
From: yunhong jiang <yunhong.jiang@intel.com>
Date: Wed, 5 Nov 2014 03:30:25 -0700
Subject: [PATCH 0109/3333] Add agent_ipmitool support

This patch enables to use the agent_ipmitool deploy driver to
deploy the ironic on real hardware, instead of virtual machine.

It also append the deploy driver name to the kernel/ramdisk
path, so that if developer switch the deploy driver after
./unstack.sh, devstack will use the correct kernel/ramdisk.

Change-Id: Iac0415f6895d037c876e137aa4f2bf2990eb47c5
---
 lib/ironic | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 98619c5f51..f2b1fb2f6a 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -93,7 +93,7 @@ IRONIC_AGENT_KERNEL_URL=${IRONIC_AGENT_KERNEL_URL:-http://tarballs.openstack.org
 IRONIC_AGENT_RAMDISK_URL=${IRONIC_AGENT_RAMDISK_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe_image-oem.cpio.gz}
 
 # Which deploy driver to use - valid choices right now
-# are 'pxe_ssh', 'pxe_ipmitool' and 'agent_ssh'.
+# are 'pxe_ssh', 'pxe_ipmitool', 'agent_ssh' and 'agent_ipmitool'.
 IRONIC_DEPLOY_DRIVER=${IRONIC_DEPLOY_DRIVER:-pxe_ssh}
 
 #TODO(agordeev): replace 'ubuntu' with host distro name getting
@@ -152,6 +152,11 @@ function is_ironic_hardware {
     return 1
 }
 
+function is_deployed_by_agent {
+    [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]] && return 0
+    return 1
+}
+
 # install_ironic() - Collect source and prepare
 function install_ironic {
     # make sure all needed service were enabled
@@ -307,7 +312,7 @@ function configure_ironic_conductor {
     if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
         iniset $IRONIC_CONF_FILE pxe pxe_append_params "nofb nomodeset vga=normal console=ttyS0"
     fi
-    if [[ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]] ; then
+    if is_deployed_by_agent; then
         if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
             iniset $IRONIC_CONF_FILE glance swift_temp_url_key $SWIFT_TEMPURL_KEY
         else
@@ -510,7 +515,7 @@ function enroll_nodes {
     if [[ "$IRONIC_DEPLOY_DRIVER" == "pxe_ssh" ]] ; then
         local _IRONIC_DEPLOY_KERNEL_KEY=pxe_deploy_kernel
         local _IRONIC_DEPLOY_RAMDISK_KEY=pxe_deploy_ramdisk
-    elif [[ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]] ; then
+    elif is_deployed_by_agent; then
         local _IRONIC_DEPLOY_KERNEL_KEY=deploy_kernel
         local _IRONIC_DEPLOY_RAMDISK_KEY=deploy_ramdisk
     fi
@@ -552,6 +557,10 @@ function enroll_nodes {
             # we create the bare metal flavor with minimum value
             local node_options="-i ipmi_address=$ipmi_address -i ipmi_password=$ironic_ipmi_passwd\
                 -i ipmi_username=$ironic_ipmi_username"
+            if is_deployed_by_agent; then
+                node_options+=" -i $_IRONIC_DEPLOY_KERNEL_KEY=$IRONIC_DEPLOY_KERNEL_ID"
+                node_options+=" -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID"
+            fi
         fi
 
         local node_id=$(ironic node-create --chassis_uuid $chassis_id \
@@ -589,7 +598,7 @@ function configure_iptables {
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
     sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
-    if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
+    if is_deployed_by_agent; then
         # agent ramdisk gets instance image from swift
         sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
     fi
@@ -665,8 +674,8 @@ function upload_baremetal_ironic_deploy {
     fi
 
     if [ -z "$IRONIC_DEPLOY_KERNEL" -o -z "$IRONIC_DEPLOY_RAMDISK" ]; then
-        local IRONIC_DEPLOY_KERNEL_PATH=$TOP_DIR/files/ir-deploy.kernel
-        local IRONIC_DEPLOY_RAMDISK_PATH=$TOP_DIR/files/ir-deploy.initramfs
+        local IRONIC_DEPLOY_KERNEL_PATH=$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.kernel
+        local IRONIC_DEPLOY_RAMDISK_PATH=$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.initramfs
     else
         local IRONIC_DEPLOY_KERNEL_PATH=$IRONIC_DEPLOY_KERNEL
         local IRONIC_DEPLOY_RAMDISK_PATH=$IRONIC_DEPLOY_RAMDISK
@@ -677,17 +686,17 @@ function upload_baremetal_ironic_deploy {
         if [ "$IRONIC_BUILD_DEPLOY_RAMDISK" = "True" ]; then
             # we can build them only if we're not offline
             if [ "$OFFLINE" != "True" ]; then
-                if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
+                if is_deployed_by_agent; then
                     build_ipa_coreos_ramdisk $IRONIC_DEPLOY_KERNEL_PATH $IRONIC_DEPLOY_RAMDISK_PATH
                 else
                     ramdisk-image-create $IRONIC_DEPLOY_FLAVOR \
-                        -o $TOP_DIR/files/ir-deploy
+                        -o $TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER
                 fi
             else
                 die $LINENO "Deploy kernel+ramdisk files don't exist and cannot be build in OFFLINE mode"
             fi
         else
-            if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
+            if is_deployed_by_agent; then
                 # download the agent image tarball
                 wget "$IRONIC_AGENT_KERNEL_URL" -O $IRONIC_DEPLOY_KERNEL_PATH
                 wget "$IRONIC_AGENT_RAMDISK_URL" -O $IRONIC_DEPLOY_RAMDISK_PATH
@@ -751,7 +760,7 @@ function cleanup_baremetal_basic_ops {
     restart_service xinetd
     sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
     sudo iptables -D INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
-    if [ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]; then
+    if is_deployed_by_agent; then
         # agent ramdisk gets instance image from swift
         sudo iptables -D INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
     fi

From e4e535b0bf07bc823bdd72b31f66628e5ea96465 Mon Sep 17 00:00:00 2001
From: salvatore <salv.orlando@gmail.com>
Date: Wed, 29 Oct 2014 18:22:46 +0100
Subject: [PATCH 0110/3333] Ensure syslog option is honored by neutron and
 tempest

Syslog settings were not configured at all for these two
projects. As a result, regardless of the value of the
SYSLOG environment variable, the use_syslog options for
these two projects was always set to False.

Change-Id: Iba6155d62beffa06e5bb9ac16b06082ec64d0926
Closes-Bug: #1394024
---
 lib/neutron | 2 +-
 lib/tempest | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index db6bd47ced..1d4fe1bd5f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -785,7 +785,7 @@ function _configure_neutron_common {
 
     iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
     iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
-
+    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
     # If addition config files are set, make sure their path name is set as well
     if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
         die $LINENO "Neutron additional plugin config not set.. exiting"
diff --git a/lib/tempest b/lib/tempest
index 8931300b98..d3fb9fb2dc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -247,6 +247,7 @@ function configure_tempest {
         fi
     fi
 
+    iniset $TEMPEST_CONF DEFAULT use_syslog $SYSLOG
     # Oslo
     iniset $TEMPEST_CONFIG DEFAULT lock_path $TEMPEST_STATE_PATH
     mkdir -p $TEMPEST_STATE_PATH

From 9d09f0980285b5b5d5ccf3865cab1c5df49b25d5 Mon Sep 17 00:00:00 2001
From: Oleg Gashev <oleg@gashev.net>
Date: Wed, 19 Nov 2014 00:29:03 -0500
Subject: [PATCH 0111/3333] Remove is_rackspace function from functions-common

is_rackspace function never used and can be removed from code.

Change-Id: Ic5d1dc419bdea3619fe248afad027e7d7c602b4f
Closes-Bug: #1394076
---
 functions-common | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/functions-common b/functions-common
index e890b75d13..a96c702728 100644
--- a/functions-common
+++ b/functions-common
@@ -499,13 +499,6 @@ function is_arch {
     [[ "$(uname -m)" == "$1" ]]
 }
 
-# Quick check for a rackspace host; n.b. rackspace provided images
-# have these Xen tools installed but a custom image may not.
-function is_rackspace {
-    [ -f /usr/bin/xenstore-ls ] && \
-        sudo /usr/bin/xenstore-ls vm-data | grep -q "Rackspace"
-}
-
 # Determine if current distribution is a Fedora-based distribution
 # (Fedora, RHEL, CentOS, etc).
 # is_fedora

From 48bbfe93f5b4b600db0f12c1f8574d4177ccce36 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Wed, 19 Nov 2014 15:54:17 -0500
Subject: [PATCH 0112/3333] switch to use ceilometer specific connections

in Juno/Kilo, we added ceilometer purpose specific connections for:
metering, alarms, event. Rather than piggyback off oslo.db's
connection option (which gives misleading sql help message), we
should use Ceilometer specific connections.

Change-Id: I7703b73708a5807fb8de89fbb828f06b488acf69
---
 lib/ceilometer | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index c4377e04c0..cdef422bb5 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -183,10 +183,14 @@ function configure_ceilometer {
     configure_auth_token_middleware $CEILOMETER_CONF ceilometer $CEILOMETER_AUTH_CACHE_DIR
 
     if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] ; then
-        iniset $CEILOMETER_CONF database connection $(database_connection_url ceilometer)
+        iniset $CEILOMETER_CONF database alarm_connection $(database_connection_url ceilometer)
+        iniset $CEILOMETER_CONF database event_connection $(database_connection_url ceilometer)
+        iniset $CEILOMETER_CONF database metering_connection $(database_connection_url ceilometer)
         iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
     else
-        iniset $CEILOMETER_CONF database connection mongodb://localhost:27017/ceilometer
+        iniset $CEILOMETER_CONF database alarm_connection mongodb://localhost:27017/ceilometer
+        iniset $CEILOMETER_CONF database event_connection mongodb://localhost:27017/ceilometer
+        iniset $CEILOMETER_CONF database metering_connection mongodb://localhost:27017/ceilometer
         configure_mongodb
         cleanup_ceilometer
     fi

From 8df690c52530589816a7323c24e4d616478b596c Mon Sep 17 00:00:00 2001
From: Louis Taylor <kragniz@gmail.com>
Date: Thu, 20 Nov 2014 13:09:03 +0000
Subject: [PATCH 0113/3333] Install bash completion for glanceclient

This installs the new bash-complete file in the standard location,
alongside the rest of the completion files:

    /etc/bash_completion.d/glance.bash_completion

Change-Id: I2944c47d857f7125f370b2b1ee041d1282db09c5
---
 lib/glance | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/glance b/lib/glance
index 04c088aa6d..5b456393ff 100644
--- a/lib/glance
+++ b/lib/glance
@@ -290,6 +290,7 @@ function install_glanceclient {
     if use_library_from_git "python-glanceclient"; then
         git_clone_by_name "python-glanceclient"
         setup_dev_lib "python-glanceclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-glanceclient"]}/tools/,/etc/bash_completion.d/}glance.bash_completion
     fi
 }
 

From aecd189f80533b2680184d648f393bd0f5479882 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Nov 2014 15:19:51 -0500
Subject: [PATCH 0114/3333] add unit tests for GIT* definitions

This adds unit tests for all the GIT* definitions, ensuring that for
libraries we think should be defined, they are. It exposed a bug in
glance_store definitions in the process.

The GITDIR definition for python-openstackclient is moved to stackrc
for testability.

Change-Id: Ibd9ab665f0362a84f4f7e80e80da56a4737f584e
---
 lib/glance                   |  2 +-
 stack.sh                     |  3 --
 stackrc                      |  2 +
 tests/test_libs_from_pypi.sh | 96 ++++++++++++++++++++++++++++++++++++
 4 files changed, 99 insertions(+), 4 deletions(-)
 create mode 100755 tests/test_libs_from_pypi.sh

diff --git a/lib/glance b/lib/glance
index 04c088aa6d..0c1045fd12 100644
--- a/lib/glance
+++ b/lib/glance
@@ -28,7 +28,7 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-glanceclient"]=$DEST/python-glanceclient
-GIRDIR["glance_store"]=$DEST/glance_store
+GITDIR["glance_store"]=$DEST/glance_store
 
 GLANCE_DIR=$DEST/glance
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
diff --git a/stack.sh b/stack.sh
index 93e4541990..24bda01782 100755
--- a/stack.sh
+++ b/stack.sh
@@ -575,9 +575,6 @@ if [[ -d $TOP_DIR/extras.d ]]; then
     done
 fi
 
-# Set the destination directories for other OpenStack projects
-GITDIR["python-openstackclient"]=$DEST/python-openstackclient
-
 # Interactive Configuration
 # -------------------------
 
diff --git a/stackrc b/stackrc
index e0e886d22c..5c5acb137c 100644
--- a/stackrc
+++ b/stackrc
@@ -273,6 +273,8 @@ GITBRANCH["python-troveclient"]=${TROVECLIENT_BRANCH:-master}
 # consolidated openstack python client
 GITREPO["python-openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
 GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
+# this doesn't exist in a lib file, so set it here
+GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
 ###################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
new file mode 100755
index 0000000000..1b576d87c2
--- /dev/null
+++ b/tests/test_libs_from_pypi.sh
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+export TOP_DIR=$TOP
+
+# Import common functions
+source $TOP/functions
+source $TOP/stackrc
+source $TOP/lib/tls
+for i in $TOP/lib/*; do
+    if [[ -f $i ]]; then
+        source $i
+    fi
+done
+
+ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient"
+
+# Generate the above list with
+# echo ${!GITREPO[@]}
+
+function check_exists {
+    local thing=$1
+    local hash=$2
+    local key=$3
+    if [[ ! -z "$VERBOSE" ]]; then
+        echo "Checking for $hash[$key]"
+    fi
+    if [[ -z $thing ]]; then
+        echo "$hash[$key] does not exit!"
+        exit 1
+    else
+        if [[ ! -z "$VERBOSE" ]]; then
+            echo "$hash[$key] => $thing"
+        fi
+    fi
+}
+
+function test_all_libs_upto_date {
+    # this is all the magics
+    local found_libs=${!GITREPO[@]}
+    declare -A all_libs
+    for lib in $ALL_LIBS; do
+        all_libs[$lib]=1
+    done
+
+    for lib in $found_libs; do
+        if [[ -z ${all_libs[$lib]} ]]; then
+            echo "Library '$lib' not listed in unit tests, please add to ALL_LIBS"
+            exit 1
+        fi
+
+    done
+    echo "test_all_libs_upto_date PASSED"
+}
+
+function test_libs_exist {
+    local lib=""
+    for lib in $ALL_LIBS; do
+        check_exists "${GITREPO[$lib]}" "GITREPO" "$lib"
+        check_exists "${GITBRANCH[$lib]}" "GITBRANCH" "$lib"
+        check_exists "${GITDIR[$lib]}" "GITDIR" "$lib"
+    done
+
+    echo "test_libs_exist PASSED"
+}
+
+function test_branch_master {
+    for lib in $ALL_LIBS; do
+        if [[ ${GITBRANCH[$lib]} != "master" ]]; then
+            echo "GITBRANCH for $lib not master (${GITBRANCH[$lib]})"
+            exit 1
+        fi
+    done
+
+    echo "test_branch_master PASSED"
+}
+
+set -o errexit
+
+test_libs_exist
+test_branch_master
+test_all_libs_upto_date

From 34296016632a82ebbc88978a41f12ac2af1730e6 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean_collins2@cable.comcast.com>
Date: Mon, 27 Oct 2014 11:57:20 -0400
Subject: [PATCH 0115/3333] Documentation: Using Neutron with DevStack

Change-Id: I75f30a6809a6276dbd8a61e73535913be63b54f0
---
 doc/source/guides/neutron.rst | 195 ++++++++++++++++++++++++++++++++++
 doc/source/index.rst          |   8 ++
 2 files changed, 203 insertions(+)
 create mode 100644 doc/source/guides/neutron.rst

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
new file mode 100644
index 0000000000..59b7a9d55b
--- /dev/null
+++ b/doc/source/guides/neutron.rst
@@ -0,0 +1,195 @@
+======================================
+Using DevStack with Neutron Networking
+======================================
+
+This guide will walk you through using OpenStack Neutron with the ML2
+plugin and the Open vSwitch mechanism driver.
+
+Network Interface Configuration
+===============================
+
+To use Neutron, it is suggested that two network interfaces be present
+in the host operating system.
+
+The first interface, eth0 is used for the OpenStack management (API,
+message bus, etc) as well as for ssh for an administrator to access
+the machine.
+
+::
+
+        stack@compute:~$ ifconfig eth0
+        eth0      Link encap:Ethernet  HWaddr bc:16:65:20:af:fc
+                  inet addr:192.168.1.18
+
+eth1 is manually configured at boot to not have an IP address.
+Consult your operating system documentation for the appropriate
+technique. For Ubuntu, the contents of `/etc/networking/interfaces`
+contains:
+
+::
+
+        auto eth1
+        iface eth1 inet manual
+                up ifconfig $IFACE 0.0.0.0 up
+                down ifconfig $IFACE 0.0.0.0 down
+
+The second physical interface, eth1 is added to a bridge (in this case
+named br-ex), which is used to forward network traffic from guest VMs.
+Network traffic from eth1 on the compute nodes is then NAT'd by the
+controller node that runs Neutron's `neutron-l3-agent` and provides L3
+connectivity.
+
+::
+
+        stack@compute:~$ sudo ovs-vsctl add-br br-ex
+        stack@compute:~$ sudo ovs-vsctl add-port br-ex eth1
+        stack@compute:~$ sudo ovs-vsctl show
+        9a25c837-32ab-45f6-b9f2-1dd888abcf0f
+            Bridge br-ex
+                Port br-ex
+                    Interface br-ex
+                        type: internal
+                Port phy-br-ex
+                    Interface phy-br-ex
+                        type: patch
+                        options: {peer=int-br-ex}
+                Port "eth1"
+                    Interface "eth1"
+
+
+
+
+Neutron Networking with Open vSwitch
+====================================
+
+Configuring Neutron networking in DevStack is very similar to
+configuring `nova-network` - many of the same configuration variables
+(like `FIXED_RANGE` and `FLOATING_RANGE`) used by `nova-network` are
+used by Neutron, which is intentional.
+
+The only difference is the disabling of `nova-network` in your
+local.conf, and the enabling of the Neutron components.
+
+
+Configuration
+-------------
+
+::
+
+        FIXED_RANGE=10.0.0.0/24
+        FLOATING_RANGE=192.168.27.0/24
+        PUBLIC_NETWORK_GATEWAY=192.168.27.2
+
+        disable_service n-net
+        enable_service q-svc
+        enable_service q-agt
+        enable_service q-dhcp
+        enable_service q-meta
+        enable_service q-l3
+
+        Q_USE_SECGROUP=True
+        ENABLE_TENANT_VLANS=True
+        TENANT_VLAN_RANGE=1000:1999
+        PHYSICAL_NETWORK=default
+        OVS_PHYSICAL_BRIDGE=br-ex
+
+In this configuration we are defining FLOATING_RANGE to be a
+subnet that exists in the private RFC1918 address space - however in
+in a real setup FLOATING_RANGE would be a public IP address range.
+
+Neutron Networking with Open vSwitch and Provider Networks
+==========================================================
+
+In some instances, it is desirable to use Neutron's provider
+networking extension, so that networks that are configured on an
+external router can be utilized by Neutron, and instances created via
+Nova can attach to the network managed by the external router.
+
+For example, in some lab environments, a hardware router has been
+pre-configured by another party, and an OpenStack developer has been
+given a VLAN tag and IP address range, so that instances created via
+DevStack will use the external router for L3 connectivity, as opposed
+to the Neutron L3 service.
+
+
+Service Configuration
+---------------------
+
+**Control Node**
+
+In this example, the control node will run the majority of the
+OpenStack API and management services (Keystone, Glance,
+Nova, Neutron, etc..)
+
+
+**Compute Nodes**
+
+In this example, the nodes that will host guest instances will run
+the `neutron-openvswitch-agent` for network connectivity, as well as
+the compute service `nova-compute`.
+
+DevStack Configuration
+----------------------
+
+The following is a snippet of the DevStack configuration on the
+controller node.
+
+::
+
+        PUBLIC_INTERFACE=eth1
+
+        ## Neutron options
+        Q_USE_SECGROUP=True
+        ENABLE_TENANT_VLANS=True
+        TENANT_VLAN_RANGE=3001:4000
+        PHYSICAL_NETWORK=default
+        OVS_PHYSICAL_BRIDGE=br-ex
+
+        Q_USE_PROVIDER_NETWORKING=True
+        Q_L3_ENABLED=False
+
+        # Do not use Nova-Network
+        disable_service n-net
+
+        # Neutron
+        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt
+
+        ## Neutron Networking options used to create Neutron Subnets
+
+        FIXED_RANGE="10.1.1.0/24"
+        PROVIDER_SUBNET_NAME="provider_net"
+        PROVIDER_NETWORK_TYPE="vlan"
+        SEGMENTATION_ID=2010
+
+In this configuration we are defining FIXED_RANGE to be a
+subnet that exists in the private RFC1918 address space - however in
+in a real setup FIXED_RANGE would be a public IP address range, so
+that you could access your instances from the public internet.
+
+The following is a snippet of the DevStack configuration on the
+compute node.
+
+::
+
+        # Services that a compute node runs
+        ENABLED_SERVICES=n-cpu,rabbit,q-agt
+
+        ## Neutron options
+        Q_USE_SECGROUP=True
+        ENABLE_TENANT_VLANS=True
+        TENANT_VLAN_RANGE=3001:4000
+        PHYSICAL_NETWORK=default
+        OVS_PHYSICAL_BRIDGE=br-ex
+        PUBLIC_INTERFACE=eth1
+        Q_USE_PROVIDER_NETWORKING=True
+        Q_L3_ENABLED=False
+
+When DevStack is configured to use provider networking (via
+`Q_USE_PROVIDER_NETWORKING` is True and `Q_L3_ENABLED` is False) -
+DevStack will automatically add the network interface defined in
+`PUBLIC_INTERFACE` to the `OVS_PHYSICAL_BRIDGE`
+
+For example, with the above  configuration, a bridge is
+created, named `br-ex` which is managed by Open vSwitch, and the
+second interface on the compute node, `eth1` is attached to the
+bridge, to forward traffic sent by guest vms.
diff --git a/doc/source/index.rst b/doc/source/index.rst
index dbefdec144..21b31e4925 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,6 +63,7 @@ Walk through various setups used by stackers
    guides/single-vm
    guides/single-machine
    guides/multinode-lab
+   guides/neutron
 
 All-In-One Single VM
 --------------------
@@ -84,6 +85,13 @@ Multi-Node Lab
 Setup a :doc:`multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management.
 :doc:`[Read] <guides/multinode-lab>`
 
+DevStack with Neutron Networking
+--------------------------------
+
+Building a DevStack cluster with :doc:`Neutron Networking <guides/neutron>`.
+This guide is meant for building lab environments with a dedicated
+control node and multiple compute nodes.
+
 DevStack Documentation
 ======================
 

From a6dfe8199831019a53c937aa7f1f85549bb268e7 Mon Sep 17 00:00:00 2001
From: JordanP <jordan.pittier@scality.com>
Date: Thu, 20 Nov 2014 18:06:23 +0100
Subject: [PATCH 0116/3333] Remove unused and deprecated SWIFT_CONFIG_DIR
 variable

Change-Id: Id9b9f2300288b98e4952ef8da6732232a683338d
---
 doc/source/guides/multinode-lab.rst | 2 +-
 lib/swift                           | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 44601d8713..ff81c93975 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -275,7 +275,7 @@ simple as enabling the ``swift`` service in ``local.conf``:
 Swift will put its data files in ``SWIFT_DATA_DIR`` (default
 ``/opt/stack/data/swift``). The size of the data 'partition' created
 (really a loop-mounted file) is set by ``SWIFT_LOOPBACK_DISK_SIZE``. The
-Swift config files are located in ``SWIFT_CONFIG_DIR`` (default
+Swift config files are located in ``SWIFT_CONF_DIR`` (default
 ``/etc/swift``). All of these settings can be overridden in (wait for
 it...) ``local.conf``.
 
diff --git a/lib/swift b/lib/swift
index ae0874ebdf..9e61331404 100644
--- a/lib/swift
+++ b/lib/swift
@@ -54,8 +54,7 @@ SWIFT_DISK_IMAGE=${SWIFT_DATA_DIR}/drives/images/swift.img
 
 # Set ``SWIFT_CONF_DIR`` to the location of the configuration files.
 # Default is ``/etc/swift``.
-# TODO(dtroyer): remove SWIFT_CONFIG_DIR after cutting stable/grizzly
-SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-${SWIFT_CONFIG_DIR:-/etc/swift}}
+SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-/etc/swift}
 
 if is_service_enabled s-proxy && is_service_enabled swift3; then
     # If we are using swift3, we can default the s3 port to swift instead

From 86b65dd77b14a757b1bdbec2b6ae6b4900a88bed Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 20 Nov 2014 17:23:04 -0500
Subject: [PATCH 0117/3333] fix tempest-lib setup

The setup should have been with setup_dev_lib, which looks up the path
from GITDIR. This should let tempest-lib src jobs function.

Change-Id: Ia160708c089adce469d878030196b6fed8acc92d
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d3fb9fb2dc..6bcfaec84b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -450,7 +450,7 @@ function create_tempest_accounts {
 function install_tempest_lib {
     if use_library_from_git "tempest-lib"; then
         git_clone_by_name "tempest-lib"
-        setup_develop "tempest-lib"
+        setup_dev_lib "tempest-lib"
     fi
 }
 

From a1ffcfab478888ac4b0953c51e6d92f586d31d42 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Thu, 20 Nov 2014 16:42:32 -0800
Subject: [PATCH 0118/3333] Set libvirt live_migration_uri

Sets up n-cpu to migrate domains via SSH.  By default, hosts attempt
to connect to each other as root, so this specifies STACK_USER instead.

Change-Id: Ic6e868091c89a2cc6b2f0fada3f7e95002aaff8b
---
 lib/nova_plugins/hypervisor-libvirt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 259bf15a27..53dbfb976f 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -42,6 +42,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
     iniset $NOVA_CONF libvirt cpu_mode "none"
     iniset $NOVA_CONF libvirt use_usb_tablet "False"
+    iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
     iniset $NOVA_CONF DEFAULT default_ephemeral_format "ext4"
     iniset $NOVA_CONF DEFAULT compute_driver "libvirt.LibvirtDriver"
     LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}

From 98a0ad44722182453a74872c93c904d35bcac708 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Fri, 21 Nov 2014 10:42:18 +0900
Subject: [PATCH 0119/3333] ovs_base: Fix debug-agent config for
 Q_USE_PROVIDERNET_FOR_PUBLIC=True

Set up external_network_bridge correctly for the case
of Q_USE_PROVIDERNET_FOR_PUBLIC=True.

This is an oversight in commit 6a633fd024347aade777ecd6545fa3efde5a959c.

Closes-Bug: #1394826
Change-Id: I33f0fe15bafb7071d8a09899d636471f49031606
---
 lib/neutron_plugins/ovs_base | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index f0ef194569..07aa7cca9b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -60,7 +60,11 @@ function _neutron_ovs_base_install_agent_packages {
 }
 
 function _neutron_ovs_base_configure_debug_command {
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
+    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
+        iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge ""
+    else
+        iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
+    fi
 }
 
 function _neutron_ovs_base_configure_firewall_driver {

From 90c20209088eca3dcf830856a3a3118367dbc09f Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Mon, 17 Nov 2014 01:16:22 -0500
Subject: [PATCH 0120/3333] Configure boto.cfg in tempest to point to SSL
 bundle

The boto client uses the ca_certificate_files value in the
Boto section of /etc/boto.cfg when making an SSL client
connection. Configure that to be the devstack SSL CA bundle
so the boto tests will pass when running against an SSL or
TLS-proxy configured devstack environment.

Change-Id: I55ae6d6e0c5b3adb4370ec93f40ae1cd47741457
---
 lib/tempest | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 8931300b98..ec045a9a4f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -63,6 +63,7 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 
 
 BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
+BOTO_CONF=$TEMPEST_DIR/boto.cfg
 
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}
@@ -424,6 +425,12 @@ function configure_tempest {
         fi
     done
 
+    if is_ssl_enabled_service "keystone" || is_service_enabled tls-proxy; then
+        # Use the BOTO_CONFIG environment variable to point to this file
+        iniset $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
+        sudo chown $STACK_USER $BOTO_CONF
+    fi
+
     # Restore IFS
     IFS=$ifs
 }

From af14029553a3aaeb3edaf49568b175c47f88fbc0 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 20 Nov 2014 21:13:15 -0600
Subject: [PATCH 0121/3333] Rework the old logo

* Re-work the old banner logo for the Sphinx docs
* Remove the remaining leftover assets from the old web site

So this is one possibility, I retained the other logo files so we have
options to play with.

Change-Id: Iac15899780072450dc30600a719283c0e2b0c0ae
---
 doc/source/assets/css/bootstrap.css      |  616 --------
 doc/source/assets/css/local.css          |  122 --
 doc/source/assets/images/header_bg.png   |  Bin 1014 -> 0 bytes
 doc/source/assets/images/logo-blue.png   |  Bin 0 -> 10568 bytes
 doc/source/assets/images/logo-blue.xcf   |  Bin 0 -> 33947 bytes
 doc/source/assets/images/quickstart.png  |  Bin 9491 -> 0 bytes
 doc/source/assets/js/bootstrap.js        | 1722 ----------------------
 doc/source/assets/js/bootstrap.min.js    |    1 -
 doc/source/assets/js/jquery-1.7.1.min.js |    4 -
 doc/source/index.rst                     |    2 +
 10 files changed, 2 insertions(+), 2465 deletions(-)
 delete mode 100644 doc/source/assets/css/bootstrap.css
 delete mode 100644 doc/source/assets/css/local.css
 delete mode 100644 doc/source/assets/images/header_bg.png
 create mode 100644 doc/source/assets/images/logo-blue.png
 create mode 100644 doc/source/assets/images/logo-blue.xcf
 delete mode 100644 doc/source/assets/images/quickstart.png
 delete mode 100644 doc/source/assets/js/bootstrap.js
 delete mode 100644 doc/source/assets/js/bootstrap.min.js
 delete mode 100644 doc/source/assets/js/jquery-1.7.1.min.js

diff --git a/doc/source/assets/css/bootstrap.css b/doc/source/assets/css/bootstrap.css
deleted file mode 100644
index 5fd10bcceb..0000000000
--- a/doc/source/assets/css/bootstrap.css
+++ /dev/null
@@ -1,616 +0,0 @@
-article,aside,details,figcaption,figure,footer,header,hgroup,nav,section{display:block;}
-audio,canvas,video{display:inline-block;*display:inline;*zoom:1;}
-audio:not([controls]){display:none;}
-html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;}
-a:focus{outline:thin dotted;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px;}
-a:hover,a:active{outline:0;}
-sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline;}
-sup{top:-0.5em;}
-sub{bottom:-0.25em;}
-img{max-width:100%;height:auto;border:0;-ms-interpolation-mode:bicubic;}
-button,input,select,textarea{margin:0;font-size:100%;vertical-align:middle;}
-button,input{*overflow:visible;line-height:normal;}
-button::-moz-focus-inner,input::-moz-focus-inner{padding:0;border:0;}
-button,input[type="button"],input[type="reset"],input[type="submit"]{cursor:pointer;-webkit-appearance:button;}
-input[type="search"]{-webkit-appearance:textfield;-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;}
-input[type="search"]::-webkit-search-decoration,input[type="search"]::-webkit-search-cancel-button{-webkit-appearance:none;}
-textarea{overflow:auto;vertical-align:top;}
-body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;line-height:18px;color:#333333;background-color:#ffffff;}
-a{color:#0088cc;text-decoration:none;}
-a:hover{color:#005580;text-decoration:underline;}
-.row{margin-left:-20px;*zoom:1;}.row:before,.row:after{display:table;content:"";}
-.row:after{clear:both;}
-[class*="span"]{float:left;margin-left:20px;}
-.span1{width:60px;}
-.span2{width:140px;}
-.span3{width:220px;}
-.span4{width:300px;}
-.span5{width:380px;}
-.span6{width:460px;}
-.span7{width:540px;}
-.span8{width:620px;}
-.span9{width:700px;}
-.span10{width:780px;}
-.span11{width:860px;}
-.span12,.container{width:940px;}
-.offset1{margin-left:100px;}
-.offset2{margin-left:180px;}
-.offset3{margin-left:260px;}
-.offset4{margin-left:340px;}
-.offset5{margin-left:420px;}
-.offset6{margin-left:500px;}
-.offset7{margin-left:580px;}
-.offset8{margin-left:660px;}
-.offset9{margin-left:740px;}
-.offset10{margin-left:820px;}
-.offset11{margin-left:900px;}
-.row-fluid{width:100%;*zoom:1;}.row-fluid:before,.row-fluid:after{display:table;content:"";}
-.row-fluid:after{clear:both;}
-.row-fluid>[class*="span"]{float:left;margin-left:2.127659574%;}
-.row-fluid>[class*="span"]:first-child{margin-left:0;}
-.row-fluid .span1{width:6.382978723%;}
-.row-fluid .span2{width:14.89361702%;}
-.row-fluid .span3{width:23.404255317%;}
-.row-fluid .span4{width:31.914893614%;}
-.row-fluid .span5{width:40.425531911%;}
-.row-fluid .span6{width:48.93617020799999%;}
-.row-fluid .span7{width:57.446808505%;}
-.row-fluid .span8{width:65.95744680199999%;}
-.row-fluid .span9{width:74.468085099%;}
-.row-fluid .span10{width:82.97872339599999%;}
-.row-fluid .span11{width:91.489361693%;}
-.row-fluid .span12{width:99.99999998999999%;}
-.container{width:940px;margin-left:auto;margin-right:auto;*zoom:1;}.container:before,.container:after{display:table;content:"";}
-.container:after{clear:both;}
-.container-fluid{padding-left:20px;padding-right:20px;*zoom:1;}.container-fluid:before,.container-fluid:after{display:table;content:"";}
-.container-fluid:after{clear:both;}
-p{margin:0 0 9px;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;line-height:18px;}p small{font-size:11px;color:#999999;}
-.lead{margin-bottom:18px;font-size:20px;font-weight:200;line-height:27px;}
-h1,h2,h3,h4,h5,h6{margin:0;font-weight:bold;color:#333333;text-rendering:optimizelegibility;}h1 small,h2 small,h3 small,h4 small,h5 small,h6 small{font-weight:normal;color:#999999;}
-h1{font-size:30px;line-height:36px;}h1 small{font-size:18px;}
-h2{font-size:24px;line-height:36px;}h2 small{font-size:18px;}
-h3{line-height:27px;font-size:18px;}h3 small{font-size:14px;}
-h4,h5,h6{line-height:18px;}
-h4{font-size:14px;}h4 small{font-size:12px;}
-h5{font-size:12px;}
-h6{font-size:11px;color:#999999;text-transform:uppercase;}
-.page-header{padding-bottom:17px;margin:18px 0;border-bottom:1px solid #eeeeee;}
-.page-header h1{line-height:1;}
-ul,ol{padding:0;margin:0 0 9px 25px;}
-ul ul,ul ol,ol ol,ol ul{margin-bottom:0;}
-ul{list-style:disc;}
-ol{list-style:decimal;}
-li{line-height:18px;}
-ul.unstyled{margin-left:0;list-style:none;}
-dl{margin-bottom:18px;}
-dt,dd{line-height:18px;}
-dt{font-weight:bold;}
-dd{margin-left:9px;}
-hr{margin:18px 0;border:0;border-top:1px solid #e5e5e5;border-bottom:1px solid #ffffff;}
-strong{font-weight:bold;}
-em{font-style:italic;}
-.muted{color:#999999;}
-abbr{font-size:90%;text-transform:uppercase;border-bottom:1px dotted #ddd;cursor:help;}
-blockquote{padding:0 0 0 15px;margin:0 0 18px;border-left:5px solid #eeeeee;}blockquote p{margin-bottom:0;font-size:16px;font-weight:300;line-height:22.5px;}
-blockquote small{display:block;line-height:18px;color:#999999;}blockquote small:before{content:'\2014 \00A0';}
-blockquote.pull-right{float:right;padding-left:0;padding-right:15px;border-left:0;border-right:5px solid #eeeeee;}blockquote.pull-right p,blockquote.pull-right small{text-align:right;}
-q:before,q:after,blockquote:before,blockquote:after{content:"";}
-address{display:block;margin-bottom:18px;line-height:18px;font-style:normal;}
-small{font-size:100%;}
-cite{font-style:normal;}
-code,pre{padding:0 3px 2px;font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;color:#333333;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;}
-code{padding:3px 4px;color:#d14;background-color:#f7f7f9;border:1px solid #e1e1e8;}
-pre{display:block;padding:8.5px;margin:0 0 9px;font-size:12px;line-height:18px;background-color:#f5f5f5;border:1px solid #ccc;border:1px solid rgba(0, 0, 0, 0.15);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;white-space:pre;white-space:pre-wrap;word-break:break-all;}pre.prettyprint{margin-bottom:18px;}
-pre code{padding:0;background-color:transparent;}
-form{margin:0 0 18px;}
-fieldset{padding:0;margin:0;border:0;}
-legend{display:block;width:100%;padding:0;margin-bottom:27px;font-size:19.5px;line-height:36px;color:#333333;border:0;border-bottom:1px solid #eee;}
-label,input,button,select,textarea{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;font-weight:normal;line-height:18px;}
-label{display:block;margin-bottom:5px;color:#333333;}
-input,textarea,select,.uneditable-input{display:inline-block;width:210px;height:18px;padding:4px;margin-bottom:9px;font-size:13px;line-height:18px;color:#555555;border:1px solid #ccc;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;}
-.uneditable-textarea{width:auto;height:auto;}
-label input,label textarea,label select{display:block;}
-input[type="image"],input[type="checkbox"],input[type="radio"]{width:auto;height:auto;padding:0;margin:3px 0;*margin-top:0;line-height:normal;border:0;cursor:pointer;border-radius:0 \0/;}
-input[type="file"]{padding:initial;line-height:initial;border:initial;background-color:#ffffff;background-color:initial;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;}
-input[type="button"],input[type="reset"],input[type="submit"]{width:auto;height:auto;}
-select,input[type="file"]{height:28px;*margin-top:4px;line-height:28px;}
-select{width:220px;background-color:#ffffff;}
-select[multiple],select[size]{height:auto;}
-input[type="image"]{-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;}
-textarea{height:auto;}
-input[type="hidden"]{display:none;}
-.radio,.checkbox{padding-left:18px;}
-.radio input[type="radio"],.checkbox input[type="checkbox"]{float:left;margin-left:-18px;}
-.controls>.radio:first-child,.controls>.checkbox:first-child{padding-top:5px;}
-.radio.inline,.checkbox.inline{display:inline-block;margin-bottom:0;vertical-align:middle;}
-.radio.inline+.radio.inline,.checkbox.inline+.checkbox.inline{margin-left:10px;}
-.controls>.radio.inline:first-child,.controls>.checkbox.inline:first-child{padding-top:0;}
-input,textarea{-webkit-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-moz-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-webkit-transition:border linear 0.2s,box-shadow linear 0.2s;-moz-transition:border linear 0.2s,box-shadow linear 0.2s;-ms-transition:border linear 0.2s,box-shadow linear 0.2s;-o-transition:border linear 0.2s,box-shadow linear 0.2s;transition:border linear 0.2s,box-shadow linear 0.2s;}
-input:focus,textarea:focus{border-color:rgba(82, 168, 236, 0.8);-webkit-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075),0 0 8px rgba(82, 168, 236, 0.6);-moz-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075),0 0 8px rgba(82, 168, 236, 0.6);box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075),0 0 8px rgba(82, 168, 236, 0.6);outline:0;outline:thin dotted \9;}
-input[type="file"]:focus,input[type="checkbox"]:focus,select:focus{-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;outline:thin dotted;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px;}
-.input-mini{width:60px;}
-.input-small{width:90px;}
-.input-medium{width:150px;}
-.input-large{width:210px;}
-.input-xlarge{width:270px;}
-.input-xxlarge{width:530px;}
-input[class*="span"],select[class*="span"],textarea[class*="span"],.uneditable-input{float:none;margin-left:0;}
-input.span1,textarea.span1,.uneditable-input.span1{width:50px;}
-input.span2,textarea.span2,.uneditable-input.span2{width:130px;}
-input.span3,textarea.span3,.uneditable-input.span3{width:210px;}
-input.span4,textarea.span4,.uneditable-input.span4{width:290px;}
-input.span5,textarea.span5,.uneditable-input.span5{width:370px;}
-input.span6,textarea.span6,.uneditable-input.span6{width:450px;}
-input.span7,textarea.span7,.uneditable-input.span7{width:530px;}
-input.span8,textarea.span8,.uneditable-input.span8{width:610px;}
-input.span9,textarea.span9,.uneditable-input.span9{width:690px;}
-input.span10,textarea.span10,.uneditable-input.span10{width:770px;}
-input.span11,textarea.span11,.uneditable-input.span11{width:850px;}
-input.span12,textarea.span12,.uneditable-input.span12{width:930px;}
-input[disabled],select[disabled],textarea[disabled],input[readonly],select[readonly],textarea[readonly]{background-color:#f5f5f5;border-color:#ddd;cursor:not-allowed;}
-.control-group.warning>label,.control-group.warning .help-block,.control-group.warning .help-inline{color:#c09853;}
-.control-group.warning input,.control-group.warning select,.control-group.warning textarea{color:#c09853;border-color:#c09853;}.control-group.warning input:focus,.control-group.warning select:focus,.control-group.warning textarea:focus{border-color:#a47e3c;-webkit-box-shadow:0 0 6px #dbc59e;-moz-box-shadow:0 0 6px #dbc59e;box-shadow:0 0 6px #dbc59e;}
-.control-group.warning .input-prepend .add-on,.control-group.warning .input-append .add-on{color:#c09853;background-color:#fcf8e3;border-color:#c09853;}
-.control-group.error>label,.control-group.error .help-block,.control-group.error .help-inline{color:#b94a48;}
-.control-group.error input,.control-group.error select,.control-group.error textarea{color:#b94a48;border-color:#b94a48;}.control-group.error input:focus,.control-group.error select:focus,.control-group.error textarea:focus{border-color:#953b39;-webkit-box-shadow:0 0 6px #d59392;-moz-box-shadow:0 0 6px #d59392;box-shadow:0 0 6px #d59392;}
-.control-group.error .input-prepend .add-on,.control-group.error .input-append .add-on{color:#b94a48;background-color:#f2dede;border-color:#b94a48;}
-.control-group.success>label,.control-group.success .help-block,.control-group.success .help-inline{color:#468847;}
-.control-group.success input,.control-group.success select,.control-group.success textarea{color:#468847;border-color:#468847;}.control-group.success input:focus,.control-group.success select:focus,.control-group.success textarea:focus{border-color:#356635;-webkit-box-shadow:0 0 6px #7aba7b;-moz-box-shadow:0 0 6px #7aba7b;box-shadow:0 0 6px #7aba7b;}
-.control-group.success .input-prepend .add-on,.control-group.success .input-append .add-on{color:#468847;background-color:#dff0d8;border-color:#468847;}
-input:focus:required:invalid,textarea:focus:required:invalid,select:focus:required:invalid{color:#b94a48;border-color:#ee5f5b;}input:focus:required:invalid:focus,textarea:focus:required:invalid:focus,select:focus:required:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7;}
-.form-actions{padding:17px 20px 18px;margin-top:18px;margin-bottom:18px;background-color:#f5f5f5;border-top:1px solid #ddd;}
-.uneditable-input{display:block;background-color:#ffffff;border-color:#eee;-webkit-box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.025);-moz-box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.025);box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.025);cursor:not-allowed;}
-:-moz-placeholder{color:#999999;}
-::-webkit-input-placeholder{color:#999999;}
-.help-block{margin-top:5px;margin-bottom:0;color:#999999;}
-.help-inline{display:inline-block;*display:inline;*zoom:1;margin-bottom:9px;vertical-align:middle;padding-left:5px;}
-.input-prepend,.input-append{margin-bottom:5px;*zoom:1;}.input-prepend:before,.input-append:before,.input-prepend:after,.input-append:after{display:table;content:"";}
-.input-prepend:after,.input-append:after{clear:both;}
-.input-prepend input,.input-append input,.input-prepend .uneditable-input,.input-append .uneditable-input{-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0;}.input-prepend input:focus,.input-append input:focus,.input-prepend .uneditable-input:focus,.input-append .uneditable-input:focus{position:relative;z-index:2;}
-.input-prepend .uneditable-input,.input-append .uneditable-input{border-left-color:#ccc;}
-.input-prepend .add-on,.input-append .add-on{float:left;display:block;width:auto;min-width:16px;height:18px;margin-right:-1px;padding:4px 5px;font-weight:normal;line-height:18px;color:#999999;text-align:center;text-shadow:0 1px 0 #ffffff;background-color:#f5f5f5;border:1px solid #ccc;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px;}
-.input-prepend .active,.input-append .active{background-color:#a9dba9;border-color:#46a546;}
-.input-prepend .add-on{*margin-top:1px;}
-.input-append input,.input-append .uneditable-input{float:left;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px;}
-.input-append .uneditable-input{border-right-color:#ccc;}
-.input-append .add-on{margin-right:0;margin-left:-1px;-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0;}
-.input-append input:first-child{*margin-left:-160px;}.input-append input:first-child+.add-on{*margin-left:-21px;}
-.search-query{padding-left:14px;padding-right:14px;margin-bottom:0;-webkit-border-radius:14px;-moz-border-radius:14px;border-radius:14px;}
-.form-search input,.form-inline input,.form-horizontal input,.form-search textarea,.form-inline textarea,.form-horizontal textarea,.form-search select,.form-inline select,.form-horizontal select,.form-search .help-inline,.form-inline .help-inline,.form-horizontal .help-inline,.form-search .uneditable-input,.form-inline .uneditable-input,.form-horizontal .uneditable-input{display:inline-block;margin-bottom:0;}
-.form-search label,.form-inline label,.form-search .input-append,.form-inline .input-append,.form-search .input-prepend,.form-inline .input-prepend{display:inline-block;}
-.form-search .input-append .add-on,.form-inline .input-prepend .add-on,.form-search .input-append .add-on,.form-inline .input-prepend .add-on{vertical-align:middle;}
-.control-group{margin-bottom:9px;}
-.form-horizontal legend+.control-group{margin-top:18px;-webkit-margin-top-collapse:separate;}
-.form-horizontal .control-group{margin-bottom:18px;*zoom:1;}.form-horizontal .control-group:before,.form-horizontal .control-group:after{display:table;content:"";}
-.form-horizontal .control-group:after{clear:both;}
-.form-horizontal .control-group>label{float:left;width:140px;padding-top:5px;text-align:right;}
-.form-horizontal .controls{margin-left:160px;}
-.form-horizontal .form-actions{padding-left:160px;}
-table{max-width:100%;border-collapse:collapse;border-spacing:0;}
-.table{width:100%;margin-bottom:18px;}.table th,.table td{padding:8px;line-height:18px;text-align:left;border-top:1px solid #ddd;}
-.table th{font-weight:bold;vertical-align:bottom;}
-.table td{vertical-align:top;}
-.table thead:first-child tr th,.table thead:first-child tr td{border-top:0;}
-.table tbody+tbody{border-top:2px solid #ddd;}
-.table-condensed th,.table-condensed td{padding:4px 5px;}
-.table-bordered{border:1px solid #ddd;border-collapse:separate;*border-collapse:collapsed;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}.table-bordered th+th,.table-bordered td+td,.table-bordered th+td,.table-bordered td+th{border-left:1px solid #ddd;}
-.table-bordered thead:first-child tr:first-child th,.table-bordered tbody:first-child tr:first-child th,.table-bordered tbody:first-child tr:first-child td{border-top:0;}
-.table-bordered thead:first-child tr:first-child th:first-child,.table-bordered tbody:first-child tr:first-child td:first-child{-webkit-border-radius:4px 0 0 0;-moz-border-radius:4px 0 0 0;border-radius:4px 0 0 0;}
-.table-bordered thead:first-child tr:first-child th:last-child,.table-bordered tbody:first-child tr:first-child td:last-child{-webkit-border-radius:0 4px 0 0;-moz-border-radius:0 4px 0 0;border-radius:0 4px 0 0;}
-.table-bordered thead:last-child tr:last-child th:first-child,.table-bordered tbody:last-child tr:last-child td:first-child{-webkit-border-radius:0 0 0 4px;-moz-border-radius:0 0 0 4px;border-radius:0 0 0 4px;}
-.table-bordered thead:last-child tr:last-child th:last-child,.table-bordered tbody:last-child tr:last-child td:last-child{-webkit-border-radius:0 0 4px 0;-moz-border-radius:0 0 4px 0;border-radius:0 0 4px 0;}
-.table-striped tbody tr:nth-child(even) td,.table-striped tbody tr:nth-child(even) th{background-color:#f1f1f1;}
-table .span1{float:none;width:44px;margin-left:0;}
-table .span2{float:none;width:124px;margin-left:0;}
-table .span3{float:none;width:204px;margin-left:0;}
-table .span4{float:none;width:284px;margin-left:0;}
-table .span5{float:none;width:364px;margin-left:0;}
-table .span6{float:none;width:444px;margin-left:0;}
-table .span7{float:none;width:524px;margin-left:0;}
-table .span8{float:none;width:604px;margin-left:0;}
-table .span9{float:none;width:684px;margin-left:0;}
-table .span10{float:none;width:764px;margin-left:0;}
-table .span11{float:none;width:844px;margin-left:0;}
-table .span12{float:none;width:924px;margin-left:0;}
-[class^="icon-"]{display:inline-block;width:14px;height:14px;vertical-align:text-top;background-image:url(../img/glyphicons-halflings.png);background-position:14px 14px;background-repeat:no-repeat;*margin-right:.3em;}[class^="icon-"]:last-child{*margin-left:0;}
-.icon-white{background-image:url(../img/glyphicons-halflings-white.png);}
-.icon-glass{background-position:0 0;}
-.icon-music{background-position:-24px 0;}
-.icon-search{background-position:-48px 0;}
-.icon-envelope{background-position:-72px 0;}
-.icon-heart{background-position:-96px 0;}
-.icon-star{background-position:-120px 0;}
-.icon-star-empty{background-position:-144px 0;}
-.icon-user{background-position:-168px 0;}
-.icon-film{background-position:-192px 0;}
-.icon-th-large{background-position:-216px 0;}
-.icon-th{background-position:-240px 0;}
-.icon-th-list{background-position:-264px 0;}
-.icon-ok{background-position:-288px 0;}
-.icon-remove{background-position:-312px 0;}
-.icon-zoom-in{background-position:-336px 0;}
-.icon-zoom-out{background-position:-360px 0;}
-.icon-off{background-position:-384px 0;}
-.icon-signal{background-position:-408px 0;}
-.icon-cog{background-position:-432px 0;}
-.icon-trash{background-position:-456px 0;}
-.icon-home{background-position:0 -24px;}
-.icon-file{background-position:-24px -24px;}
-.icon-time{background-position:-48px -24px;}
-.icon-road{background-position:-72px -24px;}
-.icon-download-alt{background-position:-96px -24px;}
-.icon-download{background-position:-120px -24px;}
-.icon-upload{background-position:-144px -24px;}
-.icon-inbox{background-position:-168px -24px;}
-.icon-play-circle{background-position:-192px -24px;}
-.icon-repeat{background-position:-216px -24px;}
-.icon-refresh{background-position:-240px -24px;}
-.icon-list-alt{background-position:-264px -24px;}
-.icon-lock{background-position:-287px -24px;}
-.icon-flag{background-position:-312px -24px;}
-.icon-headphones{background-position:-336px -24px;}
-.icon-volume-off{background-position:-360px -24px;}
-.icon-volume-down{background-position:-384px -24px;}
-.icon-volume-up{background-position:-408px -24px;}
-.icon-qrcode{background-position:-432px -24px;}
-.icon-barcode{background-position:-456px -24px;}
-.icon-tag{background-position:0 -48px;}
-.icon-tags{background-position:-25px -48px;}
-.icon-book{background-position:-48px -48px;}
-.icon-bookmark{background-position:-72px -48px;}
-.icon-print{background-position:-96px -48px;}
-.icon-camera{background-position:-120px -48px;}
-.icon-font{background-position:-144px -48px;}
-.icon-bold{background-position:-167px -48px;}
-.icon-italic{background-position:-192px -48px;}
-.icon-text-height{background-position:-216px -48px;}
-.icon-text-width{background-position:-240px -48px;}
-.icon-align-left{background-position:-264px -48px;}
-.icon-align-center{background-position:-288px -48px;}
-.icon-align-right{background-position:-312px -48px;}
-.icon-align-justify{background-position:-336px -48px;}
-.icon-list{background-position:-360px -48px;}
-.icon-indent-left{background-position:-384px -48px;}
-.icon-indent-right{background-position:-408px -48px;}
-.icon-facetime-video{background-position:-432px -48px;}
-.icon-picture{background-position:-456px -48px;}
-.icon-pencil{background-position:0 -72px;}
-.icon-map-marker{background-position:-24px -72px;}
-.icon-adjust{background-position:-48px -72px;}
-.icon-tint{background-position:-72px -72px;}
-.icon-edit{background-position:-96px -72px;}
-.icon-share{background-position:-120px -72px;}
-.icon-check{background-position:-144px -72px;}
-.icon-move{background-position:-168px -72px;}
-.icon-step-backward{background-position:-192px -72px;}
-.icon-fast-backward{background-position:-216px -72px;}
-.icon-backward{background-position:-240px -72px;}
-.icon-play{background-position:-264px -72px;}
-.icon-pause{background-position:-288px -72px;}
-.icon-stop{background-position:-312px -72px;}
-.icon-forward{background-position:-336px -72px;}
-.icon-fast-forward{background-position:-360px -72px;}
-.icon-step-forward{background-position:-384px -72px;}
-.icon-eject{background-position:-408px -72px;}
-.icon-chevron-left{background-position:-432px -72px;}
-.icon-chevron-right{background-position:-456px -72px;}
-.icon-plus-sign{background-position:0 -96px;}
-.icon-minus-sign{background-position:-24px -96px;}
-.icon-remove-sign{background-position:-48px -96px;}
-.icon-ok-sign{background-position:-72px -96px;}
-.icon-question-sign{background-position:-96px -96px;}
-.icon-info-sign{background-position:-120px -96px;}
-.icon-screenshot{background-position:-144px -96px;}
-.icon-remove-circle{background-position:-168px -96px;}
-.icon-ok-circle{background-position:-192px -96px;}
-.icon-ban-circle{background-position:-216px -96px;}
-.icon-arrow-left{background-position:-240px -96px;}
-.icon-arrow-right{background-position:-264px -96px;}
-.icon-arrow-up{background-position:-289px -96px;}
-.icon-arrow-down{background-position:-312px -96px;}
-.icon-share-alt{background-position:-336px -96px;}
-.icon-resize-full{background-position:-360px -96px;}
-.icon-resize-small{background-position:-384px -96px;}
-.icon-plus{background-position:-408px -96px;}
-.icon-minus{background-position:-433px -96px;}
-.icon-asterisk{background-position:-456px -96px;}
-.icon-exclamation-sign{background-position:0 -120px;}
-.icon-gift{background-position:-24px -120px;}
-.icon-leaf{background-position:-48px -120px;}
-.icon-fire{background-position:-72px -120px;}
-.icon-eye-open{background-position:-96px -120px;}
-.icon-eye-close{background-position:-120px -120px;}
-.icon-warning-sign{background-position:-144px -120px;}
-.icon-plane{background-position:-168px -120px;}
-.icon-calendar{background-position:-192px -120px;}
-.icon-random{background-position:-216px -120px;}
-.icon-comment{background-position:-240px -120px;}
-.icon-magnet{background-position:-264px -120px;}
-.icon-chevron-up{background-position:-288px -120px;}
-.icon-chevron-down{background-position:-313px -119px;}
-.icon-retweet{background-position:-336px -120px;}
-.icon-shopping-cart{background-position:-360px -120px;}
-.icon-folder-close{background-position:-384px -120px;}
-.icon-folder-open{background-position:-408px -120px;}
-.icon-resize-vertical{background-position:-432px -119px;}
-.icon-resize-horizontal{background-position:-456px -118px;}
-.dropdown{position:relative;}
-.dropdown-toggle{*margin-bottom:-3px;}
-.dropdown-toggle:active,.open .dropdown-toggle{outline:0;}
-.caret{display:inline-block;width:0;height:0;text-indent:-99999px;*text-indent:0;vertical-align:top;border-left:4px solid transparent;border-right:4px solid transparent;border-top:4px solid #000000;opacity:0.3;filter:alpha(opacity=30);content:"\2193";}
-.dropdown .caret{margin-top:8px;margin-left:2px;}
-.dropdown:hover .caret,.open.dropdown .caret{opacity:1;filter:alpha(opacity=100);}
-.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;float:left;display:none;min-width:160px;max-width:220px;_width:160px;padding:4px 0;margin:0;list-style:none;background-color:#ffffff;border-color:#ccc;border-color:rgba(0, 0, 0, 0.2);border-style:solid;border-width:1px;-webkit-border-radius:0 0 5px 5px;-moz-border-radius:0 0 5px 5px;border-radius:0 0 5px 5px;-webkit-box-shadow:0 5px 10px rgba(0, 0, 0, 0.2);-moz-box-shadow:0 5px 10px rgba(0, 0, 0, 0.2);box-shadow:0 5px 10px rgba(0, 0, 0, 0.2);-webkit-background-clip:padding-box;-moz-background-clip:padding;background-clip:padding-box;*border-right-width:2px;*border-bottom-width:2px;}.dropdown-menu.bottom-up{top:auto;bottom:100%;margin-bottom:2px;}
-.dropdown-menu .divider{height:1px;margin:5px 1px;overflow:hidden;background-color:#e5e5e5;border-bottom:1px solid #ffffff;*width:100%;*margin:-5px 0 5px;}
-.dropdown-menu a{display:block;padding:3px 15px;clear:both;font-weight:normal;line-height:18px;color:#555555;white-space:nowrap;}
-.dropdown-menu li>a:hover,.dropdown-menu .active>a,.dropdown-menu .active>a:hover{color:#ffffff;text-decoration:none;background-color:#0088cc;}
-.dropdown.open{*z-index:1000;}.dropdown.open .dropdown-toggle{color:#ffffff;background:#ccc;background:rgba(0, 0, 0, 0.3);}
-.dropdown.open .dropdown-menu{display:block;}
-.typeahead{margin-top:2px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}
-.well{min-height:20px;padding:19px;margin-bottom:20px;background-color:#f5f5f5;border:1px solid #eee;border:1px solid rgba(0, 0, 0, 0.05);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.05);-moz-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.05);box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.05);}.well blockquote{border-color:#ddd;border-color:rgba(0, 0, 0, 0.15);}
-.fade{-webkit-transition:opacity 0.15s linear;-moz-transition:opacity 0.15s linear;-ms-transition:opacity 0.15s linear;-o-transition:opacity 0.15s linear;transition:opacity 0.15s linear;opacity:0;}.fade.in{opacity:1;}
-.collapse{-webkit-transition:height 0.35s ease;-moz-transition:height 0.35s ease;-ms-transition:height 0.35s ease;-o-transition:height 0.35s ease;transition:height 0.35s ease;position:relative;overflow:hidden;height:0;}.collapse.in{height:auto;}
-.close{float:right;font-size:20px;font-weight:bold;line-height:18px;color:#000000;text-shadow:0 1px 0 #ffffff;opacity:0.2;filter:alpha(opacity=20);}.close:hover{color:#000000;text-decoration:none;opacity:0.4;filter:alpha(opacity=40);cursor:pointer;}
-.btn{display:inline-block;padding:4px 10px 4px;font-size:13px;line-height:18px;color:#333333;text-align:center;text-shadow:0 1px 1px rgba(255, 255, 255, 0.75);background-color:#fafafa;background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#ffffff), color-stop(25%, #ffffff), to(#e6e6e6));background-image:-webkit-linear-gradient(#ffffff, #ffffff 25%, #e6e6e6);background-image:-moz-linear-gradient(top, #ffffff, #ffffff 25%, #e6e6e6);background-image:-ms-linear-gradient(#ffffff, #ffffff 25%, #e6e6e6);background-image:-o-linear-gradient(#ffffff, #ffffff 25%, #e6e6e6);background-image:linear-gradient(#ffffff, #ffffff 25%, #e6e6e6);background-repeat:no-repeat;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#e6e6e6', GradientType=0);border:1px solid #ccc;border-bottom-color:#bbb;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.2),0 1px 2px rgba(0, 0, 0, 0.05);-moz-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.2),0 1px 2px rgba(0, 0, 0, 0.05);box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.2),0 1px 2px rgba(0, 0, 0, 0.05);cursor:pointer;*margin-left:.3em;}.btn:first-child{*margin-left:0;}
-.btn:hover{color:#333333;text-decoration:none;background-color:#e6e6e6;background-position:0 -15px;-webkit-transition:background-position 0.1s linear;-moz-transition:background-position 0.1s linear;-ms-transition:background-position 0.1s linear;-o-transition:background-position 0.1s linear;transition:background-position 0.1s linear;}
-.btn:focus{outline:thin dotted;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px;}
-.btn.active,.btn:active{background-image:none;-webkit-box-shadow:inset 0 2px 4px rgba(0, 0, 0, 0.15),0 1px 2px rgba(0, 0, 0, 0.05);-moz-box-shadow:inset 0 2px 4px rgba(0, 0, 0, 0.15),0 1px 2px rgba(0, 0, 0, 0.05);box-shadow:inset 0 2px 4px rgba(0, 0, 0, 0.15),0 1px 2px rgba(0, 0, 0, 0.05);background-color:#e6e6e6;background-color:#d9d9d9 \9;color:rgba(0, 0, 0, 0.5);outline:0;}
-.btn.disabled,.btn[disabled]{cursor:default;background-image:none;background-color:#e6e6e6;opacity:0.65;filter:alpha(opacity=65);-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;}
-.btn-large{padding:9px 14px;font-size:15px;line-height:normal;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;}
-.btn-large .icon{margin-top:1px;}
-.btn-small{padding:5px 9px;font-size:11px;line-height:16px;}
-.btn-small .icon{margin-top:-1px;}
-.btn-primary,.btn-primary:hover,.btn-warning,.btn-warning:hover,.btn-danger,.btn-danger:hover,.btn-success,.btn-success:hover,.btn-info,.btn-info:hover{text-shadow:0 -1px 0 rgba(0, 0, 0, 0.25);color:#ffffff;}
-.btn-primary.active,.btn-warning.active,.btn-danger.active,.btn-success.active,.btn-info.active{color:rgba(255, 255, 255, 0.75);}
-.btn-primary{background-color:#006dcc;background-image:-moz-linear-gradient(top, #0088cc, #0044cc);background-image:-ms-linear-gradient(top, #0088cc, #0044cc);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#0088cc), to(#0044cc));background-image:-webkit-linear-gradient(top, #0088cc, #0044cc);background-image:-o-linear-gradient(top, #0088cc, #0044cc);background-image:linear-gradient(top, #0088cc, #0044cc);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#0088cc', endColorstr='#0044cc', GradientType=0);border-color:#0044cc #0044cc #002a80;border-color:rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);}.btn-primary:hover,.btn-primary:active,.btn-primary.active,.btn-primary.disabled,.btn-primary[disabled]{background-color:#0044cc;}
-.btn-primary:active,.btn-primary.active{background-color:#003399 \9;}
-.btn-warning{background-color:#faa732;background-image:-moz-linear-gradient(top, #fbb450, #f89406);background-image:-ms-linear-gradient(top, #fbb450, #f89406);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#fbb450), to(#f89406));background-image:-webkit-linear-gradient(top, #fbb450, #f89406);background-image:-o-linear-gradient(top, #fbb450, #f89406);background-image:linear-gradient(top, #fbb450, #f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450', endColorstr='#f89406', GradientType=0);border-color:#f89406 #f89406 #ad6704;border-color:rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);}.btn-warning:hover,.btn-warning:active,.btn-warning.active,.btn-warning.disabled,.btn-warning[disabled]{background-color:#f89406;}
-.btn-warning:active,.btn-warning.active{background-color:#c67605 \9;}
-.btn-danger{background-color:#da4f49;background-image:-moz-linear-gradient(top, #ee5f5b, #bd362f);background-image:-ms-linear-gradient(top, #ee5f5b, #bd362f);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#ee5f5b), to(#bd362f));background-image:-webkit-linear-gradient(top, #ee5f5b, #bd362f);background-image:-o-linear-gradient(top, #ee5f5b, #bd362f);background-image:linear-gradient(top, #ee5f5b, #bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b', endColorstr='#bd362f', GradientType=0);border-color:#bd362f #bd362f #802420;border-color:rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);}.btn-danger:hover,.btn-danger:active,.btn-danger.active,.btn-danger.disabled,.btn-danger[disabled]{background-color:#bd362f;}
-.btn-danger:active,.btn-danger.active{background-color:#942a25 \9;}
-.btn-success{background-color:#5bb75b;background-image:-moz-linear-gradient(top, #62c462, #51a351);background-image:-ms-linear-gradient(top, #62c462, #51a351);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#62c462), to(#51a351));background-image:-webkit-linear-gradient(top, #62c462, #51a351);background-image:-o-linear-gradient(top, #62c462, #51a351);background-image:linear-gradient(top, #62c462, #51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462', endColorstr='#51a351', GradientType=0);border-color:#51a351 #51a351 #387038;border-color:rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);}.btn-success:hover,.btn-success:active,.btn-success.active,.btn-success.disabled,.btn-success[disabled]{background-color:#51a351;}
-.btn-success:active,.btn-success.active{background-color:#408140 \9;}
-.btn-info{background-color:#49afcd;background-image:-moz-linear-gradient(top, #5bc0de, #2f96b4);background-image:-ms-linear-gradient(top, #5bc0de, #2f96b4);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#5bc0de), to(#2f96b4));background-image:-webkit-linear-gradient(top, #5bc0de, #2f96b4);background-image:-o-linear-gradient(top, #5bc0de, #2f96b4);background-image:linear-gradient(top, #5bc0de, #2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de', endColorstr='#2f96b4', GradientType=0);border-color:#2f96b4 #2f96b4 #1f6377;border-color:rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);}.btn-info:hover,.btn-info:active,.btn-info.active,.btn-info.disabled,.btn-info[disabled]{background-color:#2f96b4;}
-.btn-info:active,.btn-info.active{background-color:#24748c \9;}
-button.btn,input[type="submit"].btn{*padding-top:2px;*padding-bottom:2px;}button.btn::-moz-focus-inner,input[type="submit"].btn::-moz-focus-inner{padding:0;border:0;}
-button.btn.large,input[type="submit"].btn.large{*padding-top:7px;*padding-bottom:7px;}
-button.btn.small,input[type="submit"].btn.small{*padding-top:3px;*padding-bottom:3px;}
-.btn-group{position:relative;*zoom:1;*margin-left:.3em;}.btn-group:before,.btn-group:after{display:table;content:"";}
-.btn-group:after{clear:both;}
-.btn-group:first-child{*margin-left:0;}
-.btn-group+.btn-group{margin-left:5px;}
-.btn-toolbar{margin-top:9px;margin-bottom:9px;}.btn-toolbar .btn-group{display:inline-block;*display:inline;*zoom:1;}
-.btn-group .btn{position:relative;float:left;margin-left:-1px;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;}
-.btn-group .btn:first-child{margin-left:0;-webkit-border-top-left-radius:4px;-moz-border-radius-topleft:4px;border-top-left-radius:4px;-webkit-border-bottom-left-radius:4px;-moz-border-radius-bottomleft:4px;border-bottom-left-radius:4px;}
-.btn-group .btn:last-child,.btn-group .dropdown-toggle{-webkit-border-top-right-radius:4px;-moz-border-radius-topright:4px;border-top-right-radius:4px;-webkit-border-bottom-right-radius:4px;-moz-border-radius-bottomright:4px;border-bottom-right-radius:4px;}
-.btn-group .btn.large:first-child{margin-left:0;-webkit-border-top-left-radius:6px;-moz-border-radius-topleft:6px;border-top-left-radius:6px;-webkit-border-bottom-left-radius:6px;-moz-border-radius-bottomleft:6px;border-bottom-left-radius:6px;}
-.btn-group .btn.large:last-child,.btn-group .large.dropdown-toggle{-webkit-border-top-right-radius:6px;-moz-border-radius-topright:6px;border-top-right-radius:6px;-webkit-border-bottom-right-radius:6px;-moz-border-radius-bottomright:6px;border-bottom-right-radius:6px;}
-.btn-group .btn:hover,.btn-group .btn:focus,.btn-group .btn:active,.btn-group .btn.active{z-index:2;}
-.btn-group .dropdown-toggle:active,.btn-group.open .dropdown-toggle{outline:0;}
-.btn-group .dropdown-toggle{padding-left:8px;padding-right:8px;-webkit-box-shadow:inset 1px 0 0 rgba(255, 255, 255, 0.125),inset 0 1px 0 rgba(255, 255, 255, 0.2),0 1px 2px rgba(0, 0, 0, 0.05);-moz-box-shadow:inset 1px 0 0 rgba(255, 255, 255, 0.125),inset 0 1px 0 rgba(255, 255, 255, 0.2),0 1px 2px rgba(0, 0, 0, 0.05);box-shadow:inset 1px 0 0 rgba(255, 255, 255, 0.125),inset 0 1px 0 rgba(255, 255, 255, 0.2),0 1px 2px rgba(0, 0, 0, 0.05);*padding-top:5px;*padding-bottom:5px;}
-.btn-group.open{*z-index:1000;}.btn-group.open .dropdown-menu{display:block;margin-top:1px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;}
-.btn-group.open .dropdown-toggle{background-image:none;-webkit-box-shadow:inset 0 1px 6px rgba(0, 0, 0, 0.15),0 1px 2px rgba(0, 0, 0, 0.05);-moz-box-shadow:inset 0 1px 6px rgba(0, 0, 0, 0.15),0 1px 2px rgba(0, 0, 0, 0.05);box-shadow:inset 0 1px 6px rgba(0, 0, 0, 0.15),0 1px 2px rgba(0, 0, 0, 0.05);}
-.btn .caret{margin-top:7px;margin-left:0;}
-.btn:hover .caret,.open.btn-group .caret{opacity:1;filter:alpha(opacity=100);}
-.btn-primary .caret,.btn-danger .caret,.btn-info .caret,.btn-success .caret{border-top-color:#ffffff;opacity:0.75;filter:alpha(opacity=75);}
-.btn-small .caret{margin-top:4px;}
-.alert{padding:8px 35px 8px 14px;margin-bottom:18px;text-shadow:0 1px 0 rgba(255, 255, 255, 0.5);background-color:#fcf8e3;border:1px solid #fbeed5;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}
-.alert,.alert-heading{color:#c09853;}
-.alert .close{position:relative;top:-2px;right:-21px;line-height:18px;}
-.alert-success{background-color:#dff0d8;border-color:#d6e9c6;}
-.alert-success,.alert-success .alert-heading{color:#468847;}
-.alert-danger,.alert-error{background-color:#f2dede;border-color:#eed3d7;}
-.alert-danger,.alert-error,.alert-danger .alert-heading,.alert-error .alert-heading{color:#b94a48;}
-.alert-info{background-color:#d9edf7;border-color:#bce8f1;}
-.alert-info,.alert-info .alert-heading{color:#3a87ad;}
-.alert-block{padding-top:14px;padding-bottom:14px;}
-.alert-block>p,.alert-block>ul{margin-bottom:0;}
-.alert-block p+p{margin-top:5px;}
-.nav{margin-left:0;margin-bottom:18px;list-style:none;}
-.nav>li>a{display:block;}
-.nav>li>a:hover{text-decoration:none;background-color:#eeeeee;}
-.nav-list{padding-left:14px;padding-right:14px;margin-bottom:0;}
-.nav-list>li>a,.nav-list .nav-header{display:block;padding:3px 15px;margin-left:-15px;margin-right:-15px;text-shadow:0 1px 0 rgba(255, 255, 255, 0.5);}
-.nav-list .nav-header{font-size:11px;font-weight:bold;line-height:18px;color:#999999;text-transform:uppercase;}
-.nav-list>li+.nav-header{margin-top:9px;}
-.nav-list .active>a{color:#ffffff;text-shadow:0 -1px 0 rgba(0, 0, 0, 0.2);background-color:#0088cc;}
-.nav-list .icon{margin-right:2px;}
-.nav-tabs,.nav-pills{*zoom:1;}.nav-tabs:before,.nav-pills:before,.nav-tabs:after,.nav-pills:after{display:table;content:"";}
-.nav-tabs:after,.nav-pills:after{clear:both;}
-.nav-tabs>li,.nav-pills>li{float:left;}
-.nav-tabs>li>a,.nav-pills>li>a{padding-right:12px;padding-left:12px;margin-right:2px;line-height:14px;}
-.nav-tabs{border-bottom:1px solid #ddd;}
-.nav-tabs>li{margin-bottom:-1px;}
-.nav-tabs>li>a{padding-top:9px;padding-bottom:9px;border:1px solid transparent;-webkit-border-radius:4px 4px 0 0;-moz-border-radius:4px 4px 0 0;border-radius:4px 4px 0 0;}.nav-tabs>li>a:hover{border-color:#eeeeee #eeeeee #dddddd;}
-.nav-tabs>.active>a,.nav-tabs>.active>a:hover{color:#555555;background-color:#ffffff;border:1px solid #ddd;border-bottom-color:transparent;cursor:default;}
-.nav-pills>li>a{padding-top:8px;padding-bottom:8px;margin-top:2px;margin-bottom:2px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;}
-.nav-pills .active>a,.nav-pills .active>a:hover{color:#ffffff;background-color:#0088cc;}
-.nav-stacked>li{float:none;}
-.nav-stacked>li>a{margin-right:0;}
-.nav-tabs.nav-stacked{border-bottom:0;}
-.nav-tabs.nav-stacked>li>a{border:1px solid #ddd;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;}
-.nav-tabs.nav-stacked>li:first-child>a{-webkit-border-radius:4px 4px 0 0;-moz-border-radius:4px 4px 0 0;border-radius:4px 4px 0 0;}
-.nav-tabs.nav-stacked>li:last-child>a{-webkit-border-radius:0 0 4px 4px;-moz-border-radius:0 0 4px 4px;border-radius:0 0 4px 4px;}
-.nav-tabs.nav-stacked>li>a:hover{border-color:#ddd;z-index:2;}
-.nav-pills.nav-stacked>li>a{margin-bottom:3px;}
-.nav-pills.nav-stacked>li:last-child>a{margin-bottom:1px;}
-.nav-tabs .dropdown-menu,.nav-pills .dropdown-menu{margin-top:1px;border-width:1px;}
-.nav-pills .dropdown-menu{-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}
-.nav-tabs .dropdown-toggle .caret,.nav-pills .dropdown-toggle .caret{border-top-color:#0088cc;margin-top:6px;}
-.nav-tabs .dropdown-toggle:hover .caret,.nav-pills .dropdown-toggle:hover .caret{border-top-color:#005580;}
-.nav-tabs .active .dropdown-toggle .caret,.nav-pills .active .dropdown-toggle .caret{border-top-color:#333333;}
-.nav>.dropdown.active>a:hover{color:#000000;cursor:pointer;}
-.nav-tabs .open .dropdown-toggle,.nav-pills .open .dropdown-toggle,.nav>.open.active>a:hover{color:#ffffff;background-color:#999999;border-color:#999999;}
-.nav .open .caret,.nav .open.active .caret,.nav .open a:hover .caret{border-top-color:#ffffff;opacity:1;filter:alpha(opacity=100);}
-.tabs-stacked .open>a:hover{border-color:#999999;}
-.tabbable{*zoom:1;}.tabbable:before,.tabbable:after{display:table;content:"";}
-.tabbable:after{clear:both;}
-.tabs-below .nav-tabs,.tabs-right .nav-tabs,.tabs-left .nav-tabs{border-bottom:0;}
-.tab-content>.tab-pane,.pill-content>.pill-pane{display:none;}
-.tab-content>.active,.pill-content>.active{display:block;}
-.tabs-below .nav-tabs{border-top:1px solid #ddd;}
-.tabs-below .nav-tabs>li{margin-top:-1px;margin-bottom:0;}
-.tabs-below .nav-tabs>li>a{-webkit-border-radius:0 0 4px 4px;-moz-border-radius:0 0 4px 4px;border-radius:0 0 4px 4px;}.tabs-below .nav-tabs>li>a:hover{border-bottom-color:transparent;border-top-color:#ddd;}
-.tabs-below .nav-tabs .active>a,.tabs-below .nav-tabs .active>a:hover{border-color:transparent #ddd #ddd #ddd;}
-.tabs-left .nav-tabs>li,.tabs-right .nav-tabs>li{float:none;}
-.tabs-left .nav-tabs>li>a,.tabs-right .nav-tabs>li>a{min-width:74px;margin-right:0;margin-bottom:3px;}
-.tabs-left .nav-tabs{float:left;margin-right:19px;border-right:1px solid #ddd;}
-.tabs-left .nav-tabs>li>a{margin-right:-1px;-webkit-border-radius:4px 0 0 4px;-moz-border-radius:4px 0 0 4px;border-radius:4px 0 0 4px;}
-.tabs-left .nav-tabs>li>a:hover{border-color:#eeeeee #dddddd #eeeeee #eeeeee;}
-.tabs-left .nav-tabs .active>a,.tabs-left .nav-tabs .active>a:hover{border-color:#ddd transparent #ddd #ddd;*border-right-color:#ffffff;}
-.tabs-right .nav-tabs{float:right;margin-left:19px;border-left:1px solid #ddd;}
-.tabs-right .nav-tabs>li>a{margin-left:-1px;-webkit-border-radius:0 4px 4px 0;-moz-border-radius:0 4px 4px 0;border-radius:0 4px 4px 0;}
-.tabs-right .nav-tabs>li>a:hover{border-color:#eeeeee #eeeeee #eeeeee #dddddd;}
-.tabs-right .nav-tabs .active>a,.tabs-right .nav-tabs .active>a:hover{border-color:#ddd #ddd #ddd transparent;*border-left-color:#ffffff;}
-.navbar{overflow:visible;margin-bottom:18px;}
-.navbar-inner{padding-left:20px;padding-right:20px;background-color:#2c2c2c;background-image:-moz-linear-gradient(top, #333333, #222222);background-image:-ms-linear-gradient(top, #333333, #222222);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#333333), to(#222222));background-image:-webkit-linear-gradient(top, #333333, #222222);background-image:-o-linear-gradient(top, #333333, #222222);background-image:linear-gradient(top, #333333, #222222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333', endColorstr='#222222', GradientType=0);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 1px 3px rgba(0, 0, 0, 0.25),inset 0 -1px 0 rgba(0, 0, 0, 0.1);-moz-box-shadow:0 1px 3px rgba(0, 0, 0, 0.25),inset 0 -1px 0 rgba(0, 0, 0, 0.1);box-shadow:0 1px 3px rgba(0, 0, 0, 0.25),inset 0 -1px 0 rgba(0, 0, 0, 0.1);}
-.btn-navbar{display:none;float:right;padding:7px 10px;margin-left:5px;margin-right:5px;background-color:#2c2c2c;background-image:-moz-linear-gradient(top, #333333, #222222);background-image:-ms-linear-gradient(top, #333333, #222222);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#333333), to(#222222));background-image:-webkit-linear-gradient(top, #333333, #222222);background-image:-o-linear-gradient(top, #333333, #222222);background-image:linear-gradient(top, #333333, #222222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333', endColorstr='#222222', GradientType=0);border-color:#222222 #222222 #000000;border-color:rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.1) rgba(0, 0, 0, 0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);-webkit-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.1),0 1px 0 rgba(255, 255, 255, 0.075);-moz-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.1),0 1px 0 rgba(255, 255, 255, 0.075);box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.1),0 1px 0 rgba(255, 255, 255, 0.075);}.btn-navbar:hover,.btn-navbar:active,.btn-navbar.active,.btn-navbar.disabled,.btn-navbar[disabled]{background-color:#222222;}
-.btn-navbar:active,.btn-navbar.active{background-color:#080808 \9;}
-.btn-navbar .icon-bar{display:block;width:18px;height:2px;background-color:#f5f5f5;-webkit-border-radius:1px;-moz-border-radius:1px;border-radius:1px;-webkit-box-shadow:0 1px 0 rgba(0, 0, 0, 0.25);-moz-box-shadow:0 1px 0 rgba(0, 0, 0, 0.25);box-shadow:0 1px 0 rgba(0, 0, 0, 0.25);}
-.btn-navbar .icon-bar+.icon-bar{margin-top:3px;}
-.nav-collapse.collapse{height:auto;}
-.navbar .brand:hover{text-decoration:none;}
-.navbar .brand{float:left;display:block;padding:8px 20px 12px;margin-left:-20px;font-size:20px;font-weight:200;line-height:1;color:#ffffff;}
-.navbar .navbar-text{margin-bottom:0;line-height:40px;color:#999999;}.navbar .navbar-text a:hover{color:#ffffff;background-color:transparent;}
-.navbar .btn,.navbar .btn-group{margin-top:5px;}
-.navbar .btn-group .btn{margin-top:0;}
-.navbar-form{margin-bottom:0;*zoom:1;}.navbar-form:before,.navbar-form:after{display:table;content:"";}
-.navbar-form:after{clear:both;}
-.navbar-form input,.navbar-form select{display:inline-block;margin-top:5px;margin-bottom:0;}
-.navbar-form .radio,.navbar-form .checkbox{margin-top:5px;}
-.navbar-form input[type="image"],.navbar-form input[type="checkbox"],.navbar-form input[type="radio"]{margin-top:3px;}
-.navbar-search{position:relative;float:left;margin-top:6px;margin-bottom:0;}.navbar-search .search-query{padding:4px 9px;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;font-weight:normal;line-height:1;color:#ffffff;color:rgba(255, 255, 255, 0.75);background:#666;background:rgba(255, 255, 255, 0.3);border:1px solid #111;-webkit-box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.1),0 1px 0px rgba(255, 255, 255, 0.15);-moz-box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.1),0 1px 0px rgba(255, 255, 255, 0.15);box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.1),0 1px 0px rgba(255, 255, 255, 0.15);-webkit-transition:none;-moz-transition:none;-ms-transition:none;-o-transition:none;transition:none;}.navbar-search .search-query :-moz-placeholder{color:#eeeeee;}
-.navbar-search .search-query::-webkit-input-placeholder{color:#eeeeee;}
-.navbar-search .search-query:hover{color:#ffffff;background-color:#999999;background-color:rgba(255, 255, 255, 0.5);}
-.navbar-search .search-query:focus,.navbar-search .search-query.focused{padding:5px 10px;color:#333333;text-shadow:0 1px 0 #ffffff;background-color:#ffffff;border:0;-webkit-box-shadow:0 0 3px rgba(0, 0, 0, 0.15);-moz-box-shadow:0 0 3px rgba(0, 0, 0, 0.15);box-shadow:0 0 3px rgba(0, 0, 0, 0.15);outline:0;}
-.navbar-fixed-top{position:fixed;top:0;right:0;left:0;z-index:1030;}
-.navbar-fixed-top .navbar-inner{padding-left:0;padding-right:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;}
-.navbar .nav{position:relative;left:0;display:block;float:left;margin:0 10px 0 0;}
-.navbar .nav.pull-right{float:right;}
-.navbar .nav>li{display:block;float:left;}
-.navbar .nav>li>a{float:none;padding:10px 10px 11px;line-height:19px;color:#999999;text-decoration:none;text-shadow:0 -1px 0 rgba(0, 0, 0, 0.25);}
-.navbar .nav>li>a:hover{background-color:transparent;color:#ffffff;text-decoration:none;}
-.navbar .nav .active>a,.navbar .nav .active>a:hover{color:#ffffff;text-decoration:none;background-color:#222222;background-color:rgba(0, 0, 0, 0.5);}
-.navbar .divider-vertical{height:40px;width:1px;margin:0 9px;overflow:hidden;background-color:#222222;border-right:1px solid #333333;}
-.navbar .nav.pull-right{margin-left:10px;margin-right:0;}
-.navbar .dropdown-menu{margin-top:1px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}.navbar .dropdown-menu:before{content:'';display:inline-block;border-left:7px solid transparent;border-right:7px solid transparent;border-bottom:7px solid #ccc;border-bottom-color:rgba(0, 0, 0, 0.2);position:absolute;top:-7px;left:9px;}
-.navbar .dropdown-menu:after{content:'';display:inline-block;border-left:6px solid transparent;border-right:6px solid transparent;border-bottom:6px solid #ffffff;position:absolute;top:-6px;left:10px;}
-.navbar .nav .dropdown-toggle .caret,.navbar .nav .open.dropdown .caret{border-top-color:#ffffff;}
-.navbar .nav .active .caret{opacity:1;filter:alpha(opacity=100);}
-.navbar .nav .open>.dropdown-toggle,.navbar .nav .active>.dropdown-toggle,.navbar .nav .open.active>.dropdown-toggle{background-color:transparent;}
-.navbar .nav .active>.dropdown-toggle:hover{color:#ffffff;}
-.navbar .nav.pull-right .dropdown-menu{left:auto;right:0;}.navbar .nav.pull-right .dropdown-menu:before{left:auto;right:12px;}
-.navbar .nav.pull-right .dropdown-menu:after{left:auto;right:13px;}
-.breadcrumb{padding:7px 14px;margin:0 0 18px;background-color:#fbfbfb;background-image:-moz-linear-gradient(top, #ffffff, #f5f5f5);background-image:-ms-linear-gradient(top, #ffffff, #f5f5f5);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#ffffff), to(#f5f5f5));background-image:-webkit-linear-gradient(top, #ffffff, #f5f5f5);background-image:-o-linear-gradient(top, #ffffff, #f5f5f5);background-image:linear-gradient(top, #ffffff, #f5f5f5);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#f5f5f5', GradientType=0);border:1px solid #ddd;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-box-shadow:inset 0 1px 0 #ffffff;-moz-box-shadow:inset 0 1px 0 #ffffff;box-shadow:inset 0 1px 0 #ffffff;}.breadcrumb li{display:inline;text-shadow:0 1px 0 #ffffff;}
-.breadcrumb .divider{padding:0 5px;color:#999999;}
-.breadcrumb .active a{color:#333333;}
-.pagination{height:36px;margin:18px 0;}
-.pagination ul{display:inline-block;*display:inline;*zoom:1;margin-left:0;margin-bottom:0;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-box-shadow:0 1px 2px rgba(0, 0, 0, 0.05);-moz-box-shadow:0 1px 2px rgba(0, 0, 0, 0.05);box-shadow:0 1px 2px rgba(0, 0, 0, 0.05);}
-.pagination li{display:inline;}
-.pagination a{float:left;padding:0 14px;line-height:34px;text-decoration:none;border:1px solid #ddd;border-left-width:0;}
-.pagination a:hover,.pagination .active a{background-color:#f5f5f5;}
-.pagination .active a{color:#999999;cursor:default;}
-.pagination .disabled a,.pagination .disabled a:hover{color:#999999;background-color:transparent;cursor:default;}
-.pagination li:first-child a{border-left-width:1px;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px;}
-.pagination li:last-child a{-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0;}
-.pagination-centered{text-align:center;}
-.pagination-right{text-align:right;}
-.pager{margin-left:0;margin-bottom:18px;list-style:none;text-align:center;*zoom:1;}.pager:before,.pager:after{display:table;content:"";}
-.pager:after{clear:both;}
-.pager li{display:inline;}
-.pager a{display:inline-block;padding:5px 14px;background-color:#fff;border:1px solid #ddd;-webkit-border-radius:15px;-moz-border-radius:15px;border-radius:15px;}
-.pager a:hover{text-decoration:none;background-color:#f5f5f5;}
-.pager .next a{float:right;}
-.pager .previous a{float:left;}
-.modal-open .dropdown-menu{z-index:2050;}
-.modal-open .dropdown.open{*z-index:2050;}
-.modal-open .popover{z-index:2060;}
-.modal-open .tooltip{z-index:2070;}
-.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:1040;background-color:#000000;}.modal-backdrop.fade{opacity:0;}
-.modal-backdrop,.modal-backdrop.fade.in{opacity:0.8;filter:alpha(opacity=80);}
-.modal{position:fixed;top:50%;left:50%;z-index:1050;max-height:500px;overflow:auto;width:560px;margin:-250px 0 0 -280px;background-color:#ffffff;border:1px solid #999;border:1px solid rgba(0, 0, 0, 0.3);*border:1px solid #999;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-moz-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;}.modal.fade{-webkit-transition:opacity .3s linear, top .3s ease-out;-moz-transition:opacity .3s linear, top .3s ease-out;-ms-transition:opacity .3s linear, top .3s ease-out;-o-transition:opacity .3s linear, top .3s ease-out;transition:opacity .3s linear, top .3s ease-out;top:-25%;}
-.modal.fade.in{top:50%;}
-.modal-header{padding:9px 15px;border-bottom:1px solid #eee;}.modal-header .close{margin-top:2px;}
-.modal-body{padding:15px;}
-.modal-footer{padding:14px 15px 15px;margin-bottom:0;background-color:#f5f5f5;border-top:1px solid #ddd;-webkit-border-radius:0 0 6px 6px;-moz-border-radius:0 0 6px 6px;border-radius:0 0 6px 6px;-webkit-box-shadow:inset 0 1px 0 #ffffff;-moz-box-shadow:inset 0 1px 0 #ffffff;box-shadow:inset 0 1px 0 #ffffff;*zoom:1;}.modal-footer:before,.modal-footer:after{display:table;content:"";}
-.modal-footer:after{clear:both;}
-.modal-footer .btn{float:right;margin-left:5px;margin-bottom:0;}
-.tooltip{position:absolute;z-index:1020;display:block;visibility:visible;padding:5px;font-size:11px;opacity:0;filter:alpha(opacity=0);}.tooltip.in{opacity:0.8;filter:alpha(opacity=80);}
-.tooltip.top{margin-top:-2px;}
-.tooltip.right{margin-left:2px;}
-.tooltip.bottom{margin-top:2px;}
-.tooltip.left{margin-left:-2px;}
-.tooltip.top .tooltip-arrow{bottom:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-top:5px solid #000000;}
-.tooltip.left .tooltip-arrow{top:50%;right:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-left:5px solid #000000;}
-.tooltip.bottom .tooltip-arrow{top:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-bottom:5px solid #000000;}
-.tooltip.right .tooltip-arrow{top:50%;left:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-right:5px solid #000000;}
-.tooltip-inner{max-width:200px;padding:3px 8px;color:#ffffff;text-align:center;text-decoration:none;background-color:#000000;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}
-.tooltip-arrow{position:absolute;width:0;height:0;}
-.popover{position:absolute;top:0;left:0;z-index:1010;display:none;padding:5px;}.popover.top{margin-top:-5px;}
-.popover.right{margin-left:5px;}
-.popover.bottom{margin-top:5px;}
-.popover.left{margin-left:-5px;}
-.popover.top .arrow{bottom:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-top:5px solid #000000;}
-.popover.right .arrow{top:50%;left:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-right:5px solid #000000;}
-.popover.bottom .arrow{top:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-bottom:5px solid #000000;}
-.popover.left .arrow{top:50%;right:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-left:5px solid #000000;}
-.popover .arrow{position:absolute;width:0;height:0;}
-.popover-inner{padding:3px;width:280px;overflow:hidden;background:#000000;background:rgba(0, 0, 0, 0.8);-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-moz-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);}
-.popover-title{padding:9px 15px;line-height:1;background-color:#f5f5f5;border-bottom:1px solid #eee;-webkit-border-radius:3px 3px 0 0;-moz-border-radius:3px 3px 0 0;border-radius:3px 3px 0 0;}
-.popover-content{padding:14px;background-color:#ffffff;-webkit-border-radius:0 0 3px 3px;-moz-border-radius:0 0 3px 3px;border-radius:0 0 3px 3px;-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;}.popover-content p,.popover-content ul,.popover-content ol{margin-bottom:0;}
-.thumbnails{margin-left:-20px;list-style:none;*zoom:1;}.thumbnails:before,.thumbnails:after{display:table;content:"";}
-.thumbnails:after{clear:both;}
-.thumbnails>li{float:left;margin:0 0 18px 20px;}
-.thumbnail{display:block;padding:4px;line-height:1;border:1px solid #ddd;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 1px 1px rgba(0, 0, 0, 0.075);-moz-box-shadow:0 1px 1px rgba(0, 0, 0, 0.075);box-shadow:0 1px 1px rgba(0, 0, 0, 0.075);}
-a.thumbnail:hover{border-color:#0088cc;-webkit-box-shadow:0 1px 4px rgba(0, 105, 214, 0.25);-moz-box-shadow:0 1px 4px rgba(0, 105, 214, 0.25);box-shadow:0 1px 4px rgba(0, 105, 214, 0.25);}
-.thumbnail>img{display:block;max-width:100%;margin-left:auto;margin-right:auto;}
-.thumbnail .caption{padding:9px;}
-.label{padding:1px 3px 2px;font-size:9.75px;font-weight:bold;color:#ffffff;text-transform:uppercase;background-color:#999999;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;}
-.label-important{background-color:#b94a48;}
-.label-warning{background-color:#f89406;}
-.label-success{background-color:#468847;}
-.label-info{background-color:#3a87ad;}
-@-webkit-keyframes progress-bar-stripes{from{background-position:0 0;} to{background-position:40px 0;}}@-moz-keyframes progress-bar-stripes{from{background-position:0 0;} to{background-position:40px 0;}}@keyframes progress-bar-stripes{from{background-position:0 0;} to{background-position:40px 0;}}.progress{overflow:hidden;height:18px;margin-bottom:18px;background-color:#f7f7f7;background-image:-moz-linear-gradient(top, #f5f5f5, #f9f9f9);background-image:-ms-linear-gradient(top, #f5f5f5, #f9f9f9);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#f5f5f5), to(#f9f9f9));background-image:-webkit-linear-gradient(top, #f5f5f5, #f9f9f9);background-image:-o-linear-gradient(top, #f5f5f5, #f9f9f9);background-image:linear-gradient(top, #f5f5f5, #f9f9f9);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#f5f5f5', endColorstr='#f9f9f9', GradientType=0);-webkit-box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.1);-moz-box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.1);box-shadow:inset 0 1px 2px rgba(0, 0, 0, 0.1);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}
-.progress .bar{width:0%;height:18px;color:#ffffff;font-size:12px;text-align:center;text-shadow:0 -1px 0 rgba(0, 0, 0, 0.25);background-color:#0e90d2;background-image:-moz-linear-gradient(top, #149bdf, #0480be);background-image:-ms-linear-gradient(top, #149bdf, #0480be);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#149bdf), to(#0480be));background-image:-webkit-linear-gradient(top, #149bdf, #0480be);background-image:-o-linear-gradient(top, #149bdf, #0480be);background-image:linear-gradient(top, #149bdf, #0480be);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#149bdf', endColorstr='#0480be', GradientType=0);-webkit-box-shadow:inset 0 -1px 0 rgba(0, 0, 0, 0.15);-moz-box-shadow:inset 0 -1px 0 rgba(0, 0, 0, 0.15);box-shadow:inset 0 -1px 0 rgba(0, 0, 0, 0.15);-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-transition:width 0.6s ease;-moz-transition:width 0.6s ease;-ms-transition:width 0.6s ease;-o-transition:width 0.6s ease;transition:width 0.6s ease;}
-.progress-striped .bar{background-color:#62c462;background-image:-webkit-gradient(linear, 0 100%, 100% 0, color-stop(0.25, rgba(255, 255, 255, 0.15)), color-stop(0.25, transparent), color-stop(0.5, transparent), color-stop(0.5, rgba(255, 255, 255, 0.15)), color-stop(0.75, rgba(255, 255, 255, 0.15)), color-stop(0.75, transparent), to(transparent));background-image:-webkit-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-moz-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-ms-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);-webkit-background-size:40px 40px;-moz-background-size:40px 40px;-o-background-size:40px 40px;background-size:40px 40px;}
-.progress.active .bar{-webkit-animation:progress-bar-stripes 2s linear infinite;-moz-animation:progress-bar-stripes 2s linear infinite;animation:progress-bar-stripes 2s linear infinite;}
-.progress-danger .bar{background-color:#dd514c;background-image:-moz-linear-gradient(top, #ee5f5b, #c43c35);background-image:-ms-linear-gradient(top, #ee5f5b, #c43c35);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#ee5f5b), to(#c43c35));background-image:-webkit-linear-gradient(top, #ee5f5b, #c43c35);background-image:-o-linear-gradient(top, #ee5f5b, #c43c35);background-image:linear-gradient(top, #ee5f5b, #c43c35);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b', endColorstr='#c43c35', GradientType=0);}
-.progress-danger.progress-striped .bar{background-color:#ee5f5b;background-image:-webkit-gradient(linear, 0 100%, 100% 0, color-stop(0.25, rgba(255, 255, 255, 0.15)), color-stop(0.25, transparent), color-stop(0.5, transparent), color-stop(0.5, rgba(255, 255, 255, 0.15)), color-stop(0.75, rgba(255, 255, 255, 0.15)), color-stop(0.75, transparent), to(transparent));background-image:-webkit-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-moz-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-ms-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);}
-.progress-success .bar{background-color:#5eb95e;background-image:-moz-linear-gradient(top, #62c462, #57a957);background-image:-ms-linear-gradient(top, #62c462, #57a957);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#62c462), to(#57a957));background-image:-webkit-linear-gradient(top, #62c462, #57a957);background-image:-o-linear-gradient(top, #62c462, #57a957);background-image:linear-gradient(top, #62c462, #57a957);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462', endColorstr='#57a957', GradientType=0);}
-.progress-success.progress-striped .bar{background-color:#62c462;background-image:-webkit-gradient(linear, 0 100%, 100% 0, color-stop(0.25, rgba(255, 255, 255, 0.15)), color-stop(0.25, transparent), color-stop(0.5, transparent), color-stop(0.5, rgba(255, 255, 255, 0.15)), color-stop(0.75, rgba(255, 255, 255, 0.15)), color-stop(0.75, transparent), to(transparent));background-image:-webkit-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-moz-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-ms-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);}
-.progress-info .bar{background-color:#4bb1cf;background-image:-moz-linear-gradient(top, #5bc0de, #339bb9);background-image:-ms-linear-gradient(top, #5bc0de, #339bb9);background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#5bc0de), to(#339bb9));background-image:-webkit-linear-gradient(top, #5bc0de, #339bb9);background-image:-o-linear-gradient(top, #5bc0de, #339bb9);background-image:linear-gradient(top, #5bc0de, #339bb9);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de', endColorstr='#339bb9', GradientType=0);}
-.progress-info.progress-striped .bar{background-color:#5bc0de;background-image:-webkit-gradient(linear, 0 100%, 100% 0, color-stop(0.25, rgba(255, 255, 255, 0.15)), color-stop(0.25, transparent), color-stop(0.5, transparent), color-stop(0.5, rgba(255, 255, 255, 0.15)), color-stop(0.75, rgba(255, 255, 255, 0.15)), color-stop(0.75, transparent), to(transparent));background-image:-webkit-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-moz-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-ms-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:-o-linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);background-image:linear-gradient(-45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);}
-.accordion{margin-bottom:18px;}
-.accordion-group{margin-bottom:2px;border:1px solid #e5e5e5;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;}
-.accordion-heading{border-bottom:0;}
-.accordion-heading .accordion-toggle{display:block;padding:8px 15px;}
-.accordion-inner{padding:9px 15px;border-top:1px solid #e5e5e5;}
-.carousel{position:relative;margin-bottom:18px;line-height:1;}
-.carousel-inner{overflow:hidden;width:100%;position:relative;}
-.carousel .item{display:none;position:relative;-webkit-transition:0.6s ease-in-out left;-moz-transition:0.6s ease-in-out left;-ms-transition:0.6s ease-in-out left;-o-transition:0.6s ease-in-out left;transition:0.6s ease-in-out left;}
-.carousel .item>img{display:block;line-height:1;}
-.carousel .active,.carousel .next,.carousel .prev{display:block;}
-.carousel .active{left:0;}
-.carousel .next,.carousel .prev{position:absolute;top:0;width:100%;}
-.carousel .next{left:100%;}
-.carousel .prev{left:-100%;}
-.carousel .next.left,.carousel .prev.right{left:0;}
-.carousel .active.left{left:-100%;}
-.carousel .active.right{left:100%;}
-.carousel-control{position:absolute;top:40%;left:15px;width:40px;height:40px;margin-top:-20px;font-size:60px;font-weight:100;line-height:30px;color:#ffffff;text-align:center;background:#222222;border:3px solid #ffffff;-webkit-border-radius:23px;-moz-border-radius:23px;border-radius:23px;opacity:0.5;filter:alpha(opacity=50);}.carousel-control.right{left:auto;right:15px;}
-.carousel-control:hover{color:#ffffff;text-decoration:none;opacity:0.9;filter:alpha(opacity=90);}
-.carousel-caption{position:absolute;left:0;right:0;bottom:0;padding:10px 15px 5px;background:#333333;background:rgba(0, 0, 0, 0.75);}
-.carousel-caption h4,.carousel-caption p{color:#ffffff;}
-.hero-unit{padding:60px;margin-bottom:30px;background-color:#f5f5f5;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;}.hero-unit h1{margin-bottom:0;font-size:60px;line-height:1;letter-spacing:-1px;}
-.hero-unit p{font-size:18px;font-weight:200;line-height:27px;}
-.pull-right{float:right;}
-.pull-left{float:left;}
-.hide{display:none;}
-.show{display:block;}
-.invisible{visibility:hidden;}
-
-
-/* Responsive css */
-
-/*.hidden{display:none;visibility:hidden;}*/
-/*@media (max-width:480px){.nav-collapse{-webkit-transform:translate3d(0, 0, 0);} .page-header h1 small{display:block;line-height:18px;} input[class*="span"],select[class*="span"],textarea[class*="span"],.uneditable-input{display:block;width:100%;height:28px;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;-ms-box-sizing:border-box;box-sizing:border-box;} .input-prepend input[class*="span"],.input-append input[class*="span"]{width:auto;} input[type="checkbox"],input[type="radio"]{border:1px solid #ccc;} .form-horizontal .control-group>label{float:none;width:auto;padding-top:0;text-align:left;} .form-horizontal .controls{margin-left:0;} .form-horizontal .control-list{padding-top:0;} .form-horizontal .form-actions{padding-left:10px;padding-right:10px;} .modal{position:absolute;top:10px;left:10px;right:10px;width:auto;margin:0;}.modal.fade.in{top:auto;} .modal-header .close{padding:10px;margin:-10px;} .carousel-caption{position:static;}}@media (max-width:768px){.container{width:auto;padding:0 20px;} .row-fluid{width:100%;} .row{margin-left:0;} .row>[class*="span"],.row-fluid>[class*="span"]{float:none;display:block;width:auto;margin:0;}}@media (min-width:768px) and (max-width:980px){.row{margin-left:-20px;*zoom:1;}.row:before,.row:after{display:table;content:"";} .row:after{clear:both;} [class*="span"]{float:left;margin-left:20px;} .span1{width:42px;} .span2{width:104px;} .span3{width:166px;} .span4{width:228px;} .span5{width:290px;} .span6{width:352px;} .span7{width:414px;} .span8{width:476px;} .span9{width:538px;} .span10{width:600px;} .span11{width:662px;} .span12,.container{width:724px;} .offset1{margin-left:82px;} .offset2{margin-left:144px;} .offset3{margin-left:206px;} .offset4{margin-left:268px;} .offset5{margin-left:330px;} .offset6{margin-left:392px;} .offset7{margin-left:454px;} .offset8{margin-left:516px;} .offset9{margin-left:578px;} .offset10{margin-left:640px;} .offset11{margin-left:702px;} .row-fluid{width:100%;*zoom:1;}.row-fluid:before,.row-fluid:after{display:table;content:"";} .row-fluid:after{clear:both;} .row-fluid>[class*="span"]{float:left;margin-left:2.762430939%;} .row-fluid>[class*="span"]:first-child{margin-left:0;} .row-fluid .span1{width:5.801104972%;} .row-fluid .span2{width:14.364640883%;} .row-fluid .span3{width:22.928176794%;} .row-fluid .span4{width:31.491712705%;} .row-fluid .span5{width:40.055248616%;} .row-fluid .span6{width:48.618784527%;} .row-fluid .span7{width:57.182320438000005%;} .row-fluid .span8{width:65.74585634900001%;} .row-fluid .span9{width:74.30939226%;} .row-fluid .span10{width:82.87292817100001%;} .row-fluid .span11{width:91.436464082%;} .row-fluid .span12{width:99.999999993%;} input.span1,textarea.span1,.uneditable-input.span1{width:32px;} input.span2,textarea.span2,.uneditable-input.span2{width:94px;} input.span3,textarea.span3,.uneditable-input.span3{width:156px;} input.span4,textarea.span4,.uneditable-input.span4{width:218px;} input.span5,textarea.span5,.uneditable-input.span5{width:280px;} input.span6,textarea.span6,.uneditable-input.span6{width:342px;} input.span7,textarea.span7,.uneditable-input.span7{width:404px;} input.span8,textarea.span8,.uneditable-input.span8{width:466px;} input.span9,textarea.span9,.uneditable-input.span9{width:528px;} input.span10,textarea.span10,.uneditable-input.span10{width:590px;} input.span11,textarea.span11,.uneditable-input.span11{width:652px;} input.span12,textarea.span12,.uneditable-input.span12{width:714px;}}@media (max-width:980px){body{padding-top:0;} .navbar-fixed-top{position:static;margin-bottom:18px;} .navbar-fixed-top .navbar-inner{padding:5px;} .navbar .container{width:auto;padding:0;} .navbar .brand{padding-left:10px;padding-right:10px;margin:0 0 0 -5px;} .navbar .nav-collapse{clear:left;} .navbar .nav{float:none;margin:0 0 9px;} .navbar .nav>li{float:none;} .navbar .nav>li>a{margin-bottom:2px;} .navbar .nav>.divider-vertical{display:none;} .navbar .nav>li>a,.navbar .dropdown-menu a{padding:6px 15px;font-weight:bold;color:#999999;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;} .navbar .dropdown-menu li+li a{margin-bottom:2px;} .navbar .nav>li>a:hover,.navbar .dropdown-menu a:hover{background-color:#222222;} .navbar .dropdown-menu{position:static;top:auto;left:auto;float:none;display:block;max-width:none;margin:0 15px;padding:0;background-color:transparent;border:none;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;} .navbar .dropdown-menu:before,.navbar .dropdown-menu:after{display:none;} .navbar .dropdown-menu .divider{display:none;} .navbar-form,.navbar-search{float:none;padding:9px 15px;margin:9px 0;border-top:1px solid #222222;border-bottom:1px solid #222222;-webkit-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.1),0 1px 0 rgba(255, 255, 255, 0.1);-moz-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.1),0 1px 0 rgba(255, 255, 255, 0.1);box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.1),0 1px 0 rgba(255, 255, 255, 0.1);} .navbar .nav.pull-right{float:none;margin-left:0;} .navbar-static .navbar-inner{padding-left:10px;padding-right:10px;} .btn-navbar{display:block;} .nav-collapse{overflow:hidden;height:0;}}@media (min-width:980px){.nav-collapse.collapse{height:auto !important;}}@media (min-width:1200px){.row{margin-left:-30px;*zoom:1;}.row:before,.row:after{display:table;content:"";} .row:after{clear:both;} [class*="span"]{float:left;margin-left:30px;} .span1{width:70px;} .span2{width:170px;} .span3{width:270px;} .span4{width:370px;} .span5{width:470px;} .span6{width:570px;} .span7{width:670px;} .span8{width:770px;} .span9{width:870px;} .span10{width:970px;} .span11{width:1070px;} .span12,.container{width:1170px;} .offset1{margin-left:130px;} .offset2{margin-left:230px;} .offset3{margin-left:330px;} .offset4{margin-left:430px;} .offset5{margin-left:530px;} .offset6{margin-left:630px;} .offset7{margin-left:730px;} .offset8{margin-left:830px;} .offset9{margin-left:930px;} .offset10{margin-left:1030px;} .offset11{margin-left:1130px;} .row-fluid{width:100%;*zoom:1;}.row-fluid:before,.row-fluid:after{display:table;content:"";} .row-fluid:after{clear:both;} .row-fluid>[class*="span"]{float:left;margin-left:2.564102564%;} .row-fluid>[class*="span"]:first-child{margin-left:0;} .row-fluid .span1{width:5.982905983%;} .row-fluid .span2{width:14.529914530000001%;} .row-fluid .span3{width:23.076923077%;} .row-fluid .span4{width:31.623931624%;} .row-fluid .span5{width:40.170940171000005%;} .row-fluid .span6{width:48.717948718%;} .row-fluid .span7{width:57.264957265%;} .row-fluid .span8{width:65.81196581200001%;} .row-fluid .span9{width:74.358974359%;} .row-fluid .span10{width:82.905982906%;} .row-fluid .span11{width:91.45299145300001%;} .row-fluid .span12{width:100%;} input.span1,textarea.span1,.uneditable-input.span1{width:60px;} input.span2,textarea.span2,.uneditable-input.span2{width:160px;} input.span3,textarea.span3,.uneditable-input.span3{width:260px;} input.span4,textarea.span4,.uneditable-input.span4{width:360px;} input.span5,textarea.span5,.uneditable-input.span5{width:460px;} input.span6,textarea.span6,.uneditable-input.span6{width:560px;} input.span7,textarea.span7,.uneditable-input.span7{width:660px;} input.span8,textarea.span8,.uneditable-input.span8{width:760px;} input.span9,textarea.span9,.uneditable-input.span9{width:860px;} input.span10,textarea.span10,.uneditable-input.span10{width:960px;} input.span11,textarea.span11,.uneditable-input.span11{width:1060px;} input.span12,textarea.span12,.uneditable-input.span12{width:1160px;} .thumbnails{margin-left:-30px;} .thumbnails>li{margin-left:30px;}}*/
diff --git a/doc/source/assets/css/local.css b/doc/source/assets/css/local.css
deleted file mode 100644
index c8667c45ff..0000000000
--- a/doc/source/assets/css/local.css
+++ /dev/null
@@ -1,122 +0,0 @@
-
-a.brand {
-	background: url(../images/small_logo.png) no-repeat left 6px;
-	width: 166px;
-	text-indent: -9999px;
-}
-
-code {
-  background-color: #ffffff;
-}
-
-#home .hero-unit {
-  background: url(../images/header_bg.png) top left repeat-x;
-	color: #fff;
-	padding-left: 25px;
-	padding-right: 25px;
-	height: 161px;
-}
-
-#home .hero-unit {
-	margin-right: ;
-}
-
-h1#main_header {
-	background: url(../images/logo.png) top left no-repeat;
-	text-indent: -9999px;
-}
-
-.sub_header {
-	font-size: 12px;
-	font-family: "anivers";
-	font-weight: normal;
-	width: 420px;
-}
-
-#home .hero-unit a {
-	color: #fff;
-	text-decoration: underline;
-}
-
-.clear {
-	clear: both;
-}
-
-ol#getting_started {
-	list-style: none;
-	width: 396px;
-	margin-top: -45px;
-	margin-right: 0;
-	margin-left: 72px;
-}
-
-ol#getting_started li {
-	background: url(../images/quickstart.png) top left no-repeat;
-}
-
-ol#getting_started li pre {
-	font-size: 11px;
-	padding: 5px;
-	background: #4d7ead;
-	border-color: #2c5d8d;
-	color: #fff;
-	overflow: auto;
-}
-
-li#ubuntu {
-	height: 46px;
-	padding: ;
-	padding-left: 82px;
-	padding-top: 27px;
-	margin-bottom: 14px;
-}
-
-li#git {
-	background-position: left -70px !important;
-	height: 61px;
-	padding: ;
-	padding-left: 82px;
-	padding-top: 4px;
-	margin-bottom: 25px;
-}
-
-
-li#install {
-	background-position: left bottom !important;
-	height: 61px;
-	padding: ;
-	padding-left: 82px;
-	padding-top: 4px;
-	margin-bottom: 25px;
-}
-
-h2 small {
-	font-size: 12px;
-	font-style: italic;
-}
-
-.container section {
-	margin-bottom: 25px;
-}
-
-
-thead, tfoot{
-	background: #ededed;
-	color: #444444;
-}
-
-table {
-	color: #444;
-}
-a.table-action {
-	display: block;
-	width: 45px;
-}
-
-footer {
-	clear: both;
-}
-
-.wat {
-	margin-top: 33px;
-}
diff --git a/doc/source/assets/images/header_bg.png b/doc/source/assets/images/header_bg.png
deleted file mode 100644
index 4e6b2b899b5787479204ae00ebe2c4fdb8e3ece1..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1014
zcmaJ=+iTNM7>^rx8E!I!jg37VG8ublb6c~SusGVLT_dK<u3$li%aYSIbjgXy>6%r1
z@kPW3Uk3gQ>VqJNAR_aEg6zd7Ve?s-58m+2A$ZcYoe$O!IN$mBe!uVbJGU0{^Zk9J
zeH2CYYdN(*&LiX>J>EmCD}xUNa*W_i2`{2Dt{Xn2k``KlKy!>$Sb&DLarGUXrKsLB
zcCmy@`UTlU4r4?yOz3z7O;NLRp=X#?h`|b6wOxh&_H2s=wx!UQM4i*UG_2UUh7T7T
z`J&mVnvzA&oddI>Ob8r^4G=nOZXkyW-Q<;t9l2Q=G(&Jzp%02G=?fr@d<aB_i<{gu
z52h0gpWvi~6axasb1W~g+)SM3WN}93c+mQ2lFhfuazV|ua*>-tS1|TumaW(8Onr($
z{wm8$lEiWXD+qBC5f3(8Y=m()7;iJEFfe`F!!~k3#AvLb8dhjh=|KyQ*P(TT)|kk^
z*wFA;p5daF+JU<M|4_&2L<hJ459|FWaZudwAX|U|s`(~aTzNc7<;iIu8W{OSgx1<q
zT&N(7f(r6LdQoI}pc|&`MxG`@*JaHOu;H3eQx%$UFt%;UTuM^K44+Pji7d}&cu7nr
zv(l6#ib7VHnNr(W6`3^$y10$C4zX%iY$OK9Bbim`+w0KE`p5yzre(W(Ey=EYEv(hO
zmQ+_PONwEm)&8~Wwu|T|GCRU0myYzIOZ4s&VIRGC=QVj06-`YR!`;W5j|N|WlfBnR
zZhsao4_)g!zZM&ty!ZZj{?*&veWg4xR_Nc`)#hIgzo~xWzj`}+OSz{fgkQ1L&~~gb
zC*9mUUEBUWaP|k&xSRX=<m0^Yp=Ww$;JdlCvwv)CeR!FgxUbohOQ*g>FHy_n)rYC&
G8-D<^u|j<S

diff --git a/doc/source/assets/images/logo-blue.png b/doc/source/assets/images/logo-blue.png
new file mode 100644
index 0000000000000000000000000000000000000000..6b363afeeed2b53c7898340e30ad5a07152f720b
GIT binary patch
literal 10568
zcmZvCXE>Z)*S6>(g6IU%yV2|DeUhjVorvDM!6?zAMdwcRG7-_+AX-AS(M4xQFTogn
zbg%n)pZCXi9N&+t9Q(M+x%XOo@3qc##_4KnkPy)mVPRpBXlbhIV_`kodAOG+#D6%i
zD1MB8xZuBksiBJHg;kBURTiqo_0aOzQ`5u;3yYZI-{TS1mt5M1Mgm{0*J=bvVk#UW
z{7t!fC>GWWEG<=~HvtQ%Jf}qVLBHiN@>CNC%&D|o|7cxX!^Xa6Ab>*`*jUg0tni(Z
z&}(9RTS98Bm!|{_DGCGU1a#*FJuz6}%um8n_$MM>{lac4W=RuL3a9o>spqb0;uFNs
z9*ED5?wiYrhP*YjSG`cNwYT##@-wuzGc=OivvzR!TGl4A)|(JKd*8vOIROZ}{DCe1
zG?@N^(%{Qv##b>Y&ugctQ?Wz5m1Kqc!E~9sVojdylb=@D2?mz0ok0J2s4=IqNjs28
zI6m15PyX~$C%^q4?j23(E}-4*f4=~_)=mz)OXmW_b61AA>`LqW_syy0$WI;HdGd_{
zGwGH`p3>Xp-ueIiYdI-YWzpX^*#uYqU=_=n!aB3`E~59@?X3N)Q-$ykl<Ddj#Iz{+
z5;@boJD~bs<^7e_7dJT>ej0qq8}EPm+0OYKgd7|t;*7LCP8qB_@|Z-cPl&+AFl&W+
zK0Y|*>?689t5d9JX@&bQ;UHbWODw@<x8o~k<0&=;RNa^(>SCp;=^$I!*hP3o%DR@(
zfkgR5v?^hEO8t5*Dg2k2i%{SD#y;anasNh`G5k0A<dF_<bOtud#xK+63~jQ?URu$g
zGWBTbYx!%1^>@dg;!+1EPW~5!1Rdu6Gj2x-;lBC~#7d9O^B#&?V~j4gJ^Y!~<3{0~
zT5Q7L$3s4bK#oIpZkEH$KXPb!lhx$>j$Wv^;qOWLO;jv6_bEv!RfEI=W2Z2!TkQ<{
zy<pVG&{mqHH_v#eKs==xggm4%#V~3cewinaBdLr0AuyXm+bA+k=wU|p$;*{MZYSAd
z^7Kyk%}YX-+L_{>LbQwsTDo8UT7Lb*vAg+dcjvY!{@v><1h;7)=b9zu8Au!-tBP%G
zTB?7P_9dHRQO+ag&~4!@XAU^gmJ89NDUiq{AXU9SE0fKRY-Lc8{5d>tEGcw$rdS0d
z$+Kd>EY*j;-OOokEl+WlqS{NcWcCXhU|iiBFpyX%^!xZ!Wve3XgsUP~LC+x&_Nt>a
zAOJdAML^<S)7;X4+}L%FbO6-&bWJD+GUaa<Wo%c9vD8vjmI|Z_7psJ>Z;zoDW#lov
zMk)I5p^DE7{qEP$ma3pQ;h5#&mQPCOz<v2PxpkpKcLh7|rJJ17Hoe9~)NIGVOKY;i
zBzs8Pukv1cG{iUm^2?edqQ@X2?O6b?eqkzgX7QhfX5+^Bzi0}mt`b9zs+-!_g`%Xq
z5?|xZQY_ON`0j>Cl7V{jGQFaZV$(J8B=PkkA8h7bBj*zpq<`aZf4<Zp!Ki@mZDM9C
z5uZ=y2Ks)Z=dim;{BFm?<9HY4cBB7z>_jhL86-ZD?>n3vVxi*ul)xLoQxQlBVX`mi
z$oCo#Y+e?T*8Z<0&QC0Dp<8`8cZjiEHX%2>@~Z2GIC(2GNBkL{Swi2{?mf4&Co6-E
zUz#Aa?;xrYllRFPt@`7HPYN#U8gBX|t+uPPxHAD8a{73A0mFTTO<PmBYp2Rk6(uv9
z%T*sAb1CVZ%aZ~rzbGzk#?@#Smzz5)#7b2Xey6~C;EPP$4OQO1QemAnE-CYYqQZMw
zBH2{(JNdEm4mA$XeUYf<SD(_u(nBTVv+8c!X-v2Yu|v-sMvn@M$O&;J;9jydz`FpQ
zh~+x%MZ<aeMT=X|g#W>NC|~ro_G8+gw1maFL4_oJGBvVd)Hc=?c8<8O@9qe+PjbS7
zq8El!gM+U(0anZ=*t~DMO<lTQY}h0-7wxu*H8$b%)4BwVeP+uwsU|(E9I+ojhg{Py
zx3;U5zv;t-l<I381nCcK&RR^pa1?*sLsoTWT<O7Lafdts0+%%cnLsj3XDU~wE)(h+
z(%(J^J+Tn8eYN)%)anP3R|ZuIM_G?&hy5)$duay*fTB+WCN`uCKAl~10LNUqQl1K-
z`=G81+XfGgssEjJNJ8RYOYJmw&b5)OKld7iu;@#>$!;(;AUisdJ`ICiS8?mcxKvi^
zOo3$tuCBWtdQ>T7D6-~wv1&@~d71ILYlvg+sB_GLkt6?NxEjNd|GRN~Y}8%*bbVu^
z+T)hys-w(zB~H2SY}J`D(ck-%ru|B-R+0YxfdiXLV4M(+t-k8<m|n-8Iuo^NFyQCK
z&vnnmA&+X3s=__HWUHH_*i{|Dqr4$A!bka79Mh_srE0&qSX6QSeTqnBIrq#!anZOd
zMQR_(>H(9IkM`B9CpXfPtP#R<?D#lDEQ;{(i`k=wqaoPJNn8Orgr<*Hh!eiZXpT(c
z`;yV#80}+_IC0P+Y(M`n$LeOUCiMkk+G!Bu3xVhVoE?yq)@HDaNkAiAV>R}*!qW<i
zm!V`&`KiNO4&0p+n_Qdt_g*JS)Xt1M66d^Dc`3WOuT@rS<BS^<G$^+iKJ*U8&l4E&
z=R{uAuDSnn{qJ<$GY*i9k9NFFpK<5ajhwq{ipa5gVIeqEZJySdxukMY++#+DMMB-j
zeO{nmMOq^a=^V2ZI=<q_+n<~Lp5u1b2!;p(rV{S4r$F6O`;ZHB?X-{7+ZrCP`+zKV
z<Wf5)u4F2A^P+dzPV2D}$uw<V9Agu#T3tCTzEC^I>akTQxS(UbvP;xFq$c<bUOz7U
zv-gMm-jDW^(K+X>`>9DmVxpjHsqqOi!O{`+95Nh)!T0sh4?74B=%rXPCvEL0Z*7K}
zASPX#o)p!IVK*P3#%o2^>lkUBIpQcsE2^&|g0$*4WJhO)o^jwdr5Utv=;$7?D=TWn
zWf%#jq_O{Is)7GQ312kMAiEjwX$ang?3J7pF2d*8p}K}v<3uFkUQk{A#uIaiXIb$P
zP&&XPqB+L5)W(9#^Zcqx{h%xOAApYw-^XM3h`~XPen8kr*mW7rKVn~eOVNP412uN-
zK>N+*?am9LneX!Fd!E}Tp8@SyKRv>(;#7Lu>Z$-DiJWiGIWOEdGCNK?K9+n@W1A#s
zgW$AET6DdC0`v)yeJt19coH!tcy$4i@-UK)Hb2kh6o3eZp<b5RX3jA>QOWLykKXZ*
zN>6_U59yExp6j>N*ZAg)D^vN#dVhi!+k+yK<s~A^aI?{3E#5VQyY?wjla)=5jK|dm
z;zm=QD$-omUVJV7-~{5bt#8?F0H+4J<J~jy(duC#E5Mlr+Mz&ZB<!MO*5Wer&8rj&
zIr5Lld>2_lO)E~CUN_DRkJww+vb`YyL>Ar4jnq*qYJpr%fx0RB`37m$Yx-Lq8jLt$
z2zIw@@^_F$e2d#FgcZf_fM{Ub*uD~j&4j7wdQU8Kp3>uli7ZiK4sAe|BW{e5yLe0e
z0y`mzA?c`Kmc=(na&ch7CLBc~nEM5N(LB^F(c<k8xwt2QRlPL7qOt6i+bR#bS}pMl
z-Iy@RZ(aEK<@2jgG;)tWB0IYEDUwg~-cdH^j{C^%JIGpCh0gEIq}J_V49K|;Iy?Ow
zJQ%X6Yu%trP44rJ291a&upas*S3#0HUUqcQiBV+TO#XD>Nq*wQ9L$DFS&F5z327Vn
zb%X!oz}5cW&kPR(+rQ15D{Z<B&wK4&>E5au65l!#k(QNgDTSO(@9db_u)6=n_vX7{
zaMx6v{*nftBn3z+^AAn=(jQC4uosYOZplf>y(@2eF%+<H`;erM-EmS&$?GLFEl5L7
zk;(I>eP~XLzk+{rZcNAlvUAW!wl~BJ>CjzO^j8f^4*7b5$+wEnXYt{?w{IA%3BF-3
zs>{eI{m351;9{>hK)&Ok<oJByI&<-L=XrO~<f{r#(uHX;GkI@!YMzA=jWj5G{K9*3
z{@IX^!0pg$YW-*QJx$XB)z$7CzrqoA`hr{cG=R=tjpe%LH2I*?;X&!-#YOr}lhP)(
zh7^%#Tan@@8{BFTix<Y(dD%VB**|Z>5-`}Vxy-*eG}J_^#aA4m$|wg;(_P}l-}PO(
z8C<oXkLHJ}p8YM$)yS$xbKTD~!P<m}ua4nJ?Kc53zw_`?ks$@%Mu3A=WEWci*lZEg
z;FfJ@i`TY^@Q0CsPwy4YczM5{f!tmotjtd1H^IanW;p@K6#Xqk{1F?m=y=w3&Pb=_
z>Gjz2)jfc`CwAFXXKY#h15TGe36_M6XUTGcfv%5oc8W>$YY2OaN(n5Mg@lV+BxYz4
zf_|T0P=ZbE&v1_gE&BN~_hnPLA4VQImf`?0KIjwr@5rMdDU4MJzXFS|CL|~4{H)1t
z;HY1+a!v$WAb_EISZcWh^x14AWa^4NJ>t{imkw{29B^J`y^&h>$myLUpHq<UfL3hJ
zqhOuGL(u(!&9=_yVbiwJgejLD;b3d2rRh3DbQUwmO)H@DnMsL=lfw^LRR)uupB}f}
zvLZF^#u>g{XCwuz;}aY*=G+Hfhk_N%B8mK)^JBFRka2Wh?Osk4QN#qiZm*$((Y}Dv
zo<FM3zp&o!S&<*~t+G_DiN45lIlBrwGVB?cIJME}^b-Le!|6Ul60+P88*^KOalL@8
zUFQU_!W*2_u>HT<(?}iRg*T!2#16@$Pfl}7G(b_-ABdI`q@V8n?u)@uRW+zz+p1!F
zJ43N7nmtimN-BCkERW%pcWlo`Cf#OtC~w+DdGB8{EqDD{Tk@9vE`S_tLxLuaXWyxo
z`syqRS5leIe4+m!yZ6ZIK4<oGl@SYl63@Cd4ZO@!|7I9M9dM$g=_dMWrat>S8M*Q6
z!Tl?Cv!^ofAv{yhOZRkxlg_;<k)PooE#i&Ytv%apaP7J-qMEXNxbXMfet4HESNtVg
zv8MI^5UHBx@+Pi#HnryYc)$RYSMFhcE1S9&v;Ey*$i87PS)g18!!-aB4Id)hG{%}e
zz{~yO(=@`EB=4r<7cQJN{<ACWiX+1cq^|hY3y+nlmYpN>(gwHA{&m;A0GV-PbaPEc
zz+F%}Uxk1+AVUZN`dGp&(igauBaq(F56QAz@>)+7dQuLF=>p$rLfn0<dim2+>R$;=
z{>~d%yIYc@^vhKcoAC^;?j~3c^<8;=mtAAEk!sTbtgm0(>kJ5q<ipSd!FD)fCx{)8
zj@sEDo_Bgm%Gp#Lz;nw<=^zWtK6!g=QL`vOoI8x`bC?>7lh4osSuldslIEzL|Aqlp
zaQf}~Xa7nqP&E5b-fv%aaI}BiB2H?j&%sHpBg%5hSt4Nf2KymNDteoyg_F`4febti
zhYe>?-5>GQ6gr=%&=F8`YxRuDw+__Nk-7<tS-9u|w3uW~L7CpDDUZVuw8!D`$W}FZ
zc68u4qcZEtFaLp#s+89F{l8az-1~DUogL(!o9^kT!do0eD^L6K;R!lsn~z*h`{jpY
z{Ieo%$5z3`V2xZZZE2n0hb?G$4|54`Xbu=BJPck=s!5FM`WA{b(d%AUWg(4xgFvvg
zU?`{a2DDi=idL-jG#7%sC7xShB4^bO<%#bnx&NBqmTD{!AUnA50+^IPc5+{zw)Pje
zt_j^>)o1sspg(ES;FUB%x+=z)D-ID1uaSYp!>%T+hu-LS6$ai!_IrjBO>sX!_EtHs
zPZ$Wuh{bOX=Xn90(;I75oTPv(V;9GVh_Zw3hY~}xq?iv?Z@F~A5GG<R$P2wIX!D0;
zUjQR%Hf+cnlF?vWRTOx4g<oOD`S}gSB0GjY%Y{_Jq*4p%SKpT!ulz2E*NJ#|79PzU
z+OdB$6>XRQqjq?<pl#5o3ljTwXyy7SiqS-~MHUbbdCt9Ie)|Pdq=cbm_y-0%0%kmK
zzi~^u%tkgdJwjhatH-YHg&qbuA{{oZMrGF9!EB@oQ7PO`srsjC^JR8|62P^OiW4C-
z*Q}GoYA)b1MKfxbc#UjO`{~>C*lf^fy7+{&x-$88F_g@;Nz7$}EU_3ElyL3Jvqbjk
zq#thnV{z>>-=cZvY<I%aRTgaULsA1V2hx9PJ4rU_RRc?VC|ugjuMY>ym$uf}AlKsi
z4{S6O+(h%2Y0n{QR#J!?xC}n~RF2~dvhr5A>P*hf+0;~PDax_PXvDJYXzgno6a2)V
zd>n^iTJKg7y*V$iSg#u4<lqmG|4yc}zzH0V$GwGqqp8jDv$)yDxoKDq<oPQJ+zlP+
zI&Gt2^WaG+6Q94ij$RI8`fz_Y4@Q|W2{Hfc5xvKuQ)0si+9+m5xS)@WGKF)(#A?8S
zz<Yiw0!F5GPnPvey5xASfLr&37mYwMG*=|w8?mNtV~42A{EZwyH3b}WMEtBe49q8%
zYbGdckd<q3YVwW8R&4(JeiKQ|c8y1yy-82dI3ngft&J}2sNhAetZB)vTDn1yNq}-K
zm2v0UuFPBBc1CGLqak0_Z^Fo#!z!cM%es?>HywgxN8Gu`S5>c>T=8;EzWeyw*|T>a
z9!|*IZ<UQ56?9(lN=lk#kbN9TXHwTPW7zJlH-jzEwrd`$A6>3^mw63%PKgbKK7D@Q
z?YT^)#ngE~P?NBAJ8&uU8^OK%iZdKsf_%xGr|D=O_h-Ey-X7dA`1akm%V%!<r1UY0
zW-x3OHV~9aVa*G5K&^g-cie`mgG{n?XYVo%iMo5nuBS7&&^hiYx@E1!*s)j1sf;Ka
zdIoh4&qKXM%Ea+q&yMq<DeX5ioa&loxtXuL-!n4#9^bl47c~Lzx2Tze1E|?PFk*>e
z=whamsKK*l=Ixz*f1&irdAYrS09N$}hkuBKh3`&`tk$>Q@(s4WVqNh64;>atrm33m
zJ5SMmZ5y5KE^*oA;i_8XAemr7X#9<rKMMnVv)MX}9`6QtlGNciQJ^gu+FbImjVv=I
z1-hCeW@0e;-#vqn{pu<rwGgmR9Myq+VQWxLG&-AAQ3><heW~<!Q#1|_l}A<6+!L{B
zZeYq?CoIi>c>bvvjYs9lWDcoRhxvN!!|L`;XljV5AaIwm>-_9xlr`>CI&2oc;#7NH
z4S7|LpNSK}@+lwI`m7_K)ED6ND~v5-XpH~=M(`Nx_(R?}(aEgvcB^hvAH)-1ninmR
z)fx|S{-U9U7|LzHZEU;oZ5FAJSW;NgU@EVBW5Bpc2-6`{<{fltHfs-P`1=kskrLlQ
zX_~t?V@iQ9fb^;yZY|+3>YEmC9RGwWJ=wTliFDBDzNt|Frz-@X3vPn&#sH}AnM@f^
z%|092hcCwJ=em!%%t|b1kB^f<rH%kmnuqj(v54(em$9^x+)bl&OM7u@54S|Sw>{(E
z0wqT~PK)R3HyRY`Kfrv&cqYD{@b)ID;9|QyIT25`y6>|yt(Q2Z2TdL~=m<XKT^uSx
zSDv57Tjr-~mfVl0(NyC6Y|x9u`L<K1W(|JA#@Am>;~rTOdJQP5GI<vY%*2mM6w1o?
ztIuOv6q*@}v@rk9{Tu+&&cLNq1XXQgf+r_(^3>q7;mr8B)Jw1Pp!^==mW4ZizlcGr
z_!3I}Ch~jgwmne-#)y=m2(+m;yHB<iW0Xk6M65x-vAy`PjK*-A*8!9UZ{hrKM=fHF
zTB`KYJ;Y1sPg+TGf80b!n8qCB$?(-6nExntthyLTTJc;{u!1IJ2VUuIyk>GPDstD`
zFanl{9#}>7jio4m*xlD{{KLoWOQ@U=nW@@v+#cxS-!!7IvKQwhl|dtDvzSYQYZ9-K
z)SV_1mw0tK3{Om<S>lNT(R<pkE+Uz_H1pON;Ye{LY=#v&MA{bVO02U?2L5fxz_A=%
zYe82hI-D2!`BPfxY4<a$psg(8HogSi%Tkwrtm#Ua&V_~*KU9j%g{t>-wUpJ*uyh@r
zY!f5WPwdt7BSiMeqF84+p}(J+hl)F!2)y;zc-`}KXke6-GYwp_{1WUOL$5M58}wo6
zfIBf3m9;hfu)XeF+QG18y@{bluAEBm`$cV|=N_dj^t9AbYY%6d6ACK_lXBYVu~E7d
z7dRN*wW>(>CvBE^19XzI%+Bij7mavnO9*xqI?IGb25}z6pC805jeWb2d{R(<;6yn_
zPtZjQuT88w0&F8_`-L*Rj@-NO+ZwU+yjRY7ii?5yt@R@afh4Zpf!CBC00L9cpp_NU
z)=vHCqK=5l>V1+L(P9Hf*~iAy;AxxkuPw7ev`#57NhuBlbeL8}?N{(fk7N3rRvTqQ
zQirdU{+SfmHH#u)I+c0+lETljt2vACukVYWp4JVw8_Pn$@E>J*K$qt?^4vWleSKYz
znb<`Ik*L{s+3e8PvA-K+$!$4b=IeL2Y^dYi(Vx~nWqOzsyP1c&*KtbAS*;E0&rfq{
z2q?7iII(bmo5hwx-Fk{Zf095yfMcqweL{p6hplv3d%WLU4{`%GXY6XJwFRaF7LQD}
zcA<5QqXiwlIrm3K%{)dG7o7#I>7zv|Ug!zcu2~L-uXUk%I8+~o9|AB4;`275wG602
z7Nqu1@jLskHvyKXsNW?mqHtvG4Z~$^;;F3Q%LT#dUC~54S6uD`If8Ub;5R6PQ`Kc=
zfq4<RDTr6F36X>C_PL5X^p?TMad4GUN{99#(~C*>kstCS<&i~2BUEG;xDU|F&c{tO
zM2cR-6HJ?%^ofLtDN7#oZ)+q2F00(M0T<>{dZ_s{3gRKZ0!&`@(NdEe%@^Hjye}X5
zTHKa)|EL$nq&&3OnPb{w^;k<*FM=~M3O{rMY|@k*17W$eLan%R<Xb)B{3Q^I+XKGm
z|J%z+mS0K}3mq6<4AP*Qh43^{%uXqiG_q6f!6x{b9YvRt_>|ygcm#is$Rxgv0@4nO
zjMR!}o|-(nR6e|~mI%22%e!E_K`ZxHDsAuOFSeI<)ksof4|*muL7TeU<-uDk0TY#_
zx-@D+C&VM#IPx@m+T&xhMgFk>{@Gg#Y+E*^bm~#Tj9=XtcUKC0PL4_*JhvwxS|sE<
zd_KCK*l+QGrvH85>D+K9_qJfdAcifLuouxB7fPC-;9+yyjn7-U!NX_Twr6?0&ofIF
zB}l}{M;}akiYhH>Y50$cq~qI+?3DVv((OO!l?95usrkiTLOV72QXa_Th)=z2<H~(3
zC8AfJp(|0i|9G?}BXCtcQu3`CuziPXuEHNA!8EtZY33#=0G6z8esq3ik}PcVUM&x1
z`X?S{G(hyIj0TkZ58u%O3g76U)hpdgzG#<tls{V<+!(=CB9tu-F=cBymIu4USM~)@
zdIjh$6<n|JrBcbkIj_>gPe<x!tz%yJBFk3CSLP?02?%=S1_GZ9b?KF~SRjJ$;1OfN
zt9V$U*MD^O(H#SCcv40bt1hr@NI=}(-&h7m`D5nvJlQ>Q1h|{1s+*`OVrWasr+F_x
ztZMs@7i|eM9^*tsjk_Pkf#tjF=#rha-Y0HaaPbAB)gxbmS5u+SSg!(eM7T|h)U<y2
zc(|YBNlNH}tVP~s<4^iJsWBQ<u}jPB$%LE{&lBS2Q|2nXUG0wJrJi$kcD5tPlJuf2
z(_xqhAOToFem;}}PzhL;tqoLxS{txsPNrVQTlw#2R9<?dtgJy@n9zUpmSQ*EpESse
zKH9<PA&EKg#I26OvpMaUBBG|WQm6n(wd%X81Ii~cnJ977jn9z&ZDBF@=O$`v{>7ve
zQhE6v*Cy3@pCAy3n<q7@5z$}~X!OoJqsMfcQNgRd`=um<dHZx>DeeQk%GTJ}$dE?v
zD4AAIX9|;q{qs48$KF_7@|P2sMidCskE6A|zVJcSW>T^er7KR;Oj!Rwi_DzYxKdzS
zuU0|KaDzgvx|hI`k=*@h%gVsYhh)A;mX!DZ?S}M!x{;7pCe^ml77mi62R@)kjklGp
zjl(=aEj3~Va}bILuOT!jIG6!|yG~;br#()+#}iKr2o}`B&Ax2p0ir!Eo9ej#W}Kq$
zQ6Y)Zn{>TFJrB8C@V``Oem(HV21^8Q4bp8jdkDt}%TLV<Z8sk+qxw%uvRo)G$HI%8
zaMIfBXUxA9HBB7RkN|7j5>8C9Rmc@<b2A6jn~o|xwBEE;tuTdPu)z++kw;Vh#V$m}
z@hiKpUGXhm)!M{&2utKO%eYU8rzq`UPcF(@#Y-nBx<?9Kop}9oeS9?Xo#+pE;IZ~-
z%n0`n(qJRJD%|@UwghgTmZKLdlg>XWxZwQLZ$wJ9-aSrIW01ra5zA7PRkJwz!;vNI
zSi6W-HahIK|Cu<KhB0i!IH6AWeC6d>b)Bx^&BfxLD_%@Im!5v1ZQJx2beh`guB~Zx
zTM1oND!}#W;sW%}_Y>I+7O2H6phNBq?uKs4*|RYkZ)Or}@$XV=dOIXwt5%dkp!D7T
zfI|*99x{HmIsHW#^hPr^u`ZQOwZdNmAEQy|ps{M-9`?{N78Nh%45C=CB@3#^-#cPN
z4Xi7FMvb#NkJK>XXzLQTXudodX*3(Ixg|+U6I1;Us1t71S6HKRWL+&IZ3fu`pB-ph
z{#&O#1Yf5qPc=t>ic?%%Z!aLKR5N;(Et*HxFHIur3p%u*T+^AOUqc5r?diBQ)}(B(
z1l$pvq#y}s1o}5V>&GJsJlmJ<tT!{_T)DGPxXuyS>Nm!@twPtx@LBMdaUbuCQynuC
zMVot8ac%7P=J|z4_xz~a{tg_Q4*Aq#6rf{!_%GMay_85}_pL$h!7JlX1`2&`Id|rA
zxY)?s;J(fywjG@1X+q699fqMJHhCYz-h!?lgL$t<l&77RTjRS8bdQ3w94H^sW!nZj
z!X$&=+7tayC&9BXu%-@1^(4x}!lFmUF0?Sy7<)&Pgie1Of#1dfvvEWM9TY8F?N{yU
zLH1I<9i`^k0GqVf#f)frtCU7@SoZc(hsxYjQW?2lyw8juxk^OT@$5WQswA!2V~>mV
z(m(pL->G3?5f1*V1<18rTSZ9%VP{&>Fw0dF-M>A>o*J)X8GA$ixtiK8YUe&^%;hTb
zk4G_B;r@VB7t0j0EEvN<hZG()8dc?Lv9~2j70-Tj6iv9WOa!yJ;+|v2)?0eS;4XNF
zE%F=@EPi>5d*F<lW$!qSzf}>R^tH$`%hBd2^I>JDc8)J&s_-dgEz$cYPifzJ_~aLr
zFD3oLQ~ofBUHZem*-AGzL6*dh`_GO6UF(UkbG5?4qUp=34X>bbc&4nGYqJ>2i2?O9
zsxFI**<!5-dNmhyA13D$`4a@n->w{E0sf9dOFsE?CTux%G8Z8EFkguuxB*)tWlVB|
zMhG=%JH=*f=BwB{M^_E6q^74!e%_<o^Dc|Q>rfI2v+59E12bh5a5o;UJo!)zIpZjT
zJulbXs)*?QLOe1X99Oeu4*Q)R;jC2{_0u?eTVm!wf3!#cA-p{p3poq@SeF9~{QBt^
zt5B-py7$xUg9j$Qd9bR9+JX8dFwmbm&KJ~@gLxh}T1Mjnq|4N?kP;t55s+B6wT>o1
z7USf_`VKcrUfPT(ba}cZDFj|V+5}BM5{Y@T%rq0)6YCbTt}5p<a4xFmm0Vz}v~%Zm
z{%wqx!D11lQLs0Nxc`>4`I|hsAgG_e2I=JGI%5N4eJJI@_9?4sej22uc^3-m#Fq|(
z7-(3udBdHyD|4*dN^EnP(X!Tjd$&UoYoDlWbC;#W%L4A_=_((JWnwi5XYVu1gz<R7
zDZ6pglT@Du{^@DK-xzJ%^M0gHL{K&-d(KD--$T727!vtVAL;*|3qT+@X74Z@iTtbC
zAZ{J$Lltf7p-6UtgRE0DM-@=v(Z*jPT4!zV)NEOB%^^!bYLn4LX#wgR#%D)wsWV;9
zHA<9r8?ocl`B(eBOpwC%Y929TPWM(RDI2N9lIPu~!H^>x_jPfVg8x~UcGyT@OJ{s$
zi{@@g(|p_%tek$={RaKSG-1lNAE_duKAzB4cJ^#qq=b_2SI!=NNMOQS$Cd_inT-6?
zLjyZ5Wx{Hti<j@$PvoBlVFo8Qb^Ie27MY?g!pSt+V?L{=H^u_`Wx30W#LFaox;;GG
z>{n^zTBePe9S(rMQo$Yq`tVW@-`t3S_yhh8gcy68gd{-ZoT%WUf$=CbluUOCB=aII
z!+9TUQ*)98c3%?;z6lzEw=spRpX_@X2hKqY$b&IK=?}>|%anxDTZ|9C&4#2R-<8Ea
zImf4-?YuM_1CXqRBBFc)Oi%RJVKenHU@u{EEk=`g(_Up6={xfgeI0k$kB8vY?=(Ua
zm`ho6mkB+Wkb}azTh|*Xs04#n7wGTL?#=z+tsBnyc8>-&fSQx6a(WJG=La0GBiwu=
z^`E&&YcQ`D&*l+p$>IX)AJCsRFrI}zm5n!38_9ycA?!6qt9P9wWjfp}SqIEkdEB&I
z|HMoxgdM@@9jHU7D~Q~7%1gnp>*wyZF{tHHMPIlHgOJ<A3@iV~=eI2Fz*iv57R-Ww
zDvBo+k1KQS7(t!PT+`y(B#a7<Ae(~6rzfoA1f$d*+-UjwT>Ne~i39`{34Id)NT)&6
zg09}3rct+bM+UL)j8=*fvAcQ6{U)_6IMhRJ3l+C0JjgM0y*_Kl*Q|FkAVz0tQOYp?
z7Wq}JyyK@H;G2+@wsh)vK<KuF0;Wg9q#EMrlFCEs-%r-M%E;RmTi49So=^E^UOQ4z
zef4Ph^3SY^i8TF4qhKu!Sdt?TM(H2g(UbPE`>V&2o7bx9v=WMKPu(~nGtH;}d>PW|
z3rY8|Fn^E>Sg{GEc|#XQKU03qU7U!FoO>Dce&%(Z<^t<A0W(Z~)qoQ7Zj5%j6=T}3
zv}y5Hq<cH;ZiMmfh*Y3KWWDG$WNE$d$Jn{yKwF1Bg&$-3;}@^K79+}oTRt$5nz|C;
z(;3QJn35P<nhv{4KM|*P)}1QNAaWBhLO<|f+}6>W;iKj@N7>a?!UwYpy$lRXCLUf#
zRRRZY3>n+2<s#5Dmz-^HF7K5N`_)CIeGWO{JwaM6Gu!)>o*Ay-_%)_|x^*DNa!=}8
z`_PSv;>Z5%{MI3bAn!Pv25qfBBNbG|RgP*7zCwu4B6r`*)=n!mKiCM0tS-bL18b@N
z;u&>MPd@$IG4CA&F4;Vte^3F`QK=de&~2{y41c1f?Ul>Gb6*d(&S?Jlh~V#x|KPH9
z<M;~qEIk#hKg1U5%EltANTN0-mUJx1wkI(?W(<$p$;<G=sD5@Z?-y#9a&<793XQSo
z`Bsp<9gH8?CpFsP!F+)OZ?n#5#Dh;Bk}fy@JYoxt7}ZWsR6awAaHoCQR9q}=n}g=K
zj8f2y^0~)EWO-Sh_;a&zxLzK-oIP@(V#nUp%GmB)1{jGpA3bj+kZbYOD)kk<YH@I(
z|LWm{L#S>EOaHlP@ByZ&C!5DFsz&H7RKf@H=05}BoTlYp_+b=3J6QFT{RiD#XpH&4
z==Or~1Nw|dJH}+5@}iIFlT*{&=?Ak5+WK|mgvXB9EbG5iWwD4IZXrnAksd3MXDmzn
zTVKf?iNmRJ@yXJR0Lwk5Nmg%1olb%Y@G0}~d)Edti&)`-z#RoFd2wfe4CBi3^o<XJ
zdB|x^{rSB=_M*C+vgZ^<GJfFWt<Qp@JbT(D!*u?Pc-jln0}f_8p)tn)qPh;g0@}E4
zclQ5_D*m{%f@$j3|C@{uHXm-q9!afxOsRh8Gk4}K?L@EP{Xa~H(RzG4r-k9ZPge+1
zWnu(h&C2Dbif>L7EsT9Dko-PY5apxrt(~ts9e?hr1^15=t4fAR;T^7d?Vk7Mmd8w|
zc#m&{YvKQ=##8vGnqu(9V_|a60p7#@<C6klc{u57Qpf+5^NB&@3Q0pA)Ot<07dKow
zmbgp>L6iTd21HeC-vpGVr*rbxrCB}-B?<_Fmpw=X|MO;_vW~_NFvr_btb1lsQoXE`
U(KlZnG>=$XYTByR%I_ln2eN+=Qvd(}

literal 0
HcmV?d00001

diff --git a/doc/source/assets/images/logo-blue.xcf b/doc/source/assets/images/logo-blue.xcf
new file mode 100644
index 0000000000000000000000000000000000000000..fff75ee21d4035be50343b3ff766966582822cb0
GIT binary patch
literal 33947
zcmd^o34ByVw)efgq_ZzTf+2xm2#Yx2XoC!l2#OyQopBg7&gML4#I2oCah<1c^x-}z
z>Kk=F9LJu;VO&@OvM20WJKdd?tep_ZLKYwigoIA-_xqo!dwWTmfbV<1-}ip+gWt`q
zI(6z))miG)sk(jdqmMoD)btk~d}R6~k3IgdAP8bF{@jd<{w3iOMf{nFEArMq2m)RB
zHwl*p7r|5HG~p!!KOOhPM?rSpV^2Kr=)?0Kede);01{9x3Ui))?#0I+p8o8b#~*v>
zn&>%?Jo@08$JabFeGa?Ld*;#A4^02|{BN^=VG`HNMc1I}>M&K6^68gOP}LWned>V+
zAA9oA>DMc50r+A#pbVS${F9G8H~q0EA2dAtEY)B0$Rp1_{G7joRC_FlLqe+(ALM`H
zdO>*QTAq1rkl+2xCtfBz{rqDO{^r@|9(d-t`A<FhC}F5Lnh=3Iv0uU!DW|DQl$^#*
zATbaQ{fow>q+^28u|es$pmYM#L|6HzLqe&qh(2B^M7QqXX@B>DtNOJdyn=eKKt*23
z2rXA_5QM3#1z|3(8$E)sqC^nxMqloKK@gsD5bj!WwGgkLFHF$S6w>sWLX3X+w|i{e
z{nAjEt>AgRR)4h+rS}@!r6|eU{i$A~&k)plM_zqZxvAi^6eoFm*6Y>!X#})2H`djZ
z_e=4T*SQD4i9)P?<ZsP&HI?OMRw+^P5im)J)7vZRt1GPLl7c}FRp}E2jo$mlYBYE8
z3EQy>tJQ2OvPnsj?;X8LACE%U+b7#fK1BWDBlXqgR;vZI9g;@!I9i4!o#g9hcxwIN
zn>JfxldV4YUj2hjAS7B{7SQUDRFd;_&EdlZ7YTb0u;T=k{`|YP#$(kr$LboJit3M5
zmRnWU^Pp^M8Eh^tC@L;4C>)j|B;T-%KGKH1m6umk)`&Hp>WT`h+Ir4nHkTF`6&075
z%F0R#3K;%7dXbTLw=~sI7sPT^g|FPIwR(VECYGtpPK&v$=ui(4H!H|HZ9q=2sw_UU
zMYM=kH&6<xx7}b%6ng9a+40&6Yot|G?yD#l%XKug(!y3kxxi4=dUp|VM{9MXlhx>@
zySlQX+^QkWlA{hOQi{+=6Qx(FEw$B2W2vie5}Ta$5ED>Utl4@<+wqyXtGlba2kNQO
zd#vE4$~sV9QB!BLZ2ZFqf7ocT)zzQ^_0v?;4?#u<I=v^4@f>t(>MPzyr-t6Is3$ZM
zs1rz9Ai3WJh$K@{U0?lUy-q*;V<brEWyL3fqY<?F!Jp+G;}y#*YmeQlkJ1m_d#n}`
z!jOxOoraESpmHOhlpJqTx=~Tn^f?qnh3*c1LX2mkDKNKtq!?hU^dr?Ln`-4zdMav<
z0a-)H$G}xWE-NW6IMg6TGi2v6+c9E@8oaEm-wzFlK!bz(>(K|Rg<%&Ql5yRY3fHUa
zcSD?!#NyoqQxoUQiVj~EQDb#m%8C^{R}Co|<VJ1pl-qXiq_&|=7SZe}EmRsGX=;TI
zR{&jQ#i%Nko>sC^p`)gfqQghz4%i>w2IBxa6C6192cQ!t&;Ob<f@2p{^tu_oR)68c
z0-GX+I*UF=KV+d{!K8`{Y!_kvS|LL3`gJae51LR>(^vpe4Hq<m7{po9<dG7%ViYlv
zLotpu9r-aS#*YhNpIk9$8i<6@J*7;`9Hc$<yB`N99gpv>XYF$}a{!U)@8ev5&zDzJ
zAFH?7YHaeLxcb_F7KK5%4>h8*(Ejp@3Rt;#%vHk}#iUYPOnoD}a{a7{G)rgol~<_A
zP$QVVV0z=_?#<L%qE%xd@}{D41zz7&LtIzG6nz%6)+}0FWY)vb&L~0DpMRqh6)|7H
z7MUGFml%gtB|ei`G`k_hvkVtA(bui@H89!Q`bJnH6DDS&(jsf8852<nMA*w(g$iyy
z-dJDXbi81_{?D=<(G1rjiIQWm{zyT=q0?;m8oe{Ot+nCnpF+aJ<~pXfY|>OqZby4b
zFJ{+hXuo&I-yn^PUy#9&k=96QQVh+}^{7I#Y(D_8G?V9(L0HQwq;x4B%vF;`-FFg<
zuc<f-SPEeF%J$Y~Tm9M7-CdKrJl#EJELmpjC*!(Gn5ADUF6ZvX0C!`6yD`As7>56B
z?(83w?0uazpBS_TxEq6aZ!fu<{yheb0q(}&u(Y+<8fwmwyXoI#P#fTG435rI?I&Ap
z7s%bX%>csP7)J6=ooodzX@IW`K)4%&y}9jpvkks!n4o5Z$^ds`@cwf>n!ET>=ZR*x
zjE34yayOe$2zO&}ec97nw+;0@)osUZqRrKW>Mrs(u2Umy!exkR!{9$VJKH-t+lpQ_
zyxRdv47H*54EdXZ)~c!+hD~k4-xvlrcebB6-g@F>dq-{Ci58pMW(VPhQx{Lw*3^o%
zo|<DL<Pt_?^pRfHx#pHuvDI_Dxf%HGrpCtlT2-yDu0d>Y*VTYNDr_={jK2F+2l%hH
zshV{*4={nFYIHVXbd~*t*Qnr?b^<TKrfTvvV)7SlZlD~aarJ{IunB|vjV_EP#^!6b
zMbYT%k9AYAofU&EwO|X{Xl^;q`qt8H(=sMiyU58HV5A23Kd2Fn&4vD-Z0is^Ty2mI
z8w6TwBNwy3v9G_czn@%;!DB;%YMZmU^<-z$fm|`yd7!EDBq*p@?=C=g@Gu6C1!yV|
zZEb7bir%=kHn#zZ55WZ_co>8Ga}IMgA8$MUnn7n6ehmpO=N{m|!x)@z6rCU}kZ(D0
z;#EVGVd&Kpkckb0tvxZoJ&eJzyRNH4?nQHJ$04W$9E@RbH!+&YqNcIe%N>ltalEJF
z1RtWO`NRp}!oL{A6GLd3q)`X&)6QpNgX=`+3C1-~OItbQ4ew&`lta%&8wAqmZh$|Q
zQGvmjeZ0*C`N6puJSITES(0qk_*hz~OaRH<N*Wbm1IbdQ(NZ+3VvTyR29l{cI=Z2$
zOyw|?78!T21+{HWd@NPfGVaKGMX&&16EDG}Twuee7|wq{3Lp=>dBDTa!T4=8ot*KW
zmXl3}7{gE#MgzQt+M3Q0?o$k|4+=?O5NmU5dkus$Ttia}47IMqi<ywALM;=YtNBDn
z^=qUGuhno9ByGM3F~g@AJoSoNwY8Z(1pk~Ln%ZQ!1C2C>DeH$^SuZpnKhf6N+1kkm
z1cL)oCy?Mz44%sN<6xfH?1c@BC)};XASQ;|TIv)xoDL{alugqd$!CoLrQj&FkZ991
zafP<Ya8FxDD@@VX)TnI~n_OtFa)dh&OfF}rj;$GHb{xv0VdmdZr>gTcG(txpuJhb~
z7zT^G+gf3aC)(O!Wn@U_Nsn!38f$86>*{K&csDR%9qnpwYwPH$*<{!)8wqj#6uFP#
zw(6Ri$^kZ7jlo&i+udILI)v$IJV|;fPlE6tuHL!<?mrCPl02~f;vupJnnqi>|1j9w
zP={vC3*3JgMyyQX8=ATQFu;EpM&9ZHpIe*HbN^wmxAb<O>TEkd(BC(?Pwe+KlK(Kk
ze;D9D41WJ%g#R$Ye;DCEjKhao`iAV1bEvQVpiygt|1f&1&XfNbsx)eh@E=CU@iU;?
zPU{u#kjbbv!haaWepla_)7^IRAD$Kf;XjNc)%|CBd%90`g9knW!haa;J!b*y>TIXw
z2cRk={D;w7v<uB$%<Dhh)7{;5s-vI$M=1*7Ka8%@bLTrPsPAbz+uJR6i(Q^htV7{H
zJOeH^kupTJ(OcZ#C-&L<&opi|?&<?6hI^`GkQ~TxZ(CbCL#IaJK#YT?{=U<_y{FIg
z^>v&Dwi=Y-2nQVf9qpK5#de>I=6RQbexCKNr>FPy>E0efS9SS1J5(LM&QszkcV|1O
z1HIHJGV1PuJ`5B{Jvtz&PHDQ}P)-gJN|%DtOr1>Vj_4A*-57N{4Q2?8fbJXJ+Xl|`
zbjNi2db*?dkO!#P$%?^?4)8+PE%u1LE(`+w(K4(y5BUru%+TmAB=Q>Icut==3(mOC
zo;l4rPK})<sUGVZQV&Ie$DVG+0B29{nZB-LSWh{Rb@h?-RIF!q2n(}>(Q_PVs%}?L
z@7bO*^u$%h#L2tw0TLXB(Opa;776Q2Z>~{i9L`083-%mv;4qBNZH=di=OEv6=5($x
z$~csJ8sqKm>gwz`O^ZHEdPYZO=K%DIqxJUHK?mS4jIK%=SeMx4?CfaoIxl++qoem6
zb(xs%0Z|~sV;EhWERatD`{Y?Z&jJh@#5ACufP~>PjGhzdf!M8vq&nMA%7`9}5RCTp
zo^65H;4qAy7C^w(F3+isw(+sFjC%@_o7(J-peCD@CY#Zu3Qa<#l@=X+=b)F$IC^AE
zR}W*4s>_9Ov?(M<b~p9)p9MDK<mo;$u!(c7eKLz2H0qvVFZUNlr=^`4rHVSyWsETn
zb-|p$b!cC|i~9>yZX|g@sy(Os+98|acA^Hu?Cg{M1@w=J#RZJET+)PGhQl?1Y#aW<
z=;;KKy4%@v`s~@3Jh0E1*K$@CJ6a@#VTzhZ<Tc$FU|MJU`cL=wu@R{m^C%jIzc6}E
z_Vt2yVvn!)wEDD%_(L)fJAAUYFuJ$*fkjc>nx05*FvHv{7~Ks-Ke1cW#kILxhI`I}
zWI}f|vrHHF6GlhTARBBCnU>h2B`ZJGsp|Bdg2KVdPhR9+!Z>If0GBX*oarOG!Z^jQ
z3!NR^gI(<%9i5O7Z(eO2Y=9D<=^JP_87pb<@~kvKUczy<t-bvut)<BdosH+uowaR)
z3_V>;73HZ8Ucz&}bC`Pxqt{jqhF`3cWzx~hy@XLb<A7CQYPEAOVH{}%3MSwl?j?-y
z62_73FcRp?MeZexBR%9G&R!fInlj|;A{SwVi!j1P7!?;Gif*+=7a1)^J0o=(HFj3#
z2_vFP8=WvIH9bSj7)ei^ln@=E5``>myLPEG8f`>W+@z_quUoWq`K`;BF8cQDX_I0j
z)S_^;(2jahvGIu$Q#0q^^uUH<+bOBPx%jiyOXp9Y6s-}3>B5j05i@a0M&_LBm%Utx
zIcmiA@5`=Di;ob6X~M9miAnj<>+9D4$A%{8s-tPm!i+?nC`?6(ZbIfCzuLNeXI>BF
z<FId7l9`A)6VM}{S|e(FDp3@N)v;6V`fB^GJ$Z*Jz;fruOQy%8(L|wFR7FI`#m7Zs
ze7XrU-pSp)FaN+%(-4qc8*WUGQ40w|kEqtgr(8RGYU;$e*u?akHtpD#pMT&mc3F}n
z*HiP8(T_NxOH}C+({KJ{;|t%PIV~+??#sEm^YZieA1p9A$zeIWDTHx#-kKSw26n%w
zjZ3@buba1S+4RXni*Cr?vSV+)nD5$u;BZkF`K<mXi>2C5H8xzI0{XE+zbY#EroV38
zv3u8!?OV5el)Gb3UcM^-{QiSS%UUm-C@(E4EG)&6Cqi=dEuS7kH3l%|KW*BvH!pAB
zo?Sb4?%umEU!8w$|AB)?3X6&gj~+gB=xAv*)o?#GH%WsE4s~4mM_YF7Lr=s!)jnTd
zzBb<j{6pd)@u1_t{sV`Ktmg=S+k%t`h95KKSDSb4%TLHx?e`tnFYXuf-9V~DzejA#
zG7}=BB6WyL9Aae3^<RFyH$O68mFL@+C+6vBs7FdV331>@3$oIurcVLlh^S4x`rn9g
z+WcYkdiSoKyLRu{mzS>r{=tGWCp?_z(I2f?DlYXc#^$j@9W&)N>VP`m3G|)YbGL|F
zoVnX~QXLiR%W(>jb{00<u!LqUsAE#+ZGZq(`2%_Tc5UDM?l15B!JWT+ck}jLs6+if
zTuiPi0_tN|YojJ)T>l2J#r$qy=l=1Bvoq4Cq-V_j;U9AeA6igEQ=S&etB#0HOv#w{
z6BH2ozTMkCT#%8R5E~PlkespL!);Kk`~!yy+kmbS>X=GpT>sFgxjXlQPTrocKV6uf
z7^zXK)SAe|^o5^(4f*arc%-O-c7ioz9Pv|DzVPLi?SwDp+xP9-@-Nd9b+A2A=p)^m
z{^Kp+1QTy*O%LC#8&*fBJoV2lU+>}!8QJ^wr*kJqqmG*DM5WCA6jGr&hmIDS$~&2>
zuxsMd-`u=|YN+!^^7d@|?TjSYlNLG~ku>AC+t9E4{Zyr(w1QP|XcDHs&4uR3+nxJF
zMuJAr34mriK~Ocx`cRQ2JZ?P4jpw+UeE0rCg&cK66F2p(%}`%RpSrOoGf_+3ASKCM
zL*0Oy?sq|*OUfB-40iIXpTk1-GU+?^e*Mv$<VfE0$mBU6v7w^lhmRIpYFUjTux;j#
zH*Ct?v6~5hWZ%v$cTS5(GsGWl{M2QnTvVl?*i=8jU1^U90i|Yr|96|VF%`($v;Ez<
zsd1PEMR7nC5tlmm-EA25{)2}LO(*Tlu?~qEUF^ivtYy!U7Kr&>`*v=9X--;FOr$O{
zCMj*sOIy(ll%v4LH~NM}l|~mcDRaR`fRpO&-Ld861({P)l2fK+E_ex(1y?<a<|Cn~
z4o&Qo`G1g=dhgEMe>|~t?wq+xpZEt;F0RzHZ5+)kW+}Ir^LhJr@5tS}$+&4VA3rx3
z+B%K`lOfb+w_+SHy}W&UckkRG?r_l@!UcM;u$=Gvjfj!S-~Kx(t1jP{w@*#8Mg&>w
z(b9hAY{^D{MlB}hYxYwUhl?9{0p$DMmR)41YD@^2Xbv1y9UM6T-NHP>gSP=q+_is4
zWlUjv_v~g<fjZyLWLQve^zcFPp!-Nk1#MnM3H=cNy<cqGwP*LvueWW*BmgF{3Gzr$
z#i=S&apBQ|VhfMo`bAyhw4Z&sb=$TrU%qtLqDONXo1vzMi(1Jy4;?p~Ojf@B=n~aY
z6El9Y@$-*Y-;kLxWBz;FnE@O;ig_L0+1cB`V>qZqR8s27TQk#B5)&p){{<N%O%F}X
zNB5EjBu+?-i_&VMl4pMcBE+I|%wL~@xFaI88fcIve(Gand-;c~+;xj;VHh+2{C{rV
zwqw`64(7Wrz<H!T{f{rc+ML_aXltI_?6Ea%hXcQ$(#22C$eKNO{(|q^bn~+0W$v4o
zE?I~IOisF(grtedlT*{DPD`2Qo|>LES(q%i(6A;#C+ft=)F@A+E&>~i%W(Zdn4wSe
zUn>1HNko41JrrlUL>Pg;N-1qzs`N3EO0UJ8j!q_p<RkSHLh@eo7JUTHw~~M#qZi>h
zZO`MpEKvq%ByY`qIC4mk^IGg>($QIb5Rn9&oV^VgolPkXCjzz}d$_@{B-FhRu-G8H
z36igdfq47TlJ9wJpvTIsAxot(fvl5d1MN(bd`47=2_gxQWh}_XK)jV0I-R0Q<7Y!!
zsUAzRU@T}o1I^H*<3p^cENPLGhy$HJ2L>@<uH-8Kn3C5>z8<iTl5@bKp935RZHSQ5
z@koR1JwIn`pP^T?gGvoV!Zidk>pyxQlNkqi_dL%;O1UVUXU>HRkXp=;_p+gG2B@2S
zsSHpzq(|SCa=NPwOwoe=Dy6i~p)x?~2B@2XHc_E&LHS4n)Ga9QZ7eWEV1GLa_%Q}_
z-QD>K_RFDe3;=a&eG5B~P&byxxG&JwIn>Qh1nTDg3NYH5RvL!7xoH<X7zTB_@D^a;
zs~->Q*2+MfJjC<~HrJqTtTkk*6ndd#-7FiZ58c{}3Q#vcNr0Nhf;t(9(}BA6UqLp6
z<ngg2YsP|T2R#OoM91x{r!3hdC!uccH-SM6fV$NHOi8F)KiEe}sN01%0fxF6pl&P;
zbu*BazscA>!vJ-2mqA2OH>N3&*@f!2n9Ml9YyO0ZlyXrx&zK7pAhnnwZ+$`Cj8HfE
zQW>FcNRPfN<#bmWnYso2RZ1ylQW+t2Bh<}E`!7(ppnRke>K2sub~P9yupO2J{1_v;
z?&&{>?KP+y13=wQZ^!lp)Q#maZaeL?LEZdBpl+U0z@S=w7}U*ULhu+2gSy$b0|vhO
z@t|&}8HkgIm<}Q~hq|%Wkfl<no09dgY@j}Ls|ppMZhn#g(XQ4gP#*(vI#9QvE69eB
z>>W$8eJsetKr@W!xRdpiCA;J#)XlRU7{mamTRXs%gt`rZeUyZ{F&07Hj8He0hPoNS
z_8}4jrJ-)v*VI5HTtgr;d)sy<GY;^!9AqM;TokrH=RyTYEoR7J^e+S_E$5<RVkgJC
zVi0GlgeihkrHf0Mnwd2@%au7bB~C{mO<dZ%B`dNgXS-G`nU@v^kViLZjx<&B&Y8qA
zDf1{ZFJ*LzQ=6Ev;I>sclXG0FRxX~M8cJ;CElaMymOufld+uKKgF6%|8F1Vl9cc3e
zTBL-6t;umR?Ax<7+0NVV_`#~X@5#~Rpj_@PpsayeS(+^8tZT1da?46!hSX<$N{rRS
zIulc8FJ8F{_1(1C!NP<MFk14=nWPgmJg1W!DHGx%seB^u7s}_Q@N)E0C)pQ#YsQqM
zXe}_3!c(}oZQaU6*HAb`A%4(MR^7HBBT<W{0x(gs+lwAtJS!yz$O*yYVp70HVh~It
zIr8qFpB9G*AwGzPGYnm=<mg;;LwX#j#)TUPZB;ydLmIUjD|n*PZbU@lxiJl!K|Gfr
zIqhrar$nm47h?~j^X^#`5yga~j*W@D@1#dlX<(?~x*09GSI<H854?ax!;Cx{1Q(@Z
zCnEZ?1YP#qGGhrbjC3bT?w7AkQnNw`GgP!F%)KE+d&!!`-$~V7w*45%ZToII!y9)%
zgm+VV<Q36dl1B8x4`=_P)Cg7>ZaAM^pRBoL%{A8~5+j1;L)IH=Dd2nmt+by5#K3sM
zm>dvu7hE-3Kw)e*N^;rnnUzQ)XCt~sa(%WSHOj9@b0lZe@=V$tlM!Y^)$X}wBHM*h
zI*X}>k(RV5%$YYiiZ->B4q^sl9mKwuqv@V`SJCz!N(1u`n-Q?hHDdpG`86q29MAhQ
zRk|=|k|cHh<L(8S6Qcl6033{+Dh<s`*|2)~4Kq{YY0D!~LBBX>(sgq(QWD70Cj@n1
zh^g?zglHY@T22g_Z|!WprC1B|&zPB+$3M#jpB`HndcAn51TAIxa$H6k7qAqBluM0z
zS^m1?<&+w9Cp-#elCj37`;|ei#shCjz#V-jYLju%V><zA-yA}87s}T}!~wxnHJ8cH
z8dFyp-z3lpmrj({3P%}L;vZoJ->I~KJu^m<!3iTtkV_?8=0>2>wNQ>hAaVnV+yHro
zPtbCbFNtN8aREy~NV&im1G>sq=uB{z%qcbKPPM=W14JHF^Ky`@@!UxgYLC7XH3*nJ
zl|nQ){cjE-x(nrNBG%%;R5h2$&l*!#84ZN#A8T-$iJVa-{!vNror#=1$w88Vlu2-0
zD&aCW0+p_XavT7W8%g9w$TNI`mUMhsDx-`GSPDYQ1;!ZBRkliItiEJUsX=$D1(p~g
z@}QcRgItYM<0RA`eJ5%VFgsHw8l3(&hY;O`@--3b;b5wo%j9Q`sjG|z!t{?dIL$=P
zs1pCEB>2um&dy><GLSL}j!Pw6=0>2>wNPG*L*ybV1g3pE7UWuumR9GQSjy146OXL}
z$G<`+kC7OcNXvCi7Iz<buATO+0}js)f0L1xLF;!-Hf7S{@JzW5|Cx`SDtWG(a~+mD
zPFm^8aOT%M3+62#IIVEQ;GbdmiT+;7E9l8Nb}Tt(X3V5zzb2<gUVjR+{9Too;*(it
z{5|VYdUm_Nzw(-X6vYvRBD^%~`V3_RF4iLgQ_lhB18}hcjKMz7uycYttHcvYtZUP!
zX7MrfD=lXGyG9|0ywXWxjGr)RD(7&&GLBHna-@;OBpE$nI;T8lEONjxiOU8Hr;s7Z
zYf>s@OS;gJjjkJRfO0nw@W=`k>0kV4a>gGgf+)5=QQ@pg(JoE)C59VV+{x?+ZYN~a
zB%>4_Mn#St*RmUzQ7Hu<DCMDui*f?VbNte9l+QC=2og<VjuLtV_fY19s0xyJVzx6d
z7XNxz9=}R=S(@^wHF1h2Vq7F$8Z{zYE^8fT6|T48c%n<WR9%v_Zc<PmLW1K!zvYE4
z$(k+b6H|jm7|`iU$eL^XtZPHt8CR!9xF+0whtl&<EuE+sDT||J#Ria1NsK?TEhI=6
z!!{dYQL#A}!;UA!Mq{%_QIeH4#Oh;n)FHEr+);T_k$Wi5JPFdd@h7e5oc??69)ALi
z&hB4%%lMONbdG1$%F*+7g5=|%z?AI=u^k%5N`Nlu6r!^|E0$c+twd*eGN)eBF-6CE
zW1{7gncMISBM}dQtH<22b&qwgC@*<Mi5@J!JmkBeq+EnAvNg3*`%*cj2Hklrcy;`G
z=~8Jujy9Bw<G_2fGZJcXytK|AH&GPi)8mPYpg~>%AO+R3aE-oWg3zb>Su|cQ5w+*y
z8hwud1^S5!mM173FBb(oqA>dIlW_Jz2Uo-aoiKiuj<~Xb6?$JQW<xWe6<E;E!o#4W
z@7Q6-(imF7f)^&&D}a0#l$47oh-}%d)V@?ssX=#M3tE968C)u@$5DZDaUAf09c569
z<E5b$7?X1O45Sr-K_Y;=93TbQS-3{up$7(Nh0LPya*3!t7uV=J^ngVq&<d1}mx}@(
zQ5b#qNjM^*^CjW{X~lS1I*G~xR_NWY6<G7n!oyz^M%}Ryj@2`?g2gvXu2%s0E+{D%
zQ4rb6T&aDjoKl1CycR_O&<aLjY+8?_1m)s5-~&5epccnVLn|;Q<?<Ox2?B#ejCVOe
z3b3<qjlM$<jL-_1MdRfXQF|_~(Rb(p3tA|YVOnv?Tog)(!sxqC!bt`l0}%&EE5^&x
z$wd~hLhp)JDAA8Lc2Eg;{09^xN~D1pNQr>7S%dPLRPe_{BTAq_c=9?;n?0y3%Vo&q
z>=8g%^Z`7!0*jGG*lL@fY`AC%BC#^KR+RBDh`Cu8EiHK&eC#FaDVvJgoWWJMEzF!0
z7aijdk!UT*LZs1sye=~>ZEB`JLJIC<2))JguDxN&3V(nUOivz*xHL-|JqB?FV59mT
zf){856qj6g-4YhV1;V0`{`h$d==F2vT+af`KvWbW2YKD8%?Y9F4~l|i>+gRIUms89
zQ9+C(t^kCjKoG`vaj75Y5<Qn&i1EiefxT)iX~39%$M~b1!1nj3UdzkH7=JuK`|nIg
z#1+$c4*{WA1%18?5Q<mALPph!5H8YToUA2GZ$jjpglL+r+7;WNb2?d9n1+XFPf~Ud
zU#}|`LPvPA#*Ed;q@447T#B8{!ITti4}5!I9zlaFfo~3s#<ep$Vh3v4oU@^HWvz+!
zAK7VhhLrf49nopC&xZC}w(MyCA)Ypy@1bKGgB|*zjZnVGb4IlPSdU4Nov#T}ELW?m
z6eW^FY=CK81ZJ|7W9#tPIjWp9vKlD-lG{uS*JidV`;5F>pa?@ARASJe$hg?v3{h7U
zSKjuKxrP|jFF~?-Ix!S*(7^&Fc|&K0vS|P?jflV)5x`7tW3c%)0Zv^hhN1ScdE`G2
z=?N7cj%z85iPN!o!9SIbQZza#l2tUAmK<^_$}5qQ(D@?|Qz#c9xFzbOd@6~pDasKv
zEH3M9oPUy^>^Df%V0}cH-z_Mc7bs&pX(;o%7G*PJt@u4GS(ghl@f-7-<SRv=i6yWK
zOW_+w-6yh5e=5C6zET+^0=N`(C`TCdaG8jwcE1TU3ANMlgY?n&0FBfTikHicrlaJq
zoSsr+^gTd<#{8chD?MGNk;fY@{XeG_{sRW+7=C7YlYFHZphZZl4A8NVJJT^%3LP`h
z#dHimCgrCR^n*n39nWB4O-~xZa#sdT!kI@pD2=`cXfUnvQ@mVmG#w>><@A&qqwfI<
z|2Jc$C(JbRc*CXt=d|M2G5j*^CizM+LdTF+8KGk#ccx>k6#8YPi|H7Cea4SLpiS&J
zgdQVfI>vHW22H{tOFAfxz6U5Xt@2a6Ty8WSC4c4glp3S&0SeGDJY@Et8!J6lrjf@R
zF8x2J6-CE<F|kwqt83BkR1;!-nORf)i)j?do;V@Pw<3G0-&LbPUPdHjXYzH7$kzl5
zx%a0WmM_TB8bB_?!-A`FrskZ-5@`B_=)jseA%_t^kCn{SNfQFA<AiKKe%93Kfpu^~
z4%(zZ@4I{-8aK*aC4o%vLuE<?qzye7Qosr-ox%m4G*dz$ZRi1!0#;DzcrWnynNwc)
zX+sZ+6tE`N#li#p*n};d<lS`t83JRHMsU%hN@7UhoqTNMKVD(0DnddTM*{ZcC@E_~
z94yES&)@@-F#S{H3g*ZQ%iwdP02f>=f<a#|(}KL-)?~Zb5;*+eu7VE?eqv2NG#U>~
zTnOb5VUO3D<Q$aCS{rV3$=R2$A4Yntli_=F3GDGY8GHcb=h%3?#z^ECMU!=<GLe<_
zzpqv*4^_HYL_<n8j@$yWgmEyu%WI`<3#g#95JpzAZT&y7%l{8J@Qp<(yP}X&&M`1Z
zi@`_-<VZ2(*nA8O6&OrD4_l5Gp+ySQaJZ5@>K>=pAXK6QnyYZ9bFqZW<fB<&84au~
zoJu8+x(7;?5Dfd#3~Ri6w3LpZYq5N#<99eb$fDmsQ43UeyfoFH#C|YCKbncVqWYI=
zlfuR;>+@PXXLor%P`Iw}mc}w(K3a-HImsz))IHAs0G<v9BGYgnl051jXMiNxp$b|<
zxyk@Zj+<w)!jDksaWT<=zJ=TarQkjb>cAC-HC`TE1@2<`N@vswpMG9MEnF^5^&v_5
zio2rvmuiy&(JSjSBzXmVprBacEsbToJS2&7l2h8Kdz?X8uIg}zF%5?p$)oOZMo5w!
zeV{dztBjE3xOpZk{Jw*p0uznsTgW|73huLT0$gEO<K@9s;4YT0bVi-<>6bgy!sXIb
zACi=>xGSoEsWvGDy0Sh)l2^b7NY1G6mc}w(9+E^k$ti8rJ<k8Qoam1_u*oP-#z|w&
zjWn?rW1_RN0-KidJfAe?<VcfsF>`7*Jw76Dg34|sY0TM?CfmDW34UQ4yz4qSXtO*%
zWaAYjY~z(yb||4JM&79nt`jAR%BHV!&ZQg#B;f!_-u921l(~={$#k!}Ej!!4P0k+y
zlurWCU!@=|E%Q2dD$~7UNluP`E0;fWCvPN!x>9h%weuD;>fTki;oSr*6q+H4OOttU
zgyae&DL^79e%W+SjyCjZztI5^Aq1cJ-~pDE**u8yKlm3|bt<7#=*f&{<t?kmwBuiR
zDv?uYJKlTlRtDf-d$DyHPGpqf$ZLN3Z4V?v$4m0y#@4`4!*oGeSt(0O)@_-G5jnoG
z1C><^zuJ+NP@9EAGFeCw*<sk}UtKB+u8qY}nXCm7Ip`^!=E)<Gf0HzcKNkleojU<Y
zCsCIIj;$Ug=|;&^?gW0RARh}v<mf`5-BbcRpvXoOk$nYJ&_z-v+{h@X`-nr))3Kcb
za4cq2I0d{6$Nm#i`NonD9hUstvHwcN8~sz9P~G?3bN7n>5*zae+#zR9{!?M^s+Ee3
zjXOyY|7fEoWaA~=tm9dA8+Cll=1sT>4UeoTbVD|P!p)WPY!<YA6g=@lwP<>lx0!+`
zYm{7~4m6K?s;GTn4=bFnKvy%fv|)C_!nq(kY!?%&^?SC!ep)!s7I^k<Ii9`J;<>xb
zQTHi=3-1W>c|D?sJ;KG;*@!m;=iKX4Ka+fTDpTd72gH<;IKeCZ7*MZI@~M5IH@GZb
za7k{j$BP$-q~mAzo&>iSZ{%Rfc)ajRPR1dbBx&^%Kov-r&j!^Sn@nJD((?HvB8Mp=
z8hQL`*W(qvGH{Y0`ZN+U_~ViA8v;ZlT8Ur|k97Cl_ul(ceKOTt==EY;c=3{i5&Rmj
zQAq(*BdGy!`J|79kDvnt@{Pc?s|d{}y#+LSQgMm^(n=#fJYeq!!q~miYr$xMc%(N+
zL449XfFy82!0<`ylsvtO8Tq&6JPw?BhBx8)7$d{0g#xfN!3!RQfbetNq+l2g!xI?_
znIzy@2~H&i91?wS@Vr+O8OuZ;eijO$qt?^t3IRdn_sFUxjc>#&6*XH64{Vp^5DC6{
zp*|WWelRBjNCZ%Uf<6s`2TTVTF)cVB;nxfxkT|gHh5{<;;&Y=pj2Q2omKBIZ8OxPy
zJqko*shSR;c<8EEh7b{gI6eS~C~%~JVkZdhb?Bdus0E<-abL6W5ooA<SX=w80Ke^%
zgpB}eK*^`_i8Kl-o`AP~pePr;q&{$~OTq!Qu!|Tq(sI~TRaw_`QbwL2*d?LEQeM$2
zEyK3JN?b5i1ZorTX5`R&s^FS%XJ)_8tAgp_xjG(5A)pkTs~@>HA6=&=>8U-XgiQ4{
z#&G;mk>Io;rOpM=O~@G5inkVceuyOOi;_RUsDhHPRs+mSDH%T-RBvqZP7ubk#>`sr
zdIQfLNW$}ZRX*qw0KQE05in?lmrRvFcy&7l25a?7YuCQ|>g$GNs`(hWAX}?X`Tz=<
z0;u0wcM99dTB$m{>PEKKFMtN&8epwnYJ#;RTPp`LOWPQX28dVsd=$hdeFaEDP@ON8
zJiX%<j8w{*wNi$+>)8o8G1Cl!eFwc64O@lI`C&8;Pj)CoHdi9UikAf!b7p$J%|=Kw
zwTLD*097vd0tISG>vKr8r|_QnVlrB^5eY_Nw9INDY}6sEC4m^ycwVvC;5>{|)(%t%
zvRDP^K~rcC7Ar$!izRj1gn}T8#S@{_Jclrg1;mjXYO#L(hQ)pfY;LiBC@l7ruwAiO
zKbTqU0cNot>JH6Acv}Zq8nf6UW<Ic324WU#Viwy~)zH#>vZF^vW)^#<$=2MBY0z)6
z2*@YkU9{?ud$M59nzeY<gX^Chra6K=_Xyi$&tk%A|Mcm9)G%J71cr&Kyok&;7b_=b
z%t27+zrpE3m@rqoEW@)NNf;O<-vNc7B<#}&fhr~AXM^g6Pb%h$*F$*Lp&^(f87s2B
zC;i6iBV#4dF9XK9WlQeXZN_A(_ZQUj8|yw&SwQ{9TCu=N#!A&`c9)H{m>Z2TV60la
zs}5$wA<W7OgK?OphSXv>rNBuDs#7v5uaq-OrHtGJy_gM#9DsOU!YG(c2EoYX_+c~z
zc*GEhY^PL(jqud~S<XezzoG(Oo+4Z6emwE%yMYXnh?PJ=xS@9RcekHtlHp{i%sNT@
zL1t=9qrA`WSb5&d@-S0bD?-gQ094FWhR9|Lie3{JA9tBd<(7w<DIVH&m;vIJMV>F9
z&k2IBgqb5TR#9?TX}@4qtke%?R(gzCDPB43!)s5-u$X~1DhA3x%s`uoIU@rnPxbbk
zIeSh<W(GQl&z78%{^2)J{zw-BYk40iu!6o?eiSS?=vE#DLmAua3A{!lu%^d5I#r_X
zd{j)rtT{h_<hc(&`hq=!=8xuBXb>;h<FESGiYMRuI<Ls0!p9>V<(3lm1e<?Xfdv<_
zLbrHpLuFM}dAZqKa-^WBsKjJ4o2_9;#tOsHbp-{*#U-U>W(z(7qr&%M2F&!NA0M0l
z=}_euHdbg(G8I->%jr`aW>aa2$zrLhu5F;9@qGsWBce*cg134kS&H%Pl8&;f`sTLI
zlQlKlxBmHcYJ|t{{)Y?$jkpsn#q=$VvkkfH9=m<fw=**mZ=AK5MnF+}5|5Q)g-#I0
z=R+)|FFyJ&cmHV33-5pOmra}Z5l?8B1!xp(#R_hQrm~8qBc?JleMzJYpTu#DA;<AV
ze0{?tnp~y$1dj#XzDQ3P`WZ2#>|ZfqDzp=<7wKt5|Ja9=O)>UlAh6hYfJIL}`o}w@
z?6k3G1c_D|h7$`J;3r=c4Ned|iN}hq(N?Fqq!coO#j+ty5ZvnbD@@iX6x7x?)S0P(
zS8%EBJ7Turn<FC@>*1d-pFe+APGrsnIl7kjgeC~CRKr258CaeY+dY^~qOvc@$FcI>
zCEg*iVw+)Kg$3U`aaxMoR;pB(R-<w*$a`V(bCnZ>b2nFh{`i+wPzH<HQn7RMjcn3m
zy-XF(FSC^Idj2o?I8H-jZO#5gES6zAMXAEMW!93)!@phsmych5c6H9Zt7q_vw2j0H
zp;+d%Su<wcxcDbO-FIg&)pJX%CJ5bh1iD>pDms1}4Z#1PK&s%m3gwVuX^B|kJX%n6
zxOpXE_#<dwBr*(lxy53I)_Y1@#?VNxmf{mGZc8yMk{`@X72GkF68g4_r$m91iUA%?
znivcxaS*($C<q>gfo@%OaLq81aI2oJEDO*EjWOa>|E>^2A#t*9`PIi2vHoyX8EHew
z@n!fuw>m1ILiT9mZ;sZO==(#W#a>oi`&{;Yk38{4K$Y5JYXA3|gLTElm_W)bmWtBS
z^2*AZaW%Lt)?E4bNB1<;H8$5)9L?XJUq*T{u4%NzTT7}pzWm-3_uu`!+w_YQ?kKdt
zLdUha&IwkNrQ+}p=Vsr&`qwZ1<*u6!9w{g(9b?X&^B`rjwXBT3nPX}G?e`0g9yxem
z%<Ry4GtjISd~d7NWGboreA=z^uA7lQhMMPQ3u%>T(O7%TH5*s|=JoX($DhNZ$}myt
ztUcvrHOHD7>Z-<_Bi-V&(6}h8SSFgpvUB51!Eu87s?Fu4)_5y_QhBtOa9{mZg~=L+
zQc}%O-w=o0VBzX7p-#~lN%;B>wQ%+4m1P#Z0$(iinaad62PVu*`mO}wG%9SYghhhS
zRru6WdD&4m?S=D#iNYCRe|+@t;jN#4y8i7~UV89nE7|N9&YdRVO`byXlEvT2nldp`
zhZ$(Cc&o4gpF+A*@H~NaJeJ+(gjx6v5dBDFrbHpWrx)MWn}|iP1G`WT?{H6V7hCoC
z4&z-pZnu4yeIqUx@6*ACn@{>HUbusec(?RNJO+**LEEKU;4e}nr%U?0AC#hm$&wQ*
zks72U1so{(yeu^ZU+!TEw$MtJ+&-RF`#?lVh6S_mo;H+JKAg{RR7zr@6`|zS((r}*
zfA{bI{?0qbBJ>_hM~>(E#jk$z_zpZGfHe?a+r-*T5X5?SL$k1xern+DmB?qb3HdCC
z9wOH(<WY`DAlHK&g)3ObdE5-->H#`yh36RxDtyzN>y%IsOvia%c+?62wtk4zMC|7Y
zZwK<pg6}OQZkF3}pAa^?<uyM8B?+SB6%HdZpqO1I<L={IiL{sI83yGj;le*#EhUGy
zZ2jP)SFmctI!=vk8@Er8z6GgyKOMlT8Y8ByB}9W>udoGmC@w?<1bJZFkqVq%U%nvR
zg!3|hY2!wVHo3Ufv~PgemGuCRQurn-Nf!P=<}^Yyg~t6wAsL))qDx%J95-5uB8qla
zF-nTTXxz|bBBPU{krUA~&m>_300>sFgXVHw9C3Q_HY%bVAzko!JMry-bLZ@K7dHG7
zgdv|~t8F>n*4cewa0qX;^Y%!1Pd!?_Pe>EoU%dF%IsvZ+A_FqOfIi{|G~_p+`?&!P
zpbJ<Kr{Hy1*d20@^bhn=WL8D?<8h3zk6slj_Op-KkJ}@Cy^Pt7$00q#4ag%M90VoV
zfPAfNU?B#?+2A)Io~0dMuS6!vDqyPtRyqls;dyLV`2wZPmb}<GPEhcHOfhXRpJ7ZF
z*ZuYHf7|rc-eV|)F>z9^-@pCAhb3f8b<CIuigz2fc{+tsW<3M4^;jtfT_WolK$sCQ
z4GKCGTk<dj7lBwKJkR11RJfv?g-FYE&I%OHqq98k92VZU0RUSf0JEj90(scd=YCt_
zHQe38QQAdjhC?83OI3<3aWd{fGJO@>m-dVRD@wR{u&b%As-SS&_RpYX%*X_3H7WNV
zdcU;jvy%)EV#XE7R^*{@lQvkG75OBqAUrv)6;a!=74f8EMLZ`PPMA!v74c%(iX4n$
zI4e^5+}^u{+<+0e9Zt*)iV=yv!7~Hr28V_m4!87G#-eCw?|GlpdE!)8@0tFK7e`|8
zK7z@Dw_i4;x5$(Zefq_hiYXakN_mWjz7cLpX@YBp@V}XLvFRyMxNzGe&p?GRt+<AU
zhsc`R$eO%v7yATIBlIps@>VCq2f=4}CF`r)nB3AvZcJXOmgWh?n8?RP3aOBV-y3mm
z_>GBY{l>(z0b}BM#hBzAra->U4!^`fkTct`fn(wTwPbhhICAu8X=zo5qO5q%_G`SD
z+!lwWhOd*E5+TEs&O-Z}3C%mqjOV=2N;%n-hIx)~VOT@RDW*h&LWn{jW&%9VP>5Kd
z!liS^S+ktZ1))8dj@u#Z=|(phA?%7sFn2izGb;9*5pTzRPH3R*U1mlE;%0PGF(bJ*
zOYJp4V#eYGQlv0Evv#1X^JGJ##aa+Bqd%d<%f82@n32!-s|IF9IR3)w!f!*ZD}}$q
zhScHR5Va~B5Kk%w#B;I%g~<dP5HFSuh%Ye48ju#pRo?f6QZ&b%kkjLGd+<)VXxR(F
zfCh&z+DAs*E{|0D_)GUgWBYwl-|7B=^MgZ9hwGQW`RVuOq~gQVt|93s-_r<l$s=ti
zGpajWQlglVc&DHe)tJ!9hVUScFq9B8YvK3rec<`u-j2W%%f{%0%vC>o@#Q~$`q|da
z`3FiYRko(GCs5%0V)ND=rKSq8LW@sox~(;jYv7dZ_{b#!ctjsqQ@bo>$DY-~y2SDb
zYlP(@b}uR_s?3eg)5klyu(-wU2z}tTt`?uRGnE|3+qw0t4Ig}=M`=f6OKW3Y*}*-Z
z|Ly&EUVZBRdw#lP#k_A_JLg;3cj8kokX-vq5B>6v<@zNH7U;9SbHj>TfBMjqZ@l^G
zKX&4^_IWF?{T3;--*n4e_dovRYrp^G?_2T@l$x#O_%0_tp;lRGu6mzgxc3*Dtd*)t
zv1+8cs*<)=EZF-HElz8R^?i|O_$=0Bd|tQ2`X0+pzC=3Gs<wDhSr=3;nj=j3#%rag
zqKYEK0Fi!+wW_MFzR}iLV%oXm$j(YckO=nC$UCf&z5`$X=}&8aYxtM@Zdoz=#@v_R
zM@)e25NElm>;r~ipOzXQuU63;Bt^k7@vDNTKQ1pbs}MD~iYzZ-WS9f+!5Lx7msOVM
zevirswegwKRrKP@3Bp-XxauoQVcpxW9o+cmKdyWI7mqDQ6$VfJva-}vz2W}Z^XJc4
z^zBF2;=4H<|4RfmrFC02?9QufX=)+n`QhbOb7eJlyvmN6-$n1Re*yZ0FItDqOb<Bo
z0tEqHd?VPD%?KAq)t&TZLun8UPo{{%@;#Lnd^%a-ce3El{HQz_G6CO%5hniY#!>~i
z9{o-d?D#uv`|sWbE=i-*`UeIcQAI{AKUnnK2ME@E6tO!i3idvOA}CmF%H-)YuUWk4
zuAG1WAivUF{QMuvE2}CiEJdbYsln?=q2s-cU+m03RAz#}Yb<4@=Aswh`tap758rp!
z|5`LT5?b7LthySTA!XoHnaNyUVKSG_nR&<cD_8yEzE{^oL%diN(`Tf+U{BbWG2z?B
zMMn>qulqsqu7VPawc?LVkK6Ha;Ns$=M+yszxJ8w>Uh`lh_DihA<y>)nCia2bGgW)`
zeERlF4?ehP<}M3%ATUZ^-v0HUKX~r(yS}%0?$oOmX6WZHT5<1JR@$QQtNxj*X3t-I
z`>ppq_{O?VHf}vwRNI7jlRiJJFgjA`+q8RsiKXUvOI<C@$%<Xd(lVyF&;Zs?C%(jt
z?<kk5N*&na!yKVVfHVijRz{&OHdyiP-dH9A4o||Tc}HMf1?IP~pA;#?S?!<#>cvH+
zh?3pq-(_I6MP>GtVFytx@xs`l^Og~F*=HL*eq$xQ=2m6yEvv>Sc`YTyhY#(~-}K2x
z&%bd0k8X&KqAw4f-M{Cn&42&vx)+|xS+!_R`s5_M@Q9S(zG(hcQxf73DPw+AA(X%j
zsTS7?h4jt!VO;Wu+J%2Znmz(g|CZvS55VJ}{{!#zvH6G}Jn-Vf&k*>(!{_Lg-l99N
z*r-!My~S_tUvUb;YZbUq_F7kH`KvPp;Z-v(l)ZWy7vbV<ZLg)`x`uG^i^Qk#DwL;v
z!qaQxZ>HN)mM1u_Z7AF36Skp@ZcAC7;JCU`*6kCzQAW3=EKhK}z(ale7U?^ZD0pZ0
zOG^+V&X#VHyy|}Z_1!Klm3&*IwXuikhBN_q8OKv<`N^zJc;#ta+i-Q`lK!jnSs3X|
zjCvO1LS#4HvXCcu7DhS~qn^dM5ZO()EaVBEg^|w0sAn-QM0V3H3weTHEqS)wu7+yP
zklg*V@m7E=$vd0<?N>`PY0&rsF6iuZV*p^FjN@g>wWcd%AgXVo#R>O3{P@EUKKIy~
zC#T=}z_Y(0NkdiGKSib2A{U8^;H30W3qMYJP&!^t6HX#7H7@*{giEQ)0D|!Pvq72(
z^w&QUgg5>b*Xy|cgCi++_WBXPpxJLs#5EaL8ZOxA8#8c$U!<9yv~@LHiypEwEqaKw
zD9uh<w2m~VhHFs`r3t{xyaM4ti&!l`8Ci2kdqOTqs%Bjpmz4b>E~$r@r0i)Vn053A
cEs>;ZH~=z28U6wfl47+WDNY7mzpSMG4+mqQQvd(}

literal 0
HcmV?d00001

diff --git a/doc/source/assets/images/quickstart.png b/doc/source/assets/images/quickstart.png
deleted file mode 100644
index 735617b8cd4845e1afa9b85524c96d9015fbc410..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 9491
zcmXY11yCGK6WzltcyM=!AVCjz3-0a~oWu2k1PyXPfN;1&&>+D{fP)0r1b5fq65zkD
z>aX42shZm9s+sA2ue)brHPscL;ZWfK0Psv%NlqKt$|Ge23j_H*cI$*A8w_hzMLFQ<
zzbC)5EEU;<?V)4@0RUW*{{#elhEpIrF};=5<T00Vp5xNLQd69{1po#>Sx#ElfBwiU
zz+ZP}DReA{^_~w~nE~ww6(P?{>^P?U7~Ht>>8&b5SLMFG+NRkOy{c-T+HW&sNyP&7
zzarxD#TqJJ#xbP#qp=c7C9`4^Dk%-}DYK<!iLB6H`@vHGjt=MiWRaE_JzsQyWwqyA
zKh9qN8*RngQ5qWLw7g(1QsY;rjywO_nhU9ipy6Rifh>zhq@LOxA%Mpu`!zbgC?=o<
zWCEF>$VoDp6$s!9R0GDlQ}{hw&nSHH0c#9G3<fHxi$zKs1$9-8oYi$xE1<UAjU&kS
z@26^DAH<L1$mAi0at^_e2Z-@|ynMEki3o;U9nA|_t&{J&)S8>`!fLo4f8Set3MI%V
zgQi0#bXj}H3{~)ox#|rZ@LN~i{WOBaz)ZzSvyb*gj2Ey8&eRdM-k-Gh8gP_x1wn+K
zQR5l=J@uG10gBLnuQiKiA$=xfLM&Aa`_kvpr0ioGWaHXS@)KRP8=JD{;Lfp+CQB`2
zZd)DETbLzVt1dZUprHO<6$^mYwZ1_lOlwnClM%g(%L>}cRHfry^oQToI7uXQqD9Kk
zlE0p2d2mmbB3ARQ{?YjvBxhTCNxd~Dj(1Eh3TGKsx?VecuF1lKhGqXV>chA_n@7U+
zQl>~aq$Xx#jDP;~CzqG6n5A4Ac>ya%Hk)F}Yhn^Q>j|vWKzVI62FA@-On}@+3c{5g
z#80Op#p1psrI?Sq88q}F<5SplU9QB3_zuoyMb&42_7D-O-ShV&A957;sj^Lu9v78D
zAP1Bpzm9k{`SD8M7c<aEEvEXZw+8<^?MlUDQ%Jhl=|C<X%LFkm$A7{%oc7IXC#A&X
zN|&b7>xbpij<B|oUvk2iRNaPq>6CCTqIdD#vL|i(Kfa$ksQH7ZT@nuVeK1)2%>f4M
znc0Z4<5ss|d9S>3P*<W8<eSS$NWH@g`4-pQV);D;$D8oNVZ%E-i^kBFnR)A4Ttw3_
zTf}Wedzm>#&*|{`tEwY>hpJi|GWS0ZzIzk<skW&!xl+7nl!T~rA31>fJz1Fca^UIR
z;zfZnk;S2yHfj$I-MePH;>#f{ga9UM|5a7FoABf1@tID#z-+G*>N-hbuWVrx(|kYm
zRY#|X{DdIj0Py1~Pv9&YCWClM7(Bb-5`iwW!=8Q!g%4M*Zmy!K4`=)6n29rj0M^59
zZFi<*xx0%oPmQZPWIoThF<`E(uy+f%@gaY95Tv)gngU0S`*D-<t8L@Su**g?>beP_
ziY)dvIcBa%NKU>nDKq0)BWN*&I}1|D^o1^5(XL!92uWCgdII)#)24+&gGM60!?c64
zr@CrxPMgb?mpVR9%TQ>tQ|i5df?+TPl>R+zQdvS!EZVptE+L?#97ET*<LKig?;~p?
z?-SuOyxLa>ik+zV4)j}U;yH2tt#}d$@xGI1P9?!$k&DJZp(lSM5MudcVV0g7dh!KZ
zM-|`TLDOtykqJGlW^;HBtMX0>l$8a<b|0N-Q4;)HFMRUFlxrjrm_3`*2)<zh7RGH=
z57!6W0vE*{L_FK-3k&8#OPlLU5_zEzhSyv#1;L9h6B|}yP2j4dP4}mrbA#)Q-!!bT
zPE60e(5XpD0w`6DRTjtn9{KM%HJ~w9kK{oT{+C5ZD}bZP&3%@E2F0@9_T$;-lUWzZ
zo1+G``$R%)mIlMuTQY1w0l|tOr_JJc7kMHLMc(m=cwYUyy4mGmP#CHQY`Vfo^`jyA
z3>zL4U8-AeZ0XUlTX>A9!f~XzxefkXGQ{3}ZZCD(lhN}vN|BmZhUwiBM+pW|@0|(p
zN%w7G)oa=uzL~rrZV}TapXG2pbf7ZEzoAuCRZ5Um1k%h@rM8UvCQQUy>YuRqz~_Vy
z<1DJ1v17h8T&zXE-xj)*jM>M6Nwd}N8bOW~u8ji0%^TzIAD#;Yu_r32<Kptl@3w}*
zSgoOjb*b{0TrZTlXn$sX75&TgQi_u|dA?7BUUK(`!;aabqQyJr`MY&yRk{~9Ug)g@
z_CoI8#p|u8(3%E|tbso6(8JP~om?}v&Q*C=(eg>4^5Xlt=Q|FfsGmq-#Hpu(V|Het
z2G%ZeVd4Wdb5|Q@?2ivK4#i{of!d?%|6C00CREh3x9ij8UuYRM!q^=~w~61J5DGfp
zetNk7z+&=N_Ri?T{$PQO4soF?bvL)D4DlZ})%Z#DBofd5Z`0qA_GEKO)9!WfUgPoZ
zxO9v)ae6IY@Atd@+c_B+yjVpayi=jLa(9+W&-G5_0`BncuBS@wZcSYn9d?gJ#dDT>
zFfcX==@BX!5R~lPJ!k^db>!x7@<%MB7QZw4I5P`;LG=hcKF=eCm)C!~2TSk`(>z?%
zmYGTCN22h=94_xNUuGQPXIzMQ_d#zYBJL1(Zy%hgjVq7CAV&khyU3;!E{5YC+f7p8
zLE+yZp3V;MgL`g!jj(YSzRXTqNhjSWPGEK-g7~WXYccXK9x5>5hnES-cxBz_s$^c*
zGkaNq2?vvE_xf6On{Re@Wk`spQ1Y!H%C||PVPdT_zok93tYW7I2viCrvLXQvx(3sf
zs{zzqSrf4dAO-lLP;y1NaZt$q?#mW>UZ}xK@mN9k1Or0dpXzR%Yc1}<kFj*%wYK<Z
zyX3n}G&%)r!nqN7P)r8|5#_{7#Ha;mu1wE=^Y1;D-IS0WHFWji#GWwc{^n#bN5&T^
z!yh1|q%6wQcM*?PS8yY>b)~8hKyZw4{gIZ9WR6k<eRx*^Paae!7CNx`q9#k&TV1Z4
zQ$gap`0u1ziw>*nhL+i2zf&RZYUB3xtObm#6O#18tX43*y7uKlb3`t@GkaR0N(3u&
z+b;VmWCJ%X^lwT9v6CAx&W12T3wswJaS&$&DNXqIQIx@YadX*-q=7z9Gyn(a4eS1U
z>lKu(lPWCXy*><rCF{GtG!QCJQ6e`M%t$jZG&y|M<-bzJhr#}<mn)9OZ!zq=FZMsW
z9{JtBV=Cx1i-b;95&b302m6!ylcp;X|Bfp{O8s`B<HGEcl0943siZF7E)ON`1h@ky
zu?<;h|BdvU3-ilk=gBgVM@T-t@l$cm7uQNygPDOw0i$v}Ep*1-4}Re@oE%!u+rUp<
zg2(SIC3Aru$SuJ?$43ghkkB+*7+;*Hpsk^@oxs<fhJOO~lsVrQ%Z%iO1v$F@T+_ic
zK1>`Jj2_zbY9(bVg|iiXrz5g%$N}4kzlCkVq_t3Jjx7OGpV_?dvzeNPDPjikXDXsR
zs)C>NH8sf<s0x(2<E?WsZb4KftL%T6UK8YB>yy-HFjORH6CW0<(dAhKnJGOUD0M<}
z^ZQL5iTcjE)nH6Zs!WQU!^fb}XC#wn21jCSpxz(~JZ9*)&`G!NcAf3e7Jk{#>bm8s
zX^2vSXVDK+g@|?Gz{<y=+uE92Is9e07?=Bk!tDj@-ur#N=9MRZF9Kju)H&S#k%Z`7
zA}m*3Lp9!mE`^azRwXa<lyTX2x$b-r=bFa?50(GH<~C8lM?YJ`*=%84`!YJ}KnR7$
zG-zV{ZFPuts<rkmBEbt|erd!tlCjX;w0NwzX=IJBZGaQLsHKDCWt;B%ye94-)Y67o
z<Iu4xXB<%D!`~}a1cA~`#Xit82>Q$X^IO*VS05fGif16gifEzGqm3g>*649_RHl82
z{p<8R3GhbBb*`aBu&uJZPj6Rh(`>_k61V>$<RA{8yK`-fzDwJ;vTMKeCo{48XR&ph
zBuYnb!}aNl_ngE$Dt@Z*X}wuMq@?#jajZm1SAB^J(~w@q+gQ@wXto0Nr02n{G(BaL
zI=<r)IMA5euWZ8?{RWGCm*GFNReuo>Nxyn$7(hVrhX+WRLX?_sA3)<OKlrL>^SqDK
zAC<BlccP-NC_Z8#l79xc%=oCW2b=Lg<htXduai`nxR{DXOXOiNO+X9jARRp>M9Gel
zG*!3KDE)J>8jQy}fDLnn6AM(%swN-gl6NHBsD>#`bJm{CZZ0eKHWDj0{8@rRf5g`B
z-wB-)zde1Uzh0KGn)qP}YT}=Z6A3c)OtgJ-{fU^2IJZx%j*G`pz3^RARV;g(^Tuwo
zX3OFv!&&AK>HjsBEU|9WiY(A?8QT^js!3@y;zlibbfIN|=~6KVzGNW_%NrI4A`A|*
zkqgn6EqIaO&lLQz6P5m%Z|rRE>})Vh3wCahAkjiaYqxil)nSo8E`8*5Yq30cQNrCN
z<6jtcJ=P)liuH9m6r23JHbak+X+vznJ3Ocak~FmGyId!OE${&#w7i^i?j~eTD;90T
zjB<SyR`%|Xsdkt7n6&4FRjm7R*byo-CZa4kGrlKLi#-H|<^6=ZAK@T&%iB(djUz>S
z@nXN?hSjMPedQwD9Hlxb%s)|DUjZfa%f+LlJ#1LaLG?fX^RAAl7x8|-7OT_Jzyf^E
zt$Yg{%1WfbP(+J*+u<ipX7>qZMnKc+X1X~5SN|zq>>Vo5E;dN#Sj<_Omkoj&A@NYL
zJ8z@)wY(b=cpsQ#M(Qupo@wv2lFI!QOE7hHg0Zl8IX0B6tQ_b1#!K2!&XNW7u4K5F
zscTOb%BN%K`e+(867!eh0vzJTu4-y=R=qmw!Ji`Oh4sH46#RQe4RCzrR-?WduTHHI
z_g;Ui>J#!cvxP(@&w7|Md|FM{7@?s?pLw;JqvO`<huja?Iuq=n_4>Eua=izVZ3r|6
z3XL1fCu=rYtl=e;Jz3oyU!9KX9zA8JwAT><@wmDE_f^j?c$gp#4x21}kpxB;yB}L<
z#f|({H?vBAnMJG9iur$O-mfyVn~~8j{ivp<q#CRGmL8TV$iy0IYub3t)1!0mGEiWr
zDs;3YU!1C@J(CyNZ{`!r7T8t~z?PrR)kJbJmV^$)8jdGgx=e9<(gh%kQLSI!Z2KsB
zo0zSb+I$r??j2TuAdy4@sH@pMogBaw3T0E=%Eh|0)K%ot?y>?U-#q5IxBaHgod58t
zvg+yL@rCyrtAoeTfr$4Kp4GER2)>!Sk~NY1W7zg&=o697(u19U)LlbC+iq*)#95Ir
z_V>_I*EIf*Jf4Ta(%(h)Tg;^2q3kCY6Wbv#9O-*W{LFowctD)UfbFS<+~6_j`((BJ
zKqWQR;-FU<KWZQ2M6&tUUzS^RULUAXd(N(dN-acOUG_%?G=z>H`*r9ar~&H9F<9Nr
zUuyc_)Ec`WTV&Yx0wlaWO7X_=iq(mHN=ddo(rqayc*tU9sWBI}2==c?z@y@z>WPH?
z#tPb<RhDf&tSDdZI`Mx4Jq;80f8f5<&h0V|(CdvA2{UV^fZ9wH35{L}?po;m4&F=&
zbMr5{aJ<w)DeX^H!=8^s=S*>7{{p~6?dF=-kM0xcQOCU(8nq_&WQo}^4?d4|w%7>(
z_g~Ln=WSNuF!2fopCS{r+vm!jnL=aK(?&E@7ZK&bE-2%T-c!pB$njx@E7QhvGtM)D
zjk?e2%fHZMQqb~+{9`baA~<l*;_*XdY7tWpiq$VmySvE;ok1y{{w>Jb#m}byD=V0L
zw6V?1%1Tg)S@zOsbzRiEnnRonB`$}I{Lv!$a7|lvEu1<r-WIs<eW_T&6&XK<SsS#a
zYm(im_%Ig=j-coJAQ9>a$$*~#EH%~GmbdhIVE@DM;x%=0p<=dvJd9~#Zv=qMYxIqr
zs~cNHs-s_w(S)3*77~Lsl#EqOVUpMUJdA-@U^cz0Wfz@_d_-d6+Ap@0AsS(Qosd<-
z5hB1sRmjC-!vjw2I-xM2Kux-hclB`fXFNi;kzHlvXqTdaUx~7gX%4)NKxr#R8^!A}
z46Q5(UdMXa(+KeCwUX8jVwwmFZfM>_$pPT77tz!V#?pmwk#>N;_GVk^=d%oa_ZjNz
z;Li3ArFBhH2XqbzVJowUe`v+1P*-=O%L@1FJVVidVdz{};sT`jF8f;Wkkf~~vVDg2
znkPB@h1<=;Q_X!ba)ZM<Xmzxf>Q1)oOeDQGw8m{-x3U|1ZM$ThdWD|l(O+e$ec14v
zSexLT+^6u-U-&t~y5+px-Da<)X9h{H#S<yF3U%lID6@;jR4TI@RMvMJBh`?Tdb9@a
zI6n#&T^Vi3b%&p8!OxrE=ST2!>(N_gI7HQbh5SHXN&(gI<wPXB0~1*MPVwR)3>{}D
zm=r31;ht^6!L4w6Y@Kj)^zmLN5R~i*;Ox%(evGy)TfuQ$fl!l<-m(JbWx&w3v^M1f
z8UCsdczaQYezcXcM;8b~NmfcJsddJs)_Jx{iTG0rQPU;{E#fkuzl)`qy6yR#uRaw7
zhe&LgqLz^Lh-%{EFz0v6z_b*yfmN%~+nJrT>$P`k|M-D1scI(2zvp-M<q<};Jc!wc
zm#k3`i3mt;zeo}QASf{FD0`SS17-<t40N2?^#UUyp<83>+QK^-Apb<&trcL|I$>^4
z2))N2c#^@~!I5Mw1@)vR)W4F%)fC<#NA-WkwQ$U2zL5tkW31XHcxsn;q8Z*Nyp;T$
z65b`rgJ{m1$@dr?(6MAw1&T5^o&)ie2NbYXxC0^2Yj1P@)B`jHQ1S@H{qYyHC`c~;
zs<>B?aZUr^Pt_Cc)<XgEKxC#uBtShR0LHHF3k5E42Cu%C{(Bi{uvFXeD+*QM)BzY8
zJPib|v;(i9Nnqj%dDI)bIw;ckvgAqAZWnV<TG_EE%Az43fEyaFlgi(+^4i36c6!=v
zScCnxvY-F?V+jBa`Llxo&O<*94_wvK<jfbH^OF}so;{9<;)71XHeV3TUI|SohKv(f
z<D5~if!c}A%a<IaV&bwIlPki#=$0I;vCGD!V7AbGSNygzhc@C>P7vTF09E|?O$6mz
zDQ(XY3-7Wq?$+Bi5J2*5bwUcl$_hx)F<rkS&^_OEx~m+m0Zu8VtwynK@`w!qF;Xm^
zVFD?8z&~@bQXH%K5D#hqqPgxH(B2H9ggR8D>fhwa>7)8*@isG-!+wb5Da4vu69PoO
z{W4l^pV~Xu;nAuVA+q%&SpX|r3T)6x8Z~OShkb9enL%O7nkqhMITe*5p2@6!ML*7U
zAEl00u<e@tQad}2Knel!f3J(Mc$BRT@jS7lhTZ}V6I##LQ0mZoEb`S)@&5Lr4a&{n
z1`c}k<1!QhFN+zfu*DUXVvFl&DG(H8t|ZX1!RA3{4hnBzN-o4mDdhaK(>o9!RZlyb
z@teTVV5Rbz;I=#&L?#9OJep-9X)iy@ASw?=&OmY_)airqv#uCOXbU@Pt$%WIKTP6k
zmZMNdyCmSp4IhFgp`HryhZAA=+~!LZ@0Bya3fB9nVA(Y$k~CQ*QCnbx6Xs5S8N)Yq
z3%ov?H$iOgVPT>36uSEzptB10C^fZzE_b()fQL)I=U{H<*Wl)O+@==CR<Cm+%rMvd
zght46na1U_<>v>L1qD};r=f7lNn}I+3RHYAJP(z(i;&^Xbl0S?aR3&jpFZTW_ILo@
zJ8+9bH&Nl8f=zj{JtgVLNPw%>q(;=A`6+}PtnhSeln*8Y+yVbsNbaZz{dW<1tW`f?
zR<rL{2*6ZHdwix(YJ0K1e&scK5@8Is+FL81CE>yA*#c@l9m{tF_iUjiW2tb_pX%Wi
z-<&?Ikd$dXds5nTE8rdv_>27ltgm~`%4jtmJy5P;HUy)zF)7ea(t}B0R5^{zYlgo}
zDeyiS)3gZhEz@LbhN`>aPmUlRK<msGS&H*VeX?)cL4PED*zFSLHK>(&70rV#ErSob
zN&OJo4OqGp7Ej7u-&IO}F_F?@@XSpDVh&Jn$uWH7-064Vtx05FqnN3-_)?a*A)gCi
z%eW{Nc7ILY?lE!8&@u^NaIgk}(k5=dAp{bE8%5}(b#YJ-@A!Hy)cyl6qH7i2g5r<;
znDh_{_(${39@=zQ0(74_CU&)tRC+KzzP^hFI^?OLMsSEl?TQOtPtyxcXZ>dHnbiW^
z9+zkp%DXpn^B_y&4xIvC&1eDRf5RUeBDDIZ?0zd2{eu)F{<<ZJT-vkA<2|h<wQ;M9
z^9yWn9C&DZ4OCIujOoDGyKtHBn3SV;M1tadSu7iWwRZ^A^M5uZETji-Kir~R9de(*
zpeeW@+R)1S<;-FeTu_9$qN>oXqRQ+=DcWmEfOo3(=?^W`8<zvt9{Q<JMTbzswGbk)
zU?$MGgb{~z%As3}txfDy3VD?e*>J#&OC#=(G5yeOx6^QsUjXqAG7D{?FeX6wVSrUc
z{!x~bqopW430?F(Ty4HgbkbA>6MKBp2;bKlP2ZO_hk|kTTvyGLhkZ0T`>MqQ^2F8U
zbV3GY3eg)ePFpV)LIQ<n^29mN5;DVI#5mrXMR!V|x3sW3he<uf5npMZ#Xy1}4ZgL4
zqXEJ@V%d<cRET+>$XF4m=KrL2eq`z<{+F1^llCtkkP^f9F(~=>IQc)7vJBjdzBrRF
z)b9zMW#a4x`q;w8_@z=-8W|kb>V3G(B)eJWZhgCQ+@DT5H2{pyPX6qFYx-D#h=Ma7
z=J>OQzHEyR6QRnQ10Mm)FnhPP@b!O(OK?a;+3i@aaZ9!0kca_=O-%wkoX{IDG`l>)
z+E|4JDxF3<@O;azWL%=Ryw?hVJ#_LzapTS!%tz32?Gr-On3ES5z6316*1cLY3pq^p
zIfjN`k-D#wrK0{Qp<scVI&g_MeJbqu!n^BV_FL1dLU~;AGj3N@d#igX(azvX>+V0-
ztk$S8@*RiT(%YB>-fbKTQY|YvYjNUtdRlydjh4ASeT9we#9w^BPI*D5<I`y^$~q}U
znm*^S1wIJwlQ}%EQ|8kulr?HLsI!%W`@o8}lC8AB(dXBKjy$kmaM@DU#S4hNX*n%H
zPB&>2ldfFt=gVJ1foYG;%2sV<qfx#EseuRk&q9T9Fm?60JCG`bvMRx~sH>+K3EY}}
zqH`t>yLGwjoGxe?;GLw;(<!!ejC+mJ)y-(rj45x>2A$6It!z8ehZkk^;d!t0@BeBb
zSz5*3tw1^296})FA=zp2>U|hh59j_g_P!+vw5T!f`Nc0R6dSA~XSDH*&;!}rSG4=W
zsURtD<YXy!f+yuH8Ep=~u{%xJuwU?N<j?3hh(OJDGcS!)5VsW5f33*D%RL9kA~?q<
zV&#$(#pHSi+tYqkg+kVAIu*eGmC(KKn%Hl-RdkL1nC~$<ra)J;F-Bmf++Ak2=<|Iq
z#@HbG{cq?!Qu~H9;O)am6(b)GT54h_`??#~yuz9s*Lx~mO*!@h&==U`9Vziz*F}qe
zB@^_G@^67}o-f}AGPo~KFA?z|D1>)Lk7FGBqpZhyt#IgKm~WeWjdem>gL{{9a=lG!
z?tcVpDCl=NMGRz<WCIaCVO$EZ$?AMGuE!kdRT|Aedshu{Sm8IV81V)Fv9Ga#y3>Em
z+Nw;nbvf5SN{%f8MJ&AP+<!3%!jC2r?VqEsnu<wp&wApA^ovWQE2k`19ly4J9mf_`
zk4H*z%{nHBgN&j`F*p)<(R1cPD3i(J?2}OcU|2Fop|t0BofsYtwTAj^2C~Xmg@7#i
zp+>uzN4F%sTk;yM3$3lBP5L^97K&Els2)sjTE@Ae?s490%Mxt!1LkQNmuUSmL%^bx
zT)L|4yqI!mOv?irs{IAbj*cm|{#$%y5<Byi_@^wB8%Ccl99kP8eeVtmwc%OEvx|3X
zv7<cFIahp?J?ShW86<jpPK;ew23}gL`uN;m=f%QdDLRC>tAR{O|7KRM#wCzO+JrRH
zk<f2%Ulmq7h+Cx<$KBJ)?|t_wpR!|9y8TS%uwj|di4d_M$e+-W;ZQheWa-yS%Mggo
z9mIi=p+n;#$Eqru*%ib_Ezuu;W;aeJ>&%-L(=EQTbYT>@dk&4zG`J(?^7}A-Bs?v!
zaRvGVFr@PeE-vgAa%WE}X!PQ&G6TO0Z5oQ!`~73DzecM7du)jh7rC$3!`y*7y8XiL
zAWqI_?3z@ZkecYW(5DL|SnwhKIBBr!dCQfMYjJhc^^hX|c#O8H;(S;v8_oh;FzXU8
z$d`bamq)Jy0U?wd7~ZwqFT}?_-uPircscIzQ0Yxv{Sh#Ubu<F(Q`&4y@Um?rmxmjJ
z-ASQm$i-l@fIAY(_(e?*p<9AokFDN&oGg-S*iKV2#$~`RF+H9^(=Yfd_fVeqg$qdM
zJW?q`x9m4bNqG?XXw(!Uq{+p4<uy~Uwzb9sI%044ztGv65hB#Ji!5Z#*8Vx4-LA1z
zu4x*GB$b_%0sh_55Q?G<!iYTq-ADciQiny=?AqD5JR@9h46x!rkpDN9W-qj=e4DJi
zJX#JhXomt`&ad|{<=$`T%vpy5%4>AQt@^au8-72Y<B2Zhup4xI;}Eqga9Efk)1G&|
zE>Ze$&i>QV-py)b4h?4qjy$Xoa@Zz|i=A6)IQ%?t+an)f<d7cutzVd4CL|VyniFji
zff2VV^sh;z69q5D`eASRbJOuhzm)s*Uhh}i)uYkUM_MyPXj)q4vp#9QhT_U`_%#Dz
zn&s7uzEun4bKb3{Z@o<mN#{8+ykGCOCKvAL5zCf2EM~XLpPA3}PGOVmex=)Yv}9oM
zyf0@I7vCN&Yl}YAE+NWL;%2N?CMEe;VCpOYJ;+Z~Yu_ZsRmaXC)s6cJZ#r$ji>()y
z%yvK?E;RKCylLUdy-DQ||Ctq?*zDw!Hd?DhfI#cXOwsA#^z$0`(J4p8hMx<=VBX-9
z{<Oeg97{G3o22mdm?NNy1n`U>L(YC;DmY6Xe6c%Vrp!#y?<~;qaVt+|Y-A~K##>hF
zB4lNF@dp-=f?S`U(<#D*Y?;%ogd2Qk8vuZo_TOCq6{(y?$5PW>hx}E()UJCtB=i{+
z%VQbmlGd&oelCbGBvDpo_T-#FDxe84`h4lW>_v}sYym8;)F-;>>m$<_d$k<B-t;EP
z?6ed}qTE*1Fw>QlPqxjp3s;3B)N&%p2LGl}5c4YcZ~)825>15FjI&?K21E+<`PD{-
zU%liU9h2D8((X7-54Y=%N|;vxzE1pY(3dZKPP!j{FLleo&9%eiYo?TsOZ7aJw8)X@
z5QPGBTDuVyps_r}k3(QeRm;{VTj>LRWLtK$W5cf&pDTTGky8}V!kV_5lVo$}$CNbN
zE2Na7p1yR+7TFObUU;-6UyR3!%61*A6c8qE)qRVRr21|X#c~xM-_nFv9KAcj$=@^N
zb=D;nn|8+V25ONUGKZC3QVUqxBp4wzc)wJmP|)^;Cbq78#Pn6pJI3o&)z*k$iB*W5
znut>t_7RNJ9j{4gT~LlXTDImcB9P&n{AjA3UxVI`xi9DZruBzMd4$#)i(Vm{E74w)
z?4&d5ZZ$SCn%FH)d<Ru&3w=HpFL+lI%exIVwkAVaW!nSCk>3gAgN?6w?X4t{Nj3%I
z&(H<S+i6bJekQNvCi62cW2+$AosLh%`@$eYHP6V1Lz%BE$3HL3(3Y~(N8R(Iz21a?
z#V^zhfc^M@4RaJ;T=6A!=lOVcb*3DZ+<2miB^8i?fKMB`6e*=P>Rcqa!LERmCz07x
zBY)*1OOE}Wq{5j3#!oXpYT63_6sBY4fv76Bh(#<*b}$ZlZ+TJ5biMFh0xLF8p-l&Z
zz9CjNDEW1HzHo7QQu~{|v~2$d^z|Vgpmo>ZDrFAyMXkVsZtkCaJ;%ZDoW?-06zZ&^
zszJj9-gfyGbz)Cu@EFZ=TwhTZ*_Xc;`C{!zBK9%7x^sx-Ia4m8M{PqRWL!z6>uKMB
zGeQH`MHiQf?{|x&y=uK2KEhfw`B{occ8y8j|J$nqpi<tq)e@w}d825#-2a6w5Q&ea
zIRR$x^om%%zL+u$m!|Qdy4ite4;BgBKf~!K!U3IIYnhWp8`Df-Q@m>b5pGCufR1-;
zAMwq0)lPu_+nn&*j+3KW&>vSHpAX}I49hH*qrFHdDF}J+k!3NmIR+5p@0wPA@Cl5`
z6m?5JuH~Tp!55{+7^sRr|7yk<VDyqO<0Yz2Dt3nyF$5hDwHf{*PwTjtKeSZkF>3bq
zxnjVQQh?mV?vR^SRYCHy!uuQ|sb@PKR8Xh&5cj--6}aYszRG{9%(Bq7@ZVM!t4x6!
zc@S@jJ^NxGVDEX9F7l+~xyBtwE_9zG3|~#lNMS;MApt=DuAPV$J<64oBF?A2AI?xB
zEV;1v-5f*AY?OpY#=2(ONfk}rBfNY>Uz3*rIz@64)DAnAkG!rXU5F796d*hm1Wd<%
z5KMcP;i34o89F;xjiD4u&5n?N)wDtS{P724)=ikqt&S!xFjOw9?)}ByC0(vHx664d
z@H5!(;cB#1BZQfq$V2>X#uwzho%gGzk(GZOBWfo#S`xXIt@Dq+goBY4sh))=&@N52
V6fLn*CGz?bpe(O0S0iH?{y%IZ@nHY}

diff --git a/doc/source/assets/js/bootstrap.js b/doc/source/assets/js/bootstrap.js
deleted file mode 100644
index c832ccb2e6..0000000000
--- a/doc/source/assets/js/bootstrap.js
+++ /dev/null
@@ -1,1722 +0,0 @@
-/* ===================================================
- * bootstrap-transition.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#transitions
- * ===================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-!function( $ ) {
-
-  $(function () {
-
-    "use strict"
-
-    /* CSS TRANSITION SUPPORT (https://gist.github.com/373874)
-     * ======================================================= */
-
-    $.support.transition = (function () {
-      var thisBody = document.body || document.documentElement
-        , thisStyle = thisBody.style
-        , support = thisStyle.transition !== undefined || thisStyle.WebkitTransition !== undefined || thisStyle.MozTransition !== undefined || thisStyle.MsTransition !== undefined || thisStyle.OTransition !== undefined
-
-      return support && {
-        end: (function () {
-          var transitionEnd = "TransitionEnd"
-          if ( $.browser.webkit ) {
-          	transitionEnd = "webkitTransitionEnd"
-          } else if ( $.browser.mozilla ) {
-          	transitionEnd = "transitionend"
-          } else if ( $.browser.opera ) {
-          	transitionEnd = "oTransitionEnd"
-          }
-          return transitionEnd
-        }())
-      }
-    })()
-
-  })
-  
-}( window.jQuery )
-/* ==========================================================
- * bootstrap-alert.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#alerts
- * ==========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* ALERT CLASS DEFINITION
-  * ====================== */
-
-  var dismiss = '[data-dismiss="alert"]'
-    , Alert = function ( el ) {
-        $(el).on('click', dismiss, this.close)
-      }
-
-  Alert.prototype = {
-
-    constructor: Alert
-
-  , close: function ( e ) {
-      var $this = $(this)
-        , selector = $this.attr('data-target')
-        , $parent
-
-      if (!selector) {
-        selector = $this.attr('href')
-        selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') //strip for ie7
-      }
-
-      $parent = $(selector)
-      $parent.trigger('close')
-
-      e && e.preventDefault()
-
-      $parent.length || ($parent = $this.hasClass('alert') ? $this : $this.parent())
-
-      $parent.removeClass('in')
-
-      function removeElement() {
-        $parent.remove()
-        $parent.trigger('closed')
-      }
-
-      $.support.transition && $parent.hasClass('fade') ?
-        $parent.on($.support.transition.end, removeElement) :
-        removeElement()
-    }
-
-  }
-
-
- /* ALERT PLUGIN DEFINITION
-  * ======================= */
-
-  $.fn.alert = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('alert')
-      if (!data) $this.data('alert', (data = new Alert(this)))
-      if (typeof option == 'string') data[option].call($this)
-    })
-  }
-
-  $.fn.alert.Constructor = Alert
-
-
- /* ALERT DATA-API
-  * ============== */
-
-  $(function () {
-    $('body').on('click.alert.data-api', dismiss, Alert.prototype.close)
-  })
-
-}( window.jQuery )
-/* ============================================================
- * bootstrap-button.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#buttons
- * ============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-!function( $ ){
-
-  "use strict"
-
- /* BUTTON PUBLIC CLASS DEFINITION
-  * ============================== */
-
-  var Button = function ( element, options ) {
-    this.$element = $(element)
-    this.options = $.extend({}, $.fn.button.defaults, options)
-  }
-
-  Button.prototype = {
-
-      constructor: Button
-
-    , setState: function ( state ) {
-        var d = 'disabled'
-          , $el = this.$element
-          , data = $el.data()
-          , val = $el.is('input') ? 'val' : 'html'
-
-        state = state + 'Text'
-        data.resetText || $el.data('resetText', $el[val]())
-
-        $el[val](data[state] || this.options[state])
-
-        // push to event loop to allow forms to submit
-        setTimeout(function () {
-          state == 'loadingText' ?
-            $el.addClass(d).attr(d, d) :
-            $el.removeClass(d).removeAttr(d)
-        }, 0)
-      }
-
-    , toggle: function () {
-        var $parent = this.$element.parent('[data-toggle="buttons-radio"]')
-
-        $parent && $parent
-          .find('.active')
-          .removeClass('active')
-
-        this.$element.toggleClass('active')
-      }
-
-  }
-
-
- /* BUTTON PLUGIN DEFINITION
-  * ======================== */
-
-  $.fn.button = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('button')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('button', (data = new Button(this, options)))
-      if (option == 'toggle') data.toggle()
-      else if (option) data.setState(option)
-    })
-  }
-
-  $.fn.button.defaults = {
-    loadingText: 'loading...'
-  }
-
-  $.fn.button.Constructor = Button
-
-
- /* BUTTON DATA-API
-  * =============== */
-
-  $(function () {
-    $('body').on('click.button.data-api', '[data-toggle^=button]', function ( e ) {
-      $(e.target).button('toggle')
-    })
-  })
-
-}( window.jQuery )
-/* ==========================================================
- * bootstrap-carousel.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#carousel
- * ==========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* CAROUSEL CLASS DEFINITION
-  * ========================= */
-
-  var Carousel = function (element, options) {
-    this.$element = $(element)
-    this.options = $.extend({}, $.fn.carousel.defaults, options)
-    this.options.slide && this.slide(this.options.slide)
-  }
-
-  Carousel.prototype = {
-
-    cycle: function () {
-      this.interval = setInterval($.proxy(this.next, this), this.options.interval)
-      return this
-    }
-
-  , to: function (pos) {
-      var $active = this.$element.find('.active')
-        , children = $active.parent().children()
-        , activePos = children.index($active)
-        , that = this
-
-      if (pos > (children.length - 1) || pos < 0) return
-
-      if (this.sliding) {
-        return this.$element.one('slid', function () {
-          that.to(pos)
-        })
-      }
-
-      if (activePos == pos) {
-        return this.pause().cycle()
-      }
-
-      return this.slide(pos > activePos ? 'next' : 'prev', $(children[pos]))
-    }
-
-  , pause: function () {
-      clearInterval(this.interval)
-      return this
-    }
-
-  , next: function () {
-      if (this.sliding) return
-      return this.slide('next')
-    }
-
-  , prev: function () {
-      if (this.sliding) return
-      return this.slide('prev')
-    }
-
-  , slide: function (type, next) {
-      var $active = this.$element.find('.active')
-        , $next = next || $active[type]()
-        , isCycling = this.interval
-        , direction = type == 'next' ? 'left' : 'right'
-        , fallback  = type == 'next' ? 'first' : 'last'
-        , that = this
-
-      this.sliding = true
-
-      isCycling && this.pause()
-
-      $next = $next.length ? $next : this.$element.find('.item')[fallback]()
-
-      if (!$.support.transition && this.$element.hasClass('slide')) {
-        this.$element.trigger('slide')
-        $active.removeClass('active')
-        $next.addClass('active')
-        this.sliding = false
-        this.$element.trigger('slid')
-      } else {
-        $next.addClass(type)
-        $next[0].offsetWidth // force reflow
-        $active.addClass(direction)
-        $next.addClass(direction)
-        this.$element.trigger('slide')
-        this.$element.one($.support.transition.end, function () {
-          $next.removeClass([type, direction].join(' ')).addClass('active')
-          $active.removeClass(['active', direction].join(' '))
-          that.sliding = false
-          setTimeout(function () { that.$element.trigger('slid') }, 0)
-        })
-      }
-
-      isCycling && this.cycle()
-
-      return this
-    }
-
-  }
-
-
- /* CAROUSEL PLUGIN DEFINITION
-  * ========================== */
-
-  $.fn.carousel = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('carousel')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('carousel', (data = new Carousel(this, options)))
-      if (typeof option == 'number') data.to(option)
-      else if (typeof option == 'string' || (option = options.slide)) data[option]()
-      else data.cycle()
-    })
-  }
-
-  $.fn.carousel.defaults = {
-    interval: 5000
-  }
-
-  $.fn.carousel.Constructor = Carousel
-
-
- /* CAROUSEL DATA-API
-  * ================= */
-
-  $(function () {
-    $('body').on('click.carousel.data-api', '[data-slide]', function ( e ) {
-      var $this = $(this), href
-        , $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) //strip for ie7
-        , options = !$target.data('modal') && $.extend({}, $target.data(), $this.data())
-      $target.carousel(options)
-      e.preventDefault()
-    })
-  })
-
-}( window.jQuery )
-/* =============================================================
- * bootstrap-collapse.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#collapse
- * =============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-!function( $ ){
-
-  "use strict"
-
-  var Collapse = function ( element, options ) {
-  	this.$element = $(element)
-    this.options = $.extend({}, $.fn.collapse.defaults, options)
-
-    if (this.options["parent"]) {
-      this.$parent = $(this.options["parent"])
-    }
-
-    this.options.toggle && this.toggle()
-  }
-
-  Collapse.prototype = {
-
-    constructor: Collapse
-
-  , dimension: function () {
-      var hasWidth = this.$element.hasClass('width')
-      return hasWidth ? 'width' : 'height'
-    }
-
-  , show: function () {
-      var dimension = this.dimension()
-        , scroll = $.camelCase(['scroll', dimension].join('-'))
-        , actives = this.$parent && this.$parent.find('.in')
-        , hasData
-
-      if (actives && actives.length) {
-        hasData = actives.data('collapse')
-        actives.collapse('hide')
-        hasData || actives.data('collapse', null)
-      }
-
-      this.$element[dimension](0)
-      this.transition('addClass', 'show', 'shown')
-      this.$element[dimension](this.$element[0][scroll])
-
-    }
-
-  , hide: function () {
-      var dimension = this.dimension()
-      this.reset(this.$element[dimension]())
-      this.transition('removeClass', 'hide', 'hidden')
-      this.$element[dimension](0)
-    }
-
-  , reset: function ( size ) {
-      var dimension = this.dimension()
-
-      this.$element
-        .removeClass('collapse')
-        [dimension](size || 'auto')
-        [0].offsetWidth
-
-      this.$element.addClass('collapse')
-    }
-
-  , transition: function ( method, startEvent, completeEvent ) {
-      var that = this
-        , complete = function () {
-            if (startEvent == 'show') that.reset()
-            that.$element.trigger(completeEvent)
-          }
-
-      this.$element
-        .trigger(startEvent)
-        [method]('in')
-
-      $.support.transition && this.$element.hasClass('collapse') ?
-        this.$element.one($.support.transition.end, complete) :
-        complete()
-  	}
-
-  , toggle: function () {
-      this[this.$element.hasClass('in') ? 'hide' : 'show']()
-  	}
-
-  }
-
-  /* COLLAPSIBLE PLUGIN DEFINITION
-  * ============================== */
-
-  $.fn.collapse = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('collapse')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('collapse', (data = new Collapse(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.collapse.defaults = {
-    toggle: true
-  }
-
-  $.fn.collapse.Constructor = Collapse
-
-
- /* COLLAPSIBLE DATA-API
-  * ==================== */
-
-  $(function () {
-    $('body').on('click.collapse.data-api', '[data-toggle=collapse]', function ( e ) {
-      var $this = $(this), href
-        , target = $this.attr('data-target')
-          || e.preventDefault()
-          || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') //strip for ie7
-        , option = $(target).data('collapse') ? 'toggle' : $this.data()
-      $(target).collapse(option)
-    })
-  })
-
-}( window.jQuery )
-/* ============================================================
- * bootstrap-dropdown.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#dropdowns
- * ============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* DROPDOWN CLASS DEFINITION
-  * ========================= */
-
-  var toggle = '[data-toggle="dropdown"]'
-    , Dropdown = function ( element ) {
-        var $el = $(element).on('click.dropdown.data-api', this.toggle)
-        $('html').on('click.dropdown.data-api', function () {
-          $el.parent().removeClass('open')
-        })
-      }
-
-  Dropdown.prototype = {
-
-    constructor: Dropdown
-
-  , toggle: function ( e ) {
-      var $this = $(this)
-        , selector = $this.attr('data-target')
-        , $parent
-        , isActive
-
-      if (!selector) {
-        selector = $this.attr('href')
-        selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') //strip for ie7
-      }
-
-      $parent = $(selector)
-      $parent.length || ($parent = $this.parent())
-
-      isActive = $parent.hasClass('open')
-
-      clearMenus()
-      !isActive && $parent.toggleClass('open')
-
-      return false
-    }
-
-  }
-
-  function clearMenus() {
-    $(toggle).parent().removeClass('open')
-  }
-
-
-  /* DROPDOWN PLUGIN DEFINITION
-   * ========================== */
-
-  $.fn.dropdown = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('dropdown')
-      if (!data) $this.data('dropdown', (data = new Dropdown(this)))
-      if (typeof option == 'string') data[option].call($this)
-    })
-  }
-
-  $.fn.dropdown.Constructor = Dropdown
-
-
-  /* APPLY TO STANDARD DROPDOWN ELEMENTS
-   * =================================== */
-
-  $(function () {
-    $('html').on('click.dropdown.data-api', clearMenus)
-    $('body').on('click.dropdown.data-api', toggle, Dropdown.prototype.toggle)
-  })
-
-}( window.jQuery )
-/* =========================================================
- * bootstrap-modal.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#modals
- * =========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================= */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* MODAL CLASS DEFINITION
-  * ====================== */
-
-  var Modal = function ( content, options ) {
-    this.options = $.extend({}, $.fn.modal.defaults, options)
-    this.$element = $(content)
-      .delegate('[data-dismiss="modal"]', 'click.dismiss.modal', $.proxy(this.hide, this))
-  }
-
-  Modal.prototype = {
-
-      constructor: Modal
-
-    , toggle: function () {
-        return this[!this.isShown ? 'show' : 'hide']()
-      }
-
-    , show: function () {
-        var that = this
-
-        if (this.isShown) return
-
-        $('body').addClass('modal-open')
-
-        this.isShown = true
-        this.$element.trigger('show')
-
-        escape.call(this)
-        backdrop.call(this, function () {
-          var transition = $.support.transition && that.$element.hasClass('fade')
-
-          !that.$element.parent().length && that.$element.appendTo(document.body) //don't move modals dom position
-
-          that.$element
-            .show()
-
-          if (transition) {
-            that.$element[0].offsetWidth // force reflow
-          }
-
-          that.$element.addClass('in')
-
-          transition ?
-            that.$element.one($.support.transition.end, function () { that.$element.trigger('shown') }) :
-            that.$element.trigger('shown')
-
-        })
-      }
-
-    , hide: function ( e ) {
-        e && e.preventDefault()
-
-        if (!this.isShown) return
-
-        var that = this
-        this.isShown = false
-
-        $('body').removeClass('modal-open')
-
-        escape.call(this)
-
-        this.$element
-          .trigger('hide')
-          .removeClass('in')
-
-        $.support.transition && this.$element.hasClass('fade') ?
-          hideWithTransition.call(this) :
-          hideModal.call(this)
-      }
-
-  }
-
-
- /* MODAL PRIVATE METHODS
-  * ===================== */
-
-  function hideWithTransition() {
-    var that = this
-      , timeout = setTimeout(function () {
-          that.$element.off($.support.transition.end)
-          hideModal.call(that)
-        }, 500)
-
-    this.$element.one($.support.transition.end, function () {
-      clearTimeout(timeout)
-      hideModal.call(that)
-    })
-  }
-
-  function hideModal( that ) {
-    this.$element
-      .hide()
-      .trigger('hidden')
-
-    backdrop.call(this)
-  }
-
-  function backdrop( callback ) {
-    var that = this
-      , animate = this.$element.hasClass('fade') ? 'fade' : ''
-
-    if (this.isShown && this.options.backdrop) {
-      var doAnimate = $.support.transition && animate
-
-      this.$backdrop = $('<div class="modal-backdrop ' + animate + '" />')
-        .appendTo(document.body)
-
-      if (this.options.backdrop != 'static') {
-        this.$backdrop.click($.proxy(this.hide, this))
-      }
-
-      if (doAnimate) this.$backdrop[0].offsetWidth // force reflow
-
-      this.$backdrop.addClass('in')
-
-      doAnimate ?
-        this.$backdrop.one($.support.transition.end, callback) :
-        callback()
-
-    } else if (!this.isShown && this.$backdrop) {
-      this.$backdrop.removeClass('in')
-
-      $.support.transition && this.$element.hasClass('fade')?
-        this.$backdrop.one($.support.transition.end, $.proxy(removeBackdrop, this)) :
-        removeBackdrop.call(this)
-
-    } else if (callback) {
-      callback()
-    }
-  }
-
-  function removeBackdrop() {
-    this.$backdrop.remove()
-    this.$backdrop = null
-  }
-
-  function escape() {
-    var that = this
-    if (this.isShown && this.options.keyboard) {
-      $(document).on('keyup.dismiss.modal', function ( e ) {
-        e.which == 27 && that.hide()
-      })
-    } else if (!this.isShown) {
-      $(document).off('keyup.dismiss.modal')
-    }
-  }
-
-
- /* MODAL PLUGIN DEFINITION
-  * ======================= */
-
-  $.fn.modal = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('modal')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('modal', (data = new Modal(this, options)))
-      if (typeof option == 'string') data[option]()
-      else data.show()
-    })
-  }
-
-  $.fn.modal.defaults = {
-      backdrop: true
-    , keyboard: true
-  }
-
-  $.fn.modal.Constructor = Modal
-
-
- /* MODAL DATA-API
-  * ============== */
-
-  $(function () {
-    $('body').on('click.modal.data-api', '[data-toggle="modal"]', function ( e ) {
-      var $this = $(this), href
-        , $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) //strip for ie7
-        , option = $target.data('modal') ? 'toggle' : $.extend({}, $target.data(), $this.data())
-
-      e.preventDefault()
-      $target.modal(option)
-    })
-  })
-
-}( window.jQuery )
-/* ===========================================================
- * bootstrap-tooltip.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#tooltips
- * Inspired by the original jQuery.tipsy by Jason Frame
- * ===========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-!function( $ ) {
-
-  "use strict"
-
- /* TOOLTIP PUBLIC CLASS DEFINITION
-  * =============================== */
-
-  var Tooltip = function ( element, options ) {
-    this.init('tooltip', element, options)
-  }
-
-  Tooltip.prototype = {
-
-    constructor: Tooltip
-
-  , init: function ( type, element, options ) {
-      var eventIn
-        , eventOut
-
-      this.type = type
-      this.$element = $(element)
-      this.options = this.getOptions(options)
-      this.enabled = true
-
-      if (this.options.trigger != 'manual') {
-        eventIn  = this.options.trigger == 'hover' ? 'mouseenter' : 'focus'
-        eventOut = this.options.trigger == 'hover' ? 'mouseleave' : 'blur'
-        this.$element.on(eventIn, this.options.selector, $.proxy(this.enter, this))
-        this.$element.on(eventOut, this.options.selector, $.proxy(this.leave, this))
-      }
-
-      this.options.selector ?
-        (this._options = $.extend({}, this.options, { trigger: 'manual', selector: '' })) :
-        this.fixTitle()
-    }
-
-  , getOptions: function ( options ) {
-      options = $.extend({}, $.fn[this.type].defaults, options, this.$element.data())
-
-      if (options.delay && typeof options.delay == 'number') {
-        options.delay = {
-          show: options.delay
-        , hide: options.delay
-        }
-      }
-
-      return options
-    }
-
-  , enter: function ( e ) {
-      var self = $(e.currentTarget)[this.type](this._options).data(this.type)
-
-      if (!self.options.delay || !self.options.delay.show) {
-        self.show()
-      } else {
-        self.hoverState = 'in'
-        setTimeout(function() {
-          if (self.hoverState == 'in') {
-            self.show()
-          }
-        }, self.options.delay.show)
-      }
-    }
-
-  , leave: function ( e ) {
-      var self = $(e.currentTarget)[this.type](this._options).data(this.type)
-
-      if (!self.options.delay || !self.options.delay.hide) {
-        self.hide()
-      } else {
-        self.hoverState = 'out'
-        setTimeout(function() {
-          if (self.hoverState == 'out') {
-            self.hide()
-          }
-        }, self.options.delay.hide)
-      }
-    }
-
-  , show: function () {
-      var $tip
-        , inside
-        , pos
-        , actualWidth
-        , actualHeight
-        , placement
-        , tp
-
-      if (this.hasContent() && this.enabled) {
-        $tip = this.tip()
-        this.setContent()
-
-        if (this.options.animation) {
-          $tip.addClass('fade')
-        }
-
-        placement = typeof this.options.placement == 'function' ?
-          this.options.placement.call(this, $tip[0], this.$element[0]) :
-          this.options.placement
-
-        inside = /in/.test(placement)
-
-        $tip
-          .remove()
-          .css({ top: 0, left: 0, display: 'block' })
-          .appendTo(inside ? this.$element : document.body)
-
-        pos = this.getPosition(inside)
-
-        actualWidth = $tip[0].offsetWidth
-        actualHeight = $tip[0].offsetHeight
-
-        switch (inside ? placement.split(' ')[1] : placement) {
-          case 'bottom':
-            tp = {top: pos.top + pos.height, left: pos.left + pos.width / 2 - actualWidth / 2}
-            break
-          case 'top':
-            tp = {top: pos.top - actualHeight, left: pos.left + pos.width / 2 - actualWidth / 2}
-            break
-          case 'left':
-            tp = {top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left - actualWidth}
-            break
-          case 'right':
-            tp = {top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left + pos.width}
-            break
-        }
-
-        $tip
-          .css(tp)
-          .addClass(placement)
-          .addClass('in')
-      }
-    }
-
-  , setContent: function () {
-      var $tip = this.tip()
-      $tip.find('.tooltip-inner').html(this.getTitle())
-      $tip.removeClass('fade in top bottom left right')
-    }
-
-  , hide: function () {
-      var that = this
-        , $tip = this.tip()
-
-      $tip.removeClass('in')
-
-      function removeWithAnimation() {
-        var timeout = setTimeout(function () {
-          $tip.off($.support.transition.end).remove()
-        }, 500)
-
-        $tip.one($.support.transition.end, function () {
-          clearTimeout(timeout)
-          $tip.remove()
-        })
-      }
-
-      $.support.transition && this.$tip.hasClass('fade') ?
-        removeWithAnimation() :
-        $tip.remove()
-    }
-
-  , fixTitle: function () {
-      var $e = this.$element
-      if ($e.attr('title') || typeof($e.attr('data-original-title')) != 'string') {
-        $e.attr('data-original-title', $e.attr('title') || '').removeAttr('title')
-      }
-    }
-
-  , hasContent: function () {
-      return this.getTitle()
-    }
-
-  , getPosition: function (inside) {
-      return $.extend({}, (inside ? {top: 0, left: 0} : this.$element.offset()), {
-        width: this.$element[0].offsetWidth
-      , height: this.$element[0].offsetHeight
-      })
-    }
-
-  , getTitle: function () {
-      var title
-        , $e = this.$element
-        , o = this.options
-
-      title = $e.attr('data-original-title')
-        || (typeof o.title == 'function' ? o.title.call($e[0]) :  o.title)
-
-      title = title.toString().replace(/(^\s*|\s*$)/, "")
-
-      return title
-    }
-
-  , tip: function () {
-      return this.$tip = this.$tip || $(this.options.template)
-    }
-
-  , validate: function () {
-      if (!this.$element[0].parentNode) {
-        this.hide()
-        this.$element = null
-        this.options = null
-      }
-    }
-
-  , enable: function () {
-      this.enabled = true
-    }
-
-  , disable: function () {
-      this.enabled = false
-    }
-
-  , toggleEnabled: function () {
-      this.enabled = !this.enabled
-    }
-
-  , toggle: function () {
-      this[this.tip().hasClass('in') ? 'hide' : 'show']()
-    }
-
-  }
-
-
- /* TOOLTIP PLUGIN DEFINITION
-  * ========================= */
-
-  $.fn.tooltip = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('tooltip')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('tooltip', (data = new Tooltip(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.tooltip.Constructor = Tooltip
-
-  $.fn.tooltip.defaults = {
-    animation: true
-  , delay: 0
-  , selector: false
-  , placement: 'top'
-  , trigger: 'hover'
-  , title: ''
-  , template: '<div class="tooltip"><div class="tooltip-arrow"></div><div class="tooltip-inner"></div></div>'
-  }
-
-}( window.jQuery )
-/* ===========================================================
- * bootstrap-popover.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#popovers
- * ===========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * =========================================================== */
-
-
-!function( $ ) {
-
- "use strict"
-
-  var Popover = function ( element, options ) {
-    this.init('popover', element, options)
-  }
-
-  /* NOTE: POPOVER EXTENDS BOOTSTRAP-TOOLTIP.js
-     ========================================== */
-
-  Popover.prototype = $.extend({}, $.fn.tooltip.Constructor.prototype, {
-
-    constructor: Popover
-
-  , setContent: function () {
-      var $tip = this.tip()
-        , title = this.getTitle()
-        , content = this.getContent()
-
-      $tip.find('.popover-title')[ $.type(title) == 'object' ? 'append' : 'html' ](title)
-      $tip.find('.popover-content > *')[ $.type(content) == 'object' ? 'append' : 'html' ](content)
-
-      $tip.removeClass('fade top bottom left right in')
-    }
-
-  , hasContent: function () {
-      return this.getTitle() || this.getContent()
-    }
-
-  , getContent: function () {
-      var content
-        , $e = this.$element
-        , o = this.options
-
-      content = $e.attr('data-content')
-        || (typeof o.content == 'function' ? o.content.call($e[0]) :  o.content)
-
-      content = content.toString().replace(/(^\s*|\s*$)/, "")
-
-      return content
-    }
-
-  , tip: function() {
-      if (!this.$tip) {
-        this.$tip = $(this.options.template)
-      }
-      return this.$tip
-    }
-
-  })
-
-
- /* POPOVER PLUGIN DEFINITION
-  * ======================= */
-
-  $.fn.popover = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('popover')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('popover', (data = new Popover(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.popover.Constructor = Popover
-
-  $.fn.popover.defaults = $.extend({} , $.fn.tooltip.defaults, {
-    placement: 'right'
-  , content: ''
-  , template: '<div class="popover"><div class="arrow"></div><div class="popover-inner"><h3 class="popover-title"></h3><div class="popover-content"><p></p></div></div></div>'
-  })
-
-}( window.jQuery )
-/* =============================================================
- * bootstrap-scrollspy.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#scrollspy
- * =============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================== */
-
-!function ( $ ) {
-
-  "use strict"
-
-  /* SCROLLSPY CLASS DEFINITION
-   * ========================== */
-
-  function ScrollSpy( element, options) {
-    var process = $.proxy(this.process, this)
-      , $element = $(element).is('body') ? $(window) : $(element)
-      , href
-    this.options = $.extend({}, $.fn.scrollspy.defaults, options)
-    this.$scrollElement = $element.on('scroll.scroll.data-api', process)
-    this.selector = (this.options.target
-      || ((href = $(element).attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) //strip for ie7
-      || '') + ' .nav li > a'
-    this.$body = $('body').on('click.scroll.data-api', this.selector, process)
-    this.refresh()
-    this.process()
-  }
-
-  ScrollSpy.prototype = {
-
-      constructor: ScrollSpy
-
-    , refresh: function () {
-        this.targets = this.$body
-          .find(this.selector)
-          .map(function () {
-            var href = $(this).attr('href')
-            return /^#\w/.test(href) && $(href).length ? href : null
-          })
-
-        this.offsets = $.map(this.targets, function (id) {
-          return $(id).position().top
-        })
-      }
-
-    , process: function () {
-        var scrollTop = this.$scrollElement.scrollTop() + this.options.offset
-          , offsets = this.offsets
-          , targets = this.targets
-          , activeTarget = this.activeTarget
-          , i
-
-        for (i = offsets.length; i--;) {
-          activeTarget != targets[i]
-            && scrollTop >= offsets[i]
-            && (!offsets[i + 1] || scrollTop <= offsets[i + 1])
-            && this.activate( targets[i] )
-        }
-      }
-
-    , activate: function (target) {
-        var active
-
-        this.activeTarget = target
-
-        this.$body
-          .find(this.selector).parent('.active')
-          .removeClass('active')
-
-        active = this.$body
-          .find(this.selector + '[href="' + target + '"]')
-          .parent('li')
-          .addClass('active')
-
-        if ( active.parent('.dropdown-menu') )  {
-          active.closest('li.dropdown').addClass('active')
-        }
-      }
-
-  }
-
-
- /* SCROLLSPY PLUGIN DEFINITION
-  * =========================== */
-
-  $.fn.scrollspy = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('scrollspy')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('scrollspy', (data = new ScrollSpy(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.scrollspy.Constructor = ScrollSpy
-
-  $.fn.scrollspy.defaults = {
-    offset: 10
-  }
-
-
- /* SCROLLSPY DATA-API
-  * ================== */
-
-  $(function () {
-    $('[data-spy="scroll"]').each(function () {
-      var $spy = $(this)
-      $spy.scrollspy($spy.data())
-    })
-  })
-
-}( window.jQuery )
-/* ========================================================
- * bootstrap-tab.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#tabs
- * ========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ======================================================== */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* TAB CLASS DEFINITION
-  * ==================== */
-
-  var Tab = function ( element ) {
-    this.element = $(element)
-  }
-
-  Tab.prototype = {
-
-    constructor: Tab
-
-  , show: function () {
-      var $this = this.element
-        , $ul = $this.closest('ul:not(.dropdown-menu)')
-        , selector = $this.attr('data-target')
-        , previous
-        , $target
-
-      if (!selector) {
-        selector = $this.attr('href')
-        selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') //strip for ie7
-      }
-
-      if ( $this.parent('li').hasClass('active') ) return
-
-      previous = $ul.find('.active a').last()[0]
-
-      $this.trigger({
-        type: 'show'
-      , relatedTarget: previous
-      })
-
-      $target = $(selector)
-
-      this.activate($this.parent('li'), $ul)
-      this.activate($target, $target.parent(), function () {
-        $this.trigger({
-          type: 'shown'
-        , relatedTarget: previous
-        })
-      })
-    }
-
-  , activate: function ( element, container, callback) {
-      var $active = container.find('> .active')
-        , transition = callback
-            && $.support.transition
-            && $active.hasClass('fade')
-
-      function next() {
-        $active
-          .removeClass('active')
-          .find('> .dropdown-menu > .active')
-          .removeClass('active')
-
-        element.addClass('active')
-
-        if (transition) {
-          element[0].offsetWidth // reflow for transition
-          element.addClass('in')
-        } else {
-          element.removeClass('fade')
-        }
-
-        if ( element.parent('.dropdown-menu') ) {
-          element.closest('li.dropdown').addClass('active')
-        }
-
-        callback && callback()
-      }
-
-      transition ?
-        $active.one($.support.transition.end, next) :
-        next()
-
-      $active.removeClass('in')
-    }
-  }
-
-
- /* TAB PLUGIN DEFINITION
-  * ===================== */
-
-  $.fn.tab = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('tab')
-      if (!data) $this.data('tab', (data = new Tab(this)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.tab.Constructor = Tab
-
-
- /* TAB DATA-API
-  * ============ */
-
-  $(function () {
-    $('body').on('click.tab.data-api', '[data-toggle="tab"], [data-toggle="pill"]', function (e) {
-      e.preventDefault()
-      $(this).tab('show')
-    })
-  })
-
-}( window.jQuery )
-/* =============================================================
- * bootstrap-typeahead.js v2.0.0
- * http://twitter.github.com/bootstrap/javascript.html#typeahead
- * =============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-!function( $ ){
-
-  "use strict"
-
-  var Typeahead = function ( element, options ) {
-    this.$element = $(element)
-    this.options = $.extend({}, $.fn.typeahead.defaults, options)
-    this.matcher = this.options.matcher || this.matcher
-    this.sorter = this.options.sorter || this.sorter
-    this.highlighter = this.options.highlighter || this.highlighter
-    this.$menu = $(this.options.menu).appendTo('body')
-    this.source = this.options.source
-    this.shown = false
-    this.listen()
-  }
-
-  Typeahead.prototype = {
-
-    constructor: Typeahead
-
-  , select: function () {
-      var val = this.$menu.find('.active').attr('data-value')
-      this.$element.val(val)
-      return this.hide()
-    }
-
-  , show: function () {
-      var pos = $.extend({}, this.$element.offset(), {
-        height: this.$element[0].offsetHeight
-      })
-
-      this.$menu.css({
-        top: pos.top + pos.height
-      , left: pos.left
-      })
-
-      this.$menu.show()
-      this.shown = true
-      return this
-    }
-
-  , hide: function () {
-      this.$menu.hide()
-      this.shown = false
-      return this
-    }
-
-  , lookup: function (event) {
-      var that = this
-        , items
-        , q
-
-      this.query = this.$element.val()
-
-      if (!this.query) {
-        return this.shown ? this.hide() : this
-      }
-
-      items = $.grep(this.source, function (item) {
-        if (that.matcher(item)) return item
-      })
-
-      items = this.sorter(items)
-
-      if (!items.length) {
-        return this.shown ? this.hide() : this
-      }
-
-      return this.render(items.slice(0, this.options.items)).show()
-    }
-
-  , matcher: function (item) {
-      return ~item.toLowerCase().indexOf(this.query.toLowerCase())
-    }
-
-  , sorter: function (items) {
-      var beginswith = []
-        , caseSensitive = []
-        , caseInsensitive = []
-        , item
-
-      while (item = items.shift()) {
-        if (!item.toLowerCase().indexOf(this.query.toLowerCase())) beginswith.push(item)
-        else if (~item.indexOf(this.query)) caseSensitive.push(item)
-        else caseInsensitive.push(item)
-      }
-
-      return beginswith.concat(caseSensitive, caseInsensitive)
-    }
-
-  , highlighter: function (item) {
-      return item.replace(new RegExp('(' + this.query + ')', 'ig'), function ($1, match) {
-        return '<strong>' + match + '</strong>'
-      })
-    }
-
-  , render: function (items) {
-      var that = this
-
-      items = $(items).map(function (i, item) {
-        i = $(that.options.item).attr('data-value', item)
-        i.find('a').html(that.highlighter(item))
-        return i[0]
-      })
-
-      items.first().addClass('active')
-      this.$menu.html(items)
-      return this
-    }
-
-  , next: function (event) {
-      var active = this.$menu.find('.active').removeClass('active')
-        , next = active.next()
-
-      if (!next.length) {
-        next = $(this.$menu.find('li')[0])
-      }
-
-      next.addClass('active')
-    }
-
-  , prev: function (event) {
-      var active = this.$menu.find('.active').removeClass('active')
-        , prev = active.prev()
-
-      if (!prev.length) {
-        prev = this.$menu.find('li').last()
-      }
-
-      prev.addClass('active')
-    }
-
-  , listen: function () {
-      this.$element
-        .on('blur',     $.proxy(this.blur, this))
-        .on('keypress', $.proxy(this.keypress, this))
-        .on('keyup',    $.proxy(this.keyup, this))
-
-      if ($.browser.webkit || $.browser.msie) {
-        this.$element.on('keydown', $.proxy(this.keypress, this))
-      }
-
-      this.$menu
-        .on('click', $.proxy(this.click, this))
-        .on('mouseenter', 'li', $.proxy(this.mouseenter, this))
-    }
-
-  , keyup: function (e) {
-      e.stopPropagation()
-      e.preventDefault()
-
-      switch(e.keyCode) {
-        case 40: // down arrow
-        case 38: // up arrow
-          break
-
-        case 9: // tab
-        case 13: // enter
-          if (!this.shown) return
-          this.select()
-          break
-
-        case 27: // escape
-          this.hide()
-          break
-
-        default:
-          this.lookup()
-      }
-
-  }
-
-  , keypress: function (e) {
-      e.stopPropagation()
-      if (!this.shown) return
-
-      switch(e.keyCode) {
-        case 9: // tab
-        case 13: // enter
-        case 27: // escape
-          e.preventDefault()
-          break
-
-        case 38: // up arrow
-          e.preventDefault()
-          this.prev()
-          break
-
-        case 40: // down arrow
-          e.preventDefault()
-          this.next()
-          break
-      }
-    }
-
-  , blur: function (e) {
-      var that = this
-      e.stopPropagation()
-      e.preventDefault()
-      setTimeout(function () { that.hide() }, 150)
-    }
-
-  , click: function (e) {
-      e.stopPropagation()
-      e.preventDefault()
-      this.select()
-    }
-
-  , mouseenter: function (e) {
-      this.$menu.find('.active').removeClass('active')
-      $(e.currentTarget).addClass('active')
-    }
-
-  }
-
-
-  /* TYPEAHEAD PLUGIN DEFINITION
-   * =========================== */
-
-  $.fn.typeahead = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('typeahead')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('typeahead', (data = new Typeahead(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.typeahead.defaults = {
-    source: []
-  , items: 8
-  , menu: '<ul class="typeahead dropdown-menu"></ul>'
-  , item: '<li><a href="#"></a></li>'
-  }
-
-  $.fn.typeahead.Constructor = Typeahead
-
-
- /* TYPEAHEAD DATA-API
-  * ================== */
-
-  $(function () {
-    $('body').on('focus.typeahead.data-api', '[data-provide="typeahead"]', function (e) {
-      var $this = $(this)
-      if ($this.data('typeahead')) return
-      e.preventDefault()
-      $this.typeahead($this.data())
-    })
-  })
-
-}( window.jQuery )
diff --git a/doc/source/assets/js/bootstrap.min.js b/doc/source/assets/js/bootstrap.min.js
deleted file mode 100644
index 1f295a14e9..0000000000
--- a/doc/source/assets/js/bootstrap.min.js
+++ /dev/null
@@ -1 +0,0 @@
-!function(a){a(function(){"use strict",a.support.transition=function(){var b=document.body||document.documentElement,c=b.style,d=c.transition!==undefined||c.WebkitTransition!==undefined||c.MozTransition!==undefined||c.MsTransition!==undefined||c.OTransition!==undefined;return d&&{end:function(){var b="TransitionEnd";return a.browser.webkit?b="webkitTransitionEnd":a.browser.mozilla?b="transitionend":a.browser.opera&&(b="oTransitionEnd"),b}()}}()})}(window.jQuery),!function(a){"use strict";var b='[data-dismiss="alert"]',c=function(c){a(c).on("click",b,this.close)};c.prototype={constructor:c,close:function(b){function f(){e.remove(),e.trigger("closed")}var c=a(this),d=c.attr("data-target"),e;d||(d=c.attr("href"),d=d&&d.replace(/.*(?=#[^\s]*$)/,"")),e=a(d),e.trigger("close"),b&&b.preventDefault(),e.length||(e=c.hasClass("alert")?c:c.parent()),e.removeClass("in"),a.support.transition&&e.hasClass("fade")?e.on(a.support.transition.end,f):f()}},a.fn.alert=function(b){return this.each(function(){var d=a(this),e=d.data("alert");e||d.data("alert",e=new c(this)),typeof b=="string"&&e[b].call(d)})},a.fn.alert.Constructor=c,a(function(){a("body").on("click.alert.data-api",b,c.prototype.close)})}(window.jQuery),!function(a){"use strict";var b=function(b,c){this.$element=a(b),this.options=a.extend({},a.fn.button.defaults,c)};b.prototype={constructor:b,setState:function(a){var b="disabled",c=this.$element,d=c.data(),e=c.is("input")?"val":"html";a+="Text",d.resetText||c.data("resetText",c[e]()),c[e](d[a]||this.options[a]),setTimeout(function(){a=="loadingText"?c.addClass(b).attr(b,b):c.removeClass(b).removeAttr(b)},0)},toggle:function(){var a=this.$element.parent('[data-toggle="buttons-radio"]');a&&a.find(".active").removeClass("active"),this.$element.toggleClass("active")}},a.fn.button=function(c){return this.each(function(){var d=a(this),e=d.data("button"),f=typeof c=="object"&&c;e||d.data("button",e=new b(this,f)),c=="toggle"?e.toggle():c&&e.setState(c)})},a.fn.button.defaults={loadingText:"loading..."},a.fn.button.Constructor=b,a(function(){a("body").on("click.button.data-api","[data-toggle^=button]",function(b){a(b.target).button("toggle")})})}(window.jQuery),!function(a){"use strict";var b=function(b,c){this.$element=a(b),this.options=a.extend({},a.fn.carousel.defaults,c),this.options.slide&&this.slide(this.options.slide)};b.prototype={cycle:function(){return this.interval=setInterval(a.proxy(this.next,this),this.options.interval),this},to:function(b){var c=this.$element.find(".active"),d=c.parent().children(),e=d.index(c),f=this;if(b>d.length-1||b<0)return;return this.sliding?this.$element.one("slid",function(){f.to(b)}):e==b?this.pause().cycle():this.slide(b>e?"next":"prev",a(d[b]))},pause:function(){return clearInterval(this.interval),this},next:function(){if(this.sliding)return;return this.slide("next")},prev:function(){if(this.sliding)return;return this.slide("prev")},slide:function(b,c){var d=this.$element.find(".active"),e=c||d[b](),f=this.interval,g=b=="next"?"left":"right",h=b=="next"?"first":"last",i=this;return this.sliding=!0,f&&this.pause(),e=e.length?e:this.$element.find(".item")[h](),!a.support.transition&&this.$element.hasClass("slide")?(this.$element.trigger("slide"),d.removeClass("active"),e.addClass("active"),this.sliding=!1,this.$element.trigger("slid")):(e.addClass(b),e[0].offsetWidth,d.addClass(g),e.addClass(g),this.$element.trigger("slide"),this.$element.one(a.support.transition.end,function(){e.removeClass([b,g].join(" ")).addClass("active"),d.removeClass(["active",g].join(" ")),i.sliding=!1,setTimeout(function(){i.$element.trigger("slid")},0)})),f&&this.cycle(),this}},a.fn.carousel=function(c){return this.each(function(){var d=a(this),e=d.data("carousel"),f=typeof c=="object"&&c;e||d.data("carousel",e=new b(this,f)),typeof c=="number"?e.to(c):typeof c=="string"||(c=f.slide)?e[c]():e.cycle()})},a.fn.carousel.defaults={interval:5e3},a.fn.carousel.Constructor=b,a(function(){a("body").on("click.carousel.data-api","[data-slide]",function(b){var c=a(this),d,e=a(c.attr("data-target")||(d=c.attr("href"))&&d.replace(/.*(?=#[^\s]+$)/,"")),f=!e.data("modal")&&a.extend({},e.data(),c.data());e.carousel(f),b.preventDefault()})})}(window.jQuery),!function(a){"use strict";var b=function(b,c){this.$element=a(b),this.options=a.extend({},a.fn.collapse.defaults,c),this.options.parent&&(this.$parent=a(this.options.parent)),this.options.toggle&&this.toggle()};b.prototype={constructor:b,dimension:function(){var a=this.$element.hasClass("width");return a?"width":"height"},show:function(){var b=this.dimension(),c=a.camelCase(["scroll",b].join("-")),d=this.$parent&&this.$parent.find(".in"),e;d&&d.length&&(e=d.data("collapse"),d.collapse("hide"),e||d.data("collapse",null)),this.$element[b](0),this.transition("addClass","show","shown"),this.$element[b](this.$element[0][c])},hide:function(){var a=this.dimension();this.reset(this.$element[a]()),this.transition("removeClass","hide","hidden"),this.$element[a](0)},reset:function(a){var b=this.dimension();this.$element.removeClass("collapse")[b](a||"auto")[0].offsetWidth,this.$element.addClass("collapse")},transition:function(b,c,d){var e=this,f=function(){c=="show"&&e.reset(),e.$element.trigger(d)};this.$element.trigger(c)[b]("in"),a.support.transition&&this.$element.hasClass("collapse")?this.$element.one(a.support.transition.end,f):f()},toggle:function(){this[this.$element.hasClass("in")?"hide":"show"]()}},a.fn.collapse=function(c){return this.each(function(){var d=a(this),e=d.data("collapse"),f=typeof c=="object"&&c;e||d.data("collapse",e=new b(this,f)),typeof c=="string"&&e[c]()})},a.fn.collapse.defaults={toggle:!0},a.fn.collapse.Constructor=b,a(function(){a("body").on("click.collapse.data-api","[data-toggle=collapse]",function(b){var c=a(this),d,e=c.attr("data-target")||b.preventDefault()||(d=c.attr("href"))&&d.replace(/.*(?=#[^\s]+$)/,""),f=a(e).data("collapse")?"toggle":c.data();a(e).collapse(f)})})}(window.jQuery),!function(a){function d(){a(b).parent().removeClass("open")}"use strict";var b='[data-toggle="dropdown"]',c=function(b){var c=a(b).on("click.dropdown.data-api",this.toggle);a("html").on("click.dropdown.data-api",function(){c.parent().removeClass("open")})};c.prototype={constructor:c,toggle:function(b){var c=a(this),e=c.attr("data-target"),f,g;return e||(e=c.attr("href"),e=e&&e.replace(/.*(?=#[^\s]*$)/,"")),f=a(e),f.length||(f=c.parent()),g=f.hasClass("open"),d(),!g&&f.toggleClass("open"),!1}},a.fn.dropdown=function(b){return this.each(function(){var d=a(this),e=d.data("dropdown");e||d.data("dropdown",e=new c(this)),typeof b=="string"&&e[b].call(d)})},a.fn.dropdown.Constructor=c,a(function(){a("html").on("click.dropdown.data-api",d),a("body").on("click.dropdown.data-api",b,c.prototype.toggle)})}(window.jQuery),!function(a){function c(){var b=this,c=setTimeout(function(){b.$element.off(a.support.transition.end),d.call(b)},500);this.$element.one(a.support.transition.end,function(){clearTimeout(c),d.call(b)})}function d(a){this.$element.hide().trigger("hidden"),e.call(this)}function e(b){var c=this,d=this.$element.hasClass("fade")?"fade":"";if(this.isShown&&this.options.backdrop){var e=a.support.transition&&d;this.$backdrop=a('<div class="modal-backdrop '+d+'" />').appendTo(document.body),this.options.backdrop!="static"&&this.$backdrop.click(a.proxy(this.hide,this)),e&&this.$backdrop[0].offsetWidth,this.$backdrop.addClass("in"),e?this.$backdrop.one(a.support.transition.end,b):b()}else!this.isShown&&this.$backdrop?(this.$backdrop.removeClass("in"),a.support.transition&&this.$element.hasClass("fade")?this.$backdrop.one(a.support.transition.end,a.proxy(f,this)):f.call(this)):b&&b()}function f(){this.$backdrop.remove(),this.$backdrop=null}function g(){var b=this;this.isShown&&this.options.keyboard?a(document).on("keyup.dismiss.modal",function(a){a.which==27&&b.hide()}):this.isShown||a(document).off("keyup.dismiss.modal")}"use strict";var b=function(b,c){this.options=a.extend({},a.fn.modal.defaults,c),this.$element=a(b).delegate('[data-dismiss="modal"]',"click.dismiss.modal",a.proxy(this.hide,this))};b.prototype={constructor:b,toggle:function(){return this[this.isShown?"hide":"show"]()},show:function(){var b=this;if(this.isShown)return;a("body").addClass("modal-open"),this.isShown=!0,this.$element.trigger("show"),g.call(this),e.call(this,function(){var c=a.support.transition&&b.$element.hasClass("fade");!b.$element.parent().length&&b.$element.appendTo(document.body),b.$element.show(),c&&b.$element[0].offsetWidth,b.$element.addClass("in"),c?b.$element.one(a.support.transition.end,function(){b.$element.trigger("shown")}):b.$element.trigger("shown")})},hide:function(b){b&&b.preventDefault();if(!this.isShown)return;var e=this;this.isShown=!1,a("body").removeClass("modal-open"),g.call(this),this.$element.trigger("hide").removeClass("in"),a.support.transition&&this.$element.hasClass("fade")?c.call(this):d.call(this)}},a.fn.modal=function(c){return this.each(function(){var d=a(this),e=d.data("modal"),f=typeof c=="object"&&c;e||d.data("modal",e=new b(this,f)),typeof c=="string"?e[c]():e.show()})},a.fn.modal.defaults={backdrop:!0,keyboard:!0},a.fn.modal.Constructor=b,a(function(){a("body").on("click.modal.data-api",'[data-toggle="modal"]',function(b){var c=a(this),d,e=a(c.attr("data-target")||(d=c.attr("href"))&&d.replace(/.*(?=#[^\s]+$)/,"")),f=e.data("modal")?"toggle":a.extend({},e.data(),c.data());b.preventDefault(),e.modal(f)})})}(window.jQuery),!function(a){"use strict";var b=function(a,b){this.init("tooltip",a,b)};b.prototype={constructor:b,init:function(b,c,d){var e,f;this.type=b,this.$element=a(c),this.options=this.getOptions(d),this.enabled=!0,this.options.trigger!="manual"&&(e=this.options.trigger=="hover"?"mouseenter":"focus",f=this.options.trigger=="hover"?"mouseleave":"blur",this.$element.on(e,this.options.selector,a.proxy(this.enter,this)),this.$element.on(f,this.options.selector,a.proxy(this.leave,this))),this.options.selector?this._options=a.extend({},this.options,{trigger:"manual",selector:""}):this.fixTitle()},getOptions:function(b){return b=a.extend({},a.fn[this.type].defaults,b,this.$element.data()),b.delay&&typeof b.delay=="number"&&(b.delay={show:b.delay,hide:b.delay}),b},enter:function(b){var c=a(b.currentTarget)[this.type](this._options).data(this.type);!c.options.delay||!c.options.delay.show?c.show():(c.hoverState="in",setTimeout(function(){c.hoverState=="in"&&c.show()},c.options.delay.show))},leave:function(b){var c=a(b.currentTarget)[this.type](this._options).data(this.type);!c.options.delay||!c.options.delay.hide?c.hide():(c.hoverState="out",setTimeout(function(){c.hoverState=="out"&&c.hide()},c.options.delay.hide))},show:function(){var a,b,c,d,e,f,g;if(this.hasContent()&&this.enabled){a=this.tip(),this.setContent(),this.options.animation&&a.addClass("fade"),f=typeof this.options.placement=="function"?this.options.placement.call(this,a[0],this.$element[0]):this.options.placement,b=/in/.test(f),a.remove().css({top:0,left:0,display:"block"}).appendTo(b?this.$element:document.body),c=this.getPosition(b),d=a[0].offsetWidth,e=a[0].offsetHeight;switch(b?f.split(" ")[1]:f){case"bottom":g={top:c.top+c.height,left:c.left+c.width/2-d/2};break;case"top":g={top:c.top-e,left:c.left+c.width/2-d/2};break;case"left":g={top:c.top+c.height/2-e/2,left:c.left-d};break;case"right":g={top:c.top+c.height/2-e/2,left:c.left+c.width}}a.css(g).addClass(f).addClass("in")}},setContent:function(){var a=this.tip();a.find(".tooltip-inner").html(this.getTitle()),a.removeClass("fade in top bottom left right")},hide:function(){function d(){var b=setTimeout(function(){c.off(a.support.transition.end).remove()},500);c.one(a.support.transition.end,function(){clearTimeout(b),c.remove()})}var b=this,c=this.tip();c.removeClass("in"),a.support.transition&&this.$tip.hasClass("fade")?d():c.remove()},fixTitle:function(){var a=this.$element;(a.attr("title")||typeof a.attr("data-original-title")!="string")&&a.attr("data-original-title",a.attr("title")||"").removeAttr("title")},hasContent:function(){return this.getTitle()},getPosition:function(b){return a.extend({},b?{top:0,left:0}:this.$element.offset(),{width:this.$element[0].offsetWidth,height:this.$element[0].offsetHeight})},getTitle:function(){var a,b=this.$element,c=this.options;return a=b.attr("data-original-title")||(typeof c.title=="function"?c.title.call(b[0]):c.title),a=a.toString().replace(/(^\s*|\s*$)/,""),a},tip:function(){return this.$tip=this.$tip||a(this.options.template)},validate:function(){this.$element[0].parentNode||(this.hide(),this.$element=null,this.options=null)},enable:function(){this.enabled=!0},disable:function(){this.enabled=!1},toggleEnabled:function(){this.enabled=!this.enabled},toggle:function(){this[this.tip().hasClass("in")?"hide":"show"]()}},a.fn.tooltip=function(c){return this.each(function(){var d=a(this),e=d.data("tooltip"),f=typeof c=="object"&&c;e||d.data("tooltip",e=new b(this,f)),typeof c=="string"&&e[c]()})},a.fn.tooltip.Constructor=b,a.fn.tooltip.defaults={animation:!0,delay:0,selector:!1,placement:"top",trigger:"hover",title:"",template:'<div class="tooltip"><div class="tooltip-arrow"></div><div class="tooltip-inner"></div></div>'}}(window.jQuery),!function(a){"use strict";var b=function(a,b){this.init("popover",a,b)};b.prototype=a.extend({},a.fn.tooltip.Constructor.prototype,{constructor:b,setContent:function(){var b=this.tip(),c=this.getTitle(),d=this.getContent();b.find(".popover-title")[a.type(c)=="object"?"append":"html"](c),b.find(".popover-content > *")[a.type(d)=="object"?"append":"html"](d),b.removeClass("fade top bottom left right in")},hasContent:function(){return this.getTitle()||this.getContent()},getContent:function(){var a,b=this.$element,c=this.options;return a=b.attr("data-content")||(typeof c.content=="function"?c.content.call(b[0]):c.content),a=a.toString().replace(/(^\s*|\s*$)/,""),a},tip:function(){return this.$tip||(this.$tip=a(this.options.template)),this.$tip}}),a.fn.popover=function(c){return this.each(function(){var d=a(this),e=d.data("popover"),f=typeof c=="object"&&c;e||d.data("popover",e=new b(this,f)),typeof c=="string"&&e[c]()})},a.fn.popover.Constructor=b,a.fn.popover.defaults=a.extend({},a.fn.tooltip.defaults,{placement:"right",content:"",template:'<div class="popover"><div class="arrow"></div><div class="popover-inner"><h3 class="popover-title"></h3><div class="popover-content"><p></p></div></div></div>'})}(window.jQuery),!function(a){function b(b,c){var d=a.proxy(this.process,this),e=a(b).is("body")?a(window):a(b),f;this.options=a.extend({},a.fn.scrollspy.defaults,c),this.$scrollElement=e.on("scroll.scroll.data-api",d),this.selector=(this.options.target||(f=a(b).attr("href"))&&f.replace(/.*(?=#[^\s]+$)/,"")||"")+" .nav li > a",this.$body=a("body").on("click.scroll.data-api",this.selector,d),this.refresh(),this.process()}"use strict",b.prototype={constructor:b,refresh:function(){this.targets=this.$body.find(this.selector).map(function(){var b=a(this).attr("href");return/^#\w/.test(b)&&a(b).length?b:null}),this.offsets=a.map(this.targets,function(b){return a(b).position().top})},process:function(){var a=this.$scrollElement.scrollTop()+this.options.offset,b=this.offsets,c=this.targets,d=this.activeTarget,e;for(e=b.length;e--;)d!=c[e]&&a>=b[e]&&(!b[e+1]||a<=b[e+1])&&this.activate(c[e])},activate:function(a){var b;this.activeTarget=a,this.$body.find(this.selector).parent(".active").removeClass("active"),b=this.$body.find(this.selector+'[href="'+a+'"]').parent("li").addClass("active"),b.parent(".dropdown-menu")&&b.closest("li.dropdown").addClass("active")}},a.fn.scrollspy=function(c){return this.each(function(){var d=a(this),e=d.data("scrollspy"),f=typeof c=="object"&&c;e||d.data("scrollspy",e=new b(this,f)),typeof c=="string"&&e[c]()})},a.fn.scrollspy.Constructor=b,a.fn.scrollspy.defaults={offset:10},a(function(){a('[data-spy="scroll"]').each(function(){var b=a(this);b.scrollspy(b.data())})})}(window.jQuery),!function(a){"use strict";var b=function(b){this.element=a(b)};b.prototype={constructor:b,show:function(){var b=this.element,c=b.closest("ul:not(.dropdown-menu)"),d=b.attr("data-target"),e,f;d||(d=b.attr("href"),d=d&&d.replace(/.*(?=#[^\s]*$)/,""));if(b.parent("li").hasClass("active"))return;e=c.find(".active a").last()[0],b.trigger({type:"show",relatedTarget:e}),f=a(d),this.activate(b.parent("li"),c),this.activate(f,f.parent(),function(){b.trigger({type:"shown",relatedTarget:e})})},activate:function(b,c,d){function g(){e.removeClass("active").find("> .dropdown-menu > .active").removeClass("active"),b.addClass("active"),f?(b[0].offsetWidth,b.addClass("in")):b.removeClass("fade"),b.parent(".dropdown-menu")&&b.closest("li.dropdown").addClass("active"),d&&d()}var e=c.find("> .active"),f=d&&a.support.transition&&e.hasClass("fade");f?e.one(a.support.transition.end,g):g(),e.removeClass("in")}},a.fn.tab=function(c){return this.each(function(){var d=a(this),e=d.data("tab");e||d.data("tab",e=new b(this)),typeof c=="string"&&e[c]()})},a.fn.tab.Constructor=b,a(function(){a("body").on("click.tab.data-api",'[data-toggle="tab"], [data-toggle="pill"]',function(b){b.preventDefault(),a(this).tab("show")})})}(window.jQuery),!function(a){"use strict";var b=function(b,c){this.$element=a(b),this.options=a.extend({},a.fn.typeahead.defaults,c),this.matcher=this.options.matcher||this.matcher,this.sorter=this.options.sorter||this.sorter,this.highlighter=this.options.highlighter||this.highlighter,this.$menu=a(this.options.menu).appendTo("body"),this.source=this.options.source,this.shown=!1,this.listen()};b.prototype={constructor:b,select:function(){var a=this.$menu.find(".active").attr("data-value");return this.$element.val(a),this.hide()},show:function(){var b=a.extend({},this.$element.offset(),{height:this.$element[0].offsetHeight});return this.$menu.css({top:b.top+b.height,left:b.left}),this.$menu.show(),this.shown=!0,this},hide:function(){return this.$menu.hide(),this.shown=!1,this},lookup:function(b){var c=this,d,e;return this.query=this.$element.val(),this.query?(d=a.grep(this.source,function(a){if(c.matcher(a))return a}),d=this.sorter(d),d.length?this.render(d.slice(0,this.options.items)).show():this.shown?this.hide():this):this.shown?this.hide():this},matcher:function(a){return~a.toLowerCase().indexOf(this.query.toLowerCase())},sorter:function(a){var b=[],c=[],d=[],e;while(e=a.shift())e.toLowerCase().indexOf(this.query.toLowerCase())?~e.indexOf(this.query)?c.push(e):d.push(e):b.push(e);return b.concat(c,d)},highlighter:function(a){return a.replace(new RegExp("("+this.query+")","ig"),function(a,b){return"<strong>"+b+"</strong>"})},render:function(b){var c=this;return b=a(b).map(function(b,d){return b=a(c.options.item).attr("data-value",d),b.find("a").html(c.highlighter(d)),b[0]}),b.first().addClass("active"),this.$menu.html(b),this},next:function(b){var c=this.$menu.find(".active").removeClass("active"),d=c.next();d.length||(d=a(this.$menu.find("li")[0])),d.addClass("active")},prev:function(a){var b=this.$menu.find(".active").removeClass("active"),c=b.prev();c.length||(c=this.$menu.find("li").last()),c.addClass("active")},listen:function(){this.$element.on("blur",a.proxy(this.blur,this)).on("keypress",a.proxy(this.keypress,this)).on("keyup",a.proxy(this.keyup,this)),(a.browser.webkit||a.browser.msie)&&this.$element.on("keydown",a.proxy(this.keypress,this)),this.$menu.on("click",a.proxy(this.click,this)).on("mouseenter","li",a.proxy(this.mouseenter,this))},keyup:function(a){a.stopPropagation(),a.preventDefault();switch(a.keyCode){case 40:case 38:break;case 9:case 13:if(!this.shown)return;this.select();break;case 27:this.hide();break;default:this.lookup()}},keypress:function(a){a.stopPropagation();if(!this.shown)return;switch(a.keyCode){case 9:case 13:case 27:a.preventDefault();break;case 38:a.preventDefault(),this.prev();break;case 40:a.preventDefault(),this.next()}},blur:function(a){var b=this;a.stopPropagation(),a.preventDefault(),setTimeout(function(){b.hide()},150)},click:function(a){a.stopPropagation(),a.preventDefault(),this.select()},mouseenter:function(b){this.$menu.find(".active").removeClass("active"),a(b.currentTarget).addClass("active")}},a.fn.typeahead=function(c){return this.each(function(){var d=a(this),e=d.data("typeahead"),f=typeof c=="object"&&c;e||d.data("typeahead",e=new b(this,f)),typeof c=="string"&&e[c]()})},a.fn.typeahead.defaults={source:[],items:8,menu:'<ul class="typeahead dropdown-menu"></ul>',item:'<li><a href="#"></a></li>'},a.fn.typeahead.Constructor=b,a(function(){a("body").on("focus.typeahead.data-api",'[data-provide="typeahead"]',function(b){var c=a(this);if(c.data("typeahead"))return;b.preventDefault(),c.typeahead(c.data())})})}(window.jQuery);
\ No newline at end of file
diff --git a/doc/source/assets/js/jquery-1.7.1.min.js b/doc/source/assets/js/jquery-1.7.1.min.js
deleted file mode 100644
index ee0233703d..0000000000
--- a/doc/source/assets/js/jquery-1.7.1.min.js
+++ /dev/null
@@ -1,4 +0,0 @@
-/*! jQuery v1.7.1 jquery.com | jquery.org/license */
-(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){cl||(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"")+"<html><body>"),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g++){if(g===1)for(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l+" "+k,n=e[m]||e["* "+k];if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[1]+" "+k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.error("No conversion from "+m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(c)))}}return c}function cb(a,c,d){var e=a.contents,f=a.dataTypes,g=a.responseFields,h,i,j,k;for(i in g)i in d&&(c[g[i]]=d[i]);while(f[0]==="*")f.shift(),h===b&&(h=a.mimeType||c.getResponseHeader("content-type"));if(h)for(i in e)if(e[i]&&e[i].test(h)){f.unshift(i);break}if(f[0]in d)j=f[0];else{for(i in d){if(!f[0]||a.converters[i+" "+f[0]]){j=i;break}k||(k=i)}j=j||k}if(j){j!==f[0]&&f.unshift(j);return d[j]}}function ca(a,b,c,d){if(f.isArray(b))f.each(b,function(b,e){c||bE.test(a)?d(a,e):ca(a+"["+(typeof e=="object"||f.isArray(e)?b:"")+"]",e,c,d)});else if(!c&&b!=null&&typeof b=="object")for(var e in b)ca(a+"["+e+"]",b[e],c,d);else d(a,b)}function b_(a,c){var d,e,g=f.ajaxSettings.flatOptions||{};for(d in c)c[d]!==b&&((g[d]?a:e||(e={}))[d]=c[d]);e&&f.extend(!0,a,e)}function b$(a,c,d,e,f,g){f=f||c.dataTypes[0],g=g||{},g[f]=!0;var h=a[f],i=0,j=h?h.length:0,k=a===bT,l;for(;i<j&&(k||!l);i++)l=h[i](c,d,e),typeof l=="string"&&(!k||g[l]?l=b:(c.dataTypes.unshift(l),l=b$(a,c,d,e,l,g)));(k||!l)&&!g["*"]&&(l=b$(a,c,d,e,"*",g));return l}function bZ(a){return function(b,c){typeof b!="string"&&(c=b,b="*");if(f.isFunction(c)){var d=b.toLowerCase().split(bP),e=0,g=d.length,h,i,j;for(;e<g;e++)h=d[e],j=/^\+/.test(h),j&&(h=h.substr(1)||"*"),i=a[h]=a[h]||[],i[j?"unshift":"push"](c)}}}function bC(a,b,c){var d=b==="width"?a.offsetWidth:a.offsetHeight,e=b==="width"?bx:by,g=0,h=e.length;if(d>0){if(c!=="border")for(;g<h;g++)c||(d-=parseFloat(f.css(a,"padding"+e[g]))||0),c==="margin"?d+=parseFloat(f.css(a,c+e[g]))||0:d-=parseFloat(f.css(a,"border"+e[g]+"Width"))||0;return d+"px"}d=bz(a,b,b);if(d<0||d==null)d=a.style[b]||0;d=parseFloat(d)||0;if(c)for(;g<h;g++)d+=parseFloat(f.css(a,"padding"+e[g]))||0,c!=="padding"&&(d+=parseFloat(f.css(a,"border"+e[g]+"Width"))||0),c==="margin"&&(d+=parseFloat(f.css(a,c+e[g]))||0);return d+"px"}function bp(a,b){b.src?f.ajax({url:b.src,async:!1,dataType:"script"}):f.globalEval((b.text||b.textContent||b.innerHTML||"").replace(bf,"/*$0*/")),b.parentNode&&b.parentNode.removeChild(b)}function bo(a){var b=c.createElement("div");bh.appendChild(b),b.innerHTML=a.outerHTML;return b.firstChild}function bn(a){var b=(a.nodeName||"").toLowerCase();b==="input"?bm(a):b!=="script"&&typeof a.getElementsByTagName!="undefined"&&f.grep(a.getElementsByTagName("input"),bm)}function bm(a){if(a.type==="checkbox"||a.type==="radio")a.defaultChecked=a.checked}function bl(a){return typeof a.getElementsByTagName!="undefined"?a.getElementsByTagName("*"):typeof a.querySelectorAll!="undefined"?a.querySelectorAll("*"):[]}function bk(a,b){var c;if(b.nodeType===1){b.clearAttributes&&b.clearAttributes(),b.mergeAttributes&&b.mergeAttributes(a),c=b.nodeName.toLowerCase();if(c==="object")b.outerHTML=a.outerHTML;else if(c!=="input"||a.type!=="checkbox"&&a.type!=="radio"){if(c==="option")b.selected=a.defaultSelected;else if(c==="input"||c==="textarea")b.defaultValue=a.defaultValue}else a.checked&&(b.defaultChecked=b.checked=a.checked),b.value!==a.value&&(b.value=a.value);b.removeAttribute(f.expando)}}function bj(a,b){if(b.nodeType===1&&!!f.hasData(a)){var c,d,e,g=f._data(a),h=f._data(b,g),i=g.events;if(i){delete h.handle,h.events={};for(c in i)for(d=0,e=i[c].length;d<e;d++)f.event.add(b,c+(i[c][d].namespace?".":"")+i[c][d].namespace,i[c][d],i[c][d].data)}h.data&&(h.data=f.extend({},h.data))}}function bi(a,b){return f.nodeName(a,"table")?a.getElementsByTagName("tbody")[0]||a.appendChild(a.ownerDocument.createElement("tbody")):a}function U(a){var b=V.split("|"),c=a.createDocumentFragment();if(c.createElement)while(b.length)c.createElement(b.pop());return c}function T(a,b,c){b=b||0;if(f.isFunction(b))return f.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return f.grep(a,function(a,d){return a===b===c});if(typeof b=="string"){var d=f.grep(a,function(a){return a.nodeType===1});if(O.test(b))return f.filter(b,d,!c);b=f.filter(b,d)}return f.grep(a,function(a,d){return f.inArray(a,b)>=0===c})}function S(a){return!a||!a.parentNode||a.parentNode.nodeType===11}function K(){return!0}function J(){return!1}function n(a,b,c){var d=b+"defer",e=b+"queue",g=b+"mark",h=f._data(a,d);h&&(c==="queue"||!f._data(a,e))&&(c==="mark"||!f._data(a,g))&&setTimeout(function(){!f._data(a,e)&&!f._data(a,g)&&(f.removeData(a,d,!0),h.fire())},0)}function m(a){for(var b in a){if(b==="data"&&f.isEmptyObject(a[b]))continue;if(b!=="toJSON")return!1}return!0}function l(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(k,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:f.isNumeric(d)?parseFloat(d):j.test(d)?f.parseJSON(d):d}catch(g){}f.data(a,c,d)}else d=b}return d}function h(a){var b=g[a]={},c,d;a=a.split(/\s+/);for(c=0,d=a.length;c<d;c++)b[a[c]]=!0;return b}var c=a.document,d=a.navigator,e=a.location,f=function(){function J(){if(!e.isReady){try{c.documentElement.doScroll("left")}catch(a){setTimeout(J,1);return}e.ready()}}var e=function(a,b){return new e.fn.init(a,b,h)},f=a.jQuery,g=a.$,h,i=/^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,j=/\S/,k=/^\s+/,l=/\s+$/,m=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,n=/^[\],:{}\s]*$/,o=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,p=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,q=/(?:^|:|,)(?:\s*\[)+/g,r=/(webkit)[ \/]([\w.]+)/,s=/(opera)(?:.*version)?[ \/]([\w.]+)/,t=/(msie) ([\w.]+)/,u=/(mozilla)(?:.*? rv:([\w.]+))?/,v=/-([a-z]|[0-9])/ig,w=/^-ms-/,x=function(a,b){return(b+"").toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.nodeType){this.context=this[0]=a,this.length=1;return this}if(a==="body"&&!d&&c.body){this.context=c,this[0]=c.body,this.selector=a,this.length=1;return this}if(typeof a=="string"){a.charAt(0)!=="<"||a.charAt(a.length-1)!==">"||a.length<3?g=i.exec(a):g=[null,a,null];if(g&&(g[1]||!d)){if(g[1]){d=d instanceof e?d[0]:d,k=d?d.ownerDocument||d:c,j=m.exec(a),j?e.isPlainObject(d)?(a=[c.createElement(j[1])],e.fn.attr.call(a,d,!0)):a=[k.createElement(j[1])]:(j=e.buildFragment([g[1]],[k]),a=(j.cacheable?e.clone(j.fragment):j.fragment).childNodes);return e.merge(this,a)}h=c.getElementById(g[2]);if(h&&h.parentNode){if(h.id!==g[2])return f.find(a);this.length=1,this[0]=h}this.context=c,this.selector=a;return this}return!d||d.jquery?(d||f).find(a):this.constructor(d).find(a)}if(e.isFunction(a))return f.ready(a);a.selector!==b&&(this.selector=a.selector,this.context=a.context);return e.makeArray(a,this)},selector:"",jquery:"1.7.1",length:0,size:function(){return this.length},toArray:function(){return F.call(this,0)},get:function(a){return a==null?this.toArray():a<0?this[this.length+a]:this[a]},pushStack:function(a,b,c){var d=this.constructor();e.isArray(a)?E.apply(d,a):e.merge(d,a),d.prevObject=this,d.context=this.context,b==="find"?d.selector=this.selector+(this.selector?" ":"")+c:b&&(d.selector=this.selector+"."+b+"("+c+")");return d},each:function(a,b){return e.each(this,a,b)},ready:function(a){e.bindReady(),A.add(a);return this},eq:function(a){a=+a;return a===-1?this.slice(a):this.slice(a,a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(F.apply(this,arguments),"slice",F.call(arguments).join(","))},map:function(a){return this.pushStack(e.map(this,function(b,c){return a.call(b,c,b)}))},end:function(){return this.prevObject||this.constructor(null)},push:E,sort:[].sort,splice:[].splice},e.fn.init.prototype=e.fn,e.extend=e.fn.extend=function(){var a,c,d,f,g,h,i=arguments[0]||{},j=1,k=arguments.length,l=!1;typeof i=="boolean"&&(l=i,i=arguments[1]||{},j=2),typeof i!="object"&&!e.isFunction(i)&&(i={}),k===j&&(i=this,--j);for(;j<k;j++)if((a=arguments[j])!=null)for(c in a){d=i[c],f=a[c];if(i===f)continue;l&&f&&(e.isPlainObject(f)||(g=e.isArray(f)))?(g?(g=!1,h=d&&e.isArray(d)?d:[]):h=d&&e.isPlainObject(d)?d:{},i[c]=e.extend(l,h,f)):f!==b&&(i[c]=f)}return i},e.extend({noConflict:function(b){a.$===e&&(a.$=g),b&&a.jQuery===e&&(a.jQuery=f);return e},isReady:!1,readyWait:1,holdReady:function(a){a?e.readyWait++:e.ready(!0)},ready:function(a){if(a===!0&&!--e.readyWait||a!==!0&&!e.isReady){if(!c.body)return setTimeout(e.ready,1);e.isReady=!0;if(a!==!0&&--e.readyWait>0)return;A.fireWith(c,[e]),e.fn.trigger&&e(c).trigger("ready").off("ready")}},bindReady:function(){if(!A){A=e.Callbacks("once memory");if(c.readyState==="complete")return setTimeout(e.ready,1);if(c.addEventListener)c.addEventListener("DOMContentLoaded",B,!1),a.addEventListener("load",e.ready,!1);else if(c.attachEvent){c.attachEvent("onreadystatechange",B),a.attachEvent("onload",e.ready);var b=!1;try{b=a.frameElement==null}catch(d){}c.documentElement.doScroll&&b&&J()}}},isFunction:function(a){return e.type(a)==="function"},isArray:Array.isArray||function(a){return e.type(a)==="array"},isWindow:function(a){return a&&typeof a=="object"&&"setInterval"in a},isNumeric:function(a){return!isNaN(parseFloat(a))&&isFinite(a)},type:function(a){return a==null?String(a):I[C.call(a)]||"object"},isPlainObject:function(a){if(!a||e.type(a)!=="object"||a.nodeType||e.isWindow(a))return!1;try{if(a.constructor&&!D.call(a,"constructor")&&!D.call(a.constructor.prototype,"isPrototypeOf"))return!1}catch(c){return!1}var d;for(d in a);return d===b||D.call(a,d)},isEmptyObject:function(a){for(var b in a)return!1;return!0},error:function(a){throw new Error(a)},parseJSON:function(b){if(typeof b!="string"||!b)return null;b=e.trim(b);if(a.JSON&&a.JSON.parse)return a.JSON.parse(b);if(n.test(b.replace(o,"@").replace(p,"]").replace(q,"")))return(new Function("return "+b))();e.error("Invalid JSON: "+b)},parseXML:function(c){var d,f;try{a.DOMParser?(f=new DOMParser,d=f.parseFromString(c,"text/xml")):(d=new ActiveXObject("Microsoft.XMLDOM"),d.async="false",d.loadXML(c))}catch(g){d=b}(!d||!d.documentElement||d.getElementsByTagName("parsererror").length)&&e.error("Invalid XML: "+c);return d},noop:function(){},globalEval:function(b){b&&j.test(b)&&(a.execScript||function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(w,"ms-").replace(v,x)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toUpperCase()===b.toUpperCase()},each:function(a,c,d){var f,g=0,h=a.length,i=h===b||e.isFunction(a);if(d){if(i){for(f in a)if(c.apply(a[f],d)===!1)break}else for(;g<h;)if(c.apply(a[g++],d)===!1)break}else if(i){for(f in a)if(c.call(a[f],f,a[f])===!1)break}else for(;g<h;)if(c.call(a[g],g,a[g++])===!1)break;return a},trim:G?function(a){return a==null?"":G.call(a)}:function(a){return a==null?"":(a+"").replace(k,"").replace(l,"")},makeArray:function(a,b){var c=b||[];if(a!=null){var d=e.type(a);a.length==null||d==="string"||d==="function"||d==="regexp"||e.isWindow(a)?E.call(c,a):e.merge(c,a)}return c},inArray:function(a,b,c){var d;if(b){if(H)return H.call(b,a,c);d=b.length,c=c?c<0?Math.max(0,d+c):c:0;for(;c<d;c++)if(c in b&&b[c]===a)return c}return-1},merge:function(a,c){var d=a.length,e=0;if(typeof c.length=="number")for(var f=c.length;e<f;e++)a[d++]=c[e];else while(c[e]!==b)a[d++]=c[e++];a.length=d;return a},grep:function(a,b,c){var d=[],e;c=!!c;for(var f=0,g=a.length;f<g;f++)e=!!b(a[f],f),c!==e&&d.push(a[f]);return d},map:function(a,c,d){var f,g,h=[],i=0,j=a.length,k=a instanceof e||j!==b&&typeof j=="number"&&(j>0&&a[0]&&a[j-1]||j===0||e.isArray(a));if(k)for(;i<j;i++)f=c(a[i],i,d),f!=null&&(h[h.length]=f);else for(g in a)f=c(a[g],g,d),f!=null&&(h[h.length]=f);return h.concat.apply([],h)},guid:1,proxy:function(a,c){if(typeof c=="string"){var d=a[c];c=a,a=d}if(!e.isFunction(a))return b;var f=F.call(arguments,2),g=function(){return a.apply(c,f.concat(F.call(arguments)))};g.guid=a.guid=a.guid||g.guid||e.guid++;return g},access:function(a,c,d,f,g,h){var i=a.length;if(typeof c=="object"){for(var j in c)e.access(a,j,c[j],f,g,d);return a}if(d!==b){f=!h&&f&&e.isFunction(d);for(var k=0;k<i;k++)g(a[k],c,f?d.call(a[k],k,g(a[k],c)):d,h);return a}return i?g(a[0],c):b},now:function(){return(new Date).getTime()},uaMatch:function(a){a=a.toLowerCase();var b=r.exec(a)||s.exec(a)||t.exec(a)||a.indexOf("compatible")<0&&u.exec(a)||[];return{browser:b[1]||"",version:b[2]||"0"}},sub:function(){function a(b,c){return new a.fn.init(b,c)}e.extend(!0,a,this),a.superclass=this,a.fn=a.prototype=this(),a.fn.constructor=a,a.sub=this.sub,a.fn.init=function(d,f){f&&f instanceof e&&!(f instanceof a)&&(f=a(f));return e.fn.init.call(this,d,f,b)},a.fn.init.prototype=a.fn;var b=a(c);return a},browser:{}}),e.each("Boolean Number String Function Array Date RegExp Object".split(" "),function(a,b){I["[object "+b+"]"]=b.toLowerCase()}),z=e.uaMatch(y),z.browser&&(e.browser[z.browser]=!0,e.browser.version=z.version),e.browser.webkit&&(e.browser.safari=!0),j.test(" ")&&(k=/^[\s\xA0]+/,l=/[\s\xA0]+$/),h=e(c),c.addEventListener?B=function(){c.removeEventListener("DOMContentLoaded",B,!1),e.ready()}:c.attachEvent&&(B=function(){c.readyState==="complete"&&(c.detachEvent("onreadystatechange",B),e.ready())});return e}(),g={};f.Callbacks=function(a){a=a?g[a]||h(a):{};var c=[],d=[],e,i,j,k,l,m=function(b){var d,e,g,h,i;for(d=0,e=b.length;d<e;d++)g=b[d],h=f.type(g),h==="array"?m(g):h==="function"&&(!a.unique||!o.has(g))&&c.push(g)},n=function(b,f){f=f||[],e=!a.memory||[b,f],i=!0,l=j||0,j=0,k=c.length;for(;c&&l<k;l++)if(c[l].apply(b,f)===!1&&a.stopOnFalse){e=!0;break}i=!1,c&&(a.once?e===!0?o.disable():c=[]:d&&d.length&&(e=d.shift(),o.fireWith(e[0],e[1])))},o={add:function(){if(c){var a=c.length;m(arguments),i?k=c.length:e&&e!==!0&&(j=a,n(e[0],e[1]))}return this},remove:function(){if(c){var b=arguments,d=0,e=b.length;for(;d<e;d++)for(var f=0;f<c.length;f++)if(b[d]===c[f]){i&&f<=k&&(k--,f<=l&&l--),c.splice(f--,1);if(a.unique)break}}return this},has:function(a){if(c){var b=0,d=c.length;for(;b<d;b++)if(a===c[b])return!0}return!1},empty:function(){c=[];return this},disable:function(){c=d=e=b;return this},disabled:function(){return!c},lock:function(){d=b,(!e||e===!0)&&o.disable();return this},locked:function(){return!d},fireWith:function(b,c){d&&(i?a.once||d.push([b,c]):(!a.once||!e)&&n(b,c));return this},fire:function(){o.fireWith(this,arguments);return this},fired:function(){return!!e}};return o};var i=[].slice;f.extend({Deferred:function(a){var b=f.Callbacks("once memory"),c=f.Callbacks("once memory"),d=f.Callbacks("memory"),e="pending",g={resolve:b,reject:c,notify:d},h={done:b.add,fail:c.add,progress:d.add,state:function(){return e},isResolved:b.fired,isRejected:c.fired,then:function(a,b,c){i.done(a).fail(b).progress(c);return this},always:function(){i.done.apply(i,arguments).fail.apply(i,arguments);return this},pipe:function(a,b,c){return f.Deferred(function(d){f.each({done:[a,"resolve"],fail:[b,"reject"],progress:[c,"notify"]},function(a,b){var c=b[0],e=b[1],g;f.isFunction(c)?i[a](function(){g=c.apply(this,arguments),g&&f.isFunction(g.promise)?g.promise().then(d.resolve,d.reject,d.notify):d[e+"With"](this===i?d:this,[g])}):i[a](d[e])})}).promise()},promise:function(a){if(a==null)a=h;else for(var b in h)a[b]=h[b];return a}},i=h.promise({}),j;for(j in g)i[j]=g[j].fire,i[j+"With"]=g[j].fireWith;i.done(function(){e="resolved"},c.disable,d.lock).fail(function(){e="rejected"},b.disable,d.lock),a&&a.call(i,i);return i},when:function(a){function m(a){return function(b){e[a]=arguments.length>1?i.call(arguments,0):b,j.notifyWith(k,e)}}function l(a){return function(c){b[a]=arguments.length>1?i.call(arguments,0):c,--g||j.resolveWith(j,b)}}var b=i.call(arguments,0),c=0,d=b.length,e=Array(d),g=d,h=d,j=d<=1&&a&&f.isFunction(a.promise)?a:f.Deferred(),k=j.promise();if(d>1){for(;c<d;c++)b[c]&&b[c].promise&&f.isFunction(b[c].promise)?b[c].promise().then(l(c),j.reject,m(c)):--g;g||j.resolveWith(j,b)}else j!==a&&j.resolveWith(j,d?[a]:[]);return k}}),f.support=function(){var b,d,e,g,h,i,j,k,l,m,n,o,p,q=c.createElement("div"),r=c.documentElement;q.setAttribute("className","t"),q.innerHTML="   <link/><table></table><a href='/a' style='top:1px;float:left;opacity:.55;'>a</a><input type='checkbox'/>",d=q.getElementsByTagName("*"),e=q.getElementsByTagName("a")[0];if(!d||!d.length||!e)return{};g=c.createElement("select"),h=g.appendChild(c.createElement("option")),i=q.getElementsByTagName("input")[0],b={leadingWhitespace:q.firstChild.nodeType===3,tbody:!q.getElementsByTagName("tbody").length,htmlSerialize:!!q.getElementsByTagName("link").length,style:/top/.test(e.getAttribute("style")),hrefNormalized:e.getAttribute("href")==="/a",opacity:/^0.55/.test(e.style.opacity),cssFloat:!!e.style.cssFloat,checkOn:i.value==="on",optSelected:h.selected,getSetAttribute:q.className!=="t",enctype:!!c.createElement("form").enctype,html5Clone:c.createElement("nav").cloneNode(!0).outerHTML!=="<:nav></:nav>",submitBubbles:!0,changeBubbles:!0,focusinBubbles:!1,deleteExpando:!0,noCloneEvent:!0,inlineBlockNeedsLayout:!1,shrinkWrapBlocks:!1,reliableMarginRight:!0},i.checked=!0,b.noCloneChecked=i.cloneNode(!0).checked,g.disabled=!0,b.optDisabled=!h.disabled;try{delete q.test}catch(s){b.deleteExpando=!1}!q.addEventListener&&q.attachEvent&&q.fireEvent&&(q.attachEvent("onclick",function(){b.noCloneEvent=!1}),q.cloneNode(!0).fireEvent("onclick")),i=c.createElement("input"),i.value="t",i.setAttribute("type","radio"),b.radioValue=i.value==="t",i.setAttribute("checked","checked"),q.appendChild(i),k=c.createDocumentFragment(),k.appendChild(q.lastChild),b.checkClone=k.cloneNode(!0).cloneNode(!0).lastChild.checked,b.appendChecked=i.checked,k.removeChild(i),k.appendChild(q),q.innerHTML="",a.getComputedStyle&&(j=c.createElement("div"),j.style.width="0",j.style.marginRight="0",q.style.width="2px",q.appendChild(j),b.reliableMarginRight=(parseInt((a.getComputedStyle(j,null)||{marginRight:0}).marginRight,10)||0)===0);if(q.attachEvent)for(o in{submit:1,change:1,focusin:1})n="on"+o,p=n in q,p||(q.setAttribute(n,"return;"),p=typeof q[n]=="function"),b[o+"Bubbles"]=p;k.removeChild(q),k=g=h=j=q=i=null,f(function(){var a,d,e,g,h,i,j,k,m,n,o,r=c.getElementsByTagName("body")[0];!r||(j=1,k="position:absolute;top:0;left:0;width:1px;height:1px;margin:0;",m="visibility:hidden;border:0;",n="style='"+k+"border:5px solid #000;padding:0;'",o="<div "+n+"><div></div></div>"+"<table "+n+" cellpadding='0' cellspacing='0'>"+"<tr><td></td></tr></table>",a=c.createElement("div"),a.style.cssText=m+"width:0;height:0;position:static;top:0;margin-top:"+j+"px",r.insertBefore(a,r.firstChild),q=c.createElement("div"),a.appendChild(q),q.innerHTML="<table><tr><td style='padding:0;border:0;display:none'></td><td>t</td></tr></table>",l=q.getElementsByTagName("td"),p=l[0].offsetHeight===0,l[0].style.display="",l[1].style.display="none",b.reliableHiddenOffsets=p&&l[0].offsetHeight===0,q.innerHTML="",q.style.width=q.style.paddingLeft="1px",f.boxModel=b.boxModel=q.offsetWidth===2,typeof q.style.zoom!="undefined"&&(q.style.display="inline",q.style.zoom=1,b.inlineBlockNeedsLayout=q.offsetWidth===2,q.style.display="",q.innerHTML="<div style='width:4px;'></div>",b.shrinkWrapBlocks=q.offsetWidth!==2),q.style.cssText=k+m,q.innerHTML=o,d=q.firstChild,e=d.firstChild,h=d.nextSibling.firstChild.firstChild,i={doesNotAddBorder:e.offsetTop!==5,doesAddBorderForTableAndCells:h.offsetTop===5},e.style.position="fixed",e.style.top="20px",i.fixedPosition=e.offsetTop===20||e.offsetTop===15,e.style.position=e.style.top="",d.style.overflow="hidden",d.style.position="relative",i.subtractsBorderForOverflowNotVisible=e.offsetTop===-5,i.doesNotIncludeMarginInBodyOffset=r.offsetTop!==j,r.removeChild(a),q=a=null,f.extend(b,i))});return b}();var j=/^(?:\{.*\}|\[.*\])$/,k=/([A-Z])/g;f.extend({cache:{},uuid:0,expando:"jQuery"+(f.fn.jquery+Math.random()).replace(/\D/g,""),noData:{embed:!0,object:"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000",applet:!0},hasData:function(a){a=a.nodeType?f.cache[a[f.expando]]:a[f.expando];return!!a&&!m(a)},data:function(a,c,d,e){if(!!f.acceptData(a)){var g,h,i,j=f.expando,k=typeof c=="string",l=a.nodeType,m=l?f.cache:a,n=l?a[j]:a[j]&&j,o=c==="events";if((!n||!m[n]||!o&&!e&&!m[n].data)&&k&&d===b)return;n||(l?a[j]=n=++f.uuid:n=j),m[n]||(m[n]={},l||(m[n].toJSON=f.noop));if(typeof c=="object"||typeof c=="function")e?m[n]=f.extend(m[n],c):m[n].data=f.extend(m[n].data,c);g=h=m[n],e||(h.data||(h.data={}),h=h.data),d!==b&&(h[f.camelCase(c)]=d);if(o&&!h[c])return g.events;k?(i=h[c],i==null&&(i=h[f.camelCase(c)])):i=h;return i}},removeData:function(a,b,c){if(!!f.acceptData(a)){var d,e,g,h=f.expando,i=a.nodeType,j=i?f.cache:a,k=i?a[h]:h;if(!j[k])return;if(b){d=c?j[k]:j[k].data;if(d){f.isArray(b)||(b in d?b=[b]:(b=f.camelCase(b),b in d?b=[b]:b=b.split(" ")));for(e=0,g=b.length;e<g;e++)delete d[b[e]];if(!(c?m:f.isEmptyObject)(d))return}}if(!c){delete j[k].data;if(!m(j[k]))return}f.support.deleteExpando||!j.setInterval?delete j[k]:j[k]=null,i&&(f.support.deleteExpando?delete a[h]:a.removeAttribute?a.removeAttribute(h):a[h]=null)}},_data:function(a,b,c){return f.data(a,b,c,!0)},acceptData:function(a){if(a.nodeName){var b=f.noData[a.nodeName.toLowerCase()];if(b)return b!==!0&&a.getAttribute("classid")===b}return!0}}),f.fn.extend({data:function(a,c){var d,e,g,h=null;if(typeof a=="undefined"){if(this.length){h=f.data(this[0]);if(this[0].nodeType===1&&!f._data(this[0],"parsedAttrs")){e=this[0].attributes;for(var i=0,j=e.length;i<j;i++)g=e[i].name,g.indexOf("data-")===0&&(g=f.camelCase(g.substring(5)),l(this[0],g,h[g]));f._data(this[0],"parsedAttrs",!0)}}return h}if(typeof a=="object")return this.each(function(){f.data(this,a)});d=a.split("."),d[1]=d[1]?"."+d[1]:"";if(c===b){h=this.triggerHandler("getData"+d[1]+"!",[d[0]]),h===b&&this.length&&(h=f.data(this[0],a),h=l(this[0],a,h));return h===b&&d[1]?this.data(d[0]):h}return this.each(function(){var b=f(this),e=[d[0],c];b.triggerHandler("setData"+d[1]+"!",e),f.data(this,a,c),b.triggerHandler("changeData"+d[1]+"!",e)})},removeData:function(a){return this.each(function(){f.removeData(this,a)})}}),f.extend({_mark:function(a,b){a&&(b=(b||"fx")+"mark",f._data(a,b,(f._data(a,b)||0)+1))},_unmark:function(a,b,c){a!==!0&&(c=b,b=a,a=!1);if(b){c=c||"fx";var d=c+"mark",e=a?0:(f._data(b,d)||1)-1;e?f._data(b,d,e):(f.removeData(b,d,!0),n(b,c,"mark"))}},queue:function(a,b,c){var d;if(a){b=(b||"fx")+"queue",d=f._data(a,b),c&&(!d||f.isArray(c)?d=f._data(a,b,f.makeArray(c)):d.push(c));return d||[]}},dequeue:function(a,b){b=b||"fx";var c=f.queue(a,b),d=c.shift(),e={};d==="inprogress"&&(d=c.shift()),d&&(b==="fx"&&c.unshift("inprogress"),f._data(a,b+".run",e),d.call(a,function(){f.dequeue(a,b)},e)),c.length||(f.removeData(a,b+"queue "+b+".run",!0),n(a,b,"queue"))}}),f.fn.extend({queue:function(a,c){typeof a!="string"&&(c=a,a="fx");if(c===b)return f.queue(this[0],a);return this.each(function(){var b=f.queue(this,a,c);a==="fx"&&b[0]!=="inprogress"&&f.dequeue(this,a)})},dequeue:function(a){return this.each(function(){f.dequeue(this,a)})},delay:function(a,b){a=f.fx?f.fx.speeds[a]||a:a,b=b||"fx";return this.queue(b,function(b,c){var d=setTimeout(b,a);c.stop=function(){clearTimeout(d)}})},clearQueue:function(a){return this.queue(a||"fx",[])},promise:function(a,c){function m(){--h||d.resolveWith(e,[e])}typeof a!="string"&&(c=a,a=b),a=a||"fx";var d=f.Deferred(),e=this,g=e.length,h=1,i=a+"defer",j=a+"queue",k=a+"mark",l;while(g--)if(l=f.data(e[g],i,b,!0)||(f.data(e[g],j,b,!0)||f.data(e[g],k,b,!0))&&f.data(e[g],i,f.Callbacks("once memory"),!0))h++,l.add(m);m();return d.promise()}});var o=/[\n\t\r]/g,p=/\s+/,q=/\r/g,r=/^(?:button|input)$/i,s=/^(?:button|input|object|select|textarea)$/i,t=/^a(?:rea)?$/i,u=/^(?:autofocus|autoplay|async|checked|controls|defer|disabled|hidden|loop|multiple|open|readonly|required|scoped|selected)$/i,v=f.support.getSetAttribute,w,x,y;f.fn.extend({attr:function(a,b){return f.access(this,a,b,!0,f.attr)},removeAttr:function(a){return this.each(function(){f.removeAttr(this,a)})},prop:function(a,b){return f.access(this,a,b,!0,f.prop)},removeProp:function(a){a=f.propFix[a]||a;return this.each(function(){try{this[a]=b,delete this[a]}catch(c){}})},addClass:function(a){var b,c,d,e,g,h,i;if(f.isFunction(a))return this.each(function(b){f(this).addClass(a.call(this,b,this.className))});if(a&&typeof a=="string"){b=a.split(p);for(c=0,d=this.length;c<d;c++){e=this[c];if(e.nodeType===1)if(!e.className&&b.length===1)e.className=a;else{g=" "+e.className+" ";for(h=0,i=b.length;h<i;h++)~g.indexOf(" "+b[h]+" ")||(g+=b[h]+" ");e.className=f.trim(g)}}}return this},removeClass:function(a){var c,d,e,g,h,i,j;if(f.isFunction(a))return this.each(function(b){f(this).removeClass(a.call(this,b,this.className))});if(a&&typeof a=="string"||a===b){c=(a||"").split(p);for(d=0,e=this.length;d<e;d++){g=this[d];if(g.nodeType===1&&g.className)if(a){h=(" "+g.className+" ").replace(o," ");for(i=0,j=c.length;i<j;i++)h=h.replace(" "+c[i]+" "," ");g.className=f.trim(h)}else g.className=""}}return this},toggleClass:function(a,b){var c=typeof a,d=typeof b=="boolean";if(f.isFunction(a))return this.each(function(c){f(this).toggleClass(a.call(this,c,this.className,b),b)});return this.each(function(){if(c==="string"){var e,g=0,h=f(this),i=b,j=a.split(p);while(e=j[g++])i=d?i:!h.hasClass(e),h[i?"addClass":"removeClass"](e)}else if(c==="undefined"||c==="boolean")this.className&&f._data(this,"__className__",this.className),this.className=this.className||a===!1?"":f._data(this,"__className__")||""})},hasClass:function(a){var b=" "+a+" ",c=0,d=this.length;for(;c<d;c++)if(this[c].nodeType===1&&(" "+this[c].className+" ").replace(o," ").indexOf(b)>-1)return!0;return!1},val:function(a){var c,d,e,g=this[0];{if(!!arguments.length){e=f.isFunction(a);return this.each(function(d){var g=f(this),h;if(this.nodeType===1){e?h=a.call(this,d,g.val()):h=a,h==null?h="":typeof h=="number"?h+="":f.isArray(h)&&(h=f.map(h,function(a){return a==null?"":a+""})),c=f.valHooks[this.nodeName.toLowerCase()]||f.valHooks[this.type];if(!c||!("set"in c)||c.set(this,h,"value")===b)this.value=h}})}if(g){c=f.valHooks[g.nodeName.toLowerCase()]||f.valHooks[g.type];if(c&&"get"in c&&(d=c.get(g,"value"))!==b)return d;d=g.value;return typeof d=="string"?d.replace(q,""):d==null?"":d}}}}),f.extend({valHooks:{option:{get:function(a){var b=a.attributes.value;return!b||b.specified?a.value:a.text}},select:{get:function(a){var b,c,d,e,g=a.selectedIndex,h=[],i=a.options,j=a.type==="select-one";if(g<0)return null;c=j?g:0,d=j?g+1:i.length;for(;c<d;c++){e=i[c];if(e.selected&&(f.support.optDisabled?!e.disabled:e.getAttribute("disabled")===null)&&(!e.parentNode.disabled||!f.nodeName(e.parentNode,"optgroup"))){b=f(e).val();if(j)return b;h.push(b)}}if(j&&!h.length&&i.length)return f(i[g]).val();return h},set:function(a,b){var c=f.makeArray(b);f(a).find("option").each(function(){this.selected=f.inArray(f(this).val(),c)>=0}),c.length||(a.selectedIndex=-1);return c}}},attrFn:{val:!0,css:!0,html:!0,text:!0,data:!0,width:!0,height:!0,offset:!0},attr:function(a,c,d,e){var g,h,i,j=a.nodeType;if(!!a&&j!==3&&j!==8&&j!==2){if(e&&c in f.attrFn)return f(a)[c](d);if(typeof a.getAttribute=="undefined")return f.prop(a,c,d);i=j!==1||!f.isXMLDoc(a),i&&(c=c.toLowerCase(),h=f.attrHooks[c]||(u.test(c)?x:w));if(d!==b){if(d===null){f.removeAttr(a,c);return}if(h&&"set"in h&&i&&(g=h.set(a,d,c))!==b)return g;a.setAttribute(c,""+d);return d}if(h&&"get"in h&&i&&(g=h.get(a,c))!==null)return g;g=a.getAttribute(c);return g===null?b:g}},removeAttr:function(a,b){var c,d,e,g,h=0;if(b&&a.nodeType===1){d=b.toLowerCase().split(p),g=d.length;for(;h<g;h++)e=d[h],e&&(c=f.propFix[e]||e,f.attr(a,e,""),a.removeAttribute(v?e:c),u.test(e)&&c in a&&(a[c]=!1))}},attrHooks:{type:{set:function(a,b){if(r.test(a.nodeName)&&a.parentNode)f.error("type property can't be changed");else if(!f.support.radioValue&&b==="radio"&&f.nodeName(a,"input")){var c=a.value;a.setAttribute("type",b),c&&(a.value=c);return b}}},value:{get:function(a,b){if(w&&f.nodeName(a,"button"))return w.get(a,b);return b in a?a.value:null},set:function(a,b,c){if(w&&f.nodeName(a,"button"))return w.set(a,b,c);a.value=b}}},propFix:{tabindex:"tabIndex",readonly:"readOnly","for":"htmlFor","class":"className",maxlength:"maxLength",cellspacing:"cellSpacing",cellpadding:"cellPadding",rowspan:"rowSpan",colspan:"colSpan",usemap:"useMap",frameborder:"frameBorder",contenteditable:"contentEditable"},prop:function(a,c,d){var e,g,h,i=a.nodeType;if(!!a&&i!==3&&i!==8&&i!==2){h=i!==1||!f.isXMLDoc(a),h&&(c=f.propFix[c]||c,g=f.propHooks[c]);return d!==b?g&&"set"in g&&(e=g.set(a,d,c))!==b?e:a[c]=d:g&&"get"in g&&(e=g.get(a,c))!==null?e:a[c]}},propHooks:{tabIndex:{get:function(a){var c=a.getAttributeNode("tabindex");return c&&c.specified?parseInt(c.value,10):s.test(a.nodeName)||t.test(a.nodeName)&&a.href?0:b}}}}),f.attrHooks.tabindex=f.propHooks.tabIndex,x={get:function(a,c){var d,e=f.prop(a,c);return e===!0||typeof e!="boolean"&&(d=a.getAttributeNode(c))&&d.nodeValue!==!1?c.toLowerCase():b},set:function(a,b,c){var d;b===!1?f.removeAttr(a,c):(d=f.propFix[c]||c,d in a&&(a[d]=!0),a.setAttribute(c,c.toLowerCase()));return c}},v||(y={name:!0,id:!0},w=f.valHooks.button={get:function(a,c){var d;d=a.getAttributeNode(c);return d&&(y[c]?d.nodeValue!=="":d.specified)?d.nodeValue:b},set:function(a,b,d){var e=a.getAttributeNode(d);e||(e=c.createAttribute(d),a.setAttributeNode(e));return e.nodeValue=b+""}},f.attrHooks.tabindex.set=w.set,f.each(["width","height"],function(a,b){f.attrHooks[b]=f.extend(f.attrHooks[b],{set:function(a,c){if(c===""){a.setAttribute(b,"auto");return c}}})}),f.attrHooks.contenteditable={get:w.get,set:function(a,b,c){b===""&&(b="false"),w.set(a,b,c)}}),f.support.hrefNormalized||f.each(["href","src","width","height"],function(a,c){f.attrHooks[c]=f.extend(f.attrHooks[c],{get:function(a){var d=a.getAttribute(c,2);return d===null?b:d}})}),f.support.style||(f.attrHooks.style={get:function(a){return a.style.cssText.toLowerCase()||b},set:function(a,b){return a.style.cssText=""+b}}),f.support.optSelected||(f.propHooks.selected=f.extend(f.propHooks.selected,{get:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex);return null}})),f.support.enctype||(f.propFix.enctype="encoding"),f.support.checkOn||f.each(["radio","checkbox"],function(){f.valHooks[this]={get:function(a){return a.getAttribute("value")===null?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var z=/^(?:textarea|input|select)$/i,A=/^([^\.]*)?(?:\.(.+))?$/,B=/\bhover(\.\S+)?\b/,C=/^key/,D=/^(?:mouse|contextmenu)|click/,E=/^(?:focusinfocus|focusoutblur)$/,F=/^(\w*)(?:#([\w\-]+))?(?:\.([\w\-]+))?$/,G=function(a){var b=F.exec(a);b&&(b[1]=(b[1]||"").toLowerCase(),b[3]=b[3]&&new RegExp("(?:^|\\s)"+b[3]+"(?:\\s|$)"));return b},H=function(a,b){var c=a.attributes||{};return(!b[1]||a.nodeName.toLowerCase()===b[1])&&(!b[2]||(c.id||{}).value===b[2])&&(!b[3]||b[3].test((c["class"]||{}).value))},I=function(a){return f.event.special.hover?a:a.replace(B,"mouseenter$1 mouseleave$1")};
-f.event={add:function(a,c,d,e,g){var h,i,j,k,l,m,n,o,p,q,r,s;if(!(a.nodeType===3||a.nodeType===8||!c||!d||!(h=f._data(a)))){d.handler&&(p=d,d=p.handler),d.guid||(d.guid=f.guid++),j=h.events,j||(h.events=j={}),i=h.handle,i||(h.handle=i=function(a){return typeof f!="undefined"&&(!a||f.event.triggered!==a.type)?f.event.dispatch.apply(i.elem,arguments):b},i.elem=a),c=f.trim(I(c)).split(" ");for(k=0;k<c.length;k++){l=A.exec(c[k])||[],m=l[1],n=(l[2]||"").split(".").sort(),s=f.event.special[m]||{},m=(g?s.delegateType:s.bindType)||m,s=f.event.special[m]||{},o=f.extend({type:m,origType:l[1],data:e,handler:d,guid:d.guid,selector:g,quick:G(g),namespace:n.join(".")},p),r=j[m];if(!r){r=j[m]=[],r.delegateCount=0;if(!s.setup||s.setup.call(a,e,n,i)===!1)a.addEventListener?a.addEventListener(m,i,!1):a.attachEvent&&a.attachEvent("on"+m,i)}s.add&&(s.add.call(a,o),o.handler.guid||(o.handler.guid=d.guid)),g?r.splice(r.delegateCount++,0,o):r.push(o),f.event.global[m]=!0}a=null}},global:{},remove:function(a,b,c,d,e){var g=f.hasData(a)&&f._data(a),h,i,j,k,l,m,n,o,p,q,r,s;if(!!g&&!!(o=g.events)){b=f.trim(I(b||"")).split(" ");for(h=0;h<b.length;h++){i=A.exec(b[h])||[],j=k=i[1],l=i[2];if(!j){for(j in o)f.event.remove(a,j+b[h],c,d,!0);continue}p=f.event.special[j]||{},j=(d?p.delegateType:p.bindType)||j,r=o[j]||[],m=r.length,l=l?new RegExp("(^|\\.)"+l.split(".").sort().join("\\.(?:.*\\.)?")+"(\\.|$)"):null;for(n=0;n<r.length;n++)s=r[n],(e||k===s.origType)&&(!c||c.guid===s.guid)&&(!l||l.test(s.namespace))&&(!d||d===s.selector||d==="**"&&s.selector)&&(r.splice(n--,1),s.selector&&r.delegateCount--,p.remove&&p.remove.call(a,s));r.length===0&&m!==r.length&&((!p.teardown||p.teardown.call(a,l)===!1)&&f.removeEvent(a,j,g.handle),delete o[j])}f.isEmptyObject(o)&&(q=g.handle,q&&(q.elem=null),f.removeData(a,["events","handle"],!0))}},customEvent:{getData:!0,setData:!0,changeData:!0},trigger:function(c,d,e,g){if(!e||e.nodeType!==3&&e.nodeType!==8){var h=c.type||c,i=[],j,k,l,m,n,o,p,q,r,s;if(E.test(h+f.event.triggered))return;h.indexOf("!")>=0&&(h=h.slice(0,-1),k=!0),h.indexOf(".")>=0&&(i=h.split("."),h=i.shift(),i.sort());if((!e||f.event.customEvent[h])&&!f.event.global[h])return;c=typeof c=="object"?c[f.expando]?c:new f.Event(h,c):new f.Event(h),c.type=h,c.isTrigger=!0,c.exclusive=k,c.namespace=i.join("."),c.namespace_re=c.namespace?new RegExp("(^|\\.)"+i.join("\\.(?:.*\\.)?")+"(\\.|$)"):null,o=h.indexOf(":")<0?"on"+h:"";if(!e){j=f.cache;for(l in j)j[l].events&&j[l].events[h]&&f.event.trigger(c,d,j[l].handle.elem,!0);return}c.result=b,c.target||(c.target=e),d=d!=null?f.makeArray(d):[],d.unshift(c),p=f.event.special[h]||{};if(p.trigger&&p.trigger.apply(e,d)===!1)return;r=[[e,p.bindType||h]];if(!g&&!p.noBubble&&!f.isWindow(e)){s=p.delegateType||h,m=E.test(s+h)?e:e.parentNode,n=null;for(;m;m=m.parentNode)r.push([m,s]),n=m;n&&n===e.ownerDocument&&r.push([n.defaultView||n.parentWindow||a,s])}for(l=0;l<r.length&&!c.isPropagationStopped();l++)m=r[l][0],c.type=r[l][1],q=(f._data(m,"events")||{})[c.type]&&f._data(m,"handle"),q&&q.apply(m,d),q=o&&m[o],q&&f.acceptData(m)&&q.apply(m,d)===!1&&c.preventDefault();c.type=h,!g&&!c.isDefaultPrevented()&&(!p._default||p._default.apply(e.ownerDocument,d)===!1)&&(h!=="click"||!f.nodeName(e,"a"))&&f.acceptData(e)&&o&&e[h]&&(h!=="focus"&&h!=="blur"||c.target.offsetWidth!==0)&&!f.isWindow(e)&&(n=e[o],n&&(e[o]=null),f.event.triggered=h,e[h](),f.event.triggered=b,n&&(e[o]=n));return c.result}},dispatch:function(c){c=f.event.fix(c||a.event);var d=(f._data(this,"events")||{})[c.type]||[],e=d.delegateCount,g=[].slice.call(arguments,0),h=!c.exclusive&&!c.namespace,i=[],j,k,l,m,n,o,p,q,r,s,t;g[0]=c,c.delegateTarget=this;if(e&&!c.target.disabled&&(!c.button||c.type!=="click")){m=f(this),m.context=this.ownerDocument||this;for(l=c.target;l!=this;l=l.parentNode||this){o={},q=[],m[0]=l;for(j=0;j<e;j++)r=d[j],s=r.selector,o[s]===b&&(o[s]=r.quick?H(l,r.quick):m.is(s)),o[s]&&q.push(r);q.length&&i.push({elem:l,matches:q})}}d.length>e&&i.push({elem:this,matches:d.slice(e)});for(j=0;j<i.length&&!c.isPropagationStopped();j++){p=i[j],c.currentTarget=p.elem;for(k=0;k<p.matches.length&&!c.isImmediatePropagationStopped();k++){r=p.matches[k];if(h||!c.namespace&&!r.namespace||c.namespace_re&&c.namespace_re.test(r.namespace))c.data=r.data,c.handleObj=r,n=((f.event.special[r.origType]||{}).handle||r.handler).apply(p.elem,g),n!==b&&(c.result=n,n===!1&&(c.preventDefault(),c.stopPropagation()))}}return c.result},props:"attrChange attrName relatedNode srcElement altKey bubbles cancelable ctrlKey currentTarget eventPhase metaKey relatedTarget shiftKey target timeStamp view which".split(" "),fixHooks:{},keyHooks:{props:"char charCode key keyCode".split(" "),filter:function(a,b){a.which==null&&(a.which=b.charCode!=null?b.charCode:b.keyCode);return a}},mouseHooks:{props:"button buttons clientX clientY fromElement offsetX offsetY pageX pageY screenX screenY toElement".split(" "),filter:function(a,d){var e,f,g,h=d.button,i=d.fromElement;a.pageX==null&&d.clientX!=null&&(e=a.target.ownerDocument||c,f=e.documentElement,g=e.body,a.pageX=d.clientX+(f&&f.scrollLeft||g&&g.scrollLeft||0)-(f&&f.clientLeft||g&&g.clientLeft||0),a.pageY=d.clientY+(f&&f.scrollTop||g&&g.scrollTop||0)-(f&&f.clientTop||g&&g.clientTop||0)),!a.relatedTarget&&i&&(a.relatedTarget=i===a.target?d.toElement:i),!a.which&&h!==b&&(a.which=h&1?1:h&2?3:h&4?2:0);return a}},fix:function(a){if(a[f.expando])return a;var d,e,g=a,h=f.event.fixHooks[a.type]||{},i=h.props?this.props.concat(h.props):this.props;a=f.Event(g);for(d=i.length;d;)e=i[--d],a[e]=g[e];a.target||(a.target=g.srcElement||c),a.target.nodeType===3&&(a.target=a.target.parentNode),a.metaKey===b&&(a.metaKey=a.ctrlKey);return h.filter?h.filter(a,g):a},special:{ready:{setup:f.bindReady},load:{noBubble:!0},focus:{delegateType:"focusin"},blur:{delegateType:"focusout"},beforeunload:{setup:function(a,b,c){f.isWindow(this)&&(this.onbeforeunload=c)},teardown:function(a,b){this.onbeforeunload===b&&(this.onbeforeunload=null)}}},simulate:function(a,b,c,d){var e=f.extend(new f.Event,c,{type:a,isSimulated:!0,originalEvent:{}});d?f.event.trigger(e,null,b):f.event.dispatch.call(b,e),e.isDefaultPrevented()&&c.preventDefault()}},f.event.handle=f.event.dispatch,f.removeEvent=c.removeEventListener?function(a,b,c){a.removeEventListener&&a.removeEventListener(b,c,!1)}:function(a,b,c){a.detachEvent&&a.detachEvent("on"+b,c)},f.Event=function(a,b){if(!(this instanceof f.Event))return new f.Event(a,b);a&&a.type?(this.originalEvent=a,this.type=a.type,this.isDefaultPrevented=a.defaultPrevented||a.returnValue===!1||a.getPreventDefault&&a.getPreventDefault()?K:J):this.type=a,b&&f.extend(this,b),this.timeStamp=a&&a.timeStamp||f.now(),this[f.expando]=!0},f.Event.prototype={preventDefault:function(){this.isDefaultPrevented=K;var a=this.originalEvent;!a||(a.preventDefault?a.preventDefault():a.returnValue=!1)},stopPropagation:function(){this.isPropagationStopped=K;var a=this.originalEvent;!a||(a.stopPropagation&&a.stopPropagation(),a.cancelBubble=!0)},stopImmediatePropagation:function(){this.isImmediatePropagationStopped=K,this.stopPropagation()},isDefaultPrevented:J,isPropagationStopped:J,isImmediatePropagationStopped:J},f.each({mouseenter:"mouseover",mouseleave:"mouseout"},function(a,b){f.event.special[a]={delegateType:b,bindType:b,handle:function(a){var c=this,d=a.relatedTarget,e=a.handleObj,g=e.selector,h;if(!d||d!==c&&!f.contains(c,d))a.type=e.origType,h=e.handler.apply(this,arguments),a.type=b;return h}}}),f.support.submitBubbles||(f.event.special.submit={setup:function(){if(f.nodeName(this,"form"))return!1;f.event.add(this,"click._submit keypress._submit",function(a){var c=a.target,d=f.nodeName(c,"input")||f.nodeName(c,"button")?c.form:b;d&&!d._submit_attached&&(f.event.add(d,"submit._submit",function(a){this.parentNode&&!a.isTrigger&&f.event.simulate("submit",this.parentNode,a,!0)}),d._submit_attached=!0)})},teardown:function(){if(f.nodeName(this,"form"))return!1;f.event.remove(this,"._submit")}}),f.support.changeBubbles||(f.event.special.change={setup:function(){if(z.test(this.nodeName)){if(this.type==="checkbox"||this.type==="radio")f.event.add(this,"propertychange._change",function(a){a.originalEvent.propertyName==="checked"&&(this._just_changed=!0)}),f.event.add(this,"click._change",function(a){this._just_changed&&!a.isTrigger&&(this._just_changed=!1,f.event.simulate("change",this,a,!0))});return!1}f.event.add(this,"beforeactivate._change",function(a){var b=a.target;z.test(b.nodeName)&&!b._change_attached&&(f.event.add(b,"change._change",function(a){this.parentNode&&!a.isSimulated&&!a.isTrigger&&f.event.simulate("change",this.parentNode,a,!0)}),b._change_attached=!0)})},handle:function(a){var b=a.target;if(this!==b||a.isSimulated||a.isTrigger||b.type!=="radio"&&b.type!=="checkbox")return a.handleObj.handler.apply(this,arguments)},teardown:function(){f.event.remove(this,"._change");return z.test(this.nodeName)}}),f.support.focusinBubbles||f.each({focus:"focusin",blur:"focusout"},function(a,b){var d=0,e=function(a){f.event.simulate(b,a.target,f.event.fix(a),!0)};f.event.special[b]={setup:function(){d++===0&&c.addEventListener(a,e,!0)},teardown:function(){--d===0&&c.removeEventListener(a,e,!0)}}}),f.fn.extend({on:function(a,c,d,e,g){var h,i;if(typeof a=="object"){typeof c!="string"&&(d=c,c=b);for(i in a)this.on(i,c,d,a[i],g);return this}d==null&&e==null?(e=c,d=c=b):e==null&&(typeof c=="string"?(e=d,d=b):(e=d,d=c,c=b));if(e===!1)e=J;else if(!e)return this;g===1&&(h=e,e=function(a){f().off(a);return h.apply(this,arguments)},e.guid=h.guid||(h.guid=f.guid++));return this.each(function(){f.event.add(this,a,e,d,c)})},one:function(a,b,c,d){return this.on.call(this,a,b,c,d,1)},off:function(a,c,d){if(a&&a.preventDefault&&a.handleObj){var e=a.handleObj;f(a.delegateTarget).off(e.namespace?e.type+"."+e.namespace:e.type,e.selector,e.handler);return this}if(typeof a=="object"){for(var g in a)this.off(g,c,a[g]);return this}if(c===!1||typeof c=="function")d=c,c=b;d===!1&&(d=J);return this.each(function(){f.event.remove(this,a,d,c)})},bind:function(a,b,c){return this.on(a,null,b,c)},unbind:function(a,b){return this.off(a,null,b)},live:function(a,b,c){f(this.context).on(a,this.selector,b,c);return this},die:function(a,b){f(this.context).off(a,this.selector||"**",b);return this},delegate:function(a,b,c,d){return this.on(b,a,c,d)},undelegate:function(a,b,c){return arguments.length==1?this.off(a,"**"):this.off(b,a,c)},trigger:function(a,b){return this.each(function(){f.event.trigger(a,b,this)})},triggerHandler:function(a,b){if(this[0])return f.event.trigger(a,b,this[0],!0)},toggle:function(a){var b=arguments,c=a.guid||f.guid++,d=0,e=function(c){var e=(f._data(this,"lastToggle"+a.guid)||0)%d;f._data(this,"lastToggle"+a.guid,e+1),c.preventDefault();return b[e].apply(this,arguments)||!1};e.guid=c;while(d<b.length)b[d++].guid=c;return this.click(e)},hover:function(a,b){return this.mouseenter(a).mouseleave(b||a)}}),f.each("blur focus focusin focusout load resize scroll unload click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup error contextmenu".split(" "),function(a,b){f.fn[b]=function(a,c){c==null&&(c=a,a=null);return arguments.length>0?this.on(b,null,a,c):this.trigger(b)},f.attrFn&&(f.attrFn[b]=!0),C.test(b)&&(f.event.fixHooks[b]=f.event.keyHooks),D.test(b)&&(f.event.fixHooks[b]=f.event.mouseHooks)}),function(){function x(a,b,c,e,f,g){for(var h=0,i=e.length;h<i;h++){var j=e[h];if(j){var k=!1;j=j[a];while(j){if(j[d]===c){k=e[j.sizset];break}if(j.nodeType===1){g||(j[d]=c,j.sizset=h);if(typeof b!="string"){if(j===b){k=!0;break}}else if(m.filter(b,[j]).length>0){k=j;break}}j=j[a]}e[h]=k}}}function w(a,b,c,e,f,g){for(var h=0,i=e.length;h<i;h++){var j=e[h];if(j){var k=!1;j=j[a];while(j){if(j[d]===c){k=e[j.sizset];break}j.nodeType===1&&!g&&(j[d]=c,j.sizset=h);if(j.nodeName.toLowerCase()===b){k=j;break}j=j[a]}e[h]=k}}}var a=/((?:\((?:\([^()]+\)|[^()]+)+\)|\[(?:\[[^\[\]]*\]|['"][^'"]*['"]|[^\[\]'"]+)+\]|\\.|[^ >+~,(\[\\]+)+|[>+~])(\s*,\s*)?((?:.|\r|\n)*)/g,d="sizcache"+(Math.random()+"").replace(".",""),e=0,g=Object.prototype.toString,h=!1,i=!0,j=/\\/g,k=/\r\n/g,l=/\W/;[0,0].sort(function(){i=!1;return 0});var m=function(b,d,e,f){e=e||[],d=d||c;var h=d;if(d.nodeType!==1&&d.nodeType!==9)return[];if(!b||typeof b!="string")return e;var i,j,k,l,n,q,r,t,u=!0,v=m.isXML(d),w=[],x=b;do{a.exec(""),i=a.exec(x);if(i){x=i[3],w.push(i[1]);if(i[2]){l=i[3];break}}}while(i);if(w.length>1&&p.exec(b))if(w.length===2&&o.relative[w[0]])j=y(w[0]+w[1],d,f);else{j=o.relative[w[0]]?[d]:m(w.shift(),d);while(w.length)b=w.shift(),o.relative[b]&&(b+=w.shift()),j=y(b,j,f)}else{!f&&w.length>1&&d.nodeType===9&&!v&&o.match.ID.test(w[0])&&!o.match.ID.test(w[w.length-1])&&(n=m.find(w.shift(),d,v),d=n.expr?m.filter(n.expr,n.set)[0]:n.set[0]);if(d){n=f?{expr:w.pop(),set:s(f)}:m.find(w.pop(),w.length===1&&(w[0]==="~"||w[0]==="+")&&d.parentNode?d.parentNode:d,v),j=n.expr?m.filter(n.expr,n.set):n.set,w.length>0?k=s(j):u=!1;while(w.length)q=w.pop(),r=q,o.relative[q]?r=w.pop():q="",r==null&&(r=d),o.relative[q](k,r,v)}else k=w=[]}k||(k=j),k||m.error(q||b);if(g.call(k)==="[object Array]")if(!u)e.push.apply(e,k);else if(d&&d.nodeType===1)for(t=0;k[t]!=null;t++)k[t]&&(k[t]===!0||k[t].nodeType===1&&m.contains(d,k[t]))&&e.push(j[t]);else for(t=0;k[t]!=null;t++)k[t]&&k[t].nodeType===1&&e.push(j[t]);else s(k,e);l&&(m(l,h,e,f),m.uniqueSort(e));return e};m.uniqueSort=function(a){if(u){h=i,a.sort(u);if(h)for(var b=1;b<a.length;b++)a[b]===a[b-1]&&a.splice(b--,1)}return a},m.matches=function(a,b){return m(a,null,null,b)},m.matchesSelector=function(a,b){return m(b,null,null,[a]).length>0},m.find=function(a,b,c){var d,e,f,g,h,i;if(!a)return[];for(e=0,f=o.order.length;e<f;e++){h=o.order[e];if(g=o.leftMatch[h].exec(a)){i=g[1],g.splice(1,1);if(i.substr(i.length-1)!=="\\"){g[1]=(g[1]||"").replace(j,""),d=o.find[h](g,b,c);if(d!=null){a=a.replace(o.match[h],"");break}}}}d||(d=typeof b.getElementsByTagName!="undefined"?b.getElementsByTagName("*"):[]);return{set:d,expr:a}},m.filter=function(a,c,d,e){var f,g,h,i,j,k,l,n,p,q=a,r=[],s=c,t=c&&c[0]&&m.isXML(c[0]);while(a&&c.length){for(h in o.filter)if((f=o.leftMatch[h].exec(a))!=null&&f[2]){k=o.filter[h],l=f[1],g=!1,f.splice(1,1);if(l.substr(l.length-1)==="\\")continue;s===r&&(r=[]);if(o.preFilter[h]){f=o.preFilter[h](f,s,d,r,e,t);if(!f)g=i=!0;else if(f===!0)continue}if(f)for(n=0;(j=s[n])!=null;n++)j&&(i=k(j,f,n,s),p=e^i,d&&i!=null?p?g=!0:s[n]=!1:p&&(r.push(j),g=!0));if(i!==b){d||(s=r),a=a.replace(o.match[h],"");if(!g)return[];break}}if(a===q)if(g==null)m.error(a);else break;q=a}return s},m.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)};var n=m.getText=function(a){var b,c,d=a.nodeType,e="";if(d){if(d===1||d===9){if(typeof a.textContent=="string")return a.textContent;if(typeof a.innerText=="string")return a.innerText.replace(k,"");for(a=a.firstChild;a;a=a.nextSibling)e+=n(a)}else if(d===3||d===4)return a.nodeValue}else for(b=0;c=a[b];b++)c.nodeType!==8&&(e+=n(c));return e},o=m.selectors={order:["ID","NAME","TAG"],match:{ID:/#((?:[\w\u00c0-\uFFFF\-]|\\.)+)/,CLASS:/\.((?:[\w\u00c0-\uFFFF\-]|\\.)+)/,NAME:/\[name=['"]*((?:[\w\u00c0-\uFFFF\-]|\\.)+)['"]*\]/,ATTR:/\[\s*((?:[\w\u00c0-\uFFFF\-]|\\.)+)\s*(?:(\S?=)\s*(?:(['"])(.*?)\3|(#?(?:[\w\u00c0-\uFFFF\-]|\\.)*)|)|)\s*\]/,TAG:/^((?:[\w\u00c0-\uFFFF\*\-]|\\.)+)/,CHILD:/:(only|nth|last|first)-child(?:\(\s*(even|odd|(?:[+\-]?\d+|(?:[+\-]?\d*)?n\s*(?:[+\-]\s*\d+)?))\s*\))?/,POS:/:(nth|eq|gt|lt|first|last|even|odd)(?:\((\d*)\))?(?=[^\-]|$)/,PSEUDO:/:((?:[\w\u00c0-\uFFFF\-]|\\.)+)(?:\((['"]?)((?:\([^\)]+\)|[^\(\)]*)+)\2\))?/},leftMatch:{},attrMap:{"class":"className","for":"htmlFor"},attrHandle:{href:function(a){return a.getAttribute("href")},type:function(a){return a.getAttribute("type")}},relative:{"+":function(a,b){var c=typeof b=="string",d=c&&!l.test(b),e=c&&!d;d&&(b=b.toLowerCase());for(var f=0,g=a.length,h;f<g;f++)if(h=a[f]){while((h=h.previousSibling)&&h.nodeType!==1);a[f]=e||h&&h.nodeName.toLowerCase()===b?h||!1:h===b}e&&m.filter(b,a,!0)},">":function(a,b){var c,d=typeof b=="string",e=0,f=a.length;if(d&&!l.test(b)){b=b.toLowerCase();for(;e<f;e++){c=a[e];if(c){var g=c.parentNode;a[e]=g.nodeName.toLowerCase()===b?g:!1}}}else{for(;e<f;e++)c=a[e],c&&(a[e]=d?c.parentNode:c.parentNode===b);d&&m.filter(b,a,!0)}},"":function(a,b,c){var d,f=e++,g=x;typeof b=="string"&&!l.test(b)&&(b=b.toLowerCase(),d=b,g=w),g("parentNode",b,f,a,d,c)},"~":function(a,b,c){var d,f=e++,g=x;typeof b=="string"&&!l.test(b)&&(b=b.toLowerCase(),d=b,g=w),g("previousSibling",b,f,a,d,c)}},find:{ID:function(a,b,c){if(typeof b.getElementById!="undefined"&&!c){var d=b.getElementById(a[1]);return d&&d.parentNode?[d]:[]}},NAME:function(a,b){if(typeof b.getElementsByName!="undefined"){var c=[],d=b.getElementsByName(a[1]);for(var e=0,f=d.length;e<f;e++)d[e].getAttribute("name")===a[1]&&c.push(d[e]);return c.length===0?null:c}},TAG:function(a,b){if(typeof b.getElementsByTagName!="undefined")return b.getElementsByTagName(a[1])}},preFilter:{CLASS:function(a,b,c,d,e,f){a=" "+a[1].replace(j,"")+" ";if(f)return a;for(var g=0,h;(h=b[g])!=null;g++)h&&(e^(h.className&&(" "+h.className+" ").replace(/[\t\n\r]/g," ").indexOf(a)>=0)?c||d.push(h):c&&(b[g]=!1));return!1},ID:function(a){return a[1].replace(j,"")},TAG:function(a,b){return a[1].replace(j,"").toLowerCase()},CHILD:function(a){if(a[1]==="nth"){a[2]||m.error(a[0]),a[2]=a[2].replace(/^\+|\s*/g,"");var b=/(-?)(\d*)(?:n([+\-]?\d*))?/.exec(a[2]==="even"&&"2n"||a[2]==="odd"&&"2n+1"||!/\D/.test(a[2])&&"0n+"+a[2]||a[2]);a[2]=b[1]+(b[2]||1)-0,a[3]=b[3]-0}else a[2]&&m.error(a[0]);a[0]=e++;return a},ATTR:function(a,b,c,d,e,f){var g=a[1]=a[1].replace(j,"");!f&&o.attrMap[g]&&(a[1]=o.attrMap[g]),a[4]=(a[4]||a[5]||"").replace(j,""),a[2]==="~="&&(a[4]=" "+a[4]+" ");return a},PSEUDO:function(b,c,d,e,f){if(b[1]==="not")if((a.exec(b[3])||"").length>1||/^\w/.test(b[3]))b[3]=m(b[3],null,null,c);else{var g=m.filter(b[3],c,d,!0^f);d||e.push.apply(e,g);return!1}else if(o.match.POS.test(b[0])||o.match.CHILD.test(b[0]))return!0;return b},POS:function(a){a.unshift(!0);return a}},filters:{enabled:function(a){return a.disabled===!1&&a.type!=="hidden"},disabled:function(a){return a.disabled===!0},checked:function(a){return a.checked===!0},selected:function(a){a.parentNode&&a.parentNode.selectedIndex;return a.selected===!0},parent:function(a){return!!a.firstChild},empty:function(a){return!a.firstChild},has:function(a,b,c){return!!m(c[3],a).length},header:function(a){return/h\d/i.test(a.nodeName)},text:function(a){var b=a.getAttribute("type"),c=a.type;return a.nodeName.toLowerCase()==="input"&&"text"===c&&(b===c||b===null)},radio:function(a){return a.nodeName.toLowerCase()==="input"&&"radio"===a.type},checkbox:function(a){return a.nodeName.toLowerCase()==="input"&&"checkbox"===a.type},file:function(a){return a.nodeName.toLowerCase()==="input"&&"file"===a.type},password:function(a){return a.nodeName.toLowerCase()==="input"&&"password"===a.type},submit:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"submit"===a.type},image:function(a){return a.nodeName.toLowerCase()==="input"&&"image"===a.type},reset:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"reset"===a.type},button:function(a){var b=a.nodeName.toLowerCase();return b==="input"&&"button"===a.type||b==="button"},input:function(a){return/input|select|textarea|button/i.test(a.nodeName)},focus:function(a){return a===a.ownerDocument.activeElement}},setFilters:{first:function(a,b){return b===0},last:function(a,b,c,d){return b===d.length-1},even:function(a,b){return b%2===0},odd:function(a,b){return b%2===1},lt:function(a,b,c){return b<c[3]-0},gt:function(a,b,c){return b>c[3]-0},nth:function(a,b,c){return c[3]-0===b},eq:function(a,b,c){return c[3]-0===b}},filter:{PSEUDO:function(a,b,c,d){var e=b[1],f=o.filters[e];if(f)return f(a,c,b,d);if(e==="contains")return(a.textContent||a.innerText||n([a])||"").indexOf(b[3])>=0;if(e==="not"){var g=b[3];for(var h=0,i=g.length;h<i;h++)if(g[h]===a)return!1;return!0}m.error(e)},CHILD:function(a,b){var c,e,f,g,h,i,j,k=b[1],l=a;switch(k){case"only":case"first":while(l=l.previousSibling)if(l.nodeType===1)return!1;if(k==="first")return!0;l=a;case"last":while(l=l.nextSibling)if(l.nodeType===1)return!1;return!0;case"nth":c=b[2],e=b[3];if(c===1&&e===0)return!0;f=b[0],g=a.parentNode;if(g&&(g[d]!==f||!a.nodeIndex)){i=0;for(l=g.firstChild;l;l=l.nextSibling)l.nodeType===1&&(l.nodeIndex=++i);g[d]=f}j=a.nodeIndex-e;return c===0?j===0:j%c===0&&j/c>=0}},ID:function(a,b){return a.nodeType===1&&a.getAttribute("id")===b},TAG:function(a,b){return b==="*"&&a.nodeType===1||!!a.nodeName&&a.nodeName.toLowerCase()===b},CLASS:function(a,b){return(" "+(a.className||a.getAttribute("class"))+" ").indexOf(b)>-1},ATTR:function(a,b){var c=b[1],d=m.attr?m.attr(a,c):o.attrHandle[c]?o.attrHandle[c](a):a[c]!=null?a[c]:a.getAttribute(c),e=d+"",f=b[2],g=b[4];return d==null?f==="!=":!f&&m.attr?d!=null:f==="="?e===g:f==="*="?e.indexOf(g)>=0:f==="~="?(" "+e+" ").indexOf(g)>=0:g?f==="!="?e!==g:f==="^="?e.indexOf(g)===0:f==="$="?e.substr(e.length-g.length)===g:f==="|="?e===g||e.substr(0,g.length+1)===g+"-":!1:e&&d!==!1},POS:function(a,b,c,d){var e=b[2],f=o.setFilters[e];if(f)return f(a,c,b,d)}}},p=o.match.POS,q=function(a,b){return"\\"+(b-0+1)};for(var r in o.match)o.match[r]=new RegExp(o.match[r].source+/(?![^\[]*\])(?![^\(]*\))/.source),o.leftMatch[r]=new RegExp(/(^(?:.|\r|\n)*?)/.source+o.match[r].source.replace(/\\(\d+)/g,q));var s=function(a,b){a=Array.prototype.slice.call(a,0);if(b){b.push.apply(b,a);return b}return a};try{Array.prototype.slice.call(c.documentElement.childNodes,0)[0].nodeType}catch(t){s=function(a,b){var c=0,d=b||[];if(g.call(a)==="[object Array]")Array.prototype.push.apply(d,a);else if(typeof a.length=="number")for(var e=a.length;c<e;c++)d.push(a[c]);else for(;a[c];c++)d.push(a[c]);return d}}var u,v;c.documentElement.compareDocumentPosition?u=function(a,b){if(a===b){h=!0;return 0}if(!a.compareDocumentPosition||!b.compareDocumentPosition)return a.compareDocumentPosition?-1:1;return a.compareDocumentPosition(b)&4?-1:1}:(u=function(a,b){if(a===b){h=!0;return 0}if(a.sourceIndex&&b.sourceIndex)return a.sourceIndex-b.sourceIndex;var c,d,e=[],f=[],g=a.parentNode,i=b.parentNode,j=g;if(g===i)return v(a,b);if(!g)return-1;if(!i)return 1;while(j)e.unshift(j),j=j.parentNode;j=i;while(j)f.unshift(j),j=j.parentNode;c=e.length,d=f.length;for(var k=0;k<c&&k<d;k++)if(e[k]!==f[k])return v(e[k],f[k]);return k===c?v(a,f[k],-1):v(e[k],b,1)},v=function(a,b,c){if(a===b)return c;var d=a.nextSibling;while(d){if(d===b)return-1;d=d.nextSibling}return 1}),function(){var a=c.createElement("div"),d="script"+(new Date).getTime(),e=c.documentElement;a.innerHTML="<a name='"+d+"'/>",e.insertBefore(a,e.firstChild),c.getElementById(d)&&(o.find.ID=function(a,c,d){if(typeof c.getElementById!="undefined"&&!d){var e=c.getElementById(a[1]);return e?e.id===a[1]||typeof e.getAttributeNode!="undefined"&&e.getAttributeNode("id").nodeValue===a[1]?[e]:b:[]}},o.filter.ID=function(a,b){var c=typeof a.getAttributeNode!="undefined"&&a.getAttributeNode("id");return a.nodeType===1&&c&&c.nodeValue===b}),e.removeChild(a),e=a=null}(),function(){var a=c.createElement("div");a.appendChild(c.createComment("")),a.getElementsByTagName("*").length>0&&(o.find.TAG=function(a,b){var c=b.getElementsByTagName(a[1]);if(a[1]==="*"){var d=[];for(var e=0;c[e];e++)c[e].nodeType===1&&d.push(c[e]);c=d}return c}),a.innerHTML="<a href='#'></a>",a.firstChild&&typeof a.firstChild.getAttribute!="undefined"&&a.firstChild.getAttribute("href")!=="#"&&(o.attrHandle.href=function(a){return a.getAttribute("href",2)}),a=null}(),c.querySelectorAll&&function(){var a=m,b=c.createElement("div"),d="__sizzle__";b.innerHTML="<p class='TEST'></p>";if(!b.querySelectorAll||b.querySelectorAll(".TEST").length!==0){m=function(b,e,f,g){e=e||c;if(!g&&!m.isXML(e)){var h=/^(\w+$)|^\.([\w\-]+$)|^#([\w\-]+$)/.exec(b);if(h&&(e.nodeType===1||e.nodeType===9)){if(h[1])return s(e.getElementsByTagName(b),f);if(h[2]&&o.find.CLASS&&e.getElementsByClassName)return s(e.getElementsByClassName(h[2]),f)}if(e.nodeType===9){if(b==="body"&&e.body)return s([e.body],f);if(h&&h[3]){var i=e.getElementById(h[3]);if(!i||!i.parentNode)return s([],f);if(i.id===h[3])return s([i],f)}try{return s(e.querySelectorAll(b),f)}catch(j){}}else if(e.nodeType===1&&e.nodeName.toLowerCase()!=="object"){var k=e,l=e.getAttribute("id"),n=l||d,p=e.parentNode,q=/^\s*[+~]/.test(b);l?n=n.replace(/'/g,"\\$&"):e.setAttribute("id",n),q&&p&&(e=e.parentNode);try{if(!q||p)return s(e.querySelectorAll("[id='"+n+"'] "+b),f)}catch(r){}finally{l||k.removeAttribute("id")}}}return a(b,e,f,g)};for(var e in a)m[e]=a[e];b=null}}(),function(){var a=c.documentElement,b=a.matchesSelector||a.mozMatchesSelector||a.webkitMatchesSelector||a.msMatchesSelector;if(b){var d=!b.call(c.createElement("div"),"div"),e=!1;try{b.call(c.documentElement,"[test!='']:sizzle")}catch(f){e=!0}m.matchesSelector=function(a,c){c=c.replace(/\=\s*([^'"\]]*)\s*\]/g,"='$1']");if(!m.isXML(a))try{if(e||!o.match.PSEUDO.test(c)&&!/!=/.test(c)){var f=b.call(a,c);if(f||!d||a.document&&a.document.nodeType!==11)return f}}catch(g){}return m(c,null,null,[a]).length>0}}}(),function(){var a=c.createElement("div");a.innerHTML="<div class='test e'></div><div class='test'></div>";if(!!a.getElementsByClassName&&a.getElementsByClassName("e").length!==0){a.lastChild.className="e";if(a.getElementsByClassName("e").length===1)return;o.order.splice(1,0,"CLASS"),o.find.CLASS=function(a,b,c){if(typeof b.getElementsByClassName!="undefined"&&!c)return b.getElementsByClassName(a[1])},a=null}}(),c.documentElement.contains?m.contains=function(a,b){return a!==b&&(a.contains?a.contains(b):!0)}:c.documentElement.compareDocumentPosition?m.contains=function(a,b){return!!(a.compareDocumentPosition(b)&16)}:m.contains=function(){return!1},m.isXML=function(a){var b=(a?a.ownerDocument||a:0).documentElement;return b?b.nodeName!=="HTML":!1};var y=function(a,b,c){var d,e=[],f="",g=b.nodeType?[b]:b;while(d=o.match.PSEUDO.exec(a))f+=d[0],a=a.replace(o.match.PSEUDO,"");a=o.relative[a]?a+"*":a;for(var h=0,i=g.length;h<i;h++)m(a,g[h],e,c);return m.filter(f,e)};m.attr=f.attr,m.selectors.attrMap={},f.find=m,f.expr=m.selectors,f.expr[":"]=f.expr.filters,f.unique=m.uniqueSort,f.text=m.getText,f.isXMLDoc=m.isXML,f.contains=m.contains}();var L=/Until$/,M=/^(?:parents|prevUntil|prevAll)/,N=/,/,O=/^.[^:#\[\.,]*$/,P=Array.prototype.slice,Q=f.expr.match.POS,R={children:!0,contents:!0,next:!0,prev:!0};f.fn.extend({find:function(a){var b=this,c,d;if(typeof a!="string")return f(a).filter(function(){for(c=0,d=b.length;c<d;c++)if(f.contains(b[c],this))return!0});var e=this.pushStack("","find",a),g,h,i;for(c=0,d=this.length;c<d;c++){g=e.length,f.find(a,this[c],e);if(c>0)for(h=g;h<e.length;h++)for(i=0;i<g;i++)if(e[i]===e[h]){e.splice(h--,1);break}}return e},has:function(a){var b=f(a);return this.filter(function(){for(var a=0,c=b.length;a<c;a++)if(f.contains(this,b[a]))return!0})},not:function(a){return this.pushStack(T(this,a,!1),"not",a)},filter:function(a){return this.pushStack(T(this,a,!0),"filter",a)},is:function(a){return!!a&&(typeof a=="string"?Q.test(a)?f(a,this.context).index(this[0])>=0:f.filter(a,this).length>0:this.filter(a).length>0)},closest:function(a,b){var c=[],d,e,g=this[0];if(f.isArray(a)){var h=1;while(g&&g.ownerDocument&&g!==b){for(d=0;d<a.length;d++)f(g).is(a[d])&&c.push({selector:a[d],elem:g,level:h});g=g.parentNode,h++}return c}var i=Q.test(a)||typeof a!="string"?f(a,b||this.context):0;for(d=0,e=this.length;d<e;d++){g=this[d];while(g){if(i?i.index(g)>-1:f.find.matchesSelector(g,a)){c.push(g);break}g=g.parentNode;if(!g||!g.ownerDocument||g===b||g.nodeType===11)break}}c=c.length>1?f.unique(c):c;return this.pushStack(c,"closest",a)},index:function(a){if(!a)return this[0]&&this[0].parentNode?this.prevAll().length:-1;if(typeof a=="string")return f.inArray(this[0],f(a));return f.inArray(a.jquery?a[0]:a,this)},add:function(a,b){var c=typeof a=="string"?f(a,b):f.makeArray(a&&a.nodeType?[a]:a),d=f.merge(this.get(),c);return this.pushStack(S(c[0])||S(d[0])?d:f.unique(d))},andSelf:function(){return this.add(this.prevObject)}}),f.each({parent:function(a){var b=a.parentNode;return b&&b.nodeType!==11?b:null},parents:function(a){return f.dir(a,"parentNode")},parentsUntil:function(a,b,c){return f.dir(a,"parentNode",c)},next:function(a){return f.nth(a,2,"nextSibling")},prev:function(a){return f.nth(a,2,"previousSibling")},nextAll:function(a){return f.dir(a,"nextSibling")},prevAll:function(a){return f.dir(a,"previousSibling")},nextUntil:function(a,b,c){return f.dir(a,"nextSibling",c)},prevUntil:function(a,b,c){return f.dir(a,"previousSibling",c)},siblings:function(a){return f.sibling(a.parentNode.firstChild,a)},children:function(a){return f.sibling(a.firstChild)},contents:function(a){return f.nodeName(a,"iframe")?a.contentDocument||a.contentWindow.document:f.makeArray(a.childNodes)}},function(a,b){f.fn[a]=function(c,d){var e=f.map(this,b,c);L.test(a)||(d=c),d&&typeof d=="string"&&(e=f.filter(d,e)),e=this.length>1&&!R[a]?f.unique(e):e,(this.length>1||N.test(d))&&M.test(a)&&(e=e.reverse());return this.pushStack(e,a,P.call(arguments).join(","))}}),f.extend({filter:function(a,b,c){c&&(a=":not("+a+")");return b.length===1?f.find.matchesSelector(b[0],a)?[b[0]]:[]:f.find.matches(a,b)},dir:function(a,c,d){var e=[],g=a[c];while(g&&g.nodeType!==9&&(d===b||g.nodeType!==1||!f(g).is(d)))g.nodeType===1&&e.push(g),g=g[c];return e},nth:function(a,b,c,d){b=b||1;var e=0;for(;a;a=a[c])if(a.nodeType===1&&++e===b)break;return a},sibling:function(a,b){var c=[];for(;a;a=a.nextSibling)a.nodeType===1&&a!==b&&c.push(a);return c}});var V="abbr|article|aside|audio|canvas|datalist|details|figcaption|figure|footer|header|hgroup|mark|meter|nav|output|progress|section|summary|time|video",W=/ jQuery\d+="(?:\d+|null)"/g,X=/^\s+/,Y=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,Z=/<([\w:]+)/,$=/<tbody/i,_=/<|&#?\w+;/,ba=/<(?:script|style)/i,bb=/<(?:script|object|embed|option|style)/i,bc=new RegExp("<(?:"+V+")","i"),bd=/checked\s*(?:[^=]|=\s*.checked.)/i,be=/\/(java|ecma)script/i,bf=/^\s*<!(?:\[CDATA\[|\-\-)/,bg={option:[1,"<select multiple='multiple'>","</select>"],legend:[1,"<fieldset>","</fieldset>"],thead:[1,"<table>","</table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],col:[2,"<table><tbody></tbody><colgroup>","</colgroup></table>"],area:[1,"<map>","</map>"],_default:[0,"",""]},bh=U(c);bg.optgroup=bg.option,bg.tbody=bg.tfoot=bg.colgroup=bg.caption=bg.thead,bg.th=bg.td,f.support.htmlSerialize||(bg._default=[1,"div<div>","</div>"]),f.fn.extend({text:function(a){if(f.isFunction(a))return this.each(function(b){var c=f(this);c.text(a.call(this,b,c.text()))});if(typeof a!="object"&&a!==b)return this.empty().append((this[0]&&this[0].ownerDocument||c).createTextNode(a));return f.text(this)},wrapAll:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapAll(a.call(this,b))});if(this[0]){var b=f(a,this[0].ownerDocument).eq(0).clone(!0);this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstChild&&a.firstChild.nodeType===1)a=a.firstChild;return a}).append(this)}return this},wrapInner:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapInner(a.call(this,b))});return this.each(function(){var b=f(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=f.isFunction(a);return this.each(function(c){f(this).wrapAll(b?a.call(this,c):a)})},unwrap:function(){return this.parent().each(function(){f.nodeName(this,"body")||f(this).replaceWith(this.childNodes)}).end()},append:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.appendChild(a)})},prepend:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.insertBefore(a,this.firstChild)})},before:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this)});if(arguments.length){var a=f.clean(arguments);a.push.apply(a,this.toArray());return this.pushStack(a,"before",arguments)}},after:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this.nextSibling)});if(arguments.length){var a=this.pushStack(this,"after",arguments);a.push.apply(a,f.clean(arguments));return a}},remove:function(a,b){for(var c=0,d;(d=this[c])!=null;c++)if(!a||f.filter(a,[d]).length)!b&&d.nodeType===1&&(f.cleanData(d.getElementsByTagName("*")),f.cleanData([d])),d.parentNode&&d.parentNode.removeChild(d);return this},empty:function()
-{for(var a=0,b;(b=this[a])!=null;a++){b.nodeType===1&&f.cleanData(b.getElementsByTagName("*"));while(b.firstChild)b.removeChild(b.firstChild)}return this},clone:function(a,b){a=a==null?!1:a,b=b==null?a:b;return this.map(function(){return f.clone(this,a,b)})},html:function(a){if(a===b)return this[0]&&this[0].nodeType===1?this[0].innerHTML.replace(W,""):null;if(typeof a=="string"&&!ba.test(a)&&(f.support.leadingWhitespace||!X.test(a))&&!bg[(Z.exec(a)||["",""])[1].toLowerCase()]){a=a.replace(Y,"<$1></$2>");try{for(var c=0,d=this.length;c<d;c++)this[c].nodeType===1&&(f.cleanData(this[c].getElementsByTagName("*")),this[c].innerHTML=a)}catch(e){this.empty().append(a)}}else f.isFunction(a)?this.each(function(b){var c=f(this);c.html(a.call(this,b,c.html()))}):this.empty().append(a);return this},replaceWith:function(a){if(this[0]&&this[0].parentNode){if(f.isFunction(a))return this.each(function(b){var c=f(this),d=c.html();c.replaceWith(a.call(this,b,d))});typeof a!="string"&&(a=f(a).detach());return this.each(function(){var b=this.nextSibling,c=this.parentNode;f(this).remove(),b?f(b).before(a):f(c).append(a)})}return this.length?this.pushStack(f(f.isFunction(a)?a():a),"replaceWith",a):this},detach:function(a){return this.remove(a,!0)},domManip:function(a,c,d){var e,g,h,i,j=a[0],k=[];if(!f.support.checkClone&&arguments.length===3&&typeof j=="string"&&bd.test(j))return this.each(function(){f(this).domManip(a,c,d,!0)});if(f.isFunction(j))return this.each(function(e){var g=f(this);a[0]=j.call(this,e,c?g.html():b),g.domManip(a,c,d)});if(this[0]){i=j&&j.parentNode,f.support.parentNode&&i&&i.nodeType===11&&i.childNodes.length===this.length?e={fragment:i}:e=f.buildFragment(a,this,k),h=e.fragment,h.childNodes.length===1?g=h=h.firstChild:g=h.firstChild;if(g){c=c&&f.nodeName(g,"tr");for(var l=0,m=this.length,n=m-1;l<m;l++)d.call(c?bi(this[l],g):this[l],e.cacheable||m>1&&l<n?f.clone(h,!0,!0):h)}k.length&&f.each(k,bp)}return this}}),f.buildFragment=function(a,b,d){var e,g,h,i,j=a[0];b&&b[0]&&(i=b[0].ownerDocument||b[0]),i.createDocumentFragment||(i=c),a.length===1&&typeof j=="string"&&j.length<512&&i===c&&j.charAt(0)==="<"&&!bb.test(j)&&(f.support.checkClone||!bd.test(j))&&(f.support.html5Clone||!bc.test(j))&&(g=!0,h=f.fragments[j],h&&h!==1&&(e=h)),e||(e=i.createDocumentFragment(),f.clean(a,i,e,d)),g&&(f.fragments[j]=h?e:1);return{fragment:e,cacheable:g}},f.fragments={},f.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){f.fn[a]=function(c){var d=[],e=f(c),g=this.length===1&&this[0].parentNode;if(g&&g.nodeType===11&&g.childNodes.length===1&&e.length===1){e[b](this[0]);return this}for(var h=0,i=e.length;h<i;h++){var j=(h>0?this.clone(!0):this).get();f(e[h])[b](j),d=d.concat(j)}return this.pushStack(d,a,e.selector)}}),f.extend({clone:function(a,b,c){var d,e,g,h=f.support.html5Clone||!bc.test("<"+a.nodeName)?a.cloneNode(!0):bo(a);if((!f.support.noCloneEvent||!f.support.noCloneChecked)&&(a.nodeType===1||a.nodeType===11)&&!f.isXMLDoc(a)){bk(a,h),d=bl(a),e=bl(h);for(g=0;d[g];++g)e[g]&&bk(d[g],e[g])}if(b){bj(a,h);if(c){d=bl(a),e=bl(h);for(g=0;d[g];++g)bj(d[g],e[g])}}d=e=null;return h},clean:function(a,b,d,e){var g;b=b||c,typeof b.createElement=="undefined"&&(b=b.ownerDocument||b[0]&&b[0].ownerDocument||c);var h=[],i;for(var j=0,k;(k=a[j])!=null;j++){typeof k=="number"&&(k+="");if(!k)continue;if(typeof k=="string")if(!_.test(k))k=b.createTextNode(k);else{k=k.replace(Y,"<$1></$2>");var l=(Z.exec(k)||["",""])[1].toLowerCase(),m=bg[l]||bg._default,n=m[0],o=b.createElement("div");b===c?bh.appendChild(o):U(b).appendChild(o),o.innerHTML=m[1]+k+m[2];while(n--)o=o.lastChild;if(!f.support.tbody){var p=$.test(k),q=l==="table"&&!p?o.firstChild&&o.firstChild.childNodes:m[1]==="<table>"&&!p?o.childNodes:[];for(i=q.length-1;i>=0;--i)f.nodeName(q[i],"tbody")&&!q[i].childNodes.length&&q[i].parentNode.removeChild(q[i])}!f.support.leadingWhitespace&&X.test(k)&&o.insertBefore(b.createTextNode(X.exec(k)[0]),o.firstChild),k=o.childNodes}var r;if(!f.support.appendChecked)if(k[0]&&typeof (r=k.length)=="number")for(i=0;i<r;i++)bn(k[i]);else bn(k);k.nodeType?h.push(k):h=f.merge(h,k)}if(d){g=function(a){return!a.type||be.test(a.type)};for(j=0;h[j];j++)if(e&&f.nodeName(h[j],"script")&&(!h[j].type||h[j].type.toLowerCase()==="text/javascript"))e.push(h[j].parentNode?h[j].parentNode.removeChild(h[j]):h[j]);else{if(h[j].nodeType===1){var s=f.grep(h[j].getElementsByTagName("script"),g);h.splice.apply(h,[j+1,0].concat(s))}d.appendChild(h[j])}}return h},cleanData:function(a){var b,c,d=f.cache,e=f.event.special,g=f.support.deleteExpando;for(var h=0,i;(i=a[h])!=null;h++){if(i.nodeName&&f.noData[i.nodeName.toLowerCase()])continue;c=i[f.expando];if(c){b=d[c];if(b&&b.events){for(var j in b.events)e[j]?f.event.remove(i,j):f.removeEvent(i,j,b.handle);b.handle&&(b.handle.elem=null)}g?delete i[f.expando]:i.removeAttribute&&i.removeAttribute(f.expando),delete d[c]}}}});var bq=/alpha\([^)]*\)/i,br=/opacity=([^)]*)/,bs=/([A-Z]|^ms)/g,bt=/^-?\d+(?:px)?$/i,bu=/^-?\d/,bv=/^([\-+])=([\-+.\de]+)/,bw={position:"absolute",visibility:"hidden",display:"block"},bx=["Left","Right"],by=["Top","Bottom"],bz,bA,bB;f.fn.css=function(a,c){if(arguments.length===2&&c===b)return this;return f.access(this,a,c,!0,function(a,c,d){return d!==b?f.style(a,c,d):f.css(a,c)})},f.extend({cssHooks:{opacity:{get:function(a,b){if(b){var c=bz(a,"opacity","opacity");return c===""?"1":c}return a.style.opacity}}},cssNumber:{fillOpacity:!0,fontWeight:!0,lineHeight:!0,opacity:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{"float":f.support.cssFloat?"cssFloat":"styleFloat"},style:function(a,c,d,e){if(!!a&&a.nodeType!==3&&a.nodeType!==8&&!!a.style){var g,h,i=f.camelCase(c),j=a.style,k=f.cssHooks[i];c=f.cssProps[i]||i;if(d===b){if(k&&"get"in k&&(g=k.get(a,!1,e))!==b)return g;return j[c]}h=typeof d,h==="string"&&(g=bv.exec(d))&&(d=+(g[1]+1)*+g[2]+parseFloat(f.css(a,c)),h="number");if(d==null||h==="number"&&isNaN(d))return;h==="number"&&!f.cssNumber[i]&&(d+="px");if(!k||!("set"in k)||(d=k.set(a,d))!==b)try{j[c]=d}catch(l){}}},css:function(a,c,d){var e,g;c=f.camelCase(c),g=f.cssHooks[c],c=f.cssProps[c]||c,c==="cssFloat"&&(c="float");if(g&&"get"in g&&(e=g.get(a,!0,d))!==b)return e;if(bz)return bz(a,c)},swap:function(a,b,c){var d={};for(var e in b)d[e]=a.style[e],a.style[e]=b[e];c.call(a);for(e in b)a.style[e]=d[e]}}),f.curCSS=f.css,f.each(["height","width"],function(a,b){f.cssHooks[b]={get:function(a,c,d){var e;if(c){if(a.offsetWidth!==0)return bC(a,b,d);f.swap(a,bw,function(){e=bC(a,b,d)});return e}},set:function(a,b){if(!bt.test(b))return b;b=parseFloat(b);if(b>=0)return b+"px"}}}),f.support.opacity||(f.cssHooks.opacity={get:function(a,b){return br.test((b&&a.currentStyle?a.currentStyle.filter:a.style.filter)||"")?parseFloat(RegExp.$1)/100+"":b?"1":""},set:function(a,b){var c=a.style,d=a.currentStyle,e=f.isNumeric(b)?"alpha(opacity="+b*100+")":"",g=d&&d.filter||c.filter||"";c.zoom=1;if(b>=1&&f.trim(g.replace(bq,""))===""){c.removeAttribute("filter");if(d&&!d.filter)return}c.filter=bq.test(g)?g.replace(bq,e):g+" "+e}}),f(function(){f.support.reliableMarginRight||(f.cssHooks.marginRight={get:function(a,b){var c;f.swap(a,{display:"inline-block"},function(){b?c=bz(a,"margin-right","marginRight"):c=a.style.marginRight});return c}})}),c.defaultView&&c.defaultView.getComputedStyle&&(bA=function(a,b){var c,d,e;b=b.replace(bs,"-$1").toLowerCase(),(d=a.ownerDocument.defaultView)&&(e=d.getComputedStyle(a,null))&&(c=e.getPropertyValue(b),c===""&&!f.contains(a.ownerDocument.documentElement,a)&&(c=f.style(a,b)));return c}),c.documentElement.currentStyle&&(bB=function(a,b){var c,d,e,f=a.currentStyle&&a.currentStyle[b],g=a.style;f===null&&g&&(e=g[b])&&(f=e),!bt.test(f)&&bu.test(f)&&(c=g.left,d=a.runtimeStyle&&a.runtimeStyle.left,d&&(a.runtimeStyle.left=a.currentStyle.left),g.left=b==="fontSize"?"1em":f||0,f=g.pixelLeft+"px",g.left=c,d&&(a.runtimeStyle.left=d));return f===""?"auto":f}),bz=bA||bB,f.expr&&f.expr.filters&&(f.expr.filters.hidden=function(a){var b=a.offsetWidth,c=a.offsetHeight;return b===0&&c===0||!f.support.reliableHiddenOffsets&&(a.style&&a.style.display||f.css(a,"display"))==="none"},f.expr.filters.visible=function(a){return!f.expr.filters.hidden(a)});var bD=/%20/g,bE=/\[\]$/,bF=/\r?\n/g,bG=/#.*$/,bH=/^(.*?):[ \t]*([^\r\n]*)\r?$/mg,bI=/^(?:color|date|datetime|datetime-local|email|hidden|month|number|password|range|search|tel|text|time|url|week)$/i,bJ=/^(?:about|app|app\-storage|.+\-extension|file|res|widget):$/,bK=/^(?:GET|HEAD)$/,bL=/^\/\//,bM=/\?/,bN=/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,bO=/^(?:select|textarea)/i,bP=/\s+/,bQ=/([?&])_=[^&]*/,bR=/^([\w\+\.\-]+:)(?:\/\/([^\/?#:]*)(?::(\d+))?)?/,bS=f.fn.load,bT={},bU={},bV,bW,bX=["*/"]+["*"];try{bV=e.href}catch(bY){bV=c.createElement("a"),bV.href="",bV=bV.href}bW=bR.exec(bV.toLowerCase())||[],f.fn.extend({load:function(a,c,d){if(typeof a!="string"&&bS)return bS.apply(this,arguments);if(!this.length)return this;var e=a.indexOf(" ");if(e>=0){var g=a.slice(e,a.length);a=a.slice(0,e)}var h="GET";c&&(f.isFunction(c)?(d=c,c=b):typeof c=="object"&&(c=f.param(c,f.ajaxSettings.traditional),h="POST"));var i=this;f.ajax({url:a,type:h,dataType:"html",data:c,complete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?f("<div>").append(c.replace(bN,"")).find(g):c)),d&&i.each(d,[c,b,a])}});return this},serialize:function(){return f.param(this.serializeArray())},serializeArray:function(){return this.map(function(){return this.elements?f.makeArray(this.elements):this}).filter(function(){return this.name&&!this.disabled&&(this.checked||bO.test(this.nodeName)||bI.test(this.type))}).map(function(a,b){var c=f(this).val();return c==null?null:f.isArray(c)?f.map(c,function(a,c){return{name:b.name,value:a.replace(bF,"\r\n")}}):{name:b.name,value:c.replace(bF,"\r\n")}}).get()}}),f.each("ajaxStart ajaxStop ajaxComplete ajaxError ajaxSuccess ajaxSend".split(" "),function(a,b){f.fn[b]=function(a){return this.on(b,a)}}),f.each(["get","post"],function(a,c){f[c]=function(a,d,e,g){f.isFunction(d)&&(g=g||e,e=d,d=b);return f.ajax({type:c,url:a,data:d,success:e,dataType:g})}}),f.extend({getScript:function(a,c){return f.get(a,b,c,"script")},getJSON:function(a,b,c){return f.get(a,b,c,"json")},ajaxSetup:function(a,b){b?b_(a,f.ajaxSettings):(b=a,a=f.ajaxSettings),b_(a,b);return a},ajaxSettings:{url:bV,isLocal:bJ.test(bW[1]),global:!0,type:"GET",contentType:"application/x-www-form-urlencoded",processData:!0,async:!0,accepts:{xml:"application/xml, text/xml",html:"text/html",text:"text/plain",json:"application/json, text/javascript","*":bX},contents:{xml:/xml/,html:/html/,json:/json/},responseFields:{xml:"responseXML",text:"responseText"},converters:{"* text":a.String,"text html":!0,"text json":f.parseJSON,"text xml":f.parseXML},flatOptions:{context:!0,url:!0}},ajaxPrefilter:bZ(bT),ajaxTransport:bZ(bU),ajax:function(a,c){function w(a,c,l,m){if(s!==2){s=2,q&&clearTimeout(q),p=b,n=m||"",v.readyState=a>0?4:0;var o,r,u,w=c,x=l?cb(d,v,l):b,y,z;if(a>=200&&a<300||a===304){if(d.ifModified){if(y=v.getResponseHeader("Last-Modified"))f.lastModified[k]=y;if(z=v.getResponseHeader("Etag"))f.etag[k]=z}if(a===304)w="notmodified",o=!0;else try{r=cc(d,x),w="success",o=!0}catch(A){w="parsererror",u=A}}else{u=w;if(!w||a)w="error",a<0&&(a=0)}v.status=a,v.statusText=""+(c||w),o?h.resolveWith(e,[r,w,v]):h.rejectWith(e,[v,w,u]),v.statusCode(j),j=b,t&&g.trigger("ajax"+(o?"Success":"Error"),[v,d,o?r:u]),i.fireWith(e,[v,w]),t&&(g.trigger("ajaxComplete",[v,d]),--f.active||f.event.trigger("ajaxStop"))}}typeof a=="object"&&(c=a,a=b),c=c||{};var d=f.ajaxSetup({},c),e=d.context||d,g=e!==d&&(e.nodeType||e instanceof f)?f(e):f.event,h=f.Deferred(),i=f.Callbacks("once memory"),j=d.statusCode||{},k,l={},m={},n,o,p,q,r,s=0,t,u,v={readyState:0,setRequestHeader:function(a,b){if(!s){var c=a.toLowerCase();a=m[c]=m[c]||a,l[a]=b}return this},getAllResponseHeaders:function(){return s===2?n:null},getResponseHeader:function(a){var c;if(s===2){if(!o){o={};while(c=bH.exec(n))o[c[1].toLowerCase()]=c[2]}c=o[a.toLowerCase()]}return c===b?null:c},overrideMimeType:function(a){s||(d.mimeType=a);return this},abort:function(a){a=a||"abort",p&&p.abort(a),w(0,a);return this}};h.promise(v),v.success=v.done,v.error=v.fail,v.complete=i.add,v.statusCode=function(a){if(a){var b;if(s<2)for(b in a)j[b]=[j[b],a[b]];else b=a[v.status],v.then(b,b)}return this},d.url=((a||d.url)+"").replace(bG,"").replace(bL,bW[1]+"//"),d.dataTypes=f.trim(d.dataType||"*").toLowerCase().split(bP),d.crossDomain==null&&(r=bR.exec(d.url.toLowerCase()),d.crossDomain=!(!r||r[1]==bW[1]&&r[2]==bW[2]&&(r[3]||(r[1]==="http:"?80:443))==(bW[3]||(bW[1]==="http:"?80:443)))),d.data&&d.processData&&typeof d.data!="string"&&(d.data=f.param(d.data,d.traditional)),b$(bT,d,c,v);if(s===2)return!1;t=d.global,d.type=d.type.toUpperCase(),d.hasContent=!bK.test(d.type),t&&f.active++===0&&f.event.trigger("ajaxStart");if(!d.hasContent){d.data&&(d.url+=(bM.test(d.url)?"&":"?")+d.data,delete d.data),k=d.url;if(d.cache===!1){var x=f.now(),y=d.url.replace(bQ,"$1_="+x);d.url=y+(y===d.url?(bM.test(d.url)?"&":"?")+"_="+x:"")}}(d.data&&d.hasContent&&d.contentType!==!1||c.contentType)&&v.setRequestHeader("Content-Type",d.contentType),d.ifModified&&(k=k||d.url,f.lastModified[k]&&v.setRequestHeader("If-Modified-Since",f.lastModified[k]),f.etag[k]&&v.setRequestHeader("If-None-Match",f.etag[k])),v.setRequestHeader("Accept",d.dataTypes[0]&&d.accepts[d.dataTypes[0]]?d.accepts[d.dataTypes[0]]+(d.dataTypes[0]!=="*"?", "+bX+"; q=0.01":""):d.accepts["*"]);for(u in d.headers)v.setRequestHeader(u,d.headers[u]);if(d.beforeSend&&(d.beforeSend.call(e,v,d)===!1||s===2)){v.abort();return!1}for(u in{success:1,error:1,complete:1})v[u](d[u]);p=b$(bU,d,c,v);if(!p)w(-1,"No Transport");else{v.readyState=1,t&&g.trigger("ajaxSend",[v,d]),d.async&&d.timeout>0&&(q=setTimeout(function(){v.abort("timeout")},d.timeout));try{s=1,p.send(l,w)}catch(z){if(s<2)w(-1,z);else throw z}}return v},param:function(a,c){var d=[],e=function(a,b){b=f.isFunction(b)?b():b,d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(b)};c===b&&(c=f.ajaxSettings.traditional);if(f.isArray(a)||a.jquery&&!f.isPlainObject(a))f.each(a,function(){e(this.name,this.value)});else for(var g in a)ca(g,a[g],c,e);return d.join("&").replace(bD,"+")}}),f.extend({active:0,lastModified:{},etag:{}});var cd=f.now(),ce=/(\=)\?(&|$)|\?\?/i;f.ajaxSetup({jsonp:"callback",jsonpCallback:function(){return f.expando+"_"+cd++}}),f.ajaxPrefilter("json jsonp",function(b,c,d){var e=b.contentType==="application/x-www-form-urlencoded"&&typeof b.data=="string";if(b.dataTypes[0]==="jsonp"||b.jsonp!==!1&&(ce.test(b.url)||e&&ce.test(b.data))){var g,h=b.jsonpCallback=f.isFunction(b.jsonpCallback)?b.jsonpCallback():b.jsonpCallback,i=a[h],j=b.url,k=b.data,l="$1"+h+"$2";b.jsonp!==!1&&(j=j.replace(ce,l),b.url===j&&(e&&(k=k.replace(ce,l)),b.data===k&&(j+=(/\?/.test(j)?"&":"?")+b.jsonp+"="+h))),b.url=j,b.data=k,a[h]=function(a){g=[a]},d.always(function(){a[h]=i,g&&f.isFunction(i)&&a[h](g[0])}),b.converters["script json"]=function(){g||f.error(h+" was not called");return g[0]},b.dataTypes[0]="json";return"script"}}),f.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/javascript|ecmascript/},converters:{"text script":function(a){f.globalEval(a);return a}}}),f.ajaxPrefilter("script",function(a){a.cache===b&&(a.cache=!1),a.crossDomain&&(a.type="GET",a.global=!1)}),f.ajaxTransport("script",function(a){if(a.crossDomain){var d,e=c.head||c.getElementsByTagName("head")[0]||c.documentElement;return{send:function(f,g){d=c.createElement("script"),d.async="async",a.scriptCharset&&(d.charset=a.scriptCharset),d.src=a.url,d.onload=d.onreadystatechange=function(a,c){if(c||!d.readyState||/loaded|complete/.test(d.readyState))d.onload=d.onreadystatechange=null,e&&d.parentNode&&e.removeChild(d),d=b,c||g(200,"success")},e.insertBefore(d,e.firstChild)},abort:function(){d&&d.onload(0,1)}}}});var cf=a.ActiveXObject?function(){for(var a in ch)ch[a](0,1)}:!1,cg=0,ch;f.ajaxSettings.xhr=a.ActiveXObject?function(){return!this.isLocal&&ci()||cj()}:ci,function(a){f.extend(f.support,{ajax:!!a,cors:!!a&&"withCredentials"in a})}(f.ajaxSettings.xhr()),f.support.ajax&&f.ajaxTransport(function(c){if(!c.crossDomain||f.support.cors){var d;return{send:function(e,g){var h=c.xhr(),i,j;c.username?h.open(c.type,c.url,c.async,c.username,c.password):h.open(c.type,c.url,c.async);if(c.xhrFields)for(j in c.xhrFields)h[j]=c.xhrFields[j];c.mimeType&&h.overrideMimeType&&h.overrideMimeType(c.mimeType),!c.crossDomain&&!e["X-Requested-With"]&&(e["X-Requested-With"]="XMLHttpRequest");try{for(j in e)h.setRequestHeader(j,e[j])}catch(k){}h.send(c.hasContent&&c.data||null),d=function(a,e){var j,k,l,m,n;try{if(d&&(e||h.readyState===4)){d=b,i&&(h.onreadystatechange=f.noop,cf&&delete ch[i]);if(e)h.readyState!==4&&h.abort();else{j=h.status,l=h.getAllResponseHeaders(),m={},n=h.responseXML,n&&n.documentElement&&(m.xml=n),m.text=h.responseText;try{k=h.statusText}catch(o){k=""}!j&&c.isLocal&&!c.crossDomain?j=m.text?200:404:j===1223&&(j=204)}}}catch(p){e||g(-1,p)}m&&g(j,k,m,l)},!c.async||h.readyState===4?d():(i=++cg,cf&&(ch||(ch={},f(a).unload(cf)),ch[i]=d),h.onreadystatechange=d)},abort:function(){d&&d(0,1)}}}});var ck={},cl,cm,cn=/^(?:toggle|show|hide)$/,co=/^([+\-]=)?([\d+.\-]+)([a-z%]*)$/i,cp,cq=[["height","marginTop","marginBottom","paddingTop","paddingBottom"],["width","marginLeft","marginRight","paddingLeft","paddingRight"],["opacity"]],cr;f.fn.extend({show:function(a,b,c){var d,e;if(a||a===0)return this.animate(cu("show",3),a,b,c);for(var g=0,h=this.length;g<h;g++)d=this[g],d.style&&(e=d.style.display,!f._data(d,"olddisplay")&&e==="none"&&(e=d.style.display=""),e===""&&f.css(d,"display")==="none"&&f._data(d,"olddisplay",cv(d.nodeName)));for(g=0;g<h;g++){d=this[g];if(d.style){e=d.style.display;if(e===""||e==="none")d.style.display=f._data(d,"olddisplay")||""}}return this},hide:function(a,b,c){if(a||a===0)return this.animate(cu("hide",3),a,b,c);var d,e,g=0,h=this.length;for(;g<h;g++)d=this[g],d.style&&(e=f.css(d,"display"),e!=="none"&&!f._data(d,"olddisplay")&&f._data(d,"olddisplay",e));for(g=0;g<h;g++)this[g].style&&(this[g].style.display="none");return this},_toggle:f.fn.toggle,toggle:function(a,b,c){var d=typeof a=="boolean";f.isFunction(a)&&f.isFunction(b)?this._toggle.apply(this,arguments):a==null||d?this.each(function(){var b=d?a:f(this).is(":hidden");f(this)[b?"show":"hide"]()}):this.animate(cu("toggle",3),a,b,c);return this},fadeTo:function(a,b,c,d){return this.filter(":hidden").css("opacity",0).show().end().animate({opacity:b},a,c,d)},animate:function(a,b,c,d){function g(){e.queue===!1&&f._mark(this);var b=f.extend({},e),c=this.nodeType===1,d=c&&f(this).is(":hidden"),g,h,i,j,k,l,m,n,o;b.animatedProperties={};for(i in a){g=f.camelCase(i),i!==g&&(a[g]=a[i],delete a[i]),h=a[g],f.isArray(h)?(b.animatedProperties[g]=h[1],h=a[g]=h[0]):b.animatedProperties[g]=b.specialEasing&&b.specialEasing[g]||b.easing||"swing";if(h==="hide"&&d||h==="show"&&!d)return b.complete.call(this);c&&(g==="height"||g==="width")&&(b.overflow=[this.style.overflow,this.style.overflowX,this.style.overflowY],f.css(this,"display")==="inline"&&f.css(this,"float")==="none"&&(!f.support.inlineBlockNeedsLayout||cv(this.nodeName)==="inline"?this.style.display="inline-block":this.style.zoom=1))}b.overflow!=null&&(this.style.overflow="hidden");for(i in a)j=new f.fx(this,b,i),h=a[i],cn.test(h)?(o=f._data(this,"toggle"+i)||(h==="toggle"?d?"show":"hide":0),o?(f._data(this,"toggle"+i,o==="show"?"hide":"show"),j[o]()):j[h]()):(k=co.exec(h),l=j.cur(),k?(m=parseFloat(k[2]),n=k[3]||(f.cssNumber[i]?"":"px"),n!=="px"&&(f.style(this,i,(m||1)+n),l=(m||1)/j.cur()*l,f.style(this,i,l+n)),k[1]&&(m=(k[1]==="-="?-1:1)*m+l),j.custom(l,m,n)):j.custom(l,h,""));return!0}var e=f.speed(b,c,d);if(f.isEmptyObject(a))return this.each(e.complete,[!1]);a=f.extend({},a);return e.queue===!1?this.each(g):this.queue(e.queue,g)},stop:function(a,c,d){typeof a!="string"&&(d=c,c=a,a=b),c&&a!==!1&&this.queue(a||"fx",[]);return this.each(function(){function h(a,b,c){var e=b[c];f.removeData(a,c,!0),e.stop(d)}var b,c=!1,e=f.timers,g=f._data(this);d||f._unmark(!0,this);if(a==null)for(b in g)g[b]&&g[b].stop&&b.indexOf(".run")===b.length-4&&h(this,g,b);else g[b=a+".run"]&&g[b].stop&&h(this,g,b);for(b=e.length;b--;)e[b].elem===this&&(a==null||e[b].queue===a)&&(d?e[b](!0):e[b].saveState(),c=!0,e.splice(b,1));(!d||!c)&&f.dequeue(this,a)})}}),f.each({slideDown:cu("show",1),slideUp:cu("hide",1),slideToggle:cu("toggle",1),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"},fadeToggle:{opacity:"toggle"}},function(a,b){f.fn[a]=function(a,c,d){return this.animate(b,a,c,d)}}),f.extend({speed:function(a,b,c){var d=a&&typeof a=="object"?f.extend({},a):{complete:c||!c&&b||f.isFunction(a)&&a,duration:a,easing:c&&b||b&&!f.isFunction(b)&&b};d.duration=f.fx.off?0:typeof d.duration=="number"?d.duration:d.duration in f.fx.speeds?f.fx.speeds[d.duration]:f.fx.speeds._default;if(d.queue==null||d.queue===!0)d.queue="fx";d.old=d.complete,d.complete=function(a){f.isFunction(d.old)&&d.old.call(this),d.queue?f.dequeue(this,d.queue):a!==!1&&f._unmark(this)};return d},easing:{linear:function(a,b,c,d){return c+d*a},swing:function(a,b,c,d){return(-Math.cos(a*Math.PI)/2+.5)*d+c}},timers:[],fx:function(a,b,c){this.options=b,this.elem=a,this.prop=c,b.orig=b.orig||{}}}),f.fx.prototype={update:function(){this.options.step&&this.options.step.call(this.elem,this.now,this),(f.fx.step[this.prop]||f.fx.step._default)(this)},cur:function(){if(this.elem[this.prop]!=null&&(!this.elem.style||this.elem.style[this.prop]==null))return this.elem[this.prop];var a,b=f.css(this.elem,this.prop);return isNaN(a=parseFloat(b))?!b||b==="auto"?0:b:a},custom:function(a,c,d){function h(a){return e.step(a)}var e=this,g=f.fx;this.startTime=cr||cs(),this.end=c,this.now=this.start=a,this.pos=this.state=0,this.unit=d||this.unit||(f.cssNumber[this.prop]?"":"px"),h.queue=this.options.queue,h.elem=this.elem,h.saveState=function(){e.options.hide&&f._data(e.elem,"fxshow"+e.prop)===b&&f._data(e.elem,"fxshow"+e.prop,e.start)},h()&&f.timers.push(h)&&!cp&&(cp=setInterval(g.tick,g.interval))},show:function(){var a=f._data(this.elem,"fxshow"+this.prop);this.options.orig[this.prop]=a||f.style(this.elem,this.prop),this.options.show=!0,a!==b?this.custom(this.cur(),a):this.custom(this.prop==="width"||this.prop==="height"?1:0,this.cur()),f(this.elem).show()},hide:function(){this.options.orig[this.prop]=f._data(this.elem,"fxshow"+this.prop)||f.style(this.elem,this.prop),this.options.hide=!0,this.custom(this.cur(),0)},step:function(a){var b,c,d,e=cr||cs(),g=!0,h=this.elem,i=this.options;if(a||e>=i.duration+this.startTime){this.now=this.end,this.pos=this.state=1,this.update(),i.animatedProperties[this.prop]=!0;for(b in i.animatedProperties)i.animatedProperties[b]!==!0&&(g=!1);if(g){i.overflow!=null&&!f.support.shrinkWrapBlocks&&f.each(["","X","Y"],function(a,b){h.style["overflow"+b]=i.overflow[a]}),i.hide&&f(h).hide();if(i.hide||i.show)for(b in i.animatedProperties)f.style(h,b,i.orig[b]),f.removeData(h,"fxshow"+b,!0),f.removeData(h,"toggle"+b,!0);d=i.complete,d&&(i.complete=!1,d.call(h))}return!1}i.duration==Infinity?this.now=e:(c=e-this.startTime,this.state=c/i.duration,this.pos=f.easing[i.animatedProperties[this.prop]](this.state,c,0,1,i.duration),this.now=this.start+(this.end-this.start)*this.pos),this.update();return!0}},f.extend(f.fx,{tick:function(){var a,b=f.timers,c=0;for(;c<b.length;c++)a=b[c],!a()&&b[c]===a&&b.splice(c--,1);b.length||f.fx.stop()},interval:13,stop:function(){clearInterval(cp),cp=null},speeds:{slow:600,fast:200,_default:400},step:{opacity:function(a){f.style(a.elem,"opacity",a.now)},_default:function(a){a.elem.style&&a.elem.style[a.prop]!=null?a.elem.style[a.prop]=a.now+a.unit:a.elem[a.prop]=a.now}}}),f.each(["width","height"],function(a,b){f.fx.step[b]=function(a){f.style(a.elem,b,Math.max(0,a.now)+a.unit)}}),f.expr&&f.expr.filters&&(f.expr.filters.animated=function(a){return f.grep(f.timers,function(b){return a===b.elem}).length});var cw=/^t(?:able|d|h)$/i,cx=/^(?:body|html)$/i;"getBoundingClientRect"in c.documentElement?f.fn.offset=function(a){var b=this[0],c;if(a)return this.each(function(b){f.offset.setOffset(this,a,b)});if(!b||!b.ownerDocument)return null;if(b===b.ownerDocument.body)return f.offset.bodyOffset(b);try{c=b.getBoundingClientRect()}catch(d){}var e=b.ownerDocument,g=e.documentElement;if(!c||!f.contains(g,b))return c?{top:c.top,left:c.left}:{top:0,left:0};var h=e.body,i=cy(e),j=g.clientTop||h.clientTop||0,k=g.clientLeft||h.clientLeft||0,l=i.pageYOffset||f.support.boxModel&&g.scrollTop||h.scrollTop,m=i.pageXOffset||f.support.boxModel&&g.scrollLeft||h.scrollLeft,n=c.top+l-j,o=c.left+m-k;return{top:n,left:o}}:f.fn.offset=function(a){var b=this[0];if(a)return this.each(function(b){f.offset.setOffset(this,a,b)});if(!b||!b.ownerDocument)return null;if(b===b.ownerDocument.body)return f.offset.bodyOffset(b);var c,d=b.offsetParent,e=b,g=b.ownerDocument,h=g.documentElement,i=g.body,j=g.defaultView,k=j?j.getComputedStyle(b,null):b.currentStyle,l=b.offsetTop,m=b.offsetLeft;while((b=b.parentNode)&&b!==i&&b!==h){if(f.support.fixedPosition&&k.position==="fixed")break;c=j?j.getComputedStyle(b,null):b.currentStyle,l-=b.scrollTop,m-=b.scrollLeft,b===d&&(l+=b.offsetTop,m+=b.offsetLeft,f.support.doesNotAddBorder&&(!f.support.doesAddBorderForTableAndCells||!cw.test(b.nodeName))&&(l+=parseFloat(c.borderTopWidth)||0,m+=parseFloat(c.borderLeftWidth)||0),e=d,d=b.offsetParent),f.support.subtractsBorderForOverflowNotVisible&&c.overflow!=="visible"&&(l+=parseFloat(c.borderTopWidth)||0,m+=parseFloat(c.borderLeftWidth)||0),k=c}if(k.position==="relative"||k.position==="static")l+=i.offsetTop,m+=i.offsetLeft;f.support.fixedPosition&&k.position==="fixed"&&(l+=Math.max(h.scrollTop,i.scrollTop),m+=Math.max(h.scrollLeft,i.scrollLeft));return{top:l,left:m}},f.offset={bodyOffset:function(a){var b=a.offsetTop,c=a.offsetLeft;f.support.doesNotIncludeMarginInBodyOffset&&(b+=parseFloat(f.css(a,"marginTop"))||0,c+=parseFloat(f.css(a,"marginLeft"))||0);return{top:b,left:c}},setOffset:function(a,b,c){var d=f.css(a,"position");d==="static"&&(a.style.position="relative");var e=f(a),g=e.offset(),h=f.css(a,"top"),i=f.css(a,"left"),j=(d==="absolute"||d==="fixed")&&f.inArray("auto",[h,i])>-1,k={},l={},m,n;j?(l=e.position(),m=l.top,n=l.left):(m=parseFloat(h)||0,n=parseFloat(i)||0),f.isFunction(b)&&(b=b.call(a,c,g)),b.top!=null&&(k.top=b.top-g.top+m),b.left!=null&&(k.left=b.left-g.left+n),"using"in b?b.using.call(a,k):e.css(k)}},f.fn.extend({position:function(){if(!this[0])return null;var a=this[0],b=this.offsetParent(),c=this.offset(),d=cx.test(b[0].nodeName)?{top:0,left:0}:b.offset();c.top-=parseFloat(f.css(a,"marginTop"))||0,c.left-=parseFloat(f.css(a,"marginLeft"))||0,d.top+=parseFloat(f.css(b[0],"borderTopWidth"))||0,d.left+=parseFloat(f.css(b[0],"borderLeftWidth"))||0;return{top:c.top-d.top,left:c.left-d.left}},offsetParent:function(){return this.map(function(){var a=this.offsetParent||c.body;while(a&&!cx.test(a.nodeName)&&f.css(a,"position")==="static")a=a.offsetParent;return a})}}),f.each(["Left","Top"],function(a,c){var d="scroll"+c;f.fn[d]=function(c){var e,g;if(c===b){e=this[0];if(!e)return null;g=cy(e);return g?"pageXOffset"in g?g[a?"pageYOffset":"pageXOffset"]:f.support.boxModel&&g.document.documentElement[d]||g.document.body[d]:e[d]}return this.each(function(){g=cy(this),g?g.scrollTo(a?f(g).scrollLeft():c,a?c:f(g).scrollTop()):this[d]=c})}}),f.each(["Height","Width"],function(a,c){var d=c.toLowerCase();f.fn["inner"+c]=function(){var a=this[0];return a?a.style?parseFloat(f.css(a,d,"padding")):this[d]():null},f.fn["outer"+c]=function(a){var b=this[0];return b?b.style?parseFloat(f.css(b,d,a?"margin":"border")):this[d]():null},f.fn[d]=function(a){var e=this[0];if(!e)return a==null?null:this;if(f.isFunction(a))return this.each(function(b){var c=f(this);c[d](a.call(this,b,c[d]()))});if(f.isWindow(e)){var g=e.document.documentElement["client"+c],h=e.document.body;return e.document.compatMode==="CSS1Compat"&&g||h&&h["client"+c]||g}if(e.nodeType===9)return Math.max(e.documentElement["client"+c],e.body["scroll"+c],e.documentElement["scroll"+c],e.body["offset"+c],e.documentElement["offset"+c]);if(a===b){var i=f.css(e,d),j=parseFloat(i);return f.isNumeric(j)?j:i}return this.css(d,typeof a=="string"?a:a+"px")}}),a.jQuery=a.$=f,typeof define=="function"&&define.amd&&define.amd.jQuery&&define("jquery",[],function(){return f})})(window);
\ No newline at end of file
diff --git a/doc/source/index.rst b/doc/source/index.rst
index dbefdec144..69e6ce940f 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -1,6 +1,8 @@
 DevStack - an OpenStack Community Production
 ============================================
 
+.. image:: assets/images/logo-blue.png
+
 .. toctree::
    :glob:
    :maxdepth: 1

From 50187eec280422fe091297901bb5e9396728d10a Mon Sep 17 00:00:00 2001
From: mathieu-rohon <mathieu.rohon@gmail.com>
Date: Fri, 21 Nov 2014 22:12:40 +0100
Subject: [PATCH 0122/3333] Restore linuxbridge-agent compatibility

This patch partially reverts commit
15130cd5fd1688b8984d78136b97bb8de7c32b64.

This commit was desupporting ovs and linuxbridge plugins.
But the ML2 plugin can be deployed with the linuxbridge agent.

The current patch restores the linuxbridge agent configuration
file.

Closes-Bug: #1393429

Change-Id: If824185b22e22a1de6498f1f0f2742a279235675
---
 lib/neutron_plugins/linuxbridge_agent | 77 +++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
new file mode 100644
index 0000000000..2638dd3725
--- /dev/null
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -0,0 +1,77 @@
+# Neutron Linux Bridge L2 agent
+# -----------------------------
+
+# Save trace setting
+PLUGIN_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+function is_neutron_ovs_base_plugin {
+    # linuxbridge doesn't use OVS
+    return 1
+}
+
+function neutron_plugin_create_nova_conf {
+    :
+}
+
+function neutron_plugin_install_agent_packages {
+    install_package bridge-utils
+}
+
+function neutron_plugin_configure_debug_command {
+    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge
+}
+
+function neutron_plugin_configure_dhcp_agent {
+    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+}
+
+function neutron_plugin_configure_l3_agent {
+    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
+    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
+}
+
+function neutron_plugin_configure_plugin_agent {
+    # Setup physical network interface mappings.  Override
+    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
+    # complex physical network configurations.
+    if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
+        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
+    fi
+    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
+    fi
+    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
+    else
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
+    fi
+    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
+    iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
+    # Define extra "AGENT" configuration options when q-agt is configured by defining
+    # the array ``Q_AGENT_EXTRA_AGENT_OPTS``.
+    # For Example: ``Q_AGENT_EXTRA_AGENT_OPTS=(foo=true bar=2)``
+    for I in "${Q_AGENT_EXTRA_AGENT_OPTS[@]}"; do
+        # Replace the first '=' with ' ' for iniset syntax
+        iniset /$Q_PLUGIN_CONF_FILE agent ${I/=/ }
+    done
+    # Define extra "LINUX_BRIDGE" configuration options when q-agt is configured by defining
+    # the array ``Q_AGENT_EXTRA_SRV_OPTS``.
+    # For Example: ``Q_AGENT_EXTRA_SRV_OPTS=(foo=true bar=2)``
+    for I in "${Q_AGENT_EXTRA_SRV_OPTS[@]}"; do
+        # Replace the first '=' with ' ' for iniset syntax
+        iniset /$Q_PLUGIN_CONF_FILE linux_bridge ${I/=/ }
+    done
+}
+
+function neutron_plugin_setup_interface_driver {
+    local conf_file=$1
+    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
+}
+
+function neutron_plugin_check_adv_test_requirements {
+    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+}
+
+# Restore xtrace
+$PLUGIN_XTRACE

From 81a016dbcd7bbf9fde791386fcc294fca0a59d71 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 15 Nov 2014 17:18:13 -0300
Subject: [PATCH 0123/3333] Rename apts to debs

apts aren't a thing, debs are. apt-get installs debs, like yum installs
rpms. Another option would be to rename rpms to yums, but that is even
sillier, considering then for suse we'd have to call it "zypper-suse" or
something, even though it would want to consume yums-general as a base.

Include a symlink to the old name to help out with grenade. The symlink
should go away later.

This is a long-standing annoyance of mine.

Related-to: I915f0e59c13d8cf5fb3549c6202f8aa2f8be0856
Change-Id: I0416180db5b6add996ce5b48c6966c1b68adbcb0
---
 files/apts                                | 1 +
 files/{apts => debs}/baremetal            | 0
 files/{apts => debs}/ceilometer-collector | 0
 files/{apts => debs}/ceph                 | 0
 files/{apts => debs}/cinder               | 0
 files/{apts => debs}/dstat                | 0
 files/{apts => debs}/general              | 0
 files/{apts => debs}/glance               | 0
 files/{apts => debs}/heat                 | 0
 files/{apts => debs}/horizon              | 0
 files/{apts => debs}/ironic               | 0
 files/{apts => debs}/keystone             | 0
 files/{apts => debs}/ldap                 | 0
 files/{apts => debs}/n-api                | 0
 files/{apts => debs}/n-cpu                | 0
 files/{apts => debs}/n-novnc              | 0
 files/{apts => debs}/neutron              | 0
 files/{apts => debs}/nova                 | 0
 files/{apts => debs}/openvswitch          | 0
 files/{apts => debs}/postgresql           | 0
 files/{apts => debs}/q-agt                | 0
 files/{apts => debs}/q-l3                 | 0
 files/{apts => debs}/qpid                 | 0
 files/{apts => debs}/ryu                  | 0
 files/{apts => debs}/swift                | 0
 files/{apts => debs}/tempest              | 0
 files/{apts => debs}/tls-proxy            | 0
 files/{apts => debs}/trema                | 0
 files/{apts => debs}/trove                | 0
 files/{apts => debs}/zaqar-server         | 0
 functions-common                          | 4 ++--
 31 files changed, 3 insertions(+), 2 deletions(-)
 create mode 120000 files/apts
 rename files/{apts => debs}/baremetal (100%)
 rename files/{apts => debs}/ceilometer-collector (100%)
 rename files/{apts => debs}/ceph (100%)
 rename files/{apts => debs}/cinder (100%)
 rename files/{apts => debs}/dstat (100%)
 rename files/{apts => debs}/general (100%)
 rename files/{apts => debs}/glance (100%)
 rename files/{apts => debs}/heat (100%)
 rename files/{apts => debs}/horizon (100%)
 rename files/{apts => debs}/ironic (100%)
 rename files/{apts => debs}/keystone (100%)
 rename files/{apts => debs}/ldap (100%)
 rename files/{apts => debs}/n-api (100%)
 rename files/{apts => debs}/n-cpu (100%)
 rename files/{apts => debs}/n-novnc (100%)
 rename files/{apts => debs}/neutron (100%)
 rename files/{apts => debs}/nova (100%)
 rename files/{apts => debs}/openvswitch (100%)
 rename files/{apts => debs}/postgresql (100%)
 rename files/{apts => debs}/q-agt (100%)
 rename files/{apts => debs}/q-l3 (100%)
 rename files/{apts => debs}/qpid (100%)
 rename files/{apts => debs}/ryu (100%)
 rename files/{apts => debs}/swift (100%)
 rename files/{apts => debs}/tempest (100%)
 rename files/{apts => debs}/tls-proxy (100%)
 rename files/{apts => debs}/trema (100%)
 rename files/{apts => debs}/trove (100%)
 rename files/{apts => debs}/zaqar-server (100%)

diff --git a/files/apts b/files/apts
new file mode 120000
index 0000000000..ef926de053
--- /dev/null
+++ b/files/apts
@@ -0,0 +1 @@
+debs/
\ No newline at end of file
diff --git a/files/apts/baremetal b/files/debs/baremetal
similarity index 100%
rename from files/apts/baremetal
rename to files/debs/baremetal
diff --git a/files/apts/ceilometer-collector b/files/debs/ceilometer-collector
similarity index 100%
rename from files/apts/ceilometer-collector
rename to files/debs/ceilometer-collector
diff --git a/files/apts/ceph b/files/debs/ceph
similarity index 100%
rename from files/apts/ceph
rename to files/debs/ceph
diff --git a/files/apts/cinder b/files/debs/cinder
similarity index 100%
rename from files/apts/cinder
rename to files/debs/cinder
diff --git a/files/apts/dstat b/files/debs/dstat
similarity index 100%
rename from files/apts/dstat
rename to files/debs/dstat
diff --git a/files/apts/general b/files/debs/general
similarity index 100%
rename from files/apts/general
rename to files/debs/general
diff --git a/files/apts/glance b/files/debs/glance
similarity index 100%
rename from files/apts/glance
rename to files/debs/glance
diff --git a/files/apts/heat b/files/debs/heat
similarity index 100%
rename from files/apts/heat
rename to files/debs/heat
diff --git a/files/apts/horizon b/files/debs/horizon
similarity index 100%
rename from files/apts/horizon
rename to files/debs/horizon
diff --git a/files/apts/ironic b/files/debs/ironic
similarity index 100%
rename from files/apts/ironic
rename to files/debs/ironic
diff --git a/files/apts/keystone b/files/debs/keystone
similarity index 100%
rename from files/apts/keystone
rename to files/debs/keystone
diff --git a/files/apts/ldap b/files/debs/ldap
similarity index 100%
rename from files/apts/ldap
rename to files/debs/ldap
diff --git a/files/apts/n-api b/files/debs/n-api
similarity index 100%
rename from files/apts/n-api
rename to files/debs/n-api
diff --git a/files/apts/n-cpu b/files/debs/n-cpu
similarity index 100%
rename from files/apts/n-cpu
rename to files/debs/n-cpu
diff --git a/files/apts/n-novnc b/files/debs/n-novnc
similarity index 100%
rename from files/apts/n-novnc
rename to files/debs/n-novnc
diff --git a/files/apts/neutron b/files/debs/neutron
similarity index 100%
rename from files/apts/neutron
rename to files/debs/neutron
diff --git a/files/apts/nova b/files/debs/nova
similarity index 100%
rename from files/apts/nova
rename to files/debs/nova
diff --git a/files/apts/openvswitch b/files/debs/openvswitch
similarity index 100%
rename from files/apts/openvswitch
rename to files/debs/openvswitch
diff --git a/files/apts/postgresql b/files/debs/postgresql
similarity index 100%
rename from files/apts/postgresql
rename to files/debs/postgresql
diff --git a/files/apts/q-agt b/files/debs/q-agt
similarity index 100%
rename from files/apts/q-agt
rename to files/debs/q-agt
diff --git a/files/apts/q-l3 b/files/debs/q-l3
similarity index 100%
rename from files/apts/q-l3
rename to files/debs/q-l3
diff --git a/files/apts/qpid b/files/debs/qpid
similarity index 100%
rename from files/apts/qpid
rename to files/debs/qpid
diff --git a/files/apts/ryu b/files/debs/ryu
similarity index 100%
rename from files/apts/ryu
rename to files/debs/ryu
diff --git a/files/apts/swift b/files/debs/swift
similarity index 100%
rename from files/apts/swift
rename to files/debs/swift
diff --git a/files/apts/tempest b/files/debs/tempest
similarity index 100%
rename from files/apts/tempest
rename to files/debs/tempest
diff --git a/files/apts/tls-proxy b/files/debs/tls-proxy
similarity index 100%
rename from files/apts/tls-proxy
rename to files/debs/tls-proxy
diff --git a/files/apts/trema b/files/debs/trema
similarity index 100%
rename from files/apts/trema
rename to files/debs/trema
diff --git a/files/apts/trove b/files/debs/trove
similarity index 100%
rename from files/apts/trove
rename to files/debs/trove
diff --git a/files/apts/zaqar-server b/files/debs/zaqar-server
similarity index 100%
rename from files/apts/zaqar-server
rename to files/debs/zaqar-server
diff --git a/functions-common b/functions-common
index e890b75d13..24507fef91 100644
--- a/functions-common
+++ b/functions-common
@@ -945,7 +945,7 @@ function get_or_create_endpoint {
 function _get_package_dir {
     local pkg_dir
     if is_ubuntu; then
-        pkg_dir=$FILES/apts
+        pkg_dir=$FILES/debs
     elif is_fedora; then
         pkg_dir=$FILES/rpms
     elif is_suse; then
@@ -975,7 +975,7 @@ function apt_get {
 }
 
 # get_packages() collects a list of package names of any type from the
-# prerequisite files in ``files/{apts|rpms}``.  The list is intended
+# prerequisite files in ``files/{debs|rpms}``.  The list is intended
 # to be passed to a package installer such as apt or yum.
 #
 # Only packages required for the services in 1st argument will be

From b64738f1c9fb69ba4af8e2088fc8585ab38f50b3 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Mon, 24 Nov 2014 16:44:50 +0100
Subject: [PATCH 0124/3333] Enable admin mode by default

Zaqar has an admin mode which enables certain endpoints. This mode
should be enabled by default in devstack so that tests environments can
rely on those endpoints to be present.

Change-Id: Ic50875f4515bb631a6bf800c9338d3b6bbeaafae
---
 lib/zaqar | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/zaqar b/lib/zaqar
index b8570eb282..3b0452940f 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -112,6 +112,7 @@ function configure_zaqar {
     sudo chown $USER $ZAQAR_API_LOG_DIR
 
     iniset $ZAQAR_CONF DEFAULT verbose True
+    iniset $ZAQAR_CONF DEFAULT admin_mode True
     iniset $ZAQAR_CONF DEFAULT use_syslog $SYSLOG
     iniset $ZAQAR_CONF DEFAULT log_file $ZAQAR_API_LOG_FILE
     iniset $ZAQAR_CONF 'drivers:transport:wsgi' bind $ZAQAR_SERVICE_HOST

From 6de7dba863cfbe0fda6f918eea31adbd7d652676 Mon Sep 17 00:00:00 2001
From: pcrews <gleebix@gmail.com>
Date: Tue, 18 Nov 2014 20:50:00 -0800
Subject: [PATCH 0125/3333] Return mysql-server to default for all ubuntu
 installs

Change: I97cbede806e5c00363c7174fa1e9f286de96aab6 altered
the logic in lib/databases/mysql from installing mariadb only if
one was using rhel7 to installing it by default unless one was using
rhel6.

Change: Iae9a7a1c09f1fc83573c3926b3470955c244c401
Attempted to fix this, but only does so for precise.

Unless mariadb has become the default, I strongly prefer to keep
standard mysql as the database on ubuntu (precise or otherwise).

Closes-Bug: 1395776

Change-Id: I3afb89ae6d55405313b7219dd6daa24d9ca80f70
---
 lib/databases/mysql | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index bbf2fd0861..eab1aa400f 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -141,12 +141,14 @@ EOF
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
-    if is_ubuntu || is_fedora; then
-        if [[ $DISTRO =~ (rhel6|precise) ]]; then
+    if is_fedora; then
+        if [[ $DISTRO =~ (rhel6) ]]; then
             install_package mysql-server
         else
             install_package mariadb-server
         fi
+    elif is_ubuntu; then
+        install_package mysql-server
     elif is_suse; then
         if ! is_package_installed mariadb; then
             install_package mysql-community-server

From 7f8a27da52e9564c0d6ff477eedb2bafb6864179 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Mon, 24 Nov 2014 11:12:20 -0800
Subject: [PATCH 0126/3333] IPA Ramdisk should log to console in devstack

Setting these kernel command line parameters will have journald log
everything to the console, which means it'll end up in the appropriate
log in the ironic-bm-logs/ directory.

Change-Id: I0f4c79436c4856a5aa72f00f1ac8c2ed534b702e
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index f2b1fb2f6a..3742d27d18 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -326,7 +326,7 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
         iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
         if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-            iniset $IRONIC_CONF_FILE agent agent_pxe_append_params "nofb nomodeset vga=normal console=ttyS0"
+            iniset $IRONIC_CONF_FILE agent agent_pxe_append_params "nofb nomodeset vga=normal console=ttyS0 systemd.journald.forward_to_console=yes"
         fi
     fi
 

From 55c7ebbdbaf97c8f1f22d8a06579edf836b503c6 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Tue, 25 Nov 2014 12:08:55 +1000
Subject: [PATCH 0127/3333] Use new cafile option in nova cinder options

ca_certificate_file is deprecated in favour of using the standard
options from keystoneclient session.

Change-Id: I611da719fb3a95d0a9c2f6ad43e2c083ea7d6862
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 78906f7210..32ab567023 100644
--- a/lib/nova
+++ b/lib/nova
@@ -459,7 +459,7 @@ function create_nova_conf {
             CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
             CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
             iniset $NOVA_CONF cinder endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
-            iniset $NOVA_CONF cinder ca_certificates_file $SSL_BUNDLE_FILE
+            iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
         fi
     fi
 

From d7af4843382d0f281a35e3769109da7beda1dfc5 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Tue, 25 Nov 2014 12:10:07 +1000
Subject: [PATCH 0128/3333] Use the service catalog when talking to cinder

The cinder endpoints should be correctly established in the service
catalog. There is no reason to provide an overriding endpoint_template.

Change-Id: I9b206fa22a8271a0fb65789d139ead35dfb1ea0d
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 32ab567023..2ebba40cfb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -458,7 +458,6 @@ function create_nova_conf {
         if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
             CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
             CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
-            iniset $NOVA_CONF cinder endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
             iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
         fi
     fi

From ff8de0c707a779bcd329b3bb513c5fea806bcbea Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Thu, 13 Nov 2014 07:57:09 +0000
Subject: [PATCH 0129/3333] Update the ODL support to Helium SR1.

This commit updates the default ODL package to be tested with to the
first stable release of Helium. Critically, this includes ODL fixes
for some IPV6 issues.

Change-Id: I4eaa52a8baffdcc3a5e74cabca2f9cd7ea4ec237
---
 lib/opendaylight | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/opendaylight b/lib/opendaylight
index bdebe5846d..831329a750 100644
--- a/lib/opendaylight
+++ b/lib/opendaylight
@@ -45,16 +45,16 @@ ODL_USERNAME=${ODL_USERNAME:-admin}
 ODL_PASSWORD=${ODL_PASSWORD:-admin}
 
 # Short name of ODL package
-ODL_NAME=${ODL_NAME:-distribution-karaf-0.2.0-Helium}
+ODL_NAME=${ODL_NAME:-distribution-karaf-0.2.1-Helium-SR1}
 
 # <define global variables here that belong to this project>
 ODL_DIR=$DEST/opendaylight
 
 # The OpenDaylight Package, currently using 'Hydrogen' release
-ODL_PKG=${ODL_PKG:-distribution-karaf-0.2.0-Helium.zip}
+ODL_PKG=${ODL_PKG:-distribution-karaf-0.2.1-Helium-SR1.zip}
 
 # The OpenDaylight URL
-ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/groups/public/org/opendaylight/integration/distribution-karaf/0.2.0-Helium}
+ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/repositories/public/org/opendaylight/integration/distribution-karaf/0.2.1-Helium-SR1/}
 
 # Default arguments for OpenDaylight. This is typically used to set
 # Java memory options.

From b01fb940c93dfa3ae75b11e34b8a99e6906c8a25 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Wed, 1 Oct 2014 13:20:50 -0400
Subject: [PATCH 0130/3333] Ceph: undefine secret from nova.conf when deleting
 secret

At teardown time we delete the libvirt secret but leave
nova.conf referencing the stale UUID.  Remove it to make
debugging and repeated runs less error-prone.

Additionally, only try to delete secret if it Cinder is
enabled (causing it to be defined when deploying devstack).

Change-Id: Id5e1290b8dcfd79238f02e31084ab12c3d6aed5f
---
 lib/ceph | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index 2ddf5dbb6a..521430626b 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -106,8 +106,13 @@ function cleanup_ceph {
         sudo rm -f ${CEPH_DISK_IMAGE}
     fi
     uninstall_package ceph ceph-common python-ceph libcephfs1 > /dev/null 2>&1
-    VIRSH_UUID=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
-    sudo virsh secret-undefine ${VIRSH_UUID} >/dev/null 2>&1
+    if is_service_enabled cinder || is_service_enabled nova; then
+        local virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
+        sudo virsh secret-undefine ${virsh_uuid} >/dev/null 2>&1
+    fi
+    if is_service_enabled nova; then
+        iniset $NOVA_CONF libvirt rbd_secret_uuid ""
+    fi
 }
 
 # configure_ceph() - Set config files, create data dirs, etc

From 9eb8177eb7afa1e1cc9c64f80d175a1cb658ea50 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Fri, 21 Nov 2014 09:41:45 -0800
Subject: [PATCH 0131/3333] Move sgabios setup to hypervisor-ironic

This moves setup of sgabios ROM to the ironic hypervisor library.
This is failing to backport to juno because of an error in the sideways ironic
grenade. install_ironic() is expected to setup only python things and happens
earlier than initial package installation.

Fixes-bug: #1396352
Change-Id: I75f0052045143571619e6712d57014228abf7a20
---
 lib/ironic                         | 8 --------
 lib/nova_plugins/hypervisor-ironic | 7 +++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index f2b1fb2f6a..fc4b162036 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -171,14 +171,6 @@ function install_ironic {
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
         install_apache_wsgi
     fi
-
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] && is_ubuntu; then
-        # Ubuntu packaging+apparmor issue prevents libvirt from loading
-        # the ROM from /usr/share/misc.  Workaround by installing it directly
-        # to a directory that it can read from. (LP: #1393548)
-        sudo rm -rf /usr/share/qemu/sgabios.bin
-        sudo cp /usr/share/misc/sgabios.bin /usr/share/qemu/sgabios.bin
-    fi
 }
 
 # install_ironicclient() - Collect sources and prepare
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 420950328e..abf59b8008 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -56,6 +56,13 @@ function install_nova_hypervisor {
         die $LINENO "Neutron should be enabled for usage of the Ironic Nova driver."
     fi
     install_libvirt
+    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] && is_ubuntu; then
+        # Ubuntu packaging+apparmor issue prevents libvirt from loading
+        # the ROM from /usr/share/misc.  Workaround by installing it directly
+        # to a directory that it can read from. (LP: #1393548)
+        sudo rm -rf /usr/share/qemu/sgabios.bin
+        sudo cp /usr/share/misc/sgabios.bin /usr/share/qemu/sgabios.bin
+    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From ea70cc94719b140f90fb3a3d86e37bd543146ee3 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Tue, 25 Nov 2014 19:07:11 -0800
Subject: [PATCH 0132/3333] Copy nova-api-paste.ini if n-api* is enabled

In multi node devstack using multi-host nova-networking, n-api-meta runs
on every machine but n-api only runs on the API node. So copy
nova-api-paste.ini if any version of n-api* is running.

Change-Id: I323f39f5080b94e22907a173a1a2bc4a324567b8
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 78906f7210..9a8614b47a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -257,7 +257,7 @@ function configure_nova {
 
     configure_nova_rootwrap
 
-    if is_service_enabled n-api; then
+    if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
         # Remove legacy paste config if present
         rm -f $NOVA_DIR/bin/nova-api-paste.ini
 

From a3d60c80d9f39ee6a0410dcdd5c778d0b7511c9d Mon Sep 17 00:00:00 2001
From: Julie Pichon <jpichon@redhat.com>
Date: Fri, 21 Nov 2014 14:57:16 +0000
Subject: [PATCH 0133/3333] Explicitly pass in SLAPPASS when setting up LDAP

Change-Id: Ibcceabf2c76aaeeb8902a670557cc0093943a3e4
Closes-Bug: #1373750
---
 lib/ldap | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/ldap b/lib/ldap
index a6fb82f6f2..2a3ba64efb 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -51,9 +51,10 @@ fi
 # _ldap_varsubst file
 function _ldap_varsubst {
     local infile=$1
+    local slappass=$2
     sed -e "
         s|\${LDAP_OLCDB_NUMBER}|$LDAP_OLCDB_NUMBER|
-        s|\${SLAPPASS}|$SLAPPASS|
+        s|\${SLAPPASS}|$slappass|
         s|\${LDAP_ROOTPW_COMMAND}|$LDAP_ROOTPW_COMMAND|
         s|\${BASE_DC}|$LDAP_BASE_DC|
         s|\${BASE_DN}|$LDAP_BASE_DN|
@@ -130,7 +131,7 @@ function install_ldap {
     printf "LDAP secret is $slappass\n"
 
     # Create manager.ldif and add to olcdb
-    _ldap_varsubst $FILES/ldap/manager.ldif.in >$tmp_ldap_dir/manager.ldif
+    _ldap_varsubst $FILES/ldap/manager.ldif.in $slappass >$tmp_ldap_dir/manager.ldif
     sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f $tmp_ldap_dir/manager.ldif
 
     # On fedora we need to manually add cosine and inetorgperson schemas

From 19354585e16513f5ee590c90620b7fae603b6a78 Mon Sep 17 00:00:00 2001
From: Evgeny Antyshev <eantyshev@parallels.com>
Date: Mon, 24 Nov 2014 14:20:35 +0400
Subject: [PATCH 0134/3333] libvirt plugin "parallels" support

We're in the process of establishing the CI testing with
Parallels Cloud Server plugin for libvirt.
Currently we use local clone of devstack in our infrastructure,
but we want to switch to upstream

requires extra customization of nova.conf and glance-api.conf:
nova.conf should have "images_type" and "connection_uri"
defined, and glance-api.conf to have "ploop" in disk formats

Implements: blueprint pcs-support
Change-Id: I0b073359fda8b4531cae7b8946eb52a561c82857
---
 lib/glance                          | 3 +++
 lib/nova_plugins/hypervisor-libvirt | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/lib/glance b/lib/glance
index b4c18f8ac7..0970f9483a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -129,6 +129,9 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
+    if [ "$VIRT_DRIVER" = 'libvirt' ] && [ "$LIBVIRT_TYPE" = 'parallels' ]; then
+        iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
+    fi
 
     # Store specific configs
     iniset $GLANCE_API_CONF DEFAULT filesystem_store_datadir $GLANCE_IMAGE_DIR/
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 53dbfb976f..123ca82048 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -64,6 +64,11 @@ function configure_nova_hypervisor {
         # disable it here for now to avoid surprises later.
         iniset $NOVA_CONF libvirt inject_partition '-2'
     fi
+
+    if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
+        iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
+        iniset $NOVA_CONF libvirt images_type "ploop"
+    fi
 }
 
 # install_nova_hypervisor() - Install external components

From f10c81869e27f215092c98af5d5b7c19bd64a8c9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 27 Nov 2014 07:13:35 -0500
Subject: [PATCH 0135/3333] drop tempest xml variable setting

tempest has dropped xml support, this variable no longer does
anything.

Change-Id: Iab4dbb88f6f01fe301fd54b3ac53995bed1c485a
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 6bcfaec84b..46c9e26916 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -304,7 +304,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions ${COMPUTE_API_EXTENSIONS:-"all"}
-    iniset $TEMPEST_CONFIG compute-feature-enabled xml_api_v2 ${TEMPEST_ENABLE_NOVA_XML_API:-True}
     iniset $TEMPEST_CONFIG compute-feature-disabled api_extensions ${DISABLE_COMPUTE_API_EXTENSIONS}
 
     # Compute admin

From fe6dccb0a8b1ca05e73982f0aba647044bf79a2d Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio Robles <juan.osorio.robles@ericsson.com>
Date: Fri, 28 Nov 2014 13:12:14 +0200
Subject: [PATCH 0136/3333] Fix typos in the configuration documentation

Change-Id: I0089c195f4cda313c3b68a7c5c215b9dbff94db2
---
 doc/source/configuration.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 5157622441..baebe979b0 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -92,7 +92,7 @@ added:
     [[post-config|/$Q_PLUGIN_CONF_FILE]]
 
 Also note that the ``localrc`` section is sourced as a shell script
-fragment amd MUST conform to the shell requirements, specifically no
+fragment and MUST conform to the shell requirements, specifically no
 whitespace around ``=`` (equals).
 
 Minimal Configuration
@@ -131,7 +131,7 @@ used for both the local networking and Nova's fixed and floating ranges.
 
 ``HOST_IP`` is normally detected on the first run of ``stack.sh`` but
 often is indeterminate on later runs due to the IP being moved from an
-Ethernet integace to a bridge on the host. Setting it here also makes it
+Ethernet interface to a bridge on the host. Setting it here also makes it
 available for ``openrc`` to set ``OS_AUTH_URL``. ``HOST_IP`` is not set
 by default.
 
@@ -208,7 +208,7 @@ Logging the Screen Output
        which is useful for watching log and debug output. However, in
        automated testing the interactive ``screen`` sessions may not be
        available after the fact; setting ``SCREEN_LOGDIR`` enables logging
-       of the ``screen`` sessions in the specified diretory. There will be
+       of the ``screen`` sessions in the specified directory. There will be
        one file per ``screen`` session named for the session name and a
        timestamp.
     |

From b7c1ce4d0f40cb24c78d6a14bb092b57ee12be03 Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio Robles <juan.osorio.robles@ericsson.com>
Date: Fri, 28 Nov 2014 14:19:19 +0200
Subject: [PATCH 0137/3333] Fix path to network interfaces configurations

This commit changes the path that is used as reference in the
documentation to one that is widely used in both ubuntu and debian. This
was made in order to avoid confusions (that actually happened while I
was trying out the devstack guide).

Change-Id: Ic3ce40816f79f9f522fc33ed8b4a574d7a57d586
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 59b7a9d55b..dc2fc71617 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -23,7 +23,7 @@ the machine.
 
 eth1 is manually configured at boot to not have an IP address.
 Consult your operating system documentation for the appropriate
-technique. For Ubuntu, the contents of `/etc/networking/interfaces`
+technique. For Ubuntu, the contents of `/etc/network/interfaces`
 contains:
 
 ::

From 5a252d9a0e860e27676b60851766728451c29c17 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <igawa@mxs.nes.nec.co.jp>
Date: Fri, 21 Nov 2014 21:55:09 +0900
Subject: [PATCH 0138/3333] Fix variable typo of use_syslog in lib/tempest

TEMPEST_CONF is not set but used it. As a result the meaningless file
'DEFAULT' is created. So this commit fixes to use proper variable name.

Closes-bug: #1394969
Change-Id: If6e58f269319df3c4f71b4fc13aa855c63f7e3a3
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d3fb9fb2dc..399e8e6c22 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -247,7 +247,7 @@ function configure_tempest {
         fi
     fi
 
-    iniset $TEMPEST_CONF DEFAULT use_syslog $SYSLOG
+    iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
     # Oslo
     iniset $TEMPEST_CONFIG DEFAULT lock_path $TEMPEST_STATE_PATH
     mkdir -p $TEMPEST_STATE_PATH

From c78e4671098f08c2eaf0b033777d3c01082141cd Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Mon, 1 Dec 2014 11:24:37 -0800
Subject: [PATCH 0139/3333] Wait for hypervisor-stats to reflect ironic nodes

When enrolling nodes into Ironic, poll nova's hypervisor-stats until
the hypervisor count reflects the number of enrolled nodes.  This
eliminates a race where devstack completes and an instance is spawned
before the first post-enrollment periodic task ticks on the Nova side,
which has recently started popping up in the gate.

Change-Id: Ib3d8005e0094ee8af2d5fcb65aca6cd92736da90
Closes-bug: #1398128
---
 lib/ironic | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 622c18937f..28f8fe87e5 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -500,9 +500,23 @@ function create_bridge_and_vms {
     create_ovs_taps
 }
 
+function wait_for_nova_resources {
+    # After nodes have been enrolled, we need to wait for n-cpu's periodic
+    # task populate the resource tracker with available nodes.  Wait for 2
+    # minutes before timing out.
+    local expected_count=$1
+    echo_summary "Waiting 2 minutes for Nova resource tracker to pick up $expected_count Ironic nodes"
+    for i in $(seq 1 120); do
+        if [ $(nova hypervisor-stats | grep " count " | get_field 2) -ge $expected_count ]; then
+            return 0
+        fi
+        sleep 1
+    done
+    die $LINENO "Nova hypervisor-stats did not register at least $expected_count nodes"
+}
+
 function enroll_nodes {
     local chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
-    local idx=0
 
     if [[ "$IRONIC_DEPLOY_DRIVER" == "pxe_ssh" ]] ; then
         local _IRONIC_DEPLOY_KERNEL_KEY=pxe_deploy_kernel
@@ -536,6 +550,7 @@ function enroll_nodes {
         fi
     fi
 
+    local total_nodes=0
     while read hardware_info; do
         if ! is_ironic_hardware; then
             local mac_address=$hardware_info
@@ -566,7 +581,7 @@ function enroll_nodes {
 
         ironic port-create --address $mac_address --node_uuid $node_id
 
-        idx=$((idx+1))
+        total_nodes=$((total_nodes+1))
     done < $ironic_hwinfo_file
 
     # create the nova flavor
@@ -581,6 +596,10 @@ function enroll_nodes {
     # from the flavor after the completion of
     # https://blueprints.launchpad.net/ironic/+spec/add-node-instance-info
     nova flavor-key baremetal set "cpu_arch"="x86_64" "baremetal:deploy_kernel_id"="$IRONIC_DEPLOY_KERNEL_ID" "baremetal:deploy_ramdisk_id"="$IRONIC_DEPLOY_RAMDISK_ID"
+
+    if [ "$VIRT_DRIVER" == "ironic" ]; then
+        wait_for_nova_resources $total_nodes
+    fi
 }
 
 function configure_iptables {

From 505b96afbe8f910d2c0d858f1da61ed361f5f14c Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Date: Wed, 19 Nov 2014 07:00:00 +0000
Subject: [PATCH 0140/3333] Remove TEMPEST_ENABLE_NOVA_XML_API from Tempest
 config

I5b3e221d942e09134024b82acaf179dc869357e0 has removed xml_api_v2 from
Tempest config, and xml_api_v2 setting of DevStack is unnecessary now.
This patch removes it.

Change-Id: Ic85fbfda13fd352c4d513859915aaca27e894b58
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 6bcfaec84b..46c9e26916 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -304,7 +304,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions ${COMPUTE_API_EXTENSIONS:-"all"}
-    iniset $TEMPEST_CONFIG compute-feature-enabled xml_api_v2 ${TEMPEST_ENABLE_NOVA_XML_API:-True}
     iniset $TEMPEST_CONFIG compute-feature-disabled api_extensions ${DISABLE_COMPUTE_API_EXTENSIONS}
 
     # Compute admin

From 6623049ec48058afcb207855a9754df197a8cbb6 Mon Sep 17 00:00:00 2001
From: Jiri Tomasek <jtomasek@redhat.com>
Date: Tue, 2 Dec 2014 13:23:19 +0100
Subject: [PATCH 0141/3333] Horizon front page test fix

Fixes the test string in horizon front page test so it is not failing
when header tag gets new attributes

Change-Id: Ibf62bf6f6300eeb0ab2f22086b0ff1c05c69d86b
---
 exercises/horizon.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/exercises/horizon.sh b/exercises/horizon.sh
index d62ad52123..ad08221690 100755
--- a/exercises/horizon.sh
+++ b/exercises/horizon.sh
@@ -36,7 +36,7 @@ source $TOP_DIR/exerciserc
 is_service_enabled horizon || exit 55
 
 # can we get the front page
-curl http://$SERVICE_HOST 2>/dev/null | grep -q '<h3>Log In</h3>' || die $LINENO "Horizon front page not functioning!"
+curl http://$SERVICE_HOST 2>/dev/null | grep -q '<h3.*>Log In</h3>' || die $LINENO "Horizon front page not functioning!"
 
 set +o xtrace
 echo "*********************************************************************"

From bfadd227ecd593d1aa151246fdc18952fcbe9d37 Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Wed, 3 Dec 2014 23:15:08 +0000
Subject: [PATCH 0142/3333] heat remove copy of sample config file

We're moving to a model like nova where we don't maintain a static
sample config, instead providing a readme showing how to generate
it in https://review.openstack.org/#/c/138800/, so this change
is needed before we can land that change.

Change-Id: I335a33646eef72962c9036dcd1de50144d8575c8
---
 lib/heat | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/heat b/lib/heat
index 2b55cf0f6a..3ed9a5ff41 100644
--- a/lib/heat
+++ b/lib/heat
@@ -94,7 +94,6 @@ function configure_heat {
 
     cp $HEAT_DIR/etc/heat/api-paste.ini $HEAT_API_PASTE_FILE
     cp $HEAT_DIR/etc/heat/policy.json $HEAT_POLICY_FILE
-    cp $HEAT_DIR/etc/heat/heat.conf.sample $HEAT_CONF
 
     # common options
     iniset_rpc_backend heat $HEAT_CONF DEFAULT

From 8b469c1c5e36047a9e5a80e040f137957bdb8d66 Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Thu, 4 Dec 2014 10:43:52 +0000
Subject: [PATCH 0143/3333] Remove heat_stack_owner role

Since https://review.openstack.org/#/c/128509/ heat no longer requires
the "heat_stack_owner" role by default, as we now delegate all roles
via the trust.  So remove the now unnecessary role creation and assignment
from lib/heat.

Change-Id: Ia097ac9a76b3242ed6e62b11ca64c7ac7680b97c
---
 lib/heat | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/lib/heat b/lib/heat
index 2b55cf0f6a..74163bdc31 100644
--- a/lib/heat
+++ b/lib/heat
@@ -252,17 +252,6 @@ function create_heat_accounts {
     get_or_create_role "heat_stack_user"
 
     if [[ $HEAT_DEFERRED_AUTH == trusts ]]; then
-
-        # heat_stack_owner role is given to users who create Heat stacks,
-        # it's the default role used by heat to delegate to the heat service
-        # user (for performing deferred operations via trusts), see heat.conf
-        local heat_owner_role=$(get_or_create_role "heat_stack_owner")
-
-        # Give the role to the demo and admin users so they can create stacks
-        # in either of the projects created by devstack
-        get_or_add_user_role $heat_owner_role demo demo
-        get_or_add_user_role $heat_owner_role admin demo
-        get_or_add_user_role $heat_owner_role admin admin
         iniset $HEAT_CONF DEFAULT deferred_auth_method trusts
     fi
 

From ffc1f8d426573f78e3a4bb88bd0246b59694bdcc Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Wed, 26 Nov 2014 04:00:33 -0800
Subject: [PATCH 0144/3333] Fix tools upload_image.sh utility

The utility would fail due to the fact that the GLANCE_SERVICE_PROTOCOL
was not set.

Change-Id: Iff0b59274fa909895abd70c3a6d1da63dbd70483
Closes-bug: #1396567
---
 tools/upload_image.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/upload_image.sh b/tools/upload_image.sh
index d81a5c8dab..5d23f31b9c 100755
--- a/tools/upload_image.sh
+++ b/tools/upload_image.sh
@@ -37,6 +37,7 @@ die_if_not_set $LINENO TOKEN "Keystone fail to get token"
 
 # Glance connection info.  Note the port must be specified.
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_HOST:9292}
+GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 for IMAGE in "$*"; do
     upload_image $IMAGE $TOKEN

From 82a7d939290ec7224f1e918a35e8c5ad0c18cb31 Mon Sep 17 00:00:00 2001
From: JordanP <jordan.pittier@scality.com>
Date: Thu, 4 Dec 2014 14:09:16 +0100
Subject: [PATCH 0145/3333] Fixes lib/tempest to accomodate Storage Protocol
 name with spaces

Change-Id: Ic711b2bb69f78b10ff6cb48e670df2d35646d8e9
Closes-Bug: #1278835
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6bcfaec84b..8c5da5ea8d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -390,8 +390,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume vendor_name "$TEMPEST_VOLUME_VENDOR"
     fi
     if [ $TEMPEST_VOLUME_DRIVER != "default" -o \
-        $TEMPEST_STORAGE_PROTOCOL != $TEMPEST_DEFAULT_STORAGE_PROTOCOL ]; then
-        iniset $TEMPEST_CONFIG volume storage_protocol $TEMPEST_STORAGE_PROTOCOL
+        "$TEMPEST_STORAGE_PROTOCOL" != "$TEMPEST_DEFAULT_STORAGE_PROTOCOL" ]; then
+        iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
     # Dashboard

From 5bef3e1633ec2c7e2b932f6d519baa23526f5f87 Mon Sep 17 00:00:00 2001
From: Victoria Martinez de la Cruz <victoria@vmartinezdelacruz.com>
Date: Thu, 4 Dec 2014 10:24:37 -0300
Subject: [PATCH 0146/3333] Enable Zaqar to run in debug mode

Change-Id: Ia751f04119ce1b4c6213be75d087ef24de904498
---
 lib/zaqar | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/zaqar b/lib/zaqar
index 3b0452940f..22ef5ef20f 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -111,6 +111,7 @@ function configure_zaqar {
     [ ! -d $ZAQAR_API_LOG_DIR ] &&  sudo mkdir -m 755 -p $ZAQAR_API_LOG_DIR
     sudo chown $USER $ZAQAR_API_LOG_DIR
 
+    iniset $ZAQAR_CONF DEFAULT debug True
     iniset $ZAQAR_CONF DEFAULT verbose True
     iniset $ZAQAR_CONF DEFAULT admin_mode True
     iniset $ZAQAR_CONF DEFAULT use_syslog $SYSLOG

From 0f176d8bc2010920842e1e6c1422aba05b9b5eb4 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Date: Wed, 3 Dec 2014 01:24:47 +0000
Subject: [PATCH 0147/3333] Add NOVA_API_VERSIONS

This provides a mechanism for overriding v2 endpoint with v2.1 so that
tests can be run against a devstack to provide equivalency between the
APIs.

Change-Id: Iaaa530bda6bcdae75e86be8dbe572abe4396e8e9
---
 lib/nova | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/nova b/lib/nova
index d5fe7ac48e..5db2f8fcd3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -45,6 +45,12 @@ NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
+# NOVA_API_VERSIONS valid options
+#   - default - setup API end points as nova does out of the box
+#   - v21default - make v21 the default on /v2
+# NOTE(sdague): this is for transitional testing of the Nova v21 API.
+# Expect to remove in L or M.
+NOVA_API_VERSIONS=${NOVA_API_VERSIONS:-default}
 
 if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
@@ -263,6 +269,11 @@ function configure_nova {
 
         # Get the sample configuration file in place
         cp $NOVA_DIR/etc/nova/api-paste.ini $NOVA_CONF_DIR
+
+        # For testing v21 is equivalent to v2
+        if [[ "$NOVA_API_VERSION" == "v21default" ]]; then
+            sed -i s/": openstack_compute_api_v2$"/": openstack_compute_api_v21"/ "$NOVA_API_PASTE_INI"
+        fi
     fi
 
     if is_service_enabled n-cpu; then

From c30d3213f8fc683523267574676fa5062c2c36de Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 Dec 2014 07:20:03 -0500
Subject: [PATCH 0148/3333] remove legacy work around for nova paste.ini

This code goes *way* back and is not needed any more

Change-Id: I23716d88899a7fc18b7d4ccfa12b563d288810b0
---
 lib/nova | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5db2f8fcd3..cdf43c4db3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -264,9 +264,6 @@ function configure_nova {
     configure_nova_rootwrap
 
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
-        # Remove legacy paste config if present
-        rm -f $NOVA_DIR/bin/nova-api-paste.ini
-
         # Get the sample configuration file in place
         cp $NOVA_DIR/etc/nova/api-paste.ini $NOVA_CONF_DIR
 

From a883698ca79a29c37a8c5a2f61966efb589f2697 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Date: Thu, 4 Dec 2014 23:08:10 +0000
Subject: [PATCH 0149/3333] Fix NOVA_API_VERSION option

lib/nova checks NOVA_API_VERSION for setting Nova v2.1 API endpoint,
but the name of the initialization is different.
This patch fixes it.

Change-Id: I2fa234d66fe76b2a7146288adc1384b33921e178
---
 lib/nova | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5db2f8fcd3..ec2d0bf29c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -45,12 +45,12 @@ NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
-# NOVA_API_VERSIONS valid options
+# NOVA_API_VERSION valid options
 #   - default - setup API end points as nova does out of the box
 #   - v21default - make v21 the default on /v2
 # NOTE(sdague): this is for transitional testing of the Nova v21 API.
 # Expect to remove in L or M.
-NOVA_API_VERSIONS=${NOVA_API_VERSIONS:-default}
+NOVA_API_VERSION=${NOVA_API_VERSION-default}
 
 if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"

From 9bc3459927ea48b2633b4a8c4a247764d6d4b8bd Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Tue, 2 Dec 2014 16:49:14 -0800
Subject: [PATCH 0150/3333] Tighten up parsing of neutron tap device for ironic

The current parsing of the interfaces from the neutron network namespace
fails if there are other things that match 'tap' (ie, gretaps created
for other purposes)  This tightens up the parsing to only match devices
starting 'tap' instead of anything containing 'tap'

Change-Id: I9a31ec8ad253da0b3c5bd7f5eb105c49850f3060
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 28f8fe87e5..0e72f6e331 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -460,7 +460,7 @@ function create_ovs_taps {
     # intentional sleep to make sure the tag has been set to port
     sleep 10
 
-    local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep tap | cut -d':' -f2 | cut -b2-)
+    local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -b2-)
     local tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
 
     # make sure veth pair is not existing, otherwise delete its links

From 6c74932bf7f02ddd5bad7c276bca68b58e5b745d Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Tue, 2 Dec 2014 16:20:50 -0800
Subject: [PATCH 0151/3333] Do not regenerate ironic ssh key if one exists

Gets rid of redundant globals and avoids regenerating an ssh key
for ironic if one exists.  Also allows key file to be user-specified,
letting ironic use pregenerated keys.

Change-Id: Iaa6f8918bf14dae2116269a0be5039fc5afaecfa
---
 lib/ironic | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 0e72f6e331..0a0e8b8bcd 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -60,7 +60,7 @@ IRONIC_ENABLED_DRIVERS=${IRONIC_ENABLED_DRIVERS:-fake,pxe_ssh,pxe_ipmitool}
 IRONIC_SSH_USERNAME=${IRONIC_SSH_USERNAME:-`whoami`}
 IRONIC_SSH_KEY_DIR=${IRONIC_SSH_KEY_DIR:-$IRONIC_DATA_DIR/ssh_keys}
 IRONIC_SSH_KEY_FILENAME=${IRONIC_SSH_KEY_FILENAME:-ironic_key}
-IRONIC_KEY_FILE=$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME
+IRONIC_KEY_FILE=${IRONIC_KEY_FILE:-$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME}
 IRONIC_SSH_VIRT_TYPE=${IRONIC_SSH_VIRT_TYPE:-virsh}
 IRONIC_TFTPBOOT_DIR=${IRONIC_TFTPBOOT_DIR:-$IRONIC_DATA_DIR/tftpboot}
 IRONIC_TFTPSERVER_IP=${IRONIC_TFTPSERVER_IP:-$HOST_IP}
@@ -632,15 +632,16 @@ function configure_tftpd {
 }
 
 function configure_ironic_ssh_keypair {
-    # Generating ssh key pair for stack user
-    if [[ ! -d $IRONIC_SSH_KEY_DIR ]]; then
-        mkdir -p $IRONIC_SSH_KEY_DIR
-    fi
     if [[ ! -d $HOME/.ssh ]]; then
         mkdir -p $HOME/.ssh
         chmod 700 $HOME/.ssh
     fi
-    echo -e 'n\n' | ssh-keygen -q -t rsa -P '' -f $IRONIC_KEY_FILE
+    if [[ ! -e $IRONIC_KEY_FILE ]]; then
+        if [[ ! -d $(dirname $IRONIC_KEY_FILE) ]]; then
+            mkdir -p $(dirname $IRONIC_KEY_FILE)
+        fi
+        echo -e 'n\n' | ssh-keygen -q -t rsa -P '' -f $IRONIC_KEY_FILE
+    fi
     cat $IRONIC_KEY_FILE.pub | tee -a $IRONIC_AUTHORIZED_KEYS_FILE
 }
 
@@ -657,7 +658,7 @@ function ironic_ssh_check {
 
 function configure_ironic_auxiliary {
     configure_ironic_ssh_keypair
-    ironic_ssh_check $IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME $IRONIC_VM_SSH_ADDRESS $IRONIC_VM_SSH_PORT $IRONIC_SSH_USERNAME 10
+    ironic_ssh_check $IRONIC_KEY_FILE $IRONIC_VM_SSH_ADDRESS $IRONIC_VM_SSH_PORT $IRONIC_SSH_USERNAME 10
 }
 
 function build_ipa_coreos_ramdisk {

From 88cde0b3da7102cd28b3b44fbf6112b17303b27d Mon Sep 17 00:00:00 2001
From: Sabari Kumar Murugesan <smurugesan@vmware.com>
Date: Thu, 4 Dec 2014 17:48:26 -0800
Subject: [PATCH 0152/3333] VMware: add default image metadata for hw_vif_model

During glance image-create we are currently setting a null value
for the hw_vif_model, if we are unable to introspect from the vmdk
file.

This patch adds a default value if not found.

Change-Id: I6d0f551b18f03e2a799ae14c3347652a285693f0
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index bb40a481bd..f31a59afac 100644
--- a/functions
+++ b/functions
@@ -82,7 +82,7 @@ function upload_image {
         # driver will supply default values.
 
         local vmdk_disktype=""
-        local vmdk_net_adapter=""
+        local vmdk_net_adapter="e1000"
         local path_len
 
         # vmdk adapter type

From 2f8e08b5728f4272b415b1c0aab8ff62eae29b06 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 5 Dec 2014 08:31:16 -0500
Subject: [PATCH 0153/3333] remove nova baremetal driver support

This has been deleted from the nova tree, we should purge it from
devstack, as it will not work any more.

Change-Id: I20501fec140998b91c9ddfd84b7b10168624430a
---
 clean.sh                              |   1 -
 doc/source/index.rst                  |   1 -
 lib/baremetal                         | 439 --------------------------
 lib/neutron                           |  20 +-
 lib/nova                              |   6 -
 lib/nova_plugins/hypervisor-baremetal |  87 -----
 stack.sh                              |  63 +---
 stackrc                               |   4 +-
 unstack.sh                            |   1 -
 9 files changed, 11 insertions(+), 611 deletions(-)
 delete mode 100644 lib/baremetal
 delete mode 100644 lib/nova_plugins/hypervisor-baremetal

diff --git a/clean.sh b/clean.sh
index db1a1e4637..f2f13389c8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -50,7 +50,6 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/baremetal
 source $TOP_DIR/lib/ironic
 source $TOP_DIR/lib/trove
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index a917ac341d..7188f6ecf4 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -139,7 +139,6 @@ Scripts
 * `functions <functions.html>`__ - DevStack-specific functions
 * `functions-common <functions-common.html>`__ - Functions shared with other projects
 * `lib/apache <lib/apache.html>`__
-* `lib/baremetal <lib/baremetal.html>`__
 * `lib/ceilometer <lib/ceilometer.html>`__
 * `lib/ceph <lib/ceph.html>`__
 * `lib/cinder <lib/cinder.html>`__
diff --git a/lib/baremetal b/lib/baremetal
deleted file mode 100644
index af90c06360..0000000000
--- a/lib/baremetal
+++ /dev/null
@@ -1,439 +0,0 @@
-## vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-## Copyright (c) 2012 Hewlett-Packard Development Company, L.P.
-## All Rights Reserved.
-##
-##    Licensed under the Apache License, Version 2.0 (the "License"); you may
-##    not use this file except in compliance with the License. You may obtain
-##    a copy of the License at
-##
-##         http://www.apache.org/licenses/LICENSE-2.0
-##
-##    Unless required by applicable law or agreed to in writing, software
-##    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-##    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-##    License for the specific language governing permissions and limitations
-##    under the License.
-
-
-# This file provides devstack with the environment and utilities to
-# control nova-compute's baremetal driver.
-# It sets reasonable defaults to run within a single host,
-# using virtual machines in place of physical hardware.
-# However, by changing just a few options, devstack+baremetal can in fact
-# control physical hardware resources on the same network, if you know
-# the MAC address(es) and IPMI credentials.
-#
-# At a minimum, to enable the baremetal driver, you must set these in localrc:
-#
-#    VIRT_DRIVER=baremetal
-#    ENABLED_SERVICES="$ENABLED_SERVICES,baremetal"
-#
-#
-# We utilize diskimage-builder to create a ramdisk, and then
-# baremetal driver uses that to push a disk image onto the node(s).
-#
-# Below we define various defaults which control the behavior of the
-# baremetal compute service, and inform it of the hardware it will control.
-#
-# Below that, various functions are defined, which are called by devstack
-# in the following order:
-#
-# before nova-cpu starts:
-#
-#  - prepare_baremetal_toolchain
-#  - configure_baremetal_nova_dirs
-#
-# after nova and glance have started:
-#
-#  - build_and_upload_baremetal_deploy_k_and_r $token
-#  - create_baremetal_flavor $BM_DEPLOY_KERNEL_ID $BM_DEPLOY_RAMDISK_ID
-#  - upload_baremetal_image $url $token
-#  - add_baremetal_node <first_mac> <second_mac>
-
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Sub-driver settings
-# -------------------
-
-# sub-driver to use for kernel deployment
-#
-# - nova.virt.baremetal.pxe.PXE
-# - nova.virt.baremetal.tilera.TILERA
-BM_DRIVER=${BM_DRIVER:-nova.virt.baremetal.pxe.PXE}
-
-# sub-driver to use for remote power management
-#
-# - nova.virt.baremetal.fake.FakePowerManager, for manual power control
-# - nova.virt.baremetal.ipmi.IPMI, for remote IPMI
-# - nova.virt.baremetal.tilera_pdu.Pdu, for TilePro hardware
-BM_POWER_MANAGER=${BM_POWER_MANAGER:-nova.virt.baremetal.fake.FakePowerManager}
-
-
-# These should be customized to your environment and hardware
-# -----------------------------------------------------------
-
-# To provide PXE, configure nova-network's dnsmasq rather than run the one
-# dedicated to baremetal. When enable this, make sure these conditions are
-# fulfilled:
-#
-# 1) nova-compute and nova-network runs on the same host
-# 2) nova-network uses FlatDHCPManager
-#
-# NOTE: the other BM_DNSMASQ_* have no effect on the behavior if this option
-# is enabled.
-BM_DNSMASQ_FROM_NOVA_NETWORK=`trueorfalse False $BM_DNSMASQ_FROM_NOVA_NETWORK`
-
-# BM_DNSMASQ_IFACE should match FLAT_NETWORK_BRIDGE
-BM_DNSMASQ_IFACE=${BM_DNSMASQ_IFACE:-eth0}
-# if testing on a physical network,
-# BM_DNSMASQ_RANGE must be changed to suit your network
-BM_DNSMASQ_RANGE=${BM_DNSMASQ_RANGE:-}
-
-# BM_DNSMASQ_DNS provide dns server to bootstrap clients
-BM_DNSMASQ_DNS=${BM_DNSMASQ_DNS:-}
-
-# BM_FIRST_MAC *must* be set to the MAC address of the node you will
-# boot.  This is passed to dnsmasq along with the kernel/ramdisk to
-# deploy via PXE.
-BM_FIRST_MAC=${BM_FIRST_MAC:-}
-
-# BM_SECOND_MAC is only important if the host has >1 NIC.
-BM_SECOND_MAC=${BM_SECOND_MAC:-}
-
-# Hostname for the baremetal nova-compute node, if not run on this host
-BM_HOSTNAME=${BM_HOSTNAME:-$(hostname -f)}
-
-# BM_PM_* options are only necessary if BM_POWER_MANAGER=...IPMI
-BM_PM_ADDR=${BM_PM_ADDR:-0.0.0.0}
-BM_PM_USER=${BM_PM_USER:-user}
-BM_PM_PASS=${BM_PM_PASS:-pass}
-
-# BM_FLAVOR_* options are arbitrary and not necessarily related to
-# physical hardware capacity. These can be changed if you are testing
-# BaremetalHostManager with multiple nodes and different flavors.
-BM_CPU_ARCH=${BM_CPU_ARCH:-x86_64}
-BM_FLAVOR_CPU=${BM_FLAVOR_CPU:-1}
-BM_FLAVOR_RAM=${BM_FLAVOR_RAM:-1024}
-BM_FLAVOR_ROOT_DISK=${BM_FLAVOR_ROOT_DISK:-10}
-BM_FLAVOR_EPHEMERAL_DISK=${BM_FLAVOR_EPHEMERAL_DISK:-0}
-BM_FLAVOR_SWAP=${BM_FLAVOR_SWAP:-1}
-BM_FLAVOR_NAME=${BM_FLAVOR_NAME:-bm.small}
-BM_FLAVOR_ID=${BM_FLAVOR_ID:-11}
-BM_FLAVOR_ARCH=${BM_FLAVOR_ARCH:-$BM_CPU_ARCH}
-
-
-# Use DIB to create deploy ramdisk and kernel.
-BM_BUILD_DEPLOY_RAMDISK=`trueorfalse True $BM_BUILD_DEPLOY_RAMDISK`
-# If not use DIB, these files are used as deploy ramdisk/kernel.
-# (The value must be a relative path from $TOP_DIR/files/)
-BM_DEPLOY_RAMDISK=${BM_DEPLOY_RAMDISK:-}
-BM_DEPLOY_KERNEL=${BM_DEPLOY_KERNEL:-}
-
-# If you need to add any extra flavors to the deploy ramdisk image
-# eg, specific network drivers, specify them here
-#
-# NOTE(deva): this will be moved to lib/ironic in a future patch
-#             for now, set the default to a suitable value for Ironic's needs
-BM_DEPLOY_FLAVOR=${BM_DEPLOY_FLAVOR:--a amd64 ubuntu deploy-ironic}
-
-# set URL and version for google shell-in-a-box
-BM_SHELL_IN_A_BOX=${BM_SHELL_IN_A_BOX:-http://shellinabox.googlecode.com/files/shellinabox-2.14.tar.gz}
-
-
-# Functions
-# ---------
-
-# Check if baremetal is properly enabled
-# Returns false if VIRT_DRIVER is not baremetal, or if ENABLED_SERVICES
-# does not contain "baremetal"
-function is_baremetal {
-    if [[ "$ENABLED_SERVICES" =~ 'baremetal' && "$VIRT_DRIVER" = 'baremetal' ]]; then
-        return 0
-    fi
-    return 1
-}
-
-# Install diskimage-builder and shell-in-a-box
-# so that we can build the deployment kernel & ramdisk
-function prepare_baremetal_toolchain {
-    if [[ $(type -P ramdisk-image-create) == "" ]]; then
-        pip_install diskimage_builder
-    fi
-    local shellinabox_basename=$(basename $BM_SHELL_IN_A_BOX)
-    if [[ ! -e $DEST/$shellinabox_basename ]]; then
-        cd $DEST
-        wget $BM_SHELL_IN_A_BOX
-    fi
-    if [[ ! -d $DEST/${shellinabox_basename%%.tar.gz} ]]; then
-        cd $DEST
-        tar xzf $shellinabox_basename
-    fi
-    if [[ ! $(which shellinaboxd) ]]; then
-        cd $DEST/${shellinabox_basename%%.tar.gz}
-        ./configure
-        make
-        sudo make install
-    fi
-}
-
-# prepare various directories needed by baremetal hypervisor
-function configure_baremetal_nova_dirs {
-    # ensure /tftpboot is prepared
-    sudo mkdir -p /tftpboot
-    sudo mkdir -p /tftpboot/pxelinux.cfg
-
-    PXEBIN=/usr/share/syslinux/pxelinux.0
-    if [ ! -f $PXEBIN ]; then
-        PXEBIN=/usr/lib/syslinux/pxelinux.0
-        if [ ! -f $PXEBIN ]; then
-            die $LINENO "pxelinux.0 (from SYSLINUX) not found."
-        fi
-    fi
-
-    sudo cp $PXEBIN /tftpboot/
-    sudo chown -R $STACK_USER:$LIBVIRT_GROUP /tftpboot
-
-    # ensure $NOVA_STATE_PATH/baremetal is prepared
-    sudo mkdir -p $NOVA_STATE_PATH/baremetal
-    sudo mkdir -p $NOVA_STATE_PATH/baremetal/console
-    sudo mkdir -p $NOVA_STATE_PATH/baremetal/dnsmasq
-    sudo touch $NOVA_STATE_PATH/baremetal/dnsmasq/dnsmasq-dhcp.host
-    sudo chown -R $STACK_USER $NOVA_STATE_PATH/baremetal
-
-    # ensure dnsmasq is installed but not running
-    # because baremetal driver will reconfigure and restart this as needed
-    is_package_installed dnsmasq || install_package dnsmasq
-    stop_service dnsmasq
-}
-
-# build deploy kernel+ramdisk, then upload them to glance
-# this function sets BM_DEPLOY_KERNEL_ID and BM_DEPLOY_RAMDISK_ID
-function upload_baremetal_deploy {
-    token=$1
-
-    if [ "$BM_BUILD_DEPLOY_RAMDISK" = "True" ]; then
-        BM_DEPLOY_KERNEL=bm-deploy.kernel
-        BM_DEPLOY_RAMDISK=bm-deploy.initramfs
-        if [ ! -e "$TOP_DIR/files/$BM_DEPLOY_KERNEL" -o ! -e "$TOP_DIR/files/$BM_DEPLOY_RAMDISK" ]; then
-            ramdisk-image-create $BM_DEPLOY_FLAVOR \
-                -o $TOP_DIR/files/bm-deploy
-        fi
-    fi
-
-    # load them into glance
-    BM_DEPLOY_KERNEL_ID=$(openstack \
-        --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
-        image create \
-        $BM_DEPLOY_KERNEL \
-        --public --disk-format=aki \
-        --container-format=aki \
-        < $TOP_DIR/files/$BM_DEPLOY_KERNEL  | grep ' id ' | get_field 2)
-    BM_DEPLOY_RAMDISK_ID=$(openstack \
-        --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
-        image create \
-        $BM_DEPLOY_RAMDISK \
-        --public --disk-format=ari \
-        --container-format=ari \
-        < $TOP_DIR/files/$BM_DEPLOY_RAMDISK  | grep ' id ' | get_field 2)
-}
-
-# create a basic baremetal flavor, associated with deploy kernel & ramdisk
-#
-# Usage: create_baremetal_flavor <aki_uuid> <ari_uuid>
-function create_baremetal_flavor {
-    aki=$1
-    ari=$2
-    nova flavor-create $BM_FLAVOR_NAME $BM_FLAVOR_ID \
-        $BM_FLAVOR_RAM $BM_FLAVOR_ROOT_DISK $BM_FLAVOR_CPU
-    nova flavor-key $BM_FLAVOR_NAME set \
-        "cpu_arch"="$BM_FLAVOR_ARCH" \
-        "baremetal:deploy_kernel_id"="$aki" \
-        "baremetal:deploy_ramdisk_id"="$ari"
-
-}
-
-# Pull run-time kernel/ramdisk out of disk image and load into glance.
-# Note that $file is currently expected to be in qcow2 format.
-# Sets KERNEL_ID and RAMDISK_ID
-#
-# Usage: extract_and_upload_k_and_r_from_image $token $file
-function extract_and_upload_k_and_r_from_image {
-    token=$1
-    file=$2
-    image_name=$(basename "$file" ".qcow2")
-
-    # this call returns the file names as "$kernel,$ramdisk"
-    out=$(disk-image-get-kernel \
-            -x -d $TOP_DIR/files -o bm-deploy -i $file)
-    if [ $? -ne 0 ]; then
-        die $LINENO "Failed to get kernel and ramdisk from $file"
-    fi
-    XTRACE=$(set +o | grep xtrace)
-    set +o xtrace
-    out=$(echo "$out" | tail -1)
-    $XTRACE
-    OUT_KERNEL=${out%%,*}
-    OUT_RAMDISK=${out##*,}
-
-    # load them into glance
-    KERNEL_ID=$(openstack \
-        --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
-        image create \
-        $image_name-kernel \
-        --public --disk-format=aki \
-        --container-format=aki \
-        < $TOP_DIR/files/$OUT_KERNEL | grep ' id ' | get_field 2)
-    RAMDISK_ID=$(openstack \
-        --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
-        image create \
-        $image_name-initrd \
-        --public --disk-format=ari \
-        --container-format=ari \
-        < $TOP_DIR/files/$OUT_RAMDISK | grep ' id ' | get_field 2)
-}
-
-
-# Re-implementation of devstack's "upload_image" function
-#
-# Takes the same parameters, but has some peculiarities which made it
-# easier to create a separate method, rather than complicate the logic
-# of the existing function.
-function upload_baremetal_image {
-    local image_url=$1
-    local token=$2
-
-    # Create a directory for the downloaded image tarballs.
-    mkdir -p $FILES/images
-
-    # Downloads the image (uec ami+aki style), then extracts it.
-    IMAGE_FNAME=`basename "$image_url"`
-    if [[ ! -f $FILES/$IMAGE_FNAME || \
-        "$(stat -c "%s" $FILES/$IMAGE_FNAME)" = "0" ]]; then
-        wget -c $image_url -O $FILES/$IMAGE_FNAME
-        if [[ $? -ne 0 ]]; then
-            echo "Not found: $image_url"
-            return
-        fi
-    fi
-
-    local KERNEL=""
-    local RAMDISK=""
-    local DISK_FORMAT=""
-    local CONTAINER_FORMAT=""
-    case "$IMAGE_FNAME" in
-        *.tar.gz|*.tgz)
-            # Extract ami and aki files
-            [ "${IMAGE_FNAME%.tar.gz}" != "$IMAGE_FNAME" ] &&
-                IMAGE_NAME="${IMAGE_FNAME%.tar.gz}" ||
-                IMAGE_NAME="${IMAGE_FNAME%.tgz}"
-            xdir="$FILES/images/$IMAGE_NAME"
-            rm -Rf "$xdir";
-            mkdir "$xdir"
-            tar -zxf $FILES/$IMAGE_FNAME -C "$xdir"
-            KERNEL=$(for f in "$xdir/"*-vmlinuz* "$xdir/"aki-*/image; do
-                [ -f "$f" ] && echo "$f" && break; done; true)
-            RAMDISK=$(for f in "$xdir/"*-initrd* "$xdir/"ari-*/image; do
-                [ -f "$f" ] && echo "$f" && break; done; true)
-            IMAGE=$(for f in "$xdir/"*.img "$xdir/"ami-*/image; do
-                [ -f "$f" ] && echo "$f" && break; done; true)
-            if [[ -z "$IMAGE_NAME" ]]; then
-                IMAGE_NAME=$(basename "$IMAGE" ".img")
-            fi
-            DISK_FORMAT=ami
-            CONTAINER_FORMAT=ami
-            ;;
-        *.qcow2)
-            IMAGE="$FILES/${IMAGE_FNAME}"
-            IMAGE_NAME=$(basename "$IMAGE" ".qcow2")
-            DISK_FORMAT=qcow2
-            CONTAINER_FORMAT=bare
-            ;;
-        *) echo "Do not know what to do with $IMAGE_FNAME"; false;;
-    esac
-
-    if [ "$CONTAINER_FORMAT" = "bare" ]; then
-        extract_and_upload_k_and_r_from_image $token $IMAGE
-    elif [ "$CONTAINER_FORMAT" = "ami" ]; then
-        KERNEL_ID=$(openstack \
-            --os-token $token \
-            --os-url http://$GLANCE_HOSTPORT \
-            image create \
-            "$IMAGE_NAME-kernel" --public \
-            --container-format aki \
-            --disk-format aki < "$KERNEL" | grep ' id ' | get_field 2)
-        RAMDISK_ID=$(openstack \
-            --os-token $token \
-            --os-url http://$GLANCE_HOSTPORT \
-            image create \
-            "$IMAGE_NAME-ramdisk" --public \
-            --container-format ari \
-            --disk-format ari < "$RAMDISK" | grep ' id ' | get_field 2)
-    else
-        # TODO(deva): add support for other image types
-        return
-    fi
-
-    openstack \
-        --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
-        image create \
-        "${IMAGE_NAME%.img}" --public \
-        --container-format $CONTAINER_FORMAT \
-        --disk-format $DISK_FORMAT \
-        ${KERNEL_ID:+--property kernel_id=$KERNEL_ID} \
-        ${RAMDISK_ID:+--property ramdisk_id=$RAMDISK_ID} < "${IMAGE}"
-
-    # override DEFAULT_IMAGE_NAME so that tempest can find the image
-    # that we just uploaded in glance
-    DEFAULT_IMAGE_NAME="${IMAGE_NAME%.img}"
-}
-
-function clear_baremetal_of_all_nodes {
-    list=$(nova baremetal-node-list | awk -F '| ' 'NR>3 {print $2}' )
-    for node in $list; do
-        nova baremetal-node-delete $node
-    done
-}
-
-# Inform nova-baremetal about nodes, MACs, etc.
-# Defaults to using BM_FIRST_MAC and BM_SECOND_MAC if parameters not specified
-#
-# Usage: add_baremetal_node <first_mac> <second_mac>
-function add_baremetal_node {
-    mac_1=${1:-$BM_FIRST_MAC}
-    mac_2=${2:-$BM_SECOND_MAC}
-
-    id=$(nova baremetal-node-create \
-        --pm_address="$BM_PM_ADDR" \
-        --pm_user="$BM_PM_USER" \
-        --pm_password="$BM_PM_PASS" \
-        "$BM_HOSTNAME" \
-        "$BM_FLAVOR_CPU" \
-        "$BM_FLAVOR_RAM" \
-        "$BM_FLAVOR_ROOT_DISK" \
-        "$mac_1" \
-        | grep ' id ' | get_field 2 )
-    [ $? -eq 0 ] || [ "$id" ] || die $LINENO "Error adding baremetal node"
-    if [ -n "$mac_2" ]; then
-        id2=$(nova baremetal-interface-add "$id" "$mac_2" )
-        [ $? -eq 0 ] || [ "$id2" ] || die $LINENO "Error adding interface to barmetal node $id"
-    fi
-}
-
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/lib/neutron b/lib/neutron
index 09d935423e..5a2bfea801 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -529,25 +529,7 @@ function create_neutron_initial_network {
     TENANT_ID=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for demo"
 
-    # Create a small network
-    # Since neutron command is executed in admin context at this point,
-    # ``--tenant-id`` needs to be specified.
-    if is_baremetal; then
-        if [[ "$PUBLIC_INTERFACE" == '' || "$OVS_PHYSICAL_BRIDGE" == '' ]]; then
-            die $LINENO "Neutron settings for baremetal not set.. exiting"
-        fi
-        sudo ovs-vsctl add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
-        for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
-            sudo ip addr del $IP dev $PUBLIC_INTERFACE
-            sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
-        done
-        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant-id $TENANT_ID --provider:network_type flat --provider:physical_network "$PHYSICAL_NETWORK" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
-        SUBNET_ID=$(neutron subnet-create --tenant-id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --gateway $NETWORK_GATEWAY --name $PRIVATE_SUBNET_NAME $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $TENANT_ID"
-        sudo ifconfig $OVS_PHYSICAL_BRIDGE up
-        sudo route add default gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-    elif is_provider_network; then
+    if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
         NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
diff --git a/lib/nova b/lib/nova
index ec2d0bf29c..0e6c6afcf7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -635,12 +635,6 @@ function init_nova {
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB latin1
         fi
-
-        # (Re)create nova baremetal database
-        if is_baremetal; then
-            recreate_database nova_bm latin1
-            $NOVA_BIN_DIR/nova-baremetal-manage db sync
-        fi
     fi
 
     create_nova_cache_dir
diff --git a/lib/nova_plugins/hypervisor-baremetal b/lib/nova_plugins/hypervisor-baremetal
deleted file mode 100644
index 22d16a667b..0000000000
--- a/lib/nova_plugins/hypervisor-baremetal
+++ /dev/null
@@ -1,87 +0,0 @@
-# lib/nova_plugins/hypervisor-baremetal
-# Configure the baremetal hypervisor
-
-# Enable with:
-# VIRT_DRIVER=baremetal
-
-# Dependencies:
-# ``functions`` file
-# ``nova`` configuration
-
-# install_nova_hypervisor - install any external requirements
-# configure_nova_hypervisor - make configuration changes, including those to other services
-# start_nova_hypervisor - start any external services
-# stop_nova_hypervisor - stop any external services
-# cleanup_nova_hypervisor - remove transient data and cache
-
-# Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-NETWORK_MANAGER=${NETWORK_MANAGER:-FlatManager}
-PUBLIC_INTERFACE_DEFAULT=eth0
-FLAT_INTERFACE=${FLAT_INTERFACE:-eth0}
-FLAT_NETWORK_BRIDGE_DEFAULT=br100
-STUB_NETWORK=${STUB_NETWORK:-False}
-
-
-# Entry Points
-# ------------
-
-# clean_nova_hypervisor - Clean up an installation
-function cleanup_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# configure_nova_hypervisor - Set config files, create data dirs, etc
-function configure_nova_hypervisor {
-    configure_baremetal_nova_dirs
-
-    iniset $NOVA_CONF baremetal sql_connection `database_connection_url nova_bm`
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT compute_driver nova.virt.baremetal.driver.BareMetalDriver
-    iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    iniset $NOVA_CONF DEFAULT scheduler_host_manager nova.scheduler.baremetal_host_manager.BaremetalHostManager
-    iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
-    iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
-    iniset $NOVA_CONF baremetal flavor_extra_specs cpu_arch:$BM_CPU_ARCH
-    iniset $NOVA_CONF baremetal driver $BM_DRIVER
-    iniset $NOVA_CONF baremetal power_manager $BM_POWER_MANAGER
-    iniset $NOVA_CONF baremetal tftp_root /tftpboot
-    if [[ "$BM_DNSMASQ_FROM_NOVA_NETWORK" = "True" ]]; then
-        BM_DNSMASQ_CONF=$NOVA_CONF_DIR/dnsmasq-for-baremetal-from-nova-network.conf
-        sudo cp "$FILES/dnsmasq-for-baremetal-from-nova-network.conf" "$BM_DNSMASQ_CONF"
-        iniset $NOVA_CONF DEFAULT dnsmasq_config_file "$BM_DNSMASQ_CONF"
-    fi
-}
-
-# install_nova_hypervisor() - Install external components
-function install_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# start_nova_hypervisor - Start any required external services
-function start_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# stop_nova_hypervisor - Stop any external services
-function stop_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-
-# Restore xtrace
-$MY_XTRACE
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/stack.sh b/stack.sh
index 24bda01782..cd1c200404 100755
--- a/stack.sh
+++ b/stack.sh
@@ -561,7 +561,6 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/baremetal
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 
@@ -1136,14 +1135,6 @@ if is_service_enabled nova; then
     init_nova_cells
 fi
 
-# Extra things to prepare nova for baremetal, before nova starts
-if is_service_enabled nova && is_baremetal; then
-    echo_summary "Preparing for nova baremetal"
-    prepare_baremetal_toolchain
-    configure_baremetal_nova_dirs
-fi
-
-
 # Extras Configuration
 # ====================
 
@@ -1197,28 +1188,16 @@ if is_service_enabled g-reg; then
     TOKEN=$(keystone token-get | grep ' id ' | get_field 2)
     die_if_not_set $LINENO TOKEN "Keystone fail to get token"
 
-    if is_baremetal; then
-        echo_summary "Creating and uploading baremetal images"
-
-        # build and upload separate deploy kernel & ramdisk
-        upload_baremetal_deploy $TOKEN
-
-        # upload images, separating out the kernel & ramdisk for PXE boot
-        for image_url in ${IMAGE_URLS//,/ }; do
-            upload_baremetal_image $image_url $TOKEN
-        done
-    else
-        echo_summary "Uploading images"
-
-        # Option to upload legacy ami-tty, which works with xenserver
-        if [[ -n "$UPLOAD_LEGACY_TTY" ]]; then
-            IMAGE_URLS="${IMAGE_URLS:+${IMAGE_URLS},}https://github.com/downloads/citrix-openstack/warehouse/tty.tgz"
-        fi
+    echo_summary "Uploading images"
 
-        for image_url in ${IMAGE_URLS//,/ }; do
-            upload_image $image_url $TOKEN
-        done
+    # Option to upload legacy ami-tty, which works with xenserver
+    if [[ -n "$UPLOAD_LEGACY_TTY" ]]; then
+        IMAGE_URLS="${IMAGE_URLS:+${IMAGE_URLS},}https://github.com/downloads/citrix-openstack/warehouse/tty.tgz"
     fi
+
+    for image_url in ${IMAGE_URLS//,/ }; do
+        upload_image $image_url $TOKEN
+    done
 fi
 
 # Create an access key and secret key for nova ec2 register image
@@ -1325,32 +1304,6 @@ if is_service_enabled nova && is_service_enabled key; then
 fi
 
 
-# If we are running nova with baremetal driver, there are a few
-# last-mile configuration bits to attend to, which must happen
-# after n-api and n-sch have started.
-# Also, creating the baremetal flavor must happen after images
-# are loaded into glance, though just knowing the IDs is sufficient here
-if is_service_enabled nova && is_baremetal; then
-    # create special flavor for baremetal if we know what images to associate
-    [[ -n "$BM_DEPLOY_KERNEL_ID" ]] && [[ -n "$BM_DEPLOY_RAMDISK_ID" ]] && \
-        create_baremetal_flavor $BM_DEPLOY_KERNEL_ID $BM_DEPLOY_RAMDISK_ID
-
-    # otherwise user can manually add it later by calling nova-baremetal-manage
-    [[ -n "$BM_FIRST_MAC" ]] && add_baremetal_node
-
-    if [[ "$BM_DNSMASQ_FROM_NOVA_NETWORK" = "False" ]]; then
-        # NOTE: we do this here to ensure that our copy of dnsmasq is running
-        sudo pkill dnsmasq || true
-        sudo dnsmasq --conf-file= --port=0 --enable-tftp --tftp-root=/tftpboot \
-            --dhcp-boot=pxelinux.0 --bind-interfaces --pid-file=/var/run/dnsmasq.pid \
-            --interface=$BM_DNSMASQ_IFACE --dhcp-range=$BM_DNSMASQ_RANGE \
-            ${BM_DNSMASQ_DNS:+--dhcp-option=option:dns-server,$BM_DNSMASQ_DNS}
-    fi
-    # ensure callback daemon is running
-    sudo pkill nova-baremetal-deploy-helper || true
-    run_process baremetal "nova-baremetal-deploy-helper"
-fi
-
 # Save some values we generated for later use
 CURRENT_RUN_TIME=$(date "+$TIMESTAMP_FORMAT")
 echo "# $CURRENT_RUN_TIME" >$TOP_DIR/.stackenv
diff --git a/stackrc b/stackrc
index 5c5acb137c..ac798894b8 100644
--- a/stackrc
+++ b/stackrc
@@ -551,7 +551,7 @@ esac
 # Use 64bit fedora image if heat is enabled
 if [[ "$ENABLED_SERVICES" =~ 'h-api' ]]; then
     case "$VIRT_DRIVER" in
-        libvirt|baremetal|ironic)
+        libvirt|ironic)
             HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"}
             IMAGE_URLS+=",$HEAT_CFN_IMAGE_URL"
             ;;
@@ -563,7 +563,7 @@ fi
 # Trove needs a custom image for its work
 if [[ "$ENABLED_SERVICES" =~ 'tr-api' ]]; then
     case "$VIRT_DRIVER" in
-        libvirt|baremetal|ironic|xenapi)
+        libvirt|ironic|xenapi)
             TROVE_GUEST_IMAGE_URL=${TROVE_GUEST_IMAGE_URL:-"http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"}
             IMAGE_URLS+=",${TROVE_GUEST_IMAGE_URL}"
             ;;
diff --git a/unstack.sh b/unstack.sh
index fee608e17b..3403919042 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -53,7 +53,6 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/baremetal
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 

From fb3ce0bd6be04a5f23d33f3444a48a92fd8d0af1 Mon Sep 17 00:00:00 2001
From: Emily Hugenbruch <ekhugen@us.ibm.com>
Date: Fri, 21 Nov 2014 22:15:08 +0000
Subject: [PATCH 0154/3333] Adding tempest install to devstack

Stack.sh doesn't install tempest, but it would be useful if it did.

Change-Id: I2eba3738342cb4835a992aa1152939a8dc2f74da
---
 samples/local.conf | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/samples/local.conf b/samples/local.conf
index 20c58929e4..9e0b540250 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -93,3 +93,9 @@ SWIFT_REPLICAS=1
 # moved by setting ``SWIFT_DATA_DIR``. The directory will be created
 # if it does not exist.
 SWIFT_DATA_DIR=$DEST/data
+
+# Tempest
+# -------
+
+# Install the tempest test suite
+enable_service tempest
\ No newline at end of file

From 0354640587cde740aa0299c722f019ae1c01e05d Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Fri, 5 Dec 2014 16:49:12 -0800
Subject: [PATCH 0155/3333] Move ironic ssh key creation early in preparation

SSH creds should be in place before nodes are enrolled.  If not,
ironic cannot sync power state causing nova to skip nodes in
its resource tracker.

Change-Id: I6b98ae57ce33783f69e2cf9ba357807d384b3012
Closes-bug: #1398128
---
 lib/ironic | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 28f8fe87e5..058ee31195 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -740,6 +740,9 @@ function upload_baremetal_ironic_deploy {
 }
 
 function prepare_baremetal_basic_ops {
+    if ! is_ironic_hardware; then
+        configure_ironic_auxiliary
+    fi
     upload_baremetal_ironic_deploy
     if ! is_ironic_hardware; then
         create_bridge_and_vms
@@ -747,9 +750,6 @@ function prepare_baremetal_basic_ops {
     enroll_nodes
     configure_tftpd
     configure_iptables
-    if ! is_ironic_hardware; then
-        configure_ironic_auxiliary
-    fi
 }
 
 function cleanup_baremetal_basic_ops {

From 245daa27da40cb94410c7a8f8f19961c21821231 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Fri, 14 Nov 2014 02:17:22 -0500
Subject: [PATCH 0156/3333] Use --or-show for get_or_create_user/project/role
 function

Exploit the --or-show functionality of openstackclient,
rather than issuing two different commands at the shell level,
let the CLI handle things.

Change-Id: I1db239fd3473eb580def1c5fb28ce472a1363569
---
 functions-common | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/functions-common b/functions-common
index 24507fef91..686b5082ab 100644
--- a/functions-common
+++ b/functions-common
@@ -831,15 +831,14 @@ function get_or_create_user {
     fi
     # Gets user id
     local user_id=$(
-        # Gets user id
-        $os_cmd user show $1 $domain -f value -c id 2>/dev/null ||
-        # Creates new user
+        # Creates new user with --or-show
         $os_cmd user create \
             $1 \
             --password "$2" \
             --project $3 \
             $email \
             $domain \
+            --or-show \
             -f value -c id
     )
     echo $user_id
@@ -856,10 +855,8 @@ function get_or_create_project {
         os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI/v3 --os-identity-api-version=3"
     fi
     local project_id=$(
-        # Gets project id
-        $os_cmd project show $1 $domain -f value -c id 2>/dev/null ||
-        # Creates new project if not exists
-        $os_cmd project create $1 $domain -f value -c id
+        # Creates new project with --or-show
+        $os_cmd project create $1 $domain --or-show -f value -c id
     )
     echo $project_id
 }
@@ -868,10 +865,8 @@ function get_or_create_project {
 # Usage: get_or_create_role <name>
 function get_or_create_role {
     local role_id=$(
-        # Gets role id
-        openstack role show $1 -f value -c id 2>/dev/null ||
-        # Creates role if not exists
-        openstack role create $1 -f value -c id
+        # Creates role with --or-show
+        openstack role create $1 --or-show -f value -c id
     )
     echo $role_id
 }

From b7d5bf6e9d2140e932419fd0cce11afe161dc73e Mon Sep 17 00:00:00 2001
From: Yuiko Takada <takada-yuiko@mxn.nes.nec.co.jp>
Date: Thu, 20 Nov 2014 18:23:06 +0900
Subject: [PATCH 0157/3333] add the kernel/ramdisk id to driver_info

Because bp https://blueprints.launchpad.net/ironic/+spec/add-node-instance-info
has been completed,
add the deploy_kernel_id and deploy_ramdisk_id to ironic node's driver_info
in stead of to flavor.

Change-Id: I90ffae49212e68749b8331edc278228419317453
---
 lib/ironic | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 28f8fe87e5..b329438cad 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -564,10 +564,8 @@ function enroll_nodes {
             # we create the bare metal flavor with minimum value
             local node_options="-i ipmi_address=$ipmi_address -i ipmi_password=$ironic_ipmi_passwd\
                 -i ipmi_username=$ironic_ipmi_username"
-            if is_deployed_by_agent; then
-                node_options+=" -i $_IRONIC_DEPLOY_KERNEL_KEY=$IRONIC_DEPLOY_KERNEL_ID"
-                node_options+=" -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID"
-            fi
+            node_options+=" -i $_IRONIC_DEPLOY_KERNEL_KEY=$IRONIC_DEPLOY_KERNEL_ID"
+            node_options+=" -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID"
         fi
 
         local node_id=$(ironic node-create --chassis_uuid $chassis_id \
@@ -591,11 +589,7 @@ function enroll_nodes {
     local adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
     nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal 551 $ironic_node_ram $adjusted_disk $ironic_node_cpu
 
-    # TODO(lucasagomes): Remove the 'baremetal:deploy_kernel_id'
-    # and 'baremetal:deploy_ramdisk_id' parameters
-    # from the flavor after the completion of
-    # https://blueprints.launchpad.net/ironic/+spec/add-node-instance-info
-    nova flavor-key baremetal set "cpu_arch"="x86_64" "baremetal:deploy_kernel_id"="$IRONIC_DEPLOY_KERNEL_ID" "baremetal:deploy_ramdisk_id"="$IRONIC_DEPLOY_RAMDISK_ID"
+    nova flavor-key baremetal set "cpu_arch"="x86_64"
 
     if [ "$VIRT_DRIVER" == "ironic" ]; then
         wait_for_nova_resources $total_nodes

From 20b839fd51ff0ccecbc67f3d29578ce042c8b3c3 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Mon, 8 Dec 2014 06:17:27 +0000
Subject: [PATCH 0158/3333] Update devstack to work with new split neutron
 services repos

This commit udpates devstack to work with the latest neutron services, which
are now in their own repositories. This will also unblock third party CI for
services testing. This also allows devstack users to run neutron with
services again.

Change-Id: I9cdd51f09edaccf218988240b48ce733d5771a65
---
 lib/neutron                               | 15 +++++++++++++++
 lib/neutron_plugins/services/firewall     |  2 +-
 lib/neutron_plugins/services/loadbalancer |  2 +-
 lib/neutron_plugins/services/vpn          |  2 +-
 stackrc                                   | 12 ++++++++++++
 5 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 5a2bfea801..0029158202 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -99,6 +99,9 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 
 NEUTRON_DIR=$DEST/neutron
+NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
+NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
@@ -596,6 +599,18 @@ function init_neutron {
 function install_neutron {
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
+    if is_service_enabled q-fwaas; then
+        git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
+        setup_develop $NEUTRON_FWAAS_DIR
+    fi
+    if is_service_enabled q-lbaas; then
+        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
+        setup_develop $NEUTRON_LBAAS_DIR
+    fi
+    if is_service_enabled q-vpn; then
+        git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
+        setup_develop $NEUTRON_VPNAAS_DIR
+    fi
 
     if [ "$VIRT_DRIVER" == 'xenserver' ]; then
         local dom0_ip
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index b5253dbeef..ce1f93f7d2 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -5,7 +5,7 @@
 FW_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-FWAAS_PLUGIN=neutron.services.firewall.fwaas_plugin.FirewallPlugin
+FWAAS_PLUGIN=neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin
 
 function neutron_fwaas_configure_common {
     _neutron_service_plugin_class_add $FWAAS_PLUGIN
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index f84b71076d..bd9dc8731b 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -7,7 +7,7 @@ set +o xtrace
 
 
 AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
-LBAAS_PLUGIN=neutron.services.loadbalancer.plugin.LoadBalancerPlugin
+LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
 
 function neutron_agent_lbaas_install_agent_packages {
     if is_ubuntu || is_fedora || is_suse; then
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 2478c47ae5..07f1f35d9a 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -7,7 +7,7 @@ set +o xtrace
 
 
 AGENT_VPN_BINARY="$NEUTRON_BIN_DIR/neutron-vpn-agent"
-VPN_PLUGIN=${VPN_PLUGIN:-"neutron.services.vpn.plugin.VPNDriverPlugin"}
+VPN_PLUGIN=${VPN_PLUGIN:-"neutron_vpnaas.services.vpn.plugin.VPNDriverPlugin"}
 IPSEC_PACKAGE=${IPSEC_PACKAGE:-"openswan"}
 
 function neutron_vpn_install_agent_packages {
diff --git a/stackrc b/stackrc
index 81b60674ee..ccff87e2e4 100644
--- a/stackrc
+++ b/stackrc
@@ -185,6 +185,18 @@ KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-master}
 NEUTRON_REPO=${NEUTRON_REPO:-${GIT_BASE}/openstack/neutron.git}
 NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 
+# neutron fwaas service
+NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
+NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
+
+# neutron lbaas service
+NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
+NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
+
+# neutron vpnaas service
+NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
+NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}
+
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}

From 6accb136d3219af588d26a904f8a1f748d5e8818 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Mon, 8 Dec 2014 17:35:15 +0000
Subject: [PATCH 0159/3333] Fix fwaas service plugin location

This was missed during the services split.

Change-Id: I8b51ca2c6ef734bf2747cec48a2f751eb682afe5
---
 lib/neutron_plugins/services/firewall | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index ce1f93f7d2..a1c13ed153 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -16,7 +16,7 @@ function neutron_fwaas_configure_driver {
     cp $NEUTRON_DIR/etc/fwaas_driver.ini $FWAAS_DRIVER_CONF_FILENAME
 
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"
+    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"
 }
 
 function neutron_fwaas_stop {

From 092c124b16c3eaa541ff0e90df55c7b2c94b6eda Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <dims@linux.vnet.ibm.com>
Date: Mon, 8 Dec 2014 13:48:18 -0500
Subject: [PATCH 0160/3333] Sort oslo libraries and add missing oslo.context

Ensure both lists of oslo libraries are sorted and
add the missing oslo.context in install_oslo method

Change-Id: I5b849c97b681e65425304e05534a61140e4e1fda
---
 lib/oslo | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/lib/oslo b/lib/oslo
index d00580b14a..1fff1f5d32 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -21,14 +21,14 @@ set +o xtrace
 # Defaults
 # --------
 GITDIR["cliff"]=$DEST/cliff
-GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
+GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.context"]=$DEST/oslo.context
 GITDIR["oslo.db"]=$DEST/oslo.db
 GITDIR["oslo.i18n"]=$DEST/oslo.i18n
 GITDIR["oslo.log"]=$DEST/oslo.log
-GITDIR["oslo.middleware"]=$DEST/oslo.middleware
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
+GITDIR["oslo.middleware"]=$DEST/oslo.middleware
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
 GITDIR["oslo.utils"]=$DEST/oslo.utils
@@ -54,16 +54,17 @@ function _do_install_oslo_lib {
 # install_oslo() - Collect source and prepare
 function install_oslo {
     _do_install_oslo_lib "cliff"
-    _do_install_oslo_lib "oslo.i18n"
-    _do_install_oslo_lib "oslo.utils"
-    _do_install_oslo_lib "oslo.serialization"
-    _do_install_oslo_lib "oslo.config"
     _do_install_oslo_lib "oslo.concurrency"
+    _do_install_oslo_lib "oslo.config"
+    _do_install_oslo_lib "oslo.context"
+    _do_install_oslo_lib "oslo.db"
+    _do_install_oslo_lib "oslo.i18n"
     _do_install_oslo_lib "oslo.log"
-    _do_install_oslo_lib "oslo.middleware"
     _do_install_oslo_lib "oslo.messaging"
+    _do_install_oslo_lib "oslo.middleware"
     _do_install_oslo_lib "oslo.rootwrap"
-    _do_install_oslo_lib "oslo.db"
+    _do_install_oslo_lib "oslo.serialization"
+    _do_install_oslo_lib "oslo.utils"
     _do_install_oslo_lib "oslo.vmware"
     _do_install_oslo_lib "pycadf"
     _do_install_oslo_lib "stevedore"

From a9c2594442301b18f9d48f4ee52f6e450ec00992 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Mon, 8 Dec 2014 14:26:28 +0000
Subject: [PATCH 0161/3333] Document local.conf settings for ceilometer

Describe the various settings that can be made to control the
behavior of Ceilometer. Doing in lib/ceilometer for now. When there
is more something under doc may be warranted.

Change-Id: I9cd47085a5e91bae0a88f6e26f6c8bdc86c02978
---
 lib/ceilometer | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index cdef422bb5..b43a4ed12a 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -1,13 +1,32 @@
 # lib/ceilometer
 # Install and start **Ceilometer** service
 
-# To enable a minimal set of Ceilometer services, add the following to localrc:
+# To enable a minimal set of Ceilometer services, add the following to the
+# localrc section of local.conf:
 #
 #   enable_service ceilometer-acompute ceilometer-acentral ceilometer-anotification ceilometer-collector ceilometer-api
 #
-# To ensure Ceilometer alarming services are enabled also, further add to the localrc:
+# To ensure Ceilometer alarming services are enabled also, further add to the
+# localrc section of local.conf:
 #
 #   enable_service ceilometer-alarm-notifier ceilometer-alarm-evaluator
+#
+# To ensure events are stored, add the following section to local.conf:
+#
+#   [[post-config|$CEILOMETER_CONF]]
+#   [notification]
+#   store_events=True
+#
+# Several variables set in the localrc section adjust common behaviors
+# of Ceilometer (see within for additional settings):
+#
+#   CEILOMETER_USE_MOD_WSGI:       When True, run the api under mod_wsgi.
+#   CEILOMETER_PIPELINE_INTERVAL:  The number of seconds between pipeline processing
+#                                  runs. Default 600.
+#   CEILOMETER_BACKEND:            The database backend (e.g. 'mysql', 'mongodb')
+#   CEILOMETER_COORDINATION_URL:   The URL for a group membership service provided
+#                                  by tooz.
+
 
 # Dependencies:
 #

From c187b88e698a203a222b38cbf3a045b520918042 Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Tue, 9 Dec 2014 15:41:55 +0100
Subject: [PATCH 0162/3333] Add tooz support from Oslo

Change-Id: I4ccf4bf08e10c0ba651f973aa62562af85ea0f19
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 1fff1f5d32..79d63ba8f7 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -36,6 +36,7 @@ GITDIR["oslo.vmware"]=$DEST/oslo.vmware
 GITDIR["pycadf"]=$DEST/pycadf
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
+GITDIR["tooz"]=$DEST/tooz
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -69,6 +70,7 @@ function install_oslo {
     _do_install_oslo_lib "pycadf"
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
+    _do_install_oslo_lib "tooz"
 }
 
 # Restore xtrace
diff --git a/stackrc b/stackrc
index ac798894b8..81b60674ee 100644
--- a/stackrc
+++ b/stackrc
@@ -346,6 +346,10 @@ GITBRANCH["stevedore"]=${STEVEDORE_BRANCH:-master}
 GITREPO["taskflow"]=${TASKFLOW_REPO:-${GIT_BASE}/openstack/taskflow.git}
 GITBRANCH["taskflow"]=${TASKFLOW_BRANCH:-master}
 
+# tooz plugin manager
+GITREPO["tooz"]=${TOOZ_REPO:-${GIT_BASE}/openstack/tooz.git}
+GITBRANCH["tooz"]=${TOOZ_BRANCH:-master}
+
 # pbr drives the setuptools configs
 GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack-dev/pbr.git}
 GITBRANCH["pbr"]=${PBR_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 1b576d87c2..7e96bae7bb 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -27,7 +27,7 @@ for i in $TOP/lib/*; do
     fi
 done
 
-ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient"
+ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient tooz"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 33e8ee20a4ad087f5538e813eace1ca23243e2c5 Mon Sep 17 00:00:00 2001
From: Salvatore <salv.orlando@gmail.com>
Date: Sun, 5 Oct 2014 01:36:34 +0200
Subject: [PATCH 0163/3333] Tempest: configure exact set of extensions to test

So far devstack configures tempest either for testing all extensions
or a specific subset. It does not allow users for specifying a set
of extensions which should not be exercised.

This patch adds this support. To this aim, the tempest configuration
process will scan API endpoints for active extensions using the
verify_tempest_config.py tool, and then will remove those extensions
which have been explicitly disabled by the user.

If an explicit subset of extensions to enable is passed to devstack,
tempest will use this subset, rather than the list of active
extensions.

Implements blueprint branchless-tempest-extensions

Change-Id: I263bcf04668953f414a4ef18cb98c1c373e142ad
---
 lib/tempest | 60 ++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 52 insertions(+), 8 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 46c9e26916..416fae2c31 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -78,6 +78,18 @@ IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True $IPV6_SUBNET_ATTRIBUTES_ENABLE
 # Functions
 # ---------
 
+# remove_disabled_extension - removes disabled extensions from the list of extensions
+# to test for a given service
+function remove_disabled_extensions {
+    local extensions_list=$1
+    shift
+    local disabled_exts=$*
+    for ext_to_remove in ${disabled_exts//,/ } ; do
+        extensions_list=${extensions_list/$ext_to_remove","}
+    done
+    echo $extensions_list
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     setup_develop $TEMPEST_DIR
@@ -299,12 +311,24 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
 
     # Compute Features
+    # Run verify_tempest_config -ur to retrieve enabled extensions on API endpoints
+    # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
+    local tmp_cfg_file=$(mktemp)
+    $TEMPEST_DIR/tempest/cmd/verify_tempest_config.py -uro $tmp_cfg_file
+
+    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
+    fi
+
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
-    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions ${COMPUTE_API_EXTENSIONS:-"all"}
-    iniset $TEMPEST_CONFIG compute-feature-disabled api_extensions ${DISABLE_COMPUTE_API_EXTENSIONS}
+    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
 
     # Compute admin
     iniset $TEMPEST_CONFIG "compute-admin" username $ADMIN_USERNAME
@@ -319,8 +343,15 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6 "$IPV6_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
-    iniset $TEMPEST_CONFIG network-feature-enabled api_extensions ${NETWORK_API_EXTENSIONS:-"all"}
-    iniset $TEMPEST_CONFIG network-feature-disabled api_extensions ${DISABLE_NETWORK_API_EXTENSIONS}
+
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
 
     # boto
     iniset $TEMPEST_CONFIG boto ec2_url "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/services/Cloud"
@@ -362,12 +393,25 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG telemetry too_slow_to_test "False"
 
     # Object storage
-    iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis ${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
-    iniset $TEMPEST_CONFIG object-storage-feature-disabled discoverable_apis ${OBJECT_STORAGE_DISABLE_API_EXTENSIONS}
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
+        # Remove disabled extensions
+        object_storage_api_extensions=$(remove_disabled_extensions $object_storage_api_extensions $DISABLE_STORAGE_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
 
     # Volume
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions ${VOLUME_API_EXTENSIONS:-"all"}
-    iniset $TEMPEST_CONFIG volume-feature-disabled api_extensions ${DISABLE_VOLUME_API_EXTENSIONS}
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        volume_api_extensions=$(remove_disabled_extensions $volume_api_extensions $DISABLE_VOLUME_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions $volume_api_extensions
+
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi

From f3b49e23b04878a2a4d37bbb1884c677b6b56c2a Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Tue, 9 Dec 2014 17:37:03 +0000
Subject: [PATCH 0164/3333] XenAPI: Add another plugin directory

Buildroot on 64-bit systems may use /usr/lib64 to store the XAPI plugins
Add this as an option to search for.

The list is getting of acceptable paths is getting longer but some work is going
on in XAPI to allow us to query for this path, which will mean we can get
rid of this list in future.

Change-Id: I79aafb6a86032c7ab04937c9e9bec08661ecdefa
---
 tools/xen/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/functions b/tools/xen/functions
index c8efd57d88..4e9fede387 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -10,7 +10,7 @@ function die_with_error {
 }
 
 function xapi_plugin_location {
-    for PLUGIN_DIR in "/etc/xapi.d/plugins/" "/usr/lib/xcp/plugins/" "/usr/lib/xapi/plugins"; do
+    for PLUGIN_DIR in "/etc/xapi.d/plugins/" "/usr/lib/xcp/plugins/" "/usr/lib/xapi/plugins" "/usr/lib64/xapi/plugins"; do
         if [ -d $PLUGIN_DIR ]; then
             echo $PLUGIN_DIR
             return 0

From fc094655080955f7bfcb628b544d131145830b67 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean_collins2@cable.comcast.com>
Date: Tue, 9 Dec 2014 11:36:53 -0700
Subject: [PATCH 0165/3333] Generate an IPv6 address when PUBLIC_BRIDGE does
 not have one

Closes-Bug: #1400823
Change-Id: Ic79fd003aea2af7b258397ec2cdfd70c8568743c
---
 lib/neutron | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 5a2bfea801..c1311db1e0 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1177,6 +1177,12 @@ function _neutron_configure_router_v6 {
         # and then on to recover the public bridge's link local address
         sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=1
         sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=0
+        if ! ip -6 addr show dev $PUBLIC_BRIDGE | grep 'scope global'; then
+            # Create an IPv6 ULA address for PUBLIC_BRIDGE if one is not present
+            IPV6_BRIDGE_ULA=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
+            sudo ip -6 addr add fd$IPV6_BRIDGE_ULA::1 dev $PUBLIC_BRIDGE
+        fi
+
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}

From 19d22bd19a1802cae3eab2c194cb7c0dd7d3c47c Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith8@gmail.com>
Date: Tue, 9 Dec 2014 21:48:58 -0700
Subject: [PATCH 0166/3333] Change Cinder Cert script to run all Volume tests

The Cinder Cert script currently only runs the Tempest
tests tagged with volume.api, should be all Volume tests
to make sure we get things like attach and other commands
fully tested.

Change-Id: Ic15d2ad6d3616bfde4838873d0c79664b009ef1f
---
 driver_certs/cinder_driver_cert.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/driver_certs/cinder_driver_cert.sh b/driver_certs/cinder_driver_cert.sh
index 7726e7eb01..27570389a9 100755
--- a/driver_certs/cinder_driver_cert.sh
+++ b/driver_certs/cinder_driver_cert.sh
@@ -93,7 +93,7 @@ start_cinder
 sleep 5
 
 # run tempest api/volume/test_*
-log_message "Run the actual tempest volume tests (./tools/pretty_tox.sh api.volume)...", True
+log_message "Run the actual tempest volume tests (./tools/pretty_tox.sh volume)...", True
 ./tools/pretty_tox.sh api.volume 2>&1 | tee -a $TEMPFILE
 if [[ $? = 0 ]]; then
     log_message "CONGRATULATIONS!!!  Device driver PASSED!", True

From e263c82e48a431e502bd6baceb6dfcfdc1750cbb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 5 Dec 2014 14:25:28 -0500
Subject: [PATCH 0167/3333] add shebang lines to all lib files

With gerrit 2.8, and the new change screen, this will trigger syntax
highlighting in gerrit. Thus making reviewing code a lot nicer.

Change-Id: Id238748417ffab53e02d59413dba66f61e724383
---
 functions                                   | 2 ++
 functions-common                            | 2 ++
 lib/apache                                  | 2 ++
 lib/ceilometer                              | 2 ++
 lib/ceph                                    | 2 ++
 lib/cinder                                  | 2 ++
 lib/cinder_backends/ceph                    | 2 ++
 lib/cinder_backends/glusterfs               | 2 ++
 lib/cinder_backends/lvm                     | 2 ++
 lib/cinder_backends/netapp_iscsi            | 2 ++
 lib/cinder_backends/netapp_nfs              | 2 ++
 lib/cinder_backends/nfs                     | 2 ++
 lib/cinder_backends/solidfire               | 2 ++
 lib/cinder_backends/vmdk                    | 2 ++
 lib/cinder_backends/xiv                     | 3 ++-
 lib/cinder_plugins/XenAPINFS                | 2 ++
 lib/cinder_plugins/glusterfs                | 2 ++
 lib/cinder_plugins/nfs                      | 2 ++
 lib/cinder_plugins/sheepdog                 | 2 ++
 lib/cinder_plugins/vsphere                  | 2 ++
 lib/config                                  | 2 ++
 lib/database                                | 2 ++
 lib/databases/mysql                         | 2 ++
 lib/databases/postgresql                    | 2 ++
 lib/dib                                     | 2 ++
 lib/dstat                                   | 2 ++
 lib/gantt                                   | 2 ++
 lib/glance                                  | 2 ++
 lib/heat                                    | 2 ++
 lib/horizon                                 | 2 ++
 lib/infra                                   | 2 ++
 lib/ironic                                  | 2 ++
 lib/keystone                                | 2 ++
 lib/ldap                                    | 2 ++
 lib/neutron                                 | 2 ++
 lib/neutron_plugins/bigswitch_floodlight    | 2 ++
 lib/neutron_plugins/brocade                 | 2 ++
 lib/neutron_plugins/cisco                   | 2 ++
 lib/neutron_plugins/embrane                 | 2 ++
 lib/neutron_plugins/ibm                     | 2 ++
 lib/neutron_plugins/linuxbridge_agent       | 2 ++
 lib/neutron_plugins/midonet                 | 2 ++
 lib/neutron_plugins/ml2                     | 2 ++
 lib/neutron_plugins/nec                     | 2 ++
 lib/neutron_plugins/nuage                   | 2 ++
 lib/neutron_plugins/ofagent_agent           | 2 ++
 lib/neutron_plugins/oneconvergence          | 2 ++
 lib/neutron_plugins/openvswitch             | 2 ++
 lib/neutron_plugins/openvswitch_agent       | 2 ++
 lib/neutron_plugins/ovs_base                | 2 ++
 lib/neutron_plugins/plumgrid                | 2 ++
 lib/neutron_plugins/vmware_nsx              | 2 ++
 lib/neutron_thirdparty/bigswitch_floodlight | 2 ++
 lib/neutron_thirdparty/midonet              | 2 ++
 lib/neutron_thirdparty/ryu                  | 2 ++
 lib/neutron_thirdparty/trema                | 2 ++
 lib/neutron_thirdparty/vmware_nsx           | 2 ++
 lib/nova                                    | 2 ++
 lib/nova_plugins/functions-libvirt          | 2 ++
 lib/nova_plugins/hypervisor-fake            | 2 ++
 lib/nova_plugins/hypervisor-ironic          | 2 ++
 lib/nova_plugins/hypervisor-libvirt         | 2 ++
 lib/nova_plugins/hypervisor-openvz          | 2 ++
 lib/nova_plugins/hypervisor-vsphere         | 2 ++
 lib/nova_plugins/hypervisor-xenserver       | 2 ++
 lib/opendaylight                            | 2 ++
 lib/oslo                                    | 2 ++
 lib/rpc_backend                             | 2 ++
 lib/sahara                                  | 2 ++
 lib/stackforge                              | 2 ++
 lib/swift                                   | 2 ++
 lib/tempest                                 | 2 ++
 lib/template                                | 2 ++
 lib/tls                                     | 2 ++
 lib/trove                                   | 2 ++
 lib/zaqar                                   | 2 ++
 stackrc                                     | 2 ++
 77 files changed, 154 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index bb40a481bd..d33ad8c3a0 100644
--- a/functions
+++ b/functions
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # functions - DevStack-specific functions
 #
 # The following variables are assumed to be defined by certain functions:
diff --git a/functions-common b/functions-common
index 24507fef91..cbfa130fd1 100644
--- a/functions-common
+++ b/functions-common
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # functions-common - Common functions used by DevStack components
 #
 # The canonical copy of this file is maintained in the DevStack repo.
diff --git a/lib/apache b/lib/apache
index 2c436816c3..c7d69f2ea7 100644
--- a/lib/apache
+++ b/lib/apache
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/apache
 # Functions to control configuration and operation of apache web server
 
diff --git a/lib/ceilometer b/lib/ceilometer
index cdef422bb5..43a39dd7cb 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/ceilometer
 # Install and start **Ceilometer** service
 
diff --git a/lib/ceph b/lib/ceph
index 521430626b..c2d418f49c 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/ceph
 # Functions to control the configuration and operation of the **Ceph** storage service
 
diff --git a/lib/cinder b/lib/cinder
index 611e1ca5d9..930119cd61 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder
 # Install and start **Cinder** volume service
 
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index e9d2a02ad3..415ce94489 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/ceph
 # Configure the ceph backend
 
diff --git a/lib/cinder_backends/glusterfs b/lib/cinder_backends/glusterfs
index dd772a84de..00c62e04cd 100644
--- a/lib/cinder_backends/glusterfs
+++ b/lib/cinder_backends/glusterfs
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/glusterfs
 # Configure the glusterfs backend
 
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 8f8ab7958e..a3ab5bf3f9 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/lvm
 # Configure the LVM backend
 
diff --git a/lib/cinder_backends/netapp_iscsi b/lib/cinder_backends/netapp_iscsi
index 7a67da7a26..be9442eb83 100644
--- a/lib/cinder_backends/netapp_iscsi
+++ b/lib/cinder_backends/netapp_iscsi
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/netapp_iscsi
 # Configure the NetApp iSCSI driver
 
diff --git a/lib/cinder_backends/netapp_nfs b/lib/cinder_backends/netapp_nfs
index d90b7f7d19..dc919ad86b 100644
--- a/lib/cinder_backends/netapp_nfs
+++ b/lib/cinder_backends/netapp_nfs
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/netapp_nfs
 # Configure the NetApp NFS driver
 
diff --git a/lib/cinder_backends/nfs b/lib/cinder_backends/nfs
index 76487884f7..fc51b2b440 100644
--- a/lib/cinder_backends/nfs
+++ b/lib/cinder_backends/nfs
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/nfs
 # Configure the nfs backend
 
diff --git a/lib/cinder_backends/solidfire b/lib/cinder_backends/solidfire
index 95ffce1ccc..7cc70fc86d 100644
--- a/lib/cinder_backends/solidfire
+++ b/lib/cinder_backends/solidfire
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/solidfire
 # Configure the solidfire driver
 
diff --git a/lib/cinder_backends/vmdk b/lib/cinder_backends/vmdk
index b32c4b2e7a..d5b945354b 100644
--- a/lib/cinder_backends/vmdk
+++ b/lib/cinder_backends/vmdk
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_backends/vmdk
 # Configure the VMware vmdk backend
 
diff --git a/lib/cinder_backends/xiv b/lib/cinder_backends/xiv
index ee5da2d487..6eadaae93b 100644
--- a/lib/cinder_backends/xiv
+++ b/lib/cinder_backends/xiv
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Copyright 2014 IBM Corp.
 # Copyright (c) 2014 OpenStack Foundation
 # All Rights Reserved.
@@ -82,4 +84,3 @@ $XIV_XTRACE
 # Local variables:
 # mode: shell-script
 # End:
-
diff --git a/lib/cinder_plugins/XenAPINFS b/lib/cinder_plugins/XenAPINFS
index fa10715bdf..f7306955cb 100644
--- a/lib/cinder_plugins/XenAPINFS
+++ b/lib/cinder_plugins/XenAPINFS
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_plugins/XenAPINFS
 # Configure the XenAPINFS driver
 
diff --git a/lib/cinder_plugins/glusterfs b/lib/cinder_plugins/glusterfs
index b4196e4738..35ceb27ce1 100644
--- a/lib/cinder_plugins/glusterfs
+++ b/lib/cinder_plugins/glusterfs
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_plugins/glusterfs
 # Configure the glusterfs driver
 
diff --git a/lib/cinder_plugins/nfs b/lib/cinder_plugins/nfs
index 5f4cc5369a..83b39932cf 100644
--- a/lib/cinder_plugins/nfs
+++ b/lib/cinder_plugins/nfs
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_plugins/nfs
 # Configure the nfs driver
 
diff --git a/lib/cinder_plugins/sheepdog b/lib/cinder_plugins/sheepdog
index 30c60c6efe..ca343f708b 100644
--- a/lib/cinder_plugins/sheepdog
+++ b/lib/cinder_plugins/sheepdog
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_plugins/sheepdog
 # Configure the sheepdog driver
 
diff --git a/lib/cinder_plugins/vsphere b/lib/cinder_plugins/vsphere
index 436b060377..f14ddf0998 100644
--- a/lib/cinder_plugins/vsphere
+++ b/lib/cinder_plugins/vsphere
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/cinder_plugins/vsphere
 # Configure the vsphere driver
 
diff --git a/lib/config b/lib/config
index a4d032864b..c0756bf3fe 100644
--- a/lib/config
+++ b/lib/config
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/config - Configuration file manipulation functions
 
 # These functions have no external dependencies and the following side-effects:
diff --git a/lib/database b/lib/database
index e226515347..366d2b3d2c 100644
--- a/lib/database
+++ b/lib/database
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/database
 # Interface for interacting with different database backends
 
diff --git a/lib/databases/mysql b/lib/databases/mysql
index eab1aa400f..d39d9667fc 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/databases/mysql
 # Functions to control the configuration and operation of the **MySQL** database backend
 
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index fb6d304180..76491c479d 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/databases/postgresql
 # Functions to control the configuration and operation of the **PostgreSQL** database backend
 
diff --git a/lib/dib b/lib/dib
index 30b31ec0ee..177f4c1ef0 100644
--- a/lib/dib
+++ b/lib/dib
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/dib
 # Install and build images with **diskimage-builder**
 
diff --git a/lib/dstat b/lib/dstat
index 4ec10dcefb..8f456a879f 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/dstat
 # Functions to start and stop dstat
 
diff --git a/lib/gantt b/lib/gantt
index 485613f2cb..5bd28c2823 100644
--- a/lib/gantt
+++ b/lib/gantt
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/gantt
 # Install and start **Gantt** scheduler service
 
diff --git a/lib/glance b/lib/glance
index b4c18f8ac7..2cffc5ef63 100644
--- a/lib/glance
+++ b/lib/glance
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/glance
 # Functions to control the configuration and operation of the **Glance** service
 
diff --git a/lib/heat b/lib/heat
index 3ed9a5ff41..f9ac03a43d 100644
--- a/lib/heat
+++ b/lib/heat
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/heat
 # Install and start **Heat** service
 
diff --git a/lib/horizon b/lib/horizon
index 9fd1b854c8..3f3b1ca28f 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/horizon
 # Functions to control the configuration and operation of the horizon service
 
diff --git a/lib/infra b/lib/infra
index cd439e723a..57df07deed 100644
--- a/lib/infra
+++ b/lib/infra
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/infra
 #
 # Functions to install infrastructure projects needed by other projects
diff --git a/lib/ironic b/lib/ironic
index 28f8fe87e5..6866ae77d0 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/ironic
 # Functions to control the configuration and operation of the **Ironic** service
 
diff --git a/lib/keystone b/lib/keystone
index 72a79be44d..a218732aaf 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/keystone
 # Functions to control the configuration and operation of **Keystone**
 
diff --git a/lib/ldap b/lib/ldap
index a6fb82f6f2..5beac38038 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/ldap
 # Functions to control the installation and configuration of **ldap**
 
diff --git a/lib/neutron b/lib/neutron
index 5a2bfea801..24d7c6cf68 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/neutron
 # functions - functions specific to neutron
 
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 9e84f2e75a..4166131534 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neuton Big Switch/FloodLight plugin
 # ------------------------------------
 
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 511fb71d61..b8166d9af9 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Brocade Neutron Plugin
 # ----------------------
 
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index 95e0ab3368..b067aa6b11 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron Cisco plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/embrane b/lib/neutron_plugins/embrane
index 7dafdc001f..6b4819ef70 100644
--- a/lib/neutron_plugins/embrane
+++ b/lib/neutron_plugins/embrane
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron Embrane plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/ibm b/lib/neutron_plugins/ibm
index 39b00401ae..3660a9f2b9 100644
--- a/lib/neutron_plugins/ibm
+++ b/lib/neutron_plugins/ibm
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron IBM SDN-VE plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 2638dd3725..ec17c01612 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron Linux Bridge L2 agent
 # -----------------------------
 
diff --git a/lib/neutron_plugins/midonet b/lib/neutron_plugins/midonet
index 6ccd502d97..eb27ed63dd 100644
--- a/lib/neutron_plugins/midonet
+++ b/lib/neutron_plugins/midonet
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron MidoNet plugin
 # ----------------------
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index f9a9774e98..e3b2c4dd28 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron Modular Layer 2 plugin
 # ------------------------------
 
diff --git a/lib/neutron_plugins/nec b/lib/neutron_plugins/nec
index f8d98c35fe..3b1a25716a 100644
--- a/lib/neutron_plugins/nec
+++ b/lib/neutron_plugins/nec
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron NEC OpenFlow plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 70de8fad01..7bce233853 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Nuage Neutron Plugin
 # ----------------------
 
diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index 90b37f1be9..915badc7a0 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # OpenFlow Agent plugin
 # ----------------------
 
diff --git a/lib/neutron_plugins/oneconvergence b/lib/neutron_plugins/oneconvergence
index 4fd8c7c48f..48a368a967 100644
--- a/lib/neutron_plugins/oneconvergence
+++ b/lib/neutron_plugins/oneconvergence
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron One Convergence plugin
 # ------------------------------
 
diff --git a/lib/neutron_plugins/openvswitch b/lib/neutron_plugins/openvswitch
index 3b6567cd0a..891ab4982b 100644
--- a/lib/neutron_plugins/openvswitch
+++ b/lib/neutron_plugins/openvswitch
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Common code used by cisco and embrane plugins
 # ---------------------------------------------
 
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e1a6f4a47f..2ab61b0c3e 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron Open vSwitch L2 agent
 # -----------------------------
 
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 07aa7cca9b..cde5298af8 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # common functions for ovs based plugin
 # -------------------------------------
 
diff --git a/lib/neutron_plugins/plumgrid b/lib/neutron_plugins/plumgrid
index 7950ac0605..0d711fe8b2 100644
--- a/lib/neutron_plugins/plumgrid
+++ b/lib/neutron_plugins/plumgrid
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # PLUMgrid Neutron Plugin
 # Edgar Magana emagana@plumgrid.com
 # ------------------------------------
diff --git a/lib/neutron_plugins/vmware_nsx b/lib/neutron_plugins/vmware_nsx
index f4eb82d04e..4cbedd6de4 100644
--- a/lib/neutron_plugins/vmware_nsx
+++ b/lib/neutron_plugins/vmware_nsx
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Neutron VMware NSX plugin
 # -------------------------
 
diff --git a/lib/neutron_thirdparty/bigswitch_floodlight b/lib/neutron_thirdparty/bigswitch_floodlight
index 033731e27c..e3f4689fd7 100644
--- a/lib/neutron_thirdparty/bigswitch_floodlight
+++ b/lib/neutron_thirdparty/bigswitch_floodlight
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Big Switch/FloodLight  OpenFlow Controller
 # ------------------------------------------
 
diff --git a/lib/neutron_thirdparty/midonet b/lib/neutron_thirdparty/midonet
index 099a66eb2d..2c82d487e4 100644
--- a/lib/neutron_thirdparty/midonet
+++ b/lib/neutron_thirdparty/midonet
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # MidoNet
 # -------
 
diff --git a/lib/neutron_thirdparty/ryu b/lib/neutron_thirdparty/ryu
index eaf088b797..1f78a21fa4 100644
--- a/lib/neutron_thirdparty/ryu
+++ b/lib/neutron_thirdparty/ryu
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Ryu SDN Framework
 # -----------------
 
diff --git a/lib/neutron_thirdparty/trema b/lib/neutron_thirdparty/trema
index 3e59ef2b28..075f013ded 100644
--- a/lib/neutron_thirdparty/trema
+++ b/lib/neutron_thirdparty/trema
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # Trema Sliceable Switch
 # ----------------------
 
diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
index 7a20c64afb..7027a29892 100644
--- a/lib/neutron_thirdparty/vmware_nsx
+++ b/lib/neutron_thirdparty/vmware_nsx
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # VMware NSX
 # ----------
 
diff --git a/lib/nova b/lib/nova
index 0e6c6afcf7..ebc3db5eeb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova
 # Functions to control the configuration and operation of the **Nova** service
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d3c4eab0aa..4601eea47b 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/functions-libvirt
 # Common libvirt configuration functions
 
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index dc93633410..3180d91f0a 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/hypervisor-fake
 # Configure the fake hypervisor
 
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index abf59b8008..4c2043b6b5 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/hypervisor-ironic
 # Configure the ironic hypervisor
 
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 53dbfb976f..cc6f29e0f8 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/hypervisor-libvirt
 # Configure the libvirt hypervisor
 
diff --git a/lib/nova_plugins/hypervisor-openvz b/lib/nova_plugins/hypervisor-openvz
index a1636adf9c..cce36b8d3f 100644
--- a/lib/nova_plugins/hypervisor-openvz
+++ b/lib/nova_plugins/hypervisor-openvz
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/hypervisor-openvz
 # Configure the openvz hypervisor
 
diff --git a/lib/nova_plugins/hypervisor-vsphere b/lib/nova_plugins/hypervisor-vsphere
index 9933a3c712..c406e094f3 100644
--- a/lib/nova_plugins/hypervisor-vsphere
+++ b/lib/nova_plugins/hypervisor-vsphere
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/hypervisor-vsphere
 # Configure the vSphere hypervisor
 
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 0dba471394..db19cc2fb6 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/nova_plugins/hypervisor-xenserver
 # Configure the XenServer hypervisor
 
diff --git a/lib/opendaylight b/lib/opendaylight
index 831329a750..936a17cbed 100644
--- a/lib/opendaylight
+++ b/lib/opendaylight
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/opendaylight
 # Functions to control the configuration and operation of the opendaylight service
 
diff --git a/lib/oslo b/lib/oslo
index d00580b14a..e0b4afebdb 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/oslo
 #
 # Functions to install oslo libraries from git
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 14c78fbf7b..4c1efa66cb 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/rpc_backend
 # Interface for interactig with different rpc backend
 # rpc backend settings
diff --git a/lib/sahara b/lib/sahara
index 4f1ba22c67..c902d385d1 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/sahara
 
 # Dependencies:
diff --git a/lib/stackforge b/lib/stackforge
index 2d80dad48c..cc3a689973 100644
--- a/lib/stackforge
+++ b/lib/stackforge
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/stackforge
 #
 # Functions to install stackforge libraries that we depend on so
diff --git a/lib/swift b/lib/swift
index 9e61331404..41f9e84afa 100644
--- a/lib/swift
+++ b/lib/swift
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/swift
 # Functions to control the configuration and operation of the **Swift** service
 
diff --git a/lib/tempest b/lib/tempest
index 46c9e26916..6894501319 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/tempest
 # Install and configure Tempest
 
diff --git a/lib/template b/lib/template
index f77409bd47..2703788af4 100644
--- a/lib/template
+++ b/lib/template
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/template
 # Functions to control the configuration and operation of the XXXX service
 # <do not include this template file in ``stack.sh``!>
diff --git a/lib/tls b/lib/tls
index fdb798ff30..677895b9b2 100644
--- a/lib/tls
+++ b/lib/tls
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/tls
 # Functions to control the configuration and operation of the TLS proxy service
 
diff --git a/lib/trove b/lib/trove
index 60b2bdba22..6cc5fa8f53 100644
--- a/lib/trove
+++ b/lib/trove
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/trove
 # Functions to control the configuration and operation of the **Trove** service
 
diff --git a/lib/zaqar b/lib/zaqar
index 22ef5ef20f..0d1f6f4aaf 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/zaqar
 # Install and start **Zaqar** service
 
diff --git a/stackrc b/stackrc
index ac798894b8..cb01f21942 100644
--- a/stackrc
+++ b/stackrc
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # stackrc
 #
 # Find the other rc files

From 342ac4b77429aa0ccf0bfbd864d91477cfb656c0 Mon Sep 17 00:00:00 2001
From: Sabari Kumar Murugesan <smurugesan@vmware.com>
Date: Tue, 9 Dec 2014 15:54:40 -0800
Subject: [PATCH 0168/3333] Use latest version of python-openstackclient

Some options in openstack client like --or-show are available only
from 1.0.0. Adding this 'requirement' explictly as openstackclient
is not as part of requirements of other projects.

Change-Id: I96a98331ece15da869a3ea7af80d16fab2351329
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index cd1c200404..375be2846d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -780,7 +780,7 @@ if use_library_from_git "python-openstackclient"; then
     git_clone_by_name "python-openstackclient"
     setup_dev_lib "python-openstackclient"
 else
-    pip_install python-openstackclient
+    pip_install 'python-openstackclient>=1.0.0'
 fi
 
 

From 63d25d978ba0a0cdb1b689cafcebdaae7d609e06 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Tue, 9 Dec 2014 15:21:22 +0000
Subject: [PATCH 0169/3333] Allow use of dnf instead of yum on Fedora

Since Fedora 20 it has been possible to use 'dnf' as a drop-in
replacement for 'yum', and it is targetted to become the default
in Fedora 22

   http://fedoraproject.org/wiki/Changes/ReplaceYumWithDNF

There are many benefits of 'dnf' over 'yum' but the biggest
from the POV of an openstack developer is its speed.

Assuming an existing running devstack install ie all required
RPMs already installed on the system. Now look at how long it
takes to run stack.sh, during which yum does not have to
actually install anything

 # ./unstack.sh
 # time ./stack.sh
 real 11m12.193s
 user 10m17.129s
 sys  0m15.275s

Now, with 'export YUM=dnf' set in local.conf, run the same
test again

 # ./unstack.sh
 # time ./stack.sh
 real 0m48.610s
 user 0m28.939s
 sys  0m7.801s

So, this is showing that devstack is wasting 10 minutes just
for yum to figure out that everything is already installed.
The overhead of yum vs dnf is even worse when yum has to
acutally depsolve to install new packages.

Change-Id: Ia01a5f330a47b32207586902a861bedfc8a0f6e2
---
 functions-common | 8 ++++----
 stackrc          | 6 ++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 24507fef91..83db9d3667 100644
--- a/functions-common
+++ b/functions-common
@@ -1165,7 +1165,7 @@ function uninstall_package {
     if is_ubuntu; then
         apt_get purge "$@"
     elif is_fedora; then
-        sudo yum remove -y "$@"
+        sudo $YUM remove -y "$@" ||:
     elif is_suse; then
         sudo zypper rm "$@"
     else
@@ -1174,7 +1174,7 @@ function uninstall_package {
 }
 
 # Wrapper for ``yum`` to set proxy environment variables
-# Uses globals ``OFFLINE``, ``*_proxy``
+# Uses globals ``OFFLINE``, ``*_proxy``, ``YUM``
 # yum_install package [package ...]
 function yum_install {
     [[ "$OFFLINE" = "True" ]] && return
@@ -1186,7 +1186,7 @@ function yum_install {
     # https://bugzilla.redhat.com/show_bug.cgi?id=965567
     $sudo http_proxy=$http_proxy https_proxy=$https_proxy \
         no_proxy=$no_proxy \
-        yum install -y "$@" 2>&1 | \
+        $YUM install -y "$@" 2>&1 | \
         awk '
             BEGIN { fail=0 }
             /No package/ { fail=1 }
@@ -1196,7 +1196,7 @@ function yum_install {
 
     # also ensure we catch a yum failure
     if [[ ${PIPESTATUS[0]} != 0 ]]; then
-        die $LINENO "Yum install failure"
+        die $LINENO "$YUM install failure"
     fi
 }
 
diff --git a/stackrc b/stackrc
index ac798894b8..2a5d877223 100644
--- a/stackrc
+++ b/stackrc
@@ -621,6 +621,12 @@ API_WORKERS=${API_WORKERS:=$(( ($(nproc)/2)<2 ? 2 : ($(nproc)/2) ))}
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 
+# Support alternative yum -- in future Fedora 'dnf' will become the
+# only supported installer, but for now 'yum' and 'dnf' are both
+# available in parallel with compatible CLIs.  Allow manual switching
+# till we get to the point we need to handle this automatically
+YUM=${YUM:-yum}
+
 # Following entries need to be last items in file
 
 # Local variables:

From 2bfb9af0c952f59287be4ce684b78cfb710a6105 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 7 Nov 2014 07:44:25 -0600
Subject: [PATCH 0170/3333] Remove NoVNC from the default enabled services

Preparing to remove all non-stackforge git repos

Change-Id: I91f628f09fcdfd1aefbc40c9e26be0509eee484d
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 15b0951a1a..6881a517d8 100644
--- a/stackrc
+++ b/stackrc
@@ -44,7 +44,7 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 # this allows us to pass ENABLED_SERVICES
 if [[ -z "$ENABLED_SERVICES" ]]; then
     # core compute (glance / keystone / nova (+ nova-network))
-    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-novnc,n-xvnc,n-cauth
+    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-xvnc,n-cauth
     # cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # heat

From 21dbe993348b794a1b77c4f9db0081d1cc32138c Mon Sep 17 00:00:00 2001
From: Christian Berendt <berendt@b1-systems.de>
Date: Tue, 9 Dec 2014 21:01:40 +0100
Subject: [PATCH 0171/3333] Update used Fedora images to version 21

Change-Id: I26a3d7d0842f9d4c5fc33350992a19f597f39b2e
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index ac798894b8..9960a1b320 100644
--- a/stackrc
+++ b/stackrc
@@ -552,7 +552,7 @@ esac
 if [[ "$ENABLED_SERVICES" =~ 'h-api' ]]; then
     case "$VIRT_DRIVER" in
         libvirt|ironic)
-            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"}
+            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.qcow2"}
             IMAGE_URLS+=",$HEAT_CFN_IMAGE_URL"
             ;;
         *)
@@ -577,7 +577,7 @@ fi
 PRECACHE_IMAGES=$(trueorfalse False $PRECACHE_IMAGES)
 if [[ "$PRECACHE_IMAGES" == "True" ]]; then
     # staging in update for nodepool
-    IMAGE_URL="https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"
+    IMAGE_URL="https://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.qcow2"
     if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
         IMAGE_URLS+=",$IMAGE_URL"
     fi

From 0c99e2f65b6e86236c0d29928c110628f1e32f3d Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Tue, 9 Dec 2014 14:44:24 -0800
Subject: [PATCH 0172/3333] Poll resource tracker for ironic cpus as well as
 count

When ironic nodes are enrolled, their resources are not available
to the nova scheduler until after a round of ironic and nova periodic
tasks have run  In addition to waiting for ironic nodes to show up in
the resource tracker, also wait for associated CPU resources.  In
the worst case, this means waiting for 3 total rounds of periodic
tasks.

Change-Id: Idbbc43bf74ff5fff3d50f3494148454bb51e378f
Closes-bug: #1398128
---
 lib/ironic | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index e79842c0f3..abf4700949 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -501,18 +501,20 @@ function create_bridge_and_vms {
 }
 
 function wait_for_nova_resources {
-    # After nodes have been enrolled, we need to wait for n-cpu's periodic
-    # task populate the resource tracker with available nodes.  Wait for 2
-    # minutes before timing out.
-    local expected_count=$1
-    echo_summary "Waiting 2 minutes for Nova resource tracker to pick up $expected_count Ironic nodes"
+    # After nodes have been enrolled, we need to wait for both ironic and
+    # nova's periodic tasks to populate the resource tracker with available
+    # nodes and resources. Wait up to 2 minutes for a given resource before
+    # timing out.
+    local resource=$1
+    local expected_count=$2
+    echo_summary "Waiting 2 minutes for Nova resource tracker to pick up $resource >= $expected_count"
     for i in $(seq 1 120); do
-        if [ $(nova hypervisor-stats | grep " count " | get_field 2) -ge $expected_count ]; then
+        if [ $(nova hypervisor-stats | grep " $resource " | get_field 2) -ge $expected_count ]; then
             return 0
         fi
         sleep 1
     done
-    die $LINENO "Nova hypervisor-stats did not register at least $expected_count nodes"
+    die $LINENO "Timed out waiting for Nova hypervisor-stats $resource >= $expected_count"
 }
 
 function enroll_nodes {
@@ -551,6 +553,7 @@ function enroll_nodes {
     fi
 
     local total_nodes=0
+    local total_cpus=0
     while read hardware_info; do
         if ! is_ironic_hardware; then
             local mac_address=$hardware_info
@@ -582,6 +585,7 @@ function enroll_nodes {
         ironic port-create --address $mac_address --node_uuid $node_id
 
         total_nodes=$((total_nodes+1))
+        total_cpus=$((total_cpus+$ironic_node_cpu))
     done < $ironic_hwinfo_file
 
     # create the nova flavor
@@ -598,7 +602,8 @@ function enroll_nodes {
     nova flavor-key baremetal set "cpu_arch"="x86_64" "baremetal:deploy_kernel_id"="$IRONIC_DEPLOY_KERNEL_ID" "baremetal:deploy_ramdisk_id"="$IRONIC_DEPLOY_RAMDISK_ID"
 
     if [ "$VIRT_DRIVER" == "ironic" ]; then
-        wait_for_nova_resources $total_nodes
+        wait_for_nova_resources "count" $total_nodes
+        wait_for_nova_resources "vcpus" $total_cpus
     fi
 }
 

From d5b74c688febfafb69ddc3881d9936e0268daa4c Mon Sep 17 00:00:00 2001
From: Abhishek Chanda <abhishek@cloudscaling.com>
Date: Fri, 12 Dec 2014 02:15:55 +0530
Subject: [PATCH 0173/3333] Take an optional rabbit user name as input

Newer versions of rabbitmq (3.3 and later) do not allow the 'guest'
user to access on non-local interfaces.

- Added a new config RABBIT_USERID which defaults to stackrabbit
- Invoked config scripts using that variable

Adopted from:
https://review.openstack.org/#/c/107779/

Change-Id: I43a231c9611b4cc2e390b603aa3bfb49c915bdc5
Closes-Bug: #1343354
Co-Authored-By: Scott Moser <smoser@ubuntu.com>
---
 lib/keystone    |  1 +
 lib/nova        |  4 ++--
 lib/rpc_backend | 26 +++++++++++++++++++++++---
 lib/trove       |  4 ++++
 stack.sh        |  1 +
 5 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index a218732aaf..9c0b01378c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -214,6 +214,7 @@ function configure_keystone {
 
     # Configure rabbitmq credentials
     if is_service_enabled rabbit; then
+        iniset $KEYSTONE_CONF DEFAULT rabbit_userid $RABBIT_USERID
         iniset $KEYSTONE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
         iniset $KEYSTONE_CONF DEFAULT rabbit_host $RABBIT_HOST
     fi
diff --git a/lib/nova b/lib/nova
index 4c86d79130..cbfbdfa69f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -587,8 +587,8 @@ function init_nova_cells {
         fi
 
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=guest --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
-        $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=guest --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
+        $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
     fi
 }
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 4c1efa66cb..6afec370e8 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -7,7 +7,7 @@
 # Dependencies:
 #
 # - ``functions`` file
-# - ``RABBIT_{HOST|PASSWORD}`` must be defined when RabbitMQ is used
+# - ``RABBIT_{HOST|PASSWORD|USERID}`` must be defined when RabbitMQ is used
 # - ``RPC_MESSAGING_PROTOCOL`` option for configuring the messaging protocol
 
 # ``stack.sh`` calls the entry points in this order:
@@ -68,6 +68,9 @@ function check_rpc_backend {
 function cleanup_rpc_backend {
     if is_service_enabled rabbit; then
         # Obliterate rabbitmq-server
+        if [ -n "$RABBIT_USERID" ]; then
+            sudo rabbitmqctl delete_user "$RABBIT_USERID"
+        fi
         uninstall_package rabbitmq-server
         sudo killall epmd || sudo killall -9 epmd
         if is_ubuntu; then
@@ -180,15 +183,16 @@ function restart_rpc_backend {
                 # service is not started by default
                 restart_service rabbitmq-server
             fi
+            rabbit_setuser "$RABBIT_USERID" "$RABBIT_PASSWORD"
             # change the rabbit password since the default is "guest"
-            sudo rabbitmqctl change_password guest $RABBIT_PASSWORD && break
+            sudo rabbitmqctl change_password $RABBIT_USERID $RABBIT_PASSWORD && break
             [[ $i -eq "10" ]] && die $LINENO "Failed to set rabbitmq password"
         done
         if is_service_enabled n-cell; then
             # Add partitioned access for the child cell
             if [ -z `sudo rabbitmqctl list_vhosts | grep child_cell` ]; then
                 sudo rabbitmqctl add_vhost child_cell
-                sudo rabbitmqctl set_permissions -p child_cell guest ".*" ".*" ".*"
+                sudo rabbitmqctl set_permissions -p child_cell $RABBIT_USERID ".*" ".*" ".*"
             fi
         fi
     elif is_service_enabled qpid; then
@@ -225,6 +229,7 @@ function iniset_rpc_backend {
         iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_kombu
         iniset $file $section rabbit_hosts $RABBIT_HOST
         iniset $file $section rabbit_password $RABBIT_PASSWORD
+        iniset $file $section rabbit_userid $RABBIT_USERID
     fi
 }
 
@@ -239,6 +244,21 @@ function qpid_is_supported {
     ( ! is_suse )
 }
 
+function rabbit_setuser {
+    local user="$1" pass="$2" found="" out=""
+    out=$(sudo rabbitmqctl list_users) ||
+        { echo "failed to list users" 1>&2; return 1; }
+    found=$(echo "$out" | awk '$1 == user { print $1 }' "user=$user")
+    if [ "$found" = "$user" ]; then
+        sudo rabbitmqctl change_password "$user" "$pass" ||
+            { echo "failed changing pass for '$user'" 1>&2; return 1; }
+    else
+        sudo rabbitmqctl add_user "$user" "$pass" ||
+            { echo "failed changing pass for $user"; return 1; }
+    fi
+    sudo rabbitmqctl set_permissions "$user" ".*" ".*" ".*"
+}
+
 # Set up the various configuration files used by the qpidd broker
 function _configure_qpid {
 
diff --git a/lib/trove b/lib/trove
index 6cc5fa8f53..4149b0d592 100644
--- a/lib/trove
+++ b/lib/trove
@@ -134,6 +134,7 @@ function configure_trove {
     rm -f $TROVE_CONF_DIR/trove-taskmanager.conf
     rm -f $TROVE_CONF_DIR/trove-conductor.conf
 
+    iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
     iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_password $RABBIT_PASSWORD
     iniset $TROVE_CONF_DIR/trove.conf DEFAULT sql_connection `database_connection_url trove`
     iniset $TROVE_CONF_DIR/trove.conf DEFAULT default_datastore $TROVE_DATASTORE_TYPE
@@ -145,6 +146,7 @@ function configure_trove {
     if is_service_enabled tr-tmgr; then
         TROVE_AUTH_ENDPOINT=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
 
+        iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
         iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT rabbit_password $RABBIT_PASSWORD
         iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT sql_connection `database_connection_url trove`
         iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
@@ -157,6 +159,7 @@ function configure_trove {
 
     # (Re)create trove conductor conf file if needed
     if is_service_enabled tr-cond; then
+        iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
         iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT rabbit_password $RABBIT_PASSWORD
         iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT sql_connection `database_connection_url trove`
         iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT nova_proxy_admin_user radmin
@@ -168,6 +171,7 @@ function configure_trove {
     fi
 
     # Set up Guest Agent conf
+    iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_host $TROVE_HOST_GATEWAY
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_password $RABBIT_PASSWORD
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT nova_proxy_admin_user radmin
diff --git a/stack.sh b/stack.sh
index 375be2846d..d97139aaa7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -643,6 +643,7 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 
 # Rabbit connection info
 if is_service_enabled rabbit; then
+    RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
     RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
     read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."
 fi

From 6d012cf16f8d0f4f0a2fae4f5215fadf9884f7fc Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Fri, 12 Dec 2014 00:52:59 +0000
Subject: [PATCH 0174/3333] Revert "Update used Fedora images to version 21"

This breaks check-heat-dsvm-functional-mysql which assumes the previous glance image name.

This reverts commit 21dbe993348b794a1b77c4f9db0081d1cc32138c.

Change-Id: I77749f3f9f1a64719447ddd25ee95bc6d3afa5b3
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 9960a1b320..ac798894b8 100644
--- a/stackrc
+++ b/stackrc
@@ -552,7 +552,7 @@ esac
 if [[ "$ENABLED_SERVICES" =~ 'h-api' ]]; then
     case "$VIRT_DRIVER" in
         libvirt|ironic)
-            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.qcow2"}
+            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"}
             IMAGE_URLS+=",$HEAT_CFN_IMAGE_URL"
             ;;
         *)
@@ -577,7 +577,7 @@ fi
 PRECACHE_IMAGES=$(trueorfalse False $PRECACHE_IMAGES)
 if [[ "$PRECACHE_IMAGES" == "True" ]]; then
     # staging in update for nodepool
-    IMAGE_URL="https://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.qcow2"
+    IMAGE_URL="https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"
     if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
         IMAGE_URLS+=",$IMAGE_URL"
     fi

From 31f70b4016b9f65325d1f7d2d7fc594b4dc98c12 Mon Sep 17 00:00:00 2001
From: Zhongyue Luo <zhongyue.nah@intel.com>
Date: Fri, 12 Dec 2014 15:41:17 +0800
Subject: [PATCH 0175/3333] Delete is_ironic function

This function is not used in DevStack anymore.

Change-Id: I4a4430e451094d638704a2da1eb2de7f22f25b84
---
 lib/ironic | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index fe7b1df2d4..571202d2fd 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -444,13 +444,6 @@ function stop_ironic {
     fi
 }
 
-function is_ironic {
-    if ( is_service_enabled ir-cond && is_service_enabled ir-api ); then
-        return 0
-    fi
-    return 1
-}
-
 function create_ovs_taps {
     local ironic_net_id=$(neutron net-list | grep private | get_field 1)
 

From be485221b321ebb418f3f5dd8d86e164797f07de Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Wed, 10 Dec 2014 10:33:53 +0000
Subject: [PATCH 0176/3333] XenAPI: Simplify installed packages

Remove duplicate packages.
pip is handled by devstack, so don't try and install it here.

Change-Id: I6f22e0f86ae071d30bf69de9ed5dec6b28ebc92b
---
 lib/nova_plugins/hypervisor-xenserver | 3 +--
 tools/xen/prepare_guest.sh            | 4 +---
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index db19cc2fb6..4d0ec898ad 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -94,8 +94,7 @@ CRONTAB
 
 # install_nova_hypervisor() - Install external components
 function install_nova_hypervisor {
-    # This function intentionally left blank
-    :
+    pip_install xenapi
 }
 
 # start_nova_hypervisor - Start any required external services
diff --git a/tools/xen/prepare_guest.sh b/tools/xen/prepare_guest.sh
index 7383c91e37..7fe032a064 100755
--- a/tools/xen/prepare_guest.sh
+++ b/tools/xen/prepare_guest.sh
@@ -73,9 +73,7 @@ EOF
 # Install basics
 apt-get update
 apt-get install -y cracklib-runtime curl wget ssh openssh-server tcpdump ethtool
-apt-get install -y curl wget ssh openssh-server python-pip git sudo python-netaddr
-apt-get install -y coreutils
-pip install xenapi
+apt-get install -y git sudo python-netaddr coreutils
 
 # Install XenServer guest utilities
 dpkg -i $XS_TOOLS_PATH

From d4a6e355cab59f61c269139092e261aa105f52dc Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Thu, 11 Dec 2014 14:53:17 -0800
Subject: [PATCH 0177/3333] Enroll Ironic nodes /w IRONIC_KEY_FILE

Do not compose a full path to the ironic ssh keyfile.  Instead,
use IRONIC_KEY_FILE which will be set to the full path to the key.
This is required when IRONIC_KEY_FILE is user-specified, otherwise
we're still enrolling nodes with the default path that is only
used when generating a key.

Change-Id: Icf1ba97becc3e800caf9329a16b79cf106ac3c9a
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 3f7ae2111c..55272b9a1d 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -536,7 +536,7 @@ function enroll_nodes {
             -i ssh_address=$IRONIC_VM_SSH_ADDRESS \
             -i ssh_port=$IRONIC_VM_SSH_PORT \
             -i ssh_username=$IRONIC_SSH_USERNAME \
-            -i ssh_key_filename=$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME"
+            -i ssh_key_filename=$IRONIC_KEY_FILE"
     else
         local ironic_node_cpu=$IRONIC_HW_NODE_CPU
         local ironic_node_ram=$IRONIC_HW_NODE_RAM

From 7bb9a73b8cbb62b31cbf8faa0f19d9c609b359fd Mon Sep 17 00:00:00 2001
From: Sushil Kumar <skm.net@gmail.com>
Date: Sat, 13 Dec 2014 16:32:11 +0000
Subject: [PATCH 0178/3333] Adds missing rabbit_userid to trove configs

- rabbit_userid was only updated in trove.conf leaving other
  trove configuration files not having this value.
- Trove service setup was broken because of this.
- Added rabbit_userid to trove-taskmanager.conf,
  trove-conductor.conf and trove-guest.conf.

Change-Id: I60bd160600ec4a02c94ee5e33e4bc91c9f2aa2ed
Closes-Bug: #1402227
---
 lib/trove | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/trove b/lib/trove
index 4149b0d592..8b7b0ef640 100644
--- a/lib/trove
+++ b/lib/trove
@@ -146,7 +146,7 @@ function configure_trove {
     if is_service_enabled tr-tmgr; then
         TROVE_AUTH_ENDPOINT=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
 
-        iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
+        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT rabbit_userid $RABBIT_USERID
         iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT rabbit_password $RABBIT_PASSWORD
         iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT sql_connection `database_connection_url trove`
         iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
@@ -159,7 +159,7 @@ function configure_trove {
 
     # (Re)create trove conductor conf file if needed
     if is_service_enabled tr-cond; then
-        iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
+        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT rabbit_userid $RABBIT_USERID
         iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT rabbit_password $RABBIT_PASSWORD
         iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT sql_connection `database_connection_url trove`
         iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT nova_proxy_admin_user radmin
@@ -171,7 +171,7 @@ function configure_trove {
     fi
 
     # Set up Guest Agent conf
-    iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
+    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_userid $RABBIT_USERID
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_host $TROVE_HOST_GATEWAY
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_password $RABBIT_PASSWORD
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT nova_proxy_admin_user radmin

From 3b782d304ec2073a6406c37b9e1a76c8aecfc9a3 Mon Sep 17 00:00:00 2001
From: Ruslan Kamaldinov <rkamaldinov@mirantis.com>
Date: Sat, 13 Dec 2014 23:18:31 +0300
Subject: [PATCH 0179/3333] Pin version of setuptools

Latest release of setuptool 8.0 made several versions used in
requirements.txt of OpenStack projects invalid. Instances:
* SQLAlchemy>=0.8.4,<=0.8.99,>=0.9.7,<=0.9.99 in oslo.db 1.2.0
* python-neutronclient 2.3.9.40.g9ed73c0 in openstackclient

Cap '<8.0' is set as a temporary fix until a better solution
comes up.

Change-Id: I4cfe2e4c86474ec9bf69a3c2007c0277288ea2b6
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 55ef93e44d..c9119ae410 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -83,6 +83,6 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-pip_install -U setuptools
+pip_install -U "setuptools<8.0"
 
 get_versions

From dc31f76a27a909d010408428d938121b3abd3101 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sat, 13 Dec 2014 23:34:15 -0500
Subject: [PATCH 0180/3333] Add WSGIPassAuthorization to the keystone apache
 template

For the OS-OAUTH1 Keystone extension to fully work under Apache,
the WSGIPassAuthorization parameter must be set to On, rather
than the default of Off. This will make functional testing of
this extension much easier.

Change-Id: I5dcbdd27e7ef7a60fe3c7cb8b9c3c83b4197dfc1
---
 files/apache-keystone.template | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 88492d3408..b0cfb84ce0 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -6,6 +6,7 @@ Listen %ADMINPORT%
     WSGIProcessGroup keystone-public
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
     <IfVersion >= 2.4>
       ErrorLogFormat "%{cu}t %M"
     </IfVersion>

From 1f65fd64ce2f4ed32a706f9bcb28c2ee0cf51e5b Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Sat, 13 Dec 2014 11:56:16 -0700
Subject: [PATCH 0181/3333] Clear multi-line sections before adding lines

With multiline support for local.conf, the first line is created with
iniset, which will set *all* previous lines to the same thing, and then
subsequent lines will be added. Modify the multiline support to first
clear existing lines from the section.

This causes fatal errors with neutron.conf, which defines drivers with a bunch
of service_provider= options, and the current code ends up with the first
driver defined in local.conf being present twice.

Change-Id: If132a94e53545d9134859aa508da7b9819ede2f8
---
 functions-common  | 15 +++++++++++++
 lib/config        |  1 +
 tests/test_ini.sh | 55 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 71 insertions(+)

diff --git a/functions-common b/functions-common
index 94ab34763e..352102e24a 100644
--- a/functions-common
+++ b/functions-common
@@ -148,6 +148,21 @@ $option = $value
     $xtrace
 }
 
+function inidelete {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+
+    [[ -z $section || -z $option ]] && return
+
+    # Remove old values
+    sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
+
+    $xtrace
+}
+
 # Set an option in an INI file
 # iniset config-file section option value
 function iniset {
diff --git a/lib/config b/lib/config
index c0756bf3fe..31c6fa6e57 100644
--- a/lib/config
+++ b/lib/config
@@ -144,6 +144,7 @@ function merge_config_file {
                     else {
                         # For multiline, invoke the ini routines in the reverse order
                         count = cfg_attr_count[section, attr]
+                        print "inidelete " configfile " " section " " attr
                         print "iniset " configfile " " section " " attr " \"" cfg_attr[section, attr, count - 1] "\""
                         for (l = count -2; l >= 0; l--)
                             print "iniadd_literal " configfile " " section " " attr " \"" cfg_attr[section, attr, l] "\""
diff --git a/tests/test_ini.sh b/tests/test_ini.sh
index 598cd578f6..106cc9507f 100755
--- a/tests/test_ini.sh
+++ b/tests/test_ini.sh
@@ -34,6 +34,32 @@ empty =
 [eee]
 multi = foo1
 multi = foo2
+
+# inidelete(a)
+[del_separate_options]
+a=b
+b=c
+
+# inidelete(a)
+[del_same_option]
+a=b
+a=c
+
+# inidelete(a)
+[del_missing_option]
+b=c
+
+# inidelete(a)
+[del_missing_option_multi]
+b=c
+b=d
+
+# inidelete(a)
+[del_no_options]
+
+# inidelete(a)
+# no section - del_no_section
+
 EOF
 
 # Test with missing arguments
@@ -237,4 +263,33 @@ else
     echo "iniadd with non-exsting failed: $VAL"
 fi
 
+# Test inidelete
+del_cases="
+    del_separate_options
+    del_same_option
+    del_missing_option
+    del_missing_option_multi
+    del_no_options
+    del_no_section"
+
+for x in $del_cases; do
+    inidelete test.ini $x a
+    VAL=$(iniget_multiline test.ini $x a)
+    if [ -z "$VAL" ]; then
+        echo "OK: inidelete $x"
+    else
+        echo "inidelete $x failed: $VAL"
+    fi
+    if [ "$x" = "del_separate_options" -o \
+        "$x" = "del_missing_option" -o \
+        "$x" = "del_missing_option_multi" ]; then
+        VAL=$(iniget_multiline test.ini $x b)
+        if [ "$VAL" = "c" -o "$VAL" = "c d" ]; then
+            echo "OK: inidelete other_options $x"
+        else
+            echo "inidelete other_option $x failed: $VAL"
+        fi
+    fi
+done
+
 rm test.ini

From 1cbb5d3f0c3200ce0446de59a8b9b3af1b8db483 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 15 Dec 2014 14:57:15 -0500
Subject: [PATCH 0182/3333] Clean database ubuntu/RHEL/SUSE use
 uninstall_package and clean /var/lib/mysql

Change-Id: I72c9df06903e536320a807fae8b817379e448444
Related-Bug: #1395776
---
 lib/databases/mysql | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index d39d9667fc..0e423de675 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -23,22 +23,27 @@ function cleanup_database_mysql {
     if is_ubuntu; then
         # Get ruthless with mysql
         stop_service $MYSQL
-        apt_get purge -y mysql*
+        uninstall_package mysql-server mariadb-server
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return
     elif is_fedora; then
         if [[ $DISTRO =~ (rhel6) ]]; then
-            MYSQL=mysqld
+            stop_service mysqld
+            uninstall_package mysql-server
+            sudo rm -rf /var/lib/mysql
         else
-            MYSQL=mariadb
+            stop_service mariadb
+            uninstall_package mariadb-server
+            sudo rm -rf /var/lib/mysql
         fi
     elif is_suse; then
-        MYSQL=mysql
+        stop_service mysql
+        uninstall_package mysql-community-server
+        sudo rm -rf /var/lib/mysql
     else
         return
     fi
-    stop_service $MYSQL
 }
 
 function recreate_database_mysql {

From f3e75bf979bac5330034d350c416c61df7d8feb4 Mon Sep 17 00:00:00 2001
From: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
Date: Mon, 15 Dec 2014 20:02:08 +0200
Subject: [PATCH 0183/3333] Fixes Heat tempest issue due to hardcoded qcow2
 extension

The orchestration image_ref is set incorrectly if the extension is not
qcow2, as a result tempest cannot find the Glance image and the
associated tests fail.

This patch fixes the issue by handling any extension.

Change-Id: I32ffe021714590a1b1bab232b1d4f5da238bd4d8
Closes-Bug: #1402774
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 6fc157fa7d..7cac6dd642 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -372,7 +372,7 @@ function configure_tempest {
     # Orchestration Tests
     if is_service_enabled heat; then
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
-            iniset $TEMPEST_CONFIG orchestration image_ref $(basename "$HEAT_CFN_IMAGE_URL" ".qcow2")
+            iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
         # build a specialized heat flavor
         available_flavors=$(nova flavor-list)

From ef844fd08da208947c8e5d8e74e598d7cf7072af Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 15 Dec 2014 16:32:43 -0500
Subject: [PATCH 0184/3333] remove $KEYSTONE_TOKEN_HASH_ALGORITHM

Now that Keystone is back to UUID token defaults the use case for this
in devstack is extremely dubious, and it can be set through via
local.conf if anyone *really* cares.

Part of bp:devstack-nounset

Change-Id: I644b5b1579952959d253758b2a12b97d8a704657
---
 lib/horizon  | 3 ---
 lib/keystone | 7 -------
 2 files changed, 10 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 3f3b1ca28f..edb95e9812 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -105,9 +105,6 @@ function init_horizon {
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
-    if [[ -n "$KEYSTONE_TOKEN_HASH_ALGORITHM" ]]; then
-        _horizon_config_set $local_settings "" OPENSTACK_TOKEN_HASH_ALGORITHM \""$KEYSTONE_TOKEN_HASH_ALGORITHM"\"
-    fi
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
diff --git a/lib/keystone b/lib/keystone
index 9c0b01378c..071dc908ae 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -318,10 +318,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT admin_workers "$API_WORKERS"
     # Public workers will use the server default, typically number of CPU.
-
-    if [[ -n "$KEYSTONE_TOKEN_HASH_ALGORITHM" ]]; then
-        iniset $KEYSTONE_CONF token hash_algorithm "$KEYSTONE_TOKEN_HASH_ALGORITHM"
-    fi
 }
 
 function configure_keystone_extensions {
@@ -443,9 +439,6 @@ function configure_auth_token_middleware {
     iniset $conf_file $section admin_user $admin_user
     iniset $conf_file $section admin_password $SERVICE_PASSWORD
     iniset $conf_file $section signing_dir $signing_dir
-    if [[ -n "$KEYSTONE_TOKEN_HASH_ALGORITHM" ]]; then
-        iniset $conf_file keystone_authtoken hash_algorithms "$KEYSTONE_TOKEN_HASH_ALGORITHM"
-    fi
 }
 
 # init_keystone() - Initialize databases, etc.

From 64b56a53d8f5136c6902ce0fa948317f171a664d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Dec 2014 09:53:36 +1100
Subject: [PATCH 0185/3333] Fix rabbitmq retry for error checking

I think this retry check has been broken since we introduced "set -e".
Unfortunately it seems the issue of rabbitmq not starting first-time
persists on centos 7 hosts occasionally, e.g. [1]:

---
 + rabbit_setuser stackrabbit secretrabbit
 + local user=stackrabbit pass=secretrabbit found= out=
 ++ sudo rabbitmqctl list_users
 Error: unable to connect to node 'rabbit@devstack-centos7-rax-iad-100675': nodedown

 DIAGNOSTICS
 ===========

 nodes in question: ['rabbit@devstack-centos7-rax-iad-100675']

 hosts, their running nodes and ports:
 - devstack-centos7-rax-iad-100675: [{rabbitmqctl29293,39511}]

 current node details:
 - node name: 'rabbitmqctl29293@devstack-centos7-rax-iad-100675'
 - home dir: /var/lib/rabbitmq
 - cookie hash: KieJnx1pnllKbHVihGcDqA==
---

Fix up this retry while we investigate [2]

[1] http://logs.openstack.org/64/141864/1/check//check-tempest-dsvm-centos7/4308f0c/logs/devstacklog.txt.gz
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1144100

Change-Id: I11fb3728e08adc1e0f7acca63e5a308d24dce78e
---
 lib/rpc_backend | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 6afec370e8..400204abe1 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -176,17 +176,31 @@ function restart_rpc_backend {
         echo_summary "Starting RabbitMQ"
         # NOTE(bnemec): Retry initial rabbitmq configuration to deal with
         # the fact that sometimes it fails to start properly.
-        # Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1059028
+        # Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1144100
         local i
         for i in `seq 10`; do
+            local rc=0
+
+            [[ $i -eq "10" ]] && die $LINENO "Failed to set rabbitmq password"
+
             if is_fedora || is_suse; then
                 # service is not started by default
                 restart_service rabbitmq-server
             fi
-            rabbit_setuser "$RABBIT_USERID" "$RABBIT_PASSWORD"
+
+            rabbit_setuser "$RABBIT_USERID" "$RABBIT_PASSWORD" || rc=$?
+            if [ $rc -ne 0 ]; then
+                continue
+            fi
+
             # change the rabbit password since the default is "guest"
-            sudo rabbitmqctl change_password $RABBIT_USERID $RABBIT_PASSWORD && break
-            [[ $i -eq "10" ]] && die $LINENO "Failed to set rabbitmq password"
+            sudo rabbitmqctl change_password \
+                $RABBIT_USERID $RABBIT_PASSWORD || rc=$?
+            if [ $rc -ne 0 ]; then
+                continue;
+            fi
+
+            break
         done
         if is_service_enabled n-cell; then
             # Add partitioned access for the child cell

From fc99426a907473de3fc392c19eded30b88e8f46f Mon Sep 17 00:00:00 2001
From: Zhang Jinnan <zhang.jinnan@99cloud.net>
Date: Sun, 14 Dec 2014 19:19:53 -0500
Subject: [PATCH 0186/3333] Install Juno RDO repos for RHEL7

RHEL7 does not include Open vSwitch in the default repos, but it
is available via the RDO repo.  This patch automatically
configures the RDO repo for RHEL7.

Move this into the existing rhel6/rhel7 section.  We update RHEl6 to
the latest icehouse release, but it is not supported with Juno

Closes-Bug: #1402390
Change-Id: I4707cf68e39d9e900ec6c01331d7e124c8c4f6c4
---
 stack.sh | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/stack.sh b/stack.sh
index d97139aaa7..bbb7d75a4a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -212,17 +212,6 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-if is_fedora && [ $DISTRO == "rhel6" ]; then
-    # Installing Open vSwitch on RHEL requires enabling the RDO repo.
-    RHEL6_RDO_REPO_RPM=${RHEL6_RDO_REPO_RPM:-"http://rdo.fedorapeople.org/openstack-icehouse/rdo-release-icehouse.rpm"}
-    RHEL6_RDO_REPO_ID=${RHEL6_RDO_REPO_ID:-"openstack-icehouse"}
-    if ! sudo yum repolist enabled $RHEL6_RDO_REPO_ID | grep -q $RHEL6_RDO_REPO_ID; then
-        echo "RDO repo not detected; installing"
-        yum_install $RHEL6_RDO_REPO_RPM || \
-            die $LINENO "Error installing RDO repo, cannot continue"
-    fi
-fi
-
 if is_fedora && [[ $DISTRO == "rhel6" || $DISTRO == "rhel7" ]]; then
     # RHEL requires EPEL for many Open Stack dependencies
 
@@ -269,6 +258,23 @@ EOF
         OPTIONAL_REPO=rhel-6-server-optional-rpms
     fi
     sudo yum-config-manager --enable ${OPTIONAL_REPO}
+
+    # Installing Open vSwitch on RHEL requires enabling the RDO repo.
+    # Note no juno packages for rhel6
+    if [[ $DISTRO == "rhel6" ]]; then
+        RHEL_RDO_REPO_RPM=${RHEL6_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-icehouse/rdo-release-icehouse-4.noarch.rpm"}
+        RHEL_RDO_REPO_ID=${RHEL6_RDO_REPO_ID:-"openstack-icehouse"}
+    elif [[ $DISTRO == "rhel7" ]]; then
+        RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-juno/rdo-release-juno-1.noarch.rpm"}
+        RHEL_RDO_REPO_ID=${RHEL7_RDO_REPO_ID:-"openstack-juno"}
+    fi
+
+    if ! sudo yum repolist enabled $RHEL_RDO_REPO_ID | grep -q $RHEL_RDO_REPO_ID; then
+        echo "RDO repo not detected; installing"
+        yum_install $RHEL_RDO_REPO_RPM || \
+            die $LINENO "Error installing RDO repo, cannot continue"
+    fi
+
 fi
 
 

From b57f636ec8fc648917c05c80469473d4f1deb14e Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 15 Dec 2014 20:55:54 -0500
Subject: [PATCH 0187/3333] Add WSGIPassAuthorization to the admin port too

Accidentally only added WSGIPassAuthorization to the public port,
like all the other WSGI props, it should be added for both ports.

Change-Id: I4e52e0881df464dfb7b28e22581f462e14e37bdb
---
 files/apache-keystone.template | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index b0cfb84ce0..2190d831c0 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -22,6 +22,7 @@ Listen %ADMINPORT%
     WSGIProcessGroup keystone-admin
     WSGIScriptAlias / %ADMINWSGI%
     WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
     <IfVersion >= 2.4>
       ErrorLogFormat "%{cu}t %M"
     </IfVersion>

From 981ed299abe07b2b3e6d8df695a6b045804a5716 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Mon, 15 Dec 2014 21:11:20 -0800
Subject: [PATCH 0188/3333] Fix TRACKING_DEPENDS mode

TRACKING_DEPENDS mode was added in I89677fd54635e82b10ab674ddeb9ffb3f1a755f0

TRACKING_DEPENDS creates a global virtualenv and assumes it exists for
all pip_installs (except for installing virtualenv), so we need to set
this up before any other pip install

Change-Id: Iebe6295913094b32124295e7c5e674e1cebaaa87
---
 stack.sh | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/stack.sh b/stack.sh
index d97139aaa7..55a5a2dbd3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -704,6 +704,19 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=$PYPI_ALTERNATIVE_URL $TOP_DIR/tools/install_pip.sh
 fi
 
+TRACK_DEPENDS=${TRACK_DEPENDS:-False}
+
+# Install python packages into a virtualenv so that we can track them
+if [[ $TRACK_DEPENDS = True ]]; then
+    echo_summary "Installing Python packages into a virtualenv $DEST/.venv"
+    pip_install -U virtualenv
+
+    rm -rf $DEST/.venv
+    virtualenv --system-site-packages $DEST/.venv
+    source $DEST/.venv/bin/activate
+    $DEST/.venv/bin/pip freeze > $DEST/requires-pre-pip
+fi
+
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
 
@@ -729,19 +742,6 @@ if is_service_enabled neutron; then
     install_neutron_agent_packages
 fi
 
-TRACK_DEPENDS=${TRACK_DEPENDS:-False}
-
-# Install python packages into a virtualenv so that we can track them
-if [[ $TRACK_DEPENDS = True ]]; then
-    echo_summary "Installing Python packages into a virtualenv $DEST/.venv"
-    pip_install -U virtualenv
-
-    rm -rf $DEST/.venv
-    virtualenv --system-site-packages $DEST/.venv
-    source $DEST/.venv/bin/activate
-    $DEST/.venv/bin/pip freeze > $DEST/requires-pre-pip
-fi
-
 # Check Out and Install Source
 # ----------------------------
 

From 5c66ff6f20e8fd9a439d9c0edabd3e88423e0ac0 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Tue, 16 Dec 2014 16:50:46 +0000
Subject: [PATCH 0189/3333] Update the default ODL to Helium SR1.1

Per a nasty security vulnerability, OpenDaylight has released a security
update for Helium, SR1.1. You can read more about this here [1].

[1] https://lists.opendaylight.org/pipermail/discuss/2014-December/004135.html

Change-Id: I8b9f436b5bf7cabd2d32aaf7388f3f82f9617c3e
---
 lib/opendaylight | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/opendaylight b/lib/opendaylight
index 936a17cbed..2f0f37e34d 100644
--- a/lib/opendaylight
+++ b/lib/opendaylight
@@ -47,16 +47,16 @@ ODL_USERNAME=${ODL_USERNAME:-admin}
 ODL_PASSWORD=${ODL_PASSWORD:-admin}
 
 # Short name of ODL package
-ODL_NAME=${ODL_NAME:-distribution-karaf-0.2.1-Helium-SR1}
+ODL_NAME=${ODL_NAME:-distribution-karaf-0.2.1-Helium-SR1.1}
 
 # <define global variables here that belong to this project>
 ODL_DIR=$DEST/opendaylight
 
 # The OpenDaylight Package, currently using 'Hydrogen' release
-ODL_PKG=${ODL_PKG:-distribution-karaf-0.2.1-Helium-SR1.zip}
+ODL_PKG=${ODL_PKG:-distribution-karaf-0.2.1-Helium-SR1.1.zip}
 
 # The OpenDaylight URL
-ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/repositories/public/org/opendaylight/integration/distribution-karaf/0.2.1-Helium-SR1/}
+ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/repositories/public/org/opendaylight/integration/distribution-karaf/0.2.1-Helium-SR1.1/}
 
 # Default arguments for OpenDaylight. This is typically used to set
 # Java memory options.

From f6287c2adb4722b5688da9a4ac61dc6eda4a1372 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Tue, 16 Dec 2014 13:32:41 -0800
Subject: [PATCH 0190/3333] Fix rabbit_userid for multi node devstack

I43a231c9611b4cc2e390b603aa3bfb49c915bdc5 introduced a new setting
RABBIT_USERID but only set it if rabbit is enabled. In multi node
devstack the second node uses RABBIT_USERID but the service rabbit isn't
enabled on it.

Always set RABBIT_USERID, if a different message queue is used the
variable will just be ignored.

Change-Id: I8568bddda2a5c66235ecae23af58983ee94c720a
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index d97139aaa7..605d3cc889 100755
--- a/stack.sh
+++ b/stack.sh
@@ -642,8 +642,10 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 # Queue Configuration
 
 # Rabbit connection info
+# In multi node devstack, second node needs RABBIT_USERID, but rabbit
+# isn't enabled.
+RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
 if is_service_enabled rabbit; then
-    RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
     RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
     read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."
 fi

From fc0ff92777cc6be1914ff59b02d10e9fb75eb199 Mon Sep 17 00:00:00 2001
From: JordanP <jordan.pittier@scality.com>
Date: Wed, 17 Dec 2014 12:39:36 +0100
Subject: [PATCH 0191/3333] lib/swift : fix misleading typo in a code comment

The code comment was picked from lib/keystone but not changed.

Change-Id: Idebe5af84d481d52d529575e666105e4b0e06a59
---
 lib/swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 41f9e84afa..e9043b32a1 100644
--- a/lib/swift
+++ b/lib/swift
@@ -132,7 +132,7 @@ SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY}
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,swift
 
-# Toggle for deploying Keystone under HTTPD + mod_wsgi
+# Toggle for deploying Swift under HTTPD + mod_wsgi
 SWIFT_USE_MOD_WSGI=${SWIFT_USE_MOD_WSGI:-False}
 
 # Functions

From 684e9e9ce2bfbe21571b7ba61aa9b91ea49892fa Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 17 Dec 2014 11:48:59 -0500
Subject: [PATCH 0192/3333] Don't install sphinx from distro

We don't generate docs in devstack. But also, sphinx depends on babel
which has a hard depend that breaks with setuptools 8. However, pip
installed babel/sphinx should not have this problem.

Change-Id: I84a82e56f6540724d50c6201a68c480ba7645add
---
 files/debs/horizon      | 1 -
 files/debs/ryu          | 1 -
 files/rpms-suse/horizon | 1 -
 files/rpms-suse/ryu     | 1 -
 files/rpms/horizon      | 1 -
 files/rpms/ryu          | 1 -
 6 files changed, 6 deletions(-)

diff --git a/files/debs/horizon b/files/debs/horizon
index 5d06928c7b..f9b7d597dc 100644
--- a/files/debs/horizon
+++ b/files/debs/horizon
@@ -12,7 +12,6 @@ python-webob
 pylint
 python-eventlet
 python-nose
-python-sphinx
 python-mox
 python-coverage
 python-cherrypy3 # why?
diff --git a/files/debs/ryu b/files/debs/ryu
index 9b850807e6..354c1b75d3 100644
--- a/files/debs/ryu
+++ b/files/debs/ryu
@@ -1,2 +1 @@
 python-eventlet
-python-sphinx
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
index fa7e43964a..d1f378a70d 100644
--- a/files/rpms-suse/horizon
+++ b/files/rpms-suse/horizon
@@ -4,7 +4,6 @@ python-CherryPy # why? (coming from apts)
 python-Paste
 python-PasteDeploy
 python-Routes
-python-Sphinx
 python-SQLAlchemy
 python-WebOb
 python-anyjson
diff --git a/files/rpms-suse/ryu b/files/rpms-suse/ryu
index 6b426fb163..354c1b75d3 100644
--- a/files/rpms-suse/ryu
+++ b/files/rpms-suse/ryu
@@ -1,2 +1 @@
-python-Sphinx
 python-eventlet
diff --git a/files/rpms/horizon b/files/rpms/horizon
index 1d06ac278b..82385ed06c 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -15,7 +15,6 @@ python-nose
 python-paste        #dist:f19,f20,f21
 python-paste-deploy #dist:f19,f20,f21
 python-routes
-python-sphinx
 python-sqlalchemy
 python-webob
 pyxattr
diff --git a/files/rpms/ryu b/files/rpms/ryu
index 9b850807e6..354c1b75d3 100644
--- a/files/rpms/ryu
+++ b/files/rpms/ryu
@@ -1,2 +1 @@
 python-eventlet
-python-sphinx

From 0943e076624274978d1e87c8a44f80df9151a5e9 Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Wed, 17 Dec 2014 16:07:32 -0800
Subject: [PATCH 0193/3333] [Sahara] Set use_floating_ips=false for nova
 network

There is no sense in using floating IPs in case of nova network.
Sahara doesn't support assigning floating IPs from
default_floating_pool. The best solution is to use private network
for management.

Change-Id: I4b3e1d52cab28fe5c8d398ca896216b47b9c4ee0
Closes-Bug: #1403680
---
 lib/sahara | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/sahara b/lib/sahara
index 6d1bef571a..e5f988bb31 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -131,6 +131,9 @@ function configure_sahara {
     if is_service_enabled neutron; then
         iniset $SAHARA_CONF_FILE DEFAULT use_neutron true
         iniset $SAHARA_CONF_FILE DEFAULT use_floating_ips true
+    else
+        iniset $SAHARA_CONF_FILE DEFAULT use_neutron false
+        iniset $SAHARA_CONF_FILE DEFAULT use_floating_ips false
     fi
 
     if is_service_enabled heat; then

From b7ebc4765a327e97837f2f6696682859eb77a93d Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Wed, 17 Dec 2014 03:32:42 +0000
Subject: [PATCH 0194/3333] Revert "Pin version of setuptools"

This reverts commit 3b782d304ec2073a6406c37b9e1a76c8aecfc9a3.

The blockers for setuptools 8 compatibility should all be resolved
now.

Change-Id: I6d2d63746f98f0f885816395f36022a2706fb9c5
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index c9119ae410..55ef93e44d 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -83,6 +83,6 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-pip_install -U "setuptools<8.0"
+pip_install -U setuptools
 
 get_versions

From 35b5283a8f365f12996af1209448ccd816276e1f Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Thu, 18 Dec 2014 17:27:22 +0000
Subject: [PATCH 0195/3333] Comment option to enable Setuptools warnings

Change-Id: I9fc247ab343c2cea0a8a5b7a3823b5525d6c311f
---
 tools/install_pip.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 55ef93e44d..f30ad2bcd0 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -68,6 +68,13 @@ function configure_pypi_alternative_url {
 
 }
 
+# Setuptools 8 implements PEP 440, and 8.0.4 adds a warning triggered any time
+# pkg_resources inspects the list of installed Python packages if there are
+# non-compliant version numbers in the egg-info (for example, from distro
+# system packaged Python libraries). This is off by default after 8.2 but can
+# be enabled by uncommenting the lines below.
+#PYTHONWARNINGS=$PYTHONWARNINGS,always::RuntimeWarning:pkg_resources
+#export PYTHONWARNINGS
 
 # Show starting versions
 get_versions

From 2191f838a718049b3ba3be42f3aef8a970ff4278 Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Thu, 18 Dec 2014 22:13:13 +0000
Subject: [PATCH 0196/3333] Revert "Revert "Pin version of setuptools""

This reverts commit b7ebc4765a327e97837f2f6696682859eb77a93d.

We weren't quite ready yet... :/

Change-Id: Idccc4b79a700ca34a80f590e942e1647cdfdefb0
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 55ef93e44d..c9119ae410 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -83,6 +83,6 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-pip_install -U setuptools
+pip_install -U "setuptools<8.0"
 
 get_versions

From 305c4debde80a79676848c108cb42c0a12ce7405 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 18 Dec 2014 17:11:07 -0600
Subject: [PATCH 0197/3333] Fix wsgi dir cleanup in Keystone

Change-Id: I8350d2de8602472e5a7d80b490d2c24f43865e19
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 071dc908ae..1599fa5738 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -116,7 +116,7 @@ function cleanup_keystone {
 
 # _cleanup_keystone_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
 function _cleanup_keystone_apache_wsgi {
-    sudo rm -f $KEYSTONE_WSGI_DIR/*.wsgi
+    sudo rm -f $KEYSTONE_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for keystone)
 }
 

From 9d0d3fb46824d3f9056acf18ad218b22b31b64af Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Thu, 18 Dec 2014 23:14:54 +0000
Subject: [PATCH 0198/3333] Revert "Revert "Revert "Pin version of
 setuptools"""

This reverts commit 2191f838a718049b3ba3be42f3aef8a970ff4278.

Approve once Setuptools 8 is silencing runtime warnings by default,
e.g. via https://github.com/jaraco/setuptools/pull/23 or a similar
patch.

Change-Id: I3c97a4d7810870c9ac058350b362930ce2af713b
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index c9119ae410..55ef93e44d 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -83,6 +83,6 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-pip_install -U "setuptools<8.0"
+pip_install -U setuptools
 
 get_versions

From 5107556a7985b35a22904c57fd4a6f851cef0024 Mon Sep 17 00:00:00 2001
From: Peter Pentchev <openstack-dev@storpool.com>
Date: Fri, 19 Dec 2014 11:31:43 +0200
Subject: [PATCH 0199/3333] Actually run all the Cinder cert tests.

Change the tests to run on the tox invocation line, too, not just in
the message logged.

Change-Id: I86e02ea5a5eace92397bc18e08c494c6fd009880
---
 driver_certs/cinder_driver_cert.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/driver_certs/cinder_driver_cert.sh b/driver_certs/cinder_driver_cert.sh
index 27570389a9..d066e0667f 100755
--- a/driver_certs/cinder_driver_cert.sh
+++ b/driver_certs/cinder_driver_cert.sh
@@ -94,7 +94,7 @@ sleep 5
 
 # run tempest api/volume/test_*
 log_message "Run the actual tempest volume tests (./tools/pretty_tox.sh volume)...", True
-./tools/pretty_tox.sh api.volume 2>&1 | tee -a $TEMPFILE
+./tools/pretty_tox.sh volume 2>&1 | tee -a $TEMPFILE
 if [[ $? = 0 ]]; then
     log_message "CONGRATULATIONS!!!  Device driver PASSED!", True
     log_message "Submit output: ($TEMPFILE)"

From 933827cccea4d0866ecac9513a5f3ebeb90749ff Mon Sep 17 00:00:00 2001
From: saradpatel <sarad.patel@hp.com>
Date: Fri, 19 Dec 2014 12:09:05 +0000
Subject: [PATCH 0200/3333] Fix typo errors in devstack documentation

This submission fixes typo errors in following files
  1. contributing.rst
  2. exerciserc.rst
  3. faq.rst
  4. local.conf.rst
  5. openrc.rst

Change-Id: I2b2d61673c3c95f60c56978b5a81016603fef252
---
 doc/source/contributing.rst | 2 +-
 doc/source/exerciserc.rst   | 2 +-
 doc/source/faq.rst          | 2 +-
 doc/source/local.conf.rst   | 2 +-
 doc/source/openrc.rst       | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
index 8c9e6584ec..b2a219b596 100644
--- a/doc/source/contributing.rst
+++ b/doc/source/contributing.rst
@@ -5,7 +5,7 @@ Contributing
 DevStack uses the standard OpenStack contribution process as outlined in
 `the OpenStack wiki 'How To
 Contribute' <https://wiki.openstack.org/wiki/How_To_Contribute>`__. This
-means that you will need to meet the requirements of the Contribututors
+means that you will need to meet the requirements of the Contributors
 License Agreement (CLA). If you have already done that for another
 OpenStack project you are good to go.
 
diff --git a/doc/source/exerciserc.rst b/doc/source/exerciserc.rst
index f3780c34c5..dacae2ecf2 100644
--- a/doc/source/exerciserc.rst
+++ b/doc/source/exerciserc.rst
@@ -3,7 +3,7 @@ exerciserc - Exercise Settings
 ==============================
 
 ``exerciserc`` is used to configure settings for the exercise scripts.
-The values shown below are the default values. Thse can all be
+The values shown below are the default values. These can all be
 overridden by setting them in the ``localrc`` section.
 
 ACTIVE\_TIMEOUT
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index f39471cb4e..92d794572e 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -123,7 +123,7 @@ Q: Why not use [STRIKEOUT:``tools/pip-requires``]\ ``requirements.txt`` to grab
     [STRIKEOUT:The majority of deployments will use packages to install
     OpenStack that will have distro-based packages as dependencies.
     DevStack installs as many of these Python packages as possible to
-    mimic the expected production environemnt.] Certain Linux
+    mimic the expected production environment.] Certain Linux
     distributions have a 'lack of workaround' in their Python
     configurations that installs vendor packaged Python modules and
     pip-installed modules to the SAME DIRECTORY TREE. This is causing
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
index b2f7557e6d..a1ca60a75d 100644
--- a/doc/source/local.conf.rst
+++ b/doc/source/local.conf.rst
@@ -2,7 +2,7 @@
 local.conf - User Settings
 ==========================
 
-``local.conf`` is a user-maintained setings file that is sourced in
+``local.conf`` is a user-maintained settings file that is sourced in
 ``stackrc``. It contains a section that replaces the historical
 ``localrc`` file. See the description of
 :doc:`local.conf <configuration>` for more details about the mechanics
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index 56ff5c2edb..0b090c77b7 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -4,7 +4,7 @@ openrc - User Authentication Settings
 
 ``openrc`` configures login credentials suitable for use with the
 OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
-beginning (which in turn sources the ``localrc`` setion of
+beginning (which in turn sources the ``localrc`` section of
 ``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
 to use in the endpoints. The values shown below are the default values.
 

From 95d1a43f1feef36ee50b0f53a6da258a4a646244 Mon Sep 17 00:00:00 2001
From: Guillaume Delacour <gui@iroqwa.org>
Date: Sat, 20 Dec 2014 17:09:05 +0100
Subject: [PATCH 0201/3333] uuidgen binary is needed by lib/{neutron,ceph}

When using unstack.sh script on Debian Wheezy, i saw a failing call on
uuidgen binary:

    $ ./unstack.sh
    /home/stack/devstack/lib/neutron: line 83: uuidgen: command not found
    Site keystone disabled.
    [...]

Change-Id: I47e158abce9d090eb839c6e97d9191dc99ccfe55
---
 files/debs/neutron | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/neutron b/files/debs/neutron
index a48a800527..fd99677412 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -24,3 +24,4 @@ qpidd # NOPRIME
 sqlite3
 vlan
 radvd # NOPRIME
+uuid-runtime

From ce1524d0843894b099c4abd20a64f92acad50c55 Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Sun, 21 Dec 2014 00:46:34 -0800
Subject: [PATCH 0202/3333] Fix proper oslo.messaging object for zeromq driver

Currently, as almost all the rpc driver of projects
have been switched to oslo.messaging, the object should
be imported via oslo.messaging rather than its own rpc lib.

Change-Id: I9633446e78cb5af21f61a26f6fb365a8ed57a85f
Partially-Implements: blueprint zeromq
Closes-Bug: #1395721
---
 lib/rpc_backend | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 400204abe1..172d024f90 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -221,9 +221,9 @@ function iniset_rpc_backend {
     local file=$2
     local section=$3
     if is_service_enabled zeromq; then
-        iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_zmq
+        iniset $file $section rpc_backend "zmq"
         iniset $file $section rpc_zmq_matchmaker \
-            ${package}.openstack.common.rpc.matchmaker_redis.MatchMakerRedis
+            oslo.messaging._drivers.matchmaker_redis.MatchMakerRedis
         # Set MATCHMAKER_REDIS_HOST if running multi-node.
         MATCHMAKER_REDIS_HOST=${MATCHMAKER_REDIS_HOST:-127.0.0.1}
         iniset $file matchmaker_redis host $MATCHMAKER_REDIS_HOST

From 58402537351ed30afc0d2ee99dc52687301ff9dc Mon Sep 17 00:00:00 2001
From: "Gary W. Smith" <gary.w.smith@hp.com>
Date: Mon, 22 Dec 2014 09:13:23 -0800
Subject: [PATCH 0203/3333] Add missing space before ] in lib/trove

Change-Id: Ic852f642f03124c4a878c92ea8b6b11519c51e59
Fixes-Bug: 1404939
---
 lib/trove | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/trove b/lib/trove
index 8b7b0ef640..d889b056e8 100644
--- a/lib/trove
+++ b/lib/trove
@@ -207,7 +207,7 @@ function init_trove {
     $TROVE_BIN_DIR/trove-manage db_sync
 
     # If no guest image is specified, skip remaining setup
-    [ -z "$TROVE_GUEST_IMAGE_URL"] && return 0
+    [ -z "$TROVE_GUEST_IMAGE_URL" ] && return 0
 
     # Find the glance id for the trove guest image
     # The image is uploaded by stack.sh -- see $IMAGE_URLS handling

From 6ec66bb3d1354062ec70be972dba990e886084d5 Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Mon, 22 Dec 2014 17:17:51 +0000
Subject: [PATCH 0204/3333] Install prettytable>=0.7 to satisfy pip 6/PEP 440

Also use sudo -H with pip so that it doesn't create a ~stack/.cache
other things can't write to as the stack user later.

Change-Id: I2134c7d8f58f8b83f33150c9ed86d87f8ccba2f3
---
 functions-common     | 2 +-
 tools/fixup_stuff.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 94ab34763e..40a0d2b942 100644
--- a/functions-common
+++ b/functions-common
@@ -1578,7 +1578,7 @@ function pip_install {
         local sudo_pip="env"
     else
         local cmd_pip=$(get_pip_command)
-        local sudo_pip="sudo"
+        local sudo_pip="sudo -H"
     fi
 
     $xtrace
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index ca465339b7..26aae82535 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -85,7 +85,7 @@ function get_package_path {
 
 # Fix prettytable 0.7.2 permissions
 # Don't specify --upgrade so we use the existing package if present
-pip_install 'prettytable>0.7'
+pip_install 'prettytable>=0.7'
 PACKAGE_DIR=$(get_package_path prettytable)
 # Only fix version 0.7.2
 dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)

From fe5164aeef1c3fab581272201e4e21f8821e8784 Mon Sep 17 00:00:00 2001
From: Ilya Tyaptin <ityaptin@mirantis.com>
Date: Tue, 23 Dec 2014 14:53:43 +0400
Subject: [PATCH 0205/3333] Fix redis service restarting for Ceilometer

In Ubuntu redis service is named as redis-server. So in this
patchset different restarting for this service at different
OSes have been added.

Change-Id: I406e3556c7b9a2bef8277f34862375c5ffd3888e
Closes-bug: #1405147
---
 lib/ceilometer | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 1f480eaf63..f6280d9d3b 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -272,12 +272,12 @@ function init_ceilometer {
 function install_redis {
     if is_ubuntu; then
         install_package redis-server
+        restart_service redis-server
     else
         # This will fail (correctly) where a redis package is unavailable
         install_package redis
+        restart_service redis
     fi
-
-    restart_service redis
 }
 
 # install_ceilometer() - Collect source and prepare

From 013f52b01508f20c34209a30d76c1843764f88ca Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 23 Dec 2014 16:56:15 -0800
Subject: [PATCH 0206/3333] Always install latest pbr

When not installing pbr from source always install the latest version of
pbr. It turns out that python-pbr is a system package that satisfies
many of our requirements files pbr requirements but breaks under
setuptools 8.0. Fix this by passing the -U flag to pip when installing
pbr so that we install the latest version of pbr always.

Note that we likely need to make this more generic to avoid other system
package leakage when installing packages not from source.

We should also probably bump our pbr requirements across the board to
reflect the new setuptools 8.0 world needs.

Change-Id: I23dd21cea37d26f879aa8d864ee7d371e70221ea
Fixes-bug: 1405318
---
 lib/infra | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/infra b/lib/infra
index 57df07deed..c825b4ee56 100644
--- a/lib/infra
+++ b/lib/infra
@@ -37,7 +37,9 @@ function install_infra {
         git_clone_by_name "pbr"
         setup_lib "pbr"
     else
-        pip_install "pbr"
+        # Always upgrade pbr to latest version as we may have pulled it
+        # in via system packages.
+        pip_install "-U" "pbr"
     fi
 }
 

From 18a81a20581e7e53fa69d91b6b77f739b1e960b2 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 26 Dec 2014 09:53:21 -0600
Subject: [PATCH 0207/3333] Stop installing setuptools from distros

We go through a bunch of trouble to install setuptools via pip. Having
it in the distro install too is confusing.

Change-Id: I6875fe2a1ee6b7d296f7f44b4b1601794b136440
---
 files/debs/general      | 1 -
 files/rpms-suse/general | 1 -
 files/rpms/general      | 1 -
 3 files changed, 3 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 3fe7863de2..e824d239b4 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,6 +1,5 @@
 bridge-utils
 pylint
-python-setuptools
 screen
 unzip
 wget
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index f1f7e8f173..63ef705b64 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -15,7 +15,6 @@ openssl
 psmisc
 python-cmd2 # dist:opensuse-12.3
 python-pylint
-python-setuptools # instead of python-distribute; dist:sle11sp2
 python-unittest2
 screen
 tar
diff --git a/files/rpms/general b/files/rpms/general
index d7ace9b990..ee7cc12cef 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -13,7 +13,6 @@ libxml2-devel
 libxslt-devel
 psmisc
 pylint
-python-setuptools
 python-prettytable # dist:rhel6 [1]
 python-unittest2
 python-virtualenv

From 130efefe6c8e8750504152742bd82961f18c8a02 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Sat, 27 Dec 2014 14:01:00 -0800
Subject: [PATCH 0208/3333] Call sudo /w -H in install_pip.sh as well

We updated other usage of sudo to pass -H when installing pip things,
to avoid creating a .cache directory in $STACK_USER's $HOME that is
owned by root. get-pip.py also ends up creating a ~/.cache, so we
need to update sudo usage there as well.

Closes-bug: #1405626
Related-bug: #1405732

Change-Id: If791b9b25d6a4280dab19117004184e57e78d038
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index f30ad2bcd0..d57a687ecc 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -46,7 +46,7 @@ function install_get_pip {
         curl -o $LOCAL_PIP $PIP_GET_PIP_URL || \
             die $LINENO "Download of get-pip.py failed"
     fi
-    sudo -E python $LOCAL_PIP
+    sudo -H -E python $LOCAL_PIP
 }
 
 

From 7b5c4e6797b8e7344f42728ef5cd2208cdc8717d Mon Sep 17 00:00:00 2001
From: "Haomeng, Wang" <whaom@cn.ibm.com>
Date: Sun, 28 Dec 2014 03:15:14 +0000
Subject: [PATCH 0209/3333] ironic scripts should support $Q_USE_NAMESPACE

add logic for ironic to support $Q_USE_NAMESPACE, if it is false,
will not call 'ip netns' with network namespace

Change-Id: Idc4dfb49ee478486476973a41b420b9b7e11a4e0
---
 lib/ironic | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 3f7ae2111c..8af3a7c3a6 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -455,7 +455,11 @@ function create_ovs_taps {
     # intentional sleep to make sure the tag has been set to port
     sleep 10
 
-    local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -b2-)
+    if  [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+        local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -b2-)
+    else
+        local tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -b2-)
+    fi
     local tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
 
     # make sure veth pair is not existing, otherwise delete its links

From 1eb4c6a3753fad0166359fff417f63f028ab871d Mon Sep 17 00:00:00 2001
From: gong yong sheng <gong.yongsheng@99cloud.net>
Date: Wed, 24 Dec 2014 09:21:01 +0800
Subject: [PATCH 0210/3333] remove brackets around boolean condition expression

Change-Id: Ia550d4603d9520ddea84a144e5e042903456d96d
Closes-Bug: 1405319
---
 lib/cinder  | 2 +-
 lib/horizon | 2 +-
 lib/neutron | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 930119cd61..c106424378 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -292,7 +292,7 @@ function configure_cinder {
         configure_cinder_driver
     fi
 
-    if [[ is_fedora && $DISTRO =~ (rhel6) ]]; then
+    if is_fedora && [[ $DISTRO =~ (rhel6) ]]; then
         # Cinder clones are slightly larger due to some extra
         # metadata.  RHEL6 will not allow auto-extending of LV's
         # without this, leading to clones giving hard-to-track disk
diff --git a/lib/horizon b/lib/horizon
index edb95e9812..fee2ef0b3a 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -72,7 +72,7 @@ function _horizon_config_set {
 # cleanup_horizon() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_horizon {
-    if [[ is_fedora && $DISTRO =~ (rhel6) ]]; then
+    if is_fedora && [[ $DISTRO =~ (rhel6) ]]; then
         # If ``/usr/bin/node`` points into ``$DEST``
         # we installed it via ``install_nodejs``
         if [[ $(readlink -f /usr/bin/node) =~ ($DEST) ]]; then
diff --git a/lib/neutron b/lib/neutron
index 8517102a65..0134cbde2c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -751,7 +751,7 @@ function stop_neutron {
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
-    if [[ is_provider_network && is_ironic_hardware ]]; then
+    if is_provider_network && is_ironic_hardware; then
         for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
             sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
             sudo ip addr add $IP dev $PUBLIC_INTERFACE

From 0f52d93d6ddc0716f78fa2cd18ec16422fd367f6 Mon Sep 17 00:00:00 2001
From: Zhi Yan Liu <zhiyanl@cn.ibm.com>
Date: Tue, 30 Dec 2014 14:37:02 +0800
Subject: [PATCH 0211/3333] Setup notification properly for Zaqar

As we integrated OSprofiler with Zaqar by change
I32565de6c447cd5e95a0ef54a9fbd4e571c2d820 , then service
zaqar-server requires using notification API sends profiling
data to ceilometer, so zaqar needs relevant options to make
it work.

Change-Id: Ib09b241f60dd9961e9366f69cf7fbe8388179f96
Signed-off-by: Zhi Yan Liu <zhiyanl@cn.ibm.com>
---
 lib/zaqar | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/zaqar b/lib/zaqar
index 0d1f6f4aaf..dfa3452f0d 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -135,6 +135,12 @@ function configure_zaqar {
         configure_redis
     fi
 
+    if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
+        iniset $ZAQAR_CONF DEFAULT notification_driver messaging
+        iniset $ZAQAR_CONF DEFAULT control_exchange zaqar
+    fi
+    iniset_rpc_backend zaqar $ZAQAR_CONF DEFAULT
+
     cleanup_zaqar
 }
 

From a38bc5b3c2b97230896948073401153b0c3d157f Mon Sep 17 00:00:00 2001
From: Sergey Kraynev <skraynev@mirantis.com>
Date: Tue, 16 Dec 2014 04:25:11 -0500
Subject: [PATCH 0212/3333] Adding installation Heat package after cloning

There are two important reasons for this change:
 - Other OpenStack components contain this code already.
 - Heat store references on client/constraint/version plugins in
   setup.cfg and and stevedore uses these references, so we should
   install Heat after changing this part of code. As example look patch
   https://review.openstack.org/#/c/86978/ for grenade job, where
   heat-engine can not find two constrainsts due to changing their code
   place between releases.

Change-Id: Ic6b1f70ec2d2c06002eb6877a747b7b84213c710
Closes-Bug: #1402985
---
 lib/heat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/heat b/lib/heat
index 49ed5331aa..4e72caeb54 100644
--- a/lib/heat
+++ b/lib/heat
@@ -73,7 +73,6 @@ function cleanup_heat {
 
 # configure_heat() - Set config files, create data dirs, etc
 function configure_heat {
-    setup_develop $HEAT_DIR
     if [[ "$HEAT_STANDALONE" = "True" ]]; then
         setup_develop $HEAT_DIR/contrib/heat_keystoneclient_v2
     fi
@@ -195,6 +194,7 @@ function install_heatclient {
 # install_heat() - Collect source and prepare
 function install_heat {
     git_clone $HEAT_REPO $HEAT_DIR $HEAT_BRANCH
+    setup_develop $HEAT_DIR
 }
 
 # install_heat_other() - Collect source and prepare

From 3a6b128f3af8068362bdd78a0d264aa54672328e Mon Sep 17 00:00:00 2001
From: Steven Dake <sdake@redhat.com>
Date: Wed, 31 Dec 2014 14:27:22 -0700
Subject: [PATCH 0213/3333] Improve firewall recommendations for Neutron
 documentation

The documention does not mention that either ufw or firewalld should be
disabled to operate a devstack+Neutron environment.  This change adds a
description of fault symptoms as well as a simple workaround.

Change-Id: Ie0ec614dfa56febbf6588836d2e1fc057aa8830f
---
 doc/source/guides/neutron.rst | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index dc2fc71617..90d4ca3c77 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -59,6 +59,40 @@ connectivity.
 
 
 
+Disabling Next Generation Firewall Tools
+========================================
+
+Devstack does not properly operate with modern firewall tools.  Specifically
+it will appear as if the guest VM can access the external network via ICMP,
+but UDP and TCP packets will not be delivered to the guest VM.  The root cause
+of the issue is that both ufw (Uncomplicated Firewall) and firewalld (Fedora's
+firewall manager) apply firewall rules to all interfaces in the system, rather
+then per-device.  One solution to this problem is to revert to iptables
+functionality.
+
+To get a functional firewall configuration for Fedora do the following:
+
+::
+
+         sudo service iptables save
+         sudo systemctl disable firewalld
+         sudo systemctl enable iptables
+         sudo systemctl stop firewalld
+         sudo systemctl start iptables
+
+
+To get a functional firewall configuration for distributions containing ufw,
+disable ufw.  Note ufw is generally not enabled by default in Ubuntu.  To
+disable ufw if it was enabled, do the following:
+
+::
+
+        sudo service iptables save
+        sudo ufw disable
+
+
+
+
 Neutron Networking with Open vSwitch
 ====================================
 

From 2de47465bdc33e7cc7bd6626a91374eccbf014f1 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Tue, 23 Dec 2014 11:08:15 +1000
Subject: [PATCH 0214/3333] Trove configure authtoken via conf file

Configure auth_token middleware in trove via the conf file rather than
the paste pipeline. This is the standard and expected mechanism.

Change-Id: Iec6bf74c9321082c35465d332aba7f5fa240cc1a
---
 lib/trove | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/trove b/lib/trove
index d889b056e8..abf4e87f9d 100644
--- a/lib/trove
+++ b/lib/trove
@@ -123,11 +123,8 @@ function configure_trove {
     sudo chown -R $STACK_USER: ${TROVE_CONF_DIR}
     sudo chown -R $STACK_USER: ${TROVE_AUTH_CACHE_DIR}
 
-    # Copy api-paste file over to the trove conf dir and configure it
+    # Copy api-paste file over to the trove conf dir
     cp $TROVE_LOCAL_CONF_DIR/api-paste.ini $TROVE_CONF_DIR/api-paste.ini
-    TROVE_API_PASTE_INI=$TROVE_CONF_DIR/api-paste.ini
-
-    configure_auth_token_middleware $TROVE_API_PASTE_INI trove $TROVE_AUTH_CACHE_DIR filter:authtoken
 
     # (Re)create trove conf files
     rm -f $TROVE_CONF_DIR/trove.conf
@@ -141,6 +138,7 @@ function configure_trove {
     setup_trove_logging $TROVE_CONF_DIR/trove.conf
     iniset $TROVE_CONF_DIR/trove.conf DEFAULT trove_api_workers "$API_WORKERS"
 
+    configure_auth_token_middleware $TROVE_CONF_DIR/trove.conf trove $TROVE_AUTH_CACHE_DIR
 
     # (Re)create trove taskmanager conf file if needed
     if is_service_enabled tr-tmgr; then

From cc5715531b46f558faffefe4fe6e77d48af2368b Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@gmail.com>
Date: Thu, 25 Sep 2014 20:00:29 +0900
Subject: [PATCH 0215/3333] Fix configure to metadata_agent.ini

Devstack set auth_uri to metadata_agent.ini in _neutron_setup_keystone function.
But Metadata_agent use auth_url not auth_uri.

This is regression caused by https://review.openstack.org/#/c/122882/

Change-Id: Iac8f240558abcdc5bcee3d3c87cef5ad3bb007e8
Closes-bug: #1373859
---
 lib/neutron | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 lib/neutron

diff --git a/lib/neutron b/lib/neutron
old mode 100644
new mode 100755
index 0134cbde2c..6c9d7b9a9e
--- a/lib/neutron
+++ b/lib/neutron
@@ -921,7 +921,9 @@ function _configure_neutron_metadata_agent {
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
     iniset $Q_META_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
 
-    _neutron_setup_keystone $Q_META_CONF_FILE DEFAULT
+    # Configures keystone for metadata_agent
+    # The third argument "True" sets auth_url needed to communicate with keystone
+    _neutron_setup_keystone $Q_META_CONF_FILE DEFAULT True
 
 }
 
@@ -1066,6 +1068,13 @@ function _neutron_setup_rootwrap {
 function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
+    local use_auth_url=$3
+
+    # Configures keystone for metadata_agent
+    # metadata_agent needs auth_url to communicate with keystone
+    if [[ "$use_auth_url" == "True" ]]; then
+        iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI/v2.0
+    fi
 
     create_neutron_cache_dir
     configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section

From 7faceb67ad73a21a6c2ee626fc7acfb02bd6cb8a Mon Sep 17 00:00:00 2001
From: Donagh McCabe <donagh.mccabe@hp.com>
Date: Fri, 19 Dec 2014 13:20:45 +0000
Subject: [PATCH 0216/3333] Allow swift keystoneauth reseller_prefix in sample
 file

The reseller_prefix option cannot be added to the
swift-proxy-server.conf-sample file because it
inadvertently gets set to "TEMPAUTH" and Tempest
tests fail.

Change-Id: Ib08d6fa1926531b8966151258eae6771c99c41ca
Closes-Bug: 1404226
---
 lib/swift | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/swift b/lib/swift
index e9043b32a1..3c1f2ec5f9 100644
--- a/lib/swift
+++ b/lib/swift
@@ -401,11 +401,10 @@ function configure_swift {
     sed -i "/^pipeline/ { s/tempauth/${swift_pipeline} ${SWIFT_EXTRAS_MIDDLEWARE}/ ;}" ${SWIFT_CONFIG_PROXY_SERVER}
     sed -i "/^pipeline/ { s/proxy-server/${SWIFT_EXTRAS_MIDDLEWARE_LAST} proxy-server/ ; }" ${SWIFT_CONFIG_PROXY_SERVER}
 
-    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
+
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server account_autocreate true
 
-    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix "TEMPAUTH"
+
 
     # Configure Crossdomain
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:crossdomain use "egg:swift#crossdomain"
@@ -422,6 +421,13 @@ function configure_swift {
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth operator_roles
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth operator_roles "Member, admin"
 
+    # Configure Tempauth. In the sample config file, Keystoneauth is commented
+    # out. Make sure we uncomment Tempauth after we uncomment Keystoneauth
+    # otherwise, this code also sets the reseller_prefix for Keystoneauth.
+    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
+    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix "TEMPAUTH"
+
     if is_service_enabled swift3; then
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
 # NOTE(chmou): s3token middleware is not updated yet to use only

From 157c84b8766ae67f6868f26505ce9a5d7291730b Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Mon, 6 Oct 2014 13:29:39 +0200
Subject: [PATCH 0217/3333] Enforce UTF-8 encoding when creating databases

We use InnoDB everywhere, so there should be no issues with long unicode
keys. Dropped charset parameter for recreate_database since it's not
needed anymore.

Change-Id: Ib768402a9337c918309030a92ab81da17269f4f6
---
 extras.d/70-tuskar.sh    | 2 +-
 lib/ceilometer           | 2 +-
 lib/cinder               | 2 +-
 lib/database             | 4 +---
 lib/databases/mysql      | 3 +--
 lib/databases/postgresql | 3 +--
 lib/glance               | 2 +-
 lib/heat                 | 2 +-
 lib/ironic               | 2 +-
 lib/keystone             | 2 +-
 lib/neutron              | 2 +-
 lib/nova                 | 7 ++-----
 lib/sahara               | 2 +-
 lib/trove                | 2 +-
 14 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/extras.d/70-tuskar.sh b/extras.d/70-tuskar.sh
index e77c504db0..56f26fff33 100644
--- a/extras.d/70-tuskar.sh
+++ b/extras.d/70-tuskar.sh
@@ -131,7 +131,7 @@ function configure_tuskar {
 function init_tuskar {
 
     # (re)create tuskar database
-    recreate_database tuskar utf8
+    recreate_database tuskar
 
     tuskar-dbsync --config-file $TUSKAR_CONF
     create_tuskar_cache_dir
diff --git a/lib/ceilometer b/lib/ceilometer
index f6280d9d3b..04f68acada 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -262,7 +262,7 @@ function init_ceilometer {
 
     if is_service_enabled mysql postgresql; then
         if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] ; then
-            recreate_database ceilometer utf8
+            recreate_database ceilometer
             $CEILOMETER_BIN_DIR/ceilometer-dbsync
         fi
     fi
diff --git a/lib/cinder b/lib/cinder
index c106424378..4b98bd9640 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -376,7 +376,7 @@ function init_cinder {
 
     if is_service_enabled $DATABASE_BACKENDS; then
         # (Re)create cinder database
-        recreate_database cinder utf8
+        recreate_database cinder
 
         # Migrate cinder database
         $CINDER_BIN_DIR/cinder-manage db sync
diff --git a/lib/database b/lib/database
index 366d2b3d2c..a25c21a6d3 100644
--- a/lib/database
+++ b/lib/database
@@ -98,11 +98,9 @@ function initialize_database_backends {
 
 # Recreate a given database
 #  $1 The name of the database
-#  $2 The character set/encoding of the database
 function recreate_database {
     local db=$1
-    local charset=$2
-    recreate_database_$DATABASE_TYPE $db $charset
+    recreate_database_$DATABASE_TYPE $db
 }
 
 # Install the database
diff --git a/lib/databases/mysql b/lib/databases/mysql
index d39d9667fc..673d867d8f 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -43,9 +43,8 @@ function cleanup_database_mysql {
 
 function recreate_database_mysql {
     local db=$1
-    local charset=$2
     mysql -u$DATABASE_USER -p$DATABASE_PASSWORD -h$MYSQL_HOST -e "DROP DATABASE IF EXISTS $db;"
-    mysql -u$DATABASE_USER -p$DATABASE_PASSWORD -h$MYSQL_HOST -e "CREATE DATABASE $db CHARACTER SET $charset;"
+    mysql -u$DATABASE_USER -p$DATABASE_PASSWORD -h$MYSQL_HOST -e "CREATE DATABASE $db CHARACTER SET utf8;"
 }
 
 function configure_database_mysql {
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 76491c479d..ad8cdc77a2 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -37,10 +37,9 @@ function cleanup_database_postgresql {
 
 function recreate_database_postgresql {
     local db=$1
-    local charset=$2
     # Avoid unsightly error when calling dropdb when the database doesn't exist
     psql -h$DATABASE_HOST -U$DATABASE_USER -dtemplate1 -c "DROP DATABASE IF EXISTS $db"
-    createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E $charset $db
+    createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
 }
 
 function configure_database_postgresql {
diff --git a/lib/glance b/lib/glance
index 8cda6be00a..87687613cd 100644
--- a/lib/glance
+++ b/lib/glance
@@ -279,7 +279,7 @@ function init_glance {
     mkdir -p $GLANCE_CACHE_DIR
 
     # (Re)create glance database
-    recreate_database glance utf8
+    recreate_database glance
 
     # Migrate glance database
     $GLANCE_BIN_DIR/glance-manage db_sync
diff --git a/lib/heat b/lib/heat
index 49ed5331aa..3c20b2ffe9 100644
--- a/lib/heat
+++ b/lib/heat
@@ -170,7 +170,7 @@ function configure_heat {
 function init_heat {
 
     # (re)create heat database
-    recreate_database heat utf8
+    recreate_database heat
 
     $HEAT_DIR/bin/heat-manage db_sync
     create_heat_cache_dir
diff --git a/lib/ironic b/lib/ironic
index 3f7ae2111c..acbffafdfb 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -380,7 +380,7 @@ function create_ironic_accounts {
 # init_ironic() - Initialize databases, etc.
 function init_ironic {
     # (Re)create  ironic database
-    recreate_database ironic utf8
+    recreate_database ironic
 
     # Migrate ironic database
     $IRONIC_BIN_DIR/ironic-dbsync --config-file=$IRONIC_CONF_FILE
diff --git a/lib/keystone b/lib/keystone
index 071dc908ae..fa6f346c30 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -448,7 +448,7 @@ function init_keystone {
     fi
 
     # (Re)create keystone database
-    recreate_database keystone utf8
+    recreate_database keystone
 
     # Initialize keystone database
     $KEYSTONE_DIR/bin/keystone-manage db_sync
diff --git a/lib/neutron b/lib/neutron
index 6c9d7b9a9e..08bd43b6c0 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -592,7 +592,7 @@ function create_neutron_initial_network {
 
 # init_neutron() - Initialize databases, etc.
 function init_neutron {
-    recreate_database $Q_DB_NAME utf8
+    recreate_database $Q_DB_NAME
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
 }
diff --git a/lib/nova b/lib/nova
index cbfbdfa69f..f8d36ce640 100644
--- a/lib/nova
+++ b/lib/nova
@@ -623,16 +623,13 @@ function init_nova {
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova database
-        # Explicitly use latin1: to avoid lp#829209, nova expects the database to
-        # use latin1 by default, and then upgrades the database to utf8 (see the
-        # 082_essex.py in nova)
-        recreate_database nova latin1
+        recreate_database nova
 
         # Migrate nova database
         $NOVA_BIN_DIR/nova-manage db sync
 
         if is_service_enabled n-cell; then
-            recreate_database $NOVA_CELLS_DB latin1
+            recreate_database $NOVA_CELLS_DB
         fi
     fi
 
diff --git a/lib/sahara b/lib/sahara
index c902d385d1..8573ee83c8 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -143,7 +143,7 @@ function configure_sahara {
         setup_colorized_logging $SAHARA_CONF_FILE DEFAULT
     fi
 
-    recreate_database sahara utf8
+    recreate_database sahara
     $SAHARA_BIN_DIR/sahara-db-manage --config-file $SAHARA_CONF_FILE upgrade head
 }
 
diff --git a/lib/trove b/lib/trove
index d889b056e8..e0a3831bc0 100644
--- a/lib/trove
+++ b/lib/trove
@@ -201,7 +201,7 @@ function install_trove {
 # init_trove() - Initializes Trove Database as a Service
 function init_trove {
     # (Re)Create trove db
-    recreate_database trove utf8
+    recreate_database trove
 
     # Initialize the trove database
     $TROVE_BIN_DIR/trove-manage db_sync

From f9512d6459599e947cd393cfd711798e95f513aa Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Mon, 15 Dec 2014 10:23:20 -0800
Subject: [PATCH 0218/3333] Initialize neutron service db with neutron

Partially-Implements: blueprint services-split
Change-Id: I407a4bb3c60ab6a491669b4ddd16aee1239808f1
---
 lib/neutron | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 6c9d7b9a9e..5678769255 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -595,6 +595,16 @@ function init_neutron {
     recreate_database $Q_DB_NAME utf8
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
+    for svc in fwaas lbaas vpnaas; do
+        if [ "$svc" = "vpnaas" ]; then
+            q_svc="q-vpn"
+        else
+            q_svc="q-$svc"
+        fi
+        if is_service_enabled $q_svc; then
+            $NEUTRON_BIN_DIR/neutron-db-manage --service $svc --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
+        fi
+    done
 }
 
 # install_neutron() - Collect source and prepare

From cecbd1ff6fa56052018422e4892b9f58239d12b3 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Mon, 5 Jan 2015 17:05:47 +0800
Subject: [PATCH 0219/3333] delete cinder configuration file before config it

Some misleading configuration item will remain if we don't delete the cinder
conf everytime before we configure it.

Change-Id: Iab6a5d7bc5fdcb05b28d24b0419c0bf380a140c1
Closes-bug: #1405301
---
 lib/cinder | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index c106424378..3e8ed53f81 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -205,6 +205,8 @@ function configure_cinder {
 
     cp -p $CINDER_DIR/etc/cinder/policy.json $CINDER_CONF_DIR
 
+    rm -f $CINDER_CONF
+
     configure_cinder_rootwrap
 
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI

From 7b47c47308a601839008413d20acacf2c52e3f45 Mon Sep 17 00:00:00 2001
From: Nels Nelson <nels.n.nelson@gmail.com>
Date: Mon, 5 Jan 2015 16:36:42 -0600
Subject: [PATCH 0220/3333] Customizing tempest configuration for libvirt-lxc

In order to support the continued testing of the libvirt driver
with lxc virtualization, certain compute features must be disabled
including rescue, resize, and suspend.

Change-Id: I52150fef11ba6e3ab2fd0acacaa3c64413c0c0d1
---
 lib/tempest | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 7cac6dd642..d31119bdf6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -464,6 +464,13 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
     fi
 
+    # Libvirt-LXC
+    if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
+        iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+        iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+    fi
+
     # service_available
     for service in ${TEMPEST_SERVICES//,/ }; do
         if is_service_enabled $service ; then

From 7c9df1017cb249afd329e915aab8a04b04940bc2 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Fri, 2 Jan 2015 18:39:29 +0100
Subject: [PATCH 0221/3333] Remove Fedora 19 as supported distribution

Fedora 19 will reach its end of life on 6-JAN-2015

  https://lists.fedoraproject.org/pipermail/announce/2014-December/003243.html

Remove it as a supported distribution and add Fedora 21

  - stack.sh: Remove Fedora 19 from list of 'supported' distributions.
  - tools/fixup_stuff.sh: Remove Fedora 19. Also remove the workaround
    of disabling firewalld for Fedora 21.

Change-Id: If92b87d2f9a2bb95469730cda201a7981670f727
---
 stack.sh             | 2 +-
 tools/fixup_stuff.sh | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 605d3cc889..61d9cd74cd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -143,7 +143,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f19|f20|f21|rhel6|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f20|f21|rhel6|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 26aae82535..c7f1efa441 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -111,8 +111,8 @@ if is_fedora; then
     fi
 
     FORCE_FIREWALLD=$(trueorfalse False $FORCE_FIREWALLD)
-    if [[ ${DISTRO} =~ (f19|f20) && $FORCE_FIREWALLD == "False" ]]; then
-        # On Fedora 19 and 20 firewalld interacts badly with libvirt and
+    if [[ ${DISTRO} =~ (f20) && $FORCE_FIREWALLD == "False" ]]; then
+        # On Fedora 20 firewalld interacts badly with libvirt and
         # slows things down significantly.  However, for those cases
         # where that combination is desired, allow this fix to be skipped.
 

From 2c65e71ab85a6271818048f79541e9b269566df5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 18 Dec 2014 09:44:56 -0500
Subject: [PATCH 0222/3333] Implement devstack external plugins

This is an initial pass at plugin infrastructure for devstack which
allows specifying an external repository via:

enable_plugin <name> <giturl> [branch]

It implements the devstack specification for this at
I173dee3d57967b1d2ffd30e4868a2832aeac97ce

Change-Id: I8e4175313b3cf0b12e981122358b1288a7eb0746
---
 doc/source/plugins.rst | 39 ++++++++++++++++++
 functions-common       | 92 +++++++++++++++++++++++++++++++++++++++++-
 stack.sh               | 34 ++++------------
 unstack.sh             |  8 ++--
 4 files changed, 141 insertions(+), 32 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 485cd0f04e..d1f73771a3 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -92,6 +92,45 @@ The arguments are:
 -  **clean** - Called by ``clean.sh`` before other services are cleaned,
    but after ``unstack.sh`` has been called.
 
+
+Externally Hosted Plugins
+=========================
+
+Based on the extras.d hooks, DevStack supports a standard mechansim
+for including plugins from external repositories. The plugin interface
+assumes the following:
+
+An external git repository that includes a ``devstack/`` top level
+directory. Inside this directory there can be 2 files.
+
+- ``settings`` - a file containing global variables that will be
+  sourced very early in the process. This is helpful if other plugins
+  might depend on this one, and need access to global variables to do
+  their work.
+- ``plugin.sh`` - the actual plugin. It will be executed by devstack
+  during it's run. The run order will be done in the registration
+  order for these plugins, and will occur immediately after all in
+  tree extras.d dispatch at the phase in question.  The plugin.sh
+  looks like the extras.d dispatcher above **except** it should not
+  include the is_service_enabled conditional. All external plugins are
+  always assumed to be enabled.
+
+Plugins are registered by adding the following to the localrc section
+of ``local.conf``.
+
+They are added in the following format::
+
+  enable_plugin <NAME> <GITURL> [GITREF]
+
+- ``name`` - an arbitrary name. (ex: glustfs, docker, zaqar, congress)
+- ``giturl`` - a valid git url that can be cloned
+- ``gitref`` - an optional git ref (branch / ref / tag) that will be
+  cloned. Defaults to master.
+
+An example would be as follows::
+
+  enable_plugin glusterfs https://github.com/sdague/devstack-plugins glusterfs
+
 Hypervisor
 ==========
 
diff --git a/functions-common b/functions-common
index 94ab34763e..1a0b5d6d1c 100644
--- a/functions-common
+++ b/functions-common
@@ -44,7 +44,6 @@ declare -A GITREPO
 declare -A GITBRANCH
 declare -A GITDIR
 
-
 # Config Functions
 # ================
 
@@ -1722,6 +1721,97 @@ function setup_package {
     fi
 }
 
+# Plugin Functions
+# =================
+
+DEVSTACK_PLUGINS=${DEVSTACK_PLUGINS:-""}
+
+# enable_plugin <name> <url> [branch]
+#
+# ``name`` is an arbitrary name - (aka: glusterfs, nova-docker, zaqar)
+# ``url`` is a git url
+# ``branch`` is a gitref. If it's not set, defaults to master
+function enable_plugin {
+    local name=$1
+    local url=$2
+    local branch=${3:-master}
+    DEVSTACK_PLUGINS+=",$name"
+    GITREPO[$name]=$url
+    GITDIR[$name]=$DEST/$name
+    GITBRANCH[$name]=$branch
+}
+
+# fetch_plugins
+#
+# clones all plugins
+function fetch_plugins {
+    local plugins="${DEVSTACK_PLUGINS}"
+    local plugin
+
+    # short circuit if nothing to do
+    if [[ -z $plugins ]]; then
+        return
+    fi
+
+    echo "Fetching devstack plugins"
+    for plugin in ${plugins//,/ }; do
+        git_clone_by_name $plugin
+    done
+}
+
+# load_plugin_settings
+#
+# Load settings from plugins in the order that they were registered
+function load_plugin_settings {
+    local plugins="${DEVSTACK_PLUGINS}"
+    local plugin
+
+    # short circuit if nothing to do
+    if [[ -z $plugins ]]; then
+        return
+    fi
+
+    echo "Loading plugin settings"
+    for plugin in ${plugins//,/ }; do
+        local dir=${GITDIR[$plugin]}
+        # source any known settings
+        if [[ -f $dir/devstack/settings ]]; then
+            source $dir/devstack/settings
+        fi
+    done
+}
+
+# run_plugins
+#
+# Run the devstack/plugin.sh in all the plugin directories. These are
+# run in registration order.
+function run_plugins {
+    local mode=$1
+    local phase=$2
+    for plugin in ${plugins//,/ }; do
+        local dir=${GITDIR[$plugin]}
+        if [[ -f $dir/devstack/plugin.sh ]]; then
+            source $dir/devstack/plugin.sh $mode $phase
+        fi
+    done
+}
+
+function run_phase {
+    local mode=$1
+    local phase=$2
+    if [[ -d $TOP_DIR/extras.d ]]; then
+        for i in $TOP_DIR/extras.d/*.sh; do
+            [[ -r $i ]] && source $i $mode $phase
+        done
+    fi
+    # the source phase corresponds to settings loading in plugins
+    if [[ "$mode" == "source" ]]; then
+        load_plugin_settings
+    else
+        run_plugins $mode $phase
+    fi
+}
+
 
 # Service Functions
 # =================
diff --git a/stack.sh b/stack.sh
index 605d3cc889..d4f2afc61b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -564,15 +564,14 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 
+# Clone all external plugins
+fetch_plugins
+
 # Extras Source
 # --------------
 
 # Phase: source
-if [[ -d $TOP_DIR/extras.d ]]; then
-    for i in $TOP_DIR/extras.d/*.sh; do
-        [[ -r $i ]] && source $i source
-    done
-fi
+run_phase source
 
 # Interactive Configuration
 # -------------------------
@@ -714,12 +713,7 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # ------------------
 
 # Phase: pre-install
-if [[ -d $TOP_DIR/extras.d ]]; then
-    for i in $TOP_DIR/extras.d/*.sh; do
-        [[ -r $i ]] && source $i stack pre-install
-    done
-fi
-
+run_phase stack pre-install
 
 install_rpc_backend
 
@@ -865,11 +859,7 @@ fi
 # --------------
 
 # Phase: install
-if [[ -d $TOP_DIR/extras.d ]]; then
-    for i in $TOP_DIR/extras.d/*.sh; do
-        [[ -r $i ]] && source $i stack install
-    done
-fi
+run_phase stack install
 
 if [[ $TRACK_DEPENDS = True ]]; then
     $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
@@ -1142,11 +1132,7 @@ fi
 # ====================
 
 # Phase: post-config
-if [[ -d $TOP_DIR/extras.d ]]; then
-    for i in $TOP_DIR/extras.d/*.sh; do
-        [[ -r $i ]] && source $i stack post-config
-    done
-fi
+run_phase stack post-config
 
 
 # Local Configuration
@@ -1328,11 +1314,7 @@ merge_config_group $TOP_DIR/local.conf extra
 # ==========
 
 # Phase: extra
-if [[ -d $TOP_DIR/extras.d ]]; then
-    for i in $TOP_DIR/extras.d/*.sh; do
-        [[ -r $i ]] && source $i stack extra
-    done
-fi
+run_phase stack extra
 
 # Local Configuration
 # ===================
diff --git a/unstack.sh b/unstack.sh
index 3403919042..ea45da9fc4 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -66,6 +66,8 @@ if [[ -d $TOP_DIR/extras.d ]]; then
     done
 fi
 
+load_plugin_settings
+
 # Determine what system we are running on.  This provides ``os_VENDOR``,
 # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
 GetOSVersion
@@ -78,11 +80,7 @@ fi
 # ==========
 
 # Phase: unstack
-if [[ -d $TOP_DIR/extras.d ]]; then
-    for i in $TOP_DIR/extras.d/*.sh; do
-        [[ -r $i ]] && source $i unstack
-    done
-fi
+run_phase unstack
 
 if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
     source $TOP_DIR/openrc

From 826e4509363ff6415a257ce1ff9ea13af390d47d Mon Sep 17 00:00:00 2001
From: Angus Salkeld <asalkeld@mirantis.com>
Date: Wed, 7 Jan 2015 17:52:05 +1000
Subject: [PATCH 0223/3333] Add support for enabling heat adopt and abandon

This is by default disabled, but we need to enable
it to test it in the gate.

Change-Id: I2339ebcaf4bd6308041675bcd35c0b70206e2e5e
---
 lib/heat | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/heat b/lib/heat
index 49ed5331aa..e3e5d0eb65 100644
--- a/lib/heat
+++ b/lib/heat
@@ -38,6 +38,7 @@ HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
 HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
 HEAT_STANDALONE=`trueorfalse False $HEAT_STANDALONE`
+HEAT_ENABLE_ADOPT_ABANDON=`trueorfalse False $HEAT_ENABLE_ADOPT_ABANDON`
 HEAT_CONF_DIR=/etc/heat
 HEAT_CONF=$HEAT_CONF_DIR/heat.conf
 HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
@@ -152,6 +153,11 @@ function configure_heat {
         iniset $HEAT_CONF clients_cinder ca_file $SSL_BUNDLE_FILE
     fi
 
+    if [[ "$HEAT_ENABLE_ADOPT_ABANDON" = "True" ]]; then
+        iniset $HEAT_CONF DEFAULT enable_stack_adopt true
+        iniset $HEAT_CONF DEFAULT enable_stack_abandon true
+    fi
+
     # heat environment
     sudo mkdir -p $HEAT_ENV_DIR
     sudo chown $STACK_USER $HEAT_ENV_DIR

From f303d7ed0b2061b49eb9390c7b8f2a18de7bc8dd Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Tue, 6 Jan 2015 12:18:03 -0800
Subject: [PATCH 0224/3333] Allow specification of ironic callback timeout

We need to be able to adjust Ironic's timeout for a node's deployment
callback.  The default is much longer than Tempest's server build
timeout, causing Ironic deployment issues to be masked by more generic
server timeouts in the tempest logs.  Being able to set this to be
lower than the nova timeout, we'll have Ironic errors that we can
fingerprint.

Change-Id: I7b8eeda504da7ffd64967bbcfa2625acf418f263
Related-bug: #1408067
---
 lib/ironic | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/ironic b/lib/ironic
index 3f7ae2111c..68641426e9 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -42,6 +42,9 @@ IRONIC_CONF_FILE=$IRONIC_CONF_DIR/ironic.conf
 IRONIC_ROOTWRAP_CONF=$IRONIC_CONF_DIR/rootwrap.conf
 IRONIC_POLICY_JSON=$IRONIC_CONF_DIR/policy.json
 
+# Deploy callback timeout can be changed from its default (1800), if required.
+IRONIC_CALLBACK_TIMEOUT=${IRONIC_CALLBACK_TIMEOUT:-}
+
 # Deploy to hardware platform
 IRONIC_HW_NODE_CPU=${IRONIC_HW_NODE_CPU:-1}
 IRONIC_HW_NODE_RAM=${IRONIC_HW_NODE_RAM:-512}
@@ -300,6 +303,9 @@ function configure_ironic_conductor {
     iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF
     iniset $IRONIC_CONF_FILE DEFAULT enabled_drivers $IRONIC_ENABLED_DRIVERS
     iniset $IRONIC_CONF_FILE conductor api_url $IRONIC_SERVICE_PROTOCOL://$HOST_IP:$IRONIC_SERVICE_PORT
+    if [[ -n "$IRONIC_CALLBACK_TIMEOUT" ]]; then
+        iniset $IRONIC_CONF_FILE conductor deploy_callback_timeout $IRONIC_CALLBACK_TIMEOUT
+    fi
     iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
     iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
     iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images

From 441ff07b97b4d44a25479912ff2878be3fa6e9a9 Mon Sep 17 00:00:00 2001
From: Bharat Kumar Kobagana <bharat.kobagana@redhat.com>
Date: Thu, 8 Jan 2015 12:26:26 +0530
Subject: [PATCH 0225/3333] Fixing the problem in loading plugins

This patch fixes the problem in loading the plugins in devstack
by defining the "plugins" variable in "run_plugins" function of
devstack/functions-common file.

Change-Id: I9fb0e24bf1fd282931a8489e0a8ec0c9ea078520
Closes-Bug: 1408571
---
 functions-common | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/functions-common b/functions-common
index 56106b3194..7a6c3a127c 100644
--- a/functions-common
+++ b/functions-common
@@ -1803,6 +1803,9 @@ function load_plugin_settings {
 function run_plugins {
     local mode=$1
     local phase=$2
+
+    local plugins="${DEVSTACK_PLUGINS}"
+    local plugin
     for plugin in ${plugins//,/ }; do
         local dir=${GITDIR[$plugin]}
         if [[ -f $dir/devstack/plugin.sh ]]; then

From d3ca1418c4f048be58080bd51c9497abe33d49b9 Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Sun, 21 Dec 2014 23:36:43 -0800
Subject: [PATCH 0226/3333] Fix matchmaker-redis dependencies for zeromq driver

Add an option 'ZEROMQ_MATCHMAKER' to indicate which
matchmaker driver to use.

When it indicates 'redis', the dependencies will be
installed.

Change-Id: I910b48347bad0685ea10083a3b0b243524f32095
Partially-Implements: blueprint zeromq
---
 lib/rpc_backend | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 172d024f90..778d466963 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -87,11 +87,20 @@ function cleanup_rpc_backend {
         fi
     elif is_service_enabled zeromq; then
         if is_fedora; then
-            uninstall_package zeromq python-zmq redis
+            uninstall_package zeromq python-zmq
+            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+                uninstall_package redis python-redis
+            fi
         elif is_ubuntu; then
-            uninstall_package libzmq1 python-zmq redis-server
+            uninstall_package libzmq1 python-zmq
+            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+                uninstall_package redis-server python-redis
+            fi
         elif is_suse; then
-            uninstall_package libzmq1 python-pyzmq redis
+            uninstall_package libzmq1 python-pyzmq
+            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+                uninstall_package redis python-redis
+            fi
         else
             exit_distro_not_supported "zeromq installation"
         fi
@@ -150,11 +159,20 @@ function install_rpc_backend {
         # but there is a matchmaker driver that works
         # really well & out of the box for multi-node.
         if is_fedora; then
-            install_package zeromq python-zmq redis
+            install_package zeromq python-zmq
+            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+                install_package redis python-redis
+            fi
         elif is_ubuntu; then
-            install_package libzmq1 python-zmq redis-server
+            install_package libzmq1 python-zmq
+            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+                install_package redis-server python-redis
+            fi
         elif is_suse; then
-            install_package libzmq1 python-pyzmq redis
+            install_package libzmq1 python-pyzmq
+            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+                install_package redis python-redis
+            fi
         else
             exit_distro_not_supported "zeromq installation"
         fi

From 26ac3d7ebbc739a2a5378716aebaa68c6ab9c84d Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Sun, 21 Dec 2014 23:41:07 -0800
Subject: [PATCH 0227/3333] Fix service start sequence

1. zmq-receiver should be started in advance
2. when using zeromq driver, nova-compute relies
on nova-conductor's rpc to be initialized

This fix is totally safe and won't influence
on other services.

Change-Id: I9d7b682df4d411af24a1ff6bcad79697e32fa723
Partially-Implements: blueprint zeromq
---
 lib/nova |  2 +-
 stack.sh | 13 ++++++++-----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index cbfbdfa69f..5ac9ff1a2b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -769,8 +769,8 @@ function start_nova_rest {
 }
 
 function start_nova {
-    start_nova_compute
     start_nova_rest
+    start_nova_compute
 }
 
 function stop_nova_compute {
diff --git a/stack.sh b/stack.sh
index b064c22f8f..3fa32125ac 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1030,6 +1030,14 @@ if is_service_enabled key; then
 fi
 
 
+# ZeroMQ
+# ------
+if is_service_enabled zeromq; then
+    echo_summary "Starting zeromq receiver"
+    run_process zeromq "$OSLO_BIN_DIR/oslo-messaging-zmq-receiver"
+fi
+
+
 # Horizon
 # -------
 
@@ -1208,11 +1216,6 @@ if is_service_enabled nova; then
     iniset $NOVA_CONF keymgr fixed_key $(generate_hex_string 32)
 fi
 
-if is_service_enabled zeromq; then
-    echo_summary "Starting zermomq receiver"
-    run_process zeromq "$OSLO_BIN_DIR/oslo-messaging-zmq-receiver"
-fi
-
 # Launch the nova-api and wait for it to answer before continuing
 if is_service_enabled n-api; then
     echo_summary "Starting Nova API"

From b968b0c36b09b8b5df860d5334e175ec75a838f6 Mon Sep 17 00:00:00 2001
From: Shuichiro MAKIGAKI <shuichiro.makigaki@gmail.com>
Date: Sun, 4 Jan 2015 17:53:12 +0900
Subject: [PATCH 0228/3333] Fix comments to use 'local.conf' instead of
 'localrc'

Instead of 'localrc', 'local.conf' should be used.
Example codes to enable neutron also should follow local.conf syntax.

Change-Id: I4f4c03fdbf0f612e5b518177b29669fb202d9f7a
Closes-Bug: #1407391
---
 stackrc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index be27dceac1..355c0dca7c 100644
--- a/stackrc
+++ b/stackrc
@@ -33,7 +33,8 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 # For example, to enable Swift add this to ``local.conf``:
 #  enable_service s-proxy s-object s-container s-account
 # In order to enable Neutron (a single node setup) add the following
-# settings in `` localrc``:
+# settings in ``local.conf``:
+#  [[local|localrc]]
 #  disable_service n-net
 #  enable_service q-svc
 #  enable_service q-agt
@@ -529,8 +530,8 @@ CIRROS_VERSION=${CIRROS_VERSION:-"0.3.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
-# which may be set in ``localrc``.  Also allow ``DEFAULT_IMAGE_NAME`` and
-# ``IMAGE_URLS`` to be set directly in ``localrc``.
+# which may be set in ``local.conf``.  Also allow ``DEFAULT_IMAGE_NAME`` and
+# ``IMAGE_URLS`` to be set in the `localrc` section of ``local.conf``.
 case "$VIRT_DRIVER" in
     openvz)
         DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ubuntu-12.04-x86_64}

From afc1423e70074762e5c8d74b7295b9e55f91a44c Mon Sep 17 00:00:00 2001
From: git-harry <git-harry@live.co.uk>
Date: Thu, 8 Jan 2015 17:37:40 +0000
Subject: [PATCH 0229/3333] Change default nova service name in cinder.conf

In cinder the config options nova_catalog_info and
nova_catalog_admin_info define values to be matched when searching for
the correct compute service in the catalog.

The commit 5ad15c040fdc115bca9efb1c952279988a2a48b3 in the cinder
project has changed these defaults.

This commit sets the options in cinder.conf to the values set by
devstack.

Change-Id: I2a0b09c34fac5f63a5cdbbe05761a0857f243465
Closes-Bug: #1408734
---
 lib/cinder | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index c106424378..9d27daa091 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -110,6 +110,12 @@ if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     done
 fi
 
+# Change the default nova_catalog_info and nova_catalog_admin_info values in
+# cinder so that the service name cinder is searching for matches that set for
+# nova in keystone.
+CINDER_NOVA_CATALOG_INFO=${CINDER_NOVA_CATALOG_INFO:-compute:nova:publicURL}
+CINDER_NOVA_CATALOG_ADMIN_INFO=${CINDER_NOVA_CATALOG_ADMIN_INFO:-compute:nova:adminURL}
+
 
 # Functions
 # ---------
@@ -220,6 +226,9 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
+    iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
+    iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
+
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $CINDER_CONF DEFAULT verbose True

From 13519e8a5b8bb9141ecff09f5273d5c2896a8082 Mon Sep 17 00:00:00 2001
From: Maru Newby <marun@redhat.com>
Date: Fri, 9 Jan 2015 13:06:56 +0000
Subject: [PATCH 0230/3333] Fix get_packages when $DISTRO is not set

Sourcing the tools/install-prereqs.sh script with TOP_DIR set results
in GetDistro being called in get_packages and echoing the result.
Since all output from get_packages is assumed to be package names,
this results in the attempted installation of the non-existant 'Found'
'Distro' and '[distro name]' packages.  This change removes the echo
statement to avoid this problem.

Change-Id: Idd05c31b9eec9e6209666fa16fa425cdf1f35aa2
---
 functions-common | 1 -
 1 file changed, 1 deletion(-)

diff --git a/functions-common b/functions-common
index 7a6c3a127c..3b4309a15d 100644
--- a/functions-common
+++ b/functions-common
@@ -1011,7 +1011,6 @@ function get_packages {
     fi
     if [[ -z "$DISTRO" ]]; then
         GetDistro
-        echo "Found Distro $DISTRO"
     fi
     for service in ${services//,/ }; do
         # Allow individual services to specify dependencies

From 5ecf46b581b70d2ef9139ad168c80f532e901abb Mon Sep 17 00:00:00 2001
From: Maru Newby <marun@redhat.com>
Date: Fri, 9 Jan 2015 13:35:18 +0000
Subject: [PATCH 0231/3333] Add 'acl' package to neutron deps

The acl package has been added as a test-only dependency of neutron.
It is used by the functional job in configuring postgres.

Change-Id: Ie28da793237b51cced3bd0a9b35273d9c50472e8
---
 files/debs/neutron      | 1 +
 files/rpms-suse/neutron | 1 +
 files/rpms/neutron      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/neutron b/files/debs/neutron
index fd99677412..5a59b22b9d 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -1,3 +1,4 @@
+acl     # testonly
 ebtables
 iptables
 iputils-ping
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 8431bd1bd0..50ee145928 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -1,3 +1,4 @@
+acl     # testonly
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
diff --git a/files/rpms/neutron b/files/rpms/neutron
index f2473fb20d..5450408a35 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -1,4 +1,5 @@
 MySQL-python
+acl     # testonly
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables

From b31304829f4ec3830c30fcf25c55f100ebfe7227 Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Tue, 16 Dec 2014 14:36:59 -0800
Subject: [PATCH 0232/3333] Register heat image in sahara image registry for
 fake plugin

Fake plugin can work with heat image. Even more, sahara uses heat
to provision instances. So, registering image in sahara image
registry.

Change-Id: Ie498fc05d0afe7f276b6f29f20a61abb58a5c676
Closes-Bug: #1402856
---
 extras.d/70-sahara.sh |  1 +
 lib/sahara            | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/extras.d/70-sahara.sh b/extras.d/70-sahara.sh
index 2a349991ef..f177766d3b 100644
--- a/extras.d/70-sahara.sh
+++ b/extras.d/70-sahara.sh
@@ -15,6 +15,7 @@ if is_service_enabled sahara; then
         create_sahara_accounts
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing sahara"
+        sahara_register_images
         start_sahara
     fi
 
diff --git a/lib/sahara b/lib/sahara
index c902d385d1..03b902e5b6 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -11,6 +11,7 @@
 # install_sahara
 # install_python_saharaclient
 # configure_sahara
+# sahara_register_images
 # start_sahara
 # stop_sahara
 # cleanup_sahara
@@ -161,6 +162,17 @@ function install_python_saharaclient {
     fi
 }
 
+# sahara_register_images() - Registers images in sahara image registry
+function sahara_register_images {
+    if is_service_enabled heat && [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
+        # Register heat image for Fake plugin
+        local fake_plugin_properties="--property _sahara_tag_0.1=True"
+        fake_plugin_properties+=" --property _sahara_tag_fake=True"
+        fake_plugin_properties+=" --property _sahara_username=fedora"
+        openstack --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image set $(basename "$HEAT_CFN_IMAGE_URL" ".qcow2") $fake_plugin_properties
+    fi
+}
+
 # start_sahara() - Start running processes, including screen
 function start_sahara {
     run_process sahara "$SAHARA_BIN_DIR/sahara-all --config-file $SAHARA_CONF_FILE"

From 78b7726dddb2e317370cfc4699a93c759cabed9a Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 19 Dec 2014 12:56:01 +1000
Subject: [PATCH 0233/3333] Configure auth_token middleware by auth plugin

As of release 1.3 auth_token middleware can be configured to use any
authentication plugin. This allows us to move to the more generic
password mechanism which will default to using keystone v3 if available.

This will allow in future revisions to move the devstack service users
out of the default domain.

Work will need to be done in heat to remove it's dependency on the
(supposed to be private) keystone_authtoken CONF values.

Change-Id: Ieac26806bd420aa08fc79bbc6a11eb6a1c15c7df
---
 lib/heat     | 13 ++++++++++++-
 lib/keystone | 26 +++++++++-----------------
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/lib/heat b/lib/heat
index 4e72caeb54..019f668ae4 100644
--- a/lib/heat
+++ b/lib/heat
@@ -114,7 +114,18 @@ function configure_heat {
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
-    configure_auth_token_middleware $HEAT_CONF heat $HEAT_AUTH_CACHE_DIR
+    # NOTE(jamielennox): heat re-uses specific values from the
+    # keystone_authtoken middleware group and so currently fails when using the
+    # auth plugin setup. This should be fixed in heat.  Heat is also the only
+    # service that requires the auth_uri to include a /v2.0. Remove this custom
+    # setup when bug #1300246 is resolved.
+    iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+    iniset $HEAT_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
+    iniset $HEAT_CONF keystone_authtoken admin_user heat
+    iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
+    iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
+    iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
 
     if is_ssl_enabled_service "key"; then
         iniset $HEAT_CONF clients_keystone ca_file $SSL_BUNDLE_FILE
diff --git a/lib/keystone b/lib/keystone
index 1599fa5738..9c15688062 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -407,15 +407,6 @@ function create_keystone_accounts {
     fi
 }
 
-# Configure the API version for the OpenStack projects.
-# configure_API_version conf_file version [section]
-function configure_API_version {
-    local conf_file=$1
-    local api_version=$2
-    local section=${3:-keystone_authtoken}
-    iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$api_version
-}
-
 # Configure the service to use the auth token middleware.
 #
 # configure_auth_token_middleware conf_file admin_user signing_dir [section]
@@ -429,15 +420,16 @@ function configure_auth_token_middleware {
     local signing_dir=$3
     local section=${4:-keystone_authtoken}
 
-    iniset $conf_file $section auth_host $KEYSTONE_AUTH_HOST
-    iniset $conf_file $section auth_port $KEYSTONE_AUTH_PORT
-    iniset $conf_file $section auth_protocol $KEYSTONE_AUTH_PROTOCOL
-    iniset $conf_file $section identity_uri $KEYSTONE_AUTH_URI
+    iniset $conf_file $section auth_plugin password
+    iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
+    iniset $conf_file $section username $admin_user
+    iniset $conf_file $section password $SERVICE_PASSWORD
+    iniset $conf_file $section user_domain_id default
+    iniset $conf_file $section project_name $SERVICE_TENANT_NAME
+    iniset $conf_file $section project_domain_id default
+
+    iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    configure_API_version $conf_file $IDENTITY_API_VERSION $section
-    iniset $conf_file $section admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $conf_file $section admin_user $admin_user
-    iniset $conf_file $section admin_password $SERVICE_PASSWORD
     iniset $conf_file $section signing_dir $signing_dir
 }
 

From 5893cc7c5f14ecf645a010b930577eaaa01a3eb8 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Mon, 22 Dec 2014 11:49:42 +0100
Subject: [PATCH 0234/3333] neutron: use config files from neutron-*aas repos

Now that we split the neutron repository and have service configuration
files maintained in their own repos, start using them.

The old files are going to be cleaned up from the Neutron tree.

Change-Id: Iaeff0b9de88e9bcca87da1092cc888c4cc1bedfd
---
 lib/neutron                               | 20 +++++++++++++-------
 lib/neutron_plugins/services/firewall     |  2 +-
 lib/neutron_plugins/services/loadbalancer |  3 ++-
 lib/neutron_plugins/services/vpn          |  1 +
 4 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 6c9d7b9a9e..111a13b445 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -898,7 +898,7 @@ function _configure_neutron_l3_agent {
     Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
 
     if is_service_enabled q-vpn; then
-        cp $NEUTRON_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+        cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
     fi
 
     cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE
@@ -1024,22 +1024,28 @@ function _neutron_service_plugin_class_add {
     fi
 }
 
+# _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
+function _neutron_deploy_rootwrap_filters {
+    local srcdir=$1
+    mkdir -p -m 755 $Q_CONF_ROOTWRAP_D
+    sudo cp -pr $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
+    sudo chown -R root:root $Q_CONF_ROOTWRAP_D
+    sudo chmod 644 $Q_CONF_ROOTWRAP_D/*
+}
+
 # _neutron_setup_rootwrap() - configure Neutron's rootwrap
 function _neutron_setup_rootwrap {
     if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
         return
     fi
-    # Deploy new rootwrap filters files (owned by root).
     # Wipe any existing ``rootwrap.d`` files first
     Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
     if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
         sudo rm -rf $Q_CONF_ROOTWRAP_D
     fi
-    # Deploy filters to ``$NEUTRON_CONF_DIR/rootwrap.d``
-    mkdir -p -m 755 $Q_CONF_ROOTWRAP_D
-    cp -pr $NEUTRON_DIR/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
-    sudo chown -R root:root $Q_CONF_ROOTWRAP_D
-    sudo chmod 644 $Q_CONF_ROOTWRAP_D/*
+
+    _neutron_deploy_rootwrap_filters $NEUTRON_DIR
+
     # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
     # location moved in newer versions, prefer new location
     if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index a1c13ed153..61a148e596 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -13,7 +13,7 @@ function neutron_fwaas_configure_common {
 
 function neutron_fwaas_configure_driver {
     FWAAS_DRIVER_CONF_FILENAME=/etc/neutron/fwaas_driver.ini
-    cp $NEUTRON_DIR/etc/fwaas_driver.ini $FWAAS_DRIVER_CONF_FILENAME
+    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini $FWAAS_DRIVER_CONF_FILENAME
 
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index bd9dc8731b..f465cc94b4 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -17,6 +17,7 @@ function neutron_agent_lbaas_install_agent_packages {
 
 function neutron_agent_lbaas_configure_common {
     _neutron_service_plugin_class_add $LBAAS_PLUGIN
+    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
 }
 
 function neutron_agent_lbaas_configure_agent {
@@ -25,7 +26,7 @@ function neutron_agent_lbaas_configure_agent {
 
     LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
 
-    cp $NEUTRON_DIR/etc/lbaas_agent.ini $LBAAS_AGENT_CONF_FILENAME
+    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini $LBAAS_AGENT_CONF_FILENAME
 
     # ovs_use_veth needs to be set before the plugin configuration
     # occurs to allow plugins to override the setting.
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 07f1f35d9a..7e80b5b5f8 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -16,6 +16,7 @@ function neutron_vpn_install_agent_packages {
 
 function neutron_vpn_configure_common {
     _neutron_service_plugin_class_add $VPN_PLUGIN
+    _neutron_deploy_rootwrap_filters $NEUTRON_VPNAAS_DIR
 }
 
 function neutron_vpn_stop {

From 06005723922dcecff9be67685345e02f8f173ca8 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Tue, 13 Jan 2015 16:36:43 +1300
Subject: [PATCH 0235/3333] log dstat top io

We aren't always cpu bound, track top io usage as well.

Change-Id: I3c16b851ebab61ef96a6e3016237a294038561de
---
 lib/dstat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dstat b/lib/dstat
index 8f456a879f..73ca279fea 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -26,7 +26,7 @@ DSTAT_FILE=${DSTAT_FILE:-"dstat.txt"}
 # start_dstat() - Start running processes, including screen
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
-    DSTAT_OPTS="-tcmndrylpg --top-cpu-adv"
+    DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
     if [[ -n ${SCREEN_LOGDIR} ]]; then
         screen_it dstat "cd $TOP_DIR; dstat $DSTAT_OPTS | tee $SCREEN_LOGDIR/$DSTAT_FILE"
     else

From 6ce071b796d7bbf851df225ca7097d2de26b3456 Mon Sep 17 00:00:00 2001
From: Radoslaw Smigielski <radoslaw.smigielski@alcatel-lucent.com>
Date: Tue, 13 Jan 2015 06:29:31 +0000
Subject: [PATCH 0236/3333] Depreciated pip option PIP_DOWNLOAD_CACHE removal

Fix warning:
DEPRECATION: --download-cache has been deprecated and will be removed in the
future. Pip now automatically uses and configures its cache.

1. Since version 6.0 (2014-12-22) pip has deprecated PIP_DOWNLOAD_CACHE
   and now automatically uses and configures its cache.
   Default new location is $HOME/.cache/pip.
2. pip gets upgraded to the latest version in tools/install_pip.sh
   but if pip version<6, exit with error: "Currently installed pip version
   ${pip_version} does not meet meet minimum requirements"

Change-Id: I8b203ffc6d9cf588462d0d65a9703a9941d8fa71
---
 functions-common | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index 40a0d2b942..30f99ba3e9 100644
--- a/functions-common
+++ b/functions-common
@@ -26,7 +26,6 @@
 # - ``ERROR_ON_CLONE``
 # - ``FILES``
 # - ``OFFLINE``
-# - ``PIP_DOWNLOAD_CACHE``
 # - ``RECLONE``
 # - ``REQUIREMENTS_DIR``
 # - ``STACK_USER``
@@ -1555,8 +1554,7 @@ function get_python_exec_prefix {
 }
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
-# Uses globals ``OFFLINE``, ``PIP_DOWNLOAD_CACHE``,
-# ``TRACK_DEPENDS``, ``*_proxy``
+# Uses globals ``OFFLINE``, ``TRACK_DEPENDS``, ``*_proxy``
 # pip_install package [package ...]
 function pip_install {
     local xtrace=$(set +o | grep xtrace)
@@ -1581,8 +1579,15 @@ function pip_install {
         local sudo_pip="sudo -H"
     fi
 
+    local pip_version=$(python -c "import pip; \
+                        print(pip.__version__.strip('.')[0])")
+    if (( pip_version<6 )); then
+        die $LINENO "Currently installed pip version ${pip_version} does not" \
+            "meet minimum requirements (>=6)."
+    fi
+
     $xtrace
-    $sudo_pip PIP_DOWNLOAD_CACHE=${PIP_DOWNLOAD_CACHE:-/var/cache/pip} \
+    $sudo_pip \
         http_proxy=$http_proxy \
         https_proxy=$https_proxy \
         no_proxy=$no_proxy \
@@ -1593,7 +1598,7 @@ function pip_install {
     if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
         local test_req="$@/test-requirements.txt"
         if [[ -e "$test_req" ]]; then
-            $sudo_pip PIP_DOWNLOAD_CACHE=${PIP_DOWNLOAD_CACHE:-/var/cache/pip} \
+            $sudo_pip \
                 http_proxy=$http_proxy \
                 https_proxy=$https_proxy \
                 no_proxy=$no_proxy \

From 4eb04a5f9e378fa67175056ab94b5803db2be875 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <sebastien.han@enovance.com>
Date: Thu, 4 Dec 2014 16:22:41 +0100
Subject: [PATCH 0237/3333] Ability to use a remote Ceph cluster
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sometimes we want to run some benchmarks on virtual machines that will be
backed by a Ceph cluster. The first idea that comes in our mind is to
use devstack to quickly get an OpenStack up and running but what about
the configuration of Devstack with this remote cluster?

Thanks to this commit it's now possible to use an already existing Ceph
cluster. In this case Devstack just needs two things:

* the location of the Ceph config file (by default devstack will look
for /etc/ceph/ceph.conf
* the admin key of the remote ceph cluster (by default devstack will
look for /etc/ceph/ceph.client.admin.keyring)

Devstack will then create the necessary pools, users, keys and will
connect the OpenStack environment as usual. During the unstack phase
every pools, users and keys will be deleted on the remote cluster while
local files and ceph-common package will be removed from the current
Devstack host.

To enable this mode simply add REMOTE_CEPH=True to your localrc file.

Change-Id: I1a4b6fd676d50b6a41a09e7beba9b11f8d1478f7
Signed-off-by: Sébastien Han <sebastien.han@enovance.com>
---
 extras.d/60-ceph.sh      |  52 +++++++++++++++----
 lib/ceph                 | 106 ++++++++++++++++++++++++++++-----------
 lib/cinder_backends/ceph |  10 ++--
 3 files changed, 125 insertions(+), 43 deletions(-)

diff --git a/extras.d/60-ceph.sh b/extras.d/60-ceph.sh
index 50bdfaee3b..38b901b767 100644
--- a/extras.d/60-ceph.sh
+++ b/extras.d/60-ceph.sh
@@ -6,14 +6,19 @@ if is_service_enabled ceph; then
         source $TOP_DIR/lib/ceph
     elif [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
         echo_summary "Installing Ceph"
-        install_ceph
-        echo_summary "Configuring Ceph"
-        configure_ceph
-        # NOTE (leseb): Do everything here because we need to have Ceph started before the main
-        # OpenStack components. Ceph OSD must start here otherwise we can't upload any images.
-        echo_summary "Initializing Ceph"
-        init_ceph
-        start_ceph
+        check_os_support_ceph
+        if [ "$REMOTE_CEPH" = "False" ]; then
+            install_ceph
+            echo_summary "Configuring Ceph"
+            configure_ceph
+            # NOTE (leseb): Do everything here because we need to have Ceph started before the main
+            # OpenStack components. Ceph OSD must start here otherwise we can't upload any images.
+            echo_summary "Initializing Ceph"
+            init_ceph
+            start_ceph
+        else
+            install_ceph_remote
+        fi
     elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
         if is_service_enabled glance; then
             echo_summary "Configuring Glance for Ceph"
@@ -32,14 +37,39 @@ if is_service_enabled ceph; then
             echo_summary "Configuring libvirt secret"
             import_libvirt_secret_ceph
         fi
+
+        if [ "$REMOTE_CEPH" = "False" ]; then
+            if is_service_enabled glance; then
+                echo_summary "Configuring Glance for Ceph"
+                configure_ceph_embedded_glance
+            fi
+            if is_service_enabled nova; then
+                echo_summary "Configuring Nova for Ceph"
+                configure_ceph_embedded_nova
+            fi
+            if is_service_enabled cinder; then
+                echo_summary "Configuring Cinder for Ceph"
+                configure_ceph_embedded_cinder
+            fi
+        fi
     fi
 
     if [[ "$1" == "unstack" ]]; then
-        stop_ceph
-        cleanup_ceph
+        if [ "$REMOTE_CEPH" = "True" ]; then
+            cleanup_ceph_remote
+        else
+            cleanup_ceph_embedded
+            stop_ceph
+        fi
+        cleanup_ceph_general
     fi
 
     if [[ "$1" == "clean" ]]; then
-        cleanup_ceph
+        if [ "$REMOTE_CEPH" = "True" ]; then
+            cleanup_ceph_remote
+        else
+            cleanup_ceph_embedded
+        fi
+        cleanup_ceph_general
     fi
 fi
diff --git a/lib/ceph b/lib/ceph
index 521430626b..d5c916f084 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -68,6 +68,11 @@ CINDER_CEPH_UUID=${CINDER_CEPH_UUID:-$(uuidgen)}
 CEPH_REPLICAS=${CEPH_REPLICAS:-1}
 CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
 
+# Connect to an existing Ceph cluster
+REMOTE_CEPH=$(trueorfalse False $REMOTE_CEPH)
+REMOTE_CEPH_ADMIN_KEY_PATH=${REMOTE_CEPH_ADMIN_KEY_PATH:-$CEPH_CONF_DIR/ceph.client.admin.keyring}
+
+
 # Functions
 # ------------
 
@@ -92,29 +97,69 @@ EOF
     sudo rm -f secret.xml
 }
 
+# undefine_virsh_secret() - Undefine Cinder key secret from libvirt
+function undefine_virsh_secret {
+    if is_service_enabled cinder || is_service_enabled nova; then
+        local virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
+        sudo virsh secret-undefine ${virsh_uuid} >/dev/null 2>&1
+    fi
+}
+
+
+# check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
+function check_os_support_ceph {
+    if [[ ! ${DISTRO} =~ (trusty|f20|f21) ]]; then
+        echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
+        if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
+            die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
+        fi
+        NO_UPDATE_REPOS=False
+    fi
+}
+
 # cleanup_ceph() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
-function cleanup_ceph {
+function cleanup_ceph_remote {
+    # do a proper cleanup from here to avoid leftover on the remote Ceph cluster
+    if is_service_enabled glance; then
+        sudo ceph osd pool delete $GLANCE_CEPH_POOL $GLANCE_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
+        sudo ceph auth del client.$GLANCE_CEPH_USER > /dev/null 2>&1
+    fi
+    if is_service_enabled cinder; then
+        sudo ceph osd pool delete $CINDER_CEPH_POOL $CINDER_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
+        sudo ceph auth del client.$CINDER_CEPH_USER > /dev/null 2>&1
+    fi
+    if is_service_enabled c-bak; then
+        sudo ceph osd pool delete $CINDER_BAK_CEPH_POOL $CINDER_BAK_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
+        sudo ceph auth del client.$CINDER_BAK_CEPH_USER > /dev/null 2>&1
+    fi
+    if is_service_enabled nova; then
+        iniset $NOVA_CONF libvirt rbd_secret_uuid ""
+        sudo ceph osd pool delete $NOVA_CEPH_POOL $NOVA_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
+    fi
+}
+
+function cleanup_ceph_embedded {
     sudo pkill -f ceph-mon
     sudo pkill -f ceph-osd
     sudo rm -rf ${CEPH_DATA_DIR}/*/*
-    sudo rm -rf ${CEPH_CONF_DIR}/*
     if egrep -q ${CEPH_DATA_DIR} /proc/mounts; then
         sudo umount ${CEPH_DATA_DIR}
     fi
     if [[ -e ${CEPH_DISK_IMAGE} ]]; then
         sudo rm -f ${CEPH_DISK_IMAGE}
     fi
+}
+
+function cleanup_ceph_general {
+    undefine_virsh_secret
     uninstall_package ceph ceph-common python-ceph libcephfs1 > /dev/null 2>&1
-    if is_service_enabled cinder || is_service_enabled nova; then
-        local virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
-        sudo virsh secret-undefine ${virsh_uuid} >/dev/null 2>&1
-    fi
-    if is_service_enabled nova; then
-        iniset $NOVA_CONF libvirt rbd_secret_uuid ""
-    fi
+
+    # purge ceph config file and keys
+    sudo rm -rf ${CEPH_CONF_DIR}/*
 }
 
+
 # configure_ceph() - Set config files, create data dirs, etc
 function configure_ceph {
     local count=0
@@ -130,7 +175,7 @@ function configure_ceph {
     sudo mkdir /var/lib/ceph/mon/ceph-$(hostname)
 
     # create a default ceph configuration file
-    sudo tee -a ${CEPH_CONF_FILE} > /dev/null <<EOF
+    sudo tee ${CEPH_CONF_FILE} > /dev/null <<EOF
 [global]
 fsid = ${CEPH_FSID}
 mon_initial_members = $(hostname)
@@ -203,14 +248,17 @@ EOF
     done
 }
 
-# configure_ceph_glance() - Glance config needs to come after Glance is set up
-function configure_ceph_glance {
+function configure_ceph_embedded_glance {
     # configure Glance service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${GLANCE_CEPH_POOL} ${GLANCE_CEPH_POOL_PG} ${GLANCE_CEPH_POOL_PGP}
     sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${GLANCE_CEPH_POOL} size ${CEPH_REPLICAS}
     if [[ $CEPH_REPLICAS -ne 1 ]]; then
         sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${GLANCE_CEPH_POOL} crush_ruleset ${RULE_ID}
     fi
+}
+
+# configure_ceph_glance() - Glance config needs to come after Glance is set up
+function configure_ceph_glance {
+    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${GLANCE_CEPH_POOL} ${GLANCE_CEPH_POOL_PG} ${GLANCE_CEPH_POOL_PGP}
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
 
@@ -225,14 +273,17 @@ function configure_ceph_glance {
     iniset $GLANCE_API_CONF glance_store rbd_store_pool $GLANCE_CEPH_POOL
 }
 
-# configure_ceph_nova() - Nova config needs to come after Nova is set up
-function configure_ceph_nova {
+function configure_ceph_embedded_nova {
     # configure Nova service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${NOVA_CEPH_POOL} ${NOVA_CEPH_POOL_PG} ${NOVA_CEPH_POOL_PGP}
     sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} size ${CEPH_REPLICAS}
     if [[ $CEPH_REPLICAS -ne 1 ]]; then
         sudo -c ${CEPH_CONF_FILE} ceph osd pool set ${NOVA_CEPH_POOL} crush_ruleset ${RULE_ID}
     fi
+}
+
+# configure_ceph_nova() - Nova config needs to come after Nova is set up
+function configure_ceph_nova {
+    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${NOVA_CEPH_POOL} ${NOVA_CEPH_POOL_PG} ${NOVA_CEPH_POOL_PGP}
     iniset $NOVA_CONF libvirt rbd_user ${CINDER_CEPH_USER}
     iniset $NOVA_CONF libvirt rbd_secret_uuid ${CINDER_CEPH_UUID}
     iniset $NOVA_CONF libvirt inject_key false
@@ -248,15 +299,17 @@ function configure_ceph_nova {
     fi
 }
 
-# configure_ceph_cinder() - Cinder config needs to come after Cinder is set up
-function configure_ceph_cinder {
+function configure_ceph_embedded_cinder {
     # Configure Cinder service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_CEPH_POOL} ${CINDER_CEPH_POOL_PG} ${CINDER_CEPH_POOL_PGP}
     sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_CEPH_POOL} size ${CEPH_REPLICAS}
     if [[ $CEPH_REPLICAS -ne 1 ]]; then
         sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_CEPH_POOL} crush_ruleset ${RULE_ID}
-
     fi
+}
+
+# configure_ceph_cinder() - Cinder config needs to come after Cinder is set up
+function configure_ceph_cinder {
+    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_CEPH_POOL} ${CINDER_CEPH_POOL_PG} ${CINDER_CEPH_POOL_PGP}
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
 }
@@ -270,15 +323,12 @@ function init_ceph {
 }
 
 # install_ceph() - Collect source and prepare
+function install_ceph_remote {
+    install_package ceph-common
+}
+
 function install_ceph {
-    # NOTE(dtroyer): At some point it'll be easier to test for unsupported distros,
-    #                leveraging the list in stack.sh
-    if [[ ${os_CODENAME} =~ trusty ]] || [[ ${os_CODENAME} =~ Schrödinger’sCat ]] || [[ ${os_CODENAME} =~ Heisenbug ]]; then
-        NO_UPDATE_REPOS=False
-        install_package ceph
-    else
-        exit_distro_not_supported "Ceph since your distro doesn't provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 19/20"
-    fi
+    install_package ceph
 }
 
 # start_ceph() - Start running processes, including screen
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index e9d2a02ad3..9003afd9cb 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -52,11 +52,13 @@ function configure_cinder_backend_ceph {
     iniset $CINDER_CONF DEFAULT glance_api_version 2
 
     if is_service_enabled c-bak; then
-        # Configure Cinder backup service options, ceph pool, ceph user and ceph key
         sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
-        if [[ $CEPH_REPLICAS -ne 1 ]]; then
-            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+        if [ "$REMOTE_CEPH" = "False" ]; then
+            # Configure Cinder backup service options, ceph pool, ceph user and ceph key
+            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
+            if [[ $CEPH_REPLICAS -ne 1 ]]; then
+                sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+            fi
         fi
         sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring

From 057d6ae2255f8895baada8d00767ffa71c8615ac Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 13 Jan 2015 14:01:26 +0100
Subject: [PATCH 0238/3333] wget less verbose

wget is too verbose in devstack logs [1] on image download.

Changing the progress bar style to giga, in order
to be less verbose.

http://logs.openstack.org/73/146573/2/check/
check-tempest-dsvm-full-juno/41ba988/logs/devstacklog.txt.gz#_2015-01-13_11_34_15_330

Change-Id: Ic5304893f4c97c50e7a2f29ad5cd77dba3d5a9dd
---
 functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index c7a3b9db1d..12be160e7d 100644
--- a/functions
+++ b/functions
@@ -42,7 +42,7 @@ function upload_image {
     if [[ $image_url != file* ]]; then
         # Downloads the image (uec ami+akistyle), then extracts it.
         if [[ ! -f $FILES/$image_fname || "$(stat -c "%s" $FILES/$image_fname)" = "0" ]]; then
-            wget -c $image_url -O $FILES/$image_fname
+            wget --progress=dot:giga -c $image_url -O $FILES/$image_fname
             if [[ $? -ne 0 ]]; then
                 echo "Not found: $image_url"
                 return
@@ -116,7 +116,7 @@ function upload_image {
             if [[ $flat_url != file* ]]; then
                 if [[ ! -f $FILES/$flat_fname || \
                 "$(stat -c "%s" $FILES/$flat_fname)" = "0" ]]; then
-                    wget -c $flat_url -O $FILES/$flat_fname
+                    wget --progress=dot:giga -c $flat_url -O $FILES/$flat_fname
                 fi
                 image="$FILES/${flat_fname}"
             else

From d97d2cb01767d670969449d7f11f8438c014933e Mon Sep 17 00:00:00 2001
From: Moshe Levi <moshele@mellanox.com>
Date: Mon, 12 Jan 2015 22:47:29 +0200
Subject: [PATCH 0239/3333] fix mysql clean on ubuntu

Closes-Bug: 1409902
Change-Id: I72900eb2c7f3c6f66d829b10e9bb73b6d186da98
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 0e423de675..62c3d4c90e 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -23,7 +23,7 @@ function cleanup_database_mysql {
     if is_ubuntu; then
         # Get ruthless with mysql
         stop_service $MYSQL
-        uninstall_package mysql-server mariadb-server
+        uninstall_package mysql-common mariadb-common
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return

From a134f652e51d9d7922ef37feb535d583619f4055 Mon Sep 17 00:00:00 2001
From: Ethan Lynn <xjunlin@cn.ibm.com>
Date: Mon, 12 Jan 2015 12:59:30 +0800
Subject: [PATCH 0240/3333] Configure region name in neutron & ceilometer
 config files

Because of lacking some options in multi-region env, neutron and
ceilometer can not work after setup a multi-region env using
devstack.
This patch adds related options for multi-region env.

Change-Id: I4de890b233366f9526fa283aa9078a4d6ed0ca23
Closes-Bug: #1409589
---
 lib/ceilometer | 2 ++
 lib/neutron    | 1 +
 2 files changed, 3 insertions(+)

diff --git a/lib/ceilometer b/lib/ceilometer
index f6280d9d3b..d9064e2747 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -200,6 +200,8 @@ function configure_ceilometer {
     iniset $CEILOMETER_CONF service_credentials os_username ceilometer
     iniset $CEILOMETER_CONF service_credentials os_password $SERVICE_PASSWORD
     iniset $CEILOMETER_CONF service_credentials os_tenant_name $SERVICE_TENANT_NAME
+    iniset $CEILOMETER_CONF service_credentials os_region_name $REGION_NAME
+    iniset $CEILOMETER_CONF service_credentials os_auth_url $KEYSTONE_SERVICE_URI/v2.0
 
     configure_auth_token_middleware $CEILOMETER_CONF ceilometer $CEILOMETER_AUTH_CACHE_DIR
 
diff --git a/lib/neutron b/lib/neutron
index 5678769255..8a8fe3cabf 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -1011,6 +1011,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
     iniset $NEUTRON_CONF DEFAULT nova_url "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2"
+    iniset $NEUTRON_CONF DEFAULT nova_region_name $REGION_NAME
     iniset $NEUTRON_CONF DEFAULT nova_admin_username nova
     iniset $NEUTRON_CONF DEFAULT nova_admin_password $SERVICE_PASSWORD
     ADMIN_TENANT_ID=$(openstack project list | awk "/ service / { print \$2 }")

From 56b7efbf93d8afbdd093934f183a7096ce798552 Mon Sep 17 00:00:00 2001
From: Zhongyue Luo <zhongyue.nah@intel.com>
Date: Tue, 16 Dec 2014 11:36:49 +0800
Subject: [PATCH 0241/3333] Gracefully add provider network port

Patch 5ec6f8f1 introduced the provider network support in DevStack. However, this patch
does not include a port clean up routine during ./unstack that openvswitch complains
that the PUBLIC_INTERFACE already exists and exits when you run DevStack multiple times.
Adding --may-exist to ovs add-port command solves this problem.

Change-Id: I89dc560ffb35fccf6ceed2557047adca37054ce7
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index b4d0b8cad4..90991d15e0 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -699,7 +699,7 @@ function start_neutron_agents {
     run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
     if is_provider_network; then
-        sudo ovs-vsctl add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
+        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
         sudo ip link set $OVS_PHYSICAL_BRIDGE up
         sudo ip link set br-int up
         sudo ip link set $PUBLIC_INTERFACE up

From 8f90f765faf269c3b1f9c04d80a1369223bc982c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 14 Jan 2015 10:36:48 -0500
Subject: [PATCH 0242/3333] clean mysql better

The purge that was previously removed was actually kind of important
to burning mysql back down to a stateless zero point. Bring this back
with the addition of doing it for mariadb as well.

Change-Id: If608db8731d9ddfb2440a37387409798619b163c
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 62c3d4c90e..1c74c03735 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -23,7 +23,7 @@ function cleanup_database_mysql {
     if is_ubuntu; then
         # Get ruthless with mysql
         stop_service $MYSQL
-        uninstall_package mysql-common mariadb-common
+        apt_get purge -y mysql* mariadb*
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return

From b74e01c34de76cb451f80d2f1ac1c4ccac1bb7e4 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Thu, 18 Dec 2014 01:35:35 -0500
Subject: [PATCH 0243/3333] Add a group create function, and a sample group

Slowly trying to introduce more v3 concepts into a generic
devstack installation.

Work with description of none and description with spaces

Change-Id: I7d2fde58363698ff020f92f129f1ff7378f945a8
---
 functions-common | 23 ++++++++++++++++++++---
 lib/heat         | 10 ++++------
 lib/keystone     |  7 +++++++
 lib/tempest      |  2 +-
 4 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index 3b4309a15d..c3c8486f13 100644
--- a/functions-common
+++ b/functions-common
@@ -815,7 +815,7 @@ function policy_add {
 # Gets or creates a domain
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
-    local os_url="$KEYSTONE_SERVICE_URI/v3"
+    local os_url="$KEYSTONE_SERVICE_URI_V3"
     # Gets domain id
     local domain_id=$(
         # Gets domain id
@@ -831,6 +831,23 @@ function get_or_create_domain {
     echo $domain_id
 }
 
+# Gets or creates group
+# Usage: get_or_create_group <groupname> [<domain> <description>]
+function get_or_create_group {
+    local domain=${2:+--domain ${2}}
+    local desc="${3:-}"
+    local os_url="$KEYSTONE_SERVICE_URI_V3"
+    # Gets group id
+    local group_id=$(
+        # Creates new group with --or-show
+        openstack --os-token=$OS_TOKEN --os-url=$os_url \
+            --os-identity-api-version=3 group create $1 \
+            $domain --description "$desc" --or-show \
+            -f value -c id
+    )
+    echo $group_id
+}
+
 # Gets or creates user
 # Usage: get_or_create_user <username> <password> <project> [<email> [<domain>]]
 function get_or_create_user {
@@ -843,7 +860,7 @@ function get_or_create_user {
     local domain=""
     if [[ ! -z "$5" ]]; then
         domain="--domain=$5"
-        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI/v3 --os-identity-api-version=3"
+        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI_V3 --os-identity-api-version=3"
     fi
     # Gets user id
     local user_id=$(
@@ -868,7 +885,7 @@ function get_or_create_project {
     local domain=""
     if [[ ! -z "$2" ]]; then
         domain="--domain=$2"
-        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI/v3 --os-identity-api-version=3"
+        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI_V3 --os-identity-api-version=3"
     fi
     local project_id=$(
         # Creates new project with --or-show
diff --git a/lib/heat b/lib/heat
index 544ec451f7..d98b0960ae 100644
--- a/lib/heat
+++ b/lib/heat
@@ -265,23 +265,21 @@ function create_heat_accounts {
     if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
         # Note we have to pass token/endpoint here because the current endpoint and
         # version negotiation in OSC means just --os-identity-api-version=3 won't work
-        local ks_endpoint_v3="$KEYSTONE_SERVICE_URI/v3"
-
-        D_ID=$(openstack --os-token $OS_TOKEN --os-url=$ks_endpoint_v3 \
+        D_ID=$(openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3 domain list | grep ' heat ' | get_field 1)
 
         if [[ -z "$D_ID" ]]; then
-            D_ID=$(openstack --os-token $OS_TOKEN --os-url=$ks_endpoint_v3 \
+            D_ID=$(openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
                 --os-identity-api-version=3 domain create heat \
                 --description "Owns users and projects created by heat" \
                 | grep ' id ' | get_field 2)
             iniset $HEAT_CONF DEFAULT stack_user_domain_id ${D_ID}
 
-            openstack --os-token $OS_TOKEN --os-url=$ks_endpoint_v3 \
+            openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
                 --os-identity-api-version=3 user create --password $SERVICE_PASSWORD \
                 --domain $D_ID heat_domain_admin \
                 --description "Manages users and projects created by heat"
-            openstack --os-token $OS_TOKEN --os-url=$ks_endpoint_v3 \
+            openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
                 --os-identity-api-version=3 role add \
                 --user heat_domain_admin --domain ${D_ID} admin
             iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
diff --git a/lib/keystone b/lib/keystone
index 1599fa5738..219034b1d4 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -106,6 +106,10 @@ fi
 KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
 
+# V3 URIs
+KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
+KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
+
 # Functions
 # ---------
 # cleanup_keystone() - Remove residual data files, anything left over from previous
@@ -394,6 +398,9 @@ function create_keystone_accounts {
     get_or_add_user_role $another_role $demo_user $demo_tenant
     get_or_add_user_role $member_role $demo_user $invis_tenant
 
+    get_or_create_group "developers" "default" "openstack developers"
+    get_or_create_group "testers" "default"
+
     # Keystone
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/tempest b/lib/tempest
index d31119bdf6..aea913d143 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -278,7 +278,7 @@ function configure_tempest {
 
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
-    iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v3/"
+    iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     iniset $TEMPEST_CONFIG identity username $TEMPEST_USERNAME
     iniset $TEMPEST_CONFIG identity password "$password"
     iniset $TEMPEST_CONFIG identity tenant_name $TEMPEST_TENANT_NAME

From 537532931da4103e1a873684476dac6d7fe56489 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 Dec 2014 19:38:15 -0500
Subject: [PATCH 0244/3333] Make changes such that -o nounset runs

This makes a bunch of variable cleanups that will let -o nounset
function, for the time being we hide nounset behind another setting
variable so that it's not on by default.

Because this is bash, and things are only executed on demand, this
probably only works in the config it was run in. Expect cleaning up
all the paths to be something that takes quite a while.

This also includes a new set of unit tests around the trueorfalse
function, because my change in how it worked, didn't. Tests are good
m'kay.

Change-Id: I71a896623ea9e1f042a73dc0678ce85acf0dc87d
---
 clean.sh                            |  2 +-
 extras.d/70-tuskar.sh               |  2 +-
 functions                           |  2 +-
 functions-common                    | 72 ++++++++++++++++++-----------
 lib/ceilometer                      |  5 +-
 lib/cinder                          |  4 +-
 lib/cinder_backends/lvm             |  1 +
 lib/database                        |  3 +-
 lib/databases/mysql                 | 10 ++++
 lib/dib                             |  2 +-
 lib/heat                            |  6 +--
 lib/horizon                         |  2 +-
 lib/ironic                          |  6 +--
 lib/keystone                        |  1 +
 lib/nova                            | 10 ++--
 lib/nova_plugins/functions-libvirt  |  2 +-
 lib/nova_plugins/hypervisor-libvirt |  2 +-
 lib/rpc_backend                     |  8 ++--
 lib/swift                           |  4 +-
 lib/tempest                         |  4 +-
 stack.sh                            | 72 ++++++++---------------------
 stackrc                             | 62 +++++++++++++++++++++++--
 tests/test_functions.sh             | 34 ++++++++++++++
 tests/unittest.sh                   | 39 ++++++++++++++++
 tools/install_prereqs.sh            | 12 +++--
 unstack.sh                          | 19 +++++---
 26 files changed, 265 insertions(+), 121 deletions(-)
 create mode 100755 tests/test_functions.sh
 create mode 100644 tests/unittest.sh

diff --git a/clean.sh b/clean.sh
index f2f13389c8..edbd04a2d9 100755
--- a/clean.sh
+++ b/clean.sh
@@ -18,7 +18,7 @@ source $TOP_DIR/functions
 FILES=$TOP_DIR/files
 
 # Load local configuration
-source $TOP_DIR/stackrc
+source $TOP_DIR/openrc
 
 # Get the variables that are set in stack.sh
 if [[ -r $TOP_DIR/.stackenv ]]; then
diff --git a/extras.d/70-tuskar.sh b/extras.d/70-tuskar.sh
index e77c504db0..38aba34518 100644
--- a/extras.d/70-tuskar.sh
+++ b/extras.d/70-tuskar.sh
@@ -65,7 +65,7 @@ TUSKARCLIENT_BRANCH=${TUSKARCLIENT_BRANCH:-master}
 TUSKAR_DIR=$DEST/tuskar
 TUSKARCLIENT_DIR=$DEST/python-tuskarclient
 TUSKAR_AUTH_CACHE_DIR=${TUSKAR_AUTH_CACHE_DIR:-/var/cache/tuskar}
-TUSKAR_STANDALONE=`trueorfalse False $TUSKAR_STANDALONE`
+TUSKAR_STANDALONE=$(trueorfalse False TUSKAR_STANDALONE)
 TUSKAR_CONF_DIR=/etc/tuskar
 TUSKAR_CONF=$TUSKAR_CONF_DIR/tuskar.conf
 TUSKAR_API_HOST=${TUSKAR_API_HOST:-$HOST_IP}
diff --git a/functions b/functions
index 12be160e7d..5b3a8ea192 100644
--- a/functions
+++ b/functions
@@ -353,7 +353,7 @@ function _ping_check_novanet {
     local boot_timeout=$3
     local expected=${4:-"True"}
     local check_command=""
-    MULTI_HOST=`trueorfalse False $MULTI_HOST`
+    MULTI_HOST=$(trueorfalse False MULTI_HOST)
     if [[ "$MULTI_HOST" = "True" && "$from_net" = "$PRIVATE_NETWORK_NAME" ]]; then
         return
     fi
diff --git a/functions-common b/functions-common
index b0b262236d..1f76458db0 100644
--- a/functions-common
+++ b/functions-common
@@ -21,7 +21,6 @@
 #
 # The following variables are assumed to be defined by certain functions:
 #
-# - ``GIT_DEPTH``
 # - ``ENABLED_SERVICES``
 # - ``ERROR_ON_CLONE``
 # - ``FILES``
@@ -43,6 +42,8 @@ declare -A GITREPO
 declare -A GITBRANCH
 declare -A GITDIR
 
+TRACK_DEPENDS=${TRACK_DEPENDS:-False}
+
 # Config Functions
 # ================
 
@@ -243,7 +244,8 @@ function trueorfalse {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local default=$1
-    local testval=$2
+    local literal=$2
+    local testval=${!literal}
 
     [[ -z "$testval" ]] && { echo "$default"; return; }
     [[ "0 no No NO false False FALSE" =~ "$testval" ]] && { echo "False"; return; }
@@ -252,6 +254,14 @@ function trueorfalse {
     $xtrace
 }
 
+function isset {
+    nounset=$(set +o | grep nounset)
+    set +o nounset
+    [[ -n "${!1+x}" ]]
+    result=$?
+    $nounset
+    return $result
+}
 
 # Control Functions
 # =================
@@ -381,7 +391,11 @@ function warn {
 # ``os_UPDATE`` - update: ex. the ``5`` in ``RHEL6.5``
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
 # ``os_CODENAME`` - vendor's codename for release: ``snow leopard``, ``trusty``
-declare os_VENDOR os_RELEASE os_UPDATE os_PACKAGE os_CODENAME
+os_VENDOR=""
+os_RELEASE=""
+os_UPDATE=""
+os_PACKAGE=""
+os_CODENAME=""
 
 # GetOSVersion
 function GetOSVersion {
@@ -577,8 +591,7 @@ function get_release_name_from_branch {
 # Set global ``RECLONE=yes`` to simulate a clone when dest-dir exists
 # Set global ``ERROR_ON_CLONE=True`` to abort execution with an error if the git repo
 # does not exist (default is False, meaning the repo will be cloned).
-# Set global ``GIT_DEPTH=<number>`` to limit the history depth of the git clone
-# Uses globals ``ERROR_ON_CLONE``, ``OFFLINE``, ``RECLONE``, ``GIT_DEPTH``
+# Uses globals ``ERROR_ON_CLONE``, ``OFFLINE``, ``RECLONE``
 # git_clone remote dest-dir branch
 function git_clone {
     local git_remote=$1
@@ -587,8 +600,7 @@ function git_clone {
     local orig_dir=$(pwd)
     local git_clone_flags=""
 
-    RECLONE=$(trueorfalse False $RECLONE)
-
+    RECLONE=$(trueorfalse False RECLONE)
     if [[ -n "${GIT_DEPTH}" ]]; then
         git_clone_flags="$git_clone_flags --depth $GIT_DEPTH"
     fi
@@ -978,9 +990,10 @@ function apt_get {
     [[ "$(id -u)" = "0" ]] && sudo="env"
 
     $xtrace
+
     $sudo DEBIAN_FRONTEND=noninteractive \
-        http_proxy=$http_proxy https_proxy=$https_proxy \
-        no_proxy=$no_proxy \
+        http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
+        no_proxy=${no_proxy:-} \
         apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
 }
 
@@ -999,10 +1012,10 @@ function get_packages {
     set +o xtrace
     local services=$@
     local package_dir=$(_get_package_dir)
-    local file_to_parse
-    local service
+    local file_to_parse=""
+    local service=""
 
-    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False $INSTALL_TESTONLY_PACKAGES)
+    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False INSTALL_TESTONLY_PACKAGES)
 
     if [[ -z "$package_dir" ]]; then
         echo "No package directory supplied"
@@ -1112,6 +1125,10 @@ function get_packages {
 # Uses globals ``NO_UPDATE_REPOS``, ``REPOS_UPDATED``, ``RETRY_UPDATE``
 # install_package package [package ...]
 function update_package_repo {
+    NO_UPDATE_REPOS=${NO_UPDATE_REPOS:-False}
+    REPOS_UPDATED=${REPOS_UPDATED:-False}
+    RETRY_UPDATE=${RETRY_UPDATE:-False}
+
     if [[ "$NO_UPDATE_REPOS" = "True" ]]; then
         return 0
     fi
@@ -1321,7 +1338,7 @@ function screen_process {
 
     SCREEN_NAME=${SCREEN_NAME:-stack}
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True $USE_SCREEN)
+    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     # Append the process to the screen rc file
     screen_rc "$name" "$command"
@@ -1394,7 +1411,7 @@ function screen_stop_service {
 
     SCREEN_NAME=${SCREEN_NAME:-stack}
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True $USE_SCREEN)
+    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     if is_service_enabled $service; then
         # Clean up the screen window
@@ -1412,7 +1429,7 @@ function stop_process {
     local service=$1
 
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True $USE_SCREEN)
+    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     if is_service_enabled $service; then
         # Kill via pid if we have one available
@@ -1462,7 +1479,7 @@ function tail_log {
     local name=$1
     local logfile=$2
 
-    USE_SCREEN=$(trueorfalse True $USE_SCREEN)
+    USE_SCREEN=$(trueorfalse True USE_SCREEN)
     if [[ "$USE_SCREEN" = "True" ]]; then
         screen_process "$name" "sudo tail -f $logfile"
     fi
@@ -1572,7 +1589,8 @@ function get_python_exec_prefix {
 function pip_install {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
-    if [[ "$OFFLINE" = "True" || -z "$@" ]]; then
+    local offline=${OFFLINE:-False}
+    if [[ "$offline" == "True" || -z "$@" ]]; then
         $xtrace
         return
     fi
@@ -1601,20 +1619,20 @@ function pip_install {
 
     $xtrace
     $sudo_pip \
-        http_proxy=$http_proxy \
-        https_proxy=$https_proxy \
-        no_proxy=$no_proxy \
+        http_proxy=${http_proxy:-} \
+        https_proxy=${https_proxy:-} \
+        no_proxy=${no_proxy:-} \
         $cmd_pip install \
         $@
 
-    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False $INSTALL_TESTONLY_PACKAGES)
+    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False INSTALL_TESTONLY_PACKAGES)
     if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
         local test_req="$@/test-requirements.txt"
         if [[ -e "$test_req" ]]; then
             $sudo_pip \
-                http_proxy=$http_proxy \
-                https_proxy=$https_proxy \
-                no_proxy=$no_proxy \
+                http_proxy=${http_proxy:-} \
+                https_proxy=${https_proxy:-} \
+                no_proxy=${no_proxy:-} \
                 $cmd_pip install \
                 -r $test_req
         fi
@@ -2084,13 +2102,13 @@ function cp_it {
 #     http_proxy=http://proxy.example.com:3128/ no_proxy=repo.example.net ./stack.sh
 
 function export_proxy_variables {
-    if [[ -n "$http_proxy" ]]; then
+    if isset http_proxy ; then
         export http_proxy=$http_proxy
     fi
-    if [[ -n "$https_proxy" ]]; then
+    if isset https_proxy ; then
         export https_proxy=$https_proxy
     fi
-    if [[ -n "$no_proxy" ]]; then
+    if isset no_proxy ; then
         export no_proxy=$no_proxy
     fi
 }
diff --git a/lib/ceilometer b/lib/ceilometer
index f6280d9d3b..98a7e8f0e0 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -75,11 +75,14 @@ CEILOMETER_BACKEND=${CEILOMETER_BACKEND:-mysql}
 CEILOMETER_SERVICE_PROTOCOL=http
 CEILOMETER_SERVICE_HOST=$SERVICE_HOST
 CEILOMETER_SERVICE_PORT=${CEILOMETER_SERVICE_PORT:-8777}
-CEILOMETER_USE_MOD_WSGI=$(trueorfalse False $CEILOMETER_USE_MOD_WSGI)
+CEILOMETER_USE_MOD_WSGI=$(trueorfalse False CEILOMETER_USE_MOD_WSGI)
 
 # To enable OSprofiler change value of this variable to "notifications,profiler"
 CEILOMETER_NOTIFICATION_TOPICS=${CEILOMETER_NOTIFICATION_TOPICS:-notifications}
 
+CEILOMETER_COORDINATION_URL=${CEILOMETER_COORDINATION_URL:-}
+CEILOMETER_PIPELINE_INTERVAL=${CEILOMETER_PIPELINE_INTERVAL:-}
+
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,ceilometer
 
diff --git a/lib/cinder b/lib/cinder
index 177ddf0bf2..7fc694957b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -68,7 +68,7 @@ fi
 # Maintain this here for backward-compatibility with the old configuration
 # DEPRECATED: Use CINDER_ENABLED_BACKENDS instead
 # Support for multi lvm backend configuration (default is no support)
-CINDER_MULTI_LVM_BACKEND=$(trueorfalse False $CINDER_MULTI_LVM_BACKEND)
+CINDER_MULTI_LVM_BACKEND=$(trueorfalse False CINDER_MULTI_LVM_BACKEND)
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend
@@ -85,7 +85,7 @@ fi
 # Should cinder perform secure deletion of volumes?
 # Defaults to true, can be set to False to avoid this bug when testing:
 # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1023755
-CINDER_SECURE_DELETE=`trueorfalse True $CINDER_SECURE_DELETE`
+CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
 
 # Cinder reports allocations back to the scheduler on periodic intervals
 # it turns out we can get an "out of space" issue when we run tests too
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index a3ab5bf3f9..280baf7b3e 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -33,6 +33,7 @@ set +o xtrace
 # If ``VOLUME_GROUP`` is set, use it, otherwise we'll build a VG name based
 # on ``VOLUME_GROUP_NAME`` that includes the backend name
 # Grenade doesn't use ``VOLUME_GROUP2`` so it is left out
+VOLUME_GROUP=${VOLUME_GROUP:-}
 VOLUME_GROUP_NAME=${VOLUME_GROUP:-${VOLUME_GROUP_NAME:-stack-volumes}}
 
 # TODO: resurrect backing device...need to know how to set values
diff --git a/lib/database b/lib/database
index 366d2b3d2c..896b8e1430 100644
--- a/lib/database
+++ b/lib/database
@@ -23,6 +23,7 @@
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
+DATABASE_BACKENDS=""
 
 # Register a database backend
 #
@@ -30,7 +31,7 @@ set +o xtrace
 #
 # This is required to be defined before the specific database scripts are sourced
 function register_database {
-    [ -z "$DATABASE_BACKENDS" ] && DATABASE_BACKENDS=$1 || DATABASE_BACKENDS+=" $1"
+    DATABASE_BACKENDS+=" $1"
 }
 
 # Sourcing the database libs sets DATABASE_BACKENDS with the available list
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 62c3d4c90e..42004c5dcd 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -14,12 +14,22 @@ set +o xtrace
 
 register_database mysql
 
+# Linux distros, thank you for being incredibly consistent
+MYSQL=mysql
+if is_fedora; then
+    if [[ $DISTRO =~ (rhel6) ]]; then
+        MYSQL=mysqld
+    else
+        MYSQL=mariadb
+    fi
+fi
 
 # Functions
 # ---------
 
 # Get rid of everything enough to cleanly change database backends
 function cleanup_database_mysql {
+    stop_service $MYSQL
     if is_ubuntu; then
         # Get ruthless with mysql
         stop_service $MYSQL
diff --git a/lib/dib b/lib/dib
index 177f4c1ef0..809217bc93 100644
--- a/lib/dib
+++ b/lib/dib
@@ -26,7 +26,7 @@ TIE_DIR=$DEST/tripleo-image-elements
 # NOTE: Setting DIB_APT_SOURCES assumes you will be building
 # Debian/Ubuntu based images. Leave unset for other flavors.
 DIB_APT_SOURCES=${DIB_APT_SOURCES:-""}
-DIB_BUILD_OFFLINE=$(trueorfalse False $DIB_BUILD_OFFLINE)
+DIB_BUILD_OFFLINE=$(trueorfalse False DIB_BUILD_OFFLINE)
 DIB_IMAGE_CACHE=$DATA_DIR/diskimage-builder/image-create
 DIB_PIP_REPO=$DATA_DIR/diskimage-builder/pip-repo
 DIB_PIP_REPO_PORT=${DIB_PIP_REPO_PORT:-8899}
diff --git a/lib/heat b/lib/heat
index 544ec451f7..b2e5a1272f 100644
--- a/lib/heat
+++ b/lib/heat
@@ -37,13 +37,13 @@ HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
 HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
-HEAT_STANDALONE=`trueorfalse False $HEAT_STANDALONE`
-HEAT_ENABLE_ADOPT_ABANDON=`trueorfalse False $HEAT_ENABLE_ADOPT_ABANDON`
+HEAT_STANDALONE=$(trueorfalse False HEAT_STANDALONE)
+HEAT_ENABLE_ADOPT_ABANDON=$(trueorfalse False HEAT_ENABLE_ADOPT_ABANDON)
 HEAT_CONF_DIR=/etc/heat
 HEAT_CONF=$HEAT_CONF_DIR/heat.conf
 HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
 HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
-HEAT_STACK_DOMAIN=`trueorfalse True $HEAT_STACK_DOMAIN`
+HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
 
diff --git a/lib/horizon b/lib/horizon
index fee2ef0b3a..aa70bd59eb 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -173,7 +173,7 @@ function install_horizon {
     # Apache installation, because we mark it NOPRIME
     install_apache_wsgi
 
-    git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH $HORIZON_TAG
+    git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH
 }
 
 # start_horizon() - Start running processes, including screen
diff --git a/lib/ironic b/lib/ironic
index 55272b9a1d..141b2fda54 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -57,7 +57,7 @@ IRONIC_IPMIINFO_FILE=${IRONIC_IPMIINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
 # Set up defaults for functional / integration testing
 IRONIC_SCRIPTS_DIR=${IRONIC_SCRIPTS_DIR:-$TOP_DIR/tools/ironic/scripts}
 IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$TOP_DIR/tools/ironic/templates}
-IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False $IRONIC_BAREMETAL_BASIC_OPS)
+IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False IRONIC_BAREMETAL_BASIC_OPS)
 IRONIC_ENABLED_DRIVERS=${IRONIC_ENABLED_DRIVERS:-fake,pxe_ssh,pxe_ipmitool}
 IRONIC_SSH_USERNAME=${IRONIC_SSH_USERNAME:-`whoami`}
 IRONIC_SSH_KEY_DIR=${IRONIC_SSH_KEY_DIR:-$IRONIC_DATA_DIR/ssh_keys}
@@ -84,7 +84,7 @@ IRONIC_VM_LOG_CONSOLE=${IRONIC_VM_LOG_CONSOLE:-True}
 IRONIC_VM_LOG_DIR=${IRONIC_VM_LOG_DIR:-$IRONIC_DATA_DIR/logs/}
 
 # Use DIB to create deploy ramdisk and kernel.
-IRONIC_BUILD_DEPLOY_RAMDISK=`trueorfalse True $IRONIC_BUILD_DEPLOY_RAMDISK`
+IRONIC_BUILD_DEPLOY_RAMDISK=$(trueorfalse True IRONIC_BUILD_DEPLOY_RAMDISK)
 # If not use DIB, these files are used as deploy ramdisk/kernel.
 # (The value must be a absolute path)
 IRONIC_DEPLOY_RAMDISK=${IRONIC_DEPLOY_RAMDISK:-}
@@ -113,7 +113,7 @@ IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST:$IRONIC_SERVICE_PORT}
 TEMPEST_SERVICES+=,ironic
 
 # Enable iPXE
-IRONIC_IPXE_ENABLED=$(trueorfalse False $IRONIC_IPXE_ENABLED)
+IRONIC_IPXE_ENABLED=$(trueorfalse False IRONIC_IPXE_ENABLED)
 IRONIC_HTTP_DIR=${IRONIC_HTTP_DIR:-$IRONIC_DATA_DIR/httpboot}
 IRONIC_HTTP_SERVER=${IRONIC_HTTP_SERVER:-$HOST_IP}
 IRONIC_HTTP_PORT=${IRONIC_HTTP_PORT:-8088}
diff --git a/lib/keystone b/lib/keystone
index 1599fa5738..ad77bb39f9 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -71,6 +71,7 @@ KEYSTONE_ASSIGNMENT_BACKEND=${KEYSTONE_ASSIGNMENT_BACKEND:-sql}
 
 # Select Keystone's token format
 # Choose from 'UUID', 'PKI', or 'PKIZ'
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration
diff --git a/lib/nova b/lib/nova
index 5ac9ff1a2b..0e9282bb1b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -106,7 +106,7 @@ GUEST_INTERFACE_DEFAULT=$(ip link \
 
 # $NOVA_VNC_ENABLED can be used to forcibly enable vnc configuration.
 # In multi-node setups allows compute hosts to not run n-novnc.
-NOVA_VNC_ENABLED=$(trueorfalse False $NOVA_VNC_ENABLED)
+NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
 
 # Get hypervisor configuration
 # ----------------------------
@@ -145,11 +145,11 @@ FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 # ``MULTI_HOST`` is a mode where each compute node runs its own network node.  This
 # allows network operations and routing for a VM to occur on the server that is
 # running the VM - removing a SPOF and bandwidth bottleneck.
-MULTI_HOST=`trueorfalse False $MULTI_HOST`
+MULTI_HOST=$(trueorfalse False MULTI_HOST)
 
 # ``NOVA_ALLOW_MOVE_TO_SAME_HOST` can be set to False in multi node devstack,
 # where there are at least two nova-computes.
-NOVA_ALLOW_MOVE_TO_SAME_HOST=`trueorfalse True $NOVA_ALLOW_MOVE_TO_SAME_HOST`
+NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
 
 # Test floating pool and range are used for testing.  They are defined
 # here until the admin APIs can replace nova-manage
@@ -657,7 +657,7 @@ function install_nova {
 
     if is_service_enabled n-novnc; then
         # a websockets/html5 or flash powered VNC console for vm instances
-        NOVNC_FROM_PACKAGE=`trueorfalse False $NOVNC_FROM_PACKAGE`
+        NOVNC_FROM_PACKAGE=$(trueorfalse False NOVNC_FROM_PACKAGE)
         if [ "$NOVNC_FROM_PACKAGE" = "True" ]; then
             NOVNC_WEB_DIR=/usr/share/novnc
             install_package novnc
@@ -669,7 +669,7 @@ function install_nova {
 
     if is_service_enabled n-spice; then
         # a websockets/html5 or flash powered SPICE console for vm instances
-        SPICE_FROM_PACKAGE=`trueorfalse True $SPICE_FROM_PACKAGE`
+        SPICE_FROM_PACKAGE=$(trueorfalse True SPICE_FROM_PACKAGE)
         if [ "$SPICE_FROM_PACKAGE" = "True" ]; then
             SPICE_WEB_DIR=/usr/share/spice-html5
             install_package spice-html5
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4601eea47b..c136e352df 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -15,7 +15,7 @@ set +o xtrace
 # --------
 
 # if we should turn on massive libvirt debugging
-DEBUG_LIBVIRT=$(trueorfalse False $DEBUG_LIBVIRT)
+DEBUG_LIBVIRT=$(trueorfalse False DEBUG_LIBVIRT)
 
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b1b440073f..4d1eb6cdcb 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -54,7 +54,7 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF DEFAULT vnc_enabled "false"
     fi
 
-    ENABLE_FILE_INJECTION=$(trueorfalse False $ENABLE_FILE_INJECTION)
+    ENABLE_FILE_INJECTION=$(trueorfalse False ENABLE_FILE_INJECTION)
     if [[ "$ENABLE_FILE_INJECTION" = "True" ]] ; then
         # When libguestfs is available for file injection, enable using
         # libguestfs to inspect the image and figure out the proper
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 778d466963..d87d6207b1 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -21,6 +21,11 @@
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
+RPC_MESSAGING_PROTOCOL=${RPC_MESSAGING_PROTOCOL:-0.9}
+
+# TODO(sdague): RPC backend selection is super wonky because we treat
+# messaging server as a service, which it really isn't for multi host
+QPID_HOST=${QPID_HOST:-}
 
 # Functions
 # ---------
@@ -68,9 +73,6 @@ function check_rpc_backend {
 function cleanup_rpc_backend {
     if is_service_enabled rabbit; then
         # Obliterate rabbitmq-server
-        if [ -n "$RABBIT_USERID" ]; then
-            sudo rabbitmqctl delete_user "$RABBIT_USERID"
-        fi
         uninstall_package rabbitmq-server
         sudo killall epmd || sudo killall -9 epmd
         if is_ubuntu; then
diff --git a/lib/swift b/lib/swift
index e9043b32a1..b5577d86b8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -82,7 +82,7 @@ SWIFT_EXTRAS_MIDDLEWARE=${SWIFT_EXTRAS_MIDDLEWARE:-formpost staticweb}
 
 # Set ``SWIFT_EXTRAS_MIDDLEWARE_LAST`` to extras middlewares that need to be at
 # the end of the pipeline.
-SWIFT_EXTRAS_MIDDLEWARE_LAST=${SWIFT_EXTRAS_MIDDLEWARE_LAST}
+SWIFT_EXTRAS_MIDDLEWARE_LAST=${SWIFT_EXTRAS_MIDDLEWARE_LAST:-}
 
 # Set ``SWIFT_EXTRAS_MIDDLEWARE_NO_AUTH`` to extras middlewares that need to be at
 # the beginning of the pipeline, before authentication middlewares.
@@ -127,7 +127,7 @@ ACCOUNT_PORT_BASE=${ACCOUNT_PORT_BASE:-6012}
 
 # Enable tempurl feature
 SWIFT_ENABLE_TEMPURLS=${SWIFT_ENABLE_TEMPURLS:-False}
-SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY}
+SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY:-}
 
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,swift
diff --git a/lib/tempest b/lib/tempest
index d31119bdf6..a525b85b1e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -75,8 +75,8 @@ TEMPEST_DEFAULT_STORAGE_PROTOCOL="iSCSI"
 TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-$TEMPEST_DEFAULT_STORAGE_PROTOCOL}
 
 # Neutron/Network variables
-IPV6_ENABLED=$(trueorfalse True $IPV6_ENABLED)
-IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True $IPV6_SUBNET_ATTRIBUTES_ENABLED)
+IPV6_ENABLED=$(trueorfalse True IPV6_ENABLED)
+IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True IPV6_SUBNET_ATTRIBUTES_ENABLED)
 
 # Functions
 # ---------
diff --git a/stack.sh b/stack.sh
index 696dc2473b..dedc500763 100755
--- a/stack.sh
+++ b/stack.sh
@@ -40,6 +40,12 @@ PATH=$PATH:/usr/local/sbin:/usr/sbin:/sbin
 # Keep track of the devstack directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 
+# Check for uninitialized variables, a big cause of bugs
+NOUNSET=${NOUNSET:-}
+if [[ -n "$NOUNSET" ]]; then
+    set -o nounset
+fi
+
 # Sanity Checks
 # -------------
 
@@ -79,6 +85,9 @@ fi
 # Prepare the environment
 # -----------------------
 
+# Initialize variables:
+LAST_SPINNER_PID=""
+
 # Import common functions
 source $TOP_DIR/functions
 
@@ -172,12 +181,12 @@ export_proxy_variables
 disable_negated_services
 
 # Look for obsolete stuff
-if [[ ,${ENABLED_SERVICES}, =~ ,"swift", ]]; then
-    echo "FATAL: 'swift' is not supported as a service name"
-    echo "FATAL: Use the actual swift service names to enable them as required:"
-    echo "FATAL: s-proxy s-object s-container s-account"
-    exit 1
-fi
+# if [[ ,${ENABLED_SERVICES}, =~ ,"swift", ]]; then
+#     echo "FATAL: 'swift' is not supported as a service name"
+#     echo "FATAL: Use the actual swift service names to enable them as required:"
+#     echo "FATAL: s-proxy s-object s-container s-account"
+#     exit 1
+# fi
 
 # Configure sudo
 # --------------
@@ -311,7 +320,7 @@ fi
 # -----------------
 
 # Set up logging level
-VERBOSE=$(trueorfalse True $VERBOSE)
+VERBOSE=$(trueorfalse True VERBOSE)
 
 # Draw a spinner so the user knows something is happening
 function spinner {
@@ -482,47 +491,6 @@ set -o errexit
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
 
-
-# Common Configuration
-# --------------------
-
-# Set ``OFFLINE`` to ``True`` to configure ``stack.sh`` to run cleanly without
-# Internet access. ``stack.sh`` must have been previously run with Internet
-# access to install prerequisites and fetch repositories.
-OFFLINE=`trueorfalse False $OFFLINE`
-
-# Set ``ERROR_ON_CLONE`` to ``True`` to configure ``stack.sh`` to exit if
-# the destination git repository does not exist during the ``git_clone``
-# operation.
-ERROR_ON_CLONE=`trueorfalse False $ERROR_ON_CLONE`
-
-# Whether to enable the debug log level in OpenStack services
-ENABLE_DEBUG_LOG_LEVEL=`trueorfalse True $ENABLE_DEBUG_LOG_LEVEL`
-
-# Set fixed and floating range here so we can make sure not to use addresses
-# from either range when attempting to guess the IP to use for the host.
-# Note that setting FIXED_RANGE may be necessary when running DevStack
-# in an OpenStack cloud that uses either of these address ranges internally.
-FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
-FIXED_RANGE=${FIXED_RANGE:-10.0.0.0/24}
-FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
-
-HOST_IP=$(get_default_host_ip $FIXED_RANGE $FLOATING_RANGE "$HOST_IP_IFACE" "$HOST_IP")
-if [ "$HOST_IP" == "" ]; then
-    die $LINENO "Could not determine host ip address.  See local.conf for suggestions on setting HOST_IP."
-fi
-
-# Allow the use of an alternate hostname (such as localhost/127.0.0.1) for service endpoints.
-SERVICE_HOST=${SERVICE_HOST:-$HOST_IP}
-
-# Configure services to use syslog instead of writing to individual log files
-SYSLOG=`trueorfalse False $SYSLOG`
-SYSLOG_HOST=${SYSLOG_HOST:-$HOST_IP}
-SYSLOG_PORT=${SYSLOG_PORT:-516}
-
-# Use color for logging output (only available if syslog is not used)
-LOG_COLOR=`trueorfalse True $LOG_COLOR`
-
 # Reset the bundle of CA certificates
 SSL_BUNDLE_FILE="$DATA_DIR/ca-bundle.pem"
 rm -f $SSL_BUNDLE_FILE
@@ -535,9 +503,6 @@ source $TOP_DIR/lib/rpc_backend
 # and the specified rpc backend is available on your platform.
 check_rpc_backend
 
-# Use native SSL for servers in SSL_ENABLED_SERVICES
-USE_SSL=$(trueorfalse False $USE_SSL)
-
 # Service to enable with SSL if USE_SSL is True
 SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron"
 
@@ -708,7 +673,7 @@ source $TOP_DIR/tools/install_prereqs.sh
 
 # Configure an appropriate python environment
 if [[ "$OFFLINE" != "True" ]]; then
-    PYPI_ALTERNATIVE_URL=$PYPI_ALTERNATIVE_URL $TOP_DIR/tools/install_pip.sh
+    PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
 # Do the ugly hacks for broken packages and distros
@@ -944,13 +909,14 @@ fi
 # Configure screen
 # ----------------
 
-USE_SCREEN=$(trueorfalse True $USE_SCREEN)
+USE_SCREEN=$(trueorfalse True USE_SCREEN)
 if [[ "$USE_SCREEN" == "True" ]]; then
     # Create a new named screen to run processes in
     screen -d -m -S $SCREEN_NAME -t shell -s /bin/bash
     sleep 1
 
     # Set a reasonable status bar
+    SCREEN_HARDSTATUS=${SCREEN_HARDSTATUS-:}
     if [ -z "$SCREEN_HARDSTATUS" ]; then
         SCREEN_HARDSTATUS='%{= .} %-Lw%{= .}%> %n%f %t*%{= .}%+Lw%< %-=%{g}(%{d}%H/%l%{g})'
     fi
diff --git a/stackrc b/stackrc
index 355c0dca7c..25682027df 100644
--- a/stackrc
+++ b/stackrc
@@ -43,9 +43,17 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 #  enable_service q-meta
 #  # Optional, to enable tempest configuration as part of devstack
 #  enable_service tempest
+function isset {
+    local nounset=$(set +o | grep nounset)
+    set +o nounset
+    [[ -n "${!1+x}" ]]
+    result=$?
+    $nounset
+    return $result
+}
 
 # this allows us to pass ENABLED_SERVICES
-if [[ -z "$ENABLED_SERVICES" ]]; then
+if ! isset ENABLED_SERVICES ; then
     # core compute (glance / keystone / nova (+ nova-network))
     ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-xvnc,n-cauth
     # cinder
@@ -106,7 +114,7 @@ fi
 
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)
-DATABASE_QUERY_LOGGING=$(trueorfalse True $DATABASE_QUERY_LOGGING)
+DATABASE_QUERY_LOGGING=$(trueorfalse True DATABASE_QUERY_LOGGING)
 
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is
@@ -593,7 +601,7 @@ fi
 
 # Staging Area for New Images, have them here for at least 24hrs for nodepool
 # to cache them otherwise the failure rates in the gate are too high
-PRECACHE_IMAGES=$(trueorfalse False $PRECACHE_IMAGES)
+PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
 if [[ "$PRECACHE_IMAGES" == "True" ]]; then
     # staging in update for nodepool
     IMAGE_URL="https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"
@@ -646,6 +654,54 @@ SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 # till we get to the point we need to handle this automatically
 YUM=${YUM:-yum}
 
+# Common Configuration
+# --------------------
+
+# Set ``OFFLINE`` to ``True`` to configure ``stack.sh`` to run cleanly without
+# Internet access. ``stack.sh`` must have been previously run with Internet
+# access to install prerequisites and fetch repositories.
+OFFLINE=$(trueorfalse False OFFLINE)
+
+# Set ``ERROR_ON_CLONE`` to ``True`` to configure ``stack.sh`` to exit if
+# the destination git repository does not exist during the ``git_clone``
+# operation.
+ERROR_ON_CLONE=$(trueorfalse False ERROR_ON_CLONE)
+
+# Whether to enable the debug log level in OpenStack services
+ENABLE_DEBUG_LOG_LEVEL=$(trueorfalse True ENABLE_DEBUG_LOG_LEVEL)
+
+# Set fixed and floating range here so we can make sure not to use addresses
+# from either range when attempting to guess the IP to use for the host.
+# Note that setting FIXED_RANGE may be necessary when running DevStack
+# in an OpenStack cloud that uses either of these address ranges internally.
+FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
+FIXED_RANGE=${FIXED_RANGE:-10.0.0.0/24}
+FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
+HOST_IP_IFACE=${HOST_IP_IFACE:-}
+HOST_IP=${HOST_IP:-}
+
+HOST_IP=$(get_default_host_ip $FIXED_RANGE $FLOATING_RANGE "$HOST_IP_IFACE" "$HOST_IP")
+if [ "$HOST_IP" == "" ]; then
+    die $LINENO "Could not determine host ip address.  See local.conf for suggestions on setting HOST_IP."
+fi
+
+# Allow the use of an alternate hostname (such as localhost/127.0.0.1) for service endpoints.
+SERVICE_HOST=${SERVICE_HOST:-$HOST_IP}
+
+# Configure services to use syslog instead of writing to individual log files
+SYSLOG=$(trueorfalse False SYSLOG)
+SYSLOG_HOST=${SYSLOG_HOST:-$HOST_IP}
+SYSLOG_PORT=${SYSLOG_PORT:-516}
+
+# Use color for logging output (only available if syslog is not used)
+LOG_COLOR=$(trueorfalse True LOG_COLOR)
+
+# Set global ``GIT_DEPTH=<number>`` to limit the history depth of the git clone
+GIT_DEPTH=${GIT_DEPTH:-1}
+
+# Use native SSL for servers in SSL_ENABLED_SERVICES
+USE_SSL=$(trueorfalse False USE_SSL)
+
 # Following entries need to be last items in file
 
 # Local variables:
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
new file mode 100755
index 0000000000..e57948a407
--- /dev/null
+++ b/tests/test_functions.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Tests for DevStack meta-config functions
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import common functions
+source $TOP/functions
+source $TOP/tests/unittest.sh
+
+function test_truefalse {
+    local one=1
+    local captrue=True
+    local lowtrue=true
+    local abrevtrue=t
+    local zero=0
+    local capfalse=False
+    local lowfalse=false
+    local abrevfalse=f
+    for against in True False; do
+        for name in one captrue lowtrue abrevtrue; do
+            assert_equal "True" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
+        done
+    done
+    for against in True False; do
+        for name in zero capfalse lowfalse abrevfalse; do
+            assert_equal "False" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
+        done
+    done
+}
+
+test_truefalse
+
+report_results
diff --git a/tests/unittest.sh b/tests/unittest.sh
new file mode 100644
index 0000000000..435cc3a58b
--- /dev/null
+++ b/tests/unittest.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# we always start with no errors
+ERROR=0
+FAILED_FUNCS=""
+
+function assert_equal {
+    local lineno=`caller 0 | awk '{print $1}'`
+    local function=`caller 0 | awk '{print $2}'`
+    local msg=$3
+    if [[ "$1" != "$2" ]]; then
+        FAILED_FUNCS+="$function:L$lineno\n"
+        echo "ERROR: $1 != $2 in $function:L$lineno!"
+        echo "  $msg"
+        ERROR=1
+    else
+        echo "$function:L$lineno - ok"
+    fi
+}
+
+function report_results {
+    if [[ $ERROR -eq 1 ]]; then
+        echo "Tests FAILED"
+        echo $FAILED_FUNCS
+        exit 1
+    fi
+}
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 9651083cb3..303cc63307 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -8,9 +8,15 @@
 #
 # -f        Force an install run now
 
-if [[ -n "$1" &&  "$1" = "-f" ]]; then
-    FORCE_PREREQ=1
-fi
+FORCE_PREREQ=0
+
+while getopts ":f" opt; do
+    case $opt in
+        f)
+            FORCE_PREREQ=1
+            ;;
+    esac
+done
 
 # If TOP_DIR is set we're being sourced rather than running stand-alone
 # or in a sub-shell
diff --git a/unstack.sh b/unstack.sh
index ea45da9fc4..bff01d1ca4 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -6,11 +6,22 @@
 # mysql and rabbit are left running as OpenStack code refreshes
 # do not require them to be restarted.
 #
-# Stop all processes by setting ``UNSTACK_ALL`` or specifying ``--all``
+# Stop all processes by setting ``UNSTACK_ALL`` or specifying ``-a``
 # on the command line
 
+UNSTACK_ALL=""
+
+while getopts ":a" opt; do
+    case $opt in
+        a)
+            UNSTACK_ALL=""
+            ;;
+    esac
+done
+
 # Keep track of the current devstack directory.
 TOP_DIR=$(cd $(dirname "$0") && pwd)
+FILES=$TOP_DIR/files
 
 # Import common functions
 source $TOP_DIR/functions
@@ -19,7 +30,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/lib/database
 
 # Load local configuration
-source $TOP_DIR/stackrc
+source $TOP_DIR/openrc
 
 # Destination path for service data
 DATA_DIR=${DATA_DIR:-${DEST}/data}
@@ -72,10 +83,6 @@ load_plugin_settings
 # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
 GetOSVersion
 
-if [[ "$1" == "--all" ]]; then
-    UNSTACK_ALL=${UNSTACK_ALL:-1}
-fi
-
 # Run extras
 # ==========
 

From 37026f536663f6d915169b356db08ac5fe4831cb Mon Sep 17 00:00:00 2001
From: Zhongyue Luo <zhongyue.nah@intel.com>
Date: Tue, 16 Dec 2014 10:56:54 +0800
Subject: [PATCH 0245/3333] Avoid VM configuration with Ironic hardware mode.

If "IRONIC_HARDWARE" is True, VMs are not required when using Ironic.

Change-Id: I33ba294f1e2ea583cd4c24c392637a4ee60a39ab
---
 lib/nova_plugins/hypervisor-ironic | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 4c2043b6b5..0169d731e8 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -56,6 +56,8 @@ function configure_nova_hypervisor {
 function install_nova_hypervisor {
     if ! is_service_enabled neutron; then
         die $LINENO "Neutron should be enabled for usage of the Ironic Nova driver."
+    elif is_ironic_hardware; then
+        return
     fi
     install_libvirt
     if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] && is_ubuntu; then

From 5bc957711ddefddc686af6a3be7ef8f984ee4779 Mon Sep 17 00:00:00 2001
From: Ryu Ishimoto <ryu@midokura.com>
Date: Thu, 15 Jan 2015 17:00:03 +0000
Subject: [PATCH 0246/3333] Clone neutron_lbaas for midonet plugin

MidoNet plugin needs the 'neutron_lbaas' module available when it
starts up without needing to start the LBaaS service.  After the
advanced service split, however, devstack clones 'neutron_lbaas'
only when the 'lbaas' service is enabled.  To get around this
conflict, clone 'neutron_lbaas' everytime midonet is configured
as the Neutron plugin.

Change-Id: Ide620db383fc44a66a84d00b2365ec2e846469fe
Closes-Bug: 1402242
---
 lib/neutron_plugins/midonet | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/neutron_plugins/midonet b/lib/neutron_plugins/midonet
index eb27ed63dd..23ad8b2020 100644
--- a/lib/neutron_plugins/midonet
+++ b/lib/neutron_plugins/midonet
@@ -29,6 +29,18 @@ function neutron_plugin_configure_common {
     Q_PLUGIN_CONF_PATH=etc/neutron/plugins/midonet
     Q_PLUGIN_CONF_FILENAME=midonet.ini
     Q_PLUGIN_CLASS="neutron.plugins.midonet.plugin.MidonetPluginV2"
+
+    # MidoNet implements LBaaS API in the plugin, not as an LBaaS driver.
+    # In this model, the plugin references the 'neutron_lbaas' module but
+    # does not require starting an LBaaS service.  Devstack, however, clones
+    # 'neutron_lbaas' only if 'lbaas' service is enabled.  To get around this,
+    # always clone 'neutron_lbaas' so that it is made available to the plugin.
+    # Also, discontinue if the 'lbaas' service is enabled.
+    if is_service_enabled q-lbaas; then
+        die $LINENO "LBaaS service should be disabled for the MidoNet plugin"
+    fi
+    git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
+    setup_develop $NEUTRON_LBAAS_DIR
 }
 
 function neutron_plugin_configure_debug_command {

From 0686dae6617407270e08b9313b9be3fa7a2592a0 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Thu, 15 Jan 2015 12:48:26 +0000
Subject: [PATCH 0247/3333] XenAPI: Fix another race condition

Fix it properly this time by forcing a PID from run.sh and using that to track.

A second issue is that upstart may run services twice, introduce a flock test
to ensure that we only run stack.sh once as running in parallel causes issues.

Change-Id: I05990c7154366350b0f9cc3e6c70d6f34238486f
---
 tools/xen/build_xva.sh       | 21 +++++++++++++++------
 tools/xen/install_os_domU.sh | 13 +++++--------
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
index 7c8e620f44..7002e6e22e 100755
--- a/tools/xen/build_xva.sh
+++ b/tools/xen/build_xva.sh
@@ -119,9 +119,7 @@ script
 
     chown -R $STACK_USER /opt/stack
 
-    if su -c "/opt/stack/run.sh" $STACK_USER; then
-        touch /var/run/devstack.succeeded
-    fi
+    su -c "/opt/stack/run.sh" $STACK_USER
 
     # Update /etc/issue
     {
@@ -177,8 +175,19 @@ fi
 cat <<EOF >$STAGING_DIR/opt/stack/run.sh
 #!/bin/bash
 set -eux
-cd /opt/stack/devstack
-./unstack.sh || true
-./stack.sh
+(
+  flock -n 9 || exit 1
+
+  [ -e /opt/stack/runsh.succeeded ] && rm /opt/stack/runsh.succeeded
+  echo \$\$ >> /opt/stack/run_sh.pid
+
+  cd /opt/stack/devstack
+  ./unstack.sh || true
+  ./stack.sh
+
+  # Got to the end - success
+  touch /opt/stack/runsh.succeeded
+  rm /opt/stack/run_sh.pid
+) 9> /opt/stack/.runsh_lock
 EOF
 chmod 755 $STAGING_DIR/opt/stack/run.sh
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 3a63473d40..753f06a83d 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -365,8 +365,8 @@ COPYENV=${COPYENV:-1}
 if [ "$WAIT_TILL_LAUNCH" = "1" ]  && [ -e ~/.ssh/id_rsa.pub  ] && [ "$COPYENV" = "1" ]; then
     set +x
 
-    echo "VM Launched - Waiting for devstack to start"
-    while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "service devstack status | grep -q running"; do
+    echo "VM Launched - Waiting for run.sh"
+    while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e /opt/stack/run_sh.pid"; do
         sleep 10
     done
     echo -n "devstack service is running, waiting for stack.sh to start logging..."
@@ -376,14 +376,11 @@ if [ "$WAIT_TILL_LAUNCH" = "1" ]  && [ -e ~/.ssh/id_rsa.pub  ] && [ "$COPYENV" =
     done
     set -x
 
-    # Watch devstack's output (which doesn't start until stack.sh is running,
-    # but wait for run.sh (which starts stack.sh) to exit as that is what
-    # hopefully writes the succeeded cookie.
-    pid=`ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS pgrep run.sh`
+    pid=`ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "cat /opt/stack/run_sh.pid"`
     ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "tail --pid $pid -n +1 -f /tmp/devstack/log/stack.log"
 
     # Fail if devstack did not succeed
-    ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS 'test -e /var/run/devstack.succeeded'
+    ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS 'test -e /opt/stack/runsh.succeeded'
 
     set +x
     echo "################################################################################"
@@ -401,7 +398,7 @@ else
     echo ""
     echo "ssh into your domU now: 'ssh stack@$OS_VM_MANAGEMENT_ADDRESS' using your password"
     echo "and then do: 'sudo service devstack status' to check if devstack is still running."
-    echo "Check that /var/run/devstack.succeeded exists"
+    echo "Check that /opt/stack/runsh.succeeded exists"
     echo ""
     echo "When devstack completes, you can visit the OpenStack Dashboard"
     echo "at http://$OS_VM_SERVICES_ADDRESS, and contact other services at the usual ports."

From 1e3a5d2d6cfd298080a9596ae4efa5c450341b69 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Fri, 16 Jan 2015 13:06:58 +0000
Subject: [PATCH 0248/3333] XenAPI: Use SCREEN_LOGDIR rather than assuming a
 static value

This value was defined in Citrix's install-devstack-xen script, so
only worked for those using that script.

Change-Id: Iab63389f41760865f2b67f6dccd57d774e889905
---
 tools/xen/install_os_domU.sh | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 753f06a83d..546ead6127 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -371,14 +371,19 @@ if [ "$WAIT_TILL_LAUNCH" = "1" ]  && [ -e ~/.ssh/id_rsa.pub  ] && [ "$COPYENV" =
     done
     echo -n "devstack service is running, waiting for stack.sh to start logging..."
 
-    while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e /tmp/devstack/log/stack.log"; do
-        sleep 10
-    done
-    set -x
-
     pid=`ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "cat /opt/stack/run_sh.pid"`
-    ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "tail --pid $pid -n +1 -f /tmp/devstack/log/stack.log"
+    if [ -n "$SCREEN_LOGDIR" ]; then
+        while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e ${SCREEN_LOGDIR}/stack.log"; do
+            sleep 10
+        done
+
+        ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "tail --pid $pid -n +1 -f ${SCREEN_LOGDIR}/stack.log"
+    else
+        echo -n "SCREEN_LOGDIR not set; just waiting for process $pid to finish"
+        ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "wait $pid"
+    fi
 
+    set -x
     # Fail if devstack did not succeed
     ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS 'test -e /opt/stack/runsh.succeeded'
 

From d06a6d9d8bd3663d0cc0783b0868f6cfc9b8563e Mon Sep 17 00:00:00 2001
From: Rob <rcresswe@cisco.com>
Date: Thu, 4 Dec 2014 20:32:22 +0000
Subject: [PATCH 0249/3333] Create initial network when using Cisco N1k plugin

This patch creates an initial network when using the Cisco n1k plugin,
as it fails otherwise.

Change-Id: Ieceac0e2518bf5ca4cd808f6719b73aad0db903b
Closes-Bug: 1399389
---
 lib/neutron               | 5 +++++
 lib/neutron_plugins/cisco | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index b4d0b8cad4..bfb0fbadec 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -534,6 +534,11 @@ function create_neutron_initial_network {
     TENANT_ID=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for demo"
 
+    # Allow drivers that need to create an initial network to do so here
+    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
+        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
+    fi
+
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index b067aa6b11..90dcd574c0 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -144,6 +144,10 @@ function neutron_plugin_configure_service {
     fi
 }
 
+function neutron_plugin_create_initial_network_profile {
+    neutron cisco-network-profile-create default_network_profile vlan --segment_range 1-3000 --physical_network "$1"
+}
+
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
     iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver

From ad5cc986d86e9deff506c0451409f26fc8e86efe Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 10 Dec 2014 16:35:32 -0600
Subject: [PATCH 0250/3333] Rename screen logfiles

This renames the log files in logs/screen that contain timestamps to put
the timestamp after '.log' and '.log.summary' in the names.  This will
simplify devstack-gate's search for log files to copy to '*.log'.

dstat.txt is also renamed to dstat.log

Make LOGDIR and LOGFILE local

bp:devstack-logging-and-service-names
Change-Id: I02aba9ca82c117a1186dafc1d3c07aa04ecd1dde
---
 functions-common | 14 +++++++-------
 lib/dstat        |  2 +-
 stack.sh         | 19 +++++++++----------
 3 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/functions-common b/functions-common
index b0b262236d..23d59c7d98 100644
--- a/functions-common
+++ b/functions-common
@@ -1244,8 +1244,8 @@ function _run_process {
     exec 6>&-
 
     if [[ -n ${SCREEN_LOGDIR} ]]; then
-        exec 1>&${SCREEN_LOGDIR}/screen-${service}.${CURRENT_LOG_TIME}.log 2>&1
-        ln -sf ${SCREEN_LOGDIR}/screen-${service}.${CURRENT_LOG_TIME}.log ${SCREEN_LOGDIR}/screen-${service}.log
+        exec 1>&${SCREEN_LOGDIR}/screen-${service}.log.${CURRENT_LOG_TIME} 2>&1
+        ln -sf ${SCREEN_LOGDIR}/screen-${service}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${service}.log
 
         # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
         export PYTHONUNBUFFERED=1
@@ -1329,9 +1329,9 @@ function screen_process {
     screen -S $SCREEN_NAME -X screen -t $name
 
     if [[ -n ${SCREEN_LOGDIR} ]]; then
-        screen -S $SCREEN_NAME -p $name -X logfile ${SCREEN_LOGDIR}/screen-${name}.${CURRENT_LOG_TIME}.log
+        screen -S $SCREEN_NAME -p $name -X logfile ${SCREEN_LOGDIR}/screen-${name}.log.${CURRENT_LOG_TIME}
         screen -S $SCREEN_NAME -p $name -X log on
-        ln -sf ${SCREEN_LOGDIR}/screen-${name}.${CURRENT_LOG_TIME}.log ${SCREEN_LOGDIR}/screen-${name}.log
+        ln -sf ${SCREEN_LOGDIR}/screen-${name}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${name}.log
     fi
 
     # sleep to allow bash to be ready to be send the command - we are
@@ -1377,7 +1377,7 @@ function screen_rc {
         echo "stuff \"$2$NL\"" >> $SCREENRC
 
         if [[ -n ${SCREEN_LOGDIR} ]]; then
-            echo "logfile ${SCREEN_LOGDIR}/screen-${1}.${CURRENT_LOG_TIME}.log" >>$SCREENRC
+            echo "logfile ${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
             echo "log on" >>$SCREENRC
         fi
     fi
@@ -1489,8 +1489,8 @@ function _old_run_process {
     exec 6>&-
 
     if [[ -n ${SCREEN_LOGDIR} ]]; then
-        exec 1>&${SCREEN_LOGDIR}/screen-${1}.${CURRENT_LOG_TIME}.log 2>&1
-        ln -sf ${SCREEN_LOGDIR}/screen-${1}.${CURRENT_LOG_TIME}.log ${SCREEN_LOGDIR}/screen-${1}.log
+        exec 1>&${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME} 2>&1
+        ln -sf ${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${1}.log
 
         # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
         export PYTHONUNBUFFERED=1
diff --git a/lib/dstat b/lib/dstat
index 73ca279fea..a17125fc92 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -20,7 +20,7 @@ set +o xtrace
 # Defaults
 # --------
 # for DSTAT logging
-DSTAT_FILE=${DSTAT_FILE:-"dstat.txt"}
+DSTAT_FILE=${DSTAT_FILE:-"dstat.log"}
 
 
 # start_dstat() - Start running processes, including screen
diff --git a/stack.sh b/stack.sh
index 048e5d1a1e..f42e68ae08 100755
--- a/stack.sh
+++ b/stack.sh
@@ -370,15 +370,14 @@ if [[ -n "$LOGFILE" || -n "$SCREEN_LOGDIR" ]]; then
 fi
 
 if [[ -n "$LOGFILE" ]]; then
-    # First clean up old log files.  Use the user-specified ``LOGFILE``
-    # as the template to search for, appending '.*' to match the date
-    # we added on earlier runs.
-    LOGDIR=$(dirname "$LOGFILE")
-    LOGFILENAME=$(basename "$LOGFILE")
-    mkdir -p $LOGDIR
-    find $LOGDIR -maxdepth 1 -name $LOGFILENAME.\* -mtime +$LOGDAYS -exec rm {} \;
+    # Clean up old log files.  Append '.*' to the user-specified
+    # ``LOGFILE`` to match the date in the search template.
+    local logfile_dir="${LOGFILE%/*}"           # dirname
+    local logfile_name="${LOGFILE##*/}"         # basename
+    mkdir -p $logfile_dir
+    find $logfile_dir -maxdepth 1 -name $logfile_name.\* -mtime +$LOGDAYS -exec rm {} \;
     LOGFILE=$LOGFILE.${CURRENT_LOG_TIME}
-    SUMFILE=$LOGFILE.${CURRENT_LOG_TIME}.summary
+    SUMFILE=$LOGFILE.summary.${CURRENT_LOG_TIME}
 
     # Redirect output according to config
 
@@ -399,8 +398,8 @@ if [[ -n "$LOGFILE" ]]; then
 
     echo_summary "stack.sh log $LOGFILE"
     # Specified logfile name always links to the most recent log
-    ln -sf $LOGFILE $LOGDIR/$LOGFILENAME
-    ln -sf $SUMFILE $LOGDIR/$LOGFILENAME.summary
+    ln -sf $LOGFILE $logfile_dir/$logfile_name
+    ln -sf $SUMFILE $logfile_dir/$logfile_name.summary
 else
     # Set up output redirection without log files
     # Set fd 3 to a copy of stdout. So we can set fd 1 without losing

From 9b1df576342e2151df4b6e8daec3ccb72abc238a Mon Sep 17 00:00:00 2001
From: venkata anil <anil.venkata@enovance.com>
Date: Thu, 15 Jan 2015 07:38:22 +0000
Subject: [PATCH 0251/3333] neutron should log user_name and project_name by
 default like in nova

neutron doesn't log user_name and project_name along side req-id in
devstack logs. So, Openstack jenkins neutron check and gate jobs also
not logging user_name and project_name along side req-id.
Without knowing the user and tenant, its hard to understand what the
logs are doing when multiple tenants are using the cloud.

Nova is logging user_name and project_name by default.
So porting the same changes to neutron.

Change-Id: I10eac2e4177a898e9bcc60c08f3bd39a2ec9f31b
Closes-Bug: #1399788
---
 lib/neutron | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index b4d0b8cad4..52cc575d1c 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -837,6 +837,9 @@ function _configure_neutron_common {
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
         setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
+    else
+        # Show user_name and project_name by default like in nova
+        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
     fi
 
     if is_service_enabled tls-proxy; then

From 90333437337ff38c04e363cd3dbd7aa970ef21c4 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 19 Jan 2015 10:56:42 +0000
Subject: [PATCH 0252/3333] Set password irrespective of mysql server version

Ubuntu recently upgraded from 5.1 to 5.5 so the previous debconf
settings no longer work.  Removing the version number should make
the settings work for all versions of mysql

Change-Id: I6b399a06232364d3ba3bf74430b663e0b8b922ed
---
 lib/databases/mysql | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 45484c15e9..7bd74dce27 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -138,10 +138,10 @@ function install_database_mysql {
     if is_ubuntu; then
         # Seed configuration with mysql password so that apt-get install doesn't
         # prompt us for a password upon install.
-        cat <<MYSQL_PRESEED | sudo debconf-set-selections
-mysql-server-5.1 mysql-server/root_password password $DATABASE_PASSWORD
-mysql-server-5.1 mysql-server/root_password_again password $DATABASE_PASSWORD
-mysql-server-5.1 mysql-server/start_on_boot boolean true
+        sudo debconf-set-selections <<MYSQL_PRESEED
+mysql-server mysql-server/root_password password $DATABASE_PASSWORD
+mysql-server mysql-server/root_password_again password $DATABASE_PASSWORD
+mysql-server mysql-server/start_on_boot boolean true
 MYSQL_PRESEED
     fi
 

From d470867f08a2be3c30c66d9519a95eb5801cfbc9 Mon Sep 17 00:00:00 2001
From: Daniel Genin <Daniel.Genin@jhuapl.edu>
Date: Fri, 31 Oct 2014 15:01:29 -0400
Subject: [PATCH 0253/3333] Adds support for LVM ephemeral storage in Nova

DevStack currently lacks support for LVM ephemeral storage in Nova.
This support is important for testing of Nova's LVM backend. The
proposed change adds a default volume group, to be shared by Cinder
and Nova. It also adds a configuration option NOVA_BACKEND, which
must be LVM if it is set, that determines whether Nova should be
configured to use LVM ephemeral storage.

Change-Id: I4eb9afff3536fbcd563939f2d325efbb845081bb
---
 HACKING.rst             |   4 +-
 lib/cinder              |   4 +-
 lib/cinder_backends/lvm | 130 +++-------------------------------------
 lib/lvm                 | 124 ++++++++++++++++++++++++++++++++++++++
 lib/nova                |   5 ++
 stack.sh                |   5 ++
 unstack.sh              |   3 +
 7 files changed, 150 insertions(+), 125 deletions(-)
 create mode 100644 lib/lvm

diff --git a/HACKING.rst b/HACKING.rst
index 3ffe1e2103..b7d9a49458 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -110,8 +110,8 @@ follows:
 * Global configuration that may be referenced in ``local.conf``, i.e. ``DEST``, ``DATA_DIR``
 * Global service configuration like ``ENABLED_SERVICES``
 * Variables used by multiple services that do not have a clear owner, i.e.
-  ``VOLUME_BACKING_FILE_SIZE`` (nova-volumes and cinder) or ``PUBLIC_NETWORK_NAME``
-  (nova-network and neutron)
+  ``VOLUME_BACKING_FILE_SIZE`` (nova-compute, nova-volumes and cinder) or
+  ``PUBLIC_NETWORK_NAME`` (nova-network and neutron)
 * Variables that can not be cleanly declared in a project file due to
   dependency ordering, i.e. the order of sourcing the project files can
   not be changed for other reasons but the earlier file needs to dereference a
diff --git a/lib/cinder b/lib/cinder
index 7fc694957b..f1a5de7e05 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -76,9 +76,9 @@ CINDER_MULTI_LVM_BACKEND=$(trueorfalse False CINDER_MULTI_LVM_BACKEND)
 # configuration and for the volume type name.  Multiple backends are
 # comma-separated.
 if [[ $CINDER_MULTI_LVM_BACKEND == "False" ]]; then
-    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
+    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:${DEFAULT_VOLUME_GROUP_NAME##*-}}
 else
-    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2}
+    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:${DEFAULT_VOLUME_GROUP_NAME##*-},lvm:cinder}
 fi
 
 
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 280baf7b3e..43e13e4dac 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -14,6 +14,7 @@
 
 # CINDER_CONF
 # DATA_DIR
+# VOLUME_GROUP_NAME
 
 # clean_cinder_backend_lvm - called from clean_cinder()
 # configure_cinder_backend_lvm - called from configure_cinder()
@@ -25,157 +26,44 @@ MY_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
 
-# Defaults
-# --------
-
-# Name of the lvm volume groups to use/create for iscsi volumes
-# This monkey-motion is for compatibility with icehouse-generation Grenade
-# If ``VOLUME_GROUP`` is set, use it, otherwise we'll build a VG name based
-# on ``VOLUME_GROUP_NAME`` that includes the backend name
-# Grenade doesn't use ``VOLUME_GROUP2`` so it is left out
-VOLUME_GROUP=${VOLUME_GROUP:-}
-VOLUME_GROUP_NAME=${VOLUME_GROUP:-${VOLUME_GROUP_NAME:-stack-volumes}}
-
 # TODO: resurrect backing device...need to know how to set values
 #VOLUME_BACKING_DEVICE=${VOLUME_BACKING_DEVICE:-}
 
-VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}
-
-
 # Entry Points
 # ------------
 
-# Compatibility for getting a volume group name from either ``VOLUME_GROUP``
-# or from ``VOLUME_GROUP_NAME`` plus the backend name
-function get_volume_group_name {
-    local be_name=$1
-
-    # Again with the icehouse-generation compatibility
-    local volume_group_name=$VOLUME_GROUP_NAME
-    if [[ -z $VOLUME_GROUP ]]; then
-        volume_group_name+="-$be_name"
-    fi
-    echo $volume_group_name
-}
-
+# cleanup_cinder_backend_lvm - Delete volume group and remove backing file
+# cleanup_cinder_backend_lvm $be_name
 function cleanup_cinder_backend_lvm {
     local be_name=$1
 
-    # Again with the icehouse-generation compatibility
-    local volume_group_name=$(get_volume_group_name $be_name)
-
     # Campsite rule: leave behind a volume group at least as clean as we found it
-    _clean_lvm_lv ${volume_group_name} $VOLUME_NAME_PREFIX
-    _clean_lvm_backing_file ${volume_group_name} $DATA_DIR/${volume_group_name}-backing-file
+    clean_lvm_volume_group $VOLUME_GROUP_NAME-$be_name
 }
 
 # configure_cinder_backend_lvm - Set config files, create data dirs, etc
-# configure_cinder_backend_lvm $name
+# configure_cinder_backend_lvm $be_name
 function configure_cinder_backend_lvm {
     local be_name=$1
 
-    # Again with the icehouse-generation compatibility
-    local volume_group_name=$(get_volume_group_name $be_name)
-
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMISCSIDriver"
-    iniset $CINDER_CONF $be_name volume_group $volume_group_name
+    iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
 
     if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
         iniset $CINDER_CONF $be_name volume_clear none
     fi
 }
 
-
+# init_cinder_backend_lvm - Initialize volume group
+# init_cinder_backend_lvm $be_name
 function init_cinder_backend_lvm {
     local be_name=$1
 
-    # Again with the icehouse-generation compatibility
-    local volume_group_name=$(get_volume_group_name $be_name)
-
     # Start with a clean volume group
-    _create_cinder_volume_group ${volume_group_name} $DATA_DIR/${volume_group_name}-backing-file
-
-    if is_fedora || is_suse; then
-        # service is not started by default
-        start_service tgtd
-    fi
-
-    # Remove iscsi targets
-    sudo tgtadm --op show --mode target | grep $VOLUME_NAME_PREFIX | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
-    _clean_lvm_lv ${volume_group_name} $VOLUME_NAME_PREFIX
-}
-
-
-# _clean_lvm_lv removes all cinder LVM volumes
-#
-# Usage: _clean_lvm_lv volume-group-name $VOLUME_NAME_PREFIX
-function _clean_lvm_lv {
-    local vg=$1
-    local lv_prefix=$2
-
-    # Clean out existing volumes
-    local lv
-    for lv in $(sudo lvs --noheadings -o lv_name $vg 2>/dev/null); do
-        # lv_prefix prefixes the LVs we want
-        if [[ "${lv#$lv_prefix}" != "$lv" ]]; then
-            sudo lvremove -f $vg/$lv
-        fi
-    done
-}
-
-# _clean_lvm_backing_file() removes the backing file of the
-# volume group used by cinder
-#
-# Usage: _clean_lvm_backing_file() volume-group-name backing-file-name
-function _clean_lvm_backing_file {
-    local vg=$1
-    local backing_file=$2
-
-    # if there is no logical volume left, it's safe to attempt a cleanup
-    # of the backing file
-    if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then
-        # if the backing physical device is a loop device, it was probably setup by devstack
-        local vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/backing-file/ { print $1}')
-        if [[ -n "$vg_dev" ]] && [[ -e "$vg_dev" ]]; then
-            sudo losetup -d $vg_dev
-            rm -f $backing_file
-        fi
-    fi
+    init_lvm_volume_group $VOLUME_GROUP_NAME-$be_name $VOLUME_BACKING_FILE_SIZE
 }
 
-# _create_cinder_volume_group volume-group-name backing-file-name
-function _create_cinder_volume_group {
-    # According to the ``CINDER_MULTI_LVM_BACKEND`` value, configure one or two default volumes
-    # group called ``stack-volumes`` (and ``stack-volumes2``) for the volume
-    # service if it (they) does (do) not yet exist. If you don't wish to use a
-    # file backed volume group, create your own volume group called ``stack-volumes``
-    # and ``stack-volumes2`` before invoking ``stack.sh``.
-    #
-    # The two backing files are ``VOLUME_BACKING_FILE_SIZE`` in size, and they are stored in
-    # the ``DATA_DIR``.
-
-    local vg_name=$1
-    local backing_file=$2
-
-    if ! sudo vgs $vg_name; then
-        # TODO: fix device handling
-        if [ -z "$VOLUME_BACKING_DEVICE" ]; then
-            # Only create if the file doesn't already exists
-            [[ -f $backing_file ]] || truncate -s $VOLUME_BACKING_FILE_SIZE $backing_file
-            local vg_dev=`sudo losetup -f --show $backing_file`
-
-            # Only create if the loopback device doesn't contain $VOLUME_GROUP
-            if ! sudo vgs $vg_name; then
-                sudo vgcreate $vg_name $vg_dev
-            fi
-        else
-            sudo vgcreate $vg_name $VOLUME_BACKING_DEVICE
-        fi
-    fi
-}
-
-
 # Restore xtrace
 $MY_XTRACE
 
diff --git a/lib/lvm b/lib/lvm
new file mode 100644
index 0000000000..4ef260d593
--- /dev/null
+++ b/lib/lvm
@@ -0,0 +1,124 @@
+# lib/lvm
+# Configure the default LVM volume group used by Cinder and Nova
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# DATA_DIR
+
+# clean_default_volume_group - called from clean()
+# configure_default_volume_group - called from configure()
+# init_default_volume_group - called from init()
+
+
+# Save trace setting
+MY_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+# Name of the lvm volume groups to use/create for iscsi volumes
+# This monkey-motion is for compatibility with icehouse-generation Grenade
+# If ``VOLUME_GROUP`` is set, use it, otherwise we'll build a VG name based
+# on ``VOLUME_GROUP_NAME`` that includes the backend name
+# Grenade doesn't use ``VOLUME_GROUP2`` so it is left out
+VOLUME_GROUP_NAME=${VOLUME_GROUP:-${VOLUME_GROUP_NAME:-stack-volumes}}
+DEFAULT_VOLUME_GROUP_NAME=$VOLUME_GROUP_NAME-default
+
+# Backing file name is of the form $VOLUME_GROUP$BACKING_FILE_SUFFIX
+BACKING_FILE_SUFFIX=-backing-file
+
+
+# Entry Points
+# ------------
+
+# _clean_lvm_volume_group removes all default LVM volumes
+#
+# Usage: clean_lvm_volume_group $vg
+function _clean_lvm_volume_group {
+    local vg=$1
+
+    # Clean out existing volumes
+    sudo lvremove -f $vg
+}
+
+# _clean_lvm_backing_file() removes the backing file of the
+# volume group
+#
+# Usage: _clean_lvm_backing_file() $backing_file
+function _clean_lvm_backing_file {
+    local backing_file=$1
+
+    # if the backing physical device is a loop device, it was probably setup by devstack
+    if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
+        local vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
+        sudo losetup -d $vg_dev
+        rm -f $backing_file
+    fi
+}
+
+# clean_lvm_volume_group() cleans up the volume group and removes the
+# backing file
+#
+# Usage: clean_lvm_volume_group $vg
+function clean_lvm_volume_group {
+    local vg=$1
+
+    _clean_lvm_volume_group $vg
+    # if there is no logical volume left, it's safe to attempt a cleanup
+    # of the backing file
+    if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then
+        _clean_lvm_backing_file $DATA_DIR/$vg$BACKING_FILE_SUFFIX
+    fi
+}
+
+
+# _create_volume_group creates default volume group
+#
+# Usage: _create_lvm_volume_group() $vg $size
+function _create_lvm_volume_group {
+    local vg=$1
+    local size=$2
+
+    local backing_file=$DATA_DIR/$vg$BACKING_FILE_SUFFIX
+    if ! sudo vgs $vg; then
+        # Only create if the file doesn't already exists
+        [[ -f $DATA_DIR/$backing_file ]] || truncate -s $size $backing_file
+        local vg_dev=`sudo losetup -f --show $backing_file`
+
+        # Only create volume group if it doesn't already exist
+        if ! sudo vgs $vg; then
+            sudo vgcreate $vg $vg_dev
+        fi
+    fi
+}
+
+# init_lvm_volume_group() initializes the volume group creating the backing
+# file if necessary
+#
+# Usage: init_lvm_volume_group() $vg
+function init_lvm_volume_group {
+    local vg=$1
+    local size=$2
+    # Start with a clean volume group
+    _create_lvm_volume_group $vg $size
+
+    if is_fedora || is_suse; then
+        # service is not started by default
+        start_service tgtd
+    fi
+
+    # Remove iscsi targets
+    sudo tgtadm --op show --mode target | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
+
+    _clean_lvm_volume_group $vg
+}
+
+# Restore xtrace
+$MY_XTRACE
+
+# mode: shell-script
+# End:
diff --git a/lib/nova b/lib/nova
index 0e9282bb1b..61216ff9d6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -547,6 +547,11 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT ec2_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"
 
+    if [[ "$NOVA_BACKEND" == "LVM" ]]; then
+        iniset $NOVA_CONF libvirt images_type "lvm"
+        iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
+    fi
+
     if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
     fi
diff --git a/stack.sh b/stack.sh
index 585d1ceaf6..45113b50d2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -523,6 +523,7 @@ source $TOP_DIR/lib/tls
 source $TOP_DIR/lib/infra
 source $TOP_DIR/lib/oslo
 source $TOP_DIR/lib/stackforge
+source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
@@ -939,6 +940,10 @@ init_service_check
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+# Initialize default LVM volume group
+# -----------------------------------
+init_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME $VOLUME_BACKING_FILE_SIZE
+
 # Start Services
 # ==============
 
diff --git a/unstack.sh b/unstack.sh
index bff01d1ca4..b8b7f4a130 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -55,6 +55,7 @@ source $TOP_DIR/lib/tls
 source $TOP_DIR/lib/infra
 source $TOP_DIR/lib/oslo
 source $TOP_DIR/lib/stackforge
+source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
@@ -177,3 +178,5 @@ if [[ -n "$SCREEN" ]]; then
         screen -X -S $SESSION quit
     fi
 fi
+
+clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME

From 5541a618de890ec721c375506057eeb6cb7a5a63 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 19 Jan 2015 15:58:49 -0500
Subject: [PATCH 0254/3333] Use `os role list` instead of `os user role list`

Since `os user role list` is being deprecated, we should start
migrating to `os role list`, which now has the required ability
to list a users role on a project as of v1.0.2 of osc.

Change-Id: I3fa8bf8f1feaac16e1cde5c55b1be00b92eaa5f6
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 5bca836d37..9c4d59976a 100644
--- a/functions-common
+++ b/functions-common
@@ -919,8 +919,8 @@ function get_or_create_role {
 # Usage: get_or_add_user_role <role> <user> <project>
 function get_or_add_user_role {
     # Gets user role id
-    local user_role_id=$(openstack user role list \
-        $2 \
+    local user_role_id=$(openstack role list \
+        --user $2 \
         --project $3 \
         --column "ID" \
         --column "Name" \

From 789af5ccfa49e40eabe1454e9e2d31bd6c6f0ef8 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 19 Jan 2015 16:11:44 -0500
Subject: [PATCH 0255/3333] Update osc server create to have type as positional
 arg

In Keystone, for v2 and v3 service creation, there was a bug that
allowed a service to be created with no type, which made it useless.

See reference bug for details.

Change-Id: I5d095007fe2ebc8219dc012c5b16cb4c122179cd
Related-Bug: #1404073
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 5bca836d37..ce809f1563 100644
--- a/functions-common
+++ b/functions-common
@@ -945,8 +945,8 @@ function get_or_create_service {
         openstack service show $1 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
         openstack service create \
-            $1 \
-            --type=$2 \
+            $2 \
+            --name $1 \
             --description="$3" \
             -f value -c id
     )

From 3566310ea8731547afd1ca18e1416a2d12dbc0c7 Mon Sep 17 00:00:00 2001
From: Kennan <wkq5325@gmail.com>
Date: Tue, 20 Jan 2015 16:19:49 +0800
Subject: [PATCH 0256/3333] Remove unneeded word

Change-Id: Ic3f7fb5bc992e1a8c5b9fc433572d7e39f81f08a
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 90d4ca3c77..95cde9699a 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -196,7 +196,7 @@ controller node.
         SEGMENTATION_ID=2010
 
 In this configuration we are defining FIXED_RANGE to be a
-subnet that exists in the private RFC1918 address space - however in
+subnet that exists in the private RFC1918 address space - however
 in a real setup FIXED_RANGE would be a public IP address range, so
 that you could access your instances from the public internet.
 

From 37b7a665d046160754396423cd4443a3e3f9bb11 Mon Sep 17 00:00:00 2001
From: JordanP <jordan.pittier@scality.com>
Date: Tue, 20 Jan 2015 14:28:22 +0100
Subject: [PATCH 0257/3333] Fix doc: API_RATE_LIMIT has been removed

Ib0538bdd23b17e519b9c917018ccc9fa8c6425c5 removed the option
API_RATE_LIMIT. So don't mention it in the documentation.

Change-Id: I9df67c3dd1b800f6a51de2cd78aeaad10ca38f7e
---
 doc/source/configuration.rst | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index baebe979b0..b9a48024ed 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -352,19 +352,6 @@ Multi-host DevStack
         GLANCE_HOSTPORT=w.x.y.z:9292
         ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
 
-API rate limits
----------------
-
-    | Default: ``API_RATE_LIMIT=True``
-    | Integration tests such as Tempest will likely run afoul of the
-      default rate limits configured for Nova. Turn off rate limiting
-      during testing by setting ``API_RATE_LIMIT=False``.*
-    |
-
-    ::
-
-        API_RATE_LIMIT=False
-
 IP Version
     | Default: ``IP_VERSION=4``
     | This setting can be used to configure DevStack to create either an IPv4,

From 59d52f307b8fee53c29cda803ba3d1848ef91a8b Mon Sep 17 00:00:00 2001
From: Kevin Benton <blak111@gmail.com>
Date: Sat, 17 Jan 2015 11:29:12 -0800
Subject: [PATCH 0258/3333] Disable shallow cloning with GIT_DEPTH=0

The recent patch to enable shallow cloning added a method to skip
it by checking if GIT_DEPTH was null. However, this could never
be triggered because if the user specified it as null, the default
setting code would take over and set it to 1.

This patch allows the user to specify GIT_DEPTH=0 to skip the
shallow clone.

Change-Id: I00ea7ab54ed51dc3ede9ceb9ff0f11575a035d1c
---
 functions-common | 2 +-
 stackrc          | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 5bca836d37..7be0a92a72 100644
--- a/functions-common
+++ b/functions-common
@@ -601,7 +601,7 @@ function git_clone {
     local git_clone_flags=""
 
     RECLONE=$(trueorfalse False RECLONE)
-    if [[ -n "${GIT_DEPTH}" ]]; then
+    if [[ "${GIT_DEPTH}" -gt 0 ]]; then
         git_clone_flags="$git_clone_flags --depth $GIT_DEPTH"
     fi
 
diff --git a/stackrc b/stackrc
index 25682027df..2dd56e8104 100644
--- a/stackrc
+++ b/stackrc
@@ -697,7 +697,8 @@ SYSLOG_PORT=${SYSLOG_PORT:-516}
 LOG_COLOR=$(trueorfalse True LOG_COLOR)
 
 # Set global ``GIT_DEPTH=<number>`` to limit the history depth of the git clone
-GIT_DEPTH=${GIT_DEPTH:-1}
+# Set to 0 to disable shallow cloning
+GIT_DEPTH=${GIT_DEPTH:-0}
 
 # Use native SSL for servers in SSL_ENABLED_SERVICES
 USE_SSL=$(trueorfalse False USE_SSL)

From fc9cc96514bf582d644029f114441891a087d665 Mon Sep 17 00:00:00 2001
From: Mikhail S Medvedev <mmedvede@us.ibm.com>
Date: Tue, 20 Jan 2015 11:04:48 -0600
Subject: [PATCH 0259/3333] Remove locals that were not inside functions

Using 'local' keyword outside a function is invalid.

Also uppercase the variables to adhere to the style.

Related: I02aba9ca82c117a1186dafc1d3c07aa04ecd1dde
Change-Id: I76d358f8ebf5145cd3c65f9a470c83d4af67fd32
---
 stack.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/stack.sh b/stack.sh
index 00a617253e..aeaaf6072c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -381,10 +381,10 @@ fi
 if [[ -n "$LOGFILE" ]]; then
     # Clean up old log files.  Append '.*' to the user-specified
     # ``LOGFILE`` to match the date in the search template.
-    local logfile_dir="${LOGFILE%/*}"           # dirname
-    local logfile_name="${LOGFILE##*/}"         # basename
-    mkdir -p $logfile_dir
-    find $logfile_dir -maxdepth 1 -name $logfile_name.\* -mtime +$LOGDAYS -exec rm {} \;
+    LOGFILE_DIR="${LOGFILE%/*}"           # dirname
+    LOGFILE_NAME="${LOGFILE##*/}"         # basename
+    mkdir -p $LOGFILE_DIR
+    find $LOGFILE_DIR -maxdepth 1 -name $LOGFILE_NAME.\* -mtime +$LOGDAYS -exec rm {} \;
     LOGFILE=$LOGFILE.${CURRENT_LOG_TIME}
     SUMFILE=$LOGFILE.summary.${CURRENT_LOG_TIME}
 
@@ -407,8 +407,8 @@ if [[ -n "$LOGFILE" ]]; then
 
     echo_summary "stack.sh log $LOGFILE"
     # Specified logfile name always links to the most recent log
-    ln -sf $LOGFILE $logfile_dir/$logfile_name
-    ln -sf $SUMFILE $logfile_dir/$logfile_name.summary
+    ln -sf $LOGFILE $LOGFILE_DIR/$LOGFILE_NAME
+    ln -sf $SUMFILE $LOGFILE_DIR/$LOGFILE_NAME.summary
 else
     # Set up output redirection without log files
     # Set fd 3 to a copy of stdout. So we can set fd 1 without losing

From dde41d0797f0b085099cd5c9ff1e0110d5ae3fbd Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Tue, 9 Dec 2014 17:47:57 -0600
Subject: [PATCH 0260/3333] Deprecate SCREEN_LOGDIR in favor of LOGDIR

This is the first step in the log file cleanup.  If SCREEN_LOGDIR
is still set, symlinks will be created in the old screen log directory
so things like the devstack-gate log collector continues to work.

bp:logging-and-service-names
Change-Id: I3ac796e322a18dbd0b8b2310a08310ca159d7613
---
 doc/source/configuration.rst | 25 +++++++++----------
 functions-common             | 43 +++++++++++++++++++++------------
 lib/dstat                    |  8 ++++--
 stack.sh                     |  7 +++---
 stackrc                      | 47 ++++++++++++++++++++++++++++++++++++
 5 files changed, 95 insertions(+), 35 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index baebe979b0..7dbb5882ee 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -200,22 +200,19 @@ Enable Logging
 
         LOG_COLOR=False
 
-Logging the Screen Output
--------------------------
-
-    | *Default: ``SCREEN_LOGDIR=""``*
-    |  By default DevStack runs the OpenStack services using ``screen``
-       which is useful for watching log and debug output. However, in
-       automated testing the interactive ``screen`` sessions may not be
-       available after the fact; setting ``SCREEN_LOGDIR`` enables logging
-       of the ``screen`` sessions in the specified directory. There will be
-       one file per ``screen`` session named for the session name and a
-       timestamp.
+Logging the Service Output
+--------------------------
+
+    | *Default: ``LOGDIR=""``*
+    |  DevStack will log the stdout output of the services it starts.
+       When using ``screen`` this logs the output in the screen windows
+       to a file.  Without ``screen`` this simply redirects stdout of
+       the service process to a file in ``LOGDIR``.
     |
 
     ::
 
-        SCREEN_LOGDIR=$DEST/logs/screen
+        LOGDIR=$DEST/logs
 
     *Note the use of ``DEST`` to locate the main install directory; this
     is why we suggest setting it in ``local.conf``.*
@@ -413,8 +410,8 @@ Examples
        FIXED_RANGE=10.254.1.0/24
        NETWORK_GATEWAY=10.254.1.1
        LOGDAYS=1
-       LOGFILE=$DEST/logs/stack.sh.log
-       SCREEN_LOGDIR=$DEST/logs/screen
+       LOGDIR=$DEST/logs
+       LOGFILE=$LOGDIR/stack.sh.log
        ADMIN_PASSWORD=quiet
        DATABASE_PASSWORD=$ADMIN_PASSWORD
        RABBIT_PASSWORD=$ADMIN_PASSWORD
diff --git a/functions-common b/functions-common
index 44d5671236..8d54473a99 100644
--- a/functions-common
+++ b/functions-common
@@ -319,8 +319,8 @@ function err {
     set +o xtrace
     local msg="[ERROR] ${BASH_SOURCE[2]}:$1 $2"
     echo $msg 1>&2;
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        echo $msg >> "${SCREEN_LOGDIR}/error.log"
+    if [[ -n ${LOGDIR} ]]; then
+        echo $msg >> "${LOGDIR}/error.log"
     fi
     $xtrace
     return $exitcode
@@ -372,8 +372,8 @@ function warn {
     set +o xtrace
     local msg="[WARNING] ${BASH_SOURCE[2]}:$1 $2"
     echo $msg 1>&2;
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        echo $msg >> "${SCREEN_LOGDIR}/error.log"
+    if [[ -n ${LOGDIR} ]]; then
+        echo $msg >> "${LOGDIR}/error.log"
     fi
     $xtrace
     return $exitcode
@@ -1261,8 +1261,8 @@ function zypper_install {
 # _run_process() is designed to be backgrounded by run_process() to simulate a
 # fork.  It includes the dirty work of closing extra filehandles and preparing log
 # files to produce the same logs as screen_it().  The log filename is derived
-# from the service name and global-and-now-misnamed ``SCREEN_LOGDIR``
-# Uses globals ``CURRENT_LOG_TIME``, ``SCREEN_LOGDIR``, ``SCREEN_NAME``, ``SERVICE_DIR``
+# from the service name.
+# Uses globals ``CURRENT_LOG_TIME``, ``LOGDIR``, ``SCREEN_LOGDIR``, ``SCREEN_NAME``, ``SERVICE_DIR``
 # If an optional group is provided sg will be used to set the group of
 # the command.
 # _run_process service "command-line" [group]
@@ -1277,9 +1277,14 @@ function _run_process {
     exec 3>&-
     exec 6>&-
 
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        exec 1>&${SCREEN_LOGDIR}/screen-${service}.log.${CURRENT_LOG_TIME} 2>&1
-        ln -sf ${SCREEN_LOGDIR}/screen-${service}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${service}.log
+    local real_logfile="${LOGDIR}/${service}.log.${CURRENT_LOG_TIME}"
+    if [[ -n ${LOGDIR} ]]; then
+        exec 1>&"$real_logfile" 2>&1
+        ln -sf "$real_logfile" ${LOGDIR}/${service}.log
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+        fi
 
         # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
         export PYTHONUNBUFFERED=1
@@ -1343,7 +1348,7 @@ function run_process {
 }
 
 # Helper to launch a process in a named screen
-# Uses globals ``CURRENT_LOG_TIME``, ``SCREEN_NAME``, ``SCREEN_LOGDIR``,
+# Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
 # ``SERVICE_DIR``, ``USE_SCREEN``
 # screen_process name "command-line" [group]
 # Run a command in a shell in a screen window, if an optional group
@@ -1362,10 +1367,18 @@ function screen_process {
 
     screen -S $SCREEN_NAME -X screen -t $name
 
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        screen -S $SCREEN_NAME -p $name -X logfile ${SCREEN_LOGDIR}/screen-${name}.log.${CURRENT_LOG_TIME}
+    local real_logfile="${LOGDIR}/${name}.log.${CURRENT_LOG_TIME}"
+    echo "LOGDIR: $LOGDIR"
+    echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
+    echo "log: $real_logfile"
+    if [[ -n ${LOGDIR} ]]; then
+        screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
         screen -S $SCREEN_NAME -p $name -X log on
-        ln -sf ${SCREEN_LOGDIR}/screen-${name}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${name}.log
+        ln -sf "$real_logfile" ${LOGDIR}/${name}.log
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${1}.log
+        fi
     fi
 
     # sleep to allow bash to be ready to be send the command - we are
@@ -1410,8 +1423,8 @@ function screen_rc {
         echo "screen -t $1 bash" >> $SCREENRC
         echo "stuff \"$2$NL\"" >> $SCREENRC
 
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            echo "logfile ${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
+        if [[ -n ${LOGDIR} ]]; then
+            echo "logfile ${LOGDIR}/${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
             echo "log on" >>$SCREENRC
         fi
     fi
diff --git a/lib/dstat b/lib/dstat
index a17125fc92..d1db469aa6 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -27,8 +27,12 @@ DSTAT_FILE=${DSTAT_FILE:-"dstat.log"}
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        screen_it dstat "cd $TOP_DIR; dstat $DSTAT_OPTS | tee $SCREEN_LOGDIR/$DSTAT_FILE"
+    if [[ -n ${LOGDIR} ]]; then
+        screen_it dstat "cd $TOP_DIR; dstat $DSTAT_OPTS | tee $LOGDIR/$DSTAT_FILE"
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf $LOGDIR/$DSTAT_FILE ${SCREEN_LOGDIR}/$DSTAT_FILE
+        fi
     else
         screen_it dstat "dstat $DSTAT_OPTS"
     fi
diff --git a/stack.sh b/stack.sh
index aeaaf6072c..558b07eb07 100755
--- a/stack.sh
+++ b/stack.sh
@@ -373,10 +373,8 @@ fi
 # Append '.xxxxxxxx' to the given name to maintain history
 # where 'xxxxxxxx' is a representation of the date the file was created
 TIMESTAMP_FORMAT=${TIMESTAMP_FORMAT:-"%F-%H%M%S"}
-if [[ -n "$LOGFILE" || -n "$SCREEN_LOGDIR" ]]; then
-    LOGDAYS=${LOGDAYS:-7}
-    CURRENT_LOG_TIME=$(date "+$TIMESTAMP_FORMAT")
-fi
+LOGDAYS=${LOGDAYS:-7}
+CURRENT_LOG_TIME=$(date "+$TIMESTAMP_FORMAT")
 
 if [[ -n "$LOGFILE" ]]; then
     # Clean up old log files.  Append '.*' to the user-specified
@@ -428,6 +426,7 @@ fi
 # ``screen-$SERVICE_NAME-$TIMESTAMP.log`` in that dir and have a link
 # ``screen-$SERVICE_NAME.log`` to the latest log file.
 # Logs are kept for as long specified in ``LOGDAYS``.
+# This is deprecated....logs go in ``LOGDIR``, only symlinks will be here now.
 if [[ -n "$SCREEN_LOGDIR" ]]; then
 
     # We make sure the directory is created.
diff --git a/stackrc b/stackrc
index 2dd56e8104..ff821401d7 100644
--- a/stackrc
+++ b/stackrc
@@ -705,6 +705,53 @@ USE_SSL=$(trueorfalse False USE_SSL)
 
 # Following entries need to be last items in file
 
+# Compatibility bits required by other callers like Grenade
+
+# Old way was using SCREEN_LOGDIR to locate those logs and LOGFILE for the stack.sh trace log.
+# LOGFILE       SCREEN_LOGDIR       output
+# not set       not set             no log files
+# set           not set             stack.sh log to LOGFILE
+# not set       set                 screen logs to SCREEN_LOGDIR
+# set           set                 stack.sh log to LOGFILE, screen logs to SCREEN_LOGDIR
+
+# New way is LOGDIR for all logs and LOGFILE for stack.sh trace log, but if not fully-qualified will be in LOGDIR
+# LOGFILE       LOGDIR              output
+# not set       not set             (new) set LOGDIR from default
+# set           not set             stack.sh log to LOGFILE, (new) set LOGDIR from LOGFILE
+# not set       set                 screen logs to LOGDIR
+# set           set                 stack.sh log to LOGFILE, screen logs to LOGDIR
+
+# For compat, if SCREEN_LOGDIR is set, it will be used to create back-compat symlinks to the LOGDIR
+# symlinks to SCREEN_LOGDIR (compat)
+
+
+# Set up new logging defaults
+if [[ -z "${LOGDIR:-}" ]]; then
+    default_logdir=$DEST/logs
+    if [[ -z "${LOGFILE:-}" ]]; then
+        # Nothing is set, we need a default
+        LOGDIR="$default_logdir"
+    else
+        # Set default LOGDIR
+        LOGDIR="${LOGFILE%/*}"
+        logfile="${LOGFILE##*/}"
+        if [[ -z "$LOGDIR" || "$LOGDIR" == "$logfile" ]]; then
+            # LOGFILE had no path, set a default
+            LOGDIR="$default_logdir"
+        fi
+
+        # Check for duplication
+        if [[ "${SCREEN_LOGDIR:-}" == "${LOGDIR}" ]]; then
+            # We don't need the symlinks since it's the same directory
+            unset SCREEN_LOGDIR
+        fi
+    fi
+    unset default_logdir logfile
+fi
+
+# LOGDIR is always set at this point so it is not useful as a 'enable' for service logs
+# SCREEN_LOGDIR may be set, it is useful to enable the compat symlinks
+
 # Local variables:
 # mode: shell-script
 # End:

From e9a96ea8855574b157d336c51ff876d1c76ae620 Mon Sep 17 00:00:00 2001
From: Jakub Libosvar <libosvar@redhat.com>
Date: Wed, 21 Jan 2015 16:08:12 +0100
Subject: [PATCH 0261/3333] Use openstackclient>=1.0.2

After changing usage of "openstack role" [1] python-openstackclient
stoppped working with 1.0.1 and less. This patch bumps version to use at
least 1.0.2v.

[1] https://review.openstack.org/#/c/148361

Change-Id: I2fdca28ae97a215cff5e2a6dd7cab2d3321caa6c
Closes-bug: 1413252
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index aeaaf6072c..4602b0b7d8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -748,7 +748,7 @@ if use_library_from_git "python-openstackclient"; then
     git_clone_by_name "python-openstackclient"
     setup_dev_lib "python-openstackclient"
 else
-    pip_install 'python-openstackclient>=1.0.0'
+    pip_install 'python-openstackclient>=1.0.2'
 fi
 
 

From ff72c5050e23cf7a68f9b3929180959aff5c522e Mon Sep 17 00:00:00 2001
From: Ed Cranford <ed.cranford@rackspace.com>
Date: Wed, 21 Jan 2015 16:42:42 -0600
Subject: [PATCH 0262/3333] Fixes SCREEN_HARDSTATUS default value

If SCREEN_HARDSTATUS is null, default it to "", not ":".

Change-Id: I52d4eb6bb494cca995e33971d5f1eec953d484fd
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index aeaaf6072c..4eed4ca23e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -916,7 +916,7 @@ if [[ "$USE_SCREEN" == "True" ]]; then
     sleep 1
 
     # Set a reasonable status bar
-    SCREEN_HARDSTATUS=${SCREEN_HARDSTATUS-:}
+    SCREEN_HARDSTATUS=${SCREEN_HARDSTATUS:-}
     if [ -z "$SCREEN_HARDSTATUS" ]; then
         SCREEN_HARDSTATUS='%{= .} %-Lw%{= .}%> %n%f %t*%{= .}%+Lw%< %-=%{g}(%{d}%H/%l%{g})'
     fi

From 2548e6f290b90c790fd055bef03ee60d97a1eb26 Mon Sep 17 00:00:00 2001
From: Zhongyue Luo <zhongyue.nah@intel.com>
Date: Thu, 18 Dec 2014 15:57:31 +0800
Subject: [PATCH 0263/3333] Provider network subnets based on IP version

Subnets for both IP version 4 and 6 are created even if IP_VERSION is set to 4.
Added two if statements to only create subnets that are nessesary.

Change-Id: I87c97741808726a260c846db48c10931e8991a74
---
 lib/neutron | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 3c6b0dbafc..954a2d9524 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -538,8 +538,15 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
         NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-        SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+        fi
+
         sudo ip link set $OVS_PHYSICAL_BRIDGE up
         sudo ip link set br-int up
         sudo ip link set $PUBLIC_INTERFACE up

From f5b415425199c3496872849a3ada08e5a821b36b Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 22 Jan 2015 07:57:37 -0500
Subject: [PATCH 0264/3333] Switch on curl retry options for fetching
 get-pip.py

Let's retry a few times before giving up.

Related-Bug: #1413034

Change-Id: I7c5c1a3936b5c08c5de43edc569b5a53d11b55a7
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index d57a687ecc..73d0947320 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -43,7 +43,7 @@ function get_versions {
 
 function install_get_pip {
     if [[ ! -r $LOCAL_PIP ]]; then
-        curl -o $LOCAL_PIP $PIP_GET_PIP_URL || \
+        curl --retry 6 --retry-delay 5 -o $LOCAL_PIP $PIP_GET_PIP_URL || \
             die $LINENO "Download of get-pip.py failed"
     fi
     sudo -H -E python $LOCAL_PIP

From c1dbf10562796c7006fd0a66c6cb39a1b990c8c1 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 22 Jan 2015 14:09:00 +0000
Subject: [PATCH 0265/3333] Exit after printing error about RPC config

When finding an invalid RPC configuration, devstack prints
a suitable error in the logs

    ERROR: only one rpc backend may be enabled,
           set only one of 'rabbit', 'qpid', 'zeromq'
           via ENABLED_SERVICES.

but then just carries on running, as a result the developer
is very unlikely to ever see the original error message.
Change the 'echo' to a 'die' so that it stop immediately
making the error message clearly visible.

Change-Id: If108f314e1ad2ecc79f41cbca47d08c4024a23cd
---
 lib/rpc_backend | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index d87d6207b1..98be1844b6 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -54,13 +54,15 @@ function check_rpc_backend {
         (( rpc_backend_cnt++ )) || true
     done
     if [ "$rpc_backend_cnt" -gt 1 ]; then
-        echo "ERROR: only one rpc backend may be enabled,"
-        echo "       set only one of 'rabbit', 'qpid', 'zeromq'"
-        echo "       via ENABLED_SERVICES."
+        die $LINENO \
+            "Only one rpc backend may be enabled, " \
+            "set only one of 'rabbit', 'qpid', 'zeromq' " \
+            "via ENABLED_SERVICES."
     elif [ "$rpc_backend_cnt" == 0 ] && [ "$rpc_needed" == 0 ]; then
-        echo "ERROR: at least one rpc backend must be enabled,"
-        echo "       set one of 'rabbit', 'qpid', 'zeromq'"
-        echo "       via ENABLED_SERVICES."
+        die $LINENO \
+            "at least one rpc backend must be enabled, " \
+            "set one of 'rabbit', 'qpid', 'zeromq'" \
+            "via ENABLED_SERVICES."
     fi
 
     if is_service_enabled qpid && ! qpid_is_supported; then

From 2d7c346f0c8cefe622edc8fed47cc2782aeb9a9b Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 22 Jan 2015 14:37:04 +0000
Subject: [PATCH 0266/3333] Exit when printing error about database config

When finding no configured database, devstack prints
a suitable error in the logs

   "No database enabled"

but then just carries on running, as a result the developer
is very unlikely to ever see the original error message.
Change the 'echo' to a 'die' so that it stop immediately
making the error message clearly visible.

Change-Id: Ibd86bfcb5d4a3b90a1ee7a5bd637b01124e3a6ba
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 4602b0b7d8..b03cca8c51 100755
--- a/stack.sh
+++ b/stack.sh
@@ -606,7 +606,7 @@ function read_password {
 # The available database backends are listed in ``DATABASE_BACKENDS`` after
 # ``lib/database`` is sourced. ``mysql`` is the default.
 
-initialize_database_backends && echo "Using $DATABASE_TYPE database backend" || echo "No database enabled"
+initialize_database_backends && echo "Using $DATABASE_TYPE database backend" || die $LINENO "No database enabled"
 
 
 # Queue Configuration

From 1f3f4b0a69a70bb5fce0707a517d67c896c3cf2c Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Wed, 14 Jan 2015 10:52:03 +0000
Subject: [PATCH 0267/3333] Check dib is available before building heat test
 image

When running with HEAT_CREATE_TEST_IMAGE=True, it's necessary
to add dib to ENABLED_SERVICES, or the image building will fail
so check for is_service_enabled dib before we start and error
with a helpful message if it's not.

Change-Id: Ia7ee64f6f8dd628267e485a1dc67581d8896d19c
---
 lib/heat | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/lib/heat b/lib/heat
index 9a28af568b..c9a3f7e6e2 100644
--- a/lib/heat
+++ b/lib/heat
@@ -10,6 +10,7 @@
 # Dependencies:
 #
 # - functions
+# - dib (if HEAT_CREATE_TEST_IMAGE=True)
 
 # stack.sh
 # ---------
@@ -290,19 +291,25 @@ function create_heat_accounts {
 
 # build_heat_functional_test_image() - Build and upload functional test image
 function build_heat_functional_test_image {
-    build_dib_pip_repo "$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
-    local image_name=heat-functional-tests-image
-
-    # The elements to invoke disk-image-create with
-    local image_elements="vm fedora selinux-permissive pypi \
-        os-collect-config os-refresh-config os-apply-config heat-cfntools \
-        heat-config heat-config-cfn-init heat-config-puppet heat-config-script"
-
-    # Elements path for tripleo-image-elements and heat-templates software-config
-    local elements_path=$TIE_DIR/elements:$HEAT_TEMPLATES_REPO_DIR/hot/software-config/elements
-
-    disk_image_create_upload "$image_name" "$image_elements" "$elements_path"
-    iniset $TEMPEST_CONFIG orchestration image_ref $image_name
+    if is_service_enabled dib; then
+        build_dib_pip_repo "$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
+        local image_name=heat-functional-tests-image
+
+        # The elements to invoke disk-image-create with
+        local image_elements="vm fedora selinux-permissive pypi \
+            os-collect-config os-refresh-config os-apply-config heat-cfntools \
+            heat-config heat-config-cfn-init heat-config-puppet heat-config-script"
+
+        # Elements path for tripleo-image-elements and heat-templates software-config
+        local elements_path=$TIE_DIR/elements:$HEAT_TEMPLATES_REPO_DIR/hot/software-config/elements
+
+        disk_image_create_upload "$image_name" "$image_elements" "$elements_path"
+        iniset $TEMPEST_CONFIG orchestration image_ref $image_name
+    else
+        echo "Error, HEAT_CREATE_TEST_IMAGE=True requires dib" >&2
+        echo "Add \"enable_service dib\" to your localrc" >&2
+        exit 1
+    fi
 }
 
 # Restore xtrace

From 0b9e76f280208b5b5ad54bb6fbc4133e63037286 Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith@solidfire.com>
Date: Wed, 21 Jan 2015 13:46:59 -0700
Subject: [PATCH 0268/3333] Auto add a cinder lvm.conf file

We have a number of issues where LVM scan commands hang during
test runs.  Looking closer at this with strace it turns out
that what seems to be happening is that we're scanning all of the
devices on the node, this includes the loop devices for swift and
other projects as well as the Cinder devices that are being attached
to the system during the test.

This is particularly messy for example when we issue a VG or LV scan
on a device like /dev/vdb and at the same time issue a detach.  The
result is LVM scan commands hanging waiting for timeout.

This patch adds a function to the cinder_backend/lvm module which
is called as the last part of cinder init.  If Cinder LVM is in use
as per cinder.conf this function will copy the default
/etc/lvm/lvm.conf to /etc/cinder/lvm.conf and use the cinder.conf file
and PVS to create filters so that ONLY the devices actually being used
by Cinder are included in scans.

There are two pieces to this fix; the first is to properly setup an
lvm.conf file with filters.  The second step is to merge the Cinder
change that modifies the Cinder LVM commands to specify the lvm.conf
file usage.

The Cinder part of this fix can be found here:
    https://review.openstack.org/#/c/148747/

Change-Id: I962b6e21cbfb6f5612b6c973053d86828ca8071a
Partial-Bug: #1373513
---
 lib/cinder              | 17 +++++++++++++++++
 lib/cinder_backends/lvm | 30 ++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 6eee880fef..6043891164 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -395,15 +395,32 @@ function init_cinder {
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local be be_name be_type
+        local has_lvm=0
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_type=${be%%:*}
             be_name=${be##*:}
+
+            if [[ $be_type == 'lvm' ]]; then
+                has_lvm=1
+            fi
+
             if type init_cinder_backend_${be_type} >/dev/null 2>&1; then
                 init_cinder_backend_${be_type} ${be_name}
             fi
         done
     fi
 
+    # Keep it simple, set a marker if there's an LVM backend
+    # use the created VG's to setup lvm filters
+    if [[ $has_lvm == 1 ]]; then
+        # Order matters here, not only obviously to make
+        # sure the VG's are created, but also some distros
+        # do some customizations to lvm.conf on init, we
+        # want to make sure we copy those over
+        sudo cp /etc/lvm/lvm.conf /etc/cinder/lvm.conf
+        configure_cinder_backend_conf_lvm
+    fi
+
     mkdir -p $CINDER_STATE_PATH/volumes
     create_cinder_cache_dir
 }
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 43e13e4dac..8aee2a99ef 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -19,6 +19,7 @@
 # clean_cinder_backend_lvm - called from clean_cinder()
 # configure_cinder_backend_lvm - called from configure_cinder()
 # init_cinder_backend_lvm - called from init_cinder()
+# configure_cinder_backend_conf_lvm - called from configure_cinder()
 
 
 # Save trace setting
@@ -64,6 +65,35 @@ function init_cinder_backend_lvm {
     init_lvm_volume_group $VOLUME_GROUP_NAME-$be_name $VOLUME_BACKING_FILE_SIZE
 }
 
+# configure_cinder_backend_conf_lvm - Sets device filter in /etc/cinder/lvm.conf
+# init_cinder_backend_lvm
+function configure_cinder_backend_conf_lvm {
+    local filter_suffix='"r/.*/" ]'
+    local filter_string="filter = [ "
+    local conf_entries=$(grep volume_group /etc/cinder/cinder.conf | sed "s/ //g")
+    local pv
+    local vg
+    local line
+
+    for pv_info in $(sudo pvs --noheadings -o name,vg_name --separator ';'); do
+        IFS=';' read pv vg <<< $pv_info
+        for line in ${conf_entries}; do
+            IFS='=' read label group <<< $line
+            group=$(echo $group|sed "s/^ *//g")
+            if [[ "$vg" == "$group" ]]; then
+                new="\"a$pv/\", "
+                filter_string=$filter_string$new
+            fi
+        done
+    done
+    filter_string=$filter_string$filter_suffix
+
+    # FIXME(jdg): Possible odd case that the lvm.conf file has been modified
+    # and doesn't have a filter entry to search/replace.  For devstack don't
+    # know that we care, but could consider adding a check and add
+    sudo sed -i "s#^[ \t]*filter.*#    $filter_string#g" /etc/cinder/lvm.conf
+    echo "set LVM filter_strings: $filter_string"
+}
 # Restore xtrace
 $MY_XTRACE
 

From bbe771a8d0682dbf85ecd18f9da071c40886fe7c Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 20 Jan 2015 13:30:33 -0500
Subject: [PATCH 0269/3333] Add bash completion for OSC

use openstackclient to generate bash completion script, and move
the file to the right location.

Change-Id: I96f2230cbba030e235161165d3b173c7af5e28fe
---
 stack.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/stack.sh b/stack.sh
index 585d1ceaf6..37b4e2853f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1312,6 +1312,13 @@ fi
 service_check
 
 
+# Bash completion
+# ===============
+
+# Prepare bash completion for OSC
+openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+
+
 # Fin
 # ===
 

From a0126b642c6021310798762342139dc41614697b Mon Sep 17 00:00:00 2001
From: Mike Perez <thingee@gmail.com>
Date: Thu, 22 Jan 2015 08:25:59 -0800
Subject: [PATCH 0270/3333] Use LVMVolumeDriver instead of LVMISCSIDriver

The Cinder LVMISCSIDriver is now deprecated. As a result, default
settings in devstack are giving warnings in the Cinder volume serivce.
The LVMVolumeDriver now handles all cases, by looking at the
iscsi_helper. This will use that driver instead, which will stop the
deprecation warnings.

Closes-bug: #1413761
Change-Id: Ifbb9ce45694095ff9e30f3ca4c3859a07de8df73
---
 lib/cinder_backends/lvm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 43e13e4dac..f210578339 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -47,8 +47,9 @@ function configure_cinder_backend_lvm {
     local be_name=$1
 
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
-    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMISCSIDriver"
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
+    iniset $CINDER_CONF $be_name iscsi_helper "tgtadm"
 
     if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
         iniset $CINDER_CONF $be_name volume_clear none

From 529f8113c2d93c85bbede7041cde1b455bc2119f Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Fri, 23 Jan 2015 03:10:49 -0800
Subject: [PATCH 0271/3333] Fix oslo_messaging package and related object names

Use the latest oslo_messaging package and the related driver names.

Change-Id: I20d4c9286cd2216aa238705f00d8f4537ed91234
---
 lib/rpc_backend | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index d87d6207b1..981b80b405 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -243,7 +243,7 @@ function iniset_rpc_backend {
     if is_service_enabled zeromq; then
         iniset $file $section rpc_backend "zmq"
         iniset $file $section rpc_zmq_matchmaker \
-            oslo.messaging._drivers.matchmaker_redis.MatchMakerRedis
+            oslo_messaging._drivers.matchmaker_redis.MatchMakerRedis
         # Set MATCHMAKER_REDIS_HOST if running multi-node.
         MATCHMAKER_REDIS_HOST=${MATCHMAKER_REDIS_HOST:-127.0.0.1}
         iniset $file matchmaker_redis host $MATCHMAKER_REDIS_HOST
@@ -252,7 +252,7 @@ function iniset_rpc_backend {
         if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
             iniset $file $section rpc_backend "amqp"
         else
-            iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_qpid
+            iniset $file $section rpc_backend "qpid"
         fi
         iniset $file $section qpid_hostname ${QPID_HOST:-$SERVICE_HOST}
         if [ -n "$QPID_USERNAME" ]; then
@@ -260,7 +260,7 @@ function iniset_rpc_backend {
             iniset $file $section qpid_password $QPID_PASSWORD
         fi
     elif is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
-        iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_kombu
+        iniset $file $section rpc_backend "rabbit"
         iniset $file $section rabbit_hosts $RABBIT_HOST
         iniset $file $section rabbit_password $RABBIT_PASSWORD
         iniset $file $section rabbit_userid $RABBIT_USERID

From 3163c17170b0b2bd7775e5e0d50040504b559ea1 Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Fri, 23 Jan 2015 13:26:29 +0000
Subject: [PATCH 0272/3333] Make elements for heat test image configurable

Allow the elements built into the heat functional test image to
be overridden via the localrc, allows easier testing of local
images with different/additional elements.

Change-Id: Ibaf2322e0572d25461579bbb2dc8a18858f4e09c
---
 lib/heat | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/heat b/lib/heat
index c9a3f7e6e2..ed5d834460 100644
--- a/lib/heat
+++ b/lib/heat
@@ -47,6 +47,11 @@ HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
 HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
+HEAT_FUNCTIONAL_IMAGE_ELEMENTS=${HEAT_FUNCTIONAL_IMAGE_ELEMENTS:-\
+vm fedora selinux-permissive pypi  os-collect-config os-refresh-config \
+os-apply-config heat-cfntools heat-config heat-config-cfn-init \
+heat-config-puppet heat-config-script}
+
 
 # other default options
 HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
@@ -295,15 +300,10 @@ function build_heat_functional_test_image {
         build_dib_pip_repo "$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
         local image_name=heat-functional-tests-image
 
-        # The elements to invoke disk-image-create with
-        local image_elements="vm fedora selinux-permissive pypi \
-            os-collect-config os-refresh-config os-apply-config heat-cfntools \
-            heat-config heat-config-cfn-init heat-config-puppet heat-config-script"
-
         # Elements path for tripleo-image-elements and heat-templates software-config
         local elements_path=$TIE_DIR/elements:$HEAT_TEMPLATES_REPO_DIR/hot/software-config/elements
 
-        disk_image_create_upload "$image_name" "$image_elements" "$elements_path"
+        disk_image_create_upload "$image_name" "$HEAT_FUNCTIONAL_IMAGE_ELEMENTS" "$elements_path"
         iniset $TEMPEST_CONFIG orchestration image_ref $image_name
     else
         echo "Error, HEAT_CREATE_TEST_IMAGE=True requires dib" >&2

From 905275ec9f51614911fbb915f8bba9896b3ab684 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Sat, 24 Jan 2015 19:21:34 -0500
Subject: [PATCH 0273/3333] Bump up the count of workers for heat

Looks like the workers is set to 0 which in heat is used
mainly for profiling/debugging and not really useful in
the devstack scenarios.
https://github.com/openstack/heat/blob/master/heat/common/wsgi.py#L286

Partial-Bug: #1412923
Change-Id: Iccf6aeffd461fdc1f78022cbda370be4b9573267
---
 lib/heat | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/heat b/lib/heat
index 9a28af568b..ad9148ab64 100644
--- a/lib/heat
+++ b/lib/heat
@@ -133,6 +133,7 @@ function configure_heat {
 
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
+    iniset $HEAT_CONF heat_api workers "$API_WORKERS"
 
     # Cloudformation API
     iniset $HEAT_CONF heat_api_cfn bind_port $HEAT_API_CFN_PORT

From f35e95706c42f98336059c2177261a77b55427a9 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 26 Jan 2015 14:13:02 +0000
Subject: [PATCH 0274/3333] XenAPI: Replace remaining instances of
 'devstack.succeeded'

Commit I05990c7154366350b0f9cc3e6c70d6f34238486f was incomplete
and left two references to the, now replaced, devstack.succeeded.

The impact of this is that the XVA always claims that devstack failed
to run when actually the run may have been successful

Change-Id: Ie4ac673011d77a9edc8923db94d914efe9f45d5d
---
 tools/xen/build_xva.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
index 7002e6e22e..25bf58cb8a 100755
--- a/tools/xen/build_xva.sh
+++ b/tools/xen/build_xva.sh
@@ -104,7 +104,7 @@ console output
 task
 
 pre-start script
-    rm -f /var/run/devstack.succeeded
+    rm -f /opt/stack/runsh.succeeded
 end script
 
 script
@@ -127,7 +127,7 @@ script
         IPADDR=\$(ip -4 address show eth0 | sed -n 's/.*inet \\([0-9\.]\\+\\).*/\1/p')
         echo "  Management IP:   \$IPADDR"
         echo -n "  Devstack run:    "
-        if [ -e /var/run/devstack.succeeded ]; then
+        if [ -e /opt/stack/runsh.succeeded ]; then
             echo "SUCCEEDED"
         else
             echo "FAILED"

From 55383f1a9bb2538b3e6add6dd9bf38080b910492 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 26 Jan 2015 18:06:33 +0100
Subject: [PATCH 0275/3333] Do not install wsgiref for glance

wsgiref is not used by glance.

Change-Id: I5085e6418ca3cea2549b1b5d8a5877445b10c4a7
Related-Bug: #1255826
---
 files/debs/glance      | 1 -
 files/rpms-suse/glance | 1 -
 files/rpms/glance      | 1 -
 3 files changed, 3 deletions(-)

diff --git a/files/debs/glance b/files/debs/glance
index 15e09aad4d..8db8145935 100644
--- a/files/debs/glance
+++ b/files/debs/glance
@@ -7,7 +7,6 @@ python-eventlet
 python-routes
 python-greenlet
 python-sqlalchemy
-python-wsgiref
 python-pastedeploy
 python-xattr
 python-iso8601
diff --git a/files/rpms-suse/glance b/files/rpms-suse/glance
index edd1564e92..9b962f9643 100644
--- a/files/rpms-suse/glance
+++ b/files/rpms-suse/glance
@@ -8,5 +8,4 @@ python-eventlet
 python-greenlet
 python-iso8601
 python-pyOpenSSL
-python-wsgiref
 python-xattr
diff --git a/files/rpms/glance b/files/rpms/glance
index d2792cf987..acf0cc394b 100644
--- a/files/rpms/glance
+++ b/files/rpms/glance
@@ -10,6 +10,5 @@ python-lxml         #dist:f19,f20,f21,rhel7
 python-paste-deploy #dist:f19,f20,f21,rhel7
 python-routes
 python-sqlalchemy
-python-wsgiref      #dist:f18,f19,f20,f21
 pyxattr
 zlib-devel          # testonly

From 8874115668427b9d60bb65cbe3670d01d3f7eb14 Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Tue, 23 Dec 2014 13:13:05 +1300
Subject: [PATCH 0276/3333] Define extra_elements inside
 disk_image_create_upload

This avoids the need to define a global variable,
and tolerates extra_elements not being set when bash
flag -u is set.

Change-Id: I343951a678bed9ca3cda347a9c902e60c7b70e2d
---
 lib/dib | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/dib b/lib/dib
index 809217bc93..88d9fd8434 100644
--- a/lib/dib
+++ b/lib/dib
@@ -35,15 +35,6 @@ OCC_DIR=$DEST/os-collect-config
 ORC_DIR=$DEST/os-refresh-config
 OAC_DIR=$DEST/os-apply-config
 
-# Include the apt-sources element in builds if we have an
-# alternative sources.list specified.
-if [ -n "$DIB_APT_SOURCES" ]; then
-    if [ ! -e "$DIB_APT_SOURCES" ]; then
-        die $LINENO "DIB_APT_SOURCES set but not found at $DIB_APT_SOURCES"
-    fi
-    EXTRA_ELEMENTS="apt-sources"
-fi
-
 # Functions
 # ---------
 
@@ -106,6 +97,15 @@ function disk_image_create_upload {
 
     local image_path=$TOP_DIR/files/$image_name.qcow2
 
+    # Include the apt-sources element in builds if we have an
+    # alternative sources.list specified.
+    if [ -n "$DIB_APT_SOURCES" ]; then
+        if [ ! -e "$DIB_APT_SOURCES" ]; then
+            die $LINENO "DIB_APT_SOURCES set but not found at $DIB_APT_SOURCES"
+        fi
+        local extra_elements="apt-sources"
+    fi
+
     # Set the local pip repo as the primary index mirror so the
     # image is built with local packages
     local pypi_mirror_url=http://$SERVICE_HOST:$DIB_PIP_REPO_PORT/
@@ -127,7 +127,7 @@ function disk_image_create_upload {
     DIB_OFFLINE=$DIB_BUILD_OFFLINE \
     PYPI_MIRROR_URL=$pypi_mirror_url \
     PYPI_MIRROR_URL_1=$pypi_mirror_url_1 \
-    disk-image-create -a amd64 $image_elements $EXTRA_ELEMENTS \
+    disk-image-create -a amd64 $image_elements ${extra_elements:-} \
         --image-cache $DIB_IMAGE_CACHE \
         -o $image_path
 

From 1f316beb2052b715f077ef42279361026d1a24c3 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 26 Jan 2015 16:39:57 +0100
Subject: [PATCH 0277/3333] Remove rhel6 and py26 support

el6 is shipped with Python 2.6.x which is not expected
to be supported with the openstack kilo release.

For el6 support we need to do lot of thing differently,
which makes the code more complicated.

This change removes el6 and py26 support from devstack.

This change also removed a discontinued (1 year ago)
openSUSE 12.2 code path, which used a similar codepath as el6.

Several comment related to el6 also removed or modified.

Change-Id: Iea0b0c98a5e11fd85bb5e93c099f740fe05d2f3a
---
 doc/source/faq.rst                     |  7 +--
 files/apache-keystone.template         |  4 --
 files/patches/unittest2-discover.patch | 16 ------
 files/rpms/cinder                      |  2 +-
 files/rpms/general                     |  6 ---
 files/rpms/glance                      |  4 +-
 files/rpms/horizon                     |  4 +-
 files/rpms/keystone                    | 10 ++--
 files/rpms/neutron                     |  5 +-
 files/rpms/nova                        |  8 ++-
 files/rpms/swift                       |  2 +-
 lib/cinder                             | 20 +-------
 lib/databases/mysql                    | 32 +++---------
 lib/databases/postgresql               |  6 +--
 lib/horizon                            |  8 ---
 lib/nova_plugins/functions-libvirt     | 40 +++------------
 stack.sh                               | 38 +++-----------
 tools/fixup_stuff.sh                   | 69 ++------------------------
 18 files changed, 45 insertions(+), 236 deletions(-)
 delete mode 100644 files/patches/unittest2-discover.patch

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 92d794572e..f10c2eec36 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -24,7 +24,7 @@ Q: Then why selinux in enforcing mode?
     by packaging in "real" deployments. To remove additional protections
     that will be desired/required in production would be a step
     backward.
-Q: But selinux is disabled in RHEL 6!
+Q: But selinux is disabled in RHEL!
     A: Today it is, yes. That is a specific exception that certain
     DevStack contributors fought strongly against. The primary reason it
     was allowed was to support using RHEL6 as the Python 2.6 test
@@ -70,11 +70,6 @@ Q: What about Fedora/RHEL/CentOS?
 Q: Are there any differences between Ubuntu and Fedora support?
     A: Neutron is not fully supported prior to Fedora 18 due lack of
     OpenVSwitch packages.
-Q: How about RHEL 6?
-    A: RHEL 6 has Python 2.6 and many old modules packaged and is a
-    challenge to support. There are a number of specific RHEL6
-    work-arounds in ``stack.sh`` to handle this. But the testing on py26
-    is valuable so we do it...
 
 Operation and Configuration
 ===========================
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 2190d831c0..504dc01d21 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -32,7 +32,3 @@ Listen %ADMINPORT%
     %SSLCERTFILE%
     %SSLKEYFILE%
 </VirtualHost>
-
-# Workaround for missing path on RHEL6, see
-#  https://bugzilla.redhat.com/show_bug.cgi?id=1121019
-WSGISocketPrefix /var/run/%APACHE_NAME%
diff --git a/files/patches/unittest2-discover.patch b/files/patches/unittest2-discover.patch
deleted file mode 100644
index 347300d172..0000000000
--- a/files/patches/unittest2-discover.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff -r b2efb7df637b discover.py
---- a/discover.py	Thu Mar 24 00:31:02 2011 -0400
-+++ b/discover.py	Thu Nov 28 12:02:19 2013 +0000
-@@ -82,7 +82,11 @@
-     """
-     testMethodPrefix = 'test'
-     sortTestMethodsUsing = cmp
--    suiteClass = unittest.TestSuite
-+    try:
-+        import unittest2
-+        suiteClass = unittest2.TestSuite
-+    except ImportError:
-+        suiteClass = unittest.TestSuite
-     _top_level_dir = None
- 
-     def loadTestsFromTestCase(self, testCaseClass):
diff --git a/files/rpms/cinder b/files/rpms/cinder
index eedff184dd..082a35af32 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -3,4 +3,4 @@ scsi-target-utils
 qemu-img
 postgresql-devel
 iscsi-initiator-utils
-python-lxml         #dist:f19,f20,f21,rhel7
+python-lxml
diff --git a/files/rpms/general b/files/rpms/general
index ee7cc12cef..13c8a87780 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -13,7 +13,6 @@ libxml2-devel
 libxslt-devel
 psmisc
 pylint
-python-prettytable # dist:rhel6 [1]
 python-unittest2
 python-virtualenv
 python-devel
@@ -27,8 +26,3 @@ bc
 libyaml-devel
 gettext  # used for compiling message catalogs
 net-tools
-
-# [1] : some of installed tools have unversioned dependencies on this,
-# but others have versioned (<=0.7).  So if a later version (0.7.1)
-# gets installed in response to an unversioned dependency, it breaks.
-# This pre-installs a compatible 0.6(ish) version from RHEL
diff --git a/files/rpms/glance b/files/rpms/glance
index acf0cc394b..a09b669309 100644
--- a/files/rpms/glance
+++ b/files/rpms/glance
@@ -6,8 +6,8 @@ postgresql-devel    # testonly
 python-argparse
 python-eventlet
 python-greenlet
-python-lxml         #dist:f19,f20,f21,rhel7
-python-paste-deploy #dist:f19,f20,f21,rhel7
+python-lxml
+python-paste-deploy
 python-routes
 python-sqlalchemy
 pyxattr
diff --git a/files/rpms/horizon b/files/rpms/horizon
index 82385ed06c..585c36cfde 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -12,8 +12,8 @@ python-httplib2
 python-migrate
 python-mox
 python-nose
-python-paste        #dist:f19,f20,f21
-python-paste-deploy #dist:f19,f20,f21
+python-paste
+python-paste-deploy
 python-routes
 python-sqlalchemy
 python-webob
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 8b0953dd69..45492e0de6 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,10 +1,10 @@
 MySQL-python
 python-greenlet
-libxslt-devel       # dist:f20,f21
-python-lxml         #dist:f19,f20,f21
-python-paste        #dist:f19,f20,f21
-python-paste-deploy #dist:f19,f20,f21
-python-paste-script #dist:f19,f20,f21
+libxslt-devel
+python-lxml
+python-paste
+python-paste-deploy
+python-paste-script
 python-routes
 python-sqlalchemy
 python-webob
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 5450408a35..59152d6e93 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -12,9 +12,8 @@ openvswitch # NOPRIME
 python-eventlet
 python-greenlet
 python-iso8601
-#rhel6 gets via pip
-python-paste        # dist:f19,f20,f21,rhel7
-python-paste-deploy # dist:f19,f20,f21,rhel7
+python-paste
+python-paste-deploy
 python-qpid # NOPRIME
 python-routes
 python-sqlalchemy
diff --git a/files/rpms/nova b/files/rpms/nova
index 07f13c7071..557de908f1 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -29,11 +29,9 @@ python-iso8601
 python-lockfile
 python-migrate
 python-mox
-python-paramiko # dist:f19,f20,f21,rhel7
-# ^ on RHEL6, brings in python-crypto which conflicts with version from
-# pip we need
-python-paste        # dist:f19,f20,f21,rhel7
-python-paste-deploy # dist:f19,f20,f21,rhel7
+python-paramiko
+python-paste
+python-paste-deploy
 python-qpid # NOPRIME
 python-routes
 python-sqlalchemy
diff --git a/files/rpms/swift b/files/rpms/swift
index ccda22bcc8..0fcdb0fe27 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -6,7 +6,7 @@ python-eventlet
 python-greenlet
 python-netifaces
 python-nose
-python-paste-deploy # dist:f19,f20,f21,rhel7
+python-paste-deploy
 python-simplejson
 python-webob
 pyxattr
diff --git a/lib/cinder b/lib/cinder
index 6eee880fef..12bac8cb38 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -303,18 +303,6 @@ function configure_cinder {
         configure_cinder_driver
     fi
 
-    if is_fedora && [[ $DISTRO =~ (rhel6) ]]; then
-        # Cinder clones are slightly larger due to some extra
-        # metadata.  RHEL6 will not allow auto-extending of LV's
-        # without this, leading to clones giving hard-to-track disk
-        # I/O errors.
-        # see https://bugzilla.redhat.com/show_bug.cgi?id=975052
-        sudo sed -i~ \
-            -e 's/snapshot_autoextend_threshold =.*/snapshot_autoextend_threshold = 80/' \
-            -e 's/snapshot_autoextend_percent =.*/snapshot_autoextend_percent = 20/' \
-            /etc/lvm/lvm.conf
-    fi
-
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
     iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
@@ -446,12 +434,8 @@ function start_cinder {
         if is_ubuntu; then
             sudo service tgt restart
         elif is_fedora; then
-            if [[ $DISTRO =~ (rhel6) ]]; then
-                sudo /sbin/service tgtd restart
-            else
-                # bypass redirection to systemctl during restart
-                sudo /sbin/service --skip-redirect tgtd restart
-            fi
+            # bypass redirection to systemctl during restart
+            sudo /sbin/service --skip-redirect tgtd restart
         elif is_suse; then
             restart_service tgtd
         else
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 2f3b6d4123..72c0f82b4a 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -17,11 +17,7 @@ register_database mysql
 # Linux distros, thank you for being incredibly consistent
 MYSQL=mysql
 if is_fedora; then
-    if [[ $DISTRO =~ (rhel6) ]]; then
-        MYSQL=mysqld
-    else
-        MYSQL=mariadb
-    fi
+    MYSQL=mariadb
 fi
 
 # Functions
@@ -38,15 +34,9 @@ function cleanup_database_mysql {
         sudo rm -rf /etc/mysql
         return
     elif is_fedora; then
-        if [[ $DISTRO =~ (rhel6) ]]; then
-            stop_service mysqld
-            uninstall_package mysql-server
-            sudo rm -rf /var/lib/mysql
-        else
-            stop_service mariadb
-            uninstall_package mariadb-server
-            sudo rm -rf /var/lib/mysql
-        fi
+        stop_service mariadb
+        uninstall_package mariadb-server
+        sudo rm -rf /var/lib/mysql
     elif is_suse; then
         stop_service mysql
         uninstall_package mysql-community-server
@@ -70,11 +60,7 @@ function configure_database_mysql {
         my_conf=/etc/mysql/my.cnf
         mysql=mysql
     elif is_fedora; then
-        if [[ $DISTRO =~ (rhel6) ]]; then
-            mysql=mysqld
-        else
-            mysql=mariadb
-        fi
+        mysql=mariadb
         my_conf=/etc/my.cnf
     elif is_suse; then
         my_conf=/etc/my.cnf
@@ -110,7 +96,7 @@ function configure_database_mysql {
 
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"
-        if is_fedora && ! [[ $DISTRO =~ (rhel6) ]]; then
+        if is_fedora; then
             slow_log=/var/log/mariadb/mariadb-slow.log
         else
             slow_log=/var/log/mysql/mysql-slow.log
@@ -158,11 +144,7 @@ EOF
     fi
     # Install mysql-server
     if is_fedora; then
-        if [[ $DISTRO =~ (rhel6) ]]; then
-            install_package mysql-server
-        else
-            install_package mariadb-server
-        fi
+        install_package mariadb-server
     elif is_ubuntu; then
         install_package mysql-server
     elif is_suse; then
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index ad8cdc77a2..317e0ebf53 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -49,11 +49,7 @@ function configure_database_postgresql {
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
         pg_conf=/var/lib/pgsql/data/postgresql.conf
         if ! sudo [ -e $pg_hba ]; then
-            if ! [[ $DISTRO =~ (rhel6) ]]; then
-                sudo postgresql-setup initdb
-            else
-                sudo service postgresql initdb
-            fi
+            sudo postgresql-setup initdb
         fi
     elif is_ubuntu; then
         pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
diff --git a/lib/horizon b/lib/horizon
index aa70bd59eb..122d516673 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -72,14 +72,6 @@ function _horizon_config_set {
 # cleanup_horizon() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_horizon {
-    if is_fedora && [[ $DISTRO =~ (rhel6) ]]; then
-        # If ``/usr/bin/node`` points into ``$DEST``
-        # we installed it via ``install_nodejs``
-        if [[ $(readlink -f /usr/bin/node) =~ ($DEST) ]]; then
-            sudo rm /usr/bin/node
-        fi
-    fi
-
     local horizon_conf=$(apache_site_config_for horizon)
     sudo rm -f $horizon_conf
 }
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index c136e352df..4d617e8b5e 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -37,8 +37,7 @@ function install_libvirt {
 
     # Note there is a difference between F20 rackspace cloud images
     # and HP images used in the gate; rackspace has firewalld but hp
-    # cloud doesn't.  RHEL6 doesn't have firewalld either.  So we
-    # don't care if it fails.
+    # cloud doesn't.
     if is_fedora && is_package_installed firewalld; then
         sudo service firewalld restart || true
     fi
@@ -68,34 +67,12 @@ EOF
     fi
 
     if is_fedora || is_suse; then
-        if is_fedora && [[ $DISTRO =~ (rhel6) || "$os_RELEASE" -le "17" ]]; then
-            cat <<EOF | sudo tee /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
-[libvirt Management Access]
-Identity=unix-group:$LIBVIRT_GROUP
-Action=org.libvirt.unix.manage
-ResultAny=yes
-ResultInactive=yes
-ResultActive=yes
-EOF
-        elif is_suse && [[ $os_RELEASE = 12.2 || "$os_VENDOR" = "SUSE LINUX" ]]; then
-            # openSUSE < 12.3 or SLE
-            # Work around the fact that polkit-default-privs overrules pklas
-            # with 'unix-group:$group'.
-            cat <<EOF | sudo tee /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
-[libvirt Management Access]
-Identity=unix-user:$STACK_USER
-Action=org.libvirt.unix.manage
-ResultAny=yes
-ResultInactive=yes
-ResultActive=yes
-EOF
-        else
-            # Starting with fedora 18 and opensuse-12.3 enable stack-user to
-            # virsh -c qemu:///system by creating a policy-kit rule for
-            # stack-user using the new Javascript syntax
-            rules_dir=/etc/polkit-1/rules.d
-            sudo mkdir -p $rules_dir
-            cat <<EOF | sudo tee $rules_dir/50-libvirt-$STACK_USER.rules
+        # Starting with fedora 18 and opensuse-12.3 enable stack-user to
+        # virsh -c qemu:///system by creating a policy-kit rule for
+        # stack-user using the new Javascript syntax
+        rules_dir=/etc/polkit-1/rules.d
+        sudo mkdir -p $rules_dir
+        cat <<EOF | sudo tee $rules_dir/50-libvirt-$STACK_USER.rules
 polkit.addRule(function(action, subject) {
     if (action.id == 'org.libvirt.unix.manage' &&
         subject.user == '$STACK_USER') {
@@ -103,8 +80,7 @@ polkit.addRule(function(action, subject) {
     }
 });
 EOF
-            unset rules_dir
-        fi
+        unset rules_dir
     fi
 
     # The user that nova runs as needs to be member of **libvirtd** group otherwise
diff --git a/stack.sh b/stack.sh
index b03cca8c51..5c3c99b3ba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -152,7 +152,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f20|f21|rhel6|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f20|f21|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
@@ -221,7 +221,7 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-if is_fedora && [[ $DISTRO == "rhel6" || $DISTRO == "rhel7" ]]; then
+if is_fedora && [[ $DISTRO == "rhel7" ]]; then
     # RHEL requires EPEL for many Open Stack dependencies
 
     # note we always remove and install latest -- some environments
@@ -239,16 +239,10 @@ if is_fedora && [[ $DISTRO == "rhel6" || $DISTRO == "rhel7" ]]; then
     # $releasever directly in .repo file we create below.  However
     # RHEL gives a $releasever of "6Server" which breaks the path;
     # see https://bugzilla.redhat.com/show_bug.cgi?id=1150759
-    if [[ $DISTRO == "rhel7" ]]; then
-        epel_ver="7"
-    elif [[ $DISTRO == "rhel6" ]]; then
-        epel_ver="6"
-    fi
-
     cat <<EOF | sudo tee /etc/yum.repos.d/epel-bootstrap.repo
 [epel-bootstrap]
 name=Bootstrap EPEL
-mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-$epel_ver&arch=\$basearch
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-7&arch=\$basearch
 failovermethod=priority
 enabled=0
 gpgcheck=0
@@ -261,22 +255,10 @@ EOF
 
     # ... and also optional to be enabled
     is_package_installed yum-utils || install_package yum-utils
-    if [[ $DISTRO == "rhel7" ]]; then
-        OPTIONAL_REPO=rhel-7-server-optional-rpms
-    elif [[ $DISTRO == "rhel6" ]]; then
-        OPTIONAL_REPO=rhel-6-server-optional-rpms
-    fi
-    sudo yum-config-manager --enable ${OPTIONAL_REPO}
-
-    # Installing Open vSwitch on RHEL requires enabling the RDO repo.
-    # Note no juno packages for rhel6
-    if [[ $DISTRO == "rhel6" ]]; then
-        RHEL_RDO_REPO_RPM=${RHEL6_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-icehouse/rdo-release-icehouse-4.noarch.rpm"}
-        RHEL_RDO_REPO_ID=${RHEL6_RDO_REPO_ID:-"openstack-icehouse"}
-    elif [[ $DISTRO == "rhel7" ]]; then
-        RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-juno/rdo-release-juno-1.noarch.rpm"}
-        RHEL_RDO_REPO_ID=${RHEL7_RDO_REPO_ID:-"openstack-juno"}
-    fi
+    sudo yum-config-manager --enable rhel-7-server-optional-rpms
+
+    RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-juno/rdo-release-juno-1.noarch.rpm"}
+    RHEL_RDO_REPO_ID=${RHEL7_RDO_REPO_ID:-"openstack-juno"}
 
     if ! sudo yum repolist enabled $RHEL_RDO_REPO_ID | grep -q $RHEL_RDO_REPO_ID; then
         echo "RDO repo not detected; installing"
@@ -362,12 +344,6 @@ function echo_nolog {
     echo $@ >&3
 }
 
-if is_fedora && [ $DISTRO == "rhel6" ]; then
-    # poor old python2.6 doesn't have argparse by default, which
-    # outfilter.py uses
-    is_package_installed python-argparse || install_package python-argparse
-fi
-
 # Set up logging for ``stack.sh``
 # Set ``LOGFILE`` to turn on logging
 # Append '.xxxxxxxx' to the given name to maintain history
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index c7f1efa441..cc5275fe45 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -12,12 +12,10 @@
 # - httplib2 0.8 permissions are 600 in the package and
 #   pip 1.4 doesn't fix it (1.3 did)
 #
-# - RHEL6:
-#
+# - Fedora:
 #   - set selinux not enforcing
-#   - (re)start messagebus daemon
-#   - remove distro packages python-crypto and python-lxml
-#   - pre-install hgtools to work around a bug in RHEL6 distribute
+#   - uninstall firewalld (f20 only)
+
 
 # If TOP_DIR is set we're being sourced rather than running stand-alone
 # or in a sub-shell
@@ -125,64 +123,3 @@ if is_fedora; then
     fi
 
 fi
-
-# RHEL6
-# -----
-
-if [[ $DISTRO =~ (rhel6) ]]; then
-
-    # install_pip.sh installs the latest setuptools over the packaged
-    # version.  We can't really uninstall the packaged version if it
-    # is there, because it may remove other important things like
-    # cloud-init.  Things work, but there can be an old egg file left
-    # around from the package that causes some really strange
-    # setuptools errors.  Remove it, if it is there
-    sudo rm -f /usr/lib/python2.6/site-packages/setuptools-0.6*.egg-info
-
-    # If the ``dbus`` package was installed by DevStack dependencies the
-    # uuid may not be generated because the service was never started (PR#598200),
-    # causing Nova to stop later on complaining that ``/var/lib/dbus/machine-id``
-    # does not exist.
-    sudo service messagebus restart
-
-    # The following workarounds break xenserver
-    if [ "$VIRT_DRIVER" != 'xenserver' ]; then
-        # An old version of ``python-crypto`` (2.0.1) may be installed on a
-        # fresh system via Anaconda and the dependency chain
-        # ``cas`` -> ``python-paramiko`` -> ``python-crypto``.
-        # ``pip uninstall pycrypto`` will remove the packaged ``.egg-info``
-        # file but leave most of the actual library files behind in
-        # ``/usr/lib64/python2.6/Crypto``. Later ``pip install pycrypto``
-        # will install over the packaged files resulting
-        # in a useless mess of old, rpm-packaged files and pip-installed files.
-        # Remove the package so that ``pip install python-crypto`` installs
-        # cleanly.
-        # Note: other RPM packages may require ``python-crypto`` as well.
-        # For example, RHEL6 does not install ``python-paramiko packages``.
-        uninstall_package python-crypto
-
-        # A similar situation occurs with ``python-lxml``, which is required by
-        # ``ipa-client``, an auditing package we don't care about.  The
-        # build-dependencies needed for ``pip install lxml`` (``gcc``,
-        # ``libxml2-dev`` and ``libxslt-dev``) are present in
-        # ``files/rpms/general``.
-        uninstall_package python-lxml
-    fi
-
-    # ``setup.py`` contains a ``setup_requires`` package that is supposed
-    # to be transient.  However, RHEL6 distribute has a bug where
-    # ``setup_requires`` registers entry points that are not cleaned
-    # out properly after the setup-phase resulting in installation failures
-    # (bz#924038).  Pre-install the problem package so the ``setup_requires``
-    # dependency is satisfied and it will not be installed transiently.
-    # Note we do this before the track-depends in ``stack.sh``.
-    pip_install hgtools
-
-    # workaround for https://code.google.com/p/unittest-ext/issues/detail?id=79
-    install_package python-unittest2 patch
-    pip_install discover
-    (cd /usr/lib/python2.6/site-packages/; sudo patch <"$FILES/patches/unittest2-discover.patch" || echo 'Assume already applied')
-    # Make sure the discover.pyc is up to date
-    sudo rm /usr/lib/python2.6/site-packages/discover.pyc || true
-    sudo python -c 'import discover'
-fi

From a27b74cdf74a83ef2d197d026526211d12990228 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Thu, 18 Sep 2014 13:02:55 -0400
Subject: [PATCH 0278/3333] Ceph: wait for services to shutdown during cleanup

It can take ceph-osd and ceph-mon a few seconds to complete when
they are killed.  This races against the umount command in cleaup
and can often result in $CEPH_DATA_DIR failing to unmount since
it is still in use.

Wait for these processes to stop to ensure the mount point is
umounted successfully.

Change-Id: I1a635e75a68be6b14fbee52ff981b5f5a3a8eb0e
---
 lib/ceph | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index 77b5726df1..a6b8cc8b57 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -142,8 +142,8 @@ function cleanup_ceph_remote {
 }
 
 function cleanup_ceph_embedded {
-    sudo pkill -f ceph-mon
-    sudo pkill -f ceph-osd
+    sudo killall -w -9 ceph-mon
+    sudo killall -w -9 ceph-osd
     sudo rm -rf ${CEPH_DATA_DIR}/*/*
     if egrep -q ${CEPH_DATA_DIR} /proc/mounts; then
         sudo umount ${CEPH_DATA_DIR}

From c906bb38851037880f557b15ad30c9b0bb7fa295 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Mon, 1 Dec 2014 07:20:33 +0000
Subject: [PATCH 0279/3333] Make neutron the default in devstack

This changes the default devstack configuration to use Neutron instead of
nova-network.

Change-Id: Ia161695a8414cad751c3e66b985a78384a76890d
---
 stackrc | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/stackrc b/stackrc
index 2dd56e8104..ce54fae432 100644
--- a/stackrc
+++ b/stackrc
@@ -32,15 +32,11 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 # ``disable_service`` functions in ``local.conf``.
 # For example, to enable Swift add this to ``local.conf``:
 #  enable_service s-proxy s-object s-container s-account
-# In order to enable Neutron (a single node setup) add the following
-# settings in ``local.conf``:
+# In order to enable nova-networking add the following settings in
+# `` local.conf ``:
 #  [[local|localrc]]
-#  disable_service n-net
-#  enable_service q-svc
-#  enable_service q-agt
-#  enable_service q-dhcp
-#  enable_service q-l3
-#  enable_service q-meta
+#  disable_service q-svc q-agt q-dhcp q-l3 q-meta
+#  enable_service n-net
 #  # Optional, to enable tempest configuration as part of devstack
 #  enable_service tempest
 function isset {
@@ -54,14 +50,16 @@ function isset {
 
 # this allows us to pass ENABLED_SERVICES
 if ! isset ENABLED_SERVICES ; then
-    # core compute (glance / keystone / nova (+ nova-network))
-    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-xvnc,n-cauth
+    # core compute (glance / keystone / nova)
+    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch,n-xvnc,n-cauth
     # cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # heat
     ENABLED_SERVICES+=,h-eng,h-api,h-api-cfn,h-api-cw
     # dashboard
     ENABLED_SERVICES+=,horizon
+    # neutron
+    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
     # additional services
     ENABLED_SERVICES+=,rabbit,tempest,mysql
 fi

From c070a3dbb5c52fb9099bd6cec477ba3d0a75760a Mon Sep 17 00:00:00 2001
From: Maru Newby <marun@redhat.com>
Date: Tue, 27 Jan 2015 17:44:44 +0000
Subject: [PATCH 0280/3333] Init default lvm volume group only if required

A recent patch [1] added support for lvm ephemeral storage for nova,
but at the cost of initializing a default lvm volume group even if it
was not required.  This change ensures that init of the default volume
group is only performed when nova and/or cinder are configured to use
lvm.

1: https://review.openstack.org/#/c/132333

Change-Id: I7634ca0ed0ffe1b13464e4d66744918f85149f2e
Closes-Bug: #1414820
---
 lib/cinder |  4 ++++
 lib/lvm    | 19 +++++++++++++++++++
 lib/nova   |  4 ++++
 stack.sh   |  4 ----
 4 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 6eee880fef..03e2e28727 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -399,6 +399,10 @@ function init_cinder {
             be_type=${be%%:*}
             be_name=${be##*:}
             if type init_cinder_backend_${be_type} >/dev/null 2>&1; then
+                # Always init the default volume group for lvm.
+                if [[ "$be_type" == "lvm" ]]; then
+                    init_default_lvm_volume_group
+                fi
                 init_cinder_backend_${be_type} ${be_name}
             fi
         done
diff --git a/lib/lvm b/lib/lvm
index 4ef260d593..ed24487c5f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -117,6 +117,25 @@ function init_lvm_volume_group {
     _clean_lvm_volume_group $vg
 }
 
+# Sentinal value to ensure that init of default lvm volume group is
+# only performed once across calls of init_default_lvm_volume_group.
+_DEFAULT_LVM_INIT=${_DEFAULT_LVM_INIT:-0}
+
+# init_default_lvm_volume_group() initializes a default volume group
+# intended to be shared between cinder and nova.  It is idempotent;
+# the init of the default volume group is guaranteed to be performed
+# only once so that either or both of the dependent services can
+# safely call this function.
+#
+# Usage: init_default_lvm_volume_group()
+function init_default_lvm_volume_group {
+    if [[ "$_DEFAULT_LVM_INIT" = "0" ]]; then
+        init_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME $VOLUME_BACKING_FILE_SIZE
+        _DEFAULT_LVM_INIT=1
+    fi
+}
+
+
 # Restore xtrace
 $MY_XTRACE
 
diff --git a/lib/nova b/lib/nova
index 76212edc96..a4b1bb15dc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -640,6 +640,10 @@ function init_nova {
 
     create_nova_cache_dir
     create_nova_keys_dir
+
+    if [[ "$NOVA_BACKEND" == "LVM" ]]; then
+        init_default_lvm_volume_group
+    fi
 }
 
 # install_novaclient() - Collect source and prepare
diff --git a/stack.sh b/stack.sh
index b03cca8c51..db36367c07 100755
--- a/stack.sh
+++ b/stack.sh
@@ -939,10 +939,6 @@ init_service_check
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
-# Initialize default LVM volume group
-# -----------------------------------
-init_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME $VOLUME_BACKING_FILE_SIZE
-
 # Start Services
 # ==============
 

From 18f39bfb1f6af23a7fc5f5a5b822e7216ce9ec62 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Wed, 28 Jan 2015 13:38:32 +1000
Subject: [PATCH 0281/3333] Remove the default project from all users

The default project means that a user gains token scoping information
for a project if they don't specify another. This is something we want
to discourage for user creation. User's should specify there own
authentication scope when they authenticate.

Change-Id: I42c3060d59edfcd44d04cd166bad500419dd99bc
---
 extras.d/70-tuskar.sh |  3 +--
 functions-common      | 11 +++++------
 lib/ceilometer        |  3 +--
 lib/cinder            |  3 +--
 lib/glance            |  5 ++---
 lib/heat              |  3 +--
 lib/ironic            |  3 +--
 lib/keystone          |  5 ++---
 lib/neutron           |  3 +--
 lib/nova              |  3 +--
 lib/sahara            |  3 +--
 lib/swift             | 16 ++++++----------
 lib/tempest           |  2 +-
 lib/trove             |  3 +--
 lib/zaqar             |  3 +--
 15 files changed, 26 insertions(+), 43 deletions(-)

diff --git a/extras.d/70-tuskar.sh b/extras.d/70-tuskar.sh
index 6e26db2804..551916f35a 100644
--- a/extras.d/70-tuskar.sh
+++ b/extras.d/70-tuskar.sh
@@ -180,8 +180,7 @@ function create_tuskar_accounts {
     local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
     local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
 
-    local tuskar_user=$(get_or_create_user "tuskar" \
-        "$SERVICE_PASSWORD" $service_tenant)
+    local tuskar_user=$(get_or_create_user "tuskar" "$SERVICE_PASSWORD")
     get_or_add_user_role $admin_role $tuskar_user $service_tenant
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/functions-common b/functions-common
index f8b8eaf567..29c28f4581 100644
--- a/functions-common
+++ b/functions-common
@@ -860,17 +860,17 @@ function get_or_create_group {
 }
 
 # Gets or creates user
-# Usage: get_or_create_user <username> <password> <project> [<email> [<domain>]]
+# Usage: get_or_create_user <username> <password> [<email> [<domain>]]
 function get_or_create_user {
-    if [[ ! -z "$4" ]]; then
-        local email="--email=$4"
+    if [[ ! -z "$3" ]]; then
+        local email="--email=$3"
     else
         local email=""
     fi
     local os_cmd="openstack"
     local domain=""
-    if [[ ! -z "$5" ]]; then
-        domain="--domain=$5"
+    if [[ ! -z "$4" ]]; then
+        domain="--domain=$4"
         os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI_V3 --os-identity-api-version=3"
     fi
     # Gets user id
@@ -879,7 +879,6 @@ function get_or_create_user {
         $os_cmd user create \
             $1 \
             --password "$2" \
-            --project $3 \
             $email \
             $domain \
             --or-show \
diff --git a/lib/ceilometer b/lib/ceilometer
index d48751e5a3..a83d0931a1 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -110,8 +110,7 @@ function create_ceilometer_accounts {
 
     # Ceilometer
     if [[ "$ENABLED_SERVICES" =~ "ceilometer-api" ]]; then
-        local ceilometer_user=$(get_or_create_user "ceilometer" \
-            "$SERVICE_PASSWORD" $service_tenant)
+        local ceilometer_user=$(get_or_create_user "ceilometer" "$SERVICE_PASSWORD")
         get_or_add_user_role $admin_role $ceilometer_user $service_tenant
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/cinder b/lib/cinder
index 6043891164..dbccf44600 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -348,8 +348,7 @@ function create_cinder_accounts {
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
-        local cinder_user=$(get_or_create_user "cinder" \
-            "$SERVICE_PASSWORD" $service_tenant)
+        local cinder_user=$(get_or_create_user "cinder" "$SERVICE_PASSWORD")
         get_or_add_user_role $admin_role $cinder_user $service_tenant
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/glance b/lib/glance
index 87687613cd..bee57a3100 100644
--- a/lib/glance
+++ b/lib/glance
@@ -232,15 +232,14 @@ function configure_glance {
 function create_glance_accounts {
     if is_service_enabled g-api; then
 
-        local glance_user=$(get_or_create_user "glance" \
-            "$SERVICE_PASSWORD" $SERVICE_TENANT_NAME)
+        local glance_user=$(get_or_create_user "glance" "$SERVICE_PASSWORD")
         get_or_add_user_role service $glance_user $SERVICE_TENANT_NAME
 
         # required for swift access
         if is_service_enabled s-proxy; then
 
             local glance_swift_user=$(get_or_create_user "glance-swift" \
-                "$SERVICE_PASSWORD" $SERVICE_TENANT_NAME "glance-swift@example.com")
+                "$SERVICE_PASSWORD" "glance-swift@example.com")
             get_or_add_user_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
         fi
 
diff --git a/lib/heat b/lib/heat
index 813c2fe65a..5bc7283361 100644
--- a/lib/heat
+++ b/lib/heat
@@ -243,8 +243,7 @@ function create_heat_accounts {
     local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
     local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
 
-    local heat_user=$(get_or_create_user "heat" \
-        "$SERVICE_PASSWORD" $service_tenant)
+    local heat_user=$(get_or_create_user "heat" "$SERVICE_PASSWORD")
     get_or_add_user_role $admin_role $heat_user $service_tenant
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/ironic b/lib/ironic
index 2075a9cda6..fced2949f4 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -365,8 +365,7 @@ function create_ironic_accounts {
     if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
         # Get ironic user if exists
 
-        local ironic_user=$(get_or_create_user "ironic" \
-            "$SERVICE_PASSWORD" $service_tenant)
+        local ironic_user=$(get_or_create_user "ironic" "$SERVICE_PASSWORD")
         get_or_add_user_role $admin_role $ironic_user $service_tenant
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/keystone b/lib/keystone
index afa7f009e7..d5ccc2f075 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -362,8 +362,7 @@ function create_keystone_accounts {
 
     # admin
     local admin_tenant=$(get_or_create_project "admin")
-    local admin_user=$(get_or_create_user "admin" \
-        "$ADMIN_PASSWORD" "$admin_tenant")
+    local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD")
     local admin_role=$(get_or_create_role "admin")
     get_or_add_user_role $admin_role $admin_user $admin_tenant
 
@@ -392,7 +391,7 @@ function create_keystone_accounts {
     # demo
     local demo_tenant=$(get_or_create_project "demo")
     local demo_user=$(get_or_create_user "demo" \
-        "$ADMIN_PASSWORD" "$demo_tenant" "demo@example.com")
+        "$ADMIN_PASSWORD" "demo@example.com")
 
     get_or_add_user_role $member_role $demo_user $demo_tenant
     get_or_add_user_role $admin_role $admin_user $demo_tenant
diff --git a/lib/neutron b/lib/neutron
index b22c00b097..d16cd3810b 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -513,8 +513,7 @@ function create_neutron_accounts {
 
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
-        local neutron_user=$(get_or_create_user "neutron" \
-            "$SERVICE_PASSWORD" $service_tenant)
+        local neutron_user=$(get_or_create_user "neutron" "$SERVICE_PASSWORD")
         get_or_add_user_role $service_role $neutron_user $service_tenant
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/nova b/lib/nova
index 76212edc96..c8d0d94c27 100644
--- a/lib/nova
+++ b/lib/nova
@@ -359,8 +359,7 @@ function create_nova_accounts {
     # Nova
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
 
-        local nova_user=$(get_or_create_user "nova" \
-            "$SERVICE_PASSWORD" $service_tenant)
+        local nova_user=$(get_or_create_user "nova" "$SERVICE_PASSWORD")
         get_or_add_user_role $admin_role $nova_user $service_tenant
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/sahara b/lib/sahara
index 995935aebf..44c06d3c46 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -64,8 +64,7 @@ function create_sahara_accounts {
     local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
     local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
 
-    local sahara_user=$(get_or_create_user "sahara" \
-        "$SERVICE_PASSWORD" $service_tenant)
+    local sahara_user=$(get_or_create_user "sahara" "$SERVICE_PASSWORD")
     get_or_add_user_role $admin_role $sahara_user $service_tenant
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/swift b/lib/swift
index ee4543cb5b..1ddfa450ab 100644
--- a/lib/swift
+++ b/lib/swift
@@ -594,8 +594,7 @@ function create_swift_accounts {
     local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
     local another_role=$(openstack role list | awk "/ anotherrole / { print \$2 }")
 
-    local swift_user=$(get_or_create_user "swift" \
-        "$SERVICE_PASSWORD" $service_tenant)
+    local swift_user=$(get_or_create_user "swift" "$SERVICE_PASSWORD")
     get_or_add_user_role $admin_role $swift_user $service_tenant
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
@@ -611,21 +610,18 @@ function create_swift_accounts {
 
     local swift_tenant_test1=$(get_or_create_project swifttenanttest1)
     die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
-    SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password \
-        "$swift_tenant_test1" "test@example.com")
+    SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
     get_or_add_user_role $admin_role $SWIFT_USER_TEST1 $swift_tenant_test1
 
-    local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password \
-        "$swift_tenant_test1" "test3@example.com")
+    local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
     get_or_add_user_role $another_role $swift_user_test3 $swift_tenant_test1
 
     local swift_tenant_test2=$(get_or_create_project swifttenanttest2)
     die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
 
-    local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password \
-        "$swift_tenant_test2" "test2@example.com")
+    local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
     get_or_add_user_role $admin_role $swift_user_test2 $swift_tenant_test2
 
@@ -634,8 +630,8 @@ function create_swift_accounts {
 
     local swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
     die_if_not_set $LINENO swift_tenant_test4 "Failure creating swift_tenant_test4"
-    local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
-        $swift_tenant_test4 "test4@example.com" $swift_domain)
+
+    local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password "test4@example.com" $swift_domain)
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
     get_or_add_user_role $admin_role $swift_user_test4 $swift_tenant_test4
 }
diff --git a/lib/tempest b/lib/tempest
index 1ae945779d..86f30b4a40 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -502,7 +502,7 @@ function create_tempest_accounts {
         # Tempest has some tests that validate various authorization checks
         # between two regular users in separate tenants
         get_or_create_project alt_demo
-        get_or_create_user alt_demo "$ADMIN_PASSWORD" alt_demo "alt_demo@example.com"
+        get_or_create_user alt_demo "$ADMIN_PASSWORD" "alt_demo@example.com"
         get_or_add_user_role Member alt_demo alt_demo
     fi
 }
diff --git a/lib/trove b/lib/trove
index 3249ce0746..5e6b1b39c3 100644
--- a/lib/trove
+++ b/lib/trove
@@ -84,8 +84,7 @@ function create_trove_accounts {
 
     if [[ "$ENABLED_SERVICES" =~ "trove" ]]; then
 
-        local trove_user=$(get_or_create_user "trove" \
-            "$SERVICE_PASSWORD" $service_tenant)
+        local trove_user=$(get_or_create_user "trove" "$SERVICE_PASSWORD")
         get_or_add_user_role $service_role $trove_user $service_tenant
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/zaqar b/lib/zaqar
index dfa3452f0d..618ac30534 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -218,8 +218,7 @@ function create_zaqar_accounts {
     local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
     ADMIN_ROLE=$(openstack role list | awk "/ admin / { print \$2 }")
 
-    local zaqar_user=$(get_or_create_user "zaqar" \
-        "$SERVICE_PASSWORD" $service_tenant)
+    local zaqar_user=$(get_or_create_user "zaqar" "$SERVICE_PASSWORD")
     get_or_add_user_role $ADMIN_ROLE $zaqar_user $service_tenant
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

From 9a704486a9471d6e0d6e6bf82321784e2348f257 Mon Sep 17 00:00:00 2001
From: Zhenzan Zhou <zhenzan.zhou@intel.com>
Date: Tue, 27 Jan 2015 10:48:24 +0800
Subject: [PATCH 0282/3333] Fix wrong grep regular expression for tap ports

The regular expression used in neutron_ovs_base_cleanup omit
prefix in ovs tap ports, so wrong names are returned and used.
E.g. tap devices created for ironic in devstack are brbm-tap1
and ovs-tap1.

Change-Id: I034be6362b3d09c5296ecc413828a056712c3bd2
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index cde5298af8..2997c6c25a 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -28,7 +28,7 @@ function _neutron_ovs_base_setup_bridge {
 
 function neutron_ovs_base_cleanup {
     # remove all OVS ports that look like Neutron created ports
-    for port in $(sudo ovs-vsctl list port | grep -o -e tap[0-9a-f\-]* -e q[rg]-[0-9a-f\-]*); do
+    for port in $(sudo ovs-vsctl list port | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e q[rg]-[0-9a-f\-]*); do
         sudo ovs-vsctl del-port ${port}
     done
 

From ec89fa039bb115bce8dc40c4b72359c07e487a3a Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 29 Jan 2015 11:16:00 +0100
Subject: [PATCH 0283/3333] Remove --skip-redirect form the tgtd service
 restart

skip-redirect was intruduced with the first commit related
to cinder support, nobody remembers why was this undocumented option
there those times.

Change-Id: If579a93090392327bce96ddd1b562977edf762de
---
 lib/cinder | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 1bc6ddd7c5..524152b302 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -450,10 +450,7 @@ function start_cinder {
         _configure_tgt_for_config_d
         if is_ubuntu; then
             sudo service tgt restart
-        elif is_fedora; then
-            # bypass redirection to systemctl during restart
-            sudo /sbin/service --skip-redirect tgtd restart
-        elif is_suse; then
+        elif is_fedora || is_suse; then
             restart_service tgtd
         else
             # note for other distros: unstack.sh also uses the tgt/tgtd service

From d8267b74aeb865ac1289d75bd2a965d3248aeed5 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 29 Jan 2015 09:25:42 -0800
Subject: [PATCH 0284/3333] Revert "Exit after printing error about RPC config"

This reverts commit c1dbf10562796c7006fd0a66c6cb39a1b990c8c1.

Reverting because it is valid to run devstack without enabling an rpc
backend. For example when you run devstack on a multinode deployment
compute hosts probably shouldn't run rabbit and instead will just talk
to the rabbit server set up on the controller node. As a result we
should not die when no rpc backends are set.

Change-Id: If9a31e031552f4161d42094fa960221b4d9e893c
---
 lib/rpc_backend | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 98be1844b6..d87d6207b1 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -54,15 +54,13 @@ function check_rpc_backend {
         (( rpc_backend_cnt++ )) || true
     done
     if [ "$rpc_backend_cnt" -gt 1 ]; then
-        die $LINENO \
-            "Only one rpc backend may be enabled, " \
-            "set only one of 'rabbit', 'qpid', 'zeromq' " \
-            "via ENABLED_SERVICES."
+        echo "ERROR: only one rpc backend may be enabled,"
+        echo "       set only one of 'rabbit', 'qpid', 'zeromq'"
+        echo "       via ENABLED_SERVICES."
     elif [ "$rpc_backend_cnt" == 0 ] && [ "$rpc_needed" == 0 ]; then
-        die $LINENO \
-            "at least one rpc backend must be enabled, " \
-            "set one of 'rabbit', 'qpid', 'zeromq'" \
-            "via ENABLED_SERVICES."
+        echo "ERROR: at least one rpc backend must be enabled,"
+        echo "       set one of 'rabbit', 'qpid', 'zeromq'"
+        echo "       via ENABLED_SERVICES."
     fi
 
     if is_service_enabled qpid && ! qpid_is_supported; then

From b43b3595061ce3138889ac78ded0eebbb144e4db Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 29 Jan 2015 12:05:43 -0600
Subject: [PATCH 0285/3333] Create LOGDIR if it doesn't exist

Create LOGDIR when LOGFILE is not set.  This fix is rather blunt
as logging setup will be further tweaked as
https://github.com/openstack/qa-specs/blob/master/specs/devstack/devstack-logging-and-service-names.rst
progresses.

Change-Id: I4a574f295eb6d55c7196ec563bd356d6c0bc8833
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 5b5697252b..d3d54cc699 100755
--- a/stack.sh
+++ b/stack.sh
@@ -352,6 +352,10 @@ TIMESTAMP_FORMAT=${TIMESTAMP_FORMAT:-"%F-%H%M%S"}
 LOGDAYS=${LOGDAYS:-7}
 CURRENT_LOG_TIME=$(date "+$TIMESTAMP_FORMAT")
 
+if [[ -n ${LOGDIR:-} ]]; then
+    mkdir -p $LOGDIR
+fi
+
 if [[ -n "$LOGFILE" ]]; then
     # Clean up old log files.  Append '.*' to the user-specified
     # ``LOGFILE`` to match the date in the search template.

From 38c95b8eba7a67535895c62a0d676f0ad37c5070 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 30 Jan 2015 02:15:42 +0000
Subject: [PATCH 0286/3333] Configure auth_token middleware manually in swift.

Swift doesn't use olso.config and so the method of configuring swift via the
[keystone_authtoken] config options will not work. Go back to configuring swift
manually.

This will need to be fixed in either keystonemiddleware or swift as configuring
via plugin is the path to v3 authentication, service domains and new forms of
service user authentication.

Closes-Bug: #1415795
Change-Id: Ibe27116a11756072d5a300a6d3691c5f8c32317e
---
 lib/swift | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/lib/swift b/lib/swift
index ee4543cb5b..e6e1212f23 100644
--- a/lib/swift
+++ b/lib/swift
@@ -409,16 +409,27 @@ function configure_swift {
     # Configure Crossdomain
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:crossdomain use "egg:swift#crossdomain"
 
-    # Configure Keystone
-    sed -i '/^# \[filter:authtoken\]/,/^# \[filter:keystoneauth\]$/ s/^#[ \t]*//' ${SWIFT_CONFIG_PROXY_SERVER}
-    configure_auth_token_middleware ${SWIFT_CONFIG_PROXY_SERVER} swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
+
     # This causes the authtoken middleware to use the same python logging
     # adapter provided by the swift proxy-server, so that request transaction
     # IDs will included in all of its log messages.
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
-    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth use
-    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth operator_roles
+    # NOTE(jamielennox): swift cannot use the regular configure_auth_token_middleware function because swift
+    # doesn't use oslo.config which is the only way to configure auth plugins with the middleare.
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken identity_uri $KEYSTONE_AUTH_URI
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken admin_user swift
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken admin_password $SERVICE_PASSWORD
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken auth_uri $KEYSTONE_SERVICE_URI
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cafile $SSL_BUNDLE_FILE
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken signing_dir $SWIFT_AUTH_CACHE_DIR
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
+
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth use "egg:swift#keystoneauth"
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth operator_roles "Member, admin"
 
     # Configure Tempauth. In the sample config file, Keystoneauth is commented

From 901dbecd4ca2d851cfb929b18aec546481699978 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Fri, 30 Jan 2015 17:03:32 +0000
Subject: [PATCH 0287/3333] dstat: avoid creating self-referential symlink

If the SCREEN_LOGDIR and LOGDIR environment variables point to the
same location, devstack creates a dstat.log which is a symlink
pointing to itself. The second invokation of devstack then fails
trying to reference this broken symlink

Change-Id: I1de2bb7983e7535b41b28f526083a0d77312ff85
---
 lib/dstat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dstat b/lib/dstat
index d1db469aa6..8165e5c5e9 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -29,7 +29,7 @@ function start_dstat {
     DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
     if [[ -n ${LOGDIR} ]]; then
         screen_it dstat "cd $TOP_DIR; dstat $DSTAT_OPTS | tee $LOGDIR/$DSTAT_FILE"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
+        if [[ -n ${SCREEN_LOGDIR} && ${SCREEN_LOGDIR} != ${LOGDIR} ]]; then
             # Drop the backward-compat symlink
             ln -sf $LOGDIR/$DSTAT_FILE ${SCREEN_LOGDIR}/$DSTAT_FILE
         fi

From a1b82cc1b5a7172c3fdf17d2c3f0725660911ad7 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 30 Jan 2015 13:54:40 -0600
Subject: [PATCH 0288/3333] Fix unbound literal in trueorfalse()

Change-Id: I4c465819c311604e97d24e081389ff531f8a42fa
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 4d1c89ae15..b92fa55663 100644
--- a/functions-common
+++ b/functions-common
@@ -245,7 +245,7 @@ function trueorfalse {
     set +o xtrace
     local default=$1
     local literal=$2
-    local testval=${!literal}
+    local testval=${!literal:-}
 
     [[ -z "$testval" ]] && { echo "$default"; return; }
     [[ "0 no No NO false False FALSE" =~ "$testval" ]] && { echo "False"; return; }

From 490430dbe3b7d9979b4623f2c327bb0a74436401 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 30 Jan 2015 14:38:35 -0600
Subject: [PATCH 0289/3333] Split functions-common: python functions

Move Python-related functions into inc/python

Should be transparent to all callers as it is sourced from functions-common

Change-Id: I88043830cef9211b4e0baa91bfcc7a92125afa9f
---
 functions        |   1 +
 functions-common | 199 ------------------------------------------
 inc/python       | 223 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 224 insertions(+), 199 deletions(-)
 create mode 100644 inc/python

diff --git a/functions b/functions
index 5b3a8ea192..2f976cfab1 100644
--- a/functions
+++ b/functions
@@ -13,6 +13,7 @@
 # Include the common functions
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source ${FUNC_DIR}/functions-common
+source ${FUNC_DIR}/inc/python
 
 # Save trace setting
 XTRACE=$(set +o | grep xtrace)
diff --git a/functions-common b/functions-common
index b92fa55663..a6ecdd6983 100644
--- a/functions-common
+++ b/functions-common
@@ -15,7 +15,6 @@
 # - OpenStack Functions
 # - Package Functions
 # - Process Functions
-# - Python Functions
 # - Service Functions
 # - System Functions
 #
@@ -1590,204 +1589,6 @@ function screen_stop {
 }
 
 
-# Python Functions
-# ================
-
-# Get the path to the pip command.
-# get_pip_command
-function get_pip_command {
-    which pip || which pip-python
-
-    if [ $? -ne 0 ]; then
-        die $LINENO "Unable to find pip; cannot continue"
-    fi
-}
-
-# Get the path to the direcotry where python executables are installed.
-# get_python_exec_prefix
-function get_python_exec_prefix {
-    if is_fedora || is_suse; then
-        echo "/usr/bin"
-    else
-        echo "/usr/local/bin"
-    fi
-}
-
-# Wrapper for ``pip install`` to set cache and proxy environment variables
-# Uses globals ``OFFLINE``, ``TRACK_DEPENDS``, ``*_proxy``
-# pip_install package [package ...]
-function pip_install {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local offline=${OFFLINE:-False}
-    if [[ "$offline" == "True" || -z "$@" ]]; then
-        $xtrace
-        return
-    fi
-
-    if [[ -z "$os_PACKAGE" ]]; then
-        GetOSVersion
-    fi
-    if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
-        # TRACK_DEPENDS=True installation creates a circular dependency when
-        # we attempt to install virtualenv into a virualenv, so we must global
-        # that installation.
-        source $DEST/.venv/bin/activate
-        local cmd_pip=$DEST/.venv/bin/pip
-        local sudo_pip="env"
-    else
-        local cmd_pip=$(get_pip_command)
-        local sudo_pip="sudo -H"
-    fi
-
-    local pip_version=$(python -c "import pip; \
-                        print(pip.__version__.strip('.')[0])")
-    if (( pip_version<6 )); then
-        die $LINENO "Currently installed pip version ${pip_version} does not" \
-            "meet minimum requirements (>=6)."
-    fi
-
-    $xtrace
-    $sudo_pip \
-        http_proxy=${http_proxy:-} \
-        https_proxy=${https_proxy:-} \
-        no_proxy=${no_proxy:-} \
-        $cmd_pip install \
-        $@
-
-    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False INSTALL_TESTONLY_PACKAGES)
-    if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
-        local test_req="$@/test-requirements.txt"
-        if [[ -e "$test_req" ]]; then
-            $sudo_pip \
-                http_proxy=${http_proxy:-} \
-                https_proxy=${https_proxy:-} \
-                no_proxy=${no_proxy:-} \
-                $cmd_pip install \
-                -r $test_req
-        fi
-    fi
-}
-
-# should we use this library from their git repo, or should we let it
-# get pulled in via pip dependencies.
-function use_library_from_git {
-    local name=$1
-    local enabled=1
-    [[ ,${LIBS_FROM_GIT}, =~ ,${name}, ]] && enabled=0
-    return $enabled
-}
-
-# setup a library by name. If we are trying to use the library from
-# git, we'll do a git based install, otherwise we'll punt and the
-# library should be installed by a requirements pull from another
-# project.
-function setup_lib {
-    local name=$1
-    local dir=${GITDIR[$name]}
-    setup_install $dir
-}
-
-# setup a library by name in editiable mode. If we are trying to use
-# the library from git, we'll do a git based install, otherwise we'll
-# punt and the library should be installed by a requirements pull from
-# another project.
-#
-# use this for non namespaced libraries
-function setup_dev_lib {
-    local name=$1
-    local dir=${GITDIR[$name]}
-    setup_develop $dir
-}
-
-# this should be used if you want to install globally, all libraries should
-# use this, especially *oslo* ones
-function setup_install {
-    local project_dir=$1
-    setup_package_with_req_sync $project_dir
-}
-
-# this should be used for projects which run services, like all services
-function setup_develop {
-    local project_dir=$1
-    setup_package_with_req_sync $project_dir -e
-}
-
-# determine if a project as specified by directory is in
-# projects.txt. This will not be an exact match because we throw away
-# the namespacing when we clone, but it should be good enough in all
-# practical ways.
-function is_in_projects_txt {
-    local project_dir=$1
-    local project_name=$(basename $project_dir)
-    return grep "/$project_name\$" $REQUIREMENTS_DIR/projects.txt >/dev/null
-}
-
-# ``pip install -e`` the package, which processes the dependencies
-# using pip before running `setup.py develop`
-#
-# Updates the dependencies in project_dir from the
-# openstack/requirements global list before installing anything.
-#
-# Uses globals ``TRACK_DEPENDS``, ``REQUIREMENTS_DIR``, ``UNDO_REQUIREMENTS``
-# setup_develop directory
-function setup_package_with_req_sync {
-    local project_dir=$1
-    local flags=$2
-
-    # Don't update repo if local changes exist
-    # Don't use buggy "git diff --quiet"
-    # ``errexit`` requires us to trap the exit code when the repo is changed
-    local update_requirements=$(cd $project_dir && git diff --exit-code >/dev/null || echo "changed")
-
-    if [[ $update_requirements != "changed" ]]; then
-        if [[ "$REQUIREMENTS_MODE" == "soft" ]]; then
-            if is_in_projects_txt $project_dir; then
-                (cd $REQUIREMENTS_DIR; \
-                    python update.py $project_dir)
-            else
-                # soft update projects not found in requirements project.txt
-                (cd $REQUIREMENTS_DIR; \
-                    python update.py -s $project_dir)
-            fi
-        else
-            (cd $REQUIREMENTS_DIR; \
-                python update.py $project_dir)
-        fi
-    fi
-
-    setup_package $project_dir $flags
-
-    # We've just gone and possibly modified the user's source tree in an
-    # automated way, which is considered bad form if it's a development
-    # tree because we've screwed up their next git checkin. So undo it.
-    #
-    # However... there are some circumstances, like running in the gate
-    # where we really really want the overridden version to stick. So provide
-    # a variable that tells us whether or not we should UNDO the requirements
-    # changes (this will be set to False in the OpenStack ci gate)
-    if [ $UNDO_REQUIREMENTS = "True" ]; then
-        if [[ $update_requirements != "changed" ]]; then
-            (cd $project_dir && git reset --hard)
-        fi
-    fi
-}
-
-# ``pip install -e`` the package, which processes the dependencies
-# using pip before running `setup.py develop`
-# Uses globals ``STACK_USER``
-# setup_develop_no_requirements_update directory
-function setup_package {
-    local project_dir=$1
-    local flags=$2
-
-    pip_install $flags $project_dir
-    # ensure that further actions can do things like setup.py sdist
-    if [[ "$flags" == "-e" ]]; then
-        safe_chown -R $STACK_USER $1/*.egg-info
-    fi
-}
-
 # Plugin Functions
 # =================
 
diff --git a/inc/python b/inc/python
new file mode 100644
index 0000000000..0348cb389f
--- /dev/null
+++ b/inc/python
@@ -0,0 +1,223 @@
+#!/bin/bash
+#
+# **inc/python** - Python-related functions
+#
+# Support for pip/setuptools interfaces and virtual environments
+#
+# External functions used:
+# - GetOSVersion
+# - is_fedora
+# - is_suse
+# - safe_chown
+
+# Save trace setting
+INC_PY_TRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Python Functions
+# ================
+
+# Get the path to the pip command.
+# get_pip_command
+function get_pip_command {
+    which pip || which pip-python
+
+    if [ $? -ne 0 ]; then
+        die $LINENO "Unable to find pip; cannot continue"
+    fi
+}
+
+# Get the path to the direcotry where python executables are installed.
+# get_python_exec_prefix
+function get_python_exec_prefix {
+    if is_fedora || is_suse; then
+        echo "/usr/bin"
+    else
+        echo "/usr/local/bin"
+    fi
+}
+
+# Wrapper for ``pip install`` to set cache and proxy environment variables
+# Uses globals ``INSTALL_TESTONLY_PACKAGES``, ``OFFLINE``, ``TRACK_DEPENDS``,
+# ``*_proxy``
+# pip_install package [package ...]
+function pip_install {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local offline=${OFFLINE:-False}
+    if [[ "$offline" == "True" || -z "$@" ]]; then
+        $xtrace
+        return
+    fi
+
+    if [[ -z "$os_PACKAGE" ]]; then
+        GetOSVersion
+    fi
+    if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
+        # TRACK_DEPENDS=True installation creates a circular dependency when
+        # we attempt to install virtualenv into a virualenv, so we must global
+        # that installation.
+        source $DEST/.venv/bin/activate
+        local cmd_pip=$DEST/.venv/bin/pip
+        local sudo_pip="env"
+    else
+        local cmd_pip=$(get_pip_command)
+        local sudo_pip="sudo -H"
+    fi
+
+    local pip_version=$(python -c "import pip; \
+                        print(pip.__version__.strip('.')[0])")
+    if (( pip_version<6 )); then
+        die $LINENO "Currently installed pip version ${pip_version} does not" \
+            "meet minimum requirements (>=6)."
+    fi
+
+    $xtrace
+    $sudo_pip \
+        http_proxy=${http_proxy:-} \
+        https_proxy=${https_proxy:-} \
+        no_proxy=${no_proxy:-} \
+        $cmd_pip install \
+        $@
+
+    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False INSTALL_TESTONLY_PACKAGES)
+    if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
+        local test_req="$@/test-requirements.txt"
+        if [[ -e "$test_req" ]]; then
+            $sudo_pip \
+                http_proxy=${http_proxy:-} \
+                https_proxy=${https_proxy:-} \
+                no_proxy=${no_proxy:-} \
+                $cmd_pip install \
+                -r $test_req
+        fi
+    fi
+}
+
+# should we use this library from their git repo, or should we let it
+# get pulled in via pip dependencies.
+function use_library_from_git {
+    local name=$1
+    local enabled=1
+    [[ ,${LIBS_FROM_GIT}, =~ ,${name}, ]] && enabled=0
+    return $enabled
+}
+
+# setup a library by name. If we are trying to use the library from
+# git, we'll do a git based install, otherwise we'll punt and the
+# library should be installed by a requirements pull from another
+# project.
+function setup_lib {
+    local name=$1
+    local dir=${GITDIR[$name]}
+    setup_install $dir
+}
+
+# setup a library by name in editiable mode. If we are trying to use
+# the library from git, we'll do a git based install, otherwise we'll
+# punt and the library should be installed by a requirements pull from
+# another project.
+#
+# use this for non namespaced libraries
+function setup_dev_lib {
+    local name=$1
+    local dir=${GITDIR[$name]}
+    setup_develop $dir
+}
+
+# this should be used if you want to install globally, all libraries should
+# use this, especially *oslo* ones
+function setup_install {
+    local project_dir=$1
+    setup_package_with_req_sync $project_dir
+}
+
+# this should be used for projects which run services, like all services
+function setup_develop {
+    local project_dir=$1
+    setup_package_with_req_sync $project_dir -e
+}
+
+# determine if a project as specified by directory is in
+# projects.txt. This will not be an exact match because we throw away
+# the namespacing when we clone, but it should be good enough in all
+# practical ways.
+function is_in_projects_txt {
+    local project_dir=$1
+    local project_name=$(basename $project_dir)
+    return grep "/$project_name\$" $REQUIREMENTS_DIR/projects.txt >/dev/null
+}
+
+# ``pip install -e`` the package, which processes the dependencies
+# using pip before running `setup.py develop`
+#
+# Updates the dependencies in project_dir from the
+# openstack/requirements global list before installing anything.
+#
+# Uses globals ``TRACK_DEPENDS``, ``REQUIREMENTS_DIR``, ``UNDO_REQUIREMENTS``
+# setup_develop directory
+function setup_package_with_req_sync {
+    local project_dir=$1
+    local flags=$2
+
+    # Don't update repo if local changes exist
+    # Don't use buggy "git diff --quiet"
+    # ``errexit`` requires us to trap the exit code when the repo is changed
+    local update_requirements=$(cd $project_dir && git diff --exit-code >/dev/null || echo "changed")
+
+    if [[ $update_requirements != "changed" ]]; then
+        if [[ "$REQUIREMENTS_MODE" == "soft" ]]; then
+            if is_in_projects_txt $project_dir; then
+                (cd $REQUIREMENTS_DIR; \
+                    python update.py $project_dir)
+            else
+                # soft update projects not found in requirements project.txt
+                (cd $REQUIREMENTS_DIR; \
+                    python update.py -s $project_dir)
+            fi
+        else
+            (cd $REQUIREMENTS_DIR; \
+                python update.py $project_dir)
+        fi
+    fi
+
+    setup_package $project_dir $flags
+
+    # We've just gone and possibly modified the user's source tree in an
+    # automated way, which is considered bad form if it's a development
+    # tree because we've screwed up their next git checkin. So undo it.
+    #
+    # However... there are some circumstances, like running in the gate
+    # where we really really want the overridden version to stick. So provide
+    # a variable that tells us whether or not we should UNDO the requirements
+    # changes (this will be set to False in the OpenStack ci gate)
+    if [ $UNDO_REQUIREMENTS = "True" ]; then
+        if [[ $update_requirements != "changed" ]]; then
+            (cd $project_dir && git reset --hard)
+        fi
+    fi
+}
+
+# ``pip install -e`` the package, which processes the dependencies
+# using pip before running `setup.py develop`
+# Uses globals ``STACK_USER``
+# setup_develop_no_requirements_update directory
+function setup_package {
+    local project_dir=$1
+    local flags=$2
+
+    pip_install $flags $project_dir
+    # ensure that further actions can do things like setup.py sdist
+    if [[ "$flags" == "-e" ]]; then
+        safe_chown -R $STACK_USER $1/*.egg-info
+    fi
+}
+
+
+# Restore xtrace
+$INC_PY_TRACE
+
+# Local variables:
+# mode: shell-script
+# End:

From c4b871f613b2bb8f29083f4a7200734d1cf3d8b1 Mon Sep 17 00:00:00 2001
From: Maru Newby <marun@redhat.com>
Date: Fri, 30 Jan 2015 22:24:30 +0000
Subject: [PATCH 0290/3333] Add q-l3 conntrack dependency for ubuntu

The conntrack binary is included with conntrackd on rpm-based
distros but needs to be explicitly installed on ubuntu.

Change-Id: I615627c85d6aa5a465355c0ea27148f24d863a01
---
 files/debs/q-l3 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/q-l3 b/files/debs/q-l3
index b98b628f22..106a6a35aa 100644
--- a/files/debs/q-l3
+++ b/files/debs/q-l3
@@ -1,2 +1,3 @@
+conntrack
 conntrackd
 keepalived

From 952fd90ff12e4964a35b63da2ec4226325f8f373 Mon Sep 17 00:00:00 2001
From: Maru Newby <marun@redhat.com>
Date: Fri, 30 Jan 2015 22:27:12 +0000
Subject: [PATCH 0291/3333] Refactor lib/neutron rootwrap conf for reuse

This change separates out the creation and permision setting for
the /etc/neutron so that it can be reused by functional test
setup in rootwrap deployment.

Change-Id: Ib2ad5b21630ac82a3d7ffc7b088600b2168f1ecd
---
 lib/neutron | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 0f49476c4f..b13e31b8cb 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -791,15 +791,20 @@ function cleanup_neutron {
     done
 }
 
-# _configure_neutron_common()
-# Set common config for all neutron server and agents.
-# This MUST be called before other ``_configure_neutron_*`` functions.
-function _configure_neutron_common {
+
+function _create_neutron_conf_dir {
     # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
     if [[ ! -d $NEUTRON_CONF_DIR ]]; then
         sudo mkdir -p $NEUTRON_CONF_DIR
     fi
     sudo chown $STACK_USER $NEUTRON_CONF_DIR
+}
+
+# _configure_neutron_common()
+# Set common config for all neutron server and agents.
+# This MUST be called before other ``_configure_neutron_*`` functions.
+function _configure_neutron_common {
+    _create_neutron_conf_dir
 
     cp $NEUTRON_DIR/etc/neutron.conf $NEUTRON_CONF
 

From 5bee0cd4ce52098b84dcdada3fbee0bb0add726b Mon Sep 17 00:00:00 2001
From: Martin Falatic <mfalatic@cisco.com>
Date: Fri, 23 Jan 2015 14:10:33 -0800
Subject: [PATCH 0292/3333] Updated supported OS releases listed in stack.sh

Updated the supported OS release versions mentioned in stack.sh to be
consistent with what is listed in doc/source/index.rst

Change-Id: Ie9045927779a063865115e3aff1b92450a104946
Closes-Bug: #1414205
---
 doc/source/index.rst |  2 +-
 stack.sh             | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 7188f6ecf4..0763fb83cb 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -19,7 +19,7 @@ Quick Start
 
 #. Select a Linux Distribution
 
-   Only Ubuntu 14.04 (Trusty), Fedora 20 and CentOS/RHEL 6.5 are
+   Only Ubuntu 14.04 (Trusty), Fedora 20 and CentOS/RHEL 7 are
    documented here. OpenStack also runs and is packaged on other flavors
    of Linux such as OpenSUSE and Debian.
 
diff --git a/stack.sh b/stack.sh
index cda302fd74..eaecea075c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -13,11 +13,11 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (12.04 Precise or newer) or **Fedora** (F18 or newer) machine.  (It may work
-# on other platforms but support for those platforms is left to those who added
-# them to DevStack.)  It should work in a VM or physical server.  Additionally
-# we maintain a list of ``apt`` and ``rpm`` dependencies and other configuration
-# files in this repo.
+# (14.04 Trusty or newer), **Fedora** (F20 or newer), or **CentOS/RHEL**
+# (7 or newer) machine. (It may work on other platforms but support for those
+# platforms is left to those who added them to DevStack.) It should work in
+# a VM or physical server. Additionally, we maintain a list of ``apt`` and
+# ``rpm`` dependencies and other configuration files in this repo.
 
 # Learn more and get the most recent version at http://devstack.org
 

From 99f5bcc35338aecc0ba1478369970baf1f5013e2 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Tue, 3 Feb 2015 09:23:39 -0500
Subject: [PATCH 0293/3333] add event pipeline yaml

Ceilometer as added support for an event pipeline to enable
transformations and publishing of events. this patch adds the new
event_pipeline.yaml file

Change-Id: I7018a57e7db3690d72fd7c7d5090e6e61cf73e18
---
 lib/ceilometer | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/ceilometer b/lib/ceilometer
index 5d5b987e9e..67a546e63c 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -190,6 +190,7 @@ function configure_ceilometer {
     iniset $CEILOMETER_CONF DEFAULT policy_file $CEILOMETER_CONF_DIR/policy.json
 
     cp $CEILOMETER_DIR/etc/ceilometer/pipeline.yaml $CEILOMETER_CONF_DIR
+    cp $CEILOMETER_DIR/etc/ceilometer/event_pipeline.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/api_paste.ini $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/event_definitions.yaml $CEILOMETER_CONF_DIR
 

From 37da4592c200a54dc8dcf6a549fb634a1d5814ca Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Fri, 30 Jan 2015 23:30:08 -0700
Subject: [PATCH 0294/3333] Copy neutron service conf files into
 NEUTRON_CONF_DIR

As part of splitting neutron into pieces, one of the steps was splitting
the various bits of configuration into their respective repos. That just
happened, and this change propagates those config files into /etc/neutron
in the same manner that devstack is using for neutron.conf (and which is
done via setup.cfg, like neutron, for regular package installs.)

Required for neutron review: https://review.openstack.org/#/c/151541/

Change-Id: Ic9aec4401925eca9e1678d84662b96d346a911e3
---
 lib/neutron | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 0f49476c4f..6edba5ba39 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -957,6 +957,9 @@ function _configure_neutron_ceilometer_notifications {
 }
 
 function _configure_neutron_lbaas {
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
+    fi
     neutron_agent_lbaas_configure_common
     neutron_agent_lbaas_configure_agent
 }
@@ -967,11 +970,17 @@ function _configure_neutron_metering {
 }
 
 function _configure_neutron_fwaas {
+    if [ -f $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf ]; then
+        cp $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf $NEUTRON_CONF_DIR
+    fi
     neutron_fwaas_configure_common
     neutron_fwaas_configure_driver
 }
 
 function _configure_neutron_vpn {
+    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf ]; then
+        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf $NEUTRON_CONF_DIR
+    fi
     neutron_vpn_install_agent_packages
     neutron_vpn_configure_common
 }

From 3eeed23751f75d0cf27e11bc73eba9e9ae5e321c Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Fri, 5 Dec 2014 03:30:41 +0000
Subject: [PATCH 0295/3333] Workflow documentation is now in infra-manual

Replace URLs for workflow documentation to appropriate parts of the
OpenStack Project Infrastructure Manual.

Change-Id: Idf519ff362731c106bbd9b63135f8dab4c7b7b92
---
 HACKING.rst                 | 2 +-
 doc/source/contributing.rst | 6 +++---
 doc/source/faq.rst          | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index b7d9a49458..dcde141782 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -20,7 +20,7 @@ in `How To Contribute`__ in the OpenStack wiki.  `DevStack's LaunchPad project`_
 contains the usual links for blueprints, bugs, etc.
 
 __ contribute_
-.. _contribute: http://wiki.openstack.org/HowToContribute
+.. _contribute: http://docs.openstack.org/infra/manual/developers.html
 
 __ lp_
 .. _lp: https://launchpad.net/~devstack
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
index b2a219b596..50c0100578 100644
--- a/doc/source/contributing.rst
+++ b/doc/source/contributing.rst
@@ -3,9 +3,9 @@ Contributing
 ============
 
 DevStack uses the standard OpenStack contribution process as outlined in
-`the OpenStack wiki 'How To
-Contribute' <https://wiki.openstack.org/wiki/How_To_Contribute>`__. This
-means that you will need to meet the requirements of the Contributors
+`the OpenStack developer
+guide <http://docs.openstack.org/infra/manual/developers.html>`__. This
+means that you will need to meet the requirements of the Contribututors
 License Agreement (CLA). If you have already done that for another
 OpenStack project you are good to go.
 
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index f10c2eec36..fd9c736736 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -46,8 +46,8 @@ Q: I'd like to help!
     `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
     and bug reports go to
     `LaunchPad <http://bugs.launchpad.net/devstack/>`__. Contributions
-    follow the usual process as described in the `OpenStack
-    wiki <http://wiki.openstack.org/HowToContribute>`__. This Sphinx
+    follow the usual process as described in the `developer
+    guide <http://docs.openstack.org/infra/manual/developers.html>`__. This Sphinx
     documentation is housed in the doc directory.
 Q: Why not use packages?
     A: Unlike packages, DevStack leaves your cloud ready to develop -

From 0413d2db8d55f0d6a32551bc48a8e7d65800a0e2 Mon Sep 17 00:00:00 2001
From: Flavio Fernandes <ffernand@redhat.com>
Date: Fri, 9 Jan 2015 16:09:12 -0500
Subject: [PATCH 0296/3333] Add param for turning on debug logs on
 opendaylight's net-virt

When looking at issues related to opendaylight and openstack, it
helps to bump up the logs on ovsdb and neutron northbound. This
commit introduces a param for doing that:

ODL_NETVIRT_DEBUG_LOGS=True

Change-Id: I109fc61ddc44255de031341fb41bef8db5f0714f
---
 lib/opendaylight | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/lib/opendaylight b/lib/opendaylight
index 2f0f37e34d..6518673524 100644
--- a/lib/opendaylight
+++ b/lib/opendaylight
@@ -72,6 +72,11 @@ ODL_PROVIDER_MAPPINGS=${ODL_PROVIDER_MAPPINGS:-physnet1:eth1}
 # Enable OpenDaylight l3 forwarding
 ODL_L3=${ODL_L3:-False}
 
+# Enable debug logs for odl ovsdb
+ODL_NETVIRT_DEBUG_LOGS=${ODL_NETVIRT_DEBUG_LOGS:-False}
+
+# The logging config file in ODL
+ODL_LOGGING_CONFIG=${ODL_LOGGING_CONFIG:-${ODL_DIR}/${ODL_NAME}/etc/org.ops4j.pax.logging.cfg}
 
 # Entry Points
 # ------------
@@ -111,6 +116,22 @@ function configure_opendaylight {
             echo "ovsdb.l3.fwd.enabled=yes" >> $ODL_DIR/$ODL_NAME/etc/custom.properties
         fi
     fi
+
+    # Configure DEBUG logs for network virtualization in odl, if the user wants it
+    if [ "${ODL_NETVIRT_DEBUG_LOGS}" == "True" ]; then
+        local OVSDB_DEBUG_LOGS=$(cat $ODL_LOGGING_CONFIG | grep ^log4j.logger.org.opendaylight.ovsdb)
+        if [ "${OVSDB_DEBUG_LOGS}" == "" ]; then
+            echo 'log4j.logger.org.opendaylight.ovsdb = TRACE' >> $ODL_LOGGING_CONFIG
+            echo 'log4j.logger.org.opendaylight.ovsdb.lib = INFO' >> $ODL_LOGGING_CONFIG
+            echo 'log4j.logger.org.opendaylight.ovsdb.openstack.netvirt.impl.NeutronL3Adapter = DEBUG' >> $ODL_LOGGING_CONFIG
+            echo 'log4j.logger.org.opendaylight.ovsdb.openstack.netvirt.impl.TenantNetworkManagerImpl = DEBUG' >> $ODL_LOGGING_CONFIG
+            echo 'log4j.logger.org.opendaylight.ovsdb.plugin.md.OvsdbInventoryManager = INFO' >> $ODL_LOGGING_CONFIG
+        fi
+        local ODL_NEUTRON_DEBUG_LOGS=$(cat $ODL_LOGGING_CONFIG | grep ^log4j.logger.org.opendaylight.controller.networkconfig.neutron)
+        if [ "${ODL_NEUTRON_DEBUG_LOGS}" == "" ]; then
+            echo 'log4j.logger.org.opendaylight.controller.networkconfig.neutron = TRACE' >> $ODL_LOGGING_CONFIG
+        fi
+    fi
 }
 
 function configure_ml2_odl {

From 1add6fc222745d6cd4b396fd105fccee3c015e1b Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 3 Feb 2015 16:24:48 -0500
Subject: [PATCH 0297/3333] Increase the suggested minimum ram to 4gb

Change-Id: I4f098d731693e635ebcc89357d382674c7730201
---
 doc/source/guides/single-vm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index a41c4e14f1..ab46d91b83 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -15,7 +15,7 @@ Virtual Machine
 ---------------
 
 DevStack should run in any virtual machine running a supported Linux
-release. It will perform best with 2Gb or more of RAM.
+release. It will perform best with 4Gb or more of RAM.
 
 OpenStack Deployment & cloud-init
 ---------------------------------

From 36298eec001f900c00a8ac89143375620af9ce3e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 4 Feb 2015 10:29:31 +1100
Subject: [PATCH 0298/3333] Add default for YUM

This allows tools/* to use install_packages, etc, without having to
pull in stackrc for the $YUM definition.  Alternative to
Ief944af1ab177638bf818624a216751821e6330b

Change-Id: I7fe37079240e8cabbdffdcae5ad9d21e122e43c2
---
 functions-common | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 4d1c89ae15..1c114a156d 100644
--- a/functions-common
+++ b/functions-common
@@ -1208,7 +1208,7 @@ function uninstall_package {
     if is_ubuntu; then
         apt_get purge "$@"
     elif is_fedora; then
-        sudo $YUM remove -y "$@" ||:
+        sudo ${YUM:-yum} remove -y "$@" ||:
     elif is_suse; then
         sudo zypper rm "$@"
     else
@@ -1229,7 +1229,7 @@ function yum_install {
     # https://bugzilla.redhat.com/show_bug.cgi?id=965567
     $sudo http_proxy=$http_proxy https_proxy=$https_proxy \
         no_proxy=$no_proxy \
-        $YUM install -y "$@" 2>&1 | \
+        ${YUM:-yum} install -y "$@" 2>&1 | \
         awk '
             BEGIN { fail=0 }
             /No package/ { fail=1 }
@@ -1239,7 +1239,7 @@ function yum_install {
 
     # also ensure we catch a yum failure
     if [[ ${PIPESTATUS[0]} != 0 ]]; then
-        die $LINENO "$YUM install failure"
+        die $LINENO "${YUM:-yum} install failure"
     fi
 }
 

From 58e694e223138dde60fb82f1ca9ebbdbd665ba09 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 4 Feb 2015 12:45:50 +0100
Subject: [PATCH 0299/3333] Use the site-wide boto.cfg

The boto.cfg in the TEMPEST_DIR is not read by any tool at the momement,
including tempest and euca2ools.

Adding the ssl setings to the site-wide config file.

Change-Id: Ibeab5671ac81e5092da0ee7ec1ecf867f8555082
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 1ae945779d..e534e35fa3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -65,7 +65,7 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 
 
 BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
-BOTO_CONF=$TEMPEST_DIR/boto.cfg
+BOTO_CONF=/etc/boto.cfg
 
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}

From d97ee3095eea53ed21da397c6b46c01948bc0e76 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 4 Feb 2015 12:35:39 -0600
Subject: [PATCH 0300/3333] Update minimum bash version

Clarify our position on bash and other shells.

Change-Id: I30e801afa03f8d7235556b0933d0205a30310899
---
 HACKING.rst        |  2 +-
 doc/source/faq.rst | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/HACKING.rst b/HACKING.rst
index dcde141782..b3c82a37a8 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -6,7 +6,7 @@ General
 -------
 
 DevStack is written in UNIX shell script.  It uses a number of bash-isms
-and so is limited to Bash (version 3 and up) and compatible shells.
+and so is limited to Bash (version 4 and up) and compatible shells.
 Shell script was chosen because it best illustrates the steps used to
 set up and interact with OpenStack components.
 
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index fd9c736736..a449f496ee 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -70,6 +70,18 @@ Q: What about Fedora/RHEL/CentOS?
 Q: Are there any differences between Ubuntu and Fedora support?
     A: Neutron is not fully supported prior to Fedora 18 due lack of
     OpenVSwitch packages.
+Q: Why can't I use another shell?
+    A: DevStack now uses some specific bash-ism that require Bash 4, such
+    as associative arrays. Simple compatibility patches have been accepted
+    in the past when they are not complex, at this point no additional
+    compatibility patches will be considered except for shells matching
+    the array functionality as it is very ingrained in the repo and project
+    management.
+Q: But, but, can't I test on OS/X?
+   A: Yes, even you, core developer who complained about this, needs to
+   install bash 4 via homebrew to keep running tests on OS/X.  Get a Real
+   Operating System.   (For most of you who don't know, I am refering to
+   myself.)
 
 Operation and Configuration
 ===========================

From 005b1db5c0f7ba6b20d4eede2b731614bc757cb4 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 4 Feb 2015 10:53:31 -0500
Subject: [PATCH 0301/3333] Add Service token to conf in single vm
 documentation

This is probably the 3rd time i got bitten by this, So
filing a review :)

Change-Id: Icd0834dda9c7ef806eb0fe976de85130e0220781
---
 doc/source/guides/single-machine.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 17e9b9e153..70287a9037 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -108,6 +108,7 @@ do the following:
     MYSQL_PASSWORD=iheartdatabases
     RABBIT_PASSWORD=flopsymopsy
     SERVICE_PASSWORD=iheartksl
+    SERVICE_TOKEN=xyzpdqlazydog
 
 Run DevStack:
 

From 1a669dce052e45b0e7de74e1613c06f41b6be1ce Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Thu, 5 Feb 2015 11:54:12 +0900
Subject: [PATCH 0302/3333] lib/neutron: Update comments about entry points

Change-Id: Iefb8057f71d4a3589cb3f0b18375779dd3896916
---
 lib/neutron | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 0fb8d00a11..698f6b71b1 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -10,24 +10,25 @@
 
 # ``stack.sh`` calls the entry points in this order:
 #
-# - install_neutron
-# - install_neutronclient
 # - install_neutron_agent_packages
+# - install_neutronclient
+# - install_neutron
 # - install_neutron_third_party
 # - configure_neutron
 # - init_neutron
 # - configure_neutron_third_party
 # - init_neutron_third_party
 # - start_neutron_third_party
-# - create_neutron_cache_dir
 # - create_nova_conf_neutron
 # - start_neutron_service_and_check
+# - check_neutron_third_party_integration
 # - start_neutron_agents
 # - create_neutron_initial_network
 # - setup_neutron_debug
 #
 # ``unstack.sh`` calls the entry points in this order:
 #
+# - teardown_neutron_debug
 # - stop_neutron
 # - stop_neutron_third_party
 # - cleanup_neutron

From e3e9b226d003589028a05cfa10e153eaac5a0349 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 5 Feb 2015 12:34:12 +0000
Subject: [PATCH 0303/3333] Revert "Make neutron the default in devstack"

The simple case of a single interface doesn't work
out of the box, and this is now failing for lots of
people. We need to back up and get that working.

This reverts commit c906bb38851037880f557b15ad30c9b0bb7fa295.

Change-Id: If20df670e06cda2d65028bceb46d257d011cf917
---
 stackrc | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/stackrc b/stackrc
index ce54fae432..2dd56e8104 100644
--- a/stackrc
+++ b/stackrc
@@ -32,11 +32,15 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 # ``disable_service`` functions in ``local.conf``.
 # For example, to enable Swift add this to ``local.conf``:
 #  enable_service s-proxy s-object s-container s-account
-# In order to enable nova-networking add the following settings in
-# `` local.conf ``:
+# In order to enable Neutron (a single node setup) add the following
+# settings in ``local.conf``:
 #  [[local|localrc]]
-#  disable_service q-svc q-agt q-dhcp q-l3 q-meta
-#  enable_service n-net
+#  disable_service n-net
+#  enable_service q-svc
+#  enable_service q-agt
+#  enable_service q-dhcp
+#  enable_service q-l3
+#  enable_service q-meta
 #  # Optional, to enable tempest configuration as part of devstack
 #  enable_service tempest
 function isset {
@@ -50,16 +54,14 @@ function isset {
 
 # this allows us to pass ENABLED_SERVICES
 if ! isset ENABLED_SERVICES ; then
-    # core compute (glance / keystone / nova)
-    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch,n-xvnc,n-cauth
+    # core compute (glance / keystone / nova (+ nova-network))
+    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-xvnc,n-cauth
     # cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # heat
     ENABLED_SERVICES+=,h-eng,h-api,h-api-cfn,h-api-cw
     # dashboard
     ENABLED_SERVICES+=,horizon
-    # neutron
-    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
     # additional services
     ENABLED_SERVICES+=,rabbit,tempest,mysql
 fi

From 36891dc1435741b8caf747b8ff82d6b25594f2c5 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Tue, 3 Feb 2015 16:22:44 +0000
Subject: [PATCH 0304/3333] Stop neutron services more explicitly

After an unstack.sh several neutron services are left running. This
change tries to do a better (but not always successful) job of
stopping neutron agents.

stop_process does its own checking to see if a service is enabled
so we don't need to check before calling.

Change-Id: I8becbe9db56121cbc619a6d156b18f6c6d31a6e7
---
 lib/neutron                           | 8 ++++++++
 lib/neutron_plugins/services/metering | 2 +-
 lib/neutron_plugins/services/vpn      | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 0f49476c4f..ededef50e3 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -749,13 +749,21 @@ function start_neutron_agents {
 # stop_neutron() - Stop running processes (non-screen)
 function stop_neutron {
     if is_service_enabled q-dhcp; then
+        stop_process q-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
+
+    stop_process q-svc
+    stop_process q-l3
+
     if is_service_enabled q-meta; then
         sudo pkill -9 -f neutron-ns-metadata-proxy || :
+        stop_process q-meta
     fi
 
+    stop_process q-agt
+
     if is_service_enabled q-lbaas; then
         neutron_lbaas_stop
     fi
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 51123e2ff8..37ba019b98 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -23,7 +23,7 @@ function neutron_agent_metering_configure_agent {
 }
 
 function neutron_metering_stop {
-    :
+    stop_process q-metering
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 7e80b5b5f8..5912eab9ca 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -28,6 +28,7 @@ function neutron_vpn_stop {
     if [ -n "$pids" ]; then
         sudo kill $pids
     fi
+    stop_process q-vpn
 }
 
 # Restore xtrace

From 2e17d85d80f647d04054aca1571ef1910f9c2c62 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 28 Jan 2015 06:29:03 -0800
Subject: [PATCH 0305/3333] Document where we are going

Somewhat opinionated document on where we want to be going, should be
an accurate first approximation of what Dean and I have chatted about
over the last few weeks. Hopefully helpful in framing where we are
going.

Change-Id: Ia153af27a08203ffc44e37c7db73e04573d3be9f
---
 FUTURE.rst | 113 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 113 insertions(+)
 create mode 100644 FUTURE.rst

diff --git a/FUTURE.rst b/FUTURE.rst
new file mode 100644
index 0000000000..11bea30f0b
--- /dev/null
+++ b/FUTURE.rst
@@ -0,0 +1,113 @@
+=============
+ Quo Vadimus
+=============
+
+Where are we going?
+
+This is a document in Devstack to outline where we are headed in the
+future. The future might be near or far, but this is where we'd like
+to be.
+
+This is intended to help people contribute, because it will be a
+little clearer if a contribution takes us closer to or further away to
+our end game.
+
+==================
+ Default Services
+==================
+
+Devstack is designed as a development environment first. There are a
+lot of ways to compose the OpenStack services, but we do need one
+default.
+
+That should be the Compute Layer (currently Glance + Nova + Cinder +
+Neutron Core (not advanced services) + Keystone). It should be the
+base building block going forward, and the introduction point of
+people to OpenStack via Devstack.
+
+================
+ Service Howtos
+================
+
+Starting from the base building block all services included in
+OpenStack should have an overview page in the Devstack
+documentation. That should include the following:
+
+- A helpful high level overview of that service
+- What it depends on (both other OpenStack services and other system
+  components)
+- What new daemons are needed to be started, including where they
+  should live
+
+This provides a map for people doing multinode testing to understand
+what portions are control plane, which should live on worker nodes.
+
+Service how to pages will start with an ugly "This team has provided
+no information about this service" until someone does.
+
+===================
+ Included Services
+===================
+
+Devstack doesn't need to eat the world. Given the existence of the
+external devstack plugin architecture, the future direction is to move
+the bulk of the support code out of devstack itself and into external
+plugins.
+
+This will also promote a more clean separation between services.
+
+=============================
+ Included Backends / Drivers
+=============================
+
+Upstream Devstack should only include Open Source backends / drivers,
+it's intent is for Open Source development of OpenStack. Proprietary
+drivers should be supported via external plugins.
+
+Just being Open Source doesn't mean it should be in upstream Devstack
+if it's not required for base development of OpenStack
+components. When in doubt, external plugins should be used.
+
+========================================
+ OpenStack Services vs. System Services
+========================================
+
+ENABLED_SERVICES is currently entirely too overloaded. We should have
+a separation of actual OpenStack services that you have to run (n-cpu,
+g-api) and required backends like mysql and rabbitmq.
+
+===========================
+ Splitting up of Functions
+===========================
+
+The functions-common file has grown over time, and needs to be split
+up into smaller libraries that handle specific domains.
+
+======================
+ Testing of Functions
+======================
+
+Every function in a functions file should get tests. The devstack
+testing framework is young, but we do have some unit tests for the
+tree, and those should be enhanced.
+
+==============================
+ Not Co-Gating with the World
+==============================
+
+As projects spin up functional test jobs, Devstack should not be
+co-gated with every single one of those. The Devstack team has one of
+the fastest turn arounds for blocking bugs of any Open Stack
+project.
+
+Basic service validation should be included as part of Devstack
+installation to mitigate this.
+
+============================
+ Documenting all the things
+============================
+
+Devstack started off as an explanation as much as an install
+script. We would love contributions to that further enhance the
+comments and explanations about what is happening, even if it seems a
+little pedantic at times.

From 75afd6d33c93f510fb9f62abd443eac4131480e6 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Tue, 20 Jan 2015 17:39:25 +0100
Subject: [PATCH 0306/3333] guides: Notes to setup DevStack with Nested KVM
 Virtualization

Add a document with procedure to configure KVM-based nested
virtualization on the physical host and to configure DevStack (in a VM)
to take advantage of it.

Current topics:

   - Configure nested virt on Intel hosts
   - Configure nested virt on AMD hosts
   - Expose virt extensions to DevStack VM
   - Ensure DevStack VM is using KVM

Change-Id: Ibe6fa482cc0d51183438d99680a0e10d0da652cb
---
 .../guides/devstack-with-nested-kvm.rst       | 139 ++++++++++++++++++
 doc/source/index.rst                          |   8 +
 2 files changed, 147 insertions(+)
 create mode 100644 doc/source/guides/devstack-with-nested-kvm.rst

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
new file mode 100644
index 0000000000..2538c8d031
--- /dev/null
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -0,0 +1,139 @@
+=======================================================
+Configure DevStack with KVM-based Nested Virtualization
+=======================================================
+
+When using virtualization technologies like KVM, one can take advantage
+of "Nested VMX" (i.e. the ability to run KVM on KVM) so that the VMs in
+cloud (Nova guests) can run relatively faster than with plain QEMU
+emulation.
+
+Kernels shipped with Linux distributions doesn't have this enabled by
+default. This guide outlines the configuration details to enable nested
+virtualization in KVM-based environments. And how to setup DevStack
+(that'll run in a VM) to take advantage of this.
+
+
+Nested Virtualization Configuration
+===================================
+
+Configure Nested KVM for Intel-based Machines
+---------------------------------------------
+
+Procedure to enable nested KVM virtualization on AMD-based machines.
+
+Check if the nested KVM Kernel parameter is enabled:
+
+::
+
+    cat /sys/module/kvm_intel/parameters/nested
+    N
+
+Temporarily remove the KVM intel Kernel module, enable nested
+virtualization to be persistent across reboots and add the Kernel
+module back:
+
+::
+
+    sudo rmmod kvm-intel
+    sudo sh -c "echo 'options kvm-intel nested=y' >> /etc/modprobe.d/dist.conf"
+    sudo modprobe kvm-intel
+
+Ensure the Nested KVM Kernel module parameter for Intel is enabled on
+the host:
+
+::
+
+    cat /sys/module/kvm_intel/parameters/nested
+    Y
+
+    modinfo kvm_intel | grep nested
+    parm:           nested:bool
+
+Start your VM, now it should have KVM capabilities -- you can verify
+that by ensuring `/dev/kvm` character device is present.
+
+
+Configure Nested KVM for AMD-based Machines
+--------------------------------------------
+
+Procedure to enable nested KVM virtualization on AMD-based machines.
+
+Check if the nested KVM Kernel parameter is enabled:
+
+::
+
+    cat /sys/module/kvm_amd/parameters/nested
+    0
+
+
+Temporarily remove the KVM AMD Kernel module, enable nested
+virtualization to be persistent across reboots and add the Kernel module
+back:
+
+::
+
+    sudo rmmod kvm-amd
+    sudo sh -c "echo 'options amd nested=1' >> /etc/modprobe.d/dist.conf"
+    sudo modprobe kvm-amd
+
+Ensure the Nested KVM Kernel module parameter for AMD is enabled on the
+host:
+
+::
+
+    cat /sys/module/kvm_amd/parameters/nested
+    1
+
+    modinfo kvm_amd | grep -i nested
+    parm:           nested:int
+
+To make the above value persistent across reboots, add an entry in
+/etc/modprobe.ddist.conf so it looks as below::
+
+    cat /etc/modprobe.d/dist.conf
+    options kvm-amd nested=y
+
+
+Expose Virtualization Extensions to DevStack VM
+-----------------------------------------------
+
+Edit the VM's libvirt XML configuration via `virsh` utility:
+
+::
+
+    sudo virsh edit devstack-vm
+
+Add the below snippet to expose the host CPU features to the VM:
+
+::
+
+    <cpu mode='host-passthrough'>
+    </cpu>
+
+
+Ensure DevStack VM is Using KVM
+-------------------------------
+
+Before invoking ``stack.sh`` in the VM, ensure that KVM is enabled. This
+can be verified by checking for the presence of the file `/dev/kvm` in
+your VM. If it is present, DevStack will default to using the config
+attribute `virt_type = kvm` in `/etc/nova.conf`; otherwise, it'll fall
+back to `virt_type=qemu`, i.e. plain QEMU emulation.
+
+Optionally, to explicitly set the type of virtualization, to KVM, by the
+libvirt driver in Nova, the below config attribute can be used in
+DevStack's ``local.conf``:
+
+::
+
+    LIBVIRT_TYPE=kvm
+
+
+Once DevStack is configured succesfully, verify if the Nova instances
+are using KVM by noticing the QEMU CLI invoked by Nova is using the
+parameter `accel=kvm`, e.g.:
+
+::
+
+    ps -ef | grep -i qemu
+    root     29773     1  0 11:24 ?        00:00:00 /usr/bin/qemu-system-x86_64 -machine accel=kvm [. . .]
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 7188f6ecf4..1aaab6e2d6 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -66,6 +66,7 @@ Walk through various setups used by stackers
    guides/single-machine
    guides/multinode-lab
    guides/neutron
+   guides/devstack-with-nested-kvm
 
 All-In-One Single VM
 --------------------
@@ -94,6 +95,13 @@ Building a DevStack cluster with :doc:`Neutron Networking <guides/neutron>`.
 This guide is meant for building lab environments with a dedicated
 control node and multiple compute nodes.
 
+DevStack with KVM-based Nested Virtualization
+---------------------------------------------
+
+Procedure to setup :doc:`DevStack with KVM-based Nested Virtualization
+<guides/devstack-with-nested-kvm>`. With this setup, Nova instances
+will be more performant than with plain QEMU emulation.
+
 DevStack Documentation
 ======================
 

From cbfe93bb4861d3129b82984c3aefc658a743d69b Mon Sep 17 00:00:00 2001
From: Maru Newby <marun@redhat.com>
Date: Thu, 5 Feb 2015 00:05:23 +0000
Subject: [PATCH 0307/3333] Add postgresql dev package as testonly neutron dep

The neutron functional job needs to build psycopg2 which has a
dependency on postgresql dev packages.

Change-Id: Ie5c8e2bd02e148d6638f4a4c1fbf6667c30313d5
---
 files/debs/neutron      | 1 +
 files/rpms-suse/neutron | 1 +
 files/rpms/neutron      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/neutron b/files/debs/neutron
index 5a59b22b9d..3f4b6d2999 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -6,6 +6,7 @@ iputils-arping
 libmysqlclient-dev  # testonly
 mysql-server #NOPRIME
 sudo
+postgresql-server-dev-all       # testonly
 python-iso8601
 python-paste
 python-routes
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 50ee145928..66d6e4cad0 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -5,6 +5,7 @@ ebtables
 iptables
 iputils
 mariadb # NOPRIME
+postgresql-devel        # testonly
 python-eventlet
 python-greenlet
 python-iso8601
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 59152d6e93..d11dab7e1a 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -9,6 +9,7 @@ mysql-connector-python
 mysql-devel  # testonly
 mysql-server # NOPRIME
 openvswitch # NOPRIME
+postgresql-devel        # testonly
 python-eventlet
 python-greenlet
 python-iso8601

From f8b4f85aeb7d38db029eb89c28d00082b71eab2b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 4 Feb 2015 15:46:03 -0500
Subject: [PATCH 0308/3333] implement elasticsearch pkg for devstack

the first implementation of arbitrary installation in tree for
components for elasticsearch.

Change-Id: I88e852ad009735ae77c6d4c19c4f4838c49cc0ad
---
 pkg/elasticsearch.sh | 126 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)
 create mode 100755 pkg/elasticsearch.sh

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
new file mode 100755
index 0000000000..15e1b2b594
--- /dev/null
+++ b/pkg/elasticsearch.sh
@@ -0,0 +1,126 @@
+#!/bin/bash -xe
+
+# basic reference point for things like filecache
+#
+# TODO(sdague): once we have a few of these I imagine the download
+# step can probably be factored out to something nicer
+TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
+FILES=$TOP_DIR/files
+source $TOP_DIR/functions
+
+# Package source and version, all pkg files are expected to have
+# something like this, as well as a way to override them.
+ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.4.2}
+ELASTICSEARCH_BASEURL=${ELASTICSEARCH_BASEURL:-https://download.elasticsearch.org/elasticsearch/elasticsearch}
+
+# Elastic search actual implementation
+function wget_elasticsearch {
+    local file=${1}
+
+    if [ ! -f ${FILES}/${file} ]; then
+        wget $ELASTICSEARCH_BASEURL/${file} -O ${FILES}/${file}
+    fi
+
+    if [ ! -f ${FILES}/${file}.sha1.txt ]; then
+        wget $ELASTICSEARCH_BASEURL/${file}.sha1.txt -O ${FILES}/${file}.sha1.txt
+    fi
+
+    pushd ${FILES};  sha1sum ${file} > ${file}.sha1.gen;  popd
+
+    if ! diff ${FILES}/${file}.sha1.gen ${FILES}/${file}.sha1.txt; then
+        echo "Invalid elasticsearch download. Could not install."
+        return 1
+    fi
+    return 0
+}
+
+function download_elasticsearch {
+    if is_ubuntu; then
+        wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.deb
+    elif is_fedora; then
+        wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
+    fi
+}
+
+function configure_elasticsearch {
+    # currently a no op
+    ::
+}
+
+function start_elasticsearch {
+    if is_ubuntu; then
+        sudo /etc/init.d/elasticsearch start
+    elif is_fedora; then
+        sudo /bin/systemctl start elasticsearch.service
+    else
+        echo "Unsupported architecture...can not start elasticsearch."
+    fi
+}
+
+function stop_elasticsearch {
+    if is_ubuntu; then
+        sudo /etc/init.d/elasticsearch stop
+    elif is_fedora; then
+        sudo /bin/systemctl stop elasticsearch.service
+    else
+        echo "Unsupported architecture...can not stop elasticsearch."
+    fi
+}
+
+function install_elasticsearch {
+    if is_package_installed elasticsearch; then
+        echo "Note: elasticsearch was already installed."
+        return
+    fi
+    if is_ubuntu; then
+        is_package_installed openjdk-7-jre-headless || install_package openjdk-7-jre-headless
+
+        sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
+        sudo update-rc.d elasticsearch defaults 95 10
+    elif is_fedora; then
+        is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
+        yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
+        sudo /bin/systemctl daemon-reload
+        sudo /bin/systemctl enable elasticsearch.service
+    else
+        echo "Unsupported install of elasticsearch on this architecture."
+    fi
+}
+
+function uninstall_elasticsearch {
+    if is_package_installed elasticsearch; then
+        if is_ubuntu; then
+            sudo apt-get purge elasticsearch
+        elif is_fedora; then
+            sudo yum remove elasticsearch
+        else
+            echo "Unsupported install of elasticsearch on this architecture."
+        fi
+    fi
+}
+
+# The PHASE dispatcher. All pkg files are expected to basically cargo
+# cult the case statement.
+PHASE=$1
+echo "Phase is $PHASE"
+
+case $PHASE in
+    download)
+        download_elasticsearch
+        ;;
+    install)
+        install_elasticsearch
+        ;;
+    configure)
+        configure_elasticsearch
+        ;;
+    start)
+        start_elasticsearch
+        ;;
+    stop)
+        stop_elasticsearch
+        ;;
+    uninstall)
+        uninstall_elasticsearch
+        ;;
+esac

From 0ea8b72a20be9026f025eaa6d9b4277b058aa735 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Fri, 6 Feb 2015 22:37:53 +0300
Subject: [PATCH 0309/3333] Make EC2 compatible with current AWS CLI.

Nova listens for EC2 calls now at the URL without path -
http://some.server.com:8773/
I was made in review -
https://review.openstack.org/#/c/152496/

So I suggest to change EC2 urls in keystone catalog.

Change-Id: Ia2975ce0f6a30eed6016733e12c98b5f97648307
Closes-Bug: 1417555
---
 files/default_catalog.templates | 6 +++---
 lib/nova                        | 6 +++---
 lib/tempest                     | 2 +-
 tools/create_userrc.sh          | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/files/default_catalog.templates b/files/default_catalog.templates
index a18d38f606..4aab4160c1 100644
--- a/files/default_catalog.templates
+++ b/files/default_catalog.templates
@@ -30,9 +30,9 @@ catalog.RegionOne.volumev2.internalURL = http://%SERVICE_HOST%:8776/v2/$(tenant_
 catalog.RegionOne.volumev2.name = Volume Service V2
 
 
-catalog.RegionOne.ec2.publicURL = http://%SERVICE_HOST%:8773/services/Cloud
-catalog.RegionOne.ec2.adminURL = http://%SERVICE_HOST%:8773/services/Admin
-catalog.RegionOne.ec2.internalURL = http://%SERVICE_HOST%:8773/services/Cloud
+catalog.RegionOne.ec2.publicURL = http://%SERVICE_HOST%:8773/
+catalog.RegionOne.ec2.adminURL = http://%SERVICE_HOST%:8773/
+catalog.RegionOne.ec2.internalURL = http://%SERVICE_HOST%:8773/
 catalog.RegionOne.ec2.name = EC2 Service
 
 
diff --git a/lib/nova b/lib/nova
index 0f4729fb63..f1cf74ff72 100644
--- a/lib/nova
+++ b/lib/nova
@@ -397,9 +397,9 @@ function create_nova_accounts {
                 "ec2" "EC2 Compatibility Layer")
             get_or_create_endpoint $ec2_service \
                 "$REGION_NAME" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/services/Cloud" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/services/Admin" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/services/Cloud"
+                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
+                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
+                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
         fi
     fi
 
diff --git a/lib/tempest b/lib/tempest
index 86f30b4a40..9058fa624e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -359,7 +359,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
 
     # boto
-    iniset $TEMPEST_CONFIG boto ec2_url "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/services/Cloud"
+    iniset $TEMPEST_CONFIG boto ec2_url "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
     iniset $TEMPEST_CONFIG boto s3_url "http://$SERVICE_HOST:${S3_SERVICE_PORT:-3333}"
     iniset $TEMPEST_CONFIG boto s3_materials_path "$BOTO_MATERIALS_PATH"
     iniset $TEMPEST_CONFIG boto ari_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd.manifest.xml
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index b43fd883a3..f067ed1f4b 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -131,7 +131,7 @@ export -n SERVICE_TOKEN SERVICE_ENDPOINT OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT
 
 EC2_URL=$(openstack endpoint show -f value -c publicurl ec2 || true)
 if [[ -z $EC2_URL ]]; then
-    EC2_URL=http://localhost:8773/services/Cloud
+    EC2_URL=http://localhost:8773/
 fi
 
 S3_URL=$(openstack endpoint show -f value -c publicurl s3 || true)

From 365421b99a6e76cd3c2e3dbb02638005e456abf8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 6 Feb 2015 15:27:43 -0500
Subject: [PATCH 0310/3333] isolate unit tests from stackrc HOST_IP check

The HOST_IP check in stackrc is useful for real users, but some cloud
nodes that infra runs don't detect it correctly, and it's not actually
required for unit tests to work right.

Change-Id: Id2aaa713aea91825021e9d8d49d19f3e40a8e6c9
---
 tests/test_ip.sh             | 3 ---
 tests/test_libs_from_pypi.sh | 2 ++
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/test_ip.sh b/tests/test_ip.sh
index e9cbcca4a4..add8d1ae65 100755
--- a/tests/test_ip.sh
+++ b/tests/test_ip.sh
@@ -8,9 +8,6 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 # Import common functions
 source $TOP/functions
 
-# Import configuration
-source $TOP/openrc
-
 
 echo "Testing IP addr functions"
 
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 7e96bae7bb..6e1b515efd 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -17,6 +17,8 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 
 export TOP_DIR=$TOP
 
+# we don't actually care about the HOST_IP
+HOST_IP="don't care"
 # Import common functions
 source $TOP/functions
 source $TOP/stackrc

From 76a08f5a931c9c9a052d8a5bdcd5d99621ec41c0 Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Fri, 6 Feb 2015 21:43:52 +0000
Subject: [PATCH 0311/3333] Remove OpenDaylight from being in-tree for devstack

Now that we have a patch to make this pluggable [1], lets remove this
from the devstack repository.

[1] https://review.openstack.org/#/c/153700/

Change-Id: Ia23f99476ec16df9cc12f63864189835a09eb644
---
 doc/source/index.rst        |   2 -
 extras.d/80-opendaylight.sh |  76 -------------
 lib/opendaylight            | 215 ------------------------------------
 3 files changed, 293 deletions(-)
 delete mode 100644 extras.d/80-opendaylight.sh
 delete mode 100644 lib/opendaylight

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 0763fb83cb..399d97960d 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -155,7 +155,6 @@ Scripts
 * `lib/ldap <lib/ldap.html>`__
 * `lib/neutron <lib/neutron.html>`__
 * `lib/nova <lib/nova.html>`__
-* `lib/opendaylight <lib/opendaylight.html>`__
 * `lib/oslo <lib/oslo.html>`__
 * `lib/rpc\_backend <lib/rpc_backend.html>`__
 * `lib/sahara <lib/sahara.html>`__
@@ -176,7 +175,6 @@ Scripts
 * `extras.d/70-trove.sh <extras.d/70-trove.sh.html>`__
 * `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
 * `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
-* `extras.d/80-opendaylight.sh <extras.d/80-opendaylight.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
 
 Configuration
diff --git a/extras.d/80-opendaylight.sh b/extras.d/80-opendaylight.sh
deleted file mode 100644
index b673777e3a..0000000000
--- a/extras.d/80-opendaylight.sh
+++ /dev/null
@@ -1,76 +0,0 @@
-# opendaylight.sh - DevStack extras script
-
-if is_service_enabled odl-server odl-compute; then
-    # Initial source
-    [[ "$1" == "source" ]] && source $TOP_DIR/lib/opendaylight
-fi
-
-if is_service_enabled odl-server; then
-    if [[ "$1" == "source" ]]; then
-        # no-op
-        :
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        install_opendaylight
-        configure_opendaylight
-        init_opendaylight
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        configure_ml2_odl
-        # This has to start before Neutron
-        start_opendaylight
-    elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
-        # no-op
-        :
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_opendaylight
-        cleanup_opendaylight
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        # no-op
-        :
-    fi
-fi
-
-if is_service_enabled odl-compute; then
-    if [[ "$1" == "source" ]]; then
-        # no-op
-        :
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        install_opendaylight-compute
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        if is_service_enabled nova; then
-            create_nova_conf_neutron
-        fi
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        echo_summary "Initializing OpenDaylight"
-        ODL_LOCAL_IP=${ODL_LOCAL_IP:-$HOST_IP}
-        ODL_MGR_PORT=${ODL_MGR_PORT:-6640}
-        read ovstbl <<< $(sudo ovs-vsctl get Open_vSwitch . _uuid)
-        sudo ovs-vsctl set-manager tcp:$ODL_MGR_IP:$ODL_MGR_PORT
-        if [[ -n "$ODL_PROVIDER_MAPPINGS" ]] && [[ "$ENABLE_TENANT_VLANS" == "True" ]]; then
-            sudo ovs-vsctl set Open_vSwitch $ovstbl \
-                other_config:provider_mappings=$ODL_PROVIDER_MAPPINGS
-        fi
-        sudo ovs-vsctl set Open_vSwitch $ovstbl other_config:local_ip=$ODL_LOCAL_IP
-    elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
-        # no-op
-        :
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        sudo ovs-vsctl del-manager
-        BRIDGES=$(sudo ovs-vsctl list-br)
-        for bridge in $BRIDGES ; do
-            sudo ovs-vsctl del-controller $bridge
-        done
-
-        stop_opendaylight-compute
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        # no-op
-        :
-    fi
-fi
diff --git a/lib/opendaylight b/lib/opendaylight
deleted file mode 100644
index 6518673524..0000000000
--- a/lib/opendaylight
+++ /dev/null
@@ -1,215 +0,0 @@
-#!/bin/bash
-#
-# lib/opendaylight
-# Functions to control the configuration and operation of the opendaylight service
-
-# Dependencies:
-#
-# ``functions`` file
-# ``DEST`` must be defined
-# ``STACK_USER`` must be defined
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - is_opendaylight_enabled
-# - is_opendaylight-compute_enabled
-# - install_opendaylight
-# - install_opendaylight-compute
-# - configure_opendaylight
-# - init_opendaylight
-# - start_opendaylight
-# - stop_opendaylight-compute
-# - stop_opendaylight
-# - cleanup_opendaylight
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# For OVS_BRIDGE and PUBLIC_BRIDGE
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-
-# Defaults
-# --------
-
-# The IP address of ODL. Set this in local.conf.
-# ODL_MGR_IP=
-ODL_MGR_IP=${ODL_MGR_IP:-$SERVICE_HOST}
-
-# The ODL endpoint URL
-ODL_ENDPOINT=${ODL_ENDPOINT:-http://${ODL_MGR_IP}:8080/controller/nb/v2/neutron}
-
-# The ODL username
-ODL_USERNAME=${ODL_USERNAME:-admin}
-
-# The ODL password
-ODL_PASSWORD=${ODL_PASSWORD:-admin}
-
-# Short name of ODL package
-ODL_NAME=${ODL_NAME:-distribution-karaf-0.2.1-Helium-SR1.1}
-
-# <define global variables here that belong to this project>
-ODL_DIR=$DEST/opendaylight
-
-# The OpenDaylight Package, currently using 'Hydrogen' release
-ODL_PKG=${ODL_PKG:-distribution-karaf-0.2.1-Helium-SR1.1.zip}
-
-# The OpenDaylight URL
-ODL_URL=${ODL_URL:-https://nexus.opendaylight.org/content/repositories/public/org/opendaylight/integration/distribution-karaf/0.2.1-Helium-SR1.1/}
-
-# Default arguments for OpenDaylight. This is typically used to set
-# Java memory options.
-# ``ODL_ARGS=Xmx1024m -XX:MaxPermSize=512m``
-ODL_ARGS=${ODL_ARGS:-"-XX:MaxPermSize=384m"}
-
-# How long to pause after ODL starts to let it complete booting
-ODL_BOOT_WAIT=${ODL_BOOT_WAIT:-20}
-
-# The physical provider network to device mapping
-ODL_PROVIDER_MAPPINGS=${ODL_PROVIDER_MAPPINGS:-physnet1:eth1}
-
-# Enable OpenDaylight l3 forwarding
-ODL_L3=${ODL_L3:-False}
-
-# Enable debug logs for odl ovsdb
-ODL_NETVIRT_DEBUG_LOGS=${ODL_NETVIRT_DEBUG_LOGS:-False}
-
-# The logging config file in ODL
-ODL_LOGGING_CONFIG=${ODL_LOGGING_CONFIG:-${ODL_DIR}/${ODL_NAME}/etc/org.ops4j.pax.logging.cfg}
-
-# Entry Points
-# ------------
-
-# Test if OpenDaylight is enabled
-# is_opendaylight_enabled
-function is_opendaylight_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"odl-" ]] && return 0
-    return 1
-}
-
-# cleanup_opendaylight() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_opendaylight {
-    :
-}
-
-# configure_opendaylight() - Set config files, create data dirs, etc
-function configure_opendaylight {
-    # Add odl-ovsdb-openstack if it's not already there
-    local ODLOVSDB=$(cat $ODL_DIR/$ODL_NAME/etc/org.apache.karaf.features.cfg | grep featuresBoot= | grep odl)
-    if [ "$ODLOVSDB" == "" ]; then
-        sed -i '/^featuresBoot=/ s/$/,odl-ovsdb-openstack/' $ODL_DIR/$ODL_NAME/etc/org.apache.karaf.features.cfg
-    fi
-
-    # Configure OpenFlow 1.3 if it's not there
-    local OFLOW13=$(cat $ODL_DIR/$ODL_NAME/etc/custom.properties | grep ^of.version)
-    if [ "$OFLOW13" == "" ]; then
-        echo "ovsdb.of.version=1.3" >> $ODL_DIR/$ODL_NAME/etc/custom.properties
-    fi
-
-    # Configure L3 if the user wants it
-    if [ "${ODL_L3}" == "True" ]; then
-        # Configure L3 FWD if it's not there
-        local L3FWD=$(cat $ODL_DIR/$ODL_NAME/etc/custom.properties | grep ^ovsdb.l3.fwd.enabled)
-        if [ "$L3FWD" == "" ]; then
-            echo "ovsdb.l3.fwd.enabled=yes" >> $ODL_DIR/$ODL_NAME/etc/custom.properties
-        fi
-    fi
-
-    # Configure DEBUG logs for network virtualization in odl, if the user wants it
-    if [ "${ODL_NETVIRT_DEBUG_LOGS}" == "True" ]; then
-        local OVSDB_DEBUG_LOGS=$(cat $ODL_LOGGING_CONFIG | grep ^log4j.logger.org.opendaylight.ovsdb)
-        if [ "${OVSDB_DEBUG_LOGS}" == "" ]; then
-            echo 'log4j.logger.org.opendaylight.ovsdb = TRACE' >> $ODL_LOGGING_CONFIG
-            echo 'log4j.logger.org.opendaylight.ovsdb.lib = INFO' >> $ODL_LOGGING_CONFIG
-            echo 'log4j.logger.org.opendaylight.ovsdb.openstack.netvirt.impl.NeutronL3Adapter = DEBUG' >> $ODL_LOGGING_CONFIG
-            echo 'log4j.logger.org.opendaylight.ovsdb.openstack.netvirt.impl.TenantNetworkManagerImpl = DEBUG' >> $ODL_LOGGING_CONFIG
-            echo 'log4j.logger.org.opendaylight.ovsdb.plugin.md.OvsdbInventoryManager = INFO' >> $ODL_LOGGING_CONFIG
-        fi
-        local ODL_NEUTRON_DEBUG_LOGS=$(cat $ODL_LOGGING_CONFIG | grep ^log4j.logger.org.opendaylight.controller.networkconfig.neutron)
-        if [ "${ODL_NEUTRON_DEBUG_LOGS}" == "" ]; then
-            echo 'log4j.logger.org.opendaylight.controller.networkconfig.neutron = TRACE' >> $ODL_LOGGING_CONFIG
-        fi
-    fi
-}
-
-function configure_ml2_odl {
-    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_odl url=$ODL_ENDPOINT
-    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_odl username=$ODL_USERNAME
-    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_odl password=$ODL_PASSWORD
-}
-
-# init_opendaylight() - Initialize databases, etc.
-function init_opendaylight {
-    # clean up from previous (possibly aborted) runs
-    # create required data files
-    :
-}
-
-# install_opendaylight() - Collect source and prepare
-function install_opendaylight {
-    local _pwd=$(pwd)
-
-    if is_ubuntu; then
-        install_package maven openjdk-7-jre openjdk-7-jdk
-    else
-        yum_install maven java-1.7.0-openjdk
-    fi
-
-    # Download OpenDaylight
-    mkdir -p $ODL_DIR
-    cd $ODL_DIR
-    wget -N $ODL_URL/$ODL_PKG
-    unzip -u $ODL_PKG
-}
-
-# install_opendaylight-compute - Make sure OVS is installed
-function install_opendaylight-compute {
-    # packages are the same as for Neutron OVS agent
-    _neutron_ovs_base_install_agent_packages
-}
-
-# start_opendaylight() - Start running processes, including screen
-function start_opendaylight {
-    if is_ubuntu; then
-        JHOME=/usr/lib/jvm/java-1.7.0-openjdk-amd64
-    else
-        JHOME=/usr/lib/jvm/java-1.7.0-openjdk
-    fi
-
-    # The flags to ODL have the following meaning:
-    #   -of13: runs ODL using OpenFlow 1.3 protocol support.
-    #   -virt ovsdb: Runs ODL in "virtualization" mode with OVSDB support
-
-    run_process odl-server "cd $ODL_DIR/$ODL_NAME && JAVA_HOME=$JHOME bin/karaf"
-
-    # Sleep a bit to let OpenDaylight finish starting up
-    sleep $ODL_BOOT_WAIT
-}
-
-# stop_opendaylight() - Stop running processes (non-screen)
-function stop_opendaylight {
-    stop_process odl-server
-}
-
-# stop_opendaylight-compute() - Remove OVS bridges
-function stop_opendaylight-compute {
-    # remove all OVS ports that look like Neutron created ports
-    for port in $(sudo ovs-vsctl list port | grep -o -e tap[0-9a-f\-]* -e q[rg]-[0-9a-f\-]*); do
-        sudo ovs-vsctl del-port ${port}
-    done
-
-    # remove all OVS bridges created by Neutron
-    for bridge in $(sudo ovs-vsctl list-br | grep -o -e ${OVS_BRIDGE} -e ${PUBLIC_BRIDGE}); do
-        sudo ovs-vsctl del-br ${bridge}
-    done
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:

From 4f7e0f27e8e0f37f28f3da311c6f3c8866fb850f Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Fri, 6 Feb 2015 16:16:01 -0800
Subject: [PATCH 0312/3333] Configure sahara to work with other secured
 services

Registering SSL parameters in sahara.conf for all openstack
services.

Change-Id: I63dd8a0f6e7b37cfd8140d2783af04505f29285f
Closes-Bug: #1419195
---
 lib/sahara | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/sahara b/lib/sahara
index 44c06d3c46..f2a506c81b 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -128,6 +128,10 @@ function configure_sahara {
     if is_service_enabled neutron; then
         iniset $SAHARA_CONF_FILE DEFAULT use_neutron true
         iniset $SAHARA_CONF_FILE DEFAULT use_floating_ips true
+
+        if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+            iniset $SAHARA_CONF_FILE neutron ca_file $SSL_BUNDLE_FILE
+        fi
     else
         iniset $SAHARA_CONF_FILE DEFAULT use_neutron false
         iniset $SAHARA_CONF_FILE DEFAULT use_floating_ips false
@@ -135,10 +139,30 @@ function configure_sahara {
 
     if is_service_enabled heat; then
         iniset $SAHARA_CONF_FILE DEFAULT infrastructure_engine heat
+
+        if is_ssl_enabled_service "heat" || is_service_enabled tls-proxy; then
+            iniset $SAHARA_CONF_FILE heat ca_file $SSL_BUNDLE_FILE
+        fi
     else
         iniset $SAHARA_CONF_FILE DEFAULT infrastructure_engine direct
     fi
 
+    if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+        iniset $SAHARA_CONF_FILE cinder ca_file $SSL_BUNDLE_FILE
+    fi
+
+    if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
+        iniset $SAHARA_CONF_FILE nova ca_file $SSL_BUNDLE_FILE
+    fi
+
+    if is_ssl_enabled_service "swift" || is_service_enabled tls-proxy; then
+        iniset $SAHARA_CONF_FILE swift ca_file $SSL_BUNDLE_FILE
+    fi
+
+    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
+        iniset $SAHARA_CONF_FILE keystone ca_file $SSL_BUNDLE_FILE
+    fi
+
     iniset $SAHARA_CONF_FILE DEFAULT use_syslog $SYSLOG
 
     # Format logging

From 76549e332e51e6bd53d16656433c90e9da8ce8d5 Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Fri, 6 Feb 2015 16:31:31 -0800
Subject: [PATCH 0313/3333] Removed confusing duplication of ca config for
 keystone

More general check is performed at line 157. No need for this one.

Change-Id: I7de820ca2b2954313b1f591ece7785891868cd27
---
 lib/heat | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/heat b/lib/heat
index 58439d67f8..48e2afc5bb 100644
--- a/lib/heat
+++ b/lib/heat
@@ -134,10 +134,6 @@ function configure_heat {
     iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
     iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
 
-    if is_ssl_enabled_service "key"; then
-        iniset $HEAT_CONF clients_keystone ca_file $SSL_BUNDLE_FILE
-    fi
-
     # ec2authtoken
     iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
 

From 0fc336df89833945457a597ff2a3dfee97517958 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sun, 8 Feb 2015 11:03:02 -0600
Subject: [PATCH 0314/3333] Keystone set debug in config file

Change keystone so that the debug setting is always in the config
file. This way the debug setting is done consistently whether it's
run as keystone-all or in Apache httpd.

Change-Id: I10f091e32b8b12ac71f0e7f613c5d1d3f4a8cbec
---
 lib/keystone | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index d5ccc2f075..1e9db1e760 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -309,8 +309,9 @@ function configure_keystone {
         setup_colorized_logging $KEYSTONE_CONF DEFAULT
     fi
 
+    iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+
     if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
-        iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         # Eliminate the %(asctime)s.%(msecs)03d from the log format strings
         iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
         iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
@@ -532,12 +533,8 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else
-        local EXTRA_PARAMS=""
-        if [ "$ENABLE_DEBUG_LOG_LEVEL" == "True" ]; then
-            EXTRA_PARAMS="--debug"
-        fi
         # Start Keystone in a screen window
-        run_process key "$KEYSTONE_DIR/bin/keystone-all --config-file $KEYSTONE_CONF $EXTRA_PARAMS"
+        run_process key "$KEYSTONE_DIR/bin/keystone-all --config-file $KEYSTONE_CONF"
     fi
 
     echo "Waiting for keystone to start..."

From 85ff5323ff95106eb18c1c6bfd71d75f3980c370 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Wed, 28 Jan 2015 14:28:01 +1000
Subject: [PATCH 0315/3333] Isolate creating service users

The code for creating service users is almost exactly the same. Abstract
this into a function that can be reused and standardized.

Change-Id: I3a4edbff0a928da7ef9b0097a5a8d508fdfab7ff
---
 extras.d/70-tuskar.sh |  6 +-----
 lib/ceilometer        |  7 ++-----
 lib/cinder            |  6 +-----
 lib/glance            |  3 +--
 lib/heat              |  7 +------
 lib/ironic            |  6 +-----
 lib/keystone          | 14 ++++++++++++++
 lib/neutron           |  7 +------
 lib/nova              |  6 +-----
 lib/sahara            |  6 +-----
 lib/swift             | 11 ++++-------
 lib/trove             |  6 +-----
 lib/zaqar             |  6 +-----
 13 files changed, 30 insertions(+), 61 deletions(-)

diff --git a/extras.d/70-tuskar.sh b/extras.d/70-tuskar.sh
index 551916f35a..aa8f46af11 100644
--- a/extras.d/70-tuskar.sh
+++ b/extras.d/70-tuskar.sh
@@ -176,12 +176,8 @@ function stop_tuskar {
 
 # create_tuskar_accounts() - Set up common required tuskar accounts
 function create_tuskar_accounts {
-    # migrated from files/keystone_data.sh
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
 
-    local tuskar_user=$(get_or_create_user "tuskar" "$SERVICE_PASSWORD")
-    get_or_add_user_role $admin_role $tuskar_user $service_tenant
+    create_service_user "tuskar" "admin"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/ceilometer b/lib/ceilometer
index f1617fb9e4..f03bab21fc 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -105,13 +105,10 @@ function is_ceilometer_enabled {
 # SERVICE_TENANT_NAME  ceilometer   ResellerAdmin (if Swift is enabled)
 function create_ceilometer_accounts {
 
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
     # Ceilometer
     if [[ "$ENABLED_SERVICES" =~ "ceilometer-api" ]]; then
-        local ceilometer_user=$(get_or_create_user "ceilometer" "$SERVICE_PASSWORD")
-        get_or_add_user_role $admin_role $ceilometer_user $service_tenant
+
+        create_service_user "ceilometer" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
             local ceilometer_service=$(get_or_create_service "ceilometer" \
diff --git a/lib/cinder b/lib/cinder
index 937689a528..12ba51e49b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -330,14 +330,10 @@ function configure_cinder {
 # Migrated from keystone_data.sh
 function create_cinder_accounts {
 
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
-        local cinder_user=$(get_or_create_user "cinder" "$SERVICE_PASSWORD")
-        get_or_add_user_role $admin_role $cinder_user $service_tenant
+        create_service_user "cinder" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/glance b/lib/glance
index bee57a3100..0340c21ee0 100644
--- a/lib/glance
+++ b/lib/glance
@@ -232,8 +232,7 @@ function configure_glance {
 function create_glance_accounts {
     if is_service_enabled g-api; then
 
-        local glance_user=$(get_or_create_user "glance" "$SERVICE_PASSWORD")
-        get_or_add_user_role service $glance_user $SERVICE_TENANT_NAME
+        create_service_user "glance"
 
         # required for swift access
         if is_service_enabled s-proxy; then
diff --git a/lib/heat b/lib/heat
index 58439d67f8..1a57474122 100644
--- a/lib/heat
+++ b/lib/heat
@@ -246,12 +246,7 @@ function stop_heat {
 
 # create_heat_accounts() - Set up common required heat accounts
 function create_heat_accounts {
-    # migrated from files/keystone_data.sh
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
-    local heat_user=$(get_or_create_user "heat" "$SERVICE_PASSWORD")
-    get_or_add_user_role $admin_role $heat_user $service_tenant
+    create_service_user "heat" "admin"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/ironic b/lib/ironic
index fced2949f4..921bcf1a26 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -358,15 +358,11 @@ function create_ironic_cache_dir {
 # service              ironic     admin        # if enabled
 function create_ironic_accounts {
 
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
     # Ironic
     if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
         # Get ironic user if exists
 
-        local ironic_user=$(get_or_create_user "ironic" "$SERVICE_PASSWORD")
-        get_or_add_user_role $admin_role $ironic_user $service_tenant
+        create_service_user "ironic" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/keystone b/lib/keystone
index d5ccc2f075..8ec4d61862 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -414,6 +414,20 @@ function create_keystone_accounts {
     fi
 }
 
+# Create a user that is capable of verifying keystone tokens for use with auth_token middleware.
+#
+# create_service_user <name> [role]
+#
+# The role defaults to the service role. It is allowed to be provided as optional as historically
+# a lot of projects have configured themselves with the admin or other role here if they are
+# using this user for other purposes beyond simply auth_token middleware.
+function create_service_user {
+    local role=${2:-service}
+
+    local user=$(get_or_create_user "$1" "$SERVICE_PASSWORD")
+    get_or_add_user_role "$role" "$user" "$SERVICE_TENANT_NAME"
+}
+
 # Configure the service to use the auth token middleware.
 #
 # configure_auth_token_middleware conf_file admin_user signing_dir [section]
diff --git a/lib/neutron b/lib/neutron
index 2c7ec94ad0..0ff8813e3e 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -507,14 +507,9 @@ function create_neutron_cache_dir {
 
 # Migrated from keystone_data.sh
 function create_neutron_accounts {
-
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local service_role=$(openstack role list | awk "/ service / { print \$2 }")
-
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
-        local neutron_user=$(get_or_create_user "neutron" "$SERVICE_PASSWORD")
-        get_or_add_user_role $service_role $neutron_user $service_tenant
+        create_service_user "neutron"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/nova b/lib/nova
index 0f4729fb63..c760066f15 100644
--- a/lib/nova
+++ b/lib/nova
@@ -353,14 +353,10 @@ function configure_nova {
 # SERVICE_TENANT_NAME  nova         ResellerAdmin (if Swift is enabled)
 function create_nova_accounts {
 
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
     # Nova
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
 
-        local nova_user=$(get_or_create_user "nova" "$SERVICE_PASSWORD")
-        get_or_add_user_role $admin_role $nova_user $service_tenant
+        create_service_user "nova" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/sahara b/lib/sahara
index 44c06d3c46..cb6ecc3be3 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -61,11 +61,7 @@ TEMPEST_SERVICES+=,sahara
 # service     sahara    admin
 function create_sahara_accounts {
 
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
-    local sahara_user=$(get_or_create_user "sahara" "$SERVICE_PASSWORD")
-    get_or_add_user_role $admin_role $sahara_user $service_tenant
+    create_service_user "sahara" "admin"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/swift b/lib/swift
index 683bc17871..d9f750c27f 100644
--- a/lib/swift
+++ b/lib/swift
@@ -601,12 +601,9 @@ function create_swift_accounts {
 
     KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
 
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
     local another_role=$(openstack role list | awk "/ anotherrole / { print \$2 }")
 
-    local swift_user=$(get_or_create_user "swift" "$SERVICE_PASSWORD")
-    get_or_add_user_role $admin_role $swift_user $service_tenant
+    create_service_user "swift" "admin"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
@@ -623,7 +620,7 @@ function create_swift_accounts {
     die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
     SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
-    get_or_add_user_role $admin_role $SWIFT_USER_TEST1 $swift_tenant_test1
+    get_or_add_user_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
 
     local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
@@ -634,7 +631,7 @@ function create_swift_accounts {
 
     local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
-    get_or_add_user_role $admin_role $swift_user_test2 $swift_tenant_test2
+    get_or_add_user_role admin $swift_user_test2 $swift_tenant_test2
 
     local swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
     die_if_not_set $LINENO swift_domain "Failure creating swift_test domain"
@@ -644,7 +641,7 @@ function create_swift_accounts {
 
     local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password "test4@example.com" $swift_domain)
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
-    get_or_add_user_role $admin_role $swift_user_test4 $swift_tenant_test4
+    get_or_add_user_role admin $swift_user_test4 $swift_tenant_test4
 }
 
 # init_swift() - Initialize rings
diff --git a/lib/trove b/lib/trove
index 5e6b1b39c3..d32c7765e0 100644
--- a/lib/trove
+++ b/lib/trove
@@ -79,13 +79,9 @@ function setup_trove_logging {
 # service              trove     admin        # if enabled
 
 function create_trove_accounts {
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    local service_role=$(openstack role list | awk "/ admin / { print \$2 }")
-
     if [[ "$ENABLED_SERVICES" =~ "trove" ]]; then
 
-        local trove_user=$(get_or_create_user "trove" "$SERVICE_PASSWORD")
-        get_or_add_user_role $service_role $trove_user $service_tenant
+        create_service_user "trove" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/zaqar b/lib/zaqar
index 618ac30534..8b560bb4d5 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -215,11 +215,7 @@ function stop_zaqar {
 }
 
 function create_zaqar_accounts {
-    local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
-    ADMIN_ROLE=$(openstack role list | awk "/ admin / { print \$2 }")
-
-    local zaqar_user=$(get_or_create_user "zaqar" "$SERVICE_PASSWORD")
-    get_or_add_user_role $ADMIN_ROLE $zaqar_user $service_tenant
+    create_service_user "zaqar" "admin"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 

From b1a153ed71b90345119112700a2a2796198fe072 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Mon, 9 Feb 2015 12:43:12 +0900
Subject: [PATCH 0316/3333] plugins.rst: Fix a typo

Change-Id: I3f85166a1e0f2fea02055dae6871746ad1b8d897
---
 doc/source/plugins.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index d1f73771a3..8bb92ed4b9 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -16,7 +16,7 @@ DevStack using this mechanism.
 The script in ``extras.d`` is expected to be mostly a dispatcher to
 functions in a ``lib/*`` script. The scripts are named with a
 zero-padded two digits sequence number prefix to control the order that
-the scripts are called, and with a suffix of ``.sh``. DevSack reserves
+the scripts are called, and with a suffix of ``.sh``. DevStack reserves
 for itself the sequence numbers 00 through 09 and 90 through 99.
 
 Below is a template that shows handlers for the possible command-line

From 347e30877b12fb9d096bcab50255ba992416bfce Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Sat, 7 Feb 2015 15:15:12 +0000
Subject: [PATCH 0317/3333] XenAPI: Use round-robin mirror for Ubuntu

ANL has discontinued their Ubuntu mirror.  Update the target
to be the official round-robin mirror which should be more stable long-term

Change-Id: I1271301d96a44888f45664537435e31dd38ff30d
---
 tools/xen/xenrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 0cbf86118d..43a6ce8a77 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -70,8 +70,8 @@ UBUNTU_INST_TEMPLATE_NAME="Ubuntu 14.04 (64-bit) for DevStack"
 # XenServer 6.1 and later or XCP 1.6 or later
 # 11.10 is only really supported with XenServer 6.0.2 and later
 UBUNTU_INST_ARCH="amd64"
-UBUNTU_INST_HTTP_HOSTNAME="mirror.anl.gov"
-UBUNTU_INST_HTTP_DIRECTORY="/pub/ubuntu"
+UBUNTU_INST_HTTP_HOSTNAME="archive.ubuntu.com"
+UBUNTU_INST_HTTP_DIRECTORY="/ubuntu"
 UBUNTU_INST_HTTP_PROXY=""
 UBUNTU_INST_LOCALE="en_US"
 UBUNTU_INST_KEYBOARD="us"

From fa94dfcb17317b192f8a13f2b833dbcae9f7fde4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 9 Feb 2015 07:50:03 -0500
Subject: [PATCH 0318/3333] remove tuskar

Tuskar server support is proposed as an external plugin here
I67dc8420582a40e18de7d5e00094bccc1184a7f9, we should remove Tuskar
from the main devstack tree.

Change-Id: I93e97e7ae8fd03cabc1245a10588c4474d7e3728
---
 extras.d/70-tuskar.sh | 200 ------------------------------------------
 1 file changed, 200 deletions(-)
 delete mode 100644 extras.d/70-tuskar.sh

diff --git a/extras.d/70-tuskar.sh b/extras.d/70-tuskar.sh
deleted file mode 100644
index aa8f46af11..0000000000
--- a/extras.d/70-tuskar.sh
+++ /dev/null
@@ -1,200 +0,0 @@
-# Install and start the **Tuskar** service
-#
-# To enable, add the following to your localrc
-#
-# enable_service tuskar
-# enable_service tuskar-api
-
-
-if is_service_enabled tuskar; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source, do nothing as functions sourced
-        # are below rather than in lib/tuskar
-        echo_summary "source extras tuskar"
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing Tuskar"
-        install_tuskarclient
-        install_tuskar
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring Tuskar"
-        configure_tuskar
-        configure_tuskarclient
-
-        if is_service_enabled key; then
-            create_tuskar_accounts
-        fi
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        echo_summary "Initializing Tuskar"
-        init_tuskar
-        start_tuskar
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_tuskar
-    fi
-fi
-
-# library code (equivalent to lib/tuskar)
-# ---------
-# - install_tuskarclient
-# - install_tuskar
-# - configure_tuskarclient
-# - configure_tuskar
-# - init_tuskar
-# - start_tuskar
-# - stop_tuskar
-# - cleanup_tuskar
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# tuskar repos
-TUSKAR_REPO=${TUSKAR_REPO:-${GIT_BASE}/openstack/tuskar.git}
-TUSKAR_BRANCH=${TUSKAR_BRANCH:-master}
-
-TUSKARCLIENT_REPO=${TUSKARCLIENT_REPO:-${GIT_BASE}/openstack/python-tuskarclient.git}
-TUSKARCLIENT_BRANCH=${TUSKARCLIENT_BRANCH:-master}
-
-# set up default directories
-TUSKAR_DIR=$DEST/tuskar
-TUSKARCLIENT_DIR=$DEST/python-tuskarclient
-TUSKAR_AUTH_CACHE_DIR=${TUSKAR_AUTH_CACHE_DIR:-/var/cache/tuskar}
-TUSKAR_STANDALONE=$(trueorfalse False TUSKAR_STANDALONE)
-TUSKAR_CONF_DIR=/etc/tuskar
-TUSKAR_CONF=$TUSKAR_CONF_DIR/tuskar.conf
-TUSKAR_API_HOST=${TUSKAR_API_HOST:-$HOST_IP}
-TUSKAR_API_PORT=${TUSKAR_API_PORT:-8585}
-
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,tuskar
-
-# Functions
-# ---------
-
-# Test if any Tuskar services are enabled
-# is_tuskar_enabled
-function is_tuskar_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"tuskar-" ]] && return 0
-    return 1
-}
-
-# cleanup_tuskar() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_tuskar {
-    sudo rm -rf $TUSKAR_AUTH_CACHE_DIR
-}
-
-# configure_tuskar() - Set config files, create data dirs, etc
-function configure_tuskar {
-    setup_develop $TUSKAR_DIR
-
-    if [[ ! -d $TUSKAR_CONF_DIR ]]; then
-        sudo mkdir -p $TUSKAR_CONF_DIR
-    fi
-    sudo chown $STACK_USER $TUSKAR_CONF_DIR
-    # remove old config files
-    rm -f $TUSKAR_CONF_DIR/tuskar-*.conf
-
-    TUSKAR_POLICY_FILE=$TUSKAR_CONF_DIR/policy.json
-
-    cp $TUSKAR_DIR/etc/tuskar/policy.json $TUSKAR_POLICY_FILE
-    cp $TUSKAR_DIR/etc/tuskar/tuskar.conf.sample $TUSKAR_CONF
-
-    # common options
-    iniset $TUSKAR_CONF database connection `database_connection_url tuskar`
-
-    # logging
-    iniset $TUSKAR_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $TUSKAR_CONF DEFAULT use_syslog $SYSLOG
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        # Add color to logging output
-        setup_colorized_logging $TUSKAR_CONF DEFAULT tenant user
-    fi
-
-    configure_auth_token_middleware $TUSKAR_CONF tuskar $TUSKAR_AUTH_CACHE_DIR
-
-    if is_ssl_enabled_service "key"; then
-        iniset $TUSKAR_CONF clients_keystone ca_file $SSL_BUNDLE_FILE
-    fi
-
-    iniset $TUSKAR_CONF tuskar_api bind_port $TUSKAR_API_PORT
-
-}
-
-# init_tuskar() - Initialize database
-function init_tuskar {
-
-    # (re)create tuskar database
-    recreate_database tuskar
-
-    tuskar-dbsync --config-file $TUSKAR_CONF
-    create_tuskar_cache_dir
-}
-
-# create_tuskar_cache_dir() - Part of the init_tuskar() process
-function create_tuskar_cache_dir {
-    # Create cache dirs
-    sudo mkdir -p $TUSKAR_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $TUSKAR_AUTH_CACHE_DIR
-}
-
-# install_tuskarclient() - Collect source and prepare
-function install_tuskarclient {
-    git_clone $TUSKARCLIENT_REPO $TUSKARCLIENT_DIR $TUSKARCLIENT_BRANCH
-    setup_develop $TUSKARCLIENT_DIR
-}
-
-# configure_tuskarclient() - Set config files, create data dirs, etc
-function configure_tuskarclient {
-    setup_develop $TUSKARCLIENT_DIR
-}
-
-# install_tuskar() - Collect source and prepare
-function install_tuskar {
-    git_clone $TUSKAR_REPO $TUSKAR_DIR $TUSKAR_BRANCH
-}
-
-# start_tuskar() - Start running processes, including screen
-function start_tuskar {
-    run_process tuskar-api "tuskar-api --config-file=$TUSKAR_CONF"
-}
-
-# stop_tuskar() - Stop running processes
-function stop_tuskar {
-    # Kill the screen windows
-    local serv
-    for serv in tuskar-api; do
-        stop_process $serv
-    done
-}
-
-# create_tuskar_accounts() - Set up common required tuskar accounts
-function create_tuskar_accounts {
-
-    create_service_user "tuskar" "admin"
-
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        local tuskar_service=$(get_or_create_service "tuskar" \
-                "management" "Tuskar Management Service")
-        get_or_create_endpoint $tuskar_service \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$TUSKAR_API_HOST:$TUSKAR_API_PORT" \
-            "$SERVICE_PROTOCOL://$TUSKAR_API_HOST:$TUSKAR_API_PORT" \
-            "$SERVICE_PROTOCOL://$TUSKAR_API_HOST:$TUSKAR_API_PORT"
-    fi
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:

From b36a13a76a9434daa8257a88a558fb301339970d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 9 Feb 2015 07:51:53 -0500
Subject: [PATCH 0319/3333] gantt is a dead project, remove it

The gantt source trees are dead projects, we should remove them from
devstack.

Change-Id: I0f271891846d2ad7a7a8edd975cdfb4f08419f0c
---
 extras.d/70-gantt.sh | 31 --------------
 lib/gantt            | 98 --------------------------------------------
 2 files changed, 129 deletions(-)
 delete mode 100644 extras.d/70-gantt.sh
 delete mode 100644 lib/gantt

diff --git a/extras.d/70-gantt.sh b/extras.d/70-gantt.sh
deleted file mode 100644
index ac1efba748..0000000000
--- a/extras.d/70-gantt.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-# gantt.sh - Devstack extras script to install Gantt
-
-if is_service_enabled n-sch; then
-    disable_service gantt
-fi
-
-if is_service_enabled gantt; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/gantt
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing Gantt"
-        install_gantt
-        cleanup_gantt
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring Gantt"
-        configure_gantt
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        # Initialize gantt
-        init_gantt
-
-        # Start gantt
-        echo_summary "Starting Gantt"
-        start_gantt
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_gantt
-    fi
-fi
diff --git a/lib/gantt b/lib/gantt
deleted file mode 100644
index 5bd28c2823..0000000000
--- a/lib/gantt
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/bin/bash
-#
-# lib/gantt
-# Install and start **Gantt** scheduler service
-
-# Dependencies:
-#
-# - functions
-# - DEST, DATA_DIR, STACK_USER must be defined
-
-# stack.sh
-# ---------
-# - install_gantt
-# - configure_gantt
-# - init_gantt
-# - start_gantt
-# - stop_gantt
-# - cleanup_gantt
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-# Defaults
-# --------
-
-# set up default directories
-GANTT_DIR=$DEST/gantt
-GANTT_STATE_PATH=${GANTT_STATE_PATH:=$DATA_DIR/gantt}
-GANTT_REPO=${GANTT_REPO:-${GIT_BASE}/openstack/gantt.git}
-GANTT_BRANCH=${GANTT_BRANCH:-master}
-
-GANTTCLIENT_DIR=$DEST/python-ganttclient
-GANTTCLIENT_REPO=${GANTT_REPO:-${GIT_BASE}/openstack/python-ganttclient.git}
-GANTTCLIENT_BRANCH=${GANTT_BRANCH:-master}
-
-# eventually we will have a separate gantt config
-# file but for compatibility reasone stick with
-# nova.conf for now
-GANTT_CONF_DIR=${GANTT_CONF_DIR:-/etc/nova}
-GANTT_CONF=$GANTT_CONF_DIR/nova.conf
-
-# Support entry points installation of console scripts
-GANTT_BIN_DIR=$(get_python_exec_prefix)
-
-
-# Functions
-# ---------
-
-# cleanup_gantt() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_gantt {
-    echo "Cleanup Gantt"
-}
-
-# configure_gantt() - Set config files, create data dirs, etc
-function configure_gantt {
-    echo "Configure Gantt"
-}
-
-# init_gantt() - Initialize database and volume group
-function init_gantt {
-    echo "Initialize Gantt"
-}
-
-# install_gantt() - Collect source and prepare
-function install_gantt {
-    git_clone $GANTT_REPO $GANTT_DIR $GANTT_BRANCH
-    setup_develop $GANTT_DIR
-}
-
-# install_ganttclient() - Collect source and prepare
-function install_ganttclient {
-    echo "Install Gantt Client"
-#    git_clone $GANTTCLIENT_REPO $GANTTCLIENT_DIR $GANTTCLIENT_BRANCH
-#    setup_develop $GANTTCLIENT_DIR
-}
-
-# start_gantt() - Start running processes, including screen
-function start_gantt {
-    if is_service_enabled gantt; then
-        run_process gantt "$GANTT_BIN_DIR/gantt-scheduler --config-file $GANTT_CONF"
-    fi
-}
-
-# stop_gantt() - Stop running processes
-function stop_gantt {
-    echo "Stop Gantt"
-    stop_process gantt
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:

From 1368b98669ae9365193f8cd22bdce1c9abdc5499 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 4 Feb 2015 15:28:18 -0800
Subject: [PATCH 0320/3333] Stop installing tempest

We run tempest inside of tox so no nee to install it. By not installing
it we decouple one more thing from the requirements sync.

Without this patch, due to branchless tempest, tempest must work with
master and all stable branch global requirements.

Although installing tempest should work on master, don't install it
anyway to make the user experience more uniform across master and
stable branches.

Note: Long term we can install this inside of a virtualenv
(I92648fffc1ad6af53006a0970722fd15f4e79dc2) but that logic hasn't landed
yet and installing tempest is breaking us. So leave moving this to a
virtualenv for a later patch.

Change-Id: I78d51f04ed01da4ce8aa0e127be028f969d3b4f8
---
 lib/tempest | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 1ae945779d..e416affc46 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -95,7 +95,8 @@ function remove_disabled_extensions {
 
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
-    setup_develop $TEMPEST_DIR
+    # install testr since its used to process tempest logs
+    pip_install `grep -h testrepository $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1`
     local image_lines
     local images
     local num_images
@@ -319,7 +320,8 @@ function configure_tempest {
     # Run verify_tempest_config -ur to retrieve enabled extensions on API endpoints
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
     local tmp_cfg_file=$(mktemp)
-    $TEMPEST_DIR/tempest/cmd/verify_tempest_config.py -uro $tmp_cfg_file
+    cd $TEMPEST_DIR
+    tox -evenv -- verify-tempest-config -uro $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then

From 00d0da36af934bfdc15a5175e8cac3667e8cd581 Mon Sep 17 00:00:00 2001
From: Wayne Okuma <wayne.okuma@hp.com>
Date: Thu, 22 Jan 2015 16:06:41 -0800
Subject: [PATCH 0321/3333] Adds elasticsearch support as a pre-req for the
 glance-index.

Add elastic search pkg installation and start into the glance install
and start paths.

Change-Id: I53fc37225dd606f627c9f967083007613eb1f1bb
Implements: blueprint catalog-index-service
---
 files/debs/general | 1 +
 files/rpms/general | 1 +
 lib/glance         | 9 +++++++--
 3 files changed, 9 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 lib/glance

diff --git a/files/debs/general b/files/debs/general
index e824d239b4..4050191379 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,3 +27,4 @@ libyaml-dev
 libffi-dev
 libssl-dev # for pyOpenSSL
 gettext  # used for compiling message catalogs
+openjdk-7-jre-headless  # NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index 13c8a87780..6f2239196b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,3 +26,4 @@ bc
 libyaml-devel
 gettext  # used for compiling message catalogs
 net-tools
+java-1.7.0-openjdk-headless  # NOPRIME
diff --git a/lib/glance b/lib/glance
old mode 100644
new mode 100755
index 0340c21ee0..c5206d489a
--- a/lib/glance
+++ b/lib/glance
@@ -70,7 +70,6 @@ GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,glance
 
-
 # Functions
 # ---------
 
@@ -308,6 +307,10 @@ function install_glance {
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
     setup_develop $GLANCE_DIR
+    if is_service_enabled g-graffiti; then
+        ${TOP_DIR}/pkg/elasticsearch.sh download
+        ${TOP_DIR}/pkg/elasticsearch.sh install
+    fi
 }
 
 # start_glance() - Start running processes, including screen
@@ -321,6 +324,9 @@ function start_glance {
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
 
+    if is_service_enabled g-graffiti; then
+        ${TOP_DIR}/pkg/elasticsearch.sh start
+    fi
     echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
@@ -334,7 +340,6 @@ function stop_glance {
     stop_process g-reg
 }
 
-
 # Restore xtrace
 $XTRACE
 

From 33127a1287da160676ff337ae980603f8c183006 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 9 Feb 2015 15:17:27 -0500
Subject: [PATCH 0322/3333] update plugin doc

After doing a couple of external plugins I found that basically things
don't work unless you enable_service in the settings file. Document
that as a requirement, and clean up the rest of the docs around the
external plugins to be consistent with that.

Change-Id: I13aee7dbf112ce9663e8338b555a208327f89b61
---
 doc/source/plugins.rst | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 8bb92ed4b9..5d6d3f183d 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -107,19 +107,24 @@ directory. Inside this directory there can be 2 files.
   sourced very early in the process. This is helpful if other plugins
   might depend on this one, and need access to global variables to do
   their work.
+
+  Your settings should include any ``enable_service`` lines required
+  by your plugin. This is especially important if you are kicking off
+  services using ``run_process`` as it only works with enabled
+  services.
+
 - ``plugin.sh`` - the actual plugin. It will be executed by devstack
   during it's run. The run order will be done in the registration
   order for these plugins, and will occur immediately after all in
   tree extras.d dispatch at the phase in question.  The plugin.sh
-  looks like the extras.d dispatcher above **except** it should not
-  include the is_service_enabled conditional. All external plugins are
-  always assumed to be enabled.
+  looks like the extras.d dispatcher above.
 
 Plugins are registered by adding the following to the localrc section
 of ``local.conf``.
 
 They are added in the following format::
 
+  [[local|localrc]]
   enable_plugin <NAME> <GITURL> [GITREF]
 
 - ``name`` - an arbitrary name. (ex: glustfs, docker, zaqar, congress)
@@ -129,7 +134,7 @@ They are added in the following format::
 
 An example would be as follows::
 
-  enable_plugin glusterfs https://github.com/sdague/devstack-plugins glusterfs
+  enable_plugin ec2api git://git.openstack.org/stackforge/ec2api
 
 Hypervisor
 ==========

From ebcb8496348fad84053c79a933771ce6063994f8 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 10 Feb 2015 14:16:56 -0500
Subject: [PATCH 0323/3333] Unconfigure the devstack CA when USE_SSL is True

Change-Id: I17cb5e5d93bfe6fc6746ee530f639e2ed42da85a
---
 unstack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/unstack.sh b/unstack.sh
index bc439e90bf..4364e58a32 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -132,6 +132,9 @@ if is_service_enabled tls-proxy; then
     stop_tls_proxy
     cleanup_CA
 fi
+if [ "$USE_SSL" == "True" ]; then
+    cleanup_CA
+fi
 
 SCSI_PERSIST_DIR=$CINDER_STATE_PATH/volumes/*
 

From e1d013f9265a86c00ec02822f2425874fa97769f Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 10 Feb 2015 14:15:35 -0500
Subject: [PATCH 0324/3333] Set ca_certificates_file in tempest, fix test for
 "keystone"

Configure tempest with the location of the devstack CA bundle.

Fix a conditional that was looking for the "keystone" service
when it should be "key". This affected users who set
USE_SSL=True

Change-Id: I7171d7bd539443dce9f3b1a80274b7861abdcfdb
---
 lib/tempest | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 777d03e0f3..3d9d8bb47e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -292,6 +292,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG identity admin_tenant_id $ADMIN_TENANT_ID
     iniset $TEMPEST_CONFIG identity admin_domain_name $ADMIN_DOMAIN_NAME
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
+    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
+        iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
+    fi
 
     # Image
     # for the gate we want to be able to override this variable so we aren't
@@ -482,7 +485,7 @@ function configure_tempest {
         fi
     done
 
-    if is_ssl_enabled_service "keystone" || is_service_enabled tls-proxy; then
+    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         # Use the BOTO_CONFIG environment variable to point to this file
         iniset $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
         sudo chown $STACK_USER $BOTO_CONF

From 117c6c2048e232660613666b9e606991a5ad32b6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 10 Feb 2015 07:53:36 -0500
Subject: [PATCH 0325/3333] remove lib/stackforge

Now that we have a working external plugin mechanism stackforge
projects definitely don't need to be directly in devstack. These were
largely unused previously anyway.

Change-Id: I300686b2ac976d9b454404842b3f210fd7c239d9
---
 doc/source/index.rst |  1 -
 lib/stackforge       | 56 --------------------------------------------
 stack.sh             |  6 -----
 stackrc              | 20 ----------------
 unstack.sh           |  1 -
 5 files changed, 84 deletions(-)
 delete mode 100644 lib/stackforge

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 0790d1e7e1..be77dc12a5 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -167,7 +167,6 @@ Scripts
 * `lib/oslo <lib/oslo.html>`__
 * `lib/rpc\_backend <lib/rpc_backend.html>`__
 * `lib/sahara <lib/sahara.html>`__
-* `lib/stackforge <lib/stackforge.html>`__
 * `lib/swift <lib/swift.html>`__
 * `lib/tempest <lib/tempest.html>`__
 * `lib/tls <lib/tls.html>`__
diff --git a/lib/stackforge b/lib/stackforge
deleted file mode 100644
index cc3a689973..0000000000
--- a/lib/stackforge
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/bin/bash
-#
-# lib/stackforge
-#
-# Functions to install stackforge libraries that we depend on so
-# that we can try their git versions during devstack gate.
-#
-# This is appropriate for python libraries that release to pypi and are
-# expected to be used beyond OpenStack like, but are requirements
-# for core services in global-requirements.
-#
-#     * wsme
-#     * pecan
-#
-# This is not appropriate for stackforge projects which are early stage
-# OpenStack tools
-
-# Dependencies:
-# ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# install_stackforge
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-WSME_DIR=$DEST/wsme
-PECAN_DIR=$DEST/pecan
-SQLALCHEMY_MIGRATE_DIR=$DEST/sqlalchemy-migrate
-
-# Entry Points
-# ------------
-
-# install_stackforge() - Collect source and prepare
-function install_stackforge {
-    git_clone $WSME_REPO $WSME_DIR $WSME_BRANCH
-    setup_package $WSME_DIR
-
-    git_clone $PECAN_REPO $PECAN_DIR $PECAN_BRANCH
-    setup_package $PECAN_DIR
-
-    git_clone $SQLALCHEMY_MIGRATE_REPO $SQLALCHEMY_MIGRATE_DIR $SQLALCHEMY_MIGRATE_BRANCH
-    setup_package $SQLALCHEMY_MIGRATE_DIR
-}
-
-# Restore xtrace
-$XTRACE
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/stack.sh b/stack.sh
index eaecea075c..3f97919e0e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -500,7 +500,6 @@ source $TOP_DIR/lib/tls
 # Source project function libraries
 source $TOP_DIR/lib/infra
 source $TOP_DIR/lib/oslo
-source $TOP_DIR/lib/stackforge
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
@@ -699,11 +698,6 @@ install_infra
 # Install oslo libraries that have graduated
 install_oslo
 
-# Install stackforge libraries for testing
-if is_service_enabled stackforge_libs; then
-    install_stackforge
-fi
-
 # Install clients libraries
 install_keystoneclient
 install_glanceclient
diff --git a/stackrc b/stackrc
index ff821401d7..7bb4cc29d9 100644
--- a/stackrc
+++ b/stackrc
@@ -434,26 +434,6 @@ ORC_BRANCH=${ORC_BRANCH:-master}
 TIE_REPO=${TIE_REPO:-${GIT_BASE}/openstack/tripleo-image-elements.git}
 TIE_BRANCH=${TIE_BRANCH:-master}
 
-#################
-#
-#  Additional Libraries
-#
-#################
-
-# stackforge libraries that are used by OpenStack core services
-# wsme
-WSME_REPO=${WSME_REPO:-${GIT_BASE}/stackforge/wsme.git}
-WSME_BRANCH=${WSME_BRANCH:-master}
-
-# pecan
-PECAN_REPO=${PECAN_REPO:-${GIT_BASE}/stackforge/pecan.git}
-PECAN_BRANCH=${PECAN_BRANCH:-master}
-
-# sqlalchemy-migrate
-SQLALCHEMY_MIGRATE_REPO=${SQLALCHEMY_MIGRATE_REPO:-${GIT_BASE}/stackforge/sqlalchemy-migrate.git}
-SQLALCHEMY_MIGRATE_BRANCH=${SQLALCHEMY_MIGRATE_BRANCH:-master}
-
-
 #################
 #
 #  3rd Party Components (non pip installable)
diff --git a/unstack.sh b/unstack.sh
index b8b7f4a130..bc439e90bf 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -54,7 +54,6 @@ source $TOP_DIR/lib/tls
 # Source project function libraries
 source $TOP_DIR/lib/infra
 source $TOP_DIR/lib/oslo
-source $TOP_DIR/lib/stackforge
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone

From e8bc2b82a04f4cca251ed7437f738672107428a3 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Tue, 10 Feb 2015 20:38:56 +1100
Subject: [PATCH 0326/3333] Reduce service user permissions

Most of the services create the service user with the admin permission.
This is unnecessary for token validation and they should be restricted
to only having the service role.

Change-Id: Id7a9366d2c6a36139240f64371002362dc2d8d3b
---
 lib/ceilometer | 2 +-
 lib/cinder     | 2 +-
 lib/ironic     | 2 +-
 lib/nova       | 2 ++
 lib/sahara     | 2 +-
 lib/swift      | 2 +-
 lib/trove      | 2 +-
 lib/zaqar      | 2 +-
 8 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index f03bab21fc..8fff91058c 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -108,7 +108,7 @@ function create_ceilometer_accounts {
     # Ceilometer
     if [[ "$ENABLED_SERVICES" =~ "ceilometer-api" ]]; then
 
-        create_service_user "ceilometer" "admin"
+        create_service_user "ceilometer"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
             local ceilometer_service=$(get_or_create_service "ceilometer" \
diff --git a/lib/cinder b/lib/cinder
index 12ba51e49b..17a0cc3c1a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -333,7 +333,7 @@ function create_cinder_accounts {
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
-        create_service_user "cinder" "admin"
+        create_service_user "cinder"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/ironic b/lib/ironic
index 921bcf1a26..bed816e5c5 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -362,7 +362,7 @@ function create_ironic_accounts {
     if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
         # Get ironic user if exists
 
-        create_service_user "ironic" "admin"
+        create_service_user "ironic"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/nova b/lib/nova
index c760066f15..6a149af322 100644
--- a/lib/nova
+++ b/lib/nova
@@ -356,6 +356,8 @@ function create_nova_accounts {
     # Nova
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
 
+        # NOTE(jamielennox): Nova doesn't need the admin role here, however neutron uses
+        # this service user when notifying nova of changes and that requires the admin role.
         create_service_user "nova" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/sahara b/lib/sahara
index b3ca32f346..db200cca10 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -61,7 +61,7 @@ TEMPEST_SERVICES+=,sahara
 # service     sahara    admin
 function create_sahara_accounts {
 
-    create_service_user "sahara" "admin"
+    create_service_user "sahara"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/swift b/lib/swift
index d9f750c27f..31a1ba1d20 100644
--- a/lib/swift
+++ b/lib/swift
@@ -603,7 +603,7 @@ function create_swift_accounts {
 
     local another_role=$(openstack role list | awk "/ anotherrole / { print \$2 }")
 
-    create_service_user "swift" "admin"
+    create_service_user "swift"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/trove b/lib/trove
index d32c7765e0..e1b307a52f 100644
--- a/lib/trove
+++ b/lib/trove
@@ -81,7 +81,7 @@ function setup_trove_logging {
 function create_trove_accounts {
     if [[ "$ENABLED_SERVICES" =~ "trove" ]]; then
 
-        create_service_user "trove" "admin"
+        create_service_user "trove"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
diff --git a/lib/zaqar b/lib/zaqar
index 8b560bb4d5..4a24415248 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -215,7 +215,7 @@ function stop_zaqar {
 }
 
 function create_zaqar_accounts {
-    create_service_user "zaqar" "admin"
+    create_service_user "zaqar"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 

From 9b215db569dcee2e9cd52c3336ba14b73ad05ab0 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Tue, 10 Feb 2015 18:19:57 +1100
Subject: [PATCH 0327/3333] Rename get_or_add_user_role

get_or_add_user_role is specific to adding a role on a project.
Rename it to get_or_add_user_project_role to allow room for adding a
domain specific role function.

Change-Id: I999308098d22be9800578ae67144a3b687fbc3be
---
 functions-common |  6 +++---
 lib/ceilometer   |  2 +-
 lib/glance       |  2 +-
 lib/keystone     | 12 ++++++------
 lib/nova         |  2 +-
 lib/swift        |  8 ++++----
 lib/tempest      |  2 +-
 7 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/functions-common b/functions-common
index d3b3c0c73d..6beb670c6c 100644
--- a/functions-common
+++ b/functions-common
@@ -913,9 +913,9 @@ function get_or_create_role {
     echo $role_id
 }
 
-# Gets or adds user role
-# Usage: get_or_add_user_role <role> <user> <project>
-function get_or_add_user_role {
+# Gets or adds user role to project
+# Usage: get_or_add_user_project_role <role> <user> <project>
+function get_or_add_user_project_role {
     # Gets user role id
     local user_role_id=$(openstack role list \
         --user $2 \
diff --git a/lib/ceilometer b/lib/ceilometer
index f03bab21fc..c449ad243d 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -121,7 +121,7 @@ function create_ceilometer_accounts {
         fi
         if is_service_enabled swift; then
             # Ceilometer needs ResellerAdmin role to access swift account stats.
-            get_or_add_user_role "ResellerAdmin" "ceilometer" $SERVICE_TENANT_NAME
+            get_or_add_user_project_role "ResellerAdmin" "ceilometer" $SERVICE_TENANT_NAME
         fi
     fi
 }
diff --git a/lib/glance b/lib/glance
index c5206d489a..5bd0b8cdf1 100755
--- a/lib/glance
+++ b/lib/glance
@@ -238,7 +238,7 @@ function create_glance_accounts {
 
             local glance_swift_user=$(get_or_create_user "glance-swift" \
                 "$SERVICE_PASSWORD" "glance-swift@example.com")
-            get_or_add_user_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
+            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
         fi
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
diff --git a/lib/keystone b/lib/keystone
index 79806b8fd1..2da2d1b4f7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -365,7 +365,7 @@ function create_keystone_accounts {
     local admin_tenant=$(get_or_create_project "admin")
     local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD")
     local admin_role=$(get_or_create_role "admin")
-    get_or_add_user_role $admin_role $admin_user $admin_tenant
+    get_or_add_user_project_role $admin_role $admin_user $admin_tenant
 
     # Create service project/role
     get_or_create_project "$SERVICE_TENANT_NAME"
@@ -394,10 +394,10 @@ function create_keystone_accounts {
     local demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "demo@example.com")
 
-    get_or_add_user_role $member_role $demo_user $demo_tenant
-    get_or_add_user_role $admin_role $admin_user $demo_tenant
-    get_or_add_user_role $another_role $demo_user $demo_tenant
-    get_or_add_user_role $member_role $demo_user $invis_tenant
+    get_or_add_user_project_role $member_role $demo_user $demo_tenant
+    get_or_add_user_project_role $admin_role $admin_user $demo_tenant
+    get_or_add_user_project_role $another_role $demo_user $demo_tenant
+    get_or_add_user_project_role $member_role $demo_user $invis_tenant
 
     get_or_create_group "developers" "default" "openstack developers"
     get_or_create_group "testers" "default"
@@ -426,7 +426,7 @@ function create_service_user {
     local role=${2:-service}
 
     local user=$(get_or_create_user "$1" "$SERVICE_PASSWORD")
-    get_or_add_user_role "$role" "$user" "$SERVICE_TENANT_NAME"
+    get_or_add_user_project_role "$role" "$user" "$SERVICE_TENANT_NAME"
 }
 
 # Configure the service to use the auth token middleware.
diff --git a/lib/nova b/lib/nova
index c760066f15..801378dd97 100644
--- a/lib/nova
+++ b/lib/nova
@@ -383,7 +383,7 @@ function create_nova_accounts {
         if is_service_enabled swift; then
             # Nova needs ResellerAdmin role to download images when accessing
             # swift through the s3 api.
-            get_or_add_user_role ResellerAdmin nova $SERVICE_TENANT_NAME
+            get_or_add_user_project_role ResellerAdmin nova $SERVICE_TENANT_NAME
         fi
 
         # EC2
diff --git a/lib/swift b/lib/swift
index d9f750c27f..194df3330d 100644
--- a/lib/swift
+++ b/lib/swift
@@ -620,18 +620,18 @@ function create_swift_accounts {
     die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
     SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
-    get_or_add_user_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
+    get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
 
     local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
-    get_or_add_user_role $another_role $swift_user_test3 $swift_tenant_test1
+    get_or_add_user_project_role $another_role $swift_user_test3 $swift_tenant_test1
 
     local swift_tenant_test2=$(get_or_create_project swifttenanttest2)
     die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
 
     local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
-    get_or_add_user_role admin $swift_user_test2 $swift_tenant_test2
+    get_or_add_user_project_role admin $swift_user_test2 $swift_tenant_test2
 
     local swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
     die_if_not_set $LINENO swift_domain "Failure creating swift_test domain"
@@ -641,7 +641,7 @@ function create_swift_accounts {
 
     local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password "test4@example.com" $swift_domain)
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
-    get_or_add_user_role admin $swift_user_test4 $swift_tenant_test4
+    get_or_add_user_project_role admin $swift_user_test4 $swift_tenant_test4
 }
 
 # init_swift() - Initialize rings
diff --git a/lib/tempest b/lib/tempest
index 777d03e0f3..560ab1b1e8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -505,7 +505,7 @@ function create_tempest_accounts {
         # between two regular users in separate tenants
         get_or_create_project alt_demo
         get_or_create_user alt_demo "$ADMIN_PASSWORD" "alt_demo@example.com"
-        get_or_add_user_role Member alt_demo alt_demo
+        get_or_add_user_project_role Member alt_demo alt_demo
     fi
 }
 

From 9a413abcd4bb0a7527b37fcaab4a16c9aa7cd938 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 4 Feb 2015 12:44:18 -0500
Subject: [PATCH 0328/3333] add gating up/down script for devstack

This adds the test infrastructure for testing that unstack.sh and
clean.sh do the right thing, and actually stop what's expected. This
is designed to be used in upstream testing to make unstack and clean a
bit more certain.

It includes numerous fixes to make these pass in an errexit
environment with the gate config. The scripts still don't run under
errexit because we don't assume we've handled all possible cleanup safely.

Change-Id: I774dfb2cc934367eef2bb7ea5123197f6da7565b
---
 clean.sh            |  7 +++++--
 gate/updown.sh      | 24 ++++++++++++++++++++++++
 lib/databases/mysql |  3 ---
 lib/dstat           |  5 ++++-
 lib/rpc_backend     |  3 ++-
 lib/sahara          |  2 +-
 unstack.sh          | 12 ++++++++----
 7 files changed, 44 insertions(+), 12 deletions(-)
 create mode 100755 gate/updown.sh

diff --git a/clean.sh b/clean.sh
index edbd04a2d9..50d414c1d9 100755
--- a/clean.sh
+++ b/clean.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # **clean.sh**
 
@@ -83,7 +83,10 @@ if [[ -d $TOP_DIR/extras.d ]]; then
 fi
 
 # Clean projects
-cleanup_cinder
+
+# BUG: cinder tgt doesn't exit cleanly if it's not running.
+cleanup_cinder || /bin/true
+
 cleanup_glance
 cleanup_keystone
 cleanup_nova
diff --git a/gate/updown.sh b/gate/updown.sh
new file mode 100755
index 0000000000..d2d7351a2f
--- /dev/null
+++ b/gate/updown.sh
@@ -0,0 +1,24 @@
+#!/bin/bash -xe
+#
+# An up / down test for gate functional testing
+#
+# Note: this is expected to start running as jenkins
+
+# Step 1: give back sudoers permissions to devstack
+TEMPFILE=`mktemp`
+echo "stack ALL=(root) NOPASSWD:ALL" >$TEMPFILE
+chmod 0440 $TEMPFILE
+sudo chown root:root $TEMPFILE
+sudo mv $TEMPFILE /etc/sudoers.d/51_stack_sh
+
+# TODO: do something to start a guest to create crud that should
+# disappear
+
+# Step 2: unstack
+echo "Running unstack.sh"
+sudo -H -u stack stdbuf -oL -eL bash -ex ./unstack.sh
+
+# Step 3: clean
+echo "Running clean.sh"
+sudo -H -u stack stdbuf -oL -eL bash -ex ./clean.sh
+
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 72c0f82b4a..c8ceec2455 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -28,17 +28,14 @@ function cleanup_database_mysql {
     stop_service $MYSQL
     if is_ubuntu; then
         # Get ruthless with mysql
-        stop_service $MYSQL
         apt_get purge -y mysql* mariadb*
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return
     elif is_fedora; then
-        stop_service mariadb
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
     elif is_suse; then
-        stop_service mysql
         uninstall_package mysql-community-server
         sudo rm -rf /var/lib/mysql
     else
diff --git a/lib/dstat b/lib/dstat
index 8165e5c5e9..740e48f9e0 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -40,7 +40,10 @@ function start_dstat {
 
 # stop_dstat() stop dstat process
 function stop_dstat {
-    screen_stop dstat
+    # dstat runs as a console, not as a service, and isn't trackable
+    # via the normal mechanisms for devstack. So lets just do a
+    # killall and move on.
+    killall dstat || /bin/true
 }
 
 # Restore xtrace
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 981b80b405..ec821f16c6 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -74,7 +74,8 @@ function cleanup_rpc_backend {
     if is_service_enabled rabbit; then
         # Obliterate rabbitmq-server
         uninstall_package rabbitmq-server
-        sudo killall epmd || sudo killall -9 epmd
+        # in case it's not actually running, /bin/true at the end
+        sudo killall epmd || sudo killall -9 epmd || /bin/true
         if is_ubuntu; then
             # And the Erlang runtime too
             apt_get purge -y erlang*
diff --git a/lib/sahara b/lib/sahara
index 995935aebf..5720c203ea 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -184,7 +184,7 @@ function start_sahara {
 # stop_sahara() - Stop running processes
 function stop_sahara {
     # Kill the Sahara screen windows
-    screen -S $SCREEN_NAME -p sahara -X kill
+    stop_process sahara
 }
 
 
diff --git a/unstack.sh b/unstack.sh
index b8b7f4a130..9a283bafff 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # **unstack.sh**
 
@@ -136,10 +136,13 @@ fi
 
 SCSI_PERSIST_DIR=$CINDER_STATE_PATH/volumes/*
 
+# BUG: tgt likes to exit 1 on service stop if everything isn't
+# perfect, we should clean up cinder stop paths.
+
 # Get the iSCSI volumes
 if is_service_enabled cinder; then
-    stop_cinder
-    cleanup_cinder
+    stop_cinder || /bin/true
+    cleanup_cinder || /bin/true
 fi
 
 if [[ -n "$UNSTACK_ALL" ]]; then
@@ -179,4 +182,5 @@ if [[ -n "$SCREEN" ]]; then
     fi
 fi
 
-clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME
+# BUG: maybe it doesn't exist? We should isolate this further down.
+clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true

From 5b9adb60de38584b94596a07fdb7e5ffbe4c9480 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Tue, 10 Feb 2015 08:09:08 +0000
Subject: [PATCH 0329/3333] XenAPI: Move some boot-time functions to
 install-time

The boot-time script (prepare_guest.sh) is one of the less reliable parts
of the install process.  This change enables SSH into the host as well as
reporting of the IP address.  This significantly helps debugging issues
now and enables moving of all other setup code to being executed over SSH.

Change-Id: I1555f1d91353ba8b75e2de4607df33ee20307a6e
---
 tools/xen/devstackubuntu_latecommand.sh | 14 +++++++++++++
 tools/xen/devstackubuntupreseed.cfg     |  7 ++++---
 tools/xen/install_os_domU.sh            | 25 ++++++++++++++++++++++
 tools/xen/prepare_guest.sh              | 15 ++-----------
 tools/xen/prepare_guest_template.sh     | 28 +------------------------
 5 files changed, 46 insertions(+), 43 deletions(-)
 create mode 100644 tools/xen/devstackubuntu_latecommand.sh

diff --git a/tools/xen/devstackubuntu_latecommand.sh b/tools/xen/devstackubuntu_latecommand.sh
new file mode 100644
index 0000000000..2afbe2cdf3
--- /dev/null
+++ b/tools/xen/devstackubuntu_latecommand.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -eux
+
+# Need to set barrier=0 to avoid a Xen bug
+# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/824089
+sed -i -e 's/errors=/barrier=0,errors=/' /etc/fstab
+
+# Allow root to login with a password
+sed -i -e 's/.*PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config
+
+# Install the XenServer tools so IP addresses are reported
+wget --no-proxy @XS_TOOLS_URL@ -O /root/tools.deb
+dpkg -i /root/tools.deb
+rm /root/tools.deb
diff --git a/tools/xen/devstackubuntupreseed.cfg b/tools/xen/devstackubuntupreseed.cfg
index 94e6e96625..80f334ba8e 100644
--- a/tools/xen/devstackubuntupreseed.cfg
+++ b/tools/xen/devstackubuntupreseed.cfg
@@ -331,10 +331,11 @@ d-i apt-setup/backports boolean true
 tasksel tasksel/first multiselect openssh-server
 
 # Individual additional packages to install
-#d-i pkgsel/include string openssh-server build-essential
+d-i pkgsel/include string cracklib-runtime curl wget ssh openssh-server tcpdump ethtool git sudo python-netaddr coreutils
+
 # Whether to upgrade packages after debootstrap.
 # Allowed values: none, safe-upgrade, full-upgrade
-#d-i pkgsel/upgrade select none
+d-i pkgsel/upgrade select safe-upgrade
 
 # Language pack selection
 #d-i pkgsel/language-packs multiselect de, en, zh
@@ -467,4 +468,4 @@ xserver-xorg xserver-xorg/config/monitor/mode-list \
 # still a usable /target directory. You can chroot to /target and use it
 # directly, or use the apt-install and in-target commands to easily install
 # packages and run commands in the target system.
-#d-i preseed/late_command string apt-install zsh; in-target chsh -s /bin/zsh
+d-i preseed/late_command string
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 546ead6127..8a0725152f 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -178,12 +178,32 @@ if [ -z "$templateuuid" ]; then
     PRESEED_URL=${PRESEED_URL:-""}
     if [ -z "$PRESEED_URL" ]; then
         PRESEED_URL="${HOST_IP}/devstackubuntupreseed.cfg"
+
         HTTP_SERVER_LOCATION="/opt/xensource/www"
         if [ ! -e $HTTP_SERVER_LOCATION ]; then
             HTTP_SERVER_LOCATION="/var/www/html"
             mkdir -p $HTTP_SERVER_LOCATION
         fi
+
+        # Copy the tools DEB to the XS web server
+        XS_TOOLS_URL="https://github.com/downloads/citrix-openstack/warehouse/xe-guest-utilities_5.6.100-651_amd64.deb"
+        ISO_DIR="/opt/xensource/packages/iso"
+        XS_TOOLS_FILE_NAME="xs-tools.deb"
+        XS_TOOLS_PATH="/root/$XS_TOOLS_FILE_NAME"
+        if [ -e "$ISO_DIR" ]; then
+            TOOLS_ISO=$(ls -1 $ISO_DIR/xs-tools-*.iso | head -1)
+            TMP_DIR=/tmp/temp.$RANDOM
+            mkdir -p $TMP_DIR
+            mount -o loop $TOOLS_ISO $TMP_DIR
+            DEB_FILE=$(ls $TMP_DIR/Linux/*amd64.deb)
+            cp $DEB_FILE $HTTP_SERVER_LOCATION
+            umount $TMP_DIR
+            rmdir $TMP_DIR
+            XS_TOOLS_URL=${HOST_IP}/$(basename $DEB_FILE)
+        fi
+
         cp -f $THIS_DIR/devstackubuntupreseed.cfg $HTTP_SERVER_LOCATION
+        cp -f $THIS_DIR/devstackubuntu_latecommand.sh $HTTP_SERVER_LOCATION/latecommand.sh
 
         sed \
             -e "s,\(d-i mirror/http/hostname string\).*,\1 $UBUNTU_INST_HTTP_HOSTNAME,g" \
@@ -191,7 +211,12 @@ if [ -z "$templateuuid" ]; then
             -e "s,\(d-i mirror/http/proxy string\).*,\1 $UBUNTU_INST_HTTP_PROXY,g" \
             -e "s,\(d-i passwd/root-password password\).*,\1 $GUEST_PASSWORD,g" \
             -e "s,\(d-i passwd/root-password-again password\).*,\1 $GUEST_PASSWORD,g" \
+            -e "s,\(d-i preseed/late_command string\).*,\1 in-target mkdir -p /tmp; in-target wget --no-proxy ${HOST_IP}/latecommand.sh -O /root/latecommand.sh; in-target bash /root/latecommand.sh,g" \
             -i "${HTTP_SERVER_LOCATION}/devstackubuntupreseed.cfg"
+
+        sed \
+            -e "s,@XS_TOOLS_URL@,$XS_TOOLS_URL,g" \
+            -i "${HTTP_SERVER_LOCATION}/latecommand.sh"
     fi
 
     # Update the template
diff --git a/tools/xen/prepare_guest.sh b/tools/xen/prepare_guest.sh
index 7fe032a064..6de1afc199 100755
--- a/tools/xen/prepare_guest.sh
+++ b/tools/xen/prepare_guest.sh
@@ -16,9 +16,8 @@ set -o xtrace
 
 # Configurable nuggets
 GUEST_PASSWORD="$1"
-XS_TOOLS_PATH="$2"
-STACK_USER="$3"
-DOMZERO_USER="$4"
+STACK_USER="$2"
+DOMZERO_USER="$3"
 
 
 function setup_domzero_user {
@@ -70,16 +69,6 @@ EOF
 
 }
 
-# Install basics
-apt-get update
-apt-get install -y cracklib-runtime curl wget ssh openssh-server tcpdump ethtool
-apt-get install -y git sudo python-netaddr coreutils
-
-# Install XenServer guest utilities
-dpkg -i $XS_TOOLS_PATH
-update-rc.d -f xe-linux-distribution remove
-update-rc.d xe-linux-distribution defaults
-
 # Make a small cracklib dictionary, so that passwd still works, but we don't
 # have the big dictionary.
 mkdir -p /usr/share/cracklib
diff --git a/tools/xen/prepare_guest_template.sh b/tools/xen/prepare_guest_template.sh
index 6cb2ca7099..6cddddaa84 100755
--- a/tools/xen/prepare_guest_template.sh
+++ b/tools/xen/prepare_guest_template.sh
@@ -46,28 +46,6 @@ if [ ! -d $STAGING_DIR/etc ]; then
     exit 1
 fi
 
-# Copy XenServer tools deb into the VM
-ISO_DIR="/opt/xensource/packages/iso"
-XS_TOOLS_FILE_NAME="xs-tools.deb"
-XS_TOOLS_PATH="/root/$XS_TOOLS_FILE_NAME"
-if [ -e "$ISO_DIR" ]; then
-    TOOLS_ISO=$(ls -1 $ISO_DIR/xs-tools-*.iso | head -1)
-    TMP_DIR=/tmp/temp.$RANDOM
-    mkdir -p $TMP_DIR
-    mount -o loop $TOOLS_ISO $TMP_DIR
-    DEB_FILE=$(ls $TMP_DIR/Linux/*amd64.deb)
-    echo "Copying XenServer tools into VM from: $DEB_FILE"
-    cp $DEB_FILE "${STAGING_DIR}${XS_TOOLS_PATH}"
-    umount $TMP_DIR
-    rm -rf $TMP_DIR
-else
-    echo "WARNING: no XenServer tools found, falling back to 5.6 tools"
-    TOOLS_URL="https://github.com/downloads/citrix-openstack/warehouse/xe-guest-utilities_5.6.100-651_amd64.deb"
-    curl --no-sessionid -L -o "$XS_TOOLS_FILE_NAME" $TOOLS_URL
-    cp $XS_TOOLS_FILE_NAME "${STAGING_DIR}${XS_TOOLS_PATH}"
-    rm -rf $XS_TOOLS_FILE_NAME
-fi
-
 # Copy prepare_guest.sh to VM
 mkdir -p $STAGING_DIR/opt/stack/
 cp $TOP_DIR/prepare_guest.sh $STAGING_DIR/opt/stack/prepare_guest.sh
@@ -79,14 +57,10 @@ cp $STAGING_DIR/etc/rc.local $STAGING_DIR/etc/rc.local.preparebackup
 cat <<EOF >$STAGING_DIR/etc/rc.local
 #!/bin/sh -e
 bash /opt/stack/prepare_guest.sh \\
-    "$GUEST_PASSWORD" "$XS_TOOLS_PATH" "$STACK_USER" "$DOMZERO_USER" \\
+    "$GUEST_PASSWORD" "$STACK_USER" "$DOMZERO_USER" \\
     > /opt/stack/prepare_guest.log 2>&1
 EOF
 
-# Need to set barrier=0 to avoid a Xen bug
-# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/824089
-sed -i -e 's/errors=/barrier=0,errors=/' $STAGING_DIR/etc/fstab
-
 # Update ubuntu repositories
 cat > $STAGING_DIR/etc/apt/sources.list << EOF
 deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted

From d1e3ff14b872de704a1b21da7e84a8e5e8d7b756 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Tue, 10 Feb 2015 17:54:53 +0100
Subject: [PATCH 0330/3333] qpid: plain auth needs cyrus-sasl-plain package

On fedora 21, qpidd cannot authenticate user, because
cyrus-sasl-plain is no more automatically installed.

This change fixes that.

Change-Id: I74452f40723881291b8c7577e5509da1c0e4e6e5
---
 files/rpms/qpid | 2 +-
 lib/rpc_backend | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/files/rpms/qpid b/files/rpms/qpid
index 9e3f10af13..c5e2699fcc 100644
--- a/files/rpms/qpid
+++ b/files/rpms/qpid
@@ -1,4 +1,4 @@
 qpid-proton-c-devel # NOPRIME
 python-qpid-proton # NOPRIME
 cyrus-sasl-lib # NOPRIME
-
+cyrus-sasl-plain # NOPRIME
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 981b80b405..30d300bbad 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -342,6 +342,7 @@ EOF
             install_package sasl2-bin
         elif is_fedora; then
             install_package cyrus-sasl-lib
+            install_package cyrus-sasl-plain
         fi
         local sasl_conf_file=/etc/sasl2/qpidd.conf
         sudo sed -i.bak '/PLAIN/!s/mech_list: /mech_list: PLAIN /' $sasl_conf_file

From 311f48764465d809cbc86f0ea38882a98221f7ec Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 18 Dec 2014 16:31:34 -0600
Subject: [PATCH 0331/3333] Remove deprecated vars

These have been emitting deprecated warnings for over a full release cycle:
Q_AGENT_EXTRA_AGENT_OPTS, Q_AGENT_EXTRA_SRV_OPTS, CINDER_MULTI_LVM_BACKEND

Change-Id: I3aa5cabd6ce3a0072cba08bbca1ad23d4a831219
---
 README.md                             | 15 --------
 lib/cinder                            | 13 ++-----
 lib/neutron_plugins/linuxbridge_agent | 14 --------
 lib/neutron_plugins/ofagent_agent     |  7 ----
 lib/neutron_plugins/openvswitch_agent | 14 --------
 lib/tempest                           |  1 -
 stack.sh                              | 51 ---------------------------
 7 files changed, 3 insertions(+), 112 deletions(-)

diff --git a/README.md b/README.md
index 7eacebdc1e..40060a7cf5 100644
--- a/README.md
+++ b/README.md
@@ -215,21 +215,6 @@ in the near future.  The ``local.conf`` headers for the replacements are:
     [[post-config|/$Q_PLUGIN_CONF_FILE]]
     [linuxbridge]   # or [ovs]
 
-* ``Q_AGENT_EXTRA_AGENT_OPTS``:
-
-    [[post-config|/$Q_PLUGIN_CONF_FILE]]
-    [agent]
-
-* ``Q_AGENT_EXTRA_SRV_OPTS``:
-
-    [[post-config|/$Q_PLUGIN_CONF_FILE]]
-    [linuxbridge]   # or [ovs]
-
-* ``Q_SRV_EXTRA_DEFAULT_OPTS``:
-
-    [[post-config|$NEUTRON_CONF]]
-    [DEFAULT]
-
 Example extra config in `local.conf`:
 
     [[post-config|/$Q_PLUGIN_CONF_FILE]]
diff --git a/lib/cinder b/lib/cinder
index 17a0cc3c1a..0d157dd78e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -65,21 +65,14 @@ else
 fi
 
 
-# Maintain this here for backward-compatibility with the old configuration
-# DEPRECATED: Use CINDER_ENABLED_BACKENDS instead
-# Support for multi lvm backend configuration (default is no support)
-CINDER_MULTI_LVM_BACKEND=$(trueorfalse False CINDER_MULTI_LVM_BACKEND)
-
 # Default backends
 # The backend format is type:name where type is one of the supported backend
 # types (lvm, nfs, etc) and name is the identifier used in the Cinder
 # configuration and for the volume type name.  Multiple backends are
 # comma-separated.
-if [[ $CINDER_MULTI_LVM_BACKEND == "False" ]]; then
-    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:${DEFAULT_VOLUME_GROUP_NAME##*-}}
-else
-    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:${DEFAULT_VOLUME_GROUP_NAME##*-},lvm:cinder}
-fi
+# The old ``CINDER_MULTI_LVM_BACKEND=True`` setting had a default of:
+# CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2}
+CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 
 
 # Should cinder perform secure deletion of volumes?
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index ec17c01612..c9ea1cac28 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -50,20 +50,6 @@ function neutron_plugin_configure_plugin_agent {
     fi
     AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-    # Define extra "AGENT" configuration options when q-agt is configured by defining
-    # the array ``Q_AGENT_EXTRA_AGENT_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_AGENT_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_AGENT_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE agent ${I/=/ }
-    done
-    # Define extra "LINUX_BRIDGE" configuration options when q-agt is configured by defining
-    # the array ``Q_AGENT_EXTRA_SRV_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_SRV_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_SRV_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge ${I/=/ }
-    done
 }
 
 function neutron_plugin_setup_interface_driver {
diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index 915badc7a0..d38fbebc74 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -84,13 +84,6 @@ function neutron_plugin_configure_plugin_agent {
     AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-ofagent-agent"
 
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-    # Define extra "AGENT" configuration options when q-agt is configured by defining
-    # defining the array ``Q_AGENT_EXTRA_AGENT_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_AGENT_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_AGENT_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE agent ${I/=/ }
-    done
 }
 
 function neutron_plugin_setup_interface_driver {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 2ab61b0c3e..1d24f3b837 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -104,20 +104,6 @@ function neutron_plugin_configure_plugin_agent {
         iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_COMMAND"
     fi
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-    # Define extra "AGENT" configuration options when q-agt is configured by defining
-    # defining the array ``Q_AGENT_EXTRA_AGENT_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_AGENT_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_AGENT_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE agent ${I/=/ }
-    done
-    # Define extra "OVS" configuration options when q-agt is configured by defining
-    # defining the array ``Q_AGENT_EXTRA_SRV_OPTS``.
-    # For Example: ``Q_AGENT_EXTRA_SRV_OPTS=(foo=true bar=2)``
-    for I in "${Q_AGENT_EXTRA_SRV_OPTS[@]}"; do
-        # Replace the first '=' with ' ' for iniset syntax
-        iniset /$Q_PLUGIN_CONF_FILE ovs ${I/=/ }
-    done
 }
 
 function neutron_plugin_setup_interface_driver {
diff --git a/lib/tempest b/lib/tempest
index 5ca217e893..d990b4fd2b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -29,7 +29,6 @@
 # - ``USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION``
 # - ``DEFAULT_INSTANCE_TYPE``
 # - ``DEFAULT_INSTANCE_USER``
-# - ``CINDER_MULTI_LVM_BACKEND``
 # - ``CINDER_ENABLED_BACKENDS``
 #
 # ``stack.sh`` calls the entry points in this order:
diff --git a/stack.sh b/stack.sh
index 3f97919e0e..19584b9759 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1329,57 +1329,6 @@ if [[ -n "$DEPRECATED_TEXT" ]]; then
     echo_summary "WARNING: $DEPRECATED_TEXT"
 fi
 
-if is_service_enabled neutron; then
-    # TODO(dtroyer): Remove Q_AGENT_EXTRA_AGENT_OPTS after stable/juno branch is cut
-    if [[ -n "$Q_AGENT_EXTRA_AGENT_OPTS" ]]; then
-        echo ""
-        echo_summary "WARNING: Q_AGENT_EXTRA_AGENT_OPTS is used"
-        echo "You are using Q_AGENT_EXTRA_AGENT_OPTS to pass configuration into $NEUTRON_CONF."
-        echo "Please convert that configuration in localrc to a $NEUTRON_CONF section in local.conf:"
-        echo "Q_AGENT_EXTRA_AGENT_OPTS will be removed early in the 'K' development cycle"
-        echo "
-[[post-config|/\$Q_PLUGIN_CONF_FILE]]
-[DEFAULT]
-"
-        for I in "${Q_AGENT_EXTRA_AGENT_OPTS[@]}"; do
-            # Replace the first '=' with ' ' for iniset syntax
-            echo ${I}
-        done
-    fi
-
-    # TODO(dtroyer): Remove Q_AGENT_EXTRA_SRV_OPTS after stable/juno branch is cut
-    if [[ -n "$Q_AGENT_EXTRA_SRV_OPTS" ]]; then
-        echo ""
-        echo_summary "WARNING: Q_AGENT_EXTRA_SRV_OPTS is used"
-        echo "You are using Q_AGENT_EXTRA_SRV_OPTS to pass configuration into $NEUTRON_CONF."
-        echo "Please convert that configuration in localrc to a $NEUTRON_CONF section in local.conf:"
-        echo "Q_AGENT_EXTRA_AGENT_OPTS will be removed early in the 'K' development cycle"
-        echo "
-[[post-config|/\$Q_PLUGIN_CONF_FILE]]
-[DEFAULT]
-"
-        for I in "${Q_AGENT_EXTRA_SRV_OPTS[@]}"; do
-            # Replace the first '=' with ' ' for iniset syntax
-            echo ${I}
-        done
-    fi
-fi
-
-if is_service_enabled cinder; then
-    # TODO(dtroyer): Remove CINDER_MULTI_LVM_BACKEND after stable/juno branch is cut
-    if [[ "$CINDER_MULTI_LVM_BACKEND" = "True" ]]; then
-        echo ""
-        echo_summary "WARNING: CINDER_MULTI_LVM_BACKEND is used"
-        echo "You are using CINDER_MULTI_LVM_BACKEND to configure Cinder's multiple LVM backends"
-        echo "Please convert that configuration in local.conf to use CINDER_ENABLED_BACKENDS."
-        echo "CINDER_MULTI_LVM_BACKEND will be removed early in the 'K' development cycle"
-        echo "
-[[local|localrc]]
-CINDER_ENABLED_BACKENDS=lvm:lvmdriver-1,lvm:lvmdriver-2
-"
-    fi
-fi
-
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)
 echo_summary "stack.sh completed in $SECONDS seconds."
 

From a7c655850c5efec2fdd2f25328e0ed9b84e96362 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 11 Feb 2015 17:58:15 +0100
Subject: [PATCH 0332/3333] guides: devstack-with-nested-kvm: Fix typo -
 s/AMD/Intel

In section "Configure Nested KVM for Intel-based Machines", this
sentence:

  Procedure to enable nested KVM virtualization on AMD-based machines.

should (obviously) read as:

  Procedure to enable nested KVM virtualization on Intel-based machines.

Change-Id: I9872a5d20a23f1cce7bf2a79bf29e1b11511b418
---
 doc/source/guides/devstack-with-nested-kvm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 2538c8d031..58ec3d3672 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -19,7 +19,7 @@ Nested Virtualization Configuration
 Configure Nested KVM for Intel-based Machines
 ---------------------------------------------
 
-Procedure to enable nested KVM virtualization on AMD-based machines.
+Procedure to enable nested KVM virtualization on Intel-based machines.
 
 Check if the nested KVM Kernel parameter is enabled:
 

From a99e5c9b0e308aa5fa66591e5213243463313ba6 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Wed, 11 Feb 2015 17:25:32 +0000
Subject: [PATCH 0333/3333] Revert "Exit when printing error about database
 config"

This reverts commit 2d7c346f0c8cefe622edc8fed47cc2782aeb9a9b.

Not setting DATABASE_TYPE is not a fatal error since it is
valid to create nodes which only run a subset of services,
and so a database may not be needed.

Change-Id: I7d957e628141ba333b6f38940b39845b18fba4df
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 3f97919e0e..c8905a7f2f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -584,7 +584,7 @@ function read_password {
 # The available database backends are listed in ``DATABASE_BACKENDS`` after
 # ``lib/database`` is sourced. ``mysql`` is the default.
 
-initialize_database_backends && echo "Using $DATABASE_TYPE database backend" || die $LINENO "No database enabled"
+initialize_database_backends && echo "Using $DATABASE_TYPE database backend" || echo "No database enabled"
 
 
 # Queue Configuration

From 701276a800f97af501de3f4cf9163e48fbcfb562 Mon Sep 17 00:00:00 2001
From: Louis Taylor <kragniz@gmail.com>
Date: Wed, 11 Feb 2015 19:34:09 +0000
Subject: [PATCH 0334/3333] Enable colorized logging for glance

Extensive QA has found this makes glance 100% more fabulous.

Change-Id: I1cf94096d6bd5033ef0f9e3ed2a77108677581f0
---
 lib/glance | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/glance b/lib/glance
index 5bd0b8cdf1..eb1df2e8ae 100755
--- a/lib/glance
+++ b/lib/glance
@@ -183,6 +183,12 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT registry_client_protocol https
     fi
 
+    # Format logging
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+        setup_colorized_logging $GLANCE_API_CONF DEFAULT "project_id" "user_id"
+        setup_colorized_logging $GLANCE_REGISTRY_CONF DEFAULT "project_id" "user_id"
+    fi
+
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
 
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI

From cdfcd4b88df651a6ac0d95bca8236d0d3ddc5543 Mon Sep 17 00:00:00 2001
From: David Shrewsbury <shrewsbury.dave@gmail.com>
Date: Wed, 11 Feb 2015 16:07:40 -0800
Subject: [PATCH 0335/3333] Restore Ironic admin user privilege

Change Id7a9366d2c6a36139240f64371002362dc2d8d3b broke the Ironic gate
by removing admin level privileges. This restores the privilege and adds
a comment to prevent the removal again (hopefully).

Change-Id: Ida1c05d9e429e24d060aef2548fc2a0c225350b8
Closes-Bug: #1421006
---
 lib/ironic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index bed816e5c5..7ffa6a5caf 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -362,7 +362,8 @@ function create_ironic_accounts {
     if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
         # Get ironic user if exists
 
-        create_service_user "ironic"
+        # NOTE(Shrews): This user MUST have admin level privileges!
+        create_service_user "ironic" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 

From c3c94ca6bc28930de54443713d7b28218c5f8cb3 Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith@solidfire.com>
Date: Wed, 11 Feb 2015 18:55:47 -0700
Subject: [PATCH 0336/3333] Add eval message when setting Cinder lvm.conf

We added an lvm filter for use when using Cinder's
LVM driver that would only scan devices that we have
actually deployed Cinder Volume Groups on.

This patch adds a simple output message to the setup
routine so we can more easily inspect what was found
and what has been set during devstack setup.

Change-Id: Iba5012caffd45dfb5143b6df954eed277445a60e
---
 lib/cinder_backends/lvm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 4b9d8dc950..d83c31a81e 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -77,6 +77,7 @@ function configure_cinder_backend_conf_lvm {
     local line
 
     for pv_info in $(sudo pvs --noheadings -o name,vg_name --separator ';'); do
+        echo_summary "Evaluate PV info for Cinder lvm.conf: $pv_info"
         IFS=';' read pv vg <<< $pv_info
         for line in ${conf_entries}; do
             IFS='=' read label group <<< $line

From 0df75a7288ec0e8e9fa6f861afd7db676a73e6d1 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Thu, 12 Feb 2015 11:59:46 +0000
Subject: [PATCH 0337/3333] XenAPI: Move where os-vpx is set

os-vpx is only true after we know it's not a JEOS we're creating
Move the location we set the os-vpx flag to as we're starting to
prepare the VM for devstack

Change-Id: If736f3a7de171b8090b0bb905e04accb70470a90
---
 tools/xen/install_os_domU.sh        | 1 +
 tools/xen/scripts/install-os-vpx.sh | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 8a0725152f..f28ae97940 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -258,6 +258,7 @@ fi
 #
 # Prepare VM for DevStack
 #
+xe vm-param-set other-config:os-vpx=true uuid="$vm_uuid"
 
 # Install XenServer tools, and other such things
 $THIS_DIR/prepare_guest_template.sh "$GUEST_NAME"
diff --git a/tools/xen/scripts/install-os-vpx.sh b/tools/xen/scripts/install-os-vpx.sh
index b9b65fdce2..1ebbeaf564 100755
--- a/tools/xen/scripts/install-os-vpx.sh
+++ b/tools/xen/scripts/install-os-vpx.sh
@@ -131,5 +131,4 @@ vm_uuid=$(xe_min vm-install template="$TEMPLATE_NAME" new-name-label="$NAME_LABE
 destroy_vifs "$vm_uuid"
 set_auto_start "$vm_uuid"
 create_vif "$vm_uuid"
-xe vm-param-set other-config:os-vpx=true uuid="$vm_uuid"
 xe vm-param-set actions-after-reboot=Destroy uuid="$vm_uuid"

From ae74ed778a2daef5490caa085ee33029e693fc5c Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 12 Feb 2015 07:33:36 -0800
Subject: [PATCH 0338/3333] Make swift user an admin

This breaks Ironic's use of temp URLs, which the key for the service
account is configured via the Swift user.

Change-Id: I69f6f6eef4ad573f406d64d579a9811c70ac5d28
Closes-Bug: #1421006
---
 lib/swift | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index e4d8b5fe19..56baa12445 100644
--- a/lib/swift
+++ b/lib/swift
@@ -603,7 +603,9 @@ function create_swift_accounts {
 
     local another_role=$(openstack role list | awk "/ anotherrole / { print \$2 }")
 
-    create_service_user "swift"
+    # NOTE(jroll): Swift doesn't need the admin role here, however Ironic uses
+    # temp urls, which break when uploaded by a non-admin role
+    create_service_user "swift" "admin"
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 

From 2b564763aafe6466f42bc5cf2ccc47ddf4169986 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 11 Feb 2015 17:01:02 -0600
Subject: [PATCH 0339/3333] Teach pip_install() about virtual envs

Set PIP_VIRTUAL_ENV to install the package(s) into an existing virtual
environment.  This works by simply using the pip command already
in the venv, and not using sudo.

Change-Id: I910e1752e58a666174f83b4f97e547851e66e655
---
 inc/python | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/inc/python b/inc/python
index 0348cb389f..4a107ac8ec 100644
--- a/inc/python
+++ b/inc/python
@@ -31,6 +31,13 @@ function get_pip_command {
 # Get the path to the direcotry where python executables are installed.
 # get_python_exec_prefix
 function get_python_exec_prefix {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    if [[ -z "$os_PACKAGE" ]]; then
+        GetOSVersion
+    fi
+    $xtrace
+
     if is_fedora || is_suse; then
         echo "/usr/bin"
     else
@@ -39,8 +46,8 @@ function get_python_exec_prefix {
 }
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
-# Uses globals ``INSTALL_TESTONLY_PACKAGES``, ``OFFLINE``, ``TRACK_DEPENDS``,
-# ``*_proxy``
+# Uses globals ``INSTALL_TESTONLY_PACKAGES``, ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
+# ``TRACK_DEPENDS``, ``*_proxy``
 # pip_install package [package ...]
 function pip_install {
     local xtrace=$(set +o | grep xtrace)
@@ -62,8 +69,13 @@ function pip_install {
         local cmd_pip=$DEST/.venv/bin/pip
         local sudo_pip="env"
     else
-        local cmd_pip=$(get_pip_command)
-        local sudo_pip="sudo -H"
+        if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+            local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
+            local sudo_pip="env"
+        else
+            local cmd_pip=$(get_pip_command)
+            local sudo_pip="sudo -H"
+        fi
     fi
 
     local pip_version=$(python -c "import pip; \
@@ -93,6 +105,7 @@ function pip_install {
                 -r $test_req
         fi
     fi
+    $xtrace
 }
 
 # should we use this library from their git repo, or should we let it

From b9f2e25fa8afb2ea17a89ed76c4fac03689b5f07 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 12 Feb 2015 20:31:58 +0000
Subject: [PATCH 0340/3333] Revert "Remove NoVNC from the default enabled
 services"

Reverting this is probably appropriate because until we can
get Debian/Ubuntu to fix their underlying dependencies.
It's confusing a lot of people that this is no longer
available

This reverts commit 2bfb9af0c952f59287be4ce684b78cfb710a6105.

Change-Id: Id352db9dcd40bfb5eb771dad42cdf04e0ce72313
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 6881a517d8..15b0951a1a 100644
--- a/stackrc
+++ b/stackrc
@@ -44,7 +44,7 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 # this allows us to pass ENABLED_SERVICES
 if [[ -z "$ENABLED_SERVICES" ]]; then
     # core compute (glance / keystone / nova (+ nova-network))
-    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-xvnc,n-cauth
+    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-novnc,n-xvnc,n-cauth
     # cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # heat

From ad61e7f9dd6cd0e19204e0ce5a15c0d7888b752a Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 12 Feb 2015 15:17:25 -0500
Subject: [PATCH 0341/3333] add ceilometermiddleware lib

middleware in ceilometer has been broken into it's own lib. this
first patch adds the package.

Change-Id: I63795787b909effcc4fcdee7f262207bb59fd8c2
---
 lib/ceilometer               | 9 +++++++++
 stackrc                      | 6 +++++-
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 698e8b07f6..73ab73ca17 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -57,6 +57,7 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-ceilometerclient"]=$DEST/python-ceilometerclient
+GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 
 CEILOMETER_DIR=$DEST/ceilometer
 CEILOMETER_CONF_DIR=/etc/ceilometer
@@ -303,6 +304,14 @@ function install_ceilometerclient {
     fi
 }
 
+# install_ceilometermiddleware() - Collect source and prepare
+function install_ceilometermiddleware {
+    if use_library_from_git "ceilometermiddleware"; then
+        git_clone_by_name "ceilometermiddleware"
+        setup_dev_lib "ceilometermiddleware"
+    fi
+}
+
 # start_ceilometer() - Start running processes, including screen
 function start_ceilometer {
     run_process ceilometer-acentral "ceilometer-agent-central --config-file $CEILOMETER_CONF"
diff --git a/stackrc b/stackrc
index 7bb4cc29d9..a1f05fe66e 100644
--- a/stackrc
+++ b/stackrc
@@ -164,7 +164,7 @@ GIT_BASE=${GIT_BASE:-git://git.openstack.org}
 #
 ##############
 
-# metering service
+# telemetry service
 CEILOMETER_REPO=${CEILOMETER_REPO:-${GIT_BASE}/openstack/ceilometer.git}
 CEILOMETER_BRANCH=${CEILOMETER_BRANCH:-master}
 
@@ -407,6 +407,10 @@ GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
 SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/stackforge/swift3.git}
 SWIFT3_BRANCH=${SWIFT3_BRANCH:-master}
 
+# ceilometer middleware
+GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
+GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
+
 
 ##################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 6e1b515efd..cce020399c 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -29,7 +29,7 @@ for i in $TOP/lib/*; do
     fi
 done
 
-ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient tooz"
+ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient tooz ceilometermiddleware"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 183a9c0386e2d4c6846e342855e3ecc1df1b0878 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Mon, 26 Jan 2015 13:39:30 +0900
Subject: [PATCH 0342/3333] ofagent: Vendor code split

Install networking-ofagent from StackForge, using DevStack's
external plugins mechanism.

The following line needs to be added to the existing local.conf settings:
    enable_plugin networking-ofagent https://git.openstack.org/stackforge/networking-ofagent

Remove neutron_thirdparty/ryu, as Ryu is installed via
networking-ofagent's requirements.

Change-Id: I12287a47eac4689414f70b517ee37fb98b260e60
Partially-implements: blueprint core-vendor-decomposition
Partial-Bug: #1412653
---
 lib/neutron_plugins/ofagent_agent | 100 +-----------------------------
 lib/neutron_thirdparty/ryu        |  28 ---------
 2 files changed, 2 insertions(+), 126 deletions(-)
 delete mode 100644 lib/neutron_thirdparty/ryu

diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index d38fbebc74..0bc9bffb55 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -1,100 +1,4 @@
 #!/bin/bash
-#
-# OpenFlow Agent plugin
-# ----------------------
 
-# Save trace setting
-OFA_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-source $TOP_DIR/lib/neutron_thirdparty/ryu  # for RYU_DIR, install_ryu, etc
-
-function neutron_plugin_create_nova_conf {
-    _neutron_ovs_base_configure_nova_vif_driver
-}
-
-function neutron_plugin_install_agent_packages {
-    _neutron_ovs_base_install_agent_packages
-
-    # This agent uses ryu to talk with switches
-    install_package $(get_packages "ryu")
-    install_ryu
-}
-
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
-}
-
-function neutron_plugin_configure_l3_agent {
-    _neutron_ovs_base_configure_l3_agent
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
-}
-
-function _neutron_ofagent_configure_firewall_driver {
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # Set up integration bridge
-    _neutron_ovs_base_setup_bridge $OVS_BRIDGE
-    _neutron_ofagent_configure_firewall_driver
-
-    # Check a supported openflow version
-    OF_VERSION=`ovs-ofctl --version | grep "OpenFlow versions" | awk '{print $3}' | cut -d':' -f2`
-    if [ `vercmp_numbers "$OF_VERSION" "0x3"` -lt "0" ]; then
-        die $LINENO "This agent requires OpenFlow 1.3+ capable switch."
-    fi
-
-    # Enable tunnel networks if selected
-    if [[ "$OVS_ENABLE_TUNNELING" == "True" ]]; then
-        # Verify tunnels are supported
-        # REVISIT - also check kernel module support for GRE and patch ports
-        OVS_VERSION=`ovs-vsctl --version | head -n 1 | grep -E -o "[0-9]+\.[0-9]+"`
-        if [ `vercmp_numbers "$OVS_VERSION" "1.4"` -lt "0" ]; then
-            die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
-        fi
-        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
-    fi
-
-    # Setup physical network bridge mappings.  Override
-    # ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
-        OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
-
-        # Configure bridge manually with physical interface as port for multi-node
-        sudo ovs-vsctl --no-wait -- --may-exist add-br $OVS_PHYSICAL_BRIDGE
-    fi
-    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS
-    fi
-    if [[ "$OFAGENT_PHYSICAL_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE agent physical_interface_mappings \
-            $OFAGENT_PHYSICAL_INTERFACE_MAPPINGS
-    fi
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-ofagent-agent"
-
-    iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
-    iniset $conf_file DEFAULT ovs_use_veth True
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
-}
-
-# Restore xtrace
-$OFA_XTRACE
+# REVISIT(yamamoto): This file is intentionally left empty
+# in order to keep Q_AGENT=ofagent_agent work.
diff --git a/lib/neutron_thirdparty/ryu b/lib/neutron_thirdparty/ryu
deleted file mode 100644
index 1f78a21fa4..0000000000
--- a/lib/neutron_thirdparty/ryu
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/bash
-#
-# Ryu SDN Framework
-# -----------------
-
-# Used by ofagent.
-# TODO(yamamoto): Switch to pip_install once the development was settled
-
-# Save trace setting
-RYU3_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-RYU_DIR=$DEST/ryu
-
-# Make this function idempotent and avoid cloning same repo many times
-# with RECLONE=yes
-_RYU_INSTALLED=${_RYU_INSTALLED:-False}
-function install_ryu {
-    if [[ "$_RYU_INSTALLED" == "False" ]]; then
-        git_clone $RYU_REPO $RYU_DIR $RYU_BRANCH
-        export PYTHONPATH=$RYU_DIR:$PYTHONPATH
-        pip_install $(cat $RYU_DIR/tools/pip-requires)
-        _RYU_INSTALLED=True
-    fi
-}
-
-# Restore xtrace
-$RYU3_XTRACE

From 5ce44cd63b6e2b53f08a6b4b87cb4ab11d1ade26 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 12 Feb 2015 22:18:33 -0600
Subject: [PATCH 0343/3333] Fix is_keystone_enabled()

is_keystone_enabled() was calling is_service_enabled(), which is what called
is_keystone_enabled() in the first place.  Make it work as designed and
also change calls to use the full service name.  Note that this is all
still comptible with the prior usage of 'is_service_enabled key'.

Change-Id: I9c28377ecf074b7996461d2a4ca12d88dfc4d47e
---
 functions-common |  1 -
 lib/keystone     | 12 +++++++++---
 lib/swift        |  4 ++--
 stack.sh         | 12 ++++++------
 unstack.sh       |  2 +-
 5 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 6beb670c6c..ecaa4d948f 100644
--- a/functions-common
+++ b/functions-common
@@ -1817,7 +1817,6 @@ function is_service_enabled {
         [[ ${service} == "trove" && ${ENABLED_SERVICES} =~ "tr-" ]] && enabled=0
         [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
         [[ ${service} == s-* && ${ENABLED_SERVICES} =~ "swift" ]] && enabled=0
-        [[ ${service} == key-* && ${ENABLED_SERVICES} =~ "key" ]] && enabled=0
     done
     $xtrace
     return $enabled
diff --git a/lib/keystone b/lib/keystone
index 2da2d1b4f7..102d188611 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -111,8 +111,17 @@ KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${K
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
 KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 
+
 # Functions
 # ---------
+
+# Test if Keystone is enabled
+# is_keystone_enabled
+function is_keystone_enabled {
+    [[ ,${ENABLED_SERVICES}, =~ ,"key", ]] && return 0
+    return 1
+}
+
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
@@ -576,9 +585,6 @@ function stop_keystone {
     stop_process key
 }
 
-function is_keystone_enabled {
-    return is_service_enabled key
-}
 
 # Restore xtrace
 $XTRACE
diff --git a/lib/swift b/lib/swift
index e4d8b5fe19..2bb6422fd9 100644
--- a/lib/swift
+++ b/lib/swift
@@ -393,7 +393,7 @@ function configure_swift {
         swift_pipeline+=" swift3 s3token "
     fi
 
-    if is_service_enabled key;then
+    if is_service_enabled keystone; then
         swift_pipeline+=" authtoken keystoneauth"
     fi
     swift_pipeline+=" tempauth "
@@ -498,7 +498,7 @@ EOF
     iniset ${testfile} func_test password4 testing4
     iniset ${testfile} func_test domain4 swift_test
 
-    if is_service_enabled key;then
+    if is_service_enabled keystone; then
         iniuncomment ${testfile} func_test auth_version
         local auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
diff --git a/stack.sh b/stack.sh
index 3f97919e0e..da2027662d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -601,7 +601,7 @@ fi
 
 # Keystone
 
-if is_service_enabled key; then
+if is_service_enabled keystone; then
     # The ``SERVICE_TOKEN`` is used to bootstrap the Keystone database.  It is
     # just a string and is not a 'real' Keystone token.
     read_password SERVICE_TOKEN "ENTER A SERVICE_TOKEN TO USE FOR THE SERVICE ADMIN TOKEN."
@@ -725,7 +725,7 @@ else
 fi
 
 
-if is_service_enabled key; then
+if is_service_enabled keystone; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
         install_keystone
         configure_keystone
@@ -918,7 +918,7 @@ start_dstat
 # Keystone
 # --------
 
-if is_service_enabled key; then
+if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
 
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
@@ -1143,7 +1143,7 @@ if is_service_enabled g-reg; then
 fi
 
 # Create an access key and secret key for nova ec2 register image
-if is_service_enabled key && is_service_enabled swift3 && is_service_enabled nova; then
+if is_service_enabled keystone && is_service_enabled swift3 && is_service_enabled nova; then
     eval $(openstack ec2 credentials create --user nova --project $SERVICE_TENANT_NAME -f shell -c access -c secret)
     iniset $NOVA_CONF DEFAULT s3_access_key "$access"
     iniset $NOVA_CONF DEFAULT s3_secret_key "$secret"
@@ -1226,7 +1226,7 @@ fi
 # This step also creates certificates for tenants and users,
 # which is helpful in image bundle steps.
 
-if is_service_enabled nova && is_service_enabled key; then
+if is_service_enabled nova && is_service_enabled keystone; then
     USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
 
     if [ -f $SSL_BUNDLE_FILE ]; then
@@ -1314,7 +1314,7 @@ if is_service_enabled horizon; then
 fi
 
 # If Keystone is present you can point ``nova`` cli to this server
-if is_service_enabled key; then
+if is_service_enabled keystone; then
     echo "Keystone is serving at $KEYSTONE_SERVICE_URI/v2.0/"
     echo "Examples on using novaclient command line is in exercise.sh"
     echo "The default users are: admin and demo"
diff --git a/unstack.sh b/unstack.sh
index 4364e58a32..f31b84c9ae 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -112,7 +112,7 @@ if is_service_enabled glance; then
     stop_glance
 fi
 
-if is_service_enabled key; then
+if is_service_enabled keystone; then
     stop_keystone
 fi
 

From 4c20607e0a867fcd877466e1eccab305ff62a03a Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Mon, 16 Feb 2015 21:56:29 +0000
Subject: [PATCH 0344/3333] Don't prepend $DATA_DIR to volume path that already
 has it

Otherwise the test is testing the wrong file.

Change-Id: Ia7dcda8d4f3a1fe87e74f4605a7010b66c38fa14
---
 lib/lvm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index ed24487c5f..c183f09d04 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -86,7 +86,7 @@ function _create_lvm_volume_group {
     local backing_file=$DATA_DIR/$vg$BACKING_FILE_SUFFIX
     if ! sudo vgs $vg; then
         # Only create if the file doesn't already exists
-        [[ -f $DATA_DIR/$backing_file ]] || truncate -s $size $backing_file
+        [[ -f $backing_file ]] || truncate -s $size $backing_file
         local vg_dev=`sudo losetup -f --show $backing_file`
 
         # Only create volume group if it doesn't already exist

From 230e03af2db04c7f2879e70bc96f850b73294dbe Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Mon, 16 Feb 2015 22:07:00 +0000
Subject: [PATCH 0345/3333] Add admin role back to ceilometer service user

admin is required for the discovery process in the polling agents.

Change-Id: I255184c544c6cc43c832d7c5d19d09b9f43adb10
Closes-Bug: 1422488
---
 lib/ceilometer | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 698e8b07f6..c449ad243d 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -108,7 +108,7 @@ function create_ceilometer_accounts {
     # Ceilometer
     if [[ "$ENABLED_SERVICES" =~ "ceilometer-api" ]]; then
 
-        create_service_user "ceilometer"
+        create_service_user "ceilometer" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
             local ceilometer_service=$(get_or_create_service "ceilometer" \

From 236fd078c085446f7239feba61a1f52c81be5c57 Mon Sep 17 00:00:00 2001
From: Brian Hunter <bhunter@tesora.com>
Date: Thu, 12 Feb 2015 16:14:02 -0500
Subject: [PATCH 0346/3333] define variables for Trove to be used in local.conf

This defines a number of variables for Trove configuration files
and options
In addition to general cleanup within devstack, this also enables
consumers to enable features such as Openstack profiling, without
the need to repeat the hardcoding of these parameters in their
local.conf

Change-Id: Ieaa999ea3ca5c4f7d320416a8d2375c9a1d03d39
closes-bug: #1421403
---
 lib/trove | 83 ++++++++++++++++++++++++++++++-------------------------
 1 file changed, 45 insertions(+), 38 deletions(-)

diff --git a/lib/trove b/lib/trove
index e1b307a52f..d4377186ed 100644
--- a/lib/trove
+++ b/lib/trove
@@ -34,7 +34,13 @@ GITDIR["python-troveclient"]=$DEST/python-troveclient
 
 TROVE_DIR=$DEST/trove
 TROVE_CONF_DIR=/etc/trove
+TROVE_CONF=$TROVE_CONF_DIR/trove.conf
+TROVE_TASKMANAGER_CONF=$TROVE_CONF_DIR/trove-taskmanager.conf
+TROVE_CONDUCTOR_CONF=$TROVE_CONF_DIR/trove-conductor.conf
+TROVE_API_PASTE_INI=$TROVE_CONF_DIR/api-paste.ini
+
 TROVE_LOCAL_CONF_DIR=$TROVE_DIR/etc/trove
+TROVE_LOCAL_API_PASTE_INI=$TROVE_LOCAL_CONF_DIR/api-paste.ini
 TROVE_AUTH_CACHE_DIR=${TROVE_AUTH_CACHE_DIR:-/var/cache/trove}
 TROVE_DATASTORE_TYPE=${TROVE_DATASTORE_TYPE:-"mysql"}
 TROVE_DATASTORE_VERSION=${TROVE_DATASTORE_VERSION:-"5.5"}
@@ -46,6 +52,7 @@ if [[ -d $TROVE_DIR/bin ]]; then
 else
     TROVE_BIN_DIR=$(get_python_exec_prefix)
 fi
+TROVE_MANAGE=$TROVE_BIN_DIR/trove-manage
 
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,trove
@@ -119,48 +126,48 @@ function configure_trove {
     sudo chown -R $STACK_USER: ${TROVE_AUTH_CACHE_DIR}
 
     # Copy api-paste file over to the trove conf dir
-    cp $TROVE_LOCAL_CONF_DIR/api-paste.ini $TROVE_CONF_DIR/api-paste.ini
+    cp $TROVE_LOCAL_API_PASTE_INI $TROVE_API_PASTE_INI
 
     # (Re)create trove conf files
-    rm -f $TROVE_CONF_DIR/trove.conf
-    rm -f $TROVE_CONF_DIR/trove-taskmanager.conf
-    rm -f $TROVE_CONF_DIR/trove-conductor.conf
+    rm -f $TROVE_CONF
+    rm -f $TROVE_TASKMANAGER_CONF
+    rm -f $TROVE_CONDUCTOR_CONF
 
-    iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
-    iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_password $RABBIT_PASSWORD
-    iniset $TROVE_CONF_DIR/trove.conf DEFAULT sql_connection `database_connection_url trove`
-    iniset $TROVE_CONF_DIR/trove.conf DEFAULT default_datastore $TROVE_DATASTORE_TYPE
-    setup_trove_logging $TROVE_CONF_DIR/trove.conf
-    iniset $TROVE_CONF_DIR/trove.conf DEFAULT trove_api_workers "$API_WORKERS"
+    iniset $TROVE_CONF DEFAULT rabbit_userid $RABBIT_USERID
+    iniset $TROVE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
+    iniset $TROVE_CONF DEFAULT sql_connection `database_connection_url trove`
+    iniset $TROVE_CONF DEFAULT default_datastore $TROVE_DATASTORE_TYPE
+    setup_trove_logging $TROVE_CONF
+    iniset $TROVE_CONF DEFAULT trove_api_workers "$API_WORKERS"
 
-    configure_auth_token_middleware $TROVE_CONF_DIR/trove.conf trove $TROVE_AUTH_CACHE_DIR
+    configure_auth_token_middleware $TROVE_CONF trove $TROVE_AUTH_CACHE_DIR
 
     # (Re)create trove taskmanager conf file if needed
     if is_service_enabled tr-tmgr; then
         TROVE_AUTH_ENDPOINT=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
 
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT rabbit_userid $RABBIT_USERID
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT sql_connection `database_connection_url trove`
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT nova_proxy_admin_user radmin
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT nova_proxy_admin_tenant_name trove
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
-        iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
-        setup_trove_logging $TROVE_CONF_DIR/trove-taskmanager.conf
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT rabbit_userid $RABBIT_USERID
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT sql_connection `database_connection_url trove`
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_user radmin
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_tenant_name trove
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
+        iniset $TROVE_TASKMANAGER_CONF DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
+        setup_trove_logging $TROVE_TASKMANAGER_CONF
     fi
 
     # (Re)create trove conductor conf file if needed
     if is_service_enabled tr-cond; then
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT rabbit_userid $RABBIT_USERID
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT sql_connection `database_connection_url trove`
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT nova_proxy_admin_user radmin
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT nova_proxy_admin_tenant_name trove
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
-        iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT control_exchange trove
-        setup_trove_logging $TROVE_CONF_DIR/trove-conductor.conf
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT rabbit_userid $RABBIT_USERID
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT sql_connection `database_connection_url trove`
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_user radmin
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_tenant_name trove
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
+        iniset $TROVE_CONDUCTOR_CONF DEFAULT control_exchange trove
+        setup_trove_logging $TROVE_CONDUCTOR_CONF
     fi
 
     # Set up Guest Agent conf
@@ -197,7 +204,7 @@ function init_trove {
     recreate_database trove
 
     # Initialize the trove database
-    $TROVE_BIN_DIR/trove-manage db_sync
+    $TROVE_MANAGE db_sync
 
     # If no guest image is specified, skip remaining setup
     [ -z "$TROVE_GUEST_IMAGE_URL" ] && return 0
@@ -214,19 +221,19 @@ function init_trove {
     fi
 
     # Now that we have the guest image id, initialize appropriate datastores / datastore versions
-    $TROVE_BIN_DIR/trove-manage datastore_update "$TROVE_DATASTORE_TYPE" ""
-    $TROVE_BIN_DIR/trove-manage datastore_version_update "$TROVE_DATASTORE_TYPE" "$TROVE_DATASTORE_VERSION" "$TROVE_DATASTORE_TYPE" \
+    $TROVE_MANAGE datastore_update "$TROVE_DATASTORE_TYPE" ""
+    $TROVE_MANAGE datastore_version_update "$TROVE_DATASTORE_TYPE" "$TROVE_DATASTORE_VERSION" "$TROVE_DATASTORE_TYPE" \
         "$TROVE_GUEST_IMAGE_ID" "$TROVE_DATASTORE_PACKAGE" 1
-    $TROVE_BIN_DIR/trove-manage datastore_version_update "$TROVE_DATASTORE_TYPE" "inactive_version" "inactive_manager" "$TROVE_GUEST_IMAGE_ID" "" 0
-    $TROVE_BIN_DIR/trove-manage datastore_update "$TROVE_DATASTORE_TYPE" "$TROVE_DATASTORE_VERSION"
-    $TROVE_BIN_DIR/trove-manage datastore_update "Inactive_Datastore" ""
+    $TROVE_MANAGE datastore_version_update "$TROVE_DATASTORE_TYPE" "inactive_version" "inactive_manager" "$TROVE_GUEST_IMAGE_ID" "" 0
+    $TROVE_MANAGE datastore_update "$TROVE_DATASTORE_TYPE" "$TROVE_DATASTORE_VERSION"
+    $TROVE_MANAGE datastore_update "Inactive_Datastore" ""
 }
 
 # start_trove() - Start running processes, including screen
 function start_trove {
-    run_process tr-api "$TROVE_BIN_DIR/trove-api --config-file=$TROVE_CONF_DIR/trove.conf --debug"
-    run_process tr-tmgr "$TROVE_BIN_DIR/trove-taskmanager --config-file=$TROVE_CONF_DIR/trove-taskmanager.conf --debug"
-    run_process tr-cond "$TROVE_BIN_DIR/trove-conductor --config-file=$TROVE_CONF_DIR/trove-conductor.conf --debug"
+    run_process tr-api "$TROVE_BIN_DIR/trove-api --config-file=$TROVE_CONF --debug"
+    run_process tr-tmgr "$TROVE_BIN_DIR/trove-taskmanager --config-file=$TROVE_TASKMANAGER_CONF --debug"
+    run_process tr-cond "$TROVE_BIN_DIR/trove-conductor --config-file=$TROVE_CONDUCTOR_CONF --debug"
 }
 
 # stop_trove() - Stop running processes

From 4abc4d1b6174eb0cd105fec6a6fe51576fbc0045 Mon Sep 17 00:00:00 2001
From: Naohiro Tamura <naohirot@jp.fujitsu.com>
Date: Tue, 17 Feb 2015 22:20:19 +0900
Subject: [PATCH 0347/3333] Fix an error message in the neutron script

The $PHYSICAL_NETWORK in the error message should be
$PRIVATE_NETWORK_NAME, because the command just before this error
message refers to $PRIVATE_NETWORK_NAME.

Change-Id: I9a648f8bd0e61abde8e93bc08282c14b35ec06bd
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 15a5f00fa0..8d27febf63 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -552,7 +552,7 @@ function create_neutron_initial_network {
         sudo ip link set $PUBLIC_INTERFACE up
     else
         NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             # Create IPv4 private subnet

From e356d8cff6b972ad9e7fda2ec0c51f89d5a1fd33 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Tue, 17 Feb 2015 15:05:34 +0000
Subject: [PATCH 0348/3333] XenAPI: Recommend using xl console rather than
 vncviewer

Some vncviewers do not support the -via option, so default to suggesting
xl console.  XenCenter continues to be an option for those running
Windows.

Change-Id: I1e53fd33d309e30a60031965e589167dcbacfbbe
---
 tools/xen/install_os_domU.sh | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index f28ae97940..082c27e8f3 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -149,12 +149,10 @@ SNAME_FIRST_BOOT="before_first_boot"
 
 function wait_for_VM_to_halt {
     set +x
-    echo "Waiting for the VM to halt.  Progress in-VM can be checked with vncviewer:"
+    echo "Waiting for the VM to halt.  Progress in-VM can be checked with XenCenter or xl console:"
     mgmt_ip=$(echo $XENAPI_CONNECTION_URL | tr -d -c '1234567890.')
     domid=$(get_domid "$GUEST_NAME")
-    sleep 20 # Wait for the vnc-port to be written
-    port=$(xenstore-read /local/domain/$domid/console/vnc-port)
-    echo "vncviewer -via root@$mgmt_ip localhost:${port:2}"
+    echo "ssh root@$mgmt_ip \"xl console $domid\""
     while true; do
         state=$(xe_min vm-list name-label="$GUEST_NAME" power-state=halted)
         if [ -n "$state" ]; then

From 39282bf769e26d012b179f32286737f1151219fa Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 17 Feb 2015 09:00:57 -0500
Subject: [PATCH 0349/3333] purge all pure python libraries

python libraries should be installed from upstream, not from the
distro, as much as possible. The following is a first attempt at
purging all the python libraries and making it so that they instead
should fall back to the pypi versions.

Libraries which are known to include native code are left behind.

Change-Id: I47b7e787771683c2fc4404e586f11c1a19aac15c
---
 files/debs/general  |  6 ------
 files/debs/glance   |  7 -------
 files/debs/horizon  | 16 ----------------
 files/debs/keystone |  8 --------
 files/debs/n-api    |  2 --
 files/debs/neutron  |  9 ---------
 files/debs/nova     | 15 ---------------
 files/debs/swift    | 11 ++---------
 8 files changed, 2 insertions(+), 72 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 4050191379..5047c12249 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,5 +1,4 @@
 bridge-utils
-pylint
 screen
 unzip
 wget
@@ -10,17 +9,12 @@ graphviz # testonly - docs
 lsof # useful when debugging
 openssh-server
 openssl
-python-virtualenv
-python-unittest2
 iputils-ping
 wget
 curl
 tcpdump
-euca2ools # only for testing client
 tar
-python-cmd2 # dist:precise
 python-dev
-python-mock # testonly
 python2.7
 bc
 libyaml-dev
diff --git a/files/debs/glance b/files/debs/glance
index 8db8145935..9fda6a63d9 100644
--- a/files/debs/glance
+++ b/files/debs/glance
@@ -3,11 +3,4 @@ libpq-dev           # testonly
 libssl-dev          # testonly
 libxml2-dev
 libxslt1-dev        # testonly
-python-eventlet
-python-routes
-python-greenlet
-python-sqlalchemy
-python-pastedeploy
-python-xattr
-python-iso8601
 zlib1g-dev           # testonly
diff --git a/files/debs/horizon b/files/debs/horizon
index f9b7d597dc..1f45b54f7c 100644
--- a/files/debs/horizon
+++ b/files/debs/horizon
@@ -1,19 +1,3 @@
 apache2  # NOPRIME
 libapache2-mod-wsgi  # NOPRIME
-python-beautifulsoup
-python-dateutil
-python-paste
-python-pastedeploy
-python-anyjson
-python-routes
-python-xattr
-python-sqlalchemy
-python-webob
-pylint
-python-eventlet
-python-nose
-python-mox
-python-coverage
-python-cherrypy3 # why?
-python-migrate
 libpcre3-dev  # pyScss
diff --git a/files/debs/keystone b/files/debs/keystone
index d316a4291b..70a56499e9 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,15 +1,7 @@
 python-lxml
-python-pastescript
-python-pastedeploy
-python-paste
 sqlite3
-python-pysqlite2
-python-sqlalchemy
 python-mysqldb
 python-mysql.connector
-python-webob
-python-greenlet
-python-routes
 libldap2-dev
 libsasl2-dev
 libkrb5-dev
diff --git a/files/debs/n-api b/files/debs/n-api
index b4372d9361..0928cd56b9 100644
--- a/files/debs/n-api
+++ b/files/debs/n-api
@@ -1,3 +1 @@
-python-dateutil
-msgpack-python
 fping
diff --git a/files/debs/neutron b/files/debs/neutron
index 3f4b6d2999..aa3d7095ca 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -7,17 +7,8 @@ libmysqlclient-dev  # testonly
 mysql-server #NOPRIME
 sudo
 postgresql-server-dev-all       # testonly
-python-iso8601
-python-paste
-python-routes
-python-suds
-python-pastedeploy
-python-greenlet
-python-eventlet
-python-sqlalchemy
 python-mysqldb
 python-mysql.connector
-python-pyudev
 python-qpid # NOPRIME
 dnsmasq-base
 dnsmasq-utils # for dhcp_release only available in dist:precise
diff --git a/files/debs/nova b/files/debs/nova
index 66f29c4baf..0c31385ddd 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,7 +8,6 @@ libmysqlclient-dev  # testonly
 mysql-server # NOPRIME
 python-mysqldb
 python-mysql.connector
-python-xattr # needed for glance which is needed for nova --- this shouldn't be here
 python-lxml # needed for glance which is needed for nova --- this shouldn't be here
 gawk
 iptables
@@ -27,22 +26,8 @@ genisoimage # required for config_drive
 rabbitmq-server # NOPRIME
 qpidd # NOPRIME
 socat # used by ajaxterm
-python-mox
-python-paste
-python-migrate
-python-greenlet
 python-libvirt # NOPRIME
 python-libxml2
-python-routes
 python-numpy # used by websockify for spice console
-python-pastedeploy
-python-eventlet
-python-cheetah
-python-tempita
-python-sqlalchemy
-python-suds
-python-lockfile
 python-m2crypto
-python-feedparser
-python-iso8601
 python-qpid # NOPRIME
diff --git a/files/debs/swift b/files/debs/swift
index fd51699238..b32b43985a 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -1,14 +1,7 @@
 curl
 memcached
-python-configobj
-python-coverage
-python-eventlet
-python-greenlet
-python-netifaces
+# NOTE python-nose only exists because of swift functional job, we should probably
+# figure out a more consistent way of installing this from test-requirements.txt instead
 python-nose
-python-pastedeploy
-python-simplejson
-python-webob
-python-xattr
 sqlite3
 xfsprogs

From d5ac7852473a8a34ae097c33ed173d640db80379 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Fri, 6 Feb 2015 19:29:23 -0800
Subject: [PATCH 0350/3333] Add new function get_from_global_requirements

Instead of specifying the version of a library in devstack, use the version from
global-requirements

Add new function get_from_global_requirements and use it
where it makes sense.

Change-Id: I6b2f062761ac05ef72fc6cc9993bc204faf06fa5
---
 inc/python  | 11 +++++++++++
 lib/horizon |  3 +--
 lib/tempest |  3 ++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index 0348cb389f..8da9a13aa5 100644
--- a/inc/python
+++ b/inc/python
@@ -95,6 +95,17 @@ function pip_install {
     fi
 }
 
+# get version of a package from global requirements file
+# get_from_global_requirements <package>
+function get_from_global_requirements {
+    local package=$1
+    local required_pkg=$(grep -h ${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
+    if [[ $required_pkg == ""  ]]; then
+        die $LINENO "Can't find package $package in requirements"
+    fi
+    echo $required_pkg
+}
+
 # should we use this library from their git repo, or should we let it
 # get pulled in via pip dependencies.
 function use_library_from_git {
diff --git a/lib/horizon b/lib/horizon
index 122d516673..a8e83f9d8f 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -182,8 +182,7 @@ function stop_horizon {
 # NOTE: It can be moved to common functions, but it is only used by compilation
 # of django_openstack_auth catalogs at the moment.
 function _prepare_message_catalog_compilation {
-    local babel_package=$(grep ^Babel $REQUIREMENTS_DIR/global-requirements.txt)
-    pip_install "$babel_package"
+    pip_install $(get_from_global_requirements Babel)
 }
 
 
diff --git a/lib/tempest b/lib/tempest
index 5ca217e893..bb08a05307 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -96,7 +96,8 @@ function remove_disabled_extensions {
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     # install testr since its used to process tempest logs
-    pip_install `grep -h testrepository $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1`
+    pip_install $(get_from_global_requirements testrepository)
+
     local image_lines
     local images
     local num_images

From 606f3478b1ac0021d4e66bf56aaa3b3ea5aba865 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Wed, 18 Feb 2015 13:55:48 +0900
Subject: [PATCH 0351/3333] Remove no longer used definitions for Ryu

Change-Id: Ie6dcf1569aacfa8d20e905d694847594b136fed1
---
 files/debs/ryu      | 1 -
 files/rpms-suse/ryu | 1 -
 files/rpms/ryu      | 1 -
 stackrc             | 4 ----
 4 files changed, 7 deletions(-)
 delete mode 100644 files/debs/ryu
 delete mode 100644 files/rpms-suse/ryu
 delete mode 100644 files/rpms/ryu

diff --git a/files/debs/ryu b/files/debs/ryu
deleted file mode 100644
index 354c1b75d3..0000000000
--- a/files/debs/ryu
+++ /dev/null
@@ -1 +0,0 @@
-python-eventlet
diff --git a/files/rpms-suse/ryu b/files/rpms-suse/ryu
deleted file mode 100644
index 354c1b75d3..0000000000
--- a/files/rpms-suse/ryu
+++ /dev/null
@@ -1 +0,0 @@
-python-eventlet
diff --git a/files/rpms/ryu b/files/rpms/ryu
deleted file mode 100644
index 354c1b75d3..0000000000
--- a/files/rpms/ryu
+++ /dev/null
@@ -1 +0,0 @@
-python-eventlet
diff --git a/stackrc b/stackrc
index 7bbde9941a..19bc19a170 100644
--- a/stackrc
+++ b/stackrc
@@ -450,10 +450,6 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/kanaka/noVNC.git}
 NOVNC_BRANCH=${NOVNC_BRANCH:-master}
 
-# ryu service
-RYU_REPO=${RYU_REPO:-https://github.com/osrg/ryu.git}
-RYU_BRANCH=${RYU_BRANCH:-master}
-
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
 SPICE_BRANCH=${SPICE_BRANCH:-master}

From d5323979ad247ae247f9b201934cba86f59aeba6 Mon Sep 17 00:00:00 2001
From: Yuki Nishiwaki <uckey.1067@gmail.com>
Date: Tue, 17 Feb 2015 19:00:23 +0900
Subject: [PATCH 0352/3333] Change config of keystone_authtoken in lib/ironic

This commit is temporary work-around until Ironic is fixed(bug#1422632)

The reason of creating temporary work-around is following
Ironic re-uses specific values from the keystone_authtoken middleware.
So we should specify admin_user, admin_password and so on instead of username, password.

Change-Id: If8869e16a167eea0af87afda0eabcbb803627db6
Closes-Bug: #1418341 at devstack
---
 lib/ironic | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 7ffa6a5caf..7313d2508e 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -278,7 +278,18 @@ function configure_ironic {
 function configure_ironic_api {
     iniset $IRONIC_CONF_FILE DEFAULT auth_strategy keystone
     iniset $IRONIC_CONF_FILE DEFAULT policy_file $IRONIC_POLICY_JSON
-    configure_auth_token_middleware $IRONIC_CONF_FILE ironic $IRONIC_AUTH_CACHE_DIR/api
+
+    # TODO(Yuki Nishiwaki): This is a temporary work-around until Ironic is fixed(bug#1422632).
+    # These codes need to be changed to use the function of configure_auth_token_middleware
+    # after Ironic conforms to the new auth plugin.
+    iniset $IRONIC_CONF_FILE keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+    iniset $IRONIC_CONF_FILE keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
+    iniset $IRONIC_CONF_FILE keystone_authtoken admin_user ironic
+    iniset $IRONIC_CONF_FILE keystone_authtoken admin_password $SERVICE_PASSWORD
+    iniset $IRONIC_CONF_FILE keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $IRONIC_CONF_FILE keystone_authtoken cafile $SSL_BUNDLE_FILE
+    iniset $IRONIC_CONF_FILE keystone_authtoken signing_dir $IRONIC_AUTH_CACHE_DIR/api
+
     iniset_rpc_backend ironic $IRONIC_CONF_FILE DEFAULT
     iniset $IRONIC_CONF_FILE api port $IRONIC_SERVICE_PORT
 

From 6b9debaa2476a393d90dae1c33111d4c29d37464 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 18 Feb 2015 11:24:31 -0800
Subject: [PATCH 0353/3333] Stop referring to grizzly

I am pretty sure that won't even work.

Also fix tiny typo in the faq

Change-Id: Ie2e5640b8d4214a271d5af3b652b1a18db010b61
---
 README.md          |  4 ++--
 doc/source/faq.rst | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 40060a7cf5..206ffe098b 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,9 @@ in a clean and disposable vm when you are first getting started.
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a grizzly OpenStack cloud:
+following to create a juno OpenStack cloud:
 
-    git checkout stable/grizzly
+    git checkout stable/juno
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index a449f496ee..d3b491fdac 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -80,7 +80,7 @@ Q: Why can't I use another shell?
 Q: But, but, can't I test on OS/X?
    A: Yes, even you, core developer who complained about this, needs to
    install bash 4 via homebrew to keep running tests on OS/X.  Get a Real
-   Operating System.   (For most of you who don't know, I am refering to
+   Operating System.   (For most of you who don't know, I am referring to
    myself.)
 
 Operation and Configuration
@@ -118,13 +118,13 @@ Q: How do I run a specific OpenStack milestone?
     ::
 
         [[local|localrc]]
-        GLANCE_BRANCH=stable/grizzly
-        HORIZON_BRANCH=stable/grizzly
-        KEYSTONE_BRANCH=stable/grizzly
-        NOVA_BRANCH=stable/grizzly
-        GLANCE_BRANCH=stable/grizzly
-        NEUTRON_BRANCH=stable/grizzly
-        SWIFT_BRANCH=1.10.0
+        GLANCE_BRANCH=stable/juno
+        HORIZON_BRANCH=stable/juno
+        KEYSTONE_BRANCH=stable/juno
+        NOVA_BRANCH=stable/juno
+        GLANCE_BRANCH=stable/juno
+        NEUTRON_BRANCH=stable/juno
+        SWIFT_BRANCH=2.2.1
 
 Q: Why not use [STRIKEOUT:``tools/pip-requires``]\ ``requirements.txt`` to grab project dependencies?
     [STRIKEOUT:The majority of deployments will use packages to install

From b1d8e8e274f0c220ae19ee3ea1a3b9a533459297 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Mon, 16 Feb 2015 13:58:35 -0600
Subject: [PATCH 0354/3333] Build wheel cache for venvs

Building a bunch of virtual envs later is going to be tedious if we do not
pre-cache certain annoying-to-build packages.

* tools/build_wheels.sh: pre-build some wheels for annoying package installs
* list distro package dependencies in files/*/venv
* list packages to pre-build as wheels in files/venv-requirements.txt
* install database Python modules when setting up the database

Change-Id: Idff1ea69a5ca12ba56098e664dbf6924fe6a2e47
---
 clean.sh                    |  4 ++
 files/debs/devlibs          |  7 ++++
 files/debs/postgresql       |  1 -
 files/rpms-suse/devlibs     |  6 +++
 files/rpms-suse/postgresql  |  1 -
 files/rpms/devlibs          |  8 ++++
 files/rpms/postgresql       |  1 -
 files/venv-requirements.txt | 10 +++++
 lib/databases/mysql         |  3 ++
 lib/databases/postgresql    |  3 ++
 stack.sh                    | 15 ++++++++
 stackrc                     |  5 +++
 tools/build_wheels.sh       | 77 +++++++++++++++++++++++++++++++++++++
 13 files changed, 138 insertions(+), 3 deletions(-)
 create mode 100644 files/debs/devlibs
 delete mode 100644 files/debs/postgresql
 create mode 100644 files/rpms-suse/devlibs
 delete mode 100644 files/rpms-suse/postgresql
 create mode 100644 files/rpms/devlibs
 delete mode 100644 files/rpms/postgresql
 create mode 100644 files/venv-requirements.txt
 create mode 100755 tools/build_wheels.sh

diff --git a/clean.sh b/clean.sh
index 50d414c1d9..fea1230c7b 100755
--- a/clean.sh
+++ b/clean.sh
@@ -119,6 +119,10 @@ if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
     sudo rm -rf $SCREEN_LOGDIR
 fi
 
+# Clean up venvs
+DIRS_TO_CLEAN="$WHEELHOUSE"
+rm -rf $DIRS_TO_CLEAN
+
 # Clean up files
 
 FILES_TO_CLEAN=".localrc.auto docs/files docs/html shocco/ stack-screenrc test*.conf* test.ini*"
diff --git a/files/debs/devlibs b/files/debs/devlibs
new file mode 100644
index 0000000000..0446ceb6b6
--- /dev/null
+++ b/files/debs/devlibs
@@ -0,0 +1,7 @@
+libffi-dev  # pyOpenSSL
+libmysqlclient-dev  # MySQL-python
+libpq-dev  # psycopg2
+libssl-dev  # pyOpenSSL
+libxml2-dev  # lxml
+libxslt1-dev  # lxml
+python-dev  # pyOpenSSL
diff --git a/files/debs/postgresql b/files/debs/postgresql
deleted file mode 100644
index bf19d397cb..0000000000
--- a/files/debs/postgresql
+++ /dev/null
@@ -1 +0,0 @@
-python-psycopg2
diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
new file mode 100644
index 0000000000..11722adf3c
--- /dev/null
+++ b/files/rpms-suse/devlibs
@@ -0,0 +1,6 @@
+libffi-devel  # pyOpenSSL
+libopenssl-devel  # pyOpenSSL
+libxml2-devel  # lxml
+libxslt1-dev  # lxml
+postgresql-devel  # psycopg2
+python-devel  # pyOpenSSL
diff --git a/files/rpms-suse/postgresql b/files/rpms-suse/postgresql
deleted file mode 100644
index bf19d397cb..0000000000
--- a/files/rpms-suse/postgresql
+++ /dev/null
@@ -1 +0,0 @@
-python-psycopg2
diff --git a/files/rpms/devlibs b/files/rpms/devlibs
new file mode 100644
index 0000000000..6010c9fd37
--- /dev/null
+++ b/files/rpms/devlibs
@@ -0,0 +1,8 @@
+libffi-devel  # pyOpenSSL
+libxml2-devel  # lxml
+libxslt1-devel  # lxml
+mariadb-devel  # MySQL-python  f20,f21,rhel7
+mysql-devel  # MySQL-python  rhel6
+openssl-devel  # pyOpenSSL
+postgresql-devel  # psycopg2
+python-devel  # pyOpenSSL
diff --git a/files/rpms/postgresql b/files/rpms/postgresql
deleted file mode 100644
index bf19d397cb..0000000000
--- a/files/rpms/postgresql
+++ /dev/null
@@ -1 +0,0 @@
-python-psycopg2
diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
new file mode 100644
index 0000000000..3c50061e96
--- /dev/null
+++ b/files/venv-requirements.txt
@@ -0,0 +1,10 @@
+lxml
+MySQL-python
+netifaces
+numpy
+posix-ipc
+psycopg2
+pycrypto
+pyOpenSSL
+PyYAML
+xattr
diff --git a/lib/databases/mysql b/lib/databases/mysql
index c8ceec2455..70073c4c6f 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -151,6 +151,9 @@ EOF
     else
         exit_distro_not_supported "mysql installation"
     fi
+
+    # Install Python client module
+    pip_install MySQL-python
 }
 
 function database_connection_url_mysql {
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 317e0ebf53..dfda9adbaf 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -100,6 +100,9 @@ EOF
     else
         exit_distro_not_supported "postgresql installation"
     fi
+
+    # Install Python client module
+    pip_install MySQL-python psycopg2
 }
 
 function database_connection_url_postgresql {
diff --git a/stack.sh b/stack.sh
index 753135bc81..49288a7438 100755
--- a/stack.sh
+++ b/stack.sh
@@ -671,6 +671,21 @@ fi
 source $TOP_DIR/tools/fixup_stuff.sh
 
 
+# Virtual Environment
+# -------------------
+
+# Temporary hack for testing
+# This belongs in d-g functions.sh setup_host() or devstack-vm-gate.sh
+if [[ -d /var/cache/pip ]]; then
+    sudo chown -R $STACK_USER:$STACK_USER /var/cache/pip
+fi
+
+# Pre-build some problematic wheels
+if [[ ! -d ${WHEELHOUSE:-} ]]; then
+    source tools/build_wheels.sh
+fi
+
+
 # Extras Pre-install
 # ------------------
 
diff --git a/stackrc b/stackrc
index 386c5d53e3..ee601a9b45 100644
--- a/stackrc
+++ b/stackrc
@@ -112,6 +112,11 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Configure wheel cache location
+export WHEELHOUSE=${WHEELHOUSE:-$DEST/.wheelhouse}
+export PIP_WHEEL_DIR=${PIP_WHEEL_DIR:-$WHEELHOUSE}
+export PIP_FIND_LINKS=${PIP_FIND_LINKS:-file://$WHEELHOUSE}
+
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)
 DATABASE_QUERY_LOGGING=$(trueorfalse True DATABASE_QUERY_LOGGING)
diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
new file mode 100755
index 0000000000..c87b6dafe6
--- /dev/null
+++ b/tools/build_wheels.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+#
+# **tools/build_wheels.sh** - Build a cache of Python wheels
+#
+# build_wheels.sh [package [...]]
+#
+# System package prerequisites listed in files/*/devlibs will be installed
+#
+# Builds wheels for all virtual env requirements listed in
+# ``venv-requirements.txt`` plus any supplied on the command line.
+#
+# Assumes ``tools/install_pip.sh`` has been run and a suitable pip/setuptools is available.
+
+# If TOP_DIR is set we're being sourced rather than running stand-alone
+# or in a sub-shell
+if [[ -z "$TOP_DIR" ]]; then
+
+    set -o errexit
+    set -o nounset
+
+    # Keep track of the devstack directory
+    TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
+    FILES=$TOP_DIR/files
+
+    # Import common functions
+    source $TOP_DIR/functions
+
+    GetDistro
+
+    source $TOP_DIR/stackrc
+
+    trap err_trap ERR
+
+fi
+
+# Get additional packages to build
+MORE_PACKAGES="$@"
+
+# Set a fall-back default, assume that since this script is being called
+# package builds are to happen even if WHEELHOUSE is not configured
+export WHEELHOUSE=${WHEELHOUSE:-.wheelhouse}
+
+# Exit on any errors so that errors don't compound
+function err_trap {
+    local r=$?
+    set +o xtrace
+
+    rm -rf $TMP_VENV_PATH
+
+    exit $r
+}
+
+# Get system prereqs
+install_package $(get_packages devlibs)
+
+# Get a modern ``virtualenv``
+pip_install virtualenv
+
+# Prepare the workspace
+TMP_VENV_PATH=$(mktemp -d tmp-venv-XXXX)
+virtualenv $TMP_VENV_PATH
+
+# Install modern pip and wheel
+$TMP_VENV_PATH/bin/pip install -U pip wheel
+
+# VENV_PACKAGES is a list of packages we want to pre-install
+VENV_PACKAGE_FILE=$FILES/venv-requirements.txt
+if [[ -r $VENV_PACKAGE_FILE ]]; then
+    VENV_PACKAGES=$(grep -v '^#' $VENV_PACKAGE_FILE)
+fi
+
+for pkg in ${VENV_PACKAGES,/ } ${MORE_PACKAGES}; do
+    $TMP_VENV_PATH/bin/pip wheel $pkg
+done
+
+# Clean up wheel workspace
+rm -rf $TMP_VENV_PATH

From 20a3dbdfa178f6e916e09f65476b9dfeb4748a4a Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Mon, 16 Feb 2015 13:24:35 +0000
Subject: [PATCH 0355/3333] mysql: disable query logging by default

Having DATABASE_QUERY_LOGGING enabled results in devstack turning
on verbose mysql query logging. This results in a log file
/var/log/mariadb/mariadb-slow.log that grows to 10's of GB in
size in very little time (few weeks if that). Developers never
seem to notice this exists until their host OS runs out of disk
space due to this logfile that is never truncated.

Very few people will ever look at this logged data, so a more
sensible default is False, to make the out of the box setup be
suitable for the majority. Those few people who want to debug
mysql query performance can enable it in local.conf, as will
the devstack gate setup scripts.

Depends-On: I6970d61474528f554134d0aa333cd52b7b20f309
Change-Id: Ia4a366c839ac51623bc1fbee3560dc4d848cce14
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 7bb4cc29d9..ad2e72d197 100644
--- a/stackrc
+++ b/stackrc
@@ -114,7 +114,7 @@ fi
 
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)
-DATABASE_QUERY_LOGGING=$(trueorfalse True DATABASE_QUERY_LOGGING)
+DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is

From b787b684f39eef779e416d5c86941810969ed456 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 18 Feb 2015 15:20:31 -0800
Subject: [PATCH 0356/3333] Add qemu-utils to n-cpu debs

Qemu-utils is needed by nova-cpu, we are hitting issues with this in
multi node testing where fewer services are installed on the second
node.

Change-Id: I4b0a217a252c7862014443230dda2bcced355c93
---
 files/debs/n-cpu | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index a82304dfe2..534b1c1159 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,3 +1,4 @@
+qemu-utils
 # Stuff for diablo volumes
 lvm2
 open-iscsi

From 8c2ce6ea724c9123b8cc5660c6ad52aa8ebf9865 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 18 Feb 2015 14:47:54 -0600
Subject: [PATCH 0357/3333] Virtual environment groundwork

Introduce the tooling to build virtual environments.

* tools/build_venv.sh: build a venv
* introduce lib/stack to house functionality extracted from stack.sh that
  is needed in other places, such as Grenade; start with stack_install_service
  to wrap the venv install mechanics
* declare PROJECT_VENV array to track where project venvs should be installed
* create a venv for each project defined in PROJECT_VENV in stack_install_service()

Change-Id: I508588c0e2541b976dd94569d44b61dd2c35c01c
---
 clean.sh            |  2 +-
 inc/python          |  8 +++++-
 lib/stack           | 29 ++++++++++++++++++++++
 stack.sh            | 21 +++++++++-------
 tools/build_venv.sh | 59 +++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 108 insertions(+), 11 deletions(-)
 create mode 100644 lib/stack
 create mode 100755 tools/build_venv.sh

diff --git a/clean.sh b/clean.sh
index fea1230c7b..4f8c051b53 100755
--- a/clean.sh
+++ b/clean.sh
@@ -120,7 +120,7 @@ if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
 fi
 
 # Clean up venvs
-DIRS_TO_CLEAN="$WHEELHOUSE"
+DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]}"
 rm -rf $DIRS_TO_CLEAN
 
 # Clean up files
diff --git a/inc/python b/inc/python
index d9451b4b16..dfc4d63ca4 100644
--- a/inc/python
+++ b/inc/python
@@ -15,6 +15,13 @@ INC_PY_TRACE=$(set +o | grep xtrace)
 set +o xtrace
 
 
+# Global Config Variables
+
+# PROJECT_VENV contains the name of the virtual enviromnet for each
+# project.  A null value installs to the system Python directories.
+declare -A PROJECT_VENV
+
+
 # Python Functions
 # ================
 
@@ -105,7 +112,6 @@ function pip_install {
                 -r $test_req
         fi
     fi
-    $xtrace
 }
 
 # get version of a package from global requirements file
diff --git a/lib/stack b/lib/stack
new file mode 100644
index 0000000000..6ca6c0baf2
--- /dev/null
+++ b/lib/stack
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# lib/stack
+#
+# These functions are code snippets pulled out of stack.sh for easier
+# re-use by Grenade.  They can assume the same environment is available
+# as in the lower part of stack.sh, namely a valid stackrc has been sourced
+# as well as all of the lib/* files for the services have been sourced.
+#
+# For clarity, all functions declared here that came from ``stack.sh``
+# shall be named with the prefix ``stack_``.
+
+
+# Generic service install handles venv creation if confgured for service
+# stack_install_service service
+function stack_install_service {
+    local service=$1
+    if type install_${service} >/dev/null 2>&1; then
+        if [[ -n ${PROJECT_VENV[$service]:-} ]]; then
+            rm -rf ${PROJECT_VENV[$service]}
+            source tools/build_venv.sh ${PROJECT_VENV[$service]}
+            export PIP_VIRTUAL_ENV=${PROJECT_VENV[$service]:-}
+        fi
+        install_${service}
+        if [[ -n ${PROJECT_VENV[$service]:-} ]]; then
+            unset PIP_VIRTUAL_ENV
+        fi
+    fi
+}
diff --git a/stack.sh b/stack.sh
index 49288a7438..0ec7a5e5e5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -94,6 +94,9 @@ source $TOP_DIR/functions
 # Import config functions
 source $TOP_DIR/lib/config
 
+# Import 'public' stack.sh functions
+source $TOP_DIR/lib/stack
+
 # Determine what system we are running on.  This provides ``os_VENDOR``,
 # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
@@ -742,13 +745,13 @@ fi
 
 if is_service_enabled keystone; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
-        install_keystone
+        stack_install_service keystone
         configure_keystone
     fi
 fi
 
 if is_service_enabled s-proxy; then
-    install_swift
+    stack_install_service swift
     configure_swift
 
     # swift3 middleware to provide S3 emulation to Swift
@@ -762,23 +765,23 @@ fi
 
 if is_service_enabled g-api n-api; then
     # image catalog service
-    install_glance
+    stack_install_service glance
     configure_glance
 fi
 
 if is_service_enabled cinder; then
-    install_cinder
+    stack_install_service cinder
     configure_cinder
 fi
 
 if is_service_enabled neutron; then
-    install_neutron
+    stack_install_service neutron
     install_neutron_third_party
 fi
 
 if is_service_enabled nova; then
     # compute service
-    install_nova
+    stack_install_service nova
     cleanup_nova
     configure_nova
 fi
@@ -787,19 +790,19 @@ if is_service_enabled horizon; then
     # django openstack_auth
     install_django_openstack_auth
     # dashboard
-    install_horizon
+    stack_install_service horizon
     configure_horizon
 fi
 
 if is_service_enabled ceilometer; then
     install_ceilometerclient
-    install_ceilometer
+    stack_install_service ceilometer
     echo_summary "Configuring Ceilometer"
     configure_ceilometer
 fi
 
 if is_service_enabled heat; then
-    install_heat
+    stack_install_service heat
     install_heat_other
     cleanup_heat
     configure_heat
diff --git a/tools/build_venv.sh b/tools/build_venv.sh
new file mode 100755
index 0000000000..ad9508056b
--- /dev/null
+++ b/tools/build_venv.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+#
+# **tools/build_venv.sh** - Build a Python Virtual Envirnment
+#
+# build_venv.sh venv-path [package [...]]
+#
+# Assumes:
+# - a useful pip is installed
+# - virtualenv will be installed by pip
+# - installs basic common prereq packages that require compilation
+#   to allow quick copying of resulting venv as a baseline
+
+
+VENV_DEST=${1:-.venv}
+shift
+
+MORE_PACKAGES="$@"
+
+# If TOP_DIR is set we're being sourced rather than running stand-alone
+# or in a sub-shell
+if [[ -z "$TOP_DIR" ]]; then
+
+    set -o errexit
+    set -o nounset
+
+    # Keep track of the devstack directory
+    TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
+    FILES=$TOP_DIR/files
+
+    # Import common functions
+    source $TOP_DIR/functions
+
+    GetDistro
+
+    source $TOP_DIR/stackrc
+
+    trap err_trap ERR
+
+fi
+
+# Exit on any errors so that errors don't compound
+function err_trap {
+    local r=$?
+    set +o xtrace
+
+    rm -rf $TMP_VENV_PATH
+
+    exit $r
+}
+
+# Build new venv
+virtualenv $VENV_DEST
+
+# Install modern pip
+$VENV_DEST/bin/pip install -U pip
+
+for pkg in ${MORE_PACKAGES}; do
+    pip_install_venv $VENV_DEST $pkg
+done

From 20b027b79cf628a8be974bc5b9aff17b46c773b3 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Wed, 4 Feb 2015 02:38:13 -0500
Subject: [PATCH 0358/3333] Add oslo.policy to lib/oslo and stackrc

As per the graduation work items, any new libraries should be
added to lib/oslo and stackrc

partially implements bp graduate-policy

Change-Id: Ief8f28715ecff5a602d6d840d736ea07b5e7ff39
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 31c9d34849..effde90f13 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -31,6 +31,7 @@ GITDIR["oslo.i18n"]=$DEST/oslo.i18n
 GITDIR["oslo.log"]=$DEST/oslo.log
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
 GITDIR["oslo.middleware"]=$DEST/oslo.middleware
+GITDIR["oslo.policy"]=$DEST/oslo.policy
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
 GITDIR["oslo.utils"]=$DEST/oslo.utils
@@ -65,6 +66,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.log"
     _do_install_oslo_lib "oslo.messaging"
     _do_install_oslo_lib "oslo.middleware"
+    _do_install_oslo_lib "oslo.policy"
     _do_install_oslo_lib "oslo.rootwrap"
     _do_install_oslo_lib "oslo.serialization"
     _do_install_oslo_lib "oslo.utils"
diff --git a/stackrc b/stackrc
index 42a625baed..96e6a700a0 100644
--- a/stackrc
+++ b/stackrc
@@ -341,6 +341,10 @@ GITBRANCH["oslo.messaging"]=${OSLOMSG_BRANCH:-master}
 GITREPO["oslo.middleware"]=${OSLOMID_REPO:-${GIT_BASE}/openstack/oslo.middleware.git}
 GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-master}
 
+# oslo.policy
+GITREPO["oslo.policy"]=${OSLOPOLICY_REPO:-${GIT_BASE}/openstack/oslo.policy.git}
+GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-master}
+
 # oslo.rootwrap
 GITREPO["oslo.rootwrap"]=${OSLORWRAP_REPO:-${GIT_BASE}/openstack/oslo.rootwrap.git}
 GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index cce020399c..a2a6cb781c 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -29,7 +29,7 @@ for i in $TOP/lib/*; do
     fi
 done
 
-ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient tooz ceilometermiddleware"
+ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient tooz ceilometermiddleware oslo.policy"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 380d92cc7a0601d89e40d311172e7e3ee4a58640 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 18 Feb 2015 16:22:06 +0100
Subject: [PATCH 0359/3333] Ensure lvm2-lvmetad service running on Fedora

When the lvm package gets installed the meta service does
not gets started automatically, but it becomes enabled so it would be
running on the next reboot.

The lvm commands are configured to use this service.
In the past this issue just causes warnings in the cinder log,
but now it can lead to a real issue.

It is better to ensure it is really running,
because it speeds up the lvm related commands.

Change-Id: I17fe2c3bcf77a6505ed2b6c824c5b20807beb725
---
 lib/lvm | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index c183f09d04..39eed00675 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -103,14 +103,17 @@ function _create_lvm_volume_group {
 function init_lvm_volume_group {
     local vg=$1
     local size=$2
-    # Start with a clean volume group
-    _create_lvm_volume_group $vg $size
 
+    # Start the lvmetad and tgtd services
     if is_fedora || is_suse; then
-        # service is not started by default
+        # services is not started by default
+        start_service lvm2-lvmetad
         start_service tgtd
     fi
 
+    # Start with a clean volume group
+    _create_lvm_volume_group $vg $size
+
     # Remove iscsi targets
     sudo tgtadm --op show --mode target | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
 

From 69741a99c783c4113280988d51c3226a7a1613fd Mon Sep 17 00:00:00 2001
From: Mikhail S Medvedev <mmedvede@us.ibm.com>
Date: Thu, 19 Feb 2015 19:05:19 -0600
Subject: [PATCH 0360/3333] Fix package names that cause f20/f21 breakage

Closes-Bug: #1423720
Change-Id: I8fdea7d24d1ec09885d2a395d4ba656f4194d39f
---
 files/rpms-suse/devlibs | 2 +-
 files/rpms/devlibs      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
index 11722adf3c..dbcd6af95b 100644
--- a/files/rpms-suse/devlibs
+++ b/files/rpms-suse/devlibs
@@ -1,6 +1,6 @@
 libffi-devel  # pyOpenSSL
 libopenssl-devel  # pyOpenSSL
 libxml2-devel  # lxml
-libxslt1-dev  # lxml
+libxslt-dev  # lxml
 postgresql-devel  # psycopg2
 python-devel  # pyOpenSSL
diff --git a/files/rpms/devlibs b/files/rpms/devlibs
index 6010c9fd37..42b7865978 100644
--- a/files/rpms/devlibs
+++ b/files/rpms/devlibs
@@ -1,6 +1,6 @@
 libffi-devel  # pyOpenSSL
 libxml2-devel  # lxml
-libxslt1-devel  # lxml
+libxslt-devel  # lxml
 mariadb-devel  # MySQL-python  f20,f21,rhel7
 mysql-devel  # MySQL-python  rhel6
 openssl-devel  # pyOpenSSL

From aa8d31ac8b6a69b40569f7d906b8217ac6612c2d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 20 Feb 2015 06:10:48 -0500
Subject: [PATCH 0361/3333] fix missing TOP_DIR which can break sourcing

There were a couple of places where TOP_DIR is missing when we do a
source of content in tools. Given that working directory can change
quite often during devstack, we need to always be explicit here.

Change-Id: I14b5699637d7f5db745bccf116f440cdcbaa8d91
---
 lib/stack | 2 +-
 stack.sh  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/stack b/lib/stack
index 6ca6c0baf2..9a509d8318 100644
--- a/lib/stack
+++ b/lib/stack
@@ -18,7 +18,7 @@ function stack_install_service {
     if type install_${service} >/dev/null 2>&1; then
         if [[ -n ${PROJECT_VENV[$service]:-} ]]; then
             rm -rf ${PROJECT_VENV[$service]}
-            source tools/build_venv.sh ${PROJECT_VENV[$service]}
+            source $TOP_DIR/tools/build_venv.sh ${PROJECT_VENV[$service]}
             export PIP_VIRTUAL_ENV=${PROJECT_VENV[$service]:-}
         fi
         install_${service}
diff --git a/stack.sh b/stack.sh
index 0ec7a5e5e5..6002cf9d17 100755
--- a/stack.sh
+++ b/stack.sh
@@ -685,7 +685,7 @@ fi
 
 # Pre-build some problematic wheels
 if [[ ! -d ${WHEELHOUSE:-} ]]; then
-    source tools/build_wheels.sh
+    source $TOP_DIR/tools/build_wheels.sh
 fi
 
 

From 83e166b707bbce1501146db06e968194f3c7b376 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 18 Feb 2015 19:01:20 -0500
Subject: [PATCH 0362/3333] Ensure we install tempest-lib from git in tempest's
 tox venv

This commit adds installing tempest-lib from git to the tempest full
job's tox venv. Since by default tempest isn't being installed
globally anymore and when we do run tempest it is normally within a
tox venv that means previously the install from git flag isn't being
taken into account.

Change-Id: I98b0754c4a91690c9402fa2ae2c3e9ba9195d444
---
 lib/tempest | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d3b40aa361..6177ffe197 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -517,14 +517,23 @@ function install_tempest_lib {
     if use_library_from_git "tempest-lib"; then
         git_clone_by_name "tempest-lib"
         setup_dev_lib "tempest-lib"
+        # NOTE(mtreinish) For testing tempest-lib from git with tempest we need
+        # put the git version of tempest-lib in the tempest job's tox venv
+        export PIP_VIRTUAL_ENV=${PROJECT_VENV["tempest"]}
+        setup_dev_lib "tempest-lib"
+        unset PIP_VIRTUAL_ENV
     fi
 }
 
 # install_tempest() - Collect source and prepare
 function install_tempest {
-    install_tempest_lib
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
     pip_install tox
+    pushd $TEMPEST_DIR
+    tox --notest -efull
+    PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    install_tempest_lib
+    popd
 }
 
 # init_tempest() - Initialize ec2 images

From 99c463d56df9e82e5f81e695a8e7b97a4a6fdfbc Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 19 Feb 2015 13:05:15 -0600
Subject: [PATCH 0363/3333] Recent virtualenv review cleanups

This is a follow-on to comments in https://review.openstack.org/156356
and https://review.openstack.org/#/c/151513/

* Remove work-around for /var/cache/pip
* Remove WHEELHOUSE setting in tools/build_wheels.sh and use the pip
  default directory '<cwd>/wheelhouse'
* Remove bogus MySQL-python install
* Removed unused bits and clean up pip commands in from tools/build_venvs.sh

Closes-Bug: #1423720
Change-Id: I0283b0dff9146b1b63bd821358505a93566270c6
---
 files/rpms-suse/devlibs  |  2 +-
 lib/databases/postgresql |  2 +-
 stack.sh                 |  8 +-------
 tools/build_venv.sh      | 19 +++----------------
 tools/build_wheels.sh    |  4 ----
 5 files changed, 6 insertions(+), 29 deletions(-)

diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
index dbcd6af95b..c9238252af 100644
--- a/files/rpms-suse/devlibs
+++ b/files/rpms-suse/devlibs
@@ -1,6 +1,6 @@
 libffi-devel  # pyOpenSSL
 libopenssl-devel  # pyOpenSSL
 libxml2-devel  # lxml
-libxslt-dev  # lxml
+libxslt-devel  # lxml
 postgresql-devel  # psycopg2
 python-devel  # pyOpenSSL
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index dfda9adbaf..e891a08754 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -102,7 +102,7 @@ EOF
     fi
 
     # Install Python client module
-    pip_install MySQL-python psycopg2
+    pip_install psycopg2
 }
 
 function database_connection_url_postgresql {
diff --git a/stack.sh b/stack.sh
index 6002cf9d17..f597f78c36 100755
--- a/stack.sh
+++ b/stack.sh
@@ -677,14 +677,8 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # Virtual Environment
 # -------------------
 
-# Temporary hack for testing
-# This belongs in d-g functions.sh setup_host() or devstack-vm-gate.sh
-if [[ -d /var/cache/pip ]]; then
-    sudo chown -R $STACK_USER:$STACK_USER /var/cache/pip
-fi
-
 # Pre-build some problematic wheels
-if [[ ! -d ${WHEELHOUSE:-} ]]; then
+if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
     source $TOP_DIR/tools/build_wheels.sh
 fi
 
diff --git a/tools/build_venv.sh b/tools/build_venv.sh
index ad9508056b..11d1d35208 100755
--- a/tools/build_venv.sh
+++ b/tools/build_venv.sh
@@ -34,26 +34,13 @@ if [[ -z "$TOP_DIR" ]]; then
 
     source $TOP_DIR/stackrc
 
-    trap err_trap ERR
-
 fi
 
-# Exit on any errors so that errors don't compound
-function err_trap {
-    local r=$?
-    set +o xtrace
-
-    rm -rf $TMP_VENV_PATH
-
-    exit $r
-}
-
 # Build new venv
 virtualenv $VENV_DEST
 
 # Install modern pip
-$VENV_DEST/bin/pip install -U pip
+PIP_VIRTUAL_ENV=$VENV_DEST pip_install -U pip
 
-for pkg in ${MORE_PACKAGES}; do
-    pip_install_venv $VENV_DEST $pkg
-done
+# Install additional packages
+PIP_VIRTUAL_ENV=$VENV_DEST pip_install ${MORE_PACKAGES}
diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
index c87b6dafe6..31398f9b0e 100755
--- a/tools/build_wheels.sh
+++ b/tools/build_wheels.sh
@@ -36,10 +36,6 @@ fi
 # Get additional packages to build
 MORE_PACKAGES="$@"
 
-# Set a fall-back default, assume that since this script is being called
-# package builds are to happen even if WHEELHOUSE is not configured
-export WHEELHOUSE=${WHEELHOUSE:-.wheelhouse}
-
 # Exit on any errors so that errors don't compound
 function err_trap {
     local r=$?

From 1ffa33210def38e488b8887c69b70faad5965a00 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 20 Feb 2015 16:23:15 +0100
Subject: [PATCH 0364/3333] Install openstackclient after other services

Let's see whether openstackclient will trigger unneeded version bump for
clients if its installation is put below all other services that are
expected to intall client libraries on proper versions on their own.

Change-Id: Ifa774219b7057112fc794a5e3d93bc963c55ba90
---
 stack.sh | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/stack.sh b/stack.sh
index 0ec7a5e5e5..cf99950e18 100755
--- a/stack.sh
+++ b/stack.sh
@@ -734,14 +734,6 @@ fi
 # Install middleware
 install_keystonemiddleware
 
-# install the OpenStack client, needed for most setup commands
-if use_library_from_git "python-openstackclient"; then
-    git_clone_by_name "python-openstackclient"
-    setup_dev_lib "python-openstackclient"
-else
-    pip_install 'python-openstackclient>=1.0.2'
-fi
-
 
 if is_service_enabled keystone; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
@@ -816,13 +808,22 @@ if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
     # don't be naive and add to existing line!
 fi
 
-
 # Extras Install
 # --------------
 
 # Phase: install
 run_phase stack install
 
+
+# install the OpenStack client, needed for most setup commands
+if use_library_from_git "python-openstackclient"; then
+    git_clone_by_name "python-openstackclient"
+    setup_dev_lib "python-openstackclient"
+else
+    pip_install 'python-openstackclient>=1.0.2'
+fi
+
+
 if [[ $TRACK_DEPENDS = True ]]; then
     $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
     if ! diff -Nru $DEST/requires-pre-pip $DEST/requires-post-pip > $DEST/requires.diff; then

From a1701fabcf8593bc8c555154cb2b85ef6fd5bba0 Mon Sep 17 00:00:00 2001
From: Al Miller <al.miller@hp.com>
Date: Fri, 20 Feb 2015 08:10:41 -0800
Subject: [PATCH 0365/3333] clean.sh needs to call "run_phase clean" for
 external plugins

Change-Id: I67b970992479e50dc054f8c4a77a20e724e3e305
---
 clean.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/clean.sh b/clean.sh
index 4f8c051b53..ad4525ba62 100755
--- a/clean.sh
+++ b/clean.sh
@@ -76,6 +76,8 @@ fi
 # ==========
 
 # Phase: clean
+run_phase clean
+
 if [[ -d $TOP_DIR/extras.d ]]; then
     for i in $TOP_DIR/extras.d/*.sh; do
         [[ -r $i ]] && source $i clean

From c9b245bb438cdfe1155a86986e3fe2eb83f6f328 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Tue, 10 Feb 2015 14:32:39 -0800
Subject: [PATCH 0366/3333] Optionally install tempest and disable by default

In I78d51f04ed01da4ce8aa0e127be028f969d3b4f8 we turned off installing
tempest because we install it on stable branches where the stable reqs
do not equal the tempest master (branchless) reqs.

Leave this off by default since that is the behaviour we have in the
gate, and make default devstack as similar to the gate as possible. But
add an option to install tempest by default so developers can opt and
reproduce the previous behaviour.

Update the tempest section of the README with how to run tempest tests
and how to install tempest if desired.

Change-Id: Ie4ea7335a57917244873ec54658ca269ab765ce1
---
 README.md   | 10 +++++++++-
 lib/tempest | 14 ++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 40060a7cf5..28f4c90cda 100644
--- a/README.md
+++ b/README.md
@@ -282,7 +282,15 @@ If tempest has been successfully configured, a basic set of smoke
 tests can be run as follows:
 
     $ cd /opt/stack/tempest
-    $ nosetests tempest/scenario/test_network_basic_ops.py
+    $ tox -efull  tempest.scenario.test_network_basic_ops
+
+By default tempest is downloaded and the config file is generated, but the
+tempest package is not installed in the system's global site-packages (the
+package install includes installing dependences). So tempest won't run
+outside of tox. If you would like to install it add the following to your
+``localrc`` section:
+
+    INSTALL_TEMPEST=True
 
 # DevStack on Xenserver
 
diff --git a/lib/tempest b/lib/tempest
index d3b40aa361..258bb374ee 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -63,6 +63,12 @@ BUILD_INTERVAL=1
 BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 
 
+# This must be False on stable branches, as master tempest
+# deps do not match stable branch deps. Set this to True to
+# have tempest installed in devstack by default.
+INSTALL_TEMPEST=${INSTALL_TEMPEST:-"False"}
+
+
 BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
 BOTO_CONF=/etc/boto.cfg
 
@@ -94,8 +100,12 @@ function remove_disabled_extensions {
 
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
-    # install testr since its used to process tempest logs
-    pip_install $(get_from_global_requirements testrepository)
+    if [[ "$INSTALL_TEMPEST" == "True" ]]; then
+        setup_develop $TEMPEST_DIR
+    else
+        # install testr since its used to process tempest logs
+        pip_install $(get_from_global_requirements testrepository)
+    fi
 
     local image_lines
     local images

From b592454e5113b19fba6f6cacfd97bcb8ec11f4f3 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Fri, 20 Feb 2015 13:51:22 +0100
Subject: [PATCH 0367/3333] Install python-redis from pip

Following the leads of  I47b7e787771683c2fc4404e586f11c1a19aac15c and as
an attempt to fix a bug blocking Zaqar's gate, this patch installs
python-redis from pypi instead of using the distro package.

Change-Id: Idfef2fe1b41b44c4cba6b6948b621bc44e77659b
---
 files/debs/zaqar-server | 3 +--
 lib/zaqar               | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/files/debs/zaqar-server b/files/debs/zaqar-server
index 32b10179b0..6c2a4d154a 100644
--- a/files/debs/zaqar-server
+++ b/files/debs/zaqar-server
@@ -1,5 +1,4 @@
 python-pymongo
 mongodb-server
 pkg-config
-redis-server # NOPRIME
-python-redis # NOPRIME
\ No newline at end of file
+redis-server # NOPRIME
\ No newline at end of file
diff --git a/lib/zaqar b/lib/zaqar
index 4a24415248..c9321b997f 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -147,13 +147,13 @@ function configure_zaqar {
 function configure_redis {
     if is_ubuntu; then
         install_package redis-server
+        pip_install redis
     elif is_fedora; then
         install_package redis
+        pip_install redis
     else
         exit_distro_not_supported "redis installation"
     fi
-
-    install_package python-redis
 }
 
 function configure_mongodb {

From d5004a380294e05963d4de39007f3336e975fb0f Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 23 Feb 2015 12:32:05 +0100
Subject: [PATCH 0368/3333] F21 requires redhat-rpm-config for mariadb-devel

As you can see in the f21 job, the python-MYSQL compilation
fails without this library.

At the first look it seams like packaging issue, so
I created bug related to this. [1]
Until the issue is addressed, the redhat-rpm-config will be
considered as build time dev dependency for f21.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1195207

Change-Id: I731828cac912d1b11eaf2269364411c77a57d76c
---
 files/rpms/devlibs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/devlibs b/files/rpms/devlibs
index 42b7865978..834a4b6cf1 100644
--- a/files/rpms/devlibs
+++ b/files/rpms/devlibs
@@ -6,3 +6,4 @@ mysql-devel  # MySQL-python  rhel6
 openssl-devel  # pyOpenSSL
 postgresql-devel  # psycopg2
 python-devel  # pyOpenSSL
+redhat-rpm-config # MySQL-python rhbz-1195207 f21

From 0fda343c1893527934171c45349ebc63bb2c5b34 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 23 Feb 2015 14:33:52 +0100
Subject: [PATCH 0369/3333] msgpack-python requires g++

msgpack-python when installed from source requires a C++ compiler
installed on the system, otherwise it falls back to the python
implementation.

Change-Id: Iffe1f90f3a70780be22459c3f7a3cddfe47f01ca
---
 files/debs/general      | 1 +
 files/rpms-suse/general | 1 +
 files/rpms/general      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 5047c12249..84d43029ff 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -4,6 +4,7 @@ unzip
 wget
 psmisc
 gcc
+g++
 git
 graphviz # testonly - docs
 lsof # useful when debugging
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 63ef705b64..7f4bbfb1b6 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -4,6 +4,7 @@ ca-certificates-mozilla
 curl
 euca2ools
 gcc
+gcc-c++
 git-core
 graphviz # testonly - docs
 iputils
diff --git a/files/rpms/general b/files/rpms/general
index 6f2239196b..a648214a7b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -3,6 +3,7 @@ curl
 dbus
 euca2ools # only for testing client
 gcc
+gcc-c++
 git-core
 graphviz # testonly - docs
 openssh-server

From e7b51362fdca995f866d992dc34280da3ea838db Mon Sep 17 00:00:00 2001
From: George Peristerakis <george.peristerakis@enovance.com>
Date: Fri, 20 Feb 2015 16:28:32 -0500
Subject: [PATCH 0370/3333] Changed the log format for horizon's apache
 configuration

The default apache log format is noisy. Added a custom log format
that matches the other apache log format of projects like keystone

Closes-Bug: #1222900
Change-Id: Id9a8c3a4413c778e009c56ffde6b646b8a120c8b
---
 files/apache-horizon.template | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index bca1251bec..68838985ee 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -28,7 +28,9 @@
             Require all granted
         </IfVersion>
     </Directory>
-
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/horizon_error.log
     LogLevel warn
     CustomLog /var/log/%APACHE_NAME%/horizon_access.log combined

From a339efcd676b81804b2d5ab54d4bba8ecaba99b5 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Thu, 4 Dec 2014 16:52:58 +1100
Subject: [PATCH 0371/3333] Create service definition for nova-serialproxy

Nova has the ability to do remote interactive consoles but there is no
easy way to enable this in devstack.  This change defines a service
called n-serial to enable the service.  Documentation is added to a
new guide on nova, describing how to set further options in local.conf

Change-Id: I401d94b2413c62bfae9b90d2214d77bd4cfc15d5
---
 doc/source/guides/nova.rst | 72 ++++++++++++++++++++++++++++++++++++++
 doc/source/index.rst       |  6 ++++
 lib/nova                   |  7 +++-
 3 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/guides/nova.rst

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
new file mode 100644
index 0000000000..0d98f4abad
--- /dev/null
+++ b/doc/source/guides/nova.rst
@@ -0,0 +1,72 @@
+=================
+Nova and devstack
+=================
+
+This is a rough guide to various configuration parameters for nova
+running with devstack.
+
+
+nova-serialproxy
+================
+
+In Juno nova implemented a `spec
+<http://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
+to allow read/write access to the serial console of an instance via
+`nova-serialproxy
+<http://docs.openstack.org/developer/nova/man/nova-serialproxy.html>`_.
+
+The service can be enabled by adding ``n-sproxy`` to
+``ENABLED_SERVICES``.  Further options can be enabled via
+``local.conf``, e.g.
+
+::
+
+    [[post-config|$NOVA_CONF]]
+    [serial_console]
+    #
+    # Options defined in nova.cmd.serialproxy
+    #
+
+    # Host on which to listen for incoming requests (string value)
+    #serialproxy_host=0.0.0.0
+
+    # Port on which to listen for incoming requests (integer
+    # value)
+    #serialproxy_port=6083
+
+
+    #
+    # Options defined in nova.console.serial
+    #
+
+    # Enable serial console related features (boolean value)
+    #enabled=false
+    # Do not set this manually.  Instead enable the service as
+    # outlined above.
+
+    # Range of TCP ports to use for serial ports on compute hosts
+    # (string value)
+    #port_range=10000:20000
+
+    # Location of serial console proxy. (string value)
+    #base_url=ws://127.0.0.1:6083/
+
+    # IP address on which instance serial console should listen
+    # (string value)
+    #listen=127.0.0.1
+
+    # The address to which proxy clients (like nova-serialproxy)
+    # should connect (string value)
+    #proxyclient_address=127.0.0.1
+
+
+Enabling the service is enough to be functional for a single machine devstack.
+
+These config options are defined in `nova.console.serial
+<https://github.com/openstack/nova/blob/master/nova/console/serial.py#L33-L52>`_
+and `nova.cmd.serialproxy
+<https://github.com/openstack/nova/blob/master/nova/cmd/serialproxy.py#L26-L33>`_.
+
+For more information on OpenStack configuration see the `OpenStack
+Configuration Reference
+<http://docs.openstack.org/trunk/config-reference/content/list-of-compute-config-options.html>`_
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 855a2d6b2b..10f4355c07 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -67,6 +67,7 @@ Walk through various setups used by stackers
    guides/multinode-lab
    guides/neutron
    guides/devstack-with-nested-kvm
+   guides/nova
 
 All-In-One Single VM
 --------------------
@@ -102,6 +103,11 @@ Procedure to setup :doc:`DevStack with KVM-based Nested Virtualization
 <guides/devstack-with-nested-kvm>`. With this setup, Nova instances
 will be more performant than with plain QEMU emulation.
 
+Nova and devstack
+--------------------------------
+
+Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
+
 DevStack Documentation
 ======================
 
diff --git a/lib/nova b/lib/nova
index 74a34117bc..e9e78c7bc4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -566,6 +566,10 @@ function create_nova_conf {
     if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT ec2_listen_port $EC2_SERVICE_PORT_INT
     fi
+
+    if is_service_enabled n-sproxy; then
+        iniset $NOVA_CONF serial_console enabled True
+    fi
 }
 
 function init_nova_cells {
@@ -764,6 +768,7 @@ function start_nova_rest {
     run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
     run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
     run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
+    run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
 
     # Starting the nova-objectstore only if swift3 service is not enabled.
     # Swift will act as s3 objectstore.
@@ -794,7 +799,7 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-obj; do
+    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-obj n-sproxy; do
         stop_process $serv
     done
 }

From b8cf38c05d4c73710bbdf9a14a0a80a90c3bf925 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 24 Feb 2015 13:00:51 +0100
Subject: [PATCH 0372/3333] Remove duplicated isset function

stackrc defines the isset function, but this function is already
declared in functions-common.

The stackrc sources the `functions` which sources the `functions-common`.

Change-Id: I0772c42d049833334107c2e6da3700e544ce094f
---
 stackrc | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/stackrc b/stackrc
index e084d94d7c..2bbe47c613 100644
--- a/stackrc
+++ b/stackrc
@@ -43,14 +43,6 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 #  enable_service q-meta
 #  # Optional, to enable tempest configuration as part of devstack
 #  enable_service tempest
-function isset {
-    local nounset=$(set +o | grep nounset)
-    set +o nounset
-    [[ -n "${!1+x}" ]]
-    result=$?
-    $nounset
-    return $result
-}
 
 # this allows us to pass ENABLED_SERVICES
 if ! isset ENABLED_SERVICES ; then

From ee9064b76293ec8838f7a3a52ed1de45056f6201 Mon Sep 17 00:00:00 2001
From: Joshua Harlow <harlowja@yahoo-inc.com>
Date: Thu, 19 Feb 2015 15:06:23 -0800
Subject: [PATCH 0373/3333] Add debtcollector to lib/oslo and stackrc

Ensure that the debtcollector library is pulled in
like the other oslo libraries so that devstack can
use it where appropriate.

Also fixes 'test_libs_from_pypi.sh' to not have a huge
single line of libraries; and splits it into multiple
lines so the diffs and code can be easily looked at.

Change-Id: I35ab0ed0e20b6092a41ecb3b6f1aaf0a05f5180e
---
 lib/oslo                     |  2 ++
 stackrc                      |  4 ++++
 tests/test_libs_from_pypi.sh | 12 +++++++++++-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index effde90f13..18cddc193e 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -23,6 +23,7 @@ set +o xtrace
 # Defaults
 # --------
 GITDIR["cliff"]=$DEST/cliff
+GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.context"]=$DEST/oslo.context
@@ -58,6 +59,7 @@ function _do_install_oslo_lib {
 # install_oslo() - Collect source and prepare
 function install_oslo {
     _do_install_oslo_lib "cliff"
+    _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "oslo.concurrency"
     _do_install_oslo_lib "oslo.config"
     _do_install_oslo_lib "oslo.context"
diff --git a/stackrc b/stackrc
index e084d94d7c..b2bc970c63 100644
--- a/stackrc
+++ b/stackrc
@@ -314,6 +314,10 @@ GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 GITREPO["cliff"]=${CLIFF_REPO:-${GIT_BASE}/openstack/cliff.git}
 GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
 
+# debtcollector deprecation framework/helpers
+GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
+GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-master}
+
 # oslo.concurrency
 GITREPO["oslo.concurrency"]=${OSLOCON_REPO:-${GIT_BASE}/openstack/oslo.concurrency.git}
 GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index a2a6cb781c..472b0ea4af 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -29,7 +29,17 @@ for i in $TOP/lib/*; do
     fi
 done
 
-ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient python-keystoneclient taskflow oslo.middleware pycadf python-glanceclient python-ironicclient tempest-lib oslo.messaging oslo.log cliff python-heatclient stevedore python-cinderclient glance_store oslo.concurrency oslo.db oslo.vmware keystonemiddleware oslo.serialization python-saharaclient django_openstack_auth python-openstackclient oslo.rootwrap oslo.i18n python-ceilometerclient oslo.utils python-swiftclient python-neutronclient tooz ceilometermiddleware oslo.policy"
+ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient"
+ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
+ALL_LIBS+=" python-glanceclient python-ironicclient tempest-lib"
+ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
+ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
+ALL_LIBS+=" oslo.vmware keystonemiddleware oslo.serialization"
+ALL_LIBS+=" python-saharaclient django_openstack_auth"
+ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
+ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
+ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
+ALL_LIBS+=" debtcollector"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 834b804d3eda9029d3c66db0ab732a76a22ed08b Mon Sep 17 00:00:00 2001
From: "Vigneshvar.A.S" <vigneshvar.a.s@gmail.com>
Date: Sat, 14 Feb 2015 01:05:55 +0530
Subject: [PATCH 0374/3333] Upgrades pip under virtualenv

The version of pip supported by python-virtualenv has issues in
environment under proxy, hence uninstalling python-virtualenv package
and installing the latest version using pip.

Change-Id: Id749c37ab7fefa96b35f11816b56b9def5ef4b08
Closes-Bug: 1421541
---
 tools/fixup_stuff.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index cc5275fe45..f8edd16ecd 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -123,3 +123,9 @@ if is_fedora; then
     fi
 
 fi
+
+# The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
+# connection issues under proxy, hence uninstalling python-virtualenv package
+# and installing the latest version using pip.
+uninstall_package python-virtualenv
+pip_install -U virtualenv

From 9826093202b2e05b1481f57fb6ef68f95256631c Mon Sep 17 00:00:00 2001
From: Jaume Devesa <devvesa@gmail.com>
Date: Wed, 11 Feb 2015 17:20:46 +0000
Subject: [PATCH 0375/3333] Improve MidoNet integration

Since midonet has become open source, we can build it from
external plugin scripts. The way to enable it is using the devstack
plugin approach:

    disable_service n-net
    enable_service q-svc
    enable_service q-dhcp
    enable_service q-meta
    enable_plugin networking-midonet \
        http://github.com/stackforge/networking-midonet
    Q_PLUGIN=midonet

and should download and build the last master branch of midonet.

Change-Id: I795f92f9d3c97b2c35bac712c6edfc032eff345a
---
 lib/neutron_plugins/midonet    | 100 +--------------------------------
 lib/neutron_thirdparty/midonet |  51 -----------------
 2 files changed, 2 insertions(+), 149 deletions(-)
 delete mode 100644 lib/neutron_thirdparty/midonet

diff --git a/lib/neutron_plugins/midonet b/lib/neutron_plugins/midonet
index 23ad8b2020..9e72aa0ce9 100644
--- a/lib/neutron_plugins/midonet
+++ b/lib/neutron_plugins/midonet
@@ -1,100 +1,4 @@
 #!/bin/bash
-#
-# Neutron MidoNet plugin
-# ----------------------
 
-MIDONET_DIR=${MIDONET_DIR:-$DEST/midonet}
-MIDONET_API_PORT=${MIDONET_API_PORT:-8080}
-MIDONET_API_URL=${MIDONET_API_URL:-http://localhost:$MIDONET_API_PORT/midonet-api}
-
-# Save trace setting
-MN_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-function is_neutron_ovs_base_plugin {
-    # MidoNet does not use l3-agent
-    # 0 means True here
-    return 1
-}
-
-function neutron_plugin_create_nova_conf {
-    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
-}
-
-function neutron_plugin_install_agent_packages {
-    :
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/midonet
-    Q_PLUGIN_CONF_FILENAME=midonet.ini
-    Q_PLUGIN_CLASS="neutron.plugins.midonet.plugin.MidonetPluginV2"
-
-    # MidoNet implements LBaaS API in the plugin, not as an LBaaS driver.
-    # In this model, the plugin references the 'neutron_lbaas' module but
-    # does not require starting an LBaaS service.  Devstack, however, clones
-    # 'neutron_lbaas' only if 'lbaas' service is enabled.  To get around this,
-    # always clone 'neutron_lbaas' so that it is made available to the plugin.
-    # Also, discontinue if the 'lbaas' service is enabled.
-    if is_service_enabled q-lbaas; then
-        die $LINENO "LBaaS service should be disabled for the MidoNet plugin"
-    fi
-    git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-    setup_develop $NEUTRON_LBAAS_DIR
-}
-
-function neutron_plugin_configure_debug_command {
-    :
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    DHCP_DRIVER=${DHCP_DRIVER:-"neutron.plugins.midonet.agent.midonet_driver.DhcpNoOpDriver"}
-    neutron_plugin_setup_interface_driver $Q_DHCP_CONF_FILE
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_driver $DHCP_DRIVER
-    iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces True
-    iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata True
-}
-
-function neutron_plugin_configure_l3_agent {
-    die $LINENO "q-l3 must not be executed with MidoNet plugin!"
-}
-
-function neutron_plugin_configure_plugin_agent {
-    die $LINENO "q-agt must not be executed with MidoNet plugin!"
-}
-
-function neutron_plugin_configure_service {
-    if [[ "$MIDONET_API_URL" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE MIDONET midonet_uri $MIDONET_API_URL
-    fi
-    if [[ "$MIDONET_USERNAME" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE MIDONET username $MIDONET_USERNAME
-    fi
-    if [[ "$MIDONET_PASSWORD" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE MIDONET password $MIDONET_PASSWORD
-    fi
-    if [[ "$MIDONET_PROJECT_ID" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE MIDONET project_id $MIDONET_PROJECT_ID
-    fi
-
-    Q_L3_ENABLED=True
-    Q_L3_ROUTER_PER_TENANT=True
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.MidonetInterfaceDriver
-}
-
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    # 0 means True here
-    return 1
-}
-
-# Restore xtrace
-$MN_XTRACE
+# REVISIT(devvesa): This file is intentionally left empty
+# in order to keep Q_PLUGIN=midonet work.
diff --git a/lib/neutron_thirdparty/midonet b/lib/neutron_thirdparty/midonet
deleted file mode 100644
index 2c82d487e4..0000000000
--- a/lib/neutron_thirdparty/midonet
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-#
-# MidoNet
-# -------
-
-# This file implements functions required to configure MidoNet as the third-party
-# system used with devstack's Neutron.  To include this file, specify the following
-# variables in localrc:
-#
-# * enable_service midonet
-#
-
-# MidoNet devstack destination dir
-MIDONET_DIR=${MIDONET_DIR:-$DEST/midonet}
-
-# MidoNet client repo
-MIDONET_CLIENT_REPO=${MIDONET_CLIENT_REPO:-https://github.com/midokura/python-midonetclient.git}
-MIDONET_CLIENT_BRANCH=${MIDONET_CLIENT_BRANCH:-master}
-MIDONET_CLIENT_DIR=${MIDONET_CLIENT_DIR:-$MIDONET_DIR/python-midonetclient}
-
-# Save trace setting
-MN3_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-function configure_midonet {
-    :
-}
-
-function init_midonet {
-    :
-}
-
-function install_midonet {
-    git_clone $MIDONET_CLIENT_REPO $MIDONET_CLIENT_DIR $MIDONET_CLIENT_BRANCH
-    export PYTHONPATH=$MIDONET_CLIENT_DIR/src:$PYTHONPATH
-}
-
-function start_midonet {
-    :
-}
-
-function stop_midonet {
-    :
-}
-
-function check_midonet {
-    :
-}
-
-# Restore xtrace
-$MN3_XTRACE

From 99b598887bfb189b38ac3ae97abe0a303bc1063c Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 24 Feb 2015 12:15:21 +0100
Subject: [PATCH 0376/3333] Fedora-21 has openjdk-1.8.0 only

Fedora-21 does not have openjdk-1.7.0 it has only 1.8.0.

This change also fixing the no op statement in the configure.

Change-Id: I6012aeb17b8e8fafa37d48aa29482702fa3491fd
---
 files/rpms/general   | 3 ++-
 pkg/elasticsearch.sh | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index a648214a7b..56a933190c 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,4 +27,5 @@ bc
 libyaml-devel
 gettext  # used for compiling message catalogs
 net-tools
-java-1.7.0-openjdk-headless  # NOPRIME
+java-1.7.0-openjdk-headless  # NOPRIME rhel7,f20
+java-1.8.0-openjdk-headless  # NOPRIME f21,f22
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 15e1b2b594..447596a8db 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -44,7 +44,7 @@ function download_elasticsearch {
 
 function configure_elasticsearch {
     # currently a no op
-    ::
+    :
 }
 
 function start_elasticsearch {
@@ -78,7 +78,11 @@ function install_elasticsearch {
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10
     elif is_fedora; then
-        is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
+        if [[ "$os_RELEASE" -ge "21" ]]; then
+            is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
+        else
+            is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
+        fi
         yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
         sudo /bin/systemctl daemon-reload
         sudo /bin/systemctl enable elasticsearch.service

From 32ac55abb81293002f2c4a1fb1fda2f109664c92 Mon Sep 17 00:00:00 2001
From: Sergey Reshetnyak <sreshetniak@mirantis.com>
Date: Wed, 25 Feb 2015 15:54:20 +0300
Subject: [PATCH 0377/3333] Enable CDH and Spark plugin by default in Sahara

Spark and CDH plugins enabled by default in Sahara.
Need to enable these plugins in devstack.

Change-Id: Idb57966c67c3e7da71ae3a408fbd83ba82e4321f
---
 lib/sahara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/sahara b/lib/sahara
index da4fbcd34f..a84a06f1ce 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -39,7 +39,7 @@ SAHARA_SERVICE_PROTOCOL=${SAHARA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 SAHARA_AUTH_CACHE_DIR=${SAHARA_AUTH_CACHE_DIR:-/var/cache/sahara}
 
-SAHARA_ENABLED_PLUGINS=${SAHARA_ENABLED_PLUGINS:-vanilla,hdp,fake}
+SAHARA_ENABLED_PLUGINS=${SAHARA_ENABLED_PLUGINS:-vanilla,hdp,cdh,spark,fake}
 
 # Support entry points installation of console scripts
 if [[ -d $SAHARA_DIR/bin ]]; then

From 71e82f52bde99b4bf791ea1558f1abf86019a384 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 25 Feb 2015 11:39:18 -0800
Subject: [PATCH 0378/3333] List all CIRROS ARCH images in image_list.sh

image_list.sh is used to make a list of all possible images. Loop over
both x86_64 and i386 instead of just using the default arch of x86_64

For live migration we are starting to use the i386 arch based images and
don't want to cache them like all other images.

Change-Id: I47da72a0e9da3689cb085bb43ac6536094445112
---
 tools/image_list.sh | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/tools/image_list.sh b/tools/image_list.sh
index 0bb49ab007..88c1d09379 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -9,6 +9,8 @@ source $TOP_DIR/functions
 # dummy in the end position to trigger the fall through case.
 DRIVERS="openvz ironic libvirt vsphere xenserver dummy"
 
+CIRROS_ARCHS="x86_64 i386"
+
 # Extra variables to trigger getting additional images.
 export ENABLED_SERVICES="h-api,tr-api"
 HEAT_FETCHED_TEST_IMAGE="Fedora-i386-20-20131211.1-sda"
@@ -17,12 +19,15 @@ PRECACHE_IMAGES=True
 # Loop over all the virt drivers and collect all the possible images
 ALL_IMAGES=""
 for driver in $DRIVERS; do
-    VIRT_DRIVER=$driver
-    URLS=$(source $TOP_DIR/stackrc && echo $IMAGE_URLS)
-    if [[ ! -z "$ALL_IMAGES" ]]; then
-        ALL_IMAGES+=,
-    fi
-    ALL_IMAGES+=$URLS
+    for arch in $CIRROS_ARCHS; do
+        CIRROS_ARCH=$arch
+        VIRT_DRIVER=$driver
+        URLS=$(source $TOP_DIR/stackrc && echo $IMAGE_URLS)
+        if [[ ! -z "$ALL_IMAGES" ]]; then
+            ALL_IMAGES+=,
+        fi
+        ALL_IMAGES+=$URLS
+    done
 done
 
 # Make a nice list

From 907d41c2623809702b887ada97a87a2e7a23dfba Mon Sep 17 00:00:00 2001
From: Naohiro Tamura <naohirot@jp.fujitsu.com>
Date: Thu, 19 Feb 2015 20:57:20 +0900
Subject: [PATCH 0379/3333] Add error checks to provider net and subnet
 creation

Error checks are added to detect provider network and subnet
creation.

Closes-Bug: #1423766
Change-Id: I4d4323d1c3159f84ce3d19924a569b153038d542
---
 lib/neutron | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 8d27febf63..3804e05271 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -538,13 +538,16 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
         NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 
         sudo ip link set $OVS_PHYSICAL_BRIDGE up

From c08d5470aa797923f613ada052b399e8ddfee54b Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Mon, 23 Feb 2015 15:39:22 +0000
Subject: [PATCH 0380/3333] Fix Ironic for Syslinux >= 5.00

Syslinux >= 5.00 pxelinux.0 binary is not "stand-alone"
anymore, it depends on some c32 modules to work correctly.
See: http://www.syslinux.org/wiki/index.php/Library_modules

Closes-Bug: #1419867
Change-Id: Ia62e980052ece3d5e2abf090b5609dea31f0d6b8
---
 lib/ironic | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 7ffa6a5caf..b39d2cc619 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -238,7 +238,15 @@ function configure_ironic_dirs {
         die $LINENO "PXE boot file $IRONIC_PXE_BOOT_IMAGE not found."
     fi
 
-    cp $IRONIC_PXE_BOOT_IMAGE $IRONIC_TFTPBOOT_DIR
+    # Copy PXE binary
+    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
+        cp $IRONIC_PXE_BOOT_IMAGE $IRONIC_TFTPBOOT_DIR
+    else
+        # Syslinux >= 5.00 pxelinux.0 binary is not "stand-alone" anymore,
+        # it depends on some c32 modules to work correctly.
+        # More info: http://www.syslinux.org/wiki/index.php/Library_modules
+        cp -aR $(dirname $IRONIC_PXE_BOOT_IMAGE)/*.{c32,0} $IRONIC_TFTPBOOT_DIR
+    fi
 }
 
 # configure_ironic() - Set config files, create data dirs, etc

From 15d40a56832baadc65fe5261f5f53ce24ad00e84 Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Thu, 26 Feb 2015 09:08:09 +0100
Subject: [PATCH 0381/3333] Add quotation marks to parse string correclty on
 rhel7

Problem:
On rhel7 the lvm.conf filter is generated wrongly

Root Cause:

bash-4.2 (rhel7/centos7) incorrectly splits herestrings
when combined with IFS.  See [1] and [2]

Quoting the argument is a safe work-around

[1] http://stackoverflow.com/questions/20144593/trying-to-split-a-string-into-two-variables
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1196566

Closes-Bug #1425839
Change-Id: Ie82fcd7ef0deacbb6aaf18c5c466a5d5baf52681
---
 lib/cinder_backends/lvm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index d83c31a81e..52fc6fbf63 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -78,9 +78,9 @@ function configure_cinder_backend_conf_lvm {
 
     for pv_info in $(sudo pvs --noheadings -o name,vg_name --separator ';'); do
         echo_summary "Evaluate PV info for Cinder lvm.conf: $pv_info"
-        IFS=';' read pv vg <<< $pv_info
+        IFS=';' read pv vg <<< "$pv_info"
         for line in ${conf_entries}; do
-            IFS='=' read label group <<< $line
+            IFS='=' read label group <<< "$line"
             group=$(echo $group|sed "s/^ *//g")
             if [[ "$vg" == "$group" ]]; then
                 new="\"a$pv/\", "

From db29a7cf0c15b3600bf1363497a1899bdeb1b596 Mon Sep 17 00:00:00 2001
From: Ramy Asselin <ramy.asselin@hp.com>
Date: Thu, 26 Feb 2015 14:30:07 -0800
Subject: [PATCH 0382/3333] Fix devstack running behind a proxy

As suggested by dtroyer to resolve wheels not buildings
behind a proxy. Issue introduced in I0283b0dff9146b1b63bd821358505a93566270c6

Change-Id: Ib376469aff73a22ac2bc9d7d5a7f90081004aa8d
Closes-bug: 1426146
---
 tools/build_wheels.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
index 31398f9b0e..f1740dfbd6 100755
--- a/tools/build_wheels.sh
+++ b/tools/build_wheels.sh
@@ -57,7 +57,7 @@ TMP_VENV_PATH=$(mktemp -d tmp-venv-XXXX)
 virtualenv $TMP_VENV_PATH
 
 # Install modern pip and wheel
-$TMP_VENV_PATH/bin/pip install -U pip wheel
+PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install -U pip wheel
 
 # VENV_PACKAGES is a list of packages we want to pre-install
 VENV_PACKAGE_FILE=$FILES/venv-requirements.txt

From b124f4d595cc41b4f20bf935ffd0848448b3713c Mon Sep 17 00:00:00 2001
From: Al Miller <al.miller@hp.com>
Date: Tue, 3 Feb 2015 20:18:42 -0800
Subject: [PATCH 0383/3333] Remove LBaaS support from devstack

Devstack support for LBaaS is being migrated to an external
plugin in the neutron-lbaas repository.  The only LBaaS-
specific code that remains in devstack is a hook to support
existing configs that enable q-lbaas.  In that case, load
the external plugin if necessary.

Change-Id: I592f64407ccf1e722b8d9788917879d0236acf0b
Depends-On: I64a94aeeabe6357b5ea7796e34c9306c55c9ae67
---
 functions-common                          | 19 ++++++++
 lib/neutron                               | 53 +++++++----------------
 lib/neutron_plugins/services/loadbalancer | 49 ---------------------
 stackrc                                   |  3 ++
 4 files changed, 38 insertions(+), 86 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/functions-common b/functions-common
index df69cbad16..267dfe8622 100644
--- a/functions-common
+++ b/functions-common
@@ -1601,6 +1601,25 @@ function enable_plugin {
     GITBRANCH[$name]=$branch
 }
 
+# is_plugin_enabled
+#
+# Has a particular plugin been enabled?
+function is_plugin_enabled {
+    local plugins=$@
+    local plugin
+    local enabled=1
+
+    # short circuit if nothing to do
+    if [[ -z ${DEVSTACK_PLUGINS} ]]; then
+        return $enabled
+    fi
+
+    for plugin in ${plugins}; do
+        [[ ,${DEVSTACK_PLUGINS}, =~ ,${plugin}, ]] && enabled=0
+    done
+    return $enabled
+}
+
 # fetch_plugins
 #
 # clones all plugins
diff --git a/lib/neutron b/lib/neutron
index 3804e05271..2c69830afd 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -100,10 +100,8 @@ IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-fe80:cafe:cafe::1}
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
-
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
@@ -116,6 +114,7 @@ fi
 
 NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
+
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
 # Agent binaries.  Note, binary paths for other agents are set in per-service
@@ -326,12 +325,6 @@ ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
 # Please refer to ``lib/neutron_plugins/README.md`` for details.
 source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 
-# Agent loadbalancer service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
-
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -358,6 +351,17 @@ fi
 TEMPEST_SERVICES+=,neutron
 
 
+# For backward compatibility, if q-lbaas service is enabled, make sure to load the
+# neutron-lbaas plugin.  This hook should be removed in a future release, perhaps
+# as early as Liberty.
+
+if is_service_enabled q-lbaas; then
+    if ! is_plugin_enabled neutron-lbaas; then
+        DEPRECATED_TEXT+="External plugin neutron-lbaas has been automatically activated, please add the appropriate enable_plugin to your local.conf. This will be removed in the Liberty cycle."
+        enable_plugin "neutron-lbaas" ${NEUTRON_LBAAS_REPO} ${NEUTRON_LBAAS_BRANCH}
+    fi
+fi
+
 # Save trace setting
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
@@ -425,9 +429,7 @@ function configure_neutron {
     iniset_rpc_backend neutron $NEUTRON_CONF DEFAULT
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-    if is_service_enabled q-lbaas; then
-        _configure_neutron_lbaas
-    fi
+
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -605,7 +607,8 @@ function init_neutron {
     recreate_database $Q_DB_NAME
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-    for svc in fwaas lbaas vpnaas; do
+
+    for svc in fwaas vpnaas; do
         if [ "$svc" = "vpnaas" ]; then
             q_svc="q-vpn"
         else
@@ -625,10 +628,6 @@ function install_neutron {
         git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
         setup_develop $NEUTRON_FWAAS_DIR
     fi
-    if is_service_enabled q-lbaas; then
-        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-        setup_develop $NEUTRON_LBAAS_DIR
-    fi
     if is_service_enabled q-vpn; then
         git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
         setup_develop $NEUTRON_VPNAAS_DIR
@@ -672,10 +671,6 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
-
-    if is_service_enabled q-lbaas; then
-        neutron_agent_lbaas_install_agent_packages
-    fi
 }
 
 # Start running processes, including screen
@@ -735,10 +730,6 @@ function start_neutron_agents {
         run_process q-domua "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
     fi
 
-    if is_service_enabled q-lbaas; then
-        run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
-    fi
-
     if is_service_enabled q-metering; then
         run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
     fi
@@ -762,9 +753,6 @@ function stop_neutron {
 
     stop_process q-agt
 
-    if is_service_enabled q-lbaas; then
-        neutron_lbaas_stop
-    fi
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
@@ -792,12 +780,11 @@ function cleanup_neutron {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
 
-
 function _create_neutron_conf_dir {
     # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
     if [[ ! -d $NEUTRON_CONF_DIR ]]; then
@@ -967,14 +954,6 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF DEFAULT notification_driver messaging
 }
 
-function _configure_neutron_lbaas {
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
-    fi
-    neutron_agent_lbaas_configure_common
-    neutron_agent_lbaas_configure_agent
-}
-
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
deleted file mode 100644
index f465cc94b4..0000000000
--- a/lib/neutron_plugins/services/loadbalancer
+++ /dev/null
@@ -1,49 +0,0 @@
-# Neutron loadbalancer plugin
-# ---------------------------
-
-# Save trace setting
-LB_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
-LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
-
-function neutron_agent_lbaas_install_agent_packages {
-    if is_ubuntu || is_fedora || is_suse; then
-        install_package haproxy
-    fi
-}
-
-function neutron_agent_lbaas_configure_common {
-    _neutron_service_plugin_class_add $LBAAS_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
-}
-
-function neutron_agent_lbaas_configure_agent {
-    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
-    mkdir -p $LBAAS_AGENT_CONF_PATH
-
-    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
-
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini $LBAAS_AGENT_CONF_FILENAME
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
-
-    if is_fedora; then
-        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
-        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
-    fi
-}
-
-function neutron_lbaas_stop {
-    pids=$(ps aux | awk '/haproxy/ { print $2 }')
-    [ ! -z "$pids" ] && sudo kill $pids
-}
-
-# Restore xtrace
-$LB_XTRACE
diff --git a/stackrc b/stackrc
index cb044b8fed..103be6de66 100644
--- a/stackrc
+++ b/stackrc
@@ -198,6 +198,9 @@ NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
 # neutron lbaas service
+# The neutron-lbaas specific entries are deprecated and replaced by the neutron-lbaas
+# devstack plugin and should be removed in a future release, possibly as soon as Liberty.
+
 NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
 NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
 

From 6fd4720e606ffa91a2db7d0bef1961128014e0ed Mon Sep 17 00:00:00 2001
From: Paul Michali <pc@michali.net>
Date: Mon, 23 Feb 2015 17:07:48 -0500
Subject: [PATCH 0384/3333] VPNaaS Support for StrongSwan driver.

The StrongSwan driver under development for kilo-3 will replace the
default reference OpenSwan driver.

In the interim though, we need to be able to run functional tests
for both drivers. This change is intending to do the additional
steps that are needed to set up for Strongswan, so that when a
functional test has IPSEC_PACKAGE=strongswan, everything will be
correct.

The intent here is to explicitly set the device driver class in
vpn_agent.ini, so that this will work for when OpenSwan is the
default (currently), when no drivers are specified, and will work
for when StrongSwan is made the default in the code.

For Ubuntu, AppArmor is disabled for charon and stroke.

Note: Both OpenSwan and StrongSwan cannot be installed on the
host at the same time.

Change-Id: Ib8467e24633230d6643d812068e4ed6ffb33f104
Partial-Bug: 1424757
---
 lib/neutron                      |  2 +-
 lib/neutron_plugins/services/vpn | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 8d27febf63..2f2c15f4ad 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -931,7 +931,7 @@ function _configure_neutron_l3_agent {
     Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
 
     if is_service_enabled q-vpn; then
-        cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+        neutron_vpn_configure_agent
     fi
 
     cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 5912eab9ca..4d6a2bf9a0 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -12,6 +12,13 @@ IPSEC_PACKAGE=${IPSEC_PACKAGE:-"openswan"}
 
 function neutron_vpn_install_agent_packages {
     install_package $IPSEC_PACKAGE
+    if is_ubuntu && [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
+        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.charon /etc/apparmor.d/disable/
+        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.stroke /etc/apparmor.d/disable/
+        # NOTE: Due to https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1387220
+        # one must use 'sudo start apparmor ACTION=reload' for Ubuntu 14.10
+        restart_service apparmor
+    fi
 }
 
 function neutron_vpn_configure_common {
@@ -19,6 +26,18 @@ function neutron_vpn_configure_common {
     _neutron_deploy_rootwrap_filters $NEUTRON_VPNAAS_DIR
 }
 
+function neutron_vpn_configure_agent {
+    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+    if [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
+        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
+        if is_fedora; then
+            iniset $Q_VPN_CONF_FILE strongswan default_config_area /usr/share/strongswan/templates/config/strongswan.d
+        fi
+    else
+        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.ipsec.OpenSwanDriver
+    fi
+}
+
 function neutron_vpn_stop {
     local ipsec_data_dir=$DATA_DIR/neutron/ipsec
     local pids

From 1d3a6ec0de8badae58492021e9025f0ef78878b6 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 25 Feb 2015 12:38:47 +0000
Subject: [PATCH 0385/3333] Add support for using IPA with iSCSI

This patch is adding a new boolean that can be toggled to indicate
that we should use the IPA ramdisk instead of the normal ramdisk when
deploying a node with the iSCSI methodology. Defaults to False.

Depends-On: Iaabc6ada729461f18d69ee12d01b9f1465944454
Change-Id: If4004078866d833eb946be40b6dfb204aa4a6840
---
 lib/ironic | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 7ffa6a5caf..394d68225a 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -121,6 +121,16 @@ IRONIC_HTTP_DIR=${IRONIC_HTTP_DIR:-$IRONIC_DATA_DIR/httpboot}
 IRONIC_HTTP_SERVER=${IRONIC_HTTP_SERVER:-$HOST_IP}
 IRONIC_HTTP_PORT=${IRONIC_HTTP_PORT:-8088}
 
+# NOTE(lucasagomes): This flag is used to differentiate the nodes that
+# uses IPA as their deploy ramdisk from nodes that uses the agent_* drivers
+# (which also uses IPA but depends on Swift Temp URLs to work). At present,
+# all drivers that uses the iSCSI approach for their deployment supports
+# using both, IPA or bash ramdisks for the deployment. In the future we
+# want to remove the support for the bash ramdisk in favor of IPA, once
+# we get there this flag can be removed, and all conditionals that uses
+# it should just run by default.
+IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA=$(trueorfalse False IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA)
+
 # get_pxe_boot_file() - Get the PXE/iPXE boot file path
 function get_pxe_boot_file {
     local relpath=syslinux/pxelinux.0
@@ -162,6 +172,11 @@ function is_deployed_by_agent {
     return 1
 }
 
+function is_deployed_with_ipa_ramdisk {
+    is_deployed_by_agent || [[ "$IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA" == "True" ]] && return 0
+    return 1
+}
+
 # install_ironic() - Collect source and prepare
 function install_ironic {
     # make sure all needed service were enabled
@@ -310,7 +325,11 @@ function configure_ironic_conductor {
     iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
     iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
     if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-        iniset $IRONIC_CONF_FILE pxe pxe_append_params "nofb nomodeset vga=normal console=ttyS0"
+        local pxe_params="nofb nomodeset vga=normal console=ttyS0"
+        if is_deployed_with_ipa_ramdisk; then
+            pxe_params+=" systemd.journald.forward_to_console=yes"
+        fi
+        iniset $IRONIC_CONF_FILE pxe pxe_append_params "$pxe_params"
     fi
     if is_deployed_by_agent; then
         if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
@@ -325,9 +344,6 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
         iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
-        if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-            iniset $IRONIC_CONF_FILE agent agent_pxe_append_params "nofb nomodeset vga=normal console=ttyS0 systemd.journald.forward_to_console=yes"
-        fi
     fi
 
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
@@ -698,7 +714,7 @@ function upload_baremetal_ironic_deploy {
         if [ "$IRONIC_BUILD_DEPLOY_RAMDISK" = "True" ]; then
             # we can build them only if we're not offline
             if [ "$OFFLINE" != "True" ]; then
-                if is_deployed_by_agent; then
+                if is_deployed_with_ipa_ramdisk; then
                     build_ipa_coreos_ramdisk $IRONIC_DEPLOY_KERNEL_PATH $IRONIC_DEPLOY_RAMDISK_PATH
                 else
                     ramdisk-image-create $IRONIC_DEPLOY_FLAVOR \
@@ -708,7 +724,7 @@ function upload_baremetal_ironic_deploy {
                 die $LINENO "Deploy kernel+ramdisk files don't exist and cannot be build in OFFLINE mode"
             fi
         else
-            if is_deployed_by_agent; then
+            if is_deployed_with_ipa_ramdisk; then
                 # download the agent image tarball
                 wget "$IRONIC_AGENT_KERNEL_URL" -O $IRONIC_DEPLOY_KERNEL_PATH
                 wget "$IRONIC_AGENT_RAMDISK_URL" -O $IRONIC_DEPLOY_RAMDISK_PATH

From c82c30c55afea76efee63ae48669b457986ab465 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 18 Feb 2015 15:24:40 -0800
Subject: [PATCH 0386/3333] Remove debs for diablo volumes

Diablo is long gone. Remove debs for diablo nova volumes

Original commit that added this: I3e7c412ff125dbadd18b59af55fb7dea9ea17b07

Move open-iscsi requirement over to ironic, (ironic conductor calls
iscsiadm)

libvirt driver uses iscsiadm for iscsi based volume attaches as well.
lvm backend is supported for libvirt driver

Change-Id: I536ba0ebdb6e3fa68f0a82b3027e70d8e2f35085
---
 files/debs/ironic | 1 +
 files/debs/n-cpu  | 4 +---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/files/debs/ironic b/files/debs/ironic
index f6c7b74494..0a906dbffc 100644
--- a/files/debs/ironic
+++ b/files/debs/ironic
@@ -4,6 +4,7 @@ iptables
 ipxe
 libguestfs0
 libvirt-bin
+open-iscsi
 openssh-client
 openvswitch-switch
 openvswitch-datapath-dkms
diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 534b1c1159..5d5052aa4e 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,8 +1,6 @@
 qemu-utils
-# Stuff for diablo volumes
-lvm2
+lvm2 # NOPRIME
 open-iscsi
-open-iscsi-utils # Deprecated since quantal dist:precise
 genisoimage
 sysfsutils
 sg3-utils

From 84c9ceff7baa9711415a6ccfcf03cef24e15be38 Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Sun, 22 Feb 2015 12:47:00 -0500
Subject: [PATCH 0387/3333] Change the Guest Agent log_dir to /var/log/trove

In trove-integration, a patch was submitted to change the value
of the log_dir variable in the trove-guestagent.conf.sample file.
This should be changed here as well so that devstack uses the same
location.

The devstack trove-guestagent.conf file is created by devstack, not
from the sample file, so it needs to be changed here.

(For reference, an actual trove-guestagent.conf file is created by
the cloud provider implementing Trove, who may or may not use the
sample file provided.)

See: https://review.openstack.org/#/c/157973

Change-Id: I41b8e6fe443a2eff376ffc1f92c2ed90c94530b0
---
 lib/trove | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/trove b/lib/trove
index d4377186ed..080e860f03 100644
--- a/lib/trove
+++ b/lib/trove
@@ -180,7 +180,7 @@ function configure_trove {
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT control_exchange trove
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT ignore_users os_admin
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT log_dir /tmp/
+    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT log_dir /var/log/trove/
     iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT log_file trove-guestagent.log
     setup_trove_logging $TROVE_CONF_DIR/trove-guestagent.conf
 }

From c24b399b7e37480ee57546fee9fab4d4c6b452e0 Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Sun, 21 Dec 2014 23:51:40 -0800
Subject: [PATCH 0388/3333] Complete the support of MatchMakerRedis driver

MatchMakerRedis is the only tested routing method
for ZeroMQ driver. For others, like MatchMakerLocalhost
and MatchMakerRing, it still takes some time to work
on and completely test.

MatchMakerRedis is enough to run under real-world
deployment.

Change-Id: I3b2e8e68ceebd377479d75bbb8b862ae60cfc826
Partially-Implements: blueprint zeromq
---
 lib/rpc_backend | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 899748c53d..ff22bbf8fa 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -158,9 +158,6 @@ function install_rpc_backend {
         fi
         _configure_qpid
     elif is_service_enabled zeromq; then
-        # NOTE(ewindisch): Redis is not strictly necessary
-        # but there is a matchmaker driver that works
-        # really well & out of the box for multi-node.
         if is_fedora; then
             install_package zeromq python-zmq
             if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
@@ -243,11 +240,15 @@ function iniset_rpc_backend {
     local section=$3
     if is_service_enabled zeromq; then
         iniset $file $section rpc_backend "zmq"
-        iniset $file $section rpc_zmq_matchmaker \
-            oslo_messaging._drivers.matchmaker_redis.MatchMakerRedis
-        # Set MATCHMAKER_REDIS_HOST if running multi-node.
-        MATCHMAKER_REDIS_HOST=${MATCHMAKER_REDIS_HOST:-127.0.0.1}
-        iniset $file matchmaker_redis host $MATCHMAKER_REDIS_HOST
+        iniset $file $section rpc_zmq_host `hostname`
+        if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
+            iniset $file $section rpc_zmq_matchmaker \
+                oslo.messaging._drivers.matchmaker_redis.MatchMakerRedis
+            MATCHMAKER_REDIS_HOST=${MATCHMAKER_REDIS_HOST:-127.0.0.1}
+            iniset $file matchmaker_redis host $MATCHMAKER_REDIS_HOST
+        else
+            die $LINENO "Other matchmaker drivers not supported"
+        fi
     elif is_service_enabled qpid || [ -n "$QPID_HOST" ]; then
         # For Qpid use the 'amqp' oslo.messaging transport when AMQP 1.0 is used
         if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then

From a67ef00a6dc303659873bf6e60c8a488e96d0762 Mon Sep 17 00:00:00 2001
From: Noboru Iwamatsu <n_iwamatsu@jp.fujitsu.com>
Date: Fri, 27 Feb 2015 13:34:12 +0900
Subject: [PATCH 0389/3333] Handle proxy environment variables for epel-release
 install

Use yum_install() to support proxy environment variables when
epel-release package is installed from epel-bootstrap repo.

Change-Id: I45f7a38c6c71bbce07bd0d21c1ac8a75c04113cb
Closes-Bug: 1426221
---
 stack.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 44a07439af..58b4479635 100755
--- a/stack.sh
+++ b/stack.sh
@@ -250,8 +250,10 @@ failovermethod=priority
 enabled=0
 gpgcheck=0
 EOF
-    # bare yum call due to --enablerepo
-    sudo yum --enablerepo=epel-bootstrap -y install epel-release || \
+    # Enable a bootstrap repo.  It is removed after finishing
+    # the epel-release installation.
+    sudo yum-config-manager --enable epel-bootstrap
+    yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
     # epel rpm has installed it's version
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo

From 37a06f017ba6ef38159ee65ac25bdd890ccbd102 Mon Sep 17 00:00:00 2001
From: Telles Nobrega <tellesmvn@lsd.ufcg.edu.br>
Date: Tue, 18 Nov 2014 07:59:10 -0300
Subject: [PATCH 0390/3333] Add data-processing service for Sahara

When registering endpoint with data_processing keystone transforms it
into data-processing. This problem causes sahara to not find the
endpoint afterwards

We need to have two endpoints for correct working tempest and horizon
with devstack. After resolving bug in tempest and horizon need to remove
old data_processing endpoint

Change-Id: I97827d23ffe8a1218abd61e76804b918b1b7cbe0
Partial-bug: #1356053
---
 lib/sahara | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/lib/sahara b/lib/sahara
index a84a06f1ce..9b2e9c406d 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -65,9 +65,25 @@ function create_sahara_accounts {
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-        local sahara_service=$(get_or_create_service "sahara" \
-            "data_processing" "Sahara Data Processing")
-        get_or_create_endpoint $sahara_service \
+        # TODO: remove "data_processing" service when #1356053 will be fixed
+        local sahara_service_old=$(openstack service create \
+            "data_processing" \
+            --name "sahara" \
+            --description "Sahara Data Processing" \
+            -f value -c id
+        )
+        local sahara_service_new=$(openstack service create \
+            "data-processing" \
+            --name "sahara" \
+            --description "Sahara Data Processing" \
+            -f value -c id
+        )
+        get_or_create_endpoint $sahara_service_old \
+            "$REGION_NAME" \
+            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
+            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
+            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s"
+        get_or_create_endpoint $sahara_service_new \
             "$REGION_NAME" \
             "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
             "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \

From b5ab6468c9784d5f5f21e808034f462d5c9d91b2 Mon Sep 17 00:00:00 2001
From: sridhargaddam <sridhar.gaddam@enovance.com>
Date: Tue, 24 Feb 2015 07:23:24 +0000
Subject: [PATCH 0391/3333] Fix curl issue when SERVICE_HOST is defined to IPv6
 address

When SERVICE_HOST is defined to literal IPv6 address
(i.e., [fdf8:f53b:82e4::179]) we will have to include
--globoff option for curl to be able to reach the various
openstack services. Using globoff works for both IPv6 and
IPv4 urls, so its safe to include this option for all curl
statements in devstack.

Closes-Bug: #1424943
Change-Id: I2afc16f2f94d7d7069b0ba61bc8348c03413e4e7
---
 exercises/horizon.sh | 2 +-
 exercises/sahara.sh  | 2 +-
 exercises/zaqar.sh   | 2 +-
 functions            | 4 +++-
 lib/ceilometer       | 2 +-
 lib/keystone         | 2 +-
 6 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/exercises/horizon.sh b/exercises/horizon.sh
index ad08221690..4020580157 100755
--- a/exercises/horizon.sh
+++ b/exercises/horizon.sh
@@ -36,7 +36,7 @@ source $TOP_DIR/exerciserc
 is_service_enabled horizon || exit 55
 
 # can we get the front page
-curl http://$SERVICE_HOST 2>/dev/null | grep -q '<h3.*>Log In</h3>' || die $LINENO "Horizon front page not functioning!"
+$CURL_GET http://$SERVICE_HOST 2>/dev/null | grep -q '<h3.*>Log In</h3>' || die $LINENO "Horizon front page not functioning!"
 
 set +o xtrace
 echo "*********************************************************************"
diff --git a/exercises/sahara.sh b/exercises/sahara.sh
index 867920ed31..2589e28c0c 100755
--- a/exercises/sahara.sh
+++ b/exercises/sahara.sh
@@ -35,7 +35,7 @@ source $TOP_DIR/exerciserc
 
 is_service_enabled sahara || exit 55
 
-curl http://$SERVICE_HOST:8386/ 2>/dev/null | grep -q 'Auth' || die $LINENO "Sahara API isn't functioning!"
+$CURL_GET http://$SERVICE_HOST:8386/ 2>/dev/null | grep -q 'Auth' || die $LINENO "Sahara API isn't functioning!"
 
 set +o xtrace
 echo "*********************************************************************"
diff --git a/exercises/zaqar.sh b/exercises/zaqar.sh
index 6996f346b5..c370b12c85 100755
--- a/exercises/zaqar.sh
+++ b/exercises/zaqar.sh
@@ -35,7 +35,7 @@ source $TOP_DIR/exerciserc
 
 is_service_enabled zaqar-server || exit 55
 
-curl http://$SERVICE_HOST:8888/v1/ 2>/dev/null | grep -q 'queue_name' || die $LINENO "Zaqar API not functioning!"
+$CURL_GET http://$SERVICE_HOST:8888/v1/ 2>/dev/null | grep -q 'queue_name' || die $LINENO "Zaqar API not functioning!"
 
 set +o xtrace
 echo "*********************************************************************"
diff --git a/functions b/functions
index 2f976cfab1..79b2b37b4e 100644
--- a/functions
+++ b/functions
@@ -325,13 +325,15 @@ function use_database {
     fi
 }
 
+#Macro for curl statements. curl requires -g option for literal IPv6 addresses.
+CURL_GET="${CURL_GET:-curl -g}"
 
 # Wait for an HTTP server to start answering requests
 # wait_for_service timeout url
 function wait_for_service {
     local timeout=$1
     local url=$2
-    timeout $timeout sh -c "while ! curl -k --noproxy '*' -s $url >/dev/null; do sleep 1; done"
+    timeout $timeout sh -c "while ! $CURL_GET -k --noproxy '*' -s $url >/dev/null; do sleep 1; done"
 }
 
 
diff --git a/lib/ceilometer b/lib/ceilometer
index f509788ab7..82e9417ba4 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -340,7 +340,7 @@ function start_ceilometer {
     # only die on API if it was actually intended to be turned on
     if is_service_enabled ceilometer-api; then
         echo "Waiting for ceilometer-api to start..."
-        if ! timeout $SERVICE_TIMEOUT sh -c "while ! curl --noproxy '*' -s http://localhost:8777/v2/ >/dev/null; do sleep 1; done"; then
+        if ! wait_for_service $SERVICE_TIMEOUT $CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/v2/; then
             die $LINENO "ceilometer-api did not start"
         fi
     fi
diff --git a/lib/keystone b/lib/keystone
index 102d188611..0968445dc0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -564,7 +564,7 @@ function start_keystone {
     # Check that the keystone service is running. Even if the tls tunnel
     # should be enabled, make sure the internal port is checked using
     # unencryted traffic at this point.
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! curl --noproxy '*' -k -s $auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/ >/dev/null; do sleep 1; done"; then
+    if ! wait_for_service $SERVICE_TIMEOUT $auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/; then
         die $LINENO "keystone did not start"
     fi
 

From 76e724b9f7417a666fcd1a792fbce5e825c1ed56 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Wed, 11 Feb 2015 18:28:37 -0500
Subject: [PATCH 0392/3333] elasticsearch event support in ceilometer

add support to store events in elasticsearch in ceilometer.

Change-Id: I9c9801d2b83af8332df21f221c2ac8579898d56b
---
 lib/ceilometer       | 31 ++++++++++++++++++++++---------
 pkg/elasticsearch.sh |  9 +++++++++
 2 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index f509788ab7..0779c99115 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -13,21 +13,16 @@
 #
 #   enable_service ceilometer-alarm-notifier ceilometer-alarm-evaluator
 #
-# To ensure events are stored, add the following section to local.conf:
-#
-#   [[post-config|$CEILOMETER_CONF]]
-#   [notification]
-#   store_events=True
-#
 # Several variables set in the localrc section adjust common behaviors
 # of Ceilometer (see within for additional settings):
 #
 #   CEILOMETER_USE_MOD_WSGI:       When True, run the api under mod_wsgi.
 #   CEILOMETER_PIPELINE_INTERVAL:  The number of seconds between pipeline processing
 #                                  runs. Default 600.
-#   CEILOMETER_BACKEND:            The database backend (e.g. 'mysql', 'mongodb')
+#   CEILOMETER_BACKEND:            The database backend (e.g. 'mysql', 'mongodb', 'es')
 #   CEILOMETER_COORDINATION_URL:   The URL for a group membership service provided
 #                                  by tooz.
+#   CEILOMETER_EVENTS:             Enable event collection
 
 
 # Dependencies:
@@ -80,6 +75,7 @@ CEILOMETER_USE_MOD_WSGI=$(trueorfalse False CEILOMETER_USE_MOD_WSGI)
 
 # To enable OSprofiler change value of this variable to "notifications,profiler"
 CEILOMETER_NOTIFICATION_TOPICS=${CEILOMETER_NOTIFICATION_TOPICS:-notifications}
+CEILOMETER_EVENTS=${CEILOMETER_EVENTS:-True}
 
 CEILOMETER_COORDINATION_URL=${CEILOMETER_COORDINATION_URL:-}
 CEILOMETER_PIPELINE_INTERVAL=${CEILOMETER_PIPELINE_INTERVAL:-}
@@ -137,8 +133,10 @@ function _cleanup_ceilometer_apache_wsgi {
 # cleanup_ceilometer() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_ceilometer {
-    if [ "$CEILOMETER_BACKEND" != 'mysql' ] && [ "$CEILOMETER_BACKEND" != 'postgresql' ] ; then
+    if [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
         mongo ceilometer --eval "db.dropDatabase();"
+    elif [ "$CEILOMETER_BACKEND" = 'es' ] ; then
+        curl -XDELETE "localhost:9200/events_*"
     fi
     if [ "$CEILOMETER_USE_MOD_WSGI" == "True" ]; then
         _cleanup_ceilometer_apache_wsgi
@@ -206,11 +204,21 @@ function configure_ceilometer {
 
     configure_auth_token_middleware $CEILOMETER_CONF ceilometer $CEILOMETER_AUTH_CACHE_DIR
 
+    iniset $CEILOMETER_CONF notification store_events $CEILOMETER_EVENTS
+
     if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] ; then
         iniset $CEILOMETER_CONF database alarm_connection $(database_connection_url ceilometer)
         iniset $CEILOMETER_CONF database event_connection $(database_connection_url ceilometer)
         iniset $CEILOMETER_CONF database metering_connection $(database_connection_url ceilometer)
         iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
+    elif [ "$CEILOMETER_BACKEND" = 'es' ] ; then
+        # es is only supported for events. we will use sql for alarming/metering.
+        iniset $CEILOMETER_CONF database alarm_connection $(database_connection_url ceilometer)
+        iniset $CEILOMETER_CONF database event_connection es://localhost:9200
+        iniset $CEILOMETER_CONF database metering_connection $(database_connection_url ceilometer)
+        iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
+        ${TOP_DIR}/pkg/elasticsearch.sh start
+        cleanup_ceilometer
     else
         iniset $CEILOMETER_CONF database alarm_connection mongodb://localhost:27017/ceilometer
         iniset $CEILOMETER_CONF database event_connection mongodb://localhost:27017/ceilometer
@@ -264,7 +272,7 @@ function init_ceilometer {
     rm -f $CEILOMETER_AUTH_CACHE_DIR/*
 
     if is_service_enabled mysql postgresql; then
-        if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] ; then
+        if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] || [ "$CEILOMETER_BACKEND" = 'es' ] ; then
             recreate_database ceilometer
             $CEILOMETER_BIN_DIR/ceilometer-dbsync
         fi
@@ -293,6 +301,11 @@ function install_ceilometer {
     elif echo $CEILOMETER_COORDINATION_URL | grep -q '^redis:'; then
         install_redis
     fi
+
+    if [ "$CEILOMETER_BACKEND" = 'es' ] ; then
+        ${TOP_DIR}/pkg/elasticsearch.sh download
+        ${TOP_DIR}/pkg/elasticsearch.sh install
+    fi
 }
 
 # install_ceilometerclient() - Collect source and prepare
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 447596a8db..239d6b938e 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -47,11 +47,20 @@ function configure_elasticsearch {
     :
 }
 
+function _check_elasticsearch_ready {
+    # poll elasticsearch to see if it's started
+    if ! wait_for_service 30 http://localhost:9200; then
+        die $LINENO "Maximum timeout reached. Could not connect to ElasticSearch"
+    fi
+}
+
 function start_elasticsearch {
     if is_ubuntu; then
         sudo /etc/init.d/elasticsearch start
+        _check_elasticsearch_ready
     elif is_fedora; then
         sudo /bin/systemctl start elasticsearch.service
+        _check_elasticsearch_ready
     else
         echo "Unsupported architecture...can not start elasticsearch."
     fi

From c4c27232c869633030022b750c2bf0cd65b66d4c Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 3 Mar 2015 09:54:49 +0100
Subject: [PATCH 0393/3333] Use the Member role with horizon

Horizon by default using the _member_ role,
which is considered as a legacy role.

The tools/create_userrc.sh already creates the regular users,
with Member role.

Change-Id: Ibc07a0f28d0729f8a717a54e94fe014853363592
Closes-Bug: #1421616
---
 lib/horizon | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/horizon b/lib/horizon
index a8e83f9d8f..c6e3692d47 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -94,6 +94,7 @@ function init_horizon {
     cp $HORIZON_SETTINGS $local_settings
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""

From 8b5406e228e83e5b83a32f67fe2ea5e49a90016d Mon Sep 17 00:00:00 2001
From: Roey Chen <roeyc@vmware.com>
Date: Mon, 22 Dec 2014 04:57:22 -0800
Subject: [PATCH 0394/3333] vmware-nsx: Vendor code split

Devstack support is added using Devstack's external plugins:
https://review.openstack.org/#/c/156526

Asside to the environment variables, the following should be added to
local.conf file:

enable_plugin vmware-nsx https://git.openstack.org/stackforge/vmware-nsx

for the nsx plugin:
    Q_PLUGIN=vmware_nsx
    enable_service vmware_nsx

for the nsx_v plugin:
    Q_PLUGIN=vmware_nsx_v

Partially-Implements: blueprint vmware-nsx-v

Change-Id: I4e03d4953bf9b5112ff75a252b61c27fadd04bf1
Signed-off-by: Roey Chen <roeyc@vmware.com>
---
 lib/neutron_plugins/vmware_nsx    | 143 +-----------------------------
 lib/neutron_plugins/vmware_nsx_v  |  10 +++
 lib/neutron_thirdparty/vmware_nsx |  91 +------------------
 3 files changed, 15 insertions(+), 229 deletions(-)
 create mode 100644 lib/neutron_plugins/vmware_nsx_v

diff --git a/lib/neutron_plugins/vmware_nsx b/lib/neutron_plugins/vmware_nsx
index 4cbedd6de4..b6c1c9c13f 100644
--- a/lib/neutron_plugins/vmware_nsx
+++ b/lib/neutron_plugins/vmware_nsx
@@ -1,147 +1,10 @@
 #!/bin/bash
-#
-# Neutron VMware NSX plugin
-# -------------------------
 
-# Save trace setting
-NSX_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-
-function setup_integration_bridge {
-    _neutron_ovs_base_setup_bridge $OVS_BRIDGE
-    # Set manager to NSX controller (1st of list)
-    if [[ "$NSX_CONTROLLERS" != "" ]]; then
-        # Get the first controller
-        controllers=(${NSX_CONTROLLERS//,/ })
-        OVS_MGR_IP=${controllers[0]}
-    else
-        die $LINENO "Error - No controller specified. Unable to set a manager for OVS"
-    fi
-    sudo ovs-vsctl set-manager ssl:$OVS_MGR_IP
-}
-
-function is_neutron_ovs_base_plugin {
-    # NSX uses OVS, but not the l3-agent
-    return 0
-}
-
-function neutron_plugin_create_nova_conf {
-    # if n-cpu is enabled, then setup integration bridge
-    if is_service_enabled n-cpu; then
-        setup_integration_bridge
-    fi
-}
-
-function neutron_plugin_install_agent_packages {
-    # VMware NSX Plugin does not run q-agt, but it currently needs dhcp and metadata agents
-    _neutron_ovs_base_install_agent_packages
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/vmware
-    Q_PLUGIN_CONF_FILENAME=nsx.ini
-    Q_PLUGIN_CLASS="neutron.plugins.vmware.plugin.NsxPlugin"
-}
-
-function neutron_plugin_configure_debug_command {
-    sudo ovs-vsctl --no-wait -- --may-exist add-br $PUBLIC_BRIDGE
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge "$PUBLIC_BRIDGE"
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    setup_integration_bridge
-    iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata True
-    iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network True
-    iniset $Q_DHCP_CONF_FILE DEFAULT ovs_use_veth True
-}
-
-function neutron_plugin_configure_l3_agent {
-    # VMware NSX plugin does not run L3 agent
-    die $LINENO "q-l3 should not be executed with VMware NSX plugin!"
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # VMware NSX plugin does not run L2 agent
-    die $LINENO "q-agt must not be executed with VMware NSX plugin!"
-}
-
-function neutron_plugin_configure_service {
-    if [[ "$MAX_LP_PER_BRIDGED_LS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE nsx max_lp_per_bridged_ls $MAX_LP_PER_BRIDGED_LS
-    fi
-    if [[ "$MAX_LP_PER_OVERLAY_LS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE nsx max_lp_per_overlay_ls $MAX_LP_PER_OVERLAY_LS
-    fi
-    if [[ "$FAILOVER_TIME" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE nsx failover_time $FAILOVER_TIME
-    fi
-    if [[ "$CONCURRENT_CONNECTIONS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE nsx concurrent_connections $CONCURRENT_CONNECTIONS
-    fi
-
-    if [[ "$DEFAULT_TZ_UUID" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT default_tz_uuid $DEFAULT_TZ_UUID
-    else
-        die $LINENO "The VMware NSX plugin won't work without a default transport zone."
-    fi
-    if [[ "$DEFAULT_L3_GW_SVC_UUID" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT default_l3_gw_service_uuid $DEFAULT_L3_GW_SVC_UUID
-        Q_L3_ENABLED=True
-        Q_L3_ROUTER_PER_TENANT=True
-        iniset /$Q_PLUGIN_CONF_FILE nsx metadata_mode access_network
-    fi
-    if [[ "$DEFAULT_L2_GW_SVC_UUID" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT default_l2_gw_service_uuid $DEFAULT_L2_GW_SVC_UUID
-    fi
-    # NSX_CONTROLLERS must be a comma separated string
-    if [[ "$NSX_CONTROLLERS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT nsx_controllers $NSX_CONTROLLERS
-    else
-        die $LINENO "The VMware NSX plugin needs at least an NSX controller."
-    fi
-    if [[ "$NSX_USER" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT nsx_user $NSX_USER
-    fi
-    if [[ "$NSX_PASSWORD" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT nsx_password $NSX_PASSWORD
-    fi
-    if [[ "$NSX_HTTP_TIMEOUT" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT http_timeout $NSX_HTTP_TIMEOUT
-    fi
-    if [[ "$NSX_RETRIES" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT retries $NSX_RETRIES
-    fi
-    if [[ "$NSX_REDIRECTS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE DEFAULT redirects $NSX_REDIRECTS
-    fi
-    if [[ "$AGENT_MODE" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE nsx agent_mode $AGENT_MODE
-        if [[ "$AGENT_MODE" == "agentless" ]]; then
-            if [[ "$DEFAULT_SERVICE_CLUSTER_UUID" != "" ]]; then
-                iniset /$Q_PLUGIN_CONF_FILE DEFAULT default_service_cluster_uuid $DEFAULT_SERVICE_CLUSTER_UUID
-            else
-                die $LINENO "Agentless mode requires a service cluster."
-            fi
-            iniset /$Q_PLUGIN_CONF_FILE nsx_metadata metadata_server_address $Q_META_DATA_IP
-        fi
-    fi
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
-}
+# This file is needed so Q_PLUGIN=vmware_nsx will work.
 
+# FIXME(salv-orlando): This function should not be here, but unfortunately
+# devstack calls it before the external plugins are fetched
 function has_neutron_plugin_security_group {
     # 0 means True here
     return 0
 }
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-dhcp && return 0
-}
-
-# Restore xtrace
-$NSX_XTRACE
diff --git a/lib/neutron_plugins/vmware_nsx_v b/lib/neutron_plugins/vmware_nsx_v
new file mode 100644
index 0000000000..3d33c652d1
--- /dev/null
+++ b/lib/neutron_plugins/vmware_nsx_v
@@ -0,0 +1,10 @@
+#!/bin/bash
+#
+# This file is needed so Q_PLUGIN=vmware_nsx_v will work.
+
+# FIXME(salv-orlando): This function should not be here, but unfortunately
+# devstack calls it before the external plugins are fetched
+function has_neutron_plugin_security_group {
+    # 0 means True here
+    return 0
+}
diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
index 7027a29892..03853a9bf4 100644
--- a/lib/neutron_thirdparty/vmware_nsx
+++ b/lib/neutron_thirdparty/vmware_nsx
@@ -1,89 +1,2 @@
-#!/bin/bash
-#
-# VMware NSX
-# ----------
-
-# This third-party addition can be used to configure connectivity between a DevStack instance
-# and an NSX Gateway in dev/test environments. In order to use this correctly, the following
-# env variables need to be set (e.g. in your localrc file):
-#
-# * enable_service vmware_nsx        --> to execute this third-party addition
-# * PUBLIC_BRIDGE                    --> bridge used for external connectivity, typically br-ex
-# * NSX_GATEWAY_NETWORK_INTERFACE    --> interface used to communicate with the NSX Gateway
-# * NSX_GATEWAY_NETWORK_CIDR         --> CIDR to configure $PUBLIC_BRIDGE, e.g. 172.24.4.211/24
-
-# Save trace setting
-NSX3_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-# This is the interface that connects the Devstack instance
-# to an network that allows it to talk to the gateway for
-# testing purposes
-NSX_GATEWAY_NETWORK_INTERFACE=${NSX_GATEWAY_NETWORK_INTERFACE:-eth2}
-# Re-declare floating range as it's needed also in stop_vmware_nsx, which
-# is invoked by unstack.sh
-FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
-
-function configure_vmware_nsx {
-    :
-}
-
-function init_vmware_nsx {
-    if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
-        NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
-        echo "The IP address to set on $PUBLIC_BRIDGE was not specified. "
-        echo "Defaulting to "$NSX_GATEWAY_NETWORK_CIDR
-    fi
-    # Make sure the interface is up, but not configured
-    sudo ip link set $NSX_GATEWAY_NETWORK_INTERFACE up
-    # Save and then flush the IP addresses on the interface
-    addresses=$(ip addr show dev $NSX_GATEWAY_NETWORK_INTERFACE | grep inet | awk {'print $2'})
-    sudo ip addr flush $NSX_GATEWAY_NETWORK_INTERFACE
-    # Use the PUBLIC Bridge to route traffic to the NSX gateway
-    # NOTE(armando-migliaccio): if running in a nested environment this will work
-    # only with mac learning enabled, portsecurity and security profiles disabled
-    # The public bridge might not exist for the NSX plugin if Q_USE_DEBUG_COMMAND is off
-    # Try to create it anyway
-    sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE
-    sudo ovs-vsctl --may-exist add-port $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_INTERFACE
-    nsx_gw_net_if_mac=$(ip link show $NSX_GATEWAY_NETWORK_INTERFACE | awk '/ether/ {print $2}')
-    sudo ip link set address $nsx_gw_net_if_mac dev $PUBLIC_BRIDGE
-    for address in $addresses; do
-        sudo ip addr add dev $PUBLIC_BRIDGE $address
-    done
-    sudo ip addr add dev $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_CIDR
-    sudo ip link set $PUBLIC_BRIDGE up
-}
-
-function install_vmware_nsx {
-    :
-}
-
-function start_vmware_nsx {
-    :
-}
-
-function stop_vmware_nsx {
-    if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
-        NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
-        echo "The IP address expected on $PUBLIC_BRIDGE was not specified. "
-        echo "Defaulting to "$NSX_GATEWAY_NETWORK_CIDR
-    fi
-    sudo ip addr del $NSX_GATEWAY_NETWORK_CIDR dev $PUBLIC_BRIDGE
-    # Save and then flush remaining addresses on the interface
-    addresses=$(ip addr show dev $PUBLIC_BRIDGE | grep inet | awk {'print $2'})
-    sudo ip addr flush $PUBLIC_BRIDGE
-    # Try to detach physical interface from PUBLIC_BRIDGE
-    sudo ovs-vsctl del-port $NSX_GATEWAY_NETWORK_INTERFACE
-    # Restore addresses on NSX_GATEWAY_NETWORK_INTERFACE
-    for address in $addresses; do
-        sudo ip addr add dev $NSX_GATEWAY_NETWORK_INTERFACE $address
-    done
-}
-
-function check_vmware_nsx {
-    neutron-check-nsx-config $NEUTRON_CONF_DIR/plugins/vmware/nsx.ini
-}
-
-# Restore xtrace
-$NSX3_XTRACE
+# REVISIT(roeyc): this file left empty so that 'enable_service vmware_nsx'
+# continues to work.

From dd4bafd7ef832f6264659af8d63f4db66d32828f Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Mon, 2 Mar 2015 23:32:04 -0500
Subject: [PATCH 0395/3333] Add guestagent to defined Trove conf variables

When the Trove configuration files were defined in variables, the
guestagent wasn't included. In order for profiling to continue on the
guestagent, its configuration file must be defined as well.
(See https://bugs.launchpad.net/devstack/+bug/1421403)

TROVE_GUESTAGENT_CONF is now defined.

Change-Id: Ie7cb531e2a1eca74100e2466a430e85eaf936263
Closes-Bug: #1427506
---
 lib/trove | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/trove b/lib/trove
index 080e860f03..d77798308b 100644
--- a/lib/trove
+++ b/lib/trove
@@ -37,6 +37,7 @@ TROVE_CONF_DIR=/etc/trove
 TROVE_CONF=$TROVE_CONF_DIR/trove.conf
 TROVE_TASKMANAGER_CONF=$TROVE_CONF_DIR/trove-taskmanager.conf
 TROVE_CONDUCTOR_CONF=$TROVE_CONF_DIR/trove-conductor.conf
+TROVE_GUESTAGENT_CONF=$TROVE_CONF_DIR/trove-guestagent.conf
 TROVE_API_PASTE_INI=$TROVE_CONF_DIR/api-paste.ini
 
 TROVE_LOCAL_CONF_DIR=$TROVE_DIR/etc/trove
@@ -171,18 +172,18 @@ function configure_trove {
     fi
 
     # Set up Guest Agent conf
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_userid $RABBIT_USERID
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_host $TROVE_HOST_GATEWAY
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_password $RABBIT_PASSWORD
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT nova_proxy_admin_user radmin
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT nova_proxy_admin_tenant_name trove
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT control_exchange trove
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT ignore_users os_admin
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT log_dir /var/log/trove/
-    iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT log_file trove-guestagent.log
-    setup_trove_logging $TROVE_CONF_DIR/trove-guestagent.conf
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT rabbit_userid $RABBIT_USERID
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT rabbit_host $TROVE_HOST_GATEWAY
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT nova_proxy_admin_user radmin
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT nova_proxy_admin_tenant_name trove
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT control_exchange trove
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT ignore_users os_admin
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT log_dir /var/log/trove/
+    iniset $TROVE_GUESTAGENT_CONF DEFAULT log_file trove-guestagent.log
+    setup_trove_logging $TROVE_GUESTAGENT_CONF
 }
 
 # install_troveclient() - Collect source and prepare

From e3ceaedbd7b111c1e8b28510a4eb11e540d4af77 Mon Sep 17 00:00:00 2001
From: Matthew Booth <mbooth@redhat.com>
Date: Tue, 3 Mar 2015 16:13:31 +0000
Subject: [PATCH 0396/3333] Fix defaulting of REMOTE_CEPH

A typo in lib/ceph was causing REMOTE_CEPH to be defaulted whenever
lib/ceph was sourced, regardless of its existing value. The
`trueorfalse` function takes a variable name as its second argument,
not a value.

Change-Id: Iec846e0b892eaa63a0a2a59aa045bc56d5606af1
---
 lib/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceph b/lib/ceph
index a6b8cc8b57..251cfd1449 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -71,7 +71,7 @@ CEPH_REPLICAS=${CEPH_REPLICAS:-1}
 CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
 
 # Connect to an existing Ceph cluster
-REMOTE_CEPH=$(trueorfalse False $REMOTE_CEPH)
+REMOTE_CEPH=$(trueorfalse False REMOTE_CEPH)
 REMOTE_CEPH_ADMIN_KEY_PATH=${REMOTE_CEPH_ADMIN_KEY_PATH:-$CEPH_CONF_DIR/ceph.client.admin.keyring}
 
 

From 0fdf34959eb8f330301adfcd0ab1cfe975b5460c Mon Sep 17 00:00:00 2001
From: Matthew Booth <mbooth@redhat.com>
Date: Tue, 3 Mar 2015 16:37:35 +0000
Subject: [PATCH 0397/3333] Don't cleanup ceph config when REMOTE_CEPH=True

If REMOTE_CEPH=True then we didn't write the contents of /etc/ceph, so
we shouldn't delete them.

Change-Id: I6291c6562a2864de775b1acb4be0be35b866f30d
---
 lib/ceph | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index 251cfd1449..76747ccd77 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -151,14 +151,14 @@ function cleanup_ceph_embedded {
     if [[ -e ${CEPH_DISK_IMAGE} ]]; then
         sudo rm -f ${CEPH_DISK_IMAGE}
     fi
+
+    # purge ceph config file and keys
+    sudo rm -rf ${CEPH_CONF_DIR}/*
 }
 
 function cleanup_ceph_general {
     undefine_virsh_secret
     uninstall_package ceph ceph-common python-ceph libcephfs1 > /dev/null 2>&1
-
-    # purge ceph config file and keys
-    sudo rm -rf ${CEPH_CONF_DIR}/*
 }
 
 

From aca8a7fd991484a59fc20aadc3cedb339fc55ca5 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 3 Mar 2015 08:50:27 -0800
Subject: [PATCH 0398/3333] Add support for oslo.versionedobjects

Change-Id: I01dba39259a3b264d4ec2b21db8429d340751979
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 4 ++--
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/oslo b/lib/oslo
index 18cddc193e..86efb60a4e 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -36,6 +36,7 @@ GITDIR["oslo.policy"]=$DEST/oslo.policy
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
 GITDIR["oslo.utils"]=$DEST/oslo.utils
+GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
 GITDIR["pycadf"]=$DEST/pycadf
 GITDIR["stevedore"]=$DEST/stevedore
@@ -72,6 +73,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.rootwrap"
     _do_install_oslo_lib "oslo.serialization"
     _do_install_oslo_lib "oslo.utils"
+    _do_install_oslo_lib "oslo.versionedobjects"
     _do_install_oslo_lib "oslo.vmware"
     _do_install_oslo_lib "pycadf"
     _do_install_oslo_lib "stevedore"
diff --git a/stackrc b/stackrc
index 103be6de66..30706ebd4a 100644
--- a/stackrc
+++ b/stackrc
@@ -361,6 +361,10 @@ GITBRANCH["oslo.serialization"]=${OSLOSERIALIZATION_BRANCH:-master}
 GITREPO["oslo.utils"]=${OSLOUTILS_REPO:-${GIT_BASE}/openstack/oslo.utils.git}
 GITBRANCH["oslo.utils"]=${OSLOUTILS_BRANCH:-master}
 
+# oslo.versionedobjects
+GITREPO["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_REPO:-${GIT_BASE}/openstack/oslo.versionedobjects.git}
+GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-master}
+
 # oslo.vmware
 GITREPO["oslo.vmware"]=${OSLOVMWARE_REPO:-${GIT_BASE}/openstack/oslo.vmware.git}
 GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 472b0ea4af..0bec584aad 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -34,8 +34,8 @@ ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
 ALL_LIBS+=" python-glanceclient python-ironicclient tempest-lib"
 ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
-ALL_LIBS+=" oslo.vmware keystonemiddleware oslo.serialization"
-ALL_LIBS+=" python-saharaclient django_openstack_auth"
+ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
+ALL_LIBS+=" oslo.serialization python-saharaclient django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"

From 93e682c558f954fa35a00d7cc6a6903e8ed59178 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Tue, 3 Mar 2015 10:31:30 -0700
Subject: [PATCH 0399/3333] Revert change to remove lbaas from devstack; it
 breaks grenade.

Change-Id: Ie2adaeb7f27d6d646ca2e6e575fb430b9b74b276
---
 functions-common                          | 19 --------
 lib/neutron                               | 53 ++++++++++++++++-------
 lib/neutron_plugins/services/loadbalancer | 49 +++++++++++++++++++++
 stackrc                                   |  3 --
 4 files changed, 86 insertions(+), 38 deletions(-)
 create mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/functions-common b/functions-common
index 267dfe8622..df69cbad16 100644
--- a/functions-common
+++ b/functions-common
@@ -1601,25 +1601,6 @@ function enable_plugin {
     GITBRANCH[$name]=$branch
 }
 
-# is_plugin_enabled
-#
-# Has a particular plugin been enabled?
-function is_plugin_enabled {
-    local plugins=$@
-    local plugin
-    local enabled=1
-
-    # short circuit if nothing to do
-    if [[ -z ${DEVSTACK_PLUGINS} ]]; then
-        return $enabled
-    fi
-
-    for plugin in ${plugins}; do
-        [[ ,${DEVSTACK_PLUGINS}, =~ ,${plugin}, ]] && enabled=0
-    done
-    return $enabled
-}
-
 # fetch_plugins
 #
 # clones all plugins
diff --git a/lib/neutron b/lib/neutron
index a0f9c362f2..a7aabc5909 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -100,8 +100,10 @@ IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-fe80:cafe:cafe::1}
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
+
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
@@ -114,7 +116,6 @@ fi
 
 NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
-
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
 # Agent binaries.  Note, binary paths for other agents are set in per-service
@@ -325,6 +326,12 @@ ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
 # Please refer to ``lib/neutron_plugins/README.md`` for details.
 source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 
+# Agent loadbalancer service plugin functions
+# -------------------------------------------
+
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
+
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -351,17 +358,6 @@ fi
 TEMPEST_SERVICES+=,neutron
 
 
-# For backward compatibility, if q-lbaas service is enabled, make sure to load the
-# neutron-lbaas plugin.  This hook should be removed in a future release, perhaps
-# as early as Liberty.
-
-if is_service_enabled q-lbaas; then
-    if ! is_plugin_enabled neutron-lbaas; then
-        DEPRECATED_TEXT+="External plugin neutron-lbaas has been automatically activated, please add the appropriate enable_plugin to your local.conf. This will be removed in the Liberty cycle."
-        enable_plugin "neutron-lbaas" ${NEUTRON_LBAAS_REPO} ${NEUTRON_LBAAS_BRANCH}
-    fi
-fi
-
 # Save trace setting
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
@@ -429,7 +425,9 @@ function configure_neutron {
     iniset_rpc_backend neutron $NEUTRON_CONF DEFAULT
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-
+    if is_service_enabled q-lbaas; then
+        _configure_neutron_lbaas
+    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -607,8 +605,7 @@ function init_neutron {
     recreate_database $Q_DB_NAME
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-
-    for svc in fwaas vpnaas; do
+    for svc in fwaas lbaas vpnaas; do
         if [ "$svc" = "vpnaas" ]; then
             q_svc="q-vpn"
         else
@@ -628,6 +625,10 @@ function install_neutron {
         git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
         setup_develop $NEUTRON_FWAAS_DIR
     fi
+    if is_service_enabled q-lbaas; then
+        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
+        setup_develop $NEUTRON_LBAAS_DIR
+    fi
     if is_service_enabled q-vpn; then
         git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
         setup_develop $NEUTRON_VPNAAS_DIR
@@ -671,6 +672,10 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
+
+    if is_service_enabled q-lbaas; then
+        neutron_agent_lbaas_install_agent_packages
+    fi
 }
 
 # Start running processes, including screen
@@ -730,6 +735,10 @@ function start_neutron_agents {
         run_process q-domua "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
     fi
 
+    if is_service_enabled q-lbaas; then
+        run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
+    fi
+
     if is_service_enabled q-metering; then
         run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
     fi
@@ -753,6 +762,9 @@ function stop_neutron {
 
     stop_process q-agt
 
+    if is_service_enabled q-lbaas; then
+        neutron_lbaas_stop
+    fi
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
@@ -780,11 +792,12 @@ function cleanup_neutron {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
 
+
 function _create_neutron_conf_dir {
     # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
     if [[ ! -d $NEUTRON_CONF_DIR ]]; then
@@ -954,6 +967,14 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF DEFAULT notification_driver messaging
 }
 
+function _configure_neutron_lbaas {
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
+    fi
+    neutron_agent_lbaas_configure_common
+    neutron_agent_lbaas_configure_agent
+}
+
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
new file mode 100644
index 0000000000..f465cc94b4
--- /dev/null
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -0,0 +1,49 @@
+# Neutron loadbalancer plugin
+# ---------------------------
+
+# Save trace setting
+LB_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
+LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
+
+function neutron_agent_lbaas_install_agent_packages {
+    if is_ubuntu || is_fedora || is_suse; then
+        install_package haproxy
+    fi
+}
+
+function neutron_agent_lbaas_configure_common {
+    _neutron_service_plugin_class_add $LBAAS_PLUGIN
+    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
+}
+
+function neutron_agent_lbaas_configure_agent {
+    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
+    mkdir -p $LBAAS_AGENT_CONF_PATH
+
+    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
+
+    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini $LBAAS_AGENT_CONF_FILENAME
+
+    # ovs_use_veth needs to be set before the plugin configuration
+    # occurs to allow plugins to override the setting.
+    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
+
+    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
+
+    if is_fedora; then
+        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
+        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
+    fi
+}
+
+function neutron_lbaas_stop {
+    pids=$(ps aux | awk '/haproxy/ { print $2 }')
+    [ ! -z "$pids" ] && sudo kill $pids
+}
+
+# Restore xtrace
+$LB_XTRACE
diff --git a/stackrc b/stackrc
index 103be6de66..cb044b8fed 100644
--- a/stackrc
+++ b/stackrc
@@ -198,9 +198,6 @@ NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
 # neutron lbaas service
-# The neutron-lbaas specific entries are deprecated and replaced by the neutron-lbaas
-# devstack plugin and should be removed in a future release, possibly as soon as Liberty.
-
 NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
 NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
 

From 802473e45ab897144d81d48164d8342763a119d8 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 4 Mar 2015 11:14:00 +0100
Subject: [PATCH 0400/3333] Do not install the python-virtualenv on Fedora

The files/rpms/general:python-virtualenv explicitly
installed this package on Fedoras.

This package is not installed on other distros by devstack
by default.

If you stack/unstack the package gets reinstalled,
and confuses the system about the installed virtual-env version.
The uninstall works in CI, but it can be problematic when you do
reinstalls on the same machine.

The uninstall introduced by
834b804d3eda9029d3c66db0ab732a76a22ed08b, this commit deos not
has any reference to the external bug what it supposed to solve.

Related RDO thread started here:
https://www.redhat.com/archives/rdo-list/2015-March/msg00015.html

Change-Id: I4a723f179bdc28d39a4910fb9e3787e9e67c354b
---
 files/rpms/general | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/rpms/general b/files/rpms/general
index 56a933190c..cf406325e7 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -15,7 +15,6 @@ libxslt-devel
 psmisc
 pylint
 python-unittest2
-python-virtualenv
 python-devel
 screen
 tar

From e2d2d65aa517fdf88cbdd0248d72eb6473bb14c6 Mon Sep 17 00:00:00 2001
From: Zhenzan Zhou <zhenzan.zhou@intel.com>
Date: Sat, 28 Feb 2015 11:13:27 +0800
Subject: [PATCH 0401/3333] Fix ironic port-create deprecated option

A recent ironicclient commit If05d51b09d787ccfbf6f6d35d8e752d42f673601
deprecated --node_uuid, now it should use --node.

Change-Id: Ia97074bd2ce92645ac4b4151824098cb99434117
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index ade889ef75..0c549b6e68 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -600,7 +600,7 @@ function enroll_nodes {
             $node_options \
             | grep " uuid " | get_field 2)
 
-        ironic port-create --address $mac_address --node_uuid $node_id
+        ironic port-create --address $mac_address --node $node_id
 
         total_nodes=$((total_nodes+1))
         total_cpus=$((total_cpus+$ironic_node_cpu))

From ab7df5ea1d4bd579c97bc739d7b9893df1715845 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 4 Mar 2015 16:25:40 -0800
Subject: [PATCH 0402/3333] Add cryptography to list if files to build before
 hand

building this takes 20 seconds or so

Change-Id: I95c71b1d0255c02038006bc743125ff2c49d9da9
---
 files/venv-requirements.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
index 3c50061e96..8417b92408 100644
--- a/files/venv-requirements.txt
+++ b/files/venv-requirements.txt
@@ -1,3 +1,4 @@
+cryptography
 lxml
 MySQL-python
 netifaces

From 8c32e0df7bf35e860ce95e5db3c78e5d6dd33ff6 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Wed, 4 Mar 2015 14:53:05 -0800
Subject: [PATCH 0403/3333] Set rootfstype=ramfs for low memory Ironic nodes

When running with low memory (<1024), we need to switch from the default
rootfstype from tmpfs to ramfs to ensure nodes can decompress deployment
ramdisks.

Change-Id: I1b9dd614e592d99b2f59dea899b1ed3859ae0811
---
 lib/ironic | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index bc30cdbeba..325bee9060 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -343,13 +343,24 @@ function configure_ironic_conductor {
     iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
     iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
     iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
+
+    local pxe_params=""
     if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-        local pxe_params="nofb nomodeset vga=normal console=ttyS0"
+        pxe_params+="nofb nomodeset vga=normal console=ttyS0"
         if is_deployed_with_ipa_ramdisk; then
             pxe_params+=" systemd.journald.forward_to_console=yes"
         fi
+    fi
+    # When booting with less than 1GB, we need to switch from default tmpfs
+    # to ramfs for ramdisks to decompress successfully.
+    if (is_ironic_hardware && [[ "$IRONIC_HW_NODE_RAM" -lt 1024 ]]) ||
+        (! is_ironic_hardware && [[ "$IRONIC_VM_SPECS_RAM" -lt 1024 ]]); then
+        pxe_params+=" rootfstype=ramfs"
+    fi
+    if [[ -n "$pxe_params" ]]; then
         iniset $IRONIC_CONF_FILE pxe pxe_append_params "$pxe_params"
     fi
+
     if is_deployed_by_agent; then
         if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
             iniset $IRONIC_CONF_FILE glance swift_temp_url_key $SWIFT_TEMPURL_KEY

From 249e36dec6198c1dfd8e4f80d1f0a815fe6f36aa Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Thu, 5 Mar 2015 14:01:45 +1300
Subject: [PATCH 0404/3333] Remove lib/dib

diskimage-builder is a utility rather than a service, and is already
installed in devstack via pip when required.

lib/dib was created to allow an image to be created during a devstack
run for the heat functional tests, however this approach is no longer
being taken and there are no other known uses for lib/dib.

This change removes lib/dib and moves the pip mirror building to
lib/heat so that snapshot pip packages of the heat agent projects can
be made available to servers which the heat functional tests boot.

This also removes tripleo-image-elements, which has never
been utilised, and since images won't be created
during heat functional test runs it is no longer required.

Change-Id: Ic77f841437ea23c0645d3a34d9dd6bfd1ee28714
---
 doc/source/index.rst                |   2 -
 extras.d/40-dib.sh                  |  27 -----
 files/apache-dib-pip-repo.template  |  15 ---
 files/apache-heat-pip-repo.template |  15 +++
 lib/dib                             | 149 ----------------------------
 lib/heat                            |  69 ++++++++-----
 stack.sh                            |   6 +-
 stackrc                             |  10 +-
 8 files changed, 65 insertions(+), 228 deletions(-)
 delete mode 100644 extras.d/40-dib.sh
 delete mode 100644 files/apache-dib-pip-repo.template
 create mode 100644 files/apache-heat-pip-repo.template
 delete mode 100644 lib/dib

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 10f4355c07..cfde99132d 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -158,7 +158,6 @@ Scripts
 * `lib/cinder <lib/cinder.html>`__
 * `lib/config <lib/config.html>`__
 * `lib/database <lib/database.html>`__
-* `lib/dib <lib/dib.html>`__
 * `lib/dstat <lib/dstat.html>`__
 * `lib/glance <lib/glance.html>`__
 * `lib/heat <lib/heat.html>`__
@@ -181,7 +180,6 @@ Scripts
 * `clean.sh <clean.sh.html>`__
 * `run\_tests.sh <run_tests.sh.html>`__
 
-* `extras.d/40-dib.sh <extras.d/40-dib.sh.html>`__
 * `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
 * `extras.d/70-sahara.sh <extras.d/70-sahara.sh.html>`__
diff --git a/extras.d/40-dib.sh b/extras.d/40-dib.sh
deleted file mode 100644
index fdae01191f..0000000000
--- a/extras.d/40-dib.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-# dib.sh - Devstack extras script to install diskimage-builder
-
-if is_service_enabled dib; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/dib
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing diskimage-builder"
-        install_dib
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        # no-op
-        :
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        # no-op
-        :
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        # no-op
-        :
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        # no-op
-        :
-    fi
-fi
diff --git a/files/apache-dib-pip-repo.template b/files/apache-dib-pip-repo.template
deleted file mode 100644
index 5d2379b5bb..0000000000
--- a/files/apache-dib-pip-repo.template
+++ /dev/null
@@ -1,15 +0,0 @@
-Listen %DIB_PIP_REPO_PORT%
-
-<VirtualHost *:%DIB_PIP_REPO_PORT%>
-    DocumentRoot %DIB_PIP_REPO%
-    <Directory %DIB_PIP_REPO%>
-        DirectoryIndex index.html
-        Require all granted
-        Order allow,deny
-        allow from all
-    </Directory>
-
-    ErrorLog /var/log/%APACHE_NAME%/dib_pip_repo_error.log
-    LogLevel warn
-    CustomLog /var/log/%APACHE_NAME%/dib_pip_repo_access.log combined
-</VirtualHost>
diff --git a/files/apache-heat-pip-repo.template b/files/apache-heat-pip-repo.template
new file mode 100644
index 0000000000..d88ac3e35a
--- /dev/null
+++ b/files/apache-heat-pip-repo.template
@@ -0,0 +1,15 @@
+Listen %HEAT_PIP_REPO_PORT%
+
+<VirtualHost *:%HEAT_PIP_REPO_PORT%>
+    DocumentRoot %HEAT_PIP_REPO%
+    <Directory %HEAT_PIP_REPO%>
+        DirectoryIndex index.html
+        Require all granted
+        Order allow,deny
+        allow from all
+    </Directory>
+
+    ErrorLog /var/log/%APACHE_NAME%/heat_pip_repo_error.log
+    LogLevel warn
+    CustomLog /var/log/%APACHE_NAME%/heat_pip_repo_access.log combined
+</VirtualHost>
diff --git a/lib/dib b/lib/dib
deleted file mode 100644
index 88d9fd8434..0000000000
--- a/lib/dib
+++ /dev/null
@@ -1,149 +0,0 @@
-#!/bin/bash
-#
-# lib/dib
-# Install and build images with **diskimage-builder**
-
-# Dependencies:
-#
-# - functions
-# - DEST, DATA_DIR must be defined
-
-# stack.sh
-# ---------
-# - install_dib
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-# Defaults
-# --------
-
-# set up default directories
-DIB_DIR=$DEST/diskimage-builder
-TIE_DIR=$DEST/tripleo-image-elements
-
-# NOTE: Setting DIB_APT_SOURCES assumes you will be building
-# Debian/Ubuntu based images. Leave unset for other flavors.
-DIB_APT_SOURCES=${DIB_APT_SOURCES:-""}
-DIB_BUILD_OFFLINE=$(trueorfalse False DIB_BUILD_OFFLINE)
-DIB_IMAGE_CACHE=$DATA_DIR/diskimage-builder/image-create
-DIB_PIP_REPO=$DATA_DIR/diskimage-builder/pip-repo
-DIB_PIP_REPO_PORT=${DIB_PIP_REPO_PORT:-8899}
-
-OCC_DIR=$DEST/os-collect-config
-ORC_DIR=$DEST/os-refresh-config
-OAC_DIR=$DEST/os-apply-config
-
-# Functions
-# ---------
-
-# install_dib() - Collect source and prepare
-function install_dib {
-    pip_install diskimage-builder
-
-    git_clone $TIE_REPO $TIE_DIR $TIE_BRANCH
-    git_clone $OCC_REPO $OCC_DIR $OCC_BRANCH
-    git_clone $ORC_REPO $ORC_DIR $ORC_BRANCH
-    git_clone $OAC_REPO $OAC_DIR $OAC_BRANCH
-    mkdir -p $DIB_IMAGE_CACHE
-}
-
-# build_dib_pip_repo() - Builds a local pip repo from local projects
-function build_dib_pip_repo {
-    local project_dirs=$1
-    local projpath proj package
-
-    rm -rf $DIB_PIP_REPO
-    mkdir -p $DIB_PIP_REPO
-
-    echo "<html><body>" > $DIB_PIP_REPO/index.html
-    for projpath in $project_dirs; do
-        proj=$(basename $projpath)
-        mkdir -p $DIB_PIP_REPO/$proj
-        pushd $projpath
-        rm -rf dist
-        python setup.py sdist
-        pushd dist
-        package=$(ls *)
-        mv $package $DIB_PIP_REPO/$proj/$package
-        popd
-
-        echo "<html><body><a href=\"$package\">$package</a></body></html>" > $DIB_PIP_REPO/$proj/index.html
-        echo "<a href=\"$proj\">$proj</a><br/>" >> $DIB_PIP_REPO/index.html
-
-        popd
-    done
-
-    echo "</body></html>" >> $DIB_PIP_REPO/index.html
-
-    local dib_pip_repo_apache_conf=$(apache_site_config_for dib_pip_repo)
-
-    sudo cp $FILES/apache-dib-pip-repo.template $dib_pip_repo_apache_conf
-    sudo sed -e "
-        s|%DIB_PIP_REPO%|$DIB_PIP_REPO|g;
-        s|%DIB_PIP_REPO_PORT%|$DIB_PIP_REPO_PORT|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-    " -i $dib_pip_repo_apache_conf
-    enable_apache_site dib_pip_repo
-}
-
-# disk_image_create_upload() - Creates and uploads a diskimage-builder built image
-function disk_image_create_upload {
-
-    local image_name=$1
-    local image_elements=$2
-    local elements_path=$3
-
-    local image_path=$TOP_DIR/files/$image_name.qcow2
-
-    # Include the apt-sources element in builds if we have an
-    # alternative sources.list specified.
-    if [ -n "$DIB_APT_SOURCES" ]; then
-        if [ ! -e "$DIB_APT_SOURCES" ]; then
-            die $LINENO "DIB_APT_SOURCES set but not found at $DIB_APT_SOURCES"
-        fi
-        local extra_elements="apt-sources"
-    fi
-
-    # Set the local pip repo as the primary index mirror so the
-    # image is built with local packages
-    local pypi_mirror_url=http://$SERVICE_HOST:$DIB_PIP_REPO_PORT/
-    local pypi_mirror_url_1
-
-    if [ -a $HOME/.pip/pip.conf ]; then
-        # Add the current pip.conf index-url as an extra-index-url
-        # in the image build
-        pypi_mirror_url_1=$(iniget $HOME/.pip/pip.conf global index-url)
-    else
-        # If no pip.conf, set upstream pypi as an extra mirror
-        # (this also sets the .pydistutils.cfg index-url)
-        pypi_mirror_url_1=http://pypi.python.org/simple
-    fi
-
-    # The disk-image-create command to run
-    ELEMENTS_PATH=$elements_path \
-    DIB_APT_SOURCES=$DIB_APT_SOURCES \
-    DIB_OFFLINE=$DIB_BUILD_OFFLINE \
-    PYPI_MIRROR_URL=$pypi_mirror_url \
-    PYPI_MIRROR_URL_1=$pypi_mirror_url_1 \
-    disk-image-create -a amd64 $image_elements ${extra_elements:-} \
-        --image-cache $DIB_IMAGE_CACHE \
-        -o $image_path
-
-    local token=$(keystone token-get | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO token "Keystone fail to get token"
-
-    glance --os-auth-token $token --os-image-url http://$GLANCE_HOSTPORT \
-        image-create --name $image_name --is-public True \
-        --container-format=bare --disk-format qcow2 \
-        < $image_path
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/lib/heat b/lib/heat
index c1021639b4..a088e82886 100644
--- a/lib/heat
+++ b/lib/heat
@@ -8,9 +8,7 @@
 #   ENABLED_SERVICES+=,heat,h-api,h-api-cfn,h-api-cw,h-eng
 
 # Dependencies:
-#
-# - functions
-# - dib (if HEAT_CREATE_TEST_IMAGE=True)
+# (none)
 
 # stack.sh
 # ---------
@@ -37,6 +35,13 @@ GITDIR["python-heatclient"]=$DEST/python-heatclient
 HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
+OCC_DIR=$DEST/os-collect-config
+ORC_DIR=$DEST/os-refresh-config
+OAC_DIR=$DEST/os-apply-config
+
+HEAT_PIP_REPO=$DATA_DIR/heat-pip-repo
+HEAT_PIP_REPO_PORT=${HEAT_PIP_REPO_PORT:-8899}
+
 HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
 HEAT_STANDALONE=$(trueorfalse False HEAT_STANDALONE)
 HEAT_ENABLE_ADOPT_ABANDON=$(trueorfalse False HEAT_ENABLE_ADOPT_ABANDON)
@@ -47,10 +52,6 @@ HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
 HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
-HEAT_FUNCTIONAL_IMAGE_ELEMENTS=${HEAT_FUNCTIONAL_IMAGE_ELEMENTS:-\
-vm fedora selinux-permissive pypi  os-collect-config os-refresh-config \
-os-apply-config heat-cfntools heat-config heat-config-cfn-init \
-heat-config-puppet heat-config-script}
 
 
 # other default options
@@ -296,22 +297,44 @@ function create_heat_accounts {
     fi
 }
 
-# build_heat_functional_test_image() - Build and upload functional test image
-function build_heat_functional_test_image {
-    if is_service_enabled dib; then
-        build_dib_pip_repo "$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
-        local image_name=heat-functional-tests-image
-
-        # Elements path for tripleo-image-elements and heat-templates software-config
-        local elements_path=$TIE_DIR/elements:$HEAT_TEMPLATES_REPO_DIR/hot/software-config/elements
-
-        disk_image_create_upload "$image_name" "$HEAT_FUNCTIONAL_IMAGE_ELEMENTS" "$elements_path"
-        iniset $TEMPEST_CONFIG orchestration image_ref $image_name
-    else
-        echo "Error, HEAT_CREATE_TEST_IMAGE=True requires dib" >&2
-        echo "Add \"enable_service dib\" to your localrc" >&2
-        exit 1
-    fi
+# build_heat_pip_mirror() - Build a pip mirror containing heat agent projects
+function build_heat_pip_mirror {
+    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
+    local projpath proj package
+
+    rm -rf $HEAT_PIP_REPO
+    mkdir -p $HEAT_PIP_REPO
+
+    echo "<html><body>" > $HEAT_PIP_REPO/index.html
+    for projpath in $project_dirs; do
+        proj=$(basename $projpath)
+        mkdir -p $HEAT_PIP_REPO/$proj
+        pushd $projpath
+        rm -rf dist
+        python setup.py sdist
+        pushd dist
+        package=$(ls *)
+        mv $package $HEAT_PIP_REPO/$proj/$package
+        popd
+
+        echo "<html><body><a href=\"$package\">$package</a></body></html>" > $HEAT_PIP_REPO/$proj/index.html
+        echo "<a href=\"$proj\">$proj</a><br/>" >> $HEAT_PIP_REPO/index.html
+
+        popd
+    done
+
+    echo "</body></html>" >> $HEAT_PIP_REPO/index.html
+
+    local heat_pip_repo_apache_conf=$(apache_site_config_for heat_pip_repo)
+
+    sudo cp $FILES/apache-heat-pip-repo.template $heat_pip_repo_apache_conf
+    sudo sed -e "
+        s|%HEAT_PIP_REPO%|$HEAT_PIP_REPO|g;
+        s|%HEAT_PIP_REPO_PORT%|$HEAT_PIP_REPO_PORT|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+    " -i $heat_pip_repo_apache_conf
+    enable_apache_site heat_pip_repo
+    restart_apache_server
 }
 
 # Restore xtrace
diff --git a/stack.sh b/stack.sh
index 2ac7dfadeb..bf9fc0118e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1227,9 +1227,9 @@ if is_service_enabled heat; then
     init_heat
     echo_summary "Starting Heat"
     start_heat
-    if [ "$HEAT_CREATE_TEST_IMAGE" = "True" ]; then
-        echo_summary "Building Heat functional test image"
-        build_heat_functional_test_image
+    if [ "$HEAT_BUILD_PIP_MIRROR" = "True" ]; then
+        echo_summary "Building Heat pip mirror"
+        build_heat_pip_mirror
     fi
 fi
 
diff --git a/stackrc b/stackrc
index cb044b8fed..efea1e4560 100644
--- a/stackrc
+++ b/stackrc
@@ -419,14 +419,10 @@ GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
 
 ##################
 #
-#  TripleO Components
+#  TripleO / Heat Agent Components
 #
 ##################
 
-# diskimage-builder
-DIB_REPO=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
-DIB_BRANCH=${DIB_BRANCH:-master}
-
 # os-apply-config configuration template tool
 OAC_REPO=${OAC_REPO:-${GIT_BASE}/openstack/os-apply-config.git}
 OAC_BRANCH=${OAC_BRANCH:-master}
@@ -439,10 +435,6 @@ OCC_BRANCH=${OCC_BRANCH:-master}
 ORC_REPO=${ORC_REPO:-${GIT_BASE}/openstack/os-refresh-config.git}
 ORC_BRANCH=${ORC_BRANCH:-master}
 
-# Tripleo elements for diskimage-builder images
-TIE_REPO=${TIE_REPO:-${GIT_BASE}/openstack/tripleo-image-elements.git}
-TIE_BRANCH=${TIE_BRANCH:-master}
-
 #################
 #
 #  3rd Party Components (non pip installable)

From cd8824ac04989e625d7f1ae442498383250932a9 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Wed, 4 Mar 2015 16:40:19 -0800
Subject: [PATCH 0405/3333] Pass PIP_FIND_LINKS through sudo to pip

We weren't actually using the wheels since PIP_FIND_LINKS environmental
variable was getting lost during the sudo

Change-Id: I4a89a70df63772a16ee5a8c3f1cd86e9c7bb5242
---
 inc/python | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/inc/python b/inc/python
index dfc4d63ca4..d72c3c94d7 100644
--- a/inc/python
+++ b/inc/python
@@ -97,6 +97,7 @@ function pip_install {
         http_proxy=${http_proxy:-} \
         https_proxy=${https_proxy:-} \
         no_proxy=${no_proxy:-} \
+        PIP_FIND_LINKS=$PIP_FIND_LINKS \
         $cmd_pip install \
         $@
 
@@ -108,6 +109,7 @@ function pip_install {
                 http_proxy=${http_proxy:-} \
                 https_proxy=${https_proxy:-} \
                 no_proxy=${no_proxy:-} \
+                PIP_FIND_LINKS=$PIP_FIND_LINKS \
                 $cmd_pip install \
                 -r $test_req
         fi

From 82450a5ebcc050bc4161d99dc5e6d41d7b289a40 Mon Sep 17 00:00:00 2001
From: Baohua Yang <yangbaohua@gmail.com>
Date: Thu, 5 Mar 2015 17:14:06 +0800
Subject: [PATCH 0406/3333] Fix typo of setings to settings

The typo happens at the head part, and only one time occurs.

Change-Id: Ic6d3d8e17447066fe5e8ab867b10516dc8f185cc
---
 samples/local.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/local.conf b/samples/local.conf
index 9e0b540250..e4052c21ac 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -3,7 +3,7 @@
 # NOTE: Copy this file to the root ``devstack`` directory for it to
 # work properly.
 
-# ``local.conf`` is a user-maintained setings file that is sourced from ``stackrc``.
+# ``local.conf`` is a user-maintained settings file that is sourced from ``stackrc``.
 # This gives it the ability to override any variables set in ``stackrc``.
 # Also, most of the settings in ``stack.sh`` are written to only be set if no
 # value has already been set; this lets ``local.conf`` effectively override the

From 1340ee72bfefa5a4fd0930cb90987275301280c8 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Fri, 6 Mar 2015 21:11:55 +0000
Subject: [PATCH 0407/3333] XenAPI: Default JEOS VM to only use 1GB RAM

While Devstack needs 4GB RAM (or more!) the JEOS
used as the base for the Devstack VM for XenServer
needs much less.  Allowing the initial install to
use 1GB means we have lower requirements overall

Change-Id: Iecaeeb4db0dffcc43c5532b5d57cb041d47047a6
---
 tools/xen/install_os_domU.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 082c27e8f3..b49347e09b 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -227,7 +227,7 @@ if [ -z "$templateuuid" ]; then
         -n "$UBUNTU_INST_BRIDGE_OR_NET_NAME" \
         -l "$GUEST_NAME"
 
-    set_vm_memory "$GUEST_NAME" "$OSDOMU_MEM_MB"
+    set_vm_memory "$GUEST_NAME" "1024"
 
     xe vm-start vm="$GUEST_NAME"
 

From 40ce320bb013f850a47d32781dd2f77a4d7927fa Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Fri, 6 Mar 2015 15:33:32 -0800
Subject: [PATCH 0408/3333] Temporarily stop building mumpy wheel

It turns out we aren't actually using this wheel since we are still
installing the deb python-numpy, and building numpy takes several
minutes which is a lot considering we do it on every single dsvm job.

So until we have wheel caching in place, and are actually using the
version we build ourselves, stop wasting time.

Change-Id: I7643c55598e5ecc29ea708c537818b37a8047d4b
---
 files/venv-requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
index 8417b92408..e473a2fe02 100644
--- a/files/venv-requirements.txt
+++ b/files/venv-requirements.txt
@@ -2,7 +2,7 @@ cryptography
 lxml
 MySQL-python
 netifaces
-numpy
+#numpy    # slowest wheel by far, stop building until we are actually using the output
 posix-ipc
 psycopg2
 pycrypto

From a3c103be7dd218168fcd9f4d78a113490902a26d Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Sun, 8 Mar 2015 15:13:23 +0900
Subject: [PATCH 0409/3333] neutron-nec: Vendor code split

Neutron NEC plugin support is configured using DevStack external
plugin mechanism. The following needs to be added in local.conf:

Q_PLUGIN=nec
enable_plugin networking-nec https://git.openstack.org/stackforge/networking-nec

Also removes lib/neutron_thirdparty/trema and files/debs/trema.
DevStack external plugin for Trema Sliceable Switch is available
and the following is needed to enable it in DevStack.

enable_plugin trema-devstack-plugin https://github.com/nec-openstack/trema-devstack-plugin

Change-Id: If983b986355fcc0118b6e0446b3b295f23b3c40e
---
 files/debs/trema             |  15 -----
 lib/neutron_plugins/nec      | 127 +----------------------------------
 lib/neutron_thirdparty/trema | 119 --------------------------------
 3 files changed, 3 insertions(+), 258 deletions(-)
 delete mode 100644 files/debs/trema
 delete mode 100644 lib/neutron_thirdparty/trema

diff --git a/files/debs/trema b/files/debs/trema
deleted file mode 100644
index f685ca53b4..0000000000
--- a/files/debs/trema
+++ /dev/null
@@ -1,15 +0,0 @@
-# Trema
-make
-ruby1.8
-rubygems1.8
-ruby1.8-dev
-libpcap-dev
-libsqlite3-dev
-libglib2.0-dev
-
-# Sliceable Switch
-sqlite3
-libdbi-perl
-libdbd-sqlite3-perl
-apache2
-libjson-perl
diff --git a/lib/neutron_plugins/nec b/lib/neutron_plugins/nec
index 3b1a25716a..9ea7338696 100644
--- a/lib/neutron_plugins/nec
+++ b/lib/neutron_plugins/nec
@@ -1,131 +1,10 @@
 #!/bin/bash
-#
-# Neutron NEC OpenFlow plugin
-# ---------------------------
 
-# Save trace setting
-NEC_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-# Configuration parameters
-OFC_HOST=${OFC_HOST:-127.0.0.1}
-OFC_PORT=${OFC_PORT:-8888}
-
-OFC_API_HOST=${OFC_API_HOST:-$OFC_HOST}
-OFC_API_PORT=${OFC_API_PORT:-$OFC_PORT}
-OFC_OFP_HOST=${OFC_OFP_HOST:-$OFC_HOST}
-OFC_OFP_PORT=${OFC_OFP_PORT:-6633}
-OFC_DRIVER=${OFC_DRIVER:-trema}
-OFC_RETRY_MAX=${OFC_RETRY_MAX:-0}
-OFC_RETRY_INTERVAL=${OFC_RETRY_INTERVAL:-1}
-
-# Main logic
-# ---------------------------
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-
-function neutron_plugin_create_nova_conf {
-    _neutron_ovs_base_configure_nova_vif_driver
-}
-
-function neutron_plugin_install_agent_packages {
-    # SKIP_OVS_INSTALL is useful when we want to use Open vSwitch whose
-    # version is different from the version provided by the distribution.
-    if [[ "$SKIP_OVS_INSTALL" = "True" ]]; then
-        echo "You need to install Open vSwitch manually."
-        return
-    fi
-    _neutron_ovs_base_install_agent_packages
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/nec
-    Q_PLUGIN_CONF_FILENAME=nec.ini
-    Q_PLUGIN_CLASS="neutron.plugins.nec.nec_plugin.NECPluginV2"
-}
-
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    :
-}
-
-function neutron_plugin_configure_l3_agent {
-    _neutron_ovs_base_configure_l3_agent
-}
-
-function _quantum_plugin_setup_bridge {
-    if [[ "$SKIP_OVS_BRIDGE_SETUP" = "True" ]]; then
-        return
-    fi
-    # Set up integration bridge
-    _neutron_ovs_base_setup_bridge $OVS_BRIDGE
-    # Generate datapath ID from HOST_IP
-    local dpid=$(printf "%07d%03d%03d%03d\n" ${HOST_IP//./ })
-    sudo ovs-vsctl --no-wait set Bridge $OVS_BRIDGE other-config:datapath-id=$dpid
-    sudo ovs-vsctl --no-wait set-fail-mode $OVS_BRIDGE secure
-    sudo ovs-vsctl --no-wait set-controller $OVS_BRIDGE tcp:$OFC_OFP_HOST:$OFC_OFP_PORT
-    if [ -n "$OVS_INTERFACE" ]; then
-        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_BRIDGE $OVS_INTERFACE
-    fi
-    _neutron_setup_ovs_tunnels $OVS_BRIDGE
-}
-
-function neutron_plugin_configure_plugin_agent {
-    _quantum_plugin_setup_bridge
-
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-nec-agent"
-
-    _neutron_ovs_base_configure_firewall_driver
-}
-
-function neutron_plugin_configure_service {
-    iniset $NEUTRON_CONF DEFAULT api_extensions_path neutron/plugins/nec/extensions/
-    iniset /$Q_PLUGIN_CONF_FILE ofc host $OFC_API_HOST
-    iniset /$Q_PLUGIN_CONF_FILE ofc port $OFC_API_PORT
-    iniset /$Q_PLUGIN_CONF_FILE ofc driver $OFC_DRIVER
-    iniset /$Q_PLUGIN_CONF_FILE ofc api_retry_max OFC_RETRY_MAX
-    iniset /$Q_PLUGIN_CONF_FILE ofc api_retry_interval OFC_RETRY_INTERVAL
-
-    _neutron_ovs_base_configure_firewall_driver
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
-    iniset $conf_file DEFAULT ovs_use_veth True
-}
-
-# Utility functions
-# ---------------------------
-
-# Setup OVS tunnel manually
-function _neutron_setup_ovs_tunnels {
-    local bridge=$1
-    local id=0
-    GRE_LOCAL_IP=${GRE_LOCAL_IP:-$HOST_IP}
-    if [ -n "$GRE_REMOTE_IPS" ]; then
-        for ip in ${GRE_REMOTE_IPS//:/ }; do
-            if [[ "$ip" == "$GRE_LOCAL_IP" ]]; then
-                continue
-            fi
-            sudo ovs-vsctl --no-wait add-port $bridge gre$id -- \
-                set Interface gre$id type=gre options:remote_ip=$ip
-            id=`expr $id + 1`
-        done
-    fi
-}
+# This file is needed so Q_PLUGIN=nec will work.
 
+# FIXME(amotoki): This function should not be here, but unfortunately
+# devstack calls it before the external plugins are fetched
 function has_neutron_plugin_security_group {
     # 0 means True here
     return 0
 }
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
-}
-
-# Restore xtrace
-$NEC_XTRACE
diff --git a/lib/neutron_thirdparty/trema b/lib/neutron_thirdparty/trema
deleted file mode 100644
index 075f013ded..0000000000
--- a/lib/neutron_thirdparty/trema
+++ /dev/null
@@ -1,119 +0,0 @@
-#!/bin/bash
-#
-# Trema Sliceable Switch
-# ----------------------
-
-# Trema is a Full-Stack OpenFlow Framework in Ruby and C
-# https://github.com/trema/trema
-#
-# Trema Sliceable Switch is an OpenFlow controller which provides
-# virtual layer-2 network slices.
-# https://github.com/trema/apps/wiki
-
-# Trema Sliceable Switch (OpenFlow Controller)
-TREMA_APPS_REPO=${TREMA_APPS_REPO:-https://github.com/trema/apps.git}
-TREMA_APPS_BRANCH=${TREMA_APPS_BRANCH:-master}
-
-# Save trace setting
-TREMA3_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-TREMA_DIR=${TREMA_DIR:-$DEST/trema}
-TREMA_SS_DIR="$TREMA_DIR/apps/sliceable_switch"
-
-TREMA_DATA_DIR=${TREMA_DATA_DIR:-$DATA_DIR/trema}
-TREMA_SS_ETC_DIR=$TREMA_DATA_DIR/sliceable_switch/etc
-TREMA_SS_DB_DIR=$TREMA_DATA_DIR/sliceable_switch/db
-TREMA_SS_SCRIPT_DIR=$TREMA_DATA_DIR/sliceable_switch/script
-TREMA_TMP_DIR=$TREMA_DATA_DIR/trema
-
-TREMA_LOG_LEVEL=${TREMA_LOG_LEVEL:-info}
-
-TREMA_SS_CONFIG=$TREMA_SS_ETC_DIR/sliceable.conf
-TREMA_SS_APACHE_CONFIG=$(apache_site_config_for sliceable_switch)
-
-# configure_trema - Set config files, create data dirs, etc
-function configure_trema {
-    # prepare dir
-    for d in $TREMA_SS_ETC_DIR $TREMA_SS_DB_DIR $TREMA_SS_SCRIPT_DIR; do
-        sudo mkdir -p $d
-        sudo chown -R `whoami` $d
-    done
-    sudo mkdir -p $TREMA_TMP_DIR
-}
-
-# init_trema - Initialize databases, etc.
-function init_trema {
-    local _pwd=$(pwd)
-
-    # Initialize databases for Sliceable Switch
-    cd $TREMA_SS_DIR
-    rm -f filter.db slice.db
-    ./create_tables.sh
-    mv filter.db slice.db $TREMA_SS_DB_DIR
-    # Make sure that apache cgi has write access to the databases
-    sudo chown -R www-data.www-data $TREMA_SS_DB_DIR
-    cd $_pwd
-
-    # Setup HTTP Server for sliceable_switch
-    cp $TREMA_SS_DIR/{Slice.pm,Filter.pm,config.cgi} $TREMA_SS_SCRIPT_DIR
-    sed -i -e "s|/home/sliceable_switch/db|$TREMA_SS_DB_DIR|" \
-        $TREMA_SS_SCRIPT_DIR/config.cgi
-
-    sudo cp $TREMA_SS_DIR/apache/sliceable_switch $TREMA_SS_APACHE_CONFIG
-    sudo sed -i -e "s|/home/sliceable_switch/script|$TREMA_SS_SCRIPT_DIR|" \
-        $TREMA_SS_APACHE_CONFIG
-    # TODO(gabriel-bezerra): use some function from lib/apache to enable these modules
-    sudo a2enmod rewrite actions
-    enable_apache_site sliceable_switch
-
-    cp $TREMA_SS_DIR/sliceable_switch_null.conf $TREMA_SS_CONFIG
-    sed -i -e "s|^\$apps_dir.*$|\$apps_dir = \"$TREMA_DIR/apps\"|" \
-        -e "s|^\$db_dir.*$|\$db_dir = \"$TREMA_SS_DB_DIR\"|" \
-        $TREMA_SS_CONFIG
-}
-
-function gem_install {
-    [[ "$OFFLINE" = "True" ]] && return
-    [ -n "$RUBYGEMS_CMD" ] || get_gem_command
-
-    local pkg=$1
-    $RUBYGEMS_CMD list | grep "^${pkg} " && return
-    sudo $RUBYGEMS_CMD install $pkg
-}
-
-function get_gem_command {
-    # Trema requires ruby 1.8, so gem1.8 is checked first
-    RUBYGEMS_CMD=$(which gem1.8 || which gem)
-    if [ -z "$RUBYGEMS_CMD" ]; then
-        echo "Warning: ruby gems command not found."
-    fi
-}
-
-function install_trema {
-    # Trema
-    gem_install trema
-    # Sliceable Switch
-    git_clone $TREMA_APPS_REPO $TREMA_DIR/apps $TREMA_APPS_BRANCH
-    make -C $TREMA_DIR/apps/topology
-    make -C $TREMA_DIR/apps/flow_manager
-    make -C $TREMA_DIR/apps/sliceable_switch
-}
-
-function start_trema {
-    restart_apache_server
-
-    sudo LOGGING_LEVEL=$TREMA_LOG_LEVEL TREMA_TMP=$TREMA_TMP_DIR \
-        trema run -d -c $TREMA_SS_CONFIG
-}
-
-function stop_trema {
-    sudo TREMA_TMP=$TREMA_TMP_DIR trema killall
-}
-
-function check_trema {
-    :
-}
-
-# Restore xtrace
-$TREMA3_XTRACE

From dc757dd8506b9524defcffcf68dbc443380926a9 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Mon, 9 Mar 2015 14:48:09 +1100
Subject: [PATCH 0410/3333] Configure neutron->nova with identity v3

Use authentication plugins for neutron -> nova communications and
default to using the password plugin, which defaults to using the
v3 Identity API.

Neutron config change: 13427a40768f1a4646520c6b7e3e8c988ce6e18c
Change-Id: If152b97f940286ed08767225b13dedf6ef8c2342
---
 lib/neutron | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a7aabc5909..e41abafda9 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -871,7 +871,7 @@ function _configure_neutron_common {
     fi
 
     if is_ssl_enabled_service "nova"; then
-        iniset $NEUTRON_CONF DEFAULT nova_ca_certificates_file "$SSL_BUNDLE_FILE"
+        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
     fi
 
     if is_ssl_enabled_service "neutron"; then
@@ -1045,13 +1045,15 @@ function _configure_neutron_service {
     # Configuration for neutron notifations to nova.
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
-    iniset $NEUTRON_CONF DEFAULT nova_url "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2"
-    iniset $NEUTRON_CONF DEFAULT nova_region_name $REGION_NAME
-    iniset $NEUTRON_CONF DEFAULT nova_admin_username nova
-    iniset $NEUTRON_CONF DEFAULT nova_admin_password $SERVICE_PASSWORD
-    ADMIN_TENANT_ID=$(openstack project list | awk "/ service / { print \$2 }")
-    iniset $NEUTRON_CONF DEFAULT nova_admin_tenant_id $ADMIN_TENANT_ID
-    iniset $NEUTRON_CONF DEFAULT nova_admin_auth_url  "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
+
+    iniset $NEUTRON_CONF nova auth_plugin password
+    iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
+    iniset $NEUTRON_CONF nova username nova
+    iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
+    iniset $NEUTRON_CONF nova user_domain_id default
+    iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
+    iniset $NEUTRON_CONF nova project_domain_id default
+    iniset $NEUTRON_CONF nova region_name $REGION_NAME
 
     # Configure plugin
     neutron_plugin_configure_service

From fbb3e773f017e90286f7e988c4167c3758edba45 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 3 Mar 2015 15:08:28 +0100
Subject: [PATCH 0411/3333] Remove the kesytone admin token from swift

The keystone admin token supposed to be used only
for setting up keystone and it should not be used
in any other service config.

Change-Id: Iaa9be1878e89a6bc3a84a0c57fc6f5cecc371d2f
---
 lib/swift | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/swift b/lib/swift
index 8a96615d01..4a63500b54 100644
--- a/lib/swift
+++ b/lib/swift
@@ -441,16 +441,15 @@ function configure_swift {
 
     if is_service_enabled swift3; then
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
-# NOTE(chmou): s3token middleware is not updated yet to use only
-# username and password.
 [filter:s3token]
 paste.filter_factory = keystoneclient.middleware.s3_token:filter_factory
 auth_port = ${KEYSTONE_AUTH_PORT}
 auth_host = ${KEYSTONE_AUTH_HOST}
 auth_protocol = ${KEYSTONE_AUTH_PROTOCOL}
 cafile = ${SSL_BUNDLE_FILE}
-auth_token = ${SERVICE_TOKEN}
-admin_token = ${SERVICE_TOKEN}
+admin_user = swift
+admin_tenant_name = ${SERVICE_TENANT_NAME}
+admin_password = ${SERVICE_PASSWORD}
 
 [filter:swift3]
 use = egg:swift3#swift3

From bf2ad7015d068f9a85c01813cea0aa79143b1d0f Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Mon, 9 Mar 2015 15:16:10 -0500
Subject: [PATCH 0412/3333] Move configuration functions into inc/*

* config/INI functions from functions-common to to inc/ini-config
* local.conf meta-config functions from lib/config to inc/meta-config

Change-Id: I00fab724075a693529273878875cfd292d00b18a
---
 doc/source/index.rst                          |   7 +-
 functions                                     |   1 +
 functions-common                              | 199 ----------------
 inc/ini-config                                | 223 ++++++++++++++++++
 lib/config => inc/meta-config                 |  10 +-
 stack.sh                                      |   2 +-
 tests/{test_ini.sh => test_ini_config.sh}     |   4 +-
 tests/{test_config.sh => test_meta_config.sh} |   6 +-
 tools/build_docs.sh                           |   2 +-
 tox.ini                                       |   1 +
 10 files changed, 243 insertions(+), 212 deletions(-)
 create mode 100644 inc/ini-config
 rename lib/config => inc/meta-config (96%)
 rename tests/{test_ini.sh => test_ini_config.sh} (99%)
 rename tests/{test_config.sh => test_meta_config.sh} (99%)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index cfde99132d..bac593de03 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -156,7 +156,6 @@ Scripts
 * `lib/ceilometer <lib/ceilometer.html>`__
 * `lib/ceph <lib/ceph.html>`__
 * `lib/cinder <lib/cinder.html>`__
-* `lib/config <lib/config.html>`__
 * `lib/database <lib/database.html>`__
 * `lib/dstat <lib/dstat.html>`__
 * `lib/glance <lib/glance.html>`__
@@ -188,6 +187,12 @@ Scripts
 * `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
 
+* `inc/ini-config <inc/ini-config.html>`__
+* `inc/meta-config <inc/meta-config.html>`__
+* `inc/python <inc/python.html>`__
+
+* `pkg/elasticsearch.sh <pkg/elasticsearch.sh.html>`_
+
 Configuration
 -------------
 
diff --git a/functions b/functions
index 79b2b37b4e..9adbfe7cf6 100644
--- a/functions
+++ b/functions
@@ -13,6 +13,7 @@
 # Include the common functions
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source ${FUNC_DIR}/functions-common
+source ${FUNC_DIR}/inc/ini-config
 source ${FUNC_DIR}/inc/python
 
 # Save trace setting
diff --git a/functions-common b/functions-common
index df69cbad16..4739e42e90 100644
--- a/functions-common
+++ b/functions-common
@@ -43,197 +43,6 @@ declare -A GITDIR
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
-# Config Functions
-# ================
-
-# Append a new option in an ini file without replacing the old value
-# iniadd config-file section option value1 value2 value3 ...
-function iniadd {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    shift 3
-
-    local values="$(iniget_multiline $file $section $option) $@"
-    iniset_multiline $file $section $option $values
-    $xtrace
-}
-
-# Comment an option in an INI file
-# inicomment config-file section option
-function inicomment {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-
-    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|^\($option[ \t]*=.*$\)|#\1|" "$file"
-    $xtrace
-}
-
-# Get an option from an INI file
-# iniget config-file section option
-function iniget {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    local line
-
-    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
-    echo ${line#*=}
-    $xtrace
-}
-
-# Get a multiple line option from an INI file
-# iniget_multiline config-file section option
-function iniget_multiline {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    local values
-
-    values=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { s/^$option[ \t]*=[ \t]*//gp; }" "$file")
-    echo ${values}
-    $xtrace
-}
-
-# Determinate is the given option present in the INI file
-# ini_has_option config-file section option
-function ini_has_option {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    local line
-
-    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
-    $xtrace
-    [ -n "$line" ]
-}
-
-# Add another config line for a multi-line option.
-# It's normally called after iniset of the same option and assumes
-# that the section already exists.
-#
-# Note that iniset_multiline requires all the 'lines' to be supplied
-# in the argument list. Doing that will cause incorrect configuration
-# if spaces are used in the config values.
-#
-# iniadd_literal config-file section option value
-function iniadd_literal {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    local value=$4
-
-    [[ -z $section || -z $option ]] && return
-
-    # Add it
-    sed -i -e "/^\[$section\]/ a\\
-$option = $value
-" "$file"
-
-    $xtrace
-}
-
-function inidelete {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-
-    [[ -z $section || -z $option ]] && return
-
-    # Remove old values
-    sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
-
-    $xtrace
-}
-
-# Set an option in an INI file
-# iniset config-file section option value
-function iniset {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    local value=$4
-
-    [[ -z $section || -z $option ]] && return
-
-    if ! grep -q "^\[$section\]" "$file" 2>/dev/null; then
-        # Add section at the end
-        echo -e "\n[$section]" >>"$file"
-    fi
-    if ! ini_has_option "$file" "$section" "$option"; then
-        # Add it
-        sed -i -e "/^\[$section\]/ a\\
-$option = $value
-" "$file"
-    else
-        local sep=$(echo -ne "\x01")
-        # Replace it
-        sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
-    fi
-    $xtrace
-}
-
-# Set a multiple line option in an INI file
-# iniset_multiline config-file section option value1 value2 valu3 ...
-function iniset_multiline {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-
-    shift 3
-    local values
-    for v in $@; do
-        # The later sed command inserts each new value in the line next to
-        # the section identifier, which causes the values to be inserted in
-        # the reverse order. Do a reverse here to keep the original order.
-        values="$v ${values}"
-    done
-    if ! grep -q "^\[$section\]" "$file"; then
-        # Add section at the end
-        echo -e "\n[$section]" >>"$file"
-    else
-        # Remove old values
-        sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
-    fi
-    # Add new ones
-    for v in $values; do
-        sed -i -e "/^\[$section\]/ a\\
-$option = $v
-" "$file"
-    done
-    $xtrace
-}
-
-# Uncomment an option in an INI file
-# iniuncomment config-file section option
-function iniuncomment {
-    local xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-    local file=$1
-    local section=$2
-    local option=$3
-    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|[^ \t]*#[ \t]*\($option[ \t]*=.*$\)|\1|" "$file"
-    $xtrace
-}
 
 # Normalize config values to True or False
 # Accepts as False: 0 no No NO false False FALSE
@@ -253,14 +62,6 @@ function trueorfalse {
     $xtrace
 }
 
-function isset {
-    nounset=$(set +o | grep nounset)
-    set +o nounset
-    [[ -n "${!1+x}" ]]
-    result=$?
-    $nounset
-    return $result
-}
 
 # Control Functions
 # =================
diff --git a/inc/ini-config b/inc/ini-config
new file mode 100644
index 0000000000..0d6d169f8b
--- /dev/null
+++ b/inc/ini-config
@@ -0,0 +1,223 @@
+#!/bin/bash
+#
+# **inc/ini-config** - Configuration/INI functions
+#
+# Support for manipulating INI-style configuration files
+#
+# These functions have no external dependencies and no side-effects
+
+# Save trace setting
+INC_CONF_TRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Config Functions
+# ================
+
+# Append a new option in an ini file without replacing the old value
+# iniadd config-file section option value1 value2 value3 ...
+function iniadd {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    shift 3
+
+    local values="$(iniget_multiline $file $section $option) $@"
+    iniset_multiline $file $section $option $values
+    $xtrace
+}
+
+# Comment an option in an INI file
+# inicomment config-file section option
+function inicomment {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+
+    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|^\($option[ \t]*=.*$\)|#\1|" "$file"
+    $xtrace
+}
+
+# Get an option from an INI file
+# iniget config-file section option
+function iniget {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    local line
+
+    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
+    echo ${line#*=}
+    $xtrace
+}
+
+# Get a multiple line option from an INI file
+# iniget_multiline config-file section option
+function iniget_multiline {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    local values
+
+    values=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { s/^$option[ \t]*=[ \t]*//gp; }" "$file")
+    echo ${values}
+    $xtrace
+}
+
+# Determinate is the given option present in the INI file
+# ini_has_option config-file section option
+function ini_has_option {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    local line
+
+    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
+    $xtrace
+    [ -n "$line" ]
+}
+
+# Add another config line for a multi-line option.
+# It's normally called after iniset of the same option and assumes
+# that the section already exists.
+#
+# Note that iniset_multiline requires all the 'lines' to be supplied
+# in the argument list. Doing that will cause incorrect configuration
+# if spaces are used in the config values.
+#
+# iniadd_literal config-file section option value
+function iniadd_literal {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    local value=$4
+
+    [[ -z $section || -z $option ]] && return
+
+    # Add it
+    sed -i -e "/^\[$section\]/ a\\
+$option = $value
+" "$file"
+
+    $xtrace
+}
+
+# Remove an option from an INI file
+# inidelete config-file section option
+function inidelete {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+
+    [[ -z $section || -z $option ]] && return
+
+    # Remove old values
+    sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
+
+    $xtrace
+}
+
+# Set an option in an INI file
+# iniset config-file section option value
+function iniset {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    local value=$4
+
+    [[ -z $section || -z $option ]] && return
+
+    if ! grep -q "^\[$section\]" "$file" 2>/dev/null; then
+        # Add section at the end
+        echo -e "\n[$section]" >>"$file"
+    fi
+    if ! ini_has_option "$file" "$section" "$option"; then
+        # Add it
+        sed -i -e "/^\[$section\]/ a\\
+$option = $value
+" "$file"
+    else
+        local sep=$(echo -ne "\x01")
+        # Replace it
+        sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
+    fi
+    $xtrace
+}
+
+# Set a multiple line option in an INI file
+# iniset_multiline config-file section option value1 value2 valu3 ...
+function iniset_multiline {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+
+    shift 3
+    local values
+    for v in $@; do
+        # The later sed command inserts each new value in the line next to
+        # the section identifier, which causes the values to be inserted in
+        # the reverse order. Do a reverse here to keep the original order.
+        values="$v ${values}"
+    done
+    if ! grep -q "^\[$section\]" "$file"; then
+        # Add section at the end
+        echo -e "\n[$section]" >>"$file"
+    else
+        # Remove old values
+        sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
+    fi
+    # Add new ones
+    for v in $values; do
+        sed -i -e "/^\[$section\]/ a\\
+$option = $v
+" "$file"
+    done
+    $xtrace
+}
+
+# Uncomment an option in an INI file
+# iniuncomment config-file section option
+function iniuncomment {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+    local section=$2
+    local option=$3
+    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|[^ \t]*#[ \t]*\($option[ \t]*=.*$\)|\1|" "$file"
+    $xtrace
+}
+
+function isset {
+    nounset=$(set +o | grep nounset)
+    set +o nounset
+    [[ -n "${!1+x}" ]]
+    result=$?
+    $nounset
+    return $result
+}
+
+
+# Restore xtrace
+$INC_CONF_TRACE
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/config b/inc/meta-config
similarity index 96%
rename from lib/config
rename to inc/meta-config
index 31c6fa6e57..c8789bf816 100644
--- a/lib/config
+++ b/inc/meta-config
@@ -1,7 +1,9 @@
 #!/bin/bash
 #
-# lib/config - Configuration file manipulation functions
-
+# **lib/meta-config** - Configuration file manipulation functions
+#
+# Support for DevStack's local.conf meta-config sections
+#
 # These functions have no external dependencies and the following side-effects:
 #
 # CONFIG_AWK_CMD is defined, default is ``awk``
@@ -18,7 +20,7 @@
 # file-name is the destination of the config file
 
 # Save trace setting
-C_XTRACE=$(set +o | grep xtrace)
+INC_META_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -176,7 +178,7 @@ function merge_config_group {
 
 
 # Restore xtrace
-$C_XTRACE
+$INC_META_XTRACE
 
 # Local variables:
 # mode: shell-script
diff --git a/stack.sh b/stack.sh
index bf9fc0118e..2060f2d65a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -92,7 +92,7 @@ LAST_SPINNER_PID=""
 source $TOP_DIR/functions
 
 # Import config functions
-source $TOP_DIR/lib/config
+source $TOP_DIR/inc/meta-config
 
 # Import 'public' stack.sh functions
 source $TOP_DIR/lib/stack
diff --git a/tests/test_ini.sh b/tests/test_ini_config.sh
similarity index 99%
rename from tests/test_ini.sh
rename to tests/test_ini_config.sh
index 106cc9507f..4a0ae33aeb 100755
--- a/tests/test_ini.sh
+++ b/tests/test_ini_config.sh
@@ -4,8 +4,8 @@
 
 TOP=$(cd $(dirname "$0")/.. && pwd)
 
-# Import common functions
-source $TOP/functions
+# Import config functions
+source $TOP/inc/ini-config
 
 
 echo "Testing INI functions"
diff --git a/tests/test_config.sh b/tests/test_meta_config.sh
similarity index 99%
rename from tests/test_config.sh
rename to tests/test_meta_config.sh
index 3252104bf1..9d65280b8c 100755
--- a/tests/test_config.sh
+++ b/tests/test_meta_config.sh
@@ -4,11 +4,9 @@
 
 TOP=$(cd $(dirname "$0")/.. && pwd)
 
-# Import common functions
-source $TOP/functions
-
 # Import config functions
-source $TOP/lib/config
+source $TOP/inc/ini-config
+source $TOP/inc/meta-config
 
 # check_result() tests and reports the result values
 # check_result "actual" "expected"
diff --git a/tools/build_docs.sh b/tools/build_docs.sh
index 929d1e0e6c..2aa0a0ac04 100755
--- a/tools/build_docs.sh
+++ b/tools/build_docs.sh
@@ -81,7 +81,7 @@ for f in $(find . -name .git -prune -o \( -type f -name \*.sh -not -path \*shocc
     mkdir -p $FQ_HTML_BUILD/`dirname $f`;
     $SHOCCO $f > $FQ_HTML_BUILD/$f.html
 done
-for f in $(find functions functions-common lib samples -type f -name \*); do
+for f in $(find functions functions-common inc lib pkg samples -type f -name \*); do
     echo $f
     FILES+="$f "
     mkdir -p $FQ_HTML_BUILD/`dirname $f`;
diff --git a/tox.ini b/tox.ini
index a958ae7ba4..bc84928d95 100644
--- a/tox.ini
+++ b/tox.ini
@@ -20,6 +20,7 @@ commands = bash -c "find {toxinidir}          \
           -name \*.sh -or                     \
           -name \*rc -or                      \
           -name functions\* -or               \
+          -wholename \*/inc/\*                \ # /inc files and
           -wholename \*/lib/\*                \ # /lib files are shell, but
          \)                                   \ #   have no extension
          -print0 | xargs -0 bashate -v"

From 4de0f1cd0ba1541f49eb54a68b32ec7f973c274b Mon Sep 17 00:00:00 2001
From: Takashi NATSUME <natsume.takashi@lab.ntt.co.jp>
Date: Tue, 10 Mar 2015 14:51:39 +0900
Subject: [PATCH 0413/3333] Fix typo in devstack-with-nested-kvm.rst

'succesfully' has been fixed to 'successfully'.

Change-Id: Ib14b1b8cb612aba759f3fe8b94d35cf47eb9b339
Closes-Bug: #1430149
---
 doc/source/guides/devstack-with-nested-kvm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 58ec3d3672..610300be52 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -129,7 +129,7 @@ DevStack's ``local.conf``:
     LIBVIRT_TYPE=kvm
 
 
-Once DevStack is configured succesfully, verify if the Nova instances
+Once DevStack is configured successfully, verify if the Nova instances
 are using KVM by noticing the QEMU CLI invoked by Nova is using the
 parameter `accel=kvm`, e.g.:
 

From 679f395fbbae68b4dfee0edbddff646ff75b5a0d Mon Sep 17 00:00:00 2001
From: Ethan Lynn <xjunlin@cn.ibm.com>
Date: Mon, 9 Mar 2015 23:45:18 +0800
Subject: [PATCH 0414/3333] Set os_region_name for cinder

Region name should be set to nova.conf and cinder.conf so that
cinder volume can work in multiregion env.

Closes-Bug: #1429738
Change-Id: Ib20911c24d8daabc07e6515f4a23a745d77593ff
---
 lib/cinder | 2 ++
 lib/nova   | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 0d157dd78e..19240eec60 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -242,6 +242,8 @@ function configure_cinder {
     # supported.
     iniset $CINDER_CONF DEFAULT enable_v1_api true
 
+    iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index e9e78c7bc4..199daeea3d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -544,6 +544,8 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT ec2_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"
 
+    iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
+
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
         iniset $NOVA_CONF libvirt images_type "lvm"
         iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME

From 360839e0addbd2692ee34333ac06d957cf60b780 Mon Sep 17 00:00:00 2001
From: Ken Chen <ken.chen@intel.com>
Date: Fri, 27 Feb 2015 14:12:23 +0800
Subject: [PATCH 0415/3333] Remove setting use_floating_ips values

We remove the code to set use_floating_ips. In old code it was set
false if we do not use neutron. However, we cannot deploy clusters
with floating ips by that. So we just use the default value, which
is set True in Sahara.

Closes-Bug: #1426226
Change-Id: Idfcdc5ab776681ddc740dc12035e04da349ea089
---
 lib/sahara | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/sahara b/lib/sahara
index 9b2e9c406d..521b19a4a1 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -139,14 +139,12 @@ function configure_sahara {
 
     if is_service_enabled neutron; then
         iniset $SAHARA_CONF_FILE DEFAULT use_neutron true
-        iniset $SAHARA_CONF_FILE DEFAULT use_floating_ips true
 
         if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
             iniset $SAHARA_CONF_FILE neutron ca_file $SSL_BUNDLE_FILE
         fi
     else
         iniset $SAHARA_CONF_FILE DEFAULT use_neutron false
-        iniset $SAHARA_CONF_FILE DEFAULT use_floating_ips false
     fi
 
     if is_service_enabled heat; then

From db1152c96e8e5a4ce599677f9ee3d556f925d734 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 13 Jan 2015 10:18:49 +1100
Subject: [PATCH 0416/3333] Document use of plugins for gate jobs

Document use of plugins for gate jobs.  See also [1]

[1] http://lists.openstack.org/pipermail/openstack-dev/2015-January/054291.html

Change-Id: I9ed82f5d195511fb612517745f93f2a54475091a
---
 doc/source/plugins.rst | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index d1f73771a3..0217d09457 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -131,6 +131,31 @@ An example would be as follows::
 
   enable_plugin glusterfs https://github.com/sdague/devstack-plugins glusterfs
 
+Plugins for gate jobs
+---------------------
+
+All OpenStack plugins that wish to be used as gate jobs need to exist
+in OpenStack's gerrit. Both ``openstack`` namespace and ``stackforge``
+namespace are fine. This allows testing of the plugin as well as
+provides network isolation against upstream git repository failures
+(which we see often enough to be an issue).
+
+Ideally plugins will be implemented as ``devstack`` directory inside
+the project they are testing. For example, the stackforge/ec2-api
+project has it's pluggin support in it's tree.
+
+In the cases where there is no "project tree" per say (like
+integrating a backend storage configuration such as ceph or glusterfs)
+it's also allowed to build a dedicated
+``stackforge/devstack-plugin-FOO`` project to house the plugin.
+
+Note jobs must not require cloning of repositories during tests.
+Tests must list their repository in the ``PROJECTS`` variable for
+`devstack-gate
+<https://git.openstack.org/cgit/openstack-infra/devstack-gate/tree/devstack-vm-gate-wrap.sh>`_
+for the repository to be available to the test.  Further information
+is provided in the project creator's guide.
+
 Hypervisor
 ==========
 

From 7c4ce9edbad6f3c33469d45be832ebea4a46ff70 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Mar 2015 11:32:26 +1100
Subject: [PATCH 0417/3333] Check for new versions of get-pip.py

People can leave their devstack installs around for a long time, and
in the mean time new versions of pip can be released.

The current check does not download a new version if an old one
exists.  We want to check for new versions, but we also don't want the
gate jobs trying this sometimes unreliable fetch.

So add a flag-file that tells devstack if it downloaded get-pip.py
originally.  If so, on each run check for a new version using curl's
"-z" flag to request only files modified since the file's timestamp.

Change-Id: I91734528f02deafabf3d18d968c3abd749751199
Closes-Bug: #1429943
---
 .gitignore           |  2 +-
 tools/install_pip.sh | 16 ++++++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 67ab722190..c6900c881c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,7 +14,7 @@ files/*.gz
 files/*.qcow2
 files/images
 files/pip-*
-files/get-pip.py
+files/get-pip.py*
 local.conf
 local.sh
 localrc
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 73d0947320..b7b40c7486 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -42,9 +42,21 @@ function get_versions {
 
 
 function install_get_pip {
-    if [[ ! -r $LOCAL_PIP ]]; then
-        curl --retry 6 --retry-delay 5 -o $LOCAL_PIP $PIP_GET_PIP_URL || \
+    # the openstack gate and others put a cached version of get-pip.py
+    # for this to find, explicitly to avoid download issues.
+    #
+    # However, if devstack *did* download the file, we want to check
+    # for updates; people can leave thier stacks around for a long
+    # time and in the mean-time pip might get upgraded.
+    #
+    # Thus we use curl's "-z" feature to always check the modified
+    # since and only download if a new version is out -- but only if
+    # it seems we downloaded the file originally.
+    if [[ ! -r $LOCAL_PIP || -r $LOCAL_PIP.downloaded ]]; then
+        curl --retry 6 --retry-delay 5 \
+            -z $LOCAL_PIP -o $LOCAL_PIP $PIP_GET_PIP_URL || \
             die $LINENO "Download of get-pip.py failed"
+        touch $LOCAL_PIP.downloaded
     fi
     sudo -H -E python $LOCAL_PIP
 }

From a72a393d658216ec75a59ad5a788e2504fee4b53 Mon Sep 17 00:00:00 2001
From: kieleth <luis.guzman@ammeon.com>
Date: Tue, 10 Mar 2015 08:47:05 -0700
Subject: [PATCH 0418/3333] Add sudo to yum example

Add sudo to yum example so following along with copy-paste works

Change-Id: I5e64b3d751b55989a353bfe2bb691ea6e51690e3
---
 doc/source/guides/single-machine.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 70287a9037..236ece9c01 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -67,7 +67,7 @@ We'll grab the latest version of DevStack via https:
 
 ::
 
-    sudo apt-get install git -y || yum install -y git
+    sudo apt-get install git -y || sudo yum install -y git
     git clone https://git.openstack.org/openstack-dev/devstack
     cd devstack
 

From b0595235a2374451c3f899fb893ad989a74b04d1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 11 Mar 2015 12:04:49 +1100
Subject: [PATCH 0419/3333] Don't use packaged unittest2

Let pip install unittest2; pip installation can conflict with the
packaged version.

Change-Id: Iec9b35174ac68ebf713cd7462d7b5a82583d6e22
Partial-Bug: #1430592
---
 files/rpms-suse/general | 1 -
 files/rpms/general      | 1 -
 2 files changed, 2 deletions(-)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 7f4bbfb1b6..63cf14bd5b 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -16,7 +16,6 @@ openssl
 psmisc
 python-cmd2 # dist:opensuse-12.3
 python-pylint
-python-unittest2
 screen
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index cf406325e7..eac4ec36a7 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -14,7 +14,6 @@ libxml2-devel
 libxslt-devel
 psmisc
 pylint
-python-unittest2
 python-devel
 screen
 tar

From 4d74e0f49515e23668a9dd955f30939cd03f94b2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 11 Mar 2015 09:45:59 +1100
Subject: [PATCH 0420/3333] Fail if run in POSIX compatability mode

This is mostly to detect if someone is running the script with "sh
./stack.sh" where sh is the bash-symlink that puts it in POSIX mode
(this can be invoked in other ways, but much less common).

In this case POSIXLY_CORRECT is set; so if we see that, bail out early
before we start hitting syntax errors.

Closes-Bug: #1430535
Change-Id: I7bbc4b0f656df9f6d9da2243c8caeb42d30ace95
---
 stack.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/stack.sh b/stack.sh
index bf9fc0118e..36a9ed46d2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -21,6 +21,13 @@
 
 # Learn more and get the most recent version at http://devstack.org
 
+# check if someone has invoked with "sh"
+if [[ "${POSIXLY_CORRECT}" == "y" ]]; then
+    echo "You appear to be running bash in POSIX compatability mode."
+    echo "devstack uses bash features. \"./stack.sh\" should do the right thing"
+    exit 1
+fi
+
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 

From 10a8c88cccc43a8a9222b5e414198b105b190a67 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Wed, 11 Mar 2015 16:41:32 +0900
Subject: [PATCH 0421/3333] README.md: Correct the defaults of some of
 Q_ML2_PLUGIN variables

Also, tweak Q_AGENT description and note its default.

Change-Id: Ie24d14f58c09ccd375fd981683dba2efd5211f24
---
 README.md | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 206ffe098b..2e269762f7 100644
--- a/README.md
+++ b/README.md
@@ -249,14 +249,17 @@ To change this, set the `Q_AGENT` variable to the agent you want to run
     Variable Name                    Notes
     ----------------------------------------------------------------------------
     Q_AGENT                          This specifies which agent to run with the
-                                     ML2 Plugin (either `openvswitch` or `linuxbridge`).
+                                     ML2 Plugin (Typically either `openvswitch`
+                                     or `linuxbridge`).
+                                     Defaults to `openvswitch`.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS   The ML2 MechanismDrivers to load. The default
-                                     is none. Note, ML2 will work with the OVS
-                                     and LinuxBridge agents by default.
+                                     is `openvswitch,linuxbridge`.
     Q_ML2_PLUGIN_TYPE_DRIVERS        The ML2 TypeDrivers to load. Defaults to
                                      all available TypeDrivers.
-    Q_ML2_PLUGIN_GRE_TYPE_OPTIONS    GRE TypeDriver options. Defaults to none.
-    Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS  VXLAN TypeDriver options. Defaults to none.
+    Q_ML2_PLUGIN_GRE_TYPE_OPTIONS    GRE TypeDriver options. Defaults to
+                                     `tunnel_id_ranges=1:1000'.
+    Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS  VXLAN TypeDriver options. Defaults to
+                                     `vni_ranges=1001:2000`
     Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS   VLAN TypeDriver options. Defaults to none.
 
 # Heat

From d28ea9cbcb1db93d6ae925ee6efc8a032a319816 Mon Sep 17 00:00:00 2001
From: Christian Berendt <berendt@b1-systems.de>
Date: Wed, 11 Mar 2015 18:53:33 +0100
Subject: [PATCH 0422/3333] Add package mongodb to files/rpms/zaqar-server

The command mongo, used in lib/zaqar, is part of the package mongodb.
At the moment only mongodb-server is listed in files/rpms/zaqar-server,
mongodb has to be added there.

Change-Id: I60edeae6760addad62b9b61c3dcdecc2ff01cba7
Closes-bug: #1430939
---
 files/rpms/zaqar-server | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/zaqar-server b/files/rpms/zaqar-server
index 69e8bfa80b..541cefa99d 100644
--- a/files/rpms/zaqar-server
+++ b/files/rpms/zaqar-server
@@ -1,4 +1,5 @@
 selinux-policy-targeted
+mongodb
 mongodb-server
 pymongo
 redis # NOPRIME

From 7ca90cded374685c8c68ea50381220b915eb0b63 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Wed, 4 Mar 2015 17:25:07 -0800
Subject: [PATCH 0423/3333] Allow devstack plugins to specify prereq packages

We offer main devstack components the ability to install their own
system package preqreqs via files/{debs, rpms}/$service.  This adds
similar functionality for plugins, who can now do the same in their
own tree at ./devstack/files/{debs, rpms}/$plugin.

Change-Id: I63af8dc54c75a6e80ca4b2a96c76233a0795aabb
---
 doc/source/plugins.rst   |  21 ++++++
 functions-common         | 153 +++++++++++++++++++++++----------------
 tools/install_prereqs.sh |   2 +
 3 files changed, 115 insertions(+), 61 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 5d6d3f183d..a9153df0d1 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -154,3 +154,24 @@ functions:
 -  ``start_nova_hypervisor`` - start any external services
 -  ``stop_nova_hypervisor`` - stop any external services
 -  ``cleanup_nova_hypervisor`` - remove transient data and cache
+
+System Packages
+===============
+
+Devstack provides a framework for getting packages installed at an early
+phase of its execution. This packages may be defined in a plugin as files
+that contain new-line separated lists of packages required by the plugin
+
+Supported packaging systems include apt and yum across multiple distributions.
+To enable a plugin to hook into this and install package dependencies, packages
+may be listed at the following locations in the top-level of the plugin
+repository:
+
+- ``./devstack/files/debs/$plugin_name`` - Packages to install when running
+  on Ubuntu, Debian or Linux Mint.
+
+- ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
+  on Red Hat, Fedora, CentOS or XenServer.
+
+- ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
+  running on SUSE Linux or openSUSE.
diff --git a/functions-common b/functions-common
index df69cbad16..e791ad79c8 100644
--- a/functions-common
+++ b/functions-common
@@ -973,13 +973,18 @@ function get_or_create_endpoint {
 
 # _get_package_dir
 function _get_package_dir {
+    local base_dir=$1
     local pkg_dir
+
+    if [[ -z "$base_dir" ]]; then
+        base_dir=$FILES
+    fi
     if is_ubuntu; then
-        pkg_dir=$FILES/debs
+        pkg_dir=$base_dir/debs
     elif is_fedora; then
-        pkg_dir=$FILES/rpms
+        pkg_dir=$base_dir/rpms
     elif is_suse; then
-        pkg_dir=$FILES/rpms-suse
+        pkg_dir=$base_dir/rpms-suse
     else
         exit_distro_not_supported "list of packages"
     fi
@@ -1005,6 +1010,59 @@ function apt_get {
         apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
 }
 
+function _parse_package_files {
+    local files_to_parse=$@
+
+    if [[ -z "$DISTRO" ]]; then
+        GetDistro
+    fi
+
+    for fname in ${files_to_parse}; do
+        local OIFS line package distros distro
+        [[ -e $fname ]] || continue
+
+        OIFS=$IFS
+        IFS=$'\n'
+        for line in $(<${fname}); do
+            if [[ $line =~ "NOPRIME" ]]; then
+                continue
+            fi
+
+            # Assume we want this package
+            package=${line%#*}
+            inst_pkg=1
+
+            # Look for # dist:xxx in comment
+            if [[ $line =~ (.*)#.*dist:([^ ]*) ]]; then
+                # We are using BASH regexp matching feature.
+                package=${BASH_REMATCH[1]}
+                distros=${BASH_REMATCH[2]}
+                # In bash ${VAR,,} will lowecase VAR
+                # Look for a match in the distro list
+                if [[ ! ${distros,,} =~ ${DISTRO,,} ]]; then
+                    # If no match then skip this package
+                    inst_pkg=0
+                fi
+            fi
+
+            # Look for # testonly in comment
+            if [[ $line =~ (.*)#.*testonly.* ]]; then
+                package=${BASH_REMATCH[1]}
+                # Are we installing test packages? (test for the default value)
+                if [[ $INSTALL_TESTONLY_PACKAGES = "False" ]]; then
+                    # If not installing test packages the skip this package
+                    inst_pkg=0
+                fi
+            fi
+
+            if [[ $inst_pkg = 1 ]]; then
+                echo $package
+            fi
+        done
+        IFS=$OIFS
+    done
+}
+
 # get_packages() collects a list of package names of any type from the
 # prerequisite files in ``files/{debs|rpms}``.  The list is intended
 # to be passed to a package installer such as apt or yum.
@@ -1029,103 +1087,76 @@ function get_packages {
         echo "No package directory supplied"
         return 1
     fi
-    if [[ -z "$DISTRO" ]]; then
-        GetDistro
-    fi
     for service in ${services//,/ }; do
         # Allow individual services to specify dependencies
         if [[ -e ${package_dir}/${service} ]]; then
-            file_to_parse="${file_to_parse} $service"
+            file_to_parse="${file_to_parse} ${package_dir}/${service}"
         fi
         # NOTE(sdague) n-api needs glance for now because that's where
         # glance client is
         if [[ $service == n-api ]]; then
             if [[ ! $file_to_parse =~ nova ]]; then
-                file_to_parse="${file_to_parse} nova"
+                file_to_parse="${file_to_parse} ${package_dir}/nova"
             fi
             if [[ ! $file_to_parse =~ glance ]]; then
-                file_to_parse="${file_to_parse} glance"
+                file_to_parse="${file_to_parse} ${package_dir}/glance"
             fi
         elif [[ $service == c-* ]]; then
             if [[ ! $file_to_parse =~ cinder ]]; then
-                file_to_parse="${file_to_parse} cinder"
+                file_to_parse="${file_to_parse} ${package_dir}/cinder"
             fi
         elif [[ $service == ceilometer-* ]]; then
             if [[ ! $file_to_parse =~ ceilometer ]]; then
-                file_to_parse="${file_to_parse} ceilometer"
+                file_to_parse="${file_to_parse} ${package_dir}/ceilometer"
             fi
         elif [[ $service == s-* ]]; then
             if [[ ! $file_to_parse =~ swift ]]; then
-                file_to_parse="${file_to_parse} swift"
+                file_to_parse="${file_to_parse} ${package_dir}/swift"
             fi
         elif [[ $service == n-* ]]; then
             if [[ ! $file_to_parse =~ nova ]]; then
-                file_to_parse="${file_to_parse} nova"
+                file_to_parse="${file_to_parse} ${package_dir}/nova"
             fi
         elif [[ $service == g-* ]]; then
             if [[ ! $file_to_parse =~ glance ]]; then
-                file_to_parse="${file_to_parse} glance"
+                file_to_parse="${file_to_parse} ${package_dir}/glance"
             fi
         elif [[ $service == key* ]]; then
             if [[ ! $file_to_parse =~ keystone ]]; then
-                file_to_parse="${file_to_parse} keystone"
+                file_to_parse="${file_to_parse} ${package_dir}/keystone"
             fi
         elif [[ $service == q-* ]]; then
             if [[ ! $file_to_parse =~ neutron ]]; then
-                file_to_parse="${file_to_parse} neutron"
+                file_to_parse="${file_to_parse} ${package_dir}/neutron"
             fi
         elif [[ $service == ir-* ]]; then
             if [[ ! $file_to_parse =~ ironic ]]; then
-                file_to_parse="${file_to_parse} ironic"
+                file_to_parse="${file_to_parse} ${package_dir}/ironic"
             fi
         fi
     done
+    echo "$(_parse_package_files $file_to_parse)"
+    $xtrace
+}
 
-    for file in ${file_to_parse}; do
-        local fname=${package_dir}/${file}
-        local OIFS line package distros distro
-        [[ -e $fname ]] || continue
-
-        OIFS=$IFS
-        IFS=$'\n'
-        for line in $(<${fname}); do
-            if [[ $line =~ "NOPRIME" ]]; then
-                continue
-            fi
-
-            # Assume we want this package
-            package=${line%#*}
-            inst_pkg=1
-
-            # Look for # dist:xxx in comment
-            if [[ $line =~ (.*)#.*dist:([^ ]*) ]]; then
-                # We are using BASH regexp matching feature.
-                package=${BASH_REMATCH[1]}
-                distros=${BASH_REMATCH[2]}
-                # In bash ${VAR,,} will lowecase VAR
-                # Look for a match in the distro list
-                if [[ ! ${distros,,} =~ ${DISTRO,,} ]]; then
-                    # If no match then skip this package
-                    inst_pkg=0
-                fi
-            fi
-
-            # Look for # testonly in comment
-            if [[ $line =~ (.*)#.*testonly.* ]]; then
-                package=${BASH_REMATCH[1]}
-                # Are we installing test packages? (test for the default value)
-                if [[ $INSTALL_TESTONLY_PACKAGES = "False" ]]; then
-                    # If not installing test packages the skip this package
-                    inst_pkg=0
-                fi
-            fi
-
-            if [[ $inst_pkg = 1 ]]; then
-                echo $package
-            fi
-        done
-        IFS=$OIFS
+# get_plugin_packages() collects a list of package names of any type from a
+# plugin's prerequisite files in ``$PLUGIN/devstack/files/{debs|rpms}``.  The
+# list is intended to be passed to a package installer such as apt or yum.
+#
+# Only packages required for enabled and collected plugins will included.
+#
+# The same metadata used in the main devstack prerequisite files may be used
+# in these prerequisite files, see get_packages() for more info.
+function get_plugin_packages {
+    local xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local files_to_parse=""
+    local package_dir=""
+    for plugin in ${DEVSTACK_PLUGINS//,/ }; do
+        local package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
+        files_to_parse+="$package_dir/$plugin"
     done
+    echo "$(_parse_package_files $files_to_parse)"
     $xtrace
 }
 
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 303cc63307..917980ccc5 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -62,6 +62,8 @@ export_proxy_variables
 
 # Install package requirements
 PACKAGES=$(get_packages general $ENABLED_SERVICES)
+PACKAGES="$PACKAGES $(get_plugin_packages)"
+
 if is_ubuntu && echo $PACKAGES | grep -q dkms ; then
     # ensure headers for the running kernel are installed for any DKMS builds
     PACKAGES="$PACKAGES linux-headers-$(uname -r)"

From e32c868f220720079facf462fa11c2bc9737e9c0 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Thu, 26 Feb 2015 14:10:05 +0100
Subject: [PATCH 0424/3333] Comment `log_file` for Zaqar

Instead of logging to a file, let it use stdout so we can see the output
in the screen logs.

Change-Id: I0e5e12a6ddc5ad91dd37e97362ac9a5bed238e32
---
 lib/zaqar | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/zaqar b/lib/zaqar
index c9321b997f..79b4c5a2ca 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -37,8 +37,6 @@ ZAQAR_DIR=$DEST/zaqar
 ZAQARCLIENT_DIR=$DEST/python-zaqarclient
 ZAQAR_CONF_DIR=/etc/zaqar
 ZAQAR_CONF=$ZAQAR_CONF_DIR/zaqar.conf
-ZAQAR_API_LOG_DIR=/var/log/zaqar
-ZAQAR_API_LOG_FILE=$ZAQAR_API_LOG_DIR/queues.log
 ZAQAR_AUTH_CACHE_DIR=${ZAQAR_AUTH_CACHE_DIR:-/var/cache/zaqar}
 
 # Support potential entry-points console scripts
@@ -110,14 +108,10 @@ function configure_zaqar {
     [ ! -d $ZAQAR_CONF_DIR ] && sudo mkdir -m 755 -p $ZAQAR_CONF_DIR
     sudo chown $USER $ZAQAR_CONF_DIR
 
-    [ ! -d $ZAQAR_API_LOG_DIR ] &&  sudo mkdir -m 755 -p $ZAQAR_API_LOG_DIR
-    sudo chown $USER $ZAQAR_API_LOG_DIR
-
     iniset $ZAQAR_CONF DEFAULT debug True
     iniset $ZAQAR_CONF DEFAULT verbose True
     iniset $ZAQAR_CONF DEFAULT admin_mode True
     iniset $ZAQAR_CONF DEFAULT use_syslog $SYSLOG
-    iniset $ZAQAR_CONF DEFAULT log_file $ZAQAR_API_LOG_FILE
     iniset $ZAQAR_CONF 'drivers:transport:wsgi' bind $ZAQAR_SERVICE_HOST
 
     configure_auth_token_middleware $ZAQAR_CONF zaqar $ZAQAR_AUTH_CACHE_DIR

From de77c471f3df400c4c7df724c78dbd7dc771c618 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Wed, 11 Mar 2015 17:15:42 -0700
Subject: [PATCH 0425/3333] Make ironic's service check flexible

We currently assume we are deploying ironic with the rest of
a cloud and assert that glance/neutron/nova are enabled. This
makes it a bit more flexible and allows deploying with only
the minimum required services if desired, and asserts the others
are enabled when we intend on testing nova+ironic integration.

This is required for in-tree python-ironicclient functional tests,
which we aim to run against a minimal devstack deployment.

Change-Id: I99001d151161fa225b97c3ba6b167a61aa9b59fe
---
 lib/ironic                         | 6 +++++-
 lib/nova_plugins/hypervisor-ironic | 4 +---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 0d7c12777c..e530f523f2 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -180,7 +180,11 @@ function is_deployed_with_ipa_ramdisk {
 # install_ironic() - Collect source and prepare
 function install_ironic {
     # make sure all needed service were enabled
-    for srv in nova glance key; do
+    local req_services="mysql rabbit key"
+    if [[ "$VIRT_DRIVER" == "ironic" ]]; then
+        req_services+=" nova glance neutron"
+    fi
+    for srv in $req_services; do
         if ! is_service_enabled "$srv"; then
             die $LINENO "$srv should be enabled for Ironic."
         fi
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 0169d731e8..b9e286d5b6 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -54,9 +54,7 @@ function configure_nova_hypervisor {
 
 # install_nova_hypervisor() - Install external components
 function install_nova_hypervisor {
-    if ! is_service_enabled neutron; then
-        die $LINENO "Neutron should be enabled for usage of the Ironic Nova driver."
-    elif is_ironic_hardware; then
+    if is_ironic_hardware; then
         return
     fi
     install_libvirt

From 41daa208d9f1bcc56c861b7751a51d3ef4b0f3f4 Mon Sep 17 00:00:00 2001
From: Vincent Hou <sbhou@cn.ibm.com>
Date: Wed, 4 Mar 2015 15:34:41 +0800
Subject: [PATCH 0426/3333] Remove my_ip from cinder.conf

The current issue is that if we deploy c-vol service on a separate
machine, my_ip and SERVICE_HOST will be different, because my_ip is
the machine where c-vol service is running and SERVICE_HOST points
to the machine where the cinder api service is running. If my_ip of
c-vol in cinder.conf is set to the IP of c-api, it will cause the
issue that the volume is unable to attach. The issue can be resolved
by removing my_ip from cinder.conf.

Change-Id: I699c0b5297c60e9f9934f74684abf563f4b0e977
closes-bug: #1428013
---
 lib/cinder | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 0d157dd78e..bc8a481ad6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -228,7 +228,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $CINDER_CONF DEFAULT verbose True
 
-    iniset $CINDER_CONF DEFAULT my_ip "$CINDER_SERVICE_HOST"
     iniset $CINDER_CONF DEFAULT iscsi_helper tgtadm
     iniset $CINDER_CONF DEFAULT sql_connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI

From cf3b41fa8bfa0f3d8dce897e4ad6ce4c88ac5ab3 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Thu, 12 Mar 2015 13:33:12 +0000
Subject: [PATCH 0427/3333] Shut down ironic services in the modern way

Instead of killing the screen, use stop_process which will
shut the processes when USE_SCREEN is False.

Change-Id: If0f714cb112dbf5fe9e4fdd7291cb4fb1df87f42
---
 lib/ironic | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 0d7c12777c..35b5411cd4 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -482,9 +482,8 @@ function start_ironic_conductor {
 
 # stop_ironic() - Stop running processes
 function stop_ironic {
-    # Kill the Ironic screen windows
-    screen -S $SCREEN_NAME -p ir-api -X kill
-    screen -S $SCREEN_NAME -p ir-cond -X kill
+    stop_process ir-api
+    stop_process ir-cond
 
     # Cleanup the WSGI files
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then

From b1a094d289a53fcbb0d04c0d3fa72707583728bd Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 12 Mar 2015 13:57:11 +0100
Subject: [PATCH 0428/3333] Install rsync-daemon on f22

swift requires to have rsyncd running as service or behind xinetd.
/etc/xinetd.d/rsync is not shipped with f22 and the daemon mode
 requires an additional package.
Adding rsync-daemon as swift dependency for f22 and f23(rawhide).

Change-Id: I33222719cabed59a261ce1b8ddedc457aa03800e
---
 files/rpms/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/swift b/files/rpms/swift
index 0fcdb0fe27..5789a198e8 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -13,3 +13,4 @@ pyxattr
 sqlite
 xfsprogs
 xinetd
+rsync-daemon # dist:f22,f23

From 23d6d5068752358c1d3bbacc314594b1b50e2fc8 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Fri, 6 Mar 2015 15:24:22 -0800
Subject: [PATCH 0429/3333] Stop using deprecated oslo_concurrency and
 sql_connection config options

As per the logs:
 Option "lock_path" from group "DEFAULT" is deprecated. Use option "lock_path" from group
"oslo_concurrency".

Option "sql_connection" from group "DEFAULT" is deprecated. Use option
"connection" from group "database".

Change-Id: I2109cec07ebee916c9ce0ccd24bd9a47d8d3c688
---
 lib/cinder  | 4 ++--
 lib/ironic  | 2 +-
 lib/nova    | 6 +++---
 lib/tempest | 2 +-
 lib/trove   | 6 +++---
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 0d157dd78e..8ae2581169 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -230,12 +230,12 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT my_ip "$CINDER_SERVICE_HOST"
     iniset $CINDER_CONF DEFAULT iscsi_helper tgtadm
-    iniset $CINDER_CONF DEFAULT sql_connection `database_connection_url cinder`
+    iniset $CINDER_CONF database connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
     iniset $CINDER_CONF DEFAULT osapi_volume_extension cinder.api.contrib.standard_extensions
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
-    iniset $CINDER_CONF DEFAULT lock_path $CINDER_STATE_PATH
+    iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     # NOTE(thingee): Cinder V1 API is deprecated and defaults to off as of
     # Juno. Keep it enabled so we can continue testing while it's still
diff --git a/lib/ironic b/lib/ironic
index bc30cdbeba..a65ea8807b 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -273,7 +273,7 @@ function configure_ironic {
     cp $IRONIC_DIR/etc/ironic/ironic.conf.sample $IRONIC_CONF_FILE
     iniset $IRONIC_CONF_FILE DEFAULT debug True
     inicomment $IRONIC_CONF_FILE DEFAULT log_file
-    iniset $IRONIC_CONF_FILE DEFAULT sql_connection `database_connection_url ironic`
+    iniset $IRONIC_CONF_FILE database connection `database_connection_url ironic`
     iniset $IRONIC_CONF_FILE DEFAULT state_path $IRONIC_STATE_PATH
     iniset $IRONIC_CONF_FILE DEFAULT use_syslog $SYSLOG
     # Configure Ironic conductor, if it was enabled.
diff --git a/lib/nova b/lib/nova
index e9e78c7bc4..81064380c0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -437,7 +437,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
     iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
     iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
-    iniset $NOVA_CONF DEFAULT sql_connection `database_connection_url nova`
+    iniset $NOVA_CONF database connection `database_connection_url nova`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF osapi_v3 enabled "True"
 
@@ -471,7 +471,7 @@ function create_nova_conf {
 
     if [ -n "$NOVA_STATE_PATH" ]; then
         iniset $NOVA_CONF DEFAULT state_path "$NOVA_STATE_PATH"
-        iniset $NOVA_CONF DEFAULT lock_path "$NOVA_STATE_PATH"
+        iniset $NOVA_CONF oslo_concurrency lock_path "$NOVA_STATE_PATH"
     fi
     if [ -n "$NOVA_INSTANCES_PATH" ]; then
         iniset $NOVA_CONF DEFAULT instances_path "$NOVA_INSTANCES_PATH"
@@ -575,7 +575,7 @@ function create_nova_conf {
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
-        iniset $NOVA_CELLS_CONF DEFAULT sql_connection `database_connection_url $NOVA_CELLS_DB`
+        iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
         iniset $NOVA_CELLS_CONF DEFAULT rabbit_virtual_host child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
diff --git a/lib/tempest b/lib/tempest
index f856ce05f9..7464499d43 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -275,7 +275,7 @@ function configure_tempest {
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
     # Oslo
-    iniset $TEMPEST_CONFIG DEFAULT lock_path $TEMPEST_STATE_PATH
+    iniset $TEMPEST_CONFIG oslo_concurrency lock_path $TEMPEST_STATE_PATH
     mkdir -p $TEMPEST_STATE_PATH
     iniset $TEMPEST_CONFIG DEFAULT use_stderr False
     iniset $TEMPEST_CONFIG DEFAULT log_file tempest.log
diff --git a/lib/trove b/lib/trove
index d77798308b..31c3eef5ea 100644
--- a/lib/trove
+++ b/lib/trove
@@ -136,7 +136,7 @@ function configure_trove {
 
     iniset $TROVE_CONF DEFAULT rabbit_userid $RABBIT_USERID
     iniset $TROVE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-    iniset $TROVE_CONF DEFAULT sql_connection `database_connection_url trove`
+    iniset $TROVE_CONF database connection `database_connection_url trove`
     iniset $TROVE_CONF DEFAULT default_datastore $TROVE_DATASTORE_TYPE
     setup_trove_logging $TROVE_CONF
     iniset $TROVE_CONF DEFAULT trove_api_workers "$API_WORKERS"
@@ -149,7 +149,7 @@ function configure_trove {
 
         iniset $TROVE_TASKMANAGER_CONF DEFAULT rabbit_userid $RABBIT_USERID
         iniset $TROVE_TASKMANAGER_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT sql_connection `database_connection_url trove`
+        iniset $TROVE_TASKMANAGER_CONF database connection `database_connection_url trove`
         iniset $TROVE_TASKMANAGER_CONF DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
         iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_user radmin
         iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_tenant_name trove
@@ -162,7 +162,7 @@ function configure_trove {
     if is_service_enabled tr-cond; then
         iniset $TROVE_CONDUCTOR_CONF DEFAULT rabbit_userid $RABBIT_USERID
         iniset $TROVE_CONDUCTOR_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT sql_connection `database_connection_url trove`
+        iniset $TROVE_CONDUCTOR_CONF database connection `database_connection_url trove`
         iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_user radmin
         iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_tenant_name trove
         iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS

From 3011ec75493c456589947567d972c3a3c1f602bb Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 12 Mar 2015 00:34:06 -0400
Subject: [PATCH 0430/3333] install missing elasticsearch client

elasticsearch client must be explicitly installed as it's an
optional backend requirement. this patch installs the client when
installing elasticsearch

Change-Id: I534cf0c78ab1fe7d309ef5f808bbe7b5422b403e
---
 pkg/elasticsearch.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 239d6b938e..f53c7f2ff2 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -77,6 +77,7 @@ function stop_elasticsearch {
 }
 
 function install_elasticsearch {
+    pip_install elasticsearch
     if is_package_installed elasticsearch; then
         echo "Note: elasticsearch was already installed."
         return

From 6ac97deba6af9ced38f3c0ec93327d352e20c6df Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 12 Mar 2015 09:03:28 +1100
Subject: [PATCH 0431/3333] Swift use v3 auth_token credentials

The keystonemiddleware 1.5.0 released 2015-03-11 supports configuring
auth plugins from the paste config file. This means that swift can now
use authentication plugins for auth_token middleware.

Change-Id: Icb9f008a57b6f75e0506cbecd0a1e0f28b7dadda
---
 lib/swift | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/lib/swift b/lib/swift
index 8a96615d01..f291d872d4 100644
--- a/lib/swift
+++ b/lib/swift
@@ -415,16 +415,8 @@ function configure_swift {
     # IDs will included in all of its log messages.
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
-    # NOTE(jamielennox): swift cannot use the regular configure_auth_token_middleware function because swift
-    # doesn't use oslo.config which is the only way to configure auth plugins with the middleare.
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken identity_uri $KEYSTONE_AUTH_URI
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken admin_user swift
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken admin_password $SERVICE_PASSWORD
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken auth_uri $KEYSTONE_SERVICE_URI
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cafile $SSL_BUNDLE_FILE
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken signing_dir $SWIFT_AUTH_CACHE_DIR
+    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False

From e52f6ca11fc581d5ab3da4200ed0128287ec2d39 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 5 Mar 2015 09:35:52 +1100
Subject: [PATCH 0432/3333] Remove packaged rpm python libraries

Let's just use pip versions

Change-Id: Idf3a3a914b54779172776822710b3e52e751b1d1
---
 files/rpms/ceilometer-collector |  1 -
 files/rpms/cinder               |  1 -
 files/rpms/glance               |  8 --------
 files/rpms/horizon              | 15 ---------------
 files/rpms/ironic               |  1 -
 files/rpms/keystone             | 10 ----------
 files/rpms/ldap                 |  1 -
 files/rpms/n-api                |  1 -
 files/rpms/n-cpu                |  2 +-
 files/rpms/neutron              |  9 ---------
 files/rpms/nova                 | 16 ----------------
 files/rpms/qpid                 |  1 -
 files/rpms/swift                |  9 ---------
 files/rpms/zaqar-server         |  1 -
 14 files changed, 1 insertion(+), 75 deletions(-)

diff --git a/files/rpms/ceilometer-collector b/files/rpms/ceilometer-collector
index 9cf580d22d..b139ed2b6b 100644
--- a/files/rpms/ceilometer-collector
+++ b/files/rpms/ceilometer-collector
@@ -1,4 +1,3 @@
 selinux-policy-targeted
 mongodb-server #NOPRIME
-pymongo # NOPRIME
 mongodb # NOPRIME
diff --git a/files/rpms/cinder b/files/rpms/cinder
index 082a35af32..9f1359f988 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -3,4 +3,3 @@ scsi-target-utils
 qemu-img
 postgresql-devel
 iscsi-initiator-utils
-python-lxml
diff --git a/files/rpms/glance b/files/rpms/glance
index a09b669309..119492a3f8 100644
--- a/files/rpms/glance
+++ b/files/rpms/glance
@@ -3,12 +3,4 @@ libxslt-devel       # testonly
 mysql-devel         # testonly
 openssl-devel       # testonly
 postgresql-devel    # testonly
-python-argparse
-python-eventlet
-python-greenlet
-python-lxml
-python-paste-deploy
-python-routes
-python-sqlalchemy
-pyxattr
 zlib-devel          # testonly
diff --git a/files/rpms/horizon b/files/rpms/horizon
index 585c36cfde..8d7f0371ef 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -2,20 +2,5 @@ Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
 pylint
-python-anyjson
-python-BeautifulSoup
-python-coverage
-python-dateutil
-python-eventlet
-python-greenlet
-python-httplib2
-python-migrate
-python-mox
-python-nose
-python-paste
-python-paste-deploy
-python-routes
-python-sqlalchemy
-python-webob
 pyxattr
 pcre-devel  # pyScss
diff --git a/files/rpms/ironic b/files/rpms/ironic
index 0a46314964..2bf8bb370e 100644
--- a/files/rpms/ironic
+++ b/files/rpms/ironic
@@ -8,7 +8,6 @@ libvirt-python
 net-tools
 openssh-clients
 openvswitch
-python-libguestfs
 sgabios
 syslinux
 tftp-server
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 45492e0de6..8074119fdb 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,14 +1,4 @@
 MySQL-python
-python-greenlet
 libxslt-devel
-python-lxml
-python-paste
-python-paste-deploy
-python-paste-script
-python-routes
-python-sqlalchemy
-python-webob
 sqlite
 mod_ssl
-
-# Deps installed via pip for RHEL
diff --git a/files/rpms/ldap b/files/rpms/ldap
index 2f7ab5de46..d89c4cf8c1 100644
--- a/files/rpms/ldap
+++ b/files/rpms/ldap
@@ -1,3 +1,2 @@
 openldap-servers
 openldap-clients
-python-ldap
diff --git a/files/rpms/n-api b/files/rpms/n-api
index 6f59e603b2..0928cd56b9 100644
--- a/files/rpms/n-api
+++ b/files/rpms/n-api
@@ -1,2 +1 @@
-python-dateutil
 fping
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 32b1546c39..c1a8e8ffa6 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -4,4 +4,4 @@ lvm2
 genisoimage
 sysfsutils
 sg3_utils
-python-libguestfs # NOPRIME
+
diff --git a/files/rpms/neutron b/files/rpms/neutron
index d11dab7e1a..c0dee78a48 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -10,15 +10,6 @@ mysql-devel  # testonly
 mysql-server # NOPRIME
 openvswitch # NOPRIME
 postgresql-devel        # testonly
-python-eventlet
-python-greenlet
-python-iso8601
-python-paste
-python-paste-deploy
-python-qpid # NOPRIME
-python-routes
-python-sqlalchemy
-python-suds
 rabbitmq-server # NOPRIME
 qpid-cpp-server        # NOPRIME
 sqlite
diff --git a/files/rpms/nova b/files/rpms/nova
index 557de908f1..527928a581 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -21,22 +21,6 @@ mysql-devel  # testonly
 mysql-server # NOPRIME
 parted
 polkit
-python-cheetah
-python-eventlet
-python-feedparser
-python-greenlet
-python-iso8601
-python-lockfile
-python-migrate
-python-mox
-python-paramiko
-python-paste
-python-paste-deploy
-python-qpid # NOPRIME
-python-routes
-python-sqlalchemy
-python-suds
-python-tempita
 rabbitmq-server # NOPRIME
 qpid-cpp-server # NOPRIME
 sqlite
diff --git a/files/rpms/qpid b/files/rpms/qpid
index c5e2699fcc..41dd2f69f9 100644
--- a/files/rpms/qpid
+++ b/files/rpms/qpid
@@ -1,4 +1,3 @@
 qpid-proton-c-devel # NOPRIME
-python-qpid-proton # NOPRIME
 cyrus-sasl-lib # NOPRIME
 cyrus-sasl-plain # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 0fcdb0fe27..accf547ece 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,14 +1,5 @@
 curl
 memcached
-python-configobj
-python-coverage
-python-eventlet
-python-greenlet
-python-netifaces
-python-nose
-python-paste-deploy
-python-simplejson
-python-webob
 pyxattr
 sqlite
 xfsprogs
diff --git a/files/rpms/zaqar-server b/files/rpms/zaqar-server
index 541cefa99d..78806fb3f6 100644
--- a/files/rpms/zaqar-server
+++ b/files/rpms/zaqar-server
@@ -3,4 +3,3 @@ mongodb
 mongodb-server
 pymongo
 redis # NOPRIME
-python-redis # NOPRIME

From b6197e6ab0b6085f2b81f7a29fa6a3ea5ec03748 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 12 Feb 2015 15:33:35 -0500
Subject: [PATCH 0433/3333] switch to use ceilometermiddleware

swift middleware contained in ceilometer is now deprecated. the
middleware is available in ceilometermiddleware.

Change-Id: I6e41986245f4d95a9385dc7829479ed1199f10ac
---
 lib/ceilometer  | 2 ++
 lib/rpc_backend | 9 +++++++++
 lib/swift       | 6 +++++-
 stack.sh        | 3 +++
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 9db0640940..a464c52b6c 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -322,6 +322,8 @@ function install_ceilometermiddleware {
     if use_library_from_git "ceilometermiddleware"; then
         git_clone_by_name "ceilometermiddleware"
         setup_dev_lib "ceilometermiddleware"
+    else
+        pip_install ceilometermiddleware
     fi
 }
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index ff22bbf8fa..a399d1757e 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -233,6 +233,15 @@ function restart_rpc_backend {
     fi
 }
 
+# builds transport url string
+function get_transport_url {
+    if is_service_enabled qpid || [ -n "$QPID_HOST" ]; then
+        echo "qpid://$QPID_USERNAME:$QPID_PASSWORD@$QPID_HOST:5672/"
+    elif is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
+        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/"
+    fi
+}
+
 # iniset cofiguration
 function iniset_rpc_backend {
     local package=$1
diff --git a/lib/swift b/lib/swift
index 4a63500b54..3decd2f9f0 100644
--- a/lib/swift
+++ b/lib/swift
@@ -378,7 +378,11 @@ function configure_swift {
     # Configure Ceilometer
     if is_service_enabled ceilometer; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer use "egg:ceilometer#swift"
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer paste.filter_factory "ceilometermiddleware.swift:filter_factory"
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer control_exchange "swift"
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer url $(get_transport_url)
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer driver "messaging"
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer topic "notifications"
         SWIFT_EXTRAS_MIDDLEWARE_LAST="${SWIFT_EXTRAS_MIDDLEWARE_LAST} ceilometer"
     fi
 
diff --git a/stack.sh b/stack.sh
index 2060f2d65a..5c726a3a1c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -739,6 +739,9 @@ if is_service_enabled keystone; then
 fi
 
 if is_service_enabled s-proxy; then
+    if is_service_enabled ceilometer; then
+        install_ceilometermiddleware
+    fi
     stack_install_service swift
     configure_swift
 

From 7b2eaedabf0700a50ddcb32ac54570ea200c616e Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@hp.com>
Date: Fri, 13 Mar 2015 12:05:49 +0000
Subject: [PATCH 0434/3333] Adding tempest_roles when auth_version is v3

With identity v3 the _member_ role is not added on the projects
automatically for the user when it's created.

Setting _member_ to tempest_roles so that tempest adds the role.

Change-Id: Iaae9286ecc6f019d36261a5c450068a650e24a28
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index f856ce05f9..fcb0e59937 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -315,6 +315,9 @@ function configure_tempest {
 
     # Auth
     iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+    if [[ "$TEMPEST_AUTH_VERSION" == "v3" ]]; then
+        iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    fi
 
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED

From 58065f26b6f35272636174c3b07006255424b9c5 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sat, 14 Mar 2015 06:13:26 -0700
Subject: [PATCH 0435/3333] Set compute-feature-enabled.preserve_ports=True in
 tempest.conf

Because of branchless Tempest we have to set a compute-feature-enabled
flag to test preserving preexisting ports from Neutron since the code
only works starting in Kilo and won't be backported to stable/juno or
stable/icehouse.

We can remove this flag once juno-eol happens.

Depends-On: I95469e4c2f4aa2bc4e6342860a9c222fb4fa7e16

Related-Bug: #1431724

Change-Id: I214baa3b861e29bedf6bb7b50534ac2286676dd1
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index f856ce05f9..f9a2da1650 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -349,6 +349,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
+    # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
+    iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
 
     # Compute admin
     iniset $TEMPEST_CONFIG "compute-admin" username $ADMIN_USERNAME

From 5dfecc8966912c2f74a4c7ecc85dd5f0b930cd99 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sat, 14 Mar 2015 12:28:59 -0500
Subject: [PATCH 0436/3333] Keystone RPC backend config consistency

lib/keystone was setting up rabbit config directly rather than
using the iniset_rpc_backend function that other projects use.

Change-Id: Ic368f102c808cdbd2e4cbc1ff457cdf17a681332
---
 lib/keystone | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 0968445dc0..c9433d98fe 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -226,12 +226,7 @@ function configure_keystone {
         iniset $KEYSTONE_CONF assignment driver "keystone.assignment.backends.$KEYSTONE_ASSIGNMENT_BACKEND.Assignment"
     fi
 
-    # Configure rabbitmq credentials
-    if is_service_enabled rabbit; then
-        iniset $KEYSTONE_CONF DEFAULT rabbit_userid $RABBIT_USERID
-        iniset $KEYSTONE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $KEYSTONE_CONF DEFAULT rabbit_host $RABBIT_HOST
-    fi
+    iniset_rpc_backend keystone $KEYSTONE_CONF DEFAULT
 
     # Set the URL advertised in the ``versions`` structure returned by the '/' route
     if is_service_enabled tls-proxy; then

From 2dd110ce8668f6cb7b507928bad972d94656e2d7 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sat, 14 Mar 2015 12:39:14 -0500
Subject: [PATCH 0437/3333] iniset_rpc_backend default section

iniset_rpc_backend should know what section it needs to set the
config options in better than the callers. The config options
have actually been moved to different sections and the options
in the DEFAULT section are deprecated.

Change-Id: I0e07fe03c7812ef8df49e126bf71c57588635639
---
 lib/ceilometer  | 2 +-
 lib/cinder      | 2 +-
 lib/glance      | 4 ++--
 lib/heat        | 2 +-
 lib/ironic      | 2 +-
 lib/keystone    | 2 +-
 lib/neutron     | 2 +-
 lib/nova        | 2 +-
 lib/rpc_backend | 2 +-
 lib/sahara      | 2 +-
 lib/zaqar       | 2 +-
 11 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 9db0640940..e2400833c8 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -169,7 +169,7 @@ function configure_ceilometer {
     [ ! -d $CEILOMETER_API_LOG_DIR ] &&  sudo mkdir -m 755 -p $CEILOMETER_API_LOG_DIR
     sudo chown $STACK_USER $CEILOMETER_API_LOG_DIR
 
-    iniset_rpc_backend ceilometer $CEILOMETER_CONF DEFAULT
+    iniset_rpc_backend ceilometer $CEILOMETER_CONF
 
     iniset $CEILOMETER_CONF DEFAULT notification_topics "$CEILOMETER_NOTIFICATION_TOPICS"
     iniset $CEILOMETER_CONF DEFAULT verbose True
diff --git a/lib/cinder b/lib/cinder
index 880af1fd40..a8f05389b5 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -281,7 +281,7 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT use_syslog True
     fi
 
-    iniset_rpc_backend cinder $CINDER_CONF DEFAULT
+    iniset_rpc_backend cinder $CINDER_CONF
 
     if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
         iniset $CINDER_CONF DEFAULT secure_delete False
diff --git a/lib/glance b/lib/glance
index eb1df2e8ae..8400ca18cc 100755
--- a/lib/glance
+++ b/lib/glance
@@ -112,7 +112,7 @@ function configure_glance {
     if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
         iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
     fi
-    iniset_rpc_backend glance $GLANCE_REGISTRY_CONF DEFAULT
+    iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
 
     cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -125,7 +125,7 @@ function configure_glance {
     if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
         iniset $GLANCE_API_CONF DEFAULT notification_driver messaging
     fi
-    iniset_rpc_backend glance $GLANCE_API_CONF DEFAULT
+    iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,raw,iso"
diff --git a/lib/heat b/lib/heat
index a088e82886..d713f18269 100644
--- a/lib/heat
+++ b/lib/heat
@@ -105,7 +105,7 @@ function configure_heat {
     cp $HEAT_DIR/etc/heat/policy.json $HEAT_POLICY_FILE
 
     # common options
-    iniset_rpc_backend heat $HEAT_CONF DEFAULT
+    iniset_rpc_backend heat $HEAT_CONF
     iniset $HEAT_CONF DEFAULT heat_metadata_server_url http://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT
     iniset $HEAT_CONF DEFAULT heat_waitcondition_server_url http://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1/waitcondition
     iniset $HEAT_CONF DEFAULT heat_watch_server_url http://$HEAT_API_CW_HOST:$HEAT_API_CW_PORT
diff --git a/lib/ironic b/lib/ironic
index 35b5411cd4..2dc95bb435 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -313,7 +313,7 @@ function configure_ironic_api {
     iniset $IRONIC_CONF_FILE keystone_authtoken cafile $SSL_BUNDLE_FILE
     iniset $IRONIC_CONF_FILE keystone_authtoken signing_dir $IRONIC_AUTH_CACHE_DIR/api
 
-    iniset_rpc_backend ironic $IRONIC_CONF_FILE DEFAULT
+    iniset_rpc_backend ironic $IRONIC_CONF_FILE
     iniset $IRONIC_CONF_FILE api port $IRONIC_SERVICE_PORT
 
     cp -p $IRONIC_DIR/etc/ironic/policy.json $IRONIC_POLICY_JSON
diff --git a/lib/keystone b/lib/keystone
index c9433d98fe..89e9aa1918 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -226,7 +226,7 @@ function configure_keystone {
         iniset $KEYSTONE_CONF assignment driver "keystone.assignment.backends.$KEYSTONE_ASSIGNMENT_BACKEND.Assignment"
     fi
 
-    iniset_rpc_backend keystone $KEYSTONE_CONF DEFAULT
+    iniset_rpc_backend keystone $KEYSTONE_CONF
 
     # Set the URL advertised in the ``versions`` structure returned by the '/' route
     if is_service_enabled tls-proxy; then
diff --git a/lib/neutron b/lib/neutron
index e41abafda9..a31a064063 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -422,7 +422,7 @@ function is_neutron_enabled {
 # Set common config for all neutron server and agents.
 function configure_neutron {
     _configure_neutron_common
-    iniset_rpc_backend neutron $NEUTRON_CONF DEFAULT
+    iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
     if is_service_enabled q-lbaas; then
diff --git a/lib/nova b/lib/nova
index 199daeea3d..f0490951b7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -537,7 +537,7 @@ function create_nova_conf {
 
     iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
     iniset $NOVA_CONF DEFAULT keystone_ec2_url $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
-    iniset_rpc_backend nova $NOVA_CONF DEFAULT
+    iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
diff --git a/lib/rpc_backend b/lib/rpc_backend
index ff22bbf8fa..32c3e17aa3 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -237,7 +237,7 @@ function restart_rpc_backend {
 function iniset_rpc_backend {
     local package=$1
     local file=$2
-    local section=$3
+    local section=${3:-DEFAULT}
     if is_service_enabled zeromq; then
         iniset $file $section rpc_backend "zmq"
         iniset $file $section rpc_zmq_host `hostname`
diff --git a/lib/sahara b/lib/sahara
index 521b19a4a1..7c22d0f5b9 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -127,7 +127,7 @@ function configure_sahara {
     if is_service_enabled ceilometer; then
         iniset $SAHARA_CONF_FILE DEFAULT enable_notifications "true"
         iniset $SAHARA_CONF_FILE DEFAULT notification_driver "messaging"
-        iniset_rpc_backend sahara $SAHARA_CONF_FILE DEFAULT
+        iniset_rpc_backend sahara $SAHARA_CONF_FILE
     fi
 
     iniset $SAHARA_CONF_FILE DEFAULT verbose True
diff --git a/lib/zaqar b/lib/zaqar
index 79b4c5a2ca..02b69879fe 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -133,7 +133,7 @@ function configure_zaqar {
         iniset $ZAQAR_CONF DEFAULT notification_driver messaging
         iniset $ZAQAR_CONF DEFAULT control_exchange zaqar
     fi
-    iniset_rpc_backend zaqar $ZAQAR_CONF DEFAULT
+    iniset_rpc_backend zaqar $ZAQAR_CONF
 
     cleanup_zaqar
 }

From 1577663f4a7d50542e1c729a3f975af627f6c47b Mon Sep 17 00:00:00 2001
From: Anand Shanmugam <anand1712@gmail.com>
Date: Sat, 14 Mar 2015 19:24:10 +0530
Subject: [PATCH 0438/3333] Fix Traceback exceptions in g-api and g-reg

The log_context format specified in glance-api and glance-reistry
are causing tracebacks.  This fix changes the
project_id and user_id to tenant and user which are supported
in oslo-context.  This is the format used by other projects

Change-Id: Ifbf268e9765039a0085c9af930dabf8a5cc681b8
Closes-Bug: #1431784
---
 lib/glance | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index eb1df2e8ae..26d7960143 100755
--- a/lib/glance
+++ b/lib/glance
@@ -185,8 +185,8 @@ function configure_glance {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $GLANCE_API_CONF DEFAULT "project_id" "user_id"
-        setup_colorized_logging $GLANCE_REGISTRY_CONF DEFAULT "project_id" "user_id"
+        setup_colorized_logging $GLANCE_API_CONF DEFAULT tenant user
+        setup_colorized_logging $GLANCE_REGISTRY_CONF DEFAULT tenant user
     fi
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI

From 80cdbc423112f76720f9b8b4cdf19f17815429f8 Mon Sep 17 00:00:00 2001
From: Zhenzan Zhou <zhenzan.zhou@intel.com>
Date: Mon, 16 Mar 2015 12:30:44 +0800
Subject: [PATCH 0439/3333] Make ironic ssh check timeout configurable

On some environments, the current 10s timeout waiting for server
ssh-able is not enough. SSH session was killed before the command
executed by server and then break the whole stack.sh.

Change-Id: I4d842744793455d44a633dee8920a60552e8075e
---
 lib/ironic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 35b5411cd4..863d023c38 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -63,6 +63,7 @@ IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$TOP_DIR/tools/ironic/templates}
 IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False IRONIC_BAREMETAL_BASIC_OPS)
 IRONIC_ENABLED_DRIVERS=${IRONIC_ENABLED_DRIVERS:-fake,pxe_ssh,pxe_ipmitool}
 IRONIC_SSH_USERNAME=${IRONIC_SSH_USERNAME:-`whoami`}
+IRONIC_SSH_TIMEOUT=${IRONIC_SSH_TIMEOUT:-15}
 IRONIC_SSH_KEY_DIR=${IRONIC_SSH_KEY_DIR:-$IRONIC_DATA_DIR/ssh_keys}
 IRONIC_SSH_KEY_FILENAME=${IRONIC_SSH_KEY_FILENAME:-ironic_key}
 IRONIC_KEY_FILE=${IRONIC_KEY_FILE:-$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME}
@@ -703,7 +704,7 @@ function ironic_ssh_check {
 
 function configure_ironic_auxiliary {
     configure_ironic_ssh_keypair
-    ironic_ssh_check $IRONIC_KEY_FILE $IRONIC_VM_SSH_ADDRESS $IRONIC_VM_SSH_PORT $IRONIC_SSH_USERNAME 10
+    ironic_ssh_check $IRONIC_KEY_FILE $IRONIC_VM_SSH_ADDRESS $IRONIC_VM_SSH_PORT $IRONIC_SSH_USERNAME $IRONIC_SSH_TIMEOUT
 }
 
 function build_ipa_coreos_ramdisk {

From 1331a828dab91f2e053cb1a4b78b872af00410c1 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 16 Mar 2015 10:27:47 +0100
Subject: [PATCH 0440/3333] Add \n at the end of samples/local.conf

Currently if you `cat` the file, the bash prompt will be at a weird
position. And if you programmaticaly add a new line to this file,
the line will be, in fact, appended to the previous line.

Change-Id: I19ba018d9a934f8fdc07cc9bec50a0105f2710f9
---
 samples/local.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/local.conf b/samples/local.conf
index e4052c21ac..63000b65ba 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -98,4 +98,4 @@ SWIFT_DATA_DIR=$DEST/data
 # -------
 
 # Install the tempest test suite
-enable_service tempest
\ No newline at end of file
+enable_service tempest

From cb3ceceda227036c357a1c3173ecbd8c3116b148 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 16 Mar 2015 10:37:51 -0400
Subject: [PATCH 0441/3333] Set INSTALL_TEMPEST to default true

This commit switches the default value for INSTALL_TEMPEST on master
devstack to be true. Not installing tempest by default on devstack is
confusing for devs and people working with tempest in devstack. The
venv isolation is only really required on stable branches because of
conflicting requirements, however it is not really necessary on master.

Change-Id: I368cb56fd9e0cbf59cefe24a46507d3f58b9a8e3
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index f856ce05f9..85bccb62a0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -66,7 +66,7 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 # This must be False on stable branches, as master tempest
 # deps do not match stable branch deps. Set this to True to
 # have tempest installed in devstack by default.
-INSTALL_TEMPEST=${INSTALL_TEMPEST:-"False"}
+INSTALL_TEMPEST=${INSTALL_TEMPEST:-"True"}
 
 
 BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"

From a3430270f3b652317a85c9eabe76962bd64f4543 Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Mon, 9 Mar 2015 16:55:32 +0100
Subject: [PATCH 0442/3333] Support detection of interfaces with non-word chars
 in the name

The current regex only matches host interface names that consits
of "word characters" (regex \w). Intefaces having other special
chars like "-" or "." are not parsed. Examples that are not yet
matched are br-ex (ovs bridge) or enccw0.0.1234 (s390 eth device
name).

In addition it's hard to understand the the regex.

This fix is replacing the regex by a simple awk statement also
matching those names.

In addition the determination of the host_ip_iface was moved
down into the if clause, as it is only used inside.

Change-Id: I3d1b1afa32956e4e8c55c7e68cbafaf8e03e7da2
Closes-Bug: #1429903
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 4739e42e90..ed43e20d8d 100644
--- a/functions-common
+++ b/functions-common
@@ -542,11 +542,11 @@ function get_default_host_ip {
     local host_ip_iface=$3
     local host_ip=$4
 
-    # Find the interface used for the default route
-    host_ip_iface=${host_ip_iface:-$(ip route | sed -n '/^default/{ s/.*dev \(\w\+\)\s\+.*/\1/; p; }' | head -1)}
     # Search for an IP unless an explicit is set by ``HOST_IP`` environment variable
     if [ -z "$host_ip" -o "$host_ip" == "dhcp" ]; then
         host_ip=""
+        # Find the interface used for the default route
+        host_ip_iface=${host_ip_iface:-$(ip route | awk '/default/ {print $5}' | head -1)}
         local host_ips=$(LC_ALL=C ip -f inet addr show ${host_ip_iface} | awk '/inet/ {split($2,parts,"/");  print parts[1]}')
         local ip
         for ip in $host_ips; do

From 45e7db0e7a702e7a1cdb1121acd7c2766c664dbc Mon Sep 17 00:00:00 2001
From: Morgan Jones <morgan@parelastic.com>
Date: Mon, 16 Mar 2015 12:20:32 -0400
Subject: [PATCH 0443/3333] Change datastore version for Mysql datastore

The Replication V2 change to Trove moves the test
datastore from Mysql 5.5 to Mysql 5.6.  This change
reflects that in devstack.

Change-Id: Ibdf32b46c200d3061975d390c872be77d19bc361
Implements: blueprint bp/replication-v2
Closes-bug: #1432686
Depends-On: I8eec708f41e791e3db04a2c7b7c12855118b64ac
---
 lib/trove | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/trove b/lib/trove
index d77798308b..9c2140cfba 100644
--- a/lib/trove
+++ b/lib/trove
@@ -44,8 +44,8 @@ TROVE_LOCAL_CONF_DIR=$TROVE_DIR/etc/trove
 TROVE_LOCAL_API_PASTE_INI=$TROVE_LOCAL_CONF_DIR/api-paste.ini
 TROVE_AUTH_CACHE_DIR=${TROVE_AUTH_CACHE_DIR:-/var/cache/trove}
 TROVE_DATASTORE_TYPE=${TROVE_DATASTORE_TYPE:-"mysql"}
-TROVE_DATASTORE_VERSION=${TROVE_DATASTORE_VERSION:-"5.5"}
-TROVE_DATASTORE_PACKAGE=${TROVE_DATASTORE_PACKAGE:-"mysql-server-5.5"}
+TROVE_DATASTORE_VERSION=${TROVE_DATASTORE_VERSION:-"5.6"}
+TROVE_DATASTORE_PACKAGE=${TROVE_DATASTORE_PACKAGE:-"mysql-server-5.6"}
 
 # Support entry points installation of console scripts
 if [[ -d $TROVE_DIR/bin ]]; then

From ad13c0a8dacbf5d5d399aa2df99313bb5fb6a39b Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sat, 14 Mar 2015 12:14:31 -0500
Subject: [PATCH 0444/3333] Keystone stop using config refs

 - Rather than using config refs, deployments should be using a tool
   such as chef or puppet to set the options correctly.

 - Config refs have a bug where you can only reference an option in
   the DEFAULT group, which limits the usefulness, and with this
   feature it's impossible to move any config options out of the
   DEFAULT group, luckily this has been ignored anyways since I think
   everyone realizes how broken it is.

Change-Id: I74cae09f9d75177f8efea69e7ae981ed8f14039f
---
 lib/keystone | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 0968445dc0..4592440248 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -234,13 +234,8 @@ function configure_keystone {
     fi
 
     # Set the URL advertised in the ``versions`` structure returned by the '/' route
-    if is_service_enabled tls-proxy; then
-        iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/"
-        iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/"
-    else
-        iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:%(public_port)s/"
-        iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:%(admin_port)s/"
-    fi
+    iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/"
+    iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/"
     iniset $KEYSTONE_CONF DEFAULT admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
 
     # Register SSL certificates if provided

From 2662395fac0c7cf8e842b56987ad0f0cdedc3d5f Mon Sep 17 00:00:00 2001
From: Yuriy Taraday <yorik.sar@gmail.com>
Date: Wed, 16 Jul 2014 17:41:53 +0400
Subject: [PATCH 0445/3333] Add rootwrap daemon mode support for Neutron

Daemon mode is turned on by default.

Implements: blueprint rootwrap-daemon-mode
Change-Id: I632df4149e9d7f78cb5a7091dfe4ea8f8ca3ddfa
---
 lib/neutron | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index e41abafda9..411c6961ce 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -153,6 +153,7 @@ Q_USE_NAMESPACE=${Q_USE_NAMESPACE:-True}
 # RHEL's support for namespaces requires using veths with ovs
 Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
 Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
+Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 # Meta data IP
 Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
 # Allow Overlapping IP among subnets
@@ -226,6 +227,9 @@ if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
 else
     NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
     Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+    fi
 fi
 
 
@@ -896,6 +900,9 @@ function _configure_neutron_debug_command {
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
 
     _neutron_setup_interface_driver $NEUTRON_TEST_CONFIG_FILE
 
@@ -910,6 +917,9 @@ function _configure_neutron_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_DHCP_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
 
     if ! is_service_enabled q-l3; then
         if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
@@ -943,6 +953,9 @@ function _configure_neutron_l3_agent {
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
 
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
@@ -956,6 +969,9 @@ function _configure_neutron_metadata_agent {
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
     iniset $Q_META_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $Q_META_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
 
     # Configures keystone for metadata_agent
     # The third argument "True" sets auth_url needed to communicate with keystone
@@ -1008,6 +1024,9 @@ function _configure_neutron_plugin_agent {
     # Specify the default root helper prior to agent configuration to
     # ensure that an agent's configuration can override the default
     iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
     iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
@@ -1106,16 +1125,21 @@ function _neutron_setup_rootwrap {
     sudo chmod 0644 $Q_RR_CONF_FILE
     # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
     ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
+    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
 
     # Set up the rootwrap sudoers for neutron
     TEMPFILE=`mktemp`
     echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
     chmod 0440 $TEMPFILE
     sudo chown root:root $TEMPFILE
     sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
 
     # Update the root_helper
     iniset $NEUTRON_CONF agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $NEUTRON_CONF agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
 }
 
 # Configures keystone integration for neutron service and agents

From 6a83c423fc1d788d9e81b58a8659eca1cb84095d Mon Sep 17 00:00:00 2001
From: Eli Qiao <liyong.qiao@intel.com>
Date: Tue, 17 Mar 2015 16:54:16 +0800
Subject: [PATCH 0446/3333] Fix pip install error

If we set mutiple proxy (ip or url), pip install will
treat the second proxy as a command.
Add quotation marks around proxy.
expecially for no_proxy

Change-Id: I38ad3f083ba5155cda0e5e2b8f5df64492b7fecd
---
 inc/python | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index d72c3c94d7..229c54009d 100644
--- a/inc/python
+++ b/inc/python
@@ -94,9 +94,9 @@ function pip_install {
 
     $xtrace
     $sudo_pip \
-        http_proxy=${http_proxy:-} \
-        https_proxy=${https_proxy:-} \
-        no_proxy=${no_proxy:-} \
+        http_proxy="${http_proxy:-}" \
+        https_proxy="${https_proxy:-}" \
+        no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         $cmd_pip install \
         $@

From 302389bf8d1d9dfeed9a7c07e8bb4b85fc731028 Mon Sep 17 00:00:00 2001
From: Vitaly Gridnev <vgridnev@mirantis.com>
Date: Thu, 12 Mar 2015 14:15:44 +0300
Subject: [PATCH 0447/3333] [SAHARA] Remove copying sahara.conf from base
 config file

Sahara is going to remove sahara.conf.sample because it
is not gated anymore and therefore it gets out of date.
So, we need to remove copying sahara.conf from base config file
sahara.conf.sample

Change-Id: I0ddf36cfc15694dfe41fe695d577199da75ce7f1
---
 lib/sahara | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/sahara b/lib/sahara
index 521b19a4a1..709e90e1bd 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -111,9 +111,6 @@ function configure_sahara {
         cp -p $SAHARA_DIR/etc/sahara/policy.json $SAHARA_CONF_DIR
     fi
 
-    # Copy over sahara configuration file and configure common parameters.
-    cp $SAHARA_DIR/etc/sahara/sahara.conf.sample $SAHARA_CONF_FILE
-
     # Create auth cache dir
     sudo mkdir -p $SAHARA_AUTH_CACHE_DIR
     sudo chown $STACK_USER $SAHARA_AUTH_CACHE_DIR

From d66bac3f70ce2470be8d19f91b6945483a62328f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 17 Mar 2015 09:10:01 -0400
Subject: [PATCH 0448/3333] remove horizon exercises

The horizon team keeps changing how the UI is exposed. This exercise
keeps lagging and doesn't really test anything useful any more. Just
delete it.

Change-Id: Id62904868f1d4b39e33d2ad63340b5ee2177fb56
---
 exercises/horizon.sh | 45 --------------------------------------------
 1 file changed, 45 deletions(-)
 delete mode 100755 exercises/horizon.sh

diff --git a/exercises/horizon.sh b/exercises/horizon.sh
deleted file mode 100755
index 4020580157..0000000000
--- a/exercises/horizon.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-
-# **horizon.sh**
-
-# Sanity check that horizon started if enabled
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-is_service_enabled horizon || exit 55
-
-# can we get the front page
-$CURL_GET http://$SERVICE_HOST 2>/dev/null | grep -q '<h3.*>Log In</h3>' || die $LINENO "Horizon front page not functioning!"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
-

From a03ed3762613a70e9f15811bc02a5006c0004f05 Mon Sep 17 00:00:00 2001
From: Thanassis Parathyras <aparathyras@stackmasters.eu>
Date: Thu, 12 Mar 2015 22:15:50 +0200
Subject: [PATCH 0449/3333] Adds documentation for devstack unit tests
 enablement

Closes Bug: 1283214
Closes Bug: 1203723

Change-Id: Iac25185c7cc92ddebd3a22b602f7c8885d009807
---
 doc/source/configuration.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index fe3e2c29bf..7d06658ee2 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -378,6 +378,18 @@ IP Version
       can be configured with any valid IPv6 prefix. The default values make
       use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC 4193.*
 
+Unit tests dependencies install
+-------------------------------
+
+    | *Default: ``INSTALL_TESTONLY_PACKAGES=False``*
+    |  In order to be able to run unit tests with script ``run_test.sh``,
+       the required package dependencies need to be installed.
+       Setting this option as below does the work.
+
+    ::
+
+        INSTALL_TESTONLY_PACKAGES=True
+
 Examples
 ========
 

From 744c2afd6f5a594a5a16144c773436fbca263c4d Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Tue, 16 Dec 2014 12:00:40 +1300
Subject: [PATCH 0450/3333] Allow heat-standalone to work with keystone v3

Heat can now run in standalone mode with the default v3 keystone
backend.

This change removes the installation of the v2 contrib backend.
It also configures saner defaults when HEAT_STANDALONE is True.
Using trusts and a stack-domain will never work in standalone mode
since they both require a service user which doesn't exist in
standalone mode.

Finally, this change prevents heat.conf being populated with service user options
not required by standalone mode.

Configuring the v2 backend may be reintroduced later with a dedicated
flag variable.

Change-Id: I88403e359e5e59e776b25ba1b65fae6fa8a3548e
---
 lib/heat | 83 ++++++++++++++++++++++++++++++--------------------------
 stack.sh |  2 +-
 2 files changed, 45 insertions(+), 40 deletions(-)

diff --git a/lib/heat b/lib/heat
index a088e82886..cef70692c7 100644
--- a/lib/heat
+++ b/lib/heat
@@ -49,13 +49,19 @@ HEAT_CONF_DIR=/etc/heat
 HEAT_CONF=$HEAT_CONF_DIR/heat.conf
 HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
 HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
-HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
 
 
 # other default options
-HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
+if [[ "$HEAT_STANDALONE" = "True" ]]; then
+    # for standalone, use defaults which require no service user
+    HEAT_STACK_DOMAIN=`trueorfalse False $HEAT_STACK_DOMAIN`
+    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-password}
+else
+    HEAT_STACK_DOMAIN=`trueorfalse True $HEAT_STACK_DOMAIN`
+    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
+fi
 
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,heat
@@ -77,13 +83,11 @@ function cleanup_heat {
     sudo rm -rf $HEAT_AUTH_CACHE_DIR
     sudo rm -rf $HEAT_ENV_DIR
     sudo rm -rf $HEAT_TEMPLATES_DIR
+    sudo rm -rf $HEAT_CONF_DIR
 }
 
 # configure_heat() - Set config files, create data dirs, etc
 function configure_heat {
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        setup_develop $HEAT_DIR/contrib/heat_keystoneclient_v2
-    fi
 
     if [[ ! -d $HEAT_CONF_DIR ]]; then
         sudo mkdir -p $HEAT_CONF_DIR
@@ -127,24 +131,22 @@ function configure_heat {
     # auth plugin setup. This should be fixed in heat.  Heat is also the only
     # service that requires the auth_uri to include a /v2.0. Remove this custom
     # setup when bug #1300246 is resolved.
-    iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
     iniset $HEAT_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
-    iniset $HEAT_CONF keystone_authtoken admin_user heat
-    iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
-    iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
-    iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
-
-    # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
-
-    # paste_deploy
     if [[ "$HEAT_STANDALONE" = "True" ]]; then
         iniset $HEAT_CONF paste_deploy flavor standalone
-        iniset $HEAT_CONF DEFAULT keystone_backend heat_keystoneclient_v2.client.KeystoneClientV2
         iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
+    else
+        iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+        iniset $HEAT_CONF keystone_authtoken admin_user heat
+        iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
+        iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+        iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
+        iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
     fi
 
+    # ec2authtoken
+    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
+
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
     iniset $HEAT_CONF heat_api workers "$API_WORKERS"
@@ -243,29 +245,32 @@ function stop_heat {
 
 # create_heat_accounts() - Set up common required heat accounts
 function create_heat_accounts {
-    create_service_user "heat" "admin"
-
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        local heat_service=$(get_or_create_service "heat" \
-                "orchestration" "Heat Orchestration Service")
-        get_or_create_endpoint $heat_service \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
-
-        local heat_cfn_service=$(get_or_create_service "heat-cfn" \
-                "cloudformation" "Heat CloudFormation Service")
-        get_or_create_endpoint $heat_cfn_service \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
-    fi
+    if [[ "$HEAT_STANDALONE" != "True" ]]; then
+
+        create_service_user "heat" "admin"
+
+        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
+
+            local heat_service=$(get_or_create_service "heat" \
+                    "orchestration" "Heat Orchestration Service")
+            get_or_create_endpoint $heat_service \
+                "$REGION_NAME" \
+                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
+                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
+                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
+
+            local heat_cfn_service=$(get_or_create_service "heat-cfn" \
+                    "cloudformation" "Heat CloudFormation Service")
+            get_or_create_endpoint $heat_cfn_service \
+                "$REGION_NAME" \
+                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
+                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
+                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
+        fi
 
-    # heat_stack_user role is for users created by Heat
-    get_or_create_role "heat_stack_user"
+        # heat_stack_user role is for users created by Heat
+        get_or_create_role "heat_stack_user"
+    fi
 
     if [[ $HEAT_DEFERRED_AUTH == trusts ]]; then
         iniset $HEAT_CONF DEFAULT deferred_auth_method trusts
diff --git a/stack.sh b/stack.sh
index eac7eec724..f049782387 100755
--- a/stack.sh
+++ b/stack.sh
@@ -978,7 +978,7 @@ if is_service_enabled keystone; then
         create_swift_accounts
     fi
 
-    if is_service_enabled heat && [[ "$HEAT_STANDALONE" != "True" ]]; then
+    if is_service_enabled heat; then
         create_heat_accounts
     fi
 

From fdf00f27db19f572ac1d8fd3714c5b412556dbf3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 13 Mar 2015 11:50:02 +1100
Subject: [PATCH 0451/3333] Add defaults for yum proxy variables

Without these defaults, sourcing functions-common with -u turned on
(as say ./tools/build_wheels.sh does) will bail out with unset
variable errors.  Also fix up quoting, and add no_proxy for zypper run

Change-Id: Ideb441634243c1c5ce7db3a375c2d98617e9d1dc
---
 functions-common | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 4739e42e90..838ca53f6a 100644
--- a/functions-common
+++ b/functions-common
@@ -1019,8 +1019,8 @@ function yum_install {
     # The manual check for missing packages is because yum -y assumes
     # missing packages are OK.  See
     # https://bugzilla.redhat.com/show_bug.cgi?id=965567
-    $sudo http_proxy=$http_proxy https_proxy=$https_proxy \
-        no_proxy=$no_proxy \
+    $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}" \
+        no_proxy="${no_proxy:-}" \
         ${YUM:-yum} install -y "$@" 2>&1 | \
         awk '
             BEGIN { fail=0 }
@@ -1042,7 +1042,8 @@ function zypper_install {
     [[ "$OFFLINE" = "True" ]] && return
     local sudo="sudo"
     [[ "$(id -u)" = "0" ]] && sudo="env"
-    $sudo http_proxy=$http_proxy https_proxy=$https_proxy \
+    $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}" \
+        no_proxy="${no_proxy:-}" \
         zypper --non-interactive install --auto-agree-with-licenses "$@"
 }
 

From ee78c9e2f6076db2db1b2fc3c1178905de6f7e5d Mon Sep 17 00:00:00 2001
From: Josh Gachnang <josh@pcsforeducation.com>
Date: Mon, 16 Mar 2015 23:24:52 -0700
Subject: [PATCH 0452/3333] Add Ironic cleaning network

The cleaning network is where ramdisks will be booted during
the cleaning process. We want to ensure nodes are being properly
cleaned on tear down.

Change-Id: Ic38de10668c97648d073fdf9a3afc59712057849
Implements: bp/implement-cleaning-states
---
 lib/ironic | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/ironic b/lib/ironic
index 35b5411cd4..71f9933d36 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -427,6 +427,11 @@ function create_ironic_accounts {
 
 # init_ironic() - Initialize databases, etc.
 function init_ironic {
+    # Save private network as cleaning network
+    local cleaning_network_uuid
+    cleaning_network_uuid=$(neutron net-list | grep private | get_field 1)
+    iniset $IRONIC_CONF_FILE neutron cleaning_network_uuid ${cleaning_network_uuid}
+
     # (Re)create  ironic database
     recreate_database ironic
 

From 8421c2b9ab5d8242abb7d1bdc20435408db8b802 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Mon, 16 Mar 2015 13:52:19 -0500
Subject: [PATCH 0453/3333] Use install(1) where possible

This eliminated a number of sudo calls by doing the copy/chown/chmod in
a single step and sets a common pattern.

Change-Id: I9c8f48854d5bc443cc187df0948c28b82c4d2838
---
 lib/ceilometer |  9 ++-------
 lib/cinder     | 21 ++++++++-------------
 lib/glance     | 18 +++---------------
 lib/heat       | 16 ++++------------
 lib/ironic     | 17 ++++-------------
 lib/keystone   | 11 +++--------
 lib/neutron    | 20 ++++++--------------
 lib/nova       | 27 ++++++++++-----------------
 lib/sahara     | 10 ++--------
 lib/swift      | 10 ++++------
 lib/tempest    |  8 ++------
 lib/trove      |  5 +----
 lib/zaqar      |  6 ++----
 13 files changed, 51 insertions(+), 127 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 9db0640940..318c5467cf 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -163,11 +163,7 @@ function _config_ceilometer_apache_wsgi {
 
 # configure_ceilometer() - Set config files, create data dirs, etc
 function configure_ceilometer {
-    [ ! -d $CEILOMETER_CONF_DIR ] && sudo mkdir -m 755 -p $CEILOMETER_CONF_DIR
-    sudo chown $STACK_USER $CEILOMETER_CONF_DIR
-
-    [ ! -d $CEILOMETER_API_LOG_DIR ] &&  sudo mkdir -m 755 -p $CEILOMETER_API_LOG_DIR
-    sudo chown $STACK_USER $CEILOMETER_API_LOG_DIR
+    sudo install -d -o $STACK_USER -m 755 $CEILOMETER_CONF_DIR $CEILOMETER_API_LOG_DIR
 
     iniset_rpc_backend ceilometer $CEILOMETER_CONF DEFAULT
 
@@ -267,8 +263,7 @@ function configure_mongodb {
 # init_ceilometer() - Initialize etc.
 function init_ceilometer {
     # Create cache dir
-    sudo mkdir -p $CEILOMETER_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $CEILOMETER_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER $CEILOMETER_AUTH_CACHE_DIR
     rm -f $CEILOMETER_AUTH_CACHE_DIR/*
 
     if is_service_enabled mysql postgresql; then
diff --git a/lib/cinder b/lib/cinder
index 880af1fd40..51f0163e44 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -174,16 +174,15 @@ function configure_cinder_rootwrap {
     if [[ -d $CINDER_CONF_DIR/rootwrap.d ]]; then
         sudo rm -rf $CINDER_CONF_DIR/rootwrap.d
     fi
+
     # Deploy filters to /etc/cinder/rootwrap.d
-    sudo mkdir -m 755 $CINDER_CONF_DIR/rootwrap.d
-    sudo cp $CINDER_DIR/etc/cinder/rootwrap.d/*.filters $CINDER_CONF_DIR/rootwrap.d
-    sudo chown -R root:root $CINDER_CONF_DIR/rootwrap.d
-    sudo chmod 644 $CINDER_CONF_DIR/rootwrap.d/*
+    sudo install -d -o root -g root -m 755 $CINDER_CONF_DIR/rootwrap.d
+    sudo install -o root -g root -m 644 $CINDER_DIR/etc/cinder/rootwrap.d/*.filters $CINDER_CONF_DIR/rootwrap.d
+
     # Set up rootwrap.conf, pointing to /etc/cinder/rootwrap.d
-    sudo cp $CINDER_DIR/etc/cinder/rootwrap.conf $CINDER_CONF_DIR/
+    sudo install -o root -g root -m 644 $CINDER_DIR/etc/cinder/rootwrap.conf $CINDER_CONF_DIR
     sudo sed -e "s:^filters_path=.*$:filters_path=$CINDER_CONF_DIR/rootwrap.d:" -i $CINDER_CONF_DIR/rootwrap.conf
-    sudo chown root:root $CINDER_CONF_DIR/rootwrap.conf
-    sudo chmod 0644 $CINDER_CONF_DIR/rootwrap.conf
+
     # Specify rootwrap.conf as first parameter to rootwrap
     ROOTWRAP_CSUDOER_CMD="$cinder_rootwrap $CINDER_CONF_DIR/rootwrap.conf *"
 
@@ -197,10 +196,7 @@ function configure_cinder_rootwrap {
 
 # configure_cinder() - Set config files, create data dirs, etc
 function configure_cinder {
-    if [[ ! -d $CINDER_CONF_DIR ]]; then
-        sudo mkdir -p $CINDER_CONF_DIR
-    fi
-    sudo chown $STACK_USER $CINDER_CONF_DIR
+    sudo install -d -o $STACK_USER -m 755 $CINDER_CONF_DIR
 
     cp -p $CINDER_DIR/etc/cinder/policy.json $CINDER_CONF_DIR
 
@@ -351,8 +347,7 @@ function create_cinder_accounts {
 # create_cinder_cache_dir() - Part of the init_cinder() process
 function create_cinder_cache_dir {
     # Create cache dir
-    sudo mkdir -p $CINDER_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $CINDER_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
     rm -f $CINDER_AUTH_CACHE_DIR/*
 }
 
diff --git a/lib/glance b/lib/glance
index eb1df2e8ae..db3de17232 100755
--- a/lib/glance
+++ b/lib/glance
@@ -90,15 +90,7 @@ function cleanup_glance {
 
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
-    if [[ ! -d $GLANCE_CONF_DIR ]]; then
-        sudo mkdir -p $GLANCE_CONF_DIR
-    fi
-    sudo chown $STACK_USER $GLANCE_CONF_DIR
-
-    if [[ ! -d $GLANCE_METADEF_DIR ]]; then
-        sudo mkdir -p $GLANCE_METADEF_DIR
-    fi
-    sudo chown $STACK_USER $GLANCE_METADEF_DIR
+    sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
     # Copy over our glance configurations and update them
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
@@ -263,12 +255,8 @@ function create_glance_accounts {
 # create_glance_cache_dir() - Part of the init_glance() process
 function create_glance_cache_dir {
     # Create cache dir
-    sudo mkdir -p $GLANCE_AUTH_CACHE_DIR/api
-    sudo chown $STACK_USER $GLANCE_AUTH_CACHE_DIR/api
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/*
-    sudo mkdir -p $GLANCE_AUTH_CACHE_DIR/registry
-    sudo chown $STACK_USER $GLANCE_AUTH_CACHE_DIR/registry
-    rm -f $GLANCE_AUTH_CACHE_DIR/registry/*
+    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry
+    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/*
 }
 
 # init_glance() - Initialize databases, etc.
diff --git a/lib/heat b/lib/heat
index a088e82886..d75652ab7b 100644
--- a/lib/heat
+++ b/lib/heat
@@ -85,10 +85,7 @@ function configure_heat {
         setup_develop $HEAT_DIR/contrib/heat_keystoneclient_v2
     fi
 
-    if [[ ! -d $HEAT_CONF_DIR ]]; then
-        sudo mkdir -p $HEAT_CONF_DIR
-    fi
-    sudo chown $STACK_USER $HEAT_CONF_DIR
+    sudo install -d -o $STACK_USER $HEAT_CONF_DIR
     # remove old config files
     rm -f $HEAT_CONF_DIR/heat-*.conf
 
@@ -172,15 +169,11 @@ function configure_heat {
         iniset $HEAT_CONF DEFAULT enable_stack_abandon true
     fi
 
-    # heat environment
-    sudo mkdir -p $HEAT_ENV_DIR
-    sudo chown $STACK_USER $HEAT_ENV_DIR
+    sudo install -d -o $STACK_USER $HEAT_ENV_DIR $HEAT_TEMPLATES_DIR
+
     # copy the default environment
     cp $HEAT_DIR/etc/heat/environment.d/* $HEAT_ENV_DIR/
 
-    # heat template resources.
-    sudo mkdir -p $HEAT_TEMPLATES_DIR
-    sudo chown $STACK_USER $HEAT_TEMPLATES_DIR
     # copy the default templates
     cp $HEAT_DIR/etc/heat/templates/* $HEAT_TEMPLATES_DIR/
 
@@ -199,8 +192,7 @@ function init_heat {
 # create_heat_cache_dir() - Part of the init_heat() process
 function create_heat_cache_dir {
     # Create cache dirs
-    sudo mkdir -p $HEAT_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $HEAT_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER $HEAT_AUTH_CACHE_DIR
 }
 
 # install_heatclient() - Collect source and prepare
diff --git a/lib/ironic b/lib/ironic
index 35b5411cd4..2fddc54b63 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -233,22 +233,14 @@ function cleanup_ironic {
 # configure_ironic_dirs() - Create all directories required by Ironic and
 # associated services.
 function configure_ironic_dirs {
-    if [[ ! -d $IRONIC_CONF_DIR ]]; then
-        sudo mkdir -p $IRONIC_CONF_DIR
-    fi
+    sudo install -d -o $STACK_USER $IRONIC_CONF_DIR $STACK_USER $IRONIC_DATA_DIR \
+        $IRONIC_STATE_PATH $IRONIC_TFTPBOOT_DIR $IRONIC_TFTPBOOT_DIR/pxelinux.cfg
+    sudo chown -R $STACK_USER:$LIBVIRT_GROUP $IRONIC_TFTPBOOT_DIR
 
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        sudo mkdir -p $IRONIC_HTTP_DIR
-        sudo chown -R $STACK_USER:$LIBVIRT_GROUP $IRONIC_HTTP_DIR
+        sudo install -d -o $STACK_USER -g $LIBVIRT_GROUP $IRONIC_HTTP_DIR
     fi
 
-    sudo mkdir -p $IRONIC_DATA_DIR
-    sudo mkdir -p $IRONIC_STATE_PATH
-    sudo mkdir -p $IRONIC_TFTPBOOT_DIR
-    sudo chown -R $STACK_USER $IRONIC_DATA_DIR $IRONIC_STATE_PATH
-    sudo chown -R $STACK_USER:$LIBVIRT_GROUP $IRONIC_TFTPBOOT_DIR
-    mkdir -p $IRONIC_TFTPBOOT_DIR/pxelinux.cfg
-
     if [ ! -f $IRONIC_PXE_BOOT_IMAGE ]; then
         die $LINENO "PXE boot file $IRONIC_PXE_BOOT_IMAGE not found."
     fi
@@ -267,7 +259,6 @@ function configure_ironic_dirs {
 # configure_ironic() - Set config files, create data dirs, etc
 function configure_ironic {
     configure_ironic_dirs
-    sudo chown $STACK_USER $IRONIC_CONF_DIR
 
     # Copy over ironic configuration file and configure common parameters.
     cp $IRONIC_DIR/etc/ironic/ironic.conf.sample $IRONIC_CONF_FILE
diff --git a/lib/keystone b/lib/keystone
index 0968445dc0..9dfdc608d4 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -175,14 +175,10 @@ function _config_keystone_apache_wsgi {
 
 # configure_keystone() - Set config files, create data dirs, etc
 function configure_keystone {
-    if [[ ! -d $KEYSTONE_CONF_DIR ]]; then
-        sudo mkdir -p $KEYSTONE_CONF_DIR
-    fi
-    sudo chown $STACK_USER $KEYSTONE_CONF_DIR
+    sudo install -d -o $STACK_USER $KEYSTONE_CONF_DIR
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
-        cp -p $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
-        chmod 600 $KEYSTONE_CONF
+        install -m 600 $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
         cp -p $KEYSTONE_DIR/etc/policy.json $KEYSTONE_CONF_DIR
         if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
             cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
@@ -490,8 +486,7 @@ function init_keystone {
         $KEYSTONE_DIR/bin/keystone-manage pki_setup
 
         # Create cache dir
-        sudo mkdir -p $KEYSTONE_AUTH_CACHE_DIR
-        sudo chown $STACK_USER $KEYSTONE_AUTH_CACHE_DIR
+        sudo install -d -o $STACK_USER $KEYSTONE_AUTH_CACHE_DIR
         rm -f $KEYSTONE_AUTH_CACHE_DIR/*
     fi
 }
diff --git a/lib/neutron b/lib/neutron
index e41abafda9..d0463d8089 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -495,8 +495,7 @@ function create_nova_conf_neutron {
 # create_neutron_cache_dir() - Part of the _neutron_setup_keystone() process
 function create_neutron_cache_dir {
     # Create cache dir
-    sudo mkdir -p $NEUTRON_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $NEUTRON_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
     rm -f $NEUTRON_AUTH_CACHE_DIR/*
 }
 
@@ -800,10 +799,7 @@ function cleanup_neutron {
 
 function _create_neutron_conf_dir {
     # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
-    if [[ ! -d $NEUTRON_CONF_DIR ]]; then
-        sudo mkdir -p $NEUTRON_CONF_DIR
-    fi
-    sudo chown $STACK_USER $NEUTRON_CONF_DIR
+    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 }
 
 # _configure_neutron_common()
@@ -1075,10 +1071,8 @@ function _neutron_service_plugin_class_add {
 # _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
 function _neutron_deploy_rootwrap_filters {
     local srcdir=$1
-    mkdir -p -m 755 $Q_CONF_ROOTWRAP_D
-    sudo cp -pr $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
-    sudo chown -R root:root $Q_CONF_ROOTWRAP_D
-    sudo chmod 644 $Q_CONF_ROOTWRAP_D/*
+    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
+    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
 }
 
 # _neutron_setup_rootwrap() - configure Neutron's rootwrap
@@ -1097,13 +1091,11 @@ function _neutron_setup_rootwrap {
     # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
     # location moved in newer versions, prefer new location
     if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
-        sudo cp -p $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     else
-        sudo cp -p $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
-    sudo chown root:root $Q_RR_CONF_FILE
-    sudo chmod 0644 $Q_RR_CONF_FILE
     # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
     ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
 
diff --git a/lib/nova b/lib/nova
index 199daeea3d..e850fe9daf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -232,16 +232,15 @@ function configure_nova_rootwrap {
     if [[ -d $NOVA_CONF_DIR/rootwrap.d ]]; then
         sudo rm -rf $NOVA_CONF_DIR/rootwrap.d
     fi
+
     # Deploy filters to /etc/nova/rootwrap.d
-    sudo mkdir -m 755 $NOVA_CONF_DIR/rootwrap.d
-    sudo cp $NOVA_DIR/etc/nova/rootwrap.d/*.filters $NOVA_CONF_DIR/rootwrap.d
-    sudo chown -R root:root $NOVA_CONF_DIR/rootwrap.d
-    sudo chmod 644 $NOVA_CONF_DIR/rootwrap.d/*
+    sudo install -d -o root -g root -m 755 $NOVA_CONF_DIR/rootwrap.d
+    sudo install -o root -g root -m 644  $NOVA_DIR/etc/nova/rootwrap.d/*.filters $NOVA_CONF_DIR/rootwrap.d
+
     # Set up rootwrap.conf, pointing to /etc/nova/rootwrap.d
-    sudo cp $NOVA_DIR/etc/nova/rootwrap.conf $NOVA_CONF_DIR/
+    sudo install -o root -g root -m 644 $NOVA_DIR/etc/nova/rootwrap.conf $NOVA_CONF_DIR
     sudo sed -e "s:^filters_path=.*$:filters_path=$NOVA_CONF_DIR/rootwrap.d:" -i $NOVA_CONF_DIR/rootwrap.conf
-    sudo chown root:root $NOVA_CONF_DIR/rootwrap.conf
-    sudo chmod 0644 $NOVA_CONF_DIR/rootwrap.conf
+
     # Specify rootwrap.conf as first parameter to nova-rootwrap
     local rootwrap_sudoer_cmd="$NOVA_ROOTWRAP $NOVA_CONF_DIR/rootwrap.conf *"
 
@@ -256,10 +255,7 @@ function configure_nova_rootwrap {
 # configure_nova() - Set config files, create data dirs, etc
 function configure_nova {
     # Put config files in ``/etc/nova`` for everyone to find
-    if [[ ! -d $NOVA_CONF_DIR ]]; then
-        sudo mkdir -p $NOVA_CONF_DIR
-    fi
-    sudo chown $STACK_USER $NOVA_CONF_DIR
+    sudo install -d -o $STACK_USER $NOVA_CONF_DIR
 
     cp -p $NOVA_DIR/etc/nova/policy.json $NOVA_CONF_DIR
 
@@ -318,8 +314,7 @@ function configure_nova {
         # ----------------
 
         # Nova stores each instance in its own directory.
-        sudo mkdir -p $NOVA_INSTANCES_PATH
-        sudo chown -R $STACK_USER $NOVA_INSTANCES_PATH
+        sudo install -d -o $STACK_USER $NOVA_INSTANCES_PATH
 
         # You can specify a different disk to be mounted and used for backing the
         # virtual machines.  If there is a partition labeled nova-instances we
@@ -603,8 +598,7 @@ function init_nova_cells {
 # create_nova_cache_dir() - Part of the init_nova() process
 function create_nova_cache_dir {
     # Create cache dir
-    sudo mkdir -p $NOVA_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $NOVA_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
     rm -f $NOVA_AUTH_CACHE_DIR/*
 }
 
@@ -621,8 +615,7 @@ function create_nova_conf_nova_network {
 # create_nova_keys_dir() - Part of the init_nova() process
 function create_nova_keys_dir {
     # Create keys dir
-    sudo mkdir -p ${NOVA_STATE_PATH}/keys
-    sudo chown -R $STACK_USER ${NOVA_STATE_PATH}
+    sudo install -d -o $STACK_USER ${NOVA_STATE_PATH} ${NOVA_STATE_PATH}/keys
 }
 
 # init_nova() - Initialize databases, etc.
diff --git a/lib/sahara b/lib/sahara
index 521b19a4a1..f389326a6f 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -101,11 +101,7 @@ function cleanup_sahara {
 
 # configure_sahara() - Set config files, create data dirs, etc
 function configure_sahara {
-
-    if [[ ! -d $SAHARA_CONF_DIR ]]; then
-        sudo mkdir -p $SAHARA_CONF_DIR
-    fi
-    sudo chown $STACK_USER $SAHARA_CONF_DIR
+    sudo install -d -o $STACK_USER $SAHARA_CONF_DIR
 
     if [[ -f $SAHARA_DIR/etc/sahara/policy.json ]]; then
         cp -p $SAHARA_DIR/etc/sahara/policy.json $SAHARA_CONF_DIR
@@ -115,9 +111,7 @@ function configure_sahara {
     cp $SAHARA_DIR/etc/sahara/sahara.conf.sample $SAHARA_CONF_FILE
 
     # Create auth cache dir
-    sudo mkdir -p $SAHARA_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $SAHARA_AUTH_CACHE_DIR
-    sudo chmod 700 $SAHARA_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER -m 700 $SAHARA_AUTH_CACHE_DIR
     rm -rf $SAHARA_AUTH_CACHE_DIR/*
 
     configure_auth_token_middleware $SAHARA_CONF_FILE sahara $SAHARA_AUTH_CACHE_DIR
diff --git a/lib/swift b/lib/swift
index 4a63500b54..9781e862db 100644
--- a/lib/swift
+++ b/lib/swift
@@ -306,8 +306,8 @@ function configure_swift {
     # Make sure to kill all swift processes first
     swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
 
-    sudo mkdir -p ${SWIFT_CONF_DIR}/{object,container,account}-server
-    sudo chown -R ${STACK_USER}: ${SWIFT_CONF_DIR}
+    sudo install -d -o ${STACK_USER} ${SWIFT_CONF_DIR}
+    sudo install -d -o ${STACK_USER} ${SWIFT_CONF_DIR}/{object,container,account}-server
 
     if [[ "$SWIFT_CONF_DIR" != "/etc/swift" ]]; then
         # Some swift tools are hard-coded to use ``/etc/swift`` and are apparently not going to be fixed.
@@ -534,8 +534,7 @@ function create_swift_disk {
     # changing the permissions so we can run it as our user.
 
     local user_group=$(id -g ${STACK_USER})
-    sudo mkdir -p ${SWIFT_DATA_DIR}/{drives,cache,run,logs}
-    sudo chown -R ${STACK_USER}:${user_group} ${SWIFT_DATA_DIR}
+    sudo install -d -o ${STACK_USER} -g ${user_group} ${SWIFT_DATA_DIR}/{drives,cache,run,logs}
 
     # Create a loopback disk and format it to XFS.
     if [[ -e ${SWIFT_DISK_IMAGE} ]]; then
@@ -675,8 +674,7 @@ function init_swift {
     } && popd >/dev/null
 
     # Create cache dir
-    sudo mkdir -p $SWIFT_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $SWIFT_AUTH_CACHE_DIR
+    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
     rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
diff --git a/lib/tempest b/lib/tempest
index f856ce05f9..99cfc5857b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -170,12 +170,8 @@ function configure_tempest {
 
     # Create tempest.conf from tempest.conf.sample
     # copy every time, because the image UUIDS are going to change
-    if [[ ! -d $TEMPEST_CONFIG_DIR ]]; then
-        sudo mkdir -p $TEMPEST_CONFIG_DIR
-    fi
-    sudo chown $STACK_USER $TEMPEST_CONFIG_DIR
-    cp $TEMPEST_DIR/etc/tempest.conf.sample $TEMPEST_CONFIG
-    chmod 644 $TEMPEST_CONFIG
+    sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
+    install -m 644 $TEMPEST_DIR/etc/tempest.conf.sample $TEMPEST_CONFIG
 
     password=${ADMIN_PASSWORD:-secrete}
 
diff --git a/lib/trove b/lib/trove
index d77798308b..dab6dced54 100644
--- a/lib/trove
+++ b/lib/trove
@@ -121,10 +121,7 @@ function configure_trove {
     setup_develop $TROVE_DIR
 
     # Create the trove conf dir and cache dirs if they don't exist
-    sudo mkdir -p ${TROVE_CONF_DIR}
-    sudo mkdir -p ${TROVE_AUTH_CACHE_DIR}
-    sudo chown -R $STACK_USER: ${TROVE_CONF_DIR}
-    sudo chown -R $STACK_USER: ${TROVE_AUTH_CACHE_DIR}
+    sudo install -d -o $STACK_USER ${TROVE_CONF_DIR} ${TROVE_AUTH_CACHE_DIR}
 
     # Copy api-paste file over to the trove conf dir
     cp $TROVE_LOCAL_API_PASTE_INI $TROVE_API_PASTE_INI
diff --git a/lib/zaqar b/lib/zaqar
index 79b4c5a2ca..5f3f7bb20b 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -105,8 +105,7 @@ function configure_zaqarclient {
 function configure_zaqar {
     setup_develop $ZAQAR_DIR
 
-    [ ! -d $ZAQAR_CONF_DIR ] && sudo mkdir -m 755 -p $ZAQAR_CONF_DIR
-    sudo chown $USER $ZAQAR_CONF_DIR
+    sudo install -d -o $STACK_USER -m 755 $ZAQAR_CONF_DIR
 
     iniset $ZAQAR_CONF DEFAULT debug True
     iniset $ZAQAR_CONF DEFAULT verbose True
@@ -168,8 +167,7 @@ function configure_mongodb {
 # init_zaqar() - Initialize etc.
 function init_zaqar {
     # Create cache dir
-    sudo mkdir -p $ZAQAR_AUTH_CACHE_DIR
-    sudo chown $STACK_USER $ZAQAR_AUTH_CACHE_DIR
+    sudo install -d -o $STACK_USER $ZAQAR_AUTH_CACHE_DIR
     rm -f $ZAQAR_AUTH_CACHE_DIR/*
 }
 

From 199c6048fd209d87c87c0bb40860f4b4b2661a5e Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <pshchelokovskyy@mirantis.com>
Date: Wed, 18 Mar 2015 10:48:47 +0000
Subject: [PATCH 0454/3333] Recreate tox venv for tempest on stack.sh run

Sometimes when certain dependencies are changed, recreating an existing
DevStack fails, as tempest is using an old existing venv for tox run,
where dependencies are not met.

This change should help developers who are reusing
their existing DevStack.
The gate should not be affected as there the vev is freshly created
anyway.

Change-Id: Ic42ba1cb0aa829c5120151d3d8cdafa4efc3ffaa
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index fcb0e59937..655bb08368 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -337,7 +337,7 @@ function configure_tempest {
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
     local tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -evenv -- verify-tempest-config -uro $tmp_cfg_file
+    tox -revenv -- verify-tempest-config -uro $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then

From 4bf861c76c220a98a3b3165eea5448411d000f3a Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith@solidfire.com>
Date: Tue, 17 Mar 2015 21:07:39 -0600
Subject: [PATCH 0455/3333] Create global_filter to avoid scan of missing devs

A while back I added an lvm.conf file with a device filter setting
to try and clean up the LVM hangs in the gate:
  (commit 0b9e76f280208b5b5ad54bb6fbc4133e63037286)

It turns out this wasn't the real problem, the real problem
is that on an LVS/VGS command LVM  will attempt to open and read
all potential block devices in /dev to see if they have LVM data
on them.  I initially thought the local filter would keep that
from happening, as it turns out the local filter only limits what's
returned AFTER the actual scan process.  In order to keep the scan
from happening at all, either a global_filter needs to be used or
lvmetad needs to be running and enabled.

There are situations in gate tests where /dev/sdX devices are created and
deleted and the result is that we hit situations where LVM tries
to open up devices to check them even if they've been removed.  The
result is we have a blocking open call from LVM that takes approx
60 seconds to time out and fail.

Ubuntu won't have a version of lvmetad until Vivid, so for now
that just leaves the global_filter as an option.

This patch adds the filter routine to the end of stack.sh.  We don't
want to put the routine in lib/cinder_backend/lvm like we had it because
now we have to set the global filter for all LVM commands on the system.
So we put this as one of the last steps in stack.sh and run it if Cinder
is enabled.  This way we can query PV's on the system regardless of what
other services may be running and using LVM and make sure that all of
their devices are added to the filter as well.

Also, make sure we only set this for Ubuntu as Fedora/RHEL variants
utilize lvmetad.

This patch also removes the old change that set the local filter.

DocImpact
Should add this to recommended config for Cinder on systems
that don't have lvmetad, and recommend lvmetad for those that do.

Change-Id: I5d5c48e188cbb9b4208096736807f082bce524e8
Closes-Bug: #1373513
---
 lib/cinder              | 17 -----------------
 lib/cinder_backends/lvm | 31 -------------------------------
 lib/lvm                 | 25 +++++++++++++++++++++++++
 stack.sh                |  9 +++++++++
 4 files changed, 34 insertions(+), 48 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 880af1fd40..958c7f05ac 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,15 +372,9 @@ function init_cinder {
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local be be_name be_type
-        local has_lvm=0
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_type=${be%%:*}
             be_name=${be##*:}
-
-            if [[ $be_type == 'lvm' ]]; then
-                has_lvm=1
-            fi
-
             if type init_cinder_backend_${be_type} >/dev/null 2>&1; then
                 # Always init the default volume group for lvm.
                 if [[ "$be_type" == "lvm" ]]; then
@@ -391,17 +385,6 @@ function init_cinder {
         done
     fi
 
-    # Keep it simple, set a marker if there's an LVM backend
-    # use the created VG's to setup lvm filters
-    if [[ $has_lvm == 1 ]]; then
-        # Order matters here, not only obviously to make
-        # sure the VG's are created, but also some distros
-        # do some customizations to lvm.conf on init, we
-        # want to make sure we copy those over
-        sudo cp /etc/lvm/lvm.conf /etc/cinder/lvm.conf
-        configure_cinder_backend_conf_lvm
-    fi
-
     mkdir -p $CINDER_STATE_PATH/volumes
     create_cinder_cache_dir
 }
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 52fc6fbf63..f210578339 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -19,7 +19,6 @@
 # clean_cinder_backend_lvm - called from clean_cinder()
 # configure_cinder_backend_lvm - called from configure_cinder()
 # init_cinder_backend_lvm - called from init_cinder()
-# configure_cinder_backend_conf_lvm - called from configure_cinder()
 
 
 # Save trace setting
@@ -66,36 +65,6 @@ function init_cinder_backend_lvm {
     init_lvm_volume_group $VOLUME_GROUP_NAME-$be_name $VOLUME_BACKING_FILE_SIZE
 }
 
-# configure_cinder_backend_conf_lvm - Sets device filter in /etc/cinder/lvm.conf
-# init_cinder_backend_lvm
-function configure_cinder_backend_conf_lvm {
-    local filter_suffix='"r/.*/" ]'
-    local filter_string="filter = [ "
-    local conf_entries=$(grep volume_group /etc/cinder/cinder.conf | sed "s/ //g")
-    local pv
-    local vg
-    local line
-
-    for pv_info in $(sudo pvs --noheadings -o name,vg_name --separator ';'); do
-        echo_summary "Evaluate PV info for Cinder lvm.conf: $pv_info"
-        IFS=';' read pv vg <<< "$pv_info"
-        for line in ${conf_entries}; do
-            IFS='=' read label group <<< "$line"
-            group=$(echo $group|sed "s/^ *//g")
-            if [[ "$vg" == "$group" ]]; then
-                new="\"a$pv/\", "
-                filter_string=$filter_string$new
-            fi
-        done
-    done
-    filter_string=$filter_string$filter_suffix
-
-    # FIXME(jdg): Possible odd case that the lvm.conf file has been modified
-    # and doesn't have a filter entry to search/replace.  For devstack don't
-    # know that we care, but could consider adding a check and add
-    sudo sed -i "s#^[ \t]*filter.*#    $filter_string#g" /etc/cinder/lvm.conf
-    echo "set LVM filter_strings: $filter_string"
-}
 # Restore xtrace
 $MY_XTRACE
 
diff --git a/lib/lvm b/lib/lvm
index 39eed00675..d0322c76b3 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -138,6 +138,31 @@ function init_default_lvm_volume_group {
     fi
 }
 
+# set_lvm_filter() Gather all devices configured for LVM and
+# use them to build a global device filter
+# set_lvm_filter() Create a device filter
+# and add to /etc/lvm.conf.  Note this uses
+# all current PV's in use by LVM on the
+# system to build it's filter.
+#
+# Usage: set_lvm_filter()
+function set_lvm_filter {
+    local filter_suffix='"r|.*|" ]'
+    local filter_string="global_filter = [ "
+    local pv
+    local vg
+    local line
+
+    for pv_info in $(sudo pvs --noheadings -o name); do
+        pv=$(echo -e "${pv_info}" | sed 's/ //g' | sed 's/\/dev\///g')
+        new="\"a|$pv|\", "
+        filter_string=$filter_string$new
+    done
+    filter_string=$filter_string$filter_suffix
+
+    sudo sed -i "/# global_filter = \[*\]/a\    $global_filter$filter_string" /etc/lvm/lvm.conf
+    echo_summary "set lvm.conf device global_filter to: $filter_string"
+}
 
 # Restore xtrace
 $MY_XTRACE
diff --git a/stack.sh b/stack.sh
index eac7eec724..ee1b985eab 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1316,6 +1316,15 @@ service_check
 # Prepare bash completion for OSC
 openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
+# If cinder is configured, set global_filter for PV devices
+if is_service_enabled cinder; then
+    if is_ubuntu; then
+        echo_summary "Configuring lvm.conf global device filter"
+        set_lvm_filter
+    else
+        echo_summary "Skip setting lvm filters for non Ubuntu systems"
+    fi
+fi
 
 # Fin
 # ===

From 16819951038c464d330233d0d3df4173420f14ae Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Wed, 18 Mar 2015 13:45:40 +1300
Subject: [PATCH 0456/3333] Install missing heat agent projects

This change adds the dib-utils repo, and adds git_clone calls for the
required os-*-config projects.

Change-Id: I2641feb0c462d2940f2698515ff62a2ff06c0e70
---
 lib/heat | 7 ++++++-
 stackrc  | 4 ++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/heat b/lib/heat
index cef70692c7..b8a434bdb7 100644
--- a/lib/heat
+++ b/lib/heat
@@ -36,6 +36,7 @@ HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
 OCC_DIR=$DEST/os-collect-config
+DIB_UTILS_DIR=$DEST/dib-utils
 ORC_DIR=$DEST/os-refresh-config
 OAC_DIR=$DEST/os-apply-config
 
@@ -224,6 +225,10 @@ function install_heat {
 function install_heat_other {
     git_clone $HEAT_CFNTOOLS_REPO $HEAT_CFNTOOLS_DIR $HEAT_CFNTOOLS_BRANCH
     git_clone $HEAT_TEMPLATES_REPO $HEAT_TEMPLATES_REPO_DIR $HEAT_TEMPLATES_BRANCH
+    git_clone $OAC_REPO $OAC_DIR $OAC_BRANCH
+    git_clone $OCC_REPO $OCC_DIR $OCC_BRANCH
+    git_clone $ORC_REPO $ORC_DIR $ORC_BRANCH
+    git_clone $DIB_UTILS_REPO $DIB_UTILS_DIR $DIB_UTILS_BRANCH
 }
 
 # start_heat() - Start running processes, including screen
@@ -304,7 +309,7 @@ function create_heat_accounts {
 
 # build_heat_pip_mirror() - Build a pip mirror containing heat agent projects
 function build_heat_pip_mirror {
-    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
+    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR $DIB_UTILS_DIR"
     local projpath proj package
 
     rm -rf $HEAT_PIP_REPO
diff --git a/stackrc b/stackrc
index 02b12a36a0..f8d9c43c38 100644
--- a/stackrc
+++ b/stackrc
@@ -427,6 +427,10 @@ GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
 #
 ##################
 
+# run-parts script required by os-refresh-config
+DIB_UTILS_REPO=${DIB_UTILS_REPO:-${GIT_BASE}/openstack/dib-utils.git}
+DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-master}
+
 # os-apply-config configuration template tool
 OAC_REPO=${OAC_REPO:-${GIT_BASE}/openstack/os-apply-config.git}
 OAC_BRANCH=${OAC_BRANCH:-master}

From 886cbb2a86e475a7982df1d98ea8452d0f9873fd Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 18 Mar 2015 22:03:01 -0400
Subject: [PATCH 0457/3333] Set heat stack role in tempest config to _member_

In kilo heat started to use keystone delegations to perform the needed
operations, as part of this the need to set the explicit role in
devstack for stack management disappeared. However, in tempest as part
of the effort to make credentials configuration more explicit an option
was added to ensure that the users created by tempest have the proper
role set for stack management in the heat tests. This commit sets the
value of this config option in tempest to be the default role _member_
to reflect that there is no separate heat_stack_owner role created
anymore. (which is the tempest default value)

Change-Id: Id98a83f0a716de0fdb5f36d03407364830e8fa5f
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 9b44f47d57..5f7be3ccb9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -399,6 +399,7 @@ function configure_tempest {
         fi
         iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
+        iniset $TEMPEST_CONFIG orchestration stack_owner_role "_member_"
     fi
 
     # Scenario

From 4599fd174c0c10f3a7e51ad6cba5d4c74abac207 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Thu, 12 Mar 2015 21:30:58 -0400
Subject: [PATCH 0458/3333] Add roles when we create groups

We should prime the groups that were created with some roles on
projects. Eventually we can add users directly to the groups
and not have to resort to individual user assignments.

Change-Id: Icebafc06859f8879c584cfd67aa51cb0c9ce48af
---
 functions-common | 21 +++++++++++++++++++++
 lib/keystone     | 16 ++++++++++++++--
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 4739e42e90..67697671d3 100644
--- a/functions-common
+++ b/functions-common
@@ -728,6 +728,27 @@ function get_or_add_user_project_role {
     echo $user_role_id
 }
 
+# Gets or adds group role to project
+# Usage: get_or_add_group_project_role <role> <group> <project>
+function get_or_add_group_project_role {
+    # Gets group role id
+    local group_role_id=$(openstack role list \
+        --group $2 \
+        --project $3 \
+        --column "ID" \
+        --column "Name" \
+        | grep " $1 " | get_field 1)
+    if [[ -z "$group_role_id" ]]; then
+        # Adds role to group
+        group_role_id=$(openstack role add \
+            $1 \
+            --group $2 \
+            --project $3 \
+            | grep " id " | get_field 2)
+    fi
+    echo $group_role_id
+}
+
 # Gets or creates service
 # Usage: get_or_create_service <name> <type> <description>
 function get_or_create_service {
diff --git a/lib/keystone b/lib/keystone
index c9433d98fe..acc8c2c9d0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -362,6 +362,12 @@ function configure_keystone_extensions {
 # demo                 demo       Member, anotherrole
 # invisible_to_admin   demo       Member
 
+# Group                Users      Roles                 Tenant
+# ------------------------------------------------------------------
+# admins               admin      admin                 admin
+# nonadmin             demo       Member, anotherrole   demo
+
+
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
@@ -403,8 +409,14 @@ function create_keystone_accounts {
     get_or_add_user_project_role $another_role $demo_user $demo_tenant
     get_or_add_user_project_role $member_role $demo_user $invis_tenant
 
-    get_or_create_group "developers" "default" "openstack developers"
-    get_or_create_group "testers" "default"
+    local admin_group=$(get_or_create_group "admins" \
+        "default" "openstack admin group")
+    local non_admin_group=$(get_or_create_group "nonadmins" \
+        "default" "non-admin group")
+
+    get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
+    get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
+    get_or_add_group_project_role $admin_role $admin_group $admin_tenant
 
     # Keystone
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

From f26deea6b1d7a91da44979d8c7feaf1ff8970b25 Mon Sep 17 00:00:00 2001
From: yuntongjin <yuntongjin@gmail.com>
Date: Sat, 28 Feb 2015 10:50:34 +0800
Subject: [PATCH 0459/3333] create install_default_policy

Recent versions of oslo policy allow the use of a policy.d to break up
policy in a more user understandable way. Nova is going to use this in
Kilo to break out v2 and v2.1 API policy definitions.

This provides a unified helper for installing sample policies. It
makes some assumptions on project directory structure. Porting other
projects to use this can happen in the future.

Change-Id: Iec23b095176332414faf76a9c329f8bb5f3aa6c3
---
 functions-common | 22 ++++++++++++++++++++++
 lib/nova         |  2 +-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index df69cbad16..8d7db96606 100644
--- a/functions-common
+++ b/functions-common
@@ -787,6 +787,28 @@ function get_field {
     done
 }
 
+# install default policy
+# copy over a default policy.json and policy.d for projects
+function install_default_policy {
+    local project=$1
+    local project_uc=$(echo $1|tr a-z A-Z)
+    local conf_dir="${project_uc}_CONF_DIR"
+    # eval conf dir to get the variable
+    conf_dir="${!conf_dir}"
+    local project_dir="${project_uc}_DIR"
+    # eval project dir to get the variable
+    project_dir="${!project_dir}"
+    local sample_conf_dir="${project_dir}/etc/${project}"
+    local sample_policy_dir="${project_dir}/etc/${project}/policy.d"
+
+    # first copy any policy.json
+    cp -p $sample_conf_dir/policy.json $conf_dir
+    # then optionally copy over policy.d
+    if [[ -d $sample_policy_dir ]]; then
+        cp -r $sample_policy_dir $conf_dir/policy.d
+    fi
+}
+
 # Add a policy to a policy.json file
 # Do nothing if the policy already exists
 # ``policy_add policy_file policy_name policy_permissions``
diff --git a/lib/nova b/lib/nova
index e9e78c7bc4..fe61e83620 100644
--- a/lib/nova
+++ b/lib/nova
@@ -261,7 +261,7 @@ function configure_nova {
     fi
     sudo chown $STACK_USER $NOVA_CONF_DIR
 
-    cp -p $NOVA_DIR/etc/nova/policy.json $NOVA_CONF_DIR
+    install_default_policy nova
 
     configure_nova_rootwrap
 

From 9ebd65be32357a0554e4e5525037e7f1803077f8 Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Sun, 8 Mar 2015 23:51:55 +0200
Subject: [PATCH 0460/3333] Increase Swift disk size up to 2GB if Glance is
 enabled

Minimum Cinder volume size is 1GB so if Swift backend for Glance is only
1GB we can not upload volume to image.

Change-Id: Ifd4cb42bf96367ff3ada0c065fa258fa5ba635d9
---
 lib/swift | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/lib/swift b/lib/swift
index 8a96615d01..5005ba0e10 100644
--- a/lib/swift
+++ b/lib/swift
@@ -64,11 +64,19 @@ if is_service_enabled s-proxy && is_service_enabled swift3; then
     S3_SERVICE_PORT=${S3_SERVICE_PORT:-8080}
 fi
 
-# DevStack will create a loop-back disk formatted as XFS to store the
-# swift data. Set ``SWIFT_LOOPBACK_DISK_SIZE`` to the disk size in
-# kilobytes.
-# Default is 1 gigabyte.
-SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=1G
+if is_service_enabled g-api; then
+    # Minimum Cinder volume size is 1G so if Swift backend for Glance is
+    # only 1G we can not upload volume to image.
+    # Increase Swift disk size up to 2G
+    SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=2G
+else
+    # DevStack will create a loop-back disk formatted as XFS to store the
+    # swift data. Set ``SWIFT_LOOPBACK_DISK_SIZE`` to the disk size in
+    # kilobytes.
+    # Default is 1 gigabyte.
+    SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=1G
+fi
+
 # if tempest enabled the default size is 6 Gigabyte.
 if is_service_enabled tempest; then
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=${SWIFT_LOOPBACK_DISK_SIZE:-6G}

From 6f3f310848d1134ff73dd23e246ad00f7cd13365 Mon Sep 17 00:00:00 2001
From: Ryan Hsu <rhsu@vmware.com>
Date: Thu, 19 Mar 2015 16:26:45 -0700
Subject: [PATCH 0461/3333] Fix packages not getting installed if service name
 in base path

Currently, if devstack base path includes the name of a given
service (e.g. nova), then the service's prereq packages will
not be installed. This fix changes the checking the match
against the full path of the package list file rather than the
name of a given service.

Closes-Bug: #1434314
Change-Id: Ie81352ebd5691afc6d0019f71d5b62370e8bb95f
---
 functions-common | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index 875c2e697d..b191f3a2b9 100644
--- a/functions-common
+++ b/functions-common
@@ -918,42 +918,42 @@ function get_packages {
         # NOTE(sdague) n-api needs glance for now because that's where
         # glance client is
         if [[ $service == n-api ]]; then
-            if [[ ! $file_to_parse =~ nova ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/nova ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/nova"
             fi
-            if [[ ! $file_to_parse =~ glance ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/glance ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/glance"
             fi
         elif [[ $service == c-* ]]; then
-            if [[ ! $file_to_parse =~ cinder ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/cinder ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/cinder"
             fi
         elif [[ $service == ceilometer-* ]]; then
-            if [[ ! $file_to_parse =~ ceilometer ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/ceilometer ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/ceilometer"
             fi
         elif [[ $service == s-* ]]; then
-            if [[ ! $file_to_parse =~ swift ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/swift ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/swift"
             fi
         elif [[ $service == n-* ]]; then
-            if [[ ! $file_to_parse =~ nova ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/nova ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/nova"
             fi
         elif [[ $service == g-* ]]; then
-            if [[ ! $file_to_parse =~ glance ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/glance ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/glance"
             fi
         elif [[ $service == key* ]]; then
-            if [[ ! $file_to_parse =~ keystone ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/keystone ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/keystone"
             fi
         elif [[ $service == q-* ]]; then
-            if [[ ! $file_to_parse =~ neutron ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/neutron ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/neutron"
             fi
         elif [[ $service == ir-* ]]; then
-            if [[ ! $file_to_parse =~ ironic ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/ironic ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/ironic"
             fi
         fi

From 6f6e2fd2cc9517b09b98fc45912d21c8574a4f94 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Mar 2015 12:16:28 +1100
Subject: [PATCH 0462/3333] Move contributing into HACKING

contributing.rst doesn't add very much over the extant HACKING.rst, so
move some of the unique bits into HACKING.rst and then link that into
the documentation.

Change-Id: I0530f38eda92f8dd374c0ec224556ace6e679f54
---
 HACKING.rst                 | 54 ++++++++++++++++++---
 doc/source/contributing.rst | 94 -------------------------------------
 doc/source/hacking.rst      |  1 +
 doc/source/index.rst        |  4 +-
 4 files changed, 51 insertions(+), 102 deletions(-)
 delete mode 100644 doc/source/contributing.rst
 create mode 100644 doc/source/hacking.rst

diff --git a/HACKING.rst b/HACKING.rst
index b3c82a37a8..4971db250b 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -25,23 +25,63 @@ __ contribute_
 __ lp_
 .. _lp: https://launchpad.net/~devstack
 
+The `Gerrit review
+queue <https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z>`__
+is used for all commits.
+
 The primary script in DevStack is ``stack.sh``, which performs the bulk of the
 work for DevStack's use cases.  There is a subscript ``functions`` that contains
 generally useful shell functions and is used by a number of the scripts in
 DevStack.
 
-The ``lib`` directory contains sub-scripts for projects or packages that ``stack.sh``
-sources to perform much of the work related to those projects.  These sub-scripts
-contain configuration defaults and functions to configure, start and stop the project
-or package.  These variables and functions are also used by related projects,
-such as Grenade, to manage a DevStack installation.
-
 A number of additional scripts can be found in the ``tools`` directory that may
 be useful in supporting DevStack installations.  Of particular note are ``info.sh``
 to collect and report information about the installed system, and ``install_prereqs.sh``
 that handles installation of the prerequisite packages for DevStack.  It is
 suitable, for example, to pre-load a system for making a snapshot.
 
+Repo Layout
+-----------
+
+The DevStack repo generally keeps all of the primary scripts at the root
+level.
+
+``doc`` - Contains the Sphinx source for the documentation.
+``tools/build_docs.sh`` is used to generate the HTML versions of the
+DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
+
+``exercises`` - Contains the test scripts used to sanity-check and
+demonstrate some OpenStack functions. These scripts know how to exit
+early or skip services that are not enabled.
+
+``extras.d`` - Contains the dispatch scripts called by the hooks in
+``stack.sh``, ``unstack.sh`` and ``clean.sh``. See :doc:`the plugins
+docs <plugins>` for more information.
+
+``files`` - Contains a variety of otherwise lost files used in
+configuring and operating DevStack. This includes templates for
+configuration files and the system dependency information. This is also
+where image files are downloaded and expanded if necessary.
+
+``lib`` - Contains the sub-scripts specific to each project. This is
+where the work of managing a project's services is located. Each
+top-level project (Keystone, Nova, etc) has a file here. Additionally
+there are some for system services and project plugins.  These
+variables and functions are also used by related projects, such as
+Grenade, to manage a DevStack installation.
+
+``samples`` - Contains a sample of the local files not included in the
+DevStack repo.
+
+``tests`` - the DevStack test suite is rather sparse, mostly consisting
+of test of specific fragile functions in the ``functions`` and
+``functions-common`` files.
+
+``tools`` - Contains a collection of stand-alone scripts. While these
+may reference the top-level DevStack configuration they can generally be
+run alone. There are also some sub-directories to support specific
+environments such as XenServer.
+
 
 Scripts
 -------
@@ -249,6 +289,7 @@ Whitespace Rules
 
 Control Structure Rules
 -----------------------
+
 - then should be on the same line as the if
 - do should be on the same line as the for
 
@@ -270,6 +311,7 @@ Example::
 
 Variables and Functions
 -----------------------
+
 - functions should be used whenever possible for clarity
 - functions should use ``local`` variables as much as possible to
   ensure they are isolated from the rest of the environment
diff --git a/doc/source/contributing.rst b/doc/source/contributing.rst
deleted file mode 100644
index 50c0100578..0000000000
--- a/doc/source/contributing.rst
+++ /dev/null
@@ -1,94 +0,0 @@
-============
-Contributing
-============
-
-DevStack uses the standard OpenStack contribution process as outlined in
-`the OpenStack developer
-guide <http://docs.openstack.org/infra/manual/developers.html>`__. This
-means that you will need to meet the requirements of the Contribututors
-License Agreement (CLA). If you have already done that for another
-OpenStack project you are good to go.
-
-Things To Know
-==============
-
-|
-| **Where Things Are**
-
-The official DevStack repository is located at
-``git://git.openstack.org/openstack-dev/devstack.git``, replicated from
-the repo maintained by Gerrit. GitHub also has a mirror at
-``git://github.com/openstack-dev/devstack.git``.
-
-The `blueprint <https://blueprints.launchpad.net/devstack>`__ and `bug
-trackers <https://bugs.launchpad.net/devstack>`__ are on Launchpad. It
-should be noted that DevStack generally does not use these as strongly
-as other projects, but we're trying to change that.
-
-The `Gerrit review
-queue <https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z>`__
-is, however, used for all commits except for the text of this website.
-That should also change in the near future.
-
-|
-| **HACKING.rst**
-
-Like most OpenStack projects, DevStack includes a ``HACKING.rst`` file
-that describes the layout, style and conventions of the project. Because
-``HACKING.rst`` is in the main DevStack repo it is considered
-authoritative. Much of the content on this page is taken from there.
-
-|
-| **bashate Formatting**
-
-Around the time of the OpenStack Havana release we added a tool to do
-style checking in DevStack similar to what pep8/flake8 do for Python
-projects. It is still \_very\_ simplistic, focusing mostly on stray
-whitespace to help prevent -1 on reviews that are otherwise acceptable.
-Oddly enough it is called ``bashate``. It will be expanded to enforce
-some of the documentation rules in comments that are used in formatting
-the script pages for devstack.org and possibly even simple code
-formatting. Run it on the entire project with ``./run_tests.sh``.
-
-Code
-====
-
-|
-| **Repo Layout**
-
-The DevStack repo generally keeps all of the primary scripts at the root
-level.
-
-``doc`` - Contains the Sphinx source for the documentation.
-``tools/build_docs.sh`` is used to generate the HTML versions of the
-DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
-
-``exercises`` - Contains the test scripts used to sanity-check and
-demonstrate some OpenStack functions. These scripts know how to exit
-early or skip services that are not enabled.
-
-``extras.d`` - Contains the dispatch scripts called by the hooks in
-``stack.sh``, ``unstack.sh`` and ``clean.sh``. See :doc:`the plugins
-docs <plugins>` for more information.
-
-``files`` - Contains a variety of otherwise lost files used in
-configuring and operating DevStack. This includes templates for
-configuration files and the system dependency information. This is also
-where image files are downloaded and expanded if necessary.
-
-``lib`` - Contains the sub-scripts specific to each project. This is
-where the work of managing a project's services is located. Each
-top-level project (Keystone, Nova, etc) has a file here. Additionally
-there are some for system services and project plugins.
-
-``samples`` - Contains a sample of the local files not included in the
-DevStack repo.
-
-``tests`` - the DevStack test suite is rather sparse, mostly consisting
-of test of specific fragile functions in the ``functions`` and
-``functions-common`` files.
-
-``tools`` - Contains a collection of stand-alone scripts. While these
-may reference the top-level DevStack configuration they can generally be
-run alone. There are also some sub-directories to support specific
-environments such as XenServer.
diff --git a/doc/source/hacking.rst b/doc/source/hacking.rst
new file mode 100644
index 0000000000..a2bcf4fd67
--- /dev/null
+++ b/doc/source/hacking.rst
@@ -0,0 +1 @@
+.. include:: ../../HACKING.rst
diff --git a/doc/source/index.rst b/doc/source/index.rst
index bac593de03..0ffb15c2a8 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -12,7 +12,7 @@ DevStack - an OpenStack Community Production
    plugins
    faq
    changes
-   contributing
+   hacking
 
 Quick Start
 -----------
@@ -139,7 +139,7 @@ FAQ
 Contributing
 ------------
 
-:doc:`Pitching in to make DevStack a better place <contributing>`
+:doc:`Pitching in to make DevStack a better place <hacking>`
 
 Code
 ====

From 5686dbc45dbdc552080592e31bed63b0f201717e Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Mon, 9 Mar 2015 14:27:51 -0500
Subject: [PATCH 0463/3333] Add global venv enable/disable knob

Adds USE_VENV to globally enable/disable use of virtual environments.

ADDITIONAL_VENV_PACKAGES is used to manually add packages that do not
appear in requirements.txt or test-requirements.txt to be installed
into each venv.  Database Python bindings are handled this way when
a dataabse service is enabled.

Change-Id: I9cf298b936fd10c95e2ce5f51aab0d49d4b7f37f
---
 doc/source/configuration.rst | 24 ++++++++++++++++++++++++
 doc/source/index.rst         |  2 ++
 lib/database                 |  5 +++++
 lib/databases/mysql          |  3 +++
 lib/databases/postgresql     |  3 +++
 lib/stack                    | 10 +++++++---
 stack.sh                     |  1 +
 stackrc                      | 10 ++++++++++
 8 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 7d06658ee2..05a21cde5c 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -170,6 +170,30 @@ Libraries from Git
 
       LIBS_FROM_GIT=python-keystoneclient,oslo.config
 
+Virtual Environments
+--------------------
+
+  | *Default: ``USE_VENV=False``*
+  |   Enable the use of Python virtual environments by setting ``USE_VENV``
+      to ``True``.  This will enable the creation of venvs for each project
+      that is defined in the ``PROJECT_VENV`` array.
+
+  | *Default: ``PROJECT_VENV['<project>']='<project-dir>.venv'*
+  |   Each entry in the ``PROJECT_VENV`` array contains the directory name
+      of a venv to be used for the project.  The array index is the project
+      name.  Multiple projects can use the same venv if desired.
+
+  ::
+
+    PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
+
+  | *Default: ``ADDITIONAL_VENV_PACKAGES=""``*
+  |   A comma-separated list of additional packages to be installed into each
+      venv.  Often projects will not have certain packages listed in its
+      ``requirements.txt`` file because they are 'optional' requirements,
+      i.e. only needed for certain configurations.  By default, the enabled
+      databases will have their Python bindings added when they are enabled.
+
 Enable Logging
 --------------
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index bac593de03..d98e573dcc 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -210,6 +210,8 @@ Tools
 -----
 
 * `tools/build\_docs.sh <tools/build_docs.sh.html>`__
+* `tools/build\_venv.sh <tools/build_venv.sh.html>`__
+* `tools/build\_wheels.sh <tools/build_wheels.sh.html>`__
 * `tools/create-stack-user.sh <tools/create-stack-user.sh.html>`__
 * `tools/create\_userrc.sh <tools/create_userrc.sh.html>`__
 * `tools/fixup\_stuff.sh <tools/fixup_stuff.sh.html>`__
diff --git a/lib/database b/lib/database
index b114e9e4f6..ff1fafee26 100644
--- a/lib/database
+++ b/lib/database
@@ -109,6 +109,11 @@ function install_database {
     install_database_$DATABASE_TYPE
 }
 
+# Install the database Python packages
+function install_database_python {
+    install_database_python_$DATABASE_TYPE
+}
+
 # Configure and start the database
 function configure_database {
     configure_database_$DATABASE_TYPE
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 70073c4c6f..d548db103e 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -151,9 +151,12 @@ EOF
     else
         exit_distro_not_supported "mysql installation"
     fi
+}
 
+function install_database_python_mysql {
     # Install Python client module
     pip_install MySQL-python
+    ADDITIONAL_VENV_PACKAGES+=",MySQL-python"
 }
 
 function database_connection_url_mysql {
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index e891a08754..a6bcf8c0a2 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -100,9 +100,12 @@ EOF
     else
         exit_distro_not_supported "postgresql installation"
     fi
+}
 
+function install_database_python_postgresql {
     # Install Python client module
     pip_install psycopg2
+    ADDITIONAL_VENV_PACKAGES+=",psycopg2"
 }
 
 function database_connection_url_postgresql {
diff --git a/lib/stack b/lib/stack
index 9a509d8318..11dd87ca28 100644
--- a/lib/stack
+++ b/lib/stack
@@ -16,13 +16,17 @@
 function stack_install_service {
     local service=$1
     if type install_${service} >/dev/null 2>&1; then
-        if [[ -n ${PROJECT_VENV[$service]:-} ]]; then
+        if [[ ${USE_VENV} = True && -n ${PROJECT_VENV[$service]:-} ]]; then
             rm -rf ${PROJECT_VENV[$service]}
-            source $TOP_DIR/tools/build_venv.sh ${PROJECT_VENV[$service]}
+            source $TOP_DIR/tools/build_venv.sh ${PROJECT_VENV[$service]} ${ADDITIONAL_VENV_PACKAGES//,/ }
             export PIP_VIRTUAL_ENV=${PROJECT_VENV[$service]:-}
+
+            # Install other OpenStack prereqs that might come from source repos
+            install_oslo
+            install_keystonemiddleware
         fi
         install_${service}
-        if [[ -n ${PROJECT_VENV[$service]:-} ]]; then
+        if [[ ${USE_VENV} = True && -n ${PROJECT_VENV[$service]:-} ]]; then
             unset PIP_VIRTUAL_ENV
         fi
     fi
diff --git a/stack.sh b/stack.sh
index d83952accc..9d4a2061ef 100755
--- a/stack.sh
+++ b/stack.sh
@@ -702,6 +702,7 @@ install_rpc_backend
 
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
+    install_database_python
 fi
 
 if is_service_enabled neutron; then
diff --git a/stackrc b/stackrc
index 02b12a36a0..3c4593a27f 100644
--- a/stackrc
+++ b/stackrc
@@ -104,6 +104,16 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Enable use of Python virtual environments.  Individual project use of
+# venvs are controlled by the PROJECT_VENV array; every project with
+# an entry in the array will be installed into the named venv.
+# By default this will put each project into its own venv.
+USE_VENV=$(trueorfalse False USE_VENV)
+
+# Add packages that need to be installed into a venv but are not in any
+# requirmenets files here, in a comma-separated list
+ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
+
 # Configure wheel cache location
 export WHEELHOUSE=${WHEELHOUSE:-$DEST/.wheelhouse}
 export PIP_WHEEL_DIR=${PIP_WHEEL_DIR:-$WHEELHOUSE}

From 7448edb031028af2e26e17bce6373d8f8929570d Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Wed, 11 Mar 2015 20:06:26 -0500
Subject: [PATCH 0464/3333] Keystone use new section for eventlet server
 options

Configuration options that are only relevant when running keystone
under eventlet (rather than Apache httpd) were moved to the
[eventlet_server] and [eventlet_server_ssl] groups in the
keystone.conf file to avoid confusion. This change updates devstack
to use the new non-deprecated group for these options.

Change-Id: I651a278d09f6a3a32b2e96fac87f1e5ea0f18c39
---
 lib/keystone | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index b7acb37931..97307b169b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -227,21 +227,21 @@ function configure_keystone {
     # Set the URL advertised in the ``versions`` structure returned by the '/' route
     iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/"
     iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/"
-    iniset $KEYSTONE_CONF DEFAULT admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
+    iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
 
     # Register SSL certificates if provided
     if is_ssl_enabled_service key; then
         ensure_certificates KEYSTONE
 
-        iniset $KEYSTONE_CONF ssl enable True
-        iniset $KEYSTONE_CONF ssl certfile $KEYSTONE_SSL_CERT
-        iniset $KEYSTONE_CONF ssl keyfile $KEYSTONE_SSL_KEY
+        iniset $KEYSTONE_CONF eventlet_server_ssl enable True
+        iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
+        iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
     fi
 
     if is_service_enabled tls-proxy; then
         # Set the service ports for a proxy to take the originals
-        iniset $KEYSTONE_CONF DEFAULT public_port $KEYSTONE_SERVICE_PORT_INT
-        iniset $KEYSTONE_CONF DEFAULT admin_port $KEYSTONE_AUTH_PORT_INT
+        iniset $KEYSTONE_CONF eventlet_server public_port $KEYSTONE_SERVICE_PORT_INT
+        iniset $KEYSTONE_CONF eventlet_server admin_port $KEYSTONE_AUTH_PORT_INT
     fi
 
     iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"
@@ -317,7 +317,7 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
-    iniset $KEYSTONE_CONF DEFAULT admin_workers "$API_WORKERS"
+    iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
     # Public workers will use the server default, typically number of CPU.
 }
 

From f8ae647f2eabfd06c1006a1c3c92a3ef78578cfa Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Tue, 17 Feb 2015 11:05:06 -0600
Subject: [PATCH 0465/3333] Install Keystone into its own venv

Configure Apache to use the Keystone venv.

Change-Id: I86f1bfdfd800f5b818bfb5c4d2750ff732049107
---
 files/apache-keystone.template |  4 ++--
 lib/keystone                   | 30 ++++++++++++++++++++++++------
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 504dc01d21..1d20af7f90 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -2,7 +2,7 @@ Listen %PUBLICPORT%
 Listen %ADMINPORT%
 
 <VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP}
+    WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-public
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
@@ -18,7 +18,7 @@ Listen %ADMINPORT%
 </VirtualHost>
 
 <VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=%USER% display-name=%{GROUP}
+    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-admin
     WSGIScriptAlias / %ADMINWSGI%
     WSGIApplicationGroup %{GLOBAL}
diff --git a/lib/keystone b/lib/keystone
index b7acb37931..0f9b512eb7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -37,8 +37,16 @@ set +o xtrace
 # Set up default directories
 GITDIR["python-keystoneclient"]=$DEST/python-keystoneclient
 GITDIR["keystonemiddleware"]=$DEST/keystonemiddleware
-
 KEYSTONE_DIR=$DEST/keystone
+
+# Keystone virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["keystone"]=${KEYSTONE_DIR}.venv
+    KEYSTONE_BIN_DIR=${PROJECT_VENV["keystone"]}/bin
+else
+    KEYSTONE_BIN_DIR=$(get_python_exec_prefix)
+fi
+
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
@@ -144,6 +152,7 @@ function _config_keystone_apache_wsgi {
     local keystone_keyfile=""
     local keystone_service_port=$KEYSTONE_SERVICE_PORT
     local keystone_auth_port=$KEYSTONE_AUTH_PORT
+    local venv_path=""
 
     if is_ssl_enabled_service key; then
         keystone_ssl="SSLEngine On"
@@ -154,6 +163,9 @@ function _config_keystone_apache_wsgi {
         keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
         keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
     fi
+    if [[ ${USE_VENV} = True ]]; then
+        venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/python2.7/site-packages"
+    fi
 
     # copy proxy vhost and wsgi file
     sudo cp $KEYSTONE_DIR/httpd/keystone.py $KEYSTONE_WSGI_DIR/main
@@ -169,7 +181,8 @@ function _config_keystone_apache_wsgi {
         s|%SSLENGINE%|$keystone_ssl|g;
         s|%SSLCERTFILE%|$keystone_certfile|g;
         s|%SSLKEYFILE%|$keystone_keyfile|g;
-        s|%USER%|$STACK_USER|g
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
     " -i $keystone_apache_conf
 }
 
@@ -460,20 +473,20 @@ function init_keystone {
     recreate_database keystone
 
     # Initialize keystone database
-    $KEYSTONE_DIR/bin/keystone-manage db_sync
+    $KEYSTONE_BIN_DIR/keystone-manage db_sync
 
     local extension_value
     for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
         if [[ -z "${extension_value}" ]]; then
             continue
         fi
-        $KEYSTONE_DIR/bin/keystone-manage db_sync --extension "${extension_value}"
+        $KEYSTONE_BIN_DIR/keystone-manage db_sync --extension "${extension_value}"
     done
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "uuid" ]]; then
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl
-        $KEYSTONE_DIR/bin/keystone-manage pki_setup
+        $KEYSTONE_BIN_DIR/keystone-manage pki_setup
 
         # Create cache dir
         sudo install -d -o $STACK_USER $KEYSTONE_AUTH_CACHE_DIR
@@ -492,9 +505,14 @@ function install_keystoneclient {
 
 # install_keystonemiddleware() - Collect source and prepare
 function install_keystonemiddleware {
+    # install_keystonemiddleware() is called when keystonemiddleware is needed
+    # to provide an opportunity to install it from the source repo
     if use_library_from_git "keystonemiddleware"; then
         git_clone_by_name "keystonemiddleware"
         setup_dev_lib "keystonemiddleware"
+    else
+        # When not installing from repo, keystonemiddleware is still needed...
+        pip_install keystonemiddleware
     fi
 }
 
@@ -542,7 +560,7 @@ function start_keystone {
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else
         # Start Keystone in a screen window
-        run_process key "$KEYSTONE_DIR/bin/keystone-all --config-file $KEYSTONE_CONF"
+        run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"
     fi
 
     echo "Waiting for keystone to start..."

From aed607920542ee27f87f8e5cdb659faf1bde00eb Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Tue, 17 Feb 2015 15:38:16 -0600
Subject: [PATCH 0466/3333] Install Glance into its own venv

Change-Id: Ib46b89dafa1fc81a2d0717150203b848b87ea323
---
 lib/glance | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/lib/glance b/lib/glance
index d16b3456a3..00f07540e8 100755
--- a/lib/glance
+++ b/lib/glance
@@ -31,8 +31,16 @@ set +o xtrace
 # Set up default directories
 GITDIR["python-glanceclient"]=$DEST/python-glanceclient
 GITDIR["glance_store"]=$DEST/glance_store
-
 GLANCE_DIR=$DEST/glance
+
+# Glance virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
+    GLANCE_BIN_DIR=${PROJECT_VENV["glance"]}/bin
+else
+    GLANCE_BIN_DIR=$(get_python_exec_prefix)
+fi
+
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
@@ -47,13 +55,6 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 
-# Support entry points installation of console scripts
-if [[ -d $GLANCE_DIR/bin ]]; then
-    GLANCE_BIN_DIR=$GLANCE_DIR/bin
-else
-    GLANCE_BIN_DIR=$(get_python_exec_prefix)
-fi
-
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
 fi

From 6aaad5f7239c8e199fde0d1e5fca14f0a77164f2 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 18 Feb 2015 07:09:04 -0600
Subject: [PATCH 0467/3333] Install Cinder into its own venv

rootwrap is horribly called indirectly via PATH.  The choice, other than fixing
such nonsense, is to force the path in sudo.

Change-Id: Idac07455359b347e1c617736a515c2261b56d871
---
 lib/cinder | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 3c3fff3087..be4ef75208 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -39,8 +39,16 @@ fi
 
 # set up default directories
 GITDIR["python-cinderclient"]=$DEST/python-cinderclient
-
 CINDER_DIR=$DEST/cinder
+
+# Cinder virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["cinder"]=${CINDER_DIR}.venv
+    CINDER_BIN_DIR=${PROJECT_VENV["cinder"]}/bin
+else
+    CINDER_BIN_DIR=$(get_python_exec_prefix)
+fi
+
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
 CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
@@ -57,13 +65,6 @@ CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
-# Support entry points installation of console scripts
-if [[ -d $CINDER_DIR/bin ]]; then
-    CINDER_BIN_DIR=$CINDER_DIR/bin
-else
-    CINDER_BIN_DIR=$(get_python_exec_prefix)
-fi
-
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend
@@ -164,12 +165,11 @@ function cleanup_cinder {
     fi
 }
 
+# Deploy new rootwrap filters files and configure sudo
 # configure_cinder_rootwrap() - configure Cinder's rootwrap
 function configure_cinder_rootwrap {
-    # Set the paths of certain binaries
-    local cinder_rootwrap=$(get_rootwrap_location cinder)
+    local cinder_rootwrap=$CINDER_BIN_DIR/cinder-rootwrap
 
-    # Deploy new rootwrap filters files (owned by root).
     # Wipe any existing rootwrap.d files first
     if [[ -d $CINDER_CONF_DIR/rootwrap.d ]]; then
         sudo rm -rf $CINDER_CONF_DIR/rootwrap.d
@@ -188,10 +188,17 @@ function configure_cinder_rootwrap {
 
     # Set up the rootwrap sudoers for cinder
     local tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_CSUDOER_CMD" >$tempfile
+    echo "Defaults:$STACK_USER secure_path=$CINDER_BIN_DIR:/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >$tempfile
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_CSUDOER_CMD" >>$tempfile
     chmod 0440 $tempfile
     sudo chown root:root $tempfile
     sudo mv $tempfile /etc/sudoers.d/cinder-rootwrap
+
+    # So rootwrap and PATH are broken beyond belief.  WTF relies on a SECURE operation
+    # to blindly follow PATH???  We learned that was a bad idea in the 80's!
+    # So to fix this in a venv, we must exploit the very hole we want to close by dropping
+    # a copy of the venv rootwrap binary into /usr/local/bin.
+    #sudo cp -p $cinder_rootwrap /usr/local/bin
 }
 
 # configure_cinder() - Set config files, create data dirs, etc

From 2f6576bfaf7f43d9bf820e3e5ecc0b7fd136ce3c Mon Sep 17 00:00:00 2001
From: Geronimo Orozco <geronimo.orozco@intel.com>
Date: Thu, 19 Mar 2015 12:08:23 -0600
Subject: [PATCH 0468/3333] Creates SWIFT_DATA_DIR if it does not exist

If SWIFT_DATA_DIR is set on local.conf we need to make sure to create
the directory with proper permissions

Change-Id: If29fa53f01b4c0c8a881ec3734383ecffac334ce
Closes-Bug: 1302893
---
 lib/swift | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/swift b/lib/swift
index af19c68a1b..0fd671160e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -302,6 +302,7 @@ function configure_swift {
     local node_number
     local swift_node_config
     local swift_log_dir
+    local user_group
 
     # Make sure to kill all swift processes first
     swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
@@ -505,10 +506,12 @@ EOF
         fi
     fi
 
+    local user_group=$(id -g ${STACK_USER})
+    sudo install -d -o ${STACK_USER} -g ${user_group} ${SWIFT_DATA_DIR}
+
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
-    rm -rf ${swift_log_dir}
-    mkdir -p ${swift_log_dir}/hourly
-    sudo chown -R ${STACK_USER}:adm ${swift_log_dir}
+    sudo rm -rf ${swift_log_dir}
+    sudo install -d -o ${STACK_USER} -g adm ${swift_log_dir}/hourly
 
     if [[ $SYSLOG != "False" ]]; then
         sed "s,%SWIFT_LOGDIR%,${swift_log_dir}," $FILES/swift/rsyslog.conf | sudo \

From 10ba751a784f92a78933137f5b1baf09a3daf930 Mon Sep 17 00:00:00 2001
From: Mitsuhiro SHIGEMATSU <shigematsu.mitsuhiro@lab.ntt.co.jp>
Date: Sat, 21 Mar 2015 06:59:05 +0900
Subject: [PATCH 0469/3333] Fix typo in devstack/stack.sh

Change-Id: Ie13f1ae7fb5a46bb654aa3ab526933107c485b0b
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index d83952accc..0e22804db9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -23,7 +23,7 @@
 
 # check if someone has invoked with "sh"
 if [[ "${POSIXLY_CORRECT}" == "y" ]]; then
-    echo "You appear to be running bash in POSIX compatability mode."
+    echo "You appear to be running bash in POSIX compatibility mode."
     echo "devstack uses bash features. \"./stack.sh\" should do the right thing"
     exit 1
 fi

From c7df4df0b18a50313497bfca31af04e5475f780f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Mar 2015 12:18:52 +1100
Subject: [PATCH 0470/3333] Add some discussion about review criteria

An attempt to layout some of the ratioanle behind devstack reviews.

Change-Id: I9f4878653b5c746159206cd44b49255d9fdd32ef
---
 HACKING.rst | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/HACKING.rst b/HACKING.rst
index 4971db250b..a40af54b45 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -320,3 +320,48 @@ Variables and Functions
 - function names should_have_underscores, NotCamelCase.
 - functions should be declared as per the regex ^function foo {$
   with code starting on the next line
+
+
+Review Criteria
+===============
+
+There are some broad criteria that will be followed when reviewing
+your change
+
+* **Is it passing tests** -- your change will not be reviewed
+  throughly unless the official CI has run successfully against it.
+
+* **Does this belong in DevStack** -- DevStack reviewers have a
+  default position of "no" but are ready to be convinced by your
+  change.
+
+  For very large changes, you should consider :doc:`the plugins system
+  <plugins>` to see if your code is better abstracted from the main
+  repository.
+
+  For smaller changes, you should always consider if the change can be
+  encapsulated by per-user settings in ``local.conf``.  A common example
+  is adding a simple config-option to an ``ini`` file.  Specific flags
+  are not usually required for this, although adding documentation
+  about how to achieve a larger goal (which might include turning on
+  various settings, etc) is always welcome.
+
+* **Work-arounds** -- often things get broken and DevStack can be in a
+  position to fix them.  Work-arounds are fine, but should be
+  presented in the context of fixing the root-cause of the problem.
+  This means it is well-commented in the code and the change-log and
+  mostly likely includes links to changes or bugs that fix the
+  underlying problem.
+
+* **Should this be upstream** -- DevStack generally does not override
+  default choices provided by projects and attempts to not
+  unexpectedly modify behaviour.
+
+* **Context in commit messages** -- DevStack touches many different
+  areas and reviewers need context around changes to make good
+  decisions.  We also always want it to be clear to someone -- perhaps
+  even years from now -- why we were motivated to make a change at the
+  time.
+
+* **Reviewers** -- please see ``MAINTAINERS.rst`` for a list of people
+  that should be added to reviews of various sub-systems.

From ec47bc1d720852ca07f1af2143c2a6c1353e9306 Mon Sep 17 00:00:00 2001
From: Wiekus Beukes <wiekus.beukes@oracle.com>
Date: Thu, 19 Mar 2015 08:20:38 -0700
Subject: [PATCH 0471/3333] Add support for Oracle Linux 7 and later.

Most of the changes revolves around using MySQL rather than MariaDB,
plus enabling the addon repos on public-yum.oracle.com.
The patch just touch the areas where there is a divergence between the
Fedora and Oracle distributions and in all other cases the is_fedora
will result in the correct decision to be made and left as is.

Collapsed the is_suse and is_oraclelinux into a single check in
configure_database_mysql and cleanup_database_mysql

Added Oracle Linux to MAINTAINERS.rst

Rather than duplicating most of the Redhat version check code, added
a check in the block to do the determination if it is Oracle Linux

Change-Id: I5f1f15106329eec67aa008b17847fa44863f243f
---
 MAINTAINERS.rst     |  4 ++++
 functions-common    | 19 +++++++++++++++++--
 lib/databases/mysql | 24 ++++++++++++------------
 stack.sh            |  4 ++++
 4 files changed, 37 insertions(+), 14 deletions(-)

diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index a376eb0428..20e8655d69 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -90,3 +90,7 @@ Zaqar (Marconi)
 
 * Flavio Percoco <flaper87@gmail.com>
 * Malini Kamalambal <malini.kamalambal@rackspace.com>
+
+Oracle Linux
+~~~~~~~~~~~~
+* Wiekus Beukes <wiekus.beukes@oracle.com>
diff --git a/functions-common b/functions-common
index 3dae8147b5..d00d4a7c6f 100644
--- a/functions-common
+++ b/functions-common
@@ -246,6 +246,7 @@ function GetOSVersion {
         # CentOS Linux release 6.0 (Final)
         # Fedora release 16 (Verne)
         # XenServer release 6.2.0-70446c (xenenterprise)
+        # Oracle Linux release 7
         os_CODENAME=""
         for r in "Red Hat" CentOS Fedora XenServer; do
             os_VENDOR=$r
@@ -259,6 +260,9 @@ function GetOSVersion {
             fi
             os_VENDOR=""
         done
+        if [ "$os_VENDOR" = "Red Hat" ] && [[ -r /etc/oracle-release ]]; then
+            os_VENDOR=OracleLinux
+        fi
         os_PACKAGE="rpm"
     elif [[ -r /etc/SuSE-release ]]; then
         for r in openSUSE "SUSE Linux"; do
@@ -310,7 +314,7 @@ function GetDistro {
         fi
     elif [[ "$os_VENDOR" =~ (Red Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
-        "$os_VENDOR" =~ (OracleServer) ]]; then
+        "$os_VENDOR" =~ (OracleLinux) ]]; then
         # Drop the . release as we assume it's compatible
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
@@ -328,6 +332,17 @@ function is_arch {
     [[ "$(uname -m)" == "$1" ]]
 }
 
+# Determine if current distribution is an Oracle distribution
+# is_oraclelinux
+function is_oraclelinux {
+    if [[ -z "$os_VENDOR" ]]; then
+        GetOSVersion
+    fi
+
+    [ "$os_VENDOR" = "OracleLinux" ]
+}
+
+
 # Determine if current distribution is a Fedora-based distribution
 # (Fedora, RHEL, CentOS, etc).
 # is_fedora
@@ -337,7 +352,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
-        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ]
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ]
 }
 
 
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 70073c4c6f..dabd7d05fe 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -16,7 +16,7 @@ register_database mysql
 
 # Linux distros, thank you for being incredibly consistent
 MYSQL=mysql
-if is_fedora; then
+if is_fedora && ! is_oraclelinux; then
     MYSQL=mariadb
 fi
 
@@ -32,12 +32,12 @@ function cleanup_database_mysql {
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return
+    elif is_suse || is_oraclelinux; then
+        uninstall_package mysql-community-server
+        sudo rm -rf /var/lib/mysql
     elif is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
-    elif is_suse; then
-        uninstall_package mysql-community-server
-        sudo rm -rf /var/lib/mysql
     else
         return
     fi
@@ -56,12 +56,12 @@ function configure_database_mysql {
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
         mysql=mysql
+    elif is_suse || is_oraclelinux; then
+        my_conf=/etc/my.cnf
+        mysql=mysql
     elif is_fedora; then
         mysql=mariadb
         my_conf=/etc/my.cnf
-    elif is_suse; then
-        my_conf=/etc/my.cnf
-        mysql=mysql
     else
         exit_distro_not_supported "mysql configuration"
     fi
@@ -140,14 +140,14 @@ EOF
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
-    if is_fedora; then
-        install_package mariadb-server
-    elif is_ubuntu; then
-        install_package mysql-server
-    elif is_suse; then
+    if is_suse || is_oraclelinux; then
         if ! is_package_installed mariadb; then
             install_package mysql-community-server
         fi
+    elif is_fedora; then
+        install_package mariadb-server
+    elif is_ubuntu; then
+        install_package mysql-server
     else
         exit_distro_not_supported "mysql installation"
     fi
diff --git a/stack.sh b/stack.sh
index d83952accc..a475aab1b0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -278,6 +278,10 @@ EOF
             die $LINENO "Error installing RDO repo, cannot continue"
     fi
 
+    if is_oraclelinux; then
+        sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
+    fi
+
 fi
 
 

From a519f429cf3cd90f06dd50b95608ec18f81d400c Mon Sep 17 00:00:00 2001
From: Mahito OGURA <earthdragon77@gmail.com>
Date: Mon, 23 Mar 2015 15:19:57 +0900
Subject: [PATCH 0472/3333] Fix unstack.sh to stop stop_dstat when it is
 disabled.

unstack.sh always stop dstat process, however unstack.sh show 'dstat: no process
found' when dstat is disabled.
This patch stop function of stop_dstat, when dstat is disabled.

Change-Id: If9054826bed8a7fedd4f77ef4efef2c0ccd7f16e
Closes-Bug: #1435148
---
 unstack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/unstack.sh b/unstack.sh
index a6aeec5a25..fdd63fbcd0 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -173,7 +173,9 @@ if is_service_enabled trove; then
     cleanup_trove
 fi
 
-stop_dstat
+if is_service_enabled dstat; then
+    stop_dstat
+fi
 
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)

From d2287cfb9f4dfac71f14f3374514f5b8c2b0c70b Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Sun, 22 Mar 2015 07:20:06 -0700
Subject: [PATCH 0473/3333] Config driver: use "True" instead of "always"

Commit c12a78b35dc910fa97df888960ef2b9a64557254 has set the
"always" flag to be deprecated in liberty. This moves to using
"True" instead.

Change-Id: Idecf7966968369d2f372abffcab85fbf9aa097c7
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 7fbade0713..502bb35f05 100644
--- a/lib/nova
+++ b/lib/nova
@@ -81,7 +81,7 @@ NOVA_ROOTWRAP=$(get_rootwrap_location nova)
 
 # Option to enable/disable config drive
 # NOTE: Set FORCE_CONFIG_DRIVE="False" to turn OFF config drive
-FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"always"}
+FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
 
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.

From 435cd4dc6e4e5bbd0201f85524e21d83a7407719 Mon Sep 17 00:00:00 2001
From: Sergey Reshetnyak <sreshetniak@mirantis.com>
Date: Sun, 1 Mar 2015 12:44:02 +0300
Subject: [PATCH 0474/3333] Add support running sahara in distributed mode

Sahara supports running in distributed mode. Need to add this ability in
devstack.

Changes:
* configure rpc backend for sahara by default
* added sahara-api service for running api side
* added sahara-eng service for running engine side

Change-Id: I4fb9d5746b08c9b1fee0d283bcf448e47a87089b
---
 lib/sahara | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/sahara b/lib/sahara
index a965f55f68..0651b0a633 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -113,12 +113,13 @@ function configure_sahara {
 
     configure_auth_token_middleware $SAHARA_CONF_FILE sahara $SAHARA_AUTH_CACHE_DIR
 
+    iniset_rpc_backend sahara $SAHARA_CONF_FILE DEFAULT
+
     # Set configuration to send notifications
 
     if is_service_enabled ceilometer; then
         iniset $SAHARA_CONF_FILE DEFAULT enable_notifications "true"
         iniset $SAHARA_CONF_FILE DEFAULT notification_driver "messaging"
-        iniset_rpc_backend sahara $SAHARA_CONF_FILE
     fi
 
     iniset $SAHARA_CONF_FILE DEFAULT verbose True
@@ -203,12 +204,16 @@ function sahara_register_images {
 # start_sahara() - Start running processes, including screen
 function start_sahara {
     run_process sahara "$SAHARA_BIN_DIR/sahara-all --config-file $SAHARA_CONF_FILE"
+    run_process sahara-api "$SAHARA_BIN_DIR/sahara-api --config-file $SAHARA_CONF_FILE"
+    run_process sahara-eng "$SAHARA_BIN_DIR/sahara-engine --config-file $SAHARA_CONF_FILE"
 }
 
 # stop_sahara() - Stop running processes
 function stop_sahara {
     # Kill the Sahara screen windows
     stop_process sahara
+    stop_process sahara-api
+    stop_process sahara-eng
 }
 
 

From 7c57306c33630bd5e8a99b9afbd27b45b1157959 Mon Sep 17 00:00:00 2001
From: Aishwarya Thangappa <aishwarya.thangappa@gmail.com>
Date: Wed, 18 Feb 2015 01:51:13 -0800
Subject: [PATCH 0475/3333] Added devstack-with-lbaas-v2 installation
 documentation

This document explains the steps to configure Load-Balancer in
kilo.

Change-Id: Ic8c2f3cca80e331b7275f689051c07d863d918ea
Depends-On: I64a94aeeabe6357b5ea7796e34c9306c55c9ae67
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 99 ++++++++++++++++++++
 doc/source/index.rst                         |  1 +
 2 files changed, 100 insertions(+)
 create mode 100644 doc/source/guides/devstack-with-lbaas-v2.rst

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
new file mode 100644
index 0000000000..f67978310d
--- /dev/null
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -0,0 +1,99 @@
+Configure Load-Balancer in Kilo
+=================================
+
+The Kilo release of OpenStack will support Version 2 of the neutron load balancer. Until now, using OpenStack `LBaaS V2 <http://docs.openstack.org/api/openstack-network/2.0/content/lbaas_ext.html>`_ has required a good understanding of neutron and LBaaS architecture and several manual steps.
+
+
+Phase 1: Create DevStack + 2 nova instances
+--------------------------------------------
+
+First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space, make sure it is updated. Install git and any other developer tools you find useful.
+
+Install devstack
+
+  ::
+
+    git clone https://git.openstack.org/openstack-dev/devstack
+    cd devstack
+
+
+Edit your `local.conf` to look like
+
+  ::
+
+    [[local|localrc]]
+    # Load the external LBaaS plugin.
+    enable_plugin neutron-lbaas https://git.openstack.org/openstack/neutron-lbaas
+
+    # ===== BEGIN localrc =====
+    DATABASE_PASSWORD=password
+    ADMIN_PASSWORD=password
+    SERVICE_PASSWORD=password
+    SERVICE_TOKEN=password
+    RABBIT_PASSWORD=password
+    # Enable Logging
+    LOGFILE=$DEST/logs/stack.sh.log
+    VERBOSE=True
+    LOG_COLOR=True
+    SCREEN_LOGDIR=$DEST/logs
+    # Pre-requisite
+    ENABLED_SERVICES=rabbit,mysql,key
+    # Horizon
+    ENABLED_SERVICES+=,horizon
+    # Nova
+    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch
+    IMAGE_URLS+=",https://launchpad.net/cirros/trunk/0.3.0/+download/cirros-0.3.0-x86_64-disk.img"
+    # Glance
+    ENABLED_SERVICES+=,g-api,g-reg
+    # Neutron
+    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
+    # Enable LBaaS V2
+    ENABLED_SERVICES+=,q-lbaasv2
+    # Cinder
+    ENABLED_SERVICES+=,c-api,c-vol,c-sch
+    # Tempest
+    ENABLED_SERVICES+=,tempest
+    # ===== END localrc =====
+
+Run stack.sh and do some sanity checks
+
+  ::
+
+    ./stack.sh
+    . ./openrc
+
+    neutron net-list  # should show public and private networks
+
+Create two nova instances that we can use as test http servers:
+
+  ::
+
+    #create nova instances on private network
+    nova boot --image $(nova image-list | awk '/ cirros-0.3.0-x86_64-disk / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
+    nova boot --image $(nova image-list | awk '/ cirros-0.3.0-x86_64-disk / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
+    nova list # should show the nova instances just created
+
+    #add secgroup rule to allow ssh etc..
+    neutron security-group-rule-create default --protocol icmp
+    neutron security-group-rule-create default --protocol tcp --port-range-min 22 --port-range-max 22
+    neutron security-group-rule-create default --protocol tcp --port-range-min 80 --port-range-max 80
+
+Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
+
+ ::
+
+    MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
+    while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
+
+Phase 2: Create your load balancers
+------------------------------------
+
+ ::
+
+    neutron lbaas-loadbalancer-create --name lb1 private-subnet
+    neutron lbaas-listener-create --loadbalancer lb1 --protocol HTTP --protocol-port 80 --name listener1
+    neutron lbaas-pool-create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.3 --protocol-port 80 pool1
+    neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.5 --protocol-port 80 pool1
+
+Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes (in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is "curl that-lb-ip", which should alternate between showing the IPs of the two nodes.
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 10f4355c07..84ef6fd638 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -68,6 +68,7 @@ Walk through various setups used by stackers
    guides/neutron
    guides/devstack-with-nested-kvm
    guides/nova
+   guides/devstack-with-lbaas-v2
 
 All-In-One Single VM
 --------------------

From d01ff96e3f330684f3f1041ce6e08f729cf4006c Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Mon, 23 Mar 2015 15:05:39 -0700
Subject: [PATCH 0476/3333] Stop using deprecated rabbit related config options

Stop services from throwing the following warning:
  Option "rabbit_password" from group "DEFAULT" is deprecated. Use option
  "rabbit_password" from group "oslo_messaging_rabbit".
Same for rabbit_hosts and rabbit_userid

Change-Id: I7da503ef50b3653b888cb243caa74b4253a495e2
---
 lib/rpc_backend | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3d4ef762a7..3033cbe08e 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -272,9 +272,9 @@ function iniset_rpc_backend {
         fi
     elif is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
         iniset $file $section rpc_backend "rabbit"
-        iniset $file $section rabbit_hosts $RABBIT_HOST
-        iniset $file $section rabbit_password $RABBIT_PASSWORD
-        iniset $file $section rabbit_userid $RABBIT_USERID
+        iniset $file oslo_messaging_rabbit rabbit_hosts $RABBIT_HOST
+        iniset $file oslo_messaging_rabbit rabbit_password $RABBIT_PASSWORD
+        iniset $file oslo_messaging_rabbit rabbit_userid $RABBIT_USERID
     fi
 }
 

From 0f20ad41f3bb7f674a85b341556386cea492830e Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Mon, 23 Mar 2015 23:05:15 -0700
Subject: [PATCH 0477/3333] Add pluggability for matchmaker-redis

This commit introduces stevedore to matchmaker-redis:

https://review.openstack.org/#/c/161615/

Change-Id: I547157c02c9e0536add6949910a911540f27fb2d
---
 lib/rpc_backend | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3d4ef762a7..8a4a0908cd 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -251,8 +251,7 @@ function iniset_rpc_backend {
         iniset $file $section rpc_backend "zmq"
         iniset $file $section rpc_zmq_host `hostname`
         if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-            iniset $file $section rpc_zmq_matchmaker \
-                oslo.messaging._drivers.matchmaker_redis.MatchMakerRedis
+            iniset $file $section rpc_zmq_matchmaker "redis"
             MATCHMAKER_REDIS_HOST=${MATCHMAKER_REDIS_HOST:-127.0.0.1}
             iniset $file matchmaker_redis host $MATCHMAKER_REDIS_HOST
         else

From 16e0656bd0def2ea37b9020109aa9cdf8146e89b Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Thu, 19 Mar 2015 15:32:20 -0700
Subject: [PATCH 0478/3333] Until we prebuild wheels don't build wheels for deb
 installed libs

Until we have the ability to prebuild wheels so we don't spend time
compiling them during devstack runs, stop building wheels for libraries
that we still install from deb packages.

Long term we want to move away from using deb packages to install python
packages and use wheels. But until the wheel building logic is in place
so we don't have to compile wheels on each devstack run, don't waste
time compiling python libraries that we just use the packaged version of
anyway.

Change-Id: I962e2cfff223f7ab8efd5766ee0ef22229ab27bf
---
 files/venv-requirements.txt | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
index e473a2fe02..73d05793ce 100644
--- a/files/venv-requirements.txt
+++ b/files/venv-requirements.txt
@@ -1,10 +1,11 @@
+# Once we can prebuild wheels before a devstack run, uncomment the skipped libraries
 cryptography
-lxml
+# lxml # still install from from packages
 MySQL-python
-netifaces
+# netifaces # still install from packages
 #numpy    # slowest wheel by far, stop building until we are actually using the output
 posix-ipc
-psycopg2
+# psycopg # still install from packages
 pycrypto
 pyOpenSSL
 PyYAML

From 668749ae8582bd19e22bb1d0ec46cf3a18cc1bf0 Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Tue, 24 Mar 2015 18:00:29 +0000
Subject: [PATCH 0479/3333] Allow external ENV setup for conf files

In order to keep redstack in synch with devstack, the conf files
referenced within devstack need to be able to be declared externally.

This change allows *_CONF values to be specified, and uses the
original values as defaults.

Change-Id: Ic67f6347b92b05619103a77e9f7ea80a299a6869
---
 lib/trove | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/trove b/lib/trove
index 4c5a438fb8..5dd4f23611 100644
--- a/lib/trove
+++ b/lib/trove
@@ -33,12 +33,12 @@ fi
 GITDIR["python-troveclient"]=$DEST/python-troveclient
 
 TROVE_DIR=$DEST/trove
-TROVE_CONF_DIR=/etc/trove
-TROVE_CONF=$TROVE_CONF_DIR/trove.conf
-TROVE_TASKMANAGER_CONF=$TROVE_CONF_DIR/trove-taskmanager.conf
-TROVE_CONDUCTOR_CONF=$TROVE_CONF_DIR/trove-conductor.conf
-TROVE_GUESTAGENT_CONF=$TROVE_CONF_DIR/trove-guestagent.conf
-TROVE_API_PASTE_INI=$TROVE_CONF_DIR/api-paste.ini
+TROVE_CONF_DIR=${TROVE_CONF_DIR:-/etc/trove}
+TROVE_CONF=${TROVE_CONF:-$TROVE_CONF_DIR/trove.conf}
+TROVE_TASKMANAGER_CONF=${TROVE_TASKMANAGER_CONF:-$TROVE_CONF_DIR/trove-taskmanager.conf}
+TROVE_CONDUCTOR_CONF=${TROVE_CONDUCTOR_CONF:-$TROVE_CONF_DIR/trove-conductor.conf}
+TROVE_GUESTAGENT_CONF=${TROVE_GUESTAGENT_CONF:-$TROVE_CONF_DIR/trove-guestagent.conf}
+TROVE_API_PASTE_INI=${TROVE_API_PASTE_INI:-$TROVE_CONF_DIR/api-paste.ini}
 
 TROVE_LOCAL_CONF_DIR=$TROVE_DIR/etc/trove
 TROVE_LOCAL_API_PASTE_INI=$TROVE_LOCAL_CONF_DIR/api-paste.ini

From 89983b6dfe15e8e83f390e9870cc3ddfbf2b8243 Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Wed, 18 Mar 2015 11:12:15 +1300
Subject: [PATCH 0480/3333] Do not download Fedora cloud image for heat

Tempest can now do all heat tests with cirros, and heat functional
tests now load a custom test image from tarballs.o.o, so devstack
no longer needs to register the fedora cloud image.

Depends-On: I6041b8d6e7e9422f6e220d7aef0ca38857085e4b
Change-Id: I9b3ea2c157b96dee139a24f0fa6f68f6764a7d67
---
 stackrc | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/stackrc b/stackrc
index f8d9c43c38..5b2ed70584 100644
--- a/stackrc
+++ b/stackrc
@@ -560,18 +560,6 @@ case "$VIRT_DRIVER" in
         IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz"};;
 esac
 
-# Use 64bit fedora image if heat is enabled
-if [[ "$ENABLED_SERVICES" =~ 'h-api' ]]; then
-    case "$VIRT_DRIVER" in
-        libvirt|ironic)
-            HEAT_CFN_IMAGE_URL=${HEAT_CFN_IMAGE_URL:-"https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"}
-            IMAGE_URLS+=",$HEAT_CFN_IMAGE_URL"
-            ;;
-        *)
-            ;;
-    esac
-fi
-
 # Trove needs a custom image for its work
 if [[ "$ENABLED_SERVICES" =~ 'tr-api' ]]; then
     case "$VIRT_DRIVER" in
@@ -584,17 +572,6 @@ if [[ "$ENABLED_SERVICES" =~ 'tr-api' ]]; then
     esac
 fi
 
-# Staging Area for New Images, have them here for at least 24hrs for nodepool
-# to cache them otherwise the failure rates in the gate are too high
-PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
-if [[ "$PRECACHE_IMAGES" == "True" ]]; then
-    # staging in update for nodepool
-    IMAGE_URL="https://download.fedoraproject.org/pub/alt/openstack/20/x86_64/Fedora-x86_64-20-20140618-sda.qcow2"
-    if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
-        IMAGE_URLS+=",$IMAGE_URL"
-    fi
-fi
-
 # 10Gb default volume backing file size
 VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-10250M}
 

From 51c48d4c801fecce9d2486ce956a2602eb8a0ea9 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 25 Mar 2015 06:26:03 +1100
Subject: [PATCH 0481/3333] Add a note on default values of globals

Add a note on default values of globals in plugin settings

Change-Id: I0d5d3a7e0597abe7e2401f8bae30ccc5682eab03
---
 doc/source/plugins.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 5a610634b4..c4ed2285cb 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -113,6 +113,11 @@ directory. Inside this directory there can be 2 files.
   services using ``run_process`` as it only works with enabled
   services.
 
+  Be careful to allow users to override global-variables for
+  customizing their environment.  Usually it is best to provide a
+  default value only if the variable is unset or empty; e.g. in bash
+  syntax ``FOO=${FOO:-default}``.
+
 - ``plugin.sh`` - the actual plugin. It will be executed by devstack
   during it's run. The run order will be done in the registration
   order for these plugins, and will occur immediately after all in

From 93b2100c983e1c271a8d51aa7f4755a6445be6a8 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 20 Feb 2015 11:45:21 -0500
Subject: [PATCH 0482/3333] Support for single interface Neutron networking
 with OVS

When running Neutron on a single node that only has a single interface,
the following operations are required:

    * Remove the IP address from the physical interface
    * Add the interface to the OVS physical bridge
    * Add the IP address from the physical interface to the OVS bridge
    * Update the routing table

The reverse is done on cleanup.

In order run Neutron on a single interface, the $PUBLIC_INTERFACE and
$OVS_PHYSICAL_BRIDGE variables must be set.

Co-Authored-By: Brian Haley <brian.haley@hp.com>

Change-Id: Ie35cb537bb670c4773598b8db29877fb8a12ff50
---
 lib/neutron | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 411c6961ce..dc9a339f5b 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -780,9 +780,41 @@ function stop_neutron {
     fi
 }
 
+# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
+# on startup, or back to the public interface on cleanup
+function _move_neutron_addresses_route {
+    local from_intf=$1
+    local to_intf=$2
+    local add_ovs_port=$3
+
+    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
+        # Remove the primary IP address from $from_intf and add it to $to_intf,
+        # along with the default route, if it exists.  Also, when called
+        # on configure we will also add $from_intf as a port on $to_intf,
+        # assuming it is an OVS bridge.
+
+        local IP_BRD=$(ip -4 a s dev $from_intf | awk '/inet/ { print $2, $3, $4; exit }')
+        local DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
+        local ADD_OVS_PORT=""
+
+        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
+            ADD_DEFAULT_ROUTE="sudo ip r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
+        fi
+
+        if [[ "$add_ovs_port" == "True" ]]; then
+            ADD_OVS_PORT="sudo ovs-vsctl add-port $to_intf $from_intf"
+        fi
+
+        sudo ip addr del $IP_BRD dev $from_intf; sudo ip addr add $IP_BRD dev $to_intf; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+    fi
+}
+
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
+
+    _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False
+
     if is_provider_network && is_ironic_hardware; then
         for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
             sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
@@ -960,6 +992,8 @@ function _configure_neutron_l3_agent {
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
     neutron_plugin_configure_l3_agent
+
+    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True
 }
 
 function _configure_neutron_metadata_agent {
@@ -1235,8 +1269,10 @@ function _neutron_configure_router_v4 {
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local cidr_len=${FLOATING_RANGE#*/}
-            sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
-            sudo ip link set $ext_gw_interface up
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" ]]; then
+                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+                sudo ip link set $ext_gw_interface up
+            fi
             ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP

From eeb7bda510ad29dce7bfc5eb8aed9b6fe25efea1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 25 Mar 2015 11:55:32 -0400
Subject: [PATCH 0483/3333] eliminate TEST_ONLY differentiation

devstack is a development and test environment, but by default we were
only installing the runtime dependencies. We should install all the
testing required packages as well.

Change-Id: I7c95927b9daad15766aac9d1276b10ca62efb24c
---
 files/debs/general      |  2 +-
 files/debs/glance       | 10 +++++-----
 files/debs/neutron      |  6 +++---
 files/debs/nova         |  2 +-
 files/debs/trove        |  2 +-
 files/rpms-suse/general |  2 +-
 files/rpms-suse/neutron |  4 ++--
 files/rpms-suse/trove   |  2 +-
 files/rpms/general      |  2 +-
 files/rpms/glance       | 12 ++++++------
 files/rpms/neutron      |  6 +++---
 files/rpms/nova         |  2 +-
 files/rpms/trove        |  2 +-
 functions-common        | 10 ----------
 inc/python              | 23 +++++++++++------------
 stackrc                 |  3 ---
 16 files changed, 38 insertions(+), 52 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 84d43029ff..5f10a20fc3 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -6,7 +6,7 @@ psmisc
 gcc
 g++
 git
-graphviz # testonly - docs
+graphviz # needed for docs
 lsof # useful when debugging
 openssh-server
 openssl
diff --git a/files/debs/glance b/files/debs/glance
index 9fda6a63d9..37877a85c2 100644
--- a/files/debs/glance
+++ b/files/debs/glance
@@ -1,6 +1,6 @@
-libmysqlclient-dev  # testonly
-libpq-dev           # testonly
-libssl-dev          # testonly
+libmysqlclient-dev
+libpq-dev
+libssl-dev
 libxml2-dev
-libxslt1-dev        # testonly
-zlib1g-dev           # testonly
+libxslt1-dev
+zlib1g-dev
diff --git a/files/debs/neutron b/files/debs/neutron
index aa3d7095ca..2d69a71c3a 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -1,12 +1,12 @@
-acl     # testonly
+acl
 ebtables
 iptables
 iputils-ping
 iputils-arping
-libmysqlclient-dev  # testonly
+libmysqlclient-dev
 mysql-server #NOPRIME
 sudo
-postgresql-server-dev-all       # testonly
+postgresql-server-dev-all
 python-mysqldb
 python-mysql.connector
 python-qpid # NOPRIME
diff --git a/files/debs/nova b/files/debs/nova
index 0c31385ddd..9d9acde3e9 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -4,7 +4,7 @@ conntrack
 kpartx
 parted
 iputils-arping
-libmysqlclient-dev  # testonly
+libmysqlclient-dev
 mysql-server # NOPRIME
 python-mysqldb
 python-mysql.connector
diff --git a/files/debs/trove b/files/debs/trove
index 09dcee8104..96f8f29277 100644
--- a/files/debs/trove
+++ b/files/debs/trove
@@ -1 +1 @@
-libxslt1-dev   # testonly
+libxslt1-dev
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 63cf14bd5b..2219426141 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -6,7 +6,7 @@ euca2ools
 gcc
 gcc-c++
 git-core
-graphviz # testonly - docs
+graphviz # docs
 iputils
 libopenssl-devel # to rebuild pyOpenSSL if needed
 lsof # useful when debugging
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 66d6e4cad0..d278363e98 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -1,11 +1,11 @@
-acl     # testonly
+acl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
 iptables
 iputils
 mariadb # NOPRIME
-postgresql-devel        # testonly
+postgresql-devel
 python-eventlet
 python-greenlet
 python-iso8601
diff --git a/files/rpms-suse/trove b/files/rpms-suse/trove
index 09dcee8104..96f8f29277 100644
--- a/files/rpms-suse/trove
+++ b/files/rpms-suse/trove
@@ -1 +1 @@
-libxslt1-dev   # testonly
+libxslt1-dev
diff --git a/files/rpms/general b/files/rpms/general
index eac4ec36a7..d74ecc6e98 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -5,7 +5,7 @@ euca2ools # only for testing client
 gcc
 gcc-c++
 git-core
-graphviz # testonly - docs
+graphviz # needed only for docs
 openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
diff --git a/files/rpms/glance b/files/rpms/glance
index 119492a3f8..479194f918 100644
--- a/files/rpms/glance
+++ b/files/rpms/glance
@@ -1,6 +1,6 @@
-libxml2-devel       # testonly
-libxslt-devel       # testonly
-mysql-devel         # testonly
-openssl-devel       # testonly
-postgresql-devel    # testonly
-zlib-devel          # testonly
+libxml2-devel
+libxslt-devel
+mysql-devel
+openssl-devel
+postgresql-devel
+zlib-devel
diff --git a/files/rpms/neutron b/files/rpms/neutron
index c0dee78a48..8292e7bffe 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -1,15 +1,15 @@
 MySQL-python
-acl     # testonly
+acl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
 iptables
 iputils
 mysql-connector-python
-mysql-devel  # testonly
+mysql-devel
 mysql-server # NOPRIME
 openvswitch # NOPRIME
-postgresql-devel        # testonly
+postgresql-devel
 rabbitmq-server # NOPRIME
 qpid-cpp-server        # NOPRIME
 sqlite
diff --git a/files/rpms/nova b/files/rpms/nova
index 527928a581..ebd667454a 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -17,7 +17,7 @@ libxml2-python
 numpy # needed by websockify for spice console
 m2crypto
 mysql-connector-python
-mysql-devel  # testonly
+mysql-devel
 mysql-server # NOPRIME
 parted
 polkit
diff --git a/files/rpms/trove b/files/rpms/trove
index c5cbdea012..e7bbd43cd6 100644
--- a/files/rpms/trove
+++ b/files/rpms/trove
@@ -1 +1 @@
-libxslt-devel   # testonly
+libxslt-devel
diff --git a/functions-common b/functions-common
index f96da5b799..48e400dfb1 100644
--- a/functions-common
+++ b/functions-common
@@ -883,16 +883,6 @@ function _parse_package_files {
                 fi
             fi
 
-            # Look for # testonly in comment
-            if [[ $line =~ (.*)#.*testonly.* ]]; then
-                package=${BASH_REMATCH[1]}
-                # Are we installing test packages? (test for the default value)
-                if [[ $INSTALL_TESTONLY_PACKAGES = "False" ]]; then
-                    # If not installing test packages the skip this package
-                    inst_pkg=0
-                fi
-            fi
-
             if [[ $inst_pkg = 1 ]]; then
                 echo $package
             fi
diff --git a/inc/python b/inc/python
index 229c54009d..2d76081a52 100644
--- a/inc/python
+++ b/inc/python
@@ -101,18 +101,17 @@ function pip_install {
         $cmd_pip install \
         $@
 
-    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False INSTALL_TESTONLY_PACKAGES)
-    if [[ "$INSTALL_TESTONLY_PACKAGES" == "True" ]]; then
-        local test_req="$@/test-requirements.txt"
-        if [[ -e "$test_req" ]]; then
-            $sudo_pip \
-                http_proxy=${http_proxy:-} \
-                https_proxy=${https_proxy:-} \
-                no_proxy=${no_proxy:-} \
-                PIP_FIND_LINKS=$PIP_FIND_LINKS \
-                $cmd_pip install \
-                -r $test_req
-        fi
+    # Also install test requirements
+    local test_req="$@/test-requirements.txt"
+    if [[ -e "$test_req" ]]; then
+        echo "Installing test-requirements for $test_req"
+        $sudo_pip \
+            http_proxy=${http_proxy:-} \
+            https_proxy=${https_proxy:-} \
+            no_proxy=${no_proxy:-} \
+            PIP_FIND_LINKS=$PIP_FIND_LINKS \
+            $cmd_pip install \
+            -r $test_req
     fi
 }
 
diff --git a/stackrc b/stackrc
index f8d9c43c38..a13f82a889 100644
--- a/stackrc
+++ b/stackrc
@@ -615,9 +615,6 @@ USE_SCREEN=${SCREEN_DEV:-$USE_SCREEN}
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}
 
-# Do not install packages tagged with 'testonly' by default
-INSTALL_TESTONLY_PACKAGES=${INSTALL_TESTONLY_PACKAGES:-False}
-
 # Undo requirements changes by global requirements
 UNDO_REQUIREMENTS=${UNDO_REQUIREMENTS:-True}
 

From 72f026b60d350ede39e22e08b8f7f286fd0d2633 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@hp.com>
Date: Wed, 25 Mar 2015 17:24:24 -0400
Subject: [PATCH 0484/3333] Always defines tempest_roles as Member

Because tests might force the auth version to v3, we always need
to have Member in the list of roles.

Change-Id: I06fd043e1b31ae0e5e33f4dcf898fb58f2907267
---
 lib/tempest | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index fcb0e59937..7535fa6596 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -315,9 +315,7 @@ function configure_tempest {
 
     # Auth
     iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
-    if [[ "$TEMPEST_AUTH_VERSION" == "v3" ]]; then
-        iniset $TEMPEST_CONFIG auth tempest_roles "Member"
-    fi
+    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
 
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED

From 85c98b3e18b132d99c569626e1b747eafa59f7c6 Mon Sep 17 00:00:00 2001
From: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
Date: Thu, 26 Mar 2015 00:14:05 +0100
Subject: [PATCH 0485/3333] Revert "Support for single interface Neutron
 networking with OVS"

This patch is causing blocking failures in some 3rd party CIs.
The issue can be tracked to the fact that the PUBLIC_INTERFACE
interface might have no address assigned.

This reverts commit 93b2100c983e1c271a8d51aa7f4755a6445be6a8.

Partial-Bug: #1436607
Change-Id: I0943aa542b911fbcebb100543e0adbb38159b233
---
 lib/neutron | 40 ++--------------------------------------
 1 file changed, 2 insertions(+), 38 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 89ed3ccea0..5ff39212fc 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -779,41 +779,9 @@ function stop_neutron {
     fi
 }
 
-# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
-# on startup, or back to the public interface on cleanup
-function _move_neutron_addresses_route {
-    local from_intf=$1
-    local to_intf=$2
-    local add_ovs_port=$3
-
-    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
-        # Remove the primary IP address from $from_intf and add it to $to_intf,
-        # along with the default route, if it exists.  Also, when called
-        # on configure we will also add $from_intf as a port on $to_intf,
-        # assuming it is an OVS bridge.
-
-        local IP_BRD=$(ip -4 a s dev $from_intf | awk '/inet/ { print $2, $3, $4; exit }')
-        local DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
-        local ADD_OVS_PORT=""
-
-        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
-            ADD_DEFAULT_ROUTE="sudo ip r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
-        fi
-
-        if [[ "$add_ovs_port" == "True" ]]; then
-            ADD_OVS_PORT="sudo ovs-vsctl add-port $to_intf $from_intf"
-        fi
-
-        sudo ip addr del $IP_BRD dev $from_intf; sudo ip addr add $IP_BRD dev $to_intf; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
-    fi
-}
-
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
-
-    _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False
-
     if is_provider_network && is_ironic_hardware; then
         for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
             sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
@@ -988,8 +956,6 @@ function _configure_neutron_l3_agent {
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
     neutron_plugin_configure_l3_agent
-
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True
 }
 
 function _configure_neutron_metadata_agent {
@@ -1261,10 +1227,8 @@ function _neutron_configure_router_v4 {
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local cidr_len=${FLOATING_RANGE#*/}
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" ]]; then
-                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
-                sudo ip link set $ext_gw_interface up
-            fi
+            sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+            sudo ip link set $ext_gw_interface up
             ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP

From 5a9739a4cae7957a24898fb11562559be2916121 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 25 Mar 2015 11:33:51 -0500
Subject: [PATCH 0486/3333] Rename lib/neutron to lib/neutron-legacy

Preparing to refactor lib/neutron to support Neutron as the default
network config.  lib/neutron will be renamed internally and refined
to support a couple of specific configurations.

Change-Id: I0d3773d14c4c636a4b915734784e7241f4d15474
---
 clean.sh                         |    2 +-
 doc/source/index.rst             |    2 +-
 exercises/boot_from_volume.sh    |    2 +-
 exercises/euca.sh                |    2 +-
 exercises/floating_ips.sh        |    2 +-
 exercises/neutron-adv-test.sh    |    2 +-
 exercises/volumes.sh             |    2 +-
 lib/neutron                      | 1468 +-----------------------------
 lib/neutron-legacy               | 1467 +++++++++++++++++++++++++++++
 lib/neutron_plugins/README.md    |    2 +-
 lib/neutron_thirdparty/README.md |    2 +-
 stack.sh                         |    2 +-
 unstack.sh                       |    2 +-
 13 files changed, 1479 insertions(+), 1478 deletions(-)
 mode change 100755 => 120000 lib/neutron
 create mode 100755 lib/neutron-legacy

diff --git a/clean.sh b/clean.sh
index ad4525ba62..035489c045 100755
--- a/clean.sh
+++ b/clean.sh
@@ -49,7 +49,7 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ironic
 source $TOP_DIR/lib/trove
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 537f6570a2..b7012379cb 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -166,7 +166,7 @@ Scripts
 * `lib/ironic <lib/ironic.html>`__
 * `lib/keystone <lib/keystone.html>`__
 * `lib/ldap <lib/ldap.html>`__
-* `lib/neutron <lib/neutron.html>`__
+* `lib/neutron-legacy <lib/neutron-legacy.html>`__
 * `lib/nova <lib/nova.html>`__
 * `lib/oslo <lib/oslo.html>`__
 * `lib/rpc\_backend <lib/rpc_backend.html>`__
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index a2ae275b04..aa348307af 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -32,7 +32,7 @@ source $TOP_DIR/functions
 
 # Import project functions
 source $TOP_DIR/lib/cinder
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 
 # Import configuration
 source $TOP_DIR/openrc
diff --git a/exercises/euca.sh b/exercises/euca.sh
index f9c47523e6..df5e233b8d 100755
--- a/exercises/euca.sh
+++ b/exercises/euca.sh
@@ -37,7 +37,7 @@ source $TOP_DIR/eucarc
 source $TOP_DIR/exerciserc
 
 # Import project functions
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 
 # If nova api is not enabled we exit with exitcode 55 so that
 # the exercise is skipped
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
index 57f48e08b2..59444e1ebd 100755
--- a/exercises/floating_ips.sh
+++ b/exercises/floating_ips.sh
@@ -31,7 +31,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/openrc
 
 # Import project functions
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 
 # Import exercise configuration
 source $TOP_DIR/exerciserc
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 5b3281b16a..9230587817 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -49,7 +49,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/openrc
 
 # Import neutron functions
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 
 # If neutron is not enabled we exit with exitcode 55, which means exercise is skipped.
 neutron_plugin_check_adv_test_requirements || exit 55
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index 504fba1a04..3ac2016254 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -32,7 +32,7 @@ source $TOP_DIR/openrc
 
 # Import project functions
 source $TOP_DIR/lib/cinder
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 
 # Import exercise configuration
 source $TOP_DIR/exerciserc
diff --git a/lib/neutron b/lib/neutron
deleted file mode 100755
index 5ff39212fc..0000000000
--- a/lib/neutron
+++ /dev/null
@@ -1,1467 +0,0 @@
-#!/bin/bash
-#
-# lib/neutron
-# functions - functions specific to neutron
-
-# Dependencies:
-# ``functions`` file
-# ``DEST`` must be defined
-# ``STACK_USER`` must be defined
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_neutron_agent_packages
-# - install_neutronclient
-# - install_neutron
-# - install_neutron_third_party
-# - configure_neutron
-# - init_neutron
-# - configure_neutron_third_party
-# - init_neutron_third_party
-# - start_neutron_third_party
-# - create_nova_conf_neutron
-# - start_neutron_service_and_check
-# - check_neutron_third_party_integration
-# - start_neutron_agents
-# - create_neutron_initial_network
-# - setup_neutron_debug
-#
-# ``unstack.sh`` calls the entry points in this order:
-#
-# - teardown_neutron_debug
-# - stop_neutron
-# - stop_neutron_third_party
-# - cleanup_neutron
-
-# Functions in lib/neutron are classified into the following categories:
-#
-# - entry points (called from stack.sh or unstack.sh)
-# - internal functions
-# - neutron exercises
-# - 3rd party programs
-
-
-# Neutron Networking
-# ------------------
-
-# Make sure that neutron is enabled in ``ENABLED_SERVICES``.  If you want
-# to run Neutron on this host, make sure that q-svc is also in
-# ``ENABLED_SERVICES``.
-#
-# See "Neutron Network Configuration" below for additional variables
-# that must be set in localrc for connectivity across hosts with
-# Neutron.
-#
-# With Neutron networking the NETWORK_MANAGER variable is ignored.
-
-# Settings
-# --------
-
-# Timeout value in seconds to wait for IPv6 gateway configuration
-GATEWAY_TIMEOUT=30
-
-
-# Neutron Network Configuration
-# -----------------------------
-
-# Subnet IP version
-IP_VERSION=${IP_VERSION:-4}
-# Validate IP_VERSION
-if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
-    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
-fi
-# Gateway and subnet defaults, in case they are not customized in localrc
-NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
-PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
-PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
-PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
-
-if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
-    Q_PROTOCOL="https"
-fi
-
-# Generate 40-bit IPv6 Global ID to comply with RFC 4193
-IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
-
-# IPv6 gateway and subnet defaults, in case they are not customized in localrc
-IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
-IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
-IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
-IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
-IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
-IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-fe80:cafe:cafe::/64}
-IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-fe80:cafe:cafe::2}
-# IPV6_ROUTER_GW_IP must be defined when IP_VERSION=4+6 as it cannot be
-# obtained conventionally until the l3-agent has support for dual-stack
-# TODO (john-davidge) Remove once l3-agent supports dual-stack
-IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-fe80:cafe:cafe::1}
-
-# Set up default directories
-GITDIR["python-neutronclient"]=$DEST/python-neutronclient
-
-
-NEUTRON_DIR=$DEST/neutron
-NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
-NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
-
-# Support entry points installation of console scripts
-if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
-    NEUTRON_BIN_DIR=$NEUTRON_DIR/bin
-else
-    NEUTRON_BIN_DIR=$(get_python_exec_prefix)
-fi
-
-NEUTRON_CONF_DIR=/etc/neutron
-NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
-export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
-
-# Agent binaries.  Note, binary paths for other agents are set in per-service
-# scripts in lib/neutron_plugins/services/
-AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
-AGENT_L3_BINARY=${AGENT_L3_BINARY:-"$NEUTRON_BIN_DIR/neutron-l3-agent"}
-AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
-
-# Agent config files. Note, plugin-specific Q_PLUGIN_CONF_FILE is set and
-# loaded from per-plugin  scripts in lib/neutron_plugins/
-Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
-Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
-Q_FWAAS_CONF_FILE=$NEUTRON_CONF_DIR/fwaas_driver.ini
-Q_VPN_CONF_FILE=$NEUTRON_CONF_DIR/vpn_agent.ini
-Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
-
-# Default name for Neutron database
-Q_DB_NAME=${Q_DB_NAME:-neutron}
-# Default Neutron Plugin
-Q_PLUGIN=${Q_PLUGIN:-ml2}
-# Default Neutron Port
-Q_PORT=${Q_PORT:-9696}
-# Default Neutron Internal Port when using TLS proxy
-Q_PORT_INT=${Q_PORT_INT:-19696}
-# Default Neutron Host
-Q_HOST=${Q_HOST:-$SERVICE_HOST}
-# Default protocol
-Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
-# Default admin username
-Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
-# Default auth strategy
-Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
-# Use namespace or not
-Q_USE_NAMESPACE=${Q_USE_NAMESPACE:-True}
-# RHEL's support for namespaces requires using veths with ovs
-Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
-Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
-Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
-# Meta data IP
-Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
-# Allow Overlapping IP among subnets
-Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-# Use neutron-debug command
-Q_USE_DEBUG_COMMAND=${Q_USE_DEBUG_COMMAND:-False}
-# The name of the default q-l3 router
-Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
-# nova vif driver that all plugins should use
-NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
-Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
-Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
-VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
-VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
-# Specify if the initial private and external networks should be created
-NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
-
-## Provider Network Information
-PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
-
-# Use flat providernet for public network
-#
-# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
-# for external interface of neutron l3-agent.  In that case,
-# PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
-# used for the network.  In case of ofagent, you should add the
-# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
-# For openvswitch agent, you should add the corresponding entry to
-# your OVS_BRIDGE_MAPPINGS.
-#
-# eg.  (ofagent)
-#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-#    Q_USE_PUBLIC_VETH=True
-#    PUBLIC_PHYSICAL_NETWORK=public
-#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
-#
-# eg.  (openvswitch agent)
-#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-#    PUBLIC_PHYSICAL_NETWORK=public
-#    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
-PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
-
-# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
-# PUBLIC_BRIDGE.  This is intended to be used with
-# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
-Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
-Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
-Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
-
-# The next two variables are configured by plugin
-# e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
-#
-# The plugin supports L3.
-Q_L3_ENABLED=${Q_L3_ENABLED:-False}
-# L3 routers exist per tenant
-Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-False}
-
-# List of config file names in addition to the main plugin config file
-# See _configure_neutron_common() for details about setting it up
-declare -a Q_PLUGIN_EXTRA_CONF_FILES
-
-# List of (optional) config files for VPN device drivers to use with
-# the neutron-q-vpn agent
-declare -a Q_VPN_EXTRA_CONF_FILES
-
-
-Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-    Q_RR_COMMAND="sudo"
-else
-    NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
-    Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
-    fi
-fi
-
-
-# Distributed Virtual Router (DVR) configuration
-# Can be:
-# - ``legacy``   - No DVR functionality
-# - ``dvr_snat`` - Controller or single node DVR
-# - ``dvr``      - Compute node in multi-node DVR
-#
-Q_DVR_MODE=${Q_DVR_MODE:-legacy}
-if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,l2population
-fi
-
-# Provider Network Configurations
-# --------------------------------
-
-# The following variables control the Neutron ML2 plugins' allocation
-# of tenant networks and availability of provider networks. If these
-# are not configured in ``localrc``, tenant networks will be local to
-# the host (with no remote connectivity), and no physical resources
-# will be available for the allocation of provider networks.
-
-# To disable tunnels (GRE or VXLAN) for tenant networks,
-# set to False in ``local.conf``.
-# GRE tunnels are only supported by the openvswitch.
-ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
-
-# If using GRE tunnels for tenant networks, specify the range of
-# tunnel IDs from which tenant networks are allocated. Can be
-# overriden in ``localrc`` in necesssary.
-TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
-
-# To use VLANs for tenant networks, set to True in localrc. VLANs
-# are supported by the ML2 plugins, requiring additional configuration
-# described below.
-ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
-
-# If using VLANs for tenant networks, set in ``localrc`` to specify
-# the range of VLAN VIDs from which tenant networks are
-# allocated. An external network switch must be configured to
-# trunk these VLANs between hosts for multi-host connectivity.
-#
-# Example: ``TENANT_VLAN_RANGE=1000:1999``
-TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
-
-# If using VLANs for tenant networks, or if using flat or VLAN
-# provider networks, set in ``localrc`` to the name of the physical
-# network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
-# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
-# agent, as described below.
-#
-# Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
-
-# With the openvswitch agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the OVS bridge to use for the physical network. The
-# bridge will be created if it does not already exist, but a
-# physical interface must be manually added to the bridge as a
-# port for external connectivity.
-#
-# Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
-
-# With the linuxbridge agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the network interface to use for the physical
-# network.
-#
-# Example: ``LB_PHYSICAL_INTERFACE=eth1``
-LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-}
-
-# When Neutron tunnels are enabled it is needed to specify the
-# IP address of the end point in the local server. This IP is set
-# by default to the same IP address that the HOST IP.
-# This variable can be used to specify a different end point IP address
-# Example: ``TUNNEL_ENDPOINT_IP=1.1.1.1``
-TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-$HOST_IP}
-
-# With the openvswitch plugin, set to True in ``localrc`` to enable
-# provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
-#
-# Example: ``OVS_ENABLE_TUNNELING=True``
-OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
-
-# Use DHCP agent for providing metadata service in the case of
-# without L3 agent (No Route Agent), set to True in localrc.
-ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
-
-# Add a static route as dhcp option, so the request to 169.254.169.254
-# will be able to reach through a route(DHCP agent)
-# This option require ENABLE_ISOLATED_METADATA = True
-ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
-# Neutron plugin specific functions
-# ---------------------------------
-
-# Please refer to ``lib/neutron_plugins/README.md`` for details.
-source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
-
-# Agent loadbalancer service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
-
-# Agent metering service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/metering
-
-# VPN service plugin functions
-# -------------------------------------------
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/vpn
-
-# Firewall Service Plugin functions
-# ---------------------------------
-source $TOP_DIR/lib/neutron_plugins/services/firewall
-
-# Use security group or not
-if has_neutron_plugin_security_group; then
-    Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
-else
-    Q_USE_SECGROUP=False
-fi
-
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,neutron
-
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Functions
-# ---------
-
-function _determine_config_server {
-    local cfg_file
-    local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
-        opts+=" --config-file /$cfg_file"
-    done
-    echo "$opts"
-}
-
-function _determine_config_vpn {
-    local cfg_file
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE --config-file=$Q_VPN_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
-    for cfg_file in ${Q_VPN_EXTRA_CONF_FILES[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-    echo "$opts"
-
-}
-
-function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
-    echo "$opts"
-}
-
-# For services and agents that require it, dynamically construct a list of
-# --config-file arguments that are passed to the binary.
-function determine_config_files {
-    local opts=""
-    case "$1" in
-        "neutron-server") opts="$(_determine_config_server)" ;;
-        "neutron-vpn-agent") opts="$(_determine_config_vpn)" ;;
-        "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
-    esac
-    if [ -z "$opts" ] ; then
-        die $LINENO "Could not determine config files for $1."
-    fi
-    echo "$opts"
-}
-
-# Test if any Neutron services are enabled
-# is_neutron_enabled
-function is_neutron_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
-    return 1
-}
-
-# configure_neutron()
-# Set common config for all neutron server and agents.
-function configure_neutron {
-    _configure_neutron_common
-    iniset_rpc_backend neutron $NEUTRON_CONF
-
-    # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-    if is_service_enabled q-lbaas; then
-        _configure_neutron_lbaas
-    fi
-    if is_service_enabled q-metering; then
-        _configure_neutron_metering
-    fi
-    if is_service_enabled q-vpn; then
-        _configure_neutron_vpn
-    fi
-    if is_service_enabled q-fwaas; then
-        _configure_neutron_fwaas
-    fi
-    if is_service_enabled q-agt q-svc; then
-        _configure_neutron_service
-    fi
-    if is_service_enabled q-agt; then
-        _configure_neutron_plugin_agent
-    fi
-    if is_service_enabled q-dhcp; then
-        _configure_neutron_dhcp_agent
-    fi
-    if is_service_enabled q-l3; then
-        _configure_neutron_l3_agent
-    fi
-    if is_service_enabled q-meta; then
-        _configure_neutron_metadata_agent
-    fi
-
-    if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-        _configure_dvr
-    fi
-    if is_service_enabled ceilometer; then
-        _configure_neutron_ceilometer_notifications
-    fi
-
-    _configure_neutron_debug_command
-}
-
-function create_nova_conf_neutron {
-    iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
-    iniset $NOVA_CONF neutron admin_username "$Q_ADMIN_USERNAME"
-    iniset $NOVA_CONF neutron admin_password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron admin_auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
-    iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
-    iniset $NOVA_CONF neutron admin_tenant_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-    iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
-
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-        iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-        iniset $NOVA_CONF DEFAULT security_group_api neutron
-    fi
-
-    # set NOVA_VIF_DRIVER and optionally set options in nova_conf
-    neutron_plugin_create_nova_conf
-
-    iniset $NOVA_CONF libvirt vif_driver "$NOVA_VIF_DRIVER"
-    iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
-    if is_service_enabled q-meta; then
-        iniset $NOVA_CONF neutron service_metadata_proxy "True"
-    fi
-
-    iniset $NOVA_CONF DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
-    iniset $NOVA_CONF DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
-}
-
-# create_neutron_cache_dir() - Part of the _neutron_setup_keystone() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
-# create_neutron_accounts() - Set up common required neutron accounts
-
-# Tenant               User       Roles
-# ------------------------------------------------------------------
-# service              neutron    admin        # if enabled
-
-# Migrated from keystone_data.sh
-function create_neutron_accounts {
-    if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
-
-        create_service_user "neutron"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            local neutron_service=$(get_or_create_service "neutron" \
-                "network" "Neutron Service")
-            get_or_create_endpoint $neutron_service \
-                "$REGION_NAME" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
-        fi
-    fi
-}
-
-function create_neutron_initial_network {
-    TENANT_ID=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for demo"
-
-    # Allow drivers that need to create an initial network to do so here
-    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
-        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
-    fi
-
-    if is_provider_network; then
-        die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
-        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
-        fi
-
-        sudo ip link set $OVS_PHYSICAL_BRIDGE up
-        sudo ip link set br-int up
-        sudo ip link set $PUBLIC_INTERFACE up
-    else
-        NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4)
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
-        fi
-    fi
-
-    if [[ "$Q_L3_ENABLED" == "True" ]]; then
-        # Create a router, and add the private subnet as one of its interfaces
-        if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
-            # create a tenant-owned router.
-            ROUTER_ID=$(neutron router-create --tenant-id $TENANT_ID $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $TENANT_ID $Q_ROUTER_NAME"
-        else
-            # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
-        fi
-
-        # Create an external network, and a subnet. Configure the external network as router gw
-        if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
-        else
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True | grep ' id ' | get_field 2)
-        fi
-        die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            # Configure router for IPv4 public access
-            _neutron_configure_router_v4
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            # Configure router for IPv6 public access
-            _neutron_configure_router_v6
-        fi
-    fi
-}
-
-# init_neutron() - Initialize databases, etc.
-function init_neutron {
-    recreate_database $Q_DB_NAME
-    # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-    for svc in fwaas lbaas vpnaas; do
-        if [ "$svc" = "vpnaas" ]; then
-            q_svc="q-vpn"
-        else
-            q_svc="q-$svc"
-        fi
-        if is_service_enabled $q_svc; then
-            $NEUTRON_BIN_DIR/neutron-db-manage --service $svc --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-        fi
-    done
-}
-
-# install_neutron() - Collect source and prepare
-function install_neutron {
-    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
-    setup_develop $NEUTRON_DIR
-    if is_service_enabled q-fwaas; then
-        git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
-        setup_develop $NEUTRON_FWAAS_DIR
-    fi
-    if is_service_enabled q-lbaas; then
-        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-        setup_develop $NEUTRON_LBAAS_DIR
-    fi
-    if is_service_enabled q-vpn; then
-        git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
-        setup_develop $NEUTRON_VPNAAS_DIR
-    fi
-
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        local dom0_ip
-        dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
-
-        local ssh_dom0
-        ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
-
-        # Find where the plugins should go in dom0
-        local xen_functions
-        xen_functions=$(cat $TOP_DIR/tools/xen/functions)
-        local plugin_dir
-        plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
-
-        # install neutron plugins to dom0
-        tar -czf - -C $NEUTRON_DIR/neutron/plugins/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
-            $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
-    fi
-}
-
-# install_neutronclient() - Collect source and prepare
-function install_neutronclient {
-    if use_library_from_git "python-neutronclient"; then
-        git_clone_by_name "python-neutronclient"
-        setup_dev_lib "python-neutronclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
-    fi
-}
-
-# install_neutron_agent_packages() - Collect source and prepare
-function install_neutron_agent_packages {
-    # radvd doesn't come with the OS. Install it if the l3 service is enabled.
-    if is_service_enabled q-l3; then
-        install_package radvd
-    fi
-    # install packages that are specific to plugin agent(s)
-    if is_service_enabled q-agt q-dhcp q-l3; then
-        neutron_plugin_install_agent_packages
-    fi
-
-    if is_service_enabled q-lbaas; then
-        neutron_agent_lbaas_install_agent_packages
-    fi
-}
-
-# Start running processes, including screen
-function start_neutron_service_and_check {
-    local cfg_file_options="$(determine_config_files neutron-server)"
-    local service_port=$Q_PORT
-    local service_protocol=$Q_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        service_port=$Q_PORT_INT
-        service_protocol="http"
-    fi
-    # Start the Neutron service
-    run_process q-svc "python $NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-    echo "Waiting for Neutron to start..."
-    if is_ssl_enabled_service "neutron"; then
-        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
-    fi
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port; do sleep 1; done"; then
-        die $LINENO "Neutron did not start"
-    fi
-    # Start proxy if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $Q_PORT $Q_HOST $Q_PORT_INT &
-    fi
-}
-
-# Start running processes, including screen
-function start_neutron_agents {
-    # Start up the neutron agents if enabled
-    run_process q-agt "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
-
-    if is_provider_network; then
-        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
-        sudo ip link set $OVS_PHYSICAL_BRIDGE up
-        sudo ip link set br-int up
-        sudo ip link set $PUBLIC_INTERFACE up
-        if is_ironic_hardware; then
-            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
-                sudo ip addr del $IP dev $PUBLIC_INTERFACE
-                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
-            done
-            sudo route add -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-        fi
-    fi
-
-    if is_service_enabled q-vpn; then
-        run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
-    else
-        run_process q-l3 "python $AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
-    fi
-
-    run_process q-meta "python $AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
-
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        # For XenServer, start an agent for the domU openvswitch
-        run_process q-domua "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
-    fi
-
-    if is_service_enabled q-lbaas; then
-        run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
-    fi
-
-    if is_service_enabled q-metering; then
-        run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
-    fi
-}
-
-# stop_neutron() - Stop running processes (non-screen)
-function stop_neutron {
-    if is_service_enabled q-dhcp; then
-        stop_process q-dhcp
-        pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
-        [ ! -z "$pid" ] && sudo kill -9 $pid
-    fi
-
-    stop_process q-svc
-    stop_process q-l3
-
-    if is_service_enabled q-meta; then
-        sudo pkill -9 -f neutron-ns-metadata-proxy || :
-        stop_process q-meta
-    fi
-
-    stop_process q-agt
-
-    if is_service_enabled q-lbaas; then
-        neutron_lbaas_stop
-    fi
-    if is_service_enabled q-fwaas; then
-        neutron_fwaas_stop
-    fi
-    if is_service_enabled q-vpn; then
-        neutron_vpn_stop
-    fi
-    if is_service_enabled q-metering; then
-        neutron_metering_stop
-    fi
-}
-
-# cleanup_neutron() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_neutron {
-    if is_provider_network && is_ironic_hardware; then
-        for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
-            sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
-            sudo ip addr add $IP dev $PUBLIC_INTERFACE
-        done
-        sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-    fi
-
-    if is_neutron_ovs_base_plugin; then
-        neutron_ovs_base_cleanup
-    fi
-
-    # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
-        sudo ip netns delete ${ns}
-    done
-}
-
-
-function _create_neutron_conf_dir {
-    # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
-    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
-}
-
-# _configure_neutron_common()
-# Set common config for all neutron server and agents.
-# This MUST be called before other ``_configure_neutron_*`` functions.
-function _configure_neutron_common {
-    _create_neutron_conf_dir
-
-    cp $NEUTRON_DIR/etc/neutron.conf $NEUTRON_CONF
-
-    # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
-    # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH``,
-    # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
-    #
-    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1, file2)``
-    neutron_plugin_configure_common
-
-    if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
-        die $LINENO "Neutron plugin not set.. exiting"
-    fi
-
-    # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
-    mkdir -p /$Q_PLUGIN_CONF_PATH
-    Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
-    cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
-
-    iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
-    iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
-    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
-    # If addition config files are set, make sure their path name is set as well
-    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
-        die $LINENO "Neutron additional plugin config not set.. exiting"
-    fi
-
-    # If additional config files exist, copy them over to neutron configuration
-    # directory
-    if [[ $Q_PLUGIN_EXTRA_CONF_PATH != '' ]]; then
-        local f
-        for (( f=0; $f < ${#Q_PLUGIN_EXTRA_CONF_FILES[@]}; f+=1 )); do
-            Q_PLUGIN_EXTRA_CONF_FILES[$f]=$Q_PLUGIN_EXTRA_CONF_PATH/${Q_PLUGIN_EXTRA_CONF_FILES[$f]}
-        done
-    fi
-
-    if [ "$VIRT_DRIVER" = 'fake' ]; then
-        # Disable arbitrary limits
-        iniset $NEUTRON_CONF quotas quota_network -1
-        iniset $NEUTRON_CONF quotas quota_subnet -1
-        iniset $NEUTRON_CONF quotas quota_port -1
-        iniset $NEUTRON_CONF quotas quota_security_group -1
-        iniset $NEUTRON_CONF quotas quota_security_group_rule -1
-    fi
-
-    # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
-    else
-        # Show user_name and project_name by default like in nova
-        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
-    fi
-
-    if is_service_enabled tls-proxy; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
-    fi
-
-    if is_ssl_enabled_service "nova"; then
-        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "neutron"; then
-        ensure_certificates NEUTRON
-
-        iniset $NEUTRON_CONF DEFAULT use_ssl True
-        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
-        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
-    fi
-
-    _neutron_setup_rootwrap
-}
-
-function _configure_neutron_debug_command {
-    if [[ "$Q_USE_DEBUG_COMMAND" != "True" ]]; then
-        return
-    fi
-
-    cp $NEUTRON_DIR/etc/l3_agent.ini $NEUTRON_TEST_CONFIG_FILE
-
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    _neutron_setup_interface_driver $NEUTRON_TEST_CONFIG_FILE
-
-    neutron_plugin_configure_debug_command
-}
-
-function _configure_neutron_dhcp_agent {
-
-    cp $NEUTRON_DIR/etc/dhcp_agent.ini $Q_DHCP_CONF_FILE
-
-    iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
-    iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_DHCP_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    if ! is_service_enabled q-l3; then
-        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
-            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
-            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
-        else
-            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
-                die "$LINENO" "Enable isolated metadata is a must for metadata network"
-            fi
-        fi
-    fi
-
-    _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
-
-    neutron_plugin_configure_dhcp_agent
-}
-
-function _configure_neutron_l3_agent {
-    local cfg_file
-    Q_L3_ENABLED=True
-    # for l3-agent, only use per tenant router if we have namespaces
-    Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
-
-    if is_service_enabled q-vpn; then
-        neutron_vpn_configure_agent
-    fi
-
-    cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE
-
-    iniset $Q_L3_CONF_FILE DEFAULT verbose True
-    iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    _neutron_setup_interface_driver $Q_L3_CONF_FILE
-
-    neutron_plugin_configure_l3_agent
-}
-
-function _configure_neutron_metadata_agent {
-    cp $NEUTRON_DIR/etc/metadata_agent.ini $Q_META_CONF_FILE
-
-    iniset $Q_META_CONF_FILE DEFAULT verbose True
-    iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
-    iniset $Q_META_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_META_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    # Configures keystone for metadata_agent
-    # The third argument "True" sets auth_url needed to communicate with keystone
-    _neutron_setup_keystone $Q_META_CONF_FILE DEFAULT True
-
-}
-
-function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF DEFAULT notification_driver messaging
-}
-
-function _configure_neutron_lbaas {
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
-    fi
-    neutron_agent_lbaas_configure_common
-    neutron_agent_lbaas_configure_agent
-}
-
-function _configure_neutron_metering {
-    neutron_agent_metering_configure_common
-    neutron_agent_metering_configure_agent
-}
-
-function _configure_neutron_fwaas {
-    if [ -f $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf ]; then
-        cp $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf $NEUTRON_CONF_DIR
-    fi
-    neutron_fwaas_configure_common
-    neutron_fwaas_configure_driver
-}
-
-function _configure_neutron_vpn {
-    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf ]; then
-        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf $NEUTRON_CONF_DIR
-    fi
-    neutron_vpn_install_agent_packages
-    neutron_vpn_configure_common
-}
-
-function _configure_dvr {
-    iniset $NEUTRON_CONF DEFAULT router_distributed True
-    iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
-}
-
-
-# _configure_neutron_plugin_agent() - Set config files for neutron plugin agent
-# It is called when q-agt is enabled.
-function _configure_neutron_plugin_agent {
-    # Specify the default root helper prior to agent configuration to
-    # ensure that an agent's configuration can override the default
-    iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-    iniset $NEUTRON_CONF DEFAULT verbose True
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-
-    # Configure agent for plugin
-    neutron_plugin_configure_plugin_agent
-}
-
-# _configure_neutron_service() - Set config files for neutron service
-# It is called when q-svc is enabled.
-function _configure_neutron_service {
-    Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
-
-    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
-    cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
-
-    # allow neutron user to administer neutron to match neutron account
-    sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
-
-    # Update either configuration file with plugin
-    iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
-
-    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
-        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
-    fi
-
-    iniset $NEUTRON_CONF DEFAULT verbose True
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $NEUTRON_CONF DEFAULT policy_file $Q_POLICY_FILE
-    iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
-
-    iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
-    _neutron_setup_keystone $NEUTRON_CONF keystone_authtoken
-
-    # Configuration for neutron notifations to nova.
-    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
-    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
-
-    iniset $NEUTRON_CONF nova auth_plugin password
-    iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
-    iniset $NEUTRON_CONF nova username nova
-    iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
-    iniset $NEUTRON_CONF nova user_domain_id default
-    iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
-    iniset $NEUTRON_CONF nova project_domain_id default
-    iniset $NEUTRON_CONF nova region_name $REGION_NAME
-
-    # Configure plugin
-    neutron_plugin_configure_service
-}
-
-# Utility Functions
-#------------------
-
-# _neutron_service_plugin_class_add() - add service plugin class
-function _neutron_service_plugin_class_add {
-    local service_plugin_class=$1
-    if [[ $Q_SERVICE_PLUGIN_CLASSES == '' ]]; then
-        Q_SERVICE_PLUGIN_CLASSES=$service_plugin_class
-    elif [[ ! ,${Q_SERVICE_PLUGIN_CLASSES}, =~ ,${service_plugin_class}, ]]; then
-        Q_SERVICE_PLUGIN_CLASSES="$Q_SERVICE_PLUGIN_CLASSES,$service_plugin_class"
-    fi
-}
-
-# _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
-function _neutron_deploy_rootwrap_filters {
-    local srcdir=$1
-    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
-    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
-}
-
-# _neutron_setup_rootwrap() - configure Neutron's rootwrap
-function _neutron_setup_rootwrap {
-    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-        return
-    fi
-    # Wipe any existing ``rootwrap.d`` files first
-    Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
-    if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
-        sudo rm -rf $Q_CONF_ROOTWRAP_D
-    fi
-
-    _neutron_deploy_rootwrap_filters $NEUTRON_DIR
-
-    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
-    # location moved in newer versions, prefer new location
-    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
-    else
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
-    fi
-    sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
-    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
-    ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
-    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
-
-    # Set up the rootwrap sudoers for neutron
-    TEMPFILE=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
-    chmod 0440 $TEMPFILE
-    sudo chown root:root $TEMPFILE
-    sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
-
-    # Update the root_helper
-    iniset $NEUTRON_CONF agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_CONF agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-}
-
-# Configures keystone integration for neutron service and agents
-function _neutron_setup_keystone {
-    local conf_file=$1
-    local section=$2
-    local use_auth_url=$3
-
-    # Configures keystone for metadata_agent
-    # metadata_agent needs auth_url to communicate with keystone
-    if [[ "$use_auth_url" == "True" ]]; then
-        iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI/v2.0
-    fi
-
-    create_neutron_cache_dir
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
-}
-
-function _neutron_setup_interface_driver {
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $1 DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $1
-}
-
-# Create private IPv4 subnet
-function _neutron_create_private_subnet_v4 {
-    local subnet_params="--tenant-id $TENANT_ID "
-    subnet_params+="--ip_version 4 "
-    subnet_params+="--gateway $NETWORK_GATEWAY "
-    subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE"
-    local subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $TENANT_ID"
-    echo $subnet_id
-}
-
-# Create private IPv6 subnet
-function _neutron_create_private_subnet_v6 {
-    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
-    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
-    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
-    local subnet_params="--tenant-id $TENANT_ID "
-    subnet_params+="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
-    local ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $TENANT_ID"
-    echo $ipv6_subnet_id
-}
-
-# Create public IPv4 subnet
-function _neutron_create_public_subnet_v4 {
-    local subnet_params+="--ip_version 4 "
-    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
-    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
-    local id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
-    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
-    echo $id_and_ext_gw_ip
-}
-
-# Create public IPv6 subnet
-function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
-    local ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
-    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
-    echo $ipv6_id_and_ext_gw_ip
-}
-
-# Configure neutron router for IPv4 public access
-function _neutron_configure_router_v4 {
-    neutron router-interface-add $ROUTER_ID $SUBNET_ID
-    # Create a public subnet on the external network
-    local id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
-    local ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
-    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
-    # Configure the external network as the default router gateway
-    neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
-
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
-        # Configure and enable public bridge
-        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
-            local cidr_len=${FLOATING_RANGE#*/}
-            sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
-            sudo ip link set $ext_gw_interface up
-            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
-            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP
-        fi
-        _neutron_set_router_id
-    fi
-}
-
-# Configure neutron router for IPv6 public access
-function _neutron_configure_router_v6 {
-    neutron router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
-    # Create a public subnet on the external network
-    local ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
-    local ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
-    local ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
-
-    # If the external network has not already been set as the default router
-    # gateway when configuring an IPv4 public subnet, do so now
-    if [[ "$IP_VERSION" == "6" ]]; then
-        neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
-    fi
-
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
-        local ipv6_router_gw_port
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
-        # Configure and enable public bridge
-        if [[ "$IP_VERSION" = "6" ]]; then
-            # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-            IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
-            die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
-            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
-            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
-        else
-            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
-            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
-        fi
-
-        # The ovs_base_configure_l3_agent function flushes the public
-        # bridge's ip addresses, so turn IPv6 support in the host off
-        # and then on to recover the public bridge's link local address
-        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=1
-        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=0
-        if ! ip -6 addr show dev $PUBLIC_BRIDGE | grep 'scope global'; then
-            # Create an IPv6 ULA address for PUBLIC_BRIDGE if one is not present
-            IPV6_BRIDGE_ULA=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
-            sudo ip -6 addr add fd$IPV6_BRIDGE_ULA::1 dev $PUBLIC_BRIDGE
-        fi
-
-        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
-            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-
-            # Define router_ns based on whether DVR is enabled
-            local router_ns=qrouter
-            if [[ "$Q_DVR_MODE" == "dvr_snat" ]]; then
-                router_ns=snat
-            fi
-
-            # Configure interface for public bridge
-            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-
-            # Wait until layer 3 agent has configured the gateway port on
-            # the public bridge, then add gateway address to the interface
-            # TODO (john-davidge) Remove once l3-agent supports dual-stack
-            if [[ "$IP_VERSION" == "4+6" ]]; then
-                if ! timeout $GATEWAY_TIMEOUT sh -c "until sudo ip netns exec $router_ns-$ROUTER_ID ip addr show qg-${ipv6_router_gw_port:0:11} | grep $ROUTER_GW_IP; do sleep 1; done"; then
-                    die $LINENO "Timeout retrieving ROUTER_GW_IP"
-                fi
-                # Configure the gateway port with the public IPv6 adress
-                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 addr add $IPV6_ROUTER_GW_IP/$ipv6_cidr_len dev qg-${ipv6_router_gw_port:0:11}
-                # Add a default IPv6 route to the neutron router as the
-                # l3-agent does not add one in the dual-stack case
-                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 route replace default via $ipv6_ext_gw_ip dev qg-${ipv6_router_gw_port:0:11}
-            fi
-            sudo ip -6 route add $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
-        fi
-        _neutron_set_router_id
-    fi
-}
-
-# Explicitly set router id in l3 agent configuration
-function _neutron_set_router_id {
-    if [[ "$Q_USE_NAMESPACE" == "False" ]]; then
-        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
-    fi
-}
-
-# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
-function _neutron_get_ext_gw_interface {
-    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
-        echo $Q_PUBLIC_VETH_EX
-    else
-        # Disable in-band as we are going to use local port
-        # to communicate with VMs
-        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
-            other_config:disable-in-band=true
-        echo $PUBLIC_BRIDGE
-    fi
-}
-
-# Functions for Neutron Exercises
-#--------------------------------
-
-function delete_probe {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
-    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
-}
-
-function setup_neutron_debug {
-    if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
-        public_net_id=`_get_net_id $PUBLIC_NETWORK_NAME`
-        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
-        private_net_id=`_get_net_id $PRIVATE_NETWORK_NAME`
-        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
-    fi
-}
-
-function teardown_neutron_debug {
-    delete_probe $PUBLIC_NETWORK_NAME
-    delete_probe $PRIVATE_NETWORK_NAME
-}
-
-function _get_net_id {
-    neutron --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
-}
-
-function _get_probe_cmd_prefix {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
-    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
-}
-
-function _ping_check_neutron {
-    local from_net=$1
-    local ip=$2
-    local timeout_sec=$3
-    local expected=${4:-"True"}
-    local check_command=""
-    probe_cmd=`_get_probe_cmd_prefix $from_net`
-    if [[ "$expected" = "True" ]]; then
-        check_command="while ! $probe_cmd ping -w 1 -c 1 $ip; do sleep 1; done"
-    else
-        check_command="while $probe_cmd ping -w 1 -c 1 $ip; do sleep 1; done"
-    fi
-    if ! timeout $timeout_sec sh -c "$check_command"; then
-        if [[ "$expected" = "True" ]]; then
-            die $LINENO "[Fail] Couldn't ping server"
-        else
-            die $LINENO "[Fail] Could ping server"
-        fi
-    fi
-}
-
-# ssh check
-function _ssh_check_neutron {
-    local from_net=$1
-    local key_file=$2
-    local ip=$3
-    local user=$4
-    local timeout_sec=$5
-    local probe_cmd = ""
-    probe_cmd=`_get_probe_cmd_prefix $from_net`
-    if ! timeout $timeout_sec sh -c "while ! $probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success; do sleep 1; done"; then
-        die $LINENO "server didn't become ssh-able!"
-    fi
-}
-
-# Neutron 3rd party programs
-#---------------------------
-
-# please refer to ``lib/neutron_thirdparty/README.md`` for details
-NEUTRON_THIRD_PARTIES=""
-for f in $TOP_DIR/lib/neutron_thirdparty/*; do
-    third_party=$(basename $f)
-    if is_service_enabled $third_party; then
-        source $TOP_DIR/lib/neutron_thirdparty/$third_party
-        NEUTRON_THIRD_PARTIES="$NEUTRON_THIRD_PARTIES,$third_party"
-    fi
-done
-
-function _neutron_third_party_do {
-    for third_party in ${NEUTRON_THIRD_PARTIES//,/ }; do
-        ${1}_${third_party}
-    done
-}
-
-# configure_neutron_third_party() - Set config files, create data dirs, etc
-function configure_neutron_third_party {
-    _neutron_third_party_do configure
-}
-
-# init_neutron_third_party() - Initialize databases, etc.
-function init_neutron_third_party {
-    _neutron_third_party_do init
-}
-
-# install_neutron_third_party() - Collect source and prepare
-function install_neutron_third_party {
-    _neutron_third_party_do install
-}
-
-# start_neutron_third_party() - Start running processes, including screen
-function start_neutron_third_party {
-    _neutron_third_party_do start
-}
-
-# stop_neutron_third_party - Stop running processes (non-screen)
-function stop_neutron_third_party {
-    _neutron_third_party_do stop
-}
-
-# check_neutron_third_party_integration() - Check that third party integration is sane
-function check_neutron_third_party_integration {
-    _neutron_third_party_do check
-}
-
-function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
-        return 0
-    fi
-    return 1
-}
-
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/lib/neutron b/lib/neutron
new file mode 120000
index 0000000000..00cd72273e
--- /dev/null
+++ b/lib/neutron
@@ -0,0 +1 @@
+neutron-legacy
\ No newline at end of file
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
new file mode 100755
index 0000000000..5ff39212fc
--- /dev/null
+++ b/lib/neutron-legacy
@@ -0,0 +1,1467 @@
+#!/bin/bash
+#
+# lib/neutron
+# functions - functions specific to neutron
+
+# Dependencies:
+# ``functions`` file
+# ``DEST`` must be defined
+# ``STACK_USER`` must be defined
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - install_neutron_agent_packages
+# - install_neutronclient
+# - install_neutron
+# - install_neutron_third_party
+# - configure_neutron
+# - init_neutron
+# - configure_neutron_third_party
+# - init_neutron_third_party
+# - start_neutron_third_party
+# - create_nova_conf_neutron
+# - start_neutron_service_and_check
+# - check_neutron_third_party_integration
+# - start_neutron_agents
+# - create_neutron_initial_network
+# - setup_neutron_debug
+#
+# ``unstack.sh`` calls the entry points in this order:
+#
+# - teardown_neutron_debug
+# - stop_neutron
+# - stop_neutron_third_party
+# - cleanup_neutron
+
+# Functions in lib/neutron are classified into the following categories:
+#
+# - entry points (called from stack.sh or unstack.sh)
+# - internal functions
+# - neutron exercises
+# - 3rd party programs
+
+
+# Neutron Networking
+# ------------------
+
+# Make sure that neutron is enabled in ``ENABLED_SERVICES``.  If you want
+# to run Neutron on this host, make sure that q-svc is also in
+# ``ENABLED_SERVICES``.
+#
+# See "Neutron Network Configuration" below for additional variables
+# that must be set in localrc for connectivity across hosts with
+# Neutron.
+#
+# With Neutron networking the NETWORK_MANAGER variable is ignored.
+
+# Settings
+# --------
+
+# Timeout value in seconds to wait for IPv6 gateway configuration
+GATEWAY_TIMEOUT=30
+
+
+# Neutron Network Configuration
+# -----------------------------
+
+# Subnet IP version
+IP_VERSION=${IP_VERSION:-4}
+# Validate IP_VERSION
+if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
+    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
+fi
+# Gateway and subnet defaults, in case they are not customized in localrc
+NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
+PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
+PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
+PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
+
+if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+    Q_PROTOCOL="https"
+fi
+
+# Generate 40-bit IPv6 Global ID to comply with RFC 4193
+IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
+
+# IPv6 gateway and subnet defaults, in case they are not customized in localrc
+IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
+IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
+IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
+IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
+IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
+IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-fe80:cafe:cafe::/64}
+IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-fe80:cafe:cafe::2}
+# IPV6_ROUTER_GW_IP must be defined when IP_VERSION=4+6 as it cannot be
+# obtained conventionally until the l3-agent has support for dual-stack
+# TODO (john-davidge) Remove once l3-agent supports dual-stack
+IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-fe80:cafe:cafe::1}
+
+# Set up default directories
+GITDIR["python-neutronclient"]=$DEST/python-neutronclient
+
+
+NEUTRON_DIR=$DEST/neutron
+NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
+NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
+
+# Support entry points installation of console scripts
+if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
+    NEUTRON_BIN_DIR=$NEUTRON_DIR/bin
+else
+    NEUTRON_BIN_DIR=$(get_python_exec_prefix)
+fi
+
+NEUTRON_CONF_DIR=/etc/neutron
+NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
+export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
+
+# Agent binaries.  Note, binary paths for other agents are set in per-service
+# scripts in lib/neutron_plugins/services/
+AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
+AGENT_L3_BINARY=${AGENT_L3_BINARY:-"$NEUTRON_BIN_DIR/neutron-l3-agent"}
+AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
+
+# Agent config files. Note, plugin-specific Q_PLUGIN_CONF_FILE is set and
+# loaded from per-plugin  scripts in lib/neutron_plugins/
+Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
+Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
+Q_FWAAS_CONF_FILE=$NEUTRON_CONF_DIR/fwaas_driver.ini
+Q_VPN_CONF_FILE=$NEUTRON_CONF_DIR/vpn_agent.ini
+Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
+
+# Default name for Neutron database
+Q_DB_NAME=${Q_DB_NAME:-neutron}
+# Default Neutron Plugin
+Q_PLUGIN=${Q_PLUGIN:-ml2}
+# Default Neutron Port
+Q_PORT=${Q_PORT:-9696}
+# Default Neutron Internal Port when using TLS proxy
+Q_PORT_INT=${Q_PORT_INT:-19696}
+# Default Neutron Host
+Q_HOST=${Q_HOST:-$SERVICE_HOST}
+# Default protocol
+Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
+# Default admin username
+Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
+# Default auth strategy
+Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
+# Use namespace or not
+Q_USE_NAMESPACE=${Q_USE_NAMESPACE:-True}
+# RHEL's support for namespaces requires using veths with ovs
+Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
+Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
+Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
+# Meta data IP
+Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
+# Allow Overlapping IP among subnets
+Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
+# Use neutron-debug command
+Q_USE_DEBUG_COMMAND=${Q_USE_DEBUG_COMMAND:-False}
+# The name of the default q-l3 router
+Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
+# nova vif driver that all plugins should use
+NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
+Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
+Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
+VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
+VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
+# Specify if the initial private and external networks should be created
+NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
+
+## Provider Network Information
+PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
+
+# Use flat providernet for public network
+#
+# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
+# for external interface of neutron l3-agent.  In that case,
+# PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
+# used for the network.  In case of ofagent, you should add the
+# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
+# For openvswitch agent, you should add the corresponding entry to
+# your OVS_BRIDGE_MAPPINGS.
+#
+# eg.  (ofagent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    Q_USE_PUBLIC_VETH=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
+#
+# eg.  (openvswitch agent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OVS_BRIDGE_MAPPINGS=public:br-ex
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
+
+# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
+# PUBLIC_BRIDGE.  This is intended to be used with
+# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
+Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
+Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
+Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
+
+# The next two variables are configured by plugin
+# e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
+#
+# The plugin supports L3.
+Q_L3_ENABLED=${Q_L3_ENABLED:-False}
+# L3 routers exist per tenant
+Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-False}
+
+# List of config file names in addition to the main plugin config file
+# See _configure_neutron_common() for details about setting it up
+declare -a Q_PLUGIN_EXTRA_CONF_FILES
+
+# List of (optional) config files for VPN device drivers to use with
+# the neutron-q-vpn agent
+declare -a Q_VPN_EXTRA_CONF_FILES
+
+
+Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
+if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+    Q_RR_COMMAND="sudo"
+else
+    NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
+    Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+    fi
+fi
+
+
+# Distributed Virtual Router (DVR) configuration
+# Can be:
+# - ``legacy``   - No DVR functionality
+# - ``dvr_snat`` - Controller or single node DVR
+# - ``dvr``      - Compute node in multi-node DVR
+#
+Q_DVR_MODE=${Q_DVR_MODE:-legacy}
+if [[ "$Q_DVR_MODE" != "legacy" ]]; then
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,l2population
+fi
+
+# Provider Network Configurations
+# --------------------------------
+
+# The following variables control the Neutron ML2 plugins' allocation
+# of tenant networks and availability of provider networks. If these
+# are not configured in ``localrc``, tenant networks will be local to
+# the host (with no remote connectivity), and no physical resources
+# will be available for the allocation of provider networks.
+
+# To disable tunnels (GRE or VXLAN) for tenant networks,
+# set to False in ``local.conf``.
+# GRE tunnels are only supported by the openvswitch.
+ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
+
+# If using GRE tunnels for tenant networks, specify the range of
+# tunnel IDs from which tenant networks are allocated. Can be
+# overriden in ``localrc`` in necesssary.
+TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
+
+# To use VLANs for tenant networks, set to True in localrc. VLANs
+# are supported by the ML2 plugins, requiring additional configuration
+# described below.
+ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
+
+# If using VLANs for tenant networks, set in ``localrc`` to specify
+# the range of VLAN VIDs from which tenant networks are
+# allocated. An external network switch must be configured to
+# trunk these VLANs between hosts for multi-host connectivity.
+#
+# Example: ``TENANT_VLAN_RANGE=1000:1999``
+TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
+
+# If using VLANs for tenant networks, or if using flat or VLAN
+# provider networks, set in ``localrc`` to the name of the physical
+# network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
+# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
+# agent, as described below.
+#
+# Example: ``PHYSICAL_NETWORK=default``
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
+
+# With the openvswitch agent, if using VLANs for tenant networks,
+# or if using flat or VLAN provider networks, set in ``localrc`` to
+# the name of the OVS bridge to use for the physical network. The
+# bridge will be created if it does not already exist, but a
+# physical interface must be manually added to the bridge as a
+# port for external connectivity.
+#
+# Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
+
+# With the linuxbridge agent, if using VLANs for tenant networks,
+# or if using flat or VLAN provider networks, set in ``localrc`` to
+# the name of the network interface to use for the physical
+# network.
+#
+# Example: ``LB_PHYSICAL_INTERFACE=eth1``
+LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-}
+
+# When Neutron tunnels are enabled it is needed to specify the
+# IP address of the end point in the local server. This IP is set
+# by default to the same IP address that the HOST IP.
+# This variable can be used to specify a different end point IP address
+# Example: ``TUNNEL_ENDPOINT_IP=1.1.1.1``
+TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-$HOST_IP}
+
+# With the openvswitch plugin, set to True in ``localrc`` to enable
+# provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
+#
+# Example: ``OVS_ENABLE_TUNNELING=True``
+OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
+
+# Use DHCP agent for providing metadata service in the case of
+# without L3 agent (No Route Agent), set to True in localrc.
+ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
+
+# Add a static route as dhcp option, so the request to 169.254.169.254
+# will be able to reach through a route(DHCP agent)
+# This option require ENABLE_ISOLATED_METADATA = True
+ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
+# Neutron plugin specific functions
+# ---------------------------------
+
+# Please refer to ``lib/neutron_plugins/README.md`` for details.
+source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
+
+# Agent loadbalancer service plugin functions
+# -------------------------------------------
+
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
+
+# Agent metering service plugin functions
+# -------------------------------------------
+
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/metering
+
+# VPN service plugin functions
+# -------------------------------------------
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/vpn
+
+# Firewall Service Plugin functions
+# ---------------------------------
+source $TOP_DIR/lib/neutron_plugins/services/firewall
+
+# Use security group or not
+if has_neutron_plugin_security_group; then
+    Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
+else
+    Q_USE_SECGROUP=False
+fi
+
+# Tell Tempest this project is present
+TEMPEST_SERVICES+=,neutron
+
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Functions
+# ---------
+
+function _determine_config_server {
+    local cfg_file
+    local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+        opts+=" --config-file /$cfg_file"
+    done
+    echo "$opts"
+}
+
+function _determine_config_vpn {
+    local cfg_file
+    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE --config-file=$Q_VPN_CONF_FILE"
+    if is_service_enabled q-fwaas; then
+        opts+=" --config-file $Q_FWAAS_CONF_FILE"
+    fi
+    for cfg_file in ${Q_VPN_EXTRA_CONF_FILES[@]}; do
+        opts+=" --config-file $cfg_file"
+    done
+    echo "$opts"
+
+}
+
+function _determine_config_l3 {
+    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    if is_service_enabled q-fwaas; then
+        opts+=" --config-file $Q_FWAAS_CONF_FILE"
+    fi
+    echo "$opts"
+}
+
+# For services and agents that require it, dynamically construct a list of
+# --config-file arguments that are passed to the binary.
+function determine_config_files {
+    local opts=""
+    case "$1" in
+        "neutron-server") opts="$(_determine_config_server)" ;;
+        "neutron-vpn-agent") opts="$(_determine_config_vpn)" ;;
+        "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
+    esac
+    if [ -z "$opts" ] ; then
+        die $LINENO "Could not determine config files for $1."
+    fi
+    echo "$opts"
+}
+
+# Test if any Neutron services are enabled
+# is_neutron_enabled
+function is_neutron_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
+    return 1
+}
+
+# configure_neutron()
+# Set common config for all neutron server and agents.
+function configure_neutron {
+    _configure_neutron_common
+    iniset_rpc_backend neutron $NEUTRON_CONF
+
+    # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
+    if is_service_enabled q-lbaas; then
+        _configure_neutron_lbaas
+    fi
+    if is_service_enabled q-metering; then
+        _configure_neutron_metering
+    fi
+    if is_service_enabled q-vpn; then
+        _configure_neutron_vpn
+    fi
+    if is_service_enabled q-fwaas; then
+        _configure_neutron_fwaas
+    fi
+    if is_service_enabled q-agt q-svc; then
+        _configure_neutron_service
+    fi
+    if is_service_enabled q-agt; then
+        _configure_neutron_plugin_agent
+    fi
+    if is_service_enabled q-dhcp; then
+        _configure_neutron_dhcp_agent
+    fi
+    if is_service_enabled q-l3; then
+        _configure_neutron_l3_agent
+    fi
+    if is_service_enabled q-meta; then
+        _configure_neutron_metadata_agent
+    fi
+
+    if [[ "$Q_DVR_MODE" != "legacy" ]]; then
+        _configure_dvr
+    fi
+    if is_service_enabled ceilometer; then
+        _configure_neutron_ceilometer_notifications
+    fi
+
+    _configure_neutron_debug_command
+}
+
+function create_nova_conf_neutron {
+    iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
+    iniset $NOVA_CONF neutron admin_username "$Q_ADMIN_USERNAME"
+    iniset $NOVA_CONF neutron admin_password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF neutron admin_auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
+    iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
+    iniset $NOVA_CONF neutron admin_tenant_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
+    iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
+
+    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
+        LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
+        iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
+        iniset $NOVA_CONF DEFAULT security_group_api neutron
+    fi
+
+    # set NOVA_VIF_DRIVER and optionally set options in nova_conf
+    neutron_plugin_create_nova_conf
+
+    iniset $NOVA_CONF libvirt vif_driver "$NOVA_VIF_DRIVER"
+    iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
+    if is_service_enabled q-meta; then
+        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+    fi
+
+    iniset $NOVA_CONF DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
+    iniset $NOVA_CONF DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
+}
+
+# create_neutron_cache_dir() - Part of the _neutron_setup_keystone() process
+function create_neutron_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
+    rm -f $NEUTRON_AUTH_CACHE_DIR/*
+}
+
+# create_neutron_accounts() - Set up common required neutron accounts
+
+# Tenant               User       Roles
+# ------------------------------------------------------------------
+# service              neutron    admin        # if enabled
+
+# Migrated from keystone_data.sh
+function create_neutron_accounts {
+    if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
+
+        create_service_user "neutron"
+
+        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
+
+            local neutron_service=$(get_or_create_service "neutron" \
+                "network" "Neutron Service")
+            get_or_create_endpoint $neutron_service \
+                "$REGION_NAME" \
+                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
+                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
+                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
+        fi
+    fi
+}
+
+function create_neutron_initial_network {
+    TENANT_ID=$(openstack project list | grep " demo " | get_field 1)
+    die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for demo"
+
+    # Allow drivers that need to create an initial network to do so here
+    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
+        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
+    fi
+
+    if is_provider_network; then
+        die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
+        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
+        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
+        fi
+
+        sudo ip link set $OVS_PHYSICAL_BRIDGE up
+        sudo ip link set br-int up
+        sudo ip link set $PUBLIC_INTERFACE up
+    else
+        NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Create IPv4 private subnet
+            SUBNET_ID=$(_neutron_create_private_subnet_v4)
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Create IPv6 private subnet
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
+        fi
+    fi
+
+    if [[ "$Q_L3_ENABLED" == "True" ]]; then
+        # Create a router, and add the private subnet as one of its interfaces
+        if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
+            # create a tenant-owned router.
+            ROUTER_ID=$(neutron router-create --tenant-id $TENANT_ID $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $TENANT_ID $Q_ROUTER_NAME"
+        else
+            # Plugin only supports creating a single router, which should be admin owned.
+            ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
+        fi
+
+        # Create an external network, and a subnet. Configure the external network as router gw
+        if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
+            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+        else
+            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True | grep ' id ' | get_field 2)
+        fi
+        die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Configure router for IPv4 public access
+            _neutron_configure_router_v4
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Configure router for IPv6 public access
+            _neutron_configure_router_v6
+        fi
+    fi
+}
+
+# init_neutron() - Initialize databases, etc.
+function init_neutron {
+    recreate_database $Q_DB_NAME
+    # Run Neutron db migrations
+    $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
+    for svc in fwaas lbaas vpnaas; do
+        if [ "$svc" = "vpnaas" ]; then
+            q_svc="q-vpn"
+        else
+            q_svc="q-$svc"
+        fi
+        if is_service_enabled $q_svc; then
+            $NEUTRON_BIN_DIR/neutron-db-manage --service $svc --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
+        fi
+    done
+}
+
+# install_neutron() - Collect source and prepare
+function install_neutron {
+    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
+    setup_develop $NEUTRON_DIR
+    if is_service_enabled q-fwaas; then
+        git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
+        setup_develop $NEUTRON_FWAAS_DIR
+    fi
+    if is_service_enabled q-lbaas; then
+        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
+        setup_develop $NEUTRON_LBAAS_DIR
+    fi
+    if is_service_enabled q-vpn; then
+        git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
+        setup_develop $NEUTRON_VPNAAS_DIR
+    fi
+
+    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
+        local dom0_ip
+        dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
+
+        local ssh_dom0
+        ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
+
+        # Find where the plugins should go in dom0
+        local xen_functions
+        xen_functions=$(cat $TOP_DIR/tools/xen/functions)
+        local plugin_dir
+        plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
+
+        # install neutron plugins to dom0
+        tar -czf - -C $NEUTRON_DIR/neutron/plugins/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
+            $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
+    fi
+}
+
+# install_neutronclient() - Collect source and prepare
+function install_neutronclient {
+    if use_library_from_git "python-neutronclient"; then
+        git_clone_by_name "python-neutronclient"
+        setup_dev_lib "python-neutronclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
+    fi
+}
+
+# install_neutron_agent_packages() - Collect source and prepare
+function install_neutron_agent_packages {
+    # radvd doesn't come with the OS. Install it if the l3 service is enabled.
+    if is_service_enabled q-l3; then
+        install_package radvd
+    fi
+    # install packages that are specific to plugin agent(s)
+    if is_service_enabled q-agt q-dhcp q-l3; then
+        neutron_plugin_install_agent_packages
+    fi
+
+    if is_service_enabled q-lbaas; then
+        neutron_agent_lbaas_install_agent_packages
+    fi
+}
+
+# Start running processes, including screen
+function start_neutron_service_and_check {
+    local cfg_file_options="$(determine_config_files neutron-server)"
+    local service_port=$Q_PORT
+    local service_protocol=$Q_PROTOCOL
+    if is_service_enabled tls-proxy; then
+        service_port=$Q_PORT_INT
+        service_protocol="http"
+    fi
+    # Start the Neutron service
+    run_process q-svc "python $NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+    echo "Waiting for Neutron to start..."
+    if is_ssl_enabled_service "neutron"; then
+        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
+    fi
+    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port; do sleep 1; done"; then
+        die $LINENO "Neutron did not start"
+    fi
+    # Start proxy if enabled
+    if is_service_enabled tls-proxy; then
+        start_tls_proxy '*' $Q_PORT $Q_HOST $Q_PORT_INT &
+    fi
+}
+
+# Start running processes, including screen
+function start_neutron_agents {
+    # Start up the neutron agents if enabled
+    run_process q-agt "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+    run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
+
+    if is_provider_network; then
+        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
+        sudo ip link set $OVS_PHYSICAL_BRIDGE up
+        sudo ip link set br-int up
+        sudo ip link set $PUBLIC_INTERFACE up
+        if is_ironic_hardware; then
+            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $PUBLIC_INTERFACE
+                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
+            done
+            sudo route add -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+        fi
+    fi
+
+    if is_service_enabled q-vpn; then
+        run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
+    else
+        run_process q-l3 "python $AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
+    fi
+
+    run_process q-meta "python $AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
+
+    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
+        # For XenServer, start an agent for the domU openvswitch
+        run_process q-domua "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
+    fi
+
+    if is_service_enabled q-lbaas; then
+        run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
+    fi
+
+    if is_service_enabled q-metering; then
+        run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
+    fi
+}
+
+# stop_neutron() - Stop running processes (non-screen)
+function stop_neutron {
+    if is_service_enabled q-dhcp; then
+        stop_process q-dhcp
+        pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
+        [ ! -z "$pid" ] && sudo kill -9 $pid
+    fi
+
+    stop_process q-svc
+    stop_process q-l3
+
+    if is_service_enabled q-meta; then
+        sudo pkill -9 -f neutron-ns-metadata-proxy || :
+        stop_process q-meta
+    fi
+
+    stop_process q-agt
+
+    if is_service_enabled q-lbaas; then
+        neutron_lbaas_stop
+    fi
+    if is_service_enabled q-fwaas; then
+        neutron_fwaas_stop
+    fi
+    if is_service_enabled q-vpn; then
+        neutron_vpn_stop
+    fi
+    if is_service_enabled q-metering; then
+        neutron_metering_stop
+    fi
+}
+
+# cleanup_neutron() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_neutron {
+    if is_provider_network && is_ironic_hardware; then
+        for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
+            sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
+            sudo ip addr add $IP dev $PUBLIC_INTERFACE
+        done
+        sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+    fi
+
+    if is_neutron_ovs_base_plugin; then
+        neutron_ovs_base_cleanup
+    fi
+
+    # delete all namespaces created by neutron
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+        sudo ip netns delete ${ns}
+    done
+}
+
+
+function _create_neutron_conf_dir {
+    # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
+    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+}
+
+# _configure_neutron_common()
+# Set common config for all neutron server and agents.
+# This MUST be called before other ``_configure_neutron_*`` functions.
+function _configure_neutron_common {
+    _create_neutron_conf_dir
+
+    cp $NEUTRON_DIR/etc/neutron.conf $NEUTRON_CONF
+
+    # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
+    # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
+    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH``,
+    # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
+    #
+    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1, file2)``
+    neutron_plugin_configure_common
+
+    if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
+        die $LINENO "Neutron plugin not set.. exiting"
+    fi
+
+    # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
+    mkdir -p /$Q_PLUGIN_CONF_PATH
+    Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
+    cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
+
+    iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
+    iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
+    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
+    # If addition config files are set, make sure their path name is set as well
+    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
+        die $LINENO "Neutron additional plugin config not set.. exiting"
+    fi
+
+    # If additional config files exist, copy them over to neutron configuration
+    # directory
+    if [[ $Q_PLUGIN_EXTRA_CONF_PATH != '' ]]; then
+        local f
+        for (( f=0; $f < ${#Q_PLUGIN_EXTRA_CONF_FILES[@]}; f+=1 )); do
+            Q_PLUGIN_EXTRA_CONF_FILES[$f]=$Q_PLUGIN_EXTRA_CONF_PATH/${Q_PLUGIN_EXTRA_CONF_FILES[$f]}
+        done
+    fi
+
+    if [ "$VIRT_DRIVER" = 'fake' ]; then
+        # Disable arbitrary limits
+        iniset $NEUTRON_CONF quotas quota_network -1
+        iniset $NEUTRON_CONF quotas quota_subnet -1
+        iniset $NEUTRON_CONF quotas quota_port -1
+        iniset $NEUTRON_CONF quotas quota_security_group -1
+        iniset $NEUTRON_CONF quotas quota_security_group_rule -1
+    fi
+
+    # Format logging
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
+    else
+        # Show user_name and project_name by default like in nova
+        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+    fi
+
+    if is_service_enabled tls-proxy; then
+        # Set the service port for a proxy to take the original
+        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
+    fi
+
+    if is_ssl_enabled_service "nova"; then
+        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
+    fi
+
+    if is_ssl_enabled_service "neutron"; then
+        ensure_certificates NEUTRON
+
+        iniset $NEUTRON_CONF DEFAULT use_ssl True
+        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
+        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
+    fi
+
+    _neutron_setup_rootwrap
+}
+
+function _configure_neutron_debug_command {
+    if [[ "$Q_USE_DEBUG_COMMAND" != "True" ]]; then
+        return
+    fi
+
+    cp $NEUTRON_DIR/etc/l3_agent.ini $NEUTRON_TEST_CONFIG_FILE
+
+    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
+    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
+    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
+    iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+
+    _neutron_setup_interface_driver $NEUTRON_TEST_CONFIG_FILE
+
+    neutron_plugin_configure_debug_command
+}
+
+function _configure_neutron_dhcp_agent {
+
+    cp $NEUTRON_DIR/etc/dhcp_agent.ini $Q_DHCP_CONF_FILE
+
+    iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
+    iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
+    iniset $Q_DHCP_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+
+    if ! is_service_enabled q-l3; then
+        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
+        else
+            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
+                die "$LINENO" "Enable isolated metadata is a must for metadata network"
+            fi
+        fi
+    fi
+
+    _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
+
+    neutron_plugin_configure_dhcp_agent
+}
+
+function _configure_neutron_l3_agent {
+    local cfg_file
+    Q_L3_ENABLED=True
+    # for l3-agent, only use per tenant router if we have namespaces
+    Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
+
+    if is_service_enabled q-vpn; then
+        neutron_vpn_configure_agent
+    fi
+
+    cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE
+
+    iniset $Q_L3_CONF_FILE DEFAULT verbose True
+    iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
+    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+
+    _neutron_setup_interface_driver $Q_L3_CONF_FILE
+
+    neutron_plugin_configure_l3_agent
+}
+
+function _configure_neutron_metadata_agent {
+    cp $NEUTRON_DIR/etc/metadata_agent.ini $Q_META_CONF_FILE
+
+    iniset $Q_META_CONF_FILE DEFAULT verbose True
+    iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $Q_META_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+
+    # Configures keystone for metadata_agent
+    # The third argument "True" sets auth_url needed to communicate with keystone
+    _neutron_setup_keystone $Q_META_CONF_FILE DEFAULT True
+
+}
+
+function _configure_neutron_ceilometer_notifications {
+    iniset $NEUTRON_CONF DEFAULT notification_driver messaging
+}
+
+function _configure_neutron_lbaas {
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
+    fi
+    neutron_agent_lbaas_configure_common
+    neutron_agent_lbaas_configure_agent
+}
+
+function _configure_neutron_metering {
+    neutron_agent_metering_configure_common
+    neutron_agent_metering_configure_agent
+}
+
+function _configure_neutron_fwaas {
+    if [ -f $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf ]; then
+        cp $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf $NEUTRON_CONF_DIR
+    fi
+    neutron_fwaas_configure_common
+    neutron_fwaas_configure_driver
+}
+
+function _configure_neutron_vpn {
+    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf ]; then
+        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf $NEUTRON_CONF_DIR
+    fi
+    neutron_vpn_install_agent_packages
+    neutron_vpn_configure_common
+}
+
+function _configure_dvr {
+    iniset $NEUTRON_CONF DEFAULT router_distributed True
+    iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
+}
+
+
+# _configure_neutron_plugin_agent() - Set config files for neutron plugin agent
+# It is called when q-agt is enabled.
+function _configure_neutron_plugin_agent {
+    # Specify the default root helper prior to agent configuration to
+    # ensure that an agent's configuration can override the default
+    iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+    iniset $NEUTRON_CONF DEFAULT verbose True
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+
+    # Configure agent for plugin
+    neutron_plugin_configure_plugin_agent
+}
+
+# _configure_neutron_service() - Set config files for neutron service
+# It is called when q-svc is enabled.
+function _configure_neutron_service {
+    Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
+    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
+
+    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+    cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
+
+    # allow neutron user to administer neutron to match neutron account
+    sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
+
+    # Update either configuration file with plugin
+    iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
+
+    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
+        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
+    fi
+
+    iniset $NEUTRON_CONF DEFAULT verbose True
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $NEUTRON_CONF DEFAULT policy_file $Q_POLICY_FILE
+    iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
+
+    iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
+    _neutron_setup_keystone $NEUTRON_CONF keystone_authtoken
+
+    # Configuration for neutron notifations to nova.
+    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
+    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
+
+    iniset $NEUTRON_CONF nova auth_plugin password
+    iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
+    iniset $NEUTRON_CONF nova username nova
+    iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
+    iniset $NEUTRON_CONF nova user_domain_id default
+    iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
+    iniset $NEUTRON_CONF nova project_domain_id default
+    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
+    # Configure plugin
+    neutron_plugin_configure_service
+}
+
+# Utility Functions
+#------------------
+
+# _neutron_service_plugin_class_add() - add service plugin class
+function _neutron_service_plugin_class_add {
+    local service_plugin_class=$1
+    if [[ $Q_SERVICE_PLUGIN_CLASSES == '' ]]; then
+        Q_SERVICE_PLUGIN_CLASSES=$service_plugin_class
+    elif [[ ! ,${Q_SERVICE_PLUGIN_CLASSES}, =~ ,${service_plugin_class}, ]]; then
+        Q_SERVICE_PLUGIN_CLASSES="$Q_SERVICE_PLUGIN_CLASSES,$service_plugin_class"
+    fi
+}
+
+# _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
+function _neutron_deploy_rootwrap_filters {
+    local srcdir=$1
+    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
+    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
+}
+
+# _neutron_setup_rootwrap() - configure Neutron's rootwrap
+function _neutron_setup_rootwrap {
+    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+        return
+    fi
+    # Wipe any existing ``rootwrap.d`` files first
+    Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
+    if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
+        sudo rm -rf $Q_CONF_ROOTWRAP_D
+    fi
+
+    _neutron_deploy_rootwrap_filters $NEUTRON_DIR
+
+    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
+    # location moved in newer versions, prefer new location
+    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
+    else
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
+    fi
+    sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
+    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
+    ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
+    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+
+    # Set up the rootwrap sudoers for neutron
+    TEMPFILE=`mktemp`
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
+    chmod 0440 $TEMPFILE
+    sudo chown root:root $TEMPFILE
+    sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
+
+    # Update the root_helper
+    iniset $NEUTRON_CONF agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $NEUTRON_CONF agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+}
+
+# Configures keystone integration for neutron service and agents
+function _neutron_setup_keystone {
+    local conf_file=$1
+    local section=$2
+    local use_auth_url=$3
+
+    # Configures keystone for metadata_agent
+    # metadata_agent needs auth_url to communicate with keystone
+    if [[ "$use_auth_url" == "True" ]]; then
+        iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI/v2.0
+    fi
+
+    create_neutron_cache_dir
+    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
+}
+
+function _neutron_setup_interface_driver {
+
+    # ovs_use_veth needs to be set before the plugin configuration
+    # occurs to allow plugins to override the setting.
+    iniset $1 DEFAULT ovs_use_veth $Q_OVS_USE_VETH
+
+    neutron_plugin_setup_interface_driver $1
+}
+
+# Create private IPv4 subnet
+function _neutron_create_private_subnet_v4 {
+    local subnet_params="--tenant-id $TENANT_ID "
+    subnet_params+="--ip_version 4 "
+    subnet_params+="--gateway $NETWORK_GATEWAY "
+    subnet_params+="--name $PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE"
+    local subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $TENANT_ID"
+    echo $subnet_id
+}
+
+# Create private IPv6 subnet
+function _neutron_create_private_subnet_v6 {
+    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
+    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
+    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
+    local subnet_params="--tenant-id $TENANT_ID "
+    subnet_params+="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
+    local ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $TENANT_ID"
+    echo $ipv6_subnet_id
+}
+
+# Create public IPv4 subnet
+function _neutron_create_public_subnet_v4 {
+    local subnet_params+="--ip_version 4 "
+    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
+    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
+    echo $id_and_ext_gw_ip
+}
+
+# Create public IPv6 subnet
+function _neutron_create_public_subnet_v6 {
+    local subnet_params="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
+    echo $ipv6_id_and_ext_gw_ip
+}
+
+# Configure neutron router for IPv4 public access
+function _neutron_configure_router_v4 {
+    neutron router-interface-add $ROUTER_ID $SUBNET_ID
+    # Create a public subnet on the external network
+    local id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
+    local ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
+    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
+    # Configure the external network as the default router gateway
+    neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        # Configure and enable public bridge
+        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local cidr_len=${FLOATING_RANGE#*/}
+            sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+            sudo ip link set $ext_gw_interface up
+            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
+            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
+            sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP
+        fi
+        _neutron_set_router_id
+    fi
+}
+
+# Configure neutron router for IPv6 public access
+function _neutron_configure_router_v6 {
+    neutron router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    # Create a public subnet on the external network
+    local ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
+    local ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
+    local ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
+
+    # If the external network has not already been set as the default router
+    # gateway when configuring an IPv4 public subnet, do so now
+    if [[ "$IP_VERSION" == "6" ]]; then
+        neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+    fi
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        local ipv6_router_gw_port
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
+        # Configure and enable public bridge
+        if [[ "$IP_VERSION" = "6" ]]; then
+            # Override global IPV6_ROUTER_GW_IP with the true value from neutron
+            IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
+            die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
+            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
+            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
+        else
+            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
+            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
+        fi
+
+        # The ovs_base_configure_l3_agent function flushes the public
+        # bridge's ip addresses, so turn IPv6 support in the host off
+        # and then on to recover the public bridge's link local address
+        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=1
+        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=0
+        if ! ip -6 addr show dev $PUBLIC_BRIDGE | grep 'scope global'; then
+            # Create an IPv6 ULA address for PUBLIC_BRIDGE if one is not present
+            IPV6_BRIDGE_ULA=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
+            sudo ip -6 addr add fd$IPV6_BRIDGE_ULA::1 dev $PUBLIC_BRIDGE
+        fi
+
+        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
+
+            # Define router_ns based on whether DVR is enabled
+            local router_ns=qrouter
+            if [[ "$Q_DVR_MODE" == "dvr_snat" ]]; then
+                router_ns=snat
+            fi
+
+            # Configure interface for public bridge
+            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+
+            # Wait until layer 3 agent has configured the gateway port on
+            # the public bridge, then add gateway address to the interface
+            # TODO (john-davidge) Remove once l3-agent supports dual-stack
+            if [[ "$IP_VERSION" == "4+6" ]]; then
+                if ! timeout $GATEWAY_TIMEOUT sh -c "until sudo ip netns exec $router_ns-$ROUTER_ID ip addr show qg-${ipv6_router_gw_port:0:11} | grep $ROUTER_GW_IP; do sleep 1; done"; then
+                    die $LINENO "Timeout retrieving ROUTER_GW_IP"
+                fi
+                # Configure the gateway port with the public IPv6 adress
+                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 addr add $IPV6_ROUTER_GW_IP/$ipv6_cidr_len dev qg-${ipv6_router_gw_port:0:11}
+                # Add a default IPv6 route to the neutron router as the
+                # l3-agent does not add one in the dual-stack case
+                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 route replace default via $ipv6_ext_gw_ip dev qg-${ipv6_router_gw_port:0:11}
+            fi
+            sudo ip -6 route add $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+        fi
+        _neutron_set_router_id
+    fi
+}
+
+# Explicitly set router id in l3 agent configuration
+function _neutron_set_router_id {
+    if [[ "$Q_USE_NAMESPACE" == "False" ]]; then
+        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
+    fi
+}
+
+# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
+function _neutron_get_ext_gw_interface {
+    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
+        echo $Q_PUBLIC_VETH_EX
+    else
+        # Disable in-band as we are going to use local port
+        # to communicate with VMs
+        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+            other_config:disable-in-band=true
+        echo $PUBLIC_BRIDGE
+    fi
+}
+
+# Functions for Neutron Exercises
+#--------------------------------
+
+function delete_probe {
+    local from_net="$1"
+    net_id=`_get_net_id $from_net`
+    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
+    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
+}
+
+function setup_neutron_debug {
+    if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
+        public_net_id=`_get_net_id $PUBLIC_NETWORK_NAME`
+        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
+        private_net_id=`_get_net_id $PRIVATE_NETWORK_NAME`
+        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
+    fi
+}
+
+function teardown_neutron_debug {
+    delete_probe $PUBLIC_NETWORK_NAME
+    delete_probe $PRIVATE_NETWORK_NAME
+}
+
+function _get_net_id {
+    neutron --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
+}
+
+function _get_probe_cmd_prefix {
+    local from_net="$1"
+    net_id=`_get_net_id $from_net`
+    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
+    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
+}
+
+function _ping_check_neutron {
+    local from_net=$1
+    local ip=$2
+    local timeout_sec=$3
+    local expected=${4:-"True"}
+    local check_command=""
+    probe_cmd=`_get_probe_cmd_prefix $from_net`
+    if [[ "$expected" = "True" ]]; then
+        check_command="while ! $probe_cmd ping -w 1 -c 1 $ip; do sleep 1; done"
+    else
+        check_command="while $probe_cmd ping -w 1 -c 1 $ip; do sleep 1; done"
+    fi
+    if ! timeout $timeout_sec sh -c "$check_command"; then
+        if [[ "$expected" = "True" ]]; then
+            die $LINENO "[Fail] Couldn't ping server"
+        else
+            die $LINENO "[Fail] Could ping server"
+        fi
+    fi
+}
+
+# ssh check
+function _ssh_check_neutron {
+    local from_net=$1
+    local key_file=$2
+    local ip=$3
+    local user=$4
+    local timeout_sec=$5
+    local probe_cmd = ""
+    probe_cmd=`_get_probe_cmd_prefix $from_net`
+    if ! timeout $timeout_sec sh -c "while ! $probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success; do sleep 1; done"; then
+        die $LINENO "server didn't become ssh-able!"
+    fi
+}
+
+# Neutron 3rd party programs
+#---------------------------
+
+# please refer to ``lib/neutron_thirdparty/README.md`` for details
+NEUTRON_THIRD_PARTIES=""
+for f in $TOP_DIR/lib/neutron_thirdparty/*; do
+    third_party=$(basename $f)
+    if is_service_enabled $third_party; then
+        source $TOP_DIR/lib/neutron_thirdparty/$third_party
+        NEUTRON_THIRD_PARTIES="$NEUTRON_THIRD_PARTIES,$third_party"
+    fi
+done
+
+function _neutron_third_party_do {
+    for third_party in ${NEUTRON_THIRD_PARTIES//,/ }; do
+        ${1}_${third_party}
+    done
+}
+
+# configure_neutron_third_party() - Set config files, create data dirs, etc
+function configure_neutron_third_party {
+    _neutron_third_party_do configure
+}
+
+# init_neutron_third_party() - Initialize databases, etc.
+function init_neutron_third_party {
+    _neutron_third_party_do init
+}
+
+# install_neutron_third_party() - Collect source and prepare
+function install_neutron_third_party {
+    _neutron_third_party_do install
+}
+
+# start_neutron_third_party() - Start running processes, including screen
+function start_neutron_third_party {
+    _neutron_third_party_do start
+}
+
+# stop_neutron_third_party - Stop running processes (non-screen)
+function stop_neutron_third_party {
+    _neutron_third_party_do stop
+}
+
+# check_neutron_third_party_integration() - Check that third party integration is sane
+function check_neutron_third_party_integration {
+    _neutron_third_party_do check
+}
+
+function is_provider_network {
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
+        return 0
+    fi
+    return 1
+}
+
+
+# Restore xtrace
+$XTRACE
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/neutron_plugins/README.md b/lib/neutron_plugins/README.md
index 7192a051b4..4b220d3377 100644
--- a/lib/neutron_plugins/README.md
+++ b/lib/neutron_plugins/README.md
@@ -13,7 +13,7 @@ Plugin specific configuration variables should be in this file.
 
 functions
 ---------
-``lib/neutron`` calls the following functions when the ``$Q_PLUGIN`` is enabled
+``lib/neutron-legacy`` calls the following functions when the ``$Q_PLUGIN`` is enabled
 
 * ``neutron_plugin_create_nova_conf`` :
   set ``NOVA_VIF_DRIVER`` and optionally set options in nova_conf
diff --git a/lib/neutron_thirdparty/README.md b/lib/neutron_thirdparty/README.md
index 5655e0bf60..905ae776a8 100644
--- a/lib/neutron_thirdparty/README.md
+++ b/lib/neutron_thirdparty/README.md
@@ -10,7 +10,7 @@ Third party program specific configuration variables should be in this file.
 
 functions
 ---------
-``lib/neutron`` calls the following functions when the ``<third_party>`` is enabled
+``lib/neutron-legacy`` calls the following functions when the ``<third_party>`` is enabled
 
 functions to be implemented
 * ``configure_<third_party>``:
diff --git a/stack.sh b/stack.sh
index 9d6230332e..9069367fa0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -525,7 +525,7 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 
diff --git a/unstack.sh b/unstack.sh
index fdd63fbcd0..a66370b1e9 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -63,7 +63,7 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
-source $TOP_DIR/lib/neutron
+source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 

From 93b906d53ee457b3768c755615fc7c2395d26c85 Mon Sep 17 00:00:00 2001
From: Angus Salkeld <asalkeld@mirantis.com>
Date: Thu, 26 Mar 2015 12:53:51 +1000
Subject: [PATCH 0487/3333] Always set the Heat deferred auth method

Otherwise in standalone mode we use the new default of "trusts"
which won't work.

Change-Id: If18db711faf7810217af0a89d1e38590a94d8e5b
Closes-bug: 1436631
---
 lib/heat | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/heat b/lib/heat
index c7abd3bb1c..0930776a58 100644
--- a/lib/heat
+++ b/lib/heat
@@ -124,6 +124,8 @@ function configure_heat {
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
+    iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
+
     # NOTE(jamielennox): heat re-uses specific values from the
     # keystone_authtoken middleware group and so currently fails when using the
     # auth plugin setup. This should be fixed in heat.  Heat is also the only
@@ -269,10 +271,6 @@ function create_heat_accounts {
         get_or_create_role "heat_stack_user"
     fi
 
-    if [[ $HEAT_DEFERRED_AUTH == trusts ]]; then
-        iniset $HEAT_CONF DEFAULT deferred_auth_method trusts
-    fi
-
     if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
         # Note we have to pass token/endpoint here because the current endpoint and
         # version negotiation in OSC means just --os-identity-api-version=3 won't work

From d9de1199bd3f79fc7b71e933970c6f14afa8d310 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 26 Mar 2015 09:25:02 +0100
Subject: [PATCH 0488/3333] Print kernel version

Adding `uname -a` to stack.sh to make easy to see from the devstack logs
what was the actually running kernel version.

Change-Id: I0068504bf055a588b155b0a60215440d365bf53e
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index 9069367fa0..79f8fa3a7f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -89,6 +89,9 @@ if [[ $EUID -eq 0 ]]; then
     exit 1
 fi
 
+# Print the kernel version
+uname -a
+
 # Prepare the environment
 # -----------------------
 

From 7ced150f8c70e1acaa4b83c25d3c9271cdb512c3 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 23 Mar 2015 15:51:54 -0400
Subject: [PATCH 0489/3333] Add variable to indicated if Tempest should have
 admin

This commit adds a new flag, TEMPEST_HAS_ADMIN, to enable or disable
setting admin credentials in the tempest config file. This allows for
devstack / tempest configurations where tempest doesn't have admin to
ensure it would work in public cloud scenarios.

Change-Id: Id983417801e4b276334fb9e700f2c8e6ab78f9ba
---
 lib/tempest | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 4ece349159..2ec353bce8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -175,6 +175,10 @@ function configure_tempest {
 
     password=${ADMIN_PASSWORD:-secrete}
 
+    # Do we want to make a configuration where Tempest has admin on
+    # the cloud. We don't always want to so that we can ensure Tempest
+    # would work on a public cloud.
+    TEMPEST_HAS_ADMIN=$(trueorfalse True TEMPEST_HAS_ADMIN)
     # See files/keystone_data.sh and stack.sh where admin, demo and alt_demo
     # user and tenant are set up...
     ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
@@ -292,11 +296,13 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG identity alt_username $ALT_USERNAME
     iniset $TEMPEST_CONFIG identity alt_password "$password"
     iniset $TEMPEST_CONFIG identity alt_tenant_name $ALT_TENANT_NAME
-    iniset $TEMPEST_CONFIG identity admin_username $ADMIN_USERNAME
-    iniset $TEMPEST_CONFIG identity admin_password "$password"
-    iniset $TEMPEST_CONFIG identity admin_tenant_name $ADMIN_TENANT_NAME
-    iniset $TEMPEST_CONFIG identity admin_tenant_id $ADMIN_TENANT_ID
-    iniset $TEMPEST_CONFIG identity admin_domain_name $ADMIN_DOMAIN_NAME
+    if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
+        iniset $TEMPEST_CONFIG identity admin_username $ADMIN_USERNAME
+        iniset $TEMPEST_CONFIG identity admin_password "$password"
+        iniset $TEMPEST_CONFIG identity admin_tenant_name $ADMIN_TENANT_NAME
+        iniset $TEMPEST_CONFIG identity admin_tenant_id $ADMIN_TENANT_ID
+        iniset $TEMPEST_CONFIG identity admin_domain_name $ADMIN_DOMAIN_NAME
+    fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
@@ -310,6 +316,9 @@ function configure_tempest {
     fi
 
     # Auth
+    #
+    #
+    TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}
     iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
 

From 1bd79596c3c5f62cbbef92558156401447a9b5d3 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 24 Feb 2015 14:06:56 +0100
Subject: [PATCH 0490/3333] Move back isset to the functions-common

isset function was moved to config file related functions by accident,
this change also simplfies the isset in a bash >=4.2 way.

All supported distro has at least bash 4.2. (RHEL6 used 4.1)

Change-Id: Id644b46ff9cdbe18cde46e96aa72764e1c8653ac
---
 functions-common   |  3 +++
 inc/ini-config     | 10 ----------
 tests/functions.sh | 17 +++++++++++++++++
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index 48e400dfb1..56fa64a990 100644
--- a/functions-common
+++ b/functions-common
@@ -62,6 +62,9 @@ function trueorfalse {
     $xtrace
 }
 
+function isset {
+    [[ -v "$1" ]]
+}
 
 # Control Functions
 # =================
diff --git a/inc/ini-config b/inc/ini-config
index 0d6d169f8b..26401f3917 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -205,16 +205,6 @@ function iniuncomment {
     $xtrace
 }
 
-function isset {
-    nounset=$(set +o | grep nounset)
-    set +o nounset
-    [[ -n "${!1+x}" ]]
-    result=$?
-    $nounset
-    return $result
-}
-
-
 # Restore xtrace
 $INC_CONF_TRACE
 
diff --git a/tests/functions.sh b/tests/functions.sh
index 874d02230d..126080f1e3 100755
--- a/tests/functions.sh
+++ b/tests/functions.sh
@@ -196,3 +196,20 @@ if is_ubuntu; then
         echo "is_package_installed() on deleted package failed"
     fi
 fi
+
+# test isset function
+echo  "Testing isset()"
+you_should_not_have_this_variable=42
+
+if isset "you_should_not_have_this_variable"; then
+    echo "OK"
+else
+    echo "\"you_should_not_have_this_variable\" not declared. failed"
+fi
+
+unset you_should_not_have_this_variable
+if isset "you_should_not_have_this_variable"; then
+    echo "\"you_should_not_have_this_variable\" looks like declared variable. failed"
+else
+    echo "OK"
+fi

From 0fc946ddc805989adb68c1e836e86b51d1f011cf Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 23 Mar 2015 16:38:30 -0400
Subject: [PATCH 0491/3333] Remove the compute-admin section from tempest
 config

This commit removes the compute-admin section from the tempest config
file that devstack generates. These options have been removed from
the tempest config and aren't being used, so there is no reason to
keep them around.

Change-Id: I7500fe3b329b913c60fa505a5230db4a5d35d7f1
---
 lib/tempest | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 2ec353bce8..11e9ac4fa1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -358,11 +358,6 @@ function configure_tempest {
     # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
     iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
 
-    # Compute admin
-    iniset $TEMPEST_CONFIG "compute-admin" username $ADMIN_USERNAME
-    iniset $TEMPEST_CONFIG "compute-admin" password "$password"
-    iniset $TEMPEST_CONFIG "compute-admin" tenant_name $ADMIN_TENANT_NAME
-
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
     iniset $TEMPEST_CONFIG network tenant_networks_reachable "$tenant_networks_reachable"

From 00e16a9d53905f309655172d8a2b1cbcfc1cbfa5 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 20 Feb 2015 11:45:21 -0500
Subject: [PATCH 0492/3333] Support for single interface Neutron networking
 with OVS

When running Neutron on a single node that only has a single interface,
the following operations are required:

    * Remove the IP address from the physical interface
    * Add the interface to the OVS physical bridge
    * Add the IP address from the physical interface to the OVS bridge
    * Update the routing table

The reverse is done on cleanup.

In order run Neutron on a single interface, the $PUBLIC_INTERFACE and
$OVS_PHYSICAL_BRIDGE variables must be set.

Co-Authored-By: Brian Haley <brian.haley@hp.com>
Change-Id: I71e2594288bae1a71dc2c8c3fb350b913dbd5e2c
---
 lib/neutron-legacy | 42 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5ff39212fc..e9a3926b28 100755
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -779,9 +779,41 @@ function stop_neutron {
     fi
 }
 
+# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
+# on startup, or back to the public interface on cleanup
+function _move_neutron_addresses_route {
+    local from_intf=$1
+    local to_intf=$2
+    local add_ovs_port=$3
+
+    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
+        # Remove the primary IP address from $from_intf and add it to $to_intf,
+        # along with the default route, if it exists.  Also, when called
+        # on configure we will also add $from_intf as a port on $to_intf,
+        # assuming it is an OVS bridge.
+
+        local IP_BRD=$(ip -4 a s dev $from_intf | awk '/inet/ { print $2, $3, $4; exit }')
+        local DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
+        local ADD_OVS_PORT=""
+
+        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
+            ADD_DEFAULT_ROUTE="sudo ip r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
+        fi
+
+        if [[ "$add_ovs_port" == "True" ]]; then
+            ADD_OVS_PORT="sudo ovs-vsctl add-port $to_intf $from_intf"
+        fi
+
+        sudo ip addr del $IP_BRD dev $from_intf; sudo ip addr add $IP_BRD dev $to_intf; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+    fi
+}
+
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
+
+    _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False
+
     if is_provider_network && is_ironic_hardware; then
         for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
             sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
@@ -956,6 +988,10 @@ function _configure_neutron_l3_agent {
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
     neutron_plugin_configure_l3_agent
+
+    if [[ $(ip -4 a s dev "$PUBLIC_INTERFACE" | grep -c 'inet') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True
+    fi
 }
 
 function _configure_neutron_metadata_agent {
@@ -1227,8 +1263,10 @@ function _neutron_configure_router_v4 {
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local cidr_len=${FLOATING_RANGE#*/}
-            sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
-            sudo ip link set $ext_gw_interface up
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" ]]; then
+                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+                sudo ip link set $ext_gw_interface up
+            fi
             ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP

From ebdd9ac5b41da372c0276a507451ea9878be7dda Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 4 Mar 2015 12:35:14 +0000
Subject: [PATCH 0493/3333] Provide an option to force pip --upgrade

Make it possible for someone to config

  PIP_UPGRADE=True

in local.conf and thus force pip_install calls to upgrade. In
automated testing this is probably a bad idea, but in manual testing
or situations where devstack is being used to spin up proof of
concepts having the option to use the latest and greatest Python
modules is a useful way of exploring the health of the ecosystem.

To help with visibility of the setting, and section has been added
in configuration.rst near other similar settings.

Change-Id: I484c954f1e1f05ed02c0b08e8e4a9c18558c05ef
---
 doc/source/configuration.rst | 15 +++++++++++++++
 inc/python                   | 12 +++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 7d06658ee2..79d911c91d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -247,6 +247,21 @@ A clean install every time
 
         RECLONE=yes
 
+Upgrade packages installed by pip
+---------------------------------
+
+    | *Default: ``PIP_UPGRADE=""``*
+    |  By default ``stack.sh`` only installs Python packages if no version
+       is currently installed or the current version does not match a specified
+       requirement. If ``PIP_UPGRADE`` is set to ``True`` then existing required
+       Python packages will be upgraded to the most recent version that
+       matches requirements.
+    |
+
+    ::
+
+        PIP_UPGRADE=True
+
 Swift
 -----
 
diff --git a/inc/python b/inc/python
index 2d76081a52..d00eb0cd1f 100644
--- a/inc/python
+++ b/inc/python
@@ -54,17 +54,23 @@ function get_python_exec_prefix {
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``INSTALL_TESTONLY_PACKAGES``, ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
-# ``TRACK_DEPENDS``, ``*_proxy``
+# ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``
 # pip_install package [package ...]
 function pip_install {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local upgrade=""
     local offline=${OFFLINE:-False}
     if [[ "$offline" == "True" || -z "$@" ]]; then
         $xtrace
         return
     fi
 
+    PIP_UPGRADE=$(trueorfalse False PIP_UPGRADE)
+    if [[ "$PIP_UPGRADE" = "True" ]] ; then
+        upgrade="--upgrade"
+    fi
+
     if [[ -z "$os_PACKAGE" ]]; then
         GetOSVersion
     fi
@@ -98,7 +104,7 @@ function pip_install {
         https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
-        $cmd_pip install \
+        $cmd_pip install $upgrade \
         $@
 
     # Also install test requirements
@@ -110,7 +116,7 @@ function pip_install {
             https_proxy=${https_proxy:-} \
             no_proxy=${no_proxy:-} \
             PIP_FIND_LINKS=$PIP_FIND_LINKS \
-            $cmd_pip install \
+            $cmd_pip install $upgrade \
             -r $test_req
     fi
 }

From 6e275e170c042794560c9b2c442a32c3de55566e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 26 Mar 2015 05:54:28 -0400
Subject: [PATCH 0494/3333] provide an override-defaults phase

during the glusterfs integration it was seen that plugins might need
to set new defaults on projects before the project files load. Create
a new override-defaults phase for that.

Intentionally not adding to the documentation yet until we're sure
this works right in the glusterfs case.

Reported-By: Deepak C Shetty <deepakcs@redhat.com>
Change-Id: I13c961b19bdcc1a99e9a7068fe91bbaac787e948
---
 functions-common | 29 +++++++++++++++++++++++++++++
 stack.sh         |  4 ++++
 unstack.sh       |  4 ++++
 3 files changed, 37 insertions(+)

diff --git a/functions-common b/functions-common
index 48e400dfb1..9bad981ab1 100644
--- a/functions-common
+++ b/functions-common
@@ -1501,6 +1501,33 @@ function load_plugin_settings {
     done
 }
 
+# plugin_override_defaults
+#
+# Run an extremely early setting phase for plugins that allows default
+# overriding of services.
+function plugin_override_defaults {
+    local plugins="${DEVSTACK_PLUGINS}"
+    local plugin
+
+    # short circuit if nothing to do
+    if [[ -z $plugins ]]; then
+        return
+    fi
+
+    echo "Overriding Configuration Defaults"
+    for plugin in ${plugins//,/ }; do
+        local dir=${GITDIR[$plugin]}
+        # source any overrides
+        if [[ -f $dir/devstack/override-defaults ]]; then
+            # be really verbose that an override is happening, as it
+            # may not be obvious if things fail later.
+            echo "$plugin has overriden the following defaults"
+            cat $dir/devstack/override-defaults
+            source $dir/devstack/override-defaults
+        fi
+    done
+}
+
 # run_plugins
 #
 # Run the devstack/plugin.sh in all the plugin directories. These are
@@ -1530,6 +1557,8 @@ function run_phase {
     # the source phase corresponds to settings loading in plugins
     if [[ "$mode" == "source" ]]; then
         load_plugin_settings
+    elif [[ "$mode" == "override_defaults" ]]; then
+        plugin_override_defaults
     else
         run_plugins $mode $phase
     fi
diff --git a/stack.sh b/stack.sh
index 9069367fa0..a9deba7ff6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -507,6 +507,10 @@ fi
 # Configure Projects
 # ==================
 
+# Plugin Phase 0: override_defaults - allow pluggins to override
+# defaults before other services are run
+run_phase override_defaults
+
 # Import apache functions
 source $TOP_DIR/lib/apache
 
diff --git a/unstack.sh b/unstack.sh
index a66370b1e9..c45af7400c 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -45,6 +45,10 @@ fi
 # Configure Projects
 # ==================
 
+# Plugin Phase 0: override_defaults - allow pluggins to override
+# defaults before other services are run
+run_phase override_defaults
+
 # Import apache functions
 source $TOP_DIR/lib/apache
 

From c70605d1013296d0127ad38d8c53a69ed982e647 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 26 Jan 2015 15:44:47 +0100
Subject: [PATCH 0495/3333] Add lioadm cinder iscsi helper support

The Linux-IO is a modern way of handling targets.
Per the IRC discussions lioadm as default
seams like a better default for everyone, for now it will be
optional, but the tgtadm admin support expected to be removed when
lioadm works well with all CI (including third party).

Change-Id: Ia54c59914c1d3ff2ef5f00ecf819426bc448d0a9
---
 files/debs/cinder       |  2 +-
 files/rpms-suse/cinder  |  2 +-
 files/rpms/cinder       |  2 +-
 lib/cinder              | 95 ++++++++++++++++++++++-------------------
 lib/cinder_backends/lvm |  2 +-
 lib/lvm                 | 11 +++--
 6 files changed, 63 insertions(+), 51 deletions(-)

diff --git a/files/debs/cinder b/files/debs/cinder
index 7819c31655..51908eb27b 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,4 +1,4 @@
-tgt
+tgt # NOPRIME
 lvm2
 qemu-utils
 libpq-dev
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 55078da27c..3fd03cc9be 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,5 +1,5 @@
 lvm2
-tgt
+tgt # NOPRIME
 qemu-tools
 python-devel
 postgresql-devel
diff --git a/files/rpms/cinder b/files/rpms/cinder
index 9f1359f988..a88503b8bc 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 lvm2
-scsi-target-utils
+scsi-target-utils # NOPRIME
 qemu-img
 postgresql-devel
 iscsi-initiator-utils
diff --git a/lib/cinder b/lib/cinder
index ef68d8d643..f257afcdb6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,6 +88,8 @@ CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
 # https://bugs.launchpad.net/cinder/+bug/1180976
 CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
+CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
+
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,cinder
 
@@ -125,31 +127,35 @@ function is_cinder_enabled {
 function cleanup_cinder {
     # ensure the volume group is cleared up because fails might
     # leave dead volumes in the group
-    local targets=$(sudo tgtadm --op show --mode target)
-    if [ $? -ne 0 ]; then
-        # If tgt driver isn't running this won't work obviously
-        # So check the response and restart if need be
-        echo "tgtd seems to be in a bad state, restarting..."
-        if is_ubuntu; then
-            restart_service tgt
-        else
-            restart_service tgtd
+    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+        local targets=$(sudo tgtadm --op show --mode target)
+        if [ $? -ne 0 ]; then
+            # If tgt driver isn't running this won't work obviously
+            # So check the response and restart if need be
+            echo "tgtd seems to be in a bad state, restarting..."
+            if is_ubuntu; then
+                restart_service tgt
+            else
+                restart_service tgtd
+            fi
+            targets=$(sudo tgtadm --op show --mode target)
         fi
-        targets=$(sudo tgtadm --op show --mode target)
-    fi
 
-    if [[ -n "$targets" ]]; then
-        local iqn_list=( $(grep --no-filename -r iqn $SCSI_PERSIST_DIR | sed 's/<target //' | sed 's/>//') )
-        for i in "${iqn_list[@]}"; do
-            echo removing iSCSI target: $i
-            sudo tgt-admin --delete $i
-        done
-    fi
+        if [[ -n "$targets" ]]; then
+            local iqn_list=( $(grep --no-filename -r iqn $SCSI_PERSIST_DIR | sed 's/<target //' | sed 's/>//') )
+            for i in "${iqn_list[@]}"; do
+                echo removing iSCSI target: $i
+                sudo tgt-admin --delete $i
+            done
+        fi
 
-    if is_ubuntu; then
-        stop_service tgt
+        if is_ubuntu; then
+            stop_service tgt
+        else
+            stop_service tgtd
+        fi
     else
-        stop_service tgtd
+        sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -224,7 +230,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $CINDER_CONF DEFAULT verbose True
 
-    iniset $CINDER_CONF DEFAULT iscsi_helper tgtadm
+    iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
@@ -388,6 +394,13 @@ function init_cinder {
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
+    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+        if is_fedora; then
+            install_package scsi-target-utils
+        else
+            install_package tgt
+        fi
+    fi
 }
 
 # install_cinderclient() - Collect source and prepare
@@ -415,21 +428,23 @@ function start_cinder {
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi
-    if is_service_enabled c-vol; then
-        # Delete any old stack.conf
-        sudo rm -f /etc/tgt/conf.d/stack.conf
-        _configure_tgt_for_config_d
-        if is_ubuntu; then
-            sudo service tgt restart
-        elif is_fedora || is_suse; then
-            restart_service tgtd
-        else
-            # note for other distros: unstack.sh also uses the tgt/tgtd service
-            # name, and would need to be adjusted too
-            exit_distro_not_supported "restarting tgt"
+    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+        if is_service_enabled c-vol; then
+            # Delete any old stack.conf
+            sudo rm -f /etc/tgt/conf.d/stack.conf
+            _configure_tgt_for_config_d
+            if is_ubuntu; then
+                sudo service tgt restart
+            elif is_fedora || is_suse; then
+                restart_service tgtd
+            else
+                # note for other distros: unstack.sh also uses the tgt/tgtd service
+                # name, and would need to be adjusted too
+                exit_distro_not_supported "restarting tgt"
+            fi
+            # NOTE(gfidente): ensure tgtd is running in debug mode
+            sudo tgtadm --mode system --op update --name debug --value on
         fi
-        # NOTE(gfidente): ensure tgtd is running in debug mode
-        sudo tgtadm --mode system --op update --name debug --value on
     fi
 
     run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
@@ -459,14 +474,6 @@ function stop_cinder {
     for serv in c-api c-bak c-sch c-vol; do
         stop_process $serv
     done
-
-    if is_service_enabled c-vol; then
-        if is_ubuntu; then
-            stop_service tgt
-        else
-            stop_service tgtd
-        fi
-    fi
 }
 
 # create_volume_types() - Create Cinder's configured volume types
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index f210578339..d369c0c840 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -49,7 +49,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name iscsi_helper "tgtadm"
+    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
 
     if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
         iniset $CINDER_CONF $be_name volume_clear none
diff --git a/lib/lvm b/lib/lvm
index d0322c76b3..519e82c806 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -108,15 +108,20 @@ function init_lvm_volume_group {
     if is_fedora || is_suse; then
         # services is not started by default
         start_service lvm2-lvmetad
-        start_service tgtd
+        if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+            start_service tgtd
+        fi
     fi
 
     # Start with a clean volume group
     _create_lvm_volume_group $vg $size
 
     # Remove iscsi targets
-    sudo tgtadm --op show --mode target | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
-
+    if [ "$CINDER_ISCSI_HELPER" = "lioadm" ]; then
+        sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
+    else
+        sudo tgtadm --op show --mode target | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
+    fi
     _clean_lvm_volume_group $vg
 }
 

From 4533eeec1fe4834ced0996fc8f9c8487dcd31d45 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Tue, 17 Feb 2015 16:25:38 -0600
Subject: [PATCH 0496/3333] Install Nova into its own venv

Install a couple of optional feature prereqs in hypervisor plugins.

rootwrap is horribly called indirectly via PATH.  The choice, other than fixing
such nonsense, is to force the path in sudo.

TODO:
* python guestfs isn't in pypi, need to specifically install it to not
  use the distro package

Change-Id: Iad9a66d8a937fd0b0d1874005588c702e3d75e04
---
 files/debs/general                 |  1 +
 files/rpms/general                 |  1 +
 lib/nova                           | 52 ++++++++++++++++++++++--------
 lib/nova_plugins/functions-libvirt | 14 ++++----
 4 files changed, 48 insertions(+), 20 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 84d43029ff..87a6c7cb31 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -23,3 +23,4 @@ libffi-dev
 libssl-dev # for pyOpenSSL
 gettext  # used for compiling message catalogs
 openjdk-7-jre-headless  # NOPRIME
+pkg-config
diff --git a/files/rpms/general b/files/rpms/general
index eac4ec36a7..81cc7891be 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -12,6 +12,7 @@ openssl-devel # to rebuild pyOpenSSL if needed
 libffi-devel
 libxml2-devel
 libxslt-devel
+pkgconfig
 psmisc
 pylint
 python-devel
diff --git a/lib/nova b/lib/nova
index 32dea77fbf..d3bf2a8ec1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -32,9 +32,16 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-novaclient"]=$DEST/python-novaclient
+NOVA_DIR=$DEST/nova
 
+# Nova virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["nova"]=${NOVA_DIR}.venv
+    NOVA_BIN_DIR=${PROJECT_VENV["nova"]}/bin
+else
+    NOVA_BIN_DIR=$(get_python_exec_prefix)
+fi
 
-NOVA_DIR=$DEST/nova
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
@@ -69,16 +76,6 @@ NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
 EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
 
-# Support entry points installation of console scripts
-if [[ -d $NOVA_DIR/bin ]]; then
-    NOVA_BIN_DIR=$NOVA_DIR/bin
-else
-    NOVA_BIN_DIR=$(get_python_exec_prefix)
-fi
-
-# Set the paths of certain binaries
-NOVA_ROOTWRAP=$(get_rootwrap_location nova)
-
 # Option to enable/disable config drive
 # NOTE: Set FORCE_CONFIG_DRIVE="False" to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"always"}
@@ -225,9 +222,11 @@ function cleanup_nova {
     #fi
 }
 
+# Deploy new rootwrap filters files and configure sudo
 # configure_nova_rootwrap() - configure Nova's rootwrap
 function configure_nova_rootwrap {
-    # Deploy new rootwrap filters files (owned by root).
+    nova_rootwrap=$NOVA_BIN_DIR/nova-rootwrap
+
     # Wipe any existing rootwrap.d files first
     if [[ -d $NOVA_CONF_DIR/rootwrap.d ]]; then
         sudo rm -rf $NOVA_CONF_DIR/rootwrap.d
@@ -242,14 +241,21 @@ function configure_nova_rootwrap {
     sudo sed -e "s:^filters_path=.*$:filters_path=$NOVA_CONF_DIR/rootwrap.d:" -i $NOVA_CONF_DIR/rootwrap.conf
 
     # Specify rootwrap.conf as first parameter to nova-rootwrap
-    local rootwrap_sudoer_cmd="$NOVA_ROOTWRAP $NOVA_CONF_DIR/rootwrap.conf *"
+    local rootwrap_sudoer_cmd="$nova_rootwrap $NOVA_CONF_DIR/rootwrap.conf *"
 
     # Set up the rootwrap sudoers for nova
     local tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd" >$tempfile
+    echo "Defaults:$STACK_USER secure_path=$NOVA_BIN_DIR:/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >$tempfile
+    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd" >>$tempfile
     chmod 0440 $tempfile
     sudo chown root:root $tempfile
     sudo mv $tempfile /etc/sudoers.d/nova-rootwrap
+
+    # So rootwrap and PATH are broken beyond belief.  WTF relies on a SECURE operation
+    # to blindly follow PATH???  We learned that was a bad idea in the 80's!
+    # So to fix this in a venv, we must exploit the very hole we want to close by dropping
+    # a copy of the venv rootwrap binary into /usr/local/bin.
+    #sudo cp -p $nova_rootwrap /usr/local/bin
 }
 
 # configure_nova() - Set config files, create data dirs, etc
@@ -696,6 +702,10 @@ function start_nova_api {
         service_protocol="http"
     fi
 
+    # Hack to set the path for rootwrap
+    local old_path=$PATH
+    export PATH=$NOVA_BIN_DIR:$PATH
+
     run_process n-api "$NOVA_BIN_DIR/nova-api"
     echo "Waiting for nova-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$SERVICE_HOST:$service_port; then
@@ -707,10 +717,16 @@ function start_nova_api {
         start_tls_proxy '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT &
         start_tls_proxy '*' $EC2_SERVICE_PORT $NOVA_SERVICE_HOST $EC2_SERVICE_PORT_INT &
     fi
+
+    export PATH=$old_path
 }
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
+    # Hack to set the path for rootwrap
+    local old_path=$PATH
+    export PATH=$NOVA_BIN_DIR:$PATH
+
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
     else
@@ -738,10 +754,16 @@ function start_nova_compute {
         fi
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
+
+    export PATH=$old_path
 }
 
 # start_nova() - Start running processes, including screen
 function start_nova_rest {
+    # Hack to set the path for rootwrap
+    local old_path=$PATH
+    export PATH=$NOVA_BIN_DIR:$PATH
+
     local api_cell_conf=$NOVA_CONF
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
@@ -769,6 +791,8 @@ function start_nova_rest {
     # Swift will act as s3 objectstore.
     is_service_enabled swift3 || \
         run_process n-obj "$NOVA_BIN_DIR/nova-objectstore --config-file $api_cell_conf"
+
+    export PATH=$old_path
 }
 
 function start_nova {
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4d617e8b5e..60707cf859 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -21,14 +21,16 @@ DEBUG_LIBVIRT=$(trueorfalse False DEBUG_LIBVIRT)
 function install_libvirt {
     if is_ubuntu; then
         install_package qemu-kvm
-        install_package libvirt-bin
-        install_package python-libvirt
-        install_package python-guestfs
+        install_package libvirt-bin libvirt-dev
+        pip_install libvirt-python
+        install_package libguestfs0
+        #install_package python-guestfs
+        #pip_install <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm
-        install_package libvirt
-        install_package libvirt-python
-        install_package python-libguestfs
+        install_package libvirt libvirt-devel
+        pip_install libvirt-python
+        #install_package python-libguestfs
     fi
 
     # Restart firewalld after install of libvirt to avoid a problem

From fab7880bcd98ff8d64e1389aac073b79728e77e5 Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Thu, 26 Mar 2015 13:03:49 -0700
Subject: [PATCH 0497/3333] lib/ironic: Do not check for database or message
 queue

Only check for OpenStack services, not specific database or
messaging backends.

Change-Id: I7960718defa3f521d1c2128d8523e8ee9328da64
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index b99e3255d5..a7738bc14e 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -181,7 +181,7 @@ function is_deployed_with_ipa_ramdisk {
 # install_ironic() - Collect source and prepare
 function install_ironic {
     # make sure all needed service were enabled
-    local req_services="mysql rabbit key"
+    local req_services="key"
     if [[ "$VIRT_DRIVER" == "ironic" ]]; then
         req_services+=" nova glance neutron"
     fi

From 11cf7b64a78d225d7ba84b86597a934d0417ad3c Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Fri, 27 Mar 2015 09:08:53 +1300
Subject: [PATCH 0498/3333] iptables rule for heat pip mirror

This is required for guest VMs to reach http://$HOST_IP:8899

Change-Id: I814c682fb02974ae05dfbe5e212409cdd11d16ac
---
 lib/heat | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/heat b/lib/heat
index c7abd3bb1c..a27691fab2 100644
--- a/lib/heat
+++ b/lib/heat
@@ -337,6 +337,7 @@ function build_heat_pip_mirror {
     " -i $heat_pip_repo_apache_conf
     enable_apache_site heat_pip_repo
     restart_apache_server
+    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $HEAT_PIP_REPO_PORT -j ACCEPT || true
 }
 
 # Restore xtrace

From 41d6f858be8431975762e65db470929c72b8f2a8 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 25 Mar 2015 22:42:46 -0500
Subject: [PATCH 0499/3333] Clean up additional INSTALL_TESTONLY_PACKAGES bits

The original removal is in https://review.openstack.org/#/c/167669/

Change-Id: I3c59f040523d2cd1453465e80280955218880634
---
 doc/source/configuration.rst | 12 ------------
 functions-common             |  2 --
 inc/python                   |  2 +-
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 2af69c6b5e..a0d0840263 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -417,18 +417,6 @@ IP Version
       can be configured with any valid IPv6 prefix. The default values make
       use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC 4193.*
 
-Unit tests dependencies install
--------------------------------
-
-    | *Default: ``INSTALL_TESTONLY_PACKAGES=False``*
-    |  In order to be able to run unit tests with script ``run_test.sh``,
-       the required package dependencies need to be installed.
-       Setting this option as below does the work.
-
-    ::
-
-        INSTALL_TESTONLY_PACKAGES=True
-
 Examples
 ========
 
diff --git a/functions-common b/functions-common
index 9bad981ab1..0f80e98f43 100644
--- a/functions-common
+++ b/functions-common
@@ -909,8 +909,6 @@ function get_packages {
     local file_to_parse=""
     local service=""
 
-    INSTALL_TESTONLY_PACKAGES=$(trueorfalse False INSTALL_TESTONLY_PACKAGES)
-
     if [[ -z "$package_dir" ]]; then
         echo "No package directory supplied"
         return 1
diff --git a/inc/python b/inc/python
index d00eb0cd1f..39684b6fc5 100644
--- a/inc/python
+++ b/inc/python
@@ -53,7 +53,7 @@ function get_python_exec_prefix {
 }
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
-# Uses globals ``INSTALL_TESTONLY_PACKAGES``, ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
+# Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``
 # pip_install package [package ...]
 function pip_install {

From 909fa8f49e0e253009be1299a4a067a22d80bb9b Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Date: Fri, 27 Mar 2015 10:56:16 +0900
Subject: [PATCH 0500/3333] Fix Q_USE_PUBLIC_VETH regression

A recently merged change Ie35cb537bb670c4773598b8db29877fb8a12ff50
and I71e2594288bae1a71dc2c8c3fb350b913dbd5e2c broke Q_USE_PUBLIC_VETH.
This commit fixes the regression.

Closes-Bug: #1436637
Change-Id: I1447bf98607143ba4954ce5ec3ed94010320baa5
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e9a3926b28..d3dd8dd33e 100755
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1263,7 +1263,7 @@ function _neutron_configure_router_v4 {
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local cidr_len=${FLOATING_RANGE#*/}
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From 9e98f9435ec36f2fffed0ac368befd520f07e0e1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 27 Mar 2015 14:43:14 +1100
Subject: [PATCH 0501/3333] Install packaged pyOpenSSL

pyOpenSSL has done a rewrite of itself in Python.  This may be good
for many reasons, but memory usage is not one of them.  It just about
doubles the size of at least swift, which usually consumes about 6% of
a CI testing vm's 8gb RAM.  This is enough to push centos hosts into
OOM conditions and then everything falls apart.

The distro packages of pyOpenSSL are the older C-based versions, which
doesn't bring in the kitchen sink of cffi & pycparser.

Change-Id: Icd4100da1d5cbdb82017da046b00b9397813c2f2
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index d74ecc6e98..64329a4086 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,3 +27,4 @@ gettext  # used for compiling message catalogs
 net-tools
 java-1.7.0-openjdk-headless  # NOPRIME rhel7,f20
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
+pyOpenSSL # version in pip uses too much memory
\ No newline at end of file

From bba4742e8cbdc577121bf1010f5fe307c958cd15 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 28 Mar 2015 13:37:26 -0500
Subject: [PATCH 0502/3333] Add parent id to worlddump output

Helpful in tracking down some process-doesn't-die problems.

Change-Id: I146910403879c9a85d644bd07a53830ea17ca77d
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9a62c0dfbb..8dd455c274 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -66,7 +66,7 @@ def process_list():
 Process Listing
 ===============
 """
-    psraw = os.popen("ps auxw").read()
+    psraw = os.popen("ps axo user,ppid,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,args").read()
     print psraw
 
 

From 3bb5a6f445f4938f1edca3c649aa22ff4ef8e5c3 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 28 Mar 2015 10:27:43 -0500
Subject: [PATCH 0503/3333] Remove symlink for lib/neutron compat

Depends-On: I146910403879c9a85d644bd07a53830ea17ca77d
Change-Id: Ia25331fc74fd26df347024a8314bc4c6ed54428e
---
 lib/neutron | 1 -
 1 file changed, 1 deletion(-)
 delete mode 120000 lib/neutron

diff --git a/lib/neutron b/lib/neutron
deleted file mode 120000
index 00cd72273e..0000000000
--- a/lib/neutron
+++ /dev/null
@@ -1 +0,0 @@
-neutron-legacy
\ No newline at end of file

From dc97cb71e85fc807d2cce6f054c785922d322eb9 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 28 Mar 2015 08:20:50 -0500
Subject: [PATCH 0504/3333] Mostly docs cleanups

Fix documentation build errors and RST formatting

Change-Id: Id93153400c5b069dd9d772381558c7085f64c207
---
 exercise.sh                        |  10 +-
 functions                          |   6 +-
 functions-common                   |   4 +-
 gate/updown.sh                     |   2 +-
 lib/ceilometer                     |  33 +++--
 lib/dstat                          |   2 +-
 lib/horizon                        |   2 +-
 lib/ironic                         |   6 +-
 lib/lvm                            |   8 +-
 lib/nova                           |  21 ++--
 lib/oslo                           |   7 +-
 lib/rpc_backend                    |   5 +-
 lib/stack                          |   9 +-
 lib/swift                          |  47 ++++----
 lib/tempest                        |  60 +++++-----
 lib/tls                            |  15 +--
 lib/trove                          |   4 +-
 run_tests.sh                       |   5 +-
 samples/local.conf                 |   3 +-
 samples/local.sh                   |   7 +-
 stack.sh                           | 185 +++++++++++++++--------------
 stackrc                            |  39 +++---
 tools/build_docs.sh                |   6 +-
 tools/build_venv.sh                |   9 +-
 tools/build_wheels.sh              |  11 +-
 tools/create-stack-user.sh         |   2 +-
 tools/fixup_stuff.sh               |  12 +-
 tools/image_list.sh                |   2 +-
 tools/info.sh                      |   4 +-
 tools/install_pip.sh               |  10 +-
 tools/install_prereqs.sh           |   6 +-
 tools/ironic/scripts/create-node   |   4 +-
 tools/ironic/scripts/setup-network |   4 +-
 tools/outfilter.py                 |  14 +--
 unstack.sh                         |   2 +-
 35 files changed, 284 insertions(+), 282 deletions(-)

diff --git a/exercise.sh b/exercise.sh
index ce694fba66..19c9d80451 100755
--- a/exercise.sh
+++ b/exercise.sh
@@ -2,7 +2,7 @@
 
 # **exercise.sh**
 
-# Keep track of the current devstack directory.
+# Keep track of the current DevStack directory.
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 
 # Import common functions
@@ -14,11 +14,11 @@ source $TOP_DIR/stackrc
 # Run everything in the exercises/ directory that isn't explicitly disabled
 
 # comma separated list of script basenames to skip
-# to refrain from exercising euca.sh use SKIP_EXERCISES=euca
+# to refrain from exercising euca.sh use ``SKIP_EXERCISES=euca``
 SKIP_EXERCISES=${SKIP_EXERCISES:-""}
 
 # comma separated list of script basenames to run
-# to run only euca.sh use RUN_EXERCISES=euca
+# to run only euca.sh use ``RUN_EXERCISES=euca``
 basenames=${RUN_EXERCISES:-""}
 
 EXERCISE_DIR=$TOP_DIR/exercises
@@ -27,7 +27,7 @@ if [[ -z "${basenames}" ]]; then
     # Locate the scripts we should run
     basenames=$(for b in `ls $EXERCISE_DIR/*.sh`; do basename $b .sh; done)
 else
-    # If RUN_EXERCISES was specified, ignore SKIP_EXERCISES.
+    # If ``RUN_EXERCISES`` was specified, ignore ``SKIP_EXERCISES``.
     SKIP_EXERCISES=
 fi
 
@@ -56,7 +56,7 @@ for script in $basenames; do
     fi
 done
 
-# output status of exercise run
+# Output status of exercise run
 echo "====================================================================="
 for script in $skips; do
     echo SKIP $script
diff --git a/functions b/functions
index 9adbfe7cf6..5bc8456281 100644
--- a/functions
+++ b/functions
@@ -439,7 +439,7 @@ function check_path_perm_sanity {
             echo "*** DEST path element"
             echo "***    ${rebuilt_path}"
             echo "*** appears to have 0700 permissions."
-            echo "*** This is very likely to cause fatal issues for devstack daemons."
+            echo "*** This is very likely to cause fatal issues for DevStack daemons."
 
             if [[ -n "$SKIP_PATH_SANITY" ]]; then
                 return
@@ -526,8 +526,8 @@ function setup_colorized_logging {
 }
 
 # These functions are provided for basic fall-back functionality for
-# projects that include parts of devstack (grenade).  stack.sh will
-# override these with more specific versions for devstack (with fancy
+# projects that include parts of DevStack (Grenade).  stack.sh will
+# override these with more specific versions for DevStack (with fancy
 # spinners, etc).  We never override an existing version
 if ! function_exists echo_summary; then
     function echo_summary {
diff --git a/functions-common b/functions-common
index 0f80e98f43..f1aca29b30 100644
--- a/functions-common
+++ b/functions-common
@@ -971,7 +971,7 @@ function get_packages {
 #
 # Only packages required for enabled and collected plugins will included.
 #
-# The same metadata used in the main devstack prerequisite files may be used
+# The same metadata used in the main DevStack prerequisite files may be used
 # in these prerequisite files, see get_packages() for more info.
 function get_plugin_packages {
     local xtrace=$(set +o | grep xtrace)
@@ -1471,7 +1471,7 @@ function fetch_plugins {
         return
     fi
 
-    echo "Fetching devstack plugins"
+    echo "Fetching DevStack plugins"
     for plugin in ${plugins//,/ }; do
         git_clone_by_name $plugin
     done
diff --git a/gate/updown.sh b/gate/updown.sh
index d2d7351a2f..f46385cfe1 100755
--- a/gate/updown.sh
+++ b/gate/updown.sh
@@ -4,7 +4,7 @@
 #
 # Note: this is expected to start running as jenkins
 
-# Step 1: give back sudoers permissions to devstack
+# Step 1: give back sudoers permissions to DevStack
 TEMPFILE=`mktemp`
 echo "stack ALL=(root) NOPASSWD:ALL" >$TEMPFILE
 chmod 0440 $TEMPFILE
diff --git a/lib/ceilometer b/lib/ceilometer
index 7b2215c3d3..81353093b2 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -4,7 +4,7 @@
 # Install and start **Ceilometer** service
 
 # To enable a minimal set of Ceilometer services, add the following to the
-# localrc section of local.conf:
+# ``localrc`` section of ``local.conf``:
 #
 #   enable_service ceilometer-acompute ceilometer-acentral ceilometer-anotification ceilometer-collector ceilometer-api
 #
@@ -17,14 +17,11 @@
 # of Ceilometer (see within for additional settings):
 #
 #   CEILOMETER_USE_MOD_WSGI:       When True, run the api under mod_wsgi.
-#   CEILOMETER_PIPELINE_INTERVAL:  The number of seconds between pipeline processing
-#                                  runs. Default 600.
-#   CEILOMETER_BACKEND:            The database backend (e.g. 'mysql', 'mongodb', 'es')
-#   CEILOMETER_COORDINATION_URL:   The URL for a group membership service provided
-#                                  by tooz.
+#   CEILOMETER_PIPELINE_INTERVAL:  Seconds between pipeline processing runs. Default 600.
+#   CEILOMETER_BACKEND:            Database backend (e.g. 'mysql', 'mongodb', 'es')
+#   CEILOMETER_COORDINATION_URL:   URL for group membership service provided by tooz.
 #   CEILOMETER_EVENTS:             Enable event collection
 
-
 # Dependencies:
 #
 # - functions
@@ -94,7 +91,7 @@ function is_ceilometer_enabled {
     return 1
 }
 
-# create_ceilometer_accounts() - Set up common required ceilometer accounts
+# create_ceilometer_accounts() - Set up common required Ceilometer accounts
 #
 # Project              User         Roles
 # ------------------------------------------------------------------
@@ -117,14 +114,14 @@ function create_ceilometer_accounts {
                 "$CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/"
         fi
         if is_service_enabled swift; then
-            # Ceilometer needs ResellerAdmin role to access swift account stats.
+            # Ceilometer needs ResellerAdmin role to access Swift account stats.
             get_or_add_user_project_role "ResellerAdmin" "ceilometer" $SERVICE_TENANT_NAME
         fi
     fi
 }
 
 
-# _cleanup_keystone_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
+# _cleanup_keystone_apache_wsgi() - Remove WSGI files, disable and remove Apache vhost file
 function _cleanup_ceilometer_apache_wsgi {
     sudo rm -f $CEILOMETER_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for ceilometer)
@@ -149,7 +146,7 @@ function _config_ceilometer_apache_wsgi {
     local ceilometer_apache_conf=$(apache_site_config_for ceilometer)
     local apache_version=$(get_apache_version)
 
-    # copy proxy vhost and wsgi file
+    # Copy proxy vhost and wsgi file
     sudo cp $CEILOMETER_DIR/ceilometer/api/app.wsgi $CEILOMETER_WSGI_DIR/app
 
     sudo cp $FILES/apache-ceilometer.template $ceilometer_apache_conf
@@ -189,9 +186,9 @@ function configure_ceilometer {
         sed -i "s/interval:.*/interval: ${CEILOMETER_PIPELINE_INTERVAL}/" $CEILOMETER_CONF_DIR/pipeline.yaml
     fi
 
-    # the compute and central agents need these credentials in order to
-    # call out to other services' public APIs
-    # the alarm evaluator needs these options to call ceilometer APIs
+    # The compute and central agents need these credentials in order to
+    # call out to other services' public APIs.
+    # The alarm evaluator needs these options to call ceilometer APIs
     iniset $CEILOMETER_CONF service_credentials os_username ceilometer
     iniset $CEILOMETER_CONF service_credentials os_password $SERVICE_PASSWORD
     iniset $CEILOMETER_CONF service_credentials os_tenant_name $SERVICE_TENANT_NAME
@@ -237,7 +234,7 @@ function configure_ceilometer {
 }
 
 function configure_mongodb {
-    # server package is the same on all
+    # Server package is the same on all
     local packages=mongodb-server
 
     if is_fedora; then
@@ -250,13 +247,13 @@ function configure_mongodb {
     install_package ${packages}
 
     if is_fedora; then
-        # ensure smallfiles selected to minimize freespace requirements
+        # Ensure smallfiles is selected to minimize freespace requirements
         sudo sed -i '/--smallfiles/!s/OPTIONS=\"/OPTIONS=\"--smallfiles /' /etc/sysconfig/mongod
 
         restart_service mongod
     fi
 
-    # give mongodb time to start-up
+    # Give mongodb time to start-up
     sleep 5
 }
 
@@ -347,7 +344,7 @@ function start_ceilometer {
         run_process ceilometer-acompute "ceilometer-agent-compute --config-file $CEILOMETER_CONF"
     fi
 
-    # only die on API if it was actually intended to be turned on
+    # Only die on API if it was actually intended to be turned on
     if is_service_enabled ceilometer-api; then
         echo "Waiting for ceilometer-api to start..."
         if ! wait_for_service $SERVICE_TIMEOUT $CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/v2/; then
diff --git a/lib/dstat b/lib/dstat
index 740e48f9e0..c8faa6578c 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -41,7 +41,7 @@ function start_dstat {
 # stop_dstat() stop dstat process
 function stop_dstat {
     # dstat runs as a console, not as a service, and isn't trackable
-    # via the normal mechanisms for devstack. So lets just do a
+    # via the normal mechanisms for DevStack. So lets just do a
     # killall and move on.
     killall dstat || /bin/true
 }
diff --git a/lib/horizon b/lib/horizon
index c6e3692d47..63a9d0fe46 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -129,7 +129,7 @@ function init_horizon {
     fi
     enable_apache_site horizon
 
-    # Remove old log files that could mess with how devstack detects whether Horizon
+    # Remove old log files that could mess with how DevStack detects whether Horizon
     # has been successfully started (see start_horizon() and functions::screen_it())
     # and run_process
     sudo rm -f /var/log/$APACHE_NAME/horizon_*
diff --git a/lib/ironic b/lib/ironic
index a7738bc14e..fcf1a543a9 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -53,7 +53,7 @@ IRONIC_HW_EPHEMERAL_DISK=${IRONIC_HW_EPHEMERAL_DISK:-0}
 # The file is composed of multiple lines, each line includes four field
 # separated by white space: IPMI address, MAC address, IPMI username
 # and IPMI password.
-# An example:
+#
 #   192.168.110.107 00:1e:67:57:50:4c root otc123
 IRONIC_IPMIINFO_FILE=${IRONIC_IPMIINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
 
@@ -99,10 +99,10 @@ IRONIC_AGENT_KERNEL_URL=${IRONIC_AGENT_KERNEL_URL:-http://tarballs.openstack.org
 IRONIC_AGENT_RAMDISK_URL=${IRONIC_AGENT_RAMDISK_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe_image-oem.cpio.gz}
 
 # Which deploy driver to use - valid choices right now
-# are 'pxe_ssh', 'pxe_ipmitool', 'agent_ssh' and 'agent_ipmitool'.
+# are ``pxe_ssh``, ``pxe_ipmitool``, ``agent_ssh`` and ``agent_ipmitool``.
 IRONIC_DEPLOY_DRIVER=${IRONIC_DEPLOY_DRIVER:-pxe_ssh}
 
-#TODO(agordeev): replace 'ubuntu' with host distro name getting
+# TODO(agordeev): replace 'ubuntu' with host distro name getting
 IRONIC_DEPLOY_FLAVOR=${IRONIC_DEPLOY_FLAVOR:-ubuntu $IRONIC_DEPLOY_ELEMENT}
 
 # Support entry points installation of console scripts
diff --git a/lib/lvm b/lib/lvm
index d0322c76b3..6c59937b0c 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -1,3 +1,5 @@
+#!/bin/bash
+#
 # lib/lvm
 # Configure the default LVM volume group used by Cinder and Nova
 
@@ -32,8 +34,8 @@ DEFAULT_VOLUME_GROUP_NAME=$VOLUME_GROUP_NAME-default
 BACKING_FILE_SUFFIX=-backing-file
 
 
-# Entry Points
-# ------------
+# Functions
+# ---------
 
 # _clean_lvm_volume_group removes all default LVM volumes
 #
@@ -52,7 +54,7 @@ function _clean_lvm_volume_group {
 function _clean_lvm_backing_file {
     local backing_file=$1
 
-    # if the backing physical device is a loop device, it was probably setup by devstack
+    # If the backing physical device is a loop device, it was probably setup by DevStack
     if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
         local vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
         sudo losetup -d $vg_dev
diff --git a/lib/nova b/lib/nova
index 8e1b2f7b9d..385da4e44b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -55,8 +55,9 @@ NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 # NOVA_API_VERSION valid options
-#   - default - setup API end points as nova does out of the box
-#   - v21default - make v21 the default on /v2
+# - default - setup API end points as nova does out of the box
+# - v21default - make v21 the default on /v2
+#
 # NOTE(sdague): this is for transitional testing of the Nova v21 API.
 # Expect to remove in L or M.
 NOVA_API_VERSION=${NOVA_API_VERSION-default}
@@ -77,7 +78,7 @@ EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
 EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
 
 # Option to enable/disable config drive
-# NOTE: Set FORCE_CONFIG_DRIVE="False" to turn OFF config drive
+# NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
 
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
@@ -89,11 +90,11 @@ QEMU_CONF=/etc/libvirt/qemu.conf
 # Set default defaults here as some hypervisor drivers override these
 PUBLIC_INTERFACE_DEFAULT=br100
 FLAT_NETWORK_BRIDGE_DEFAULT=br100
-# set the GUEST_INTERFACE_DEFAULT to some interface on the box so that
-# the default isn't completely crazy. This will match eth*, em*, or
-# the new p* interfaces, then basically picks the first
+# Set ``GUEST_INTERFACE_DEFAULT`` to some interface on the box so that
+# the default isn't completely crazy. This will match ``eth*``, ``em*``, or
+# the new ``p*`` interfaces, then basically picks the first
 # alphabetically. It's probably wrong, however it's less wrong than
-# always using 'eth0' which doesn't exist on new Linux distros at all.
+# always using ``eth0`` which doesn't exist on new Linux distros at all.
 GUEST_INTERFACE_DEFAULT=$(ip link \
     | grep 'state UP' \
     | awk '{print $2}' \
@@ -101,8 +102,8 @@ GUEST_INTERFACE_DEFAULT=$(ip link \
     | grep ^[ep] \
     | head -1)
 
-# $NOVA_VNC_ENABLED can be used to forcibly enable vnc configuration.
-# In multi-node setups allows compute hosts to not run n-novnc.
+# ``NOVA_VNC_ENABLED`` can be used to forcibly enable VNC configuration.
+# In multi-node setups allows compute hosts to not run ``n-novnc``.
 NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
 
 # Get hypervisor configuration
@@ -144,7 +145,7 @@ FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 # running the VM - removing a SPOF and bandwidth bottleneck.
 MULTI_HOST=$(trueorfalse False MULTI_HOST)
 
-# ``NOVA_ALLOW_MOVE_TO_SAME_HOST` can be set to False in multi node devstack,
+# ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
 # where there are at least two nova-computes.
 NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
 
diff --git a/lib/oslo b/lib/oslo
index 86efb60a4e..d9688a01cd 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -2,7 +2,7 @@
 #
 # lib/oslo
 #
-# Functions to install oslo libraries from git
+# Functions to install **Oslo** libraries from git
 #
 # We need this to handle the fact that projects would like to use
 # pre-released versions of oslo libraries.
@@ -46,8 +46,9 @@ GITDIR["tooz"]=$DEST/tooz
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
 
-# Entry Points
-# ------------
+
+# Functions
+# ---------
 
 function _do_install_oslo_lib {
     local name=$1
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3033cbe08e..d82af6de6e 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -1,8 +1,7 @@
 #!/bin/bash
 #
 # lib/rpc_backend
-# Interface for interactig with different rpc backend
-# rpc backend settings
+# Interface for interactig with different RPC backends
 
 # Dependencies:
 #
@@ -27,10 +26,10 @@ RPC_MESSAGING_PROTOCOL=${RPC_MESSAGING_PROTOCOL:-0.9}
 # messaging server as a service, which it really isn't for multi host
 QPID_HOST=${QPID_HOST:-}
 
+
 # Functions
 # ---------
 
-
 # Make sure we only have one rpc backend enabled.
 # Also check the specified rpc backend is available on your platform.
 function check_rpc_backend {
diff --git a/lib/stack b/lib/stack
index 11dd87ca28..47e8ce2a22 100644
--- a/lib/stack
+++ b/lib/stack
@@ -2,15 +2,18 @@
 #
 # lib/stack
 #
-# These functions are code snippets pulled out of stack.sh for easier
+# These functions are code snippets pulled out of ``stack.sh`` for easier
 # re-use by Grenade.  They can assume the same environment is available
-# as in the lower part of stack.sh, namely a valid stackrc has been sourced
-# as well as all of the lib/* files for the services have been sourced.
+# as in the lower part of ``stack.sh``, namely a valid stackrc has been sourced
+# as well as all of the ``lib/*`` files for the services have been sourced.
 #
 # For clarity, all functions declared here that came from ``stack.sh``
 # shall be named with the prefix ``stack_``.
 
 
+# Functions
+# ---------
+
 # Generic service install handles venv creation if confgured for service
 # stack_install_service service
 function stack_install_service {
diff --git a/lib/swift b/lib/swift
index 28ef7de1f1..07068bb104 100644
--- a/lib/swift
+++ b/lib/swift
@@ -38,7 +38,6 @@ fi
 # Set up default directories
 GITDIR["python-swiftclient"]=$DEST/python-swiftclient
 
-
 SWIFT_DIR=$DEST/swift
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
@@ -59,7 +58,7 @@ SWIFT_DISK_IMAGE=${SWIFT_DATA_DIR}/drives/images/swift.img
 SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-/etc/swift}
 
 if is_service_enabled s-proxy && is_service_enabled swift3; then
-    # If we are using swift3, we can default the s3 port to swift instead
+    # If we are using ``swift3``, we can default the S3 port to swift instead
     # of nova-objectstore
     S3_SERVICE_PORT=${S3_SERVICE_PORT:-8080}
 fi
@@ -137,11 +136,12 @@ ACCOUNT_PORT_BASE=${ACCOUNT_PORT_BASE:-6012}
 SWIFT_ENABLE_TEMPURLS=${SWIFT_ENABLE_TEMPURLS:-False}
 SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY:-}
 
+# Toggle for deploying Swift under HTTPD + mod_wsgi
+SWIFT_USE_MOD_WSGI=${SWIFT_USE_MOD_WSGI:-False}
+
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,swift
 
-# Toggle for deploying Swift under HTTPD + mod_wsgi
-SWIFT_USE_MOD_WSGI=${SWIFT_USE_MOD_WSGI:-False}
 
 # Functions
 # ---------
@@ -303,7 +303,6 @@ function generate_swift_config_services {
     sed -i -e "s,#[ ]*recon_cache_path .*,recon_cache_path = ${SWIFT_DATA_DIR}/cache," ${swift_node_config}
 }
 
-
 # configure_swift() - Set config files, create data dirs and loop image
 function configure_swift {
     local swift_pipeline="${SWIFT_EXTRAS_MIDDLEWARE_NO_AUTH}"
@@ -374,12 +373,9 @@ function configure_swift {
         iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT key_file "$SWIFT_SSL_KEY"
     fi
 
-    # Devstack is commonly run in a small slow environment, so bump the
-    # timeouts up.
-    # node_timeout is how long between read operations a node takes to
-    # respond to the proxy server
-    # conn_timeout is all about how long it takes a connect() system call to
-    # return
+    # DevStack is commonly run in a small slow environment, so bump the timeouts up.
+    # ``node_timeout`` is the node read operation response time to the proxy server
+    # ``conn_timeout`` is how long it takes a connect() system call to return
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server node_timeout 120
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server conn_timeout 20
 
@@ -394,10 +390,10 @@ function configure_swift {
         SWIFT_EXTRAS_MIDDLEWARE_LAST="${SWIFT_EXTRAS_MIDDLEWARE_LAST} ceilometer"
     fi
 
-    # Restrict the length of auth tokens in the swift proxy-server logs.
+    # Restrict the length of auth tokens in the Swift ``proxy-server`` logs.
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:proxy-logging reveal_sensitive_prefix ${SWIFT_LOG_TOKEN_LENGTH}
 
-    # By default Swift will be installed with keystone and tempauth middleware
+    # By default Swift will be installed with Keystone and tempauth middleware
     # and add the swift3 middleware if its configured for it. The token for
     # tempauth would be prefixed with the reseller_prefix setting `TEMPAUTH_` the
     # token for keystoneauth would have the standard reseller_prefix `AUTH_`
@@ -413,17 +409,13 @@ function configure_swift {
     sed -i "/^pipeline/ { s/tempauth/${swift_pipeline} ${SWIFT_EXTRAS_MIDDLEWARE}/ ;}" ${SWIFT_CONFIG_PROXY_SERVER}
     sed -i "/^pipeline/ { s/proxy-server/${SWIFT_EXTRAS_MIDDLEWARE_LAST} proxy-server/ ; }" ${SWIFT_CONFIG_PROXY_SERVER}
 
-
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server account_autocreate true
 
-
-
     # Configure Crossdomain
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:crossdomain use "egg:swift#crossdomain"
 
-
-    # This causes the authtoken middleware to use the same python logging
-    # adapter provided by the swift proxy-server, so that request transaction
+    # Configure authtoken middleware to use the same Python logging
+    # adapter provided by the Swift ``proxy-server``, so that request transaction
     # IDs will included in all of its log messages.
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
@@ -436,7 +428,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth use "egg:swift#keystoneauth"
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:keystoneauth operator_roles "Member, admin"
 
-    # Configure Tempauth. In the sample config file, Keystoneauth is commented
+    # Configure Tempauth. In the sample config file Keystoneauth is commented
     # out. Make sure we uncomment Tempauth after we uncomment Keystoneauth
     # otherwise, this code also sets the reseller_prefix for Keystoneauth.
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
@@ -579,7 +571,8 @@ function create_swift_disk {
         sudo chown -R ${STACK_USER}: ${node}
     done
 }
-# create_swift_accounts() - Set up standard swift accounts and extra
+
+# create_swift_accounts() - Set up standard Swift accounts and extra
 # one for tests we do this by attaching all words in the account name
 # since we want to make it compatible with tempauth which use
 # underscores for separators.
@@ -593,9 +586,9 @@ function create_swift_disk {
 # swifttenanttest4   swiftusertest4     admin          swift_test
 
 function create_swift_accounts {
-    # Defines specific passwords used by tools/create_userrc.sh
-    # As these variables are used by create_userrc.sh, they must be exported
-    # The _password suffix is expected by create_userrc.sh
+    # Defines specific passwords used by ``tools/create_userrc.sh``
+    # As these variables are used by ``create_userrc.sh,`` they must be exported
+    # The _password suffix is expected by ``create_userrc.sh``.
     export swiftusertest1_password=testing
     export swiftusertest2_password=testing2
     export swiftusertest3_password=testing3
@@ -725,8 +718,8 @@ function start_swift {
 
     # By default with only one replica we are launching the proxy,
     # container, account and object server in screen in foreground and
-    # other services in background. If we have SWIFT_REPLICAS set to something
-    # greater than one we first spawn all the swift services then kill the proxy
+    # other services in background. If we have ``SWIFT_REPLICAS`` set to something
+    # greater than one we first spawn all the Swift services then kill the proxy
     # service so we can run it in foreground in screen.  ``swift-init ...
     # {stop|restart}`` exits with '1' if no servers are running, ignore it just
     # in case
@@ -762,7 +755,7 @@ function stop_swift {
         swift-init --run-dir=${SWIFT_DATA_DIR}/run rest stop && return 0
     fi
 
-    # screen normally killed by unstack.sh
+    # screen normally killed by ``unstack.sh``
     if type -p swift-init >/dev/null; then
         swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
     fi
diff --git a/lib/tempest b/lib/tempest
index 8672a14338..d86ee27fd0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -62,13 +62,11 @@ BUILD_INTERVAL=1
 # The default is set to 196 seconds.
 BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 
-
 # This must be False on stable branches, as master tempest
 # deps do not match stable branch deps. Set this to True to
-# have tempest installed in devstack by default.
+# have tempest installed in DevStack by default.
 INSTALL_TEMPEST=${INSTALL_TEMPEST:-"True"}
 
-
 BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
 BOTO_CONF=/etc/boto.cfg
 
@@ -83,6 +81,7 @@ TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-$TEMPEST_DEFAULT_STORAGE_PR
 IPV6_ENABLED=$(trueorfalse True IPV6_ENABLED)
 IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True IPV6_SUBNET_ATTRIBUTES_ENABLED)
 
+
 # Functions
 # ---------
 
@@ -168,8 +167,8 @@ function configure_tempest {
         esac
     fi
 
-    # Create tempest.conf from tempest.conf.sample
-    # copy every time, because the image UUIDS are going to change
+    # Create ``tempest.conf`` from ``tempest.conf.sample``
+    # Copy every time because the image UUIDS are going to change
     sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
     install -m 644 $TEMPEST_DIR/etc/tempest.conf.sample $TEMPEST_CONFIG
 
@@ -179,8 +178,8 @@ function configure_tempest {
     # the cloud. We don't always want to so that we can ensure Tempest
     # would work on a public cloud.
     TEMPEST_HAS_ADMIN=$(trueorfalse True TEMPEST_HAS_ADMIN)
-    # See files/keystone_data.sh and stack.sh where admin, demo and alt_demo
-    # user and tenant are set up...
+
+    # See ``lib/keystone`` where these users and tenants are set up
     ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
     ADMIN_TENANT_NAME=${ADMIN_TENANT_NAME:-admin}
     ADMIN_DOMAIN_NAME=${ADMIN_DOMAIN_NAME:-Default}
@@ -191,13 +190,13 @@ function configure_tempest {
     ADMIN_TENANT_ID=$(openstack project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
-        # If the ``DEFAULT_INSTANCE_TYPE`` not declared, use the new behavior
-        # Tempest creates instane types for himself
+        # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
+        # Tempest creates its own instance types
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             available_flavors=$(nova flavor-list)
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 if is_arch "ppc64"; then
-                    # qemu needs at least 128MB of memory to boot on ppc64
+                    # Qemu needs at least 128MB of memory to boot on ppc64
                     nova flavor-create m1.nano 42 128 0 1
                 else
                     nova flavor-create m1.nano 42 64 0 1
@@ -214,8 +213,7 @@ function configure_tempest {
             fi
             flavor_ref_alt=84
         else
-            # Check Nova for existing flavors and, if set, look for the
-            # ``DEFAULT_INSTANCE_TYPE`` and use that.
+            # Check Nova for existing flavors, if ``DEFAULT_INSTANCE_TYPE`` is set use it.
             boto_instance_type=$DEFAULT_INSTANCE_TYPE
             flavor_lines=`nova flavor-list`
             IFS=$'\r\n'
@@ -240,8 +238,8 @@ function configure_tempest {
             flavor_ref=${flavors[0]}
             flavor_ref_alt=$flavor_ref
 
-            # ensure flavor_ref and flavor_ref_alt have different values
-            # some resize instance in tempest tests depends on this.
+            # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
+            # Some resize instance in tempest tests depends on this.
             for f in ${flavors[@]:1}; do
                 if [[ $f -ne $flavor_ref ]]; then
                     flavor_ref_alt=$f
@@ -266,7 +264,7 @@ function configure_tempest {
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
         if [ "$Q_USE_NAMESPACE" == "False" ]; then
-            # If namespaces are disabled, devstack will create a single
+            # If namespaces are disabled, DevStack will create a single
             # public router that tempest should be configured to use.
             public_router_id=$(neutron router-list | awk "/ $Q_ROUTER_NAME / \
                 { print \$2 }")
@@ -274,6 +272,7 @@ function configure_tempest {
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
+
     # Oslo
     iniset $TEMPEST_CONFIG oslo_concurrency lock_path $TEMPEST_STATE_PATH
     mkdir -p $TEMPEST_STATE_PATH
@@ -309,15 +308,13 @@ function configure_tempest {
     fi
 
     # Image
-    # for the gate we want to be able to override this variable so we aren't
-    # doing an HTTP fetch over the wide internet for this test
+    # We want to be able to override this variable in the gate to avoid
+    # doing an external HTTP fetch for this test.
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
 
     # Auth
-    #
-    #
     TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}
     iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
@@ -336,7 +333,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
 
     # Compute Features
-    # Run verify_tempest_config -ur to retrieve enabled extensions on API endpoints
+    # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
     local tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
@@ -417,11 +414,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario large_ops_number ${TEMPEST_LARGE_OPS_NUMBER:-0}
 
     # Telemetry
-    # Ceilometer API optimization happened in juno that allows to run more tests in tempest.
+    # Ceilometer API optimization happened in Juno that allows to run more tests in tempest.
     # Once Tempest retires support for icehouse this flag can be removed.
     iniset $TEMPEST_CONFIG telemetry too_slow_to_test "False"
 
-    # Object storage
+    # Object Store
     local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
@@ -445,7 +442,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi
 
-    # Using CINDER_ENABLED_BACKENDS
+    # Using ``CINDER_ENABLED_BACKENDS``
     if [[ -n "$CINDER_ENABLED_BACKENDS" ]] && [[ $CINDER_ENABLED_BACKENDS =~ .*,.* ]]; then
         iniset $TEMPEST_CONFIG volume-feature-enabled multi_backend "True"
         local i=1
@@ -470,7 +467,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG dashboard dashboard_url "http://$SERVICE_HOST/"
     iniset $TEMPEST_CONFIG dashboard login_url "http://$SERVICE_HOST/auth/login/"
 
-    # cli
+    # CLI
     iniset $TEMPEST_CONFIG cli cli_dir $NOVA_BIN_DIR
 
     # Baremetal
@@ -495,7 +492,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
     fi
 
-    # service_available
+    # ``service_available``
     for service in ${TEMPEST_SERVICES//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"
@@ -505,7 +502,7 @@ function configure_tempest {
     done
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
-        # Use the BOTO_CONFIG environment variable to point to this file
+        # Use the ``BOTO_CONFIG`` environment variable to point to this file
         iniset $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
         sudo chown $STACK_USER $BOTO_CONF
     fi
@@ -520,7 +517,6 @@ function configure_tempest {
 # ------------------------------------------------------------------
 # alt_demo             alt_demo     Member
 
-# Migrated from keystone_data.sh
 function create_tempest_accounts {
     if is_service_enabled tempest; then
         # Tempest has some tests that validate various authorization checks
@@ -531,13 +527,13 @@ function create_tempest_accounts {
     fi
 }
 
-# install_tempest_lib() - Collect source, prepare, and install tempest-lib
+# install_tempest_lib() - Collect source, prepare, and install ``tempest-lib``
 function install_tempest_lib {
     if use_library_from_git "tempest-lib"; then
         git_clone_by_name "tempest-lib"
         setup_dev_lib "tempest-lib"
-        # NOTE(mtreinish) For testing tempest-lib from git with tempest we need
-        # put the git version of tempest-lib in the tempest job's tox venv
+        # NOTE(mtreinish) For testing ``tempest-lib`` from git with Tempest we need to
+        # put the git version of ``tempest-lib`` in the Tempest job's tox venv
         export PIP_VIRTUAL_ENV=${PROJECT_VENV["tempest"]}
         setup_dev_lib "tempest-lib"
         unset PIP_VIRTUAL_ENV
@@ -555,7 +551,7 @@ function install_tempest {
     popd
 }
 
-# init_tempest() - Initialize ec2 images
+# init_tempest() - Initialize EC2 images
 function init_tempest {
     local base_image_name=cirros-${CIRROS_VERSION}-${CIRROS_ARCH}
     # /opt/stack/devstack/files/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec
@@ -564,7 +560,7 @@ function init_tempest {
     local ramdisk="$image_dir/${base_image_name}-initrd"
     local disk_image="$image_dir/${base_image_name}-blank.img"
     if is_service_enabled nova; then
-        # if the cirros uec downloaded and the system is uec capable
+        # If the CirrOS uec downloaded and the system is UEC capable
         if [ -f "$kernel" -a -f "$ramdisk" -a -f "$disk_image" -a  "$VIRT_DRIVER" != "openvz" \
             -a \( "$LIBVIRT_TYPE" != "lxc" -o "$VIRT_DRIVER" != "libvirt" \) ]; then
             echo "Prepare aki/ari/ami Images"
diff --git a/lib/tls b/lib/tls
index 677895b9b2..09f1c2dfdd 100644
--- a/lib/tls
+++ b/lib/tls
@@ -32,6 +32,7 @@
 # - is_ssl_enabled_service
 # - enable_mod_ssl
 
+
 # Defaults
 # --------
 
@@ -92,7 +93,6 @@ function create_CA_base {
     cp /dev/null $ca_dir/index.txt
 }
 
-
 # Create a new CA configuration file
 # create_CA_config ca-dir common-name
 function create_CA_config {
@@ -248,7 +248,6 @@ function init_cert {
     fi
 }
 
-
 # make_cert creates and signs a new certificate with the given commonName and CA
 # make_cert ca-dir cert-name "common-name" ["alt-name" ...]
 function make_cert {
@@ -287,7 +286,6 @@ function make_cert {
     fi
 }
 
-
 # Make an intermediate CA to sign everything else
 # make_int_CA ca-dir signing-ca-dir
 function make_int_CA {
@@ -362,17 +360,16 @@ function is_ssl_enabled_service {
     return 1
 }
 
-
 # Ensure that the certificates for a service are in place. This function does
 # not check that a service is SSL enabled, this should already have been
 # completed.
 #
 # The function expects to find a certificate, key and CA certificate in the
-# variables {service}_SSL_CERT, {service}_SSL_KEY and {service}_SSL_CA. For
-# example for keystone this would be KEYSTONE_SSL_CERT, KEYSTONE_SSL_KEY and
-# KEYSTONE_SSL_CA.
+# variables ``{service}_SSL_CERT``, ``{service}_SSL_KEY`` and ``{service}_SSL_CA``. For
+# example for keystone this would be ``KEYSTONE_SSL_CERT``, ``KEYSTONE_SSL_KEY`` and
+# ``KEYSTONE_SSL_CA``.
 #
-# If it does not find these certificates then the devstack-issued server
+# If it does not find these certificates then the DevStack-issued server
 # certificate, key and CA certificate will be associated with the service.
 #
 # If only some of the variables are provided then the function will quit.
@@ -437,14 +434,12 @@ function start_tls_proxy {
 # Cleanup Functions
 # =================
 
-
 # Stops all stud processes. This should be done only after all services
 # using tls configuration are down.
 function stop_tls_proxy {
     killall stud
 }
 
-
 # Remove CA along with configuration, as well as the local server certificate
 function cleanup_CA {
     rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
diff --git a/lib/trove b/lib/trove
index 5dd4f23611..b0a96100c2 100644
--- a/lib/trove
+++ b/lib/trove
@@ -21,6 +21,7 @@
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
+
 # Defaults
 # --------
 if is_service_enabled neutron; then
@@ -80,7 +81,7 @@ function setup_trove_logging {
     fi
 }
 
-# create_trove_accounts() - Set up common required trove accounts
+# create_trove_accounts() - Set up common required Trove accounts
 
 # Tenant               User       Roles
 # ------------------------------------------------------------------
@@ -115,7 +116,6 @@ function cleanup_trove {
     rm -fr $TROVE_CONF_DIR/*
 }
 
-
 # configure_trove() - Set config files, create data dirs, etc
 function configure_trove {
     setup_develop $TROVE_DIR
diff --git a/run_tests.sh b/run_tests.sh
index 3ba7e1023d..c6b7da64c0 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -11,9 +11,8 @@
 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations
 # under the License.
-#
-#
-# this runs a series of unit tests for devstack to ensure it's functioning
+
+# This runs a series of unit tests for DevStack to ensure it's functioning
 
 PASSES=""
 FAILURES=""
diff --git a/samples/local.conf b/samples/local.conf
index 63000b65ba..bd0cd9c0db 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -1,7 +1,6 @@
 # Sample ``local.conf`` for user-configurable variables in ``stack.sh``
 
-# NOTE: Copy this file to the root ``devstack`` directory for it to
-# work properly.
+# NOTE: Copy this file to the root DevStack directory for it to work properly.
 
 # ``local.conf`` is a user-maintained settings file that is sourced from ``stackrc``.
 # This gives it the ability to override any variables set in ``stackrc``.
diff --git a/samples/local.sh b/samples/local.sh
index 664cb663fe..634f6ddb17 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -3,15 +3,14 @@
 # Sample ``local.sh`` for user-configurable tasks to run automatically
 # at the successful conclusion of ``stack.sh``.
 
-# NOTE: Copy this file to the root ``devstack`` directory for it to
-# work properly.
+# NOTE: Copy this file to the root DevStack directory for it to work properly.
 
 # This is a collection of some of the things we have found to be useful to run
 # after ``stack.sh`` to tweak the OpenStack configuration that DevStack produces.
 # These should be considered as samples and are unsupported DevStack code.
 
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 
 # Import common functions
@@ -50,7 +49,7 @@ if is_service_enabled nova; then
     source $TOP_DIR/openrc admin admin
 
     # Name of new flavor
-    # set in ``localrc`` with ``DEFAULT_INSTANCE_TYPE=m1.micro``
+    # set in ``local.conf`` with ``DEFAULT_INSTANCE_TYPE=m1.micro``
     MI_NAME=m1.micro
 
     # Create micro flavor if not present
diff --git a/stack.sh b/stack.sh
index 090d527328..8ab82348f3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -16,18 +16,11 @@
 # (14.04 Trusty or newer), **Fedora** (F20 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
-# a VM or physical server. Additionally, we maintain a list of ``apt`` and
+# a VM or physical server. Additionally, we maintain a list of ``deb`` and
 # ``rpm`` dependencies and other configuration files in this repo.
 
 # Learn more and get the most recent version at http://devstack.org
 
-# check if someone has invoked with "sh"
-if [[ "${POSIXLY_CORRECT}" == "y" ]]; then
-    echo "You appear to be running bash in POSIX compatibility mode."
-    echo "devstack uses bash features. \"./stack.sh\" should do the right thing"
-    exit 1
-fi
-
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
@@ -44,7 +37,7 @@ umask 022
 # Not all distros have sbin in PATH for regular users.
 PATH=$PATH:/usr/local/sbin:/usr/sbin:/sbin
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 
 # Check for uninitialized variables, a big cause of bugs
@@ -53,6 +46,10 @@ if [[ -n "$NOUNSET" ]]; then
     set -o nounset
 fi
 
+
+# Configuration
+# =============
+
 # Sanity Checks
 # -------------
 
@@ -61,7 +58,7 @@ if [[ -r $TOP_DIR/.stackenv ]]; then
     rm $TOP_DIR/.stackenv
 fi
 
-# ``stack.sh`` keeps the list of ``apt`` and ``rpm`` dependencies and config
+# ``stack.sh`` keeps the list of ``deb`` and ``rpm`` dependencies, config
 # templates and other useful files in the ``files`` subdirectory
 FILES=$TOP_DIR/files
 if [ ! -d $FILES ]; then
@@ -69,12 +66,23 @@ if [ ! -d $FILES ]; then
 fi
 
 # ``stack.sh`` keeps function libraries here
+# Make sure ``$TOP_DIR/inc`` directory is present
+if [ ! -d $TOP_DIR/inc ]; then
+    die $LINENO "missing devstack/inc"
+fi
+
+# ``stack.sh`` keeps project libraries here
 # Make sure ``$TOP_DIR/lib`` directory is present
 if [ ! -d $TOP_DIR/lib ]; then
     die $LINENO "missing devstack/lib"
 fi
 
-# Check if run as root
+# Check if run in POSIX shell
+if [[ "${POSIXLY_CORRECT}" == "y" ]]; then
+    echo "You are running POSIX compatibility mode, DevStack requires bash 4.2 or newer."
+    exit 1
+fi
+
 # OpenStack is designed to be run as a non-root user; Horizon will fail to run
 # as **root** since Apache will not serve content from **root** user).
 # ``stack.sh`` must not be run as **root**.  It aborts and suggests one course of
@@ -89,8 +97,6 @@ if [[ $EUID -eq 0 ]]; then
     exit 1
 fi
 
-# Print the kernel version
-uname -a
 
 # Prepare the environment
 # -----------------------
@@ -112,6 +118,7 @@ source $TOP_DIR/lib/stack
 # and ``DISTRO``
 GetDistro
 
+
 # Global Settings
 # ---------------
 
@@ -134,7 +141,6 @@ if [[ -r $TOP_DIR/local.conf ]]; then
     done
 fi
 
-
 # ``stack.sh`` is customizable by setting environment variables.  Override a
 # default setting via export::
 #
@@ -145,18 +151,20 @@ fi
 #
 #     DATABASE_PASSWORD=simple ./stack.sh
 #
-# Persistent variables can be placed in a ``localrc`` file::
+# Persistent variables can be placed in a ``local.conf`` file::
 #
+#     [[local|localrc]]
 #     DATABASE_PASSWORD=anothersecret
 #     DATABASE_USER=hellaroot
 #
 # We try to have sensible defaults, so you should be able to run ``./stack.sh``
-# in most cases.  ``localrc`` is not distributed with DevStack and will never
+# in most cases.  ``local.conf`` is not distributed with DevStack and will never
 # be overwritten by a DevStack update.
 #
 # DevStack distributes ``stackrc`` which contains locations for the OpenStack
 # repositories, branches to configure, and other configuration defaults.
-# ``stackrc`` sources ``localrc`` to allow you to safely override those settings.
+# ``stackrc`` sources the ``localrc`` section of ``local.conf`` to allow you to
+# safely override those settings.
 
 if [[ ! -r $TOP_DIR/stackrc ]]; then
     die $LINENO "missing $TOP_DIR/stackrc - did you grab more than just stack.sh?"
@@ -188,34 +196,27 @@ fi
 # Make sure the proxy config is visible to sub-processes
 export_proxy_variables
 
-# Remove services which were negated in ENABLED_SERVICES
+# Remove services which were negated in ``ENABLED_SERVICES``
 # using the "-" prefix (e.g., "-rabbit") instead of
 # calling disable_service().
 disable_negated_services
 
-# Look for obsolete stuff
-# if [[ ,${ENABLED_SERVICES}, =~ ,"swift", ]]; then
-#     echo "FATAL: 'swift' is not supported as a service name"
-#     echo "FATAL: Use the actual swift service names to enable them as required:"
-#     echo "FATAL: s-proxy s-object s-container s-account"
-#     exit 1
-# fi
 
 # Configure sudo
 # --------------
 
-# We're not **root**, make sure ``sudo`` is available
+# We're not as **root** so make sure ``sudo`` is available
 is_package_installed sudo || install_package sudo
 
 # UEC images ``/etc/sudoers`` does not have a ``#includedir``, add one
 sudo grep -q "^#includedir.*/etc/sudoers.d" /etc/sudoers ||
     echo "#includedir /etc/sudoers.d" | sudo tee -a /etc/sudoers
 
-# Set up devstack sudoers
+# Set up DevStack sudoers
 TEMPFILE=`mktemp`
 echo "$STACK_USER ALL=(root) NOPASSWD:ALL" >$TEMPFILE
-# Some binaries might be under /sbin or /usr/sbin, so make sure sudo will
-# see them by forcing PATH
+# Some binaries might be under ``/sbin`` or ``/usr/sbin``, so make sure sudo will
+# see them by forcing ``PATH``
 echo "Defaults:$STACK_USER secure_path=/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >> $TEMPFILE
 echo "Defaults:$STACK_USER !requiretty" >> $TEMPFILE
 chmod 0440 $TEMPFILE
@@ -226,7 +227,7 @@ sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
 # Configure Distro Repositories
 # -----------------------------
 
-# For debian/ubuntu make apt attempt to retry network ops on it's own
+# For Debian/Ubuntu make apt attempt to retry network ops on it's own
 if is_ubuntu; then
     echo 'APT::Acquire::Retries "20";' | sudo tee /etc/apt/apt.conf.d/80retry  >/dev/null
 fi
@@ -237,7 +238,7 @@ fi
 if is_fedora && [[ $DISTRO == "rhel7" ]]; then
     # RHEL requires EPEL for many Open Stack dependencies
 
-    # note we always remove and install latest -- some environments
+    # NOTE: We always remove and install latest -- some environments
     # use snapshot images, and if EPEL version updates they break
     # unless we update them to latest version.
     if sudo yum repolist enabled epel | grep -q 'epel'; then
@@ -248,7 +249,7 @@ if is_fedora && [[ $DISTRO == "rhel7" ]]; then
     # repo, then removes itself (as epel-release installed the
     # "real" repo).
     #
-    # you would think that rather than this, you could use
+    # You would think that rather than this, you could use
     # $releasever directly in .repo file we create below.  However
     # RHEL gives a $releasever of "6Server" which breaks the path;
     # see https://bugzilla.redhat.com/show_bug.cgi?id=1150759
@@ -265,7 +266,7 @@ EOF
     sudo yum-config-manager --enable epel-bootstrap
     yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
-    # epel rpm has installed it's version
+    # EPEL rpm has installed it's version
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
 
     # ... and also optional to be enabled
@@ -300,7 +301,7 @@ sudo mkdir -p $DEST
 safe_chown -R $STACK_USER $DEST
 safe_chmod 0755 $DEST
 
-# a basic test for $DEST path permissions (fatal on error unless skipped)
+# Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
 check_path_perm_sanity ${DEST}
 
 # Destination path for service data
@@ -488,6 +489,9 @@ set -o errexit
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
 
+# Print the kernel version
+uname -a
+
 # Reset the bundle of CA certificates
 SSL_BUNDLE_FILE="$DATA_DIR/ca-bundle.pem"
 rm -f $SSL_BUNDLE_FILE
@@ -500,7 +504,7 @@ source $TOP_DIR/lib/rpc_backend
 # and the specified rpc backend is available on your platform.
 check_rpc_backend
 
-# Service to enable with SSL if USE_SSL is True
+# Service to enable with SSL if ``USE_SSL`` is True
 SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron"
 
 if is_service_enabled tls-proxy && [ "$USE_SSL" == "True" ]; then
@@ -514,7 +518,7 @@ fi
 # defaults before other services are run
 run_phase override_defaults
 
-# Import apache functions
+# Import Apache functions
 source $TOP_DIR/lib/apache
 
 # Import TLS functions
@@ -598,8 +602,9 @@ function read_password {
 
 
 # Database Configuration
+# ----------------------
 
-# To select between database backends, add the following to ``localrc``:
+# To select between database backends, add the following to ``local.conf``:
 #
 #    disable_service mysql
 #    enable_service postgresql
@@ -611,9 +616,10 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 
 
 # Queue Configuration
+# -------------------
 
 # Rabbit connection info
-# In multi node devstack, second node needs RABBIT_USERID, but rabbit
+# In multi node DevStack, second node needs ``RABBIT_USERID``, but rabbit
 # isn't enabled.
 RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
 if is_service_enabled rabbit; then
@@ -623,6 +629,7 @@ fi
 
 
 # Keystone
+# --------
 
 if is_service_enabled keystone; then
     # The ``SERVICE_TOKEN`` is used to bootstrap the Keystone database.  It is
@@ -634,14 +641,14 @@ if is_service_enabled keystone; then
     read_password ADMIN_PASSWORD "ENTER A PASSWORD TO USE FOR HORIZON AND KEYSTONE (20 CHARS OR LESS)."
 
     # Keystone can now optionally install OpenLDAP by enabling the ``ldap``
-    # service in ``localrc`` (e.g. ``enable_service ldap``).
+    # service in ``local.conf`` (e.g. ``enable_service ldap``).
     # To clean out the Keystone contents in OpenLDAP set ``KEYSTONE_CLEAR_LDAP``
-    # to ``yes`` (e.g. ``KEYSTONE_CLEAR_LDAP=yes``) in ``localrc``.  To enable the
+    # to ``yes`` (e.g. ``KEYSTONE_CLEAR_LDAP=yes``) in ``local.conf``.  To enable the
     # Keystone Identity Driver (``keystone.identity.backends.ldap.Identity``)
     # set ``KEYSTONE_IDENTITY_BACKEND`` to ``ldap`` (e.g.
-    # ``KEYSTONE_IDENTITY_BACKEND=ldap``) in ``localrc``.
+    # ``KEYSTONE_IDENTITY_BACKEND=ldap``) in ``local.conf``.
 
-    # only request ldap password if the service is enabled
+    # Only request LDAP password if the service is enabled
     if is_service_enabled ldap; then
         read_password LDAP_PASSWORD "ENTER A PASSWORD TO USE FOR LDAP"
     fi
@@ -649,6 +656,7 @@ fi
 
 
 # Swift
+# -----
 
 if is_service_enabled s-proxy; then
     # We only ask for Swift Hash if we have enabled swift service.
@@ -672,14 +680,14 @@ fi
 echo_summary "Installing package prerequisites"
 source $TOP_DIR/tools/install_prereqs.sh
 
-# Configure an appropriate python environment
+# Configure an appropriate Python environment
 if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
-# Install python packages into a virtualenv so that we can track them
+# Install Python packages into a virtualenv so that we can track them
 if [[ $TRACK_DEPENDS = True ]]; then
     echo_summary "Installing Python packages into a virtualenv $DEST/.venv"
     pip_install -U virtualenv
@@ -728,10 +736,10 @@ echo_summary "Installing OpenStack project source"
 # Install required infra support libraries
 install_infra
 
-# Install oslo libraries that have graduated
+# Install Oslo libraries
 install_oslo
 
-# Install clients libraries
+# Install client libraries
 install_keystoneclient
 install_glanceclient
 install_cinderclient
@@ -749,7 +757,6 @@ fi
 # Install middleware
 install_keystonemiddleware
 
-
 if is_service_enabled keystone; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
         stack_install_service keystone
@@ -766,7 +773,7 @@ if is_service_enabled s-proxy; then
 
     # swift3 middleware to provide S3 emulation to Swift
     if is_service_enabled swift3; then
-        # replace the nova-objectstore port by the swift port
+        # Replace the nova-objectstore port by the swift port
         S3_SERVICE_PORT=8080
         git_clone $SWIFT3_REPO $SWIFT3_DIR $SWIFT3_BRANCH
         setup_develop $SWIFT3_DIR
@@ -774,23 +781,25 @@ if is_service_enabled s-proxy; then
 fi
 
 if is_service_enabled g-api n-api; then
-    # image catalog service
+    # Image catalog service
     stack_install_service glance
     configure_glance
 fi
 
 if is_service_enabled cinder; then
+    # Block volume service
     stack_install_service cinder
     configure_cinder
 fi
 
 if is_service_enabled neutron; then
+    # Network service
     stack_install_service neutron
     install_neutron_third_party
 fi
 
 if is_service_enabled nova; then
-    # compute service
+    # Compute service
     stack_install_service nova
     cleanup_nova
     configure_nova
@@ -822,18 +831,18 @@ if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
     configure_CA
     init_CA
     init_cert
-    # Add name to /etc/hosts
-    # don't be naive and add to existing line!
+    # Add name to ``/etc/hosts``.
+    # Don't be naive and add to existing line!
 fi
 
+
 # Extras Install
 # --------------
 
 # Phase: install
 run_phase stack install
 
-
-# install the OpenStack client, needed for most setup commands
+# Install the OpenStack client, needed for most setup commands
 if use_library_from_git "python-openstackclient"; then
     git_clone_by_name "python-openstackclient"
     setup_dev_lib "python-openstackclient"
@@ -841,7 +850,6 @@ else
     pip_install 'python-openstackclient>=1.0.2'
 fi
 
-
 if [[ $TRACK_DEPENDS = True ]]; then
     $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
     if ! diff -Nru $DEST/requires-pre-pip $DEST/requires-post-pip > $DEST/requires.diff; then
@@ -934,7 +942,7 @@ if [[ "$USE_SCREEN" == "True" ]]; then
     screen -r $SCREEN_NAME -X setenv PROMPT_COMMAND /bin/true
 fi
 
-# Clear screen rc file
+# Clear ``screenrc`` file
 SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
 if [[ -e $SCREENRC ]]; then
     rm -f $SCREENRC
@@ -943,14 +951,16 @@ fi
 # Initialize the directory for service status check
 init_service_check
 
+
+# Start Services
+# ==============
+
 # Dstat
-# -------
+# -----
 
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
-# Start Services
-# ==============
 
 # Keystone
 # --------
@@ -972,7 +982,7 @@ if is_service_enabled keystone; then
         SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v2.0
     fi
 
-    # Setup OpenStackclient token-flow auth
+    # Setup OpenStackClient token-endpoint auth
     export OS_TOKEN=$SERVICE_TOKEN
     export OS_URL=$SERVICE_ENDPOINT
 
@@ -994,10 +1004,10 @@ if is_service_enabled keystone; then
         create_heat_accounts
     fi
 
-    # Begone token-flow auth
+    # Begone token auth
     unset OS_TOKEN OS_URL
 
-    # Set up password-flow auth creds now that keystone is bootstrapped
+    # Set up password auth credentials now that Keystone is bootstrapped
     export OS_AUTH_URL=$SERVICE_ENDPOINT
     export OS_TENANT_NAME=admin
     export OS_USERNAME=admin
@@ -1042,7 +1052,7 @@ if is_service_enabled neutron; then
     echo_summary "Configuring Neutron"
 
     configure_neutron
-    # Run init_neutron only on the node hosting the neutron API server
+    # Run init_neutron only on the node hosting the Neutron API server
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled q-svc; then
         init_neutron
     fi
@@ -1118,6 +1128,7 @@ if is_service_enabled nova; then
     init_nova_cells
 fi
 
+
 # Extras Configuration
 # ====================
 
@@ -1128,7 +1139,7 @@ run_phase stack post-config
 # Local Configuration
 # ===================
 
-# Apply configuration from local.conf if it exists for layer 2 services
+# Apply configuration from ``local.conf`` if it exists for layer 2 services
 # Phase: post-config
 merge_config_group $TOP_DIR/local.conf post-config
 
@@ -1150,18 +1161,16 @@ if is_service_enabled glance; then
     start_glance
 fi
 
+
 # Install Images
 # ==============
 
-# Upload an image to glance.
+# Upload an image to Glance.
 #
-# The default image is cirros, a small testing image which lets you login as **root**
-# cirros has a ``cloud-init`` analog supporting login via keypair and sending
+# The default image is CirrOS, a small testing image which lets you login as **root**
+# CirrOS has a ``cloud-init`` analog supporting login via keypair and sending
 # scripts as userdata.
-# See https://help.ubuntu.com/community/CloudInit for more on cloud-init
-#
-# Override ``IMAGE_URLS`` with a comma-separated list of UEC images.
-#  * **precise**: http://uec-images.ubuntu.com/precise/current/precise-server-cloudimg-amd64.tar.gz
+# See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
 if is_service_enabled g-reg; then
     TOKEN=$(keystone token-get | grep ' id ' | get_field 2)
@@ -1179,7 +1188,7 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create an access key and secret key for nova ec2 register image
+# Create an access key and secret key for Nova EC2 register image
 if is_service_enabled keystone && is_service_enabled swift3 && is_service_enabled nova; then
     eval $(openstack ec2 credentials create --user nova --project $SERVICE_TENANT_NAME -f shell -c access -c secret)
     iniset $NOVA_CONF DEFAULT s3_access_key "$access"
@@ -1242,7 +1251,7 @@ if is_service_enabled ceilometer; then
     start_ceilometer
 fi
 
-# Configure and launch heat engine, api and metadata
+# Configure and launch Heat engine, api and metadata
 if is_service_enabled heat; then
     # Initialize heat
     echo_summary "Configuring Heat"
@@ -1287,30 +1296,34 @@ for i in BASE_SQL_CONN ENABLED_SERVICES HOST_IP LOGFILE \
 done
 
 
-# Local Configuration
-# ===================
+# Wrapup configuration
+# ====================
+
+# local.conf extra
+# ----------------
 
-# Apply configuration from local.conf if it exists for layer 2 services
+# Apply configuration from ``local.conf`` if it exists for layer 2 services
 # Phase: extra
 merge_config_group $TOP_DIR/local.conf extra
 
 
 # Run extras
-# ==========
+# ----------
 
 # Phase: extra
 run_phase stack extra
 
-# Local Configuration
-# ===================
 
-# Apply configuration from local.conf if it exists for layer 2 services
+# local.conf post-extra
+# ---------------------
+
+# Apply late configuration from ``local.conf`` if it exists for layer 2 services
 # Phase: post-extra
 merge_config_group $TOP_DIR/local.conf post-extra
 
 
 # Run local script
-# ================
+# ----------------
 
 # Run ``local.sh`` if it exists to perform user-managed tasks
 if [[ -x $TOP_DIR/local.sh ]]; then
@@ -1338,6 +1351,7 @@ if is_service_enabled cinder; then
     fi
 fi
 
+
 # Fin
 # ===
 
@@ -1354,11 +1368,12 @@ fi
 
 
 # Using the cloud
-# ---------------
+# ===============
 
 echo ""
 echo ""
 echo ""
+echo "This is your host ip: $HOST_IP"
 
 # If you installed Horizon on this server you should be able
 # to access the site using your browser.
@@ -1368,15 +1383,11 @@ fi
 
 # If Keystone is present you can point ``nova`` cli to this server
 if is_service_enabled keystone; then
-    echo "Keystone is serving at $KEYSTONE_SERVICE_URI/v2.0/"
-    echo "Examples on using novaclient command line is in exercise.sh"
+    echo "Keystone is serving at $KEYSTONE_SERVICE_URI/"
     echo "The default users are: admin and demo"
     echo "The password: $ADMIN_PASSWORD"
 fi
 
-# Echo ``HOST_IP`` - useful for ``build_uec.sh``, which uses dhcp to give the instance an address
-echo "This is your host ip: $HOST_IP"
-
 # Warn that a deprecated feature was used
 if [[ -n "$DEPRECATED_TEXT" ]]; then
     echo_summary "WARNING: $DEPRECATED_TEXT"
diff --git a/stackrc b/stackrc
index 143298c347..c27ead3c24 100644
--- a/stackrc
+++ b/stackrc
@@ -5,7 +5,7 @@
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 
-# Source required devstack functions and globals
+# Source required DevStack functions and globals
 source $RC_DIR/functions
 
 # Destination path for installation
@@ -41,20 +41,20 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 #  enable_service q-dhcp
 #  enable_service q-l3
 #  enable_service q-meta
-#  # Optional, to enable tempest configuration as part of devstack
+#  # Optional, to enable tempest configuration as part of DevStack
 #  enable_service tempest
 
-# this allows us to pass ENABLED_SERVICES
+# This allows us to pass ``ENABLED_SERVICES``
 if ! isset ENABLED_SERVICES ; then
-    # core compute (glance / keystone / nova (+ nova-network))
+    # Compute (Glance / Keystone / Nova (+ nova-network))
     ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-novnc,n-xvnc,n-cauth
-    # cinder
+    # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
-    # heat
+    # Heat
     ENABLED_SERVICES+=,h-eng,h-api,h-api-cfn,h-api-cw
-    # dashboard
+    # Dashboard
     ENABLED_SERVICES+=,horizon
-    # additional services
+    # Additional services
     ENABLED_SERVICES+=,rabbit,tempest,mysql
 fi
 
@@ -79,7 +79,7 @@ ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 # Tell Tempest which services are available.  The default is set here as
 # Tempest falls late in the configuration sequence.  This differs from
 # ``ENABLED_SERVICES`` in that the project names are used here rather than
-# the service names, i.e.: TEMPEST_SERVICES="key,glance,nova"
+# the service names, i.e.: ``TEMPEST_SERVICES="key,glance,nova"``
 TEMPEST_SERVICES=""
 
 # Set the default Nova APIs to enable
@@ -145,6 +145,7 @@ GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 #   but pass through any extras)
 REQUIREMENTS_MODE=${REQUIREMENTS_MODE:-strict}
 
+
 # Repositories
 # ------------
 
@@ -155,16 +156,17 @@ GIT_BASE=${GIT_BASE:-git://git.openstack.org}
 # Which libraries should we install from git instead of using released
 # versions on pypi?
 #
-# By default devstack is now installing libraries from pypi instead of
+# By default DevStack is now installing libraries from pypi instead of
 # from git repositories by default. This works great if you are
 # developing server components, but if you want to develop libraries
-# and see them live in devstack you need to tell devstack it should
+# and see them live in DevStack you need to tell DevStack it should
 # install them from git.
 #
 # ex: LIBS_FROM_GIT=python-keystoneclient,oslo.config
 #
 # Will install those 2 libraries from git, the rest from pypi.
 
+
 ##############
 #
 #  OpenStack Server Components
@@ -231,6 +233,7 @@ SWIFT_BRANCH=${SWIFT_BRANCH:-master}
 TROVE_REPO=${TROVE_REPO:-${GIT_BASE}/openstack/trove.git}
 TROVE_BRANCH=${TROVE_BRANCH:-master}
 
+
 ##############
 #
 #  Testing Components
@@ -306,6 +309,7 @@ GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
 # this doesn't exist in a lib file, so set it here
 GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
+
 ###################
 #
 #  Oslo Libraries
@@ -396,6 +400,7 @@ GITBRANCH["tooz"]=${TOOZ_BRANCH:-master}
 GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack-dev/pbr.git}
 GITBRANCH["pbr"]=${PBR_BRANCH:-master}
 
+
 ##################
 #
 #  Libraries managed by OpenStack programs (non oslo)
@@ -453,6 +458,7 @@ OCC_BRANCH=${OCC_BRANCH:-master}
 ORC_REPO=${ORC_REPO:-${GIT_BASE}/openstack/os-refresh-config.git}
 ORC_BRANCH=${ORC_BRANCH:-master}
 
+
 #################
 #
 #  3rd Party Components (non pip installable)
@@ -474,7 +480,6 @@ SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.gi
 SPICE_BRANCH=${SPICE_BRANCH:-master}
 
 
-
 # Nova hypervisor configuration.  We default to libvirt with **kvm** but will
 # drop back to **qemu** if we are unable to load the kvm module.  ``stack.sh`` can
 # also install an **LXC**, **OpenVZ** or **XenAPI** based system.  If xenserver-core
@@ -641,7 +646,7 @@ ENABLE_DEBUG_LOG_LEVEL=$(trueorfalse True ENABLE_DEBUG_LOG_LEVEL)
 
 # Set fixed and floating range here so we can make sure not to use addresses
 # from either range when attempting to guess the IP to use for the host.
-# Note that setting FIXED_RANGE may be necessary when running DevStack
+# Note that setting ``FIXED_RANGE`` may be necessary when running DevStack
 # in an OpenStack cloud that uses either of these address ranges internally.
 FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
 FIXED_RANGE=${FIXED_RANGE:-10.0.0.0/24}
@@ -669,9 +674,10 @@ LOG_COLOR=$(trueorfalse True LOG_COLOR)
 # Set to 0 to disable shallow cloning
 GIT_DEPTH=${GIT_DEPTH:-0}
 
-# Use native SSL for servers in SSL_ENABLED_SERVICES
+# Use native SSL for servers in ``SSL_ENABLED_SERVICES``
 USE_SSL=$(trueorfalse False USE_SSL)
 
+
 # Following entries need to be last items in file
 
 # Compatibility bits required by other callers like Grenade
@@ -693,7 +699,6 @@ USE_SSL=$(trueorfalse False USE_SSL)
 # For compat, if SCREEN_LOGDIR is set, it will be used to create back-compat symlinks to the LOGDIR
 # symlinks to SCREEN_LOGDIR (compat)
 
-
 # Set up new logging defaults
 if [[ -z "${LOGDIR:-}" ]]; then
     default_logdir=$DEST/logs
@@ -718,8 +723,8 @@ if [[ -z "${LOGDIR:-}" ]]; then
     unset default_logdir logfile
 fi
 
-# LOGDIR is always set at this point so it is not useful as a 'enable' for service logs
-# SCREEN_LOGDIR may be set, it is useful to enable the compat symlinks
+# ``LOGDIR`` is always set at this point so it is not useful as a 'enable' for service logs
+# ``SCREEN_LOGDIR`` may be set, it is useful to enable the compat symlinks
 
 # Local variables:
 # mode: shell-script
diff --git a/tools/build_docs.sh b/tools/build_docs.sh
index 2aa0a0ac04..fda86c05cd 100755
--- a/tools/build_docs.sh
+++ b/tools/build_docs.sh
@@ -2,8 +2,8 @@
 
 # **build_docs.sh** - Build the docs for DevStack
 #
-# - Install shocco if not found on PATH and INSTALL_SHOCCO is set
-# - Clone MASTER_REPO branch MASTER_BRANCH
+# - Install shocco if not found on ``PATH`` and ``INSTALL_SHOCCO`` is set
+# - Clone ``MASTER_REPO`` branch ``MASTER_BRANCH``
 # - Re-creates ``doc/build/html`` directory from existing repo + new generated script docs
 
 # Usage:
@@ -16,7 +16,7 @@
 
 HTML_BUILD=doc/build/html
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
 # Uses this shocco branch: https://github.com/dtroyer/shocco/tree/rst_support
diff --git a/tools/build_venv.sh b/tools/build_venv.sh
index 11d1d35208..cfa39a82e0 100755
--- a/tools/build_venv.sh
+++ b/tools/build_venv.sh
@@ -4,11 +4,12 @@
 #
 # build_venv.sh venv-path [package [...]]
 #
+# Installs basic common prereq packages that require compilation
+# to allow quick copying of resulting venv as a baseline
+#
 # Assumes:
 # - a useful pip is installed
 # - virtualenv will be installed by pip
-# - installs basic common prereq packages that require compilation
-#   to allow quick copying of resulting venv as a baseline
 
 
 VENV_DEST=${1:-.venv}
@@ -16,14 +17,14 @@ shift
 
 MORE_PACKAGES="$@"
 
-# If TOP_DIR is set we're being sourced rather than running stand-alone
+# If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
 # or in a sub-shell
 if [[ -z "$TOP_DIR" ]]; then
 
     set -o errexit
     set -o nounset
 
-    # Keep track of the devstack directory
+    # Keep track of the DevStack directory
     TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
     FILES=$TOP_DIR/files
 
diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
index f1740dfbd6..c57568fa64 100755
--- a/tools/build_wheels.sh
+++ b/tools/build_wheels.sh
@@ -4,21 +4,22 @@
 #
 # build_wheels.sh [package [...]]
 #
-# System package prerequisites listed in files/*/devlibs will be installed
+# System package prerequisites listed in ``files/*/devlibs`` will be installed
 #
 # Builds wheels for all virtual env requirements listed in
 # ``venv-requirements.txt`` plus any supplied on the command line.
 #
-# Assumes ``tools/install_pip.sh`` has been run and a suitable pip/setuptools is available.
+# Assumes:
+# - ``tools/install_pip.sh`` has been run and a suitable ``pip/setuptools`` is available.
 
-# If TOP_DIR is set we're being sourced rather than running stand-alone
+# If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
 # or in a sub-shell
 if [[ -z "$TOP_DIR" ]]; then
 
     set -o errexit
     set -o nounset
 
-    # Keep track of the devstack directory
+    # Keep track of the DevStack directory
     TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
     FILES=$TOP_DIR/files
 
@@ -59,7 +60,7 @@ virtualenv $TMP_VENV_PATH
 # Install modern pip and wheel
 PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install -U pip wheel
 
-# VENV_PACKAGES is a list of packages we want to pre-install
+# ``VENV_PACKAGES`` is a list of packages we want to pre-install
 VENV_PACKAGE_FILE=$FILES/venv-requirements.txt
 if [[ -r $VENV_PACKAGE_FILE ]]; then
     VENV_PACKAGES=$(grep -v '^#' $VENV_PACKAGE_FILE)
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index 9c29ecd901..b49164b22a 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -17,7 +17,7 @@
 
 set -o errexit
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
 # Import common functions
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f8edd16ecd..2efb4e0987 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -17,7 +17,7 @@
 #   - uninstall firewalld (f20 only)
 
 
-# If TOP_DIR is set we're being sourced rather than running stand-alone
+# If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
 # or in a sub-shell
 if [[ -z "$TOP_DIR" ]]; then
     set -o errexit
@@ -27,7 +27,7 @@ if [[ -z "$TOP_DIR" ]]; then
     TOOLS_DIR=$(cd $(dirname "$0") && pwd)
     TOP_DIR=$(cd $TOOLS_DIR/..; pwd)
 
-    # Change dir to top of devstack
+    # Change dir to top of DevStack
     cd $TOP_DIR
 
     # Import common functions
@@ -38,7 +38,7 @@ fi
 
 # Keystone Port Reservation
 # -------------------------
-# Reserve and prevent $KEYSTONE_AUTH_PORT and $KEYSTONE_AUTH_PORT_INT from
+# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
 # being used as ephemeral ports by the system. The default(s) are 35357 and
 # 35358 which are in the Linux defined ephemeral port range (in disagreement
 # with the IANA ephemeral port range). This is a workaround for bug #1253482
@@ -47,9 +47,9 @@ fi
 # exception into the Kernel for the Keystone AUTH ports.
 keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
 
-# only do the reserved ports when available, on some system (like containers)
+# Only do the reserved ports when available, on some system (like containers)
 # where it's not exposed we are almost pretty sure these ports would be
-# exclusive for our devstack.
+# exclusive for our DevStack.
 if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
     # Get any currently reserved ports, strip off leading whitespace
     reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
@@ -59,7 +59,7 @@ if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
         sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
     else
         # If there are currently reserved ports, keep those and also reserve the
-        # keystone specific ports. Duplicate reservations are merged into a single
+        # Keystone specific ports. Duplicate reservations are merged into a single
         # reservation (or range) automatically by the kernel.
         sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
     fi
diff --git a/tools/image_list.sh b/tools/image_list.sh
index 88c1d09379..204280704e 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
 source $TOP_DIR/functions
diff --git a/tools/info.sh b/tools/info.sh
index a8f9544073..433206e8ae 100755
--- a/tools/info.sh
+++ b/tools/info.sh
@@ -2,7 +2,7 @@
 
 # **info.sh**
 
-# Produce a report on the state of devstack installs
+# Produce a report on the state of DevStack installs
 #
 # Output fields are separated with '|' chars
 # Output types are git,localrc,os,pip,pkg:
@@ -14,7 +14,7 @@
 #   pkg|<package>|<version>
 
 function usage {
-    echo "$0 - Report on the devstack configuration"
+    echo "$0 - Report on the DevStack configuration"
     echo ""
     echo "Usage: $0"
     exit 1
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index b7b40c7486..0f7c962b2b 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -16,7 +16,7 @@ set -o xtrace
 TOOLS_DIR=$(cd $(dirname "$0") && pwd)
 TOP_DIR=`cd $TOOLS_DIR/..; pwd`
 
-# Change dir to top of devstack
+# Change dir to top of DevStack
 cd $TOP_DIR
 
 # Import common functions
@@ -42,11 +42,11 @@ function get_versions {
 
 
 function install_get_pip {
-    # the openstack gate and others put a cached version of get-pip.py
+    # The OpenStack gate and others put a cached version of get-pip.py
     # for this to find, explicitly to avoid download issues.
     #
-    # However, if devstack *did* download the file, we want to check
-    # for updates; people can leave thier stacks around for a long
+    # However, if DevStack *did* download the file, we want to check
+    # for updates; people can leave their stacks around for a long
     # time and in the mean-time pip might get upgraded.
     #
     # Thus we use curl's "-z" feature to always check the modified
@@ -74,7 +74,7 @@ function configure_pypi_alternative_url {
         touch $PIP_CONFIG_FILE
     fi
     if ! ini_has_option "$PIP_CONFIG_FILE" "global" "index-url"; then
-        #it means that the index-url does not exist
+        # It means that the index-url does not exist
         iniset "$PIP_CONFIG_FILE" "global" "index-url" "$PYPI_OVERRIDE"
     fi
 
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 917980ccc5..a07e58d3e6 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -18,10 +18,10 @@ while getopts ":f" opt; do
     esac
 done
 
-# If TOP_DIR is set we're being sourced rather than running stand-alone
+# If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
 # or in a sub-shell
 if [[ -z "$TOP_DIR" ]]; then
-    # Keep track of the devstack directory
+    # Keep track of the DevStack directory
     TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
     # Import common functions
@@ -65,7 +65,7 @@ PACKAGES=$(get_packages general $ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"
 
 if is_ubuntu && echo $PACKAGES | grep -q dkms ; then
-    # ensure headers for the running kernel are installed for any DKMS builds
+    # Ensure headers for the running kernel are installed for any DKMS builds
     PACKAGES="$PACKAGES linux-headers-$(uname -r)"
 fi
 
diff --git a/tools/ironic/scripts/create-node b/tools/ironic/scripts/create-node
index 25b53d47f3..b018acddc9 100755
--- a/tools/ironic/scripts/create-node
+++ b/tools/ironic/scripts/create-node
@@ -6,13 +6,13 @@
 
 set -ex
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
 NAME=$1
 CPU=$2
 MEM=$(( 1024 * $3 ))
-# extra G to allow fuzz for partition table : flavor size and registered size
+# Extra G to allow fuzz for partition table : flavor size and registered size
 # need to be different to actual size.
 DISK=$(( $4 + 1))
 
diff --git a/tools/ironic/scripts/setup-network b/tools/ironic/scripts/setup-network
index e326bf8ccd..83308ed416 100755
--- a/tools/ironic/scripts/setup-network
+++ b/tools/ironic/scripts/setup-network
@@ -9,7 +9,7 @@ set -exu
 
 LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
 
-# Keep track of the devstack directory
+# Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 BRIDGE_SUFFIX=${1:-''}
 BRIDGE_NAME=brbm$BRIDGE_SUFFIX
@@ -19,7 +19,7 @@ export VIRSH_DEFAULT_CONNECT_URI="$LIBVIRT_CONNECT_URI"
 # Only add bridge if missing
 (sudo ovs-vsctl list-br | grep ${BRIDGE_NAME}$) || sudo ovs-vsctl add-br ${BRIDGE_NAME}
 
-# remove bridge before replacing it.
+# Remove bridge before replacing it.
 (virsh net-list | grep "${BRIDGE_NAME} ") && virsh net-destroy ${BRIDGE_NAME}
 (virsh net-list --inactive  | grep "${BRIDGE_NAME} ") && virsh net-undefine ${BRIDGE_NAME}
 
diff --git a/tools/outfilter.py b/tools/outfilter.py
index 9686a387c2..f82939be1d 100755
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -14,8 +14,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-# This is an output filter to filter and timestamp the logs from grenade and
-# devstack. Largely our awk filters got beyond the complexity level which were
+# This is an output filter to filter and timestamp the logs from Grenade and
+# DevStack. Largely our awk filters got beyond the complexity level which were
 # sustainable, so this provides us much more control in a single place.
 #
 # The overhead of running python should be less than execing `date` a million
@@ -32,7 +32,7 @@
 
 def get_options():
     parser = argparse.ArgumentParser(
-        description='Filter output by devstack and friends')
+        description='Filter output by DevStack and friends')
     parser.add_argument('-o', '--outfile',
                         help='Output file for content',
                         default=None)
@@ -52,7 +52,7 @@ def main():
     if opts.outfile:
         outfile = open(opts.outfile, 'a', 0)
 
-    # otherwise fileinput reprocess args as files
+    # Otherwise fileinput reprocess args as files
     sys.argv = []
     while True:
         line = sys.stdin.readline()
@@ -63,9 +63,9 @@ def main():
         if skip_line(line):
             continue
 
-        # this prevents us from nesting date lines, because
-        # we'd like to pull this in directly in grenade and not double
-        # up on devstack lines
+        # This prevents us from nesting date lines, because
+        # we'd like to pull this in directly in Grenade and not double
+        # up on DevStack lines
         if HAS_DATE.search(line) is None:
             now = datetime.datetime.utcnow()
             line = ("%s | %s" % (
diff --git a/unstack.sh b/unstack.sh
index c45af7400c..30981fd3c6 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -19,7 +19,7 @@ while getopts ":a" opt; do
     esac
 done
 
-# Keep track of the current devstack directory.
+# Keep track of the current DevStack directory.
 TOP_DIR=$(cd $(dirname "$0") && pwd)
 FILES=$TOP_DIR/files
 

From 32d6bc6ad1f5d857c8e34e15001f8eb8666c601c Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sun, 29 Mar 2015 14:16:44 -0500
Subject: [PATCH 0505/3333] Add inc/rootwrap

Rootwrap shouldn't be a unique snowflake.  Plus the binaries tend
to be called assuming PATH will find them.  Not so with venvs
so we need to work around that brokenness.

Configure Cinder and Nova to use configure_rootwrap().

Change-Id: I8ee1f66014875caf20a2d14ff6ef3672673ba85a
---
 functions    |  1 +
 inc/rootwrap | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/cinder   | 38 +-------------------------
 lib/nova     | 38 +-------------------------
 4 files changed, 80 insertions(+), 74 deletions(-)
 create mode 100644 inc/rootwrap

diff --git a/functions b/functions
index 5bc8456281..4dc20e7f23 100644
--- a/functions
+++ b/functions
@@ -15,6 +15,7 @@ FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source ${FUNC_DIR}/functions-common
 source ${FUNC_DIR}/inc/ini-config
 source ${FUNC_DIR}/inc/python
+source ${FUNC_DIR}/inc/rootwrap
 
 # Save trace setting
 XTRACE=$(set +o | grep xtrace)
diff --git a/inc/rootwrap b/inc/rootwrap
new file mode 100644
index 0000000000..bac8e1e86c
--- /dev/null
+++ b/inc/rootwrap
@@ -0,0 +1,77 @@
+#!/bin/bash
+#
+# **inc/rootwrap** - Rootwrap functions
+#
+# Handle rootwrap's foibles
+
+# Uses: ``STACK_USER``
+# Defines: ``SUDO_SECURE_PATH_FILE``
+
+# Save trace setting
+INC_ROOT_TRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+# Accumulate all additions to sudo's ``secure_path`` in one file read last
+# so they all work in a venv configuration
+SUDO_SECURE_PATH_FILE=${SUDO_SECURE_PATH_FILE:-/etc/sudoers.d/zz-secure-path}
+
+# Add a directory to the common sudo ``secure_path``
+# add_sudo_secure_path dir
+function add_sudo_secure_path {
+    local dir=$1
+    local line
+
+    # This is pretty simplistic for now - assume only the first line is used
+    if [[ -r SUDO_SECURE_PATH_FILE ]]; then
+        line=$(head -1 $SUDO_SECURE_PATH_FILE)
+    else
+        line="Defaults:$STACK_USER secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin"
+    fi
+
+    # Only add ``dir`` if it is not already present
+    if [[ $line =~ $dir ]]; then
+        echo "${line}:$dir" | sudo tee $SUDO_SECURE_PATH_FILE
+        sudo chmod 400 $SUDO_SECURE_PATH_FILE
+        sudo chown root:root $SUDO_SECURE_PATH_FILE
+    fi
+}
+
+# Configure rootwrap
+# Make a load of assumptions otherwise we'll have 6 arguments
+# configure_rootwrap project bin conf-src-dir
+function configure_rootwrap {
+    local project=$1                    # xx
+    local rootwrap_bin=$2               # /opt/stack/xx.venv/bin/xx-rootwrap
+    local rootwrap_conf_src_dir=$3      # /opt/stack/xx/etc/xx
+
+    # Start fresh with rootwrap filters
+    sudo rm -rf /etc/${project}/rootwrap.d
+    sudo install -d -o root -g root -m 755 /etc/${project}/rootwrap.d
+    sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.d/*.filters /etc/${project}/rootwrap.d
+
+    # Set up rootwrap.conf, pointing to /etc/*/rootwrap.d
+    sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.conf /etc/${project}/rootwrap.conf
+    sudo sed -e "s:^filters_path=.*$:filters_path=/etc/${project}/rootwrap.d:" -i /etc/${project}/rootwrap.conf
+
+    # Specify rootwrap.conf as first parameter to rootwrap
+    rootwrap_sudo_cmd="$rootwrap_bin /etc/${project}/rootwrap.conf *"
+
+    # Set up the rootwrap sudoers
+    local tempfile=$(mktemp)
+    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudo_cmd" >$tempfile
+    chmod 0440 $tempfile
+    sudo chown root:root $tempfile
+    sudo mv $tempfile /etc/sudoers.d/${project}-rootwrap
+
+    # Add bin dir to sudo's secure_path because rootwrap is being called
+    # without a path because BROKEN.
+    add_sudo_secure_path $(dirname $rootwrap_bin)
+}
+
+
+# Restore xtrace
+$INC_ROOT_TRACE
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/cinder b/lib/cinder
index 27fd692292..de41bc5f79 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -171,42 +171,6 @@ function cleanup_cinder {
     fi
 }
 
-# Deploy new rootwrap filters files and configure sudo
-# configure_cinder_rootwrap() - configure Cinder's rootwrap
-function configure_cinder_rootwrap {
-    local cinder_rootwrap=$CINDER_BIN_DIR/cinder-rootwrap
-
-    # Wipe any existing rootwrap.d files first
-    if [[ -d $CINDER_CONF_DIR/rootwrap.d ]]; then
-        sudo rm -rf $CINDER_CONF_DIR/rootwrap.d
-    fi
-
-    # Deploy filters to /etc/cinder/rootwrap.d
-    sudo install -d -o root -g root -m 755 $CINDER_CONF_DIR/rootwrap.d
-    sudo install -o root -g root -m 644 $CINDER_DIR/etc/cinder/rootwrap.d/*.filters $CINDER_CONF_DIR/rootwrap.d
-
-    # Set up rootwrap.conf, pointing to /etc/cinder/rootwrap.d
-    sudo install -o root -g root -m 644 $CINDER_DIR/etc/cinder/rootwrap.conf $CINDER_CONF_DIR
-    sudo sed -e "s:^filters_path=.*$:filters_path=$CINDER_CONF_DIR/rootwrap.d:" -i $CINDER_CONF_DIR/rootwrap.conf
-
-    # Specify rootwrap.conf as first parameter to rootwrap
-    ROOTWRAP_CSUDOER_CMD="$cinder_rootwrap $CINDER_CONF_DIR/rootwrap.conf *"
-
-    # Set up the rootwrap sudoers for cinder
-    local tempfile=`mktemp`
-    echo "Defaults:$STACK_USER secure_path=$CINDER_BIN_DIR:/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >$tempfile
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_CSUDOER_CMD" >>$tempfile
-    chmod 0440 $tempfile
-    sudo chown root:root $tempfile
-    sudo mv $tempfile /etc/sudoers.d/cinder-rootwrap
-
-    # So rootwrap and PATH are broken beyond belief.  WTF relies on a SECURE operation
-    # to blindly follow PATH???  We learned that was a bad idea in the 80's!
-    # So to fix this in a venv, we must exploit the very hole we want to close by dropping
-    # a copy of the venv rootwrap binary into /usr/local/bin.
-    #sudo cp -p $cinder_rootwrap /usr/local/bin
-}
-
 # configure_cinder() - Set config files, create data dirs, etc
 function configure_cinder {
     sudo install -d -o $STACK_USER -m 755 $CINDER_CONF_DIR
@@ -215,7 +179,7 @@ function configure_cinder {
 
     rm -f $CINDER_CONF
 
-    configure_cinder_rootwrap
+    configure_rootwrap cinder $CINDER_BIN_DIR/cinder-rootwrap $CINDER_DIR/etc/cinder
 
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI
 
diff --git a/lib/nova b/lib/nova
index 385da4e44b..807dfceeae 100644
--- a/lib/nova
+++ b/lib/nova
@@ -223,42 +223,6 @@ function cleanup_nova {
     #fi
 }
 
-# Deploy new rootwrap filters files and configure sudo
-# configure_nova_rootwrap() - configure Nova's rootwrap
-function configure_nova_rootwrap {
-    nova_rootwrap=$NOVA_BIN_DIR/nova-rootwrap
-
-    # Wipe any existing rootwrap.d files first
-    if [[ -d $NOVA_CONF_DIR/rootwrap.d ]]; then
-        sudo rm -rf $NOVA_CONF_DIR/rootwrap.d
-    fi
-
-    # Deploy filters to /etc/nova/rootwrap.d
-    sudo install -d -o root -g root -m 755 $NOVA_CONF_DIR/rootwrap.d
-    sudo install -o root -g root -m 644  $NOVA_DIR/etc/nova/rootwrap.d/*.filters $NOVA_CONF_DIR/rootwrap.d
-
-    # Set up rootwrap.conf, pointing to /etc/nova/rootwrap.d
-    sudo install -o root -g root -m 644 $NOVA_DIR/etc/nova/rootwrap.conf $NOVA_CONF_DIR
-    sudo sed -e "s:^filters_path=.*$:filters_path=$NOVA_CONF_DIR/rootwrap.d:" -i $NOVA_CONF_DIR/rootwrap.conf
-
-    # Specify rootwrap.conf as first parameter to nova-rootwrap
-    local rootwrap_sudoer_cmd="$nova_rootwrap $NOVA_CONF_DIR/rootwrap.conf *"
-
-    # Set up the rootwrap sudoers for nova
-    local tempfile=`mktemp`
-    echo "Defaults:$STACK_USER secure_path=$NOVA_BIN_DIR:/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >$tempfile
-    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd" >>$tempfile
-    chmod 0440 $tempfile
-    sudo chown root:root $tempfile
-    sudo mv $tempfile /etc/sudoers.d/nova-rootwrap
-
-    # So rootwrap and PATH are broken beyond belief.  WTF relies on a SECURE operation
-    # to blindly follow PATH???  We learned that was a bad idea in the 80's!
-    # So to fix this in a venv, we must exploit the very hole we want to close by dropping
-    # a copy of the venv rootwrap binary into /usr/local/bin.
-    #sudo cp -p $nova_rootwrap /usr/local/bin
-}
-
 # configure_nova() - Set config files, create data dirs, etc
 function configure_nova {
     # Put config files in ``/etc/nova`` for everyone to find
@@ -266,7 +230,7 @@ function configure_nova {
 
     install_default_policy nova
 
-    configure_nova_rootwrap
+    configure_rootwrap nova $NOVA_BIN_DIR/nova-rootwrap $NOVA_DIR/etc/nova
 
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
         # Get the sample configuration file in place

From e929fdd47e31919bb8e30d2300e3c8e43b1bb9cc Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Mon, 30 Mar 2015 15:11:11 +1100
Subject: [PATCH 0506/3333] Remove keystone public/admin_endpoint options

The public_endpoint and admin_endpoint options are used to set the base
hostname when listing versions. If they are not provided then the
response will use the same hostname as the request was made with - which
is almost always what you actually want.

This means devstack will respond correctly to a version list when behind
a floating IP for example.

Change-Id: Idc48b9d7bee9751deb24d730fdc560b163f39dfe
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1e39ab6bc2..1d12583b42 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -237,9 +237,6 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
-    # Set the URL advertised in the ``versions`` structure returned by the '/' route
-    iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/"
-    iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/"
     iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
 
     # Register SSL certificates if provided

From 5f2eb6dade5f3b19b8905b97d8e4018b5e068321 Mon Sep 17 00:00:00 2001
From: James Polley <jp@jamezpolley.com>
Date: Mon, 30 Mar 2015 17:36:26 +1100
Subject: [PATCH 0507/3333] Add a target for, and link to, minimal config docs

Reading through the docs for the first time, the reader encounters an
instruction to provide a minimal configuration, with a link that they'd
expect to tell them how to do this.

At present the link actually takes them to the top of
configuration.html, where they read some history about how devstack's
configuration has changed over time.

This is interesting and important and should be in the docs - but in my
opinion a link about setting up a minimal configuration would be more
useful if it takes me to a place that tells them about a minimal
configuration.

To get this, I've had to an an explicit link target into
configuration.rst. I'm not hugely keen on this approach, as I don't
think it scales well. I'd be open to suggestions about other
approaches. The only idea I've had so far though is to simply move the
minimal configuration section right to the top of the page, so that a
link to the doc is a link to the minimal config - the historical
information could be moved to its own topic somewhere further down the doc.

Change-Id: I231ca1b7f17b55f09a4e058dab8ee433893f737e
---
 doc/source/configuration.rst | 2 ++
 doc/source/index.rst         | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index a0d0840263..1cc7083bb4 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -95,6 +95,8 @@ Also note that the ``localrc`` section is sourced as a shell script
 fragment and MUST conform to the shell requirements, specifically no
 whitespace around ``=`` (equals).
 
+.. _minimal-configuration:
+
 Minimal Configuration
 =====================
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index c31287cd57..4435b495ae 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -41,8 +41,7 @@ Quick Start
 
 #. Configure
 
-   We recommend at least a :doc:`minimal
-   configuration <configuration>` be set up.
+   We recommend at least a :ref:`minimal-configuration` be set up.
 
 #. Start the install
 

From 0c04c12b3f91638560544e2b56a2994ac8015557 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 30 Mar 2015 18:15:19 +0200
Subject: [PATCH 0508/3333] Swift PyEClib build requires 'make'

PyEClib was introduced recently to swift-master. It tries
to build liberasurecode which requires the `make` binary.

Change-Id: I8acfed4f7b46a29eac36f6acbe1d66e7fff800db
---
 files/debs/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/swift b/files/debs/swift
index b32b43985a..0089d27fee 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -1,4 +1,5 @@
 curl
+make
 memcached
 # NOTE python-nose only exists because of swift functional job, we should probably
 # figure out a more consistent way of installing this from test-requirements.txt instead

From 206c596d693d429cbbfa738e4e0a397c646d77c1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 30 Mar 2015 13:56:11 -0400
Subject: [PATCH 0509/3333] add back python-guestfs

This is needed otherwise we fall back to the nbd code path which is
super hacky. This shouldn't have been deleted for the venv path.

Change-Id: If5cb6cb4944bd0ed3548d53c98443b76725d1c0c
---
 lib/nova_plugins/functions-libvirt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 60707cf859..edcf73ebe2 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,13 +24,13 @@ function install_libvirt {
         install_package libvirt-bin libvirt-dev
         pip_install libvirt-python
         install_package libguestfs0
-        #install_package python-guestfs
+        install_package python-guestfs
         #pip_install <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm
         install_package libvirt libvirt-devel
         pip_install libvirt-python
-        #install_package python-libguestfs
+        install_package python-libguestfs
     fi
 
     # Restart firewalld after install of libvirt to avoid a problem

From 84ee55b3ee3630945792fa849d793a6d71d2364d Mon Sep 17 00:00:00 2001
From: Adam Gandelman <adamg@ubuntu.com>
Date: Mon, 30 Mar 2015 14:25:27 -0700
Subject: [PATCH 0510/3333] Set fixed_network_name in Tempest config

This previously defatuled to 'private' and aligned with devstack's
defaults but it has since been updated to 'None'.  This sets the config
value according to devstack's.

Change-Id: I3f480d5480521a93992bedfe602eb20a4999263d
Closes-bug: #1438415
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index b3a4c7b6e3..3f33512cf6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -331,6 +331,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
+    iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
 
     # Compute Features
     # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints

From f3d52335e728995209feec1c9813d341c2690cb7 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 28 Mar 2015 10:14:47 -0500
Subject: [PATCH 0511/3333] Add basic Makefile

There are a couple of targets in here that some might find useful in
doing DevStack testing in multiple remote VMs.

There are some of the usual boring targets too, like stack and unstack,
that do exactly what you would expect.

Change-Id: I7974cac4cc527bacf6f183ac1f344428b05f2fdc
---
 Makefile | 104 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)
 create mode 100644 Makefile

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000000..082aff21d2
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,104 @@
+# DevStack Makefile of Sanity
+
+# Interesting targets:
+# ds-remote - Create a Git remote for use by ds-push and ds-pull targets
+#             DS_REMOTE_URL must be set on the command line
+#
+# ds-push - Merge a list of branches taken from .ds-test and push them
+#           to the ds-remote repo in ds-test branch
+#
+# ds-pull - Pull the remote ds-test branch into a fresh local branch
+#
+# refresh - Performs a sequence of unstack, refresh and stack
+
+# Duplicated from stackrc for now
+DEST=/opt/stack
+WHEELHOUSE=$(DEST)/.wheelhouse
+
+all:
+	echo "This just saved you from a terrible mistake!"
+
+# Do Some Work
+stack:
+	./stack.sh
+
+unstack:
+	./unstack.sh
+
+wheels:
+	WHEELHOUSE=$(WHEELHOUSE) tools/build-wheels.sh
+
+docs:
+	tox -edocs
+
+# Just run the shocco source formatting build
+docs-build:
+	INSTALL_SHOCCO=True tools/build_docs.sh
+
+# Just run the Sphinx docs build
+docs-rst:
+	python setup.py build_sphinx
+
+# Run the bashate test
+bashate:
+	tox -ebashate
+
+# Run the function tests
+test:
+	tests/test_ini_config.sh
+	tests/test_meta_config.sh
+	tests/test_ip.sh
+	tests/test_refs.sh
+
+# Spiff up the place a bit
+clean:
+	./clean.sh
+	rm -rf accrc doc/build test*-e *.egg-info
+
+# Clean out the cache too
+realclean: clean
+	rm -rf files/cirros*.tar.gz files/Fedora*.qcow2 $(WHEELHOUSE)
+
+# Repo stuffs
+
+pull:
+	git pull
+
+
+# These repo targets are used to maintain a branch in a remote repo that
+# consists of one or more local branches merged and pushed to the remote.
+# This is most useful for iterative testing on multiple or remote servers
+# while keeping the working repo local.
+#
+# It requires:
+# * a remote pointing to a remote repo, often GitHub is used for this
+# * a branch name to be used on the remote
+# * a local file containing the list of local branches to be merged into
+#   the remote branch
+
+GIT_REMOTE_NAME=ds-test
+GIT_REMOTE_BRANCH=ds-test
+
+# Push the current branch to a remote named ds-test
+ds-push:
+	git checkout master
+	git branch -D $(GIT_REMOTE_BRANCH) || true
+	git checkout -b $(GIT_REMOTE_BRANCH)
+	for i in $(shell cat .$(GIT_REMOTE_BRANCH) | grep -v "^#" | grep "[^ ]"); do \
+	  git merge --no-edit $$i; \
+	done
+	git push -f $(GIT_REMOTE_NAME) HEAD:$(GIT_REMOTE_BRANCH)
+
+# Pull the ds-test branch
+ds-pull:
+	git checkout master
+	git branch -D $(GIT_REMOTE_BRANCH) || true
+	git pull $(GIT_REMOTE_NAME) $(GIT_REMOTE_BRANCH)
+	git checkout $(GIT_REMOTE_BRANCH)
+
+# Add the remote - set DS_REMOTE_URL=htps://example.com/ on the command line
+ds-remote:
+	git remote add $(GIT_REMOTE_NAME) $(DS_REMOTE_URL)
+
+# Refresh the current DevStack checkout nd re-initialize
+refresh: unstack ds-pull stack

From ae7b4f9b9e811f2c0abfb4f7f4e85dd91ca1c2b3 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Tue, 31 Mar 2015 20:49:15 +0200
Subject: [PATCH 0512/3333] functions-libvirt: Enable 'qemu_monitor' logging
 filter for libvirt

A lot of libvirt interactions with QEMU are via the QEMU monitor
console, which allows you to either query or modify the state of a
virtual machine. Spefici examples include: querying the status of live
block operations, live snapshot operations, live migration, etc.

Enabling the 'qemu_monitor' log filter allows us to capture precisely
what commands libvirt is sending to QEMU.

Note that the log level was intentionally set to '1' (i.e. debug) for
this specific filter, because (a) it's not extremely verbose, (b) when
something breaks, it's helpful to have the exact sequence of
interactions between libvirt and QEMU.

Change-Id: Iba95b6bd7c9f197c8d48c7d978f538e50d4e31fa
---
 lib/nova_plugins/functions-libvirt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index edcf73ebe2..05ef605b04 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -99,9 +99,9 @@ EOF
             # source file paths, not relative paths. This screws with the matching
             # of '1:libvirt' making everything turn on. So use libvirt.c for now.
             # This will have to be re-visited when Ubuntu ships libvirt >= 1.2.3
-            local log_filters="1:libvirt.c 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util"
+            local log_filters="1:libvirt.c 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
         else
-            local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util"
+            local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
         fi
         local log_outputs="1:file:/var/log/libvirt/libvirtd.log"
         if ! grep -q "log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then

From edd60481682bf2cca061f94f113835922cd79709 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 27 Mar 2015 09:19:57 -0700
Subject: [PATCH 0513/3333] Update libvirt cpu map before starting nova

We are trying to get a working 64bit qemu cpu model in the gate for nova
live migration testing. It appears that we need to make this change
prior to nova starting.

Make the change in configure_libvirt() to handle this along with the
other libvirt config updates. This allows us to restart the libvirt
service once. This function calls a python tool which parses and updates
the XML if necessary.

Change-Id: I00667713bfba67ab8cedbcb1660ff94d4f4bcc07
---
 lib/nova_plugins/functions-libvirt | 12 +++-
 tools/cpu_map_update.py            | 89 ++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+), 2 deletions(-)
 create mode 100755 tools/cpu_map_update.py

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4d617e8b5e..763afaf596 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -110,10 +110,18 @@ EOF
         fi
     fi
 
+    # Update the libvirt cpu map with a gate64 cpu model. This enables nova
+    # live migration for 64bit guest OSes on heterogenous cloud "hardware".
+    if [[ -f /usr/share/libvirt/cpu_map.xml ]] ; then
+        sudo $TOP_DIR/tools/cpu_map_update.py /usr/share/libvirt/cpu_map.xml
+    fi
+
     # libvirt detects various settings on startup, as we potentially changed
     # the system configuration (modules, filesystems), we need to restart
-    # libvirt to detect those changes.
-    restart_service $LIBVIRT_DAEMON
+    # libvirt to detect those changes. Use a stop start as otherwise the new
+    # cpu_map is not loaded properly on some systems (Ubuntu).
+    stop_service $LIBVIRT_DAEMON
+    start_service $LIBVIRT_DAEMON
 }
 
 
diff --git a/tools/cpu_map_update.py b/tools/cpu_map_update.py
new file mode 100755
index 0000000000..1938793114
--- /dev/null
+++ b/tools/cpu_map_update.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This small script updates the libvirt CPU map to add a gate64 cpu model
+# that can be used to enable a common 64bit capable feature set across
+# devstack nodes so that features like nova live migration work.
+
+import sys
+import xml.etree.ElementTree as ET
+from xml.dom import minidom
+
+
+def update_cpu_map(tree):
+    root = tree.getroot()
+    cpus = root#.find("cpus")
+    x86 = None
+    for arch in cpus.findall("arch"):
+        if arch.get("name") == "x86":
+            x86 = arch
+            break
+    if x86 is not None:
+        # Create a gate64 cpu model that is core2duo less monitor and pse36
+        gate64 = ET.SubElement(x86, "model")
+        gate64.set("name", "gate64")
+        ET.SubElement(gate64, "vendor").set("name", "Intel")
+        ET.SubElement(gate64, "feature").set("name", "fpu")
+        ET.SubElement(gate64, "feature").set("name", "de")
+        ET.SubElement(gate64, "feature").set("name", "pse")
+        ET.SubElement(gate64, "feature").set("name", "tsc")
+        ET.SubElement(gate64, "feature").set("name", "msr")
+        ET.SubElement(gate64, "feature").set("name", "pae")
+        ET.SubElement(gate64, "feature").set("name", "mce")
+        ET.SubElement(gate64, "feature").set("name", "cx8")
+        ET.SubElement(gate64, "feature").set("name", "apic")
+        ET.SubElement(gate64, "feature").set("name", "sep")
+        ET.SubElement(gate64, "feature").set("name", "pge")
+        ET.SubElement(gate64, "feature").set("name", "cmov")
+        ET.SubElement(gate64, "feature").set("name", "pat")
+        ET.SubElement(gate64, "feature").set("name", "mmx")
+        ET.SubElement(gate64, "feature").set("name", "fxsr")
+        ET.SubElement(gate64, "feature").set("name", "sse")
+        ET.SubElement(gate64, "feature").set("name", "sse2")
+        ET.SubElement(gate64, "feature").set("name", "vme")
+        ET.SubElement(gate64, "feature").set("name", "mtrr")
+        ET.SubElement(gate64, "feature").set("name", "mca")
+        ET.SubElement(gate64, "feature").set("name", "clflush")
+        ET.SubElement(gate64, "feature").set("name", "pni")
+        ET.SubElement(gate64, "feature").set("name", "nx")
+        ET.SubElement(gate64, "feature").set("name", "ssse3")
+        ET.SubElement(gate64, "feature").set("name", "syscall")
+        ET.SubElement(gate64, "feature").set("name", "lm")
+
+
+def format_xml(root):
+    # Adapted from http://pymotw.com/2/xml/etree/ElementTree/create.html
+    # thank you dhellmann
+    rough_string = ET.tostring(root, encoding="UTF-8")
+    dom_parsed = minidom.parseString(rough_string)
+    return dom_parsed.toprettyxml("  ", encoding="UTF-8")
+
+
+def main():
+    if len(sys.argv) != 2:
+        raise Exception("Must pass path to cpu_map.xml to update")
+    cpu_map = sys.argv[1]
+    tree = ET.parse(cpu_map)
+    for model in tree.getroot().iter("model"):
+        if model.get("name") == "gate64":
+            # gate64 model is already present
+            return
+    update_cpu_map(tree)
+    pretty_xml = format_xml(tree.getroot())
+    with open(cpu_map, 'w') as f:
+        f.write(pretty_xml)
+
+
+if __name__ == "__main__":
+    main()

From d3cfb82c65ae7f85b9d92e1245b1d81792a5641b Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 1 Apr 2015 11:30:57 +0200
Subject: [PATCH 0514/3333] functions-libvirt: Enable DEBUG_LIBVIRT config
 attribute by default

Enabling it by default because:

  - This allows you to get the relevant logs right away when something
    in the libvirt code path fails, without having to submit another
    change and keep doing a 'recheck' to re-run the CI check/gate jobs
    until you hit the bug.

  - The libvirt log filters specified in the function
    'configure_libvirt' are much more _selective_ and not a catch-all
    debug option where you end up with the unhelpful situation of having
    to find a "specific piece of hay in a haystack"[1].

FWIW, I always have it enabled in local test environments, and I don't
see the resulting libvirtd.log growing beyond a couple of MB for
three-four days of usage.

[1] http://lists.openstack.org/pipermail/openstack-dev/2014-January/024414.html

Change-Id: I5e0b35446075b419fe473e1db8d0bfedd7009741
---
 lib/nova_plugins/functions-libvirt | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 05ef605b04..1a8e0e4e75 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -14,8 +14,11 @@ set +o xtrace
 # Defaults
 # --------
 
-# if we should turn on massive libvirt debugging
-DEBUG_LIBVIRT=$(trueorfalse False DEBUG_LIBVIRT)
+# Turn on selective debug log filters for libvirt.
+# (NOTE: Enabling this by default, because the log filters enabled in
+# 'configure_libvirt' function further below are _selective_ and not
+# extremely verbose.)
+DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 
 # Installs required distro-specific libvirt packages.
 function install_libvirt {

From 279cfe75198c723519f1fb361b2bff3c641c6cef Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 1 Apr 2015 07:33:55 -0400
Subject: [PATCH 0515/3333] minimize the default services

This changes the default service list in devstack to minimize what is
running out of the box, so that it's likelihood of working in a 4G vm
is much higher.

This removes heat from the default enabled service list.

It drops the ec2 only needed n-obj and n-crt services.

It drops all the alternative consoles (xvnc, consoleauth). novnc is
fine for libvirt which is the default.

It adds dstat, because that's turned out to be so useful in debugging
things.

Change-Id: I84457260dff6f42a5c6ebcc2c60fb6e01aec9567
---
 stackrc | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/stackrc b/stackrc
index c27ead3c24..0d8f059c1b 100644
--- a/stackrc
+++ b/stackrc
@@ -46,16 +46,18 @@ REGION_NAME=${REGION_NAME:-RegionOne}
 
 # This allows us to pass ``ENABLED_SERVICES``
 if ! isset ENABLED_SERVICES ; then
-    # Compute (Glance / Keystone / Nova (+ nova-network))
-    ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,n-sch,n-novnc,n-xvnc,n-cauth
+    # Keystone - nothing works without keystone
+    ENABLED_SERVICES=key
+    # Nova - services to support libvirt based openstack clouds
+    ENABLED_SERVICES=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc
+    # Glance services needed for Nova
+    ENABLED_SERVICES=,g-api,g-reg
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
-    # Heat
-    ENABLED_SERVICES+=,h-eng,h-api,h-api-cfn,h-api-cw
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
 fi
 
 # SQLAlchemy supports multiple database drivers for each database server

From ba1c56bf5e292df74b17eebdc998c74428c925a7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 1 Apr 2015 07:40:10 -0400
Subject: [PATCH 0516/3333] remove extraneous +x bits from lib files

2 files had execute bits set on them, fix as a cleanup. These files
should not be directly executed.

Change-Id: Ic0fdb85d77a3b47ef777524faf4fcdb0d8cedece
---
 lib/glance         | 0
 lib/neutron-legacy | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 lib/glance
 mode change 100755 => 100644 lib/neutron-legacy

diff --git a/lib/glance b/lib/glance
old mode 100755
new mode 100644
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
old mode 100755
new mode 100644

From 6c0da09b00fcfa8c4a9d34fb2ed08f6c704ed06e Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Thu, 26 Mar 2015 15:19:32 -0700
Subject: [PATCH 0517/3333] Prepare devstack for Ironic cleaning testing

This patch changes the two config options required for Ironic to
successfully test cleaning in devstack.

First, we disable erase_devices clean step. Erase devices in VMs
ends up running shred on the drives for the agent driver, which is
incredibly slow and completely unneeded in devstack.

Additionally, we allow Ironic more time to complete the unprovision
after the nova instance is deleted. This time is spend in the CLEANING
state to clean up the node.

This is related to the Ironic blueprint "implement-cleaning-states".

Change-Id: I77081165a80491da3e66d8a4554b6d71fc3d9353
---
 lib/ironic  | 1 +
 lib/tempest | 1 +
 2 files changed, 2 insertions(+)

diff --git a/lib/ironic b/lib/ironic
index b99e3255d5..9651ec3189 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -370,6 +370,7 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
         iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
+        iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
     fi
 
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
diff --git a/lib/tempest b/lib/tempest
index 8672a14338..c981c2ba74 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -476,6 +476,7 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
+        iniset $TEMPEST_CONFIG baremetal unprovision_timeout 300
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
         iniset $TEMPEST_CONFIG compute-feature-enabled console_output False
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False

From d2cb234be4b5e6d70635fc7578d951a42a41cc4a Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 2 Apr 2015 11:08:24 -0400
Subject: [PATCH 0518/3333] Set qcow image file location with right cirros
 version

This commit ensures we also set the qcow image location in the
tempest config when we update qcow version. The tempest config has
a default value for img_file (which is incorrect) but before we can
remove the defaults in tempest we need to ensure devstack is using
it properly first. The only reason the tests weren't failing here is
because tempest falls back to using uec images (which devstack was
correctly setting config for) if qcow isn't found. The img_dir was
also hardcoded assuming a uec image, however if qcow is intended to be
used you'll need to be able to override that, which is added as
part of this commit.

Change-Id: I05af346b3c9be9560dc8846dd1f437cfbb2d5005
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 3f33512cf6..7d7cf11469 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -401,10 +401,12 @@ function configure_tempest {
     fi
 
     # Scenario
-    iniset $TEMPEST_CONFIG scenario img_dir "$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec"
+    SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+    iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
     iniset $TEMPEST_CONFIG scenario ami_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img"
     iniset $TEMPEST_CONFIG scenario ari_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd"
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
+    iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
     # Large Ops Number
     iniset $TEMPEST_CONFIG scenario large_ops_number ${TEMPEST_LARGE_OPS_NUMBER:-0}

From 7cc3907ff1070858af2fcc8dd2d5b480f83022b6 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Mon, 30 Mar 2015 20:49:22 +0300
Subject: [PATCH 0519/3333] install euca2ools for tempest preparation

euca-bundle-image can be run only if euca2ools is installed.
but now it doesn't installed and several tests for EC2 doesn't run.

Change-Id: Ib3824052d5f4155d3cb5c0ef6fe334d44de5153c
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 3f33512cf6..d8692dcce9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -562,6 +562,8 @@ function init_tempest {
             echo "Prepare aki/ari/ami Images"
             mkdir -p $BOTO_MATERIALS_PATH
             ( #new namespace
+                # euca2ools should be installed to call euca-* commands
+                is_package_installed euca2ools || install_package euca2ools
                 # tenant:demo ; user: demo
                 source $TOP_DIR/accrc/demo/demo
                 euca-bundle-image -r ${CIRROS_ARCH} -i "$kernel" --kernel true -d "$BOTO_MATERIALS_PATH"

From 40e652af0e40203e870d6d4c3b8d77176ef8785d Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Thu, 2 Apr 2015 22:39:59 +0300
Subject: [PATCH 0520/3333] Use ec2 and s3 urls from keystone catalog

In current implemetation these two urls are defined from Nova
definitions. And urls point to nova. But standalone EC2API
project has another urls that are defined in keystone catalog
in plugin setup.
I suggest to use urls from catalog to be able to test
stackforge/ec2-api by current tempest.

Change-Id: Ibec8c36a8c2fc7ea3d8fab57819adae5f7378045
---
 lib/tempest | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 3f33512cf6..9f7e62608c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -271,6 +271,15 @@ function configure_tempest {
         fi
     fi
 
+    EC2_URL=$(openstack endpoint show -f value -c publicurl ec2 || true)
+    if [[ -z $EC2_URL ]]; then
+        EC2_URL="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
+    fi
+    S3_URL=$(openstack endpoint show -f value -c publicurl s3 || true)
+    if [[ -z $S3_URL ]]; then
+        S3_URL="http://$SERVICE_HOST:${S3_SERVICE_PORT:-3333}"
+    fi
+
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
 
     # Oslo
@@ -375,8 +384,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
 
     # boto
-    iniset $TEMPEST_CONFIG boto ec2_url "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
-    iniset $TEMPEST_CONFIG boto s3_url "http://$SERVICE_HOST:${S3_SERVICE_PORT:-3333}"
+    iniset $TEMPEST_CONFIG boto ec2_url "$EC2_URL"
+    iniset $TEMPEST_CONFIG boto s3_url "$S3_URL"
     iniset $TEMPEST_CONFIG boto s3_materials_path "$BOTO_MATERIALS_PATH"
     iniset $TEMPEST_CONFIG boto ari_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd.manifest.xml
     iniset $TEMPEST_CONFIG boto ami_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img.manifest.xml

From b58e22d170cc01467adf9cbb191aeb9351317f37 Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew.laski@rackspace.com>
Date: Thu, 2 Apr 2015 17:56:43 -0400
Subject: [PATCH 0521/3333] If cells enabled create a fixed network in the API
 cell

Now that tempest is querying for a network before making server create
calls the fixed network needs to be known by the API cell.  Server
creates should work for networks defined in both databases, but defining
a new network via the API will continue to not work.

Change-Id: I32461add0d20940a55385c8b34cd493e2561615e
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index 8ab82348f3..adcaa219cc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1214,6 +1214,9 @@ if is_service_enabled q-svc; then
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}
     if is_service_enabled n-cell; then
+        # Create a small network in the API cell
+        $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF network create "$PRIVATE_NETWORK_NAME" $FIXED_RANGE 1 $FIXED_NETWORK_SIZE $NETWORK_CREATE_ARGS
+        # Everything else should go in the child cell
         NM_CONF=${NOVA_CELLS_CONF}
     fi
 

From db02bbf107ff0a9f0ffcf3dc8a9b9219ccd7a2c0 Mon Sep 17 00:00:00 2001
From: Raman Budny <raman_budny@epam.com>
Date: Tue, 31 Mar 2015 13:09:09 +0300
Subject: [PATCH 0522/3333] Fixes ovs-vsctl add port issue

Setup of OVS may fail, if ports that are added,
are already exist. Add "--may-exist" directive to OVS
add-port command to prevent this behaviour.

Change-Id: I2280be9a63a4a6fbc747b5e32b602697b555ffa8
Closes-Bug: #1394162
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d3dd8dd33e..c6d9296fba 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -801,7 +801,7 @@ function _move_neutron_addresses_route {
         fi
 
         if [[ "$add_ovs_port" == "True" ]]; then
-            ADD_OVS_PORT="sudo ovs-vsctl add-port $to_intf $from_intf"
+            ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
         fi
 
         sudo ip addr del $IP_BRD dev $from_intf; sudo ip addr add $IP_BRD dev $to_intf; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE

From 72a3312904d9a97a99929bf1001a6fef4d8bfa00 Mon Sep 17 00:00:00 2001
From: Sushil Kumar <sushil.kumar3@hp.com>
Date: Fri, 3 Apr 2015 09:28:50 +0000
Subject: [PATCH 0523/3333] Fixes devstack stackrc

One of the earlier patchset while updating stackrc
missed on adding "+=" while adding multiple services.

Closes-Bug: #1439983
Change-Id: I74f788e15b7da05a93fc8d99c562e51386b65053
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 0d8f059c1b..abedb001d1 100644
--- a/stackrc
+++ b/stackrc
@@ -49,9 +49,9 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc
+    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc
     # Glance services needed for Nova
-    ENABLED_SERVICES=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api,g-reg
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Dashboard

From 5e5a29cc8c83b3f9032de2482987bb9989422b7b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 3 Apr 2015 08:52:29 -0400
Subject: [PATCH 0524/3333] fix bashate target

there was a missing -or which meant we weren't running this on most of
the files in the repository.

Change-Id: If926afc8f12f6beb80d7a9af7c787b3dcc360a89
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index bc84928d95..279dcd4f66 100644
--- a/tox.ini
+++ b/tox.ini
@@ -20,7 +20,7 @@ commands = bash -c "find {toxinidir}          \
           -name \*.sh -or                     \
           -name \*rc -or                      \
           -name functions\* -or               \
-          -wholename \*/inc/\*                \ # /inc files and
+          -wholename \*/inc/\* -or            \ # /inc files and
           -wholename \*/lib/\*                \ # /lib files are shell, but
          \)                                   \ #   have no extension
          -print0 | xargs -0 bashate -v"

From a79e1011ca15bee9d1f326270e516edeab6a5257 Mon Sep 17 00:00:00 2001
From: Dane LeBlanc <leblancd@cisco.com>
Date: Thu, 26 Mar 2015 14:48:07 -0400
Subject: [PATCH 0525/3333] Remove unused IPv6 setup from DevStack neutron
 script

With the implementation of dual-stack gateway support
as part of the Neutron multiple-ipv6-prefixes
blueprint, some of the code in the IPv6 setup in the
DevStack neutron legacy script must be removed. This
code had been added temporarily, with a TODO note
indicating that this code should be removed when
the Neutron L3 agent is modified to support
dual-stack.

Without this change, DevStack will fail to configure
the Neutron router gateway interface (there will be
no external connectivity) whenever IP_VERSION is set
to '4+6' in localrc/local.conf, since
first DevStack and later the Neutron L3 agent will be
trying to ADD the IPv6 address to the router gateway
interface.

This change also includes a modification of the
default prefix to be used for the public IPv6
subnet. The new value (2001:df8::/64) is a special
reserved prefix that will be treated as non-routable
external to the OpenStack instance.

Change-Id: I85fe68782bc54f28f3e14aa4a1d042cb15959dac
Partially-implements: blueprint multiple-ipv6-prefixes
---
 lib/neutron-legacy | 46 ++++++----------------------------------------
 1 file changed, 6 insertions(+), 40 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c6d9296fba..8eb9e62a90 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -57,9 +57,6 @@
 # Settings
 # --------
 
-# Timeout value in seconds to wait for IPv6 gateway configuration
-GATEWAY_TIMEOUT=30
-
 
 # Neutron Network Configuration
 # -----------------------------
@@ -90,12 +87,9 @@ IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
 IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
 FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
 IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
-IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-fe80:cafe:cafe::/64}
-IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-fe80:cafe:cafe::2}
-# IPV6_ROUTER_GW_IP must be defined when IP_VERSION=4+6 as it cannot be
-# obtained conventionally until the l3-agent has support for dual-stack
-# TODO (john-davidge) Remove once l3-agent supports dual-stack
-IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-fe80:cafe:cafe::1}
+IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
+IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
+IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
 
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
@@ -1291,20 +1285,12 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3; then
-        local ipv6_router_gw_port
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
-        if [[ "$IP_VERSION" = "6" ]]; then
-            # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-            IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
-            die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
-            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
-            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
-        else
-            ipv6_router_gw_port=`neutron port-list -c id -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $1; }' | awk -F ' | ' '{ print $2; }'`
-            die_if_not_set $LINENO ipv6_router_gw_port "Failure retrieving ipv6_router_gw_port"
-        fi
+        # Override global IPV6_ROUTER_GW_IP with the true value from neutron
+        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
+        die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         # The ovs_base_configure_l3_agent function flushes the public
         # bridge's ip addresses, so turn IPv6 support in the host off
@@ -1321,28 +1307,8 @@ function _neutron_configure_router_v6 {
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
 
-            # Define router_ns based on whether DVR is enabled
-            local router_ns=qrouter
-            if [[ "$Q_DVR_MODE" == "dvr_snat" ]]; then
-                router_ns=snat
-            fi
-
             # Configure interface for public bridge
             sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-
-            # Wait until layer 3 agent has configured the gateway port on
-            # the public bridge, then add gateway address to the interface
-            # TODO (john-davidge) Remove once l3-agent supports dual-stack
-            if [[ "$IP_VERSION" == "4+6" ]]; then
-                if ! timeout $GATEWAY_TIMEOUT sh -c "until sudo ip netns exec $router_ns-$ROUTER_ID ip addr show qg-${ipv6_router_gw_port:0:11} | grep $ROUTER_GW_IP; do sleep 1; done"; then
-                    die $LINENO "Timeout retrieving ROUTER_GW_IP"
-                fi
-                # Configure the gateway port with the public IPv6 adress
-                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 addr add $IPV6_ROUTER_GW_IP/$ipv6_cidr_len dev qg-${ipv6_router_gw_port:0:11}
-                # Add a default IPv6 route to the neutron router as the
-                # l3-agent does not add one in the dual-stack case
-                sudo ip netns exec $router_ns-$ROUTER_ID ip -6 route replace default via $ipv6_ext_gw_ip dev qg-${ipv6_router_gw_port:0:11}
-            fi
             sudo ip -6 route add $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
         fi
         _neutron_set_router_id

From bcef63ed4306ac8cbfac5c68c828b10e129c3475 Mon Sep 17 00:00:00 2001
From: Andrew McDermott <andrew.mcdermott@linaro.org>
Date: Wed, 1 Apr 2015 15:47:36 +0000
Subject: [PATCH 0526/3333] Update qemu package name for Ubuntu aarch64

The qemu-system package, and not qemu-kvm, should be installed on either
trusty- or utopic-based ARMv8 (aarch64) Ubuntu releases. Additionally,
libguestfs is not available so that is not installed.

No changes are required for vivid.

Change-Id: Id9dc1fc465bd7acab17c991c292fb531016758ad
Signed-off-by: Andrew McDermott <andrew.mcdermott@linaro.org>
---
 lib/nova_plugins/functions-libvirt | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
 mode change 100644 => 100755 lib/nova_plugins/functions-libvirt

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
old mode 100644
new mode 100755
index fa3666eff7..d4a07688cd
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -23,11 +23,15 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
     if is_ubuntu; then
-        install_package qemu-kvm
+        if is_arch "aarch64" && [[ ${DISTRO} =~ (trusty|utopic) ]]; then
+            install_package qemu-system
+        else
+            install_package qemu-kvm
+            install_package libguestfs0
+            install_package python-guestfs
+        fi
         install_package libvirt-bin libvirt-dev
         pip_install libvirt-python
-        install_package libguestfs0
-        install_package python-guestfs
         #pip_install <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm

From 33ba738b052cd642f7ea2e6c2196e193be14122f Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Mon, 6 Apr 2015 10:25:54 -0700
Subject: [PATCH 0527/3333] Revert "List all CIRROS ARCH images in
 image_list.sh"

This reverts commit 71e82f52bde99b4bf791ea1558f1abf86019a384.

aioppcu now uses x86_64 so no need to list the i386 images for caching.

Change-Id: If500367c8bf3fdb4590c866e007ecd7de1ab5781
Depends-On: I839e1c724821ba2624beddb5233eda24b50c149f
---
 tools/image_list.sh | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/tools/image_list.sh b/tools/image_list.sh
index 204280704e..a27635effd 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -9,8 +9,6 @@ source $TOP_DIR/functions
 # dummy in the end position to trigger the fall through case.
 DRIVERS="openvz ironic libvirt vsphere xenserver dummy"
 
-CIRROS_ARCHS="x86_64 i386"
-
 # Extra variables to trigger getting additional images.
 export ENABLED_SERVICES="h-api,tr-api"
 HEAT_FETCHED_TEST_IMAGE="Fedora-i386-20-20131211.1-sda"
@@ -19,15 +17,12 @@ PRECACHE_IMAGES=True
 # Loop over all the virt drivers and collect all the possible images
 ALL_IMAGES=""
 for driver in $DRIVERS; do
-    for arch in $CIRROS_ARCHS; do
-        CIRROS_ARCH=$arch
-        VIRT_DRIVER=$driver
-        URLS=$(source $TOP_DIR/stackrc && echo $IMAGE_URLS)
-        if [[ ! -z "$ALL_IMAGES" ]]; then
-            ALL_IMAGES+=,
-        fi
-        ALL_IMAGES+=$URLS
-    done
+    VIRT_DRIVER=$driver
+    URLS=$(source $TOP_DIR/stackrc && echo $IMAGE_URLS)
+    if [[ ! -z "$ALL_IMAGES" ]]; then
+        ALL_IMAGES+=,
+    fi
+    ALL_IMAGES+=$URLS
 done
 
 # Make a nice list

From 8c6276ea0a2332f5210fc1f16399281c083520cd Mon Sep 17 00:00:00 2001
From: Raseel Bhagat <raseelbhagat@gmail.com>
Date: Tue, 7 Apr 2015 03:15:45 +0530
Subject: [PATCH 0528/3333] Added libxml2-dev package as a pre-requisite when
 installing tempest. This is required so that devstack can be installed on
 vanilla Ubuntu systems.

Closes-Bug: 1225395

Change-Id: Id9116e00e18c23e8e6391d8aa652c04d8bdb86c3
---
 files/debs/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/files/debs/tempest b/files/debs/tempest
index f244e4e783..bb095297e0 100644
--- a/files/debs/tempest
+++ b/files/debs/tempest
@@ -1 +1,2 @@
-libxslt1-dev
\ No newline at end of file
+libxml2-dev
+libxslt1-dev

From 0089035504a97fca58cb2383f62ccbb4e6108820 Mon Sep 17 00:00:00 2001
From: Yuki Nishiwaki <uckey.1067@gmail.com>
Date: Sun, 29 Mar 2015 23:35:39 +0900
Subject: [PATCH 0529/3333] Assurance status of rabbitmq is running

I changed it so that rabbitmq always restart.

Current devstack don't restart rabbitmq in case of ubuntu. Because
rabbitmq is running at default.
But this approach have the following bug.
If rabbitmq is already installed and not running ,  stack.sh will
fail.
So I change it so that rabbitmq always restart.

Closes-bug: #1030798
Change-Id: Ie45446d3817b2f15631f03b2af84749fe936c67b
---
 lib/rpc_backend | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3033cbe08e..3d8fd2bd3e 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -201,10 +201,7 @@ function restart_rpc_backend {
 
             [[ $i -eq "10" ]] && die $LINENO "Failed to set rabbitmq password"
 
-            if is_fedora || is_suse; then
-                # service is not started by default
-                restart_service rabbitmq-server
-            fi
+            restart_service rabbitmq-server
 
             rabbit_setuser "$RABBIT_USERID" "$RABBIT_PASSWORD" || rc=$?
             if [ $rc -ne 0 ]; then

From 7b9341e1789b31786d10f27a3a3c825fe44bb506 Mon Sep 17 00:00:00 2001
From: Bharat Kumar Kobagana <bharat.kobagana@redhat.com>
Date: Mon, 30 Mar 2015 11:58:10 +0530
Subject: [PATCH 0530/3333] Clone external plugins before overriding defaults

This patch clones external plugin repositories before overriding
default configuration parameters.

Closes-Bug: 1441058
Change-Id: Ie14fcb897cb40b1604bfb5869baa0dec58e51bce
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index adcaa219cc..5331beb9b7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -514,6 +514,9 @@ fi
 # Configure Projects
 # ==================
 
+# Clone all external plugins
+fetch_plugins
+
 # Plugin Phase 0: override_defaults - allow pluggins to override
 # defaults before other services are run
 run_phase override_defaults
@@ -540,9 +543,6 @@ source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 
-# Clone all external plugins
-fetch_plugins
-
 # Extras Source
 # --------------
 

From 97aa81d905ce73054747a56a4ba0d93c308d23a5 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 7 Apr 2015 16:23:53 -0400
Subject: [PATCH 0531/3333] Fix docs about heat in devtack

In 279cfe75198c723519f1fb361b2bff3c641c6cef, we disabled heat by default.
So fixing the README to reflect that.

Change-Id: I3da257158b37e235eed1c78e0c4df432caeefa1d
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 53de970763..039ce3e548 100644
--- a/README.md
+++ b/README.md
@@ -264,10 +264,10 @@ To change this, set the `Q_AGENT` variable to the agent you want to run
 
 # Heat
 
-Heat is enabled by default (see `stackrc` file). To disable it explicitly
+Heat is disabled by default (see `stackrc` file). To enable it explicitly
 you'll need the following settings in your `localrc` section:
 
-    disable_service heat h-api h-api-cfn h-api-cw h-eng
+    enable_service heat h-api h-api-cfn h-api-cw h-eng
 
 Heat can also run in standalone mode, and be configured to orchestrate
 on an external OpenStack cloud. To launch only Heat in standalone mode

From 60996b1b60c3efb1376b9f0d659acebd05c47f09 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 8 Apr 2015 09:06:49 -0400
Subject: [PATCH 0532/3333] introduce pip_install_gr

This creates a new pip_install_gr that installs from global
requirements allowed versions. Now that stable branches are getting
capped all of devstack needs to be fixed to do things like this.

Change-Id: I8fd0ef2bfc544ca2576fab09d3018f760b8848fe
---
 inc/python                            | 14 +++++++++++++-
 lib/ceilometer                        |  3 +++
 lib/databases/mysql                   |  2 +-
 lib/databases/postgresql              |  2 +-
 lib/horizon                           |  2 +-
 lib/ironic                            |  4 ++--
 lib/keystone                          |  2 +-
 lib/ldap                              |  2 +-
 lib/nova_plugins/functions-libvirt    |  6 +++---
 lib/nova_plugins/hypervisor-xenserver |  2 +-
 lib/rpc_backend                       |  2 +-
 lib/tempest                           |  2 +-
 lib/zaqar                             |  4 ++--
 pkg/elasticsearch.sh                  |  2 +-
 stack.sh                              |  2 +-
 15 files changed, 33 insertions(+), 18 deletions(-)

diff --git a/inc/python b/inc/python
index 39684b6fc5..c7cbb52884 100644
--- a/inc/python
+++ b/inc/python
@@ -52,6 +52,18 @@ function get_python_exec_prefix {
     fi
 }
 
+# Wrapper for ``pip install`` that only installs versions of libraries
+# from the global-requirements specification.
+#
+# Uses globals ``REQUIREMENTS_DIR``
+#
+# pip_install_gr packagename
+function pip_install_gr {
+    local name=$1
+    local clean_name=$(get_from_global_requirements $name)
+    pip_install $clean_name
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``
@@ -125,7 +137,7 @@ function pip_install {
 # get_from_global_requirements <package>
 function get_from_global_requirements {
     local package=$1
-    local required_pkg=$(grep -h ${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
+    local required_pkg=$(grep -h ^${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
     if [[ $required_pkg == ""  ]]; then
         die $LINENO "Can't find package $package in requirements"
     fi
diff --git a/lib/ceilometer b/lib/ceilometer
index 81353093b2..dba92ba542 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -315,6 +315,9 @@ function install_ceilometermiddleware {
         git_clone_by_name "ceilometermiddleware"
         setup_dev_lib "ceilometermiddleware"
     else
+        # BUG: this should be a pip_install_gr except it was never
+        # included in global-requirements. Needs to be fixed by
+        # https://bugs.launchpad.net/ceilometer/+bug/1441655
         pip_install ceilometermiddleware
     fi
 }
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 310817b69a..1b9a08199f 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -155,7 +155,7 @@ EOF
 
 function install_database_python_mysql {
     # Install Python client module
-    pip_install MySQL-python
+    pip_install_gr MySQL-python
     ADDITIONAL_VENV_PACKAGES+=",MySQL-python"
 }
 
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index a6bcf8c0a2..e087a1e0d4 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -104,7 +104,7 @@ EOF
 
 function install_database_python_postgresql {
     # Install Python client module
-    pip_install psycopg2
+    pip_install_gr psycopg2
     ADDITIONAL_VENV_PACKAGES+=",psycopg2"
 }
 
diff --git a/lib/horizon b/lib/horizon
index 63a9d0fe46..f953f5cc01 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -183,7 +183,7 @@ function stop_horizon {
 # NOTE: It can be moved to common functions, but it is only used by compilation
 # of django_openstack_auth catalogs at the moment.
 function _prepare_message_catalog_compilation {
-    pip_install $(get_from_global_requirements Babel)
+    pip_install_gr Babel
 }
 
 
diff --git a/lib/ironic b/lib/ironic
index c8481ab992..7afed052e9 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -206,7 +206,7 @@ function install_ironicclient {
         sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-ironicclient"]}/tools/,/etc/bash_completion.d/}ironic.bash_completion
     else
         # nothing actually "requires" ironicclient, so force instally from pypi
-        pip_install python-ironicclient
+        pip_install_gr python-ironicclient
     fi
 }
 
@@ -729,7 +729,7 @@ function upload_baremetal_ironic_deploy {
 
     # install diskimage-builder
     if [[ $(type -P ramdisk-image-create) == "" ]]; then
-        pip_install diskimage_builder
+        pip_install_gr "diskimage-builder"
     fi
 
     if [ -z "$IRONIC_DEPLOY_KERNEL" -o -z "$IRONIC_DEPLOY_RAMDISK" ]; then
diff --git a/lib/keystone b/lib/keystone
index 7b41812fca..31659f4338 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -524,7 +524,7 @@ function install_keystonemiddleware {
         setup_dev_lib "keystonemiddleware"
     else
         # When not installing from repo, keystonemiddleware is still needed...
-        pip_install keystonemiddleware
+        pip_install_gr keystonemiddleware
     fi
 }
 
diff --git a/lib/ldap b/lib/ldap
index d69d3f84a5..d2dbc3b728 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -142,7 +142,7 @@ function install_ldap {
         sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
     fi
 
-    pip_install ldappool
+    pip_install_gr ldappool
 
     rm -rf $tmp_ldap_dir
 }
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d4a07688cd..04da5e2b60 100755
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -31,12 +31,12 @@ function install_libvirt {
             install_package python-guestfs
         fi
         install_package libvirt-bin libvirt-dev
-        pip_install libvirt-python
-        #pip_install <there-si-no-guestfs-in-pypi>
+        pip_install_gr libvirt-python
+        #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm
         install_package libvirt libvirt-devel
-        pip_install libvirt-python
+        pip_install_gr libvirt-python
         install_package python-libguestfs
     fi
 
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 4d0ec898ad..efce383222 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -94,7 +94,7 @@ CRONTAB
 
 # install_nova_hypervisor() - Install external components
 function install_nova_hypervisor {
-    pip_install xenapi
+    pip_install_gr xenapi
 }
 
 # start_nova_hypervisor - Start any required external services
diff --git a/lib/rpc_backend b/lib/rpc_backend
index cc083de449..2b7c6cbc64 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -141,7 +141,7 @@ function install_rpc_backend {
         # TODO(kgiusti) can remove once python qpid bindings are
         # available on all supported platforms _and_ pyngus is added
         # to the requirements.txt file in oslo.messaging
-        pip_install pyngus
+        pip_install_gr pyngus
     fi
 
     if is_service_enabled rabbit; then
diff --git a/lib/tempest b/lib/tempest
index e8e9e0b239..cd8fbd725f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -103,7 +103,7 @@ function configure_tempest {
         setup_develop $TEMPEST_DIR
     else
         # install testr since its used to process tempest logs
-        pip_install $(get_from_global_requirements testrepository)
+        pip_install_gr testrepository
     fi
 
     local image_lines
diff --git a/lib/zaqar b/lib/zaqar
index 34f1915025..8d51910896 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -140,10 +140,10 @@ function configure_zaqar {
 function configure_redis {
     if is_ubuntu; then
         install_package redis-server
-        pip_install redis
+        pip_install_gr redis
     elif is_fedora; then
         install_package redis
-        pip_install redis
+        pip_install_gr redis
     else
         exit_distro_not_supported "redis installation"
     fi
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index f53c7f2ff2..29dc22fb88 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -77,7 +77,7 @@ function stop_elasticsearch {
 }
 
 function install_elasticsearch {
-    pip_install elasticsearch
+    pip_install_gr elasticsearch
     if is_package_installed elasticsearch; then
         echo "Note: elasticsearch was already installed."
         return
diff --git a/stack.sh b/stack.sh
index adcaa219cc..69b76a9e19 100755
--- a/stack.sh
+++ b/stack.sh
@@ -847,7 +847,7 @@ if use_library_from_git "python-openstackclient"; then
     git_clone_by_name "python-openstackclient"
     setup_dev_lib "python-openstackclient"
 else
-    pip_install 'python-openstackclient>=1.0.2'
+    pip_install_gr python-openstackclient
 fi
 
 if [[ $TRACK_DEPENDS = True ]]; then

From 9860876f5dbb07826b680143a4e111ad580053fe Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@tesora.com>
Date: Wed, 8 Apr 2015 15:37:58 -0400
Subject: [PATCH 0533/3333] perform install_infra sooner in stack.sh

The install_infra() call needs to be done earlier since
pip_install_gr() depends on it. Also the fact that python module names
are supposed to be lower case but some use camel case is a problem
(for example with XenAPI).

Change-Id: I7012d77134fa0d9c746d87e837934e7dcb337e5c
Closes-Bug: #1441820
---
 inc/python | 2 +-
 stack.sh   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/inc/python b/inc/python
index c7cbb52884..3d329b59a9 100644
--- a/inc/python
+++ b/inc/python
@@ -137,7 +137,7 @@ function pip_install {
 # get_from_global_requirements <package>
 function get_from_global_requirements {
     local package=$1
-    local required_pkg=$(grep -h ^${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
+    local required_pkg=$(grep -i -h ^${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
     if [[ $required_pkg == ""  ]]; then
         die $LINENO "Can't find package $package in requirements"
     fi
diff --git a/stack.sh b/stack.sh
index 69b76a9e19..9ecc49c7ca 100755
--- a/stack.sh
+++ b/stack.sh
@@ -714,6 +714,9 @@ fi
 # Extras Pre-install
 # ------------------
 
+# Install required infra support libraries
+install_infra
+
 # Phase: pre-install
 run_phase stack pre-install
 
@@ -733,9 +736,6 @@ fi
 
 echo_summary "Installing OpenStack project source"
 
-# Install required infra support libraries
-install_infra
-
 # Install Oslo libraries
 install_oslo
 

From fcc3f6ee986c1166c001774052c05b5d974593ea Mon Sep 17 00:00:00 2001
From: Clark Laughlin <clark.laughlin@linaro.org>
Date: Tue, 7 Apr 2015 16:31:47 +0000
Subject: [PATCH 0534/3333] Add support for arm64 images

This patch enables proper support for arm64 images by disabling VNC support
and adding several properties to the image in glance that are necessary to
boot correctly:
  hw_cdrom_bus=virtio
  hw_machine_type=virt
  os_command_line='console=ttyAMA0'

Change-Id: I68c9a5e0e083af2f92875c3bdf70df750f6e4d8f
---
 functions                           | 4 ++++
 lib/nova_plugins/hypervisor-libvirt | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/functions b/functions
index 4dc20e7f23..2078db1e7c 100644
--- a/functions
+++ b/functions
@@ -287,6 +287,10 @@ function upload_image {
         img_property="--property hw_cdrom_bus=scsi"
     fi
 
+    if is_arch "aarch64"; then
+        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=virtio --property os_command_line='console=ttyAMA0'"
+    fi
+
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
             openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 4d1eb6cdcb..a6a87f9164 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -54,6 +54,12 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF DEFAULT vnc_enabled "false"
     fi
 
+    # arm64-specific configuration
+    if is_arch "aarch64"; then
+        # arm64 architecture currently does not support graphical consoles.
+        iniset $NOVA_CONF DEFAULT vnc_enabled "false"
+    fi
+
     ENABLE_FILE_INJECTION=$(trueorfalse False ENABLE_FILE_INJECTION)
     if [[ "$ENABLE_FILE_INJECTION" = "True" ]] ; then
         # When libguestfs is available for file injection, enable using

From 4d7ee095a18af9e834202e92534d2ba7a0b371c5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 7 Apr 2015 10:40:49 -0400
Subject: [PATCH 0535/3333] Make screen sleep time configurable

the sleep 3 in screen_it was added to make devstack pass in the gate
with exceptionally slow test cloud nodes. In the gate we now bypass
the screen path entirely. However the sleep 3 remains and can add a
couple minutes delay into local development runs.

We're not sure yet how low this can safely be tuned, so step 1 is to
make it configurable, then get devstack team members to try various
options to see what works.

Change-Id: I0e6476176fc8589efc4e40e78c2231f704d14e45
---
 functions-common | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index f442211a61..f8543c1f98 100644
--- a/functions-common
+++ b/functions-common
@@ -1256,8 +1256,13 @@ function screen_process {
 
     # sleep to allow bash to be ready to be send the command - we are
     # creating a new window in screen and then sends characters, so if
-    # bash isn't running by the time we send the command, nothing happens
-    sleep 3
+    # bash isn't running by the time we send the command, nothing
+    # happens.  This sleep was added originally to handle gate runs
+    # where we needed this to be at least 3 seconds to pass
+    # consistently on slow clouds. Now this is configurable so that we
+    # can determine a reasonable value for the local case which should
+    # be much smaller.
+    sleep ${SCREEN_SLEEP:-3}
 
     NL=`echo -ne '\015'`
     # This fun command does the following:

From 7cf7a8f88f05a6e6994dfb2ff3a6643d21c3048e Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <mehdi.abaakouk@enovance.com>
Date: Thu, 9 Apr 2015 11:46:56 +0200
Subject: [PATCH 0536/3333] rpc: Allow to configure the rabbitmq heartbeat

For testing we can need to disable or change the rate of the heartbeat
Currently we have to set the value manually in each componments or
to write multiple [[post-config|$<APP>_CONF]] section in local.conf.

This change will allow to configure all componments at once with only two
lines.

Also, we don't set default values to continue to use oslo.messaging
defaults.

Change-Id: Ieaca60ca1cd6d7455b66ce490a9b023df431e9c3
---
 lib/rpc_backend | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 2b7c6cbc64..288987cdf0 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -273,6 +273,12 @@ function iniset_rpc_backend {
         iniset $file oslo_messaging_rabbit rabbit_hosts $RABBIT_HOST
         iniset $file oslo_messaging_rabbit rabbit_password $RABBIT_PASSWORD
         iniset $file oslo_messaging_rabbit rabbit_userid $RABBIT_USERID
+        if [ -n "$RABBIT_HEARTBEAT_TIMEOUT_THRESHOLD" ]; then
+            iniset $file oslo_messaging_rabbit heartbeat_timeout_threshold $RABBIT_HEARTBEAT_TIMEOUT_THRESHOLD
+        fi
+        if [ -n "$RABBIT_HEARTBEAT_RATE" ]; then
+            iniset $file oslo_messaging_rabbit heartbeat_rate $RABBIT_HEARTBEAT_RATE
+        fi
     fi
 }
 

From d394e59b5c43d6dc7107c3ee31cbb0bb07300d13 Mon Sep 17 00:00:00 2001
From: melanie witt <melwitt@yahoo-inc.com>
Date: Wed, 8 Apr 2015 23:02:59 +0000
Subject: [PATCH 0537/3333] Specify network UUID for network create with cells

When the n-cell service is enabled, we create networks in both the
API cell and the child cell. Recent changes to tempest have tests
querying networks from the API and passing them for a server create.
In order for this to work in cells, the UUIDs for the network in
the API cell and the child cell must match, else the network won't
be found in the child.

This change adds the --uuid option to the nova-manage network create
command for cells only.

Related-Bug: #1441931

Depends-On: Ib29e632b09905f557a7a6910d58207ed91cdc047

Change-Id: Ib5933b1405c0761ff727e04cda0c502a826c8eaf
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 69b76a9e19..c795dfcf90 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1214,6 +1214,10 @@ if is_service_enabled q-svc; then
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}
     if is_service_enabled n-cell; then
+        # Both cells should have the same network uuid for server create
+        if [[ ! "$NETWORK_CREATE_ARGS" =~ "--uuid" ]]; then
+            NETWORK_CREATE_ARGS="$NETWORK_CREATE_ARGS --uuid $(uuidgen)"
+        fi
         # Create a small network in the API cell
         $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF network create "$PRIVATE_NETWORK_NAME" $FIXED_RANGE 1 $FIXED_NETWORK_SIZE $NETWORK_CREATE_ARGS
         # Everything else should go in the child cell

From c2dc95add6e46829f1705041c1d9dddab9b360d3 Mon Sep 17 00:00:00 2001
From: armando-migliaccio <armamig@gmail.com>
Date: Wed, 8 Apr 2015 23:32:17 -0700
Subject: [PATCH 0538/3333] Avoid flushing br-ex during stacking

This operation seems vestigial, as it was added to the code when stack.sh
did not have a robust cleanup procedure. These days, unstack.sh does destroy
all bridges, therefore during subsequent stack.sh runs (or even initially, from
a clean environment), the flush operation has become superfluous.

Its removal has also been deemeded necessary to enable certain multi-node
cloud deployments, like the one available in OpenStack infra [1].

[1] https://review.openstack.org/#/c/158525/

Change-Id: I6b4e5b82958e6d29dd450f1c4c9513f6a9e5053a
---
 lib/neutron_plugins/ovs_base | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 2997c6c25a..51999c60e4 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -93,11 +93,8 @@ function _neutron_ovs_base_configure_l3_agent {
         sudo ip link set $Q_PUBLIC_VETH_EX up
         sudo ip addr flush dev $Q_PUBLIC_VETH_EX
     else
-        # --no-wait causes a race condition if $PUBLIC_BRIDGE is not up when ip addr flush is called
         sudo ovs-vsctl -- --may-exist add-br $PUBLIC_BRIDGE
         sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
-        # ensure no IP is configured on the public bridge
-        sudo ip addr flush dev $PUBLIC_BRIDGE
     fi
 }
 

From 13a95a2dc1b429e5aa11148612b0f867fb75f1b0 Mon Sep 17 00:00:00 2001
From: Ghe Rivero <ghe.rivero@hp.com>
Date: Thu, 9 Apr 2015 10:23:58 +0200
Subject: [PATCH 0539/3333] Add ironic files to .gitignore

Add pxe booting related files to the .gitignore list

Change-Id: I08cfc98bcdd89f6a9a922f86c86551b661d69fff
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index c6900c881c..76ad830a5e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ files/*.qcow2
 files/images
 files/pip-*
 files/get-pip.py*
+files/ir-deploy*
 local.conf
 local.sh
 localrc

From f5b550ee2959a30f7e07271e596cee1d7346aa50 Mon Sep 17 00:00:00 2001
From: melanie witt <melwitt@yahoo-inc.com>
Date: Fri, 10 Apr 2015 22:20:07 +0000
Subject: [PATCH 0540/3333] Prevent setting tempest fixed_network_name for
 cells

Instead of creating a network in both the API cell and child cell,
let tempest use the old behavior of not querying networks from the
API for testing server create.

Change-Id: I9809d2b2e796ff1a5ea7e4f25bbeb21bd4817a72
---
 lib/tempest | 4 +++-
 stack.sh    | 7 -------
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index cd8fbd725f..dc5fb5130a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -340,7 +340,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
-    iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
+    if ! is_service_enabled n-cell; then
+        iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
+    fi
 
     # Compute Features
     # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
diff --git a/stack.sh b/stack.sh
index 5cdcbdf9d8..7a5cbcc1fc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1214,13 +1214,6 @@ if is_service_enabled q-svc; then
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}
     if is_service_enabled n-cell; then
-        # Both cells should have the same network uuid for server create
-        if [[ ! "$NETWORK_CREATE_ARGS" =~ "--uuid" ]]; then
-            NETWORK_CREATE_ARGS="$NETWORK_CREATE_ARGS --uuid $(uuidgen)"
-        fi
-        # Create a small network in the API cell
-        $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF network create "$PRIVATE_NETWORK_NAME" $FIXED_RANGE 1 $FIXED_NETWORK_SIZE $NETWORK_CREATE_ARGS
-        # Everything else should go in the child cell
         NM_CONF=${NOVA_CELLS_CONF}
     fi
 

From 93d09c24e35611cc7fc1ef8e6796d177d460fecc Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Sat, 11 Apr 2015 18:45:09 -0400
Subject: [PATCH 0541/3333] Setting LOGFILE to a file in root directory wipes
 everything

clean.sh picks the parent of LOGFILE and wipes it clean! So if you
set it to a log file in the users root directory, you lose everything

We should delete just the LOGFILE and cleanup LOGDIR and SCREEN_LOGDIR if
they are explicitly set.

Change-Id: I45745427dcaed3dcf0b78cc9ed680833d9d555e8
---
 clean.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index 035489c045..fa7d56fbac 100755
--- a/clean.sh
+++ b/clean.sh
@@ -114,9 +114,16 @@ sudo rm -f /etc/tgt/conf.d/*
 cleanup_rpc_backend
 cleanup_database
 
-# Clean out data, logs and status
-LOGDIR=$(dirname "$LOGFILE")
-sudo rm -rf $DATA_DIR $LOGDIR $DEST/status
+# Clean out data and status
+sudo rm -rf $DATA_DIR $DEST/status
+
+# Clean out the log file and log directories
+if [[ -n "$LOGFILE" ]] && [[ -f "$LOGFILE" ]]; then
+    sudo rm -f $LOGFILE
+fi
+if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
+    sudo rm -rf $LOGDIR
+fi
 if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
     sudo rm -rf $SCREEN_LOGDIR
 fi

From 8768ee39c4775b656304169e18acce3c3c0dd095 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <pshchelokovskyy@mirantis.com>
Date: Sun, 12 Apr 2015 10:23:08 +0000
Subject: [PATCH 0542/3333] Ignore *.img images in files folder

Some (qcow) images have .img file name extension (e.g. Cirros).
Ignore such files in files/ folder too (as we already do
with .qcow2 and .gz images).

Change-Id: Iac8593b65205e25fd3f94244a136c584d9af8eab
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index c6900c881c..afc221ffa6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@ doc/files
 doc/build
 files/*.gz
 files/*.qcow2
+files/*.img
 files/images
 files/pip-*
 files/get-pip.py*

From e53e15845144533debc48b32620d420d9f0ece4e Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Tue, 7 Apr 2015 16:44:54 +0200
Subject: [PATCH 0543/3333] Fix readme for multi-node setup

The readme currently states that a compute node in a multi-node setup
requires the glance-api service to be enabled. But actually
the glance-api service is only required on the controller node where
glance-registry is running.
Running the glance-api service on a node without glance-registry will
even lead to a failure of glance-api, as the glance cache directory
will not be created without enabling glance-registry.

Change-Id: Ie92533f3333f3fe3e2d747762e60f2f42a233e79
Closes-bug: #1441198
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 53de970763..faf2d93de7 100644
--- a/README.md
+++ b/README.md
@@ -333,7 +333,7 @@ will balance VMs across hosts:
 You can then run many compute nodes, each of which should have a `stackrc`
 which includes the following, with the IP address of the above controller node:
 
-    ENABLED_SERVICES=n-cpu,rabbit,g-api,neutron,q-agt
+    ENABLED_SERVICES=n-cpu,rabbit,neutron,q-agt
     SERVICE_HOST=[IP of controller node]
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST

From 9a808922c194929bff88bdc7dca4f8e2431de1a4 Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Wed, 8 Apr 2015 19:48:09 +0000
Subject: [PATCH 0544/3333] Use openstack CLI instead of keystone

When running './stack.sh' messages are output stating that
the keystone CLI has been deprecated. These calls should be
replaced to ones utilizing the openstack CLI program instead.

Documentation examples were also updated to reflect the new syntax.

Change-Id: Ib20b8940e317d150e5f6febb618e20bd85d13f8b
Closes-Bug: #1441340
---
 doc/source/eucarc.rst               |  6 +++---
 doc/source/guides/multinode-lab.rst | 26 +++++++++++++-------------
 eucarc                              |  4 ++--
 exercises/client-args.sh            |  2 +-
 lib/ironic                          |  2 +-
 stack.sh                            |  2 +-
 tools/upload_image.sh               |  2 +-
 7 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/doc/source/eucarc.rst b/doc/source/eucarc.rst
index 1284b8883b..c2ecbc6732 100644
--- a/doc/source/eucarc.rst
+++ b/doc/source/eucarc.rst
@@ -13,7 +13,7 @@ EC2\_URL
 
     ::
 
-        EC2_URL=$(keystone catalog --service ec2 | awk '/ publicURL / { print $4 }')
+        EC2_URL=$(openstack catalog show ec2 | awk '/ publicURL: / { print $4 }')
 
 S3\_URL
     Set the S3 endpoint for euca2ools. The endpoint is extracted from
@@ -21,14 +21,14 @@ S3\_URL
 
     ::
 
-        export S3_URL=$(keystone catalog --service s3 | awk '/ publicURL / { print $4 }')
+        export S3_URL=$(openstack catalog show s3 | awk '/ publicURL: / { print $4 }')
 
 EC2\_ACCESS\_KEY, EC2\_SECRET\_KEY
     Create EC2 credentials for the current tenant:user in Keystone.
 
     ::
 
-        CREDS=$(keystone ec2-credentials-create)
+        CREDS=$(openstack ec2 credentials create)
         export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
         export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index ff81c93975..d963243fa8 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -229,10 +229,10 @@ Additional Users
 ----------------
 
 DevStack creates two OpenStack users (``admin`` and ``demo``) and two
-tenants (also ``admin`` and ``demo``). ``admin`` is exactly what it
+projects (also ``admin`` and ``demo``). ``admin`` is exactly what it
 sounds like, a privileged administrative account that is a member of
-both the ``admin`` and ``demo`` tenants. ``demo`` is a normal user
-account that is only a member of the ``demo`` tenant. Creating
+both the ``admin`` and ``demo`` projects. ``demo`` is a normal user
+account that is only a member of the ``demo`` project. Creating
 additional OpenStack users can be done through the dashboard, sometimes
 it is easier to do them in bulk from a script, especially since they get
 blown away every time ``stack.sh`` runs. The following steps are ripe
@@ -243,21 +243,21 @@ for scripting:
     # Get admin creds
     . openrc admin admin
 
-    # List existing tenants
-    keystone tenant-list
+    # List existing projects
+    openstack project list
 
     # List existing users
-    keystone user-list
+    openstack user list
 
-    # Add a user and tenant
+    # Add a user and project
     NAME=bob
     PASSWORD=BigSecrete
-    TENANT=$NAME
-    keystone tenant-create --name=$NAME
-    keystone user-create --name=$NAME --pass=$PASSWORD
-    keystone user-role-add --user-id=<bob-user-id> --tenant-id=<bob-tenant-id> --role-id=<member-role-id>
-    # member-role-id comes from the existing member role created by stack.sh
-    # keystone role-list
+    PROJECT=$NAME
+    openstack project create $PROJECT
+    openstack user create $NAME --password=$PASSWORD --project $PROJECT
+    openstack role add Member --user $NAME --project $PROJECT
+    # The Member role is created by stack.sh
+    # openstack role list
 
 Swift
 -----
diff --git a/eucarc b/eucarc
index 343f4ccde2..1e672bd932 100644
--- a/eucarc
+++ b/eucarc
@@ -19,7 +19,7 @@ RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source $RC_DIR/openrc
 
 # Set the ec2 url so euca2ools works
-export EC2_URL=$(keystone catalog --service ec2 | awk '/ publicURL / { print $4 }')
+export EC2_URL=$(openstack catalog show ec2 | awk '/ publicURL: / { print $4 }')
 
 # Create EC2 credentials for the current user
 CREDS=$(openstack ec2 credentials create)
@@ -29,7 +29,7 @@ export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
 # Euca2ools Certificate stuff for uploading bundles
 # See exercises/bundle.sh to see how to get certs using nova cli
 NOVA_KEY_DIR=${NOVA_KEY_DIR:-$RC_DIR}
-export S3_URL=$(keystone catalog --service s3 | awk '/ publicURL / { print $4 }')
+export S3_URL=$(openstack catalog show s3 | awk '/ publicURL: / { print $4 }')
 export EC2_USER_ID=42 # nova does not use user id, but bundling requires it
 export EC2_PRIVATE_KEY=${NOVA_KEY_DIR}/pk.pem
 export EC2_CERT=${NOVA_KEY_DIR}/cert.pem
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 2f85d98d8f..c33ef44e9a 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -69,7 +69,7 @@ if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
         STATUS_KEYSTONE="Skipped"
     else
         echo -e "\nTest Keystone"
-        if keystone $TENANT_ARG $ARGS catalog --service identity; then
+        if openstack $TENANT_ARG $ARGS catalog show identity; then
             STATUS_KEYSTONE="Succeeded"
         else
             STATUS_KEYSTONE="Failed"
diff --git a/lib/ironic b/lib/ironic
index 7afed052e9..4ac0100410 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -765,7 +765,7 @@ function upload_baremetal_ironic_deploy {
         fi
     fi
 
-    local token=$(keystone token-get | grep ' id ' | get_field 2)
+    local token=$(openstack token issue -c id -f value)
     die_if_not_set $LINENO token "Keystone fail to get token"
 
     # load them into glance
diff --git a/stack.sh b/stack.sh
index 9ecc49c7ca..af44feb901 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1173,7 +1173,7 @@ fi
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
 if is_service_enabled g-reg; then
-    TOKEN=$(keystone token-get | grep ' id ' | get_field 2)
+    TOKEN=$(openstack token issue -c id -f value)
     die_if_not_set $LINENO TOKEN "Keystone fail to get token"
 
     echo_summary "Uploading images"
diff --git a/tools/upload_image.sh b/tools/upload_image.sh
index 5d23f31b9c..19c6b71976 100755
--- a/tools/upload_image.sh
+++ b/tools/upload_image.sh
@@ -32,7 +32,7 @@ if [[ -z "$1" ]]; then
 fi
 
 # Get a token to authenticate to glance
-TOKEN=$(keystone token-get | grep ' id ' | get_field 2)
+TOKEN=$(openstack token issue -c id -f value)
 die_if_not_set $LINENO TOKEN "Keystone fail to get token"
 
 # Glance connection info.  Note the port must be specified.

From e6843e5ea1d97c194536d1fc54e909ef9aa3740c Mon Sep 17 00:00:00 2001
From: ajmiller <al.miller@ajmiller.net>
Date: Sat, 11 Apr 2015 09:52:48 -0700
Subject: [PATCH 0545/3333] clean.sh needs to load plugin settings.

Change-Id: Id957f585d2aa93075b138d462d6076d2d70d450e
---
 clean.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/clean.sh b/clean.sh
index 035489c045..78f4cbf500 100755
--- a/clean.sh
+++ b/clean.sh
@@ -76,6 +76,7 @@ fi
 # ==========
 
 # Phase: clean
+load_plugin_settings
 run_phase clean
 
 if [[ -d $TOP_DIR/extras.d ]]; then

From c00d2a53136d4d37a519829c4c9cad668fa69a44 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 9 Apr 2015 19:57:13 +1000
Subject: [PATCH 0546/3333] run dstat with run_process

It is not clear to me why this can't use run_process?  Currently we
end up with two log-files both with the same thing

- dstat.txt.gz which comes from the "tee" and is symlinked into
  SCREEN_LOGDIR, so gets picked-up by the gate scripts
- screen-dstat.txt.gz which comes from screen_it

Change-Id: I00b9e09b8d44f72ff14e69dc6e4a4bd5e2a0439e
---
 lib/dstat | 22 ++--------------------
 1 file changed, 2 insertions(+), 20 deletions(-)

diff --git a/lib/dstat b/lib/dstat
index c8faa6578c..4b22752ced 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -16,34 +16,16 @@
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-
-# Defaults
-# --------
-# for DSTAT logging
-DSTAT_FILE=${DSTAT_FILE:-"dstat.log"}
-
-
 # start_dstat() - Start running processes, including screen
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
-    if [[ -n ${LOGDIR} ]]; then
-        screen_it dstat "cd $TOP_DIR; dstat $DSTAT_OPTS | tee $LOGDIR/$DSTAT_FILE"
-        if [[ -n ${SCREEN_LOGDIR} && ${SCREEN_LOGDIR} != ${LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf $LOGDIR/$DSTAT_FILE ${SCREEN_LOGDIR}/$DSTAT_FILE
-        fi
-    else
-        screen_it dstat "dstat $DSTAT_OPTS"
-    fi
+    run_process dstat "dstat $DSTAT_OPTS"
 }
 
 # stop_dstat() stop dstat process
 function stop_dstat {
-    # dstat runs as a console, not as a service, and isn't trackable
-    # via the normal mechanisms for DevStack. So lets just do a
-    # killall and move on.
-    killall dstat || /bin/true
+    stop_process dstat
 }
 
 # Restore xtrace

From 5ccbd0ae0fd9d8caace3a9e0533b9c7a2f0ff579 Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Fri, 6 Feb 2015 16:22:12 -0800
Subject: [PATCH 0547/3333] Switching Sahara to https in case of USE_SSL=True

Sahara will work over https in case if USE_SSL is set.

Note, this patch requires https://review.openstack.org/#/c/145383/
which is not merged yet.

Change-Id: I9e0069cfe72323a069a4205ca2f882c7a3ad17e0
Closes-Bug: #1419162
---
 lib/sahara | 11 +++++++++++
 stack.sh   |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/sahara b/lib/sahara
index 0651b0a633..6a3a5180bf 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -33,6 +33,9 @@ SAHARA_DIR=$DEST/sahara
 SAHARA_CONF_DIR=${SAHARA_CONF_DIR:-/etc/sahara}
 SAHARA_CONF_FILE=${SAHARA_CONF_DIR}/sahara.conf
 
+if is_ssl_enabled_service "sahara"; then
+    SAHARA_SERVICE_PROTOCOL="https"
+fi
 SAHARA_SERVICE_HOST=${SAHARA_SERVICE_HOST:-$SERVICE_HOST}
 SAHARA_SERVICE_PORT=${SAHARA_SERVICE_PORT:-8386}
 SAHARA_SERVICE_PROTOCOL=${SAHARA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
@@ -165,6 +168,14 @@ function configure_sahara {
         iniset $SAHARA_CONF_FILE keystone ca_file $SSL_BUNDLE_FILE
     fi
 
+    # Register SSL certificates if provided
+    if is_ssl_enabled_service sahara; then
+        ensure_certificates SAHARA
+
+        iniset $SAHARA_CONF_FILE ssl cert_file "$SAHARA_SSL_CERT"
+        iniset $SAHARA_CONF_FILE ssl key_file "$SAHARA_SSL_KEY"
+    fi
+
     iniset $SAHARA_CONF_FILE DEFAULT use_syslog $SYSLOG
 
     # Format logging
diff --git a/stack.sh b/stack.sh
index 5cdcbdf9d8..a9d958de5e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -505,7 +505,7 @@ source $TOP_DIR/lib/rpc_backend
 check_rpc_backend
 
 # Service to enable with SSL if ``USE_SSL`` is True
-SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron"
+SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron,sahara"
 
 if is_service_enabled tls-proxy && [ "$USE_SSL" == "True" ]; then
     die $LINENO "tls-proxy and SSL are mutually exclusive"

From 0479d37878ee96a1a4f3fc37dce341d782bb6cfd Mon Sep 17 00:00:00 2001
From: Andrew Lazarev <alazarev@mirantis.com>
Date: Mon, 9 Feb 2015 16:51:25 -0800
Subject: [PATCH 0548/3333] Added support of sahara with tls-proxy service

Now devstack will configure tls-proxy for sahara as well as for
other openstack services.

Change-Id: I7b0f2f0773cd3619a33cac66d40f3d0ce0f5432c
Closes-Bug: #1419163
---
 lib/sahara | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/lib/sahara b/lib/sahara
index 6a3a5180bf..6d4e8648bf 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -33,11 +33,12 @@ SAHARA_DIR=$DEST/sahara
 SAHARA_CONF_DIR=${SAHARA_CONF_DIR:-/etc/sahara}
 SAHARA_CONF_FILE=${SAHARA_CONF_DIR}/sahara.conf
 
-if is_ssl_enabled_service "sahara"; then
+if is_ssl_enabled_service "sahara" || is_service_enabled tls-proxy; then
     SAHARA_SERVICE_PROTOCOL="https"
 fi
 SAHARA_SERVICE_HOST=${SAHARA_SERVICE_HOST:-$SERVICE_HOST}
 SAHARA_SERVICE_PORT=${SAHARA_SERVICE_PORT:-8386}
+SAHARA_SERVICE_PORT_INT=${SAHARA_SERVICE_PORT_INT:-18386}
 SAHARA_SERVICE_PROTOCOL=${SAHARA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 SAHARA_AUTH_CACHE_DIR=${SAHARA_AUTH_CACHE_DIR:-/var/cache/sahara}
@@ -183,6 +184,11 @@ function configure_sahara {
         setup_colorized_logging $SAHARA_CONF_FILE DEFAULT
     fi
 
+    if is_service_enabled tls-proxy; then
+        # Set the service port for a proxy to take the original
+        iniset $SAHARA_CONF DEFAULT port $SAHARA_SERVICE_PORT_INT
+    fi
+
     recreate_database sahara
     $SAHARA_BIN_DIR/sahara-db-manage --config-file $SAHARA_CONF_FILE upgrade head
 }
@@ -214,9 +220,26 @@ function sahara_register_images {
 
 # start_sahara() - Start running processes, including screen
 function start_sahara {
+    local service_port=$SAHARA_SERVICE_PORT
+    local service_protocol=$SAHARA_SERVICE_PROTOCOL
+    if is_service_enabled tls-proxy; then
+        service_port=$SAHARA_SERVICE_PORT_INT
+        service_protocol="http"
+    fi
+
     run_process sahara "$SAHARA_BIN_DIR/sahara-all --config-file $SAHARA_CONF_FILE"
     run_process sahara-api "$SAHARA_BIN_DIR/sahara-api --config-file $SAHARA_CONF_FILE"
     run_process sahara-eng "$SAHARA_BIN_DIR/sahara-engine --config-file $SAHARA_CONF_FILE"
+
+    echo "Waiting for Sahara to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$SAHARA_SERVICE_HOST:$service_port; then
+        die $LINENO "Sahara did not start"
+    fi
+
+    # Start proxies if enabled
+    if is_service_enabled tls-proxy; then
+        start_tls_proxy '*' $SAHARA_SERVICE_PORT $SAHARA_SERVICE_HOST $SAHARA_SERVICE_PORT_INT &
+    fi
 }
 
 # stop_sahara() - Stop running processes

From 73af846ca064f214828c9833ab83561be53a1be4 Mon Sep 17 00:00:00 2001
From: Thiago Paiva <thiagop@lsd.ufcg.edu.br>
Date: Tue, 14 Apr 2015 16:57:22 -0300
Subject: [PATCH 0549/3333] Fixing n-crt removal from stackrc

The commit 279cfe75198c723519f1fb361b2bff3c641c6cef removed the n-crt
service from the default devstack setup. As such, the stack.sh script
begun to thrown the following error when trying to "nova x509-create-cert":

  ERROR (ClientException): The server has either erred or is incapable of
  performing the requested operation. (HTTP 500)

This patches reintroduces the n-crt as a default service.

Change-Id: Id9695a37e1c6df567f2c86baa4475225adcfb0ee
Closes-bug: #1441007
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index abedb001d1..0b93d32358 100644
--- a/stackrc
+++ b/stackrc
@@ -49,7 +49,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc
+    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder

From c39f6405254b100fbfc0f2471bf85b74aafa3282 Mon Sep 17 00:00:00 2001
From: Lianhao Lu <lianhao.lu@intel.com>
Date: Tue, 24 Mar 2015 12:36:00 +0800
Subject: [PATCH 0550/3333] Added ceilometer-agent-ipmi support

Enable devstack to start ceilometer-agent-ipmi.

Change-Id: Ia5f4c78760415a50f329fc2f1cf2f20be2e3c221
Closes-Bug: #1410614
---
 lib/ceilometer | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index dba92ba542..3a4a4fb167 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -13,6 +13,26 @@
 #
 #   enable_service ceilometer-alarm-notifier ceilometer-alarm-evaluator
 #
+# To enable Ceilometer to collect the IPMI based meters, further add to the
+# localrc section of local.conf:
+#
+#   enable_service ceilometer-aipmi
+#
+# NOTE: Currently, there are two ways to get the IPMI based meters in
+# OpenStack. One way is to configure Ironic conductor to report those meters
+# for the nodes managed by Ironic and to have Ceilometer notification
+# agent to collect them. Ironic by default does NOT enable that reporting
+# functionality. So in order to do so, users need to set the option of
+# conductor.send_sensor_data to true in the ironic.conf configuration file
+# for the Ironic conductor service, and also enable the
+# ceilometer-anotification service.
+#
+# The other way is to use Ceilometer ipmi agent only to get the IPMI based
+# meters. To avoid duplicated meters, users need to make sure to set the
+# option of conductor.send_sensor_data to false in the ironic.conf
+# configuration file if the node on which Ceilometer ipmi agent is running
+# is also managed by Ironic.
+#
 # Several variables set in the localrc section adjust common behaviors
 # of Ceilometer (see within for additional settings):
 #
@@ -231,6 +251,11 @@ function configure_ceilometer {
         iniset $CEILOMETER_CONF api pecan_debug "False"
         _config_ceilometer_apache_wsgi
     fi
+
+    if is_service_enabled ceilometer-aipmi; then
+        # Configure rootwrap for the ipmi agent
+        configure_rootwrap ceilometer $CEILOMETER_BIN_DIR/ceilometer-rootwrap $CEILOMETER_DIR/etc/ceilometer
+    fi
 }
 
 function configure_mongodb {
@@ -327,6 +352,7 @@ function start_ceilometer {
     run_process ceilometer-acentral "ceilometer-agent-central --config-file $CEILOMETER_CONF"
     run_process ceilometer-anotification "ceilometer-agent-notification --config-file $CEILOMETER_CONF"
     run_process ceilometer-collector "ceilometer-collector --config-file $CEILOMETER_CONF"
+    run_process ceilometer-aipmi "ceilometer-agent-ipmi --config-file $CEILOMETER_CONF"
 
     if [[ "$CEILOMETER_USE_MOD_WSGI" == "False" ]]; then
         run_process ceilometer-api "ceilometer-api -d -v --log-dir=$CEILOMETER_API_LOG_DIR --config-file $CEILOMETER_CONF"
@@ -366,7 +392,7 @@ function stop_ceilometer {
         restart_apache_server
     fi
     # Kill the ceilometer screen windows
-    for serv in ceilometer-acompute ceilometer-acentral ceilometer-anotification ceilometer-collector ceilometer-api ceilometer-alarm-notifier ceilometer-alarm-evaluator; do
+    for serv in ceilometer-acompute ceilometer-acentral ceilometer-aipmi ceilometer-anotification ceilometer-collector ceilometer-api ceilometer-alarm-notifier ceilometer-alarm-evaluator; do
         stop_process $serv
     done
 }

From 37b779c3bc40bbd72cb2f55d15d5b2d43a3bb03d Mon Sep 17 00:00:00 2001
From: Lianhao Lu <lianhao.lu@intel.com>
Date: Wed, 15 Apr 2015 10:27:06 +0800
Subject: [PATCH 0551/3333] Acknowledge API_WORKERS in glance-registry

Change-Id: Ifaf671439480719255c07673b54dc49c0c2ca4f6
Closes-Bug: #1444231
---
 lib/glance | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/glance b/lib/glance
index 578c88ab22..a15e1e722a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -100,6 +100,7 @@ function configure_glance {
     local dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF DEFAULT sql_connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
+    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then

From b28b27082c63bc701b4cad8f9c686ba2c1880e6e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2015 08:43:43 +1000
Subject: [PATCH 0552/3333] Append command to screenrc after we update it

If a group is specified we modify the command to run under "sg".  This
currently isn't reflected in screenrc so rejoining fails

Change-Id: I5c18ba664a6ae9ba9aaa4439a9086bc85085cd75
Closes-Bug: #1444267
---
 functions-common | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index f8543c1f98..24a462ac21 100644
--- a/functions-common
+++ b/functions-common
@@ -1235,9 +1235,6 @@ function screen_process {
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
     USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
-    # Append the process to the screen rc file
-    screen_rc "$name" "$command"
-
     screen -S $SCREEN_NAME -X screen -t $name
 
     local real_logfile="${LOGDIR}/${name}.log.${CURRENT_LOG_TIME}"
@@ -1277,6 +1274,10 @@ function screen_process {
     if [[ -n "$group" ]]; then
         command="sg $group '$command'"
     fi
+
+    # Append the process to the screen rc file
+    screen_rc "$name" "$command"
+
     screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
 }
 

From cae97da9c7786990acb12c43f691483f549a2945 Mon Sep 17 00:00:00 2001
From: Shilla Saebi <shilla.saebi@gmail.com>
Date: Thu, 16 Apr 2015 13:58:56 -0400
Subject: [PATCH 0553/3333] doc changes to devstack overview.rst

changed to comply with doc conventions
When referring to services, use "Compute," "Image service"
and "Identity" instead of "nova," "glance," and "keystone."
Use the project names like "nova" and "keystone"
glance is officially Image service not storage
removed extra .

Change-Id: I39457c20dc2ede775fe3f3c63077133fbb6c917b
---
 doc/source/overview.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 23ccf27d0a..d245035a1a 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -7,7 +7,7 @@ and alternative platforms and support services. That evolution has grown
 well beyond what was originally intended and the majority of
 configuration combinations are rarely, if ever, tested. DevStack is not
 a general OpenStack installer and was never meant to be everything to
-everyone..
+everyone.
 
 Below is a list of what is specifically is supported (read that as
 "tested") going forward.
@@ -58,7 +58,7 @@ Web Server
 OpenStack Network
 -----------------
 
-*Default to Nova Network, optionally use Neutron*
+*Defaults to nova network, optionally use neutron*
 
 -  Nova Network: FlatDHCP
 -  Neutron: A basic configuration approximating the original FlatDHCP
@@ -67,10 +67,10 @@ OpenStack Network
 Services
 --------
 
-The default services configured by DevStack are Identity (Keystone),
-Object Storage (Swift), Image Storage (Glance), Block Storage (Cinder),
-Compute (Nova), Network (Nova), Dashboard (Horizon), Orchestration
-(Heat)
+The default services configured by DevStack are Identity (keystone),
+Object Storage (swift), Image Service (glance), Block Storage (cinder),
+Compute (nova), Networking (nova), Dashboard (horizon), Orchestration
+(heat)
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call

From dd62293591fd1e822f59754cece645639a4d2d2c Mon Sep 17 00:00:00 2001
From: Wayne Okuma <wayne.okuma@hp.com>
Date: Tue, 31 Mar 2015 00:28:39 -0700
Subject: [PATCH 0554/3333] Catalog Index Service - glance devstack

Implements: blueprint catalog-index-service

The changes to lib/glance incorporate the new g-search service.
The g-search service is optional.
To enable it add the following line to devstack/local.conf:
enable_service g-search

In addition to deploying g-search, the changes will also populate a
search type of keystone service and adds in appropriate endpoints.

Change-Id: I0272d56bc2e50e8174db78bd449f65f60f7f4000
---
 lib/glance           | 92 ++++++++++++++++++++++++++++++++++++++------
 pkg/elasticsearch.sh |  2 +
 2 files changed, 83 insertions(+), 11 deletions(-)

diff --git a/lib/glance b/lib/glance
index 578c88ab22..5a96a61d18 100644
--- a/lib/glance
+++ b/lib/glance
@@ -49,8 +49,10 @@ GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_REGISTRY_CONF=$GLANCE_CONF_DIR/glance-registry.conf
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
+GLANCE_SEARCH_CONF=$GLANCE_CONF_DIR/glance-search.conf
 GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
+GLANCE_SEARCH_PASTE_INI=$GLANCE_CONF_DIR/glance-search-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
@@ -67,6 +69,9 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_SEARCH_PORT=${GLANCE_SEARCH_PORT:-9393}
+GLANCE_SEARCH_PORT_INT=${GLANCE_SEARCH_PORT_INT:-19393}
+GLANCE_SEARCH_HOSTPORT=${GLANCE_SEARCH_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SEARCH_PORT}
 
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,glance
@@ -87,6 +92,10 @@ function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
     sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
+
+    if is_service_enabled g-search; then
+        ${TOP_DIR}/pkg/elasticsearch.sh stop
+    fi
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -218,14 +227,38 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    # Configure search
+    if is_service_enabled g-search; then
+        cp $GLANCE_DIR/etc/glance-search.conf $GLANCE_SEARCH_CONF
+        iniset $GLANCE_SEARCH_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        inicomment $GLANCE_SEARCH_CONF DEFAULT log_file
+        iniset $GLANCE_SEARCH_CONF DEFAULT use_syslog $SYSLOG
+        iniset $GLANCE_SEARCH_CONF DEFAULT sql_connection $dburl
+        iniset $GLANCE_SEARCH_CONF paste_deploy flavor keystone
+        configure_auth_token_middleware $GLANCE_SEARCH_CONF glance $GLANCE_AUTH_CACHE_DIR/search
+
+        if is_service_enabled tls-proxy; then
+            iniset $GLANCE_SEARCH_CONF DEFAULT bind_port $GLANCE_SEARCH_PORT_INT
+        fi
+        # Register SSL certificates if provided
+        if is_ssl_enabled_service glance; then
+            ensure_certificates GLANCE
+            iniset $GLANCE_SEARCH_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
+            iniset $GLANCE_SEARCH_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
+        fi
+
+        cp $GLANCE_DIR/etc/glance-search-paste.ini $GLANCE_SEARCH_PASTE_INI
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
 
-# Project              User         Roles
-# ------------------------------------------------------------------
-# SERVICE_TENANT_NAME  glance       service
-# SERVICE_TENANT_NAME  glance-swift ResellerAdmin (if Swift is enabled)
+# Project              User            Roles
+# ---------------------------------------------------------------------
+# SERVICE_TENANT_NAME  glance          service
+# SERVICE_TENANT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
+# SERVICE_TENANT_NAME  glance-search   search (if Search is enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -251,13 +284,27 @@ function create_glance_accounts {
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
         fi
     fi
+
+    # Add glance-search service and endpoints
+    if is_service_enabled g-search; then
+        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
+            local glance_search_service=$(get_or_create_service "glance-search" \
+                "search" "EXPERIMENTAL - Glance Graffiti Search Service")
+
+            get_or_create_endpoint $glance_search_service \
+                "$REGION_NAME" \
+                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
+                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
+                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT"
+        fi
+    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
 function create_glance_cache_dir {
     # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/*
+    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search
+    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/*
 }
 
 # init_glance() - Initialize databases, etc.
@@ -280,6 +327,12 @@ function init_glance {
     $GLANCE_BIN_DIR/glance-manage db_load_metadefs
 
     create_glance_cache_dir
+
+    # Init glance search by exporting found metadefs/images to elasticsearch
+    if is_service_enabled g-search; then
+        ${TOP_DIR}/pkg/elasticsearch.sh start
+        $GLANCE_BIN_DIR/glance-index
+    fi
 }
 
 # install_glanceclient() - Collect source and prepare
@@ -301,11 +354,13 @@ function install_glance {
     fi
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
-    setup_develop $GLANCE_DIR
-    if is_service_enabled g-graffiti; then
+
+    if is_service_enabled g-search; then
         ${TOP_DIR}/pkg/elasticsearch.sh download
         ${TOP_DIR}/pkg/elasticsearch.sh install
     fi
+
+    setup_develop $GLANCE_DIR
 }
 
 # start_glance() - Start running processes, including screen
@@ -314,18 +369,29 @@ function start_glance {
     if is_service_enabled tls-proxy; then
         start_tls_proxy '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT &
         start_tls_proxy '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT &
+
+        # Handle g-search
+        if is_service_enabled g-search; then
+            start_tls_proxy '*' $GLANCE_SEARCH_PORT $GLANCE_SERVICE_HOST $GLANCE_SEARCH_PORT_INT &
+        fi
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
 
-    if is_service_enabled g-graffiti; then
-        ${TOP_DIR}/pkg/elasticsearch.sh start
-    fi
     echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
+
+    # Start g-search after g-reg/g-api
+    if is_service_enabled g-search; then
+        run_process g-search "$GLANCE_BIN_DIR/glance-search --config-file=$GLANCE_CONF_DIR/glance-search.conf"
+        echo "Waiting for g-search ($GLANCE_SEARCH_HOSTPORT) to start..."
+        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT; then
+            die $LINENO "g-search did not start"
+        fi
+    fi
 }
 
 # stop_glance() - Stop running processes
@@ -333,6 +399,10 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
+
+    if is_service_enabled g-search; then
+        stop_process g-search
+    fi
 }
 
 # Restore xtrace
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 29dc22fb88..79f67a0179 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -7,6 +7,8 @@
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 FILES=$TOP_DIR/files
 source $TOP_DIR/functions
+DEST=${DEST:-/opt/stack}
+source $TOP_DIR/lib/infra
 
 # Package source and version, all pkg files are expected to have
 # something like this, as well as a way to override them.

From 1cb809d8ef81931ea0b1f15619b7e830281f2556 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 12:55:38 +1000
Subject: [PATCH 0555/3333] Add "passed" and "failed" functions

Add two generic "passed" and "failed" functions to the unittest
helper.  Also keep a count of passed and failed tests.  Later changes
will use these functions to ensure they exit with a correct return
code.

Change-Id: I8574dcb1447b04fcda3d72df0bf8605cf7488d3c
---
 tests/unittest.sh | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/tests/unittest.sh b/tests/unittest.sh
index 435cc3a58b..69f19b7dae 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -14,8 +14,30 @@
 
 # we always start with no errors
 ERROR=0
+PASS=0
 FAILED_FUNCS=""
 
+function passed {
+    local lineno=$(caller 0 | awk '{print $1}')
+    local function=$(caller 0 | awk '{print $2}')
+    local msg="$1"
+    if [ -z "$msg" ]; then
+        msg="OK"
+    fi
+    PASS=$((PASS+1))
+    echo $function:L$lineno $msg
+}
+
+function failed {
+    local lineno=$(caller 0 | awk '{print $1}')
+    local function=$(caller 0 | awk '{print $2}')
+    local msg="$1"
+    FAILED_FUNCS+="$function:L$lineno\n"
+    echo "ERROR: $function:L$lineno!"
+    echo "   $msg"
+    ERROR=$((ERROR+1))
+}
+
 function assert_equal {
     local lineno=`caller 0 | awk '{print $1}'`
     local function=`caller 0 | awk '{print $2}'`
@@ -24,16 +46,20 @@ function assert_equal {
         FAILED_FUNCS+="$function:L$lineno\n"
         echo "ERROR: $1 != $2 in $function:L$lineno!"
         echo "  $msg"
-        ERROR=1
+        ERROR=$((ERROR+1))
     else
+        PASS=$((PASS+1))
         echo "$function:L$lineno - ok"
     fi
 }
 
 function report_results {
-    if [[ $ERROR -eq 1 ]]; then
-        echo "Tests FAILED"
-        echo $FAILED_FUNCS
+    echo "$PASS Tests PASSED"
+    if [[ $ERROR -gt 1 ]]; then
+        echo
+        echo "The following $ERROR tests FAILED"
+        echo -e "$FAILED_FUNCS"
+        echo "---"
         exit 1
     fi
 }

From f56348bcb2c736b9e66ebfe20c1f118cfc96b9f6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 12:58:56 +1000
Subject: [PATCH 0556/3333] Use unittest help in test_ip.sh

Use the unittest helper to track test runs and correctly exit with a
failure code if there is a problem

Change-Id: Ie62f354a8cd3b8fd5986e6943a073f7955fb55ba
---
 tests/test_ip.sh | 79 +++++++++++++++++++++++++-----------------------
 1 file changed, 41 insertions(+), 38 deletions(-)

diff --git a/tests/test_ip.sh b/tests/test_ip.sh
index add8d1ae65..c53e80de36 100755
--- a/tests/test_ip.sh
+++ b/tests/test_ip.sh
@@ -8,108 +8,111 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 # Import common functions
 source $TOP/functions
 
+source $TOP/tests/unittest.sh
 
 echo "Testing IP addr functions"
 
 if [[ $(cidr2netmask 4) == 240.0.0.0 ]]; then
-    echo "cidr2netmask(): /4...OK"
+    passed "cidr2netmask(): /4...OK"
 else
-    echo "cidr2netmask(): /4...failed"
+    failed "cidr2netmask(): /4...failed"
 fi
 if [[ $(cidr2netmask 8) == 255.0.0.0 ]]; then
-    echo "cidr2netmask(): /8...OK"
+    passed "cidr2netmask(): /8...OK"
 else
-    echo "cidr2netmask(): /8...failed"
+    failed "cidr2netmask(): /8...failed"
 fi
 if [[ $(cidr2netmask 12) == 255.240.0.0 ]]; then
-    echo "cidr2netmask(): /12...OK"
+    passed "cidr2netmask(): /12...OK"
 else
-    echo "cidr2netmask(): /12...failed"
+    failed "cidr2netmask(): /12...failed"
 fi
 if [[ $(cidr2netmask 16) == 255.255.0.0 ]]; then
-    echo "cidr2netmask(): /16...OK"
+    passed "cidr2netmask(): /16...OK"
 else
-    echo "cidr2netmask(): /16...failed"
+    failed "cidr2netmask(): /16...failed"
 fi
 if [[ $(cidr2netmask 20) == 255.255.240.0 ]]; then
-    echo "cidr2netmask(): /20...OK"
+    passed "cidr2netmask(): /20...OK"
 else
-    echo "cidr2netmask(): /20...failed"
+    failed "cidr2netmask(): /20...failed"
 fi
 if [[ $(cidr2netmask 24) == 255.255.255.0 ]]; then
-    echo "cidr2netmask(): /24...OK"
+    passed "cidr2netmask(): /24...OK"
 else
-    echo "cidr2netmask(): /24...failed"
+    failed "cidr2netmask(): /24...failed"
 fi
 if [[ $(cidr2netmask 28) == 255.255.255.240 ]]; then
-    echo "cidr2netmask(): /28...OK"
+    passed "cidr2netmask(): /28...OK"
 else
-    echo "cidr2netmask(): /28...failed"
+    failed "cidr2netmask(): /28...failed"
 fi
 if [[ $(cidr2netmask 30) == 255.255.255.252 ]]; then
-    echo "cidr2netmask(): /30...OK"
+    passed "cidr2netmask(): /30...OK"
 else
-    echo "cidr2netmask(): /30...failed"
+    failed "cidr2netmask(): /30...failed"
 fi
 if [[ $(cidr2netmask 32) == 255.255.255.255 ]]; then
-    echo "cidr2netmask(): /32...OK"
+    passed "cidr2netmask(): /32...OK"
 else
-    echo "cidr2netmask(): /32...failed"
+    failed "cidr2netmask(): /32...failed"
 fi
 
 if [[ $(maskip 169.254.169.254 240.0.0.0) == 160.0.0.0 ]]; then
-    echo "maskip(): /4...OK"
+    passed "maskip(): /4...OK"
 else
-    echo "maskip(): /4...failed"
+    failed "maskip(): /4...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.0.0.0) == 169.0.0.0 ]]; then
-    echo "maskip(): /8...OK"
+    passed "maskip(): /8...OK"
 else
-    echo "maskip(): /8...failed"
+    failed "maskip(): /8...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.240.0.0) == 169.240.0.0 ]]; then
-    echo "maskip(): /12...OK"
+    passed "maskip(): /12...OK"
 else
-    echo "maskip(): /12...failed"
+    failed "maskip(): /12...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.255.0.0) == 169.254.0.0 ]]; then
-    echo "maskip(): /16...OK"
+    passed "maskip(): /16...OK"
 else
-    echo "maskip(): /16...failed"
+    failed "maskip(): /16...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.255.240.0) == 169.254.160.0 ]]; then
-    echo "maskip(): /20...OK"
+    passed "maskip(): /20...OK"
 else
-    echo "maskip(): /20...failed"
+    failed "maskip(): /20...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.255.255.0) == 169.254.169.0 ]]; then
-    echo "maskip(): /24...OK"
+    passed "maskip(): /24...OK"
 else
-    echo "maskip(): /24...failed"
+    failed "maskip(): /24...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.255.255.240) == 169.254.169.240 ]]; then
-    echo "maskip(): /28...OK"
+    passed "maskip(): /28...OK"
 else
-    echo "maskip(): /28...failed"
+    failed "maskip(): /28...failed"
 fi
 if [[ $(maskip 169.254.169.254 255.255.255.255) == 169.254.169.254 ]]; then
-    echo "maskip(): /32...OK"
+    passed "maskip(): /32...OK"
 else
-    echo "maskip(): /32...failed"
+    failed "maskip(): /32...failed"
 fi
 
 for mask in 8 12 16 20 24 26 28; do
     echo -n "address_in_net(): in /$mask..."
     if address_in_net 10.10.10.1 10.10.10.0/$mask; then
-        echo "OK"
+        passed "OK"
     else
-        echo "address_in_net() failed on /$mask"
+        failed "address_in_net() failed on /$mask"
     fi
 
     echo -n "address_in_net(): not in /$mask..."
     if ! address_in_net 10.10.10.1 11.11.11.0/$mask; then
-        echo "OK"
+        passed "OK"
     else
-        echo "address_in_net() failed on /$mask"
+        failed "address_in_net() failed on /$mask"
     fi
 done
+
+report_results

From fcdca05de55b9ecec2b66f0cccb88ee01beebbd0 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 13:02:49 +1000
Subject: [PATCH 0557/3333] Fix return of test_ini_config & test_meta_config

Convert test_ini_config to use the "passed / failed" functions in
unittest.sh.  test_meta_config wraps everything into a function; it's
not work unrolling this so just make sure it exits with non-zero if a
test fails.

Change-Id: I9e9883fdad42358255383eede9121b1d361799c8
---
 tests/test_ini_config.sh  | 99 ++++++++++++++++++++-------------------
 tests/test_meta_config.sh |  1 +
 2 files changed, 53 insertions(+), 47 deletions(-)

diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 4a0ae33aeb..b2529ac4c9 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -7,6 +7,9 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 # Import config functions
 source $TOP/inc/ini-config
 
+source $TOP/tests/unittest.sh
+
+set -e
 
 echo "Testing INI functions"
 
@@ -70,86 +73,86 @@ echo -n "iniset: test missing attribute argument: "
 iniset test.ini aaa
 NO_ATTRIBUTE=$(cat test.ini)
 if [[ "$BEFORE" == "$NO_ATTRIBUTE" ]]; then
-    echo "OK"
+    passed
 else
-    echo "failed"
+    failed "failed"
 fi
 
 echo -n "iniset: test missing section argument: "
 iniset test.ini
 NO_SECTION=$(cat test.ini)
 if [[ "$BEFORE" == "$NO_SECTION" ]]; then
-    echo "OK"
+    passed
 else
-    echo "failed"
+    failed "failed"
 fi
 
 # Test with spaces
 
 VAL=$(iniget test.ini aaa handlers)
 if [[ "$VAL" == "aa, bb" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 iniset test.ini aaa handlers "11, 22"
 
 VAL=$(iniget test.ini aaa handlers)
 if [[ "$VAL" == "11, 22" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # Test with spaces in section header
 
 VAL=$(iniget test.ini " ccc " spaces)
 if [[ "$VAL" == "yes" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 iniset test.ini "b b" opt_ion 42
 
 VAL=$(iniget test.ini "b b" opt_ion)
 if [[ "$VAL" == "42" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # Test without spaces, end of file
 
 VAL=$(iniget test.ini bbb handlers)
 if [[ "$VAL" == "ee,ff" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 iniset test.ini bbb handlers "33,44"
 
 VAL=$(iniget test.ini bbb handlers)
 if [[ "$VAL" == "33,44" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # test empty option
 if ini_has_option test.ini ddd empty; then
-    echo "OK: ddd.empty present"
+    passed "OK: ddd.empty present"
 else
-    echo "ini_has_option failed: ddd.empty not found"
+    failed "ini_has_option failed: ddd.empty not found"
 fi
 
 # test non-empty option
 if ini_has_option test.ini bbb handlers; then
-    echo "OK: bbb.handlers present"
+    passed "OK: bbb.handlers present"
 else
-    echo "ini_has_option failed: bbb.handlers not found"
+    failed "ini_has_option failed: bbb.handlers not found"
 fi
 
 # test changing empty option
@@ -157,9 +160,9 @@ iniset test.ini ddd empty "42"
 
 VAL=$(iniget test.ini ddd empty)
 if [[ "$VAL" == "42" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # test pipe in option
@@ -167,9 +170,9 @@ iniset test.ini aaa handlers "a|b"
 
 VAL=$(iniget test.ini aaa handlers)
 if [[ "$VAL" == "a|b" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # test space in option
@@ -177,51 +180,51 @@ iniset test.ini aaa handlers "a b"
 
 VAL="$(iniget test.ini aaa handlers)"
 if [[ "$VAL" == "a b" ]]; then
-    echo "OK: $VAL"
+    passed "OK: $VAL"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # Test section not exist
 
 VAL=$(iniget test.ini zzz handlers)
 if [[ -z "$VAL" ]]; then
-    echo "OK: zzz not present"
+    passed "OK: zzz not present"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 iniset test.ini zzz handlers "999"
 
 VAL=$(iniget test.ini zzz handlers)
 if [[ -n "$VAL" ]]; then
-    echo "OK: zzz not present"
+    passed "OK: zzz not present"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # Test option not exist
 
 VAL=$(iniget test.ini aaa debug)
 if [[ -z "$VAL" ]]; then
-    echo "OK aaa.debug not present"
+    passed "OK aaa.debug not present"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 if ! ini_has_option test.ini aaa debug; then
-    echo "OK aaa.debug not present"
+    passed "OK aaa.debug not present"
 else
-    echo "ini_has_option failed: aaa.debug"
+    failed "ini_has_option failed: aaa.debug"
 fi
 
 iniset test.ini aaa debug "999"
 
 VAL=$(iniget test.ini aaa debug)
 if [[ -n "$VAL" ]]; then
-    echo "OK aaa.debug present"
+    passed "OK aaa.debug present"
 else
-    echo "iniget failed: $VAL"
+    failed "iniget failed: $VAL"
 fi
 
 # Test comments
@@ -230,9 +233,9 @@ inicomment test.ini aaa handlers
 
 VAL=$(iniget test.ini aaa handlers)
 if [[ -z "$VAL" ]]; then
-    echo "OK"
+    passed "OK"
 else
-    echo "inicomment failed: $VAL"
+    failed "inicomment failed: $VAL"
 fi
 
 # Test multiple line iniset/iniget
@@ -242,25 +245,25 @@ VAL=$(iniget_multiline test.ini eee multi)
 if [[ "$VAL" == "bar1 bar2" ]]; then
     echo "OK: iniset_multiline"
 else
-    echo "iniset_multiline failed: $VAL"
+    failed "iniset_multiline failed: $VAL"
 fi
 
 # Test iniadd with exiting values
 iniadd test.ini eee multi bar3
 VAL=$(iniget_multiline test.ini eee multi)
 if [[ "$VAL" == "bar1 bar2 bar3" ]]; then
-    echo "OK: iniadd"
+    passed "OK: iniadd"
 else
-    echo "iniadd failed: $VAL"
+    failed "iniadd failed: $VAL"
 fi
 
 # Test iniadd with non-exiting values
 iniadd test.ini eee non-multi foobar1 foobar2
 VAL=$(iniget_multiline test.ini eee non-multi)
 if [[ "$VAL" == "foobar1 foobar2" ]]; then
-    echo "OK: iniadd with non-exiting value"
+    passed "OK: iniadd with non-exiting value"
 else
-    echo "iniadd with non-exsting failed: $VAL"
+    failed "iniadd with non-exsting failed: $VAL"
 fi
 
 # Test inidelete
@@ -276,20 +279,22 @@ for x in $del_cases; do
     inidelete test.ini $x a
     VAL=$(iniget_multiline test.ini $x a)
     if [ -z "$VAL" ]; then
-        echo "OK: inidelete $x"
+        passed "OK: inidelete $x"
     else
-        echo "inidelete $x failed: $VAL"
+        failed "inidelete $x failed: $VAL"
     fi
     if [ "$x" = "del_separate_options" -o \
         "$x" = "del_missing_option" -o \
         "$x" = "del_missing_option_multi" ]; then
         VAL=$(iniget_multiline test.ini $x b)
         if [ "$VAL" = "c" -o "$VAL" = "c d" ]; then
-            echo "OK: inidelete other_options $x"
+            passed "OK: inidelete other_options $x"
         else
-            echo "inidelete other_option $x failed: $VAL"
+            failed "inidelete other_option $x failed: $VAL"
         fi
     fi
 done
 
 rm test.ini
+
+report_results
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 9d65280b8c..3ec65bf9b0 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -17,6 +17,7 @@ function check_result {
         echo "OK"
     else
         echo -e "failed: $actual != $expected\n"
+        exit 1
     fi
 }
 

From 9b0ebc44f413edac87e52d23e8852ca7c52cb091 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 13:06:47 +1000
Subject: [PATCH 0558/3333] Move function.sh to test_functions.sh

run_tests.sh runs tests starting with test_*

The existing test_functions.sh is really testing true/false.  Move
that to test_truefalse.sh

Then move functions.sh to test_functions.sh.  This will ensure it is
run during unit testing from run-tests.sh

Change-Id: I959ac38c946da1fb47458b8c4f09157f74f0e644
---
 tests/functions.sh      | 215 -------------------------------------
 tests/test_functions.sh | 229 +++++++++++++++++++++++++++++++++++-----
 tests/test_truefalse.sh |  34 ++++++
 3 files changed, 239 insertions(+), 239 deletions(-)
 delete mode 100755 tests/functions.sh
 create mode 100755 tests/test_truefalse.sh

diff --git a/tests/functions.sh b/tests/functions.sh
deleted file mode 100755
index 126080f1e3..0000000000
--- a/tests/functions.sh
+++ /dev/null
@@ -1,215 +0,0 @@
-#!/usr/bin/env bash
-
-# Tests for DevStack functions
-
-TOP=$(cd $(dirname "$0")/.. && pwd)
-
-# Import common functions
-source $TOP/functions
-
-# Import configuration
-source $TOP/openrc
-
-
-echo "Testing die_if_not_set()"
-
-bash -cx "source $TOP/functions; X=`echo Y && true`; die_if_not_set X 'not OK'"
-if [[ $? != 0 ]]; then
-    echo "die_if_not_set [X='Y' true] Failed"
-else
-    echo 'OK'
-fi
-
-bash -cx "source $TOP/functions; X=`true`; die_if_not_set X 'OK'"
-if [[ $? = 0 ]]; then
-    echo "die_if_not_set [X='' true] Failed"
-fi
-
-bash -cx "source $TOP/functions; X=`echo Y && false`; die_if_not_set X 'not OK'"
-if [[ $? != 0 ]]; then
-    echo "die_if_not_set [X='Y' false] Failed"
-else
-    echo 'OK'
-fi
-
-bash -cx "source $TOP/functions; X=`false`; die_if_not_set X 'OK'"
-if [[ $? = 0 ]]; then
-    echo "die_if_not_set [X='' false] Failed"
-fi
-
-
-# Enabling/disabling services
-
-echo "Testing enable_service()"
-
-function test_enable_service {
-    local start="$1"
-    local add="$2"
-    local finish="$3"
-
-    ENABLED_SERVICES="$start"
-    enable_service $add
-    if [ "$ENABLED_SERVICES" = "$finish" ]; then
-        echo "OK: $start + $add -> $ENABLED_SERVICES"
-    else
-        echo "changing $start to $finish with $add failed: $ENABLED_SERVICES"
-    fi
-}
-
-test_enable_service '' a 'a'
-test_enable_service 'a' b 'a,b'
-test_enable_service 'a,b' c 'a,b,c'
-test_enable_service 'a,b' c 'a,b,c'
-test_enable_service 'a,b,' c 'a,b,c'
-test_enable_service 'a,b' c,d 'a,b,c,d'
-test_enable_service 'a,b' "c d" 'a,b,c,d'
-test_enable_service 'a,b,c' c 'a,b,c'
-
-test_enable_service 'a,b,-c' c 'a,b'
-test_enable_service 'a,b,c' -c 'a,b'
-
-function test_disable_service {
-    local start="$1"
-    local del="$2"
-    local finish="$3"
-
-    ENABLED_SERVICES="$start"
-    disable_service "$del"
-    if [ "$ENABLED_SERVICES" = "$finish" ]; then
-        echo "OK: $start - $del -> $ENABLED_SERVICES"
-    else
-        echo "changing $start to $finish with $del failed: $ENABLED_SERVICES"
-    fi
-}
-
-echo "Testing disable_service()"
-test_disable_service 'a,b,c' a 'b,c'
-test_disable_service 'a,b,c' b 'a,c'
-test_disable_service 'a,b,c' c 'a,b'
-
-test_disable_service 'a,b,c' a 'b,c'
-test_disable_service 'b,c' b 'c'
-test_disable_service 'c' c ''
-test_disable_service '' d ''
-
-test_disable_service 'a,b,c,' c 'a,b'
-test_disable_service 'a,b' c 'a,b'
-
-
-echo "Testing disable_all_services()"
-ENABLED_SERVICES=a,b,c
-disable_all_services
-
-if [[ -z "$ENABLED_SERVICES" ]]; then
-    echo "OK"
-else
-    echo "disabling all services FAILED: $ENABLED_SERVICES"
-fi
-
-echo "Testing disable_negated_services()"
-
-
-function test_disable_negated_services {
-    local start="$1"
-    local finish="$2"
-
-    ENABLED_SERVICES="$start"
-    disable_negated_services
-    if [ "$ENABLED_SERVICES" = "$finish" ]; then
-        echo "OK: $start + $add -> $ENABLED_SERVICES"
-    else
-        echo "changing $start to $finish failed: $ENABLED_SERVICES"
-    fi
-}
-
-test_disable_negated_services '-a' ''
-test_disable_negated_services '-a,a' ''
-test_disable_negated_services '-a,-a' ''
-test_disable_negated_services 'a,-a' ''
-test_disable_negated_services 'b,a,-a' 'b'
-test_disable_negated_services 'a,b,-a' 'b'
-test_disable_negated_services 'a,-a,b' 'b'
-
-
-echo "Testing is_package_installed()"
-
-if [[ -z "$os_PACKAGE" ]]; then
-    GetOSVersion
-fi
-
-if [[ "$os_PACKAGE" = "deb" ]]; then
-    is_package_installed dpkg
-    VAL=$?
-elif [[ "$os_PACKAGE" = "rpm" ]]; then
-    is_package_installed rpm
-    VAL=$?
-else
-    VAL=1
-fi
-if [[ "$VAL" -eq 0 ]]; then
-    echo "OK"
-else
-    echo "is_package_installed() on existing package failed"
-fi
-
-if [[ "$os_PACKAGE" = "deb" ]]; then
-    is_package_installed dpkg bash
-    VAL=$?
-elif [[ "$os_PACKAGE" = "rpm" ]]; then
-    is_package_installed rpm bash
-    VAL=$?
-else
-    VAL=1
-fi
-if [[ "$VAL" -eq 0 ]]; then
-    echo "OK"
-else
-    echo "is_package_installed() on more than one existing package failed"
-fi
-
-is_package_installed zzzZZZzzz
-VAL=$?
-if [[ "$VAL" -ne 0 ]]; then
-    echo "OK"
-else
-    echo "is_package_installed() on non-existing package failed"
-fi
-
-# test against removed package...was a bug on Ubuntu
-if is_ubuntu; then
-    PKG=cowsay
-    if ! (dpkg -s $PKG >/dev/null 2>&1); then
-        # it was never installed...set up the condition
-        sudo apt-get install -y cowsay >/dev/null 2>&1
-    fi
-    if (dpkg -s $PKG >/dev/null 2>&1); then
-        # remove it to create the 'un' status
-        sudo dpkg -P $PKG >/dev/null 2>&1
-    fi
-
-    # now test the installed check on a deleted package
-    is_package_installed $PKG
-    VAL=$?
-    if [[ "$VAL" -ne 0 ]]; then
-        echo "OK"
-    else
-        echo "is_package_installed() on deleted package failed"
-    fi
-fi
-
-# test isset function
-echo  "Testing isset()"
-you_should_not_have_this_variable=42
-
-if isset "you_should_not_have_this_variable"; then
-    echo "OK"
-else
-    echo "\"you_should_not_have_this_variable\" not declared. failed"
-fi
-
-unset you_should_not_have_this_variable
-if isset "you_should_not_have_this_variable"; then
-    echo "\"you_should_not_have_this_variable\" looks like declared variable. failed"
-else
-    echo "OK"
-fi
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index e57948a407..126080f1e3 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -1,34 +1,215 @@
 #!/usr/bin/env bash
 
-# Tests for DevStack meta-config functions
+# Tests for DevStack functions
 
 TOP=$(cd $(dirname "$0")/.. && pwd)
 
 # Import common functions
 source $TOP/functions
-source $TOP/tests/unittest.sh
-
-function test_truefalse {
-    local one=1
-    local captrue=True
-    local lowtrue=true
-    local abrevtrue=t
-    local zero=0
-    local capfalse=False
-    local lowfalse=false
-    local abrevfalse=f
-    for against in True False; do
-        for name in one captrue lowtrue abrevtrue; do
-            assert_equal "True" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
-        done
-    done
-    for against in True False; do
-        for name in zero capfalse lowfalse abrevfalse; do
-            assert_equal "False" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
-        done
-    done
+
+# Import configuration
+source $TOP/openrc
+
+
+echo "Testing die_if_not_set()"
+
+bash -cx "source $TOP/functions; X=`echo Y && true`; die_if_not_set X 'not OK'"
+if [[ $? != 0 ]]; then
+    echo "die_if_not_set [X='Y' true] Failed"
+else
+    echo 'OK'
+fi
+
+bash -cx "source $TOP/functions; X=`true`; die_if_not_set X 'OK'"
+if [[ $? = 0 ]]; then
+    echo "die_if_not_set [X='' true] Failed"
+fi
+
+bash -cx "source $TOP/functions; X=`echo Y && false`; die_if_not_set X 'not OK'"
+if [[ $? != 0 ]]; then
+    echo "die_if_not_set [X='Y' false] Failed"
+else
+    echo 'OK'
+fi
+
+bash -cx "source $TOP/functions; X=`false`; die_if_not_set X 'OK'"
+if [[ $? = 0 ]]; then
+    echo "die_if_not_set [X='' false] Failed"
+fi
+
+
+# Enabling/disabling services
+
+echo "Testing enable_service()"
+
+function test_enable_service {
+    local start="$1"
+    local add="$2"
+    local finish="$3"
+
+    ENABLED_SERVICES="$start"
+    enable_service $add
+    if [ "$ENABLED_SERVICES" = "$finish" ]; then
+        echo "OK: $start + $add -> $ENABLED_SERVICES"
+    else
+        echo "changing $start to $finish with $add failed: $ENABLED_SERVICES"
+    fi
+}
+
+test_enable_service '' a 'a'
+test_enable_service 'a' b 'a,b'
+test_enable_service 'a,b' c 'a,b,c'
+test_enable_service 'a,b' c 'a,b,c'
+test_enable_service 'a,b,' c 'a,b,c'
+test_enable_service 'a,b' c,d 'a,b,c,d'
+test_enable_service 'a,b' "c d" 'a,b,c,d'
+test_enable_service 'a,b,c' c 'a,b,c'
+
+test_enable_service 'a,b,-c' c 'a,b'
+test_enable_service 'a,b,c' -c 'a,b'
+
+function test_disable_service {
+    local start="$1"
+    local del="$2"
+    local finish="$3"
+
+    ENABLED_SERVICES="$start"
+    disable_service "$del"
+    if [ "$ENABLED_SERVICES" = "$finish" ]; then
+        echo "OK: $start - $del -> $ENABLED_SERVICES"
+    else
+        echo "changing $start to $finish with $del failed: $ENABLED_SERVICES"
+    fi
+}
+
+echo "Testing disable_service()"
+test_disable_service 'a,b,c' a 'b,c'
+test_disable_service 'a,b,c' b 'a,c'
+test_disable_service 'a,b,c' c 'a,b'
+
+test_disable_service 'a,b,c' a 'b,c'
+test_disable_service 'b,c' b 'c'
+test_disable_service 'c' c ''
+test_disable_service '' d ''
+
+test_disable_service 'a,b,c,' c 'a,b'
+test_disable_service 'a,b' c 'a,b'
+
+
+echo "Testing disable_all_services()"
+ENABLED_SERVICES=a,b,c
+disable_all_services
+
+if [[ -z "$ENABLED_SERVICES" ]]; then
+    echo "OK"
+else
+    echo "disabling all services FAILED: $ENABLED_SERVICES"
+fi
+
+echo "Testing disable_negated_services()"
+
+
+function test_disable_negated_services {
+    local start="$1"
+    local finish="$2"
+
+    ENABLED_SERVICES="$start"
+    disable_negated_services
+    if [ "$ENABLED_SERVICES" = "$finish" ]; then
+        echo "OK: $start + $add -> $ENABLED_SERVICES"
+    else
+        echo "changing $start to $finish failed: $ENABLED_SERVICES"
+    fi
 }
 
-test_truefalse
+test_disable_negated_services '-a' ''
+test_disable_negated_services '-a,a' ''
+test_disable_negated_services '-a,-a' ''
+test_disable_negated_services 'a,-a' ''
+test_disable_negated_services 'b,a,-a' 'b'
+test_disable_negated_services 'a,b,-a' 'b'
+test_disable_negated_services 'a,-a,b' 'b'
+
+
+echo "Testing is_package_installed()"
+
+if [[ -z "$os_PACKAGE" ]]; then
+    GetOSVersion
+fi
+
+if [[ "$os_PACKAGE" = "deb" ]]; then
+    is_package_installed dpkg
+    VAL=$?
+elif [[ "$os_PACKAGE" = "rpm" ]]; then
+    is_package_installed rpm
+    VAL=$?
+else
+    VAL=1
+fi
+if [[ "$VAL" -eq 0 ]]; then
+    echo "OK"
+else
+    echo "is_package_installed() on existing package failed"
+fi
+
+if [[ "$os_PACKAGE" = "deb" ]]; then
+    is_package_installed dpkg bash
+    VAL=$?
+elif [[ "$os_PACKAGE" = "rpm" ]]; then
+    is_package_installed rpm bash
+    VAL=$?
+else
+    VAL=1
+fi
+if [[ "$VAL" -eq 0 ]]; then
+    echo "OK"
+else
+    echo "is_package_installed() on more than one existing package failed"
+fi
+
+is_package_installed zzzZZZzzz
+VAL=$?
+if [[ "$VAL" -ne 0 ]]; then
+    echo "OK"
+else
+    echo "is_package_installed() on non-existing package failed"
+fi
+
+# test against removed package...was a bug on Ubuntu
+if is_ubuntu; then
+    PKG=cowsay
+    if ! (dpkg -s $PKG >/dev/null 2>&1); then
+        # it was never installed...set up the condition
+        sudo apt-get install -y cowsay >/dev/null 2>&1
+    fi
+    if (dpkg -s $PKG >/dev/null 2>&1); then
+        # remove it to create the 'un' status
+        sudo dpkg -P $PKG >/dev/null 2>&1
+    fi
+
+    # now test the installed check on a deleted package
+    is_package_installed $PKG
+    VAL=$?
+    if [[ "$VAL" -ne 0 ]]; then
+        echo "OK"
+    else
+        echo "is_package_installed() on deleted package failed"
+    fi
+fi
+
+# test isset function
+echo  "Testing isset()"
+you_should_not_have_this_variable=42
+
+if isset "you_should_not_have_this_variable"; then
+    echo "OK"
+else
+    echo "\"you_should_not_have_this_variable\" not declared. failed"
+fi
 
-report_results
+unset you_should_not_have_this_variable
+if isset "you_should_not_have_this_variable"; then
+    echo "\"you_should_not_have_this_variable\" looks like declared variable. failed"
+else
+    echo "OK"
+fi
diff --git a/tests/test_truefalse.sh b/tests/test_truefalse.sh
new file mode 100755
index 0000000000..e57948a407
--- /dev/null
+++ b/tests/test_truefalse.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Tests for DevStack meta-config functions
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import common functions
+source $TOP/functions
+source $TOP/tests/unittest.sh
+
+function test_truefalse {
+    local one=1
+    local captrue=True
+    local lowtrue=true
+    local abrevtrue=t
+    local zero=0
+    local capfalse=False
+    local lowfalse=false
+    local abrevfalse=f
+    for against in True False; do
+        for name in one captrue lowtrue abrevtrue; do
+            assert_equal "True" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
+        done
+    done
+    for against in True False; do
+        for name in zero capfalse lowfalse abrevfalse; do
+            assert_equal "False" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
+        done
+    done
+}
+
+test_truefalse
+
+report_results

From 9b845da478ae2fb65ac63de95f6005ecacbb52ce Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 13:10:33 +1000
Subject: [PATCH 0559/3333] Fix die_if_not_set tests

The "die_if_not_set" test has the LINENO as a positional argument.
The existing tests are not passing this in, so they are failing.

Along with this, remove the "-x" from the invocation and hide the
output of the tests that are expected to fail to avoid confusion.

Change-Id: Ibf6b9d7bb72b9f92831e1a90292ff8b0bec7faea
---
 tests/test_functions.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index 126080f1e3..4d0237afb7 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -13,26 +13,26 @@ source $TOP/openrc
 
 echo "Testing die_if_not_set()"
 
-bash -cx "source $TOP/functions; X=`echo Y && true`; die_if_not_set X 'not OK'"
+bash -c "source $TOP/functions; X=`echo Y && true`; die_if_not_set $LINENO X 'not OK'"
 if [[ $? != 0 ]]; then
     echo "die_if_not_set [X='Y' true] Failed"
 else
     echo 'OK'
 fi
 
-bash -cx "source $TOP/functions; X=`true`; die_if_not_set X 'OK'"
+bash -c "source $TOP/functions; X=`true`; die_if_not_set $LINENO X 'OK'" > /dev/null 2>&1
 if [[ $? = 0 ]]; then
     echo "die_if_not_set [X='' true] Failed"
 fi
 
-bash -cx "source $TOP/functions; X=`echo Y && false`; die_if_not_set X 'not OK'"
+bash -c "source $TOP/functions; X=`echo Y && false`; die_if_not_set $LINENO X 'not OK'"
 if [[ $? != 0 ]]; then
     echo "die_if_not_set [X='Y' false] Failed"
 else
     echo 'OK'
 fi
 
-bash -cx "source $TOP/functions; X=`false`; die_if_not_set X 'OK'"
+bash -c "source $TOP/functions; X=`false`; die_if_not_set $LINENO X 'OK'" > /dev/null 2>&1
 if [[ $? = 0 ]]; then
     echo "die_if_not_set [X='' false] Failed"
 fi

From 09f4ad227976eb95d70045b67d0f724294cf7e22 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 13:13:04 +1000
Subject: [PATCH 0560/3333] Convert test_functions.sh to use unittest helpers

This currently does not exit with any failure code when tests are
failing.  Convert it to use the helper functions from unittest.sh so
it correctly reports failures.

Change-Id: I2062d9c00ebffcc98ba75a12f480e4dd728ee080
---
 tests/test_functions.sh | 55 ++++++++++++++++++++++-------------------
 1 file changed, 29 insertions(+), 26 deletions(-)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index 4d0237afb7..a7914f7a1b 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -10,31 +10,32 @@ source $TOP/functions
 # Import configuration
 source $TOP/openrc
 
+source $TOP/tests/unittest.sh
 
 echo "Testing die_if_not_set()"
 
 bash -c "source $TOP/functions; X=`echo Y && true`; die_if_not_set $LINENO X 'not OK'"
 if [[ $? != 0 ]]; then
-    echo "die_if_not_set [X='Y' true] Failed"
+    failed "die_if_not_set [X='Y' true] Failed"
 else
-    echo 'OK'
+    passed 'OK'
 fi
 
 bash -c "source $TOP/functions; X=`true`; die_if_not_set $LINENO X 'OK'" > /dev/null 2>&1
 if [[ $? = 0 ]]; then
-    echo "die_if_not_set [X='' true] Failed"
+    failed "die_if_not_set [X='' true] Failed"
 fi
 
 bash -c "source $TOP/functions; X=`echo Y && false`; die_if_not_set $LINENO X 'not OK'"
 if [[ $? != 0 ]]; then
-    echo "die_if_not_set [X='Y' false] Failed"
+    failed "die_if_not_set [X='Y' false] Failed"
 else
-    echo 'OK'
+    passed 'OK'
 fi
 
 bash -c "source $TOP/functions; X=`false`; die_if_not_set $LINENO X 'OK'" > /dev/null 2>&1
 if [[ $? = 0 ]]; then
-    echo "die_if_not_set [X='' false] Failed"
+    failed "die_if_not_set [X='' false] Failed"
 fi
 
 
@@ -50,9 +51,9 @@ function test_enable_service {
     ENABLED_SERVICES="$start"
     enable_service $add
     if [ "$ENABLED_SERVICES" = "$finish" ]; then
-        echo "OK: $start + $add -> $ENABLED_SERVICES"
+        passed "OK: $start + $add -> $ENABLED_SERVICES"
     else
-        echo "changing $start to $finish with $add failed: $ENABLED_SERVICES"
+        failed "changing $start to $finish with $add failed: $ENABLED_SERVICES"
     fi
 }
 
@@ -76,9 +77,9 @@ function test_disable_service {
     ENABLED_SERVICES="$start"
     disable_service "$del"
     if [ "$ENABLED_SERVICES" = "$finish" ]; then
-        echo "OK: $start - $del -> $ENABLED_SERVICES"
+        passed "OK: $start - $del -> $ENABLED_SERVICES"
     else
-        echo "changing $start to $finish with $del failed: $ENABLED_SERVICES"
+        failed "changing $start to $finish with $del failed: $ENABLED_SERVICES"
     fi
 }
 
@@ -101,9 +102,9 @@ ENABLED_SERVICES=a,b,c
 disable_all_services
 
 if [[ -z "$ENABLED_SERVICES" ]]; then
-    echo "OK"
+    passed "OK"
 else
-    echo "disabling all services FAILED: $ENABLED_SERVICES"
+    failed "disabling all services FAILED: $ENABLED_SERVICES"
 fi
 
 echo "Testing disable_negated_services()"
@@ -116,9 +117,9 @@ function test_disable_negated_services {
     ENABLED_SERVICES="$start"
     disable_negated_services
     if [ "$ENABLED_SERVICES" = "$finish" ]; then
-        echo "OK: $start + $add -> $ENABLED_SERVICES"
+        passed "OK: $start + $add -> $ENABLED_SERVICES"
     else
-        echo "changing $start to $finish failed: $ENABLED_SERVICES"
+        failed "changing $start to $finish failed: $ENABLED_SERVICES"
     fi
 }
 
@@ -147,9 +148,9 @@ else
     VAL=1
 fi
 if [[ "$VAL" -eq 0 ]]; then
-    echo "OK"
+    passed "OK"
 else
-    echo "is_package_installed() on existing package failed"
+    failed "is_package_installed() on existing package failed"
 fi
 
 if [[ "$os_PACKAGE" = "deb" ]]; then
@@ -162,17 +163,17 @@ else
     VAL=1
 fi
 if [[ "$VAL" -eq 0 ]]; then
-    echo "OK"
+    passed "OK"
 else
-    echo "is_package_installed() on more than one existing package failed"
+    failed "is_package_installed() on more than one existing package failed"
 fi
 
 is_package_installed zzzZZZzzz
 VAL=$?
 if [[ "$VAL" -ne 0 ]]; then
-    echo "OK"
+    passed "OK"
 else
-    echo "is_package_installed() on non-existing package failed"
+    failed "is_package_installed() on non-existing package failed"
 fi
 
 # test against removed package...was a bug on Ubuntu
@@ -191,9 +192,9 @@ if is_ubuntu; then
     is_package_installed $PKG
     VAL=$?
     if [[ "$VAL" -ne 0 ]]; then
-        echo "OK"
+        passed "OK"
     else
-        echo "is_package_installed() on deleted package failed"
+        failed "is_package_installed() on deleted package failed"
     fi
 fi
 
@@ -202,14 +203,16 @@ echo  "Testing isset()"
 you_should_not_have_this_variable=42
 
 if isset "you_should_not_have_this_variable"; then
-    echo "OK"
+    passed "OK"
 else
-    echo "\"you_should_not_have_this_variable\" not declared. failed"
+    failed "\"you_should_not_have_this_variable\" not declared. failed"
 fi
 
 unset you_should_not_have_this_variable
 if isset "you_should_not_have_this_variable"; then
-    echo "\"you_should_not_have_this_variable\" looks like declared variable. failed"
+    failed "\"you_should_not_have_this_variable\" looks like declared variable."
 else
-    echo "OK"
+    passed "OK"
 fi
+
+report_results

From 9b64bbf06eab19534e58a1b7af1757e427e6b3b6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 13:16:24 +1000
Subject: [PATCH 0561/3333] Remove old comment in run_tests.sh

The scope of this has expanded to run everything in ./tests

Change-Id: I640b0a8b7aa578ddd24dd3e58d5b2a1e09fe0284
---
 run_tests.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/run_tests.sh b/run_tests.sh
index c6b7da64c0..a9a3d0bb48 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -17,8 +17,6 @@
 PASSES=""
 FAILURES=""
 
-# Test that no one is trying to land crazy refs as branches
-
 for testfile in tests/test_*.sh; do
     $testfile
     if [[ $? -eq 0 ]]; then

From fa3e8412864a92715c296c6ed5e3828dd4bb2205 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2015 11:53:40 +1000
Subject: [PATCH 0562/3333] Create config file in merge_config_file

Change If132a94e53545d9134859aa508da7b9819ede2f8 introduced a small
regression; it added an "inidelete" which looks in the config file to
delete rows.

However, at least for the test-case, the config file isn't created
yet.  The end result is that the test fails but we don't notice.

 2015-04-17 00:55:03.169 | merge_config_file test-multiline: sed: can't read test-multiline.conf: No such file or directory
 2015-04-17 00:55:03.195 | OK

So fix this up by creating the config-file if it isn't there.

Also, add "-e" to the test file so we catch things like this in the
future.

Change-Id: I43a4ecc247f19cccf51d5931dfb687adbd23d6b1
---
 inc/meta-config           | 8 ++++++++
 tests/test_meta_config.sh | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/inc/meta-config b/inc/meta-config
index c8789bf816..e5f902d1dd 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -86,6 +86,14 @@ function merge_config_file {
     local matchgroup=$2
     local configfile=$3
 
+    # note, configfile might be a variable (note the iniset, etc
+    # created in the mega-awk below is "eval"ed too, so we just leave
+    # it alone.
+    local real_configfile=$(eval echo $configfile)
+    if [ ! -f $real_configfile ]; then
+        touch $real_configfile
+    fi
+
     get_meta_section $file $matchgroup $configfile | \
     $CONFIG_AWK_CMD -v configfile=$configfile '
         BEGIN {
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 3ec65bf9b0..a04c081854 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -8,6 +8,8 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/inc/ini-config
 source $TOP/inc/meta-config
 
+set -e
+
 # check_result() tests and reports the result values
 # check_result "actual" "expected"
 function check_result {

From af9bf8663b43a2cc80f2c3adb09b8aa3641f99ab Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 16 Apr 2015 08:58:32 -0400
Subject: [PATCH 0563/3333] refactor ping_check

Encapsulate all the neutron specific things you have to do ping a
neutron guest into a separate script. Refactor the main ping_check so
all logic is contained within it.

Change-Id: Ic79d8e3a2473b978551a5635a11dba07e1020bb2
---
 exercises/boot_from_volume.sh |  2 +-
 exercises/euca.sh             |  2 +-
 exercises/floating_ips.sh     |  6 ++--
 exercises/neutron-adv-test.sh |  2 +-
 exercises/volumes.sh          |  2 +-
 functions                     | 61 ++++++++++++++++----------------
 lib/neutron-legacy            | 21 -----------
 tools/ping_neutron.sh         | 65 +++++++++++++++++++++++++++++++++++
 8 files changed, 104 insertions(+), 57 deletions(-)
 create mode 100755 tools/ping_neutron.sh

diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index aa348307af..d520b9bbbf 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -182,7 +182,7 @@ IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
 die_if_not_set $LINENO IP "Failure retrieving IP address"
 
 # Private IPs can be pinged in single node deployments
-ping_check "$PRIVATE_NETWORK_NAME" $IP $BOOT_TIMEOUT
+ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
 
 # Clean up
 # --------
diff --git a/exercises/euca.sh b/exercises/euca.sh
index df5e233b8d..c2957e222b 100755
--- a/exercises/euca.sh
+++ b/exercises/euca.sh
@@ -142,7 +142,7 @@ else
         die $LINENO "Failure authorizing rule in $SECGROUP"
 
     # Test we can ping our floating ip within ASSOCIATE_TIMEOUT seconds
-    ping_check "$PUBLIC_NETWORK_NAME" $FLOATING_IP $ASSOCIATE_TIMEOUT
+    ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME"
 
     # Revoke pinging
     euca-revoke -P icmp -s 0.0.0.0/0 -t -1:-1 $SECGROUP || \
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
index 59444e1ebd..4b72a0073f 100755
--- a/exercises/floating_ips.sh
+++ b/exercises/floating_ips.sh
@@ -139,7 +139,7 @@ IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
 die_if_not_set $LINENO IP "Failure retrieving IP address"
 
 # Private IPs can be pinged in single node deployments
-ping_check "$PRIVATE_NETWORK_NAME" $IP $BOOT_TIMEOUT
+ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
 
 # Floating IPs
 # ------------
@@ -158,7 +158,7 @@ nova add-floating-ip $VM_UUID $FLOATING_IP || \
     die $LINENO "Failure adding floating IP $FLOATING_IP to $VM_NAME"
 
 # Test we can ping our floating IP within ASSOCIATE_TIMEOUT seconds
-ping_check "$PUBLIC_NETWORK_NAME" $FLOATING_IP $ASSOCIATE_TIMEOUT
+ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME"
 
 if ! is_service_enabled neutron; then
     # Allocate an IP from second floating pool
@@ -182,7 +182,7 @@ fi
 # FIXME (anthony): make xs support security groups
 if [ "$VIRT_DRIVER" != "ironic" -a "$VIRT_DRIVER" != "xenserver" -a "$VIRT_DRIVER" != "openvz" ]; then
     # Test we can aren't able to ping our floating ip within ASSOCIATE_TIMEOUT seconds
-    ping_check "$PUBLIC_NETWORK_NAME" $FLOATING_IP $ASSOCIATE_TIMEOUT Fail
+    ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME" Fail
 fi
 
 # Clean up
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 9230587817..04892b0e93 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -281,7 +281,7 @@ function ping_ip {
     local VM_NAME=$1
     local NET_NAME=$2
     IP=$(get_instance_ip $VM_NAME $NET_NAME)
-    ping_check $NET_NAME $IP $BOOT_TIMEOUT
+    ping_check $IP $BOOT_TIMEOUT $NET_NAME
 }
 
 function check_vm {
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index 3ac2016254..f95c81fdf1 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -143,7 +143,7 @@ IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
 die_if_not_set $LINENO IP "Failure retrieving IP address"
 
 # Private IPs can be pinged in single node deployments
-ping_check "$PRIVATE_NETWORK_NAME" $IP $BOOT_TIMEOUT
+ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
 
 # Volumes
 # -------
diff --git a/functions b/functions
index 4dc20e7f23..339779c338 100644
--- a/functions
+++ b/functions
@@ -340,39 +340,42 @@ function wait_for_service {
 
 
 # ping check
-# Uses globals ``ENABLED_SERVICES``
-# ping_check from-net ip boot-timeout expected
+# Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
+# ping_check <ip> [boot-timeout] [from_net] [expected]
 function ping_check {
-    if is_service_enabled neutron; then
-        _ping_check_neutron  "$1" $2 $3 $4
-        return
+    local ip=$1
+    local timeout=${2:-30}
+    local from_net=${3:-""}
+    local expected=${4:-True}
+    local op="!"
+    local failmsg="[Fail] Couldn't ping server"
+    local ping_cmd="ping"
+
+    # if we don't specify a from_net we're expecting things to work
+    # fine from our local box.
+    if [[ -n "$from_net" ]]; then
+        if is_service_enabled neutron; then
+            ping_cmd="$TOP_DIR/tools/ping_neutron.sh $from_net"
+        elif [[ "$MULTI_HOST" = "True" && "$from_net" = "$PRIVATE_NETWORK_NAME" ]]; then
+            # there is no way to address the multihost / private case, bail here for compatibility.
+            # TODO: remove this cruft and redo code to handle this at the caller level.
+            return
+        fi
     fi
-    _ping_check_novanet "$1" $2 $3 $4
-}
 
-# ping check for nova
-# Uses globals ``MULTI_HOST``, ``PRIVATE_NETWORK``
-function _ping_check_novanet {
-    local from_net=$1
-    local ip=$2
-    local boot_timeout=$3
-    local expected=${4:-"True"}
-    local check_command=""
-    MULTI_HOST=$(trueorfalse False MULTI_HOST)
-    if [[ "$MULTI_HOST" = "True" && "$from_net" = "$PRIVATE_NETWORK_NAME" ]]; then
-        return
+    # inverse the logic if we're testing no connectivity
+    if [[ "$expected" != "True" ]]; then
+        op=""
+        failmsg="[Fail] Could ping server"
     fi
-    if [[ "$expected" = "True" ]]; then
-        check_command="while ! ping -c1 -w1 $ip; do sleep 1; done"
-    else
-        check_command="while ping -c1 -w1 $ip; do sleep 1; done"
-    fi
-    if ! timeout $boot_timeout sh -c "$check_command"; then
-        if [[ "$expected" = "True" ]]; then
-            die $LINENO "[Fail] Couldn't ping server"
-        else
-            die $LINENO "[Fail] Could ping server"
-        fi
+
+    # Because we've transformed this command so many times, print it
+    # out at the end.
+    local check_command="while $op $ping_cmd -c1 -w1 $ip; do sleep 1; done"
+    echo "Checking connectivity with $check_command"
+
+    if ! timeout $timeout sh -c "$check_command"; then
+        die $LINENO $failmsg
     fi
 }
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c6d9296fba..80e78d5db6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1404,27 +1404,6 @@ function _get_probe_cmd_prefix {
     echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
 }
 
-function _ping_check_neutron {
-    local from_net=$1
-    local ip=$2
-    local timeout_sec=$3
-    local expected=${4:-"True"}
-    local check_command=""
-    probe_cmd=`_get_probe_cmd_prefix $from_net`
-    if [[ "$expected" = "True" ]]; then
-        check_command="while ! $probe_cmd ping -w 1 -c 1 $ip; do sleep 1; done"
-    else
-        check_command="while $probe_cmd ping -w 1 -c 1 $ip; do sleep 1; done"
-    fi
-    if ! timeout $timeout_sec sh -c "$check_command"; then
-        if [[ "$expected" = "True" ]]; then
-            die $LINENO "[Fail] Couldn't ping server"
-        else
-            die $LINENO "[Fail] Could ping server"
-        fi
-    fi
-}
-
 # ssh check
 function _ssh_check_neutron {
     local from_net=$1
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
new file mode 100755
index 0000000000..d36b7f60c8
--- /dev/null
+++ b/tools/ping_neutron.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+#
+# Copyright 2015 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# Ping a neutron guest using a network namespace probe
+
+set -o errexit
+set -o pipefail
+
+TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
+
+# This *must* be run as the admin tenant
+source $TOP_DIR/openrc admin admin
+
+function usage {
+    cat - <<EOF
+ping_neutron.sh <net_name> [ping args]
+
+This provides a wrapper to ping neutron guests that are on isolated
+tenant networks that the caller can't normally reach. It does so by
+creating a network namespace probe.
+
+It takes arguments like ping, except the first arg must be the network
+name.
+
+Note: in environments with duplicate network names, the results are
+non deterministic.
+
+This should *really* be in the neutron cli.
+
+EOF
+    exit 1
+}
+
+NET_NAME=$1
+
+if [[ -z "$NET_NAME" ]]; then
+    echo "Error: net_name is required"
+    usage
+fi
+
+REMANING_ARGS="${@:2}"
+
+# BUG: with duplicate network names, this fails pretty hard.
+NET_ID=$(neutron net-list $NET_NAME | grep "$NET_NAME" | awk '{print $2}')
+PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
+
+# This runs a command inside the specific netns
+NET_NS_CMD="ip netns exec qprobe-$PROBE_ID"
+
+PING_CMD="sudo $NET_NS_CMD ping $REMAING_ARGS"
+echo "Running $PING_CMD"
+$PING_CMD

From 645114b7133bc70fb52f9f0c3f841766595358c8 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 3 Mar 2015 10:56:03 -0500
Subject: [PATCH 0564/3333] Set DevStack to dual stack by default in Kilo+

This patch sets DevStack to run in dual stack networking, with both IPv4
and IPv6 networking configured. This change is required for dual stack
testing at the gate.

A different patch was created against devstack-gate to make this the
default, but the Juno branch of Neutron is missing required fixes to the
L3 agent that are present in Kilo. This was the suggested alternative.

Related-change: I3d416275f77913769b98e77f7e47bed17fc4d1cc

Co-Authored-By: Henry Gessau <gessau@cisco.com>
Co-Authored-By: Andrew Boik <dboik@cisco.com>

Depends-On: Ib66a9109cc1c7999474daca5970d0af1f70886e4
Depends-On: I0f9ea98cb84aa72cb1505fb9ff8ac61561cc1376
Depends-On: I85fe68782bc54f28f3e14aa4a1d042cb15959dac
Depends-On: I9395834f673038dc23b25eaeefe14895fe154e0e

Change-Id: If0e0b818355e4cb1338f7fa72af5e81e24361574
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c6d9296fba..bad2001608 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -65,7 +65,7 @@ GATEWAY_TIMEOUT=30
 # -----------------------------
 
 # Subnet IP version
-IP_VERSION=${IP_VERSION:-4}
+IP_VERSION=${IP_VERSION:-"4+6"}
 # Validate IP_VERSION
 if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
     die $LINENO "IP_VERSION must be either 4, 6, or 4+6"

From 95b994d54815027904504cf173451cd87fd99c66 Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith8@gmail.com>
Date: Sat, 18 Apr 2015 11:20:15 -0600
Subject: [PATCH 0565/3333] Add logging config to cinder.conf

Part of the effort to clean up the Cinder logs is to use
the resource tag in the log format.  We also want to have
some consistency with other projects in how we do logging.

This change adds the logging format to cinder.conf similar to
what Nova and others use, and most importantly turns on the use
of the resource tag that's in olso_log.

We're slowly cleaning up the logging in Cinder by doing things
like replacing "Delete volume %(volume_id)s compoleted" with
("Delete volume completed successfully.", resource=volume)

It woudl be good to have these picked up as we transition so we're
not missing info.  Also, there's sure to be cases where "volume"
isn't a valid dbref and we find issues that need fixed.

Change-Id: I193637fea14d97183f6a9782f37d8edcf929e0c4
---
 lib/cinder | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index de41bc5f79..6439903953 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -264,6 +264,9 @@ function configure_cinder {
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
         setup_colorized_logging $CINDER_CONF DEFAULT "project_id" "user_id"
+    else
+        # Set req-id, project-name and resource in log format
+        iniset $CINDER_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(project_name)s] %(resource)s%(message)s"
     fi
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then

From 71e4e6f601381494e640f424876bad0f92b6dc9b Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Mon, 16 Mar 2015 16:33:01 -0400
Subject: [PATCH 0566/3333] ceilometer: add tempest option to test events

event support in Ceilometer was implemented in Kilo. to enable
tests in tempest, we add an option to run tests only on Kilo+
branch.

Change-Id: Ia4a73b7df343e31e6301f8314490fd42a01b7cd0
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index f856ce05f9..06413f7110 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -411,6 +411,7 @@ function configure_tempest {
     # Ceilometer API optimization happened in juno that allows to run more tests in tempest.
     # Once Tempest retires support for icehouse this flag can be removed.
     iniset $TEMPEST_CONFIG telemetry too_slow_to_test "False"
+    iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
 
     # Object storage
     local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}

From 72a8be60cd6b6efd32ebe2d81346ece48434510f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 9 Apr 2015 13:51:23 +1000
Subject: [PATCH 0567/3333] Add a peak memory tracker to dstat

We can see at-a-glance memory usage during the run with dstat but we
have no way to break that down into an overview of where memory is
going.

This adds a peer-service to dstat that records snapshots of the system
during peak memory usage.  It checks periodically if there is less
memory available than before and, if so, records the running processes
and vm overview.

The intent is to add logic into the verify-pipeline jobs to use this
report and send statistics on peak memory usage to statsd [1].  We can
then build a picture of memory-usage growth over time.  This type of
report would have allowed better insight into issues such as
introduced by Idf3a3a914b54779172776822710b3e52e751b1d1 where
memory-usage jumped dramatically after switching to pip versions of
libraries.  Tracking details of memory usage is going to be an
important part of future development.

[1] http://graphite.openstack.org/

Change-Id: I4b0a8f382dcaa09331987ab84a68546ec29cbc18
---
 lib/dstat                |  6 +++
 tools/peakmem_tracker.sh | 96 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+)
 create mode 100755 tools/peakmem_tracker.sh

diff --git a/lib/dstat b/lib/dstat
index 4b22752ced..f11bfa55c0 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -21,11 +21,17 @@ function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
     run_process dstat "dstat $DSTAT_OPTS"
+
+    # To enable peakmem_tracker add:
+    #    enable_service peakmem_tracker
+    # to your localrc
+    run_process peakmem_tracker "$TOP_DIR/tools/peakmem_tracker.sh"
 }
 
 # stop_dstat() stop dstat process
 function stop_dstat {
     stop_process dstat
+    stop_process peakmem_tracker
 }
 
 # Restore xtrace
diff --git a/tools/peakmem_tracker.sh b/tools/peakmem_tracker.sh
new file mode 100755
index 0000000000..0d5728a538
--- /dev/null
+++ b/tools/peakmem_tracker.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+set -o errexit
+
+# time to sleep between checks
+SLEEP_TIME=20
+
+# MemAvailable is the best estimation and has built-in heuristics
+# around reclaimable memory.  However, it is not available until 3.14
+# kernel (i.e. Ubuntu LTS Trusty misses it).  In that case, we fall
+# back to free+buffers+cache as the available memory.
+USE_MEM_AVAILBLE=0
+if grep -q '^MemAvailable:' /proc/meminfo; then
+    USE_MEM_AVAILABLE=1
+fi
+
+function get_mem_available {
+    if [[ $USE_MEM_AVAILABLE -eq 1 ]]; then
+        awk '/^MemAvailable:/ {print $2}' /proc/meminfo
+    else
+        awk '/^MemFree:/ {free=$2}
+            /^Buffers:/ {buffers=$2}
+            /^Cached:/  {cached=$2}
+            END { print free+buffers+cached }' /proc/meminfo
+    fi
+}
+
+# whenever we see less memory available than last time, dump the
+# snapshot of current usage; i.e. checking the latest entry in the
+# file will give the peak-memory usage
+function tracker {
+    local low_point=$(get_mem_available)
+    while [ 1 ]; do
+
+        local mem_available=$(get_mem_available)
+
+        if [[ $mem_available -lt $low_point ]]; then
+            low_point=$mem_available
+            echo "[[["
+            date
+            echo "---"
+            # always available greppable output; given difference in
+            # meminfo output as described above...
+            echo "peakmem_tracker low_point: $mem_available"
+            echo "---"
+            cat /proc/meminfo
+            echo "---"
+            # would hierarchial view be more useful (-H)?  output is
+            # not sorted by usage then, however, and the first
+            # question is "what's using up the memory"
+            #
+            # there are a lot of kernel threads, especially on a 8-cpu
+            # system.  do a best-effort removal to improve
+            # signal/noise ratio of output.
+            ps --sort=-pmem -eo pid:10,pmem:6,rss:15,ppid:10,cputime:10,nlwp:8,wchan:25,args:100 |
+                grep -v ']$'
+            echo "]]]"
+        fi
+
+        sleep $SLEEP_TIME
+    done
+}
+
+function usage {
+    echo "Usage: $0 [-x] [-s N]" 1>&2
+    exit 1
+}
+
+while getopts ":s:x" opt; do
+    case $opt in
+        s)
+            SLEEP_TIME=$OPTARG
+            ;;
+        x)
+            set -o xtrace
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done
+shift $((OPTIND-1))
+
+tracker

From a80cb815fff0b625718550a2f19a0be08c1af6a1 Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Thu, 12 Mar 2015 17:55:51 -0700
Subject: [PATCH 0568/3333] Add response time to keystone access log

Add the response time to keystone's access log for each request. This
will be the last element in the log-line and will be represented in
microseconds.

Change-Id: I19204369af5cdf06df2237550c350dfb3ffc995d
---
 files/apache-keystone.template | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 1d20af7f90..0b914e2b8f 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,5 +1,6 @@
 Listen %PUBLICPORT%
 Listen %ADMINPORT%
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <VirtualHost *:%PUBLICPORT%>
     WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
@@ -11,7 +12,7 @@ Listen %ADMINPORT%
       ErrorLogFormat "%{cu}t %M"
     </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log combined
+    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
@@ -27,7 +28,7 @@ Listen %ADMINPORT%
       ErrorLogFormat "%{cu}t %M"
     </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log combined
+    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%

From 8f5fe871a45585fdbc72aacca6f8528b1f4d328d Mon Sep 17 00:00:00 2001
From: Ramakrishnan G <rameshg87@gmail.com>
Date: Fri, 17 Apr 2015 12:48:39 +0000
Subject: [PATCH 0569/3333] Fix issue with ml2 plugin on using provider network

This commit fixes the issue that ml2 plugin
sets 'flat_networks' in ml2 configuration file as
empty.  The value of 'flat_networks' need to be set
as the name of the physical network that was specified
in the localrc file (or it's default value).

Change-Id: Ib4c31f6576da57534b36aefebd1ca8cd397c6c1a
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e3b2c4dd28..abe6ea70f5 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -89,7 +89,7 @@ function neutron_plugin_configure_service {
 
     # Allow for setup the flat type network
     if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" && -n "$PHYSICAL_NETWORK" ]]; then
-            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$Q_ML2_FLAT_PHYSNET_OPTIONS"
+            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$PHYSICAL_NETWORK"
     fi
     # REVISIT(rkukura): Setting firewall_driver here for
     # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is

From 2ed09d88fb2847fe8ec813bf518dd945d8d813fa Mon Sep 17 00:00:00 2001
From: Shilla Saebi <shilla.saebi@gmail.com>
Date: Tue, 21 Apr 2015 15:02:13 -0400
Subject: [PATCH 0570/3333] made several changes to guides to comply to doc
 conventions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

“Speed not required” is not a sentence
Gb should be GB
added a , after floating IPs
fixed sentence around “To implement a true multi-node test of Swift
since it did not make sense
removed extra underline line after Machines
removed capitalization of service names to comply with docs conventions
https://wiki.openstack.org/wiki/Documentation/Conventions
changed to DevStack for consistency throughout
Change-Id: I531bf6b2bad62fbf9d1417b2b1ce06de3715e0f0
---
 .../guides/devstack-with-nested-kvm.rst       |  4 +--
 doc/source/guides/multinode-lab.rst           | 16 ++++++------
 doc/source/guides/neutron.rst                 | 26 +++++++++----------
 doc/source/guides/nova.rst                    |  8 +++---
 doc/source/guides/single-vm.rst               |  8 +++---
 5 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 610300be52..b35492ea17 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -54,7 +54,7 @@ that by ensuring `/dev/kvm` character device is present.
 
 
 Configure Nested KVM for AMD-based Machines
---------------------------------------------
+-------------------------------------------
 
 Procedure to enable nested KVM virtualization on AMD-based machines.
 
@@ -121,7 +121,7 @@ attribute `virt_type = kvm` in `/etc/nova.conf`; otherwise, it'll fall
 back to `virt_type=qemu`, i.e. plain QEMU emulation.
 
 Optionally, to explicitly set the type of virtualization, to KVM, by the
-libvirt driver in Nova, the below config attribute can be used in
+libvirt driver in nova, the below config attribute can be used in
 DevStack's ``local.conf``:
 
 ::
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index d963243fa8..b2617c9f17 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -262,17 +262,17 @@ for scripting:
 Swift
 -----
 
-Swift requires a significant amount of resources and is disabled by
-default in DevStack. The support in DevStack is geared toward a minimal
-installation but can be used for testing. To implement a true multi-node
-test of Swift required more than DevStack provides. Enabling it is as
+Swift, OpenStack Object Storage, requires a significant amount of resources
+and is disabled by default in DevStack. The support in DevStack is geared 
+toward a minimal installation but can be used for testing. To implement a
+true multi-node test of swift, additional steps will be required. Enabling it is as
 simple as enabling the ``swift`` service in ``local.conf``:
 
 ::
 
     enable_service s-proxy s-object s-container s-account
 
-Swift will put its data files in ``SWIFT_DATA_DIR`` (default
+Swift, OpenStack Object Storage, will put its data files in ``SWIFT_DATA_DIR`` (default
 ``/opt/stack/data/swift``). The size of the data 'partition' created
 (really a loop-mounted file) is set by ``SWIFT_LOOPBACK_DISK_SIZE``. The
 Swift config files are located in ``SWIFT_CONF_DIR`` (default
@@ -334,14 +334,14 @@ After making changes to the repository or branch, if ``RECLONE`` is not
 set in ``localrc`` it may be necessary to remove the corresponding
 directory from ``/opt/stack`` to force git to re-clone the repository.
 
-For example, to pull Nova from a proposed release candidate in the
-primary Nova repository:
+For example, to pull nova, OpenStack Compute, from a proposed release candidate
+in the primary nova repository:
 
 ::
 
     NOVA_BRANCH=rc-proposed
 
-To pull Glance from an experimental fork:
+To pull glance, OpenStack Image service, from an experimental fork:
 
 ::
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 95cde9699a..3030c7b5f2 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -1,14 +1,14 @@
 ======================================
-Using DevStack with Neutron Networking
+Using DevStack with neutron Networking
 ======================================
 
-This guide will walk you through using OpenStack Neutron with the ML2
+This guide will walk you through using OpenStack neutron with the ML2
 plugin and the Open vSwitch mechanism driver.
 
 Network Interface Configuration
 ===============================
 
-To use Neutron, it is suggested that two network interfaces be present
+To use neutron, it is suggested that two network interfaces be present
 in the host operating system.
 
 The first interface, eth0 is used for the OpenStack management (API,
@@ -62,7 +62,7 @@ connectivity.
 Disabling Next Generation Firewall Tools
 ========================================
 
-Devstack does not properly operate with modern firewall tools.  Specifically
+DevStack does not properly operate with modern firewall tools.  Specifically
 it will appear as if the guest VM can access the external network via ICMP,
 but UDP and TCP packets will not be delivered to the guest VM.  The root cause
 of the issue is that both ufw (Uncomplicated Firewall) and firewalld (Fedora's
@@ -96,13 +96,13 @@ disable ufw if it was enabled, do the following:
 Neutron Networking with Open vSwitch
 ====================================
 
-Configuring Neutron networking in DevStack is very similar to
+Configuring neutron, OpenStack Networking in DevStack is very similar to
 configuring `nova-network` - many of the same configuration variables
 (like `FIXED_RANGE` and `FLOATING_RANGE`) used by `nova-network` are
-used by Neutron, which is intentional.
+used by neutron, which is intentional.
 
 The only difference is the disabling of `nova-network` in your
-local.conf, and the enabling of the Neutron components.
+local.conf, and the enabling of the neutron components.
 
 
 Configuration
@@ -134,16 +134,16 @@ in a real setup FLOATING_RANGE would be a public IP address range.
 Neutron Networking with Open vSwitch and Provider Networks
 ==========================================================
 
-In some instances, it is desirable to use Neutron's provider
+In some instances, it is desirable to use neutron's provider
 networking extension, so that networks that are configured on an
-external router can be utilized by Neutron, and instances created via
+external router can be utilized by neutron, and instances created via
 Nova can attach to the network managed by the external router.
 
 For example, in some lab environments, a hardware router has been
 pre-configured by another party, and an OpenStack developer has been
 given a VLAN tag and IP address range, so that instances created via
 DevStack will use the external router for L3 connectivity, as opposed
-to the Neutron L3 service.
+to the neutron L3 service.
 
 
 Service Configuration
@@ -152,8 +152,8 @@ Service Configuration
 **Control Node**
 
 In this example, the control node will run the majority of the
-OpenStack API and management services (Keystone, Glance,
-Nova, Neutron, etc..)
+OpenStack API and management services (keystone, glance,
+nova, neutron)
 
 
 **Compute Nodes**
@@ -226,4 +226,4 @@ DevStack will automatically add the network interface defined in
 For example, with the above  configuration, a bridge is
 created, named `br-ex` which is managed by Open vSwitch, and the
 second interface on the compute node, `eth1` is attached to the
-bridge, to forward traffic sent by guest vms.
+bridge, to forward traffic sent by guest VMs.
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 0d98f4abad..a91e0d194c 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -1,15 +1,15 @@
 =================
-Nova and devstack
+Nova and DevStack
 =================
 
 This is a rough guide to various configuration parameters for nova
-running with devstack.
+running with DevStack.
 
 
 nova-serialproxy
 ================
 
-In Juno nova implemented a `spec
+In Juno, nova implemented a `spec
 <http://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
 to allow read/write access to the serial console of an instance via
 `nova-serialproxy
@@ -60,7 +60,7 @@ The service can be enabled by adding ``n-sproxy`` to
     #proxyclient_address=127.0.0.1
 
 
-Enabling the service is enough to be functional for a single machine devstack.
+Enabling the service is enough to be functional for a single machine DevStack.
 
 These config options are defined in `nova.console.serial
 <https://github.com/openstack/nova/blob/master/nova/console/serial.py#L33-L52>`_
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index ab46d91b83..c2ce1a34a0 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -3,10 +3,10 @@ All-In-One Single VM
 ====================
 
 Use the cloud to build the cloud! Use your cloud to launch new versions
-of OpenStack in about 5 minutes. When you break it, start over! The VMs
+of OpenStack in about 5 minutes. If you break it, start over! The VMs
 launched in the cloud will be slow as they are running in QEMU
 (emulation), but their primary use is testing OpenStack development and
-operation. Speed not required.
+operation.
 
 Prerequisites Cloud & Image
 ===========================
@@ -15,7 +15,7 @@ Virtual Machine
 ---------------
 
 DevStack should run in any virtual machine running a supported Linux
-release. It will perform best with 4Gb or more of RAM.
+release. It will perform best with 4GB or more of RAM.
 
 OpenStack Deployment & cloud-init
 ---------------------------------
@@ -88,7 +88,7 @@ Using OpenStack
 ---------------
 
 At this point you should be able to access the dashboard. Launch VMs and
-if you give them floating IPs access those VMs from other machines on
+if you give them floating IPs, access those VMs from other machines on
 your network.
 
 One interesting use case is for developers working on a VM on their

From fad7b43abece71ccee09bf0a3b729c72e81d9465 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 21 Apr 2015 13:32:11 -0400
Subject: [PATCH 0571/3333] testr requires python's gdbm

Debian/Ubuntu have *helpfully* removed gdbm from the base python
package and put it into another package, which is not dragged in by
installing python. Testr doesn't function without this.

We should ensure this always gets installed.

Depends-On: If48a8444b02ee1e105bc1d9ce78a0489ea0c405b

Change-Id: I85a0ffe5ee384e055e78fd3164c27d42a86bc39d
---
 files/debs/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/general b/files/debs/general
index c27b77de18..146052643c 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -17,6 +17,7 @@ tcpdump
 tar
 python-dev
 python2.7
+python-gdbm # needed for testr
 bc
 libyaml-dev
 libffi-dev

From 74a85b0f2954f96eeda876ec8fc8f43017aa8a82 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 22 Apr 2015 18:02:39 +0000
Subject: [PATCH 0572/3333] Set policy_file in the oslo_policy group

policy_file in DEFAULT is deprecated

Change-Id: I6698a810d5e6c395a18aed8066e61f8c4bae2408
---
 lib/ceilometer     | 2 +-
 lib/ironic         | 2 +-
 lib/neutron-legacy | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 3a4a4fb167..9abdbfe286 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -195,7 +195,7 @@ function configure_ceilometer {
 
     # Install the policy file for the API server
     cp $CEILOMETER_DIR/etc/ceilometer/policy.json $CEILOMETER_CONF_DIR
-    iniset $CEILOMETER_CONF DEFAULT policy_file $CEILOMETER_CONF_DIR/policy.json
+    iniset $CEILOMETER_CONF oslo_policy policy_file $CEILOMETER_CONF_DIR/policy.json
 
     cp $CEILOMETER_DIR/etc/ceilometer/pipeline.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/event_pipeline.yaml $CEILOMETER_CONF_DIR
diff --git a/lib/ironic b/lib/ironic
index 4ac0100410..4a37f0aafa 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -296,7 +296,7 @@ function configure_ironic {
 # API specific configuration.
 function configure_ironic_api {
     iniset $IRONIC_CONF_FILE DEFAULT auth_strategy keystone
-    iniset $IRONIC_CONF_FILE DEFAULT policy_file $IRONIC_POLICY_JSON
+    iniset $IRONIC_CONF_FILE oslo_policy policy_file $IRONIC_POLICY_JSON
 
     # TODO(Yuki Nishiwaki): This is a temporary work-around until Ironic is fixed(bug#1422632).
     # These codes need to be changed to use the function of configure_auth_token_middleware
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3072d0a0ed..ac1cd0ffc2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1081,7 +1081,7 @@ function _configure_neutron_service {
 
     iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $NEUTRON_CONF DEFAULT policy_file $Q_POLICY_FILE
+    iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
 
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY

From 2796a82ab48107d4445c03938e037e60dd1bbfa9 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 15 Apr 2015 08:59:04 +1000
Subject: [PATCH 0573/3333] Fix negated services with common prefix

The current sed matching mixes up common-prefix matching;
e.g. "-q-lbaas,q-lbaasv2" is changed into just "v2"

This is more verbose, but I think more reliable.  See also
Ib50f782824f89ae4eb9787f11d42416704babd90.

Change-Id: I3faad0841834e24acc811c05015625cf7f848b19
---
 functions-common        | 32 ++++++++++++++++++++++++++++----
 tests/test_functions.sh | 10 +++++++++-
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index 24a462ac21..e6af662069 100644
--- a/functions-common
+++ b/functions-common
@@ -1621,14 +1621,38 @@ function disable_all_services {
 # Uses global ``ENABLED_SERVICES``
 # disable_negated_services
 function disable_negated_services {
-    local tmpsvcs="${ENABLED_SERVICES}"
+    local to_remove=""
+    local remaining=""
+    local enabled=""
     local service
-    for service in ${tmpsvcs//,/ }; do
+
+    # build up list of services that should be removed; i.e. they
+    # begin with "-"
+    for service in ${ENABLED_SERVICES//,/ }; do
         if [[ ${service} == -* ]]; then
-            tmpsvcs=$(echo ${tmpsvcs}|sed -r "s/(,)?(-)?${service#-}(,)?/,/g")
+            to_remove+=",${service#-}"
+        else
+            remaining+=",${service}"
         fi
     done
-    ENABLED_SERVICES=$(_cleanup_service_list "$tmpsvcs")
+
+    # go through the service list.  if this service appears in the "to
+    # be removed" list, drop it
+    for service in ${remaining//,/ }; do
+        local remove
+        local add=1
+        for remove in ${to_remove//,/ }; do
+            if [[ ${remove} == ${service} ]]; then
+                add=0
+                break
+            fi
+        done
+        if [[ $add == 1 ]]; then
+            enabled="${enabled},$service"
+        fi
+    done
+
+    ENABLED_SERVICES=$(_cleanup_service_list "$enabled")
 }
 
 # disable_service() removes the services passed as argument to the
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index a7914f7a1b..4ebb00085e 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -130,7 +130,15 @@ test_disable_negated_services 'a,-a' ''
 test_disable_negated_services 'b,a,-a' 'b'
 test_disable_negated_services 'a,b,-a' 'b'
 test_disable_negated_services 'a,-a,b' 'b'
-
+test_disable_negated_services 'a,aa,-a' 'aa'
+test_disable_negated_services 'aa,-a' 'aa'
+test_disable_negated_services 'a_a, -a_a' ''
+test_disable_negated_services 'a-b, -a-b' ''
+test_disable_negated_services 'a-b, b, -a-b' 'b'
+test_disable_negated_services 'a,-a,av2,b' 'av2,b'
+test_disable_negated_services 'a,aa,-a' 'aa'
+test_disable_negated_services 'a,av2,-a,a' 'av2'
+test_disable_negated_services 'a,-a,av2' 'av2'
 
 echo "Testing is_package_installed()"
 

From 2c5d462d910ba505df44d884f8cf9d6df9252b37 Mon Sep 17 00:00:00 2001
From: Robert Li <baoli@cisco.com>
Date: Tue, 21 Apr 2015 15:48:22 -0400
Subject: [PATCH 0574/3333] Add /usr/local/bin to exec_dirs in rootwrap.conf

devstack installs neutron utilities into /usr/local/bin such as
neutron-keepalived-state-change and neutron-ns-metadata-proxy.
In stead of adding individual filters to allow them to run from that
directory, this patch adds /usr/local/bin into exec_dirs.

Please also refer to I3abd1c173121dc8abb5738d1879db8ac9a98b690 for
discussion on the approach to fix the bug.

Change-Id: Iade8b5b09bb53018485c85f8372fb94dbc2ad2da
Closes-Bug: 1435971
---
 lib/neutron-legacy | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3072d0a0ed..9f26239010 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1145,6 +1145,8 @@ function _neutron_setup_rootwrap {
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
+    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
+
     # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
     ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
     ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"

From 6cdb2e0f1a2c2429587f1e9187344cb26eb31812 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 23 Apr 2015 09:12:59 -0700
Subject: [PATCH 0575/3333] Remove the lvm.conf filter during cleanup

This avoids us leaving the filter in the global lvm config. Without cleaning
this up, we can hit some failures to run stack.sh because devices are excluded
that we need to be able to see. This resets it to what it was before when
we do a cleanup.

Also, do this before we add the line, so we don't add multiple lines on
successive runs.

Closes-bug: #1437998
Change-Id: Idbf8a06b723f79ef16a7c175ee77a8c25f813244
---
 lib/cinder_backends/lvm |  1 +
 lib/lvm                 | 10 +++++++++-
 unstack.sh              |  1 +
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index d369c0c840..35ad209db7 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -39,6 +39,7 @@ function cleanup_cinder_backend_lvm {
 
     # Campsite rule: leave behind a volume group at least as clean as we found it
     clean_lvm_volume_group $VOLUME_GROUP_NAME-$be_name
+    clean_lvm_filter
 }
 
 # configure_cinder_backend_lvm - Set config files, create data dirs, etc
diff --git a/lib/lvm b/lib/lvm
index 54976a36cd..1fe2683e65 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -145,6 +145,13 @@ function init_default_lvm_volume_group {
     fi
 }
 
+# clean_lvm_filter() Remove the filter rule set in set_lvm_filter()
+#
+# Usage: clean_lvm_filter()
+function clean_lvm_filter {
+    sudo sed -i "s/^.*# from devstack$//" /etc/lvm/lvm.conf
+}
+
 # set_lvm_filter() Gather all devices configured for LVM and
 # use them to build a global device filter
 # set_lvm_filter() Create a device filter
@@ -154,7 +161,7 @@ function init_default_lvm_volume_group {
 #
 # Usage: set_lvm_filter()
 function set_lvm_filter {
-    local filter_suffix='"r|.*|" ]'
+    local filter_suffix='"r|.*|" ]  # from devstack'
     local filter_string="global_filter = [ "
     local pv
     local vg
@@ -167,6 +174,7 @@ function set_lvm_filter {
     done
     filter_string=$filter_string$filter_suffix
 
+    clean_lvm_filter
     sudo sed -i "/# global_filter = \[*\]/a\    $global_filter$filter_string" /etc/lvm/lvm.conf
     echo_summary "set lvm.conf device global_filter to: $filter_string"
 }
diff --git a/unstack.sh b/unstack.sh
index 30981fd3c6..ed7e6175ca 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -192,3 +192,4 @@ fi
 
 # BUG: maybe it doesn't exist? We should isolate this further down.
 clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
+clean_lvm_filter

From 2443c37c1dc2b62bb4c423357f3cae33b6e92762 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Fri, 24 Apr 2015 10:58:52 +0800
Subject: [PATCH 0576/3333] Add n-cauth into defalut services

n-cauth work with n-novnc to provide the vnc service for VMs.

Change-Id: Ia5c53aaaf7fe4f881d525a31b097b167fdb8e5c8
Closes-Bug: #1447774
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0b93d32358..2a49ea5ef5 100644
--- a/stackrc
+++ b/stackrc
@@ -49,7 +49,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt
+    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt,n-cauth
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder

From e4af92987a882dc2f7bb48527d0bcdbaa2427d4a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 28 Apr 2015 08:57:57 -0400
Subject: [PATCH 0577/3333] fix warn function

The warn function was putting content into a side log file which made
it kind of hard to keep an eye on when warnings were actually being
issued. Let's just get this into the main output stream.

The calling of the warn function in git_timed was also incorrect, so
the output would not have been what we expected. This solves that as
well.

This will hopefully give us trackable data about how often we need to
recover from git clone errors.

Change-Id: Iee0d2df7fb788a4d34044d29ab10afdcafb9bb5a
---
 functions-common | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index 24a462ac21..a3b8b92f5f 100644
--- a/functions-common
+++ b/functions-common
@@ -174,10 +174,7 @@ function warn {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[WARNING] ${BASH_SOURCE[2]}:$1 $2"
-    echo $msg 1>&2;
-    if [[ -n ${LOGDIR} ]]; then
-        echo $msg >> "${LOGDIR}/error.log"
-    fi
+    echo $msg
     $xtrace
     return $exitcode
 }
@@ -509,7 +506,7 @@ function git_timed {
         fi
 
         count=$(($count + 1))
-        warn "timeout ${count} for git call: [git $@]"
+        warn $LINENO "timeout ${count} for git call: [git $@]"
         if [ $count -eq 3 ]; then
             die $LINENO "Maximum of 3 git retries reached"
         fi

From 7efba991f78667c19d13431524c95f77660781c5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 28 Apr 2015 13:15:22 -0400
Subject: [PATCH 0578/3333] don't source openrc

There is actually no reason why we need openrc for these tests, don't
source it as it prevents some ip math errors from randomly killing
tests.

Change-Id: Iface7c21898d92e14e840379938b25844cd85565
---
 tests/test_functions.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index a7914f7a1b..f8e2c9e2e4 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -7,9 +7,6 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 # Import common functions
 source $TOP/functions
 
-# Import configuration
-source $TOP/openrc
-
 source $TOP/tests/unittest.sh
 
 echo "Testing die_if_not_set()"

From 6e137abbfe66837bc7456425472b53d067591d24 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 29 Apr 2015 08:22:24 -0400
Subject: [PATCH 0579/3333] clean up logging around run_process

We do a bunch of exec magic unwind in run_process that leads to a lot
of confusing lines in the logs under xtrace. Instead, disable xtrace
through these parts to ensure that the flow at the end of the day
makes more sense.

Change-Id: I91e02465240e704a1a0c0036f5073c0295be018e
---
 functions-common | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/functions-common b/functions-common
index a3b8b92f5f..f2e7076ccf 100644
--- a/functions-common
+++ b/functions-common
@@ -1137,6 +1137,10 @@ function zypper_install {
 # the command.
 # _run_process service "command-line" [group]
 function _run_process {
+    # disable tracing through the exec redirects, it's just confusing in the logs.
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local service=$1
     local command="$2"
     local group=$3
@@ -1160,6 +1164,9 @@ function _run_process {
         export PYTHONUNBUFFERED=1
     fi
 
+    # reenable xtrace before we do *real* work
+    $xtrace
+
     # Run under ``setsid`` to force the process to become a session and group leader.
     # The pid saved can be used with pkill -g to get the entire process group.
     if [[ -n "$group" ]]; then

From 8d558c8c270c36a78aeb23f16da084508916a89e Mon Sep 17 00:00:00 2001
From: sridhargaddam <sridhar.gaddam@enovance.com>
Date: Mon, 4 May 2015 14:04:16 +0000
Subject: [PATCH 0580/3333] Set local_ip only when TENANT_TUNNELS are enabled

In an installation with VLAN tenant networks, devstack should
not configure the local_ip (which is applicable only when
tenant_tunnels are used). This is causing failures in Neutron
for an IPv6 only setup. This patch addresses this issue, but
configuring the local_ip only when TENANT_TUNNELS are enabled.

Related-Bug: #1447693
Change-Id: I0e2a2d8b6ce0ad87f6c0d318ac522dbab50d44ee
---
 lib/neutron_plugins/ml2 | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index abe6ea70f5..88537774b7 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -104,8 +104,10 @@ function neutron_plugin_configure_service {
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
 
-    # Since we enable the tunnel TypeDrivers, also enable a local_ip
-    iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
+    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
+        # Set local_ip if TENANT_TUNNELS are enabled.
+        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
+    fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
 

From dfcc3871c022516330b6afb6c74751ac42a87480 Mon Sep 17 00:00:00 2001
From: Joe D'Andrea <jdandrea@research.att.com>
Date: Wed, 29 Apr 2015 15:39:17 -0400
Subject: [PATCH 0581/3333] cinder setup now refers to CINDER_VOLUME_CLEAR and
 volume_clear

CINDER_SECURE_DELETE previously iniset volume_clear to none as a
side effect, however secure_delete is not documented in cinder.
Now using CINDER_VOLUME_CLEAR outright. CINDER_SECURE_DELETE is
supported but now deprecated.

Change-Id: Ic8694cf16654c23b27d23853a9f06ddf1050fa93
Closes-Bug: #1450159
---
 lib/cinder | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 6439903953..eb0e1d7600 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -77,9 +77,20 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 
 
 # Should cinder perform secure deletion of volumes?
-# Defaults to true, can be set to False to avoid this bug when testing:
+# Defaults to zero. Can also be set to none or shred.
+# This was previously CINDER_SECURE_DELETE (True or False).
+# Equivalents using CINDER_VOLUME_CLEAR are zero and none, respectively.
+# Set to none to avoid this bug when testing:
 # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1023755
-CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
+if [[ -n $CINDER_SECURE_DELETE ]]; then
+    CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
+    if [[ $CINDER_SECURE_DELETE == "False" ]]; then
+        CINDER_VOLUME_CLEAR_DEFAULT="none"
+    fi
+    DEPRECATED_TEXT="$DEPRECATED_TEXT\nConfigure secure Cinder volume deletion using CINDER_VOLUME_CLEAR instead of CINDER_SECURE_DELETE.\n"
+fi
+CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
+CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
 # Cinder reports allocations back to the scheduler on periodic intervals
 # it turns out we can get an "out of space" issue when we run tests too
@@ -256,9 +267,8 @@ function configure_cinder {
 
     iniset_rpc_backend cinder $CINDER_CONF
 
-    if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
-        iniset $CINDER_CONF DEFAULT secure_delete False
-        iniset $CINDER_CONF DEFAULT volume_clear none
+    if [[ "$CINDER_VOLUME_CLEAR" == "none" ]] || [[ "$CINDER_VOLUME_CLEAR" == "zero" ]] || [[ "$CINDER_VOLUME_CLEAR" == "shred" ]]; then
+        iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
     fi
 
     # Format logging

From d5537c1dc835413f1911ab797e3007d85322eace Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 30 Apr 2015 21:10:48 -0400
Subject: [PATCH 0582/3333] Add toggle to run Nova API and EC2-API under
 Apache2

Inspired by keystone and rcbops-cookbooks's nova scripts,
this review adds apache2 templates for two of the Nova
services. Also add code in lib/nova to switch between
the old and new ways to these two services. The patch
depends on the Nova review mentioned below as the two
scripts that are needed will be in Nova's repository.

TODO for later would be to switch on NOVA_USE_MOD_WSGI
when ENABLE_HTTPD_MOD_WSGI_SERVICES is switched on.

Related Nova blueprint:
https://blueprints.launchpad.net/nova/+spec/run-nova-services-under-apache2

Depends-On: Idd7d3d1b3cc5770cdecea7afe6db3c89d5b2c0d0
Change-Id: I9fc0c601db2776d3e9084be84065e728e3f5d414
---
 README.md                          |   4 ++
 files/apache-nova-api.template     |  16 +++++
 files/apache-nova-ec2-api.template |  16 +++++
 lib/nova                           | 101 ++++++++++++++++++++++++++++-
 4 files changed, 135 insertions(+), 2 deletions(-)
 create mode 100644 files/apache-nova-api.template
 create mode 100644 files/apache-nova-ec2-api.template

diff --git a/README.md b/README.md
index 04f5fd9711..9853c3d88d 100644
--- a/README.md
+++ b/README.md
@@ -149,6 +149,10 @@ Example (Keystone):
 
     KEYSTONE_USE_MOD_WSGI="True"
 
+Example (Nova):
+
+    NOVA_USE_MOD_WSGI="True"
+
 Example (Swift):
 
     SWIFT_USE_MOD_WSGI="True"
diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
new file mode 100644
index 0000000000..70ccedddc8
--- /dev/null
+++ b/files/apache-nova-api.template
@@ -0,0 +1,16 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess nova-api processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup nova-api
+    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/nova-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
\ No newline at end of file
diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
new file mode 100644
index 0000000000..ae4cf94a38
--- /dev/null
+++ b/files/apache-nova-ec2-api.template
@@ -0,0 +1,16 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess nova-ec2-api processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup nova-ec2-api
+    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/nova-ec2-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
\ No newline at end of file
diff --git a/lib/nova b/lib/nova
index 807dfceeae..768346a983 100644
--- a/lib/nova
+++ b/lib/nova
@@ -16,6 +16,7 @@
 #
 # - install_nova
 # - configure_nova
+# - _config_nova_apache_wsgi
 # - create_nova_conf
 # - init_nova
 # - start_nova
@@ -62,6 +63,15 @@ NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 # Expect to remove in L or M.
 NOVA_API_VERSION=${NOVA_API_VERSION-default}
 
+if is_suse; then
+    NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/srv/www/htdocs/nova}
+else
+    NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/var/www/nova}
+fi
+
+# Toggle for deploying Nova-API under HTTPD + mod_wsgi
+NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
+
 if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
     EC2_SERVICE_PROTOCOL="https"
@@ -223,6 +233,64 @@ function cleanup_nova {
     #fi
 }
 
+# _cleanup_nova_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
+function _cleanup_nova_apache_wsgi {
+    sudo rm -f $NOVA_WSGI_DIR/*
+    sudo rm -f $(apache_site_config_for nova-api)
+    sudo rm -f $(apache_site_config_for nova-ec2-api)
+}
+
+# _config_nova_apache_wsgi() - Set WSGI config files of Keystone
+function _config_nova_apache_wsgi {
+    sudo mkdir -p $NOVA_WSGI_DIR
+
+    local nova_apache_conf=$(apache_site_config_for nova-api)
+    local nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
+    local nova_ssl=""
+    local nova_certfile=""
+    local nova_keyfile=""
+    local nova_api_port=$NOVA_SERVICE_PORT
+    local nova_ec2_api_port=$EC2_SERVICE_PORT
+    local venv_path=""
+
+    if is_ssl_enabled_service nova-api; then
+        nova_ssl="SSLEngine On"
+        nova_certfile="SSLCertificateFile $NOVA_SSL_CERT"
+        nova_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
+    fi
+    if [[ ${USE_VENV} = True ]]; then
+        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/python2.7/site-packages"
+    fi
+
+    # copy proxy vhost and wsgi helper files
+    sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
+    sudo cp $NOVA_DIR/nova/wsgi/nova-ec2-api.py $NOVA_WSGI_DIR/nova-ec2-api
+
+    sudo cp $FILES/apache-nova-api.template $nova_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$nova_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-api|g;
+        s|%SSLENGINE%|$nova_ssl|g;
+        s|%SSLCERTFILE%|$nova_certfile|g;
+        s|%SSLKEYFILE%|$nova_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $nova_apache_conf
+
+    sudo cp $FILES/apache-nova-ec2-api.template $nova_ec2_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$nova_ec2_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-ec2-api|g;
+        s|%SSLENGINE%|$nova_ssl|g;
+        s|%SSLCERTFILE%|$nova_certfile|g;
+        s|%SSLKEYFILE%|$nova_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $nova_ec2_apache_conf
+}
+
 # configure_nova() - Set config files, create data dirs, etc
 function configure_nova {
     # Put config files in ``/etc/nova`` for everyone to find
@@ -453,12 +521,16 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$NOVA_USE_MOD_WSGI" == "False" ]  ; then
         setup_colorized_logging $NOVA_CONF DEFAULT
     else
         # Show user_name and project_name instead of user_id and project_id
         iniset $NOVA_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
     fi
+    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
+        _config_nova_apache_wsgi
+    fi
+
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
         iniset $NOVA_CONF DEFAULT instance_usage_audit_period "hour"
@@ -655,6 +727,13 @@ function install_nova {
     git_clone $NOVA_REPO $NOVA_DIR $NOVA_BRANCH
     setup_develop $NOVA_DIR
     sudo install -D -m 0644 -o $STACK_USER {$NOVA_DIR/tools/,/etc/bash_completion.d/}nova-manage.bash_completion
+
+    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
+        install_apache_wsgi
+        if is_ssl_enabled_service "nova-api"; then
+            enable_mod_ssl
+        fi
+    fi
 }
 
 # start_nova_api() - Start the API process ahead of other things
@@ -671,7 +750,18 @@ function start_nova_api {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    run_process n-api "$NOVA_BIN_DIR/nova-api"
+    # If the site is not enabled then we are in a grenade scenario
+    local enabled_site_file=$(apache_site_config_for nova-api)
+    if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
+        enable_apache_site nova-api
+        enable_apache_site nova-ec2-api
+        restart_apache_server
+        tail_log nova /var/log/$APACHE_NAME/nova-api.log
+        tail_log nova /var/log/$APACHE_NAME/nova-ec2-api.log
+    else
+        run_process n-api "$NOVA_BIN_DIR/nova-api"
+    fi
+
     echo "Waiting for nova-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$SERVICE_HOST:$service_port; then
         die $LINENO "nova-api did not start"
@@ -780,6 +870,13 @@ function stop_nova_compute {
 }
 
 function stop_nova_rest {
+    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
+        disable_apache_site nova-api
+        disable_apache_site nova-ec2-api
+        restart_apache_server
+    else
+        stop_process n-api
+    fi
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.

From ee3d2a8ece24efe8ee8b0304c133574967eb60d3 Mon Sep 17 00:00:00 2001
From: Gregory Haynes <greg@greghaynes.net>
Date: Tue, 5 May 2015 22:14:24 +0000
Subject: [PATCH 0583/3333] Import xattr with sudo early on

xattr fails to import due to being unable to build cffi bindings unless
it is imported as root beforehand.

Depends-On: I6a9d64277974933ae9b7bbe2a40b8a0eb0fa8c6a

Change-Id: I835e55bbafc7e0640987e6f3c8ee0c873f875ee0
Closes-Bug: #1451992
---
 stack.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stack.sh b/stack.sh
index e5ee0dc03f..3925bb0ccf 100755
--- a/stack.sh
+++ b/stack.sh
@@ -708,6 +708,12 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # Pre-build some problematic wheels
 if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
     source $TOP_DIR/tools/build_wheels.sh
+
+    # Due to https://bugs.launchpad.net/swift/+bug/1451992 we have to import
+    # this package with root once so the CFFI bindings can be built. We have
+    # to therefore install it so we can import it.
+    pip_install xattr
+    sudo python -c "import xattr"
 fi
 
 

From e8a2fa431b4b432c5a05da0cab6c4af5999e5aee Mon Sep 17 00:00:00 2001
From: Cyril Roelandt <cyril.roelandt@enovance.com>
Date: Wed, 6 May 2015 17:30:48 +0200
Subject: [PATCH 0584/3333] lib/swift: the s3_token middleware should be
 provided by keystonemiddleware

Recently, keystoneclient.middleware has been moved from keystoneclient to
keystonemiddleware. The latter should be used.

Change-Id: Ib9489a21b988b32fc17399c08eeb60862efae034
Closes-Bug: #1452315
---
 lib/swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 456dde4c8d..820042d972 100644
--- a/lib/swift
+++ b/lib/swift
@@ -439,7 +439,7 @@ function configure_swift {
     if is_service_enabled swift3; then
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
 [filter:s3token]
-paste.filter_factory = keystoneclient.middleware.s3_token:filter_factory
+paste.filter_factory = keystonemiddleware.s3_token:filter_factory
 auth_port = ${KEYSTONE_AUTH_PORT}
 auth_host = ${KEYSTONE_AUTH_HOST}
 auth_protocol = ${KEYSTONE_AUTH_PROTOCOL}

From 5a59ac7d43bb10a5bbc912b94edea19e1009b675 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 6 May 2015 09:48:54 -0400
Subject: [PATCH 0585/3333] create a more generic work around for cffi & wheels

This is an attempt to fix the cffi vs. wheels bug in a more generic
way by just ensuring that pip has installed cffi with a pip understood
version into the venv before we try to do any builds.

Related-Bug: #1451992

Change-Id: Ibc58668c53933033405b40f79b0e9ffc73a01a6f
---
 stack.sh              |  6 ------
 tools/build_wheels.sh | 12 ++++++++++++
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/stack.sh b/stack.sh
index 3925bb0ccf..e5ee0dc03f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -708,12 +708,6 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # Pre-build some problematic wheels
 if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
     source $TOP_DIR/tools/build_wheels.sh
-
-    # Due to https://bugs.launchpad.net/swift/+bug/1451992 we have to import
-    # this package with root once so the CFFI bindings can be built. We have
-    # to therefore install it so we can import it.
-    pip_install xattr
-    sudo python -c "import xattr"
 fi
 
 
diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
index c57568fa64..14c2999c8f 100755
--- a/tools/build_wheels.sh
+++ b/tools/build_wheels.sh
@@ -60,6 +60,18 @@ virtualenv $TMP_VENV_PATH
 # Install modern pip and wheel
 PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install -U pip wheel
 
+# BUG: cffi has a lot of issues. It has no stable ABI, if installed
+# code is built with a different ABI than the one that's detected at
+# load time, it tries to compile on the fly for the new ABI in the
+# install location (which will probably be /usr and not
+# writable). Also cffi is often included via setup_requires by
+# packages, which have different install rules (allowing betas) than
+# pip has.
+#
+# Because of this we must pip install cffi into the venv to build
+# wheels.
+PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install_gr cffi
+
 # ``VENV_PACKAGES`` is a list of packages we want to pre-install
 VENV_PACKAGE_FILE=$FILES/venv-requirements.txt
 if [[ -r $VENV_PACKAGE_FILE ]]; then

From 52a3bebcfcb09ec2b78d0357f1a074458ab04053 Mon Sep 17 00:00:00 2001
From: Clint Byrum <clint@fewbar.com>
Date: Tue, 5 May 2015 15:00:03 -0700
Subject: [PATCH 0586/3333] Do not set OS_CACERT if there is no CA cert

In openrc, if we set OS_CACERT, some things will expect it to be there
in pre-flight checks. But it may very well be missing. This "fails
closed" because if we find the file, we try to use it, but if we don't
find the file, and the user thought we should be using it, we'll just
not be able to verify the server's name, and the libs will fail on that.

Change-Id: Ia5d06afa74bc645c2f19711cfa37e57a377c329b
Closes-Bug: #1452036
---
 openrc | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/openrc b/openrc
index aec8a2a642..64faa58a3a 100644
--- a/openrc
+++ b/openrc
@@ -78,8 +78,14 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
-# Set the pointer to our CA certificate chain.  Harmless if TLS is not used.
-export OS_CACERT=${OS_CACERT:-$INT_CA_DIR/ca-chain.pem}
+# Set OS_CACERT to a default CA certificate chain if it exists.
+if [[ ! -v OS_CACERT ]] ; then
+    DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem
+    # If the file does not exist, this may confuse preflight sanity checks
+    if [ -e $DEFAULT_OS_CACERT ] ; then
+        export OS_CACERT=$DEFAULT_OS_CACERT
+    fi
+fi
 
 # Currently novaclient needs you to specify the *compute api* version.  This
 # needs to match the config of your catalog returned by Keystone.

From 168b7c226cd17fa75eecc0e6ce4c81d001747f78 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 7 May 2015 08:57:28 -0400
Subject: [PATCH 0587/3333] dump iptables in the worlddump

If we fail during devstack / grenade runs, it would be nice to have
the map of iptables that are currently active as well. This makes it
handy to start figuring out what's going on when test servers don't
ping.

Change-Id: Ia31736ef2cb0221586d30c089473dfdc1db90e23
---
 tools/worlddump.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 8dd455c274..cb32510526 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -61,6 +61,17 @@ def disk_space():
     print dfraw
 
 
+def iptables_dump():
+    tables = ['filter', 'nat', 'mangle']
+    print """
+IP Tables Dump
+===============
+"""
+    for table in tables:
+        print os.popen("sudo iptables --line-numbers -L -nv -t %s"
+                       % table).read()
+
+
 def process_list():
     print """
 Process Listing
@@ -79,6 +90,7 @@ def main():
         os.dup2(f.fileno(), sys.stdout.fileno())
         disk_space()
         process_list()
+        iptables_dump()
 
 
 if __name__ == '__main__':

From 9fd75f57fd8bdbd1926b1942462d439f9e496204 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Mon, 23 Mar 2015 11:45:00 +0100
Subject: [PATCH 0588/3333] Update default cirros version

Update the default CIRROS_VERSION to 0.3.4, which has better support
for IPv6 and some other bugfixes.

Co-Authored-By: Scott Moser <smoser@ubuntu.com>
Change-Id: I03ee6e1403680fb6c421225a7cadaf8a82edf702
Depends-On: Iac9f108d947ff4a51f99c6e8ad9d1ac5b32c000a
---
 stackrc             | 2 +-
 tools/xen/README.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index abedb001d1..076efc17b4 100644
--- a/stackrc
+++ b/stackrc
@@ -536,7 +536,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.3.4"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
diff --git a/tools/xen/README.md b/tools/xen/README.md
index c8f47be393..61694e9616 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -97,7 +97,7 @@ Of course, use real passwords if this machine is exposed.
     # Download a vhd and a uec image
     IMAGE_URLS="\
     https://github.com/downloads/citrix-openstack/warehouse/cirros-0.3.0-x86_64-disk.vhd.tgz,\
-    http://download.cirros-cloud.net/0.3.2/cirros-0.3.2-x86_64-uec.tar.gz"
+    http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-uec.tar.gz"
 
     # Explicitly set virt driver
     VIRT_DRIVER=xenserver

From d4c89289f9d4bf88c065dca85a46c9b08464b56c Mon Sep 17 00:00:00 2001
From: Waldemar Znoinski <waldemar.znoinski@intel.com>
Date: Thu, 7 May 2015 17:14:21 +0100
Subject: [PATCH 0589/3333] Set datapath to $OVS_DATAPATH_TYPE for bridges

This change extends devstack to configure the br-ex,
br-<phy> and Xenserver's br-$GUEST_INTERFACE_DEFAULT
datapaths when OVS_DATAPATH_TYPE is set.

Change-Id: I71e590de86e7526e8423140463752d6b3ad14214
Closes-Bug: #1416444
---
 lib/neutron_plugins/openvswitch_agent |  4 ++--
 lib/neutron_plugins/ovs_base          | 18 +++++++++++++-----
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 1d24f3b837..2a05e2dcfa 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -59,7 +59,7 @@ function neutron_plugin_configure_plugin_agent {
         OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
 
         # Configure bridge manually with physical interface as port for multi-node
-        sudo ovs-vsctl --no-wait -- --may-exist add-br $OVS_PHYSICAL_BRIDGE
+        _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE
     fi
     if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS
@@ -92,7 +92,7 @@ function neutron_plugin_configure_plugin_agent {
         # Set up domU's L2 agent:
 
         # Create a bridge "br-$GUEST_INTERFACE_DEFAULT"
-        sudo ovs-vsctl --no-wait -- --may-exist add-br "br-$GUEST_INTERFACE_DEFAULT"
+        _neutron_ovs_base_add_bridge "br-$GUEST_INTERFACE_DEFAULT"
         # Add $GUEST_INTERFACE_DEFAULT to that bridge
         sudo ovs-vsctl add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
 
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 51999c60e4..5ecca81ce9 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -16,13 +16,21 @@ function is_neutron_ovs_base_plugin {
     return 0
 }
 
+function _neutron_ovs_base_add_bridge {
+    local bridge=$1
+    local addbr_cmd="sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge"
+
+    if [ "$OVS_DATAPATH_TYPE" != "" ] ; then
+        addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
+    fi
+
+    $addbr_cmd
+}
+
 function _neutron_ovs_base_setup_bridge {
     local bridge=$1
     neutron-ovs-cleanup
-    sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge
-    if [[ $OVS_DATAPATH_TYPE != "" ]]; then
-        sudo ovs-vsctl set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}
-    fi
+    _neutron_ovs_base_add_bridge $bridge
     sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
 }
 
@@ -93,7 +101,7 @@ function _neutron_ovs_base_configure_l3_agent {
         sudo ip link set $Q_PUBLIC_VETH_EX up
         sudo ip addr flush dev $Q_PUBLIC_VETH_EX
     else
-        sudo ovs-vsctl -- --may-exist add-br $PUBLIC_BRIDGE
+        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
         sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
     fi
 }

From 1b5a49829eebea87b2cd1fd057f808612f72e7cf Mon Sep 17 00:00:00 2001
From: Matthew Gilliard <matthew.gilliard@hp.com>
Date: Fri, 10 Apr 2015 08:42:22 +0100
Subject: [PATCH 0590/3333] Set live_migrate_paused_instances=True in
 tempest.conf

Live migration of paused instances is a new Nova feature in Kilo, and will not
be backported.  The compute_feature_enabled.live_migrate_paused_instances flag
defaults to False for this reason, but can be set to True here. The tempest
config option and this change can both be removed at Juno-EOL.

The related Tempest change: I5c6fd3de7ea45d1851bb40037c64ad7fb5e6dc48

Change-Id: I3a83e43d252b88c234438a224e2fbebc0a81eaff
Related-Bug: #1305062
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cd8fbd725f..6ce245aef1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -364,6 +364,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
     # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
     iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
+    # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
+    iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_paused_instances True
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0

From 0a9d03d5059356a9f494ad331b548cc74d85d75f Mon Sep 17 00:00:00 2001
From: Yuki Nishiwaki <uckey.1067@gmail.com>
Date: Fri, 8 May 2015 16:29:55 +0900
Subject: [PATCH 0591/3333] Move install_infra before execute build_wheels.sh

The pip_install_gr function in build_wheels.sh use requirements project.
So requirements project must exist before execute build_wheels.sh.
Then we moved install_infra function which install requirements project.

Change-Id: I8f80ecafff0f7e1942731379b70bccac338ea3b3
Closes-Bug: 1453012
---
 stack.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index e5ee0dc03f..f0aafafb3a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -705,6 +705,9 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # Virtual Environment
 # -------------------
 
+# Install required infra support libraries
+install_infra
+
 # Pre-build some problematic wheels
 if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
     source $TOP_DIR/tools/build_wheels.sh
@@ -713,10 +716,6 @@ fi
 
 # Extras Pre-install
 # ------------------
-
-# Install required infra support libraries
-install_infra
-
 # Phase: pre-install
 run_phase stack pre-install
 

From 41309002fa1a1c00f8485ef71acdec93fbfbd014 Mon Sep 17 00:00:00 2001
From: Vladyslav Drok <vdrok@mirantis.com>
Date: Wed, 29 Apr 2015 13:36:52 +0300
Subject: [PATCH 0592/3333] Add new options to baremetal config section

This change adds setting of deploy_img_dir and node_uuid baremetal
config options during tempest configuration to enable ironic w/o
glance scenario testing.
Needed for change I171e85cb8a21fae4da45028f1f798988a36f6c95

Change-Id: I6fd393390389c4c643b93198fa461fc2adc415ae
---
 lib/ironic  | 8 +++++++-
 lib/tempest | 2 ++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 4a37f0aafa..7493c3cab2 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -58,6 +58,7 @@ IRONIC_HW_EPHEMERAL_DISK=${IRONIC_HW_EPHEMERAL_DISK:-0}
 IRONIC_IPMIINFO_FILE=${IRONIC_IPMIINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
 
 # Set up defaults for functional / integration testing
+IRONIC_NODE_UUID=${IRONIC_NODE_UUID:-`uuidgen`}
 IRONIC_SCRIPTS_DIR=${IRONIC_SCRIPTS_DIR:-$TOP_DIR/tools/ironic/scripts}
 IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$TOP_DIR/tools/ironic/templates}
 IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False IRONIC_BAREMETAL_BASIC_OPS)
@@ -619,7 +620,12 @@ function enroll_nodes {
             node_options+=" -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID"
         fi
 
-        local node_id=$(ironic node-create --chassis_uuid $chassis_id \
+        # First node created will be used for testing in ironic w/o glance
+        # scenario, so we need to know its UUID.
+        local standalone_node_uuid=$([ $total_nodes -eq 0 ] && echo "--uuid $IRONIC_NODE_UUID")
+
+        local node_id=$(ironic node-create $standalone_node_uuid\
+            --chassis_uuid $chassis_id \
             --driver $IRONIC_DEPLOY_DRIVER \
             -p cpus=$ironic_node_cpu\
             -p memory_mb=$ironic_node_ram\
diff --git a/lib/tempest b/lib/tempest
index cd8fbd725f..44b2f96101 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -481,6 +481,8 @@ function configure_tempest {
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
         iniset $TEMPEST_CONFIG baremetal unprovision_timeout 300
+        iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
+        iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
         iniset $TEMPEST_CONFIG compute-feature-enabled console_output False
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False

From b3a8f6032a47fd78fcaeb46bca6572a700c775ce Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 8 May 2015 06:59:39 -0700
Subject: [PATCH 0593/3333] nova: remove allow_migrate_to_same_host config
 usage

Nova commit 9b224641295af3763d011816d6399565ac7b98de removed the option
in Liberty so we can remove it's usage in devstack.

Related-Bug: #1364851

Change-Id: If051f43fb75d57c118db4e8e97895ff06fbb54e2
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 807dfceeae..75e585d9d2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -392,7 +392,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
     if [ "$NOVA_ALLOW_MOVE_TO_SAME_HOST" == "True" ]; then
         iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
-        iniset $NOVA_CONF DEFAULT allow_migrate_to_same_host "True"
     fi
     iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"

From ad0a518ca92f86a9f1361d717413f8d1d65d2994 Mon Sep 17 00:00:00 2001
From: Accela Zhao <accelazh@gmail.com>
Date: Fri, 8 May 2015 23:55:31 +0800
Subject: [PATCH 0594/3333] Use an actual existing nova scheduler in README.md

The Multi-Node Setup guide in README.md

    https://github.com/openstack-dev/devstack/tree/master#multi-node-setup

guides users to use

    SCHEDULER=nova.scheduler.simple.SimpleScheduler

where the SimpleScheduler doesn't actually exist in nova. Even
though this is just an example, it is misleading enough for a
beginner to put SimpleScheduler into local.conf. The resulting
error message where n-sch fails to start

    ImportError: No module named simple

Isn't intuitive enough and may takes the beginner long time to
locate what's wrong.

This patch replaces SimpleScheduler with a real existing
FilterScheduler in nova.

Change-Id: I14a2a5c0604ce08a498accfc3a795c1c9aa3e642
Closes-bug: #1453186
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 04f5fd9711..7ba4e7461c 100644
--- a/README.md
+++ b/README.md
@@ -328,7 +328,7 @@ that includes at least:
 You likely want to change your `localrc` section to run a scheduler that
 will balance VMs across hosts:
 
-    SCHEDULER=nova.scheduler.simple.SimpleScheduler
+    SCHEDULER=nova.scheduler.filter_scheduler.FilterScheduler
 
 You can then run many compute nodes, each of which should have a `stackrc`
 which includes the following, with the IP address of the above controller node:

From 99de7cc1782ed00905068d0ec894ac08db5aa06f Mon Sep 17 00:00:00 2001
From: Accela Zhao <accelazh@gmail.com>
Date: Fri, 8 May 2015 18:14:11 +0800
Subject: [PATCH 0595/3333] Fix wrong `sudo ceph -c` command in lib/ceph

The `sudo -c ${CEPH_CONF_FILE} ceph ...` in lib/ceph misplaced
`ceph`. The correct syntax is `sudo ceph -c ${CEPH_CONF_FILE} ...`,
see lib/ceph:308.

While installing ./stack.sh with ceph enabled, the above malformed
command raises a `usage: sudo -h | -K | -k | -V ...` error and stops
the installation.

This patch fixes `sudo -c ${CEPH_CONF_FILE} ceph ...` by moving
`ceph` to the right place.

Change-Id: I3da943d5a353d99b09787f804b79c1d006a09d96
Closes-bug: #1453055
---
 lib/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceph b/lib/ceph
index 76747ccd77..4068e26222 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -279,7 +279,7 @@ function configure_ceph_embedded_nova {
     # configure Nova service options, ceph pool, ceph user and ceph key
     sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} size ${CEPH_REPLICAS}
     if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo -c ${CEPH_CONF_FILE} ceph osd pool set ${NOVA_CEPH_POOL} crush_ruleset ${RULE_ID}
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} crush_ruleset ${RULE_ID}
     fi
 }
 

From 091b42b7da7650d528bb5f88ec411a04af3da828 Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Fri, 8 May 2015 17:43:08 +0000
Subject: [PATCH 0596/3333] Stop installing nose and pylint from distros

The distro packages of nose and pylint depend on python-setuptools
on some platforms, and on some of those platforms (at least CentOS
6.x) you can't resolve dependencies on python-setuptools properly if
you've forcibly removed it already (as we do on our CI workers). It
appears that any current upstream use of these tools in relation to
DevStack-based testing is now relying on tox and pip to obtain them
instead.

Change-Id: Ibd16ac550c90364115caf57fae4f5f4cb5d5f238
---
 files/debs/swift        | 3 ---
 files/rpms-suse/general | 1 -
 files/rpms-suse/horizon | 2 --
 files/rpms-suse/swift   | 1 -
 files/rpms/general      | 1 -
 files/rpms/horizon      | 1 -
 6 files changed, 9 deletions(-)

diff --git a/files/debs/swift b/files/debs/swift
index 0089d27fee..726786ee18 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -1,8 +1,5 @@
 curl
 make
 memcached
-# NOTE python-nose only exists because of swift functional job, we should probably
-# figure out a more consistent way of installing this from test-requirements.txt instead
-python-nose
 sqlite3
 xfsprogs
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 2219426141..42756d8fcc 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -15,7 +15,6 @@ openssh
 openssl
 psmisc
 python-cmd2 # dist:opensuse-12.3
-python-pylint
 screen
 tar
 tcpdump
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
index d1f378a70d..c45eae6153 100644
--- a/files/rpms-suse/horizon
+++ b/files/rpms-suse/horizon
@@ -12,7 +12,5 @@ python-coverage
 python-dateutil
 python-eventlet
 python-mox
-python-nose
-python-pylint
 python-sqlalchemy-migrate
 python-xattr
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
index 4b14098064..9c0d188fe2 100644
--- a/files/rpms-suse/swift
+++ b/files/rpms-suse/swift
@@ -8,7 +8,6 @@ python-devel
 python-eventlet
 python-greenlet
 python-netifaces
-python-nose
 python-simplejson
 python-xattr
 sqlite3
diff --git a/files/rpms/general b/files/rpms/general
index e17d6d6458..7b2c00ad5c 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -14,7 +14,6 @@ libxml2-devel
 libxslt-devel
 pkgconfig
 psmisc
-pylint
 python-devel
 screen
 tar
diff --git a/files/rpms/horizon b/files/rpms/horizon
index 8d7f0371ef..b2cf0ded6f 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,6 +1,5 @@
 Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pylint
 pyxattr
 pcre-devel  # pyScss

From 98f59aafaf88328f6aee98efa0f563fb8bf91ebd Mon Sep 17 00:00:00 2001
From: Mahito OGURA <earthdragon77@gmail.com>
Date: Mon, 11 May 2015 18:02:34 +0900
Subject: [PATCH 0597/3333] Fix function and test for 'trueorfalse'.

The function's comment is written as follow, however the function accepts
other values (ex. "e", "t", "T", "f", "F", etc...).

---
Accepts as False: 0 no No NO false False FALSE
Accepts as True: 1 yes Yes YES true True TRUE
---

Moreover if testval mach True or False, the function exits without resetting
xtrace.

This patch fixes the issue and add test patterns.

Change-Id: Ie48a859476faff22a4dfef466516e2d7d62ef0c0
Closes-bug: #1453687
---
 functions-common        | 14 ++++++++------
 tests/test_truefalse.sh | 33 +++++++++++++++++++++------------
 2 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/functions-common b/functions-common
index 4d07c03cce..6d9a0fa6b0 100644
--- a/functions-common
+++ b/functions-common
@@ -51,14 +51,16 @@ TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 function trueorfalse {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+
     local default=$1
-    local literal=$2
-    local testval=${!literal:-}
+    local testval=${!2:-}
+
+    case "$testval" in
+        "1" | [yY]es | "YES" | [tT]rue | "TRUE" ) echo "True" ;;
+        "0" | [nN]o | "NO" | [fF]alse | "FALSE" ) echo "False" ;;
+        * )                                       echo "$default" ;;
+    esac
 
-    [[ -z "$testval" ]] && { echo "$default"; return; }
-    [[ "0 no No NO false False FALSE" =~ "$testval" ]] && { echo "False"; return; }
-    [[ "1 yes Yes YES true True TRUE" =~ "$testval" ]] && { echo "True"; return; }
-    echo "$default"
     $xtrace
 }
 
diff --git a/tests/test_truefalse.sh b/tests/test_truefalse.sh
index e57948a407..ebd9650649 100755
--- a/tests/test_truefalse.sh
+++ b/tests/test_truefalse.sh
@@ -8,27 +8,36 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/functions
 source $TOP/tests/unittest.sh
 
-function test_truefalse {
+function test_trueorfalse {
     local one=1
     local captrue=True
     local lowtrue=true
-    local abrevtrue=t
+    local uppertrue=TRUE
+    local capyes=Yes
+    local lowyes=yes
+    local upperyes=YES
+
+    for default in True False; do
+        for name in one captrue lowtrue uppertrue capyes lowyes upperyes; do
+                assert_equal "True" $(trueorfalse $default $name) "\$(trueorfalse $default $name)"
+        done
+    done
+
     local zero=0
     local capfalse=False
     local lowfalse=false
-    local abrevfalse=f
-    for against in True False; do
-        for name in one captrue lowtrue abrevtrue; do
-            assert_equal "True" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
-        done
-    done
-    for against in True False; do
-        for name in zero capfalse lowfalse abrevfalse; do
-            assert_equal "False" $(trueorfalse $against $name) "\$(trueorfalse $against $name)"
+    local upperfalse=FALSE
+    local capno=No
+    local lowno=no
+    local upperno=NO
+
+    for default in True False; do
+        for name in zero capfalse lowfalse upperfalse capno lowno upperno; do
+            assert_equal "False" $(trueorfalse $default $name) "\$(trueorfalse $default $name)"
         done
     done
 }
 
-test_truefalse
+test_trueorfalse
 
 report_results

From 331a64f9d087692cba10f3dd15c6b01595e1c127 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 11 May 2015 10:02:24 -0500
Subject: [PATCH 0598/3333] Use stevedore for keystone backends

With bp stevedore, keystone will load backend drivers using
stevedore entrypoints. Using the qualified class name is
deprecated.

Since stevedore is going to validate that the entrypoint is
found, there's no need to list the valid backends, so backend
validation was removed. This change will cause the server to fail
to start if the backends are misconfigured rather than using the
default one.

The names of the stevedore endpoints are "sql", "ldap", etc.,
rather than the qualified class name, so the way that these
are specified in KEYSTONE_IDENTITY_BACKEND, etc., is the same as
the stevedore entrypoint and there's no need to translate.

Change-Id: I81e4e3a6c97b0057610e6b256aff5df4da884e33
---
 lib/keystone | 42 +++++++++++-------------------------------
 1 file changed, 11 insertions(+), 31 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 997bb14967..976aad0c6f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -64,21 +64,21 @@ KEYSTONE_EXTENSIONS=${KEYSTONE_EXTENSIONS:-}
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
-# Select the backend for Keystone's service catalog
+# Select the Catalog backend driver
 KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
 KEYSTONE_CATALOG=$KEYSTONE_CONF_DIR/default_catalog.templates
 
-# Select the backend for Tokens
+# Select the token persistence backend driver
 KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
 
-# Select the backend for Identity
+# Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 
-# Select the backend for Assignment
+# Select the Assignment backend driver
 KEYSTONE_ASSIGNMENT_BACKEND=${KEYSTONE_ASSIGNMENT_BACKEND:-sql}
 
-# Select Keystone's token format
-# Choose from 'UUID', 'PKI', or 'PKIZ'
+# Select Keystone's token provider (and format)
+# Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
@@ -99,12 +99,6 @@ KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the tenant for service accounts in Keystone
 SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
 
-# valid identity backends as per dir keystone/identity/backends
-KEYSTONE_VALID_IDENTITY_BACKENDS=kvs,ldap,pam,sql
-
-# valid assignment backends as per dir keystone/identity/backends
-KEYSTONE_VALID_ASSIGNMENT_BACKENDS=kvs,ldap,sql
-
 # if we are running with SSL use https protocols
 if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
     KEYSTONE_AUTH_PROTOCOL="https"
@@ -225,15 +219,8 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT member_role_name "_member_"
     fi
 
-    # check if identity backend is valid
-    if [[ "$KEYSTONE_VALID_IDENTITY_BACKENDS" =~ "$KEYSTONE_IDENTITY_BACKEND" ]]; then
-        iniset $KEYSTONE_CONF identity driver "keystone.identity.backends.$KEYSTONE_IDENTITY_BACKEND.Identity"
-    fi
-
-    # check if assignment backend is valid
-    if [[ "$KEYSTONE_VALID_ASSIGNMENT_BACKENDS" =~ "$KEYSTONE_ASSIGNMENT_BACKEND" ]]; then
-        iniset $KEYSTONE_CONF assignment driver "keystone.assignment.backends.$KEYSTONE_ASSIGNMENT_BACKEND.Assignment"
-    fi
+    iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
+    iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
@@ -257,23 +244,17 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
-        iniset $KEYSTONE_CONF token provider keystone.token.providers.$KEYSTONE_TOKEN_FORMAT.Provider
+        iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
     fi
 
     iniset $KEYSTONE_CONF database connection `database_connection_url keystone`
     iniset $KEYSTONE_CONF ec2 driver "keystone.contrib.ec2.backends.sql.Ec2"
 
-    if [[ "$KEYSTONE_TOKEN_BACKEND" = "sql" ]]; then
-        iniset $KEYSTONE_CONF token driver keystone.token.persistence.backends.sql.Token
-    elif [[ "$KEYSTONE_TOKEN_BACKEND" = "memcache" ]]; then
-        iniset $KEYSTONE_CONF token driver keystone.token.persistence.backends.memcache.Token
-    else
-        iniset $KEYSTONE_CONF token driver keystone.token.persistence.backends.kvs.Token
-    fi
+    iniset $KEYSTONE_CONF token driver "$KEYSTONE_TOKEN_BACKEND"
 
+    iniset $KEYSTONE_CONF catalog driver "$KEYSTONE_CATALOG_BACKEND"
     if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
         # Configure ``keystone.conf`` to use sql
-        iniset $KEYSTONE_CONF catalog driver keystone.catalog.backends.sql.Catalog
         inicomment $KEYSTONE_CONF catalog template_file
     else
         cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
@@ -300,7 +281,6 @@ function configure_keystone {
         " -i $KEYSTONE_CATALOG
 
         # Configure ``keystone.conf`` to use templates
-        iniset $KEYSTONE_CONF catalog driver "keystone.catalog.backends.templated.Catalog"
         iniset $KEYSTONE_CONF catalog template_file "$KEYSTONE_CATALOG"
     fi
 

From 71a8eccdc3594b2e0395d7df75e69eb877269e81 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 11 May 2015 10:37:18 -0500
Subject: [PATCH 0599/3333] Remove setting nonexistant [ec2] driver option in
 keystone

There's no [ec2] driver option in keystone.

Change-Id: Ifee92127f32db85d4d55f665471c8da1c9a970e7
---
 lib/keystone | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 976aad0c6f..a1d832c5ae 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -248,7 +248,6 @@ function configure_keystone {
     fi
 
     iniset $KEYSTONE_CONF database connection `database_connection_url keystone`
-    iniset $KEYSTONE_CONF ec2 driver "keystone.contrib.ec2.backends.sql.Ec2"
 
     iniset $KEYSTONE_CONF token driver "$KEYSTONE_TOKEN_BACKEND"
 

From eb7a0d9b2d22da3d1e0fbc3f581c597a1a510666 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 11 May 2015 12:54:33 -0500
Subject: [PATCH 0600/3333] Remove KEYSTONE_AUTH_CACHE_DIR

Keystone doesn't use a cache directory.

Change-Id: I569b406db46cf6bdabcbfd8c5eb6f3cbdbc3cff7
---
 lib/keystone | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index a1d832c5ae..63c3f7973a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -50,7 +50,6 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
-KEYSTONE_AUTH_CACHE_DIR=${KEYSTONE_AUTH_CACHE_DIR:-/var/cache/keystone}
 if is_suse; then
     KEYSTONE_WSGI_DIR=${KEYSTONE_WSGI_DIR:-/srv/www/htdocs/keystone}
 else
@@ -475,10 +474,6 @@ function init_keystone {
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl
         $KEYSTONE_BIN_DIR/keystone-manage pki_setup
-
-        # Create cache dir
-        sudo install -d -o $STACK_USER $KEYSTONE_AUTH_CACHE_DIR
-        rm -f $KEYSTONE_AUTH_CACHE_DIR/*
     fi
 }
 

From 60a140571ea3a4ad07772f1eedae6d4d1a6e4c67 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 11 May 2015 14:53:39 -0400
Subject: [PATCH 0601/3333] add network info to the worlddump

This adds potentially helpful networking info to the world dump.

It also refactors some of the output mechanisms into reusable
functions for cleanliness in the code.

Change-Id: I39f95bd487c152925f8fadd1799149db35cffd52
---
 tools/worlddump.py | 49 +++++++++++++++++++++++++++++++---------------
 1 file changed, 33 insertions(+), 16 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index cb32510526..7f2614dcaa 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -41,12 +41,24 @@ def warn(msg):
     print "WARN: %s" % msg
 
 
+def _dump_cmd(cmd):
+    print cmd
+    print "-" * len(cmd)
+    print
+    print os.popen(cmd).read()
+
+
+def _header(name):
+    print
+    print name
+    print "=" * len(name)
+    print
+
+
 def disk_space():
     # the df output
-    print """
-File System Summary
-===================
-"""
+    _header("File System Summary")
+
     dfraw = os.popen("df -Ph").read()
     df = [s.split() for s in dfraw.splitlines()]
     for fs in df:
@@ -63,22 +75,26 @@ def disk_space():
 
 def iptables_dump():
     tables = ['filter', 'nat', 'mangle']
-    print """
-IP Tables Dump
-===============
-"""
+    _header("IP Tables Dump")
+
     for table in tables:
-        print os.popen("sudo iptables --line-numbers -L -nv -t %s"
-                       % table).read()
+        _dump_cmd("sudo iptables --line-numbers -L -nv -t %s" % table)
+
+
+def network_dump():
+    _header("Network Dump")
+
+    _dump_cmd("brctl show")
+    _dump_cmd("arp -n")
+    _dump_cmd("ip addr")
+    _dump_cmd("ip link")
+    _dump_cmd("ip route")
 
 
 def process_list():
-    print """
-Process Listing
-===============
-"""
-    psraw = os.popen("ps axo user,ppid,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,args").read()
-    print psraw
+    _header("Process Listing")
+    _dump_cmd("ps axo "
+              "user,ppid,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,args")
 
 
 def main():
@@ -90,6 +106,7 @@ def main():
         os.dup2(f.fileno(), sys.stdout.fileno())
         disk_space()
         process_list()
+        network_dump()
         iptables_dump()
 
 

From cbe12eb72eaf70001b80b0a6357cde3048cbc81f Mon Sep 17 00:00:00 2001
From: Louis Taylor <louis@kragniz.eu>
Date: Tue, 12 May 2015 16:49:49 +0000
Subject: [PATCH 0602/3333] glance: remove deprecated store options

glance_store has now been fully migrated, so we can remove these from the
config files.

Change-Id: I987ab6338b235f0beeed7c7fe74b0f5b6526f70d
---
 lib/glance | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/lib/glance b/lib/glance
index f543e54c7a..4e1bd24ef5 100644
--- a/lib/glance
+++ b/lib/glance
@@ -138,26 +138,12 @@ function configure_glance {
     fi
 
     # Store specific configs
-    iniset $GLANCE_API_CONF DEFAULT filesystem_store_datadir $GLANCE_IMAGE_DIR/
-
-    # NOTE(flaper87): Until Glance is fully migrated, set these configs in both
-    # sections.
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
 
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then
-        iniset $GLANCE_API_CONF DEFAULT default_store swift
-        iniset $GLANCE_API_CONF DEFAULT swift_store_auth_address $KEYSTONE_SERVICE_URI/v2.0/
-        iniset $GLANCE_API_CONF DEFAULT swift_store_user $SERVICE_TENANT_NAME:glance-swift
-        iniset $GLANCE_API_CONF DEFAULT swift_store_key $SERVICE_PASSWORD
-        iniset $GLANCE_API_CONF DEFAULT swift_store_create_container_on_put True
-
-        iniset $GLANCE_API_CONF DEFAULT known_stores "glance.store.filesystem.Store, glance.store.http.Store, glance.store.swift.Store"
-
-        # NOTE(flaper87): Until Glance is fully migrated, set these configs in both
-        # sections.
         iniset $GLANCE_API_CONF glance_store default_store swift
         iniset $GLANCE_API_CONF glance_store swift_store_auth_address $KEYSTONE_SERVICE_URI/v2.0/
         iniset $GLANCE_API_CONF glance_store swift_store_user $SERVICE_TENANT_NAME:glance-swift
@@ -211,9 +197,6 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
 
     # Store specific confs
-    # NOTE(flaper87): Until Glance is fully migrated, set these configs in both
-    # sections.
-    iniset $GLANCE_CACHE_CONF DEFAULT filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
     cp -p $GLANCE_DIR/etc/policy.json $GLANCE_POLICY_JSON

From 3a2c86aabfa985dbdc998f02201649f49f3adab7 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Tue, 12 May 2015 13:41:25 +0000
Subject: [PATCH 0603/3333] Add python_version function to functions-common

This makes it possible to list virtual site-package directories
without statically stating the python version, which is a bit ugly.

Change-Id: I3e7ac39eb43cdc4f656e0c90f3bfb23545722aef
---
 functions-common | 6 ++++++
 lib/keystone     | 2 +-
 lib/nova         | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 4d07c03cce..d28ef85cc1 100644
--- a/functions-common
+++ b/functions-common
@@ -1897,6 +1897,12 @@ function maskip {
     echo $subnet
 }
 
+# Return the current python as "python<major>.<minor>"
+function python_version {
+    local python_version=$(python -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    echo "python${python_version}"
+}
+
 # Service wrapper to restart services
 # restart_service service-name
 function restart_service {
diff --git a/lib/keystone b/lib/keystone
index 997bb14967..0f369af71d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -164,7 +164,7 @@ function _config_keystone_apache_wsgi {
         keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
     fi
     if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/python2.7/site-packages"
+        venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
     fi
 
     # copy proxy vhost and wsgi file
diff --git a/lib/nova b/lib/nova
index 6ac9da3b41..7d2145b170 100644
--- a/lib/nova
+++ b/lib/nova
@@ -259,7 +259,7 @@ function _config_nova_apache_wsgi {
         nova_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
     fi
     if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/python2.7/site-packages"
+        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
     fi
 
     # copy proxy vhost and wsgi helper files

From ce8e6f6aa61c267df7892e7e8748963db8c83bc3 Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith@solidfire.com>
Date: Tue, 12 May 2015 17:28:59 -0600
Subject: [PATCH 0604/3333] Add ability to specify cinder lvm_type option

Cinder has had an lvm_type option for quite a while
that allows the LVM driver to be configured to use
thin provisioning.

This required an additional PPA in Precise, but is
available in the default Trusty packages.

This patch adds the lvm_type option, and we'll use
it to do gate testing against the lvm_thin configuration.

Change-Id: I99c7fea131f3d79747ec75052adf8b24f41ba483
---
 lib/cinder              | 4 ++++
 lib/cinder_backends/lvm | 1 +
 2 files changed, 5 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index eb0e1d7600..93285bf99c 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -65,6 +65,10 @@ CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
+# What type of LVM device should Cinder use for LVM backend
+# Defaults to default, which is thick, the other valid choice
+# is thin, which as the name implies utilizes lvm thin provisioning.
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 35ad209db7..411b82c190 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -51,6 +51,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
     iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
     if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
         iniset $CINDER_CONF $be_name volume_clear none

From 1fa82aab6634bf815d162978e33b211e1fdef343 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Tue, 12 May 2015 20:04:49 -0700
Subject: [PATCH 0605/3333] Install g-r version of OSC in configure_tempest

configure_tempest uses python-openstackclient (OSC) and we call
configure_tempest in grenade on the new side. So we need to make sure
the version of OSC is installed matches global-requirements on new.

Change-Id: I6fae9b8b081355b45e7c8d622d8db2482d41b464
Closes-Bug: #1454467
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6ce245aef1..1af5c7a795 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -106,6 +106,10 @@ function configure_tempest {
         pip_install_gr testrepository
     fi
 
+    # Used during configuration so make sure we have the correct
+    # version installed
+    pip_install_gr python-openstackclient
+
     local image_lines
     local images
     local num_images

From 38bee18a2c440b01bd1c2187cb2a62a841e3b7ae Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 11 May 2015 16:51:10 +0200
Subject: [PATCH 0606/3333] Cinder: Set os_privileged_user credentials (for
 os-assisted-snapshots)

When calling os-assisted-snapshots APIs, Cinder often (by default) needs
 to pass an admin token to Nova. Currently it uses the credentials of
 the current user.

This will cause calls to Nova APIs for assisted volume snapshots to fail.

Configuration options should be added to specify different credentials
for talking to Nova.

Change-Id: I9e3ed53f4e1349d57a0c33518445f54ac63e36ec
Related-Bug: #1308736
---
 lib/cinder | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index eb0e1d7600..7ad7ef9b0c 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -299,6 +299,11 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT ssl_key_file "$CINDER_SSL_KEY"
     fi
 
+    # Set os_privileged_user credentials (used for os-assisted-snapshots)
+    iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
+    iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
+    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_TENANT_NAME"
+
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts

From a747cd25f76440a2320bd5e1c65252d31eb9b189 Mon Sep 17 00:00:00 2001
From: Swapnil Kulkarni <me@coolsvap.net>
Date: Wed, 13 May 2015 09:26:15 +0000
Subject: [PATCH 0607/3333] Update the glance image-list with openstack image
 list

Change-Id: I0f0f15cb204daf12fbc12384f04a2cd9618c4bef
---
 lib/tempest | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index cd8fbd725f..df986728c1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -143,9 +143,7 @@ function configure_tempest {
                 image_uuid_alt="$IMAGE_UUID"
             fi
             images+=($IMAGE_UUID)
-        # TODO(stevemar): update this command to use openstackclient's `openstack image list`
-        # when it supports listing by status.
-        done < <(glance image-list --status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+        done < <(openstack image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
 
         case "${#images[*]}" in
             0)

From 737e94202fe635b7bd9ad59195352bb5dfe54817 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 12 May 2015 19:51:39 -0400
Subject: [PATCH 0608/3333] dump compute consoles on fail as well

This provides a dump of the compute consoles as well on failure.

Change-Id: Ib253537a54a1b9d83a930bbefa4512e039575fd1
---
 tools/worlddump.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 7f2614dcaa..d846f10025 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -18,6 +18,7 @@
 
 import argparse
 import datetime
+import fnmatch
 import os
 import os.path
 import sys
@@ -97,6 +98,14 @@ def process_list():
               "user,ppid,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,args")
 
 
+def compute_consoles():
+    _header("Compute consoles")
+    for root, dirnames, filenames in os.walk('/opt/stack'):
+        for filename in fnmatch.filter(filenames, 'console.log'):
+            fullpath = os.path.join(root, filename)
+            _dump_cmd("sudo cat %s" % fullpath)
+
+
 def main():
     opts = get_options()
     fname = filename(opts.dir)
@@ -108,6 +117,7 @@ def main():
         process_list()
         network_dump()
         iptables_dump()
+        compute_consoles()
 
 
 if __name__ == '__main__':

From 6816234dc84b3e81a3de8745e84691d09123ba7f Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 13 May 2015 15:41:03 -0500
Subject: [PATCH 0609/3333] Save stackenv values more often

Having these for debugging can be handy

Change-Id: I18c2658eec83a0f20f697a3c4c36aa1cf46b7a92
---
 functions-common | 20 ++++++++++++++++++++
 stack.sh         | 13 +++++++------
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index 52d80fb95b..974f5934e4 100644
--- a/functions-common
+++ b/functions-common
@@ -43,6 +43,25 @@ declare -A GITDIR
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
+# Save these variables to .stackenv
+STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
+    KEYSTONE_AUTH_PROTOCOL KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
+    LOGFILE OS_CACERT SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP"
+
+
+# Saves significant environment variables to .stackenv for later use
+# Refers to a lot of globals, only TOP_DIR and STACK_ENV_VARS are required to
+# function, the rest are simply saved and do not cause problems if they are undefined.
+# save_stackenv [tag]
+function save_stackenv {
+    local tag=${1:-""}
+    # Save some values we generated for later use
+    time_stamp=$(date "+$TIMESTAMP_FORMAT")
+    echo "# $time_stamp $tag" >$TOP_DIR/.stackenv
+    for i in $STACK_ENV_VARS; do
+        echo $i=${!i} >>$TOP_DIR/.stackenv
+    done
+}
 
 # Normalize config values to True or False
 # Accepts as False: 0 no No NO false False FALSE
@@ -68,6 +87,7 @@ function isset {
     [[ -v "$1" ]]
 }
 
+
 # Control Functions
 # =================
 
diff --git a/stack.sh b/stack.sh
index f0aafafb3a..4f7a805f3f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -669,6 +669,9 @@ if is_service_enabled s-proxy; then
     fi
 fi
 
+# Save configuration values
+save_stackenv $LINENO
+
 
 # Install Packages
 # ================
@@ -950,6 +953,9 @@ fi
 # Initialize the directory for service status check
 init_service_check
 
+# Save configuration values
+save_stackenv $LINENO
+
 
 # Start Services
 # ==============
@@ -1294,12 +1300,7 @@ fi
 
 
 # Save some values we generated for later use
-CURRENT_RUN_TIME=$(date "+$TIMESTAMP_FORMAT")
-echo "# $CURRENT_RUN_TIME" >$TOP_DIR/.stackenv
-for i in BASE_SQL_CONN ENABLED_SERVICES HOST_IP LOGFILE \
-    SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP KEYSTONE_AUTH_PROTOCOL OS_CACERT; do
-    echo $i=${!i} >>$TOP_DIR/.stackenv
-done
+save_stackenv
 
 
 # Wrapup configuration

From 9e220b9b2b560b160c93058b255b3d69e49c0cbc Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@hp.com>
Date: Tue, 24 Mar 2015 16:32:03 -0700
Subject: [PATCH 0610/3333] Move trove into in-tree plugin

Once the trove code is copied into the trove repo and it is used
as a devstack-plugin, we can remove trove-specific code from
devstack.

Change-Id: I8f9f1a015edb7ec1033e2eaf0b29ab15d89384ce
Depends-On: I3506dec0e6097f9c2e9267110fdfb768faa23c85
---
 MAINTAINERS.rst              |   6 -
 clean.sh                     |   1 -
 doc/source/index.rst         |   3 -
 extras.d/70-trove.sh         |  32 -----
 lib/trove                    | 252 -----------------------------------
 stackrc                      |  28 ++--
 tests/test_libs_from_pypi.sh |   2 +-
 unstack.sh                   |   4 -
 8 files changed, 10 insertions(+), 318 deletions(-)
 delete mode 100644 extras.d/70-trove.sh
 delete mode 100644 lib/trove

diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index 20e8655d69..d3e8c67487 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -75,12 +75,6 @@ SUSE
 Tempest
 ~~~~~~~
 
-Trove
-~~~~~
-
-* Nikhil Manchanda <SlickNik@gmail.com>
-* Michael Basnight <mbasnight@gmail.com>
-
 Xen
 ~~~
 * Bob Ball <bob.ball@citrix.com>
diff --git a/clean.sh b/clean.sh
index 7db519b0dc..c31a65fd40 100755
--- a/clean.sh
+++ b/clean.sh
@@ -51,7 +51,6 @@ source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ironic
-source $TOP_DIR/lib/trove
 
 
 # Extras Source
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 4435b495ae..e0c3f3a5d6 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -173,7 +173,6 @@ Scripts
 * `lib/swift <lib/swift.html>`__
 * `lib/tempest <lib/tempest.html>`__
 * `lib/tls <lib/tls.html>`__
-* `lib/trove <lib/trove.html>`__
 * `lib/zaqar <lib/zaqar.html>`__
 * `unstack.sh <unstack.sh.html>`__
 * `clean.sh <clean.sh.html>`__
@@ -182,7 +181,6 @@ Scripts
 * `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
 * `extras.d/70-sahara.sh <extras.d/70-sahara.sh.html>`__
-* `extras.d/70-trove.sh <extras.d/70-trove.sh.html>`__
 * `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
 * `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
@@ -242,6 +240,5 @@ Exercises
 * `exercises/sahara.sh <exercises/sahara.sh.html>`__
 * `exercises/sec\_groups.sh <exercises/sec_groups.sh.html>`__
 * `exercises/swift.sh <exercises/swift.sh.html>`__
-* `exercises/trove.sh <exercises/trove.sh.html>`__
 * `exercises/volumes.sh <exercises/volumes.sh.html>`__
 * `exercises/zaqar.sh <exercises/zaqar.sh.html>`__
diff --git a/extras.d/70-trove.sh b/extras.d/70-trove.sh
deleted file mode 100644
index f284354e1f..0000000000
--- a/extras.d/70-trove.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-# trove.sh - Devstack extras script to install Trove
-
-if is_service_enabled trove; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/trove
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing Trove"
-        install_trove
-        install_troveclient
-        cleanup_trove
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring Trove"
-        configure_trove
-
-        if is_service_enabled key; then
-            create_trove_accounts
-        fi
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        # Initialize trove
-        init_trove
-
-        # Start the trove API and trove taskmgr components
-        echo_summary "Starting Trove"
-        start_trove
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_trove
-    fi
-fi
diff --git a/lib/trove b/lib/trove
deleted file mode 100644
index b0a96100c2..0000000000
--- a/lib/trove
+++ /dev/null
@@ -1,252 +0,0 @@
-#!/bin/bash
-#
-# lib/trove
-# Functions to control the configuration and operation of the **Trove** service
-
-# Dependencies:
-# ``functions`` file
-# ``DEST``, ``STACK_USER`` must be defined
-# ``SERVICE_{HOST|PROTOCOL|TOKEN}`` must be defined
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# install_trove
-# configure_trove
-# init_trove
-# start_trove
-# stop_trove
-# cleanup_trove
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-if is_service_enabled neutron; then
-    TROVE_HOST_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
-else
-    TROVE_HOST_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
-fi
-
-# Set up default configuration
-GITDIR["python-troveclient"]=$DEST/python-troveclient
-
-TROVE_DIR=$DEST/trove
-TROVE_CONF_DIR=${TROVE_CONF_DIR:-/etc/trove}
-TROVE_CONF=${TROVE_CONF:-$TROVE_CONF_DIR/trove.conf}
-TROVE_TASKMANAGER_CONF=${TROVE_TASKMANAGER_CONF:-$TROVE_CONF_DIR/trove-taskmanager.conf}
-TROVE_CONDUCTOR_CONF=${TROVE_CONDUCTOR_CONF:-$TROVE_CONF_DIR/trove-conductor.conf}
-TROVE_GUESTAGENT_CONF=${TROVE_GUESTAGENT_CONF:-$TROVE_CONF_DIR/trove-guestagent.conf}
-TROVE_API_PASTE_INI=${TROVE_API_PASTE_INI:-$TROVE_CONF_DIR/api-paste.ini}
-
-TROVE_LOCAL_CONF_DIR=$TROVE_DIR/etc/trove
-TROVE_LOCAL_API_PASTE_INI=$TROVE_LOCAL_CONF_DIR/api-paste.ini
-TROVE_AUTH_CACHE_DIR=${TROVE_AUTH_CACHE_DIR:-/var/cache/trove}
-TROVE_DATASTORE_TYPE=${TROVE_DATASTORE_TYPE:-"mysql"}
-TROVE_DATASTORE_VERSION=${TROVE_DATASTORE_VERSION:-"5.6"}
-TROVE_DATASTORE_PACKAGE=${TROVE_DATASTORE_PACKAGE:-"mysql-server-5.6"}
-
-# Support entry points installation of console scripts
-if [[ -d $TROVE_DIR/bin ]]; then
-    TROVE_BIN_DIR=$TROVE_DIR/bin
-else
-    TROVE_BIN_DIR=$(get_python_exec_prefix)
-fi
-TROVE_MANAGE=$TROVE_BIN_DIR/trove-manage
-
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,trove
-
-
-# Functions
-# ---------
-
-# Test if any Trove services are enabled
-# is_trove_enabled
-function is_trove_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"tr-" ]] && return 0
-    return 1
-}
-
-# setup_trove_logging() - Adds logging configuration to conf files
-function setup_trove_logging {
-    local CONF=$1
-    iniset $CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $CONF DEFAULT use_syslog $SYSLOG
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        # Add color to logging output
-        setup_colorized_logging $CONF DEFAULT tenant user
-    fi
-}
-
-# create_trove_accounts() - Set up common required Trove accounts
-
-# Tenant               User       Roles
-# ------------------------------------------------------------------
-# service              trove     admin        # if enabled
-
-function create_trove_accounts {
-    if [[ "$ENABLED_SERVICES" =~ "trove" ]]; then
-
-        create_service_user "trove"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            local trove_service=$(get_or_create_service "trove" \
-                "database" "Trove Service")
-            get_or_create_endpoint $trove_service \
-                "$REGION_NAME" \
-                "http://$SERVICE_HOST:8779/v1.0/\$(tenant_id)s" \
-                "http://$SERVICE_HOST:8779/v1.0/\$(tenant_id)s" \
-                "http://$SERVICE_HOST:8779/v1.0/\$(tenant_id)s"
-        fi
-    fi
-}
-
-# stack.sh entry points
-# ---------------------
-
-# cleanup_trove() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_trove {
-    #Clean up dirs
-    rm -fr $TROVE_AUTH_CACHE_DIR/*
-    rm -fr $TROVE_CONF_DIR/*
-}
-
-# configure_trove() - Set config files, create data dirs, etc
-function configure_trove {
-    setup_develop $TROVE_DIR
-
-    # Create the trove conf dir and cache dirs if they don't exist
-    sudo install -d -o $STACK_USER ${TROVE_CONF_DIR} ${TROVE_AUTH_CACHE_DIR}
-
-    # Copy api-paste file over to the trove conf dir
-    cp $TROVE_LOCAL_API_PASTE_INI $TROVE_API_PASTE_INI
-
-    # (Re)create trove conf files
-    rm -f $TROVE_CONF
-    rm -f $TROVE_TASKMANAGER_CONF
-    rm -f $TROVE_CONDUCTOR_CONF
-
-    iniset $TROVE_CONF DEFAULT rabbit_userid $RABBIT_USERID
-    iniset $TROVE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-    iniset $TROVE_CONF database connection `database_connection_url trove`
-    iniset $TROVE_CONF DEFAULT default_datastore $TROVE_DATASTORE_TYPE
-    setup_trove_logging $TROVE_CONF
-    iniset $TROVE_CONF DEFAULT trove_api_workers "$API_WORKERS"
-
-    configure_auth_token_middleware $TROVE_CONF trove $TROVE_AUTH_CACHE_DIR
-
-    # (Re)create trove taskmanager conf file if needed
-    if is_service_enabled tr-tmgr; then
-        TROVE_AUTH_ENDPOINT=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
-
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT rabbit_userid $RABBIT_USERID
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $TROVE_TASKMANAGER_CONF database connection `database_connection_url trove`
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_user radmin
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_tenant_name trove
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
-        iniset $TROVE_TASKMANAGER_CONF DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
-        setup_trove_logging $TROVE_TASKMANAGER_CONF
-    fi
-
-    # (Re)create trove conductor conf file if needed
-    if is_service_enabled tr-cond; then
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT rabbit_userid $RABBIT_USERID
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-        iniset $TROVE_CONDUCTOR_CONF database connection `database_connection_url trove`
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_user radmin
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_tenant_name trove
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
-        iniset $TROVE_CONDUCTOR_CONF DEFAULT control_exchange trove
-        setup_trove_logging $TROVE_CONDUCTOR_CONF
-    fi
-
-    # Set up Guest Agent conf
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT rabbit_userid $RABBIT_USERID
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT rabbit_host $TROVE_HOST_GATEWAY
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT nova_proxy_admin_user radmin
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT nova_proxy_admin_tenant_name trove
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT nova_proxy_admin_pass $RADMIN_USER_PASS
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT trove_auth_url $TROVE_AUTH_ENDPOINT
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT control_exchange trove
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT ignore_users os_admin
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT log_dir /var/log/trove/
-    iniset $TROVE_GUESTAGENT_CONF DEFAULT log_file trove-guestagent.log
-    setup_trove_logging $TROVE_GUESTAGENT_CONF
-}
-
-# install_troveclient() - Collect source and prepare
-function install_troveclient {
-    if use_library_from_git "python-troveclient"; then
-        git_clone_by_name "python-troveclient"
-        setup_dev_lib "python-troveclient"
-    fi
-}
-
-# install_trove() - Collect source and prepare
-function install_trove {
-    git_clone $TROVE_REPO $TROVE_DIR $TROVE_BRANCH
-}
-
-# init_trove() - Initializes Trove Database as a Service
-function init_trove {
-    # (Re)Create trove db
-    recreate_database trove
-
-    # Initialize the trove database
-    $TROVE_MANAGE db_sync
-
-    # If no guest image is specified, skip remaining setup
-    [ -z "$TROVE_GUEST_IMAGE_URL" ] && return 0
-
-    # Find the glance id for the trove guest image
-    # The image is uploaded by stack.sh -- see $IMAGE_URLS handling
-    GUEST_IMAGE_NAME=$(basename "$TROVE_GUEST_IMAGE_URL")
-    GUEST_IMAGE_NAME=${GUEST_IMAGE_NAME%.*}
-    TROVE_GUEST_IMAGE_ID=$(openstack --os-token $TOKEN --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image list | grep "${GUEST_IMAGE_NAME}" | get_field 1)
-    if [ -z "$TROVE_GUEST_IMAGE_ID" ]; then
-        # If no glance id is found, skip remaining setup
-        echo "Datastore ${TROVE_DATASTORE_TYPE} will not be created: guest image ${GUEST_IMAGE_NAME} not found."
-        return 1
-    fi
-
-    # Now that we have the guest image id, initialize appropriate datastores / datastore versions
-    $TROVE_MANAGE datastore_update "$TROVE_DATASTORE_TYPE" ""
-    $TROVE_MANAGE datastore_version_update "$TROVE_DATASTORE_TYPE" "$TROVE_DATASTORE_VERSION" "$TROVE_DATASTORE_TYPE" \
-        "$TROVE_GUEST_IMAGE_ID" "$TROVE_DATASTORE_PACKAGE" 1
-    $TROVE_MANAGE datastore_version_update "$TROVE_DATASTORE_TYPE" "inactive_version" "inactive_manager" "$TROVE_GUEST_IMAGE_ID" "" 0
-    $TROVE_MANAGE datastore_update "$TROVE_DATASTORE_TYPE" "$TROVE_DATASTORE_VERSION"
-    $TROVE_MANAGE datastore_update "Inactive_Datastore" ""
-}
-
-# start_trove() - Start running processes, including screen
-function start_trove {
-    run_process tr-api "$TROVE_BIN_DIR/trove-api --config-file=$TROVE_CONF --debug"
-    run_process tr-tmgr "$TROVE_BIN_DIR/trove-taskmanager --config-file=$TROVE_TASKMANAGER_CONF --debug"
-    run_process tr-cond "$TROVE_BIN_DIR/trove-conductor --config-file=$TROVE_CONDUCTOR_CONF --debug"
-}
-
-# stop_trove() - Stop running processes
-function stop_trove {
-    # Kill the trove screen windows
-    local serv
-    for serv in tr-api tr-tmgr tr-cond; do
-        stop_process $serv
-    done
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stackrc b/stackrc
index 3c08b15b03..938a09a56d 100644
--- a/stackrc
+++ b/stackrc
@@ -231,11 +231,6 @@ SAHARA_BRANCH=${SAHARA_BRANCH:-master}
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
 SWIFT_BRANCH=${SWIFT_BRANCH:-master}
 
-# trove service
-TROVE_REPO=${TROVE_REPO:-${GIT_BASE}/openstack/trove.git}
-TROVE_BRANCH=${TROVE_BRANCH:-master}
-
-
 ##############
 #
 #  Testing Components
@@ -301,10 +296,6 @@ GITBRANCH["python-saharaclient"]=${SAHARACLIENT_BRANCH:-master}
 GITREPO["python-swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
 GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
 
-# trove client library test
-GITREPO["python-troveclient"]=${TROVECLIENT_REPO:-${GIT_BASE}/openstack/python-troveclient.git}
-GITBRANCH["python-troveclient"]=${TROVECLIENT_BRANCH:-master}
-
 # consolidated openstack python client
 GITREPO["python-openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
 GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
@@ -577,16 +568,15 @@ case "$VIRT_DRIVER" in
         IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz"};;
 esac
 
-# Trove needs a custom image for its work
-if [[ "$ENABLED_SERVICES" =~ 'tr-api' ]]; then
-    case "$VIRT_DRIVER" in
-        libvirt|ironic|xenapi)
-            TROVE_GUEST_IMAGE_URL=${TROVE_GUEST_IMAGE_URL:-"http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"}
-            IMAGE_URLS+=",${TROVE_GUEST_IMAGE_URL}"
-            ;;
-        *)
-            ;;
-    esac
+# Staging Area for New Images, have them here for at least 24hrs for nodepool
+# to cache them otherwise the failure rates in the gate are too high
+PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
+if [[ "$PRECACHE_IMAGES" == "True" ]]; then
+
+    IMAGE_URL="http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"
+    if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
+        IMAGE_URLS+=",$IMAGE_URL"
+    fi
 fi
 
 # 10Gb default volume backing file size
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 0bec584aad..8210d0a466 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -29,7 +29,7 @@ for i in $TOP/lib/*; do
     fi
 done
 
-ALL_LIBS="python-novaclient oslo.config pbr oslo.context python-troveclient"
+ALL_LIBS="python-novaclient oslo.config pbr oslo.context"
 ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
 ALL_LIBS+=" python-glanceclient python-ironicclient tempest-lib"
 ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
diff --git a/unstack.sh b/unstack.sh
index ed7e6175ca..f0da9710a2 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -173,10 +173,6 @@ if is_service_enabled neutron; then
     cleanup_neutron
 fi
 
-if is_service_enabled trove; then
-    cleanup_trove
-fi
-
 if is_service_enabled dstat; then
     stop_dstat
 fi

From 61045ca58a89f9ce3a2c905450885700119a8a6f Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 14 May 2015 11:20:39 -0400
Subject: [PATCH 0611/3333] Write out a clouds.yaml file

os-client-config consumes clouds.yaml files, which is now supported in
python-openstackclient and shade. It also makes for a non-envvar way of
getting config info into functional tests.

Change-Id: I1150b943f52f10d19f8434b27e8dde73a14d7843
---
 clean.sh |  2 +-
 stack.sh | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index 7db519b0dc..86e3d4bec8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -130,7 +130,7 @@ if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
 fi
 
 # Clean up venvs
-DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]}"
+DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]} .config/openstack"
 rm -rf $DIRS_TO_CLEAN
 
 # Clean up files
diff --git a/stack.sh b/stack.sh
index f20af219a6..dea56437dd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1294,6 +1294,29 @@ for i in BASE_SQL_CONN ENABLED_SERVICES HOST_IP LOGFILE \
     echo $i=${!i} >>$TOP_DIR/.stackenv
 done
 
+# Write out a clouds.yaml file
+# putting the location into a variable to allow for easier refactoring later
+# to make it overridable. There is current no usecase where doing so makes
+# sense, so I'm not actually doing it now.
+CLOUDS_YAML=~/.config/openstack/clouds.yaml
+if [ ! -e $CLOUDS_YAML ]; then
+    mkdir -p $(dirname $CLOUDS_YAML)
+    cat >"$CLOUDS_YAML" <<EOF
+clouds:
+  devstack:
+    auth:
+      auth_url: $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
+      username: demo
+      project_name: demo
+      password: $ADMIN_PASSWORD
+    region_name: $REGION_NAME
+    identity_api_version: $IDENTITY_API_VERSION
+EOF
+    if [ -f "$SSL_BUNDLE_FILE" ]; then
+        echo "    cacert: $SSL_BUNDLE_FILE" >>"$CLOUDS_YAML"
+    fi
+fi
+
 
 # Wrapup configuration
 # ====================

From c6782413081cbdc72c7b24e34acec383a1cf2f46 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 14 May 2015 10:01:53 +1000
Subject: [PATCH 0612/3333] Infer rootwrap arguments from project

We can infer the binary and configuration paths just from the project
name and expanding this to the known *_DIR & *_BIN_DIR variables.  A
similar thing is done for policyd settings

Change-Id: I7c6a9fa106948ae5cbcf52555ade6154623798f1
---
 inc/rootwrap   | 14 ++++++++++----
 lib/ceilometer |  2 +-
 lib/cinder     |  2 +-
 lib/nova       |  2 +-
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/inc/rootwrap b/inc/rootwrap
index bac8e1e86c..411e5f7b73 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -38,11 +38,17 @@ function add_sudo_secure_path {
 
 # Configure rootwrap
 # Make a load of assumptions otherwise we'll have 6 arguments
-# configure_rootwrap project bin conf-src-dir
+# configure_rootwrap project
 function configure_rootwrap {
-    local project=$1                    # xx
-    local rootwrap_bin=$2               # /opt/stack/xx.venv/bin/xx-rootwrap
-    local rootwrap_conf_src_dir=$3      # /opt/stack/xx/etc/xx
+    local project=$1
+    local project_uc=$(echo $1|tr a-z A-Z)
+    local bin_dir="${project_uc}_BIN_DIR"
+    bin_dir="${!bin_dir}"
+    local project_dir="${project_uc}_DIR"
+    project_dir="${!project_dir}"
+
+    local rootwrap_conf_src_dir="${project_dir}/etc/${project}"
+    local rootwrap_bin="${bin_dir}/${project}-rootwrap"
 
     # Start fresh with rootwrap filters
     sudo rm -rf /etc/${project}/rootwrap.d
diff --git a/lib/ceilometer b/lib/ceilometer
index 9abdbfe286..1f72187ed6 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -254,7 +254,7 @@ function configure_ceilometer {
 
     if is_service_enabled ceilometer-aipmi; then
         # Configure rootwrap for the ipmi agent
-        configure_rootwrap ceilometer $CEILOMETER_BIN_DIR/ceilometer-rootwrap $CEILOMETER_DIR/etc/ceilometer
+        configure_rootwrap ceilometer
     fi
 }
 
diff --git a/lib/cinder b/lib/cinder
index eb0e1d7600..3c5425af08 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -190,7 +190,7 @@ function configure_cinder {
 
     rm -f $CINDER_CONF
 
-    configure_rootwrap cinder $CINDER_BIN_DIR/cinder-rootwrap $CINDER_DIR/etc/cinder
+    configure_rootwrap cinder
 
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI
 
diff --git a/lib/nova b/lib/nova
index 7d2145b170..da288d3e4d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -298,7 +298,7 @@ function configure_nova {
 
     install_default_policy nova
 
-    configure_rootwrap nova $NOVA_BIN_DIR/nova-rootwrap $NOVA_DIR/etc/nova
+    configure_rootwrap nova
 
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
         # Get the sample configuration file in place

From 8afbaa1c80d54d7f6591f8f2c1a26c34f60c77e1 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 13 May 2015 20:53:08 -0400
Subject: [PATCH 0613/3333] Support for running Nova with oslo.rootwrap daemon

Nova is being enhanced to use rootwrap as a daemon. For this effort,
we need an additional entry for nova-rootwrap-daemon in the
sudoers.d/ directory.

Needed by:
I57dc2efa39b86fa1fa20730ad70d056e87617c96

Change-Id: I80c7b9dd8e9e0f940aa4e54a95b241dfc40d3574
---
 inc/rootwrap | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/inc/rootwrap b/inc/rootwrap
index 411e5f7b73..f91e557e68 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -59,12 +59,16 @@ function configure_rootwrap {
     sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.conf /etc/${project}/rootwrap.conf
     sudo sed -e "s:^filters_path=.*$:filters_path=/etc/${project}/rootwrap.d:" -i /etc/${project}/rootwrap.conf
 
-    # Specify rootwrap.conf as first parameter to rootwrap
-    rootwrap_sudo_cmd="$rootwrap_bin /etc/${project}/rootwrap.conf *"
-
     # Set up the rootwrap sudoers
     local tempfile=$(mktemp)
+    # Specify rootwrap.conf as first parameter to rootwrap
+    rootwrap_sudo_cmd="${rootwrap_bin} /etc/${project}/rootwrap.conf *"
     echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudo_cmd" >$tempfile
+    if [ -f ${bin_dir}/${project}-rootwrap-daemon ]; then
+        # rootwrap daemon does not need any parameters
+        rootwrap_sudo_cmd="${rootwrap_bin}-daemon /etc/${project}/rootwrap.conf"
+        echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudo_cmd" >>$tempfile
+    fi
     chmod 0440 $tempfile
     sudo chown root:root $tempfile
     sudo mv $tempfile /etc/sudoers.d/${project}-rootwrap

From 3380a16974defc62db65fbc8e30e2510b57b84b6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 15 May 2015 13:12:02 +1000
Subject: [PATCH 0614/3333] Disable firewalld always

We've bike-sheded over this before
(I5252a12223a35f7fb7a4ac3c58aa4a3cd1bc4799) but I have just traced
down further issues to firewalld with neutron+ipv6 (see the bug).

In fact, as mentioned in the comments, RDO disables firewalld and the
neutron guide says to disable it [1].  The force flag is left if
anyone really wants this; but nobody is testing (or, as far as I can
tell, working on) this so bring devstack back into line and disable it
always.  Note we do not remove the package; as has been found in the
puppet scripts this can lead to dependency issues.

[1] http://docs.openstack.org/developer/devstack/guides/neutron.html

Change-Id: Ief7cb33d926a9538f4eb39c74d906ee0c879de35
Partial-Bug: 1455303
---
 lib/nova_plugins/functions-libvirt | 11 -----------
 tools/fixup_stuff.sh               | 27 ++++++++++++++++++---------
 2 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 04da5e2b60..96d8a44b05 100755
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -39,17 +39,6 @@ function install_libvirt {
         pip_install_gr libvirt-python
         install_package python-libguestfs
     fi
-
-    # Restart firewalld after install of libvirt to avoid a problem
-    # with polkit, which libvirtd brings in.  See
-    # https://bugzilla.redhat.com/show_bug.cgi?id=1099031
-
-    # Note there is a difference between F20 rackspace cloud images
-    # and HP images used in the gate; rackspace has firewalld but hp
-    # cloud doesn't.
-    if is_fedora && is_package_installed firewalld; then
-        sudo service firewalld restart || true
-    fi
 }
 
 # Configures the installed libvirt system so that is accessible by
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 2efb4e0987..31258d13f7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -109,19 +109,28 @@ if is_fedora; then
     fi
 
     FORCE_FIREWALLD=$(trueorfalse False $FORCE_FIREWALLD)
-    if [[ ${DISTRO} =~ (f20) && $FORCE_FIREWALLD == "False" ]]; then
+    if [[ $FORCE_FIREWALLD == "False" ]]; then
         # On Fedora 20 firewalld interacts badly with libvirt and
-        # slows things down significantly.  However, for those cases
-        # where that combination is desired, allow this fix to be skipped.
-
-        # There was also an additional issue with firewalld hanging
-        # after install of libvirt with polkit.  See
-        # https://bugzilla.redhat.com/show_bug.cgi?id=1099031
+        # slows things down significantly (this issue was fixed in
+        # later fedoras).  There was also an additional issue with
+        # firewalld hanging after install of libvirt with polkit [1].
+        # firewalld also causes problems with neturon+ipv6 [2]
+        #
+        # Note we do the same as the RDO packages and stop & disable,
+        # rather than remove.  This is because other packages might
+        # have the dependency [3][4].
+        #
+        # [1] https://bugzilla.redhat.com/show_bug.cgi?id=1099031
+        # [2] https://bugs.launchpad.net/neutron/+bug/1455303
+        # [3] https://github.com/redhat-openstack/openstack-puppet-modules/blob/master/firewall/manifests/linux/redhat.pp
+        # [4] http://docs.openstack.org/developer/devstack/guides/neutron.html
         if is_package_installed firewalld; then
-            uninstall_package firewalld
+            sudo systemctl disable firewalld
+            sudo systemctl enable iptables
+            sudo systemctl stop firewalld
+            sudo systemctl start iptables
         fi
     fi
-
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From 4b684aed316a89d4bc0d365e594ed345fe99d6b4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 15 May 2015 12:38:09 -0400
Subject: [PATCH 0615/3333] Don't set tempest fixed_network_name with neutron

If neutron is enabled then there isn't a shared private network
between all tenants which is what is required for the
fixed_network_name config option. This commit adds a conditional
to not set that option when neutron is enabled. While not necessarily
fatal to tempest it does emit a warning on almost every server create
call if it is set with a non-existent network name.

Change-Id: I1a42fa6b0b5a93b411c08ec35df043d6ea69d453
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 9c227167d8..f02b0d13dd 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -344,7 +344,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
-    if ! is_service_enabled n-cell; then
+    if [[ ! $(is_service_enabled n-cell) && ! $(is_service_enabled neutron) ]]; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi
 

From a48e5dc4bd3514cc24cd75c72ea998ad9afe5321 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Fri, 6 Mar 2015 17:05:11 +0800
Subject: [PATCH 0616/3333] add the port_sec as default neutron/ml2 extension
 driver

Neutron ML2 plugin introduces the first extension driver port_security, this
patch add it to be a default extension driver as a example. And also, if not
set it by default, networks like public/private which are created after the
neutron-db-manage's update, will not include the port-sec value.

Change-Id: I3035317c83d22804855517434bd8578719ce0436
Partially Implements: blueprint ml2-ovs-portsecurity
---
 doc/source/guides/neutron.rst | 5 +++++
 lib/neutron_plugins/ml2       | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 3030c7b5f2..b0a89070fb 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -131,6 +131,11 @@ In this configuration we are defining FLOATING_RANGE to be a
 subnet that exists in the private RFC1918 address space - however in
 in a real setup FLOATING_RANGE would be a public IP address range.
 
+Note that extension drivers for the ML2 plugin is set by
+`Q_ML2_PLUGIN_EXT_DRIVERS`, and it includes 'port_security' by default. If you
+want to remove all the extension drivers (even 'port_security'), set
+`Q_ML2_PLUGIN_EXT_DRIVERS` to blank.
+
 Neutron Networking with Open vSwitch and Provider Networks
 ==========================================================
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 88537774b7..2733f1f513 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -31,6 +31,9 @@ Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=
 Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS:-vni_ranges=1001:2000}
 # Default VLAN TypeDriver options
 Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
+# List of extension drivers to load, use '-' instead of ':-' to allow people to
+# explicitly override this to blank
+Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 
 # L3 Plugin to load for ML2
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
@@ -113,6 +116,8 @@ function neutron_plugin_configure_service {
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
 
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 extension_drivers=$Q_ML2_PLUGIN_EXT_DRIVERS
+
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 $Q_SRV_EXTRA_OPTS
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_gre $Q_ML2_PLUGIN_GRE_TYPE_OPTIONS

From 37421991b446f2077a9fb4e9a6d580b1c08044a3 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 20 May 2015 06:37:11 -0700
Subject: [PATCH 0617/3333] optional pymysql support

This allows you to specify MYSQL_DRIVER=PyMySQL and get it in the
environment.

Change-Id: Ic9d75266640b7aa6d7efb6e882d3027e81414059
---
 files/venv-requirements.txt |  1 -
 lib/databases/mysql         | 13 +++++++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
index 73d05793ce..b9a55b423d 100644
--- a/files/venv-requirements.txt
+++ b/files/venv-requirements.txt
@@ -1,7 +1,6 @@
 # Once we can prebuild wheels before a devstack run, uncomment the skipped libraries
 cryptography
 # lxml # still install from from packages
-MySQL-python
 # netifaces # still install from packages
 #numpy    # slowest wheel by far, stop building until we are actually using the output
 posix-ipc
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 1b9a08199f..7cd2856ae9 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -11,6 +11,13 @@
 MY_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
+MYSQL_DRIVER=${MYSQL_DRIVER:-MySQL-python}
+# Force over to pymysql driver by default if we are using it.
+if is_service_enabled mysql; then
+    if [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then
+        SQLALCHEMY_DATABASE_DRIVER=${SQLALCHEMY_DATABASE_DRIVER:-"pymysql"}
+    fi
+fi
 
 register_database mysql
 
@@ -155,8 +162,10 @@ EOF
 
 function install_database_python_mysql {
     # Install Python client module
-    pip_install_gr MySQL-python
-    ADDITIONAL_VENV_PACKAGES+=",MySQL-python"
+    pip_install_gr $MYSQL_DRIVER
+    if [[ "$MYSQL_DRIVER" == "MySQL-python" ]]; then
+        ADDITIONAL_VENV_PACKAGES+=",MySQL-python"
+    fi
 }
 
 function database_connection_url_mysql {

From 165afa2377ee8eb6bad1b6cfb454a7de525a4498 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 25 May 2015 11:29:48 +1000
Subject: [PATCH 0618/3333] Fix msg argument to assert_equal

I noticed this was taking an argument but not dealing with it.  In
general the functions were undocumented, so I added some terse usage.

Also, the intent of the test-case was to expand the values before
using them as the message; make sure this happens by using a temp
variable.

Change-Id: Ib317ad1e9dd2a5d2232b9c64541fe4a601a2b8da
---
 tests/test_truefalse.sh |  6 ++++--
 tests/unittest.sh       | 17 +++++++++++++++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/tests/test_truefalse.sh b/tests/test_truefalse.sh
index ebd9650649..2689589dc9 100755
--- a/tests/test_truefalse.sh
+++ b/tests/test_truefalse.sh
@@ -19,7 +19,8 @@ function test_trueorfalse {
 
     for default in True False; do
         for name in one captrue lowtrue uppertrue capyes lowyes upperyes; do
-                assert_equal "True" $(trueorfalse $default $name) "\$(trueorfalse $default $name)"
+            local msg="trueorfalse($default $name)"
+            assert_equal "True" $(trueorfalse $default $name) "$msg"
         done
     done
 
@@ -33,7 +34,8 @@ function test_trueorfalse {
 
     for default in True False; do
         for name in zero capfalse lowfalse upperfalse capno lowno upperno; do
-            assert_equal "False" $(trueorfalse $default $name) "\$(trueorfalse $default $name)"
+            local msg="trueorfalse($default $name)"
+            assert_equal "False" $(trueorfalse $default $name) "$msg"
         done
     done
 }
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 69f19b7dae..93aa5fc571 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -17,6 +17,8 @@ ERROR=0
 PASS=0
 FAILED_FUNCS=""
 
+# pass a test, printing out MSG
+#  usage: passed message
 function passed {
     local lineno=$(caller 0 | awk '{print $1}')
     local function=$(caller 0 | awk '{print $2}')
@@ -25,9 +27,11 @@ function passed {
         msg="OK"
     fi
     PASS=$((PASS+1))
-    echo $function:L$lineno $msg
+    echo "PASS: $function:L$lineno $msg"
 }
 
+# fail a test, printing out MSG
+#  usage: failed message
 function failed {
     local lineno=$(caller 0 | awk '{print $1}')
     local function=$(caller 0 | awk '{print $2}')
@@ -38,10 +42,16 @@ function failed {
     ERROR=$((ERROR+1))
 }
 
+# assert string comparision of val1 equal val2, printing out msg
+#  usage: assert_equal val1 val2 msg
 function assert_equal {
     local lineno=`caller 0 | awk '{print $1}'`
     local function=`caller 0 | awk '{print $2}'`
     local msg=$3
+
+    if [ -z "$msg" ]; then
+        msg="OK"
+    fi
     if [[ "$1" != "$2" ]]; then
         FAILED_FUNCS+="$function:L$lineno\n"
         echo "ERROR: $1 != $2 in $function:L$lineno!"
@@ -49,10 +59,13 @@ function assert_equal {
         ERROR=$((ERROR+1))
     else
         PASS=$((PASS+1))
-        echo "$function:L$lineno - ok"
+        echo "PASS: $function:L$lineno - $msg"
     fi
 }
 
+# print a summary of passing and failing tests, exiting
+# with an error if we have failed tests
+#  usage: report_results
 function report_results {
     echo "$PASS Tests PASSED"
     if [[ $ERROR -gt 1 ]]; then

From fcefb0a910f78f36b329d8eb74d3849678a7a2b7 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Sun, 26 Apr 2015 08:50:49 -0700
Subject: [PATCH 0619/3333] VMware: add support for simple DVS

Add the file vmware_dvs that will enable the external CI to be
run.

The patch in the VMware repo for the DVS support is:
https://review.openstack.org/#/c/177597/

Change-Id: I6dee978fd2be3818c5ce57b1dcb2917234ab61e2
---
 lib/neutron_plugins/vmware_dvs | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 lib/neutron_plugins/vmware_dvs

diff --git a/lib/neutron_plugins/vmware_dvs b/lib/neutron_plugins/vmware_dvs
new file mode 100644
index 0000000000..587d5a6b11
--- /dev/null
+++ b/lib/neutron_plugins/vmware_dvs
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# This file is needed so Q_PLUGIN=vmware_dvs will work.
+
+# FIXME(salv-orlando): This function should not be here, but unfortunately
+# devstack calls it before the external plugins are fetched
+function has_neutron_plugin_security_group {
+    # 0 means True here
+    return 0
+}

From 93ee8c876ca2a8cdea98b6685538f85f1a7979ef Mon Sep 17 00:00:00 2001
From: Guillaume Giamarchi <guillaume.giamarchi@gmail.com>
Date: Tue, 26 May 2015 02:08:44 +0200
Subject: [PATCH 0620/3333] Set IP_VERSION default value to 4+6

This is actually the default value since 645114b

Change-Id: Ib6603b4f6ea0b4079f9a4ea46e723ecbb2ea371d
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1cc7083bb4..8e2e7ffa31 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -391,7 +391,7 @@ Multi-host DevStack
         ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
 
 IP Version
-    | Default: ``IP_VERSION=4``
+    | Default: ``IP_VERSION=4+6``
     | This setting can be used to configure DevStack to create either an IPv4,
       IPv6, or dual stack tenant data network by setting ``IP_VERSION`` to
       either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``

From 8606c98c53722f425525fa06eee554b7d30f62f6 Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Mon, 13 Apr 2015 09:55:06 +0900
Subject: [PATCH 0621/3333] Fix remove_disabled_extensions to remove an
 extension at the last position

remove_disabled_extensions do matching by '$ext_to_remove","'. So it doesn't
match an extension at the last position in extensions_list.
This patch fixes that.

Closes-Bug: #1443254
Change-Id: I194b483de797697ba06b320cf33f1bac67fc0cc7
---
 functions-common        | 41 +++++++++++++++++++++++++----------------
 lib/tempest             |  5 +----
 tests/test_functions.sh | 25 +++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 20 deletions(-)

diff --git a/functions-common b/functions-common
index 52d80fb95b..ff9261161c 100644
--- a/functions-common
+++ b/functions-common
@@ -1629,7 +1629,6 @@ function disable_all_services {
 function disable_negated_services {
     local to_remove=""
     local remaining=""
-    local enabled=""
     local service
 
     # build up list of services that should be removed; i.e. they
@@ -1644,21 +1643,7 @@ function disable_negated_services {
 
     # go through the service list.  if this service appears in the "to
     # be removed" list, drop it
-    for service in ${remaining//,/ }; do
-        local remove
-        local add=1
-        for remove in ${to_remove//,/ }; do
-            if [[ ${remove} == ${service} ]]; then
-                add=0
-                break
-            fi
-        done
-        if [[ $add == 1 ]]; then
-            enabled="${enabled},$service"
-        fi
-    done
-
-    ENABLED_SERVICES=$(_cleanup_service_list "$enabled")
+    ENABLED_SERVICES=$(remove_disabled_services "$remaining" "$to_remove")
 }
 
 # disable_service() removes the services passed as argument to the
@@ -1762,6 +1747,30 @@ function is_service_enabled {
     return $enabled
 }
 
+# remove specified list from the input string
+# remove_disabled_services service-list remove-list
+function remove_disabled_services {
+    local service_list=$1
+    local remove_list=$2
+    local service
+    local enabled=""
+
+    for service in ${service_list//,/ }; do
+        local remove
+        local add=1
+        for remove in ${remove_list//,/ }; do
+            if [[ ${remove} == ${service} ]]; then
+                add=0
+                break
+            fi
+        done
+        if [[ $add == 1 ]]; then
+            enabled="${enabled},$service"
+        fi
+    done
+    _cleanup_service_list "$enabled"
+}
+
 # Toggle enable/disable_service for services that must run exclusive of each other
 #  $1 The name of a variable containing a space-separated list of services
 #  $2 The name of a variable in which to store the enabled service's name
diff --git a/lib/tempest b/lib/tempest
index 6c34323802..ffb59ff59b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -91,10 +91,7 @@ function remove_disabled_extensions {
     local extensions_list=$1
     shift
     local disabled_exts=$*
-    for ext_to_remove in ${disabled_exts//,/ } ; do
-        extensions_list=${extensions_list/$ext_to_remove","}
-    done
-    echo $extensions_list
+    remove_disabled_services "$extensions_list" "$disabled_exts"
 }
 
 # configure_tempest() - Set config files, create data dirs, etc
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index 1d82792ca7..f555de8dff 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -137,6 +137,31 @@ test_disable_negated_services 'a,aa,-a' 'aa'
 test_disable_negated_services 'a,av2,-a,a' 'av2'
 test_disable_negated_services 'a,-a,av2' 'av2'
 
+echo "Testing remove_disabled_services()"
+
+function test_remove_disabled_services {
+    local service_list="$1"
+    local remove_list="$2"
+    local expected="$3"
+
+    results=$(remove_disabled_services "$service_list" "$remove_list")
+    if [ "$results" = "$expected" ]; then
+        passed "OK: '$service_list' - '$remove_list' -> '$results'"
+    else
+        failed "getting '$expected' from '$service_list' - '$remove_list' failed: '$results'"
+    fi
+}
+
+test_remove_disabled_services 'a,b,c' 'a,c' 'b'
+test_remove_disabled_services 'a,b,c' 'b' 'a,c'
+test_remove_disabled_services 'a,b,c,d' 'a,c d' 'b'
+test_remove_disabled_services 'a,b c,d' 'a d' 'b,c'
+test_remove_disabled_services 'a,b,c' 'a,b,c' ''
+test_remove_disabled_services 'a,b,c' 'd' 'a,b,c'
+test_remove_disabled_services 'a,b,c' '' 'a,b,c'
+test_remove_disabled_services '' 'a,b,c' ''
+test_remove_disabled_services '' '' ''
+
 echo "Testing is_package_installed()"
 
 if [[ -z "$os_PACKAGE" ]]; then

From d82d3f13401320ec47757aff0457a307203b28fe Mon Sep 17 00:00:00 2001
From: Mahito <m.ogura@ntt.com>
Date: Fri, 22 May 2015 10:37:23 -0700
Subject: [PATCH 0622/3333] Add test case to 'cidr2netmask'

'cidr2netmask' of function doesn't have enough test case
and test code isn't smart.
This patch adds test case and refactors test code.

Change-Id: Iab20ef06fe78316a78198ab75c0afe738a577dd6
Closes-bug: #1457989
---
 tests/test_ip.sh | 80 +++++++++++++++++++++---------------------------
 1 file changed, 35 insertions(+), 45 deletions(-)

diff --git a/tests/test_ip.sh b/tests/test_ip.sh
index c53e80de36..f8c2058967 100755
--- a/tests/test_ip.sh
+++ b/tests/test_ip.sh
@@ -12,51 +12,41 @@ source $TOP/tests/unittest.sh
 
 echo "Testing IP addr functions"
 
-if [[ $(cidr2netmask 4) == 240.0.0.0 ]]; then
-    passed "cidr2netmask(): /4...OK"
-else
-    failed "cidr2netmask(): /4...failed"
-fi
-if [[ $(cidr2netmask 8) == 255.0.0.0 ]]; then
-    passed "cidr2netmask(): /8...OK"
-else
-    failed "cidr2netmask(): /8...failed"
-fi
-if [[ $(cidr2netmask 12) == 255.240.0.0 ]]; then
-    passed "cidr2netmask(): /12...OK"
-else
-    failed "cidr2netmask(): /12...failed"
-fi
-if [[ $(cidr2netmask 16) == 255.255.0.0 ]]; then
-    passed "cidr2netmask(): /16...OK"
-else
-    failed "cidr2netmask(): /16...failed"
-fi
-if [[ $(cidr2netmask 20) == 255.255.240.0 ]]; then
-    passed "cidr2netmask(): /20...OK"
-else
-    failed "cidr2netmask(): /20...failed"
-fi
-if [[ $(cidr2netmask 24) == 255.255.255.0 ]]; then
-    passed "cidr2netmask(): /24...OK"
-else
-    failed "cidr2netmask(): /24...failed"
-fi
-if [[ $(cidr2netmask 28) == 255.255.255.240 ]]; then
-    passed "cidr2netmask(): /28...OK"
-else
-    failed "cidr2netmask(): /28...failed"
-fi
-if [[ $(cidr2netmask 30) == 255.255.255.252 ]]; then
-    passed "cidr2netmask(): /30...OK"
-else
-    failed "cidr2netmask(): /30...failed"
-fi
-if [[ $(cidr2netmask 32) == 255.255.255.255 ]]; then
-    passed "cidr2netmask(): /32...OK"
-else
-    failed "cidr2netmask(): /32...failed"
-fi
+function test_cidr2netmask {
+    local mask=0
+    local ips="128 192 224 240 248 252 254 255"
+    local ip
+    local msg
+
+    msg="cidr2netmask(/0) == 0.0.0.0"
+    assert_equal "0.0.0.0" $(cidr2netmask $mask) "$msg"
+
+    for ip in $ips; do
+        mask=$(( mask + 1 ))
+        msg="cidr2netmask(/$mask) == $ip.0.0.0"
+        assert_equal "$ip.0.0.0" $(cidr2netmask $mask) "$msg"
+    done
+
+    for ip in $ips; do
+        mask=$(( mask + 1 ))
+        msg="cidr2netmask(/$mask) == 255.$ip.0.0"
+        assert_equal "255.$ip.0.0" $(cidr2netmask $mask) "$msg"
+    done
+
+    for ip in $ips; do
+        mask=$(( mask + 1 ))
+        msg="cidr2netmask(/$mask) == 255.255.$ip.0"
+        assert_equal "255.255.$ip.0" $(cidr2netmask $mask) "$msg"
+    done
+
+    for ip in $ips; do
+        mask=$(( mask + 1 ))
+        msg="cidr2netmask(/$mask) == 255.255.255.$ip"
+        assert_equal "255.255.255.$ip" $(cidr2netmask $mask) "$msg"
+    done
+}
+
+test_cidr2netmask
 
 if [[ $(maskip 169.254.169.254 240.0.0.0) == 160.0.0.0 ]]; then
     passed "maskip(): /4...OK"

From b3798af474955368211a297ba85332fde5491993 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 20 May 2015 06:48:02 -0700
Subject: [PATCH 0623/3333] change the default to PyMYSQL

As discussed in the Liberty Design Summit "Moving apps to Python 3"
cross-project workshop, the way forward in the near future is to
switch to the pure-python PyMySQL library as a default.

    https://etherpad.openstack.org/p/liberty-cross-project-python3

Change-Id: Ic609ce136061b753ca692b37509a0b29c60bb8b5
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7cd2856ae9..832c2ca6d7 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -11,7 +11,7 @@
 MY_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-MYSQL_DRIVER=${MYSQL_DRIVER:-MySQL-python}
+MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 # Force over to pymysql driver by default if we are using it.
 if is_service_enabled mysql; then
     if [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then

From aece9ff9eff94fcdd2bdac14d64536e16207139d Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 26 May 2015 15:24:38 -0400
Subject: [PATCH 0624/3333] Use correct conf file variable name in sahara

When the tls-proxy service is enabled then a separate
set of ports is used internally vs externally. The
services listen on the internal port and a proxy (stud)
listen on the "standard" port and forward requests to
the internal port.

An incorrect environment variable was being used to set
the internal port in the sahara configuration so it wasn't
listening on the correct port, causing stack.sh to fail
because it thought the service wasn't up (at least not
on the right port).

Change-Id: I3384039392be786d3c189f3e4f84e069ddaf4339
Closes-Bug: #1458984
---
 lib/sahara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/sahara b/lib/sahara
index 6d4e8648bf..51e431afc7 100644
--- a/lib/sahara
+++ b/lib/sahara
@@ -186,7 +186,7 @@ function configure_sahara {
 
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
-        iniset $SAHARA_CONF DEFAULT port $SAHARA_SERVICE_PORT_INT
+        iniset $SAHARA_CONF_FILE DEFAULT port $SAHARA_SERVICE_PORT_INT
     fi
 
     recreate_database sahara

From 73d24b2c1c1795a1d8b7f6dcdd608ad387d125b9 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 27 May 2015 11:41:33 +0100
Subject: [PATCH 0625/3333] Ironic: Remove deprecated parameters

Ironic have updated some parameters to have a consistent name
across drivers. This patch is updating devstack to stop using the
pxe_deploy_{kernel, ramdisk} parameters which have been deprecated since
early Kilo eliminating the deprecation warnings in the logs.

WARNING ironic.drivers.modules.pxe [-] The "pxe_deploy_kernel" parameter
is deprecated. Please update the node 267e42c8-df07-49f5-bc7f-48b566acb109
to use "deploy_kernel" instead.

WARNING ironic.drivers.modules.pxe [-] The "pxe_deploy_ramdisk" parameter
is deprecated. Please update the node 267e42c8-df07-49f5-bc7f-48b566acb109
to use "deploy_ramdisk" instead.

Change-Id: I3dcf8df130efc0c2ea35695018bedba31bf0570c
---
 lib/ironic | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 7493c3cab2..4984be1861 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -569,14 +569,6 @@ function wait_for_nova_resources {
 function enroll_nodes {
     local chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
 
-    if [[ "$IRONIC_DEPLOY_DRIVER" == "pxe_ssh" ]] ; then
-        local _IRONIC_DEPLOY_KERNEL_KEY=pxe_deploy_kernel
-        local _IRONIC_DEPLOY_RAMDISK_KEY=pxe_deploy_ramdisk
-    elif is_deployed_by_agent; then
-        local _IRONIC_DEPLOY_KERNEL_KEY=deploy_kernel
-        local _IRONIC_DEPLOY_RAMDISK_KEY=deploy_ramdisk
-    fi
-
     if ! is_ironic_hardware; then
         local ironic_node_cpu=$IRONIC_VM_SPECS_CPU
         local ironic_node_ram=$IRONIC_VM_SPECS_RAM
@@ -584,8 +576,8 @@ function enroll_nodes {
         local ironic_ephemeral_disk=$IRONIC_VM_EPHEMERAL_DISK
         local ironic_hwinfo_file=$IRONIC_VM_MACS_CSV_FILE
         local node_options="\
-            -i $_IRONIC_DEPLOY_KERNEL_KEY=$IRONIC_DEPLOY_KERNEL_ID \
-            -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID \
+            -i deploy_kernel=$IRONIC_DEPLOY_KERNEL_ID \
+            -i deploy_ramdisk=$IRONIC_DEPLOY_RAMDISK_ID \
             -i ssh_virt_type=$IRONIC_SSH_VIRT_TYPE \
             -i ssh_address=$IRONIC_VM_SSH_ADDRESS \
             -i ssh_port=$IRONIC_VM_SSH_PORT \
@@ -616,8 +608,8 @@ function enroll_nodes {
             # we create the bare metal flavor with minimum value
             local node_options="-i ipmi_address=$ipmi_address -i ipmi_password=$ironic_ipmi_passwd\
                 -i ipmi_username=$ironic_ipmi_username"
-            node_options+=" -i $_IRONIC_DEPLOY_KERNEL_KEY=$IRONIC_DEPLOY_KERNEL_ID"
-            node_options+=" -i $_IRONIC_DEPLOY_RAMDISK_KEY=$IRONIC_DEPLOY_RAMDISK_ID"
+            node_options+=" -i deploy_kernel=$IRONIC_DEPLOY_KERNEL_ID"
+            node_options+=" -i deploy_ramdisk=$IRONIC_DEPLOY_RAMDISK_ID"
         fi
 
         # First node created will be used for testing in ironic w/o glance

From 3fd71d68933f2c4e38ff7fa58416ec0263325a9f Mon Sep 17 00:00:00 2001
From: Samuel de Medeiros Queiroz <samuel@lsd.ufcg.edu.br>
Date: Sun, 3 May 2015 14:54:45 -0300
Subject: [PATCH 0626/3333] Honor the flag for Identity v3 API only jobs

When the property ENABLE_IDENTITY_V2 is set to
False in the local.conf file, devstack will:

* Disable the v2 API in Keystone paste config;
* Set Tempest to skip Identity v2 tests and use
  v3 auth tokens to run all the other tests;
* Set Horizon to use v3 API and v3 auth tokens;
* Register the Identity endpoint as v3.

Change-Id: I2575a516244b848e5ed461e7f488c59edc41068d
---
 lib/horizon  |  9 ++++++++-
 lib/keystone |  6 ++++++
 lib/tempest  | 10 +++++++++-
 stackrc      | 19 ++++++++++++++++---
 4 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index f953f5cc01..ab6e758409 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,7 +97,14 @@ function init_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
-    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
+
+    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
+        # Only Identity v3 API is available; then use it with v3 auth tokens
+        _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":\"v3\"}
+        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
+    else
+        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
+    fi
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
diff --git a/lib/keystone b/lib/keystone
index 997bb14967..de2d2ca53f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -204,6 +204,12 @@ function configure_keystone {
         KEYSTONE_PASTE_INI="$KEYSTONE_CONF"
     fi
 
+    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
+        # Only Identity v3 API should be available; then disable v2 pipelines
+        inidelete $KEYSTONE_PASTE_INI composite:main \\/v2.0
+        inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
+    fi
+
     configure_keystone_extensions
 
     # Rewrite stock ``keystone.conf``
diff --git a/lib/tempest b/lib/tempest
index cd8fbd725f..18e3703110 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -311,7 +311,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity admin_tenant_id $ADMIN_TENANT_ID
         iniset $TEMPEST_CONFIG identity admin_domain_name $ADMIN_DOMAIN_NAME
     fi
-    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
+    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
+        # Only Identity v3 is available; then skip Identity API v2 tests
+        iniset $TEMPEST_CONFIG identity-feature-enabled v2_api False
+        # In addition, use v3 auth tokens for running all Tempest tests
+        iniset $TEMPEST_CONFIG identity auth_version v3
+    else
+        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
+    fi
+
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
diff --git a/stackrc b/stackrc
index 2a49ea5ef5..af5ed6e16d 100644
--- a/stackrc
+++ b/stackrc
@@ -87,9 +87,6 @@ TEMPEST_SERVICES=""
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=ec2,osapi_compute,metadata
 
-# Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=2.0
-
 # Whether to use 'dev mode' for screen windows. Dev mode works by
 # stuffing text into the screen windows so that a developer can use
 # ctrl-c, up-arrow, enter to restart the service. Starting services
@@ -106,6 +103,22 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Configure Identity API version: 2.0, 3
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+
+# Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
+# deployment will be deploying the Identity v2 pipelines. If this option is set
+# to ``False``, DevStack will: i) disable Identity v2; ii) configure Tempest to
+# skip Identity v2 specific tests; and iii) configure Horizon to use Identity
+# v3. When this option is set to ``False``, the option IDENTITY_API_VERSION
+# will to be set to ``3`` in order to make DevStack register the Identity
+# endpoint as v3. This flag is experimental and will be used as basis to
+# identify the projects which still have issues to operate with Identity v3.
+ENABLE_IDENTITY_V2=$(trueorfalse True ENABLE_IDENTITY_V2)
+if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
+    IDENTITY_API_VERSION=3
+fi
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.

From dd363a182fb1f8472bc163c82ea5f48e8f8fd29e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 25 May 2015 11:50:32 +1000
Subject: [PATCH 0627/3333] Cleanup test_ip.sh to give more consistent output

Minor changes to give more consistent output; no functional changes to
tests.

Change-Id: I6c4ef74587c59b786761735c7bd528f3d7f94905
---
 tests/test_ip.sh | 76 +++++++++++++++++++-----------------------------
 1 file changed, 30 insertions(+), 46 deletions(-)

diff --git a/tests/test_ip.sh b/tests/test_ip.sh
index f8c2058967..da939f41d1 100755
--- a/tests/test_ip.sh
+++ b/tests/test_ip.sh
@@ -48,60 +48,44 @@ function test_cidr2netmask {
 
 test_cidr2netmask
 
-if [[ $(maskip 169.254.169.254 240.0.0.0) == 160.0.0.0 ]]; then
-    passed "maskip(): /4...OK"
-else
-    failed "maskip(): /4...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.0.0.0) == 169.0.0.0 ]]; then
-    passed "maskip(): /8...OK"
-else
-    failed "maskip(): /8...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.240.0.0) == 169.240.0.0 ]]; then
-    passed "maskip(): /12...OK"
-else
-    failed "maskip(): /12...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.255.0.0) == 169.254.0.0 ]]; then
-    passed "maskip(): /16...OK"
-else
-    failed "maskip(): /16...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.255.240.0) == 169.254.160.0 ]]; then
-    passed "maskip(): /20...OK"
-else
-    failed "maskip(): /20...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.255.255.0) == 169.254.169.0 ]]; then
-    passed "maskip(): /24...OK"
-else
-    failed "maskip(): /24...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.255.255.240) == 169.254.169.240 ]]; then
-    passed "maskip(): /28...OK"
-else
-    failed "maskip(): /28...failed"
-fi
-if [[ $(maskip 169.254.169.254 255.255.255.255) == 169.254.169.254 ]]; then
-    passed "maskip(): /32...OK"
-else
-    failed "maskip(): /32...failed"
-fi
+msg="maskip(169.254.169.254 240.0.0.0) == 160.0.0.0"
+assert_equal $(maskip 169.254.169.254 240.0.0.0) 160.0.0.0 "$msg"
+
+msg="maskip(169.254.169.254 255.0.0.0) == 169.0.0.0"
+assert_equal $(maskip 169.254.169.254 255.0.0.0) 169.0.0.0 "$msg"
+
+msg="maskip(169.254.169.254 255.240.0.0) == 169.240.0.0"
+assert_equal $(maskip 169.254.169.254 255.240.0.0) 169.240.0.0 "$msg"
+
+msg="maskip(169.254.169.254 255.255.0.0) == 169.254.0.0"
+assert_equal $(maskip 169.254.169.254 255.255.0.0) 169.254.0.0 "$msg"
+
+msg="maskip(169.254.169.254 255.255.240.0) == 169.254.160.0"
+assert_equal $(maskip 169.254.169.254 255.255.240.0) 169.254.160.0 "$msg"
+
+msg="maskip(169.254.169.254 255.255.255.0) == 169.254.169.0"
+assert_equal $(maskip 169.254.169.254 255.255.255.0) 169.254.169.0 "$msg"
+
+msg="maskip(169.254.169.254 255.255.255.240) == 169.254.169.240"
+assert_equal $(maskip 169.254.169.254 255.255.255.240) 169.254.169.240 "$msg"
+
+msg="maskip(169.254.169.254 255.255.255.255) == 169.254.169.254"
+assert_equal $(maskip 169.254.169.254 255.255.255.255) 169.254.169.254 "$msg"
+
 
 for mask in 8 12 16 20 24 26 28; do
-    echo -n "address_in_net(): in /$mask..."
+    msg="address_in_net($10.10.10.1 10.10.10.0/$mask)"
     if address_in_net 10.10.10.1 10.10.10.0/$mask; then
-        passed "OK"
+        passed "$msg"
     else
-        failed "address_in_net() failed on /$mask"
+        failed "$msg"
     fi
 
-    echo -n "address_in_net(): not in /$mask..."
+    msg="! address_in_net($10.10.10.1 11.11.11.0/$mask)"
     if ! address_in_net 10.10.10.1 11.11.11.0/$mask; then
-        passed "OK"
+        passed "$msg"
     else
-        failed "address_in_net() failed on /$mask"
+        failed "$msg"
     fi
 done
 

From 9ee1ef6cb8e06864e2341f4121372028d6d59c64 Mon Sep 17 00:00:00 2001
From: Shin Sato <s-sato@ts.jp.nec.com>
Date: Thu, 28 May 2015 13:56:58 +0900
Subject: [PATCH 0628/3333] Fix typo: _create_volume_group =>
 _create_lvm_volume_group

Change-Id: Ifb648c9eb4a57ac0fc97afb842e83286789801dd
---
 lib/lvm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index 1fe2683e65..8afd543f34 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -78,7 +78,7 @@ function clean_lvm_volume_group {
 }
 
 
-# _create_volume_group creates default volume group
+# _create_lvm_volume_group creates default volume group
 #
 # Usage: _create_lvm_volume_group() $vg $size
 function _create_lvm_volume_group {

From 40c5ea67d34168048068d115e5d870a5065d4b0f Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Thu, 28 May 2015 06:42:03 +0100
Subject: [PATCH 0629/3333] XenAPI: Increase OpenStack DomU usage again

Devstack has continued to grow in memory requirements and now we cannot
reliably fit in 4GB, with several services being unable to start.  Increase
the minimum for DomU to 6GB to leave room for virtual machines

Change-Id: Idbdfa1f36015b6af347d1ce27eb28baa360af5ef
---
 tools/xen/xenrc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 43a6ce8a77..be6c5ca037 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -14,12 +14,12 @@ CLEAN_TEMPLATES=${CLEAN_TEMPLATES:-false}
 # Size of image
 VDI_MB=${VDI_MB:-5000}
 
-# Devstack now contains many components.  3GB ram is not enough to prevent
+# Devstack now contains many components.  4GB ram is not enough to prevent
 # swapping and memory fragmentation - the latter of which can cause failures
 # such as blkfront failing to plug a VBD and lead to random test fails.
 #
-# Set to 4GB so an 8GB XenServer VM can have a 1GB Dom0 and leave 3GB for VMs
-OSDOMU_MEM_MB=4096
+# Set to 6GB so an 8GB XenServer VM can have a 1GB Dom0 and leave 1GB for VMs
+OSDOMU_MEM_MB=6144
 OSDOMU_VDI_GB=8
 
 # Network mapping. Specify bridge names or network names. Network names may

From 75c44737121baea0c56050599350bc7de8f22799 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Wed, 13 May 2015 12:43:56 +0800
Subject: [PATCH 0630/3333] Remove the code against flushing public bridge

As unstack.sh does destroy all bridges, we don't have to refresh bridge
interface any more, as what is done in commit
c2dc95add6e46829f1705041c1d9dddab9b360d3. So in this commit we will continue to
remove the related statements in lib/neutron-legacy. These statements will also
cause undefined PUBLIC_BRIDGE error.

Change-Id: I4c7617f6a245ea4e2e08f518d873b1b8adc2b807
Closes-Bug: #1454475
---
 lib/neutron-legacy | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 18b0942ae1..a08778ca32 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1294,17 +1294,6 @@ function _neutron_configure_router_v6 {
         IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
-        # The ovs_base_configure_l3_agent function flushes the public
-        # bridge's ip addresses, so turn IPv6 support in the host off
-        # and then on to recover the public bridge's link local address
-        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=1
-        sudo sysctl -w net.ipv6.conf.${PUBLIC_BRIDGE}.disable_ipv6=0
-        if ! ip -6 addr show dev $PUBLIC_BRIDGE | grep 'scope global'; then
-            # Create an IPv6 ULA address for PUBLIC_BRIDGE if one is not present
-            IPV6_BRIDGE_ULA=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
-            sudo ip -6 addr add fd$IPV6_BRIDGE_ULA::1 dev $PUBLIC_BRIDGE
-        fi
-
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             local ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}

From c550f2158970fc222cf01ddccf71d03f96a4651d Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 28 May 2015 15:38:01 +0200
Subject: [PATCH 0631/3333] Enable F22 without the FORCE flag

F22 has a stable release and working with devstack.

The change also removes the version flags regarding to the
mariadb-devel.

NOTE: You may see yum deprecation warnings, unless
you set the YUM variable to dnf.

Change-Id: I05140765bffc16faef5a29dfaba291c290bfae02
---
 files/rpms/devlibs | 3 +--
 lib/ceph           | 2 +-
 stack.sh           | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/files/rpms/devlibs b/files/rpms/devlibs
index 834a4b6cf1..385ed3b84c 100644
--- a/files/rpms/devlibs
+++ b/files/rpms/devlibs
@@ -1,8 +1,7 @@
 libffi-devel  # pyOpenSSL
 libxml2-devel  # lxml
 libxslt-devel  # lxml
-mariadb-devel  # MySQL-python  f20,f21,rhel7
-mysql-devel  # MySQL-python  rhel6
+mariadb-devel  # MySQL-python
 openssl-devel  # pyOpenSSL
 postgresql-devel  # psycopg2
 python-devel  # pyOpenSSL
diff --git a/lib/ceph b/lib/ceph
index 4068e26222..4d6ca4aa68 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -110,7 +110,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f20|f21) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f20|f21|f22) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index dea56437dd..6615b8fef4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -173,7 +173,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f20|f21|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f20|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 31127a2a74ab851fe4b133e7f413719f370d7c94 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Fri, 15 May 2015 13:09:26 +1000
Subject: [PATCH 0632/3333] Skip 'shocco' code when running tox

when running tox in a devstack directory where you have previously run tox
-edocs the bashate testenv will fail as the shocco code doesn't match the
devstack style.

eg:
---
E003: Indent not multiple of 4: '           2>/dev/null ||'
 - /home/stack/projects/openstack/openstack-dev/devstack/shocco/shocco.sh : L352
<snip>
27 bashate error(s) found
---

Take the easy path and avoid running bashate in the shocco dir.

Change-Id: I5b0155332ec994afaffc5c5961902281864cff61
---
 tox.ini | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/tox.ini b/tox.ini
index 279dcd4f66..e3d19ce60c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -10,19 +10,20 @@ install_command = pip install {opts} {packages}
 [testenv:bashate]
 deps = bashate
 whitelist_externals = bash
-commands = bash -c "find {toxinidir}          \
-         -not \( -type d -name .?\* -prune \) \ # prune all 'dot' dirs
-         -not \( -type d -name doc -prune \)  \ # skip documentation
-         -type f                              \ # only files
-         -not -name \*~                       \ # skip editors, readme, etc
-         -not -name \*.md                     \
-         \(                                   \
-          -name \*.sh -or                     \
-          -name \*rc -or                      \
-          -name functions\* -or               \
-          -wholename \*/inc/\* -or            \ # /inc files and
-          -wholename \*/lib/\*                \ # /lib files are shell, but
-         \)                                   \ #   have no extension
+commands = bash -c "find {toxinidir}             \
+         -not \( -type d -name .?\* -prune \)    \ # prune all 'dot' dirs
+         -not \( -type d -name doc -prune \)     \ # skip documentation
+         -not \( -type d -name shocco -prune \)  \ # skip shocco
+         -type f                                 \ # only files
+         -not -name \*~                          \ # skip editors, readme, etc
+         -not -name \*.md                        \
+         \(                                      \
+          -name \*.sh -or                        \
+          -name \*rc -or                         \
+          -name functions\* -or                  \
+          -wholename \*/inc/\* -or               \ # /inc files and
+          -wholename \*/lib/\*                   \ # /lib files are shell, but
+         \)                                      \ #   have no extension
          -print0 | xargs -0 bashate -v"
 
 [testenv:docs]

From 6d50d95cae72435330690e518e4b7dbf06c75f84 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Fri, 29 May 2015 12:26:31 +1000
Subject: [PATCH 0633/3333] Skip the .tox dir when building docs

When running tools/build_docs.sh in a devstack dir that has also run tox
build_docs needlessly runs shocco on the .tox files.

Just skip them.

Change-Id: Ia561e49ea2214ac75bd55964f1b86872118b2031
---
 tools/build_docs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build_docs.sh b/tools/build_docs.sh
index fda86c05cd..fa843432b5 100755
--- a/tools/build_docs.sh
+++ b/tools/build_docs.sh
@@ -75,7 +75,7 @@ rm -f $GLOG
 
 # Build list of scripts to process
 FILES=""
-for f in $(find . -name .git -prune -o \( -type f -name \*.sh -not -path \*shocco/\* -print \)); do
+for f in $(find . \( -name .git -o -name .tox \) -prune -o \( -type f -name \*.sh -not -path \*shocco/\* -print \)); do
     echo $f
     FILES+="$f "
     mkdir -p $FQ_HTML_BUILD/`dirname $f`;

From 02ae50dc995815641c787d821c69ac537ac6527a Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 20 Mar 2015 09:58:55 -0700
Subject: [PATCH 0634/3333] Documentation for single interface Neutron
 networking with OVS

Change-Id: I7a72377f55952db629c2ce7ba4ed648635e581ef
---
 doc/source/conf.py            |  2 +-
 doc/source/guides/neutron.rst | 74 +++++++++++++++++++++++++++++++++--
 tox.ini                       |  4 ++
 3 files changed, 75 insertions(+), 5 deletions(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 3e9aa45911..6e3ec029e9 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -26,7 +26,7 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'oslosphinx' ]
+extensions = [ 'oslosphinx', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
 
 todo_include_todos = True
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index b0a89070fb..bdfd3a4afa 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -5,11 +5,77 @@ Using DevStack with neutron Networking
 This guide will walk you through using OpenStack neutron with the ML2
 plugin and the Open vSwitch mechanism driver.
 
-Network Interface Configuration
-===============================
 
-To use neutron, it is suggested that two network interfaces be present
-in the host operating system.
+Using Neutron with a Single Interface
+=====================================
+
+In some instances, like on a developer laptop, there is only one
+network interface that is available. In this scenario, the physical
+interface is added to the Open vSwitch bridge, and the IP address of
+the laptop is migrated onto the bridge interface. That way, the
+physical interface can be used to transmit tenant network traffic,
+the OpenStack API traffic, and management traffic.
+
+
+Physical Network Setup
+----------------------
+
+In most cases where DevStack is being deployed with a single
+interface, there is a hardware router that is being used for external
+connectivity and DHCP. The developer machine is connected to this
+network and is on a shared subnet with other machines.
+
+.. nwdiag::
+
+        nwdiag {
+                inet [ shape = cloud ];
+                router;
+                inet -- router;
+
+                network hardware_network {
+                        address = "172.18.161.0/24"
+                        router [ address = "172.18.161.1" ];
+                        devstack_laptop [ address = "172.18.161.6" ];
+                }
+        }
+
+
+DevStack Configuration
+----------------------
+
+
+::
+
+        HOST_IP=172.18.161.6
+        SERVICE_HOST=172.18.161.6
+        MYSQL_HOST=172.18.161.6
+        RABBIT_HOST=172.18.161.6
+        GLANCE_HOSTPORT=172.18.161.6:9292
+        ADMIN_PASSWORD=secrete
+        MYSQL_PASSWORD=secrete
+        RABBIT_PASSWORD=secrete
+        SERVICE_PASSWORD=secrete
+        SERVICE_TOKEN=secrete
+
+        ## Neutron options
+        Q_USE_SECGROUP=True
+        FLOATING_RANGE="172.18.161.1/24"
+        FIXED_RANGE="10.0.0.0/24"
+        Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
+        PUBLIC_NETWORK_GATEWAY="172.18.161.1"
+        Q_L3_ENABLED=True
+        PUBLIC_INTERFACE=eth0
+        Q_USE_PROVIDERNET_FOR_PUBLIC=True
+        OVS_PHYSICAL_BRIDGE=br-ex
+        PUBLIC_BRIDGE=br-ex
+        OVS_BRIDGE_MAPPINGS=public:br-ex
+
+
+
+
+
+Using Neutron with Multiple Interfaces
+======================================
 
 The first interface, eth0 is used for the OpenStack management (API,
 message bus, etc) as well as for ssh for an administrator to access
diff --git a/tox.ini b/tox.ini
index 279dcd4f66..f76e2565eb 100644
--- a/tox.ini
+++ b/tox.ini
@@ -32,6 +32,10 @@ deps =
    sphinx>=1.1.2,<1.2
    pbr>=0.6,!=0.7,<1.0
    oslosphinx
+   nwdiag
+   blockdiag
+   sphinxcontrib-blockdiag
+   sphinxcontrib-nwdiag
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}

From 7ef246492c8613c80b197fcec93ca65c5db47cb1 Mon Sep 17 00:00:00 2001
From: David Lyle <david.lyle@intel.com>
Date: Fri, 29 May 2015 13:49:03 -0600
Subject: [PATCH 0635/3333] Fixing keystone v3 version use for horizon

The setting for overriding Horizon's OPENSTACK_API_VERSIONS is not
the correct format. The version should be a number, not a string.

so should be 3, not "v3".

Change-Id: I193d21514b196336796eac067417dc2aaec56433
Closes-Bug: #1460190
---
 lib/horizon | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/horizon b/lib/horizon
index ab6e758409..b0f306b675 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -100,7 +100,7 @@ function init_horizon {
 
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 API is available; then use it with v3 auth tokens
-        _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":\"v3\"}
+        _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
         _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
     else
         _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""

From 4be092da3eb79ffe172d29ed767815fb13d658ca Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Sat, 30 May 2015 23:19:18 +0200
Subject: [PATCH 0636/3333] Fix devlibs for SUSE

libmysqld-devel is needed for installing MySQL-python. Otherwise the
following error occurs:

EnvironmentError: mysql_config not found

Change-Id: Id84d3116d5987976169d8e2f9aca754ded205880
---
 files/rpms-suse/devlibs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
index c9238252af..02c5398079 100644
--- a/files/rpms-suse/devlibs
+++ b/files/rpms-suse/devlibs
@@ -4,3 +4,4 @@ libxml2-devel  # lxml
 libxslt-devel  # lxml
 postgresql-devel  # psycopg2
 python-devel  # pyOpenSSL
+libmysqld-devel  # MySQL-python
\ No newline at end of file

From 06efa2ac5df6f64785c2574e653595625dbbffde Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Sat, 30 May 2015 23:55:33 +0200
Subject: [PATCH 0637/3333] Fix horizon files for SUSE

python-CherryPy and python-beautifulsoup are not needed so remove them
from the list of packages for horizon.

Change-Id: I45ddf98b5891a1f1f1da82bb4afa79ea43d156cc
---
 files/rpms-suse/horizon | 2 --
 1 file changed, 2 deletions(-)

diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
index c45eae6153..5ba5aafd38 100644
--- a/files/rpms-suse/horizon
+++ b/files/rpms-suse/horizon
@@ -1,13 +1,11 @@
 apache2  # NOPRIME
 apache2-mod_wsgi  # NOPRIME
-python-CherryPy # why? (coming from apts)
 python-Paste
 python-PasteDeploy
 python-Routes
 python-SQLAlchemy
 python-WebOb
 python-anyjson
-python-beautifulsoup
 python-coverage
 python-dateutil
 python-eventlet

From a858085afb46922760d9e89c34feb988ea283a54 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Sun, 31 May 2015 00:04:33 +0200
Subject: [PATCH 0638/3333] Simplify add_user_to_group function

Current SLE12 and openSUSE13.X versions can handle usermod's '-a' and '-G'
switches so remove the special case.

Change-Id: If0f1390a0eb8f41ffffca74525a4648cfe8ea61d
---
 functions-common | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index ff9261161c..3a2f5f7f41 100644
--- a/functions-common
+++ b/functions-common
@@ -1842,16 +1842,7 @@ function add_user_to_group {
     local user=$1
     local group=$2
 
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    # SLE11 and openSUSE 12.2 don't have the usual usermod
-    if ! is_suse || [[ "$os_VENDOR" = "openSUSE" && "$os_RELEASE" != "12.2" ]]; then
-        sudo usermod -a -G "$group" "$user"
-    else
-        sudo usermod -A "$group" "$user"
-    fi
+    sudo usermod -a -G "$group" "$user"
 }
 
 # Convert CIDR notation to a IPv4 netmask

From 6bc905c3488a93fa87776bcd0af7e362a90b082f Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Fri, 15 May 2015 12:51:43 +1000
Subject: [PATCH 0639/3333] Change the restart_rpc_backend loop to accomodate
 async rabbitmq

Some distros have converted to systemd for starting RabbitMQ.  This has
resulted in:
---
[Call Trace]
./stack.sh:904:restart_rpc_backend
/home/stack/projects/openstack/openstack-dev/devstack/lib/rpc_backend:201:die
[ERROR] /home/stack/projects/openstack/openstack-dev/devstack/lib/rpc_backend:201 Failed to set rabbitmq password
Error on exit
World dumping... see /opt/stack/logs/worlddump-2015-05-29-031618.txt for details
---

Because 'restart_service rabbitmq-server' returns before the server is ready to
accept connections.

Alter the retry loop to only restart the rabbitmq-server every second time
through the loop.  Allowing time for the slow rabbit to start.

Closes-Bug: 1449056
Change-Id: Ibb291c1ecfd109f9ed10b5f194933364985cc1ce
---
 lib/rpc_backend | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 297ebacc08..33ab03d664 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -194,13 +194,22 @@ function restart_rpc_backend {
         # NOTE(bnemec): Retry initial rabbitmq configuration to deal with
         # the fact that sometimes it fails to start properly.
         # Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1144100
+        # NOTE(tonyb): Extend the orginal retry logic to only restart rabbitmq
+        # every second time around the loop.
+        # See: https://bugs.launchpad.net/devstack/+bug/1449056 for details on
+        # why this is needed.  This can bee seen on vivid and Debian unstable
+        # (May 2015)
+        # TODO(tonyb): Remove this when Debian and Ubuntu have a fixed systemd
+        # service file.
         local i
-        for i in `seq 10`; do
+        for i in `seq 20`; do
             local rc=0
 
-            [[ $i -eq "10" ]] && die $LINENO "Failed to set rabbitmq password"
+            [[ $i -eq "20" ]] && die $LINENO "Failed to set rabbitmq password"
 
-            restart_service rabbitmq-server
+            if [[ $(( i % 2 )) == "0" ]] ; then
+                restart_service rabbitmq-server
+            fi
 
             rabbit_setuser "$RABBIT_USERID" "$RABBIT_PASSWORD" || rc=$?
             if [ $rc -ne 0 ]; then

From 0bedeb906244b8ecf32cff43d4a73717217801b2 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Fri, 15 May 2015 12:51:16 +1000
Subject: [PATCH 0640/3333] Add utopic and vivid as a supported distros

Change-Id: I63843335bd70ab9701bbd10dcf61f3eaa45a10e8
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 6615b8fef4..dc79fa94f7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -173,7 +173,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|7.0|wheezy|sid|testing|jessie|f20|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|utopic|vivid|7.0|wheezy|sid|testing|jessie|f20|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 1ebe4f1ff0b9056d8015eee021a11ce1bd18b184 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 29 May 2015 13:36:09 +0200
Subject: [PATCH 0641/3333] Add missing libmysqlclient-devel dependency for
 SUSE

Currently devstack unconditionally installs MySQL-python, so
we need to have its dependencies available. Since this is
transitional until the switch to PyMysql happened, lets just
add the dependency for now to have devstack working again.

Change-Id: I638b5999d35a06eee962679b1cd95950bbf2b1d7
---
 files/rpms-suse/devlibs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
index 02c5398079..bdb630a16f 100644
--- a/files/rpms-suse/devlibs
+++ b/files/rpms-suse/devlibs
@@ -3,5 +3,5 @@ libopenssl-devel  # pyOpenSSL
 libxml2-devel  # lxml
 libxslt-devel  # lxml
 postgresql-devel  # psycopg2
+libmysqlclient-devel # MySQL-python
 python-devel  # pyOpenSSL
-libmysqld-devel  # MySQL-python
\ No newline at end of file

From 643779873acfaca160caac5ef94c1286eb33ae51 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 1 Jun 2015 10:43:58 +0200
Subject: [PATCH 0642/3333] Remove packaged rpm python libraries

We want to use the pip versions instead, only python-devel
should be needed.

Change-Id: If7720d54c4ad3358f9dc2fceedd6f5897085eb8f
---
 files/rpms-suse/ceilometer-collector |  1 -
 files/rpms-suse/glance               |  9 ---------
 files/rpms-suse/horizon              | 12 ------------
 files/rpms-suse/keystone             | 11 -----------
 files/rpms-suse/neutron              | 12 ------------
 files/rpms-suse/nova                 | 24 +-----------------------
 files/rpms-suse/swift                |  9 ---------
 7 files changed, 1 insertion(+), 77 deletions(-)

diff --git a/files/rpms-suse/ceilometer-collector b/files/rpms-suse/ceilometer-collector
index c76454fded..5e4dfcc35e 100644
--- a/files/rpms-suse/ceilometer-collector
+++ b/files/rpms-suse/ceilometer-collector
@@ -1,4 +1,3 @@
 # Not available in openSUSE main repositories, but can be fetched from OBS
 # (devel:languages:python and server:database projects)
 mongodb
-python-pymongo
diff --git a/files/rpms-suse/glance b/files/rpms-suse/glance
index 9b962f9643..0e58425b1f 100644
--- a/files/rpms-suse/glance
+++ b/files/rpms-suse/glance
@@ -1,11 +1,2 @@
 libxml2-devel
-python-PasteDeploy
-python-Routes
-python-SQLAlchemy
-python-argparse
 python-devel
-python-eventlet
-python-greenlet
-python-iso8601
-python-pyOpenSSL
-python-xattr
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
index 5ba5aafd38..77f7c34b31 100644
--- a/files/rpms-suse/horizon
+++ b/files/rpms-suse/horizon
@@ -1,14 +1,2 @@
 apache2  # NOPRIME
 apache2-mod_wsgi  # NOPRIME
-python-Paste
-python-PasteDeploy
-python-Routes
-python-SQLAlchemy
-python-WebOb
-python-anyjson
-python-coverage
-python-dateutil
-python-eventlet
-python-mox
-python-sqlalchemy-migrate
-python-xattr
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
index 4c37adef9b..c838b413c3 100644
--- a/files/rpms-suse/keystone
+++ b/files/rpms-suse/keystone
@@ -1,15 +1,4 @@
 cyrus-sasl-devel
 openldap2-devel
-python-Paste
-python-PasteDeploy
-python-PasteScript
-python-Routes
-python-SQLAlchemy
-python-WebOb
 python-devel
-python-greenlet
-python-lxml
-python-mysql
-python-mysql-connector-python
-python-pysqlite
 sqlite3
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index d278363e98..e75db89ddf 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -6,17 +6,6 @@ iptables
 iputils
 mariadb # NOPRIME
 postgresql-devel
-python-eventlet
-python-greenlet
-python-iso8601
-python-mysql
-python-mysql-connector-python
-python-Paste
-python-PasteDeploy
-python-pyudev
-python-Routes
-python-SQLAlchemy
-python-suds
 rabbitmq-server # NOPRIME
 sqlite3
 sudo
@@ -24,5 +13,4 @@ vlan
 radvd # NOPRIME
 
 # FIXME: qpid is not part of openSUSE, those names are tentative
-python-qpid # NOPRIME
 qpidd # NOPRIME
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index b1c4f6a8d0..6f8aef1027 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -16,29 +16,7 @@ libvirt-python # NOPRIME
 mariadb # NOPRIME
 parted
 polkit
-python-M2Crypto
-python-m2crypto # dist:sle11sp2
-python-Paste
-python-PasteDeploy
-python-Routes
-python-SQLAlchemy
-python-Tempita
-python-cheetah
-python-eventlet
-python-feedparser
-python-greenlet
-python-iso8601
-python-libxml2
-python-lockfile
-python-lxml # needed for glance which is needed for nova --- this shouldn't be here
-python-mox
-python-mysql
-python-mysql-connector-python
-python-numpy # needed by websockify for spice console
-python-paramiko
-python-sqlalchemy-migrate
-python-suds
-python-xattr # needed for glance which is needed for nova --- this shouldn't be here
+python-devel
 rabbitmq-server # NOPRIME
 socat
 sqlite3
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
index 9c0d188fe2..6a824f944f 100644
--- a/files/rpms-suse/swift
+++ b/files/rpms-suse/swift
@@ -1,15 +1,6 @@
 curl
 memcached
-python-PasteDeploy
-python-WebOb
-python-configobj
-python-coverage
 python-devel
-python-eventlet
-python-greenlet
-python-netifaces
-python-simplejson
-python-xattr
 sqlite3
 xfsprogs
 xinetd

From f100e1cfe6860cc3b7d5384ed41d5bdad6af2fd2 Mon Sep 17 00:00:00 2001
From: David Kranz <dkranz@redhat.com>
Date: Mon, 1 Jun 2015 10:29:59 -0400
Subject: [PATCH 0643/3333] Enable image deactivate feature which was added in
 kilo

Change-Id: Ia1d3d811bd57d3de16d397cfab341e8d0f17cb69
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 059709dbb8..95715a33da 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -330,6 +330,9 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
 
+    # Image Features
+    iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True
+
     # Auth
     TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}
     iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}

From 25cb34606eb25ad2760e4ac50fa4d08036afbc96 Mon Sep 17 00:00:00 2001
From: Sergey Skripnick <sskripnick@mirantis.com>
Date: Mon, 1 Jun 2015 19:06:46 +0300
Subject: [PATCH 0644/3333] Fix sample multinode configuration

There should not be c-sch and c-api services on compute node.

Change-Id: Ice057eb80e7ab6e917ca972abe7eaae7d635e8a5
Closes-Bug: 1393721
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index b2617c9f17..27d71f1b9c 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -178,7 +178,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=192.168.42.11
     RABBIT_HOST=192.168.42.11
     GLANCE_HOSTPORT=192.168.42.11:9292
-    ENABLED_SERVICES=n-cpu,n-net,n-api,c-sch,c-api,c-vol
+    ENABLED_SERVICES=n-cpu,n-net,n-api,c-vol
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://192.168.42.11:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP

From 64d5ecf3bf7e0bd08762a7fe5f94f7947ae0204c Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 1 Jun 2015 14:13:41 -0400
Subject: [PATCH 0645/3333] Define PUBLIC_BRIDGE in the main Neutron lib

This way, it can be used by both OVS and Linux Bridge

Change-Id: Iea5a8bb720d327b69f64791a23d414d4cde2e3ea
Closes-Bug: #1460758
---
 lib/neutron-legacy                    | 4 ++++
 lib/neutron_plugins/linuxbridge_agent | 5 +++++
 lib/neutron_plugins/ovs_base          | 1 -
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 18b0942ae1..8879bd91c6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -168,6 +168,10 @@ NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 ## Provider Network Information
 PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
 
+# Define the public bridge that will transmit traffic from VMs to the
+# physical network - used by both the OVS and Linux Bridge drivers.
+PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+
 # Use flat providernet for public network
 #
 # If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index c9ea1cac28..b348af9c4f 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -7,6 +7,10 @@
 PLUGIN_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
+function neutron_lb_cleanup {
+    sudo brctl delbr $PUBLIC_BRIDGE
+}
+
 function is_neutron_ovs_base_plugin {
     # linuxbridge doesn't use OVS
     return 1
@@ -29,6 +33,7 @@ function neutron_plugin_configure_dhcp_agent {
 }
 
 function neutron_plugin_configure_l3_agent {
+    sudo brctl addbr $PUBLIC_BRIDGE
     iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
     iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 51999c60e4..81561d3114 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -8,7 +8,6 @@ OVSB_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
-PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-""}
 
 function is_neutron_ovs_base_plugin {

From 7d350720fe5d25fece68c5d1625a33a6cad431ef Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 28 May 2015 14:59:31 -0400
Subject: [PATCH 0646/3333] Replace pip-installed requests CA bundle with link

If the version of python-requests required is higher than
that provided by the operating system, pip will install
it from upstream.

The upstream version provides its own CA certificate bundle
based on the Mozilla bundle, and defaults to that in case
a CA certificate file is not specified for a request.

The distribution-specific packages point to the system-wide
CA bundle that can be managed by tools such as
update-ca-trust (Fedora/RHEL) and update-ca-certificates
(Debian/Ubuntu).

When installing in SSL/TLS mode, either with SSL=True or by
adding tls-proxy to ENABLED_SERVICES, if a non-systemwide
CA bundle is used, then the CA generated by devstack will
not be used causing the installation to fail.

Replace the upstream-provided bundle with a link to the
system bundle when possible.

Change-Id: I349662ff8f851b4a7f879f89b8975a068f2d73dc
Closes-Bug: #1459789
---
 tools/fixup_stuff.sh | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 31258d13f7..d3a3de2092 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -138,3 +138,24 @@ fi
 # and installing the latest version using pip.
 uninstall_package python-virtualenv
 pip_install -U virtualenv
+
+# If a non-system python-requests is installed then it will use the
+# built-in CA certificate store rather than the distro-specific
+# CA certificate store. Detect this and symlink to the correct
+# one. If the value for the CA is not rooted in /etc then we know
+# we need to change it.
+capath=$(python -c "from requests import certs; print certs.where()")
+
+if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+    if [[ ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
+        if is_fedora; then
+            sudo rm -f $capath
+            sudo ln -s /etc/pki/tls/certs/ca-bundle.crt $capath
+        elif is_ubuntu; then
+            sudo rm -f $capath
+            sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
+        else
+            echo "Don't know how to set the CA bundle, expect the install to fail."
+        fi
+    fi
+fi

From aa54511727614a837992845be416b9bd921be2e4 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 3 Jun 2015 17:10:43 +0900
Subject: [PATCH 0647/3333] midonet: Provide has_neutron_plugin_security_group

Change-Id: I6ac12022bb8998fbec17cfa503db9277aa2eb8b7
Partial-Bug: #1458871
---
 lib/neutron_plugins/midonet | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/midonet b/lib/neutron_plugins/midonet
index 9e72aa0ce9..ca0b70c76c 100644
--- a/lib/neutron_plugins/midonet
+++ b/lib/neutron_plugins/midonet
@@ -1,4 +1,10 @@
 #!/bin/bash
 
-# REVISIT(devvesa): This file is intentionally left empty
-# in order to keep Q_PLUGIN=midonet work.
+# REVISIT(devvesa): This file is needed so Q_PLUGIN=midonet will work.
+
+# FIXME(yamamoto): This function should not be here, but unfortunately
+# devstack calls it before the external plugins are fetched
+function has_neutron_plugin_security_group {
+    # 0 means True here
+    return 0
+}

From 3fe4c4e789f266b1367a770e12f3c461e8981a15 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 3 Jun 2015 17:29:50 +0900
Subject: [PATCH 0648/3333] MAINTAINERS.rst: Add MidoNet section

While the most part of MidoNet code is now externally maintained
using the external plugin mechanism, it can be still useful to
have a contact list.

Change-Id: I3e0a0586c07875ca37ce101dd169eaf78f34f7a5
---
 MAINTAINERS.rst | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index d3e8c67487..eeb1f21b61 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -45,6 +45,13 @@ Fedora/CentOS/RHEL
 Neutron
 ~~~~~~~
 
+MidoNet
+~~~~~~~
+
+* Jaume Devesa <devvesa@gmail.com>
+* Ryu Ishimoto <ryu@midokura.com>
+* YAMAMOTO Takashi <yamamoto@midokura.com>
+
 OpenDaylight
 ~~~~~~~~~~~~
 

From 50a3edf1b77fbe91c8101cfca9c1abad9c756a3d Mon Sep 17 00:00:00 2001
From: afazekas <afazekas@redhat.com>
Date: Wed, 27 May 2015 11:50:12 +0200
Subject: [PATCH 0649/3333] Enable deactivate image tests in tempest

Deactivate image is new feature, so it cannot be default
enabled in tempest.

Change-Id: Ic33b3e2f7a9f62543680647312603bdd19b90198
Depends-On: I7880f0e2646ce8660e035ebaa19a60f5bf271b64
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 059709dbb8..5312a02cfa 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -329,6 +329,7 @@ function configure_tempest {
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
+    iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image true
 
     # Auth
     TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}

From a53ae68889746d61ad84cc19d2f2b61eec2c052a Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 27 May 2015 21:59:32 +0200
Subject: [PATCH 0650/3333] Remove Fedora 20 as supported distribution

Fedora 20 will reach end of life on 23-JUN-2015[1]; remove it as
supported distribution. Add Fedora 22 where applicable.

    - stack.sh: Remove Fedora 20 from list of supported distributions.
    - files/rpms/general: Remove 'f20' from NOPRIME.
    - lib/ceph: Remove 'f20' from the check_os_support_ceph()
      function.
    - doc/source/index.rst: s/Fedora 20/Fedora 21/

[1] https://lists.fedoraproject.org/pipermail/devel-announce/2015-May/001586.html

Change-Id: I8f2e1ddc24c071754b1cceb5bed5bdafdc9d9f79
---
 doc/source/index.rst | 6 +++---
 files/rpms/general   | 2 +-
 lib/ceph             | 2 +-
 stack.sh             | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index e0c3f3a5d6..6d0edb0bfe 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -19,9 +19,9 @@ Quick Start
 
 #. Select a Linux Distribution
 
-   Only Ubuntu 14.04 (Trusty), Fedora 20 and CentOS/RHEL 7 are
-   documented here. OpenStack also runs and is packaged on other flavors
-   of Linux such as OpenSUSE and Debian.
+   Only Ubuntu 14.04 (Trusty), Fedora 21 (or Fedora 22) and CentOS/RHEL
+   7 are documented here. OpenStack also runs and is packaged on other
+   flavors of Linux such as OpenSUSE and Debian.
 
 #. Install Selected OS
 
diff --git a/files/rpms/general b/files/rpms/general
index 7b2c00ad5c..67b084ef29 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -25,6 +25,6 @@ bc
 libyaml-devel
 gettext  # used for compiling message catalogs
 net-tools
-java-1.7.0-openjdk-headless  # NOPRIME rhel7,f20
+java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 pyOpenSSL # version in pip uses too much memory
diff --git a/lib/ceph b/lib/ceph
index 4d6ca4aa68..cbdc3b87f1 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -110,7 +110,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f20|f21|f22) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f21|f22) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index dc79fa94f7..0c01165642 100755
--- a/stack.sh
+++ b/stack.sh
@@ -173,7 +173,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|utopic|vivid|7.0|wheezy|sid|testing|jessie|f20|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|utopic|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 6254d5fd0d87e65aa0a53b9fb30b36145e47d46d Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Fri, 5 Jun 2015 11:58:15 -0400
Subject: [PATCH 0651/3333] Fix nova and glance discovery URLs when tls-proxy
 is enabled.

Retrieving the root page in the nova and glance APIs include
URLs for the various versions supported. These are by default
reported using unsecure URLs. Configure the services to report
a SSL-based URL instead.

Change-Id: I220757e53b94a5f6d19291371407220fdf54c645
---
 lib/glance | 1 +
 lib/nova   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/lib/glance b/lib/glance
index 4e1bd24ef5..016ade3479 100644
--- a/lib/glance
+++ b/lib/glance
@@ -154,6 +154,7 @@ function configure_glance {
 
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
+        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
     fi
 
diff --git a/lib/nova b/lib/nova
index da288d3e4d..11fa2a0ba4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -489,6 +489,7 @@ function create_nova_conf {
         if is_service_enabled tls-proxy; then
             # Set the service port for a proxy to take the original
             iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
+            iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
         configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR

From 027e2ea741bdbcb6e1afc3fe527c3fdf045825c3 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Fri, 5 Jun 2015 18:43:50 +0000
Subject: [PATCH 0652/3333] Allow ceilometer to run in virtualenv if USE_VENV

This requires three main changes:

* setting CEILOMETER_BIN_DIR appropriately
* running the various services with a full path
* explicitly installing optional python modules (for mongo and
  virt drivers, if configured) during the install phase

In the process of making this work it was discovered that setting
CEILOMETER_BACKEND to something like 'foo' would cause the backend
to be configured to use mongodb but for the mongodb system packages
and related python modules to not be installed. Fixing this was used
to validate the install process under USE_VENV.

Change-Id: I35fbfa76bdd60a22ba90b13666b06eeb961dddb3
---
 files/apache-ceilometer.template |  2 +-
 lib/ceilometer                   | 59 +++++++++++++++++++++++---------
 2 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/files/apache-ceilometer.template b/files/apache-ceilometer.template
index 1c57b328b8..79f14c38ab 100644
--- a/files/apache-ceilometer.template
+++ b/files/apache-ceilometer.template
@@ -1,7 +1,7 @@
 Listen %PORT%
 
 <VirtualHost *:%PORT%>
-    WSGIDaemonProcess ceilometer-api processes=2 threads=10 user=%USER% display-name=%{GROUP}
+    WSGIDaemonProcess ceilometer-api processes=2 threads=10 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup ceilometer-api
     WSGIScriptAlias / %WSGIAPP%
     WSGIApplicationGroup %{GLOBAL}
diff --git a/lib/ceilometer b/lib/ceilometer
index 1f72187ed6..f6f605b686 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -78,8 +78,13 @@ CEILOMETER_API_LOG_DIR=/var/log/ceilometer-api
 CEILOMETER_AUTH_CACHE_DIR=${CEILOMETER_AUTH_CACHE_DIR:-/var/cache/ceilometer}
 CEILOMETER_WSGI_DIR=${CEILOMETER_WSGI_DIR:-/var/www/ceilometer}
 
-# Support potential entry-points console scripts
-CEILOMETER_BIN_DIR=$(get_python_exec_prefix)
+# Support potential entry-points console scripts in VENV or not
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["ceilometer"]=${CEILOMETER_DIR}.venv
+    CEILOMETER_BIN_DIR=${PROJECT_VENV["ceilometer"]}/bin
+else
+    CEILOMETER_BIN_DIR=$(get_python_exec_prefix)
+fi
 
 # Set up database backend
 CEILOMETER_BACKEND=${CEILOMETER_BACKEND:-mysql}
@@ -151,6 +156,8 @@ function _cleanup_ceilometer_apache_wsgi {
 # runs that a clean run would need to clean up
 function cleanup_ceilometer {
     if [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
+        echo "### cleaning database"
+        read
         mongo ceilometer --eval "db.dropDatabase();"
     elif [ "$CEILOMETER_BACKEND" = 'es' ] ; then
         curl -XDELETE "localhost:9200/events_*"
@@ -165,16 +172,22 @@ function _config_ceilometer_apache_wsgi {
 
     local ceilometer_apache_conf=$(apache_site_config_for ceilometer)
     local apache_version=$(get_apache_version)
+    local venv_path=""
 
     # Copy proxy vhost and wsgi file
     sudo cp $CEILOMETER_DIR/ceilometer/api/app.wsgi $CEILOMETER_WSGI_DIR/app
 
+    if [[ ${USE_VENV} = True ]]; then
+        venv_path="python-path=${PROJECT_VENV["ceilometer"]}/lib/$(python_version)/site-packages"
+    fi
+
     sudo cp $FILES/apache-ceilometer.template $ceilometer_apache_conf
     sudo sed -e "
         s|%PORT%|$CEILOMETER_SERVICE_PORT|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%WSGIAPP%|$CEILOMETER_WSGI_DIR/app|g;
-        s|%USER%|$STACK_USER|g
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
     " -i $ceilometer_apache_conf
 }
 
@@ -232,12 +245,14 @@ function configure_ceilometer {
         iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
         ${TOP_DIR}/pkg/elasticsearch.sh start
         cleanup_ceilometer
-    else
+    elif [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
         iniset $CEILOMETER_CONF database alarm_connection mongodb://localhost:27017/ceilometer
         iniset $CEILOMETER_CONF database event_connection mongodb://localhost:27017/ceilometer
         iniset $CEILOMETER_CONF database metering_connection mongodb://localhost:27017/ceilometer
         configure_mongodb
         cleanup_ceilometer
+    else
+        die $LINENO "Unable to configure unknown CEILOMETER_BACKEND $CEILOMETER_BACKEND"
     fi
 
     if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
@@ -263,10 +278,8 @@ function configure_mongodb {
     local packages=mongodb-server
 
     if is_fedora; then
-        # mongodb client + python bindings
-        packages="${packages} mongodb pymongo"
-    else
-        packages="${packages} python-pymongo"
+        # mongodb client
+        packages="${packages} mongodb"
     fi
 
     install_package ${packages}
@@ -319,6 +332,18 @@ function install_ceilometer {
         install_redis
     fi
 
+    if [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
+        pip_install_gr pymongo
+    fi
+
+    if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
+        pip_install_gr libvirt-python
+    fi
+
+    if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
+        pip_instal_gr oslo.vmware
+    fi
+
     if [ "$CEILOMETER_BACKEND" = 'es' ] ; then
         ${TOP_DIR}/pkg/elasticsearch.sh download
         ${TOP_DIR}/pkg/elasticsearch.sh install
@@ -349,13 +374,13 @@ function install_ceilometermiddleware {
 
 # start_ceilometer() - Start running processes, including screen
 function start_ceilometer {
-    run_process ceilometer-acentral "ceilometer-agent-central --config-file $CEILOMETER_CONF"
-    run_process ceilometer-anotification "ceilometer-agent-notification --config-file $CEILOMETER_CONF"
-    run_process ceilometer-collector "ceilometer-collector --config-file $CEILOMETER_CONF"
-    run_process ceilometer-aipmi "ceilometer-agent-ipmi --config-file $CEILOMETER_CONF"
+    run_process ceilometer-acentral "$CEILOMETER_BIN_DIR/ceilometer-agent-central --config-file $CEILOMETER_CONF"
+    run_process ceilometer-anotification "$CEILOMETER_BIN_DIR/ceilometer-agent-notification --config-file $CEILOMETER_CONF"
+    run_process ceilometer-collector "$CEILOMETER_BIN_DIR/ceilometer-collector --config-file $CEILOMETER_CONF"
+    run_process ceilometer-aipmi "$CEILOMETER_BIN_DIR/ceilometer-agent-ipmi --config-file $CEILOMETER_CONF"
 
     if [[ "$CEILOMETER_USE_MOD_WSGI" == "False" ]]; then
-        run_process ceilometer-api "ceilometer-api -d -v --log-dir=$CEILOMETER_API_LOG_DIR --config-file $CEILOMETER_CONF"
+        run_process ceilometer-api "$CEILOMETER_BIN_DIR/ceilometer-api -d -v --log-dir=$CEILOMETER_API_LOG_DIR --config-file $CEILOMETER_CONF"
     else
         enable_apache_site ceilometer
         restart_apache_server
@@ -367,10 +392,10 @@ function start_ceilometer {
     # Start the compute agent last to allow time for the collector to
     # fully wake up and connect to the message bus. See bug #1355809
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
-        run_process ceilometer-acompute "ceilometer-agent-compute --config-file $CEILOMETER_CONF" $LIBVIRT_GROUP
+        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-agent-compute --config-file $CEILOMETER_CONF" $LIBVIRT_GROUP
     fi
     if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-        run_process ceilometer-acompute "ceilometer-agent-compute --config-file $CEILOMETER_CONF"
+        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-agent-compute --config-file $CEILOMETER_CONF"
     fi
 
     # Only die on API if it was actually intended to be turned on
@@ -381,8 +406,8 @@ function start_ceilometer {
         fi
     fi
 
-    run_process ceilometer-alarm-notifier "ceilometer-alarm-notifier --config-file $CEILOMETER_CONF"
-    run_process ceilometer-alarm-evaluator "ceilometer-alarm-evaluator --config-file $CEILOMETER_CONF"
+    run_process ceilometer-alarm-notifier "$CEILOMETER_BIN_DIR/ceilometer-alarm-notifier --config-file $CEILOMETER_CONF"
+    run_process ceilometer-alarm-evaluator "$CEILOMETER_BIN_DIR/ceilometer-alarm-evaluator --config-file $CEILOMETER_CONF"
 }
 
 # stop_ceilometer() - Stop running processes

From 2ebe993b25462919e8aeeb896c9f91b6be7aa573 Mon Sep 17 00:00:00 2001
From: Joe Gordon <joe.gordon0@gmail.com>
Date: Sun, 7 Jun 2015 16:57:34 +0900
Subject: [PATCH 0653/3333] guru meditation report for nova-compute in
 worlddump

Nova-compute is hanging in the multinode test, and its difficult to
figure out why. So trigger a guru meditation report for nova-compute in
worlddump so we can see what nova-compute is doing when it is hung.

Having a hung nova-compute causes tempest to fail and
I035fe8e3333034e44b403ed0f986220ab5b0e57a runs worlddump whenever
tempest fails.

Bug 1462305 is one of the last issues left before the multinode job is
stable enough to gate on, and this patch should make it much easier to
debug.

Change-Id: I87d7536b5992c47b8082684cc662f953113fd1a8
Related-Bug: #1462305
---
 tools/worlddump.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index d846f10025..7acfb5e97d 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -106,6 +106,12 @@ def compute_consoles():
             _dump_cmd("sudo cat %s" % fullpath)
 
 
+def guru_meditation_report():
+    _header("nova-compute Guru Meditation Report")
+    _dump_cmd("kill -s USR1 `pgrep nova-compute`")
+    print "guru meditation report in nova-compute log"
+
+
 def main():
     opts = get_options()
     fname = filename(opts.dir)
@@ -118,6 +124,7 @@ def main():
         network_dump()
         iptables_dump()
         compute_consoles()
+        guru_meditation_report()
 
 
 if __name__ == '__main__':

From 10e1fd420dbebec2a5e546266edfc748b8684f9b Mon Sep 17 00:00:00 2001
From: Ramy Asselin <ramy.asselin@hp.com>
Date: Thu, 4 Jun 2015 12:12:15 -0700
Subject: [PATCH 0654/3333] Allow override of os-brick library used by cinder

os-brick code was pulled out of cinder and made into its own library
https://review.openstack.org/#/c/155552/

added to requirements:
https://review.openstack.org/#/c/177372/

Integration tests were added
https://review.openstack.org/#/c/188156/

But they still use the version of os-brick from pip.

This change updates devstack to pull in the changes from
os-brick patch sets instead, when configured to do so.

Needed-by: Id2bc10782847861fe4bb5e9e46245654450e38fd

Change-Id: I5359dd37dfe94bd469d5ca35f9fbaeda61b5fac4
---
 lib/cinder                   | 8 ++++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index da22e29f84..b8cf8090dc 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -39,6 +39,7 @@ fi
 
 # set up default directories
 GITDIR["python-cinderclient"]=$DEST/python-cinderclient
+GITDIR["os-brick"]=$DEST/os-brick
 CINDER_DIR=$DEST/cinder
 
 # Cinder virtual environment
@@ -381,6 +382,13 @@ function init_cinder {
 
 # install_cinder() - Collect source and prepare
 function install_cinder {
+    # Install os-brick from git so we make sure we're testing
+    # the latest code.
+    if use_library_from_git "os-brick"; then
+        git_clone_by_name "os-brick"
+        setup_dev_lib "os-brick"
+    fi
+
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
     if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
diff --git a/stackrc b/stackrc
index 09ba3e9807..f8add4b44d 100644
--- a/stackrc
+++ b/stackrc
@@ -441,6 +441,10 @@ SWIFT3_BRANCH=${SWIFT3_BRANCH:-master}
 GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
 GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
 
+# os-brick library to manage local volume attaches
+GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
+GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
+
 
 ##################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 8210d0a466..336a213bc5 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -39,7 +39,7 @@ ALL_LIBS+=" oslo.serialization python-saharaclient django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
-ALL_LIBS+=" debtcollector"
+ALL_LIBS+=" debtcollector os-brick"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 7bc2af7a6b75a0e7f383546c1d61e02b27cf45b5 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 8 Jun 2015 12:36:30 -0400
Subject: [PATCH 0655/3333] Neutron: Add a cleanup function for Linux Bridge

Change-Id: Ia1bad5d2fa3b94afc662463b2e072f8482b0ce1f
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5681743e41..dd67f45a39 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -824,6 +824,10 @@ function cleanup_neutron {
         neutron_ovs_base_cleanup
     fi
 
+    if [[ $Q_AGENT == "linuxbridge" ]]; then
+        neutron_lb_cleanup
+    fi
+
     # delete all namespaces created by neutron
     for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}

From 09b94603bb4f903616da3b1b4970ee1e2a666b91 Mon Sep 17 00:00:00 2001
From: Russell Bryant <rbryant@redhat.com>
Date: Mon, 8 Jun 2015 15:25:43 -0400
Subject: [PATCH 0656/3333] Separate start/stop control of Neutron L2 agent.

This patch separates out control of the Neutron L2 agent from
starting/stopping the rest of Neutron.  This is needed for the same
reason that control of nova-compute was separated out for Nova.  When
doing rolling upgrade testing with Grenade, we need to be able to stop
and upgrade everything except the L2 agent, as that is what would be
running on a compute node.

After this is in place, we can update grenade to support a partial
upgrade scenario with Neutron and run it in jenkins to ensure we don't
break live upgrade support of Neutron.

Change-Id: I7eb87fba778aff3e4514813c6232dafa99ee2912
Signed-off-by: Russell Bryant <rbryant@redhat.com>
---
 lib/neutron-legacy | 33 +++++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5681743e41..519200bbcb 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -703,11 +703,10 @@ function start_neutron_service_and_check {
     fi
 }
 
-# Start running processes, including screen
-function start_neutron_agents {
-    # Start up the neutron agents if enabled
+# Control of the l2 agent is separated out to make it easier to test partial
+# upgrades (everything upgraded except the L2 agent)
+function start_neutron_l2_agent {
     run_process q-agt "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
     if is_provider_network; then
         sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
@@ -722,6 +721,10 @@ function start_neutron_agents {
             sudo route add -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
         fi
     fi
+}
+
+function start_neutron_other_agents {
+    run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
     if is_service_enabled q-vpn; then
         run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
@@ -745,8 +748,18 @@ function start_neutron_agents {
     fi
 }
 
-# stop_neutron() - Stop running processes (non-screen)
-function stop_neutron {
+# Start running processes, including screen
+function start_neutron_agents {
+    # Start up the neutron agents if enabled
+    start_neutron_l2_agent
+    start_neutron_other_agents
+}
+
+function stop_neutron_l2_agent {
+    stop_process q-agt
+}
+
+function stop_neutron_other {
     if is_service_enabled q-dhcp; then
         stop_process q-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
@@ -761,8 +774,6 @@ function stop_neutron {
         stop_process q-meta
     fi
 
-    stop_process q-agt
-
     if is_service_enabled q-lbaas; then
         neutron_lbaas_stop
     fi
@@ -777,6 +788,12 @@ function stop_neutron {
     fi
 }
 
+# stop_neutron() - Stop running processes (non-screen)
+function stop_neutron {
+    stop_neutron_other
+    stop_neutron_l2_agent
+}
+
 # _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
 # on startup, or back to the public interface on cleanup
 function _move_neutron_addresses_route {

From ce2d75df01071a06ac08c8f5ba73a8fd78002da4 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 4 Jun 2015 18:01:29 -0400
Subject: [PATCH 0657/3333] Remove hardcoded http in URL in sahara exercise
 script

The script hardcoded http://$SERVICE_HOST/... which failed
when SSL or tls-proxy was enabled. Calculate the protocol
based on enabled services instead.

Change-Id: I192eeeafe7bf4dc5cbd382c505ffb9307651d78a
---
 exercises/sahara.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/exercises/sahara.sh b/exercises/sahara.sh
index 2589e28c0c..8cad94562d 100755
--- a/exercises/sahara.sh
+++ b/exercises/sahara.sh
@@ -35,7 +35,13 @@ source $TOP_DIR/exerciserc
 
 is_service_enabled sahara || exit 55
 
-$CURL_GET http://$SERVICE_HOST:8386/ 2>/dev/null | grep -q 'Auth' || die $LINENO "Sahara API isn't functioning!"
+if is_ssl_enabled_service "sahara" || is_service_enabled tls-proxy; then
+    SAHARA_SERVICE_PROTOCOL="https"
+fi
+
+SAHARA_SERVICE_PROTOCOL=${SAHARA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+
+$CURL_GET $SAHARA_SERVICE_PROTOCOL://$SERVICE_HOST:8386/ 2>/dev/null | grep -q 'Auth' || die $LINENO "Sahara API isn't functioning!"
 
 set +o xtrace
 echo "*********************************************************************"

From a16e46100a2f676457abf884fc2b852d67597807 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 2 Jun 2015 10:08:04 +1000
Subject: [PATCH 0658/3333] Cleanup FAQ somewhat

Remove some old discussions that no longer seem relevant and cleanup a
few other points.

Change-Id: I175ddaf9362bf48d35b0e648904eeb21bdc3c793
---
 doc/source/faq.rst | 104 ++++++++++++++++-----------------------------
 1 file changed, 37 insertions(+), 67 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index d3b491fdac..0437ec26d5 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -10,36 +10,21 @@ General Questions
 =================
 
 Q: Can I use DevStack for production?
-    A: No. We mean it. Really. DevStack makes some implementation
-    choices that are not appropriate for production deployments. We
-    warned you!
-Q: Then why selinux in enforcing mode?
-    A: That is the default on current Fedora and RHEL releases. DevStack
-    has (rightly so) a bad reputation for its security practices; it has
-    always been meant as a development tool first and system integration
-    later. This is changing as the security issues around OpenStack's
-    use of root (for example) have been tightened and developers need to
-    be better equipped to work in these environments. ``stack.sh``'s use
-    of root is primarily to support the activities that would be handled
-    by packaging in "real" deployments. To remove additional protections
-    that will be desired/required in production would be a step
-    backward.
-Q: But selinux is disabled in RHEL!
-    A: Today it is, yes. That is a specific exception that certain
-    DevStack contributors fought strongly against. The primary reason it
-    was allowed was to support using RHEL6 as the Python 2.6 test
-    platform and that took priority time-wise. This will not be the case
-    with RHEL 7.
+
+    A: DevStack is targeted at developers and CI systems to use the
+    raw upstream code.  It makes many choices that are not appropriate
+    for production systems.
+
+    Your best choice is probably to choose a `distribution of
+    OpenStack
+    <https://www.openstack.org/marketplace/distros>`__.
+
 Q: Why a shell script, why not chef/puppet/...
     A: The script is meant to be read by humans (as well as ran by
     computers); it is the primary documentation after all. Using a
     recipe system requires everyone to agree and understand chef or
     puppet.
-Q: Why not use Crowbar?
-    A: DevStack is optimized for documentation & developers. As some of
-    us use `Crowbar <https://github.com/dellcloudedge/crowbar>`__ for
-    production deployments, we hope developers documenting how they
-    setup systems for new features supports projects like Crowbar.
+
 Q: I'd like to help!
     A: That isn't a question, but please do! The source for DevStack is
     at
@@ -49,27 +34,23 @@ Q: I'd like to help!
     follow the usual process as described in the `developer
     guide <http://docs.openstack.org/infra/manual/developers.html>`__. This Sphinx
     documentation is housed in the doc directory.
+
 Q: Why not use packages?
     A: Unlike packages, DevStack leaves your cloud ready to develop -
     checkouts of the code and services running in screen. However, many
     people are doing the hard work of packaging and recipes for
-    production deployments. We hope this script serves as a way to
-    communicate configuration changes between developers and packagers.
+    production deployments.
+
 Q: Why isn't $MY\_FAVORITE\_DISTRO supported?
     A: DevStack is meant for developers and those who want to see how
     OpenStack really works. DevStack is known to run on the
     distro/release combinations listed in ``README.md``. DevStack is
     only supported on releases other than those documented in
     ``README.md`` on a best-effort basis.
-Q: What about Fedora/RHEL/CentOS?
-    A: Fedora and CentOS/RHEL are supported via rpm dependency files and
-    specific checks in ``stack.sh``. Support will follow the pattern set
-    with the Ubuntu testing, i.e. only a single release of the distro
-    will receive regular testing, others will be handled on a
-    best-effort basis.
-Q: Are there any differences between Ubuntu and Fedora support?
-    A: Neutron is not fully supported prior to Fedora 18 due lack of
-    OpenVSwitch packages.
+
+Q: Are there any differences between Ubuntu and Centos/Fedora support?
+    A: Both should work well and are tested by DevStack CI.
+
 Q: Why can't I use another shell?
     A: DevStack now uses some specific bash-ism that require Bash 4, such
     as associative arrays. Simple compatibility patches have been accepted
@@ -77,26 +58,23 @@ Q: Why can't I use another shell?
     compatibility patches will be considered except for shells matching
     the array functionality as it is very ingrained in the repo and project
     management.
-Q: But, but, can't I test on OS/X?
-   A: Yes, even you, core developer who complained about this, needs to
-   install bash 4 via homebrew to keep running tests on OS/X.  Get a Real
-   Operating System.   (For most of you who don't know, I am referring to
-   myself.)
+
+Q: Can I test on OS/X?
+   A: Some people have success with bash 4 installed via
+   homebrew to keep running tests on OS/X.
 
 Operation and Configuration
 ===========================
 
 Q: Can DevStack handle a multi-node installation?
-    A: Indirectly, yes. You run DevStack on each node with the
-    appropriate configuration in ``local.conf``. The primary
-    considerations are turning off the services not required on the
-    secondary nodes, making sure the passwords match and setting the
-    various API URLs to the right place.
+    A: Yes, see :doc:`multinode lab guide <guides/multinode-lab>`
+
 Q: How can I document the environment that DevStack is using?
     A: DevStack includes a script (``tools/info.sh``) that gathers the
     versions of the relevant installed apt packages, pip packages and
     git repos. This is a good way to verify what Python modules are
     installed.
+
 Q: How do I turn off a service that is enabled by default?
     A: Services can be turned off by adding ``disable_service xxx`` to
     ``local.conf`` (using ``n-vol`` in this example):
@@ -113,31 +91,22 @@ Q: Is enabling a service that defaults to off done with the reverse of the above
         enable_service qpid
 
 Q: How do I run a specific OpenStack milestone?
-    A: OpenStack milestones have tags set in the git repo. Set the appropriate tag in the ``*_BRANCH`` variables in ``local.conf``.  Swift is on its own release schedule so pick a tag in the Swift repo that is just before the milestone release. For example:
+   A: OpenStack milestones have tags set in the git repo. Set the
+   appropriate tag in the ``*_BRANCH`` variables in ``local.conf``.
+   Swift is on its own release schedule so pick a tag in the Swift repo
+   that is just before the milestone release. For example:
 
     ::
 
         [[local|localrc]]
-        GLANCE_BRANCH=stable/juno
-        HORIZON_BRANCH=stable/juno
-        KEYSTONE_BRANCH=stable/juno
-        NOVA_BRANCH=stable/juno
-        GLANCE_BRANCH=stable/juno
-        NEUTRON_BRANCH=stable/juno
-        SWIFT_BRANCH=2.2.1
-
-Q: Why not use [STRIKEOUT:``tools/pip-requires``]\ ``requirements.txt`` to grab project dependencies?
-    [STRIKEOUT:The majority of deployments will use packages to install
-    OpenStack that will have distro-based packages as dependencies.
-    DevStack installs as many of these Python packages as possible to
-    mimic the expected production environment.] Certain Linux
-    distributions have a 'lack of workaround' in their Python
-    configurations that installs vendor packaged Python modules and
-    pip-installed modules to the SAME DIRECTORY TREE. This is causing
-    heartache and moving us in the direction of installing more modules
-    from PyPI than vendor packages. However, that is only being done as
-    necessary as the packaging needs to catch up to the development
-    cycle anyway so this is kept to a minimum.
+        GLANCE_BRANCH=stable/kilo
+        HORIZON_BRANCH=stable/kilo
+        KEYSTONE_BRANCH=stable/kilo
+        NOVA_BRANCH=stable/kilo
+        GLANCE_BRANCH=stable/kilo
+        NEUTRON_BRANCH=stable/kilo
+        SWIFT_BRANCH=2.3.0
+
 Q: What can I do about RabbitMQ not wanting to start on my fresh new VM?
     A: This is often caused by ``erlang`` not being happy with the
     hostname resolving to a reachable IP address. Make sure your
@@ -145,6 +114,7 @@ Q: What can I do about RabbitMQ not wanting to start on my fresh new VM?
     in ``/etc/hosts`` is often good enough for a single-node
     installation. And in an extreme case, use ``clean.sh`` to eradicate
     it and try again.
+
 Q: How can I set up Heat in stand-alone configuration?
     A: Configure ``local.conf`` thusly:
 

From 2f27addf660d768988b1d9ec199e59584f0d4022 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 2 Jun 2015 10:18:49 +1000
Subject: [PATCH 0659/3333] Move FAQ to a section-based format

Move to a section-based format, and add a TOC so we can see an
overview of the questions.

Change-Id: Ie480f2ab759a5a7081d4dc7d2491b44a85b6503a
---
 doc/source/faq.rst | 218 +++++++++++++++++++++++++--------------------
 1 file changed, 121 insertions(+), 97 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 0437ec26d5..87f84693df 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -2,99 +2,120 @@
 FAQ
 ===
 
--  `General Questions <#general>`__
--  `Operation and Configuration <#ops_conf>`__
--  `Miscellaneous <#misc>`__
+.. contents::
+   :local:
 
 General Questions
 =================
 
-Q: Can I use DevStack for production?
-
-    A: DevStack is targeted at developers and CI systems to use the
-    raw upstream code.  It makes many choices that are not appropriate
-    for production systems.
-
-    Your best choice is probably to choose a `distribution of
-    OpenStack
-    <https://www.openstack.org/marketplace/distros>`__.
-
-Q: Why a shell script, why not chef/puppet/...
-    A: The script is meant to be read by humans (as well as ran by
-    computers); it is the primary documentation after all. Using a
-    recipe system requires everyone to agree and understand chef or
-    puppet.
-
-Q: I'd like to help!
-    A: That isn't a question, but please do! The source for DevStack is
-    at
-    `git.openstack.org <https://git.openstack.org/cgit/openstack-dev/devstack>`__
-    and bug reports go to
-    `LaunchPad <http://bugs.launchpad.net/devstack/>`__. Contributions
-    follow the usual process as described in the `developer
-    guide <http://docs.openstack.org/infra/manual/developers.html>`__. This Sphinx
-    documentation is housed in the doc directory.
-
-Q: Why not use packages?
-    A: Unlike packages, DevStack leaves your cloud ready to develop -
-    checkouts of the code and services running in screen. However, many
-    people are doing the hard work of packaging and recipes for
-    production deployments.
-
-Q: Why isn't $MY\_FAVORITE\_DISTRO supported?
-    A: DevStack is meant for developers and those who want to see how
-    OpenStack really works. DevStack is known to run on the
-    distro/release combinations listed in ``README.md``. DevStack is
-    only supported on releases other than those documented in
-    ``README.md`` on a best-effort basis.
-
-Q: Are there any differences between Ubuntu and Centos/Fedora support?
-    A: Both should work well and are tested by DevStack CI.
-
-Q: Why can't I use another shell?
-    A: DevStack now uses some specific bash-ism that require Bash 4, such
-    as associative arrays. Simple compatibility patches have been accepted
-    in the past when they are not complex, at this point no additional
-    compatibility patches will be considered except for shells matching
-    the array functionality as it is very ingrained in the repo and project
-    management.
-
-Q: Can I test on OS/X?
-   A: Some people have success with bash 4 installed via
-   homebrew to keep running tests on OS/X.
+Can I use DevStack for production?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+DevStack is targeted at developers and CI systems to use the raw
+upstream code.  It makes many choices that are not appropriate for
+production systems.
+
+Your best choice is probably to choose a `distribution of OpenStack
+<https://www.openstack.org/marketplace/distros/distribution>`__.
+
+Why a shell script, why not chef/puppet/...
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The script is meant to be read by humans (as well as ran by
+computers); it is the primary documentation after all. Using a recipe
+system requires everyone to agree and understand chef or puppet.
+
+I'd like to help!
+~~~~~~~~~~~~~~~~~
+
+That isn't a question, but please do! The source for DevStack is at
+`git.openstack.org
+<https://git.openstack.org/cgit/openstack-dev/devstack>`__ and bug
+reports go to `LaunchPad
+<http://bugs.launchpad.net/devstack/>`__. Contributions follow the
+usual process as described in the `developer guide
+<http://docs.openstack.org/infra/manual/developers.html>`__. This
+Sphinx documentation is housed in the doc directory.
+
+Why not use packages?
+~~~~~~~~~~~~~~~~~~~~~
+
+Unlike packages, DevStack leaves your cloud ready to develop -
+checkouts of the code and services running in screen. However, many
+people are doing the hard work of packaging and recipes for production
+deployments.
+
+Why isn't $MY\_FAVORITE\_DISTRO supported?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+DevStack is meant for developers and those who want to see how
+OpenStack really works. DevStack is known to run on the distro/release
+combinations listed in ``README.md``. DevStack is only supported on
+releases other than those documented in ``README.md`` on a best-effort
+basis.
+
+Are there any differences between Ubuntu and Centos/Fedora support?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Both should work well and are tested by DevStack CI.
+
+Why can't I use another shell?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+DevStack now uses some specific bash-ism that require Bash 4, such as
+associative arrays. Simple compatibility patches have been accepted in
+the past when they are not complex, at this point no additional
+compatibility patches will be considered except for shells matching
+the array functionality as it is very ingrained in the repo and
+project management.
+
+Can I test on OS/X?
+~~~~~~~~~~~~~~~~~~~
+
+Some people have success with bash 4 installed via homebrew to keep
+running tests on OS/X.
 
 Operation and Configuration
 ===========================
 
-Q: Can DevStack handle a multi-node installation?
-    A: Yes, see :doc:`multinode lab guide <guides/multinode-lab>`
+Can DevStack handle a multi-node installation?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Yes, see :doc:`multinode lab guide <guides/multinode-lab>`
+
+How can I document the environment that DevStack is using?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Q: How can I document the environment that DevStack is using?
-    A: DevStack includes a script (``tools/info.sh``) that gathers the
-    versions of the relevant installed apt packages, pip packages and
-    git repos. This is a good way to verify what Python modules are
-    installed.
+DevStack includes a script (``tools/info.sh``) that gathers the
+versions of the relevant installed apt packages, pip packages and git
+repos. This is a good way to verify what Python modules are
+installed.
 
-Q: How do I turn off a service that is enabled by default?
-    A: Services can be turned off by adding ``disable_service xxx`` to
-    ``local.conf`` (using ``n-vol`` in this example):
+How do I turn off a service that is enabled by default?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Services can be turned off by adding ``disable_service xxx`` to
+``local.conf`` (using ``n-vol`` in this example):
 
     ::
 
         disable_service n-vol
 
-Q: Is enabling a service that defaults to off done with the reverse of the above?
-    A: Of course!
+Is enabling a service that defaults to off done with the reverse of the above?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Of course!
 
     ::
 
         enable_service qpid
 
-Q: How do I run a specific OpenStack milestone?
-   A: OpenStack milestones have tags set in the git repo. Set the
-   appropriate tag in the ``*_BRANCH`` variables in ``local.conf``.
-   Swift is on its own release schedule so pick a tag in the Swift repo
-   that is just before the milestone release. For example:
+How do I run a specific OpenStack milestone?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+OpenStack milestones have tags set in the git repo. Set the
+appropriate tag in the ``*_BRANCH`` variables in ``local.conf``.
+Swift is on its own release schedule so pick a tag in the Swift repo
+that is just before the milestone release. For example:
 
     ::
 
@@ -107,16 +128,16 @@ Q: How do I run a specific OpenStack milestone?
         NEUTRON_BRANCH=stable/kilo
         SWIFT_BRANCH=2.3.0
 
-Q: What can I do about RabbitMQ not wanting to start on my fresh new VM?
-    A: This is often caused by ``erlang`` not being happy with the
-    hostname resolving to a reachable IP address. Make sure your
-    hostname resolves to a working IP address; setting it to 127.0.0.1
-    in ``/etc/hosts`` is often good enough for a single-node
-    installation. And in an extreme case, use ``clean.sh`` to eradicate
-    it and try again.
+What can I do about RabbitMQ not wanting to start on my fresh new VM?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is often caused by ``erlang`` not being happy with the hostname
+resolving to a reachable IP address. Make sure your hostname resolves
+to a working IP address; setting it to 127.0.0.1 in ``/etc/hosts`` is
+often good enough for a single-node installation. And in an extreme
+case, use ``clean.sh`` to eradicate it and try again.
 
-Q: How can I set up Heat in stand-alone configuration?
-    A: Configure ``local.conf`` thusly:
+Configure ``local.conf`` thusly:
 
     ::
 
@@ -126,22 +147,25 @@ Q: How can I set up Heat in stand-alone configuration?
         KEYSTONE_SERVICE_HOST=<keystone-host>
         KEYSTONE_AUTH_HOST=<keystone-host>
 
-Q: Why are my configuration changes ignored?
-    A: You may have run into the package prerequisite installation
-    timeout. ``tools/install_prereqs.sh`` has a timer that skips the
-    package installation checks if it was run within the last
-    ``PREREQ_RERUN_HOURS`` hours (default is 2). To override this, set
-    ``FORCE_PREREQ=1`` and the package checks will never be skipped.
+Why are my configuration changes ignored?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You may have run into the package prerequisite installation
+timeout. ``tools/install_prereqs.sh`` has a timer that skips the
+package installation checks if it was run within the last
+``PREREQ_RERUN_HOURS`` hours (default is 2). To override this, set
+``FORCE_PREREQ=1`` and the package checks will never be skipped.
 
 Miscellaneous
 =============
 
-Q: ``tools/fixup_stuff.sh`` is broken and shouldn't 'fix' just one version of packages.
-    A: [Another not-a-question] No it isn't. Stuff in there is to
-    correct problems in an environment that need to be fixed elsewhere
-    or may/will be fixed in a future release. In the case of
-    ``httplib2`` and ``prettytable`` specific problems with specific
-    versions are being worked around. If later releases have those
-    problems than we'll add them to the script. Knowing about the broken
-    future releases is valuable rather than polling to see if it has
-    been fixed.
+``tools/fixup_stuff.sh`` is broken and shouldn't 'fix' just one version of packages.
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Stuff in there is to correct problems in an environment that need to
+be fixed elsewhere or may/will be fixed in a future release. In the
+case of ``httplib2`` and ``prettytable`` specific problems with
+specific versions are being worked around. If later releases have
+those problems than we'll add them to the script. Knowing about the
+broken future releases is valuable rather than polling to see if it
+has been fixed.

From 64cf20440865595a4c6c71859a964ddbea0389e2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 2 Jun 2015 10:28:55 +1000
Subject: [PATCH 0660/3333] Add note on openrc and zsh

Add a note about running openrc through bash for import into zsh, as
shown by Chmouel Boudjnah in I5b6c8cfedcdd36efb4cbc91831501ee5c9c3b1d1

Change-Id: I5f1c9fc3fdc045cf6fb69af13f6264a81bf5f763
Closes-Bug: #1460656
---
 doc/source/faq.rst | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 87f84693df..b09d386048 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -75,6 +75,21 @@ Can I test on OS/X?
 Some people have success with bash 4 installed via homebrew to keep
 running tests on OS/X.
 
+Can I at least source ``openrc`` with ``zsh``?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+People have reported success with a special function to run ``openrc``
+through bash for this
+
+.. code-block:: bash
+
+   function sourceopenrc {
+       pushd ~/devstack >/dev/null
+       eval $(bash -c ". openrc $1 $2;env|sed -n '/OS_/ { s/^/export /;p}'")
+       popd >/dev/null
+   }
+
+
 Operation and Configuration
 ===========================
 

From 64b2ebca15701785af09d2c225d7c81e3c6acdce Mon Sep 17 00:00:00 2001
From: Ben Nemec <bnemec@redhat.com>
Date: Fri, 5 Jun 2015 12:22:36 -0500
Subject: [PATCH 0661/3333] Make sure iptables-services is installed

The iptables service files are no longer included by default on
Fedora.  This causes the systemctl calls in fixup_stuff.sh to fail
when disabling firewalld in favor of iptables.

Change-Id: If37691d03e3d07ca8b53c541717081beeb184c16
Closes-Bug: #1462347
---
 files/rpms/general   | 1 +
 tools/fixup_stuff.sh | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/files/rpms/general b/files/rpms/general
index 7b2c00ad5c..43101f7c87 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -28,3 +28,4 @@ net-tools
 java-1.7.0-openjdk-headless  # NOPRIME rhel7,f20
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 pyOpenSSL # version in pip uses too much memory
+iptables-services  # NOPRIME f21,f22
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 31258d13f7..4fff57f401 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -126,6 +126,9 @@ if is_fedora; then
         # [4] http://docs.openstack.org/developer/devstack/guides/neutron.html
         if is_package_installed firewalld; then
             sudo systemctl disable firewalld
+            # The iptables service files are no longer included by default,
+            # at least on a baremetal Fedora 21 Server install.
+            install_package iptables-services
             sudo systemctl enable iptables
             sudo systemctl stop firewalld
             sudo systemctl start iptables

From d8ed29dcb3c73bd0eec61939164b90b914c6530c Mon Sep 17 00:00:00 2001
From: Aaron Rosen <aaronorosen@gmail.com>
Date: Tue, 9 Jun 2015 13:15:24 -0700
Subject: [PATCH 0662/3333] Add vmware_nsx_v3 support

Sadly this is needed. We should refactor this out from all of the
plugins so we don't need to have all of these files. Adding this one
for now though.

Change-Id: Id382443fa7bef6b45237688c7e88d9e9a80a6ba1
---
 lib/neutron_plugins/vmware_nsx_v3 | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 lib/neutron_plugins/vmware_nsx_v3

diff --git a/lib/neutron_plugins/vmware_nsx_v3 b/lib/neutron_plugins/vmware_nsx_v3
new file mode 100644
index 0000000000..6d8a6e6b70
--- /dev/null
+++ b/lib/neutron_plugins/vmware_nsx_v3
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# This file is needed so Q_PLUGIN=vmware_nsx_v3 will work.
+
+# FIXME(salv-orlando): This function should not be here, but unfortunately
+# devstack calls it before the external plugins are fetched
+function has_neutron_plugin_security_group {
+    # 0 means True here
+    return 0
+}

From 7272afdf8bf55580f778530d590afd505394b4ae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 10 Jun 2015 10:26:57 +0000
Subject: [PATCH 0663/3333] Revert "Replace pip-installed requests CA bundle
 with link"

This does not gracefully handle the situation where requests
is not there at the beginning. Needs to be rethought.

This reverts commit 7d350720fe5d25fece68c5d1625a33a6cad431ef.

Change-Id: I101fac0dc6fdc97b7fb0b2955cffc6b4905152e5
---
 tools/fixup_stuff.sh | 21 ---------------------
 1 file changed, 21 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d3a3de2092..31258d13f7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -138,24 +138,3 @@ fi
 # and installing the latest version using pip.
 uninstall_package python-virtualenv
 pip_install -U virtualenv
-
-# If a non-system python-requests is installed then it will use the
-# built-in CA certificate store rather than the distro-specific
-# CA certificate store. Detect this and symlink to the correct
-# one. If the value for the CA is not rooted in /etc then we know
-# we need to change it.
-capath=$(python -c "from requests import certs; print certs.where()")
-
-if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
-    if [[ ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
-        if is_fedora; then
-            sudo rm -f $capath
-            sudo ln -s /etc/pki/tls/certs/ca-bundle.crt $capath
-        elif is_ubuntu; then
-            sudo rm -f $capath
-            sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
-        else
-            echo "Don't know how to set the CA bundle, expect the install to fail."
-        fi
-    fi
-fi

From cfbc7918c5e7720fcfba88d2c18d26dd9d0cf5cf Mon Sep 17 00:00:00 2001
From: Russell Bryant <rbryant@redhat.com>
Date: Tue, 9 Jun 2015 09:14:13 -0400
Subject: [PATCH 0664/3333] Simplify start_neutron_other_agents

This patch just simplifies the start function a bit by removing some
unnecessary is_service_enabled checks that just wrap run_process
calls.  run_process does this exact check internally so it's not
needed here.

Change-Id: Id12a23f77ea0342854337c7d65821dd4e574dec2
Signed-off-by: Russell Bryant <rbryant@redhat.com>
---
 lib/neutron-legacy | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 519200bbcb..87674b309a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -733,19 +733,13 @@ function start_neutron_other_agents {
     fi
 
     run_process q-meta "python $AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
+    run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
+    run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         # For XenServer, start an agent for the domU openvswitch
         run_process q-domua "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
     fi
-
-    if is_service_enabled q-lbaas; then
-        run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
-    fi
-
-    if is_service_enabled q-metering; then
-        run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
-    fi
 }
 
 # Start running processes, including screen

From 21afa42da6c3f0d7d73cc71718cfd7c9588fc43b Mon Sep 17 00:00:00 2001
From: Louis Taylor <louis@kragniz.eu>
Date: Wed, 10 Jun 2015 12:55:10 +0000
Subject: [PATCH 0665/3333] ceph: remove deprecated glance_store options

glance_store has now been fully migrated, so we can stop setting these
options in the config files.

Change-Id: I3c6c2eea0171227b1ed362e74bcc5b10770721be
---
 lib/ceph | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index 4d6ca4aa68..25afb6c10c 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -264,10 +264,6 @@ function configure_ceph_glance {
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
 
-    # NOTE(eharney): When Glance has fully migrated to Glance store,
-    # default_store can be removed from [DEFAULT].  (See lib/glance.)
-    iniset $GLANCE_API_CONF DEFAULT default_store rbd
-    iniset $GLANCE_API_CONF DEFAULT show_image_direct_url True
     iniset $GLANCE_API_CONF glance_store default_store rbd
     iniset $GLANCE_API_CONF glance_store stores "file, http, rbd"
     iniset $GLANCE_API_CONF glance_store rbd_store_ceph_conf $CEPH_CONF_FILE

From 96c6b2deb33e67c1657e37fdcc8c6ec904674ed6 Mon Sep 17 00:00:00 2001
From: Joshua Harlow <harlowja@yahoo-inc.com>
Date: Mon, 8 Jun 2015 16:48:49 -0700
Subject: [PATCH 0666/3333] Add automaton to lib/oslo and stackrc

Part of blueprint adopt-automaton

Change-Id: I520643b74aced431f7a46b7d7b94616bb2e6bf8e
---
 lib/oslo                     | 1 +
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index d9688a01cd..b195687bb7 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -22,6 +22,7 @@ set +o xtrace
 
 # Defaults
 # --------
+GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
diff --git a/stackrc b/stackrc
index f8add4b44d..b010a88d52 100644
--- a/stackrc
+++ b/stackrc
@@ -330,6 +330,10 @@ GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
 GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-master}
 
+# helpful state machines
+GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
+GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-master}
+
 # oslo.concurrency
 GITREPO["oslo.concurrency"]=${OSLOCON_REPO:-${GIT_BASE}/openstack/oslo.concurrency.git}
 GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 336a213bc5..83b7e10b81 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -39,7 +39,7 @@ ALL_LIBS+=" oslo.serialization python-saharaclient django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
-ALL_LIBS+=" debtcollector os-brick"
+ALL_LIBS+=" debtcollector os-brick automaton"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From e3a640d57327955aba491366d6e69349813897a8 Mon Sep 17 00:00:00 2001
From: Joshua Harlow <harlowja@yahoo-inc.com>
Date: Mon, 8 Jun 2015 16:44:21 -0700
Subject: [PATCH 0667/3333] Add futurist to lib/oslo and stackrc

Part of blueprint adopt-futurist

Change-Id: I17e27a085c7c509bad6018016e90d0114543b073
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index b195687bb7..be26668dfb 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -25,6 +25,7 @@ set +o xtrace
 GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
+GITDIR["futurist"]=$DEST/futurist
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.context"]=$DEST/oslo.context
@@ -63,6 +64,7 @@ function _do_install_oslo_lib {
 function install_oslo {
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
+    _do_install_oslo_lib "futurist"
     _do_install_oslo_lib "oslo.concurrency"
     _do_install_oslo_lib "oslo.config"
     _do_install_oslo_lib "oslo.context"
diff --git a/stackrc b/stackrc
index b010a88d52..c16a9997a4 100644
--- a/stackrc
+++ b/stackrc
@@ -326,6 +326,10 @@ GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 GITREPO["cliff"]=${CLIFF_REPO:-${GIT_BASE}/openstack/cliff.git}
 GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
 
+# async framework/helpers
+GITREPO["futurist"]=${FUTURIST_REPO:-${GIT_BASE}/openstack/futurist.git}
+GITBRANCH["futurist"]=${FUTURIST_BRANCH:-master}
+
 # debtcollector deprecation framework/helpers
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
 GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 83b7e10b81..2f0b1febe4 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -39,7 +39,7 @@ ALL_LIBS+=" oslo.serialization python-saharaclient django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
-ALL_LIBS+=" debtcollector os-brick automaton"
+ALL_LIBS+=" debtcollector os-brick automaton futurist"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 03786b1cca196473d90c8ce0dc1c98a1b3081ac5 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 10 Jun 2015 11:31:51 -0700
Subject: [PATCH 0668/3333] Create and initialize the nova api_db

Going forward, nova will have another database at the API level (similar to how
current cells has an api-level cell, with its own database). This patch creates
and initializes it so that we can start testing the migrations with grenade.

Change-Id: I0dfae32102aeda9c5d17e134527b6a18f4b88014
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 11fa2a0ba4..a9f335115d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,6 +53,7 @@ NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
+NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 # NOVA_API_VERSION valid options
@@ -471,6 +472,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
     iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
     iniset $NOVA_CONF database connection `database_connection_url nova`
+    iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF osapi_v3 enabled "True"
 
@@ -675,6 +677,9 @@ function init_nova {
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
+
+        recreate_database $NOVA_API_DB
+        $NOVA_BIN_DIR/nova-manage api_db sync
     fi
 
     create_nova_cache_dir

From d1d6667c6b201d8c01f6b1d89660ceb4176de070 Mon Sep 17 00:00:00 2001
From: David Kranz <dkranz@redhat.com>
Date: Thu, 11 Jun 2015 13:09:37 -0400
Subject: [PATCH 0669/3333] Enable the volume bootable feature flag that was
 added in kilo

Change-Id: I5f8e0154a8b654b4c65b95f8b5c03e1a9be9e137
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index c4ae05f534..0c451d3b55 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -451,6 +451,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
 
     # Volume
+    # TODO(dkranz): Remove the bootable flag when Juno is end of life.
+    iniset $TEMPEST_CONFIG volume-feature-enabled bootable True
+
     local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint

From 0f63eb3a37c547b4aa9027fb83cc444d60157adf Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Fri, 12 Jun 2015 09:05:12 +0200
Subject: [PATCH 0670/3333] Install PyMySQL if used

Change Ic609ce136061b753ca692b37509a0b29c60bb8b5 switched to PyMySQL by
default but does not make sure it is installed. This is causing gate
failure in Gnocchi for example:

  http://logs.openstack.org/25/186025/3/check/gate-gnocchi-dsvm-functional-file-mysql/eebd773/logs/devstacklog.txt.gz

Change-Id: I23d313220607fcc8acb95ab43f55b7d9899b9b1f
---
 lib/databases/mysql | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 832c2ca6d7..f097fb21cb 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -165,6 +165,8 @@ function install_database_python_mysql {
     pip_install_gr $MYSQL_DRIVER
     if [[ "$MYSQL_DRIVER" == "MySQL-python" ]]; then
         ADDITIONAL_VENV_PACKAGES+=",MySQL-python"
+    elif [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then
+        ADDITIONAL_VENV_PACKAGES+=",PyMySQL"
     fi
 }
 

From de8d29ed8ce4a26b61cbee48f9fe5418d5416a06 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 12 Jun 2015 10:43:28 +0000
Subject: [PATCH 0671/3333] Revert "change the default to PyMYSQL"

The failure rate with neutron is too high to keep this
as the default.

Related-Bug: #1464612

This reverts commit b3798af474955368211a297ba85332fde5491993.

Change-Id: Ie9550aeb25d472a38e3d3ef6f3711622c9221c46
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 832c2ca6d7..7cd2856ae9 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -11,7 +11,7 @@
 MY_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
+MYSQL_DRIVER=${MYSQL_DRIVER:-MySQL-python}
 # Force over to pymysql driver by default if we are using it.
 if is_service_enabled mysql; then
     if [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then

From 987f83da5adcf5f8dd2b78a526613cc23a9cdfdd Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 1 Jun 2015 12:43:30 +0200
Subject: [PATCH 0672/3333] SUSE: Add dependencies for L3 agent

Change-Id: If3f4f5ab9a3072273d2f440718ce0c75fd71fdf1
---
 files/rpms-suse/q-l3 | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 files/rpms-suse/q-l3

diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
new file mode 100644
index 0000000000..a7a190c063
--- /dev/null
+++ b/files/rpms-suse/q-l3
@@ -0,0 +1,2 @@
+conntrack-tools
+keepalived

From b3d8822ec835f1ca7eb5d9742b28f2ece480b387 Mon Sep 17 00:00:00 2001
From: armando-migliaccio <armamig@gmail.com>
Date: Fri, 12 Jun 2015 07:54:03 -0700
Subject: [PATCH 0673/3333] Revert "Revert "change the default to PyMYSQL""

Some projects (Neutron) seem to be affected more than others, so we should revert this
to allow for a more selective choice of the DB driver on a per project basis.

We can re-enable the use MySQL-python just for Neutron.

This reverts commit de8d29ed8ce4a26b61cbee48f9fe5418d5416a06.

Related-Bug: #1464612

Change-Id: I889f4f8b116c413b300ab9eecc7b428a9a4afb1a
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7cd2856ae9..832c2ca6d7 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -11,7 +11,7 @@
 MY_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-MYSQL_DRIVER=${MYSQL_DRIVER:-MySQL-python}
+MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 # Force over to pymysql driver by default if we are using it.
 if is_service_enabled mysql; then
     if [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then

From e155b894c8975f649cbbbc08675095fe728d0b69 Mon Sep 17 00:00:00 2001
From: armando-migliaccio <armamig@gmail.com>
Date: Fri, 12 Jun 2015 08:55:02 -0700
Subject: [PATCH 0674/3333] Set Neutron api_workers to $API_WORKERS

Change [1] brings back this feature in Neutron, so we want to have
the ability to set the number of API workers the same way other
projects do.

However, this cause some instability, so we need to be careful on
how we bring it back.

[1] https://review.openstack.org/#/c/191127/

Closes-Bug: #1432189
Related-bug: #1432065

Change-Id: Id4986a49d33fa4b8a7291150488665e200525dac
Co-authored-by: Russell Bryant <rbryant@redhat.com>
---
 lib/neutron-legacy | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index dd67f45a39..3ac76a2586 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -463,6 +463,8 @@ function configure_neutron {
     fi
 
     _configure_neutron_debug_command
+
+    iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
 }
 
 function create_nova_conf_neutron {

From 13f655720d77149d908fcae7d0b7c6d377c972d5 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Wed, 10 Jun 2015 14:34:22 -0400
Subject: [PATCH 0675/3333] Small fixes for running Nova services under Apache2

Following fixed were done:
1. Cleanup fixed.
2. API_WORKERS config option was added to nova config templates.
3. Nova API screen tabs were named as nova-api and nova-ec2-api.

Change-Id: I68dc6fd6c8aeffcec7f9039afd63bd1599c65682
---
 files/apache-nova-api.template     |  4 ++--
 files/apache-nova-ec2-api.template |  4 ++--
 lib/nova                           | 10 ++++++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index 70ccedddc8..301a3bdbdd 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -1,7 +1,7 @@
 Listen %PUBLICPORT%
 
 <VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess nova-api processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIDaemonProcess nova-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup nova-api
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
@@ -13,4 +13,4 @@ Listen %PUBLICPORT%
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
-</VirtualHost>
\ No newline at end of file
+</VirtualHost>
diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
index ae4cf94a38..235d958d1a 100644
--- a/files/apache-nova-ec2-api.template
+++ b/files/apache-nova-ec2-api.template
@@ -1,7 +1,7 @@
 Listen %PUBLICPORT%
 
 <VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess nova-ec2-api processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIDaemonProcess nova-ec2-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup nova-ec2-api
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
@@ -13,4 +13,4 @@ Listen %PUBLICPORT%
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
-</VirtualHost>
\ No newline at end of file
+</VirtualHost>
diff --git a/lib/nova b/lib/nova
index a9f335115d..88b336a1be 100644
--- a/lib/nova
+++ b/lib/nova
@@ -232,6 +232,10 @@ function cleanup_nova {
     #if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
     #    cleanup_nova_hypervisor
     #fi
+
+    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
+        _cleanup_nova_apache_wsgi
+    fi
 }
 
 # _cleanup_nova_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
@@ -277,6 +281,7 @@ function _config_nova_apache_wsgi {
         s|%SSLKEYFILE%|$nova_keyfile|g;
         s|%USER%|$STACK_USER|g;
         s|%VIRTUALENV%|$venv_path|g
+        s|%APIWORKERS%|$API_WORKERS|g
     " -i $nova_apache_conf
 
     sudo cp $FILES/apache-nova-ec2-api.template $nova_ec2_apache_conf
@@ -289,6 +294,7 @@ function _config_nova_apache_wsgi {
         s|%SSLKEYFILE%|$nova_keyfile|g;
         s|%USER%|$STACK_USER|g;
         s|%VIRTUALENV%|$venv_path|g
+        s|%APIWORKERS%|$API_WORKERS|g
     " -i $nova_ec2_apache_conf
 }
 
@@ -761,8 +767,8 @@ function start_nova_api {
         enable_apache_site nova-api
         enable_apache_site nova-ec2-api
         restart_apache_server
-        tail_log nova /var/log/$APACHE_NAME/nova-api.log
-        tail_log nova /var/log/$APACHE_NAME/nova-ec2-api.log
+        tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
+        tail_log nova-ec2-api /var/log/$APACHE_NAME/nova-ec2-api.log
     else
         run_process n-api "$NOVA_BIN_DIR/nova-api"
     fi

From 6bc089fce03e1b29405224eeed4761f08339255a Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 1 Jun 2015 12:39:12 +0200
Subject: [PATCH 0676/3333] Cinder: On SUSE, avoid restarting tgt

There is a known bug that restart tgtd fails, so go the
workaround way and stopping/starting it instead.

In addition, remove the else case since unstack also
uses cleanup_cinder, which already unconditionally supports
all distros.

Change-Id: Ib70917a95f001ef36a51815f08416fa30084aad6
---
 lib/cinder | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index b8cf8090dc..ade3b82c3a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -432,12 +432,13 @@ function start_cinder {
             _configure_tgt_for_config_d
             if is_ubuntu; then
                 sudo service tgt restart
-            elif is_fedora || is_suse; then
-                restart_service tgtd
+            elif is_suse; then
+                # NOTE(dmllr): workaround restart bug
+                # https://bugzilla.suse.com/show_bug.cgi?id=934642
+                stop_service tgtd
+                start_service tgtd
             else
-                # note for other distros: unstack.sh also uses the tgt/tgtd service
-                # name, and would need to be adjusted too
-                exit_distro_not_supported "restarting tgt"
+                restart_service tgtd
             fi
             # NOTE(gfidente): ensure tgtd is running in debug mode
             sudo tgtadm --mode system --op update --name debug --value on

From b632c9ef81090e210fee27346c6e1f2b4f3bedec Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 28 May 2015 23:36:15 +0000
Subject: [PATCH 0677/3333] Use keystone v3 API for projects

Always use the keystone v3 API for project creation. Make domain a
required argument. Whilst we could simply default this value within the
function I think it's better to make this explicit as these are things
deployers and services need to consider.

In future we will want to figure out how we want devstack to organize domains
however I don't believe that it belongs in this patch.

Change-Id: Ib9587193c5c8419dc4b5a608246709baaddd2a52
Implements: bp keystonev3
---
 functions-common | 15 ++++++---------
 lib/ironic       |  2 +-
 lib/keystone     |  8 ++++----
 lib/swift        |  4 ++--
 lib/tempest      |  2 +-
 5 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/functions-common b/functions-common
index 3a2f5f7f41..33245fbc3d 100644
--- a/functions-common
+++ b/functions-common
@@ -720,18 +720,15 @@ function get_or_create_user {
 }
 
 # Gets or creates project
-# Usage: get_or_create_project <name> [<domain>]
+# Usage: get_or_create_project <name> <domain>
 function get_or_create_project {
-    # Gets project id
-    local os_cmd="openstack"
-    local domain=""
-    if [[ ! -z "$2" ]]; then
-        domain="--domain=$2"
-        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI_V3 --os-identity-api-version=3"
-    fi
     local project_id=$(
         # Creates new project with --or-show
-        $os_cmd project create $1 $domain --or-show -f value -c id
+        openstack --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            project create $1 \
+            --domain=$2 \
+            --or-show -f value -c id
     )
     echo $project_id
 }
diff --git a/lib/ironic b/lib/ironic
index 4984be1861..40a3460f1f 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -366,7 +366,7 @@ function configure_ironic_conductor {
         fi
         iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:${SWIFT_DEFAULT_BIND_PORT:-8080}
         iniset $IRONIC_CONF_FILE glance swift_api_version v1
-        local tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME)
+        local tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME default)
         iniset $IRONIC_CONF_FILE glance swift_account AUTH_${tenant_id}
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
diff --git a/lib/keystone b/lib/keystone
index 7a949cf96f..90ff31a54c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -357,13 +357,13 @@ function configure_keystone_extensions {
 function create_keystone_accounts {
 
     # admin
-    local admin_tenant=$(get_or_create_project "admin")
+    local admin_tenant=$(get_or_create_project "admin" default)
     local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD")
     local admin_role=$(get_or_create_role "admin")
     get_or_add_user_project_role $admin_role $admin_user $admin_tenant
 
     # Create service project/role
-    get_or_create_project "$SERVICE_TENANT_NAME"
+    get_or_create_project "$SERVICE_TENANT_NAME" default
 
     # Service role, so service users do not have to be admins
     get_or_create_role service
@@ -382,10 +382,10 @@ function create_keystone_accounts {
     local another_role=$(get_or_create_role "anotherrole")
 
     # invisible tenant - admin can't see this one
-    local invis_tenant=$(get_or_create_project "invisible_to_admin")
+    local invis_tenant=$(get_or_create_project "invisible_to_admin" default)
 
     # demo
-    local demo_tenant=$(get_or_create_project "demo")
+    local demo_tenant=$(get_or_create_project "demo" default)
     local demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "demo@example.com")
 
diff --git a/lib/swift b/lib/swift
index 820042d972..420350b95e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -616,7 +616,7 @@ function create_swift_accounts {
             "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s"
     fi
 
-    local swift_tenant_test1=$(get_or_create_project swifttenanttest1)
+    local swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
     die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
     SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
@@ -626,7 +626,7 @@ function create_swift_accounts {
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
     get_or_add_user_project_role $another_role $swift_user_test3 $swift_tenant_test1
 
-    local swift_tenant_test2=$(get_or_create_project swifttenanttest2)
+    local swift_tenant_test2=$(get_or_create_project swifttenanttest2 default)
     die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
 
     local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password "test2@example.com")
diff --git a/lib/tempest b/lib/tempest
index c4ae05f534..4e7133a0db 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -546,7 +546,7 @@ function create_tempest_accounts {
     if is_service_enabled tempest; then
         # Tempest has some tests that validate various authorization checks
         # between two regular users in separate tenants
-        get_or_create_project alt_demo
+        get_or_create_project alt_demo default
         get_or_create_user alt_demo "$ADMIN_PASSWORD" "alt_demo@example.com"
         get_or_add_user_project_role Member alt_demo alt_demo
     fi

From 9d7e776b704d0fa54b2bf6543d054ab0118f5806 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 29 May 2015 01:08:53 +0000
Subject: [PATCH 0678/3333] Use Keystone v3 API for user creation

This includes requiring a domain when creating a user. This will allow us to
control where users are created in a later patch.

Adding the token to the user creation call is required because of a bad
interaction between OpenStackClient, os-client-config and keystoneclient
when dealing with v2 authentication but v3 API calls. It will be cleaned
up when we switch to v3 credentials.

Change-Id: I6ef50fd384d423bc0f13ee1016a8bdbb0650ecd9
Implements: bp keystonev3
---
 functions-common | 23 +++++++++--------------
 lib/glance       |  2 +-
 lib/keystone     |  6 +++---
 lib/swift        | 12 ++++++++----
 lib/tempest      |  2 +-
 stack.sh         |  3 +++
 6 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/functions-common b/functions-common
index 33245fbc3d..48c0c75637 100644
--- a/functions-common
+++ b/functions-common
@@ -675,9 +675,8 @@ function get_or_create_domain {
 }
 
 # Gets or creates group
-# Usage: get_or_create_group <groupname> [<domain> <description>]
+# Usage: get_or_create_group <groupname> <domain> [<description>]
 function get_or_create_group {
-    local domain=${2:+--domain ${2}}
     local desc="${3:-}"
     local os_url="$KEYSTONE_SERVICE_URI_V3"
     # Gets group id
@@ -685,34 +684,30 @@ function get_or_create_group {
         # Creates new group with --or-show
         openstack --os-token=$OS_TOKEN --os-url=$os_url \
             --os-identity-api-version=3 group create $1 \
-            $domain --description "$desc" --or-show \
+            --domain $2 --description "$desc" --or-show \
             -f value -c id
     )
     echo $group_id
 }
 
 # Gets or creates user
-# Usage: get_or_create_user <username> <password> [<email> [<domain>]]
+# Usage: get_or_create_user <username> <password> <domain> [<email>]
 function get_or_create_user {
-    if [[ ! -z "$3" ]]; then
-        local email="--email=$3"
+    if [[ ! -z "$4" ]]; then
+        local email="--email=$4"
     else
         local email=""
     fi
-    local os_cmd="openstack"
-    local domain=""
-    if [[ ! -z "$4" ]]; then
-        domain="--domain=$4"
-        os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI_V3 --os-identity-api-version=3"
-    fi
     # Gets user id
     local user_id=$(
         # Creates new user with --or-show
-        $os_cmd user create \
+        openstack user create \
             $1 \
             --password "$2" \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            --domain=$3 \
             $email \
-            $domain \
             --or-show \
             -f value -c id
     )
diff --git a/lib/glance b/lib/glance
index 016ade3479..2fae002049 100644
--- a/lib/glance
+++ b/lib/glance
@@ -254,7 +254,7 @@ function create_glance_accounts {
         if is_service_enabled s-proxy; then
 
             local glance_swift_user=$(get_or_create_user "glance-swift" \
-                "$SERVICE_PASSWORD" "glance-swift@example.com")
+                "$SERVICE_PASSWORD" "default" "glance-swift@example.com")
             get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
         fi
 
diff --git a/lib/keystone b/lib/keystone
index 90ff31a54c..c33d466c6c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -358,7 +358,7 @@ function create_keystone_accounts {
 
     # admin
     local admin_tenant=$(get_or_create_project "admin" default)
-    local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD")
+    local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
     local admin_role=$(get_or_create_role "admin")
     get_or_add_user_project_role $admin_role $admin_user $admin_tenant
 
@@ -387,7 +387,7 @@ function create_keystone_accounts {
     # demo
     local demo_tenant=$(get_or_create_project "demo" default)
     local demo_user=$(get_or_create_user "demo" \
-        "$ADMIN_PASSWORD" "demo@example.com")
+        "$ADMIN_PASSWORD" "default" "demo@example.com")
 
     get_or_add_user_project_role $member_role $demo_user $demo_tenant
     get_or_add_user_project_role $admin_role $admin_user $demo_tenant
@@ -426,7 +426,7 @@ function create_keystone_accounts {
 function create_service_user {
     local role=${2:-service}
 
-    local user=$(get_or_create_user "$1" "$SERVICE_PASSWORD")
+    local user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
     get_or_add_user_project_role "$role" "$user" "$SERVICE_TENANT_NAME"
 }
 
diff --git a/lib/swift b/lib/swift
index 420350b95e..0cd51aaddf 100644
--- a/lib/swift
+++ b/lib/swift
@@ -618,18 +618,21 @@ function create_swift_accounts {
 
     local swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
     die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
-    SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password "test@example.com")
+    SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password \
+                        "default" "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
     get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
 
-    local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password "test3@example.com")
+    local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password \
+                                "default" "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
     get_or_add_user_project_role $another_role $swift_user_test3 $swift_tenant_test1
 
     local swift_tenant_test2=$(get_or_create_project swifttenanttest2 default)
     die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
 
-    local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password "test2@example.com")
+    local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password \
+                                "default" "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
     get_or_add_user_project_role admin $swift_user_test2 $swift_tenant_test2
 
@@ -639,7 +642,8 @@ function create_swift_accounts {
     local swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
     die_if_not_set $LINENO swift_tenant_test4 "Failure creating swift_tenant_test4"
 
-    local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password "test4@example.com" $swift_domain)
+    local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
+                                $swift_domain "test4@example.com")
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
     get_or_add_user_project_role admin $swift_user_test4 $swift_tenant_test4
 }
diff --git a/lib/tempest b/lib/tempest
index 4e7133a0db..f3703a072a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -547,7 +547,7 @@ function create_tempest_accounts {
         # Tempest has some tests that validate various authorization checks
         # between two regular users in separate tenants
         get_or_create_project alt_demo default
-        get_or_create_user alt_demo "$ADMIN_PASSWORD" "alt_demo@example.com"
+        get_or_create_user alt_demo "$ADMIN_PASSWORD" "default" "alt_demo@example.com"
         get_or_add_user_project_role Member alt_demo alt_demo
     fi
 }
diff --git a/stack.sh b/stack.sh
index dc79fa94f7..489fbe446c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1006,6 +1006,9 @@ if is_service_enabled keystone; then
     # Begone token auth
     unset OS_TOKEN OS_URL
 
+    # force set to use v2 identity authentication even with v3 commands
+    export OS_AUTH_TYPE=v2password
+
     # Set up password auth credentials now that Keystone is bootstrapped
     export OS_AUTH_URL=$SERVICE_ENDPOINT
     export OS_TENANT_NAME=admin

From 37eca48970106abb9b982af4f1262bcb227411ea Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 16 Jun 2015 07:19:22 -0400
Subject: [PATCH 0679/3333] remove non RabbitMQ messaging

Part of what was decided at summit is devstack needs to return to a
more opinionated stance, the following removes support for non
RabbitMQ messaging. RabbitMQ is used by over 95% of our community
(statistically all of it), so it's a pretty clear line to draw that
this shouldn't be in tree.

iniset_rpc_backend will be our stable hook for other projects that
want to implement this out of tree. The burden on creating those out
of tree plugins will be on those that wish to support those
alternative stacks.

Change-Id: I8073a895c03ec927a2598eff6c2f01e5c82606fc
---
 README.md               |  16 ---
 doc/source/faq.rst      |   2 +-
 files/debs/neutron      |   2 -
 files/debs/nova         |   2 -
 files/debs/qpid         |   1 -
 files/rpms-suse/neutron |   3 -
 files/rpms-suse/nova    |   4 -
 files/rpms/neutron      |   1 -
 files/rpms/nova         |   1 -
 files/rpms/qpid         |   3 -
 functions-common        |   2 +-
 lib/glance              |   8 +-
 lib/rpc_backend         | 271 ++--------------------------------------
 lib/zaqar               |   7 +-
 stack.sh                |  13 --
 15 files changed, 16 insertions(+), 320 deletions(-)
 delete mode 100644 files/debs/qpid
 delete mode 100644 files/rpms/qpid

diff --git a/README.md b/README.md
index 455e1c69c6..ebcb0184e5 100644
--- a/README.md
+++ b/README.md
@@ -115,22 +115,6 @@ following in the `localrc` section:
 
 `mysql` is the default database.
 
-# RPC Backend
-
-Multiple RPC backends are available. Currently, this
-includes RabbitMQ (default), Qpid, and ZeroMQ. Your backend of
-choice may be selected via the `localrc` section.
-
-Note that selecting more than one RPC backend will result in a failure.
-
-Example (ZeroMQ):
-
-    ENABLED_SERVICES="$ENABLED_SERVICES,-rabbit,-qpid,zeromq"
-
-Example (Qpid):
-
-    ENABLED_SERVICES="$ENABLED_SERVICES,-rabbit,-zeromq,qpid"
-
 # Apache Frontend
 
 Apache web server can be enabled for wsgi services that support being deployed
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 0437ec26d5..be81f5d863 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -88,7 +88,7 @@ Q: Is enabling a service that defaults to off done with the reverse of the above
 
     ::
 
-        enable_service qpid
+        enable_service q-svc
 
 Q: How do I run a specific OpenStack milestone?
    A: OpenStack milestones have tags set in the git repo. Set the
diff --git a/files/debs/neutron b/files/debs/neutron
index 2d69a71c3a..b5a457e482 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -9,11 +9,9 @@ sudo
 postgresql-server-dev-all
 python-mysqldb
 python-mysql.connector
-python-qpid # NOPRIME
 dnsmasq-base
 dnsmasq-utils # for dhcp_release only available in dist:precise
 rabbitmq-server # NOPRIME
-qpidd # NOPRIME
 sqlite3
 vlan
 radvd # NOPRIME
diff --git a/files/debs/nova b/files/debs/nova
index 9d9acde3e9..346b8b337a 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -24,10 +24,8 @@ vlan
 curl
 genisoimage # required for config_drive
 rabbitmq-server # NOPRIME
-qpidd # NOPRIME
 socat # used by ajaxterm
 python-libvirt # NOPRIME
 python-libxml2
 python-numpy # used by websockify for spice console
 python-m2crypto
-python-qpid # NOPRIME
diff --git a/files/debs/qpid b/files/debs/qpid
deleted file mode 100644
index e3bbf0961c..0000000000
--- a/files/debs/qpid
+++ /dev/null
@@ -1 +0,0 @@
-sasl2-bin # NOPRIME
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index e75db89ddf..133979911e 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -11,6 +11,3 @@ sqlite3
 sudo
 vlan
 radvd # NOPRIME
-
-# FIXME: qpid is not part of openSUSE, those names are tentative
-qpidd # NOPRIME
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 6f8aef1027..039456fc1b 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -22,7 +22,3 @@ socat
 sqlite3
 sudo
 vlan
-
-# FIXME: qpid is not part of openSUSE, those names are tentative
-python-qpid # NOPRIME
-qpidd # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 8292e7bffe..29851bea9b 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -11,7 +11,6 @@ mysql-server # NOPRIME
 openvswitch # NOPRIME
 postgresql-devel
 rabbitmq-server # NOPRIME
-qpid-cpp-server        # NOPRIME
 sqlite
 sudo
 radvd # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index ebd667454a..6a20940bd4 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -22,6 +22,5 @@ mysql-server # NOPRIME
 parted
 polkit
 rabbitmq-server # NOPRIME
-qpid-cpp-server # NOPRIME
 sqlite
 sudo
diff --git a/files/rpms/qpid b/files/rpms/qpid
deleted file mode 100644
index 41dd2f69f9..0000000000
--- a/files/rpms/qpid
+++ /dev/null
@@ -1,3 +0,0 @@
-qpid-proton-c-devel # NOPRIME
-cyrus-sasl-lib # NOPRIME
-cyrus-sasl-plain # NOPRIME
diff --git a/functions-common b/functions-common
index 3a2f5f7f41..8f1031139d 100644
--- a/functions-common
+++ b/functions-common
@@ -1671,7 +1671,7 @@ function disable_service {
 # ``ENABLED_SERVICES`` list, if they are not already present.
 #
 # For example:
-#   enable_service qpid
+#   enable_service q-svc
 #
 # This function does not know about the special cases
 # for nova, glance, and neutron built into is_service_enabled().
diff --git a/lib/glance b/lib/glance
index 016ade3479..9db25aef06 100644
--- a/lib/glance
+++ b/lib/glance
@@ -112,9 +112,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
-    if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
-        iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
-    fi
+    iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
 
     cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
@@ -125,9 +123,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
-    if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
-        iniset $GLANCE_API_CONF DEFAULT notification_driver messaging
-    fi
+    iniset $GLANCE_API_CONF DEFAULT notification_driver messaging
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 33ab03d664..03eacd8674 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -1,72 +1,32 @@
 #!/bin/bash
 #
 # lib/rpc_backend
-# Interface for interactig with different RPC backends
+# Interface for installing RabbitMQ on the system
 
 # Dependencies:
 #
 # - ``functions`` file
 # - ``RABBIT_{HOST|PASSWORD|USERID}`` must be defined when RabbitMQ is used
-# - ``RPC_MESSAGING_PROTOCOL`` option for configuring the messaging protocol
 
 # ``stack.sh`` calls the entry points in this order:
 #
 # - check_rpc_backend
 # - install_rpc_backend
 # - restart_rpc_backend
-# - iniset_rpc_backend
+# - iniset_rpc_backend (stable interface)
+#
+# Note: if implementing an out of tree plugin for an RPC backend, you
+# should install all services through normal plugin methods, then
+# redefine ``iniset_rpc_backend`` in your code. That's the one portion
+# of this file which is a standard interface.
 
 # Save trace setting
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
-RPC_MESSAGING_PROTOCOL=${RPC_MESSAGING_PROTOCOL:-0.9}
-
-# TODO(sdague): RPC backend selection is super wonky because we treat
-# messaging server as a service, which it really isn't for multi host
-QPID_HOST=${QPID_HOST:-}
-
-
 # Functions
 # ---------
 
-# Make sure we only have one rpc backend enabled.
-# Also check the specified rpc backend is available on your platform.
-function check_rpc_backend {
-    local c svc
-
-    local rpc_needed=1
-    # We rely on the fact that filenames in lib/* match the service names
-    # that can be passed as arguments to is_service_enabled.
-    # We check for a call to iniset_rpc_backend in these files, meaning
-    # the service needs a backend.
-    rpc_candidates=$(grep -rl iniset_rpc_backend $TOP_DIR/lib/ | awk -F/ '{print $NF}')
-    for c in ${rpc_candidates}; do
-        if is_service_enabled $c; then
-            rpc_needed=0
-            break
-        fi
-    done
-    local rpc_backend_cnt=0
-    for svc in qpid zeromq rabbit; do
-        is_service_enabled $svc &&
-        (( rpc_backend_cnt++ )) || true
-    done
-    if [ "$rpc_backend_cnt" -gt 1 ]; then
-        echo "ERROR: only one rpc backend may be enabled,"
-        echo "       set only one of 'rabbit', 'qpid', 'zeromq'"
-        echo "       via ENABLED_SERVICES."
-    elif [ "$rpc_backend_cnt" == 0 ] && [ "$rpc_needed" == 0 ]; then
-        echo "ERROR: at least one rpc backend must be enabled,"
-        echo "       set one of 'rabbit', 'qpid', 'zeromq'"
-        echo "       via ENABLED_SERVICES."
-    fi
-
-    if is_service_enabled qpid && ! qpid_is_supported; then
-        die $LINENO "Qpid support is not available for this version of your distribution."
-    fi
-}
-
 # clean up after rpc backend - eradicate all traces so changing backends
 # produces a clean switch
 function cleanup_rpc_backend {
@@ -79,110 +39,14 @@ function cleanup_rpc_backend {
             # And the Erlang runtime too
             apt_get purge -y erlang*
         fi
-    elif is_service_enabled qpid; then
-        if is_fedora; then
-            uninstall_package qpid-cpp-server
-        elif is_ubuntu; then
-            uninstall_package qpidd
-        else
-            exit_distro_not_supported "qpid installation"
-        fi
-    elif is_service_enabled zeromq; then
-        if is_fedora; then
-            uninstall_package zeromq python-zmq
-            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-                uninstall_package redis python-redis
-            fi
-        elif is_ubuntu; then
-            uninstall_package libzmq1 python-zmq
-            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-                uninstall_package redis-server python-redis
-            fi
-        elif is_suse; then
-            uninstall_package libzmq1 python-pyzmq
-            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-                uninstall_package redis python-redis
-            fi
-        else
-            exit_distro_not_supported "zeromq installation"
-        fi
-    fi
-
-    # Remove the AMQP 1.0 messaging libraries
-    if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
-        if is_fedora; then
-            uninstall_package qpid-proton-c-devel
-            uninstall_package python-qpid-proton
-        fi
-        # TODO(kgiusti) ubuntu cleanup
     fi
 }
 
 # install rpc backend
 function install_rpc_backend {
-    # Regardless of the broker used, if AMQP 1.0 is configured load
-    # the necessary messaging client libraries for oslo.messaging
-    if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
-        if is_fedora; then
-            install_package qpid-proton-c-devel
-            install_package python-qpid-proton
-        elif is_ubuntu; then
-            # TODO(kgiusti) The QPID AMQP 1.0 protocol libraries
-            # are not yet in the ubuntu repos. Enable these installs
-            # once they are present:
-            #install_package libqpid-proton2-dev
-            #install_package python-qpid-proton
-            # Also add 'uninstall' directives in cleanup_rpc_backend()!
-            exit_distro_not_supported "QPID AMQP 1.0 Proton libraries"
-        else
-            exit_distro_not_supported "QPID AMQP 1.0 Proton libraries"
-        fi
-        # Install pyngus client API
-        # TODO(kgiusti) can remove once python qpid bindings are
-        # available on all supported platforms _and_ pyngus is added
-        # to the requirements.txt file in oslo.messaging
-        pip_install_gr pyngus
-    fi
-
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-    elif is_service_enabled qpid; then
-        if is_fedora; then
-            install_package qpid-cpp-server
-        elif is_ubuntu; then
-            install_package qpidd
-        else
-            exit_distro_not_supported "qpid installation"
-        fi
-        _configure_qpid
-    elif is_service_enabled zeromq; then
-        if is_fedora; then
-            install_package zeromq python-zmq
-            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-                install_package redis python-redis
-            fi
-        elif is_ubuntu; then
-            install_package libzmq1 python-zmq
-            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-                install_package redis-server python-redis
-            fi
-        elif is_suse; then
-            install_package libzmq1 python-pyzmq
-            if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-                install_package redis python-redis
-            fi
-        else
-            exit_distro_not_supported "zeromq installation"
-        fi
-        # Necessary directory for socket location.
-        sudo mkdir -p /var/run/openstack
-        sudo chown $STACK_USER /var/run/openstack
-    fi
-
-    # If using the QPID broker, install the QPID python client API
-    if is_service_enabled qpid || [ -n "$QPID_HOST" ]; then
-        install_package python-qpid
     fi
 }
 
@@ -232,17 +96,12 @@ function restart_rpc_backend {
                 sudo rabbitmqctl set_permissions -p child_cell $RABBIT_USERID ".*" ".*" ".*"
             fi
         fi
-    elif is_service_enabled qpid; then
-        echo_summary "Starting qpid"
-        restart_service qpidd
     fi
 }
 
 # builds transport url string
 function get_transport_url {
-    if is_service_enabled qpid || [ -n "$QPID_HOST" ]; then
-        echo "qpid://$QPID_USERNAME:$QPID_PASSWORD@$QPID_HOST:5672/"
-    elif is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
+    if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
         echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/"
     fi
 }
@@ -252,29 +111,7 @@ function iniset_rpc_backend {
     local package=$1
     local file=$2
     local section=${3:-DEFAULT}
-    if is_service_enabled zeromq; then
-        iniset $file $section rpc_backend "zmq"
-        iniset $file $section rpc_zmq_host `hostname`
-        if [ "$ZEROMQ_MATCHMAKER" == "redis" ]; then
-            iniset $file $section rpc_zmq_matchmaker "redis"
-            MATCHMAKER_REDIS_HOST=${MATCHMAKER_REDIS_HOST:-127.0.0.1}
-            iniset $file matchmaker_redis host $MATCHMAKER_REDIS_HOST
-        else
-            die $LINENO "Other matchmaker drivers not supported"
-        fi
-    elif is_service_enabled qpid || [ -n "$QPID_HOST" ]; then
-        # For Qpid use the 'amqp' oslo.messaging transport when AMQP 1.0 is used
-        if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
-            iniset $file $section rpc_backend "amqp"
-        else
-            iniset $file $section rpc_backend "qpid"
-        fi
-        iniset $file $section qpid_hostname ${QPID_HOST:-$SERVICE_HOST}
-        if [ -n "$QPID_USERNAME" ]; then
-            iniset $file $section qpid_username $QPID_USERNAME
-            iniset $file $section qpid_password $QPID_PASSWORD
-        fi
-    elif is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
+    if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
         iniset $file $section rpc_backend "rabbit"
         iniset $file oslo_messaging_rabbit rabbit_hosts $RABBIT_HOST
         iniset $file oslo_messaging_rabbit rabbit_password $RABBIT_PASSWORD
@@ -288,17 +125,6 @@ function iniset_rpc_backend {
     fi
 }
 
-# Check if qpid can be used on the current distro.
-# qpid_is_supported
-function qpid_is_supported {
-    if [[ -z "$DISTRO" ]]; then
-        GetDistro
-    fi
-
-    # Qpid is not in openSUSE
-    ( ! is_suse )
-}
-
 function rabbit_setuser {
     local user="$1" pass="$2" found="" out=""
     out=$(sudo rabbitmqctl list_users) ||
@@ -314,85 +140,6 @@ function rabbit_setuser {
     sudo rabbitmqctl set_permissions "$user" ".*" ".*" ".*"
 }
 
-# Set up the various configuration files used by the qpidd broker
-function _configure_qpid {
-
-    # the location of the configuration files have changed since qpidd 0.14
-    local qpid_conf_file
-    if [ -e /etc/qpid/qpidd.conf ]; then
-        qpid_conf_file=/etc/qpid/qpidd.conf
-    elif [ -e /etc/qpidd.conf ]; then
-        qpid_conf_file=/etc/qpidd.conf
-    else
-        exit_distro_not_supported "qpidd.conf file not found!"
-    fi
-
-    # force the ACL file to a known location
-    local qpid_acl_file=/etc/qpid/qpidd.acl
-    if [ ! -e $qpid_acl_file ]; then
-        sudo mkdir -p -m 755 `dirname $qpid_acl_file`
-        sudo touch $qpid_acl_file
-        sudo chmod o+r $qpid_acl_file
-    fi
-    sudo sed -i.bak '/^acl-file=/d' $qpid_conf_file
-    echo "acl-file=$qpid_acl_file" | sudo tee --append $qpid_conf_file
-
-    sudo sed -i '/^auth=/d' $qpid_conf_file
-    if [ -z "$QPID_USERNAME" ]; then
-        # no QPID user configured, so disable authentication
-        # and access control
-        echo "auth=no" | sudo tee --append $qpid_conf_file
-        cat <<EOF | sudo tee $qpid_acl_file
-acl allow all all
-EOF
-    else
-        # Configure qpidd to use PLAIN authentication, and add
-        # QPID_USERNAME to the ACL:
-        echo "auth=yes" | sudo tee --append $qpid_conf_file
-        if [ -z "$QPID_PASSWORD" ]; then
-            read_password QPID_PASSWORD "ENTER A PASSWORD FOR QPID USER $QPID_USERNAME"
-        fi
-        # Create ACL to allow $QPID_USERNAME full access
-        cat <<EOF | sudo tee $qpid_acl_file
-group admin ${QPID_USERNAME}@QPID
-acl allow admin all
-acl deny all all
-EOF
-        # Add user to SASL database
-        if is_ubuntu; then
-            install_package sasl2-bin
-        elif is_fedora; then
-            install_package cyrus-sasl-lib
-            install_package cyrus-sasl-plain
-        fi
-        local sasl_conf_file=/etc/sasl2/qpidd.conf
-        sudo sed -i.bak '/PLAIN/!s/mech_list: /mech_list: PLAIN /' $sasl_conf_file
-        local sasl_db=`sudo grep sasldb_path $sasl_conf_file | cut -f 2 -d ":" | tr -d [:blank:]`
-        if [ ! -e $sasl_db ]; then
-            sudo mkdir -p -m 755 `dirname $sasl_db`
-        fi
-        echo $QPID_PASSWORD | sudo saslpasswd2 -c -p -f $sasl_db -u QPID $QPID_USERNAME
-        sudo chmod o+r $sasl_db
-    fi
-
-    # If AMQP 1.0 is specified, ensure that the version of the
-    # broker can support AMQP 1.0 and configure the queue and
-    # topic address patterns used by oslo.messaging.
-    if [ "$RPC_MESSAGING_PROTOCOL" == "AMQP1" ]; then
-        QPIDD=$(type -p qpidd)
-        if ! $QPIDD --help | grep -q "queue-patterns"; then
-            exit_distro_not_supported "qpidd with AMQP 1.0 support"
-        fi
-        if ! grep -q "queue-patterns=exclusive" $qpid_conf_file; then
-            cat <<EOF | sudo tee --append $qpid_conf_file
-queue-patterns=exclusive
-queue-patterns=unicast
-topic-patterns=broadcast
-EOF
-        fi
-    fi
-}
-
 # Restore xtrace
 $XTRACE
 
diff --git a/lib/zaqar b/lib/zaqar
index 8d51910896..891b0eab04 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -128,10 +128,9 @@ function configure_zaqar {
         configure_redis
     fi
 
-    if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
-        iniset $ZAQAR_CONF DEFAULT notification_driver messaging
-        iniset $ZAQAR_CONF DEFAULT control_exchange zaqar
-    fi
+    iniset $ZAQAR_CONF DEFAULT notification_driver messaging
+    iniset $ZAQAR_CONF DEFAULT control_exchange zaqar
+
     iniset_rpc_backend zaqar $ZAQAR_CONF
 
     cleanup_zaqar
diff --git a/stack.sh b/stack.sh
index dc79fa94f7..50573b57f4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -500,10 +500,6 @@ rm -f $SSL_BUNDLE_FILE
 source $TOP_DIR/lib/database
 source $TOP_DIR/lib/rpc_backend
 
-# Make sure we only have one rpc backend enabled,
-# and the specified rpc backend is available on your platform.
-check_rpc_backend
-
 # Service to enable with SSL if ``USE_SSL`` is True
 SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron,sahara"
 
@@ -1014,15 +1010,6 @@ if is_service_enabled keystone; then
     export OS_REGION_NAME=$REGION_NAME
 fi
 
-
-# ZeroMQ
-# ------
-if is_service_enabled zeromq; then
-    echo_summary "Starting zeromq receiver"
-    run_process zeromq "$OSLO_BIN_DIR/oslo-messaging-zmq-receiver"
-fi
-
-
 # Horizon
 # -------
 

From 9e68af7d170db8f4231727ebdc6630320213da8d Mon Sep 17 00:00:00 2001
From: Sirushti Murugesan <sirushti.murugesan@hp.com>
Date: Tue, 16 Jun 2015 23:25:17 +0530
Subject: [PATCH 0680/3333] Invoke Heat via console script generated binaries

Depends-On: Ic8f5b8dc85098de752bbf673c4b15c06fdc4162a
Change-Id: Iffb6d09bfef593d854b38e68200ae6039c4727e7
---
 lib/heat | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/heat b/lib/heat
index 5cb0dbf6d9..373b810f4a 100644
--- a/lib/heat
+++ b/lib/heat
@@ -53,6 +53,8 @@ HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
 
+# Support entry points installation of console scripts
+HEAT_BIN_DIR=$(get_python_exec_prefix)
 
 # other default options
 if [[ "$HEAT_STANDALONE" = "True" ]]; then
@@ -190,7 +192,7 @@ function init_heat {
     # (re)create heat database
     recreate_database heat
 
-    $HEAT_DIR/bin/heat-manage db_sync
+    $HEAT_BIN_DIR/heat-manage db_sync
     create_heat_cache_dir
 }
 
@@ -227,10 +229,10 @@ function install_heat_other {
 
 # start_heat() - Start running processes, including screen
 function start_heat {
-    run_process h-eng "$HEAT_DIR/bin/heat-engine --config-file=$HEAT_CONF"
-    run_process h-api "$HEAT_DIR/bin/heat-api --config-file=$HEAT_CONF"
-    run_process h-api-cfn "$HEAT_DIR/bin/heat-api-cfn --config-file=$HEAT_CONF"
-    run_process h-api-cw "$HEAT_DIR/bin/heat-api-cloudwatch --config-file=$HEAT_CONF"
+    run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
+    run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
+    run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
+    run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
 }
 
 # stop_heat() - Stop running processes

From 1987fcc8a31478911d6c815eb0a94afcf9fa5788 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Wed, 10 Jun 2015 11:00:59 -0400
Subject: [PATCH 0681/3333] Replace pip-installed requests CA bundle with link

If the version of python-requests required is higher than
that provided by the operating system, pip will install
it from upstream.

The upstream version provides its own CA certificate bundle
based on the Mozilla bundle, and defaults to that in case
a CA certificate file is not specified for a request.

The distribution-specific packages point to the system-wide
CA bundle that can be managed by tools such as
update-ca-trust (Fedora/RHEL) and update-ca-certificates
(Debian/Ubuntu).

When installing in SSL/TLS mode, either with SSL=True or by
adding tls-proxy to ENABLED_SERVICES, if a non-systemwide
CA bundle is used, then the CA generated by devstack will
not be used causing the installation to fail.

Replace the upstream-provided bundle with a link to the
system bundle when possible.

Change-Id: I651aec93398d583dcdc8323503792df7ca05a7e7
Closes-Bug: #1459789
---
 lib/tls | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/tls b/lib/tls
index 09f1c2dfdd..8ff2027819 100644
--- a/lib/tls
+++ b/lib/tls
@@ -202,6 +202,7 @@ subjectAltName          = \$ENV::SUBJECT_ALT_NAME
 # Create root and intermediate CAs
 # init_CA
 function init_CA {
+    fix_system_ca_bundle_path
     # Ensure CAs are built
     make_root_CA $ROOT_CA_DIR
     make_int_CA $INT_CA_DIR $ROOT_CA_DIR
@@ -338,6 +339,29 @@ function make_root_CA {
         -outform PEM
 }
 
+# If a non-system python-requests is installed then it will use the
+# built-in CA certificate store rather than the distro-specific
+# CA certificate store. Detect this and symlink to the correct
+# one. If the value for the CA is not rooted in /etc then we know
+# we need to change it.
+function fix_system_ca_bundle_path {
+    if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+        local capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
+
+        if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
+            if is_fedora; then
+                sudo rm -f $capath
+                sudo ln -s /etc/pki/tls/certs/ca-bundle.crt $capath
+            elif is_ubuntu; then
+                sudo rm -f $capath
+                sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
+            else
+                echo "Don't know how to set the CA bundle, expect the install to fail."
+            fi
+        fi
+    fi
+}
+
 
 # Certificate Input Configuration
 # ===============================

From 40fc66324c94a54263c63e70e8f427940c04a0a7 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 17 Jun 2015 16:39:37 +0000
Subject: [PATCH 0682/3333] Remove debugging artifacts

The change in 027e2ea741bdbcb6e1afc3fe527c3fdf045825c3 included some
debugging code that should have been removed before being added. This
removes it.

Change-Id: Ia56e1eb7305683b6c00b27a727fc8e094c65a963
---
 lib/ceilometer | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index f6f605b686..90c7705743 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -156,8 +156,6 @@ function _cleanup_ceilometer_apache_wsgi {
 # runs that a clean run would need to clean up
 function cleanup_ceilometer {
     if [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
-        echo "### cleaning database"
-        read
         mongo ceilometer --eval "db.dropDatabase();"
     elif [ "$CEILOMETER_BACKEND" = 'es' ] ; then
         curl -XDELETE "localhost:9200/events_*"

From ccd4c2e1775a214967ca287729facfc21bd4e59d Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 17 Jun 2015 16:42:43 +0000
Subject: [PATCH 0683/3333] Install python-libvirt for ceilometer only if n-cpu
 enabled

Nova is responsible for installing the libvirt package (if it is being
used). It is required by python-libvirt but python-libvirt only required
in ceilometer if nova compute is being used. There are some usage
scenarios where nova compute is not being used so in that case don't
install python-libvirt.

Change-Id: I0db66f1c0526e24ade98de85989a5ed8d37f0c4f
---
 lib/ceilometer | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 90c7705743..a577ee9ca8 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -334,12 +334,15 @@ function install_ceilometer {
         pip_install_gr pymongo
     fi
 
-    if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
-        pip_install_gr libvirt-python
-    fi
+    # Only install virt drivers if we're running nova compute
+    if is_service_enabled n-cpu ; then
+        if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
+            pip_install_gr libvirt-python
+        fi
 
-    if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-        pip_instal_gr oslo.vmware
+        if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
+            pip_instal_gr oslo.vmware
+        fi
     fi
 
     if [ "$CEILOMETER_BACKEND" = 'es' ] ; then

From f553ce24ea1fa860d19b5dfb14c286614552d509 Mon Sep 17 00:00:00 2001
From: Robert Collins <rbtcollins@hp.com>
Date: Wed, 17 Jun 2015 13:52:20 +1200
Subject: [PATCH 0684/3333] Actually install the requirements repo.

The requirements repo has had a setup.cfg etc for a long time but only
recently started using it. As it now has dependencies, we need to pip
install it. To preserve compat with older requirements repos I haven't
changed the call to invoke update-requirements yet, as we still have
the update.py symlink.

The pbr install is moved before requirements to ensure we don't
trigger easy-install.

Change-Id: I7d7e91694c9145fac0ddab8a9de5f789d723c641
---
 lib/infra | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/infra b/lib/infra
index c825b4ee56..5fb185fd6a 100644
--- a/lib/infra
+++ b/lib/infra
@@ -29,9 +29,6 @@ REQUIREMENTS_DIR=$DEST/requirements
 
 # install_infra() - Collect source and prepare
 function install_infra {
-    # bring down global requirements
-    git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
-
     # Install pbr
     if use_library_from_git "pbr"; then
         git_clone_by_name "pbr"
@@ -41,6 +38,10 @@ function install_infra {
         # in via system packages.
         pip_install "-U" "pbr"
     fi
+
+    # bring down global requirements
+    git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
+    pip_install $REQUIREMENTS_DIR
 }
 
 # Restore xtrace

From 18d1cca6cb1e56827e04c2f38c9db745b881f98a Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 18 Jun 2015 06:32:00 -0400
Subject: [PATCH 0685/3333] Add oslo.service to devstack

Add the ability to switch on oslo.service master using
LIBS_FROM_GIT

Change-Id: I00fe7776aea005b6d4e0a84fce54f33a862b57e3
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index be26668dfb..554bec8945 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -37,6 +37,7 @@ GITDIR["oslo.middleware"]=$DEST/oslo.middleware
 GITDIR["oslo.policy"]=$DEST/oslo.policy
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
+GITDIR["oslo.service"]=$DEST/oslo.service
 GITDIR["oslo.utils"]=$DEST/oslo.utils
 GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
@@ -76,6 +77,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.policy"
     _do_install_oslo_lib "oslo.rootwrap"
     _do_install_oslo_lib "oslo.serialization"
+    _do_install_oslo_lib "oslo.service"
     _do_install_oslo_lib "oslo.utils"
     _do_install_oslo_lib "oslo.versionedobjects"
     _do_install_oslo_lib "oslo.vmware"
diff --git a/stackrc b/stackrc
index c16a9997a4..1ac1338f2c 100644
--- a/stackrc
+++ b/stackrc
@@ -382,6 +382,10 @@ GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-master}
 GITREPO["oslo.serialization"]=${OSLOSERIALIZATION_REPO:-${GIT_BASE}/openstack/oslo.serialization.git}
 GITBRANCH["oslo.serialization"]=${OSLOSERIALIZATION_BRANCH:-master}
 
+# oslo.service
+GITREPO["oslo.service"]=${OSLOSERVICE_REPO:-${GIT_BASE}/openstack/oslo.service.git}
+GITBRANCH["oslo.service"]=${OSLOSERVICE_BRANCH:-master}
+
 # oslo.utils
 GITREPO["oslo.utils"]=${OSLOUTILS_REPO:-${GIT_BASE}/openstack/oslo.utils.git}
 GITBRANCH["oslo.utils"]=${OSLOUTILS_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 2f0b1febe4..fc6596789b 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -39,7 +39,7 @@ ALL_LIBS+=" oslo.serialization python-saharaclient django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
-ALL_LIBS+=" debtcollector os-brick automaton futurist"
+ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 40f3e33f734330c32f27882898ab1bb4ab8f3217 Mon Sep 17 00:00:00 2001
From: Robert Collins <rbtcollins@hp.com>
Date: Fri, 19 Jun 2015 08:04:00 +1200
Subject: [PATCH 0686/3333] Put requirements repo in a venv.

This is to prevent any possible contamination of test results from its
presence.

Change-Id: I5a929854745650cc6a182ffc4d15c50caabdd727
---
 inc/python | 6 +++---
 lib/infra  | 6 +++++-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/inc/python b/inc/python
index 3d329b59a9..e3c5e61dd2 100644
--- a/inc/python
+++ b/inc/python
@@ -219,15 +219,15 @@ function setup_package_with_req_sync {
         if [[ "$REQUIREMENTS_MODE" == "soft" ]]; then
             if is_in_projects_txt $project_dir; then
                 (cd $REQUIREMENTS_DIR; \
-                    python update.py $project_dir)
+                    ./.venv/bin/python update.py $project_dir)
             else
                 # soft update projects not found in requirements project.txt
                 (cd $REQUIREMENTS_DIR; \
-                    python update.py -s $project_dir)
+                    ./.venv/bin/python update.py -s $project_dir)
             fi
         else
             (cd $REQUIREMENTS_DIR; \
-                python update.py $project_dir)
+                ./.venv/bin/python update.py $project_dir)
         fi
     fi
 
diff --git a/lib/infra b/lib/infra
index 5fb185fd6a..4cc25965ea 100644
--- a/lib/infra
+++ b/lib/infra
@@ -29,6 +29,8 @@ REQUIREMENTS_DIR=$DEST/requirements
 
 # install_infra() - Collect source and prepare
 function install_infra {
+    local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
+
     # Install pbr
     if use_library_from_git "pbr"; then
         git_clone_by_name "pbr"
@@ -41,7 +43,9 @@ function install_infra {
 
     # bring down global requirements
     git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
-    pip_install $REQUIREMENTS_DIR
+    [ ! -d $PIP_VIRTUAL_ENV ] && virtualenv $PIP_VIRTUAL_ENV
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 }
 
 # Restore xtrace

From d16bfa48ee33f07ebb60221267082002aea5c47b Mon Sep 17 00:00:00 2001
From: Clint Byrum <clint@fewbar.com>
Date: Thu, 18 Jun 2015 13:22:35 -0700
Subject: [PATCH 0687/3333] Tune mysql a bit better for concurrent operations

With PyMySQL in the projects we can expect things to happen more
concurrently now. The query cache is a hinderance to concurrency, and
more connections will be required.

Change-Id: Icfb8cdbb9ed39cfd7732ad05fe740e01c767af7b
---
 lib/databases/mysql | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index f097fb21cb..0e477ca264 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -95,7 +95,10 @@ function configure_database_mysql {
     sudo bash -c "source $TOP_DIR/functions && \
         iniset $my_conf mysqld bind-address 0.0.0.0 && \
         iniset $my_conf mysqld sql_mode STRICT_ALL_TABLES && \
-        iniset $my_conf mysqld default-storage-engine InnoDB"
+        iniset $my_conf mysqld default-storage-engine InnoDB \
+        iniset $my_conf mysqld max_connections 1024 \
+        iniset $my_conf mysqld query_cache_type OFF \
+        iniset $my_conf mysqld query_cache_size 0"
 
 
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then

From d72b839b7f15a8065d2f7bcceff0a9299ea9c901 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 18 Jun 2015 12:40:09 -0400
Subject: [PATCH 0688/3333] Docs: Use RFC5737 for Provider Networking

That'll make things more clear that with the provider networking
feature in DevStack, FIXED_RANGE will be a routed IPv4 subnet that gives
routed IPv4 addresses to instances without using floating IPs.

Change-Id: Ie26d75ac5ff285a25762c4f61fd9800b0382886b
---
 doc/source/guides/neutron.rst | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index bdfd3a4afa..40a5632b86 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -261,15 +261,18 @@ controller node.
 
         ## Neutron Networking options used to create Neutron Subnets
 
-        FIXED_RANGE="10.1.1.0/24"
+        FIXED_RANGE="203.0.113.0/24"
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010
 
 In this configuration we are defining FIXED_RANGE to be a
-subnet that exists in the private RFC1918 address space - however
-in a real setup FIXED_RANGE would be a public IP address range, so
-that you could access your instances from the public internet.
+publicly routed IPv4 subnet. In this specific instance we are using
+the special TEST-NET-3 subnet defined in `RFC 5737 <http://tools.ietf.org/html/rfc5737>`_,
+which is used for documentation.  In your DevStack setup, FIXED_RANGE
+would be a public IP address range that you or your organization has
+allocated to you, so that you could access your instances from the
+public internet.
 
 The following is a snippet of the DevStack configuration on the
 compute node.

From 86923559a4feb4a7c1f01f69ffdbff6c67c6b785 Mon Sep 17 00:00:00 2001
From: Robert Collins <rbtcollins@hp.com>
Date: Fri, 19 Jun 2015 11:17:04 +1200
Subject: [PATCH 0689/3333] Fixup pbr in LIBS_FROM_GIT

Change-Id: I32594f30a13c0757cc918c8a5e54ae182e985693
---
 lib/infra | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/infra b/lib/infra
index 4cc25965ea..585e9b47bc 100644
--- a/lib/infra
+++ b/lib/infra
@@ -30,6 +30,12 @@ REQUIREMENTS_DIR=$DEST/requirements
 # install_infra() - Collect source and prepare
 function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
+    # bring down global requirements
+    git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
+    [ ! -d $PIP_VIRTUAL_ENV ] && virtualenv $PIP_VIRTUAL_ENV
+    # We don't care about testing git pbr in the requirements venv.
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
     # Install pbr
     if use_library_from_git "pbr"; then
@@ -40,12 +46,6 @@ function install_infra {
         # in via system packages.
         pip_install "-U" "pbr"
     fi
-
-    # bring down global requirements
-    git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
-    [ ! -d $PIP_VIRTUAL_ENV ] && virtualenv $PIP_VIRTUAL_ENV
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 }
 
 # Restore xtrace

From f4f01c63973246cbd7821fb28f0e8f9d74e4a131 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 19 Jun 2015 02:52:41 +0000
Subject: [PATCH 0690/3333] Use swift store config files in glance

Using the swift_store_auth_address, swift_store_user and swift_store_key are
marked as deprecated in glance in favour of using a standalone config file that
provides multiple auth options.

Create and use a standalone authentication file for communicating with swift.

Change-Id: I9b5361ce6e1771781d7ae7226974604a7f9e5d00
---
 lib/glance | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/lib/glance b/lib/glance
index 016ade3479..47bad0e277 100644
--- a/lib/glance
+++ b/lib/glance
@@ -56,6 +56,7 @@ GLANCE_SEARCH_PASTE_INI=$GLANCE_CONF_DIR/glance-search-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
+GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -145,11 +146,20 @@ function configure_glance {
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift
-        iniset $GLANCE_API_CONF glance_store swift_store_auth_address $KEYSTONE_SERVICE_URI/v2.0/
-        iniset $GLANCE_API_CONF glance_store swift_store_user $SERVICE_TENANT_NAME:glance-swift
-        iniset $GLANCE_API_CONF glance_store swift_store_key $SERVICE_PASSWORD
         iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
+
+        iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
+        iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_TENANT_NAME:glance-swift
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v2.0/
+
+        # commenting is not strictly necessary but it's confusing to have bad values in conf
+        inicomment $GLANCE_API_CONF glance_store swift_store_user
+        inicomment $GLANCE_API_CONF glance_store swift_store_key
+        inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
     if is_service_enabled tls-proxy; then

From ceca15db4d1d7cf652c25d0339ce90d9aad2b885 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 19 Jun 2015 11:46:36 +0200
Subject: [PATCH 0691/3333] Glance: move connection_url from DEFAULT section to
 DB section

To get rid of Oslo_config deprecation warning.

Change-Id: I9de475f4dea4a4496cc8b5e93aa6928235d4cb29
---
 lib/glance | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/glance b/lib/glance
index 016ade3479..650028450e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -107,7 +107,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     inicomment $GLANCE_REGISTRY_CONF DEFAULT log_file
     local dburl=`database_connection_url glance`
-    iniset $GLANCE_REGISTRY_CONF DEFAULT sql_connection $dburl
+    iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
@@ -120,7 +120,7 @@ function configure_glance {
     cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     inicomment $GLANCE_API_CONF DEFAULT log_file
-    iniset $GLANCE_API_CONF DEFAULT sql_connection $dburl
+    iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
@@ -219,7 +219,7 @@ function configure_glance {
         iniset $GLANCE_SEARCH_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         inicomment $GLANCE_SEARCH_CONF DEFAULT log_file
         iniset $GLANCE_SEARCH_CONF DEFAULT use_syslog $SYSLOG
-        iniset $GLANCE_SEARCH_CONF DEFAULT sql_connection $dburl
+        iniset $GLANCE_SEARCH_CONF database connection $dburl
         iniset $GLANCE_SEARCH_CONF paste_deploy flavor keystone
         configure_auth_token_middleware $GLANCE_SEARCH_CONF glance $GLANCE_AUTH_CACHE_DIR/search
 

From 0124e08ede770caf8b787d3a54e4683e7e1277cb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 19 Jun 2015 08:26:45 -0400
Subject: [PATCH 0692/3333] refresh the devstack plugin docs, add plugin
 registry

The devstack plugin docs mostly referred to in tree plugins, which is
honestly something we don't want people doing. Instead restructure the
whole document to talk about external plugins as the only kinds of
plugins, and focus on a workflow to make that easy for people to work
through.

This also adds a plugin-registry page to start listing known plugins
somewhere centrally. Some sample content was added, hopefully people
will submit patches to include their plugins.

This does drop the section on hypervisor plugins. That's not currently
something that we expect a ton of people to work on, so diving into
the code for this should be fine.

Change-Id: Ifc0b831c90a1a45daa507a009d1dcffcd6e2deca
---
 doc/source/index.rst           |   1 +
 doc/source/plugin-registry.rst |  73 ++++++++
 doc/source/plugins.rst         | 305 ++++++++++++++++++---------------
 3 files changed, 243 insertions(+), 136 deletions(-)
 create mode 100644 doc/source/plugin-registry.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6d0edb0bfe..f15c3060e7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -10,6 +10,7 @@ DevStack - an OpenStack Community Production
    overview
    configuration
    plugins
+   plugin-registry
    faq
    changes
    hacking
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
new file mode 100644
index 0000000000..2dd70d84e9
--- /dev/null
+++ b/doc/source/plugin-registry.rst
@@ -0,0 +1,73 @@
+..
+  Note to reviewers: the intent of this file is to be easy for
+  community members to update. As such fast approving (single core +2)
+  is fine as long as you've identified that the plugin listed actually exists.
+
+==========================
+ DevStack Plugin Registry
+==========================
+
+Since we've created the external plugin mechanism, it's gotten used by
+a lot of projects. The following is a list of plugins that currently
+exist. Any project that wishes to list their plugin here is welcomed
+to.
+
+Official OpenStack Projects
+===========================
+
+The following are plugins that exist for official OpenStack projects.
+
++--------------------+-------------------------------------------+--------------------+
+|Plugin Name         |URL                                        |Comments            |
++--------------------+-------------------------------------------+--------------------+
+|magnum              |git://git.openstack.org/openstack/magnum   |                    |
++--------------------+-------------------------------------------+--------------------+
+|trove               |git://git.openstack.org/openstack/trove    |                    |
++--------------------+-------------------------------------------+--------------------+
+|zaqar               |git://git.openstack.org/openstack/zarar    |                    |
++--------------------+-------------------------------------------+--------------------+
+
+
+
+Drivers
+=======
+
++--------------------+-------------------------------------------------+------------------+
+|Plugin Name         |URL                                              |Comments          |
++--------------------+-------------------------------------------------+------------------+
+|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
++--------------------+-------------------------------------------------+------------------+
+|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
++--------------------+-------------------------------------------------+------------------+
+
+.. [d1] demonstrates example of installing 3rd party SDN controller
+.. [d2] demonstrates a pretty advanced set of modes that that allow
+        one to run OpenDayLight either from a pre-existing install, or
+        also from source
+
+Alternate Configs
+=================
+
++-------------+------------------------------------------------------------+------------+
+| Plugin Name | URL                                                        | Comments   |
+|             |                                                            |            |
++-------------+------------------------------------------------------------+------------+
+|glusterfs    |git://git.openstack.org/stackforge/devstack-plugin-glusterfs|            |
++-------------+------------------------------------------------------------+------------+
+|             |                                                            |            |
++-------------+------------------------------------------------------------+------------+
+
+Additional Services
+===================
+
++-------------+------------------------------------------+------------+
+| Plugin Name | URL                                      | Comments   |
+|             |                                          |            |
++-------------+------------------------------------------+------------+
+|ec2-api      |git://git.openstack.org/stackforge/ec2api |[as1]_      |
++-------------+------------------------------------------+------------+
+|             |                                          |            |
++-------------+------------------------------------------+------------+
+
+.. [as1] first functional devstack plugin, hence why used in most of
+         the examples.
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index c4ed2285cb..b166936a8b 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -2,78 +2,83 @@
 Plugins
 =======
 
-DevStack has a couple of plugin mechanisms to allow easily adding
-support for additional projects and features.
+The OpenStack ecosystem is wide and deep, and only growing more so
+every day. The value of DevStack is that it's simple enough to
+understand what it's doing clearly. And yet we'd like to support as
+much of the OpenStack Ecosystem as possible. We do that with plugins.
 
-Extras.d Hooks
-==============
+DevStack plugins are bits of bash code that live outside the DevStack
+tree. They are called through a strong contract, so these plugins can
+be sure that they will continue to work in the future as DevStack
+evolves.
 
-These hooks are an extension of the service calls in
-``stack.sh`` at specific points in its run, plus ``unstack.sh`` and
-``clean.sh``. A number of the higher-layer projects are implemented in
-DevStack using this mechanism.
+Plugin Interface
+================
 
-The script in ``extras.d`` is expected to be mostly a dispatcher to
-functions in a ``lib/*`` script. The scripts are named with a
-zero-padded two digits sequence number prefix to control the order that
-the scripts are called, and with a suffix of ``.sh``. DevStack reserves
-for itself the sequence numbers 00 through 09 and 90 through 99.
+DevStack supports a standard mechansim for including plugins from
+external repositories. The plugin interface assumes the following:
 
-Below is a template that shows handlers for the possible command-line
-arguments:
+An external git repository that includes a ``devstack/`` top level
+directory. Inside this directory there can be 2 files.
 
-::
+- ``settings`` - a file containing global variables that will be
+  sourced very early in the process. This is helpful if other plugins
+  might depend on this one, and need access to global variables to do
+  their work.
 
-    # template.sh - DevStack extras.d dispatch script template
+  Your settings should include any ``enable_service`` lines required
+  by your plugin. This is especially important if you are kicking off
+  services using ``run_process`` as it only works with enabled
+  services.
 
-    # check for service enabled
-    if is_service_enabled template; then
+  Be careful to allow users to override global-variables for
+  customizing their environment.  Usually it is best to provide a
+  default value only if the variable is unset or empty; e.g. in bash
+  syntax ``FOO=${FOO:-default}``.
 
-        if [[ "$1" == "source" ]]; then
-            # Initial source of lib script
-            source $TOP_DIR/lib/template
-        fi
+- ``plugin.sh`` - the actual plugin. It is executed by devstack at
+  well defined points during a ``stack.sh`` run. The plugin.sh
+  internal structure is discussed bellow.
 
-        if [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
-            # Set up system services
-            echo_summary "Configuring system services Template"
-            install_package cowsay
 
-        elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-            # Perform installation of service source
-            echo_summary "Installing Template"
-            install_template
+Plugins are registered by adding the following to the localrc section
+of ``local.conf``.
 
-        elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-            # Configure after the other layer 1 and 2 services have been configured
-            echo_summary "Configuring Template"
-            configure_template
+They are added in the following format::
 
-        elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-            # Initialize and start the template service
-            echo_summary "Initializing Template"
-            ##init_template
-        fi
+  [[local|localrc]]
+  enable_plugin <NAME> <GITURL> [GITREF]
 
-        if [[ "$1" == "unstack" ]]; then
-            # Shut down template services
-            # no-op
-            :
-        fi
+- ``name`` - an arbitrary name. (ex: glustfs, docker, zaqar, congress)
+- ``giturl`` - a valid git url that can be cloned
+- ``gitref`` - an optional git ref (branch / ref / tag) that will be
+  cloned. Defaults to master.
 
-        if [[ "$1" == "clean" ]]; then
-            # Remove state and transient data
-            # Remember clean.sh first calls unstack.sh
-            # no-op
-            :
-        fi
-    fi
+An example would be as follows::
 
-The arguments are:
+  enable_plugin ec2api git://git.openstack.org/stackforge/ec2api
+
+plugin.sh contract
+==================
+
+``plugin.sh`` is a bash script that will be called at specific points
+during ``stack.sh``, ``unstack.sh``, and ``clean.sh``. It will be
+called in the following way::
+
+  source $PATH/TO/plugin.sh <mode> [phase]
 
--  **source** - Called by each script that utilizes ``extras.d`` hooks;
-   this replaces directly sourcing the ``lib/*`` script.
--  **stack** - Called by ``stack.sh`` three times for different phases
+``mode`` can be thought of as the major mode being called, currently
+one of: ``stack``, ``unstack``, ``clean``. ``phase`` is used by modes
+which have multiple points during their run where it's necessary to
+be able to execute code. All existing ``mode`` and ``phase`` points
+are considered **strong contracts** and won't be removed without a
+reasonable deprecation period. Additional new ``mode`` or ``phase``
+points may be added at any time if we discover we need them to support
+additional kinds of plugins in devstack.
+
+The current full list of ``mode`` and ``phase`` are:
+
+-  **stack** - Called by ``stack.sh`` four times for different phases
    of its run:
 
    -  **pre-install** - Called after system (OS) setup is complete and
@@ -84,106 +89,90 @@ The arguments are:
       been configured. All configuration files for enabled services
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
-      been started. This is the existing hook and has not otherwise
-      changed.
+      been started.
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut
    down.
 -  **clean** - Called by ``clean.sh`` before other services are cleaned,
    but after ``unstack.sh`` has been called.
 
+Example plugin
+====================
 
-Externally Hosted Plugins
-=========================
+An example plugin would look something as follows.
 
-Based on the extras.d hooks, DevStack supports a standard mechansim
-for including plugins from external repositories. The plugin interface
-assumes the following:
+``devstack/settings``::
 
-An external git repository that includes a ``devstack/`` top level
-directory. Inside this directory there can be 2 files.
+    # settings file for template
+  enable_service template
 
-- ``settings`` - a file containing global variables that will be
-  sourced very early in the process. This is helpful if other plugins
-  might depend on this one, and need access to global variables to do
-  their work.
 
-  Your settings should include any ``enable_service`` lines required
-  by your plugin. This is especially important if you are kicking off
-  services using ``run_process`` as it only works with enabled
-  services.
+``devstack/plugin.sh``::
 
-  Be careful to allow users to override global-variables for
-  customizing their environment.  Usually it is best to provide a
-  default value only if the variable is unset or empty; e.g. in bash
-  syntax ``FOO=${FOO:-default}``.
+    # plugin.sh - DevStack plugin.sh dispatch script template
 
-- ``plugin.sh`` - the actual plugin. It will be executed by devstack
-  during it's run. The run order will be done in the registration
-  order for these plugins, and will occur immediately after all in
-  tree extras.d dispatch at the phase in question.  The plugin.sh
-  looks like the extras.d dispatcher above.
+    function install_template {
+        ...
+    }
 
-Plugins are registered by adding the following to the localrc section
-of ``local.conf``.
+    function init_template {
+        ...
+    }
 
-They are added in the following format::
+    function configure_template {
+        ...
+    }
 
-  [[local|localrc]]
-  enable_plugin <NAME> <GITURL> [GITREF]
+    # check for service enabled
+    if is_service_enabled template; then
 
-- ``name`` - an arbitrary name. (ex: glustfs, docker, zaqar, congress)
-- ``giturl`` - a valid git url that can be cloned
-- ``gitref`` - an optional git ref (branch / ref / tag) that will be
-  cloned. Defaults to master.
+        if [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
+            # Set up system services
+            echo_summary "Configuring system services Template"
+            install_package cowsay
 
-An example would be as follows::
+        elif [[ "$1" == "stack" && "$2" == "install" ]]; then
+            # Perform installation of service source
+            echo_summary "Installing Template"
+            install_template
 
-  enable_plugin ec2api git://git.openstack.org/stackforge/ec2api
+        elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
+            # Configure after the other layer 1 and 2 services have been configured
+            echo_summary "Configuring Template"
+            configure_template
+
+        elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
+            # Initialize and start the template service
+            echo_summary "Initializing Template"
+            init_template
+        fi
+
+        if [[ "$1" == "unstack" ]]; then
+            # Shut down template services
+            # no-op
+            :
+        fi
 
-Plugins for gate jobs
----------------------
-
-All OpenStack plugins that wish to be used as gate jobs need to exist
-in OpenStack's gerrit. Both ``openstack`` namespace and ``stackforge``
-namespace are fine. This allows testing of the plugin as well as
-provides network isolation against upstream git repository failures
-(which we see often enough to be an issue).
-
-Ideally plugins will be implemented as ``devstack`` directory inside
-the project they are testing. For example, the stackforge/ec2-api
-project has it's pluggin support in it's tree.
-
-In the cases where there is no "project tree" per say (like
-integrating a backend storage configuration such as ceph or glusterfs)
-it's also allowed to build a dedicated
-``stackforge/devstack-plugin-FOO`` project to house the plugin.
-
-Note jobs must not require cloning of repositories during tests.
-Tests must list their repository in the ``PROJECTS`` variable for
-`devstack-gate
-<https://git.openstack.org/cgit/openstack-infra/devstack-gate/tree/devstack-vm-gate-wrap.sh>`_
-for the repository to be available to the test.  Further information
-is provided in the project creator's guide.
-
-Hypervisor
-==========
-
-Hypervisor plugins are fairly new and condense most hypervisor
-configuration into one place.
-
-The initial plugin implemented was for Docker support and is a useful
-template for the required support. Plugins are placed in
-``lib/nova_plugins`` and named ``hypervisor-<name>`` where ``<name>`` is
-the value of ``VIRT_DRIVER``. Plugins must define the following
-functions:
-
--  ``install_nova_hypervisor`` - install any external requirements
--  ``configure_nova_hypervisor`` - make configuration changes, including
-   those to other services
--  ``start_nova_hypervisor`` - start any external services
--  ``stop_nova_hypervisor`` - stop any external services
--  ``cleanup_nova_hypervisor`` - remove transient data and cache
+        if [[ "$1" == "clean" ]]; then
+            # Remove state and transient data
+            # Remember clean.sh first calls unstack.sh
+            # no-op
+            :
+        fi
+    fi
+
+Plugin Execution Order
+======================
+
+Plugins are run after in tree services at each of the stages
+above. For example, if you need something to happen before Keystone
+starts, you should do that at the ``post-config`` phase.
+
+Multiple plugins can be specified in your ``local.conf``. When that
+happens the plugins will be executed **in order** at each phase. This
+allows plugins to conceptually depend on each other through
+documenting to the user the order they must be declared. A formal
+dependency mechanism is beyond the scope of the current work.
 
 System Packages
 ===============
@@ -205,3 +194,47 @@ repository:
 
 - ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
   running on SUSE Linux or openSUSE.
+
+
+Using Plugins in the OpenStack Gate
+===================================
+
+For everyday use, DevStack plugins can exist in any git tree that's
+accessible on the internet. However, when using DevStack plugins in
+the OpenStack gate, they must live in projects in OpenStack's
+gerrit. Both ``openstack`` namespace and ``stackforge`` namespace are
+fine. This allows testing of the plugin as well as provides network
+isolation against upstream git repository failures (which we see often
+enough to be an issue).
+
+Ideally a plugin will be included within the ``devstack`` directory of
+the project they are being tested. For example, the stackforge/ec2-api
+project has its pluggin support in its own tree.
+
+However, some times a DevStack plugin might be used solely to
+configure a backend service that will be used by the rest of
+OpenStack, so there is no "project tree" per say. Good examples
+include: integration of back end storage (e.g. ceph or glusterfs),
+integration of SDN controllers (e.g. ovn, OpenDayLight), or
+integration of alternate RPC systems (e.g. zmq, qpid). In these cases
+the best practice is to build a dedicated
+``stackforge/devstack-plugin-FOO`` project.
+
+To enable a plugin to be used in a gate job, the following lines will
+be needed in your project.yaml definition::
+
+  # Because we are testing a non standard project, add the
+  # our project repository. This makes zuul do the right
+  # reference magic for testing changes.
+  export PROJECTS="stackforge/ec2-api $PROJECTS"
+
+  # note the actual url here is somewhat irrelevant because it
+  # caches in nodepool, however make it a valid url for
+  # documentation purposes.
+  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api git://git.openstack.org/stackforge/ec2-api"
+
+See Also
+========
+
+For additional inspiration on devstack plugins you can check out the
+`Plugin Registry <plugin-registry.html>`_.

From 23bf045c183f53762e7771fe0081b3d4ab09e107 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 29 May 2015 11:38:22 +0200
Subject: [PATCH 0693/3333] Check if cinder is enabled before doing anything
 lvm2 related

On some system Cinder is not enabled so we can't assume LVM is installed. So
do not try to `sed` /etc/lvm/lvm.conf or clean LVM VG if cinder is not enabled

Change-Id: I09b1a7bee0785e5e1bb7dc96158a654bd3f15c83
---
 unstack.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index f0da9710a2..10e595809a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -187,5 +187,10 @@ if [[ -n "$SCREEN" ]]; then
 fi
 
 # BUG: maybe it doesn't exist? We should isolate this further down.
-clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
-clean_lvm_filter
+# NOTE: Cinder automatically installs the lvm2 package, independently of the
+# enabled backends. So if Cinder is enabled, we are sure lvm (lvremove,
+# /etc/lvm/lvm.conf, etc.) is here.
+if is_service_enabled cinder; then
+    clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
+    clean_lvm_filter
+fi

From d3d78cc528ea2d35a8794ea21c2b8d043e3119e2 Mon Sep 17 00:00:00 2001
From: Jerry Zhao <xyzjerry@gmail.com>
Date: Fri, 19 Jun 2015 18:57:13 -0700
Subject: [PATCH 0694/3333] use pip_install_gr for ceilometermiddleware

Since this patch https://review.openstack.org/#/c/171685 has been
merged in global requirements, better to switch to pip_install_gr.

Change-Id: Ibe708d4f523c32ade3c6a273f80b9c38bb03e382
---
 lib/ceilometer | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index a577ee9ca8..d7888d9502 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -366,10 +366,7 @@ function install_ceilometermiddleware {
         git_clone_by_name "ceilometermiddleware"
         setup_dev_lib "ceilometermiddleware"
     else
-        # BUG: this should be a pip_install_gr except it was never
-        # included in global-requirements. Needs to be fixed by
-        # https://bugs.launchpad.net/ceilometer/+bug/1441655
-        pip_install ceilometermiddleware
+        pip_install_gr ceilometermiddleware
     fi
 }
 

From e1fa0701b3920932d40b031b08d19c6fd2e3397e Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sun, 21 Jun 2015 08:54:43 -0500
Subject: [PATCH 0695/3333] Update clouds.yaml

If the user already has a clouds.yaml, update it with the "devstack"
entry.

Change-Id: Id02378b6f3a86f9fee201d91688205705202c0a8
---
 stack.sh                    | 45 ++++++++++--------
 tools/update_clouds_yaml.py | 95 +++++++++++++++++++++++++++++++++++++
 2 files changed, 119 insertions(+), 21 deletions(-)
 create mode 100755 tools/update_clouds_yaml.py

diff --git a/stack.sh b/stack.sh
index 0d9d836eca..26d9754f6f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1295,28 +1295,31 @@ fi
 # Save some values we generated for later use
 save_stackenv
 
-# Write out a clouds.yaml file
-# putting the location into a variable to allow for easier refactoring later
-# to make it overridable. There is current no usecase where doing so makes
-# sense, so I'm not actually doing it now.
+# Update/create user clouds.yaml file.
+# clouds.yaml will have a `devstack` entry for the `demo` user for the `demo`
+# project.
+
+# The location is a variable to allow for easier refactoring later to make it
+# overridable. There is currently no usecase where doing so makes sense, so
+# it's not currently configurable.
 CLOUDS_YAML=~/.config/openstack/clouds.yaml
-if [ ! -e $CLOUDS_YAML ]; then
-    mkdir -p $(dirname $CLOUDS_YAML)
-    cat >"$CLOUDS_YAML" <<EOF
-clouds:
-  devstack:
-    auth:
-      auth_url: $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
-      username: demo
-      project_name: demo
-      password: $ADMIN_PASSWORD
-    region_name: $REGION_NAME
-    identity_api_version: $IDENTITY_API_VERSION
-EOF
-    if [ -f "$SSL_BUNDLE_FILE" ]; then
-        echo "    cacert: $SSL_BUNDLE_FILE" >>"$CLOUDS_YAML"
-    fi
-fi
+
+mkdir -p $(dirname $CLOUDS_YAML)
+
+CA_CERT_ARG=''
+if [ -f "$SSL_BUNDLE_FILE" ]; then
+    CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
+fi
+$TOP_DIR/tools/update_clouds_yaml.py \
+    --file $CLOUDS_YAML \
+    --os-cloud devstack \
+    --os-region-name $REGION_NAME \
+    --os-identity-api-version $IDENTITY_API_VERSION \
+    $CA_CERT_ARG \
+    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+    --os-username demo \
+    --os-password $ADMIN_PASSWORD \
+    --os-project-name demo
 
 
 # Wrapup configuration
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
new file mode 100755
index 0000000000..08621352ad
--- /dev/null
+++ b/tools/update_clouds_yaml.py
@@ -0,0 +1,95 @@
+#!/usr/bin/env python
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# Update the clouds.yaml file.
+
+
+import argparse
+import os.path
+
+import yaml
+
+
+class UpdateCloudsYaml(object):
+    def __init__(self, args):
+        if args.file:
+            self._clouds_path = args.file
+            self._create_directory = False
+        else:
+            self._clouds_path = os.path.expanduser(
+                '~/.config/openstack/clouds.yaml')
+            self._create_directory = True
+        self._clouds = {}
+
+        self._cloud = args.os_cloud
+        self._cloud_data = {
+            'region_name': args.os_region_name,
+            'identity_api_version': args.os_identity_api_version,
+            'auth': {
+                'auth_url': args.os_auth_url,
+                'username': args.os_username,
+                'password': args.os_password,
+                'project_name': args.os_project_name,
+            },
+        }
+        if args.os_cacert:
+            self._cloud_data['cacert'] = args.os_cacert
+
+    def run(self):
+        self._read_clouds()
+        self._update_clouds()
+        self._write_clouds()
+
+    def _read_clouds(self):
+        try:
+            with open(self._clouds_path) as clouds_file:
+                self._clouds = yaml.load(clouds_file)
+        except IOError:
+            # The user doesn't have a clouds.yaml file.
+            print("The user clouds.yaml file didn't exist.")
+            self._clouds = {}
+
+    def _update_clouds(self):
+        self._clouds.setdefault('clouds', {})[self._cloud] = self._cloud_data
+
+    def _write_clouds(self):
+
+        if self._create_directory:
+            clouds_dir = os.path.dirname(self._clouds_path)
+            os.makedirs(clouds_dir)
+
+        with open(self._clouds_path, 'w') as clouds_file:
+            yaml.dump(self._clouds, clouds_file, default_flow_style=False)
+
+
+def main():
+    parser = argparse.ArgumentParser('Update clouds.yaml file.')
+    parser.add_argument('--file')
+    parser.add_argument('--os-cloud', required=True)
+    parser.add_argument('--os-region-name', default='RegionOne')
+    parser.add_argument('--os-identity-api-version', default='3')
+    parser.add_argument('--os-cacert')
+    parser.add_argument('--os-auth-url', required=True)
+    parser.add_argument('--os-username', required=True)
+    parser.add_argument('--os-password', required=True)
+    parser.add_argument('--os-project-name', required=True)
+
+    args = parser.parse_args()
+
+    update_clouds_yaml = UpdateCloudsYaml(args)
+    update_clouds_yaml.run()
+
+
+if __name__ == "__main__":
+    main()

From e123830c15a4bd07f7ea700a46ca1e158487cdd9 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sun, 21 Jun 2015 09:16:44 -0500
Subject: [PATCH 0696/3333] Add devstack-admin cloud to clouds.yaml

A lot of commands developers use require admin by default, so add a
"devstack-admin" cloud to clouds.yaml that has admin authority.

 $ openstack --os-cloud devstack-admin user list

Change-Id: Ie0f1979c50901004418f8622d4ca79dc4bdadd8d
---
 stack.sh | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 26d9754f6f..4228f35e0d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1296,8 +1296,9 @@ fi
 save_stackenv
 
 # Update/create user clouds.yaml file.
-# clouds.yaml will have a `devstack` entry for the `demo` user for the `demo`
-# project.
+# clouds.yaml will have
+# - A `devstack` entry for the `demo` user for the `demo` project.
+# - A `devstack-admin` entry for the `admin` user for the `admin` project.
 
 # The location is a variable to allow for easier refactoring later to make it
 # overridable. There is currently no usecase where doing so makes sense, so
@@ -1320,6 +1321,16 @@ $TOP_DIR/tools/update_clouds_yaml.py \
     --os-username demo \
     --os-password $ADMIN_PASSWORD \
     --os-project-name demo
+$TOP_DIR/tools/update_clouds_yaml.py \
+    --file $CLOUDS_YAML \
+    --os-cloud devstack-admin \
+    --os-region-name $REGION_NAME \
+    --os-identity-api-version $IDENTITY_API_VERSION \
+    $CA_CERT_ARG \
+    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+    --os-username admin \
+    --os-password $ADMIN_PASSWORD \
+    --os-project-name admin
 
 
 # Wrapup configuration

From 2f63da9e0e0d0491acab31cafcee530ca0982e2e Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sun, 21 Jun 2015 09:02:59 -0700
Subject: [PATCH 0697/3333] Ensure yum-utils is installed before using
 yum-config-manager

yum-utils provides yum-config-manager but the check for yum-utils is
currently being done after the first usage of yum-config-manager, which
fails if you don't have yum-utils already installed, so move it up
before the first usage of yum-config-manager.

Putting yum-utils in files/rpms/general doesn't help since
yum-config-manager is used in stack.sh before tools/install_prereqs.sh
is called.

Closes-Bug: #1467270

Change-Id: I74996c76838b7dc50d847e3bedb2d04dc55b4431
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 0d9d836eca..f1dc74f45d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -263,6 +263,7 @@ gpgcheck=0
 EOF
     # Enable a bootstrap repo.  It is removed after finishing
     # the epel-release installation.
+    is_package_installed yum-utils || install_package yum-utils
     sudo yum-config-manager --enable epel-bootstrap
     yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
@@ -270,7 +271,6 @@ EOF
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
 
     # ... and also optional to be enabled
-    is_package_installed yum-utils || install_package yum-utils
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
     RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-juno/rdo-release-juno-1.noarch.rpm"}

From c7e89f23808abf837d2a410ec9f4b1a452957c6d Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 1 Jun 2015 12:57:33 +0200
Subject: [PATCH 0698/3333] SUSE: Clean up libxslt/libxml2 related dependencies

libxml2-devel is a dependency of libxslt-devel, so we don't need
to explicitly include it. Also, since it is only really needed
by python-lxml, consolidate it into devlibs and remove the copies.
Also remove a non-existing package reference along the way

Change-Id: If9afaaa93f2c485baa1efff74d7ae58c59713de6
---
 files/rpms-suse/devlibs | 1 -
 files/rpms-suse/glance  | 1 -
 files/rpms-suse/trove   | 1 -
 3 files changed, 3 deletions(-)
 delete mode 100644 files/rpms-suse/trove

diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
index bdb630a16f..54d13a33e9 100644
--- a/files/rpms-suse/devlibs
+++ b/files/rpms-suse/devlibs
@@ -1,6 +1,5 @@
 libffi-devel  # pyOpenSSL
 libopenssl-devel  # pyOpenSSL
-libxml2-devel  # lxml
 libxslt-devel  # lxml
 postgresql-devel  # psycopg2
 libmysqlclient-devel # MySQL-python
diff --git a/files/rpms-suse/glance b/files/rpms-suse/glance
index 0e58425b1f..bf512de575 100644
--- a/files/rpms-suse/glance
+++ b/files/rpms-suse/glance
@@ -1,2 +1 @@
-libxml2-devel
 python-devel
diff --git a/files/rpms-suse/trove b/files/rpms-suse/trove
deleted file mode 100644
index 96f8f29277..0000000000
--- a/files/rpms-suse/trove
+++ /dev/null
@@ -1 +0,0 @@
-libxslt1-dev

From 0ae942b41c6dcd0fe7353e7d68574194fb72a66d Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 3 Jun 2015 14:09:05 +0200
Subject: [PATCH 0699/3333] Only install python-libguestfs bindings when needed

Currently those bindings are missing from SLES12, and since
they're not actually used unless file injection is enabled
(which is not by default), only conditionally depend on it.

Change-Id: I79a8d8ac7ad2fbd7d2fce696821d130218e43e03
---
 lib/nova_plugins/functions-libvirt  |  2 --
 lib/nova_plugins/hypervisor-libvirt | 11 +++++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 96d8a44b05..22b58e0065 100755
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -28,7 +28,6 @@ function install_libvirt {
         else
             install_package qemu-kvm
             install_package libguestfs0
-            install_package python-guestfs
         fi
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
@@ -37,7 +36,6 @@ function install_libvirt {
         install_package kvm
         install_package libvirt libvirt-devel
         pip_install_gr libvirt-python
-        install_package python-libguestfs
     fi
 }
 
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index a6a87f9164..f70b21a475 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -26,7 +26,7 @@ source $TOP_DIR/lib/nova_plugins/functions-libvirt
 # --------
 
 # File injection is disabled by default in Nova.  This will turn it back on.
-ENABLE_FILE_INJECTION=${ENABLE_FILE_INJECTION:-False}
+ENABLE_FILE_INJECTION=$(trueorfalse False ENABLE_FILE_INJECTION)
 
 
 # Entry Points
@@ -60,7 +60,6 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF DEFAULT vnc_enabled "false"
     fi
 
-    ENABLE_FILE_INJECTION=$(trueorfalse False ENABLE_FILE_INJECTION)
     if [[ "$ENABLE_FILE_INJECTION" = "True" ]] ; then
         # When libguestfs is available for file injection, enable using
         # libguestfs to inspect the image and figure out the proper
@@ -97,6 +96,14 @@ function install_nova_hypervisor {
             yum_install libcgroup-tools
         fi
     fi
+
+    if [[ "$ENABLE_FILE_INJECTION" = "True" ]] ; then
+        if is_ubuntu; then
+            install_package python-guestfs
+        elif is_fedora || is_suse; then
+            install_package python-libguestfs
+        fi
+    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From 7ebe8e0751dab545091e0b114589087009cc4e22 Mon Sep 17 00:00:00 2001
From: Robert Collins <rbtcollins@hp.com>
Date: Tue, 23 Jun 2015 09:41:21 +1200
Subject: [PATCH 0700/3333] Don't install pbr in a venv

Because PIP_VIRTUAL_ENV was set for the installation of requirements,
and left around in scope, the installation of pbr no longer happened
in a global context, it instead landed inside the virtual
env. Unsetting the variable after requirements install gets us back to
where we expect.

This was an unintended side effect of the requirements-venv patch.

Change-Id: I2c4cb4305fec81a5fd237edabee78874ccd0da22
---
 lib/infra | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/infra b/lib/infra
index 585e9b47bc..3d68e45bd9 100644
--- a/lib/infra
+++ b/lib/infra
@@ -37,6 +37,10 @@ function install_infra {
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
+    # Unset the PIP_VIRTUAL_ENV so that PBR does not end up trapped
+    # down the VENV well
+    unset PIP_VIRTUAL_ENV
+
     # Install pbr
     if use_library_from_git "pbr"; then
         git_clone_by_name "pbr"

From 365d11dfa9fec3b1025c14e38ad3a66f8c79a148 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 23 Jun 2015 11:50:18 +0100
Subject: [PATCH 0701/3333] Ironic: Fix iPXE Connection timed out

This patch fixes the problem of iPXE connection timing out when it's
trying to fetch the configuration files and images from the HTTP server
by accepting requests to HTTP server port on iptables.

Closes-Bug: #1467894
Change-Id: I43d66335a97c376ab64d604ff807540d0decc401
---
 lib/ironic | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/ironic b/lib/ironic
index 4984be1861..ab1915abd6 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -658,6 +658,10 @@ function configure_iptables {
         # agent ramdisk gets instance image from swift
         sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
     fi
+
+    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
+        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
+    fi
 }
 
 function configure_tftpd {

From 010963c677a1c4e558e09afa320595fa5584b329 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 23 Jun 2015 14:16:39 +0100
Subject: [PATCH 0702/3333] Correct logging_context_format_string for Ironic

We should use "tenant" and "user" instead of "project_name" and
"user_name" by calling setup_colorized_logging with these parameters.

Closes-Bug: #1467942
Change-Id: I484ef431ac422e25545391ed41fab45060a7b821
---
 lib/ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 4984be1861..5c8509f98a 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -285,7 +285,7 @@ function configure_ironic {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $IRONIC_CONF_FILE DEFAULT
+        setup_colorized_logging $IRONIC_CONF_FILE DEFAULT tenant user
     fi
 
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]]; then

From 348c6ace71f791034dae19a3467d18cea3140d5a Mon Sep 17 00:00:00 2001
From: gong yong sheng <gong.yongsheng@99cloud.net>
Date: Tue, 23 Jun 2015 14:03:47 +0800
Subject: [PATCH 0703/3333] Use ip route replace to avoid the existing route

Change-Id: I3cc82aca1e3fd26e3beb4baee1f11a9b45e8b9f7
Closes-Bug: 1467762
---
 lib/neutron-legacy | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3ac76a2586..279f6e937b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -721,7 +721,7 @@ function start_neutron_agents {
                 sudo ip addr del $IP dev $PUBLIC_INTERFACE
                 sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
             done
-            sudo route add -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+            sudo ip route replace $FIXED_RANGE via $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
         fi
     fi
 
@@ -1275,7 +1275,7 @@ function _neutron_configure_router_v4 {
             fi
             ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            sudo route add -net $FIXED_RANGE gw $ROUTER_GW_IP
+            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
         fi
         _neutron_set_router_id
     fi
@@ -1310,7 +1310,7 @@ function _neutron_configure_router_v6 {
 
             # Configure interface for public bridge
             sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-            sudo ip -6 route add $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
         fi
         _neutron_set_router_id
     fi

From 7af8a1b9b3180da54e2c9505228ad722db44ca27 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 24 Jun 2015 05:51:54 -0400
Subject: [PATCH 0704/3333] only soft enforce requirements not in projects.txt

We're adding the ability to have devstack plugins, which should be
much more free to require new things not in global requirements. Our
old thinking of locking down all the requirements doesn't really work
in a plugin model.

Instead, if the project is in projects.txt, continue with the old
behavior. If it is not, do a soft update (update all the requirements
we know about, leave the ones we don't). This was previously the SOFT
requirements update mode, but now it will just be the default.

Change-Id: Ic0c6e01a6d7613d712ac9e7e4a378cc3a8ce75e6
---
 inc/python | 16 ++++++----------
 stackrc    | 11 -----------
 2 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/inc/python b/inc/python
index e3c5e61dd2..07a811e8c3 100644
--- a/inc/python
+++ b/inc/python
@@ -216,18 +216,14 @@ function setup_package_with_req_sync {
     local update_requirements=$(cd $project_dir && git diff --exit-code >/dev/null || echo "changed")
 
     if [[ $update_requirements != "changed" ]]; then
-        if [[ "$REQUIREMENTS_MODE" == "soft" ]]; then
-            if is_in_projects_txt $project_dir; then
-                (cd $REQUIREMENTS_DIR; \
-                    ./.venv/bin/python update.py $project_dir)
-            else
-                # soft update projects not found in requirements project.txt
-                (cd $REQUIREMENTS_DIR; \
-                    ./.venv/bin/python update.py -s $project_dir)
-            fi
-        else
+        if is_in_projects_txt $project_dir; then
             (cd $REQUIREMENTS_DIR; \
                 ./.venv/bin/python update.py $project_dir)
+        else
+            # soft update projects not found in requirements project.txt
+            echo "$project_dir not a constrained repository, soft enforcing requirements"
+            (cd $REQUIREMENTS_DIR; \
+                ./.venv/bin/python update.py -s $project_dir)
         fi
     fi
 
diff --git a/stackrc b/stackrc
index 1ac1338f2c..9cd9c053d7 100644
--- a/stackrc
+++ b/stackrc
@@ -149,17 +149,6 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # Zero disables timeouts
 GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 
-# Requirements enforcing mode
-#
-# - strict (default) : ensure all project requirements files match
-#   what's in global requirements.
-#
-# - soft : enforce requirements on everything in
-#   requirements/projects.txt, but do soft updates on all other
-#   repositories (i.e. sync versions for requirements that are in g-r,
-#   but pass through any extras)
-REQUIREMENTS_MODE=${REQUIREMENTS_MODE:-strict}
-
 
 # Repositories
 # ------------

From 442e4e962559479fa0000ad64e6fa34da2c141c8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 24 Jun 2015 13:24:02 -0400
Subject: [PATCH 0705/3333] make test_with_retry a function

We have this pattern of timeout with while tests for a non infinite
while loop condition. It's enough of a pattern that we should probably
extract it into a function to make it more widely used.

Change-Id: I11afcda9fac9709acf2f52d256d6e97644d4727c
---
 functions-common   | 13 +++++++++++++
 lib/neutron-legacy | 12 ++++++------
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index c85052d5b0..061a9356f5 100644
--- a/functions-common
+++ b/functions-common
@@ -1967,6 +1967,19 @@ function stop_service {
     fi
 }
 
+# Test with a finite retry loop.
+#
+function test_with_retry {
+    local testcmd=$1
+    local failmsg=$2
+    local until=${3:-10}
+    local sleep=${4:-0.5}
+
+    if ! timeout $until sh -c "while ! $testcmd; do sleep $sleep; done"; then
+        die $LINENO "$failmsg"
+    fi
+}
+
 
 # Restore xtrace
 $XTRACE
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3ac76a2586..4cfb026ae2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -696,9 +696,10 @@ function start_neutron_service_and_check {
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
     fi
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port; do sleep 1; done"; then
-        die $LINENO "Neutron did not start"
-    fi
+
+    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port"
+    test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
+
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy '*' $Q_PORT $Q_HOST $Q_PORT_INT &
@@ -1380,9 +1381,8 @@ function _ssh_check_neutron {
     local timeout_sec=$5
     local probe_cmd = ""
     probe_cmd=`_get_probe_cmd_prefix $from_net`
-    if ! timeout $timeout_sec sh -c "while ! $probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success; do sleep 1; done"; then
-        die $LINENO "server didn't become ssh-able!"
-    fi
+    local testcmd="$probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success"
+    test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
 }
 
 # Neutron 3rd party programs

From 3bae7d48c0bd283779c206152e6dcfa4c5883521 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sun, 21 Jun 2015 09:56:17 -0500
Subject: [PATCH 0706/3333] Keystone also handle /identity and /identity_admin

When configured to run under Apache Httpd, keystone will also
handle requests on /identity (public) and /identity_admin (admin).

Change-Id: I4e6eb0cad1603aa0e612d0adc5431565da93870e
---
 files/apache-keystone.template | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 0b914e2b8f..6dd1ad9ea6 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -33,3 +33,23 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLCERTFILE%
     %SSLKEYFILE%
 </VirtualHost>
+
+Alias /identity %PUBLICWSGI%
+<Location /identity>
+    SetHandler wsgi-script
+    Options +ExecCGI
+
+    WSGIProcessGroup keystone-public
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
+
+Alias /identity_admin %ADMINWSGI%
+<Location /identity_admin>
+    SetHandler wsgi-script
+    Options +ExecCGI
+
+    WSGIProcessGroup keystone-admin
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>

From b0160d0fa9b20a4c1bda01dda6ffceac6beb9842 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 23 Jun 2015 12:53:51 -0400
Subject: [PATCH 0707/3333] Log all input/output in rootwrap calls

This should make it easier to understand possible interactions between
rootwrap processes calling commands that might be the cause of race
bugs.

Closes-Bug: 1081524
Change-Id: Ic1f1fa42e4478a9d30f0f582a68f648935d0097d
---
 stack.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/stack.sh b/stack.sh
index 0d9d836eca..5b3f2c1183 100755
--- a/stack.sh
+++ b/stack.sh
@@ -212,6 +212,15 @@ is_package_installed sudo || install_package sudo
 sudo grep -q "^#includedir.*/etc/sudoers.d" /etc/sudoers ||
     echo "#includedir /etc/sudoers.d" | sudo tee -a /etc/sudoers
 
+# Conditionally setup detailed logging for sudo
+if [[ -n "$LOG_SUDO" ]]; then
+    TEMPFILE=`mktemp`
+    echo "Defaults log_output" > $TEMPFILE
+    chmod 0440 $TEMPFILE
+    sudo chown root:root $TEMPFILE
+    sudo mv $TEMPFILE /etc/sudoers.d/00_logging
+fi
+
 # Set up DevStack sudoers
 TEMPFILE=`mktemp`
 echo "$STACK_USER ALL=(root) NOPASSWD:ALL" >$TEMPFILE

From 1e3a89eeffc58525c30b8201a552e10776fba423 Mon Sep 17 00:00:00 2001
From: Tomoki Sekine <t-sekine@pd.jp.nec.com>
Date: Thu, 25 Jun 2015 06:35:07 +0900
Subject: [PATCH 0708/3333] Fix typo: where is runs => where it runs

Change-Id: I7dad52c5b5ea91d727bd8ee7253a64422e4ec210
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 8e2e7ffa31..e91012fe2b 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -201,7 +201,7 @@ Enable Logging
 
     | *Defaults: ``LOGFILE="" LOGDAYS=7 LOG_COLOR=True``*
     |  By default ``stack.sh`` output is only written to the console
-       where is runs. It can be sent to a file in addition to the console
+       where it runs. It can be sent to a file in addition to the console
        by setting ``LOGFILE`` to the fully-qualified name of the
        destination log file. A timestamp will be appended to the given
        filename for each run of ``stack.sh``.

From 71947d5fd05c3609417351ab37b9ac24b0eae9ef Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 17 Jun 2015 17:33:02 -0400
Subject: [PATCH 0709/3333] Fixes for Linux Bridge in the L3 agent

Prior to this patch, the logic for configuring the interface used for
the L3 agent was OVS specific. This patch introduces code to correctly
identify the brq device that is used for the L3 agent when using the
Linux Bridge mechanism driver.

Change-Id: I1a36cad0fb790aaa37417a1176576293e4f2c87f
Co-Authored-By: Jens Rosenboom <j.rosenboom@x-ion.de>
---
 lib/neutron-legacy | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4cfb026ae2..ee72b600d7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1267,9 +1267,19 @@ function _neutron_configure_router_v4 {
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3; then
         # Configure and enable public bridge
+        local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            ext_gw_interface=$(_neutron_get_ext_gw_interface)
+        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
+            # Search for the brq device the neutron router and network for $FIXED_RANGE
+            # will be using.
+            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
+            ext_gw_interface=brq${EXT_NET_ID:0:11}
+        fi
+        if [[ "$ext_gw_interface" != "none" ]]; then
             local cidr_len=${FLOATING_RANGE#*/}
+            local testcmd="ip -o link | grep -q $ext_gw_interface"
+            test_with_retry "$testcmd" "$ext_gw_interface creation failed"
             if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up

From 614ca26b47076321e1e06d0d79b9f7c53c5ef259 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 26 Jun 2015 14:45:04 +1000
Subject: [PATCH 0710/3333] Install qemu-kvm package on centos/fedora

Change I79a8d8ac7ad2fbd7d2fce696821d130218e43e03 removed the install
of python-libguestfs, which was actually hiding a dependency issue on
Centos.  The "kvm" package is ultimately missing some bios files from
"seabios-bin" -- however with python-libguestfs installed this was
coming in via a dependency chain that pulled in qemu-kvm, which has
the dependency.

qemu-kvm is not strictly required as all the functionality is within
qemu-system-x86.  But while we get [1] sorted out this restores the
job functionality.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1235890

Change-Id: I3379bc497978befac48c5af0f1035b96d030b7eb
---
 files/rpms/nova                    | 1 +
 lib/nova_plugins/functions-libvirt | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/files/rpms/nova b/files/rpms/nova
index ebd667454a..d32c332dd9 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -10,6 +10,7 @@ iptables
 iputils
 kpartx
 kvm # NOPRIME
+qemu-kvm # NOPRIME
 libvirt-bin # NOPRIME
 libvirt-devel # NOPRIME
 libvirt-python # NOPRIME
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 22b58e0065..5525cfd951 100755
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -34,6 +34,13 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm
+        # there is a dependency issue with kvm (which is really just a
+        # wrapper to qemu-system-x86) that leaves some bios files out,
+        # so install qemu-kvm (which shouldn't strictly be needed, as
+        # everything has been merged into qemu-system-x86) to bring in
+        # the right packages. see
+        # https://bugzilla.redhat.com/show_bug.cgi?id=1235890
+        install_package qemu-kvm
         install_package libvirt libvirt-devel
         pip_install_gr libvirt-python
     fi

From f2a05497a3716b5eaa178b970d5cd2e6db865a97 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Fri, 26 Jun 2015 15:20:54 +0200
Subject: [PATCH 0711/3333] Drop no longer needed and broken check for cinder
 in is_service_enabled

There is properly working is_cinder_enabled now, and this check
actualy matches ironic-inspector, breaking its devstack plugin.

Change-Id: I659ec9b9b2b49690fd075f9766ae8cbf19e81848
Closes-Bug: #1469160
---
 functions-common | 1 -
 1 file changed, 1 deletion(-)

diff --git a/functions-common b/functions-common
index c85052d5b0..9054c335b6 100644
--- a/functions-common
+++ b/functions-common
@@ -1754,7 +1754,6 @@ function is_service_enabled {
         [[ ${service} == n-cell-* && ${ENABLED_SERVICES} =~ "n-cell" ]] && enabled=0
         [[ ${service} == n-cpu-* && ${ENABLED_SERVICES} =~ "n-cpu" ]] && enabled=0
         [[ ${service} == "nova" && ${ENABLED_SERVICES} =~ "n-" ]] && enabled=0
-        [[ ${service} == "cinder" && ${ENABLED_SERVICES} =~ "c-" ]] && enabled=0
         [[ ${service} == "ceilometer" && ${ENABLED_SERVICES} =~ "ceilometer-" ]] && enabled=0
         [[ ${service} == "glance" && ${ENABLED_SERVICES} =~ "g-" ]] && enabled=0
         [[ ${service} == "ironic" && ${ENABLED_SERVICES} =~ "ir-" ]] && enabled=0

From 68e6ae60e70161eb1f359912da42a450070846b6 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 25 Jun 2015 18:15:05 -0500
Subject: [PATCH 0712/3333] Support identity API v3 when generate clouds.yaml

When using IDENTITY_API_VERSION=3, the clouds.yaml must also set
auth/user_domain_id and project_domain_id.

Change-Id: If028f2935ea729276f40039a4003c07c08e91672
---
 tools/update_clouds_yaml.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 08621352ad..3a364fe982 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -43,6 +43,9 @@ def __init__(self, args):
                 'project_name': args.os_project_name,
             },
         }
+        if args.os_identity_api_version == '3':
+            self._cloud_data['auth']['user_domain_id'] = 'default'
+            self._cloud_data['auth']['project_domain_id'] = 'default'
         if args.os_cacert:
             self._cloud_data['cacert'] = args.os_cacert
 

From cef5e40e0c1479f12f78c9dab74dc3100b2f10f7 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 25 Jun 2015 17:57:53 -0500
Subject: [PATCH 0713/3333] Support fernet token provider

Keystone added the "fernet" token provider in Kilo. This adds
support for it.

Change-Id: I6b7342ea67157a40edc8b9ba3d84d118e39d86ed
---
 lib/keystone | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 7a949cf96f..99e31b48f9 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -313,6 +313,8 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
     # Public workers will use the server default, typically number of CPU.
+
+    iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 }
 
 function configure_keystone_extensions {
@@ -476,11 +478,15 @@ function init_keystone {
         $KEYSTONE_BIN_DIR/keystone-manage db_sync --extension "${extension_value}"
     done
 
-    if [[ "$KEYSTONE_TOKEN_FORMAT" != "uuid" ]]; then
+    if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl
         $KEYSTONE_BIN_DIR/keystone-manage pki_setup
     fi
+    if [[ "$KEYSTONE_TOKEN_FORMAT" == "fernet" ]]; then
+        rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
+        $KEYSTONE_BIN_DIR/keystone-manage fernet_setup
+    fi
 }
 
 # install_keystoneclient() - Collect source and prepare

From dcc8a30f2a1cb597ebc609d10d34b45c68c9a74e Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Sat, 27 Jun 2015 12:45:21 +0000
Subject: [PATCH 0714/3333] Be more explicit about jenkins project config

In documentation like this (which is a huge boon) we should strive to be
as explicit and helpful as possible, so this change tries to be more
clear about what a project.yaml is and where one might go to create it
or change it.

Change-Id: Ia66a361fc7d79e511afa3ad903fffb122b86998b
---
 doc/source/plugins.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index b166936a8b..1b6f5e36ed 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -221,7 +221,9 @@ the best practice is to build a dedicated
 ``stackforge/devstack-plugin-FOO`` project.
 
 To enable a plugin to be used in a gate job, the following lines will
-be needed in your project.yaml definition::
+be needed in your ``jenkins/jobs/<project>.yaml`` definition in
+`project-config
+<http://git.openstack.org/cgit/openstack-infra/project-config/>`_::
 
   # Because we are testing a non standard project, add the
   # our project repository. This makes zuul do the right

From 53a8f7c7bc1864a0e63643ebf90e7c66bf3cdeb7 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Sat, 27 Jun 2015 15:07:20 +0100
Subject: [PATCH 0715/3333] Fix typo in installation of vmware virtdriver

The probably got introduced in recent adjustments to cleanup the
virt driver installs.

Change-Id: Ic51411d5bd9b18d395dbdf948c58fea2d53eba0d
---
 lib/ceilometer | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index d7888d9502..ed9b93377e 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -341,7 +341,7 @@ function install_ceilometer {
         fi
 
         if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-            pip_instal_gr oslo.vmware
+            pip_install_gr oslo.vmware
         fi
     fi
 

From 531017cf3e760dc1e9af25684465681277dec8d4 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sat, 27 Jun 2015 03:37:39 +0000
Subject: [PATCH 0716/3333] Add oslo.cache to devstack

as part of the graduation process, add oslo.cache to lib/oslo
and stackrc.

Change-Id: I2baf0384dd5d71d234a95b7acd0bfe5534f2732c
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 3 files changed, 7 insertions(+)

diff --git a/lib/oslo b/lib/oslo
index 554bec8945..be935bbe8c 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -26,6 +26,7 @@ GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
+GITDIR["oslo.cache"]=$DEST/oslo.cache
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.context"]=$DEST/oslo.context
@@ -66,6 +67,7 @@ function install_oslo {
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
+    _do_install_oslo_lib "oslo.cache"
     _do_install_oslo_lib "oslo.concurrency"
     _do_install_oslo_lib "oslo.config"
     _do_install_oslo_lib "oslo.context"
diff --git a/stackrc b/stackrc
index 9cd9c053d7..f2aafe97fc 100644
--- a/stackrc
+++ b/stackrc
@@ -327,6 +327,10 @@ GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-master}
 GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
 GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-master}
 
+# oslo.cache
+GITREPO["oslo.cache"]=${OSLOCACHE_REPO:-${GIT_BASE}/openstack/oslo.cache.git}
+GITBRANCH["oslo.cache"]=${OSLOCACHE_BRANCH:-master}
+
 # oslo.concurrency
 GITREPO["oslo.concurrency"]=${OSLOCON_REPO:-${GIT_BASE}/openstack/oslo.concurrency.git}
 GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index fc6596789b..1f7169c689 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -40,6 +40,7 @@ ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
+ALL_LIBS+=" oslo.cache"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 5c0546e427a02ca7f84eac0894bc84073fa32638 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Fri, 26 Jun 2015 17:43:28 +0900
Subject: [PATCH 0717/3333] Add cleanup for Linuxbridge-agent

Change-Id: I53f445e7f8efd950823f79aca95b9e65d1544ee9
Closes-Bug: #1469609
---
 lib/neutron_plugins/linuxbridge_agent | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 mode change 100644 => 100755 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
old mode 100644
new mode 100755
index b348af9c4f..fefc1c33a8
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -9,6 +9,20 @@ set +o xtrace
 
 function neutron_lb_cleanup {
     sudo brctl delbr $PUBLIC_BRIDGE
+
+    if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then
+        for port in $(sudo brctl show | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
+            sudo ip link delete $port
+        done
+    elif [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vlan" ]]; then
+        for port in $(sudo brctl show | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
+            sudo ip link delete $port
+        done
+    fi
+    for bridge in $(sudo brctl show |grep -o -e brq[0-9a-f\-]*); do
+        sudo ip link set $bridge down
+        sudo brctl delbr $bridge
+    done
 }
 
 function is_neutron_ovs_base_plugin {

From bde24cb7c20a9797eb581a39a9f0839c4951300d Mon Sep 17 00:00:00 2001
From: Anandprakash Dnyaneshwar Tandale <anand.prakash@izeltech.com>
Date: Mon, 29 Jun 2015 15:04:30 +0530
Subject: [PATCH 0718/3333] Fixing the deprecated library function

os.popen() is deprecated since version 2.6. Resolved with use of
    subprocess module.

Change-Id: Ib6a91ee525e2e57d3901d2c0c1b2d1305bc4566f
---
 tools/worlddump.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 7acfb5e97d..0f1a6a1da9 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -23,6 +23,7 @@
 import os.path
 import sys
 
+from subprocess import Popen
 
 def get_options():
     parser = argparse.ArgumentParser(
@@ -46,7 +47,7 @@ def _dump_cmd(cmd):
     print cmd
     print "-" * len(cmd)
     print
-    print os.popen(cmd).read()
+    subprocess.Popen(cmd, shell=True)
 
 
 def _header(name):

From 04c0f0be2643ef95380a7dcf4b510d86ff11cd58 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 30 Jun 2015 13:47:51 +1000
Subject: [PATCH 0719/3333] Move failure trap after functions it uses

Move the failure trap after the functions it uses, so that
"delete_all" is defined when it is triggered.

Change-Id: Icb2465d0f834b8cb2d46dca3c7df4ae06e49d9b5
---
 exercises/neutron-adv-test.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 04892b0e93..a0de4ccd37 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -19,18 +19,6 @@ echo "*********************************************************************"
 
 set -o errtrace
 
-trap failed ERR
-function failed {
-    local r=$?
-    set +o errtrace
-    set +o xtrace
-    echo "Failed to execute"
-    echo "Starting cleanup..."
-    delete_all
-    echo "Finished cleanup"
-    exit $r
-}
-
 # Print the commands being run so that we can see the command that triggers
 # an error.  It is also useful for following allowing as the install occurs.
 set -o xtrace
@@ -441,6 +429,18 @@ function main {
     fi
 }
 
+trap failed ERR
+function failed {
+    local r=$?
+    set +o errtrace
+    set +o xtrace
+    echo "Failed to execute"
+    echo "Starting cleanup..."
+    delete_all
+    echo "Finished cleanup"
+    exit $r
+}
+
 # Kick off script
 # ---------------
 

From 4ffb4541452a95ae964c562c89e31c49e39dbaa7 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 30 Jun 2015 11:00:32 +1000
Subject: [PATCH 0720/3333] Add header guard to functions/functions-common

To avoid sourcing this twice and getting globals mixed up,
particularly when using multiple plugins, add a "header guard" that
ensures we only source it once.

In general I don't think functions/functions-common have been written
or considered to be idempotent.  I don't think going down that path is
going to be a long-term solution as it's easy to break.

Change-Id: Idca49eb996d2b7ff3779ec27ed672a2da7852590
Closes-Bug: #1469178
---
 functions        | 4 ++++
 functions-common | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/functions b/functions
index 1668e16b6d..e4aea677d6 100644
--- a/functions
+++ b/functions
@@ -10,6 +10,10 @@
 # - ``GLANCE_HOSTPORT``
 #
 
+# ensure we don't re-source this in the same environment
+[[ -z "$_DEVSTACK_FUNCTIONS" ]] || return 0
+declare -r _DEVSTACK_FUNCTIONS=1
+
 # Include the common functions
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source ${FUNC_DIR}/functions-common
diff --git a/functions-common b/functions-common
index 061a9356f5..5f22bf0c6d 100644
--- a/functions-common
+++ b/functions-common
@@ -36,6 +36,10 @@
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
+# ensure we don't re-source this in the same environment
+[[ -z "$_DEVSTACK_FUNCTIONS_COMMON" ]] || return 0
+declare -r _DEVSTACK_FUNCTIONS_COMMON=1
+
 # Global Config Variables
 declare -A GITREPO
 declare -A GITBRANCH

From 432268b17bff090a8ea8cbbd46c430ddd5be98a1 Mon Sep 17 00:00:00 2001
From: Amey Bhide <abhide@vmware.com>
Date: Tue, 30 Jun 2015 11:39:05 -0700
Subject: [PATCH 0721/3333] Fix NameError in worlddump.py

Change-Id: Ie87e5b5ead777c0153ed7fa5d1db5cc1ae444261
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 0f1a6a1da9..628a69f7e5 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -47,7 +47,7 @@ def _dump_cmd(cmd):
     print cmd
     print "-" * len(cmd)
     print
-    subprocess.Popen(cmd, shell=True)
+    Popen(cmd, shell=True)
 
 
 def _header(name):

From 77a7d11dfa828468f27bce5456d11a9827473b20 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 22 Jun 2015 16:44:13 -0400
Subject: [PATCH 0722/3333] Add new oslo libraries

Full list for liberty is as follows:
* oslo.service
* oslo.reports
* automaton
* futurist

oslo.cache was already added in the earlier review

Some of the entries are already there, though automaton was
missing in one spot. Made sure all references have all five
libraries.

Change-Id: Iffb720d46058424924469695a3ae1e4f20655f99
---
 lib/oslo                     | 3 +++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index be935bbe8c..123572cd7b 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -36,6 +36,7 @@ GITDIR["oslo.log"]=$DEST/oslo.log
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
 GITDIR["oslo.middleware"]=$DEST/oslo.middleware
 GITDIR["oslo.policy"]=$DEST/oslo.policy
+GITDIR["oslo.reports"]=$DEST/oslo.reports
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
 GITDIR["oslo.service"]=$DEST/oslo.service
@@ -64,6 +65,7 @@ function _do_install_oslo_lib {
 
 # install_oslo() - Collect source and prepare
 function install_oslo {
+    _do_install_oslo_lib "automaton"
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
@@ -77,6 +79,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.messaging"
     _do_install_oslo_lib "oslo.middleware"
     _do_install_oslo_lib "oslo.policy"
+    _do_install_oslo_lib "oslo.reports"
     _do_install_oslo_lib "oslo.rootwrap"
     _do_install_oslo_lib "oslo.serialization"
     _do_install_oslo_lib "oslo.service"
diff --git a/stackrc b/stackrc
index f2aafe97fc..3f56151b00 100644
--- a/stackrc
+++ b/stackrc
@@ -367,6 +367,10 @@ GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-master}
 GITREPO["oslo.policy"]=${OSLOPOLICY_REPO:-${GIT_BASE}/openstack/oslo.policy.git}
 GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-master}
 
+# oslo.reports
+GITREPO["oslo.reports"]=${OSLOREPORTS_REPO:-${GIT_BASE}/openstack/oslo.reports.git}
+GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-master}
+
 # oslo.rootwrap
 GITREPO["oslo.rootwrap"]=${OSLORWRAP_REPO:-${GIT_BASE}/openstack/oslo.rootwrap.git}
 GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 1f7169c689..b3b38e6baf 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -40,7 +40,7 @@ ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
-ALL_LIBS+=" oslo.cache"
+ALL_LIBS+=" oslo.cache oslo.reports"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 99440f9d596668724690d9091e0a5def1d7f1d6d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 1 Jul 2015 06:14:01 +1000
Subject: [PATCH 0723/3333] Wait for command in worlddump

Wait for the command to complete and catch errors when running
commands.

Change-Id: I2c93b3bdd930ed8564e33bd2d45fe4e3f08f03f5
---
 tools/worlddump.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 628a69f7e5..0a9f810877 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -21,9 +21,9 @@
 import fnmatch
 import os
 import os.path
+import subprocess
 import sys
 
-from subprocess import Popen
 
 def get_options():
     parser = argparse.ArgumentParser(
@@ -47,7 +47,10 @@ def _dump_cmd(cmd):
     print cmd
     print "-" * len(cmd)
     print
-    Popen(cmd, shell=True)
+    try:
+        subprocess.check_call(cmd, shell=True)
+    except subprocess.CalledProcessError:
+        print "*** Failed to run: %s" % cmd
 
 
 def _header(name):

From 3a9df1dab73e2cb2f27dd014543ab16f22ac3846 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 1 Jul 2015 06:18:47 +1000
Subject: [PATCH 0724/3333] Check for nova-compute before running kill

Unconditionally running this can lead to confusing failure output from
kill as the pgrep matches nothing when nova-compute isn't yet running.

Change-Id: I37cb84fe8e0b393f49b8907af16a3e44f82c46a6
---
 tools/worlddump.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 0a9f810877..e4ba02b51c 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -112,6 +112,13 @@ def compute_consoles():
 
 def guru_meditation_report():
     _header("nova-compute Guru Meditation Report")
+
+    try:
+        subprocess.check_call(["pgrep","nova-compute"])
+    except subprocess.CalledProcessError:
+        print "Skipping as nova-compute does not appear to be running"
+        return
+
     _dump_cmd("kill -s USR1 `pgrep nova-compute`")
     print "guru meditation report in nova-compute log"
 

From 5c7f39fdcd29a74c402840021ca55f47c359fbf1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 1 Jul 2015 06:29:27 +1000
Subject: [PATCH 0725/3333] Add worlddump unit test

Add a worlddump unit test to avoid simple breakages

Change-Id: I6b87d4dbe22da2c1ca5ceb13134e9bb570f5cef2
---
 tests/test_worlddump.sh | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100755 tests/test_worlddump.sh

diff --git a/tests/test_worlddump.sh b/tests/test_worlddump.sh
new file mode 100755
index 0000000000..f407d407c0
--- /dev/null
+++ b/tests/test_worlddump.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# Simple test of worlddump.py
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+source $TOP/tests/unittest.sh
+
+OUT_DIR=$(mktemp -d)
+
+$TOP/tools/worlddump.py -d $OUT_DIR
+
+if [[ $? -ne 0 ]]; then
+    fail "worlddump failed"
+else
+
+    # worlddump creates just one output file
+    OUT_FILE=($OUT_DIR/*.txt)
+
+    if [ ! -r $OUT_FILE ]; then
+        failed "worlddump output not seen"
+    else
+        passed "worlddump output $OUT_FILE"
+
+        if [[ $(stat -c %s $OUT_DIR/*.txt) -gt 0 ]]; then
+            passed "worlddump output is not zero sized"
+        fi
+
+        # put more extensive examination here, if required.
+    fi
+fi
+
+rm -rf $OUT_DIR
+
+report_results

From f750a6fedbb34399e1ee4dd540c13028d53c0e13 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 1 Jul 2015 12:17:35 +0200
Subject: [PATCH 0726/3333] Already dead process tolerance in unstack.sh

The gate/updown.sh calls the unstack.sh with
-ex option. Normally we do not use -e with unstack.sh.

The unstack.sh can fail if the service already stopped,
and it also can have flaky failures on the gate.

For example the stop_swift function tries to kill swift in two
different ways, and if the first one succeeds before the 2th attempt
the pkill fails the whole unstack.sh.

This change accepts kill failure.
Normally the kill can fail if the process does not exits,
or when you do not have permission to the kill operation.

Since the permission issue is very unlikely in our case,
this change does not tries to distinguish the two operation.

The behavior of the unstack.sh wen you are not using -ex should
not be changed by this change.

Change-Id: I64bf3cbe1b60c96f5b271dcfb620c3d4b50de26b
---
 functions-common                          | 2 +-
 lib/neutron_plugins/services/loadbalancer | 2 +-
 lib/swift                                 | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 6ab567a4c6..f122e56f98 100644
--- a/functions-common
+++ b/functions-common
@@ -1342,7 +1342,7 @@ function screen_stop_service {
 
     if is_service_enabled $service; then
         # Clean up the screen window
-        screen -S $SCREEN_NAME -p $service -X kill
+        screen -S $SCREEN_NAME -p $service -X kill || true
     fi
 }
 
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index f465cc94b4..34190f9a56 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -42,7 +42,7 @@ function neutron_agent_lbaas_configure_agent {
 
 function neutron_lbaas_stop {
     pids=$(ps aux | awk '/haproxy/ { print $2 }')
-    [ ! -z "$pids" ] && sudo kill $pids
+    [ ! -z "$pids" ] && sudo kill $pids || true
 }
 
 # Restore xtrace
diff --git a/lib/swift b/lib/swift
index 0cd51aaddf..5b73981ed2 100644
--- a/lib/swift
+++ b/lib/swift
@@ -772,7 +772,7 @@ function stop_swift {
         stop_process s-${type}
     done
     # Blast out any stragglers
-    pkill -f swift-
+    pkill -f swift- || true
 }
 
 function swift_configure_tempurls {

From 2ba4a7214c96542987e1c379a28765a242136b12 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 26 Jun 2015 10:45:44 +0200
Subject: [PATCH 0727/3333] Fixed detection of a project in projects.txt

Before the fix, requirements soft-update was used for projects that are
in the file.

Change-Id: I095d42521f54b45a6b13837e2f8375fa04532faa
Closes-Bug: #1469067
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 07a811e8c3..9a7cea0a07 100644
--- a/inc/python
+++ b/inc/python
@@ -195,7 +195,7 @@ function setup_develop {
 function is_in_projects_txt {
     local project_dir=$1
     local project_name=$(basename $project_dir)
-    return grep "/$project_name\$" $REQUIREMENTS_DIR/projects.txt >/dev/null
+    grep -q "/$project_name\$" $REQUIREMENTS_DIR/projects.txt
 }
 
 # ``pip install -e`` the package, which processes the dependencies

From 3381e09f72e7edbf39080893212b533b8e01a3a9 Mon Sep 17 00:00:00 2001
From: Sergey Lukjanov <slukjanov@mirantis.com>
Date: Wed, 1 Jul 2015 14:20:23 +0300
Subject: [PATCH 0728/3333] Move Sahara into in-tree plugin

Once the Sahara related code moved to Sahara repo and used, we can
remove Sahara specific code from Devstack.

Partial-Implements: bp sahara-devstack-intree

Change-Id: I34412b5cb2e86944b8555b8fd04b43556eb2bbe6
Depends-on: I2e00b2ebc59dd3be6a0539dea2985f2e801a1bd7
Depends-on: I07c3fede473030e8a110cbf5a08309f890905abf
---
 MAINTAINERS.rst                |   5 -
 doc/source/index.rst           |   3 -
 doc/source/plugin-registry.rst |   2 +
 exercises/sahara.sh            |  49 -------
 extras.d/70-sahara.sh          |  29 ----
 lib/sahara                     | 259 ---------------------------------
 stack.sh                       |   2 +-
 stackrc                        |   8 -
 tests/test_libs_from_pypi.sh   |   2 +-
 9 files changed, 4 insertions(+), 355 deletions(-)
 delete mode 100755 exercises/sahara.sh
 delete mode 100644 extras.d/70-sahara.sh
 delete mode 100644 lib/sahara

diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index eeb1f21b61..d4968a6051 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -63,11 +63,6 @@ OpenFlow Agent (ofagent)
 * YAMAMOTO Takashi <yamamoto@valinux.co.jp>
 * Fumihiko Kakuma <kakuma@valinux.co.jp>
 
-Sahara
-~~~~~~
-
-* Sergey Lukjanov <slukjanov@mirantis.com>
-
 Swift
 ~~~~~
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index f15c3060e7..2dd0241fba 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -170,7 +170,6 @@ Scripts
 * `lib/nova <lib/nova.html>`__
 * `lib/oslo <lib/oslo.html>`__
 * `lib/rpc\_backend <lib/rpc_backend.html>`__
-* `lib/sahara <lib/sahara.html>`__
 * `lib/swift <lib/swift.html>`__
 * `lib/tempest <lib/tempest.html>`__
 * `lib/tls <lib/tls.html>`__
@@ -181,7 +180,6 @@ Scripts
 
 * `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
-* `extras.d/70-sahara.sh <extras.d/70-sahara.sh.html>`__
 * `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
 * `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
@@ -238,7 +236,6 @@ Exercises
 * `exercises/floating\_ips.sh <exercises/floating_ips.sh.html>`__
 * `exercises/horizon.sh <exercises/horizon.sh.html>`__
 * `exercises/neutron-adv-test.sh <exercises/neutron-adv-test.sh.html>`__
-* `exercises/sahara.sh <exercises/sahara.sh.html>`__
 * `exercises/sec\_groups.sh <exercises/sec_groups.sh.html>`__
 * `exercises/swift.sh <exercises/swift.sh.html>`__
 * `exercises/volumes.sh <exercises/volumes.sh.html>`__
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2dd70d84e9..c5c4e1eaa5 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -22,6 +22,8 @@ The following are plugins that exist for official OpenStack projects.
 +--------------------+-------------------------------------------+--------------------+
 |magnum              |git://git.openstack.org/openstack/magnum   |                    |
 +--------------------+-------------------------------------------+--------------------+
+|sahara              |git://git.openstack.org/openstack/sahara   |                    |
++--------------------+-------------------------------------------+--------------------+
 |trove               |git://git.openstack.org/openstack/trove    |                    |
 +--------------------+-------------------------------------------+--------------------+
 |zaqar               |git://git.openstack.org/openstack/zarar    |                    |
diff --git a/exercises/sahara.sh b/exercises/sahara.sh
deleted file mode 100755
index 8cad94562d..0000000000
--- a/exercises/sahara.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-
-# **sahara.sh**
-
-# Sanity check that Sahara started if enabled
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-is_service_enabled sahara || exit 55
-
-if is_ssl_enabled_service "sahara" || is_service_enabled tls-proxy; then
-    SAHARA_SERVICE_PROTOCOL="https"
-fi
-
-SAHARA_SERVICE_PROTOCOL=${SAHARA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-
-$CURL_GET $SAHARA_SERVICE_PROTOCOL://$SERVICE_HOST:8386/ 2>/dev/null | grep -q 'Auth' || die $LINENO "Sahara API isn't functioning!"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/extras.d/70-sahara.sh b/extras.d/70-sahara.sh
deleted file mode 100644
index f177766d3b..0000000000
--- a/extras.d/70-sahara.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-# sahara.sh - DevStack extras script to install Sahara
-
-if is_service_enabled sahara; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/sahara
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing sahara"
-        install_sahara
-        install_python_saharaclient
-        cleanup_sahara
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring sahara"
-        configure_sahara
-        create_sahara_accounts
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        echo_summary "Initializing sahara"
-        sahara_register_images
-        start_sahara
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_sahara
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        cleanup_sahara
-    fi
-fi
diff --git a/lib/sahara b/lib/sahara
deleted file mode 100644
index 51e431afc7..0000000000
--- a/lib/sahara
+++ /dev/null
@@ -1,259 +0,0 @@
-#!/bin/bash
-#
-# lib/sahara
-
-# Dependencies:
-# ``functions`` file
-# ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# install_sahara
-# install_python_saharaclient
-# configure_sahara
-# sahara_register_images
-# start_sahara
-# stop_sahara
-# cleanup_sahara
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default repos
-
-# Set up default directories
-GITDIR["python-saharaclient"]=$DEST/python-saharaclient
-SAHARA_DIR=$DEST/sahara
-
-SAHARA_CONF_DIR=${SAHARA_CONF_DIR:-/etc/sahara}
-SAHARA_CONF_FILE=${SAHARA_CONF_DIR}/sahara.conf
-
-if is_ssl_enabled_service "sahara" || is_service_enabled tls-proxy; then
-    SAHARA_SERVICE_PROTOCOL="https"
-fi
-SAHARA_SERVICE_HOST=${SAHARA_SERVICE_HOST:-$SERVICE_HOST}
-SAHARA_SERVICE_PORT=${SAHARA_SERVICE_PORT:-8386}
-SAHARA_SERVICE_PORT_INT=${SAHARA_SERVICE_PORT_INT:-18386}
-SAHARA_SERVICE_PROTOCOL=${SAHARA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-
-SAHARA_AUTH_CACHE_DIR=${SAHARA_AUTH_CACHE_DIR:-/var/cache/sahara}
-
-SAHARA_ENABLED_PLUGINS=${SAHARA_ENABLED_PLUGINS:-vanilla,hdp,cdh,spark,fake}
-
-# Support entry points installation of console scripts
-if [[ -d $SAHARA_DIR/bin ]]; then
-    SAHARA_BIN_DIR=$SAHARA_DIR/bin
-else
-    SAHARA_BIN_DIR=$(get_python_exec_prefix)
-fi
-
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,sahara
-
-# Functions
-# ---------
-
-# create_sahara_accounts() - Set up common required sahara accounts
-#
-# Tenant      User       Roles
-# ------------------------------
-# service     sahara    admin
-function create_sahara_accounts {
-
-    create_service_user "sahara"
-
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        # TODO: remove "data_processing" service when #1356053 will be fixed
-        local sahara_service_old=$(openstack service create \
-            "data_processing" \
-            --name "sahara" \
-            --description "Sahara Data Processing" \
-            -f value -c id
-        )
-        local sahara_service_new=$(openstack service create \
-            "data-processing" \
-            --name "sahara" \
-            --description "Sahara Data Processing" \
-            -f value -c id
-        )
-        get_or_create_endpoint $sahara_service_old \
-            "$REGION_NAME" \
-            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
-            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
-            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s"
-        get_or_create_endpoint $sahara_service_new \
-            "$REGION_NAME" \
-            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
-            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s" \
-            "$SAHARA_SERVICE_PROTOCOL://$SAHARA_SERVICE_HOST:$SAHARA_SERVICE_PORT/v1.1/\$(tenant_id)s"
-    fi
-}
-
-# cleanup_sahara() - Remove residual data files, anything left over from
-# previous runs that would need to clean up.
-function cleanup_sahara {
-
-    # Cleanup auth cache dir
-    sudo rm -rf $SAHARA_AUTH_CACHE_DIR
-}
-
-# configure_sahara() - Set config files, create data dirs, etc
-function configure_sahara {
-    sudo install -d -o $STACK_USER $SAHARA_CONF_DIR
-
-    if [[ -f $SAHARA_DIR/etc/sahara/policy.json ]]; then
-        cp -p $SAHARA_DIR/etc/sahara/policy.json $SAHARA_CONF_DIR
-    fi
-
-    # Create auth cache dir
-    sudo install -d -o $STACK_USER -m 700 $SAHARA_AUTH_CACHE_DIR
-    rm -rf $SAHARA_AUTH_CACHE_DIR/*
-
-    configure_auth_token_middleware $SAHARA_CONF_FILE sahara $SAHARA_AUTH_CACHE_DIR
-
-    iniset_rpc_backend sahara $SAHARA_CONF_FILE DEFAULT
-
-    # Set configuration to send notifications
-
-    if is_service_enabled ceilometer; then
-        iniset $SAHARA_CONF_FILE DEFAULT enable_notifications "true"
-        iniset $SAHARA_CONF_FILE DEFAULT notification_driver "messaging"
-    fi
-
-    iniset $SAHARA_CONF_FILE DEFAULT verbose True
-    iniset $SAHARA_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-
-    iniset $SAHARA_CONF_FILE DEFAULT plugins $SAHARA_ENABLED_PLUGINS
-
-    iniset $SAHARA_CONF_FILE database connection `database_connection_url sahara`
-
-    if is_service_enabled neutron; then
-        iniset $SAHARA_CONF_FILE DEFAULT use_neutron true
-
-        if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
-            iniset $SAHARA_CONF_FILE neutron ca_file $SSL_BUNDLE_FILE
-        fi
-    else
-        iniset $SAHARA_CONF_FILE DEFAULT use_neutron false
-    fi
-
-    if is_service_enabled heat; then
-        iniset $SAHARA_CONF_FILE DEFAULT infrastructure_engine heat
-
-        if is_ssl_enabled_service "heat" || is_service_enabled tls-proxy; then
-            iniset $SAHARA_CONF_FILE heat ca_file $SSL_BUNDLE_FILE
-        fi
-    else
-        iniset $SAHARA_CONF_FILE DEFAULT infrastructure_engine direct
-    fi
-
-    if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
-        iniset $SAHARA_CONF_FILE cinder ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
-        iniset $SAHARA_CONF_FILE nova ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "swift" || is_service_enabled tls-proxy; then
-        iniset $SAHARA_CONF_FILE swift ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
-        iniset $SAHARA_CONF_FILE keystone ca_file $SSL_BUNDLE_FILE
-    fi
-
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service sahara; then
-        ensure_certificates SAHARA
-
-        iniset $SAHARA_CONF_FILE ssl cert_file "$SAHARA_SSL_CERT"
-        iniset $SAHARA_CONF_FILE ssl key_file "$SAHARA_SSL_KEY"
-    fi
-
-    iniset $SAHARA_CONF_FILE DEFAULT use_syslog $SYSLOG
-
-    # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $SAHARA_CONF_FILE DEFAULT
-    fi
-
-    if is_service_enabled tls-proxy; then
-        # Set the service port for a proxy to take the original
-        iniset $SAHARA_CONF_FILE DEFAULT port $SAHARA_SERVICE_PORT_INT
-    fi
-
-    recreate_database sahara
-    $SAHARA_BIN_DIR/sahara-db-manage --config-file $SAHARA_CONF_FILE upgrade head
-}
-
-# install_sahara() - Collect source and prepare
-function install_sahara {
-    git_clone $SAHARA_REPO $SAHARA_DIR $SAHARA_BRANCH
-    setup_develop $SAHARA_DIR
-}
-
-# install_python_saharaclient() - Collect source and prepare
-function install_python_saharaclient {
-    if use_library_from_git "python-saharaclient"; then
-        git_clone_by_name "python-saharaclient"
-        setup_dev_lib "python-saharaclient"
-    fi
-}
-
-# sahara_register_images() - Registers images in sahara image registry
-function sahara_register_images {
-    if is_service_enabled heat && [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
-        # Register heat image for Fake plugin
-        local fake_plugin_properties="--property _sahara_tag_0.1=True"
-        fake_plugin_properties+=" --property _sahara_tag_fake=True"
-        fake_plugin_properties+=" --property _sahara_username=fedora"
-        openstack --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image set $(basename "$HEAT_CFN_IMAGE_URL" ".qcow2") $fake_plugin_properties
-    fi
-}
-
-# start_sahara() - Start running processes, including screen
-function start_sahara {
-    local service_port=$SAHARA_SERVICE_PORT
-    local service_protocol=$SAHARA_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        service_port=$SAHARA_SERVICE_PORT_INT
-        service_protocol="http"
-    fi
-
-    run_process sahara "$SAHARA_BIN_DIR/sahara-all --config-file $SAHARA_CONF_FILE"
-    run_process sahara-api "$SAHARA_BIN_DIR/sahara-api --config-file $SAHARA_CONF_FILE"
-    run_process sahara-eng "$SAHARA_BIN_DIR/sahara-engine --config-file $SAHARA_CONF_FILE"
-
-    echo "Waiting for Sahara to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$SAHARA_SERVICE_HOST:$service_port; then
-        die $LINENO "Sahara did not start"
-    fi
-
-    # Start proxies if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $SAHARA_SERVICE_PORT $SAHARA_SERVICE_HOST $SAHARA_SERVICE_PORT_INT &
-    fi
-}
-
-# stop_sahara() - Stop running processes
-function stop_sahara {
-    # Kill the Sahara screen windows
-    stop_process sahara
-    stop_process sahara-api
-    stop_process sahara-eng
-}
-
-
-# Restore xtrace
-$XTRACE
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/stack.sh b/stack.sh
index 591c0dc614..1f355e539b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -505,7 +505,7 @@ source $TOP_DIR/lib/rpc_backend
 check_rpc_backend
 
 # Service to enable with SSL if ``USE_SSL`` is True
-SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron,sahara"
+SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron"
 
 if is_service_enabled tls-proxy && [ "$USE_SSL" == "True" ]; then
     die $LINENO "tls-proxy and SSL are mutually exclusive"
diff --git a/stackrc b/stackrc
index f2aafe97fc..91eef07fe1 100644
--- a/stackrc
+++ b/stackrc
@@ -225,10 +225,6 @@ NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}
 
-# data processing service
-SAHARA_REPO=${SAHARA_REPO:-${GIT_BASE}/openstack/sahara.git}
-SAHARA_BRANCH=${SAHARA_BRANCH:-master}
-
 # object storage service
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
 SWIFT_BRANCH=${SWIFT_BRANCH:-master}
@@ -290,10 +286,6 @@ GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
 GITREPO["python-novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
 GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-master}
 
-# python saharaclient
-GITREPO["python-saharaclient"]=${SAHARACLIENT_REPO:-${GIT_BASE}/openstack/python-saharaclient.git}
-GITBRANCH["python-saharaclient"]=${SAHARACLIENT_BRANCH:-master}
-
 # python swift client library
 GITREPO["python-swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
 GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 1f7169c689..5532347848 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -35,7 +35,7 @@ ALL_LIBS+=" python-glanceclient python-ironicclient tempest-lib"
 ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
-ALL_LIBS+=" oslo.serialization python-saharaclient django_openstack_auth"
+ALL_LIBS+=" oslo.serialization django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"

From 99970389925f8fb79d55d1a2e00a2d0407f76580 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 1 Jul 2015 11:28:32 -0500
Subject: [PATCH 0729/3333] Replace RPC Backend text in README

Review https://review.openstack.org/#/c/192154/ removed support for RPC backends
other than RabbitMQ, but we should still document how to disable rabbit.

Change-Id: I1fd64b5f02573c58d7b0d1005c39a22c459a09a5
---
 README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/README.md b/README.md
index ebcb0184e5..750190b716 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,16 @@ following in the `localrc` section:
 
 `mysql` is the default database.
 
+# RPC Backend
+
+Support for a RabbitMQ RPC backend is included. Additional RPC backends may
+be available via external plugins.  Enabling or disabling RabbitMQ is handled
+via the usual service functions and ``ENABLED_SERVICES``.
+
+Example disabling RabbitMQ in ``local.conf``:
+
+    disable_service rabbit
+
 # Apache Frontend
 
 Apache web server can be enabled for wsgi services that support being deployed

From e57a33224bcc8a22b4c64be2a7e3b7e784a2536a Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sat, 20 Jun 2015 14:48:00 -0700
Subject: [PATCH 0730/3333] Set compute-feature-enabled.attach_encrypted_volume
 Tempest option

This allows setting the new option in Tempest for toggling whether
or not the Cinder encrypted volume tests should run.

Depends-On: I48eba7c645cc1c979fd766ae9c05efb00957f787

Related-Bug: #1463525

Change-Id: I9e12f8dc9e3e6b68dc031351cb081ee2bc6e6cbb
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 5ea217f869..a84ade2a81 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -379,6 +379,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
     # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_paused_instances True
+    iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0

From a709b11a533c40bee910b8a4a4c9d102fab004cc Mon Sep 17 00:00:00 2001
From: Assaf Muller <amuller@redhat.com>
Date: Wed, 1 Jul 2015 18:19:11 -0400
Subject: [PATCH 0731/3333] Update Neutron section in README

Change-Id: Ic4b354a587a1d5f83037fb5250e8e5c9cfe6d48c
---
 README.md | 37 ++++++++++++++-----------------------
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/README.md b/README.md
index 455e1c69c6..cd83dd8292 100644
--- a/README.md
+++ b/README.md
@@ -193,7 +193,7 @@ services are started in background and managed by `swift-init` tool.
 
 Basic Setup
 
-In order to enable Neutron a single node setup, you'll need the
+In order to enable Neutron in a single node setup, you'll need the
 following settings in your `local.conf`:
 
     disable_service n-net
@@ -203,47 +203,38 @@ following settings in your `local.conf`:
     enable_service q-l3
     enable_service q-meta
     enable_service q-metering
-    # Optional, to enable tempest configuration as part of DevStack
-    enable_service tempest
 
 Then run `stack.sh` as normal.
 
 DevStack supports setting specific Neutron configuration flags to the
-service, Open vSwitch plugin and LinuxBridge plugin configuration files.
-To make use of this feature, the settings can be added to ``local.conf``.
-The old ``Q_XXX_EXTRA_XXX_OPTS`` variables are deprecated and will be removed
-in the near future.  The ``local.conf`` headers for the replacements are:
-
-* ``Q_SRV_EXTRA_OPTS``:
+service, ML2 plugin, DHCP and L3 configuration files:
 
     [[post-config|/$Q_PLUGIN_CONF_FILE]]
-    [linuxbridge]   # or [ovs]
+    [ml2]
+    mechanism_drivers=openvswitch,l2population
 
-Example extra config in `local.conf`:
+    [[post-config|$NEUTRON_CONF]]
+    [DEFAULT]
+    quota_port=42
 
-    [[post-config|/$Q_PLUGIN_CONF_FILE]]
-    [agent]
-    tunnel_type=vxlan
-    vxlan_udp_port=8472
+    [[post-config|$Q_L3_CONF_FILE]]
+    [DEFAULT]
+    agent_mode=legacy
 
-    [[post-config|$NEUTRON_CONF]]
+    [[post-config|$Q_DHCP_CONF_FILE]]
     [DEFAULT]
-    tenant_network_type=vxlan
+    dnsmasq_dns_servers = 8.8.8.8,8.8.4.4
 
-DevStack also supports configuring the Neutron ML2 plugin. The ML2 plugin
-can run with the OVS, LinuxBridge, or Hyper-V agents on compute hosts. This
-is a simple way to configure the ml2 plugin:
+The ML2 plugin can run with the OVS, LinuxBridge, or Hyper-V agents on compute
+hosts. This is a simple way to configure the ml2 plugin:
 
     # VLAN configuration
-    Q_PLUGIN=ml2
     ENABLE_TENANT_VLANS=True
 
     # GRE tunnel configuration
-    Q_PLUGIN=ml2
     ENABLE_TENANT_TUNNELS=True
 
     # VXLAN tunnel configuration
-    Q_PLUGIN=ml2
     Q_ML2_TENANT_NETWORK_TYPE=vxlan
 
 The above will default in DevStack to using the OVS on each compute host.

From 635a5ba9929e1594aacfc0229663f43898479e2a Mon Sep 17 00:00:00 2001
From: Robert Collins <rbtcollins@hp.com>
Date: Wed, 10 Jun 2015 08:48:06 +1200
Subject: [PATCH 0732/3333] constraints file support for devstack.

Constraints files allow a global view of dependencies for devstack
without the side effect that requirements files have of installing
everything everytime. This is part of the cross project
requirements-management spec.

Change-Id: If089d30146629e6cf817edd634e5c2b80f1366dd
---
 inc/python | 22 ++++++++++++++++++----
 stack.sh   |  3 +++
 stackrc    |  6 ++++++
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/inc/python b/inc/python
index 07a811e8c3..ca185f05d2 100644
--- a/inc/python
+++ b/inc/python
@@ -66,7 +66,8 @@ function pip_install_gr {
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
-# ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``
+# ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
+# ``USE_CONSTRAINTS``
 # pip_install package [package ...]
 function pip_install {
     local xtrace=$(set +o | grep xtrace)
@@ -103,6 +104,13 @@ function pip_install {
         fi
     fi
 
+    cmd_pip="$cmd_pip install"
+
+    # Handle a constraints file, if needed.
+    if [[ "$USE_CONSTRAINTS" == "True" ]]; then
+        cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
+    fi
+
     local pip_version=$(python -c "import pip; \
                         print(pip.__version__.strip('.')[0])")
     if (( pip_version<6 )); then
@@ -116,7 +124,7 @@ function pip_install {
         https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
-        $cmd_pip install $upgrade \
+        $cmd_pip $upgrade \
         $@
 
     # Also install test requirements
@@ -128,7 +136,7 @@ function pip_install {
             https_proxy=${https_proxy:-} \
             no_proxy=${no_proxy:-} \
             PIP_FIND_LINKS=$PIP_FIND_LINKS \
-            $cmd_pip install $upgrade \
+            $cmd_pip $upgrade \
             -r $test_req
     fi
 }
@@ -215,7 +223,7 @@ function setup_package_with_req_sync {
     # ``errexit`` requires us to trap the exit code when the repo is changed
     local update_requirements=$(cd $project_dir && git diff --exit-code >/dev/null || echo "changed")
 
-    if [[ $update_requirements != "changed" ]]; then
+    if [[ $update_requirements != "changed" && "$USE_CONSTRAINTS" == "False" ]]; then
         if is_in_projects_txt $project_dir; then
             (cd $REQUIREMENTS_DIR; \
                 ./.venv/bin/python update.py $project_dir)
@@ -227,6 +235,12 @@ function setup_package_with_req_sync {
         fi
     fi
 
+    if [ -n "$REQUIREMENTS_DIR" ]; then
+        # Constrain this package to this project directory from here on out.
+        local name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
+        $REQUIREMENTS_DIR/.venv/bin/edit-constraints $REQUIREMENTS_DIR/upper-constraints.txt -- $name "$flags $project_dir"
+    fi
+
     setup_package $project_dir $flags
 
     # We've just gone and possibly modified the user's source tree in an
diff --git a/stack.sh b/stack.sh
index 591c0dc614..4069509e96 100755
--- a/stack.sh
+++ b/stack.sh
@@ -683,6 +683,9 @@ save_stackenv $LINENO
 echo_summary "Installing package prerequisites"
 source $TOP_DIR/tools/install_prereqs.sh
 
+# Normalise USE_CONSTRAINTS
+USE_CONSTRAINTS=$(trueorfalse False USE_CONSTRAINTS)
+
 # Configure an appropriate Python environment
 if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
diff --git a/stackrc b/stackrc
index f2aafe97fc..e76abc0e85 100644
--- a/stackrc
+++ b/stackrc
@@ -149,6 +149,12 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # Zero disables timeouts
 GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 
+# Constraints mode
+# - False (default) : update git projects dependencies from global-requirements.
+#
+# - True : use upper-constraints.txt to constrain versions of packages intalled
+#          and do not edit projects at all.
+USE_CONSTRAINTS=${USE_CONSTRAINTS:-False}
 
 # Repositories
 # ------------

From 0ffdb368a65d4e1532aba14c82c8b91e30db0acd Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 2 Jul 2015 09:09:51 -0500
Subject: [PATCH 0733/3333] Move USE_CONSTRAINTS normalization back to stackrc

stackrc needs to do all of the initialization for situations (Grenade,
unstack.sh, etc) that do not run stack.sh

Change-Id: Ib8c7b923dde817b37f852515dd049fcf970b999a
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index e76abc0e85..c59d0a4a20 100644
--- a/stackrc
+++ b/stackrc
@@ -154,7 +154,7 @@ GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 #
 # - True : use upper-constraints.txt to constrain versions of packages intalled
 #          and do not edit projects at all.
-USE_CONSTRAINTS=${USE_CONSTRAINTS:-False}
+USE_CONSTRAINTS=$(trueorfalse False USE_CONSTRAINTS)
 
 # Repositories
 # ------------

From 180f5eb652c73463cd5ae7d0dbede6d9d31a5df5 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hp.com>
Date: Tue, 16 Jun 2015 13:14:31 -0400
Subject: [PATCH 0734/3333] Add IPv6 support to devstack infrastructure

By default, most Openstack services are bound to 0.0.0.0
and service endpoints are registered as IPv4 addresses.
With this change we introduce two new variables to control
this behavior:

SERVICE_IP_VERSION - can either be "4" or "6".

When set to "4" (default if not set) devstack will operate
as today - most services will open listen sockets on 0.0.0.0
and service endpoints will be registered using HOST_IP as the
address.

When set to "6" devstack services will open listen sockets on ::
and service endpoints will be registered using HOST_IPV6 as the
address.

There is no support for "4+6", more work is required for that.

HOST_IPV6 - if SERVICE_IP_VERSION=6 this must be an IPv6
address configured on the system.

Some existing services, like the Openvswitch agent, will continue
to use IPv4 addresses for things like tunnel endpoints.  This is
a current restriction in the code and can be updated at a later
time.  This change is just a first step to supporting IPv6-only
control and data planes in devstack.

This change is also partly based on two previous patches,
https://review.openstack.org/#/c/140519/ and
https://review.openstack.org/#/c/176898/

Change-Id: I5c0b775490ce54ab104fd5e89b20fb700212ae74
Co-Authored-By: Sean Collins <sean@coreitpro.com>
Co-Authored-By: Baodong Li <baoli@cisco.com>
Co-Authored-By: Sridhar Gaddam <sridhar.gaddam@enovance.com>
Co-Authored-By: Adam Kacmarsky <adam.kacmarsky@hp.com>
Co-Authored-By: Jeremy Alvis <jeremy.alvis@hp.com>
---
 README.md                    | 16 +++++++++++++
 doc/source/configuration.rst | 26 ++++++++++++++++++++
 functions-common             | 12 +++++++---
 lib/cinder                   |  2 ++
 lib/database                 | 13 ++++++++--
 lib/databases/mysql          |  4 ++--
 lib/glance                   |  6 +++++
 lib/neutron-legacy           |  3 +++
 lib/nova                     | 25 ++++++++++++++++----
 lib/swift                    |  7 +++---
 samples/local.conf           | 15 ++++++------
 stack.sh                     |  5 +++-
 stackrc                      | 46 +++++++++++++++++++++++++++++++++---
 13 files changed, 154 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index ebcb0184e5..34e451dc0b 100644
--- a/README.md
+++ b/README.md
@@ -360,6 +360,22 @@ Be aware that there are some features currently missing in cells, one notable
 one being security groups.  The exercises have been patched to disable
 functionality not supported by cells.
 
+# IPv6
+
+By default, most Openstack services are bound to 0.0.0.0
+and service endpoints are registered as IPv4 addresses.
+A new variable was created to control this behavior, and to
+allow for operation over IPv6 instead of IPv4.
+
+For this, add the following to `local.conf`:
+
+    SERVICE_IP_VERSION=6
+
+When set to "6" devstack services will open listen sockets on ::
+and service endpoints will be registered using HOST_IPV6 as the
+address.  The default value for this setting is `4`.  Dual-mode
+support, for example `4+6` is not currently supported.
+
 
 # Local Configuration
 
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e91012fe2b..6052576e98 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -137,6 +137,11 @@ Ethernet interface to a bridge on the host. Setting it here also makes it
 available for ``openrc`` to set ``OS_AUTH_URL``. ``HOST_IP`` is not set
 by default.
 
+``HOST_IPV6`` is normally detected on the first run of ``stack.sh`` but
+will not be set if there is no IPv6 address on the default Ethernet interface.
+Setting it here also makes it available for ``openrc`` to set ``OS_AUTH_URL``.
+``HOST_IPV6`` is not set by default.
+
 Common Configuration Variables
 ==============================
 
@@ -391,6 +396,8 @@ Multi-host DevStack
         ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
 
 IP Version
+----------
+
     | Default: ``IP_VERSION=4+6``
     | This setting can be used to configure DevStack to create either an IPv4,
       IPv6, or dual stack tenant data network by setting ``IP_VERSION`` to
@@ -418,6 +425,25 @@ IP Version
     | *Note: ``FIXED_RANGE_V6`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
       can be configured with any valid IPv6 prefix. The default values make
       use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC 4193.*
+    |
+
+    | Default: ``SERVICE_IP_VERSION=4``
+    | This setting can be used to configure DevStack to enable services to
+      operate over either IPv4 or IPv6, by setting ``SERVICE_IP_VERSION`` to
+      either ``SERVICE_IP_VERSION=4`` or ``SERVICE_IP_VERSION=6`` respectively.
+      When set to ``4`` devstack services will open listen sockets on 0.0.0.0
+      and service endpoints will be registered using ``HOST_IP`` as the address.
+      When set to ``6`` devstack services will open listen sockets on :: and
+      service endpoints will be registered using ``HOST_IPV6`` as the address.
+      The default value for this setting is ``4``.  Dual-mode support, for
+      example ``4+6`` is not currently supported.
+    | The following optional variable can be used to alter the default IPv6
+      address used:
+    |
+
+    ::
+
+        HOST_IPV6=${some_local_ipv6_address}
 
 Examples
 ========
diff --git a/functions-common b/functions-common
index 483b1fa696..39c1bfc4d7 100644
--- a/functions-common
+++ b/functions-common
@@ -46,7 +46,8 @@ TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
     KEYSTONE_AUTH_PROTOCOL KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
-    LOGFILE OS_CACERT SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP"
+    LOGFILE OS_CACERT SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP \
+    HOST_IPV6"
 
 
 # Saves significant environment variables to .stackenv for later use
@@ -578,13 +579,14 @@ function get_default_host_ip {
     local floating_range=$2
     local host_ip_iface=$3
     local host_ip=$4
+    local af=$5
 
     # Search for an IP unless an explicit is set by ``HOST_IP`` environment variable
     if [ -z "$host_ip" -o "$host_ip" == "dhcp" ]; then
         host_ip=""
         # Find the interface used for the default route
-        host_ip_iface=${host_ip_iface:-$(ip route | awk '/default/ {print $5}' | head -1)}
-        local host_ips=$(LC_ALL=C ip -f inet addr show ${host_ip_iface} | awk '/inet/ {split($2,parts,"/");  print parts[1]}')
+        host_ip_iface=${host_ip_iface:-$(ip -f $af route | awk '/default/ {print $5}' | head -1)}
+        local host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | awk /$af'/ {split($2,parts,"/");  print parts[1]}')
         local ip
         for ip in $host_ips; do
             # Attempt to filter out IP addresses that are part of the fixed and
@@ -593,6 +595,10 @@ function get_default_host_ip {
             # will be printed and the first IP from the interface will be used.
             # If that is not correct set ``HOST_IP`` in ``localrc`` to the correct
             # address.
+            if [[ "$af" == "inet6" ]]; then
+                host_ip=$ip
+                break;
+            fi
             if ! (address_in_net $ip $fixed_range || address_in_net $ip $floating_range); then
                 host_ip=$ip
                 break;
diff --git a/lib/cinder b/lib/cinder
index 81174474e4..ab315ac8a2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -65,6 +65,7 @@ CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
 CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to default, which is thick, the other valid choice
@@ -222,6 +223,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
     iniset $CINDER_CONF DEFAULT osapi_volume_extension cinder.api.contrib.standard_extensions
+    iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
diff --git a/lib/database b/lib/database
index ff1fafee26..5bbbe3144b 100644
--- a/lib/database
+++ b/lib/database
@@ -70,10 +70,19 @@ function initialize_database_backends {
 
     # For backward-compatibility, read in the MYSQL_HOST/USER variables and use
     # them as the default values for the DATABASE_HOST/USER variables.
-    MYSQL_HOST=${MYSQL_HOST:-127.0.0.1}
+    MYSQL_HOST=${MYSQL_HOST:-$SERVICE_LOCAL_HOST}
     MYSQL_USER=${MYSQL_USER:-root}
 
-    DATABASE_HOST=${DATABASE_HOST:-${MYSQL_HOST}}
+    # Set DATABASE_HOST equal to MYSQL_HOST. If SERVICE_IP_VERSION is equal to 6,
+    # set DATABASE_HOST equal to [MYSQL_HOST]. MYSQL_HOST cannot use brackets due
+    # to mysql not using bracketing for IPv6 addresses. DATABASE_HOST must have brackets
+    # due to sqlalchemy only reading IPv6 addresses with brackets.
+    if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
+        DATABASE_HOST=${DATABASE_HOST:-[$MYSQL_HOST]}
+    else
+        DATABASE_HOST=${DATABASE_HOST:-${MYSQL_HOST}}
+    fi
+
     DATABASE_USER=${DATABASE_USER:-${MYSQL_USER}}
 
     if [ -n "$MYSQL_PASSWORD" ]; then
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 0e477ca264..9c9401edf6 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -90,10 +90,10 @@ function configure_database_mysql {
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
-    # Change ‘bind-address’ from localhost (127.0.0.1) to any (0.0.0.0) and
+    # Change ‘bind-address’ from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
     sudo bash -c "source $TOP_DIR/functions && \
-        iniset $my_conf mysqld bind-address 0.0.0.0 && \
+        iniset $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS" && \
         iniset $my_conf mysqld sql_mode STRICT_ALL_TABLES && \
         iniset $my_conf mysqld default-storage-engine InnoDB \
         iniset $my_conf mysqld max_connections 1024 \
diff --git a/lib/glance b/lib/glance
index 4dbce9f521..c268324733 100644
--- a/lib/glance
+++ b/lib/glance
@@ -64,6 +64,7 @@ fi
 
 # Glance connection info.  Note the port must be specified.
 GLANCE_SERVICE_HOST=${GLANCE_SERVICE_HOST:-$SERVICE_HOST}
+GLANCE_SERVICE_LISTEN_ADDRESS=${GLANCE_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
@@ -106,6 +107,7 @@ function configure_glance {
     # Copy over our glance configurations and update them
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_REGISTRY_CONF DEFAULT log_file
     local dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF DEFAULT sql_connection $dburl
@@ -118,6 +120,7 @@ function configure_glance {
 
     cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF DEFAULT sql_connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -136,6 +139,7 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
 
@@ -202,6 +206,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
+    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
@@ -223,6 +228,7 @@ function configure_glance {
     if is_service_enabled g-search; then
         cp $GLANCE_DIR/etc/glance-search.conf $GLANCE_SEARCH_CONF
         iniset $GLANCE_SEARCH_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $GLANCE_SEARCH_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         inicomment $GLANCE_SEARCH_CONF DEFAULT log_file
         iniset $GLANCE_SEARCH_CONF DEFAULT use_syslog $SYSLOG
         iniset $GLANCE_SEARCH_CONF DEFAULT sql_connection $dburl
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index acc2851131..cb1d1ef2ad 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -138,6 +138,8 @@ Q_PORT_INT=${Q_PORT_INT:-19696}
 Q_HOST=${Q_HOST:-$SERVICE_HOST}
 # Default protocol
 Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
+# Default listen address
+Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 # Default admin username
 Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
 # Default auth strategy
@@ -871,6 +873,7 @@ function _configure_neutron_common {
     iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
     iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
+    iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
     # If addition config files are set, make sure their path name is set as well
     if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
         die $LINENO "Neutron additional plugin config not set.. exiting"
diff --git a/lib/nova b/lib/nova
index 88b336a1be..ee748434d5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -85,6 +85,8 @@ NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
 NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
+NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
 EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
 
@@ -476,11 +478,20 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
     iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
-    iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
+    if [[ $SERVICE_IP_VERSION == 6 ]]; then
+        iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
+        iniset $NOVA_CONF DEFAULT use_ipv6 "True"
+    else
+        iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
+    fi
     iniset $NOVA_CONF database connection `database_connection_url nova`
     iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF osapi_v3 enabled "True"
+    iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
+    iniset $NOVA_CONF DEFAULT ec2_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
+    iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
+    iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to
@@ -560,11 +571,13 @@ function create_nova_conf {
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=127.0.0.1}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=127.0.0.1}
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
         iniset $NOVA_CONF DEFAULT vnc_enabled true
         iniset $NOVA_CONF DEFAULT vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $NOVA_CONF DEFAULT xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
         iniset $NOVA_CONF DEFAULT vnc_enabled false
     fi
@@ -572,11 +585,12 @@ function create_nova_conf {
     if is_service_enabled n-spice; then
         # Address on which instance spiceservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=127.0.0.1}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=127.0.0.1}
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         iniset $NOVA_CONF spice enabled true
         iniset $NOVA_CONF spice server_listen "$SPICESERVER_LISTEN"
         iniset $NOVA_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CONF spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
         iniset $NOVA_CONF spice enabled false
     fi
@@ -616,6 +630,7 @@ function create_nova_conf {
     fi
 
     if is_service_enabled n-sproxy; then
+        iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
     fi
 }
diff --git a/lib/swift b/lib/swift
index 5b73981ed2..a8c02b3eb2 100644
--- a/lib/swift
+++ b/lib/swift
@@ -45,6 +45,7 @@ SWIFT3_DIR=$DEST/swift3
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 SWIFT_DEFAULT_BIND_PORT_INT=${SWIFT_DEFAULT_BIND_PORT_INT:-8081}
+SWIFT_SERVICE_LOCAL_HOST=${SWIFT_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 
 # TODO: add logging to different location.
 
@@ -668,9 +669,9 @@ function init_swift {
         swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
 
         for node_number in ${SWIFT_REPLICAS_SEQ}; do
-            swift-ring-builder object.builder add z${node_number}-127.0.0.1:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-            swift-ring-builder container.builder add z${node_number}-127.0.0.1:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-            swift-ring-builder account.builder add z${node_number}-127.0.0.1:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+            swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+            swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+            swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
         done
         swift-ring-builder object.builder rebalance
         swift-ring-builder container.builder rebalance
diff --git a/samples/local.conf b/samples/local.conf
index bd0cd9c0db..ce7007391d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -32,14 +32,15 @@ MYSQL_PASSWORD=stackdb
 RABBIT_PASSWORD=stackqueue
 SERVICE_PASSWORD=$ADMIN_PASSWORD
 
-# ``HOST_IP`` should be set manually for best results if the NIC configuration
-# of the host is unusual, i.e. ``eth1`` has the default route but ``eth0`` is the
-# public interface.  It is auto-detected in ``stack.sh`` but often is indeterminate
-# on later runs due to the IP moving from an Ethernet interface to a bridge on
-# the host. Setting it here also makes it available for ``openrc`` to include
-# when setting ``OS_AUTH_URL``.
-# ``HOST_IP`` is not set by default.
+# ``HOST_IP`` and ``HOST_IPV6`` should be set manually for best results if
+# the NIC configuration of the host is unusual, i.e. ``eth1`` has the default
+# route but ``eth0`` is the public interface.  They are auto-detected in
+# ``stack.sh`` but often is indeterminate on later runs due to the IP moving
+# from an Ethernet interface to a bridge on the host. Setting it here also
+# makes it available for ``openrc`` to include when setting ``OS_AUTH_URL``.
+# Neither is set by default.
 #HOST_IP=w.x.y.z
+#HOST_IPV6=2001:db8::7
 
 
 # Logging
diff --git a/stack.sh b/stack.sh
index 17cbe75802..4b53df379b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1403,7 +1403,10 @@ fi
 echo ""
 echo ""
 echo ""
-echo "This is your host ip: $HOST_IP"
+echo "This is your host IP address: $HOST_IP"
+if [ "$HOST_IPV6" != "" ]; then
+    echo "This is your host IPv6 address: $HOST_IPV6"
+fi
 
 # If you installed Horizon on this server you should be able
 # to access the site using your browser.
diff --git a/stackrc b/stackrc
index 9fb334a69a..5cacb1858f 100644
--- a/stackrc
+++ b/stackrc
@@ -669,14 +669,54 @@ FIXED_RANGE=${FIXED_RANGE:-10.0.0.0/24}
 FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
 HOST_IP_IFACE=${HOST_IP_IFACE:-}
 HOST_IP=${HOST_IP:-}
+HOST_IPV6=${HOST_IPV6:-}
 
-HOST_IP=$(get_default_host_ip $FIXED_RANGE $FLOATING_RANGE "$HOST_IP_IFACE" "$HOST_IP")
+HOST_IP=$(get_default_host_ip "$FIXED_RANGE" "$FLOATING_RANGE" "$HOST_IP_IFACE" "$HOST_IP" "inet")
 if [ "$HOST_IP" == "" ]; then
     die $LINENO "Could not determine host ip address.  See local.conf for suggestions on setting HOST_IP."
 fi
 
-# Allow the use of an alternate hostname (such as localhost/127.0.0.1) for service endpoints.
-SERVICE_HOST=${SERVICE_HOST:-$HOST_IP}
+HOST_IPV6=$(get_default_host_ip "" "" "$HOST_IP_IFACE" "$HOST_IPV6" "inet6")
+
+# SERVICE IP version
+# This is the IP version that services should be listening on, as well
+# as using to register their endpoints with keystone.
+SERVICE_IP_VERSION=${SERVICE_IP_VERSION:-4}
+
+# Validate SERVICE_IP_VERSION
+# It would be nice to support "4+6" here as well, but that will require
+# multiple calls into keystone to register endpoints, so for now let's
+# just support one or the other.
+if [[ $SERVICE_IP_VERSION != "4" ]] && [[ $SERVICE_IP_VERSION != "6" ]]; then
+    die $LINENO "SERVICE_IP_VERSION must be either 4 or 6"
+fi
+
+if [[ "$SERVICE_IP_VERSION" == 4 ]]; then
+    DEF_SERVICE_HOST=$HOST_IP
+    DEF_SERVICE_LOCAL_HOST=127.0.0.1
+    DEF_SERVICE_LISTEN_ADDRESS=0.0.0.0
+fi
+
+if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
+    if [ "$HOST_IPV6" == "" ]; then
+        die $LINENO "Could not determine host IPv6 address.  See local.conf for suggestions on setting HOST_IPV6."
+    fi
+
+    DEF_SERVICE_HOST=[$HOST_IPV6]
+    DEF_SERVICE_LOCAL_HOST=::1
+    DEF_SERVICE_LISTEN_ADDRESS=::
+fi
+
+# This is either 0.0.0.0 for IPv4 or :: for IPv6
+SERVICE_LISTEN_ADDRESS=${SERVICE_LISTEN_ADDRESS:-${DEF_SERVICE_LISTEN_ADDRESS}}
+
+# Allow the use of an alternate hostname (such as localhost/127.0.0.1) for
+# service endpoints.  Default is dependent on SERVICE_IP_VERSION above.
+SERVICE_HOST=${SERVICE_HOST:-${DEF_SERVICE_HOST}}
+# This is either 127.0.0.1 for IPv4 or ::1 for IPv6
+SERVICE_LOCAL_HOST=${SERVICE_LOCAL_HOST:-${DEF_SERVICE_LOCAL_HOST}}
+
+REGION_NAME=${REGION_NAME:-RegionOne}
 
 # Configure services to use syslog instead of writing to individual log files
 SYSLOG=$(trueorfalse False SYSLOG)

From 5d04db20ec5a89c6f04df7c798efa41a4259d22e Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hp.com>
Date: Tue, 16 Jun 2015 13:14:31 -0400
Subject: [PATCH 0735/3333] Add IPv6 support to openrc files

Assumes devstack was configured with SERVICE_IP_VERSION in
local.conf

SERVICE_IP_VERSION is stored in .stackenv and checked in
openrc. If SERVICE_IP_VERSION is set to 6, openrc will use
IPv6.

NOTE: At first, I added a '-6' option to the openrc call
which would set the HOSTS accordingly. I then simplified
the code by saving SERVICE_IP_VERSION to the .stackenv file
which is sourced by openrc. After that, I simplified the
code even more by removing an extra, unnecessary, variable.

Change-Id: I5d46d5438d3e56fea788720ca17f0010caef3df1
---
 functions-common |  2 +-
 openrc           | 24 ++++++++++++++++--------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index 39c1bfc4d7..fc17d42422 100644
--- a/functions-common
+++ b/functions-common
@@ -47,7 +47,7 @@ TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
     KEYSTONE_AUTH_PROTOCOL KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
     LOGFILE OS_CACERT SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP \
-    HOST_IPV6"
+    HOST_IPV6 SERVICE_IP_VERSION"
 
 
 # Saves significant environment variables to .stackenv for later use
diff --git a/openrc b/openrc
index 64faa58a3a..71ba5a6ea5 100644
--- a/openrc
+++ b/openrc
@@ -56,18 +56,26 @@ export OS_NO_CACHE=${OS_NO_CACHE:-1}
 # Region
 export OS_REGION_NAME=${REGION_NAME:-RegionOne}
 
-# Set api HOST_IP endpoint.  SERVICE_HOST may also be used to specify the endpoint,
-# which is convenient for some localrc configurations.
-HOST_IP=${HOST_IP:-127.0.0.1}
-SERVICE_HOST=${SERVICE_HOST:-$HOST_IP}
+# Set the host API endpoint. This will default to HOST_IP if SERVICE_IP_VERSION
+# is 4, else HOST_IPV6 if it's 6. SERVICE_HOST may also be used to specify the
+# endpoint, which is convenient for some localrc configurations. Additionally,
+# some exercises call Glance directly. On a single-node installation, Glance
+# should be listening on a local IP address, depending on the setting of
+# SERVICE_IP_VERSION. If its running elsewhere, it can be set here.
+if [[ $SERVICE_IP_VERSION == 6 ]]; then
+    HOST_IPV6=${HOST_IPV6:-::1}
+    SERVICE_HOST=${SERVICE_HOST:-[$HOST_IPV6]}
+    GLANCE_HOST=${GLANCE_HOST:-[$HOST_IPV6]}
+else
+    HOST_IP=${HOST_IP:-127.0.0.1}
+    SERVICE_HOST=${SERVICE_HOST:-$HOST_IP}
+    GLANCE_HOST=${GLANCE_HOST:-$HOST_IP}
+fi
+
 SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
-# Some exercises call glance directly.  On a single-node installation, Glance
-# should be listening on HOST_IP.  If its running elsewhere, it can be set here
-GLANCE_HOST=${GLANCE_HOST:-$HOST_IP}
-
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 

From aedb8b97f60e7ff5bf5d0bafc192cc6e3e289cbe Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 2 Jul 2015 17:39:07 +1000
Subject: [PATCH 0736/3333] Search for service by type

When you get or create service it first checks to see if an existing
service matching these parameters exists. The definition of existing is
having a service with the same name, however name is not a unique field.
Sahara for example creates two services, one with data-processing, one
with data_processing with the same sahara name.

Search for existing services by service type, not by service name.

Change-Id: I6148e2254aa3968039b0e7c178e7cabc53b6be68
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 483b1fa696..d6be1ecc1e 100644
--- a/functions-common
+++ b/functions-common
@@ -806,7 +806,7 @@ function get_or_create_service {
     # Gets service id
     local service_id=$(
         # Gets service id
-        openstack service show $1 -f value -c id 2>/dev/null ||
+        openstack service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
         openstack service create \
             $2 \

From e62c906baf9f94be1cd4d3a66c3e5b7b6324bed8 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Wed, 24 Jun 2015 16:25:16 -0400
Subject: [PATCH 0737/3333] Added processing /compute URL

With config option NOVA_USE_MOD_WSGI=True nova-api handles
requests on /compute URL.

Depends on I83bc4731507fa028377ae6701ed4d32adefa9251

Change-Id: Ic84b5c0dc0726662470ef9c076a0cadca55a3917
---
 files/apache-nova-api.template |  9 +++++++++
 lib/nova                       | 18 ++++++++++++------
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index 301a3bdbdd..49081528ff 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -14,3 +14,12 @@ Listen %PUBLICPORT%
     %SSLCERTFILE%
     %SSLKEYFILE%
 </VirtualHost>
+
+Alias /compute %PUBLICWSGI%
+<Location /compute>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup nova-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/nova b/lib/nova
index 88b336a1be..41248b10ed 100644
--- a/lib/nova
+++ b/lib/nova
@@ -405,19 +405,25 @@ function create_nova_accounts {
 
             local nova_service=$(get_or_create_service "nova" \
                 "compute" "Nova Compute Service")
+            local nova_api_url
+            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
+                nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
+            else
+                nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
+            fi
             get_or_create_endpoint $nova_service \
                 "$REGION_NAME" \
-                "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2/\$(tenant_id)s" \
-                "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2/\$(tenant_id)s" \
-                "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2/\$(tenant_id)s"
+                "$nova_api_url/v2/\$(tenant_id)s" \
+                "$nova_api_url/v2/\$(tenant_id)s" \
+                "$nova_api_url/v2/\$(tenant_id)s"
 
             local nova_v21_service=$(get_or_create_service "novav21" \
                 "computev21" "Nova Compute Service V2.1")
             get_or_create_endpoint $nova_v21_service \
                 "$REGION_NAME" \
-                "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2.1/\$(tenant_id)s" \
-                "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2.1/\$(tenant_id)s" \
-                "$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT/v2.1/\$(tenant_id)s"
+                "$nova_api_url/v2.1/\$(tenant_id)s" \
+                "$nova_api_url/v2.1/\$(tenant_id)s" \
+                "$nova_api_url/v2.1/\$(tenant_id)s"
         fi
     fi
 

From 7c838616c98212c808d12c3789cc17ec76cbd878 Mon Sep 17 00:00:00 2001
From: Robert Collins <rbtcollins@hp.com>
Date: Fri, 3 Jul 2015 13:28:09 +1200
Subject: [PATCH 0738/3333] Fix library runs.

Libraries were resulting in two edit-constraints runs:
 - one for the library, which adds a non-editable file path
 - then one for the editable servers, but that fails becuse
   pkg-resources couldn't parse the prior entry.

This is fixed in two parts: the dependent patch which supports parsing
file urls that have egg names, and this patch which changes from a
file path to a file url with an egg name.

Change-Id: I0f07858e96ea3baf46f8a453e253b9ed29c7f7e2
---
 inc/python | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index ca185f05d2..bba9cda44d 100644
--- a/inc/python
+++ b/inc/python
@@ -238,7 +238,9 @@ function setup_package_with_req_sync {
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
         local name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
-        $REQUIREMENTS_DIR/.venv/bin/edit-constraints $REQUIREMENTS_DIR/upper-constraints.txt -- $name "$flags $project_dir"
+        $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
+            $REQUIREMENTS_DIR/upper-constraints.txt -- $name \
+            "$flags file://$project_dir#egg=$name"
     fi
 
     setup_package $project_dir $flags

From 4f91f93557d088b315e1687db9fa462888a06312 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Sat, 4 Jul 2015 20:45:24 +0900
Subject: [PATCH 0739/3333] Remove duplication in ml2 and openvswitch_agent

Configuration of local_ip is duplication in ml2 because there is
the configuration in both ml2 and openvswitch_agent.
It also should be set in each driver using openvswitch.

Change-Id: Ib0b874aed8db883d778426ed1ae01679fc0cc075
---
 lib/neutron_plugins/ml2 | 5 -----
 1 file changed, 5 deletions(-)
 mode change 100644 => 100755 lib/neutron_plugins/ml2

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
old mode 100644
new mode 100755
index 2733f1f513..13ffee9b5b
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -107,11 +107,6 @@ function neutron_plugin_configure_service {
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
 
-    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
-        # Set local_ip if TENANT_TUNNELS are enabled.
-        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
-    fi
-
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS

From d48d672a8d36a70b10456496159fecf7551e89f8 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Sat, 4 Jul 2015 22:58:44 +0900
Subject: [PATCH 0740/3333] Add tunnel_bridge configuration for openvswitch
 agent

Change-Id: I0235aa05cf86b3ed9d9620dda3f16b69ced077e3
---
 lib/neutron_plugins/openvswitch_agent | 1 +
 lib/neutron_plugins/ovs_base          | 1 +
 2 files changed, 2 insertions(+)
 mode change 100644 => 100755 lib/neutron_plugins/openvswitch_agent
 mode change 100644 => 100755 lib/neutron_plugins/ovs_base

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
old mode 100644
new mode 100755
index 2a05e2dcfa..1ff3a40c82
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -50,6 +50,7 @@ function neutron_plugin_configure_plugin_agent {
             die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
         fi
         iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
+        iniset /$Q_PLUGIN_CONF_FILE ovs tunnel_bridge $OVS_TUNNEL_BRIDGE
     fi
 
     # Setup physical network bridge mappings.  Override
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
old mode 100644
new mode 100755
index 4e750f0932..ad09a739c6
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -9,6 +9,7 @@ set +o xtrace
 
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
 OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-""}
+OVS_TUNNEL_BRIDGE=${OVS_TUNNEL_BRIDGE:-br-tun}
 
 function is_neutron_ovs_base_plugin {
     # Yes, we use OVS.

From 7ab3e39bc485acc2b54d7496a77c2e43eda4e799 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Sat, 4 Jul 2015 23:11:52 +0900
Subject: [PATCH 0741/3333] Add cleanup for br-tun with OVS

Change-Id: I5c4d28844f40eaad622ef7590c54e0e6647c85e3
Closes-Bug: #1471390
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index ad09a739c6..f1f7f8597b 100755
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -41,7 +41,7 @@ function neutron_ovs_base_cleanup {
     done
 
     # remove all OVS bridges created by Neutron
-    for bridge in $(sudo ovs-vsctl list-br | grep -o -e ${OVS_BRIDGE} -e ${PUBLIC_BRIDGE}); do
+    for bridge in $(sudo ovs-vsctl list-br | grep -o -e ${OVS_BRIDGE} -e ${PUBLIC_BRIDGE} -e ${OVS_TUNNEL_BRIDGE}); do
         sudo ovs-vsctl del-br ${bridge}
     done
 }

From 21a9077d7cf32ee1c387171b943125e938eaa1b2 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 3 Jul 2015 11:54:38 +1000
Subject: [PATCH 0742/3333] Allow installing keystoneauth from git

Keystoneauth is not marked as stable yet however to ensure that the
integration between it, keystoneclient and other services don't break
compatibility we want to test it with tempest.

Unfortunately you can't put -e links in requirements.txt files so add
it to devstack so we can set the test environment. This will also make
it available when keystoneauth is released.

Change-Id: I43ca1df9c6ae2f0ac1a687c9ce1e2ccb97e81652
---
 lib/keystone                 | 9 +++++++++
 stack.sh                     | 1 +
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 4 files changed, 15 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index c33d466c6c..baa4f8c22c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -35,6 +35,7 @@ set +o xtrace
 # --------
 
 # Set up default directories
+GITDIR["keystoneauth"]=$DEST/keystoneauth
 GITDIR["python-keystoneclient"]=$DEST/python-keystoneclient
 GITDIR["keystonemiddleware"]=$DEST/keystonemiddleware
 KEYSTONE_DIR=$DEST/keystone
@@ -483,6 +484,14 @@ function init_keystone {
     fi
 }
 
+# install_keystoneauth() - Collect source and prepare
+function install_keystoneauth {
+    if use_library_from_git "keystoneauth"; then
+        git_clone_by_name "keystoneauth"
+        setup_dev_lib "keystoneauth"
+    fi
+}
+
 # install_keystoneclient() - Collect source and prepare
 function install_keystoneclient {
     if use_library_from_git "python-keystoneclient"; then
diff --git a/stack.sh b/stack.sh
index 17cbe75802..1610651fa7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -741,6 +741,7 @@ echo_summary "Installing OpenStack project source"
 install_oslo
 
 # Install client libraries
+install_keystoneauth
 install_keystoneclient
 install_glanceclient
 install_cinderclient
diff --git a/stackrc b/stackrc
index 342f9bf987..eb0c330ed3 100644
--- a/stackrc
+++ b/stackrc
@@ -280,6 +280,10 @@ GITBRANCH["python-heatclient"]=${HEATCLIENT_BRANCH:-master}
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
 GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
 
+# the base authentication plugins that clients use to authenticate
+GITREPO["keystoneauth"]=${KEYSTONEAUTH_REPO:-${GIT_BASE}/openstack/keystoneauth.git}
+GITBRANCH["keystoneauth"]=${KEYSTONEAUTH_BRANCH:-master}
+
 # python keystone client library to nova that horizon uses
 GITREPO["python-keystoneclient"]=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
 GITBRANCH["python-keystoneclient"]=${KEYSTONECLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 8dc3ba3c6e..d10cd0ee62 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -41,6 +41,7 @@ ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
+ALL_LIBS+=" keystoneauth"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 1848b837e672fd6b7e091637e7cefa1ce0052958 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Sat, 27 Jun 2015 15:05:17 +0100
Subject: [PATCH 0743/3333] Move ceilometermiddleware installation to lib/swift

lib/swift is where it is used so this makes the relationship more
clear and direct.

Change-Id: Ie6fc09e27a39295c92f0790856446edb7dedb995
---
 lib/ceilometer | 10 ----------
 lib/swift      | 15 +++++++++++++++
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index ed9b93377e..163ed0b0ab 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -360,16 +360,6 @@ function install_ceilometerclient {
     fi
 }
 
-# install_ceilometermiddleware() - Collect source and prepare
-function install_ceilometermiddleware {
-    if use_library_from_git "ceilometermiddleware"; then
-        git_clone_by_name "ceilometermiddleware"
-        setup_dev_lib "ceilometermiddleware"
-    else
-        pip_install_gr ceilometermiddleware
-    fi
-}
-
 # start_ceilometer() - Start running processes, including screen
 function start_ceilometer {
     run_process ceilometer-acentral "$CEILOMETER_BIN_DIR/ceilometer-agent-central --config-file $CEILOMETER_CONF"
diff --git a/lib/swift b/lib/swift
index 5b73981ed2..3207fac165 100644
--- a/lib/swift
+++ b/lib/swift
@@ -697,6 +697,21 @@ function install_swiftclient {
     fi
 }
 
+# install_ceilometermiddleware() - Collect source and prepare
+#   note that this doesn't really have anything to do with ceilometer;
+#   though ceilometermiddleware has ceilometer in its name as an
+#   artifact of history, it is not a ceilometer specific tool. It
+#   simply generates pycadf-based notifications about requests and
+#   responses on the swift proxy
+function install_ceilometermiddleware {
+    if use_library_from_git "ceilometermiddleware"; then
+        git_clone_by_name "ceilometermiddleware"
+        setup_dev_lib "ceilometermiddleware"
+    else
+        pip_install_gr ceilometermiddleware
+    fi
+}
+
 # start_swift() - Start running processes, including screen
 function start_swift {
     # (re)start memcached to make sure we have a clean memcache.

From 9ef663a70fb02d4829b4c5a50f7fe6ef3ec6a8b4 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Tue, 7 Jul 2015 09:34:33 -0400
Subject: [PATCH 0744/3333] Don't uninstall ceph packages at cleanup

We stop the services, which should be sufficient.
Uninstalling the packages means that doing repeated
runs with devstack takes longer than necessary.

Change-Id: I5626e42ce83710690a3523439bb2c9c9af560cd9
---
 lib/ceph | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/ceph b/lib/ceph
index 16dcda2f9e..04e05e7b01 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -158,7 +158,6 @@ function cleanup_ceph_embedded {
 
 function cleanup_ceph_general {
     undefine_virsh_secret
-    uninstall_package ceph ceph-common python-ceph libcephfs1 > /dev/null 2>&1
 }
 
 

From 11298a01f74c7952b924d001c548d9721eebf591 Mon Sep 17 00:00:00 2001
From: Adam Kacmarsky <adam.kacmarsky@hp.com>
Date: Fri, 26 Jun 2015 14:49:47 -0600
Subject: [PATCH 0745/3333] Add IPv6 support for _move_neutron_addresses_route

Added functionallity to allow IPv6 addresses to be moved to the
OVS_PHYSICAL_BRIDGE from PUBLIC_INTERFACE automatically using
_move_neutron_addresses_route. Only PUBLIC_INTERFACE and
OVS_PHYSICAL_BRIDGE need to be set in localrc.

HOST_IP must be set in localrc. HOST_IPV6 must be set in localrc if a
global IPv6 address is configured on PUBLIC_INTERFACE.

Change-Id: I8d2c055702e1c7cf08499a77f6843393762fd4c1
---
 lib/neutron-legacy | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index cb1d1ef2ad..ee98015708 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -788,6 +788,7 @@ function _move_neutron_addresses_route {
     local from_intf=$1
     local to_intf=$2
     local add_ovs_port=$3
+    local af=$4
 
     if [[ -n "$from_intf" && -n "$to_intf" ]]; then
         # Remove the primary IP address from $from_intf and add it to $to_intf,
@@ -795,10 +796,18 @@ function _move_neutron_addresses_route {
         # on configure we will also add $from_intf as a port on $to_intf,
         # assuming it is an OVS bridge.
 
-        local IP_BRD=$(ip -4 a s dev $from_intf | awk '/inet/ { print $2, $3, $4; exit }')
+        local IP_BRD=$(ip -f $af a s dev $from_intf | awk '/inet/ { print $2, $3, $4; exit }')
         local DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
+        if [[ $af == "inet" ]]; then
+            IP_BRD=$(ip -f $af a s dev $from_intf | grep $HOST_IP | awk '{ print $2, $3, $4; exit }')
+        fi
+
+        if [[ $af == "inet6" ]]; then
+            IP_BRD=$(ip -f $af a s dev $from_intf | grep $HOST_IPV6 | awk '{ print $2, $3, $4; exit }')
+        fi
+
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
@@ -815,7 +824,13 @@ function _move_neutron_addresses_route {
 # runs that a clean run would need to clean up
 function cleanup_neutron {
 
-    _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False
+    if [[ $(ip -f inet a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
+    fi
+
+    if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
+    fi
 
     if is_provider_network && is_ironic_hardware; then
         for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
@@ -997,8 +1012,12 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent
 
-    if [[ $(ip -4 a s dev "$PUBLIC_INTERFACE" | grep -c 'inet') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True
+    if [[ $(ip -f inet a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
+    fi
+
+    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
     fi
 }
 

From b17ad7560d7d67e3464b489e124c540e025b9299 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 29 May 2015 06:04:47 +0000
Subject: [PATCH 0746/3333] Use identity V3 API for endpoint creation

Always use the keystone V3 API when creating services and endpoints. The syntax
here is slightly different but we maintain the function interface.

Change-Id: Ib3a375918a45fd6e37d873a1a5c0c4b26bdbb5d8
Implements: bp keystonev3
---
 functions-common   | 59 ++++++++++++++++++++++++++++++++++------------
 lib/ceilometer     |  5 ++--
 lib/cinder         | 10 ++++----
 lib/glance         | 10 ++++----
 lib/heat           | 10 ++++----
 lib/ironic         |  5 ++--
 lib/keystone       |  5 ++--
 lib/neutron-legacy |  5 ++--
 lib/nova           | 21 +++++++----------
 lib/swift          |  5 ++--
 lib/tempest        |  4 ++--
 lib/zaqar          |  5 ++--
 12 files changed, 79 insertions(+), 65 deletions(-)

diff --git a/functions-common b/functions-common
index d6be1ecc1e..9023e85fad 100644
--- a/functions-common
+++ b/functions-common
@@ -809,6 +809,8 @@ function get_or_create_service {
         openstack service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
         openstack service create \
+            --os-url $KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             $2 \
             --name $1 \
             --description="$3" \
@@ -817,29 +819,56 @@ function get_or_create_service {
     echo $service_id
 }
 
-# Gets or creates endpoint
-# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
-function get_or_create_endpoint {
-    # Gets endpoint id
+# Create an endpoint with a specific interface
+# Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
+function _get_or_create_endpoint_with_interface {
     local endpoint_id=$(openstack endpoint list \
-        --column "ID" \
-        --column "Region" \
-        --column "Service Name" \
-        | grep " $2 " \
-        | grep " $1 " | get_field 1)
+        --os-url $KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
+        --service $1 \
+        --interface $2 \
+        --region $4 \
+        -c ID -f value)
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \
-            $1 \
-            --region $2 \
-            --publicurl $3 \
-            --adminurl $4 \
-            --internalurl $5 \
-            | grep " id " | get_field 2)
+            --os-url $KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            $1 $2 $3 --region $4 -f value -c id)
     fi
+
     echo $endpoint_id
 }
 
+# Gets or creates endpoint
+# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+function get_or_create_endpoint {
+    # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
+    # creating one endpoint with multiple urls to multiple endpoints each with
+    # a different interface.  To maintain the existing function interface we
+    # create 3 endpoints and return the id of the public one. In reality
+    # returning the public id will not make a lot of difference as there are no
+    # scenarios currently that use the returned id. Ideally this behaviour
+    # should be pushed out to the service setups and let them create the
+    # endpoints they need.
+    local public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
+    _get_or_create_endpoint_with_interface $1 admin $4 $2
+    _get_or_create_endpoint_with_interface $1 internal $5 $2
+
+    # return the public id to indicate success, and this is the endpoint most likely wanted
+    echo $public_id
+}
+
+# Get a URL from the identity service
+# Usage: get_endpoint_url <service> <interface>
+function get_endpoint_url {
+    echo $(openstack endpoint list \
+            --service $1 --interface $2 \
+            --os-url $KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            -c URL -f value)
+}
+
 
 # Package Functions
 # =================
diff --git a/lib/ceilometer b/lib/ceilometer
index 163ed0b0ab..7905384623 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -130,9 +130,8 @@ function create_ceilometer_accounts {
         create_service_user "ceilometer" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            local ceilometer_service=$(get_or_create_service "ceilometer" \
-                "metering" "OpenStack Telemetry Service")
-            get_or_create_endpoint $ceilometer_service \
+            get_or_create_service "ceilometer" "metering" "OpenStack Telemetry Service"
+            get_or_create_endpoint "metering" \
                 "$REGION_NAME" \
                 "$CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/" \
                 "$CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/" \
diff --git a/lib/cinder b/lib/cinder
index 81174474e4..e51cd8ba1b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -327,16 +327,14 @@ function create_cinder_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            local cinder_service=$(get_or_create_service "cinder" \
-                "volume" "Cinder Volume Service")
-            get_or_create_endpoint $cinder_service "$REGION_NAME" \
+            get_or_create_service "cinder" "volume" "Cinder Volume Service"
+            get_or_create_endpoint "volume" "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
 
-            local cinder_v2_service=$(get_or_create_service "cinderv2" \
-                "volumev2" "Cinder Volume Service V2")
-            get_or_create_endpoint $cinder_v2_service "$REGION_NAME" \
+            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+            get_or_create_endpoint "volumev2" "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
diff --git a/lib/glance b/lib/glance
index 4dbce9f521..be6ccf9a37 100644
--- a/lib/glance
+++ b/lib/glance
@@ -266,9 +266,8 @@ function create_glance_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            local glance_service=$(get_or_create_service "glance" \
-                "image" "Glance Image Service")
-            get_or_create_endpoint $glance_service \
+            get_or_create_service "glance" "image" "Glance Image Service"
+            get_or_create_endpoint "image" \
                 "$REGION_NAME" \
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
@@ -279,10 +278,9 @@ function create_glance_accounts {
     # Add glance-search service and endpoints
     if is_service_enabled g-search; then
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            local glance_search_service=$(get_or_create_service "glance-search" \
-                "search" "EXPERIMENTAL - Glance Graffiti Search Service")
+            get_or_create_service "glance-search" "search" "EXPERIMENTAL - Glance Graffiti Search Service"
 
-            get_or_create_endpoint $glance_search_service \
+            get_or_create_endpoint "search" \
                 "$REGION_NAME" \
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
diff --git a/lib/heat b/lib/heat
index 5cb0dbf6d9..cedddd2d26 100644
--- a/lib/heat
+++ b/lib/heat
@@ -250,17 +250,15 @@ function create_heat_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            local heat_service=$(get_or_create_service "heat" \
-                    "orchestration" "Heat Orchestration Service")
-            get_or_create_endpoint $heat_service \
+            get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
+            get_or_create_endpoint "orchestration" \
                 "$REGION_NAME" \
                 "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
                 "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
                 "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
 
-            local heat_cfn_service=$(get_or_create_service "heat-cfn" \
-                    "cloudformation" "Heat CloudFormation Service")
-            get_or_create_endpoint $heat_cfn_service \
+            get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
+            get_or_create_endpoint "cloudformation"  \
                 "$REGION_NAME" \
                 "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
                 "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
diff --git a/lib/ironic b/lib/ironic
index cff20c9bbc..2d197dc655 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -411,9 +411,8 @@ function create_ironic_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            local ironic_service=$(get_or_create_service "ironic" \
-                "baremetal" "Ironic baremetal provisioning service")
-            get_or_create_endpoint $ironic_service \
+            get_or_create_service "ironic" "baremetal" "Ironic baremetal provisioning service"
+            get_or_create_endpoint "baremetal" \
                 "$REGION_NAME" \
                 "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT" \
                 "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT" \
diff --git a/lib/keystone b/lib/keystone
index c33d466c6c..428e615444 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -406,9 +406,8 @@ function create_keystone_accounts {
     # Keystone
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-        KEYSTONE_SERVICE=$(get_or_create_service "keystone" \
-            "identity" "Keystone Identity Service")
-        get_or_create_endpoint $KEYSTONE_SERVICE \
+        get_or_create_service "keystone" "identity" "Keystone Identity Service"
+        get_or_create_endpoint "identity" \
             "$REGION_NAME" \
             "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
             "$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT/v$IDENTITY_API_VERSION" \
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index acc2851131..af7c6a1a47 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -517,9 +517,8 @@ function create_neutron_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            local neutron_service=$(get_or_create_service "neutron" \
-                "network" "Neutron Service")
-            get_or_create_endpoint $neutron_service \
+            get_or_create_service "neutron" "network" "Neutron Service"
+            get_or_create_endpoint "network" \
                 "$REGION_NAME" \
                 "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
                 "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
diff --git a/lib/nova b/lib/nova
index 41248b10ed..0d8f975fa7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -402,24 +402,22 @@ function create_nova_accounts {
         create_service_user "nova" "admin"
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            local nova_service=$(get_or_create_service "nova" \
-                "compute" "Nova Compute Service")
             local nova_api_url
             if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
                 nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
             else
                 nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
             fi
-            get_or_create_endpoint $nova_service \
+
+            get_or_create_service "nova" "compute" "Nova Compute Service"
+            get_or_create_endpoint "compute" \
                 "$REGION_NAME" \
                 "$nova_api_url/v2/\$(tenant_id)s" \
                 "$nova_api_url/v2/\$(tenant_id)s" \
                 "$nova_api_url/v2/\$(tenant_id)s"
 
-            local nova_v21_service=$(get_or_create_service "novav21" \
-                "computev21" "Nova Compute Service V2.1")
-            get_or_create_endpoint $nova_v21_service \
+            get_or_create_service "novav21" "computev21" "Nova Compute Service V2.1"
+            get_or_create_endpoint "computev21" \
                 "$REGION_NAME" \
                 "$nova_api_url/v2.1/\$(tenant_id)s" \
                 "$nova_api_url/v2.1/\$(tenant_id)s" \
@@ -438,9 +436,8 @@ function create_nova_accounts {
         # EC2
         if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
 
-            local ec2_service=$(get_or_create_service "ec2" \
-                "ec2" "EC2 Compatibility Layer")
-            get_or_create_endpoint $ec2_service \
+            get_or_create_service "ec2" "ec2" "EC2 Compatibility Layer"
+            get_or_create_endpoint "ec2" \
                 "$REGION_NAME" \
                 "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
                 "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
@@ -452,8 +449,8 @@ function create_nova_accounts {
     if is_service_enabled n-obj swift3; then
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            local s3_service=$(get_or_create_service "s3" "s3" "S3")
-            get_or_create_endpoint $s3_service \
+            get_or_create_service "s3" "s3" "S3"
+            get_or_create_endpoint "s3" \
                 "$REGION_NAME" \
                 "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
                 "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
diff --git a/lib/swift b/lib/swift
index 3207fac165..52101f863a 100644
--- a/lib/swift
+++ b/lib/swift
@@ -607,9 +607,8 @@ function create_swift_accounts {
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-        local swift_service=$(get_or_create_service "swift" \
-            "object-store" "Swift Service")
-        get_or_create_endpoint $swift_service \
+        get_or_create_service "swift" "object-store" "Swift Service"
+        get_or_create_endpoint "object-store" \
             "$REGION_NAME" \
             "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s" \
             "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080" \
diff --git a/lib/tempest b/lib/tempest
index a84ade2a81..1376c87a77 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -270,11 +270,11 @@ function configure_tempest {
         fi
     fi
 
-    EC2_URL=$(openstack endpoint show -f value -c publicurl ec2 || true)
+    EC2_URL=$(get_endpoint_url ec2 public || true)
     if [[ -z $EC2_URL ]]; then
         EC2_URL="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
     fi
-    S3_URL=$(openstack endpoint show -f value -c publicurl s3 || true)
+    S3_URL=$(get_endpoint_url s3 public || true)
     if [[ -z $S3_URL ]]; then
         S3_URL="http://$SERVICE_HOST:${S3_SERVICE_PORT:-3333}"
     fi
diff --git a/lib/zaqar b/lib/zaqar
index 891b0eab04..fdab3a26a8 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -210,9 +210,8 @@ function create_zaqar_accounts {
 
     if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-        local zaqar_service=$(get_or_create_service "zaqar" \
-            "messaging" "Zaqar Service")
-        get_or_create_endpoint $zaqar_service \
+        get_or_create_service "zaqar" "messaging" "Zaqar Service"
+        get_or_create_endpoint "messaging" \
             "$REGION_NAME" \
             "$ZAQAR_SERVICE_PROTOCOL://$ZAQAR_SERVICE_HOST:$ZAQAR_SERVICE_PORT" \
             "$ZAQAR_SERVICE_PROTOCOL://$ZAQAR_SERVICE_HOST:$ZAQAR_SERVICE_PORT" \

From 72ce6acd22a553e4d34f0ffdc429aaaed7ed1212 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 2 Jul 2015 09:19:01 +1000
Subject: [PATCH 0747/3333] Use Keystone V3 API for role creation

Always use the V3 API for role creation.

Groups only exist in the v3 identity API and so we must specify
--os-identity-api-version in these commands.

Implements: bp keystonev3
Closes-Bug: #1470668
Change-Id: I5e01d23ebcb5a0c7de56233071a4eb9b16d3b813
---
 functions-common | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index 9023e85fad..a1a8afaecf 100644
--- a/functions-common
+++ b/functions-common
@@ -753,7 +753,10 @@ function get_or_create_project {
 function get_or_create_role {
     local role_id=$(
         # Creates role with --or-show
-        openstack role create $1 --or-show -f value -c id
+        openstack role create $1 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            --or-show -f value -c id
     )
     echo $role_id
 }
@@ -764,8 +767,10 @@ function get_or_add_user_project_role {
     # Gets user role id
     local user_role_id=$(openstack role list \
         --user $2 \
-        --project $3 \
+        --os-url=$KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
         --column "ID" \
+        --project $3 \
         --column "Name" \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
@@ -774,6 +779,8 @@ function get_or_add_user_project_role {
             $1 \
             --user $2 \
             --project $3 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             | grep " id " | get_field 2)
     fi
     echo $user_role_id
@@ -784,18 +791,24 @@ function get_or_add_user_project_role {
 function get_or_add_group_project_role {
     # Gets group role id
     local group_role_id=$(openstack role list \
+        --os-url=$KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
         --group $2 \
         --project $3 \
-        --column "ID" \
-        --column "Name" \
-        | grep " $1 " | get_field 1)
+        -c "ID" -f value)
     if [[ -z "$group_role_id" ]]; then
-        # Adds role to group
-        group_role_id=$(openstack role add \
-            $1 \
+        # Adds role to group and get it
+        openstack role add $1 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            --group $2 \
+            --project $3
+        group_role_id=$(openstack role list \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             --group $2 \
             --project $3 \
-            | grep " id " | get_field 2)
+            -c "ID" -f value)
     fi
     echo $group_role_id
 }

From 494f7cdf35d025f73b4cce9a3bde7b433183b1d8 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 29 May 2015 08:33:03 +0000
Subject: [PATCH 0748/3333] Use openstack cli for cinder type creation

This command was commented out so assumedly there used to be a bug. Switch to
OpenStackClient as the cinder CLI doesn't handle v3 auth correctly.

Implements: bp keystonev3
Change-Id: I1acdc04cf04b7056701bdded31ef2a015de5bce3
---
 lib/cinder | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index e51cd8ba1b..eb32b719c8 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -480,13 +480,10 @@ function stop_cinder {
 function create_volume_types {
     # Create volume types
     if is_service_enabled c-api && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
-        local be be_name be_type
+        local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
-            be_type=${be%%:*}
             be_name=${be##*:}
-            # openstack volume type create --property volume_backend_name="${be_type}" ${be_name}
-            cinder type-create ${be_name} && \
-                cinder type-key ${be_name} set volume_backend_name="${be_name}"
+            openstack volume type create --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }

From 9d6d8f801571a1a0e6eff90cd2bfcdbac7945bcc Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Mon, 22 Jun 2015 03:37:59 +0000
Subject: [PATCH 0749/3333] Use project instead of tenant in create_userrc

The create_userrc file is littered with references to a tenant. The tenant
concept has been deprecated long enough that we should use project instead.

I have not attempted to maintain compatibility with the --os-tenant-X flags
because I have not found reference to anyone using this script outside of
devstack.

Change-Id: I613f1bdc6673f0c4bfe29aaab7b514348a617a8c
---
 tools/create_userrc.sh | 103 +++++++++++++++++++++++------------------
 1 file changed, 57 insertions(+), 46 deletions(-)

diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index f067ed1f4b..3f10abbf7c 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -16,45 +16,45 @@ cat <<EOF
 
 usage: $0 <options..>
 
-This script creates certificates and sourcable rc files per tenant/user.
+This script creates certificates and sourcable rc files per project/user.
 
 Target account directory hierarchy:
 target_dir-|
            |-cacert.pem
-           |-tenant1-name|
-           |             |- user1
-           |             |- user1-cert.pem
-           |             |- user1-pk.pem
-           |             |- user2
-           |             ..
-           |-tenant2-name..
+           |-project1-name|
+           |              |- user1
+           |              |- user1-cert.pem
+           |              |- user1-pk.pem
+           |              |- user2
+           |              ..
+           |-project2-name..
            ..
 
 Optional Arguments
 -P include password to the rc files; with -A it assume all users password is the same
 -A try with all user
 -u <username> create files just for the specified user
--C <tenant_name> create user and tenant, the specifid tenant will be the user's tenant
--r <name> when combined with -C and the (-u) user exists it will be the user's tenant role in the (-C)tenant (default: Member)
+-C <project_name> create user and project, the specifid project will be the user's project
+-r <name> when combined with -C and the (-u) user exists it will be the user's project role in the (-C)project (default: Member)
 -p <userpass> password for the user
 --heat-url <heat_url>
 --os-username <username>
 --os-password <admin password>
---os-tenant-name <tenant_name>
---os-tenant-id <tenant_id>
+--os-project-name <project_name>
+--os-project-id <project_id>
 --os-auth-url <auth_url>
 --os-cacert <cert file>
 --target-dir <target_directory>
---skip-tenant <tenant-name>
+--skip-project <project-name>
 --debug
 
 Example:
 $0 -AP
-$0 -P -C mytenant -u myuser -p mypass
+$0 -P -C myproject -u myuser -p mypass
 EOF
 }
 
-if ! options=$(getopt -o hPAp:u:r:C: -l os-username:,os-password:,os-tenant-name:,os-tenant-id:,os-auth-url:,target-dir:,heat-url:,skip-tenant:,os-cacert:,help,debug -- "$@"); then
+if ! options=$(getopt -o hPAp:u:r:C: -l os-username:,os-password:,os-tenant-id:,os-tenant-name:,os-project-name:,os-project-id:,os-auth-url:,target-dir:,heat-url:,skip-project:,os-cacert:,help,debug -- "$@"); then
     display_help
     exit 1
 fi
@@ -62,10 +62,10 @@ eval set -- $options
 ADDPASS=""
 HEAT_URL=""
 
-# The services users usually in the service tenant.
+# The services users usually in the service project.
 # rc files for service users, is out of scope.
-# Supporting different tenant for services is out of scope.
-SKIP_TENANT="service"
+# Supporting different project for services is out of scope.
+SKIP_PROJECT="service"
 MODE=""
 ROLE=Member
 USER_NAME=""
@@ -75,9 +75,12 @@ while [ $# -gt 0 ]; do
     -h|--help) display_help; exit 0 ;;
     --os-username) export OS_USERNAME=$2; shift ;;
     --os-password) export OS_PASSWORD=$2; shift ;;
-    --os-tenant-name) export OS_TENANT_NAME=$2; shift ;;
-    --os-tenant-id) export OS_TENANT_ID=$2; shift ;;
-    --skip-tenant) SKIP_TENANT="$SKIP_TENANT$2,"; shift ;;
+    --os-tenant-name) export OS_PROJECT_NAME=$2; shift ;;
+    --os-tenant-id) export OS_PROJECT_ID=$2; shift ;;
+    --os-project-name) export OS_PROJECT_NAME=$2; shift ;;
+    --os-project-id) export OS_PROJECT_ID=$2; shift ;;
+    --skip-tenant) SKIP_PROJECT="$SKIP_PROJECT$2,"; shift ;;
+    --skip-project) SKIP_PROJECT="$SKIP_PROJECT$2,"; shift ;;
     --os-auth-url) export OS_AUTH_URL=$2; shift ;;
     --os-cacert) export OS_CACERT=$2; shift ;;
     --target-dir) ACCOUNT_DIR=$2; shift ;;
@@ -87,7 +90,7 @@ while [ $# -gt 0 ]; do
     -p) USER_PASS=$2; shift ;;
     -A) MODE=all; ;;
     -P) ADDPASS="yes" ;;
-    -C) MODE=create; TENANT=$2; shift ;;
+    -C) MODE=create; PROJECT=$2; shift ;;
     -r) ROLE=$2; shift ;;
     (--) shift; break ;;
     (-*) echo "$0: error - unrecognized option $1" >&2; display_help; exit 1 ;;
@@ -105,8 +108,16 @@ if [ -z "$OS_PASSWORD" ]; then
     fi
 fi
 
-if [ -z "$OS_TENANT_NAME" -a -z "$OS_TENANT_ID" ]; then
-    export OS_TENANT_NAME=admin
+if [ -z "$OS_PROJECT_ID" -a "$OS_TENANT_ID" ]; then
+    export OS_PROJECT_ID=$OS_TENANT_ID
+fi
+
+if [ -z "$OS_PROJECT_NAME" -a "$OS_TENANT_NAME" ]; then
+    export OS_PROJECT_NAME=$OS_TENANT_NAME
+fi
+
+if [ -z "$OS_PROJECT_NAME" -a -z "$OS_PROJECT_ID" ]; then
+    export OS_PROJECT_NAME=admin
 fi
 
 if [ -z "$OS_USERNAME" ]; then
@@ -156,21 +167,21 @@ fi
 function add_entry {
     local user_id=$1
     local user_name=$2
-    local tenant_id=$3
-    local tenant_name=$4
+    local project_id=$3
+    local project_name=$4
     local user_passwd=$5
 
     # The admin user can see all user's secret AWS keys, it does not looks good
-    local line=`openstack ec2 credentials list --user $user_id | grep " $tenant_id "`
+    local line=`openstack ec2 credentials list --user $user_id | grep " $project_id "`
     if [ -z "$line" ]; then
-        openstack ec2 credentials create --user $user_id --project $tenant_id 1>&2
-        line=`openstack ec2 credentials list --user $user_id | grep " $tenant_id "`
+        openstack ec2 credentials create --user $user_id --project $project_id 1>&2
+        line=`openstack ec2 credentials list --user $user_id | grep " $project_id "`
     fi
     local ec2_access_key ec2_secret_key
     read ec2_access_key ec2_secret_key <<<  `echo $line | awk '{print $2 " " $4 }'`
-    mkdir -p "$ACCOUNT_DIR/$tenant_name"
-    local rcfile="$ACCOUNT_DIR/$tenant_name/$user_name"
-    # The certs subject part are the tenant ID "dash" user ID, but the CN should be the first part of the DN
+    mkdir -p "$ACCOUNT_DIR/$project_name"
+    local rcfile="$ACCOUNT_DIR/$project_name/$user_name"
+    # The certs subject part are the project ID "dash" user ID, but the CN should be the first part of the DN
     # Generally the subject DN parts should be in reverse order like the Issuer
     # The Serial does not seams correctly marked either
     local ec2_cert="$rcfile-cert.pem"
@@ -183,7 +194,7 @@ function add_entry {
         mv -f "$ec2_cert" "$ec2_cert.old"
     fi
     # It will not create certs when the password is incorrect
-    if ! nova --os-password "$user_passwd" --os-username "$user_name" --os-tenant-name "$tenant_name" x509-create-cert "$ec2_private_key" "$ec2_cert"; then
+    if ! nova --os-password "$user_passwd" --os-username "$user_name" --os-project-name "$project_name" x509-create-cert "$ec2_private_key" "$ec2_cert"; then
         if [ -e "$ec2_private_key.old" ]; then
             mv -f "$ec2_private_key.old" "$ec2_private_key"
         fi
@@ -199,8 +210,8 @@ export EC2_URL="$EC2_URL"
 export S3_URL="$S3_URL"
 # OpenStack USER ID = $user_id
 export OS_USERNAME="$user_name"
-# OpenStack Tenant ID = $tenant_id
-export OS_TENANT_NAME="$tenant_name"
+# OpenStack project ID = $project_id
+export OS_PROJECT_NAME="$project_name"
 export OS_AUTH_URL="$OS_AUTH_URL"
 export OS_CACERT="$OS_CACERT"
 export EC2_CERT="$ec2_cert"
@@ -213,7 +224,7 @@ EOF
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"
     fi
     if [ -n "$HEAT_URL" ]; then
-        echo "export HEAT_URL=\"$HEAT_URL/$tenant_id\"" >>"$rcfile"
+        echo "export HEAT_URL=\"$HEAT_URL/$project_id\"" >>"$rcfile"
         echo "export OS_NO_CLIENT_AUTH=True" >>"$rcfile"
     fi
 }
@@ -245,9 +256,9 @@ function get_user_id {
 }
 
 if [ $MODE != "create" ]; then
-    # looks like I can't ask for all tenant related to a specified user
-    openstack project list --long --quote none -f csv | grep ',True' | grep -v "${SKIP_TENANT}" | while IFS=, read tenant_id tenant_name desc enabled; do
-        openstack user list --project $tenant_id --long --quote none -f csv | grep ',True' | while IFS=, read user_id user_name project email enabled; do
+    # looks like I can't ask for all project related to a specified user
+    openstack project list --long --quote none -f csv | grep ',True' | grep -v "${SKIP_PROJECT}" | while IFS=, read project_id project_name desc enabled; do
+        openstack user list --project $project_id --long --quote none -f csv | grep ',True' | while IFS=, read user_id user_name project email enabled; do
             if [ $MODE = one -a "$user_name" != "$USER_NAME" ]; then
                 continue;
             fi
@@ -259,21 +270,21 @@ if [ $MODE != "create" ]; then
             if [ -n "$SPECIFIC_UPASSWORD" ]; then
                 USER_PASS=$SPECIFIC_UPASSWORD
             fi
-            add_entry "$user_id" "$user_name" "$tenant_id" "$tenant_name" "$USER_PASS"
+            add_entry "$user_id" "$user_name" "$project_id" "$project_name" "$USER_PASS"
         done
     done
 else
-    tenant_name=$TENANT
-    tenant_id=$(create_or_get_project "$TENANT")
+    project_name=$PROJECT
+    project_id=$(create_or_get_project "$PROJECT")
     user_name=$USER_NAME
     user_id=`get_user_id $user_name`
     if [ -z "$user_id" ]; then
-        eval $(openstack user create "$user_name" --project "$tenant_id" --password "$USER_PASS" --email "$user_name@example.com" -f shell -c id)
+        eval $(openstack user create "$user_name" --project "$project_id" --password "$USER_PASS" --email "$user_name@example.com" -f shell -c id)
         user_id=$id
-        add_entry "$user_id" "$user_name" "$tenant_id" "$tenant_name" "$USER_PASS"
+        add_entry "$user_id" "$user_name" "$project_id" "$project_name" "$USER_PASS"
     else
         role_id=$(create_or_get_role "$ROLE")
-        openstack role add "$role_id" --user "$user_id" --project "$tenant_id"
-        add_entry "$user_id" "$user_name" "$tenant_id" "$tenant_name" "$USER_PASS"
+        openstack role add "$role_id" --user "$user_id" --project "$project_id"
+        add_entry "$user_id" "$user_name" "$project_id" "$project_name" "$USER_PASS"
     fi
 fi

From c54d4ab9104057b82e02dc9a62f0dd35928f6f64 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Mon, 22 Jun 2015 04:07:18 +0000
Subject: [PATCH 0750/3333] Include domain variables in accrc

Include the user and project domain parameters in the generated user rc files.
This is fairly simplistic, if we were to follow the existing attitudes we
should iterate over the domains and add a new level of folders however this
would change the output location for files that may be depended upon.

Change-Id: I5e9e78406b11382751a591d91f711161bb98f47a
---
 tools/create_userrc.sh | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 3f10abbf7c..c2dbe1aeb4 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -42,6 +42,10 @@ Optional Arguments
 --os-password <admin password>
 --os-project-name <project_name>
 --os-project-id <project_id>
+--os-user-domain-id <user_domain_id>
+--os-user-domain-name <user_domain_name>
+--os-project-domain-id <project_domain_id>
+--os-project-domain-name <project_domain_name>
 --os-auth-url <auth_url>
 --os-cacert <cert file>
 --target-dir <target_directory>
@@ -54,7 +58,7 @@ $0 -P -C myproject -u myuser -p mypass
 EOF
 }
 
-if ! options=$(getopt -o hPAp:u:r:C: -l os-username:,os-password:,os-tenant-id:,os-tenant-name:,os-project-name:,os-project-id:,os-auth-url:,target-dir:,heat-url:,skip-project:,os-cacert:,help,debug -- "$@"); then
+if ! options=$(getopt -o hPAp:u:r:C: -l os-username:,os-password:,os-tenant-id:,os-tenant-name:,os-project-name:,os-project-id:,os-project-domain-id:,os-project-domain-name:,os-user-domain-id:,os-user-domain-name:,os-auth-url:,target-dir:,heat-url:,skip-project:,os-cacert:,help,debug -- "$@"); then
     display_help
     exit 1
 fi
@@ -79,6 +83,10 @@ while [ $# -gt 0 ]; do
     --os-tenant-id) export OS_PROJECT_ID=$2; shift ;;
     --os-project-name) export OS_PROJECT_NAME=$2; shift ;;
     --os-project-id) export OS_PROJECT_ID=$2; shift ;;
+    --os-user-domain-id) export OS_USER_DOMAIN_ID=$2; shift ;;
+    --os-user-domain-name) export OS_USER_DOMAIN_NAME=$2; shift ;;
+    --os-project-domain-id) export OS_PROJECT_DOMAIN_ID=$2; shift ;;
+    --os-project-domain-name) export OS_PROJECT_DOMAIN_NAME=$2; shift ;;
     --skip-tenant) SKIP_PROJECT="$SKIP_PROJECT$2,"; shift ;;
     --skip-project) SKIP_PROJECT="$SKIP_PROJECT$2,"; shift ;;
     --os-auth-url) export OS_AUTH_URL=$2; shift ;;
@@ -128,6 +136,16 @@ if [ -z "$OS_AUTH_URL" ]; then
     export OS_AUTH_URL=http://localhost:5000/v2.0/
 fi
 
+if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
+    # purposefully not exported as it would force v3 auth within this file.
+    OS_USER_DOMAIN_ID=default
+fi
+
+if [ -z "$OS_PROJECT_DOMAIN_ID" -a -z "$OS_PROJECT_DOMAIN_NAME" ]; then
+    # purposefully not exported as it would force v3 auth within this file.
+    OS_PROJECT_DOMAIN_ID=default
+fi
+
 USER_PASS=${USER_PASS:-$OS_PASSWORD}
 USER_NAME=${USER_NAME:-$OS_USERNAME}
 
@@ -219,6 +237,7 @@ export EC2_PRIVATE_KEY="$ec2_private_key"
 export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
 export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
+export OS_AUTH_TYPE=v2password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"
@@ -227,6 +246,13 @@ EOF
         echo "export HEAT_URL=\"$HEAT_URL/$project_id\"" >>"$rcfile"
         echo "export OS_NO_CLIENT_AUTH=True" >>"$rcfile"
     fi
+    for v in OS_USER_DOMAIN_ID OS_USER_DOMAIN_NAME OS_PROJECT_DOMAIN_ID OS_PROJECT_DOMAIN_NAME; do
+        if [ ${!v} ]; then
+            echo "export $v=${!v}" >>"$rcfile"
+        else
+            echo "unset $v" >>"$rcfile"
+        fi
+    done
 }
 
 #admin users expected

From 6e121ff53e85fbe8f9eb9437403a4302bd0ee222 Mon Sep 17 00:00:00 2001
From: John Hua <john.hua@citrix.com>
Date: Wed, 8 Jul 2015 03:00:07 +0100
Subject: [PATCH 0751/3333] Remove unused files from tools/xen.

Most of unused files were used with build_domU_multi.sh which has been
replaced by build_xva.sh. Besides tools/xen/scripts/templatedelete.sh
was created for convenience purposes and now not in use.

Change-Id: I4282c779629e3413ee3cd3ff134c3b7b19eee487
Closes-Bug: #1470535
---
 tools/xen/build_domU_multi.sh       |  29 ---
 tools/xen/files/fstab               |   5 -
 tools/xen/files/hvc0.conf           |  10 -
 tools/xen/scripts/mkxva             | 365 ----------------------------
 tools/xen/scripts/templatedelete.sh |   9 -
 tools/xen/templates/hosts.in        |   8 -
 tools/xen/templates/menu.lst.in     |   6 -
 tools/xen/templates/ova.xml.in      |  14 --
 8 files changed, 446 deletions(-)
 delete mode 100755 tools/xen/build_domU_multi.sh
 delete mode 100644 tools/xen/files/fstab
 delete mode 100644 tools/xen/files/hvc0.conf
 delete mode 100755 tools/xen/scripts/mkxva
 delete mode 100755 tools/xen/scripts/templatedelete.sh
 delete mode 100644 tools/xen/templates/hosts.in
 delete mode 100644 tools/xen/templates/menu.lst.in
 delete mode 100644 tools/xen/templates/ova.xml.in

diff --git a/tools/xen/build_domU_multi.sh b/tools/xen/build_domU_multi.sh
deleted file mode 100755
index 0eb2077414..0000000000
--- a/tools/xen/build_domU_multi.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-# Echo commands
-set -o xtrace
-
-# Head node host, which runs glance, api, keystone
-HEAD_PUB_IP=${HEAD_PUB_IP:-192.168.1.57}
-HEAD_MGT_IP=${HEAD_MGT_IP:-172.16.100.57}
-
-COMPUTE_PUB_IP=${COMPUTE_PUB_IP:-192.168.1.58}
-COMPUTE_MGT_IP=${COMPUTE_MGT_IP:-172.16.100.58}
-
-# Networking params
-FLOATING_RANGE=${FLOATING_RANGE:-192.168.1.196/30}
-
-# Variables common amongst all hosts in the cluster
-COMMON_VARS="$STACKSH_PARAMS MYSQL_HOST=$HEAD_MGT_IP RABBIT_HOST=$HEAD_MGT_IP GLANCE_HOSTPORT=$HEAD_MGT_IP:9292 FLOATING_RANGE=$FLOATING_RANGE"
-
-# Helper to launch containers
-function build_xva {
-    GUEST_NAME=$1 PUB_IP=$2 MGT_IP=$3 DO_SHUTDOWN=$4 TERMINATE=$TERMINATE STACKSH_PARAMS="$COMMON_VARS $5" ./build_xva.sh
-}
-
-# Launch the head node - headnode uses a non-ip domain name,
-# because rabbit won't launch with an ip addr hostname :(
-build_xva HEADNODE $HEAD_PUB_IP $HEAD_MGT_IP 1 "ENABLED_SERVICES=g-api,g-reg,key,n-api,n-sch,n-vnc,horizon,mysql,rabbit"
-
-# Build the HA compute host
-build_xva COMPUTENODE $COMPUTE_PUB_IP $COMPUTE_MGT_IP 0 "ENABLED_SERVICES=n-cpu,n-net,n-api"
diff --git a/tools/xen/files/fstab b/tools/xen/files/fstab
deleted file mode 100644
index 6c9b9818c3..0000000000
--- a/tools/xen/files/fstab
+++ /dev/null
@@ -1,5 +0,0 @@
-LABEL=vpxroot           /                       ext3    defaults        1 1
-tmpfs                   /dev/shm                tmpfs   defaults        0 0
-devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
-sysfs                   /sys                    sysfs   defaults        0 0
-proc                    /proc                   proc    defaults        0 0
diff --git a/tools/xen/files/hvc0.conf b/tools/xen/files/hvc0.conf
deleted file mode 100644
index 4eedaf6ee1..0000000000
--- a/tools/xen/files/hvc0.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-# hvc0 - getty
-#
-# This service maintains a getty on hvc0 from the point the system is
-# started until it is shut down again.
-
-start on stopped rc RUNLEVEL=[2345]
-stop on runlevel [!2345]
-
-respawn
-exec /sbin/getty -8 9600 hvc0
diff --git a/tools/xen/scripts/mkxva b/tools/xen/scripts/mkxva
deleted file mode 100755
index 392c05b407..0000000000
--- a/tools/xen/scripts/mkxva
+++ /dev/null
@@ -1,365 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2011 Citrix Systems, Inc.
-# Copyright 2011 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-
-set -eu
-
-set -o xtrace
-
-VBOX_IMG=/output/packages/vbox-img
-
-usage() {
-    cat >&2 <<EOF
-$0 -o <output filenames> -t <types> -x <xml files> <fs-staging-dir> <fs-size-MiB> <tmpdir>
-  -o: Colon-separated list of output filenames (one for each type).
-  -p: Create a disk label and partition within the output image
-  -t: Colon-separated list of types of output file.  xva and ovf supported.
-  -x: XML filenames (one for each type)
-
-EOF
-    exit 1
-}
-
-# parse cmdline
-
-OPT_USE_PARTITION=
-OPT_TYPES=
-OPT_OUTPUT_FILES=
-OPT_XML_FILES=
-
-while getopts o:pt:x: o
-do case "$o" in
-    o)    OPT_OUTPUT_FILES=$(echo "$OPTARG" | sed -e 's/\s*:\s*/ /g')
-        ;;
-    p)    OPT_USE_PARTITION=1
-        ;;
-    t)    OPT_TYPES=$(echo "$OPTARG" | sed -e 's/\s*:\s*/ /g')
-        ;;
-    x)    OPT_XML_FILES=$(echo "$OPTARG" | sed -e 's/\s*:\s*/ /g')
-        ;;
-    [?])  usage
-        ;;
-    esac
-done
-shift $((OPTIND-1))
-
-[ $# -ne 3 ] && usage
-FS_STAGING="$1"
-FS_SIZE_MIB="$2"
-TMPDIR="$3"
-
-if [ "$UID" = "0" ]
-then
-  SUDO=
-else
-  SUDO=sudo
-fi
-
-if [ "$FS_SIZE_MIB" = "0" ]
-then
-    # Just create a dummy file.  This allows developers to bypass bits of
-    # the build by setting the size to 0.
-    touch $OPT_OUTPUT_FILES
-    exit 0
-fi
-
-# create temporary files and dirs
-FS_TMPFILE=$(mktemp "$TMPDIR/mkxva-fsimg-XXXXX")
-XVA_TARBALL_STAGING=$(mktemp -d "$TMPDIR/mkxva-tarball-staging-XXXXX")
-OVF_STAGING=$(mktemp -d "$TMPDIR/mkxva-ovf-staging-XXXXX")
-
-# Find udevsettle and udevtrigger on this installation
-if [ -x "/sbin/udevsettle" ] ; then
-    UDEVSETTLE="/sbin/udevsettle --timeout=30"
-elif [ -x "/sbin/udevadm" ] ; then
-    UDEVSETTLE='/sbin/udevadm settle'
-else
-    UDEVSETTLE='/bin/true'
-fi
-
-if [ -x "/sbin/udevtrigger" ] ; then
-    UDEVTRIGGER=/sbin/udevtrigger
-elif [ -x "/sbin/udevadm" ] ; then
-    UDEVTRIGGER='/sbin/udevadm trigger'
-else
-    UDEVTRIGGER=
-fi
-
-# CLEAN_ variables track devices and mounts that must be taken down
-# no matter how the script exits.  Loop devices are vulnerable to
-# exhaustion so we make every effort to remove them
-
-CLEAN_KPARTX=
-CLEAN_LOSETUP=
-CLEAN_MOUNTPOINT=
-
-cleanup_devices () {
-    if [ -n "$CLEAN_MOUNTPOINT" ] ; then
-        echo "Mountpoint $CLEAN_MOUNTPOINT removed on abnormal exit"
-        $SUDO umount "$CLEAN_MOUNTPOINT" || echo "umount failed"
-        rmdir "$CLEAN_MOUNTPOINT" || echo "rmdir failed"
-    fi
-    if [ -n "$CLEAN_KPARTX" ] ; then
-        echo "kpartx devices for $CLEAN_KPARTX removed on abnormal exit"
-        $SUDO kpartx -d "$CLEAN_KPARTX" || echo "kpartx -d failed"
-    fi
-    if [ -n "$CLEAN_LOSETUP" ] ; then
-        echo "Loop device $CLEAN_LOSETUP removed on abnormal exit"
-        $SUDO losetup -d "$CLEAN_LOSETUP" # Allow losetup errors to propagate
-    fi
-}
-
-trap "cleanup_devices" EXIT
-
-make_fs_inner () {
-    local staging="$1"
-    local output="$2"
-    local options="$3"
-    CLEAN_MOUNTPOINT=$(mktemp -d "$TMPDIR/mkfs-XXXXXX")
-
-    # copy staging dir contents to fs image
-    $SUDO mount $options "$output" "$CLEAN_MOUNTPOINT"
-    $SUDO tar -C "$staging" -c . | tar -C "$CLEAN_MOUNTPOINT" -x
-    $SUDO umount "$CLEAN_MOUNTPOINT"
-    rmdir "$CLEAN_MOUNTPOINT"
-    CLEAN_MOUNTPOINT=
-}
-
-# Turn a staging dir into an ext3 filesystem within a partition
-make_fs_in_partition () {
-    local staging="$1"
-    local output="$2"
-
-    # create new empty disk
-    dd if=/dev/zero of="$output" bs=1M count=$FS_SIZE_MIB
-    # Set up a loop device on the empty disk image
-    local loopdevice=$($SUDO losetup -f)
-    $SUDO losetup "$loopdevice" "$output"
-    CLEAN_LOSETUP="$loopdevice"
-    # Create a partition table and single partition.
-    # Start partition at sector 63 to allow space for grub
-    cat <<EOF
-Errors from sfdisk below are expected because the new disk is uninitialised
-  Expecting: sfdisk: ERROR: sector 0 does not have an msdos signature
-  Expecting: /dev/loop0: unrecognized partition table type
-EOF
-    $SUDO sfdisk -uS "$CLEAN_LOSETUP" <<EOF
-63 - - *
-EOF
-
-    # kpartx creates a device for the new partition
-    # in the form /dev/mapper/loop1p1
-    $SUDO kpartx -av "$CLEAN_LOSETUP"
-    CLEAN_KPARTX="$CLEAN_LOSETUP"
-    # Wait for the device to appear
-    $UDEVTRIGGER
-    $UDEVSETTLE  || echo "udev settle command return code non-zero"
-    # Infer the name of the partition device
-    local partition="${CLEAN_LOSETUP/dev/dev/mapper}p1"
-    # Set permissive privileges on the device
-    $SUDO chmod 0777 "$partition"
-    # Make an ext3 filesystem on the partition
-    /sbin/mkfs.ext3 -I 128 -m0 -F "$partition"
-    /sbin/e2label "$partition" vpxroot
-    make_fs_inner "$staging" "$partition" ""
-
-    # Now run grub on the image we've created
-    CLEAN_MOUNTPOINT=$(mktemp -d "$TMPDIR/mkfs-XXXXXX")
-
-    # copy Set up[ grub files prior to installing grub within the image
-    $SUDO mount "$partition" "$CLEAN_MOUNTPOINT"
-    $SUDO cp $CLEAN_MOUNTPOINT/usr/share/grub/i386-redhat/* "$CLEAN_MOUNTPOINT/boot/grub"
-    kernel_version=$($SUDO chroot "$CLEAN_MOUNTPOINT" rpm -qv kernel | sed -e 's/kernel-//')
-    kernel_version_xen=$($SUDO chroot "$CLEAN_MOUNTPOINT" rpm -qv kernel-xen | sed -e 's/kernel-xen-//')
-    $SUDO cat > "$CLEAN_MOUNTPOINT/boot/grub/grub.conf" <<EOF
-default 0
-timeout 2
-
-title vmlinuz-$kernel_version (HVM)
-        root (hd0,0)
-        kernel /boot/vmlinuz-$kernel_version ro root=LABEL=vpxroot
-        initrd /boot/initrd-$kernel_version.img
-
-title vmlinuz-${kernel_version_xen}xen (PV)
-        root (hd0,0)
-        kernel /boot/vmlinuz-${kernel_version_xen}xen ro root=LABEL=vpxroot console=xvc0
-        initrd /boot/initrd-${kernel_version_xen}xen.img
-EOF
-
-    $SUDO umount "$CLEAN_MOUNTPOINT"
-    CLEAN_MOUNTPOINT=
-
-    # Grub expects a disk with name /dev/xxxx with a first partition
-    # named /dev/xxxx1, so we give it what it wants using symlinks
-    # Note: /dev is linked to the real /dev of the build machine, so
-    # must be cleaned up
-    local disk_name="/dev/osxva$$bld"
-    local disk_part1_name="${disk_name}1"
-    rm -f "$disk_name"
-    rm -f "$disk_part1_name"
-    ln -s "$CLEAN_LOSETUP" "$disk_name"
-    ln -s "$partition" "$disk_part1_name"
-
-    # Feed commands into the grub shell to setup the disk
-    grub --no-curses --device-map=/dev/null <<EOF
-device (hd0) $disk_name
-setup (hd0) (hd0,0)
-quit
-EOF
-
-    # Cleanup
-    rm -f "$disk_name"
-    rm -f "$disk_part1_name"
-    $SUDO kpartx -dv "$CLEAN_KPARTX"
-    CLEAN_KPARTX=
-    $SUDO losetup -d "$CLEAN_LOSETUP"
-    CLEAN_LOSETUP=
-}
-
-# turn a staging dir into an ext3 filesystem image
-make_fs () {
-    local staging="$1"
-    local output="$2"
-
-    # create new empty fs
-    dd if=/dev/zero of="$output" bs=1M count=0 seek=$FS_SIZE_MIB
-    /sbin/mkfs.ext3 -m0 -F "$output"
-    /sbin/e2label "$output" vpxroot
-    make_fs_inner "$staging" "$output" "-oloop"
-}
-
-
-# split a virtual disk image into the format expected inside an xva file
-splitvdi () {
-    local diskimg="$1"
-    local outputdir="$2"
-    local rio="$3"
-
-    local n_bytes=$(stat --printf=%s "$diskimg")
-    local n_meg=$((($n_bytes+$((1024*1024 -1)))/$((1024*1024))))
-    local i=0
-    while [ $i -lt $n_meg ] ; do
-	if [ $rio -eq 0 ] ; then
-		local file="$outputdir"/chunk-$(printf "%08d" $i)
-		dd if="$diskimg" of="$file" skip=$i bs=1M count=1 2>/dev/null
-		gzip "$file"
-	else
-		local file="$outputdir"/$(printf "%08d" $i)
-	        dd if="$diskimg" of="$file" skip=$i bs=1M count=1 2>/dev/null
-		local chksum=$(sha1sum -b "$file")
-		echo -n "${chksum/ */}" > "$file.checksum"
-	fi
-	i=$(($i + 1))
-    done
-}
-
-if [ -n "$OPT_USE_PARTITION" ] ; then
-    make_fs_in_partition "$FS_STAGING" "$FS_TMPFILE"
-else
-    make_fs "$FS_STAGING" "$FS_TMPFILE"
-fi
-
-VDI_SIZE=$(stat --format=%s "$FS_TMPFILE")
-
-make_xva () {
-    local output_file="$1"
-    local xml_file="$2"
-    local subdir
-    local rio
-
-    if [[ `cat $xml_file` =~ "<member>\s*<name>class</name>\s*<value>VDI</value>\s*</member>\s*<member>\s*<name>id</name>\s*<value>(Ref:[0-9]+)</value>" ]]
-    then
-        # it's a rio style xva
-        subdir="${BASH_REMATCH[1]}";
-        rio=1
-    else
-        # it's a geneva style xva
-        subdir="xvda"
-        rio=0
-    fi
-
-    cp "$xml_file" "$XVA_TARBALL_STAGING"/ova.xml
-    sed -i -e "s/@VDI_SIZE@/$VDI_SIZE/" "$XVA_TARBALL_STAGING"/ova.xml
-    mkdir "$XVA_TARBALL_STAGING/$subdir"
-    splitvdi "$FS_TMPFILE" "$XVA_TARBALL_STAGING/$subdir" "$rio"
-    TARFILE_MEMBERS=$(cd "$XVA_TARBALL_STAGING" && echo ova.xml $subdir/*)
-    tar -C "$XVA_TARBALL_STAGING" --format=v7 -c $TARFILE_MEMBERS -f "$output_file.tmp"
-    mv "$output_file.tmp" "$output_file"
-}
-
-make_ovf () {
-    local output_dir="$1"
-    local xml_file="$2"
-    local output_base=$(basename "$output_dir")
-    local disk="$output_dir/${output_base}.vmdk"
-    local manifest="$output_dir/${output_base}.mf"
-    local ovf="$output_dir/${output_base}.ovf"
-
-    mkdir -p "$output_dir"
-    rm -f "$disk"
-    $VBOX_IMG convert --srcfilename="$FS_TMPFILE" --dstfilename="$disk" \
-        --srcformat RAW --dstformat VMDK --variant Stream
-    chmod 0644 "$disk"
-
-    local n_bytes=$(stat --printf=%s "$disk")
-    cp "$xml_file" "$ovf"
-    sed -i -e "s/@MKXVA_DISK_FULLSIZE@/$VDI_SIZE/" "$ovf"
-    sed -i -e "s/@MKXVA_DISK_SIZE@/$n_bytes/" "$ovf"
-    sed -i -e "s/@MKXVA_DISK_MIB_SIZE@/$FS_SIZE_MIB/" "$ovf"
-    sed -i -e "s/@MKXVA_DISK_FILENAME@/${output_base}.vmdk/" "$ovf"
-
-    for to_sign in "$ovf" "$disk"
-    do
-	local sha1_sum=$(sha1sum "$to_sign" | cut -d' ' -f1)
-	echo "SHA1($(basename "$to_sign"))= $sha1_sum" >> $manifest
-    done
-}
-
-output_files="$OPT_OUTPUT_FILES"
-xml_files="$OPT_XML_FILES"
-# Iterate through the type list creating the relevant VMs
-for create_type in $OPT_TYPES
-do
-    # Shift one parameter from the front of the lists
-    create_output_file="${output_files%% *}"
-    output_files="${output_files#* }"
-    create_xml_file="${xml_files%% *}"
-    xml_files="${xml_files#* }"
-    echo "Creating $create_type appliance $create_output_file using metadata file $create_xml_file"
-
-    case "$create_type" in
-	xva)
-	    make_xva "$create_output_file" "$create_xml_file"
-	    ;;
-	ovf)
-	    make_ovf "$create_output_file" "$create_xml_file"
-	    ;;
-	*)
-	    echo "Unknown VM type '$create_type'"
-	    exit 1
-	    ;;
-    esac
-
-done
-
-
-# cleanup
-if [ -z "${DO_NOT_CLEANUP:-}" ] ; then
-    rm -rf "$XVA_TARBALL_STAGING"
-    rm -f "$FS_TMPFILE"
-fi
diff --git a/tools/xen/scripts/templatedelete.sh b/tools/xen/scripts/templatedelete.sh
deleted file mode 100755
index 66765b2446..0000000000
--- a/tools/xen/scripts/templatedelete.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-#Usage: ./templatedelete.sh <template-uuid>
-
-templateuuid="$1"
-
-xe template-param-set other-config:default_template=false uuid="$templateuuid"
-xe template-param-set is-a-template=false uuid="$templateuuid"
-xe vm-destroy uuid="$templateuuid"
diff --git a/tools/xen/templates/hosts.in b/tools/xen/templates/hosts.in
deleted file mode 100644
index 8ab4c3e919..0000000000
--- a/tools/xen/templates/hosts.in
+++ /dev/null
@@ -1,8 +0,0 @@
-127.0.0.1   localhost
-127.0.0.1   %HOSTNAME%
-::1     localhost ip6-localhost ip6-loopback
-fe00::0     ip6-localnet
-ff00::0     ip6-mcastprefix
-ff02::1     ip6-allnodes
-ff02::2     ip6-allrouters
-
diff --git a/tools/xen/templates/menu.lst.in b/tools/xen/templates/menu.lst.in
deleted file mode 100644
index 8bc6426251..0000000000
--- a/tools/xen/templates/menu.lst.in
+++ /dev/null
@@ -1,6 +0,0 @@
-default 0
-
-title default
-        root (hd0,0)
-        kernel /boot/vmlinuz-@KERNEL_VERSION@ ro root=LABEL=vpxroot console=xvc0
-        initrd /boot/initrd.img-@KERNEL_VERSION@
diff --git a/tools/xen/templates/ova.xml.in b/tools/xen/templates/ova.xml.in
deleted file mode 100644
index 01041e2030..0000000000
--- a/tools/xen/templates/ova.xml.in
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" ?>
-<appliance version="0.1">
-        <vm name="vm">
-                <label>
-                        @PRODUCT_BRAND@ @PRODUCT_VERSION@-@BUILD_NUMBER@
-                </label>
-                <shortdesc></shortdesc>
-                <config mem_set="1073741824" vcpus="1"/>
-                <hacks is_hvm="false"/>
-                <vbd device="xvda" function="root" mode="w" vdi="vdi_xvda"/>
-        </vm>
-        <vdi name="vdi_xvda" size="@VDI_SIZE@" source="file://xvda" type="dir-gzipped-chunks" variety="system"/>
-</appliance>
-

From e446fc3f5982089770a936cd8614fe75566cc103 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 8 Jul 2015 12:10:15 -0700
Subject: [PATCH 0752/3333] Set ATTACH_ENCRYPTED_VOLUME_AVAILABLE=False if
 testing with Ceph

The encrypted Cinder volume tests in Tempest don't actually work
properly for a Ceph backend in cinder since the volume encryption
support is not in Nova for RBD volume types.

This is needed for Cinder change
I03f8cae05cc117e14f7482115de685fc9f3fa54a which tells Nova that the rbd
volume connection is on an encrypted volume type.

Related-Bug: #1463525

Change-Id: I8548d41095513b9e669f773e3f35353e9228ead9
---
 lib/ceph | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/ceph b/lib/ceph
index 16dcda2f9e..5104629065 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -74,6 +74,10 @@ CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
 REMOTE_CEPH=$(trueorfalse False REMOTE_CEPH)
 REMOTE_CEPH_ADMIN_KEY_PATH=${REMOTE_CEPH_ADMIN_KEY_PATH:-$CEPH_CONF_DIR/ceph.client.admin.keyring}
 
+# Cinder encrypted volume tests are not supported with a Ceph backend due to
+# bug 1463525.
+ATTACH_ENCRYPTED_VOLUME_AVAILABLE=False
+
 
 # Functions
 # ------------

From 23cd71ac94cf11a18d5d153b963a96eabcb0cd15 Mon Sep 17 00:00:00 2001
From: Zhang Jinnan <zhang.jinnan@99cloud.net>
Date: Wed, 8 Jul 2015 11:36:32 -0400
Subject: [PATCH 0753/3333] Update Centos/RHEL to use Kilo RDO packages

Update Centos/RHEL to use Kilo based RDO

Change-Id: I901c4e9dfb6bce377b6afb19bbce94c71dfe127f
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 17cbe75802..012b726811 100755
--- a/stack.sh
+++ b/stack.sh
@@ -273,8 +273,8 @@ EOF
     # ... and also optional to be enabled
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
-    RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-juno/rdo-release-juno-1.noarch.rpm"}
-    RHEL_RDO_REPO_ID=${RHEL7_RDO_REPO_ID:-"openstack-juno"}
+    RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release-kilo-1.noarch.rpm"}
+    RHEL_RDO_REPO_ID=${RHEL7_RDO_REPO_ID:-"openstack-kilo"}
 
     if ! sudo yum repolist enabled $RHEL_RDO_REPO_ID | grep -q $RHEL_RDO_REPO_ID; then
         echo "RDO repo not detected; installing"

From f0247ed21ab38e525fb6edace5dbbdd7c14cfb2d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 9 Jul 2015 15:49:16 +1000
Subject: [PATCH 0754/3333] Move xtrace early

I dug back through the history to see why xtrace is enabled where it
is.  Originally (like first commit originally), it was somewhat sanely
placed to turn on tracing after it had done the interactive
"read_password" prompt stuff.  Over time, it has just shuffled it's
way down as stuff got added around it.

This was noticed this because I was looking for tracing of earlier
commands when looking at the repo setup (see
Iec2ad7b5598fdaefbc2338ade702bc7b08963b96) and couldn't find it.

Putting this at the start means we both capture all output
unconditionally, and avoid needlessly getting this interleaved at some
odd place again.

Change-Id: I441d7eecbab9d204258c18a071ccc1cbf4f7512a
---
 stack.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 17cbe75802..dea820a050 100755
--- a/stack.sh
+++ b/stack.sh
@@ -21,6 +21,10 @@
 
 # Learn more and get the most recent version at http://devstack.org
 
+# Print the commands being run so that we can see the command that triggers
+# an error.  It is also useful for following along as the install occurs.
+set -o xtrace
+
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
@@ -485,10 +489,6 @@ function err_trap {
 # Begin trapping error exit codes
 set -o errexit
 
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following along as the install occurs.
-set -o xtrace
-
 # Print the kernel version
 uname -a
 

From 89ee58523050443a38c284e8f0920dae152a901a Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 9 Jul 2015 13:25:04 -0700
Subject: [PATCH 0755/3333] neutron: add NOVA_ALLOW_DUPLICATE_NETWORKS config
 option

Nova commit 322cc9336fe6f6fe9b3f0da33c6b26a3e5ea9b0c added the
neutron.allow_duplicate_networks config option in Juno and it defaults
to False. The option was deprecated in Kilo with commit
4306d9190f49e7fadf88669d18effedabc880d3b and removed in Liberty with
commit b06867c581541ed325ddc5e5b5a2d53b1b0261ac so it's the default
behavior in Liberty.

To test it in the gate with Tempest, we need to be able to set it to
True in devstack-gate and update tempest.conf (since tempest is branchless
and we don't want to try to test duplicate networks against kilo/juno code).

We can remove the change to lib/tempest when it's removed from Tempest
after kilo-eol.

Depends-On: I05f81d86cde249c23be06d5804fadbf40fc4a7f3

Change-Id: Ifd075420f57c9b60746f4a6af6520c0ef04800db
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index a84ade2a81..cb5711f7d8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -30,6 +30,7 @@
 # - ``DEFAULT_INSTANCE_TYPE``
 # - ``DEFAULT_INSTANCE_USER``
 # - ``CINDER_ENABLED_BACKENDS``
+# - ``NOVA_ALLOW_DUPLICATE_NETWORKS``
 #
 # ``stack.sh`` calls the entry points in this order:
 #
@@ -380,6 +381,10 @@ function configure_tempest {
     # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_paused_instances True
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
+    # TODO(mriedem): Remove this when kilo-eol happens since the
+    # neutron.allow_duplicate_networks option was removed from nova in Liberty
+    # and is now the default behavior.
+    iniset $TEMPEST_CONFIG compute-feature-enabled allow_duplicate_networks ${NOVA_ALLOW_DUPLICATE_NETWORKS:-True}
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0

From ee6161720360f589485596dd572286d7a1865b17 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 22 Jun 2015 13:48:57 +0100
Subject: [PATCH 0756/3333] XenAPI: Update to a newer Cirros image

Update to 0.3.4 as it has support for config drive v2

Change-Id: Id8143f16fb3f0b6ce82c1332e8f695ac739a9e8c
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 09ba3e9807..c8069be994 100644
--- a/stackrc
+++ b/stackrc
@@ -564,8 +564,8 @@ case "$VIRT_DRIVER" in
         DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
         IMAGE_URLS=${IMAGE_URLS:-"http://partnerweb.vmware.com/programs/vmdkimage/cirros-0.3.2-i386-disk.vmdk"};;
     xenserver)
-        DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.0-x86_64-disk}
-        IMAGE_URLS=${IMAGE_URLS:-"https://github.com/downloads/citrix-openstack/warehouse/cirros-0.3.0-x86_64-disk.vhd.tgz"}
+        DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
+        IMAGE_URLS=${IMAGE_URLS:-"http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"}
         IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
     ironic)
         # Ironic can do both partition and full disk images, depending on the driver

From a3c94468baa159840a47c34cf94d97d816208313 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 23 Jun 2015 12:23:29 +0200
Subject: [PATCH 0757/3333] Remove support for enabling file injection

File injection is disabled in nova meanwhile, and devstack core
reviewers think it shouldn't be configureable in devstack anymore.
This basically reverts https://review.openstack.org/#/c/70560/

Change-Id: Ia7dd407da00c0b1c9641865aea1f7b74533d7357
---
 lib/nova_plugins/hypervisor-libvirt | 25 +++----------------------
 1 file changed, 3 insertions(+), 22 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index f70b21a475..f52629dc91 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -25,9 +25,6 @@ source $TOP_DIR/lib/nova_plugins/functions-libvirt
 # Defaults
 # --------
 
-# File injection is disabled by default in Nova.  This will turn it back on.
-ENABLE_FILE_INJECTION=$(trueorfalse False ENABLE_FILE_INJECTION)
-
 
 # Entry Points
 # ------------
@@ -60,17 +57,9 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF DEFAULT vnc_enabled "false"
     fi
 
-    if [[ "$ENABLE_FILE_INJECTION" = "True" ]] ; then
-        # When libguestfs is available for file injection, enable using
-        # libguestfs to inspect the image and figure out the proper
-        # partition to inject into.
-        iniset $NOVA_CONF libvirt inject_partition '-1'
-        iniset $NOVA_CONF libvirt inject_key 'true'
-    else
-        # File injection is being disabled by default in the near future -
-        # disable it here for now to avoid surprises later.
-        iniset $NOVA_CONF libvirt inject_partition '-2'
-    fi
+    # File injection is being disabled by default in the near future -
+    # disable it here for now to avoid surprises later.
+    iniset $NOVA_CONF libvirt inject_partition '-2'
 
     if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
@@ -96,14 +85,6 @@ function install_nova_hypervisor {
             yum_install libcgroup-tools
         fi
     fi
-
-    if [[ "$ENABLE_FILE_INJECTION" = "True" ]] ; then
-        if is_ubuntu; then
-            install_package python-guestfs
-        elif is_fedora || is_suse; then
-            install_package python-libguestfs
-        fi
-    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From 11cf23e03457357368cc40622ecc37cebe56293c Mon Sep 17 00:00:00 2001
From: Jeffrey Zhang <zhang.lei.fly@gmail.com>
Date: Wed, 15 Jul 2015 08:18:23 +0800
Subject: [PATCH 0758/3333] Fix the typo zaqar

Change-Id: Ic05b88a55f4110cd2e72985c7f3f544d0de8dd67
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c5c4e1eaa5..99bfb85b38 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,7 +26,7 @@ The following are plugins that exist for official OpenStack projects.
 +--------------------+-------------------------------------------+--------------------+
 |trove               |git://git.openstack.org/openstack/trove    |                    |
 +--------------------+-------------------------------------------+--------------------+
-|zaqar               |git://git.openstack.org/openstack/zarar    |                    |
+|zaqar               |git://git.openstack.org/openstack/zaqar    |                    |
 +--------------------+-------------------------------------------+--------------------+
 
 

From 7aaaf9090145b3e84e1d9a3c90e12bd370f5f31f Mon Sep 17 00:00:00 2001
From: Isao Yamagata <isao.yamagata@gmail.com>
Date: Sat, 11 Jul 2015 16:07:22 +0000
Subject: [PATCH 0759/3333] Fix distribution link in documentation

Fix broken link to distributions of OpenStack

Closes-Bug: #1469433
Change-Id: Ica572e11c0dedfe0684fad1c4d48b248f7003d47
---
 doc/source/faq.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index f61002baf2..0db8932e9c 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -16,7 +16,7 @@ upstream code.  It makes many choices that are not appropriate for
 production systems.
 
 Your best choice is probably to choose a `distribution of OpenStack
-<https://www.openstack.org/marketplace/distros/distribution>`__.
+<https://www.openstack.org/marketplace/distros/>`__.
 
 Why a shell script, why not chef/puppet/...
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

From 54ee8a82a837eb2b28746c77e0259ec326ab15cc Mon Sep 17 00:00:00 2001
From: Maxim Nestratov <mnestratov@virtuozzo.com>
Date: Wed, 15 Jul 2015 11:47:11 +0300
Subject: [PATCH 0760/3333] Make it possible to upload ploop images

Add support of ploop images (*.hds extension) for both exe and hvm types.
In devstack we assume that images have '-exe' and '-hvm' suffixes in
their names correspondently.

Change-Id: I1c074876c530be0535a6e02e764d67a4ebcbbbe5
---
 functions | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/functions b/functions
index 1668e16b6d..5bbe18f990 100644
--- a/functions
+++ b/functions
@@ -219,6 +219,23 @@ function upload_image {
         return
     fi
 
+    if [[ "$image_url" =~ '.hds' ]]; then
+        image_name="${image_fname%.hds}"
+        vm_mode=${image_name##*-}
+        if [[ $vm_mode != 'exe' && $vm_mode != 'hvm' ]]; then
+            die $LINENO "Unknown vm_mode=${vm_mode} for Virtuozzo image"
+        fi
+
+        openstack \
+            --os-token $token \
+            --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
+            image create \
+            "$image_name" --public \
+            --container-format=bare --disk-format=ploop \
+            --property vm_mode=$vm_mode < "${image}"
+        return
+    fi
+
     local kernel=""
     local ramdisk=""
     local disk_format=""

From e6f37b91e5cd5b0f70d2be1e75eb4f61adc1e16a Mon Sep 17 00:00:00 2001
From: Maxim Nestratov <mnestratov@virtuozzo.com>
Date: Tue, 30 Jun 2015 14:54:12 +0300
Subject: [PATCH 0761/3333] libvirt virt_type=parallels support enchancement

As soon as Parallels Cloud Server/Virtuozzo is based on CloudLinux distribution
this new rpm kind of distribution is introduced.
Also we setup vnc and set vnc_encoding parameter to None as soon it isn't
supported by parallels.

Change-Id: Ib97a09f397f950227498cfc2ce162d19b700f6f4
---
 functions-common                    | 6 ++++--
 lib/nova_plugins/hypervisor-libvirt | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 061a9356f5..813d164272 100644
--- a/functions-common
+++ b/functions-common
@@ -269,8 +269,9 @@ function GetOSVersion {
         # Fedora release 16 (Verne)
         # XenServer release 6.2.0-70446c (xenenterprise)
         # Oracle Linux release 7
+        # CloudLinux release 7.1
         os_CODENAME=""
-        for r in "Red Hat" CentOS Fedora XenServer; do
+        for r in "Red Hat" CentOS Fedora XenServer CloudLinux; do
             os_VENDOR=$r
             if [[ -n "`grep \"$r\" /etc/redhat-release`" ]]; then
                 ver=`sed -e 's/^.* \([0-9].*\) (\(.*\)).*$/\1\|\2/' /etc/redhat-release`
@@ -374,7 +375,8 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
-        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ]
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
+        [ "$os_VENDOR" = "CloudLinux" ]
 }
 
 
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index f70b21a475..dfd8a67fd9 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -75,6 +75,10 @@ function configure_nova_hypervisor {
     if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
+        iniset $NOVA_CONF DEFAULT force_raw_images  "False"
+        iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address  $HOST_IP
+        iniset $NOVA_CONF DEFAULT vncserver_listen $HOST_IP
+        iniset $NOVA_CONF DEFAULT vnc_keymap
     fi
 }
 

From 54dc19ecad2ed06694a4b6269c2833d9533a26f5 Mon Sep 17 00:00:00 2001
From: Mahito OGURA <m.ogura@ntt.com>
Date: Tue, 14 Jul 2015 17:16:42 +0900
Subject: [PATCH 0762/3333] Add export_proxy_variables() tests to
 test_functions.sh

In test_functions.sh, There aren't export_proxy_variables() tests.
This patch add test of export_proxy_variables to test_funstions.sh.

Change-Id: I76f2bab84f4019961e612b0bff0ab66646b6e160
---
 tests/test_functions.sh | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index f555de8dff..be8dc5e287 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -245,4 +245,33 @@ else
     passed "OK"
 fi
 
+function test_export_proxy_variables {
+    echo "Testing export_proxy_variables()"
+
+    local expected results
+
+    http_proxy=http_proxy_test
+    https_proxy=https_proxy_test
+    no_proxy=no_proxy_test
+
+    export_proxy_variables
+    expected=$(echo -e "http_proxy=$http_proxy\nhttps_proxy=$https_proxy\nno_proxy=$no_proxy")
+    results=$(env | egrep '(http(s)?|no)_proxy=')
+    if [[ $expected = $results ]]; then
+        passed "OK: Proxy variables are exported when proxy variables are set"
+    else
+        failed "Expected: $expected, Failed: $results"
+    fi
+
+    unset http_proxy https_proxy no_proxy
+    export_proxy_variables
+    results=$(env | egrep '(http(s)?|no)_proxy=')
+    if [[ "" = $results ]]; then
+        passed "OK: Proxy variables aren't exported when proxy variables aren't set"
+    else
+        failed "Expected: '', Failed: $results"
+    fi
+}
+test_export_proxy_variables
+
 report_results

From 7e5fb63b71364637eaa81a0f978af76fe3df2c97 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 16 Jul 2015 10:40:43 +1000
Subject: [PATCH 0763/3333] Always use volume v1 API for type create.

OpenStackClient doesn't currently support volume type create on the V2
API. Make sure that all requests use the V1 api until this has been
fixed in OpenStackClient.

Change-Id: I2fa133d30753e188d383d3de78c0022a3625cb34
Closes-Bug: #1475062
---
 lib/cinder | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index a9a9f0d298..e5ed2db1a3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -485,7 +485,9 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            openstack volume type create --property volume_backend_name="${be_name}" ${be_name}
+            # FIXME(jamielennox): Remove --os-volume-api-version pinning when
+            # osc supports volume type create on v2 api. bug #1475060
+            openstack volume type create --os-volume-api-version 1 --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }

From 11d276c73cdd848c0287f6718d0163369cefd157 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 2 Jul 2015 09:34:34 +1000
Subject: [PATCH 0764/3333] local call masks errors in subshells

In another "things from the man page"

   The return status is 0 unless local is used outside a function, an
   invalid name is supplied, or name is a readonly variable.

Thus if anything fails in "cmd" of "local foo=$( cmd )" we don't
notice.

Change-Id: I22b10d5d39f014b6c92d2e101b167cbacf81afca
---
 functions-common | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index 322bf82f30..a2a9a3daf4 100644
--- a/functions-common
+++ b/functions-common
@@ -684,9 +684,10 @@ function policy_add {
 # Gets or creates a domain
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
+    local domain_id
     local os_url="$KEYSTONE_SERVICE_URI_V3"
     # Gets domain id
-    local domain_id=$(
+    domain_id=$(
         # Gets domain id
         openstack --os-token=$OS_TOKEN --os-url=$os_url \
             --os-identity-api-version=3 domain show $1 \
@@ -705,8 +706,9 @@ function get_or_create_domain {
 function get_or_create_group {
     local desc="${3:-}"
     local os_url="$KEYSTONE_SERVICE_URI_V3"
+    local group_id
     # Gets group id
-    local group_id=$(
+    group_id=$(
         # Creates new group with --or-show
         openstack --os-token=$OS_TOKEN --os-url=$os_url \
             --os-identity-api-version=3 group create $1 \
@@ -719,13 +721,14 @@ function get_or_create_group {
 # Gets or creates user
 # Usage: get_or_create_user <username> <password> <domain> [<email>]
 function get_or_create_user {
+    local user_id
     if [[ ! -z "$4" ]]; then
         local email="--email=$4"
     else
         local email=""
     fi
     # Gets user id
-    local user_id=$(
+    user_id=$(
         # Creates new user with --or-show
         openstack user create \
             $1 \
@@ -743,7 +746,8 @@ function get_or_create_user {
 # Gets or creates project
 # Usage: get_or_create_project <name> <domain>
 function get_or_create_project {
-    local project_id=$(
+    local project_id
+    project_id=$(
         # Creates new project with --or-show
         openstack --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3 \
@@ -757,7 +761,8 @@ function get_or_create_project {
 # Gets or creates role
 # Usage: get_or_create_role <name>
 function get_or_create_role {
-    local role_id=$(
+    local role_id
+    role_id=$(
         # Creates role with --or-show
         openstack role create $1 \
             --os-url=$KEYSTONE_SERVICE_URI_V3 \
@@ -770,8 +775,9 @@ function get_or_create_role {
 # Gets or adds user role to project
 # Usage: get_or_add_user_project_role <role> <user> <project>
 function get_or_add_user_project_role {
+    local user_role_id
     # Gets user role id
-    local user_role_id=$(openstack role list \
+    user_role_id=$(openstack role list \
         --user $2 \
         --os-url=$KEYSTONE_SERVICE_URI_V3 \
         --os-identity-api-version=3 \
@@ -795,8 +801,9 @@ function get_or_add_user_project_role {
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
+    local group_role_id
     # Gets group role id
-    local group_role_id=$(openstack role list \
+    group_role_id=$(openstack role list \
         --os-url=$KEYSTONE_SERVICE_URI_V3 \
         --os-identity-api-version=3 \
         --group $2 \
@@ -822,8 +829,9 @@ function get_or_add_group_project_role {
 # Gets or creates service
 # Usage: get_or_create_service <name> <type> <description>
 function get_or_create_service {
+    local service_id
     # Gets service id
-    local service_id=$(
+    service_id=$(
         # Gets service id
         openstack service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
@@ -841,7 +849,8 @@ function get_or_create_service {
 # Create an endpoint with a specific interface
 # Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
 function _get_or_create_endpoint_with_interface {
-    local endpoint_id=$(openstack endpoint list \
+    local endpoint_id
+    endpoint_id=$(openstack endpoint list \
         --os-url $KEYSTONE_SERVICE_URI_V3 \
         --os-identity-api-version=3 \
         --service $1 \

From 2fa8944057787fc01e94f9f94a905cee9492edc5 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Date: Fri, 17 Jul 2015 03:08:55 +0000
Subject: [PATCH 0765/3333] Remove osapi_v3 configuration

Nova option osapi_v3 is used for Nova v2.1 API and the default value
was False(disabled). However Nova v2.1 API is CURRENT status and the
API should be enabled as the default as we discussed on
http://lists.openstack.org/pipermail/openstack-dev/2015-July/069624.html
We could not find it before because devstack makes it True, so this
patch removes it for avoiding confusion any more.

Change-Id: I4efd2036605a1a41ea297b44a5f31b2da7412593
Related-Bug: #1462901
Depends-on: I43f0352f9fa89401f79389a6dc1035d901f52ed2
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index a6cd651a9c..6441a891eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -490,7 +490,6 @@ function create_nova_conf {
     iniset $NOVA_CONF database connection `database_connection_url nova`
     iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
-    iniset $NOVA_CONF osapi_v3 enabled "True"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT ec2_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"

From 92ad15251226dc8f19ad5f901c48f4eb8892f24e Mon Sep 17 00:00:00 2001
From: Rawlin Peters <rawlin.peters@hp.com>
Date: Mon, 20 Jul 2015 13:33:33 -0600
Subject: [PATCH 0766/3333] Explicitly set bind_ip in Swift server config files

Currently, the Swift proxy, object, account, and container servers bind
to IPv4 address 0.0.0.0 by default. In the case of a user setting
SERVICE_IP_VERSION=6 in their local.conf file, these Swift servers still
listen on 0.0.0.0 instead of ::, which causes a ./stack.sh run to fail.

This change explicitly sets the bind_ip variable in the Swift server
config files so that the servers bind to either 0.0.0.0 (when
SERVICE_IP_VERSION != 6) or :: (when SERVICE_IP_VERSION == 6).

This patch is related to the following patch for devstack IPv6 support:
    https://review.openstack.org/#/c/192329

Change-Id: Ie268c6daf5374e67ef8710a731c3af50ffdb821e
---
 lib/swift | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/swift b/lib/swift
index 826f233414..96d730ef2c 100644
--- a/lib/swift
+++ b/lib/swift
@@ -46,6 +46,7 @@ SWIFT3_DIR=$DEST/swift3
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 SWIFT_DEFAULT_BIND_PORT_INT=${SWIFT_DEFAULT_BIND_PORT_INT:-8081}
 SWIFT_SERVICE_LOCAL_HOST=${SWIFT_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
+SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # TODO: add logging to different location.
 
@@ -361,6 +362,9 @@ function configure_swift {
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT log_level
     iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT log_level DEBUG
 
+    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_ip
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
+
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port
     if is_service_enabled tls-proxy; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT_INT}
@@ -463,17 +467,23 @@ EOF
         local swift_node_config=${SWIFT_CONF_DIR}/object-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/object-server.conf-sample ${swift_node_config}
         generate_swift_config_services ${swift_node_config} ${node_number} $(( OBJECT_PORT_BASE + 10 * (node_number - 1) )) object
+        iniuncomment ${swift_node_config} DEFAULT bind_ip
+        iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
         iniset ${swift_node_config} filter:recon recon_cache_path  ${SWIFT_DATA_DIR}/cache
 
         swift_node_config=${SWIFT_CONF_DIR}/container-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/container-server.conf-sample ${swift_node_config}
         generate_swift_config_services ${swift_node_config} ${node_number} $(( CONTAINER_PORT_BASE + 10 * (node_number - 1) )) container
+        iniuncomment ${swift_node_config} DEFAULT bind_ip
+        iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
         iniuncomment ${swift_node_config} app:container-server allow_versions
         iniset ${swift_node_config} app:container-server allow_versions  "true"
 
         swift_node_config=${SWIFT_CONF_DIR}/account-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/account-server.conf-sample ${swift_node_config}
         generate_swift_config_services ${swift_node_config} ${node_number} $(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) )) account
+        iniuncomment ${swift_node_config} DEFAULT bind_ip
+        iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
     done
 
     # Set new accounts in tempauth to match keystone tenant/user (to make testing easier)

From 3756687d1777153e1d6fbf938a74470011aa7bef Mon Sep 17 00:00:00 2001
From: Pradeep Kilambi <pkilambi@redhat.com>
Date: Mon, 20 Jul 2015 16:16:31 -0400
Subject: [PATCH 0767/3333] Include meter.yaml when devstack sets up ceilometer

Partially Implements: blueprint declarative-notifications

Change-Id: Ia20f3558eb85b4e3478e33a9e54b7e696eb6c3fd
---
 lib/ceilometer | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/ceilometer b/lib/ceilometer
index 7905384623..9226d85e20 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -211,6 +211,7 @@ function configure_ceilometer {
     cp $CEILOMETER_DIR/etc/ceilometer/event_pipeline.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/api_paste.ini $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/event_definitions.yaml $CEILOMETER_CONF_DIR
+    cp $CEILOMETER_DIR/etc/ceilometer/meters.yaml $CEILOMETER_CONF_DIR
 
     if [ "$CEILOMETER_PIPELINE_INTERVAL" ]; then
         sed -i "s/interval:.*/interval: ${CEILOMETER_PIPELINE_INTERVAL}/" $CEILOMETER_CONF_DIR/pipeline.yaml

From 0294ddc7352d5cf9ab0eca48a6cab3894aa866dc Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Tue, 21 Jul 2015 14:11:49 -0500
Subject: [PATCH 0768/3333] mysql: Fix mysql config

devstack attempts to set bind-address, sql_mode, default-storage-engine,
max_connections, query_cache_type and query_cache_size.

However the bash command is missing some '&&'s and was omiting
max_connections, query_cache_type and query_cache_size.

Change-Id: I24388b5de777995f92d73076524122cf599d6371
---
 lib/databases/mysql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 9c9401edf6..fb55b60ff6 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -95,9 +95,9 @@ function configure_database_mysql {
     sudo bash -c "source $TOP_DIR/functions && \
         iniset $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS" && \
         iniset $my_conf mysqld sql_mode STRICT_ALL_TABLES && \
-        iniset $my_conf mysqld default-storage-engine InnoDB \
-        iniset $my_conf mysqld max_connections 1024 \
-        iniset $my_conf mysqld query_cache_type OFF \
+        iniset $my_conf mysqld default-storage-engine InnoDB && \
+        iniset $my_conf mysqld max_connections 1024 && \
+        iniset $my_conf mysqld query_cache_type OFF && \
         iniset $my_conf mysqld query_cache_size 0"
 
 

From c1dded9b91ae46d339430efcc69b0d3a4882b88b Mon Sep 17 00:00:00 2001
From: Hiroshi Miura <miurahr@nttdata.co.jp>
Date: Wed, 22 Jul 2015 12:18:35 +0900
Subject: [PATCH 0769/3333] fix typo in guide for nested kvm

Change-Id: Ie103a097830401248c75fcb16d4dd746bbbb7288
Signed-off-by: Hiroshi Miura <miurahr@nttdata.co.jp>
---
 doc/source/guides/devstack-with-nested-kvm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index b35492ea17..c652bacced 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -88,7 +88,7 @@ host:
     parm:           nested:int
 
 To make the above value persistent across reboots, add an entry in
-/etc/modprobe.ddist.conf so it looks as below::
+/etc/modprobe.d/dist.conf so it looks as below::
 
     cat /etc/modprobe.d/dist.conf
     options kvm-amd nested=y

From 92884ede5d20a399186c61cf5e003da61838eec4 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 22 Jul 2015 12:16:45 +1000
Subject: [PATCH 0770/3333] ini-config : always reenable xtrace on return

These return paths doesn't renable xtrace, so output mysteriously goes
missing until the next time it is enabled.

Change-Id: I3a8018dfa9397c07534970c39fba8dc10afcbe41
---
 inc/ini-config | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 26401f3917..8e7c0187ae 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -104,7 +104,10 @@ function iniadd_literal {
     local option=$3
     local value=$4
 
-    [[ -z $section || -z $option ]] && return
+    if [[ -z $section || -z $option ]]; then
+        $xtrace
+        return
+    fi
 
     # Add it
     sed -i -e "/^\[$section\]/ a\\
@@ -123,7 +126,10 @@ function inidelete {
     local section=$2
     local option=$3
 
-    [[ -z $section || -z $option ]] && return
+    if [[ -z $section || -z $option ]]; then
+        $xtrace
+        return
+    fi
 
     # Remove old values
     sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
@@ -141,7 +147,10 @@ function iniset {
     local option=$3
     local value=$4
 
-    [[ -z $section || -z $option ]] && return
+    if [[ -z $section || -z $option ]]; then
+        $xtrace
+        return
+    fi
 
     if ! grep -q "^\[$section\]" "$file" 2>/dev/null; then
         # Add section at the end

From b997db602e15b60c68c0f7a99db74b5d2419a85c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 22 Jul 2015 10:05:32 +1000
Subject: [PATCH 0771/3333] Cleanup of ini test-case

Various cleanup to this file.

Firstly create a temporary space to test, rather than working in the
source directory.

We have "assert_equal" which simplifies a lot.  Add "assert_empty"
that is used in a couple of tests too.  Remove a couple of duplicate
tests.

Change-Id: I7fd476ed63026e67d66a8ac2891b2e4a6687d09c
---
 tests/test_ini_config.sh | 234 +++++++++++----------------------------
 tests/unittest.sh        |  23 +++-
 2 files changed, 87 insertions(+), 170 deletions(-)

diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index b2529ac4c9..3aef6f39bd 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -13,7 +13,13 @@ set -e
 
 echo "Testing INI functions"
 
-cat >test.ini <<EOF
+INI_TMP_DIR=$(mktemp -d)
+INI_TMP_ETC_DIR=$INI_TMP_DIR/etc
+TEST_INI=${INI_TMP_ETC_DIR}/test.ini
+mkdir ${INI_TMP_ETC_DIR}
+
+echo "Creating $TEST_INI"
+cat >${TEST_INI} <<EOF
 [default]
 # comment an option
 #log_file=./log.conf
@@ -67,204 +73,98 @@ EOF
 
 # Test with missing arguments
 
-BEFORE=$(cat test.ini)
-
-echo -n "iniset: test missing attribute argument: "
-iniset test.ini aaa
-NO_ATTRIBUTE=$(cat test.ini)
-if [[ "$BEFORE" == "$NO_ATTRIBUTE" ]]; then
-    passed
-else
-    failed "failed"
-fi
+BEFORE=$(cat ${TEST_INI})
 
-echo -n "iniset: test missing section argument: "
-iniset test.ini
-NO_SECTION=$(cat test.ini)
-if [[ "$BEFORE" == "$NO_SECTION" ]]; then
-    passed
-else
-    failed "failed"
-fi
+iniset ${TEST_INI} aaa
+NO_ATTRIBUTE=$(cat ${TEST_INI})
+assert_equal "$BEFORE" "$NO_ATTRIBUTE" "test missing attribute argument"
 
-# Test with spaces
+iniset ${TEST_INI}
+NO_SECTION=$(cat ${TEST_INI})
+assert_equal "$BEFORE" "$NO_SECTION" "missing section argument"
 
-VAL=$(iniget test.ini aaa handlers)
-if [[ "$VAL" == "aa, bb" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
+# Test with spaces in values
+VAL=$(iniget ${TEST_INI} aaa handlers)
+assert_equal "$VAL" "aa, bb" "iniget spaces in option"
 
-iniset test.ini aaa handlers "11, 22"
-
-VAL=$(iniget test.ini aaa handlers)
-if [[ "$VAL" == "11, 22" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
+iniset ${TEST_INI} aaa handlers "11, 22"
+VAL=$(iniget ${TEST_INI} aaa handlers)
+assert_equal "$VAL" "11, 22" "iniset spaces in option"
 
 # Test with spaces in section header
+VAL=$(iniget ${TEST_INI} " ccc " spaces)
+assert_equal "$VAL" "yes" "iniget with section header space"
 
-VAL=$(iniget test.ini " ccc " spaces)
-if [[ "$VAL" == "yes" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
-
-iniset test.ini "b b" opt_ion 42
-
-VAL=$(iniget test.ini "b b" opt_ion)
-if [[ "$VAL" == "42" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
+iniset ${TEST_INI} "b b" opt_ion 42
+VAL=$(iniget ${TEST_INI} "b b" opt_ion)
+assert_equal "$VAL" "42" "iniset with section header space"
 
 # Test without spaces, end of file
+VAL=$(iniget ${TEST_INI} bbb handlers)
+assert_equal "$VAL" "ee,ff" "iniget at EOF"
 
-VAL=$(iniget test.ini bbb handlers)
-if [[ "$VAL" == "ee,ff" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
-
-iniset test.ini bbb handlers "33,44"
-
-VAL=$(iniget test.ini bbb handlers)
-if [[ "$VAL" == "33,44" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
+iniset ${TEST_INI} bbb handlers "33,44"
+VAL=$(iniget ${TEST_INI} bbb handlers)
+assert_equal "$VAL" "33,44" "inset at EOF"
 
 # test empty option
-if ini_has_option test.ini ddd empty; then
-    passed "OK: ddd.empty present"
+if ini_has_option ${TEST_INI} ddd empty; then
+    passed "ini_has_option: ddd.empty present"
 else
     failed "ini_has_option failed: ddd.empty not found"
 fi
 
 # test non-empty option
-if ini_has_option test.ini bbb handlers; then
-    passed "OK: bbb.handlers present"
+if ini_has_option ${TEST_INI} bbb handlers; then
+    passed "ini_has_option: bbb.handlers present"
 else
     failed "ini_has_option failed: bbb.handlers not found"
 fi
 
 # test changing empty option
-iniset test.ini ddd empty "42"
-
-VAL=$(iniget test.ini ddd empty)
-if [[ "$VAL" == "42" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
+iniset ${TEST_INI} ddd empty "42"
+VAL=$(iniget ${TEST_INI} ddd empty)
+assert_equal "$VAL" "42" "change empty option"
 
 # test pipe in option
-iniset test.ini aaa handlers "a|b"
-
-VAL=$(iniget test.ini aaa handlers)
-if [[ "$VAL" == "a|b" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
-
-# test space in option
-iniset test.ini aaa handlers "a b"
-
-VAL="$(iniget test.ini aaa handlers)"
-if [[ "$VAL" == "a b" ]]; then
-    passed "OK: $VAL"
-else
-    failed "iniget failed: $VAL"
-fi
+iniset ${TEST_INI} aaa handlers "a|b"
+VAL=$(iniget ${TEST_INI} aaa handlers)
+assert_equal "$VAL" "a|b" "pipe in option"
 
 # Test section not exist
-
-VAL=$(iniget test.ini zzz handlers)
-if [[ -z "$VAL" ]]; then
-    passed "OK: zzz not present"
-else
-    failed "iniget failed: $VAL"
-fi
-
-iniset test.ini zzz handlers "999"
-
-VAL=$(iniget test.ini zzz handlers)
-if [[ -n "$VAL" ]]; then
-    passed "OK: zzz not present"
-else
-    failed "iniget failed: $VAL"
-fi
+VAL=$(iniget ${TEST_INI} zzz handlers)
+assert_empty VAL "section does not exist"
 
 # Test option not exist
+VAL=$(iniget ${TEST_INI} aaa debug)
+assert_empty VAL "option does not exist"
 
-VAL=$(iniget test.ini aaa debug)
-if [[ -z "$VAL" ]]; then
-    passed "OK aaa.debug not present"
-else
-    failed "iniget failed: $VAL"
-fi
-
-if ! ini_has_option test.ini aaa debug; then
-    passed "OK aaa.debug not present"
+if ! ini_has_option ${TEST_INI} aaa debug; then
+    passed "ini_has_option: aaa.debug not present"
 else
     failed "ini_has_option failed: aaa.debug"
 fi
 
-iniset test.ini aaa debug "999"
-
-VAL=$(iniget test.ini aaa debug)
-if [[ -n "$VAL" ]]; then
-    passed "OK aaa.debug present"
-else
-    failed "iniget failed: $VAL"
-fi
-
 # Test comments
-
-inicomment test.ini aaa handlers
-
-VAL=$(iniget test.ini aaa handlers)
-if [[ -z "$VAL" ]]; then
-    passed "OK"
-else
-    failed "inicomment failed: $VAL"
-fi
+inicomment ${TEST_INI} aaa handlers
+VAL=$(iniget ${TEST_INI} aaa handlers)
+assert_empty VAL "test inicomment"
 
 # Test multiple line iniset/iniget
-iniset_multiline test.ini eee multi bar1 bar2
+iniset_multiline ${TEST_INI} eee multi bar1 bar2
 
-VAL=$(iniget_multiline test.ini eee multi)
-if [[ "$VAL" == "bar1 bar2" ]]; then
-    echo "OK: iniset_multiline"
-else
-    failed "iniset_multiline failed: $VAL"
-fi
+VAL=$(iniget_multiline ${TEST_INI} eee multi)
+assert_equal "$VAL" "bar1 bar2" "iniget_multiline"
 
 # Test iniadd with exiting values
-iniadd test.ini eee multi bar3
-VAL=$(iniget_multiline test.ini eee multi)
-if [[ "$VAL" == "bar1 bar2 bar3" ]]; then
-    passed "OK: iniadd"
-else
-    failed "iniadd failed: $VAL"
-fi
+iniadd ${TEST_INI} eee multi bar3
+VAL=$(iniget_multiline ${TEST_INI} eee multi)
+assert_equal "$VAL" "bar1 bar2 bar3" "iniadd with existing values"
 
 # Test iniadd with non-exiting values
-iniadd test.ini eee non-multi foobar1 foobar2
-VAL=$(iniget_multiline test.ini eee non-multi)
-if [[ "$VAL" == "foobar1 foobar2" ]]; then
-    passed "OK: iniadd with non-exiting value"
-else
-    failed "iniadd with non-exsting failed: $VAL"
-fi
+iniadd ${TEST_INI} eee non-multi foobar1 foobar2
+VAL=$(iniget_multiline ${TEST_INI} eee non-multi)
+assert_equal "$VAL" "foobar1 foobar2" "iniadd non-existing values"
 
 # Test inidelete
 del_cases="
@@ -276,25 +176,21 @@ del_cases="
     del_no_section"
 
 for x in $del_cases; do
-    inidelete test.ini $x a
-    VAL=$(iniget_multiline test.ini $x a)
-    if [ -z "$VAL" ]; then
-        passed "OK: inidelete $x"
-    else
-        failed "inidelete $x failed: $VAL"
-    fi
+    inidelete ${TEST_INI} $x a
+    VAL=$(iniget_multiline ${TEST_INI} $x a)
+    assert_empty VAL "inidelete $x"
     if [ "$x" = "del_separate_options" -o \
         "$x" = "del_missing_option" -o \
         "$x" = "del_missing_option_multi" ]; then
-        VAL=$(iniget_multiline test.ini $x b)
+        VAL=$(iniget_multiline ${TEST_INI} $x b)
         if [ "$VAL" = "c" -o "$VAL" = "c d" ]; then
-            passed "OK: inidelete other_options $x"
+            passed "inidelete other_options $x"
         else
-            failed "inidelete other_option $x failed: $VAL"
+            failed "inidelete other_option $x: $VAL"
         fi
     fi
 done
 
-rm test.ini
+rm -rf ${INI_TMP_DIR}
 
 report_results
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 93aa5fc571..603652a216 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -27,7 +27,7 @@ function passed {
         msg="OK"
     fi
     PASS=$((PASS+1))
-    echo "PASS: $function:L$lineno $msg"
+    echo "PASS: $function:L$lineno - $msg"
 }
 
 # fail a test, printing out MSG
@@ -63,6 +63,27 @@ function assert_equal {
     fi
 }
 
+# assert variable is empty/blank, printing out msg
+#  usage: assert_empty VAR msg
+function assert_empty {
+    local lineno=`caller 0 | awk '{print $1}'`
+    local function=`caller 0 | awk '{print $2}'`
+    local msg=$2
+
+    if [ -z "$msg" ]; then
+        msg="OK"
+    fi
+    if [[ ! -z ${!1} ]]; then
+        FAILED_FUNCS+="$function:L$lineno\n"
+        echo "ERROR: $1 not empty in $function:L$lineno!"
+        echo "  $msg"
+        ERROR=$((ERROR+1))
+    else
+        PASS=$((PASS+1))
+        echo "PASS: $function:L$lineno - $msg"
+    fi
+}
+
 # print a summary of passing and failing tests, exiting
 # with an error if we have failed tests
 #  usage: report_results

From f44a024f022d843fd204da6e23b4a98a142c07f3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 22 Jul 2015 10:34:47 +1000
Subject: [PATCH 0772/3333] Add -sudo option to ini setting options

Add a -sudo option to allow these functions to operate on root-owned
files.  Test-case is updated, but not enabled by default as we can't
expect test-runner to have sudo access.

Change-Id: I134c3397314c7d9395996eb6c825ecb7e7fdfc69
---
 inc/ini-config           | 69 ++++++++++++++++++++++++++++++----------
 tests/test_ini_config.sh | 36 +++++++++++++--------
 2 files changed, 74 insertions(+), 31 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 8e7c0187ae..d23f4743f1 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -15,30 +15,40 @@ set +o xtrace
 # ================
 
 # Append a new option in an ini file without replacing the old value
-# iniadd config-file section option value1 value2 value3 ...
+# iniadd [-sudo] config-file section option value1 value2 value3 ...
 function iniadd {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="-sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
     shift 3
 
     local values="$(iniget_multiline $file $section $option) $@"
-    iniset_multiline $file $section $option $values
+    iniset_multiline $sudo $file $section $option $values
     $xtrace
 }
 
 # Comment an option in an INI file
-# inicomment config-file section option
+# inicomment [-sudo] config-file section option
 function inicomment {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
 
-    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|^\($option[ \t]*=.*$\)|#\1|" "$file"
+    $sudo sed -i -e "/^\[$section\]/,/^\[.*\]/ s|^\($option[ \t]*=.*$\)|#\1|" "$file"
     $xtrace
 }
 
@@ -95,10 +105,15 @@ function ini_has_option {
 # in the argument list. Doing that will cause incorrect configuration
 # if spaces are used in the config values.
 #
-# iniadd_literal config-file section option value
+# iniadd_literal [-sudo] config-file section option value
 function iniadd_literal {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
@@ -110,7 +125,7 @@ function iniadd_literal {
     fi
 
     # Add it
-    sed -i -e "/^\[$section\]/ a\\
+    $sudo sed -i -e "/^\[$section\]/ a\\
 $option = $value
 " "$file"
 
@@ -118,10 +133,15 @@ $option = $value
 }
 
 # Remove an option from an INI file
-# inidelete config-file section option
+# inidelete [-sudo] config-file section option
 function inidelete {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
@@ -132,16 +152,21 @@ function inidelete {
     fi
 
     # Remove old values
-    sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
+    $sudo sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
 
     $xtrace
 }
 
 # Set an option in an INI file
-# iniset config-file section option value
+# iniset [-sudo] config-file section option value
 function iniset {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
@@ -154,26 +179,31 @@ function iniset {
 
     if ! grep -q "^\[$section\]" "$file" 2>/dev/null; then
         # Add section at the end
-        echo -e "\n[$section]" >>"$file"
+        echo -e "\n[$section]" | $sudo tee --append "$file" > /dev/null
     fi
     if ! ini_has_option "$file" "$section" "$option"; then
         # Add it
-        sed -i -e "/^\[$section\]/ a\\
+        $sudo sed -i -e "/^\[$section\]/ a\\
 $option = $value
 " "$file"
     else
         local sep=$(echo -ne "\x01")
         # Replace it
-        sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
+        $sudo sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
     fi
     $xtrace
 }
 
 # Set a multiple line option in an INI file
-# iniset_multiline config-file section option value1 value2 valu3 ...
+# iniset_multiline [-sudo] config-file section option value1 value2 valu3 ...
 function iniset_multiline {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
@@ -188,14 +218,14 @@ function iniset_multiline {
     done
     if ! grep -q "^\[$section\]" "$file"; then
         # Add section at the end
-        echo -e "\n[$section]" >>"$file"
+        echo -e "\n[$section]" | $sudo tee --append "$file" > /dev/null
     else
         # Remove old values
-        sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
+        $sudo sed -i -e "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ d; }" "$file"
     fi
     # Add new ones
     for v in $values; do
-        sed -i -e "/^\[$section\]/ a\\
+        $sudo sed -i -e "/^\[$section\]/ a\\
 $option = $v
 " "$file"
     done
@@ -207,10 +237,15 @@ $option = $v
 function iniuncomment {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
-    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|[^ \t]*#[ \t]*\($option[ \t]*=.*$\)|\1|" "$file"
+    $sudo sed -i -e "/^\[$section\]/,/^\[.*\]/ s|[^ \t]*#[ \t]*\($option[ \t]*=.*$\)|\1|" "$file"
     $xtrace
 }
 
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 3aef6f39bd..61f2c410f9 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -71,15 +71,23 @@ b=d
 
 EOF
 
-# Test with missing arguments
+# set TEST_SUDO to test writing to root-owned files
+SUDO_ARG=""
+SUDO=""
+if [ -n "$TEST_SUDO" ]; then
+    SUDO="sudo "
+    SUDO_ARG="-sudo "
+    sudo chown -R root:root ${INI_TMP_ETC_DIR}
+fi
 
+# Test with missing arguments
 BEFORE=$(cat ${TEST_INI})
 
-iniset ${TEST_INI} aaa
+iniset ${SUDO_ARG} ${TEST_INI} aaa
 NO_ATTRIBUTE=$(cat ${TEST_INI})
 assert_equal "$BEFORE" "$NO_ATTRIBUTE" "test missing attribute argument"
 
-iniset ${TEST_INI}
+iniset ${SUDO_ARG} ${TEST_INI}
 NO_SECTION=$(cat ${TEST_INI})
 assert_equal "$BEFORE" "$NO_SECTION" "missing section argument"
 
@@ -87,7 +95,7 @@ assert_equal "$BEFORE" "$NO_SECTION" "missing section argument"
 VAL=$(iniget ${TEST_INI} aaa handlers)
 assert_equal "$VAL" "aa, bb" "iniget spaces in option"
 
-iniset ${TEST_INI} aaa handlers "11, 22"
+iniset ${SUDO_ARG} ${TEST_INI} aaa handlers "11, 22"
 VAL=$(iniget ${TEST_INI} aaa handlers)
 assert_equal "$VAL" "11, 22" "iniset spaces in option"
 
@@ -95,7 +103,7 @@ assert_equal "$VAL" "11, 22" "iniset spaces in option"
 VAL=$(iniget ${TEST_INI} " ccc " spaces)
 assert_equal "$VAL" "yes" "iniget with section header space"
 
-iniset ${TEST_INI} "b b" opt_ion 42
+iniset ${SUDO_ARG} ${TEST_INI} "b b" opt_ion 42
 VAL=$(iniget ${TEST_INI} "b b" opt_ion)
 assert_equal "$VAL" "42" "iniset with section header space"
 
@@ -103,7 +111,7 @@ assert_equal "$VAL" "42" "iniset with section header space"
 VAL=$(iniget ${TEST_INI} bbb handlers)
 assert_equal "$VAL" "ee,ff" "iniget at EOF"
 
-iniset ${TEST_INI} bbb handlers "33,44"
+iniset ${SUDO_ARG} ${TEST_INI} bbb handlers "33,44"
 VAL=$(iniget ${TEST_INI} bbb handlers)
 assert_equal "$VAL" "33,44" "inset at EOF"
 
@@ -122,12 +130,12 @@ else
 fi
 
 # test changing empty option
-iniset ${TEST_INI} ddd empty "42"
+iniset ${SUDO_ARG} ${TEST_INI} ddd empty "42"
 VAL=$(iniget ${TEST_INI} ddd empty)
 assert_equal "$VAL" "42" "change empty option"
 
 # test pipe in option
-iniset ${TEST_INI} aaa handlers "a|b"
+iniset ${SUDO_ARG} ${TEST_INI} aaa handlers "a|b"
 VAL=$(iniget ${TEST_INI} aaa handlers)
 assert_equal "$VAL" "a|b" "pipe in option"
 
@@ -146,23 +154,23 @@ else
 fi
 
 # Test comments
-inicomment ${TEST_INI} aaa handlers
+inicomment ${SUDO_ARG} ${TEST_INI} aaa handlers
 VAL=$(iniget ${TEST_INI} aaa handlers)
 assert_empty VAL "test inicomment"
 
 # Test multiple line iniset/iniget
-iniset_multiline ${TEST_INI} eee multi bar1 bar2
+iniset_multiline ${SUDO_ARG} ${TEST_INI} eee multi bar1 bar2
 
 VAL=$(iniget_multiline ${TEST_INI} eee multi)
 assert_equal "$VAL" "bar1 bar2" "iniget_multiline"
 
 # Test iniadd with exiting values
-iniadd ${TEST_INI} eee multi bar3
+iniadd ${SUDO_ARG} ${TEST_INI} eee multi bar3
 VAL=$(iniget_multiline ${TEST_INI} eee multi)
 assert_equal "$VAL" "bar1 bar2 bar3" "iniadd with existing values"
 
 # Test iniadd with non-exiting values
-iniadd ${TEST_INI} eee non-multi foobar1 foobar2
+iniadd ${SUDO_ARG} ${TEST_INI} eee non-multi foobar1 foobar2
 VAL=$(iniget_multiline ${TEST_INI} eee non-multi)
 assert_equal "$VAL" "foobar1 foobar2" "iniadd non-existing values"
 
@@ -176,7 +184,7 @@ del_cases="
     del_no_section"
 
 for x in $del_cases; do
-    inidelete ${TEST_INI} $x a
+    inidelete ${SUDO_ARG} ${TEST_INI} $x a
     VAL=$(iniget_multiline ${TEST_INI} $x a)
     assert_empty VAL "inidelete $x"
     if [ "$x" = "del_separate_options" -o \
@@ -191,6 +199,6 @@ for x in $del_cases; do
     fi
 done
 
-rm -rf ${INI_TMP_DIR}
+$SUDO rm -rf ${INI_TMP_DIR}
 
 report_results

From cede78748291a8b5ae0dd0dc34c95da4a72fb3ea Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 22 Jul 2015 13:36:12 +1000
Subject: [PATCH 0773/3333] Add file creation test

Ensure that iniadd is creating files that don't exist, as it has
historically done.

Change-Id: I2798996f3d46ff1dce410b815a87395f1bf729f9
---
 inc/ini-config           | 1 +
 tests/test_ini_config.sh | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/inc/ini-config b/inc/ini-config
index d23f4743f1..58386e2441 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -159,6 +159,7 @@ function inidelete {
 
 # Set an option in an INI file
 # iniset [-sudo] config-file section option value
+#  - if the file does not exist, it is created
 function iniset {
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 61f2c410f9..d9cb8d8a99 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -199,6 +199,11 @@ for x in $del_cases; do
     fi
 done
 
+# test file-creation
+iniset $SUDO_ARG ${INI_TMP_ETC_DIR}/test.new.ini test foo bar
+VAL=$(iniget ${INI_TMP_ETC_DIR}/test.new.ini test foo)
+assert_equal "$VAL" "bar" "iniset created file"
+
 $SUDO rm -rf ${INI_TMP_DIR}
 
 report_results

From ff70dad892a89cc4cb09aebfcf72e2de5ab7d556 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 1 Jul 2015 15:22:53 +0200
Subject: [PATCH 0774/3333] Make image_list.sh independent of host IP address

We do not need the HOST_IP to be detected in order to be able to list
our images. So just set that to some dummy value before sourcing
functions.

This will allow tools like disk-image-builder to work regardless of
whether get_default_host_ip succeeds or not.

Change-Id: I9c22d2066e34309e70e56076e3d17c5db6ecee06
---
 tools/image_list.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/image_list.sh b/tools/image_list.sh
index a27635effd..27b3d4612d 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -3,6 +3,12 @@
 # Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
+# The following "source" implicitly calls get_default_host_ip() in
+# stackrc and will die if the selected default IP happens to lie
+# in the default ranges for FIXED_RANGE or FLOATING_RANGE. Since we
+# do not really need HOST_IP to be properly set in the remainder of
+# this script, just set it to some dummy value and make stackrc happy.
+HOST_IP=SKIP
 source $TOP_DIR/functions
 
 # Possible virt drivers, if we have more, add them here. Always keep

From 22cf648cf64029b6ba34a77aadd43b356acd53e7 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Thu, 23 Jul 2015 18:13:55 +0900
Subject: [PATCH 0775/3333] Remove restraint on agent file from ml2 plugin

Ml2 plugin always needs agent file even if the agent is out of tree.
This patch removes the restraint and ofagent_agent.

Change-Id: I12de58e13da1fd162ad8b632d895779ae7560c3c
Closes-Bug: #1477459
---
 lib/neutron_plugins/ml2           | 4 +++-
 lib/neutron_plugins/ofagent_agent | 4 ----
 2 files changed, 3 insertions(+), 5 deletions(-)
 delete mode 100644 lib/neutron_plugins/ofagent_agent

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 13ffee9b5b..ace5335a78 100755
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -19,7 +19,9 @@ fi
 
 # Default openvswitch L2 agent
 Q_AGENT=${Q_AGENT:-openvswitch}
-source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
+if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
+    source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
+fi
 
 # List of MechanismDrivers to load
 Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
deleted file mode 100644
index 0bc9bffb55..0000000000
--- a/lib/neutron_plugins/ofagent_agent
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-# REVISIT(yamamoto): This file is intentionally left empty
-# in order to keep Q_AGENT=ofagent_agent work.

From 1c506c5c3422b80ca01903f929b47011a4f969e1 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Fri, 24 Jul 2015 10:42:13 +0900
Subject: [PATCH 0776/3333] Remove unused variable

Change-Id: Ib3b50c0e34403311b529e116f39bf82dd03dca0e
---
 lib/neutron-legacy | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2c9dd1aa7d..4069439183 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -999,7 +999,6 @@ function _configure_neutron_dhcp_agent {
 }
 
 function _configure_neutron_l3_agent {
-    local cfg_file
     Q_L3_ENABLED=True
     # for l3-agent, only use per tenant router if we have namespaces
     Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE

From eef5d8590f560e4dd2be21942086e1e8b1223de4 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Fri, 24 Jul 2015 10:55:42 +0200
Subject: [PATCH 0777/3333] Adds two new configuration files

Ceilometer introduces two new configuration files

This change adds them.

Change-Id: I4da44f09eb0a839f36fef513aec41d9b1564155d
Depends-On: I5a202c30614d06821063e243d4e2330736aba5fd
---
 lib/ceilometer | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/ceilometer b/lib/ceilometer
index 9226d85e20..ce93ebdc4f 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -212,6 +212,8 @@ function configure_ceilometer {
     cp $CEILOMETER_DIR/etc/ceilometer/api_paste.ini $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/event_definitions.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/meters.yaml $CEILOMETER_CONF_DIR
+    cp $CEILOMETER_DIR/etc/ceilometer/gnocchi_archive_policy_map.yaml $CEILOMETER_CONF_DIR
+    cp $CEILOMETER_DIR/etc/ceilometer/gnocchi_resources.yaml $CEILOMETER_CONF_DIR
 
     if [ "$CEILOMETER_PIPELINE_INTERVAL" ]; then
         sed -i "s/interval:.*/interval: ${CEILOMETER_PIPELINE_INTERVAL}/" $CEILOMETER_CONF_DIR/pipeline.yaml

From aa81e2ea73cf46ab4e220a66959d19529f7bfeac Mon Sep 17 00:00:00 2001
From: Stanislaw Szydlo <stanislaw.szydlo@ericpol.com>
Date: Mon, 27 Jul 2015 10:54:44 +0200
Subject: [PATCH 0778/3333] Fix errors in tools/ping_neutron.sh

Due to errors in tools/ping_neutron.sh, exercise neutron-adv-test.sh
fails. Faults were: 'neutron net-list' took too much arguments and
variable REMAINING_ARGS was mistyped.

Change-Id: I681328bfb1e4445543ef9d94e3b3824dbc9c8346
Closes-Bug: #1478021
---
 tools/ping_neutron.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index d36b7f60c8..dba7502652 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -51,15 +51,15 @@ if [[ -z "$NET_NAME" ]]; then
     usage
 fi
 
-REMANING_ARGS="${@:2}"
+REMAINING_ARGS="${@:2}"
 
 # BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(neutron net-list $NET_NAME | grep "$NET_NAME" | awk '{print $2}')
+NET_ID=$(neutron net-list | grep "$NET_NAME" | awk '{print $2}')
 PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
 
 # This runs a command inside the specific netns
 NET_NS_CMD="ip netns exec qprobe-$PROBE_ID"
 
-PING_CMD="sudo $NET_NS_CMD ping $REMAING_ARGS"
+PING_CMD="sudo $NET_NS_CMD ping $REMAINING_ARGS"
 echo "Running $PING_CMD"
 $PING_CMD

From 20401434091e6083c85f7269cd4e7cf44e5713b4 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Mon, 27 Jul 2015 20:42:44 +0900
Subject: [PATCH 0779/3333] Fix four typos on devstack documentation

behaviour => behavior
mechansim => mechanism
glustfs => glusterfs
pluggin => plugin

Change-Id: I3de6740e5d4b2b55009614007767458124036b75
Closes-Bug: #1478538
---
 HACKING.rst            | 2 +-
 doc/source/plugins.rst | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index a40af54b45..6bd24b0174 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -355,7 +355,7 @@ your change
 
 * **Should this be upstream** -- DevStack generally does not override
   default choices provided by projects and attempts to not
-  unexpectedly modify behaviour.
+  unexpectedly modify behavior.
 
 * **Context in commit messages** -- DevStack touches many different
   areas and reviewers need context around changes to make good
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 1b6f5e36ed..803dd08a48 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -15,7 +15,7 @@ evolves.
 Plugin Interface
 ================
 
-DevStack supports a standard mechansim for including plugins from
+DevStack supports a standard mechanism for including plugins from
 external repositories. The plugin interface assumes the following:
 
 An external git repository that includes a ``devstack/`` top level
@@ -49,7 +49,7 @@ They are added in the following format::
   [[local|localrc]]
   enable_plugin <NAME> <GITURL> [GITREF]
 
-- ``name`` - an arbitrary name. (ex: glustfs, docker, zaqar, congress)
+- ``name`` - an arbitrary name. (ex: glusterfs, docker, zaqar, congress)
 - ``giturl`` - a valid git url that can be cloned
 - ``gitref`` - an optional git ref (branch / ref / tag) that will be
   cloned. Defaults to master.
@@ -209,7 +209,7 @@ enough to be an issue).
 
 Ideally a plugin will be included within the ``devstack`` directory of
 the project they are being tested. For example, the stackforge/ec2-api
-project has its pluggin support in its own tree.
+project has its plugin support in its own tree.
 
 However, some times a DevStack plugin might be used solely to
 configure a backend service that will be used by the rest of

From 089f044cbee4be1d2e1c3ad943c20eec33df736f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <seb@redhat.com>
Date: Fri, 24 Jul 2015 17:07:07 +0200
Subject: [PATCH 0780/3333] update cinder's key permission to allow nova
 snapshots
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Preparing the field for this patch:
https://review.openstack.org/#/c/205282/2

The client.cinder key needs to have write permission to the glance pool
in order to complete the snapshot process.

Change-Id: I90c6aa056b99944aa558783f3f81d06f918f3e26
Signed-off-by: Sébastien Han <seb@redhat.com>
---
 lib/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceph b/lib/ceph
index 6cf481e530..aeb7191512 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -295,7 +295,7 @@ function configure_ceph_nova {
     iniset $NOVA_CONF libvirt images_rbd_ceph_conf ${CEPH_CONF_FILE}
 
     if ! is_service_enabled cinder; then
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
         sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
     fi
 }

From 64ab8d122893d4ab1e135e82dab17f14cc74c33c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <seb@redhat.com>
Date: Mon, 27 Jul 2015 14:29:57 +0200
Subject: [PATCH 0781/3333] Re-enable direct URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This parameter is needed in order to test the copy on write cloning
functionnality.

Change-Id: Ie8179a68827acba2dd8614ea9c6cecf2ddb20e29
Signed-off-by: Sébastien Han <seb@redhat.com>
---
 lib/ceph | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/ceph b/lib/ceph
index 6cf481e530..f09252ff5d 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -267,6 +267,7 @@ function configure_ceph_glance {
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
 
+    iniset $GLANCE_API_CONF DEFAULT show_image_direct_url True
     iniset $GLANCE_API_CONF glance_store default_store rbd
     iniset $GLANCE_API_CONF glance_store stores "file, http, rbd"
     iniset $GLANCE_API_CONF glance_store rbd_store_ceph_conf $CEPH_CONF_FILE

From ac9313e5a5af9e350d66c0ae628ca900c4cfc218 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 27 Jul 2015 13:33:30 -0400
Subject: [PATCH 0782/3333] add -n --name flag to worlddump

We're worlddumping at success points in grenade, and it would be much
handier to explain when that happens via a symbolic name in the
filename. Add a --name option to worlddump to allow it.

Change-Id: I644200fe08e404dc7ca2006478ae4e11ca020672
---
 tools/worlddump.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index e4ba02b51c..926b4a1873 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -31,12 +31,19 @@ def get_options():
     parser.add_argument('-d', '--dir',
                         default='.',
                         help='Output directory for worlddump')
+    parser.add_argument('-n', '--name',
+                        default='',
+                        help='Additional name to tag into file')
     return parser.parse_args()
 
 
-def filename(dirname):
+def filename(dirname, name=""):
     now = datetime.datetime.utcnow()
-    return os.path.join(dirname, now.strftime("worlddump-%Y-%m-%d-%H%M%S.txt"))
+    fmt = "worlddump-%Y-%m-%d-%H%M%S"
+    if name:
+        fmt += "-" + name
+    fmt += ".txt"
+    return os.path.join(dirname, now.strftime(fmt))
 
 
 def warn(msg):
@@ -125,7 +132,7 @@ def guru_meditation_report():
 
 def main():
     opts = get_options()
-    fname = filename(opts.dir)
+    fname = filename(opts.dir, opts.name)
     print "World dumping... see %s for details" % fname
     sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)
     with open(fname, 'w') as f:

From dd07c484e474f3e9410c558c8fb3103233facd3e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 27 Jul 2015 13:10:44 -0400
Subject: [PATCH 0783/3333] line wrapping for longer ceph commands

Some of the ceph commands had gotten quite long, so reviewing them in
gerrit is a bit problematic. Do some line wrapping just to bring these
back to a bit more managable state.

Change-Id: Ice5122702f2466d059dd275b038d5ff983bcda44
---
 lib/ceph | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index aeb7191512..b05e6e818c 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -176,7 +176,9 @@ function configure_ceph {
     sudo mkdir -p ${CEPH_DATA_DIR}/{bootstrap-mds,bootstrap-osd,mds,mon,osd,tmp}
 
     # create ceph monitor initial key and directory
-    sudo ceph-authtool /var/lib/ceph/tmp/keyring.mon.$(hostname) --create-keyring --name=mon. --add-key=$(ceph-authtool --gen-print-key) --cap mon 'allow *'
+    sudo ceph-authtool /var/lib/ceph/tmp/keyring.mon.$(hostname) \
+        --create-keyring --name=mon. --add-key=$(ceph-authtool --gen-print-key) \
+        --cap mon 'allow *'
     sudo mkdir /var/lib/ceph/mon/ceph-$(hostname)
 
     # create a default ceph configuration file
@@ -194,12 +196,14 @@ osd journal size = 100
 EOF
 
     # bootstrap the ceph monitor
-    sudo ceph-mon -c ${CEPH_CONF_FILE} --mkfs -i $(hostname) --keyring /var/lib/ceph/tmp/keyring.mon.$(hostname)
+    sudo ceph-mon -c ${CEPH_CONF_FILE} --mkfs -i $(hostname) \
+        --keyring /var/lib/ceph/tmp/keyring.mon.$(hostname)
+
     if is_ubuntu; then
-    sudo touch /var/lib/ceph/mon/ceph-$(hostname)/upstart
+        sudo touch /var/lib/ceph/mon/ceph-$(hostname)/upstart
         sudo initctl emit ceph-mon id=$(hostname)
     else
-    sudo touch /var/lib/ceph/mon/ceph-$(hostname)/sysvinit
+        sudo touch /var/lib/ceph/mon/ceph-$(hostname)/sysvinit
         sudo service ceph start mon.$(hostname)
     fi
 
@@ -240,7 +244,9 @@ EOF
         OSD_ID=$(sudo ceph -c ${CEPH_CONF_FILE} osd create)
         sudo mkdir -p ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}
         sudo ceph-osd -c ${CEPH_CONF_FILE} -i ${OSD_ID} --mkfs
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create osd.${OSD_ID} mon 'allow profile osd ' osd 'allow *' | sudo tee ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/keyring
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create osd.${OSD_ID} \
+            mon 'allow profile osd ' osd 'allow *' | \
+            sudo tee ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/keyring
 
         # ceph's init script is parsing ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/ and looking for a file
         # 'upstart' or 'sysinitv', thanks to these 'touches' we are able to control OSDs daemons
@@ -264,7 +270,10 @@ function configure_ceph_embedded_glance {
 # configure_ceph_glance() - Glance config needs to come after Glance is set up
 function configure_ceph_glance {
     sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${GLANCE_CEPH_POOL} ${GLANCE_CEPH_POOL_PG} ${GLANCE_CEPH_POOL_PGP}
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
+    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} \
+        mon "allow r" \
+        osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | \
+        sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
 
     iniset $GLANCE_API_CONF glance_store default_store rbd
@@ -295,7 +304,10 @@ function configure_ceph_nova {
     iniset $NOVA_CONF libvirt images_rbd_ceph_conf ${CEPH_CONF_FILE}
 
     if ! is_service_enabled cinder; then
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
+            mon "allow r" \
+            osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | \
+            sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
         sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
     fi
 }
@@ -311,7 +323,10 @@ function configure_ceph_embedded_cinder {
 # configure_ceph_cinder() - Cinder config needs to come after Cinder is set up
 function configure_ceph_cinder {
     sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_CEPH_POOL} ${CINDER_CEPH_POOL_PG} ${CINDER_CEPH_POOL_PGP}
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rx pool=${GLANCE_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
+    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
+        mon "allow r" \
+        osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rx pool=${GLANCE_CEPH_POOL}" | \
+        sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
 }
 

From 961643e404919e0fa3b90f7620a4daccc962e6a3 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Fri, 31 Jul 2015 13:45:27 +0900
Subject: [PATCH 0784/3333] configuration.rst: Document post-extra meta section
 phase

Change-Id: I81d121424057fd79c1a0a65d420df3ee1badb6f3
---
 doc/source/configuration.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6052576e98..96f91ec774 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -56,6 +56,7 @@ The defined phases are:
    before they are started
 -  **extra** - runs after services are started and before any files in
    ``extra.d`` are executed
+-  **post-extra** - runs after files in ``extra.d`` are executed
 
 The file is processed strictly in sequence; meta-sections may be
 specified more than once but if any settings are duplicated the last to

From 93c10571e8b1b2c8e6916c759d5b92ab379c037f Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 31 Jul 2015 10:38:50 -0400
Subject: [PATCH 0785/3333] Stop relying on the tempest sample config file

This commit stops using the sample config file as the base for tempest
configuration. The sample config isn't actually needed as a based for
configuration because all the options are commented out so from the
perspective of the config parser it's a blank file.

There are 2 reasons for making this change, first using the sample
like this creates a hard dependency on tempest having a sample config
file in tree. This is something that the project wants to change since
keeping the file in sync causes headaches because of new oslo
releases. The second aspect is that it makes the generated output
difficult to read. It includes *every* option and it's description in
the generated output which makes finding where devstack is actually
setting something more difficult to find.

Change-Id: I4064a041a965ed2419b68efc8dc31fce37b24cfd
---
 lib/tempest | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 68ddd44105..ebed5ae98f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -167,10 +167,10 @@ function configure_tempest {
         esac
     fi
 
-    # Create ``tempest.conf`` from ``tempest.conf.sample``
-    # Copy every time because the image UUIDS are going to change
+    # (Re)create ``tempest.conf``
+    # Create every time because the image UUIDS are going to change
     sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
-    install -m 644 $TEMPEST_DIR/etc/tempest.conf.sample $TEMPEST_CONFIG
+    rm -f $TEMPEST_CONFIG
 
     password=${ADMIN_PASSWORD:-secrete}
 

From d73df506f29854997f3b74f1b60968535923316b Mon Sep 17 00:00:00 2001
From: Pradeep Kilambi <pkilambi@redhat.com>
Date: Fri, 31 Jul 2015 11:07:31 -0400
Subject: [PATCH 0786/3333] Remove the old meter.yaml path from devstack

This will let us defauilt to the path within the code,
we can add the right path in once we have the file in
the codebase.

Change-Id: I9de94c5ac6349c3b46adbacb77fc877b5201285c
---
 lib/ceilometer | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index ce93ebdc4f..3df75b7300 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -211,7 +211,6 @@ function configure_ceilometer {
     cp $CEILOMETER_DIR/etc/ceilometer/event_pipeline.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/api_paste.ini $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/event_definitions.yaml $CEILOMETER_CONF_DIR
-    cp $CEILOMETER_DIR/etc/ceilometer/meters.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/gnocchi_archive_policy_map.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/gnocchi_resources.yaml $CEILOMETER_CONF_DIR
 

From e97cb825d2800d34d1fe6eceae85a3a7f84549d1 Mon Sep 17 00:00:00 2001
From: Nicolas Simonds <nic@metacloud.com>
Date: Tue, 28 Jul 2015 11:46:46 -0700
Subject: [PATCH 0787/3333] update cinder's key permission to allow nova
 snapshots

Preparing the field for this patch:

https://review.openstack.org/205282

The client.cinder key needs to have write permission to the glance pool
in order to complete the snapshot process.

Change-Id: I98f16167db864ffd14e8c3dd5dec81fc16245448
---
 lib/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ceph b/lib/ceph
index 6af4b3a139..8e34aa49a4 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -326,7 +326,7 @@ function configure_ceph_cinder {
     sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_CEPH_POOL} ${CINDER_CEPH_POOL_PG} ${CINDER_CEPH_POOL_PGP}
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
         mon "allow r" \
-        osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rx pool=${GLANCE_CEPH_POOL}" | \
+        osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | \
         sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
     sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
 }

From 57aafb5a9ad20e19e2c248a8e853a32d5b719c03 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 31 Jul 2015 12:22:44 -0700
Subject: [PATCH 0788/3333] Clone reqs repo prior to using pip constraints

We pull the pip constraints from the requirements repo so need to clone
that repo prior to using the constraints. In fixup_stuff.sh devstack
attempts to install packages like prettytable using the constraints. It
is also possible to need constraints before fixup_stuff.sh if tracking
depends. To deal with this clone requirements repo before any possible
use of constraints in pip_install.

Change-Id: I42e981c8c5ce1b8a57b9f6cce213065c72d6af11
---
 lib/infra | 2 --
 stack.sh  | 5 +++++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/infra b/lib/infra
index 3d68e45bd9..eb8000e8d3 100644
--- a/lib/infra
+++ b/lib/infra
@@ -30,8 +30,6 @@ REQUIREMENTS_DIR=$DEST/requirements
 # install_infra() - Collect source and prepare
 function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
-    # bring down global requirements
-    git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
     [ ! -d $PIP_VIRTUAL_ENV ] && virtualenv $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
diff --git a/stack.sh b/stack.sh
index cc8bc8c88f..2288af57a4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -698,6 +698,11 @@ fi
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
+# Bring down global requirements before any use of pip_install. This is
+# necessary to ensure that the constraints file is in place before we
+# attempt to apply any constraints to pip installs.
+git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
+
 # Install Python packages into a virtualenv so that we can track them
 if [[ $TRACK_DEPENDS = True ]]; then
     echo_summary "Installing Python packages into a virtualenv $DEST/.venv"

From 994db6173861a8c6f8c73d59cdf85cd28463ab31 Mon Sep 17 00:00:00 2001
From: lanoux <joseph.lanoux@hp.com>
Date: Mon, 3 Aug 2015 13:48:12 +0000
Subject: [PATCH 0789/3333] Add tempest run_validation option

This change adds the tempest run_validation option to run
tests with ssh connection in the gate.

Change-Id: I140f79b06d2e85c1d5d07fa5f117d4f8b250fa3d
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 68ddd44105..a534530b05 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -457,6 +457,9 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
 
+    # Validation
+    iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
+
     # Volume
     # TODO(dkranz): Remove the bootable flag when Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled bootable True

From a6db5e30cc53d6dae11ffdc228e0ed01865bf603 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 4 Aug 2015 06:23:28 -0400
Subject: [PATCH 0790/3333] fix multinode guide

The multinode guide erroneously said to enable n-api on the worker
nodes, which is a typo. n-api-meta is the thing that's needed.

Change-Id: I733896681f7f6fe3bea0fdeeb8ffc9033d7fc761
---
 doc/source/guides/multinode-lab.rst | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 27d71f1b9c..557b522f69 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -178,12 +178,17 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=192.168.42.11
     RABBIT_HOST=192.168.42.11
     GLANCE_HOSTPORT=192.168.42.11:9292
-    ENABLED_SERVICES=n-cpu,n-net,n-api,c-vol
+    ENABLED_SERVICES=n-cpu,n-net,n-api-meta,c-vol
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://192.168.42.11:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP
     VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
 
+**Note:** the ``n-api-meta`` service is a version of the api server
+that only serves the metadata service. It's needed because the
+computes created won't have a routing path to the metadata service on
+the controller.
+
 Fire up OpenStack:
 
 ::
@@ -263,7 +268,7 @@ Swift
 -----
 
 Swift, OpenStack Object Storage, requires a significant amount of resources
-and is disabled by default in DevStack. The support in DevStack is geared 
+and is disabled by default in DevStack. The support in DevStack is geared
 toward a minimal installation but can be used for testing. To implement a
 true multi-node test of swift, additional steps will be required. Enabling it is as
 simple as enabling the ``swift`` service in ``local.conf``:

From 815db16c2099610a52dec35f0846c0d19b9bd5b9 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 6 Aug 2015 10:25:45 +1000
Subject: [PATCH 0791/3333] Clean up configuration documentation

The current format is just copy-paste after auto-conversion and very
inconsistent.  Move discussion of each option into a section and
reword some slightly so they read more clearly.  Group some together
into a section+sub-sections, such as the logging and ip-version option
discussions.

Add a top table-of-contents for the major sections, and then a
separate toc for each of the configuration options that are discussed
in detail.

Change-Id: Iddd27cb54f1d9f062b9c47ff9ad6a2bef3650d6b
---
 doc/source/configuration.rst | 330 +++++++++++++++++------------------
 1 file changed, 165 insertions(+), 165 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6052576e98..05a8d95f51 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -2,6 +2,10 @@
 Configuration
 =============
 
+.. contents::
+   :local:
+   :depth: 1
+
 DevStack has always tried to be mostly-functional with a minimal amount
 of configuration. The number of options has ballooned as projects add
 features, new projects added and more combinations need to be tested.
@@ -142,121 +146,79 @@ will not be set if there is no IPv6 address on the default Ethernet interface.
 Setting it here also makes it available for ``openrc`` to set ``OS_AUTH_URL``.
 ``HOST_IPV6`` is not set by default.
 
-Common Configuration Variables
-==============================
+Configuration Notes
+===================
+
+.. contents::
+   :local:
 
 Installation Directory
 ----------------------
 
-    | *Default: ``DEST=/opt/stack``*
-    |  The DevStack install directory is set by the ``DEST`` variable.
-    |  By setting it early in the ``localrc`` section you can reference it
-       in later variables. It can be useful to set it even though it is not
-       changed from the default value.
-    |
+The DevStack install directory is set by the ``DEST`` variable.  By
+default it is ``/opt/stack``.
+
+By setting it early in the ``localrc`` section you can reference it in
+later variables.  It can be useful to set it even though it is not
+changed from the default value.
 
     ::
 
         DEST=/opt/stack
 
-Libraries from Git
-------------------
-
-   | *Default: ``LIBS_FROM_GIT=""``*
-
-   | By default devstack installs OpenStack server components from
-     git, however it installs client libraries from released versions
-     on pypi. This is appropriate if you are working on server
-     development, but if you want to see how an unreleased version of
-     the client affects the system you can have devstack install it
-     from upstream, or from local git trees.
-   | Multiple libraries can be specified as a comma separated list.
-   |
-
-   ::
-
-      LIBS_FROM_GIT=python-keystoneclient,oslo.config
-
-Virtual Environments
---------------------
-
-  | *Default: ``USE_VENV=False``*
-  |   Enable the use of Python virtual environments by setting ``USE_VENV``
-      to ``True``.  This will enable the creation of venvs for each project
-      that is defined in the ``PROJECT_VENV`` array.
-
-  | *Default: ``PROJECT_VENV['<project>']='<project-dir>.venv'*
-  |   Each entry in the ``PROJECT_VENV`` array contains the directory name
-      of a venv to be used for the project.  The array index is the project
-      name.  Multiple projects can use the same venv if desired.
-
-  ::
-
-    PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
-
-  | *Default: ``ADDITIONAL_VENV_PACKAGES=""``*
-  |   A comma-separated list of additional packages to be installed into each
-      venv.  Often projects will not have certain packages listed in its
-      ``requirements.txt`` file because they are 'optional' requirements,
-      i.e. only needed for certain configurations.  By default, the enabled
-      databases will have their Python bindings added when they are enabled.
+Logging
+-------
 
 Enable Logging
---------------
+~~~~~~~~~~~~~~
 
-    | *Defaults: ``LOGFILE="" LOGDAYS=7 LOG_COLOR=True``*
-    |  By default ``stack.sh`` output is only written to the console
-       where it runs. It can be sent to a file in addition to the console
-       by setting ``LOGFILE`` to the fully-qualified name of the
-       destination log file. A timestamp will be appended to the given
-       filename for each run of ``stack.sh``.
-    |
+By default ``stack.sh`` output is only written to the console where it
+runs. It can be sent to a file in addition to the console by setting
+``LOGFILE`` to the fully-qualified name of the destination log file. A
+timestamp will be appended to the given filename for each run of
+``stack.sh``.
 
     ::
 
         LOGFILE=$DEST/logs/stack.sh.log
 
-    Old log files are cleaned automatically if ``LOGDAYS`` is set to the
-    number of days of old log files to keep.
+Old log files are cleaned automatically if ``LOGDAYS`` is set to the
+number of days of old log files to keep.
 
     ::
 
         LOGDAYS=1
 
-    The some of the project logs (Nova, Cinder, etc) will be colorized
-    by default (if ``SYSLOG`` is not set below); this can be turned off
-    by setting ``LOG_COLOR`` False.
+The some of the project logs (Nova, Cinder, etc) will be colorized by
+default (if ``SYSLOG`` is not set below); this can be turned off by
+setting ``LOG_COLOR`` to ``False``.
 
     ::
 
         LOG_COLOR=False
 
 Logging the Service Output
---------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-    | *Default: ``LOGDIR=""``*
-    |  DevStack will log the stdout output of the services it starts.
-       When using ``screen`` this logs the output in the screen windows
-       to a file.  Without ``screen`` this simply redirects stdout of
-       the service process to a file in ``LOGDIR``.
-    |
+DevStack will log the ``stdout`` output of the services it starts.
+When using ``screen`` this logs the output in the screen windows to a
+file.  Without ``screen`` this simply redirects stdout of the service
+process to a file in ``LOGDIR``.
 
     ::
 
         LOGDIR=$DEST/logs
 
-    *Note the use of ``DEST`` to locate the main install directory; this
-    is why we suggest setting it in ``local.conf``.*
+*Note the use of ``DEST`` to locate the main install directory; this
+is why we suggest setting it in ``local.conf``.*
 
 Enabling Syslog
----------------
+~~~~~~~~~~~~~~~
 
-    | *Default: ``SYSLOG=False SYSLOG_HOST=$HOST_IP SYSLOG_PORT=516``*
-    |  Logging all services to a single syslog can be convenient. Enable
-       syslogging by setting ``SYSLOG`` to ``True``. If the destination log
-       host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be
-       used to direct the message stream to the log host.
-    |
+Logging all services to a single syslog can be convenient. Enable
+syslogging by setting ``SYSLOG`` to ``True``. If the destination log
+host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be used
+to direct the message stream to the log host.  |
 
     ::
 
@@ -264,15 +226,55 @@ Enabling Syslog
         SYSLOG_HOST=$HOST_IP
         SYSLOG_PORT=516
 
+Libraries from Git
+------------------
+
+By default devstack installs OpenStack server components from git,
+however it installs client libraries from released versions on pypi.
+This is appropriate if you are working on server development, but if
+you want to see how an unreleased version of the client affects the
+system you can have devstack install it from upstream, or from local
+git trees by specifying it in ``LIBS_FROM_GIT``.  Multiple libraries
+can be specified as a comma separated list.
+
+   ::
+
+      LIBS_FROM_GIT=python-keystoneclient,oslo.config
+
+Virtual Environments
+--------------------
+
+Enable the use of Python virtual environments by setting ``USE_VENV``
+to ``True``.  This will enable the creation of venvs for each project
+that is defined in the ``PROJECT_VENV`` array.
+
+Each entry in the ``PROJECT_VENV`` array contains the directory name
+of a venv to be used for the project.  The array index is the project
+name.  Multiple projects can use the same venv if desired.
+
+  ::
+
+    PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
+
+``ADDITIONAL_VENV_PACKAGES`` is a comma-separated list of additional
+packages to be installed into each venv.  Often projects will not have
+certain packages listed in its ``requirements.txt`` file because they
+are 'optional' requirements, i.e. only needed for certain
+configurations.  By default, the enabled databases will have their
+Python bindings added when they are enabled.
+
+  ::
+
+     ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
+
+
 A clean install every time
 --------------------------
 
-    | *Default: ``RECLONE=""``*
-    |  By default ``stack.sh`` only clones the project repos if they do
-       not exist in ``$DEST``. ``stack.sh`` will freshen each repo on each
-       run if ``RECLONE`` is set to ``yes``. This avoids having to manually
-       remove repos in order to get the current branch from ``$GIT_BASE``.
-    |
+By default ``stack.sh`` only clones the project repos if they do not
+exist in ``$DEST``. ``stack.sh`` will freshen each repo on each run if
+``RECLONE`` is set to ``yes``. This avoids having to manually remove
+repos in order to get the current branch from ``$GIT_BASE``.
 
     ::
 
@@ -281,13 +283,11 @@ A clean install every time
 Upgrade packages installed by pip
 ---------------------------------
 
-    | *Default: ``PIP_UPGRADE=""``*
-    |  By default ``stack.sh`` only installs Python packages if no version
-       is currently installed or the current version does not match a specified
-       requirement. If ``PIP_UPGRADE`` is set to ``True`` then existing required
-       Python packages will be upgraded to the most recent version that
-       matches requirements.
-    |
+By default ``stack.sh`` only installs Python packages if no version is
+currently installed or the current version does not match a specified
+requirement. If ``PIP_UPGRADE`` is set to ``True`` then existing
+required Python packages will be upgraded to the most recent version
+that matches requirements.
 
     ::
 
@@ -296,74 +296,69 @@ Upgrade packages installed by pip
 Swift
 -----
 
-    | Default: SWIFT_HASH=""
-    | SWIFT_REPLICAS=1
-    | SWIFT_DATA_DIR=$DEST/data/swift
+Swift is now used as the back-end for the S3-like object store.  When
+enabled Nova's objectstore (``n-obj`` in ``ENABLED_SERVICES``) is
+automatically disabled. Enable Swift by adding it services to
+``ENABLED_SERVICES``
 
-    | Swift is now used as the back-end for the S3-like object store.
-      When enabled Nova's objectstore (n-obj in ENABLED_SERVICES) is
-      automatically disabled. Enable Swift by adding it services to
-      ENABLED_SERVICES: enable_service s-proxy s-object s-container
-      s-account
+    ::
+
+       enable_service s-proxy s-object s-container s-account
 
-    Setting Swift's hash value is required and you will be prompted for
-    it if Swift is enabled so just set it to something already:
+Setting Swift's hash value is required and you will be prompted for it
+if Swift is enabled so just set it to something already:
 
     ::
 
         SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5
 
-    For development purposes the default number of replicas is set to
-    ``1`` to reduce the overhead required. To better simulate a
-    production deployment set this to ``3`` or more.
+For development purposes the default number of replicas is set to
+``1`` to reduce the overhead required. To better simulate a production
+deployment set this to ``3`` or more.
 
     ::
 
         SWIFT_REPLICAS=3
 
-    The data for Swift is stored in the source tree by default (in
-    ``$DEST/swift/data``) and can be moved by setting
-    ``SWIFT_DATA_DIR``. The specified directory will be created if it
-    does not exist.
+The data for Swift is stored in the source tree by default (in
+``$DEST/swift/data``) and can be moved by setting
+``SWIFT_DATA_DIR``. The specified directory will be created if it does
+not exist.
 
     ::
 
         SWIFT_DATA_DIR=$DEST/data/swift
 
-    *Note: Previously just enabling ``swift`` was sufficient to start
-    the Swift services. That does not provide proper service
-    granularity, particularly in multi-host configurations, and is
-    considered deprecated. Some service combination tests now check for
-    specific Swift services and the old blanket acceptance will longer
-    work correctly.*
+*Note*: Previously just enabling ``swift`` was sufficient to start the
+Swift services. That does not provide proper service granularity,
+particularly in multi-host configurations, and is considered
+deprecated. Some service combination tests now check for specific
+Swift services and the old blanket acceptance will longer work
+correctly.
 
 Service Catalog Backend
 -----------------------
 
-    | *Default: ``KEYSTONE_CATALOG_BACKEND=sql``*
-    |  DevStack uses Keystone's ``sql`` service catalog backend. An
-       alternate ``template`` backend is also available. However, it does
-       not support the ``service-*`` and ``endpoint-*`` commands of the
-       ``keystone`` CLI. To do so requires the ``sql`` backend be enabled:
-    |
+By default DevStack uses Keystone's ``sql`` service catalog backend.
+An alternate ``template`` backend is also available, however, it does
+not support the ``service-*`` and ``endpoint-*`` commands of the
+``keystone`` CLI.  To do so requires the ``sql`` backend be enabled
+with ``KEYSTONE_CATALOG_BACKEND``:
 
     ::
 
         KEYSTONE_CATALOG_BACKEND=template
 
-    DevStack's default configuration in ``sql`` mode is set in
-    ``files/keystone_data.sh``
+DevStack's default configuration in ``sql`` mode is set in
+``files/keystone_data.sh``
 
 Cinder
 ------
 
-    | Default:
-    | VOLUME_GROUP="stack-volumes" VOLUME_NAME_PREFIX="volume-" VOLUME_BACKING_FILE_SIZE=10250M
-    |  The logical volume group used to hold the Cinder-managed volumes
-       is set by ``VOLUME_GROUP``, the logical volume name prefix is set
-       with ``VOLUME_NAME_PREFIX`` and the size of the volume backing file
-       is set with ``VOLUME_BACKING_FILE_SIZE``.
-    |
+The logical volume group used to hold the Cinder-managed volumes is
+set by ``VOLUME_GROUP``, the logical volume name prefix is set with
+``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
+with ``VOLUME_BACKING_FILE_SIZE``.
 
     ::
 
@@ -374,19 +369,23 @@ Cinder
 Multi-host DevStack
 -------------------
 
-    | *Default: ``MULTI_HOST=False``*
-    |  Running DevStack with multiple hosts requires a custom
-       ``local.conf`` section for each host. The master is the same as a
-       single host installation with ``MULTI_HOST=True``. The slaves have
-       fewer services enabled and a couple of host variables pointing to
-       the master.
-    |  **Master**
+Running DevStack with multiple hosts requires a custom ``local.conf``
+section for each host. The master is the same as a single host
+installation with ``MULTI_HOST=True``. The slaves have fewer services
+enabled and a couple of host variables pointing to the master.
+
+Master
+~~~~~~
 
+Set ``MULTI_HOST`` to true
     ::
 
         MULTI_HOST=True
 
-    **Slave**
+Slave
+~~~~~
+
+Set the following options to point to the master
 
     ::
 
@@ -398,22 +397,19 @@ Multi-host DevStack
 IP Version
 ----------
 
-    | Default: ``IP_VERSION=4+6``
-    | This setting can be used to configure DevStack to create either an IPv4,
-      IPv6, or dual stack tenant data network by setting ``IP_VERSION`` to
-      either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
-      respectively. This functionality requires that the Neutron networking
-      service is enabled by setting the following options:
-    |
+``IP_VERSION`` can be used to configure DevStack to create either an
+IPv4, IPv6, or dual-stack tenant data-network by with either
+``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
+respectively.  This functionality requires that the Neutron networking
+service is enabled by setting the following options:
 
     ::
 
         disable_service n-net
         enable_service q-svc q-agt q-dhcp q-l3
 
-    | The following optional variables can be used to alter the default IPv6
-      behavior:
-    |
+The following optional variables can be used to alter the default IPv6
+behavior:
 
     ::
 
@@ -422,24 +418,28 @@ IP Version
         FIXED_RANGE_V6=fd$IPV6_GLOBAL_ID::/64
         IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
 
-    | *Note: ``FIXED_RANGE_V6`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
-      can be configured with any valid IPv6 prefix. The default values make
-      use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC 4193.*
-    |
-
-    | Default: ``SERVICE_IP_VERSION=4``
-    | This setting can be used to configure DevStack to enable services to
-      operate over either IPv4 or IPv6, by setting ``SERVICE_IP_VERSION`` to
-      either ``SERVICE_IP_VERSION=4`` or ``SERVICE_IP_VERSION=6`` respectively.
-      When set to ``4`` devstack services will open listen sockets on 0.0.0.0
-      and service endpoints will be registered using ``HOST_IP`` as the address.
-      When set to ``6`` devstack services will open listen sockets on :: and
-      service endpoints will be registered using ``HOST_IPV6`` as the address.
-      The default value for this setting is ``4``.  Dual-mode support, for
-      example ``4+6`` is not currently supported.
-    | The following optional variable can be used to alter the default IPv6
-      address used:
-    |
+*Note*: ``FIXED_RANGE_V6`` and ``IPV6_PRIVATE_NETWORK_GATEWAY`` can be
+configured with any valid IPv6 prefix. The default values make use of
+an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
+
+Service Version
+~~~~~~~~~~~~~~~
+
+DevStack can enable service operation over either IPv4 or IPv6 by
+setting ``SERVICE_IP_VERSION`` to either ``SERVICE_IP_VERSION=4`` or
+``SERVICE_IP_VERSION=6`` respectively.
+
+When set to ``4`` devstack services will open listen sockets on
+``0.0.0.0`` and service endpoints will be registered using ``HOST_IP``
+as the address.
+
+When set to ``6`` devstack services will open listen sockets on ``::``
+and service endpoints will be registered using ``HOST_IPV6`` as the
+address.
+
+The default value for this setting is ``4``.  Dual-mode support, for
+example ``4+6`` is not currently supported.  ``HOST_IPV6`` can
+optionally be used to alter the default IPv6 address
 
     ::
 

From 66919076838771c3a07864037ab661994145a958 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 6 Aug 2015 11:49:46 +0200
Subject: [PATCH 0792/3333] Install cryptsetup on the n-cpu nodes

test_encrypted_cinder_volumes.* tempest test failes,
when cryptsetup package is not installed.

The following error can be seen in the n-cpu log:
Stderr: u'/usr/bin/nova-rootwrap: Executable not found: cryptsetup
(filter match = cryptsetup)\n'

Change-Id: I86603f1301fa946c8bb22de3e69a2ec1ab7f1ef3
---
 files/debs/n-cpu      | 1 +
 files/rpms-suse/n-cpu | 1 +
 files/rpms/n-cpu      | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 5d5052aa4e..ffc947a36d 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -5,3 +5,4 @@ genisoimage
 sysfsutils
 sg3-utils
 python-guestfs # NOPRIME
+cryptsetup
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index 7040b843bf..b3a468d2d8 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -4,3 +4,4 @@ lvm2
 open-iscsi
 sysfsutils
 sg3_utils
+cryptsetup
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index c1a8e8ffa6..81278b30bb 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -4,4 +4,4 @@ lvm2
 genisoimage
 sysfsutils
 sg3_utils
-
+cryptsetup

From 2da606da2e47b7260732bb6ef43f1cbf6b4a1559 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 6 Aug 2015 10:02:43 -0400
Subject: [PATCH 0793/3333] add ebtables to world dump

I'm still at a loss about why guests stop being pingable in grenade,
so lets get ourselves some ebtables output as well.

Change-Id: I4e40eff6d0b1ef194e43b151a83206fbd50deb66
---
 tools/worlddump.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 926b4a1873..1b337a9a83 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -85,6 +85,11 @@ def disk_space():
     print dfraw
 
 
+def ebtables_dump():
+    _header("EB Tables Dump")
+    _dump_cmd("sudo ebtables -L")
+
+
 def iptables_dump():
     tables = ['filter', 'nat', 'mangle']
     _header("IP Tables Dump")
@@ -141,6 +146,7 @@ def main():
         process_list()
         network_dump()
         iptables_dump()
+        ebtables_dump()
         compute_consoles()
         guru_meditation_report()
 

From c0057ed5158c61446d3ba025a3b1feb337688859 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 7 Aug 2015 12:36:00 +1000
Subject: [PATCH 0794/3333] exercises/aggregates.sh: Only source openrc once

Only source openrc once, and remove the unnecessary re-sourcing of
"functions" which is done by openrc.

Change-Id: I61c87a0742de274d47753a0b216c56d96344d161
---
 exercises/aggregates.sh | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/exercises/aggregates.sh b/exercises/aggregates.sh
index 01d548d1f2..808ef76e2f 100755
--- a/exercises/aggregates.sh
+++ b/exercises/aggregates.sh
@@ -31,18 +31,13 @@ set -o xtrace
 EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
 TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
 
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
+# Test as the admin user
+# note this imports stackrc/functions, etc
+. $TOP_DIR/openrc admin admin
 
 # Import exercise configuration
 source $TOP_DIR/exerciserc
 
-# Test as the admin user
-. $TOP_DIR/openrc admin admin
-
 # If nova api is not enabled we exit with exitcode 55 so that
 # the exercise is skipped
 is_service_enabled n-api || exit 55

From 296c1e3809082db4173f00141a981d3a2d168922 Mon Sep 17 00:00:00 2001
From: Jerry Zhao <xyzjerry@gmail.com>
Date: Fri, 7 Aug 2015 20:43:54 -0400
Subject: [PATCH 0795/3333] Move policy.json creation to
 _configure_neutron_common

To allow separating neutron l3, metadata, or dhcp agent from neutron
server or controller, there is supposed to be policy.json on the nodes
with l3, dhcp, metadata agent enabled, so it would be more appropriate
to create policy.json in _configure_neutron_common.

Change-Id: I890d647ffca05482f36ebaaf9c2c6e9e6cb23e2b
---
 lib/neutron-legacy | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4069439183..498cf46179 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -878,6 +878,12 @@ function _configure_neutron_common {
 
     cp $NEUTRON_DIR/etc/neutron.conf $NEUTRON_CONF
 
+    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
+    cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
+
+    # allow neutron user to administer neutron to match neutron account
+    sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
+
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
     # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH``,
@@ -1106,13 +1112,7 @@ function _configure_neutron_plugin_agent {
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
-
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
-    cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
-
-    # allow neutron user to administer neutron to match neutron account
-    sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
 
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS

From 144dbc62f8aa6a62cdca403a69bb883cb8552142 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 10 Aug 2015 12:51:29 +1000
Subject: [PATCH 0796/3333] Remove config_apache_wsgi mention

This has only ever appeared in
I3a5d1e511c5dca1e6d01a1adca8fda0a43d4f632 and has never been exported,
referenced, etc.

Remove it to avoid confusion
(e.g. Icfad40ee6998296727a95613199e5c2d87bd0a45)

Change-Id: Ic71e841f6f751ff43083e12ad734b9c84be7b645
---
 lib/apache | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index c7d69f2ea7..a8e9bc5ad2 100644
--- a/lib/apache
+++ b/lib/apache
@@ -11,7 +11,6 @@
 # lib/apache exports the following functions:
 #
 # - install_apache_wsgi
-# - config_apache_wsgi
 # - apache_site_config_for
 # - enable_apache_site
 # - disable_apache_site

From df8f43b44adec60ce6528441f2a0ea193793adb8 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Sun, 9 Aug 2015 20:30:39 -0400
Subject: [PATCH 0797/3333] Add support to lib/tempest for using tempest test
 accounts

This commit adds support to lib/tempest for configuring tempest to use
the test accounts mechanism. It adds a new variable
TEMPEST_USE_TEST_ACCOUNTS which will be used to trigger using test
accounts. The generate tempest-account-generator utility packaged with
tempest is used to generate the users and projects and write an
accounts.yaml. Another option TEMPEST_CONCURRENCY is added to specify
the the number of accounts to create, the value defaults to the number
of processors on the system.

The auth configuration section is moved to the bottom of the
configure_tempest function to ensure the proper auth endpoint and
catalog entries are all set in the tempest.conf file because the
tempest-account-generator tool depends on tempest knowing how to talk
to keystone to create the accounts.

Change-Id: I8682f72ffe26fd133874f5c575df6389f787ffcc
---
 lib/tempest | 38 ++++++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 3a9ba814d0..240d55c545 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -82,6 +82,21 @@ TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-$TEMPEST_DEFAULT_STORAGE_PR
 IPV6_ENABLED=$(trueorfalse True IPV6_ENABLED)
 IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True IPV6_SUBNET_ATTRIBUTES_ENABLED)
 
+# Do we want to make a configuration where Tempest has admin on
+# the cloud. We don't always want to so that we can ensure Tempest
+# would work on a public cloud.
+TEMPEST_HAS_ADMIN=$(trueorfalse True TEMPEST_HAS_ADMIN)
+
+# Credential provider configuration option variables
+TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}
+TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False $TEMPEST_USE_TEST_ACCOUNTS)
+
+# The number of workers tempest is expected to be run with. This is used for
+# generating a accounts.yaml for running with test-accounts. This is also the
+# same variable that devstack-gate uses to specify the number of workers that
+# it will run tempest with
+TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
+
 
 # Functions
 # ---------
@@ -174,11 +189,6 @@ function configure_tempest {
 
     password=${ADMIN_PASSWORD:-secrete}
 
-    # Do we want to make a configuration where Tempest has admin on
-    # the cloud. We don't always want to so that we can ensure Tempest
-    # would work on a public cloud.
-    TEMPEST_HAS_ADMIN=$(trueorfalse True TEMPEST_HAS_ADMIN)
-
     # See ``lib/keystone`` where these users and tenants are set up
     ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
     ADMIN_TENANT_NAME=${ADMIN_TENANT_NAME:-admin}
@@ -335,11 +345,6 @@ function configure_tempest {
     # Image Features
     iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True
 
-    # Auth
-    TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}
-    iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
-
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
     iniset $TEMPEST_CONFIG compute network_for_ssh $PRIVATE_NETWORK_NAME
@@ -545,6 +550,19 @@ function configure_tempest {
         sudo chown $STACK_USER $BOTO_CONF
     fi
 
+    # Auth
+    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
+        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+        else:
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+        fi
+        iniset $TEMPEST_CONFIG auth allow_tenant_isolation False
+        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    else
+        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+    fi
     # Restore IFS
     IFS=$ifs
 }

From 19c5e62a04902e19a603d5a55bcfc5f318a522cf Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Wed, 5 Aug 2015 15:53:21 +1000
Subject: [PATCH 0798/3333] Configure glance swift communication with v3

With the aim of moving everything fully over to v3 authentication we
need to configure glance_store to use v3 when calling swift.

Requires glance_store 0.8.0

Change-Id: I61e8c5a4136404077f5505ebc2edfe49841c244f
Implements: bp keystonev3
---
 lib/glance | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index f200dcaeea..b1b0f32f62 100644
--- a/lib/glance
+++ b/lib/glance
@@ -154,7 +154,10 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_TENANT_NAME:glance-swift
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v2.0/
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id default
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
         inicomment $GLANCE_API_CONF glance_store swift_store_user

From 1991e7599313cdbc75cf7674df94f32e9443cc60 Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Tue, 11 Aug 2015 19:34:22 +0200
Subject: [PATCH 0799/3333] Fix creation of endpoints in multi-region

Keystone API v3 does currently not support filtering for region names.
As a consequence an additional check is needed in get_or_create_endpoint
to check if an endpoint must be created for a given region or if it
already exists.
See related bug for more information regarding the missing region
filtering in keystone.

Closes-Bug: #1483784
Related-Bug: #1482772
Change-Id: Ia6a497b9fb58f7474636ab52dc01b99857bed3a2
---
 functions-common | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 60cf04c499..641eca8362 100644
--- a/functions-common
+++ b/functions-common
@@ -852,13 +852,18 @@ function get_or_create_service {
 # Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
 function _get_or_create_endpoint_with_interface {
     local endpoint_id
+    # TODO(dgonzalez): The check of the region name, as done in the grep
+    # statement below, exists only because keystone does currently
+    # not allow filtering the region name when listing endpoints. If keystone
+    # gets support for this, the check for the region name can be removed.
+    # Related bug in keystone: https://bugs.launchpad.net/keystone/+bug/1482772
     endpoint_id=$(openstack endpoint list \
         --os-url $KEYSTONE_SERVICE_URI_V3 \
         --os-identity-api-version=3 \
         --service $1 \
         --interface $2 \
         --region $4 \
-        -c ID -f value)
+        -c ID -c Region -f value | grep $4 | cut -f 1 -d " ")
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \

From 75c1dfe3b0adc8bcb98276bcdbecca76a94eaab7 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 13 Aug 2015 10:40:57 +1000
Subject: [PATCH 0800/3333] Rename bad option value

To disable tempest running the v2 tests when the identity v2 api is
disabled you need to set api_v2=False not v2_api=False.

Change-Id: Ied8a0593619dccb5985f9a1e51feb370754336c7
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 240d55c545..6863bae9de 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -323,7 +323,7 @@ function configure_tempest {
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
-        iniset $TEMPEST_CONFIG identity-feature-enabled v2_api False
+        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
         # In addition, use v3 auth tokens for running all Tempest tests
         iniset $TEMPEST_CONFIG identity auth_version v3
     else

From 7b105c572ed51510d951304b31c043cfe4674731 Mon Sep 17 00:00:00 2001
From: David Lyle <david.lyle@intel.com>
Date: Mon, 27 Jul 2015 17:14:32 -0600
Subject: [PATCH 0801/3333] Move horizon apache root to /dashboard

With keystone's move to /identity, a conflict in for resources was
created as both keystone and horizon used /identity. The keystone
config took precedence and rendered API output in the horizon UI.

This patch sets the root for horizon to /dashboard and serves all
horizon content from there. Additionally, a RedirectMatch has been added
to the apache config for horizon to redirect '/' to '/dashboard' this
will allow the implementation to change without being immediately
painful to users.

Also made the path '/dashboard/' configurable in stackrc.

Closes-Bug: #1478306
Depends-On: I9a04f936ed6d8c14775a332dc28e903992806c42

for devstack-gate changes to remove hard coded horizon url structure
assumptions.

Change-Id: I6fbca5cea9e44df160afbccc71bd045437657320
---
 files/apache-horizon.template | 7 +++++--
 lib/horizon                   | 4 ++++
 stack.sh                      | 2 +-
 stackrc                       | 3 +++
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index 68838985ee..bfd75678e3 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -1,5 +1,5 @@
 <VirtualHost *:80>
-    WSGIScriptAlias / %HORIZON_DIR%/openstack_dashboard/wsgi/django.wsgi
+    WSGIScriptAlias %WEBROOT% %HORIZON_DIR%/openstack_dashboard/wsgi/django.wsgi
     WSGIDaemonProcess horizon user=%USER% group=%GROUP% processes=3 threads=10 home=%HORIZON_DIR% display-name=%{GROUP}
     WSGIApplicationGroup %{GLOBAL}
 
@@ -8,7 +8,10 @@
     WSGIProcessGroup horizon
 
     DocumentRoot %HORIZON_DIR%/.blackhole/
-    Alias /media %HORIZON_DIR%/openstack_dashboard/static
+    Alias %WEBROOT%/media %HORIZON_DIR%/openstack_dashboard/static
+    Alias %WEBROOT%/static %HORIZON_DIR%/static
+
+    RedirectMatch "^/$" "%WEBROOT%/"
 
     <Directory />
         Options FollowSymLinks
diff --git a/lib/horizon b/lib/horizon
index b0f306b675..9fe0aa8b49 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -93,6 +93,9 @@ function init_horizon {
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
     cp $HORIZON_SETTINGS $local_settings
 
+    _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
+    _horizon_config_set $local_settings "" CUSTOM_THEME_PATH \"themes/webroot\"
+
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"
 
@@ -122,6 +125,7 @@ function init_horizon {
         s,%HORIZON_DIR%,$HORIZON_DIR,g;
         s,%APACHE_NAME%,$APACHE_NAME,g;
         s,%DEST%,$DEST,g;
+        s,%WEBROOT%,$HORIZON_APACHE_ROOT,g;
     \" $FILES/apache-horizon.template >$horizon_conf"
 
     if is_ubuntu; then
diff --git a/stack.sh b/stack.sh
index cc8bc8c88f..cfcf126bda 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1421,7 +1421,7 @@ fi
 # If you installed Horizon on this server you should be able
 # to access the site using your browser.
 if is_service_enabled horizon; then
-    echo "Horizon is now available at http://$SERVICE_HOST/"
+    echo "Horizon is now available at http://$SERVICE_HOST$HORIZON_APACHE_ROOT"
 fi
 
 # If Keystone is present you can point ``nova`` cli to this server
diff --git a/stackrc b/stackrc
index 8beef9639f..f4245a40cf 100644
--- a/stackrc
+++ b/stackrc
@@ -87,6 +87,9 @@ TEMPEST_SERVICES=""
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=ec2,osapi_compute,metadata
 
+# Set the root URL for Horizon
+HORIZON_APACHE_ROOT="/dashboard"
+
 # Whether to use 'dev mode' for screen windows. Dev mode works by
 # stuffing text into the screen windows so that a developer can use
 # ctrl-c, up-arrow, enter to restart the service. Starting services

From b237b93f2bdfd66152bd68eedccec85ce0cb75b8 Mon Sep 17 00:00:00 2001
From: venkatamahesh <venkatamaheshkotha@gmail.com>
Date: Mon, 10 Aug 2015 16:07:03 +0530
Subject: [PATCH 0802/3333] Location of the "local.conf" file is confusing. It
 is updated.

It was shown that the local.conf is at root devstack directory, but
it is at devstack/samples directory. So the path is updated.

1.) Copy the file into root Devstack directory.

Change-Id: I6ff8a404a3664c892bb458023c57ccc5d0926fdf
Closes-Bug: #1464491
---
 doc/source/configuration.rst | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 05a8d95f51..90b7d44dec 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -28,8 +28,10 @@ simplify this process and meet the following goals:
 local.conf
 ==========
 
-The new configuration file is ``local.conf`` and resides in the root
-DevStack directory like the old ``localrc`` file. It is a modified INI
+The new configuration file is ``local.conf`` and should reside in the
+root Devstack directory. An example of such ``local.conf`` file
+is provided in the ``devstack/samples`` directory. Copy this file into
+the root Devstack directory and adapt it to your needs. It is a modified INI
 format file that introduces a meta-section header to carry additional
 information regarding the configuration files to be changed.
 

From 6b172c8dd52effc649673ac5955d1ec8ae5016f9 Mon Sep 17 00:00:00 2001
From: Adam Kacmarsky <adam.kacmarsky@hp.com>
Date: Thu, 13 Aug 2015 15:14:05 -0600
Subject: [PATCH 0803/3333] Always add OVS port in
 _move_neutron_addresses_route

Added functionallity to allow _move_neutron_addresses_route to support
interfaces without a configured IP address. If PUBLIC_INTERFACE is set
to an interface without a configured IP, only the port will be
added to the OVS_PHYSICAL_BRIDGE.

Change-Id: I511ea5229ab871298086af5c96761390529bd85e
---
 lib/neutron-legacy | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4069439183..4bbc802ba9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -793,7 +793,8 @@ function stop_neutron {
 }
 
 # _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
-# on startup, or back to the public interface on cleanup
+# on startup, or back to the public interface on cleanup. If no IP is
+# configured on the interface, just add it as a port to the OVS bridge.
 function _move_neutron_addresses_route {
     local from_intf=$1
     local to_intf=$2
@@ -806,7 +807,8 @@ function _move_neutron_addresses_route {
         # on configure we will also add $from_intf as a port on $to_intf,
         # assuming it is an OVS bridge.
 
-        local IP_BRD=$(ip -f $af a s dev $from_intf | awk '/inet/ { print $2, $3, $4; exit }')
+        local IP_ADD=""
+        local IP_DEL=""
         local DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
@@ -826,7 +828,12 @@ function _move_neutron_addresses_route {
             ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
         fi
 
-        sudo ip addr del $IP_BRD dev $from_intf; sudo ip addr add $IP_BRD dev $to_intf; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        if [[ "$IP_BRD" != "" ]]; then
+            IP_ADD="sudo ip addr del $IP_BRD dev $from_intf"
+            IP_DEL="sudo ip addr add $IP_BRD dev $to_intf"
+        fi
+
+        $IP_ADD; $IP_DEL; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
     fi
 }
 
@@ -834,9 +841,7 @@ function _move_neutron_addresses_route {
 # runs that a clean run would need to clean up
 function cleanup_neutron {
 
-    if [[ $(ip -f inet a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
-    fi
+    _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
 
     if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
@@ -1021,9 +1026,7 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent
 
-    if [[ $(ip -f inet a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
-    fi
+    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
 
     if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
         _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"

From dbdee698700d9c7cf86ad3cde74e8b4347ef757a Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 14 Aug 2015 12:22:18 +1000
Subject: [PATCH 0804/3333] Use standard get_or_create_role to find role

The openstack role list command doesn't include any identity API version
information and so will fail when running purely with v3. We could add
this information to the command however we already have a function that
does what swift requires so we should use it.

Change-Id: I5d5417eaed432760bfb97cf35bd76a0919c6004d
---
 lib/swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 96d730ef2c..7bc811e1e6 100644
--- a/lib/swift
+++ b/lib/swift
@@ -610,7 +610,7 @@ function create_swift_accounts {
 
     KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
 
-    local another_role=$(openstack role list | awk "/ anotherrole / { print \$2 }")
+    local another_role=$(get_or_create_role "anotherrole")
 
     # NOTE(jroll): Swift doesn't need the admin role here, however Ironic uses
     # temp urls, which break when uploaded by a non-admin role

From e4289c88c8007ae942a18a1786fc6fd36f2489c7 Mon Sep 17 00:00:00 2001
From: Paul Michali <pc@michali.net>
Date: Fri, 14 Aug 2015 11:49:27 -0400
Subject: [PATCH 0805/3333] Prevent spawning two VPN agents

Currently, if the VPN devstack plugin is enabled (which is
the method used for VPN in all test jobs), there will be
two VPN agent processes started. This doesn't seem to
affect the tests, but is incorrect.

To resolve this, the proposal is to do this in two steps.
With this commit, the script is modified to start the q-vpn
process, if q-vpn is enabled (legacy), and to only start
q-l3 process, if neither q-vpn nor neutron-vpnaas is enabled.

Once committed, the opertion will be the same - if no VPN
service is enabled, we get q-l3 (correct); if legacy q-vpn is
enabled (only), we get q-vpn (correct); if the plugin is used
(the default), we get two q-vpn processes started (wrong).

With a separate plugin commit (to be pushed next), the plugin
will be renamed to neutron-vpnaas, and then we'll get only
one agent process (q-vpn or neutron-vpnaas) runing. We can't
commit the plugin first, because both the VPN agent and the
q-l3 agent will be started at once (just as bad, if not worse).

Change-Id: I2bb7ac01e619c8a9b22bd517a4ff60d67035dfed
Partial-Bug: 1484141
---
 lib/neutron-legacy | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4069439183..01be7cb244 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -730,7 +730,9 @@ function start_neutron_l2_agent {
 function start_neutron_other_agents {
     run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
-    if is_service_enabled q-vpn; then
+    if is_service_enabled neutron-vpnaas; then
+        :  # Started by plugin
+    elif is_service_enabled q-vpn; then
         run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
     else
         run_process q-l3 "python $AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"

From a83e90b56080d1c86f98e66d146f781c19d150c5 Mon Sep 17 00:00:00 2001
From: Tim Buckley <timothy.jas.buckley@hp.com>
Date: Wed, 5 Aug 2015 10:25:00 -0600
Subject: [PATCH 0806/3333] Enable CSV logging output for DStat.

Future work toward visualization of DevStack and devstack-gate performance
would benefit greatly from the availability of machine-parsable DStat output.
This patch outputs an additional logfile to $LOGDIR, `dstat-csv.log`, using
DStat's built-in CSV logging functionality.

An additional instance of DStat is started during start_dstat that outputs
to CSV-formatted text without `--top-cpu-adv` and `-top-io-adv` enabled, as
these plugins are currently incompatible with CSV output. To facilitate this,
a new `dstat.sh` script is added to $TOP_DIR/tools/ to act as a daemon to
manage the two processes.

Change-Id: I826c94c35b6a109308b4f132c181ff7a1f63bc7b
Depends-On: I534fb1f9356a7948d2fec0aecc7f275e47362a11
---
 lib/dstat      |  3 +--
 tools/dstat.sh | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100755 tools/dstat.sh

diff --git a/lib/dstat b/lib/dstat
index f11bfa55c0..fe4790b12d 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -19,8 +19,7 @@ set +o xtrace
 # start_dstat() - Start running processes, including screen
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
-    DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
-    run_process dstat "dstat $DSTAT_OPTS"
+    run_process dstat "$TOP_DIR/tools/dstat.sh $LOGDIR"
 
     # To enable peakmem_tracker add:
     #    enable_service peakmem_tracker
diff --git a/tools/dstat.sh b/tools/dstat.sh
new file mode 100755
index 0000000000..6ba4515acf
--- /dev/null
+++ b/tools/dstat.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# **tools/dstat.sh** - Execute instances of DStat to log system load info
+#
+# Multiple instances of DStat are executed in order to take advantage of
+# incompatible features, particularly CSV output and the "top-cpu-adv" and
+# "top-io-adv" flags.
+#
+# Assumes:
+#  - dstat command is installed
+
+# Retreive log directory as argument from calling script.
+LOGDIR=$1
+
+# Command line arguments for primary DStat process.
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
+
+# Command-line arguments for secondary background DStat process.
+DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"
+
+# Execute and background the secondary dstat process and discard its output.
+dstat $DSTAT_CSV_OPTS >& /dev/null &
+
+# Execute and background the primary dstat process, but keep its output in this
+# TTY.
+dstat $DSTAT_OPTS &
+
+# Catch any exit signals, making sure to also terminate any child processes.
+trap "kill -- -$$" EXIT
+
+# Keep this script running as long as child dstat processes are alive.
+wait

From 51bddb8c64f5cb4086d672574202262ad9c38332 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 14 Aug 2015 17:21:47 +0100
Subject: [PATCH 0807/3333] Ironic: Create nodes with names

This patch is setting a name for each node created in Ironic, when
testing stuff it's easier to refer to a nome by its name then uuid.

The format of the name is: node-0, node-1, ...

Change-Id: I60fcddbcb36d1b1da8b3846b6edf14c59401f102
---
 lib/ironic | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/ironic b/lib/ironic
index 1323446c1f..b3ad586923 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -618,6 +618,7 @@ function enroll_nodes {
         local node_id=$(ironic node-create $standalone_node_uuid\
             --chassis_uuid $chassis_id \
             --driver $IRONIC_DEPLOY_DRIVER \
+            --name node-$total_nodes \
             -p cpus=$ironic_node_cpu\
             -p memory_mb=$ironic_node_ram\
             -p local_gb=$ironic_node_disk\

From 597c902dfc9ea62f1a1455d6db7c7c50d09a5876 Mon Sep 17 00:00:00 2001
From: Masaki Matsushita <glass.saga@gmail.com>
Date: Sat, 15 Aug 2015 11:35:20 +0900
Subject: [PATCH 0808/3333] use $SERVICE_HOST in multi-node doc

The change fix multi-node doc to use SERVICE_HOST.
It resolves duplicate IP address.

Closes-Bug: #1485159
Change-Id: If86393e9a37bcb911a9aa125829cd8ce684edd9f
---
 doc/source/guides/multinode-lab.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 557b522f69..1530a84523 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -175,12 +175,12 @@ machines, create a ``local.conf`` with:
     SERVICE_TOKEN=xyzpdqlazydog
     DATABASE_TYPE=mysql
     SERVICE_HOST=192.168.42.11
-    MYSQL_HOST=192.168.42.11
-    RABBIT_HOST=192.168.42.11
-    GLANCE_HOSTPORT=192.168.42.11:9292
+    MYSQL_HOST=$SERVICE_HOST
+    RABBIT_HOST=$SERVICE_HOST
+    GLANCE_HOSTPORT=$SERVICE_HOST:9292
     ENABLED_SERVICES=n-cpu,n-net,n-api-meta,c-vol
     NOVA_VNC_ENABLED=True
-    NOVNCPROXY_URL="http://192.168.42.11:6080/vnc_auto.html"
+    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP
     VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
 

From 4b115ad526df7e12bbdc71e0280b3c691e53ed04 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 29 May 2015 08:36:40 +0000
Subject: [PATCH 0809/3333] Convert identity defaults to keystone v3 api

At this point all our function calls should be using the V3 APIs anyway
so switch the authentication credentials to v3 compatible ones and
remove all the hacks we added to force v3 API calls.

Implements: bp keystonev3
Change-Id: If92d3e11b9a363454f77527783b6d25f4da9c249
---
 functions-common | 35 ++++-------------------------------
 stack.sh         | 15 ++++++++-------
 2 files changed, 12 insertions(+), 38 deletions(-)

diff --git a/functions-common b/functions-common
index 641eca8362..cc5136da56 100644
--- a/functions-common
+++ b/functions-common
@@ -687,16 +687,13 @@ function policy_add {
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
     local domain_id
-    local os_url="$KEYSTONE_SERVICE_URI_V3"
     # Gets domain id
     domain_id=$(
         # Gets domain id
-        openstack --os-token=$OS_TOKEN --os-url=$os_url \
-            --os-identity-api-version=3 domain show $1 \
+        openstack domain show $1 \
             -f value -c id 2>/dev/null ||
         # Creates new domain
-        openstack --os-token=$OS_TOKEN --os-url=$os_url \
-            --os-identity-api-version=3 domain create $1 \
+        openstack domain create $1 \
             --description "$2" \
             -f value -c id
     )
@@ -707,13 +704,11 @@ function get_or_create_domain {
 # Usage: get_or_create_group <groupname> <domain> [<description>]
 function get_or_create_group {
     local desc="${3:-}"
-    local os_url="$KEYSTONE_SERVICE_URI_V3"
     local group_id
     # Gets group id
     group_id=$(
         # Creates new group with --or-show
-        openstack --os-token=$OS_TOKEN --os-url=$os_url \
-            --os-identity-api-version=3 group create $1 \
+        openstack group create $1 \
             --domain $2 --description "$desc" --or-show \
             -f value -c id
     )
@@ -735,8 +730,6 @@ function get_or_create_user {
         openstack user create \
             $1 \
             --password "$2" \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --domain=$3 \
             $email \
             --or-show \
@@ -751,9 +744,7 @@ function get_or_create_project {
     local project_id
     project_id=$(
         # Creates new project with --or-show
-        openstack --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
-            project create $1 \
+        openstack project create $1 \
             --domain=$2 \
             --or-show -f value -c id
     )
@@ -767,8 +758,6 @@ function get_or_create_role {
     role_id=$(
         # Creates role with --or-show
         openstack role create $1 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --or-show -f value -c id
     )
     echo $role_id
@@ -781,8 +770,6 @@ function get_or_add_user_project_role {
     # Gets user role id
     user_role_id=$(openstack role list \
         --user $2 \
-        --os-url=$KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
         --column "ID" \
         --project $3 \
         --column "Name" \
@@ -793,8 +780,6 @@ function get_or_add_user_project_role {
             $1 \
             --user $2 \
             --project $3 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             | grep " id " | get_field 2)
     fi
     echo $user_role_id
@@ -806,21 +791,15 @@ function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
     group_role_id=$(openstack role list \
-        --os-url=$KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
         --group $2 \
         --project $3 \
         -c "ID" -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
         openstack role add $1 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --group $2 \
             --project $3
         group_role_id=$(openstack role list \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --group $2 \
             --project $3 \
             -c "ID" -f value)
@@ -838,8 +817,6 @@ function get_or_create_service {
         openstack service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
         openstack service create \
-            --os-url $KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             $2 \
             --name $1 \
             --description="$3" \
@@ -858,8 +835,6 @@ function _get_or_create_endpoint_with_interface {
     # gets support for this, the check for the region name can be removed.
     # Related bug in keystone: https://bugs.launchpad.net/keystone/+bug/1482772
     endpoint_id=$(openstack endpoint list \
-        --os-url $KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
         --service $1 \
         --interface $2 \
         --region $4 \
@@ -867,8 +842,6 @@ function _get_or_create_endpoint_with_interface {
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \
-            --os-url $KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             $1 $2 $3 --region $4 -f value -c id)
     fi
 
diff --git a/stack.sh b/stack.sh
index cc8bc8c88f..fa2e490704 100755
--- a/stack.sh
+++ b/stack.sh
@@ -987,13 +987,15 @@ if is_service_enabled keystone; then
         start_keystone
     fi
 
+    export OS_IDENTITY_API_VERSION=3
+
     # Set up a temporary admin URI for Keystone
-    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v2.0
+    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v3
 
     if is_service_enabled tls-proxy; then
         export OS_CACERT=$INT_CA_DIR/ca-chain.pem
         # Until the client support is fixed, just use the internal endpoint
-        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v2.0
+        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v3
     fi
 
     # Setup OpenStackClient token-endpoint auth
@@ -1021,14 +1023,13 @@ if is_service_enabled keystone; then
     # Begone token auth
     unset OS_TOKEN OS_URL
 
-    # force set to use v2 identity authentication even with v3 commands
-    export OS_AUTH_TYPE=v2password
-
     # Set up password auth credentials now that Keystone is bootstrapped
-    export OS_AUTH_URL=$SERVICE_ENDPOINT
-    export OS_TENANT_NAME=admin
+    export OS_AUTH_URL=$KEYSTONE_AUTH_URI
     export OS_USERNAME=admin
+    export OS_USER_DOMAIN_ID=default
     export OS_PASSWORD=$ADMIN_PASSWORD
+    export OS_PROJECT_NAME=admin
+    export OS_PROJECT_DOMAIN_ID=default
     export OS_REGION_NAME=$REGION_NAME
 fi
 

From 05076fb7ea45b7f1f7d9f232afb56dbb1d6e2f08 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Sat, 15 Aug 2015 19:01:59 +1000
Subject: [PATCH 0810/3333] Configure horizon with identity v3

Currently horizon configures keystone using v3 only if v2 is not
available. Really we should just always be using v3.

Change-Id: Icac4d90b617209da75abf33f8e25ffc021c45fdb
---
 lib/horizon | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index b0f306b675..108a7f0a8f 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -98,13 +98,8 @@ function init_horizon {
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        # Only Identity v3 API is available; then use it with v3 auth tokens
-        _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
-        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
-    else
-        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
-    fi
+    _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"

From 1e7fb4c9a0a7a45fb89363a25504e8b173e032aa Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 23 Jul 2015 15:49:39 +0900
Subject: [PATCH 0811/3333] _configure_neutron_dhcp_agent: Modify the right
 config file

This has been incorrect since the initial commit
(I632df4149e9d7f78cb5a7091dfe4ea8f8ca3ddfa)

Closes-Bug: #1483499
Change-Id: Ife4defce989c4f3c7eb5381376c0f93de50a9668
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4069439183..64126094cb 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -979,7 +979,7 @@ function _configure_neutron_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_DHCP_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $Q_DHCP_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     if ! is_service_enabled q-l3; then

From fc657f4ff280e0908e096d562ce0770dbfd9e41a Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 23 Jul 2015 15:52:49 +0900
Subject: [PATCH 0812/3333] neutron-legacy: Update after DEFAULT.root_helper
 removal

Update after change I17cd62c8763430bf3a4b67ab5e9cf5b736065133 .

Closes-Bug: #1483501
Change-Id: Ieb5270484205cffe4ec97db0d59f012d1e7708d4
---
 lib/neutron-legacy | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 64126094cb..7dddde15fd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -977,7 +977,7 @@ function _configure_neutron_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_DHCP_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    iniset $Q_DHCP_CONF_FILE agent root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_DHCP_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
@@ -1012,7 +1012,7 @@ function _configure_neutron_l3_agent {
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    iniset $Q_L3_CONF_FILE agent root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
@@ -1036,7 +1036,7 @@ function _configure_neutron_metadata_agent {
     iniset $Q_META_CONF_FILE DEFAULT verbose True
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
-    iniset $Q_META_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    iniset $Q_META_CONF_FILE agent root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_META_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi

From 05aa3846a0402edc9cc49f4ba36f09592004b273 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 3 Aug 2015 11:14:13 -0700
Subject: [PATCH 0813/3333] Just use constraints everywhere

Having behavior on your laptop diverge from behavior in the gate is
confusing. Just use constraints on every devstack run to be consistent.
Users of devstack can edit the requirements repo in order to change
these constraints locally if necessary.

Change-Id: I843208e2e982eb04931b76f5cb4bd219fbcd70de
---
 functions-common     |  1 -
 inc/python           | 51 ++++++++------------------------------------
 lib/infra            |  1 -
 stack.sh             |  3 ---
 stackrc              | 13 +++--------
 tools/install_pip.sh |  2 +-
 6 files changed, 13 insertions(+), 58 deletions(-)

diff --git a/functions-common b/functions-common
index 60cf04c499..749ca2b40c 100644
--- a/functions-common
+++ b/functions-common
@@ -28,7 +28,6 @@
 # - ``REQUIREMENTS_DIR``
 # - ``STACK_USER``
 # - ``TRACK_DEPENDS``
-# - ``UNDO_REQUIREMENTS``
 # - ``http_proxy``, ``https_proxy``, ``no_proxy``
 #
 
diff --git a/inc/python b/inc/python
index 54e19a7886..5c9dc5c3e5 100644
--- a/inc/python
+++ b/inc/python
@@ -67,7 +67,6 @@ function pip_install_gr {
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
-# ``USE_CONSTRAINTS``
 # pip_install package [package ...]
 function pip_install {
     local xtrace=$(set +o | grep xtrace)
@@ -105,11 +104,8 @@ function pip_install {
     fi
 
     cmd_pip="$cmd_pip install"
-
-    # Handle a constraints file, if needed.
-    if [[ "$USE_CONSTRAINTS" == "True" ]]; then
-        cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
-    fi
+    # Always apply constraints
+    cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
 
     local pip_version=$(python -c "import pip; \
                         print(pip.__version__.strip('.')[0])")
@@ -187,13 +183,13 @@ function setup_dev_lib {
 # use this, especially *oslo* ones
 function setup_install {
     local project_dir=$1
-    setup_package_with_req_sync $project_dir
+    setup_package_with_constraints_edit $project_dir
 }
 
 # this should be used for projects which run services, like all services
 function setup_develop {
     local project_dir=$1
-    setup_package_with_req_sync $project_dir -e
+    setup_package_with_constraints_edit $project_dir -e
 }
 
 # determine if a project as specified by directory is in
@@ -209,32 +205,16 @@ function is_in_projects_txt {
 # ``pip install -e`` the package, which processes the dependencies
 # using pip before running `setup.py develop`
 #
-# Updates the dependencies in project_dir from the
-# openstack/requirements global list before installing anything.
+# Updates the constraints from REQUIREMENTS_DIR to reflect the
+# future installed state of this package. This ensures when we
+# install this package we get the from source version.
 #
-# Uses globals ``TRACK_DEPENDS``, ``REQUIREMENTS_DIR``, ``UNDO_REQUIREMENTS``
+# Uses globals ``REQUIREMENTS_DIR``
 # setup_develop directory
-function setup_package_with_req_sync {
+function setup_package_with_constraints_edit {
     local project_dir=$1
     local flags=$2
 
-    # Don't update repo if local changes exist
-    # Don't use buggy "git diff --quiet"
-    # ``errexit`` requires us to trap the exit code when the repo is changed
-    local update_requirements=$(cd $project_dir && git diff --exit-code >/dev/null || echo "changed")
-
-    if [[ $update_requirements != "changed" && "$USE_CONSTRAINTS" == "False" ]]; then
-        if is_in_projects_txt $project_dir; then
-            (cd $REQUIREMENTS_DIR; \
-                ./.venv/bin/python update.py $project_dir)
-        else
-            # soft update projects not found in requirements project.txt
-            echo "$project_dir not a constrained repository, soft enforcing requirements"
-            (cd $REQUIREMENTS_DIR; \
-                ./.venv/bin/python update.py -s $project_dir)
-        fi
-    fi
-
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
         local name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
@@ -245,19 +225,6 @@ function setup_package_with_req_sync {
 
     setup_package $project_dir $flags
 
-    # We've just gone and possibly modified the user's source tree in an
-    # automated way, which is considered bad form if it's a development
-    # tree because we've screwed up their next git checkin. So undo it.
-    #
-    # However... there are some circumstances, like running in the gate
-    # where we really really want the overridden version to stick. So provide
-    # a variable that tells us whether or not we should UNDO the requirements
-    # changes (this will be set to False in the OpenStack ci gate)
-    if [ $UNDO_REQUIREMENTS = "True" ]; then
-        if [[ $update_requirements != "changed" ]]; then
-            (cd $project_dir && git reset --hard)
-        fi
-    fi
 }
 
 # ``pip install -e`` the package, which processes the dependencies
diff --git a/lib/infra b/lib/infra
index eb8000e8d3..89397de792 100644
--- a/lib/infra
+++ b/lib/infra
@@ -22,7 +22,6 @@ set +o xtrace
 # Defaults
 # --------
 GITDIR["pbr"]=$DEST/pbr
-REQUIREMENTS_DIR=$DEST/requirements
 
 # Entry Points
 # ------------
diff --git a/stack.sh b/stack.sh
index 2288af57a4..ba935be76e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -688,9 +688,6 @@ save_stackenv $LINENO
 echo_summary "Installing package prerequisites"
 source $TOP_DIR/tools/install_prereqs.sh
 
-# Normalise USE_CONSTRAINTS
-USE_CONSTRAINTS=$(trueorfalse False USE_CONSTRAINTS)
-
 # Configure an appropriate Python environment
 if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
diff --git a/stackrc b/stackrc
index 8beef9639f..f67afd9aee 100644
--- a/stackrc
+++ b/stackrc
@@ -149,13 +149,6 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # Zero disables timeouts
 GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 
-# Constraints mode
-# - False (default) : update git projects dependencies from global-requirements.
-#
-# - True : use upper-constraints.txt to constrain versions of packages intalled
-#          and do not edit projects at all.
-USE_CONSTRAINTS=$(trueorfalse False USE_CONSTRAINTS)
-
 # Repositories
 # ------------
 
@@ -163,6 +156,9 @@ USE_CONSTRAINTS=$(trueorfalse False USE_CONSTRAINTS)
 # Another option is https://git.openstack.org
 GIT_BASE=${GIT_BASE:-git://git.openstack.org}
 
+# The location of REQUIREMENTS once cloned
+REQUIREMENTS_DIR=$DEST/requirements
+
 # Which libraries should we install from git instead of using released
 # versions on pypi?
 #
@@ -627,9 +623,6 @@ USE_SCREEN=${SCREEN_DEV:-$USE_SCREEN}
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}
 
-# Undo requirements changes by global requirements
-UNDO_REQUIREMENTS=${UNDO_REQUIREMENTS:-True}
-
 # Allow the use of an alternate protocol (such as https) for service endpoints
 SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 0f7c962b2b..7b42c8c485 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -20,7 +20,7 @@ TOP_DIR=`cd $TOOLS_DIR/..; pwd`
 cd $TOP_DIR
 
 # Import common functions
-source $TOP_DIR/functions
+source $TOP_DIR/stackrc
 
 FILES=$TOP_DIR/files
 

From ea21eb4f69e2f2ea2c9c6d2fb9c4ed9aef4fc198 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Tue, 18 Aug 2015 06:57:18 -0400
Subject: [PATCH 0814/3333] Remove non-ASCII characters

Change-Id: If1c68e5aab6990617519150d8aeb3f073df2ad17
---
 lib/databases/mysql | 4 ++--
 lib/swift           | 2 +-
 lib/tempest         | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index fb55b60ff6..7ae9a936d6 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -85,12 +85,12 @@ function configure_database_mysql {
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
-    # Update the DB to give user ‘$DATABASE_USER’@’%’ full control of the all databases:
+    # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
     sudo mysql -uroot -p$DATABASE_PASSWORD -h127.0.0.1 -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
-    # Change ‘bind-address’ from localhost (127.0.0.1) to any (::) and
+    # Change bind-address from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
     sudo bash -c "source $TOP_DIR/functions && \
         iniset $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS" && \
diff --git a/lib/swift b/lib/swift
index 96d730ef2c..dac121be0c 100644
--- a/lib/swift
+++ b/lib/swift
@@ -97,7 +97,7 @@ SWIFT_EXTRAS_MIDDLEWARE_LAST=${SWIFT_EXTRAS_MIDDLEWARE_LAST:-}
 # the beginning of the pipeline, before authentication middlewares.
 SWIFT_EXTRAS_MIDDLEWARE_NO_AUTH=${SWIFT_EXTRAS_MIDDLEWARE_NO_AUTH:-crossdomain}
 
-# The ring uses a configurable number of bits from a path’s MD5 hash as
+# The ring uses a configurable number of bits from a path's MD5 hash as
 # a partition index that designates a device. The number of bits kept
 # from the hash is known as the partition power, and 2 to the partition
 # power indicates the partition count. Partitioning the full MD5 hash
diff --git a/lib/tempest b/lib/tempest
index 3a9ba814d0..b598db4527 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -386,7 +386,7 @@ function configure_tempest {
     # and is now the default behavior.
     iniset $TEMPEST_CONFIG compute-feature-enabled allow_duplicate_networks ${NOVA_ALLOW_DUPLICATE_NETWORKS:-True}
 
-    # Network
+    # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
     iniset $TEMPEST_CONFIG network tenant_networks_reachable "$tenant_networks_reachable"
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
@@ -468,7 +468,7 @@ function configure_tempest {
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
+        # Remove disabled extensions
         volume_api_extensions=$(remove_disabled_extensions $volume_api_extensions $DISABLE_VOLUME_API_EXTENSIONS)
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions $volume_api_extensions

From 2bb3a648929550ae9ff237185be43d864e1e0225 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Tue, 18 Aug 2015 12:59:08 -0700
Subject: [PATCH 0815/3333] Fix duplicated section name

Although l3_agent.ini, dhcp_agent.ini and metadata_agent.ini have
"AGENT" section as default, devstack added "agent" section.

Change-Id: Ie4034257d8aed00d67e3f28e7dd3b05cc5d89fc4
---
 lib/neutron-legacy | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7dddde15fd..a6743c31fa 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -960,9 +960,9 @@ function _configure_neutron_debug_command {
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper "$Q_RR_COMMAND"
+    iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     _neutron_setup_interface_driver $NEUTRON_TEST_CONFIG_FILE
@@ -977,9 +977,9 @@ function _configure_neutron_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_DHCP_CONF_FILE agent root_helper "$Q_RR_COMMAND"
+    iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_DHCP_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     if ! is_service_enabled q-l3; then
@@ -1012,9 +1012,9 @@ function _configure_neutron_l3_agent {
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_L3_CONF_FILE agent root_helper "$Q_RR_COMMAND"
+    iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
@@ -1036,9 +1036,9 @@ function _configure_neutron_metadata_agent {
     iniset $Q_META_CONF_FILE DEFAULT verbose True
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
-    iniset $Q_META_CONF_FILE agent root_helper "$Q_RR_COMMAND"
+    iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_META_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     # Configures keystone for metadata_agent

From 0612b485d3646e40ea0f70dfaadd7705a2b10c71 Mon Sep 17 00:00:00 2001
From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Date: Tue, 18 Aug 2015 18:51:24 -0400
Subject: [PATCH 0816/3333] Ironic: Fix tag ID detection of tap devices

On Linux kernel 4.1, `ip link` reports peer interface name for
each Open vSwitch interface, like:
  $ ip link
  ...
  71: ovs-tap1@brbm-tap1: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
              ~~~~~~~~~~
Currently it is regarded as a part of interface name, so
causes failure in tap id detection from ovs-vsctl output,
that results into ironic deployment failure.
This patch removes the peer name from the interface name.

Change-Id: Id3b181fa821e9bff1afabef4d63964f61fa49a65
Closes-Bug: #1486273
---
 lib/ironic | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index b3ad586923..d9c3396944 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -505,9 +505,9 @@ function create_ovs_taps {
     sleep 10
 
     if  [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-        local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -b2-)
+        local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
     else
-        local tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -b2-)
+        local tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
     fi
     local tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
 

From 2d91fe8a6ba466c57bae9c7f16ece1d1cc6d7563 Mon Sep 17 00:00:00 2001
From: Shashank Hegde <hegde.shashank@gmail.com>
Date: Tue, 18 Aug 2015 18:33:55 -0700
Subject: [PATCH 0817/3333] Cloning requirements repository before pip install

The commit 05aa3846a0402edc9cc49f4ba36f09592004b273 into devstack exposed a bug
where pip_install is called before the requirements repository is cloned. This
change ensures that the requirements repository exists before pip_install is
called.

Change-Id: I60b157fc98691764a69cf022852e7a95fc50cdd7
Closes-Bug: #1486304
---
 stack.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 341df7fc92..639f72b1bc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -683,6 +683,11 @@ save_stackenv $LINENO
 
 # OpenStack uses a fair number of other projects.
 
+# Bring down global requirements before any use of pip_install. This is
+# necessary to ensure that the constraints file is in place before we
+# attempt to apply any constraints to pip installs.
+git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
+
 # Install package requirements
 # Source it so the entire environment is available
 echo_summary "Installing package prerequisites"
@@ -695,11 +700,6 @@ fi
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
-# Bring down global requirements before any use of pip_install. This is
-# necessary to ensure that the constraints file is in place before we
-# attempt to apply any constraints to pip installs.
-git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
-
 # Install Python packages into a virtualenv so that we can track them
 if [[ $TRACK_DEPENDS = True ]]; then
     echo_summary "Installing Python packages into a virtualenv $DEST/.venv"

From 67168e807adfaff996bf2767601fde0d8cb16c02 Mon Sep 17 00:00:00 2001
From: Mahito <m.ogura@ntt.com>
Date: Tue, 18 Aug 2015 23:59:29 -0700
Subject: [PATCH 0818/3333] Add "source $TOP_DIR/lib/lvm" to clean.sh

When clean.sh is executed, it shows "command not found" messages.
Commands are defined in lib/lvm, however lib/lvm doesn't include clean.sh.
This pache add lib/lvm to clean.sh.

Change-Id: I56672e949d25f7cdcda879badd992f849d06c749
Closes-Bug: 1486392
---
 clean.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/clean.sh b/clean.sh
index 74bcaee924..78e2a7a826 100755
--- a/clean.sh
+++ b/clean.sh
@@ -41,6 +41,7 @@ source $TOP_DIR/lib/rpc_backend
 source $TOP_DIR/lib/tls
 
 source $TOP_DIR/lib/oslo
+source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance

From d6456e67589a78f50f71e93fd789c1423513ab60 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 19 Aug 2015 10:33:23 -0400
Subject: [PATCH 0819/3333] Ability to specify keystone v3 in nova.conf for
 neutron

As part of moving components to use keystone v3, this review
allows nova.conf's [neutron] section to switch to using the
auth_plugin in keystoneclient for talking to keystone /v3 API

Change-Id: I42502bff147534199096fb581630b8559f311963
---
 lib/neutron-legacy | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9206fe1754..c4d2dd5f7e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -471,11 +471,21 @@ function configure_neutron {
 
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
-    iniset $NOVA_CONF neutron admin_username "$Q_ADMIN_USERNAME"
-    iniset $NOVA_CONF neutron admin_password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron admin_auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
+
+
+    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
+        iniset $NOVA_CONF neutron auth_plugin "v3password"
+        iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+        iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
+        iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
+        iniset $NOVA_CONF neutron user_domain_name "default"
+    else
+        iniset $NOVA_CONF neutron admin_username "$Q_ADMIN_USERNAME"
+        iniset $NOVA_CONF neutron admin_password "$SERVICE_PASSWORD"
+        iniset $NOVA_CONF neutron admin_auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
+        iniset $NOVA_CONF neutron admin_tenant_name "$SERVICE_TENANT_NAME"
+    fi
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
-    iniset $NOVA_CONF neutron admin_tenant_name "$SERVICE_TENANT_NAME"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
     iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
 

From b203d0c71aeb155ae194650004f3a10335801b0f Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Wed, 12 Aug 2015 11:58:11 -0400
Subject: [PATCH 0820/3333] do not redefine path in elasticsearch

in I0272d56bc2e50e8174db78bd449f65f60f7f4000, we reset DEST value
when installing elasticsearch. it gets set to /opt/stack/ which is
not always correct in gate causing the path to be wrong and
elasticseach cannot be installed. we should reuse DEST from stackrc

Change-Id: Ia3a2383ada30c4e92c37386aedd6164c69cac60a
Closes-Bug: #1484182
---
 pkg/elasticsearch.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 79f67a0179..14d13cf733 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -6,9 +6,7 @@
 # step can probably be factored out to something nicer
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 FILES=$TOP_DIR/files
-source $TOP_DIR/functions
-DEST=${DEST:-/opt/stack}
-source $TOP_DIR/lib/infra
+source $TOP_DIR/stackrc
 
 # Package source and version, all pkg files are expected to have
 # something like this, as well as a way to override them.

From 9b21f98ce0aa5093e477bab68aede5af0fb8d9ad Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Thu, 20 Aug 2015 23:37:04 +0300
Subject: [PATCH 0821/3333] Add region definition to swift3

Swift3 should be in the same region as all other cloud.
By default it has regaion name 'US'. It's ok for requests
that signed by version 1 of signature because they haven't
region information in request.
But S3 signature of version 4 protocol sends region name to server
and swift3 plugin checks that input region equals to internal.
And because all cloud lives with 'RegionOne' then swift3 fails
request because it has 'US' region name by default.

Change-Id: Icd817183b1a040110372a8ae5d73fd2f0ec5559c
Related-Bug: #1411078
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index dac121be0c..233a493acb 100644
--- a/lib/swift
+++ b/lib/swift
@@ -455,6 +455,7 @@ admin_password = ${SERVICE_PASSWORD}
 
 [filter:swift3]
 use = egg:swift3#swift3
+location = ${REGION_NAME}
 EOF
     fi
 

From dca06dc7dec148cac2d9e27cdb20d7d26bb0a941 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 20 Aug 2015 13:56:57 -0700
Subject: [PATCH 0822/3333] Enable nbd if you're running an lxc virt_type
 without an lvm backend

If nbd isn't enabled you can't boot instances with libvirt using lxc
(unless you're using an lvm backend).

Closes-Bug: #1487195

Co-Authored-By: Andrew Melton <andrew.melton@rackspace.com>

Change-Id: I08c4d498ed35166f566291d9530ca1ecfae05625
---
 lib/nova | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6441a891eb..087cac6016 100644
--- a/lib/nova
+++ b/lib/nova
@@ -354,6 +354,12 @@ function configure_nova {
                             sudo mount /cgroup
                         fi
                     fi
+
+                    # enable nbd for lxc unless you're using an lvm backend
+                    # otherwise you can't boot instances
+                    if [[ "$NOVA_BACKEND" != "LVM" ]]; then
+                        sudo modprobe nbd
+                    fi
                 fi
             fi
         fi

From 485c962667631e4f321ee2513729718305f4f372 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Mon, 24 Aug 2015 22:55:19 +0300
Subject: [PATCH 0823/3333] Fix create_userrc.sh script

Patchset fixes calculating EC2_URL/S3_URL for user rc files in 'accrc' directory.
Currently calculation of these url's uses 'openstack endpoint show' command
without specifying os-identity-v3 flag. But output is empty without such flag.
So this patchset uses same construction as exists in functions-common.

Change-Id: Ia4f2510750fa0f46e2f1d58cf0a7a16782f022b3
---
 tools/create_userrc.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index c2dbe1aeb4..de44abbbe5 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -158,12 +158,12 @@ fi
 
 export -n SERVICE_TOKEN SERVICE_ENDPOINT OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT
 
-EC2_URL=$(openstack endpoint show -f value -c publicurl ec2 || true)
+EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
 if [[ -z $EC2_URL ]]; then
     EC2_URL=http://localhost:8773/
 fi
 
-S3_URL=$(openstack endpoint show -f value -c publicurl s3 || true)
+S3_URL=$(openstack endpoint list --service s3 --interface public --os-identity-api-version=3 -c URL -f value || true)
 if [[ -z $S3_URL ]]; then
     S3_URL=http://localhost:3333
 fi

From 403fbb1d33a3bbb0901d1a696ef68a3fe099dd70 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 24 Aug 2015 21:17:37 -0400
Subject: [PATCH 0824/3333] Fix trueorfalse call in tempest use accounts check

The lib/tempest variable definition for TEMPEST_USE_TEST_ACCOUNTS was
incorrectly calling the trueorfalse function by passing the variable's
value to the function instead of the variable's name. This was causing
trueorfalse the default value of false to always be returned even when
specifying the option as true in the localrc. (well assuming True or
it's variants wasn't an actual defined variable with a value that
would return true) This commit fixes this issue by properly using the
trueorfalse function.

Change-Id: I8cefb58f49dcd2cb2def8a5071d0892af520e7f7
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index e7f825f417..fe63015c5d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -89,7 +89,7 @@ TEMPEST_HAS_ADMIN=$(trueorfalse True TEMPEST_HAS_ADMIN)
 
 # Credential provider configuration option variables
 TEMPEST_ALLOW_TENANT_ISOLATION=${TEMPEST_ALLOW_TENANT_ISOLATION:-$TEMPEST_HAS_ADMIN}
-TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False $TEMPEST_USE_TEST_ACCOUNTS)
+TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 
 # The number of workers tempest is expected to be run with. This is used for
 # generating a accounts.yaml for running with test-accounts. This is also the

From b274dbd7d04b643932fc583e2901353cfded45c3 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 25 Aug 2015 10:01:39 -0400
Subject: [PATCH 0825/3333] Fix syntax error on if else statement

This commit fixes an simple syntax error on an else statement causing
it to crash instead of eval. Clearly someone has been writing too much
python and not enough bash.

Change-Id: I81d2324abd17790dc4790147f210ad7d9f0db74b
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index fe63015c5d..be24da6b61 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -555,7 +555,7 @@ function configure_tempest {
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
             tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
-        else:
+        else
             tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth allow_tenant_isolation False

From 2ad1a42ca667ff21e6f7d2ae906be23a20430036 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Tue, 23 Jun 2015 10:53:50 -0500
Subject: [PATCH 0826/3333] Use keystone wsgi_scripts

Devstack was setting up a separate directory and copying
http/keystone.py into it for the admin and public endpoints.

Keystone now defines wsgi_scripts entrypoints so that
keystone-wsgi-admin and keystone-wsgi-public are created on
install so devstack can reference these files instead.

See http://httpd.apache.org/docs/2.4/upgrading.html#access for
the apache docs with examples for the Allow|Deny/Require
directives.

Depends-On: Ic9c03e6c00408f3698c10012ca98cfc6ea9b6ace
Change-Id: Ided688be62b64066d90776313c963ec5016363f2
---
 files/apache-keystone.template | 24 ++++++++++++++++++++++--
 lib/keystone                   | 15 +--------------
 2 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 6dd1ad9ea6..4d3d2d6623 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -5,7 +5,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 <VirtualHost *:%PUBLICPORT%>
     WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-public
-    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
     <IfVersion >= 2.4>
@@ -16,12 +16,22 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
+
+    <Directory %KEYSTONE_BIN%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
 </VirtualHost>
 
 <VirtualHost *:%ADMINPORT%>
     WSGIDaemonProcess keystone-admin processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-admin
-    WSGIScriptAlias / %ADMINWSGI%
+    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
     <IfVersion >= 2.4>
@@ -32,6 +42,16 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
+
+    <Directory %KEYSTONE_BIN%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
 </VirtualHost>
 
 Alias /identity %PUBLICWSGI%
diff --git a/lib/keystone b/lib/keystone
index e2448c9068..921dc766dd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -51,11 +51,6 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
-if is_suse; then
-    KEYSTONE_WSGI_DIR=${KEYSTONE_WSGI_DIR:-/srv/www/htdocs/keystone}
-else
-    KEYSTONE_WSGI_DIR=${KEYSTONE_WSGI_DIR:-/var/www/keystone}
-fi
 
 # Set up additional extensions, such as oauth1, federation
 # Example of KEYSTONE_EXTENSIONS=oauth1,federation
@@ -132,14 +127,11 @@ function cleanup_keystone {
 
 # _cleanup_keystone_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
 function _cleanup_keystone_apache_wsgi {
-    sudo rm -f $KEYSTONE_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for keystone)
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
 function _config_keystone_apache_wsgi {
-    sudo mkdir -p $KEYSTONE_WSGI_DIR
-
     local keystone_apache_conf=$(apache_site_config_for keystone)
     local keystone_ssl=""
     local keystone_certfile=""
@@ -161,22 +153,17 @@ function _config_keystone_apache_wsgi {
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
     fi
 
-    # copy proxy vhost and wsgi file
-    sudo cp $KEYSTONE_DIR/httpd/keystone.py $KEYSTONE_WSGI_DIR/main
-    sudo cp $KEYSTONE_DIR/httpd/keystone.py $KEYSTONE_WSGI_DIR/admin
-
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$keystone_service_port|g;
         s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$KEYSTONE_WSGI_DIR/main|g;
-        s|%ADMINWSGI%|$KEYSTONE_WSGI_DIR/admin|g;
         s|%SSLENGINE%|$keystone_ssl|g;
         s|%SSLCERTFILE%|$keystone_certfile|g;
         s|%SSLKEYFILE%|$keystone_keyfile|g;
         s|%USER%|$STACK_USER|g;
         s|%VIRTUALENV%|$venv_path|g
+        s|%KEYSTONE_BIN%|$KEYSTONE_BIN_DIR|g
     " -i $keystone_apache_conf
 }
 

From 091d1ff39d47bf9bebf564b11bbbe5edc984340b Mon Sep 17 00:00:00 2001
From: Henry Gessau <gessau@cisco.com>
Date: Sun, 5 Jul 2015 08:55:18 -0400
Subject: [PATCH 0827/3333] Neutron auto-discovers installed alembic_migrations

Neutron and its sub-projects have been made more intelligent about the
alembic migrations of installed sub-projects. Neutron will now
discover the installed migrations and run them automatically.

Partial-Bug: #1470625

Change-Id: Iec8993b02400ae306abf520e6e70d86bba042c8d
---
 lib/neutron-legacy | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index da8c06446c..35ca402087 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -609,16 +609,6 @@ function init_neutron {
     recreate_database $Q_DB_NAME
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-    for svc in fwaas lbaas vpnaas; do
-        if [ "$svc" = "vpnaas" ]; then
-            q_svc="q-vpn"
-        else
-            q_svc="q-$svc"
-        fi
-        if is_service_enabled $q_svc; then
-            $NEUTRON_BIN_DIR/neutron-db-manage --service $svc --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-        fi
-    done
 }
 
 # install_neutron() - Collect source and prepare

From 925c256cd45bd845c8dd03827ae9c26f43ad5481 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 25 Aug 2015 13:40:25 -0700
Subject: [PATCH 0828/3333] Remove NOVA_VIF_DRIVER variable

Commit 7561c8ded211d53e8745d1420a73b82bd0fc35cf removed the
libvirt.vif_driver option from Nova in Juno so we should remove the
variable from devstack since it's useless / confusing.

Change-Id: I70a8cb4a3606eb5eabd3c0ef331945e72c80543a
---
 lib/neutron-legacy                 | 5 +----
 lib/neutron_plugins/README.md      | 4 +---
 lib/neutron_plugins/brocade        | 2 +-
 lib/neutron_plugins/ibm            | 1 -
 lib/neutron_plugins/nuage          | 1 -
 lib/neutron_plugins/oneconvergence | 1 -
 6 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index da8c06446c..f381f6ebec 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -158,8 +158,6 @@ Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_USE_DEBUG_COMMAND=${Q_USE_DEBUG_COMMAND:-False}
 # The name of the default q-l3 router
 Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
-# nova vif driver that all plugins should use
-NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
@@ -485,10 +483,9 @@ function create_nova_conf_neutron {
         iniset $NOVA_CONF DEFAULT security_group_api neutron
     fi
 
-    # set NOVA_VIF_DRIVER and optionally set options in nova_conf
+    # optionally set options in nova_conf
     neutron_plugin_create_nova_conf
 
-    iniset $NOVA_CONF libvirt vif_driver "$NOVA_VIF_DRIVER"
     iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
     if is_service_enabled q-meta; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
diff --git a/lib/neutron_plugins/README.md b/lib/neutron_plugins/README.md
index 4b220d3377..f03000e7cb 100644
--- a/lib/neutron_plugins/README.md
+++ b/lib/neutron_plugins/README.md
@@ -16,9 +16,7 @@ functions
 ``lib/neutron-legacy`` calls the following functions when the ``$Q_PLUGIN`` is enabled
 
 * ``neutron_plugin_create_nova_conf`` :
-  set ``NOVA_VIF_DRIVER`` and optionally set options in nova_conf
-  e.g.
-  NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
+  optionally set options in nova_conf
 * ``neutron_plugin_install_agent_packages`` :
   install packages that is specific to plugin agent
   e.g.
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index b8166d9af9..557b94dec0 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -12,7 +12,7 @@ function is_neutron_ovs_base_plugin {
 }
 
 function neutron_plugin_create_nova_conf {
-    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
+    :
 }
 
 function neutron_plugin_install_agent_packages {
diff --git a/lib/neutron_plugins/ibm b/lib/neutron_plugins/ibm
index 3660a9f2b9..dd5cfa6694 100644
--- a/lib/neutron_plugins/ibm
+++ b/lib/neutron_plugins/ibm
@@ -42,7 +42,6 @@ function neutron_setup_integration_bridge {
 }
 
 function neutron_plugin_create_nova_conf {
-    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
     # if n-cpu is enabled, then setup integration bridge
     if is_service_enabled n-cpu; then
         neutron_setup_integration_bridge
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 7bce233853..9e5307ba53 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -10,7 +10,6 @@ set +o xtrace
 function neutron_plugin_create_nova_conf {
     NOVA_OVS_BRIDGE=${NOVA_OVS_BRIDGE:-"br-int"}
     iniset $NOVA_CONF neutron ovs_bridge $NOVA_OVS_BRIDGE
-    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
     LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 }
diff --git a/lib/neutron_plugins/oneconvergence b/lib/neutron_plugins/oneconvergence
index 48a368a967..0c570e534b 100644
--- a/lib/neutron_plugins/oneconvergence
+++ b/lib/neutron_plugins/oneconvergence
@@ -68,7 +68,6 @@ function neutron_plugin_configure_plugin_agent {
 }
 
 function neutron_plugin_create_nova_conf {
-    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtGenericVIFDriver"}
     if ( is_service_enabled n-cpu && ! ( is_service_enabled q-dhcp )) ; then
         setup_integration_bridge
     fi

From d20435bdd4fb5ea856497c797376517ed516d833 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 25 Aug 2015 19:24:51 -0400
Subject: [PATCH 0829/3333] Filter out temporary addresses

Some IPv6 addresses are temporary and are generated by IPv6 privacy
extensions. They eventually expire and are regenerated, so we should
filter them out.

Change-Id: I916d6a335bab096f765ae8c7e0e540a4349dd15f
Closes-Bug: #1488691
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index f6a525354f..446de5374f 100644
--- a/functions-common
+++ b/functions-common
@@ -591,7 +591,7 @@ function get_default_host_ip {
         host_ip=""
         # Find the interface used for the default route
         host_ip_iface=${host_ip_iface:-$(ip -f $af route | awk '/default/ {print $5}' | head -1)}
-        local host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | awk /$af'/ {split($2,parts,"/");  print parts[1]}')
+        local host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | sed /temporary/d |awk /$af'/ {split($2,parts,"/");  print parts[1]}')
         local ip
         for ip in $host_ips; do
             # Attempt to filter out IP addresses that are part of the fixed and

From 346edcc532719f6f29471920f9434b6d5300d43a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 26 Aug 2015 09:38:37 -0400
Subject: [PATCH 0830/3333] check all possible services when configuring
 tempest

The previous approach assumed that devstack in tree service support
would always be a super set of tempest. That's not necessarily
true. Instead when configuring tempest we should look at all the
possible services that tempest could know about, which will let us
disable services we don't have support for.

Change-Id: I9c24705e494689f09a885eb0a640efd50db33fcf
---
 lib/ceilometer     | 3 ---
 lib/cinder         | 3 ---
 lib/glance         | 3 ---
 lib/heat           | 4 ----
 lib/horizon        | 4 ----
 lib/ironic         | 3 ---
 lib/neutron-legacy | 4 ----
 lib/nova           | 4 ----
 lib/swift          | 4 ----
 lib/tempest        | 5 +++++
 lib/zaqar          | 4 ----
 stackrc            | 6 ------
 12 files changed, 5 insertions(+), 42 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index 3df75b7300..d1cc862160 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -102,9 +102,6 @@ CEILOMETER_EVENTS=${CEILOMETER_EVENTS:-True}
 CEILOMETER_COORDINATION_URL=${CEILOMETER_COORDINATION_URL:-}
 CEILOMETER_PIPELINE_INTERVAL=${CEILOMETER_PIPELINE_INTERVAL:-}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,ceilometer
-
 
 # Functions
 # ---------
diff --git a/lib/cinder b/lib/cinder
index e5ed2db1a3..26277ccaba 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -108,9 +108,6 @@ CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
 CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,cinder
-
 
 # Source the enabled backends
 if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
diff --git a/lib/glance b/lib/glance
index b1b0f32f62..7be3a8495c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -75,9 +75,6 @@ GLANCE_SEARCH_PORT=${GLANCE_SEARCH_PORT:-9393}
 GLANCE_SEARCH_PORT_INT=${GLANCE_SEARCH_PORT_INT:-19393}
 GLANCE_SEARCH_HOSTPORT=${GLANCE_SEARCH_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SEARCH_PORT}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,glance
-
 # Functions
 # ---------
 
diff --git a/lib/heat b/lib/heat
index cedddd2d26..3489578162 100644
--- a/lib/heat
+++ b/lib/heat
@@ -64,10 +64,6 @@ else
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
 fi
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,heat
-
-
 # Functions
 # ---------
 
diff --git a/lib/horizon b/lib/horizon
index 9fe0aa8b49..b2539d1b7d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -35,10 +35,6 @@ HORIZON_DIR=$DEST/horizon
 # The example file in Horizon repo is used by default.
 HORIZON_SETTINGS=${HORIZON_SETTINGS:-$HORIZON_DIR/openstack_dashboard/local/local_settings.py.example}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,horizon
-
-
 # Functions
 # ---------
 
diff --git a/lib/ironic b/lib/ironic
index b3ad586923..cc1dfe31d9 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -114,9 +114,6 @@ IRONIC_SERVICE_PROTOCOL=http
 IRONIC_SERVICE_PORT=${IRONIC_SERVICE_PORT:-6385}
 IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST:$IRONIC_SERVICE_PORT}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,ironic
-
 # Enable iPXE
 IRONIC_IPXE_ENABLED=$(trueorfalse False IRONIC_IPXE_ENABLED)
 IRONIC_HTTP_DIR=${IRONIC_HTTP_DIR:-$IRONIC_DATA_DIR/httpboot}
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index da8c06446c..9fb668ef81 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -358,10 +358,6 @@ else
     Q_USE_SECGROUP=False
 fi
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,neutron
-
-
 # Save trace setting
 XTRACE=$(set +o | grep xtrace)
 set +o xtrace
diff --git a/lib/nova b/lib/nova
index 6441a891eb..d4be019ae3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -167,10 +167,6 @@ NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
 TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
 TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,nova
-
-
 # Functions
 # ---------
 
diff --git a/lib/swift b/lib/swift
index fc736a60bc..b119d2fd35 100644
--- a/lib/swift
+++ b/lib/swift
@@ -141,10 +141,6 @@ SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY:-}
 # Toggle for deploying Swift under HTTPD + mod_wsgi
 SWIFT_USE_MOD_WSGI=${SWIFT_USE_MOD_WSGI:-False}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,swift
-
-
 # Functions
 # ---------
 
diff --git a/lib/tempest b/lib/tempest
index fe63015c5d..323a90a4cd 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -536,6 +536,11 @@ function configure_tempest {
     fi
 
     # ``service_available``
+    #
+    # this tempest service list needs to be all the services that
+    # tempest supports, otherwise we can have an erroneous set of
+    # defaults (something defaulting true in Tempest, but not listed here).
+    TEMPEST_SERVICES="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove,zaqar"
     for service in ${TEMPEST_SERVICES//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"
diff --git a/lib/zaqar b/lib/zaqar
index fdab3a26a8..aa21aac271 100644
--- a/lib/zaqar
+++ b/lib/zaqar
@@ -59,10 +59,6 @@ ZAQAR_SERVICE_HOST=${ZAQAR_SERVICE_HOST:-$SERVICE_HOST}
 ZAQAR_SERVICE_PORT=${ZAQAR_SERVICE_PORT:-8888}
 ZAQAR_SERVICE_PROTOCOL=${ZAQAR_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
-# Tell Tempest this project is present
-TEMPEST_SERVICES+=,zaqar
-
-
 # Functions
 # ---------
 
diff --git a/stackrc b/stackrc
index 156cb1f85a..67b6424aab 100644
--- a/stackrc
+++ b/stackrc
@@ -78,12 +78,6 @@ fi
 # services will rely on the local toggle variable (e.g. ``KEYSTONE_USE_MOD_WSGI``)
 ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 
-# Tell Tempest which services are available.  The default is set here as
-# Tempest falls late in the configuration sequence.  This differs from
-# ``ENABLED_SERVICES`` in that the project names are used here rather than
-# the service names, i.e.: ``TEMPEST_SERVICES="key,glance,nova"``
-TEMPEST_SERVICES=""
-
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=ec2,osapi_compute,metadata
 

From 869b72b8512d73d24b42e0fa5c39b8dc0d7b28f7 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Thu, 13 Aug 2015 13:36:23 +0200
Subject: [PATCH 0831/3333] Support installing ironic-lib

ironic-lib will soon become a dependency of ironic, make sure we can
write dsvm gates against it.

Change-Id: I6e66ae770cf5065980848e7e987bfd75765a5ac6
---
 lib/ironic                   | 7 +++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index b3ad586923..6fb5184af9 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -31,6 +31,7 @@ set +o pipefail
 
 # Set up default directories
 GITDIR["python-ironicclient"]=$DEST/python-ironicclient
+GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 IRONIC_DIR=$DEST/ironic
 IRONIC_PYTHON_AGENT_DIR=$DEST/ironic-python-agent
@@ -191,6 +192,12 @@ function install_ironic {
             die $LINENO "$srv should be enabled for Ironic."
         fi
     done
+
+    if use_library_from_git "ironic-lib"; then
+        git_clone_by_name "ironic-lib"
+        setup_dev_lib "ironic-lib"
+    fi
+
     git_clone $IRONIC_REPO $IRONIC_DIR $IRONIC_BRANCH
     setup_develop $IRONIC_DIR
 
diff --git a/stackrc b/stackrc
index 156cb1f85a..760e2fc745 100644
--- a/stackrc
+++ b/stackrc
@@ -455,6 +455,10 @@ GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 
+# ironic common lib
+GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
+GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
+
 
 ##################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index d10cd0ee62..cf6ec1cbff 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -41,7 +41,7 @@ ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
-ALL_LIBS+=" keystoneauth"
+ALL_LIBS+=" keystoneauth ironic-lib"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 7d5be299206e801d39e0e07eec54dfc5948a15a5 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 10 Aug 2015 13:39:17 +1000
Subject: [PATCH 0832/3333] Move configuration notes into configuration guide

We have configuration information split between the README.md and
configuration documentation.  A lot of it is duplicated and it shows
little organisation.

This clears the README.md of detailed configuration options and
consolidates it into the existing configuration guide.  When someone
first hits the README they don't need details on changing the RPC
back-end; but more importantly this indicates clearly where we should
be adding or clarifying details.

Firstly, the detailed overview of local.conf is removed; it was
duplicated in the configuration guide.  This is left as a first-level
section of that guide.

The configuration notes are divided into generic devstack things
(logging, database-backend, etc) and then the rest of the notes on
various projects' configuration options have been moved into a
dedicated sub-section "Projects".

Each project gets its own sub-sub-section.  Duplicated swift guides is
consolidated into the single "Swift section". The neutron and
multi-node nodes, which were all duplicated in their more specific
dedicated guides are removed and replaced with links to those.  Other
sections are moved directly.

Change-Id: Ib0bac56d82be870fe99c47c53fda674d8668b968
---
 README.md                    | 345 +---------------------------------
 doc/source/configuration.rst | 351 +++++++++++++++++++++++++----------
 2 files changed, 255 insertions(+), 441 deletions(-)

diff --git a/README.md b/README.md
index acc3e5a747..df0df917a4 100644
--- a/README.md
+++ b/README.md
@@ -93,345 +93,14 @@ for example).
 
 # Customizing
 
-You can override environment variables used in `stack.sh` by creating file
-name `local.conf` with a ``localrc`` section as shown below.  It is likely
-that you will need to do this to tweak your networking configuration should
-you need to access your cloud from a different host.
+You can override environment variables used in `stack.sh` by creating
+file name `local.conf` with a ``localrc`` section as shown below.  It
+is likely that you will need to do this to tweak several settings for
+your environment.
 
     [[local|localrc]]
     VARIABLE=value
 
-See the **Local Configuration** section below for more details.
-
-# Database Backend
-
-Multiple database backends are available. The available databases are defined
-in the lib/databases directory.
-`mysql` is the default database, choose a different one by putting the
-following in the `localrc` section:
-
-    disable_service mysql
-    enable_service postgresql
-
-`mysql` is the default database.
-
-# RPC Backend
-
-Support for a RabbitMQ RPC backend is included. Additional RPC backends may
-be available via external plugins.  Enabling or disabling RabbitMQ is handled
-via the usual service functions and ``ENABLED_SERVICES``.
-
-Example disabling RabbitMQ in ``local.conf``:
-
-    disable_service rabbit
-
-# Apache Frontend
-
-Apache web server can be enabled for wsgi services that support being deployed
-under HTTPD + mod_wsgi. By default, services that recommend running under
-HTTPD + mod_wsgi are deployed under Apache. To use an alternative deployment
-strategy (e.g. eventlet) for services that support an alternative to HTTPD +
-mod_wsgi set ``ENABLE_HTTPD_MOD_WSGI_SERVICES`` to ``False`` in your
-``local.conf``.
-
-Each service that can be run under HTTPD + mod_wsgi also has an override
-toggle available that can be set in your ``local.conf``.
-
-Keystone is run under HTTPD + mod_wsgi by default.
-
-Example (Keystone):
-
-    KEYSTONE_USE_MOD_WSGI="True"
-
-Example (Nova):
-
-    NOVA_USE_MOD_WSGI="True"
-
-Example (Swift):
-
-    SWIFT_USE_MOD_WSGI="True"
-
-# Swift
-
-Swift is disabled by default.  When enabled, it is configured with
-only one replica to avoid being IO/memory intensive on a small
-vm. When running with only one replica the account, container and
-object services will run directly in screen. The others services like
-replicator, updaters or auditor runs in background.
-
-If you would like to enable Swift you can add this to your `localrc` section:
-
-    enable_service s-proxy s-object s-container s-account
-
-If you want a minimal Swift install with only Swift and Keystone you
-can have this instead in your `localrc` section:
-
-    disable_all_services
-    enable_service key mysql s-proxy s-object s-container s-account
-
-If you only want to do some testing of a real normal swift cluster
-with multiple replicas you can do so by customizing the variable
-`SWIFT_REPLICAS` in your `localrc` section (usually to 3).
-
-# Swift S3
-
-If you are enabling `swift3` in `ENABLED_SERVICES` DevStack will
-install the swift3 middleware emulation. Swift will be configured to
-act as a S3 endpoint for Keystone so effectively replacing the
-`nova-objectstore`.
-
-Only Swift proxy server is launched in the screen session all other
-services are started in background and managed by `swift-init` tool.
-
-# Neutron
-
-Basic Setup
-
-In order to enable Neutron in a single node setup, you'll need the
-following settings in your `local.conf`:
-
-    disable_service n-net
-    enable_service q-svc
-    enable_service q-agt
-    enable_service q-dhcp
-    enable_service q-l3
-    enable_service q-meta
-    enable_service q-metering
-
-Then run `stack.sh` as normal.
-
-DevStack supports setting specific Neutron configuration flags to the
-service, ML2 plugin, DHCP and L3 configuration files:
-
-    [[post-config|/$Q_PLUGIN_CONF_FILE]]
-    [ml2]
-    mechanism_drivers=openvswitch,l2population
-
-    [[post-config|$NEUTRON_CONF]]
-    [DEFAULT]
-    quota_port=42
-
-    [[post-config|$Q_L3_CONF_FILE]]
-    [DEFAULT]
-    agent_mode=legacy
-
-    [[post-config|$Q_DHCP_CONF_FILE]]
-    [DEFAULT]
-    dnsmasq_dns_servers = 8.8.8.8,8.8.4.4
-
-The ML2 plugin can run with the OVS, LinuxBridge, or Hyper-V agents on compute
-hosts. This is a simple way to configure the ml2 plugin:
-
-    # VLAN configuration
-    ENABLE_TENANT_VLANS=True
-
-    # GRE tunnel configuration
-    ENABLE_TENANT_TUNNELS=True
-
-    # VXLAN tunnel configuration
-    Q_ML2_TENANT_NETWORK_TYPE=vxlan
-
-The above will default in DevStack to using the OVS on each compute host.
-To change this, set the `Q_AGENT` variable to the agent you want to run
-(e.g. linuxbridge).
-
-    Variable Name                    Notes
-    ----------------------------------------------------------------------------
-    Q_AGENT                          This specifies which agent to run with the
-                                     ML2 Plugin (Typically either `openvswitch`
-                                     or `linuxbridge`).
-                                     Defaults to `openvswitch`.
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS   The ML2 MechanismDrivers to load. The default
-                                     is `openvswitch,linuxbridge`.
-    Q_ML2_PLUGIN_TYPE_DRIVERS        The ML2 TypeDrivers to load. Defaults to
-                                     all available TypeDrivers.
-    Q_ML2_PLUGIN_GRE_TYPE_OPTIONS    GRE TypeDriver options. Defaults to
-                                     `tunnel_id_ranges=1:1000'.
-    Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS  VXLAN TypeDriver options. Defaults to
-                                     `vni_ranges=1001:2000`
-    Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS   VLAN TypeDriver options. Defaults to none.
-
-# Heat
-
-Heat is disabled by default (see `stackrc` file). To enable it explicitly
-you'll need the following settings in your `localrc` section:
-
-    enable_service heat h-api h-api-cfn h-api-cw h-eng
-
-Heat can also run in standalone mode, and be configured to orchestrate
-on an external OpenStack cloud. To launch only Heat in standalone mode
-you'll need the following settings in your `localrc` section:
-
-    disable_all_services
-    enable_service rabbit mysql heat h-api h-api-cfn h-api-cw h-eng
-    HEAT_STANDALONE=True
-    KEYSTONE_SERVICE_HOST=...
-    KEYSTONE_AUTH_HOST=...
-
-# Tempest
-
-If tempest has been successfully configured, a basic set of smoke
-tests can be run as follows:
-
-    $ cd /opt/stack/tempest
-    $ tox -efull  tempest.scenario.test_network_basic_ops
-
-By default tempest is downloaded and the config file is generated, but the
-tempest package is not installed in the system's global site-packages (the
-package install includes installing dependences). So tempest won't run
-outside of tox. If you would like to install it add the following to your
-``localrc`` section:
-
-    INSTALL_TEMPEST=True
-
-# DevStack on Xenserver
-
-If you would like to use Xenserver as the hypervisor, please refer
-to the instructions in `./tools/xen/README.md`.
-
-# Additional Projects
-
-DevStack has a hook mechanism to call out to a dispatch script at specific
-points in the execution of `stack.sh`, `unstack.sh` and `clean.sh`.  This
-allows upper-layer projects, especially those that the lower layer projects
-have no dependency on, to be added to DevStack without modifying the core
-scripts.  Tempest is built this way as an example of how to structure the
-dispatch script, see `extras.d/80-tempest.sh`.  See `extras.d/README.md`
-for more information.
-
-# Multi-Node Setup
-
-A more interesting setup involves running multiple compute nodes, with Neutron
-networks connecting VMs on different compute nodes.
-You should run at least one "controller node", which should have a `stackrc`
-that includes at least:
-
-    disable_service n-net
-    enable_service q-svc
-    enable_service q-agt
-    enable_service q-dhcp
-    enable_service q-l3
-    enable_service q-meta
-    enable_service neutron
-
-You likely want to change your `localrc` section to run a scheduler that
-will balance VMs across hosts:
-
-    SCHEDULER=nova.scheduler.filter_scheduler.FilterScheduler
-
-You can then run many compute nodes, each of which should have a `stackrc`
-which includes the following, with the IP address of the above controller node:
-
-    ENABLED_SERVICES=n-cpu,rabbit,neutron,q-agt
-    SERVICE_HOST=[IP of controller node]
-    MYSQL_HOST=$SERVICE_HOST
-    RABBIT_HOST=$SERVICE_HOST
-    Q_HOST=$SERVICE_HOST
-    MATCHMAKER_REDIS_HOST=$SERVICE_HOST
-
-# Multi-Region Setup
-
-We want to setup two devstack (RegionOne and RegionTwo) with shared keystone
-(same users and services) and horizon.
-Keystone and Horizon will be located in RegionOne.
-Full spec is available at:
-https://wiki.openstack.org/wiki/Heat/Blueprints/Multi_Region_Support_for_Heat.
-
-In RegionOne:
-
-    REGION_NAME=RegionOne
-
-In RegionTwo:
-
-    disable_service horizon
-    KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
-    KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
-    REGION_NAME=RegionTwo
-
-# Cells
-
-Cells is a new scaling option with a full spec at:
-http://wiki.openstack.org/blueprint-nova-compute-cells.
-
-To setup a cells environment add the following to your `localrc` section:
-
-    enable_service n-cell
-
-Be aware that there are some features currently missing in cells, one notable
-one being security groups.  The exercises have been patched to disable
-functionality not supported by cells.
-
-# IPv6
-
-By default, most Openstack services are bound to 0.0.0.0
-and service endpoints are registered as IPv4 addresses.
-A new variable was created to control this behavior, and to
-allow for operation over IPv6 instead of IPv4.
-
-For this, add the following to `local.conf`:
-
-    SERVICE_IP_VERSION=6
-
-When set to "6" devstack services will open listen sockets on ::
-and service endpoints will be registered using HOST_IPV6 as the
-address.  The default value for this setting is `4`.  Dual-mode
-support, for example `4+6` is not currently supported.
-
-
-# Local Configuration
-
-Historically DevStack has used ``localrc`` to contain all local configuration
-and customizations. More and more of the configuration variables available for
-DevStack are passed-through to the individual project configuration files.
-The old mechanism for this required specific code for each file and did not
-scale well.  This is handled now by a master local configuration file.
-
-# local.conf
-
-The new config file ``local.conf`` is an extended-INI format that introduces
-a new meta-section header that provides some additional information such
-as a phase name and destination config filename:
-
-    [[ <phase> | <config-file-name> ]]
-
-where ``<phase>`` is one of a set of phase names defined by ``stack.sh``
-and ``<config-file-name>`` is the configuration filename.  The filename is
-eval'ed in the ``stack.sh`` context so all environment variables are
-available and may be used.  Using the project config file variables in
-the header is strongly suggested (see the ``NOVA_CONF`` example below).
-If the path of the config file does not exist it is skipped.
-
-The defined phases are:
-
-* **local** - extracts ``localrc`` from ``local.conf`` before ``stackrc`` is sourced
-* **post-config** - runs after the layer 2 services are configured
-                    and before they are started
-* **extra** - runs after services are started and before any files
-              in ``extra.d`` are executed
-* **post-extra** - runs after files in ``extra.d`` are executed
-
-The file is processed strictly in sequence; meta-sections may be specified more
-than once but if any settings are duplicated the last to appear in the file
-will be used.
-
-    [[post-config|$NOVA_CONF]]
-    [DEFAULT]
-    use_syslog = True
-
-    [osapi_v3]
-    enabled = False
-
-A specific meta-section ``local|localrc`` is used to provide a default
-``localrc`` file (actually ``.localrc.auto``).  This allows all custom
-settings for DevStack to be contained in a single file.  If ``localrc``
-exists it will be used instead to preserve backward-compatibility.
-
-    [[local|localrc]]
-    FIXED_RANGE=10.254.1.0/24
-    ADMIN_PASSWORD=speciale
-    LOGFILE=$DEST/logs/stack.sh.log
-
-Note that ``Q_PLUGIN_CONF_FILE`` is unique in that it is assumed to *NOT*
-start with a ``/`` (slash) character.  A slash will need to be added:
-
-    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+Start by reading the [configuration
+guide](doc/source/configuration.rst) for details of the many available
+options.
\ No newline at end of file
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 90b7d44dec..ed17924d45 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -148,6 +148,34 @@ will not be set if there is no IPv6 address on the default Ethernet interface.
 Setting it here also makes it available for ``openrc`` to set ``OS_AUTH_URL``.
 ``HOST_IPV6`` is not set by default.
 
+Examples
+========
+
+-  Eliminate a Cinder pass-through (``CINDER_PERIODIC_INTERVAL``):
+
+   ::
+
+       [[post-config|$CINDER_CONF]]
+       [DEFAULT]
+       periodic_interval = 60
+
+-  Sample ``local.conf`` with screen logging enabled:
+
+   ::
+
+       [[local|localrc]]
+       FIXED_RANGE=10.254.1.0/24
+       NETWORK_GATEWAY=10.254.1.1
+       LOGDAYS=1
+       LOGDIR=$DEST/logs
+       LOGFILE=$LOGDIR/stack.sh.log
+       ADMIN_PASSWORD=quiet
+       DATABASE_PASSWORD=$ADMIN_PASSWORD
+       RABBIT_PASSWORD=$ADMIN_PASSWORD
+       SERVICE_PASSWORD=$ADMIN_PASSWORD
+       SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
+
+
 Configuration Notes
 ===================
 
@@ -228,6 +256,72 @@ to direct the message stream to the log host.  |
         SYSLOG_HOST=$HOST_IP
         SYSLOG_PORT=516
 
+
+Database Backend
+----------------
+
+Multiple database backends are available. The available databases are defined
+in the lib/databases directory.
+`mysql` is the default database, choose a different one by putting the
+following in the `localrc` section:
+
+   ::
+
+      disable_service mysql
+      enable_service postgresql
+
+`mysql` is the default database.
+
+RPC Backend
+-----------
+
+Support for a RabbitMQ RPC backend is included. Additional RPC
+backends may be available via external plugins.  Enabling or disabling
+RabbitMQ is handled via the usual service functions and
+``ENABLED_SERVICES``.
+
+Example disabling RabbitMQ in ``local.conf``:
+
+::
+    disable_service rabbit
+
+
+Apache Frontend
+---------------
+
+The Apache web server can be enabled for wsgi services that support
+being deployed under HTTPD + mod_wsgi. By default, services that
+recommend running under HTTPD + mod_wsgi are deployed under Apache. To
+use an alternative deployment strategy (e.g. eventlet) for services
+that support an alternative to HTTPD + mod_wsgi set
+``ENABLE_HTTPD_MOD_WSGI_SERVICES`` to ``False`` in your
+``local.conf``.
+
+Each service that can be run under HTTPD + mod_wsgi also has an
+override toggle available that can be set in your ``local.conf``.
+
+Keystone is run under Apache with ``mod_wsgi`` by default.
+
+Example (Keystone)
+
+::
+
+    KEYSTONE_USE_MOD_WSGI="True"
+
+Example (Nova):
+
+::
+
+    NOVA_USE_MOD_WSGI="True"
+
+Example (Swift):
+
+::
+
+    SWIFT_USE_MOD_WSGI="True"
+
+
+
 Libraries from Git
 ------------------
 
@@ -295,48 +389,6 @@ that matches requirements.
 
         PIP_UPGRADE=True
 
-Swift
------
-
-Swift is now used as the back-end for the S3-like object store.  When
-enabled Nova's objectstore (``n-obj`` in ``ENABLED_SERVICES``) is
-automatically disabled. Enable Swift by adding it services to
-``ENABLED_SERVICES``
-
-    ::
-
-       enable_service s-proxy s-object s-container s-account
-
-Setting Swift's hash value is required and you will be prompted for it
-if Swift is enabled so just set it to something already:
-
-    ::
-
-        SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5
-
-For development purposes the default number of replicas is set to
-``1`` to reduce the overhead required. To better simulate a production
-deployment set this to ``3`` or more.
-
-    ::
-
-        SWIFT_REPLICAS=3
-
-The data for Swift is stored in the source tree by default (in
-``$DEST/swift/data``) and can be moved by setting
-``SWIFT_DATA_DIR``. The specified directory will be created if it does
-not exist.
-
-    ::
-
-        SWIFT_DATA_DIR=$DEST/data/swift
-
-*Note*: Previously just enabling ``swift`` was sufficient to start the
-Swift services. That does not provide proper service granularity,
-particularly in multi-host configurations, and is considered
-deprecated. Some service combination tests now check for specific
-Swift services and the old blanket acceptance will longer work
-correctly.
 
 Service Catalog Backend
 -----------------------
@@ -354,47 +406,6 @@ with ``KEYSTONE_CATALOG_BACKEND``:
 DevStack's default configuration in ``sql`` mode is set in
 ``files/keystone_data.sh``
 
-Cinder
-------
-
-The logical volume group used to hold the Cinder-managed volumes is
-set by ``VOLUME_GROUP``, the logical volume name prefix is set with
-``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
-with ``VOLUME_BACKING_FILE_SIZE``.
-
-    ::
-
-        VOLUME_GROUP="stack-volumes"
-        VOLUME_NAME_PREFIX="volume-"
-        VOLUME_BACKING_FILE_SIZE=10250M
-
-Multi-host DevStack
--------------------
-
-Running DevStack with multiple hosts requires a custom ``local.conf``
-section for each host. The master is the same as a single host
-installation with ``MULTI_HOST=True``. The slaves have fewer services
-enabled and a couple of host variables pointing to the master.
-
-Master
-~~~~~~
-
-Set ``MULTI_HOST`` to true
-    ::
-
-        MULTI_HOST=True
-
-Slave
-~~~~~
-
-Set the following options to point to the master
-
-    ::
-
-        MYSQL_HOST=w.x.y.z
-        RABBIT_HOST=w.x.y.z
-        GLANCE_HOSTPORT=w.x.y.z:9292
-        ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
 
 IP Version
 ----------
@@ -447,29 +458,163 @@ optionally be used to alter the default IPv6 address
 
         HOST_IPV6=${some_local_ipv6_address}
 
-Examples
-========
+Multi-node setup
+~~~~~~~~~~~~~~~~
 
--  Eliminate a Cinder pass-through (``CINDER_PERIODIC_INTERVAL``):
+See the :doc:`multi-node lab guide<guides/multinode-lab>`
 
-   ::
+Projects
+--------
 
-       [[post-config|$CINDER_CONF]]
-       [DEFAULT]
-       periodic_interval = 60
+Neutron
+~~~~~~~
 
--  Sample ``local.conf`` with screen logging enabled:
+See the :doc:`neutron configuration guide<guides/neutron>` for
+details on configuration of Neutron
 
-   ::
 
-       [[local|localrc]]
-       FIXED_RANGE=10.254.1.0/24
-       NETWORK_GATEWAY=10.254.1.1
-       LOGDAYS=1
-       LOGDIR=$DEST/logs
-       LOGFILE=$LOGDIR/stack.sh.log
-       ADMIN_PASSWORD=quiet
-       DATABASE_PASSWORD=$ADMIN_PASSWORD
-       RABBIT_PASSWORD=$ADMIN_PASSWORD
-       SERVICE_PASSWORD=$ADMIN_PASSWORD
-       SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
+Swift
+~~~~~
+
+Swift is disabled by default.  When enabled, it is configured with
+only one replica to avoid being IO/memory intensive on a small
+VM. When running with only one replica the account, container and
+object services will run directly in screen. The others services like
+replicator, updaters or auditor runs in background.
+
+If you would like to enable Swift you can add this to your `localrc`
+section:
+
+::
+
+    enable_service s-proxy s-object s-container s-account
+
+If you want a minimal Swift install with only Swift and Keystone you
+can have this instead in your `localrc` section:
+
+::
+
+    disable_all_services
+    enable_service key mysql s-proxy s-object s-container s-account
+
+If you only want to do some testing of a real normal swift cluster
+with multiple replicas you can do so by customizing the variable
+`SWIFT_REPLICAS` in your `localrc` section (usually to 3).
+
+Swift S3
+++++++++
+
+If you are enabling `swift3` in `ENABLED_SERVICES` DevStack will
+install the swift3 middleware emulation. Swift will be configured to
+act as a S3 endpoint for Keystone so effectively replacing the
+`nova-objectstore`.
+
+Only Swift proxy server is launched in the screen session all other
+services are started in background and managed by `swift-init` tool.
+
+Heat
+~~~~
+
+Heat is disabled by default (see `stackrc` file). To enable it
+explicitly you'll need the following settings in your `localrc`
+section
+
+::
+
+    enable_service heat h-api h-api-cfn h-api-cw h-eng
+
+Heat can also run in standalone mode, and be configured to orchestrate
+on an external OpenStack cloud. To launch only Heat in standalone mode
+you'll need the following settings in your `localrc` section
+
+::
+
+    disable_all_services
+    enable_service rabbit mysql heat h-api h-api-cfn h-api-cw h-eng
+    HEAT_STANDALONE=True
+    KEYSTONE_SERVICE_HOST=...
+    KEYSTONE_AUTH_HOST=...
+
+Tempest
+~~~~~~~
+
+If tempest has been successfully configured, a basic set of smoke
+tests can be run as follows:
+
+::
+
+    $ cd /opt/stack/tempest
+    $ tox -efull  tempest.scenario.test_network_basic_ops
+
+By default tempest is downloaded and the config file is generated, but the
+tempest package is not installed in the system's global site-packages (the
+package install includes installing dependences). So tempest won't run
+outside of tox. If you would like to install it add the following to your
+``localrc`` section:
+
+::
+
+    INSTALL_TEMPEST=True
+
+
+Xenserver
+~~~~~~~~~
+
+If you would like to use Xenserver as the hypervisor, please refer to
+the instructions in `./tools/xen/README.md`.
+
+Cells
+~~~~~
+
+`Cells <http://wiki.openstack.org/blueprint-nova-compute-cells>`__ is
+an alternative scaling option.  To setup a cells environment add the
+following to your `localrc` section:
+
+::
+
+    enable_service n-cell
+
+Be aware that there are some features currently missing in cells, one
+notable one being security groups.  The exercises have been patched to
+disable functionality not supported by cells.
+
+Cinder
+~~~~~~
+
+The logical volume group used to hold the Cinder-managed volumes is
+set by ``VOLUME_GROUP``, the logical volume name prefix is set with
+``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
+with ``VOLUME_BACKING_FILE_SIZE``.
+
+    ::
+
+        VOLUME_GROUP="stack-volumes"
+        VOLUME_NAME_PREFIX="volume-"
+        VOLUME_BACKING_FILE_SIZE=10250M
+
+
+Keystone
+~~~~~~~~
+
+Multi-Region Setup
+++++++++++++++++++
+
+We want to setup two devstack (RegionOne and RegionTwo) with shared
+keystone (same users and services) and horizon.  Keystone and Horizon
+will be located in RegionOne.  Full spec is available at:
+`<https://wiki.openstack.org/wiki/Heat/Blueprints/Multi_Region_Support_for_Heat>`__.
+
+In RegionOne:
+
+::
+
+    REGION_NAME=RegionOne
+
+In RegionTwo:
+
+::
+   
+    disable_service horizon
+    KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
+    KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
+    REGION_NAME=RegionTwo

From a35391e3bb497190e7e78cd0f233ddf1684fe18e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 10 Aug 2015 13:53:40 +1000
Subject: [PATCH 0833/3333] Talk about local.conf first

We bury the lead with all the historical notes about localrc; just
talk about what is important to somebody setting up a current
devstack, which is local.conf.

There are already inline examples of config-variables, etc.  Remove
them, but add a small overview example for logging in its place.

Change-Id: I466252ffba66ef4ea180c9355f715a19eb4f8017
---
 README.md                    | 39 +++++++-----------
 doc/source/configuration.rst | 78 +++++++++++++-----------------------
 2 files changed, 42 insertions(+), 75 deletions(-)

diff --git a/README.md b/README.md
index df0df917a4..ee7f0e7809 100644
--- a/README.md
+++ b/README.md
@@ -77,30 +77,21 @@ here, so run it in a VM.  And take advantage of the snapshot capabilities
 of your hypervisor of choice to reduce testing cycle times.  You might even save
 enough time to write one more feature before the next feature freeze...
 
-``stack.sh`` needs to have root access for a lot of tasks, but uses ``sudo``
-for all of those tasks.  However, it needs to be not-root for most of its
-work and for all of the OpenStack services.  ``stack.sh`` specifically
-does not run if started as root.
-
-This is a recent change (Oct 2013) from the previous behaviour of
-automatically creating a ``stack`` user.  Automatically creating
-user accounts is not the right response to running as root, so
-that bit is now an explicit step using ``tools/create-stack-user.sh``.
-Run that (as root!) or just check it out to see what DevStack's
-expectations are for the account it runs under.  Many people simply
-use their usual login (the default 'ubuntu' login on a UEC image
-for example).
+``stack.sh`` needs to have root access for a lot of tasks, but uses
+``sudo`` for all of those tasks.  However, it needs to be not-root for
+most of its work and for all of the OpenStack services.  ``stack.sh``
+specifically does not run if started as root.
 
-# Customizing
-
-You can override environment variables used in `stack.sh` by creating
-file name `local.conf` with a ``localrc`` section as shown below.  It
-is likely that you will need to do this to tweak several settings for
-your environment.
+DevStack will not automatically create the user, but provides a helper
+script in ``tools/create-stack-user.sh``.  Run that (as root!) or just
+check it out to see what DevStack's expectations are for the account
+it runs under.  Many people simply use their usual login (the default
+'ubuntu' login on a UEC image for example).
 
-    [[local|localrc]]
-    VARIABLE=value
+# Customizing
 
-Start by reading the [configuration
-guide](doc/source/configuration.rst) for details of the many available
-options.
\ No newline at end of file
+DevStack can be extensively configured via the configuration file
+`local.conf`.  It is likely that you will need to provide and modify
+this file if you want anything other than the most basic setup.  Start
+by reading the [configuration guide](doc/source/configuration.rst) for
+details of the configuration file and the many available options.
\ No newline at end of file
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index ed17924d45..fe23d6cb34 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -6,34 +6,15 @@ Configuration
    :local:
    :depth: 1
 
-DevStack has always tried to be mostly-functional with a minimal amount
-of configuration. The number of options has ballooned as projects add
-features, new projects added and more combinations need to be tested.
-Historically DevStack obtained all local configuration and
-customizations from a ``localrc`` file. The number of configuration
-variables that are simply passed-through to the individual project
-configuration files is also increasing. The old mechanism for this
-(``EXTRAS_OPTS`` and friends) required specific code for each file and
-did not scale well.
-
-In Oct 2013 a new configuration method was introduced (in `review
-46768 <https://review.openstack.org/#/c/46768/>`__) to hopefully
-simplify this process and meet the following goals:
-
--  contain all non-default local configuration in a single file
--  be backward-compatible with ``localrc`` to smooth the transition
-   process
--  allow settings in arbitrary configuration files to be changed
-
 local.conf
 ==========
 
-The new configuration file is ``local.conf`` and should reside in the
-root Devstack directory. An example of such ``local.conf`` file
-is provided in the ``devstack/samples`` directory. Copy this file into
-the root Devstack directory and adapt it to your needs. It is a modified INI
-format file that introduces a meta-section header to carry additional
-information regarding the configuration files to be changed.
+DevStack configuration is modified via the file ``local.conf``.  It is
+a modified INI format file that introduces a meta-section header to
+carry additional information regarding the configuration files to be
+changed.
+
+A sample is provided in ``devstack/samples``
 
 The new header is similar to a normal INI section header but with double
 brackets (``[[ ... ]]``) and two internal fields separated by a pipe
@@ -148,33 +129,14 @@ will not be set if there is no IPv6 address on the default Ethernet interface.
 Setting it here also makes it available for ``openrc`` to set ``OS_AUTH_URL``.
 ``HOST_IPV6`` is not set by default.
 
-Examples
-========
-
--  Eliminate a Cinder pass-through (``CINDER_PERIODIC_INTERVAL``):
-
-   ::
-
-       [[post-config|$CINDER_CONF]]
-       [DEFAULT]
-       periodic_interval = 60
-
--  Sample ``local.conf`` with screen logging enabled:
-
-   ::
-
-       [[local|localrc]]
-       FIXED_RANGE=10.254.1.0/24
-       NETWORK_GATEWAY=10.254.1.1
-       LOGDAYS=1
-       LOGDIR=$DEST/logs
-       LOGFILE=$LOGDIR/stack.sh.log
-       ADMIN_PASSWORD=quiet
-       DATABASE_PASSWORD=$ADMIN_PASSWORD
-       RABBIT_PASSWORD=$ADMIN_PASSWORD
-       SERVICE_PASSWORD=$ADMIN_PASSWORD
-       SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
+Historical Notes
+================
 
+Historically DevStack obtained all local configuration and
+customizations from a ``localrc`` file.  In Oct 2013 the
+``local.conf`` configuration method was introduced (in `review 46768
+<https://review.openstack.org/#/c/46768/>`__) to simplify this
+process.
 
 Configuration Notes
 ===================
@@ -257,6 +219,20 @@ to direct the message stream to the log host.  |
         SYSLOG_PORT=516
 
 
+Example Logging Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For example, non-interactive installs probably wish to save output to
+a file, keep service logs and disable color in the stored files.
+
+   ::
+
+       [[local|localrc]]
+       DEST=/opt/stack/
+       LOGDIR=$DEST/logs
+       LOGFILE=$LOGDIR/stack.sh.log
+       LOG_COLOR=False
+
 Database Backend
 ----------------
 

From a4693b5dea459acb02f226bbd1a8efdbcf1fc2b2 Mon Sep 17 00:00:00 2001
From: John Hua <john.hua@citrix.com>
Date: Thu, 6 Aug 2015 13:53:35 +0100
Subject: [PATCH 0834/3333] Add/Overwrite default images in IMAGE_URLS and
 detect duplicates

IMAGE_URLS could be set both in localrc with customization or stackrc by
default. By setting DOWNLOAD_DEFAULT_IMAGES, user could choose to add
default images to IMAGE_URLS or overwrite them.

As uploading duplicate images will cause a "409 Conflict" error, a
duplicate detection will expose it earlier.

Care needs to be taken that you don't end up with a duplicate image, so
clean up Xen's README.

Depends-On: I6fbae12f950a03afab39f341132746d3db9f788c
Change-Id: I3ca4e576aa3fb8992c08ca44900a8c53dd4b4163
Closes-Bug: #1473432
---
 doc/source/configuration.rst | 18 ++++++++
 stackrc                      | 87 ++++++++++++++++++++++--------------
 tools/xen/README.md          |  5 ---
 3 files changed, 71 insertions(+), 39 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 90b7d44dec..fef395c327 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -396,6 +396,24 @@ Set the following options to point to the master
         GLANCE_HOSTPORT=w.x.y.z:9292
         ENABLED_SERVICES=n-vol,n-cpu,n-net,n-api
 
+Guest Images
+------------
+
+Images provided in URLS via the comma-separated ``IMAGE_URLS``
+variable will be downloaded and uploaded to glance by DevStack.
+
+Default guest-images are predefined for each type of hypervisor and
+their testing-requirements in ``stack.sh``.  Setting
+``DOWNLOAD_DEFAULT_IMAGES=False`` will prevent DevStack downloading
+these default images; in that case, you will want to populate
+``IMAGE_URLS`` with sufficient images to satisfy testing-requirements.
+
+    ::
+
+        DOWNLOAD_DEFAULT_IMAGES=False
+        IMAGE_URLS="http://foo.bar.com/image.qcow,"
+        IMAGE_URLS+="http://foo.bar.com/image2.qcow"
+
 IP Version
 ----------
 
diff --git a/stackrc b/stackrc
index 156cb1f85a..43292a5e02 100644
--- a/stackrc
+++ b/stackrc
@@ -2,6 +2,11 @@
 #
 # stackrc
 #
+
+# ensure we don't re-source this in the same environment
+[[ -z "$_DEVSTACK_STACKRC" ]] || return 0
+declare -r _DEVSTACK_STACKRC=1
+
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 
@@ -560,40 +565,47 @@ CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
 # which may be set in ``local.conf``.  Also allow ``DEFAULT_IMAGE_NAME`` and
 # ``IMAGE_URLS`` to be set in the `localrc` section of ``local.conf``.
-case "$VIRT_DRIVER" in
-    openvz)
-        DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ubuntu-12.04-x86_64}
-        IMAGE_URLS=${IMAGE_URLS:-"http://download.openvz.org/template/precreated/ubuntu-12.04-x86_64.tar.gz"};;
-    libvirt)
-        case "$LIBVIRT_TYPE" in
-            lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
-                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
-                IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz"};;
-            *) # otherwise, use the uec style image (with kernel, ramdisk, disk)
-                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-                IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz"};;
-        esac
-        ;;
-    vsphere)
-        DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
-        IMAGE_URLS=${IMAGE_URLS:-"http://partnerweb.vmware.com/programs/vmdkimage/cirros-0.3.2-i386-disk.vmdk"};;
-    xenserver)
-        DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
-        IMAGE_URLS=${IMAGE_URLS:-"http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"}
-        IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
-    ironic)
-        # Ironic can do both partition and full disk images, depending on the driver
-        if [[ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]]; then
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-disk}
-        else
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}
-        fi
-        IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz"}
-        IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-disk.img";;
-    *) # Default to Cirros with kernel, ramdisk and disk image
-        DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-        IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz"};;
-esac
+DOWNLOAD_DEFAULT_IMAGES=$(trueorfalse True DOWNLOAD_DEFAULT_IMAGES)
+if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
+    if [ -n $IMAGE_URLS ]; then
+        IMAGE_URLS+=","
+    fi
+    case "$VIRT_DRIVER" in
+        openvz)
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ubuntu-12.04-x86_64}
+            IMAGE_URLS+="http://download.openvz.org/template/precreated/ubuntu-12.04-x86_64.tar.gz";;
+        libvirt)
+            case "$LIBVIRT_TYPE" in
+                lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
+                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz";;
+                *) # otherwise, use the uec style image (with kernel, ramdisk, disk)
+                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;
+                esac
+            ;;
+        vsphere)
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
+            IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/cirros-0.3.2-i386-disk.vmdk";;
+        xenserver)
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
+            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
+            IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
+        ironic)
+            # Ironic can do both partition and full disk images, depending on the driver
+            if [[ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]]; then
+                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-disk}
+            else
+                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}
+            fi
+            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz"
+            IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-disk.img";;
+        *) # Default to Cirros with kernel, ramdisk and disk image
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;
+    esac
+    DOWNLOAD_DEFAULT_IMAGES=False
+fi
 
 # Staging Area for New Images, have them here for at least 24hrs for nodepool
 # to cache them otherwise the failure rates in the gate are too high
@@ -606,6 +618,13 @@ if [[ "$PRECACHE_IMAGES" == "True" ]]; then
     fi
 fi
 
+# Detect duplicate values in IMAGE_URLS
+for image_url in ${IMAGE_URLS//,/ }; do
+    if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then
+        die $LINENO "$image_url is duplicate, please remove it from IMAGE_URLS."
+    fi
+done
+
 # 10Gb default volume backing file size
 VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-10250M}
 
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 61694e9616..6212cc54d7 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -94,11 +94,6 @@ Of course, use real passwords if this machine is exposed.
     XENAPI_CONNECTION_URL="http://address_of_your_xenserver"
     VNCSERVER_PROXYCLIENT_ADDRESS=address_of_your_xenserver
 
-    # Download a vhd and a uec image
-    IMAGE_URLS="\
-    https://github.com/downloads/citrix-openstack/warehouse/cirros-0.3.0-x86_64-disk.vhd.tgz,\
-    http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-uec.tar.gz"
-
     # Explicitly set virt driver
     VIRT_DRIVER=xenserver
 

From 605d6417e60494ef1f9d0511d526afe498d72120 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 26 Aug 2015 15:37:41 +0000
Subject: [PATCH 0835/3333] Add aodh and gnocchi to the plugin registry

The comment is their keystone service entry.

Change-Id: I896d5c594fa0c61924dbf4527215cc543b6e43e7
---
 doc/source/plugin-registry.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 99bfb85b38..428efc4977 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -20,6 +20,10 @@ The following are plugins that exist for official OpenStack projects.
 +--------------------+-------------------------------------------+--------------------+
 |Plugin Name         |URL                                        |Comments            |
 +--------------------+-------------------------------------------+--------------------+
+|aodh                |git://git.openstack.org/openstack/aodh     | alarming           |
++--------------------+-------------------------------------------+--------------------+
+|gnocchi             |git://git.openstack.org/openstack/gnocchi  | metric             |
++--------------------+-------------------------------------------+--------------------+
 |magnum              |git://git.openstack.org/openstack/magnum   |                    |
 +--------------------+-------------------------------------------+--------------------+
 |sahara              |git://git.openstack.org/openstack/sahara   |                    |

From e89126f6a446ad9a8e17a0e6481644403f8d5a22 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Fri, 28 Aug 2015 15:29:14 -0400
Subject: [PATCH 0836/3333] remove too_slow_to_test flag

this flag was added to deal with inefficiencies of Icehouse. this
patch removes flag as it's not used in post-Icehouse

Change-Id: Ib715e68dc61f3c3ea0a40fae0ea57028e36285bd
Depends-On: I842dfe04725b2482399c0e95b54403fb82001645
---
 lib/tempest | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index be24da6b61..fe90023c06 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -447,9 +447,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario large_ops_number ${TEMPEST_LARGE_OPS_NUMBER:-0}
 
     # Telemetry
-    # Ceilometer API optimization happened in Juno that allows to run more tests in tempest.
-    # Once Tempest retires support for icehouse this flag can be removed.
-    iniset $TEMPEST_CONFIG telemetry too_slow_to_test "False"
     iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
 
     # Object Store

From 9c0b9f30247d30babf35147351cfcf8bdf64d223 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 22 Jul 2015 06:08:09 +1000
Subject: [PATCH 0837/3333] Use sudo iniset to modify /etc files

The existing mysql code is wrong and not detected as failing [1], and
boto config requires work-arounds [2,3] that are all fairly ugly.  Use
-sudo argument to iniset to handle this.

[1] I24388b5de777995f92d73076524122cf599d6371
[2] I5f4c43bbbe477c570936e2e40ac05cc38febbb3f
[3] Ib7556dac9aaaf2f3c96237e0ca28ed6ae1b1b7ac

Change-Id: Iaceb8d42ce37be728adae6fd0a30a1f9d33d4029
---
 lib/databases/mysql | 24 ++++++++++--------------
 lib/tempest         |  2 +-
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7ae9a936d6..ada56a762a 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -92,14 +92,12 @@ function configure_database_mysql {
 
     # Change bind-address from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
-    sudo bash -c "source $TOP_DIR/functions && \
-        iniset $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS" && \
-        iniset $my_conf mysqld sql_mode STRICT_ALL_TABLES && \
-        iniset $my_conf mysqld default-storage-engine InnoDB && \
-        iniset $my_conf mysqld max_connections 1024 && \
-        iniset $my_conf mysqld query_cache_type OFF && \
-        iniset $my_conf mysqld query_cache_size 0"
-
+    iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
+    iniset -sudo $my_conf mysqld sql_mode STRICT_ALL_TABLES
+    iniset -sudo $my_conf mysqld default-storage-engine InnoDB
+    iniset -sudo $my_conf mysqld max_connections 1024
+    iniset -sudo $my_conf mysqld query_cache_type OFF
+    iniset -sudo $my_conf mysqld query_cache_size 0
 
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"
@@ -115,12 +113,10 @@ function configure_database_mysql {
 
         # Turn on slow query log, log all queries (any query taking longer than
         # 0 seconds) and log all non-indexed queries
-        sudo bash -c "source $TOP_DIR/functions && \
-            iniset $my_conf mysqld slow-query-log 1 && \
-            iniset $my_conf mysqld slow-query-log-file $slow_log && \
-            iniset $my_conf mysqld long-query-time 0 && \
-            iniset $my_conf mysqld log-queries-not-using-indexes 1"
-
+        iniset -sudo $my_conf mysqld slow-query-log 1
+        iniset -sudo $my_conf mysqld slow-query-log-file $slow_log
+        iniset -sudo $my_conf mysqld long-query-time 0
+        iniset -sudo $my_conf mysqld log-queries-not-using-indexes 1
     fi
 
     restart_service $mysql
diff --git a/lib/tempest b/lib/tempest
index be24da6b61..645d245d8f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -546,7 +546,7 @@ function configure_tempest {
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         # Use the ``BOTO_CONFIG`` environment variable to point to this file
-        iniset $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
+        iniset -sudo $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
         sudo chown $STACK_USER $BOTO_CONF
     fi
 

From 2e1a91c50b73ca7f46871d3a906ade93bbcac6a7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 31 Aug 2015 09:43:00 -0400
Subject: [PATCH 0838/3333] turn multi host true for nova network by default

With multi host set to true devstack's dnsmasq server no longer
listens on the network to other systems. In the gate we can see we're
getting a ton of spurious dhcp requests from other systems on the
network, and it's better that we never even see it.

Change-Id: Ie600de91e4a7da734eae722e78101c2401a7b1f5
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6441a891eb..ed4d43be30 100644
--- a/lib/nova
+++ b/lib/nova
@@ -156,7 +156,7 @@ FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 # ``MULTI_HOST`` is a mode where each compute node runs its own network node.  This
 # allows network operations and routing for a VM to occur on the server that is
 # running the VM - removing a SPOF and bandwidth bottleneck.
-MULTI_HOST=$(trueorfalse False MULTI_HOST)
+MULTI_HOST=$(trueorfalse True MULTI_HOST)
 
 # ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
 # where there are at least two nova-computes.

From 8349aff5abd26c63470b96e99ade0e8292a87e7a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 1 Sep 2015 12:45:28 -0400
Subject: [PATCH 0839/3333] add options to support nova test matrix

This adds 2 devstack options:

NOVA_V2_LEGACY={True/False} which is whether we'd like to force the
/v2 endpoint to use the legacy v2.0 code base.

it also provides TEMPEST_COMPUTE_TYPE as an way to pass in which
service catalog entry we'd like to use for compute testing.

We also make v2.1 the default compute endpoint, as that's what we'd
like everyone to be testing and using. The other options will let us
build jobs that nova can run to ensure those APIs don't regress.

Change-Id: Ie6b7e4290d9a1d9789d04099b3b31c9a557bc22b
---
 lib/nova    | 21 +++++++++++++++++----
 lib/tempest |  8 ++++++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 6441a891eb..dcb4f13bd6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -64,6 +64,11 @@ NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 # Expect to remove in L or M.
 NOVA_API_VERSION=${NOVA_API_VERSION-default}
 
+# NOVA_V2_LEGACY defines whether we force the Nova v2.0 enpoint onto
+# the Nova v2.0 legacy code base. Remove this option once the Nova
+# v2.0 legacy codebase is removed.
+NOVA_V2_LEGACY=$(trueorfalse False NOVA_V2_LEGACY)
+
 if is_suse; then
     NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/srv/www/htdocs/nova}
 else
@@ -317,6 +322,13 @@ function configure_nova {
         if [[ "$NOVA_API_VERSION" == "v21default" ]]; then
             sed -i s/": openstack_compute_api_v2$"/": openstack_compute_api_v21"/ "$NOVA_API_PASTE_INI"
         fi
+
+        # For setting up an environment where v2.0 is running on the
+        # v2.0 legacy code base.
+        if [[ "$NOVA_V2_LEGACY" == "True" ]]; then
+            sed -i s@"^/v2: openstack_compute_api_v21_legacy_v2_compatible$"@"/v2: openstack_compute_api_legacy_v2"@ \
+                "$NOVA_API_PASTE_INI"
+        fi
     fi
 
     if is_service_enabled n-cpu; then
@@ -411,15 +423,16 @@ function create_nova_accounts {
                 nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
             fi
 
-            get_or_create_service "nova" "compute" "Nova Compute Service"
-            get_or_create_endpoint "compute" \
+            get_or_create_service "nova_legacy" "compute_legacy" \
+                "Nova Compute Service (Legacy 2.0)"
+            get_or_create_endpoint "compute_legacy" \
                 "$REGION_NAME" \
                 "$nova_api_url/v2/\$(tenant_id)s" \
                 "$nova_api_url/v2/\$(tenant_id)s" \
                 "$nova_api_url/v2/\$(tenant_id)s"
 
-            get_or_create_service "novav21" "computev21" "Nova Compute Service V2.1"
-            get_or_create_endpoint "computev21" \
+            get_or_create_service "nova" "compute" "Nova Compute Service"
+            get_or_create_endpoint "compute" \
                 "$REGION_NAME" \
                 "$nova_api_url/v2.1/\$(tenant_id)s" \
                 "$nova_api_url/v2.1/\$(tenant_id)s" \
diff --git a/lib/tempest b/lib/tempest
index be24da6b61..df0e382133 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -361,6 +361,14 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi
 
+    # Set the service catalog entry for Tempest to run on. Typically
+    # used to try different compute API version targets. The tempest
+    # default if 'compute', which is typically valid, so only set this
+    # if you want to change it.
+    if [[ -n "$TEMPEST_COMPUTE_TYPE" ]]; then
+        iniset $TEMPEST_CONFIG compute catalog_type $TEMPEST_COMPUTE_TYPE
+    fi
+
     # Compute Features
     # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config

From f798ec12422b6ff9314e0f5fbaa995ab7203b419 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 1 Sep 2015 13:20:48 -0700
Subject: [PATCH 0840/3333] docs: add a blurb in the single-vm doc about
 cloud-init log output

I had to poke around for awhile to find /var/log/cloud-init-output.log
so I figured I'd add a sentence in the docs about using that.

Change-Id: I8bb6cb730032e41661ee443da816cbea2b28f76d
---
 doc/source/guides/single-vm.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index c2ce1a34a0..515cd505c3 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -78,6 +78,11 @@ passed as the user-data file when booting the VM.
 As DevStack will refuse to run as root, this configures ``cloud-init``
 to create a non-root user and run the ``start.sh`` script as that user.
 
+If you are using cloud-init and you have not
+`enabled custom logging <../configuration.html#enable-logging>`_ of the stack
+output, then the stack output can be found in
+``/var/log/cloud-init-output.log`` by default.
+
 Launching By Hand
 -----------------
 

From e5a6f82e431bece62deb830257439b309b2921ec Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyam.mann@nectechnologies.in>
Date: Wed, 2 Sep 2015 13:19:48 +0900
Subject: [PATCH 0841/3333] Cleanup nova v2.1 API testing options

Now gate will tests Nova v2.1 as default and separate jobs
for v2 legacy and v2 compatible APIs -
 I86a627b8ec7b1246452a16c10dcfb1ad5f83bdef

This commit cleanup the options used for old v2.1 jobs.

Separate options are provided for Nova APIs testing-
 Ie6b7e4290d9a1d9789d04099b3b31c9a557bc22b

Depends-On: Ie0430cedb7a8136c04b9fb7d08746293aab79f42
To remove old V2.1 jobs.

Change-Id: Ibbed44e1c41ec1e6b3675317f08061810762796c
---
 lib/nova | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/lib/nova b/lib/nova
index dcb4f13bd6..c0227c524f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -56,13 +56,6 @@ NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
-# NOVA_API_VERSION valid options
-# - default - setup API end points as nova does out of the box
-# - v21default - make v21 the default on /v2
-#
-# NOTE(sdague): this is for transitional testing of the Nova v21 API.
-# Expect to remove in L or M.
-NOVA_API_VERSION=${NOVA_API_VERSION-default}
 
 # NOVA_V2_LEGACY defines whether we force the Nova v2.0 enpoint onto
 # the Nova v2.0 legacy code base. Remove this option once the Nova
@@ -318,11 +311,6 @@ function configure_nova {
         # Get the sample configuration file in place
         cp $NOVA_DIR/etc/nova/api-paste.ini $NOVA_CONF_DIR
 
-        # For testing v21 is equivalent to v2
-        if [[ "$NOVA_API_VERSION" == "v21default" ]]; then
-            sed -i s/": openstack_compute_api_v2$"/": openstack_compute_api_v21"/ "$NOVA_API_PASTE_INI"
-        fi
-
         # For setting up an environment where v2.0 is running on the
         # v2.0 legacy code base.
         if [[ "$NOVA_V2_LEGACY" == "True" ]]; then

From 36daecd1a362a6a5388aa4ee5c5269563a820cbf Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Thu, 23 Jul 2015 17:50:40 +0900
Subject: [PATCH 0842/3333] Remove restraint on plugin file from neutron
 plugins

Neutron plugin always needs plugin file even if the plugin
is out of tree. This patch remove the restraint.

Change-Id: Iedd52db6430def47505a127986170d7279966141
Closes-Bug: #1477452
---
 lib/neutron-legacy | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 lib/neutron-legacy

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
old mode 100644
new mode 100755
index c244bc54cd..c74c844a0c
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -326,7 +326,9 @@ ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
 # ---------------------------------
 
 # Please refer to ``lib/neutron_plugins/README.md`` for details.
-source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
+if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
+    source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
+fi
 
 # Agent loadbalancer service plugin functions
 # -------------------------------------------

From 09b431d72d3db29e01be44f85dcbfcb78f651b13 Mon Sep 17 00:00:00 2001
From: Chuck Carmack <carmack@us.ibm.com>
Date: Wed, 2 Sep 2015 14:27:58 +0000
Subject: [PATCH 0843/3333] Disable the shelve tests for nova-cells using
 tempest config

Change from using a blacklist to disable the shelve tests for
nova-cells to using the tempest config option to disable the shelve
feature tests.  This is the intended method of disabling feature tests.
This first commit is to add code to lib/tempest to disable the shelve
feature test if the nova-cells service is enabled.  The next
st will remove the shelve blacklist from
http://git.openstack.org/cgit/openstack/nova/tree/devstack/tempest-dsvm-cells-rc

Change-Id: Ibf1f9aaa63e5f17b7d8774b511940ba8421e0887
Partial-bug: 1491152
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index a8d597a34e..272b549c1a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -390,6 +390,10 @@ function configure_tempest {
     # neutron.allow_duplicate_networks option was removed from nova in Liberty
     # and is now the default behavior.
     iniset $TEMPEST_CONFIG compute-feature-enabled allow_duplicate_networks ${NOVA_ALLOW_DUPLICATE_NETWORKS:-True}
+    if is_service_enabled n-cell; then
+        # Cells doesn't support shelving/unshelving
+        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
+    fi
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0

From 0c3a3b051e08589189914bc543378e4dd2dcdeb8 Mon Sep 17 00:00:00 2001
From: Mikhail Feoktistov <mfeoktistov@virtuozzo.com>
Date: Thu, 3 Sep 2015 18:15:28 +0300
Subject: [PATCH 0844/3333] Fix upload_image error in stackrc

This commit fixes error caused by adding default image path to IMAGE_URLS without ','
If user sets IMAGE_URLS in localrc like
IMAGE_URLS="path1, path2" (with a space after the comma)
the we get an error "binary operator expected" in
if [ -n $IMAGE_URLS ] condition and a comma will not be added to the end of IMAGE_URLS
In the code below we add default image path(path3) to IMAGE_URLS and we get
IMAGE_URLS="path1, path2path3"

Change-Id: I6543f7178c49a42c71ad9df4cdb4c6e78cbf7758
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index b838911d97..ca897a1c4d 100644
--- a/stackrc
+++ b/stackrc
@@ -565,7 +565,7 @@ CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 # ``IMAGE_URLS`` to be set in the `localrc` section of ``local.conf``.
 DOWNLOAD_DEFAULT_IMAGES=$(trueorfalse True DOWNLOAD_DEFAULT_IMAGES)
 if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
-    if [ -n $IMAGE_URLS ]; then
+    if [[ -n "$IMAGE_URLS" ]]; then
         IMAGE_URLS+=","
     fi
     case "$VIRT_DRIVER" in

From c7e772c164c0c08be90624d76d4c3e11864364b7 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 1 Sep 2015 15:18:57 +0200
Subject: [PATCH 0845/3333] Use the pip installed version of requests with
 Fedora

The upstream version of requests contains a copy
of urllib3 and cardet library, common practice in many distros
to create symbolic links for these libraries instead of creating
a huge package which contains the same library as the distro provides
as separate package as well.

Now devstack upgrades the urllib3 to incompatible version,
but it leaves the requests unchanged because Fedora already has the
latest version.
The issue does not happens with Ubuntu because it has older requests
and devstack updates it as well.
The pip installed version contains a bundled urllib3 and the actually
installed urllib3 version does not matters.

This is not the `usual` distro package overrides pip installed package
case.

Change-Id: Icfa71368384b0c2e3ff39265b2fa9190b5566b9b
Related-Bug: #1476770
---
 tools/fixup_stuff.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 4fff57f401..a601cf2f67 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -134,6 +134,31 @@ if is_fedora; then
             sudo systemctl start iptables
         fi
     fi
+
+    if  [[ "$os_RELEASE" -ge "21" ]]; then
+        # requests ships vendored version of chardet/urllib3, but on
+        # fedora these are symlinked back to the primary versions to
+        # avoid duplication of code on disk.  This is fine when
+        # maintainers keep things in sync, but since devstack takes
+        # over and installs later versions via pip we can end up with
+        # incompatible versions.
+        #
+        # The rpm package is not removed to preserve the dependent
+        # packages like cloud-init; rather we remove the symlinks and
+        # force a re-install of requests so the vendored versions it
+        # wants are present.
+        #
+        # Realted issues:
+        # https://bugs.launchpad.net/glance/+bug/1476770
+        # https://bugzilla.redhat.com/show_bug.cgi?id=1253823
+
+        base_path=/usr/lib/python2.7/site-packages/requests/packages
+        if [ -L $base_path/chardet -o -L $base_path/urllib3 ]; then
+            sudo rm -f /usr/lib/python2.7/site-packages/requests/packages/{chardet,urllib3}
+            # install requests with the bundled urllib3 to avoid conflicts
+            pip_install --upgrade --force-reinstall requests
+        fi
+    fi
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From 975243189216561f66ca91520495e0c6e2f747e2 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 4 Sep 2015 14:15:27 +0000
Subject: [PATCH 0846/3333] Revert "turn multi host true for nova network by
 default"

This reverts commit 2e1a91c50b73ca7f46871d3a906ade93bbcac6a7

It looks like this introduced race bug 1491949 in the
gate-tempest-dsvm-large-ops job causing rpc timeouts when
deallocating network information for an instance,
specifically around the dnsmasq callback to release the
fixed IP that the instance was using which triggers the
disassociation between the fixed IP and the instance in the
nova database.

Change-Id: I163cdeea75e92485f241647c69aea0d7456c3258
Closes-Bug: #1491949
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index ed4d43be30..6441a891eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -156,7 +156,7 @@ FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 # ``MULTI_HOST`` is a mode where each compute node runs its own network node.  This
 # allows network operations and routing for a VM to occur on the server that is
 # running the VM - removing a SPOF and bandwidth bottleneck.
-MULTI_HOST=$(trueorfalse True MULTI_HOST)
+MULTI_HOST=$(trueorfalse False MULTI_HOST)
 
 # ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
 # where there are at least two nova-computes.

From f768787bdd6dddf2790f83a884618d29677ca77c Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 4 Sep 2015 15:34:06 +0100
Subject: [PATCH 0847/3333] Revert "Convert identity defaults to keystone v3
 api"

This change have broke the Ironic tests. Reverting to unblock the Ironic
gate.

This reverts commit 4b115ad526df7e12bbdc71e0280b3c691e53ed04.

Closes-Bug: #1492216
Change-Id: I03acfdf47caf435cede1df08fd79b288a6662435
---
 functions-common | 35 +++++++++++++++++++++++++++++++----
 stack.sh         | 15 +++++++--------
 2 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/functions-common b/functions-common
index 473808b1f5..446de5374f 100644
--- a/functions-common
+++ b/functions-common
@@ -690,13 +690,16 @@ function policy_add {
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
     local domain_id
+    local os_url="$KEYSTONE_SERVICE_URI_V3"
     # Gets domain id
     domain_id=$(
         # Gets domain id
-        openstack domain show $1 \
+        openstack --os-token=$OS_TOKEN --os-url=$os_url \
+            --os-identity-api-version=3 domain show $1 \
             -f value -c id 2>/dev/null ||
         # Creates new domain
-        openstack domain create $1 \
+        openstack --os-token=$OS_TOKEN --os-url=$os_url \
+            --os-identity-api-version=3 domain create $1 \
             --description "$2" \
             -f value -c id
     )
@@ -707,11 +710,13 @@ function get_or_create_domain {
 # Usage: get_or_create_group <groupname> <domain> [<description>]
 function get_or_create_group {
     local desc="${3:-}"
+    local os_url="$KEYSTONE_SERVICE_URI_V3"
     local group_id
     # Gets group id
     group_id=$(
         # Creates new group with --or-show
-        openstack group create $1 \
+        openstack --os-token=$OS_TOKEN --os-url=$os_url \
+            --os-identity-api-version=3 group create $1 \
             --domain $2 --description "$desc" --or-show \
             -f value -c id
     )
@@ -733,6 +738,8 @@ function get_or_create_user {
         openstack user create \
             $1 \
             --password "$2" \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             --domain=$3 \
             $email \
             --or-show \
@@ -747,7 +754,9 @@ function get_or_create_project {
     local project_id
     project_id=$(
         # Creates new project with --or-show
-        openstack project create $1 \
+        openstack --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            project create $1 \
             --domain=$2 \
             --or-show -f value -c id
     )
@@ -761,6 +770,8 @@ function get_or_create_role {
     role_id=$(
         # Creates role with --or-show
         openstack role create $1 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             --or-show -f value -c id
     )
     echo $role_id
@@ -773,6 +784,8 @@ function get_or_add_user_project_role {
     # Gets user role id
     user_role_id=$(openstack role list \
         --user $2 \
+        --os-url=$KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
         --column "ID" \
         --project $3 \
         --column "Name" \
@@ -783,6 +796,8 @@ function get_or_add_user_project_role {
             $1 \
             --user $2 \
             --project $3 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             | grep " id " | get_field 2)
     fi
     echo $user_role_id
@@ -794,15 +809,21 @@ function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
     group_role_id=$(openstack role list \
+        --os-url=$KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
         --group $2 \
         --project $3 \
         -c "ID" -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
         openstack role add $1 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             --group $2 \
             --project $3
         group_role_id=$(openstack role list \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             --group $2 \
             --project $3 \
             -c "ID" -f value)
@@ -820,6 +841,8 @@ function get_or_create_service {
         openstack service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
         openstack service create \
+            --os-url $KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             $2 \
             --name $1 \
             --description="$3" \
@@ -838,6 +861,8 @@ function _get_or_create_endpoint_with_interface {
     # gets support for this, the check for the region name can be removed.
     # Related bug in keystone: https://bugs.launchpad.net/keystone/+bug/1482772
     endpoint_id=$(openstack endpoint list \
+        --os-url $KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
         --service $1 \
         --interface $2 \
         --region $4 \
@@ -845,6 +870,8 @@ function _get_or_create_endpoint_with_interface {
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \
+            --os-url $KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
             $1 $2 $3 --region $4 -f value -c id)
     fi
 
diff --git a/stack.sh b/stack.sh
index 093fef4cd9..accfd0ac3e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -989,15 +989,13 @@ if is_service_enabled keystone; then
         start_keystone
     fi
 
-    export OS_IDENTITY_API_VERSION=3
-
     # Set up a temporary admin URI for Keystone
-    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v3
+    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v2.0
 
     if is_service_enabled tls-proxy; then
         export OS_CACERT=$INT_CA_DIR/ca-chain.pem
         # Until the client support is fixed, just use the internal endpoint
-        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v3
+        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v2.0
     fi
 
     # Setup OpenStackClient token-endpoint auth
@@ -1025,13 +1023,14 @@ if is_service_enabled keystone; then
     # Begone token auth
     unset OS_TOKEN OS_URL
 
+    # force set to use v2 identity authentication even with v3 commands
+    export OS_AUTH_TYPE=v2password
+
     # Set up password auth credentials now that Keystone is bootstrapped
-    export OS_AUTH_URL=$KEYSTONE_AUTH_URI
+    export OS_AUTH_URL=$SERVICE_ENDPOINT
+    export OS_TENANT_NAME=admin
     export OS_USERNAME=admin
-    export OS_USER_DOMAIN_ID=default
     export OS_PASSWORD=$ADMIN_PASSWORD
-    export OS_PROJECT_NAME=admin
-    export OS_PROJECT_DOMAIN_ID=default
     export OS_REGION_NAME=$REGION_NAME
 fi
 

From e0550190a597c9c78caf2f0cfe3d79ad1d368259 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Sun, 6 Sep 2015 12:05:49 +0300
Subject: [PATCH 0848/3333] remove unused param from tempest config

Remove setting of ssh_user param to boto section.
Because boto uses user name to ssh from compute.ssh_user

Change-Id: Ifd5b99ef35eaf126a3c6e0055837c4741353345e
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index a78cd741c6..7695054f78 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -426,7 +426,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG boto aki_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz.manifest.xml
     iniset $TEMPEST_CONFIG boto instance_type "$boto_instance_type"
     iniset $TEMPEST_CONFIG boto http_socket_timeout 30
-    iniset $TEMPEST_CONFIG boto ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
 
     # Orchestration Tests
     if is_service_enabled heat; then

From 9451021200cf333dc624275ef832acd3f37dd553 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hp.com>
Date: Wed, 2 Sep 2015 15:40:04 -0400
Subject: [PATCH 0849/3333] Fix typo in _move_neutron_addresses_route()

A previous change in this code had a typo, reversing the
definitions of IP_ADD and IP_DEL, noticed while debugging
another issue.

Change-Id: Ifb87de1138eeb72081a2e52a5c81bfe9fe91ecd6
---
 lib/neutron-legacy | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c74c844a0c..d1865d8bcd 100755
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -826,11 +826,11 @@ function _move_neutron_addresses_route {
         fi
 
         if [[ "$IP_BRD" != "" ]]; then
-            IP_ADD="sudo ip addr del $IP_BRD dev $from_intf"
-            IP_DEL="sudo ip addr add $IP_BRD dev $to_intf"
+            IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
+            IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
         fi
 
-        $IP_ADD; $IP_DEL; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        $IP_DEL; $IP_ADD; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
     fi
 }
 

From b848ad783ffa417c4e1a732c164774ee22442f1d Mon Sep 17 00:00:00 2001
From: Takashi NATSUME <natsume.takashi@lab.ntt.co.jp>
Date: Tue, 8 Sep 2015 10:56:28 +0900
Subject: [PATCH 0850/3333] Fix a typo in make_cert.sh

Change-Id: I6d4f02edf843f0519c3d0413bb033604a7ec73e9
---
 tools/make_cert.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/make_cert.sh b/tools/make_cert.sh
index cb93e57c4b..2628b40524 100755
--- a/tools/make_cert.sh
+++ b/tools/make_cert.sh
@@ -5,7 +5,7 @@
 # Create a CA hierarchy (if necessary) and server certificate
 #
 # This mimics the CA structure that DevStack sets up when ``tls_proxy`` is enabled
-# but in the curent directory unless ``DATA_DIR`` is set
+# but in the current directory unless ``DATA_DIR`` is set
 
 ENABLE_TLS=True
 DATA_DIR=${DATA_DIR:-`pwd`/ca-data}

From 3e3212b52d14c27c002c27b6d4f8bcfa7f5ffbcf Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Fri, 4 Sep 2015 13:02:19 +0200
Subject: [PATCH 0851/3333] Add trailing IDENTITY_API_VERSION to OS_AUTH_URL in
 swift_configure_tempurls

The python-keystoneclient requires a trailing /v<IDENTITY_API_VERSION> to
successfully authenticate, otherwise it fails with a 404 error due to a not
found resource.

This error showed up only when generating Swift tempurls, because the error was
raised when using python-swiftclient.

This change fixes this for python-swiftclient within devstack.

Change-Id: Ibe222d65162898db69acba076b5fe1cb3621fbc3
Closes-Bug: 1492216
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 6b61274127..645bfd7cd9 100644
--- a/lib/swift
+++ b/lib/swift
@@ -801,6 +801,7 @@ function swift_configure_tempurls {
     OS_USERNAME=swift \
         OS_TENANT_NAME=$SERVICE_TENANT_NAME \
         OS_PASSWORD=$SERVICE_PASSWORD \
+        OS_AUTH_URL=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
         swift post -m "Temp-URL-Key: $SWIFT_TEMPURL_KEY"
 }
 

From 2af6915e08da87334da9ea023ad65b1f10040604 Mon Sep 17 00:00:00 2001
From: Wei Jiangang <weijg.fnst@cn.fujitsu.com>
Date: Tue, 8 Sep 2015 18:03:22 +0800
Subject: [PATCH 0852/3333] Fix typos in devstack/stack.sh

log to the the file => log to the file
pluggins => plugins

Change-Id: Iff5c54c39afb4398962bfe6a0500b1f011c75c8a
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 639f72b1bc..40f481331e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -431,7 +431,7 @@ fi
 
 # Set up logging of screen windows
 # Set ``SCREEN_LOGDIR`` to turn on logging of screen windows to the
-# directory specified in ``SCREEN_LOGDIR``, we will log to the the file
+# directory specified in ``SCREEN_LOGDIR``, we will log to the file
 # ``screen-$SERVICE_NAME-$TIMESTAMP.log`` in that dir and have a link
 # ``screen-$SERVICE_NAME.log`` to the latest log file.
 # Logs are kept for as long specified in ``LOGDAYS``.
@@ -522,7 +522,7 @@ fi
 # Clone all external plugins
 fetch_plugins
 
-# Plugin Phase 0: override_defaults - allow pluggins to override
+# Plugin Phase 0: override_defaults - allow plugins to override
 # defaults before other services are run
 run_phase override_defaults
 

From 0eec4f86c1ac607bfbdf1ec19561b3bbdb56cf4f Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Tue, 8 Sep 2015 10:45:06 +0000
Subject: [PATCH 0853/3333] database: fix PostgreSQL connection string

If all databases drivers are loaded, MySQL SQLAlchemy driver
overrides all the other one that might not have set one.
This patches fixes that.

Change-Id: If6d8d08e5b7b7c48ca012677b536d71058def6fd
Closes-Bug: #1493304
---
 lib/database             | 10 +---------
 lib/databases/mysql      | 14 ++++++++------
 lib/databases/postgresql |  4 ++++
 3 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/lib/database b/lib/database
index 5bbbe3144b..13740b90e6 100644
--- a/lib/database
+++ b/lib/database
@@ -101,7 +101,7 @@ function initialize_database_backends {
     # a multi-node DevStack installation.
 
     # NOTE: Don't specify ``/db`` in this string so we can use it for multiple services
-    BASE_SQL_CONN=${BASE_SQL_CONN:-$(get_database_type)://$DATABASE_USER:$DATABASE_PASSWORD@$DATABASE_HOST}
+    BASE_SQL_CONN=${BASE_SQL_CONN:-$(get_database_type_$DATABASE_TYPE)://$DATABASE_USER:$DATABASE_PASSWORD@$DATABASE_HOST}
 
     return 0
 }
@@ -135,14 +135,6 @@ function database_connection_url {
     database_connection_url_$DATABASE_TYPE $db
 }
 
-function get_database_type {
-    if [[ -n "${SQLALCHEMY_DATABASE_DRIVER}" ]]; then
-        echo "${DATABASE_TYPE}+${SQLALCHEMY_DATABASE_DRIVER}"
-    else
-        echo "${DATABASE_TYPE}"
-    fi
-}
-
 
 # Restore xtrace
 $XTRACE
diff --git a/lib/databases/mysql b/lib/databases/mysql
index ada56a762a..c2ab32e5b2 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -12,12 +12,6 @@ MY_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
 MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
-# Force over to pymysql driver by default if we are using it.
-if is_service_enabled mysql; then
-    if [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then
-        SQLALCHEMY_DATABASE_DRIVER=${SQLALCHEMY_DATABASE_DRIVER:-"pymysql"}
-    fi
-fi
 
 register_database mysql
 
@@ -30,6 +24,14 @@ fi
 # Functions
 # ---------
 
+function get_database_type_mysql {
+    if [[ "$MYSQL_DRIVER" == "PyMySQL" ]]; then
+        echo mysql+pymysql
+    else
+        echo mysql
+    fi
+}
+
 # Get rid of everything enough to cleanly change database backends
 function cleanup_database_mysql {
     stop_service $MYSQL
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index e087a1e0d4..78c7bedc90 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -21,6 +21,10 @@ register_database postgresql
 # Functions
 # ---------
 
+function get_database_type_postgresql {
+    echo postgresql
+}
+
 # Get rid of everything enough to cleanly change database backends
 function cleanup_database_postgresql {
     stop_service postgresql

From 54616845dfd0942164a67f69aef4e929d004d2d9 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Tue, 8 Sep 2015 21:39:20 -0700
Subject: [PATCH 0854/3333] VMware: remove configuration integration_bridge
 from nova

There are a number of different neutron plugins that work with the
VMware nova driver. If necessary this flag can be set by each plugin
if necessary.

Change-Id: I47ac2a5c71ff573f474d45b85a523fc243ec3ade
---
 lib/nova_plugins/hypervisor-vsphere | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-vsphere b/lib/nova_plugins/hypervisor-vsphere
index c406e094f3..698f836bad 100644
--- a/lib/nova_plugins/hypervisor-vsphere
+++ b/lib/nova_plugins/hypervisor-vsphere
@@ -42,9 +42,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF vmware host_username "$VMWAREAPI_USER"
     iniset $NOVA_CONF vmware host_password "$VMWAREAPI_PASSWORD"
     iniset_multiline $NOVA_CONF vmware cluster_name "$VMWAREAPI_CLUSTER"
-    if is_service_enabled neutron; then
-        iniset $NOVA_CONF vmware integration_bridge $OVS_BRIDGE
-    fi
 }
 
 # install_nova_hypervisor() - Install external components

From 97cc85b9b1661cb73f732b854a3f2ebd738539ed Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Tue, 8 Sep 2015 13:51:01 +0900
Subject: [PATCH 0855/3333] Provide hook for neutron plugin config

This removes a restriction for neutron vendor plugin.
Some neutron vendor plugins were already decomposed and
there is no config file in Neutron tree. They should prepare
the file in each plugin.

Change-Id: I4997b8eae1f433b1c23f20c06ba254568ac4982b
---
 lib/neutron-legacy | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d1865d8bcd..550eadb4b4 100755
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -901,7 +901,11 @@ function _configure_neutron_common {
     # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
     mkdir -p /$Q_PLUGIN_CONF_PATH
     Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
-    cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
+    # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
+    # there is no config file in Neutron tree. They should prepare the file in each plugin.
+    if [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
+        cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
+    fi
 
     iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
     iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron

From 23f65cb9d77cac11101dc7f25c3b8a6a25a73d53 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Wed, 9 Sep 2015 08:33:15 +0000
Subject: [PATCH 0856/3333] Update lib/ceilometer to reflect script renames

Without this change some services for ceilometer will not start
breaking CI.

This change I7447ba4f408c95b0acf1b809504ce16fff1c6e21 was validated
against the ceilometer devstack plugin but apparently not against
devstack itself. Until I413ab159474b7d7231ad66d3a482201f74efe8a8
merges devstack still has ceilometer support and is used in the
gate.

Change-Id: Ib1ea8b6ef7019570f82b0ba87e03fc627c8f6801
---
 lib/ceilometer | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/ceilometer b/lib/ceilometer
index d1cc862160..c6c4c87fbc 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -360,10 +360,10 @@ function install_ceilometerclient {
 
 # start_ceilometer() - Start running processes, including screen
 function start_ceilometer {
-    run_process ceilometer-acentral "$CEILOMETER_BIN_DIR/ceilometer-agent-central --config-file $CEILOMETER_CONF"
+    run_process ceilometer-acentral "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces central --config-file $CEILOMETER_CONF"
     run_process ceilometer-anotification "$CEILOMETER_BIN_DIR/ceilometer-agent-notification --config-file $CEILOMETER_CONF"
     run_process ceilometer-collector "$CEILOMETER_BIN_DIR/ceilometer-collector --config-file $CEILOMETER_CONF"
-    run_process ceilometer-aipmi "$CEILOMETER_BIN_DIR/ceilometer-agent-ipmi --config-file $CEILOMETER_CONF"
+    run_process ceilometer-aipmi "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces ipmi --config-file $CEILOMETER_CONF"
 
     if [[ "$CEILOMETER_USE_MOD_WSGI" == "False" ]]; then
         run_process ceilometer-api "$CEILOMETER_BIN_DIR/ceilometer-api -d -v --log-dir=$CEILOMETER_API_LOG_DIR --config-file $CEILOMETER_CONF"
@@ -378,10 +378,10 @@ function start_ceilometer {
     # Start the compute agent last to allow time for the collector to
     # fully wake up and connect to the message bus. See bug #1355809
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
-        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-agent-compute --config-file $CEILOMETER_CONF" $LIBVIRT_GROUP
+        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces compute --config-file $CEILOMETER_CONF" $LIBVIRT_GROUP
     fi
     if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-agent-compute --config-file $CEILOMETER_CONF"
+        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces compute --config-file $CEILOMETER_CONF"
     fi
 
     # Only die on API if it was actually intended to be turned on

From e8c70e23b5c8b9a41e2e86116972cf4da3367e19 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 13 Aug 2015 18:10:00 +0200
Subject: [PATCH 0857/3333] Tempest: add a Cinder extend_with_snapshot feature
 flag

A new tempest test is being added in https://review.openstack.org/#/c/200108/
but it doesn't run by default because the test fails on Juno. So a
feature flag in Tempest is added. This patch turns on this feature
flag at Devstack's side.

Change-Id: If1cf90dac3edc81a483fc51da74495042c96d543
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index fb4b0d34ae..85e8d5ffc3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -477,6 +477,8 @@ function configure_tempest {
     # Volume
     # TODO(dkranz): Remove the bootable flag when Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled bootable True
+    # TODO(jordanP): Remove the extend_with_snapshot flag when Juno is end of life.
+    iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
 
     local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then

From e9a4750fe1b111eeb457378c26ca9eea1b5e0085 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Sat, 27 Jun 2015 11:29:09 +0000
Subject: [PATCH 0858/3333] Remove ceilometer in favor of plugin

The ceilometer project is moving to using a devstack plugin rather
than having ceilometer in the base devstack. This is to allow
greater control and flexibility.

Change-Id: I413ab159474b7d7231ad66d3a482201f74efe8a8
---
 clean.sh                         |   1 -
 doc/source/index.rst             |   1 -
 files/apache-ceilometer.template |  15 --
 functions-common                 |   6 -
 lib/ceilometer                   | 418 -------------------------------
 stack.sh                         |  22 +-
 stackrc                          |   9 +-
 tests/test_libs_from_pypi.sh     |   2 +-
 unstack.sh                       |   5 -
 9 files changed, 4 insertions(+), 475 deletions(-)
 delete mode 100644 files/apache-ceilometer.template
 delete mode 100644 lib/ceilometer

diff --git a/clean.sh b/clean.sh
index 78e2a7a826..b22a29cb41 100755
--- a/clean.sh
+++ b/clean.sh
@@ -48,7 +48,6 @@ source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ironic
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2dd0241fba..7ff2705055 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -154,7 +154,6 @@ Scripts
 * `functions <functions.html>`__ - DevStack-specific functions
 * `functions-common <functions-common.html>`__ - Functions shared with other projects
 * `lib/apache <lib/apache.html>`__
-* `lib/ceilometer <lib/ceilometer.html>`__
 * `lib/ceph <lib/ceph.html>`__
 * `lib/cinder <lib/cinder.html>`__
 * `lib/database <lib/database.html>`__
diff --git a/files/apache-ceilometer.template b/files/apache-ceilometer.template
deleted file mode 100644
index 79f14c38ab..0000000000
--- a/files/apache-ceilometer.template
+++ /dev/null
@@ -1,15 +0,0 @@
-Listen %PORT%
-
-<VirtualHost *:%PORT%>
-    WSGIDaemonProcess ceilometer-api processes=2 threads=10 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup ceilometer-api
-    WSGIScriptAlias / %WSGIAPP%
-    WSGIApplicationGroup %{GLOBAL}
-    <IfVersion >= 2.4>
-        ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/ceilometer.log
-    CustomLog /var/log/%APACHE_NAME%/ceilometer_access.log combined
-</VirtualHost>
-
-WSGISocketPrefix /var/run/%APACHE_NAME%
diff --git a/functions-common b/functions-common
index 446de5374f..867bd5227d 100644
--- a/functions-common
+++ b/functions-common
@@ -1033,10 +1033,6 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/cinder ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/cinder"
             fi
-        elif [[ $service == ceilometer-* ]]; then
-            if [[ ! $file_to_parse =~ $package_dir/ceilometer ]]; then
-                file_to_parse="${file_to_parse} ${package_dir}/ceilometer"
-            fi
         elif [[ $service == s-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/swift ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/swift"
@@ -1777,7 +1773,6 @@ function enable_service {
 # There are special cases for some 'catch-all' services::
 #   **nova** returns true if any service enabled start with **n-**
 #   **cinder** returns true if any service enabled start with **c-**
-#   **ceilometer** returns true if any service enabled start with **ceilometer**
 #   **glance** returns true if any service enabled start with **g-**
 #   **neutron** returns true if any service enabled start with **q-**
 #   **swift** returns true if any service enabled start with **s-**
@@ -1813,7 +1808,6 @@ function is_service_enabled {
         [[ ${service} == n-cell-* && ${ENABLED_SERVICES} =~ "n-cell" ]] && enabled=0
         [[ ${service} == n-cpu-* && ${ENABLED_SERVICES} =~ "n-cpu" ]] && enabled=0
         [[ ${service} == "nova" && ${ENABLED_SERVICES} =~ "n-" ]] && enabled=0
-        [[ ${service} == "ceilometer" && ${ENABLED_SERVICES} =~ "ceilometer-" ]] && enabled=0
         [[ ${service} == "glance" && ${ENABLED_SERVICES} =~ "g-" ]] && enabled=0
         [[ ${service} == "ironic" && ${ENABLED_SERVICES} =~ "ir-" ]] && enabled=0
         [[ ${service} == "neutron" && ${ENABLED_SERVICES} =~ "q-" ]] && enabled=0
diff --git a/lib/ceilometer b/lib/ceilometer
deleted file mode 100644
index c6c4c87fbc..0000000000
--- a/lib/ceilometer
+++ /dev/null
@@ -1,418 +0,0 @@
-#!/bin/bash
-#
-# lib/ceilometer
-# Install and start **Ceilometer** service
-
-# To enable a minimal set of Ceilometer services, add the following to the
-# ``localrc`` section of ``local.conf``:
-#
-#   enable_service ceilometer-acompute ceilometer-acentral ceilometer-anotification ceilometer-collector ceilometer-api
-#
-# To ensure Ceilometer alarming services are enabled also, further add to the
-# localrc section of local.conf:
-#
-#   enable_service ceilometer-alarm-notifier ceilometer-alarm-evaluator
-#
-# To enable Ceilometer to collect the IPMI based meters, further add to the
-# localrc section of local.conf:
-#
-#   enable_service ceilometer-aipmi
-#
-# NOTE: Currently, there are two ways to get the IPMI based meters in
-# OpenStack. One way is to configure Ironic conductor to report those meters
-# for the nodes managed by Ironic and to have Ceilometer notification
-# agent to collect them. Ironic by default does NOT enable that reporting
-# functionality. So in order to do so, users need to set the option of
-# conductor.send_sensor_data to true in the ironic.conf configuration file
-# for the Ironic conductor service, and also enable the
-# ceilometer-anotification service.
-#
-# The other way is to use Ceilometer ipmi agent only to get the IPMI based
-# meters. To avoid duplicated meters, users need to make sure to set the
-# option of conductor.send_sensor_data to false in the ironic.conf
-# configuration file if the node on which Ceilometer ipmi agent is running
-# is also managed by Ironic.
-#
-# Several variables set in the localrc section adjust common behaviors
-# of Ceilometer (see within for additional settings):
-#
-#   CEILOMETER_USE_MOD_WSGI:       When True, run the api under mod_wsgi.
-#   CEILOMETER_PIPELINE_INTERVAL:  Seconds between pipeline processing runs. Default 600.
-#   CEILOMETER_BACKEND:            Database backend (e.g. 'mysql', 'mongodb', 'es')
-#   CEILOMETER_COORDINATION_URL:   URL for group membership service provided by tooz.
-#   CEILOMETER_EVENTS:             Enable event collection
-
-# Dependencies:
-#
-# - functions
-# - OS_AUTH_URL for auth in api
-# - DEST set to the destination directory
-# - SERVICE_PASSWORD, SERVICE_TENANT_NAME for auth in api
-# - STACK_USER service user
-
-# stack.sh
-# ---------
-# - install_ceilometer
-# - configure_ceilometer
-# - init_ceilometer
-# - start_ceilometer
-# - stop_ceilometer
-# - cleanup_ceilometer
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default directories
-GITDIR["python-ceilometerclient"]=$DEST/python-ceilometerclient
-GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
-
-CEILOMETER_DIR=$DEST/ceilometer
-CEILOMETER_CONF_DIR=/etc/ceilometer
-CEILOMETER_CONF=$CEILOMETER_CONF_DIR/ceilometer.conf
-CEILOMETER_API_LOG_DIR=/var/log/ceilometer-api
-CEILOMETER_AUTH_CACHE_DIR=${CEILOMETER_AUTH_CACHE_DIR:-/var/cache/ceilometer}
-CEILOMETER_WSGI_DIR=${CEILOMETER_WSGI_DIR:-/var/www/ceilometer}
-
-# Support potential entry-points console scripts in VENV or not
-if [[ ${USE_VENV} = True ]]; then
-    PROJECT_VENV["ceilometer"]=${CEILOMETER_DIR}.venv
-    CEILOMETER_BIN_DIR=${PROJECT_VENV["ceilometer"]}/bin
-else
-    CEILOMETER_BIN_DIR=$(get_python_exec_prefix)
-fi
-
-# Set up database backend
-CEILOMETER_BACKEND=${CEILOMETER_BACKEND:-mysql}
-
-# Ceilometer connection info.
-CEILOMETER_SERVICE_PROTOCOL=http
-CEILOMETER_SERVICE_HOST=$SERVICE_HOST
-CEILOMETER_SERVICE_PORT=${CEILOMETER_SERVICE_PORT:-8777}
-CEILOMETER_USE_MOD_WSGI=$(trueorfalse False CEILOMETER_USE_MOD_WSGI)
-
-# To enable OSprofiler change value of this variable to "notifications,profiler"
-CEILOMETER_NOTIFICATION_TOPICS=${CEILOMETER_NOTIFICATION_TOPICS:-notifications}
-CEILOMETER_EVENTS=${CEILOMETER_EVENTS:-True}
-
-CEILOMETER_COORDINATION_URL=${CEILOMETER_COORDINATION_URL:-}
-CEILOMETER_PIPELINE_INTERVAL=${CEILOMETER_PIPELINE_INTERVAL:-}
-
-
-# Functions
-# ---------
-
-# Test if any Ceilometer services are enabled
-# is_ceilometer_enabled
-function is_ceilometer_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"ceilometer-" ]] && return 0
-    return 1
-}
-
-# create_ceilometer_accounts() - Set up common required Ceilometer accounts
-#
-# Project              User         Roles
-# ------------------------------------------------------------------
-# SERVICE_TENANT_NAME  ceilometer   admin
-# SERVICE_TENANT_NAME  ceilometer   ResellerAdmin (if Swift is enabled)
-function create_ceilometer_accounts {
-
-    # Ceilometer
-    if [[ "$ENABLED_SERVICES" =~ "ceilometer-api" ]]; then
-
-        create_service_user "ceilometer" "admin"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            get_or_create_service "ceilometer" "metering" "OpenStack Telemetry Service"
-            get_or_create_endpoint "metering" \
-                "$REGION_NAME" \
-                "$CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/" \
-                "$CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/" \
-                "$CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/"
-        fi
-        if is_service_enabled swift; then
-            # Ceilometer needs ResellerAdmin role to access Swift account stats.
-            get_or_add_user_project_role "ResellerAdmin" "ceilometer" $SERVICE_TENANT_NAME
-        fi
-    fi
-}
-
-
-# _cleanup_keystone_apache_wsgi() - Remove WSGI files, disable and remove Apache vhost file
-function _cleanup_ceilometer_apache_wsgi {
-    sudo rm -f $CEILOMETER_WSGI_DIR/*
-    sudo rm -f $(apache_site_config_for ceilometer)
-}
-
-# cleanup_ceilometer() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_ceilometer {
-    if [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
-        mongo ceilometer --eval "db.dropDatabase();"
-    elif [ "$CEILOMETER_BACKEND" = 'es' ] ; then
-        curl -XDELETE "localhost:9200/events_*"
-    fi
-    if [ "$CEILOMETER_USE_MOD_WSGI" == "True" ]; then
-        _cleanup_ceilometer_apache_wsgi
-    fi
-}
-
-function _config_ceilometer_apache_wsgi {
-    sudo mkdir -p $CEILOMETER_WSGI_DIR
-
-    local ceilometer_apache_conf=$(apache_site_config_for ceilometer)
-    local apache_version=$(get_apache_version)
-    local venv_path=""
-
-    # Copy proxy vhost and wsgi file
-    sudo cp $CEILOMETER_DIR/ceilometer/api/app.wsgi $CEILOMETER_WSGI_DIR/app
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["ceilometer"]}/lib/$(python_version)/site-packages"
-    fi
-
-    sudo cp $FILES/apache-ceilometer.template $ceilometer_apache_conf
-    sudo sed -e "
-        s|%PORT%|$CEILOMETER_SERVICE_PORT|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%WSGIAPP%|$CEILOMETER_WSGI_DIR/app|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $ceilometer_apache_conf
-}
-
-# configure_ceilometer() - Set config files, create data dirs, etc
-function configure_ceilometer {
-    sudo install -d -o $STACK_USER -m 755 $CEILOMETER_CONF_DIR $CEILOMETER_API_LOG_DIR
-
-    iniset_rpc_backend ceilometer $CEILOMETER_CONF
-
-    iniset $CEILOMETER_CONF DEFAULT notification_topics "$CEILOMETER_NOTIFICATION_TOPICS"
-    iniset $CEILOMETER_CONF DEFAULT verbose True
-    iniset $CEILOMETER_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
-
-    if [[ -n "$CEILOMETER_COORDINATION_URL" ]]; then
-        iniset $CEILOMETER_CONF coordination backend_url $CEILOMETER_COORDINATION_URL
-        iniset $CEILOMETER_CONF compute workload_partitioning True
-    fi
-
-    # Install the policy file for the API server
-    cp $CEILOMETER_DIR/etc/ceilometer/policy.json $CEILOMETER_CONF_DIR
-    iniset $CEILOMETER_CONF oslo_policy policy_file $CEILOMETER_CONF_DIR/policy.json
-
-    cp $CEILOMETER_DIR/etc/ceilometer/pipeline.yaml $CEILOMETER_CONF_DIR
-    cp $CEILOMETER_DIR/etc/ceilometer/event_pipeline.yaml $CEILOMETER_CONF_DIR
-    cp $CEILOMETER_DIR/etc/ceilometer/api_paste.ini $CEILOMETER_CONF_DIR
-    cp $CEILOMETER_DIR/etc/ceilometer/event_definitions.yaml $CEILOMETER_CONF_DIR
-    cp $CEILOMETER_DIR/etc/ceilometer/gnocchi_archive_policy_map.yaml $CEILOMETER_CONF_DIR
-    cp $CEILOMETER_DIR/etc/ceilometer/gnocchi_resources.yaml $CEILOMETER_CONF_DIR
-
-    if [ "$CEILOMETER_PIPELINE_INTERVAL" ]; then
-        sed -i "s/interval:.*/interval: ${CEILOMETER_PIPELINE_INTERVAL}/" $CEILOMETER_CONF_DIR/pipeline.yaml
-    fi
-
-    # The compute and central agents need these credentials in order to
-    # call out to other services' public APIs.
-    # The alarm evaluator needs these options to call ceilometer APIs
-    iniset $CEILOMETER_CONF service_credentials os_username ceilometer
-    iniset $CEILOMETER_CONF service_credentials os_password $SERVICE_PASSWORD
-    iniset $CEILOMETER_CONF service_credentials os_tenant_name $SERVICE_TENANT_NAME
-    iniset $CEILOMETER_CONF service_credentials os_region_name $REGION_NAME
-    iniset $CEILOMETER_CONF service_credentials os_auth_url $KEYSTONE_SERVICE_URI/v2.0
-
-    configure_auth_token_middleware $CEILOMETER_CONF ceilometer $CEILOMETER_AUTH_CACHE_DIR
-
-    iniset $CEILOMETER_CONF notification store_events $CEILOMETER_EVENTS
-
-    if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] ; then
-        iniset $CEILOMETER_CONF database alarm_connection $(database_connection_url ceilometer)
-        iniset $CEILOMETER_CONF database event_connection $(database_connection_url ceilometer)
-        iniset $CEILOMETER_CONF database metering_connection $(database_connection_url ceilometer)
-        iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
-    elif [ "$CEILOMETER_BACKEND" = 'es' ] ; then
-        # es is only supported for events. we will use sql for alarming/metering.
-        iniset $CEILOMETER_CONF database alarm_connection $(database_connection_url ceilometer)
-        iniset $CEILOMETER_CONF database event_connection es://localhost:9200
-        iniset $CEILOMETER_CONF database metering_connection $(database_connection_url ceilometer)
-        iniset $CEILOMETER_CONF DEFAULT collector_workers $API_WORKERS
-        ${TOP_DIR}/pkg/elasticsearch.sh start
-        cleanup_ceilometer
-    elif [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
-        iniset $CEILOMETER_CONF database alarm_connection mongodb://localhost:27017/ceilometer
-        iniset $CEILOMETER_CONF database event_connection mongodb://localhost:27017/ceilometer
-        iniset $CEILOMETER_CONF database metering_connection mongodb://localhost:27017/ceilometer
-        configure_mongodb
-        cleanup_ceilometer
-    else
-        die $LINENO "Unable to configure unknown CEILOMETER_BACKEND $CEILOMETER_BACKEND"
-    fi
-
-    if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-        iniset $CEILOMETER_CONF DEFAULT hypervisor_inspector vsphere
-        iniset $CEILOMETER_CONF vmware host_ip "$VMWAREAPI_IP"
-        iniset $CEILOMETER_CONF vmware host_username "$VMWAREAPI_USER"
-        iniset $CEILOMETER_CONF vmware host_password "$VMWAREAPI_PASSWORD"
-    fi
-
-    if [ "$CEILOMETER_USE_MOD_WSGI" == "True" ]; then
-        iniset $CEILOMETER_CONF api pecan_debug "False"
-        _config_ceilometer_apache_wsgi
-    fi
-
-    if is_service_enabled ceilometer-aipmi; then
-        # Configure rootwrap for the ipmi agent
-        configure_rootwrap ceilometer
-    fi
-}
-
-function configure_mongodb {
-    # Server package is the same on all
-    local packages=mongodb-server
-
-    if is_fedora; then
-        # mongodb client
-        packages="${packages} mongodb"
-    fi
-
-    install_package ${packages}
-
-    if is_fedora; then
-        # Ensure smallfiles is selected to minimize freespace requirements
-        sudo sed -i '/--smallfiles/!s/OPTIONS=\"/OPTIONS=\"--smallfiles /' /etc/sysconfig/mongod
-
-        restart_service mongod
-    fi
-
-    # Give mongodb time to start-up
-    sleep 5
-}
-
-# init_ceilometer() - Initialize etc.
-function init_ceilometer {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $CEILOMETER_AUTH_CACHE_DIR
-    rm -f $CEILOMETER_AUTH_CACHE_DIR/*
-
-    if is_service_enabled mysql postgresql; then
-        if [ "$CEILOMETER_BACKEND" = 'mysql' ] || [ "$CEILOMETER_BACKEND" = 'postgresql' ] || [ "$CEILOMETER_BACKEND" = 'es' ] ; then
-            recreate_database ceilometer
-            $CEILOMETER_BIN_DIR/ceilometer-dbsync
-        fi
-    fi
-}
-
-# install_redis() - Install the redis server.
-function install_redis {
-    if is_ubuntu; then
-        install_package redis-server
-        restart_service redis-server
-    else
-        # This will fail (correctly) where a redis package is unavailable
-        install_package redis
-        restart_service redis
-    fi
-}
-
-# install_ceilometer() - Collect source and prepare
-function install_ceilometer {
-    git_clone $CEILOMETER_REPO $CEILOMETER_DIR $CEILOMETER_BRANCH
-    setup_develop $CEILOMETER_DIR
-
-    if echo $CEILOMETER_COORDINATION_URL | grep -q '^memcached:'; then
-        install_package memcached
-    elif echo $CEILOMETER_COORDINATION_URL | grep -q '^redis:'; then
-        install_redis
-    fi
-
-    if [ "$CEILOMETER_BACKEND" = 'mongodb' ] ; then
-        pip_install_gr pymongo
-    fi
-
-    # Only install virt drivers if we're running nova compute
-    if is_service_enabled n-cpu ; then
-        if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
-            pip_install_gr libvirt-python
-        fi
-
-        if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-            pip_install_gr oslo.vmware
-        fi
-    fi
-
-    if [ "$CEILOMETER_BACKEND" = 'es' ] ; then
-        ${TOP_DIR}/pkg/elasticsearch.sh download
-        ${TOP_DIR}/pkg/elasticsearch.sh install
-    fi
-}
-
-# install_ceilometerclient() - Collect source and prepare
-function install_ceilometerclient {
-    if use_library_from_git "python-ceilometerclient"; then
-        git_clone_by_name "python-ceilometerclient"
-        setup_dev_lib "python-ceilometerclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-ceilometerclient"]}/tools/,/etc/bash_completion.d/}ceilometer.bash_completion
-    fi
-}
-
-# start_ceilometer() - Start running processes, including screen
-function start_ceilometer {
-    run_process ceilometer-acentral "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces central --config-file $CEILOMETER_CONF"
-    run_process ceilometer-anotification "$CEILOMETER_BIN_DIR/ceilometer-agent-notification --config-file $CEILOMETER_CONF"
-    run_process ceilometer-collector "$CEILOMETER_BIN_DIR/ceilometer-collector --config-file $CEILOMETER_CONF"
-    run_process ceilometer-aipmi "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces ipmi --config-file $CEILOMETER_CONF"
-
-    if [[ "$CEILOMETER_USE_MOD_WSGI" == "False" ]]; then
-        run_process ceilometer-api "$CEILOMETER_BIN_DIR/ceilometer-api -d -v --log-dir=$CEILOMETER_API_LOG_DIR --config-file $CEILOMETER_CONF"
-    else
-        enable_apache_site ceilometer
-        restart_apache_server
-        tail_log ceilometer /var/log/$APACHE_NAME/ceilometer.log
-        tail_log ceilometer-api /var/log/$APACHE_NAME/ceilometer_access.log
-    fi
-
-
-    # Start the compute agent last to allow time for the collector to
-    # fully wake up and connect to the message bus. See bug #1355809
-    if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
-        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces compute --config-file $CEILOMETER_CONF" $LIBVIRT_GROUP
-    fi
-    if [[ "$VIRT_DRIVER" = 'vsphere' ]]; then
-        run_process ceilometer-acompute "$CEILOMETER_BIN_DIR/ceilometer-polling --polling-namespaces compute --config-file $CEILOMETER_CONF"
-    fi
-
-    # Only die on API if it was actually intended to be turned on
-    if is_service_enabled ceilometer-api; then
-        echo "Waiting for ceilometer-api to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $CEILOMETER_SERVICE_PROTOCOL://$CEILOMETER_SERVICE_HOST:$CEILOMETER_SERVICE_PORT/v2/; then
-            die $LINENO "ceilometer-api did not start"
-        fi
-    fi
-
-    run_process ceilometer-alarm-notifier "$CEILOMETER_BIN_DIR/ceilometer-alarm-notifier --config-file $CEILOMETER_CONF"
-    run_process ceilometer-alarm-evaluator "$CEILOMETER_BIN_DIR/ceilometer-alarm-evaluator --config-file $CEILOMETER_CONF"
-}
-
-# stop_ceilometer() - Stop running processes
-function stop_ceilometer {
-    if [ "$CEILOMETER_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site ceilometer
-        restart_apache_server
-    fi
-    # Kill the ceilometer screen windows
-    for serv in ceilometer-acompute ceilometer-acentral ceilometer-aipmi ceilometer-anotification ceilometer-collector ceilometer-api ceilometer-alarm-notifier ceilometer-alarm-evaluator; do
-        stop_process $serv
-    done
-}
-
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index accfd0ac3e..8a9a28fd67 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1,9 +1,8 @@
 #!/usr/bin/env bash
 
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
-# installs and configures various combinations of **Ceilometer**, **Cinder**,
-# **Glance**, **Heat**, **Horizon**, **Keystone**, **Nova**, **Neutron**,
-# and **Swift**
+# installs and configures various combinations of **Cinder**, **Glance**,
+# **Heat**, **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
 
 # This script's options can be changed by setting appropriate environment
 # variables.  You can configure things like which git repositories to use,
@@ -542,7 +541,6 @@ source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
@@ -826,13 +824,6 @@ if is_service_enabled horizon; then
     configure_horizon
 fi
 
-if is_service_enabled ceilometer; then
-    install_ceilometerclient
-    stack_install_service ceilometer
-    echo_summary "Configuring Ceilometer"
-    configure_ceilometer
-fi
-
 if is_service_enabled heat; then
     stack_install_service heat
     install_heat_other
@@ -1008,10 +999,6 @@ if is_service_enabled keystone; then
     create_cinder_accounts
     create_neutron_accounts
 
-    if is_service_enabled ceilometer; then
-        create_ceilometer_accounts
-    fi
-
     if is_service_enabled swift; then
         create_swift_accounts
     fi
@@ -1255,11 +1242,6 @@ if is_service_enabled cinder; then
     start_cinder
     create_volume_types
 fi
-if is_service_enabled ceilometer; then
-    echo_summary "Starting Ceilometer"
-    init_ceilometer
-    start_ceilometer
-fi
 
 # Configure and launch Heat engine, api and metadata
 if is_service_enabled heat; then
diff --git a/stackrc b/stackrc
index ca897a1c4d..12c315ad78 100644
--- a/stackrc
+++ b/stackrc
@@ -181,10 +181,6 @@ REQUIREMENTS_DIR=$DEST/requirements
 #
 ##############
 
-# telemetry service
-CEILOMETER_REPO=${CEILOMETER_REPO:-${GIT_BASE}/openstack/ceilometer.git}
-CEILOMETER_BRANCH=${CEILOMETER_BRANCH:-master}
-
 # block storage service
 CINDER_REPO=${CINDER_REPO:-${GIT_BASE}/openstack/cinder.git}
 CINDER_BRANCH=${CINDER_BRANCH:-master}
@@ -258,10 +254,6 @@ GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
 #
 ##############
 
-# ceilometer client library
-GITREPO["python-ceilometerclient"]=${CEILOMETERCLIENT_REPO:-${GIT_BASE}/openstack/python-ceilometerclient.git}
-GITBRANCH["python-ceilometerclient"]=${CEILOMETERCLIENT_BRANCH:-master}
-
 # volume client
 GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
 GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
@@ -449,6 +441,7 @@ SWIFT3_BRANCH=${SWIFT3_BRANCH:-master}
 # ceilometer middleware
 GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
 GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
+GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 
 # os-brick library to manage local volume attaches
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index cf6ec1cbff..8e8c0227a9 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -37,7 +37,7 @@ ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
 ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
-ALL_LIBS+=" python-ceilometerclient oslo.utils python-swiftclient"
+ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
diff --git a/unstack.sh b/unstack.sh
index 10e595809a..6fa8314d4e 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -65,7 +65,6 @@ source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/ceilometer
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
@@ -104,10 +103,6 @@ if is_service_enabled heat; then
     stop_heat
 fi
 
-if is_service_enabled ceilometer; then
-    stop_ceilometer
-fi
-
 if is_service_enabled nova; then
     stop_nova
 fi

From 1c394829d1a6523b6b0b2f449b9ba92f5e8c472b Mon Sep 17 00:00:00 2001
From: Christian Berendt <berendt@b1-systems.de>
Date: Thu, 10 Sep 2015 12:15:16 +0200
Subject: [PATCH 0859/3333] Fix the FLOATING_RANGE in the Neutron guide

The range should be 172.18.161.0/24 and not 172.18.161.1/24.

Change-Id: I29bb24a1a278c285a00cd69188de340670891c53
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 40a5632b86..2973eb63e8 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -59,7 +59,7 @@ DevStack Configuration
 
         ## Neutron options
         Q_USE_SECGROUP=True
-        FLOATING_RANGE="172.18.161.1/24"
+        FLOATING_RANGE="172.18.161.0/24"
         FIXED_RANGE="10.0.0.0/24"
         Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"

From 3db0aad63c182a88830ec61fc048240058c02d85 Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Thu, 10 Sep 2015 11:15:39 +0000
Subject: [PATCH 0860/3333] Fix is_service_enabled when using multiple
 arguments

is_service_enabled might actually fail to return the expected result if
there is a is_${service}_enabled function available and multiple
services are checked.

For example, if one defines swift as a service but disables glance, the
following check fails:

 if is_service_enabled swift glance horizon; then
     install_swiftclient
 fi

This is because the second for-iteration resets the local "enabled" var
again to 1 and finally exits with 1 as a return code.

This patch fixes this.

Change-Id: Ic76b72897efe9597d1412470353895001a1a4c66
---
 functions-common | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 446de5374f..705c3149dd 100644
--- a/functions-common
+++ b/functions-common
@@ -1803,8 +1803,7 @@ function is_service_enabled {
         # Look for top-level 'enabled' function for this service
         if type is_${service}_enabled >/dev/null 2>&1; then
             # A function exists for this service, use it
-            is_${service}_enabled
-            enabled=$?
+            is_${service}_enabled && enabled=0
         fi
 
         # TODO(dtroyer): Remove these legacy special-cases after the is_XXX_enabled()

From 17fe88a72c65fa1f926f3ada5a0cfb45bf6649a9 Mon Sep 17 00:00:00 2001
From: Hidekazu Nakamura <hid-nakamura@vf.jp.nec.com>
Date: Fri, 11 Sep 2015 19:50:26 +0900
Subject: [PATCH 0861/3333] Fix typo in lib/keystone

nonadmin => nonadmins

Change-Id: I9d51e079c10f7c48b962a1d6f4577e8a6ec4a229
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index e2448c9068..6520fc6035 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -353,7 +353,7 @@ function configure_keystone_extensions {
 # Group                Users      Roles                 Tenant
 # ------------------------------------------------------------------
 # admins               admin      admin                 admin
-# nonadmin             demo       Member, anotherrole   demo
+# nonadmins            demo       Member, anotherrole   demo
 
 
 # Migrated from keystone_data.sh

From 2105b9f9ce325394d205d9c5f7a7427141bc4ebd Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 10 Sep 2015 14:01:40 -0400
Subject: [PATCH 0862/3333] move back to editable install for oslo

Now that we don't have namespace packages any more, editable installs
should be fine. This also means that we apply constraints to these
libraries during installation, which is important for future testing.

This is needed in order to be able to easily sanity check
LIBS_FROM_GIT, as then all libs installed from git will have pip urls
with git in them.

Change-Id: I46c3b8f943b97f912eccc7278e3e033ae67e7e31
---
 lib/infra | 2 +-
 lib/oslo  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/infra b/lib/infra
index 89397de792..ab32efecd9 100644
--- a/lib/infra
+++ b/lib/infra
@@ -41,7 +41,7 @@ function install_infra {
     # Install pbr
     if use_library_from_git "pbr"; then
         git_clone_by_name "pbr"
-        setup_lib "pbr"
+        setup_dev_lib "pbr"
     else
         # Always upgrade pbr to latest version as we may have pulled it
         # in via system packages.
diff --git a/lib/oslo b/lib/oslo
index 123572cd7b..f64f327ccd 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -59,7 +59,7 @@ function _do_install_oslo_lib {
     local name=$1
     if use_library_from_git "$name"; then
         git_clone_by_name "$name"
-        setup_lib "$name"
+        setup_dev_lib "$name"
     fi
 }
 

From c71973eb04d05c2497eb930c4e1b59dcaf983085 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 8 Sep 2015 07:12:48 -0400
Subject: [PATCH 0863/3333] check LIBS_FROM_GIT

after the glance_store vs. upper-constraints bug, it's probably worth
actually enforcing and sanity checking that devstack is doing what
it's being asked of with LIBS_FROM_GIT. This will hopefully reduce
user generated error.

This *might* not work with the current oslo naming, we'll have to test
and normalize that.

Change-Id: Iffef2007f99a0e932b68c4c897ebbfb748cac2b4
---
 inc/python | 22 ++++++++++++++++++++++
 stack.sh   |  7 +++++++
 2 files changed, 29 insertions(+)

diff --git a/inc/python b/inc/python
index 5c9dc5c3e5..210a9dbdfe 100644
--- a/inc/python
+++ b/inc/python
@@ -157,6 +157,28 @@ function use_library_from_git {
     return $enabled
 }
 
+# determine if a package was installed from git
+function lib_installed_from_git {
+    local name=$1
+    pip freeze 2>/dev/null | grep -- "$name" | grep -q -- '-e git'
+}
+
+# check that everything that's in LIBS_FROM_GIT was actually installed
+# correctly, this helps double check issues with library fat fingering.
+function check_libs_from_git {
+    local lib=""
+    local not_installed=""
+    for lib in $(echo ${LIBS_FROM_GIT} | tr "," " "); do
+        if ! lib_installed_from_git "$lib"; then
+            not_installed+=" $lib"
+        fi
+    done
+    # if anything is not installed, say what it is.
+    if [[ -n "$not_installed" ]]; then
+        die $LINENO "The following LIBS_FROM_GIT were not installed correct: $not_installed"
+    fi
+}
+
 # setup a library by name. If we are trying to use the library from
 # git, we'll do a git based install, otherwise we'll punt and the
 # library should be installed by a requirements pull from another
diff --git a/stack.sh b/stack.sh
index accfd0ac3e..638d471654 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1373,9 +1373,16 @@ if [[ -x $TOP_DIR/local.sh ]]; then
     $TOP_DIR/local.sh
 fi
 
+# Sanity checks
+# =============
+
 # Check the status of running services
 service_check
 
+# ensure that all the libraries we think we installed from git,
+# actually were.
+check_libs_from_git
+
 
 # Bash completion
 # ===============

From be65c6f88d5922e356178a2958afa9ae452fb85e Mon Sep 17 00:00:00 2001
From: Wei Jiangang <weijg.fnst@cn.fujitsu.com>
Date: Mon, 14 Sep 2015 18:52:47 +0800
Subject: [PATCH 0864/3333] Fix typos in stackrc and unstack.sh

Componets => Components
pluggins => plugins

Change-Id: I82634a55fd5895599099c94817af7d8d2f602859
---
 stackrc    | 2 +-
 unstack.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 156cb1f85a..05956ee0b2 100644
--- a/stackrc
+++ b/stackrc
@@ -255,7 +255,7 @@ GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
 
 ##############
 #
-#  OpenStack Client Library Componets
+#  OpenStack Client Library Components
 #
 ##############
 
diff --git a/unstack.sh b/unstack.sh
index 10e595809a..27d6719af9 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -45,7 +45,7 @@ fi
 # Configure Projects
 # ==================
 
-# Plugin Phase 0: override_defaults - allow pluggins to override
+# Plugin Phase 0: override_defaults - allow plugins to override
 # defaults before other services are run
 run_phase override_defaults
 

From a29434460e869b7bb397044d8f073531e4ee112d Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Tue, 23 Jun 2015 19:09:34 +0300
Subject: [PATCH 0865/3333] Disable Cinder v1 API support by default

Cinder API v1 will be removed Mitaka so we don't need to setup it be
default.

To enable Cinder API v1 you need to set CINDER_ENABLE_V1_API=True in
your Devstack config.

Related-Bug: #1467589

Depends-On: I6916eb3e4b7c85f37be8b365b11ca8b48f88177c
Change-Id: I0754e357433cfcd9fde7e937a4a1b440580b6289
---
 doc/source/configuration.rst |  7 +++++++
 lib/cinder                   | 29 +++++++++++++++++------------
 lib/tempest                  |  9 +++++++++
 3 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 983f5c0aae..3bd246d870 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -587,6 +587,13 @@ with ``VOLUME_BACKING_FILE_SIZE``.
         VOLUME_BACKING_FILE_SIZE=10250M
 
 
+Cinder v1 API is depricated and disabled by default. You can enable v1 API by
+setting ``CINDER_ENABLE_V1_API`` to ``True``.
+
+    ::
+        CINDER_ENABLE_V1_API=True
+
+
 Keystone
 ~~~~~~~~
 
diff --git a/lib/cinder b/lib/cinder
index 26277ccaba..f0b0f1d7e5 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -27,6 +27,9 @@ set +o xtrace
 # Defaults
 # --------
 
+# NOTE (e0ne): Cinder API v1 is deprecated and will be disabled by default.
+CINDER_ENABLE_V1_API=$(trueorfalse False CINDER_ENABLE_V1_API)
+
 # set up default driver
 CINDER_DRIVER=${CINDER_DRIVER:-default}
 CINDER_PLUGINS=$TOP_DIR/lib/cinder_plugins
@@ -225,9 +228,12 @@ function configure_cinder {
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     # NOTE(thingee): Cinder V1 API is deprecated and defaults to off as of
-    # Juno. Keep it enabled so we can continue testing while it's still
-    # supported.
-    iniset $CINDER_CONF DEFAULT enable_v1_api true
+    # Juno.
+    if [[ ${CINDER_ENABLE_V1_API} = True ]]; then
+        iniset $CINDER_CONF DEFAULT enable_v1_api true
+    else
+        iniset $CINDER_CONF DEFAULT enable_v1_api false
+    fi
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
@@ -326,12 +332,13 @@ function create_cinder_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            get_or_create_service "cinder" "volume" "Cinder Volume Service"
-            get_or_create_endpoint "volume" "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
-
+            if [[ ${CINDER_ENABLE_V1_API} = True ]]; then
+                get_or_create_service "cinder" "volume" "Cinder Volume Service"
+                get_or_create_endpoint "volume" "$REGION_NAME" \
+                    "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+                    "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+                    "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
+            fi
             get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
             get_or_create_endpoint "volumev2" "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
@@ -482,9 +489,7 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            # FIXME(jamielennox): Remove --os-volume-api-version pinning when
-            # osc supports volume type create on v2 api. bug #1475060
-            openstack volume type create --os-volume-api-version 1 --property volume_backend_name="${be_name}" ${be_name}
+            openstack volume type create --os-volume-api-version 2 --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }
diff --git a/lib/tempest b/lib/tempest
index d372e0f6ca..3624b9605e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -494,6 +494,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi
 
+    # Use only Cinder API v2
+    if [[ ${CINDER_ENABLE_V1_API} = True ]]; then
+        iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 True
+        iniset $TEMPEST_CONFIG volume catalog_type volume
+    else
+        iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 False
+        iniset $TEMPEST_CONFIG volume catalog_type volumev2
+    fi
+
     # Using ``CINDER_ENABLED_BACKENDS``
     if [[ -n "$CINDER_ENABLED_BACKENDS" ]] && [[ $CINDER_ENABLED_BACKENDS =~ .*,.* ]]; then
         iniset $TEMPEST_CONFIG volume-feature-enabled multi_backend "True"

From 624ab1e65dac94572de04e4a12b28d31e342faf1 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Thu, 30 Apr 2015 08:54:15 +0200
Subject: [PATCH 0866/3333] Remove Zaqar from devstack

Zaqar's devstack code has been moved into a plugin in the Zaqar repo.
This patch removes the remaining code from devstack.

Depends-On: Iceefabb6cd528b23075a91e8039b8264eb3f33f5
Change-Id: Ifcf54fa2d4a5bf49b6757b593bb70cdeda8edb2a
---
 doc/source/index.rst    |   4 +-
 exercises/zaqar.sh      |  43 --------
 extras.d/70-zaqar.sh    |  29 ------
 files/debs/zaqar-server |   4 -
 files/rpms/zaqar-server |   5 -
 lib/tempest             |   2 +-
 lib/zaqar               | 225 ----------------------------------------
 7 files changed, 2 insertions(+), 310 deletions(-)
 delete mode 100755 exercises/zaqar.sh
 delete mode 100644 extras.d/70-zaqar.sh
 delete mode 100644 files/debs/zaqar-server
 delete mode 100644 files/rpms/zaqar-server
 delete mode 100644 lib/zaqar

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2dd0241fba..21fec590ef 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -173,7 +173,7 @@ Scripts
 * `lib/swift <lib/swift.html>`__
 * `lib/tempest <lib/tempest.html>`__
 * `lib/tls <lib/tls.html>`__
-* `lib/zaqar <lib/zaqar.html>`__
+* `lib/trove <lib/trove.html>`__
 * `unstack.sh <unstack.sh.html>`__
 * `clean.sh <clean.sh.html>`__
 * `run\_tests.sh <run_tests.sh.html>`__
@@ -181,7 +181,6 @@ Scripts
 * `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
 * `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
-* `extras.d/70-zaqar.sh <extras.d/70-zaqar.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
 
 * `inc/ini-config <inc/ini-config.html>`__
@@ -239,4 +238,3 @@ Exercises
 * `exercises/sec\_groups.sh <exercises/sec_groups.sh.html>`__
 * `exercises/swift.sh <exercises/swift.sh.html>`__
 * `exercises/volumes.sh <exercises/volumes.sh.html>`__
-* `exercises/zaqar.sh <exercises/zaqar.sh.html>`__
diff --git a/exercises/zaqar.sh b/exercises/zaqar.sh
deleted file mode 100755
index c370b12c85..0000000000
--- a/exercises/zaqar.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env bash
-
-# **zaqar.sh**
-
-# Sanity check that Zaqar started if enabled
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-is_service_enabled zaqar-server || exit 55
-
-$CURL_GET http://$SERVICE_HOST:8888/v1/ 2>/dev/null | grep -q 'queue_name' || die $LINENO "Zaqar API not functioning!"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/extras.d/70-zaqar.sh b/extras.d/70-zaqar.sh
deleted file mode 100644
index 63c4fd5ad5..0000000000
--- a/extras.d/70-zaqar.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-# zaqar.sh - Devstack extras script to install Zaqar
-
-if is_service_enabled zaqar-server; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/zaqar
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing Zaqar"
-        install_zaqarclient
-        install_zaqar
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring Zaqar"
-        configure_zaqar
-        configure_zaqarclient
-
-        if is_service_enabled key; then
-            create_zaqar_accounts
-        fi
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        echo_summary "Initializing Zaqar"
-        init_zaqar
-        start_zaqar
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_zaqar
-    fi
-fi
diff --git a/files/debs/zaqar-server b/files/debs/zaqar-server
deleted file mode 100644
index 6c2a4d154a..0000000000
--- a/files/debs/zaqar-server
+++ /dev/null
@@ -1,4 +0,0 @@
-python-pymongo
-mongodb-server
-pkg-config
-redis-server # NOPRIME
\ No newline at end of file
diff --git a/files/rpms/zaqar-server b/files/rpms/zaqar-server
deleted file mode 100644
index 78806fb3f6..0000000000
--- a/files/rpms/zaqar-server
+++ /dev/null
@@ -1,5 +0,0 @@
-selinux-policy-targeted
-mongodb
-mongodb-server
-pymongo
-redis # NOPRIME
diff --git a/lib/tempest b/lib/tempest
index 71181cca21..f4d0a6dab0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -550,7 +550,7 @@ function configure_tempest {
     # this tempest service list needs to be all the services that
     # tempest supports, otherwise we can have an erroneous set of
     # defaults (something defaulting true in Tempest, but not listed here).
-    TEMPEST_SERVICES="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove,zaqar"
+    TEMPEST_SERVICES="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
     for service in ${TEMPEST_SERVICES//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"
diff --git a/lib/zaqar b/lib/zaqar
deleted file mode 100644
index aa21aac271..0000000000
--- a/lib/zaqar
+++ /dev/null
@@ -1,225 +0,0 @@
-#!/bin/bash
-#
-# lib/zaqar
-# Install and start **Zaqar** service
-
-# To enable a minimal set of Zaqar services, add the following to localrc:
-#
-#     enable_service zaqar-server
-#
-# Dependencies:
-# - functions
-# - OS_AUTH_URL for auth in api
-# - DEST set to the destination directory
-# - SERVICE_PASSWORD, SERVICE_TENANT_NAME for auth in api
-# - STACK_USER service user
-
-# stack.sh
-# ---------
-# install_zaqar
-# configure_zaqar
-# init_zaqar
-# start_zaqar
-# stop_zaqar
-# cleanup_zaqar
-# cleanup_zaqar_mongodb
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default directories
-ZAQAR_DIR=$DEST/zaqar
-ZAQARCLIENT_DIR=$DEST/python-zaqarclient
-ZAQAR_CONF_DIR=/etc/zaqar
-ZAQAR_CONF=$ZAQAR_CONF_DIR/zaqar.conf
-ZAQAR_AUTH_CACHE_DIR=${ZAQAR_AUTH_CACHE_DIR:-/var/cache/zaqar}
-
-# Support potential entry-points console scripts
-ZAQAR_BIN_DIR=$(get_python_exec_prefix)
-
-# Set up database backend
-ZAQAR_BACKEND=${ZAQAR_BACKEND:-mongodb}
-
-
-# Set Zaqar repository
-ZAQAR_REPO=${ZAQAR_REPO:-${GIT_BASE}/openstack/zaqar.git}
-ZAQAR_BRANCH=${ZAQAR_BRANCH:-master}
-
-# Set client library repository
-ZAQARCLIENT_REPO=${ZAQARCLIENT_REPO:-${GIT_BASE}/openstack/python-zaqarclient.git}
-ZAQARCLIENT_BRANCH=${ZAQARCLIENT_BRANCH:-master}
-
-# Set Zaqar Connection Info
-ZAQAR_SERVICE_HOST=${ZAQAR_SERVICE_HOST:-$SERVICE_HOST}
-ZAQAR_SERVICE_PORT=${ZAQAR_SERVICE_PORT:-8888}
-ZAQAR_SERVICE_PROTOCOL=${ZAQAR_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-
-# Functions
-# ---------
-
-# Test if any Zaqar services are enabled
-# is_zaqar_enabled
-function is_zaqar_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"zaqar-" ]] && return 0
-    return 1
-}
-
-# cleanup_zaqar() - Cleans up general things from previous
-# runs and storage specific left overs.
-function cleanup_zaqar {
-    if [ "$ZAQAR_BACKEND" = 'mongodb' ] ; then
-        cleanup_zaqar_mongodb
-    fi
-}
-
-# cleanup_zaqar_mongodb() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_zaqar_mongodb {
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! mongo zaqar --eval 'db.dropDatabase();'; do sleep 1; done"; then
-        die $LINENO "Mongo DB did not start"
-    else
-        full_version=$(mongo zaqar --eval 'db.dropDatabase();')
-        mongo_version=`echo $full_version | cut -d' ' -f4`
-        required_mongo_version='2.2'
-        if [[ $mongo_version < $required_mongo_version ]]; then
-            die $LINENO "Zaqar needs Mongo DB version >= 2.2 to run."
-        fi
-    fi
-}
-
-# configure_zaqarclient() - Set config files, create data dirs, etc
-function configure_zaqarclient {
-    setup_develop $ZAQARCLIENT_DIR
-}
-
-# configure_zaqar() - Set config files, create data dirs, etc
-function configure_zaqar {
-    setup_develop $ZAQAR_DIR
-
-    sudo install -d -o $STACK_USER -m 755 $ZAQAR_CONF_DIR
-
-    iniset $ZAQAR_CONF DEFAULT debug True
-    iniset $ZAQAR_CONF DEFAULT verbose True
-    iniset $ZAQAR_CONF DEFAULT admin_mode True
-    iniset $ZAQAR_CONF DEFAULT use_syslog $SYSLOG
-    iniset $ZAQAR_CONF 'drivers:transport:wsgi' bind $ZAQAR_SERVICE_HOST
-
-    configure_auth_token_middleware $ZAQAR_CONF zaqar $ZAQAR_AUTH_CACHE_DIR
-
-    if [ "$ZAQAR_BACKEND" = 'mysql' ] || [ "$ZAQAR_BACKEND" = 'postgresql' ] ; then
-        iniset $ZAQAR_CONF drivers storage sqlalchemy
-        iniset $ZAQAR_CONF 'drivers:storage:sqlalchemy' uri `database_connection_url zaqar`
-    elif [ "$ZAQAR_BACKEND" = 'mongodb' ] ; then
-        iniset $ZAQAR_CONF  drivers storage mongodb
-        iniset $ZAQAR_CONF 'drivers:storage:mongodb' uri mongodb://localhost:27017/zaqar
-        configure_mongodb
-    elif [ "$ZAQAR_BACKEND" = 'redis' ] ; then
-        iniset $ZAQAR_CONF  drivers storage redis
-        iniset $ZAQAR_CONF 'drivers:storage:redis' uri redis://localhost:6379
-        configure_redis
-    fi
-
-    iniset $ZAQAR_CONF DEFAULT notification_driver messaging
-    iniset $ZAQAR_CONF DEFAULT control_exchange zaqar
-
-    iniset_rpc_backend zaqar $ZAQAR_CONF
-
-    cleanup_zaqar
-}
-
-function configure_redis {
-    if is_ubuntu; then
-        install_package redis-server
-        pip_install_gr redis
-    elif is_fedora; then
-        install_package redis
-        pip_install_gr redis
-    else
-        exit_distro_not_supported "redis installation"
-    fi
-}
-
-function configure_mongodb {
-    # Set nssize to 2GB. This increases the number of namespaces supported
-    # # per database.
-    if is_ubuntu; then
-        sudo sed -i -e "
-            s|[^ \t]*#[ \t]*\(nssize[ \t]*=.*\$\)|\1|
-            s|^\(nssize[ \t]*=[ \t]*\).*\$|\1 2047|
-        " /etc/mongodb.conf
-        restart_service mongodb
-    elif is_fedora; then
-        sudo sed -i '/--nssize/!s/OPTIONS=\"/OPTIONS=\"--nssize 2047 /' /etc/sysconfig/mongod
-        restart_service mongod
-    fi
-}
-
-# init_zaqar() - Initialize etc.
-function init_zaqar {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $ZAQAR_AUTH_CACHE_DIR
-    rm -f $ZAQAR_AUTH_CACHE_DIR/*
-}
-
-# install_zaqar() - Collect source and prepare
-function install_zaqar {
-    git_clone $ZAQAR_REPO $ZAQAR_DIR $ZAQAR_BRANCH
-    setup_develop $ZAQAR_DIR
-}
-
-# install_zaqarclient() - Collect source and prepare
-function install_zaqarclient {
-    git_clone $ZAQARCLIENT_REPO $ZAQARCLIENT_DIR $ZAQARCLIENT_BRANCH
-    setup_develop $ZAQARCLIENT_DIR
-}
-
-# start_zaqar() - Start running processes, including screen
-function start_zaqar {
-    if [[ "$USE_SCREEN" = "False" ]]; then
-        run_process zaqar-server "zaqar-server --config-file $ZAQAR_CONF --daemon"
-    else
-        run_process zaqar-server "zaqar-server --config-file $ZAQAR_CONF"
-    fi
-
-    echo "Waiting for Zaqar to start..."
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget --no-proxy -q -O- $ZAQAR_SERVICE_PROTOCOL://$ZAQAR_SERVICE_HOST:$ZAQAR_SERVICE_PORT/v1/health; do sleep 1; done"; then
-        die $LINENO "Zaqar did not start"
-    fi
-}
-
-# stop_zaqar() - Stop running processes
-function stop_zaqar {
-    local serv
-    # Kill the zaqar screen windows
-    for serv in zaqar-server; do
-        screen -S $SCREEN_NAME -p $serv -X kill
-    done
-}
-
-function create_zaqar_accounts {
-    create_service_user "zaqar"
-
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        get_or_create_service "zaqar" "messaging" "Zaqar Service"
-        get_or_create_endpoint "messaging" \
-            "$REGION_NAME" \
-            "$ZAQAR_SERVICE_PROTOCOL://$ZAQAR_SERVICE_HOST:$ZAQAR_SERVICE_PORT" \
-            "$ZAQAR_SERVICE_PROTOCOL://$ZAQAR_SERVICE_HOST:$ZAQAR_SERVICE_PORT" \
-            "$ZAQAR_SERVICE_PROTOCOL://$ZAQAR_SERVICE_HOST:$ZAQAR_SERVICE_PORT"
-    fi
-
-}
-
-
-# Restore xtrace
-$XTRACE
-
-# Local variables:
-# mode: shell-script
-# End:

From 193d8a6e7c22695f33d2082bb330e3039b516a5b Mon Sep 17 00:00:00 2001
From: Fawad Khaliq <fawad@plumgrid.com>
Date: Tue, 11 Aug 2015 07:32:56 -0700
Subject: [PATCH 0867/3333] Improve PLUMgrid Install Endpoints

PLUMgrid Plugin has moved out of Neutron tree and it's new
home is openstack/networking-plumgrid[1]. With core vendor
decomposition reaching completion, this change moves
PLUMgrid Plugin install to an external DevStack plugin
for better integration.

[1] https://github.com/openstack/networking-plumgrid
[2] http://docs.openstack.org/developer/neutron/devref/contribute.html

Change-Id: I5bd6d8f611c2a134f2e8f14c074c1a4185d9c522
---
 lib/neutron_plugins/plumgrid | 58 ------------------------------------
 1 file changed, 58 deletions(-)
 delete mode 100644 lib/neutron_plugins/plumgrid

diff --git a/lib/neutron_plugins/plumgrid b/lib/neutron_plugins/plumgrid
deleted file mode 100644
index 0d711fe8b2..0000000000
--- a/lib/neutron_plugins/plumgrid
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/bash
-#
-# PLUMgrid Neutron Plugin
-# Edgar Magana emagana@plumgrid.com
-# ------------------------------------
-
-# Save trace settings
-PG_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-function neutron_plugin_create_nova_conf {
-    :
-}
-
-function neutron_plugin_setup_interface_driver {
-    :
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/plumgrid
-    Q_PLUGIN_CONF_FILENAME=plumgrid.ini
-    Q_PLUGIN_CLASS="neutron.plugins.plumgrid.plumgrid_plugin.plumgrid_plugin.NeutronPluginPLUMgridV2"
-    PLUMGRID_DIRECTOR_IP=${PLUMGRID_DIRECTOR_IP:-localhost}
-    PLUMGRID_DIRECTOR_PORT=${PLUMGRID_DIRECTOR_PORT:-7766}
-    PLUMGRID_ADMIN=${PLUMGRID_ADMIN:-username}
-    PLUMGRID_PASSWORD=${PLUMGRID_PASSWORD:-password}
-    PLUMGRID_TIMEOUT=${PLUMGRID_TIMEOUT:-70}
-    PLUMGRID_DRIVER=${PLUMGRID_DRIVER:-neutron.plugins.plumgrid.drivers.fake_plumlib.Plumlib}
-}
-
-function neutron_plugin_configure_service {
-    iniset /$Q_PLUGIN_CONF_FILE plumgriddirector director_server $PLUMGRID_DIRECTOR_IP
-    iniset /$Q_PLUGIN_CONF_FILE plumgriddirector director_server_port $PLUMGRID_DIRECTOR_PORT
-    iniset /$Q_PLUGIN_CONF_FILE plumgriddirector username $PLUMGRID_ADMIN
-    iniset /$Q_PLUGIN_CONF_FILE plumgriddirector password $PLUMGRID_PASSWORD
-    iniset /$Q_PLUGIN_CONF_FILE plumgriddirector servertimeout $PLUMGRID_TIMEOUT
-    iniset /$Q_PLUGIN_CONF_FILE plumgriddirector driver $PLUMGRID_DRIVER
-}
-
-function neutron_plugin_configure_debug_command {
-    :
-}
-
-function is_neutron_ovs_base_plugin {
-    # False
-    return 1
-}
-
-function has_neutron_plugin_security_group {
-    # return 0 means enabled
-    return 0
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
-}
-# Restore xtrace
-$PG_XTRACE

From 7c7679ecc9f1e8dffcb886aab8ef96eafcc1d9f6 Mon Sep 17 00:00:00 2001
From: dieterly <deklan.dieterly@hpe.com>
Date: Fri, 18 Sep 2015 15:10:48 -0600
Subject: [PATCH 0868/3333] Clarify new header configuration syntax

Make it clear that there are no spaces in the
new header section.

Change-Id: I69c14017820621a3aea75e41960ac3758f7e4835
---
 doc/source/configuration.rst | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 983f5c0aae..e8de7c4f70 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -18,11 +18,12 @@ A sample is provided in ``devstack/samples``
 
 The new header is similar to a normal INI section header but with double
 brackets (``[[ ... ]]``) and two internal fields separated by a pipe
-(``|``):
-
+(``|``). Note that there are no spaces between the double brackets and the
+internal fields. Likewise, there are no spaces between the pipe and the
+internal fields:
 ::
 
-    [[ <phase> | <config-file-name> ]]
+    '[[' <phase> '|' <config-file-name> ']]'
 
 where ``<phase>`` is one of a set of phase names defined by ``stack.sh``
 and ``<config-file-name>`` is the configuration filename. The filename

From 261d10080900908e3377d88a82adb47b607d0174 Mon Sep 17 00:00:00 2001
From: Christian Berendt <berendt@b1-systems.de>
Date: Sat, 19 Sep 2015 18:44:29 +0200
Subject: [PATCH 0869/3333] registry: list rally project

Change-Id: I29ec5693ad1e2c3edd5a8ed2d18a4433e4eee627
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 428efc4977..9bc7ce3f2d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,8 @@ The following are plugins that exist for official OpenStack projects.
 +--------------------+-------------------------------------------+--------------------+
 |magnum              |git://git.openstack.org/openstack/magnum   |                    |
 +--------------------+-------------------------------------------+--------------------+
+|rally               |git://git.openstack.org/openstack/rally    |                    |
++--------------------+-------------------------------------------+--------------------+
 |sahara              |git://git.openstack.org/openstack/sahara   |                    |
 +--------------------+-------------------------------------------+--------------------+
 |trove               |git://git.openstack.org/openstack/trove    |                    |

From 2a16b512640afd6290a4f023e359b83d7052a0de Mon Sep 17 00:00:00 2001
From: Christian Berendt <berendt@b1-systems.de>
Date: Sat, 19 Sep 2015 18:42:21 +0200
Subject: [PATCH 0870/3333] registry: list mistral project

Change-Id: Icbc73b3df9cedf9bd228c23b20aebf9b69c4a39c
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9bc7ce3f2d..1b54c01f54 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,8 @@ The following are plugins that exist for official OpenStack projects.
 +--------------------+-------------------------------------------+--------------------+
 |magnum              |git://git.openstack.org/openstack/magnum   |                    |
 +--------------------+-------------------------------------------+--------------------+
+|mistral             |git://git.openstack.org/openstack/mistral  |                    |
++--------------------+-------------------------------------------+--------------------+
 |rally               |git://git.openstack.org/openstack/rally    |                    |
 +--------------------+-------------------------------------------+--------------------+
 |sahara              |git://git.openstack.org/openstack/sahara   |                    |

From 91e3c1ec9a0e003e5cea08383852be6535e11c45 Mon Sep 17 00:00:00 2001
From: Wei Jiangang <weijg.fnst@cn.fujitsu.com>
Date: Mon, 21 Sep 2015 17:51:02 +0800
Subject: [PATCH 0871/3333] lib/nova: make redirects happen in correct order

It should redirect stdout to /dev/null firstly,
then redirect stderr to whatever stdout currently points at.

Change-Id: I4666fa90a96301f0b504a8501f0ffc3fe17616b0
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6441a891eb..63489502e9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -332,7 +332,7 @@ function configure_nova {
                 if [ ! -e /dev/kvm ]; then
                     echo "WARNING: Switching to QEMU"
                     LIBVIRT_TYPE=qemu
-                    if which selinuxenabled 2>&1 > /dev/null && selinuxenabled; then
+                    if which selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
                         # https://bugzilla.redhat.com/show_bug.cgi?id=753589
                         sudo setsebool virt_use_execmem on
                     fi

From e3340f1fe6a79166e50dc2a89e7a74fa038e9014 Mon Sep 17 00:00:00 2001
From: Wei Jiangang <weijg.fnst@cn.fujitsu.com>
Date: Mon, 21 Sep 2015 17:52:14 +0800
Subject: [PATCH 0872/3333] Fix typo: falure => failure

Change-Id: Ic1a53eec71d5e20194505aa8655a99b2fedd7632
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index f6a525354f..16abb65fb3 100644
--- a/functions-common
+++ b/functions-common
@@ -1453,7 +1453,7 @@ function service_check {
         return
     fi
 
-    # Check if there is any falure flag file under $SERVICE_DIR/$SCREEN_NAME
+    # Check if there is any failure flag file under $SERVICE_DIR/$SCREEN_NAME
     # make this -o errexit safe
     failures=`ls "$SERVICE_DIR/$SCREEN_NAME"/*.failure 2>/dev/null || /bin/true`
 

From bf9f9a594246e6f997c7be69910efa25b6bd80d7 Mon Sep 17 00:00:00 2001
From: dieterly <deklan.dieterly@hpe.com>
Date: Mon, 21 Sep 2015 13:24:00 -0600
Subject: [PATCH 0873/3333] Fix typo

Change 'This' -> 'These'.

Change-Id: If2f8f92d3adbb8fe4556e5c3ec53e4da31d02d49
---
 doc/source/plugins.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 803dd08a48..fda601b414 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -178,7 +178,7 @@ System Packages
 ===============
 
 Devstack provides a framework for getting packages installed at an early
-phase of its execution. This packages may be defined in a plugin as files
+phase of its execution. These packages may be defined in a plugin as files
 that contain new-line separated lists of packages required by the plugin
 
 Supported packaging systems include apt and yum across multiple distributions.

From 16a2d64f379974e7c88ef9f7879c88511e43c2eb Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 19 Sep 2015 11:19:31 -0400
Subject: [PATCH 0874/3333] Move writing of credentials earlier in the process

If something goes wrong after keystone is running with services
registered, but before credentials are written, it's hard to poke at the
existing half-running state because none of the auth information is
recorded.

Write the files right after we're done bootstrapping keystone.

Change-Id: I2f8ae86e17d26ec4defa16e843faa8987d27fac9
---
 stack.sh | 130 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 67 insertions(+), 63 deletions(-)

diff --git a/stack.sh b/stack.sh
index 700a0aecad..7184e59bc0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1034,6 +1034,73 @@ if is_service_enabled keystone; then
     export OS_REGION_NAME=$REGION_NAME
 fi
 
+# We now have a working keystone. From this point, everything can be done
+# with normal auth. Let's write out the auth config files so that if something
+# goes wrong subsequently, developers debugging have stackrc and clouds.yaml
+# files to use to poke at things
+
+# Create account rc files
+# =======================
+
+# Creates source able script files for easier user switching.
+# This step also creates certificates for tenants and users,
+# which is helpful in image bundle steps.
+
+if is_service_enabled nova && is_service_enabled keystone; then
+    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
+
+    if [ -f $SSL_BUNDLE_FILE ]; then
+        USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"
+    fi
+
+    if [[ "$HEAT_STANDALONE" = "True" ]]; then
+        USERRC_PARAMS="$USERRC_PARAMS --heat-url http://$HEAT_API_HOST:$HEAT_API_PORT/v1"
+    fi
+
+    $TOP_DIR/tools/create_userrc.sh $USERRC_PARAMS
+fi
+
+
+# Save some values we generated for later use
+save_stackenv
+
+# Update/create user clouds.yaml file.
+# clouds.yaml will have
+# - A `devstack` entry for the `demo` user for the `demo` project.
+# - A `devstack-admin` entry for the `admin` user for the `admin` project.
+
+# The location is a variable to allow for easier refactoring later to make it
+# overridable. There is currently no usecase where doing so makes sense, so
+# it's not currently configurable.
+CLOUDS_YAML=~/.config/openstack/clouds.yaml
+
+mkdir -p $(dirname $CLOUDS_YAML)
+
+CA_CERT_ARG=''
+if [ -f "$SSL_BUNDLE_FILE" ]; then
+    CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
+fi
+$TOP_DIR/tools/update_clouds_yaml.py \
+    --file $CLOUDS_YAML \
+    --os-cloud devstack \
+    --os-region-name $REGION_NAME \
+    --os-identity-api-version $IDENTITY_API_VERSION \
+    $CA_CERT_ARG \
+    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+    --os-username demo \
+    --os-password $ADMIN_PASSWORD \
+    --os-project-name demo
+$TOP_DIR/tools/update_clouds_yaml.py \
+    --file $CLOUDS_YAML \
+    --os-cloud devstack-admin \
+    --os-region-name $REGION_NAME \
+    --os-identity-api-version $IDENTITY_API_VERSION \
+    $CA_CERT_ARG \
+    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+    --os-username admin \
+    --os-password $ADMIN_PASSWORD \
+    --os-project-name admin
+
 # Horizon
 # -------
 
@@ -1275,69 +1342,6 @@ if is_service_enabled heat; then
 fi
 
 
-# Create account rc files
-# =======================
-
-# Creates source able script files for easier user switching.
-# This step also creates certificates for tenants and users,
-# which is helpful in image bundle steps.
-
-if is_service_enabled nova && is_service_enabled keystone; then
-    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
-
-    if [ -f $SSL_BUNDLE_FILE ]; then
-        USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"
-    fi
-
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        USERRC_PARAMS="$USERRC_PARAMS --heat-url http://$HEAT_API_HOST:$HEAT_API_PORT/v1"
-    fi
-
-    $TOP_DIR/tools/create_userrc.sh $USERRC_PARAMS
-fi
-
-
-# Save some values we generated for later use
-save_stackenv
-
-# Update/create user clouds.yaml file.
-# clouds.yaml will have
-# - A `devstack` entry for the `demo` user for the `demo` project.
-# - A `devstack-admin` entry for the `admin` user for the `admin` project.
-
-# The location is a variable to allow for easier refactoring later to make it
-# overridable. There is currently no usecase where doing so makes sense, so
-# it's not currently configurable.
-CLOUDS_YAML=~/.config/openstack/clouds.yaml
-
-mkdir -p $(dirname $CLOUDS_YAML)
-
-CA_CERT_ARG=''
-if [ -f "$SSL_BUNDLE_FILE" ]; then
-    CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
-fi
-$TOP_DIR/tools/update_clouds_yaml.py \
-    --file $CLOUDS_YAML \
-    --os-cloud devstack \
-    --os-region-name $REGION_NAME \
-    --os-identity-api-version $IDENTITY_API_VERSION \
-    $CA_CERT_ARG \
-    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
-    --os-username demo \
-    --os-password $ADMIN_PASSWORD \
-    --os-project-name demo
-$TOP_DIR/tools/update_clouds_yaml.py \
-    --file $CLOUDS_YAML \
-    --os-cloud devstack-admin \
-    --os-region-name $REGION_NAME \
-    --os-identity-api-version $IDENTITY_API_VERSION \
-    $CA_CERT_ARG \
-    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
-    --os-username admin \
-    --os-password $ADMIN_PASSWORD \
-    --os-project-name admin
-
-
 # Wrapup configuration
 # ====================
 

From 7224eecb98883a91e9da445baefc23a194e8fd68 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 19 Sep 2015 11:26:18 -0400
Subject: [PATCH 0875/3333] Extract writing clouds.yaml to function

It's a bit wordy to be directly in stack.sh and not in a function.

Change-Id: Ibddfd8018d861191f1b1dc3270e0e81c274733cd
---
 functions-common | 39 +++++++++++++++++++++++++++++++++++++++
 stack.sh         | 38 ++------------------------------------
 2 files changed, 41 insertions(+), 36 deletions(-)

diff --git a/functions-common b/functions-common
index 446de5374f..4fca80e14b 100644
--- a/functions-common
+++ b/functions-common
@@ -67,6 +67,45 @@ function save_stackenv {
     done
 }
 
+# Update/create user clouds.yaml file.
+# clouds.yaml will have
+# - A `devstack` entry for the `demo` user for the `demo` project.
+# - A `devstack-admin` entry for the `admin` user for the `admin` project.
+# write_clouds_yaml
+function write_clouds_yaml {
+    # The location is a variable to allow for easier refactoring later to make it
+    # overridable. There is currently no usecase where doing so makes sense, so
+    # it's not currently configurable.
+    CLOUDS_YAML=~/.config/openstack/clouds.yaml
+
+    mkdir -p $(dirname $CLOUDS_YAML)
+
+    CA_CERT_ARG=''
+    if [ -f "$SSL_BUNDLE_FILE" ]; then
+        CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
+    fi
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version $IDENTITY_API_VERSION \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+        --os-username demo \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version $IDENTITY_API_VERSION \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name admin
+}
+
 # Normalize config values to True or False
 # Accepts as False: 0 no No NO false False FALSE
 # Accepts as True: 1 yes Yes YES true True TRUE
diff --git a/stack.sh b/stack.sh
index 7184e59bc0..21760213ec 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1064,42 +1064,8 @@ fi
 # Save some values we generated for later use
 save_stackenv
 
-# Update/create user clouds.yaml file.
-# clouds.yaml will have
-# - A `devstack` entry for the `demo` user for the `demo` project.
-# - A `devstack-admin` entry for the `admin` user for the `admin` project.
-
-# The location is a variable to allow for easier refactoring later to make it
-# overridable. There is currently no usecase where doing so makes sense, so
-# it's not currently configurable.
-CLOUDS_YAML=~/.config/openstack/clouds.yaml
-
-mkdir -p $(dirname $CLOUDS_YAML)
-
-CA_CERT_ARG=''
-if [ -f "$SSL_BUNDLE_FILE" ]; then
-    CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
-fi
-$TOP_DIR/tools/update_clouds_yaml.py \
-    --file $CLOUDS_YAML \
-    --os-cloud devstack \
-    --os-region-name $REGION_NAME \
-    --os-identity-api-version $IDENTITY_API_VERSION \
-    $CA_CERT_ARG \
-    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
-    --os-username demo \
-    --os-password $ADMIN_PASSWORD \
-    --os-project-name demo
-$TOP_DIR/tools/update_clouds_yaml.py \
-    --file $CLOUDS_YAML \
-    --os-cloud devstack-admin \
-    --os-region-name $REGION_NAME \
-    --os-identity-api-version $IDENTITY_API_VERSION \
-    $CA_CERT_ARG \
-    --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
-    --os-username admin \
-    --os-password $ADMIN_PASSWORD \
-    --os-project-name admin
+# Write a clouds.yaml file
+write_clouds_yaml
 
 # Horizon
 # -------

From 31c313d3a35e1b222fdb3aa72993a27c288d10bb Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 19 Sep 2015 11:35:22 -0400
Subject: [PATCH 0876/3333] Use normal API not token/endpoint for image uploads

There is no reason to use keystone token bootstrapping for image
uploads. Glance is a service, and images can be uploaded to it normally
without special shenanigans.

Depends-On: If7b81c4a6746c8a1eb0302c96e045fb0f457d67b
Change-Id: I7092fb10cbe243e091789134263fab081af0c7f4
---
 functions | 23 ++++++++++-------------
 stack.sh  |  2 --
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/functions b/functions
index 4001e9d5f9..3dae157a0c 100644
--- a/functions
+++ b/functions
@@ -71,7 +71,7 @@ function upload_image {
     # OpenVZ-format images are provided as .tar.gz, but not decompressed prior to loading
     if [[ "$image_url" =~ 'openvz' ]]; then
         image_name="${image_fname%.tar.gz}"
-        openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
+        openstack --os-cloud=devstack-admin image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
         return
     fi
 
@@ -182,7 +182,7 @@ function upload_image {
         vmdk_adapter_type="${props[1]:-$vmdk_adapter_type}"
         vmdk_net_adapter="${props[2]:-$vmdk_net_adapter}"
 
-        openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
+        openstack --os-cloud=devstack-admin image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
         return
     fi
 
@@ -199,8 +199,7 @@ function upload_image {
             force_vm_mode="--property vm_mode=xen"
         fi
         openstack \
-            --os-token $token \
-            --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
+            --os-cloud=devstack-admin \
             image create \
             "$image_name" --public \
             --container-format=ovf --disk-format=vhd \
@@ -214,8 +213,7 @@ function upload_image {
     if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
         image_name="${image_fname%.xen-raw.tgz}"
         openstack \
-            --os-token $token \
-            --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
+            --os-cloud=devstack-admin \
             image create \
             "$image_name" --public \
             --container-format=tgz --disk-format=raw \
@@ -231,8 +229,7 @@ function upload_image {
         fi
 
         openstack \
-            --os-token $token \
-            --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
+            --os-cloud=devstack-admin \
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
@@ -314,9 +311,9 @@ function upload_image {
 
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
-            openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+            openstack --os-cloud=devstack-admin image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
         else
-            openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
+            openstack --os-cloud=devstack-admin image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi
     else
         # Use glance client to add the kernel the root filesystem.
@@ -324,12 +321,12 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
-        openstack --os-token $token --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
+        openstack --os-cloud=devstack-admin image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
     fi
 }
 
diff --git a/stack.sh b/stack.sh
index 21760213ec..3625e5f296 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1216,8 +1216,6 @@ fi
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
 if is_service_enabled g-reg; then
-    TOKEN=$(openstack token issue -c id -f value)
-    die_if_not_set $LINENO TOKEN "Keystone fail to get token"
 
     echo_summary "Uploading images"
 

From 382f982e51d6117cf8d478b94f975455dabe4ce9 Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Mon, 21 Sep 2015 14:19:52 +0000
Subject: [PATCH 0877/3333] keystone: fix prefixed URL

Commit 2ad1a42ca667ff21e6f7d2ae906be23a20430036 broke entirely the
Apache configuration for Keystone when used without a port on the
/identity URL. This patch fixes that.

Change-Id: I47805138c66456c9c5fa9af1f4ac33b03d0ce5b9
---
 files/apache-keystone.template | 34 ++++++++++++----------------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 4d3d2d6623..f9fa265db5 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -2,6 +2,16 @@ Listen %PUBLICPORT%
 Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
+<Directory %KEYSTONE_BIN%>
+    <IfVersion >= 2.4>
+        Require all granted
+    </IfVersion>
+    <IfVersion < 2.4>
+        Order allow,deny
+        Allow from all
+    </IfVersion>
+</Directory>
+
 <VirtualHost *:%PUBLICPORT%>
     WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-public
@@ -16,16 +26,6 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
-
-    <Directory %KEYSTONE_BIN%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
 </VirtualHost>
 
 <VirtualHost *:%ADMINPORT%>
@@ -42,19 +42,9 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
-
-    <Directory %KEYSTONE_BIN%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
 </VirtualHost>
 
-Alias /identity %PUBLICWSGI%
+Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
 <Location /identity>
     SetHandler wsgi-script
     Options +ExecCGI
@@ -64,7 +54,7 @@ Alias /identity %PUBLICWSGI%
     WSGIPassAuthorization On
 </Location>
 
-Alias /identity_admin %ADMINWSGI%
+Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
 <Location /identity_admin>
     SetHandler wsgi-script
     Options +ExecCGI

From 91b7fa134ccc4d58dc14f08fef4641602c98db9e Mon Sep 17 00:00:00 2001
From: Clinton Knight <cknight@netapp.com>
Date: Tue, 22 Sep 2015 09:39:23 -0700
Subject: [PATCH 0878/3333] Add manila to devstack plugin registry

Manila has had a devstack plugin since Kilo.  The registry should
reflect that.

Change-Id: I910198495e98b6f8d92c4880d1bee0c16d6c1559
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1b54c01f54..bbab56b025 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,8 @@ The following are plugins that exist for official OpenStack projects.
 +--------------------+-------------------------------------------+--------------------+
 |magnum              |git://git.openstack.org/openstack/magnum   |                    |
 +--------------------+-------------------------------------------+--------------------+
+|manila              |git://git.openstack.org/openstack/manila   | file shares        |
++--------------------+-------------------------------------------+--------------------+
 |mistral             |git://git.openstack.org/openstack/mistral  |                    |
 +--------------------+-------------------------------------------+--------------------+
 |rally               |git://git.openstack.org/openstack/rally    |                    |

From 59c6377ae51c024c28a6fba72de567bc97edda10 Mon Sep 17 00:00:00 2001
From: Roxana Gherle <roxana.gherle@hp.com>
Date: Wed, 9 Sep 2015 18:22:31 -0700
Subject: [PATCH 0879/3333] Assign admin role for admin user on default domain

This patch adds an admin role assignment for the admin user on
the default domain as part of the Keystone configuration stage.

Closes-Bug: #1494081
Change-Id: I91c88917bd51be4572e4970c94e65d866798df26
---
 functions-common | 32 ++++++++++++++++++++++++++++++++
 lib/keystone     |  1 +
 2 files changed, 33 insertions(+)

diff --git a/functions-common b/functions-common
index 446de5374f..c38a77243e 100644
--- a/functions-common
+++ b/functions-common
@@ -803,6 +803,38 @@ function get_or_add_user_project_role {
     echo $user_role_id
 }
 
+# Gets or adds user role to domain
+# Usage: get_or_add_user_domain_role <role> <user> <domain>
+function get_or_add_user_domain_role {
+    local user_role_id
+    # Gets user role id
+    user_role_id=$(openstack role list \
+        --user $2 \
+        --os-url=$KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
+        --column "ID" \
+        --domain $3 \
+        --column "Name" \
+        | grep " $1 " | get_field 1)
+    if [[ -z "$user_role_id" ]]; then
+        # Adds role to user and get it
+        openstack role add $1 \
+            --user $2 \
+            --domain $3 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3
+        user_role_id=$(openstack role list \
+            --user $2 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            --column "ID" \
+            --domain $3 \
+            --column "Name" \
+            | grep " $1 " | get_field 1)
+    fi
+    echo $user_role_id
+}
+
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
diff --git a/lib/keystone b/lib/keystone
index e2448c9068..b15abe1cb5 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -364,6 +364,7 @@ function create_keystone_accounts {
     local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
     local admin_role=$(get_or_create_role "admin")
     get_or_add_user_project_role $admin_role $admin_user $admin_tenant
+    get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
     get_or_create_project "$SERVICE_TENANT_NAME" default

From 50821bed081e94dfd4b75cf02121a42a56cdbaac Mon Sep 17 00:00:00 2001
From: Roxana Gherle <roxana.gherle@hp.com>
Date: Tue, 22 Sep 2015 10:52:46 -0700
Subject: [PATCH 0880/3333] Fix return value of get_or_add_user_project_role

get_or_add_user_project_role function was always returning an
empty user_role_id because the role assignment command does not
return any output. Added a command to get the user_role_id after
the assignment happens.

Closes-Bug: #1498599
Change-Id: If1b77eef0d4f0ebdcdf761ecb5e2011484f73871
---
 functions-common | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index cf140072fd..d230a29891 100644
--- a/functions-common
+++ b/functions-common
@@ -830,14 +830,20 @@ function get_or_add_user_project_role {
         --column "Name" \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
-        # Adds role to user
-        user_role_id=$(openstack role add \
-            $1 \
+        # Adds role to user and get it
+        openstack role add $1 \
             --user $2 \
             --project $3 \
             --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3
+        user_role_id=$(openstack role list \
+            --user $2 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3 \
-            | grep " id " | get_field 2)
+            --column "ID" \
+            --project $3 \
+            --column "Name" \
+            | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
 }

From 5aeea6ae3e2434d7b08bce2da672061cdba08ab0 Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Tue, 22 Sep 2015 19:38:02 +0000
Subject: [PATCH 0881/3333] Removed unused TOKEN from upload_image

Changeset https://review.openstack.org/#/c/225426/ changed how images
were uploaded into Glance, however the (now) unused TOKEN variable
and function argument to upload_image remained.

These have been removed.

Change-Id: I9910c469f72d52e56111048cc24ea3c992c1d480
---
 functions | 3 +--
 stack.sh  | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 3dae157a0c..ff95c89ad9 100644
--- a/functions
+++ b/functions
@@ -36,10 +36,9 @@ function function_exists {
 # - ``FILES`` must be set to the cache dir
 # - ``GLANCE_HOSTPORT``
 #
-# upload_image image-url glance-token
+# upload_image image-url
 function upload_image {
     local image_url=$1
-    local token=$2
 
     local image image_fname image_name
 
diff --git a/stack.sh b/stack.sh
index 3625e5f296..ae9c946aaa 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1225,7 +1225,7 @@ if is_service_enabled g-reg; then
     fi
 
     for image_url in ${IMAGE_URLS//,/ }; do
-        upload_image $image_url $TOKEN
+        upload_image $image_url
     done
 fi
 

From 5090142969e162e115d6eb1ea7582f68f34d8879 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Tue, 22 Sep 2015 21:20:36 +0300
Subject: [PATCH 0882/3333] Revert change
 I2f8ae86e17d26ec4defa16e843faa8987d27fac9

The commit breaks creation of user rc file.
Now devstack doesn't create certificate for user
(because it's too early to do it) and doesn't react
to changes of EC2/S3 urls if they is recreated by devstack plugins.
So the commit totally broke ec2-api gating for example.

Change-Id: I069f46f95656655ae7ba8f3dd929f47eae594b68
---
 stack.sh | 56 ++++++++++++++++++++++++++------------------------------
 1 file changed, 26 insertions(+), 30 deletions(-)

diff --git a/stack.sh b/stack.sh
index 3625e5f296..d8ab52ec98 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1034,36 +1034,6 @@ if is_service_enabled keystone; then
     export OS_REGION_NAME=$REGION_NAME
 fi
 
-# We now have a working keystone. From this point, everything can be done
-# with normal auth. Let's write out the auth config files so that if something
-# goes wrong subsequently, developers debugging have stackrc and clouds.yaml
-# files to use to poke at things
-
-# Create account rc files
-# =======================
-
-# Creates source able script files for easier user switching.
-# This step also creates certificates for tenants and users,
-# which is helpful in image bundle steps.
-
-if is_service_enabled nova && is_service_enabled keystone; then
-    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
-
-    if [ -f $SSL_BUNDLE_FILE ]; then
-        USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"
-    fi
-
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        USERRC_PARAMS="$USERRC_PARAMS --heat-url http://$HEAT_API_HOST:$HEAT_API_PORT/v1"
-    fi
-
-    $TOP_DIR/tools/create_userrc.sh $USERRC_PARAMS
-fi
-
-
-# Save some values we generated for later use
-save_stackenv
-
 # Write a clouds.yaml file
 write_clouds_yaml
 
@@ -1306,6 +1276,32 @@ if is_service_enabled heat; then
 fi
 
 
+# Create account rc files
+# =======================
+
+# Creates source able script files for easier user switching.
+# This step also creates certificates for tenants and users,
+# which is helpful in image bundle steps.
+
+if is_service_enabled nova && is_service_enabled keystone; then
+    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
+
+    if [ -f $SSL_BUNDLE_FILE ]; then
+        USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"
+    fi
+
+    if [[ "$HEAT_STANDALONE" = "True" ]]; then
+        USERRC_PARAMS="$USERRC_PARAMS --heat-url http://$HEAT_API_HOST:$HEAT_API_PORT/v1"
+    fi
+
+    $TOP_DIR/tools/create_userrc.sh $USERRC_PARAMS
+fi
+
+
+# Save some values we generated for later use
+save_stackenv
+
+
 # Wrapup configuration
 # ====================
 

From 78f6c1d70b51c29e5d36143e6051e6ff96ceb41c Mon Sep 17 00:00:00 2001
From: jianghua wang <jianghua.wang@citrix.com>
Date: Fri, 18 Sep 2015 11:17:46 +0100
Subject: [PATCH 0883/3333] tools/Xen: failed to install domU in new XenServer

Current install_os_domU.sh depends on some keywords which are changed in the
next version XenServer which is upgraded to CentOS 7. So with the existing
script to install domU in the new version XenServer, it will always fail.
This patch is to make it to be compatible with all XenServer versions:
1. the output format of "ifconfig" is changed; the fix is to use the ip
   command to retrieve IP address.
2. In XS 6.5 and the previous XS, the "xe-guest-utilities" package file name
   is as "xe-guest-utilities_<version>_<arch>.deb" but now it delivers a
   single file for all Arch's and the file name is
   "xe-guest-utilities_<version>_all.deb". In order to make it to be
   compatible, the fix will try to search the old file name pattern by
   default. If it does't exist, then try to search the new file name pattern.

Change-Id: I893e89e42a5ef7dd079b571ea308f318c9befc9e
Closes-Bug: #1494241
---
 tools/xen/functions          | 3 ++-
 tools/xen/install_os_domU.sh | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/xen/functions b/tools/xen/functions
index 4e9fede387..8c674dcce3 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -179,7 +179,8 @@ function xenapi_ip_on {
     local bridge_or_net_name
     bridge_or_net_name=$1
 
-    ifconfig $(bridge_for "$bridge_or_net_name") | grep "inet addr" | cut -d ":" -f2 | sed "s/ .*//"
+    ip -4 addr show $(bridge_for "$bridge_or_net_name") |\
+    awk '/inet/{split($2, ip, "/"); print ip[1];}'
 }
 
 function xenapi_is_listening_on {
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index b49347e09b..e24d9ed0b9 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -193,7 +193,10 @@ if [ -z "$templateuuid" ]; then
             TMP_DIR=/tmp/temp.$RANDOM
             mkdir -p $TMP_DIR
             mount -o loop $TOOLS_ISO $TMP_DIR
-            DEB_FILE=$(ls $TMP_DIR/Linux/*amd64.deb)
+            # the target deb package maybe *amd64.deb or *all.deb,
+            # so use *amd64.deb by default. If it doesn't exist,
+            # then use *all.deb.
+            DEB_FILE=$(ls $TMP_DIR/Linux/*amd64.deb || ls $TMP_DIR/Linux/*all.deb)
             cp $DEB_FILE $HTTP_SERVER_LOCATION
             umount $TMP_DIR
             rmdir $TMP_DIR

From 59756e990ca527d017e698e54bc7c6432af1b1fd Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 23 Sep 2015 17:42:54 -0400
Subject: [PATCH 0884/3333] Don't use python with run_process

First noted in change id by fumihiko and kyle:
I079e18b58b214bf8362945c253d6d894ca8b1a6b

Neutron and few others seem to use an extra "python" along
with run_process which is quite unnecessary and complicates
adding python3 support in devstack. So let's clean this up.

Change-Id: I2d478f2b04c04d05c18420563e2ad77eba73be3f
---
 lib/neutron-legacy | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 550eadb4b4..e67bd4ae32 100755
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -687,7 +687,7 @@ function start_neutron_service_and_check {
         service_protocol="http"
     fi
     # Start the Neutron service
-    run_process q-svc "python $NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+    run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
     echo "Waiting for Neutron to start..."
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
@@ -705,7 +705,7 @@ function start_neutron_service_and_check {
 # Control of the l2 agent is separated out to make it easier to test partial
 # upgrades (everything upgraded except the L2 agent)
 function start_neutron_l2_agent {
-    run_process q-agt "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+    run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
 
     if is_provider_network; then
         sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
@@ -723,23 +723,23 @@ function start_neutron_l2_agent {
 }
 
 function start_neutron_other_agents {
-    run_process q-dhcp "python $AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
+    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
     if is_service_enabled neutron-vpnaas; then
         :  # Started by plugin
     elif is_service_enabled q-vpn; then
         run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
     else
-        run_process q-l3 "python $AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
+        run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
     fi
 
-    run_process q-meta "python $AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
-    run_process q-lbaas "python $AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
-    run_process q-metering "python $AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
+    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
+    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
+    run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         # For XenServer, start an agent for the domU openvswitch
-        run_process q-domua "python $AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
+        run_process q-domua "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
     fi
 }
 

From 1ce19ab76d67a89b04f907f1d292d013a3b699e0 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 23 Sep 2015 10:36:53 -0400
Subject: [PATCH 0885/3333] attempt to cut api workers in half

One of the key reasons for the large number of API_WORKERS was that
mysql would block API workers, so would start rejecting work. Now with
the python mysql driver we should be eventlet aware, and life should
be good.

Let's see if this works.

Change-Id: Iaf8730a4dcdc30ef390795bfb5fb73ec3cd665fe
---
 lib/nova | 2 ++
 stackrc  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index ab5a76e2ad..db7967841c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -607,6 +607,8 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT ec2_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"
+    # don't let the conductor get out of control now that we're using a pure python db driver
+    iniset $NOVA_CONF conductor workers "$API_WORKERS"
 
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
 
diff --git a/stackrc b/stackrc
index 2641be64b7..9e05d8253a 100644
--- a/stackrc
+++ b/stackrc
@@ -631,7 +631,7 @@ SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 # the memory used where there are a large number of CPUs present
 # (the default number of workers for many services is the number of CPUs)
 # Also sets the minimum number of workers to 2.
-API_WORKERS=${API_WORKERS:=$(( ($(nproc)/2)<2 ? 2 : ($(nproc)/2) ))}
+API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
 
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}

From 1c42846a62dfafd43eb3cca4f7f1c8f3819cf867 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Thu, 24 Sep 2015 16:51:50 +0200
Subject: [PATCH 0886/3333] Mention ironic-inspector in plugin-registry docs

Change-Id: Ia508a3af5a65e4fbf34dd8b9ae537ca133358fa3
---
 doc/source/plugin-registry.rst | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bbab56b025..0feaafb275 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -72,14 +72,16 @@ Alternate Configs
 Additional Services
 ===================
 
-+-------------+------------------------------------------+------------+
-| Plugin Name | URL                                      | Comments   |
-|             |                                          |            |
-+-------------+------------------------------------------+------------+
-|ec2-api      |git://git.openstack.org/stackforge/ec2api |[as1]_      |
-+-------------+------------------------------------------+------------+
-|             |                                          |            |
-+-------------+------------------------------------------+------------+
++----------------+--------------------------------------------------+------------+
+| Plugin Name    | URL                                              | Comments   |
+|                |                                                  |            |
++----------------+--------------------------------------------------+------------+
+|ec2-api         |git://git.openstack.org/stackforge/ec2api         |[as1]_      |
++----------------+--------------------------------------------------+------------+
+|ironic-inspector|git://git.openstack.org/openstack/ironic-inspector|            |
++----------------+--------------------------------------------------+------------+
+|                |                                                  |            |
++----------------+--------------------------------------------------+------------+
 
 .. [as1] first functional devstack plugin, hence why used in most of
          the examples.

From ebe63d826b7909b992bff988b3eac65e7b6bfa88 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@linux.vnet.ibm.com>
Date: Thu, 24 Sep 2015 07:43:50 -0700
Subject: [PATCH 0887/3333] Improve ERROR_ON_CLONE message

In case ERROR_ON_CLONE is true and triggers a failure for a missing
project, suggest a remedial action.  On their own, people have
come up with remedies that include altering the value of ERROR_ON_CLONE
which rather defeats the purpose.

Change-Id: I28d7f2c184f8440b774fefaa8ec7002d6708db95
---
 functions-common | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index cf140072fd..1ae4d6597d 100644
--- a/functions-common
+++ b/functions-common
@@ -492,8 +492,11 @@ function git_clone {
     if echo $git_ref | egrep -q "^refs"; then
         # If our branch name is a gerrit style refs/changes/...
         if [[ ! -d $git_dest ]]; then
-            [[ "$ERROR_ON_CLONE" = "True" ]] && \
+            if [[ "$ERROR_ON_CLONE" = "True" ]]; then
+                echo "The $git_dest project was not found; if this is a gate job, add"
+                echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "Cloning not allowed in this configuration"
+            fi
             git_timed clone $git_clone_flags $git_remote $git_dest
         fi
         cd $git_dest
@@ -501,8 +504,11 @@ function git_clone {
     else
         # do a full clone only if the directory doesn't exist
         if [[ ! -d $git_dest ]]; then
-            [[ "$ERROR_ON_CLONE" = "True" ]] && \
+            if [[ "$ERROR_ON_CLONE" = "True" ]]; then
+                echo "The $git_dest project was not found; if this is a gate job, add"
+                echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "Cloning not allowed in this configuration"
+            fi
             git_timed clone $git_clone_flags $git_remote $git_dest
             cd $git_dest
             # This checkout syntax works for both branches and tags

From 8872545a0f98c5681147a08541e119813f0bdc01 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Mon, 14 Sep 2015 13:17:56 +0200
Subject: [PATCH 0888/3333] worlddump: Use SIGUSR2 instead of SIGUSR1

The function guru_meditation_report() currently uses the User-defined
signal SIGUSR1 to kill a Nova Compute process so that a Guru Meditation
Report is generated.

Testing locally, in a DevStack instance, manually attempting to kill a
Nova compute process [kill -s USR1 `pgrep nova-compute`] does not result
in process being terminated, and no error report generated.

It turns out[1] that SIGUSR1 is used by Apache 'mod_wsgi'.

Using the signal SIGUSR2 resolves this issue (i.e. 'nova-compute'
process is terminated, and the Guru Meditation Report is generated).

So, use USR2, instead of USR1.

Corresponding oslo.reports related commit[2].

[1] https://code.google.com/p/modwsgi/wiki/ConfigurationDirectives#WSGIRestrictSignal
[2] 45b1c02d113051d147e54ef921ce8e94135542d8 -- guru_meditation_report:
    Use SIGUSR2 instead of SIGUSR1
[3] Original DevStack commit that brought in this change --
    2ebe993b25462919e8aeeb896c9f91b6be7aa573

Change-Id: I8a7eaf71b83edca3c80074d6bf2d471e3db6142b
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1b337a9a83..33d5b8f620 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -131,7 +131,7 @@ def guru_meditation_report():
         print "Skipping as nova-compute does not appear to be running"
         return
 
-    _dump_cmd("kill -s USR1 `pgrep nova-compute`")
+    _dump_cmd("kill -s USR2 `pgrep nova-compute`")
     print "guru meditation report in nova-compute log"
 
 

From c1605550d94736f5698d3f6ea7bc1e0b0914cb4e Mon Sep 17 00:00:00 2001
From: Michal Ptacek <michalx.ptacek@intel.com>
Date: Wed, 23 Sep 2015 21:02:02 +0100
Subject: [PATCH 0889/3333] Propagate OVS_DATAPATH_TYPE to ml2_conf.ini

If OVS_DATAPATH_TYPE is configured it should be visible in ML2 config

Changing OVS_DATAPATH_TYPE default value to 'system' from ''

Closes-Bug: 1499029
Change-Id: I88e7d2554e8a1d6dcfea71fc1fb8e9fb2491d8b7
---
 lib/neutron_plugins/openvswitch_agent | 1 +
 lib/neutron_plugins/ovs_base          | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 1ff3a40c82..48e47b3dab 100755
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -105,6 +105,7 @@ function neutron_plugin_configure_plugin_agent {
         iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_COMMAND"
     fi
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
+    iniset /$Q_PLUGIN_CONF_FILE ovs datapath_type $OVS_DATAPATH_TYPE
 }
 
 function neutron_plugin_setup_interface_driver {
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index f1f7f8597b..b012683a6f 100755
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -8,7 +8,8 @@ OVSB_XTRACE=$(set +o | grep xtrace)
 set +o xtrace
 
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
-OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-""}
+# OVS recognize default 'system' datapath or 'netdev' for userspace datapath
+OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-system}
 OVS_TUNNEL_BRIDGE=${OVS_TUNNEL_BRIDGE:-br-tun}
 
 function is_neutron_ovs_base_plugin {
@@ -20,7 +21,7 @@ function _neutron_ovs_base_add_bridge {
     local bridge=$1
     local addbr_cmd="sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge"
 
-    if [ "$OVS_DATAPATH_TYPE" != "" ] ; then
+    if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
         addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
     fi
 

From 1eca508c57dd987fa6f7a7e6f441096365e6892d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 25 Sep 2015 13:28:58 +1000
Subject: [PATCH 0890/3333] Simplify RDO install

We can just directly install the latest RDO repo rather than having to
keep this up-to-date.  I don't think there is actually much there we
need any more; there was a lot more coming from RDO in the centos6
days.  openvswitch is one big one, however.

Change-Id: I42b8bc1aea8ff61770987eecd5fc3b8309c1e210
---
 stack.sh | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/stack.sh b/stack.sh
index d8ab52ec98..01b1165f26 100755
--- a/stack.sh
+++ b/stack.sh
@@ -286,14 +286,7 @@ EOF
     # ... and also optional to be enabled
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
-    RHEL_RDO_REPO_RPM=${RHEL7_RDO_REPO_RPM:-"https://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release-kilo-1.noarch.rpm"}
-    RHEL_RDO_REPO_ID=${RHEL7_RDO_REPO_ID:-"openstack-kilo"}
-
-    if ! sudo yum repolist enabled $RHEL_RDO_REPO_ID | grep -q $RHEL_RDO_REPO_ID; then
-        echo "RDO repo not detected; installing"
-        yum_install $RHEL_RDO_REPO_RPM || \
-            die $LINENO "Error installing RDO repo, cannot continue"
-    fi
+    sudo yum install -y https://rdoproject.org/repos/rdo-release.rpm
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56

From 3c68501356c319ecda80a9eba82f0575e7714eb2 Mon Sep 17 00:00:00 2001
From: venkatamahesh <venkatamaheshkotha@gmail.com>
Date: Sat, 26 Sep 2015 18:05:34 +0530
Subject: [PATCH 0891/3333] Replace the devstack.org with devstack docs url

Change-Id: I870300b90e1e5f4f382238c209fc5416914d49f0
---
 README.md | 4 ++--
 setup.cfg | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index ee7f0e7809..dd394c2e07 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@ DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud.
 * To provide an environment for the OpenStack CI testing on every commit
   to the projects
 
-Read more at http://devstack.org.
+Read more at http://docs.openstack.org/developer/devstack
 
 IMPORTANT: Be sure to carefully read `stack.sh` and any other scripts you
 execute before you run them, as they install software and will alter your
@@ -94,4 +94,4 @@ DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
 by reading the [configuration guide](doc/source/configuration.rst) for
-details of the configuration file and the many available options.
\ No newline at end of file
+details of the configuration file and the many available options.
diff --git a/setup.cfg b/setup.cfg
index 58871344aa..e4b2888dcb 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -5,7 +5,7 @@ description-file =
     README.md
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
-home-page = http://devstack.org
+home-page = http://docs.openstack.org/developer/devstack
 classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License

From f327b1e1196eacf25e7c4c9e3a7ad30c53bb961c Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Thu, 24 Sep 2015 18:50:30 +0800
Subject: [PATCH 0892/3333] stackrc set the LC_ALL to C

It will report 'unknown locale: UTF-8', when the env is UTF-8.
Default set the LC_ALL to C in the stackrc, instead. And delete
the duplicate option in stack.sh.

Closes-Bug: 1499296

Change-Id: I14121b25ac314a1a93e6dd6811e196ce2a7c0eb5
---
 stack.sh | 7 -------
 stackrc  | 7 +++++++
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/stack.sh b/stack.sh
index d8ab52ec98..5e57274d64 100755
--- a/stack.sh
+++ b/stack.sh
@@ -28,13 +28,6 @@ set -o xtrace
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
-# Sanitize language settings to avoid commands bailing out
-# with "unsupported locale setting" errors.
-unset LANG
-unset LANGUAGE
-LC_ALL=C
-export LC_ALL
-
 # Make sure umask is sane
 umask 022
 
diff --git a/stackrc b/stackrc
index fdde62f50c..82c6885db9 100644
--- a/stackrc
+++ b/stackrc
@@ -7,6 +7,13 @@
 [[ -z "$_DEVSTACK_STACKRC" ]] || return 0
 declare -r _DEVSTACK_STACKRC=1
 
+# Sanitize language settings to avoid commands bailing out
+# with "unsupported locale setting" errors.
+unset LANG
+unset LANGUAGE
+LC_ALL=C
+export LC_ALL
+
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 

From 651cb1ad758866a87b947c4e50b4ec995072d6ca Mon Sep 17 00:00:00 2001
From: Anton Arefiev <aarefiev@mirantis.com>
Date: Tue, 1 Sep 2015 10:55:20 +0300
Subject: [PATCH 0893/3333] Add toggle to run Cinder API under Apache

This change adds apache templates for Cinder API services.
Also add possibility to switch between the old and new ways
to setup Cinder API.

Related Cinder blueprint:
 https://blueprints.launchpad.net/cinder/+spec/non-eventlet-wsgi-app

Change-Id: Icfad40ee6998296727a95613199e5c2d87bd0a45
Depends-On: Ifbab059001d1567b1f7b394c0411a9ca4629f846
Co-Authored-By: Ivan Kolodyazhny <e0ne@e0ne.info>
---
 doc/source/configuration.rst     |  6 +++
 files/apache-cinder-api.template | 26 +++++++++++
 lib/cinder                       | 80 +++++++++++++++++++++++++++++---
 3 files changed, 106 insertions(+), 6 deletions(-)
 create mode 100644 files/apache-cinder-api.template

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e8de7c4f70..7ca82c7fd1 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -298,6 +298,12 @@ Example (Swift):
     SWIFT_USE_MOD_WSGI="True"
 
 
+Example (Cinder):
+
+::
+
+    CINDER_USE_MOD_WSGI="True"
+
 
 Libraries from Git
 ------------------
diff --git a/files/apache-cinder-api.template b/files/apache-cinder-api.template
new file mode 100644
index 0000000000..e1246f11b6
--- /dev/null
+++ b/files/apache-cinder-api.template
@@ -0,0 +1,26 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess osapi_volume processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup osapi_volume
+    WSGIScriptAlias / %CINDER_BIN_DIR%/cinder-wsgi
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/c-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %CINDER_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/lib/cinder b/lib/cinder
index 26277ccaba..10144117ec 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -108,6 +108,8 @@ CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
 CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 
+# Toggle for deploying Cinder under HTTPD + mod_wsgi
+CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-False}
 
 # Source the enabled backends
 if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -137,6 +139,11 @@ function is_cinder_enabled {
     return 1
 }
 
+# _cinder_cleanup_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
+function _cinder_cleanup_apache_wsgi {
+    sudo rm -f $(apache_site_config_for osapi-volume)
+}
+
 # cleanup_cinder() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_cinder {
@@ -183,6 +190,43 @@ function cleanup_cinder {
             fi
         done
     fi
+
+    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+        _cinder_cleanup_apache_wsgi
+    fi
+}
+
+# _cinder_config_apache_wsgi() - Set WSGI config files
+function _cinder_config_apache_wsgi {
+    local cinder_apache_conf=$(apache_site_config_for osapi-volume)
+    local cinder_ssl=""
+    local cinder_certfile=""
+    local cinder_keyfile=""
+    local cinder_api_port=$CINDER_SERVICE_PORT
+    local venv_path=""
+
+    if is_ssl_enabled_service c-api; then
+        cinder_ssl="SSLEngine On"
+        cinder_certfile="SSLCertificateFile $CINDER_SSL_CERT"
+        cinder_keyfile="SSLCertificateKeyFile $CINDER_SSL_KEY"
+    fi
+    if [[ ${USE_VENV} = True ]]; then
+        venv_path="python-path=${PROJECT_VENV["cinder"]}/lib/python2.7/site-packages"
+    fi
+
+    # copy proxy vhost file
+    sudo cp $FILES/apache-cinder-api.template $cinder_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$cinder_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%APIWORKERS%|$API_WORKERS|g
+        s|%CINDER_BIN_DIR%|$CINDER_BIN_DIR|g;
+        s|%SSLENGINE%|$cinder_ssl|g;
+        s|%SSLCERTFILE%|$cinder_certfile|g;
+        s|%SSLKEYFILE%|$cinder_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $cinder_apache_conf
 }
 
 # configure_cinder() - Set config files, create data dirs, etc
@@ -276,13 +320,17 @@ function configure_cinder {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
         setup_colorized_logging $CINDER_CONF DEFAULT "project_id" "user_id"
     else
         # Set req-id, project-name and resource in log format
         iniset $CINDER_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(project_name)s] %(resource)s%(message)s"
     fi
 
+    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+        _cinder_config_apache_wsgi
+    fi
+
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
         configure_cinder_driver
     fi
@@ -399,6 +447,13 @@ function install_cinder {
             install_package tgt
         fi
     fi
+
+    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+        install_apache_wsgi
+        if is_ssl_enabled_service "c-api"; then
+            enable_mod_ssl
+        fi
+    fi
 }
 
 # install_cinderclient() - Collect source and prepare
@@ -446,10 +501,16 @@ function start_cinder {
         fi
     fi
 
-    run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-    echo "Waiting for Cinder API to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-        die $LINENO "c-api did not start"
+    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+        enable_apache_site osapi-volume
+        restart_apache_server
+        tail_log c-api /var/log/$APACHE_NAME/c-api.log
+    else
+        run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
+        echo "Waiting for Cinder API to start..."
+        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
+            die $LINENO "c-api did not start"
+        fi
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
@@ -468,9 +529,16 @@ function start_cinder {
 
 # stop_cinder() - Stop running processes
 function stop_cinder {
+    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+        disable_apache_site osapi-volume
+        restart_apache_server
+    else
+        stop_process c-api
+    fi
+
     # Kill the cinder screen windows
     local serv
-    for serv in c-api c-bak c-sch c-vol; do
+    for serv in c-bak c-sch c-vol; do
         stop_process $serv
     done
 }

From d2999d0d0cc4d283873ff0d0951c4fdacd234dd1 Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Tue, 29 Sep 2015 10:02:32 +0000
Subject: [PATCH 0894/3333] Add ceilometer to plugin registry

Ceilometer is now removed from devstack and only exists as a plugin
so it should be in the registry.

Unfortunately the length of the URL changed the table formatting so
the diff is much larger than the semantic change.

Change-Id: Ibe8e27e97294c2d13be8f22f41eea27775811eec
---
 doc/source/plugin-registry.rst | 44 ++++++++++++++++++----------------
 1 file changed, 23 insertions(+), 21 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0feaafb275..85fd7cc065 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -17,27 +17,29 @@ Official OpenStack Projects
 
 The following are plugins that exist for official OpenStack projects.
 
-+--------------------+-------------------------------------------+--------------------+
-|Plugin Name         |URL                                        |Comments            |
-+--------------------+-------------------------------------------+--------------------+
-|aodh                |git://git.openstack.org/openstack/aodh     | alarming           |
-+--------------------+-------------------------------------------+--------------------+
-|gnocchi             |git://git.openstack.org/openstack/gnocchi  | metric             |
-+--------------------+-------------------------------------------+--------------------+
-|magnum              |git://git.openstack.org/openstack/magnum   |                    |
-+--------------------+-------------------------------------------+--------------------+
-|manila              |git://git.openstack.org/openstack/manila   | file shares        |
-+--------------------+-------------------------------------------+--------------------+
-|mistral             |git://git.openstack.org/openstack/mistral  |                    |
-+--------------------+-------------------------------------------+--------------------+
-|rally               |git://git.openstack.org/openstack/rally    |                    |
-+--------------------+-------------------------------------------+--------------------+
-|sahara              |git://git.openstack.org/openstack/sahara   |                    |
-+--------------------+-------------------------------------------+--------------------+
-|trove               |git://git.openstack.org/openstack/trove    |                    |
-+--------------------+-------------------------------------------+--------------------+
-|zaqar               |git://git.openstack.org/openstack/zaqar    |                    |
-+--------------------+-------------------------------------------+--------------------+
++------------------+---------------------------------------------+--------------------+
+|Plugin Name       |URL                                          |Comments            |
++------------------+---------------------------------------------+--------------------+
+|aodh              |git://git.openstack.org/openstack/aodh       | alarming           |
++------------------+---------------------------------------------+--------------------+
+|ceilometer        |git://git.openstack.org/openstack/ceilometer | metering           |
++------------------+---------------------------------------------+--------------------+
+|gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
++------------------+---------------------------------------------+--------------------+
+|magnum            |git://git.openstack.org/openstack/magnum     |                    |
++------------------+---------------------------------------------+--------------------+
+|manila            |git://git.openstack.org/openstack/manila     | file shares        |
++------------------+---------------------------------------------+--------------------+
+|mistral           |git://git.openstack.org/openstack/mistral    |                    |
++------------------+---------------------------------------------+--------------------+
+|rally             |git://git.openstack.org/openstack/rally      |                    |
++------------------+---------------------------------------------+--------------------+
+|sahara            |git://git.openstack.org/openstack/sahara     |                    |
++------------------+---------------------------------------------+--------------------+
+|trove             |git://git.openstack.org/openstack/trove      |                    |
++------------------+---------------------------------------------+--------------------+
+|zaqar             |git://git.openstack.org/openstack/zaqar      |                    |
++------------------+---------------------------------------------+--------------------+
 
 
 

From c35eee5dbbb6b4dbc2901ebef4c4d88780aa74ec Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 28 Sep 2015 14:46:27 -0700
Subject: [PATCH 0895/3333] use nproc/2 workers for large ops job

Commit 1ce19ab76d67a89b04f907f1d292d013a3b699e0 dropped API_WORKERS from
nproc/2 to nproc/4 and also started using API_WORKERS for the number of
conductor workers, so in gate runs that dropped conductor workers from 8
to 2.  We're now seeing instance build timeouts in the large ops job.

This change goes back to nproc/2 for the large ops job (VIRT_DRIVER=='fake').

Closes-Bug: #1500615

Change-Id: Ie6ef855fce0a99c930d479b7459c15b69e8de499
---
 stackrc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index e010b452c2..c7c631362e 100644
--- a/stackrc
+++ b/stackrc
@@ -650,7 +650,12 @@ SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 # the memory used where there are a large number of CPUs present
 # (the default number of workers for many services is the number of CPUs)
 # Also sets the minimum number of workers to 2.
-API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
+if [[ "$VIRT_DRIVER" = 'fake' ]]; then
+    # we need more workers for the large ops job
+    API_WORKERS=${API_WORKERS:=$(( ($(nproc)/2)<2 ? 2 : ($(nproc)/2) ))}
+else
+    API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
+fi
 
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}

From 7dd890d6e13e3bc021952ed1e4b81d3ae4bb4356 Mon Sep 17 00:00:00 2001
From: Olivier Lemasle <olivier.lemasle@apalia.net>
Date: Mon, 14 Sep 2015 14:21:12 +0200
Subject: [PATCH 0896/3333] Install python db client if a db backend is
 configured

If `DATABASE_TYPE` is configured in `local.conf`, the database backend
is currently configured with `initialize_database_backends` even if no
database backend is enabled.

On a multi-nodes Devstack environment, such as devstack-vagrant, the
compute node currently fails because it does not have PyMysql. This
compute node has no database backend enabled, but has to connect to
the database on another node.

We should install the python client if DATABASE_TYPE is set, even
if no database backend is enabled.

Closes-Bug: 1501001
Change-Id: Iffd5f7243a0dfdbe56cf6b9a87b96ed7678c81dd
---
 stack.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/stack.sh b/stack.sh
index 700a0aecad..7bc9c20fcf 100755
--- a/stack.sh
+++ b/stack.sh
@@ -736,6 +736,8 @@ install_rpc_backend
 
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
+fi
+if [ -n "$DATABASE_TYPE" ]; then
     install_database_python
 fi
 

From 050a0d5b304a013e23cd5909abf6e11b7dda5f18 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sun, 6 Sep 2015 22:03:54 +0000
Subject: [PATCH 0897/3333] Revert "Revert "Convert identity defaults to
 keystone v3 api""

This reverts commit f768787bdd6dddf2790f83a884618d29677ca77c.
And sets OS_AUTH_VERSION so swift CLI doesn't fall flat when
not using v2 keystone

Change-Id: If44a7e0d85e48020a3c90d8c5c027513129f0f3b
---
 functions-common | 47 +++++++++--------------------------------------
 lib/swift        |  6 +++---
 stack.sh         | 15 ++++++++-------
 3 files changed, 20 insertions(+), 48 deletions(-)

diff --git a/functions-common b/functions-common
index a7fec41bb9..fb774002ec 100644
--- a/functions-common
+++ b/functions-common
@@ -88,9 +88,9 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version $IDENTITY_API_VERSION \
+        --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+        --os-auth-url $KEYSTONE_AUTH_URI \
         --os-username demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
@@ -98,9 +98,9 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version $IDENTITY_API_VERSION \
+        --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
+        --os-auth-url $KEYSTONE_AUTH_URI \
         --os-username admin \
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
@@ -735,16 +735,13 @@ function policy_add {
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
     local domain_id
-    local os_url="$KEYSTONE_SERVICE_URI_V3"
     # Gets domain id
     domain_id=$(
         # Gets domain id
-        openstack --os-token=$OS_TOKEN --os-url=$os_url \
-            --os-identity-api-version=3 domain show $1 \
+        openstack domain show $1 \
             -f value -c id 2>/dev/null ||
         # Creates new domain
-        openstack --os-token=$OS_TOKEN --os-url=$os_url \
-            --os-identity-api-version=3 domain create $1 \
+        openstack domain create $1 \
             --description "$2" \
             -f value -c id
     )
@@ -755,13 +752,11 @@ function get_or_create_domain {
 # Usage: get_or_create_group <groupname> <domain> [<description>]
 function get_or_create_group {
     local desc="${3:-}"
-    local os_url="$KEYSTONE_SERVICE_URI_V3"
     local group_id
     # Gets group id
     group_id=$(
         # Creates new group with --or-show
-        openstack --os-token=$OS_TOKEN --os-url=$os_url \
-            --os-identity-api-version=3 group create $1 \
+        openstack group create $1 \
             --domain $2 --description "$desc" --or-show \
             -f value -c id
     )
@@ -783,8 +778,6 @@ function get_or_create_user {
         openstack user create \
             $1 \
             --password "$2" \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --domain=$3 \
             $email \
             --or-show \
@@ -799,9 +792,7 @@ function get_or_create_project {
     local project_id
     project_id=$(
         # Creates new project with --or-show
-        openstack --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
-            project create $1 \
+        openstack project create $1 \
             --domain=$2 \
             --or-show -f value -c id
     )
@@ -815,8 +806,6 @@ function get_or_create_role {
     role_id=$(
         # Creates role with --or-show
         openstack role create $1 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --or-show -f value -c id
     )
     echo $role_id
@@ -829,8 +818,6 @@ function get_or_add_user_project_role {
     # Gets user role id
     user_role_id=$(openstack role list \
         --user $2 \
-        --os-url=$KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
         --column "ID" \
         --project $3 \
         --column "Name" \
@@ -839,13 +826,9 @@ function get_or_add_user_project_role {
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
-            --project $3 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3
+            --project $3
         user_role_id=$(openstack role list \
             --user $2 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --column "ID" \
             --project $3 \
             --column "Name" \
@@ -860,21 +843,15 @@ function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
     group_role_id=$(openstack role list \
-        --os-url=$KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
         --group $2 \
         --project $3 \
         -c "ID" -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
         openstack role add $1 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --group $2 \
             --project $3
         group_role_id=$(openstack role list \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             --group $2 \
             --project $3 \
             -c "ID" -f value)
@@ -892,8 +869,6 @@ function get_or_create_service {
         openstack service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
         openstack service create \
-            --os-url $KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             $2 \
             --name $1 \
             --description="$3" \
@@ -912,8 +887,6 @@ function _get_or_create_endpoint_with_interface {
     # gets support for this, the check for the region name can be removed.
     # Related bug in keystone: https://bugs.launchpad.net/keystone/+bug/1482772
     endpoint_id=$(openstack endpoint list \
-        --os-url $KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
         --service $1 \
         --interface $2 \
         --region $4 \
@@ -921,8 +894,6 @@ function _get_or_create_endpoint_with_interface {
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \
-            --os-url $KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             $1 $2 $3 --region $4 -f value -c id)
     fi
 
diff --git a/lib/swift b/lib/swift
index 645bfd7cd9..f0eb56abbe 100644
--- a/lib/swift
+++ b/lib/swift
@@ -799,10 +799,10 @@ function stop_swift {
 
 function swift_configure_tempurls {
     OS_USERNAME=swift \
-        OS_TENANT_NAME=$SERVICE_TENANT_NAME \
+        OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
         OS_PASSWORD=$SERVICE_PASSWORD \
-        OS_AUTH_URL=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION \
-        swift post -m "Temp-URL-Key: $SWIFT_TEMPURL_KEY"
+        OS_AUTH_URL=$SERVICE_ENDPOINT \
+        swift post --auth-version 3 -m "Temp-URL-Key: $SWIFT_TEMPURL_KEY"
 }
 
 # Restore xtrace
diff --git a/stack.sh b/stack.sh
index cd8a11e66c..11dd2009e8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -973,13 +973,15 @@ if is_service_enabled keystone; then
         start_keystone
     fi
 
+    export OS_IDENTITY_API_VERSION=3
+
     # Set up a temporary admin URI for Keystone
-    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v2.0
+    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v3
 
     if is_service_enabled tls-proxy; then
         export OS_CACERT=$INT_CA_DIR/ca-chain.pem
         # Until the client support is fixed, just use the internal endpoint
-        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v2.0
+        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v3
     fi
 
     # Setup OpenStackClient token-endpoint auth
@@ -1003,14 +1005,13 @@ if is_service_enabled keystone; then
     # Begone token auth
     unset OS_TOKEN OS_URL
 
-    # force set to use v2 identity authentication even with v3 commands
-    export OS_AUTH_TYPE=v2password
-
     # Set up password auth credentials now that Keystone is bootstrapped
-    export OS_AUTH_URL=$SERVICE_ENDPOINT
-    export OS_TENANT_NAME=admin
+    export OS_AUTH_URL=$KEYSTONE_AUTH_URI
     export OS_USERNAME=admin
+    export OS_USER_DOMAIN_ID=default
     export OS_PASSWORD=$ADMIN_PASSWORD
+    export OS_PROJECT_NAME=admin
+    export OS_PROJECT_DOMAIN_ID=default
     export OS_REGION_NAME=$REGION_NAME
 fi
 

From c295bca61fbef22d4816b2db8cec40e924c709c4 Mon Sep 17 00:00:00 2001
From: Nick <skywalker.nick@gmail.com>
Date: Tue, 4 Aug 2015 09:28:19 +0800
Subject: [PATCH 0898/3333] Fix tunneling support for linuxbridge-agent

When I deploy linuxbridge-agent and enable tunneling,
the configuration of neutron isn't right. It lacks
the whole section [vxlan] to be properly configured.

Change-Id: Ib3bfe0f3445f466f4dbb36f7f0cb0d940114e7f6
Closes-Bug: #1481126
---
 lib/neutron_plugins/linuxbridge_agent | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index fefc1c33a8..bd4438db04 100755
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -69,6 +69,18 @@ function neutron_plugin_configure_plugin_agent {
     fi
     AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
+
+    # Configure vxlan tunneling
+    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
+        if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
+            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "True"
+            iniset /$Q_PLUGIN_CONF_FILE vxlan local_ip $TUNNEL_ENDPOINT_IP
+        else
+            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
+        fi
+    else
+        iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
+    fi
 }
 
 function neutron_plugin_setup_interface_driver {

From 713fd2f6c644e13ed8ad7e8d819f6a3d44ff5370 Mon Sep 17 00:00:00 2001
From: Sirushti Murugesan <sirushti.murugesan@hp.com>
Date: Wed, 30 Sep 2015 15:12:50 +0530
Subject: [PATCH 0899/3333] Additionally install test-requirements with
 pip_install

When moving to Python 3, we also need to install test-requriements
to allow projects to install any python 3 test dependencies they
might be missing otherwise.

Change-Id: I2d19aa2f7ec8de869a82aa7764ab72cc8693101f
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 210a9dbdfe..fd0d616b62 100644
--- a/inc/python
+++ b/inc/python
@@ -124,7 +124,7 @@ function pip_install {
         $@
 
     # Also install test requirements
-    local test_req="$@/test-requirements.txt"
+    local test_req="${!#}/test-requirements.txt"
     if [[ -e "$test_req" ]]; then
         echo "Installing test-requirements for $test_req"
         $sudo_pip \

From 36218e6c50c9eb22003eefe0389b00cbf7132dfb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 30 Sep 2015 10:33:57 +0000
Subject: [PATCH 0900/3333] Revert "Disable Cinder v1 API support by default"

There has been a ton of fall out from this change, and I
think it's been premature. We should revert and try again
when more of the client space supports this.

This reverts commit a29434460e869b7bb397044d8f073531e4ee112d.

Change-Id: I1658dc48a024627be0fdb39c46137aaa3d9b911a
---
 doc/source/configuration.rst |  7 -------
 lib/cinder                   | 29 ++++++++++++-----------------
 lib/tempest                  |  9 ---------
 3 files changed, 12 insertions(+), 33 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 3bd246d870..983f5c0aae 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -587,13 +587,6 @@ with ``VOLUME_BACKING_FILE_SIZE``.
         VOLUME_BACKING_FILE_SIZE=10250M
 
 
-Cinder v1 API is depricated and disabled by default. You can enable v1 API by
-setting ``CINDER_ENABLE_V1_API`` to ``True``.
-
-    ::
-        CINDER_ENABLE_V1_API=True
-
-
 Keystone
 ~~~~~~~~
 
diff --git a/lib/cinder b/lib/cinder
index f0b0f1d7e5..26277ccaba 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -27,9 +27,6 @@ set +o xtrace
 # Defaults
 # --------
 
-# NOTE (e0ne): Cinder API v1 is deprecated and will be disabled by default.
-CINDER_ENABLE_V1_API=$(trueorfalse False CINDER_ENABLE_V1_API)
-
 # set up default driver
 CINDER_DRIVER=${CINDER_DRIVER:-default}
 CINDER_PLUGINS=$TOP_DIR/lib/cinder_plugins
@@ -228,12 +225,9 @@ function configure_cinder {
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     # NOTE(thingee): Cinder V1 API is deprecated and defaults to off as of
-    # Juno.
-    if [[ ${CINDER_ENABLE_V1_API} = True ]]; then
-        iniset $CINDER_CONF DEFAULT enable_v1_api true
-    else
-        iniset $CINDER_CONF DEFAULT enable_v1_api false
-    fi
+    # Juno. Keep it enabled so we can continue testing while it's still
+    # supported.
+    iniset $CINDER_CONF DEFAULT enable_v1_api true
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
@@ -332,13 +326,12 @@ function create_cinder_accounts {
 
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
-            if [[ ${CINDER_ENABLE_V1_API} = True ]]; then
-                get_or_create_service "cinder" "volume" "Cinder Volume Service"
-                get_or_create_endpoint "volume" "$REGION_NAME" \
-                    "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                    "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                    "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
-            fi
+            get_or_create_service "cinder" "volume" "Cinder Volume Service"
+            get_or_create_endpoint "volume" "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
+
             get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
             get_or_create_endpoint "volumev2" "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
@@ -489,7 +482,9 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            openstack volume type create --os-volume-api-version 2 --property volume_backend_name="${be_name}" ${be_name}
+            # FIXME(jamielennox): Remove --os-volume-api-version pinning when
+            # osc supports volume type create on v2 api. bug #1475060
+            openstack volume type create --os-volume-api-version 1 --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }
diff --git a/lib/tempest b/lib/tempest
index 3624b9605e..d372e0f6ca 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -494,15 +494,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi
 
-    # Use only Cinder API v2
-    if [[ ${CINDER_ENABLE_V1_API} = True ]]; then
-        iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 True
-        iniset $TEMPEST_CONFIG volume catalog_type volume
-    else
-        iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 False
-        iniset $TEMPEST_CONFIG volume catalog_type volumev2
-    fi
-
     # Using ``CINDER_ENABLED_BACKENDS``
     if [[ -n "$CINDER_ENABLED_BACKENDS" ]] && [[ $CINDER_ENABLED_BACKENDS =~ .*,.* ]]; then
         iniset $TEMPEST_CONFIG volume-feature-enabled multi_backend "True"

From bd5e6b16590f852402ae60eb6e2b45178be85870 Mon Sep 17 00:00:00 2001
From: Aaron Rosen <aaronorosen@gmail.com>
Date: Fri, 25 Sep 2015 17:55:45 -0700
Subject: [PATCH 0901/3333] Remove unnecessary execute permissions

These files have acquired execute permissions that
are not strictly necessary because they are being
sourced, and not intended to be run separately.

Restore to 644

Change-Id: I0b8654123416a07521502b61610ca45c94494a07
---
 lib/neutron-legacy                    | 0
 lib/neutron_plugins/linuxbridge_agent | 0
 lib/neutron_plugins/ml2               | 0
 lib/neutron_plugins/openvswitch_agent | 0
 lib/neutron_plugins/ovs_base          | 0
 lib/nova_plugins/functions-libvirt    | 0
 6 files changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 lib/neutron-legacy
 mode change 100755 => 100644 lib/neutron_plugins/linuxbridge_agent
 mode change 100755 => 100644 lib/neutron_plugins/ml2
 mode change 100755 => 100644 lib/neutron_plugins/openvswitch_agent
 mode change 100755 => 100644 lib/neutron_plugins/ovs_base
 mode change 100755 => 100644 lib/nova_plugins/functions-libvirt

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
old mode 100755
new mode 100644
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
old mode 100755
new mode 100644
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
old mode 100755
new mode 100644
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
old mode 100755
new mode 100644
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
old mode 100755
new mode 100644
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
old mode 100755
new mode 100644

From ce7246a34ba51a5ccff0ac08d6e85a8cda7d275b Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 23 Apr 2015 09:41:06 -0700
Subject: [PATCH 0902/3333] Workaround potential failure to shutdown services

Kill them twice to make sure they're good'n'dead. There is a supposed
fix to oslo-incubator code, but we're working around that here in the
meantime with this change.

This returned in Liberty.

Change-Id: I02a7af995dc7de857c4efcf2cef2f95d357c007a
Related-Bug: #1446583
(cherry picked from commit 953baa7998f253681ed31013fd18bd8aa8098b34)
---
 functions-common | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/functions-common b/functions-common
index a7fec41bb9..cfe0c8d4ba 100644
--- a/functions-common
+++ b/functions-common
@@ -1476,6 +1476,22 @@ function stop_process {
         # Kill via pid if we have one available
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
             pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid)
+            # oslo.service tends to stop actually shutting down
+            # reliably in between releases because someone believes it
+            # is dying too early due to some inflight work they
+            # have. This is a tension. It happens often enough we're
+            # going to just account for it in devstack and assume it
+            # doesn't work.
+            #
+            # Set OSLO_SERVICE_WORKS=True to skip this block
+            if [[ -z "$OSLO_SERVICE_WORKS" ]]; then
+                # TODO(danms): Remove this double-kill when we have
+                # this fixed in all services:
+                # https://bugs.launchpad.net/oslo-incubator/+bug/1446583
+                sleep 1
+                # /bin/true becakse pkill on a non existant process returns an error
+                pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid) || /bin/true
+            fi
             rm $SERVICE_DIR/$SCREEN_NAME/$service.pid
         fi
         if [[ "$USE_SCREEN" = "True" ]]; then

From dbe0868d11531204b1dcc3a7eafdf9da711a7cc6 Mon Sep 17 00:00:00 2001
From: Denis Afonso <denis.afonso@gmail.com>
Date: Fri, 2 Oct 2015 23:51:41 -0400
Subject: [PATCH 0903/3333] Change the default bind_port for swift

The default bind_port (6011-6013) in the sample config files for swift
use port numbers that are in the range registered by X11 (6000-6063) and
can prevent swift from starting if the ports are in use.

We should use an unregistered range (6611-6613).

Change-Id: Ifd95b99004aead5ddc8ae1a8dd3ccd9c4f2abe91
Closes-Bug: #1254328
---
 lib/swift | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/swift b/lib/swift
index 645bfd7cd9..caf2fdf00f 100644
--- a/lib/swift
+++ b/lib/swift
@@ -130,9 +130,9 @@ SWIFT_MAX_HEADER_SIZE=${SWIFT_MAX_HEADER_SIZE:-16384}
 # Port bases used in port number calclution for the service "nodes"
 # The specified port number will be used, the additinal ports calculated by
 # base_port + node_num * 10
-OBJECT_PORT_BASE=${OBJECT_PORT_BASE:-6013}
-CONTAINER_PORT_BASE=${CONTAINER_PORT_BASE:-6011}
-ACCOUNT_PORT_BASE=${ACCOUNT_PORT_BASE:-6012}
+OBJECT_PORT_BASE=${OBJECT_PORT_BASE:-6613}
+CONTAINER_PORT_BASE=${CONTAINER_PORT_BASE:-6611}
+ACCOUNT_PORT_BASE=${ACCOUNT_PORT_BASE:-6612}
 
 # Enable tempurl feature
 SWIFT_ENABLE_TEMPURLS=${SWIFT_ENABLE_TEMPURLS:-False}

From 1759618adb90853a76b77bb6ba24f2bed8b3b1f5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 5 Oct 2015 15:26:43 -0400
Subject: [PATCH 0904/3333] update faq entry about running other branches

Change-Id: I4f982f9050024245c4a656e9535d4fdfb4413f36
---
 doc/source/faq.rst | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 0db8932e9c..3562bfacee 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -124,24 +124,30 @@ Of course!
 
         enable_service q-svc
 
-How do I run a specific OpenStack milestone?
+How do I run a specific OpenStack release?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-OpenStack milestones have tags set in the git repo. Set the
-appropriate tag in the ``*_BRANCH`` variables in ``local.conf``.
-Swift is on its own release schedule so pick a tag in the Swift repo
-that is just before the milestone release. For example:
+DevStack master tracks the upstream master of all the projects. If you
+would like to run a stable branch of OpenStack, you should use the
+corresponding stable branch of DevStack as well. For instance the
+``stable/kilo`` version of DevStack will already default to all the
+projects running at ``stable/kilo`` levels.
 
-    ::
+Note: it's also possible to manually adjust the ``*_BRANCH`` variables
+further if you would like to test specific milestones, or even custom
+out of tree branches. This is done with entries like the following in
+your ``local.conf``
+
+::
 
         [[local|localrc]]
-        GLANCE_BRANCH=stable/kilo
-        HORIZON_BRANCH=stable/kilo
-        KEYSTONE_BRANCH=stable/kilo
-        NOVA_BRANCH=stable/kilo
-        GLANCE_BRANCH=stable/kilo
-        NEUTRON_BRANCH=stable/kilo
-        SWIFT_BRANCH=2.3.0
+        GLANCE_BRANCH=11.0.0.0rc1
+        NOVA_BRANCH=12.0.0.0.rc1
+
+
+Upstream DevStack is only tested with master and stable
+branches. Setting custom BRANCH definitions is not guarunteed to
+produce working results.
 
 What can I do about RabbitMQ not wanting to start on my fresh new VM?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

From c961e791c1068c3054260c0fa59eed412a1aa6ed Mon Sep 17 00:00:00 2001
From: armando-migliaccio <armamig@gmail.com>
Date: Mon, 5 Oct 2015 16:51:33 -0700
Subject: [PATCH 0905/3333] Remove explicit support for OneConvergence plugin

This is being removed from the Neutron tree, so there is
no need to keep it here anymore.

Change-Id: Ice869bc445cb9dab6f227c30d38fb9b7ba04442b
Depends-on: I949a51873ee5af654b577952d423dd29a6ced8e7
---
 lib/neutron_plugins/oneconvergence | 77 ------------------------------
 1 file changed, 77 deletions(-)
 delete mode 100644 lib/neutron_plugins/oneconvergence

diff --git a/lib/neutron_plugins/oneconvergence b/lib/neutron_plugins/oneconvergence
deleted file mode 100644
index 0c570e534b..0000000000
--- a/lib/neutron_plugins/oneconvergence
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/bash
-#
-# Neutron One Convergence plugin
-# ------------------------------
-
-# Save trace setting
-OC_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-
-Q_L3_ENABLED=true
-Q_L3_ROUTER_PER_TENANT=true
-Q_USE_NAMESPACE=true
-
-function neutron_plugin_install_agent_packages {
-    _neutron_ovs_base_install_agent_packages
-}
-# Configure common parameters
-function neutron_plugin_configure_common {
-
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/oneconvergence
-    Q_PLUGIN_CONF_FILENAME=nvsdplugin.ini
-    Q_PLUGIN_CLASS="neutron.plugins.oneconvergence.plugin.OneConvergencePluginV2"
-}
-
-# Configure plugin specific information
-function neutron_plugin_configure_service {
-    iniset /$Q_PLUGIN_CONF_FILE nvsd nvsd_ip $NVSD_IP
-    iniset /$Q_PLUGIN_CONF_FILE nvsd nvsd_port $NVSD_PORT
-    iniset /$Q_PLUGIN_CONF_FILE nvsd nvsd_user $NVSD_USER
-    iniset /$Q_PLUGIN_CONF_FILE nvsd nvsd_passwd $NVSD_PASSWD
-}
-
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
-}
-
-function has_neutron_plugin_security_group {
-    # 1 means False here
-    return 0
-}
-
-function setup_integration_bridge {
-    _neutron_ovs_base_setup_bridge $OVS_BRIDGE
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    setup_integration_bridge
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
-}
-
-function neutron_plugin_configure_l3_agent {
-    _neutron_ovs_base_configure_l3_agent
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
-}
-
-function neutron_plugin_configure_plugin_agent {
-
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-nvsd-agent"
-
-    _neutron_ovs_base_configure_firewall_driver
-}
-
-function neutron_plugin_create_nova_conf {
-    if ( is_service_enabled n-cpu && ! ( is_service_enabled q-dhcp )) ; then
-        setup_integration_bridge
-    fi
-}
-
-# Restore xtrace
-$OC_XTRACE

From f80c37dd47ac11b6cbd4cd08a0af2c4c17e31198 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Oct 2015 20:18:15 +1100
Subject: [PATCH 0906/3333] Ignore bashate long-line warnings (E006)

Since Ic2532676e46e93f129d590d1fa7a044ef65f50fb bashate warns on
long-lines.  Traditionally, for whatever reason, devstack hasn't cared
too much about long lines unless it really damages readability.

So ignore this to avoid thousands of warnings on the long lines.  Note
even though released bashate doesn't have this, ignoring a missing
test doesn't matter.

Change-Id: I16aeaa3b334fac1eec5085f2cfe26c81c53023a8
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index 788fea9c4f..1c238add8a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -24,7 +24,7 @@ commands = bash -c "find {toxinidir}             \
           -wholename \*/inc/\* -or               \ # /inc files and
           -wholename \*/lib/\*                   \ # /lib files are shell, but
          \)                                      \ #   have no extension
-         -print0 | xargs -0 bashate -v"
+         -print0 | xargs -0 bashate -v -iE006"
 
 [testenv:docs]
 deps =

From f0131e14b8550d5d3637b29f0151ad280c77cb63 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Wed, 23 Sep 2015 12:55:02 -0500
Subject: [PATCH 0907/3333] Nano and Micro flavors should run really small
 cirros only

Guests with large memory requirements can use default flavors, so
removing the special flavor for ppc64 since new qemu requires more
memory - http://wiki.qemu.org/ChangeLog/2.4 - PowerPC.
Users should set DEFAULT_INSTANCE_TYPE to one of the default
flavors available in local.conf, as m1.tiny.

DocImpact

Change-Id: I0fd275dc7342cc2daa83e9a2bd79d30e7defa3e4
---
 doc/source/configuration.rst | 22 ++++++++++++++++++++++
 lib/tempest                  | 13 ++-----------
 2 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e8de7c4f70..8f311e037b 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -402,6 +402,28 @@ these default images; in that case, you will want to populate
         IMAGE_URLS="http://foo.bar.com/image.qcow,"
         IMAGE_URLS+="http://foo.bar.com/image2.qcow"
 
+
+Instance Type
+-------------
+
+``DEFAULT_INSTANCE_TYPE`` can be used to configure the default instance
+type. When this parameter is not specified, Devstack creates additional
+micro & nano flavors for really small instances to run Tempest tests.
+
+For guests with larger memory requirements, ``DEFAULT_INSTANCE_TYPE``
+should be specified in the configuration file so Tempest selects the
+default flavors instead.
+
+KVM on Power with QEMU 2.4 requires 512 MB to load the firmware -
+`QEMU 2.4 - PowerPC <http://wiki.qemu.org/ChangeLog/2.4>`__ so users
+running instances on ppc64/ppc64le can choose one of the default
+created flavors as follows:
+
+    ::
+
+        DEFAULT_INSTANCE_TYPE=m1.tiny
+
+
 IP Version
 ----------
 
diff --git a/lib/tempest b/lib/tempest
index f4d0a6dab0..6eeab4e231 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -205,21 +205,12 @@ function configure_tempest {
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             available_flavors=$(nova flavor-list)
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
-                if is_arch "ppc64"; then
-                    # Qemu needs at least 128MB of memory to boot on ppc64
-                    nova flavor-create m1.nano 42 128 0 1
-                else
-                    nova flavor-create m1.nano 42 64 0 1
-                fi
+                nova flavor-create m1.nano 42 64 0 1
             fi
             flavor_ref=42
             boto_instance_type=m1.nano
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
-                if is_arch "ppc64"; then
-                    nova flavor-create m1.micro 84 256 0 1
-                else
-                    nova flavor-create m1.micro 84 128 0 1
-                fi
+                nova flavor-create m1.micro 84 128 0 1
             fi
             flavor_ref_alt=84
         else

From bb4654b869722feb400d65869350465d8ff5439c Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Tue, 6 Oct 2015 18:09:07 +0200
Subject: [PATCH 0908/3333] Don't configure neutron metadata agent for neutron
 API access

Metadata agent now talks to neutron-server thru AMQP, so there is no use
for API access configuration.

Change-Id: I8f81eea91fe3448d5098e77312f64f2eaba68a68
Depends-On: I254c575c66214f50fb93a94c46c4c9caebfc2937
Closes-Bug: #1502947
---
 lib/neutron-legacy | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e67bd4ae32..8b964a72c8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1050,11 +1050,6 @@ function _configure_neutron_metadata_agent {
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
-
-    # Configures keystone for metadata_agent
-    # The third argument "True" sets auth_url needed to communicate with keystone
-    _neutron_setup_keystone $Q_META_CONF_FILE DEFAULT True
-
 }
 
 function _configure_neutron_ceilometer_notifications {
@@ -1212,17 +1207,10 @@ function _neutron_setup_rootwrap {
     fi
 }
 
-# Configures keystone integration for neutron service and agents
+# Configures keystone integration for neutron service
 function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
-    local use_auth_url=$3
-
-    # Configures keystone for metadata_agent
-    # metadata_agent needs auth_url to communicate with keystone
-    if [[ "$use_auth_url" == "True" ]]; then
-        iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI/v2.0
-    fi
 
     create_neutron_cache_dir
     configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section

From 872a2622b9dc9295918784114bce4f4f991187b7 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 6 Oct 2015 12:45:06 -0400
Subject: [PATCH 0909/3333] Move the firewall disable section into a misc
 section

It broke the flow of the section it was in.

Change-Id: I4c6ec7ccbe7e856600037eb5a3a73863319aa232
---
 doc/source/guides/neutron.rst | 71 +++++++++++++++++++----------------
 1 file changed, 38 insertions(+), 33 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 2973eb63e8..424844547c 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -125,39 +125,6 @@ connectivity.
 
 
 
-Disabling Next Generation Firewall Tools
-========================================
-
-DevStack does not properly operate with modern firewall tools.  Specifically
-it will appear as if the guest VM can access the external network via ICMP,
-but UDP and TCP packets will not be delivered to the guest VM.  The root cause
-of the issue is that both ufw (Uncomplicated Firewall) and firewalld (Fedora's
-firewall manager) apply firewall rules to all interfaces in the system, rather
-then per-device.  One solution to this problem is to revert to iptables
-functionality.
-
-To get a functional firewall configuration for Fedora do the following:
-
-::
-
-         sudo service iptables save
-         sudo systemctl disable firewalld
-         sudo systemctl enable iptables
-         sudo systemctl stop firewalld
-         sudo systemctl start iptables
-
-
-To get a functional firewall configuration for distributions containing ufw,
-disable ufw.  Note ufw is generally not enabled by default in Ubuntu.  To
-disable ufw if it was enabled, do the following:
-
-::
-
-        sudo service iptables save
-        sudo ufw disable
-
-
-
 
 Neutron Networking with Open vSwitch
 ====================================
@@ -301,3 +268,41 @@ For example, with the above  configuration, a bridge is
 created, named `br-ex` which is managed by Open vSwitch, and the
 second interface on the compute node, `eth1` is attached to the
 bridge, to forward traffic sent by guest VMs.
+
+Miscellaneous Tips
+==================
+
+
+Disabling Next Generation Firewall Tools
+----------------------------------------
+
+DevStack does not properly operate with modern firewall tools.  Specifically
+it will appear as if the guest VM can access the external network via ICMP,
+but UDP and TCP packets will not be delivered to the guest VM.  The root cause
+of the issue is that both ufw (Uncomplicated Firewall) and firewalld (Fedora's
+firewall manager) apply firewall rules to all interfaces in the system, rather
+then per-device.  One solution to this problem is to revert to iptables
+functionality.
+
+To get a functional firewall configuration for Fedora do the following:
+
+::
+
+         sudo service iptables save
+         sudo systemctl disable firewalld
+         sudo systemctl enable iptables
+         sudo systemctl stop firewalld
+         sudo systemctl start iptables
+
+
+To get a functional firewall configuration for distributions containing ufw,
+disable ufw.  Note ufw is generally not enabled by default in Ubuntu.  To
+disable ufw if it was enabled, do the following:
+
+::
+
+        sudo service iptables save
+        sudo ufw disable
+
+
+

From 433a9b10ddd6fa67d7459c4943a92ce4f488cebc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 7 Oct 2015 13:29:31 +1100
Subject: [PATCH 0910/3333] Don't set xtrace directly in local call

Ia0957b47187c3dcadd46154b17022c4213781112 detects setting local
variables with subshell commands.

Although this is a particuarly benign case, it trips the test.  Rather
than putting in an ignore for this, we can easily change it to make
the test pass.  This seems better than putting in special work-arounds
to bashate, etc.

Change-Id: I37c3967c0f2d780a636a7d26cda83755085c5c69
---
 functions-common | 33 ++++++++++++++++++++++-----------
 inc/ini-config   | 30 ++++++++++++++++++++----------
 inc/python       |  6 ++++--
 3 files changed, 46 insertions(+), 23 deletions(-)

diff --git a/functions-common b/functions-common
index cfe0c8d4ba..53b64d668a 100644
--- a/functions-common
+++ b/functions-common
@@ -111,7 +111,8 @@ function write_clouds_yaml {
 # Accepts as True: 1 yes Yes YES true True TRUE
 # VAR=$(trueorfalse default-value test-value)
 function trueorfalse {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
     local default=$1
@@ -169,7 +170,8 @@ function die {
 # die_if_not_set $LINENO env-var "message"
 function die_if_not_set {
     local exitcode=$?
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local line=$1; shift
     local evar=$1; shift
@@ -183,7 +185,8 @@ function die_if_not_set {
 # err $LINENO "message"
 function err {
     local exitcode=$?
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[ERROR] ${BASH_SOURCE[2]}:$1 $2"
     echo $msg 1>&2;
@@ -200,7 +203,8 @@ function err {
 # err_if_not_set $LINENO env-var "message"
 function err_if_not_set {
     local exitcode=$?
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local line=$1; shift
     local evar=$1; shift
@@ -236,7 +240,8 @@ function is_set {
 # warn $LINENO "message"
 function warn {
     local exitcode=$?
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[WARNING] ${BASH_SOURCE[2]}:$1 $2"
     echo $msg
@@ -986,7 +991,8 @@ function _get_package_dir {
 # Uses globals ``OFFLINE``, ``*_proxy``
 # apt_get operation package [package ...]
 function apt_get {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
     [[ "$OFFLINE" = "True" || -z "$@" ]] && return
@@ -1055,7 +1061,8 @@ function _parse_package_files {
 # - ``# dist:DISTRO`` or ``dist:DISTRO1,DISTRO2`` limits the selection
 #   of the package to the distros listed.  The distro names are case insensitive.
 function get_packages {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local services=$@
     local package_dir=$(_get_package_dir)
@@ -1123,7 +1130,8 @@ function get_packages {
 # The same metadata used in the main DevStack prerequisite files may be used
 # in these prerequisite files, see get_packages() for more info.
 function get_plugin_packages {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local files_to_parse=""
     local package_dir=""
@@ -1148,7 +1156,8 @@ function update_package_repo {
     fi
 
     if is_ubuntu; then
-        local xtrace=$(set +o | grep xtrace)
+        local xtrace
+    xtrace=$(set +o | grep xtrace)
         set +o xtrace
         if [[ "$REPOS_UPDATED" != "True" || "$RETRY_UPDATE" = "True" ]]; then
             # if there are transient errors pulling the updates, that's fine.
@@ -1854,7 +1863,8 @@ function enable_service {
 # Uses global ``ENABLED_SERVICES``
 # is_service_enabled service [service ...]
 function is_service_enabled {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local enabled=1
     local services=$@
@@ -1933,7 +1943,8 @@ function use_exclusive_service {
 # Only run the command if the target file (the last arg) is not on an
 # NFS filesystem.
 function _safe_permission_operation {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local args=( $@ )
     local last
diff --git a/inc/ini-config b/inc/ini-config
index 58386e2441..ba2d827ae9 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -17,7 +17,8 @@ set +o xtrace
 # Append a new option in an ini file without replacing the old value
 # iniadd [-sudo] config-file section option value1 value2 value3 ...
 function iniadd {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
@@ -37,7 +38,8 @@ function iniadd {
 # Comment an option in an INI file
 # inicomment [-sudo] config-file section option
 function inicomment {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
@@ -55,7 +57,8 @@ function inicomment {
 # Get an option from an INI file
 # iniget config-file section option
 function iniget {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local file=$1
     local section=$2
@@ -70,7 +73,8 @@ function iniget {
 # Get a multiple line option from an INI file
 # iniget_multiline config-file section option
 function iniget_multiline {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local file=$1
     local section=$2
@@ -85,7 +89,8 @@ function iniget_multiline {
 # Determinate is the given option present in the INI file
 # ini_has_option config-file section option
 function ini_has_option {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local file=$1
     local section=$2
@@ -107,7 +112,8 @@ function ini_has_option {
 #
 # iniadd_literal [-sudo] config-file section option value
 function iniadd_literal {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
@@ -135,7 +141,8 @@ $option = $value
 # Remove an option from an INI file
 # inidelete [-sudo] config-file section option
 function inidelete {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
@@ -161,7 +168,8 @@ function inidelete {
 # iniset [-sudo] config-file section option value
 #  - if the file does not exist, it is created
 function iniset {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
@@ -198,7 +206,8 @@ $option = $value
 # Set a multiple line option in an INI file
 # iniset_multiline [-sudo] config-file section option value1 value2 valu3 ...
 function iniset_multiline {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
@@ -236,7 +245,8 @@ $option = $v
 # Uncomment an option in an INI file
 # iniuncomment config-file section option
 function iniuncomment {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
     if [ $1 == "-sudo" ]; then
diff --git a/inc/python b/inc/python
index fd0d616b62..fe7bba6992 100644
--- a/inc/python
+++ b/inc/python
@@ -38,7 +38,8 @@ function get_pip_command {
 # Get the path to the direcotry where python executables are installed.
 # get_python_exec_prefix
 function get_python_exec_prefix {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     if [[ -z "$os_PACKAGE" ]]; then
         GetOSVersion
@@ -69,7 +70,8 @@ function pip_install_gr {
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
 # pip_install package [package ...]
 function pip_install {
-    local xtrace=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local upgrade=""
     local offline=${OFFLINE:-False}

From ada886dd43ccc07f48d3a82d8d3d840fe5096c03 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 7 Oct 2015 14:06:26 +1100
Subject: [PATCH 0911/3333] Don't mix declaration and set of locals

Ia0957b47187c3dcadd46154b17022c4213781112 proposes to have bashate
find instances of setting a local value.  The issue is that "local"
always returns 0, thus hiding any failure in the commands running to
set the variable.

This is an automated replacement of such instances

Depends-On: I676c805e8f0401f75cc5367eee83b3d880cdef81
Change-Id: I9c8912a8fd596535589b207d7fc553b9d951d3fe
---
 exercises/neutron-adv-test.sh         | 36 ++++++++++-----
 functions                             |  9 ++--
 functions-common                      | 36 ++++++++++-----
 inc/ini-config                        |  3 +-
 inc/meta-config                       |  3 +-
 inc/python                            | 18 +++++---
 inc/rootwrap                          |  6 ++-
 lib/apache                            | 12 +++--
 lib/ceph                              |  9 ++--
 lib/cinder                            |  6 ++-
 lib/glance                            |  6 ++-
 lib/heat                              |  3 +-
 lib/horizon                           |  9 ++--
 lib/ironic                            | 63 ++++++++++++++++++---------
 lib/keystone                          | 36 ++++++++++-----
 lib/ldap                              |  9 ++--
 lib/lvm                               |  6 ++-
 lib/neutron-legacy                    | 33 +++++++++-----
 lib/neutron_plugins/embrane           |  3 +-
 lib/neutron_plugins/ovs_base          |  6 ++-
 lib/nova                              | 15 ++++---
 lib/swift                             | 42 ++++++++++++------
 lib/tempest                           |  3 +-
 lib/tls                               |  3 +-
 tests/unittest.sh                     | 24 ++++++----
 tools/create_userrc.sh                |  3 +-
 tools/peakmem_tracker.sh              |  6 ++-
 tools/xen/scripts/install-os-vpx.sh   |  3 +-
 tools/xen/scripts/uninstall-os-vpx.sh | 12 +++--
 tools/xen/test_functions.sh           |  6 ++-
 30 files changed, 286 insertions(+), 143 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a0de4ccd37..a8fbd86473 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -122,41 +122,47 @@ function foreach_tenant_net {
 }
 
 function get_image_id {
-    local IMAGE_ID=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
+    local IMAGE_ID
+    IMAGE_ID=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
     die_if_not_set $LINENO IMAGE_ID "Failure retrieving IMAGE_ID"
     echo "$IMAGE_ID"
 }
 
 function get_tenant_id {
     local TENANT_NAME=$1
-    local TENANT_ID=`openstack project list | grep " $TENANT_NAME " | head -n 1 | get_field 1`
+    local TENANT_ID
+    TENANT_ID=`openstack project list | grep " $TENANT_NAME " | head -n 1 | get_field 1`
     die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for $TENANT_NAME"
     echo "$TENANT_ID"
 }
 
 function get_user_id {
     local USER_NAME=$1
-    local USER_ID=`openstack user list | grep $USER_NAME | awk '{print $2}'`
+    local USER_ID
+    USER_ID=`openstack user list | grep $USER_NAME | awk '{print $2}'`
     die_if_not_set $LINENO USER_ID "Failure retrieving USER_ID for $USER_NAME"
     echo "$USER_ID"
 }
 
 function get_role_id {
     local ROLE_NAME=$1
-    local ROLE_ID=`openstack role list | grep $ROLE_NAME | awk '{print $2}'`
+    local ROLE_ID
+    ROLE_ID=`openstack role list | grep $ROLE_NAME | awk '{print $2}'`
     die_if_not_set $LINENO ROLE_ID "Failure retrieving ROLE_ID for $ROLE_NAME"
     echo "$ROLE_ID"
 }
 
 function get_network_id {
     local NETWORK_NAME="$1"
-    local NETWORK_ID=`neutron net-list -F id  -- --name=$NETWORK_NAME | awk "NR==4" | awk '{print $2}'`
+    local NETWORK_ID
+    NETWORK_ID=`neutron net-list -F id  -- --name=$NETWORK_NAME | awk "NR==4" | awk '{print $2}'`
     echo $NETWORK_ID
 }
 
 function get_flavor_id {
     local INSTANCE_TYPE=$1
-    local FLAVOR_ID=`nova flavor-list | grep $INSTANCE_TYPE | awk '{print $2}'`
+    local FLAVOR_ID
+    FLAVOR_ID=`nova flavor-list | grep $INSTANCE_TYPE | awk '{print $2}'`
     die_if_not_set $LINENO FLAVOR_ID "Failure retrieving FLAVOR_ID for $INSTANCE_TYPE"
     echo "$FLAVOR_ID"
 }
@@ -185,13 +191,15 @@ function add_tenant {
 
 function remove_tenant {
     local TENANT=$1
-    local TENANT_ID=$(get_tenant_id $TENANT)
+    local TENANT_ID
+    TENANT_ID=$(get_tenant_id $TENANT)
     openstack project delete $TENANT_ID
 }
 
 function remove_user {
     local USER=$1
-    local USER_ID=$(get_user_id $USER)
+    local USER_ID
+    USER_ID=$(get_user_id $USER)
     openstack user delete $USER_ID
 }
 
@@ -221,9 +229,11 @@ function create_network {
     local NET_NAME="${TENANT}-net$NUM"
     local ROUTER_NAME="${TENANT}-router${NUM}"
     source $TOP_DIR/openrc admin admin
-    local TENANT_ID=$(get_tenant_id $TENANT)
+    local TENANT_ID
+    TENANT_ID=$(get_tenant_id $TENANT)
     source $TOP_DIR/openrc $TENANT $TENANT
-    local NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
+    local NET_ID
+    NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
     neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
@@ -251,7 +261,8 @@ function create_vm {
     done
     #TODO (nati) Add multi-nic test
     #TODO (nati) Add public-net test
-    local VM_UUID=`nova boot --flavor $(get_flavor_id m1.tiny) \
+    local VM_UUID
+    VM_UUID=`nova boot --flavor $(get_flavor_id m1.tiny) \
         --image $(get_image_id) \
         $NIC \
         $TENANT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
@@ -309,7 +320,8 @@ function delete_network {
     local NUM=$2
     local NET_NAME="${TENANT}-net$NUM"
     source $TOP_DIR/openrc admin admin
-    local TENANT_ID=$(get_tenant_id $TENANT)
+    local TENANT_ID
+    TENANT_ID=$(get_tenant_id $TENANT)
     #TODO(nati) comment out until l3-agent merged
     #for res in port subnet net router;do
     for net_id in `neutron net-list -c id -c name | grep $NET_NAME | awk '{print $2}'`;do
diff --git a/functions b/functions
index ff95c89ad9..8cf7a25f49 100644
--- a/functions
+++ b/functions
@@ -264,7 +264,8 @@ function upload_image {
             ;;
         *.img)
             image_name=$(basename "$image" ".img")
-            local format=$(qemu-img info ${image} | awk '/^file format/ { print $3; exit }')
+            local format
+            format=$(qemu-img info ${image} | awk '/^file format/ { print $3; exit }')
             if [[ ",qcow2,raw,vdi,vmdk,vpc," =~ ",$format," ]]; then
                 disk_format=$format
             else
@@ -405,7 +406,8 @@ function get_instance_ip {
     local vm_id=$1
     local network_name=$2
     local nova_result="$(nova show $vm_id)"
-    local ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
+    local ip
+    ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
     if [[ $ip = "" ]];then
         echo "$nova_result"
         die $LINENO "[Fail] Coudn't get ipaddress of VM"
@@ -455,7 +457,8 @@ function check_path_perm_sanity {
     # homedir permissions on RHEL and common practice of making DEST in
     # the stack user's homedir.
 
-    local real_path=$(readlink -f $1)
+    local real_path
+    real_path=$(readlink -f $1)
     local rebuilt_path=""
     for i in $(echo ${real_path} | tr "/" " "); do
         rebuilt_path=$rebuilt_path"/"$i
diff --git a/functions-common b/functions-common
index 53b64d668a..c831b261e1 100644
--- a/functions-common
+++ b/functions-common
@@ -140,7 +140,8 @@ function isset {
 # backtrace level
 function backtrace {
     local level=$1
-    local deep=$((${#BASH_SOURCE[@]} - 1))
+    local deep
+    deep=$((${#BASH_SOURCE[@]} - 1))
     echo "[Call Trace]"
     while [ $level -le $deep ]; do
         echo "${BASH_SOURCE[$deep]}:${BASH_LINENO[$deep-1]}:${FUNCNAME[$deep-1]}"
@@ -477,7 +478,8 @@ function git_clone {
     local git_remote=$1
     local git_dest=$2
     local git_ref=$3
-    local orig_dir=$(pwd)
+    local orig_dir
+    orig_dir=$(pwd)
     local git_clone_flags=""
 
     RECLONE=$(trueorfalse False RECLONE)
@@ -641,7 +643,8 @@ function get_default_host_ip {
         host_ip=""
         # Find the interface used for the default route
         host_ip_iface=${host_ip_iface:-$(ip -f $af route | awk '/default/ {print $5}' | head -1)}
-        local host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | sed /temporary/d |awk /$af'/ {split($2,parts,"/");  print parts[1]}')
+        local host_ips
+        host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | sed /temporary/d |awk /$af'/ {split($2,parts,"/");  print parts[1]}')
         local ip
         for ip in $host_ips; do
             # Attempt to filter out IP addresses that are part of the fixed and
@@ -690,7 +693,8 @@ function get_field {
 # copy over a default policy.json and policy.d for projects
 function install_default_policy {
     local project=$1
-    local project_uc=$(echo $1|tr a-z A-Z)
+    local project_uc
+    project_uc=$(echo $1|tr a-z A-Z)
     local conf_dir="${project_uc}_CONF_DIR"
     # eval conf dir to get the variable
     conf_dir="${!conf_dir}"
@@ -723,7 +727,8 @@ function policy_add {
 
     # Add a terminating comma to policy lines without one
     # Remove the closing '}' and all lines following to the end-of-file
-    local tmpfile=$(mktemp)
+    local tmpfile
+    tmpfile=$(mktemp)
     uniq ${policy_file} | sed -e '
         s/]$/],/
         /^[}]/,$d
@@ -945,7 +950,8 @@ function get_or_create_endpoint {
     # scenarios currently that use the returned id. Ideally this behaviour
     # should be pushed out to the service setups and let them create the
     # endpoints they need.
-    local public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
+    local public_id
+    public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
     _get_or_create_endpoint_with_interface $1 admin $4 $2
     _get_or_create_endpoint_with_interface $1 internal $5 $2
 
@@ -1065,7 +1071,8 @@ function get_packages {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local services=$@
-    local package_dir=$(_get_package_dir)
+    local package_dir
+    package_dir=$(_get_package_dir)
     local file_to_parse=""
     local service=""
 
@@ -1980,8 +1987,10 @@ function address_in_net {
     local ip=$1
     local range=$2
     local masklen=${range#*/}
-    local network=$(maskip ${range%/*} $(cidr2netmask $masklen))
-    local subnet=$(maskip $ip $(cidr2netmask $masklen))
+    local network
+    network=$(maskip ${range%/*} $(cidr2netmask $masklen))
+    local subnet
+    subnet=$(maskip $ip $(cidr2netmask $masklen))
     [[ $network == $subnet ]]
 }
 
@@ -2033,7 +2042,8 @@ function export_proxy_variables {
 
 # Returns true if the directory is on a filesystem mounted via NFS.
 function is_nfs_directory {
-    local mount_type=`stat -f -L -c %T $1`
+    local mount_type
+    mount_type=`stat -f -L -c %T $1`
     test "$mount_type" == "nfs"
 }
 
@@ -2044,13 +2054,15 @@ function maskip {
     local ip=$1
     local mask=$2
     local l="${ip%.*}"; local r="${ip#*.}"; local n="${mask%.*}"; local m="${mask#*.}"
-    local subnet=$((${ip%%.*}&${mask%%.*})).$((${r%%.*}&${m%%.*})).$((${l##*.}&${n##*.})).$((${ip##*.}&${mask##*.}))
+    local subnet
+    subnet=$((${ip%%.*}&${mask%%.*})).$((${r%%.*}&${m%%.*})).$((${l##*.}&${n##*.})).$((${ip##*.}&${mask##*.}))
     echo $subnet
 }
 
 # Return the current python as "python<major>.<minor>"
 function python_version {
-    local python_version=$(python -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    local python_version
+    python_version=$(python -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
     echo "python${python_version}"
 }
 
diff --git a/inc/ini-config b/inc/ini-config
index ba2d827ae9..42a66c63b6 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -196,7 +196,8 @@ function iniset {
 $option = $value
 " "$file"
     else
-        local sep=$(echo -ne "\x01")
+        local sep
+        sep=$(echo -ne "\x01")
         # Replace it
         $sudo sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
     fi
diff --git a/inc/meta-config b/inc/meta-config
index e5f902d1dd..d74db59bb3 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -89,7 +89,8 @@ function merge_config_file {
     # note, configfile might be a variable (note the iniset, etc
     # created in the mega-awk below is "eval"ed too, so we just leave
     # it alone.
-    local real_configfile=$(eval echo $configfile)
+    local real_configfile
+    real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
         touch $real_configfile
     fi
diff --git a/inc/python b/inc/python
index fe7bba6992..c7ba51a81d 100644
--- a/inc/python
+++ b/inc/python
@@ -61,7 +61,8 @@ function get_python_exec_prefix {
 # pip_install_gr packagename
 function pip_install_gr {
     local name=$1
-    local clean_name=$(get_from_global_requirements $name)
+    local clean_name
+    clean_name=$(get_from_global_requirements $name)
     pip_install $clean_name
 }
 
@@ -100,7 +101,8 @@ function pip_install {
             local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
             local sudo_pip="env"
         else
-            local cmd_pip=$(get_pip_command)
+            local cmd_pip
+            cmd_pip=$(get_pip_command)
             local sudo_pip="sudo -H"
         fi
     fi
@@ -109,7 +111,8 @@ function pip_install {
     # Always apply constraints
     cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
 
-    local pip_version=$(python -c "import pip; \
+    local pip_version
+    pip_version=$(python -c "import pip; \
                         print(pip.__version__.strip('.')[0])")
     if (( pip_version<6 )); then
         die $LINENO "Currently installed pip version ${pip_version} does not" \
@@ -143,7 +146,8 @@ function pip_install {
 # get_from_global_requirements <package>
 function get_from_global_requirements {
     local package=$1
-    local required_pkg=$(grep -i -h ^${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
+    local required_pkg
+    required_pkg=$(grep -i -h ^${package} $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
     if [[ $required_pkg == ""  ]]; then
         die $LINENO "Can't find package $package in requirements"
     fi
@@ -222,7 +226,8 @@ function setup_develop {
 # practical ways.
 function is_in_projects_txt {
     local project_dir=$1
-    local project_name=$(basename $project_dir)
+    local project_name
+    project_name=$(basename $project_dir)
     grep -q "/$project_name\$" $REQUIREMENTS_DIR/projects.txt
 }
 
@@ -241,7 +246,8 @@ function setup_package_with_constraints_edit {
 
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
-        local name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
+        local name
+        name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
         $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
             $REQUIREMENTS_DIR/upper-constraints.txt -- $name \
             "$flags file://$project_dir#egg=$name"
diff --git a/inc/rootwrap b/inc/rootwrap
index f91e557e68..63ab59adc7 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -41,7 +41,8 @@ function add_sudo_secure_path {
 # configure_rootwrap project
 function configure_rootwrap {
     local project=$1
-    local project_uc=$(echo $1|tr a-z A-Z)
+    local project_uc
+    project_uc=$(echo $1|tr a-z A-Z)
     local bin_dir="${project_uc}_BIN_DIR"
     bin_dir="${!bin_dir}"
     local project_dir="${project_uc}_DIR"
@@ -60,7 +61,8 @@ function configure_rootwrap {
     sudo sed -e "s:^filters_path=.*$:filters_path=/etc/${project}/rootwrap.d:" -i /etc/${project}/rootwrap.conf
 
     # Set up the rootwrap sudoers
-    local tempfile=$(mktemp)
+    local tempfile
+    tempfile=$(mktemp)
     # Specify rootwrap.conf as first parameter to rootwrap
     rootwrap_sudo_cmd="${rootwrap_bin} /etc/${project}/rootwrap.conf *"
     echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudo_cmd" >$tempfile
diff --git a/lib/apache b/lib/apache
index a8e9bc5ad2..17526c74d0 100644
--- a/lib/apache
+++ b/lib/apache
@@ -72,11 +72,14 @@ function install_apache_wsgi {
 # various differences between Apache 2.2 and 2.4 that warrant special handling.
 function get_apache_version {
     if is_ubuntu; then
-        local version_str=$(sudo /usr/sbin/apache2ctl -v | awk '/Server version/ {print $3}' | cut -f2 -d/)
+        local version_str
+        version_str=$(sudo /usr/sbin/apache2ctl -v | awk '/Server version/ {print $3}' | cut -f2 -d/)
     elif is_fedora; then
-        local version_str=$(rpm -qa --queryformat '%{VERSION}' httpd)
+        local version_str
+        version_str=$(rpm -qa --queryformat '%{VERSION}' httpd)
     elif is_suse; then
-        local version_str=$(rpm -qa --queryformat '%{VERSION}' apache2)
+        local version_str
+        version_str=$(rpm -qa --queryformat '%{VERSION}' apache2)
     else
         exit_distro_not_supported "cannot determine apache version"
     fi
@@ -115,7 +118,8 @@ function get_apache_version {
 function apache_site_config_for {
     local site=$@
     if is_ubuntu; then
-        local apache_version=$(get_apache_version)
+        local apache_version
+        apache_version=$(get_apache_version)
         if [[ "$apache_version" == "2.2" ]]; then
             # Ubuntu 12.04 - Apache 2.2
             echo $APACHE_CONF_DIR/${site}
diff --git a/lib/ceph b/lib/ceph
index 8e34aa49a4..29d2aca54f 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -83,7 +83,8 @@ ATTACH_ENCRYPTED_VOLUME_AVAILABLE=False
 # ------------
 
 function get_ceph_version {
-    local ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4 | cut -f 1,2 -d '.')
+    local ceph_version_str
+    ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4 | cut -f 1,2 -d '.')
     echo $ceph_version_str
 }
 
@@ -106,7 +107,8 @@ EOF
 # undefine_virsh_secret() - Undefine Cinder key secret from libvirt
 function undefine_virsh_secret {
     if is_service_enabled cinder || is_service_enabled nova; then
-        local virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
+        local virsh_uuid
+        virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
         sudo virsh secret-undefine ${virsh_uuid} >/dev/null 2>&1
     fi
 }
@@ -219,7 +221,8 @@ EOF
     done
 
     # pools data and metadata were removed in the Giant release so depending on the version we apply different commands
-    local ceph_version=$(get_ceph_version)
+    local ceph_version
+    ceph_version=$(get_ceph_version)
     # change pool replica size according to the CEPH_REPLICAS set by the user
     if [[ ${ceph_version%%.*} -eq 0 ]] && [[ ${ceph_version##*.} -lt 87 ]]; then
         sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
diff --git a/lib/cinder b/lib/cinder
index 10144117ec..73941c6973 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -150,7 +150,8 @@ function cleanup_cinder {
     # ensure the volume group is cleared up because fails might
     # leave dead volumes in the group
     if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
-        local targets=$(sudo tgtadm --op show --mode target)
+        local targets
+        targets=$(sudo tgtadm --op show --mode target)
         if [ $? -ne 0 ]; then
             # If tgt driver isn't running this won't work obviously
             # So check the response and restart if need be
@@ -198,7 +199,8 @@ function cleanup_cinder {
 
 # _cinder_config_apache_wsgi() - Set WSGI config files
 function _cinder_config_apache_wsgi {
-    local cinder_apache_conf=$(apache_site_config_for osapi-volume)
+    local cinder_apache_conf
+    cinder_apache_conf=$(apache_site_config_for osapi-volume)
     local cinder_ssl=""
     local cinder_certfile=""
     local cinder_keyfile=""
diff --git a/lib/glance b/lib/glance
index 7be3a8495c..2eb93a46e6 100644
--- a/lib/glance
+++ b/lib/glance
@@ -106,7 +106,8 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_REGISTRY_CONF DEFAULT log_file
-    local dburl=`database_connection_url glance`
+    local dburl
+    dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
@@ -265,7 +266,8 @@ function create_glance_accounts {
         # required for swift access
         if is_service_enabled s-proxy; then
 
-            local glance_swift_user=$(get_or_create_user "glance-swift" \
+            local glance_swift_user
+            glance_swift_user=$(get_or_create_user "glance-swift" \
                 "$SERVICE_PASSWORD" "default" "glance-swift@example.com")
             get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
         fi
diff --git a/lib/heat b/lib/heat
index 3e6975ae26..df85c72cfe 100644
--- a/lib/heat
+++ b/lib/heat
@@ -321,7 +321,8 @@ function build_heat_pip_mirror {
 
     echo "</body></html>" >> $HEAT_PIP_REPO/index.html
 
-    local heat_pip_repo_apache_conf=$(apache_site_config_for heat_pip_repo)
+    local heat_pip_repo_apache_conf
+    heat_pip_repo_apache_conf=$(apache_site_config_for heat_pip_repo)
 
     sudo cp $FILES/apache-heat-pip-repo.template $heat_pip_repo_apache_conf
     sudo sed -e "
diff --git a/lib/horizon b/lib/horizon
index b2539d1b7d..6ecd755795 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -49,7 +49,8 @@ function _horizon_config_set {
         sed -e "/^$option/d" -i $local_settings
         echo -e "\n$option=$value" >> $file
     elif grep -q "^$section" $file; then
-        local line=$(sed -ne "/^$section/,/^}/ { /^ *'$option':/ p; }" $file)
+        local line
+        line=$(sed -ne "/^$section/,/^}/ { /^ *'$option':/ p; }" $file)
         if [ -n "$line" ]; then
             sed -i -e "/^$section/,/^}/ s/^\( *'$option'\) *:.*$/\1: $value,/" $file
         else
@@ -68,7 +69,8 @@ function _horizon_config_set {
 # cleanup_horizon() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_horizon {
-    local horizon_conf=$(apache_site_config_for horizon)
+    local horizon_conf
+    horizon_conf=$(apache_site_config_for horizon)
     sudo rm -f $horizon_conf
 }
 
@@ -112,7 +114,8 @@ function init_horizon {
     # Create an empty directory that apache uses as docroot
     sudo mkdir -p $HORIZON_DIR/.blackhole
 
-    local horizon_conf=$(apache_site_config_for horizon)
+    local horizon_conf
+    horizon_conf=$(apache_site_config_for horizon)
 
     # Configure apache to run horizon
     sudo sh -c "sed -e \"
diff --git a/lib/ironic b/lib/ironic
index 40475e0a83..8eb0d80e07 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -225,7 +225,8 @@ function _cleanup_ironic_apache_wsgi {
 
 # _config_ironic_apache_wsgi() - Set WSGI config files of Ironic
 function _config_ironic_apache_wsgi {
-    local ironic_apache_conf=$(apache_site_config_for ironic)
+    local ironic_apache_conf
+    ironic_apache_conf=$(apache_site_config_for ironic)
     sudo cp $FILES/apache-ironic.template $ironic_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$IRONIC_HTTP_PORT|g;
@@ -325,11 +326,13 @@ function configure_ironic_api {
 function configure_ironic_conductor {
     cp $IRONIC_DIR/etc/ironic/rootwrap.conf $IRONIC_ROOTWRAP_CONF
     cp -r $IRONIC_DIR/etc/ironic/rootwrap.d $IRONIC_CONF_DIR
-    local ironic_rootwrap=$(get_rootwrap_location ironic)
+    local ironic_rootwrap
+    ironic_rootwrap=$(get_rootwrap_location ironic)
     local rootwrap_isudoer_cmd="$ironic_rootwrap $IRONIC_CONF_DIR/rootwrap.conf *"
 
     # Set up the rootwrap sudoers for ironic
-    local tempfile=`mktemp`
+    local tempfile
+    tempfile=`mktemp`
     echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_isudoer_cmd" >$tempfile
     chmod 0440 $tempfile
     sudo chown root:root $tempfile
@@ -370,7 +373,8 @@ function configure_ironic_conductor {
         fi
         iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:${SWIFT_DEFAULT_BIND_PORT:-8080}
         iniset $IRONIC_CONF_FILE glance swift_api_version v1
-        local tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME default)
+        local tenant_id
+        tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME default)
         iniset $IRONIC_CONF_FILE glance swift_account AUTH_${tenant_id}
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
@@ -379,7 +383,8 @@ function configure_ironic_conductor {
     fi
 
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        local pxebin=`basename $IRONIC_PXE_BOOT_IMAGE`
+        local pxebin
+        pxebin=`basename $IRONIC_PXE_BOOT_IMAGE`
         iniset $IRONIC_CONF_FILE pxe ipxe_enabled True
         iniset $IRONIC_CONF_FILE pxe pxe_config_template '\$pybasedir/drivers/modules/ipxe_config.template'
         iniset $IRONIC_CONF_FILE pxe pxe_bootfile_name $pxebin
@@ -445,7 +450,8 @@ function init_ironic {
 # _ironic_bm_vm_names() - Generates list of names for baremetal VMs.
 function _ironic_bm_vm_names {
     local idx
-    local num_vms=$(($IRONIC_VM_COUNT - 1))
+    local num_vms
+    num_vms=$(($IRONIC_VM_COUNT - 1))
     for idx in $(seq 0 $num_vms); do
         echo "baremetal${IRONIC_VM_NETWORK_BRIDGE}_${idx}"
     done
@@ -498,22 +504,27 @@ function stop_ironic {
 }
 
 function create_ovs_taps {
-    local ironic_net_id=$(neutron net-list | grep private | get_field 1)
+    local ironic_net_id
+    ironic_net_id=$(neutron net-list | grep private | get_field 1)
 
     # Work around: No netns exists on host until a Neutron port is created.  We
     # need to create one in Neutron to know what netns to tap into prior to the
     # first node booting.
-    local port_id=$(neutron port-create private | grep " id " | get_field 2)
+    local port_id
+    port_id=$(neutron port-create private | grep " id " | get_field 2)
 
     # intentional sleep to make sure the tag has been set to port
     sleep 10
 
     if  [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-        local tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
+        local tapdev
+        tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
     else
-        local tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
+        local tapdev
+        tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
     fi
-    local tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
+    local tag_id
+    tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
 
     # make sure veth pair is not existing, otherwise delete its links
     sudo ip link show ovs-tap1 && sudo ip link delete ovs-tap1
@@ -570,7 +581,8 @@ function wait_for_nova_resources {
 }
 
 function enroll_nodes {
-    local chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
+    local chassis_id
+    chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
 
     if ! is_ironic_hardware; then
         local ironic_node_cpu=$IRONIC_VM_SPECS_CPU
@@ -602,10 +614,14 @@ function enroll_nodes {
         if ! is_ironic_hardware; then
             local mac_address=$hardware_info
         elif [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
-            local ipmi_address=$(echo $hardware_info |awk  '{print $1}')
-            local mac_address=$(echo $hardware_info |awk '{print $2}')
-            local ironic_ipmi_username=$(echo $hardware_info |awk '{print $3}')
-            local ironic_ipmi_passwd=$(echo $hardware_info |awk '{print $4}')
+            local ipmi_address
+            ipmi_address=$(echo $hardware_info |awk  '{print $1}')
+            local mac_address
+            mac_address=$(echo $hardware_info |awk '{print $2}')
+            local ironic_ipmi_username
+            ironic_ipmi_username=$(echo $hardware_info |awk '{print $3}')
+            local ironic_ipmi_passwd
+            ironic_ipmi_passwd=$(echo $hardware_info |awk '{print $4}')
             # Currently we require all hardware platform have same CPU/RAM/DISK info
             # in future, this can be enhanced to support different type, and then
             # we create the bare metal flavor with minimum value
@@ -617,9 +633,11 @@ function enroll_nodes {
 
         # First node created will be used for testing in ironic w/o glance
         # scenario, so we need to know its UUID.
-        local standalone_node_uuid=$([ $total_nodes -eq 0 ] && echo "--uuid $IRONIC_NODE_UUID")
+        local standalone_node_uuid
+        standalone_node_uuid=$([ $total_nodes -eq 0 ] && echo "--uuid $IRONIC_NODE_UUID")
 
-        local node_id=$(ironic node-create $standalone_node_uuid\
+        local node_id
+        node_id=$(ironic node-create $standalone_node_uuid\
             --chassis_uuid $chassis_id \
             --driver $IRONIC_DEPLOY_DRIVER \
             --name node-$total_nodes \
@@ -640,7 +658,8 @@ function enroll_nodes {
     # NOTE(adam_g): Attempting to use an autogenerated UUID for flavor id here uncovered
     # bug (LP: #1333852) in Trove.  This can be changed to use an auto flavor id when the
     # bug is fixed in Juno.
-    local adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
+    local adjusted_disk
+    adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
     nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal 551 $ironic_node_ram $adjusted_disk $ironic_node_cpu
 
     nova flavor-key baremetal set "cpu_arch"="x86_64"
@@ -771,7 +790,8 @@ function upload_baremetal_ironic_deploy {
         fi
     fi
 
-    local token=$(openstack token issue -c id -f value)
+    local token
+    token=$(openstack token issue -c id -f value)
     die_if_not_set $LINENO token "Keystone fail to get token"
 
     # load them into glance
@@ -809,7 +829,8 @@ function prepare_baremetal_basic_ops {
 function cleanup_baremetal_basic_ops {
     rm -f $IRONIC_VM_MACS_CSV_FILE
     if [ -f $IRONIC_KEY_FILE ]; then
-        local key=$(cat $IRONIC_KEY_FILE.pub)
+        local key
+        key=$(cat $IRONIC_KEY_FILE.pub)
         # remove public key from authorized_keys
         grep -v "$key" $IRONIC_AUTHORIZED_KEYS_FILE > temp && mv temp $IRONIC_AUTHORIZED_KEYS_FILE
         chmod 0600 $IRONIC_AUTHORIZED_KEYS_FILE
diff --git a/lib/keystone b/lib/keystone
index ec28b46341..cdcc13a326 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -132,7 +132,8 @@ function _cleanup_keystone_apache_wsgi {
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
 function _config_keystone_apache_wsgi {
-    local keystone_apache_conf=$(apache_site_config_for keystone)
+    local keystone_apache_conf
+    keystone_apache_conf=$(apache_site_config_for keystone)
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
@@ -347,9 +348,12 @@ function configure_keystone_extensions {
 function create_keystone_accounts {
 
     # admin
-    local admin_tenant=$(get_or_create_project "admin" default)
-    local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
-    local admin_role=$(get_or_create_role "admin")
+    local admin_tenant
+    admin_tenant=$(get_or_create_project "admin" default)
+    local admin_user
+    admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
+    local admin_role
+    admin_role=$(get_or_create_role "admin")
     get_or_add_user_project_role $admin_role $admin_user $admin_tenant
 
     # Create service project/role
@@ -365,18 +369,23 @@ function create_keystone_accounts {
     get_or_create_role ResellerAdmin
 
     # The Member role is used by Horizon and Swift so we need to keep it:
-    local member_role=$(get_or_create_role "Member")
+    local member_role
+    member_role=$(get_or_create_role "Member")
 
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
-    local another_role=$(get_or_create_role "anotherrole")
+    local another_role
+    another_role=$(get_or_create_role "anotherrole")
 
     # invisible tenant - admin can't see this one
-    local invis_tenant=$(get_or_create_project "invisible_to_admin" default)
+    local invis_tenant
+    invis_tenant=$(get_or_create_project "invisible_to_admin" default)
 
     # demo
-    local demo_tenant=$(get_or_create_project "demo" default)
-    local demo_user=$(get_or_create_user "demo" \
+    local demo_tenant
+    demo_tenant=$(get_or_create_project "demo" default)
+    local demo_user
+    demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "default" "demo@example.com")
 
     get_or_add_user_project_role $member_role $demo_user $demo_tenant
@@ -384,9 +393,11 @@ function create_keystone_accounts {
     get_or_add_user_project_role $another_role $demo_user $demo_tenant
     get_or_add_user_project_role $member_role $demo_user $invis_tenant
 
-    local admin_group=$(get_or_create_group "admins" \
+    local admin_group
+    admin_group=$(get_or_create_group "admins" \
         "default" "openstack admin group")
-    local non_admin_group=$(get_or_create_group "nonadmins" \
+    local non_admin_group
+    non_admin_group=$(get_or_create_group "nonadmins" \
         "default" "non-admin group")
 
     get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
@@ -415,7 +426,8 @@ function create_keystone_accounts {
 function create_service_user {
     local role=${2:-service}
 
-    local user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
+    local user
+    user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
     get_or_add_user_project_role "$role" "$user" "$SERVICE_TENANT_NAME"
 }
 
diff --git a/lib/ldap b/lib/ldap
index d2dbc3b728..0414fea639 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -82,7 +82,8 @@ function cleanup_ldap {
 function init_ldap {
     local keystone_ldif
 
-    local tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)
+    local tmp_ldap_dir
+    tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)
 
     # Remove data but not schemas
     clear_ldap_state
@@ -113,7 +114,8 @@ function install_ldap {
     echo "Installing LDAP inside function"
     echo "os_VENDOR is $os_VENDOR"
 
-    local tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)
+    local tmp_ldap_dir
+    tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)
 
     printf "installing OpenLDAP"
     if is_ubuntu; then
@@ -129,7 +131,8 @@ function install_ldap {
     fi
 
     echo "LDAP_PASSWORD is $LDAP_PASSWORD"
-    local slappass=$(slappasswd -s $LDAP_PASSWORD)
+    local slappass
+    slappass=$(slappasswd -s $LDAP_PASSWORD)
     printf "LDAP secret is $slappass\n"
 
     # Create manager.ldif and add to olcdb
diff --git a/lib/lvm b/lib/lvm
index 8afd543f34..468a99aecc 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -56,7 +56,8 @@ function _clean_lvm_backing_file {
 
     # If the backing physical device is a loop device, it was probably setup by DevStack
     if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
-        local vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
+        local vg_dev
+        vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
         sudo losetup -d $vg_dev
         rm -f $backing_file
     fi
@@ -89,7 +90,8 @@ function _create_lvm_volume_group {
     if ! sudo vgs $vg; then
         # Only create if the file doesn't already exists
         [[ -f $backing_file ]] || truncate -s $size $backing_file
-        local vg_dev=`sudo losetup -f --show $backing_file`
+        local vg_dev
+        vg_dev=`sudo losetup -f --show $backing_file`
 
         # Only create volume group if it doesn't already exist
         if ! sudo vgs $vg; then
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e67bd4ae32..e9f88fbd1b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -806,7 +806,8 @@ function _move_neutron_addresses_route {
 
         local IP_ADD=""
         local IP_DEL=""
-        local DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
+        local DEFAULT_ROUTE_GW
+        DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
         if [[ $af == "inet" ]]; then
@@ -1244,7 +1245,8 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
-    local subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    local subnet_id
+    subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $TENANT_ID"
     echo $subnet_id
 }
@@ -1259,7 +1261,8 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
-    local ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    local ipv6_subnet_id
+    ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $TENANT_ID"
     echo $ipv6_subnet_id
 }
@@ -1272,7 +1275,8 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
-    local id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    local id_and_ext_gw_ip
+    id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
@@ -1284,7 +1288,8 @@ function _neutron_create_public_subnet_v6 {
     subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
-    local ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    local ipv6_id_and_ext_gw_ip
+    ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
@@ -1293,8 +1298,10 @@ function _neutron_create_public_subnet_v6 {
 function _neutron_configure_router_v4 {
     neutron router-interface-add $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
-    local id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
-    local ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
+    local id_and_ext_gw_ip
+    id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
+    local ext_gw_ip
+    ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
     neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
@@ -1331,9 +1338,12 @@ function _neutron_configure_router_v4 {
 function _neutron_configure_router_v6 {
     neutron router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
-    local ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
-    local ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
-    local ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
+    local ipv6_id_and_ext_gw_ip
+    ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
+    local ipv6_ext_gw_ip
+    ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
+    local ipv6_pub_subnet_id
+    ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
 
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
@@ -1351,7 +1361,8 @@ function _neutron_configure_router_v6 {
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-            local ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local ext_gw_interface
+            ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
 
             # Configure interface for public bridge
diff --git a/lib/neutron_plugins/embrane b/lib/neutron_plugins/embrane
index 6b4819ef70..2028496ca1 100644
--- a/lib/neutron_plugins/embrane
+++ b/lib/neutron_plugins/embrane
@@ -10,7 +10,8 @@ set +o xtrace
 source $TOP_DIR/lib/neutron_plugins/openvswitch
 
 function save_function {
-    local ORIG_FUNC=$(declare -f $1)
+    local ORIG_FUNC
+    ORIG_FUNC=$(declare -f $1)
     local NEW_FUNC="$2${ORIG_FUNC#$1}"
     eval "$NEW_FUNC"
 }
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index b012683a6f..d3fd198b08 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -49,8 +49,10 @@ function neutron_ovs_base_cleanup {
 
 function _neutron_ovs_base_install_ubuntu_dkms {
     # install Dynamic Kernel Module Support packages if needed
-    local kernel_version=$(uname -r)
-    local kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
+    local kernel_version
+    kernel_version=$(uname -r)
+    local kernel_major_minor
+    kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
     # From kernel 3.13 on, openvswitch-datapath-dkms is not needed
     if [ `vercmp_numbers "$kernel_major_minor" "3.13"` -lt "0" ]; then
         install_package "dkms openvswitch-datapath-dkms linux-headers-$kernel_version"
diff --git a/lib/nova b/lib/nova
index 9830276232..6e6075cae6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -202,14 +202,16 @@ function cleanup_nova {
         clean_iptables
 
         # Destroy old instances
-        local instances=`sudo virsh list --all | grep $INSTANCE_NAME_PREFIX | sed "s/.*\($INSTANCE_NAME_PREFIX[0-9a-fA-F]*\).*/\1/g"`
+        local instances
+        instances=`sudo virsh list --all | grep $INSTANCE_NAME_PREFIX | sed "s/.*\($INSTANCE_NAME_PREFIX[0-9a-fA-F]*\).*/\1/g"`
         if [ ! "$instances" = "" ]; then
             echo $instances | xargs -n1 sudo virsh destroy || true
             echo $instances | xargs -n1 sudo virsh undefine --managed-save || true
         fi
 
         # Logout and delete iscsi sessions
-        local tgts=$(sudo iscsiadm --mode node | grep $VOLUME_NAME_PREFIX | cut -d ' ' -f2)
+        local tgts
+        tgts=$(sudo iscsiadm --mode node | grep $VOLUME_NAME_PREFIX | cut -d ' ' -f2)
         local target
         for target in $tgts; do
             sudo iscsiadm --mode node -T $target --logout || true
@@ -245,8 +247,10 @@ function _cleanup_nova_apache_wsgi {
 function _config_nova_apache_wsgi {
     sudo mkdir -p $NOVA_WSGI_DIR
 
-    local nova_apache_conf=$(apache_site_config_for nova-api)
-    local nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
+    local nova_apache_conf
+    nova_apache_conf=$(apache_site_config_for nova-api)
+    local nova_ec2_apache_conf
+    nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
     local nova_ssl=""
     local nova_certfile=""
     local nova_keyfile=""
@@ -784,7 +788,8 @@ function start_nova_api {
     export PATH=$NOVA_BIN_DIR:$PATH
 
     # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file=$(apache_site_config_for nova-api)
+    local enabled_site_file
+    enabled_site_file=$(apache_site_config_for nova-api)
     if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site nova-api
         enable_apache_site nova-ec2-api
diff --git a/lib/swift b/lib/swift
index 645bfd7cd9..62f47dce50 100644
--- a/lib/swift
+++ b/lib/swift
@@ -205,9 +205,12 @@ function _config_swift_apache_wsgi {
     # copy apache vhost file and set name and port
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do
-        local object_port=$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))
-        local container_port=$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))
-        local account_port=$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))
+        local object_port
+        object_port=$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))
+        local container_port
+        container_port=$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))
+        local account_port
+        account_port=$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))
 
         sudo cp ${SWIFT_DIR}/examples/apache2/object-server.template $(apache_site_config_for object-server-${node_number})
         sudo sed -e "
@@ -504,7 +507,8 @@ EOF
 
     if is_service_enabled keystone; then
         iniuncomment ${testfile} func_test auth_version
-        local auth_vers=$(iniget ${testfile} func_test auth_version)
+        local auth_vers
+        auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
         iniset ${testfile} func_test auth_port ${KEYSTONE_AUTH_PORT}
         if [[ $auth_vers == "3" ]]; then
@@ -514,7 +518,8 @@ EOF
         fi
     fi
 
-    local user_group=$(id -g ${STACK_USER})
+    local user_group
+    user_group=$(id -g ${STACK_USER})
     sudo install -d -o ${STACK_USER} -g ${user_group} ${SWIFT_DATA_DIR}
 
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
@@ -540,7 +545,8 @@ function create_swift_disk {
     # First do a bit of setup by creating the directories and
     # changing the permissions so we can run it as our user.
 
-    local user_group=$(id -g ${STACK_USER})
+    local user_group
+    user_group=$(id -g ${STACK_USER})
     sudo install -d -o ${STACK_USER} -g ${user_group} ${SWIFT_DATA_DIR}/{drives,cache,run,logs}
 
     # Create a loopback disk and format it to XFS.
@@ -607,7 +613,8 @@ function create_swift_accounts {
 
     KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
 
-    local another_role=$(get_or_create_role "anotherrole")
+    local another_role
+    another_role=$(get_or_create_role "anotherrole")
 
     # NOTE(jroll): Swift doesn't need the admin role here, however Ironic uses
     # temp urls, which break when uploaded by a non-admin role
@@ -623,33 +630,40 @@ function create_swift_accounts {
             "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s"
     fi
 
-    local swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
+    local swift_tenant_test1
+    swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
     die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
     SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password \
                         "default" "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
     get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
 
-    local swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password \
+    local swift_user_test3
+    swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password \
                                 "default" "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
     get_or_add_user_project_role $another_role $swift_user_test3 $swift_tenant_test1
 
-    local swift_tenant_test2=$(get_or_create_project swifttenanttest2 default)
+    local swift_tenant_test2
+    swift_tenant_test2=$(get_or_create_project swifttenanttest2 default)
     die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
 
-    local swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password \
+    local swift_user_test2
+    swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password \
                                 "default" "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
     get_or_add_user_project_role admin $swift_user_test2 $swift_tenant_test2
 
-    local swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
+    local swift_domain
+    swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
     die_if_not_set $LINENO swift_domain "Failure creating swift_test domain"
 
-    local swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
+    local swift_tenant_test4
+    swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
     die_if_not_set $LINENO swift_tenant_test4 "Failure creating swift_tenant_test4"
 
-    local swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
+    local swift_user_test4
+    swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
                                 $swift_domain "test4@example.com")
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
     get_or_add_user_project_role admin $swift_user_test4 $swift_tenant_test4
diff --git a/lib/tempest b/lib/tempest
index f4d0a6dab0..e7ea429847 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -372,7 +372,8 @@ function configure_tempest {
     # Compute Features
     # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
-    local tmp_cfg_file=$(mktemp)
+    local tmp_cfg_file
+    tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
     tox -revenv -- verify-tempest-config -uro $tmp_cfg_file
 
diff --git a/lib/tls b/lib/tls
index 8ff2027819..f4740b88be 100644
--- a/lib/tls
+++ b/lib/tls
@@ -346,7 +346,8 @@ function make_root_CA {
 # we need to change it.
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
-        local capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
+        local capath
+        capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
 
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 603652a216..df7a8b4534 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -20,8 +20,10 @@ FAILED_FUNCS=""
 # pass a test, printing out MSG
 #  usage: passed message
 function passed {
-    local lineno=$(caller 0 | awk '{print $1}')
-    local function=$(caller 0 | awk '{print $2}')
+    local lineno
+    lineno=$(caller 0 | awk '{print $1}')
+    local function
+    function=$(caller 0 | awk '{print $2}')
     local msg="$1"
     if [ -z "$msg" ]; then
         msg="OK"
@@ -33,8 +35,10 @@ function passed {
 # fail a test, printing out MSG
 #  usage: failed message
 function failed {
-    local lineno=$(caller 0 | awk '{print $1}')
-    local function=$(caller 0 | awk '{print $2}')
+    local lineno
+    lineno=$(caller 0 | awk '{print $1}')
+    local function
+    function=$(caller 0 | awk '{print $2}')
     local msg="$1"
     FAILED_FUNCS+="$function:L$lineno\n"
     echo "ERROR: $function:L$lineno!"
@@ -45,8 +49,10 @@ function failed {
 # assert string comparision of val1 equal val2, printing out msg
 #  usage: assert_equal val1 val2 msg
 function assert_equal {
-    local lineno=`caller 0 | awk '{print $1}'`
-    local function=`caller 0 | awk '{print $2}'`
+    local lineno
+    lineno=`caller 0 | awk '{print $1}'`
+    local function
+    function=`caller 0 | awk '{print $2}'`
     local msg=$3
 
     if [ -z "$msg" ]; then
@@ -66,8 +72,10 @@ function assert_equal {
 # assert variable is empty/blank, printing out msg
 #  usage: assert_empty VAR msg
 function assert_empty {
-    local lineno=`caller 0 | awk '{print $1}'`
-    local function=`caller 0 | awk '{print $2}'`
+    local lineno
+    lineno=`caller 0 | awk '{print $1}'`
+    local function
+    function=`caller 0 | awk '{print $2}'`
     local msg=$2
 
     if [ -z "$msg" ]; then
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index de44abbbe5..25f713ca93 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -190,7 +190,8 @@ function add_entry {
     local user_passwd=$5
 
     # The admin user can see all user's secret AWS keys, it does not looks good
-    local line=`openstack ec2 credentials list --user $user_id | grep " $project_id "`
+    local line
+    line=$(openstack ec2 credentials list --user $user_id | grep " $project_id " || true)
     if [ -z "$line" ]; then
         openstack ec2 credentials create --user $user_id --project $project_id 1>&2
         line=`openstack ec2 credentials list --user $user_id | grep " $project_id "`
diff --git a/tools/peakmem_tracker.sh b/tools/peakmem_tracker.sh
index 0d5728a538..ecbd79a0bc 100755
--- a/tools/peakmem_tracker.sh
+++ b/tools/peakmem_tracker.sh
@@ -41,10 +41,12 @@ function get_mem_available {
 # snapshot of current usage; i.e. checking the latest entry in the
 # file will give the peak-memory usage
 function tracker {
-    local low_point=$(get_mem_available)
+    local low_point
+    low_point=$(get_mem_available)
     while [ 1 ]; do
 
-        local mem_available=$(get_mem_available)
+        local mem_available
+        mem_available=$(get_mem_available)
 
         if [[ $mem_available -lt $low_point ]]; then
             low_point=$mem_available
diff --git a/tools/xen/scripts/install-os-vpx.sh b/tools/xen/scripts/install-os-vpx.sh
index 1ebbeaf564..66f7ef4763 100755
--- a/tools/xen/scripts/install-os-vpx.sh
+++ b/tools/xen/scripts/install-os-vpx.sh
@@ -100,7 +100,8 @@ create_vif()
 {
     local v="$1"
     echo "Installing VM interface on [$BRIDGE]"
-    local out_network_uuid=$(find_network "$BRIDGE")
+    local out_network_uuid
+    out_network_uuid=$(find_network "$BRIDGE")
     xe vif-create vm-uuid="$v" network-uuid="$out_network_uuid" device="0"
 }
 
diff --git a/tools/xen/scripts/uninstall-os-vpx.sh b/tools/xen/scripts/uninstall-os-vpx.sh
index 1ed249433a..96dad7e852 100755
--- a/tools/xen/scripts/uninstall-os-vpx.sh
+++ b/tools/xen/scripts/uninstall-os-vpx.sh
@@ -35,9 +35,12 @@ xe_min()
 destroy_vdi()
 {
     local vbd_uuid="$1"
-    local type=$(xe_min vbd-list uuid=$vbd_uuid params=type)
-    local dev=$(xe_min vbd-list uuid=$vbd_uuid params=userdevice)
-    local vdi_uuid=$(xe_min vbd-list uuid=$vbd_uuid params=vdi-uuid)
+    local type
+    type=$(xe_min vbd-list uuid=$vbd_uuid params=type)
+    local dev
+    dev=$(xe_min vbd-list uuid=$vbd_uuid params=userdevice)
+    local vdi_uuid
+    vdi_uuid=$(xe_min vbd-list uuid=$vbd_uuid params=vdi-uuid)
 
     if [ "$type" == 'Disk' ] && [ "$dev" != 'xvda' ] && [ "$dev" != '0' ]; then
         xe vdi-destroy uuid=$vdi_uuid
@@ -47,7 +50,8 @@ destroy_vdi()
 uninstall()
 {
     local vm_uuid="$1"
-    local power_state=$(xe_min vm-list uuid=$vm_uuid params=power-state)
+    local power_state
+    power_state=$(xe_min vm-list uuid=$vm_uuid params=power-state)
 
     if [ "$power_state" != "halted" ]; then
         xe vm-shutdown vm=$vm_uuid force=true
diff --git a/tools/xen/test_functions.sh b/tools/xen/test_functions.sh
index 924e773c00..324e6a1a1e 100755
--- a/tools/xen/test_functions.sh
+++ b/tools/xen/test_functions.sh
@@ -165,7 +165,8 @@ EOF
 function test_get_local_sr {
     setup_xe_response "uuid123"
 
-    local RESULT=$(. mocks && get_local_sr)
+    local RESULT
+    RESULT=$(. mocks && get_local_sr)
 
     [ "$RESULT" == "uuid123" ]
 
@@ -173,7 +174,8 @@ function test_get_local_sr {
 }
 
 function test_get_local_sr_path {
-    local RESULT=$(mock_out get_local_sr "uuid1" && get_local_sr_path)
+    local RESULT
+    RESULT=$(mock_out get_local_sr "uuid1" && get_local_sr_path)
 
     [ "/var/run/sr-mount/uuid1" == "$RESULT" ]
 }

From 056a0c6bbc277937ee79361f901e4f6bd5513eec Mon Sep 17 00:00:00 2001
From: Christian Berendt <berendt@b1-systems.de>
Date: Wed, 7 Oct 2015 18:11:46 +0200
Subject: [PATCH 0912/3333] build_docs: do not handle md and conf files with
 shocco

At the moment the following md and conf files are handled with shocco.
This should not be the case.

* samples/local.conf
* lib/neutron_thirdparty/README.md
* lib/neutron_plugins/README.md

Change-Id: I11ea5ebda111e6cdab71d3cffaeb4f16443bfd3c
---
 tools/build_docs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build_docs.sh b/tools/build_docs.sh
index fa843432b5..7dc492e2a4 100755
--- a/tools/build_docs.sh
+++ b/tools/build_docs.sh
@@ -81,7 +81,7 @@ for f in $(find . \( -name .git -o -name .tox \) -prune -o \( -type f -name \*.s
     mkdir -p $FQ_HTML_BUILD/`dirname $f`;
     $SHOCCO $f > $FQ_HTML_BUILD/$f.html
 done
-for f in $(find functions functions-common inc lib pkg samples -type f -name \*); do
+for f in $(find functions functions-common inc lib pkg samples -type f -name \* ! -name *.md ! -name *.conf); do
     echo $f
     FILES+="$f "
     mkdir -p $FQ_HTML_BUILD/`dirname $f`;

From 1de9e330de9fd509fcdbe04c4722951b3acf199c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 7 Oct 2015 08:46:13 -0400
Subject: [PATCH 0913/3333] add big warning for extras.d usage

This adds a warning for extras.d usage. This will give us something to
keep an eye on in logstash to build up the list of projects that will
break at Mitaka-1.

This also makes the deprecated handling done through a function, which
will hopefully make it more consistent in the future.

Change-Id: Icd393bc3e7095fe58be0fd13ef74fece3aa5c5f1
---
 functions-common | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/functions-common b/functions-common
index cfe0c8d4ba..ee5c5cd03c 100644
--- a/functions-common
+++ b/functions-common
@@ -179,6 +179,12 @@ function die_if_not_set {
     $xtrace
 }
 
+function deprecated {
+    local text=$1
+    DEPRECATED_TEXT+="\n$text"
+    echo "WARNING: $text"
+}
+
 # Prints line number and "message" in error format
 # err $LINENO "message"
 function err {
@@ -1728,6 +1734,16 @@ function run_phase {
     if [[ -d $TOP_DIR/extras.d ]]; then
         for i in $TOP_DIR/extras.d/*.sh; do
             [[ -r $i ]] && source $i $mode $phase
+            # NOTE(sdague): generate a big warning about using
+            # extras.d in an unsupported way which will let us track
+            # unsupported usage in the gate.
+            local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
+            local extra=$(basename $i)
+            if [[ ! ( $exceptions =~ "$extra" ) ]]; then
+                deprecated "extras.d support is being removed in Mitaka-1"
+                deprecated "jobs for project $extra will break after that point"
+                deprecated "please move project to a supported devstack plugin model"
+            fi
         done
     fi
     # the source phase corresponds to settings loading in plugins

From 72ad942796adb03c96154cd1df4f97ad775e6092 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 7 Oct 2015 11:51:40 -0400
Subject: [PATCH 0914/3333] use deprecated function instead of modifying global

It's safer to run this through a common function to let us make
changes later.

Change-Id: Ic661824027577e1946726c1843a29ac8325915bf
---
 functions  | 2 +-
 lib/cinder | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index ff95c89ad9..3e17f2f9e9 100644
--- a/functions
+++ b/functions
@@ -341,7 +341,7 @@ function use_database {
         # No backends registered means this is likely called from ``localrc``
         # This is now deprecated usage
         DATABASE_TYPE=$1
-        DEPRECATED_TEXT="$DEPRECATED_TEXT\nThe database backend needs to be properly set in ENABLED_SERVICES; use_database is deprecated localrc\n"
+        deprecated "The database backend needs to be properly set in ENABLED_SERVICES; use_database is deprecated localrc"
     else
         # This should no longer get called...here for posterity
         use_exclusive_service DATABASE_BACKENDS DATABASE_TYPE $1
diff --git a/lib/cinder b/lib/cinder
index 10144117ec..2cda8b7841 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -93,7 +93,7 @@ if [[ -n $CINDER_SECURE_DELETE ]]; then
     if [[ $CINDER_SECURE_DELETE == "False" ]]; then
         CINDER_VOLUME_CLEAR_DEFAULT="none"
     fi
-    DEPRECATED_TEXT="$DEPRECATED_TEXT\nConfigure secure Cinder volume deletion using CINDER_VOLUME_CLEAR instead of CINDER_SECURE_DELETE.\n"
+    deprecated "Configure secure Cinder volume deletion using CINDER_VOLUME_CLEAR instead of CINDER_SECURE_DELETE."
 fi
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')

From a0cc2918adb4fc9f43c4f2e7f2cec9f46630636f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 7 Oct 2015 09:06:42 -0400
Subject: [PATCH 0915/3333] fix warning in install_get_pip

we were unconditionally adding -z to the curl command even if the file
doesn't exist that we are referencing. That produces a scary warning
for users. Lets not do that.

Change-Id: Id2860c1c702510b0f8fd496abce579d0fa3ff867
---
 tools/install_pip.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 7b42c8c485..41261800e4 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -53,8 +53,15 @@ function install_get_pip {
     # since and only download if a new version is out -- but only if
     # it seems we downloaded the file originally.
     if [[ ! -r $LOCAL_PIP || -r $LOCAL_PIP.downloaded ]]; then
+        # only test freshness if LOCAL_PIP is actually there,
+        # otherwise we generate a scary warning.
+        local timecond=""
+        if [[ -r $LOCAL_PIP ]]; then
+            timecond="-z $LOCAL_PIP"
+        fi
+
         curl --retry 6 --retry-delay 5 \
-            -z $LOCAL_PIP -o $LOCAL_PIP $PIP_GET_PIP_URL || \
+            $timecond -o $LOCAL_PIP $PIP_GET_PIP_URL || \
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi

From 33e3969081e9d3acd332f909cf405193603ec915 Mon Sep 17 00:00:00 2001
From: Dave McCowan <dmccowan@cisco.com>
Date: Wed, 7 Oct 2015 16:57:58 -0400
Subject: [PATCH 0916/3333] Add Barbican to plugin registry list

Barbican can now be installed with devstack via:

enable_plugin barbican https://git.openstack.org/openstack/barbican

Change-Id: I81af04bb6600d1e58590c39efdc2c0c91563321d
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 85fd7cc065..eb09988a53 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -22,6 +22,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |aodh              |git://git.openstack.org/openstack/aodh       | alarming           |
 +------------------+---------------------------------------------+--------------------+
+|barbican          |git://git.openstack.org/openstack/barbican   | key management     |
++------------------+---------------------------------------------+--------------------+
 |ceilometer        |git://git.openstack.org/openstack/ceilometer | metering           |
 +------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |

From 7adf15df5c0812a74a1697b930003bc1dcddb127 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 23 Sep 2015 11:56:02 +1000
Subject: [PATCH 0917/3333] Add a debugging userrc after keystone is up

As a follow-on to the issues raised by
I069f46f95656655ae7ba8f3dd929f47eae594b68, rather than a re-write of
create_userrc.sh logic, create a temporary userrc that can be helpful
for debugging until we have the whole system bootstrapped

Change-Id: I3325acffd259cf7f6f4a153c88037cfe8405ca50
---
 stack.sh | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/stack.sh b/stack.sh
index 01668c208b..58a708c497 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1007,14 +1007,27 @@ if is_service_enabled keystone; then
     # Begone token auth
     unset OS_TOKEN OS_URL
 
-    # Set up password auth credentials now that Keystone is bootstrapped
-    export OS_AUTH_URL=$KEYSTONE_AUTH_URI
-    export OS_USERNAME=admin
-    export OS_USER_DOMAIN_ID=default
-    export OS_PASSWORD=$ADMIN_PASSWORD
-    export OS_PROJECT_NAME=admin
-    export OS_PROJECT_DOMAIN_ID=default
-    export OS_REGION_NAME=$REGION_NAME
+    # Rather than just export these, we write them out to a
+    # intermediate userrc file that can also be used to debug if
+    # something goes wrong between here and running
+    # tools/create_userrc.sh (this script relies on services other
+    # than keystone being available, so we can't call it right now)
+    cat > $TOP_DIR/userrc_early <<EOF
+# Use this for debugging issues before files in accrc are created
+
+# Set up password auth credentials now that Keystone is bootstrapped
+export OS_AUTH_URL=$KEYSTONE_AUTH_URI
+export OS_USERNAME=admin
+export OS_USER_DOMAIN_ID=default
+export OS_PASSWORD=$ADMIN_PASSWORD
+export OS_PROJECT_NAME=admin
+export OS_PROJECT_DOMAIN_ID=default
+export OS_REGION_NAME=$REGION_NAME
+
+EOF
+
+    source $TOP_DIR/userrc_early
+
 fi
 
 # Write a clouds.yaml file

From 797668ba77d781bf65cbf0832c69c8337603b9a4 Mon Sep 17 00:00:00 2001
From: jianghua wang <jianghua.wang@citrix.com>
Date: Thu, 8 Oct 2015 06:40:21 +0100
Subject: [PATCH 0918/3333] XenServer: the cron job shouldn't print debug text
 into stderr

one cron job attempts to print debug text into stderr; so the file
of /root/dead.letter gets created and its size grows continuously.
It could eventually threaten dom0 disk space. Maybe there are two
solutions: one is to redirect the output to a specific log file;
and rotate log files in the script. And the other one is simply
to redirect the output /dev/null. By considering the function of
this cron job and the printed contents are straight and simple,
this patch set goes with the later solution.

Change-Id: I4875e5e3837e6f0249e314c6c5f408c79145c6c1
Closes-Bug: 1503966
---
 lib/nova_plugins/hypervisor-xenserver | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index efce383222..e097990bd3 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -79,7 +79,7 @@ function configure_nova_hypervisor {
 
     # Create a cron job that will rotate guest logs
     $ssh_dom0 crontab - << CRONTAB
-* * * * * /root/rotate_xen_guest_logs.sh
+* * * * * /root/rotate_xen_guest_logs.sh >/dev/null 2>&1
 CRONTAB
 
     # Create directories for kernels and images

From c988bf6fde5e692e768f7fbd6b70d2d5715cb85e Mon Sep 17 00:00:00 2001
From: "Swapnil (coolsvap) Kulkarni" <me@coolsvap.net>
Date: Thu, 8 Oct 2015 13:10:43 +0530
Subject: [PATCH 0919/3333] Updated configuration and docs for MYSQL_PASSWORD

Updated MYSQL_PASSWORD to DATABASE_PASSWORD in sample
configuration and existing docs

Change-Id: Iafb295a0b7707e08a81e6528620db8543d40f7ae
---
 doc/source/guides/multinode-lab.rst  | 4 ++--
 doc/source/guides/neutron.rst        | 2 +-
 doc/source/guides/single-machine.rst | 2 +-
 doc/source/guides/single-vm.rst      | 2 +-
 samples/local.conf                   | 2 +-
 tools/xen/README.md                  | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 1530a84523..5660bc5222 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -128,7 +128,7 @@ cluster controller's DevStack in ``local.conf``:
     MULTI_HOST=1
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
-    MYSQL_PASSWORD=supersecret
+    DATABASE_PASSWORD=supersecret
     RABBIT_PASSWORD=supersecrete
     SERVICE_PASSWORD=supersecrete
     SERVICE_TOKEN=xyzpdqlazydog
@@ -169,7 +169,7 @@ machines, create a ``local.conf`` with:
     MULTI_HOST=1
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
-    MYSQL_PASSWORD=supersecret
+    DATABASE_PASSWORD=supersecret
     RABBIT_PASSWORD=supersecrete
     SERVICE_PASSWORD=supersecrete
     SERVICE_TOKEN=xyzpdqlazydog
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 424844547c..9d4f54a05e 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -52,7 +52,7 @@ DevStack Configuration
         RABBIT_HOST=172.18.161.6
         GLANCE_HOSTPORT=172.18.161.6:9292
         ADMIN_PASSWORD=secrete
-        MYSQL_PASSWORD=secrete
+        DATABASE_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
         SERVICE_TOKEN=secrete
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 236ece9c01..a01c368213 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -105,7 +105,7 @@ do the following:
     FIXED_NETWORK_SIZE=256
     FLAT_INTERFACE=eth0
     ADMIN_PASSWORD=supersecret
-    MYSQL_PASSWORD=iheartdatabases
+    DATABASE_PASSWORD=iheartdatabases
     RABBIT_PASSWORD=flopsymopsy
     SERVICE_PASSWORD=iheartksl
     SERVICE_TOKEN=xyzpdqlazydog
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 515cd505c3..53c3fa973f 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -64,7 +64,7 @@ passed as the user-data file when booting the VM.
             cd devstack
             echo '[[local|localrc]]' > local.conf
             echo ADMIN_PASSWORD=password >> local.conf
-            echo MYSQL_PASSWORD=password >> local.conf
+            echo DATABASE_PASSWORD=password >> local.conf
             echo RABBIT_PASSWORD=password >> local.conf
             echo SERVICE_PASSWORD=password >> local.conf
             echo SERVICE_TOKEN=tokentoken >> local.conf
diff --git a/samples/local.conf b/samples/local.conf
index ce7007391d..cb293b6c15 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -28,7 +28,7 @@
 # and they will be added to ``local.conf``.
 SERVICE_TOKEN=azertytoken
 ADMIN_PASSWORD=nomoresecrete
-MYSQL_PASSWORD=stackdb
+DATABASE_PASSWORD=stackdb
 RABBIT_PASSWORD=stackqueue
 SERVICE_PASSWORD=$ADMIN_PASSWORD
 
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 6212cc54d7..a1adf590a6 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -77,7 +77,7 @@ Of course, use real passwords if this machine is exposed.
     # NOTE: these need to be specified, otherwise devstack will try
     # to prompt for these passwords, blocking the install process.
 
-    MYSQL_PASSWORD=my_super_secret
+    DATABASE_PASSWORD=my_super_secret
     SERVICE_TOKEN=my_super_secret
     ADMIN_PASSWORD=my_super_secret
     SERVICE_PASSWORD=my_super_secret

From 9e11e098c3346efd7cf70283df7c725e5a3e86c6 Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Tue, 29 Sep 2015 20:01:44 +0800
Subject: [PATCH 0920/3333] Move $DEST creation after logging setup

Setup the log output before calling functions like
check_path_perm_sanity that want to write out to
the error log.

Change-Id: I9815965257c399a48f8cf0f344814d954137aecb
Closes-Bug: #1500834
---
 stack.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 01668c208b..061289053b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -306,9 +306,6 @@ sudo mkdir -p $DEST
 safe_chown -R $STACK_USER $DEST
 safe_chmod 0755 $DEST
 
-# Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
-check_path_perm_sanity ${DEST}
-
 # Destination path for service data
 DATA_DIR=${DATA_DIR:-${DEST}/data}
 sudo mkdir -p $DATA_DIR
@@ -443,6 +440,8 @@ if [[ -n "$SCREEN_LOGDIR" ]]; then
     fi
 fi
 
+# Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
+check_path_perm_sanity ${DEST}
 
 # Configure Error Traps
 # ---------------------

From 0280f6f6c83b45b06220050e0a9353dfe364ef18 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 7 Oct 2015 09:19:53 -0400
Subject: [PATCH 0921/3333] remove corrupt get-pip.py

If get-pip servers fall over and return 503 for a few hours (which
they do medium regularly) we'll cache crud html, and everything will
suck. We know this script should be python, so if it isn't, delete it.

Change-Id: Ia9f6f7c7217939bc1ab5745f4a9d568acfbf04c8
---
 tools/install_pip.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 41261800e4..dd4e4339cb 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -42,6 +42,15 @@ function get_versions {
 
 
 function install_get_pip {
+    # If get-pip.py isn't python, delete it. This was probably an
+    # outage on the server.
+    if [[ -r $LOCAL_PIP ]]; then
+        if ! head -1 $LOCAL_PIP | grep -q '#!/usr/bin/env python'; then
+            echo "WARNING: Corrupt $LOCAL_PIP found removing"
+            rm $LOCAL_PIP
+        fi
+    fi
+
     # The OpenStack gate and others put a cached version of get-pip.py
     # for this to find, explicitly to avoid download issues.
     #

From 3d6eaae21c0b11361b4d83a47e3e345682641e57 Mon Sep 17 00:00:00 2001
From: gong yong sheng <gong.yongsheng@99cloud.net>
Date: Tue, 15 Sep 2015 15:00:29 +0800
Subject: [PATCH 0922/3333] don't install root filters when Q_USE_ROOTWRAP is
 false

Change-Id: I2f6edfcfb3789310fbeea8a509e0d9a13428becc
Closes-bug: #1495822
---
 lib/neutron-legacy | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e67bd4ae32..350706c9b7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1165,6 +1165,9 @@ function _neutron_service_plugin_class_add {
 
 # _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
 function _neutron_deploy_rootwrap_filters {
+    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+        return
+    fi
     local srcdir=$1
     sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
     sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/

From fa41b5b47ebbf6f2d973bdde235cb58694a2103f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 8 Oct 2015 06:05:20 -0400
Subject: [PATCH 0923/3333] make curl fail on pypi errors

This will make curl fail on pypi errors, and should prevent corrupt
images from pypi going offline for a few hours randomly, which it does
from time to time.

Closes-Bug: #1503909

Change-Id: Ib4a740b7d1772e1e36aa701e42d3ac0f0ee12883
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dd4e4339cb..13c1786fb9 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -69,7 +69,7 @@ function install_get_pip {
             timecond="-z $LOCAL_PIP"
         fi
 
-        curl --retry 6 --retry-delay 5 \
+        curl -f --retry 6 --retry-delay 5 \
             $timecond -o $LOCAL_PIP $PIP_GET_PIP_URL || \
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded

From 56037e9a6e0286640fce1f812f3a9d10c3f8535b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 8 Oct 2015 12:27:07 -0400
Subject: [PATCH 0924/3333] provide devstack lockout with .no-devstack file.

This lets you specify that devstack should not be run by the user on
the box that you are on. Helps with running commands in the wrong
window.

Change-Id: I7aa26df1a2e02331d596bbfefb0697937787252f
---
 stack.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/stack.sh b/stack.sh
index 01668c208b..1abae9c1fd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -93,6 +93,15 @@ if [[ $EUID -eq 0 ]]; then
     exit 1
 fi
 
+# Provide a safety switch for devstack. If you do a lot of devstack,
+# on a lot of different environments, you sometimes run it on the
+# wrong box. This makes there be a way to prevent that.
+if [[ -e $HOME/.no-devstack ]]; then
+    echo "You've marked this host as a no-devstack host, to save yourself from"
+    echo "running devstack accidentally. If this is in error, please remove the"
+    echo "~/.no-devstack file"
+    exit 1
+fi
 
 # Prepare the environment
 # -----------------------

From e82bac04981c8e41a919907d16621c9c952d9224 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 25 Aug 2015 14:29:08 +1000
Subject: [PATCH 0925/3333] Detect blank variable in trueorfalse

As a follow-on to I8cefb58f49dcd2cb2def8a5071d0892af520e7f7, put in
some detection around missing variable-to-test arguments in
trueorfalse.

Correct a couple of places where we were passing in blank strings,
resulting in the default always being applied.

Add test-cases and enhance the documentation a little.

Depends-On: I8cefb58f49dcd2cb2def8a5071d0892af520e7f7
Change-Id: Icc0eb3808a2b6583828d8c47f0af4181e7e2c75a
---
 functions-common        | 19 +++++++++++++++----
 lib/heat                |  4 ++--
 tests/test_truefalse.sh |  8 ++++++++
 tools/fixup_stuff.sh    |  2 +-
 4 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/functions-common b/functions-common
index f9e0b5adaa..d506b846bd 100644
--- a/functions-common
+++ b/functions-common
@@ -106,16 +106,27 @@ function write_clouds_yaml {
         --os-project-name admin
 }
 
-# Normalize config values to True or False
-# Accepts as False: 0 no No NO false False FALSE
-# Accepts as True: 1 yes Yes YES true True TRUE
-# VAR=$(trueorfalse default-value test-value)
+# trueorfalse <True|False> <VAR>
+#
+# Normalize config-value provided in variable VAR to either "True" or
+# "False".  If VAR is unset (i.e. $VAR evaluates as empty), the value
+# of the second argument will be used as the default value.
+#
+#  Accepts as False: 0 no  No  NO  false False FALSE
+#  Accepts as True:  1 yes Yes YES true  True  TRUE
+#
+# usage:
+#  VAL=$(trueorfalse False VAL)
 function trueorfalse {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
     local default=$1
+
+    if [ -z $2 ]; then
+        die $LINENO "variable to normalize required"
+    fi
     local testval=${!2:-}
 
     case "$testval" in
diff --git a/lib/heat b/lib/heat
index 3e6975ae26..c22369f56c 100644
--- a/lib/heat
+++ b/lib/heat
@@ -59,10 +59,10 @@ HEAT_BIN_DIR=$(get_python_exec_prefix)
 # other default options
 if [[ "$HEAT_STANDALONE" = "True" ]]; then
     # for standalone, use defaults which require no service user
-    HEAT_STACK_DOMAIN=`trueorfalse False $HEAT_STACK_DOMAIN`
+    HEAT_STACK_DOMAIN=$(trueorfalse False HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-password}
 else
-    HEAT_STACK_DOMAIN=`trueorfalse True $HEAT_STACK_DOMAIN`
+    HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
 fi
 
diff --git a/tests/test_truefalse.sh b/tests/test_truefalse.sh
index 2689589dc9..03996ceab4 100755
--- a/tests/test_truefalse.sh
+++ b/tests/test_truefalse.sh
@@ -8,6 +8,14 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/functions
 source $TOP/tests/unittest.sh
 
+# common mistake is to use $FOO instead of "FOO"; in that case we
+# should die
+bash -c "source $TOP/functions-common; VAR=\$(trueorfalse False \$FOO)" &> /dev/null
+assert_equal 1 $? "missing test-value"
+
+VAL=$(trueorfalse False MISSING_VARIABLE)
+assert_equal "False" $VAL "blank test-value"
+
 function test_trueorfalse {
     local one=1
     local captrue=True
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a601cf2f67..6ef32c8894 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -108,7 +108,7 @@ if is_fedora; then
         sudo setenforce 0
     fi
 
-    FORCE_FIREWALLD=$(trueorfalse False $FORCE_FIREWALLD)
+    FORCE_FIREWALLD=$(trueorfalse False FORCE_FIREWALLD)
     if [[ $FORCE_FIREWALLD == "False" ]]; then
         # On Fedora 20 firewalld interacts badly with libvirt and
         # slows things down significantly (this issue was fixed in

From 022c6672ce0e49273e21ece35186d8291f905ca2 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 22 Jun 2015 15:26:26 +0000
Subject: [PATCH 0926/3333] Revert "Install g-r version of OSC in
 configure_tempest"

This reverts commit 1fa82aab6634bf815d162978e33b211e1fdef343.

Change-Id: I931756e6d534839a6c9fb3cc6f5dc32c9a1e6436
---
 lib/tempest | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6eeab4e231..498a0c7338 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -119,10 +119,6 @@ function configure_tempest {
         pip_install_gr testrepository
     fi
 
-    # Used during configuration so make sure we have the correct
-    # version installed
-    pip_install_gr python-openstackclient
-
     local image_lines
     local images
     local num_images

From d8aa10e583efbd6574abad03f41674178fa89925 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 9 Oct 2015 12:21:30 -0400
Subject: [PATCH 0927/3333] docs: Move tip about Extension Drivers into misc
 section

Change-Id: Ifd458495992a0fd1b7437c315b4fe45906830cb1
---
 doc/source/guides/neutron.rst | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 9d4f54a05e..cf48e22fa2 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -164,11 +164,6 @@ In this configuration we are defining FLOATING_RANGE to be a
 subnet that exists in the private RFC1918 address space - however in
 in a real setup FLOATING_RANGE would be a public IP address range.
 
-Note that extension drivers for the ML2 plugin is set by
-`Q_ML2_PLUGIN_EXT_DRIVERS`, and it includes 'port_security' by default. If you
-want to remove all the extension drivers (even 'port_security'), set
-`Q_ML2_PLUGIN_EXT_DRIVERS` to blank.
-
 Neutron Networking with Open vSwitch and Provider Networks
 ==========================================================
 
@@ -304,5 +299,11 @@ disable ufw if it was enabled, do the following:
         sudo service iptables save
         sudo ufw disable
 
+Configuring Extension Drivers for the ML2 Plugin
+------------------------------------------------
 
+Extension drivers for the ML2 plugin are set with the variable
+`Q_ML2_PLUGIN_EXT_DRIVERS`, and includes the 'port_security' extension
+by default. If you want to remove all the extension drivers (even
+'port_security'), set `Q_ML2_PLUGIN_EXT_DRIVERS` to blank.
 

From c6d470142e0a0359a7322e9b76d61ba15caf95bc Mon Sep 17 00:00:00 2001
From: Chris Dent <chdent@redhat.com>
Date: Fri, 9 Oct 2015 14:57:05 +0000
Subject: [PATCH 0928/3333] Perform additional disable_service checks

With the advent of plugins and their settings files it has become
possible to disable_service in local.conf only to have the service
re-enabled in a plugin settings file. This happens because of
processing order.

To get around this the disable_service function now aggregates
service names into a DISABLED_SERVICES variable which is then checked
during enable_service. If something tries to enable something that
was previously disabled, a warning is produced in the log and the
service is not enabled.

Then after all configuration has been sourced a final check is to
done by verify_disabled_services to confirm that something has not
manually adjusted ENABLED_SERVICES to overcome a previously called
disable_service. If something has, the stack dies with an error.

Change-Id: I0f9403f44ed2fe693a46cd02486bd94043ce6b1a
Closes-Bug: #1504304
---
 functions-common | 34 ++++++++++++++++++++++++++--------
 stack.sh         |  1 +
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/functions-common b/functions-common
index f9e0b5adaa..08e5e7fb35 100644
--- a/functions-common
+++ b/functions-common
@@ -1729,6 +1729,7 @@ function run_phase {
     # the source phase corresponds to settings loading in plugins
     if [[ "$mode" == "source" ]]; then
         load_plugin_settings
+        verify_disabled_services
     elif [[ "$mode" == "override_defaults" ]]; then
         plugin_override_defaults
     else
@@ -1784,25 +1785,26 @@ function disable_negated_services {
     ENABLED_SERVICES=$(remove_disabled_services "$remaining" "$to_remove")
 }
 
-# disable_service() removes the services passed as argument to the
-# ``ENABLED_SERVICES`` list, if they are present.
+# disable_service() prepares the services passed as argument to be
+# removed from the ``ENABLED_SERVICES`` list, if they are present.
 #
 # For example:
 #   disable_service rabbit
 #
-# This function does not know about the special cases
-# for nova, glance, and neutron built into is_service_enabled().
-# Uses global ``ENABLED_SERVICES``
+# Uses global ``DISABLED_SERVICES``
 # disable_service service [service ...]
 function disable_service {
-    local tmpsvcs=",${ENABLED_SERVICES},"
+    local disabled_svcs="${DISABLED_SERVICES}"
+    local enabled_svcs=",${ENABLED_SERVICES},"
     local service
     for service in $@; do
+        disabled_svcs+=",$service"
         if is_service_enabled $service; then
-            tmpsvcs=${tmpsvcs//,$service,/,}
+            enabled_svcs=${enabled_svcs//,$service,/,}
         fi
     done
-    ENABLED_SERVICES=$(_cleanup_service_list "$tmpsvcs")
+    DISABLED_SERVICES=$(_cleanup_service_list "$disabled_svcs")
+    ENABLED_SERVICES=$(_cleanup_service_list "$enabled_svcs")
 }
 
 # enable_service() adds the services passed as argument to the
@@ -1819,6 +1821,10 @@ function enable_service {
     local tmpsvcs="${ENABLED_SERVICES}"
     local service
     for service in $@; do
+        if [[ ,${DISABLED_SERVICES}, =~ ,${service}, ]]; then
+            warn $LINENO "Attempt to enable_service ${service} when it has been disabled"
+            continue
+        fi
         if ! is_service_enabled $service; then
             tmpsvcs+=",$service"
         fi
@@ -1923,6 +1929,18 @@ function use_exclusive_service {
     return 0
 }
 
+# Make sure that nothing has manipulated ENABLED_SERVICES in a way
+# that conflicts with prior calls to disable_service.
+# Uses global ``ENABLED_SERVICES``
+function verify_disabled_services {
+    local service
+    for service in ${ENABLED_SERVICES//,/ }; do
+        if [[ ,${DISABLED_SERVICES}, =~ ,${service}, ]]; then
+            die $LINENO "ENABLED_SERVICES directly modified to overcome 'disable_service ${service}'"
+        fi
+    done
+}
+
 
 # System Functions
 # ================
diff --git a/stack.sh b/stack.sh
index db0ff98429..b65c55803c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -553,6 +553,7 @@ source $TOP_DIR/lib/dstat
 # Phase: source
 run_phase source
 
+
 # Interactive Configuration
 # -------------------------
 

From 4696db94a9b3b749cac61608daffdd883e057479 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 9 Oct 2015 12:31:57 -0400
Subject: [PATCH 0929/3333] docs: Add network diagram for provider net section

Change-Id: Id39aaab5a7eadfa3fc09ba3d30c48b452d685904
---
 doc/source/guides/neutron.rst | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 9d4f54a05e..99b7811e9c 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -183,6 +183,34 @@ given a VLAN tag and IP address range, so that instances created via
 DevStack will use the external router for L3 connectivity, as opposed
 to the neutron L3 service.
 
+Physical Network Setup
+----------------------
+
+.. nwdiag::
+
+        nwdiag {
+                inet [ shape = cloud ];
+                router;
+                inet -- router;
+
+                network provider_net {
+                        address = "203.0.113.0/24"
+                        router [ address = "203.0.113.1" ];
+                        controller;
+                        compute1;
+                        compute2;
+                }
+
+                network control_plane {
+                        router [ address = "10.0.0.1" ]
+                        address = "10.0.0.0/24"
+                        controller [ address = "10.0.0.2" ]
+                        compute1 [ address = "10.0.0.3" ]
+                        compute2 [ address = "10.0.0.4" ]
+                }
+        }
+
+
 
 Service Configuration
 ---------------------

From 611cab4b48f14227c636f34cec155dbd99a1d7f2 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 9 Oct 2015 12:54:32 -0400
Subject: [PATCH 0930/3333] docs: Add IPs to provider net node configurations

Also remove variable definitions from compute node localrc that is only
applicable on the control node.

Change-Id: I37b00611ff08d8973f21af7db340d287b1deb4af
---
 doc/source/guides/neutron.rst | 36 ++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 99b7811e9c..67be067b38 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -236,8 +236,21 @@ controller node.
 
 ::
 
+        HOST_IP=10.0.0.2
+        SERVICE_HOST=10.0.0.2
+        MYSQL_HOST=10.0.0.2
+        SERVICE_HOST=10.0.0.2
+        MYSQL_HOST=10.0.0.2
+        RABBIT_HOST=10.0.0.2
+        GLANCE_HOSTPORT=10.0.0.2:9292
         PUBLIC_INTERFACE=eth1
 
+        ADMIN_PASSWORD=secrete
+        MYSQL_PASSWORD=secrete
+        RABBIT_PASSWORD=secrete
+        SERVICE_PASSWORD=secrete
+        SERVICE_TOKEN=secrete
+
         ## Neutron options
         Q_USE_SECGROUP=True
         ENABLE_TENANT_VLANS=True
@@ -269,24 +282,37 @@ would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the
 public internet.
 
-The following is a snippet of the DevStack configuration on the
-compute node.
+The following is the DevStack configuration on 
+compute node 1.
 
 ::
 
+        HOST_IP=10.0.0.3
+        SERVICE_HOST=10.0.0.2
+        MYSQL_HOST=10.0.0.2
+        SERVICE_HOST=10.0.0.2
+        MYSQL_HOST=10.0.0.2
+        RABBIT_HOST=10.0.0.2
+        GLANCE_HOSTPORT=10.0.0.2:9292
+        ADMIN_PASSWORD=secrete
+        MYSQL_PASSWORD=secrete
+        RABBIT_PASSWORD=secrete
+        SERVICE_PASSWORD=secrete
+        SERVICE_TOKEN=secrete
+
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
 
         ## Neutron options
-        Q_USE_SECGROUP=True
-        ENABLE_TENANT_VLANS=True
-        TENANT_VLAN_RANGE=3001:4000
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_INTERFACE=eth1
         Q_USE_PROVIDER_NETWORKING=True
         Q_L3_ENABLED=False
 
+Compute node 2's configuration will be exactly the same, except
+`HOST_IP` will be `10.0.0.4`
+
 When DevStack is configured to use provider networking (via
 `Q_USE_PROVIDER_NETWORKING` is True and `Q_L3_ENABLED` is False) -
 DevStack will automatically add the network interface defined in

From 64be3210e6bae709ee88736f2b7554db6e82f28e Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Mon, 12 Oct 2015 13:10:24 +0200
Subject: [PATCH 0931/3333] Don't assume that $i variable won't be overriden in
 extras.d plugins

This causes an incorrect warning about ironic jobs putting an unexpected
file in extras.d.

Change-Id: I57acf91fba3fe13b3cc8dd739034e146a0b237c4
---
 functions-common | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 08e5e7fb35..3e5b3c23a1 100644
--- a/functions-common
+++ b/functions-common
@@ -1712,13 +1712,14 @@ function run_phase {
     local mode=$1
     local phase=$2
     if [[ -d $TOP_DIR/extras.d ]]; then
-        for i in $TOP_DIR/extras.d/*.sh; do
-            [[ -r $i ]] && source $i $mode $phase
+        local extra_plugin_file_name
+        for extra_plugin_file_name in $TOP_DIR/extras.d/*.sh; do
+            [[ -r $extra_plugin_file_name ]] && source $extra_plugin_file_name $mode $phase
             # NOTE(sdague): generate a big warning about using
             # extras.d in an unsupported way which will let us track
             # unsupported usage in the gate.
             local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
-            local extra=$(basename $i)
+            local extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
                 deprecated "extras.d support is being removed in Mitaka-1"
                 deprecated "jobs for project $extra will break after that point"

From 95d4226c4ce4e3ddd0d159572790d04c17bea831 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 12 Oct 2015 07:34:41 -0400
Subject: [PATCH 0932/3333] make i local

This prevents bleed out of the i variable to other functions that
might call this inside their own iteration loop.

Change-Id: I42d0c287a6f4bb24ae3871de9abb7e0de98a8462
---
 lib/ironic | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/ironic b/lib/ironic
index 40475e0a83..6ec7e8092b 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -559,6 +559,7 @@ function wait_for_nova_resources {
     # timing out.
     local resource=$1
     local expected_count=$2
+    local i
     echo_summary "Waiting 2 minutes for Nova resource tracker to pick up $resource >= $expected_count"
     for i in $(seq 1 120); do
         if [ $(nova hypervisor-stats | grep " $resource " | get_field 2) -ge $expected_count ]; then

From 887f182fa146b20011f9127e5653df8b42fa4897 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 12 Oct 2015 10:36:34 -0400
Subject: [PATCH 0933/3333] docs: merge multiple interface sections with
 provider network section

In this guide, multiple interfaces in DevStack is only used when doing
provider networking, so let's go ahead and just put the information
inside the provider network section. That way it won't be confusing.

Change-Id: I66f58ffb936230e72ac4cf8c04668e25dac5b17a
---
 doc/source/guides/neutron.rst | 134 +++++++++++-----------------------
 1 file changed, 42 insertions(+), 92 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index e99a143592..5891f68033 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -72,98 +72,6 @@ DevStack Configuration
 
 
 
-
-
-Using Neutron with Multiple Interfaces
-======================================
-
-The first interface, eth0 is used for the OpenStack management (API,
-message bus, etc) as well as for ssh for an administrator to access
-the machine.
-
-::
-
-        stack@compute:~$ ifconfig eth0
-        eth0      Link encap:Ethernet  HWaddr bc:16:65:20:af:fc
-                  inet addr:192.168.1.18
-
-eth1 is manually configured at boot to not have an IP address.
-Consult your operating system documentation for the appropriate
-technique. For Ubuntu, the contents of `/etc/network/interfaces`
-contains:
-
-::
-
-        auto eth1
-        iface eth1 inet manual
-                up ifconfig $IFACE 0.0.0.0 up
-                down ifconfig $IFACE 0.0.0.0 down
-
-The second physical interface, eth1 is added to a bridge (in this case
-named br-ex), which is used to forward network traffic from guest VMs.
-Network traffic from eth1 on the compute nodes is then NAT'd by the
-controller node that runs Neutron's `neutron-l3-agent` and provides L3
-connectivity.
-
-::
-
-        stack@compute:~$ sudo ovs-vsctl add-br br-ex
-        stack@compute:~$ sudo ovs-vsctl add-port br-ex eth1
-        stack@compute:~$ sudo ovs-vsctl show
-        9a25c837-32ab-45f6-b9f2-1dd888abcf0f
-            Bridge br-ex
-                Port br-ex
-                    Interface br-ex
-                        type: internal
-                Port phy-br-ex
-                    Interface phy-br-ex
-                        type: patch
-                        options: {peer=int-br-ex}
-                Port "eth1"
-                    Interface "eth1"
-
-
-
-
-
-Neutron Networking with Open vSwitch
-====================================
-
-Configuring neutron, OpenStack Networking in DevStack is very similar to
-configuring `nova-network` - many of the same configuration variables
-(like `FIXED_RANGE` and `FLOATING_RANGE`) used by `nova-network` are
-used by neutron, which is intentional.
-
-The only difference is the disabling of `nova-network` in your
-local.conf, and the enabling of the neutron components.
-
-
-Configuration
--------------
-
-::
-
-        FIXED_RANGE=10.0.0.0/24
-        FLOATING_RANGE=192.168.27.0/24
-        PUBLIC_NETWORK_GATEWAY=192.168.27.2
-
-        disable_service n-net
-        enable_service q-svc
-        enable_service q-agt
-        enable_service q-dhcp
-        enable_service q-meta
-        enable_service q-l3
-
-        Q_USE_SECGROUP=True
-        ENABLE_TENANT_VLANS=True
-        TENANT_VLAN_RANGE=1000:1999
-        PHYSICAL_NETWORK=default
-        OVS_PHYSICAL_BRIDGE=br-ex
-
-In this configuration we are defining FLOATING_RANGE to be a
-subnet that exists in the private RFC1918 address space - however in
-in a real setup FLOATING_RANGE would be a public IP address range.
-
 Neutron Networking with Open vSwitch and Provider Networks
 ==========================================================
 
@@ -206,6 +114,48 @@ Physical Network Setup
         }
 
 
+On a compute node, the first interface, eth0 is used for the OpenStack
+management (API, message bus, etc) as well as for ssh for an
+administrator to access the machine.
+
+::
+
+        stack@compute:~$ ifconfig eth0
+        eth0      Link encap:Ethernet  HWaddr bc:16:65:20:af:fc
+                  inet addr:10.0.0.3
+
+eth1 is manually configured at boot to not have an IP address.
+Consult your operating system documentation for the appropriate
+technique. For Ubuntu, the contents of `/etc/network/interfaces`
+contains:
+
+::
+
+        auto eth1
+        iface eth1 inet manual
+                up ifconfig $IFACE 0.0.0.0 up
+                down ifconfig $IFACE 0.0.0.0 down
+
+The second physical interface, eth1 is added to a bridge (in this case
+named br-ex), which is used to forward network traffic from guest VMs.
+
+::
+
+        stack@compute:~$ sudo ovs-vsctl add-br br-ex
+        stack@compute:~$ sudo ovs-vsctl add-port br-ex eth1
+        stack@compute:~$ sudo ovs-vsctl show
+        9a25c837-32ab-45f6-b9f2-1dd888abcf0f
+            Bridge br-ex
+                Port br-ex
+                    Interface br-ex
+                        type: internal
+                Port phy-br-ex
+                    Interface phy-br-ex
+                        type: patch
+                        options: {peer=int-br-ex}
+                Port "eth1"
+                    Interface "eth1"
+
 
 Service Configuration
 ---------------------

From 95c33d532f5d69516c0fbe123595f00f00792995 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 7 Oct 2015 11:05:59 -0400
Subject: [PATCH 0934/3333] add timing infrastructure to devstack

this adds a timing infrastructure to devstack to account for time
taken up by set of operations. The first instance of this is
accounting the time taken up by doing apt_get calls.

Change-Id: I855ffe9c7a75e9943106af0f70cf715c34ae25c5
---
 functions-common | 70 ++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh         |  2 ++
 2 files changed, 72 insertions(+)

diff --git a/functions-common b/functions-common
index 3e5b3c23a1..6b9a861bdf 100644
--- a/functions-common
+++ b/functions-common
@@ -976,12 +976,18 @@ function apt_get {
     local sudo="sudo"
     [[ "$(id -u)" = "0" ]] && sudo="env"
 
+    # time all the apt operations
+    time_start "apt-get"
+
     $xtrace
 
     $sudo DEBIAN_FRONTEND=noninteractive \
         http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
         no_proxy=${no_proxy:-} \
         apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
+
+    # stop the clock
+    time_stop "apt-get"
 }
 
 function _parse_package_files {
@@ -2115,6 +2121,70 @@ function test_with_retry {
     fi
 }
 
+# Timing infrastructure - figure out where large blocks of time are
+# used in DevStack
+#
+# The timing infrastructure for DevStack is about collecting buckets
+# of time that are spend in some subtask. For instance, that might be
+# 'apt', 'pip', 'osc', even database migrations. We do this by a pair
+# of functions: time_start / time_stop.
+#
+# These take a single parameter: $name - which specifies the name of
+# the bucket to be accounted against. time_totals function spits out
+# the results.
+#
+# Resolution is only in whole seconds, so should be used for long
+# running activities.
+
+declare -A TOTAL_TIME
+declare -A START_TIME
+
+# time_start $name
+#
+# starts the clock for a timer by name. Errors if that clock is
+# already started.
+function time_start {
+    local name=$1
+    local start_time=${START_TIME[$name]}
+    if [[ -n "$start_time" ]]; then
+        die $LINENO "Trying to start the clock on $name, but it's already been started"
+    fi
+    START_TIME[$name]=$(date +%s)
+}
+
+# time_stop $name
+#
+# stops the clock for a timer by name, and accumulate that time in the
+# global counter for that name. Errors if that clock had not
+# previously been started.
+function time_stop {
+    local name=$1
+    local start_time=${START_TIME[$name]}
+    if [[ -z "$start_time" ]]; then
+        die $LINENO "Trying to stop the clock on $name, but it was never started"
+    fi
+    local end_time=$(date +%s)
+    local elapsed_time=$(($end_time - $start_time))
+    local total=${TOTAL_TIME[$name]:-0}
+    # reset the clock so we can start it in the future
+    START_TIME[$name]=""
+    TOTAL_TIME[$name]=$(($total + $elapsed_time))
+}
+
+# time_totals
+#
+# prints out total time
+function time_totals {
+    echo
+    echo "========================"
+    echo "DevStack Components Timed"
+    echo "========================"
+    echo
+    for t in ${!TOTAL_TIME[*]}; do
+        local v=${TOTAL_TIME[$t]}
+        echo "$t - $v secs"
+    done
+}
 
 # Restore xtrace
 $XTRACE
diff --git a/stack.sh b/stack.sh
index b65c55803c..1976dff274 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1366,6 +1366,8 @@ else
     exec 1>&3
 fi
 
+# Dump out the time totals
+time_totals
 
 # Using the cloud
 # ===============

From cb658fab15dbf8074038bc76fc54ec4afccf5716 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 8 Oct 2015 17:12:03 -0400
Subject: [PATCH 0935/3333] add pip install timing

Change-Id: I368fec44858bd97fc6a314fb20eed2b10932cbb1
---
 inc/python | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/inc/python b/inc/python
index fe7bba6992..7d026c5933 100644
--- a/inc/python
+++ b/inc/python
@@ -80,6 +80,8 @@ function pip_install {
         return
     fi
 
+    time_start "pip_install"
+
     PIP_UPGRADE=$(trueorfalse False PIP_UPGRADE)
     if [[ "$PIP_UPGRADE" = "True" ]] ; then
         upgrade="--upgrade"
@@ -137,6 +139,8 @@ function pip_install {
             $cmd_pip $upgrade \
             -r $test_req
     fi
+
+    time_stop "pip_install"
 }
 
 # get version of a package from global requirements file

From 1d662e86bbafebbdef01307b20a7f8a21d1f8e03 Mon Sep 17 00:00:00 2001
From: Tong Li <litong01@us.ibm.com>
Date: Tue, 22 Sep 2015 11:16:11 -0400
Subject: [PATCH 0936/3333] HOST_IP should not be used in moving address to
 route

In neutron-legacy function _move_neutron_addresses_route, there are
few lines trying to figure out the bridge IP by assuming that the
bridge IP will be always same as the HOST_IP, this is not always true.
When the nic bears the HOST_IP and the nic which will be used as the
public network are different nics, the code in that method fails.
Eventually the function fails with network unreachable error.

This patch set fixes the problem, so that when HOST_IP and the IP for
the bridge are different, devstack will still be setup correctly.

Change-Id: I4d67f61c2ffd93f1e8ea2f8fe3b551044fab294e
Closes-bug: #1498538
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 350706c9b7..f1e5998ab7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -810,11 +810,11 @@ function _move_neutron_addresses_route {
         local ADD_OVS_PORT=""
 
         if [[ $af == "inet" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep $HOST_IP | awk '{ print $2, $3, $4; exit }')
+            IP_BRD=$(ip -f $af a s dev $from_intf | grep inet | awk '{ print $2, $3, $4; exit }')
         fi
 
         if [[ $af == "inet6" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep $HOST_IPV6 | awk '{ print $2, $3, $4; exit }')
+            IP_BRD=$(ip -f $af a s dev $from_intf | grep inet6 | awk '{ print $2, $3, $4; exit }')
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then

From 085855479f5a56e9ce21fdb83e2691c8aad56aa0 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Mon, 12 Oct 2015 11:36:51 -0400
Subject: [PATCH 0937/3333] Added processing /ec2 URL

With config option NOVA_USE_MOD_WSGI=True nova-ec2-api handles
requests on /ec2 URL.

Change-Id: I0c2e99bf8b5e5cf53cd176685b206038a4b0f78b
---
 files/apache-nova-ec2-api.template |  9 +++++++++
 lib/nova                           | 13 +++++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
index 235d958d1a..6443567740 100644
--- a/files/apache-nova-ec2-api.template
+++ b/files/apache-nova-ec2-api.template
@@ -14,3 +14,12 @@ Listen %PUBLICPORT%
     %SSLCERTFILE%
     %SSLKEYFILE%
 </VirtualHost>
+
+Alias /ec2 %PUBLICWSGI%
+<Location /ec2>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup nova-ec2-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/nova b/lib/nova
index 9830276232..eb1ae1cfaa 100644
--- a/lib/nova
+++ b/lib/nova
@@ -440,13 +440,18 @@ function create_nova_accounts {
 
         # EC2
         if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
-
+            local nova_ec2_api_url
+            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
+                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:$EC2_SERVICE_PORT/"
+            else
+                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST/ec2"
+            fi
             get_or_create_service "ec2" "ec2" "EC2 Compatibility Layer"
             get_or_create_endpoint "ec2" \
                 "$REGION_NAME" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
+                "$nova_ec2_api_url" \
+                "$nova_ec2_api_url" \
+                "$nova_ec2_api_url"
         fi
     fi
 

From 108b75d7a1ca653efa21e80bfb5ec3ead029954c Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 13 Oct 2015 15:51:43 +0200
Subject: [PATCH 0938/3333] lib/tempest: remove duplicate iniset calls

In Tempest config, `image-feature-enabled deactivate_image` is
enabled twice. This patch removes one of the redundant call to iniset.

Change-Id: Idbfcd6d6ee171c2c83736e17bbaf3d7a32c738b1
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 6eeab4e231..da0fe41ca3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -331,7 +331,6 @@ function configure_tempest {
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
-    iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image true
 
     # Image Features
     iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True

From 8043bfaf5ec6059e7245ff397672b1da0e563013 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 14 Oct 2015 14:53:18 +1100
Subject: [PATCH 0939/3333] Turn off tracing for service functions

These functions commonly externally called (as part of stackrc
inclusion, even) and do a fair bit of iteration over long
service-lists, which really fills up the logs of devstack and grenade
with unnecessary details.

The functions are well tested by unit-tests, so we are very unlikely
to need to debug internal issues with them in a hurry.  Thus turn
logging down for them.

Change-Id: I63b9a05a0678c7e0c7012f6d768c29fd67f090d2
---
 functions-common | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index be3f81c412..c8f551de3c 100644
--- a/functions-common
+++ b/functions-common
@@ -1147,7 +1147,7 @@ function update_package_repo {
 
     if is_ubuntu; then
         local xtrace
-    xtrace=$(set +o | grep xtrace)
+        xtrace=$(set +o | grep xtrace)
         set +o xtrace
         if [[ "$REPOS_UPDATED" != "True" || "$RETRY_UPDATE" = "True" ]]; then
             # if there are transient errors pulling the updates, that's fine.
@@ -1758,11 +1758,17 @@ function run_phase {
 # remove extra commas from the input string (i.e. ``ENABLED_SERVICES``)
 # _cleanup_service_list service-list
 function _cleanup_service_list {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     echo "$1" | sed -e '
         s/,,/,/g;
         s/^,//;
         s/,$//
     '
+
+    $xtrace
 }
 
 # disable_all_services() removes all current services
@@ -1780,6 +1786,10 @@ function disable_all_services {
 # Uses global ``ENABLED_SERVICES``
 # disable_negated_services
 function disable_negated_services {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local to_remove=""
     local remaining=""
     local service
@@ -1797,6 +1807,8 @@ function disable_negated_services {
     # go through the service list.  if this service appears in the "to
     # be removed" list, drop it
     ENABLED_SERVICES=$(remove_disabled_services "$remaining" "$to_remove")
+
+    $xtrace
 }
 
 # disable_service() prepares the services passed as argument to be
@@ -1808,6 +1820,10 @@ function disable_negated_services {
 # Uses global ``DISABLED_SERVICES``
 # disable_service service [service ...]
 function disable_service {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local disabled_svcs="${DISABLED_SERVICES}"
     local enabled_svcs=",${ENABLED_SERVICES},"
     local service
@@ -1819,6 +1835,8 @@ function disable_service {
     done
     DISABLED_SERVICES=$(_cleanup_service_list "$disabled_svcs")
     ENABLED_SERVICES=$(_cleanup_service_list "$enabled_svcs")
+
+    $xtrace
 }
 
 # enable_service() adds the services passed as argument to the
@@ -1832,6 +1850,10 @@ function disable_service {
 # Uses global ``ENABLED_SERVICES``
 # enable_service service [service ...]
 function enable_service {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local tmpsvcs="${ENABLED_SERVICES}"
     local service
     for service in $@; do
@@ -1845,6 +1867,8 @@ function enable_service {
     done
     ENABLED_SERVICES=$(_cleanup_service_list "$tmpsvcs")
     disable_negated_services
+
+    $xtrace
 }
 
 # is_service_enabled() checks if the service(s) specified as arguments are
@@ -1873,6 +1897,7 @@ function is_service_enabled {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
+
     local enabled=1
     local services=$@
     local service
@@ -1898,6 +1923,7 @@ function is_service_enabled {
         [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
         [[ ${service} == s-* && ${ENABLED_SERVICES} =~ "swift" ]] && enabled=0
     done
+
     $xtrace
     return $enabled
 }
@@ -1905,6 +1931,10 @@ function is_service_enabled {
 # remove specified list from the input string
 # remove_disabled_services service-list remove-list
 function remove_disabled_services {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local service_list=$1
     local remove_list=$2
     local service
@@ -1923,6 +1953,9 @@ function remove_disabled_services {
             enabled="${enabled},$service"
         fi
     done
+
+    $xtrace
+
     _cleanup_service_list "$enabled"
 }
 

From 316b348ad6068c485090761713685dfeb9ac4d38 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Wed, 15 Jul 2015 21:00:31 +0800
Subject: [PATCH 0940/3333] Add verification of OVS_PHYSICAL_BRIDGE

OVS_PHYSICAL_BRIDGE is not always set, like when you don't need specify the
bridge mapping, and also it has no default value. So we need to add
verification of OVS_PHYSICAL_BRIDGE in cleanup_neutron function where we refer
to it.

Change-Id: I69d113a7f3f7e67b09cb72fa0b0d3bba188e783a
Close-Bug: #1474634
---
 lib/neutron-legacy | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 350706c9b7..b3db77e874 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -838,18 +838,20 @@ function _move_neutron_addresses_route {
 # runs that a clean run would need to clean up
 function cleanup_neutron {
 
-    _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
+    if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
 
-    if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
-    fi
+        if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
+        fi
 
-    if is_provider_network && is_ironic_hardware; then
-        for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
-            sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
-            sudo ip addr add $IP dev $PUBLIC_INTERFACE
-        done
-        sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+        if is_provider_network && is_ironic_hardware; then
+            for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
+                sudo ip addr add $IP dev $PUBLIC_INTERFACE
+            done
+            sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+        fi
     fi
 
     if is_neutron_ovs_base_plugin; then

From 746e72d4c3494b9765c2ba221c50f0ca20128c29 Mon Sep 17 00:00:00 2001
From: Mark Hamzy <hamzy@us.ibm.com>
Date: Wed, 14 Oct 2015 13:42:18 -0500
Subject: [PATCH 0941/3333] Restrict requests to fedora

The os_RELEASE for RHEL is 7.1 (for example). Which does not work for comparisons
to an integer.  And, while I am at it, change base_path to not use a hard-coded
directory.

Change-Id: I64a04810cc7ba4668c2cb7a8df79c206301e9e16
---
 tools/fixup_stuff.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a601cf2f67..b57d140d6d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -135,7 +135,7 @@ if is_fedora; then
         fi
     fi
 
-    if  [[ "$os_RELEASE" -ge "21" ]]; then
+    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "21" ]]; then
         # requests ships vendored version of chardet/urllib3, but on
         # fedora these are symlinked back to the primary versions to
         # avoid duplication of code on disk.  This is fine when
@@ -152,9 +152,9 @@ if is_fedora; then
         # https://bugs.launchpad.net/glance/+bug/1476770
         # https://bugzilla.redhat.com/show_bug.cgi?id=1253823
 
-        base_path=/usr/lib/python2.7/site-packages/requests/packages
+        base_path=$(get_package_path requests)/packages
         if [ -L $base_path/chardet -o -L $base_path/urllib3 ]; then
-            sudo rm -f /usr/lib/python2.7/site-packages/requests/packages/{chardet,urllib3}
+            sudo rm -f $base_path/{chardet,urllib3}
             # install requests with the bundled urllib3 to avoid conflicts
             pip_install --upgrade --force-reinstall requests
         fi

From 975f4209d0d7e6a38ec82ce9caafabaea18f2e9d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 14 Oct 2015 15:12:32 +1100
Subject: [PATCH 0942/3333] Save interactive passwords to separate file

The interactive password prompt currently saves to .localrc.auto

However, this is removed when you re-run stack; that is required as it
is how we source the localrc bits of local.conf, and we want the
users' changes to be picked up.

The passwords, however, should remain constant, because everything has
already been setup with them.  So write them to a separate file.  Note
we source before localrc so it can still overwrite them.

Some minor flow-changes too

Change-Id: I9871c8b8c7569626faf552628de69b811ba4dac0
Closes-Bug: #1505872
---
 clean.sh |  4 +++-
 stack.sh | 10 ++++++----
 stackrc  |  5 +++++
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/clean.sh b/clean.sh
index b22a29cb41..ae28aa9ab7 100755
--- a/clean.sh
+++ b/clean.sh
@@ -134,7 +134,9 @@ rm -rf $DIRS_TO_CLEAN
 
 # Clean up files
 
-FILES_TO_CLEAN=".localrc.auto docs/files docs/html shocco/ stack-screenrc test*.conf* test.ini*"
+FILES_TO_CLEAN=".localrc.auto .localrc.password "
+FILES_TO_CLEAN+="docs/files docs/html shocco/ "
+FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
 FILES_TO_CLEAN+=".stackenv .prereqs"
 
 for file in $FILES_TO_CLEAN; do
diff --git a/stack.sh b/stack.sh
index 0720744028..886d449f12 100755
--- a/stack.sh
+++ b/stack.sh
@@ -569,7 +569,7 @@ function read_password {
     if [[ -f $RC_DIR/localrc ]]; then
         localrc=$TOP_DIR/localrc
     else
-        localrc=$TOP_DIR/.localrc.auto
+        localrc=$TOP_DIR/.localrc.password
     fi
 
     # If the password is not defined yet, proceed to prompt user for a password.
@@ -579,13 +579,15 @@ function read_password {
             touch $localrc
         fi
 
-        # Presumably if we got this far it can only be that our localrc is missing
-        # the required password.  Prompt user for a password and write to localrc.
+        # Presumably if we got this far it can only be that our
+        # localrc is missing the required password.  Prompt user for a
+        # password and write to localrc.
+
         echo ''
         echo '################################################################################'
         echo $msg
         echo '################################################################################'
-        echo "This value will be written to your localrc file so you don't have to enter it "
+        echo "This value will be written to ${localrc} file so you don't have to enter it "
         echo "again.  Use only alphanumeric characters."
         echo "If you leave this blank, a random default value will be used."
         pw=" "
diff --git a/stackrc b/stackrc
index c7c631362e..a1643356e0 100644
--- a/stackrc
+++ b/stackrc
@@ -103,6 +103,11 @@ HORIZON_APACHE_ROOT="/dashboard"
 # be disabled for automated testing by setting this value to False.
 USE_SCREEN=True
 
+# Passwords generated by interactive devstack runs
+if [[ -r $RC_DIR/.localrc.password ]]; then
+    source $RC_DIR/.localrc.password
+fi
+
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then
     # Old-style user-supplied config

From 394968fa3d6b0f3b296b49d038aac25b74c2dca7 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Fri, 28 Aug 2015 09:18:26 +1000
Subject: [PATCH 0943/3333] Always use v3 nova/neutron authentication

There is no need to test here whether v2 is disabled or not. V3
Authentication will always be available and we should just use that.

Change-Id: I0d2d76ebdf261917f1a2b23c65f0f843ae50f49a
---
 lib/neutron-legacy | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index ebb757058f..bbfe7f374b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -468,19 +468,13 @@ function configure_neutron {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
 
-
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        iniset $NOVA_CONF neutron auth_plugin "v3password"
-        iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
-        iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
-        iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-        iniset $NOVA_CONF neutron user_domain_name "default"
-    else
-        iniset $NOVA_CONF neutron admin_username "$Q_ADMIN_USERNAME"
-        iniset $NOVA_CONF neutron admin_password "$SERVICE_PASSWORD"
-        iniset $NOVA_CONF neutron admin_auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
-        iniset $NOVA_CONF neutron admin_tenant_name "$SERVICE_TENANT_NAME"
-    fi
+    iniset $NOVA_CONF neutron auth_plugin "v3password"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
+    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF neutron user_domain_name "Default"
+    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF neutron project_domain_name "Default"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
     iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"

From 5ed8af671328a0f9824bb33f9c637cc779a83ae3 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Thu, 15 Oct 2015 14:30:50 +0200
Subject: [PATCH 0944/3333] Fix devstack failure due to incorrect variable
 assignment

After I9c8912a8fd596535589b207d7fc553b9d951d3fe this approach leads
to a failure and breaks (at least) ironic-inspector gate.

Change-Id: I19bb8ada9a6f42d375838cc88a376715918c2a3e
---
 lib/ironic | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 61eba6fcf3..74e2f931ff 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -634,8 +634,10 @@ function enroll_nodes {
 
         # First node created will be used for testing in ironic w/o glance
         # scenario, so we need to know its UUID.
-        local standalone_node_uuid
-        standalone_node_uuid=$([ $total_nodes -eq 0 ] && echo "--uuid $IRONIC_NODE_UUID")
+        local standalone_node_uuid=""
+        if [ $total_nodes -eq 0 ]; then
+            standalone_node_uuid="--uuid $IRONIC_NODE_UUID"
+        fi
 
         local node_id
         node_id=$(ironic node-create $standalone_node_uuid\

From c94403d8e6c480dad6d962e517c623e1c14ac6d2 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 15 Oct 2015 12:51:13 -0700
Subject: [PATCH 0945/3333] Disable compute interface attach Tempest tests if
 using cells

Cells doesn't support the os-attach-interfaces API so disable those
tests in Tempest if running with Cells.

Change-Id: I5c7884407868eae70ea125f3f893c73214c04c75
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d29a6f9853..10dd652750 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -388,6 +388,8 @@ function configure_tempest {
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
+        # Cells doesn't support hot-plugging virtual interfaces.
+        iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
     fi
 
     # Network

From b14f96fb7aa9512d17399eb38024af652df7bc11 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 15 Oct 2015 11:50:10 +1100
Subject: [PATCH 0946/3333] Pin bashate and allow for substitution

I want to release a new bashate, but I also don't want to risk
consuming it before fully testing it.  By pinning here, we can run all
our usual CI on new versions before accepting them.

Additionally, allow substitution of the bashate dependency via an
environment variable.  We can use this in a bashate test to substitute
a path to a checkout with any changes applied.

Change-Id: I165c4d66db8b7bdcff235ef7d8c99029637bb76a
---
 tox.ini | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index 1c238add8a..0df9877ba8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,7 +8,8 @@ usedevelop = False
 install_command = pip install {opts} {packages}
 
 [testenv:bashate]
-deps = bashate
+deps =
+   {env:BASHATE_INSTALL_PATH:bashate==0.3.1}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \ # prune all 'dot' dirs

From c581c78c92dc5ea453bee8dd0a244554b4d6d57d Mon Sep 17 00:00:00 2001
From: ZhiQiang Fan <aji.zqfan@gmail.com>
Date: Sun, 18 Oct 2015 02:31:40 -0600
Subject: [PATCH 0947/3333] add file userrc_early to .gitignore list

After devstack runs ./stack.sh, there is a file named userrc_early
which contains sensitive information is created, we should add it
to ignore list, because it is only for end user debugging.

Change-Id: Ic99c279ec6a3606dc6f6ba9a7612b5ca7a2b6b10
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 2778a65c89..8870bb362c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,4 @@ proto
 shocco
 src
 stack-screenrc
+userrc_early

From cc481740a0766f0f762cc1fc9f7f6db66e792cdc Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Tue, 20 Oct 2015 01:16:25 +0800
Subject: [PATCH 0948/3333] modify stackforge/swift3 to openstack/swift3

As swift3.git has move from stackforge/swift3 to openstack/swift3,
so modify it.

Change-Id: Ieaff4c93889c46c7d4b8ecada1a5d7cf3c775965
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index a1643356e0..4026ff8feb 100644
--- a/stackrc
+++ b/stackrc
@@ -447,7 +447,7 @@ GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/k
 GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
 
 # s3 support for swift
-SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/stackforge/swift3.git}
+SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/openstack/swift3.git}
 SWIFT3_BRANCH=${SWIFT3_BRANCH:-master}
 
 # ceilometer middleware

From e3a239b2990edfd6517c9bdb1b55fce5618f5277 Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Tue, 20 Oct 2015 01:34:05 +0800
Subject: [PATCH 0949/3333] Modify the build-wheels.sh to build_wheels.sh

The path is tools/build_wheels.sh, but in the Makefile which is
tools/build-wheels.sh. Modify it to the correct one.

Change-Id: If297b65b539403af10a73adbbadfcd8281d40009
Closes-Bug: #1507699
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 082aff21d2..a6bb230708 100644
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,7 @@ unstack:
 	./unstack.sh
 
 wheels:
-	WHEELHOUSE=$(WHEELHOUSE) tools/build-wheels.sh
+	WHEELHOUSE=$(WHEELHOUSE) tools/build_wheels.sh
 
 docs:
 	tox -edocs

From 9f6b542a25dd6b48265c5e7317eb068886dc51c1 Mon Sep 17 00:00:00 2001
From: Zhang Jinnan <zhang.jinnan@99cloud.net>
Date: Tue, 20 Oct 2015 01:19:06 +0800
Subject: [PATCH 0950/3333] change stackforge url to openstack url

beacuse of the stackforge project move to openstack project,
so change the document url to git://git.openstack.org/openstack/.

Change-Id: I1628c0aeb62ee519867fdaee56386e22978c4271
---
 doc/source/plugin-registry.rst |  4 ++--
 doc/source/plugins.rst         | 13 ++++++-------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index eb09988a53..49b3a7fc02 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -68,7 +68,7 @@ Alternate Configs
 | Plugin Name | URL                                                        | Comments   |
 |             |                                                            |            |
 +-------------+------------------------------------------------------------+------------+
-|glusterfs    |git://git.openstack.org/stackforge/devstack-plugin-glusterfs|            |
+|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
 +-------------+------------------------------------------------------------+------------+
 |             |                                                            |            |
 +-------------+------------------------------------------------------------+------------+
@@ -80,7 +80,7 @@ Additional Services
 | Plugin Name    | URL                                              | Comments   |
 |                |                                                  |            |
 +----------------+--------------------------------------------------+------------+
-|ec2-api         |git://git.openstack.org/stackforge/ec2api         |[as1]_      |
+|ec2-api         |git://git.openstack.org/openstack/ec2-api         |[as1]_      |
 +----------------+--------------------------------------------------+------------+
 |ironic-inspector|git://git.openstack.org/openstack/ironic-inspector|            |
 +----------------+--------------------------------------------------+------------+
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index fda601b414..8bd3797cd2 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -56,7 +56,7 @@ They are added in the following format::
 
 An example would be as follows::
 
-  enable_plugin ec2api git://git.openstack.org/stackforge/ec2api
+  enable_plugin ec2-api git://git.openstack.org/openstack/ec2-api
 
 plugin.sh contract
 ==================
@@ -202,13 +202,12 @@ Using Plugins in the OpenStack Gate
 For everyday use, DevStack plugins can exist in any git tree that's
 accessible on the internet. However, when using DevStack plugins in
 the OpenStack gate, they must live in projects in OpenStack's
-gerrit. Both ``openstack`` namespace and ``stackforge`` namespace are
-fine. This allows testing of the plugin as well as provides network
+gerrit. This allows testing of the plugin as well as provides network
 isolation against upstream git repository failures (which we see often
 enough to be an issue).
 
 Ideally a plugin will be included within the ``devstack`` directory of
-the project they are being tested. For example, the stackforge/ec2-api
+the project they are being tested. For example, the openstack/ec2-api
 project has its plugin support in its own tree.
 
 However, some times a DevStack plugin might be used solely to
@@ -218,7 +217,7 @@ include: integration of back end storage (e.g. ceph or glusterfs),
 integration of SDN controllers (e.g. ovn, OpenDayLight), or
 integration of alternate RPC systems (e.g. zmq, qpid). In these cases
 the best practice is to build a dedicated
-``stackforge/devstack-plugin-FOO`` project.
+``openstack/devstack-plugin-FOO`` project.
 
 To enable a plugin to be used in a gate job, the following lines will
 be needed in your ``jenkins/jobs/<project>.yaml`` definition in
@@ -228,12 +227,12 @@ be needed in your ``jenkins/jobs/<project>.yaml`` definition in
   # Because we are testing a non standard project, add the
   # our project repository. This makes zuul do the right
   # reference magic for testing changes.
-  export PROJECTS="stackforge/ec2-api $PROJECTS"
+  export PROJECTS="openstack/ec2-api $PROJECTS"
 
   # note the actual url here is somewhat irrelevant because it
   # caches in nodepool, however make it a valid url for
   # documentation purposes.
-  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api git://git.openstack.org/stackforge/ec2-api"
+  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api git://git.openstack.org/openstack/ec2-api"
 
 See Also
 ========

From 8f385dde22815de5e7487e52cf78374f5c2967b3 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 19 Oct 2015 15:13:30 -0400
Subject: [PATCH 0951/3333] Write clouds.yaml to /etc as well

There are more than one user that need to access clouds.yaml values
in tests. Rather than copying the file everywhere, simply output
it to /etc/openstack.

However, we have things copying it at the moment, so output to
both places. A follow up patch will remove the homedir version.

Change-Id: I21d3c2ad7a020a5ab02dc1ab532feae70b718892
---
 functions-common | 59 +++++++++++++++++++++++++-----------------------
 1 file changed, 31 insertions(+), 28 deletions(-)

diff --git a/functions-common b/functions-common
index f95bfe543f..42555a95f5 100644
--- a/functions-common
+++ b/functions-common
@@ -76,34 +76,37 @@ function write_clouds_yaml {
     # The location is a variable to allow for easier refactoring later to make it
     # overridable. There is currently no usecase where doing so makes sense, so
     # it's not currently configurable.
-    CLOUDS_YAML=~/.config/openstack/clouds.yaml
-
-    mkdir -p $(dirname $CLOUDS_YAML)
-
-    CA_CERT_ARG=''
-    if [ -f "$SSL_BUNDLE_FILE" ]; then
-        CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
-    fi
-    $TOP_DIR/tools/update_clouds_yaml.py \
-        --file $CLOUDS_YAML \
-        --os-cloud devstack \
-        --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
-        $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
-        --os-username demo \
-        --os-password $ADMIN_PASSWORD \
-        --os-project-name demo
-    $TOP_DIR/tools/update_clouds_yaml.py \
-        --file $CLOUDS_YAML \
-        --os-cloud devstack-admin \
-        --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
-        $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
-        --os-username admin \
-        --os-password $ADMIN_PASSWORD \
-        --os-project-name admin
+    for clouds_path in /etc/openstack ~/.config/openstack ; do
+        CLOUDS_YAML=$clouds_path/clouds.yaml
+
+        sudo mkdir -p $(dirname $CLOUDS_YAML)
+        sudo chown -R $STACK_USER $(dirname $CLOUDS_YAML)
+
+        CA_CERT_ARG=''
+        if [ -f "$SSL_BUNDLE_FILE" ]; then
+            CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
+        fi
+        $TOP_DIR/tools/update_clouds_yaml.py \
+            --file $CLOUDS_YAML \
+            --os-cloud devstack \
+            --os-region-name $REGION_NAME \
+            --os-identity-api-version 3 \
+            $CA_CERT_ARG \
+            --os-auth-url $KEYSTONE_AUTH_URI \
+            --os-username demo \
+            --os-password $ADMIN_PASSWORD \
+            --os-project-name demo
+        $TOP_DIR/tools/update_clouds_yaml.py \
+            --file $CLOUDS_YAML \
+            --os-cloud devstack-admin \
+            --os-region-name $REGION_NAME \
+            --os-identity-api-version 3 \
+            $CA_CERT_ARG \
+            --os-auth-url $KEYSTONE_AUTH_URI \
+            --os-username admin \
+            --os-password $ADMIN_PASSWORD \
+            --os-project-name admin
+    done
 }
 
 # trueorfalse <True|False> <VAR>

From c49917250f2dc5243d652e59d8c70c1437975dea Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Thu, 22 Oct 2015 04:21:34 -0400
Subject: [PATCH 0952/3333] Removed starting of nova-ec2-api service

Since nova-ec2-api service was removed from nova it is not
needed in devstack.

Change-Id: I91d4be02a1a9c2ca4d18256d9a37a5c2559f53b7
Closes-Bug: #1530798
---
 files/apache-nova-ec2-api.template | 25 -----------------
 lib/nova                           | 44 ------------------------------
 2 files changed, 69 deletions(-)
 delete mode 100644 files/apache-nova-ec2-api.template

diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
deleted file mode 100644
index 7b1d68b106..0000000000
--- a/files/apache-nova-ec2-api.template
+++ /dev/null
@@ -1,25 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess nova-ec2-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup nova-ec2-api
-    WSGIScriptAlias / %PUBLICWSGI%
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/nova-ec2-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-Alias /ec2 %PUBLICWSGI%
-<Location /ec2>
-    SetHandler wsgi-script
-    Options +ExecCGI
-    WSGIProcessGroup nova-ec2-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/lib/nova b/lib/nova
index 6337f875ef..c75623f7d6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -242,7 +242,6 @@ function cleanup_nova {
 function _cleanup_nova_apache_wsgi {
     sudo rm -f $NOVA_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for nova-api)
-    sudo rm -f $(apache_site_config_for nova-ec2-api)
     sudo rm -f $(apache_site_config_for nova-metadata)
 }
 
@@ -252,15 +251,12 @@ function _config_nova_apache_wsgi {
 
     local nova_apache_conf
     nova_apache_conf=$(apache_site_config_for nova-api)
-    local nova_ec2_apache_conf
-    nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
     local nova_metadata_apache_conf
     nova_metadata_apache_conf=$(apache_site_config_for nova-metadata)
     local nova_ssl=""
     local nova_certfile=""
     local nova_keyfile=""
     local nova_api_port=$NOVA_SERVICE_PORT
-    local nova_ec2_api_port=$EC2_SERVICE_PORT
     local nova_metadata_port=$METADATA_SERVICE_PORT
     local venv_path=""
 
@@ -275,7 +271,6 @@ function _config_nova_apache_wsgi {
 
     # copy proxy vhost and wsgi helper files
     sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
-    sudo cp $NOVA_DIR/nova/wsgi/nova-ec2-api.py $NOVA_WSGI_DIR/nova-ec2-api
     sudo cp $NOVA_DIR/nova/wsgi/nova-metadata.py $NOVA_WSGI_DIR/nova-metadata
 
     sudo cp $FILES/apache-nova-api.template $nova_apache_conf
@@ -291,19 +286,6 @@ function _config_nova_apache_wsgi {
         s|%APIWORKERS%|$API_WORKERS|g
     " -i $nova_apache_conf
 
-    sudo cp $FILES/apache-nova-ec2-api.template $nova_ec2_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$nova_ec2_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-ec2-api|g;
-        s|%SSLENGINE%|$nova_ssl|g;
-        s|%SSLCERTFILE%|$nova_certfile|g;
-        s|%SSLKEYFILE%|$nova_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $nova_ec2_apache_conf
-
     sudo cp $FILES/apache-nova-metadata.template $nova_metadata_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$nova_metadata_port|g;
@@ -461,22 +443,6 @@ function create_nova_accounts {
             # swift through the s3 api.
             get_or_add_user_project_role ResellerAdmin nova $SERVICE_TENANT_NAME
         fi
-
-        # EC2
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
-            local nova_ec2_api_url
-            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
-                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:$EC2_SERVICE_PORT/"
-            else
-                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST/ec2"
-            fi
-            get_or_create_service "ec2" "ec2" "EC2 Compatibility Layer"
-            get_or_create_endpoint "ec2" \
-                "$REGION_NAME" \
-                "$nova_ec2_api_url" \
-                "$nova_ec2_api_url" \
-                "$nova_ec2_api_url"
-        fi
     fi
 
     # S3
@@ -522,7 +488,6 @@ function create_nova_conf {
     iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
-    iniset $NOVA_CONF DEFAULT ec2_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
@@ -629,12 +594,10 @@ function create_nova_conf {
     fi
 
     iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
-    iniset $NOVA_CONF DEFAULT keystone_ec2_url $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
-    iniset $NOVA_CONF DEFAULT ec2_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"
     # don't let the conductor get out of control now that we're using a pure python db driver
     iniset $NOVA_CONF conductor workers "$API_WORKERS"
@@ -660,10 +623,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT enabled_ssl_apis "$NOVA_ENABLED_APIS"
     fi
 
-    if is_service_enabled tls-proxy; then
-        iniset $NOVA_CONF DEFAULT ec2_listen_port $EC2_SERVICE_PORT_INT
-    fi
-
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
@@ -817,11 +776,9 @@ function start_nova_api {
     enabled_site_file=$(apache_site_config_for nova-api)
     if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site nova-api
-        enable_apache_site nova-ec2-api
         enable_apache_site nova-metadata
         restart_apache_server
         tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
-        tail_log nova-ec2-api /var/log/$APACHE_NAME/nova-ec2-api.log
         tail_log nova-metadata /var/log/$APACHE_NAME/nova-metadata.log
     else
         run_process n-api "$NOVA_BIN_DIR/nova-api"
@@ -937,7 +894,6 @@ function stop_nova_compute {
 function stop_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         disable_apache_site nova-api
-        disable_apache_site nova-ec2-api
         disable_apache_site nova-metadata
         restart_apache_server
     else

From c148b13c60525be637d23a1330cf56376f11432f Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 22 Oct 2015 10:05:00 -0400
Subject: [PATCH 0953/3333] Ensure we disable tenant isolation without admin

This commit fixes an issue with the tempest configuration when
TEMPEST_HAS_ADMIN is disabled. Without admin credentials tempest
is unable to create credentials at all so enabling tenant isolation
is not going to work. Previously devstack wasn't setting it one way
or the other when TEMPEST_HAS_ADMIN was set, which results in the
default of being enabled. So jobs that try to run tempest without
admin were failing.

Change-Id: Iff496cb5cbf29f17c130cfad746b48d8547ca965
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 10dd652750..bd76be570d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -564,9 +564,13 @@ function configure_tempest {
         fi
         iniset $TEMPEST_CONFIG auth allow_tenant_isolation False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
+        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+
     else
         iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     fi
+
     # Restore IFS
     IFS=$ifs
 }

From 22f747b8df023dd74808df097f5fa5a92168f620 Mon Sep 17 00:00:00 2001
From: Falk Reimann <falk.reimann@sap.com>
Date: Fri, 28 Aug 2015 12:40:19 +0200
Subject: [PATCH 0954/3333] Use swift port variable in keystone and cinder

This patch alows specifiying a deviation of the swift default port 8080 with
variable SWIFT_DEFAULT_BIND_PORT. The created endpoints in keystone for
object-store and the backup_swift_url in cinder.conf will use variable
SWIFT_DEFAULT_BIND_PORT instead of the fixed port 8080.

Change-Id: I47bbcf77368c430718fb8f29b7de1ff305e64422
Closes-Bug: #1489767
---
 lib/cinder   |  2 +-
 lib/keystone |  6 +++---
 lib/swift    | 17 +++++++++--------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index e5ed2db1a3..2ed02e8b33 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -256,7 +256,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled swift; then
-        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_"
+        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
     fi
 
     if is_service_enabled ceilometer; then
diff --git a/lib/keystone b/lib/keystone
index e2448c9068..31d5448499 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -266,9 +266,9 @@ function configure_keystone {
 
         # Add swift endpoints to service catalog if swift is enabled
         if is_service_enabled s-proxy; then
-            echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:8080/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
+            echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
+            echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/" >> $KEYSTONE_CATALOG
+            echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
             echo "catalog.RegionOne.object_store.name = Swift Service" >> $KEYSTONE_CATALOG
         fi
 
diff --git a/lib/swift b/lib/swift
index fc736a60bc..4c2b292bd7 100644
--- a/lib/swift
+++ b/lib/swift
@@ -44,6 +44,7 @@ SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+SWIFT_DEFAULT_BIND_PORT=${SWIFT_DEFAULT_BIND_PORT:-8080}
 SWIFT_DEFAULT_BIND_PORT_INT=${SWIFT_DEFAULT_BIND_PORT_INT:-8081}
 SWIFT_SERVICE_LOCAL_HOST=${SWIFT_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
@@ -62,7 +63,7 @@ SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-/etc/swift}
 if is_service_enabled s-proxy && is_service_enabled swift3; then
     # If we are using ``swift3``, we can default the S3 port to swift instead
     # of nova-objectstore
-    S3_SERVICE_PORT=${S3_SERVICE_PORT:-8080}
+    S3_SERVICE_PORT=${S3_SERVICE_PORT:-$SWIFT_DEFAULT_BIND_PORT}
 fi
 
 if is_service_enabled g-api; then
@@ -187,7 +188,7 @@ function _cleanup_swift_apache_wsgi {
 # _config_swift_apache_wsgi() - Set WSGI config files of Swift
 function _config_swift_apache_wsgi {
     sudo mkdir -p ${SWIFT_APACHE_WSGI_DIR}
-    local proxy_port=${SWIFT_DEFAULT_BIND_PORT:-8080}
+    local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
 
     # copy proxy vhost and wsgi file
     sudo cp ${SWIFT_DIR}/examples/apache2/proxy-server.template $(apache_site_config_for proxy-server)
@@ -348,7 +349,7 @@ function configure_swift {
     local csyncfile=${SWIFT_CONF_DIR}/container-sync-realms.conf
     cp ${SWIFT_DIR}/etc/container-sync-realms.conf-sample ${csyncfile}
     iniset ${csyncfile} realm1 key realm1key
-    iniset ${csyncfile} realm1 cluster_name1 "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/"
+    iniset ${csyncfile} realm1 cluster_name1 "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/"
 
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT user
     iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT user ${STACK_USER}
@@ -369,7 +370,7 @@ function configure_swift {
     if is_service_enabled tls-proxy; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT_INT}
     else
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT:-8080}
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT}
     fi
 
     if is_ssl_enabled_service s-proxy; then
@@ -621,9 +622,9 @@ function create_swift_accounts {
         get_or_create_service "swift" "object-store" "Swift Service"
         get_or_create_endpoint "object-store" \
             "$REGION_NAME" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s"
+            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
+            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
+            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
     fi
 
     local swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
@@ -764,7 +765,7 @@ function start_swift {
         swift-init --run-dir=${SWIFT_DATA_DIR}/run ${type} stop || true
     done
     if is_service_enabled tls-proxy; then
-        local proxy_port=${SWIFT_DEFAULT_BIND_PORT:-8080}
+        local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT &
     fi
     run_process s-proxy "$SWIFT_DIR/bin/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"

From 7792bc39d4f9f7ec7fd1b81ddbb30c30988f03e6 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Fri, 23 Oct 2015 13:57:14 +1100
Subject: [PATCH 0955/3333] Add new oslo.privsep library to oslo repos

A new project olos.privsep has been created but failes sdvm testing as
even though the library is added ro PROJECTS and LIBS_FROM_GIT it isn't
installed by devstack.

Add oslo.privsep to the install_oslo function

Change-Id: Ia4d56747d56dcfe50889ebbdf9d553df13e1b950
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index f64f327ccd..56615faaa3 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -36,6 +36,7 @@ GITDIR["oslo.log"]=$DEST/oslo.log
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
 GITDIR["oslo.middleware"]=$DEST/oslo.middleware
 GITDIR["oslo.policy"]=$DEST/oslo.policy
+GITDIR["oslo.privsep"]=$DEST/oslo.privsep
 GITDIR["oslo.reports"]=$DEST/oslo.reports
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
@@ -79,6 +80,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.messaging"
     _do_install_oslo_lib "oslo.middleware"
     _do_install_oslo_lib "oslo.policy"
+    _do_install_oslo_lib "oslo.privsep"
     _do_install_oslo_lib "oslo.reports"
     _do_install_oslo_lib "oslo.rootwrap"
     _do_install_oslo_lib "oslo.serialization"
diff --git a/stackrc b/stackrc
index 4026ff8feb..819aa0125c 100644
--- a/stackrc
+++ b/stackrc
@@ -371,6 +371,10 @@ GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-master}
 GITREPO["oslo.policy"]=${OSLOPOLICY_REPO:-${GIT_BASE}/openstack/oslo.policy.git}
 GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-master}
 
+# oslo.privsep
+GITREPO["oslo.privsep"]=${OSLOPRIVSEP_REPO:-${GIT_BASE}/openstack/oslo.privsep.git}
+GITBRANCH["oslo.privsep"]=${OSLOPRIVSEP_BRANCH:-master}
+
 # oslo.reports
 GITREPO["oslo.reports"]=${OSLOREPORTS_REPO:-${GIT_BASE}/openstack/oslo.reports.git}
 GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 8e8c0227a9..f31560a1fe 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -41,7 +41,7 @@ ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
-ALL_LIBS+=" keystoneauth ironic-lib"
+ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From b814b536c54f4ed840cf3eb436c4841d2ed575c4 Mon Sep 17 00:00:00 2001
From: Cedric Brandily <zzelle@gmail.com>
Date: Thu, 22 Oct 2015 22:25:45 +0200
Subject: [PATCH 0956/3333] Prepare neutron "use_namespaces" option removal

The neutron use_namespaces option is deprecated since Kilo, it's time
remove it from neutron and devstack.

Related-bug: #1508188
Change-Id: I4feb2a15c7e1e4bfdbed2531b18b8e7d798ab3cc
---
 lib/ironic         |  9 ++-------
 lib/neutron-legacy | 15 ++++-----------
 lib/tempest        | 19 +++----------------
 3 files changed, 9 insertions(+), 34 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 74e2f931ff..de07b49667 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -516,13 +516,8 @@ function create_ovs_taps {
     # intentional sleep to make sure the tag has been set to port
     sleep 10
 
-    if  [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-        local tapdev
-        tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
-    else
-        local tapdev
-        tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
-    fi
+    local tapdev
+    tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
     local tag_id
     tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4e51425ffc..3c3c96b7bd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -144,8 +144,6 @@ Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
 # Default auth strategy
 Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
-# Use namespace or not
-Q_USE_NAMESPACE=${Q_USE_NAMESPACE:-True}
 # RHEL's support for namespaces requires using veths with ovs
 Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
 Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
@@ -208,7 +206,7 @@ Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 # The plugin supports L3.
 Q_L3_ENABLED=${Q_L3_ENABLED:-False}
 # L3 routers exist per tenant
-Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-False}
+Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 # List of config file names in addition to the main plugin config file
 # See _configure_neutron_common() for details about setting it up
@@ -968,7 +966,6 @@ function _configure_neutron_debug_command {
 
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
@@ -985,7 +982,6 @@ function _configure_neutron_dhcp_agent {
 
     iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
@@ -1009,8 +1005,6 @@ function _configure_neutron_dhcp_agent {
 
 function _configure_neutron_l3_agent {
     Q_L3_ENABLED=True
-    # for l3-agent, only use per tenant router if we have namespaces
-    Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
 
     if is_service_enabled q-vpn; then
         neutron_vpn_configure_agent
@@ -1020,7 +1014,6 @@ function _configure_neutron_l3_agent {
 
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
@@ -1309,7 +1302,7 @@ function _neutron_configure_router_v4 {
     if is_service_enabled q-l3; then
         # Configure and enable public bridge
         local ext_gw_interface="none"
-        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+        if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
         elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
             # Search for the brq device the neutron router and network for $FIXED_RANGE
@@ -1359,7 +1352,7 @@ function _neutron_configure_router_v6 {
         IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
-        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+        if is_neutron_ovs_base_plugin; then
             local ext_gw_interface
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
@@ -1374,7 +1367,7 @@ function _neutron_configure_router_v6 {
 
 # Explicitly set router id in l3 agent configuration
 function _neutron_set_router_id {
-    if [[ "$Q_USE_NAMESPACE" == "False" ]]; then
+    if [[ "$Q_L3_ROUTER_PER_TENANT" == "False" ]]; then
         iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
     fi
 }
diff --git a/lib/tempest b/lib/tempest
index 10dd652750..1d10da4c86 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -15,7 +15,6 @@
 #   - ``SERVICE_HOST``
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
 #   - ``PUBLIC_NETWORK_NAME``
-#   - ``Q_USE_NAMESPACE``
 #   - ``Q_ROUTER_NAME``
 #   - ``Q_L3_ENABLED``
 #   - ``VIRT_DRIVER``
@@ -132,7 +131,6 @@ function configure_tempest {
     local flavor_lines
     local public_network_id
     local public_router_id
-    local tenant_networks_reachable
     local boto_instance_type="m1.tiny"
     local ssh_connect_method="fixed"
 
@@ -246,13 +244,8 @@ function configure_tempest {
         fi
     fi
 
-    if [ "$Q_USE_NAMESPACE" != "False" ]; then
-        tenant_networks_reachable=false
-        if ! is_service_enabled n-net; then
-            ssh_connect_method="floating"
-        fi
-    else
-        tenant_networks_reachable=true
+    if ! is_service_enabled n-net; then
+        ssh_connect_method="floating"
     fi
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
@@ -260,12 +253,6 @@ function configure_tempest {
     if [ "$Q_L3_ENABLED" = "True" ]; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
-        if [ "$Q_USE_NAMESPACE" == "False" ]; then
-            # If namespaces are disabled, DevStack will create a single
-            # public router that tempest should be configured to use.
-            public_router_id=$(neutron router-list | awk "/ $Q_ROUTER_NAME / \
-                { print \$2 }")
-        fi
     fi
 
     EC2_URL=$(get_endpoint_url ec2 public || true)
@@ -394,7 +381,7 @@ function configure_tempest {
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
-    iniset $TEMPEST_CONFIG network tenant_networks_reachable "$tenant_networks_reachable"
+    iniset $TEMPEST_CONFIG network tenant_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
     iniset $TEMPEST_CONFIG network public_router_id "$public_router_id"
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"

From 4abb31d9d86bee139a0bc3e9f7dfc5041e8b875f Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Mon, 26 Oct 2015 12:35:45 -0400
Subject: [PATCH 0957/3333] Format of nova-api log files was corrected

When nova-api and nova-ec2-api services are started by Apache
(it can be done with devstack config option NOVA_USE_MOD_WSGI=True)
log files contained duplication of timestamp value.

Change-Id: I5439ea8f89ca3073600456f67220e9d3f5257d97
Closes-Bug: #1510517
---
 files/apache-nova-api.template     | 2 +-
 files/apache-nova-ec2-api.template | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index 49081528ff..bcf406edf3 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -7,7 +7,7 @@ Listen %PUBLICPORT%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
     <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
+      ErrorLogFormat "%M"
     </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/nova-api.log
     %SSLENGINE%
diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
index 235d958d1a..a9be15b73a 100644
--- a/files/apache-nova-ec2-api.template
+++ b/files/apache-nova-ec2-api.template
@@ -7,7 +7,7 @@ Listen %PUBLICPORT%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
     <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
+      ErrorLogFormat "%M"
     </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/nova-ec2-api.log
     %SSLENGINE%

From 313ddaee6102fc03a3885bec3bf5e0d1e0214878 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Tue, 20 Oct 2015 11:26:34 +0300
Subject: [PATCH 0958/3333] Remove sudo from mkdir in $STACK_USER folder

This fails in the environment where sudo does not have permissions to
write in /home/$USER folder, e.g. [1]

Also clean-up the comment/variable usage a bit; the location isn't
actually variable at all (and that's fine, but we don't need a global
here)

[1] http://144.76.193.39/ci-artifacts/228979/10/Nova-ML2-Sriov/console.html.gz

Change-Id: I6807eae9d1c27219aa7c19de29f24fa851aa787c
---
 functions-common | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index 42555a95f5..6607d0be70 100644
--- a/functions-common
+++ b/functions-common
@@ -73,21 +73,23 @@ function save_stackenv {
 # - A `devstack-admin` entry for the `admin` user for the `admin` project.
 # write_clouds_yaml
 function write_clouds_yaml {
-    # The location is a variable to allow for easier refactoring later to make it
-    # overridable. There is currently no usecase where doing so makes sense, so
-    # it's not currently configurable.
-    for clouds_path in /etc/openstack ~/.config/openstack ; do
-        CLOUDS_YAML=$clouds_path/clouds.yaml
+    local clouds_yaml
+
+    sudo mkdir -p /etc/openstack
+    sudo chown -R $STACK_USER /etc/openstack
+    # XXX: to be removed, see https://review.openstack.org/237149/
+    # careful not to sudo this, incase ~ is NFS mounted
+    mkdir -p ~/.config/openstack
 
-        sudo mkdir -p $(dirname $CLOUDS_YAML)
-        sudo chown -R $STACK_USER $(dirname $CLOUDS_YAML)
+    for clouds_path in /etc/openstack ~/.config/openstack ; do
+        clouds_yaml=$clouds_path/clouds.yaml
 
         CA_CERT_ARG=''
         if [ -f "$SSL_BUNDLE_FILE" ]; then
             CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
         fi
         $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $CLOUDS_YAML \
+            --file $clouds_yaml \
             --os-cloud devstack \
             --os-region-name $REGION_NAME \
             --os-identity-api-version 3 \
@@ -97,7 +99,7 @@ function write_clouds_yaml {
             --os-password $ADMIN_PASSWORD \
             --os-project-name demo
         $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $CLOUDS_YAML \
+            --file $clouds_yaml \
             --os-cloud devstack-admin \
             --os-region-name $REGION_NAME \
             --os-identity-api-version 3 \

From ee9bb76647e1424e0dc84d32df6ab8607dc4ec96 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 19 Oct 2015 15:16:18 -0400
Subject: [PATCH 0959/3333] Write clouds.yaml to only /etc

After having migrated the copies of clouds.yaml to just consume from
/etc, remove the duplicate copy.

Change-Id: I036704734785958c95d2234917d7b40bd797a375
---
 functions-common | 63 +++++++++++++++++++++++-------------------------
 1 file changed, 30 insertions(+), 33 deletions(-)

diff --git a/functions-common b/functions-common
index 6607d0be70..922938f95d 100644
--- a/functions-common
+++ b/functions-common
@@ -73,42 +73,39 @@ function save_stackenv {
 # - A `devstack-admin` entry for the `admin` user for the `admin` project.
 # write_clouds_yaml
 function write_clouds_yaml {
-    local clouds_yaml
+    # The location is a variable to allow for easier refactoring later to make it
+    # overridable. There is currently no usecase where doing so makes sense, so
+    # it's not currently configurable.
 
-    sudo mkdir -p /etc/openstack
-    sudo chown -R $STACK_USER /etc/openstack
-    # XXX: to be removed, see https://review.openstack.org/237149/
-    # careful not to sudo this, incase ~ is NFS mounted
-    mkdir -p ~/.config/openstack
+    CLOUDS_YAML=/etc/openstack/clouds.yaml
 
-    for clouds_path in /etc/openstack ~/.config/openstack ; do
-        clouds_yaml=$clouds_path/clouds.yaml
+    sudo mkdir -p $(dirname $CLOUDS_YAML)
+    sudo chown -R $STACK_USER /etc/openstack
 
-        CA_CERT_ARG=''
-        if [ -f "$SSL_BUNDLE_FILE" ]; then
-            CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
-        fi
-        $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $clouds_yaml \
-            --os-cloud devstack \
-            --os-region-name $REGION_NAME \
-            --os-identity-api-version 3 \
-            $CA_CERT_ARG \
-            --os-auth-url $KEYSTONE_AUTH_URI \
-            --os-username demo \
-            --os-password $ADMIN_PASSWORD \
-            --os-project-name demo
-        $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $clouds_yaml \
-            --os-cloud devstack-admin \
-            --os-region-name $REGION_NAME \
-            --os-identity-api-version 3 \
-            $CA_CERT_ARG \
-            --os-auth-url $KEYSTONE_AUTH_URI \
-            --os-username admin \
-            --os-password $ADMIN_PASSWORD \
-            --os-project-name admin
-    done
+    CA_CERT_ARG=''
+    if [ -f "$SSL_BUNDLE_FILE" ]; then
+        CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
+    fi
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version 3 \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-username demo \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version 3 \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name admin
 }
 
 # trueorfalse <True|False> <VAR>

From a692810ef05304856e5fd12ec786f3445ecca576 Mon Sep 17 00:00:00 2001
From: Oleksii Chuprykov <ochuprykov@mirantis.com>
Date: Thu, 11 Jun 2015 08:56:58 -0400
Subject: [PATCH 0960/3333] Add toggle to run Heat API services via Apache2

Add templates for running Heat API services via
apache mod_wsgi. Also add appropriate functions to
lib/heat for configuring Heat.

Change-Id: I1bdd678c44ddfa616a9db7db85ff6f490ff08947
---
 doc/source/configuration.rst              |   6 ++
 files/apache-heat-api-cfn.template        |  27 ++++++
 files/apache-heat-api-cloudwatch.template |  27 ++++++
 files/apache-heat-api.template            |  27 ++++++
 lib/heat                                  | 109 ++++++++++++++++++++--
 5 files changed, 188 insertions(+), 8 deletions(-)
 create mode 100644 files/apache-heat-api-cfn.template
 create mode 100644 files/apache-heat-api-cloudwatch.template
 create mode 100644 files/apache-heat-api.template

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index aae4f33562..d70d3dae17 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -297,6 +297,12 @@ Example (Swift):
 
     SWIFT_USE_MOD_WSGI="True"
 
+Example (Heat):
+
+::
+
+    HEAT_USE_MOD_WSGI="True"
+
 
 Example (Cinder):
 
diff --git a/files/apache-heat-api-cfn.template b/files/apache-heat-api-cfn.template
new file mode 100644
index 0000000000..ab33c66f7e
--- /dev/null
+++ b/files/apache-heat-api-cfn.template
@@ -0,0 +1,27 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess heat-api-cfn processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup heat-api-cfn
+    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cfn
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    AllowEncodedSlashes On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/heat-api-cfn.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %HEAT_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/files/apache-heat-api-cloudwatch.template b/files/apache-heat-api-cloudwatch.template
new file mode 100644
index 0000000000..06c91bbdb1
--- /dev/null
+++ b/files/apache-heat-api-cloudwatch.template
@@ -0,0 +1,27 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess heat-api-cloudwatch processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup heat-api-cloudwatch
+    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cloudwatch
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    AllowEncodedSlashes On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/heat-api-cloudwatch.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %HEAT_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/files/apache-heat-api.template b/files/apache-heat-api.template
new file mode 100644
index 0000000000..4924b3978b
--- /dev/null
+++ b/files/apache-heat-api.template
@@ -0,0 +1,27 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess heat-api processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup heat-api
+    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    AllowEncodedSlashes On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/heat-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %HEAT_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/lib/heat b/lib/heat
index 615198cc7d..85fdaa1eb2 100644
--- a/lib/heat
+++ b/lib/heat
@@ -16,6 +16,7 @@
 # - install_heat
 # - configure_heatclient
 # - configure_heat
+# - _config_heat_apache_wsgi
 # - init_heat
 # - start_heat
 # - stop_heat
@@ -32,6 +33,9 @@ set +o xtrace
 # set up default directories
 GITDIR["python-heatclient"]=$DEST/python-heatclient
 
+# Toggle for deploying Heat-API under HTTPD + mod_wsgi
+HEAT_USE_MOD_WSGI=${HEAT_USE_MOD_WSGI:-False}
+
 HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
@@ -117,13 +121,17 @@ function configure_heat {
     # logging
     iniset $HEAT_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $HEAT_CONF DEFAULT use_syslog $SYSLOG
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$HEAT_USE_MOD_WSGI" == "False" ]  ; then
         # Add color to logging output
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
     iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
 
+    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        _config_heat_apache_wsgi
+    fi
+
     # NOTE(jamielennox): heat re-uses specific values from the
     # keystone_authtoken middleware group and so currently fails when using the
     # auth plugin setup. This should be fixed in heat.  Heat is also the only
@@ -211,6 +219,9 @@ function install_heatclient {
 function install_heat {
     git_clone $HEAT_REPO $HEAT_DIR $HEAT_BRANCH
     setup_develop $HEAT_DIR
+    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        install_apache_wsgi
+    fi
 }
 
 # install_heat_other() - Collect source and prepare
@@ -226,20 +237,102 @@ function install_heat_other {
 # start_heat() - Start running processes, including screen
 function start_heat {
     run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
-    run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
-    run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
-    run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
+
+    # If the site is not enabled then we are in a grenade scenario
+    local enabled_site_file=$(apache_site_config_for heat-api)
+    if [ -f ${enabled_site_file} ] && [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        enable_apache_site heat-api
+        enable_apache_site heat-api-cfn
+        enable_apache_site heat-api-cloudwatch
+        restart_apache_server
+        tail_log heat-api /var/log/$APACHE_NAME/heat-api.log
+        tail_log heat-api-cfn /var/log/$APACHE_NAME/heat-api-cfn.log
+        tail_log heat-api-cloudwatch /var/log/$APACHE_NAME/heat-api-cloudwatch.log
+    else
+        run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
+        run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
+        run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
+    fi
 }
 
 # stop_heat() - Stop running processes
 function stop_heat {
     # Kill the screen windows
-    local serv
-    for serv in h-eng h-api h-api-cfn h-api-cw; do
-        stop_process $serv
-    done
+    stop_process h-eng
+
+    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        disable_apache_site heat-api
+        disable_apache_site heat-api-cfn
+        disable_apache_site heat-api-cloudwatch
+        restart_apache_server
+    else
+        local serv
+        for serv in h-api h-api-cfn h-api-cw; do
+            stop_process $serv
+        done
+    fi
+
 }
 
+# _cleanup_heat_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
+function _cleanup_heat_apache_wsgi {
+    sudo rm -f $(apache_site_config_for heat-api)
+    sudo rm -f $(apache_site_config_for heat-api-cfn)
+    sudo rm -f $(apache_site_config_for heat-api-cloudwatch)
+}
+
+# _config_heat_apache_wsgi() - Set WSGI config files of Heat
+function _config_heat_apache_wsgi {
+
+    local heat_apache_conf=$(apache_site_config_for heat-api)
+    local heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
+    local heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
+    local heat_ssl=""
+    local heat_certfile=""
+    local heat_keyfile=""
+    local heat_api_port=$HEAT_API_PORT
+    local heat_cfn_api_port=$HEAT_API_CFN_PORT
+    local heat_cw_api_port=$HEAT_API_CW_PORT
+    local venv_path=""
+
+    sudo cp $FILES/apache-heat-api.template $heat_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$heat_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
+        s|%SSLENGINE%|$heat_ssl|g;
+        s|%SSLCERTFILE%|$heat_certfile|g;
+        s|%SSLKEYFILE%|$heat_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $heat_apache_conf
+
+    sudo cp $FILES/apache-heat-api-cfn.template $heat_cfn_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$heat_cfn_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
+        s|%SSLENGINE%|$heat_ssl|g;
+        s|%SSLCERTFILE%|$heat_certfile|g;
+        s|%SSLKEYFILE%|$heat_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $heat_cfn_apache_conf
+
+    sudo cp $FILES/apache-heat-api-cloudwatch.template $heat_cloudwatch_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$heat_cw_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
+        s|%SSLENGINE%|$heat_ssl|g;
+        s|%SSLCERTFILE%|$heat_certfile|g;
+        s|%SSLKEYFILE%|$heat_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $heat_cloudwatch_apache_conf
+}
+
+
 # create_heat_accounts() - Set up common required heat accounts
 function create_heat_accounts {
     if [[ "$HEAT_STANDALONE" != "True" ]]; then

From cf94edcbbdde75de3ce627d7e092936bc014d5f6 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 28 Oct 2015 09:50:01 -0700
Subject: [PATCH 0961/3333] Disable shelve/snapshot/cinder when running Tempest
 with libvirt+lxc

The libvirt+lxc backend in nova does not support shelve, image snapshot
or any volume-related actions (so pretty much anything to do with
cinder), so we need to configure tempest to not run tests that hit those
operations/service when using libvirt/lxc.

This is part of an overall effort to get a CI job running for nova with
the libvirt+lxc configuration per:

Ic07c39e219121ba6b8b20de2b83a193bb735133d

Change-Id: I4decfcc5a5dfbabdecb3eb9fc93f1d1d6c2af805
---
 lib/tempest | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 10dd652750..565e965836 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -531,6 +531,8 @@ function configure_tempest {
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
         iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
+        iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
         iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
     fi
 
@@ -548,6 +550,12 @@ function configure_tempest {
         fi
     done
 
+    if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
+        # libvirt-lxc does not support boot from volume or attaching volumes
+        # so basically anything with cinder is out of the question.
+        iniset $TEMPEST_CONFIG service_available cinder "False"
+    fi
+
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         # Use the ``BOTO_CONFIG`` environment variable to point to this file
         iniset -sudo $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE

From 5cdee8dd3311e501302993cd8c81b39cb6b45090 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 19 Oct 2015 14:17:18 +1100
Subject: [PATCH 0962/3333] Update to bashate 0.3.2

Bashate 0.3.2 has a few new checks -- firstly make sure some of the
plugins have #!/bin/bash, and fix up a couple of "local" changes that
were missed by I9c8912a8fd596535589b207d7fc553b9d951d3fe

Change-Id: I9e4b1c0dc9e0f709d8e76f9c9bf1c9478b2605ed
---
 functions-common                          | 20 ++++++++++++++------
 lib/heat                                  | 12 ++++++++----
 lib/neutron_plugins/services/firewall     |  2 ++
 lib/neutron_plugins/services/loadbalancer |  2 ++
 lib/neutron_plugins/services/metering     |  2 ++
 lib/neutron_plugins/services/vpn          |  2 ++
 lib/neutron_thirdparty/vmware_nsx         |  2 ++
 tox.ini                                   |  7 ++++---
 8 files changed, 36 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 42555a95f5..ceefd443b1 100644
--- a/functions-common
+++ b/functions-common
@@ -1746,7 +1746,8 @@ function run_phase {
             # extras.d in an unsupported way which will let us track
             # unsupported usage in the gate.
             local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
-            local extra=$(basename $extra_plugin_file_name)
+            local extra
+            extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
                 deprecated "extras.d support is being removed in Mitaka-1"
                 deprecated "jobs for project $extra will break after that point"
@@ -2184,14 +2185,21 @@ function time_start {
 # global counter for that name. Errors if that clock had not
 # previously been started.
 function time_stop {
-    local name=$1
-    local start_time=${START_TIME[$name]}
+    local name
+    local end_time
+    local elpased_time
+    local total
+    local start_time
+
+    name=$1
+    start_time=${START_TIME[$name]}
+
     if [[ -z "$start_time" ]]; then
         die $LINENO "Trying to stop the clock on $name, but it was never started"
     fi
-    local end_time=$(date +%s)
-    local elapsed_time=$(($end_time - $start_time))
-    local total=${TOTAL_TIME[$name]:-0}
+    end_time=$(date +%s)
+    elapsed_time=$(($end_time - $start_time))
+    total=${TOTAL_TIME[$name]:-0}
     # reset the clock so we can start it in the future
     START_TIME[$name]=""
     TOTAL_TIME[$name]=$(($total + $elapsed_time))
diff --git a/lib/heat b/lib/heat
index 85fdaa1eb2..f3f0548947 100644
--- a/lib/heat
+++ b/lib/heat
@@ -239,7 +239,8 @@ function start_heat {
     run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
 
     # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file=$(apache_site_config_for heat-api)
+    local enabled_site_file
+    enabled_site_file=$(apache_site_config_for heat-api)
     if [ -f ${enabled_site_file} ] && [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site heat-api
         enable_apache_site heat-api-cfn
@@ -284,9 +285,12 @@ function _cleanup_heat_apache_wsgi {
 # _config_heat_apache_wsgi() - Set WSGI config files of Heat
 function _config_heat_apache_wsgi {
 
-    local heat_apache_conf=$(apache_site_config_for heat-api)
-    local heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
-    local heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
+    local heat_apache_conf
+    heat_apache_conf=$(apache_site_config_for heat-api)
+    local heat_cfn_apache_conf
+    heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
+    local heat_cloudwatch_apache_conf
+    heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
     local heat_ssl=""
     local heat_certfile=""
     local heat_keyfile=""
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 61a148e596..3496da82f8 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron firewall plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index 34190f9a56..7865f6fd6e 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron loadbalancer plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 37ba019b98..c75ab19d4e 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron metering plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 4d6a2bf9a0..c0e7457413 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron VPN plugin
 # ---------------------------
 
diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
index 03853a9bf4..e182fca1ae 100644
--- a/lib/neutron_thirdparty/vmware_nsx
+++ b/lib/neutron_thirdparty/vmware_nsx
@@ -1,2 +1,4 @@
+#!/bin/bash
+
 # REVISIT(roeyc): this file left empty so that 'enable_service vmware_nsx'
 # continues to work.
diff --git a/tox.ini b/tox.ini
index 0df9877ba8..9279455bb8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,7 +9,7 @@ install_command = pip install {opts} {packages}
 
 [testenv:bashate]
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.3.1}
+   {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \ # prune all 'dot' dirs
@@ -20,12 +20,13 @@ commands = bash -c "find {toxinidir}             \
          -not -name \*.md                        \
          \(                                      \
           -name \*.sh -or                        \
-          -name \*rc -or                         \
+          -name \*.orig -or                      \
+          -name \*rc -or                         \ # openrc files, etc
           -name functions\* -or                  \
           -wholename \*/inc/\* -or               \ # /inc files and
           -wholename \*/lib/\*                   \ # /lib files are shell, but
          \)                                      \ #   have no extension
-         -print0 | xargs -0 bashate -v -iE006"
+         -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
 deps =

From 347dbac04e8988a01e3330e34b57f1e5b3c6aa2a Mon Sep 17 00:00:00 2001
From: Nicolas Simonds <nic@metacloud.com>
Date: Wed, 21 Jan 2015 13:40:42 -0800
Subject: [PATCH 0963/3333] Add the ability to install/enable Heat plugins

Adds the $ENABLE_HEAT_PLUGINS variable, which should be a list of
the names of the plugins the user wishes to install.

Change-Id: I2ba90002a8fad1cdce6543c89dc37c5912fe133e
---
 lib/heat | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/lib/heat b/lib/heat
index f3f0548947..e42bdf0b9e 100644
--- a/lib/heat
+++ b/lib/heat
@@ -69,6 +69,8 @@ else
     HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
 fi
+HEAT_PLUGIN_DIR=${HEAT_PLUGIN_DIR:-$DATA_DIR/heat/plugins}
+ENABLE_HEAT_PLUGINS=${ENABLE_HEAT_PLUGINS:-}
 
 # Functions
 # ---------
@@ -188,6 +190,35 @@ function configure_heat {
     # copy the default templates
     cp $HEAT_DIR/etc/heat/templates/* $HEAT_TEMPLATES_DIR/
 
+    # Enable heat plugins.
+    # NOTE(nic): The symlink nonsense is necessary because when
+    # plugins are installed in "developer mode", the final component
+    # of their target directory is always "resources", which confuses
+    # Heat's plugin loader into believing that all plugins are named
+    # "resources", and therefore are all the same plugin; so it
+    # will only load one of them.  Linking them all to a common
+    # location with unique names avoids that type of collision,
+    # while still allowing the plugins to be edited in-tree.
+    local err_count=0
+
+    if [ -n "$ENABLE_HEAT_PLUGINS" ]; then
+        mkdir -p $HEAT_PLUGIN_DIR
+        # Clean up cruft from any previous runs
+        rm -f $HEAT_PLUGIN_DIR/*
+        iniset $HEAT_CONF DEFAULT plugin_dirs $HEAT_PLUGIN_DIR
+    fi
+
+    for heat_plugin in $ENABLE_HEAT_PLUGINS; do
+        if [ -d $HEAT_DIR/contrib/$heat_plugin ]; then
+            setup_package $HEAT_DIR/contrib/$heat_plugin -e
+            ln -s $HEAT_DIR/contrib/$heat_plugin/$heat_plugin/resources $HEAT_PLUGIN_DIR/$heat_plugin
+        else
+            : # clear retval on the test so that we can roll up errors
+            err $LINENO "Requested Heat plugin(${heat_plugin}) not found."
+            err_count=$(($err_count + 1))
+        fi
+    done
+    [ $err_count -eq 0 ] || die $LINENO "$err_count of the requested Heat plugins could not be installed."
 }
 
 # init_heat() - Initialize database

From abb40f61939355f471c1a37c671774923e12b660 Mon Sep 17 00:00:00 2001
From: Thiago Paiva <thiagop@lsd.ufcg.edu.br>
Date: Thu, 29 Oct 2015 11:38:24 -0300
Subject: [PATCH 0964/3333] Correct Cinder protocol for connections on Ironic

The protocol for connections with Cinder is wrong for the Ironic script. This
patch changes the script to use $GLANCE_SERVICE_PROTOCOL, which is https when
USE_SSL=true or tls-proxy is on ENABLED_SERVICES.

Change-Id: I4d4c6f9dc6f6ee53166db109848dca64334b8748
---
 lib/ironic | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index de07b49667..d786870165 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -795,7 +795,7 @@ function upload_baremetal_ironic_deploy {
     # load them into glance
     IRONIC_DEPLOY_KERNEL_ID=$(openstack \
         --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
+        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
         image create \
         $(basename $IRONIC_DEPLOY_KERNEL_PATH) \
         --public --disk-format=aki \
@@ -803,7 +803,7 @@ function upload_baremetal_ironic_deploy {
         < $IRONIC_DEPLOY_KERNEL_PATH  | grep ' id ' | get_field 2)
     IRONIC_DEPLOY_RAMDISK_ID=$(openstack \
         --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
+        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
         image create \
         $(basename $IRONIC_DEPLOY_RAMDISK_PATH) \
         --public --disk-format=ari \

From 7159b4ba5956c0fd3141fe13ac40057364683c9c Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Thu, 22 Oct 2015 15:47:49 -0400
Subject: [PATCH 0965/3333] Config graceful_shutdown_timeout option for
 services

To avoid hanging services during gracefull shutdown option
graceful_shutdown_timeout should be configured.

Closes-Bug: #1446583

Change-Id: I2b7f0df831d65c55ae8cae241478f49c9641d99f
---
 lib/cinder | 2 +-
 lib/glance | 2 ++
 lib/nova   | 1 +
 stackrc    | 3 +++
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index ed9a1038d6..a916c6540f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -357,7 +357,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_TENANT_NAME"
-
+    iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
diff --git a/lib/glance b/lib/glance
index 2eb93a46e6..5a1b2834d0 100644
--- a/lib/glance
+++ b/lib/glance
@@ -115,6 +115,7 @@ function configure_glance {
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
+    iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
     cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -149,6 +150,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
         iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+        iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_TENANT_NAME:glance-swift
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
diff --git a/lib/nova b/lib/nova
index 6c414030ae..cce598d853 100644
--- a/lib/nova
+++ b/lib/nova
@@ -649,6 +649,7 @@ function create_nova_conf {
         iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
     fi
+    iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 }
 
 function init_nova_cells {
diff --git a/stackrc b/stackrc
index 819aa0125c..1a95e2b7ed 100644
--- a/stackrc
+++ b/stackrc
@@ -669,6 +669,9 @@ fi
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 
+# Service graceful shutdown timeout
+SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
+
 # Support alternative yum -- in future Fedora 'dnf' will become the
 # only supported installer, but for now 'yum' and 'dnf' are both
 # available in parallel with compatible CLIs.  Allow manual switching

From cdcdeb64602ea271bedf20f58a9f1ca1c0075c84 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 29 Oct 2015 09:48:17 -0700
Subject: [PATCH 0966/3333] Remove CINDER_VOLUME_CLEAR value validation

132fbcd38ebae52bdd20da54905131b75581520f in cinder changed the
volume_clear StrOpt to use the choices kwarg which enforces the value
specified and raises a ValueError if an invalid value is set for the
option in cinder.conf.

This lets us remove the validation that devstack was doing.

Change-Id: Ia7eead6297ed0f3a972de2021170fe9c7225e856
---
 lib/cinder | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index ed9a1038d6..1307c11f7a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -317,9 +317,7 @@ function configure_cinder {
 
     iniset_rpc_backend cinder $CINDER_CONF
 
-    if [[ "$CINDER_VOLUME_CLEAR" == "none" ]] || [[ "$CINDER_VOLUME_CLEAR" == "zero" ]] || [[ "$CINDER_VOLUME_CLEAR" == "shred" ]]; then
-        iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
-    fi
+    iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then

From 5ea1e16d83d6312fb17976ded0ab1a6a3773ca4d Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephen.finucane@intel.com>
Date: Thu, 29 Oct 2015 20:12:26 +0000
Subject: [PATCH 0967/3333] lib/nova: Remove 'DEFAULT/verbose'

The 'verbose' option has been deprecated by oslo_log. Using it
results in a warning for the 'nova-manage' command and likely
many other OpenStack commands.

Change-Id: Icc11b25f56ebc62443c6afa90b9572d5c63b3882
Partial-bug: #1511505
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6c414030ae..47c43bd193 100644
--- a/lib/nova
+++ b/lib/nova
@@ -480,7 +480,6 @@ function create_nova_conf {
 
     # (Re)create ``nova.conf``
     rm -f $NOVA_CONF
-    iniset $NOVA_CONF DEFAULT verbose "True"
     iniset $NOVA_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
     if [ "$NOVA_ALLOW_MOVE_TO_SAME_HOST" == "True" ]; then
         iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"

From 0ec80802735163fdbdb4ceaa339aa73f93bbd87a Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Fri, 30 Oct 2015 14:25:41 +0100
Subject: [PATCH 0968/3333] Remove multi-region workaround

When keystone API v3 was introduced, filtering regions when listing
endpoints was not supported (see [1]). This caused multi-region devstack
deployments to fail (see [2]). A workaround was introduced to devstack
to enable for multi-region deployments until region filtering would work
in keystone API v3.
Now that the bug related to region filtering in keystone is resolved,
the workaround should be removed.

[1]: https://bugs.launchpad.net/keystone/+bug/1482772
[2]: https://bugs.launchpad.net/devstack/+bug/1483784

Closes-Bug: #1511745
Related-Bug: #1483784
Related-Bug: #1482772
Change-Id: I52d13c3f5e7b77a7f8fb1be4dcea437988ebddfe
---
 functions-common | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index d36d323820..d282203d45 100644
--- a/functions-common
+++ b/functions-common
@@ -913,16 +913,11 @@ function get_or_create_service {
 # Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
 function _get_or_create_endpoint_with_interface {
     local endpoint_id
-    # TODO(dgonzalez): The check of the region name, as done in the grep
-    # statement below, exists only because keystone does currently
-    # not allow filtering the region name when listing endpoints. If keystone
-    # gets support for this, the check for the region name can be removed.
-    # Related bug in keystone: https://bugs.launchpad.net/keystone/+bug/1482772
     endpoint_id=$(openstack endpoint list \
         --service $1 \
         --interface $2 \
         --region $4 \
-        -c ID -c Region -f value | grep $4 | cut -f 1 -d " ")
+        -c ID -f value)
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \

From 55a1bca28215a7623c9bd067a663e176d4b3e672 Mon Sep 17 00:00:00 2001
From: Andrey Kurilin <akurilin@mirantis.com>
Date: Fri, 30 Oct 2015 16:24:19 +0200
Subject: [PATCH 0969/3333] Remove wrong paramter COMPUTE_API_VERSION

Since:
 - novaclient doesn't require specify the *compute api* version
  (default is 2.latest now)
 - novaclient doesn't use COMPUTE_API_VERSION, since it's wrong name(
   OS_COMPUTE_API_VERSION is a correct name)

we can remove COMPUTE_API_VERSION and NOVA_VERSION vars

Change-Id: I47856863e9403870b8d60c778b97d3de1a212ae1
---
 exercises/client-args.sh | 1 -
 exercises/client-env.sh  | 4 ----
 openrc                   | 6 ------
 3 files changed, 11 deletions(-)

diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index c33ef44e9a..7cfef1c807 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -41,7 +41,6 @@ unset NOVA_PROJECT_ID
 unset NOVA_REGION_NAME
 unset NOVA_URL
 unset NOVA_USERNAME
-unset NOVA_VERSION
 
 # Save the known variables for later
 export x_TENANT_NAME=$OS_TENANT_NAME
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
index 4a0609a944..1d2f4f5689 100755
--- a/exercises/client-env.sh
+++ b/exercises/client-env.sh
@@ -41,7 +41,6 @@ unset NOVA_PROJECT_ID
 unset NOVA_REGION_NAME
 unset NOVA_URL
 unset NOVA_USERNAME
-unset NOVA_VERSION
 
 for i in OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_AUTH_URL; do
     is_set $i
@@ -101,9 +100,6 @@ if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
             STATUS_EC2="Failed"
             RETURN=1
         fi
-
-        # Clean up side effects
-        unset NOVA_VERSION
     fi
 fi
 
diff --git a/openrc b/openrc
index 71ba5a6ea5..9bc0fd77f4 100644
--- a/openrc
+++ b/openrc
@@ -95,12 +95,6 @@ if [[ ! -v OS_CACERT ]] ; then
     fi
 fi
 
-# Currently novaclient needs you to specify the *compute api* version.  This
-# needs to match the config of your catalog returned by Keystone.
-export NOVA_VERSION=${NOVA_VERSION:-1.1}
-# In the future this will change names:
-export COMPUTE_API_VERSION=${COMPUTE_API_VERSION:-$NOVA_VERSION}
-
 # Currently cinderclient needs you to specify the *volume api* version. This
 # needs to match the config of your catalog returned by Keystone.
 export CINDER_VERSION=${CINDER_VERSION:-2}

From f54f60a63ea146e54d430e343f666638bf7947d2 Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Fri, 30 Oct 2015 23:00:57 +0800
Subject: [PATCH 0970/3333] Delete some comment or messages of
 keystone_data.sh(removed)

As files/keystone_data.sh has been removed in the commit
https://review.openstack.org/#/c/79366/, we should remove some
related documations and comments.

Change-Id: I7802d0052fa28d8debb7f361d36a4f108869554c
---
 HACKING.rst                  | 3 +--
 doc/source/configuration.rst | 2 +-
 lib/tempest                  | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index 6bd24b0174..d66687e351 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -250,8 +250,7 @@ These scripts are executed serially by ``exercise.sh`` in testing situations.
   database access from the exercise itself.
 
 * If specific configuration needs to be present for the exercise to complete,
-  it should be staged in ``stack.sh``, or called from ``stack.sh`` (see
-  ``files/keystone_data.sh`` for an example of this).
+  it should be staged in ``stack.sh``, or called from ``stack.sh``.
 
 * The ``OS_*`` environment variables should be the only ones used for all
   authentication to OpenStack clients as documented in the CLIAuth_ wiki page.
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d70d3dae17..9ba657a50d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -393,7 +393,7 @@ with ``KEYSTONE_CATALOG_BACKEND``:
         KEYSTONE_CATALOG_BACKEND=template
 
 DevStack's default configuration in ``sql`` mode is set in
-``files/keystone_data.sh``
+``lib/keystone``
 
 
 Guest Images
diff --git a/lib/tempest b/lib/tempest
index 32630dbf59..03e2aacf97 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -23,7 +23,7 @@
 #
 # Optional Dependencies:
 #
-# - ``ALT_*`` (similar vars exists in keystone_data.sh)
+# - ``ALT_*``
 # - ``LIVE_MIGRATION_AVAILABLE``
 # - ``USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION``
 # - ``DEFAULT_INSTANCE_TYPE``

From 08abba008e735d333f9180180c6a28e7cd5a1171 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Thu, 11 Jun 2015 13:01:41 -0400
Subject: [PATCH 0971/3333] Add ability to run Nova metadata under Apache2

This patch allows to run Nova metadata service using Apache
on port 80 under /metadata URL.

Change-Id: I18f3399738c31166eac884a9b0d5c4045d3f445c
---
 files/apache-nova-metadata.template | 25 +++++++++++++++++++++++++
 lib/nova                            | 23 +++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 files/apache-nova-metadata.template

diff --git a/files/apache-nova-metadata.template b/files/apache-nova-metadata.template
new file mode 100644
index 0000000000..6231c1ced8
--- /dev/null
+++ b/files/apache-nova-metadata.template
@@ -0,0 +1,25 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess nova-metadata processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup nova-metadata
+    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/nova-metadata.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+Alias /metadata %PUBLICWSGI%
+<Location /metadata>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup nova-metadata
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/nova b/lib/nova
index 6c414030ae..e82c28be4d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -7,6 +7,7 @@
 #
 # - ``functions`` file
 # - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
+# - ``FILES``
 # - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
 # - ``LIBVIRT_TYPE`` must be defined
 # - ``INSTANCE_NAME_PREFIX``, ``VOLUME_NAME_PREFIX`` must be defined
@@ -87,6 +88,7 @@ NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
 EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
+METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
@@ -241,6 +243,7 @@ function _cleanup_nova_apache_wsgi {
     sudo rm -f $NOVA_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for nova-api)
     sudo rm -f $(apache_site_config_for nova-ec2-api)
+    sudo rm -f $(apache_site_config_for nova-metadata)
 }
 
 # _config_nova_apache_wsgi() - Set WSGI config files of Keystone
@@ -251,11 +254,14 @@ function _config_nova_apache_wsgi {
     nova_apache_conf=$(apache_site_config_for nova-api)
     local nova_ec2_apache_conf
     nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
+    local nova_metadata_apache_conf
+    nova_metadata_apache_conf=$(apache_site_config_for nova-metadata)
     local nova_ssl=""
     local nova_certfile=""
     local nova_keyfile=""
     local nova_api_port=$NOVA_SERVICE_PORT
     local nova_ec2_api_port=$EC2_SERVICE_PORT
+    local nova_metadata_port=$METADATA_SERVICE_PORT
     local venv_path=""
 
     if is_ssl_enabled_service nova-api; then
@@ -270,6 +276,7 @@ function _config_nova_apache_wsgi {
     # copy proxy vhost and wsgi helper files
     sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
     sudo cp $NOVA_DIR/nova/wsgi/nova-ec2-api.py $NOVA_WSGI_DIR/nova-ec2-api
+    sudo cp $NOVA_DIR/nova/wsgi/nova-metadata.py $NOVA_WSGI_DIR/nova-metadata
 
     sudo cp $FILES/apache-nova-api.template $nova_apache_conf
     sudo sed -e "
@@ -296,6 +303,19 @@ function _config_nova_apache_wsgi {
         s|%VIRTUALENV%|$venv_path|g
         s|%APIWORKERS%|$API_WORKERS|g
     " -i $nova_ec2_apache_conf
+
+    sudo cp $FILES/apache-nova-metadata.template $nova_metadata_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$nova_metadata_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-metadata|g;
+        s|%SSLENGINE%|$nova_ssl|g;
+        s|%SSLCERTFILE%|$nova_certfile|g;
+        s|%SSLKEYFILE%|$nova_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+        s|%APIWORKERS%|$API_WORKERS|g
+    " -i $nova_metadata_apache_conf
 }
 
 # configure_nova() - Set config files, create data dirs, etc
@@ -798,9 +818,11 @@ function start_nova_api {
     if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site nova-api
         enable_apache_site nova-ec2-api
+        enable_apache_site nova-metadata
         restart_apache_server
         tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
         tail_log nova-ec2-api /var/log/$APACHE_NAME/nova-ec2-api.log
+        tail_log nova-metadata /var/log/$APACHE_NAME/nova-metadata.log
     else
         run_process n-api "$NOVA_BIN_DIR/nova-api"
     fi
@@ -916,6 +938,7 @@ function stop_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         disable_apache_site nova-api
         disable_apache_site nova-ec2-api
+        disable_apache_site nova-metadata
         restart_apache_server
     else
         stop_process n-api

From 463a0e6d980690d00b17b9ebcfaf83c2f12d7615 Mon Sep 17 00:00:00 2001
From: keiji niwa <niwa-kj@njk.co.jp>
Date: Sat, 11 Jul 2015 22:09:49 +0900
Subject: [PATCH 0972/3333] Replace hard-coded --ipv6-address-mode

Looks like this was just a typo in the original
d1498d74db816b3edbb8376ca5acb7cc5792ea5c ; replace with
environment variable

Change-Id: I877c1a570a68e926c91fc8a393217e6b18245f82
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3c3c96b7bd..c244e5470a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -547,7 +547,7 @@ function create_neutron_initial_network {
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 

From 508931ff367df646d1fa6068008fe550c5572d02 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Mon, 2 Nov 2015 17:39:48 +0900
Subject: [PATCH 0973/3333] Remove Ubuntu 14.10 as supported distribution

Ubuntu 14.10(utopic) reached end of life[1].

[1]: https://lists.ubuntu.com/archives/ubuntu-announce/2015-July/000197.html

Change-Id: Iab13ca797bda56462d9d117aa500d3ba0d9bebcb
---
 lib/nova_plugins/functions-libvirt | 2 +-
 stack.sh                           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 5525cfd951..78c59786d8 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -23,7 +23,7 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
     if is_ubuntu; then
-        if is_arch "aarch64" && [[ ${DISTRO} =~ (trusty|utopic) ]]; then
+        if is_arch "aarch64" && [[ ${DISTRO} == "trusty" ]]; then
             install_package qemu-system
         else
             install_package qemu-kvm
diff --git a/stack.sh b/stack.sh
index 80247317cf..bdbb025a0b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -178,7 +178,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|utopic|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From c30657d7de1a253ffd541d07a0b449d395cb8eab Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Mon, 2 Nov 2015 11:27:46 +0100
Subject: [PATCH 0974/3333] Cleanup ReST format issues

* ReST doesn't allow monospace in italic sections.
      bash$ grep -R \`\` doc/build/html/ --include "*.html"
* The code-block section "::" needed an empty line before the code,
  otherwise it gets shown in the HTML output.
      bash$ egrep -R "<dt>::" doc/build/html/ --include "*.html"
* Monospaced font incorrectly marked with a single back tick
      bash$ egrep -nR '\w`(\s|[\.,;:])' doc/source/ --include "*.rst"

Change-Id: I66c3f685f33851c3f3f0f859996037fc24930246
---
 doc/source/configuration.rst                  | 33 ++++++++++---------
 doc/source/guides/devstack-with-lbaas-v2.rst  |  2 +-
 .../guides/devstack-with-nested-kvm.rst       | 12 +++----
 doc/source/guides/neutron.rst                 | 18 +++++-----
 4 files changed, 33 insertions(+), 32 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d70d3dae17..e9921f049c 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -202,8 +202,8 @@ process to a file in ``LOGDIR``.
 
         LOGDIR=$DEST/logs
 
-*Note the use of ``DEST`` to locate the main install directory; this
-is why we suggest setting it in ``local.conf``.*
+Note the use of ``DEST`` to locate the main install directory; this
+is why we suggest setting it in ``local.conf``.
 
 Enabling Syslog
 ~~~~~~~~~~~~~~~
@@ -239,15 +239,15 @@ Database Backend
 
 Multiple database backends are available. The available databases are defined
 in the lib/databases directory.
-`mysql` is the default database, choose a different one by putting the
-following in the `localrc` section:
+``mysql`` is the default database, choose a different one by putting the
+following in the ``localrc`` section:
 
    ::
 
       disable_service mysql
       enable_service postgresql
 
-`mysql` is the default database.
+``mysql`` is the default database.
 
 RPC Backend
 -----------
@@ -260,6 +260,7 @@ RabbitMQ is handled via the usual service functions and
 Example disabling RabbitMQ in ``local.conf``:
 
 ::
+
     disable_service rabbit
 
 
@@ -511,7 +512,7 @@ VM. When running with only one replica the account, container and
 object services will run directly in screen. The others services like
 replicator, updaters or auditor runs in background.
 
-If you would like to enable Swift you can add this to your `localrc`
+If you would like to enable Swift you can add this to your ``localrc``
 section:
 
 ::
@@ -519,7 +520,7 @@ section:
     enable_service s-proxy s-object s-container s-account
 
 If you want a minimal Swift install with only Swift and Keystone you
-can have this instead in your `localrc` section:
+can have this instead in your ``localrc`` section:
 
 ::
 
@@ -528,24 +529,24 @@ can have this instead in your `localrc` section:
 
 If you only want to do some testing of a real normal swift cluster
 with multiple replicas you can do so by customizing the variable
-`SWIFT_REPLICAS` in your `localrc` section (usually to 3).
+``SWIFT_REPLICAS`` in your ``localrc`` section (usually to 3).
 
 Swift S3
 ++++++++
 
-If you are enabling `swift3` in `ENABLED_SERVICES` DevStack will
+If you are enabling ``swift3`` in ``ENABLED_SERVICES`` DevStack will
 install the swift3 middleware emulation. Swift will be configured to
 act as a S3 endpoint for Keystone so effectively replacing the
-`nova-objectstore`.
+``nova-objectstore``.
 
 Only Swift proxy server is launched in the screen session all other
-services are started in background and managed by `swift-init` tool.
+services are started in background and managed by ``swift-init`` tool.
 
 Heat
 ~~~~
 
-Heat is disabled by default (see `stackrc` file). To enable it
-explicitly you'll need the following settings in your `localrc`
+Heat is disabled by default (see ``stackrc`` file). To enable it
+explicitly you'll need the following settings in your ``localrc``
 section
 
 ::
@@ -554,7 +555,7 @@ section
 
 Heat can also run in standalone mode, and be configured to orchestrate
 on an external OpenStack cloud. To launch only Heat in standalone mode
-you'll need the following settings in your `localrc` section
+you'll need the following settings in your ``localrc`` section
 
 ::
 
@@ -590,14 +591,14 @@ Xenserver
 ~~~~~~~~~
 
 If you would like to use Xenserver as the hypervisor, please refer to
-the instructions in `./tools/xen/README.md`.
+the instructions in ``./tools/xen/README.md``.
 
 Cells
 ~~~~~
 
 `Cells <http://wiki.openstack.org/blueprint-nova-compute-cells>`__ is
 an alternative scaling option.  To setup a cells environment add the
-following to your `localrc` section:
+following to your ``localrc`` section:
 
 ::
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f67978310d..4e5f874787 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -17,7 +17,7 @@ Install devstack
     cd devstack
 
 
-Edit your `local.conf` to look like
+Edit your ``local.conf`` to look like
 
   ::
 
diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index c652bacced..85a5656198 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -50,7 +50,7 @@ the host:
     parm:           nested:bool
 
 Start your VM, now it should have KVM capabilities -- you can verify
-that by ensuring `/dev/kvm` character device is present.
+that by ensuring ``/dev/kvm`` character device is present.
 
 
 Configure Nested KVM for AMD-based Machines
@@ -97,7 +97,7 @@ To make the above value persistent across reboots, add an entry in
 Expose Virtualization Extensions to DevStack VM
 -----------------------------------------------
 
-Edit the VM's libvirt XML configuration via `virsh` utility:
+Edit the VM's libvirt XML configuration via ``virsh`` utility:
 
 ::
 
@@ -115,10 +115,10 @@ Ensure DevStack VM is Using KVM
 -------------------------------
 
 Before invoking ``stack.sh`` in the VM, ensure that KVM is enabled. This
-can be verified by checking for the presence of the file `/dev/kvm` in
+can be verified by checking for the presence of the file ``/dev/kvm`` in
 your VM. If it is present, DevStack will default to using the config
-attribute `virt_type = kvm` in `/etc/nova.conf`; otherwise, it'll fall
-back to `virt_type=qemu`, i.e. plain QEMU emulation.
+attribute ``virt_type = kvm`` in ``/etc/nova.conf``; otherwise, it'll fall
+back to ``virt_type=qemu``, i.e. plain QEMU emulation.
 
 Optionally, to explicitly set the type of virtualization, to KVM, by the
 libvirt driver in nova, the below config attribute can be used in
@@ -131,7 +131,7 @@ DevStack's ``local.conf``:
 
 Once DevStack is configured successfully, verify if the Nova instances
 are using KVM by noticing the QEMU CLI invoked by Nova is using the
-parameter `accel=kvm`, e.g.:
+parameter ``accel=kvm``, e.g.:
 
 ::
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 5891f68033..5e231315f7 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -170,8 +170,8 @@ nova, neutron)
 **Compute Nodes**
 
 In this example, the nodes that will host guest instances will run
-the `neutron-openvswitch-agent` for network connectivity, as well as
-the compute service `nova-compute`.
+the ``neutron-openvswitch-agent`` for network connectivity, as well as
+the compute service ``nova-compute``.
 
 DevStack Configuration
 ----------------------
@@ -256,16 +256,16 @@ compute node 1.
         Q_L3_ENABLED=False
 
 Compute node 2's configuration will be exactly the same, except
-`HOST_IP` will be `10.0.0.4`
+``HOST_IP`` will be ``10.0.0.4``
 
 When DevStack is configured to use provider networking (via
-`Q_USE_PROVIDER_NETWORKING` is True and `Q_L3_ENABLED` is False) -
+``Q_USE_PROVIDER_NETWORKING`` is True and ``Q_L3_ENABLED`` is False) -
 DevStack will automatically add the network interface defined in
-`PUBLIC_INTERFACE` to the `OVS_PHYSICAL_BRIDGE`
+``PUBLIC_INTERFACE`` to the ``OVS_PHYSICAL_BRIDGE``
 
 For example, with the above  configuration, a bridge is
-created, named `br-ex` which is managed by Open vSwitch, and the
-second interface on the compute node, `eth1` is attached to the
+created, named ``br-ex`` which is managed by Open vSwitch, and the
+second interface on the compute node, ``eth1`` is attached to the
 bridge, to forward traffic sent by guest VMs.
 
 Miscellaneous Tips
@@ -307,7 +307,7 @@ Configuring Extension Drivers for the ML2 Plugin
 ------------------------------------------------
 
 Extension drivers for the ML2 plugin are set with the variable
-`Q_ML2_PLUGIN_EXT_DRIVERS`, and includes the 'port_security' extension
+``Q_ML2_PLUGIN_EXT_DRIVERS``, and includes the 'port_security' extension
 by default. If you want to remove all the extension drivers (even
-'port_security'), set `Q_ML2_PLUGIN_EXT_DRIVERS` to blank.
+'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 

From 85f42f698c7bd74d53309da486fbf44ed860c348 Mon Sep 17 00:00:00 2001
From: Thomas Morin <thomas.morin@orange.com>
Date: Tue, 1 Sep 2015 10:33:10 +0200
Subject: [PATCH 0975/3333] Provide an error message on bogus config file spec

If local.conf specifies a config file addition in the following way...

[[post-config|$MY_CONF_FILE]]
[xyz]
foo=bar

...and $MY_CONF_FILE points to a file whose directory is not writable by
the user running the script, then stack.sh aborts with the following
obscure message:

  2015-09-01 08:20:08.113 | touch: setting times of '/': Permission denied

This patch modifies inc/meta-config to provide a useful error message,
such as:

  2015-09-01 08:20:08.114 | could not create config file / ($MY_CONF_FILE)

This patch also modifies inc/meta-config so that it provides an error
message if $MY_CONF_FILE is empty (instead of silently ignoring this local.conf
statement):

  2015-09-01 09:38:53.406 | bogus config file specification: $MY_CONF_FILE
  is undefined

Change-Id: I9b78407420318548561012a8672762bc7fdd6db6
Closes-Bug: 1490881
---
 inc/meta-config           | 17 ++++++++++++---
 tests/test_meta_config.sh | 45 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index e5f902d1dd..b9ab6b207f 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -89,9 +89,10 @@ function merge_config_file {
     # note, configfile might be a variable (note the iniset, etc
     # created in the mega-awk below is "eval"ed too, so we just leave
     # it alone.
-    local real_configfile=$(eval echo $configfile)
+    local real_configfile
+    real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
-        touch $real_configfile
+        touch $real_configfile || die $LINENO "could not create config file $real_configfile ($configfile)"
     fi
 
     get_meta_section $file $matchgroup $configfile | \
@@ -177,8 +178,18 @@ function merge_config_group {
     local configfile group
     for group in $matchgroups; do
         for configfile in $(get_meta_section_files $localfile $group); do
-            if [[ -d $(dirname $(eval "echo $configfile")) ]]; then
+            local realconfigfile
+            local dir
+
+            realconfigfile=$(eval "echo $configfile")
+            if [[ -z $realconfigfile ]]; then
+                die $LINENO "bogus config file specification: $configfile is undefined"
+            fi
+            dir=$(dirname $realconfigfile)
+            if [[ -d $dir ]]; then
                 merge_config_file $localfile $group $configfile
+            else
+                die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir is not a directory)"
             fi
         done
     done
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index a04c081854..f3e94af8f8 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -23,6 +23,12 @@ function check_result {
     fi
 }
 
+# mock function-common:die so that it does not
+# interupt our test script
+function die {
+    exit -1
+}
+
 TEST_1C_ADD="[eee]
 type=new
 multi = foo2"
@@ -110,6 +116,15 @@ attr = strip_trailing_space
 [DEFAULT]
 servers=10.11.12.13:80
 
+[[test8|/permission-denied.conf]]
+foo=bar
+
+[[test9|\$UNDEF]]
+foo=bar
+
+[[test10|does-not-exist-dir/test.conf]]
+foo=bar
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -340,6 +355,36 @@ EXPECT_VAL="
 servers = 10.11.12.13:80"
 check_result "$VAL" "$EXPECT_VAL"
 
+echo "merge_config_file test8 non-touchable conf file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_file test.conf test8 /permission-denied.conf)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
+echo -n "merge_config_group test9 undefined conf file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test9)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
+echo -n "merge_config_group test10 not directory: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test10)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \

From dca49de22f57f3b2f502380b2cbfedb0dcdba209 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Tue, 20 Oct 2015 12:13:19 +0100
Subject: [PATCH 0976/3333] Use stevedore aliases for interface_driver
 configuration

interface_driver configuration was updated to use stevedore aliases.
This patch is to change devstack scripts to now use the aliases
instead of the previous class imports.

Closes-Bug: #1504536

Change-Id: Ic56bfcc1f9da05a999e6fd328e4dd6617e9470ff
---
 lib/neutron_plugins/bigswitch_floodlight | 4 ++--
 lib/neutron_plugins/brocade              | 2 +-
 lib/neutron_plugins/cisco                | 2 +-
 lib/neutron_plugins/linuxbridge_agent    | 2 +-
 lib/neutron_plugins/openvswitch_agent    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 4166131534..f52105e658 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -58,9 +58,9 @@ function neutron_plugin_configure_service {
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
     if [ "$BS_FL_VIF_DRIVER" = "ivs" ]; then
-        iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.IVSInterfaceDriver
+        iniset $conf_file DEFAULT interface_driver ivs
     else
-        iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
+        iniset $conf_file DEFAULT interface_driver openvswitch
     fi
 }
 
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 557b94dec0..953360e070 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -68,7 +68,7 @@ function neutron_plugin_configure_plugin_agent {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver linuxbridge
 }
 
 function has_neutron_plugin_security_group {
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index 90dcd574c0..7d0cf1af39 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -150,7 +150,7 @@ function neutron_plugin_create_initial_network_profile {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver openvswitch
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index bd4438db04..f28bcfeadd 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -85,7 +85,7 @@ function neutron_plugin_configure_plugin_agent {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver linuxbridge
 }
 
 function neutron_plugin_check_adv_test_requirements {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 48e47b3dab..5a843ffba7 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -110,7 +110,7 @@ function neutron_plugin_configure_plugin_agent {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver openvswitch
 }
 
 function neutron_plugin_check_adv_test_requirements {

From a91d455e23f68613db0e67fea339a13fd9eae7d4 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 20 Oct 2015 23:15:38 -0400
Subject: [PATCH 0977/3333] change `swift post` to openstackclient cli command

with the release of osc 1.8.0, modifying object store account
properties is now available. use this mechanism and avoid setting
environment variable that are only helpful for swift CLI.

Change-Id: Ie51e3e2bb86162763f23d0a6bed36208811f89fc
---
 lib/swift | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/swift b/lib/swift
index 3a8e80dd44..ee0238d975 100644
--- a/lib/swift
+++ b/lib/swift
@@ -813,11 +813,13 @@ function stop_swift {
 }
 
 function swift_configure_tempurls {
+    # note we are using swift credentials!
     OS_USERNAME=swift \
-        OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
-        OS_PASSWORD=$SERVICE_PASSWORD \
-        OS_AUTH_URL=$SERVICE_ENDPOINT \
-        swift post --auth-version 3 -m "Temp-URL-Key: $SWIFT_TEMPURL_KEY"
+    OS_PASSWORD=$SERVICE_PASSWORD \
+    OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
+    OS_AUTH_URL=$SERVICE_ENDPOINT \
+    openstack object store account \
+        set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
 
 # Restore xtrace

From 0c96c37b5d9775a5c0ad257f210112f76f7987e7 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Sun, 1 Nov 2015 21:45:29 -0500
Subject: [PATCH 0978/3333] Enable devstack for Ubuntu 15.10 Wily

Change-Id: I2056fd26d42f29ececc4c38fdd791589ec7037a0
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index bdbb025a0b..72253f81d7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -178,7 +178,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 33a96ffc2609d8477542002e56515a5026c2c48d Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 2 Nov 2015 17:23:39 -0500
Subject: [PATCH 0979/3333] Zookeeper for DLM scenarios

In Tokyo, there was a cross project session on distributed
key locking:
https://etherpad.openstack.org/p/mitaka-cross-project-dlm

In support of the discussion there, we'll need support for
a zookeeper service in Devstack and ability to use libraries
like Tooz for DLM functionality.

In this review, we pick up some configuration files from
monasca-api and copy the lib/template to implement the
zookeeper lifecycle. Those services that need zookeeper
need to add "zookeeper" in ENABLED_SERVICES.

Change-Id: Icef26e5cdaa930a581e27d330e47706776a7f98f
---
 files/debs/zookeeper             |  1 +
 files/rpms/zookeeper             |  1 +
 files/zookeeper/environment      | 36 +++++++++++++
 files/zookeeper/log4j.properties | 69 +++++++++++++++++++++++++
 files/zookeeper/myid             |  1 +
 files/zookeeper/zoo.cfg          | 74 +++++++++++++++++++++++++++
 lib/zookeeper                    | 86 ++++++++++++++++++++++++++++++++
 stack.sh                         | 15 ++++++
 stackrc                          |  2 +-
 unstack.sh                       |  5 ++
 10 files changed, 289 insertions(+), 1 deletion(-)
 create mode 100644 files/debs/zookeeper
 create mode 100644 files/rpms/zookeeper
 create mode 100644 files/zookeeper/environment
 create mode 100644 files/zookeeper/log4j.properties
 create mode 100644 files/zookeeper/myid
 create mode 100644 files/zookeeper/zoo.cfg
 create mode 100644 lib/zookeeper

diff --git a/files/debs/zookeeper b/files/debs/zookeeper
new file mode 100644
index 0000000000..66227f7e31
--- /dev/null
+++ b/files/debs/zookeeper
@@ -0,0 +1 @@
+zookeeperd
\ No newline at end of file
diff --git a/files/rpms/zookeeper b/files/rpms/zookeeper
new file mode 100644
index 0000000000..c0d1c3066d
--- /dev/null
+++ b/files/rpms/zookeeper
@@ -0,0 +1 @@
+zookeeper
\ No newline at end of file
diff --git a/files/zookeeper/environment b/files/zookeeper/environment
new file mode 100644
index 0000000000..afa2d2f89f
--- /dev/null
+++ b/files/zookeeper/environment
@@ -0,0 +1,36 @@
+#
+# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Modified from http://packages.ubuntu.com/saucy/zookeeperd
+NAME=zookeeper
+ZOOCFGDIR=/etc/zookeeper/conf
+
+# seems, that log4j requires the log4j.properties file to be in the classpath
+CLASSPATH="$ZOOCFGDIR:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar"
+
+ZOOCFG="$ZOOCFGDIR/zoo.cfg"
+ZOO_LOG_DIR=/var/log/zookeeper
+USER=$NAME
+GROUP=$NAME
+PIDDIR=/var/run/$NAME
+PIDFILE=$PIDDIR/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+JAVA=/usr/bin/java
+ZOOMAIN="org.apache.zookeeper.server.quorum.QuorumPeerMain"
+ZOO_LOG4J_PROP="INFO,ROLLINGFILE"
+JMXLOCALONLY=false
+JAVA_OPTS=""
diff --git a/files/zookeeper/log4j.properties b/files/zookeeper/log4j.properties
new file mode 100644
index 0000000000..6c45a4aad9
--- /dev/null
+++ b/files/zookeeper/log4j.properties
@@ -0,0 +1,69 @@
+#
+# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# From http://packages.ubuntu.com/saucy/zookeeperd
+
+# ZooKeeper Logging Configuration
+#
+
+# Format is "<default threshold> (, <appender>)+
+
+log4j.rootLogger=${zookeeper.root.logger}
+
+# Example: console appender only
+# log4j.rootLogger=INFO, CONSOLE
+
+# Example with rolling log file
+#log4j.rootLogger=DEBUG, CONSOLE, ROLLINGFILE
+
+# Example with rolling log file and tracing
+#log4j.rootLogger=TRACE, CONSOLE, ROLLINGFILE, TRACEFILE
+
+#
+# Log INFO level and above messages to the console
+#
+log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
+log4j.appender.CONSOLE.Threshold=INFO
+log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
+log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
+
+#
+# Add ROLLINGFILE to rootLogger to get log file output
+#    Log DEBUG level and above messages to a log file
+log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
+log4j.appender.ROLLINGFILE.Threshold=WARN
+log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/zookeeper.log
+
+# Max log file size of 10MB
+log4j.appender.ROLLINGFILE.MaxFileSize=10MB
+# uncomment the next line to limit number of backup files
+#log4j.appender.ROLLINGFILE.MaxBackupIndex=10
+
+log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
+log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
+
+
+#
+# Add TRACEFILE to rootLogger to get log file output
+#    Log DEBUG level and above messages to a log file
+log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
+log4j.appender.TRACEFILE.Threshold=TRACE
+log4j.appender.TRACEFILE.File=${zookeeper.log.dir}/zookeeper_trace.log
+
+log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
+### Notice we are including log4j's NDC here (%x)
+log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/files/zookeeper/myid b/files/zookeeper/myid
new file mode 100644
index 0000000000..c227083464
--- /dev/null
+++ b/files/zookeeper/myid
@@ -0,0 +1 @@
+0
\ No newline at end of file
diff --git a/files/zookeeper/zoo.cfg b/files/zookeeper/zoo.cfg
new file mode 100644
index 0000000000..b8f55827e3
--- /dev/null
+++ b/files/zookeeper/zoo.cfg
@@ -0,0 +1,74 @@
+#
+# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# http://hadoop.apache.org/zookeeper/docs/current/zookeeperAdmin.html
+
+# The number of milliseconds of each tick
+tickTime=2000
+# The number of ticks that the initial
+# synchronization phase can take
+initLimit=10
+# The number of ticks that can pass between
+# sending a request and getting an acknowledgement
+syncLimit=5
+# the directory where the snapshot is stored.
+dataDir=/var/lib/zookeeper
+# Place the dataLogDir to a separate physical disc for better performance
+# dataLogDir=/disk2/zookeeper
+
+# the port at which the clients will connect
+clientPort=2181
+
+# Maximum number of clients that can connect from one client
+maxClientCnxns=60
+
+# specify all zookeeper servers
+# The fist port is used by followers to connect to the leader
+# The second one is used for leader election
+
+server.0=127.0.0.1:2888:3888
+
+# To avoid seeks ZooKeeper allocates space in the transaction log file in
+# blocks of preAllocSize kilobytes. The default block size is 64M. One reason
+# for changing the size of the blocks is to reduce the block size if snapshots
+# are taken more often. (Also, see snapCount).
+#preAllocSize=65536
+
+# Clients can submit requests faster than ZooKeeper can process them,
+# especially if there are a lot of clients. To prevent ZooKeeper from running
+# out of memory due to queued requests, ZooKeeper will throttle clients so that
+# there is no more than globalOutstandingLimit outstanding requests in the
+# system. The default limit is 1,000.ZooKeeper logs transactions to a
+# transaction log. After snapCount transactions are written to a log file a
+# snapshot is started and a new transaction log file is started. The default
+# snapCount is 10,000.
+#snapCount=1000
+
+# If this option is defined, requests will be will logged to a trace file named
+# traceFile.year.month.day.
+#traceFile=
+
+# Leader accepts client connections. Default value is "yes". The leader machine
+# coordinates updates. For higher update throughput at thes slight expense of
+# read throughput the leader can be configured to not accept clients and focus
+# on coordination.
+#leaderServes=yes
+
+# Autopurge every hour to avoid using lots of disk in bursts
+# Order of the next 2 properties matters.
+# autopurge.snapRetainCount must be before autopurge.purgeInterval.
+autopurge.snapRetainCount=3
+autopurge.purgeInterval=1
\ No newline at end of file
diff --git a/lib/zookeeper b/lib/zookeeper
new file mode 100644
index 0000000000..e62ba8ada8
--- /dev/null
+++ b/lib/zookeeper
@@ -0,0 +1,86 @@
+#!/bin/bash
+#
+# lib/zookeeper
+# Functions to control the installation and configuration of **zookeeper**
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - is_zookeeper_enabled
+# - install_zookeeper
+# - configure_zookeeper
+# - init_zookeeper
+# - start_zookeeper
+# - stop_zookeeper
+# - cleanup_zookeeper
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# <define global variables here that belong to this project>
+
+# Set up default directories
+ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
+ZOOKEEPER_CONF_DIR=/etc/zookeeper
+
+
+# Entry Points
+# ------------
+
+# Test if any zookeeper service us enabled
+# is_zookeeper_enabled
+function is_zookeeper_enabled {
+    [[ ,${ENABLED_SERVICES}, =~ ,"zookeeper", ]] && return 0
+    return 1
+}
+
+# cleanup_zookeeper() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_zookeeper {
+    sudo rm -rf $ZOOKEEPER_DATA_DIR
+}
+
+# configure_zookeeper() - Set config files, create data dirs, etc
+function configure_zookeeper {
+    sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
+    sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
+}
+
+# init_zookeeper() - Initialize databases, etc.
+function init_zookeeper {
+    # clean up from previous (possibly aborted) runs
+    # create required data files
+    sudo rm -rf $ZOOKEEPER_DATA_DIR
+    sudo mkdir -p $ZOOKEEPER_DATA_DIR
+}
+
+# install_zookeeper() - Collect source and prepare
+function install_zookeeper {
+    install_package zookeeperd
+}
+
+# start_zookeeper() - Start running processes, including screen
+function start_zookeeper {
+    start_service zookeeper
+}
+
+# stop_zookeeper() - Stop running processes (non-screen)
+function stop_zookeeper {
+    stop_service zookeeper
+}
+
+# Restore xtrace
+$XTRACE
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/stack.sh b/stack.sh
index bdbb025a0b..118785150a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -539,6 +539,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/zookeeper
 
 # Extras Source
 # --------------
@@ -729,6 +730,11 @@ run_phase stack pre-install
 
 install_rpc_backend
 
+if is_service_enabled zookeeper; then
+    cleanup_zookeeper
+    configure_zookeeper
+    init_zookeeper
+fi
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
@@ -968,6 +974,15 @@ save_stackenv $LINENO
 start_dstat
 
 
+# Zookeeper
+# -----
+
+# zookeeper for use with tooz for Distributed Lock Management capabilities etc.,
+if is_service_enabled zookeeper; then
+    start_zookeeper
+fi
+
+
 # Keystone
 # --------
 
diff --git a/stackrc b/stackrc
index 819aa0125c..19538c0679 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat,zookeeper
 fi
 
 # SQLAlchemy supports multiple database drivers for each database server
diff --git a/unstack.sh b/unstack.sh
index 30447a7005..0cace3254a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -69,6 +69,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/zookeeper
 
 # Extras Source
 # --------------
@@ -172,6 +173,10 @@ if is_service_enabled dstat; then
     stop_dstat
 fi
 
+if is_service_enabled zookeeper; then
+    stop_zookeeper
+fi
+
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)
 if [[ -n "$SCREEN" ]]; then

From 9013bb0c24623ce8d064b561d4fd331e370762e1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 4 Nov 2015 12:31:39 -0500
Subject: [PATCH 0980/3333] remove wheel cache code

Thanks to lifeless, pip now implicitly has a wheel cache so that it
builds a wheel before every install, and uses that cache. All our
clever attempts at manually doing wheelhouse things is actually
bypassing the existing cache and making things take longer.

We should remove all of this code and just let pip do this thing,
which is does very well, and get out of the way.

Change-Id: Ia140dc34638d893b92f66d1ba20efd9522c5923b
---
 Makefile                    |  6 +--
 doc/source/index.rst        |  1 -
 files/venv-requirements.txt | 11 -----
 stack.sh                    |  6 ---
 stackrc                     |  5 ---
 tools/build_wheels.sh       | 86 -------------------------------------
 6 files changed, 1 insertion(+), 114 deletions(-)
 delete mode 100644 files/venv-requirements.txt
 delete mode 100755 tools/build_wheels.sh

diff --git a/Makefile b/Makefile
index a6bb230708..a94d60a0ef 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,6 @@
 
 # Duplicated from stackrc for now
 DEST=/opt/stack
-WHEELHOUSE=$(DEST)/.wheelhouse
 
 all:
 	echo "This just saved you from a terrible mistake!"
@@ -25,9 +24,6 @@ stack:
 unstack:
 	./unstack.sh
 
-wheels:
-	WHEELHOUSE=$(WHEELHOUSE) tools/build_wheels.sh
-
 docs:
 	tox -edocs
 
@@ -57,7 +53,7 @@ clean:
 
 # Clean out the cache too
 realclean: clean
-	rm -rf files/cirros*.tar.gz files/Fedora*.qcow2 $(WHEELHOUSE)
+	rm -rf files/cirros*.tar.gz files/Fedora*.qcow2
 
 # Repo stuffs
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 99e96b1d1a..b65730ffe8 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -206,7 +206,6 @@ Tools
 
 * `tools/build\_docs.sh <tools/build_docs.sh.html>`__
 * `tools/build\_venv.sh <tools/build_venv.sh.html>`__
-* `tools/build\_wheels.sh <tools/build_wheels.sh.html>`__
 * `tools/create-stack-user.sh <tools/create-stack-user.sh.html>`__
 * `tools/create\_userrc.sh <tools/create_userrc.sh.html>`__
 * `tools/fixup\_stuff.sh <tools/fixup_stuff.sh.html>`__
diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
deleted file mode 100644
index b9a55b423d..0000000000
--- a/files/venv-requirements.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-# Once we can prebuild wheels before a devstack run, uncomment the skipped libraries
-cryptography
-# lxml # still install from from packages
-# netifaces # still install from packages
-#numpy    # slowest wheel by far, stop building until we are actually using the output
-posix-ipc
-# psycopg # still install from packages
-pycrypto
-pyOpenSSL
-PyYAML
-xattr
diff --git a/stack.sh b/stack.sh
index bdbb025a0b..aedc5d4006 100755
--- a/stack.sh
+++ b/stack.sh
@@ -716,12 +716,6 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # Install required infra support libraries
 install_infra
 
-# Pre-build some problematic wheels
-if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
-    source $TOP_DIR/tools/build_wheels.sh
-fi
-
-
 # Extras Pre-install
 # ------------------
 # Phase: pre-install
diff --git a/stackrc b/stackrc
index 819aa0125c..d9f477e8ce 100644
--- a/stackrc
+++ b/stackrc
@@ -143,11 +143,6 @@ USE_VENV=$(trueorfalse False USE_VENV)
 # requirmenets files here, in a comma-separated list
 ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
 
-# Configure wheel cache location
-export WHEELHOUSE=${WHEELHOUSE:-$DEST/.wheelhouse}
-export PIP_WHEEL_DIR=${PIP_WHEEL_DIR:-$WHEELHOUSE}
-export PIP_FIND_LINKS=${PIP_FIND_LINKS:-file://$WHEELHOUSE}
-
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)
 DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
deleted file mode 100755
index 14c2999c8f..0000000000
--- a/tools/build_wheels.sh
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-#
-# **tools/build_wheels.sh** - Build a cache of Python wheels
-#
-# build_wheels.sh [package [...]]
-#
-# System package prerequisites listed in ``files/*/devlibs`` will be installed
-#
-# Builds wheels for all virtual env requirements listed in
-# ``venv-requirements.txt`` plus any supplied on the command line.
-#
-# Assumes:
-# - ``tools/install_pip.sh`` has been run and a suitable ``pip/setuptools`` is available.
-
-# If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
-# or in a sub-shell
-if [[ -z "$TOP_DIR" ]]; then
-
-    set -o errexit
-    set -o nounset
-
-    # Keep track of the DevStack directory
-    TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-    FILES=$TOP_DIR/files
-
-    # Import common functions
-    source $TOP_DIR/functions
-
-    GetDistro
-
-    source $TOP_DIR/stackrc
-
-    trap err_trap ERR
-
-fi
-
-# Get additional packages to build
-MORE_PACKAGES="$@"
-
-# Exit on any errors so that errors don't compound
-function err_trap {
-    local r=$?
-    set +o xtrace
-
-    rm -rf $TMP_VENV_PATH
-
-    exit $r
-}
-
-# Get system prereqs
-install_package $(get_packages devlibs)
-
-# Get a modern ``virtualenv``
-pip_install virtualenv
-
-# Prepare the workspace
-TMP_VENV_PATH=$(mktemp -d tmp-venv-XXXX)
-virtualenv $TMP_VENV_PATH
-
-# Install modern pip and wheel
-PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install -U pip wheel
-
-# BUG: cffi has a lot of issues. It has no stable ABI, if installed
-# code is built with a different ABI than the one that's detected at
-# load time, it tries to compile on the fly for the new ABI in the
-# install location (which will probably be /usr and not
-# writable). Also cffi is often included via setup_requires by
-# packages, which have different install rules (allowing betas) than
-# pip has.
-#
-# Because of this we must pip install cffi into the venv to build
-# wheels.
-PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install_gr cffi
-
-# ``VENV_PACKAGES`` is a list of packages we want to pre-install
-VENV_PACKAGE_FILE=$FILES/venv-requirements.txt
-if [[ -r $VENV_PACKAGE_FILE ]]; then
-    VENV_PACKAGES=$(grep -v '^#' $VENV_PACKAGE_FILE)
-fi
-
-for pkg in ${VENV_PACKAGES,/ } ${MORE_PACKAGES}; do
-    $TMP_VENV_PATH/bin/pip wheel $pkg
-done
-
-# Clean up wheel workspace
-rm -rf $TMP_VENV_PATH

From 9127c1a56bc1504ae77df25b0da7a6d0a5f0bfe8 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 5 Nov 2015 10:09:02 +0100
Subject: [PATCH 0981/3333] Do not remove python-pip package on Fedora-23

python on fedora 23 compiled with rewheel support,
in this case the python-pip is a required package, and cannot be
removed.

[1] http://pkgs.fedoraproject.org/cgit/python.git/tree/python.spec?id=3b6fac0339bab69ca5fbf2881568f0565ab0e252#n174

Change-Id: I499b7bec97c4360b32d156079f2b7f3923e3888a
---
 tools/install_pip.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 13c1786fb9..ab5efb2e77 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -110,7 +110,11 @@ get_versions
 # Do pip
 
 # Eradicate any and all system packages
-uninstall_package python-pip
+
+# python in f23 depends on the python-pip package
+if ! { is_fedora && [[ $DISTRO == "f23" ]]; }; then
+    uninstall_package python-pip
+fi
 
 install_get_pip
 

From e3c2673ae447d8b3cc4649f5efde5b84e26f6cd9 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 6 Nov 2015 13:23:47 +0900
Subject: [PATCH 0982/3333] Fix two typos on faq.rst

guarunteed => guaranteed
Centos     => CentOS

Change-Id: Id356443fcdc4128ff20d7a89158265aa16c105b2
---
 doc/source/faq.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 3562bfacee..7aca8d0b4a 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -54,7 +54,7 @@ combinations listed in ``README.md``. DevStack is only supported on
 releases other than those documented in ``README.md`` on a best-effort
 basis.
 
-Are there any differences between Ubuntu and Centos/Fedora support?
+Are there any differences between Ubuntu and CentOS/Fedora support?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Both should work well and are tested by DevStack CI.
@@ -146,7 +146,7 @@ your ``local.conf``
 
 
 Upstream DevStack is only tested with master and stable
-branches. Setting custom BRANCH definitions is not guarunteed to
+branches. Setting custom BRANCH definitions is not guaranteed to
 produce working results.
 
 What can I do about RabbitMQ not wanting to start on my fresh new VM?

From ec7f490a687ab01f520835341c09cef9f697f05d Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 6 Nov 2015 13:35:24 +0900
Subject: [PATCH 0983/3333] Remove 'enable_service tempest' from
 sample/local.conf

tempest is already defined in stackrc as default.
Without this definition in local.conf,
tempest is installed successfully.

If it still needs "enable_service tempest" definition
on local.conf,
devstack itself has some problem.
In my environment, tempest installation works
without this definition on local.conf.

Change-Id: I25cda0142538d21bb9656b471e65ca5b018e8378
---
 samples/local.conf | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/samples/local.conf b/samples/local.conf
index cb293b6c15..b92097dd8d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -93,9 +93,3 @@ SWIFT_REPLICAS=1
 # moved by setting ``SWIFT_DATA_DIR``. The directory will be created
 # if it does not exist.
 SWIFT_DATA_DIR=$DEST/data
-
-# Tempest
-# -------
-
-# Install the tempest test suite
-enable_service tempest

From e9ef0fefa52a2d30079eba1dead1a4df61a6ad7d Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 6 Nov 2015 14:25:46 +0900
Subject: [PATCH 0984/3333] Remove lib/neutron_plugins/ibm

SDN-VE on neutron is already removed.
This patch removes SDN-VE from devstack.

Ref.
  Removing the SDN-VE monolithic plugin
  https://review.openstack.org/#/c/217703/
  Remove IBM SDN-VE left-overs
  https://review.openstack.org/#/c/237716/

Change-Id: Ie1b531153d1632798235b1100cdf9b068edcce26
---
 lib/neutron_plugins/ibm | 133 ----------------------------------------
 1 file changed, 133 deletions(-)
 delete mode 100644 lib/neutron_plugins/ibm

diff --git a/lib/neutron_plugins/ibm b/lib/neutron_plugins/ibm
deleted file mode 100644
index dd5cfa6694..0000000000
--- a/lib/neutron_plugins/ibm
+++ /dev/null
@@ -1,133 +0,0 @@
-#!/bin/bash
-#
-# Neutron IBM SDN-VE plugin
-# ---------------------------
-
-# Save trace setting
-IBM_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-
-function neutron_plugin_install_agent_packages {
-    _neutron_ovs_base_install_agent_packages
-}
-
-function _neutron_interface_setup {
-    # Setup one interface on the integration bridge if needed
-    # The plugin agent to be used if more than one interface is used
-    local bridge=$1
-    local interface=$2
-    sudo ovs-vsctl --no-wait -- --may-exist add-port $bridge $interface
-}
-
-function neutron_setup_integration_bridge {
-    # Setup integration bridge if needed
-    if [[ "$SDNVE_INTEGRATION_BRIDGE" != "" ]]; then
-        neutron_ovs_base_cleanup
-        _neutron_ovs_base_setup_bridge $SDNVE_INTEGRATION_BRIDGE
-        if [[ "$SDNVE_INTERFACE_MAPPINGS" != "" ]]; then
-            interfaces=(${SDNVE_INTERFACE_MAPPINGS//[,:]/ })
-            _neutron_interface_setup $SDNVE_INTEGRATION_BRIDGE ${interfaces[1]}
-        fi
-    fi
-
-    # Set controller to SDNVE controller (1st of list) if exists
-    if [[ "$SDNVE_CONTROLLER_IPS" != "" ]]; then
-        # Get the first controller
-        controllers=(${SDNVE_CONTROLLER_IPS//[\[,\]]/ })
-        SDNVE_IP=${controllers[0]}
-        sudo ovs-vsctl set-controller $SDNVE_INTEGRATION_BRIDGE tcp:$SDNVE_IP
-    fi
-}
-
-function neutron_plugin_create_nova_conf {
-    # if n-cpu is enabled, then setup integration bridge
-    if is_service_enabled n-cpu; then
-        neutron_setup_integration_bridge
-    fi
-}
-
-function is_neutron_ovs_base_plugin {
-    if [[ "$SDNVE_INTEGRATION_BRIDGE" != "" ]]; then
-        # Yes, we use OVS.
-        return 0
-    else
-        # No, we do not use OVS.
-        return 1
-    fi
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/ibm
-    Q_PLUGIN_CONF_FILENAME=sdnve_neutron_plugin.ini
-    Q_PLUGIN_CLASS="neutron.plugins.ibm.sdnve_neutron_plugin.SdnvePluginV2"
-}
-
-function neutron_plugin_configure_service {
-    # Define extra "SDNVE" configuration options when q-svc is configured
-
-    iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-
-    if [[ "$SDNVE_CONTROLLER_IPS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve controller_ips $SDNVE_CONTROLLER_IPS
-    fi
-
-    if [[ "$SDNVE_INTEGRATION_BRIDGE" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve integration_bridge $SDNVE_INTEGRATION_BRIDGE
-    fi
-
-    if [[ "$SDNVE_RESET_BRIDGE" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve reset_bridge $SDNVE_RESET_BRIDGE
-    fi
-
-    if [[ "$SDNVE_OUT_OF_BAND" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve out_of_band $SDNVE_OUT_OF_BAND
-    fi
-
-    if [[ "$SDNVE_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve interface_mappings $SDNVE_INTERFACE_MAPPINGS
-    fi
-
-    if [[ "$SDNVE_FAKE_CONTROLLER" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve use_fake_controller $SDNVE_FAKE_CONTROLLER
-    fi
-
-
-    iniset $NEUTRON_CONF DEFAULT notification_driver neutron.openstack.common.notifier.no_op_notifier
-
-}
-
-function neutron_plugin_configure_plugin_agent {
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-ibm-agent"
-}
-
-function neutron_plugin_configure_debug_command {
-    :
-}
-
-function neutron_plugin_setup_interface_driver {
-    return 0
-}
-
-function has_neutron_plugin_security_group {
-    # Does not support Security Groups
-    return 1
-}
-
-function neutron_ovs_base_cleanup {
-    if [[ "$SDNVE_RESET_BRIDGE" != False ]]; then
-        # remove all OVS ports that look like Neutron created ports
-        for port in $(sudo ovs-vsctl list port | grep -o -e tap[0-9a-f\-]* -e q[rg]-[0-9a-f\-]*); do
-            sudo ovs-vsctl del-port ${port}
-        done
-
-        # remove integration bridge created by Neutron
-        for bridge in $(sudo ovs-vsctl list-br | grep -o -e ${SDNVE_INTEGRATION_BRIDGE}); do
-            sudo ovs-vsctl del-br ${bridge}
-        done
-    fi
-}
-
-# Restore xtrace
-$IBM_XTRACE

From 5f8133caac097235ed4fe73d878df0ee907eb51c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 6 Nov 2015 11:48:19 -0500
Subject: [PATCH 0985/3333] remove gratuitous python packages

With pip + upper-constraints we're nearly always over installing all
python packages because we no longer support a range, we support
*exactly* one version.

This removes a bunch of the gratuitous package installs which we're
going to install over, lxml, numpy, libvirt. All of these we had
coming from packages in the past for speed concerns, but upper
constraints removes that.

It also ensures that all the headers to build all those are in
general, so they are guarunteed available at all times.

Change-Id: Ia76de730d65c84d81c4fb2c980ae1b4d595f9f5b
---
 files/debs/general  | 4 +++-
 files/debs/keystone | 1 -
 files/debs/n-novnc  | 1 -
 files/debs/nova     | 7 ++-----
 4 files changed, 5 insertions(+), 8 deletions(-)
 delete mode 100644 files/debs/n-novnc

diff --git a/files/debs/general b/files/debs/general
index 146052643c..80e81f5841 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -20,8 +20,10 @@ python2.7
 python-gdbm # needed for testr
 bc
 libyaml-dev
-libffi-dev
+libffi-dev # for pyOpenSSL
 libssl-dev # for pyOpenSSL
+libxml2-dev  # lxml
+libxslt1-dev  # lxml
 gettext  # used for compiling message catalogs
 openjdk-7-jre-headless  # NOPRIME
 pkg-config
diff --git a/files/debs/keystone b/files/debs/keystone
index 70a56499e9..f5816b59de 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,4 +1,3 @@
-python-lxml
 sqlite3
 python-mysqldb
 python-mysql.connector
diff --git a/files/debs/n-novnc b/files/debs/n-novnc
deleted file mode 100644
index c8722b9f66..0000000000
--- a/files/debs/n-novnc
+++ /dev/null
@@ -1 +0,0 @@
-python-numpy
diff --git a/files/debs/nova b/files/debs/nova
index 346b8b337a..d1678a7a6f 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,7 +8,8 @@ libmysqlclient-dev
 mysql-server # NOPRIME
 python-mysqldb
 python-mysql.connector
-python-lxml # needed for glance which is needed for nova --- this shouldn't be here
+libxml2-dev # needed for building lxml
+libxslt1-dev
 gawk
 iptables
 ebtables
@@ -25,7 +26,3 @@ curl
 genisoimage # required for config_drive
 rabbitmq-server # NOPRIME
 socat # used by ajaxterm
-python-libvirt # NOPRIME
-python-libxml2
-python-numpy # used by websockify for spice console
-python-m2crypto

From 6cd616a9edf6561ebc802f3083eb24f2713d4e96 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 6 Nov 2015 10:26:14 -0800
Subject: [PATCH 0986/3333] Disable resize tests in Tempest if using cells with
 custom flavors

By default, devstack creates it's own test flavors for Tempest runs.

These are not in the cells API database since they are non-default
for nova so any resize tests in Tempest with cells and these custom
flavors fail.

Configure Tempest to not run resize tests if using cells and custom
flavors.

This allows us to also clean up a bunch of the resize skips found
in nova/devstack/tempest-dsvm-cells-rc.

Change-Id: I20f46024e45e32c60275703a193a56ae8cfe7eca
Closes-Bug: #1513925
---
 lib/tempest | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 32630dbf59..691ad86a2d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -377,6 +377,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
         # Cells doesn't support hot-plugging virtual interfaces.
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
+
+        if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
+            # Cells supports resize but does not currently work with devstack
+            # because of the custom flavors created for Tempest runs which are
+            # not in the cells database.
+            # TODO(mriedem): work on adding a nova-manage command to sync
+            # flavors into the cells database.
+            iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+        fi
     fi
 
     # Network

From 63cac536efa3474af40ea24603fca5e1d0a74e13 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Fri, 6 Nov 2015 12:37:32 -0800
Subject: [PATCH 0987/3333] Ironic: Explicitly allow DHCP ports

This adds an iptables rule to allow ports 67 and 68. We see
occassionally dropped DHCP packets, which may be causing PXE failures in
ironic jobs.

I'm not 100% confident this fixes the issue, however I don't think it
can break anything and it rules out one theory.

Change-Id: I4630afb6f010a4c2cb146a79264c480c64c6e4b7
Related-Bug: #1393099
---
 lib/ironic | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/ironic b/lib/ironic
index d786870165..016e639d03 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -672,6 +672,8 @@ function configure_iptables {
     # enable tftp natting for allowing connections to HOST_IP's tftp server
     sudo modprobe nf_conntrack_tftp
     sudo modprobe nf_nat_tftp
+    # explicitly allow DHCP - packets are occassionally being dropped here
+    sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
     sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true

From b8509f09d670460aa3e9e2b09cf60dbf8cdbb03b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 11:55:56 +1100
Subject: [PATCH 0988/3333] Really get the "general" packages

We are specifying the argument to get_packages incorrectly, so we are
not actually adding the packages in "general" to the list of packages.

In most cases, this is hidden as other more specific plugins/services
request their packages.  However, as
I2dafd32f211fcbc9fff53030d736d97a5f1bb2df shows, not always.  I think
this was uncovered by 5f8133caac097235ed4fe73d878df0ee907eb51c

Change-Id: Ie1b8d09369281059d21da61b2725a457f708ae9e
---
 tools/install_prereqs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index a07e58d3e6..38452cd90f 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -61,7 +61,7 @@ export_proxy_variables
 # ================
 
 # Install package requirements
-PACKAGES=$(get_packages general $ENABLED_SERVICES)
+PACKAGES=$(get_packages general,$ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"
 
 if is_ubuntu && echo $PACKAGES | grep -q dkms ; then

From a7e0b39a64f53f77f970c90d17f621be74f95215 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 12:02:51 +1100
Subject: [PATCH 0989/3333] Move devlib packages into "general"

The removal of the wheel caching code
(Ia140dc34638d893b92f66d1ba20efd9522c5923b) removed the install of the
"devlib" packages, which was being done with a call in
tools/build_wheels.sh

The idea of "devlibs" and "general" seems to be pretty much the same
thing -- global build requirements.  I have removed the unused devlibs
files, and moved any missing packages into the "general" package
install file.

Change-Id: I8f34a164d6785a122394b42387d4221a7b447ae1
---
 files/debs/devlibs      | 7 -------
 files/debs/general      | 2 ++
 files/rpms-suse/devlibs | 6 ------
 files/rpms-suse/general | 5 +++++
 files/rpms/devlibs      | 8 --------
 files/rpms/general      | 7 +++++--
 6 files changed, 12 insertions(+), 23 deletions(-)
 delete mode 100644 files/debs/devlibs
 delete mode 100644 files/rpms-suse/devlibs
 delete mode 100644 files/rpms/devlibs

diff --git a/files/debs/devlibs b/files/debs/devlibs
deleted file mode 100644
index 0446ceb6b6..0000000000
--- a/files/debs/devlibs
+++ /dev/null
@@ -1,7 +0,0 @@
-libffi-dev  # pyOpenSSL
-libmysqlclient-dev  # MySQL-python
-libpq-dev  # psycopg2
-libssl-dev  # pyOpenSSL
-libxml2-dev  # lxml
-libxslt1-dev  # lxml
-python-dev  # pyOpenSSL
diff --git a/files/debs/general b/files/debs/general
index 80e81f5841..7bc90a6864 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,3 +27,5 @@ libxslt1-dev  # lxml
 gettext  # used for compiling message catalogs
 openjdk-7-jre-headless  # NOPRIME
 pkg-config
+libmysqlclient-dev  # MySQL-python
+libpq-dev  # psycopg2
diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
deleted file mode 100644
index 54d13a33e9..0000000000
--- a/files/rpms-suse/devlibs
+++ /dev/null
@@ -1,6 +0,0 @@
-libffi-devel  # pyOpenSSL
-libopenssl-devel  # pyOpenSSL
-libxslt-devel  # lxml
-postgresql-devel  # psycopg2
-libmysqlclient-devel # MySQL-python
-python-devel  # pyOpenSSL
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 42756d8fcc..3a7c4b56fd 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -21,3 +21,8 @@ tcpdump
 unzip
 wget
 net-tools
+libffi-devel  # pyOpenSSL
+libxslt-devel  # lxml
+postgresql-devel  # psycopg2
+libmysqlclient-devel # MySQL-python
+python-devel  # pyOpenSSL
diff --git a/files/rpms/devlibs b/files/rpms/devlibs
deleted file mode 100644
index 385ed3b84c..0000000000
--- a/files/rpms/devlibs
+++ /dev/null
@@ -1,8 +0,0 @@
-libffi-devel  # pyOpenSSL
-libxml2-devel  # lxml
-libxslt-devel  # lxml
-mariadb-devel  # MySQL-python
-openssl-devel  # pyOpenSSL
-postgresql-devel  # psycopg2
-python-devel  # pyOpenSSL
-redhat-rpm-config # MySQL-python rhbz-1195207 f21
diff --git a/files/rpms/general b/files/rpms/general
index c3f3de893a..2a45227e0f 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -10,8 +10,8 @@ openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
 libffi-devel
-libxml2-devel
-libxslt-devel
+libxml2-devel # lxml
+libxslt-devel # lxml
 pkgconfig
 psmisc
 python-devel
@@ -29,3 +29,6 @@ java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 pyOpenSSL # version in pip uses too much memory
 iptables-services  # NOPRIME f21,f22
+mariadb-devel  # MySQL-python
+postgresql-devel  # psycopg2
+redhat-rpm-config # MySQL-python rhbz-1195207 f21

From a5e4c0f279b6101436820dbb6b3da3d06131c12d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 12:21:10 +1100
Subject: [PATCH 0990/3333] Clear out some duplicate package dependencies

I think these duplicate dependencies came in because we were not
correctly always installing "general" packages (see
Ie1b8d09369281059d21da61b2725a457f708ae9e)

Most of these are just extras for the lxml dependencies; I added zlib
devel to general for glance (seems pretty generic), and then that can
go too, as all other packages are specified.

Change-Id: I44b14ca15c64fad9daf1ac8d851704b02ea2eae0
---
 files/debs/ceilometer-collector | 3 ---
 files/debs/general              | 1 +
 files/debs/glance               | 6 ------
 files/debs/nova                 | 2 --
 files/debs/tempest              | 2 --
 files/debs/trove                | 1 -
 files/rpms/general              | 1 +
 files/rpms/glance               | 6 ------
 files/rpms/keystone             | 1 -
 files/rpms/tempest              | 1 -
 files/rpms/trove                | 1 -
 11 files changed, 2 insertions(+), 23 deletions(-)
 delete mode 100644 files/debs/glance
 delete mode 100644 files/debs/tempest
 delete mode 100644 files/debs/trove
 delete mode 100644 files/rpms/glance
 delete mode 100644 files/rpms/tempest
 delete mode 100644 files/rpms/trove

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
index f1b692ac71..94c82e0843 100644
--- a/files/debs/ceilometer-collector
+++ b/files/debs/ceilometer-collector
@@ -1,6 +1,3 @@
 python-pymongo #NOPRIME
 mongodb-server #NOPRIME
 libnspr4-dev
-pkg-config
-libxml2-dev
-libxslt-dev
\ No newline at end of file
diff --git a/files/debs/general b/files/debs/general
index 7bc90a6864..58d1e8b3f5 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -29,3 +29,4 @@ openjdk-7-jre-headless  # NOPRIME
 pkg-config
 libmysqlclient-dev  # MySQL-python
 libpq-dev  # psycopg2
+zlib1g-dev
diff --git a/files/debs/glance b/files/debs/glance
deleted file mode 100644
index 37877a85c2..0000000000
--- a/files/debs/glance
+++ /dev/null
@@ -1,6 +0,0 @@
-libmysqlclient-dev
-libpq-dev
-libssl-dev
-libxml2-dev
-libxslt1-dev
-zlib1g-dev
diff --git a/files/debs/nova b/files/debs/nova
index d1678a7a6f..fa394e734b 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,8 +8,6 @@ libmysqlclient-dev
 mysql-server # NOPRIME
 python-mysqldb
 python-mysql.connector
-libxml2-dev # needed for building lxml
-libxslt1-dev
 gawk
 iptables
 ebtables
diff --git a/files/debs/tempest b/files/debs/tempest
deleted file mode 100644
index bb095297e0..0000000000
--- a/files/debs/tempest
+++ /dev/null
@@ -1,2 +0,0 @@
-libxml2-dev
-libxslt1-dev
diff --git a/files/debs/trove b/files/debs/trove
deleted file mode 100644
index 96f8f29277..0000000000
--- a/files/debs/trove
+++ /dev/null
@@ -1 +0,0 @@
-libxslt1-dev
diff --git a/files/rpms/general b/files/rpms/general
index 2a45227e0f..eb479d2050 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -32,3 +32,4 @@ iptables-services  # NOPRIME f21,f22
 mariadb-devel  # MySQL-python
 postgresql-devel  # psycopg2
 redhat-rpm-config # MySQL-python rhbz-1195207 f21
+zlib-devel
diff --git a/files/rpms/glance b/files/rpms/glance
deleted file mode 100644
index 479194f918..0000000000
--- a/files/rpms/glance
+++ /dev/null
@@ -1,6 +0,0 @@
-libxml2-devel
-libxslt-devel
-mysql-devel
-openssl-devel
-postgresql-devel
-zlib-devel
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 8074119fdb..7384150a4a 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,4 +1,3 @@
 MySQL-python
-libxslt-devel
 sqlite
 mod_ssl
diff --git a/files/rpms/tempest b/files/rpms/tempest
deleted file mode 100644
index e7bbd43cd6..0000000000
--- a/files/rpms/tempest
+++ /dev/null
@@ -1 +0,0 @@
-libxslt-devel
diff --git a/files/rpms/trove b/files/rpms/trove
deleted file mode 100644
index e7bbd43cd6..0000000000
--- a/files/rpms/trove
+++ /dev/null
@@ -1 +0,0 @@
-libxslt-devel

From c00df207eed1d4dec808824d8e9dcd238e7d4e08 Mon Sep 17 00:00:00 2001
From: Sirushti Murugesan <sirushti.murugesan@hp.com>
Date: Wed, 7 Oct 2015 15:06:51 +0530
Subject: [PATCH 0991/3333] Add a more accurate expression for obtaining
 (IPV6_)ROUTER_GW_IP

neutron port-list returns a dictionary that's of random order in python 3.
This expression sometimes returns a NULL value thus failing devstack.
Add an expression that always returns a consistent ROUTER_GW_IP.

Change-Id: Id23d9afda275051ca68bcba2dfd1b6e30f02c628
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..a74da2ccb7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1318,7 +1318,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
+            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
         fi
@@ -1349,7 +1349,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
+        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then

From 7d515b5db8e98a54ff9c8c5211383f9f2c33b2db Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 15:04:32 +1100
Subject: [PATCH 0992/3333] Add check for get_packages argument

Add a quick check so we don't reintroduce bad arguments as in
Ie1b8d09369281059d21da61b2725a457f708ae9e

Change-Id: Ibebc71791f2743eef64d6f7c2596d54a73ea92aa
---
 functions-common | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/functions-common b/functions-common
index 497bed26e6..e252139e78 100644
--- a/functions-common
+++ b/functions-common
@@ -1075,6 +1075,10 @@ function get_packages {
     local file_to_parse=""
     local service=""
 
+    if [ $# -ne 1 ]; then
+        die $LINENO "get_packages takes a single, comma-separated argument"
+    fi
+
     if [[ -z "$package_dir" ]]; then
         echo "No package directory supplied"
         return 1

From c416d8b94f473908a82f4e842c768927b62fc20a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 15:20:22 +1100
Subject: [PATCH 0993/3333] Sort rpm/deb files alphabetically

This is rather trivial, but it makes comparing the files much easier

Change-Id: I01e42defbf778626afd8dd457f93f0b02dd1a19d
---
 files/debs/ceilometer-collector      |  4 +--
 files/debs/cinder                    |  6 ++---
 files/debs/general                   | 40 ++++++++++++++--------------
 files/debs/ironic                    |  2 +-
 files/debs/keystone                  |  8 +++---
 files/debs/ldap                      |  2 +-
 files/debs/n-cpu                     | 10 +++----
 files/debs/neutron                   | 14 +++++-----
 files/debs/nova                      | 34 +++++++++++------------
 files/debs/zookeeper                 |  2 +-
 files/rpms-suse/ceilometer-collector |  2 +-
 files/rpms-suse/ceph                 |  2 +-
 files/rpms-suse/cinder               |  8 +++---
 files/rpms-suse/general              | 12 ++++-----
 files/rpms-suse/horizon              |  2 +-
 files/rpms-suse/n-api                |  2 +-
 files/rpms-suse/n-cpu                |  6 ++---
 files/rpms-suse/neutron              |  2 +-
 files/rpms-suse/nova                 |  6 ++---
 files/rpms-suse/openvswitch          |  2 +-
 files/rpms/ceilometer-collector      |  4 +--
 files/rpms/ceph                      |  2 +-
 files/rpms/cinder                    |  6 ++---
 files/rpms/dstat                     |  2 +-
 files/rpms/general                   | 28 +++++++++----------
 files/rpms/horizon                   |  2 +-
 files/rpms/keystone                  |  2 +-
 files/rpms/ldap                      |  2 +-
 files/rpms/n-cpu                     |  8 +++---
 files/rpms/neutron                   |  4 +--
 files/rpms/nova                      |  8 +++---
 files/rpms/swift                     |  2 +-
 files/rpms/zookeeper                 |  2 +-
 33 files changed, 119 insertions(+), 119 deletions(-)

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
index 94c82e0843..d1e9eef3bb 100644
--- a/files/debs/ceilometer-collector
+++ b/files/debs/ceilometer-collector
@@ -1,3 +1,3 @@
-python-pymongo #NOPRIME
-mongodb-server #NOPRIME
 libnspr4-dev
+mongodb-server #NOPRIME
+python-pymongo #NOPRIME
diff --git a/files/debs/cinder b/files/debs/cinder
index 51908eb27b..48b8d0f7d3 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,6 +1,6 @@
-tgt # NOPRIME
-lvm2
-qemu-utils
 libpq-dev
+lvm2
 open-iscsi
 open-iscsi-utils # Deprecated since quantal dist:precise
+qemu-utils
+tgt # NOPRIME
diff --git a/files/debs/general b/files/debs/general
index 58d1e8b3f5..9b2715685e 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,32 +1,32 @@
+bc
 bridge-utils
-screen
-unzip
-wget
-psmisc
-gcc
+curl
 g++
+gcc
+gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
-lsof # useful when debugging
-openssh-server
-openssl
 iputils-ping
-wget
-curl
-tcpdump
-tar
-python-dev
-python2.7
-python-gdbm # needed for testr
-bc
-libyaml-dev
 libffi-dev # for pyOpenSSL
+libmysqlclient-dev  # MySQL-python
+libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libxml2-dev  # lxml
 libxslt1-dev  # lxml
-gettext  # used for compiling message catalogs
+libyaml-dev
+lsof # useful when debugging
 openjdk-7-jre-headless  # NOPRIME
+openssh-server
+openssl
 pkg-config
-libmysqlclient-dev  # MySQL-python
-libpq-dev  # psycopg2
+psmisc
+python2.7
+python-dev
+python-gdbm # needed for testr
+screen
+tar
+tcpdump
+unzip
+wget
+wget
 zlib1g-dev
diff --git a/files/debs/ironic b/files/debs/ironic
index 0a906dbffc..4d5a6aa6b7 100644
--- a/files/debs/ironic
+++ b/files/debs/ironic
@@ -6,8 +6,8 @@ libguestfs0
 libvirt-bin
 open-iscsi
 openssh-client
-openvswitch-switch
 openvswitch-datapath-dkms
+openvswitch-switch
 python-libguestfs
 python-libvirt
 qemu
diff --git a/files/debs/keystone b/files/debs/keystone
index f5816b59de..0795167047 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,6 +1,6 @@
-sqlite3
-python-mysqldb
-python-mysql.connector
+libkrb5-dev
 libldap2-dev
 libsasl2-dev
-libkrb5-dev
+python-mysql.connector
+python-mysqldb
+sqlite3
diff --git a/files/debs/ldap b/files/debs/ldap
index 26f7aeffe3..aa3a934d95 100644
--- a/files/debs/ldap
+++ b/files/debs/ldap
@@ -1,3 +1,3 @@
 ldap-utils
-slapd
 python-ldap
+slapd
diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index ffc947a36d..0da57ee047 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,8 +1,8 @@
-qemu-utils
+cryptsetup
+genisoimage
 lvm2 # NOPRIME
 open-iscsi
-genisoimage
-sysfsutils
-sg3-utils
 python-guestfs # NOPRIME
-cryptsetup
+qemu-utils
+sg3-utils
+sysfsutils
diff --git a/files/debs/neutron b/files/debs/neutron
index b5a457e482..85145d3654 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -1,18 +1,18 @@
 acl
+dnsmasq-base
+dnsmasq-utils # for dhcp_release only available in dist:precise
 ebtables
 iptables
-iputils-ping
 iputils-arping
+iputils-ping
 libmysqlclient-dev
 mysql-server #NOPRIME
-sudo
 postgresql-server-dev-all
-python-mysqldb
 python-mysql.connector
-dnsmasq-base
-dnsmasq-utils # for dhcp_release only available in dist:precise
+python-mysqldb
 rabbitmq-server # NOPRIME
-sqlite3
-vlan
 radvd # NOPRIME
+sqlite3
+sudo
 uuid-runtime
+vlan
diff --git a/files/debs/nova b/files/debs/nova
index fa394e734b..fe57fc4b2a 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -1,26 +1,26 @@
+conntrack
+curl
 dnsmasq-base
 dnsmasq-utils # for dhcp_release
-conntrack
-kpartx
-parted
-iputils-arping
-libmysqlclient-dev
-mysql-server # NOPRIME
-python-mysqldb
-python-mysql.connector
+ebtables
 gawk
+genisoimage # required for config_drive
 iptables
-ebtables
-sqlite3
-sudo
-qemu-kvm # NOPRIME
-qemu # dist:wheezy,jessie NOPRIME
+iputils-arping
+kpartx
+libjs-jquery-tablesorter # Needed for coverage html reports
+libmysqlclient-dev
 libvirt-bin # NOPRIME
 libvirt-dev # NOPRIME
+mysql-server # NOPRIME
+parted
 pm-utils
-libjs-jquery-tablesorter # Needed for coverage html reports
-vlan
-curl
-genisoimage # required for config_drive
+python-mysql.connector
+python-mysqldb
+qemu # dist:wheezy,jessie NOPRIME
+qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 socat # used by ajaxterm
+sqlite3
+sudo
+vlan
diff --git a/files/debs/zookeeper b/files/debs/zookeeper
index 66227f7e31..f41b559007 100644
--- a/files/debs/zookeeper
+++ b/files/debs/zookeeper
@@ -1 +1 @@
-zookeeperd
\ No newline at end of file
+zookeeperd
diff --git a/files/rpms-suse/ceilometer-collector b/files/rpms-suse/ceilometer-collector
index 5e4dfcc35e..fc75ffad63 100644
--- a/files/rpms-suse/ceilometer-collector
+++ b/files/rpms-suse/ceilometer-collector
@@ -1,3 +1,3 @@
-# Not available in openSUSE main repositories, but can be fetched from OBS
 # (devel:languages:python and server:database projects)
 mongodb
+# Not available in openSUSE main repositories, but can be fetched from OBS
diff --git a/files/rpms-suse/ceph b/files/rpms-suse/ceph
index 8d465000e1..8c4955df90 100644
--- a/files/rpms-suse/ceph
+++ b/files/rpms-suse/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-xfsprogs
 lsb
+xfsprogs
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 3fd03cc9be..56b1bb536a 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,6 +1,6 @@
 lvm2
-tgt # NOPRIME
-qemu-tools
-python-devel
-postgresql-devel
 open-iscsi
+postgresql-devel
+python-devel
+qemu-tools
+tgt # NOPRIME
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 3a7c4b56fd..651243d274 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -8,21 +8,21 @@ gcc-c++
 git-core
 graphviz # docs
 iputils
+libffi-devel  # pyOpenSSL
+libmysqlclient-devel # MySQL-python
 libopenssl-devel # to rebuild pyOpenSSL if needed
+libxslt-devel  # lxml
 lsof # useful when debugging
 make
+net-tools
 openssh
 openssl
+postgresql-devel  # psycopg2
 psmisc
 python-cmd2 # dist:opensuse-12.3
+python-devel  # pyOpenSSL
 screen
 tar
 tcpdump
 unzip
 wget
-net-tools
-libffi-devel  # pyOpenSSL
-libxslt-devel  # lxml
-postgresql-devel  # psycopg2
-libmysqlclient-devel # MySQL-python
-python-devel  # pyOpenSSL
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
index 77f7c34b31..753ea76e04 100644
--- a/files/rpms-suse/horizon
+++ b/files/rpms-suse/horizon
@@ -1,2 +1,2 @@
-apache2  # NOPRIME
 apache2-mod_wsgi  # NOPRIME
+apache2  # NOPRIME
diff --git a/files/rpms-suse/n-api b/files/rpms-suse/n-api
index 6f59e603b2..af5ac2fc54 100644
--- a/files/rpms-suse/n-api
+++ b/files/rpms-suse/n-api
@@ -1,2 +1,2 @@
-python-dateutil
 fping
+python-dateutil
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index b3a468d2d8..29bd31b365 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,7 +1,7 @@
-# Stuff for diablo volumes
+cryptsetup
 genisoimage
 lvm2
 open-iscsi
-sysfsutils
 sg3_utils
-cryptsetup
+# Stuff for diablo volumes
+sysfsutils
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 133979911e..4b0eefaaa5 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -7,7 +7,7 @@ iputils
 mariadb # NOPRIME
 postgresql-devel
 rabbitmq-server # NOPRIME
+radvd # NOPRIME
 sqlite3
 sudo
 vlan
-radvd # NOPRIME
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 039456fc1b..2f3ad21a63 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -1,7 +1,7 @@
+conntrack-tools
 curl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
-conntrack-tools
 ebtables
 gawk
 genisoimage # required for config_drive
@@ -9,14 +9,14 @@ iptables
 iputils
 kpartx
 kvm # NOPRIME
-# qemu as fallback if kvm cannot be used
-qemu # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
 mariadb # NOPRIME
 parted
 polkit
 python-devel
+# qemu as fallback if kvm cannot be used
+qemu # NOPRIME
 rabbitmq-server # NOPRIME
 socat
 sqlite3
diff --git a/files/rpms-suse/openvswitch b/files/rpms-suse/openvswitch
index edfb4d21aa..53f8bb22cf 100644
--- a/files/rpms-suse/openvswitch
+++ b/files/rpms-suse/openvswitch
@@ -1,3 +1,3 @@
+
 openvswitch
 openvswitch-switch
-
diff --git a/files/rpms/ceilometer-collector b/files/rpms/ceilometer-collector
index b139ed2b6b..a8b81187ed 100644
--- a/files/rpms/ceilometer-collector
+++ b/files/rpms/ceilometer-collector
@@ -1,3 +1,3 @@
-selinux-policy-targeted
-mongodb-server #NOPRIME
 mongodb # NOPRIME
+mongodb-server #NOPRIME
+selinux-policy-targeted
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 5483735741..64befc5f00 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-xfsprogs
 redhat-lsb-core
+xfsprogs
diff --git a/files/rpms/cinder b/files/rpms/cinder
index a88503b8bc..f28f04d8ba 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
+iscsi-initiator-utils
 lvm2
-scsi-target-utils # NOPRIME
-qemu-img
 postgresql-devel
-iscsi-initiator-utils
+qemu-img
+scsi-target-utils # NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index 8a8f8fe737..2b643b8b1b 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1 +1 @@
-dstat
\ No newline at end of file
+dstat
diff --git a/files/rpms/general b/files/rpms/general
index eb479d2050..cfd9479600 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,35 +1,35 @@
+bc
 bridge-utils
 curl
 dbus
 euca2ools # only for testing client
 gcc
 gcc-c++
+gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-openssh-server
-openssl
-openssl-devel # to rebuild pyOpenSSL if needed
+iptables-services  # NOPRIME f21,f22
+java-1.7.0-openjdk-headless  # NOPRIME rhel7
+java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 libffi-devel
 libxml2-devel # lxml
 libxslt-devel # lxml
+libyaml-devel
+mariadb-devel  # MySQL-python
+net-tools
+openssh-server
+openssl
+openssl-devel # to rebuild pyOpenSSL if needed
 pkgconfig
+postgresql-devel  # psycopg2
 psmisc
+pyOpenSSL # version in pip uses too much memory
 python-devel
+redhat-rpm-config # MySQL-python rhbz-1195207 f21
 screen
 tar
 tcpdump
 unzip
 wget
 which
-bc
-libyaml-devel
-gettext  # used for compiling message catalogs
-net-tools
-java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f21,f22
-pyOpenSSL # version in pip uses too much memory
-iptables-services  # NOPRIME f21,f22
-mariadb-devel  # MySQL-python
-postgresql-devel  # psycopg2
-redhat-rpm-config # MySQL-python rhbz-1195207 f21
 zlib-devel
diff --git a/files/rpms/horizon b/files/rpms/horizon
index b2cf0ded6f..aeb2cb5c96 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,5 +1,5 @@
 Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pyxattr
 pcre-devel  # pyScss
+pyxattr
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 7384150a4a..c01c261e19 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,3 +1,3 @@
+mod_ssl
 MySQL-python
 sqlite
-mod_ssl
diff --git a/files/rpms/ldap b/files/rpms/ldap
index d89c4cf8c1..d5b8fa4374 100644
--- a/files/rpms/ldap
+++ b/files/rpms/ldap
@@ -1,2 +1,2 @@
-openldap-servers
 openldap-clients
+openldap-servers
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 81278b30bb..7773b0402d 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,7 +1,7 @@
-# Stuff for diablo volumes
+cryptsetup
+genisoimage
 iscsi-initiator-utils
 lvm2
-genisoimage
-sysfsutils
 sg3_utils
-cryptsetup
+# Stuff for diablo volumes
+sysfsutils
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 29851bea9b..b3f79ed146 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -1,4 +1,3 @@
-MySQL-python
 acl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
@@ -7,10 +6,11 @@ iptables
 iputils
 mysql-connector-python
 mysql-devel
+MySQL-python
 mysql-server # NOPRIME
 openvswitch # NOPRIME
 postgresql-devel
 rabbitmq-server # NOPRIME
+radvd # NOPRIME
 sqlite
 sudo
-radvd # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 6eeb6230a9..e70f138a3c 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,8 +1,7 @@
-MySQL-python
+conntrack-tools
 curl
 dnsmasq # for nova-network
 dnsmasq-utils # for dhcp_release
-conntrack-tools
 ebtables
 gawk
 genisoimage # required for config_drive
@@ -10,18 +9,19 @@ iptables
 iputils
 kpartx
 kvm # NOPRIME
-qemu-kvm # NOPRIME
 libvirt-bin # NOPRIME
 libvirt-devel # NOPRIME
 libvirt-python # NOPRIME
 libxml2-python
-numpy # needed by websockify for spice console
 m2crypto
 mysql-connector-python
 mysql-devel
+MySQL-python
 mysql-server # NOPRIME
+numpy # needed by websockify for spice console
 parted
 polkit
+qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 sqlite
 sudo
diff --git a/files/rpms/swift b/files/rpms/swift
index 1bf57cc3a2..f56a81b0d1 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,7 +1,7 @@
 curl
 memcached
 pyxattr
+rsync-daemon # dist:f22,f23
 sqlite
 xfsprogs
 xinetd
-rsync-daemon # dist:f22,f23
diff --git a/files/rpms/zookeeper b/files/rpms/zookeeper
index c0d1c3066d..1bfac538a2 100644
--- a/files/rpms/zookeeper
+++ b/files/rpms/zookeeper
@@ -1 +1 @@
-zookeeper
\ No newline at end of file
+zookeeper

From 3dac869f80e90795efc2127b713cc5282f4eabb5 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 17:26:24 +1100
Subject: [PATCH 0994/3333] Cleanup some of the deb/rpm installs

python-devel and the mysql/postgresql client dev-libs should all be
installed globally via the "general" installs; no need to installs
them separately

Change-Id: I91a9ace2e62a891634dbb4635ab2ad8c8dc59f91
---
 files/debs/cinder        | 1 -
 files/rpms-suse/cinder   | 2 --
 files/rpms-suse/glance   | 1 -
 files/rpms-suse/keystone | 1 -
 files/rpms-suse/neutron  | 1 -
 files/rpms-suse/nova     | 1 -
 files/rpms-suse/swift    | 1 -
 files/rpms/cinder        | 1 -
 files/rpms/neutron       | 1 -
 9 files changed, 10 deletions(-)
 delete mode 100644 files/rpms-suse/glance

diff --git a/files/debs/cinder b/files/debs/cinder
index 48b8d0f7d3..3595e011da 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,4 +1,3 @@
-libpq-dev
 lvm2
 open-iscsi
 open-iscsi-utils # Deprecated since quantal dist:precise
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 56b1bb536a..189a232fa7 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,6 +1,4 @@
 lvm2
 open-iscsi
-postgresql-devel
-python-devel
 qemu-tools
 tgt # NOPRIME
diff --git a/files/rpms-suse/glance b/files/rpms-suse/glance
deleted file mode 100644
index bf512de575..0000000000
--- a/files/rpms-suse/glance
+++ /dev/null
@@ -1 +0,0 @@
-python-devel
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
index c838b413c3..46832c786d 100644
--- a/files/rpms-suse/keystone
+++ b/files/rpms-suse/keystone
@@ -1,4 +1,3 @@
 cyrus-sasl-devel
 openldap2-devel
-python-devel
 sqlite3
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 4b0eefaaa5..e9abc6eca6 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -5,7 +5,6 @@ ebtables
 iptables
 iputils
 mariadb # NOPRIME
-postgresql-devel
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 2f3ad21a63..ae115d2138 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -14,7 +14,6 @@ libvirt-python # NOPRIME
 mariadb # NOPRIME
 parted
 polkit
-python-devel
 # qemu as fallback if kvm cannot be used
 qemu # NOPRIME
 rabbitmq-server # NOPRIME
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
index 6a824f944f..52e0a990e7 100644
--- a/files/rpms-suse/swift
+++ b/files/rpms-suse/swift
@@ -1,6 +1,5 @@
 curl
 memcached
-python-devel
 sqlite3
 xfsprogs
 xinetd
diff --git a/files/rpms/cinder b/files/rpms/cinder
index f28f04d8ba..0274642fd6 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,4 @@
 iscsi-initiator-utils
 lvm2
-postgresql-devel
 qemu-img
 scsi-target-utils # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index b3f79ed146..9683475d29 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -9,7 +9,6 @@ mysql-devel
 MySQL-python
 mysql-server # NOPRIME
 openvswitch # NOPRIME
-postgresql-devel
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite

From 7ddf6741d24485aa40de122f4bfdf4cd55e7cfad Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 9 Nov 2015 08:08:53 -0500
Subject: [PATCH 0995/3333] Neutron-legacy: Remove LINUXNET_VIF_DRIVER option

A value is never assigned, and it ends up in the nova.conf file as:

linuxnet_interface_driver =

So, let's delete it.

Change-Id: Ibc270ce6ee622eee871df1f8c11f21e8be8280ee
---
 lib/neutron-legacy | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4e51425ffc..096869929b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -488,7 +488,6 @@ function create_nova_conf_neutron {
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf
 
-    iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
     if is_service_enabled q-meta; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
     fi

From 5c5e08669cb7539886cb3477fc7c4c7deb701f50 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 9 Nov 2015 14:08:15 -0500
Subject: [PATCH 0996/3333] loop all ebtables tables

ebtables has 3 built in tables, if we don't call them out we only get
'filter' (per man page).

Change-Id: I52360cbb3b910cb492b61e2314848cc29dcd8266
---
 tools/worlddump.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1b337a9a83..97e4d949c7 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -86,8 +86,10 @@ def disk_space():
 
 
 def ebtables_dump():
+    tables = ['filter', 'nat', 'broute']
     _header("EB Tables Dump")
-    _dump_cmd("sudo ebtables -L")
+    for table in tables:
+        _dump_cmd("sudo ebtables -t %s -L" % table)
 
 
 def iptables_dump():

From 8a3b7d424d8edf53d0560db48247e6bca11176ee Mon Sep 17 00:00:00 2001
From: John Davidge <jodavidg@cisco.com>
Date: Tue, 7 Jul 2015 11:10:54 +0100
Subject: [PATCH 0997/3333] Fix stack failure when default subnetpool is set

Currently stack.sh will fail if a value is set for
default_ipv4_subnet_pool and/or default_ipv6_subnet_pool in
neutron.conf. This is because setting either of these values
overrides the default behaviour of using the implicit (none)
subnetpool for subnet creation, and the subnetpools
specified in neutron.conf have not been created at the time
of the devstack calls to subnet-create.

This patch fixes the failure by specifying subnetpool = None
in calls to subnet-create, so that neutron will behave as
devstack expects. This parameter will no longer be required
once these configuration options are removed in the OpenStack
N release, but will be required for compatibility with Kilo,
Liberty, and Mitaka.

Change-Id: I29b2d62a022b43f6623b127af2ca303f9de847b0
Closes-Bug: #1472200
---
 exercises/neutron-adv-test.sh | 2 +-
 lib/neutron-legacy            | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a8fbd86473..9bcb7669b7 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -235,7 +235,7 @@ function create_network {
     local NET_ID
     NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
+    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..0e7ce26674 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -542,12 +542,12 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY --subnetpool None $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 --subnetpool_id None $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 
@@ -1236,6 +1236,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
     subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1252,6 +1253,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1265,6 +1267,7 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local id_and_ext_gw_ip
@@ -1278,6 +1281,7 @@ function _neutron_create_public_subnet_v6 {
     local subnet_params="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local ipv6_id_and_ext_gw_ip

From 04e73e17e8c536abb1ea86e7b0d037aef543da37 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 10 Nov 2015 18:58:11 +0100
Subject: [PATCH 0998/3333] On Ubuntu: don't start Zookeeper twice

On Ubuntu, if the Zookeeper service is already running, attempting
to start it again fails with non-zero exit code. This patch detects
whether ZK is already started before trying to start it.

Change-Id: If1257152de01fe5fe0351fdbb538bce083edbec0
Closes-Bug: #1513741
---
 lib/zookeeper | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/zookeeper b/lib/zookeeper
index e62ba8ada8..6637d52bca 100644
--- a/lib/zookeeper
+++ b/lib/zookeeper
@@ -69,7 +69,12 @@ function install_zookeeper {
 
 # start_zookeeper() - Start running processes, including screen
 function start_zookeeper {
-    start_service zookeeper
+    # Starting twice Zookeeper on Ubuntu exits with error code 1. See LP#1513741
+    # Match both systemd and sysvinit output
+    local running="(active \(running\)|start/running)"
+    if ! is_ubuntu || ! sudo /usr/sbin/service zookeeper status | egrep -q "$running"; then
+        start_service zookeeper
+    fi
 }
 
 # stop_zookeeper() - Stop running processes (non-screen)

From 536b8c1d2cf9d2523dc60f74190ef566a8c3fc4b Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Mon, 9 Nov 2015 10:05:37 +1100
Subject: [PATCH 0999/3333] Allow screen without logging to disk

In some niche setups it is desirable to run OpenStack services under
screen, but undesirable to automatically keep a persistent log from
each service.

Add a new variable SCREEN_IS_LOGGING that controls if screen logs each
window to disk automatically.

Ideally screen itself would be configured to log but just not activate.
This isn't possible with the screerc syntax.  Temporary logging can still
be used by a developer with:
    C-a : logfile foo
    C-a : log on

Change-Id: I2a3abf15dea95ae99ddbdfe1309382df601b7d93
---
 functions-common | 14 +++++++++-----
 stackrc          | 10 ++++++++++
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index ca0543da7d..ba3c79126d 100644
--- a/functions-common
+++ b/functions-common
@@ -1366,7 +1366,7 @@ function run_process {
 
 # Helper to launch a process in a named screen
 # Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
-# ``SERVICE_DIR``, ``USE_SCREEN``
+# ``SERVICE_DIR``, ``USE_SCREEN``, ``SCREEN_IS_LOGGING``
 # screen_process name "command-line" [group]
 # Run a command in a shell in a screen window, if an optional group
 # is provided, use sg to set the group of the command.
@@ -1386,8 +1386,12 @@ function screen_process {
     echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
     echo "log: $real_logfile"
     if [[ -n ${LOGDIR} ]]; then
-        screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
-        screen -S $SCREEN_NAME -p $name -X log on
+        if [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
+            screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
+            screen -S $SCREEN_NAME -p $name -X log on
+        fi
+        # If logging isn't active then avoid a broken symlink
+        touch "$real_logfile"
         ln -sf "$real_logfile" ${LOGDIR}/${name}.log
         if [[ -n ${SCREEN_LOGDIR} ]]; then
             # Drop the backward-compat symlink
@@ -1426,7 +1430,7 @@ function screen_process {
 }
 
 # Screen rc file builder
-# Uses globals ``SCREEN_NAME``, ``SCREENRC``
+# Uses globals ``SCREEN_NAME``, ``SCREENRC``, ``SCREEN_IS_LOGGING``
 # screen_rc service "command-line"
 function screen_rc {
     SCREEN_NAME=${SCREEN_NAME:-stack}
@@ -1446,7 +1450,7 @@ function screen_rc {
         echo "screen -t $1 bash" >> $SCREENRC
         echo "stuff \"$2$NL\"" >> $SCREENRC
 
-        if [[ -n ${LOGDIR} ]]; then
+        if [[ -n ${LOGDIR} ]] && [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
             echo "logfile ${LOGDIR}/${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
             echo "log on" >>$SCREENRC
         fi
diff --git a/stackrc b/stackrc
index 3033b27580..76a5756dde 100644
--- a/stackrc
+++ b/stackrc
@@ -103,6 +103,16 @@ HORIZON_APACHE_ROOT="/dashboard"
 # be disabled for automated testing by setting this value to False.
 USE_SCREEN=True
 
+# When using screen, should we keep a log file on disk?  You might
+# want this False if you have a long-running setup where verbose logs
+# can fill-up the host.
+# XXX: Ideally screen itself would be configured to log but just not
+# activate.  This isn't possible with the screerc syntax.  Temporary
+# logging can still be used by a developer with:
+#    C-a : logfile foo
+#    C-a : log on
+SCREEN_IS_LOGGING=$(trueorfalse True SCREEN_IS_LOGGING)
+
 # Passwords generated by interactive devstack runs
 if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password

From f6cee0fa2041a9188ad5e3e24e87ebd513729da8 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Fri, 6 Nov 2015 18:18:57 +0100
Subject: [PATCH 1000/3333] Install kernel-modules package on fedora

Since f21 the kernel modules are split to multiple packages
and by default just the core modules gets installed.

nova requires iscsi_tcp module for attaching a volume
from any iscsi source (default cinder lvm setup).

On el7 it is not required.

Change-Id: I31705720ade5defd1b6d4b95bc51c2a11a5f0364
Related-Bug: #1429504
---
 files/rpms/nova | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/nova b/files/rpms/nova
index e70f138a3c..00e759636e 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,6 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
+kernel-modules # dist:f21,f22,f23
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME

From 59e86a3aae3ca49ae3a400c1fcc49c53c9328fd2 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 9 Nov 2015 11:06:39 -0500
Subject: [PATCH 1001/3333] Replace default route for inet6

When taking the IPv6 addresses from an interface, also update any routing
table entries.

Change-Id: I0424de6c5c1b0fcb7a9bc3fc1475036668cab09d
Closes-Bug: 1514494
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..2c0c9cfb3b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -799,7 +799,7 @@ function _move_neutron_addresses_route {
         local IP_ADD=""
         local IP_DEL=""
         local DEFAULT_ROUTE_GW
-        DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
+        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
         if [[ $af == "inet" ]]; then
@@ -811,7 +811,7 @@ function _move_neutron_addresses_route {
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
-            ADD_DEFAULT_ROUTE="sudo ip r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
+            ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
 
         if [[ "$add_ovs_port" == "True" ]]; then

From 9af81997b543f7634c180b73a036c59456118b50 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 10 Nov 2015 13:30:20 -0500
Subject: [PATCH 1002/3333] Only take the first global, non temporary ipv6
 address

Taking a temporary IPv6 address created through the OS' support for
Privacy Extensions (RFC 4941) is not very useful. It would occur because
it happened to be the first in the list returned from ip(8). Instead,
grab the first IPv6 address that is not a temporary address.

Related-Bug: #1488691

Change-Id: I7f455572241e7d0c7406f173239a2270a4d8926a
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2c0c9cfb3b..eed477a550 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -807,7 +807,7 @@ function _move_neutron_addresses_route {
         fi
 
         if [[ $af == "inet6" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep inet6 | awk '{ print $2, $3, $4; exit }')
+            IP_BRD=$(ip -f $af a s dev $from_intf | grep 'scope global' | sed '/temporary/d' | awk '{ print $2, $3, $4; exit }')
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then

From 1650166c2594905ca16c02b58430f4f5bd9ed24c Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 12 Oct 2015 11:01:44 -0400
Subject: [PATCH 1003/3333] docs: Add more networking details to single
 interface section

Add complete localrcs, and also add a section for additional compute
nodes, to help demonstrate the OVS layout and how traffic flows over
VXLAN tunnels from compute nodes, to the L3 node, and out onto the
wire.

Closes-Bug: #1506733

Change-Id: Ibb5fd454bdcb8c13400c1e11f640c2aafc0f73ca
---
 doc/source/guides/neutron.rst | 172 +++++++++++++++++++++++++++++++++-
 1 file changed, 171 insertions(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 5891f68033..ee29087267 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -35,7 +35,7 @@ network and is on a shared subnet with other machines.
                 network hardware_network {
                         address = "172.18.161.0/24"
                         router [ address = "172.18.161.1" ];
-                        devstack_laptop [ address = "172.18.161.6" ];
+                        devstack-1 [ address = "172.18.161.6" ];
                 }
         }
 
@@ -43,9 +43,13 @@ network and is on a shared subnet with other machines.
 DevStack Configuration
 ----------------------
 
+The following is a complete `local.conf` for the host named
+`devstack-1`. It will run all the API and services, as well as
+serving as a hypervisor for guest instances.
 
 ::
 
+        [[local|localrc]]
         HOST_IP=172.18.161.6
         SERVICE_HOST=172.18.161.6
         MYSQL_HOST=172.18.161.6
@@ -57,6 +61,12 @@ DevStack Configuration
         SERVICE_PASSWORD=secrete
         SERVICE_TOKEN=secrete
 
+        # Do not use Nova-Network
+        disable_service n-net
+        # Enable Neutron
+        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
+
+
         ## Neutron options
         Q_USE_SECGROUP=True
         FLOATING_RANGE="172.18.161.0/24"
@@ -71,6 +81,166 @@ DevStack Configuration
         OVS_BRIDGE_MAPPINGS=public:br-ex
 
 
+Adding Additional Compute Nodes
+-------------------------------
+
+Let's suppose that after installing DevStack on the first host, you
+also want to do multinode testing and networking.
+
+Physical Network Setup
+~~~~~~~~~~~~~~~~~~~~~~
+
+.. nwdiag::
+
+        nwdiag {
+                inet [ shape = cloud ];
+                router;
+                inet -- router;
+
+                network hardware_network {
+                        address = "172.18.161.0/24"
+                        router [ address = "172.18.161.1" ];
+                        devstack-1 [ address = "172.18.161.6" ];
+                        devstack-2 [ address = "172.18.161.7" ];
+                }
+        }
+
+
+After DevStack installs and configures Neutron, traffic from guest VMs
+flows out of `devstack-2` (the compute node) and is encapsulated in a
+VXLAN tunnel back to `devstack-1` (the control node) where the L3
+agent is running.
+
+::
+
+    stack@devstack-2:~/devstack$ sudo ovs-vsctl show
+    8992d965-0ba0-42fd-90e9-20ecc528bc29
+        Bridge br-int
+            fail_mode: secure
+            Port br-int
+                Interface br-int
+                    type: internal
+            Port patch-tun
+                Interface patch-tun
+                    type: patch
+                    options: {peer=patch-int}
+        Bridge br-tun
+            fail_mode: secure
+            Port "vxlan-c0a801f6"
+                Interface "vxlan-c0a801f6"
+                    type: vxlan
+                    options: {df_default="true", in_key=flow, local_ip="172.18.161.7", out_key=flow, remote_ip="172.18.161.6"}
+            Port patch-int
+                Interface patch-int
+                    type: patch
+                    options: {peer=patch-tun}
+            Port br-tun
+                Interface br-tun
+                    type: internal
+        ovs_version: "2.0.2"
+
+Open vSwitch on the control node, where the L3 agent runs, is
+configured to de-encapsulate traffic from compute nodes, then forward
+it over the `br-ex` bridge, where `eth0` is attached.
+
+::
+
+    stack@devstack-1:~/devstack$ sudo ovs-vsctl show
+    422adeea-48d1-4a1f-98b1-8e7239077964
+        Bridge br-tun
+            fail_mode: secure
+            Port br-tun
+                Interface br-tun
+                    type: internal
+            Port patch-int
+                Interface patch-int
+                    type: patch
+                    options: {peer=patch-tun}
+            Port "vxlan-c0a801d8"
+                Interface "vxlan-c0a801d8"
+                    type: vxlan
+                    options: {df_default="true", in_key=flow, local_ip="172.18.161.6", out_key=flow, remote_ip="172.18.161.7"}
+        Bridge br-ex
+            Port phy-br-ex
+                Interface phy-br-ex
+                    type: patch
+                    options: {peer=int-br-ex}
+            Port "eth0"
+                Interface "eth0"
+            Port br-ex
+                Interface br-ex
+                    type: internal
+        Bridge br-int
+            fail_mode: secure
+            Port "tapce66332d-ea"
+                tag: 1
+                Interface "tapce66332d-ea"
+                    type: internal
+            Port "qg-65e5a4b9-15"
+                tag: 2
+                Interface "qg-65e5a4b9-15"
+                    type: internal
+            Port "qr-33e5e471-88"
+                tag: 1
+                Interface "qr-33e5e471-88"
+                    type: internal
+            Port "qr-acbe9951-70"
+                tag: 1
+                Interface "qr-acbe9951-70"
+                    type: internal
+            Port br-int
+                Interface br-int
+                    type: internal
+            Port patch-tun
+                Interface patch-tun
+                    type: patch
+                    options: {peer=patch-int}
+            Port int-br-ex
+                Interface int-br-ex
+                    type: patch
+                    options: {peer=phy-br-ex}
+        ovs_version: "2.0.2"
+
+`br-int` is a bridge that the Open vSwitch mechanism driver creates,
+which is used as the "integration bridge" where ports are created, and
+plugged into the virtual switching fabric. `br-ex` is an OVS bridge
+that is used to connect physical ports (like `eth0`), so that floating
+IP traffic for tenants can be received from the physical network
+infrastructure (and the internet), and routed to tenant network ports.
+`br-tun` is a tunnel bridge that is used to connect OpenStack nodes
+(like `devstack-2`) together. This bridge is used so that tenant
+network traffic, using the VXLAN tunneling protocol, flows between
+each compute node where tenant instances run.
+
+
+
+DevStack Compute Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The host `devstack-2` has a very minimal `local.conf`.
+
+::
+
+    [[local|localrc]]
+    HOST_IP=172.18.161.7
+    SERVICE_HOST=172.18.161.6
+    MYSQL_HOST=172.18.161.6
+    RABBIT_HOST=172.18.161.6
+    GLANCE_HOSTPORT=172.18.161.6:9292
+    ADMIN_PASSWORD=secrete
+    MYSQL_PASSWORD=secrete
+    RABBIT_PASSWORD=secrete
+    SERVICE_PASSWORD=secrete
+    SERVICE_TOKEN=secrete
+
+    ## Neutron options
+    PUBLIC_INTERFACE=eth0
+    ENABLED_SERVICES=n-cpu,rabbit,q-agt
+
+Network traffic from `eth0` on the compute nodes is then NAT'd by the
+controller node that runs Neutron's `neutron-l3-agent` and provides L3
+connectivity.
+
 
 Neutron Networking with Open vSwitch and Provider Networks
 ==========================================================

From 90dd262c19d7387ef6b438aea5e6eb13f3fd609d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 10 Nov 2015 12:22:03 -0500
Subject: [PATCH 1004/3333] fail if devstack attempts to be run under
 virtualenv

This has come up on the mailing list recently, we should just fail
early and explicitly so that people don't get way down this path and
not realize it's never going to work.

Change-Id: I8a7f001adf3a5244b8655858ebd5fc7014a4af55
---
 stack.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/stack.sh b/stack.sh
index 68b932e4b1..825ed968f3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -93,6 +93,20 @@ if [[ $EUID -eq 0 ]]; then
     exit 1
 fi
 
+# OpenStack is designed to run at a system level, with system level
+# installation of python packages. It does not support running under a
+# virtual env, and will fail in really odd ways if you do this. Make
+# this explicit as it has come up on the mailing list.
+if [[ -n "$VIRTUAL_ENV" ]]; then
+    echo "You appear to be running under a python virtualenv."
+    echo "DevStack does not support this, as we my break the"
+    echo "virtualenv you are currently in by modifying "
+    echo "external system-level components the virtualenv relies on."
+    echo "We reccommend you use a separate virtual-machine if "
+    echo "you are worried about DevStack taking over your system."
+    exit 1
+fi
+
 # Provide a safety switch for devstack. If you do a lot of devstack,
 # on a lot of different environments, you sometimes run it on the
 # wrong box. This makes there be a way to prevent that.

From 7e550682977b0c3a6a667af6691760d8a7506e9b Mon Sep 17 00:00:00 2001
From: Richard Theis <rtheis@us.ibm.com>
Date: Tue, 13 Oct 2015 07:51:05 -0500
Subject: [PATCH 1005/3333] doc: Update LBaaS v2 setup for Liberty

- Updated LBaaS v2 setup to use Octavia.
- Removed the old cirros image URL, the default should be sufficient.
- Fixed nova boot commands based on Liberty DevStack.
- Added sleeps to LBaaS v2 commands since most commands
  can take a few seconds to complete.
- Added wait to load balancer creation since it can take
  a few minutes to complete.
- Wrapped long lines in the descriptions.

Change-Id: Ib4a3f02ebc2606e3e16591ae3a23676cb0a6cd64
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 30 ++++++++++++++------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f67978310d..747a9384d0 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -1,13 +1,17 @@
-Configure Load-Balancer in Kilo
+Configure Load-Balancer Version 2
 =================================
 
-The Kilo release of OpenStack will support Version 2 of the neutron load balancer. Until now, using OpenStack `LBaaS V2 <http://docs.openstack.org/api/openstack-network/2.0/content/lbaas_ext.html>`_ has required a good understanding of neutron and LBaaS architecture and several manual steps.
+Starting in the OpenStack Liberty release, the
+`neutron LBaaS v2 API <http://developer.openstack.org/api-ref-networking-v2-ext.html>`_
+is now stable while the LBaaS v1 API has been deprecated.  The LBaaS v2 reference
+driver is based on Octavia.
 
 
 Phase 1: Create DevStack + 2 nova instances
 --------------------------------------------
 
-First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space, make sure it is updated. Install git and any other developer tools you find useful.
+First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space,
+make sure it is updated. Install git and any other developer tools you find useful.
 
 Install devstack
 
@@ -24,6 +28,7 @@ Edit your `local.conf` to look like
     [[local|localrc]]
     # Load the external LBaaS plugin.
     enable_plugin neutron-lbaas https://git.openstack.org/openstack/neutron-lbaas
+    enable_plugin octavia https://git.openstack.org/openstack/octavia
 
     # ===== BEGIN localrc =====
     DATABASE_PASSWORD=password
@@ -42,13 +47,13 @@ Edit your `local.conf` to look like
     ENABLED_SERVICES+=,horizon
     # Nova
     ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch
-    IMAGE_URLS+=",https://launchpad.net/cirros/trunk/0.3.0/+download/cirros-0.3.0-x86_64-disk.img"
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
     ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
-    # Enable LBaaS V2
+    # Enable LBaaS v2
     ENABLED_SERVICES+=,q-lbaasv2
+    ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api
     # Cinder
     ENABLED_SERVICES+=,c-api,c-vol,c-sch
     # Tempest
@@ -69,11 +74,11 @@ Create two nova instances that we can use as test http servers:
   ::
 
     #create nova instances on private network
-    nova boot --image $(nova image-list | awk '/ cirros-0.3.0-x86_64-disk / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
-    nova boot --image $(nova image-list | awk '/ cirros-0.3.0-x86_64-disk / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
     nova list # should show the nova instances just created
 
-    #add secgroup rule to allow ssh etc..
+    #add secgroup rules to allow ssh etc..
     neutron security-group-rule-create default --protocol icmp
     neutron security-group-rule-create default --protocol tcp --port-range-min 22 --port-range-max 22
     neutron security-group-rule-create default --protocol tcp --port-range-min 80 --port-range-max 80
@@ -91,9 +96,16 @@ Phase 2: Create your load balancers
  ::
 
     neutron lbaas-loadbalancer-create --name lb1 private-subnet
+    neutron lbaas-loadbalancer-show lb1  # Wait for the provisioning_status to be ACTIVE.
     neutron lbaas-listener-create --loadbalancer lb1 --protocol HTTP --protocol-port 80 --name listener1
+    sleep 10  # Sleep since LBaaS actions can take a few seconds depending on the environment.
     neutron lbaas-pool-create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    sleep 10
     neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.3 --protocol-port 80 pool1
+    sleep 10
     neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.5 --protocol-port 80 pool1
 
-Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes (in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is "curl that-lb-ip", which should alternate between showing the IPs of the two nodes.
+Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes
+(in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be
+reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is
+"curl that-lb-ip", which should alternate between showing the IPs of the two nodes.

From 2e8695b0756969d89cd4152e7496df9bf540eaa3 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Tue, 20 Oct 2015 11:21:57 +1100
Subject: [PATCH 1006/3333] Add development libraries needed by Pillow

Change I8da7dd95ae24cf06dc7bdc300fcf39947a6df093 added Pillow build deps
to nodepool thick slaves.  This means that Pillow 3 will work in unit
tests.

Make the matching change to allow Pillow 3.0.0 to work under devstack.

The longer term aim is to remove temporary upper cap.

Change-Id: I2bec8cf1bfeaaa6ae329704229fdeb86d26e55c7
---
 files/debs/general      | 1 +
 files/rpms-suse/general | 2 ++
 files/rpms/general      | 1 +
 3 files changed, 4 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 9b2715685e..1215147a16 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -8,6 +8,7 @@ git
 graphviz # needed for docs
 iputils-ping
 libffi-dev # for pyOpenSSL
+libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 651243d274..34a29554f7 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -9,6 +9,7 @@ git-core
 graphviz # docs
 iputils
 libffi-devel  # pyOpenSSL
+libjpeg8-devel # Pillow 3.0.0
 libmysqlclient-devel # MySQL-python
 libopenssl-devel # to rebuild pyOpenSSL if needed
 libxslt-devel  # lxml
@@ -26,3 +27,4 @@ tar
 tcpdump
 unzip
 wget
+zlib-devel
diff --git a/files/rpms/general b/files/rpms/general
index cfd9479600..40b06f489b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -12,6 +12,7 @@ iptables-services  # NOPRIME f21,f22
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 libffi-devel
+libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel

From 5cad4d3fe94f2e3823a8d9a2588b3a580d69605c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 10 Nov 2015 14:39:07 -0500
Subject: [PATCH 1007/3333] refactor zookeeper into a slightly more generic dlm
 module

This attempts to make the zookeeper installation a bit more modular
(assuming that other folks will want to add other dlms as plugins),
and addresses the service start issues with zookeeper under
ubuntu/upstart.

Zookeeper is not going to be installed by default. Services need to
ask for it with use_dlm.

Change-Id: I33525e2b83a4497a57ec95f62880e0308c88b34f
---
 lib/dlm       | 108 ++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/zookeeper |  91 ------------------------------------------
 stack.sh      |  20 +++-------
 stackrc       |   2 +-
 unstack.sh    |   2 +-
 5 files changed, 115 insertions(+), 108 deletions(-)
 create mode 100644 lib/dlm
 delete mode 100644 lib/zookeeper

diff --git a/lib/dlm b/lib/dlm
new file mode 100644
index 0000000000..f68ee26b4b
--- /dev/null
+++ b/lib/dlm
@@ -0,0 +1,108 @@
+#!/bin/bash
+#
+# lib/dlm
+#
+# Functions to control the installation and configuration of software
+# that provides a dlm (and possibly other functions). The default is
+# **zookeeper**, and is going to be the only backend supported in the
+# devstack tree.
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - is_dlm_enabled
+# - install_dlm
+# - configure_dlm
+# - cleanup_dlm
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# <define global variables here that belong to this project>
+
+# Set up default directories
+ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
+ZOOKEEPER_CONF_DIR=/etc/zookeeper
+
+
+# Entry Points
+# ------------
+#
+# NOTE(sdague): it is expected that when someone wants to implement
+# another one of these out of tree, they'll implement the following
+# functions:
+#
+# - dlm_backend
+# - install_dlm
+# - configure_dlm
+# - cleanup_dlm
+
+# This should be declared in the settings file of any plugin or
+# service that needs to have a dlm in their enviroment.
+function use_dlm {
+    enable_service $(dlm_backend)
+}
+
+# A function to return the name of the backend in question, some users
+# are going to need to know this.
+function dlm_backend {
+    echo "zookeeper"
+}
+
+# Test if a dlm is enabled (defaults to a zookeeper specific check)
+function is_dlm_enabled {
+    [[ ,${ENABLED_SERVICES}, =~ ,"$(dlm_backend)", ]] && return 0
+    return 1
+}
+
+# cleanup_dlm() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_dlm {
+    # NOTE(sdague): we don't check for is_enabled here because we
+    # should just delete this regardless. Some times users updated
+    # their service list before they run cleanup.
+    sudo rm -rf $ZOOKEEPER_DATA_DIR
+}
+
+# configure_dlm() - Set config files, create data dirs, etc
+function configure_dlm {
+    if is_dlm_enabled; then
+        sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
+        sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
+        # clean up from previous (possibly aborted) runs
+        # create required data files
+        sudo rm -rf $ZOOKEEPER_DATA_DIR
+        sudo mkdir -p $ZOOKEEPER_DATA_DIR
+        # restart after configuration, there is no reason to make this
+        # another step, because having data files that don't match the
+        # zookeeper running is just going to cause tears.
+        restart_service zookeeper
+    fi
+}
+
+# install_dlm() - Collect source and prepare
+function install_dlm {
+    if is_dlm_enabled; then
+        if is_ubuntu; then
+            install_package zookeeperd
+        else
+            die $LINENO "Don't know how to install zookeeper on this platform"
+        fi
+    fi
+}
+
+# Restore xtrace
+$XTRACE
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/zookeeper b/lib/zookeeper
deleted file mode 100644
index 6637d52bca..0000000000
--- a/lib/zookeeper
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/bin/bash
-#
-# lib/zookeeper
-# Functions to control the installation and configuration of **zookeeper**
-
-# Dependencies:
-#
-# - ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - is_zookeeper_enabled
-# - install_zookeeper
-# - configure_zookeeper
-# - init_zookeeper
-# - start_zookeeper
-# - stop_zookeeper
-# - cleanup_zookeeper
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# <define global variables here that belong to this project>
-
-# Set up default directories
-ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
-ZOOKEEPER_CONF_DIR=/etc/zookeeper
-
-
-# Entry Points
-# ------------
-
-# Test if any zookeeper service us enabled
-# is_zookeeper_enabled
-function is_zookeeper_enabled {
-    [[ ,${ENABLED_SERVICES}, =~ ,"zookeeper", ]] && return 0
-    return 1
-}
-
-# cleanup_zookeeper() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_zookeeper {
-    sudo rm -rf $ZOOKEEPER_DATA_DIR
-}
-
-# configure_zookeeper() - Set config files, create data dirs, etc
-function configure_zookeeper {
-    sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
-    sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
-}
-
-# init_zookeeper() - Initialize databases, etc.
-function init_zookeeper {
-    # clean up from previous (possibly aborted) runs
-    # create required data files
-    sudo rm -rf $ZOOKEEPER_DATA_DIR
-    sudo mkdir -p $ZOOKEEPER_DATA_DIR
-}
-
-# install_zookeeper() - Collect source and prepare
-function install_zookeeper {
-    install_package zookeeperd
-}
-
-# start_zookeeper() - Start running processes, including screen
-function start_zookeeper {
-    # Starting twice Zookeeper on Ubuntu exits with error code 1. See LP#1513741
-    # Match both systemd and sysvinit output
-    local running="(active \(running\)|start/running)"
-    if ! is_ubuntu || ! sudo /usr/sbin/service zookeeper status | egrep -q "$running"; then
-        start_service zookeeper
-    fi
-}
-
-# stop_zookeeper() - Stop running processes (non-screen)
-function stop_zookeeper {
-    stop_service zookeeper
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index 68b932e4b1..3cc21586d7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -539,7 +539,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
-source $TOP_DIR/lib/zookeeper
+source $TOP_DIR/lib/dlm
 
 # Extras Source
 # --------------
@@ -724,11 +724,10 @@ run_phase stack pre-install
 
 install_rpc_backend
 
-if is_service_enabled zookeeper; then
-    cleanup_zookeeper
-    configure_zookeeper
-    init_zookeeper
-fi
+# NOTE(sdague): dlm install is conditional on one being enabled by configuration
+install_dlm
+configure_dlm
+
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
@@ -968,15 +967,6 @@ save_stackenv $LINENO
 start_dstat
 
 
-# Zookeeper
-# -----
-
-# zookeeper for use with tooz for Distributed Lock Management capabilities etc.,
-if is_service_enabled zookeeper; then
-    start_zookeeper
-fi
-
-
 # Keystone
 # --------
 
diff --git a/stackrc b/stackrc
index 76a5756dde..f4a162b50c 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat,zookeeper
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
 fi
 
 # SQLAlchemy supports multiple database drivers for each database server
diff --git a/unstack.sh b/unstack.sh
index 0cace3254a..8eded837fd 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -69,7 +69,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
-source $TOP_DIR/lib/zookeeper
+source $TOP_DIR/lib/dlm
 
 # Extras Source
 # --------------

From 9329290183c96be45363325a244861065413562d Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Mon, 9 Nov 2015 15:45:04 +1100
Subject: [PATCH 1008/3333] Update comments to reflect current USE_SCREEN usage

In a couple of places the tracking of USE_SCREEN has drifted from the
comments.

Correct that.

Change-Id: I63bdd5ca4de49bf653f5bc8f8e0e5efe67ef605c
---
 functions-common | 10 ++++------
 stackrc          |  2 +-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/functions-common b/functions-common
index 5c97aee9a3..3eeab09889 100644
--- a/functions-common
+++ b/functions-common
@@ -1352,6 +1352,7 @@ function is_running {
 # If the command includes shell metachatacters (;<>*) it must be run using a shell
 # If an optional group is provided sg will be used to run the
 # command as that group.
+# Uses globals ``USE_SCREEN``
 # run_process service "command-line" [group]
 function run_process {
     local service=$1
@@ -1370,7 +1371,7 @@ function run_process {
 
 # Helper to launch a process in a named screen
 # Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
-# ``SERVICE_DIR``, ``USE_SCREEN``, ``SCREEN_IS_LOGGING``
+# ``SERVICE_DIR``, ``SCREEN_IS_LOGGING``
 # screen_process name "command-line" [group]
 # Run a command in a shell in a screen window, if an optional group
 # is provided, use sg to set the group of the command.
@@ -1381,7 +1382,6 @@ function screen_process {
 
     SCREEN_NAME=${SCREEN_NAME:-stack}
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     screen -S $SCREEN_NAME -X screen -t $name
 
@@ -1465,14 +1465,13 @@ function screen_rc {
 # If a PID is available use it, kill the whole process group via TERM
 # If screen is being used kill the screen window; this will catch processes
 # that did not leave a PID behind
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``, ``USE_SCREEN``
+# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
 # screen_stop_service service
 function screen_stop_service {
     local service=$1
 
     SCREEN_NAME=${SCREEN_NAME:-stack}
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     if is_service_enabled $service; then
         # Clean up the screen window
@@ -1490,7 +1489,6 @@ function stop_process {
     local service=$1
 
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     if is_service_enabled $service; then
         # Kill via pid if we have one available
@@ -1552,11 +1550,11 @@ function service_check {
 }
 
 # Tail a log file in a screen if USE_SCREEN is true.
+# Uses globals ``USE_SCREEN``
 function tail_log {
     local name=$1
     local logfile=$2
 
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
     if [[ "$USE_SCREEN" = "True" ]]; then
         screen_process "$name" "sudo tail -f $logfile"
     fi
diff --git a/stackrc b/stackrc
index 76a5756dde..4f459397a0 100644
--- a/stackrc
+++ b/stackrc
@@ -101,7 +101,7 @@ HORIZON_APACHE_ROOT="/dashboard"
 # ctrl-c, up-arrow, enter to restart the service. Starting services
 # this way is slightly unreliable, and a bit slower, so this can
 # be disabled for automated testing by setting this value to False.
-USE_SCREEN=True
+USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
 # When using screen, should we keep a log file on disk?  You might
 # want this False if you have a long-running setup where verbose logs

From 34a5aa5110c9651e2cf33d694d71b1e450495495 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Tue, 10 Nov 2015 15:23:30 +1100
Subject: [PATCH 1009/3333] Remove unused compat variable SCREEN_DEV

Currently we set USE_SCREEN to SCREEN_DEV if it's set.  There is a
comment to remove it once it's eracticated from CI.

AFAICT this pre-condition has been met.

Change-Id: I1423c8b9c18d1b3e34dbfe1c03be735c646a12b4
---
 stackrc | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/stackrc b/stackrc
index 4f459397a0..075236890b 100644
--- a/stackrc
+++ b/stackrc
@@ -651,9 +651,6 @@ S3_SERVICE_PORT=${S3_SERVICE_PORT:-3333}
 PRIVATE_NETWORK_NAME=${PRIVATE_NETWORK_NAME:-"private"}
 PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
-# Compatibility until it's eradicated from CI
-USE_SCREEN=${SCREEN_DEV:-$USE_SCREEN}
-
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}
 

From 201e3c133e28acb6dcdeb017389718db0775a748 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 27 Aug 2015 12:34:24 +0100
Subject: [PATCH 1010/3333] XenAPI:Fix problems to support xenserver+neutron

The lack of a CI for XenAPI + Neutron has meant this support has been
broken over time. This is set of one-off fixes that are needed to
reintroduce support while we work towards getting a CI functional

Related-Bug: #1495423
Change-Id: Id41fdc77c155756bda9e2e9ac0446a49f06f0603
---
 lib/neutron-legacy                    |  2 +-
 lib/neutron_plugins/openvswitch_agent | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..ac99678e66 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -639,7 +639,7 @@ function install_neutron {
         plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
 
         # install neutron plugins to dom0
-        tar -czf - -C $NEUTRON_DIR/neutron/plugins/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
+        tar -czf - -C $NEUTRON_DIR/neutron/plugins/ml2/drivers/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
             $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
     fi
 }
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 5a843ffba7..6a333939d0 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -71,6 +71,9 @@ function neutron_plugin_configure_plugin_agent {
         # Make a copy of our config for domU
         sudo cp /$Q_PLUGIN_CONF_FILE "/$Q_PLUGIN_CONF_FILE.domU"
 
+        # change domU's config file to STACK_USER
+        sudo chown $STACK_USER:$STACK_USER /$Q_PLUGIN_CONF_FILE.domU
+
         # Deal with Dom0's L2 Agent:
         Q_RR_DOM0_COMMAND="$NEUTRON_BIN_DIR/neutron-rootwrap-xen-dom0 $Q_RR_CONF_FILE"
 
@@ -82,7 +85,14 @@ function neutron_plugin_configure_plugin_agent {
         # Under XS/XCP, the ovs agent needs to target the dom0
         # integration bridge.  This is enabled by using a root wrapper
         # that executes commands on dom0 via a XenAPI plugin.
+        # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
         iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_DOM0_COMMAND"
+        iniset /$Q_PLUGIN_CONF_FILE agent root_helper_daemon ""
+
+        # Disable minimize polling, so that it can always detect OVS and Port changes
+        # This is a problem of xenserver + neutron, bug has been reported
+        # https://bugs.launchpad.net/neutron/+bug/1495423
+        iniset /$Q_PLUGIN_CONF_FILE agent minimize_polling False
 
         # Set "physical" mapping
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
@@ -95,10 +105,14 @@ function neutron_plugin_configure_plugin_agent {
         # Create a bridge "br-$GUEST_INTERFACE_DEFAULT"
         _neutron_ovs_base_add_bridge "br-$GUEST_INTERFACE_DEFAULT"
         # Add $GUEST_INTERFACE_DEFAULT to that bridge
-        sudo ovs-vsctl add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
+        sudo ovs-vsctl -- --may-exist add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
+
+        # Create external bridge and add port
+        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE_DEFAULT
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$GUEST_INTERFACE_DEFAULT"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$GUEST_INTERFACE_DEFAULT,physnet-ex:$PUBLIC_BRIDGE"
         # Set integration bridge to domU's
         iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $OVS_BRIDGE
         # Set root wrap

From c175040103b6a903c286a253f0df0ddc468feae3 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 12 Nov 2015 11:03:20 +0100
Subject: [PATCH 1011/3333] Fix typo in error message printed if ran under
 virtualenv

Commit title says it all. I don't know how you feel about these kind
of commits, I feel like it's a waste of resources but I also feel bad
when I see big/obvious typo.

Change-Id: If048bb2dbad1a0b5a13e56b5fa1e6ea7c01eb05e
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 825ed968f3..36bf2afd48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -99,10 +99,10 @@ fi
 # this explicit as it has come up on the mailing list.
 if [[ -n "$VIRTUAL_ENV" ]]; then
     echo "You appear to be running under a python virtualenv."
-    echo "DevStack does not support this, as we my break the"
+    echo "DevStack does not support this, as we may break the"
     echo "virtualenv you are currently in by modifying "
     echo "external system-level components the virtualenv relies on."
-    echo "We reccommend you use a separate virtual-machine if "
+    echo "We recommend you use a separate virtual-machine if "
     echo "you are worried about DevStack taking over your system."
     exit 1
 fi

From 33c9a67ead4b61a9eb423f71ca4f8e062c3b5ebd Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Thu, 12 Nov 2015 19:50:00 +0900
Subject: [PATCH 1012/3333] Fix typos on three comments and one message

Fixes typos on three comments and one message
in functions/functions-common

Change-Id: I2c926ca29b284afd4534b92860fa46f248676a83
---
 functions        | 2 +-
 functions-common | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index ca5955e974..34da1ba733 100644
--- a/functions
+++ b/functions
@@ -410,7 +410,7 @@ function get_instance_ip {
     ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
     if [[ $ip = "" ]];then
         echo "$nova_result"
-        die $LINENO "[Fail] Coudn't get ipaddress of VM"
+        die $LINENO "[Fail] Couldn't get ipaddress of VM"
     fi
     echo $ip
 }
diff --git a/functions-common b/functions-common
index 5c97aee9a3..98ecfb26ae 100644
--- a/functions-common
+++ b/functions-common
@@ -1036,7 +1036,7 @@ function _parse_package_files {
                 # We are using BASH regexp matching feature.
                 package=${BASH_REMATCH[1]}
                 distros=${BASH_REMATCH[2]}
-                # In bash ${VAR,,} will lowecase VAR
+                # In bash ${VAR,,} will lowercase VAR
                 # Look for a match in the distro list
                 if [[ ! ${distros,,} =~ ${DISTRO,,} ]]; then
                     # If no match then skip this package
@@ -1509,7 +1509,7 @@ function stop_process {
                 # this fixed in all services:
                 # https://bugs.launchpad.net/oslo-incubator/+bug/1446583
                 sleep 1
-                # /bin/true becakse pkill on a non existant process returns an error
+                # /bin/true because pkill on a non existent process returns an error
                 pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid) || /bin/true
             fi
             rm $SERVICE_DIR/$SCREEN_NAME/$service.pid
@@ -1717,7 +1717,7 @@ function plugin_override_defaults {
         if [[ -f $dir/devstack/override-defaults ]]; then
             # be really verbose that an override is happening, as it
             # may not be obvious if things fail later.
-            echo "$plugin has overriden the following defaults"
+            echo "$plugin has overridden the following defaults"
             cat $dir/devstack/override-defaults
             source $dir/devstack/override-defaults
         fi

From adcf40d5f8ec0509fe9230e04bf0bd3f269a3f53 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 5 Nov 2015 09:47:38 +0100
Subject: [PATCH 1013/3333] Ensure python is installed

devstack can call python before parsing the
package requirements, so the python installation
needs to be done eralier.

Closes-Bug: #1488625
Change-Id: I85cca899aeedd741cf7dc695435d61390e260f22
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 825ed968f3..afb695836b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -335,6 +335,10 @@ if [ -z "`grep ^127.0.0.1 /etc/hosts | grep $LOCAL_HOSTNAME`" ]; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 
+# Ensure python is installed
+# --------------------------
+is_package_installed python || install_package python
+
 
 # Configure Logging
 # -----------------

From 790266f0d2b752627a8ac641c8f1c9ba1e8e85e8 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 Nov 2015 13:36:35 -0500
Subject: [PATCH 1014/3333] Delete $IPV6_PUBLIC_NETWORK_GATEWAY IP during
 cleanup

So that it does not end up being the IP address that is picked to move
back to $PUBLIC_INTERFACE when we call _move_neutron_address_route

Change-Id: I3d29d4f11feff308f6ad5d950ef004b48ec11b67
Closes-Bug: 1514984
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index eed477a550..35029a2031 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -835,6 +835,10 @@ function cleanup_neutron {
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
 
         if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+            # ip(8) wants the prefix length when deleting
+            local v6_gateway
+            v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
+            sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
             _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
         fi
 

From fe7b56cdefa4d5cb99b868e5659128601edf3600 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 13 Nov 2015 17:06:16 +0900
Subject: [PATCH 1015/3333] Fix typos for stack.sh and lib of comments and
 message

Fix 10 comments and 1 message

stack.sh
  Certicate => Certificate (comment)
lib/stack
  Sentinal => Sentinel (comment)
lib/neutron-legacy
  overriden => overridden (comment)
  necesssary => necessary (comment)
  notifiy => notify (message)
  notifations => notifications (comment)
lib/rpc_backend
  orginal => original (comment)
  cofiguration => configuration (comment)
lib/stack
  confgured => configured (comment)
lib/swift
  additinal => additional (comment)
  calclution => calculation (comment)
  maximun => maximum (comment)

Change-Id: I3637388b67decb007cd49af9addecc654009559b
---
 lib/neutron-legacy | 6 +++---
 lib/rpc_backend    | 4 ++--
 lib/stack          | 2 +-
 lib/swift          | 6 +++---
 stack.sh           | 4 ++--
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..a38b1c1d7e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -256,7 +256,7 @@ ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
 
 # If using GRE tunnels for tenant networks, specify the range of
 # tunnel IDs from which tenant networks are allocated. Can be
-# overriden in ``localrc`` in necesssary.
+# overridden in ``localrc`` in necessary.
 TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
 
 # To use VLANs for tenant networks, set to True in localrc. VLANs
@@ -537,7 +537,7 @@ function create_neutron_initial_network {
 
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
-        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
+        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
         NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
@@ -1123,7 +1123,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
     _neutron_setup_keystone $NEUTRON_CONF keystone_authtoken
 
-    # Configuration for neutron notifations to nova.
+    # Configuration for neutron notifications to nova.
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 03eacd8674..298dcb6e5f 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -58,7 +58,7 @@ function restart_rpc_backend {
         # NOTE(bnemec): Retry initial rabbitmq configuration to deal with
         # the fact that sometimes it fails to start properly.
         # Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1144100
-        # NOTE(tonyb): Extend the orginal retry logic to only restart rabbitmq
+        # NOTE(tonyb): Extend the original retry logic to only restart rabbitmq
         # every second time around the loop.
         # See: https://bugs.launchpad.net/devstack/+bug/1449056 for details on
         # why this is needed.  This can bee seen on vivid and Debian unstable
@@ -106,7 +106,7 @@ function get_transport_url {
     fi
 }
 
-# iniset cofiguration
+# iniset configuration
 function iniset_rpc_backend {
     local package=$1
     local file=$2
diff --git a/lib/stack b/lib/stack
index 47e8ce2a22..7d98604b82 100644
--- a/lib/stack
+++ b/lib/stack
@@ -14,7 +14,7 @@
 # Functions
 # ---------
 
-# Generic service install handles venv creation if confgured for service
+# Generic service install handles venv creation if configured for service
 # stack_install_service service
 function stack_install_service {
     local service=$1
diff --git a/lib/swift b/lib/swift
index 3a8e80dd44..634d6ccb35 100644
--- a/lib/swift
+++ b/lib/swift
@@ -123,13 +123,13 @@ SWIFT_REPLICAS_SEQ=$(seq ${SWIFT_REPLICAS})
 # trace through the logs when looking for its use.
 SWIFT_LOG_TOKEN_LENGTH=${SWIFT_LOG_TOKEN_LENGTH:-12}
 
-# Set ``SWIFT_MAX_HEADER_SIZE`` to configure the maximun length of headers in
+# Set ``SWIFT_MAX_HEADER_SIZE`` to configure the maximum length of headers in
 # Swift API
 SWIFT_MAX_HEADER_SIZE=${SWIFT_MAX_HEADER_SIZE:-16384}
 
 # Set ``OBJECT_PORT_BASE``, ``CONTAINER_PORT_BASE``, ``ACCOUNT_PORT_BASE``
-# Port bases used in port number calclution for the service "nodes"
-# The specified port number will be used, the additinal ports calculated by
+# Port bases used in port number calculation for the service "nodes"
+# The specified port number will be used, the additional ports calculated by
 # base_port + node_num * 10
 OBJECT_PORT_BASE=${OBJECT_PORT_BASE:-6613}
 CONTAINER_PORT_BASE=${CONTAINER_PORT_BASE:-6611}
diff --git a/stack.sh b/stack.sh
index 25c49c5709..d3d3fb2f60 100755
--- a/stack.sh
+++ b/stack.sh
@@ -926,8 +926,8 @@ fi
 restart_rpc_backend
 
 
-# Export Certicate Authority Bundle
-# ---------------------------------
+# Export Certificate Authority Bundle
+# -----------------------------------
 
 # If certificates were used and written to the SSL bundle file then these
 # should be exported so clients can validate their connections.

From 65a028bf1c3685e16fafbc7c44adaeeeb6e9cf58 Mon Sep 17 00:00:00 2001
From: "Chung Chih, Hung" <lyan.h@inwinstack.com>
Date: Fri, 13 Nov 2015 11:10:48 +0000
Subject: [PATCH 1016/3333] [ceph] Deploy ceph failed at controller node for
 multiple node

Controller node wouldn't install libvirt package. The package will only
been installed at nodes which had enable nova-compute.
We only need to configure libvirt secret if it had enable nova-compute.

Change-Id: I9cd6baf1820ce9f71c276d7e8b670307833578a5
Closes-Bug: 1515960
---
 extras.d/60-ceph.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extras.d/60-ceph.sh b/extras.d/60-ceph.sh
index 38b901b767..cc90128176 100644
--- a/extras.d/60-ceph.sh
+++ b/extras.d/60-ceph.sh
@@ -32,7 +32,7 @@ if is_service_enabled ceph; then
             echo_summary "Configuring Cinder for Ceph"
             configure_ceph_cinder
         fi
-        if is_service_enabled cinder || is_service_enabled nova; then
+        if is_service_enabled n-cpu; then
             # NOTE (leseb): the part below is a requirement to attach Ceph block devices
             echo_summary "Configuring libvirt secret"
             import_libvirt_secret_ceph

From bbe59edb6f4a5828362c59a200f6ede00f97a4c3 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Wed, 21 Oct 2015 00:47:43 -0400
Subject: [PATCH 1017/3333] Use openstackclient in swift exercises

With the release of osc 1.8.0, swift support has been expanded and
we can now remove references to the swift CLI from this exercise
file. Also made minor improvements to comments.

Change-Id: I04069eb6251f8cbf8266183441b2cfdb64defd7d
---
 exercises/swift.sh | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/exercises/swift.sh b/exercises/swift.sh
index afcede81cd..4a41e0f1ed 100755
--- a/exercises/swift.sh
+++ b/exercises/swift.sh
@@ -2,7 +2,7 @@
 
 # **swift.sh**
 
-# Test swift via the ``swift`` command line from ``python-swiftclient``
+# Test swift via the ``python-openstackclient`` command line
 
 echo "*********************************************************************"
 echo "Begin DevStack Exercise: $0"
@@ -39,26 +39,29 @@ is_service_enabled s-proxy || exit 55
 
 # Container name
 CONTAINER=ex-swift
+OBJECT=/etc/issue
 
 
 # Testing Swift
 # =============
 
 # Check if we have to swift via keystone
-swift stat || die $LINENO "Failure getting status"
+openstack object store account show || die $LINENO "Failure getting account status"
 
 # We start by creating a test container
 openstack container create $CONTAINER || die $LINENO "Failure creating container $CONTAINER"
 
-# add some files into it.
-openstack object create $CONTAINER /etc/issue || die $LINENO "Failure uploading file to container $CONTAINER"
+# add a file into it.
+openstack object create $CONTAINER $OBJECT || die $LINENO "Failure uploading file to container $CONTAINER"
 
-# list them
+# list the objects
 openstack object list $CONTAINER || die $LINENO "Failure listing contents of container $CONTAINER"
 
-# And we may want to delete them now that we have tested that
-# everything works.
-swift delete $CONTAINER || die $LINENO "Failure deleting container $CONTAINER"
+# delete the object first
+openstack object delete $CONTAINER $OBJECT || die $LINENO "Failure deleting object $OBJECT in container $CONTAINER"
+
+# delete the container
+openstack container delete $CONTAINER || die $LINENO "Failure deleting container $CONTAINER"
 
 set +o xtrace
 echo "*********************************************************************"

From 01cf55a69259a52a9e5e8614347f238826c6a7ca Mon Sep 17 00:00:00 2001
From: yangyapeng <yang.yapeng@99cloud.net>
Date: Thu, 29 Oct 2015 13:21:29 -0400
Subject: [PATCH 1018/3333] Fix RST in configuration.rst

Fix minor RST issue from before file was converted.

Change-Id: Ie16ceace9c17e98010e068641ce60ba9a365ede0
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e9921f049c..22841f6c13 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -211,7 +211,7 @@ Enabling Syslog
 Logging all services to a single syslog can be convenient. Enable
 syslogging by setting ``SYSLOG`` to ``True``. If the destination log
 host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be used
-to direct the message stream to the log host.  |
+to direct the message stream to the log host.
 
     ::
 

From ca7e4f285cfb68bae13e8df770dc2b5856559ecd Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 13 Nov 2015 11:15:15 +1100
Subject: [PATCH 1019/3333] Fix error detection & exit in report_results

We wish to fail if we have >0 zero errors, not >1 errors (i.e. exactly
one error did not trigger a failure!)

This change also brings consistency to the pass & failure paths by
ensuring report_results exits in both cases, since report_results is
supposed to be the last thing run in a test file.

Change-Id: Id4721dffe13721e6c3cd71bca40c3395627e98bf
---
 tests/unittest.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/unittest.sh b/tests/unittest.sh
index df7a8b4534..2570319fbf 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -92,16 +92,17 @@ function assert_empty {
     fi
 }
 
-# print a summary of passing and failing tests, exiting
-# with an error if we have failed tests
+# Print a summary of passing and failing tests and exit
+# (with an error if we have failed tests)
 #  usage: report_results
 function report_results {
     echo "$PASS Tests PASSED"
-    if [[ $ERROR -gt 1 ]]; then
+    if [[ $ERROR -gt 0 ]]; then
         echo
         echo "The following $ERROR tests FAILED"
         echo -e "$FAILED_FUNCS"
         echo "---"
         exit 1
     fi
+    exit 0
 }

From ecf06dbadb7c4cafb7a2fab13e58c1b05dd8a3f2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 17:42:23 +1100
Subject: [PATCH 1020/3333] Add test for package file ordering

Add a simple test to ensure package install files remain sorted
alphabetically (follow-on from the sorting of the files done in
I01e42defbf778626afd8dd457f93f0b02dd1a19d)

Change-Id: I75568871e92afcd81dac2c3ce18b84aa34cdd289
---
 tests/test_package_ordering.sh | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100755 tests/test_package_ordering.sh

diff --git a/tests/test_package_ordering.sh b/tests/test_package_ordering.sh
new file mode 100755
index 0000000000..a568abf928
--- /dev/null
+++ b/tests/test_package_ordering.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# basic test to ensure that package-install files remain sorted
+# alphabetically.
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+source $TOP/tests/unittest.sh
+
+PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms $TOP/files/rpms-suse -type f)
+
+TMPDIR=$(mktemp -d)
+
+SORTED=${TMPDIR}/sorted
+UNSORTED=${TMPDIR}/unsorted
+
+for p in $PKG_FILES; do
+    grep -v '^#' $p > ${UNSORTED}
+    sort ${UNSORTED} > ${SORTED}
+
+    if [ -n "$(diff -c ${UNSORTED} ${SORTED})" ]; then
+        failed "$p is unsorted"
+        # output this, it's helpful to see what exactly is unsorted
+        diff -c ${UNSORTED} ${SORTED}
+    else
+        passed "$p is sorted"
+    fi
+done
+
+rm -rf ${TMPDIR}
+
+report_results

From 199d857442108326959d391c337e3b02b98a1b1e Mon Sep 17 00:00:00 2001
From: Johan Pas <j20012@outlook.com>
Date: Tue, 17 Nov 2015 00:56:25 +0100
Subject: [PATCH 1021/3333] Remove brackets from IPv6 address in mysql cfgfile

stack.sh creates a user-specific configuration file ~/.my.cnf for mysql.
If devstack is installed with SERVICE_IP_VERSION=6 option in local.conf,
the IPv6 host address was stored in the ~/.my.cnf file with square
brackets. However mysql does not use bracketing for IPv6 addresses,
resulting in 'Unknown MySQL server host' error when 'mysql' command is
run. With this patch IPv6 host address is written to ~/.my.cnf without
brackets.

Closes-Bug: #1516776
Change-Id: I27a7be8c75cf6b09b4a75dc4c9d09cd36bc5ac81
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index c2ab32e5b2..cc74b33327 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -143,7 +143,7 @@ MYSQL_PRESEED
 [client]
 user=$DATABASE_USER
 password=$DATABASE_PASSWORD
-host=$DATABASE_HOST
+host=$MYSQL_HOST
 EOF
         chmod 0600 $HOME/.my.cnf
     fi

From 95a9ff0587adece32817b4f432588b1ab76a5972 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Nov 2015 14:49:20 +1100
Subject: [PATCH 1022/3333] Add option to skip EPEL & other repo installs

Add an option to skip the EPEL & other repo installs for rhel7 based
platforms.

This option can serve two purposes; firstly as described in
I834f20e9ceae151788cec3649385da1274d7ba46 during platform bringup, a
publically available EPEL might not be available.  This will allow you
to pre-configure a hand-built repo, etc. so you can continue testing.

The other thing is that in a CI system you might be frequently
building images and pre-installing EPEL/RDO etc.  In that case this is
just extra work.

Change-Id: I9809449f4a43fa9b547c6e3ca92722c7f6e66d6a
---
 stack.sh | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 9b811b7b67..e31cd604c5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -263,9 +263,7 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-if is_fedora && [[ $DISTRO == "rhel7" ]]; then
-    # RHEL requires EPEL for many Open Stack dependencies
-
+function _install_epel_and_rdo {
     # NOTE: We always remove and install latest -- some environments
     # use snapshot images, and if EPEL version updates they break
     # unless we update them to latest version.
@@ -295,18 +293,27 @@ EOF
     sudo yum-config-manager --enable epel-bootstrap
     yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
-    # EPEL rpm has installed it's version
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
 
     # ... and also optional to be enabled
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
+    # install the lastest RDO
     sudo yum install -y https://rdoproject.org/repos/rdo-release.rpm
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
     fi
+}
+
+# If you have all the repos installed above already setup (e.g. a CI
+# situation where they are on your image) you may choose to skip this
+# to speed things up
+SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
+if is_fedora && [[ $DISTRO == "rhel7" ]] && \
+        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
+    _install_epel_and_rdo
 fi
 
 

From cdba7b0e533b07d9ea896ced5085c5ce98ee2aaa Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 26 May 2015 15:33:45 -0400
Subject: [PATCH 1023/3333] Specify HTTPS URLs to fix tls-proxy mode

A number of new settings are required for glance, cinder
and keystone to be installable when the tls-proxy
service is enabled.

For cinder a new public_endpoint option was added and this
needs to be set to the secure port.

Keystone needs the admin_endpoint and public_endpoints
defined otherwise during discovery the default,
non-secure versions, will be returned.

The keystone authtoken identity_uri was set at its default value
in the glance registry and API configuration files.

Change-Id: Ibb944ad7eb000edc6bccfcded765d1976d4d46d0
Closes-Bug: #1460807
---
 lib/cinder   | 2 ++
 lib/glance   | 3 +++
 lib/keystone | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 1307c11f7a..cc203ad414 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -309,6 +309,8 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+
+        iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
     fi
 
     if [ "$SYSLOG" != "False" ]; then
diff --git a/lib/glance b/lib/glance
index 2eb93a46e6..5712943bca 100644
--- a/lib/glance
+++ b/lib/glance
@@ -167,6 +167,9 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
+
+        iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+        iniset $GLANCE_REGISTRY_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
     fi
 
     # Register SSL certificates if provided
diff --git a/lib/keystone b/lib/keystone
index 5a2afbfe02..c484795c7e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -233,6 +233,9 @@ function configure_keystone {
         # Set the service ports for a proxy to take the originals
         iniset $KEYSTONE_CONF eventlet_server public_port $KEYSTONE_SERVICE_PORT_INT
         iniset $KEYSTONE_CONF eventlet_server admin_port $KEYSTONE_AUTH_PORT_INT
+
+        iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
+        iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
     fi
 
     iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"

From bd4048a3c50e3cd215785e187e9e40b78bd064ae Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Wed, 18 Nov 2015 10:55:22 +1300
Subject: [PATCH 1024/3333] Never uninstall python-pip on fedora

Python in f23 and f22 depends on the python-pip package so removing it
results in a nonfunctional system. pip on fedora installs to /usr so pip
can safely override the system pip for all versions of Fedora.

Change-Id: I336c7ffdf00784ca8deba7d6612a08b96a0ad098
Closes-Bug: #1467569
---
 tools/install_pip.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index ab5efb2e77..1728816890 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -111,8 +111,10 @@ get_versions
 
 # Eradicate any and all system packages
 
-# python in f23 depends on the python-pip package
-if ! { is_fedora && [[ $DISTRO == "f23" ]]; }; then
+# Python in f23 and f22 depends on the python-pip package so removing it
+# results in a nonfunctional system. pip on fedora installs to /usr so pip
+# can safely override the system pip for all versions of fedora
+if ! is_fedora ; then
     uninstall_package python-pip
 fi
 

From bb9caeae00bb9e4654838f782d2e07331f4ecae4 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Mon, 16 Nov 2015 17:18:42 -0500
Subject: [PATCH 1025/3333] Consolidate two /sbin/ip commands into a single one

When determining the primary IP/IPv6 addresses on a system,
we can use the /sbin/ip command to filter them for us.  The
resulting address is parsed the same way for both address
families, so we can use just a single command.

Change-Id: I0471ff5a258a16a23061941ac38063dbf3d7c233
---
 lib/neutron-legacy | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 85f7fc0a7c..978943dae2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -801,13 +801,7 @@ function _move_neutron_addresses_route {
         DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
-        if [[ $af == "inet" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep inet | awk '{ print $2, $3, $4; exit }')
-        fi
-
-        if [[ $af == "inet6" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep 'scope global' | sed '/temporary/d' | awk '{ print $2, $3, $4; exit }')
-        fi
+        IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"

From 2960bfa7f63c26d94c8aed2c3e1a6ff039b530f0 Mon Sep 17 00:00:00 2001
From: Tushar Gohad <tushar.gohad@intel.com>
Date: Tue, 17 Nov 2015 14:06:28 -0700
Subject: [PATCH 1026/3333] Add liberasurecode-dev as a swift dependency

Swift requirement PyECLib won't bundle liberasurecode
going forward given the package is available in common
distros now.  This patch adds liberasurecode-dev(el)
package to the devstack debs/rpms list for Swift as a
PyECLib build/install dependency.

Change-Id: Idbc2ca3f677f1b8153ebf3a5912f4354525a55c7
---
 files/debs/swift      | 1 +
 files/rpms-suse/swift | 1 +
 files/rpms/swift      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/swift b/files/debs/swift
index 726786ee18..4b8ac3d793 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -1,4 +1,5 @@
 curl
+liberasurecode-dev
 make
 memcached
 sqlite3
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
index 52e0a990e7..3663b98545 100644
--- a/files/rpms-suse/swift
+++ b/files/rpms-suse/swift
@@ -1,4 +1,5 @@
 curl
+liberasurecode-devel
 memcached
 sqlite3
 xfsprogs
diff --git a/files/rpms/swift b/files/rpms/swift
index f56a81b0d1..46dc59d74d 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,4 +1,5 @@
 curl
+liberasurecode-devel
 memcached
 pyxattr
 rsync-daemon # dist:f22,f23

From 93e2499ee1abfd2f9ed1ebda7a7d4d0deab04f80 Mon Sep 17 00:00:00 2001
From: Deepak C Shetty <deepakcs@redhat.com>
Date: Wed, 18 Nov 2015 12:29:33 +0530
Subject: [PATCH 1027/3333] doc: document override_defaults phase

override_defaults phase was added to devstack in [1]
but documentation was pending. This patch adds the
same. For history around override_defaults, one can
refer to the mail thread [2]

Also fixes a small typo

[1]: https://review.openstack.org/#/c/167933/
[2]: http://lists.openstack.org/pipermail/openstack-dev/2015-March/059621.html

Change-Id: I1b58ca0ce0e4b85a1dbd710b4c426606fd4dcf45
---
 doc/source/plugins.rst | 13 +++++++++++--
 extras.d/README.md     |  9 ++++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 8bd3797cd2..b8da7e1237 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -19,7 +19,16 @@ DevStack supports a standard mechanism for including plugins from
 external repositories. The plugin interface assumes the following:
 
 An external git repository that includes a ``devstack/`` top level
-directory. Inside this directory there can be 2 files.
+directory. Inside this directory there can be 3 files.
+
+- ``override_defaults`` - a file containing global variables that
+  will be sourced before the lib/* files. This allows the plugin
+  to override the defaults that are otherwise set in the lib/*
+  files.
+
+  For example, override_defaults may export CINDER_ENABLED_BACKENDS
+  to include the plugin-specific storage backend and thus be able
+  to override the default lvm only storage backend for Cinder.
 
 - ``settings`` - a file containing global variables that will be
   sourced very early in the process. This is helpful if other plugins
@@ -38,7 +47,7 @@ directory. Inside this directory there can be 2 files.
 
 - ``plugin.sh`` - the actual plugin. It is executed by devstack at
   well defined points during a ``stack.sh`` run. The plugin.sh
-  internal structure is discussed bellow.
+  internal structure is discussed below.
 
 
 Plugins are registered by adding the following to the localrc section
diff --git a/extras.d/README.md b/extras.d/README.md
index 7c2e4fe970..4cec14b4e7 100644
--- a/extras.d/README.md
+++ b/extras.d/README.md
@@ -14,10 +14,13 @@ The scripts are sourced at the beginning of each script that calls them. The
 entire `stack.sh` variable space is available.  The scripts are
 sourced with one or more arguments, the first of which defines the hook phase:
 
-    source | stack | unstack | clean
+    override_defaults | source | stack | unstack | clean
 
-    source: always called first in any of the scripts, used to set the
-        initial defaults in a lib/* script or similar
+    override_defaults: always called first in any of the scripts, used to
+        override defaults (if need be) that are otherwise set in lib/* scripts
+
+    source: called by stack.sh. Used to set the initial defaults in a lib/*
+        script or similar
 
     stack: called by stack.sh.  There are four possible values for
         the second arg to distinguish the phase stack.sh is in:

From 7860f2ba3189b0361693c8ee9c65d8d03fb115d6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 17 Nov 2015 11:59:07 -0500
Subject: [PATCH 1028/3333] install ebtables locking workaround

ebtables is racing with itself when nova and libvirt attempt to create
rules at the same time in the nat table. ebtables now has an explicit
--concurrent flag, that all tools must opt into to prevent ebtables
from inherently being unsafe to run.

libvirt gained this support in 1.2.11, which is too new for our ubuntu
primary testing environment. Nova still hasn't added this support,
though even if it did, we'd run into the issue with libvirt.

We can do the most ghetto thing possible and create a wrapper for
ebtables that does explicit locking on it's own. It's pretty terrible,
but it should work. And it is the kind of work around that people
unable to upgrade libvirt will probably need to do.

This is an opt in value which we should set in the gate to True.

Related-Bug: #1501558

Change-Id: Ic6fa847eba34c21593b9df86a1c2c179534d0ba5
---
 files/ebtables.workaround            | 23 +++++++++++++++++++++
 lib/nova_plugins/functions-libvirt   |  5 +++++
 stackrc                              | 10 +++++++++
 tools/install_ebtables_workaround.sh | 31 ++++++++++++++++++++++++++++
 4 files changed, 69 insertions(+)
 create mode 100644 files/ebtables.workaround
 create mode 100755 tools/install_ebtables_workaround.sh

diff --git a/files/ebtables.workaround b/files/ebtables.workaround
new file mode 100644
index 0000000000..c8af51fad5
--- /dev/null
+++ b/files/ebtables.workaround
@@ -0,0 +1,23 @@
+#!/bin/bash
+#
+# Copyright 2015 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+#
+# This is a terrible, terrible, truly terrible work around for
+# environments that have libvirt < 1.2.11. ebtables requires that you
+# specifically tell it you would like to not race and get punched in
+# the face when 2 run at the same time with a --concurrent flag.
+
+flock -w 300 /var/lock/ebtables.nova /sbin/ebtables.real $@
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 78c59786d8..045fc8b919 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -31,6 +31,11 @@ function install_libvirt {
         fi
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
+        if [[ "$EBTABLES_RACE_FIX" == "True" ]]; then
+            # Work around for bug #1501558. We can remove this once we
+            # get to a version of Ubuntu that has new enough libvirt.
+            TOP_DIR=$TOP_DIR $TOP_DIR/tools/install_ebtables_workaround.sh
+        fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm
diff --git a/stackrc b/stackrc
index 76a5756dde..53ed25d83e 100644
--- a/stackrc
+++ b/stackrc
@@ -769,6 +769,16 @@ GIT_DEPTH=${GIT_DEPTH:-0}
 # Use native SSL for servers in ``SSL_ENABLED_SERVICES``
 USE_SSL=$(trueorfalse False USE_SSL)
 
+# ebtables is inherently racey. If you run it by two or more processes
+# simultaneously it will collide, badly, in the kernel and produce
+# failures or corruption of ebtables. The only way around it is for
+# all tools running ebtables to only ever do so with the --concurrent
+# flag. This requires libvirt >= 1.2.11.
+#
+# If you don't have this then the following work around will replace
+# ebtables with a wrapper script so that it is safe to run without
+# that flag.
+EBTABLES_RACE_FIX=$(trueorfalse False EBTABLES_RACE_FIX)
 
 # Following entries need to be last items in file
 
diff --git a/tools/install_ebtables_workaround.sh b/tools/install_ebtables_workaround.sh
new file mode 100755
index 0000000000..45ced87f13
--- /dev/null
+++ b/tools/install_ebtables_workaround.sh
@@ -0,0 +1,31 @@
+#!/bin/bash -eu
+#
+# Copyright 2015 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+#
+# This replaces the ebtables on your system with a wrapper script that
+# does implicit locking. This is needed if libvirt < 1.2.11 on your platform.
+
+EBTABLES=/sbin/ebtables
+EBTABLESREAL=/sbin/ebtables.real
+FILES=$TOP_DIR/files
+
+if [[ -f "$EBTABLES" ]]; then
+    if file $EBTABLES | grep ELF; then
+        sudo mv $EBTABLES $EBTABLESREAL
+        sudo install -m 0755 $FILES/ebtables.workaround $EBTABLES
+        echo "Replaced ebtables with locking workaround"
+    fi
+fi

From 2ba36cda7940d630514a7864132837191d8c561f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Nov 2015 13:52:36 +1100
Subject: [PATCH 1029/3333] Add vercmp function

The existing vercmp_numbers function only handles, as the name says,
numbers.  I noticed that "sort" has had a version sort for a long time
[1] and, rather than re-implement it badly, use this as a version of
vercmp that works a bit more naturally.

This is intended to be used in an "if" statement as in

  prog_ver=$(prog_ver --version | grep ...)
  if vercmp $prog_ver "<" 2.0; then
     ...
  fi

A test-case is added to test the basic features and some edge-cases.

[1] http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=commitdiff;h=4c9fae4e97d95a9f89d1399a8aeb03051f0fec96

Change-Id: Ie55283acdc40a095b80b2631a55310072883ad0d
---
 functions            | 46 +++++++++++++++++++++++++++++++++++++++++++
 tests/test_vercmp.sh | 47 ++++++++++++++++++++++++++++++++++++++++++++
 tests/unittest.sh    | 45 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 138 insertions(+)
 create mode 100755 tests/test_vercmp.sh

diff --git a/functions b/functions
index 34da1ba733..e5e3400ff8 100644
--- a/functions
+++ b/functions
@@ -527,12 +527,58 @@ function vercmp_numbers {
     typeset v1=$1 v2=$2 sep
     typeset -a ver1 ver2
 
+    deprecated "vercmp_numbers is deprecated for more generic vercmp"
+
     IFS=. read -ra ver1 <<< "$v1"
     IFS=. read -ra ver2 <<< "$v2"
 
     _vercmp_r "${#ver1[@]}" "${ver1[@]}" "${ver2[@]}"
 }
 
+# vercmp ver1 op ver2
+#  Compare VER1 to VER2
+#   - op is one of < <= == >= >
+#   - returns true if satisified
+#  e.g.
+#  if vercmp 1.0 "<" 2.0; then
+#    ...
+#  fi
+function vercmp {
+    local v1=$1
+    local op=$2
+    local v2=$3
+    local result
+
+    # sort the two numbers with sort's "-V" argument.  Based on if v2
+    # swapped places with v1, we can determine ordering.
+    result=$(echo -e "$v1\n$v2" | sort -V | head -1)
+
+    case $op in
+        "==")
+            [ "$v1" = "$v2" ]
+            return
+            ;;
+        ">")
+            [ "$v1" != "$v2" ] && [ "$result" = "$v2" ]
+            return
+            ;;
+        "<")
+            [ "$v1" != "$v2" ] && [ "$result" = "$v1" ]
+            return
+            ;;
+        ">=")
+            [ "$result" = "$v2" ]
+            return
+            ;;
+        "<=")
+            [ "$result" = "$v1" ]
+            return
+            ;;
+        *)
+            die $LINENO "unrecognised op: $op"
+            ;;
+    esac
+}
 
 # This function sets log formatting options for colorizing log
 # output to stdout. It is meant to be called by lib modules.
diff --git a/tests/test_vercmp.sh b/tests/test_vercmp.sh
new file mode 100755
index 0000000000..c88bf86d7e
--- /dev/null
+++ b/tests/test_vercmp.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Tests for DevStack vercmp functionality
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import common functions
+source $TOP/functions
+source $TOP/tests/unittest.sh
+
+assert_true "numeric gt"  vercmp 2.0 ">" 1.0
+assert_true "numeric gte" vercmp 2.0 ">=" 1.0
+assert_true "numeric gt"  vercmp 1.0.1 ">" 1.0
+assert_true "numeric gte" vercmp 1.0.1 ">=" 1.0
+assert_true "alpha gt"    vercmp 1.0.1b ">" 1.0.1a
+assert_true "alpha gte"   vercmp 1.0.1b ">=" 1.0.1a
+assert_true "alpha gt"    vercmp b ">" a
+assert_true "alpha gte"   vercmp b ">=" a
+assert_true "alpha gt"    vercmp 2.0-rc3 ">" 2.0-rc1
+assert_true "alpha gte"   vercmp 2.0-rc3 ">=" 2.0-rc1
+
+assert_false "numeric gt fail"  vercmp 1.0 ">" 1.0
+assert_true  "numeric gte"      vercmp 1.0 ">=" 1.0
+assert_false "numeric gt fail"  vercmp 0.9 ">" 1.0
+assert_false "numeric gte fail" vercmp 0.9 ">=" 1.0
+assert_false "numeric gt fail"  vercmp 0.9.9 ">" 1.0
+assert_false "numeric gte fail" vercmp 0.9.9 ">=" 1.0
+assert_false "numeric gt fail"  vercmp 0.9a.9 ">" 1.0.1
+assert_false "numeric gte fail" vercmp 0.9a.9 ">=" 1.0.1
+
+assert_false "numeric lt"  vercmp 1.0 "<" 1.0
+assert_true  "numeric lte" vercmp 1.0 "<=" 1.0
+assert_true "numeric lt"   vercmp 1.0 "<" 1.0.1
+assert_true "numeric lte"  vercmp 1.0 "<=" 1.0.1
+assert_true "alpha lt"     vercmp 1.0.1a "<" 1.0.1b
+assert_true "alpha lte"    vercmp 1.0.1a "<=" 1.0.1b
+assert_true "alpha lt"     vercmp a "<" b
+assert_true "alpha lte"    vercmp a "<=" b
+assert_true "alpha lt"     vercmp 2.0-rc1 "<" 2.0-rc3
+assert_true "alpha lte"    vercmp 2.0-rc1 "<=" 2.0-rc3
+
+assert_true "eq"       vercmp 1.0 "==" 1.0
+assert_true "eq"       vercmp 1.0.1 "==" 1.0.1
+assert_false "eq fail" vercmp 1.0.1 "==" 1.0.2
+assert_false "eq fail" vercmp 2.0-rc1 "==" 2.0-rc2
+
+report_results
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 2570319fbf..6c697d7925 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -92,6 +92,51 @@ function assert_empty {
     fi
 }
 
+# assert the arguments evaluate to true
+#  assert_true "message" arg1 arg2
+function assert_true {
+    local lineno
+    lineno=`caller 0 | awk '{print $1}'`
+    local function
+    function=`caller 0 | awk '{print $2}'`
+    local msg=$1
+    shift
+
+    $@
+    if [ $? -eq 0 ]; then
+        PASS=$((PASS+1))
+        echo "PASS: $function:L$lineno - $msg"
+    else
+        FAILED_FUNCS+="$function:L$lineno\n"
+        echo "ERROR: test failed in $function:L$lineno!"
+        echo "  $msg"
+        ERROR=$((ERROR+1))
+    fi
+}
+
+# assert the arguments evaluate to false
+#  assert_false "message" arg1 arg2
+function assert_false {
+    local lineno
+    lineno=`caller 0 | awk '{print $1}'`
+    local function
+    function=`caller 0 | awk '{print $2}'`
+    local msg=$1
+    shift
+
+    $@
+    if [ $? -eq 0 ]; then
+        FAILED_FUNCS+="$function:L$lineno\n"
+        echo "ERROR: test failed in $function:L$lineno!"
+        echo "  $msg"
+        ERROR=$((ERROR+1))
+    else
+        PASS=$((PASS+1))
+        echo "PASS: $function:L$lineno - $msg"
+    fi
+}
+
+
 # Print a summary of passing and failing tests and exit
 # (with an error if we have failed tests)
 #  usage: report_results

From e0129f3c248d8f246b470e21982cfefb919482b6 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 19 Nov 2015 10:47:58 +0100
Subject: [PATCH 1030/3333] Fedora 23 supported

This change allows to use f23 without the FORCE=yes option.

Make sure you have latest kernel, or you have kernel-modules
installed for the running kernel.

f21 support will be removed when the gate jobs are upgraded
to use newer fedora version.

Change-Id: I6e3e64088187a7f6da745e3cfb07524fd31782ab
---
 files/rpms/general | 4 ++--
 lib/ceph           | 2 +-
 stack.sh           | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index 40b06f489b..280468283b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -8,9 +8,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f21,f22
+iptables-services  # NOPRIME f21,f22,f23
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f21,f22
+java-1.8.0-openjdk-headless  # NOPRIME f21,f22,f23
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/lib/ceph b/lib/ceph
index 29d2aca54f..f573136a4e 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f21|f22) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f21|f22|f23) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index a3d943a4df..537f81e253 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 7f0be4fc5f5bd8f45087e53c94fae3b9146f486e Mon Sep 17 00:00:00 2001
From: "Swapnil Kulkarni (coolsvap)" <me@coolsvap.net>
Date: Fri, 20 Nov 2015 10:52:59 +0530
Subject: [PATCH 1031/3333] Updated Typos in devstack

(1/5) Updated HACKING.rst for typos
(2/5) Updated typos in lib/dlm
(3/5) Updated typos in lib/ironic
(4/5) Updated typos in unittest.sh
(5/5) Updated typos in test_meta_config.sh

Change-Id: I7aafa3af69df9dc6a5923a8557f380d48b73433a
---
 HACKING.rst               | 2 +-
 lib/dlm                   | 2 +-
 lib/ironic                | 4 ++--
 tests/test_meta_config.sh | 2 +-
 tests/unittest.sh         | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d66687e351..d763c75b8b 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -328,7 +328,7 @@ There are some broad criteria that will be followed when reviewing
 your change
 
 * **Is it passing tests** -- your change will not be reviewed
-  throughly unless the official CI has run successfully against it.
+  thoroughly unless the official CI has run successfully against it.
 
 * **Does this belong in DevStack** -- DevStack reviewers have a
   default position of "no" but are ready to be convinced by your
diff --git a/lib/dlm b/lib/dlm
index f68ee26b4b..95e9b0ac3d 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -46,7 +46,7 @@ ZOOKEEPER_CONF_DIR=/etc/zookeeper
 # - cleanup_dlm
 
 # This should be declared in the settings file of any plugin or
-# service that needs to have a dlm in their enviroment.
+# service that needs to have a dlm in their environment.
 function use_dlm {
     enable_service $(dlm_backend)
 }
diff --git a/lib/ironic b/lib/ironic
index 016e639d03..6a32983b24 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -92,7 +92,7 @@ IRONIC_VM_LOG_DIR=${IRONIC_VM_LOG_DIR:-$IRONIC_DATA_DIR/logs/}
 # Use DIB to create deploy ramdisk and kernel.
 IRONIC_BUILD_DEPLOY_RAMDISK=$(trueorfalse True IRONIC_BUILD_DEPLOY_RAMDISK)
 # If not use DIB, these files are used as deploy ramdisk/kernel.
-# (The value must be a absolute path)
+# (The value must be an absolute path)
 IRONIC_DEPLOY_RAMDISK=${IRONIC_DEPLOY_RAMDISK:-}
 IRONIC_DEPLOY_KERNEL=${IRONIC_DEPLOY_KERNEL:-}
 IRONIC_DEPLOY_ELEMENT=${IRONIC_DEPLOY_ELEMENT:-deploy-ironic}
@@ -672,7 +672,7 @@ function configure_iptables {
     # enable tftp natting for allowing connections to HOST_IP's tftp server
     sudo modprobe nf_conntrack_tftp
     sudo modprobe nf_nat_tftp
-    # explicitly allow DHCP - packets are occassionally being dropped here
+    # explicitly allow DHCP - packets are occasionally being dropped here
     sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index f3e94af8f8..327fb56185 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -24,7 +24,7 @@ function check_result {
 }
 
 # mock function-common:die so that it does not
-# interupt our test script
+# interrupt our test script
 function die {
     exit -1
 }
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 2570319fbf..26b5b8e592 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -46,7 +46,7 @@ function failed {
     ERROR=$((ERROR+1))
 }
 
-# assert string comparision of val1 equal val2, printing out msg
+# assert string comparison of val1 equal val2, printing out msg
 #  usage: assert_equal val1 val2 msg
 function assert_equal {
     local lineno

From 255a58fec613b1304c8396cd969c72043073be30 Mon Sep 17 00:00:00 2001
From: Komei Shimamura <komei.t.f@gmail.com>
Date: Fri, 20 Nov 2015 18:36:05 +0900
Subject: [PATCH 1032/3333] Add existing devstack plugins to the devstack
 plugin list

Change-Id: I336a4c652a78e778e39652f1f16ff69be10ab065
---
 doc/source/plugin-registry.rst | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 49b3a7fc02..429f31af2d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -76,16 +76,30 @@ Alternate Configs
 Additional Services
 ===================
 
-+----------------+--------------------------------------------------+------------+
-| Plugin Name    | URL                                              | Comments   |
-|                |                                                  |            |
-+----------------+--------------------------------------------------+------------+
-|ec2-api         |git://git.openstack.org/openstack/ec2-api         |[as1]_      |
-+----------------+--------------------------------------------------+------------+
-|ironic-inspector|git://git.openstack.org/openstack/ironic-inspector|            |
-+----------------+--------------------------------------------------+------------+
-|                |                                                  |            |
-+----------------+--------------------------------------------------+------------+
++-----------------+------------------------------------------------------------+------------+
+| Plugin Name     | URL                                                        | Comments   |
+|                 |                                                            |            |
++-----------------+------------------------------------------------------------+------------+
+|amqp1            |git://git.openstack.org/openstack/devstack-plugin-amqp1     |            |
++-----------------+------------------------------------------------------------+------------+
+|bdd              |git://git.openstack.org/openstack/devstack-plugin-bdd       |            |
++-----------------+------------------------------------------------------------+------------+
+|ec2-api          |git://git.openstack.org/openstack/ec2-api                   |[as1]_      |
++-----------------+------------------------------------------------------------+------------+
+|glusterfs        |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
++-----------------+------------------------------------------------------------+------------+
+|hdfs             |git://git.openstack.org/openstack/devstack-plugin-hdfs      |            |
++-----------------+------------------------------------------------------------+------------+
+|ironic-inspector |git://git.openstack.org/openstack/ironic-inspector          |            |
++-----------------+------------------------------------------------------------+------------+
+|pika             |git://git.openstack.org/openstack/devstack-plugin-pika      |            |
++-----------------+------------------------------------------------------------+------------+
+|sheepdog         |git://git.openstack.org/openstack/devstack-plugin-sheepdog  |            |
++-----------------+------------------------------------------------------------+------------+
+|zmq              |git://git.openstack.org/openstack/devstack-plugin-zmq       |            |
++-----------------+------------------------------------------------------------+------------+
+|                 |                                                            |            |
++-----------------+------------------------------------------------------------+------------+
 
 .. [as1] first functional devstack plugin, hence why used in most of
          the examples.

From c18b4a4e5c4ffa25fba1da0ec99c3ff061d1472e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 18 Nov 2015 10:02:31 -0500
Subject: [PATCH 1033/3333] remove precise from the supported list

We haven't been testing master on precise for a long time, and changes
are coming that won't work on precise. If people want to keep running
on precise they should realize they are on their own with it. And that
we won't block any changes that use it.

Change-Id: I3697f1c2409ad08f49793dabb37011606188e6f6
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 537f81e253..8625b5aaeb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From f0dd6894af777d53c6d158d0720ea1b189f065a7 Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Wed, 18 Nov 2015 10:12:34 +0200
Subject: [PATCH 1034/3333] Use autogenerated flavor id

Fix to trove has been merged, and autogenerated flavor ID
is available since Kilo.

Related-Bug: #1333852

Change-Id: Ie4b3dd11a23fa5f91cf9ff22dd05f1afd0532cb4
---
 lib/ironic | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 016e639d03..294115cafe 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -652,13 +652,9 @@ function enroll_nodes {
         total_cpus=$((total_cpus+$ironic_node_cpu))
     done < $ironic_hwinfo_file
 
-    # create the nova flavor
-    # NOTE(adam_g): Attempting to use an autogenerated UUID for flavor id here uncovered
-    # bug (LP: #1333852) in Trove.  This can be changed to use an auto flavor id when the
-    # bug is fixed in Juno.
     local adjusted_disk
     adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
-    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal 551 $ironic_node_ram $adjusted_disk $ironic_node_cpu
+    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal auto $ironic_node_ram $adjusted_disk $ironic_node_cpu
 
     nova flavor-key baremetal set "cpu_arch"="x86_64"
 

From a366b97c0a76304bf0ddf7eb78e0efb4493df221 Mon Sep 17 00:00:00 2001
From: obutenko <obutenko@mirantis.com>
Date: Tue, 20 Oct 2015 19:07:04 +0300
Subject: [PATCH 1035/3333] Add flag for test_incremental_backup

Forced creation of incremental backup is not
implemented in old release (Juno and Kilo).
The test is skipped by default for Juno and Kilo gates.
Need to add flag to unskip this test in new release.

New test: Idde2c14aba78382b1063ce20269f4832f9fdd583
Change-Id: I565b5941d6067644fc9ca6cb0891d97f4946e031
Partial-Bug: #1506394
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..202f6d93e7 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -463,6 +463,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled bootable True
     # TODO(jordanP): Remove the extend_with_snapshot flag when Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
+    # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
+    iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
 
     local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then

From bdc0fa8ab13ec5c75f1c793ca33f5a773fac1abc Mon Sep 17 00:00:00 2001
From: John Kasperski <jckasper@us.ibm.com>
Date: Mon, 23 Nov 2015 11:56:33 -0600
Subject: [PATCH 1036/3333] Neutron: Clean up documentation typo

Remove duplicate SERVICE_HOST and MYSQL_HOST settings in the
examples.

Change-Id: I0e102b671f03ccb183d30ec6a762d00ebcf1e4b5
---
 doc/source/guides/neutron.rst | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 996c7d1f59..9dcb654a27 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -354,8 +354,6 @@ controller node.
         HOST_IP=10.0.0.2
         SERVICE_HOST=10.0.0.2
         MYSQL_HOST=10.0.0.2
-        SERVICE_HOST=10.0.0.2
-        MYSQL_HOST=10.0.0.2
         RABBIT_HOST=10.0.0.2
         GLANCE_HOSTPORT=10.0.0.2:9292
         PUBLIC_INTERFACE=eth1
@@ -397,7 +395,7 @@ would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the
 public internet.
 
-The following is the DevStack configuration on 
+The following is the DevStack configuration on
 compute node 1.
 
 ::
@@ -405,8 +403,6 @@ compute node 1.
         HOST_IP=10.0.0.3
         SERVICE_HOST=10.0.0.2
         MYSQL_HOST=10.0.0.2
-        SERVICE_HOST=10.0.0.2
-        MYSQL_HOST=10.0.0.2
         RABBIT_HOST=10.0.0.2
         GLANCE_HOSTPORT=10.0.0.2:9292
         ADMIN_PASSWORD=secrete

From 2ed28132e03066edb52fab6e640a96ee2d3424ac Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Thu, 5 Nov 2015 16:38:00 +0800
Subject: [PATCH 1037/3333] Add create stack user to quickstart document

Add instructions on creating a user to the documentation, and call out
that the standard cloud-users are probably ok too

Change-Id: I1119a43f1d5ae7c0c208bf0cc16e2f7bee29a69d
---
 doc/source/index.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index b65730ffe8..ec345c9f64 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -44,6 +44,18 @@ Quick Start
 
    We recommend at least a :ref:`minimal-configuration` be set up.
 
+#. Add Stack User
+
+   Devstack should be run as a non-root user with sudo enabled
+   (standard logins to cloud images such as "ubuntu" or "cloud-user"
+   are usually fine).
+
+   You can quickly create a separate `stack` user to run DevStack with
+
+   ::
+
+       devstack/tools/create-stack-user.sh; su stack
+
 #. Start the install
 
    ::

From d663e29d40b04017c515c19891bb846ea984acde Mon Sep 17 00:00:00 2001
From: Kahou Lei <kahou82@gmail.com>
Date: Sat, 24 Oct 2015 12:18:57 -0700
Subject: [PATCH 1038/3333] Ensure the Linux Bridge agent can be used with
 provider networking

The root cause is that when provider network is used, devstack
is trying to build ovs related interface.

We need to make a condition such that if linux bridge is used, don't
build any ovs related interface.

Change-Id: I7f26ce7893a0ecce55b3467cd5621abf25745b8e
Closes-bug: #1509705
---
 lib/neutron-legacy | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4e51425ffc..ecc45edbf7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -553,9 +553,11 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 
-        sudo ip link set $OVS_PHYSICAL_BRIDGE up
-        sudo ip link set br-int up
-        sudo ip link set $PUBLIC_INTERFACE up
+        if [[ $Q_AGENT == "openvswitch" ]]; then
+            sudo ip link set $OVS_PHYSICAL_BRIDGE up
+            sudo ip link set br-int up
+            sudo ip link set $PUBLIC_INTERFACE up
+        fi
     else
         NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
@@ -701,7 +703,7 @@ function start_neutron_service_and_check {
 function start_neutron_l2_agent {
     run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
 
-    if is_provider_network; then
+    if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
         sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
         sudo ip link set $OVS_PHYSICAL_BRIDGE up
         sudo ip link set br-int up

From ad69e69e3f278bd28319224035997e11477617c4 Mon Sep 17 00:00:00 2001
From: Arun S A G <saga@yahoo-inc.com>
Date: Fri, 20 Nov 2015 20:01:24 -0800
Subject: [PATCH 1039/3333] Set unprovision and active timeout to match
 build_timeout

The build_timeout for the ironic baremetal build is at
340s. Modify the unprovision_timeout and active_timeout
to match BUILD_TIMEOUT to avoid frequent failures during
IPA gate jobs.

Change-Id: Idfdc54210e33c71719c7fd0c905d0b802809e173
Related-Bug: #1393099
---
 lib/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..0c54f9737a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -508,7 +508,8 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal unprovision_timeout 300
+        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 0b4c83a07e09eead9dad88f5b8349574e53b1c45 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Thu, 26 Nov 2015 10:08:36 -0600
Subject: [PATCH 1040/3333] Single call for 'nova flavor-list'

Code simplification only, no functional changes.

Change-Id: I0b836bc77c0553528e3bc9e0cea98d59856ccdf5
---
 lib/tempest | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..c3276d8a51 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -196,8 +196,8 @@ function configure_tempest {
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
         # Tempest creates its own instance types
+        available_flavors=$(nova flavor-list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
-            available_flavors=$(nova flavor-list)
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 nova flavor-create m1.nano 42 64 0 1
             fi
@@ -210,15 +210,14 @@ function configure_tempest {
         else
             # Check Nova for existing flavors, if ``DEFAULT_INSTANCE_TYPE`` is set use it.
             boto_instance_type=$DEFAULT_INSTANCE_TYPE
-            flavor_lines=`nova flavor-list`
             IFS=$'\r\n'
             flavors=""
-            for line in $flavor_lines; do
+            for line in $available_flavors; do
                 f=$(echo $line | awk "/ $DEFAULT_INSTANCE_TYPE / { print \$2 }")
                 flavors="$flavors $f"
             done
 
-            for line in $flavor_lines; do
+            for line in $available_flavors; do
                 flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | cut -d' ' -f2`"
             done
 

From be3e553556a1a89f5046db79d3bc88fcad1d982a Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Mon, 23 Nov 2015 16:07:21 +0200
Subject: [PATCH 1041/3333] Add discussion of LIBS_FROM_GIT

Add a pointer to installing clients via LIBS_FROM_GIT to local.conf
sample.  Mention in the git tree setup that the projects within are
usually installed via released pip versions.

Change-Id: I245094e51ea4a8ce983f6a1e48b6ab7ca5d309d0
---
 samples/local.conf | 10 +++++++++-
 stackrc            |  2 ++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/samples/local.conf b/samples/local.conf
index b92097dd8d..34c9e8b48e 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -63,7 +63,8 @@ LOGDAYS=2
 # Using milestone-proposed branches
 # ---------------------------------
 
-# Uncomment these to grab the milestone-proposed branches from the repos:
+# Uncomment these to grab the milestone-proposed branches from the
+# repos:
 #CINDER_BRANCH=milestone-proposed
 #GLANCE_BRANCH=milestone-proposed
 #HORIZON_BRANCH=milestone-proposed
@@ -74,6 +75,13 @@ LOGDAYS=2
 #NEUTRON_BRANCH=milestone-proposed
 #SWIFT_BRANCH=milestone-proposed
 
+# Using git versions of clients
+# -----------------------------
+# By default clients are installed from pip.  See LIBS_FROM_GIT in
+# stackrc for details on getting clients from specific branches or
+# revisions.  e.g.
+# LIBS_FROM_GIT="python-ironicclient"
+# IRONICCLIENT_BRANCH=refs/changes/44/2.../1
 
 # Swift
 # -----
diff --git a/stackrc b/stackrc
index 23a4a7c4c4..cfdcd4d6b2 100644
--- a/stackrc
+++ b/stackrc
@@ -268,6 +268,7 @@ GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
 ##############
 #
 #  OpenStack Client Library Components
+#   Note default install is from pip, see LIBS_FROM_GIT
 #
 ##############
 
@@ -317,6 +318,7 @@ GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 ###################
 #
 #  Oslo Libraries
+#   Note default install is from pip, see LIBS_FROM_GIT
 #
 ###################
 

From 523f48803609b35350b624244fa73b1030c1d5fa Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 13 Oct 2015 11:03:03 +1100
Subject: [PATCH 1042/3333] Namespace XTRACE commands

I noticed this when debugging some grenade issues failures.

An include of grenade/functions stores the current value of XTRACE
(on) and disables xtrace for the rest of the import.

We then include devstack's "functions" library, which now overwrites
the stored value of XTRACE the current state; i.e. disabled.

When it finishes it restores the prior state (disabled), and then
grenade restores the same value of XTRACE (disabled).

The result is that xtrace is incorrectly disabled until the next time
it just happens to be turned on.

The solution is to name-space the store of the current-value of xtrace
so when we finish sourcing a file, we always restore the tracing value
to what it was when we entered.

Some files had already discovered this.  In general there is
inconsistency around the setting of the variable, and a lot of obvious
copy-paste.  This brings consistency across all files by using
_XTRACE_* prefixes for the sotre/restore of tracing values.

Change-Id: Iba7739eada5711d9c269cb4127fa712e9f961695
---
 functions                                   | 4 ++--
 functions-common                            | 4 ++--
 inc/meta-config                             | 4 ++--
 lib/apache                                  | 4 ++--
 lib/ceph                                    | 4 ++--
 lib/cinder                                  | 4 ++--
 lib/cinder_backends/ceph                    | 4 ++--
 lib/cinder_backends/glusterfs               | 4 ++--
 lib/cinder_backends/lvm                     | 4 ++--
 lib/cinder_backends/netapp_iscsi            | 4 ++--
 lib/cinder_backends/netapp_nfs              | 4 ++--
 lib/cinder_backends/nfs                     | 4 ++--
 lib/cinder_backends/solidfire               | 4 ++--
 lib/cinder_backends/vmdk                    | 4 ++--
 lib/cinder_backends/xiv                     | 4 ++--
 lib/cinder_plugins/XenAPINFS                | 4 ++--
 lib/cinder_plugins/glusterfs                | 4 ++--
 lib/cinder_plugins/nfs                      | 4 ++--
 lib/cinder_plugins/sheepdog                 | 4 ++--
 lib/cinder_plugins/vsphere                  | 4 ++--
 lib/database                                | 4 ++--
 lib/databases/mysql                         | 4 ++--
 lib/databases/postgresql                    | 4 ++--
 lib/dlm                                     | 4 ++--
 lib/dstat                                   | 4 ++--
 lib/glance                                  | 4 ++--
 lib/heat                                    | 4 ++--
 lib/horizon                                 | 4 ++--
 lib/infra                                   | 4 ++--
 lib/ironic                                  | 8 ++++----
 lib/keystone                                | 4 ++--
 lib/ldap                                    | 4 ++--
 lib/lvm                                     | 4 ++--
 lib/neutron-legacy                          | 4 ++--
 lib/neutron_plugins/bigswitch_floodlight    | 4 ++--
 lib/neutron_plugins/brocade                 | 4 ++--
 lib/neutron_plugins/cisco                   | 4 ++--
 lib/neutron_plugins/embrane                 | 5 +++--
 lib/neutron_plugins/linuxbridge_agent       | 4 ++--
 lib/neutron_plugins/ml2                     | 4 ++--
 lib/neutron_plugins/nuage                   | 4 ++--
 lib/neutron_plugins/openvswitch             | 5 +++--
 lib/neutron_plugins/openvswitch_agent       | 4 ++--
 lib/neutron_plugins/ovs_base                | 4 ++--
 lib/neutron_plugins/services/firewall       | 4 ++--
 lib/neutron_plugins/services/loadbalancer   | 4 ++--
 lib/neutron_plugins/services/metering       | 5 +++--
 lib/neutron_plugins/services/vpn            | 4 ++--
 lib/neutron_thirdparty/bigswitch_floodlight | 4 ++--
 lib/nova                                    | 4 ++--
 lib/nova_plugins/functions-libvirt          | 4 ++--
 lib/nova_plugins/hypervisor-fake            | 4 ++--
 lib/nova_plugins/hypervisor-ironic          | 4 ++--
 lib/nova_plugins/hypervisor-libvirt         | 4 ++--
 lib/nova_plugins/hypervisor-openvz          | 4 ++--
 lib/nova_plugins/hypervisor-vsphere         | 4 ++--
 lib/nova_plugins/hypervisor-xenserver       | 4 ++--
 lib/oslo                                    | 4 ++--
 lib/rpc_backend                             | 4 ++--
 lib/swift                                   | 4 ++--
 lib/tempest                                 | 4 ++--
 lib/template                                | 4 ++--
 stack.sh                                    | 7 +++++--
 63 files changed, 134 insertions(+), 128 deletions(-)

diff --git a/functions b/functions
index 34da1ba733..762fc472c2 100644
--- a/functions
+++ b/functions
@@ -22,7 +22,7 @@ source ${FUNC_DIR}/inc/python
 source ${FUNC_DIR}/inc/rootwrap
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_FUNCTIONS=$(set +o | grep xtrace)
 set +o xtrace
 
 # Check if a function already exists
@@ -603,7 +603,7 @@ function create_disk {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_FUNCTIONS
 
 # Local variables:
 # mode: shell-script
diff --git a/functions-common b/functions-common
index 6a065ba83c..d68ae77971 100644
--- a/functions-common
+++ b/functions-common
@@ -32,7 +32,7 @@
 #
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_FUNCTIONS_COMMON=$(set +o | grep xtrace)
 set +o xtrace
 
 # ensure we don't re-source this in the same environment
@@ -2254,7 +2254,7 @@ function time_totals {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_FUNCTIONS_COMMON
 
 # Local variables:
 # mode: shell-script
diff --git a/inc/meta-config b/inc/meta-config
index b9ab6b207f..b6fe437802 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -20,7 +20,7 @@
 # file-name is the destination of the config file
 
 # Save trace setting
-INC_META_XTRACE=$(set +o | grep xtrace)
+_XTRACE_INC_META=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -197,7 +197,7 @@ function merge_config_group {
 
 
 # Restore xtrace
-$INC_META_XTRACE
+$_XTRACE_INC_META
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/apache b/lib/apache
index 17526c74d0..c9e02a2b58 100644
--- a/lib/apache
+++ b/lib/apache
@@ -19,7 +19,7 @@
 # - restart_apache_server
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_APACHE=$(set +o | grep xtrace)
 set +o xtrace
 
 # Allow overriding the default Apache user and group, default to
@@ -191,7 +191,7 @@ function restart_apache_server {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_APACHE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/ceph b/lib/ceph
index f573136a4e..4ac498ab97 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -18,7 +18,7 @@
 # - cleanup_ceph
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_CEPH=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -375,7 +375,7 @@ function stop_ceph {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_CEPH
 
 ## Local variables:
 ## mode: shell-script
diff --git a/lib/cinder b/lib/cinder
index 1307c11f7a..70b198c2e9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -20,7 +20,7 @@
 # - cleanup_cinder
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -567,7 +567,7 @@ function create_cinder_volume_group {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_CINDER
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 7e9d2d334e..c21350ba01 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -22,7 +22,7 @@
 
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_CEPH=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -76,7 +76,7 @@ function configure_cinder_backend_ceph {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_CEPH
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/glusterfs b/lib/cinder_backends/glusterfs
index 00c62e04cd..4e34f8ef6c 100644
--- a/lib/cinder_backends/glusterfs
+++ b/lib/cinder_backends/glusterfs
@@ -19,7 +19,7 @@
 # configure_cinder_backend_glusterfs - Configure Cinder for GlusterFS backends
 
 # Save trace setting
-GLUSTERFS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_GLUSTERFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -41,7 +41,7 @@ function configure_cinder_backend_glusterfs {
 
 
 # Restore xtrace
-$GLUSTERFS_XTRACE
+$_XTRACE_CINDER_GLUSTERFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 411b82c190..d927f9cd6b 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -22,7 +22,7 @@
 
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_LVM=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -68,7 +68,7 @@ function init_cinder_backend_lvm {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_LVM
 
 # mode: shell-script
 # End:
diff --git a/lib/cinder_backends/netapp_iscsi b/lib/cinder_backends/netapp_iscsi
index be9442eb83..5cce30a6d3 100644
--- a/lib/cinder_backends/netapp_iscsi
+++ b/lib/cinder_backends/netapp_iscsi
@@ -20,7 +20,7 @@
 # configure_cinder_backend_netapp_iscsi - configure iSCSI
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NETAPP=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -59,7 +59,7 @@ function configure_cinder_backend_netapp_iscsi {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_NETAPP
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/netapp_nfs b/lib/cinder_backends/netapp_nfs
index dc919ad86b..7ba36d2a3b 100644
--- a/lib/cinder_backends/netapp_nfs
+++ b/lib/cinder_backends/netapp_nfs
@@ -20,7 +20,7 @@
 # configure_cinder_backend_netapp_nfs - configure NFS
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NETAPP=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -70,7 +70,7 @@ function cleanup_cinder_backend_netapp_nfs {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_NETAPP
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/nfs b/lib/cinder_backends/nfs
index fc51b2b440..89a37a1f02 100644
--- a/lib/cinder_backends/nfs
+++ b/lib/cinder_backends/nfs
@@ -19,7 +19,7 @@
 # configure_cinder_backend_nfs - Configure Cinder for NFS backends
 
 # Save trace setting
-NFS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -38,7 +38,7 @@ function configure_cinder_backend_nfs {
 
 
 # Restore xtrace
-$NFS_XTRACE
+$_XTRACE_CINDER_NFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/solidfire b/lib/cinder_backends/solidfire
index 7cc70fc86d..16bc527863 100644
--- a/lib/cinder_backends/solidfire
+++ b/lib/cinder_backends/solidfire
@@ -17,7 +17,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_SOLIDFIRE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -42,7 +42,7 @@ function configure_cinder_backend_solidfire {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_SOLIDFIRE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/vmdk b/lib/cinder_backends/vmdk
index d5b945354b..3a6a5cf2ff 100644
--- a/lib/cinder_backends/vmdk
+++ b/lib/cinder_backends/vmdk
@@ -15,7 +15,7 @@
 # configure_cinder_backend_vmdk - Configure Cinder for VMware vmdk backends
 
 # Save trace setting
-VMDK_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_VMDK=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -40,7 +40,7 @@ function configure_cinder_backend_vmdk {
 
 
 # Restore xtrace
-$VMDK_XTRACE
+$_XTRACE_CINDER_VMDK
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/xiv b/lib/cinder_backends/xiv
index 6eadaae93b..e8b5da05d5 100644
--- a/lib/cinder_backends/xiv
+++ b/lib/cinder_backends/xiv
@@ -42,7 +42,7 @@
 # configure_cinder_backend_xiv - Configure Cinder for xiv backends
 
 # Save trace setting
-XIV_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_XIV=$(set +o | grep xtrace)
 set +o xtrace
 
 # Defaults
@@ -79,7 +79,7 @@ function configure_cinder_backend_xiv {
 }
 
 # Restore xtrace
-$XIV_XTRACE
+$_XTRACE_CINDER_XIV
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/XenAPINFS b/lib/cinder_plugins/XenAPINFS
index f7306955cb..92135e7c4f 100644
--- a/lib/cinder_plugins/XenAPINFS
+++ b/lib/cinder_plugins/XenAPINFS
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_XENAPINFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -39,7 +39,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_XENAPINFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/glusterfs b/lib/cinder_plugins/glusterfs
index 35ceb27ce1..329dd6c649 100644
--- a/lib/cinder_plugins/glusterfs
+++ b/lib/cinder_plugins/glusterfs
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_GLUSTERFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -45,7 +45,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_GLUSTERFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/nfs b/lib/cinder_plugins/nfs
index 83b39932cf..6e4ffe068e 100644
--- a/lib/cinder_plugins/nfs
+++ b/lib/cinder_plugins/nfs
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -36,7 +36,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_NFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/sheepdog b/lib/cinder_plugins/sheepdog
index ca343f708b..558de46c6d 100644
--- a/lib/cinder_plugins/sheepdog
+++ b/lib/cinder_plugins/sheepdog
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_SHEEPDOG=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -34,7 +34,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_SHEEPDOG
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/vsphere b/lib/cinder_plugins/vsphere
index f14ddf0998..1b28ffe602 100644
--- a/lib/cinder_plugins/vsphere
+++ b/lib/cinder_plugins/vsphere
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_VSPHERE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -37,7 +37,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_VSPHERE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/database b/lib/database
index 13740b90e6..0d720527df 100644
--- a/lib/database
+++ b/lib/database
@@ -20,7 +20,7 @@
 # and call register_database $DATABASE_TYPE
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_DB=$(set +o | grep xtrace)
 set +o xtrace
 
 DATABASE_BACKENDS=""
@@ -137,7 +137,7 @@ function database_connection_url {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_DB
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/databases/mysql b/lib/databases/mysql
index cc74b33327..1bbbd62cc3 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -8,7 +8,7 @@
 # - DATABASE_{HOST,USER,PASSWORD} must be defined
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_DB_MYSQL=$(set +o | grep xtrace)
 set +o xtrace
 
 MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
@@ -178,7 +178,7 @@ function database_connection_url_mysql {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_DB_MYSQL
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 78c7bedc90..913e8ffacd 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -8,7 +8,7 @@
 # - DATABASE_{HOST,USER,PASSWORD} must be defined
 
 # Save trace setting
-PG_XTRACE=$(set +o | grep xtrace)
+_XTRACE_PG=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -119,7 +119,7 @@ function database_connection_url_postgresql {
 
 
 # Restore xtrace
-$PG_XTRACE
+$_XTRACE_PG
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/dlm b/lib/dlm
index 95e9b0ac3d..74eb67ee8f 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -19,7 +19,7 @@
 # - cleanup_dlm
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_DLM=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -100,7 +100,7 @@ function install_dlm {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_DLM
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/dstat b/lib/dstat
index fe4790b12d..b705948094 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -13,7 +13,7 @@
 # - stop_dstat
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_DSTAT=$(set +o | grep xtrace)
 set +o xtrace
 
 # start_dstat() - Start running processes, including screen
@@ -34,4 +34,4 @@ function stop_dstat {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_DSTAT
diff --git a/lib/glance b/lib/glance
index 2eb93a46e6..eb5832e910 100644
--- a/lib/glance
+++ b/lib/glance
@@ -21,7 +21,7 @@
 # - cleanup_glance
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_GLANCE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -403,7 +403,7 @@ function stop_glance {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_GLANCE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/heat b/lib/heat
index e42bdf0b9e..54666a5212 100644
--- a/lib/heat
+++ b/lib/heat
@@ -23,7 +23,7 @@
 # - cleanup_heat
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_HEAT=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -464,7 +464,7 @@ function build_heat_pip_mirror {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_HEAT
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/horizon b/lib/horizon
index ff63b06ab2..67181fcf29 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -19,7 +19,7 @@
 # - cleanup_horizon
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_HORIZON=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -193,7 +193,7 @@ function _prepare_message_catalog_compilation {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_HORIZON
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/infra b/lib/infra
index ab32efecd9..cf003cce01 100644
--- a/lib/infra
+++ b/lib/infra
@@ -15,7 +15,7 @@
 # - install_infra
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_INFRA=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -50,7 +50,7 @@ function install_infra {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_INFRA
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/ironic b/lib/ironic
index 6a32983b24..23d8dda3ff 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -21,8 +21,8 @@
 # - cleanup_ironic
 
 # Save trace and pipefail settings
-XTRACE=$(set +o | grep xtrace)
-PIPEFAIL=$(set +o | grep pipefail)
+_XTRACE_IRONIC=$(set +o | grep xtrace)
+_PIPEFAIL_IRONIC=$(set +o | grep pipefail)
 set +o xtrace
 set +o pipefail
 
@@ -855,8 +855,8 @@ function cleanup_baremetal_basic_ops {
 }
 
 # Restore xtrace + pipefail
-$XTRACE
-$PIPEFAIL
+$_XTRACE_IRONIC
+$_PIPEFAIL_IRONIC
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/keystone b/lib/keystone
index 5a2afbfe02..b19202b0f7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -28,7 +28,7 @@
 # - _cleanup_keystone_apache_wsgi
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_KEYSTONE=$(set +o | grep xtrace)
 set +o xtrace
 
 # Defaults
@@ -592,7 +592,7 @@ function stop_keystone {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_KEYSTONE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/ldap b/lib/ldap
index 0414fea639..65056aea2f 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -8,7 +8,7 @@
 # - install_ldap()
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LDAP=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -166,7 +166,7 @@ function clear_ldap_state {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LDAP
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/lvm b/lib/lvm
index 468a99aecc..ae6023a836 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -16,7 +16,7 @@
 
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_LVM=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -182,7 +182,7 @@ function set_lvm_filter {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_LVM
 
 # mode: shell-script
 # End:
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 978943dae2..d00630af70 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -357,7 +357,7 @@ else
 fi
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -1492,7 +1492,7 @@ function is_provider_network {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_NEUTRON
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index f52105e658..586ded79b4 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -4,7 +4,7 @@
 # ------------------------------------
 
 # Save trace setting
-BS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_BIGSWITCH=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/ovs_base
@@ -75,4 +75,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$BS_XTRACE
+$_XTRACE_NEUTRON_BIGSWITCH
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 953360e070..6ba0a66c3f 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -4,7 +4,7 @@
 # ----------------------
 
 # Save trace setting
-BRCD_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_BROCADE=$(set +o | grep xtrace)
 set +o xtrace
 
 function is_neutron_ovs_base_plugin {
@@ -81,4 +81,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$BRCD_XTRACE
+$_XTRACE_NEUTRON_BROCADE
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index 7d0cf1af39..fc2cb8ad17 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-CISCO_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_CISCO=$(set +o | grep xtrace)
 set +o xtrace
 
 # Scecify the VSM parameters
@@ -154,4 +154,4 @@ function neutron_plugin_setup_interface_driver {
 }
 
 # Restore xtrace
-$CISCO_XTRACE
+$_XTRACE_NEUTRON_CISCO
diff --git a/lib/neutron_plugins/embrane b/lib/neutron_plugins/embrane
index 2028496ca1..385dab8354 100644
--- a/lib/neutron_plugins/embrane
+++ b/lib/neutron_plugins/embrane
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-EMBR_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_EMBR=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/openvswitch
@@ -39,4 +39,5 @@ function neutron_plugin_configure_service {
 }
 
 # Restore xtrace
-$EMBR_XTRACE
+$_XTRACE_NEUTRON_EMBR
+
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index f28bcfeadd..096722b096 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -4,7 +4,7 @@
 # -----------------------------
 
 # Save trace setting
-PLUGIN_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_lb_cleanup {
@@ -93,4 +93,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$PLUGIN_XTRACE
+$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index ace5335a78..30e1b036f3 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -4,7 +4,7 @@
 # ------------------------------
 
 # Save trace setting
-ML2_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
 # Enable this to simply and quickly enable tunneling with ML2.
@@ -137,4 +137,4 @@ function has_neutron_plugin_security_group {
 }
 
 # Restore xtrace
-$ML2_XTRACE
+$_XTRACE_NEUTRON_ML2
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 9e5307ba53..61e634e453 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -4,7 +4,7 @@
 # ----------------------
 
 # Save trace setting
-NU_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_NU=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_plugin_create_nova_conf {
@@ -66,4 +66,4 @@ function has_neutron_plugin_security_group {
 }
 
 # Restore xtrace
-$NU_XTRACE
+$_XTRACE_NEUTRON_NU
diff --git a/lib/neutron_plugins/openvswitch b/lib/neutron_plugins/openvswitch
index 891ab4982b..130eaacab3 100644
--- a/lib/neutron_plugins/openvswitch
+++ b/lib/neutron_plugins/openvswitch
@@ -7,7 +7,7 @@
 # which has been removed in Juno.
 
 # Save trace setting
-OVS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_OVS=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/openvswitch_agent
@@ -56,4 +56,5 @@ function has_neutron_plugin_security_group {
 }
 
 # Restore xtrace
-$OVS_XTRACE
+$_XTRACE_NEUTRON_OVS
+
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 6a333939d0..b1acacd4f3 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -4,7 +4,7 @@
 # -----------------------------
 
 # Save trace setting
-OVSA_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_OVSL2=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/ovs_base
@@ -132,4 +132,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$OVSA_XTRACE
+$_XTRACE_NEUTRON_OVSL2
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index d3fd198b08..91aff336fe 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -4,7 +4,7 @@
 # -------------------------------------
 
 # Save trace setting
-OVSB_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_OVS_BASE=$(set +o | grep xtrace)
 set +o xtrace
 
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
@@ -114,4 +114,4 @@ function _neutron_ovs_base_configure_nova_vif_driver {
 }
 
 # Restore xtrace
-$OVSB_XTRACE
+$_XTRACE_NEUTRON_OVS_BASE
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 3496da82f8..1d81a21825 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-FW_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_FIREWALL=$(set +o | grep xtrace)
 set +o xtrace
 
 FWAAS_PLUGIN=neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin
@@ -26,4 +26,4 @@ function neutron_fwaas_stop {
 }
 
 # Restore xtrace
-$FW_XTRACE
+$_XTRACE_NEUTRON_FIREWALL
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index 7865f6fd6e..b07d06c32b 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-LB_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -48,4 +48,4 @@ function neutron_lbaas_stop {
 }
 
 # Restore xtrace
-$LB_XTRACE
+$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index c75ab19d4e..5fd2fdce44 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-METER_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NETURON_METER=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -29,4 +29,5 @@ function neutron_metering_stop {
 }
 
 # Restore xtrace
-$METER_XTRACE
+$_XTRACE_NETURON_METER
+
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index c0e7457413..8a379f588c 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-VPN_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_VPN=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -53,4 +53,4 @@ function neutron_vpn_stop {
 }
 
 # Restore xtrace
-$VPN_XTRACE
+$_XTRACE_NEUTRON_VPN
diff --git a/lib/neutron_thirdparty/bigswitch_floodlight b/lib/neutron_thirdparty/bigswitch_floodlight
index e3f4689fd7..45a4f2e263 100644
--- a/lib/neutron_thirdparty/bigswitch_floodlight
+++ b/lib/neutron_thirdparty/bigswitch_floodlight
@@ -4,7 +4,7 @@
 # ------------------------------------------
 
 # Save trace setting
-BS3_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_BIGSWITCH=$(set +o | grep xtrace)
 set +o xtrace
 
 BS_FL_CONTROLLERS_PORT=${BS_FL_CONTROLLERS_PORT:-localhost:80}
@@ -51,4 +51,4 @@ function check_bigswitch_floodlight {
 }
 
 # Restore xtrace
-$BS3_XTRACE
+$_XTRACE_NEUTRON_BIGSWITCH
diff --git a/lib/nova b/lib/nova
index ba05f53b87..e5712939fe 100644
--- a/lib/nova
+++ b/lib/nova
@@ -25,7 +25,7 @@
 # - cleanup_nova
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_NOVA=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -958,7 +958,7 @@ function stop_nova {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_NOVA
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 045fc8b919..dae55c6eba 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -8,7 +8,7 @@
 # ``STACK_USER`` has to be defined
 
 # Save trace setting
-LV_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NOVA_FN_LIBVIRT=$(set +o | grep xtrace)
 set +o xtrace
 
 # Defaults
@@ -134,7 +134,7 @@ EOF
 
 
 # Restore xtrace
-$LV_XTRACE
+$_XTRACE_NOVA_FN_LIBVIRT
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 3180d91f0a..2434dce884 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_VIRTFAKE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -72,7 +72,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_VIRTFAKE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index b9e286d5b6..c6ed85d63e 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_HYP_IRONIC=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/nova_plugins/functions-libvirt
@@ -81,7 +81,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_HYP_IRONIC
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index c54a7166a0..8bbaa2133d 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NOVA_LIBVIRT=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/nova_plugins/functions-libvirt
@@ -105,7 +105,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_NOVA_LIBVIRT
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-openvz b/lib/nova_plugins/hypervisor-openvz
index cce36b8d3f..58ab5c11ac 100644
--- a/lib/nova_plugins/hypervisor-openvz
+++ b/lib/nova_plugins/hypervisor-openvz
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_OPENVZ=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -62,7 +62,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_OPENVZ
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-vsphere b/lib/nova_plugins/hypervisor-vsphere
index 698f836bad..7c08bc945b 100644
--- a/lib/nova_plugins/hypervisor-vsphere
+++ b/lib/nova_plugins/hypervisor-vsphere
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NOVA_VSPHERE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -64,7 +64,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_NOVA_VSPHERE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e097990bd3..3eb9149bb4 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_XENSERVER=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -111,7 +111,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_XENSERVER
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/oslo b/lib/oslo
index 56615faaa3..3d6fbb38c6 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -16,7 +16,7 @@
 # - install_oslo
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -95,7 +95,7 @@ function install_oslo {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_OSLO
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 298dcb6e5f..3864adec32 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -21,7 +21,7 @@
 # of this file which is a standard interface.
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_RPC_BACKEND=$(set +o | grep xtrace)
 set +o xtrace
 
 # Functions
@@ -141,7 +141,7 @@ function rabbit_setuser {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_RPC_BACKEND
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/swift b/lib/swift
index d7ccc24111..b596142ad2 100644
--- a/lib/swift
+++ b/lib/swift
@@ -24,7 +24,7 @@
 # - _cleanup_swift_apache_wsgi
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_SWIFT=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -823,7 +823,7 @@ function swift_configure_tempurls {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_SWIFT
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..85e0e7fa35 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -38,7 +38,7 @@
 # - init_tempest
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_TEMPEST=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -649,7 +649,7 @@ function init_tempest {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_TEMPEST
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/template b/lib/template
index 2703788af4..08d10bbf71 100644
--- a/lib/template
+++ b/lib/template
@@ -21,7 +21,7 @@
 # - cleanup_XXXX
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_TEMPLATE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -92,7 +92,7 @@ function stop_XXXX {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_TEMPLATE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/stack.sh b/stack.sh
index 8625b5aaeb..19d05c904a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -573,7 +573,8 @@ run_phase source
 
 # Generic helper to configure passwords
 function read_password {
-    XTRACE=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     var=$1; msg=$2
     pw=${!var}
@@ -616,7 +617,9 @@ function read_password {
         eval "$var=$pw"
         echo "$var=$pw" >> $localrc
     fi
-    $XTRACE
+
+    # restore previous xtrace value
+    $xtrace
 }
 
 

From f95315b6ea56b3f2cb18caeac734dd15e6704b93 Mon Sep 17 00:00:00 2001
From: Shinobu KINJO <shinobu@linux.com>
Date: Sat, 7 Nov 2015 10:21:08 +0900
Subject: [PATCH 1043/3333] Ensure link is set to up, when moving IP addresses
 across interfaces.

 - To add, initialize and set up a valiable named IP_UP
 - To bring up interface after moving IP to OVS bridge

Change-Id: I70f5974c115be6f7e7422a9a325f36cf3b71455a
Closes-Bug: #1469596
---
 lib/neutron-legacy | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..ecff3e5774 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -798,6 +798,7 @@ function _move_neutron_addresses_route {
 
         local IP_ADD=""
         local IP_DEL=""
+        local IP_UP=""
         local DEFAULT_ROUTE_GW
         DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
@@ -821,9 +822,10 @@ function _move_neutron_addresses_route {
         if [[ "$IP_BRD" != "" ]]; then
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
             IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
+            IP_UP="sudo ip link set $to_intf up"
         fi
 
-        $IP_DEL; $IP_ADD; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
     fi
 }
 

From 5509ed579773bf1a69bc5fb406a206a6da010c56 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Mon, 30 Nov 2015 20:20:21 +0900
Subject: [PATCH 1044/3333] Fix comment typos in inc/ and tests/ directories

valu3 => value3
enviromnet => environment
direcotry => directory
virualenv => virtualenv
editiable => editable
envirnment => environment

Change-Id: I97fb2d44a37b16d02d4fbdb08bfa33414349f651
---
 inc/ini-config       | 2 +-
 inc/python           | 8 ++++----
 tests/run-process.sh | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 42a66c63b6..d2830d79cd 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -205,7 +205,7 @@ $option = $value
 }
 
 # Set a multiple line option in an INI file
-# iniset_multiline [-sudo] config-file section option value1 value2 valu3 ...
+# iniset_multiline [-sudo] config-file section option value1 value2 value3 ...
 function iniset_multiline {
     local xtrace
     xtrace=$(set +o | grep xtrace)
diff --git a/inc/python b/inc/python
index 91ceb44499..59668a2c6a 100644
--- a/inc/python
+++ b/inc/python
@@ -17,7 +17,7 @@ set +o xtrace
 
 # Global Config Variables
 
-# PROJECT_VENV contains the name of the virtual enviromnet for each
+# PROJECT_VENV contains the name of the virtual environment for each
 # project.  A null value installs to the system Python directories.
 declare -A PROJECT_VENV
 
@@ -35,7 +35,7 @@ function get_pip_command {
     fi
 }
 
-# Get the path to the direcotry where python executables are installed.
+# Get the path to the directory where python executables are installed.
 # get_python_exec_prefix
 function get_python_exec_prefix {
     local xtrace
@@ -93,7 +93,7 @@ function pip_install {
     fi
     if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
         # TRACK_DEPENDS=True installation creates a circular dependency when
-        # we attempt to install virtualenv into a virualenv, so we must global
+        # we attempt to install virtualenv into a virtualenv, so we must global
         # that installation.
         source $DEST/.venv/bin/activate
         local cmd_pip=$DEST/.venv/bin/pip
@@ -199,7 +199,7 @@ function setup_lib {
     setup_install $dir
 }
 
-# setup a library by name in editiable mode. If we are trying to use
+# setup a library by name in editable mode. If we are trying to use
 # the library from git, we'll do a git based install, otherwise we'll
 # punt and the library should be installed by a requirements pull from
 # another project.
diff --git a/tests/run-process.sh b/tests/run-process.sh
index bdf1395d07..301b9a032b 100755
--- a/tests/run-process.sh
+++ b/tests/run-process.sh
@@ -5,7 +5,7 @@
 #
 # Set USE_SCREEN True|False to change use of screen.
 #
-# This script emulates the basic exec envirnment in ``stack.sh`` to test
+# This script emulates the basic exec environment in ``stack.sh`` to test
 # the process spawn and kill operations.
 
 if [[ -z $1 ]]; then

From 779d8670287952b8865a1d506ba2d68406139430 Mon Sep 17 00:00:00 2001
From: Joe D'Andrea <jdandrea@research.att.com>
Date: Mon, 30 Nov 2015 15:35:13 +0000
Subject: [PATCH 1045/3333] Force heat deferred_auth_method to password in
 standalone mode

Heat does not support Keystone Trusts when deployed in standalone
mode. This change forces an error when HEAT_DEFERRED_AUTH is set
to anything other than "password" if HEAT_STANDALONE is True and
advises of the acceptable setting.

Change-Id: Ib4ee9d9af396093137a2a0f99f1b18ae153ccdb3
Closes-Bug: #1463837
---
 lib/heat | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/heat b/lib/heat
index 54666a5212..fdcf5bcaad 100644
--- a/lib/heat
+++ b/lib/heat
@@ -65,6 +65,12 @@ if [[ "$HEAT_STANDALONE" = "True" ]]; then
     # for standalone, use defaults which require no service user
     HEAT_STACK_DOMAIN=$(trueorfalse False HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-password}
+    if [[ ${HEAT_DEFERRED_AUTH} != "password" ]]; then
+        # Heat does not support keystone trusts when deployed in
+        # standalone mode
+        die $LINENO \
+            'HEAT_DEFERRED_AUTH can only be set to "password" when HEAT_STANDALONE is True.'
+    fi
 else
     HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}

From 30d5fae31548ed998e4c053ba957f95e068eaebc Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Tue, 10 Nov 2015 13:44:15 +0000
Subject: [PATCH 1046/3333] Neutron: Use generated configuration files if
 available

Generate the neutron core sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Ic37a16b6cf8eb92030649f1fc8b198738a8cc104
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I1c6dc4e7d479f1b7c755597caded24a0f018c712
Co-Authored-By: Louis Taylor <louis@kragniz.eu>
---
 lib/neutron-legacy                    | 19 +++++++++++++------
 lib/neutron_plugins/services/metering |  2 +-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d00630af70..a60714f43b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -870,7 +870,10 @@ function _create_neutron_conf_dir {
 function _configure_neutron_common {
     _create_neutron_conf_dir
 
-    cp $NEUTRON_DIR/etc/neutron.conf $NEUTRON_CONF
+    # Uses oslo config generator to generate core sample configuration files
+    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
 
     Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
     cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
@@ -895,7 +898,9 @@ function _configure_neutron_common {
     Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
     # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
     # there is no config file in Neutron tree. They should prepare the file in each plugin.
-    if [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
+    if [ -f "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" ]; then
+        cp "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" /$Q_PLUGIN_CONF_FILE
+    elif [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
         cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
     fi
 
@@ -903,6 +908,8 @@ function _configure_neutron_common {
     iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
     iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
+    iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
+
     # If addition config files are set, make sure their path name is set as well
     if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
         die $LINENO "Neutron additional plugin config not set.. exiting"
@@ -959,7 +966,7 @@ function _configure_neutron_debug_command {
         return
     fi
 
-    cp $NEUTRON_DIR/etc/l3_agent.ini $NEUTRON_TEST_CONFIG_FILE
+    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_TEST_CONFIG_FILE
 
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
@@ -975,7 +982,7 @@ function _configure_neutron_debug_command {
 
 function _configure_neutron_dhcp_agent {
 
-    cp $NEUTRON_DIR/etc/dhcp_agent.ini $Q_DHCP_CONF_FILE
+    cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
 
     iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -1007,7 +1014,7 @@ function _configure_neutron_l3_agent {
         neutron_vpn_configure_agent
     fi
 
-    cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE
+    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -1028,7 +1035,7 @@ function _configure_neutron_l3_agent {
 }
 
 function _configure_neutron_metadata_agent {
-    cp $NEUTRON_DIR/etc/metadata_agent.ini $Q_META_CONF_FILE
+    cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
 
     iniset $Q_META_CONF_FILE DEFAULT verbose True
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 5fd2fdce44..5b32468d21 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -21,7 +21,7 @@ function neutron_agent_metering_configure_agent {
 
     METERING_AGENT_CONF_FILENAME="$METERING_AGENT_CONF_PATH/metering_agent.ini"
 
-    cp $NEUTRON_DIR/etc/metering_agent.ini $METERING_AGENT_CONF_FILENAME
+    cp $NEUTRON_DIR/etc/metering_agent.ini.sample $METERING_AGENT_CONF_FILENAME
 }
 
 function neutron_metering_stop {

From e0ac37c257bf08db8d220d13773859d9202305d2 Mon Sep 17 00:00:00 2001
From: Dmitry Guryanov <dguryanov@parallels.com>
Date: Mon, 30 Nov 2015 18:48:23 +0300
Subject: [PATCH 1047/3333] Fix path setup in add_sudo_secure_path

There are two bugs in add_sudo_secure_path.

Firstly we don't properly check if the file exists, so always append
the new line.  This will overwrite any existing changes.

Secondly the logic for checking if the path exists is inverted, so we
miss adding paths when we should.  This particularly causes failures
when installing with virtualenv's since the paths are inside the
virtualenv, rather than the standard system locations.

Change-Id: I646fe0c68958470d464fe4f3d81d5c17dd6f2ab6
Closes-bug: #1521241
---
 inc/rootwrap | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/rootwrap b/inc/rootwrap
index 63ab59adc7..2a6e4b648f 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -22,14 +22,14 @@ function add_sudo_secure_path {
     local line
 
     # This is pretty simplistic for now - assume only the first line is used
-    if [[ -r SUDO_SECURE_PATH_FILE ]]; then
+    if [[ -r $SUDO_SECURE_PATH_FILE ]]; then
         line=$(head -1 $SUDO_SECURE_PATH_FILE)
     else
         line="Defaults:$STACK_USER secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin"
     fi
 
     # Only add ``dir`` if it is not already present
-    if [[ $line =~ $dir ]]; then
+    if [[ ! $line =~ $dir ]]; then
         echo "${line}:$dir" | sudo tee $SUDO_SECURE_PATH_FILE
         sudo chmod 400 $SUDO_SECURE_PATH_FILE
         sudo chown root:root $SUDO_SECURE_PATH_FILE

From 1afc28bf6c33c792eb9d2fd1992534e82af29291 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 27 Nov 2015 14:15:56 +1100
Subject: [PATCH 1048/3333] Turn off tracing when outputting errors

When outputting these error strings, turn off the tracing so the user
can actually read it.  Also reword the "not root" user message so it
fits into a standard terminal window length.

Change-Id: I466c60865bc1128f4edd219f831a9c6cffa67829
Parital-Bug: #1517199
---
 stack.sh | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 8625b5aaeb..083c488fc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -75,6 +75,7 @@ fi
 
 # Check if run in POSIX shell
 if [[ "${POSIXLY_CORRECT}" == "y" ]]; then
+    set +o xtrace
     echo "You are running POSIX compatibility mode, DevStack requires bash 4.2 or newer."
     exit 1
 fi
@@ -85,11 +86,11 @@ fi
 # action to create a suitable user account.
 
 if [[ $EUID -eq 0 ]]; then
-    echo "You are running this script as root."
-    echo "Cut it out."
-    echo "Really."
-    echo "If you need an account to run DevStack, do this (as root, heh) to create a non-root account:"
-    echo "$TOP_DIR/tools/create-stack-user.sh"
+    set +o xtrace
+    echo "DevStack should be run as a user with sudo permissions, "
+    echo "not root."
+    echo "A \"stack\" user configured correctly can be created with:"
+    echo " $TOP_DIR/tools/create-stack-user.sh"
     exit 1
 fi
 
@@ -98,6 +99,7 @@ fi
 # virtual env, and will fail in really odd ways if you do this. Make
 # this explicit as it has come up on the mailing list.
 if [[ -n "$VIRTUAL_ENV" ]]; then
+    set +o xtrace
     echo "You appear to be running under a python virtualenv."
     echo "DevStack does not support this, as we may break the"
     echo "virtualenv you are currently in by modifying "
@@ -111,6 +113,7 @@ fi
 # on a lot of different environments, you sometimes run it on the
 # wrong box. This makes there be a way to prevent that.
 if [[ -e $HOME/.no-devstack ]]; then
+    set +o xtrace
     echo "You've marked this host as a no-devstack host, to save yourself from"
     echo "running devstack accidentally. If this is in error, please remove the"
     echo "~/.no-devstack file"

From ddc3839bdc7ff73f6224273605db10fd88cd60df Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Thu, 7 May 2015 21:06:24 +0000
Subject: [PATCH 1049/3333] Enable optional Python 3 support

Add USE_PYTHON3 and PYTHON3_VERSION variables to allow services to use
python 3 if they indicate support in their python package metadata.

Tested in Heat here -> I837c2fba682ab430d50e9f43913f2fed20325a7a.
Project config change to add a dedicated job to Heat is here -> I0837e62d6ccc66397a5e409f0961edd4be31f467

Change-Id: I079e18b58b214bf8362945c253d6d894ca8b1a6b
---
 inc/python               | 47 +++++++++++++++++++++++++++++++++++++---
 lib/stack                |  1 +
 stackrc                  | 11 ++++++++++
 tools/install_pip.sh     |  8 +++++++
 tools/install_prereqs.sh |  3 +++
 5 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index 59668a2c6a..c157604699 100644
--- a/inc/python
+++ b/inc/python
@@ -28,10 +28,13 @@ declare -A PROJECT_VENV
 # Get the path to the pip command.
 # get_pip_command
 function get_pip_command {
-    which pip || which pip-python
+    local version="$1"
+    # NOTE(dhellmann): I don't know if we actually get a pip3.4-python
+    # under any circumstances.
+    which pip${version} || which pip${version}-python
 
     if [ $? -ne 0 ]; then
-        die $LINENO "Unable to find pip; cannot continue"
+        die $LINENO "Unable to find pip${version}; cannot continue"
     fi
 }
 
@@ -66,6 +69,13 @@ function pip_install_gr {
     pip_install $clean_name
 }
 
+# Determine the python versions supported by a package
+function get_python_versions_for_package {
+    local name=$1
+    cd $name && python setup.py --classifiers \
+        | grep 'Language' | cut -f5 -d: | grep '\.' | tr '\n' ' '
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
@@ -104,8 +114,22 @@ function pip_install {
             local sudo_pip="env"
         else
             local cmd_pip
-            cmd_pip=$(get_pip_command)
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
             local sudo_pip="sudo -H"
+            if python3_enabled; then
+                # Look at the package classifiers to find the python
+                # versions supported, and if we find the version of
+                # python3 we've been told to use, use that instead of the
+                # default pip
+                local package_dir=${!#}
+                local python_versions
+                if [[ -d "$package_dir" ]]; then
+                    python_versions=$(get_python_versions_for_package $package_dir)
+                    if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
+                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                    fi
+                fi
+            fi
         fi
     fi
 
@@ -113,6 +137,8 @@ function pip_install {
     # Always apply constraints
     cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
 
+    # FIXME(dhellmann): Need to force multiple versions of pip for
+    # packages like setuptools?
     local pip_version
     pip_version=$(python -c "import pip; \
                         print(pip.__version__.strip('.')[0])")
@@ -276,6 +302,21 @@ function setup_package {
     fi
 }
 
+# Report whether python 3 should be used
+function python3_enabled {
+    if [[ $USE_PYTHON3 == "True" ]]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Install python3 packages
+function install_python3 {
+    if is_ubuntu; then
+        apt_get install python3.4 python3.4-dev
+    fi
+}
 
 # Restore xtrace
 $INC_PY_TRACE
diff --git a/lib/stack b/lib/stack
index 7d98604b82..f09ddcee85 100644
--- a/lib/stack
+++ b/lib/stack
@@ -19,6 +19,7 @@
 function stack_install_service {
     local service=$1
     if type install_${service} >/dev/null 2>&1; then
+        # FIXME(dhellmann): Needs to be python3-aware at some point.
         if [[ ${USE_VENV} = True && -n ${PROJECT_VENV[$service]:-} ]]; then
             rm -rf ${PROJECT_VENV[$service]}
             source $TOP_DIR/tools/build_venv.sh ${PROJECT_VENV[$service]} ${ADDITIONAL_VENV_PACKAGES//,/ }
diff --git a/stackrc b/stackrc
index 5dd109c0a4..f949ccbad9 100644
--- a/stackrc
+++ b/stackrc
@@ -118,6 +118,17 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
 fi
 
+# Control whether Python 3 should be used.
+export USE_PYTHON3=${USE_PYTHON3:-False}
+
+# When Python 3 is supported by an application, adding the specific
+# version of Python 3 to this variable will install the app using that
+# version of the interpreter instead of 2.7.
+export PYTHON3_VERSION=${PYTHON3_VERSION:-3.4}
+
+# Just to be more explicit on the Python 2 version to use.
+export PYTHON2_VERSION=${PYTHON2_VERSION:-2.7}
+
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then
     # Old-style user-supplied config
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index ab5efb2e77..f239c7bb16 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -8,6 +8,7 @@
 
 # Assumptions:
 # - update pip to $INSTALL_PIP_VERSION
+# - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
 
 set -o errexit
 set -o xtrace
@@ -31,6 +32,8 @@ GetDistro
 echo "Distro: $DISTRO"
 
 function get_versions {
+    # FIXME(dhellmann): Deal with multiple python versions here? This
+    # is just used for reporting, so maybe not?
     PIP=$(which pip 2>/dev/null || which pip-python 2>/dev/null || true)
     if [[ -n $PIP ]]; then
         PIP_VERSION=$($PIP --version | awk '{ print $2}')
@@ -75,6 +78,9 @@ function install_get_pip {
         touch $LOCAL_PIP.downloaded
     fi
     sudo -H -E python $LOCAL_PIP
+    if python3_enabled; then
+        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    fi
 }
 
 
@@ -114,6 +120,7 @@ get_versions
 # python in f23 depends on the python-pip package
 if ! { is_fedora && [[ $DISTRO == "f23" ]]; }; then
     uninstall_package python-pip
+    uninstall_package python3-pip
 fi
 
 install_get_pip
@@ -122,6 +129,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
+set -x
 pip_install -U setuptools
 
 get_versions
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 38452cd90f..031f8a8eca 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -81,6 +81,9 @@ if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     fi
 fi
 
+if python3_enabled; then
+    install_python3
+fi
 
 # Mark end of run
 # ---------------

From 88ee8ce4684e13865123636dd5d2baa5d6a44ef7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 2 Dec 2015 07:47:31 -0500
Subject: [PATCH 1050/3333] create apt_get_update to try to work around broken
 mirrors

Ubuntu's apt mirroring mechanism produces inconsistent mirrors pretty
regularly. The devstack-gate apt-get update model seems to have been
more effective getting past this than what we did in devstack. Adopt
that method for our updates.

Change-Id: I97c7896ef38b275aacb4f933fc849acee1bab858
---
 functions-common | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index d68ae77971..d4099ffcfa 100644
--- a/functions-common
+++ b/functions-common
@@ -978,6 +978,34 @@ function _get_package_dir {
     echo "$pkg_dir"
 }
 
+# Wrapper for ``apt-get update`` to try multiple times on the update
+# to address bad package mirrors (which happen all the time).
+function apt_get_update {
+    # only do this once per run
+    if [[ "$REPOS_UPDATED" == "True" && "$RETRY_UPDATE" != "True" ]]; then
+        return
+    fi
+
+    # bail if we are offline
+    [[ "$OFFLINE" = "True" ]] && return
+
+    local sudo="sudo"
+    [[ "$(id -u)" = "0" ]] && sudo="env"
+
+    # time all the apt operations
+    time_start "apt-get-update"
+
+    local proxies="http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} no_proxy=${no_proxy:-} "
+    local update_cmd="$sudo $proxies apt-get update"
+    if ! timeout 300 sh -c "while ! $update_cmd; do sleep 30; done"; then
+        die $LINENO "Failed to update apt repos, we're dead now"
+    fi
+
+    REPOS_UPDATED=True
+    # stop the clock
+    time_stop "apt-get-update"
+}
+
 # Wrapper for ``apt-get`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``*_proxy``
 # apt_get operation package [package ...]
@@ -1158,16 +1186,7 @@ function update_package_repo {
     fi
 
     if is_ubuntu; then
-        local xtrace
-        xtrace=$(set +o | grep xtrace)
-        set +o xtrace
-        if [[ "$REPOS_UPDATED" != "True" || "$RETRY_UPDATE" = "True" ]]; then
-            # if there are transient errors pulling the updates, that's fine.
-            # It may be secondary repositories that we don't really care about.
-            apt_get update  || /bin/true
-            REPOS_UPDATED=True
-        fi
-        $xtrace
+        apt_get_update
     fi
 }
 

From 41d01104b16bf5d0d6d4d7d2a1e5883d34bff810 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 3 Dec 2015 08:12:23 -0500
Subject: [PATCH 1051/3333] remove generic extras.d support

This removes the generic extras.d support, which we said we'd do at
Mitaka-1. In tree extras.d continues to function as before, though we
need stories to get ceph and ironic into plugins, and a better
solution for Tempest.

Change-Id: I8b134446dc08a2c3852423ca71af2f469f85496e
---
 functions-common | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/functions-common b/functions-common
index d68ae77971..91a148603b 100644
--- a/functions-common
+++ b/functions-common
@@ -1741,17 +1741,18 @@ function run_phase {
     if [[ -d $TOP_DIR/extras.d ]]; then
         local extra_plugin_file_name
         for extra_plugin_file_name in $TOP_DIR/extras.d/*.sh; do
-            [[ -r $extra_plugin_file_name ]] && source $extra_plugin_file_name $mode $phase
-            # NOTE(sdague): generate a big warning about using
-            # extras.d in an unsupported way which will let us track
-            # unsupported usage in the gate.
+            # NOTE(sdague): only process extras.d for the 3 explicitly
+            # white listed elements in tree. We want these to move out
+            # over time as well, but they are in tree, so we need to
+            # manage that.
             local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
             local extra
             extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
-                deprecated "extras.d support is being removed in Mitaka-1"
-                deprecated "jobs for project $extra will break after that point"
-                deprecated "please move project to a supported devstack plugin model"
+                warn "use of extras.d is no longer supported"
+                warn "processing of project $extra is skipped"
+            else
+                [[ -r $extra_plugin_file_name ]] && source $extra_plugin_file_name $mode $phase
             fi
         done
     fi

From 2391d4321ffe3a0a482e01d133038dfd38c76bac Mon Sep 17 00:00:00 2001
From: Devananda van der Veen <devananda.vdv@gmail.com>
Date: Thu, 3 Dec 2015 09:16:18 -0800
Subject: [PATCH 1052/3333] Update lib/ironic to always skip cleaning

Previously, devstack would disable ironic's cleaning phase if a driver
with "agent" in the name was used. However, we have begun using the IPA
ramdisk for all tests in the gate, which caused cleaning to be run for
the "pxe_ssh" job which therefore fails due to timeouts.

As a result, for now, we need to always disable cleaning.

As a point of record, we should actually be testing cleaning in the
gate. However, running 'shred' on the disks of a nested VM is too slow
and causes the gate to timeout // take too long. Some options have been
discussed for ways to test the callback mechanism but avoid actually
running 'shred' on the disks.

This needs to be revisited.

Change-Id: Id15cf6cc49122b08e557e44871b31a8c0d20b55d
Related-to-Bug: #1517277
---
 lib/ironic | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 27b0c8d4ff..2fb2004d71 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -365,6 +365,9 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE pxe pxe_append_params "$pxe_params"
     fi
 
+    # Set these options for scenarios in which the agent fetches the image
+    # directly from glance, and don't set them where the image is pushed
+    # over iSCSI.
     if is_deployed_by_agent; then
         if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
             iniset $IRONIC_CONF_FILE glance swift_temp_url_key $SWIFT_TEMPURL_KEY
@@ -379,9 +382,13 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
         iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
-        iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
     fi
 
+    # FIXME: this really needs to be tested in the gate.
+    # For now, any test using the agent ramdisk should skip cleaning
+    # because it is too slow to run in the gate.
+    iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
+
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
         local pxebin
         pxebin=`basename $IRONIC_PXE_BOOT_IMAGE`

From 7b7101f1c5ccd4d0722245613df8c8f7a67e79b9 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Tue, 1 Dec 2015 22:17:42 +0000
Subject: [PATCH 1053/3333] Neutron FWaaS: Use generated configuration files if
 available

Generate the Neutron FWaaS sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Ic8208850a27408c8fbeed80ecdb43345aa7dfaa4
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I8e9113dfb88e5290f6eedd012d1a52fc35c3c88c
---
 lib/neutron_plugins/services/firewall | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 1d81a21825..2b7f32d233 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -14,8 +14,11 @@ function neutron_fwaas_configure_common {
 }
 
 function neutron_fwaas_configure_driver {
+    # Uses oslo config generator to generate FWaaS sample configuration files
+    (cd $NEUTRON_FWAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+
     FWAAS_DRIVER_CONF_FILENAME=/etc/neutron/fwaas_driver.ini
-    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini $FWAAS_DRIVER_CONF_FILENAME
+    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini.sample $FWAAS_DRIVER_CONF_FILENAME
 
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"

From 2a688440132173d493dff7c7c3760681d41e11be Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Tue, 8 Dec 2015 13:26:29 +0000
Subject: [PATCH 1054/3333] Heat - revise keystone/trusts config to avoid
 deprecated options

There are some inter-related changes required to avoid using legacy
fallback/deprecated paths in heat, which result in warnings in the
log, e.g because we fall-back to reusing keystone auth_token
configuration instead of heat specific sections.

To fix this:
- Don't explicitly set deferred_auth_method=trusts, as this is now
  the default (since kilo)
- Create a new "trustee" section containing configuration used for
  the password auth-plugin associated with deferred authentication
  via trusts (support for this was added during liberty to enable
  us to stop incorrectly using the keystone auth_token config)
- Create a "clients_keystone" section to avoid falling back to the
  legacy behavior of stealing the uri from auth_token.

This also means we can remove the FIXME and auth_token auth_uri
mentioned by jamielennox.

Change-Id: Ie34332a7aec3b9b271df0759dd6ab66b45302832
Related-Bug: #1300246
---
 lib/heat | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/lib/heat b/lib/heat
index fdcf5bcaad..3666776317 100644
--- a/lib/heat
+++ b/lib/heat
@@ -56,6 +56,10 @@ HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
 HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
+HEAT_SERVICE_USER=${HEAT_SERVICE_USER:-heat}
+HEAT_TRUSTEE_USER=${HEAT_TRUSTEE_USER:-$HEAT_SERVICE_USER}
+HEAT_TRUSTEE_PASSWORD=${HEAT_TRUSTEE_PASSWORD:-$SERVICE_PASSWORD}
+HEAT_TRUSTEE_DOMAIN=${HEAT_TRUSTEE_DOMAIN:-default}
 
 # Support entry points installation of console scripts
 HEAT_BIN_DIR=$(get_python_exec_prefix)
@@ -73,7 +77,7 @@ if [[ "$HEAT_STANDALONE" = "True" ]]; then
     fi
 else
     HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
-    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
+    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-}
 fi
 HEAT_PLUGIN_DIR=${HEAT_PLUGIN_DIR:-$DATA_DIR/heat/plugins}
 ENABLE_HEAT_PLUGINS=${ENABLE_HEAT_PLUGINS:-}
@@ -134,30 +138,39 @@ function configure_heat {
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
-    iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
+    if [ ! -z "$HEAT_DEFERRED_AUTH" ]; then
+        iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
+    fi
 
     if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
         _config_heat_apache_wsgi
     fi
 
-    # NOTE(jamielennox): heat re-uses specific values from the
-    # keystone_authtoken middleware group and so currently fails when using the
-    # auth plugin setup. This should be fixed in heat.  Heat is also the only
-    # service that requires the auth_uri to include a /v2.0. Remove this custom
-    # setup when bug #1300246 is resolved.
-    iniset $HEAT_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
     if [[ "$HEAT_STANDALONE" = "True" ]]; then
         iniset $HEAT_CONF paste_deploy flavor standalone
         iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
     else
         iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-        iniset $HEAT_CONF keystone_authtoken admin_user heat
+        iniset $HEAT_CONF keystone_authtoken admin_user $HEAT_SERVICE_USER
         iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
         iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
         iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
         iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
     fi
 
+    # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure
+    # the section for the client plugin associated with the trustee
+    if [ -z "$HEAT_DEFERRED_AUTH" -o "trusts" == "$HEAT_DEFERRED_AUTH" ]; then
+        iniset $HEAT_CONF trustee auth_plugin password
+        iniset $HEAT_CONF trustee auth_url $KEYSTONE_AUTH_URI
+        iniset $HEAT_CONF trustee username $HEAT_TRUSTEE_USER
+        iniset $HEAT_CONF trustee password $HEAT_TRUSTEE_PASSWORD
+        iniset $HEAT_CONF trustee user_domain_id $HEAT_TRUSTEE_DOMAIN
+    fi
+
+    # clients_keystone
+    iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
+
     # ec2authtoken
     iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
 

From 642b07b930cf5f49d1ed9aa220021d45ca631b1a Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyam.mann@nectechnologies.in>
Date: Thu, 19 Nov 2015 10:01:14 +0900
Subject: [PATCH 1055/3333] Add compute microversions configuration on tempest

Many projects like Nova, Ironic etc have implemented the
microversions for versioning their APIs.

Tempest is going to tests those microversions -
I57b78b4c0543b6fb0533b556886a19a03297555e.

For testing microversion in Tempest on gate, we need to set
a valid range of microversion in Tempest config and based on that
Tempest will run appropriate tests.

This commit adds the below range options for compute microversion testing-
- [None, 'latest'] - for master branch as default
- [None, None] - for tests running on v2.0
- option to set the range.

Depends-On: I81e86faca6f8c0ffb7da22154a62236ac25cf0c0

Partially implements blueprint api-microversions-testing-support

Change-Id: I171b862d1bba1af467f5b9a76288216c39e2adda
---
 lib/tempest | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6adc449ad0..61351c0628 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -357,6 +357,30 @@ function configure_tempest {
         compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
     fi
 
+    # Set the microversion range for compute tests.
+    # This is used to run the Nova microversions tests.
+    # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.
+    # NOTE- To avoid microversion tests failure on stable branch, we need to change "tempest_compute_max_microversion"
+    #       for stable branch on each release which should be changed from "latest" to max supported version of that release.
+    local tempest_compute_min_microversion=${TEMPEST_COMPUTE_MIN_MICROVERSION:-None}
+    local tempest_compute_max_microversion=${TEMPEST_COMPUTE_MAX_MICROVERSION:-"latest"}
+    # Reset microversions to None where v2.0 is running which does not support microversion.
+    # Both "None" means no microversion testing.
+    if [[ "$TEMPEST_COMPUTE_TYPE" == "compute_legacy" ]]; then
+        tempest_compute_min_microversion=None
+        tempest_compute_max_microversion=None
+    fi
+    if [ "$tempest_compute_min_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG compute-feature-enabled min_microversion
+    else
+        iniset $TEMPEST_CONFIG compute-feature-enabled min_microversion $tempest_compute_min_microversion
+    fi
+    if [ "$tempest_compute_max_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG compute-feature-enabled max_microversion
+    else
+        iniset $TEMPEST_CONFIG compute-feature-enabled max_microversion $tempest_compute_max_microversion
+    fi
+
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From af0801de3c1b1c51cf1a995c2939e182d2ef4926 Mon Sep 17 00:00:00 2001
From: Philipp Marek <philipp.marek@linbit.com>
Date: Wed, 9 Dec 2015 13:51:56 +0100
Subject: [PATCH 1056/3333] Make logfile symlinks with relative names.

Using absolute names for the symlink breaks in quite a few ways;
 * when creating a tar file of the logs,
 * when serving via NFS,

or any other case where the directory gets transferred to
a different machine.

So just create the symlink with relative names, then they'll work
in any location.

Change-Id: I432a69754985fc71feb0068b7adca01066d7bc1b
---
 functions-common | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index d4099ffcfa..0c5e48cadf 100644
--- a/functions-common
+++ b/functions-common
@@ -1309,10 +1309,11 @@ function _run_process {
     exec 3>&-
     exec 6>&-
 
-    local real_logfile="${LOGDIR}/${service}.log.${CURRENT_LOG_TIME}"
+    local logfile="${service}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
     if [[ -n ${LOGDIR} ]]; then
         exec 1>&"$real_logfile" 2>&1
-        ln -sf "$real_logfile" ${LOGDIR}/${service}.log
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
         if [[ -n ${SCREEN_LOGDIR} ]]; then
             # Drop the backward-compat symlink
             ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
@@ -1399,7 +1400,8 @@ function screen_process {
 
     screen -S $SCREEN_NAME -X screen -t $name
 
-    local real_logfile="${LOGDIR}/${name}.log.${CURRENT_LOG_TIME}"
+    local logfile="${name}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
     echo "LOGDIR: $LOGDIR"
     echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
     echo "log: $real_logfile"
@@ -1410,7 +1412,7 @@ function screen_process {
         fi
         # If logging isn't active then avoid a broken symlink
         touch "$real_logfile"
-        ln -sf "$real_logfile" ${LOGDIR}/${name}.log
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${name}.log"
         if [[ -n ${SCREEN_LOGDIR} ]]; then
             # Drop the backward-compat symlink
             ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${1}.log

From 56632fc75ddd4af3239c44e27673854dd65f4628 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 10 Dec 2015 05:57:19 -0800
Subject: [PATCH 1057/3333] Fix override-defaults in plugin docs

Docs specify that this file should be override_defaults, when really
devstack looks for override-defaults.

Change-Id: I3900ec4d16ffb48c6969dac5081ea2817536c246
---
 doc/source/plugins.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index b8da7e1237..83e5609efa 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -21,12 +21,12 @@ external repositories. The plugin interface assumes the following:
 An external git repository that includes a ``devstack/`` top level
 directory. Inside this directory there can be 3 files.
 
-- ``override_defaults`` - a file containing global variables that
+- ``override-defaults`` - a file containing global variables that
   will be sourced before the lib/* files. This allows the plugin
   to override the defaults that are otherwise set in the lib/*
   files.
 
-  For example, override_defaults may export CINDER_ENABLED_BACKENDS
+  For example, override-defaults may export CINDER_ENABLED_BACKENDS
   to include the plugin-specific storage backend and thus be able
   to override the default lvm only storage backend for Cinder.
 

From 9fc3ba408a97d0dd39ce26dd8dbcdb3b110cde71 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 10 Dec 2015 13:33:28 +0000
Subject: [PATCH 1058/3333] Ironic: add flag for using plugin

This adds a flag to skip ironic code if the ironic devstack plugin is in
use. This flag will be set to true in ironic's devstack plugin to
indicate that the plugin should be in control, rather than devstack.

This is for the transition period only, and will be removed with the
rest of the ironic code in the devstack tree, once the gate
is configured to use the ironic plugin.

Change-Id: Id01d97fd13fa9f866d645ec5077834ddb78b2b89
---
 extras.d/50-ironic.sh | 7 +++++++
 lib/ironic            | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/extras.d/50-ironic.sh b/extras.d/50-ironic.sh
index 3b8e3d5045..0ee6a94758 100644
--- a/extras.d/50-ironic.sh
+++ b/extras.d/50-ironic.sh
@@ -1,5 +1,12 @@
 # ironic.sh - Devstack extras script to install ironic
 
+# NOTE(jroll) this is used for the transition to a devstack plugin in
+# the ironic tree.
+IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
+if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
+    return 0
+fi
+
 if is_service_enabled ir-api ir-cond; then
     if [[ "$1" == "source" ]]; then
         # Initial source
diff --git a/lib/ironic b/lib/ironic
index 2fb2004d71..dd4f8bf65f 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -26,6 +26,13 @@ _PIPEFAIL_IRONIC=$(set +o | grep pipefail)
 set +o xtrace
 set +o pipefail
 
+# NOTE(jroll) this is used for the transition to a devstack plugin in
+# the ironic tree.
+IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
+if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
+    return 0
+fi
+
 # Defaults
 # --------
 

From 10bff0e9968d7a9c59ea7f09f49775973f8b5008 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Thu, 3 Dec 2015 15:18:10 +0000
Subject: [PATCH 1059/3333] Neutron LBaaS: Use generated configuration files if
 available

Generate the Neutron LBaaS sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Iae1e581ec2bea9c0ced700229effcc716d53fe4e
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I25507f3bc6e995580aa91a912c2cf4110757df15
---
 lib/neutron-legacy                        | 11 +++++++++--
 lib/neutron_plugins/services/loadbalancer |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index caf89e3d8c..628f6463d1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -112,6 +112,9 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
+# Default provider for load balancer service
+DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -1058,8 +1061,12 @@ function _configure_neutron_ceilometer_notifications {
 }
 
 function _configure_neutron_lbaas {
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
+    # Uses oslo config generator to generate LBaaS sample configuration files
+    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
+        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
     fi
     neutron_agent_lbaas_configure_common
     neutron_agent_lbaas_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index b07d06c32b..30e9480f2e 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -28,7 +28,7 @@ function neutron_agent_lbaas_configure_agent {
 
     LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
 
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini $LBAAS_AGENT_CONF_FILENAME
+    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
 
     # ovs_use_veth needs to be set before the plugin configuration
     # occurs to allow plugins to override the setting.

From e42306d9db86a6cbb7cf1c062d8a5bdcd8479654 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 10 Dec 2015 14:54:01 -0500
Subject: [PATCH 1060/3333] only set admin_* options for eventlet

keystone+apache don't need these values set.

Change-Id: Iebdb31b5f0888613e0454f09a426933d6fcd71b3
see: http://lists.openstack.org/pipermail/openstack-dev/2015-December/081984.html
---
 lib/keystone | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index b19202b0f7..6b4118de0b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -218,8 +218,6 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
-    iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
-
     # Register SSL certificates if provided
     if is_ssl_enabled_service key; then
         ensure_certificates KEYSTONE
@@ -296,13 +294,14 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(funcName)s %(pathname)s:%(lineno)d"
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
+    else
+        iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
+        iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
+        # Public workers will use the server default, typically number of CPU.
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
-    iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
-    # Public workers will use the server default, typically number of CPU.
-
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 }
 

From 69431725eb526d9daf320d7a05cccf22d10eaafd Mon Sep 17 00:00:00 2001
From: Anusha Ramineni <anusha.ramineni@nectechnologies.in>
Date: Tue, 8 Dec 2015 12:04:27 +0530
Subject: [PATCH 1061/3333] Add congress to plugin registry

Now congress supports devstack plugin model, hence including the
same in plugin registry

Change-Id: I1ac83c529a466e6a75a9b46ed9b56085140a63ed
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 49b3a7fc02..c68d926822 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |ceilometer        |git://git.openstack.org/openstack/ceilometer | metering           |
 +------------------+---------------------------------------------+--------------------+
+|congress          |git://git.openstack.org/openstack/congress   | governance         |
++------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
 +------------------+---------------------------------------------+--------------------+
 |magnum            |git://git.openstack.org/openstack/magnum     |                    |

From 357dff588ef63935a2a36e89b1aa96419ef09ece Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean_mcginnis@dell.com>
Date: Fri, 11 Dec 2015 13:51:24 -0600
Subject: [PATCH 1062/3333] Remove Cinder API version cap

Cinder API was pinned to v1 due to openstackclient missing some of the
v2 commands, as reported in osc bug 1475060. That bug has since been
marked invalid, but its intent was covered by the blueprint:

https://blueprints.launchpad.net/python-openstackclient/+spec/volume-v2

This removes the pinning to the v1 API now that osc supports v2. Also
removing the enablement of v1 as it was deprecated three releases ago
and we would like to get more coverage on v2.

Change-Id: Ia4d97734738d026c8721791669110778ff5eb6e5
---
 lib/cinder | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2119858253..569f3ab0a3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -270,10 +270,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
-    # NOTE(thingee): Cinder V1 API is deprecated and defaults to off as of
-    # Juno. Keep it enabled so we can continue testing while it's still
-    # supported.
-    iniset $CINDER_CONF DEFAULT enable_v1_api true
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
@@ -550,9 +546,7 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            # FIXME(jamielennox): Remove --os-volume-api-version pinning when
-            # osc supports volume type create on v2 api. bug #1475060
-            openstack volume type create --os-volume-api-version 1 --property volume_backend_name="${be_name}" ${be_name}
+            openstack volume type create --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }

From cf4f76299f84135a03fe29e5eddc97490eba806a Mon Sep 17 00:00:00 2001
From: Mahito OGURA <m.ogura@ntt.com>
Date: Wed, 12 Aug 2015 10:21:27 +0900
Subject: [PATCH 1063/3333] Update the vnc config options group 'DEFAULT' to
 'vnc'

n-api log output WARNINGs that vnc config options group 'DEFAULT'
is deprecated. New vnc config options group is 'vnc'.
This is change of Nova.[1]
This patch changes the vnc config options group 'DEFAULT' to 'vnc'.

[1] https://bugs.launchpad.net/nova/+bug/1447528

Change-Id: If54f750bac83298e90bdca27b5992fe2e5fbb712
Closes-Bug: 1483583
---
 lib/nova                            | 12 ++++++------
 lib/nova_plugins/hypervisor-libvirt | 10 +++++-----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/nova b/lib/nova
index 6337f875ef..3e3f0f49ac 100644
--- a/lib/nova
+++ b/lib/nova
@@ -594,9 +594,9 @@ function create_nova_conf {
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        iniset $NOVA_CONF DEFAULT novncproxy_base_url "$NOVNCPROXY_URL"
+        iniset $NOVA_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        iniset $NOVA_CONF DEFAULT xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        iniset $NOVA_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
         SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
         iniset $NOVA_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
@@ -606,13 +606,13 @@ function create_nova_conf {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF DEFAULT vnc_enabled true
-        iniset $NOVA_CONF DEFAULT vncserver_listen "$VNCSERVER_LISTEN"
-        iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CONF vnc enabled true
+        iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
+        iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF DEFAULT xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
-        iniset $NOVA_CONF DEFAULT vnc_enabled false
+        iniset $NOVA_CONF vnc enabled false
     fi
 
     if is_service_enabled n-spice; then
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 8bbaa2133d..1b4f7ae80a 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -48,13 +48,13 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
     # Power architecture currently does not support graphical consoles.
     if is_arch "ppc64"; then
-        iniset $NOVA_CONF DEFAULT vnc_enabled "false"
+        iniset $NOVA_CONF vnc enabled "false"
     fi
 
     # arm64-specific configuration
     if is_arch "aarch64"; then
         # arm64 architecture currently does not support graphical consoles.
-        iniset $NOVA_CONF DEFAULT vnc_enabled "false"
+        iniset $NOVA_CONF vnc enabled "false"
     fi
 
     # File injection is being disabled by default in the near future -
@@ -65,9 +65,9 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
         iniset $NOVA_CONF DEFAULT force_raw_images  "False"
-        iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address  $HOST_IP
-        iniset $NOVA_CONF DEFAULT vncserver_listen $HOST_IP
-        iniset $NOVA_CONF DEFAULT vnc_keymap
+        iniset $NOVA_CONF vnc vncserver_proxyclient_address  $HOST_IP
+        iniset $NOVA_CONF vnc vncserver_listen $HOST_IP
+        iniset $NOVA_CONF vnc keymap
     fi
 }
 

From 76cbbe37aae5d54542d62a5c6deec428a8cdc75e Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Mon, 7 Dec 2015 05:05:04 -0500
Subject: [PATCH 1064/3333] libvirt: don't repeatedly configure libvirtd
 logging

/etc/libvirt is not world-readable (at least on Fedora and RHEL) so
use sudo with the grep that checks whether we have already configured
libvirtd logging. Also, change the regex so we don't count commented
out logging config.

Change-Id: I67484b28aafd0fa828385321fa96d9141cb4cb59
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
---
 lib/nova_plugins/functions-libvirt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dae55c6eba..4f9b239a1e 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -110,10 +110,10 @@ EOF
             local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
         fi
         local log_outputs="1:file:/var/log/libvirt/libvirtd.log"
-        if ! grep -q "log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then
+        if ! sudo grep -q "^log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then
             echo "log_filters=\"$log_filters\"" | sudo tee -a /etc/libvirt/libvirtd.conf
         fi
-        if ! grep -q "log_outputs=\"$log_outputs\"" /etc/libvirt/libvirtd.conf; then
+        if ! sudo grep -q "^log_outputs=\"$log_outputs\"" /etc/libvirt/libvirtd.conf; then
             echo "log_outputs=\"$log_outputs\"" | sudo tee -a /etc/libvirt/libvirtd.conf
         fi
     fi

From 239a9788b3f73495efbdf586425a83d714be4412 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Mon, 7 Dec 2015 17:09:59 +0900
Subject: [PATCH 1065/3333] Remove a stale comment about
 SQLALCHEMY_DATABASE_DRIVER

SQLALCHEMY_DATABASE_DRIVER is no longer used
after If6d8d08e5b7b7c48ca012677b536d71058def6fd .

Also, remove mysql connector packages from the install list.

Closes-Bug: #1523377
Related-Bug: #1493304
Change-Id: I5ecbc3b0bac989faa5c46d3c2866558a505414d8
---
 files/debs/keystone |  1 -
 files/debs/neutron  |  1 -
 files/debs/nova     |  1 -
 files/rpms/neutron  |  1 -
 files/rpms/nova     |  1 -
 stackrc             | 12 ------------
 6 files changed, 17 deletions(-)

diff --git a/files/debs/keystone b/files/debs/keystone
index 0795167047..370e4aac51 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,6 +1,5 @@
 libkrb5-dev
 libldap2-dev
 libsasl2-dev
-python-mysql.connector
 python-mysqldb
 sqlite3
diff --git a/files/debs/neutron b/files/debs/neutron
index 85145d3654..e53cc68ccf 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -8,7 +8,6 @@ iputils-ping
 libmysqlclient-dev
 mysql-server #NOPRIME
 postgresql-server-dev-all
-python-mysql.connector
 python-mysqldb
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
diff --git a/files/debs/nova b/files/debs/nova
index fe57fc4b2a..58dad411a8 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -15,7 +15,6 @@ libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
 pm-utils
-python-mysql.connector
 python-mysqldb
 qemu # dist:wheezy,jessie NOPRIME
 qemu-kvm # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 9683475d29..2e49a0cf93 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -4,7 +4,6 @@ dnsmasq-utils # for dhcp_release
 ebtables
 iptables
 iputils
-mysql-connector-python
 mysql-devel
 MySQL-python
 mysql-server # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 00e759636e..4db9a06d95 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -15,7 +15,6 @@ libvirt-devel # NOPRIME
 libvirt-python # NOPRIME
 libxml2-python
 m2crypto
-mysql-connector-python
 mysql-devel
 MySQL-python
 mysql-server # NOPRIME
diff --git a/stackrc b/stackrc
index 5dd109c0a4..0c311ad65b 100644
--- a/stackrc
+++ b/stackrc
@@ -72,18 +72,6 @@ if ! isset ENABLED_SERVICES ; then
     ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
 fi
 
-# SQLAlchemy supports multiple database drivers for each database server
-# type. For example, deployer may use MySQLdb, MySQLConnector, or oursql
-# to access MySQL database.
-#
-# When defined, the variable controls which database driver is used to
-# connect to database server. Otherwise using default driver defined for
-# each database type.
-#
-# You can find the list of currently supported drivers for each database
-# type at: http://docs.sqlalchemy.org/en/rel_0_9/core/engines.html
-# SQLALCHEMY_DATABASE_DRIVER="mysqldb"
-
 # Global toggle for enabling services under mod_wsgi. If this is set to
 # ``True`` all services that use HTTPD + mod_wsgi as the preferred method of
 # deployment, will be deployed under Apache. If this is set to ``False`` all

From 2b4d6d16211cc55794b7d96594394f5e8c40fa4b Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Fri, 4 Dec 2015 14:40:03 +0000
Subject: [PATCH 1066/3333] Neutron VPNaaS: Use generated configuration files
 if available

Generate the Neutron VPNaaS sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Icef8f7e8f0e8e78bfffa7a5af3f9f2300376b115
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I4a6094b8218dfd320d05bfb1e3bc121e8930c551
---
 lib/neutron-legacy               | 6 ++++--
 lib/neutron_plugins/services/vpn | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index caf89e3d8c..0089a0d4cf 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1079,8 +1079,10 @@ function _configure_neutron_fwaas {
 }
 
 function _configure_neutron_vpn {
-    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf ]; then
-        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf $NEUTRON_CONF_DIR
+    # Uses oslo config generator to generate VPNaaS sample configuration files
+    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample ]; then
+        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample $NEUTRON_CONF_DIR/neutron_vpnaas.conf
     fi
     neutron_vpn_install_agent_packages
     neutron_vpn_configure_common
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 8a379f588c..e790913847 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -29,7 +29,9 @@ function neutron_vpn_configure_common {
 }
 
 function neutron_vpn_configure_agent {
-    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+    # Uses oslo config generator to generate LBaaS sample configuration files
+    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini.sample $Q_VPN_CONF_FILE
     if [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
         iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
         if is_fedora; then

From 97b9e970b27f2303b8404aaa31a9f2e7d51ee787 Mon Sep 17 00:00:00 2001
From: Dave Chen <wei.d.chen@intel.com>
Date: Tue, 15 Dec 2015 03:33:48 +0800
Subject: [PATCH 1067/3333] Remove the support for keystone extensions

All keystone extensions have been moved into cores and are
enabled by default, there is no need to configure the extension
in devstack but configure it in devstack will block the
install process.

Change-Id: I7d21b122c641f601295ee7ece3583404b3874dbd
Closes-Bug: #1526033
---
 lib/keystone | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 6b4118de0b..336ad12cbb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -52,10 +52,6 @@ KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 
-# Set up additional extensions, such as oauth1, federation
-# Example of KEYSTONE_EXTENSIONS=oauth1,federation
-KEYSTONE_EXTENSIONS=${KEYSTONE_EXTENSIONS:-}
-
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
@@ -192,8 +188,6 @@ function configure_keystone {
         inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
     fi
 
-    configure_keystone_extensions
-
     # Rewrite stock ``keystone.conf``
 
     if is_service_enabled ldap; then
@@ -305,25 +299,6 @@ function configure_keystone {
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 }
 
-function configure_keystone_extensions {
-    # Add keystone extension into keystone v3 application pipeline
-    local extension_value
-    local api_v3
-    local extension
-    local api_v3_extension
-    for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
-        if [[ -z "${extension_value}" ]]; then
-            continue
-        fi
-        api_v3=$(iniget $KEYSTONE_PASTE_INI pipeline:api_v3 pipeline)
-        extension=$(echo $api_v3 | sed -ne "/${extension_value}/ p;" )
-        if [[ -z $extension ]]; then
-            api_v3_extension=$(echo $api_v3 | sed -ne "s/service_v3/${extension_value}_extension service_v3/p;" )
-            iniset $KEYSTONE_PASTE_INI pipeline:api_v3 pipeline "$api_v3_extension"
-        fi
-    done
-}
-
 # create_keystone_accounts() - Sets up common required keystone accounts
 
 # Tenant               User       Roles
@@ -468,14 +443,6 @@ function init_keystone {
     # Initialize keystone database
     $KEYSTONE_BIN_DIR/keystone-manage db_sync
 
-    local extension_value
-    for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
-        if [[ -z "${extension_value}" ]]; then
-            continue
-        fi
-        $KEYSTONE_BIN_DIR/keystone-manage db_sync --extension "${extension_value}"
-    done
-
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl

From 43f62c08499de004a964c3a2f90ce400a0f932ad Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Tue, 15 Dec 2015 16:44:41 +0900
Subject: [PATCH 1068/3333] Move horizon config and start to appropriate phase
 in stack.sh

Previously horizon configuration and start are done too early
and as a result horizon init and start need to be run twice
after horizon plugins are enabled.
- horizon config was done before "run_phase stack install"
- horizon init and start were done before "run_phase stack post-config"

This commit rearrange horizon setup to the appropriate phases
defined in the devstack plugin interface.

- Configuration of horizon settings is moved to configure_horizon.
- horizon config is now called between run_phase stack install
  and post-config.
- horizon init and start are now called between run_phase stack
  post-config and extra.

Change-Id: I8bf2ceaf7734c4f7cec68bc05d7cdbae81ef311e
---
 lib/horizon |  8 +++++---
 stack.sh    | 14 ++++++++------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 67181fcf29..dca31116e2 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -83,10 +83,7 @@ function configure_horizon {
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
     (cd $HORIZON_DIR; ./run_tests.sh -N --compilemessages)
-}
 
-# init_horizon() - Initialize databases, etc.
-function init_horizon {
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
     cp $HORIZON_SETTINGS $local_settings
@@ -113,6 +110,7 @@ function init_horizon {
     horizon_conf=$(apache_site_config_for horizon)
 
     # Configure apache to run horizon
+    # Set up the django horizon application to serve via apache/wsgi
     sudo sh -c "sed -e \"
         s,%USER%,$APACHE_USER,g;
         s,%GROUP%,$APACHE_GROUP,g;
@@ -133,7 +131,10 @@ function init_horizon {
         exit_distro_not_supported "horizon apache configuration"
     fi
     enable_apache_site horizon
+}
 
+# init_horizon() - Initialize databases, etc.
+function init_horizon {
     # Remove old log files that could mess with how DevStack detects whether Horizon
     # has been successfully started (see start_horizon() and functions::screen_it())
     # and run_process
@@ -147,6 +148,7 @@ function init_horizon {
         django_admin=django-admin.py
     fi
 
+    # These need to be run after horizon plugins are configured.
     DJANGO_SETTINGS_MODULE=openstack_dashboard.settings $django_admin collectstatic --noinput
     DJANGO_SETTINGS_MODULE=openstack_dashboard.settings $django_admin compress --force
 
diff --git a/stack.sh b/stack.sh
index 19d05c904a..e65d22f114 100755
--- a/stack.sh
+++ b/stack.sh
@@ -840,7 +840,6 @@ if is_service_enabled horizon; then
     install_django_openstack_auth
     # dashboard
     stack_install_service horizon
-    configure_horizon
 fi
 
 if is_service_enabled heat; then
@@ -1060,12 +1059,9 @@ write_clouds_yaml
 # Horizon
 # -------
 
-# Set up the django horizon application to serve via apache/wsgi
-
 if is_service_enabled horizon; then
-    echo_summary "Configuring and starting Horizon"
-    init_horizon
-    start_horizon
+    echo_summary "Configuring Horizon"
+    configure_horizon
 fi
 
 
@@ -1290,6 +1286,12 @@ if is_service_enabled heat; then
     fi
 fi
 
+if is_service_enabled horizon; then
+    echo_summary "Starting Horizon"
+    init_horizon
+    start_horizon
+fi
+
 
 # Create account rc files
 # =======================

From 563a7e75b7d26275a7416eb4d6641fcfe867b45a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 15 Dec 2015 17:16:19 -0500
Subject: [PATCH 1069/3333] set the validation path to fixed for n-net

See if using fixed IPs for connectivity to hosts is more reliable than
floating ips, which really were not intended for these purposes (at
least in nova-net).

Change-Id: I251710ee9186a68bb3ddc58ca803c33b81c8ac49
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6adc449ad0..e651dc30ed 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -329,6 +329,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
+    # set the equiv validation option here as well to ensure they are
+    # in sync. They shouldn't be separate options.
+    iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
     if [[ ! $(is_service_enabled n-cell) && ! $(is_service_enabled neutron) ]]; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi

From 2ca8af45a78226f29c3251cbef6449a0a51a4c1f Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Tue, 8 Dec 2015 15:36:13 +0900
Subject: [PATCH 1070/3333] Add 5 time measurement points

run_process           process starting time
test_with_retry       process starting time (for neutron legacy)
restart_apache_server Apache HTTPD restart time
wait_for_service      HTTP server waiting time
git_timed             git command execution time

example

========================
DevStack Components Timed
========================

run_process - 52 secs
test_with_retry - 3 secs
apt-get-update - 8 secs
pip_install - 76 secs
restart_apache_server - 9 secs
wait_for_service - 11 secs
git_timed - 127 secs
apt-get - 15 secs

Change-Id: I66140726617450cd9fe9b702092cacf053a20065
---
 functions        | 2 ++
 functions-common | 6 ++++++
 lib/apache       | 2 ++
 3 files changed, 10 insertions(+)

diff --git a/functions b/functions
index 762fc472c2..9495710e92 100644
--- a/functions
+++ b/functions
@@ -357,7 +357,9 @@ CURL_GET="${CURL_GET:-curl -g}"
 function wait_for_service {
     local timeout=$1
     local url=$2
+    time_start "wait_for_service"
     timeout $timeout sh -c "while ! $CURL_GET -k --noproxy '*' -s $url >/dev/null; do sleep 1; done"
+    time_stop "wait_for_service"
 }
 
 
diff --git a/functions-common b/functions-common
index 1b01eefaf9..023203d1fc 100644
--- a/functions-common
+++ b/functions-common
@@ -597,6 +597,7 @@ function git_timed {
         timeout=${GIT_TIMEOUT}
     fi
 
+    time_start "git_timed"
     until timeout -s SIGINT ${timeout} git "$@"; do
         # 124 is timeout(1)'s special return code when it reached the
         # timeout; otherwise assume fatal failure
@@ -611,6 +612,7 @@ function git_timed {
         fi
         sleep 5
     done
+    time_stop "git_timed"
 }
 
 # git update using reference as a branch.
@@ -1373,6 +1375,7 @@ function run_process {
     local command="$2"
     local group=$3
 
+    time_start "run_process"
     if is_service_enabled $service; then
         if [[ "$USE_SCREEN" = "True" ]]; then
             screen_process "$service" "$command" "$group"
@@ -1381,6 +1384,7 @@ function run_process {
             _run_process "$service" "$command" "$group" &
         fi
     fi
+    time_stop "run_process"
 }
 
 # Helper to launch a process in a named screen
@@ -2196,9 +2200,11 @@ function test_with_retry {
     local until=${3:-10}
     local sleep=${4:-0.5}
 
+    time_start "test_with_retry"
     if ! timeout $until sh -c "while ! $testcmd; do sleep $sleep; done"; then
         die $LINENO "$failmsg"
     fi
+    time_stop "test_with_retry"
 }
 
 # Timing infrastructure - figure out where large blocks of time are
diff --git a/lib/apache b/lib/apache
index c9e02a2b58..2c84c7a481 100644
--- a/lib/apache
+++ b/lib/apache
@@ -185,9 +185,11 @@ function restart_apache_server {
     # Apache can be slow to stop, doing an explicit stop, sleep, start helps
     # to mitigate issues where apache will claim a port it's listening on is
     # still in use and fail to start.
+    time_start "restart_apache_server"
     stop_service $APACHE_NAME
     sleep 3
     start_service $APACHE_NAME
+    time_stop "restart_apache_server"
 }
 
 # Restore xtrace

From 00b5f4af92a640a2507046cf76ee57caa166310b Mon Sep 17 00:00:00 2001
From: Mike Turek <mjturek@linux.vnet.ibm.com>
Date: Tue, 15 Dec 2015 18:16:35 +0000
Subject: [PATCH 1071/3333] Replace deprecated baremetal timeouts with new
 deploy_timeout

See review 258670 for more information. The preceeding patch
consolidates Ironic timeouts into one blanket timeout. This
patch sets the new timeout via the BUILD_TIMEOUT variable and
removes the deprecated timeouts.

Change-Id: I320461b2b40aa2b68afc38a901a5933e39aac1b6
Related-Bug: #1526863
---
 lib/tempest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 61351c0628..b9d9e80fc2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -533,8 +533,7 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal deploy_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 168be83597dcfc38b6d552ecbf20b5093580e2cb Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 8 Oct 2015 07:57:44 -0700
Subject: [PATCH 1072/3333] Nuke EC2 API service in defaults

Tempest does not test EC2 by default anymore:
Ib5e24e19bcba9808a9f49fe7f328668df77fe4f9

So we don't need to run nova ec2 API service by default.

Change-Id: Ieec0ca1361baf0978d96e69e1134f699c1af3bb9
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index f949ccbad9..edf23ce997 100644
--- a/stackrc
+++ b/stackrc
@@ -91,7 +91,7 @@ fi
 ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 
 # Set the default Nova APIs to enable
-NOVA_ENABLED_APIS=ec2,osapi_compute,metadata
+NOVA_ENABLED_APIS=osapi_compute,metadata
 
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"

From 47115b0314bcb9006d674fb0c7da6ac6eb94de29 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Fri, 18 Dec 2015 11:08:38 +0000
Subject: [PATCH 1073/3333] Neutron VPNaaS: Set default service provider

Default value needs to be set for service_provider config item in
neutron_vpnaas.conf. This is to support backward compatability
for using the enable_service q-vpn. It should be noted that the
recommended way to use VPN is the devstack plugin.

Change-Id: I0d5960c81c47a138087d480527eff2a8eef59445
Closes-bug: #1527483
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e0c4676297..6af44e6ab8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -115,6 +115,9 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # Default provider for load balancer service
 DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
 
+# Default provider for VPN service
+DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -1092,6 +1095,7 @@ function _configure_neutron_vpn {
     (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
     if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample ]; then
         cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample $NEUTRON_CONF_DIR/neutron_vpnaas.conf
+        iniset $NEUTRON_CONF_DIR/neutron_vpnaas.conf service_providers service_provider $DEFAULT_VPN_PROVIDER
     fi
     neutron_vpn_install_agent_packages
     neutron_vpn_configure_common

From 47367071cdc110c40ec5c92d12f4dbe50cc553d4 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 10 Dec 2015 14:24:00 +0000
Subject: [PATCH 1074/3333] Remove ironic code from tree

This removes all of the ironic code from the devstack tree, in favor of
the devstack plugin in Ironic's tree.

Depends-On: I659e3de5c64df798441798ff48ba5c9c0506585a
Depends-On: I2c52bc014f1b0dbc6b0ae22a4deb4132b4c28621
Change-Id: I5125fce295c79600781469c2f48bea80e7600081
---
 clean.sh                                     |   1 -
 doc/source/index.rst                         |   2 -
 doc/source/plugin-registry.rst               |   2 +
 extras.d/50-ironic.sh                        |  50 --
 files/apache-ironic.template                 |  12 -
 files/debs/ironic                            |  19 -
 files/rpms/ironic                            |  14 -
 functions-common                             |  12 +-
 lib/ironic                                   | 874 -------------------
 stackrc                                      |   8 +-
 tools/ironic/scripts/cleanup-node            |  25 -
 tools/ironic/scripts/configure-vm            |  93 --
 tools/ironic/scripts/create-node             |  79 --
 tools/ironic/scripts/setup-network           |  28 -
 tools/ironic/templates/brbm.xml              |   6 -
 tools/ironic/templates/tftpd-xinetd.template |  14 -
 tools/ironic/templates/vm.xml                |  49 --
 17 files changed, 16 insertions(+), 1272 deletions(-)
 delete mode 100644 extras.d/50-ironic.sh
 delete mode 100644 files/apache-ironic.template
 delete mode 100644 files/debs/ironic
 delete mode 100644 files/rpms/ironic
 delete mode 100644 lib/ironic
 delete mode 100755 tools/ironic/scripts/cleanup-node
 delete mode 100755 tools/ironic/scripts/configure-vm
 delete mode 100755 tools/ironic/scripts/create-node
 delete mode 100755 tools/ironic/scripts/setup-network
 delete mode 100644 tools/ironic/templates/brbm.xml
 delete mode 100644 tools/ironic/templates/tftpd-xinetd.template
 delete mode 100644 tools/ironic/templates/vm.xml

diff --git a/clean.sh b/clean.sh
index ae28aa9ab7..fc6f80dad4 100755
--- a/clean.sh
+++ b/clean.sh
@@ -50,7 +50,6 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
-source $TOP_DIR/lib/ironic
 
 
 # Extras Source
diff --git a/doc/source/index.rst b/doc/source/index.rst
index ec345c9f64..2622436820 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -174,7 +174,6 @@ Scripts
 * `lib/heat <lib/heat.html>`__
 * `lib/horizon <lib/horizon.html>`__
 * `lib/infra <lib/infra.html>`__
-* `lib/ironic <lib/ironic.html>`__
 * `lib/keystone <lib/keystone.html>`__
 * `lib/ldap <lib/ldap.html>`__
 * `lib/neutron-legacy <lib/neutron-legacy.html>`__
@@ -189,7 +188,6 @@ Scripts
 * `clean.sh <clean.sh.html>`__
 * `run\_tests.sh <run_tests.sh.html>`__
 
-* `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
 * `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c68d926822..7682defbed 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -30,6 +30,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
 +------------------+---------------------------------------------+--------------------+
+|ironic            |git://git.openstack.org/openstack/ironic     | baremetal          |
++------------------+---------------------------------------------+--------------------+
 |magnum            |git://git.openstack.org/openstack/magnum     |                    |
 +------------------+---------------------------------------------+--------------------+
 |manila            |git://git.openstack.org/openstack/manila     | file shares        |
diff --git a/extras.d/50-ironic.sh b/extras.d/50-ironic.sh
deleted file mode 100644
index 0ee6a94758..0000000000
--- a/extras.d/50-ironic.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-# ironic.sh - Devstack extras script to install ironic
-
-# NOTE(jroll) this is used for the transition to a devstack plugin in
-# the ironic tree.
-IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
-if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
-    return 0
-fi
-
-if is_service_enabled ir-api ir-cond; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/ironic
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing Ironic"
-        install_ironic
-        install_ironicclient
-        cleanup_ironic
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring Ironic"
-        configure_ironic
-
-        if is_service_enabled key; then
-            create_ironic_accounts
-        fi
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        # Initialize ironic
-        init_ironic
-
-        # Start the ironic API and ironic taskmgr components
-        echo_summary "Starting Ironic"
-        start_ironic
-
-        if [[ "$IRONIC_BAREMETAL_BASIC_OPS" = "True" ]]; then
-            prepare_baremetal_basic_ops
-        fi
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_ironic
-        if [[ "$IRONIC_BAREMETAL_BASIC_OPS" = "True" ]]; then
-            cleanup_baremetal_basic_ops
-        fi
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        cleanup_ironic
-    fi
-fi
diff --git a/files/apache-ironic.template b/files/apache-ironic.template
deleted file mode 100644
index 88641946f6..0000000000
--- a/files/apache-ironic.template
+++ /dev/null
@@ -1,12 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    DocumentRoot "%HTTPROOT%"
-    <Directory "%HTTPROOT%">
-        Options Indexes FollowSymLinks
-        AllowOverride None
-        Order allow,deny
-        Allow from all
-        Require all granted
-    </Directory>
-</VirtualHost>
diff --git a/files/debs/ironic b/files/debs/ironic
deleted file mode 100644
index 4d5a6aa6b7..0000000000
--- a/files/debs/ironic
+++ /dev/null
@@ -1,19 +0,0 @@
-docker.io
-ipmitool
-iptables
-ipxe
-libguestfs0
-libvirt-bin
-open-iscsi
-openssh-client
-openvswitch-datapath-dkms
-openvswitch-switch
-python-libguestfs
-python-libvirt
-qemu
-qemu-kvm
-qemu-utils
-sgabios
-syslinux
-tftpd-hpa
-xinetd
diff --git a/files/rpms/ironic b/files/rpms/ironic
deleted file mode 100644
index 2bf8bb370e..0000000000
--- a/files/rpms/ironic
+++ /dev/null
@@ -1,14 +0,0 @@
-docker-io
-ipmitool
-iptables
-ipxe-bootimgs
-libguestfs
-libvirt
-libvirt-python
-net-tools
-openssh-clients
-openvswitch
-sgabios
-syslinux
-tftp-server
-xinetd
diff --git a/functions-common b/functions-common
index 1b01eefaf9..c3eef469d3 100644
--- a/functions-common
+++ b/functions-common
@@ -954,6 +954,15 @@ function get_endpoint_url {
             -c URL -f value)
 }
 
+# check if we are using ironic with hardware
+# TODO(jroll) this is a kludge left behind when ripping ironic code
+# out of tree, as it is used by nova and neutron.
+# figure out a way to refactor nova/neutron code to eliminate this
+function is_ironic_hardware {
+    is_service_enabled ironic && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
+    return 1
+}
+
 
 # Package Functions
 # =================
@@ -1764,7 +1773,7 @@ function run_phase {
             # white listed elements in tree. We want these to move out
             # over time as well, but they are in tree, so we need to
             # manage that.
-            local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
+            local exceptions="60-ceph.sh 80-tempest.sh"
             local extra
             extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
@@ -1952,7 +1961,6 @@ function is_service_enabled {
         [[ ${service} == n-cpu-* && ${ENABLED_SERVICES} =~ "n-cpu" ]] && enabled=0
         [[ ${service} == "nova" && ${ENABLED_SERVICES} =~ "n-" ]] && enabled=0
         [[ ${service} == "glance" && ${ENABLED_SERVICES} =~ "g-" ]] && enabled=0
-        [[ ${service} == "ironic" && ${ENABLED_SERVICES} =~ "ir-" ]] && enabled=0
         [[ ${service} == "neutron" && ${ENABLED_SERVICES} =~ "q-" ]] && enabled=0
         [[ ${service} == "trove" && ${ENABLED_SERVICES} =~ "tr-" ]] && enabled=0
         [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
diff --git a/lib/ironic b/lib/ironic
deleted file mode 100644
index dd4f8bf65f..0000000000
--- a/lib/ironic
+++ /dev/null
@@ -1,874 +0,0 @@
-#!/bin/bash
-#
-# lib/ironic
-# Functions to control the configuration and operation of the **Ironic** service
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
-# - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
-# - ``SERVICE_HOST``
-# - ``KEYSTONE_TOKEN_FORMAT`` must be defined
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_ironic
-# - install_ironicclient
-# - init_ironic
-# - start_ironic
-# - stop_ironic
-# - cleanup_ironic
-
-# Save trace and pipefail settings
-_XTRACE_IRONIC=$(set +o | grep xtrace)
-_PIPEFAIL_IRONIC=$(set +o | grep pipefail)
-set +o xtrace
-set +o pipefail
-
-# NOTE(jroll) this is used for the transition to a devstack plugin in
-# the ironic tree.
-IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
-if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
-    return 0
-fi
-
-# Defaults
-# --------
-
-# Set up default directories
-GITDIR["python-ironicclient"]=$DEST/python-ironicclient
-GITDIR["ironic-lib"]=$DEST/ironic-lib
-
-IRONIC_DIR=$DEST/ironic
-IRONIC_PYTHON_AGENT_DIR=$DEST/ironic-python-agent
-IRONIC_DATA_DIR=$DATA_DIR/ironic
-IRONIC_STATE_PATH=/var/lib/ironic
-IRONIC_AUTH_CACHE_DIR=${IRONIC_AUTH_CACHE_DIR:-/var/cache/ironic}
-IRONIC_CONF_DIR=${IRONIC_CONF_DIR:-/etc/ironic}
-IRONIC_CONF_FILE=$IRONIC_CONF_DIR/ironic.conf
-IRONIC_ROOTWRAP_CONF=$IRONIC_CONF_DIR/rootwrap.conf
-IRONIC_POLICY_JSON=$IRONIC_CONF_DIR/policy.json
-
-# Deploy callback timeout can be changed from its default (1800), if required.
-IRONIC_CALLBACK_TIMEOUT=${IRONIC_CALLBACK_TIMEOUT:-}
-
-# Deploy to hardware platform
-IRONIC_HW_NODE_CPU=${IRONIC_HW_NODE_CPU:-1}
-IRONIC_HW_NODE_RAM=${IRONIC_HW_NODE_RAM:-512}
-IRONIC_HW_NODE_DISK=${IRONIC_HW_NODE_DISK:-10}
-IRONIC_HW_EPHEMERAL_DISK=${IRONIC_HW_EPHEMERAL_DISK:-0}
-# The file is composed of multiple lines, each line includes four field
-# separated by white space: IPMI address, MAC address, IPMI username
-# and IPMI password.
-#
-#   192.168.110.107 00:1e:67:57:50:4c root otc123
-IRONIC_IPMIINFO_FILE=${IRONIC_IPMIINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
-
-# Set up defaults for functional / integration testing
-IRONIC_NODE_UUID=${IRONIC_NODE_UUID:-`uuidgen`}
-IRONIC_SCRIPTS_DIR=${IRONIC_SCRIPTS_DIR:-$TOP_DIR/tools/ironic/scripts}
-IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$TOP_DIR/tools/ironic/templates}
-IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False IRONIC_BAREMETAL_BASIC_OPS)
-IRONIC_ENABLED_DRIVERS=${IRONIC_ENABLED_DRIVERS:-fake,pxe_ssh,pxe_ipmitool}
-IRONIC_SSH_USERNAME=${IRONIC_SSH_USERNAME:-`whoami`}
-IRONIC_SSH_TIMEOUT=${IRONIC_SSH_TIMEOUT:-15}
-IRONIC_SSH_KEY_DIR=${IRONIC_SSH_KEY_DIR:-$IRONIC_DATA_DIR/ssh_keys}
-IRONIC_SSH_KEY_FILENAME=${IRONIC_SSH_KEY_FILENAME:-ironic_key}
-IRONIC_KEY_FILE=${IRONIC_KEY_FILE:-$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME}
-IRONIC_SSH_VIRT_TYPE=${IRONIC_SSH_VIRT_TYPE:-virsh}
-IRONIC_TFTPBOOT_DIR=${IRONIC_TFTPBOOT_DIR:-$IRONIC_DATA_DIR/tftpboot}
-IRONIC_TFTPSERVER_IP=${IRONIC_TFTPSERVER_IP:-$HOST_IP}
-IRONIC_VM_SSH_PORT=${IRONIC_VM_SSH_PORT:-22}
-IRONIC_VM_SSH_ADDRESS=${IRONIC_VM_SSH_ADDRESS:-$HOST_IP}
-IRONIC_VM_COUNT=${IRONIC_VM_COUNT:-1}
-IRONIC_VM_SPECS_CPU=${IRONIC_VM_SPECS_CPU:-1}
-IRONIC_VM_SPECS_RAM=${IRONIC_VM_SPECS_RAM:-512}
-IRONIC_VM_SPECS_DISK=${IRONIC_VM_SPECS_DISK:-10}
-IRONIC_VM_EPHEMERAL_DISK=${IRONIC_VM_EPHEMERAL_DISK:-0}
-IRONIC_VM_EMULATOR=${IRONIC_VM_EMULATOR:-/usr/bin/qemu-system-x86_64}
-IRONIC_VM_NETWORK_BRIDGE=${IRONIC_VM_NETWORK_BRIDGE:-brbm}
-IRONIC_VM_NETWORK_RANGE=${IRONIC_VM_NETWORK_RANGE:-192.0.2.0/24}
-IRONIC_VM_MACS_CSV_FILE=${IRONIC_VM_MACS_CSV_FILE:-$IRONIC_DATA_DIR/ironic_macs.csv}
-IRONIC_AUTHORIZED_KEYS_FILE=${IRONIC_AUTHORIZED_KEYS_FILE:-$HOME/.ssh/authorized_keys}
-
-# By default, baremetal VMs will console output to file.
-IRONIC_VM_LOG_CONSOLE=${IRONIC_VM_LOG_CONSOLE:-True}
-IRONIC_VM_LOG_DIR=${IRONIC_VM_LOG_DIR:-$IRONIC_DATA_DIR/logs/}
-
-# Use DIB to create deploy ramdisk and kernel.
-IRONIC_BUILD_DEPLOY_RAMDISK=$(trueorfalse True IRONIC_BUILD_DEPLOY_RAMDISK)
-# If not use DIB, these files are used as deploy ramdisk/kernel.
-# (The value must be an absolute path)
-IRONIC_DEPLOY_RAMDISK=${IRONIC_DEPLOY_RAMDISK:-}
-IRONIC_DEPLOY_KERNEL=${IRONIC_DEPLOY_KERNEL:-}
-IRONIC_DEPLOY_ELEMENT=${IRONIC_DEPLOY_ELEMENT:-deploy-ironic}
-
-IRONIC_AGENT_KERNEL_URL=${IRONIC_AGENT_KERNEL_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe.vmlinuz}
-IRONIC_AGENT_RAMDISK_URL=${IRONIC_AGENT_RAMDISK_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe_image-oem.cpio.gz}
-
-# Which deploy driver to use - valid choices right now
-# are ``pxe_ssh``, ``pxe_ipmitool``, ``agent_ssh`` and ``agent_ipmitool``.
-IRONIC_DEPLOY_DRIVER=${IRONIC_DEPLOY_DRIVER:-pxe_ssh}
-
-# TODO(agordeev): replace 'ubuntu' with host distro name getting
-IRONIC_DEPLOY_FLAVOR=${IRONIC_DEPLOY_FLAVOR:-ubuntu $IRONIC_DEPLOY_ELEMENT}
-
-# Support entry points installation of console scripts
-IRONIC_BIN_DIR=$(get_python_exec_prefix)
-
-# Ironic connection info.  Note the port must be specified.
-IRONIC_SERVICE_PROTOCOL=http
-IRONIC_SERVICE_PORT=${IRONIC_SERVICE_PORT:-6385}
-IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST:$IRONIC_SERVICE_PORT}
-
-# Enable iPXE
-IRONIC_IPXE_ENABLED=$(trueorfalse False IRONIC_IPXE_ENABLED)
-IRONIC_HTTP_DIR=${IRONIC_HTTP_DIR:-$IRONIC_DATA_DIR/httpboot}
-IRONIC_HTTP_SERVER=${IRONIC_HTTP_SERVER:-$HOST_IP}
-IRONIC_HTTP_PORT=${IRONIC_HTTP_PORT:-8088}
-
-# NOTE(lucasagomes): This flag is used to differentiate the nodes that
-# uses IPA as their deploy ramdisk from nodes that uses the agent_* drivers
-# (which also uses IPA but depends on Swift Temp URLs to work). At present,
-# all drivers that uses the iSCSI approach for their deployment supports
-# using both, IPA or bash ramdisks for the deployment. In the future we
-# want to remove the support for the bash ramdisk in favor of IPA, once
-# we get there this flag can be removed, and all conditionals that uses
-# it should just run by default.
-IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA=$(trueorfalse False IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA)
-
-# get_pxe_boot_file() - Get the PXE/iPXE boot file path
-function get_pxe_boot_file {
-    local relpath=syslinux/pxelinux.0
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        relpath=ipxe/undionly.kpxe
-    fi
-
-    local pxe_boot_file
-    if is_ubuntu; then
-        pxe_boot_file=/usr/lib/$relpath
-    elif is_fedora || is_suse; then
-        pxe_boot_file=/usr/share/$relpath
-    fi
-
-    echo $pxe_boot_file
-}
-
-# PXE boot image
-IRONIC_PXE_BOOT_IMAGE=${IRONIC_PXE_BOOT_IMAGE:-$(get_pxe_boot_file)}
-
-
-# Functions
-# ---------
-
-# Test if any Ironic services are enabled
-# is_ironic_enabled
-function is_ironic_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"ir-" ]] && return 0
-    return 1
-}
-
-function is_ironic_hardware {
-    is_ironic_enabled && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
-    return 1
-}
-
-function is_deployed_by_agent {
-    [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]] && return 0
-    return 1
-}
-
-function is_deployed_with_ipa_ramdisk {
-    is_deployed_by_agent || [[ "$IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA" == "True" ]] && return 0
-    return 1
-}
-
-# install_ironic() - Collect source and prepare
-function install_ironic {
-    # make sure all needed service were enabled
-    local req_services="key"
-    if [[ "$VIRT_DRIVER" == "ironic" ]]; then
-        req_services+=" nova glance neutron"
-    fi
-    for srv in $req_services; do
-        if ! is_service_enabled "$srv"; then
-            die $LINENO "$srv should be enabled for Ironic."
-        fi
-    done
-
-    if use_library_from_git "ironic-lib"; then
-        git_clone_by_name "ironic-lib"
-        setup_dev_lib "ironic-lib"
-    fi
-
-    git_clone $IRONIC_REPO $IRONIC_DIR $IRONIC_BRANCH
-    setup_develop $IRONIC_DIR
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        install_apache_wsgi
-    fi
-}
-
-# install_ironicclient() - Collect sources and prepare
-function install_ironicclient {
-    if use_library_from_git "python-ironicclient"; then
-        git_clone_by_name "python-ironicclient"
-        setup_dev_lib "python-ironicclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-ironicclient"]}/tools/,/etc/bash_completion.d/}ironic.bash_completion
-    else
-        # nothing actually "requires" ironicclient, so force instally from pypi
-        pip_install_gr python-ironicclient
-    fi
-}
-
-# _cleanup_ironic_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_ironic_apache_wsgi {
-    sudo rm -rf $IRONIC_HTTP_DIR
-    disable_apache_site ironic
-    sudo rm -f $(apache_site_config_for ironic)
-    restart_apache_server
-}
-
-# _config_ironic_apache_wsgi() - Set WSGI config files of Ironic
-function _config_ironic_apache_wsgi {
-    local ironic_apache_conf
-    ironic_apache_conf=$(apache_site_config_for ironic)
-    sudo cp $FILES/apache-ironic.template $ironic_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$IRONIC_HTTP_PORT|g;
-        s|%HTTPROOT%|$IRONIC_HTTP_DIR|g;
-    " -i $ironic_apache_conf
-    enable_apache_site ironic
-}
-
-# cleanup_ironic() - Remove residual data files, anything left over from previous
-# runs that would need to clean up.
-function cleanup_ironic {
-    sudo rm -rf $IRONIC_AUTH_CACHE_DIR $IRONIC_CONF_DIR
-}
-
-# configure_ironic_dirs() - Create all directories required by Ironic and
-# associated services.
-function configure_ironic_dirs {
-    sudo install -d -o $STACK_USER $IRONIC_CONF_DIR $STACK_USER $IRONIC_DATA_DIR \
-        $IRONIC_STATE_PATH $IRONIC_TFTPBOOT_DIR $IRONIC_TFTPBOOT_DIR/pxelinux.cfg
-    sudo chown -R $STACK_USER:$LIBVIRT_GROUP $IRONIC_TFTPBOOT_DIR
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        sudo install -d -o $STACK_USER -g $LIBVIRT_GROUP $IRONIC_HTTP_DIR
-    fi
-
-    if [ ! -f $IRONIC_PXE_BOOT_IMAGE ]; then
-        die $LINENO "PXE boot file $IRONIC_PXE_BOOT_IMAGE not found."
-    fi
-
-    # Copy PXE binary
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        cp $IRONIC_PXE_BOOT_IMAGE $IRONIC_TFTPBOOT_DIR
-    else
-        # Syslinux >= 5.00 pxelinux.0 binary is not "stand-alone" anymore,
-        # it depends on some c32 modules to work correctly.
-        # More info: http://www.syslinux.org/wiki/index.php/Library_modules
-        cp -aR $(dirname $IRONIC_PXE_BOOT_IMAGE)/*.{c32,0} $IRONIC_TFTPBOOT_DIR
-    fi
-}
-
-# configure_ironic() - Set config files, create data dirs, etc
-function configure_ironic {
-    configure_ironic_dirs
-
-    # Copy over ironic configuration file and configure common parameters.
-    cp $IRONIC_DIR/etc/ironic/ironic.conf.sample $IRONIC_CONF_FILE
-    iniset $IRONIC_CONF_FILE DEFAULT debug True
-    inicomment $IRONIC_CONF_FILE DEFAULT log_file
-    iniset $IRONIC_CONF_FILE database connection `database_connection_url ironic`
-    iniset $IRONIC_CONF_FILE DEFAULT state_path $IRONIC_STATE_PATH
-    iniset $IRONIC_CONF_FILE DEFAULT use_syslog $SYSLOG
-    # Configure Ironic conductor, if it was enabled.
-    if is_service_enabled ir-cond; then
-        configure_ironic_conductor
-    fi
-
-    # Configure Ironic API, if it was enabled.
-    if is_service_enabled ir-api; then
-        configure_ironic_api
-    fi
-
-    # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $IRONIC_CONF_FILE DEFAULT tenant user
-    fi
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]]; then
-        _config_ironic_apache_wsgi
-    fi
-}
-
-# configure_ironic_api() - Is used by configure_ironic(). Performs
-# API specific configuration.
-function configure_ironic_api {
-    iniset $IRONIC_CONF_FILE DEFAULT auth_strategy keystone
-    iniset $IRONIC_CONF_FILE oslo_policy policy_file $IRONIC_POLICY_JSON
-
-    # TODO(Yuki Nishiwaki): This is a temporary work-around until Ironic is fixed(bug#1422632).
-    # These codes need to be changed to use the function of configure_auth_token_middleware
-    # after Ironic conforms to the new auth plugin.
-    iniset $IRONIC_CONF_FILE keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-    iniset $IRONIC_CONF_FILE keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
-    iniset $IRONIC_CONF_FILE keystone_authtoken admin_user ironic
-    iniset $IRONIC_CONF_FILE keystone_authtoken admin_password $SERVICE_PASSWORD
-    iniset $IRONIC_CONF_FILE keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $IRONIC_CONF_FILE keystone_authtoken cafile $SSL_BUNDLE_FILE
-    iniset $IRONIC_CONF_FILE keystone_authtoken signing_dir $IRONIC_AUTH_CACHE_DIR/api
-
-    iniset_rpc_backend ironic $IRONIC_CONF_FILE
-    iniset $IRONIC_CONF_FILE api port $IRONIC_SERVICE_PORT
-
-    cp -p $IRONIC_DIR/etc/ironic/policy.json $IRONIC_POLICY_JSON
-}
-
-# configure_ironic_conductor() - Is used by configure_ironic().
-# Sets conductor specific settings.
-function configure_ironic_conductor {
-    cp $IRONIC_DIR/etc/ironic/rootwrap.conf $IRONIC_ROOTWRAP_CONF
-    cp -r $IRONIC_DIR/etc/ironic/rootwrap.d $IRONIC_CONF_DIR
-    local ironic_rootwrap
-    ironic_rootwrap=$(get_rootwrap_location ironic)
-    local rootwrap_isudoer_cmd="$ironic_rootwrap $IRONIC_CONF_DIR/rootwrap.conf *"
-
-    # Set up the rootwrap sudoers for ironic
-    local tempfile
-    tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_isudoer_cmd" >$tempfile
-    chmod 0440 $tempfile
-    sudo chown root:root $tempfile
-    sudo mv $tempfile /etc/sudoers.d/ironic-rootwrap
-
-    iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF
-    iniset $IRONIC_CONF_FILE DEFAULT enabled_drivers $IRONIC_ENABLED_DRIVERS
-    iniset $IRONIC_CONF_FILE conductor api_url $IRONIC_SERVICE_PROTOCOL://$HOST_IP:$IRONIC_SERVICE_PORT
-    if [[ -n "$IRONIC_CALLBACK_TIMEOUT" ]]; then
-        iniset $IRONIC_CONF_FILE conductor deploy_callback_timeout $IRONIC_CALLBACK_TIMEOUT
-    fi
-    iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
-    iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
-    iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
-
-    local pxe_params=""
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-        pxe_params+="nofb nomodeset vga=normal console=ttyS0"
-        if is_deployed_with_ipa_ramdisk; then
-            pxe_params+=" systemd.journald.forward_to_console=yes"
-        fi
-    fi
-    # When booting with less than 1GB, we need to switch from default tmpfs
-    # to ramfs for ramdisks to decompress successfully.
-    if (is_ironic_hardware && [[ "$IRONIC_HW_NODE_RAM" -lt 1024 ]]) ||
-        (! is_ironic_hardware && [[ "$IRONIC_VM_SPECS_RAM" -lt 1024 ]]); then
-        pxe_params+=" rootfstype=ramfs"
-    fi
-    if [[ -n "$pxe_params" ]]; then
-        iniset $IRONIC_CONF_FILE pxe pxe_append_params "$pxe_params"
-    fi
-
-    # Set these options for scenarios in which the agent fetches the image
-    # directly from glance, and don't set them where the image is pushed
-    # over iSCSI.
-    if is_deployed_by_agent; then
-        if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
-            iniset $IRONIC_CONF_FILE glance swift_temp_url_key $SWIFT_TEMPURL_KEY
-        else
-            die $LINENO "SWIFT_ENABLE_TEMPURLS must be True to use agent_ssh driver in Ironic."
-        fi
-        iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:${SWIFT_DEFAULT_BIND_PORT:-8080}
-        iniset $IRONIC_CONF_FILE glance swift_api_version v1
-        local tenant_id
-        tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME default)
-        iniset $IRONIC_CONF_FILE glance swift_account AUTH_${tenant_id}
-        iniset $IRONIC_CONF_FILE glance swift_container glance
-        iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
-        iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
-    fi
-
-    # FIXME: this really needs to be tested in the gate.
-    # For now, any test using the agent ramdisk should skip cleaning
-    # because it is too slow to run in the gate.
-    iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        local pxebin
-        pxebin=`basename $IRONIC_PXE_BOOT_IMAGE`
-        iniset $IRONIC_CONF_FILE pxe ipxe_enabled True
-        iniset $IRONIC_CONF_FILE pxe pxe_config_template '\$pybasedir/drivers/modules/ipxe_config.template'
-        iniset $IRONIC_CONF_FILE pxe pxe_bootfile_name $pxebin
-        iniset $IRONIC_CONF_FILE pxe http_root $IRONIC_HTTP_DIR
-        iniset $IRONIC_CONF_FILE pxe http_url "http://$IRONIC_HTTP_SERVER:$IRONIC_HTTP_PORT"
-    fi
-}
-
-# create_ironic_cache_dir() - Part of the init_ironic() process
-function create_ironic_cache_dir {
-    # Create cache dir
-    sudo mkdir -p $IRONIC_AUTH_CACHE_DIR/api
-    sudo chown $STACK_USER $IRONIC_AUTH_CACHE_DIR/api
-    rm -f $IRONIC_AUTH_CACHE_DIR/api/*
-    sudo mkdir -p $IRONIC_AUTH_CACHE_DIR/registry
-    sudo chown $STACK_USER $IRONIC_AUTH_CACHE_DIR/registry
-    rm -f $IRONIC_AUTH_CACHE_DIR/registry/*
-}
-
-# create_ironic_accounts() - Set up common required ironic accounts
-
-# Tenant               User       Roles
-# ------------------------------------------------------------------
-# service              ironic     admin        # if enabled
-function create_ironic_accounts {
-
-    # Ironic
-    if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
-        # Get ironic user if exists
-
-        # NOTE(Shrews): This user MUST have admin level privileges!
-        create_service_user "ironic" "admin"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "ironic" "baremetal" "Ironic baremetal provisioning service"
-            get_or_create_endpoint "baremetal" \
-                "$REGION_NAME" \
-                "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT" \
-                "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT" \
-                "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT"
-        fi
-    fi
-}
-
-
-# init_ironic() - Initialize databases, etc.
-function init_ironic {
-    # Save private network as cleaning network
-    local cleaning_network_uuid
-    cleaning_network_uuid=$(neutron net-list | grep private | get_field 1)
-    iniset $IRONIC_CONF_FILE neutron cleaning_network_uuid ${cleaning_network_uuid}
-
-    # (Re)create  ironic database
-    recreate_database ironic
-
-    # Migrate ironic database
-    $IRONIC_BIN_DIR/ironic-dbsync --config-file=$IRONIC_CONF_FILE
-
-    create_ironic_cache_dir
-}
-
-# _ironic_bm_vm_names() - Generates list of names for baremetal VMs.
-function _ironic_bm_vm_names {
-    local idx
-    local num_vms
-    num_vms=$(($IRONIC_VM_COUNT - 1))
-    for idx in $(seq 0 $num_vms); do
-        echo "baremetal${IRONIC_VM_NETWORK_BRIDGE}_${idx}"
-    done
-}
-
-# start_ironic() - Start running processes, including screen
-function start_ironic {
-    # Start Ironic API server, if enabled.
-    if is_service_enabled ir-api; then
-        start_ironic_api
-    fi
-
-    # Start Ironic conductor, if enabled.
-    if is_service_enabled ir-cond; then
-        start_ironic_conductor
-    fi
-
-    # Start Apache if iPXE is enabled
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        restart_apache_server
-    fi
-}
-
-# start_ironic_api() - Used by start_ironic().
-# Starts Ironic API server.
-function start_ironic_api {
-    run_process ir-api "$IRONIC_BIN_DIR/ironic-api --config-file=$IRONIC_CONF_FILE"
-    echo "Waiting for ir-api ($IRONIC_HOSTPORT) to start..."
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget --no-proxy -q -O- $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT; do sleep 1; done"; then
-        die $LINENO "ir-api did not start"
-    fi
-}
-
-# start_ironic_conductor() - Used by start_ironic().
-# Starts Ironic conductor.
-function start_ironic_conductor {
-    run_process ir-cond "$IRONIC_BIN_DIR/ironic-conductor --config-file=$IRONIC_CONF_FILE"
-    # TODO(romcheg): Find a way to check whether the conductor has started.
-}
-
-# stop_ironic() - Stop running processes
-function stop_ironic {
-    stop_process ir-api
-    stop_process ir-cond
-
-    # Cleanup the WSGI files
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        _cleanup_ironic_apache_wsgi
-    fi
-}
-
-function create_ovs_taps {
-    local ironic_net_id
-    ironic_net_id=$(neutron net-list | grep private | get_field 1)
-
-    # Work around: No netns exists on host until a Neutron port is created.  We
-    # need to create one in Neutron to know what netns to tap into prior to the
-    # first node booting.
-    local port_id
-    port_id=$(neutron port-create private | grep " id " | get_field 2)
-
-    # intentional sleep to make sure the tag has been set to port
-    sleep 10
-
-    local tapdev
-    tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
-    local tag_id
-    tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
-
-    # make sure veth pair is not existing, otherwise delete its links
-    sudo ip link show ovs-tap1 && sudo ip link delete ovs-tap1
-    sudo ip link show brbm-tap1 && sudo ip link delete brbm-tap1
-    # create veth pair for future interconnection between br-int and brbm
-    sudo ip link add brbm-tap1 type veth peer name ovs-tap1
-    sudo ip link set dev brbm-tap1 up
-    sudo ip link set dev ovs-tap1 up
-
-    sudo ovs-vsctl -- --if-exists del-port ovs-tap1 -- add-port br-int ovs-tap1 tag=$tag_id
-    sudo ovs-vsctl -- --if-exists del-port brbm-tap1 -- add-port $IRONIC_VM_NETWORK_BRIDGE brbm-tap1
-
-    # Remove the port needed only for workaround.
-    neutron port-delete $port_id
-
-    # Finally, share the fixed tenant network across all tenants.  This allows the host
-    # to serve TFTP to a single network namespace via the tap device created above.
-    neutron net-update $ironic_net_id --shared true
-}
-
-function create_bridge_and_vms {
-    # Call libvirt setup scripts in a new shell to ensure any new group membership
-    sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/setup-network"
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-        local log_arg="$IRONIC_VM_LOG_DIR"
-    else
-        local log_arg=""
-    fi
-    local vm_name
-    for vm_name in $(_ironic_bm_vm_names); do
-        sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/create-node $vm_name \
-            $IRONIC_VM_SPECS_CPU $IRONIC_VM_SPECS_RAM $IRONIC_VM_SPECS_DISK \
-            amd64 $IRONIC_VM_NETWORK_BRIDGE $IRONIC_VM_EMULATOR \
-            $log_arg" >> $IRONIC_VM_MACS_CSV_FILE
-    done
-    create_ovs_taps
-}
-
-function wait_for_nova_resources {
-    # After nodes have been enrolled, we need to wait for both ironic and
-    # nova's periodic tasks to populate the resource tracker with available
-    # nodes and resources. Wait up to 2 minutes for a given resource before
-    # timing out.
-    local resource=$1
-    local expected_count=$2
-    local i
-    echo_summary "Waiting 2 minutes for Nova resource tracker to pick up $resource >= $expected_count"
-    for i in $(seq 1 120); do
-        if [ $(nova hypervisor-stats | grep " $resource " | get_field 2) -ge $expected_count ]; then
-            return 0
-        fi
-        sleep 1
-    done
-    die $LINENO "Timed out waiting for Nova hypervisor-stats $resource >= $expected_count"
-}
-
-function enroll_nodes {
-    local chassis_id
-    chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
-
-    if ! is_ironic_hardware; then
-        local ironic_node_cpu=$IRONIC_VM_SPECS_CPU
-        local ironic_node_ram=$IRONIC_VM_SPECS_RAM
-        local ironic_node_disk=$IRONIC_VM_SPECS_DISK
-        local ironic_ephemeral_disk=$IRONIC_VM_EPHEMERAL_DISK
-        local ironic_hwinfo_file=$IRONIC_VM_MACS_CSV_FILE
-        local node_options="\
-            -i deploy_kernel=$IRONIC_DEPLOY_KERNEL_ID \
-            -i deploy_ramdisk=$IRONIC_DEPLOY_RAMDISK_ID \
-            -i ssh_virt_type=$IRONIC_SSH_VIRT_TYPE \
-            -i ssh_address=$IRONIC_VM_SSH_ADDRESS \
-            -i ssh_port=$IRONIC_VM_SSH_PORT \
-            -i ssh_username=$IRONIC_SSH_USERNAME \
-            -i ssh_key_filename=$IRONIC_KEY_FILE"
-    else
-        local ironic_node_cpu=$IRONIC_HW_NODE_CPU
-        local ironic_node_ram=$IRONIC_HW_NODE_RAM
-        local ironic_node_disk=$IRONIC_HW_NODE_DISK
-        local ironic_ephemeral_disk=$IRONIC_HW_EPHEMERAL_DISK
-        if [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
-            local ironic_hwinfo_file=$IRONIC_IPMIINFO_FILE
-        fi
-    fi
-
-    local total_nodes=0
-    local total_cpus=0
-    while read hardware_info; do
-        if ! is_ironic_hardware; then
-            local mac_address=$hardware_info
-        elif [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
-            local ipmi_address
-            ipmi_address=$(echo $hardware_info |awk  '{print $1}')
-            local mac_address
-            mac_address=$(echo $hardware_info |awk '{print $2}')
-            local ironic_ipmi_username
-            ironic_ipmi_username=$(echo $hardware_info |awk '{print $3}')
-            local ironic_ipmi_passwd
-            ironic_ipmi_passwd=$(echo $hardware_info |awk '{print $4}')
-            # Currently we require all hardware platform have same CPU/RAM/DISK info
-            # in future, this can be enhanced to support different type, and then
-            # we create the bare metal flavor with minimum value
-            local node_options="-i ipmi_address=$ipmi_address -i ipmi_password=$ironic_ipmi_passwd\
-                -i ipmi_username=$ironic_ipmi_username"
-            node_options+=" -i deploy_kernel=$IRONIC_DEPLOY_KERNEL_ID"
-            node_options+=" -i deploy_ramdisk=$IRONIC_DEPLOY_RAMDISK_ID"
-        fi
-
-        # First node created will be used for testing in ironic w/o glance
-        # scenario, so we need to know its UUID.
-        local standalone_node_uuid=""
-        if [ $total_nodes -eq 0 ]; then
-            standalone_node_uuid="--uuid $IRONIC_NODE_UUID"
-        fi
-
-        local node_id
-        node_id=$(ironic node-create $standalone_node_uuid\
-            --chassis_uuid $chassis_id \
-            --driver $IRONIC_DEPLOY_DRIVER \
-            --name node-$total_nodes \
-            -p cpus=$ironic_node_cpu\
-            -p memory_mb=$ironic_node_ram\
-            -p local_gb=$ironic_node_disk\
-            -p cpu_arch=x86_64 \
-            $node_options \
-            | grep " uuid " | get_field 2)
-
-        ironic port-create --address $mac_address --node $node_id
-
-        total_nodes=$((total_nodes+1))
-        total_cpus=$((total_cpus+$ironic_node_cpu))
-    done < $ironic_hwinfo_file
-
-    local adjusted_disk
-    adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
-    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal auto $ironic_node_ram $adjusted_disk $ironic_node_cpu
-
-    nova flavor-key baremetal set "cpu_arch"="x86_64"
-
-    if [ "$VIRT_DRIVER" == "ironic" ]; then
-        wait_for_nova_resources "count" $total_nodes
-        wait_for_nova_resources "vcpus" $total_cpus
-    fi
-}
-
-function configure_iptables {
-    # enable tftp natting for allowing connections to HOST_IP's tftp server
-    sudo modprobe nf_conntrack_tftp
-    sudo modprobe nf_nat_tftp
-    # explicitly allow DHCP - packets are occasionally being dropped here
-    sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
-    # nodes boot from TFTP and callback to the API server listening on $HOST_IP
-    sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
-    if is_deployed_by_agent; then
-        # agent ramdisk gets instance image from swift
-        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
-    fi
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
-    fi
-}
-
-function configure_tftpd {
-    # stop tftpd and setup serving via xinetd
-    stop_service tftpd-hpa || true
-    [ -f /etc/init/tftpd-hpa.conf ] && echo "manual" | sudo tee /etc/init/tftpd-hpa.override
-    sudo cp $IRONIC_TEMPLATES_DIR/tftpd-xinetd.template /etc/xinetd.d/tftp
-    sudo sed -e "s|%TFTPBOOT_DIR%|$IRONIC_TFTPBOOT_DIR|g" -i /etc/xinetd.d/tftp
-
-    # setup tftp file mapping to satisfy requests at the root (booting) and
-    # /tftpboot/ sub-dir (as per deploy-ironic elements)
-    echo "r ^([^/]) $IRONIC_TFTPBOOT_DIR/\1" >$IRONIC_TFTPBOOT_DIR/map-file
-    echo "r ^(/tftpboot/) $IRONIC_TFTPBOOT_DIR/\2" >>$IRONIC_TFTPBOOT_DIR/map-file
-
-    chmod -R 0755 $IRONIC_TFTPBOOT_DIR
-    restart_service xinetd
-}
-
-function configure_ironic_ssh_keypair {
-    if [[ ! -d $HOME/.ssh ]]; then
-        mkdir -p $HOME/.ssh
-        chmod 700 $HOME/.ssh
-    fi
-    if [[ ! -e $IRONIC_KEY_FILE ]]; then
-        if [[ ! -d $(dirname $IRONIC_KEY_FILE) ]]; then
-            mkdir -p $(dirname $IRONIC_KEY_FILE)
-        fi
-        echo -e 'n\n' | ssh-keygen -q -t rsa -P '' -f $IRONIC_KEY_FILE
-    fi
-    cat $IRONIC_KEY_FILE.pub | tee -a $IRONIC_AUTHORIZED_KEYS_FILE
-}
-
-function ironic_ssh_check {
-    local key_file=$1
-    local floating_ip=$2
-    local port=$3
-    local default_instance_user=$4
-    local active_timeout=$5
-    if ! timeout $active_timeout sh -c "while ! ssh -p $port -o StrictHostKeyChecking=no -i $key_file ${default_instance_user}@$floating_ip echo success; do sleep 1; done"; then
-        die $LINENO "server didn't become ssh-able!"
-    fi
-}
-
-function configure_ironic_auxiliary {
-    configure_ironic_ssh_keypair
-    ironic_ssh_check $IRONIC_KEY_FILE $IRONIC_VM_SSH_ADDRESS $IRONIC_VM_SSH_PORT $IRONIC_SSH_USERNAME $IRONIC_SSH_TIMEOUT
-}
-
-function build_ipa_coreos_ramdisk {
-    echo "Building ironic-python-agent deploy ramdisk"
-    local kernel_path=$1
-    local ramdisk_path=$2
-    git_clone $IRONIC_PYTHON_AGENT_REPO $IRONIC_PYTHON_AGENT_DIR $IRONIC_PYTHON_AGENT_BRANCH
-    cd $IRONIC_PYTHON_AGENT_DIR
-    imagebuild/coreos/build_coreos_image.sh
-    cp imagebuild/coreos/UPLOAD/coreos_production_pxe_image-oem.cpio.gz $ramdisk_path
-    cp imagebuild/coreos/UPLOAD/coreos_production_pxe.vmlinuz $kernel_path
-    sudo rm -rf UPLOAD
-    cd -
-}
-
-# build deploy kernel+ramdisk, then upload them to glance
-# this function sets ``IRONIC_DEPLOY_KERNEL_ID``, ``IRONIC_DEPLOY_RAMDISK_ID``
-function upload_baremetal_ironic_deploy {
-    declare -g IRONIC_DEPLOY_KERNEL_ID IRONIC_DEPLOY_RAMDISK_ID
-    echo_summary "Creating and uploading baremetal images for ironic"
-
-    # install diskimage-builder
-    if [[ $(type -P ramdisk-image-create) == "" ]]; then
-        pip_install_gr "diskimage-builder"
-    fi
-
-    if [ -z "$IRONIC_DEPLOY_KERNEL" -o -z "$IRONIC_DEPLOY_RAMDISK" ]; then
-        local IRONIC_DEPLOY_KERNEL_PATH=$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.kernel
-        local IRONIC_DEPLOY_RAMDISK_PATH=$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.initramfs
-    else
-        local IRONIC_DEPLOY_KERNEL_PATH=$IRONIC_DEPLOY_KERNEL
-        local IRONIC_DEPLOY_RAMDISK_PATH=$IRONIC_DEPLOY_RAMDISK
-    fi
-
-    if [ ! -e "$IRONIC_DEPLOY_RAMDISK_PATH" -o ! -e "$IRONIC_DEPLOY_KERNEL_PATH" ]; then
-        # files don't exist, need to build them
-        if [ "$IRONIC_BUILD_DEPLOY_RAMDISK" = "True" ]; then
-            # we can build them only if we're not offline
-            if [ "$OFFLINE" != "True" ]; then
-                if is_deployed_with_ipa_ramdisk; then
-                    build_ipa_coreos_ramdisk $IRONIC_DEPLOY_KERNEL_PATH $IRONIC_DEPLOY_RAMDISK_PATH
-                else
-                    ramdisk-image-create $IRONIC_DEPLOY_FLAVOR \
-                        -o $TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER
-                fi
-            else
-                die $LINENO "Deploy kernel+ramdisk files don't exist and cannot be build in OFFLINE mode"
-            fi
-        else
-            if is_deployed_with_ipa_ramdisk; then
-                # download the agent image tarball
-                wget "$IRONIC_AGENT_KERNEL_URL" -O $IRONIC_DEPLOY_KERNEL_PATH
-                wget "$IRONIC_AGENT_RAMDISK_URL" -O $IRONIC_DEPLOY_RAMDISK_PATH
-            else
-                die $LINENO "Deploy kernel+ramdisk files don't exist and their building was disabled explicitly by IRONIC_BUILD_DEPLOY_RAMDISK"
-            fi
-        fi
-    fi
-
-    local token
-    token=$(openstack token issue -c id -f value)
-    die_if_not_set $LINENO token "Keystone fail to get token"
-
-    # load them into glance
-    IRONIC_DEPLOY_KERNEL_ID=$(openstack \
-        --os-token $token \
-        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
-        image create \
-        $(basename $IRONIC_DEPLOY_KERNEL_PATH) \
-        --public --disk-format=aki \
-        --container-format=aki \
-        < $IRONIC_DEPLOY_KERNEL_PATH  | grep ' id ' | get_field 2)
-    IRONIC_DEPLOY_RAMDISK_ID=$(openstack \
-        --os-token $token \
-        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
-        image create \
-        $(basename $IRONIC_DEPLOY_RAMDISK_PATH) \
-        --public --disk-format=ari \
-        --container-format=ari \
-        < $IRONIC_DEPLOY_RAMDISK_PATH  | grep ' id ' | get_field 2)
-}
-
-function prepare_baremetal_basic_ops {
-    if ! is_ironic_hardware; then
-        configure_ironic_auxiliary
-    fi
-    upload_baremetal_ironic_deploy
-    if ! is_ironic_hardware; then
-        create_bridge_and_vms
-    fi
-    enroll_nodes
-    configure_tftpd
-    configure_iptables
-}
-
-function cleanup_baremetal_basic_ops {
-    rm -f $IRONIC_VM_MACS_CSV_FILE
-    if [ -f $IRONIC_KEY_FILE ]; then
-        local key
-        key=$(cat $IRONIC_KEY_FILE.pub)
-        # remove public key from authorized_keys
-        grep -v "$key" $IRONIC_AUTHORIZED_KEYS_FILE > temp && mv temp $IRONIC_AUTHORIZED_KEYS_FILE
-        chmod 0600 $IRONIC_AUTHORIZED_KEYS_FILE
-    fi
-    sudo rm -rf $IRONIC_DATA_DIR $IRONIC_STATE_PATH
-
-    local vm_name
-    for vm_name in $(_ironic_bm_vm_names); do
-        sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/cleanup-node $vm_name $IRONIC_VM_NETWORK_BRIDGE"
-    done
-
-    sudo rm -rf /etc/xinetd.d/tftp /etc/init/tftpd-hpa.override
-    restart_service xinetd
-    sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -D INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
-    if is_deployed_by_agent; then
-        # agent ramdisk gets instance image from swift
-        sudo iptables -D INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
-    fi
-    sudo rmmod nf_conntrack_tftp || true
-    sudo rmmod nf_nat_tftp || true
-}
-
-# Restore xtrace + pipefail
-$_XTRACE_IRONIC
-$_PIPEFAIL_IRONIC
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stackrc b/stackrc
index f949ccbad9..8e6ea42a00 100644
--- a/stackrc
+++ b/stackrc
@@ -225,10 +225,6 @@ HEAT_BRANCH=${HEAT_BRANCH:-master}
 HORIZON_REPO=${HORIZON_REPO:-${GIT_BASE}/openstack/horizon.git}
 HORIZON_BRANCH=${HORIZON_BRANCH:-master}
 
-# baremetal provisioning service
-IRONIC_REPO=${IRONIC_REPO:-${GIT_BASE}/openstack/ironic.git}
-IRONIC_BRANCH=${IRONIC_BRANCH:-master}
-
 # unified auth system (manages accounts/tokens)
 KEYSTONE_REPO=${KEYSTONE_REPO:-${GIT_BASE}/openstack/keystone.git}
 KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-master}
@@ -298,6 +294,8 @@ GITBRANCH["python-heatclient"]=${HEATCLIENT_BRANCH:-master}
 # ironic client
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
 GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
+# ironic plugin is out of tree, but nova uses it. set GITDIR here.
+GITDIR["python-ironicclient"]=$DEST/python-ironicclient
 
 # the base authentication plugins that clients use to authenticate
 GITREPO["keystoneauth"]=${KEYSTONEAUTH_REPO:-${GIT_BASE}/openstack/keystoneauth.git}
@@ -484,6 +482,8 @@ GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
+# this doesn't exist in a lib file, so set it here
+GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 
 ##################
diff --git a/tools/ironic/scripts/cleanup-node b/tools/ironic/scripts/cleanup-node
deleted file mode 100755
index c4e4e706f4..0000000000
--- a/tools/ironic/scripts/cleanup-node
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-# **cleanup-nodes**
-
-# Cleans up baremetal poseur nodes and volumes created during ironic setup
-# Assumes calling user has proper libvirt group membership and access.
-
-set -exu
-
-LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-NAME=$1
-NETWORK_BRIDGE=$2
-
-export VIRSH_DEFAULT_CONNECT_URI=$LIBVIRT_CONNECT_URI
-
-VOL_NAME="$NAME.qcow2"
-virsh list | grep -q $NAME && virsh destroy $NAME
-virsh list --inactive | grep -q $NAME && virsh undefine $NAME
-
-if virsh pool-list | grep -q $LIBVIRT_STORAGE_POOL ; then
-  virsh vol-list $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
-      virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL
-fi
diff --git a/tools/ironic/scripts/configure-vm b/tools/ironic/scripts/configure-vm
deleted file mode 100755
index 378fcb85ad..0000000000
--- a/tools/ironic/scripts/configure-vm
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/usr/bin/env python
-
-import argparse
-import os.path
-
-import libvirt
-
-templatedir = os.path.join(os.path.dirname(os.path.dirname(__file__)),
-                           'templates')
-
-
-CONSOLE_LOG = """
-    <serial type='file'>
-      <source path='%(console_log)s'/>
-      <target port='0'/>
-      <alias name='serial0'/>
-    </serial>
-    <serial type='pty'>
-      <source path='/dev/pts/49'/>
-      <target port='1'/>
-      <alias name='serial1'/>
-    </serial>
-    <console type='file'>
-      <source path='%(console_log)s'/>
-      <target type='serial' port='0'/>
-      <alias name='serial0'/>
-    </console>
-"""
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Configure a kvm virtual machine for the seed image.")
-    parser.add_argument('--name', default='seed',
-                        help='the name to give the machine in libvirt.')
-    parser.add_argument('--image',
-                        help='Use a custom image file (must be qcow2).')
-    parser.add_argument('--engine', default='qemu',
-                        help='The virtualization engine to use')
-    parser.add_argument('--arch', default='i686',
-                        help='The architecture to use')
-    parser.add_argument('--memory', default='2097152',
-                        help="Maximum memory for the VM in KB.")
-    parser.add_argument('--cpus', default='1',
-                        help="CPU count for the VM.")
-    parser.add_argument('--bootdev', default='hd',
-                        help="What boot device to use (hd/network).")
-    parser.add_argument('--network', default="brbm",
-                        help='The libvirt network name to use')
-    parser.add_argument('--libvirt-nic-driver', default='e1000',
-                        help='The libvirt network driver to use')
-    parser.add_argument('--console-log',
-                        help='File to log console')
-    parser.add_argument('--emulator', default=None,
-                        help='Path to emulator bin for vm template')
-    args = parser.parse_args()
-    with file(templatedir + '/vm.xml', 'rb') as f:
-        source_template = f.read()
-    params = {
-        'name': args.name,
-        'imagefile': args.image,
-        'engine': args.engine,
-        'arch': args.arch,
-        'memory': args.memory,
-        'cpus': args.cpus,
-        'bootdev': args.bootdev,
-        'network': args.network,
-        'nicdriver': args.libvirt_nic_driver,
-        'emulator': args.emulator,
-    }
-
-    if args.emulator:
-        params['emulator'] = args.emulator
-    else:
-        if os.path.exists("/usr/bin/kvm"):  # Debian
-            params['emulator'] = "/usr/bin/kvm"
-        elif os.path.exists("/usr/bin/qemu-kvm"):  # Redhat
-            params['emulator'] = "/usr/bin/qemu-kvm"
-
-    if args.console_log:
-        params['bios_serial'] = "<bios useserial='yes'/>"
-        params['console_log'] = CONSOLE_LOG % {'console_log': args.console_log}
-    else:
-        params['bios_serial'] = ''
-        params['console_log'] = ''
-    libvirt_template = source_template % params
-    conn = libvirt.open("qemu:///system")
-
-    a = conn.defineXML(libvirt_template)
-    print ("Created machine %s with UUID %s" % (args.name, a.UUIDString()))
-
-if __name__ == '__main__':
-    main()
diff --git a/tools/ironic/scripts/create-node b/tools/ironic/scripts/create-node
deleted file mode 100755
index b018acddc9..0000000000
--- a/tools/ironic/scripts/create-node
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-# **create-nodes**
-
-# Creates baremetal poseur nodes for ironic testing purposes
-
-set -ex
-
-# Keep track of the DevStack directory
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-
-NAME=$1
-CPU=$2
-MEM=$(( 1024 * $3 ))
-# Extra G to allow fuzz for partition table : flavor size and registered size
-# need to be different to actual size.
-DISK=$(( $4 + 1))
-
-case $5 in
-    i386) ARCH='i686' ;;
-    amd64) ARCH='x86_64' ;;
-    *) echo "Unsupported arch $4!" ; exit 1 ;;
-esac
-
-BRIDGE=$6
-EMULATOR=$7
-LOGDIR=$8
-
-LIBVIRT_NIC_DRIVER=${LIBVIRT_NIC_DRIVER:-"e1000"}
-LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-export VIRSH_DEFAULT_CONNECT_URI=$LIBVIRT_CONNECT_URI
-
-if ! virsh pool-list --all | grep -q $LIBVIRT_STORAGE_POOL; then
-    virsh pool-define-as --name $LIBVIRT_STORAGE_POOL dir --target /var/lib/libvirt/images >&2
-    virsh pool-autostart $LIBVIRT_STORAGE_POOL >&2
-    virsh pool-start $LIBVIRT_STORAGE_POOL >&2
-fi
-
-pool_state=$(virsh pool-info $LIBVIRT_STORAGE_POOL | grep State | awk '{ print $2 }')
-if [ "$pool_state" != "running" ] ; then
-  [ ! -d /var/lib/libvirt/images ] && sudo mkdir /var/lib/libvirt/images
-  virsh pool-start $LIBVIRT_STORAGE_POOL >&2
-fi
-
-if [ -n "$LOGDIR" ] ; then
-  mkdir -p "$LOGDIR"
-fi
-
-PREALLOC=
-if [ -f /etc/debian_version ]; then
-    PREALLOC="--prealloc-metadata"
-fi
-
-if [ -n "$LOGDIR" ] ; then
-  VM_LOGGING="--console-log $LOGDIR/${NAME}_console.log"
-else
-  VM_LOGGING=""
-fi
-VOL_NAME="${NAME}.qcow2"
-
-if ! virsh list --all | grep -q $NAME; then
-  virsh vol-list --pool $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
-      virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL >&2
-  virsh vol-create-as $LIBVIRT_STORAGE_POOL ${VOL_NAME} ${DISK}G --format qcow2 $PREALLOC >&2
-  volume_path=$(virsh vol-path --pool $LIBVIRT_STORAGE_POOL $VOL_NAME)
-  # Pre-touch the VM to set +C, as it can only be set on empty files.
-  sudo touch "$volume_path"
-  sudo chattr +C "$volume_path" || true
-  $TOP_DIR/scripts/configure-vm \
-    --bootdev network --name $NAME --image "$volume_path" \
-    --arch $ARCH --cpus $CPU --memory $MEM --libvirt-nic-driver $LIBVIRT_NIC_DRIVER \
-    --emulator $EMULATOR --network $BRIDGE $VM_LOGGING >&2
-
-fi
-
-# echo mac
-virsh dumpxml $NAME | grep "mac address" | head -1 | cut -d\' -f2
diff --git a/tools/ironic/scripts/setup-network b/tools/ironic/scripts/setup-network
deleted file mode 100755
index 83308ed416..0000000000
--- a/tools/ironic/scripts/setup-network
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-# **setup-network**
-
-# Setups openvswitch libvirt network suitable for
-# running baremetal poseur nodes for ironic testing purposes
-
-set -exu
-
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-# Keep track of the DevStack directory
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-BRIDGE_SUFFIX=${1:-''}
-BRIDGE_NAME=brbm$BRIDGE_SUFFIX
-
-export VIRSH_DEFAULT_CONNECT_URI="$LIBVIRT_CONNECT_URI"
-
-# Only add bridge if missing
-(sudo ovs-vsctl list-br | grep ${BRIDGE_NAME}$) || sudo ovs-vsctl add-br ${BRIDGE_NAME}
-
-# Remove bridge before replacing it.
-(virsh net-list | grep "${BRIDGE_NAME} ") && virsh net-destroy ${BRIDGE_NAME}
-(virsh net-list --inactive  | grep "${BRIDGE_NAME} ") && virsh net-undefine ${BRIDGE_NAME}
-
-virsh net-define <(sed s/brbm/$BRIDGE_NAME/ $TOP_DIR/templates/brbm.xml)
-virsh net-autostart ${BRIDGE_NAME}
-virsh net-start ${BRIDGE_NAME}
diff --git a/tools/ironic/templates/brbm.xml b/tools/ironic/templates/brbm.xml
deleted file mode 100644
index 0769d3f1d0..0000000000
--- a/tools/ironic/templates/brbm.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<network>
-  <name>brbm</name>
-  <forward mode='bridge'/>
-  <bridge name='brbm'/>
-  <virtualport type='openvswitch'/>
-</network>
diff --git a/tools/ironic/templates/tftpd-xinetd.template b/tools/ironic/templates/tftpd-xinetd.template
deleted file mode 100644
index 5f3d03f3bb..0000000000
--- a/tools/ironic/templates/tftpd-xinetd.template
+++ /dev/null
@@ -1,14 +0,0 @@
-service tftp
-{
-  protocol        = udp
-  port            = 69
-  socket_type     = dgram
-  wait            = yes
-  user            = root
-  server          = /usr/sbin/in.tftpd
-  server_args     = -v -v -v -v -v --map-file %TFTPBOOT_DIR%/map-file %TFTPBOOT_DIR%
-  disable         = no
-  # This is a workaround for Fedora, where TFTP will listen only on
-  # IPv6 endpoint, if IPv4 flag is not used.
-  flags           = IPv4
-}
diff --git a/tools/ironic/templates/vm.xml b/tools/ironic/templates/vm.xml
deleted file mode 100644
index ae7d685256..0000000000
--- a/tools/ironic/templates/vm.xml
+++ /dev/null
@@ -1,49 +0,0 @@
-<domain type='%(engine)s'>
-  <name>%(name)s</name>
-  <memory unit='KiB'>%(memory)s</memory>
-  <vcpu>%(cpus)s</vcpu>
-  <os>
-    <type arch='%(arch)s' machine='pc-1.0'>hvm</type>
-    <boot dev='%(bootdev)s'/>
-    <bootmenu enable='no'/>
-    %(bios_serial)s
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <pae/>
-  </features>
-  <clock offset='utc'/>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>restart</on_crash>
-  <devices>
-    <emulator>%(emulator)s</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' cache='writeback'/>
-      <source file='%(imagefile)s'/>
-      <target dev='vda' bus='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
-    </disk>
-    <controller type='ide' index='0'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
-    </controller>
-    <interface type='network'>
-      <source network='%(network)s'/>
-      <virtualport type='openvswitch'/>
-      <model type='%(nicdriver)s'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
-    </interface>
-    <input type='mouse' bus='ps2'/>
-    <graphics type='vnc' port='-1' autoport='yes'/>
-    <video>
-      <model type='cirrus' vram='9216' heads='1'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
-    </video>
-    %(console_log)s
-    <memballoon model='virtio'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
-    </memballoon>
-  </devices>
-</domain>
-

From 50ce626db752d5b20dc79b9118a877db2c5b1c1c Mon Sep 17 00:00:00 2001
From: John Kasperski <jckasper@us.ibm.com>
Date: Mon, 23 Nov 2015 15:47:45 -0600
Subject: [PATCH 1075/3333] Neutron: Fix IPv6 provider networks

The creation of the IPv6 subnet with provider networks does not
specifiy the correct parameters:
 . V6_NETWORK_GATEWAY is specified but never set
       - created new IPV6_PROVIDER_NETWORK_GATEWAY
 . PROVIDER_SUBNET_NAME_V6 is specified but never set
       - created new IPV6_PROVIDER_SUBNET_NAME
 . FIXED_RANGE_V6 is being used
       - created new IPV6_PROVIDER_FIXED_RANGE
 . subnetpool_id is incorrect
       - changed to subnetpool

Related-Bug: #1507870
Closes-Bug: #1417410
Change-Id: I9a1ad11bc54529080ec84d4677fa5633708890c7
---
 lib/neutron-legacy | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index caf89e3d8c..be11ee9deb 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -165,6 +165,9 @@ NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 ## Provider Network Information
 PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
+IPV6_PROVIDER_SUBNET_NAME=${IPV6_PROVIDER_SUBNET_NAME:-"provider_net_v6"}
+IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
+IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 
 # Define the public bridge that will transmit traffic from VMs to the
 # physical network - used by both the OVS and Linux Bridge drivers.
@@ -545,9 +548,9 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 --subnetpool_id None $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
+        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME --subnetpool None $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then

From fbe0a62785781f2a5764697dd4b3e60f44fbe4e4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 10 Dec 2015 19:36:50 -0500
Subject: [PATCH 1076/3333] Stop using deprecated tempest options

This commit updates lib/tempest to stop using deprecated config
options when tempest is configured.

Change-Id: I65b56ff681d6c27094380693c953fbc3664eceb0
---
 lib/tempest | 31 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 61351c0628..f35d142af4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -281,18 +281,12 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
-    iniset $TEMPEST_CONFIG identity username $TEMPEST_USERNAME
-    iniset $TEMPEST_CONFIG identity password "$password"
-    iniset $TEMPEST_CONFIG identity tenant_name $TEMPEST_TENANT_NAME
-    iniset $TEMPEST_CONFIG identity alt_username $ALT_USERNAME
-    iniset $TEMPEST_CONFIG identity alt_password "$password"
-    iniset $TEMPEST_CONFIG identity alt_tenant_name $ALT_TENANT_NAME
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
-        iniset $TEMPEST_CONFIG identity admin_username $ADMIN_USERNAME
-        iniset $TEMPEST_CONFIG identity admin_password "$password"
-        iniset $TEMPEST_CONFIG identity admin_tenant_name $ADMIN_TENANT_NAME
-        iniset $TEMPEST_CONFIG identity admin_tenant_id $ADMIN_TENANT_ID
-        iniset $TEMPEST_CONFIG identity admin_domain_name $ADMIN_DOMAIN_NAME
+        iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
+        iniset $TEMPEST_CONFIG auth admin_password "$password"
+        iniset $TEMPEST_CONFIG auth admin_tenant_name $ADMIN_TENANT_NAME
+        iniset $TEMPEST_CONFIG auth admin_tenant_id $ADMIN_TENANT_ID
+        iniset $TEMPEST_CONFIG auth admin_domain_name $ADMIN_DOMAIN_NAME
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
@@ -319,11 +313,7 @@ function configure_tempest {
 
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
-    iniset $TEMPEST_CONFIG compute network_for_ssh $PRIVATE_NETWORK_NAME
-    iniset $TEMPEST_CONFIG compute ip_version_for_ssh 4
-    iniset $TEMPEST_CONFIG compute ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
-    iniset $TEMPEST_CONFIG compute image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt
     iniset $TEMPEST_CONFIG compute image_alt_ssh_user ${ALT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
@@ -480,6 +470,10 @@ function configure_tempest {
 
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
+    iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
+    iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
+    iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
+    iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
     # TODO(dkranz): Remove the bootable flag when Juno is end of life.
@@ -525,7 +519,6 @@ function configure_tempest {
 
     # Dashboard
     iniset $TEMPEST_CONFIG dashboard dashboard_url "http://$SERVICE_HOST/"
-    iniset $TEMPEST_CONFIG dashboard login_url "http://$SERVICE_HOST/auth/login/"
 
     # CLI
     iniset $TEMPEST_CONFIG cli cli_dir $NOVA_BIN_DIR
@@ -592,13 +585,13 @@ function configure_tempest {
         else
             tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
-        iniset $TEMPEST_CONFIG auth allow_tenant_isolation False
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
     elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
-        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
 
     else
-        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     fi
 
     # Restore IFS

From 4ce859ab2b99e68ce937c9c9df83d9270c8ef9fb Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sun, 20 Dec 2015 01:27:30 -0500
Subject: [PATCH 1077/3333] update create_heat_accounts, don't use os_url and
 os_token

Currently, the function create_heat_accounts uses the OS_URL and
OS_TOKEN environment variables. This is a bad choice for several
reasons, most importantly we are sending the "ADMIN_TOKEN" value
as a header. There is also no reason to not use a standard admin
user to create these resources.

Change-Id: I70b41d69917b9e53ad09c2c61e022ef09a50acfd
---
 functions-common | 26 ++++++++++++++++++++++++++
 lib/heat         | 29 +++++++----------------------
 2 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/functions-common b/functions-common
index 1b01eefaf9..b15c3d7653 100644
--- a/functions-common
+++ b/functions-common
@@ -866,6 +866,32 @@ function get_or_add_user_project_role {
     echo $user_role_id
 }
 
+# Gets or adds user role to domain
+# Usage: get_or_add_user_domain_role <role> <user> <domain>
+function get_or_add_user_domain_role {
+    local user_role_id
+    # Gets user role id
+    user_role_id=$(openstack role list \
+        --user $2 \
+        --column "ID" \
+        --domain $3 \
+        --column "Name" \
+        | grep " $1 " | get_field 1)
+    if [[ -z "$user_role_id" ]]; then
+        # Adds role to user and get it
+        openstack role add $1 \
+            --user $2 \
+            --domain $3
+        user_role_id=$(openstack role list \
+            --user $2 \
+            --column "ID" \
+            --domain $3 \
+            --column "Name" \
+            | grep " $1 " | get_field 1)
+    fi
+    echo $user_role_id
+}
+
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
diff --git a/lib/heat b/lib/heat
index fdcf5bcaad..ff196f4a81 100644
--- a/lib/heat
+++ b/lib/heat
@@ -402,28 +402,13 @@ function create_heat_accounts {
     fi
 
     if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
-        # Note we have to pass token/endpoint here because the current endpoint and
-        # version negotiation in OSC means just --os-identity-api-version=3 won't work
-        D_ID=$(openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 domain list | grep ' heat ' | get_field 1)
-
-        if [[ -z "$D_ID" ]]; then
-            D_ID=$(openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-                --os-identity-api-version=3 domain create heat \
-                --description "Owns users and projects created by heat" \
-                | grep ' id ' | get_field 2)
-            iniset $HEAT_CONF DEFAULT stack_user_domain_id ${D_ID}
-
-            openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-                --os-identity-api-version=3 user create --password $SERVICE_PASSWORD \
-                --domain $D_ID heat_domain_admin \
-                --description "Manages users and projects created by heat"
-            openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-                --os-identity-api-version=3 role add \
-                --user heat_domain_admin --domain ${D_ID} admin
-            iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
-            iniset $HEAT_CONF DEFAULT stack_domain_admin_password $SERVICE_PASSWORD
-        fi
+        # domain -> heat and user -> heat_domain_admin
+        domain_id=$(get_or_create_domain heat 'Owns users and projects created by heat')
+        iniset $HEAT_CONF DEFAULT stack_user_domain_id ${domain_id}
+        get_or_create_user heat_domain_admin $SERVICE_PASSWORD heat
+        get_or_add_user_domain_role admin heat_domain_admin heat
+        iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
+        iniset $HEAT_CONF DEFAULT stack_domain_admin_password $SERVICE_PASSWORD
     fi
 }
 

From bfdd47c8538260db26ead098cbafa62afb637a60 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Sun, 20 Dec 2015 16:30:36 -0500
Subject: [PATCH 1078/3333] Enable swap stats in dstat

Swap stats could be useful for trouble-shooting. It is better to
have it enabled in dstat.

Change-Id: I44e0735a95cd6ca3def9b04510551df16a1337a4
---
 tools/dstat.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 6ba4515acf..3c0b3be089 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -13,7 +13,7 @@
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --swap"
 
 # Command-line arguments for secondary background DStat process.
 DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"

From f59e6df23a430f0622215fec5bbbe18cfe7fee9c Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 21 Dec 2015 08:36:40 -0500
Subject: [PATCH 1079/3333] Do not fail with Tox 2.3.1

Latest tox causes failures:
   File "/usr/local/lib/python2.7/dist-packages/tox/config.py", line 1140, in processcommand
     argv = list(shlexer)
   File "/usr/lib/python2.7/shlex.py", line 269, in next
     token = self.get_token()
   File "/usr/lib/python2.7/shlex.py", line 96, in get_token
     raw = self.read_token()
   File "/usr/lib/python2.7/shlex.py", line 172, in read_token
     raise ValueError, "No closing quotation"
 ValueError: No closing quotation

This is caused by a backwards incompatible change in tox:
https://bitbucket.org/hpk42/tox/issues/181

Change-Id: Ic28c634cf806394cfa82b61cb45be60b8f40a61a
---
 tox.ini | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/tox.ini b/tox.ini
index 9279455bb8..f9d04f2dcd 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,20 +12,20 @@ deps =
    {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
-         -not \( -type d -name .?\* -prune \)    \ # prune all 'dot' dirs
-         -not \( -type d -name doc -prune \)     \ # skip documentation
-         -not \( -type d -name shocco -prune \)  \ # skip shocco
-         -type f                                 \ # only files
-         -not -name \*~                          \ # skip editors, readme, etc
+         -not \( -type d -name .?\* -prune \)    \
+         -not \( -type d -name doc -prune \)     \
+         -not \( -type d -name shocco -prune \)  \
+         -type f                                 \
+         -not -name \*~                          \
          -not -name \*.md                        \
          \(                                      \
           -name \*.sh -or                        \
           -name \*.orig -or                      \
-          -name \*rc -or                         \ # openrc files, etc
+          -name \*rc -or                         \
           -name functions\* -or                  \
-          -wholename \*/inc/\* -or               \ # /inc files and
-          -wholename \*/lib/\*                   \ # /lib files are shell, but
-         \)                                      \ #   have no extension
+          -wholename \*/inc/\* -or               \
+          -wholename \*/lib/\*                   \
+         \)                                      \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]

From 512be7de181b1ede95e1d31dd67cd87b7d2d41e8 Mon Sep 17 00:00:00 2001
From: syed ahsan shamim zaidi <ahsanmohsin04@yahoo.com>
Date: Tue, 20 Oct 2015 21:20:27 +0000
Subject: [PATCH 1080/3333] docs: Add additional configuration in Neutron guide

Adding NETWORK_GATEWAY to the docs

Change-Id: I67be468d9fbe5f323e21c81b673248d4b629c8ef
Closes-Bug:#1508195
---
 doc/source/guides/neutron.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 5891f68033..c7a1153608 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -215,6 +215,7 @@ controller node.
         ## Neutron Networking options used to create Neutron Subnets
 
         FIXED_RANGE="203.0.113.0/24"
+        NETWORK_GATEWAY=203.0.113.1
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010

From 79e65304708605979589568ad3b2909482ee4496 Mon Sep 17 00:00:00 2001
From: Min Pae <sputnik13@gmail.com>
Date: Tue, 22 Dec 2015 10:31:03 -0800
Subject: [PATCH 1081/3333] Adding cue to plugin registry

Adding cue to the plugin registry under "Official OpenStack Projects"

Change-Id: I24fc76eb6aadb653c0db5a0fa1d8e22cd166dbe9
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c68d926822..0740ba0eff 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -28,6 +28,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |congress          |git://git.openstack.org/openstack/congress   | governance         |
 +------------------+---------------------------------------------+--------------------+
+|cue               |git://git.openstack.org/openstack/cue        | message-broker     |
++------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
 +------------------+---------------------------------------------+--------------------+
 |magnum            |git://git.openstack.org/openstack/magnum     |                    |

From ba23ba317abd6a65979b3006410eb4ba6429cf09 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Tue, 22 Dec 2015 23:33:30 +0300
Subject: [PATCH 1082/3333] remove configuration for boto section

thirdparty.boto tests was removed from tempest and this section
is no needed more

Change-Id: Ibec0534d118423be7a51c2e2b82f1c61531503a0
---
 extras.d/80-tempest.sh |  1 -
 lib/tempest            | 63 ------------------------------------------
 2 files changed, 64 deletions(-)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 74f4c60d10..5e8da99a92 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -13,7 +13,6 @@ if is_service_enabled tempest; then
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
-        init_tempest
     elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
         # local.conf Tempest option overrides
         :
diff --git a/lib/tempest b/lib/tempest
index 61351c0628..b2c4798af9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -35,7 +35,6 @@
 #
 # - install_tempest
 # - configure_tempest
-# - init_tempest
 
 # Save trace setting
 _XTRACE_TEMPEST=$(set +o | grep xtrace)
@@ -67,9 +66,6 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 # have tempest installed in DevStack by default.
 INSTALL_TEMPEST=${INSTALL_TEMPEST:-"True"}
 
-BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
-BOTO_CONF=/etc/boto.cfg
-
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}
 TEMPEST_DEFAULT_VOLUME_VENDOR="Open Source"
@@ -131,7 +127,6 @@ function configure_tempest {
     local flavor_lines
     local public_network_id
     local public_router_id
-    local boto_instance_type="m1.tiny"
     local ssh_connect_method="fixed"
 
     # Save IFS
@@ -202,14 +197,12 @@ function configure_tempest {
                 nova flavor-create m1.nano 42 64 0 1
             fi
             flavor_ref=42
-            boto_instance_type=m1.nano
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 nova flavor-create m1.micro 84 128 0 1
             fi
             flavor_ref_alt=84
         else
             # Check Nova for existing flavors, if ``DEFAULT_INSTANCE_TYPE`` is set use it.
-            boto_instance_type=$DEFAULT_INSTANCE_TYPE
             IFS=$'\r\n'
             flavors=""
             for line in $available_flavors; do
@@ -254,15 +247,6 @@ function configure_tempest {
             awk '{print $2}')
     fi
 
-    EC2_URL=$(get_endpoint_url ec2 public || true)
-    if [[ -z $EC2_URL ]]; then
-        EC2_URL="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
-    fi
-    S3_URL=$(get_endpoint_url s3 public || true)
-    if [[ -z $S3_URL ]]; then
-        S3_URL="http://$SERVICE_HOST:${S3_SERVICE_PORT:-3333}"
-    fi
-
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
 
     # Oslo
@@ -275,8 +259,6 @@ function configure_tempest {
     # Timeouts
     iniset $TEMPEST_CONFIG compute build_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG volume build_timeout $BUILD_TIMEOUT
-    iniset $TEMPEST_CONFIG boto build_timeout $BUILD_TIMEOUT
-    iniset $TEMPEST_CONFIG boto http_socket_timeout 5
 
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
@@ -429,16 +411,6 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
 
-    # boto
-    iniset $TEMPEST_CONFIG boto ec2_url "$EC2_URL"
-    iniset $TEMPEST_CONFIG boto s3_url "$S3_URL"
-    iniset $TEMPEST_CONFIG boto s3_materials_path "$BOTO_MATERIALS_PATH"
-    iniset $TEMPEST_CONFIG boto ari_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd.manifest.xml
-    iniset $TEMPEST_CONFIG boto ami_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img.manifest.xml
-    iniset $TEMPEST_CONFIG boto aki_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz.manifest.xml
-    iniset $TEMPEST_CONFIG boto instance_type "$boto_instance_type"
-    iniset $TEMPEST_CONFIG boto http_socket_timeout 30
-
     # Orchestration Tests
     if is_service_enabled heat; then
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
@@ -578,12 +550,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG service_available cinder "False"
     fi
 
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
-        # Use the ``BOTO_CONFIG`` environment variable to point to this file
-        iniset -sudo $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
-        sudo chown $STACK_USER $BOTO_CONF
-    fi
-
     # Auth
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
@@ -645,35 +611,6 @@ function install_tempest {
     popd
 }
 
-# init_tempest() - Initialize EC2 images
-function init_tempest {
-    local base_image_name=cirros-${CIRROS_VERSION}-${CIRROS_ARCH}
-    # /opt/stack/devstack/files/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec
-    local image_dir="$FILES/images/${base_image_name}-uec"
-    local kernel="$image_dir/${base_image_name}-vmlinuz"
-    local ramdisk="$image_dir/${base_image_name}-initrd"
-    local disk_image="$image_dir/${base_image_name}-blank.img"
-    if is_service_enabled nova; then
-        # If the CirrOS uec downloaded and the system is UEC capable
-        if [ -f "$kernel" -a -f "$ramdisk" -a -f "$disk_image" -a  "$VIRT_DRIVER" != "openvz" \
-            -a \( "$LIBVIRT_TYPE" != "lxc" -o "$VIRT_DRIVER" != "libvirt" \) ]; then
-            echo "Prepare aki/ari/ami Images"
-            mkdir -p $BOTO_MATERIALS_PATH
-            ( #new namespace
-                # euca2ools should be installed to call euca-* commands
-                is_package_installed euca2ools || install_package euca2ools
-                # tenant:demo ; user: demo
-                source $TOP_DIR/accrc/demo/demo
-                euca-bundle-image -r ${CIRROS_ARCH} -i "$kernel" --kernel true -d "$BOTO_MATERIALS_PATH"
-                euca-bundle-image -r ${CIRROS_ARCH} -i "$ramdisk" --ramdisk true -d "$BOTO_MATERIALS_PATH"
-                euca-bundle-image -r ${CIRROS_ARCH} -i "$disk_image" -d "$BOTO_MATERIALS_PATH"
-            ) 2>&1 </dev/null | cat
-        else
-            echo "Boto materials are not prepared"
-        fi
-    fi
-}
-
 # Restore xtrace
 $_XTRACE_TEMPEST
 

From 50120fa047726c8ff9b76ef8bd9294bab0c7bb5d Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Sun, 13 Dec 2015 10:41:34 +0800
Subject: [PATCH 1083/3333] Kill neutron-rootwrap-daemon when stop neutron
 service

Neutron-rootwrap-daemon cannot be killed when you stop
neutron services, so here we add the right command in
the neutron stop-service scripts.

Change-Id: I91fefb277427e0e16ff59760b7255e4c7eee1792
Closes-Bug: #1525601
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 6af44e6ab8..47fa650953 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -780,6 +780,10 @@ function stop_neutron_other {
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
+
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
+    fi
 }
 
 # stop_neutron() - Stop running processes (non-screen)

From f7dc06cb892ca9d2918ae9bafba13bfa72a7da98 Mon Sep 17 00:00:00 2001
From: Hua Wang <wanghua.humble@gmail.com>
Date: Wed, 23 Dec 2015 12:15:59 +0800
Subject: [PATCH 1084/3333] Option "auth_plugin" is deprecated.

Option "auth_plugin" from group "keystone_authtoken" is deprecated.
Use option "auth_type" from group "keystone_authtoken".

Change-Id: I01371bd924114d6470e960a91a3045fe7dc22339
Closes-Bug: #1528746
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 6b4118de0b..60f86fe112 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -443,7 +443,7 @@ function configure_auth_token_middleware {
     local signing_dir=$3
     local section=${4:-keystone_authtoken}
 
-    iniset $conf_file $section auth_plugin password
+    iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD

From a6bbe031f17d82e2a4ef7338de65acb762e9527a Mon Sep 17 00:00:00 2001
From: Yuriy Nesenenko <ynesenenko@mirantis.com>
Date: Wed, 23 Dec 2015 16:00:02 +0200
Subject: [PATCH 1085/3333] Fix restoring a backup volume to a larger volume

We cannot restore a backup to a larger volume on ceph because it
fails with status "error_restoring". This patch adds read/write
permissions to volumes pool for backup user. We need such permissions
to change volume size during restoring backup when the backup is
smaller than a volume.

Change-Id: I794c1126bcee4e07baf5a9dcfee779fd61da5636
Closes-Bug: 1519749
---
 lib/cinder_backends/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index c21350ba01..9bff5bef4f 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -62,7 +62,7 @@ function configure_cinder_backend_ceph {
                 sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
             fi
         fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
         iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph"

From 44ee7e307b49c5ee9e30ba380e36576189efdc34 Mon Sep 17 00:00:00 2001
From: liyingjun <liyingjun1988@gmail.com>
Date: Fri, 25 Dec 2015 10:32:14 +0800
Subject: [PATCH 1086/3333] Fix heat config when using keystone v3

Use configure_auth_token_middleware to generate keystone_authtoken
section configration.

Change-Id: I87e0e60afb958683add2aff2552d26cbf8c9e374
Closes-bug: #1300246
---
 lib/heat | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/heat b/lib/heat
index 3666776317..c15bbe2b0b 100644
--- a/lib/heat
+++ b/lib/heat
@@ -150,12 +150,7 @@ function configure_heat {
         iniset $HEAT_CONF paste_deploy flavor standalone
         iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
     else
-        iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-        iniset $HEAT_CONF keystone_authtoken admin_user $HEAT_SERVICE_USER
-        iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
-        iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
-        iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
-        iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
+        configure_auth_token_middleware $HEAT_CONF heat $HEAT_AUTH_CACHE_DIR
     fi
 
     # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure

From cc6af3fc94ea56b0f081eabcb65404b0fa3716fe Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Wed, 23 Dec 2015 02:17:01 +0000
Subject: [PATCH 1087/3333] XenAPI: add support to use local.conf

XenServer install with devstack doesn't support local.conf, this fix
is to add support for using local.conf and backward-compatibility of
localrc

Change-Id: Ie494e01f8f1ecb8720e14392ef3f12d5a5a01dcd
Closes-Bug: #1528520
---
 inc/meta-config              | 19 +++++++++++++++++++
 stack.sh                     | 14 +-------------
 tools/xen/install_os_domU.sh | 11 ++++-------
 3 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index b6fe437802..6eb7a00f69 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -195,6 +195,25 @@ function merge_config_group {
     done
 }
 
+function extract_localrc_section {
+    local configfile=$1    # top_dir/local.conf
+    local localrcfile=$2   # top_dir/localrc
+    local localautofile=$3 # top_dir/.localrc.auto
+
+    if [[ -r $configfile ]]; then
+        LRC=$(get_meta_section_files $configfile local)
+        for lfile in $LRC; do
+            if [[ "$lfile" == "localrc" ]]; then
+                if [[ -r $localrcfile ]]; then
+                    echo "localrc and local.conf:[[local]] both exist, using localrc"
+                else
+                    echo "# Generated file, do not edit" >$localautofile
+                    get_meta_section $configfile local $lfile >>$localautofile
+                fi
+            fi
+        done
+    fi
+}
 
 # Restore xtrace
 $_XTRACE_INC_META
diff --git a/stack.sh b/stack.sh
index 09ab4747f1..df893da57a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -149,19 +149,7 @@ GetDistro
 
 # Phase: local
 rm -f $TOP_DIR/.localrc.auto
-if [[ -r $TOP_DIR/local.conf ]]; then
-    LRC=$(get_meta_section_files $TOP_DIR/local.conf local)
-    for lfile in $LRC; do
-        if [[ "$lfile" == "localrc" ]]; then
-            if [[ -r $TOP_DIR/localrc ]]; then
-                warn $LINENO "localrc and local.conf:[[local]] both exist, using localrc"
-            else
-                echo "# Generated file, do not edit" >$TOP_DIR/.localrc.auto
-                get_meta_section $TOP_DIR/local.conf local $lfile >>$TOP_DIR/.localrc.auto
-            fi
-        fi
-    done
-fi
+extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
 
 # ``stack.sh`` is customizable by setting environment variables.  Override a
 # default setting via export::
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index e24d9ed0b9..46ff0b6fda 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -12,13 +12,6 @@ set -o xtrace
 
 export LC_ALL=C
 
-# Abort if localrc is not set
-if [ ! -e ../../localrc ]; then
-    echo "You must have a localrc with ALL necessary passwords defined before proceeding."
-    echo "See the xen README for required passwords."
-    exit 1
-fi
-
 # This directory
 THIS_DIR=$(cd $(dirname "$0") && pwd)
 
@@ -31,6 +24,10 @@ THIS_DIR=$(cd $(dirname "$0") && pwd)
 #
 # Get Settings
 #
+TOP_DIR=$(cd $THIS_DIR/../../ && pwd)
+source $TOP_DIR/inc/meta-config
+rm -f $TOP_DIR/.localrc.auto
+extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
 
 # Source params - override xenrc params in your localrc to suit your taste
 source $THIS_DIR/xenrc

From 135bd484a9f83099e33e18dd97274ad550a392bb Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Fri, 11 Dec 2015 11:03:52 +0200
Subject: [PATCH 1088/3333] Introduce iniget_sections function

This function returns list of sections from specified INI file.
It is needed for I7938f26015d953efdf720774b5ad2cee4068ac90.
'iniget_sections' is needed for automatic node enrollment to
Ironic from INI syntax file.

Change-Id: I52a69ad3bc8fc528e7f20e6b03a98f327acaaa74
Implements: blueprint ironic-ml2-integration
---
 inc/ini-config           | 12 ++++++++++++
 tests/test_ini_config.sh |  5 +++++
 2 files changed, 17 insertions(+)

diff --git a/inc/ini-config b/inc/ini-config
index d2830d79cd..e99b088994 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -261,6 +261,18 @@ function iniuncomment {
     $xtrace
 }
 
+# Get list of sections from an INI file
+# iniget_sections config-file
+function iniget_sections {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+
+    echo $(sed -ne "s/^\[\(.*\)\]/\1/p" "$file")
+    $xtrace
+}
+
 # Restore xtrace
 $INC_CONF_TRACE
 
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index d9cb8d8a99..a5e110736e 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -80,6 +80,11 @@ if [ -n "$TEST_SUDO" ]; then
     sudo chown -R root:root ${INI_TMP_ETC_DIR}
 fi
 
+# test iniget_sections
+VAL=$(iniget_sections "${TEST_INI}")
+assert_equal "$VAL" "default aaa bbb ccc ddd eee del_separate_options \
+del_same_option del_missing_option del_missing_option_multi del_no_options"
+
 # Test with missing arguments
 BEFORE=$(cat ${TEST_INI})
 

From 5979f47a3df4e7662c70236e7ddf0bedcbe5ea25 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Sun, 3 Jan 2016 18:08:14 +0100
Subject: [PATCH 1089/3333] Fix get_plugin_packages when multiple plugins are
 in use

Due to missing space no plugin packages are installed in this case.

Change-Id: I56b105510e4d31a411f2531fdb20c4ddf1ebff20
Closes-Bug: #1530675
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index c3eef469d3..93c94896ef 100644
--- a/functions-common
+++ b/functions-common
@@ -1176,7 +1176,7 @@ function get_plugin_packages {
     local package_dir=""
     for plugin in ${DEVSTACK_PLUGINS//,/ }; do
         local package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
-        files_to_parse+="$package_dir/$plugin"
+        files_to_parse+=" $package_dir/$plugin"
     done
     echo "$(_parse_package_files $files_to_parse)"
     $xtrace

From 5bf6a9489c52600ab0fe5a68e554398531894051 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 31 Dec 2015 16:22:04 -0600
Subject: [PATCH 1090/3333] Write volume API version into clouds.yaml

We're trying to get things to use volume v2 by default. devstack already
deploys a v2 endpoint. Tell clouds.yaml that this devstack cloud is a v2
enabled cloud.

Change-Id: I6f792ce65153389aa1ee133e9bd363c394b28534
Closes-Bug: 1467589
---
 tools/update_clouds_yaml.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 3a364fe982..eb7265f76c 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -36,6 +36,7 @@ def __init__(self, args):
         self._cloud_data = {
             'region_name': args.os_region_name,
             'identity_api_version': args.os_identity_api_version,
+            'volume_api_version': args.os_volume_api_version,
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
@@ -82,6 +83,7 @@ def main():
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
     parser.add_argument('--os-identity-api-version', default='3')
+    parser.add_argument('--os-volume-api-version', default='2')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)

From f73263d47a85f1fe6d1b80d10e85fe35a46aa8ef Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 25 Dec 2015 08:29:32 -0600
Subject: [PATCH 1091/3333] Remove uses of --os-url and --os-token

Those were originally used to bootstrap with admin-token from keystone,
but the openstack client is fully configured now, leaving no reason to
not just use the actual users that are there.

Change-Id: I80bdee33a78a97f5d3910aa36dc331f19780d2f1
---
 functions-common | 2 --
 1 file changed, 2 deletions(-)

diff --git a/functions-common b/functions-common
index e8f8b10f79..8a087317ec 100644
--- a/functions-common
+++ b/functions-common
@@ -975,8 +975,6 @@ function get_or_create_endpoint {
 function get_endpoint_url {
     echo $(openstack endpoint list \
             --service $1 --interface $2 \
-            --os-url $KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             -c URL -f value)
 }
 

From e208d060e17e2ad622c7b06cd90baed0eeed89f8 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Sat, 21 Nov 2015 11:15:39 +0000
Subject: [PATCH 1092/3333] Preserve result returned by apt-get and pip

Change I855ffe9c7a75e9943106af0f70cf715c34ae25c5 and
I368fec44858bd97fc6a314fb20eed2b10932cbb1 added timing
infrastructure which hides the return value of
the main commands.  Restore the prior behaviour.

Change-Id: I4a536abefa7824ac6d42e7bbbf1079d9cc055984
Closes-Bug: #1518545
---
 functions-common | 4 +++-
 inc/python       | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 4a9db34119..486dcc5d59 100644
--- a/functions-common
+++ b/functions-common
@@ -1045,7 +1045,7 @@ function apt_get_update {
 # Uses globals ``OFFLINE``, ``*_proxy``
 # apt_get operation package [package ...]
 function apt_get {
-    local xtrace
+    local xtrace result
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
@@ -1062,9 +1062,11 @@ function apt_get {
         http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
         no_proxy=${no_proxy:-} \
         apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
+    result=$?
 
     # stop the clock
     time_stop "apt-get"
+    return $result
 }
 
 function _parse_package_files {
diff --git a/inc/python b/inc/python
index c157604699..f4f65fd2e8 100644
--- a/inc/python
+++ b/inc/python
@@ -81,7 +81,7 @@ function get_python_versions_for_package {
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
 # pip_install package [package ...]
 function pip_install {
-    local xtrace
+    local xtrace result
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local upgrade=""
@@ -155,10 +155,11 @@ function pip_install {
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         $cmd_pip $upgrade \
         $@
+    result=$?
 
     # Also install test requirements
     local test_req="${!#}/test-requirements.txt"
-    if [[ -e "$test_req" ]]; then
+    if [[ $result == 0 ]] && [[ -e "$test_req" ]]; then
         echo "Installing test-requirements for $test_req"
         $sudo_pip \
             http_proxy=${http_proxy:-} \
@@ -167,9 +168,11 @@ function pip_install {
             PIP_FIND_LINKS=$PIP_FIND_LINKS \
             $cmd_pip $upgrade \
             -r $test_req
+        result=$?
     fi
 
     time_stop "pip_install"
+    return $result
 }
 
 # get version of a package from global requirements file

From 90bc5867728aafb66b374ae6e6a93318303dcff0 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Tue, 1 Dec 2015 18:04:40 +0100
Subject: [PATCH 1093/3333] Remove support for Fedora 21 (EOL); add F22 where
 appropriate

Fedora 21 reached its End Of Life (EOL) on 1-DEC-2015[1]; remove it as
supported distribution.

    - stack.sh: Remove Fedora 21 from list of supported distributions.
    - tools/fixup_stuff.sh: Make the minimum Fedora version to be F22 in
      from a conditional check in 'Python packages' section
    - files/rpms/general: Remove 'f21' from NOPRIME.
    - lib/ceph: Remove 'f21' from the check_os_support_ceph() function.
    - doc/source/index.rst: s/Fedora 21/Fedora 22/
    - pkg/elasticsearch.sh: Remove the 'if' conditional in the
      install_elasticsearch() function.

[1] https://fedoramagazine.org/fedora-21-end-life-december-1st/

Change-Id: Ifbcc3dd783ff2f362a464fbf4ca22f20cc2c658e
---
 doc/source/index.rst | 2 +-
 files/rpms/general   | 6 +++---
 files/rpms/nova      | 2 +-
 lib/ceph             | 2 +-
 pkg/elasticsearch.sh | 1 -
 stack.sh             | 2 +-
 tools/fixup_stuff.sh | 2 +-
 7 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2622436820..4a1d93d817 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -20,7 +20,7 @@ Quick Start
 
 #. Select a Linux Distribution
 
-   Only Ubuntu 14.04 (Trusty), Fedora 21 (or Fedora 22) and CentOS/RHEL
+   Only Ubuntu 14.04 (Trusty), Fedora 22 (or Fedora 23) and CentOS/RHEL
    7 are documented here. OpenStack also runs and is packaged on other
    flavors of Linux such as OpenSUSE and Debian.
 
diff --git a/files/rpms/general b/files/rpms/general
index 280468283b..5bc87b6172 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -8,9 +8,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f21,f22,f23
+iptables-services  # NOPRIME f22,f23
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f21,f22,f23
+java-1.8.0-openjdk-headless  # NOPRIME f22,f23
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -26,7 +26,7 @@ postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
-redhat-rpm-config # MySQL-python rhbz-1195207 f21
+redhat-rpm-config # MySQL-python rhbz-1195207
 screen
 tar
 tcpdump
diff --git a/files/rpms/nova b/files/rpms/nova
index 4db9a06d95..0312e856dd 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f21,f22,f23
+kernel-modules # dist:f22,f23
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/lib/ceph b/lib/ceph
index 4ac498ab97..3e0839aaa2 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f21|f22|f23) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f22|f23) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 14d13cf733..7488306845 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -88,7 +88,6 @@ function install_elasticsearch {
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10
     elif is_fedora; then
-        if [[ "$os_RELEASE" -ge "21" ]]; then
             is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
         else
             is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
diff --git a/stack.sh b/stack.sh
index bc67ce069c..b5dc51c6ec 100755
--- a/stack.sh
+++ b/stack.sh
@@ -195,7 +195,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 9ae2ae7d90..193a1f7aba 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -135,7 +135,7 @@ if is_fedora; then
         fi
     fi
 
-    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "21" ]]; then
+    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "22" ]]; then
         # requests ships vendored version of chardet/urllib3, but on
         # fedora these are symlinked back to the primary versions to
         # avoid duplication of code on disk.  This is fine when

From 0842b8147f098106b679cf652edbcb5ea4330f04 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 3 Aug 2015 13:31:25 -0500
Subject: [PATCH 1094/3333] Support extra dependencies when setup_develop

Recent pip supports using [extras] to install extra dependencies
from the project setup.cfg. Add support so that projects can take
advantage of it.

For example, if devstack is configured to use ldap, install the
extra ldap dependencies using:

 setup_develop $KEYSTONE_DIR ldap

Partial-Bug: 1479962
Change-Id: Ic13d95b99aaa4d3854b2723343e90f5de6b98aa2
---
 inc/python | 56 +++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 49 insertions(+), 7 deletions(-)

diff --git a/inc/python b/inc/python
index c157604699..2bf426489d 100644
--- a/inc/python
+++ b/inc/python
@@ -239,15 +239,31 @@ function setup_dev_lib {
 
 # this should be used if you want to install globally, all libraries should
 # use this, especially *oslo* ones
+#
+# setup_install project_dir [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install <project_dir>[<extras>]"
 function setup_install {
     local project_dir=$1
-    setup_package_with_constraints_edit $project_dir
+    local extras=$2
+    _setup_package_with_constraints_edit $project_dir "" $extras
 }
 
 # this should be used for projects which run services, like all services
+#
+# setup_develop project_dir [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install -e <project_dir>[<extras>]"
 function setup_develop {
     local project_dir=$1
-    setup_package_with_constraints_edit $project_dir -e
+    local extras=$2
+    _setup_package_with_constraints_edit $project_dir -e $extras
 }
 
 # determine if a project as specified by directory is in
@@ -269,10 +285,17 @@ function is_in_projects_txt {
 # install this package we get the from source version.
 #
 # Uses globals ``REQUIREMENTS_DIR``
-# setup_develop directory
-function setup_package_with_constraints_edit {
+# _setup_package_with_constraints_edit project_dir flags [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# flags: pip CLI options/flags
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install <flags> <project_dir>[<extras>]"
+function _setup_package_with_constraints_edit {
     local project_dir=$1
     local flags=$2
+    local extras=$3
 
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
@@ -283,19 +306,38 @@ function setup_package_with_constraints_edit {
             "$flags file://$project_dir#egg=$name"
     fi
 
-    setup_package $project_dir $flags
+    setup_package $project_dir "$flags" $extras
 
 }
 
 # ``pip install -e`` the package, which processes the dependencies
 # using pip before running `setup.py develop`
+#
 # Uses globals ``STACK_USER``
-# setup_develop_no_requirements_update directory
+# setup_package project_dir [flags] [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# flags: pip CLI options/flags
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install <flags> <project_dir>[<extras>]"
 function setup_package {
     local project_dir=$1
     local flags=$2
+    local extras=$3
+
+    # if the flags variable exists, and it doesn't look like a flag,
+    # assume it's actually the extras list.
+    if [[ -n "$flags" && -z "$extras" && ! "$flags" =~ ^-.* ]]; then
+        extras=$flags
+        flags=""
+    fi
+
+    if [[ ! -z "$extras" ]]; then
+        extras="[$extras]"
+    fi
 
-    pip_install $flags $project_dir
+    pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
     if [[ "$flags" == "-e" ]]; then
         safe_chown -R $STACK_USER $1/*.egg-info

From 6a4d3eb55fb377a0ddef3d8978a85d2137430834 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sat, 1 Aug 2015 09:19:18 -0500
Subject: [PATCH 1095/3333] Use keystone[ldap] for ldap packages

Keystone now provides an "ldap" in extras to install its ldap
dependencies so devstack doesn't have to track the python
dependencies itself.

Installation of the extras is done in an extra install line. This is
slightly redundant, however this pattern works much better from an
install stand point as it supports an arbitrarily large number of
extras.

Partial-Bug: 1479962
Change-Id: If0f0ff48f3d6b3c414f2d6fcd747ecf45a397658
---
 lib/keystone | 5 +++++
 lib/ldap     | 2 --
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index b4b7df9a30..f7736147a7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -506,6 +506,11 @@ function install_keystone {
     fi
     git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH
     setup_develop $KEYSTONE_DIR
+
+    if is_service_enabled ldap; then
+        setup_develop $KEYSTONE_DIR ldap
+    fi
+
     if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
         if is_ssl_enabled_service "key"; then
diff --git a/lib/ldap b/lib/ldap
index 65056aea2f..4cea812d3c 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -145,8 +145,6 @@ function install_ldap {
         sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
     fi
 
-    pip_install_gr ldappool
-
     rm -rf $tmp_ldap_dir
 }
 

From f212622cbd8165caba640625159d35dd2fcde38f Mon Sep 17 00:00:00 2001
From: henriquetruta <henrique@lsd.ufcg.edu.br>
Date: Tue, 5 Jan 2016 13:43:18 -0300
Subject: [PATCH 1096/3333] Adding ENABLE_IDENTITY_V2 on docs

Adds the documentation of ENABLE_IDENTITY_V2 property on keystone
section.

Change-Id: If72325751c3bfd7f11f46c518c9fbf59f10a894f
---
 doc/source/configuration.rst | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 386fbbbf71..48c08dd557 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -644,8 +644,18 @@ In RegionOne:
 In RegionTwo:
 
 ::
-   
+
     disable_service horizon
     KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     REGION_NAME=RegionTwo
+
+Disabling Identity API v2
++++++++++++++++++++++++++
+
+The Identity API v2 is deprecated as of Mitaka and it is recommended to only
+use the v3 API. It is possible to setup keystone without v2 API, by doing:
+
+::
+
+    ENABLE_IDENTITY_V2=False

From a0d1b0151a9d9e169e6342f36a073e8154119924 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Mon, 16 Nov 2015 17:30:48 -0500
Subject: [PATCH 1097/3333] Delete OVS port on unstack to retain system
 connectivity

If you configure devstack with the following three values,
for example:

PHYSICAL_NETWORK=eth0
PUBLIC_INTERFACE=eth0
OVS_PHYSICAL_BRIDGE=br-eth0

This will cause devstack to create an OVS bridge, create a port for
eth0, and add it to the bridge (along with it's IP address).

The problem is that on unstack the port is never deleted from OVS,
so eth0 gets "trapped", not showing up in any of the OVS commands,
but not usable by the system.  The only workaround is to unload the
OVS kernel module.

There needs to be an 'ovs-vsctl del-port ...' call at the end of
_move_neutron_addresses_route() on unstack - the antidote to the
'ovs-vsctl add-port ...', that happened on stack.

Closes-Bug: #1516801

Change-Id: Id2ff60f1f8e8fffff1eaffd68d9de4f6aa772943
---
 lib/neutron-legacy | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index cc5b75e2b9..b8fce2833a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -802,7 +802,8 @@ function _move_neutron_addresses_route {
     local from_intf=$1
     local to_intf=$2
     local add_ovs_port=$3
-    local af=$4
+    local del_ovs_port=$4
+    local af=$5
 
     if [[ -n "$from_intf" && -n "$to_intf" ]]; then
         # Remove the primary IP address from $from_intf and add it to $to_intf,
@@ -816,6 +817,7 @@ function _move_neutron_addresses_route {
         local DEFAULT_ROUTE_GW
         DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
+        local DEL_OVS_PORT=""
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
@@ -827,13 +829,19 @@ function _move_neutron_addresses_route {
             ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
         fi
 
+        if [[ "$del_ovs_port" == "True" ]]; then
+            DEL_OVS_PORT="sudo ovs-vsctl --if-exists del-port $from_intf $to_intf"
+        fi
+
         if [[ "$IP_BRD" != "" ]]; then
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
             IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
             IP_UP="sudo ip link set $to_intf up"
         fi
 
-        $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        # The add/del OVS port calls have to happen either before or
+        # after the address is moved in order to not leave it orphaned.
+        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
     fi
 }
 
@@ -842,14 +850,14 @@ function _move_neutron_addresses_route {
 function cleanup_neutron {
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
-        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
 
         if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
             # ip(8) wants the prefix length when deleting
             local v6_gateway
             v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
             sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
-            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
+            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False False "inet6"
         fi
 
         if is_provider_network && is_ironic_hardware; then
@@ -1044,10 +1052,10 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent
 
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
+    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
 
     if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
     fi
 }
 

From e0d61118f198e6a46af0956902485098f78e8d26 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Thu, 17 Dec 2015 08:47:46 +0000
Subject: [PATCH 1098/3333] Enable SameHostFilter and DifferentHostFilter

The default filters of nova don't contain SameHostFilter and
DifferentHostFilter, so we cannot test them on the gate.
This patch makes these filters available for the development.

Change-Id: Ia6b4847e9bb21048d254d0a460ae4c5be896b17b
Closes-Bug: #1526620
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6337f875ef..bb4b4a1cd2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -98,6 +98,10 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-nova.scheduler.filter_scheduler.FilterScheduler}
 
+# The following FILTERS contains SameHostFilter and DifferentHostFilter with
+# the default filters.
+FILTERS="RetryFilter,AvailabilityZoneFilter,RamFilter,DiskFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+
 QEMU_CONF=/etc/libvirt/qemu.conf
 
 # Set default defaults here as some hypervisor drivers override these
@@ -507,6 +511,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
+    iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF"
     iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"

From 3526276a0827afb5a598c046e410b88bcb8f2e65 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 5 Jan 2016 23:56:40 -0500
Subject: [PATCH 1099/3333] Add support for role and resource keystone backends

Keystone further broken apart the assignment backend into: role,
resource, and assignment. We should define the backends in the
config file and allow users to override the default by passing in
their own value.

Change-Id: Ieb22c428609d3db852814c7eceb77efa6bbde633
---
 lib/keystone | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index b4b7df9a30..0c2722c526 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -68,6 +68,12 @@ KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 # Select the Assignment backend driver
 KEYSTONE_ASSIGNMENT_BACKEND=${KEYSTONE_ASSIGNMENT_BACKEND:-sql}
 
+# Select the Role backend driver
+KEYSTONE_ROLE_BACKEND=${KEYSTONE_ROLE_BACKEND:-sql}
+
+# Select the Resource backend driver
+KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
+
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
@@ -209,6 +215,8 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
     iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
+    iniset $KEYSTONE_CONF role driver "$KEYSTONE_ROLE_BACKEND"
+    iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 

From 3809defb2e3e66b7b9ad1cd9a827c14ba16f8ce7 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Wed, 6 Jan 2016 08:19:24 +0000
Subject: [PATCH 1100/3333] Fix elastic search support for Fedora.

Change Ifbcc3dd783ff2f362a464fbf4ca22f20cc2c658e broken it [1]

[1] https://review.openstack.org/#/c/251980/2/pkg/elasticsearch.sh

Change-Id: I330498cd490f3af2e9a569d86e8639a03b48dd17
Closes-Bug: #1531424
---
 pkg/elasticsearch.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 7488306845..9c4f6f7801 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -88,10 +88,7 @@ function install_elasticsearch {
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10
     elif is_fedora; then
-            is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
-        else
-            is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
-        fi
+        is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
         yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
         sudo /bin/systemctl daemon-reload
         sudo /bin/systemctl enable elasticsearch.service

From 4d8c03a377dbb819f28d199fe9fca7e4b576e7e3 Mon Sep 17 00:00:00 2001
From: Zhang Jinnan <zhang.jinnan@99cloud.net>
Date: Thu, 20 Aug 2015 10:00:20 -0400
Subject: [PATCH 1101/3333] Enable some serivce when on boot

Solve the devstack ./rejoin-stack.sh when is reboot-safe in RHEL 7.
Enable mysql, postgresql, rabbitmq-server, openvswitch service when on boot.

Change-Id: I3ce9fc58ccc76092ad08314de1c3c9339ebfb3b5
Related-Bug: #1486833
---
 lib/databases/mysql          | 1 +
 lib/databases/postgresql     | 3 +++
 lib/neutron_plugins/ovs_base | 1 +
 lib/rpc_backend              | 3 +++
 4 files changed, 8 insertions(+)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index c2ab32e5b2..510da7541a 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -154,6 +154,7 @@ EOF
         fi
     elif is_fedora; then
         install_package mariadb-server
+        sudo systemctl enable mariadb
     elif is_ubuntu; then
         install_package mysql-server
     else
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 78c7bedc90..261574f256 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -101,6 +101,9 @@ EOF
         install_package postgresql
     elif is_fedora || is_suse; then
         install_package postgresql-server
+        if is_fedora; then
+            sudo systemctl enable postgresql-server
+        fi
     else
         exit_distro_not_supported "postgresql installation"
     fi
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index b012683a6f..849d0b744b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -65,6 +65,7 @@ function _neutron_ovs_base_install_agent_packages {
         restart_service openvswitch-switch
     elif is_fedora; then
         restart_service openvswitch
+        sudo systemctl enable openvswitch
     elif is_suse; then
         restart_service openvswitch-switch
     fi
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 03eacd8674..2e1c89713c 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -48,6 +48,9 @@ function install_rpc_backend {
         # Install rabbitmq-server
         install_package rabbitmq-server
     fi
+    if is_fedora; then
+        sudo systemctl enable rabbitmq-server
+    fi
 }
 
 # restart the rpc backend

From a5ea08b7526bee0d9cab51000a477654726de8fe Mon Sep 17 00:00:00 2001
From: Alexander Schmidt <alexs@linux.vnet.ibm.com>
Date: Wed, 2 Dec 2015 15:30:44 +0000
Subject: [PATCH 1102/3333] Add distro support for KVM for IBM z Systems

Add "KVM for IBM z Systems" to the list of Fedora-like distros.

As the distribution does not have a dedicated kvm package,
prevent the installation of the kvm package during the libvirt
setup.

Change-Id: Ibb5c60797d6867264f9dea7fea85cdf1d7c72ded
---
 functions-common                   | 4 +++-
 lib/nova_plugins/functions-libvirt | 5 ++++-
 stack.sh                           | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index a150dc5841..e2ebd53839 100644
--- a/functions-common
+++ b/functions-common
@@ -410,6 +410,8 @@ function GetDistro {
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
         DISTRO="xs$os_RELEASE"
+    elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
+        DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
         # Catch-all for now is Vendor + Release + Update
         DISTRO="$os_VENDOR-$os_RELEASE.$os_UPDATE"
@@ -444,7 +446,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
-        [ "$os_VENDOR" = "CloudLinux" ]
+        [ "$os_VENDOR" = "CloudLinux" ] || [ "$os_VENDOR" = "kvmibm" ]
 }
 
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dae55c6eba..0afdad821f 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -38,7 +38,10 @@ function install_libvirt {
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
-        install_package kvm
+        # On "KVM for IBM z Systems", kvm does not have its own package
+        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
+            install_package kvm
+        fi
         # there is a dependency issue with kvm (which is really just a
         # wrapper to qemu-system-x86) that leaves some bios files out,
         # so install qemu-kvm (which shouldn't strictly be needed, as
diff --git a/stack.sh b/stack.sh
index 90481e09a6..1fa506c52d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -183,7 +183,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From a263e7dd52f65e92e6fc0a09ec89509904f83d6b Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 7 Jan 2016 19:40:44 +0100
Subject: [PATCH 1103/3333] lib/cinder:configure tgt even if the package was
 purged

On Ubuntu, after a successful ./stack.sh and ./unstack.sh, if one
"apt-get purge tgt", then the directory /etc/tgt/stack.d/ still
exist (i.e it is not purged) but /etc/tgt/targets.conf is removed.
Thus any subsequent ./stack.sh would fail to configure
/etc/tgt/targets.conf properly.

Change-Id: I252789f3f39bd64b5a1e7d9abb923386d2a158dd
---
 lib/cinder | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 5bd940bc20..9ca8109023 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -467,6 +467,8 @@ function install_cinderclient {
 function _configure_tgt_for_config_d {
     if [[ ! -d /etc/tgt/stack.d/ ]]; then
         sudo ln -sf $CINDER_STATE_PATH/volumes /etc/tgt/stack.d
+    fi
+    if ! grep -q "include /etc/tgt/stack.d/*" /etc/tgt/targets.conf; then
         echo "include /etc/tgt/stack.d/*" | sudo tee -a /etc/tgt/targets.conf
     fi
 }

From 75633266c851856b32056b8b5eb1b6ed4f29b84e Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Thu, 7 Jan 2016 16:46:37 -0600
Subject: [PATCH 1104/3333] rpc_backend: Conditionally enable rabbit on fedora

Change 4d8c03a3 added logic to enable rabbit on Fedora/CentOS systems
whether or not rabbit is enabled. This corrects that to only enable
rabbit when it is configured as such.

Change-Id: I270e79ff989176770d65df1ac0ac4e2c4382bb9a
Signed-off-by: Kyle Mestery <mestery@mestery.com>
---
 lib/rpc_backend | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index a44287c1b8..05e303e3e7 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -47,9 +47,9 @@ function install_rpc_backend {
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-    fi
-    if is_fedora; then
-        sudo systemctl enable rabbitmq-server
+        if is_fedora; then
+            sudo systemctl enable rabbitmq-server
+        fi
     fi
 }
 

From ecc1f41d5053807a70b51bcf2247b51d0ac81ae1 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Mon, 28 Dec 2015 15:14:13 +0100
Subject: [PATCH 1105/3333] Don't reinstall package just after installing.

Boolean logic used in install_package was wrong:
on nominal flow packages were actually installed twice.
This should fix it.

Change-Id: Ia465414936b272d04523a11f83d6ded378fe1daf
Closes-Bug: #1518544
---
 functions-common | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index cb2998bfcd..361d27c854 100644
--- a/functions-common
+++ b/functions-common
@@ -1245,7 +1245,9 @@ function real_install_package {
 # install_package package [package ...]
 function install_package {
     update_package_repo
-    real_install_package $@ || RETRY_UPDATE=True update_package_repo && real_install_package $@
+    if ! real_install_package "$@"; then
+        RETRY_UPDATE=True update_package_repo && real_install_package "$@"
+    fi
 }
 
 # Distro-agnostic function to tell if a package is installed

From 2babf3963f4eea8558b0c287c51e6faeb7069c70 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Sun, 3 Jan 2016 20:20:12 +0000
Subject: [PATCH 1106/3333] Don't die when yum fails.

Not all yum failures has to be considered
catastrofic failures also because install_package
function should implement the same behavior in Fedora,
CentOS and Ubuntu. Let return the error to be solved at higher
level.

Change-Id: Ia33bb98f47017f6ec00eb3b7261ed42d72efc573
Closes-Bug: #1522590
---
 functions-common | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index cb2998bfcd..d7d8299ad0 100644
--- a/functions-common
+++ b/functions-common
@@ -1300,13 +1300,17 @@ function yum_install {
             BEGIN { fail=0 }
             /No package/ { fail=1 }
             { print }
-            END { exit fail }' || \
-                die $LINENO "Missing packages detected"
+            END { exit fail }'
+        result=$?
 
-    # also ensure we catch a yum failure
-    if [[ ${PIPESTATUS[0]} != 0 ]]; then
-        die $LINENO "${YUM:-yum} install failure"
+    if [ $result != 0 ]; then
+        echo $LINENO "Missing packages detected"
+    elif [[ ${PIPESTATUS[0]} != 0 ]]; then
+        # also ensure we catch a yum failure
+        echo $LINENO "${YUM:-yum} install failure"
+        result=1
     fi
+    return $result
 }
 
 # zypper wrapper to set arguments correctly

From f568c3a141f04c86ba2d971eb0fa908b4a060731 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 7 Jan 2016 19:10:50 -0800
Subject: [PATCH 1107/3333] Fix SIGITIN hang with apt-get

Fix an issue where apt-get consistently hangs due to a SIGTTIN being
received. This occurs on a 'vanilla' devstack-gate VM, when running an
ironic-grenade job.

Upstream has a bug related to this:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=555632

http://www.gnu.org/software/libc/manual/html_node/Job-Control-Signals.html
Macro: int SIGTTIN

    A process cannot read from the user's terminal while it is running
    as a background job. When any process in a background job tries to
    read from the terminal, all of the processes in the job are sent a
    SIGTTIN signal. The default action for this signal is to stop the
    process. For more information about how this interacts with the
    terminal driver, see Access to the Terminal.

Change-Id: I8b1f3dccf329bb88e017eff7492da5e701b4892c
Closes-Bug: #1532080
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index e2ebd53839..e4d92cb532 100644
--- a/functions-common
+++ b/functions-common
@@ -1065,7 +1065,7 @@ function apt_get {
     $sudo DEBIAN_FRONTEND=noninteractive \
         http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
         no_proxy=${no_proxy:-} \
-        apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
+        apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@" < /dev/null
     result=$?
 
     # stop the clock

From af8b6e10a3470808b54c2a2f5031a68ce1a151df Mon Sep 17 00:00:00 2001
From: Yuriy Nesenenko <ynesenenko@mirantis.com>
Date: Wed, 6 Jan 2016 17:14:45 +0200
Subject: [PATCH 1108/3333] Add flag for test_volume_services

test_volume_services works incorrect with host info if it includes
backend name (host@backend). The test is skipped by default for
Liberty and Kilo gates. Need to add flag to unskip this test in new release.
This fix related with bug #1530144 in service-list filter.

Change-Id: Ifdc0bab819c05a00cd0c20316bd81961cf6aeb88
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index c510984382..63df4f9f80 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -485,6 +485,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
     # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
+    # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
+    iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
 
     local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then

From 923be5f791c78fa9f21b2e217a6b61328c493a38 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sun, 20 Dec 2015 00:24:19 -0500
Subject: [PATCH 1109/3333] bootstrap keystone using new bootstrap command

Be gone ADMIN_TOKEN, long live keystone-manage bootstrap.

This patch reworks the initial setup for keystone by using
the new bootstrap command. After a minimal service catalog
has been created, using this process, we simply authenticate
as usual.

implements bp: bootstrap
Depends-On: I113c6934b6b83ceff23a94101967a6df1126873f
Change-Id: Ia1475d461eab60b68c6a0356714b21c7f92e0194
---
 lib/keystone       | 76 ++++++++++++++++++++++++++++++++++------------
 samples/local.conf |  6 ++--
 stack.sh           | 47 ++++++++++------------------
 3 files changed, 75 insertions(+), 54 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 057bb47188..6f13ec655d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -12,7 +12,6 @@
 # - ``IDENTITY_API_VERSION``
 # - ``BASE_SQL_CONN``
 # - ``SERVICE_HOST``, ``SERVICE_PROTOCOL``
-# - ``SERVICE_TOKEN``
 # - ``S3_SERVICE_PORT`` (template backend only)
 
 # ``stack.sh`` calls the entry points in this order:
@@ -22,6 +21,7 @@
 # - _config_keystone_apache_wsgi
 # - init_keystone
 # - start_keystone
+# - bootstrap_keystone
 # - create_keystone_accounts
 # - stop_keystone
 # - cleanup_keystone
@@ -230,8 +230,6 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
     fi
 
-    iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"
-
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
     fi
@@ -324,14 +322,16 @@ function configure_keystone {
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
-    # admin
+    # The keystone bootstrapping process (performed via keystone-manage bootstrap)
+    # creates an admin user, admin role and admin project. As a sanity check
+    # we exercise the CLI to retrieve the IDs for these values.
     local admin_tenant
-    admin_tenant=$(get_or_create_project "admin" default)
+    admin_tenant=$(openstack project show "admin" -f value -c id)
     local admin_user
-    admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
+    admin_user=$(openstack user show "admin" -f value -c id)
     local admin_role
-    admin_role=$(get_or_create_role "admin")
-    get_or_add_user_project_role $admin_role $admin_user $admin_tenant
+    admin_role=$(openstack role show "admin" -f value -c id)
+
     get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
@@ -381,17 +381,6 @@ function create_keystone_accounts {
     get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
     get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
     get_or_add_group_project_role $admin_role $admin_group $admin_tenant
-
-    # Keystone
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        get_or_create_service "keystone" "identity" "Keystone Identity Service"
-        get_or_create_endpoint "identity" \
-            "$REGION_NAME" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
-    fi
 }
 
 # Create a user that is capable of verifying keystone tokens for use with auth_token middleware.
@@ -565,6 +554,55 @@ function stop_keystone {
     stop_process key
 }
 
+# bootstrap_keystone() - Initialize user, role and project
+# This function uses the following GLOBAL variables:
+# - ``KEYSTONE_BIN_DIR``
+# - ``ADMIN_PASSWORD``
+# - ``IDENTITY_API_VERSION``
+# - ``KEYSTONE_CATALOG_BACKEND``
+# - ``KEYSTONE_AUTH_URI``
+# - ``REGION_NAME``
+# - ``KEYSTONE_SERVICE_PROTOCOL``
+# - ``KEYSTONE_SERVICE_HOST``
+# - ``KEYSTONE_SERVICE_PORT``
+function bootstrap_keystone {
+
+    # Initialize keystone, this will create an 'admin' user, 'admin' project,
+    # 'admin' role, and assign the user the role on the project. These resources
+    # are created only if they do not already exist.
+    $KEYSTONE_BIN_DIR/keystone-manage bootstrap --bootstrap-password $ADMIN_PASSWORD
+
+    # Create the keystone service and endpoints. To do this with the new
+    # bootstrapping process, we need to get a token and use that token to
+    # interact with the new APIs. The token will only be used to create services
+    # and endpoints, thus creating a minimal service catalog.
+    # They are unset immediately after.
+    # TODO(stevemar): OpenStackClient and KeystoneClient do not have support to
+    # handle interactions that not return service catalogs. Eventually remove
+    # this section when the support is in place. Use token based auth for now.
+    local token_id
+    token_id=$(openstack token issue -c id -f value \
+        --os-username admin --os-project-name admin \
+        --os-user-domain-id default --os-project-domain-id default \
+        --os-identity-api-version 3 --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-password $ADMIN_PASSWORD)
+
+    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
+
+        export OS_TOKEN=$token_id
+        export OS_URL=$KEYSTONE_AUTH_URI/v3
+        export OS_IDENTITY_API_VERSION=3
+
+        get_or_create_service "keystone" "identity" "Keystone Identity Service"
+        get_or_create_endpoint "identity" \
+            "$REGION_NAME" \
+            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+            "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
+    fi
+
+    unset OS_TOKEN OS_URL OS_IDENTITY_API_VERSION
+}
 
 # Restore xtrace
 $_XTRACE_KEYSTONE
diff --git a/samples/local.conf b/samples/local.conf
index 34c9e8b48e..f77e1726d4 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -23,10 +23,8 @@
 # While ``stack.sh`` is happy to run without ``localrc``, devlife is better when
 # there are a few minimal variables set:
 
-# If the ``SERVICE_TOKEN`` and ``*_PASSWORD`` variables are not set
-# here you will be prompted to enter values for them by ``stack.sh``
-# and they will be added to ``local.conf``.
-SERVICE_TOKEN=azertytoken
+# If the ``*_PASSWORD`` variables are not set here you will be prompted to enter
+# values for them by ``stack.sh``and they will be added to ``local.conf``.
 ADMIN_PASSWORD=nomoresecrete
 DATABASE_PASSWORD=stackdb
 RABBIT_PASSWORD=stackqueue
diff --git a/stack.sh b/stack.sh
index 5e4a4f8310..e9831d5039 100755
--- a/stack.sh
+++ b/stack.sh
@@ -652,9 +652,6 @@ fi
 # --------
 
 if is_service_enabled keystone; then
-    # The ``SERVICE_TOKEN`` is used to bootstrap the Keystone database.  It is
-    # just a string and is not a 'real' Keystone token.
-    read_password SERVICE_TOKEN "ENTER A SERVICE_TOKEN TO USE FOR THE SERVICE ADMIN TOKEN."
     # Services authenticate to Identity with servicename/``SERVICE_PASSWORD``
     read_password SERVICE_PASSWORD "ENTER A SERVICE_PASSWORD TO USE FOR THE SERVICE AUTHENTICATION."
     # Horizon currently truncates usernames and passwords at 20 characters
@@ -994,40 +991,13 @@ if is_service_enabled keystone; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
         init_keystone
         start_keystone
+        bootstrap_keystone
     fi
 
-    export OS_IDENTITY_API_VERSION=3
-
-    # Set up a temporary admin URI for Keystone
-    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v3
-
     if is_service_enabled tls-proxy; then
         export OS_CACERT=$INT_CA_DIR/ca-chain.pem
-        # Until the client support is fixed, just use the internal endpoint
-        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v3
-    fi
-
-    # Setup OpenStackClient token-endpoint auth
-    export OS_TOKEN=$SERVICE_TOKEN
-    export OS_URL=$SERVICE_ENDPOINT
-
-    create_keystone_accounts
-    create_nova_accounts
-    create_glance_accounts
-    create_cinder_accounts
-    create_neutron_accounts
-
-    if is_service_enabled swift; then
-        create_swift_accounts
-    fi
-
-    if is_service_enabled heat; then
-        create_heat_accounts
     fi
 
-    # Begone token auth
-    unset OS_TOKEN OS_URL
-
     # Rather than just export these, we write them out to a
     # intermediate userrc file that can also be used to debug if
     # something goes wrong between here and running
@@ -1037,6 +1007,7 @@ if is_service_enabled keystone; then
 # Use this for debugging issues before files in accrc are created
 
 # Set up password auth credentials now that Keystone is bootstrapped
+export OS_IDENTITY_API_VERSION=3
 export OS_AUTH_URL=$KEYSTONE_AUTH_URI
 export OS_USERNAME=admin
 export OS_USER_DOMAIN_ID=default
@@ -1049,6 +1020,20 @@ EOF
 
     source $TOP_DIR/userrc_early
 
+    create_keystone_accounts
+    create_nova_accounts
+    create_glance_accounts
+    create_cinder_accounts
+    create_neutron_accounts
+
+    if is_service_enabled swift; then
+        create_swift_accounts
+    fi
+
+    if is_service_enabled heat; then
+        create_heat_accounts
+    fi
+
 fi
 
 # Write a clouds.yaml file

From 3567d6103abab8484c40f1a46f2465d0931dfbb0 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 5 Jan 2016 21:36:23 -0500
Subject: [PATCH 1110/3333] remove SERVICE_TOKEN from the docs

there are a few lingering instances of SERVICE_TOKEN in the docs
and some of the scripts in tools.

Change-Id: I9d2147eea6639db1f4ea15a259c147eecfc339ff
---
 doc/source/configuration.rst                 | 1 -
 doc/source/guides/devstack-with-lbaas-v2.rst | 1 -
 doc/source/guides/multinode-lab.rst          | 2 --
 doc/source/guides/neutron.rst                | 4 ----
 doc/source/guides/single-machine.rst         | 1 -
 doc/source/guides/single-vm.rst              | 1 -
 tools/create_userrc.sh                       | 2 +-
 tools/xen/README.md                          | 1 -
 8 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 386fbbbf71..a7d3b7d9be 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -108,7 +108,6 @@ values that most often need to be set.
     DATABASE_PASSWORD=$ADMIN_PASSWORD
     RABBIT_PASSWORD=$ADMIN_PASSWORD
     SERVICE_PASSWORD=$ADMIN_PASSWORD
-    SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
     #FIXED_RANGE=172.31.1.0/24
     #FLOATING_RANGE=192.168.20.0/25
     #HOST_IP=10.3.4.5
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f3bd2feb45..f6379fe43a 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -34,7 +34,6 @@ Edit your ``local.conf`` to look like
     DATABASE_PASSWORD=password
     ADMIN_PASSWORD=password
     SERVICE_PASSWORD=password
-    SERVICE_TOKEN=password
     RABBIT_PASSWORD=password
     # Enable Logging
     LOGFILE=$DEST/logs/stack.sh.log
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 5660bc5222..37c8515e86 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -131,7 +131,6 @@ cluster controller's DevStack in ``local.conf``:
     DATABASE_PASSWORD=supersecret
     RABBIT_PASSWORD=supersecrete
     SERVICE_PASSWORD=supersecrete
-    SERVICE_TOKEN=xyzpdqlazydog
 
 In the multi-node configuration the first 10 or so IPs in the private
 subnet are usually reserved. Add this to ``local.sh`` to have it run
@@ -172,7 +171,6 @@ machines, create a ``local.conf`` with:
     DATABASE_PASSWORD=supersecret
     RABBIT_PASSWORD=supersecrete
     SERVICE_PASSWORD=supersecrete
-    SERVICE_TOKEN=xyzpdqlazydog
     DATABASE_TYPE=mysql
     SERVICE_HOST=192.168.42.11
     MYSQL_HOST=$SERVICE_HOST
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index a72b6f94cb..84295a50ce 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -59,7 +59,6 @@ serving as a hypervisor for guest instances.
         DATABASE_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
-        SERVICE_TOKEN=secrete
 
         # Do not use Nova-Network
         disable_service n-net
@@ -231,7 +230,6 @@ The host `devstack-2` has a very minimal `local.conf`.
     MYSQL_PASSWORD=secrete
     RABBIT_PASSWORD=secrete
     SERVICE_PASSWORD=secrete
-    SERVICE_TOKEN=secrete
 
     ## Neutron options
     PUBLIC_INTERFACE=eth0
@@ -362,7 +360,6 @@ controller node.
         MYSQL_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
-        SERVICE_TOKEN=secrete
 
         ## Neutron options
         Q_USE_SECGROUP=True
@@ -410,7 +407,6 @@ compute node 1.
         MYSQL_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
-        SERVICE_TOKEN=secrete
 
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a01c368213..011c41fbce 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -108,7 +108,6 @@ do the following:
     DATABASE_PASSWORD=iheartdatabases
     RABBIT_PASSWORD=flopsymopsy
     SERVICE_PASSWORD=iheartksl
-    SERVICE_TOKEN=xyzpdqlazydog
 
 Run DevStack:
 
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 53c3fa973f..45b8f2dd89 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -67,7 +67,6 @@ passed as the user-data file when booting the VM.
             echo DATABASE_PASSWORD=password >> local.conf
             echo RABBIT_PASSWORD=password >> local.conf
             echo SERVICE_PASSWORD=password >> local.conf
-            echo SERVICE_TOKEN=tokentoken >> local.conf
             ./stack.sh
         path: /home/stack/start.sh
         permissions: 0755
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 25f713ca93..93d5d69342 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -156,7 +156,7 @@ if [ -z "$MODE" ]; then
     exit 3
 fi
 
-export -n SERVICE_TOKEN SERVICE_ENDPOINT OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT
+export -n SERVICE_ENDPOINT OS_SERVICE_ENDPOINT
 
 EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
 if [[ -z $EC2_URL ]]; then
diff --git a/tools/xen/README.md b/tools/xen/README.md
index a1adf590a6..21090e56aa 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -78,7 +78,6 @@ Of course, use real passwords if this machine is exposed.
     # to prompt for these passwords, blocking the install process.
 
     DATABASE_PASSWORD=my_super_secret
-    SERVICE_TOKEN=my_super_secret
     ADMIN_PASSWORD=my_super_secret
     SERVICE_PASSWORD=my_super_secret
     RABBIT_PASSWORD=my_super_secret

From d091a2dd5467f42491e85208b236956b78c1c837 Mon Sep 17 00:00:00 2001
From: Michael Turek <mjturek@linux.vnet.ibm.com>
Date: Mon, 11 Jan 2016 18:17:50 +0000
Subject: [PATCH 1111/3333] Revert "Replace deprecated baremetal timeouts with
 new deploy_timeout"

This reverts commit 00b5f4af92a640a2507046cf76ee57caa166310b.

This patch was merged before the timeout was merged to
tempest. This means that devstack is currently referencing
a non-existent config option. As such I think it needs to be reverted.

Change-Id: I947261dc330ef35efce1ecd805ba6e649e81a6aa
---
 lib/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index b9d9e80fc2..61351c0628 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -533,7 +533,8 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal deploy_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 3919d4c822a38d324adf47697f4b9bedbc906a36 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Mon, 14 Dec 2015 12:02:55 +0000
Subject: [PATCH 1112/3333] Add diskimage-builder to the list of libraries

Add diskimage-builder to the list of libraries so it can be installed
from source to be tested in gate.

Change-Id: I6cefac1eb4ebf0196a6b4d4bfc038c00921f0d70
---
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 2 files changed, 5 insertions(+)

diff --git a/stackrc b/stackrc
index 16621f1660..a42638c675 100644
--- a/stackrc
+++ b/stackrc
@@ -473,6 +473,10 @@ GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
 # this doesn't exist in a lib file, so set it here
 GITDIR["ironic-lib"]=$DEST/ironic-lib
 
+# diskimage-builder tool
+GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
+GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-master}
+GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
 ##################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index f31560a1fe..52d7426f00 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -42,6 +42,7 @@ ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
 ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
+ALL_LIBS+=" diskimage-builder"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 7710e7fc273dd9af6799ea565bbd21ce03745a44 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 27 Aug 2014 16:15:32 +1000
Subject: [PATCH 1113/3333] Only use lsb_release for distro tags

The existing GetOSVersion has a lot of unused code which is wrong in
several ways

 - the only path tested in upstream CI is with lsb_release, because
   it's pre-installed on all nodes

 - the /etc/redhat-release checking probably still works, but is
   unnecessary

 - If using lsb_release, os_UPDATE has never actually been set.

 - the /etc/SuSE-release branch checking is broken if the lsb package
   is actually installed.  lsb checking does not set os_UPDATE but yet
   the SuSE DISTRO setting relies on this to set a patch level (and so
   does some of the rpm tags).  SuSE 11 is up to update 3, but the rpm
   matching is stuck hard-coded to update 2.  I'm guessing
   installation is actually broken there.

 - the debian checking branch is broken.  The VERSION tags have been
   removed and were not supposed to be relied on anyway (see notes in
   [1])

This simplifies things:

 - remove OSX checking (moved here after discussions in
   I31d0fdd30928ecc8d959a95838b1d3affd28ac6f)

 - only use the output of lsb_release.

 - A small best-effort check to pre-install lsb packages if not
   detected (that avoids chicken-egg-problem of package-install
   wrappers relying on os_* flags).

 - The unset os_UPDATE is removed.  It's only previous use was for
   setting separate suse versions in the DISTRO element for matching
   during package installs (since removed)

 - DISTRO setting is modified to use the parts of os_RELEASE it wants.
   Per-above, this is the correct place to parse out specifics.

 - Call out the is_* functions, which are a better way to detect
   platforms

 - Export the variables as read-only, since they shouldn't be reset

[1] http://sources.debian.net/src/base-files/7.5/debian/changelog/

Change-Id: I46a2c36d95327087085df07cb797eb91249a893c
---
 clean.sh                   |   2 +-
 functions-common           | 172 ++++++++++++++-----------------------
 stack.sh                   |   2 +-
 tools/create-stack-user.sh |   2 +-
 tools/info.sh              |   4 -
 tools/install_prereqs.sh   |   2 +-
 unstack.sh                 |   2 +-
 7 files changed, 69 insertions(+), 117 deletions(-)

diff --git a/clean.sh b/clean.sh
index fc6f80dad4..57e3b5edf8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -26,7 +26,7 @@ if [[ -r $TOP_DIR/.stackenv ]]; then
 fi
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
 GetDistro
 
diff --git a/functions-common b/functions-common
index dbf605cdd8..e6f081ce0a 100644
--- a/functions-common
+++ b/functions-common
@@ -274,112 +274,71 @@ function warn {
 # ================
 
 # Determine OS Vendor, Release and Update
-# Tested with OS/X, Ubuntu, RedHat, CentOS, Fedora
-# Returns results in global variables:
+
+#
+# NOTE : For portability, you almost certainly do not want to use
+# these variables directly!  The "is_*" functions defined below this
+# bundle up compatible platforms under larger umbrellas that we have
+# determinted are compatible enough (e.g. is_ubuntu covers Ubuntu &
+# Debian, is_fedora covers RPM-based distros).  Higher-level functions
+# such as "install_package" further abstract things in better ways.
+#
 # ``os_VENDOR`` - vendor name: ``Ubuntu``, ``Fedora``, etc
 # ``os_RELEASE`` - major release: ``14.04`` (Ubuntu), ``20`` (Fedora)
-# ``os_UPDATE`` - update: ex. the ``5`` in ``RHEL6.5``
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
-# ``os_CODENAME`` - vendor's codename for release: ``snow leopard``, ``trusty``
-os_VENDOR=""
-os_RELEASE=""
-os_UPDATE=""
-os_PACKAGE=""
-os_CODENAME=""
+# ``os_CODENAME`` - vendor's codename for release: ``trusty``
+
+declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
+
+# Make a *best effort* attempt to install lsb_release packages for the
+# user if not available.  Note can't use generic install_package*
+# because they depend on this!
+function _ensure_lsb_release {
+    if [[ -x $(which lsb_release 2>/dev/null) ]]; then
+        return
+    fi
+
+    if [[ -x $(which apt-get 2>/dev/null) ]]; then
+        sudo apt-get install -y lsb-release
+    elif [[ -x $(which zypper 2>/dev/null) ]]; then
+        # XXX: old code paths seem to have assumed SUSE platforms also
+        # had "yum".  Keep this ordered above yum so we don't try to
+        # install the rh package.  suse calls it just "lsb"
+        sudo zypper -y install lsb
+    elif [[ -x $(which dnf 2>/dev/null) ]]; then
+        sudo dnf install -y redhat-lsb-core
+    elif [[ -x $(which yum 2>/dev/null) ]]; then
+        # all rh patforms (fedora, centos, rhel) have this pkg
+        sudo yum install -y redhat-lsb-core
+    else
+        die $LINENO "Unable to find or auto-install lsb_release"
+    fi
+}
 
 # GetOSVersion
+#  Set the following variables:
+#  - os_RELEASE
+#  - os_CODENAME
+#  - os_VENDOR
+#  - os_PACKAGE
 function GetOSVersion {
+    # We only support distros that provide a sane lsb_release
+    _ensure_lsb_release
 
-    # Figure out which vendor we are
-    if [[ -x "`which sw_vers 2>/dev/null`" ]]; then
-        # OS/X
-        os_VENDOR=`sw_vers -productName`
-        os_RELEASE=`sw_vers -productVersion`
-        os_UPDATE=${os_RELEASE##*.}
-        os_RELEASE=${os_RELEASE%.*}
-        os_PACKAGE=""
-        if [[ "$os_RELEASE" =~ "10.7" ]]; then
-            os_CODENAME="lion"
-        elif [[ "$os_RELEASE" =~ "10.6" ]]; then
-            os_CODENAME="snow leopard"
-        elif [[ "$os_RELEASE" =~ "10.5" ]]; then
-            os_CODENAME="leopard"
-        elif [[ "$os_RELEASE" =~ "10.4" ]]; then
-            os_CODENAME="tiger"
-        elif [[ "$os_RELEASE" =~ "10.3" ]]; then
-            os_CODENAME="panther"
-        else
-            os_CODENAME=""
-        fi
-    elif [[ -x $(which lsb_release 2>/dev/null) ]]; then
-        os_VENDOR=$(lsb_release -i -s)
-        os_RELEASE=$(lsb_release -r -s)
-        os_UPDATE=""
-        os_PACKAGE="rpm"
-        if [[ "Debian,Ubuntu,LinuxMint" =~ $os_VENDOR ]]; then
-            os_PACKAGE="deb"
-        elif [[ "SUSE LINUX" =~ $os_VENDOR ]]; then
-            lsb_release -d -s | grep -q openSUSE
-            if [[ $? -eq 0 ]]; then
-                os_VENDOR="openSUSE"
-            fi
-        elif [[ $os_VENDOR == "openSUSE project" ]]; then
-            os_VENDOR="openSUSE"
-        elif [[ $os_VENDOR =~ Red.*Hat ]]; then
-            os_VENDOR="Red Hat"
-        fi
-        os_CODENAME=$(lsb_release -c -s)
-    elif [[ -r /etc/redhat-release ]]; then
-        # Red Hat Enterprise Linux Server release 5.5 (Tikanga)
-        # Red Hat Enterprise Linux Server release 7.0 Beta (Maipo)
-        # CentOS release 5.5 (Final)
-        # CentOS Linux release 6.0 (Final)
-        # Fedora release 16 (Verne)
-        # XenServer release 6.2.0-70446c (xenenterprise)
-        # Oracle Linux release 7
-        # CloudLinux release 7.1
-        os_CODENAME=""
-        for r in "Red Hat" CentOS Fedora XenServer CloudLinux; do
-            os_VENDOR=$r
-            if [[ -n "`grep \"$r\" /etc/redhat-release`" ]]; then
-                ver=`sed -e 's/^.* \([0-9].*\) (\(.*\)).*$/\1\|\2/' /etc/redhat-release`
-                os_CODENAME=${ver#*|}
-                os_RELEASE=${ver%|*}
-                os_UPDATE=${os_RELEASE##*.}
-                os_RELEASE=${os_RELEASE%.*}
-                break
-            fi
-            os_VENDOR=""
-        done
-        if [ "$os_VENDOR" = "Red Hat" ] && [[ -r /etc/oracle-release ]]; then
-            os_VENDOR=OracleLinux
-        fi
-        os_PACKAGE="rpm"
-    elif [[ -r /etc/SuSE-release ]]; then
-        for r in openSUSE "SUSE Linux"; do
-            if [[ "$r" = "SUSE Linux" ]]; then
-                os_VENDOR="SUSE LINUX"
-            else
-                os_VENDOR=$r
-            fi
+    os_RELEASE=$(lsb_release -r -s)
+    os_CODENAME=$(lsb_release -c -s)
+    os_VENDOR=$(lsb_release -i -s)
 
-            if [[ -n "`grep \"$r\" /etc/SuSE-release`" ]]; then
-                os_CODENAME=`grep "CODENAME = " /etc/SuSE-release | sed 's:.* = ::g'`
-                os_RELEASE=`grep "VERSION = " /etc/SuSE-release | sed 's:.* = ::g'`
-                os_UPDATE=`grep "PATCHLEVEL = " /etc/SuSE-release | sed 's:.* = ::g'`
-                break
-            fi
-            os_VENDOR=""
-        done
-        os_PACKAGE="rpm"
-    # If lsb_release is not installed, we should be able to detect Debian OS
-    elif [[ -f /etc/debian_version ]] && [[ $(cat /proc/version) =~ "Debian" ]]; then
-        os_VENDOR="Debian"
+    if [[ $os_VENDOR =~ (Debian|Ubuntu|LinuxMint) ]]; then
         os_PACKAGE="deb"
-        os_CODENAME=$(awk '/VERSION=/' /etc/os-release | sed 's/VERSION=//' | sed -r 's/\"|\(|\)//g' | awk '{print $2}')
-        os_RELEASE=$(awk '/VERSION_ID=/' /etc/os-release | sed 's/VERSION_ID=//' | sed 's/\"//g')
+    else
+        os_PACKAGE="rpm"
     fi
-    export os_VENDOR os_RELEASE os_UPDATE os_PACKAGE os_CODENAME
+
+    typeset -xr os_VENDOR
+    typeset -xr os_RELEASE
+    typeset -xr os_PACKAGE
+    typeset -xr os_CODENAME
 }
 
 # Translate the OS version values into common nomenclature
@@ -389,7 +348,8 @@ declare DISTRO
 function GetDistro {
     GetOSVersion
     if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) ]]; then
-        # 'Everyone' refers to Ubuntu / Debian releases by the code name adjective
+        # 'Everyone' refers to Ubuntu / Debian releases by
+        # the code name adjective
         DISTRO=$os_CODENAME
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then
         # For Fedora, just use 'f' and the release
@@ -397,26 +357,22 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
         DISTRO="opensuse-$os_RELEASE"
     elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
-        # For SLE, also use the service pack
-        if [[ -z "$os_UPDATE" ]]; then
-            DISTRO="sle${os_RELEASE}"
-        else
-            DISTRO="sle${os_RELEASE}sp${os_UPDATE}"
-        fi
-    elif [[ "$os_VENDOR" =~ (Red Hat) || \
+        # just use major release
+        DISTRO="sle${os_RELEASE%.*}"
+    elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
         "$os_VENDOR" =~ (OracleLinux) ]]; then
         # Drop the . release as we assume it's compatible
+        # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
-        DISTRO="xs$os_RELEASE"
+        DISTRO="xs${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
         DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
-        # Catch-all for now is Vendor + Release + Update
-        DISTRO="$os_VENDOR-$os_RELEASE.$os_UPDATE"
+        die $LINENO "Unable to determine DISTRO"
     fi
-    export DISTRO
+    typeset -xr DISTRO
 }
 
 # Utility function for checking machine architecture
diff --git a/stack.sh b/stack.sh
index 5e4a4f8310..697dce156f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -136,7 +136,7 @@ source $TOP_DIR/inc/meta-config
 source $TOP_DIR/lib/stack
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
 GetDistro
 
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index b49164b22a..c0b7ac70aa 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -24,7 +24,7 @@ TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 source $TOP_DIR/functions
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
 GetDistro
 
diff --git a/tools/info.sh b/tools/info.sh
index 433206e8ae..c056fa73f8 100755
--- a/tools/info.sh
+++ b/tools/info.sh
@@ -52,10 +52,6 @@ GetDistro
 echo "os|distro=$DISTRO"
 echo "os|vendor=$os_VENDOR"
 echo "os|release=$os_RELEASE"
-if [ -n "$os_UPDATE" ]; then
-    echo "os|version=$os_UPDATE"
-fi
-
 
 # Repos
 # -----
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 031f8a8eca..8895e1e77c 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -28,7 +28,7 @@ if [[ -z "$TOP_DIR" ]]; then
     source $TOP_DIR/functions
 
     # Determine what system we are running on.  This provides ``os_VENDOR``,
-    # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+    # ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
     # and ``DISTRO``
     GetDistro
 
diff --git a/unstack.sh b/unstack.sh
index 8eded837fd..c4dfdc8d9e 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -84,7 +84,7 @@ fi
 load_plugin_settings
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 GetOSVersion
 
 # Run extras

From 4a974e61c8c53c692d0e2d0dc85b3ce9b2eff446 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 11 Jan 2016 22:10:43 -0500
Subject: [PATCH 1114/3333] Remove Nova object store service

As of I8bf7cbaa7015bb61656ab90ccc8f944aaeebb095, Nova
removed the n-obj service, so we should cleanup

Change-Id: I7db3796a6448decb4ac5e66d980f487c7d1f394e
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 doc/source/stackrc.rst                       | 2 +-
 lib/nova                                     | 9 ++-------
 samples/local.conf                           | 7 +++----
 4 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f3bd2feb45..d79e0f8885 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -46,7 +46,7 @@ Edit your ``local.conf`` to look like
     # Horizon
     ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch
+    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
index b21f74f761..81d4b80b8a 100644
--- a/doc/source/stackrc.rst
+++ b/doc/source/stackrc.rst
@@ -20,7 +20,7 @@ ENABLED\_SERVICES
 
     ::
 
-        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
+        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
 
     Other services that are not enabled by default can be enabled in
     ``localrc``. For example, to add Swift, use the following service
diff --git a/lib/nova b/lib/nova
index c97f5174b6..cbf7c5f2bd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -450,7 +450,7 @@ function create_nova_accounts {
     fi
 
     # S3
-    if is_service_enabled n-obj swift3; then
+    if is_service_enabled swift3; then
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
             get_or_create_service "s3" "s3" "S3"
@@ -869,11 +869,6 @@ function start_nova_rest {
     run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
     run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
 
-    # Starting the nova-objectstore only if swift3 service is not enabled.
-    # Swift will act as s3 objectstore.
-    is_service_enabled swift3 || \
-        run_process n-obj "$NOVA_BIN_DIR/nova-objectstore --config-file $api_cell_conf"
-
     export PATH=$old_path
 }
 
@@ -907,7 +902,7 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-obj n-sproxy; do
+    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }
diff --git a/samples/local.conf b/samples/local.conf
index 34c9e8b48e..92231bbe87 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -86,10 +86,9 @@ LOGDAYS=2
 # Swift
 # -----
 
-# Swift is now used as the back-end for the S3-like object store. If Nova's
-# objectstore (``n-obj`` in ``ENABLED_SERVICES``) is enabled, it will NOT
-# run if Swift is enabled. Setting the hash value is required and you will
-# be prompted for it if Swift is enabled so just set it to something already:
+# Swift is now used as the back-end for the S3-like object store. Setting the
+# hash value is required and you will be prompted for it if Swift is enabled
+# so just set it to something already:
 SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5
 
 # For development purposes the default of 3 replicas is usually not required.

From ed9487a885caf81b9283f39702261d91c94ac393 Mon Sep 17 00:00:00 2001
From: "Davanum Srinivas (dims)" <davanum@gmail.com>
Date: Mon, 11 Jan 2016 21:20:34 +0000
Subject: [PATCH 1115/3333] Revert "Don't die when yum fails."

This reverts commit 2babf3963f4eea8558b0c287c51e6faeb7069c70.

This breaks oslo.messaging jobs:
http://logs.openstack.org/32/265932/1/check/gate-oslo.messaging-dsvm-functional-amqp1-centos7/f5f3eb9/console.html#_2016-01-11_20_03_33_162

@kgiusti reports that PIPESTATUS[0] is always 1 on his centos7 box

Change-Id: I013c22a3545f22c79a0616b4a98622d41bb17d77
---
 functions-common | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index dbf605cdd8..c6bf648511 100644
--- a/functions-common
+++ b/functions-common
@@ -1334,17 +1334,13 @@ function yum_install {
             BEGIN { fail=0 }
             /No package/ { fail=1 }
             { print }
-            END { exit fail }'
-        result=$?
+            END { exit fail }' || \
+                die $LINENO "Missing packages detected"
 
-    if [ $result != 0 ]; then
-        echo $LINENO "Missing packages detected"
-    elif [[ ${PIPESTATUS[0]} != 0 ]]; then
-        # also ensure we catch a yum failure
-        echo $LINENO "${YUM:-yum} install failure"
-        result=1
+    # also ensure we catch a yum failure
+    if [[ ${PIPESTATUS[0]} != 0 ]]; then
+        die $LINENO "${YUM:-yum} install failure"
     fi
-    return $result
 }
 
 # zypper wrapper to set arguments correctly

From 09a3e715ec708a214eef1bed9aef01a593f96673 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 13 Jan 2016 11:35:12 +0100
Subject: [PATCH 1116/3333] Create LOGDIR earlier in the process

Specifically, before _install_epel_and_rdo is called, that may need to log an
error.

Change-Id: I4979eb9530e6ea366c99d168587b87ea358dc908
---
 stack.sh | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/stack.sh b/stack.sh
index 5e4a4f8310..21a805170f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -297,16 +297,6 @@ EOF
     fi
 }
 
-# If you have all the repos installed above already setup (e.g. a CI
-# situation where they are on your image) you may choose to skip this
-# to speed things up
-SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
-
-if is_fedora && [[ $DISTRO == "rhel7" ]] && \
-        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-    _install_epel_and_rdo
-fi
-
 
 # Configure Target Directories
 # ----------------------------
@@ -320,6 +310,11 @@ sudo mkdir -p $DEST
 safe_chown -R $STACK_USER $DEST
 safe_chmod 0755 $DEST
 
+# Destination path for devstack logs
+if [[ -n ${LOGDIR:-} ]]; then
+    mkdir -p $LOGDIR
+fi
+
 # Destination path for service data
 DATA_DIR=${DATA_DIR:-${DEST}/data}
 sudo mkdir -p $DATA_DIR
@@ -333,6 +328,16 @@ if [ -z "`grep ^127.0.0.1 /etc/hosts | grep $LOCAL_HOSTNAME`" ]; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 
+# If you have all the repos installed above already setup (e.g. a CI
+# situation where they are on your image) you may choose to skip this
+# to speed things up
+SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
+
+if is_fedora && [[ $DISTRO == "rhel7" ]] && \
+        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
+    _install_epel_and_rdo
+fi
+
 # Ensure python is installed
 # --------------------------
 is_package_installed python || install_package python
@@ -392,10 +397,6 @@ TIMESTAMP_FORMAT=${TIMESTAMP_FORMAT:-"%F-%H%M%S"}
 LOGDAYS=${LOGDAYS:-7}
 CURRENT_LOG_TIME=$(date "+$TIMESTAMP_FORMAT")
 
-if [[ -n ${LOGDIR:-} ]]; then
-    mkdir -p $LOGDIR
-fi
-
 if [[ -n "$LOGFILE" ]]; then
     # Clean up old log files.  Append '.*' to the user-specified
     # ``LOGFILE`` to match the date in the search template.

From 5aa2014e67f329f1751052643161b2e0e98ef621 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 13 Jan 2016 22:54:37 +0900
Subject: [PATCH 1117/3333] Remove Neutron NEC plugin completely

override-defaults mechanism allows us to define
s_neutron_plugin_security_group before loading lib/neutron,
and we no longer need to have a plugin-specific file in
the master DevStack repository.

Change-Id: I78a4e05fa72b1dd545b8d9e97a8fd8fdbf23739c
Depends-On: Id6765245459c1aff3aab27dbc60d320ce2951b38
---
 lib/neutron_plugins/nec | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 lib/neutron_plugins/nec

diff --git a/lib/neutron_plugins/nec b/lib/neutron_plugins/nec
deleted file mode 100644
index 9ea7338696..0000000000
--- a/lib/neutron_plugins/nec
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=nec will work.
-
-# FIXME(amotoki): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}

From 7e843edca791224eea1d53fc963267dded0c220b Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 13 Jan 2016 23:11:09 +0900
Subject: [PATCH 1118/3333] Remove Neutron Midonet plugin file completely

override-defaults mechanism allows us to define
s_neutron_plugin_security_group before loading lib/neutron,
and we no longer need to have a plugin-specific file in
the master DevStack repository.

Change-Id: I37d5012e89cb3650e4f325b6d77d70f28f87d3e7
Depends-On: I5e02acd288e53dd06a369d348ec77ead57d476fd
---
 lib/neutron_plugins/midonet | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 lib/neutron_plugins/midonet

diff --git a/lib/neutron_plugins/midonet b/lib/neutron_plugins/midonet
deleted file mode 100644
index ca0b70c76c..0000000000
--- a/lib/neutron_plugins/midonet
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# REVISIT(devvesa): This file is needed so Q_PLUGIN=midonet will work.
-
-# FIXME(yamamoto): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}

From ac8ff0f1e9e5116c390bf8a711c950bcaca71d32 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 13 Jan 2016 17:28:43 -0500
Subject: [PATCH 1119/3333] Support for logging the nova-dhcpbridge command
 line

We are seeing a lot of gate failures as vm(s) are unable to acquire
DHCP leases:
https://bugs.launchpad.net/nova/+bug/1532809

we need to set log_file for nova-dhcpbridge configuration, so clone
the nova.conf and set the log_file properly to a path where the
CI can pick up from for analysis.

Change-Id: Iec4fe3f2235da9d1f5bd399d4ffc45af516c58ce
---
 lib/nova | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index cbf7c5f2bd..094eed87ad 100644
--- a/lib/nova
+++ b/lib/nova
@@ -478,7 +478,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
-    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF"
     iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
@@ -633,6 +632,11 @@ function create_nova_conf {
         iniset $NOVA_CONF serial_console enabled True
     fi
     iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+    # Setup logging for nova-dhcpbridge command line
+    sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+    iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "/opt/stack/logs/nova-dhcpbridge.log"
+    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
 }
 
 function init_nova_cells {

From ba0a659c762e07951cd4f3e305aa5bd09a1a2918 Mon Sep 17 00:00:00 2001
From: Boris Pavlovic <boris@pavlovic.me>
Date: Thu, 14 Jan 2016 17:31:40 -0800
Subject: [PATCH 1120/3333] Make OSprofiler repo and branch configurable

OSprofiler is now under Oslo:
https://review.openstack.org/#/c/103825/

And we really need this patch to make proper dsvm job for
OSprofiler

Change-Id: I20f59c52c147303de01544dc975a82b4a741a1b9
---
 lib/oslo                     | 1 +
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 3d6fbb38c6..6f5c7d17c4 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -44,6 +44,7 @@ GITDIR["oslo.service"]=$DEST/oslo.service
 GITDIR["oslo.utils"]=$DEST/oslo.utils
 GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
+GITDIR["osprofiler"]=$DEST/osprofiler
 GITDIR["pycadf"]=$DEST/pycadf
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
diff --git a/stackrc b/stackrc
index 16621f1660..1786a44ff3 100644
--- a/stackrc
+++ b/stackrc
@@ -407,6 +407,10 @@ GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-master}
 GITREPO["oslo.vmware"]=${OSLOVMWARE_REPO:-${GIT_BASE}/openstack/oslo.vmware.git}
 GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-master}
 
+# osprofiler
+GITREPO["osprofiler"]=${OSPROFILER_REPO:-${GIT_BASE}/openstack/osprofiler.git}
+GITBRANCH["osprofiler"]=${OSPROFILER_BRANCH:-master}
+
 # pycadf auditing library
 GITREPO["pycadf"]=${PYCADF_REPO:-${GIT_BASE}/openstack/pycadf.git}
 GITBRANCH["pycadf"]=${PYCADF_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index f31560a1fe..326241df82 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -40,7 +40,7 @@ ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
-ALL_LIBS+=" oslo.cache oslo.reports"
+ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
 
 # Generate the above list with

From bd7a51200f3a3c11ca5f18f0b7f95ee9049e1e40 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 14 Jan 2016 12:11:23 -0500
Subject: [PATCH 1121/3333] Better location for the nova dhcp logs

Use LOGDIR to compute the location of the dhcp logs
instead of hardcoding to /opt/stack/logs/

Change-Id: I97ca2d8c8b7901e0895fe89a57675caf8effea53
---
 lib/nova | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 094eed87ad..62481edfce 100644
--- a/lib/nova
+++ b/lib/nova
@@ -635,7 +635,19 @@ function create_nova_conf {
 
     # Setup logging for nova-dhcpbridge command line
     sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
-    iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "/opt/stack/logs/nova-dhcpbridge.log"
+
+    local service="n-dhcp"
+    local logfile="${service}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
+    if [[ -n ${LOGDIR} ]]; then
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
+        iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+        fi
+    fi
+
     iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
 }
 

From 2dd761b16950603555409e33ac63a196eefd2607 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Fri, 15 Jan 2016 13:56:37 +0000
Subject: [PATCH 1122/3333] XenAPI: Fix disk_formats verified by tempest

lib/glance restricts the disk_formats to those supported by XenAPI, so
tempest needs a similar restriction for the disk_formats tested.

Confirmed as passing internal Citrix CI (affected tempest jobs are
currently disabled in voting XenServer CI until this change lands)

Change-Id: Iefa5b16a3fa1789ed583426ea47ebb22e6cb571e
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..a824b52aae 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -314,6 +314,9 @@ function configure_tempest {
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
+    if [ "$VIRT_DRIVER" = "xenserver" ]; then
+        iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
+    fi
 
     # Image Features
     iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True

From 16246acb4c3d81e2907ba938b9404a0fc9d30ff6 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 18 Jan 2016 01:20:53 -0500
Subject: [PATCH 1123/3333] remove clouds.yaml files when running clean.sh

There have been a few reported errors of folks running into
issues with old clouds.yaml files that linger around. Remove
these if the user runs clean.sh.

1. http://lists.openstack.org/pipermail/openstack-dev/2016-January/084283.html
2. https://ask.openstack.org/en/question/84825/glance-upload_image-fails-in-latest-devstack/
3. https://ask.openstack.org/en/question/86071/devstack-installation-failure/

Change-Id: I618ea8e27b49af360c905df85af06d9b1eef8407
---
 clean.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/clean.sh b/clean.sh
index fc6f80dad4..5da78519ba 100755
--- a/clean.sh
+++ b/clean.sh
@@ -137,6 +137,7 @@ FILES_TO_CLEAN=".localrc.auto .localrc.password "
 FILES_TO_CLEAN+="docs/files docs/html shocco/ "
 FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
 FILES_TO_CLEAN+=".stackenv .prereqs"
+FILES_TO_CLEAN+="/etc/openstack/ ~/.config/openstack"
 
 for file in $FILES_TO_CLEAN; do
     rm -rf $TOP_DIR/$file

From f90c0b7d29abe58d7d10608599e6399cf6adc509 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Mon, 18 Jan 2016 10:52:59 +0100
Subject: [PATCH 1124/3333] Stop referencing no longer existing
 SERVICE_ENDPOINT variable

It was probably finally removed by one of recent refactoring changes.
Now ironic gate fails due to Swift trying to access it to override OS_AUTH_URL.
This change drops this override and just uses OS_AUTH_URL.

Closes-Bug: #1535245
Change-Id: I145bec110c4299e61f2bce49df41dcd82e5d462d
---
 lib/swift              | 1 -
 tools/create_userrc.sh | 2 --
 2 files changed, 3 deletions(-)

diff --git a/lib/swift b/lib/swift
index b596142ad2..9edeb0ab79 100644
--- a/lib/swift
+++ b/lib/swift
@@ -817,7 +817,6 @@ function swift_configure_tempurls {
     OS_USERNAME=swift \
     OS_PASSWORD=$SERVICE_PASSWORD \
     OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
-    OS_AUTH_URL=$SERVICE_ENDPOINT \
     openstack object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 93d5d69342..74d5428382 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -156,8 +156,6 @@ if [ -z "$MODE" ]; then
     exit 3
 fi
 
-export -n SERVICE_ENDPOINT OS_SERVICE_ENDPOINT
-
 EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
 if [[ -z $EC2_URL ]]; then
     EC2_URL=http://localhost:8773/

From 8e3df96cec11ae32fba6a6031ee60850251789f9 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 18 Jan 2016 14:00:41 -0500
Subject: [PATCH 1125/3333] use sudo to remove /etc/openstack directory

the /etc/openstack directory needs to be removed with sudo privs,
the loop at the end will not suffice.

Change-Id: Icc0ac45f9216d538ca214176d90241f973a4687b
---
 clean.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index 5da78519ba..c8b822317d 100755
--- a/clean.sh
+++ b/clean.sh
@@ -104,7 +104,7 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
 fi
 
 # Clean out /etc
-sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/heat /etc/neutron
+sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/heat /etc/neutron /etc/openstack/
 
 # Clean out tgt
 sudo rm -f /etc/tgt/conf.d/*
@@ -136,8 +136,8 @@ rm -rf $DIRS_TO_CLEAN
 FILES_TO_CLEAN=".localrc.auto .localrc.password "
 FILES_TO_CLEAN+="docs/files docs/html shocco/ "
 FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
-FILES_TO_CLEAN+=".stackenv .prereqs"
-FILES_TO_CLEAN+="/etc/openstack/ ~/.config/openstack"
+FILES_TO_CLEAN+=".stackenv .prereqs "
+FILES_TO_CLEAN+="~/.config/openstack"
 
 for file in $FILES_TO_CLEAN; do
     rm -rf $TOP_DIR/$file

From cf04a9acb395cd31b231da17cba779ff61b6e8eb Mon Sep 17 00:00:00 2001
From: Wanlong Gao <wanlong.gao@easystack.cn>
Date: Sat, 16 Jan 2016 17:46:35 +0800
Subject: [PATCH 1126/3333] notification_driver is deprecated to driver

TrivialFix
https://review.openstack.org/#/c/249508/

Change-Id: I18599c7221272279dfc2e9f5b297af09faff5c3b
---
 lib/cinder         | 2 +-
 lib/glance         | 4 ++--
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 9ca8109023..144f41beea 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -299,7 +299,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled ceilometer; then
-        iniset $CINDER_CONF DEFAULT notification_driver "messaging"
+        iniset $CINDER_CONF oslo_messaging_notifications driver "messaging"
     fi
 
     if is_service_enabled tls-proxy; then
diff --git a/lib/glance b/lib/glance
index 19e7937ad3..0431bba024 100644
--- a/lib/glance
+++ b/lib/glance
@@ -113,7 +113,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
-    iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
+    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messaging
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -126,7 +126,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
-    iniset $GLANCE_API_CONF DEFAULT notification_driver messaging
+    iniset $GLANCE_API_CONF oslo_messaging_notifications driver messaging
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 692d5eae16..9497a23595 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1072,7 +1072,7 @@ function _configure_neutron_metadata_agent {
 }
 
 function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF DEFAULT notification_driver messaging
+    iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
 function _configure_neutron_lbaas {
diff --git a/lib/nova b/lib/nova
index cbf7c5f2bd..0110ad7303 100644
--- a/lib/nova
+++ b/lib/nova
@@ -557,7 +557,7 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
         iniset $NOVA_CONF DEFAULT instance_usage_audit_period "hour"
         iniset $NOVA_CONF DEFAULT notify_on_state_change "vm_and_task_state"
-        iniset $NOVA_CONF DEFAULT notification_driver "messaging"
+        iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
     fi
 
     # All nova-compute workers need to know the vnc configuration options

From ba6fb27bc874b940a2a8a34e24a6c34ecabb3ba8 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 19 Jan 2016 08:15:36 -0800
Subject: [PATCH 1127/3333] Remove vme and ssse3 from gate64 cpu mapping

It turns out that we need to be even more restrictive on the cpu flags
we expose as some clouds don't expose vme or ssse3.

Fixes-Bug: 1535799
Change-Id: I6c8c1101771d1c5496884be7a405285472ae803a
---
 tools/cpu_map_update.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tools/cpu_map_update.py b/tools/cpu_map_update.py
index 1938793114..92b7b8f9a3 100755
--- a/tools/cpu_map_update.py
+++ b/tools/cpu_map_update.py
@@ -30,7 +30,8 @@ def update_cpu_map(tree):
             x86 = arch
             break
     if x86 is not None:
-        # Create a gate64 cpu model that is core2duo less monitor and pse36
+        # Create a gate64 cpu model that is core2duo less monitor, pse36,
+        # vme, and ssse3.
         gate64 = ET.SubElement(x86, "model")
         gate64.set("name", "gate64")
         ET.SubElement(gate64, "vendor").set("name", "Intel")
@@ -51,13 +52,11 @@ def update_cpu_map(tree):
         ET.SubElement(gate64, "feature").set("name", "fxsr")
         ET.SubElement(gate64, "feature").set("name", "sse")
         ET.SubElement(gate64, "feature").set("name", "sse2")
-        ET.SubElement(gate64, "feature").set("name", "vme")
         ET.SubElement(gate64, "feature").set("name", "mtrr")
         ET.SubElement(gate64, "feature").set("name", "mca")
         ET.SubElement(gate64, "feature").set("name", "clflush")
         ET.SubElement(gate64, "feature").set("name", "pni")
         ET.SubElement(gate64, "feature").set("name", "nx")
-        ET.SubElement(gate64, "feature").set("name", "ssse3")
         ET.SubElement(gate64, "feature").set("name", "syscall")
         ET.SubElement(gate64, "feature").set("name", "lm")
 

From 4af2afcd52db5b278cf2660ef4e1d502c20cd5ff Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 13 Oct 2015 09:51:17 -0400
Subject: [PATCH 1128/3333] Add subunit output for total elapsed time

This commit adds a success output for the entire devstack run to the
subunit output. Ideally we wouldn't need this, but because we don't
have timing data for every single operation performed by devstack we
need to do this to track the total duration of the devstack run.

To capture failures this commit adds saving a devstack event when we
trip the exit_trap. This will save a similar result to the stream in
the successful case, but instead mark it as a failure.

Depends-On: Icc7df33e4d73ba6322af38fbdf3aea230f2fcf4d
Change-Id: I07112dde996c3e2c73f5aafc9b73d33d26374633
---
 stack.sh | 8 ++++++++
 stackrc  | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/stack.sh b/stack.sh
index e9831d5039..abd6a4d11e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -42,6 +42,8 @@ if [[ -n "$NOUNSET" ]]; then
     set -o nounset
 fi
 
+# Set start of devstack timestamp
+DEVSTACK_START_TIME=$(date +%s)
 
 # Configuration
 # =============
@@ -481,11 +483,14 @@ function exit_trap {
 
     if [[ $r -ne 0 ]]; then
         echo "Error on exit"
+        generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
         if [[ -z $LOGDIR ]]; then
             $TOP_DIR/tools/worlddump.py
         else
             $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
+    else
+        generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
     fi
 
     exit $r
@@ -710,6 +715,9 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
+# Install subunit for the subunit output stream
+pip_install -U os-testr
+
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Install Python packages into a virtualenv so that we can track them
diff --git a/stackrc b/stackrc
index 16621f1660..c521ecfbaf 100644
--- a/stackrc
+++ b/stackrc
@@ -29,6 +29,9 @@ DATA_DIR=${DEST}/data
 # Destination for status files
 SERVICE_DIR=${DEST}/status
 
+# Path for subunit output file
+SUBUNIT_OUTPUT=${DEST}/devstack.subunit
+
 # Determine stack user
 if [[ $EUID -eq 0 ]]; then
     STACK_USER=stack

From 1d27155f650e9b8e4053a201f1f08c494b820de2 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 19 Jan 2016 20:29:46 -0500
Subject: [PATCH 1129/3333] Cap installed pip to be < 8

Pip 8 just release which made uninstalling distutils installed packages
fatal. This was previously a deprecation warning and is now causing all
dsvm jobs to fail.

Depends-On: I511d216d9d8619c7cf919c482aaead4e833cdaac
Change-Id: I22f5c3af1adf96cfbd5747122f915a82e947843a
---
 tools/cap-pip.txt    | 1 +
 tools/install_pip.sh | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 tools/cap-pip.txt

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
new file mode 100644
index 0000000000..1a6f80c506
--- /dev/null
+++ b/tools/cap-pip.txt
@@ -0,0 +1 @@
+pip<8
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index f239c7bb16..542a28454d 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -77,9 +77,9 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    sudo -H -E python $LOCAL_PIP
+    sudo -H -E python $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
     if python3_enabled; then
-        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
     fi
 }
 

From 5dcbf7aeffb6c98f723f3045c22de23ed38f4510 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Wed, 13 Jan 2016 12:17:32 +0000
Subject: [PATCH 1130/3333] Don't die when yum fails.

Not all yum failures has to be considered
catastrofic failures also because install_package
function should implement the same behavior in Fedora,
CentOS and Ubuntu. Let return the error to be solved at higher
level.

Change-Id: I93e9f312a94aeb086925e069a83ec1d3d3419423
Closes-Bug: #1522590
---
 functions-common | 52 +++++++++++++++++++++++++++++++++---------------
 1 file changed, 36 insertions(+), 16 deletions(-)

diff --git a/functions-common b/functions-common
index 47276f0c34..b6350cebd7 100644
--- a/functions-common
+++ b/functions-common
@@ -1320,27 +1320,35 @@ function uninstall_package {
 # Uses globals ``OFFLINE``, ``*_proxy``, ``YUM``
 # yum_install package [package ...]
 function yum_install {
+    local result parse_yum_result
+
     [[ "$OFFLINE" = "True" ]] && return
-    local sudo="sudo"
-    [[ "$(id -u)" = "0" ]] && sudo="env"
+
+    time_start "yum_install"
+
+    # Warning: this would not work if yum output message
+    # have been translated to another language
+    parse_yum_result='\
+        BEGIN { result=0 }\
+        /^YUM_FAILED/ { exit $2 }\
+        /^No package/ { result=1 }\
+        //{ print }\
+        END { exit result }'
 
     # The manual check for missing packages is because yum -y assumes
-    # missing packages are OK.  See
-    # https://bugzilla.redhat.com/show_bug.cgi?id=965567
-    $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}" \
-        no_proxy="${no_proxy:-}" \
-        ${YUM:-yum} install -y "$@" 2>&1 | \
-        awk '
-            BEGIN { fail=0 }
-            /No package/ { fail=1 }
-            { print }
-            END { exit fail }' || \
-                die $LINENO "Missing packages detected"
+    # missing packages are OK.
+    # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
+    (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
+        | awk "$parse_yum_result"
+    result=$?
 
-    # also ensure we catch a yum failure
-    if [[ ${PIPESTATUS[0]} != 0 ]]; then
-        die $LINENO "${YUM:-yum} install failure"
+    if [ "$result" != 0 ]; then
+        echo $LINENO "${YUM:-yum}" install failure: $result
     fi
+
+    time_stop "yum_install"
+
+    return "$result"
 }
 
 # zypper wrapper to set arguments correctly
@@ -2279,6 +2287,18 @@ function test_with_retry {
     time_stop "test_with_retry"
 }
 
+# Like sudo but forwarding http_proxy https_proxy no_proxy environment vars.
+# If it is run as superuser then sudo is replaced by env.
+#
+function sudo_with_proxies {
+    local sudo
+
+    [[ "$(id -u)" = "0" ]] && sudo="env" || sudo="sudo"
+
+    $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}"\
+        no_proxy="${no_proxy:-}" "$@"
+}
+
 # Timing infrastructure - figure out where large blocks of time are
 # used in DevStack
 #

From 06cfce37560243d22cd05b2c620be6702528a0b1 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 14 Jan 2016 15:31:31 +0100
Subject: [PATCH 1131/3333] neutron: enable ml2 mtu calculation mechanism

Setting path_mtu to reflect mtu for physical devices that handle traffic
issued from br-tun makes ml2 plugin to calculate mtu for tenant networks
properly, considering encapsulation headers. After that, calculated mtu
values can be propagated into instances (currently, only DHCP approach
is implemented; RA support for IPv6 subnets is under review).

This change allows to run tunnelled tenant networks in multinode when
underlying physical devices don't support jumbo frames.

Note: changing the default value in neutron would not be backwards
compatible, since it could slow down east-west tunnelled traffic in
clouds that run on jumbo-aware networks.

Change-Id: I8287677c7ad0f13fa9f5cb194f9372d04b78cb61
Related-Bug: #1527675
---
 lib/neutron_plugins/ml2 | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 30e1b036f3..0483ef1fac 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -40,6 +40,12 @@ Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 # L3 Plugin to load for ML2
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
 
+# Underlying path MTU for physical network managing br-tun; use '-' instead of
+# ':-' to allow people to explicitly override this to blank, to disable
+# automatic MTU calculation for tunnelled tenant networks
+Q_ML2_PLUGIN_PATH_MTU=${Q_ML2_PLUGIN_PATH_MTU-1500}
+
+
 function populate_ml2_config {
     CONF=$1
     SECTION=$2
@@ -77,6 +83,12 @@ function neutron_plugin_configure_service {
         echo "WARNING - The ml2 plugin is using local tenant networks, with no connectivity between hosts."
     fi
 
+    # Enable ml2 mtu calculation mechanism for networks by providing path mtu
+    # value for physical devices that are used for br-tun traffic
+    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]] && [[ "$Q_ML2_PLUGIN_PATH_MTU" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE ml2 path_mtu "$Q_ML2_PLUGIN_PATH_MTU"
+    fi
+
     # Allow for overrding VLAN configuration (for example, to configure provider
     # VLANs) by first checking if Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS is set.
     if [ "$Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS" == "" ]; then

From 74379df11f6ce2e76d1448f4ffd6db9528768727 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 21 Jan 2016 10:20:08 -0500
Subject: [PATCH 1132/3333] Remove leftover homedir clouds.yaml files

We don't write files here anymore, but it's higher in the precedence
order than the /etc/openstack/clouds.yaml file we do write. Some
developers who have long-lived devstacks who update infrequently have
been bitten by the leftover file.

Change-Id: I8af6bd465f74099c560dddba6b5221dd79cbc965
---
 functions-common | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/functions-common b/functions-common
index 47276f0c34..12c925b0ff 100644
--- a/functions-common
+++ b/functions-common
@@ -106,6 +106,9 @@ function write_clouds_yaml {
         --os-username admin \
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
+
+    # CLean up any old clouds.yaml files we had laying around
+    rm -f ~$STACK_USER/.config/openstack/clouds.yaml
 }
 
 # trueorfalse <True|False> <VAR>

From 6e187218820afaa4f05f34ce0483c21170369db1 Mon Sep 17 00:00:00 2001
From: Yusuke Hayashi <hayashi-yusuke@jp.fujitsu.com>
Date: Fri, 22 Jan 2016 00:08:31 +0900
Subject: [PATCH 1133/3333] Rdo-release install failure under proxy

In RHEL under proxy, installation by stack.sh failed
because of rdo-release.rpm install failure.

This patch fixes install command for rdo-release.rpm
because it is caused by lack of http(s)_proxy.

Change-Id: I176d1e140f52e1bb0343170ba4d90c06b98d5a99
Closes-Bug: #1536478
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index e9831d5039..6f43785254 100755
--- a/stack.sh
+++ b/stack.sh
@@ -290,7 +290,7 @@ EOF
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
     # install the lastest RDO
-    sudo yum install -y https://rdoproject.org/repos/rdo-release.rpm
+    is_package_installed rdo-release || yum_install https://rdoproject.org/repos/rdo-release.rpm
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56

From 5997ce3ab657293bda11c69b6078e9290676e54b Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Wed, 20 Jan 2016 12:43:22 -0800
Subject: [PATCH 1134/3333] Always cache tokens in a shared memcache

Instead of using in-process caching for tokens per service per
worker (disabled by default now), use a shared memcache to cache
token validation(s). This should both offload/speedup validations
and avoid the issues surrounding inconsistent validation responses
when using in-process caching [since each worker caches separately].

Change-Id: Ifc17c27744dac5ad55e84752ca6f68169c2f5a86
---
 files/debs/keystone      |  1 +
 files/rpms-suse/keystone |  1 +
 files/rpms/keystone      |  1 +
 lib/keystone             | 19 ++++++++-----------
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/files/debs/keystone b/files/debs/keystone
index 370e4aac51..fd0317b9b6 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,5 +1,6 @@
 libkrb5-dev
 libldap2-dev
 libsasl2-dev
+memcached
 python-mysqldb
 sqlite3
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
index 46832c786d..66cfc23423 100644
--- a/files/rpms-suse/keystone
+++ b/files/rpms-suse/keystone
@@ -1,3 +1,4 @@
 cyrus-sasl-devel
+memcached
 openldap2-devel
 sqlite3
diff --git a/files/rpms/keystone b/files/rpms/keystone
index c01c261e19..170308373a 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,3 +1,4 @@
+memcached
 mod_ssl
 MySQL-python
 sqlite
diff --git a/lib/keystone b/lib/keystone
index 78904de5ab..7592804efa 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -430,6 +430,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
+    iniset $conf_file $section memcache_servers $SERVICE_HOST:11211
 }
 
 # init_keystone() - Initialize databases, etc.
@@ -483,6 +484,9 @@ function install_keystonemiddleware {
         # When not installing from repo, keystonemiddleware is still needed...
         pip_install_gr keystonemiddleware
     fi
+    # Install the memcache library so keystonemiddleware can cache tokens in a
+    # shared location.
+    pip_install_gr python-memcached
 }
 
 # install_keystone() - Collect source and prepare
@@ -491,17 +495,7 @@ function install_keystone {
     if is_service_enabled ldap; then
         install_ldap
     fi
-    if [[ "$KEYSTONE_TOKEN_BACKEND" = "memcache" ]]; then
-        # Install memcached and the memcache Python library that keystone uses.
-        # Unfortunately the Python library goes by different names in the .deb
-        # and .rpm circles.
-        install_package memcached
-        if is_ubuntu; then
-            install_package python-memcache
-        else
-            install_package python-memcached
-        fi
-    fi
+
     git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH
     setup_develop $KEYSTONE_DIR
 
@@ -550,6 +544,9 @@ function start_keystone {
         start_tls_proxy '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT &
         start_tls_proxy '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT &
     fi
+
+    # (re)start memcached to make sure we have a clean memcache.
+    restart_service memcached
 }
 
 # stop_keystone() - Stop running processes

From 61aa0e9f1968c9991dee7bb5aec9a2a63ac0339d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 22 Jan 2016 07:48:49 -0500
Subject: [PATCH 1135/3333] reduce default lease time to 5 minutes

Devstack used in development is about things coming and going
quickly. The long dhcp leases mean that we might miss a release, and
keep a stale lease around for way too long. See if this helps.

Change-Id: I9a58a4e64777f56ad7ec66242a319f985469469e
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6521cd7eba..df2b977274 100644
--- a/lib/nova
+++ b/lib/nova
@@ -689,6 +689,8 @@ function create_nova_conf_nova_network {
     iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
     iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
     iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
+    # force down dhcp leases to 5 minutes, which lets us expire faster
+    iniset $NOVA_CONF DEFAULT dhcp_lease_time 300
     if [ -n "$FLAT_INTERFACE" ]; then
         iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi

From 19363fc1e79e70d390da0f4d0a19a5ef476b11d4 Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Fri, 22 Jan 2016 16:35:28 +0100
Subject: [PATCH 1136/3333] remove "redhat-rpm-config" (F21 dependency)

Commit d5004a380294e05963d4de39007f3336e975fb0f introduced the package
"redhat-rpm-config" to make the Fedora 21 gate job running again.

As we dropped the F21 support in December 2015 with
commit 90bc5867728aafb66b374ae6e6a93318303dcff0 we don't need
this package anymore.

Change-Id: I71b969b7fd6651082451f6c4fd1e01d205771a11
---
 files/rpms/general | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/rpms/general b/files/rpms/general
index 5bc87b6172..e0ef54cf9a 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,7 +26,6 @@ postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
-redhat-rpm-config # MySQL-python rhbz-1195207
 screen
 tar
 tcpdump

From c2bd0d5b7d07a73c84273003041f00bf6a780e2a Mon Sep 17 00:00:00 2001
From: Gang Wei <gang.wei@intel.com>
Date: Mon, 25 Jan 2016 00:39:51 +0000
Subject: [PATCH 1137/3333] Remove call to deprecated method in tempest

Fix below warning:
"Use of: 'verify-tempest-config' is deprecated, please use: 'tempest verify-config'"

Change-Id: If66096cde31fedda407e1e6ac6899b196569a454
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 7fe63dd498..457252b7c8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -325,7 +325,7 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv -- verify-tempest-config -uro $tmp_cfg_file
+    tox -revenv -- tempest verify-config -uro $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then

From 40e2f508e42a793379c3bd1184bf1b7f36faa4d4 Mon Sep 17 00:00:00 2001
From: Allen Gao <wanlong.gao@easystack.cn>
Date: Tue, 19 Jan 2016 08:53:37 +0800
Subject: [PATCH 1138/3333] Remove option 'DEFAULT/verbose'

Option "verbose" from group "DEFAULT" is deprecated for removal.
Its value may be silently ignored in the future.

If this option is not set explicitly, there is no such warning.
Furthermore, the default value of verbose is true, so there is
no need to set this value in config files.

TrivialFix

Change-Id: I581238e661c2eb0c29dd915d1b1e4773dcdeb4c8
---
 lib/cinder         | 1 -
 lib/neutron-legacy | 6 ------
 2 files changed, 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 144f41beea..3aea05023f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -259,7 +259,6 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $CINDER_CONF DEFAULT verbose True
 
     iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9497a23595..8bddcd9b3f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -993,7 +993,6 @@ function _configure_neutron_debug_command {
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_TEST_CONFIG_FILE
 
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
     iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
@@ -1009,7 +1008,6 @@ function _configure_neutron_dhcp_agent {
 
     cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
 
-    iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
@@ -1041,7 +1039,6 @@ function _configure_neutron_l3_agent {
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
-    iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
@@ -1062,7 +1059,6 @@ function _configure_neutron_l3_agent {
 function _configure_neutron_metadata_agent {
     cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
 
-    iniset $Q_META_CONF_FILE DEFAULT verbose True
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
     iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
@@ -1126,7 +1122,6 @@ function _configure_neutron_plugin_agent {
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
-    iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     # Configure agent for plugin
@@ -1146,7 +1141,6 @@ function _configure_neutron_service {
         iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
     fi
 
-    iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP

From 5544c4a74fb985d10bc3f27fa7778a5824248979 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 25 Jan 2016 08:27:06 -0500
Subject: [PATCH 1139/3333] always default to floating ips for validation

fixed ips are not cross host accessible in our current config. So
always configure tempest to use floating ips.

Change-Id: I1cf605229070024c9d5d29c7a08967aa505fda7b
---
 lib/tempest | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7fe63dd498..3c34aad539 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -127,7 +127,7 @@ function configure_tempest {
     local flavor_lines
     local public_network_id
     local public_router_id
-    local ssh_connect_method="fixed"
+    local ssh_connect_method="floating"
 
     # Save IFS
     ifs=$IFS
@@ -236,10 +236,6 @@ function configure_tempest {
         fi
     fi
 
-    if ! is_service_enabled n-net; then
-        ssh_connect_method="floating"
-    fi
-
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
     if [ "$Q_L3_ENABLED" = "True" ]; then

From 75446deea06107fa63a7f08990f0de26e5761833 Mon Sep 17 00:00:00 2001
From: Allen Gao <wanlong.gao@easystack.cn>
Date: Mon, 25 Jan 2016 17:59:31 +0800
Subject: [PATCH 1140/3333] Remove the pip version pinning to < 8

The pip issue pypa/pip#3384 has already been fixed after pip 8.0.1
released. But leave the facility to easy flip this on in the future.

TrivialFix

Change-Id: I49658ce4056c773943321270defd461bbf3e9fb9
---
 tools/cap-pip.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
index 1a6f80c506..c280267641 100644
--- a/tools/cap-pip.txt
+++ b/tools/cap-pip.txt
@@ -1 +1 @@
-pip<8
+pip!=8

From fadebe1be337e076109860f28b213f327fc95283 Mon Sep 17 00:00:00 2001
From: Boris Pavlovic <boris@pavlovic.me>
Date: Mon, 25 Jan 2016 12:32:32 -0800
Subject: [PATCH 1141/3333] Fix OSprofiler installation from Git

Without this line DevStack fails to install OSprofiler from git

Change-Id: I0fe0e10bcece51759fbf4fd4a533b01501414d6d
---
 lib/oslo | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/oslo b/lib/oslo
index 6f5c7d17c4..1773da2975 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -89,6 +89,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.utils"
     _do_install_oslo_lib "oslo.versionedobjects"
     _do_install_oslo_lib "oslo.vmware"
+    _do_install_oslo_lib "osprofiler"
     _do_install_oslo_lib "pycadf"
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"

From e826490a437e13a493f53b7751bea58dff2b30f5 Mon Sep 17 00:00:00 2001
From: Ronald Bradford <ronald.bradford@gmail.com>
Date: Wed, 20 Jan 2016 21:16:33 +0000
Subject: [PATCH 1142/3333] Simplify oslo.log configuration options

Use the preferred logging_user_identity_format option to specify an alternative context format
in log files.  The removal of defining logging_context_format_string brings this more inline
with optimal production configuration of using the defined default.  logging_user_identity_format
is set in devstack to maintain current compatibility of names instead of ids.

Change-Id: I3807d76b91b6cc1614b4a9a203509f8e1ad7146d
---
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 692d5eae16..978cbdb89c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -963,7 +963,7 @@ function _configure_neutron_common {
         setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
     else
         # Show user_name and project_name by default like in nova
-        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+        iniset $NEUTRON_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
     fi
 
     if is_service_enabled tls-proxy; then
diff --git a/lib/nova b/lib/nova
index 62481edfce..b9769a739d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -546,7 +546,7 @@ function create_nova_conf {
         setup_colorized_logging $NOVA_CONF DEFAULT
     else
         # Show user_name and project_name instead of user_id and project_id
-        iniset $NOVA_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+        iniset $NOVA_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
     fi
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         _config_nova_apache_wsgi

From b162a1d58cdecfb32847b59bd341e06c26efb1ed Mon Sep 17 00:00:00 2001
From: Paulo Ewerton <pauloewerton@lsd.ufcg.edu.br>
Date: Fri, 22 Jan 2016 19:13:31 +0000
Subject: [PATCH 1143/3333] Move default Keystone API version to v3

This patch sets Keystone v3 as default in services
configuration files and in the openrc and stackrc scripts.

Change-Id: I24546f02067ea23d088d383b85e3a78d7b43f165
Partially-Implements: bp keystonev3
---
 lib/glance                         |  2 +-
 lib/heat                           |  2 +-
 lib/nova_plugins/hypervisor-ironic |  2 +-
 lib/tempest                        |  5 +----
 openrc                             | 11 +++++++++--
 stackrc                            |  2 +-
 tools/create_userrc.sh             |  4 ++--
 7 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/lib/glance b/lib/glance
index 0431bba024..bf0643bf53 100644
--- a/lib/glance
+++ b/lib/glance
@@ -205,7 +205,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_TENANT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/heat b/lib/heat
index df44b7689c..3c3be79ad7 100644
--- a/lib/heat
+++ b/lib/heat
@@ -167,7 +167,7 @@ function configure_heat {
     iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
 
     # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
+    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v3
 
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c6ed85d63e..2aa9b12ae3 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,7 +47,7 @@ function configure_nova_hypervisor {
     # ironic section
     iniset $NOVA_CONF ironic admin_username admin
     iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v3
     iniset $NOVA_CONF ironic admin_tenant_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
diff --git a/lib/tempest b/lib/tempest
index 3c34aad539..4a289fa859 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -259,6 +259,7 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
+    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
         iniset $TEMPEST_CONFIG auth admin_password "$password"
@@ -269,10 +270,6 @@ function configure_tempest {
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-        # In addition, use v3 auth tokens for running all Tempest tests
-        iniset $TEMPEST_CONFIG identity auth_version v3
-    else
-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     fi
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
diff --git a/openrc b/openrc
index 9bc0fd77f4..f81345f9fa 100644
--- a/openrc
+++ b/openrc
@@ -77,15 +77,22 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/tenant has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the 2.0 *identity api*.
+# We currently recommend using the version 3 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
+# Currently, in order to use openstackclient with Identity API v3,
+# we need to set the domain which the user and project belong to.
+if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
+    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
+    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
+fi
+
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
     DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem
diff --git a/stackrc b/stackrc
index 58146a4a1c..903da80dec 100644
--- a/stackrc
+++ b/stackrc
@@ -130,7 +130,7 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
 fi
 
 # Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
 # deployment will be deploying the Identity v2 pipelines. If this option is set
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 74d5428382..00a208c21e 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -133,7 +133,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v2.0/
+    export OS_AUTH_URL=http://localhost:5000/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
@@ -236,7 +236,7 @@ export EC2_PRIVATE_KEY="$ec2_private_key"
 export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
 export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
-export OS_AUTH_TYPE=v2password
+export OS_AUTH_TYPE=v3password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"

From 4baa4ce2b3ad5450b9eb3f59b61da80ffc990113 Mon Sep 17 00:00:00 2001
From: Mike Spreitzer <mspreitz@us.ibm.com>
Date: Tue, 26 Jan 2016 14:06:17 -0500
Subject: [PATCH 1144/3333] Document using Q_ML2_PLUGIN_PATH_MTU

I tested it, and it works!

Change-Id: Ic345ededc37b2e0b7b5dbeb397aa55540d5c3bd8
Related-Bug: #1527675
---
 doc/source/guides/neutron.rst | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 84295a50ce..7f93bad4c5 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -23,7 +23,9 @@ Physical Network Setup
 In most cases where DevStack is being deployed with a single
 interface, there is a hardware router that is being used for external
 connectivity and DHCP. The developer machine is connected to this
-network and is on a shared subnet with other machines.
+network and is on a shared subnet with other machines.  The
+`local.conf` exhibited here assumes that 1500 is a reasonable MTU to
+use on that network.
 
 .. nwdiag::
 
@@ -434,6 +436,16 @@ bridge, to forward traffic sent by guest VMs.
 Miscellaneous Tips
 ==================
 
+Non-Standard MTU on the Physical Network
+----------------------------------------
+
+DevStack defaults to assume that the MTU on the physical network
+is 1500.  A different MTU can be specified by adding the following to
+the `localrc` part of `local.conf` on each machine.
+
+::
+    Q_ML2_PLUGIN_PATH_MTU=1500
+
 
 Disabling Next Generation Firewall Tools
 ----------------------------------------

From e1f87963b142f494eb692e424c67512767d29f0f Mon Sep 17 00:00:00 2001
From: Zhenzan Zhou <zhenzan.zhou@intel.com>
Date: Tue, 8 Sep 2015 16:49:52 +0800
Subject: [PATCH 1145/3333] Add notes on live migration configuration

Live migration will not currently work with a multi-node DevStack
environment due to the libvirtd process running as root and the compute
process trying to use the stack user's SSH keys with the default live
migration URI.

The multi-node documentation is updated to outline how to configure the
SSH keys between the source and destination stack and root users so that
live migration will work as expected.

Co-Authored-By: Taylor Peoples <tpeoples@us.ibm.com>
Change-Id: Ifed7e95cd5ba43a05a4099a3664cbefde3e0a749
Closes-Bug: #1487262
---
 doc/source/guides/multinode-lab.rst | 40 +++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 37c8515e86..392bb1b807 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -373,3 +373,43 @@ If you forgot to set the root password you can do this:
 ::
 
     mysqladmin -u root -pnova password 'supersecret'
+
+Live Migration
+--------------
+
+In order for live migration to work with the default live migration URI::
+
+    [libvirt]
+    live_migration_uri = qemu+ssh://stack@%s/system
+
+SSH keys need to be exchanged between each compute node:
+
+1. The SOURCE root user's public RSA key (likely in /root/.ssh/id_rsa.pub)
+   needs to be in the DESTINATION stack user's authorized_keys file
+   (~stack/.ssh/authorized_keys).  This can be accomplished by manually
+   copying the contents from the file on the SOURCE to the DESTINATION.  If
+   you have a password configured for the stack user, then you can use the
+   following command to accomplish the same thing::
+
+        ssh-copy-id -i /root/.ssh/id_rsa.pub stack@DESTINATION
+
+2. The DESTINATION host's public ECDSA key (/etc/ssh/ssh_host_ecdsa_key.pub)
+   needs to be in the SOURCE root user's known_hosts file
+   (/root/.ssh/known_hosts).  This can be accomplished by running the
+   following on the SOURCE machine (hostname must be used)::
+
+        ssh-keyscan -H DEST_HOSTNAME | sudo tee -a /root/.ssh/known_hosts
+
+In essence, this means that every compute node's root user's public RSA key
+must exist in every other compute node's stack user's authorized_keys file and
+every compute node's public ECDSA key needs to be in every other compute
+node's root user's known_hosts file.  Please note that if the root or stack
+user does not have a SSH key, one can be generated using::
+
+    ssh-keygen -t rsa
+
+The above steps are necessary because libvirtd runs as root when the
+live_migration_uri uses the "qemu:///system" family of URIs.  For more
+information, see the `libvirt documentation`_.
+
+.. _libvirt documentation: https://libvirt.org/drvqemu.html#securitydriver

From a8ffe8a4734ceb7dc82ae50addcda96b84e934b7 Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Sun, 24 Jan 2016 20:36:35 -0800
Subject: [PATCH 1146/3333] Enable keystone caching

Enable keystone caching since there is now a memcache server available
for the middlewares to cache validation. Offload queries to the
keystone backend to memcache as well.

Change-Id: I6d1d28f5b974e79d44d1e86ea53c666e3f5771df
---
 lib/keystone | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 7592804efa..d60a4ba4c9 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -218,6 +218,14 @@ function configure_keystone {
     iniset $KEYSTONE_CONF role driver "$KEYSTONE_ROLE_BACKEND"
     iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"
 
+    # Enable caching
+    iniset $KEYSTONE_CONF cache enabled "True"
+    iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
+    iniset $KEYSTONE_CONF cache memcache_servers $SERVICE_HOST:11211
+
+    # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617
+    iniset $KEYSTONE_CONF catalog caching "False"
+
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
     # Register SSL certificates if provided

From 2d57f2f88d647dc7433e873f10546242c7fad0f6 Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith8@gmail.com>
Date: Wed, 27 Jan 2016 13:30:22 -0500
Subject: [PATCH 1147/3333] Remove lib/cinder_backends/solidfire

This was something we used a while back, but since support
for sections was added to devstack local.conf parsing we
don't need this, and actually prefer just using the
sections in local.conf.

Here's an example of how to achieve the same thing via
local.conf sections:

CINDER_ENABLED_BACKENDS=solidfire
TEMPEST_VOLUME_DRIVER=SolidFireDriver
TEMPEST_VOLUME_VENDOR="SolidFire Inc"
TEMPEST_STORAGE_PROTOCOL=iSCSI

[[post-config|$CINDER_CONF]]
[DEFAULT]
CINDER_ENABLED_BACKENDS=solidfire
[solidfire]
volume_driver=cinder.volume.drivers.solidfire.SolidFireDriver
san_ip=192.168.160.3
san_login=admin
san_password=admin
volume_backend_name=solidfire

Change-Id: I8068fd4fb14510b15c31edf490283454f167f6c6
---
 lib/cinder_backends/solidfire | 49 -----------------------------------
 1 file changed, 49 deletions(-)
 delete mode 100644 lib/cinder_backends/solidfire

diff --git a/lib/cinder_backends/solidfire b/lib/cinder_backends/solidfire
deleted file mode 100644
index 16bc527863..0000000000
--- a/lib/cinder_backends/solidfire
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/bin/bash
-#
-# lib/cinder_backends/solidfire
-# Configure the solidfire driver
-
-# Enable with:
-#
-#   CINDER_ENABLED_BACKENDS+=,solidfire:<volume-type-name>
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# CINDER_CONF
-
-# configure_cinder_driver - make configuration changes, including those to other services
-
-# Save trace setting
-_XTRACE_CINDER_SOLIDFIRE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_backend_solidfire - Set config files, create data dirs, etc
-function configure_cinder_backend_solidfire {
-    # To use SolidFire, set the following in local.conf:
-    # CINDER_ENABLED_BACKENDS+=,solidfire:<volume-type-name>
-    # SAN_IP=<mvip>
-    # SAN_LOGIN=<cluster-admin-account>
-    # SAN_PASSWORD=<cluster-admin-password>
-
-    local be_name=$1
-    iniset $CINDER_CONF $be_name volume_backend_name $be_name
-    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.solidfire.SolidFireDriver"
-    iniset $CINDER_CONF $be_name san_ip $SAN_IP
-    iniset $CINDER_CONF $be_name san_login $SAN_LOGIN
-    iniset $CINDER_CONF $be_name san_password $SAN_PASSWORD
-}
-
-
-# Restore xtrace
-$_XTRACE_CINDER_SOLIDFIRE
-
-# Local variables:
-# mode: shell-script
-# End:

From 2977b300132b1006c30d851f5d1a259c009e10ec Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 25 Jan 2016 09:10:52 -0500
Subject: [PATCH 1148/3333] docs: Linux Bridge configuration for Neutron

Add a section for single interface networking with Linux Bridge.
Change-Id: I595bc539297bf02182db5a33eeb44360e9eef9a3
---
 doc/source/guides/neutron.rst | 51 ++++++++++++++++++++++++++++++++++-
 1 file changed, 50 insertions(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 84295a50ce..81f737ff41 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -6,6 +6,8 @@ This guide will walk you through using OpenStack neutron with the ML2
 plugin and the Open vSwitch mechanism driver.
 
 
+.. _single-interface-ovs:
+
 Using Neutron with a Single Interface
 =====================================
 
@@ -74,6 +76,8 @@ serving as a hypervisor for guest instances.
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"
         Q_L3_ENABLED=True
         PUBLIC_INTERFACE=eth0
+
+        # Open vSwitch provider networking configuration
         Q_USE_PROVIDERNET_FOR_PUBLIC=True
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_BRIDGE=br-ex
@@ -411,7 +415,7 @@ compute node 1.
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
 
-        ## Neutron options
+        ## Open vSwitch provider networking options
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_INTERFACE=eth1
@@ -474,3 +478,48 @@ Extension drivers for the ML2 plugin are set with the variable
 by default. If you want to remove all the extension drivers (even
 'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 
+
+Using Linux Bridge instead of Open vSwitch
+------------------------------------------
+
+The configuration for using the Linux Bridge ML2 driver is fairly
+straight forward. The Linux Bridge configuration for DevStack is similar
+to the :ref:`Open vSwitch based single interface <single-interface-ovs>`
+setup, with small modifications for the interface mappings.
+
+
+::
+
+    [[local|localrc]]
+    HOST_IP=172.18.161.6
+    SERVICE_HOST=172.18.161.6
+    MYSQL_HOST=172.18.161.6
+    RABBIT_HOST=172.18.161.6
+    GLANCE_HOSTPORT=172.18.161.6:9292
+    ADMIN_PASSWORD=secrete
+    DATABASE_PASSWORD=secrete
+    RABBIT_PASSWORD=secrete
+    SERVICE_PASSWORD=secrete
+
+    # Do not use Nova-Network
+    disable_service n-net
+    # Enable Neutron
+    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
+
+
+    ## Neutron options
+    Q_USE_SECGROUP=True
+    FLOATING_RANGE="172.18.161.0/24"
+    FIXED_RANGE="10.0.0.0/24"
+    Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
+    PUBLIC_NETWORK_GATEWAY="172.18.161.1"
+    Q_L3_ENABLED=True
+    PUBLIC_INTERFACE=eth0
+
+    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+
+    # Linuxbridge Settings
+    Q_AGENT=linuxbridge
+    LB_PHYSICAL_INTERFACE=eth0
+    PUBLIC_PHYSICAL_NETWORK=default
+    LB_INTERFACE_MAPPINGS=default:eth0

From 09883c0a1801daaacd26a7a38d1b72a1b2dbb4e9 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 21 Jan 2016 18:35:43 -0800
Subject: [PATCH 1149/3333] Set PS4 in stack.sh to provide additional debug
 info

Add:
export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'

To stack.sh to provide additional debug info. This will show the
filename, line number, function name, and the content of the line.

An example output line:
+++(/opt/stack/old/devstack/functions-common:675): get_field(): local data field

Info on this PS4 variable found at:
http://wiki.bash-hackers.org/scripting/debuggingtips

Change-Id: I272df6c79f6ff7afa8f102da24706558d9169eda
---
 stack.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/stack.sh b/stack.sh
index e9831d5039..91e7204aae 100755
--- a/stack.sh
+++ b/stack.sh
@@ -23,6 +23,7 @@
 # Print the commands being run so that we can see the command that triggers
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
+export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
 
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
@@ -238,6 +239,7 @@ echo "$STACK_USER ALL=(root) NOPASSWD:ALL" >$TEMPFILE
 # see them by forcing ``PATH``
 echo "Defaults:$STACK_USER secure_path=/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >> $TEMPFILE
 echo "Defaults:$STACK_USER !requiretty" >> $TEMPFILE
+echo "Defaults env_keep += PS4" >> $TEMPFILE
 chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh

From b298e57c9f44081767c726a36d60caca66f604aa Mon Sep 17 00:00:00 2001
From: Yingxin <yingxin.cheng@intel.com>
Date: Fri, 29 Jan 2016 05:11:27 +0000
Subject: [PATCH 1150/3333] Change scheduler configurations to use entrypoints

Full class path style configuration of options scheduler_host_manager
and scheduler_driver are deprecated because of dependent changes. This
commit changes the related configurations to use entrypoints in setting
up nova scheduler in devstack.

Related to blueprint scheduler-driver-use-stevedore
Depends-On: I8c169e12d9bfacdbdb1dadf68b8a1fa98c5ea5bc
Depends-On: I3fd42ead44487a21eb5cfaf5a91209277ce30ad0

Change-Id: Iad96c270073b63719237cf9a9aa1c2dc4daa213a
---
 lib/nova                           | 2 +-
 lib/nova_plugins/hypervisor-ironic | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 79bef9bd0b..807fdf6dc0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -96,7 +96,7 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
 
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.
-SCHEDULER=${SCHEDULER:-nova.scheduler.filter_scheduler.FilterScheduler}
+SCHEDULER=${SCHEDULER:-filter_scheduler}
 
 # The following FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c6ed85d63e..43e7797371 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -41,7 +41,7 @@ function configure_nova_hypervisor {
 
     iniset $NOVA_CONF DEFAULT compute_driver nova.virt.ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    iniset $NOVA_CONF DEFAULT scheduler_host_manager nova.scheduler.ironic_host_manager.IronicHostManager
+    iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From 4fd874b4f1323ac024d263077e443d7361dd1c0e Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 19 Jan 2016 18:17:49 -0500
Subject: [PATCH 1151/3333] Add script to autogenerate
 doc/source/plugin-registry.rst

This generates the plugin-registry document from a static header,
a scan of openstack/ git repositories, and a static footer.  It
is intended to be run by a periodic job proposal bot to keep the
list of plugins current.

Change-Id: Ia04ab72900c8efd5d5289fbd7632201dcaa3e5d9
---
 data/devstack-plugins-registry.footer   | 28 ++++++++++++
 data/devstack-plugins-registry.header   | 19 ++++++++
 tools/generate-devstack-plugins-list.sh | 59 +++++++++++++++++++++++++
 3 files changed, 106 insertions(+)
 create mode 100644 data/devstack-plugins-registry.footer
 create mode 100644 data/devstack-plugins-registry.header
 create mode 100644 tools/generate-devstack-plugins-list.sh

diff --git a/data/devstack-plugins-registry.footer b/data/devstack-plugins-registry.footer
new file mode 100644
index 0000000000..669cb8d574
--- /dev/null
+++ b/data/devstack-plugins-registry.footer
@@ -0,0 +1,28 @@
+
+Drivers
+=======
+
++--------------------+-------------------------------------------------+------------------+
+|Plugin Name         |URL                                              |Comments          |
++--------------------+-------------------------------------------------+------------------+
+|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
++--------------------+-------------------------------------------------+------------------+
+|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
++--------------------+-------------------------------------------------+------------------+
+
+.. [d1] demonstrates example of installing 3rd party SDN controller
+.. [d2] demonstrates a pretty advanced set of modes that that allow
+        one to run OpenDayLight either from a pre-existing install, or
+        also from source
+
+Alternate Configs
+=================
+
++-------------+------------------------------------------------------------+------------+
+| Plugin Name | URL                                                        | Comments   |
+|             |                                                            |            |
++-------------+------------------------------------------------------------+------------+
+|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
++-------------+------------------------------------------------------------+------------+
+|             |                                                            |            |
++-------------+------------------------------------------------------------+------------+
diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
new file mode 100644
index 0000000000..9f8a99471c
--- /dev/null
+++ b/data/devstack-plugins-registry.header
@@ -0,0 +1,19 @@
+==========================
+ DevStack Plugin Registry
+==========================
+
+Since we've created the external plugin mechanism, it's gotten used by
+a lot of projects. The following is a list of plugins that currently
+exist. Any project that wishes to list their plugin here is welcomed
+to.
+
+Detected Plugins
+================
+
+The following are plugins that a script has found in the openstack/
+namespace, which includes but is not limited to official OpenStack
+projects.
+
++------------------+------------------------------------------------------------+------------+
+|Plugin Name       |URL                                                         |Date        |
++------------------+------------------------------------------------------------+------------+
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
new file mode 100644
index 0000000000..6e9e828978
--- /dev/null
+++ b/tools/generate-devstack-plugins-list.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -ex
+
+# Copyright 2016 Hewlett Packard Enterprise Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This script is intended to be run as a periodic proposal bot job
+# in OpenStack infrastructure, though you can run it as a one-off.
+#
+# In order to function correctly, the environment in which the
+# script runs must have
+#   * git
+#   * all git repos meant to be searched for plugins cloned and
+#     at the desired level of up-to-datedness
+#   * a writable doc/source directory relative to the current
+#     working directory
+#
+# If a file named data/devstack-plugins-registry.header or
+# data/devstack-plugins-registry.footer is found relative to the
+# current working directory, it will be prepended or appended to
+# the generated reStructuredText plugins table respectively.
+
+(
+declare -A plugins
+
+test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
+
+pushd ${git_dir:-/opt/openstack} >/dev/null
+for i in *; do
+    pushd ${i} >/dev/null
+    if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
+        test -n "$output" && plugins[$i]=${output}
+    fi
+    popd >/dev/null
+done
+popd >/dev/null
+
+sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
+
+for k in "${sorted_plugins[@]}"; do
+    project=${k:0:18}
+    giturl="git://git.openstack.org/openstack/${k:0:26}"
+    pdate="${plugins[$k]}"
+    printf "|%-18s|%-60s|%-12s|\n" "${project}" "${giturl}" "${pdate}"
+    printf "+------------------+------------------------------------------------------------+------------+\n"
+done
+
+test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
+) > doc/source/plugin-registry.rst

From 74b91c3eaf150eb40a5d5ab2df1533ae192ee26d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 1 Feb 2016 14:58:20 +0000
Subject: [PATCH 1152/3333] Revert "Move default Keystone API version to v3"

It seems like the fallout from this was not well sorted.
A lot of things aren't working, and there is still vestigial
v2 bits left behind.

This should have come with a much greater warning and some
spot checking of additional services working with this.

This reverts commit b162a1d58cdecfb32847b59bd341e06c26efb1ed.

Change-Id: Ia792b23119c00089542ba08879dca1c29dc80945
---
 lib/glance                         |  2 +-
 lib/heat                           |  2 +-
 lib/nova_plugins/hypervisor-ironic |  2 +-
 lib/tempest                        |  5 ++++-
 openrc                             | 11 ++---------
 stackrc                            |  2 +-
 tools/create_userrc.sh             |  4 ++--
 7 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/lib/glance b/lib/glance
index bf0643bf53..0431bba024 100644
--- a/lib/glance
+++ b/lib/glance
@@ -205,7 +205,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_TENANT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/heat b/lib/heat
index 3c3be79ad7..df44b7689c 100644
--- a/lib/heat
+++ b/lib/heat
@@ -167,7 +167,7 @@ function configure_heat {
     iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
 
     # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v3
+    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
 
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 2aa9b12ae3..c6ed85d63e 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,7 +47,7 @@ function configure_nova_hypervisor {
     # ironic section
     iniset $NOVA_CONF ironic admin_username admin
     iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
     iniset $NOVA_CONF ironic admin_tenant_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
diff --git a/lib/tempest b/lib/tempest
index 4a289fa859..3c34aad539 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -259,7 +259,6 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
-    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
         iniset $TEMPEST_CONFIG auth admin_password "$password"
@@ -270,6 +269,10 @@ function configure_tempest {
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
+        # In addition, use v3 auth tokens for running all Tempest tests
+        iniset $TEMPEST_CONFIG identity auth_version v3
+    else
+        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     fi
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
diff --git a/openrc b/openrc
index f81345f9fa..9bc0fd77f4 100644
--- a/openrc
+++ b/openrc
@@ -77,22 +77,15 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/tenant has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the version 3 *identity api*.
+# We currently recommend using the 2.0 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
-# Currently, in order to use openstackclient with Identity API v3,
-# we need to set the domain which the user and project belong to.
-if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
-    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
-    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
-fi
-
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
     DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem
diff --git a/stackrc b/stackrc
index 903da80dec..58146a4a1c 100644
--- a/stackrc
+++ b/stackrc
@@ -130,7 +130,7 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
 fi
 
 # Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
 # deployment will be deploying the Identity v2 pipelines. If this option is set
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 00a208c21e..74d5428382 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -133,7 +133,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v3/
+    export OS_AUTH_URL=http://localhost:5000/v2.0/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
@@ -236,7 +236,7 @@ export EC2_PRIVATE_KEY="$ec2_private_key"
 export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
 export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
-export OS_AUTH_TYPE=v3password
+export OS_AUTH_TYPE=v2password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"

From f81ae88c55739bbdfee7db711cc6b2e910794e05 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 1 Feb 2016 14:00:20 -0500
Subject: [PATCH 1153/3333] docs: Neutron - add required newline for code
 formatting

Otherwise it doesn't render it as the correct HTML tag.

Change-Id: Ibc5c846824c7248c64473512e9dcfe5dd4205924
---
 doc/source/guides/neutron.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 1e20d7fcbe..c6af953f22 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -448,6 +448,7 @@ is 1500.  A different MTU can be specified by adding the following to
 the `localrc` part of `local.conf` on each machine.
 
 ::
+
     Q_ML2_PLUGIN_PATH_MTU=1500
 
 

From 557cc8159eaeb67587f9bb2724a6b04830688d27 Mon Sep 17 00:00:00 2001
From: Shih-Hao Li <shihli@vmware.com>
Date: Mon, 1 Feb 2016 13:19:12 -0800
Subject: [PATCH 1154/3333] Fix xvpvncproxy_host config path

Fix xvpvncproxy_host config path due to Change
I1e34a0f98de125c8b8b145377835d95035e2b472.

Change-Id: I835950e75509ad54e5dc1c4a740d2e5cfed9f5a9
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 79bef9bd0b..dc425a19bd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -579,7 +579,7 @@ function create_nova_conf {
         iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $NOVA_CONF DEFAULT xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
         iniset $NOVA_CONF vnc enabled false
     fi

From 8eab6ad31b7d34f26c912e7c1e60d39bf596124a Mon Sep 17 00:00:00 2001
From: Jerry Zhao <xyzjerry@gmail.com>
Date: Mon, 1 Feb 2016 18:22:21 -0800
Subject: [PATCH 1155/3333] make fwaas plugin and driver configurable

user can pass fwaas plugin and driver from localrc

Change-Id: Id956d4d7e62ba81f77319c199c9cb9f354b13d12
---
 lib/neutron_plugins/services/firewall | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 2b7f32d233..40968fa04c 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -7,7 +7,8 @@
 _XTRACE_NEUTRON_FIREWALL=$(set +o | grep xtrace)
 set +o xtrace
 
-FWAAS_PLUGIN=neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin
+FWAAS_PLUGIN=${FWAAS_PLUGIN:-neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin}
+FWAAS_DRIVER=${FWAAS_DRIVER:-neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver}
 
 function neutron_fwaas_configure_common {
     _neutron_service_plugin_class_add $FWAAS_PLUGIN
@@ -21,7 +22,7 @@ function neutron_fwaas_configure_driver {
     cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini.sample $FWAAS_DRIVER_CONF_FILENAME
 
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"
+    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "$FWAAS_DRIVER"
 }
 
 function neutron_fwaas_stop {

From c67d22e2ed0eb3fa0786f4314752ab7b26758ea3 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 Feb 2016 05:51:14 -0500
Subject: [PATCH 1156/3333] make the alt_demo user during normal install

For testing reasons it's typically very useful to have a second non
admin user to cross check that it can't do a thing to the first
user. It was useful enough we always created it with tempest (though
we didn't always use it).

This makes devstack always create an alt_demo user, which is available
in occ as devstack-alt. This will help us unwind some of the keystone
v3 breaks with functional tests using keystone cli to build this
second user.

Change-Id: Iaaf02469180563e2d8c413fee0ee66ada2296cfa
---
 extras.d/80-tempest.sh |  3 +--
 functions-common       | 15 +++++++++++++++
 lib/keystone           | 16 ++++++++++++++++
 lib/tempest            | 15 ---------------
 4 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 5e8da99a92..fcf79bd4d9 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -9,7 +9,7 @@ if is_service_enabled tempest; then
         install_tempest
     elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
         # Tempest config must come after layer 2 services are running
-        create_tempest_accounts
+        :
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
@@ -28,4 +28,3 @@ if is_service_enabled tempest; then
         :
     fi
 fi
-
diff --git a/functions-common b/functions-common
index 12c925b0ff..2a08f5f112 100644
--- a/functions-common
+++ b/functions-common
@@ -86,6 +86,7 @@ function write_clouds_yaml {
     if [ -f "$SSL_BUNDLE_FILE" ]; then
         CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
     fi
+    # demo -> devstack
     $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack \
@@ -96,6 +97,20 @@ function write_clouds_yaml {
         --os-username demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
+
+    # alt_demo -> devstack-alt
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version 3 \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-username alt_demo \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name alt_demo
+
+    # admin -> devstack-admin
     $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
diff --git a/lib/keystone b/lib/keystone
index d60a4ba4c9..507ee555c2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -327,6 +327,8 @@ function configure_keystone {
 # --                   --         Member
 # demo                 admin      admin
 # demo                 demo       Member, anotherrole
+# alt_demo             admin      admin
+# alt_demo             alt_demo   Member, anotherrole
 # invisible_to_admin   demo       Member
 
 # Group                Users      Roles                 Tenant
@@ -387,6 +389,18 @@ function create_keystone_accounts {
     get_or_add_user_project_role $another_role $demo_user $demo_tenant
     get_or_add_user_project_role $member_role $demo_user $invis_tenant
 
+    # alt_demo
+    local alt_demo_tenant
+    alt_demo_tenant=$(get_or_create_project "alt_demo" default)
+    local alt_demo_user
+    alt_demo_user=$(get_or_create_user "alt_demo" \
+        "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
+
+    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_tenant
+    get_or_add_user_project_role $admin_role $admin_user $alt_demo_tenant
+    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_tenant
+
+    # groups
     local admin_group
     admin_group=$(get_or_create_group "admins" \
         "default" "openstack admin group")
@@ -396,6 +410,8 @@ function create_keystone_accounts {
 
     get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
     get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
+    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_tenant
+    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_tenant
     get_or_add_group_project_role $admin_role $admin_group $admin_tenant
 }
 
diff --git a/lib/tempest b/lib/tempest
index 5c771f9d47..add1b0e4c6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -568,21 +568,6 @@ function configure_tempest {
     IFS=$ifs
 }
 
-# create_tempest_accounts() - Set up common required tempest accounts
-
-# Project              User         Roles
-# ------------------------------------------------------------------
-# alt_demo             alt_demo     Member
-
-function create_tempest_accounts {
-    if is_service_enabled tempest; then
-        # Tempest has some tests that validate various authorization checks
-        # between two regular users in separate tenants
-        get_or_create_project alt_demo default
-        get_or_create_user alt_demo "$ADMIN_PASSWORD" "default" "alt_demo@example.com"
-        get_or_add_user_project_role Member alt_demo alt_demo
-    fi
-}
 
 # install_tempest_lib() - Collect source, prepare, and install ``tempest-lib``
 function install_tempest_lib {

From 020586fab4173ea860789e459cb941c85179c739 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Fri, 18 Dec 2015 07:44:45 -0430
Subject: [PATCH 1157/3333] Remove g-search from devstack

The g-search service was promoted to its own project and it's now called
Searchlight. This patch removes that code from devstack.

Change-Id: I9dd7ce62f0339911e025329b8a841792219ea02b
---
 lib/glance | 70 ------------------------------------------------------
 1 file changed, 70 deletions(-)

diff --git a/lib/glance b/lib/glance
index 0431bba024..fa93e6e658 100644
--- a/lib/glance
+++ b/lib/glance
@@ -49,10 +49,8 @@ GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_REGISTRY_CONF=$GLANCE_CONF_DIR/glance-registry.conf
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
-GLANCE_SEARCH_CONF=$GLANCE_CONF_DIR/glance-search.conf
 GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
-GLANCE_SEARCH_PASTE_INI=$GLANCE_CONF_DIR/glance-search-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
@@ -71,9 +69,6 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
-GLANCE_SEARCH_PORT=${GLANCE_SEARCH_PORT:-9393}
-GLANCE_SEARCH_PORT_INT=${GLANCE_SEARCH_PORT_INT:-19393}
-GLANCE_SEARCH_HOSTPORT=${GLANCE_SEARCH_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SEARCH_PORT}
 
 # Functions
 # ---------
@@ -91,10 +86,6 @@ function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
     sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
-
-    if is_service_enabled g-search; then
-        ${TOP_DIR}/pkg/elasticsearch.sh stop
-    fi
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -229,30 +220,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
-
-    # Configure search
-    if is_service_enabled g-search; then
-        cp $GLANCE_DIR/etc/glance-search.conf $GLANCE_SEARCH_CONF
-        iniset $GLANCE_SEARCH_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $GLANCE_SEARCH_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        inicomment $GLANCE_SEARCH_CONF DEFAULT log_file
-        iniset $GLANCE_SEARCH_CONF DEFAULT use_syslog $SYSLOG
-        iniset $GLANCE_SEARCH_CONF database connection $dburl
-        iniset $GLANCE_SEARCH_CONF paste_deploy flavor keystone
-        configure_auth_token_middleware $GLANCE_SEARCH_CONF glance $GLANCE_AUTH_CACHE_DIR/search
-
-        if is_service_enabled tls-proxy; then
-            iniset $GLANCE_SEARCH_CONF DEFAULT bind_port $GLANCE_SEARCH_PORT_INT
-        fi
-        # Register SSL certificates if provided
-        if is_ssl_enabled_service glance; then
-            ensure_certificates GLANCE
-            iniset $GLANCE_SEARCH_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-            iniset $GLANCE_SEARCH_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-        fi
-
-        cp $GLANCE_DIR/etc/glance-search-paste.ini $GLANCE_SEARCH_PASTE_INI
-    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -287,19 +254,6 @@ function create_glance_accounts {
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
         fi
     fi
-
-    # Add glance-search service and endpoints
-    if is_service_enabled g-search; then
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            get_or_create_service "glance-search" "search" "EXPERIMENTAL - Glance Graffiti Search Service"
-
-            get_or_create_endpoint "search" \
-                "$REGION_NAME" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT"
-        fi
-    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
@@ -329,12 +283,6 @@ function init_glance {
     $GLANCE_BIN_DIR/glance-manage db_load_metadefs
 
     create_glance_cache_dir
-
-    # Init glance search by exporting found metadefs/images to elasticsearch
-    if is_service_enabled g-search; then
-        ${TOP_DIR}/pkg/elasticsearch.sh start
-        $GLANCE_BIN_DIR/glance-index
-    fi
 }
 
 # install_glanceclient() - Collect source and prepare
@@ -371,11 +319,6 @@ function start_glance {
     if is_service_enabled tls-proxy; then
         start_tls_proxy '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT &
         start_tls_proxy '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT &
-
-        # Handle g-search
-        if is_service_enabled g-search; then
-            start_tls_proxy '*' $GLANCE_SEARCH_PORT $GLANCE_SERVICE_HOST $GLANCE_SEARCH_PORT_INT &
-        fi
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
@@ -385,15 +328,6 @@ function start_glance {
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
-
-    # Start g-search after g-reg/g-api
-    if is_service_enabled g-search; then
-        run_process g-search "$GLANCE_BIN_DIR/glance-search --config-file=$GLANCE_CONF_DIR/glance-search.conf"
-        echo "Waiting for g-search ($GLANCE_SEARCH_HOSTPORT) to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT; then
-            die $LINENO "g-search did not start"
-        fi
-    fi
 }
 
 # stop_glance() - Stop running processes
@@ -401,10 +335,6 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
-
-    if is_service_enabled g-search; then
-        stop_process g-search
-    fi
 }
 
 # Restore xtrace

From 3095ff51320291b3622cacc3bf2fb1043bff8d31 Mon Sep 17 00:00:00 2001
From: Igor Duarte Cardoso <igor.duarte.cardoso@intel.com>
Date: Tue, 19 Jan 2016 18:07:47 +0000
Subject: [PATCH 1158/3333] Automate OVS bridge creation for multiple mappings

Allows the definition of the global variable OVS_BRIDGE_MAPPINGS (e.g.
in local.conf) to automatically trigger the creation of multiple OVS
bridges. For example:

OVS_BRIDGE_MAPPINGS=physnet1:br-br-enp0s20f1,physnet2:br-enp0s20f2

should automatically yield the creation of two bridges, respectively
associated to the two physical networks declared,
by simply running DevStack with the OVS agent enabled.

Documentation has also been added to doc/source/guides/neutron.rst.

Change-Id: I79dc0213c9d70ba628621c4c0f65481783590085
Closes-Bug: #1535835
---
 doc/source/guides/neutron.rst         | 16 ++++++++++++++++
 lib/neutron_plugins/openvswitch_agent | 11 +++++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 1e20d7fcbe..be85b63580 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -535,3 +535,19 @@ setup, with small modifications for the interface mappings.
     LB_PHYSICAL_INTERFACE=eth0
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
+
+Creating specific OVS bridges for physical networks
+---------------------------------------------------
+
+When using the Open vSwitch ML2 mechanism driver, it is possible to
+have multiple Open vSwitch bridges meant for physical networking be
+automatically created by setting the ``OVS_BRIDGE_MAPPINGS`` to a list of
+physical network to bridge name associations with the following syntax:
+
+::
+    OVS_BRIDGE_MAPPINGS=net1name:bridge1name,net2name:bridge2name,<...>
+
+Also, ``OVS_BRIDGE_MAPPINGS`` has precedence over ``PHYSICAL_NETWORK`` and
+``OVS_PHYSICAL_BRIDGE``, meaning that if the former is set, the latter
+ones will be ignored. When ``OVS_BRIDGE_MAPPINGS`` is not set, the other
+variables will still be evaluated.
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index b1acacd4f3..94a26898ad 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -37,6 +37,7 @@ function neutron_plugin_configure_l3_agent {
 }
 
 function neutron_plugin_configure_plugin_agent {
+    local mappings_array mapping phys_bridge
     # Setup integration bridge
     _neutron_ovs_base_setup_bridge $OVS_BRIDGE
     _neutron_ovs_base_configure_firewall_driver
@@ -58,9 +59,15 @@ function neutron_plugin_configure_plugin_agent {
     # complex physical network configurations.
     if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
         OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+    fi
 
-        # Configure bridge manually with physical interface as port for multi-node
-        _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE
+    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
+        IFS=',' read -a mappings_array <<< "$OVS_BRIDGE_MAPPINGS"
+        for mapping in "${mappings_array[@]}"; do
+            phys_bridge=`echo $mapping | cut -f 2 -d ":"`
+            # Configure bridge manually with physical interface as port for multi-node
+            _neutron_ovs_base_add_bridge $phys_bridge
+        done
     fi
     if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS

From 50f75a9f64efc00e17028c780b6df261fc2c27ec Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 3 Feb 2016 17:40:17 -0600
Subject: [PATCH 1159/3333] Followup comment fix from alt_demo user creation

Tweak a code comment based on a review comment from Steve Martinelli in
https://review.openstack.org/#/c/275121/ where the alt_demo user is now
always created.

Change-Id: I9e9a769f601e52c030e9f6953f1746788c24a185
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 507ee555c2..6bad6b9405 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -331,10 +331,10 @@ function configure_keystone {
 # alt_demo             alt_demo   Member, anotherrole
 # invisible_to_admin   demo       Member
 
-# Group                Users      Roles                 Tenant
+# Group                Users            Roles                 Tenant
 # ------------------------------------------------------------------
-# admins               admin      admin                 admin
-# nonadmins            demo       Member, anotherrole   demo
+# admins               admin            admin                 admin
+# nonadmins            demo, alt_demo   Member, anotherrole   demo, alt_demo
 
 
 # Migrated from keystone_data.sh

From e73f88e70b9f547bb8306f1f5715c898426f87b8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 Feb 2016 06:58:39 -0500
Subject: [PATCH 1160/3333] tweak ps4 for readability

After staring at a bunch of logs, try to crisp up the ps4 output for
maximum readability.

This also adds PS4 to all calling scripts by having a common PS4 in
stackrc. It should make understanding when clean fails a bit more
straight forward.

Change-Id: Ia1f8dff5c1102c32c146a020a9f033c65d2c50de
---
 clean.sh   | 1 +
 stack.sh   | 1 -
 stackrc    | 3 +++
 unstack.sh | 2 ++
 4 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index c8b822317d..3db48585ec 100755
--- a/clean.sh
+++ b/clean.sh
@@ -51,6 +51,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 
+set -o xtrace
 
 # Extras Source
 # --------------
diff --git a/stack.sh b/stack.sh
index d261787278..c21ff77742 100755
--- a/stack.sh
+++ b/stack.sh
@@ -23,7 +23,6 @@
 # Print the commands being run so that we can see the command that triggers
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
-export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
 
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
diff --git a/stackrc b/stackrc
index 58146a4a1c..887d4b31ff 100644
--- a/stackrc
+++ b/stackrc
@@ -14,6 +14,9 @@ unset LANGUAGE
 LC_ALL=C
 export LC_ALL
 
+# Make tracing more educational
+export PS4='+ ${BASH_SOURCE}:${FUNCNAME[0]}:L${LINENO}:   '
+
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 
diff --git a/unstack.sh b/unstack.sh
index 8eded837fd..47beb04263 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -87,6 +87,8 @@ load_plugin_settings
 # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
 GetOSVersion
 
+set -o xtrace
+
 # Run extras
 # ==========
 

From e20cb43fd691c77919d77618bce46bc8c3e4de11 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 5 Feb 2016 12:00:18 -0800
Subject: [PATCH 1161/3333] Set different cloud name for alt_demu user

Having multiple clouds with the same name in clouds.yaml confuses
openstack client config and it may not choose the intended cloud.
Unfortunately the new alt_demo user's clouds.yaml config used a
duplicate name creating confusion for clouds.yaml consumers.

Correct this by using a unique cloud name, devstack-alt, for use by the
alt_demo user.

Change-Id: I2cb8f10ab5abfedf76ead309f237730ce8ce2ad4
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 2a08f5f112..b1f0a383e1 100644
--- a/functions-common
+++ b/functions-common
@@ -101,7 +101,7 @@ function write_clouds_yaml {
     # alt_demo -> devstack-alt
     $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
-        --os-cloud devstack \
+        --os-cloud devstack-alt \
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \

From da1cc5780d9501f5705a5e9844e819067514217f Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Tue, 2 Feb 2016 09:09:28 -0800
Subject: [PATCH 1162/3333] Remove microseconds from apache log(s)

Remove the microseconds from the apache logs and move back to using
milliseconds. There is no longer any 2.2 workarounds in the keystone
setup process.

Change-Id: I8787eee41fbde1f9794aeffe1e862af0d5117bc3
---
 files/apache-keystone.template | 16 +++-------------
 lib/keystone                   |  9 ++++-----
 2 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index f9fa265db5..428544f25c 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -3,13 +3,7 @@ Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
-    <IfVersion >= 2.4>
-        Require all granted
-    </IfVersion>
-    <IfVersion < 2.4>
-        Order allow,deny
-        Allow from all
-    </IfVersion>
+    Require all granted
 </Directory>
 
 <VirtualHost *:%PUBLICPORT%>
@@ -18,9 +12,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/keystone.log
     CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
     %SSLENGINE%
@@ -34,9 +26,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/keystone.log
     CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
     %SSLENGINE%
diff --git a/lib/keystone b/lib/keystone
index 507ee555c2..73332221c7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -299,11 +299,10 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
-        # Eliminate the %(asctime)s.%(msecs)03d from the log format strings
-        iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(funcName)s %(pathname)s:%(lineno)d"
-        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(process)d TRACE %(name)s %(instance)s"
+        iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
+        iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
+        iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
+        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
     else
         iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"

From d6f922364e3e8a500602f65691d395ef64a077b4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 9 Feb 2016 06:34:36 -0500
Subject: [PATCH 1163/3333] push out some deprecations to figure out what's
 using these bits

There are some parts of devstack we should really delete, but we have
no idea who is using them. Push out some deprecations so we can look
at this through logstash.

Change-Id: Id5c8748606cce16f64e978ad7ac9309bebac0eb7
---
 lib/keystone       | 1 +
 lib/neutron-legacy | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 73332221c7..38a0acf4ea 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -259,6 +259,7 @@ function configure_keystone {
         # Configure ``keystone.conf`` to use sql
         inicomment $KEYSTONE_CONF catalog template_file
     else
+        deprecated "Using templated service catalog in devstack is deprecated"
         cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
 
         # Add swift endpoints to service catalog if swift is enabled
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 78eb55d397..73a1bcd0a3 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -433,15 +433,18 @@ function configure_neutron {
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
     if is_service_enabled q-lbaas; then
+        deprecated "Configuring q-lbaas through devstack is deprecated"
         _configure_neutron_lbaas
     fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
     if is_service_enabled q-vpn; then
+        deprecated "Configuring q-vpn through devstack is deprecated"
         _configure_neutron_vpn
     fi
     if is_service_enabled q-fwaas; then
+        deprecated "Configuring q-fwaas through devstack is deprecated"
         _configure_neutron_fwaas
     fi
     if is_service_enabled q-agt q-svc; then

From 6f013631a27a726ae45e27b209fa769d96d5f069 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Tue, 9 Feb 2016 13:30:58 -0800
Subject: [PATCH 1164/3333] Handle case where FUNCNAME[0] is undefined

If FUNCNAME[0] is undefined and 'set -u' has been used it will cause the
devstack run to fail.

Handle undefined values in PS4.

Closes-Bug: #1543749
Change-Id: I06a013a5e7683e3a3461ff06361d867f61d48e6a
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 887d4b31ff..8638a900e9 100644
--- a/stackrc
+++ b/stackrc
@@ -15,7 +15,7 @@ LC_ALL=C
 export LC_ALL
 
 # Make tracing more educational
-export PS4='+ ${BASH_SOURCE}:${FUNCNAME[0]}:L${LINENO}:   '
+export PS4='+ ${BASH_SOURCE:-}:${FUNCNAME[0]:-}:L${LINENO:-}:   '
 
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)

From 1a9e294ff398e5f3c3a0a62621b8872273aeb0f9 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 9 Feb 2016 18:51:02 -0500
Subject: [PATCH 1165/3333] Switch tempest verify-config usage to avoid bug

This commit will unblock the world breakage caused by the recent
cliff release. This exposes a hole in our constraints usage in
devstack. We need to fix this bug for real in devstack and cliff,
but that will take a few minutes to an hour or so. So let's just
change the usage in the meantime, we can revert this when things
are fixed for real.

Related-Bug: #1543841

Depends-On: Ic63612dc50e064a3a69b88618e394ba17e083c22
Change-Id: I19e477fa5068474bc3471307732f89adaafb2952
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index add1b0e4c6..e90ff93c8a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -321,7 +321,7 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv -- tempest verify-config -uro $tmp_cfg_file
+    tox -revenv -- tempest verify-config -u -r -o $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then

From 1e31e68557205fa61929ff579e427b7ef86aa2ea Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 9 Feb 2016 23:50:54 -0500
Subject: [PATCH 1166/3333] Respect constraints in tempest tox venvs

This commit is a workaround for respecting upper-constraints. Since
we're using tox to handle setting up a venv and running tempest
commands we need to manually install the constrained packages inside
the tox venvs. This patch does that for all the venvs being created by
devstack via tox. However, since tempest has additional tox jobs
defined if those are run via devstack those will default to the
default pip install -U -r requirements.txt defined in tempest's
tox.ini.

Change-Id: I7f84dfb67a3c97003947aefd8a7e3c6454106db4
Closes-Bug: #1543841
---
 lib/tempest | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index e90ff93c8a..cf4c0d6dde 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -321,7 +321,10 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv -- tempest verify-config -u -r -o $tmp_cfg_file
+    tox -revenv --notest
+    # NOTE(mtreinish): Respect constraints on tempest verify-config venv
+    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    tox -evenv -- tempest verify-config -uro $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
@@ -588,6 +591,10 @@ function install_tempest {
     pip_install tox
     pushd $TEMPEST_DIR
     tox --notest -efull
+    # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
+    # are using a tox job other than full will not be respecting constraints but
+    # running pip install -U on tempest requirements
+    $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
     install_tempest_lib
     popd

From 8d6d116530634cdaca5ab6d3af9ca0ae1960c025 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 9 Feb 2016 15:13:25 -0800
Subject: [PATCH 1167/3333] Install libosinfo on n-cpu nodes

As of 9de8f7230d069e4da9736f09ad5d17773315b476 nova is now attempting
to import libosinfo packages, so install them for goodness sake.

Change-Id: Ib481dda475dd2975a513052478be0007aa1cf4a8
Related-Bug: #1543288
---
 files/debs/n-cpu      | 1 +
 files/rpms-suse/n-cpu | 1 +
 files/rpms/n-cpu      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 0da57ee047..69ac430290 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,5 +1,6 @@
 cryptsetup
 genisoimage
+gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
 open-iscsi
 python-guestfs # NOPRIME
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index 29bd31b365..9ece11534d 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,5 +1,6 @@
 cryptsetup
 genisoimage
+libosinfo
 lvm2
 open-iscsi
 sg3_utils
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 7773b0402d..26c5ced196 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,6 +1,7 @@
 cryptsetup
 genisoimage
 iscsi-initiator-utils
+libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes

From 28af7962e99a844675e175ec23bba15378231d5f Mon Sep 17 00:00:00 2001
From: Matthew Kassawara <mkassawara@gmail.com>
Date: Wed, 10 Feb 2016 19:04:08 +0000
Subject: [PATCH 1168/3333] Neutron: Change auth_plugin to auth_type

The keystoneauth1 library replaces the auth_plugin option
with auth_type. In neutron.conf, change [nova] auth_plugin
to auth_type. In nova.conf, change [neutron] auth_plugin to
auth_type.

Change-Id: Ifbd26b8999e453f4cd875e1be3ae1211bdd8fb2a
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73a1bcd0a3..da3c189ef8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -478,7 +478,7 @@ function configure_neutron {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
 
-    iniset $NOVA_CONF neutron auth_plugin "v3password"
+    iniset $NOVA_CONF neutron auth_type "password"
     iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
@@ -1155,7 +1155,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    iniset $NEUTRON_CONF nova auth_plugin password
+    iniset $NEUTRON_CONF nova auth_type password
     iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
     iniset $NEUTRON_CONF nova username nova
     iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD

From 985e958dda3e843442f76199caf63fa8b93680cc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 10 Feb 2016 07:25:24 -0500
Subject: [PATCH 1169/3333] remove keystone templated catalog

This is just another code path for little benefit in devstack which is
going to rot out. We should be opinionated here and only support the
dynamic catalog.

Change-Id: I4e5c7e86aefe72fc21c77d423033e9b169318fec
---
 doc/source/configuration.rst    | 18 ---------
 files/default_catalog.templates | 63 --------------------------------
 lib/cinder                      | 29 ++++++++-------
 lib/glance                      | 16 ++++----
 lib/heat                        | 32 ++++++++--------
 lib/keystone                    | 65 +++++++--------------------------
 lib/neutron-legacy              | 16 ++++----
 lib/nova                        | 59 ++++++++++++++----------------
 lib/swift                       | 18 ++++-----
 9 files changed, 93 insertions(+), 223 deletions(-)
 delete mode 100644 files/default_catalog.templates

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6f45c1cbb4..e985bdceb0 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -379,24 +379,6 @@ that matches requirements.
 
         PIP_UPGRADE=True
 
-
-Service Catalog Backend
------------------------
-
-By default DevStack uses Keystone's ``sql`` service catalog backend.
-An alternate ``template`` backend is also available, however, it does
-not support the ``service-*`` and ``endpoint-*`` commands of the
-``keystone`` CLI.  To do so requires the ``sql`` backend be enabled
-with ``KEYSTONE_CATALOG_BACKEND``:
-
-    ::
-
-        KEYSTONE_CATALOG_BACKEND=template
-
-DevStack's default configuration in ``sql`` mode is set in
-``lib/keystone``
-
-
 Guest Images
 ------------
 
diff --git a/files/default_catalog.templates b/files/default_catalog.templates
deleted file mode 100644
index 4aab4160c1..0000000000
--- a/files/default_catalog.templates
+++ /dev/null
@@ -1,63 +0,0 @@
-# config for TemplatedCatalog, using camelCase because I don't want to do
-# translations for legacy compat
-catalog.RegionOne.identity.publicURL = http://%SERVICE_HOST%:$(public_port)s/v2.0
-catalog.RegionOne.identity.adminURL = http://%SERVICE_HOST%:$(admin_port)s/v2.0
-catalog.RegionOne.identity.internalURL = http://%SERVICE_HOST%:$(public_port)s/v2.0
-catalog.RegionOne.identity.name = Identity Service
-
-
-catalog.RegionOne.compute.publicURL = http://%SERVICE_HOST%:8774/v2/$(tenant_id)s
-catalog.RegionOne.compute.adminURL = http://%SERVICE_HOST%:8774/v2/$(tenant_id)s
-catalog.RegionOne.compute.internalURL = http://%SERVICE_HOST%:8774/v2/$(tenant_id)s
-catalog.RegionOne.compute.name = Compute Service
-
-
-catalog.RegionOne.computev21.publicURL = http://%SERVICE_HOST%:8774/v2.1/$(tenant_id)s
-catalog.RegionOne.computev21.adminURL = http://%SERVICE_HOST%:8774/v2.1/$(tenant_id)s
-catalog.RegionOne.computev21.internalURL = http://%SERVICE_HOST%:8774/v2.1/$(tenant_id)s
-catalog.RegionOne.computev21.name = Compute Service V2.1
-
-
-catalog.RegionOne.volume.publicURL = http://%SERVICE_HOST%:8776/v1/$(tenant_id)s
-catalog.RegionOne.volume.adminURL = http://%SERVICE_HOST%:8776/v1/$(tenant_id)s
-catalog.RegionOne.volume.internalURL = http://%SERVICE_HOST%:8776/v1/$(tenant_id)s
-catalog.RegionOne.volume.name = Volume Service
-
-
-catalog.RegionOne.volumev2.publicURL = http://%SERVICE_HOST%:8776/v2/$(tenant_id)s
-catalog.RegionOne.volumev2.adminURL = http://%SERVICE_HOST%:8776/v2/$(tenant_id)s
-catalog.RegionOne.volumev2.internalURL = http://%SERVICE_HOST%:8776/v2/$(tenant_id)s
-catalog.RegionOne.volumev2.name = Volume Service V2
-
-
-catalog.RegionOne.ec2.publicURL = http://%SERVICE_HOST%:8773/
-catalog.RegionOne.ec2.adminURL = http://%SERVICE_HOST%:8773/
-catalog.RegionOne.ec2.internalURL = http://%SERVICE_HOST%:8773/
-catalog.RegionOne.ec2.name = EC2 Service
-
-
-catalog.RegionOne.s3.publicURL = http://%SERVICE_HOST%:%S3_SERVICE_PORT%
-catalog.RegionOne.s3.adminURL = http://%SERVICE_HOST%:%S3_SERVICE_PORT%
-catalog.RegionOne.s3.internalURL = http://%SERVICE_HOST%:%S3_SERVICE_PORT%
-catalog.RegionOne.s3.name = S3 Service
-
-
-catalog.RegionOne.image.publicURL = http://%SERVICE_HOST%:9292
-catalog.RegionOne.image.adminURL = http://%SERVICE_HOST%:9292
-catalog.RegionOne.image.internalURL = http://%SERVICE_HOST%:9292
-catalog.RegionOne.image.name = Image Service
-
-catalog.RegionOne.cloudformation.publicURL = http://%SERVICE_HOST%:8000/v1
-catalog.RegionOne.cloudformation.adminURL = http://%SERVICE_HOST%:8000/v1
-catalog.RegionOne.cloudformation.internalURL = http://%SERVICE_HOST%:8000/v1
-catalog.RegionOne.cloudformation.name = CloudFormation service
-
-catalog.RegionOne.orchestration.publicURL = http://%SERVICE_HOST%:8004/v1/$(tenant_id)s
-catalog.RegionOne.orchestration.adminURL = http://%SERVICE_HOST%:8004/v1/$(tenant_id)s
-catalog.RegionOne.orchestration.internalURL = http://%SERVICE_HOST%:8004/v1/$(tenant_id)s
-catalog.RegionOne.orchestration.name = Orchestration Service
-
-catalog.RegionOne.metering.publicURL = http://%SERVICE_HOST%:8777/v1
-catalog.RegionOne.metering.adminURL = http://%SERVICE_HOST%:8777/v1
-catalog.RegionOne.metering.internalURL = http://%SERVICE_HOST%:8777/v1
-catalog.RegionOne.metering.name = Telemetry Service
diff --git a/lib/cinder b/lib/cinder
index 3aea05023f..e1e1f2a893 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -369,20 +369,21 @@ function create_cinder_accounts {
 
         create_service_user "cinder"
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "cinder" "volume" "Cinder Volume Service"
-            get_or_create_endpoint "volume" "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
-
-            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-            get_or_create_endpoint "volumev2" "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
-        fi
+        get_or_create_service "cinder" "volume" "Cinder Volume Service"
+        get_or_create_endpoint \
+            "volume" \
+            "$REGION_NAME" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
+
+        get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+        get_or_create_endpoint \
+            "volumev2" \
+            "$REGION_NAME" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index fa93e6e658..c248611aef 100644
--- a/lib/glance
+++ b/lib/glance
@@ -244,15 +244,13 @@ function create_glance_accounts {
             get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
         fi
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "glance" "image" "Glance Image Service"
-            get_or_create_endpoint "image" \
-                "$REGION_NAME" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-        fi
+        get_or_create_service "glance" "image" "Glance Image Service"
+        get_or_create_endpoint \
+            "image" \
+            "$REGION_NAME" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
     fi
 }
 
diff --git a/lib/heat b/lib/heat
index df44b7689c..1bb753d788 100644
--- a/lib/heat
+++ b/lib/heat
@@ -387,23 +387,21 @@ function create_heat_accounts {
     if [[ "$HEAT_STANDALONE" != "True" ]]; then
 
         create_service_user "heat" "admin"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-            get_or_create_endpoint "orchestration" \
-                "$REGION_NAME" \
-                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
-
-            get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-            get_or_create_endpoint "cloudformation"  \
-                "$REGION_NAME" \
-                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
-        fi
+        get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
+        get_or_create_endpoint \
+            "orchestration" \
+            "$REGION_NAME" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
+
+        get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
+        get_or_create_endpoint \
+            "cloudformation"  \
+            "$REGION_NAME" \
+            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
+            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
+            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
 
         # heat_stack_user role is for users created by Heat
         get_or_create_role "heat_stack_user"
diff --git a/lib/keystone b/lib/keystone
index 38a0acf4ea..3c67693d96 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -52,13 +52,12 @@ KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 
+# NOTE(sdague): remove in Newton
+KEYSTONE_CATALOG_BACKEND="sql"
+
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
-# Select the Catalog backend driver
-KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
-KEYSTONE_CATALOG=$KEYSTONE_CONF_DIR/default_catalog.templates
-
 # Select the token persistence backend driver
 KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
 
@@ -254,39 +253,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF token driver "$KEYSTONE_TOKEN_BACKEND"
 
-    iniset $KEYSTONE_CONF catalog driver "$KEYSTONE_CATALOG_BACKEND"
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
-        # Configure ``keystone.conf`` to use sql
-        inicomment $KEYSTONE_CONF catalog template_file
-    else
-        deprecated "Using templated service catalog in devstack is deprecated"
-        cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
-
-        # Add swift endpoints to service catalog if swift is enabled
-        if is_service_enabled s-proxy; then
-            echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.name = Swift Service" >> $KEYSTONE_CATALOG
-        fi
-
-        # Add neutron endpoints to service catalog if neutron is enabled
-        if is_service_enabled neutron; then
-            echo "catalog.RegionOne.network.publicURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.network.adminURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.network.internalURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.network.name = Neutron Service" >> $KEYSTONE_CATALOG
-        fi
-
-        sed -e "
-            s,%SERVICE_HOST%,$SERVICE_HOST,g;
-            s,%S3_SERVICE_PORT%,$S3_SERVICE_PORT,g;
-        " -i $KEYSTONE_CATALOG
-
-        # Configure ``keystone.conf`` to use templates
-        iniset $KEYSTONE_CONF catalog template_file "$KEYSTONE_CATALOG"
-    fi
-
     # Set up logging
     if [ "$SYSLOG" != "False" ]; then
         iniset $KEYSTONE_CONF DEFAULT use_syslog "True"
@@ -588,7 +554,6 @@ function stop_keystone {
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
 # - ``IDENTITY_API_VERSION``
-# - ``KEYSTONE_CATALOG_BACKEND``
 # - ``KEYSTONE_AUTH_URI``
 # - ``REGION_NAME``
 # - ``KEYSTONE_SERVICE_PROTOCOL``
@@ -616,19 +581,17 @@ function bootstrap_keystone {
         --os-identity-api-version 3 --os-auth-url $KEYSTONE_AUTH_URI \
         --os-password $ADMIN_PASSWORD)
 
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        export OS_TOKEN=$token_id
-        export OS_URL=$KEYSTONE_AUTH_URI/v3
-        export OS_IDENTITY_API_VERSION=3
-
-        get_or_create_service "keystone" "identity" "Keystone Identity Service"
-        get_or_create_endpoint "identity" \
-            "$REGION_NAME" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
-    fi
+    export OS_TOKEN=$token_id
+    export OS_URL=$KEYSTONE_AUTH_URI/v3
+    export OS_IDENTITY_API_VERSION=3
+
+    get_or_create_service "keystone" "identity" "Keystone Identity Service"
+    get_or_create_endpoint \
+        "identity" \
+        "$REGION_NAME" \
+        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+        "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
 
     unset OS_TOKEN OS_URL OS_IDENTITY_API_VERSION
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73a1bcd0a3..9acc2203af 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -525,15 +525,13 @@ function create_neutron_accounts {
 
         create_service_user "neutron"
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "neutron" "network" "Neutron Service"
-            get_or_create_endpoint "network" \
-                "$REGION_NAME" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
-        fi
+        get_or_create_service "neutron" "network" "Neutron Service"
+        get_or_create_endpoint \
+            "network" \
+            "$REGION_NAME" \
+            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
+            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
+            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index dc425a19bd..17f64a7624 100644
--- a/lib/nova
+++ b/lib/nova
@@ -415,29 +415,28 @@ function create_nova_accounts {
         # this service user when notifying nova of changes and that requires the admin role.
         create_service_user "nova" "admin"
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            local nova_api_url
-            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
-                nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
-            else
-                nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
-            fi
-
-            get_or_create_service "nova_legacy" "compute_legacy" \
-                "Nova Compute Service (Legacy 2.0)"
-            get_or_create_endpoint "compute_legacy" \
-                "$REGION_NAME" \
-                "$nova_api_url/v2/\$(tenant_id)s" \
-                "$nova_api_url/v2/\$(tenant_id)s" \
-                "$nova_api_url/v2/\$(tenant_id)s"
-
-            get_or_create_service "nova" "compute" "Nova Compute Service"
-            get_or_create_endpoint "compute" \
-                "$REGION_NAME" \
-                "$nova_api_url/v2.1/\$(tenant_id)s" \
-                "$nova_api_url/v2.1/\$(tenant_id)s" \
-                "$nova_api_url/v2.1/\$(tenant_id)s"
+        local nova_api_url
+        if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
+            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
+        else
+            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
         fi
+
+        get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
+        get_or_create_endpoint \
+            "compute_legacy" \
+            "$REGION_NAME" \
+            "$nova_api_url/v2/\$(tenant_id)s" \
+            "$nova_api_url/v2/\$(tenant_id)s" \
+            "$nova_api_url/v2/\$(tenant_id)s"
+
+        get_or_create_service "nova" "compute" "Nova Compute Service"
+        get_or_create_endpoint \
+            "compute" \
+            "$REGION_NAME" \
+            "$nova_api_url/v2.1/\$(tenant_id)s" \
+            "$nova_api_url/v2.1/\$(tenant_id)s" \
+            "$nova_api_url/v2.1/\$(tenant_id)s"
     fi
 
     if is_service_enabled n-api; then
@@ -451,15 +450,13 @@ function create_nova_accounts {
 
     # S3
     if is_service_enabled swift3; then
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "s3" "s3" "S3"
-            get_or_create_endpoint "s3" \
-                "$REGION_NAME" \
-                "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
-                "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
-                "http://$SERVICE_HOST:$S3_SERVICE_PORT"
-        fi
+        get_or_create_service "s3" "s3" "S3"
+        get_or_create_endpoint \
+            "s3" \
+            "$REGION_NAME" \
+            "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
+            "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
+            "http://$SERVICE_HOST:$S3_SERVICE_PORT"
     fi
 }
 
diff --git a/lib/swift b/lib/swift
index 9edeb0ab79..947d2abdc0 100644
--- a/lib/swift
+++ b/lib/swift
@@ -612,8 +612,6 @@ function create_swift_accounts {
     export swiftusertest3_password=testing3
     export swiftusertest4_password=testing4
 
-    KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
-
     local another_role
     another_role=$(get_or_create_role "anotherrole")
 
@@ -621,15 +619,13 @@ function create_swift_accounts {
     # temp urls, which break when uploaded by a non-admin role
     create_service_user "swift" "admin"
 
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        get_or_create_service "swift" "object-store" "Swift Service"
-        get_or_create_endpoint "object-store" \
-            "$REGION_NAME" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
-    fi
+    get_or_create_service "swift" "object-store" "Swift Service"
+    get_or_create_endpoint \
+        "object-store" \
+        "$REGION_NAME" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
 
     local swift_tenant_test1
     swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)

From a6f3229eb02c409b2d875c9692e9d3b62e859f71 Mon Sep 17 00:00:00 2001
From: John Eckersberg <jeckersb@redhat.com>
Date: Fri, 5 Feb 2016 15:39:11 -0500
Subject: [PATCH 1170/3333] Re-add "redhat-rpm-config" dependency

This was removed in commit 19363fc1e79e70d390da0f4d0a19a5ef476b11d4 as
an unneeded F21 dependency, but due to missing dependencies as
described in the bug, /usr/lib/rpm/redhat/redhat-hardened-cc1 is
required and is provided by this package.

Change-Id: I2c0c3b0198d795d947fd77005fd7528de561dfcb
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index e0ef54cf9a..a0906e2587 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,6 +26,7 @@ postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
+redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 screen
 tar
 tcpdump

From 076ef7f0fbf43fd10cb30abbfdf93bb9402968a9 Mon Sep 17 00:00:00 2001
From: David Lyle <david.lyle@intel.com>
Date: Tue, 9 Feb 2016 11:01:04 -0700
Subject: [PATCH 1171/3333] Remove CUSTOM_THEME_PATH setting

Horizon now uses the WEBROOT to populate the value of $webroot in
the CSS code. The CUSTOM_THEME_PATH pointing to the webroot theme
to explicitly set the same value is no longer necessary.

Closes-Bug: 1540801
Change-Id: Ic212796ee0905751ac3fd619bbbc902d25ea10d5
---
 lib/horizon | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/horizon b/lib/horizon
index dca31116e2..abc1f6d16d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -89,7 +89,6 @@ function configure_horizon {
     cp $HORIZON_SETTINGS $local_settings
 
     _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
-    _horizon_config_set $local_settings "" CUSTOM_THEME_PATH \"themes/webroot\"
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"

From baa35d06e106a74365051bf26c56faf92ec92f88 Mon Sep 17 00:00:00 2001
From: "Cody A.W. Somerville" <cody.somerville@gmail.com>
Date: Thu, 11 Feb 2016 01:23:14 -0500
Subject: [PATCH 1172/3333] Add guide on running devstack in lxc container

Running OpenStack in a container can be a useful workflow for developers.
The primary benefits are faster performance and lower memory overhead
while still providing a suitable level of isolation.

The guide walks the user through procedure for configuring an LXC container
and deploying OpenStack in it using devstack. It also discusses the limitations
of this setup - particularly related to cinder.

Change-Id: I2e0921fd118cfe98cef86ba110a94b3edccf9a29
---
 doc/source/guides/lxc.rst | 164 ++++++++++++++++++++++++++++++++++++++
 doc/source/index.rst      |   8 ++
 2 files changed, 172 insertions(+)
 create mode 100644 doc/source/guides/lxc.rst

diff --git a/doc/source/guides/lxc.rst b/doc/source/guides/lxc.rst
new file mode 100644
index 0000000000..a719d605aa
--- /dev/null
+++ b/doc/source/guides/lxc.rst
@@ -0,0 +1,164 @@
+================================
+All-In-One Single LXC Container
+================================
+
+This guide walks you through the process of deploying OpenStack using devstack
+in an LXC container instead of a VM.
+
+The primary benefits to running devstack inside a container instead of a VM is
+faster performance and lower memory overhead while still providing a suitable
+level of isolation. This can be particularly useful when you want to simulate
+running OpenStack on multiple nodes.
+
+.. Warning:: Containers do not provide the same level of isolation as a virtual
+   machine.
+
+.. Note:: Not all OpenStack features support running inside of a container. See
+   `Limitations`_ section below for details. :doc:`OpenStack in a VM <single-vm>`
+   is recommended for beginners.
+
+Prerequisites
+==============
+
+This guide is written for Ubuntu 14.04 but should be adaptable for any modern
+Linux distribution.
+
+Install the LXC package::
+
+   sudo apt-get install lxc
+
+You can verify support for containerization features in your currently running
+kernel using the ``lxc-checkconfig`` command.
+
+Container Setup
+===============
+
+Configuration
+---------------
+
+For a successful run of ``stack.sh`` and to permit use of KVM to run the VMs you
+launch inside your container, we need to use the following additional
+configuration options. Place the following in a file called
+``devstack-lxc.conf``::
+
+  # Permit access to /dev/loop*
+  lxc.cgroup.devices.allow = b 7:* rwm
+  
+  # Setup access to /dev/net/tun and /dev/kvm
+  lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file 0 0
+  lxc.mount.entry = /dev/kvm dev/kvm none bind,create=file 0 0
+  
+  # Networking
+  lxc.network.type = veth
+  lxc.network.flags = up
+  lxc.network.link = lxcbr0
+
+
+Create Container
+-------------------
+
+The configuration and rootfs for LXC containers are created using the
+``lxc-create`` command.
+
+We will name our container ``devstack`` and use the ``ubuntu`` template which
+will use ``debootstrap`` to build a Ubuntu rootfs. It will default to the same
+release and architecture as the host system. We also install the additional
+packages ``bsdmainutils`` and ``git`` as we'll need them to run devstack::
+
+  sudo lxc-create -n devstack -t ubuntu -f devstack-lxc.conf -- --packages=bsdmainutils,git
+
+The first time it builds the rootfs will take a few minutes to download, unpack,
+and configure all the necessary packages for a minimal installation of Ubuntu.
+LXC will cache this and subsequent containers will only take seconds to create.
+
+.. Note:: To speed up the initial rootfs creation, you can specify a mirror to
+   download the Ubuntu packages from by appending ``--mirror=`` and then the URL
+   of a Ubuntu mirror. To see other other template options, you can run
+   ``lxc-create -t ubuntu -h``.
+
+Start Container
+----------------
+
+To start the container, run::
+
+  sudo lxc-start -n devstack
+
+A moment later you should be presented with the login prompt for your container.
+You can login using the username ``ubuntu`` and password ``ubuntu``.
+
+You can also ssh into your container. On your host, run
+``sudo lxc-info -n devstack`` to get the IP address (e.g. 
+``ssh ubuntu@$(sudo lxc-info -n p2 | awk '/IP/ { print $2 }')``).
+
+Run Devstack
+-------------
+
+You should now be logged into your container and almost ready to run devstack.
+The commands in this section should all be run inside your container.
+
+.. Tip:: You can greatly reduce the runtime of your initial devstack setup by
+   ensuring you have your apt sources.list configured to use a fast mirror.
+   Check and update ``/etc/apt/sources.list`` if necessary and then run 
+   ``apt-get update``.
+
+#. Download DevStack
+
+   ::
+
+       git clone https://git.openstack.org/openstack-dev/devstack
+
+#. Configure
+
+   Refer to :ref:`minimal-configuration` if you wish to configure the behaviour
+   of devstack.
+
+#. Start the install
+
+   ::
+
+       cd devstack
+       ./stack.sh
+
+Cleanup
+-------
+
+To stop the container::
+
+  lxc-stop -n devstack
+
+To delete the container::
+
+  lxc-destroy -n devstack
+
+Limitations
+============
+
+Not all OpenStack features may function correctly or at all when ran from within
+a container.
+
+Cinder
+-------
+
+Unable to create LVM backed volume
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+  In our configuration, we have not whitelisted access to device-mapper or LVM
+  devices. Doing so will permit your container to have access and control of LVM
+  on the host system. To enable, add the following to your
+  ``devstack-lxc.conf`` before running ``lxc-create``::
+
+    lxc.cgroup.devices.allow = c 10:236 rwm
+    lxc.cgroup.devices.allow = b 252:* rwm
+
+  Additionally you'll need to set ``udev_rules = 0`` in the ``activation``
+  section of ``/etc/lvm/lvm.conf`` unless you mount devtmpfs in your container.
+
+Unable to attach volume to instance
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+  It is not possible to attach cinder volumes to nova instances due to parts of
+  the Linux iSCSI implementation not being network namespace aware. This can be
+  worked around by using network pass-through instead of a separate network
+  namespace but such a setup significantly reduces the isolation of the
+  container (e.g. a ``halt`` command issued in the container will cause the host
+  system to shutdown).
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 4a1d93d817..3e324adefc 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -76,6 +76,7 @@ Walk through various setups used by stackers
 
    guides/single-vm
    guides/single-machine
+   guides/lxc
    guides/multinode-lab
    guides/neutron
    guides/devstack-with-nested-kvm
@@ -96,6 +97,13 @@ Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can inc
 server-class machine or a laptop at home.
 :doc:`[Read] <guides/single-machine>`
 
+All-In-One LXC Container
+-------------------------
+
+Run :doc:`OpenStack in a LXC container <guides/lxc>`. Beneficial for intermediate
+and advanced users. The VMs launched in this cloud will be fully accelerated but
+not all OpenStack features are supported. :doc:`[Read] <guides/lxc>`
+
 Multi-Node Lab
 --------------
 

From 629e56540f3dec14465bc88ef51c6974bac67f12 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 11 Feb 2016 11:31:56 +0000
Subject: [PATCH 1173/3333] Revert "reduce default lease time to 5 minutes"

We have a fix in Nova which should make this unessessary,
revert to see if that's true.

This reverts commit 61aa0e9f1968c9991dee7bb5aec9a2a63ac0339d.

Change-Id: If109af452ad583417e3a3a3ef1c9b545f1ec9b89
---
 lib/nova | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index df2b977274..6521cd7eba 100644
--- a/lib/nova
+++ b/lib/nova
@@ -689,8 +689,6 @@ function create_nova_conf_nova_network {
     iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
     iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
     iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
-    # force down dhcp leases to 5 minutes, which lets us expire faster
-    iniset $NOVA_CONF DEFAULT dhcp_lease_time 300
     if [ -n "$FLAT_INTERFACE" ]; then
         iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi

From 72f530fd7aa9b2029ad141ecfe9c2d62f87f72f3 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Tue, 9 Feb 2016 07:08:38 -0600
Subject: [PATCH 1174/3333] Set default properties for Power: virtual console
 and scsi driver

This patch enables the virtual console for Power systems /dev/hvc0
and sets scsi bus and virtio-scsi model as default.
The virtual console hvc0 enables full console including dmesg.
High performance virtio-scsi driver keeps the efficient design of
virtio-blk with effective SCSI passthrough.

Change-Id: I0b5cd4a15d30f06fc7993555d91d6907bd1acbd7
---
 functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 29d05187dd..8e9820cc4b 100644
--- a/functions
+++ b/functions
@@ -301,8 +301,8 @@ function upload_image {
         *) echo "Do not know what to do with $image_fname"; false;;
     esac
 
-    if is_arch "ppc64"; then
-        img_property="--property hw_cdrom_bus=scsi"
+    if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
+        img_property="--property hw_disk_bus=scsi --property hw_scsi_model=virtio-scsi --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then

From 72c34ee1aaddefe23b68ce2ae2d373356c283121 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Sat, 30 Jan 2016 16:18:01 +0100
Subject: [PATCH 1175/3333] worlddump: collect networking stack info from
 namespaces

Neutron hugely relies on namespaces, so we should try to dump
internal IP stack state for non-root network namespaces.

Change-Id: Ib980d22fbf3c6b680473754fa2b1684c2ef91b72
---
 tools/worlddump.py | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9d2b082f18..7f97931352 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -100,14 +100,24 @@ def iptables_dump():
         _dump_cmd("sudo iptables --line-numbers -L -nv -t %s" % table)
 
 
+def _netns_list():
+    process = subprocess.Popen(['ip', 'netns'], stdout=subprocess.PIPE)
+    stdout, _ = process.communicate()
+    return stdout.split()
+
+
 def network_dump():
     _header("Network Dump")
 
     _dump_cmd("brctl show")
     _dump_cmd("arp -n")
-    _dump_cmd("ip addr")
-    _dump_cmd("ip link")
-    _dump_cmd("ip route")
+    ip_cmds = ["addr", "link", "route"]
+    for cmd in ip_cmds + ['netns']:
+        _dump_cmd("ip %s" % cmd)
+    for netns_ in _netns_list():
+        for cmd in ip_cmds:
+            args = {'netns': netns_, 'cmd': cmd}
+            _dump_cmd('sudo ip netns exec %(netns)s ip %(cmd)s' % args)
 
 
 def process_list():

From 190b29d45e15fd7a0fddb89dbb304fb35554814e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 11 Feb 2016 13:42:21 +0100
Subject: [PATCH 1176/3333] worlddump: add empty newline after every command
 output

It makes it a bit easier to read the output since each new command is
now visually separated from the output of the previous one.

Change-Id: If441c61bb6f13f85f771dd31609b10d3dd1ee93c
---
 tools/worlddump.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9d2b082f18..d67f226464 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -56,6 +56,7 @@ def _dump_cmd(cmd):
     print
     try:
         subprocess.check_call(cmd, shell=True)
+        print
     except subprocess.CalledProcessError:
         print "*** Failed to run: %s" % cmd
 

From c1b7cb11171a55ba21ab4597977dea0ba6bc7b2d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 11 Feb 2016 13:50:46 +0100
Subject: [PATCH 1177/3333] worlddump: include Open vSwitch info

This may be useful when debugging neutron gate failures.

Change-Id: Iea3589456d2b05d233ba88523a5bd4ac114a0c86
---
 tools/worlddump.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9d2b082f18..83080110e2 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -110,6 +110,20 @@ def network_dump():
     _dump_cmd("ip route")
 
 
+def ovs_dump():
+    _header("Open vSwitch Dump")
+
+    # NOTE(ihrachys): worlddump is used outside of devstack context (f.e. in
+    # grenade), so there is no single place to determine the bridge names from.
+    # Hardcode for now.
+    bridges = ('br-int', 'br-tun', 'br-ex')
+    _dump_cmd("sudo ovs-vsctl show")
+    for bridge in bridges:
+        _dump_cmd("sudo ovs-ofctl show %s" % bridge)
+    for bridge in bridges:
+        _dump_cmd("sudo ovs-ofctl dump-flows %s" % bridge)
+
+
 def process_list():
     _header("Process Listing")
     _dump_cmd("ps axo "
@@ -147,6 +161,7 @@ def main():
         disk_space()
         process_list()
         network_dump()
+        ovs_dump()
         iptables_dump()
         ebtables_dump()
         compute_consoles()

From 86561c347d70c5124c139eb80fe1c0466e5a62f2 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Wed, 10 Feb 2016 18:37:21 -0700
Subject: [PATCH 1178/3333] Enable neutron-lib for LIBS_FROM_GIT for backwards
 compat jobs

Change-Id: I8dd84c59d2ec3a7c01ff4f1aaf7fa61d7466cfd5
---
 lib/neutron-legacy           | 7 +++++++
 stackrc                      | 5 +++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73a1bcd0a3..bd876e29a9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -623,6 +623,13 @@ function init_neutron {
 
 # install_neutron() - Collect source and prepare
 function install_neutron {
+    # Install neutron-lib from git so we make sure we're testing
+    # the latest code.
+    if use_library_from_git "neutron-lib"; then
+        git_clone_by_name "neutron-lib"
+        setup_dev_lib "neutron-lib"
+    fi
+
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
     if is_service_enabled q-fwaas; then
diff --git a/stackrc b/stackrc
index 2ba8398fce..7294f7b716 100644
--- a/stackrc
+++ b/stackrc
@@ -488,6 +488,11 @@ GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder
 GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-master}
 GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
+# neutron-lib library containing neutron stable non-REST interfaces
+GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git}
+GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-master}
+GITDIR["neutron-lib"]=$DEST/neutron-lib
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index d2a543ade0..ee11fd29a0 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -41,7 +41,7 @@ ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
-ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
+ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder"
 
 # Generate the above list with

From 728730aee3c03cfbe08678f95c851c60d523e52c Mon Sep 17 00:00:00 2001
From: Thomas Herve <therve@redhat.com>
Date: Fri, 12 Feb 2016 08:31:23 +0100
Subject: [PATCH 1179/3333] Enable heat caching

Enable use of memory cache by default for Heat. It will provide a boost
for various test builds and will help test this configuration.

Change-Id: I06183138d54c1cb971a58a158a15f3f5b25cba4d
---
 lib/heat | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/heat b/lib/heat
index 1bb753d788..41318787b3 100644
--- a/lib/heat
+++ b/lib/heat
@@ -196,6 +196,9 @@ function configure_heat {
         iniset $HEAT_CONF DEFAULT enable_stack_abandon true
     fi
 
+    iniset $HEAT_CONF cache enabled "True"
+    iniset $HEAT_CONF cache backend "dogpile.cache.memory"
+
     sudo install -d -o $STACK_USER $HEAT_ENV_DIR $HEAT_TEMPLATES_DIR
 
     # copy the default environment

From 326e480d2972191c89b9bae88c987ef12f648f93 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 12 Feb 2016 15:23:43 +0100
Subject: [PATCH 1180/3333] Documentation: nova-volume (n-vol) is long gone.

Long live cinder-volume (c-vol) !

Change-Id: I78257c0ef314e97e4abddf82b709fc496401cf14
---
 doc/source/faq.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7aca8d0b4a..cd4891519b 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -110,11 +110,11 @@ How do I turn off a service that is enabled by default?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Services can be turned off by adding ``disable_service xxx`` to
-``local.conf`` (using ``n-vol`` in this example):
+``local.conf`` (using ``c-vol`` in this example):
 
     ::
 
-        disable_service n-vol
+        disable_service c-vol
 
 Is enabling a service that defaults to off done with the reverse of the above?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

From 9bdd611dd25ccbc5ea0fcfd20157c2b7ef86b636 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephen.finucane@intel.com>
Date: Mon, 15 Feb 2016 14:12:06 +0000
Subject: [PATCH 1181/3333] lib/nova: Move 'novncproxy_host' to 'vnc' group

This option was moved in '11a42d4'. Move it, fixing the deprecation
warning in the process.

Change-Id: I567a04f6201695f1ca0d0919b1d1f769bad05964
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index cce538d3d7..1ed84495a3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
         iniset $NOVA_CONF vnc enabled true
         iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
-        iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
         iniset $NOVA_CONF vnc enabled false

From a03053660a3867b4f7622303c0499a6b79292cca Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 25 Jan 2016 13:38:27 -0600
Subject: [PATCH 1182/3333] Keystone deploy switch

Currently there's a boolean KEYSTONE_USE_MOD_WSGI to switch between
running keystone in mod_wsgi and eventlet. We've got a need to
support more/different deployment options (e.g., uwsgi), so a
boolean is inadequate.

A new input variable KEYSTONE_DEPLOY is introduced that can be
set to mod_wsgi or eventlet (and other values in future) to
control how keystone is deployed. KEYSTONE_USE_MOD_WSGI is
deprecated.

Change-Id: I9b2815e6f007309f088346df9ac48e6a24ae3656
---
 lib/keystone | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 3c67693d96..238a192932 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -56,8 +56,22 @@ KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 KEYSTONE_CATALOG_BACKEND="sql"
 
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
+# Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
+# KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
+# - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
+# - eventlet : Run keystone-all
+if [ -z "$KEYSTONE_DEPLOY" ]; then
+    if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
+        KEYSTONE_DEPLOY=mod_wsgi
+    elif [ "$KEYSTONE_USE_MOD_WSGI" == True ]; then
+        KEYSTONE_DEPLOY=mod_wsgi
+    else
+        KEYSTONE_DEPLOY=eventlet
+    fi
+fi
+
 # Select the token persistence backend driver
 KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
 
@@ -259,13 +273,13 @@ function configure_keystone {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_USE_MOD_WSGI" == "False" ]  ; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" == "eventlet" ]  ; then
         setup_colorized_logging $KEYSTONE_CONF DEFAULT
     fi
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
         iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
         iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
@@ -493,7 +507,7 @@ function install_keystone {
         setup_develop $KEYSTONE_DIR ldap
     fi
 
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         install_apache_wsgi
         if is_ssl_enabled_service "key"; then
             enable_mod_ssl
@@ -511,7 +525,7 @@ function start_keystone {
         auth_protocol="http"
     fi
 
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
         tail_log key /var/log/$APACHE_NAME/keystone.log
@@ -541,7 +555,7 @@ function start_keystone {
 
 # stop_keystone() - Stop running processes
 function stop_keystone {
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         disable_apache_site keystone
         restart_apache_server
     fi

From edc11c2f834e45dea9c9c0fcda21369d2afa30e2 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 14 Dec 2015 15:32:05 -0600
Subject: [PATCH 1183/3333] Keystone support deploy in uwsgi

Keystone is going to remove support for eventlet. Rather than only
have one way to run keystone (in Apache Httpd with mod_wsgi), we
should continue to gate on multiple wsgi containers to ensure that
keystone remains container-agnostic. The suggested alternative
container is uwsgi.

To run keystone in uwsgi rather than httpd or eventlet, set the
following env var in local.conf:

 KEYSTONE_DEPLOY=uwsgi

There's a lot of options to uwsgi. Here's some protips:
http://uwsgi-docs.readthedocs.org/en/latest/ThingsToKnow.html

Change-Id: If3b49879ce5181c16f0f0ab0db12fa55fe810a41
---
 functions-common |  7 +++--
 lib/keystone     | 72 ++++++++++++++++++++++++++++++++++++++++++------
 2 files changed, 68 insertions(+), 11 deletions(-)

diff --git a/functions-common b/functions-common
index ff9bc0f77f..d6c3bddc11 100644
--- a/functions-common
+++ b/functions-common
@@ -1428,14 +1428,17 @@ function run_process {
     local service=$1
     local command="$2"
     local group=$3
+    local subservice=$4
+
+    local name=${subservice:-$service}
 
     time_start "run_process"
     if is_service_enabled $service; then
         if [[ "$USE_SCREEN" = "True" ]]; then
-            screen_process "$service" "$command" "$group"
+            screen_process "$name" "$command" "$group"
         else
             # Spawn directly without screen
-            _run_process "$service" "$command" "$group" &
+            _run_process "$name" "$command" "$group" &
         fi
     fi
     time_stop "run_process"
diff --git a/lib/keystone b/lib/keystone
index 238a192932..7d5fd41f89 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -62,6 +62,7 @@ KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
 # - eventlet : Run keystone-all
+# - uwsgi : Run keystone under uwsgi
 if [ -z "$KEYSTONE_DEPLOY" ]; then
     if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
         KEYSTONE_DEPLOY=mod_wsgi
@@ -244,16 +245,15 @@ function configure_keystone {
     # Register SSL certificates if provided
     if is_ssl_enabled_service key; then
         ensure_certificates KEYSTONE
-
-        iniset $KEYSTONE_CONF eventlet_server_ssl enable True
-        iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
-        iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
     fi
 
+    local service_port=$KEYSTONE_SERVICE_PORT
+    local auth_port=$KEYSTONE_AUTH_PORT
+
     if is_service_enabled tls-proxy; then
         # Set the service ports for a proxy to take the originals
-        iniset $KEYSTONE_CONF eventlet_server public_port $KEYSTONE_SERVICE_PORT_INT
-        iniset $KEYSTONE_CONF eventlet_server admin_port $KEYSTONE_AUTH_PORT_INT
+        service_port=$KEYSTONE_SERVICE_PORT_INT
+        auth_port=$KEYSTONE_AUTH_PORT_INT
 
         iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
         iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
@@ -273,7 +273,7 @@ function configure_keystone {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" == "eventlet" ]  ; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" != "mod_wsgi" ] ; then
         setup_colorized_logging $KEYSTONE_CONF DEFAULT
     fi
 
@@ -285,7 +285,58 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
-    else
+    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+        # iniset creates these files when it's called if they don't exist.
+        KEYSTONE_PUBLIC_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
+        KEYSTONE_ADMIN_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
+
+        rm -f "$KEYSTONE_PUBLIC_UWSGI_FILE"
+        rm -f "$KEYSTONE_ADMIN_UWSGI_FILE"
+
+        if is_ssl_enabled_service key; then
+            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi https $KEYSTONE_SERVICE_HOST:$service_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
+            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi https $KEYSTONE_ADMIN_BIND_HOST:$auth_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
+        else
+            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi http $KEYSTONE_SERVICE_HOST:$service_port
+            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi http $KEYSTONE_ADMIN_BIND_HOST:$auth_port
+        fi
+
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
+        # This is running standalone
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi master true
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi enable-threads true
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python
+        # uwsgi recommends this to prevent thundering herd on accept.
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi thunder-lock true
+        # Override the default size for headers from the 4k default.
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi buffer-size 65535
+        # Make sure the client doesn't try to re-use the connection.
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi add-header "Connection: close"
+
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
+        # This is running standalone
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi master true
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi enable-threads true
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi plugins python
+        # uwsgi recommends this to prevent thundering herd on accept.
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi thunder-lock true
+        # Override the default size for headers from the 4k default.
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi buffer-size 65535
+        # Make sure the client doesn't try to re-use the connection.
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi add-header "Connection: close"
+
+    else # eventlet
+        if is_ssl_enabled_service key; then
+            iniset $KEYSTONE_CONF eventlet_server_ssl enable True
+            iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
+            iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
+        fi
+
+        iniset $KEYSTONE_CONF eventlet_server public_port $service_port
+        iniset $KEYSTONE_CONF eventlet_server admin_port $auth_port
+
         iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
         iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
         # Public workers will use the server default, typically number of CPU.
@@ -530,7 +581,10 @@ function start_keystone {
         restart_apache_server
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
-    else
+    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+        run_process key "uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
+        run_process key "uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
+    else # eventlet
         # Start Keystone in a screen window
         run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"
     fi

From ed92e43178b4f910adc038d1b0b6788e21513f32 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Feb 2016 10:56:56 +1100
Subject: [PATCH 1184/3333] Add some notes on DISTRO setting

It was pointed out in I42599c1bd851d2b61a56a3960f42ad051aab1727 that
after I46a2c36d95327087085df07cb797eb91249a893c we now die if we can't
determine DISTRO, rather than take a guess.

After some consideration, I don't consider this a regression.  This
default matching was basically only working for LinuxMint, because we
already have some matching there for setting os_PACKAGE that makes us
know the platform is Ubuntu-ish.

However, I would certainly agree it is not particularly clear as to
why.  This just adds some comments explaining why we can not just add
a default DISTRO fall-through and directs implementors on how to add
support for their platform.

Change-Id: I4b07259be1427d86a7154906646073d08dd07294
---
 functions-common | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index ff9bc0f77f..c11ba33183 100644
--- a/functions-common
+++ b/functions-common
@@ -388,7 +388,26 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
         DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
-        die $LINENO "Unable to determine DISTRO"
+        # We can't make a good choice here.  Setting a sensible DISTRO
+        # is part of the problem, but not the major issue -- we really
+        # only use DISTRO in the code as a fine-filter.
+        #
+        # The bigger problem is categorising the system into one of
+        # our two big categories as Ubuntu/Debian-ish or
+        # Fedora/CentOS-ish.
+        #
+        # The setting of os_PACKAGE above is only set to "deb" based
+        # on a hard-coded list of vendor names ... thus we will
+        # default to thinking unknown distros are RPM based
+        # (ie. is_ubuntu does not match).  But the platform will then
+        # also not match in is_fedora, because that also has a list of
+        # names.
+        #
+        # So, if you are reading this, getting your distro supported
+        # is really about making sure it matches correctly in these
+        # functions.  Then you can choose a sensible way to construct
+        # DISTRO based on your distros release approach.
+        die $LINENO "Unable to determine DISTRO, can not continue."
     fi
     typeset -xr DISTRO
 }

From 96006658bedbdfa98e4d0685852f057aeb2ae1a6 Mon Sep 17 00:00:00 2001
From: ptoohill1 <phillip.toohill@rackspace.com>
Date: Mon, 15 Feb 2016 16:07:50 -0600
Subject: [PATCH 1185/3333] Add LinuxMint to distro check

Adds LinuxMint to the distro checking. This allows linux mint with
the FORCE option to run. This will not fix for other distros that
do not pass the checks.

Change-Id: I42599c1bd851d2b61a56a3960f42ad051aab1727
Closes-Bug: #1545864
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index ff9bc0f77f..80bdbeaa57 100644
--- a/functions-common
+++ b/functions-common
@@ -365,8 +365,9 @@ declare DISTRO
 
 function GetDistro {
     GetOSVersion
-    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) ]]; then
-        # 'Everyone' refers to Ubuntu / Debian releases by
+    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) || \
+            "$os_VENDOR" =~ (LinuxMint) ]]; then
+        # 'Everyone' refers to Ubuntu / Debian / Mint releases by
         # the code name adjective
         DISTRO=$os_CODENAME
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then

From 76d05400ec64fc4f177f9dc9ad8d821fceae5e05 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Feb 2016 14:35:51 +1100
Subject: [PATCH 1186/3333] Update to bashate 0.4.0

Update to bashate 0.4.0.  The biggest change in this is that bashate
does a syntax check with "bash -n" which can be useful

Change-Id: Iff625ef2181dfaba28349dc17de0749faddec539
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index f9d04f2dcd..efffbd5d99 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,7 +9,7 @@ install_command = pip install {opts} {packages}
 
 [testenv:bashate]
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
+   {env:BASHATE_INSTALL_PATH:bashate==0.4.0}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \

From 7ae97298c55d9ba21d2dc037cc7d9fae54afa183 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Feb 2016 14:50:53 +1100
Subject: [PATCH 1187/3333] Minor fixes for bashate trunk

We don't have a new bashate release yet, but this fixes some minor
issues when used with bashate trunk.

The only two things triggered are stricter checking of assignment in
local declartions (catches quotes) and one instance of evaluating
arithmetic result in tools/xen/functions.

Therefore, hopefully, this change has no effect!

Change-Id: I3fd5d55236e90c2f2c25243af87adaf0c1b763e2
---
 functions           | 13 +++++++++----
 functions-common    |  2 +-
 inc/ini-config      |  3 ++-
 lib/neutron-legacy  |  5 ++++-
 tools/xen/functions | 16 +++++++++-------
 tox.ini             |  3 +++
 6 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/functions b/functions
index 29d05187dd..42c5c1dacb 100644
--- a/functions
+++ b/functions
@@ -94,12 +94,14 @@ function upload_image {
         local path_len
 
         # vmdk adapter type
-        local vmdk_adapter_type="$(head -25 $image | { grep -a -F -m 1 'ddb.adapterType =' $image || true; })"
+        local vmdk_adapter_type
+        vmdk_adapter_type="$(head -25 $image | { grep -a -F -m 1 'ddb.adapterType =' $image || true; })"
         vmdk_adapter_type="${vmdk_adapter_type#*\"}"
         vmdk_adapter_type="${vmdk_adapter_type%?}"
 
         # vmdk disk type
-        local vmdk_create_type="$(head -25 $image | { grep -a -F -m 1 'createType=' $image || true; })"
+        local vmdk_create_type
+        vmdk_create_type="$(head -25 $image | { grep -a -F -m 1 'createType=' $image || true; })"
         vmdk_create_type="${vmdk_create_type#*\"}"
         vmdk_create_type="${vmdk_create_type%\"*}"
 
@@ -109,7 +111,8 @@ function upload_image {
             vmdk_disktype="sparse"
         elif [[ "$vmdk_create_type" = "monolithicFlat" || "$vmdk_create_type" = "vmfs" ]]; then
             # Attempt to retrieve the ``*-flat.vmdk``
-            local flat_fname="$(head -25 $image | { grep -G 'RW\|RDONLY [0-9]+ FLAT\|VMFS' $image || true; })"
+            local flat_fname
+            flat_fname="$(head -25 $image | { grep -G 'RW\|RDONLY [0-9]+ FLAT\|VMFS' $image || true; })"
             flat_fname="${flat_fname#*\"}"
             flat_fname="${flat_fname%?}"
             if [[ -z "$flat_fname" ]]; then
@@ -407,8 +410,10 @@ function ping_check {
 function get_instance_ip {
     local vm_id=$1
     local network_name=$2
-    local nova_result="$(nova show $vm_id)"
+    local nova_result
     local ip
+
+    nova_result="$(nova show $vm_id)"
     ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
     if [[ $ip = "" ]];then
         echo "$nova_result"
diff --git a/functions-common b/functions-common
index ff9bc0f77f..f84301f4b1 100644
--- a/functions-common
+++ b/functions-common
@@ -1211,7 +1211,7 @@ function get_plugin_packages {
     local files_to_parse=""
     local package_dir=""
     for plugin in ${DEVSTACK_PLUGINS//,/ }; do
-        local package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
+        package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
         files_to_parse+=" $package_dir/$plugin"
     done
     echo "$(_parse_package_files $files_to_parse)"
diff --git a/inc/ini-config b/inc/ini-config
index e99b088994..1f12343ae0 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -30,7 +30,8 @@ function iniadd {
     local option=$3
     shift 3
 
-    local values="$(iniget_multiline $file $section $option) $@"
+    local values
+    values="$(iniget_multiline $file $section $option) $@"
     iniset_multiline $sudo $file $section $option $values
     $xtrace
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d0523f4f0a..7975570691 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -689,9 +689,12 @@ function install_neutron_agent_packages {
 
 # Start running processes, including screen
 function start_neutron_service_and_check {
-    local cfg_file_options="$(determine_config_files neutron-server)"
     local service_port=$Q_PORT
     local service_protocol=$Q_PROTOCOL
+    local cfg_file_options
+
+    cfg_file_options="$(determine_config_files neutron-server)"
+
     if is_service_enabled tls-proxy; then
         service_port=$Q_PORT_INT
         service_protocol="http"
diff --git a/tools/xen/functions b/tools/xen/functions
index 8c674dcce3..cf145686b5 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -23,9 +23,10 @@ function create_directory_for_kernels {
     if [ -d "/boot/guest" ]; then
         echo "INFO: /boot/guest directory already exists, using that" >&2
     else
-        local LOCALPATH="$(get_local_sr_path)/os-guest-kernels"
-        mkdir -p $LOCALPATH
-        ln -s $LOCALPATH /boot/guest
+        local local_path
+        local_path="$(get_local_sr_path)/os-guest-kernels"
+        mkdir -p $local_path
+        ln -s $local_path /boot/guest
     fi
 }
 
@@ -33,9 +34,10 @@ function create_directory_for_images {
     if [ -d "/images" ]; then
         echo "INFO: /images directory already exists, using that" >&2
     else
-        local LOCALPATH="$(get_local_sr_path)/os-images"
-        mkdir -p $LOCALPATH
-        ln -s $LOCALPATH /images
+        local local_path
+        local_path="$(get_local_sr_path)/os-images"
+        mkdir -p $local_path
+        ln -s $local_path /images
     fi
 }
 
@@ -73,7 +75,7 @@ function find_ip_by_name {
 
         if [ -z "$ipaddress" ]; then
             sleep $period
-            ((i++))
+            i=$((i+1))
         else
             echo $ipaddress
             break
diff --git a/tox.ini b/tox.ini
index f9d04f2dcd..bdfd29dd14 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,6 +8,9 @@ usedevelop = False
 install_command = pip install {opts} {packages}
 
 [testenv:bashate]
+# if you want to test out some changes you have made to bashate
+# against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
+# modified bashate tree
 deps =
    {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
 whitelist_externals = bash

From a15d9de92f724baebea0c202b14c2220df68e2a9 Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Tue, 19 Jan 2016 19:11:51 +0800
Subject: [PATCH 1188/3333] Kill radvd when stopping neutron-l3 service

When stopping neutron-l3 service, radvd should be
stopped.

Change-Id: I46416c1df3a4da66e863a16baeb73886e110d447
Closes-Bug: #1535661
---
 lib/neutron-legacy | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9497a23595..a1489714a0 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -764,7 +764,11 @@ function stop_neutron_other {
     fi
 
     stop_process q-svc
-    stop_process q-l3
+
+    if is_service_enabled q-l3; then
+        sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
+        stop_process q-l3
+    fi
 
     if is_service_enabled q-meta; then
         sudo pkill -9 -f neutron-ns-metadata-proxy || :

From bae609ef6fe46e70ae48a7647861123cbb16661f Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 24 Nov 2015 17:02:12 +0100
Subject: [PATCH 1189/3333] lib/tempest: Post juno-eol cleanup

There's no need to change these Tempest's default anymore.
The feature flags are left in Tempest so that downstream distros can
continue to use Tempest to test Juno.

Change-Id: I99f286d0febb1675b8feb91b6801ad0b159da332
---
 lib/tempest | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index e90ff93c8a..b7094ab8b2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -450,10 +450,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
-    # TODO(dkranz): Remove the bootable flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled bootable True
-    # TODO(jordanP): Remove the extend_with_snapshot flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
     # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.

From 14a7148f41f859c0b42641596d7d9f2c0fa295ef Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 17 Feb 2016 02:23:47 +0000
Subject: [PATCH 1190/3333] Revert "Fix stack failure when default subnetpool
 is set"

This reverts commit 8a3b7d424d8edf53d0560db48247e6bca11176ee.

This change masked a non-backward compatible change made to the
Neutron core API. This is being cleaned up and thus this workaround
is no longer required.

Depends-on: Idf516ed9db24d779742cdff0584b48182a8502d6

Change-Id: I6695a6e17df1a395ada4ecf2b063b2c20870d99d
---
 exercises/neutron-adv-test.sh | 2 +-
 lib/neutron-legacy            | 8 ++------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 9bcb7669b7..a8fbd86473 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -235,7 +235,7 @@ function create_network {
     local NET_ID
     NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
+    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d0523f4f0a..3ed5754de7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -551,12 +551,12 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY --subnetpool None $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME --subnetpool None $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
@@ -1262,7 +1262,6 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
     subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1279,7 +1278,6 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1293,7 +1291,6 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local id_and_ext_gw_ip
@@ -1307,7 +1304,6 @@ function _neutron_create_public_subnet_v6 {
     local subnet_params="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local ipv6_id_and_ext_gw_ip

From 33df895ffb042832057222432234172d6db18810 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 17 Feb 2016 15:26:33 +0100
Subject: [PATCH 1191/3333] Tox: don't check stack-screenrc with bashate

Change-Id: I8f04de2cde8a123c3825e7ba22aef1f5b311f61c
Closes-Bug: #1531885
---
 tox.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tox.ini b/tox.ini
index f9d04f2dcd..07e8a8faab 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,6 +18,7 @@ commands = bash -c "find {toxinidir}             \
          -type f                                 \
          -not -name \*~                          \
          -not -name \*.md                        \
+         -not -name stack-screenrc               \
          \(                                      \
           -name \*.sh -or                        \
           -name \*.orig -or                      \

From 8040e69a049731216efcdc3497b78391f7bc2a31 Mon Sep 17 00:00:00 2001
From: Mike Chester <mchester@siaras.com>
Date: Wed, 17 Feb 2016 10:52:33 -0800
Subject: [PATCH 1192/3333] Check UNSTACK_ALL or -a flag set on unstack

These flags were not functioning as described. Check if UNSTACK_ALL is
set in env or -a flag is set when calling script.

Change-Id: I128d32b1e74ee46e24a9eb2e81560e58137b1553
Closes-Bug: #1546687
---
 unstack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index d69e3f5213..d7670e38a5 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -9,12 +9,12 @@
 # Stop all processes by setting ``UNSTACK_ALL`` or specifying ``-a``
 # on the command line
 
-UNSTACK_ALL=""
+UNSTACK_ALL=${UNSTACK_ALL:-""}
 
 while getopts ":a" opt; do
     case $opt in
         a)
-            UNSTACK_ALL=""
+            UNSTACK_ALL="-1"
             ;;
     esac
 done

From 8a4dea24faa51e79507aa3f1655cea46a382e95d Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 18 Feb 2016 15:52:22 +0000
Subject: [PATCH 1193/3333] Ironic: Update is_ironic_hardware function

The DevStack module of Ironic added a new configuration variable called
IRONIC_IS_HARDWARE that can be set to True/False to indicate that we are
setting up devstack to deploy physical or virtual machines (see the
depends flag). Prior to that, the devstack code assumed that if the
driver name loaded is != *_ssh then it's a physical hardware but now we
need to kill this assumption because we have means (see the virtualbmc
utility) to test drivers such as pxe_ipmitool and agent_ipmitool using
virtual machines.

Depends-On: I5edc51c7fc8b6f0bb7fe4ca129596709a32eb93e
Related-Bug: #1544642
Change-Id: I8b6363bbe280ddd2720c570851bc40e2804a40e2
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 8e5285394c..ba697f8ad0 100644
--- a/functions-common
+++ b/functions-common
@@ -994,7 +994,7 @@ function get_endpoint_url {
 # out of tree, as it is used by nova and neutron.
 # figure out a way to refactor nova/neutron code to eliminate this
 function is_ironic_hardware {
-    is_service_enabled ironic && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
+    is_service_enabled ironic && [[ "$IRONIC_IS_HARDWARE" == "True" ]] && return 0
     return 1
 }
 

From b9201ccbbff301fea18fae56696b59bb7f68189d Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 18 Feb 2016 15:50:01 -0500
Subject: [PATCH 1194/3333] fix postgres service name

in fedora postgresql is the service name and postgresql-server is
the package.[1]

os: Fedora release 23 (Twenty Three)
psql: psql (PostgreSQL) 9.4.5

i'm not entirely sure when this changed, but it's devstack is broken
in above environment.

[1]https://fedoraproject.org/wiki/PostgreSQL

Change-Id: Id940fed2a777ca469ce77402e1136251ba572359
---
 lib/databases/postgresql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 204c257a67..852bac4906 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -102,7 +102,7 @@ EOF
     elif is_fedora || is_suse; then
         install_package postgresql-server
         if is_fedora; then
-            sudo systemctl enable postgresql-server
+            sudo systemctl enable postgresql
         fi
     else
         exit_distro_not_supported "postgresql installation"

From e3e805186476018b988f68f3ef3dfaccbf3c0f20 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Thu, 18 Feb 2016 14:46:35 -0500
Subject: [PATCH 1195/3333] Generate plugins list through https requests

The devstack plugins list can be generated through web requests in
environments (such as the proposal slave) that lack copies of all
the relevant git repositories.

One downside to this is that there is no way of getting the last
modification time of the plugin.

Change-Id: I2c5c9282a8ad80014cad171a4dfbdc8f26044cd1
---
 data/devstack-plugins-registry.header   |  6 +--
 tools/generate-devstack-plugins-list.py | 59 +++++++++++++++++++++++++
 tools/generate-devstack-plugins-list.sh | 59 +++++++++++++++++--------
 3 files changed, 102 insertions(+), 22 deletions(-)
 create mode 100644 tools/generate-devstack-plugins-list.py

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 9f8a99471c..687db0441c 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -14,6 +14,6 @@ The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
 
-+------------------+------------------------------------------------------------+------------+
-|Plugin Name       |URL                                                         |Date        |
-+------------------+------------------------------------------------------------+------------+
++------------------+-------------------------------------------------------------------------+
+|Plugin Name       |URL                                                                      |
++------------------+-------------------------------------------------------------------------+
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
new file mode 100644
index 0000000000..1fa550192e
--- /dev/null
+++ b/tools/generate-devstack-plugins-list.py
@@ -0,0 +1,59 @@
+#! /usr/bin/env python
+
+# Copyright 2016 Hewlett Packard Enterprise Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This script is intended to be run as part of a periodic proposal bot
+# job in OpenStack infrastructure.
+#
+# In order to function correctly, the environment in which the
+# script runs must have
+#   * network access to the review.openstack.org Gerrit API
+#     working directory
+#   * network access to https://git.openstack.org/cgit
+
+import json
+import requests
+
+url = 'https://review.openstack.org/projects/'
+
+# This is what a project looks like
+'''
+  "openstack-attic/akanda": {
+    "id": "openstack-attic%2Fakanda",
+    "state": "READ_ONLY"
+  },
+'''
+
+def is_in_openstack_namespace(proj):
+    return proj.startswith('openstack/')
+
+# Rather than returning a 404 for a nonexistent file, cgit delivers a
+# 0-byte response to a GET request.  It also does not provide a
+# Content-Length in a HEAD response, so the way we tell if a file exists
+# is to check the length of the entire GET response body.
+def has_devstack_plugin(proj):
+    r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
+    if len(r.text) > 0:
+        return True
+    else:
+        False
+
+r = requests.get(url)
+projects = sorted(filter(is_in_openstack_namespace, json.loads(r.text[4:])))
+
+found_plugins = filter(has_devstack_plugin, projects)
+
+for project in found_plugins:
+    print project[10:]
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 6e9e828978..01767854d7 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -19,11 +19,19 @@
 #
 # In order to function correctly, the environment in which the
 # script runs must have
+#   * a writable doc/source directory relative to the current
+#     working directory
+#   AND ( (
 #   * git
 #   * all git repos meant to be searched for plugins cloned and
 #     at the desired level of up-to-datedness
-#   * a writable doc/source directory relative to the current
+#   * the environment variable git_dir pointing to the location
+#   * of said git repositories
+#   ) OR (
+#   * network access to the review.openstack.org Gerrit API
 #     working directory
+#   * network access to https://git.openstack.org/cgit
+#   ))
 #
 # If a file named data/devstack-plugins-registry.header or
 # data/devstack-plugins-registry.footer is found relative to the
@@ -35,25 +43,38 @@ declare -A plugins
 
 test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
 
-pushd ${git_dir:-/opt/openstack} >/dev/null
-for i in *; do
-    pushd ${i} >/dev/null
-    if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
-        test -n "$output" && plugins[$i]=${output}
-    fi
+if test -n "$git_dir"; then
+    pushd ${git_dir} >/dev/null
+    for i in *; do
+        pushd ${i} >/dev/null
+        if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
+            test -n "$output" && plugins[$i]=${output}
+        fi
+        popd >/dev/null
+    done
     popd >/dev/null
-done
-popd >/dev/null
-
-sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
-
-for k in "${sorted_plugins[@]}"; do
-    project=${k:0:18}
-    giturl="git://git.openstack.org/openstack/${k:0:26}"
-    pdate="${plugins[$k]}"
-    printf "|%-18s|%-60s|%-12s|\n" "${project}" "${giturl}" "${pdate}"
-    printf "+------------------+------------------------------------------------------------+------------+\n"
-done
+
+    sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
+
+    for k in "${sorted_plugins[@]}"; do
+        project=${k:0:18}
+        giturl="git://git.openstack.org/openstack/${k:0:26}"
+        pdate="${plugins[$k]}"
+        printf "|%-18s|%-60s (%-10s)|\n" "${project}" "${giturl}" "${pdate}"
+        printf "+------------------+-------------------------------------------------------------------------+\n"
+    done
+
+else
+    sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
+
+    for k in ${sorted_plugins}; do
+        project=${k:0:18}
+        giturl="git://git.openstack.org/openstack/${k:0:26}"
+        printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
+        printf "+------------------+-------------------------------------------------------------------------+\n"
+    done
+
+fi
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
 ) > doc/source/plugin-registry.rst

From 1ff75ff87fc2a46d1f88918d94be48e5d59e3aab Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 19 Feb 2016 14:28:37 +1100
Subject: [PATCH 1196/3333] Always strip package comments

In the "I can't believe I missed this" category -- the existing strip
method removes shortest match (%); which fails when you put another #
in the comment (like "refer to bug#1234").  Change to the longest
match which should strip everything from the first "#" to the end
(since that's going to be the longest).

Change-Id: I47f5e710ebd87b0f54549732e7d64cf42c7a6b65
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 8e5285394c..ed444bbd41 100644
--- a/functions-common
+++ b/functions-common
@@ -1096,8 +1096,9 @@ function _parse_package_files {
                 continue
             fi
 
-            # Assume we want this package
-            package=${line%#*}
+            # Assume we want this package; free-form
+            # comments allowed after a #
+            package=${line%%#*}
             inst_pkg=1
 
             # Look for # dist:xxx in comment

From 7dbcfae7033a244e0ebeaa8e116f1c9364c23d48 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Fri, 19 Feb 2016 14:43:42 -0800
Subject: [PATCH 1197/3333] Provision deployment requirements for
 get-me-a-network

Neutron implemented an extension to allow users to automatically
provision a basic network topology to connect their instances.

One of the requirements for this feature is to be able to mark
an external network to be the one to be used for external
connectivity. Another requirement is subnetpools, which are
used to determine the IP space to allocate for private tenant
networks.

This patch codifies these requirements. The provisioning
needs to be  made conditional  based on the extensions
needed for this to work correctly.

Partially-implements: blueprint get-me-a-network

Change-Id: I43ce5d65e754f131f7ca1ce2088a397d266cf821
---
 lib/neutron-legacy | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 539b9ff551..56a9bdf229 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -73,6 +73,16 @@ PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
 PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
+# Subnetpool defaults
+SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
+
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/24}
+SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
+
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
+SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
+
+
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
@@ -580,6 +590,8 @@ function create_neutron_initial_network {
         fi
     fi
 
+    AUTO_ALLOCATE_EXT=$(neutron ext-list | grep 'auto-allocated-topology' | get_field 1)
+    SUBNETPOOL_EXT=$(neutron ext-list | grep 'subnet_allocation' | get_field 1)
     if [[ "$Q_L3_ENABLED" == "True" ]]; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
@@ -592,11 +604,23 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
+        # if the extension is available, then mark the external
+        # network as default, and provision default subnetpools
+        EXTERNAL_NETWORK_FLAGS="--router:external"
+        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
+            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
+            if [[ "$IP_VERSION" =~ 4.* ]]; then
+                SUBNETPOOL_V4_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+            if [[ "$IP_VERSION" =~ .*6 ]]; then
+                SUBNETPOOL_V6_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+        fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 

From 2688eedc51fc7b4ef0a5332c1aafce8a557928da Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 13 Jan 2016 23:01:39 +0900
Subject: [PATCH 1198/3333] Remove Neutron VMware NSX plugin files completely

override-defaults mechanism allows us to define
s_neutron_plugin_security_group before loading lib/neutron,
and we no longer need to have a plugin-specific file in
the master DevStack repository.

Change-Id: Ib0f6e3d9463357d2dd66a2d61b8c722fa1f0bfba
Depends-On: I8b19b8f1b0694a96132f158146848aee7d14e8ff
---
 lib/neutron_plugins/vmware_dvs    | 10 ----------
 lib/neutron_plugins/vmware_nsx    | 10 ----------
 lib/neutron_plugins/vmware_nsx_v  | 10 ----------
 lib/neutron_plugins/vmware_nsx_v3 | 10 ----------
 4 files changed, 40 deletions(-)
 delete mode 100644 lib/neutron_plugins/vmware_dvs
 delete mode 100644 lib/neutron_plugins/vmware_nsx
 delete mode 100644 lib/neutron_plugins/vmware_nsx_v
 delete mode 100644 lib/neutron_plugins/vmware_nsx_v3

diff --git a/lib/neutron_plugins/vmware_dvs b/lib/neutron_plugins/vmware_dvs
deleted file mode 100644
index 587d5a6b11..0000000000
--- a/lib/neutron_plugins/vmware_dvs
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=vmware_dvs will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
diff --git a/lib/neutron_plugins/vmware_nsx b/lib/neutron_plugins/vmware_nsx
deleted file mode 100644
index b6c1c9c13f..0000000000
--- a/lib/neutron_plugins/vmware_nsx
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=vmware_nsx will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
diff --git a/lib/neutron_plugins/vmware_nsx_v b/lib/neutron_plugins/vmware_nsx_v
deleted file mode 100644
index 3d33c652d1..0000000000
--- a/lib/neutron_plugins/vmware_nsx_v
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-#
-# This file is needed so Q_PLUGIN=vmware_nsx_v will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
diff --git a/lib/neutron_plugins/vmware_nsx_v3 b/lib/neutron_plugins/vmware_nsx_v3
deleted file mode 100644
index 6d8a6e6b70..0000000000
--- a/lib/neutron_plugins/vmware_nsx_v3
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=vmware_nsx_v3 will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}

From 7580a0c3e37932a8fc03750d35ccd4e13e18f8c4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 17 Feb 2016 06:23:36 -0500
Subject: [PATCH 1199/3333] Replace TENANT => PROJECT phase 1

This replaces the use of TENANT variables with PROJECT ones during the
initial setup. The openrc will still export a OS_TENANT_NAME because
many tools (cinderclient, glanceclient amoung them) will not function
without it. We warn when we do that.

Change-Id: I824b1121842eb5821034071874bf1bb2d7c3631e
---
 exercises/boot_from_volume.sh |   2 +-
 exercises/client-args.sh      |  16 ++--
 exercises/neutron-adv-test.sh | 142 +++++++++++++++++-----------------
 lib/cinder                    |   2 +-
 lib/glance                    |  12 +--
 lib/keystone                  |   8 +-
 lib/neutron-legacy            |   4 +-
 lib/nova                      |   6 +-
 lib/swift                     |   4 +-
 openrc                        |  26 ++++---
 stack.sh                      |   2 +-
 11 files changed, 114 insertions(+), 110 deletions(-)

diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index d520b9bbbf..54098594ff 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -64,7 +64,7 @@ VOL_NAME=${VOL_NAME:-ex-vol-bfv}
 # Launching a server
 # ==================
 
-# List servers for tenant:
+# List servers for project:
 nova list
 
 # Images
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 7cfef1c807..07ce5284e8 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -43,19 +43,19 @@ unset NOVA_URL
 unset NOVA_USERNAME
 
 # Save the known variables for later
-export x_TENANT_NAME=$OS_TENANT_NAME
+export x_PROJECT_NAME=$OS_PROJECT_NAME
 export x_USERNAME=$OS_USERNAME
 export x_PASSWORD=$OS_PASSWORD
 export x_AUTH_URL=$OS_AUTH_URL
 
 # Unset the usual variables to force argument processing
-unset OS_TENANT_NAME
+unset OS_PROJECT_NAME
 unset OS_USERNAME
 unset OS_PASSWORD
 unset OS_AUTH_URL
 
 # Common authentication args
-TENANT_ARG="--os-tenant-name=$x_TENANT_NAME"
+PROJECT_ARG="--os-project-name=$x_PROJECT_NAME"
 ARGS="--os-username=$x_USERNAME --os-password=$x_PASSWORD --os-auth-url=$x_AUTH_URL"
 
 # Set global return
@@ -68,7 +68,7 @@ if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
         STATUS_KEYSTONE="Skipped"
     else
         echo -e "\nTest Keystone"
-        if openstack $TENANT_ARG $ARGS catalog show identity; then
+        if openstack $PROJECT_ARG $ARGS catalog show identity; then
             STATUS_KEYSTONE="Succeeded"
         else
             STATUS_KEYSTONE="Failed"
@@ -87,7 +87,7 @@ if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
     else
         # Test OSAPI
         echo -e "\nTest Nova"
-        if nova $TENANT_ARG $ARGS flavor-list; then
+        if nova $PROJECT_ARG $ARGS flavor-list; then
             STATUS_NOVA="Succeeded"
         else
             STATUS_NOVA="Failed"
@@ -104,7 +104,7 @@ if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
         STATUS_CINDER="Skipped"
     else
         echo -e "\nTest Cinder"
-        if cinder $TENANT_ARG $ARGS list; then
+        if cinder $PROJECT_ARG $ARGS list; then
             STATUS_CINDER="Succeeded"
         else
             STATUS_CINDER="Failed"
@@ -121,7 +121,7 @@ if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
         STATUS_GLANCE="Skipped"
     else
         echo -e "\nTest Glance"
-        if openstack $TENANT_ARG $ARGS image list; then
+        if openstack $PROJECT_ARG $ARGS image list; then
             STATUS_GLANCE="Succeeded"
         else
             STATUS_GLANCE="Failed"
@@ -138,7 +138,7 @@ if [[ "$ENABLED_SERVICES" =~ "swift" || "$ENABLED_SERVICES" =~ "s-proxy" ]]; the
         STATUS_SWIFT="Skipped"
     else
         echo -e "\nTest Swift"
-        if swift $TENANT_ARG $ARGS stat; then
+        if swift $PROJECT_ARG $ARGS stat; then
             STATUS_SWIFT="Succeeded"
         else
             STATUS_SWIFT="Failed"
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a8fbd86473..a3128a8d71 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -48,9 +48,9 @@ source $TOP_DIR/exerciserc
 # Neutron Settings
 # ----------------
 
-TENANTS="DEMO1"
+PROJECTS="DEMO1"
 # TODO (nati)_Test public network
-#TENANTS="DEMO1,DEMO2"
+#PROJECTS="DEMO1,DEMO2"
 
 PUBLIC_NAME="admin"
 DEMO1_NAME="demo1"
@@ -91,34 +91,34 @@ DEMO2_ROUTER1_NET="demo2-net1"
 # Various functions
 # -----------------
 
-function foreach_tenant {
+function foreach_project {
     COMMAND=$1
-    for TENANT in ${TENANTS//,/ };do
-        eval ${COMMAND//%TENANT%/$TENANT}
+    for PROJECT in ${PROJECTS//,/ };do
+        eval ${COMMAND//%PROJECT%/$PROJECT}
     done
 }
 
-function foreach_tenant_resource {
+function foreach_project_resource {
     COMMAND=$1
     RESOURCE=$2
-    for TENANT in ${TENANTS//,/ };do
-        eval 'NUM=$'"${TENANT}_NUM_$RESOURCE"
+    for PROJECT in ${PROJECTS//,/ };do
+        eval 'NUM=$'"${PROJECT}_NUM_$RESOURCE"
         for i in `seq $NUM`;do
-            local COMMAND_LOCAL=${COMMAND//%TENANT%/$TENANT}
+            local COMMAND_LOCAL=${COMMAND//%PROJECT%/$PROJECT}
             COMMAND_LOCAL=${COMMAND_LOCAL//%NUM%/$i}
             eval $COMMAND_LOCAL
         done
     done
 }
 
-function foreach_tenant_vm {
+function foreach_project_vm {
     COMMAND=$1
-    foreach_tenant_resource "$COMMAND" 'VM'
+    foreach_project_resource "$COMMAND" 'VM'
 }
 
-function foreach_tenant_net {
+function foreach_project_net {
     COMMAND=$1
-    foreach_tenant_resource "$COMMAND" 'NET'
+    foreach_project_resource "$COMMAND" 'NET'
 }
 
 function get_image_id {
@@ -128,12 +128,12 @@ function get_image_id {
     echo "$IMAGE_ID"
 }
 
-function get_tenant_id {
-    local TENANT_NAME=$1
-    local TENANT_ID
-    TENANT_ID=`openstack project list | grep " $TENANT_NAME " | head -n 1 | get_field 1`
-    die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for $TENANT_NAME"
-    echo "$TENANT_ID"
+function get_project_id {
+    local PROJECT_NAME=$1
+    local PROJECT_ID
+    PROJECT_ID=`openstack project list | grep " $PROJECT_NAME " | head -n 1 | get_field 1`
+    die_if_not_set $LINENO PROJECT_ID "Failure retrieving PROJECT_ID for $PROJECT_NAME"
+    echo "$PROJECT_ID"
 }
 
 function get_user_id {
@@ -177,23 +177,23 @@ function confirm_server_active {
 
 function neutron_debug_admin {
     local os_username=$OS_USERNAME
-    local os_tenant_id=$OS_TENANT_ID
+    local os_project_id=$OS_PROJECT_ID
     source $TOP_DIR/openrc admin admin
     neutron-debug $@
-    source $TOP_DIR/openrc $os_username $os_tenant_id
+    source $TOP_DIR/openrc $os_username $os_project_id
 }
 
-function add_tenant {
+function add_project {
     openstack project create $1
     openstack user create $2 --password ${ADMIN_PASSWORD} --project $1
     openstack role add Member --project $1 --user $2
 }
 
-function remove_tenant {
-    local TENANT=$1
-    local TENANT_ID
-    TENANT_ID=$(get_tenant_id $TENANT)
-    openstack project delete $TENANT_ID
+function remove_project {
+    local PROJECT=$1
+    local PROJECT_ID
+    PROJECT_ID=$(get_project_id $PROJECT)
+    openstack project delete $PROJECT_ID
 }
 
 function remove_user {
@@ -203,47 +203,47 @@ function remove_user {
     openstack user delete $USER_ID
 }
 
-function create_tenants {
+function create_projects {
     source $TOP_DIR/openrc admin admin
-    add_tenant demo1 demo1 demo1
-    add_tenant demo2 demo2 demo2
+    add_project demo1 demo1 demo1
+    add_project demo2 demo2 demo2
     source $TOP_DIR/openrc demo demo
 }
 
-function delete_tenants_and_users {
+function delete_projects_and_users {
     source $TOP_DIR/openrc admin admin
     remove_user demo1
-    remove_tenant demo1
+    remove_project demo1
     remove_user demo2
-    remove_tenant demo2
-    echo "removed all tenants"
+    remove_project demo2
+    echo "removed all projects"
     source $TOP_DIR/openrc demo demo
 }
 
 function create_network {
-    local TENANT=$1
+    local PROJECT=$1
     local GATEWAY=$2
     local CIDR=$3
     local NUM=$4
     local EXTRA=$5
-    local NET_NAME="${TENANT}-net$NUM"
-    local ROUTER_NAME="${TENANT}-router${NUM}"
+    local NET_NAME="${PROJECT}-net$NUM"
+    local ROUTER_NAME="${PROJECT}-router${NUM}"
     source $TOP_DIR/openrc admin admin
-    local TENANT_ID
-    TENANT_ID=$(get_tenant_id $TENANT)
-    source $TOP_DIR/openrc $TENANT $TENANT
+    local PROJECT_ID
+    PROJECT_ID=$(get_project_id $PROJECT)
+    source $TOP_DIR/openrc $PROJECT $PROJECT
     local NET_ID
-    NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
-    die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
+    NET_ID=$(neutron net-create --project-id $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
+    die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PROJECT_ID $NET_NAME $EXTRA"
+    neutron subnet-create --ip-version 4 --project-id $PROJECT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
 
 function create_networks {
-    foreach_tenant_net 'create_network ${%TENANT%_NAME} ${%TENANT%_NET%NUM%_GATEWAY} ${%TENANT%_NET%NUM%_CIDR} %NUM% ${%TENANT%_NET%NUM%_EXTRA}'
+    foreach_project_net 'create_network ${%PROJECT%_NAME} ${%PROJECT%_NET%NUM%_GATEWAY} ${%PROJECT%_NET%NUM%_CIDR} %NUM% ${%PROJECT%_NET%NUM%_EXTRA}'
     #TODO(nati) test security group function
-    # allow ICMP for both tenant's security groups
+    # allow ICMP for both project's security groups
     #source $TOP_DIR/openrc demo1 demo1
     #$NOVA secgroup-add-rule default icmp -1 -1 0.0.0.0/0
     #source $TOP_DIR/openrc demo2 demo2
@@ -251,10 +251,10 @@ function create_networks {
 }
 
 function create_vm {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
     local NET_NAMES=$3
-    source $TOP_DIR/openrc $TENANT $TENANT
+    source $TOP_DIR/openrc $PROJECT $PROJECT
     local NIC=""
     for NET_NAME in ${NET_NAMES//,/ };do
         NIC="$NIC --nic net-id="`get_network_id $NET_NAME`
@@ -265,13 +265,13 @@ function create_vm {
     VM_UUID=`nova boot --flavor $(get_flavor_id m1.tiny) \
         --image $(get_image_id) \
         $NIC \
-        $TENANT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
-    die_if_not_set $LINENO VM_UUID "Failure launching $TENANT-server$NUM"
+        $PROJECT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
+    die_if_not_set $LINENO VM_UUID "Failure launching $PROJECT-server$NUM"
     confirm_server_active $VM_UUID
 }
 
 function create_vms {
-    foreach_tenant_vm 'create_vm ${%TENANT%_NAME} %NUM% ${%TENANT%_VM%NUM%_NET}'
+    foreach_project_vm 'create_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
 }
 
 function ping_ip {
@@ -284,11 +284,11 @@ function ping_ip {
 }
 
 function check_vm {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
-    local VM_NAME="$TENANT-server$NUM"
+    local VM_NAME="$PROJECT-server$NUM"
     local NET_NAME=$3
-    source $TOP_DIR/openrc $TENANT $TENANT
+    source $TOP_DIR/openrc $PROJECT $PROJECT
     ping_ip $VM_NAME $NET_NAME
     # TODO (nati) test ssh connection
     # TODO (nati) test inter connection between vm
@@ -297,31 +297,31 @@ function check_vm {
 }
 
 function check_vms {
-    foreach_tenant_vm 'check_vm ${%TENANT%_NAME} %NUM% ${%TENANT%_VM%NUM%_NET}'
+    foreach_project_vm 'check_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
 }
 
 function shutdown_vm {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
-    source $TOP_DIR/openrc $TENANT $TENANT
-    VM_NAME=${TENANT}-server$NUM
+    source $TOP_DIR/openrc $PROJECT $PROJECT
+    VM_NAME=${PROJECT}-server$NUM
     nova delete $VM_NAME
 }
 
 function shutdown_vms {
-    foreach_tenant_vm 'shutdown_vm ${%TENANT%_NAME} %NUM%'
+    foreach_project_vm 'shutdown_vm ${%PROJECT%_NAME} %NUM%'
     if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q ACTIVE; do sleep 1; done"; then
         die $LINENO "Some VMs failed to shutdown"
     fi
 }
 
 function delete_network {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
-    local NET_NAME="${TENANT}-net$NUM"
+    local NET_NAME="${PROJECT}-net$NUM"
     source $TOP_DIR/openrc admin admin
-    local TENANT_ID
-    TENANT_ID=$(get_tenant_id $TENANT)
+    local PROJECT_ID
+    PROJECT_ID=$(get_project_id $PROJECT)
     #TODO(nati) comment out until l3-agent merged
     #for res in port subnet net router;do
     for net_id in `neutron net-list -c id -c name | grep $NET_NAME | awk '{print $2}'`;do
@@ -333,7 +333,7 @@ function delete_network {
 }
 
 function delete_networks {
-    foreach_tenant_net 'delete_network ${%TENANT%_NAME} %NUM%'
+    foreach_project_net 'delete_network ${%PROJECT%_NAME} %NUM%'
     # TODO(nati) add secuirty group check after it is implemented
     # source $TOP_DIR/openrc demo1 demo1
     # nova secgroup-delete-rule default icmp -1 -1 0.0.0.0/0
@@ -342,7 +342,7 @@ function delete_networks {
 }
 
 function create_all {
-    create_tenants
+    create_projects
     create_networks
     create_vms
 }
@@ -350,7 +350,7 @@ function create_all {
 function delete_all {
     shutdown_vms
     delete_networks
-    delete_tenants_and_users
+    delete_projects_and_users
 }
 
 function all {
@@ -366,8 +366,8 @@ function test_functions {
     IMAGE=$(get_image_id)
     echo $IMAGE
 
-    TENANT_ID=$(get_tenant_id demo)
-    echo $TENANT_ID
+    PROJECT_ID=$(get_project_id demo)
+    echo $PROJECT_ID
 
     FLAVOR_ID=$(get_flavor_id m1.tiny)
     echo $FLAVOR_ID
@@ -382,11 +382,11 @@ function test_functions {
 function usage {
     echo "$0: [-h]"
     echo "  -h, --help              Display help message"
-    echo "  -t, --tenant            Create tenants"
+    echo "  -t, --project            Create projects"
     echo "  -n, --net               Create networks"
     echo "  -v, --vm                Create vms"
     echo "  -c, --check             Check connection"
-    echo "  -x, --delete-tenants    Delete tenants"
+    echo "  -x, --delete-projects    Delete projects"
     echo "  -y, --delete-nets       Delete networks"
     echo "  -z, --delete-vms        Delete vms"
     echo "  -T, --test              Test functions"
@@ -412,7 +412,7 @@ function main {
                 -v | --vm )     create_vms
                                 exit
                                 ;;
-                -t | --tenant ) create_tenants
+                -t | --project ) create_projects
                                 exit
                                 ;;
                 -c | --check )   check_vms
@@ -421,7 +421,7 @@ function main {
                 -T | --test )   test_functions
                                 exit
                                 ;;
-                -x | --delete-tenants ) delete_tenants_and_users
+                -x | --delete-projects ) delete_projects_and_users
                                 exit
                                 ;;
                 -y | --delete-nets ) delete_networks
diff --git a/lib/cinder b/lib/cinder
index e1e1f2a893..6401f2d59a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -351,7 +351,7 @@ function configure_cinder {
     # Set os_privileged_user credentials (used for os-assisted-snapshots)
     iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
-    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_TENANT_NAME"
+    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 }
 
diff --git a/lib/glance b/lib/glance
index c248611aef..4df231009a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -143,7 +143,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
         iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_TENANT_NAME:glance-swift
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
@@ -198,7 +198,7 @@ function configure_glance {
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
     iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
@@ -226,9 +226,9 @@ function configure_glance {
 
 # Project              User            Roles
 # ---------------------------------------------------------------------
-# SERVICE_TENANT_NAME  glance          service
-# SERVICE_TENANT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
-# SERVICE_TENANT_NAME  glance-search   search (if Search is enabled)
+# SERVICE_PROJECT_NAME  glance          service
+# SERVICE_PROJECT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
+# SERVICE_PROJECT_NAME  glance-search   search (if Search is enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -241,7 +241,7 @@ function create_glance_accounts {
             local glance_swift_user
             glance_swift_user=$(get_or_create_user "glance-swift" \
                 "$SERVICE_PASSWORD" "default" "glance-swift@example.com")
-            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
+            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_PROJECT_NAME
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
diff --git a/lib/keystone b/lib/keystone
index 7d5fd41f89..e33081cd9f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -108,7 +108,7 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the tenant for service accounts in Keystone
-SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
+SERVICE_PROJECT_NAME=${SERVICE_TENANT_NAME:-service}
 
 # if we are running with SSL use https protocols
 if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
@@ -384,7 +384,7 @@ function create_keystone_accounts {
     get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
-    get_or_create_project "$SERVICE_TENANT_NAME" default
+    get_or_create_project "$SERVICE_PROJECT_NAME" default
 
     # Service role, so service users do not have to be admins
     get_or_create_role service
@@ -458,7 +458,7 @@ function create_service_user {
 
     local user
     user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
-    get_or_add_user_project_role "$role" "$user" "$SERVICE_TENANT_NAME"
+    get_or_add_user_project_role "$role" "$user" "$SERVICE_PROJECT_NAME"
 }
 
 # Configure the service to use the auth token middleware.
@@ -479,7 +479,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
     iniset $conf_file $section user_domain_id default
-    iniset $conf_file $section project_name $SERVICE_TENANT_NAME
+    iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
     iniset $conf_file $section project_domain_id default
 
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 539b9ff551..ebf9825a27 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -483,7 +483,7 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "Default"
-    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF neutron project_name "$SERVICE_PROJECT_NAME"
     iniset $NOVA_CONF neutron project_domain_name "Default"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
@@ -1169,7 +1169,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF nova username nova
     iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
     iniset $NEUTRON_CONF nova user_domain_id default
-    iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
+    iniset $NEUTRON_CONF nova project_name $SERVICE_PROJECT_NAME
     iniset $NEUTRON_CONF nova project_domain_id default
     iniset $NEUTRON_CONF nova region_name $REGION_NAME
 
diff --git a/lib/nova b/lib/nova
index cce538d3d7..fd458c5701 100644
--- a/lib/nova
+++ b/lib/nova
@@ -404,8 +404,8 @@ function configure_nova {
 #
 # Project              User         Roles
 # ------------------------------------------------------------------
-# SERVICE_TENANT_NAME  nova         admin
-# SERVICE_TENANT_NAME  nova         ResellerAdmin (if Swift is enabled)
+# SERVICE_PROJECT_NAME  nova         admin
+# SERVICE_PROJECT_NAME  nova         ResellerAdmin (if Swift is enabled)
 function create_nova_accounts {
 
     # Nova
@@ -444,7 +444,7 @@ function create_nova_accounts {
         if is_service_enabled swift; then
             # Nova needs ResellerAdmin role to download images when accessing
             # swift through the s3 api.
-            get_or_add_user_project_role ResellerAdmin nova $SERVICE_TENANT_NAME
+            get_or_add_user_project_role ResellerAdmin nova $SERVICE_PROJECT_NAME
         fi
     fi
 
diff --git a/lib/swift b/lib/swift
index 947d2abdc0..b6c3ca49a3 100644
--- a/lib/swift
+++ b/lib/swift
@@ -450,7 +450,7 @@ auth_host = ${KEYSTONE_AUTH_HOST}
 auth_protocol = ${KEYSTONE_AUTH_PROTOCOL}
 cafile = ${SSL_BUNDLE_FILE}
 admin_user = swift
-admin_tenant_name = ${SERVICE_TENANT_NAME}
+admin_tenant_name = ${SERVICE_PROJECT_NAME}
 admin_password = ${SERVICE_PASSWORD}
 
 [filter:swift3]
@@ -812,7 +812,7 @@ function swift_configure_tempurls {
     # note we are using swift credentials!
     OS_USERNAME=swift \
     OS_PASSWORD=$SERVICE_PASSWORD \
-    OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
+    OS_PROJECT_NAME=$SERVICE_PROJECT_NAME \
     openstack object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
diff --git a/openrc b/openrc
index 9bc0fd77f4..460cf14756 100644
--- a/openrc
+++ b/openrc
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 #
-# source openrc [username] [tenantname]
+# source openrc [username] [projectname]
 #
-# Configure a set of credentials for $TENANT/$USERNAME:
-#   Set OS_TENANT_NAME to override the default tenant 'demo'
+# Configure a set of credentials for $PROJECT/$USERNAME:
+#   Set OS_PROJECT_NAME to override the default project 'demo'
 #   Set OS_USERNAME to override the default user name 'demo'
 #   Set ADMIN_PASSWORD to set the password for 'admin' and 'demo'
 
@@ -14,7 +14,7 @@ if [[ -n "$1" ]]; then
     OS_USERNAME=$1
 fi
 if [[ -n "$2" ]]; then
-    OS_TENANT_NAME=$2
+    OS_PROJECT_NAME=$2
 fi
 
 # Find the other rc files
@@ -34,13 +34,17 @@ fi
 # Get some necessary configuration
 source $RC_DIR/lib/tls
 
-# The introduction of Keystone to the OpenStack ecosystem has standardized the
-# term **tenant** as the entity that owns resources.  In some places references
-# still exist to the original Nova term **project** for this use.  Also,
-# **tenant_name** is preferred to **tenant_id**.
-export OS_TENANT_NAME=${OS_TENANT_NAME:-demo}
+# The OpenStack ecosystem has standardized the term **project** as the
+# entity that owns resources.  In some places **tenant** remains
+# referenced, but in all cases this just means **project**.  We will
+# warn if we need to turn on legacy **tenant** support to have a
+# working environment.
+export OS_PROJECT_NAME=${OS_PROJECT_NAME:-demo}
 
-# In addition to the owning entity (tenant), nova stores the entity performing
+echo "WARNING: setting legacy OS_TENANT_NAME to support cli tools."
+export OS_TENANT_NAME=$OS_PROJECT_NAME
+
+# In addition to the owning entity (project), nova stores the entity performing
 # the action as the **user**.
 export OS_USERNAME=${OS_USERNAME:-demo}
 
@@ -81,7 +85,7 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
-# the user/tenant has access to - including nova, glance, keystone, swift, ...
+# the user/project has access to - including nova, glance, keystone, swift, ...
 # We currently recommend using the 2.0 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
diff --git a/stack.sh b/stack.sh
index 6dddea4e67..0be3585020 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1210,7 +1210,7 @@ fi
 
 # Create an access key and secret key for Nova EC2 register image
 if is_service_enabled keystone && is_service_enabled swift3 && is_service_enabled nova; then
-    eval $(openstack ec2 credentials create --user nova --project $SERVICE_TENANT_NAME -f shell -c access -c secret)
+    eval $(openstack ec2 credentials create --user nova --project $SERVICE_PROJECT_NAME -f shell -c access -c secret)
     iniset $NOVA_CONF DEFAULT s3_access_key "$access"
     iniset $NOVA_CONF DEFAULT s3_secret_key "$secret"
     iniset $NOVA_CONF DEFAULT s3_affix_tenant "True"

From 0f7653587ecf22d3461775ad9da77a7090334b74 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 18 Feb 2016 06:53:08 -0500
Subject: [PATCH 1200/3333] localize user/project variables in tempest

lib/tempest is using / setting a ton of globals, a lot which don't
look used. As a first step to converting over to s/tenant/project/
make all of these local which means they can not be impacting anything
outside of this function. That will make them safe to change names
later.

Change-Id: I380dd20e5ed716a0bdf92aa02c3730359b8136e4
---
 lib/tempest | 36 +++++++++++++++++++-----------------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index f75d755066..caf8f117d1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -176,17 +176,18 @@ function configure_tempest {
     sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
     rm -f $TEMPEST_CONFIG
 
-    password=${ADMIN_PASSWORD:-secrete}
+    local password=${ADMIN_PASSWORD:-secrete}
 
     # See ``lib/keystone`` where these users and tenants are set up
-    ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
-    ADMIN_TENANT_NAME=${ADMIN_TENANT_NAME:-admin}
-    ADMIN_DOMAIN_NAME=${ADMIN_DOMAIN_NAME:-Default}
-    TEMPEST_USERNAME=${TEMPEST_USERNAME:-demo}
-    TEMPEST_TENANT_NAME=${TEMPEST_TENANT_NAME:-demo}
-    ALT_USERNAME=${ALT_USERNAME:-alt_demo}
-    ALT_TENANT_NAME=${ALT_TENANT_NAME:-alt_demo}
-    ADMIN_TENANT_ID=$(openstack project list | awk "/ admin / { print \$2 }")
+    local admin_username=${ADMIN_USERNAME:-admin}
+    local admin_tenant_name=${ADMIN_TENANT_NAME:-admin}
+    local admin_domain_name=${ADMIN_DOMAIN_NAME:-Default}
+    local tempest_username=${TEMPEST_USERNAME:-demo}
+    local tempest_tenant_name=${TEMPEST_TENANT_NAME:-demo}
+    local alt_username=${ALT_USERNAME:-alt_demo}
+    local alt_tenant_name=${ALT_TENANT_NAME:-alt_demo}
+    local admin_tenant_id
+    admin_tenant_id=$(openstack project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
@@ -260,11 +261,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
-        iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
+        iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"
-        iniset $TEMPEST_CONFIG auth admin_tenant_name $ADMIN_TENANT_NAME
-        iniset $TEMPEST_CONFIG auth admin_tenant_id $ADMIN_TENANT_ID
-        iniset $TEMPEST_CONFIG auth admin_domain_name $ADMIN_DOMAIN_NAME
+        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_tenant_name
+        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_tenant_id
+        iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
@@ -531,8 +532,9 @@ function configure_tempest {
     # this tempest service list needs to be all the services that
     # tempest supports, otherwise we can have an erroneous set of
     # defaults (something defaulting true in Tempest, but not listed here).
-    TEMPEST_SERVICES="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
-    for service in ${TEMPEST_SERVICES//,/ }; do
+    local service
+    local tempest_services="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
+    for service in ${tempest_services//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"
         else
@@ -550,9 +552,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From d8589fa01a57feccc2d20a72307098b7e3eeb1d3 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 22 Feb 2016 13:49:52 -0600
Subject: [PATCH 1201/3333] Fix uwsgi keystone

The uwsgi keystone jobs are failing with an error like

 + devstack/functions-common:_run_process:L1391:   setsid uwsgi /etc/keystone/keystone-uwsgi-admin.ini
 + devstack/functions-common:_run_process:L1395:   exit 0
 execvp: No such file or directory

I think this is because uwsgi isn't installed on the images. The fix
is to pip install it.

Also, use the full path to the uwsgi executable (even though execvp
is used) because eventlet (calling keystone-all) does.

Also, the uwsgi process wasn't shutting down on ./unstack.sh. This
is worked around by not running master process.

Change-Id: Id02e16c5149ba3dfa13051e87cfccd8e505b7362
---
 lib/keystone | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 7d5fd41f89..1cb3737037 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -303,7 +303,6 @@ function configure_keystone {
 
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
         # This is running standalone
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi master true
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi enable-threads true
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python
@@ -316,7 +315,6 @@ function configure_keystone {
 
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
         # This is running standalone
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi master true
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi enable-threads true
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi plugins python
@@ -563,6 +561,8 @@ function install_keystone {
         if is_ssl_enabled_service "key"; then
             enable_mod_ssl
         fi
+    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+        pip_install uwsgi
     fi
 }
 
@@ -582,8 +582,8 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
-        run_process key "uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
-        run_process key "uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
+        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
+        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
     else # eventlet
         # Start Keystone in a screen window
         run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"

From f5515409d5253b9063f421cf37f45ddfc062aa90 Mon Sep 17 00:00:00 2001
From: Assaf Muller <amuller@redhat.com>
Date: Mon, 22 Feb 2016 17:38:17 -0500
Subject: [PATCH 1202/3333] Change default subnetpool size

Commit 7dbcfae introduced a subnetpool needed for the
auto-configured-topology Neutron extension. However, it allows
only up to 4 tenants, then you'd hit an error about no more
available IPs. This patch changes the size of the subnetpool
and the subnets it creates.

Change-Id: I4f43bebc52fb20e39853a1632fe31506958f5071
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 56a9bdf229..61328bf11f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -76,10 +76,10 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 # Subnetpool defaults
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/24}
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
 SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 
-SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 

From 13fe6f59d1b6d209bf770b0959d408ee1a8fb659 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Tue, 23 Feb 2016 12:57:02 +0100
Subject: [PATCH 1203/3333] Fix telemetry integration gate jobs

Since https://review.openstack.org/#/c/281779/2 have been
merged the telemetry integration job is broken.

Unfortunatly, it can't be fixed on our side, because we have to
rename SERVICE_TENANT_NAME in many devstack plugin, we can't merge thing
until all plugins have been fixed.

So this change restores SERVICE_TENANT_NAME, to be able to switch to SERVICE_PROJECT_NAME.

Related-bug: #1548634
Change-Id: I14ebf23aa63f0f153b934ad213a6209d22e73e9d
---
 lib/keystone | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/keystone b/lib/keystone
index e33081cd9f..ff9714fe4d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -108,6 +108,7 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the tenant for service accounts in Keystone
+SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
 SERVICE_PROJECT_NAME=${SERVICE_TENANT_NAME:-service}
 
 # if we are running with SSL use https protocols

From bb16c87a2164dcea36bcb3836793d99265dca01e Mon Sep 17 00:00:00 2001
From: Jin Nan Zhang <zhang.jinnan@99cloud.net>
Date: Mon, 22 Feb 2016 10:01:47 -0500
Subject: [PATCH 1204/3333] Ignore files created by pkg/elasticsearch.sh

When running pkg/elasticsearch.sh the following files are created:

.localrc.password
files/elasticsearch-1.4.2.noarch.rpm
files/elasticsearch-1.4.2.noarch.rpm.sha1.gen
files/elasticsearch-1.4.2.noarch.rpm.sha1.txt


Change-Id: Ie2ab8b7fe72f51cb350e1f46ca97570b84047ac4
Closes-Bug: #1548201
---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index 8870bb362c..a5a17c2b75 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 *.log.[1-9]
 *.pem
 .localrc.auto
+.localrc.password
 .prereqs
 .tox
 .stackenv
@@ -11,6 +12,8 @@ accrc
 doc/files
 doc/build
 files/*.gz
+files/*.rpm
+files/*.rpm.*
 files/*.qcow2
 files/*.img
 files/images

From 57d79673d9f80b96e4bddc99bd8cfe95abea0103 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 23 Feb 2016 15:38:43 +0000
Subject: [PATCH 1205/3333] Skip ovs_ and ebtables_dump if needed commands not
 present

Skip with a notification that a command was not found when trying
to run a dump that relies on optional external command.

Otherwise we produce noise in the error output that is misleading.

Change-Id: I0e3d99da8c54d2912463ecba7c1783864a7c7fc7
Closes-Bug: #1548833
Closes-Bug: #1506873
---
 tools/worlddump.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index d129374253..01f601cea8 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -18,6 +18,7 @@
 
 import argparse
 import datetime
+from distutils import spawn
 import fnmatch
 import os
 import os.path
@@ -61,6 +62,13 @@ def _dump_cmd(cmd):
         print "*** Failed to run: %s" % cmd
 
 
+def _find_cmd(cmd):
+    if not spawn.find_executable(cmd):
+        print "*** %s not found: skipping" % cmd
+        return False
+    return True
+
+
 def _header(name):
     print
     print name
@@ -89,6 +97,8 @@ def disk_space():
 def ebtables_dump():
     tables = ['filter', 'nat', 'broute']
     _header("EB Tables Dump")
+    if not _find_cmd('ebtables'):
+        return
     for table in tables:
         _dump_cmd("sudo ebtables -t %s -L" % table)
 
@@ -124,6 +134,11 @@ def network_dump():
 def ovs_dump():
     _header("Open vSwitch Dump")
 
+    # NOTE(cdent): If we're not using neutron + ovs these commands
+    # will not be present so
+    if not _find_cmd('ovs-vsctl'):
+        return
+
     # NOTE(ihrachys): worlddump is used outside of devstack context (f.e. in
     # grenade), so there is no single place to determine the bridge names from.
     # Hardcode for now.

From 8a6d7678b58c3dc834fec343332020d624e4006a Mon Sep 17 00:00:00 2001
From: Angus Lees <gus@inodes.org>
Date: Mon, 15 Feb 2016 10:53:20 +1100
Subject: [PATCH 1206/3333] cinder.conf: Set privsep_osbrick.helper_command

When os-brick starts using privsep, it will need to know how to invoke
its privileged half.  Amazingly the name of the rootwrap executable
isn't anywhere else in the config, so the privsep default uses just
"sudo" (no rootwrap).

We need to either:

1. set the privsep command line to use cinder-rootwrap in
   cinder.conf (and similar in other configs), or

2. add the privsep-helper line to sudoers and bypass rootwrap entirely.

This change implements (1) for devstack/cinder and is similar to the
corresponding nova change in I90dc41bc77993bd83b80c92286e015e14f290b45

Change-Id: I8a0b1728cc66c4861f69623b1b16b1f759b57b25
---
 lib/cinder | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 3aea05023f..081e2f7860 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -272,6 +272,8 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
+    iniset $CINDER_CONF privsep_osbrick helper_command "sudo cinder-rootwrap \$rootwrap_config privsep-helper --config-file $CINDER_CONF"
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""

From 58467e2102824e92655f448fd6cb55f8820a4cf7 Mon Sep 17 00:00:00 2001
From: Angus Lees <gus@inodes.org>
Date: Tue, 9 Feb 2016 16:56:55 +1100
Subject: [PATCH 1207/3333] nova.conf: Set privsep_osbrick.helper_command

When os-brick starts using privsep, it will need to know how to invoke
its privileged half.  Amazingly the name of the rootwrap executable
isn't anywhere else in the config, so the privsep default uses just
"sudo" (no rootwrap).

We need to either:

1. set the privsep command line to use nova-rootwrap in nova.conf (and
   similar in other configs), or

2. add the privsep-helper line to sudoers and bypass rootwrap entirely.

This change implements (1) for devstack (nova only for now, cinder to
follow shortly).

Change-Id: I90dc41bc77993bd83b80c92286e015e14f290b45
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index dc425a19bd..e0bccc570b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -501,6 +501,8 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
+    iniset $NOVA_CONF privsep_osbrick helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
+
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From 7f66503de0dcfce6884f2dbe08fa5fd4ee9b05e3 Mon Sep 17 00:00:00 2001
From: Nikolay Fedotov <nfedotov@cisco.com>
Date: Wed, 24 Feb 2016 16:07:18 +0000
Subject: [PATCH 1208/3333] Use SCREEN_NAME variable instead of hardcode in
 unstack and rejoin scripts

Change-Id: I7382eccf96d14df223777cd43344d554b8452a77
---
 rejoin-stack.sh | 11 ++++++-----
 unstack.sh      |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/rejoin-stack.sh b/rejoin-stack.sh
index 30b7bab1cc..7048865fc9 100755
--- a/rejoin-stack.sh
+++ b/rejoin-stack.sh
@@ -11,14 +11,15 @@ source $TOP_DIR/functions
 
 source $TOP_DIR/stackrc
 
+SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
 # if screenrc exists, run screen
-if [[ -e $TOP_DIR/stack-screenrc ]]; then
-    if screen -ls | egrep -q "[0-9].stack"; then
+if [[ -e $SCREENRC ]]; then
+    if screen -ls | egrep -q "[0-9]+.${SCREEN_NAME}"; then
         echo "Attaching to already started screen session.."
-        exec screen -r stack
+        exec screen -r $SCREEN_NAME
     fi
-    exec screen -c $TOP_DIR/stack-screenrc
+    exec screen -c $SCREENRC
 fi
 
-echo "Couldn't find $TOP_DIR/stack-screenrc file; have you run stack.sh yet?"
+echo "Couldn't find $SCREENRC file; have you run stack.sh yet?"
 exit 1
diff --git a/unstack.sh b/unstack.sh
index d7670e38a5..7a7c945c8a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -182,7 +182,7 @@ fi
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)
 if [[ -n "$SCREEN" ]]; then
-    SESSION=$(screen -ls | awk '/[0-9].stack/ { print $1 }')
+    SESSION=$(screen -ls | awk "/[0-9]+.${SCREEN_NAME}/"'{ print $1 }')
     if [[ -n "$SESSION" ]]; then
         screen -X -S $SESSION quit
     fi

From 8ce3faf4e73297397cc84e9b64c38eb876d6c7d1 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Fri, 26 Feb 2016 08:18:13 -0700
Subject: [PATCH 1209/3333] Remove filesystem-based code path

This removes the fs-based git code path for detecting devstack plugins
as requested in I2c5c9282a8ad80014cad171a4dfbdc8f26044cd1

Change-Id: I6d1567c2545b866c433381d19587beb08c281c53
---
 tools/generate-devstack-plugins-list.sh | 40 +++++--------------------
 1 file changed, 8 insertions(+), 32 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 01767854d7..37105224dc 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -43,38 +43,14 @@ declare -A plugins
 
 test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
 
-if test -n "$git_dir"; then
-    pushd ${git_dir} >/dev/null
-    for i in *; do
-        pushd ${i} >/dev/null
-        if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
-            test -n "$output" && plugins[$i]=${output}
-        fi
-        popd >/dev/null
-    done
-    popd >/dev/null
-
-    sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
-
-    for k in "${sorted_plugins[@]}"; do
-        project=${k:0:18}
-        giturl="git://git.openstack.org/openstack/${k:0:26}"
-        pdate="${plugins[$k]}"
-        printf "|%-18s|%-60s (%-10s)|\n" "${project}" "${giturl}" "${pdate}"
-        printf "+------------------+-------------------------------------------------------------------------+\n"
-    done
-
-else
-    sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
-
-    for k in ${sorted_plugins}; do
-        project=${k:0:18}
-        giturl="git://git.openstack.org/openstack/${k:0:26}"
-        printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
-        printf "+------------------+-------------------------------------------------------------------------+\n"
-    done
-
-fi
+sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
+
+for k in ${sorted_plugins}; do
+    project=${k:0:18}
+    giturl="git://git.openstack.org/openstack/${k:0:26}"
+    printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
+    printf "+------------------+-------------------------------------------------------------------------+\n"
+done
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
 ) > doc/source/plugin-registry.rst

From e6f0d8cb40f65b7969eef8434898bf7c1d4b05d8 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Fri, 26 Feb 2016 08:25:32 -0700
Subject: [PATCH 1210/3333] Place the generated list in the correct location
 for the proposal job

If tools/generate-devstack-plugins-list.sh is invoked with a parameter,
as is the case with the proposal job, copy the generated list thither
so that git will actually generate a diff.

Change-Id: I874a521bba7f402f5c07e28d6ebb086e77873795
---
 tools/generate-devstack-plugins-list.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 37105224dc..b7817a0096 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -54,3 +54,7 @@ done
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
 ) > doc/source/plugin-registry.rst
+
+if [[ -n ${1} ]]; then
+    cp doc/source/plugin-registry.rst ${1}/doc/source/plugin-registry.rst
+fi

From 3c60168532b9202baa6d163d3501d8323239eb5b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 29 Feb 2016 15:15:39 +1100
Subject: [PATCH 1211/3333] Also detected failed packages in dnf/yum wrapper

As seen in [1]; dnf can output a "Failed:" section when installation
issues with a package are detected.  This does not, however, trigger
an exit failure code when running with "-y".  So add this to our
checking wrapper.

[1] http://logs.openstack.org/49/280449/1/check/gate-tempest-dsvm-platform-fedora23-nv/dc70ca8/logs/devstacklog.txt.gz#_2016-02-28_22_42_45_145

Change-Id: I12f7b3bc9e9cf5a97114082d3a634a42742843d5
---
 functions-common | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index ed444bbd41..2b23402b54 100644
--- a/functions-common
+++ b/functions-common
@@ -1304,15 +1304,16 @@ function yum_install {
 
     # Warning: this would not work if yum output message
     # have been translated to another language
-    parse_yum_result='\
-        BEGIN { result=0 }\
-        /^YUM_FAILED/ { exit $2 }\
-        /^No package/ { result=1 }\
-        //{ print }\
+    parse_yum_result='             \
+        BEGIN { result=0 }         \
+        /^YUM_FAILED/ { exit $2 }  \
+        /^No package/ { result=1 } \
+        /^Failed:/    { result=1 } \
+        //{ print }                \
         END { exit result }'
 
     # The manual check for missing packages is because yum -y assumes
-    # missing packages are OK.
+    # missing or failed packages are OK.
     # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
     (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
         | awk "$parse_yum_result"

From b65cf0aae40a69d5935a248b690187770ad366e3 Mon Sep 17 00:00:00 2001
From: Alexey Galkin <agalkin@mirantis.com>
Date: Tue, 15 Dec 2015 16:14:26 +0300
Subject: [PATCH 1212/3333] Add Glance Artifact API in devstack installation

Since EXPERIMENTAL Glance v3 API has been removed in favor of
standalone API implementation was added we need to add some
changes in devstack to support it.

Implements blueprint: move-v3-to-glare
Depends-On: I5b7bd4cdcc5f2a40fc4a5f74bcc422fd700c4fb0

Change-Id: Iced3c68010eb6bcd2a6a1ec8f1c6883f84cbe77f
---
 lib/glance | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 78 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 4df231009a..3743e161c4 100644
--- a/lib/glance
+++ b/lib/glance
@@ -55,6 +55,8 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
+GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
+GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -69,6 +71,8 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_GLARE_PORT=${GLANCE_GLARE_PORT:-9494}
+GLANCE_GLARE_HOSTPORT=${GLANCE_GLARE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_GLARE_PORT}
 
 # Functions
 # ---------
@@ -93,6 +97,9 @@ function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
     # Copy over our glance configurations and update them
+    if is_service_enabled g-glare; then
+        cp $GLANCE_DIR/etc/glance-glare.conf $GLANCE_GLARE_CONF
+    fi
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -129,6 +136,9 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    if is_service_enabled g-glare; then
+        iniset $GLANCE_GLARE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    fi
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
@@ -144,6 +154,23 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
+
+        # Store the glare in swift if enabled.
+        if is_service_enabled g-glare; then
+            iniset $GLANCE_GLARE_CONF glance_store default_store swift
+            iniset $GLANCE_GLARE_CONF glance_store swift_store_create_container_on_put True
+
+            iniset $GLANCE_GLARE_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
+            iniset $GLANCE_GLARE_CONF glance_store default_swift_reference ref1
+            iniset $GLANCE_GLARE_CONF glance_store stores "file, http, swift"
+            iniset $GLANCE_GLARE_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+            # commenting is not strictly necessary but it's confusing to have bad values in conf
+            inicomment $GLANCE_GLARE_CONF glance_store swift_store_user
+            inicomment $GLANCE_GLARE_CONF glance_store swift_store_key
+            inicomment $GLANCE_GLARE_CONF glance_store swift_store_auth_address
+        fi
+
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
@@ -220,6 +247,29 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    # Configure GLANCE_GLARE (Glance Glare)
+    if is_service_enabled g-glare; then
+        local dburl
+        dburl=`database_connection_url glance`
+        setup_colorized_logging $GLANCE_GLARE_CONF DEFAULT tenant user
+        iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
+        inicomment $GLANCE_GLARE_CONF DEFAULT log_file
+        iniset $GLANCE_GLARE_CONF DEFAULT workers "$API_WORKERS"
+
+        iniset $GLANCE_GLARE_CONF database connection $dburl
+        iniset $GLANCE_GLARE_CONF paste_deploy flavor keystone
+        configure_auth_token_middleware $GLANCE_GLARE_CONF glare $GLANCE_AUTH_CACHE_DIR/artifact
+        # Register SSL certificates if provided
+        if is_ssl_enabled_service glance; then
+            ensure_certificates GLANCE
+            iniset $GLANCE_GLARE_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
+            iniset $GLANCE_GLARE_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
+        fi
+        cp $GLANCE_DIR/etc/glance-glare-paste.ini $GLANCE_GLARE_PASTE_INI
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -229,6 +279,7 @@ function configure_glance {
 # SERVICE_PROJECT_NAME  glance          service
 # SERVICE_PROJECT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
 # SERVICE_PROJECT_NAME  glance-search   search (if Search is enabled)
+# SERVICE_PROJECT_NAME  glare           service (if enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -252,13 +303,25 @@ function create_glance_accounts {
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
     fi
+
+    # Add glance-glare service and endpoints
+    if is_service_enabled g-glare; then
+        create_service_user "glare"
+        get_or_create_service "glare" "artifact" "Glance Artifact Service"
+
+        get_or_create_endpoint "artifact" \
+            "$REGION_NAME" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT"
+    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
 function create_glance_cache_dir {
     # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/*
+    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
+    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
 }
 
 # init_glance() - Initialize databases, etc.
@@ -326,6 +389,15 @@ function start_glance {
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
+
+    #Start g-glare after g-reg/g-api/g-search
+    if is_service_enabled g-glare; then
+        run_process g-glare "$GLANCE_BIN_DIR/glance-glare --config-file=$GLANCE_CONF_DIR/glance-glare.conf"
+        echo "Waiting for Glare [g-glare] ($GLANCE_GLARE_HOSTPORT) to start..."
+        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT; then
+            die $LINENO " Glare [g-glare] did not start"
+        fi
+    fi
 }
 
 # stop_glance() - Stop running processes
@@ -333,6 +405,10 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
+
+    if is_service_enabled g-glare; then
+        stop_process g-glare
+    fi
 }
 
 # Restore xtrace

From 3ded0dbba567e81f49c1b82c1b03853486d1da74 Mon Sep 17 00:00:00 2001
From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
Date: Fri, 26 Feb 2016 23:14:54 +0100
Subject: [PATCH 1213/3333] Disable tempest tox venv recreation in OFFLINE mode

Setting OFFLINE=True in local.conf should enable stack.sh to run multiple
times without an internet connection. This was broken for some cases
when recreation of tox venv for tempest was forced in lib/tempest.

This change makes recreation of tox venv enabled only when OFFLINE mode is
disabled.

Change-Id: I2bf6caf60038a3690378eead905b35e9175ac356
Closes-Bug: #1550537
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index caf8f117d1..8d3bf7cd6b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -322,7 +322,9 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv --notest
+    if [[ "$OFFLINE" != "True" ]]; then
+        tox -revenv --notest
+    fi
     # NOTE(mtreinish): Respect constraints on tempest verify-config venv
     tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     tox -evenv -- tempest verify-config -uro $tmp_cfg_file

From 1b1cc8c1d491b1469c7082d28d3e4a3a8a4a4fd9 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 1 Mar 2016 13:14:39 +1100
Subject: [PATCH 1214/3333] yum_install_package: fix errexit and retry

Since I93e9f312a94aeb086925e069a83ec1d3d3419423 yum_install isn't safe
under errexit.  This means it really only works when called by
tools/install_prereqs.sh because for some reason, we don't set that
there.

However, there is a problem with the retry logic when detecting failed
installs.  A failed package install should stop further progress, but
with the current retry logic it just goes ahead and retries the
installation, which then incorrectly passes.  You can see this
happening in a test like [1].

In our detection scripts, make a failed package or missing packages
exit with error-code 2, and "die" when we see this to correctly stop.

[1] http://logs.openstack.org/81/285881/1/check/gate-tempest-dsvm-platform-fedora23-nv/a83be30/logs/devstacklog.txt.gz

Change-Id: I4ea5515fa8e82a66aefa3ec3a48b823b645274f7
---
 functions-common | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index 2b23402b54..72ac3fd96a 100644
--- a/functions-common
+++ b/functions-common
@@ -1302,13 +1302,14 @@ function yum_install {
 
     time_start "yum_install"
 
-    # Warning: this would not work if yum output message
-    # have been translated to another language
+    # - We run with LC_ALL=C so string matching *should* be OK
+    # - Exit 1 if the failure might get better with a retry.
+    # - Exit 2 if it is fatal.
     parse_yum_result='             \
         BEGIN { result=0 }         \
         /^YUM_FAILED/ { exit $2 }  \
-        /^No package/ { result=1 } \
-        /^Failed:/    { result=1 } \
+        /^No package/ { result=2 } \
+        /^Failed:/    { result=2 } \
         //{ print }                \
         END { exit result }'
 
@@ -1316,15 +1317,21 @@ function yum_install {
     # missing or failed packages are OK.
     # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
     (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
-        | awk "$parse_yum_result"
-    result=$?
-
-    if [ "$result" != 0 ]; then
-        echo $LINENO "${YUM:-yum}" install failure: $result
-    fi
+        | awk "$parse_yum_result" && result=$? || result=$?
 
     time_stop "yum_install"
 
+    # if we return 1, then the wrapper functions will run an update
+    # and try installing the package again as a defense against bad
+    # mirrors.  This can hide failures, especially when we have
+    # packages that are in the "Failed:" section because their rpm
+    # install scripts failed to run correctly (in this case, the
+    # package looks installed, so when the retry happens we just think
+    # the package is OK, and incorrectly continue on).
+    if [ "$result" == 2 ]; then
+        die "Detected fatal package install failure"
+    fi
+
     return "$result"
 }
 

From 0c985c8627da3db8c9766724e07295c726ac63df Mon Sep 17 00:00:00 2001
From: Mathieu Rohon <mathieu.rohon@gmail.com>
Date: Thu, 25 Feb 2016 10:00:36 +0000
Subject: [PATCH 1215/3333] Disable nova calls from tempest when heat is
 enabled

This patch ensures that lib/tempest doesn't call nova when heat is
enabled and nova is disabled.

Change-Id: I2debbae1bb82ecace1058e99ab172272393fb5ea
Closes-bug: #1549708
---
 lib/tempest | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index caf8f117d1..4cd94cd584 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -412,12 +412,15 @@ function configure_tempest {
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
             iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
-        # build a specialized heat flavor
-        available_flavors=$(nova flavor-list)
-        if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
-            nova flavor-create m1.heat 451 512 0 1
+        # Nova might not be enabled, especially when we want to test tempest scenario/API that only create Neutron resources
+        if is_service_enabled nova; then
+            # build a specialized heat flavor
+            available_flavors=$(nova flavor-list)
+            if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
+                nova flavor-create m1.heat 451 512 0 1
+            fi
+            iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi
-        iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
         iniset $TEMPEST_CONFIG orchestration stack_owner_role "_member_"
     fi

From 304f4ce87c4708a35424c629e5ebd18fef90076c Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 1 Mar 2016 10:44:05 -0500
Subject: [PATCH 1216/3333] Add note about the periodic proposal job to the
 header

Now that the devstack pluging periodic proposal job is in place,
add a note to the header to try to head off confusion.

Change-Id: I1c740ff768f831548970142a8bd024abe1763fdf
---
 data/devstack-plugins-registry.header | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 687db0441c..c46ed97ab5 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -1,3 +1,8 @@
+..
+  Note to patch submitters: this file is covered by a periodic proposal
+  job.  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header instead of this one.
+
 ==========================
  DevStack Plugin Registry
 ==========================

From bb40df57145d35be1199cb816f702702f6cd38b3 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 1 Mar 2016 18:12:48 -0500
Subject: [PATCH 1217/3333] Increase Plugin Name column width by 10 in devstack
 plugins list

Change-Id: I62b1dca87ca8df4335a062caaf5e6a3e76e9101a
---
 data/devstack-plugins-registry.header   | 6 +++---
 tools/generate-devstack-plugins-list.sh | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 687db0441c..82737bc59e 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -14,6 +14,6 @@ The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
 
-+------------------+-------------------------------------------------------------------------+
-|Plugin Name       |URL                                                                      |
-+------------------+-------------------------------------------------------------------------+
++----------------------------+-------------------------------------------------------------------------+
+|Plugin Name                 |URL                                                                      |
++----------------------------+-------------------------------------------------------------------------+
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index b7817a0096..8a1f743b27 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -46,10 +46,10 @@ test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-regis
 sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
 
 for k in ${sorted_plugins}; do
-    project=${k:0:18}
+    project=${k:0:28}
     giturl="git://git.openstack.org/openstack/${k:0:26}"
-    printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
-    printf "+------------------+-------------------------------------------------------------------------+\n"
+    printf "|%-28s|%-73s|\n" "${project}" "${giturl}"
+    printf "+----------------------------+-------------------------------------------------------------------------+\n"
 done
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer

From 37dddb73fd17308fa3fbb127f6e49c1bb06f89e7 Mon Sep 17 00:00:00 2001
From: Ralf Haferkamp <rhafer@suse.de>
Date: Wed, 2 Mar 2016 15:25:57 +0100
Subject: [PATCH 1218/3333] Fix is_suse() check for openSUSE distros

We need to do a substring match on the vendor here. As most releases return
"openSUSE project" for the vendor.

Change-Id: Ia05db8d93b5e3f42cb6a9c8d77616ca9f7c32039
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index a26cc50db6..1452e2366b 100644
--- a/functions-common
+++ b/functions-common
@@ -433,7 +433,7 @@ function is_suse {
         GetOSVersion
     fi
 
-    [ "$os_VENDOR" = "openSUSE" ] || [ "$os_VENDOR" = "SUSE LINUX" ]
+    [[ "$os_VENDOR" =~ (openSUSE) || "$os_VENDOR" == "SUSE LINUX" ]]
 }
 
 

From 174986db21ebf3c20ba28c873e855629737a5b86 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Wed, 2 Mar 2016 03:28:06 +0000
Subject: [PATCH 1219/3333] Add pg_createcluster creating process for psql
 version after 9.3

postgresql 9.3 don't create /etc/postgresql and related conf file by
default. So we need start the pg_createcluster in devstack if has not
started after package installed.

Change-Id: I2b348658d79b23b5f21871b33d8023499b2fb956
Close-bug: #1552051
---
 lib/databases/postgresql | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 852bac4906..14425a53b7 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -47,7 +47,7 @@ function recreate_database_postgresql {
 }
 
 function configure_database_postgresql {
-    local pg_conf pg_dir pg_hba root_roles
+    local pg_conf pg_dir pg_hba root_roles version
     echo_summary "Configuring and starting PostgreSQL"
     if is_fedora; then
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
@@ -56,6 +56,13 @@ function configure_database_postgresql {
             sudo postgresql-setup initdb
         fi
     elif is_ubuntu; then
+        version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`
+        if vercmp $version '>=' 9.3; then
+            if [ -z "`pg_lsclusters -h`" ]; then
+                echo 'No PostgreSQL clusters exist; will create one'
+                sudo pg_createcluster $version main --start
+            fi
+        fi
         pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
         pg_hba=$pg_dir/pg_hba.conf
         pg_conf=$pg_dir/postgresql.conf

From 899dfeef466914c6695e6f3baa1c6576e784da8f Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Thu, 3 Mar 2016 11:27:53 +0100
Subject: [PATCH 1220/3333] Fix lsb installation for SUSE

zypper has a "-n" (non-interactive) switch. "-y" is not known
as a global option.

Change-Id: I6537529e91c12c5f0d15a9faa2cca8aedaf7d956
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index a26cc50db6..d6e466357a 100644
--- a/functions-common
+++ b/functions-common
@@ -322,7 +322,7 @@ function _ensure_lsb_release {
         # XXX: old code paths seem to have assumed SUSE platforms also
         # had "yum".  Keep this ordered above yum so we don't try to
         # install the rh package.  suse calls it just "lsb"
-        sudo zypper -y install lsb
+        sudo zypper -n install lsb
     elif [[ -x $(which dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
     elif [[ -x $(which yum 2>/dev/null) ]]; then

From f85a7e90f02ca691545cba2d2ce03aef671c9f15 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 3 Mar 2016 10:33:17 +0000
Subject: [PATCH 1221/3333] Ironic: Set DEFAULT_IMAGE_NAME to full disk image
 for agent

The agent_* drivers in Ironic are not yet capable of deploying partition
images. The code in DevStack was aware of that but it was looking at the
agent_ssh driver specifically.

This patch is fixing this assumption and extending that conditional for
all agent drivers.

Change-Id: I416faa9ef6fba9621cd664d5a0747b1e80e281d1
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 7294f7b716..8f595eff68 100644
--- a/stackrc
+++ b/stackrc
@@ -625,7 +625,7 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
         ironic)
             # Ironic can do both partition and full disk images, depending on the driver
-            if [[ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]]; then
+            if [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]]; then
                 DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-disk}
             else
                 DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}

From 7976aacdf6827558d01fffa0320fcc9354e32094 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 3 Mar 2016 15:30:49 +0100
Subject: [PATCH 1222/3333] worlddump: log command failure details

If a command we trigger fails for some reason, it's worth logging
details about the failure (like return code).

Change-Id: Ib19aa474eccdd11e138a4f55e125935b621bca05
---
 tools/worlddump.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 01f601cea8..72a257fa8c 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -58,8 +58,8 @@ def _dump_cmd(cmd):
     try:
         subprocess.check_call(cmd, shell=True)
         print
-    except subprocess.CalledProcessError:
-        print "*** Failed to run: %s" % cmd
+    except subprocess.CalledProcessError as e:
+        print "*** Failed to run '%(cmd)s': %(err)s" % {'cmd': cmd, 'err': e}
 
 
 def _find_cmd(cmd):

From 718512c4d247682372b7e159c6adfb1514ab25b8 Mon Sep 17 00:00:00 2001
From: Evgeny Antyshev <eantyshev@virtuozzo.com>
Date: Thu, 3 Mar 2016 14:47:58 +0000
Subject: [PATCH 1223/3333] Introduce Virtuozzo distribution

Virtuozzo is a RHEL-based distribution serving as a platform OS
to host proprietary container virtualization
(formerly, Parallels Cloud Server).

We moved away from CloudLinux distribution, which has actually
no support in Devstack (no such clause in is_fedora).
As it was us who introduced CloudLinux, by this patch
we replace it with Virtuozzo distribution.

More info on Virtuozzo company here: http://virtuozzo.com

Change-Id: Ib8a77e4611ebc05bc0aa50bb83ab79c412e21c74
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index a26cc50db6..90217c955f 100644
--- a/functions-common
+++ b/functions-common
@@ -380,7 +380,8 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
-        "$os_VENDOR" =~ (OracleLinux) ]]; then
+        "$os_VENDOR" =~ (OracleLinux) || \
+        "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
@@ -421,7 +422,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
-        [ "$os_VENDOR" = "CloudLinux" ] || [ "$os_VENDOR" = "kvmibm" ]
+        [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
 }
 
 

From 5fe81c50a2606b9763676e40b4a1083c5a72e58a Mon Sep 17 00:00:00 2001
From: twm2016 <TM2086@att.com>
Date: Fri, 26 Feb 2016 11:44:57 -0600
Subject: [PATCH 1224/3333] Add error handling for euch.sh volume creation

Error handling for volume creation calls die with the appropriate
 message.

Change-Id: Ib095992384edf895aaf78cb4115702d6a0675a3f
Closes-Bug: #1206180
---
 exercises/euca.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/exercises/euca.sh b/exercises/euca.sh
index c2957e222b..60e7d8ca29 100755
--- a/exercises/euca.sh
+++ b/exercises/euca.sh
@@ -17,7 +17,6 @@ set -o errexit
 # an error.  It is also useful for following allowing as the install occurs.
 set -o xtrace
 
-
 # Settings
 # ========
 
@@ -89,7 +88,8 @@ if is_service_enabled c-vol && ! is_service_enabled n-cell && [ "$VIRT_DRIVER" !
     VOLUME_ZONE=`euca-describe-availability-zones | head -n1 | cut -f2`
     die_if_not_set $LINENO VOLUME_ZONE "Failure to find zone for volume"
 
-    VOLUME=`euca-create-volume -s 1 -z $VOLUME_ZONE | cut -f2`
+    VOLUME=`euca-create-volume -s 1 -z $VOLUME_ZONE` || die $LINENO "Failure to create volume"
+    VOLUME=`echo "$VOLUME" | cut -f2`
     die_if_not_set $LINENO VOLUME "Failure to create volume"
 
     # Test that volume has been created

From 96d895d8717a476b5ad2f5278762951e1a89bdd7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 4 Mar 2016 06:26:51 +0000
Subject: [PATCH 1225/3333] Updated from generate-devstack-plugins-list

Change-Id: I01587633625087d190e879c88c53730efa01cd16
---
 doc/source/plugin-registry.rst | 251 ++++++++++++++++++++++++---------
 1 file changed, 181 insertions(+), 70 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b96883ad9c..29b743ff2b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,7 +1,7 @@
 ..
-  Note to reviewers: the intent of this file is to be easy for
-  community members to update. As such fast approving (single core +2)
-  is fine as long as you've identified that the plugin listed actually exists.
+  Note to patch submitters: this file is covered by a periodic proposal
+  job.  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header instead of this one.
 
 ==========================
  DevStack Plugin Registry
@@ -12,44 +12,186 @@ a lot of projects. The following is a list of plugins that currently
 exist. Any project that wishes to list their plugin here is welcomed
 to.
 
-Official OpenStack Projects
-===========================
-
-The following are plugins that exist for official OpenStack projects.
-
-+------------------+---------------------------------------------+--------------------+
-|Plugin Name       |URL                                          |Comments            |
-+------------------+---------------------------------------------+--------------------+
-|aodh              |git://git.openstack.org/openstack/aodh       | alarming           |
-+------------------+---------------------------------------------+--------------------+
-|barbican          |git://git.openstack.org/openstack/barbican   | key management     |
-+------------------+---------------------------------------------+--------------------+
-|ceilometer        |git://git.openstack.org/openstack/ceilometer | metering           |
-+------------------+---------------------------------------------+--------------------+
-|congress          |git://git.openstack.org/openstack/congress   | governance         |
-+------------------+---------------------------------------------+--------------------+
-|cue               |git://git.openstack.org/openstack/cue        | message-broker     |
-+------------------+---------------------------------------------+--------------------+
-|gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
-+------------------+---------------------------------------------+--------------------+
-|ironic            |git://git.openstack.org/openstack/ironic     | baremetal          |
-+------------------+---------------------------------------------+--------------------+
-|magnum            |git://git.openstack.org/openstack/magnum     |                    |
-+------------------+---------------------------------------------+--------------------+
-|manila            |git://git.openstack.org/openstack/manila     | file shares        |
-+------------------+---------------------------------------------+--------------------+
-|mistral           |git://git.openstack.org/openstack/mistral    |                    |
-+------------------+---------------------------------------------+--------------------+
-|rally             |git://git.openstack.org/openstack/rally      |                    |
-+------------------+---------------------------------------------+--------------------+
-|sahara            |git://git.openstack.org/openstack/sahara     |                    |
-+------------------+---------------------------------------------+--------------------+
-|trove             |git://git.openstack.org/openstack/trove      |                    |
-+------------------+---------------------------------------------+--------------------+
-|zaqar             |git://git.openstack.org/openstack/zaqar      |                    |
-+------------------+---------------------------------------------+--------------------+
+Detected Plugins
+================
 
+The following are plugins that a script has found in the openstack/
+namespace, which includes but is not limited to official OpenStack
+projects.
 
++----------------------------+-------------------------------------------------------------------------+
+|Plugin Name                 |URL                                                                      |
++----------------------------+-------------------------------------------------------------------------+
+|aodh                        |git://git.openstack.org/openstack/aodh                                   |
++----------------------------+-------------------------------------------------------------------------+
+|app-catalog-ui              |git://git.openstack.org/openstack/app-catalog-ui                         |
++----------------------------+-------------------------------------------------------------------------+
+|astara                      |git://git.openstack.org/openstack/astara                                 |
++----------------------------+-------------------------------------------------------------------------+
+|barbican                    |git://git.openstack.org/openstack/barbican                               |
++----------------------------+-------------------------------------------------------------------------+
+|blazar                      |git://git.openstack.org/openstack/blazar                                 |
++----------------------------+-------------------------------------------------------------------------+
+|ceilometer                  |git://git.openstack.org/openstack/ceilometer                             |
++----------------------------+-------------------------------------------------------------------------+
+|ceilometer-powervm          |git://git.openstack.org/openstack/ceilometer-powervm                     |
++----------------------------+-------------------------------------------------------------------------+
+|cerberus                    |git://git.openstack.org/openstack/cerberus                               |
++----------------------------+-------------------------------------------------------------------------+
+|cloudkitty                  |git://git.openstack.org/openstack/cloudkitty                             |
++----------------------------+-------------------------------------------------------------------------+
+|collectd-ceilometer-plugin  |git://git.openstack.org/openstack/collectd-ceilometer-plugin             |
++----------------------------+-------------------------------------------------------------------------+
+|congress                    |git://git.openstack.org/openstack/congress                               |
++----------------------------+-------------------------------------------------------------------------+
+|cue                         |git://git.openstack.org/openstack/cue                                    |
++----------------------------+-------------------------------------------------------------------------+
+|designate                   |git://git.openstack.org/openstack/designate                              |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-amqp1       |git://git.openstack.org/openstack/devstack-plugin-amqp1                  |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-bdd         |git://git.openstack.org/openstack/devstack-plugin-bdd                    |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-ceph        |git://git.openstack.org/openstack/devstack-plugin-ceph                   |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-glusterfs   |git://git.openstack.org/openstack/devstack-plugin-glusterfs              |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-hdfs        |git://git.openstack.org/openstack/devstack-plugin-hdfs                   |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-pika        |git://git.openstack.org/openstack/devstack-plugin-pika                   |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-sheepdog    |git://git.openstack.org/openstack/devstack-plugin-sheepdog               |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-zmq         |git://git.openstack.org/openstack/devstack-plugin-zmq                    |
++----------------------------+-------------------------------------------------------------------------+
+|dragonflow                  |git://git.openstack.org/openstack/dragonflow                             |
++----------------------------+-------------------------------------------------------------------------+
+|drbd-devstack               |git://git.openstack.org/openstack/drbd-devstack                          |
++----------------------------+-------------------------------------------------------------------------+
+|ec2-api                     |git://git.openstack.org/openstack/ec2-api                                |
++----------------------------+-------------------------------------------------------------------------+
+|freezer                     |git://git.openstack.org/openstack/freezer                                |
++----------------------------+-------------------------------------------------------------------------+
+|freezer-api                 |git://git.openstack.org/openstack/freezer-api                            |
++----------------------------+-------------------------------------------------------------------------+
+|freezer-web-ui              |git://git.openstack.org/openstack/freezer-web-ui                         |
++----------------------------+-------------------------------------------------------------------------+
+|gce-api                     |git://git.openstack.org/openstack/gce-api                                |
++----------------------------+-------------------------------------------------------------------------+
+|gnocchi                     |git://git.openstack.org/openstack/gnocchi                                |
++----------------------------+-------------------------------------------------------------------------+
+|ironic                      |git://git.openstack.org/openstack/ironic                                 |
++----------------------------+-------------------------------------------------------------------------+
+|ironic-inspector            |git://git.openstack.org/openstack/ironic-inspector                       |
++----------------------------+-------------------------------------------------------------------------+
+|kingbird                    |git://git.openstack.org/openstack/kingbird                               |
++----------------------------+-------------------------------------------------------------------------+
+|kuryr                       |git://git.openstack.org/openstack/kuryr                                  |
++----------------------------+-------------------------------------------------------------------------+
+|magnum                      |git://git.openstack.org/openstack/magnum                                 |
++----------------------------+-------------------------------------------------------------------------+
+|manila                      |git://git.openstack.org/openstack/manila                                 |
++----------------------------+-------------------------------------------------------------------------+
+|mistral                     |git://git.openstack.org/openstack/mistral                                |
++----------------------------+-------------------------------------------------------------------------+
+|monasca-api                 |git://git.openstack.org/openstack/monasca-api                            |
++----------------------------+-------------------------------------------------------------------------+
+|murano                      |git://git.openstack.org/openstack/murano                                 |
++----------------------------+-------------------------------------------------------------------------+
+|networking-6wind            |git://git.openstack.org/openstack/networking-6wind                       |
++----------------------------+-------------------------------------------------------------------------+
+|networking-bagpipe          |git://git.openstack.org/openstack/networking-bagpipe                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-bgpvpn           |git://git.openstack.org/openstack/networking-bgpvpn                      |
++----------------------------+-------------------------------------------------------------------------+
+|networking-calico           |git://git.openstack.org/openstack/networking-calico                      |
++----------------------------+-------------------------------------------------------------------------+
+|networking-cisco            |git://git.openstack.org/openstack/networking-cisco                       |
++----------------------------+-------------------------------------------------------------------------+
+|networking-fortinet         |git://git.openstack.org/openstack/networking-fortinet                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-generic-switch   |git://git.openstack.org/openstack/networking-generic-switch              |
++----------------------------+-------------------------------------------------------------------------+
+|networking-infoblox         |git://git.openstack.org/openstack/networking-infoblox                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-l2gw             |git://git.openstack.org/openstack/networking-l2gw                        |
++----------------------------+-------------------------------------------------------------------------+
+|networking-midonet          |git://git.openstack.org/openstack/networking-midonet                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-mlnx             |git://git.openstack.org/openstack/networking-mlnx                        |
++----------------------------+-------------------------------------------------------------------------+
+|networking-nec              |git://git.openstack.org/openstack/networking-nec                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-odl              |git://git.openstack.org/openstack/networking-odl                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-ofagent          |git://git.openstack.org/openstack/networking-ofagent                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-ovn              |git://git.openstack.org/openstack/networking-ovn                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-ovs-dpdk         |git://git.openstack.org/openstack/networking-ovs-dpdk                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-plumgrid         |git://git.openstack.org/openstack/networking-plumgrid                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-powervm          |git://git.openstack.org/openstack/networking-powervm                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-sfc              |git://git.openstack.org/openstack/networking-sfc                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-vsphere          |git://git.openstack.org/openstack/networking-vsphere                     |
++----------------------------+-------------------------------------------------------------------------+
+|neutron                     |git://git.openstack.org/openstack/neutron                                |
++----------------------------+-------------------------------------------------------------------------+
+|neutron-lbaas               |git://git.openstack.org/openstack/neutron-lbaas                          |
++----------------------------+-------------------------------------------------------------------------+
+|neutron-lbaas-dashboard     |git://git.openstack.org/openstack/neutron-lbaas-dashboard                |
++----------------------------+-------------------------------------------------------------------------+
+|neutron-vpnaas              |git://git.openstack.org/openstack/neutron-vpnaas                         |
++----------------------------+-------------------------------------------------------------------------+
+|nova-docker                 |git://git.openstack.org/openstack/nova-docker                            |
++----------------------------+-------------------------------------------------------------------------+
+|nova-powervm                |git://git.openstack.org/openstack/nova-powervm                           |
++----------------------------+-------------------------------------------------------------------------+
+|octavia                     |git://git.openstack.org/openstack/octavia                                |
++----------------------------+-------------------------------------------------------------------------+
+|osprofiler                  |git://git.openstack.org/openstack/osprofiler                             |
++----------------------------+-------------------------------------------------------------------------+
+|rally                       |git://git.openstack.org/openstack/rally                                  |
++----------------------------+-------------------------------------------------------------------------+
+|sahara                      |git://git.openstack.org/openstack/sahara                                 |
++----------------------------+-------------------------------------------------------------------------+
+|sahara-dashboard            |git://git.openstack.org/openstack/sahara-dashboard                       |
++----------------------------+-------------------------------------------------------------------------+
+|scalpels                    |git://git.openstack.org/openstack/scalpels                               |
++----------------------------+-------------------------------------------------------------------------+
+|searchlight                 |git://git.openstack.org/openstack/searchlight                            |
++----------------------------+-------------------------------------------------------------------------+
+|senlin                      |git://git.openstack.org/openstack/senlin                                 |
++----------------------------+-------------------------------------------------------------------------+
+|smaug                       |git://git.openstack.org/openstack/smaug                                  |
++----------------------------+-------------------------------------------------------------------------+
+|solum                       |git://git.openstack.org/openstack/solum                                  |
++----------------------------+-------------------------------------------------------------------------+
+|tacker                      |git://git.openstack.org/openstack/tacker                                 |
++----------------------------+-------------------------------------------------------------------------+
+|tap-as-a-service            |git://git.openstack.org/openstack/tap-as-a-service                       |
++----------------------------+-------------------------------------------------------------------------+
+|tricircle                   |git://git.openstack.org/openstack/tricircle                              |
++----------------------------+-------------------------------------------------------------------------+
+|trove                       |git://git.openstack.org/openstack/trove                                  |
++----------------------------+-------------------------------------------------------------------------+
+|trove-dashboard             |git://git.openstack.org/openstack/trove-dashboard                        |
++----------------------------+-------------------------------------------------------------------------+
+|vitrage                     |git://git.openstack.org/openstack/vitrage                                |
++----------------------------+-------------------------------------------------------------------------+
+|vitrage-dashboard           |git://git.openstack.org/openstack/vitrage-dashboard                      |
++----------------------------+-------------------------------------------------------------------------+
+|vmware-nsx                  |git://git.openstack.org/openstack/vmware-nsx                             |
++----------------------------+-------------------------------------------------------------------------+
+|watcher                     |git://git.openstack.org/openstack/watcher                                |
++----------------------------+-------------------------------------------------------------------------+
+|watcher-dashboard           |git://git.openstack.org/openstack/watcher-dashboard                      |
++----------------------------+-------------------------------------------------------------------------+
+|zaqar                       |git://git.openstack.org/openstack/zaqar                                  |
++----------------------------+-------------------------------------------------------------------------+
 
 Drivers
 =======
@@ -78,34 +220,3 @@ Alternate Configs
 +-------------+------------------------------------------------------------+------------+
 |             |                                                            |            |
 +-------------+------------------------------------------------------------+------------+
-
-Additional Services
-===================
-
-+-----------------+------------------------------------------------------------+------------+
-| Plugin Name     | URL                                                        | Comments   |
-|                 |                                                            |            |
-+-----------------+------------------------------------------------------------+------------+
-|amqp1            |git://git.openstack.org/openstack/devstack-plugin-amqp1     |            |
-+-----------------+------------------------------------------------------------+------------+
-|bdd              |git://git.openstack.org/openstack/devstack-plugin-bdd       |            |
-+-----------------+------------------------------------------------------------+------------+
-|ec2-api          |git://git.openstack.org/openstack/ec2-api                   |[as1]_      |
-+-----------------+------------------------------------------------------------+------------+
-|glusterfs        |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
-+-----------------+------------------------------------------------------------+------------+
-|hdfs             |git://git.openstack.org/openstack/devstack-plugin-hdfs      |            |
-+-----------------+------------------------------------------------------------+------------+
-|ironic-inspector |git://git.openstack.org/openstack/ironic-inspector          |            |
-+-----------------+------------------------------------------------------------+------------+
-|pika             |git://git.openstack.org/openstack/devstack-plugin-pika      |            |
-+-----------------+------------------------------------------------------------+------------+
-|sheepdog         |git://git.openstack.org/openstack/devstack-plugin-sheepdog  |            |
-+-----------------+------------------------------------------------------------+------------+
-|zmq              |git://git.openstack.org/openstack/devstack-plugin-zmq       |            |
-+-----------------+------------------------------------------------------------+------------+
-|                 |                                                            |            |
-+-----------------+------------------------------------------------------------+------------+
-
-.. [as1] first functional devstack plugin, hence why used in most of
-         the examples.

From dab3901d9aa9d4485495d066c58a3e82c76e2261 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Thu, 3 Mar 2016 12:11:15 +0100
Subject: [PATCH 1226/3333] Use "command -v" instead of "which" to find path

If /usr/bin/which is not available, the current code
doesn't detect i.e. /usr/bin/zypper . Using "command -v" solved
the problem.

Change-Id: I1c281c3184d69cd9dc2418295b6a392d8e5693e0
---
 functions-common | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index d6e466357a..0614b78aff 100644
--- a/functions-common
+++ b/functions-common
@@ -312,20 +312,20 @@ declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 # user if not available.  Note can't use generic install_package*
 # because they depend on this!
 function _ensure_lsb_release {
-    if [[ -x $(which lsb_release 2>/dev/null) ]]; then
+    if [[ -x $(command -v lsb_release 2>/dev/null) ]]; then
         return
     fi
 
-    if [[ -x $(which apt-get 2>/dev/null) ]]; then
+    if [[ -x $(command -v apt-get 2>/dev/null) ]]; then
         sudo apt-get install -y lsb-release
-    elif [[ -x $(which zypper 2>/dev/null) ]]; then
+    elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         # XXX: old code paths seem to have assumed SUSE platforms also
         # had "yum".  Keep this ordered above yum so we don't try to
         # install the rh package.  suse calls it just "lsb"
         sudo zypper -n install lsb
-    elif [[ -x $(which dnf 2>/dev/null) ]]; then
+    elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
-    elif [[ -x $(which yum 2>/dev/null) ]]; then
+    elif [[ -x $(command -v yum 2>/dev/null) ]]; then
         # all rh patforms (fedora, centos, rhel) have this pkg
         sudo yum install -y redhat-lsb-core
     else

From c15d59157c4aab0147ab5d388642c6c08cae875a Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Fri, 4 Mar 2016 16:06:24 +0100
Subject: [PATCH 1227/3333] Ignore errors when uninstalling a pkg with zypper

I.e. when trying to uninstall python-pip and it's not installed,
don't exit.

Change-Id: I21ac715a0090ad01811af47f23c61823dfa65629
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 2c498a0b1f..371c4f9e35 100644
--- a/functions-common
+++ b/functions-common
@@ -1286,7 +1286,7 @@ function uninstall_package {
     elif is_fedora; then
         sudo ${YUM:-yum} remove -y "$@" ||:
     elif is_suse; then
-        sudo zypper rm "$@"
+        sudo zypper rm "$@" ||:
     else
         exit_distro_not_supported "uninstalling packages"
     fi

From 6cf412bb7ee2f667c38cf113440018b1ffcc7546 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 4 Mar 2016 10:36:10 -0500
Subject: [PATCH 1228/3333] Update account generator calls with correct
 password

Change I380dd20e5ed716a0bdf92aa02c3730359b8136e4 updated the tempest
configuration to stop creating a bunch of globals. But as part of
that refactor it started using $admin_password as the password
argument for tempest-account generator, which is never defined.
This commit rectifies the situation by using the correct variable
$password.

Change-Id: Ieeed58751e5784020e04bcc2911ac74791662110
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 8d3bf7cd6b..4fb3e5edca 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -554,9 +554,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From f21cc1fd9664575dbc9c31cff1b09ac16fdef985 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 4 Mar 2016 11:08:32 -0500
Subject: [PATCH 1229/3333] Use new use_neutron variable

This uses the new use_neutron variable instead of the crazy class
path. This helps us test the use of this in our jobs.

Change-Id: Ic6d0cc4b7a0df6b3f5336ee58886f7edff26e846
Depends-On: I1c2eb51d10ba6370492a911f59370b9870646a38
---
 lib/neutron-legacy | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7d6e881881..e06a020f43 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -486,8 +486,7 @@ function configure_neutron {
 }
 
 function create_nova_conf_neutron {
-    iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
-
+    iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
     iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
@@ -502,7 +501,6 @@ function create_nova_conf_neutron {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
         iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-        iniset $NOVA_CONF DEFAULT security_group_api neutron
     fi
 
     # optionally set options in nova_conf

From 4b186badaadc07fc4478c77988489d31d9375de7 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 1 Mar 2016 10:33:23 -0500
Subject: [PATCH 1230/3333] Remove devstack plugins proposal job footer

Aside from notes, the content of the footer is entirely redundant
with the detected plugins list, so let's remove it.

Change-Id: I346b59705c5b0716a18087f6800f568fb1f4c9a8
---
 data/devstack-plugins-registry.footer | 28 ---------------------------
 1 file changed, 28 deletions(-)
 delete mode 100644 data/devstack-plugins-registry.footer

diff --git a/data/devstack-plugins-registry.footer b/data/devstack-plugins-registry.footer
deleted file mode 100644
index 669cb8d574..0000000000
--- a/data/devstack-plugins-registry.footer
+++ /dev/null
@@ -1,28 +0,0 @@
-
-Drivers
-=======
-
-+--------------------+-------------------------------------------------+------------------+
-|Plugin Name         |URL                                              |Comments          |
-+--------------------+-------------------------------------------------+------------------+
-|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
-+--------------------+-------------------------------------------------+------------------+
-|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
-+--------------------+-------------------------------------------------+------------------+
-
-.. [d1] demonstrates example of installing 3rd party SDN controller
-.. [d2] demonstrates a pretty advanced set of modes that that allow
-        one to run OpenDayLight either from a pre-existing install, or
-        also from source
-
-Alternate Configs
-=================
-
-+-------------+------------------------------------------------------------+------------+
-| Plugin Name | URL                                                        | Comments   |
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+
-|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
-+-------------+------------------------------------------------------------+------------+
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+

From c21194875e8dc4dd7a2c4150c6b5ae017e65c35d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 7 Mar 2016 10:25:41 +1100
Subject: [PATCH 1231/3333] Add some notes on trove image

The trove image is one of the larger ones we cache, and after
double-checking it is still used as part of the
gate-tempest-dsvm-trove tests (although integration tests seem use
their own dib-built version)

Add some notes to clarify the situation with this image.

Change-Id: I2319dd5811d6bd215d1e8778eca5b4c9399f0efb
---
 stackrc | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index 7294f7b716..27f53616c4 100644
--- a/stackrc
+++ b/stackrc
@@ -639,11 +639,17 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
     DOWNLOAD_DEFAULT_IMAGES=False
 fi
 
-# Staging Area for New Images, have them here for at least 24hrs for nodepool
-# to cache them otherwise the failure rates in the gate are too high
+# Staging area for new images.  These images are cached by a run of
+# ./tools/image_list.sh during CI image build (see
+# project-config:nodepool/elements/cache-devstack/extra-data.d/55-cache-devstack-repos).
+#
+# To avoid CI failures grabbing the images, new images should be here
+# for at least 24hrs (nodepool builds images at 14:00UTC) so the they
+# are in the cache.
 PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
 if [[ "$PRECACHE_IMAGES" == "True" ]]; then
-
+    # required for trove devstack tests; see
+    #  git.openstack.org/cgit/openstack/trove/tree/devstack/plugin.sh
     IMAGE_URL="http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"
     if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
         IMAGE_URLS+=",$IMAGE_URL"

From c709d50afed14308c3cef4a823f440ca7972ba6f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 7 Mar 2016 14:00:58 +1100
Subject: [PATCH 1232/3333] Update bashate to 0.5.0

Update bashate to 0.5.0 release.  We got things ready for this with
I3fd5d55236e90c2f2c25243af87adaf0c1b763e2.

I'm not sure what I was thinking in
I9e4b1c0dc9e0f709d8e76f9c9bf1c9478b2605ed when I added ".orig" files
to the list of files to check.  Ignore diff/merge files.

Change-Id: I8bb0c8b39972abb775b4e5556e79d2e17005bc8c
---
 tox.ini | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tox.ini b/tox.ini
index ef557fbffe..3dfc37711c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ install_command = pip install {opts} {packages}
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.4.0}
+   {env:BASHATE_INSTALL_PATH:bashate==0.5.0}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
@@ -22,9 +22,10 @@ commands = bash -c "find {toxinidir}             \
          -not -name \*~                          \
          -not -name \*.md                        \
          -not -name stack-screenrc               \
+         -not -name \*.orig                      \
+         -not -name \*.rej                       \
          \(                                      \
           -name \*.sh -or                        \
-          -name \*.orig -or                      \
           -name \*rc -or                         \
           -name functions\* -or                  \
           -wholename \*/inc/\* -or               \

From a440bf8629ac4103244ab090a471f68852412a1c Mon Sep 17 00:00:00 2001
From: Tracy Jones <tjones@vmware.com>
Date: Mon, 7 Mar 2016 10:49:51 -0800
Subject: [PATCH 1233/3333] Ignore vmdk files as well as other image types

Change-Id: I012b21181f1e54a1e4a3707b0fdf8c0afa6222c2
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index a5a17c2b75..e813cffff7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@ accrc
 doc/files
 doc/build
 files/*.gz
+files/*.vmdk
 files/*.rpm
 files/*.rpm.*
 files/*.qcow2

From 7b85723c0421affdb82a201bf4231c4d00c18599 Mon Sep 17 00:00:00 2001
From: Matthew Oliver <matt@oliver.net.au>
Date: Mon, 7 Mar 2016 18:21:29 +1100
Subject: [PATCH 1234/3333] Set the Swift max_file_size to 1/2 the loopback

Currently Devstack (and devstack gate) uses the default
max_file_size of for Swift (5GB). However the loopback file
is only 1 or 2 GB is size.

We are looking at setting a default FALLOCATE_RESERVE in swift
https://review.openstack.org/#/c/288011.
Because of this our max file size test fails due to the max_file_size
and devstacks loopback size being too small.

This patch sets this to a more sane size by default inside DevStack.
See the gerrit link above for more details.

Tempest uses a loopback of 6GB, so in this case the swift default of 5GB
should be fine.

Change-Id: If09eab7d16ae67bd252020e00e8812ff252f065b
---
 lib/swift | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/swift b/lib/swift
index b6c3ca49a3..8c5aa5e4e8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -71,17 +71,20 @@ if is_service_enabled g-api; then
     # only 1G we can not upload volume to image.
     # Increase Swift disk size up to 2G
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=2G
+    SWIFT_MAX_FILE_SIZE_DEFAULT=1073741824 # 1G
 else
     # DevStack will create a loop-back disk formatted as XFS to store the
     # swift data. Set ``SWIFT_LOOPBACK_DISK_SIZE`` to the disk size in
     # kilobytes.
     # Default is 1 gigabyte.
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=1G
+    SWIFT_MAX_FILE_SIZE_DEFAULT=536870912 # 512M
 fi
 
 # if tempest enabled the default size is 6 Gigabyte.
 if is_service_enabled tempest; then
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=${SWIFT_LOOPBACK_DISK_SIZE:-6G}
+    SWIFT_MAX_FILE_SIZE_DEFAULT=5368709122 # Swift default 5G
 fi
 
 SWIFT_LOOPBACK_DISK_SIZE=${SWIFT_LOOPBACK_DISK_SIZE:-$SWIFT_LOOPBACK_DISK_SIZE_DEFAULT}
@@ -127,6 +130,10 @@ SWIFT_LOG_TOKEN_LENGTH=${SWIFT_LOG_TOKEN_LENGTH:-12}
 # Swift API
 SWIFT_MAX_HEADER_SIZE=${SWIFT_MAX_HEADER_SIZE:-16384}
 
+# Set ``SWIFT_MAX_FILE_SIZE`` to configure the maximum file size in Swift API
+# Default 500MB because the loopback file used for swift could be 1 or 2 GB
+SWIFT_MAX_FILE_SIZE=${SWIFT_MAX_FILE_SIZE:-$SWIFT_MAX_FILE_SIZE_DEFAULT}
+
 # Set ``OBJECT_PORT_BASE``, ``CONTAINER_PORT_BASE``, ``ACCOUNT_PORT_BASE``
 # Port bases used in port number calculation for the service "nodes"
 # The specified port number will be used, the additional ports calculated by
@@ -462,6 +469,7 @@ EOF
     cp ${SWIFT_DIR}/etc/swift.conf-sample ${SWIFT_CONF_DIR}/swift.conf
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-hash swift_hash_path_suffix ${SWIFT_HASH}
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_header_size ${SWIFT_MAX_HEADER_SIZE}
+    iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_file_size ${SWIFT_MAX_FILE_SIZE}
 
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do

From 32bf2c4f6f36dbe6e0b68143810b0f4e5b5ae3b8 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Tue, 8 Mar 2016 12:24:52 +1100
Subject: [PATCH 1235/3333] Use extended keystone-manage bootstrap parameters

Use the additional keystone-manage parameters to setup the identity
endpoint in the service catalog rather than manually fetching a token
for this.

Change-Id: I6f5be1df205dee8f3251b4eb413e00ae64f00f07
---
 lib/keystone | 44 ++++++++++----------------------------------
 1 file changed, 10 insertions(+), 34 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 5ed7de9966..0b9cebc8f4 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -629,40 +629,16 @@ function stop_keystone {
 # - ``KEYSTONE_SERVICE_HOST``
 # - ``KEYSTONE_SERVICE_PORT``
 function bootstrap_keystone {
-
-    # Initialize keystone, this will create an 'admin' user, 'admin' project,
-    # 'admin' role, and assign the user the role on the project. These resources
-    # are created only if they do not already exist.
-    $KEYSTONE_BIN_DIR/keystone-manage bootstrap --bootstrap-password $ADMIN_PASSWORD
-
-    # Create the keystone service and endpoints. To do this with the new
-    # bootstrapping process, we need to get a token and use that token to
-    # interact with the new APIs. The token will only be used to create services
-    # and endpoints, thus creating a minimal service catalog.
-    # They are unset immediately after.
-    # TODO(stevemar): OpenStackClient and KeystoneClient do not have support to
-    # handle interactions that not return service catalogs. Eventually remove
-    # this section when the support is in place. Use token based auth for now.
-    local token_id
-    token_id=$(openstack token issue -c id -f value \
-        --os-username admin --os-project-name admin \
-        --os-user-domain-id default --os-project-domain-id default \
-        --os-identity-api-version 3 --os-auth-url $KEYSTONE_AUTH_URI \
-        --os-password $ADMIN_PASSWORD)
-
-    export OS_TOKEN=$token_id
-    export OS_URL=$KEYSTONE_AUTH_URI/v3
-    export OS_IDENTITY_API_VERSION=3
-
-    get_or_create_service "keystone" "identity" "Keystone Identity Service"
-    get_or_create_endpoint \
-        "identity" \
-        "$REGION_NAME" \
-        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-        "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
-
-    unset OS_TOKEN OS_URL OS_IDENTITY_API_VERSION
+    $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
+        --bootstrap-username admin \
+        --bootstrap-password "$ADMIN_PASSWORD" \
+        --bootstrap-project-name admin \
+        --bootstrap-role-name admin \
+        --bootstrap-service-name keystone \
+        --bootstrap-region-id "$REGION_NAME" \
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
 }
 
 # Restore xtrace

From f3b6feb712bf14b3e91c98e00ea021af47771231 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Mon, 7 Mar 2016 01:52:35 -0500
Subject: [PATCH 1236/3333] Don't abort devstack plugins proposal job due to
 absence of header/footer

Not having a header or footer should not be a fatal error
especially now that we have removed the footer entirely.

Change-Id: Ibbf3e513b8faa016dc2dac8d11ab4f499b3fc51c
---
 tools/generate-devstack-plugins-list.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 8a1f743b27..be3f60a136 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -41,7 +41,9 @@
 (
 declare -A plugins
 
-test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
+if [[ -r data/devstack-plugins-registry.header ]]; then
+    cat data/devstack-plugins-registry.header
+fi
 
 sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
 
@@ -52,7 +54,9 @@ for k in ${sorted_plugins}; do
     printf "+----------------------------+-------------------------------------------------------------------------+\n"
 done
 
-test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
+if [[ -r data/devstack-plugins-registry.footer ]]; then
+    cat data/devstack-plugins-registry.footer
+fi
 ) > doc/source/plugin-registry.rst
 
 if [[ -n ${1} ]]; then

From 6fff3cc03589cb0fdf02b4bedf1c35bcb000f28d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 8 Mar 2016 12:00:15 -0500
Subject: [PATCH 1237/3333] Fix sorting on LC_ALL=C platforms

We made assumptions on the platform for sorting purposes, which turned
out to break with new images being deployed. Explicitly setting LC_ALL
should make this work.

Change-Id: Id65f1bff8e38c777fa406d88ac6a2355d6033d94
---
 tests/test_package_ordering.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/test_package_ordering.sh b/tests/test_package_ordering.sh
index a568abf928..bfc2a1954f 100755
--- a/tests/test_package_ordering.sh
+++ b/tests/test_package_ordering.sh
@@ -7,6 +7,7 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 
 source $TOP/tests/unittest.sh
 
+export LC_ALL=en_US.UTF-8
 PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms $TOP/files/rpms-suse -type f)
 
 TMPDIR=$(mktemp -d)

From 8ff298a8715d39d8ac260afba1593b6ecf95b0ce Mon Sep 17 00:00:00 2001
From: Ronald Bradford <ronald.bradford@gmail.com>
Date: Tue, 8 Mar 2016 15:19:48 +0000
Subject: [PATCH 1238/3333] Updated deprecated keystone_authtoken option

* memcache_servers is a deprecated name for memcached_servers.
  See: keystonemiddleware/auth_token/__init__.py#n287

NOTE: memcache_serves in the cache section is valid option for
    oslo.cache.  See oslo_cache/_opts.py#n65

Depends-on: Id65f1bff8e38c777fa406d88ac6a2355d6033d94
Change-Id: I3e1230b139e710a0433e71ce118ca246d7c6a0e6
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 5ed7de9966..47de2b7819 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -484,7 +484,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
-    iniset $conf_file $section memcache_servers $SERVICE_HOST:11211
+    iniset $conf_file $section memcached_servers $SERVICE_HOST:11211
 }
 
 # init_keystone() - Initialize databases, etc.

From d1ee4cfdf935bc62a7752592624991f0646c501a Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 8 Mar 2016 15:25:16 -0500
Subject: [PATCH 1239/3333] Remove check for OVS_VERSION < 1.4

1.4 was released in 2012. I think we can assume everyone is running
something newer.

http://openvswitch.org/releases/NEWS-1.4.0

Change-Id: I3cfe99d2647800ae3ffb32c9e6749d03224c2967
---
 lib/neutron_plugins/openvswitch_agent | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 94a26898ad..e1c5a504a5 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -44,12 +44,6 @@ function neutron_plugin_configure_plugin_agent {
 
     # Setup agent for tunneling
     if [[ "$OVS_ENABLE_TUNNELING" == "True" ]]; then
-        # Verify tunnels are supported
-        # REVISIT - also check kernel module support for GRE and patch ports
-        OVS_VERSION=`ovs-vsctl --version | head -n 1 | grep -E -o "[0-9]+\.[0-9]+"`
-        if [ `vercmp_numbers "$OVS_VERSION" "1.4"` -lt "0" ] && ! is_service_enabled q-svc ; then
-            die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
-        fi
         iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
         iniset /$Q_PLUGIN_CONF_FILE ovs tunnel_bridge $OVS_TUNNEL_BRIDGE
     fi

From f0e5d230437c643b868d78c04dbc8a02df83c1e8 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 9 Mar 2016 13:02:25 -0500
Subject: [PATCH 1240/3333] Neutron guide: Add missing newline for code block

Change-Id: I4eb5ec05d9db525158d47c7b16bef04fb3965f1a
---
 doc/source/guides/neutron.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c8b5c4495f..cac7bb0152 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -546,6 +546,7 @@ automatically created by setting the ``OVS_BRIDGE_MAPPINGS`` to a list of
 physical network to bridge name associations with the following syntax:
 
 ::
+
     OVS_BRIDGE_MAPPINGS=net1name:bridge1name,net2name:bridge2name,<...>
 
 Also, ``OVS_BRIDGE_MAPPINGS`` has precedence over ``PHYSICAL_NETWORK`` and

From 084efc7158f60530205e5ccad2947ec3948b7f26 Mon Sep 17 00:00:00 2001
From: Waldemar Znoinski <waldemar.znoinski@intel.com>
Date: Wed, 9 Mar 2016 12:18:51 +0000
Subject: [PATCH 1241/3333] run tgt-admin --delete only if input not empty

This change provides better handling of tgtadm --op show
output as input of tgt-admin --delete command. In situation
where no output of the first command is present no tgt-admin
command is run.

Change-Id: Ief5e1d50dd679f4d47cffef29ff07e54cc37f80a
Closes-bug: 1554997
---
 lib/lvm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index ae6023a836..b9d7c390a2 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -124,7 +124,7 @@ function init_lvm_volume_group {
     if [ "$CINDER_ISCSI_HELPER" = "lioadm" ]; then
         sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
     else
-        sudo tgtadm --op show --mode target | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
+        sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
     fi
     _clean_lvm_volume_group $vg
 }

From 5c417a0133bde77e5dbe61072bd572415acf7fd8 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 10 Mar 2016 06:27:24 +0000
Subject: [PATCH 1242/3333] Updated from generate-devstack-plugins-list

Change-Id: I683b8208aedc71ce63012e470b2afbdef8856308
---
 doc/source/plugin-registry.rst | 28 ----------------------------
 1 file changed, 28 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 29b743ff2b..f31db5185c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -192,31 +192,3 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |zaqar                       |git://git.openstack.org/openstack/zaqar                                  |
 +----------------------------+-------------------------------------------------------------------------+
-
-Drivers
-=======
-
-+--------------------+-------------------------------------------------+------------------+
-|Plugin Name         |URL                                              |Comments          |
-+--------------------+-------------------------------------------------+------------------+
-|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
-+--------------------+-------------------------------------------------+------------------+
-|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
-+--------------------+-------------------------------------------------+------------------+
-
-.. [d1] demonstrates example of installing 3rd party SDN controller
-.. [d2] demonstrates a pretty advanced set of modes that that allow
-        one to run OpenDayLight either from a pre-existing install, or
-        also from source
-
-Alternate Configs
-=================
-
-+-------------+------------------------------------------------------------+------------+
-| Plugin Name | URL                                                        | Comments   |
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+
-|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
-+-------------+------------------------------------------------------------+------------+
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+

From 6b1f49910e1c55bd7a3fbc8d23ad97aa96225361 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 10 Mar 2016 12:23:09 -0500
Subject: [PATCH 1243/3333] Tip for single interface runs that are started
 remotely

Change-Id: I6e2870b5c409dd81a34cd9934f540d9558642f91
---
 doc/source/guides/neutron.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c8b5c4495f..67cf017f4c 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -19,6 +19,18 @@ physical interface can be used to transmit tenant network traffic,
 the OpenStack API traffic, and management traffic.
 
 
+.. warning::
+
+    When using a single interface networking setup, there will be a
+    temporary network outage as your IP address is moved from the
+    physical NIC of your machine, to the OVS bridge. If you are SSH'd
+    into the machine from another computer, there is a risk of being
+    disconnected from your ssh session (due to arp cache
+    invalidation), which would stop the stack.sh or leave it in an
+    unfinished state. In these cases, start stack.sh inside its own
+    screen session so it can continue to run.
+
+
 Physical Network Setup
 ----------------------
 

From 9ba49cd82631ada84b8458b370ac535985d57725 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 10 Mar 2016 15:45:40 -0600
Subject: [PATCH 1244/3333] Remove rejoin-stack.sh

This command has never completely worked to restart DevStack.
It periodically prompts attempts to work around this brokenness
in ways that harm other functions.  Let's finally remove it.

Requiring a complete re-run of DevStack after a reboot has always
been intentional.

TODO: follow-up cleaning all of the screen hackage if this merges.

Change-Id: I2f61bb69cc110468a91dcaa4ee7653ede7048467
---
 functions-common |  2 +-
 rejoin-stack.sh  | 25 -------------------------
 2 files changed, 1 insertion(+), 26 deletions(-)
 delete mode 100755 rejoin-stack.sh

diff --git a/functions-common b/functions-common
index 9e6fef22fb..ed1ff5ae12 100644
--- a/functions-common
+++ b/functions-common
@@ -1643,7 +1643,7 @@ function service_check {
     done
 
     if [ -n "$failures" ]; then
-        die $LINENO "More details about the above errors can be found with screen, with ./rejoin-stack.sh"
+        die $LINENO "More details about the above errors can be found with screen"
     fi
 }
 
diff --git a/rejoin-stack.sh b/rejoin-stack.sh
deleted file mode 100755
index 7048865fc9..0000000000
--- a/rejoin-stack.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#! /usr/bin/env bash
-
-# This script rejoins an existing screen, or re-creates a
-# screen session from a previous run of stack.sh.
-
-TOP_DIR=`dirname $0`
-
-# Import common functions in case the localrc (loaded via stackrc)
-# uses them.
-source $TOP_DIR/functions
-
-source $TOP_DIR/stackrc
-
-SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
-# if screenrc exists, run screen
-if [[ -e $SCREENRC ]]; then
-    if screen -ls | egrep -q "[0-9]+.${SCREEN_NAME}"; then
-        echo "Attaching to already started screen session.."
-        exec screen -r $SCREEN_NAME
-    fi
-    exec screen -c $SCREENRC
-fi
-
-echo "Couldn't find $SCREENRC file; have you run stack.sh yet?"
-exit 1

From 84f6c0fa6838ffa06aafb17c460a3990c10f4443 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Fri, 11 Mar 2016 22:37:27 -0500
Subject: [PATCH 1245/3333] remove the keystone bash completion install step

keytone has removed it's CLI and will release a new version
when Newton begins. As part of the removal process we also
need to remove the bash completion script, which is currently
failing devstack gates.

Change-Id: I132b862bde5b4173bf34beae12a7a882f5a96314
---
 lib/keystone | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 5ed7de9966..840f2c9c72 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -523,7 +523,6 @@ function install_keystoneclient {
     if use_library_from_git "python-keystoneclient"; then
         git_clone_by_name "python-keystoneclient"
         setup_dev_lib "python-keystoneclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-keystoneclient"]}/tools/,/etc/bash_completion.d/}keystone.bash_completion
     fi
 }
 

From 1df1e18da28ffd33d294f485709a9388b6f0fa30 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 12 Mar 2016 06:24:11 +0000
Subject: [PATCH 1246/3333] Updated from generate-devstack-plugins-list

Change-Id: Ic4f4015eb9446c62b793897fced7b5721427f09a
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f31db5185c..a52eba8bd6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -32,6 +32,8 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |blazar                      |git://git.openstack.org/openstack/blazar                                 |
 +----------------------------+-------------------------------------------------------------------------+
+|broadview-collector         |git://git.openstack.org/openstack/broadview-collector                    |
++----------------------------+-------------------------------------------------------------------------+
 |ceilometer                  |git://git.openstack.org/openstack/ceilometer                             |
 +----------------------------+-------------------------------------------------------------------------+
 |ceilometer-powervm          |git://git.openstack.org/openstack/ceilometer-powervm                     |

From 0d38e2d5d87e98552692f4c177df3a216bfac9dd Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 14 Mar 2016 13:57:01 -0500
Subject: [PATCH 1247/3333] Cleanup duplication in keystone uwsgi options

There was a lot of duplication in the uwsgi options between the
admin and public config files. The options common to both are
moved into their own section.

Change-Id: I5519c7d4d8b8446a7a5fdb8033852655d8a2c67b
---
 lib/keystone | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 840f2c9c72..12bcee8eee 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -303,28 +303,22 @@ function configure_keystone {
         fi
 
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
-        # This is running standalone
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi enable-threads true
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python
-        # uwsgi recommends this to prevent thundering herd on accept.
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi thunder-lock true
-        # Override the default size for headers from the 4k default.
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi buffer-size 65535
-        # Make sure the client doesn't try to re-use the connection.
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi add-header "Connection: close"
 
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
-        # This is running standalone
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi enable-threads true
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi plugins python
-        # uwsgi recommends this to prevent thundering herd on accept.
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi thunder-lock true
-        # Override the default size for headers from the 4k default.
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi buffer-size 65535
-        # Make sure the client doesn't try to re-use the connection.
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi add-header "Connection: close"
+
+        # Common settings
+        for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do
+            iniset "$file" uwsgi enable-threads true
+            iniset "$file" uwsgi plugins python
+            # uwsgi recommends this to prevent thundering herd on accept.
+            iniset "$file" uwsgi thunder-lock true
+            # Override the default size for headers from the 4k default.
+            iniset "$file" uwsgi buffer-size 65535
+            # Make sure the client doesn't try to re-use the connection.
+            iniset "$file" uwsgi add-header "Connection: close"
+        done
 
     else # eventlet
         if is_ssl_enabled_service key; then

From 4abcfaa86e7bb8827bc1b8b0e48352a0b748446f Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Fri, 11 Mar 2016 08:30:05 -0600
Subject: [PATCH 1248/3333] uwsgi keystone under master process

Normally a standalone uwsgi server would run in "master" mode -- it
handles signals to reload the processes. I tried this originally
with keystone but found that the server didn't shut down when
unstacking. The reason it didn't shut down is because (by default)
uwsgi does a reload on SIGTERM & SIGHUP rather than shutting down by
default, see [1].

Setting "die-on-term = true" & "exit-on-reload = true" changes the
uwsgi server to shut down when unstacking.

[1] http://uwsgi-docs.readthedocs.org/en/latest/Management.html#reloading-the-server

Change-Id: I145fef185d4a31078295941779e175b7452a5760
---
 lib/keystone | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 12bcee8eee..7743a64201 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -310,6 +310,11 @@ function configure_keystone {
 
         # Common settings
         for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do
+            # This is running standalone
+            iniset "$file" uwsgi master true
+            # Set die-on-term & exit-on-reload so that uwsgi shuts down
+            iniset "$file" uwsgi die-on-term true
+            iniset "$file" uwsgi exit-on-reload true
             iniset "$file" uwsgi enable-threads true
             iniset "$file" uwsgi plugins python
             # uwsgi recommends this to prevent thundering herd on accept.

From 9f5e7ba1004dcc4b9f1f0cbe94f61d0120baff0c Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 14 Mar 2016 14:54:18 -0500
Subject: [PATCH 1249/3333] Update gitignore for docs

These files are created when generating docs and should not be
checked in.

Change-Id: I1dc4ca05ab522237328f79f3a855750b8202f5da
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index a5a17c2b75..c72b0c4ccd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,5 @@ shocco
 src
 stack-screenrc
 userrc_early
+AUTHORS
+ChangeLog

From 3bf69e835a043e7deecbbe3568426042961116a3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 15 Mar 2016 12:21:34 +1100
Subject: [PATCH 1250/3333] Remove EC2 API from devstack

This all started with an investigation into Fedora's use of ecua2ools
package.  This package is a bit of a nightmare because it pulls in a
lot of other system-python packages.

For Ubuntu, this package was removed in
I47b7e787771683c2fc4404e586f11c1a19aac15c.  However, it is not
actually a "pure python" package as described in that change, in that
it is not installable from pypi.  I can't see how you could actually
run exercises/euca.sh on Ubuntu unless you installed euca2ools by hand
-- ergo I suggest it is totally unused, because nobody seems to have
reported problems.

In the mean time, ec2 api has moved to a plugin [1] anyway where the
recommendation in their README is to use the aws cli from amazon.

Thus remove all the parts related to EC2 and ecua2ools from base
devstack.

[1] https://git.openstack.org/cgit/openstack/ec2-api

Change-Id: I8a07320b59ea6cd7d1fe8bce61af84b5a28fb39e
---
 README.md                |   7 --
 doc/source/eucarc.rst    |  45 ---------
 doc/source/index.rst     |   1 -
 eucarc                   |  40 --------
 exercise.sh              |   4 +-
 exerciserc               |   6 --
 exercises/bundle.sh      |  74 ---------------
 exercises/client-args.sh |   1 -
 exercises/client-env.sh  |  13 ---
 exercises/euca.sh        | 192 ---------------------------------------
 files/rpms-suse/general  |   1 -
 files/rpms/general       |   1 -
 lib/heat                 |   3 -
 lib/nova                 |   8 --
 stack.sh                 |   8 --
 tools/create_userrc.sh   |  64 +------------
 16 files changed, 3 insertions(+), 465 deletions(-)
 delete mode 100644 doc/source/eucarc.rst
 delete mode 100644 eucarc
 delete mode 100755 exercises/bundle.sh
 delete mode 100755 exercises/euca.sh

diff --git a/README.md b/README.md
index dd394c2e07..4ba4619c6d 100644
--- a/README.md
+++ b/README.md
@@ -61,13 +61,6 @@ cloud via CLI:
     # list instances
     nova list
 
-If the EC2 API is your cup-o-tea, you can create credentials and use euca2ools:
-
-    # source eucarc to generate EC2 credentials and set up the environment
-    . eucarc
-    # list instances using ec2 api
-    euca-describe-instances
-
 # DevStack Execution Environment
 
 DevStack runs rampant over the system it runs on, installing things and
diff --git a/doc/source/eucarc.rst b/doc/source/eucarc.rst
deleted file mode 100644
index c2ecbc6732..0000000000
--- a/doc/source/eucarc.rst
+++ /dev/null
@@ -1,45 +0,0 @@
-=====================
-eucarc - EC2 Settings
-=====================
-
-``eucarc`` creates EC2 credentials for the current user as defined by
-``OS_TENANT_NAME:OS_USERNAME``. ``eucarc`` sources ``openrc`` at the
-beginning (which in turn sources ``stackrc`` and ``localrc``) in order
-to set credentials to create EC2 credentials in Keystone.
-
-EC2\_URL
-    Set the EC2 url for euca2ools. The endpoint is extracted from the
-    service catalog for ``OS_TENANT_NAME:OS_USERNAME``.
-
-    ::
-
-        EC2_URL=$(openstack catalog show ec2 | awk '/ publicURL: / { print $4 }')
-
-S3\_URL
-    Set the S3 endpoint for euca2ools. The endpoint is extracted from
-    the service catalog for ``OS_TENANT_NAME:OS_USERNAME``.
-
-    ::
-
-        export S3_URL=$(openstack catalog show s3 | awk '/ publicURL: / { print $4 }')
-
-EC2\_ACCESS\_KEY, EC2\_SECRET\_KEY
-    Create EC2 credentials for the current tenant:user in Keystone.
-
-    ::
-
-        CREDS=$(openstack ec2 credentials create)
-        export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
-        export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
-
-Certificates for Bundling
-    Euca2ools requires certificate files to enable bundle uploading. The
-    exercise script ``exercises/bundle.sh`` demonstrated retrieving
-    certificates using the Nova CLI.
-
-    ::
-
-        EC2_PRIVATE_KEY=pk.pem
-        EC2_CERT=cert.pem
-        NOVA_CERT=cacert.pem
-        EUCALYPTUS_CERT=${NOVA_CERT}
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 3e324adefc..c79b2ce0c7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -217,7 +217,6 @@ Configuration
    stackrc
    openrc
    exerciserc
-   eucarc
 
 Tools
 -----
diff --git a/eucarc b/eucarc
deleted file mode 100644
index 1e672bd932..0000000000
--- a/eucarc
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-#
-# source eucarc [username] [tenantname]
-#
-# Create EC2 credentials for the current user as defined by OS_TENANT_NAME:OS_USERNAME
-# Optionally set the tenant/username via openrc
-
-if [[ -n "$1" ]]; then
-    USERNAME=$1
-fi
-if [[ -n "$2" ]]; then
-    TENANT=$2
-fi
-
-# Find the other rc files
-RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
-
-# Get user configuration
-source $RC_DIR/openrc
-
-# Set the ec2 url so euca2ools works
-export EC2_URL=$(openstack catalog show ec2 | awk '/ publicURL: / { print $4 }')
-
-# Create EC2 credentials for the current user
-CREDS=$(openstack ec2 credentials create)
-export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
-export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
-
-# Euca2ools Certificate stuff for uploading bundles
-# See exercises/bundle.sh to see how to get certs using nova cli
-NOVA_KEY_DIR=${NOVA_KEY_DIR:-$RC_DIR}
-export S3_URL=$(openstack catalog show s3 | awk '/ publicURL: / { print $4 }')
-export EC2_USER_ID=42 # nova does not use user id, but bundling requires it
-export EC2_PRIVATE_KEY=${NOVA_KEY_DIR}/pk.pem
-export EC2_CERT=${NOVA_KEY_DIR}/cert.pem
-export NOVA_CERT=${NOVA_KEY_DIR}/cacert.pem
-export EUCALYPTUS_CERT=${NOVA_CERT} # euca-bundle-image seems to require this set
-alias ec2-bundle-image="ec2-bundle-image --cert ${EC2_CERT} --privatekey ${EC2_PRIVATE_KEY} --user ${EC2_USER_ID} --ec2cert ${NOVA_CERT}"
-alias ec2-upload-bundle="ec2-upload-bundle -a ${EC2_ACCESS_KEY} -s ${EC2_SECRET_KEY} --url ${S3_URL} --ec2cert ${NOVA_CERT}"
-
diff --git a/exercise.sh b/exercise.sh
index 19c9d80451..90670333a1 100755
--- a/exercise.sh
+++ b/exercise.sh
@@ -14,11 +14,11 @@ source $TOP_DIR/stackrc
 # Run everything in the exercises/ directory that isn't explicitly disabled
 
 # comma separated list of script basenames to skip
-# to refrain from exercising euca.sh use ``SKIP_EXERCISES=euca``
+# to refrain from exercising foo.sh use ``SKIP_EXERCISES=foo``
 SKIP_EXERCISES=${SKIP_EXERCISES:-""}
 
 # comma separated list of script basenames to run
-# to run only euca.sh use ``RUN_EXERCISES=euca``
+# to run only foo.sh use ``RUN_EXERCISES=foo``
 basenames=${RUN_EXERCISES:-""}
 
 EXERCISE_DIR=$TOP_DIR/exercises
diff --git a/exerciserc b/exerciserc
index 9105fe3331..978e0b3791 100644
--- a/exerciserc
+++ b/exerciserc
@@ -21,12 +21,6 @@ export RUNNING_TIMEOUT=${RUNNING_TIMEOUT:-$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))}
 # Max time to wait for a vm to terminate
 export TERMINATE_TIMEOUT=${TERMINATE_TIMEOUT:-30}
 
-# Max time to wait for a euca-volume command to propagate
-export VOLUME_TIMEOUT=${VOLUME_TIMEOUT:-30}
-
-# Max time to wait for a euca-delete command to propagate
-export VOLUME_DELETE_TIMEOUT=${SNAPSHOT_DELETE_TIMEOUT:-60}
-
 # The size of the volume we want to boot from; some storage back-ends
 # do not allow a disk resize, so it's important that this can be tuned
 export DEFAULT_VOLUME_SIZE=${DEFAULT_VOLUME_SIZE:-1}
diff --git a/exercises/bundle.sh b/exercises/bundle.sh
deleted file mode 100755
index 5470960b91..0000000000
--- a/exercises/bundle.sh
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-
-# **bundle.sh**
-
-# we will use the ``euca2ools`` cli tool that wraps the python boto
-# library to test ec2 bundle upload compatibility
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import EC2 configuration
-source $TOP_DIR/eucarc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Remove old certificates
-rm -f $TOP_DIR/cacert.pem
-rm -f $TOP_DIR/cert.pem
-rm -f $TOP_DIR/pk.pem
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Get Certificates
-nova x509-get-root-cert $TOP_DIR/cacert.pem
-nova x509-create-cert $TOP_DIR/pk.pem $TOP_DIR/cert.pem
-
-# Max time to wait for image to be registered
-REGISTER_TIMEOUT=${REGISTER_TIMEOUT:-15}
-
-BUCKET=testbucket
-IMAGE=bundle.img
-truncate -s 5M /tmp/$IMAGE
-euca-bundle-image -i /tmp/$IMAGE || die $LINENO "Failure bundling image $IMAGE"
-
-euca-upload-bundle --debug -b $BUCKET -m /tmp/$IMAGE.manifest.xml || die $LINENO "Failure uploading bundle $IMAGE to $BUCKET"
-
-AMI=`euca-register $BUCKET/$IMAGE.manifest.xml | cut -f2`
-die_if_not_set $LINENO AMI "Failure registering $BUCKET/$IMAGE"
-
-# Wait for the image to become available
-if ! timeout $REGISTER_TIMEOUT sh -c "while euca-describe-images | grep $AMI | grep -q available; do sleep 1; done"; then
-    die $LINENO "Image $AMI not available within $REGISTER_TIMEOUT seconds"
-fi
-
-# Clean up
-euca-deregister $AMI || die $LINENO "Failure deregistering $AMI"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 07ce5284e8..2c8fe81390 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -83,7 +83,6 @@ fi
 if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
     if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
         STATUS_NOVA="Skipped"
-        STATUS_EC2="Skipped"
     else
         # Test OSAPI
         echo -e "\nTest Nova"
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
index 1d2f4f5689..6ab4d08715 100755
--- a/exercises/client-env.sh
+++ b/exercises/client-env.sh
@@ -78,7 +78,6 @@ fi
 if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
     if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
         STATUS_NOVA="Skipped"
-        STATUS_EC2="Skipped"
     else
         # Test OSAPI
         echo -e "\nTest Nova"
@@ -89,17 +88,6 @@ if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
             RETURN=1
         fi
 
-        # Test EC2 API
-        echo -e "\nTest EC2"
-        # Get EC2 creds
-        source $TOP_DIR/eucarc
-
-        if euca-describe-images; then
-            STATUS_EC2="Succeeded"
-        else
-            STATUS_EC2="Failed"
-            RETURN=1
-        fi
     fi
 fi
 
@@ -170,7 +158,6 @@ function report {
 echo -e "\n"
 report "Keystone" $STATUS_KEYSTONE
 report "Nova" $STATUS_NOVA
-report "EC2" $STATUS_EC2
 report "Cinder" $STATUS_CINDER
 report "Glance" $STATUS_GLANCE
 report "Swift" $STATUS_SWIFT
diff --git a/exercises/euca.sh b/exercises/euca.sh
deleted file mode 100755
index 60e7d8ca29..0000000000
--- a/exercises/euca.sh
+++ /dev/null
@@ -1,192 +0,0 @@
-#!/usr/bin/env bash
-
-# **euca.sh**
-
-# we will use the ``euca2ools`` cli tool that wraps the python boto
-# library to test ec2 compatibility
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-VOLUME_SIZE=1
-ATTACH_DEVICE=/dev/vdc
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import EC2 configuration
-source $TOP_DIR/eucarc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Import project functions
-source $TOP_DIR/lib/neutron-legacy
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-euca_secgroup}
-
-
-# Launching a server
-# ==================
-
-# Find a machine image to boot
-IMAGE=`euca-describe-images | grep machine | grep ${DEFAULT_IMAGE_NAME} | cut -f2 | head -n1`
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-if is_service_enabled n-cell; then
-    # Cells does not support security groups, so force the use of "default"
-    SECGROUP="default"
-    echo "Using the default security group because of Cells."
-else
-    # Add a secgroup
-    if ! euca-describe-groups | grep -q $SECGROUP; then
-        euca-add-group -d "$SECGROUP description" $SECGROUP
-        if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! euca-describe-groups | grep -q $SECGROUP; do sleep 1; done"; then
-            die $LINENO "Security group not created"
-        fi
-    fi
-fi
-
-# Launch it
-INSTANCE=`euca-run-instances -g $SECGROUP -t $DEFAULT_INSTANCE_TYPE $IMAGE | grep INSTANCE | cut -f2`
-die_if_not_set $LINENO INSTANCE "Failure launching instance"
-
-# Assure it has booted within a reasonable time
-if ! timeout $RUNNING_TIMEOUT sh -c "while ! euca-describe-instances $INSTANCE | grep -q running; do sleep 1; done"; then
-    die $LINENO "server didn't become active within $RUNNING_TIMEOUT seconds"
-fi
-
-# Volumes
-# -------
-if is_service_enabled c-vol && ! is_service_enabled n-cell && [ "$VIRT_DRIVER" != "ironic" ]; then
-    VOLUME_ZONE=`euca-describe-availability-zones | head -n1 | cut -f2`
-    die_if_not_set $LINENO VOLUME_ZONE "Failure to find zone for volume"
-
-    VOLUME=`euca-create-volume -s 1 -z $VOLUME_ZONE` || die $LINENO "Failure to create volume"
-    VOLUME=`echo "$VOLUME" | cut -f2`
-    die_if_not_set $LINENO VOLUME "Failure to create volume"
-
-    # Test that volume has been created
-    VOLUME=`euca-describe-volumes $VOLUME | cut -f2`
-    die_if_not_set $LINENO VOLUME "Failure to get volume"
-
-    # Test volume has become available
-    if ! timeout $RUNNING_TIMEOUT sh -c "while ! euca-describe-volumes $VOLUME | grep -q available; do sleep 1; done"; then
-        die $LINENO "volume didn't become available within $RUNNING_TIMEOUT seconds"
-    fi
-
-    # Attach volume to an instance
-    euca-attach-volume -i $INSTANCE -d $ATTACH_DEVICE $VOLUME || \
-        die $LINENO "Failure attaching volume $VOLUME to $INSTANCE"
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while ! euca-describe-volumes $VOLUME | grep -A 1 in-use | grep -q attach; do sleep 1; done"; then
-        die $LINENO "Could not attach $VOLUME to $INSTANCE"
-    fi
-
-    # Detach volume from an instance
-    euca-detach-volume $VOLUME || \
-        die $LINENO "Failure detaching volume $VOLUME to $INSTANCE"
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while ! euca-describe-volumes $VOLUME | grep -q available; do sleep 1; done"; then
-        die $LINENO "Could not detach $VOLUME to $INSTANCE"
-    fi
-
-    # Remove volume
-    euca-delete-volume $VOLUME || \
-        die $LINENO "Failure to delete volume"
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while euca-describe-volumes | grep $VOLUME; do sleep 1; done"; then
-        die $LINENO "Could not delete $VOLUME"
-    fi
-else
-    echo "Volume Tests Skipped"
-fi
-
-if is_service_enabled n-cell; then
-    echo "Floating IP Tests Skipped because of Cells."
-else
-    # Allocate floating address
-    FLOATING_IP=`euca-allocate-address | cut -f2`
-    die_if_not_set $LINENO FLOATING_IP "Failure allocating floating IP"
-    # describe all instances at this moment
-    euca-describe-instances
-    # Associate floating address
-    euca-associate-address -i $INSTANCE $FLOATING_IP || \
-        die $LINENO "Failure associating address $FLOATING_IP to $INSTANCE"
-
-    # Authorize pinging
-    euca-authorize -P icmp -s 0.0.0.0/0 -t -1:-1 $SECGROUP || \
-        die $LINENO "Failure authorizing rule in $SECGROUP"
-
-    # Test we can ping our floating ip within ASSOCIATE_TIMEOUT seconds
-    ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME"
-
-    # Revoke pinging
-    euca-revoke -P icmp -s 0.0.0.0/0 -t -1:-1 $SECGROUP || \
-        die $LINENO "Failure revoking rule in $SECGROUP"
-
-    # Release floating address
-    euca-disassociate-address $FLOATING_IP || \
-        die $LINENO "Failure disassociating address $FLOATING_IP"
-
-    # Wait just a tick for everything above to complete so release doesn't fail
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while euca-describe-addresses | grep $INSTANCE | grep -q $FLOATING_IP; do sleep 1; done"; then
-        die $LINENO "Floating ip $FLOATING_IP not disassociated within $ASSOCIATE_TIMEOUT seconds"
-    fi
-
-    # Release floating address
-    euca-release-address $FLOATING_IP || \
-        die $LINENO "Failure releasing address $FLOATING_IP"
-
-    # Wait just a tick for everything above to complete so terminate doesn't fail
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while euca-describe-addresses | grep -q $FLOATING_IP; do sleep 1; done"; then
-        die $LINENO "Floating ip $FLOATING_IP not released within $ASSOCIATE_TIMEOUT seconds"
-    fi
-fi
-
-# Terminate instance
-euca-terminate-instances $INSTANCE || \
-    die $LINENO "Failure terminating instance $INSTANCE"
-
-# Assure it has terminated within a reasonable time. The behaviour of this
-# case changed with bug/836978. Requesting the status of an invalid instance
-# will now return an error message including the instance id, so we need to
-# filter that out.
-if ! timeout $TERMINATE_TIMEOUT sh -c "while euca-describe-instances $INSTANCE | grep -ve '\(InstanceNotFound\|InvalidInstanceID\.NotFound\)' | grep -q $INSTANCE; do sleep 1; done"; then
-    die $LINENO "server didn't terminate within $TERMINATE_TIMEOUT seconds"
-fi
-
-if [[ "$SECGROUP" = "default" ]] ; then
-    echo "Skipping deleting default security group"
-else
-    # Delete secgroup
-    euca-delete-group $SECGROUP || die $LINENO "Failure deleting security group $SECGROUP"
-fi
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 34a29554f7..e3dfec1047 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -2,7 +2,6 @@ bc
 bridge-utils
 ca-certificates-mozilla
 curl
-euca2ools
 gcc
 gcc-c++
 git-core
diff --git a/files/rpms/general b/files/rpms/general
index a0906e2587..6d5fd1565c 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -2,7 +2,6 @@ bc
 bridge-utils
 curl
 dbus
-euca2ools # only for testing client
 gcc
 gcc-c++
 gettext  # used for compiling message catalogs
diff --git a/lib/heat b/lib/heat
index 41318787b3..2cf7a19d40 100644
--- a/lib/heat
+++ b/lib/heat
@@ -166,9 +166,6 @@ function configure_heat {
     # clients_keystone
     iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
 
-    # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
-
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
     iniset $HEAT_CONF heat_api workers "$API_WORKERS"
diff --git a/lib/nova b/lib/nova
index fd458c5701..3a5a47fa27 100644
--- a/lib/nova
+++ b/lib/nova
@@ -74,9 +74,6 @@ NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
 
 if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
-    EC2_SERVICE_PROTOCOL="https"
-else
-    EC2_SERVICE_PROTOCOL="http"
 fi
 
 # Public facing bits
@@ -86,8 +83,6 @@ NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
-EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
-EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
@@ -140,7 +135,6 @@ NETWORK_MANAGER=${NETWORK_MANAGER:-${NET_MAN:-FlatDHCPManager}}
 PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
 VLAN_INTERFACE=${VLAN_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 FLAT_NETWORK_BRIDGE=${FLAT_NETWORK_BRIDGE:-$FLAT_NETWORK_BRIDGE_DEFAULT}
-EC2_DMZ_HOST=${EC2_DMZ_HOST:-$SERVICE_HOST}
 
 # If you are using the FlatDHCP network mode on multiple hosts, set the
 # ``FLAT_INTERFACE`` variable but make sure that the interface doesn't already
@@ -594,7 +588,6 @@ function create_nova_conf {
         iniset $NOVA_CONF spice enabled false
     fi
 
-    iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
@@ -810,7 +803,6 @@ function start_nova_api {
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT &
-        start_tls_proxy '*' $EC2_SERVICE_PORT $NOVA_SERVICE_HOST $EC2_SERVICE_PORT_INT &
     fi
 
     export PATH=$old_path
diff --git a/stack.sh b/stack.sh
index 0be3585020..5c16f042d8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1208,14 +1208,6 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create an access key and secret key for Nova EC2 register image
-if is_service_enabled keystone && is_service_enabled swift3 && is_service_enabled nova; then
-    eval $(openstack ec2 credentials create --user nova --project $SERVICE_PROJECT_NAME -f shell -c access -c secret)
-    iniset $NOVA_CONF DEFAULT s3_access_key "$access"
-    iniset $NOVA_CONF DEFAULT s3_secret_key "$secret"
-    iniset $NOVA_CONF DEFAULT s3_affix_tenant "True"
-fi
-
 # Create a randomized default value for the keymgr's fixed_key
 if is_service_enabled nova; then
     iniset $NOVA_CONF keymgr fixed_key $(generate_hex_string 32)
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 74d5428382..3325c5e586 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -156,30 +156,6 @@ if [ -z "$MODE" ]; then
     exit 3
 fi
 
-EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
-if [[ -z $EC2_URL ]]; then
-    EC2_URL=http://localhost:8773/
-fi
-
-S3_URL=$(openstack endpoint list --service s3 --interface public --os-identity-api-version=3 -c URL -f value || true)
-if [[ -z $S3_URL ]]; then
-    S3_URL=http://localhost:3333
-fi
-
-mkdir -p "$ACCOUNT_DIR"
-ACCOUNT_DIR=`readlink -f "$ACCOUNT_DIR"`
-EUCALYPTUS_CERT=$ACCOUNT_DIR/cacert.pem
-if [ -e "$EUCALYPTUS_CERT" ]; then
-    mv "$EUCALYPTUS_CERT" "$EUCALYPTUS_CERT.old"
-fi
-if ! nova x509-get-root-cert "$EUCALYPTUS_CERT"; then
-    echo "Failed to update the root certificate: $EUCALYPTUS_CERT" >&2
-    if [ -e "$EUCALYPTUS_CERT.old" ]; then
-        mv "$EUCALYPTUS_CERT.old" "$EUCALYPTUS_CERT"
-    fi
-fi
-
-
 function add_entry {
     local user_id=$1
     local user_name=$2
@@ -187,54 +163,16 @@ function add_entry {
     local project_name=$4
     local user_passwd=$5
 
-    # The admin user can see all user's secret AWS keys, it does not looks good
-    local line
-    line=$(openstack ec2 credentials list --user $user_id | grep " $project_id " || true)
-    if [ -z "$line" ]; then
-        openstack ec2 credentials create --user $user_id --project $project_id 1>&2
-        line=`openstack ec2 credentials list --user $user_id | grep " $project_id "`
-    fi
-    local ec2_access_key ec2_secret_key
-    read ec2_access_key ec2_secret_key <<<  `echo $line | awk '{print $2 " " $4 }'`
     mkdir -p "$ACCOUNT_DIR/$project_name"
     local rcfile="$ACCOUNT_DIR/$project_name/$user_name"
-    # The certs subject part are the project ID "dash" user ID, but the CN should be the first part of the DN
-    # Generally the subject DN parts should be in reverse order like the Issuer
-    # The Serial does not seams correctly marked either
-    local ec2_cert="$rcfile-cert.pem"
-    local ec2_private_key="$rcfile-pk.pem"
-    # Try to preserve the original file on fail (best effort)
-    if [ -e "$ec2_private_key" ]; then
-        mv -f "$ec2_private_key" "$ec2_private_key.old"
-    fi
-    if [ -e "$ec2_cert" ]; then
-        mv -f "$ec2_cert" "$ec2_cert.old"
-    fi
-    # It will not create certs when the password is incorrect
-    if ! nova --os-password "$user_passwd" --os-username "$user_name" --os-project-name "$project_name" x509-create-cert "$ec2_private_key" "$ec2_cert"; then
-        if [ -e "$ec2_private_key.old" ]; then
-            mv -f "$ec2_private_key.old" "$ec2_private_key"
-        fi
-        if [ -e "$ec2_cert.old" ]; then
-            mv -f "$ec2_cert.old" "$ec2_cert"
-        fi
-    fi
+
     cat >"$rcfile" <<EOF
-# you can source this file
-export EC2_ACCESS_KEY="$ec2_access_key"
-export EC2_SECRET_KEY="$ec2_secret_key"
-export EC2_URL="$EC2_URL"
-export S3_URL="$S3_URL"
 # OpenStack USER ID = $user_id
 export OS_USERNAME="$user_name"
 # OpenStack project ID = $project_id
 export OS_PROJECT_NAME="$project_name"
 export OS_AUTH_URL="$OS_AUTH_URL"
 export OS_CACERT="$OS_CACERT"
-export EC2_CERT="$ec2_cert"
-export EC2_PRIVATE_KEY="$ec2_private_key"
-export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
-export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
 export OS_AUTH_TYPE=v2password
 EOF

From 04ed38b5d77276578f95184a9a9d009b12b57d43 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 15 Mar 2016 06:26:37 +0000
Subject: [PATCH 1251/3333] Updated from generate-devstack-plugins-list

Change-Id: I40f4ce322028698011931f3b72fc39e95e6813b0
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a52eba8bd6..136a9e4e92 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -106,6 +106,8 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |networking-bgpvpn           |git://git.openstack.org/openstack/networking-bgpvpn                      |
 +----------------------------+-------------------------------------------------------------------------+
+|networking-brocade          |git://git.openstack.org/openstack/networking-brocade                     |
++----------------------------+-------------------------------------------------------------------------+
 |networking-calico           |git://git.openstack.org/openstack/networking-calico                      |
 +----------------------------+-------------------------------------------------------------------------+
 |networking-cisco            |git://git.openstack.org/openstack/networking-cisco                       |

From 54d16f706a4c9886a5de93fc8b3cd08cd324de33 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 15 Mar 2016 15:18:14 -0400
Subject: [PATCH 1252/3333] Revert "Automate OVS bridge creation for multiple
 mappings"

After reviewing I5b1d49be8d9e3e331826e30182fba70f099b5e7f and
I161a157895b4ed0c9ea5a7a00302e30f4ad75ed3 - I have come to the
determination that this really should be in a DevStack plugin.

If both of the patches under review were to merge, we would be blessed
with at least the following variables:

OVS_NICS_FROM_BRIDGES
OVS_NIC_MAPPINGS
OVS_BRIDGE_MAPPINGS
OVS_PHYSICAL_BRIDGE
PHYSICAL_NETWORK
PUBLIC_PHYSICAL_NETWORK

Which really is not good. Let's just push this into a plugin, I don't
want to deal with it.

This reverts commit 3095ff51320291b3622cacc3bf2fb1043bff8d31.

Change-Id: I746022f5db93d3333101a014692fbdcd790a0004
---
 doc/source/guides/neutron.rst         | 16 ----------------
 lib/neutron_plugins/openvswitch_agent | 11 ++---------
 2 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index cac7bb0152..c24cbb90fc 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -537,19 +537,3 @@ setup, with small modifications for the interface mappings.
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
 
-Creating specific OVS bridges for physical networks
----------------------------------------------------
-
-When using the Open vSwitch ML2 mechanism driver, it is possible to
-have multiple Open vSwitch bridges meant for physical networking be
-automatically created by setting the ``OVS_BRIDGE_MAPPINGS`` to a list of
-physical network to bridge name associations with the following syntax:
-
-::
-
-    OVS_BRIDGE_MAPPINGS=net1name:bridge1name,net2name:bridge2name,<...>
-
-Also, ``OVS_BRIDGE_MAPPINGS`` has precedence over ``PHYSICAL_NETWORK`` and
-``OVS_PHYSICAL_BRIDGE``, meaning that if the former is set, the latter
-ones will be ignored. When ``OVS_BRIDGE_MAPPINGS`` is not set, the other
-variables will still be evaluated.
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e1c5a504a5..339d5fd96a 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -37,7 +37,6 @@ function neutron_plugin_configure_l3_agent {
 }
 
 function neutron_plugin_configure_plugin_agent {
-    local mappings_array mapping phys_bridge
     # Setup integration bridge
     _neutron_ovs_base_setup_bridge $OVS_BRIDGE
     _neutron_ovs_base_configure_firewall_driver
@@ -53,15 +52,9 @@ function neutron_plugin_configure_plugin_agent {
     # complex physical network configurations.
     if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
         OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
-    fi
 
-    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
-        IFS=',' read -a mappings_array <<< "$OVS_BRIDGE_MAPPINGS"
-        for mapping in "${mappings_array[@]}"; do
-            phys_bridge=`echo $mapping | cut -f 2 -d ":"`
-            # Configure bridge manually with physical interface as port for multi-node
-            _neutron_ovs_base_add_bridge $phys_bridge
-        done
+        # Configure bridge manually with physical interface as port for multi-node
+        _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE
     fi
     if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS

From 78d3739dbec518bc81e635d5a9c19eb68530454c Mon Sep 17 00:00:00 2001
From: tengqm <tengqim@cn.ibm.com>
Date: Tue, 15 Mar 2016 23:08:00 -0400
Subject: [PATCH 1253/3333] Fix RHEL7 vendor detection

When detecting os_VENDOR, the lsb_release output may be different
from what is expected today. This patch fixes the detection.

Change-Id: I850ad1acbc2397c73e7cc85c1765cba6ba2f98d4
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index 98768cdd50..366415b91e 100644
--- a/functions-common
+++ b/functions-common
@@ -440,6 +440,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
         [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
 }

From d014002d034ecfebf9f3b3e10296de15b7a9edb0 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 16 Mar 2016 08:13:49 -0500
Subject: [PATCH 1254/3333] Remove n-crt from default services

Depends-on: I8a07320b59ea6cd7d1fe8bce61af84b5a28fb39e
Change-Id: I3441317911c8e940ef038c79f97554c1c669e120
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 088cfeed26..74d507cfa2 100644
--- a/stackrc
+++ b/stackrc
@@ -67,7 +67,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt,n-cauth
+    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-cauth
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder

From 4921d4dbb937b8a9ca26379a33252f0bebcfb53f Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Tue, 23 Feb 2016 22:51:04 -0600
Subject: [PATCH 1255/3333] Use unversioned keystone endpoints

Insert the unversioned keystone URLs into the service catalog. Services
should be able to determine the correct URL for their work from this.

Depends-On: I931f0c558aafc8dfaa5519744c6e4e7fcffc3205
Change-Id: I6171f782a1dd397720a9b2a3393b30ae5aca0cc2
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 9f23e73381..802b38082e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -634,9 +634,9 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
 }
 
 # Restore xtrace

From f21b86fefbcebd1430909b1db89ef2cf3154c705 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Wed, 16 Mar 2016 17:58:07 -0400
Subject: [PATCH 1256/3333] Install uuid-runtime on Ubuntu

It seems uuidgen doesn't exist by default on the new trusty nodes [1].
There are quite a few projects that use uuidgen [2] so we need to
ensure it's on the node.

On Trusty, this is provided by the uuid-runtime package.  Note that on
Centos & Fedora this is provided by util-linux which is already tehre.

[1] http://logs.openstack.org/75/292475/1/check/gate-telemetry-dsvm-integration-ceilometer/2e85d1f/logs/devstacklog.txt.gz#_2016-03-16_19_20_30_116
[2] http://codesearch.openstack.org/?q=uuidgen&i=nope&files=&repos=

Change-Id: I230836d8b644698473d0611931334c232cf00734
---
 files/debs/general | 1 +
 files/debs/neutron | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index 1215147a16..307cd7b113 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -28,6 +28,7 @@ screen
 tar
 tcpdump
 unzip
+uuid-runtime
 wget
 wget
 zlib1g-dev
diff --git a/files/debs/neutron b/files/debs/neutron
index e53cc68ccf..2307fa54d5 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -13,5 +13,4 @@ rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
 sudo
-uuid-runtime
 vlan

From 7ed812c6cdb4814be2f40f4331aec43c62d13179 Mon Sep 17 00:00:00 2001
From: Balagopal <bala@aptira.com>
Date: Tue, 1 Mar 2016 04:43:31 +0000
Subject: [PATCH 1257/3333] Change "secrete" to "secret"

Apparently this is intentional as a joke on devstack leaking
passwords, but the dual meaning of the word confuses people.  Let's
change it before we get yet another review fixing it.

Change-Id: I3bee03612f6ea197362aab04a37f81043f77f235
---
 doc/source/configuration.rst        |  2 +-
 doc/source/guides/multinode-lab.rst | 10 ++++----
 doc/source/guides/neutron.rst       | 40 ++++++++++++++---------------
 doc/source/openrc.rst               |  2 +-
 lib/tempest                         |  2 +-
 openrc                              |  2 +-
 samples/local.conf                  |  2 +-
 tools/xen/xenrc                     |  2 +-
 8 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e985bdceb0..0493f8fa25 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -104,7 +104,7 @@ values that most often need to be set.
 ::
 
     [[local|localrc]]
-    ADMIN_PASSWORD=secrete
+    ADMIN_PASSWORD=secret
     DATABASE_PASSWORD=$ADMIN_PASSWORD
     RABBIT_PASSWORD=$ADMIN_PASSWORD
     SERVICE_PASSWORD=$ADMIN_PASSWORD
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 392bb1b807..c996f95743 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -129,8 +129,8 @@ cluster controller's DevStack in ``local.conf``:
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
-    RABBIT_PASSWORD=supersecrete
-    SERVICE_PASSWORD=supersecrete
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
 
 In the multi-node configuration the first 10 or so IPs in the private
 subnet are usually reserved. Add this to ``local.sh`` to have it run
@@ -169,8 +169,8 @@ machines, create a ``local.conf`` with:
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
-    RABBIT_PASSWORD=supersecrete
-    SERVICE_PASSWORD=supersecrete
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
     DATABASE_TYPE=mysql
     SERVICE_HOST=192.168.42.11
     MYSQL_HOST=$SERVICE_HOST
@@ -254,7 +254,7 @@ for scripting:
 
     # Add a user and project
     NAME=bob
-    PASSWORD=BigSecrete
+    PASSWORD=BigSecret
     PROJECT=$NAME
     openstack project create $PROJECT
     openstack user create $NAME --password=$PASSWORD --project $PROJECT
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c24cbb90fc..4406aa04e9 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -59,10 +59,10 @@ serving as a hypervisor for guest instances.
         MYSQL_HOST=172.18.161.6
         RABBIT_HOST=172.18.161.6
         GLANCE_HOSTPORT=172.18.161.6:9292
-        ADMIN_PASSWORD=secrete
-        DATABASE_PASSWORD=secrete
-        RABBIT_PASSWORD=secrete
-        SERVICE_PASSWORD=secrete
+        ADMIN_PASSWORD=secret
+        DATABASE_PASSWORD=secret
+        RABBIT_PASSWORD=secret
+        SERVICE_PASSWORD=secret
 
         # Do not use Nova-Network
         disable_service n-net
@@ -232,10 +232,10 @@ The host `devstack-2` has a very minimal `local.conf`.
     MYSQL_HOST=172.18.161.6
     RABBIT_HOST=172.18.161.6
     GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secrete
-    MYSQL_PASSWORD=secrete
-    RABBIT_PASSWORD=secrete
-    SERVICE_PASSWORD=secrete
+    ADMIN_PASSWORD=secret
+    MYSQL_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
 
     ## Neutron options
     PUBLIC_INTERFACE=eth0
@@ -362,10 +362,10 @@ controller node.
         GLANCE_HOSTPORT=10.0.0.2:9292
         PUBLIC_INTERFACE=eth1
 
-        ADMIN_PASSWORD=secrete
-        MYSQL_PASSWORD=secrete
-        RABBIT_PASSWORD=secrete
-        SERVICE_PASSWORD=secrete
+        ADMIN_PASSWORD=secret
+        MYSQL_PASSWORD=secret
+        RABBIT_PASSWORD=secret
+        SERVICE_PASSWORD=secret
 
         ## Neutron options
         Q_USE_SECGROUP=True
@@ -409,10 +409,10 @@ compute node 1.
         MYSQL_HOST=10.0.0.2
         RABBIT_HOST=10.0.0.2
         GLANCE_HOSTPORT=10.0.0.2:9292
-        ADMIN_PASSWORD=secrete
-        MYSQL_PASSWORD=secrete
-        RABBIT_PASSWORD=secrete
-        SERVICE_PASSWORD=secrete
+        ADMIN_PASSWORD=secret
+        MYSQL_PASSWORD=secret
+        RABBIT_PASSWORD=secret
+        SERVICE_PASSWORD=secret
 
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
@@ -509,10 +509,10 @@ setup, with small modifications for the interface mappings.
     MYSQL_HOST=172.18.161.6
     RABBIT_HOST=172.18.161.6
     GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secrete
-    DATABASE_PASSWORD=secrete
-    RABBIT_PASSWORD=secrete
-    SERVICE_PASSWORD=secrete
+    ADMIN_PASSWORD=secret
+    DATABASE_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
 
     # Do not use Nova-Network
     disable_service n-net
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index 0b090c77b7..4e7f0754a3 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -35,7 +35,7 @@ OS\_PASSWORD
 
     ::
 
-        OS_PASSWORD=secrete
+        OS_PASSWORD=secret
 
 HOST\_IP, SERVICE\_HOST
     Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
diff --git a/lib/tempest b/lib/tempest
index 3b8a8889af..19b63d18da 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -176,7 +176,7 @@ function configure_tempest {
     sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
     rm -f $TEMPEST_CONFIG
 
-    local password=${ADMIN_PASSWORD:-secrete}
+    local password=${ADMIN_PASSWORD:-secret}
 
     # See ``lib/keystone`` where these users and tenants are set up
     local admin_username=${ADMIN_USERNAME:-admin}
diff --git a/openrc b/openrc
index 460cf14756..db2e97d3b1 100644
--- a/openrc
+++ b/openrc
@@ -51,7 +51,7 @@ export OS_USERNAME=${OS_USERNAME:-demo}
 # With Keystone you pass the keystone password instead of an api key.
 # Recent versions of novaclient use OS_PASSWORD instead of NOVA_API_KEYs
 # or NOVA_PASSWORD.
-export OS_PASSWORD=${ADMIN_PASSWORD:-secrete}
+export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
 
 # Don't put the key into a keyring by default. Testing for development is much
 # easier with this off.
diff --git a/samples/local.conf b/samples/local.conf
index ea68dc0d8d..06ac18572d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -25,7 +25,7 @@
 
 # If the ``*_PASSWORD`` variables are not set here you will be prompted to enter
 # values for them by ``stack.sh``and they will be added to ``local.conf``.
-ADMIN_PASSWORD=nomoresecrete
+ADMIN_PASSWORD=nomoresecret
 DATABASE_PASSWORD=stackdb
 RABBIT_PASSWORD=stackqueue
 SERVICE_PASSWORD=$ADMIN_PASSWORD
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index be6c5ca037..bb27454e30 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -32,7 +32,7 @@ PUB_BRIDGE_OR_NET_NAME="OpenStack Public Network"
 XEN_INT_BRIDGE_OR_NET_NAME="OpenStack VM Integration Network"
 
 # VM Password
-GUEST_PASSWORD=${GUEST_PASSWORD:-secrete}
+GUEST_PASSWORD=${GUEST_PASSWORD:-secret}
 
 # Extracted variables for OpenStack VM network device numbers.
 # Make sure they form a continuous sequence starting from 0

From 198887e8903696ea9fcbec0f8a91c2f6ca5a34c7 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 10 Apr 2015 18:45:35 +0200
Subject: [PATCH 1258/3333] logging: don't set logging format strings for
 keystone

Don't override those format strings since the overridden
values are identical to those used by oslo.log by default [1].

logging_exception_prefix is still set since it changes the logging
format to use TRACE label for exceptions instead of default ERROR.

[1]: https://git.openstack.org/cgit/openstack/oslo.log/tree/oslo_log/_options.py?id=c47a91dbbb586c27d8521b1016bf7901c47b1c90#n110

Closes-Bug: #1433687
Change-Id: Ibd11cd6b0defb6dc709dbd3e718a49fd71cce6b6
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 9f23e73381..66d4988b02 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -281,9 +281,6 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
     elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then

From 7c98cfb56e73e326446a812be19b3ac9d6e2f240 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Fri, 18 Mar 2016 21:24:46 +0900
Subject: [PATCH 1259/3333] install_pip.sh: Remove stale comments

Change-Id: Id91c8e579977bedae1410095d9b4cef9d9ae2178
---
 tools/install_pip.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 2a9d813eac..17c7b619d1 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -2,12 +2,9 @@
 
 # **install_pip.sh**
 
-# install_pip.sh [--pip-version <version>] [--use-get-pip] [--force]
-#
 # Update pip and friends to a known common version
 
 # Assumptions:
-# - update pip to $INSTALL_PIP_VERSION
 # - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
 
 set -o errexit

From c10989bf189c42a99e56f0017705d1b7a8c71499 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 21 Mar 2016 13:03:34 +1100
Subject: [PATCH 1260/3333] Plugin autogen list: handle variable-width plugin
 names

We've had a couple of cases where plugin names are longer than our
table width.

Take the fixed-with table-header out of the header file, and generate
it dynamically based on first-column width.  To simplify, take
advantage that RST allows a variable-length last column and so don't
specify it's width.

Add a link to the cgit URL for each project you can click on to browse
the source (link text remains the git:// URL).

Add some logging so you can see what the python generator is doing,
should you run it.

Change-Id: I5d5e692039bbb30b2508119412472dac1d105c08
---
 data/devstack-plugins-registry.header   |  4 ---
 tools/generate-devstack-plugins-list.py |  8 ++++++
 tools/generate-devstack-plugins-list.sh | 34 +++++++++++++++++++++----
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 46d5e60749..f105fe9d35 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -18,7 +18,3 @@ Detected Plugins
 The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
-
-+----------------------------+-------------------------------------------------------------------------+
-|Plugin Name                 |URL                                                                      |
-+----------------------------+-------------------------------------------------------------------------+
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 1fa550192e..aeec4dd27d 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -23,9 +23,12 @@
 #     working directory
 #   * network access to https://git.openstack.org/cgit
 
+import logging
 import json
 import requests
 
+logging.basicConfig(level=logging.DEBUG)
+
 url = 'https://review.openstack.org/projects/'
 
 # This is what a project looks like
@@ -37,6 +40,8 @@
 '''
 
 def is_in_openstack_namespace(proj):
+    # only interested in openstack namespace (e.g. not retired
+    # stackforge, etc)
     return proj.startswith('openstack/')
 
 # Rather than returning a 404 for a nonexistent file, cgit delivers a
@@ -50,10 +55,13 @@ def has_devstack_plugin(proj):
     else:
         False
 
+logging.debug("Getting project list from %s" % url)
 r = requests.get(url)
 projects = sorted(filter(is_in_openstack_namespace, json.loads(r.text[4:])))
+logging.debug("Found %d projects" % len(projects))
 
 found_plugins = filter(has_devstack_plugin, projects)
 
 for project in found_plugins:
+    # strip of openstack/
     print project[10:]
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index be3f60a136..82486f5b2d 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -38,6 +38,17 @@
 # current working directory, it will be prepended or appended to
 # the generated reStructuredText plugins table respectively.
 
+# Print the title underline for a RST table.  Argument is the length
+# of the first column, second column is assumed to be "URL"
+function title_underline {
+    local len=$1
+    while [[ $len -gt 0 ]]; do
+        printf "="
+        len=$(( len - 1))
+    done
+    printf " ===\n"
+}
+
 (
 declare -A plugins
 
@@ -47,11 +58,24 @@ fi
 
 sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
 
-for k in ${sorted_plugins}; do
-    project=${k:0:28}
-    giturl="git://git.openstack.org/openstack/${k:0:26}"
-    printf "|%-28s|%-73s|\n" "${project}" "${giturl}"
-    printf "+----------------------------+-------------------------------------------------------------------------+\n"
+# find the length of the name column & pad
+name_col_len=$(echo "${sorted_plugins}" | wc -L)
+name_col_len=$(( name_col_len + 2 ))
+
+# ====================== ===
+# Plugin Name            URL
+# ====================== ===
+# foobar                 `git://... <http://...>`__
+# ...
+
+title_underline ${name_col_len}
+printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
+title_underline ${name_col_len}
+
+for plugin in ${sorted_plugins}; do
+    giturl="git://git.openstack.org/openstack/${plugin}"
+    gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
+    printf "%-${name_col_len}s %s\n" "${p}" "\`${giturl} <${gitlink}>\`__"
 done
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then

From 1258da64085cef851be09923e37d1ed59348b43d Mon Sep 17 00:00:00 2001
From: Sergey Belous <sbelous@mirantis.com>
Date: Mon, 21 Mar 2016 12:32:06 +0300
Subject: [PATCH 1261/3333] Allow install os-vif library used by Nova

In future Nova will use os-vif library for some communication with Neutron.
This patch add ability to install os-vif library that requires for run
tempest-jobs for new patches, that used os-vif.

Change-Id: I28e48afd3c740b1aa50c994d99f660f095e7deda
---
 lib/nova                     | 8 ++++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 3a5a47fa27..2b8fefaf00 100644
--- a/lib/nova
+++ b/lib/nova
@@ -34,6 +34,7 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-novaclient"]=$DEST/python-novaclient
+GITDIR["os-vif"]=$DEST/os-vif
 NOVA_DIR=$DEST/nova
 
 # Nova virtual environment
@@ -728,6 +729,13 @@ function install_novaclient {
 
 # install_nova() - Collect source and prepare
 function install_nova {
+
+    # Install os-vif
+    if use_library_from_git "os-vif"; then
+        git_clone_by_name "os-vif"
+        setup_dev_lib "os-vif"
+    fi
+
     if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
         install_nova_hypervisor
     fi
diff --git a/stackrc b/stackrc
index 74d507cfa2..9bd132a74a 100644
--- a/stackrc
+++ b/stackrc
@@ -477,6 +477,10 @@ GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 
+# os-vif library to communicate between Neutron to Nova
+GITREPO["os-vif"]=${OS_VIF_REPO:-${GIT_BASE}/openstack/os-vif.git}
+GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
+
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index ee11fd29a0..f01db6df1d 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -42,7 +42,7 @@ ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
-ALL_LIBS+=" diskimage-builder"
+ALL_LIBS+=" diskimage-builder os-vif"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From d99c29032bb0cc89ffe6874c7b879b84897ff0b0 Mon Sep 17 00:00:00 2001
From: Mark Vanderwiel <vanderwl@us.ibm.com>
Date: Thu, 17 Mar 2016 12:19:16 -0500
Subject: [PATCH 1262/3333] Add dependency for hexdump

hexdump is used in common function generate_hex_string which is
used by nova and heat.  The current general dependencies do not
have this dependency covered, instead it is usually pulled in by
other implicit dependencies when a full devstack is built. In
cases where only a subset is built (like just Heat and keystone)
hexdump is missing.

Added unit tests for the generate_hex_string function.

Depends-On: Ib47d802a31a0f4c2a49daa7e6698e37c70a2365a
Change-Id: I77c8c2019fb8b8174cdfaed3e56ebf728f0732b7
Closes-Bug: #1558672
---
 files/debs/general      |  1 +
 files/rpms-suse/general |  1 +
 files/rpms/general      |  1 +
 tests/test_functions.sh | 16 ++++++++++++++++
 4 files changed, 19 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 307cd7b113..a1f2a4b159 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,5 +1,6 @@
 bc
 bridge-utils
+bsdmainutils
 curl
 g++
 gcc
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index e3dfec1047..3b19071770 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -25,5 +25,6 @@ screen
 tar
 tcpdump
 unzip
+util-linux
 wget
 zlib-devel
diff --git a/files/rpms/general b/files/rpms/general
index 6d5fd1565c..2d4a97a743 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -30,6 +30,7 @@ screen
 tar
 tcpdump
 unzip
+util-linux
 wget
 which
 zlib-devel
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index be8dc5e287..8aae23dcb8 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -9,6 +9,22 @@ source $TOP/functions
 
 source $TOP/tests/unittest.sh
 
+echo "Testing generate_hex_string()"
+
+VAL=$(generate_hex_string 16)
+if [[ ${#VAL} -eq 32 ]]; then
+    passed "OK"
+else
+    failed "generate_hex_string 16 failed ${#VAL}"
+fi
+
+VAL=$(generate_hex_string 32)
+if [[ ${#VAL} -eq 64 ]]; then
+    passed "OK"
+else
+    failed "generate_hex_string 32 failed ${#VAL}"
+fi
+
 echo "Testing die_if_not_set()"
 
 bash -c "source $TOP/functions; X=`echo Y && true`; die_if_not_set $LINENO X 'not OK'"

From c8c1c615f2bf63e6a1ad9be70a340058bd813919 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Tue, 22 Mar 2016 14:29:47 +0900
Subject: [PATCH 1263/3333] Normalize path for upper-constraints

It seems pip distinguishes paths with .. or extra / for constraints.
For example, the following directories are considered different.

    /path/to/dir
    /path/to//dir
    /path/to/dir/subdir/..

This commit tries to normalize the given directory name to avoid
"Could not satisfy constraints for 'xxxx': installation from path
or url cannot be constrained to a version" error due to directory
name mismatch.

Reference: https://github.com/pypa/pip/pull/3582
Closes-Bug: #1542545
Change-Id: Iae9d58c27d3b10bca16e4a471507c4d5c16439a0
---
 inc/python | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/inc/python b/inc/python
index 35bab6f1e0..495150d4b8 100644
--- a/inc/python
+++ b/inc/python
@@ -300,6 +300,13 @@ function _setup_package_with_constraints_edit {
     local flags=$2
     local extras=$3
 
+    # Normalize the directory name to avoid
+    # "installation from path or url cannot be constrained to a version"
+    # error.
+    # REVISIT(yamamoto): Remove this when fixed in pip.
+    # https://github.com/pypa/pip/pull/3582
+    project_dir=$(cd $project_dir && pwd)
+
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
         local name

From 629917a5dd0f5b56349294e0edc8b5bdd766aa46 Mon Sep 17 00:00:00 2001
From: Brad Behle <behle@us.ibm.com>
Date: Tue, 22 Mar 2016 14:27:32 -0500
Subject: [PATCH 1264/3333] Check for valid network before probe-create call

Check that a public and/or private network exists before calling
probe-create for it, to avoid an error in the case where that
network hasn't been created

Change-Id: If01cec47dc4ab02b5d78074b1354df10dc23b384
Closes-bug: #1560629
---
 lib/neutron-legacy | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e06a020f43..34f9840791 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1453,9 +1453,13 @@ function delete_probe {
 function setup_neutron_debug {
     if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
         public_net_id=`_get_net_id $PUBLIC_NETWORK_NAME`
-        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
+        if [[ -n $public_net_id ]]; then
+            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
+        fi
         private_net_id=`_get_net_id $PRIVATE_NETWORK_NAME`
-        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
+        if [[ -n $private_net_id ]]; then
+            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
+        fi
     fi
 }
 

From 646085d701049004f9b2bcdc38610f3e87579cda Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 21 Mar 2016 17:00:51 -0400
Subject: [PATCH 1265/3333] Add colorful PS4

PS4 can include functions, so when running in the LOG_COLORS=True mode
provide a grey function line so that it's easier to visually
distinguish the content from the location.

Also make it so the main prompt chunks off all the common path, which
means we can printf to 40 characters and have a pretty reasonable and
readable PS4.

Change-Id: I4a10a49db97d413349bcfceeb8c4164936fbcc40
---
 functions              | 13 +++++++++++++
 stackrc                | 16 ++++++++++------
 tools/create_userrc.sh | 16 ++++++++++++++++
 tools/install_pip.sh   |  4 +++-
 4 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/functions b/functions
index 5730b6c894..1bfb8a5078 100644
--- a/functions
+++ b/functions
@@ -30,6 +30,19 @@ function function_exists {
     declare -f -F $1 > /dev/null
 }
 
+# short_source prints out the current location of the caller in a way
+# that strips redundant directories. This is useful for PS4 usage.
+function short_source {
+    saveIFS=$IFS
+    IFS=" "
+    called=($(caller 0))
+    IFS=$saveIFS
+    file=${called[2]}
+    file=${file#$RC_DIR/}
+    printf "%-40s " "$file:${called[1]}:${called[0]}"
+}
+
+
 # Retrieve an image from a URL and upload into Glance.
 # Uses the following variables:
 #
diff --git a/stackrc b/stackrc
index 74d507cfa2..f606bbbd8f 100644
--- a/stackrc
+++ b/stackrc
@@ -14,9 +14,6 @@ unset LANGUAGE
 LC_ALL=C
 export LC_ALL
 
-# Make tracing more educational
-export PS4='+ ${BASH_SOURCE:-}:${FUNCNAME[0]:-}:L${LINENO:-}:   '
-
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 
@@ -132,6 +129,16 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Use color for logging output (only available if syslog is not used)
+LOG_COLOR=$(trueorfalse True LOG_COLOR)
+
+# Make tracing more educational
+if [[ "$LOG_COLOR" == "True" ]]; then
+    export PS4='+\[$(tput setaf 242)\]$(short_source)\[$(tput sgr0)\] '
+else
+    export PS4='+ $(short_source):   '
+fi
+
 # Configure Identity API version: 2.0, 3
 IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
@@ -785,9 +792,6 @@ SYSLOG=$(trueorfalse False SYSLOG)
 SYSLOG_HOST=${SYSLOG_HOST:-$HOST_IP}
 SYSLOG_PORT=${SYSLOG_PORT:-516}
 
-# Use color for logging output (only available if syslog is not used)
-LOG_COLOR=$(trueorfalse True LOG_COLOR)
-
 # Set global ``GIT_DEPTH=<number>`` to limit the history depth of the git clone
 # Set to 0 to disable shallow cloning
 GIT_DEPTH=${GIT_DEPTH:-0}
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 3325c5e586..a7278e47b3 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -7,6 +7,22 @@
 # Warning: This script just for development purposes
 
 set -o errexit
+
+# short_source prints out the current location of the caller in a way
+# that strips redundant directories. This is useful for PS4
+# usage. Needed before we start tracing due to how we set
+# PS4. Normally we'd pick this up from stackrc, but that's not sourced
+# here.
+function short_source {
+    saveIFS=$IFS
+    IFS=" "
+    called=($(caller 0))
+    IFS=$saveIFS
+    file=${called[2]}
+    file=${file#$RC_DIR/}
+    printf "%-40s " "$file:${called[1]}:${called[0]}"
+}
+
 set -o xtrace
 
 ACCOUNT_DIR=./accrc
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 2a9d813eac..87660a677c 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -11,7 +11,6 @@
 # - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
 
 set -o errexit
-set -o xtrace
 
 # Keep track of the current directory
 TOOLS_DIR=$(cd $(dirname "$0") && pwd)
@@ -23,6 +22,9 @@ cd $TOP_DIR
 # Import common functions
 source $TOP_DIR/stackrc
 
+# don't start tracing until after we've sourced the world
+set -o xtrace
+
 FILES=$TOP_DIR/files
 
 PIP_GET_PIP_URL=https://bootstrap.pypa.io/get-pip.py

From 9ea497539bb1e20fc2d247719f98401d5f7cd67c Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 22 Mar 2016 15:22:03 +0100
Subject: [PATCH 1266/3333] Configure the admin as admin

Make our usual admin user to be a real admin,
and open the way for improving the per project
policy.json files.

Change-Id: I133a5953d209bc1edbd03ecfae750f77e3eaa64d
Related-Change: https://review.openstack.org/#/c/242232
---
 lib/keystone | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index acdd7e40a9..71f20ac0b0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -340,6 +340,12 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
+
+    # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
+    # The users from this project are globally admin as before, but it also
+    # allows policy changes in order to clarify the adminess scope.
+    iniset $KEYSTONE_CONF resource admin_project_domain_name default
+    iniset $KEYSTONE_CONF resource admin_project_name admin
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts

From 130c3adb0e88044c9cf3789e79f6e669fa30d7d2 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Wed, 24 Jun 2015 15:40:32 -0600
Subject: [PATCH 1267/3333] WIP - Remove lbaas from devstack proper

Lbaas devstack support is now in the neutron-lbaas repo, so we can move
towards removing it here. This will explode hard, but let's start peeling
the onion.

This can't merge until p-c no longer references lbaas jobs.

Change-Id: I1c49877bab53f6b25385302420086b25e3eeeebf
---
 lib/neutron-legacy                        | 40 +-----------------
 lib/neutron_plugins/services/loadbalancer | 51 -----------------------
 stackrc                                   |  4 --
 3 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e06a020f43..573b061a4a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -107,7 +107,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
@@ -122,9 +121,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# Default provider for load balancer service
-DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
-
 # Default provider for VPN service
 DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
 
@@ -347,12 +343,6 @@ if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
     source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 fi
 
-# Agent loadbalancer service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
-
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -442,10 +432,6 @@ function configure_neutron {
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-    if is_service_enabled q-lbaas; then
-        deprecated "Configuring q-lbaas through devstack is deprecated"
-        _configure_neutron_lbaas
-    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -656,10 +642,6 @@ function install_neutron {
         git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
         setup_develop $NEUTRON_FWAAS_DIR
     fi
-    if is_service_enabled q-lbaas; then
-        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-        setup_develop $NEUTRON_LBAAS_DIR
-    fi
     if is_service_enabled q-vpn; then
         git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
         setup_develop $NEUTRON_VPNAAS_DIR
@@ -703,10 +685,6 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
-
-    if is_service_enabled q-lbaas; then
-        neutron_agent_lbaas_install_agent_packages
-    fi
 }
 
 # Start running processes, including screen
@@ -769,7 +747,6 @@ function start_neutron_other_agents {
     fi
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
-    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -808,9 +785,6 @@ function stop_neutron_other {
         stop_process q-meta
     fi
 
-    if is_service_enabled q-lbaas; then
-        neutron_lbaas_stop
-    fi
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
@@ -915,7 +889,7 @@ function cleanup_neutron {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
@@ -1108,18 +1082,6 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
-function _configure_neutron_lbaas {
-    # Uses oslo config generator to generate LBaaS sample configuration files
-    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
-        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
-    fi
-    neutron_agent_lbaas_configure_common
-    neutron_agent_lbaas_configure_agent
-}
-
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
deleted file mode 100644
index 30e9480f2e..0000000000
--- a/lib/neutron_plugins/services/loadbalancer
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-
-# Neutron loadbalancer plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
-LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
-
-function neutron_agent_lbaas_install_agent_packages {
-    if is_ubuntu || is_fedora || is_suse; then
-        install_package haproxy
-    fi
-}
-
-function neutron_agent_lbaas_configure_common {
-    _neutron_service_plugin_class_add $LBAAS_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
-}
-
-function neutron_agent_lbaas_configure_agent {
-    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
-    mkdir -p $LBAAS_AGENT_CONF_PATH
-
-    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
-
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
-
-    if is_fedora; then
-        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
-        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
-    fi
-}
-
-function neutron_lbaas_stop {
-    pids=$(ps aux | awk '/haproxy/ { print $2 }')
-    [ ! -z "$pids" ] && sudo kill $pids || true
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/stackrc b/stackrc
index 74d507cfa2..ffb3596be6 100644
--- a/stackrc
+++ b/stackrc
@@ -231,10 +231,6 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
-# neutron lbaas service
-NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
-NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
-
 # neutron vpnaas service
 NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
 NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}

From 84d2298d3b97e43df8ec80f53bec15e8e61f8cdf Mon Sep 17 00:00:00 2001
From: Waldemar Znoinski <waldemar.znoinski@intel.com>
Date: Thu, 24 Mar 2016 12:27:53 +0000
Subject: [PATCH 1268/3333] Tox: don't check localrc with bashate

Change-Id: I9fc5f9f106184c92e555e25ab09883cbed054ca4
Closes-Bug: #1561500
---
 tox.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tox.ini b/tox.ini
index 3dfc37711c..4ec293939e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,6 +18,7 @@ commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
          -not \( -type d -name doc -prune \)     \
          -not \( -type d -name shocco -prune \)  \
+         -not \( -type f -name localrc -prune \) \
          -type f                                 \
          -not -name \*~                          \
          -not -name \*.md                        \

From 556eeb0d358746ed4587440093c2739fb0a57c2b Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 24 Mar 2016 14:01:57 -0500
Subject: [PATCH 1269/3333] Drop keystone eventlet support

Keystone has dropped support for running under eventlet (using
keystone-all).

Change-Id: Ib38c0b1a54633a6b6dfa3a0a605cd2b02ca48989
---
 lib/keystone | 24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 71f20ac0b0..d83092405b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -61,7 +61,6 @@ KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}
 
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
-# - eventlet : Run keystone-all
 # - uwsgi : Run keystone under uwsgi
 if [ -z "$KEYSTONE_DEPLOY" ]; then
     if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
@@ -69,7 +68,7 @@ if [ -z "$KEYSTONE_DEPLOY" ]; then
     elif [ "$KEYSTONE_USE_MOD_WSGI" == True ]; then
         KEYSTONE_DEPLOY=mod_wsgi
     else
-        KEYSTONE_DEPLOY=eventlet
+        KEYSTONE_DEPLOY=uwsgi
     fi
 fi
 
@@ -283,7 +282,7 @@ function configure_keystone {
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
-    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+    else # uwsgi
         # iniset creates these files when it's called if they don't exist.
         KEYSTONE_PUBLIC_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
         KEYSTONE_ADMIN_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
@@ -321,20 +320,6 @@ function configure_keystone {
             # Make sure the client doesn't try to re-use the connection.
             iniset "$file" uwsgi add-header "Connection: close"
         done
-
-    else # eventlet
-        if is_ssl_enabled_service key; then
-            iniset $KEYSTONE_CONF eventlet_server_ssl enable True
-            iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
-            iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
-        fi
-
-        iniset $KEYSTONE_CONF eventlet_server public_port $service_port
-        iniset $KEYSTONE_CONF eventlet_server admin_port $auth_port
-
-        iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
-        iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
-        # Public workers will use the server default, typically number of CPU.
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -583,12 +568,9 @@ function start_keystone {
         restart_apache_server
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
-    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+    else # uwsgi
         run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
         run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
-    else # eventlet
-        # Start Keystone in a screen window
-        run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"
     fi
 
     echo "Waiting for keystone to start..."

From 8b416ae821d8487f22d3d564c30da44d6cb2826a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 25 Mar 2016 08:58:54 -0400
Subject: [PATCH 1270/3333] run swift blocks if any services are enabled

Previously the swift blocks only ran if s-proxy is enabled, which
prevents a multinode configuration. We should run these blocks if any
swift services are enabled, and push proxy specific conditionals one
step lower.

Change-Id: I540a97615b3c19f882c8673b1a4a29cd47e36aa8
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 5c16f042d8..84eefd2304 100755
--- a/stack.sh
+++ b/stack.sh
@@ -799,7 +799,7 @@ if is_service_enabled keystone; then
     fi
 fi
 
-if is_service_enabled s-proxy; then
+if is_service_enabled swift; then
     if is_service_enabled ceilometer; then
         install_ceilometermiddleware
     fi
@@ -1118,7 +1118,7 @@ fi
 # Storage Service
 # ---------------
 
-if is_service_enabled s-proxy; then
+if is_service_enabled swift; then
     echo_summary "Configuring Swift"
     init_swift
 fi
@@ -1172,7 +1172,7 @@ merge_config_group $TOP_DIR/local.conf post-config
 # Only run the services specified in ``ENABLED_SERVICES``
 
 # Launch Swift Services
-if is_service_enabled s-proxy; then
+if is_service_enabled swift; then
     echo_summary "Starting Swift"
     start_swift
 fi

From 0948ab90ae2097da2d9e4f401cda3698e32621f4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 25 Mar 2016 19:39:43 -0400
Subject: [PATCH 1271/3333] Move auth setup earlier in tempest config

This commit moves the auth setup for tempest config to occur before
we run tempest verify-config. The API requests that command runs
require auth and in the case we run tempest without admin creds set
the config file will not have any credentials to run the query with.
By moving the auth setup to occur before this it will ensure tempest
is always configured with credentials before we run the command.

Change-Id: I6d11b24e4492f1fde3aa3a7a239c40d63111bfa1
---
 lib/tempest | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 19b63d18da..ed26cafe2c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -325,6 +325,24 @@ function configure_tempest {
     if [[ "$OFFLINE" != "True" ]]; then
         tox -revenv --notest
     fi
+
+    # Auth
+    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
+        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+        else
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+        fi
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
+        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+
+    else
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+    fi
+
     # NOTE(mtreinish): Respect constraints on tempest verify-config venv
     tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     tox -evenv -- tempest verify-config -uro $tmp_cfg_file
@@ -553,23 +571,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG service_available cinder "False"
     fi
 
-    # Auth
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
-    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
-        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
-        else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
-        fi
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
-        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
-    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
-
-    else
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
-    fi
-
     # Restore IFS
     IFS=$ifs
 }

From fb94891b80e5bfa19acf8b261d68db108a147042 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Sun, 27 Mar 2016 08:59:42 +0200
Subject: [PATCH 1272/3333] Use configure_auth_token_middleware for neutron

auch configuration in the nova section in neutron.conf was
still setup manually. Just reuse the function
configure_auth_token_middleware() for configuration to simplify
the code.

Change-Id: Ib5a7e9212e2d1242bdbec75cf3fac13d5c42a2e2
---
 lib/neutron-legacy | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e06a020f43..f38f14223b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1189,14 +1189,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    iniset $NEUTRON_CONF nova auth_type password
-    iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
-    iniset $NEUTRON_CONF nova username nova
-    iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
-    iniset $NEUTRON_CONF nova user_domain_id default
-    iniset $NEUTRON_CONF nova project_name $SERVICE_PROJECT_NAME
-    iniset $NEUTRON_CONF nova project_domain_id default
-    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
     # Configure plugin
     neutron_plugin_configure_service

From be00e95da5ae57c6aaa547ee01a5cab9a13862ca Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 24 Mar 2016 18:09:22 -0400
Subject: [PATCH 1273/3333] Add OS_CACERT to userrc_early and ensure
 SERVICE_HOST is SAN

OS_CACERT was being added directly to the environment rather
than usercc_early. This caused an untrusted CA error to be
thrown.

Ensure that SERVICE_HOST is in the Subject Alt. Names of the
issued TLS server cert. The gate sets it to 127.0.0.1 which
wasn't being handled. Only the FQDN of the host and actual
IP address of the machine were being added.

Change-Id: I8a91dffe1a5263d2bcc99ea406a8556045b52be2
---
 lib/tls  | 8 ++++++++
 stack.sh | 8 ++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/tls b/lib/tls
index f4740b88be..ca57ed44e0 100644
--- a/lib/tls
+++ b/lib/tls
@@ -257,6 +257,14 @@ function make_cert {
     local common_name=$3
     local alt_names=$4
 
+    if [ "$common_name" != "$SERVICE_HOST" ]; then
+        if [[ -z "$alt_names" ]]; then
+            alt_names="DNS:$SERVICE_HOST"
+        else
+            alt_names="$alt_names,DNS:$SERVICE_HOST"
+        fi
+    fi
+
     # Only generate the certificate if it doesn't exist yet on the disk
     if [ ! -r "$ca_dir/$cert_name.crt" ]; then
         # Generate a signing request
diff --git a/stack.sh b/stack.sh
index 5c16f042d8..b91c106ed8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1004,10 +1004,6 @@ if is_service_enabled keystone; then
         bootstrap_keystone
     fi
 
-    if is_service_enabled tls-proxy; then
-        export OS_CACERT=$INT_CA_DIR/ca-chain.pem
-    fi
-
     # Rather than just export these, we write them out to a
     # intermediate userrc file that can also be used to debug if
     # something goes wrong between here and running
@@ -1028,6 +1024,10 @@ export OS_REGION_NAME=$REGION_NAME
 
 EOF
 
+    if is_service_enabled tls-proxy; then
+        echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
+    fi
+
     source $TOP_DIR/userrc_early
 
     create_keystone_accounts

From 70dcc17592c647600ec566686a1f63f2e802225e Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 28 Mar 2016 18:40:05 +0200
Subject: [PATCH 1274/3333] Remove libnspr4-dev for ceilometer-collector

Since change Ie38deadf190db33863c99d4610157349484ac10f ceilometer does
not use spidermonkey which needed libnspr4-dev to be installed. Thus the
requirement can be removed now.

Change-Id: Ib0685181f1cc4c9b58411a1679ac9dec1812f683
---
 files/debs/ceilometer-collector | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
index d1e9eef3bb..c41f159c7a 100644
--- a/files/debs/ceilometer-collector
+++ b/files/debs/ceilometer-collector
@@ -1,3 +1,2 @@
-libnspr4-dev
 mongodb-server #NOPRIME
 python-pymongo #NOPRIME

From bb49d35739b6375202a4ff23d49fdced6693472c Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 28 Mar 2016 11:03:35 -0700
Subject: [PATCH 1275/3333] Run online_data_migrations during nova setup

This is a normal step in the process for upgrade and is now
required for migration of flavors from the main DB to the API DB.
Since we previously made a bad decision to encode those flavors into
the first database migration, that means that even on new installs we
need to run these.

Deployment tools are going to be running this command any time they
do anything to the database post-deployment, which means adding this
to devstack is putting it in line with what normal deployments will
be doing.

Change-Id: I8ab03af9d2f4974f26a7f8487ec978caea957e45
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index 2b8fefaf00..602a6ef8cf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -708,6 +708,10 @@ function init_nova {
 
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage api_db sync
+
+        # Run online migrations on the new databases
+        # Needed for flavor conversion
+        $NOVA_BIN_DIR/nova-manage db online_data_migrations
     fi
 
     create_nova_cache_dir

From de40d9234b2436c6279ca1f913d9a2c69c11976d Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Tue, 29 Mar 2016 12:04:24 +0200
Subject: [PATCH 1276/3333] Remove Ceilometer leftover

Ceilometer uses a devstack plugin for a while now, so there should not
be any need for this file in the main devstack repository.

Change-Id: I3577c52b106c63c465a40ea3740eb5b8384e900e
---
 files/debs/ceilometer-collector      | 2 --
 files/rpms-suse/ceilometer-collector | 3 ---
 files/rpms/ceilometer-collector      | 3 ---
 3 files changed, 8 deletions(-)
 delete mode 100644 files/debs/ceilometer-collector
 delete mode 100644 files/rpms-suse/ceilometer-collector
 delete mode 100644 files/rpms/ceilometer-collector

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
deleted file mode 100644
index c41f159c7a..0000000000
--- a/files/debs/ceilometer-collector
+++ /dev/null
@@ -1,2 +0,0 @@
-mongodb-server #NOPRIME
-python-pymongo #NOPRIME
diff --git a/files/rpms-suse/ceilometer-collector b/files/rpms-suse/ceilometer-collector
deleted file mode 100644
index fc75ffad63..0000000000
--- a/files/rpms-suse/ceilometer-collector
+++ /dev/null
@@ -1,3 +0,0 @@
-# (devel:languages:python and server:database projects)
-mongodb
-# Not available in openSUSE main repositories, but can be fetched from OBS
diff --git a/files/rpms/ceilometer-collector b/files/rpms/ceilometer-collector
deleted file mode 100644
index a8b81187ed..0000000000
--- a/files/rpms/ceilometer-collector
+++ /dev/null
@@ -1,3 +0,0 @@
-mongodb # NOPRIME
-mongodb-server #NOPRIME
-selinux-policy-targeted

From 908a3a952300ae5ff8a00392ee2b5577ea5c6e7d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 29 Mar 2016 14:47:09 +1100
Subject: [PATCH 1277/3333] Add total timings

Printing the total makes it easier to compare runs at a glance.  Clean
up the output a little, and use some consistent, name-spaced globals
while we're there.

Note the total runtime is at the top to avoid giving the impression
that it is the sum of the components below, since you can nest/overlap
timers (I made that mistake in a prior change :).  It might be a fun
exercise in tree building to one day track the overlaps and present a
nice nested breakdown.

Change-Id: I878ce03813d21138df493b82bceff3aaa7f83064
---
 functions-common | 54 ++++++++++++++++++++++++++++++++++--------------
 1 file changed, 38 insertions(+), 16 deletions(-)

diff --git a/functions-common b/functions-common
index 5ae974558a..b0352d38c6 100644
--- a/functions-common
+++ b/functions-common
@@ -2322,8 +2322,9 @@ function sudo_with_proxies {
 # Resolution is only in whole seconds, so should be used for long
 # running activities.
 
-declare -A TOTAL_TIME
-declare -A START_TIME
+declare -A _TIME_TOTAL
+declare -A _TIME_START
+declare -r _TIME_BEGIN=$(date +%s)
 
 # time_start $name
 #
@@ -2331,11 +2332,11 @@ declare -A START_TIME
 # already started.
 function time_start {
     local name=$1
-    local start_time=${START_TIME[$name]}
+    local start_time=${_TIME_START[$name]}
     if [[ -n "$start_time" ]]; then
         die $LINENO "Trying to start the clock on $name, but it's already been started"
     fi
-    START_TIME[$name]=$(date +%s)
+    _TIME_START[$name]=$(date +%s)
 }
 
 # time_stop $name
@@ -2351,32 +2352,53 @@ function time_stop {
     local start_time
 
     name=$1
-    start_time=${START_TIME[$name]}
+    start_time=${_TIME_START[$name]}
 
     if [[ -z "$start_time" ]]; then
         die $LINENO "Trying to stop the clock on $name, but it was never started"
     fi
     end_time=$(date +%s)
     elapsed_time=$(($end_time - $start_time))
-    total=${TOTAL_TIME[$name]:-0}
+    total=${_TIME_TOTAL[$name]:-0}
     # reset the clock so we can start it in the future
-    START_TIME[$name]=""
-    TOTAL_TIME[$name]=$(($total + $elapsed_time))
+    _TIME_START[$name]=""
+    _TIME_TOTAL[$name]=$(($total + $elapsed_time))
 }
 
 # time_totals
-#
-# prints out total time
+#  Print out total time summary
 function time_totals {
+    local elapsed_time
+    local end_time
+    local len=15
+    local xtrace
+
+    end_time=$(date +%s)
+    elapsed_time=$(($end_time - $_TIME_BEGIN))
+
+    # pad 1st column this far
+    for t in ${!_TIME_TOTAL[*]}; do
+        if [[ ${#t} -gt $len ]]; then
+            len=${#t}
+        fi
+    done
+
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     echo
-    echo "========================"
-    echo "DevStack Components Timed"
-    echo "========================"
+    echo "========================="
+    echo "DevStack Component Timing"
+    echo "========================="
+    printf "%-${len}s %3d\n" "Total runtime" "$elapsed_time"
     echo
-    for t in ${!TOTAL_TIME[*]}; do
-        local v=${TOTAL_TIME[$t]}
-        echo "$t - $v secs"
+    for t in ${!_TIME_TOTAL[*]}; do
+        local v=${_TIME_TOTAL[$t]}
+        printf "%-${len}s %3d\n" "$t" "$v"
     done
+    echo "========================="
+
+    $xtrace
 }
 
 # Restore xtrace

From e256174d9ada372555f1cd6fbbf0680c5c945c60 Mon Sep 17 00:00:00 2001
From: Ethan Lynn <xjunlin@cn.ibm.com>
Date: Wed, 30 Mar 2016 23:40:56 +0800
Subject: [PATCH 1278/3333] Correct openrc script for zsh

Since commit 7580a0c3e37932a8fc03750d35ccd4e13e18f8c4, openrc
print a WARNING message to stdout, it will break the zsh script
in faq.rst. This patch redirect openrc output to /dev/null.

Change-Id: Iaba03634d7a234cd4d120477f91ef56d0595cdf6
Closes-Bug: #1563940
---
 doc/source/faq.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index cd4891519b..7793d8eb68 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -85,7 +85,7 @@ through bash for this
 
    function sourceopenrc {
        pushd ~/devstack >/dev/null
-       eval $(bash -c ". openrc $1 $2;env|sed -n '/OS_/ { s/^/export /;p}'")
+       eval $(bash -c ". openrc $1 $2 >/dev/null;env|sed -n '/OS_/ { s/^/export /;p}'")
        popd >/dev/null
    }
 

From 7a9d78a59e7a1b7bcba390c18d6f5ca3a07bf4b4 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 31 Mar 2016 09:54:42 -0400
Subject: [PATCH 1279/3333] Cleanup from zookeeper->dlm change

In I33525e2b83a4497a57ec95f62880e0308c88b34f, we switched
from zookeeper to dlm. Somehow this got left behind.

Change-Id: I41d13d33c9a81271d4a9752cbe98c0028a17ab1e
---
 unstack.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index 7a7c945c8a..83703ec28a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -175,10 +175,6 @@ if is_service_enabled dstat; then
     stop_dstat
 fi
 
-if is_service_enabled zookeeper; then
-    stop_zookeeper
-fi
-
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)
 if [[ -n "$SCREEN" ]]; then

From 087ed52cb523956ccace89ba11483207f663abf1 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 16 Mar 2016 11:53:09 -0400
Subject: [PATCH 1280/3333] Neutron: MTU settings are now sane, so remove from
 DevStack

Neutron had a lot of work done during the Mitaka cycle to fix MTU
issues, so let's see if Neutron can stand on its own.

This commit reverts 06cfce37560243d22cd05b2c620be6702528a0b1

Neutron patches:
I6ffc8973c9b8f46cc19922ff04fdd2d23646b878
I4096a3e7704032fa4aa5c3aa8bcaec4e38d0d06d
I6a10c4dfc1f2198667f3d02528e2ca8020cb5bb8
Ic091fa78dfd133179c71cbc847bf955a06cb248a
Idf6221fee2c7da86123b330ad3c235ecc6868242
I6859ebdde1f7e3a8163b49d705620e522ada606a

Change-Id: Ie88c7ebb29adadde530217c95e2f38aacb119dc8
---
 doc/source/guides/neutron.rst | 13 +++++++++----
 lib/neutron_plugins/ml2       | 12 ------------
 2 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index cac7bb0152..1c43c119f6 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -443,13 +443,18 @@ Miscellaneous Tips
 Non-Standard MTU on the Physical Network
 ----------------------------------------
 
-DevStack defaults to assume that the MTU on the physical network
-is 1500.  A different MTU can be specified by adding the following to
-the `localrc` part of `local.conf` on each machine.
+Neutron by default uses a MTU of 1500 bytes, which is
+the standard MTU for Ethernet.
+
+A different MTU can be specified by adding the following to
+the Neutron section of `local.conf`. For example,
+if you have network equipment that supports jumbo frames, you could
+set the MTU to 9000 bytes by adding the following
 
 ::
 
-    Q_ML2_PLUGIN_PATH_MTU=1500
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+    global_physnet_mtu = 9000
 
 
 Disabling Next Generation Firewall Tools
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 0483ef1fac..30e1b036f3 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -40,12 +40,6 @@ Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 # L3 Plugin to load for ML2
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
 
-# Underlying path MTU for physical network managing br-tun; use '-' instead of
-# ':-' to allow people to explicitly override this to blank, to disable
-# automatic MTU calculation for tunnelled tenant networks
-Q_ML2_PLUGIN_PATH_MTU=${Q_ML2_PLUGIN_PATH_MTU-1500}
-
-
 function populate_ml2_config {
     CONF=$1
     SECTION=$2
@@ -83,12 +77,6 @@ function neutron_plugin_configure_service {
         echo "WARNING - The ml2 plugin is using local tenant networks, with no connectivity between hosts."
     fi
 
-    # Enable ml2 mtu calculation mechanism for networks by providing path mtu
-    # value for physical devices that are used for br-tun traffic
-    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]] && [[ "$Q_ML2_PLUGIN_PATH_MTU" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE ml2 path_mtu "$Q_ML2_PLUGIN_PATH_MTU"
-    fi
-
     # Allow for overrding VLAN configuration (for example, to configure provider
     # VLANs) by first checking if Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS is set.
     if [ "$Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS" == "" ]; then

From 6099401e002f228daf5110e1dd0a530dc1c737fc Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Tue, 8 Mar 2016 20:55:01 +0900
Subject: [PATCH 1281/3333] In worlddump, cover all supported version of
 OpenFlow protocol by ovs-ofctl

Currently ovs-ofctl command is executed for only default ofp version
(OpenFlow10).
Some Neutron's plugin uses OpenFlow13 and in that case ovs-ofctl fails.
This chage allows us to get ovs info for all ofp versions supported by ovs.
And adds dump by dump-ports and dump-ports-desc.

Change-Id: I2d3c42835a5ad0f5ebf540e8127762f466347c9c
---
 tools/worlddump.py | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 72a257fa8c..345c2a3d94 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -76,6 +76,24 @@ def _header(name):
     print
 
 
+# This method gets a max openflow version supported by openvswitch.
+# For example 'ovs-ofctl --version' displays the following:
+#
+#     ovs-ofctl (Open vSwitch) 2.0.2
+#     Compiled Dec  9 2015 14:08:08
+#     OpenFlow versions 0x1:0x4
+#
+# The above shows that openvswitch supports from OpenFlow11 to OpenFlow13.
+# This method gets max version searching 'OpenFlow versions 0x1:0x'.
+# And return a version value converted to an integer type.
+def _get_ofp_version():
+    process = subprocess.Popen(['ovs-ofctl', '--version'], stdout=subprocess.PIPE)
+    stdout, _ = process.communicate()
+    find_str = 'OpenFlow versions 0x1:0x'
+    offset = stdout.find(find_str)
+    return int(stdout[offset + len(find_str):-1]) - 1
+
+
 def disk_space():
     # the df output
     _header("File System Summary")
@@ -143,11 +161,16 @@ def ovs_dump():
     # grenade), so there is no single place to determine the bridge names from.
     # Hardcode for now.
     bridges = ('br-int', 'br-tun', 'br-ex')
+    ofctl_cmds = ('show', 'dump-ports-desc', 'dump-ports', 'dump-flows')
+    ofp_max = _get_ofp_version()
+    vers = 'OpenFlow10'
+    for i in range(ofp_max + 1):
+        vers += ',OpenFlow1' + str(i)
     _dump_cmd("sudo ovs-vsctl show")
-    for bridge in bridges:
-        _dump_cmd("sudo ovs-ofctl show %s" % bridge)
-    for bridge in bridges:
-        _dump_cmd("sudo ovs-ofctl dump-flows %s" % bridge)
+    for ofctl_cmd in ofctl_cmds:
+        for bridge in bridges:
+            args = {'vers': vers, 'cmd': ofctl_cmd, 'bridge': bridge}
+            _dump_cmd("sudo ovs-ofctl --protocols=%(vers)s %(cmd)s %(bridge)s" % args)
 
 
 def process_list():

From 1c7333c40ece0199761fa6e2ab93a9ed143240ad Mon Sep 17 00:00:00 2001
From: Komei Shimamura <komei.t.f@gmail.com>
Date: Sun, 3 Apr 2016 01:08:38 +0900
Subject: [PATCH 1282/3333] Add kafka-devstack-plugin to plugin-registry.rst

kafka-devstack-plugin is available now:

  Iceb054f0dfab2fff1920cc7dc36a4be256c6f161

Change-Id: I518bd079296a110a018f77b9b107883f3933e38a
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 136a9e4e92..b4671234ed 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -60,6 +60,8 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |devstack-plugin-hdfs        |git://git.openstack.org/openstack/devstack-plugin-hdfs                   |
 +----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-kafka       |git://git.openstack.org/openstack/devstack-plugin-kafka                  |
++----------------------------+-------------------------------------------------------------------------+
 |devstack-plugin-pika        |git://git.openstack.org/openstack/devstack-plugin-pika                   |
 +----------------------------+-------------------------------------------------------------------------+
 |devstack-plugin-sheepdog    |git://git.openstack.org/openstack/devstack-plugin-sheepdog               |

From 930bc437affea40ba0876770f902ff5483b423b9 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Sat, 2 Apr 2016 15:11:45 -0400
Subject: [PATCH 1283/3333] Plugin autogen list: put plugin names in the plugin
 names column

Change-Id: I1f2c66fa1bf8fd73ee6693d4919e33e3f14487c5
---
 tools/generate-devstack-plugins-list.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 82486f5b2d..c3c8f24dbd 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -75,7 +75,7 @@ title_underline ${name_col_len}
 for plugin in ${sorted_plugins}; do
     giturl="git://git.openstack.org/openstack/${plugin}"
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
-    printf "%-${name_col_len}s %s\n" "${p}" "\`${giturl} <${gitlink}>\`__"
+    printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then

From 76392b5b44103c1ed061f4e2f1bae8ca6767c6a6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:07:08 -0400
Subject: [PATCH 1284/3333] change internal variables from tenant_id ->
 project_id

As part of the "reduce confusion on tenant_id" we need to change as
many references as possible over to project_id.

Change-Id: Ia665312f24672b106e12fde93b60f142620c3a45
---
 lib/tempest | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index ed26cafe2c..d8790f8345 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -180,14 +180,14 @@ function configure_tempest {
 
     # See ``lib/keystone`` where these users and tenants are set up
     local admin_username=${ADMIN_USERNAME:-admin}
-    local admin_tenant_name=${ADMIN_TENANT_NAME:-admin}
+    local admin_project_name=${ADMIN_TENANT_NAME:-admin}
     local admin_domain_name=${ADMIN_DOMAIN_NAME:-Default}
     local tempest_username=${TEMPEST_USERNAME:-demo}
-    local tempest_tenant_name=${TEMPEST_TENANT_NAME:-demo}
+    local tempest_project_name=${TEMPEST_TENANT_NAME:-demo}
     local alt_username=${ALT_USERNAME:-alt_demo}
-    local alt_tenant_name=${ALT_TENANT_NAME:-alt_demo}
-    local admin_tenant_id
-    admin_tenant_id=$(openstack project list | awk "/ admin / { print \$2 }")
+    local alt_project_name=${ALT_TENANT_NAME:-alt_demo}
+    local admin_project_id
+    admin_project_id=$(openstack project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
@@ -263,8 +263,8 @@ function configure_tempest {
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"
-        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_tenant_name
-        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_tenant_id
+        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_project_name
+        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_project_id
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
@@ -330,9 +330,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From ab0a1b881225f83cfe6454091881d5ffd6626a65 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:09:27 -0400
Subject: [PATCH 1285/3333] change cinder SC to use $(project_id)

This removes another place where we reference tenant_id

Change-Id: I88fa1c5475105c301b27672b028bddb289f9c108
---
 lib/cinder | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 1b6a956f8f..4df7de8959 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -375,17 +375,17 @@ function create_cinder_accounts {
         get_or_create_endpoint \
             "volume" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
         get_or_create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
     fi
 }
 

From cbdc5d9e48d9d91fcc7a667839d592ff85ed1f09 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:10:44 -0400
Subject: [PATCH 1286/3333] switch over heat to using $(project_id) in service
 catalog

This removes one more place where we reference tenant_id

Change-Id: I721269c3397bd5e5d9cea5faf3fc691f296a517b
---
 lib/heat | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/heat b/lib/heat
index 2cf7a19d40..4326321bd1 100644
--- a/lib/heat
+++ b/lib/heat
@@ -391,9 +391,9 @@ function create_heat_accounts {
         get_or_create_endpoint \
             "orchestration" \
             "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
 
         get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
         get_or_create_endpoint \

From 2a9a9df942d68431b893fdfd83eec24fb7999391 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean_mcginnis@dell.com>
Date: Mon, 4 Apr 2016 13:58:59 -0500
Subject: [PATCH 1287/3333] Remove driver certs directory

Cinder was the only project with a script in driver_certs. That cert is
no longer required for Cinder as we now just require that third party CI
is run for all drivers before acceptance.

This removes the cinder cert test script and the now empty driver_certs
directory.

Change-Id: I8d0867c4720f324b8dbf3c64ddf66ff267996d10
---
 driver_certs/cinder_driver_cert.sh | 106 -----------------------------
 1 file changed, 106 deletions(-)
 delete mode 100755 driver_certs/cinder_driver_cert.sh

diff --git a/driver_certs/cinder_driver_cert.sh b/driver_certs/cinder_driver_cert.sh
deleted file mode 100755
index d066e0667f..0000000000
--- a/driver_certs/cinder_driver_cert.sh
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/usr/bin/env bash
-
-# **cinder_cert.sh**
-
-# This script is a simple wrapper around the tempest volume api tests
-# It requires that you have a working and functional devstack install
-# and that you've enabled your device driver by making the necessary
-# modifications to /etc/cinder/cinder.conf
-
-# This script will refresh your openstack repo's and restart the cinder
-# services to pick up your driver changes.
-# please NOTE; this script assumes your devstack install is functional
-# and includes tempest. A good first step is to make sure you can
-# create volumes on your device before you even try and run this script.
-
-# It also assumes default install location (/opt/stack/xxx)
-# to aid in debug, you should also verify that you've added
-# an output directory for screen logs:
-#
-#     SCREEN_LOGDIR=/opt/stack/screen-logs
-
-set -o pipefail
-
-CERT_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $CERT_DIR/..; pwd)
-
-source $TOP_DIR/functions
-source $TOP_DIR/stackrc
-source $TOP_DIR/openrc
-source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/tempest
-source $TOP_DIR/lib/cinder
-
-TEMPFILE=`mktemp`
-RECLONE=True
-
-function log_message {
-    MESSAGE=$1
-    STEP_HEADER=$2
-    if [[ "$STEP_HEADER" = "True" ]]; then
-        echo -e "\n========================================================" | tee -a $TEMPFILE
-    fi
-    echo -e `date +%m/%d/%y/%T:`"${MESSAGE}" | tee -a $TEMPFILE
-    if [[ "$STEP_HEADER" = "True" ]]; then
-        echo -e "========================================================" | tee -a $TEMPFILE
-    fi
-}
-
-if [[ "$OFFLINE" = "True" ]]; then
-    echo "ERROR: Driver cert requires fresh clone/pull from ${CINDER_BRANCH}"
-    echo "       Please set OFFLINE=False and retry."
-    exit 1
-fi
-
-log_message "RUNNING CINDER DRIVER CERTIFICATION CHECK", True
-log_message "Output is being logged to: $TEMPFILE"
-
-cd $CINDER_DIR
-log_message "Cloning to ${CINDER_REPO}...", True
-install_cinder
-
-log_message "Pull a fresh Clone of cinder repo...", True
-git status | tee -a $TEMPFILE
-git log --pretty=oneline -n 1 | tee -a $TEMPFILE
-
-log_message "Gathering copy of cinder.conf file (passwords will be scrubbed)...", True
-cat /etc/cinder/cinder.conf | egrep -v "(^#.*|^$)" | tee -a $TEMPFILE
-sed -i "s/\(.*password.*=\).*$/\1 xxx/i" $TEMPFILE
-log_message "End of cinder.conf.", True
-
-cd $TOP_DIR
-# Verify tempest is installed/enabled
-if ! is_service_enabled tempest; then
-    log_message "ERROR!!! Cert requires tempest in enabled_services!", True
-    log_message"       Please add tempest to enabled_services and retry."
-    exit 1
-fi
-
-cd $TEMPEST_DIR
-install_tempest
-
-log_message "Verify tempest is current....", True
-git status | tee -a $TEMPFILE
-log_message "Check status and get latest commit..."
-git log --pretty=oneline -n 1 | tee -a $TEMPFILE
-
-
-#stop and restart cinder services
-log_message "Restart Cinder services...", True
-stop_cinder
-sleep 1
-start_cinder
-sleep 5
-
-# run tempest api/volume/test_*
-log_message "Run the actual tempest volume tests (./tools/pretty_tox.sh volume)...", True
-./tools/pretty_tox.sh volume 2>&1 | tee -a $TEMPFILE
-if [[ $? = 0 ]]; then
-    log_message "CONGRATULATIONS!!!  Device driver PASSED!", True
-    log_message "Submit output: ($TEMPFILE)"
-    exit 0
-else
-    log_message "SORRY!!!  Device driver FAILED!", True
-    log_message "Check output in $TEMPFILE"
-    exit 1
-fi

From 2bd2568bd186162f44814d149030368cfa2db006 Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Tue, 5 Apr 2016 10:33:50 +0900
Subject: [PATCH 1288/3333] Fix a typo in comment for _get_ofp_version

OpenFlow11 -> OpenFlow10

Change-Id: I2a501ccd32f5f7a39fd4bc746f00ca3f67bd98c1
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 345c2a3d94..3ff22a9dfd 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -83,7 +83,7 @@ def _header(name):
 #     Compiled Dec  9 2015 14:08:08
 #     OpenFlow versions 0x1:0x4
 #
-# The above shows that openvswitch supports from OpenFlow11 to OpenFlow13.
+# The above shows that openvswitch supports from OpenFlow10 to OpenFlow13.
 # This method gets max version searching 'OpenFlow versions 0x1:0x'.
 # And return a version value converted to an integer type.
 def _get_ofp_version():

From 260583e25eabffd70942c7d97df09a5dd2ed55d6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:11:25 -0400
Subject: [PATCH 1289/3333] Switch over swift to using $(project_id) in service
 catalog

This removes one more place where we use tenant_id in our code.

Change-Id: I628fb7c1dd6f22ce499fc5cbe97b79458cce966f
---
 lib/swift | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index 8c5aa5e4e8..b2fe755cef 100644
--- a/lib/swift
+++ b/lib/swift
@@ -631,9 +631,9 @@ function create_swift_accounts {
     get_or_create_endpoint \
         "object-store" \
         "$REGION_NAME" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s"
 
     local swift_tenant_test1
     swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)

From 4b205db45b34e698734740b50752e11b75035e72 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 4 Apr 2016 10:37:11 -0700
Subject: [PATCH 1290/3333] Create default flavors in nova

This makes devstack create default flavors in nova, like cinder, now
that nova no longer hard-codes them into its database.

The flavors created here match the legacy default flavors that nova
kept for so long, and also creates a new devstack-namespaces set of
flavors which are likely more useful for people.

Change-Id: Ic275887e97221d9ce5ce6f12cdcfb5ac94e300b0
---
 lib/nova | 19 +++++++++++++++++++
 stack.sh |  1 +
 2 files changed, 20 insertions(+)

diff --git a/lib/nova b/lib/nova
index ab2bef8ae0..40d7a9b0fd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -932,6 +932,25 @@ function stop_nova {
     stop_nova_compute
 }
 
+# create_instance_types(): Create default flavors
+function create_flavors {
+    if ! openstack flavor list | grep -q ds512M; then
+    # Note that danms hates these flavors and apologizes for sdague
+        openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+        openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
+        openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
+        openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
+        openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+    fi
+
+    if ! openstack flavor list | grep -q m1.tiny; then
+        openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
+        openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
+        openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
+        openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
+        openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+    fi
+}
 
 # Restore xtrace
 $_XTRACE_LIB_NOVA
diff --git a/stack.sh b/stack.sh
index 793b7dc389..6e1fe37f2a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1251,6 +1251,7 @@ fi
 if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
+    create_flavors
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"

From 2bebf2d8d8c249d25c44a4d4cc6a9fecf8fcd454 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 5 Apr 2016 10:34:42 -0400
Subject: [PATCH 1291/3333] Skip rescue tests for cells v1

The rescue tests in Tempest don't work with cells v1 so
let's skip them.

Change-Id: I234f778c9d264ee2e5fe6050ca6b33283be464f7
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d8790f8345..67b631e596 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -398,6 +398,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
         # Cells doesn't support hot-plugging virtual interfaces.
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
+        # Cells v1 doesn't support the rescue/unrescue tests in Tempest
+        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
 
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             # Cells supports resize but does not currently work with devstack

From bd27cc2e675ad5d0e21065ea3029d02ea5a2716a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:12:24 -0400
Subject: [PATCH 1292/3333] switch over nova to using $(project_id) in service
 catalog

This makes one less place we reference tenant_id

Change-Id: I53dfeb4d23a9babf7bb46fd3736b4ac005e45993
---
 lib/nova | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index ab2bef8ae0..1b3d08651b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -421,17 +421,17 @@ function create_nova_accounts {
         get_or_create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
-            "$nova_api_url/v2/\$(tenant_id)s" \
-            "$nova_api_url/v2/\$(tenant_id)s" \
-            "$nova_api_url/v2/\$(tenant_id)s"
+            "$nova_api_url/v2/\$(project_id)s" \
+            "$nova_api_url/v2/\$(project_id)s" \
+            "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
         get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
-            "$nova_api_url/v2.1/\$(tenant_id)s" \
-            "$nova_api_url/v2.1/\$(tenant_id)s" \
-            "$nova_api_url/v2.1/\$(tenant_id)s"
+            "$nova_api_url/v2.1/\$(project_id)s" \
+            "$nova_api_url/v2.1/\$(project_id)s" \
+            "$nova_api_url/v2.1/\$(project_id)s"
     fi
 
     if is_service_enabled n-api; then

From 0486a3659e9a24fbcc34e266ecc56f25d1e5cf99 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:17:01 -0400
Subject: [PATCH 1293/3333] use project_id instead of TENANT_ID in neutron
 internal functions

This converts the create initial network to using project_id instead
of TENANT_ID.

Change-Id: Idf09b629cd13d842fceed5609b42fd1593552953
---
 lib/neutron-legacy | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 34f9840791..3ed690c883 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -544,8 +544,9 @@ function create_neutron_accounts {
 }
 
 function create_neutron_initial_network {
-    TENANT_ID=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for demo"
+    local project_id
+    project_id=$(openstack project list | grep " demo " | get_field 1)
+    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
 
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
@@ -555,17 +556,17 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
+        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
+            SUBNET_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $TENANT_ID"
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then
@@ -574,17 +575,17 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
+        NET_ID=$(neutron net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4)
+            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
         fi
     fi
 
@@ -594,8 +595,8 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(neutron router-create --tenant-id $TENANT_ID $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $TENANT_ID $Q_ROUTER_NAME"
+            ROUTER_ID=$(neutron router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
             ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
@@ -1287,30 +1288,32 @@ function _neutron_setup_interface_driver {
 
 # Create private IPv4 subnet
 function _neutron_create_private_subnet_v4 {
-    local subnet_params="--tenant-id $TENANT_ID "
+    local project_id=$1
+    local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
     subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $TENANT_ID"
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
 
 # Create private IPv6 subnet
 function _neutron_create_private_subnet_v6 {
+    local project_id=$1
     die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
     die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
-    local subnet_params="--tenant-id $TENANT_ID "
+    local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $TENANT_ID"
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 

From 19dfa2af3286a6fbd8ea74dbc41a6affd2123e3f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 10:11:54 -0400
Subject: [PATCH 1294/3333] convert tenant -> project for internal variables

This sets all the internal variables and service users that are set to
use project instead of tenant for clarity.

Change-Id: I4aa833bac2ee2281c5f2881f7ae1fd8e7c759f74
---
 lib/swift | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/lib/swift b/lib/swift
index b2fe755cef..82144f71c6 100644
--- a/lib/swift
+++ b/lib/swift
@@ -495,21 +495,21 @@ EOF
         iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
     done
 
-    # Set new accounts in tempauth to match keystone tenant/user (to make testing easier)
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swifttenanttest1_swiftusertest1 "testing .admin"
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swifttenanttest2_swiftusertest2 "testing2 .admin"
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swifttenanttest1_swiftusertest3 "testing3 .admin"
+    # Set new accounts in tempauth to match keystone project/user (to make testing easier)
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swiftprojecttest1_swiftusertest1 "testing .admin"
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swiftprojecttest2_swiftusertest2 "testing2 .admin"
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swiftprojecttest1_swiftusertest3 "testing3 .admin"
 
     testfile=${SWIFT_CONF_DIR}/test.conf
     cp ${SWIFT_DIR}/test/sample.conf ${testfile}
 
     # Set accounts for functional tests
-    iniset ${testfile} func_test account swifttenanttest1
+    iniset ${testfile} func_test account swiftprojecttest1
     iniset ${testfile} func_test username swiftusertest1
     iniset ${testfile} func_test username3 swiftusertest3
-    iniset ${testfile} func_test account2 swifttenanttest2
+    iniset ${testfile} func_test account2 swiftprojecttest2
     iniset ${testfile} func_test username2 swiftusertest2
-    iniset ${testfile} func_test account4 swifttenanttest4
+    iniset ${testfile} func_test account4 swiftprojecttest4
     iniset ${testfile} func_test username4 swiftusertest4
     iniset ${testfile} func_test password4 testing4
     iniset ${testfile} func_test domain4 swift_test
@@ -603,13 +603,13 @@ function create_swift_disk {
 # since we want to make it compatible with tempauth which use
 # underscores for separators.
 
-# Tenant             User               Roles          Domain
-# ------------------------------------------------------------------
-# service            swift              service        default
-# swifttenanttest1   swiftusertest1     admin          default
-# swifttenanttest1   swiftusertest3     anotherrole    default
-# swifttenanttest2   swiftusertest2     admin          default
-# swifttenanttest4   swiftusertest4     admin          swift_test
+# Project             User               Roles          Domain
+# -------------------------------------------------------------------
+# service             swift              service        default
+# swiftprojecttest1   swiftusertest1     admin          default
+# swiftprojecttest1   swiftusertest3     anotherrole    default
+# swiftprojecttest2   swiftusertest2     admin          default
+# swiftprojecttest4   swiftusertest4     admin          swift_test
 
 function create_swift_accounts {
     # Defines specific passwords used by ``tools/create_userrc.sh``
@@ -635,43 +635,43 @@ function create_swift_accounts {
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s"
 
-    local swift_tenant_test1
-    swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
-    die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
+    local swift_project_test1
+    swift_project_test1=$(get_or_create_project swiftprojecttest1 default)
+    die_if_not_set $LINENO swift_project_test1 "Failure creating swift_project_test1"
     SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password \
                         "default" "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
-    get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
+    get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_project_test1
 
     local swift_user_test3
     swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password \
                                 "default" "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
-    get_or_add_user_project_role $another_role $swift_user_test3 $swift_tenant_test1
+    get_or_add_user_project_role $another_role $swift_user_test3 $swift_project_test1
 
-    local swift_tenant_test2
-    swift_tenant_test2=$(get_or_create_project swifttenanttest2 default)
-    die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
+    local swift_project_test2
+    swift_project_test2=$(get_or_create_project swiftprojecttest2 default)
+    die_if_not_set $LINENO swift_project_test2 "Failure creating swift_project_test2"
 
     local swift_user_test2
     swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password \
                                 "default" "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
-    get_or_add_user_project_role admin $swift_user_test2 $swift_tenant_test2
+    get_or_add_user_project_role admin $swift_user_test2 $swift_project_test2
 
     local swift_domain
     swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
     die_if_not_set $LINENO swift_domain "Failure creating swift_test domain"
 
-    local swift_tenant_test4
-    swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
-    die_if_not_set $LINENO swift_tenant_test4 "Failure creating swift_tenant_test4"
+    local swift_project_test4
+    swift_project_test4=$(get_or_create_project swiftprojecttest4 $swift_domain)
+    die_if_not_set $LINENO swift_project_test4 "Failure creating swift_project_test4"
 
     local swift_user_test4
     swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
                                 $swift_domain "test4@example.com")
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
-    get_or_add_user_project_role admin $swift_user_test4 $swift_tenant_test4
+    get_or_add_user_project_role admin $swift_user_test4 $swift_project_test4
 }
 
 # init_swift() - Initialize rings

From 0b1465b6f699a974e3900fff2a810aec6a6bf43c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 10:15:47 -0400
Subject: [PATCH 1295/3333] change tenant to project in keystone bootstrapping

Change-Id: I6f392d3c16726f6dd734184dcf3014fb4f388207
---
 lib/keystone | 56 ++++++++++++++++++++++++++--------------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index d83092405b..4361fe0b7f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -106,9 +106,9 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
-# Set the tenant for service accounts in Keystone
-SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
-SERVICE_PROJECT_NAME=${SERVICE_TENANT_NAME:-service}
+# Set the project for service accounts in Keystone
+SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
+SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols
 if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
@@ -335,7 +335,7 @@ function configure_keystone {
 
 # create_keystone_accounts() - Sets up common required keystone accounts
 
-# Tenant               User       Roles
+# Project              User       Roles
 # ------------------------------------------------------------------
 # admin                admin      admin
 # service              --         --
@@ -348,7 +348,7 @@ function configure_keystone {
 # alt_demo             alt_demo   Member, anotherrole
 # invisible_to_admin   demo       Member
 
-# Group                Users            Roles                 Tenant
+# Group                Users            Roles                 Project
 # ------------------------------------------------------------------
 # admins               admin            admin                 admin
 # nonadmins            demo, alt_demo   Member, anotherrole   demo, alt_demo
@@ -360,8 +360,8 @@ function create_keystone_accounts {
     # The keystone bootstrapping process (performed via keystone-manage bootstrap)
     # creates an admin user, admin role and admin project. As a sanity check
     # we exercise the CLI to retrieve the IDs for these values.
-    local admin_tenant
-    admin_tenant=$(openstack project show "admin" -f value -c id)
+    local admin_project
+    admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
     local admin_role
@@ -376,8 +376,8 @@ function create_keystone_accounts {
     get_or_create_role service
 
     # The ResellerAdmin role is used by Nova and Ceilometer so we need to keep it.
-    # The admin role in swift allows a user to act as an admin for their tenant,
-    # but ResellerAdmin is needed for a user to act as any tenant. The name of this
+    # The admin role in swift allows a user to act as an admin for their project,
+    # but ResellerAdmin is needed for a user to act as any project. The name of this
     # role is also configurable in swift-proxy.conf
     get_or_create_role ResellerAdmin
 
@@ -390,32 +390,32 @@ function create_keystone_accounts {
     local another_role
     another_role=$(get_or_create_role "anotherrole")
 
-    # invisible tenant - admin can't see this one
-    local invis_tenant
-    invis_tenant=$(get_or_create_project "invisible_to_admin" default)
+    # invisible project - admin can't see this one
+    local invis_project
+    invis_project=$(get_or_create_project "invisible_to_admin" default)
 
     # demo
-    local demo_tenant
-    demo_tenant=$(get_or_create_project "demo" default)
+    local demo_project
+    demo_project=$(get_or_create_project "demo" default)
     local demo_user
     demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "default" "demo@example.com")
 
-    get_or_add_user_project_role $member_role $demo_user $demo_tenant
-    get_or_add_user_project_role $admin_role $admin_user $demo_tenant
-    get_or_add_user_project_role $another_role $demo_user $demo_tenant
-    get_or_add_user_project_role $member_role $demo_user $invis_tenant
+    get_or_add_user_project_role $member_role $demo_user $demo_project
+    get_or_add_user_project_role $admin_role $admin_user $demo_project
+    get_or_add_user_project_role $another_role $demo_user $demo_project
+    get_or_add_user_project_role $member_role $demo_user $invis_project
 
     # alt_demo
-    local alt_demo_tenant
-    alt_demo_tenant=$(get_or_create_project "alt_demo" default)
+    local alt_demo_project
+    alt_demo_project=$(get_or_create_project "alt_demo" default)
     local alt_demo_user
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
-    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_tenant
-    get_or_add_user_project_role $admin_role $admin_user $alt_demo_tenant
-    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_tenant
+    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
+    get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
+    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
     # groups
     local admin_group
@@ -425,11 +425,11 @@ function create_keystone_accounts {
     non_admin_group=$(get_or_create_group "nonadmins" \
         "default" "non-admin group")
 
-    get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
-    get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
-    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_tenant
-    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_tenant
-    get_or_add_group_project_role $admin_role $admin_group $admin_tenant
+    get_or_add_group_project_role $member_role $non_admin_group $demo_project
+    get_or_add_group_project_role $another_role $non_admin_group $demo_project
+    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
+    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
+    get_or_add_group_project_role $admin_role $admin_group $admin_project
 }
 
 # Create a user that is capable of verifying keystone tokens for use with auth_token middleware.

From 17e450131cc5f6508bea99172b6200bd6fce5584 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 6 Apr 2016 09:27:56 +1000
Subject: [PATCH 1296/3333] Pad around table in plugin list

Make sure the table is separated out from header and footer content so
it actually gets picked up as a table.

Change-Id: I60a24b2476a55cfbf5c864a1c27ce5b98e699886
---
 tools/generate-devstack-plugins-list.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index c3c8f24dbd..ea30cd5568 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -68,6 +68,7 @@ name_col_len=$(( name_col_len + 2 ))
 # foobar                 `git://... <http://...>`__
 # ...
 
+printf "\n\n"
 title_underline ${name_col_len}
 printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
 title_underline ${name_col_len}
@@ -77,6 +78,7 @@ for plugin in ${sorted_plugins}; do
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
+printf "\n\n"
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then
     cat data/devstack-plugins-registry.footer

From 7f87efdd21e92721fe2bf8bb493deb4822e32f1b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 9 Oct 2015 10:07:11 -0400
Subject: [PATCH 1297/3333] Remove project_id from nova service urls

Nova API itself supports both URL modes:
  with project-id and without project-id
However, we are changing service catalogs for removing project-id
based on the discussion.
We have agreement on https://review.openstack.org/#/c/181393 like the
following:

 - Standard required naming for endpoints (versioned vs. unversioned,
   contains project ID vs. no project ID).
    * We want unversioned endpoints so that the user can get
      information about multiple available versions in a given cloud.
    * We do not want project ID, account ID, or tenant ID as part of
      the resource URI for an OpenStack API endpoint.

So this patch removes project-id from Nova service catalog for this
direction.

Change-Id: Ifd74152727b5c0c75924419a7a52e024a69ce72c
---
 lib/nova | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 1b3d08651b..9449cfa98d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -429,9 +429,9 @@ function create_nova_accounts {
         get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
-            "$nova_api_url/v2.1/\$(project_id)s" \
-            "$nova_api_url/v2.1/\$(project_id)s" \
-            "$nova_api_url/v2.1/\$(project_id)s"
+            "$nova_api_url/v2.1" \
+            "$nova_api_url/v2.1" \
+            "$nova_api_url/v2.1"
     fi
 
     if is_service_enabled n-api; then

From 616957d5981310e465e9fb3fd0c040751d8b0b63 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 6 Apr 2016 16:50:45 +1000
Subject: [PATCH 1298/3333] Work around broken rabbitmq 3.6.1 packages on
 Fedora 23

Downgrade this package until we have a fix for the bug in the
comments.

Change-Id: I980d625fec7b11aff74814ee2d24fe9650e9f0a6
---
 tools/fixup_stuff.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 193a1f7aba..15cb5a1180 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -159,6 +159,14 @@ if is_fedora; then
             pip_install --upgrade --force-reinstall requests
         fi
     fi
+
+    if [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "23" ]]; then
+        # work-around broken rabbitmq-server 3.6.1 packages
+        #  https://bugzilla.redhat.com/show_bug.cgi?id=1323610
+        # Will be removed when this bug is fixed.
+        sudo dnf -y install \
+             https://kojipkgs.fedoraproject.org/packages/rabbitmq-server/3.5.7/4.fc23/noarch/rabbitmq-server-3.5.7-4.fc23.noarch.rpm
+    fi
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From db48db1cf0b9c36890439a161424842d07d94f60 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 6 Apr 2016 08:09:31 -0400
Subject: [PATCH 1299/3333] update docs to reference project not tenant

Change-Id: Iad66e14fa33609ea6d2a115469e054762051b964
---
 doc/source/configuration.rst  |  4 ++--
 doc/source/guides/neutron.rst | 21 ++++++++++-----------
 doc/source/openrc.rst         |  2 +-
 3 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0493f8fa25..f3e4896296 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -423,8 +423,8 @@ IP Version
 ----------
 
 ``IP_VERSION`` can be used to configure DevStack to create either an
-IPv4, IPv6, or dual-stack tenant data-network by with either
-``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
+IPv4, IPv6, or dual-stack self service project data-network by with
+either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
 respectively.  This functionality requires that the Neutron networking
 service is enabled by setting the following options:
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 6ac3993e17..a834314bcc 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -15,8 +15,8 @@ In some instances, like on a developer laptop, there is only one
 network interface that is available. In this scenario, the physical
 interface is added to the Open vSwitch bridge, and the IP address of
 the laptop is migrated onto the bridge interface. That way, the
-physical interface can be used to transmit tenant network traffic,
-the OpenStack API traffic, and management traffic.
+physical interface can be used to transmit self service project
+network traffic, the OpenStack API traffic, and management traffic.
 
 
 .. warning::
@@ -222,12 +222,12 @@ it over the `br-ex` bridge, where `eth0` is attached.
 which is used as the "integration bridge" where ports are created, and
 plugged into the virtual switching fabric. `br-ex` is an OVS bridge
 that is used to connect physical ports (like `eth0`), so that floating
-IP traffic for tenants can be received from the physical network
-infrastructure (and the internet), and routed to tenant network ports.
-`br-tun` is a tunnel bridge that is used to connect OpenStack nodes
-(like `devstack-2`) together. This bridge is used so that tenant
-network traffic, using the VXLAN tunneling protocol, flows between
-each compute node where tenant instances run.
+IP traffic for project networks can be received from the physical
+network infrastructure (and the internet), and routed to self service
+project network ports.  `br-tun` is a tunnel bridge that is used to
+connect OpenStack nodes (like `devstack-2`) together. This bridge is
+used so that project network traffic, using the VXLAN tunneling
+protocol, flows between each compute node where project instances run.
 
 
 
@@ -381,8 +381,8 @@ controller node.
 
         ## Neutron options
         Q_USE_SECGROUP=True
-        ENABLE_TENANT_VLANS=True
-        TENANT_VLAN_RANGE=3001:4000
+        ENABLE_PROJECT_VLANS=True
+        PROJECT_VLAN_RANGE=3001:4000
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
 
@@ -553,4 +553,3 @@ setup, with small modifications for the interface mappings.
     LB_PHYSICAL_INTERFACE=eth0
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
-
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index 4e7f0754a3..d28b5680c6 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -51,7 +51,7 @@ HOST\_IP, SERVICE\_HOST
 OS\_AUTH\_URL
     Authenticating against an OpenStack cloud using Keystone returns a
     *Token* and *Service Catalog*. The catalog contains the endpoints
-    for all services the user/tenant has access to - including Nova,
+    for all services the user/project has access to - including Nova,
     Glance, Keystone and Swift.
 
     ::

From d3d21394db4a958bed55d856f780c127324a71b8 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 6 Apr 2016 14:06:00 -0700
Subject: [PATCH 1300/3333] Fix create_flavors on subnodes

This makes us depend on n-api being enabled, which should avoid running
this on subnodes, where it fails because of no credentials.

Change-Id: I209bd59cd57be27c3375f5a2074361307abcafe9
Closes-Bug: #1567065
---
 lib/nova | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8aca1a6cec..77bc3c8742 100644
--- a/lib/nova
+++ b/lib/nova
@@ -934,21 +934,23 @@ function stop_nova {
 
 # create_instance_types(): Create default flavors
 function create_flavors {
-    if ! openstack flavor list | grep -q ds512M; then
-    # Note that danms hates these flavors and apologizes for sdague
-        openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
-        openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
-        openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
-        openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
-        openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
-    fi
-
-    if ! openstack flavor list | grep -q m1.tiny; then
-        openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
-        openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
-        openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
-        openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
-        openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+    if is_service_enabled n-api; then
+        if ! openstack flavor list | grep -q ds512M; then
+            # Note that danms hates these flavors and apologizes for sdague
+            openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+            openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
+            openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
+            openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
+            openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+        fi
+
+        if ! openstack flavor list | grep -q m1.tiny; then
+            openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
+            openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
+            openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
+            openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
+            openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+        fi
     fi
 }
 

From da1ca6e07c0d54d0ec5b94ebd78da81c6a46e780 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 6 Apr 2016 21:57:28 +0000
Subject: [PATCH 1301/3333] Revert "Use unversioned keystone endpoints"

This reverts commit 4921d4dbb937b8a9ca26379a33252f0bebcfb53f.

Change-Id: Ic8888fca5d25ca6caa3f29f712db319f1d3869ba
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 802b38082e..9f23e73381 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -634,9 +634,9 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
 }
 
 # Restore xtrace

From 8dda061a1fc3b06675cc873681d3bdaaad98f734 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Thu, 7 Apr 2016 00:12:51 +0000
Subject: [PATCH 1302/3333] Revert "Revert "Use unversioned keystone
 endpoints""

This reverts commit da1ca6e07c0d54d0ec5b94ebd78da81c6a46e780.

Depends-on: Id2c7e09611c1f8b06e6d272589b4ea3435b8de86
Change-Id: I1b2a65179b5863d8bcbc5dd02b615f4e6e564213
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 9f23e73381..802b38082e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -634,9 +634,9 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
 }
 
 # Restore xtrace

From e9820732f16386facc526d14a5150ba68da68161 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 8 Apr 2016 09:10:55 +1000
Subject: [PATCH 1303/3333] Fix table in generated plugins list

Fix the table with a bottom border.  Regenerate the plugin list using
the script to make sure it works this time.

Change-Id: Iab3eb3879fd6017c55259e470477e4a9e34514e2
---
 doc/source/plugin-registry.rst          | 281 +++++++++---------------
 tools/generate-devstack-plugins-list.sh |   3 +
 2 files changed, 105 insertions(+), 179 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b4671234ed..999350fe6a 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -19,182 +19,105 @@ The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
 
-+----------------------------+-------------------------------------------------------------------------+
-|Plugin Name                 |URL                                                                      |
-+----------------------------+-------------------------------------------------------------------------+
-|aodh                        |git://git.openstack.org/openstack/aodh                                   |
-+----------------------------+-------------------------------------------------------------------------+
-|app-catalog-ui              |git://git.openstack.org/openstack/app-catalog-ui                         |
-+----------------------------+-------------------------------------------------------------------------+
-|astara                      |git://git.openstack.org/openstack/astara                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|barbican                    |git://git.openstack.org/openstack/barbican                               |
-+----------------------------+-------------------------------------------------------------------------+
-|blazar                      |git://git.openstack.org/openstack/blazar                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|broadview-collector         |git://git.openstack.org/openstack/broadview-collector                    |
-+----------------------------+-------------------------------------------------------------------------+
-|ceilometer                  |git://git.openstack.org/openstack/ceilometer                             |
-+----------------------------+-------------------------------------------------------------------------+
-|ceilometer-powervm          |git://git.openstack.org/openstack/ceilometer-powervm                     |
-+----------------------------+-------------------------------------------------------------------------+
-|cerberus                    |git://git.openstack.org/openstack/cerberus                               |
-+----------------------------+-------------------------------------------------------------------------+
-|cloudkitty                  |git://git.openstack.org/openstack/cloudkitty                             |
-+----------------------------+-------------------------------------------------------------------------+
-|collectd-ceilometer-plugin  |git://git.openstack.org/openstack/collectd-ceilometer-plugin             |
-+----------------------------+-------------------------------------------------------------------------+
-|congress                    |git://git.openstack.org/openstack/congress                               |
-+----------------------------+-------------------------------------------------------------------------+
-|cue                         |git://git.openstack.org/openstack/cue                                    |
-+----------------------------+-------------------------------------------------------------------------+
-|designate                   |git://git.openstack.org/openstack/designate                              |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-amqp1       |git://git.openstack.org/openstack/devstack-plugin-amqp1                  |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-bdd         |git://git.openstack.org/openstack/devstack-plugin-bdd                    |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-ceph        |git://git.openstack.org/openstack/devstack-plugin-ceph                   |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-glusterfs   |git://git.openstack.org/openstack/devstack-plugin-glusterfs              |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-hdfs        |git://git.openstack.org/openstack/devstack-plugin-hdfs                   |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-kafka       |git://git.openstack.org/openstack/devstack-plugin-kafka                  |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-pika        |git://git.openstack.org/openstack/devstack-plugin-pika                   |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-sheepdog    |git://git.openstack.org/openstack/devstack-plugin-sheepdog               |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-zmq         |git://git.openstack.org/openstack/devstack-plugin-zmq                    |
-+----------------------------+-------------------------------------------------------------------------+
-|dragonflow                  |git://git.openstack.org/openstack/dragonflow                             |
-+----------------------------+-------------------------------------------------------------------------+
-|drbd-devstack               |git://git.openstack.org/openstack/drbd-devstack                          |
-+----------------------------+-------------------------------------------------------------------------+
-|ec2-api                     |git://git.openstack.org/openstack/ec2-api                                |
-+----------------------------+-------------------------------------------------------------------------+
-|freezer                     |git://git.openstack.org/openstack/freezer                                |
-+----------------------------+-------------------------------------------------------------------------+
-|freezer-api                 |git://git.openstack.org/openstack/freezer-api                            |
-+----------------------------+-------------------------------------------------------------------------+
-|freezer-web-ui              |git://git.openstack.org/openstack/freezer-web-ui                         |
-+----------------------------+-------------------------------------------------------------------------+
-|gce-api                     |git://git.openstack.org/openstack/gce-api                                |
-+----------------------------+-------------------------------------------------------------------------+
-|gnocchi                     |git://git.openstack.org/openstack/gnocchi                                |
-+----------------------------+-------------------------------------------------------------------------+
-|ironic                      |git://git.openstack.org/openstack/ironic                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|ironic-inspector            |git://git.openstack.org/openstack/ironic-inspector                       |
-+----------------------------+-------------------------------------------------------------------------+
-|kingbird                    |git://git.openstack.org/openstack/kingbird                               |
-+----------------------------+-------------------------------------------------------------------------+
-|kuryr                       |git://git.openstack.org/openstack/kuryr                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|magnum                      |git://git.openstack.org/openstack/magnum                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|manila                      |git://git.openstack.org/openstack/manila                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|mistral                     |git://git.openstack.org/openstack/mistral                                |
-+----------------------------+-------------------------------------------------------------------------+
-|monasca-api                 |git://git.openstack.org/openstack/monasca-api                            |
-+----------------------------+-------------------------------------------------------------------------+
-|murano                      |git://git.openstack.org/openstack/murano                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-6wind            |git://git.openstack.org/openstack/networking-6wind                       |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-bagpipe          |git://git.openstack.org/openstack/networking-bagpipe                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-bgpvpn           |git://git.openstack.org/openstack/networking-bgpvpn                      |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-brocade          |git://git.openstack.org/openstack/networking-brocade                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-calico           |git://git.openstack.org/openstack/networking-calico                      |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-cisco            |git://git.openstack.org/openstack/networking-cisco                       |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-fortinet         |git://git.openstack.org/openstack/networking-fortinet                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-generic-switch   |git://git.openstack.org/openstack/networking-generic-switch              |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-infoblox         |git://git.openstack.org/openstack/networking-infoblox                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-l2gw             |git://git.openstack.org/openstack/networking-l2gw                        |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-midonet          |git://git.openstack.org/openstack/networking-midonet                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-mlnx             |git://git.openstack.org/openstack/networking-mlnx                        |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-nec              |git://git.openstack.org/openstack/networking-nec                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-odl              |git://git.openstack.org/openstack/networking-odl                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-ofagent          |git://git.openstack.org/openstack/networking-ofagent                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-ovn              |git://git.openstack.org/openstack/networking-ovn                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-ovs-dpdk         |git://git.openstack.org/openstack/networking-ovs-dpdk                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-plumgrid         |git://git.openstack.org/openstack/networking-plumgrid                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-powervm          |git://git.openstack.org/openstack/networking-powervm                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-sfc              |git://git.openstack.org/openstack/networking-sfc                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-vsphere          |git://git.openstack.org/openstack/networking-vsphere                     |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron                     |git://git.openstack.org/openstack/neutron                                |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron-lbaas               |git://git.openstack.org/openstack/neutron-lbaas                          |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron-lbaas-dashboard     |git://git.openstack.org/openstack/neutron-lbaas-dashboard                |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron-vpnaas              |git://git.openstack.org/openstack/neutron-vpnaas                         |
-+----------------------------+-------------------------------------------------------------------------+
-|nova-docker                 |git://git.openstack.org/openstack/nova-docker                            |
-+----------------------------+-------------------------------------------------------------------------+
-|nova-powervm                |git://git.openstack.org/openstack/nova-powervm                           |
-+----------------------------+-------------------------------------------------------------------------+
-|octavia                     |git://git.openstack.org/openstack/octavia                                |
-+----------------------------+-------------------------------------------------------------------------+
-|osprofiler                  |git://git.openstack.org/openstack/osprofiler                             |
-+----------------------------+-------------------------------------------------------------------------+
-|rally                       |git://git.openstack.org/openstack/rally                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|sahara                      |git://git.openstack.org/openstack/sahara                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|sahara-dashboard            |git://git.openstack.org/openstack/sahara-dashboard                       |
-+----------------------------+-------------------------------------------------------------------------+
-|scalpels                    |git://git.openstack.org/openstack/scalpels                               |
-+----------------------------+-------------------------------------------------------------------------+
-|searchlight                 |git://git.openstack.org/openstack/searchlight                            |
-+----------------------------+-------------------------------------------------------------------------+
-|senlin                      |git://git.openstack.org/openstack/senlin                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|smaug                       |git://git.openstack.org/openstack/smaug                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|solum                       |git://git.openstack.org/openstack/solum                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|tacker                      |git://git.openstack.org/openstack/tacker                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|tap-as-a-service            |git://git.openstack.org/openstack/tap-as-a-service                       |
-+----------------------------+-------------------------------------------------------------------------+
-|tricircle                   |git://git.openstack.org/openstack/tricircle                              |
-+----------------------------+-------------------------------------------------------------------------+
-|trove                       |git://git.openstack.org/openstack/trove                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|trove-dashboard             |git://git.openstack.org/openstack/trove-dashboard                        |
-+----------------------------+-------------------------------------------------------------------------+
-|vitrage                     |git://git.openstack.org/openstack/vitrage                                |
-+----------------------------+-------------------------------------------------------------------------+
-|vitrage-dashboard           |git://git.openstack.org/openstack/vitrage-dashboard                      |
-+----------------------------+-------------------------------------------------------------------------+
-|vmware-nsx                  |git://git.openstack.org/openstack/vmware-nsx                             |
-+----------------------------+-------------------------------------------------------------------------+
-|watcher                     |git://git.openstack.org/openstack/watcher                                |
-+----------------------------+-------------------------------------------------------------------------+
-|watcher-dashboard           |git://git.openstack.org/openstack/watcher-dashboard                      |
-+----------------------------+-------------------------------------------------------------------------+
-|zaqar                       |git://git.openstack.org/openstack/zaqar                                  |
-+----------------------------+-------------------------------------------------------------------------+
+
+====================================== ===
+Plugin Name                            URL
+====================================== ===
+aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
+app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
+astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
+barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
+blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
+broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
+ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
+ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
+cerberus                               `git://git.openstack.org/openstack/cerberus <https://git.openstack.org/cgit/openstack/cerberus>`__
+cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
+collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
+congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
+cue                                    `git://git.openstack.org/openstack/cue <https://git.openstack.org/cgit/openstack/cue>`__
+designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
+devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
+devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
+devstack-plugin-bdd                    `git://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
+devstack-plugin-ceph                   `git://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
+devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
+devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
+devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
+devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
+devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
+devstack-plugin-zmq                    `git://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
+dragonflow                             `git://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
+drbd-devstack                          `git://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
+ec2-api                                `git://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
+freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
+freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
+freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
+gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
+gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
+ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
+ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
+kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
+magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
+magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
+manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
+networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
+networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
+networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
+networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
+networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
+networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
+networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
+networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
+networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
+networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
+networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
+networking-ofagent                     `git://git.openstack.org/openstack/networking-ofagent <https://git.openstack.org/cgit/openstack/networking-ofagent>`__
+networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
+networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
+networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
+networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
+networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
+neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
+neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
+neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
+nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
+octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
+rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
+sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
+sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
+scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
+searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
+searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
+senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
+smaug                                  `git://git.openstack.org/openstack/smaug <https://git.openstack.org/cgit/openstack/smaug>`__
+smaug-dashboard                        `git://git.openstack.org/openstack/smaug-dashboard <https://git.openstack.org/cgit/openstack/smaug-dashboard>`__
+solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
+tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
+tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
+tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
+trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
+trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
+vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
+vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
+vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
+watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
+watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
+zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
+zaqar-ui                               `git://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
+====================================== ===
+
+
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index ea30cd5568..95f13318b8 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -78,6 +78,9 @@ for plugin in ${sorted_plugins}; do
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
+
+title_underline ${name_col_len}
+
 printf "\n\n"
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then

From cdf9c0f73b7a8d332852d43dacad8cd0c8993a1e Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 7 Apr 2016 14:41:58 -0400
Subject: [PATCH 1304/3333] Replace vivid support with xenial

Ubuntu vivid support is EOL lets make room for xenial.

Change-Id: I21c4966c80e0b5fc2b1a7448020dd1c75e0070ad
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 6e1fe37f2a..739d939ff1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -185,7 +185,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 3888098245a8d1c9c48f9af717d3991e7acf99d9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sat, 9 Apr 2016 21:42:24 -0400
Subject: [PATCH 1305/3333] Move nova's api_paste_config into wsgi group

Change 0b9e378cca2be4e034ad401d71fbe4470907f93a moved the
api_paste_config from the DEFAULT group to the wsgi group
and deprecated it's usage in DEFAULT.

Change-Id: I283db638e76b986d3e728c6caf34a0b3f37fc9b6
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index ad72fc3ca1..acf55cc075 100644
--- a/lib/nova
+++ b/lib/nova
@@ -466,7 +466,7 @@ function create_nova_conf {
     if [ "$NOVA_ALLOW_MOVE_TO_SAME_HOST" == "True" ]; then
         iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
     fi
-    iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
+    iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"

From e7361775c112e32ea517eddc344641897d273d25 Mon Sep 17 00:00:00 2001
From: Eyal <eyal.bar-ilan@nokia.com>
Date: Tue, 5 Apr 2016 16:18:56 +0300
Subject: [PATCH 1306/3333] print statment has become a function in py3

Change-Id: Ia616e1fdd4c3fc8e1a36b026e0c3e2a568dc6517
---
 tools/generate-devstack-plugins-list.py |  4 ++--
 tools/worlddump.py                      | 31 +++++++++++++------------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index aeec4dd27d..089a6ef93e 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -53,7 +53,7 @@ def has_devstack_plugin(proj):
     if len(r.text) > 0:
         return True
     else:
-        False
+        return False
 
 logging.debug("Getting project list from %s" % url)
 r = requests.get(url)
@@ -64,4 +64,4 @@ def has_devstack_plugin(proj):
 
 for project in found_plugins:
     # strip of openstack/
-    print project[10:]
+    print(project[10:])
diff --git a/tools/worlddump.py b/tools/worlddump.py
index 345c2a3d94..3d7912a2ec 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -14,6 +14,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+
 """Dump the state of the world for post mortem."""
 
 import argparse
@@ -48,32 +49,32 @@ def filename(dirname, name=""):
 
 
 def warn(msg):
-    print "WARN: %s" % msg
+    print("WARN: %s" % msg)
 
 
 def _dump_cmd(cmd):
-    print cmd
-    print "-" * len(cmd)
-    print
+    print(cmd)
+    print("-" * len(cmd))
+    print()
     try:
         subprocess.check_call(cmd, shell=True)
-        print
+        print()
     except subprocess.CalledProcessError as e:
-        print "*** Failed to run '%(cmd)s': %(err)s" % {'cmd': cmd, 'err': e}
+        print("*** Failed to run '%(cmd)s': %(err)s" % {'cmd': cmd, 'err': e})
 
 
 def _find_cmd(cmd):
     if not spawn.find_executable(cmd):
-        print "*** %s not found: skipping" % cmd
+        print("*** %s not found: skipping" % cmd)
         return False
     return True
 
 
 def _header(name):
-    print
-    print name
-    print "=" * len(name)
-    print
+    print()
+    print(name)
+    print("=" * len(name))
+    print()
 
 
 # This method gets a max openflow version supported by openvswitch.
@@ -109,7 +110,7 @@ def disk_space():
             # if it doesn't look like an int, that's fine
             pass
 
-    print dfraw
+    print(dfraw)
 
 
 def ebtables_dump():
@@ -193,17 +194,17 @@ def guru_meditation_report():
     try:
         subprocess.check_call(["pgrep","nova-compute"])
     except subprocess.CalledProcessError:
-        print "Skipping as nova-compute does not appear to be running"
+        print("Skipping as nova-compute does not appear to be running")
         return
 
     _dump_cmd("kill -s USR2 `pgrep nova-compute`")
-    print "guru meditation report in nova-compute log"
+    print("guru meditation report in nova-compute log")
 
 
 def main():
     opts = get_options()
     fname = filename(opts.dir, opts.name)
-    print "World dumping... see %s for details" % fname
+    print("World dumping... see %s for details" % fname)
     sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)
     with open(fname, 'w') as f:
         os.dup2(f.fileno(), sys.stdout.fileno())

From e8177a5412da6b190825dc1944fe3f93e208b890 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 5 Apr 2016 09:21:24 +1000
Subject: [PATCH 1307/3333] Be a bit more explicit about the plugin generation

Make the warning in the auto-generated file stand-out a bit more, so
people don't waste time trying to add entries that appear
automatically.

Change-Id: Icf4290e1fad21ce72af54c178bafcce0b287cdf6
---
 data/devstack-plugins-registry.header | 31 +++++++++++++++------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index f105fe9d35..6119ab5284 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -1,20 +1,23 @@
 ..
-  Note to patch submitters: this file is covered by a periodic proposal
-  job.  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header instead of this one.
+
+  Note to patch submitters:
+
+  # ============================= #
+  # THIS FILE IS AUTOGENERATED !  #
+  # ============================= #
+
+  ** Plugins are found automatically and added to this list **
+
+  This file is created by a periodic proposal job.  You should not
+  edit this file.
+
+  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
 ==========================
 
-Since we've created the external plugin mechanism, it's gotten used by
-a lot of projects. The following is a list of plugins that currently
-exist. Any project that wishes to list their plugin here is welcomed
-to.
-
-Detected Plugins
-================
-
-The following are plugins that a script has found in the openstack/
-namespace, which includes but is not limited to official OpenStack
-projects.
+The following list is an automatically-generated collection of
+available DevStack plugins.  This includes, but is not limited to,
+official OpenStack projects.

From 2f5596e59051ab23dfc0dd85b083e9328600fbb1 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 5 Apr 2016 22:22:48 -0700
Subject: [PATCH 1308/3333] Use configured values instead of default value

Variables PUBLIC_INTERFACE_DEFAULT and GUEST_INTERFACE_DEFAULT
are only use to provide default value, deployment script should
not use such values directly

Closes-Bug: #1566768

Change-Id: Ib543b416df861086fa2edbe7df769b224d0b0add
---
 lib/neutron_plugins/openvswitch_agent | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 339d5fd96a..aba2587ea4 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -96,17 +96,17 @@ function neutron_plugin_configure_plugin_agent {
 
         # Set up domU's L2 agent:
 
-        # Create a bridge "br-$GUEST_INTERFACE_DEFAULT"
-        _neutron_ovs_base_add_bridge "br-$GUEST_INTERFACE_DEFAULT"
-        # Add $GUEST_INTERFACE_DEFAULT to that bridge
-        sudo ovs-vsctl -- --may-exist add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
+        # Create a bridge "br-$VLAN_INTERFACE"
+        _neutron_ovs_base_add_bridge "br-$VLAN_INTERFACE"
+        # Add $VLAN_INTERFACE to that bridge
+        sudo ovs-vsctl -- --may-exist add-port "br-$VLAN_INTERFACE" $VLAN_INTERFACE
 
         # Create external bridge and add port
         _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
-        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE_DEFAULT
+        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$GUEST_INTERFACE_DEFAULT,physnet-ex:$PUBLIC_BRIDGE"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
         # Set integration bridge to domU's
         iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $OVS_BRIDGE
         # Set root wrap

From b6259586bf241b4589965642ac76d250a0774e6f Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Mon, 11 Apr 2016 10:17:55 +0200
Subject: [PATCH 1309/3333] Replace deprecated config option
 [DEFAULT].rabbit_vritual_host

The test job "gate-tempest-dsvm-cells" uses the Nova cells concept.
This triggered a deprecation warning:

    WARNING oslo_config.cfg [...]
    Option "rabbit_virtual_host" from group "DEFAULT" is deprecated.
    Use option "rabbit_virtual_host" from group "oslo_messaging_rabbit".

This change removes that warning.

Change-Id: Ieaf437ecbf58edb8994f6afcb0ac2afcd5585a1e
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index ad72fc3ca1..8823e1ddb4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -648,7 +648,7 @@ function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
-        iniset $NOVA_CELLS_CONF DEFAULT rabbit_virtual_host child_cell
+        iniset $NOVA_CELLS_CONF oslo_messaging_rabbit rabbit_virtual_host child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
         iniset $NOVA_CELLS_CONF cells cell_type compute

From e8f3f7aa0d650da49325ab5ccd072232a6ab088c Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 11 Apr 2016 12:52:39 -0400
Subject: [PATCH 1310/3333] Fix usage of tempest utils during config

Most of the tempest utilities need at least a partially setup
configuration file to work properly. This is because most of them
make api requests in order to perform the expected operations.
This causes a bit of a chicken and egg problem when we rely on
these utilities for configuration purposes since we don't know if
we have enough of a configuration file to run things. This previously
wasn't an issue because all we needed to run was verify-tempest config
and it wasn't in a critical path just for api extension discovery and
it wasn't relied on. But, with the addition of tempest preprovisioned
credentials we rely on a tempest util to create the credentials we
use for running things. We need to ensure the util has as complete of
a config file when it's run to ensure that everything is in the
correct state.

This commit moves the running of all tempest utils and the associated
iniset calls to the end of the configure_tempest function to ensure
that the utils have as complete a config file as possible.
Additionally, it makes all tempest util calls are venv isolated. (which
is mostly future proofing for when things are branched on stable)

Change-Id: I5844aed4e134fbc7210aa0eca83500e260915b7b
---
 lib/tempest | 137 +++++++++++++++++++++++++++-------------------------
 1 file changed, 70 insertions(+), 67 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 67b631e596..fd98c948f2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -317,44 +317,6 @@ function configure_tempest {
     fi
 
     # Compute Features
-    # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
-    # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
-    local tmp_cfg_file
-    tmp_cfg_file=$(mktemp)
-    cd $TEMPEST_DIR
-    if [[ "$OFFLINE" != "True" ]]; then
-        tox -revenv --notest
-    fi
-
-    # Auth
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
-    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
-        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
-        else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
-        fi
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
-        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
-    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
-
-    else
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
-    fi
-
-    # NOTE(mtreinish): Respect constraints on tempest verify-config venv
-    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-    tox -evenv -- tempest verify-config -uro $tmp_cfg_file
-
-    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
-    fi
-
     # Set the microversion range for compute tests.
     # This is used to run the Nova microversions tests.
     # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.
@@ -383,7 +345,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
-    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
     # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
     iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
     # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
@@ -420,15 +381,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6 "$IPV6_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
 
-    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
-
     # Orchestration Tests
     if is_service_enabled heat; then
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
@@ -461,16 +413,6 @@ function configure_tempest {
     # Telemetry
     iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
 
-    # Object Store
-    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
-        # Remove disabled extensions
-        object_storage_api_extensions=$(remove_disabled_extensions $object_storage_api_extensions $DISABLE_STORAGE_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
-
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
@@ -484,15 +426,6 @@ function configure_tempest {
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
 
-    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        volume_api_extensions=$(remove_disabled_extensions $volume_api_extensions $DISABLE_VOLUME_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions $volume_api_extensions
-
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi
@@ -573,6 +506,76 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG service_available cinder "False"
     fi
 
+    # Run tempest configuration utilities. This must be done last during configuration to
+    # ensure as complete a config as possible already exists
+
+    # NOTE(mtreinish): Respect constraints on tempest verify-config venv
+    local tmp_cfg_file
+    tmp_cfg_file=$(mktemp)
+    cd $TEMPEST_DIR
+    if [[ "$OFFLINE" != "True" ]]; then
+        tox -revenv --notest
+    fi
+    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+
+    # Auth:
+    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
+        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
+            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+        else
+            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+        fi
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
+        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+
+    else
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+    fi
+
+    # API Extensions
+    # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
+    # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
+    tox -evenv -- tempest verify-config -uro $tmp_cfg_file
+    # Nova API extensions
+    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
+    # Neutron API Extensions
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
+    # Swift API Extensions
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
+        # Remove disabled extensions
+        object_storage_api_extensions=$(remove_disabled_extensions $object_storage_api_extensions $DISABLE_STORAGE_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
+    # Cinder API Extensions
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        volume_api_extensions=$(remove_disabled_extensions $volume_api_extensions $DISABLE_VOLUME_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions $volume_api_extensions
+
     # Restore IFS
     IFS=$ifs
 }

From cb32230e528414f6280a2ceaaf2d77f895b3587d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 12 Apr 2016 10:30:52 +1000
Subject: [PATCH 1311/3333] Revert "Work around broken rabbitmq 3.6.1 packages
 on Fedora 23"

This reverts commit 616957d5981310e465e9fb3fd0c040751d8b0b63.

Fixed packages are released to F23 stable

Change-Id: I6c1ecaf9afb78afa3051922eb8347a2610e57416
---
 tools/fixup_stuff.sh | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 15cb5a1180..193a1f7aba 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -159,14 +159,6 @@ if is_fedora; then
             pip_install --upgrade --force-reinstall requests
         fi
     fi
-
-    if [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "23" ]]; then
-        # work-around broken rabbitmq-server 3.6.1 packages
-        #  https://bugzilla.redhat.com/show_bug.cgi?id=1323610
-        # Will be removed when this bug is fixed.
-        sudo dnf -y install \
-             https://kojipkgs.fedoraproject.org/packages/rabbitmq-server/3.5.7/4.fc23/noarch/rabbitmq-server-3.5.7-4.fc23.noarch.rpm
-    fi
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From 6f1781f9684d803e1168c20c382ec6fa95fe161f Mon Sep 17 00:00:00 2001
From: zhiyuan_cai <luckyvega.g@gmail.com>
Date: Thu, 7 Apr 2016 18:36:46 +0800
Subject: [PATCH 1312/3333] Fix DevStack failure in multi-region setting

In stack.sh, REGION_NAME is used to set environment variable
OS_REGION_NAME before using OpenStack client to configure accounts
for services. OpenStack client will try to find Keystone endpoint
in REGION_NAME to send the requests.

However, in the case of deploying multiple DevStack instances in
different regions with shared Keystone, Keystone is only running
in one the of region. When installing DevStack for the region that
does not host Keystone, OpenStack client will fail to find the
Keystone endpoint and thus DevStack fails to start.

This patch fixes this bug by introducing KEYSTONE_REGION_NAME for
user to specify which region Keystone is running in. Document of
multi-region setup is also updated.

Change-Id: I3e82c7ff69326d4171623299ffecea103d40c80d
Closes-Bug: #1540802
---
 doc/source/configuration.rst | 10 ++++++++++
 stack.sh                     |  2 +-
 stackrc                      |  6 ++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0493f8fa25..9d580f0c46 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -630,6 +630,16 @@ In RegionTwo:
     KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     REGION_NAME=RegionTwo
+    KEYSTONE_REGION_NAME=RegionOne
+
+In the devstack for RegionOne, we set REGION_NAME as RegionOne, so region of
+the services started in this devstack are registered as RegionOne. In devstack
+for RegionTwo, similarly, we set REGION_NAME as RegionTwo since we want
+services started in this devstack to be registered in RegionTwo. But Keystone
+service is started and registered in RegionOne, not RegionTwo, so we use
+KEYSTONE_REGION_NAME to specify the region of Keystone service.
+KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
+it in the configuration of RegionOne.
 
 Disabling Identity API v2
 +++++++++++++++++++++++++
diff --git a/stack.sh b/stack.sh
index 739d939ff1..3de9af2725 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1020,7 +1020,7 @@ export OS_USER_DOMAIN_ID=default
 export OS_PASSWORD=$ADMIN_PASSWORD
 export OS_PROJECT_NAME=admin
 export OS_PROJECT_DOMAIN_ID=default
-export OS_REGION_NAME=$REGION_NAME
+export OS_REGION_NAME=$KEYSTONE_REGION_NAME
 
 EOF
 
diff --git a/stackrc b/stackrc
index 17d6047e20..8858788840 100644
--- a/stackrc
+++ b/stackrc
@@ -42,6 +42,12 @@ fi
 # Specify region name Region
 REGION_NAME=${REGION_NAME:-RegionOne}
 
+# Specify name of region where identity service endpoint is registered.
+# When deploying multiple DevStack instances in different regions with shared
+# Keystone, set KEYSTONE_REGION_NAME to the region where Keystone is running
+# for DevStack instances which do not host Keystone.
+KEYSTONE_REGION_NAME=${KEYSTONE_REGION_NAME:-$REGION_NAME}
+
 # Specify which services to launch.  These generally correspond to
 # screen tabs. To change the default list, use the ``enable_service`` and
 # ``disable_service`` functions in ``local.conf``.

From d0931db1e89bee66ced796552d9db172f9f43639 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki.igawa@gmail.com>
Date: Wed, 13 Apr 2016 19:02:40 +0900
Subject: [PATCH 1313/3333] Add execution bit to
 generate-devstack-plugins-list.sh

This commit adds an execution bit to generate-devstack-plugins-list.sh.
This should be useful for users.

Change-Id: I12d0a257eb1d487979d044c2e52e824a6ea4c02d
---
 tools/generate-devstack-plugins-list.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 tools/generate-devstack-plugins-list.sh

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
old mode 100644
new mode 100755

From 4e6f8ca67047aef99ff1573bddc21b18aae1ce0b Mon Sep 17 00:00:00 2001
From: Fernando Ribeiro <fernando.ribeiro@oracle.com>
Date: Tue, 12 Apr 2016 23:34:03 -0300
Subject: [PATCH 1314/3333] Add installation support for Oracle Linux 7

This removes Oracle Linux 6 support ("OracleLinux") which, like RHEL6,
is now unsupported.  "OracleServer" matches Oracle Linux 7.

Change-Id: I35b1c7d0b103c509283dba0f6551453e7d8ac4cc
Closes-Bug: #1568634
---
 functions-common | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index b0352d38c6..0806681c3b 100644
--- a/functions-common
+++ b/functions-common
@@ -380,7 +380,7 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
-        "$os_VENDOR" =~ (OracleLinux) || \
+        "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
@@ -427,7 +427,7 @@ function is_oraclelinux {
         GetOSVersion
     fi
 
-    [ "$os_VENDOR" = "OracleLinux" ]
+    [ "$os_VENDOR" = "OracleServer" ]
 }
 
 
@@ -441,7 +441,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
-        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
         [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
 }
 

From 578459f8088474f8b1d1d29e4ca6f3aa3a5f42c5 Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Thu, 7 Apr 2016 08:15:45 +0900
Subject: [PATCH 1315/3333] In worlddump, execute ovs-ofctl for an only
 existing bridge

When devstack fails, some or all bridges may not exist.
This change allows an only existing bridge to executes ovs-ofctl command.
And fix duplicate ofp version specified in protocol option of ovs-ofctl.

Change-Id: Ied01de727ca9b867ce87db358f72ae44838b63af
---
 tools/worlddump.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 3ff22a9dfd..f931f11b2e 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -76,6 +76,12 @@ def _header(name):
     print
 
 
+def _bridge_list():
+    process = subprocess.Popen(['ovs-vsctl', 'list-br'], stdout=subprocess.PIPE)
+    stdout, _ = process.communicate()
+    return stdout.split()
+
+
 # This method gets a max openflow version supported by openvswitch.
 # For example 'ovs-ofctl --version' displays the following:
 #
@@ -157,14 +163,11 @@ def ovs_dump():
     if not _find_cmd('ovs-vsctl'):
         return
 
-    # NOTE(ihrachys): worlddump is used outside of devstack context (f.e. in
-    # grenade), so there is no single place to determine the bridge names from.
-    # Hardcode for now.
-    bridges = ('br-int', 'br-tun', 'br-ex')
+    bridges = _bridge_list()
     ofctl_cmds = ('show', 'dump-ports-desc', 'dump-ports', 'dump-flows')
     ofp_max = _get_ofp_version()
     vers = 'OpenFlow10'
-    for i in range(ofp_max + 1):
+    for i in range(1, ofp_max + 1):
         vers += ',OpenFlow1' + str(i)
     _dump_cmd("sudo ovs-vsctl show")
     for ofctl_cmd in ofctl_cmds:

From 7cd16ce48a9e8986a3ae1427fc8f916f5aa67f3a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 8 Apr 2016 09:40:56 +1000
Subject: [PATCH 1316/3333] Remove shocco docs and other cleanups

This is a fairly opinionated change to do some spring cleaning on the
documentation.

The current output of shocco as rendered at [1] is completely broken.
I can not see that it is worth us maintaining this.  Honestly, the
github page does a better job at showing the scripts with a bit of
formatting.  The "changes" page is similarly useless today.  cgit or
github show allow browsing of changes in the repo better.  Both are
removed along with support scripts.

When you currently hit the first page, it gives no clue as to what
DevStack actually is.  Add a paragraph explaining that, and link to
the cgit for easy source browsing.

stackrc.rst is not necessary; the stuff about database backends is
already discussed in configuration.rst; move the things about service
repos into a section of configuration.rst.

The discussion in openrc.rst is moved into the configuration.rst file.

localrc.conf.rst was just a paragraph pointing back to
configuration.rst; this is removed.

The variables described in exercise.rst are moved into a separate
section of configuration.rst

[1] http://docs.openstack.org/developer/devstack/#scripts

Change-Id: Ie7f4b265368f1d10a8908d75e11d625b2cc39e7c
---
 doc/source/changes.rst       |  12 ---
 doc/source/configuration.rst | 141 ++++++++++++++++++++++++++++++++++-
 doc/source/exerciserc.rst    |  42 -----------
 doc/source/index.rst         | 109 +++------------------------
 doc/source/local.conf.rst    |   9 ---
 doc/source/openrc.rst        |  68 -----------------
 doc/source/stackrc.rst       |  66 ----------------
 tools/build_docs.sh          | 100 -------------------------
 tox.ini                      |   7 +-
 9 files changed, 151 insertions(+), 403 deletions(-)
 delete mode 100644 doc/source/changes.rst
 delete mode 100644 doc/source/exerciserc.rst
 delete mode 100644 doc/source/local.conf.rst
 delete mode 100644 doc/source/openrc.rst
 delete mode 100644 doc/source/stackrc.rst
 delete mode 100755 tools/build_docs.sh

diff --git a/doc/source/changes.rst b/doc/source/changes.rst
deleted file mode 100644
index 19fce0fd52..0000000000
--- a/doc/source/changes.rst
+++ /dev/null
@@ -1,12 +0,0 @@
-=======
-Changes
-=======
-
-Recent Changes What's been happening?
-=====================================
-
-These are the commits to DevStack for the last six months. For the
-complete list see `the DevStack project in
-Gerrit <https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack,n,z>`__.
-
-%GIT_LOG%
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index f3e4896296..3c77f4d793 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -62,8 +62,7 @@ appear in the file will be used.
 A specific meta-section ``local|localrc`` is used to provide a default
 ``localrc`` file (actually ``.localrc.auto``). This allows all custom
 settings for DevStack to be contained in a single file. If ``localrc``
-exists it will be used instead to preserve backward-compatibility. More
-details on the :doc:`contents of local.conf <local.conf>` are available.
+exists it will be used instead to preserve backward-compatibility.
 
 ::
 
@@ -84,6 +83,76 @@ Also note that the ``localrc`` section is sourced as a shell script
 fragment and MUST conform to the shell requirements, specifically no
 whitespace around ``=`` (equals).
 
+openrc
+======
+
+``openrc`` configures login credentials suitable for use with the
+OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
+beginning (which in turn sources the ``localrc`` section of
+``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
+to use in the endpoints. The values shown below are the default values.
+
+OS\_PROJECT\_NAME (OS\_TENANT\_NAME)
+    Keystone has
+    standardized the term *project* as the entity that owns resources. In
+    some places references still exist to the previous term
+    *tenant* for this use. Also, *project\_name* is preferred to
+    *project\_id*.  OS\_TENANT\_NAME remains supported for compatibility
+    with older tools.
+
+    ::
+
+        OS_PROJECT_NAME=demo
+
+OS\_USERNAME
+    In addition to the owning entity (project), OpenStack calls the entity
+    performing the action *user*.
+
+    ::
+
+        OS_USERNAME=demo
+
+OS\_PASSWORD
+    Keystone's default authentication requires a password be provided.
+    The usual cautions about putting passwords in environment variables
+    apply, for most DevStack uses this may be an acceptable tradeoff.
+
+    ::
+
+        OS_PASSWORD=secret
+
+HOST\_IP, SERVICE\_HOST
+    Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
+    be used to specify the endpoint, which is convenient for some
+    ``local.conf`` configurations. Typically, ``HOST_IP`` is set in the
+    ``localrc`` section.
+
+    ::
+
+        HOST_IP=127.0.0.1
+        SERVICE_HOST=$HOST_IP
+
+OS\_AUTH\_URL
+    Authenticating against an OpenStack cloud using Keystone returns a
+    *Token* and *Service Catalog*. The catalog contains the endpoints
+    for all services the user/tenant has access to - including Nova,
+    Glance, Keystone and Swift.
+
+    ::
+
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
+
+KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
+    Set command-line client log level to ``DEBUG``. These are commented
+    out by default.
+
+    ::
+
+        # export KEYSTONECLIENT_DEBUG=1
+        # export NOVACLIENT_DEBUG=1
+
+
+
 .. _minimal-configuration:
 
 Minimal Configuration
@@ -145,6 +214,37 @@ Configuration Notes
 .. contents::
    :local:
 
+Service Repos
+-------------
+
+The Git repositories used to check out the source for each service are
+controlled by a pair of variables set for each service.  ``*_REPO``
+points to the repository and ``*_BRANCH`` selects which branch to
+check out. These may be overridden in ``local.conf`` to pull source
+from a different repo for testing, such as a Gerrit branch
+proposal. ``GIT_BASE`` points to the primary repository server.
+
+    ::
+
+        NOVA_REPO=$GIT_BASE/openstack/nova.git
+        NOVA_BRANCH=master
+
+To pull a branch directly from Gerrit, get the repo and branch from
+the Gerrit review page:
+
+    ::
+
+        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
+
+    The repo is the stanza following ``fetch`` and the branch is the
+    stanza following that:
+
+    ::
+
+        NOVA_REPO=https://review.openstack.org/p/openstack/nova
+        NOVA_BRANCH=refs/changes/50/5050/1
+
+
 Installation Directory
 ----------------------
 
@@ -640,3 +740,40 @@ use the v3 API. It is possible to setup keystone without v2 API, by doing:
 ::
 
     ENABLE_IDENTITY_V2=False
+
+Exercises
+~~~~~~~~~
+
+``exerciserc`` is used to configure settings for the exercise scripts.
+The values shown below are the default values. These can all be
+overridden by setting them in the ``localrc`` section.
+
+* Max time to wait while vm goes from build to active state
+
+    ::
+
+        ACTIVE_TIMEOUT==30
+
+* Max time to wait for proper IP association and dis-association.
+
+    ::
+
+        ASSOCIATE_TIMEOUT=15
+
+* Max time till the vm is bootable
+
+    ::
+
+        BOOT_TIMEOUT=30
+
+* Max time from run instance command until it is running
+
+    ::
+
+        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
+
+* Max time to wait for a vm to terminate
+
+    ::
+
+        TERMINATE_TIMEOUT=30
diff --git a/doc/source/exerciserc.rst b/doc/source/exerciserc.rst
deleted file mode 100644
index dacae2ecf2..0000000000
--- a/doc/source/exerciserc.rst
+++ /dev/null
@@ -1,42 +0,0 @@
-==============================
-exerciserc - Exercise Settings
-==============================
-
-``exerciserc`` is used to configure settings for the exercise scripts.
-The values shown below are the default values. These can all be
-overridden by setting them in the ``localrc`` section.
-
-ACTIVE\_TIMEOUT
-    Max time to wait while vm goes from build to active state
-
-    ::
-
-        ACTIVE_TIMEOUT==30
-
-ASSOCIATE\_TIMEOUT
-    Max time to wait for proper IP association and dis-association.
-
-    ::
-
-        ASSOCIATE_TIMEOUT=15
-
-BOOT\_TIMEOUT
-    Max time till the vm is bootable
-
-    ::
-
-        BOOT_TIMEOUT=30
-
-RUNNING\_TIMEOUT
-    Max time from run instance command until it is running
-
-    ::
-
-        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
-
-TERMINATE\_TIMEOUT
-    Max time to wait for a vm to terminate
-
-    ::
-
-        TERMINATE_TIMEOUT=30
diff --git a/doc/source/index.rst b/doc/source/index.rst
index c79b2ce0c7..c4a7c59fe5 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -1,8 +1,16 @@
-DevStack - an OpenStack Community Production
-============================================
+DevStack
+========
 
 .. image:: assets/images/logo-blue.png
 
+DevStack is a series of extensible scripts used to quickly bring up a
+complete OpenStack environment.  It is used interactively as a
+development environment and as the basis for much of the OpenStack
+project's functional testing.
+
+The source is available at
+`<https://git.openstack.org/cgit/openstack-dev/devstack>`__.
+
 .. toctree::
    :glob:
    :maxdepth: 1
@@ -12,7 +20,6 @@ DevStack - an OpenStack Community Production
    plugins
    plugin-registry
    faq
-   changes
    hacking
 
 Quick Start
@@ -147,11 +154,6 @@ Plugins
 
 :doc:`Extending DevStack with new features <plugins>`
 
-Recent Changes
---------------
-
-:doc:`An incomplete summary of recent changes <changes>`
-
 FAQ
 ---
 
@@ -162,94 +164,3 @@ Contributing
 
 :doc:`Pitching in to make DevStack a better place <hacking>`
 
-Code
-====
-
-*A look at the bits that make it all go*
-
-Scripts
--------
-
-* `stack.sh <stack.sh.html>`__ - The main script
-* `functions <functions.html>`__ - DevStack-specific functions
-* `functions-common <functions-common.html>`__ - Functions shared with other projects
-* `lib/apache <lib/apache.html>`__
-* `lib/ceph <lib/ceph.html>`__
-* `lib/cinder <lib/cinder.html>`__
-* `lib/database <lib/database.html>`__
-* `lib/dstat <lib/dstat.html>`__
-* `lib/glance <lib/glance.html>`__
-* `lib/heat <lib/heat.html>`__
-* `lib/horizon <lib/horizon.html>`__
-* `lib/infra <lib/infra.html>`__
-* `lib/keystone <lib/keystone.html>`__
-* `lib/ldap <lib/ldap.html>`__
-* `lib/neutron-legacy <lib/neutron-legacy.html>`__
-* `lib/nova <lib/nova.html>`__
-* `lib/oslo <lib/oslo.html>`__
-* `lib/rpc\_backend <lib/rpc_backend.html>`__
-* `lib/swift <lib/swift.html>`__
-* `lib/tempest <lib/tempest.html>`__
-* `lib/tls <lib/tls.html>`__
-* `lib/trove <lib/trove.html>`__
-* `unstack.sh <unstack.sh.html>`__
-* `clean.sh <clean.sh.html>`__
-* `run\_tests.sh <run_tests.sh.html>`__
-
-* `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
-* `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
-* `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
-
-* `inc/ini-config <inc/ini-config.html>`__
-* `inc/meta-config <inc/meta-config.html>`__
-* `inc/python <inc/python.html>`__
-
-* `pkg/elasticsearch.sh <pkg/elasticsearch.sh.html>`_
-
-Configuration
--------------
-
-.. toctree::
-   :glob:
-   :maxdepth: 1
-
-   local.conf
-   stackrc
-   openrc
-   exerciserc
-
-Tools
------
-
-* `tools/build\_docs.sh <tools/build_docs.sh.html>`__
-* `tools/build\_venv.sh <tools/build_venv.sh.html>`__
-* `tools/create-stack-user.sh <tools/create-stack-user.sh.html>`__
-* `tools/create\_userrc.sh <tools/create_userrc.sh.html>`__
-* `tools/fixup\_stuff.sh <tools/fixup_stuff.sh.html>`__
-* `tools/info.sh <tools/info.sh.html>`__
-* `tools/install\_pip.sh <tools/install_pip.sh.html>`__
-* `tools/install\_prereqs.sh <tools/install_prereqs.sh.html>`__
-* `tools/make\_cert.sh <tools/make_cert.sh.html>`__
-* `tools/upload\_image.sh <tools/upload_image.sh.html>`__
-
-Samples
--------
-
-* `local.sh <samples/local.sh.html>`__
-
-Exercises
----------
-
-* `exercise.sh <exercise.sh.html>`__
-* `exercises/aggregates.sh <exercises/aggregates.sh.html>`__
-* `exercises/boot\_from\_volume.sh <exercises/boot_from_volume.sh.html>`__
-* `exercises/bundle.sh <exercises/bundle.sh.html>`__
-* `exercises/client-args.sh <exercises/client-args.sh.html>`__
-* `exercises/client-env.sh <exercises/client-env.sh.html>`__
-* `exercises/euca.sh <exercises/euca.sh.html>`__
-* `exercises/floating\_ips.sh <exercises/floating_ips.sh.html>`__
-* `exercises/horizon.sh <exercises/horizon.sh.html>`__
-* `exercises/neutron-adv-test.sh <exercises/neutron-adv-test.sh.html>`__
-* `exercises/sec\_groups.sh <exercises/sec_groups.sh.html>`__
-* `exercises/swift.sh <exercises/swift.sh.html>`__
-* `exercises/volumes.sh <exercises/volumes.sh.html>`__
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
deleted file mode 100644
index a1ca60a75d..0000000000
--- a/doc/source/local.conf.rst
+++ /dev/null
@@ -1,9 +0,0 @@
-==========================
-local.conf - User Settings
-==========================
-
-``local.conf`` is a user-maintained settings file that is sourced in
-``stackrc``. It contains a section that replaces the historical
-``localrc`` file. See the description of
-:doc:`local.conf <configuration>` for more details about the mechanics
-of the file.
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
deleted file mode 100644
index d28b5680c6..0000000000
--- a/doc/source/openrc.rst
+++ /dev/null
@@ -1,68 +0,0 @@
-=====================================
-openrc - User Authentication Settings
-=====================================
-
-``openrc`` configures login credentials suitable for use with the
-OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
-beginning (which in turn sources the ``localrc`` section of
-``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
-to use in the endpoints. The values shown below are the default values.
-
-OS\_PROJECT\_NAME (OS\_TENANT\_NAME)
-    Keystone has
-    standardized the term *project* as the entity that owns resources. In
-    some places references still exist to the previous term
-    *tenant* for this use. Also, *project\_name* is preferred to
-    *project\_id*.  OS\_TENANT\_NAME remains supported for compatibility
-    with older tools.
-
-    ::
-
-        OS_PROJECT_NAME=demo
-
-OS\_USERNAME
-    In addition to the owning entity (project), OpenStack calls the entity
-    performing the action *user*.
-
-    ::
-
-        OS_USERNAME=demo
-
-OS\_PASSWORD
-    Keystone's default authentication requires a password be provided.
-    The usual cautions about putting passwords in environment variables
-    apply, for most DevStack uses this may be an acceptable tradeoff.
-
-    ::
-
-        OS_PASSWORD=secret
-
-HOST\_IP, SERVICE\_HOST
-    Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
-    be used to specify the endpoint, which is convenient for some
-    ``local.conf`` configurations. Typically, ``HOST_IP`` is set in the
-    ``localrc`` section.
-
-    ::
-
-        HOST_IP=127.0.0.1
-        SERVICE_HOST=$HOST_IP
-
-OS\_AUTH\_URL
-    Authenticating against an OpenStack cloud using Keystone returns a
-    *Token* and *Service Catalog*. The catalog contains the endpoints
-    for all services the user/project has access to - including Nova,
-    Glance, Keystone and Swift.
-
-    ::
-
-        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
-
-KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
-    Set command-line client log level to ``DEBUG``. These are commented
-    out by default.
-
-    ::
-
-        # export KEYSTONECLIENT_DEBUG=1
-        # export NOVACLIENT_DEBUG=1
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
deleted file mode 100644
index 81d4b80b8a..0000000000
--- a/doc/source/stackrc.rst
+++ /dev/null
@@ -1,66 +0,0 @@
-===========================
-stackrc - DevStack Settings
-===========================
-
-``stackrc`` is the primary configuration file for DevStack. It contains
-all of the settings that control the services started and the
-repositories used to download the source for those services. ``stackrc``
-sources the ``localrc`` section of ``local.conf`` to perform the default
-overrides.
-
-DATABASE\_TYPE
-    Select the database backend to use. The default is ``mysql``,
-    ``postgresql`` is also available.
-ENABLED\_SERVICES
-    Specify which services to launch. These generally correspond to
-    screen tabs. The default includes: Glance (API and Registry),
-    Keystone, Nova (API, Certificate, Object Store, Compute, Network,
-    Scheduler, Certificate Authentication), Cinder
-    (Scheduler, API, Volume), Horizon, MySQL, RabbitMQ, Tempest.
-
-    ::
-
-        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
-
-    Other services that are not enabled by default can be enabled in
-    ``localrc``. For example, to add Swift, use the following service
-    names:
-
-    ::
-
-        enable_service s-proxy s-object s-container s-account
-
-    A service can similarly be disabled:
-
-    ::
-
-        disable_service horizon
-
-Service Repos
-    The Git repositories used to check out the source for each service
-    are controlled by a pair of variables set for each service.
-    ``*_REPO`` points to the repository and ``*_BRANCH`` selects which
-    branch to check out. These may be overridden in ``local.conf`` to
-    pull source from a different repo for testing, such as a Gerrit
-    branch proposal. ``GIT_BASE`` points to the primary repository
-    server.
-
-    ::
-
-        NOVA_REPO=$GIT_BASE/openstack/nova.git
-        NOVA_BRANCH=master
-
-    To pull a branch directly from Gerrit, get the repo and branch from
-    the Gerrit review page:
-
-    ::
-
-        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
-
-    The repo is the stanza following ``fetch`` and the branch is the
-    stanza following that:
-
-    ::
-
-        NOVA_REPO=https://review.openstack.org/p/openstack/nova
-        NOVA_BRANCH=refs/changes/50/5050/1
diff --git a/tools/build_docs.sh b/tools/build_docs.sh
deleted file mode 100755
index 7dc492e2a4..0000000000
--- a/tools/build_docs.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-
-# **build_docs.sh** - Build the docs for DevStack
-#
-# - Install shocco if not found on ``PATH`` and ``INSTALL_SHOCCO`` is set
-# - Clone ``MASTER_REPO`` branch ``MASTER_BRANCH``
-# - Re-creates ``doc/build/html`` directory from existing repo + new generated script docs
-
-# Usage:
-## build_docs.sh [-o <out-dir>]
-## -o <out-dir>     Write the static HTML output to <out-dir>
-##                  (Note that <out-dir> will be deleted and re-created to ensure it is clean)
-
-# Defaults
-# --------
-
-HTML_BUILD=doc/build/html
-
-# Keep track of the DevStack directory
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-
-# Uses this shocco branch: https://github.com/dtroyer/shocco/tree/rst_support
-SHOCCO=${SHOCCO:-shocco}
-if ! which shocco; then
-    if [[ ! -x $TOP_DIR/shocco/shocco ]]; then
-        if [[ -z "$INSTALL_SHOCCO" ]]; then
-            echo "shocco not found in \$PATH, please set environment variable SHOCCO"
-            exit 1
-        fi
-        echo "Installing local copy of shocco"
-        if ! which pygmentize; then
-            sudo pip install Pygments
-        fi
-        if ! which rst2html.py; then
-            sudo pip install docutils
-        fi
-        git clone -b rst_support https://github.com/dtroyer/shocco shocco
-        cd shocco
-        ./configure
-        make || exit
-        cd ..
-    fi
-    SHOCCO=$TOP_DIR/shocco/shocco
-fi
-
-# Process command-line args
-while getopts o: c; do
-    case $c in
-        o)  HTML_BUILD=$OPTARG
-            ;;
-    esac
-done
-shift `expr $OPTIND - 1`
-
-
-# Processing
-# ----------
-
-# Ensure build dir exists
-mkdir -p $HTML_BUILD
-
-# Get fully qualified dirs
-FQ_HTML_BUILD=$(cd $HTML_BUILD && pwd)
-
-# Insert automated bits
-GLOG=$(mktemp gitlogXXXX)
-echo "<ul>" >$GLOG
-git log \
-    --pretty=format:'            <li>%s - <em>Commit <a href="https://review.openstack.org/#q,%h,n,z">%h</a> %cd</em></li>' \
-    --date=short \
-    --since '6 months ago' | grep -v Merge >>$GLOG
-echo "</ul>" >>$GLOG
-sed -i~ -e $"/^.*%GIT_LOG%.*$/r $GLOG" -e $"/^.*%GIT_LOG%.*$/s/^.*%GIT_LOG%.*$//" $FQ_HTML_BUILD/changes.html
-rm -f $GLOG
-
-# Build list of scripts to process
-FILES=""
-for f in $(find . \( -name .git -o -name .tox \) -prune -o \( -type f -name \*.sh -not -path \*shocco/\* -print \)); do
-    echo $f
-    FILES+="$f "
-    mkdir -p $FQ_HTML_BUILD/`dirname $f`;
-    $SHOCCO $f > $FQ_HTML_BUILD/$f.html
-done
-for f in $(find functions functions-common inc lib pkg samples -type f -name \* ! -name *.md ! -name *.conf); do
-    echo $f
-    FILES+="$f "
-    mkdir -p $FQ_HTML_BUILD/`dirname $f`;
-    $SHOCCO $f > $FQ_HTML_BUILD/$f.html
-done
-echo "$FILES" >doc/files
-
-# Clean up or report the temp workspace
-if [[ -n REPO && -n $PUSH_REPO ]]; then
-    echo rm -rf $TMP_ROOT
-else
-    if [[ -z "$TMP_ROOT" ]]; then
-        TMP_ROOT="$(pwd)"
-    fi
-    echo "Built docs in $HTML_BUILD"
-fi
diff --git a/tox.ini b/tox.ini
index 4ec293939e..e8e7d7ebb8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -17,7 +17,6 @@ whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
          -not \( -type d -name doc -prune \)     \
-         -not \( -type d -name shocco -prune \)  \
          -not \( -type f -name localrc -prune \) \
          -type f                                 \
          -not -name \*~                          \
@@ -48,7 +47,5 @@ deps =
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
-  INSTALL_SHOCCO=true
-commands = 
-	python setup.py build_sphinx
-	bash tools/build_docs.sh
+commands =
+  python setup.py build_sphinx

From b3f26cb66c70b599c4d77945f2bdadd9537c7c35 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 13 Apr 2016 23:28:06 +0000
Subject: [PATCH 1317/3333] Revert "WIP - Remove lbaas from devstack proper"

The WIP prefix and the statement

"This can't merge until p-c no longer references lbaas jobs."

Should have been an indication that this patch is not quite ready to
go in as is.

This reverts commit 130c3adb0e88044c9cf3789e79f6e669fa30d7d2.

Change-Id: I57d5f9f2e66b1bdf6fca70074bc1d5678de65f38
---
 lib/neutron-legacy                        | 40 +++++++++++++++++-
 lib/neutron_plugins/services/loadbalancer | 51 +++++++++++++++++++++++
 stackrc                                   |  4 ++
 3 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 573b061a4a..e06a020f43 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -107,6 +107,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
@@ -121,6 +122,9 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
+# Default provider for load balancer service
+DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
+
 # Default provider for VPN service
 DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
 
@@ -343,6 +347,12 @@ if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
     source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 fi
 
+# Agent loadbalancer service plugin functions
+# -------------------------------------------
+
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
+
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -432,6 +442,10 @@ function configure_neutron {
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
+    if is_service_enabled q-lbaas; then
+        deprecated "Configuring q-lbaas through devstack is deprecated"
+        _configure_neutron_lbaas
+    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -642,6 +656,10 @@ function install_neutron {
         git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
         setup_develop $NEUTRON_FWAAS_DIR
     fi
+    if is_service_enabled q-lbaas; then
+        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
+        setup_develop $NEUTRON_LBAAS_DIR
+    fi
     if is_service_enabled q-vpn; then
         git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
         setup_develop $NEUTRON_VPNAAS_DIR
@@ -685,6 +703,10 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
+
+    if is_service_enabled q-lbaas; then
+        neutron_agent_lbaas_install_agent_packages
+    fi
 }
 
 # Start running processes, including screen
@@ -747,6 +769,7 @@ function start_neutron_other_agents {
     fi
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
+    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -785,6 +808,9 @@ function stop_neutron_other {
         stop_process q-meta
     fi
 
+    if is_service_enabled q-lbaas; then
+        neutron_lbaas_stop
+    fi
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
@@ -889,7 +915,7 @@ function cleanup_neutron {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
@@ -1082,6 +1108,18 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
+function _configure_neutron_lbaas {
+    # Uses oslo config generator to generate LBaaS sample configuration files
+    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
+        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
+    fi
+    neutron_agent_lbaas_configure_common
+    neutron_agent_lbaas_configure_agent
+}
+
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
new file mode 100644
index 0000000000..30e9480f2e
--- /dev/null
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# Neutron loadbalancer plugin
+# ---------------------------
+
+# Save trace setting
+_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
+set +o xtrace
+
+
+AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
+LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
+
+function neutron_agent_lbaas_install_agent_packages {
+    if is_ubuntu || is_fedora || is_suse; then
+        install_package haproxy
+    fi
+}
+
+function neutron_agent_lbaas_configure_common {
+    _neutron_service_plugin_class_add $LBAAS_PLUGIN
+    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
+}
+
+function neutron_agent_lbaas_configure_agent {
+    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
+    mkdir -p $LBAAS_AGENT_CONF_PATH
+
+    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
+
+    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
+
+    # ovs_use_veth needs to be set before the plugin configuration
+    # occurs to allow plugins to override the setting.
+    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
+
+    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
+
+    if is_fedora; then
+        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
+        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
+    fi
+}
+
+function neutron_lbaas_stop {
+    pids=$(ps aux | awk '/haproxy/ { print $2 }')
+    [ ! -z "$pids" ] && sudo kill $pids || true
+}
+
+# Restore xtrace
+$_XTRACE_NEUTRON_LB
diff --git a/stackrc b/stackrc
index ffb3596be6..74d507cfa2 100644
--- a/stackrc
+++ b/stackrc
@@ -231,6 +231,10 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
+# neutron lbaas service
+NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
+NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
+
 # neutron vpnaas service
 NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
 NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}

From 982b9911fb66d8c098442f0785972b3a3fcb1414 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 14 Apr 2016 07:48:24 +1000
Subject: [PATCH 1318/3333] Deprecate SERVICE_TENANT

This is a follow-on to I6f392d3c16726f6dd734184dcf3014fb4f388207 to
note the variable is kept for backwards compatibility.

Change-Id: I1008b2d4e2baf82e1aa531d9eaf96a084beb69aa
---
 lib/keystone | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index b5c107c138..c6208aec4c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -108,6 +108,9 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the project for service accounts in Keystone
 SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
+
+# Note 2016-03 : SERVICE_TENANT_NAME is kept for backwards
+# compatibility; we should be using SERVICE_PROJECT_NAME now
 SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols

From 91d2245d6ebe5f2b1627771adfe1f0fe45570c43 Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Tue, 12 Apr 2016 10:53:46 +0200
Subject: [PATCH 1319/3333] Add variable SWIFT_STORAGE_IPS

If the variable SWIFT_STORAGE_IPS contains a space-separated list of
IPs, we can use this to create consistent rings across all proxy and
storage nodes.

Change-Id: If9307196dc7e74e4a842c95503958ae2d7f7acc7
---
 doc/source/configuration.rst | 12 +++++++++++
 lib/swift                    | 42 +++++++++++++++++++++++++++++-------
 2 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0493f8fa25..f3eda01dcc 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -513,6 +513,18 @@ If you only want to do some testing of a real normal swift cluster
 with multiple replicas you can do so by customizing the variable
 ``SWIFT_REPLICAS`` in your ``localrc`` section (usually to 3).
 
+You can manually override the ring building to use specific storage
+nodes, for example when you want to test a multinode environment. In
+this case you have to set a space-separated list of IPs in
+``SWIFT_STORAGE_IPS`` in your ``localrc`` section that should be used
+as Swift storage nodes.
+Please note that this does not create a multinode setup, it is only
+used when adding nodes to the Swift rings.
+
+::
+
+    SWIFT_STORAGE_IPS="192.168.1.10 192.168.1.11 192.168.1.12"
+
 Swift S3
 ++++++++
 
diff --git a/lib/swift b/lib/swift
index b2fe755cef..bef55b9b67 100644
--- a/lib/swift
+++ b/lib/swift
@@ -149,6 +149,11 @@ SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY:-}
 # Toggle for deploying Swift under HTTPD + mod_wsgi
 SWIFT_USE_MOD_WSGI=${SWIFT_USE_MOD_WSGI:-False}
 
+# A space-separated list of storage node IPs that
+# should be used to create the Swift rings
+SWIFT_STORAGE_IPS=${SWIFT_STORAGE_IPS:-}
+
+
 # Functions
 # ---------
 
@@ -693,14 +698,35 @@ function init_swift {
         swift-ring-builder container.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
         swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
 
-        for node_number in ${SWIFT_REPLICAS_SEQ}; do
-            swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-            swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-            swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-        done
-        swift-ring-builder object.builder rebalance
-        swift-ring-builder container.builder rebalance
-        swift-ring-builder account.builder rebalance
+        # The ring will be created on each node, and because the order of
+        # nodes is identical we can use a seed for rebalancing, making it
+        # possible to get a ring on each node that uses the same partition
+        # assignment.
+        if [[ -n $SWIFT_STORAGE_IPS ]]; then
+            local node_number
+            node_number=1
+
+            for node in ${SWIFT_STORAGE_IPS}; do
+                swift-ring-builder object.builder add z${node_number}-${node}:${OBJECT_PORT_BASE}/sdb1 1
+                swift-ring-builder container.builder add z${node_number}-${node}:${CONTAINER_PORT_BASE}/sdb1 1
+                swift-ring-builder account.builder add z${node_number}-${node}:${ACCOUNT_PORT_BASE}/sdb1 1
+                let "node_number=node_number+1"
+            done
+
+        else
+
+            for node_number in ${SWIFT_REPLICAS_SEQ}; do
+                swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+            done
+        fi
+
+        # We use a seed for rebalancing. Doing this allows us to create
+        # identical rings on multiple nodes if SWIFT_STORAGE_IPS is the same
+        swift-ring-builder object.builder rebalance 42
+        swift-ring-builder container.builder rebalance 42
+        swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
 
     # Create cache dir

From 0b4a009e56d29e4fe51ae06132c5766d0da9be7d Mon Sep 17 00:00:00 2001
From: ZhiQiang Fan <aji.zqfan@gmail.com>
Date: Tue, 12 Apr 2016 20:26:33 +0800
Subject: [PATCH 1320/3333] remove clouds.yaml in clean.sh

devstack failed to install because glance:
Could not determine a suitable URL for the plugin

patch I618ea8e27b49af360c905df85af06d9b1eef8407 tries
to fix this problem, but with a wrong way because path is not
correct, the clouds.yaml is not under /path/to/devstack/~/.config/openstack/
but ~/.config/openstack.

patch I8af6bd465f74099c560dddba6b5221dd79cbc965 tries to
fix this problem, but with a worng way to specify the path,
~$STACK_USER/.config/openstack/clouds.yaml will not expand with
a variable, only const string can.

$ whoami
zqfan
$ touch ~/.config/openstack/clouds.yaml
$ export STACK_USER=zqfan
$ rm -rf ~$STACK_USER/.config/openstack/clouds.yaml
$ ls ~/.config/openstack/
clouds.yaml

Change-Id: I549817d2f4638be615991c1726b39d270ba71357
ref: I618ea8e27b49af360c905df85af06d9b1eef8407
---
 clean.sh         | 5 +++--
 functions-common | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index b18f28ec28..1176134da6 100755
--- a/clean.sh
+++ b/clean.sh
@@ -137,9 +137,10 @@ rm -rf $DIRS_TO_CLEAN
 FILES_TO_CLEAN=".localrc.auto .localrc.password "
 FILES_TO_CLEAN+="docs/files docs/html shocco/ "
 FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
-FILES_TO_CLEAN+=".stackenv .prereqs "
-FILES_TO_CLEAN+="~/.config/openstack"
+FILES_TO_CLEAN+=".stackenv .prereqs"
 
 for file in $FILES_TO_CLEAN; do
     rm -rf $TOP_DIR/$file
 done
+
+rm -rf ~/.config/openstack
diff --git a/functions-common b/functions-common
index 0806681c3b..a4711ddc58 100644
--- a/functions-common
+++ b/functions-common
@@ -123,7 +123,7 @@ function write_clouds_yaml {
         --os-project-name admin
 
     # CLean up any old clouds.yaml files we had laying around
-    rm -f ~$STACK_USER/.config/openstack/clouds.yaml
+    rm -f $(eval echo ~"$STACK_USER")/.config/openstack/clouds.yaml
 }
 
 # trueorfalse <True|False> <VAR>

From 955609356a1586b3b39892bd8433de7d75cb05f3 Mon Sep 17 00:00:00 2001
From: Rabi Mishra <ramishra@redhat.com>
Date: Mon, 1 Feb 2016 13:20:18 +0530
Subject: [PATCH 1321/3333] Add heat_stack_owner role required by tempest

Create specific heat_stack_owner role to be used by
tempest tests, rather than using _member_ which is not
automatically created in keystone v3.

Change-Id: Iff13a47e360b628bc48a8cb897d9368af49db01b
Partial-Bug: #1539692
---
 lib/tempest | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index fd98c948f2..1678c4f225 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -383,6 +383,11 @@ function configure_tempest {
 
     # Orchestration Tests
     if is_service_enabled heat; then
+        # Though this is not needed by heat, some tempest tests explicitly
+        # try to set this role. Removing them from the tempest tests breaks
+        # some non-devstack CIs.
+        get_or_create_role "heat_stack_owner"
+
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
             iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
@@ -396,7 +401,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
-        iniset $TEMPEST_CONFIG orchestration stack_owner_role "_member_"
+        iniset $TEMPEST_CONFIG orchestration stack_owner_role "heat_stack_owner"
     fi
 
     # Scenario

From fb44bc30fdc958c576290959e273185eef1f8fd9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 15 Apr 2016 06:10:04 +0000
Subject: [PATCH 1322/3333] Updated from generate-devstack-plugins-list

Change-Id: Ifd1fbd0a9e8c433119e30299ef417d70c9b967a0
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 999350fe6a..950cf04d33 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -56,6 +56,7 @@ freezer-api                            `git://git.openstack.org/openstack/freeze
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
+group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__

From ef219bfcafb69970b83db8b503d5947ced9eca16 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 11 Feb 2016 13:54:48 +0100
Subject: [PATCH 1323/3333] worlddump: request Guru Mediation reports for
 neutron agents

Those reports may be helpful when debugging neutron gate issues.

pgrep is backwards compatible with old Solaris tools, which means it
does not match with commands that are longer than 15 characters. To
avoid that for neutron agent names which are longer than that, we need
to pass -f argument to match against the full cmdline.

Also killall instead of kill + pgrep in a subshell.

Change-Id: I9b3801e927c0e80443ed76e38cd8e3618e888e49
---
 tools/worlddump.py | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 8c053e038f..238a23dab8 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -27,6 +27,16 @@
 import sys
 
 
+GMR_PROCESSES = (
+    'nova-compute',
+    'neutron-dhcp-agent',
+    'neutron-l3-agent',
+    'neutron-linuxbridge-agent',
+    'neutron-metadata-agent',
+    'neutron-openvswitch-agent',
+)
+
+
 def get_options():
     parser = argparse.ArgumentParser(
         description='Dump world state for debugging')
@@ -191,17 +201,18 @@ def compute_consoles():
             _dump_cmd("sudo cat %s" % fullpath)
 
 
-def guru_meditation_report():
-    _header("nova-compute Guru Meditation Report")
+def guru_meditation_reports():
+    for service in GMR_PROCESSES:
+        _header("%s Guru Meditation Report" % service)
 
-    try:
-        subprocess.check_call(["pgrep","nova-compute"])
-    except subprocess.CalledProcessError:
-        print("Skipping as nova-compute does not appear to be running")
-        return
+        try:
+            subprocess.check_call(['pgrep', '-f', service])
+        except subprocess.CalledProcessError:
+            print("Skipping as %s does not appear to be running" % service)
+            continue
 
-    _dump_cmd("kill -s USR2 `pgrep nova-compute`")
-    print("guru meditation report in nova-compute log")
+        _dump_cmd("killall -e -USR2 %s" % service)
+        print("guru meditation report in %s log" % service)
 
 
 def main():
@@ -218,7 +229,7 @@ def main():
         iptables_dump()
         ebtables_dump()
         compute_consoles()
-        guru_meditation_report()
+        guru_meditation_reports()
 
 
 if __name__ == '__main__':

From 82bca44845b8dd25d34d5ee4b7c75d95c8ccf82c Mon Sep 17 00:00:00 2001
From: Boden R <bodenvmw@gmail.com>
Date: Fri, 15 Apr 2016 10:56:09 -0600
Subject: [PATCH 1324/3333] Fix Q_PLUGIN_EXTRA_CONF_FILES usage comment

Related bug #1469434 fixed the usage comments for
Q_PLUGIN_EXTRA_CONF_FILES. However that change didn't
make it into neutron-legacy. This patch updates the comments
in neutron-legacy to reflect proper assignment of
Q_PLUGIN_EXTRA_CONF_FILES as well indicate
Q_PLUGIN_CONF_PATH is required when using extra conf files.

Change-Id: I447f1158d333ac4a35c4903a509146a62d93b272
Related-Bug: #1469434
Closes-Bug: #1542282
---
 lib/neutron-legacy | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 084a3569ba..c2729cb5d2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -946,10 +946,11 @@ function _configure_neutron_common {
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH``,
+    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
     # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
     #
-    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1, file2)``
+    #    ``Q_PLUGIN_CONF_PATH=/path/to/plugins``
+    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1 file2)``
     neutron_plugin_configure_common
 
     if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then

From fdb388314679b19493cef1861318190d017f7724 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Fri, 15 Apr 2016 20:54:11 +0200
Subject: [PATCH 1325/3333] Add venv tox environment

This environment is used by the normal docs job, add it.
Manually add requirements needed for doc building.

Change-Id: I1be193d113683966f6a76e862713f3a550543168
---
 tox.ini | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tox.ini b/tox.ini
index e8e7d7ebb8..dbd1652d10 100644
--- a/tox.ini
+++ b/tox.ini
@@ -49,3 +49,13 @@ setenv =
   TOP_DIR={toxinidir}
 commands =
   python setup.py build_sphinx
+
+[testenv:venv]
+deps =
+   pbr>=0.6,!=0.7,<1.0
+   sphinx>=1.1.2,<1.2
+   oslosphinx
+   blockdiag
+   sphinxcontrib-blockdiag
+   sphinxcontrib-nwdiag
+commands = {posargs}

From 4b267082a29d24154cb3bd841a910b24adb40cf8 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 16 Apr 2016 06:52:53 +0000
Subject: [PATCH 1326/3333] Updated from generate-devstack-plugins-list

Change-Id: I6a32144d4d210ebef8d770baf840fa90e345b3d1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 950cf04d33..4e191d3076 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -66,6 +66,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__

From cbcbd8f33c87904b2293e68ec9868be0b6e4393e Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Thu, 21 Jan 2016 16:08:14 -0600
Subject: [PATCH 1327/3333] Allow putting service users in a seperate domain

Make it possible to construct the service users in their own seperate
domain. Changing this away from Default will not work for everyone yet,
though it does work for basic service interaction however enabling it
will allow us to start testing and hopefully gating that services aren't
relying on v2 only concepts.

Change-Id: I7e73df5dd1caabf355783da2bc0f3007ade92fba
---
 functions-common   | 26 ++++++++++++++++++++++++--
 lib/glance         | 10 +++-------
 lib/keystone       | 12 +++++++-----
 lib/neutron-legacy |  4 ++--
 lib/nova           |  2 +-
 lib/swift          |  2 ++
 6 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/functions-common b/functions-common
index 0806681c3b..71dda76727 100644
--- a/functions-common
+++ b/functions-common
@@ -840,27 +840,49 @@ function get_or_create_role {
     echo $role_id
 }
 
+# Returns the domain parts of a function call if present
+# Usage: _get_domain_args [<user_domain> <project_domain>]
+function _get_domain_args {
+    local domain
+    domain=""
+
+    if [[ -n "$1" ]]; then
+        domain="$domain --user-domain $1"
+    fi
+    if [[ -n "$2" ]]; then
+        domain="$domain --project-domain $2"
+    fi
+
+    echo $domain
+}
+
 # Gets or adds user role to project
-# Usage: get_or_add_user_project_role <role> <user> <project>
+# Usage: get_or_add_user_project_role <role> <user> <project> [<user_domain> <project_domain>]
 function get_or_add_user_project_role {
     local user_role_id
+
+    domain_args=$(_get_domain_args $4 $5)
+
     # Gets user role id
     user_role_id=$(openstack role list \
         --user $2 \
         --column "ID" \
         --project $3 \
         --column "Name" \
+        $domain_args \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
-            --project $3
+            --project $3 \
+            $domain_args
         user_role_id=$(openstack role list \
             --user $2 \
             --column "ID" \
             --project $3 \
             --column "Name" \
+            $domain_args \
             | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
diff --git a/lib/glance b/lib/glance
index 3743e161c4..f2a6db6edc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -173,8 +173,8 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id default
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_name $SERVICE_DOMAIN_NAME
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_name $SERVICE_DOMAIN_NAME
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
@@ -288,11 +288,7 @@ function create_glance_accounts {
 
         # required for swift access
         if is_service_enabled s-proxy; then
-
-            local glance_swift_user
-            glance_swift_user=$(get_or_create_user "glance-swift" \
-                "$SERVICE_PASSWORD" "default" "glance-swift@example.com")
-            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_PROJECT_NAME
+            create_service_user "glance-swift" "ResellerAdmin"
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
diff --git a/lib/keystone b/lib/keystone
index b5c107c138..cd07b78172 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -106,7 +106,9 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
+
 # Set the project for service accounts in Keystone
+SERVICE_DOMAIN_NAME=${SERVICE_DOMAIN_NAME:-Default}
 SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
 SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
@@ -370,6 +372,7 @@ function create_keystone_accounts {
     get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
+    get_or_create_domain "$SERVICE_DOMAIN_NAME"
     get_or_create_project "$SERVICE_PROJECT_NAME" default
 
     # Service role, so service users do not have to be admins
@@ -442,9 +445,8 @@ function create_keystone_accounts {
 function create_service_user {
     local role=${2:-service}
 
-    local user
-    user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
-    get_or_add_user_project_role "$role" "$user" "$SERVICE_PROJECT_NAME"
+    get_or_create_user "$1" "$SERVICE_PASSWORD" "$SERVICE_DOMAIN_NAME"
+    get_or_add_user_project_role "$role" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
 }
 
 # Configure the service to use the auth token middleware.
@@ -464,9 +466,9 @@ function configure_auth_token_middleware {
     iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
-    iniset $conf_file $section user_domain_id default
+    iniset $conf_file $section user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
-    iniset $conf_file $section project_domain_id default
+    iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 084a3569ba..aaba8945cd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -491,9 +491,9 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron user_domain_name "Default"
+    iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $NOVA_CONF neutron project_domain_name "Default"
+    iniset $NOVA_CONF neutron project_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
     iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
diff --git a/lib/nova b/lib/nova
index 8823e1ddb4..15dae6837e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -439,7 +439,7 @@ function create_nova_accounts {
         if is_service_enabled swift; then
             # Nova needs ResellerAdmin role to download images when accessing
             # swift through the s3 api.
-            get_or_add_user_project_role ResellerAdmin nova $SERVICE_PROJECT_NAME
+            get_or_add_user_project_role ResellerAdmin nova $SERVICE_PROJECT_NAME $SERVICE_DOMAIN_NAME $SERVICE_DOMAIN_NAME
         fi
     fi
 
diff --git a/lib/swift b/lib/swift
index f47608cd6e..8cb94efa66 100644
--- a/lib/swift
+++ b/lib/swift
@@ -846,7 +846,9 @@ function swift_configure_tempurls {
     # note we are using swift credentials!
     OS_USERNAME=swift \
     OS_PASSWORD=$SERVICE_PASSWORD \
+    OS_USER_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
     OS_PROJECT_NAME=$SERVICE_PROJECT_NAME \
+    OS_PROJECT_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
     openstack object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }

From 262ecba8991f2061af2464f1966cecb3b62e4405 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 18 Apr 2016 06:53:45 +0000
Subject: [PATCH 1328/3333] Updated from generate-devstack-plugins-list

Change-Id: I9078900f98721336daf1aab4a812eed96f8b1588
---
 doc/source/plugin-registry.rst | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4e191d3076..9c207658fa 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,23 +1,26 @@
 ..
-  Note to patch submitters: this file is covered by a periodic proposal
-  job.  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header instead of this one.
+
+  Note to patch submitters:
+
+  # ============================= #
+  # THIS FILE IS AUTOGENERATED !  #
+  # ============================= #
+
+  ** Plugins are found automatically and added to this list **
+
+  This file is created by a periodic proposal job.  You should not
+  edit this file.
+
+  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
 ==========================
 
-Since we've created the external plugin mechanism, it's gotten used by
-a lot of projects. The following is a list of plugins that currently
-exist. Any project that wishes to list their plugin here is welcomed
-to.
-
-Detected Plugins
-================
-
-The following are plugins that a script has found in the openstack/
-namespace, which includes but is not limited to official OpenStack
-projects.
+The following list is an automatically-generated collection of
+available DevStack plugins.  This includes, but is not limited to,
+official OpenStack projects.
 
 
 ====================================== ===

From 06c7a4404edf25b9a4d913e77d12a2f61a608053 Mon Sep 17 00:00:00 2001
From: Alex Meade <mr.alex.meade@gmail.com>
Date: Fri, 1 Apr 2016 13:18:32 -0400
Subject: [PATCH 1329/3333] Add volumev3 endpoint for Cinder

Change-Id: I97caa6bfababf7d1cc714296ae66f77d22bf24ab
---
 lib/cinder  | 8 ++++++++
 lib/tempest | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 4df7de8959..607a6f83c6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -386,6 +386,14 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
+
+        get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
+        get_or_create_endpoint \
+            "volumev3" \
+            "$REGION_NAME" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
     fi
 }
 
diff --git a/lib/tempest b/lib/tempest
index fd98c948f2..0fc58153f4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -425,6 +425,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
+    # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
 
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False

From f9d10ebdf1f6776a9b878e0eef314acd176a7aa2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 19 Apr 2016 06:46:31 +0000
Subject: [PATCH 1330/3333] Updated from generate-devstack-plugins-list

Change-Id: Id0201da590a6af83b2b6dd26da811cd67975f6eb
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9c207658fa..5f38168006 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -99,6 +99,7 @@ neutron-vpnaas                         `git://git.openstack.org/openstack/neutro
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+openstack-ansible-os_swift_sync        `git://git.openstack.org/openstack/openstack-ansible-os_swift_sync <https://git.openstack.org/cgit/openstack/openstack-ansible-os_swift_sync>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__

From 73467041b6853ee99b5f973f52a0be092de9c48a Mon Sep 17 00:00:00 2001
From: Tom Patzig <tom.patzig@sap.com>
Date: Tue, 19 Apr 2016 17:02:34 +0200
Subject: [PATCH 1331/3333] Remove additional '/' in Q_PLUGIN_EXTRA_CONF_FILES

Currently there is added an obsolote/wrong '/' when passing
Q_PLUGIN_EXTRA_CONF_FILES to the service start arguments.
Thats not a problem when using absolute paths, but wrong for
relative paths. This patch removes that extra '/'.

Change-Id: I2136d39889eaf83ecfcc711c733e95e261f455e0
Closes-Bug: #1572192
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c2729cb5d2..2d55abf2a9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -387,7 +387,7 @@ function _determine_config_server {
     local cfg_file
     local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
     for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
-        opts+=" --config-file /$cfg_file"
+        opts+=" --config-file $cfg_file"
     done
     echo "$opts"
 }

From 181588b9ba50fefea12617a9a5e774daddfed20c Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 25 Jun 2015 17:58:51 -0500
Subject: [PATCH 1332/3333] Switch fernet to be the default token provider

Use the fernet token provider as the default for keystone.

 The Keystone token provider of choice is changing from UUID to Fernet.
 However, due the the need for multi-site keystone deploys to have keys
 kept in sync, we cannot change the default in upstream Keystone
 without  breaking existing deployments.  Fernet requires a deliberate
 setup step like what is done in devstack.  Making the change in
 devstack documents the expected setup.

Change-Id: I8c0db244634b0861b0eb3c48fe6ede153f7f04f2
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index d83092405b..49d819e500 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -89,7 +89,7 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
-KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration

From 67223b0265501c17357f91a956ff4b1f76a67523 Mon Sep 17 00:00:00 2001
From: Tom Patzig <tom.patzig@sap.com>
Date: Tue, 19 Apr 2016 16:43:05 +0200
Subject: [PATCH 1333/3333] Fix Q_PLUGIN_EXTRA_CONF_PATH usage comment

The bug #1542282 added Q_PLUGIN_CONF_PATH to the comment on how to use
Q_PLUGIN_EXTRA_CONF_FILES. But the right variable name is
Q_PLUGIN_EXTRA_CONF_PATH; this patch fixes this comment.

Change-Id: I6b6b39068fe54509b1bb8af47ae0b21dd77c444a
Related-Bug: #1469434
Closes-Bug: #1542282
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c2729cb5d2..76adb28196 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -946,10 +946,10 @@ function _configure_neutron_common {
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
+    # For additional plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
     # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
     #
-    #    ``Q_PLUGIN_CONF_PATH=/path/to/plugins``
+    #    ``Q_PLUGIN_EXTRA_CONF_PATH=/path/to/plugins``
     #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1 file2)``
     neutron_plugin_configure_common
 

From c527ded91bef5d4c56cbdb2402a4d68015364b37 Mon Sep 17 00:00:00 2001
From: Clenimar Filemon <clenimar.filemon@gmail.com>
Date: Thu, 31 Mar 2016 15:43:51 -0300
Subject: [PATCH 1334/3333] Update auth params in Nova Hypervisor-Ironic

As Nova hypervisor uses deprecated parameters when trying to
authenticate to Ironic, as well as a hardcoded /v2.0 endpoint, a fatal
error occurs when creating a keystone v3-only devstack.

This patch updates auth parameters (ironic section in nova.conf) that Nova
uses when trying to connect to Ironic to v3 parameters.

Change-Id: I2d7ebf750115613aa917448f20daaece614633ef
---
 lib/nova_plugins/hypervisor-ironic | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 43e7797371..7224fe3f42 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,10 +45,12 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
-    iniset $NOVA_CONF ironic admin_username admin
-    iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
-    iniset $NOVA_CONF ironic admin_tenant_name demo
+    iniset $NOVA_CONF ironic username admin
+    iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic project_domain_id default
+    iniset $NOVA_CONF ironic user_domain_id default
+    iniset $NOVA_CONF ironic project_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
 

From 648c4c25f7a11c4cb6f0d881d6fd4083dc957c61 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 21 Apr 2016 06:58:55 +0000
Subject: [PATCH 1335/3333] Updated from generate-devstack-plugins-list

Change-Id: I6f0a481f95055ed9334a57d50a68b077eace1e07
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5f38168006..9c207658fa 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -99,7 +99,6 @@ neutron-vpnaas                         `git://git.openstack.org/openstack/neutro
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
-openstack-ansible-os_swift_sync        `git://git.openstack.org/openstack/openstack-ansible-os_swift_sync <https://git.openstack.org/cgit/openstack/openstack-ansible-os_swift_sync>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__

From bea1e1954ad793f528876c030bc0ffecb83b0787 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 19 Apr 2016 07:01:30 +0100
Subject: [PATCH 1336/3333] Set default value and configurable value for
 integration bridge

When using XenServer as hypervisor, install_os_domU.sh will create
integration bridge for compute node when neutron network is used.
But it should provide a way to allow moving of the VM to another
host (with a different XEN_INTEGRATION_BRIDGE) for easier install.
This patch is to provide the way to let user have the chance to
configure integration bridge themselves

Change-Id: If923a5e978e77fc091d24b6e1fe7a83a3375da09
---
 lib/nova_plugins/hypervisor-xenserver | 3 ++-
 tools/xen/README.md                   | 6 ++++++
 tools/xen/install_os_domU.sh          | 4 ++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 3eb9149bb4..e7f1e87b61 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -29,7 +29,8 @@ GUEST_INTERFACE_DEFAULT=eth1
 # Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
 FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
 if is_service_enabled neutron; then
-    XEN_INTEGRATION_BRIDGE=$(sed -e 's/.* xen_integration_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
+    XEN_INTEGRATION_BRIDGE_DEFAULT=$(sed -e 's/.* xen_integration_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
+    XEN_INTEGRATION_BRIDGE=${XEN_INTEGRATION_BRIDGE:-$XEN_INTEGRATION_BRIDGE_DEFAULT}
 fi
 
 VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 21090e56aa..7062ecb48c 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -170,3 +170,9 @@ VM as `TEMPLATE_FILENAME`:
     xe vm-import filename="$mountdir/$TEMPLATE_FILENAME"
     umount "$mountdir"
     rm -rf "$mountdir"
+
+### Migrate OpenStack DomU to another host
+
+Given you need to migrate your DomU with OpenStack installed to another host,
+you need to set `XEN_INTEGRATION_BRIDGE` in localrc if neutron network is used.
+It is the bridge for `XEN_INT_BRIDGE_OR_NET_NAME` network created in Dom0
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 46ff0b6fda..8b97265e21 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -299,10 +299,10 @@ $THIS_DIR/build_xva.sh "$GUEST_NAME"
 # kernel parameter for DomU
 attach_network "$XEN_INT_BRIDGE_OR_NET_NAME"
 
-XEN_INTEGRATION_BRIDGE=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
+XEN_INTEGRATION_BRIDGE_DEFAULT=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
 append_kernel_cmdline \
     "$GUEST_NAME" \
-    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE}"
+    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE_DEFAULT}"
 
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"

From 7d1ec430046256ac3f536f4920a43936e28ef0c4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 22 Apr 2016 09:19:10 -0400
Subject: [PATCH 1337/3333] Don't check for existing endpoints

We really should only have code that create endpoints once, making all
osc calls get_or_set adds 3 seconds per call for no really good
reason.

This also stops creating the internal endpoints in the service
catalog. It's a pattern that we're trying not to propogate, so lets
not have it in devstack any more.

Change-Id: Ia8cefe43753900d62117beae330db46deb6a9fc9
---
 functions-common   | 35 ++++++++++++++++-------------------
 lib/cinder         |  6 +++---
 lib/glance         |  4 ++--
 lib/heat           |  4 ++--
 lib/neutron-legacy |  2 +-
 lib/nova           |  6 +++---
 lib/swift          |  2 +-
 7 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/functions-common b/functions-common
index e44fea112d..7f670716bd 100644
--- a/functions-common
+++ b/functions-common
@@ -987,38 +987,35 @@ function get_or_create_service {
 }
 
 # Create an endpoint with a specific interface
-# Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
-function _get_or_create_endpoint_with_interface {
+# Usage: _create_endpoint_with_interface <service> <interface> <url> <region>
+function _create_endpoint_with_interface {
+    # Creates new endpoint
     local endpoint_id
-    endpoint_id=$(openstack endpoint list \
-        --service $1 \
-        --interface $2 \
-        --region $4 \
-        -c ID -f value)
-    if [[ -z "$endpoint_id" ]]; then
-        # Creates new endpoint
-        endpoint_id=$(openstack endpoint create \
-            $1 $2 $3 --region $4 -f value -c id)
-    fi
-
+    endpoint_id=$(openstack endpoint create \
+                            $1 $2 $3 --region $4 -f value -c id)
     echo $endpoint_id
 }
 
-# Gets or creates endpoint
-# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+# TODO(sdague): remove in O
 function get_or_create_endpoint {
+    deprecated "get_or_create_endpoint is deprecated. Use create_endpoint instead"
+    create_endpoint $@
+}
+
+# Gets or creates endpoint
+# Usage: create_endpoint <service> <region> <publicurl> <adminurl>
+function create_endpoint {
     # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
     # creating one endpoint with multiple urls to multiple endpoints each with
     # a different interface.  To maintain the existing function interface we
-    # create 3 endpoints and return the id of the public one. In reality
+    # create 2 endpoints and return the id of the public one. In reality
     # returning the public id will not make a lot of difference as there are no
     # scenarios currently that use the returned id. Ideally this behaviour
     # should be pushed out to the service setups and let them create the
     # endpoints they need.
     local public_id
-    public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
-    _get_or_create_endpoint_with_interface $1 admin $4 $2
-    _get_or_create_endpoint_with_interface $1 internal $5 $2
+    public_id=$(_create_endpoint_with_interface $1 public $3 $2)
+    _create_endpoint_with_interface $1 admin $4 $2
 
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..037456adef 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,7 +372,7 @@ function create_cinder_accounts {
         create_service_user "cinder"
 
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "volume" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
@@ -380,7 +380,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-        get_or_create_endpoint \
+        create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
@@ -388,7 +388,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
 
         get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-        get_or_create_endpoint \
+        create_endpoint \
             "volumev3" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
diff --git a/lib/glance b/lib/glance
index f2a6db6edc..5d532eac5e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -292,7 +292,7 @@ function create_glance_accounts {
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "image" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
@@ -305,7 +305,7 @@ function create_glance_accounts {
         create_service_user "glare"
         get_or_create_service "glare" "artifact" "Glance Artifact Service"
 
-        get_or_create_endpoint "artifact" \
+        create_endpoint "artifact" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
diff --git a/lib/heat b/lib/heat
index 4326321bd1..6a654b5ade 100644
--- a/lib/heat
+++ b/lib/heat
@@ -388,7 +388,7 @@ function create_heat_accounts {
 
         create_service_user "heat" "admin"
         get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "orchestration" \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
@@ -396,7 +396,7 @@ function create_heat_accounts {
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
 
         get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "cloudformation"  \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..9da6a26e7b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -534,7 +534,7 @@ function create_neutron_accounts {
         create_service_user "neutron"
 
         get_or_create_service "neutron" "network" "Neutron Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "network" \
             "$REGION_NAME" \
             "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..33dbc428ee 100644
--- a/lib/nova
+++ b/lib/nova
@@ -418,7 +418,7 @@ function create_nova_accounts {
         fi
 
         get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
-        get_or_create_endpoint \
+        create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
             "$nova_api_url/v2/\$(project_id)s" \
@@ -426,7 +426,7 @@ function create_nova_accounts {
             "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "compute" \
             "$REGION_NAME" \
             "$nova_api_url/v2.1" \
@@ -446,7 +446,7 @@ function create_nova_accounts {
     # S3
     if is_service_enabled swift3; then
         get_or_create_service "s3" "s3" "S3"
-        get_or_create_endpoint \
+        create_endpoint \
             "s3" \
             "$REGION_NAME" \
             "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
diff --git a/lib/swift b/lib/swift
index 8cb94efa66..b74b4da840 100644
--- a/lib/swift
+++ b/lib/swift
@@ -633,7 +633,7 @@ function create_swift_accounts {
     create_service_user "swift" "admin"
 
     get_or_create_service "swift" "object-store" "Swift Service"
-    get_or_create_endpoint \
+    create_endpoint \
         "object-store" \
         "$REGION_NAME" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \

From ae4578bed986ebaaf3e09e1ecc9d4d7ae9f022ab Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sat, 23 Apr 2016 01:45:40 +0000
Subject: [PATCH 1338/3333] Revert "Don't check for existing endpoints"

This reverts commit 7d1ec430046256ac3f536f4920a43936e28ef0c4.

This broke the sahara and layer4 dsvm jobs. The layer4 job
is voting on tempest changes so tempest is also broken.

Change-Id: Ide69f10cd85bf7ff0d86bc8cba56dedd26850362
Partial-Bug: #1573868
---
 functions-common   | 35 +++++++++++++++++++----------------
 lib/cinder         |  6 +++---
 lib/glance         |  4 ++--
 lib/heat           |  4 ++--
 lib/neutron-legacy |  2 +-
 lib/nova           |  6 +++---
 lib/swift          |  2 +-
 7 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/functions-common b/functions-common
index 7f670716bd..e44fea112d 100644
--- a/functions-common
+++ b/functions-common
@@ -987,35 +987,38 @@ function get_or_create_service {
 }
 
 # Create an endpoint with a specific interface
-# Usage: _create_endpoint_with_interface <service> <interface> <url> <region>
-function _create_endpoint_with_interface {
-    # Creates new endpoint
+# Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
+function _get_or_create_endpoint_with_interface {
     local endpoint_id
-    endpoint_id=$(openstack endpoint create \
-                            $1 $2 $3 --region $4 -f value -c id)
-    echo $endpoint_id
-}
+    endpoint_id=$(openstack endpoint list \
+        --service $1 \
+        --interface $2 \
+        --region $4 \
+        -c ID -f value)
+    if [[ -z "$endpoint_id" ]]; then
+        # Creates new endpoint
+        endpoint_id=$(openstack endpoint create \
+            $1 $2 $3 --region $4 -f value -c id)
+    fi
 
-# TODO(sdague): remove in O
-function get_or_create_endpoint {
-    deprecated "get_or_create_endpoint is deprecated. Use create_endpoint instead"
-    create_endpoint $@
+    echo $endpoint_id
 }
 
 # Gets or creates endpoint
-# Usage: create_endpoint <service> <region> <publicurl> <adminurl>
-function create_endpoint {
+# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+function get_or_create_endpoint {
     # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
     # creating one endpoint with multiple urls to multiple endpoints each with
     # a different interface.  To maintain the existing function interface we
-    # create 2 endpoints and return the id of the public one. In reality
+    # create 3 endpoints and return the id of the public one. In reality
     # returning the public id will not make a lot of difference as there are no
     # scenarios currently that use the returned id. Ideally this behaviour
     # should be pushed out to the service setups and let them create the
     # endpoints they need.
     local public_id
-    public_id=$(_create_endpoint_with_interface $1 public $3 $2)
-    _create_endpoint_with_interface $1 admin $4 $2
+    public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
+    _get_or_create_endpoint_with_interface $1 admin $4 $2
+    _get_or_create_endpoint_with_interface $1 internal $5 $2
 
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
diff --git a/lib/cinder b/lib/cinder
index 037456adef..607a6f83c6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,7 +372,7 @@ function create_cinder_accounts {
         create_service_user "cinder"
 
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "volume" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
@@ -380,7 +380,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-        create_endpoint \
+        get_or_create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
@@ -388,7 +388,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
 
         get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-        create_endpoint \
+        get_or_create_endpoint \
             "volumev3" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
diff --git a/lib/glance b/lib/glance
index 5d532eac5e..f2a6db6edc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -292,7 +292,7 @@ function create_glance_accounts {
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
@@ -305,7 +305,7 @@ function create_glance_accounts {
         create_service_user "glare"
         get_or_create_service "glare" "artifact" "Glance Artifact Service"
 
-        create_endpoint "artifact" \
+        get_or_create_endpoint "artifact" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
diff --git a/lib/heat b/lib/heat
index 6a654b5ade..4326321bd1 100644
--- a/lib/heat
+++ b/lib/heat
@@ -388,7 +388,7 @@ function create_heat_accounts {
 
         create_service_user "heat" "admin"
         get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "orchestration" \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
@@ -396,7 +396,7 @@ function create_heat_accounts {
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
 
         get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "cloudformation"  \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9da6a26e7b..f0592e2f37 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -534,7 +534,7 @@ function create_neutron_accounts {
         create_service_user "neutron"
 
         get_or_create_service "neutron" "network" "Neutron Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "network" \
             "$REGION_NAME" \
             "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
diff --git a/lib/nova b/lib/nova
index 33dbc428ee..818ecc4f1b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -418,7 +418,7 @@ function create_nova_accounts {
         fi
 
         get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
-        create_endpoint \
+        get_or_create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
             "$nova_api_url/v2/\$(project_id)s" \
@@ -426,7 +426,7 @@ function create_nova_accounts {
             "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
             "$nova_api_url/v2.1" \
@@ -446,7 +446,7 @@ function create_nova_accounts {
     # S3
     if is_service_enabled swift3; then
         get_or_create_service "s3" "s3" "S3"
-        create_endpoint \
+        get_or_create_endpoint \
             "s3" \
             "$REGION_NAME" \
             "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
diff --git a/lib/swift b/lib/swift
index b74b4da840..8cb94efa66 100644
--- a/lib/swift
+++ b/lib/swift
@@ -633,7 +633,7 @@ function create_swift_accounts {
     create_service_user "swift" "admin"
 
     get_or_create_service "swift" "object-store" "Swift Service"
-    create_endpoint \
+    get_or_create_endpoint \
         "object-store" \
         "$REGION_NAME" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \

From 229685112d0de969e19e834be728d9c95c845abe Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Fri, 22 Apr 2016 20:14:15 -0700
Subject: [PATCH 1339/3333] Remove unused tempest options

Since I380dd20e5ed716a0bdf92aa02c3730359b8136e4 , tempest options
tempest_username and tempest_tenant_name have been added.
However, they are never used at all.
So this patch removes them for the cleanup.

Change-Id: Ic40047c5903d664e4a2d5eea88ff788e39d1e416
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 46dc1f8d42..3d004c47d6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -182,8 +182,6 @@ function configure_tempest {
     local admin_username=${ADMIN_USERNAME:-admin}
     local admin_project_name=${ADMIN_TENANT_NAME:-admin}
     local admin_domain_name=${ADMIN_DOMAIN_NAME:-Default}
-    local tempest_username=${TEMPEST_USERNAME:-demo}
-    local tempest_project_name=${TEMPEST_TENANT_NAME:-demo}
     local alt_username=${ALT_USERNAME:-alt_demo}
     local alt_project_name=${ALT_TENANT_NAME:-alt_demo}
     local admin_project_id

From c4a0d21436c125b1caa3bd38b9d50f8130d9c413 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 23 Apr 2016 06:55:18 +0000
Subject: [PATCH 1340/3333] Updated from generate-devstack-plugins-list

Change-Id: I376abd75e0d0ce77c35b106a4e9c8c3e23247eb4
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9c207658fa..835d043af1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -93,6 +93,7 @@ networking-powervm                     `git://git.openstack.org/openstack/networ
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From 336390f9b3691914f8aaf7a87867036fae35d8ba Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Fri, 1 Apr 2016 10:53:13 +0200
Subject: [PATCH 1341/3333] Set user/project domain ID when using keystone v3

Change I24546f02067ea23d088d383b85e3a78d7b43f165 aimed to use
keystone v3 as default in devstack. The change was later reverted in
Ia792b23119c00089542ba08879dca1c29dc80945 because it broke some
projects.
This patch contains a small portion of the first change to set the
environment variables $OS_USER_DOMAIN_ID and $OS_PROJECT_DOMAIN_ID in
openrc, so that users don't have to set them manually when using
keystone v3.

Change-Id: Ie4c316d60590d55830d417f13817298dac70864f
Partially-Implements: bp keystonev3
Closes-Bug: 1387814
---
 openrc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/openrc b/openrc
index db2e97d3b1..8d8ae8b030 100644
--- a/openrc
+++ b/openrc
@@ -90,6 +90,13 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
+# Currently, in order to use openstackclient with Identity API v3,
+# we need to set the domain which the user and project belong to.
+if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
+    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
+    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
+fi
+
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
     DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem

From e3a04dd857d8e6f8afc83a20673fedd79936d19b Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Tue, 26 Apr 2016 10:26:25 +0300
Subject: [PATCH 1342/3333] Fix ironic compute_driver name

This commit fixes breaking change [0].
Long driver names like 'nova.virt.libvirt.libvirtDriver' are
no longer available and 'libvirt.libvirtDriver' should be used
instead.

Reference:
[0] https://review.openstack.org/309504

Change-Id: I27a1b75b921c7401bc8614caadfd1e09e7dd5d65
Closes-Bug: 1574990
---
 lib/nova_plugins/hypervisor-ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 43e7797371..c40427c089 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -39,7 +39,7 @@ function configure_nova_hypervisor {
     configure_libvirt
     LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
 
-    iniset $NOVA_CONF DEFAULT compute_driver nova.virt.ironic.IronicDriver
+    iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0

From c8af407eb2fd2634eeb61fc5c60ef9d965ac1da6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 26 Apr 2016 17:53:45 +1000
Subject: [PATCH 1343/3333] Update to bashate 0.5.1

This minor release of bashate just fixes one small issue with python3
compatability.  This is an alternative to
Ic91b5ce8cb85e376573f9bf3659d2a86cc437179.

Change-Id: Ie5ad29003cf80a332b9a9258749757a15de79966
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index dbd1652d10..55a06d0cae 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ install_command = pip install {opts} {packages}
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.5.0}
+   {env:BASHATE_INSTALL_PATH:bashate==0.5.1}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \

From 7fa0efffab3662c0e0d4ba001d10d35e1eab87a6 Mon Sep 17 00:00:00 2001
From: Sylvain Baubeau <sbaubeau@redhat.com>
Date: Tue, 26 Apr 2016 20:39:18 +0200
Subject: [PATCH 1344/3333] Remove deprecated references to g-search

Commit 020586fab4173ea860789e459cb941c85179c739 removed support
for g-search as it was promoted to its own project. The devstack
plugin for Searchlight triggers the installation of elasticsearch,
so it can be removed from upstream devstack.

Change-Id: Iada75fc59c66b776c506431f93deb668ab0a84b9
---
 lib/glance | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/glance b/lib/glance
index f2a6db6edc..cda357fa66 100644
--- a/lib/glance
+++ b/lib/glance
@@ -362,11 +362,6 @@ function install_glance {
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
 
-    if is_service_enabled g-search; then
-        ${TOP_DIR}/pkg/elasticsearch.sh download
-        ${TOP_DIR}/pkg/elasticsearch.sh install
-    fi
-
     setup_develop $GLANCE_DIR
 }
 
@@ -386,7 +381,7 @@ function start_glance {
         die $LINENO "g-api did not start"
     fi
 
-    #Start g-glare after g-reg/g-api/g-search
+    #Start g-glare after g-reg/g-api
     if is_service_enabled g-glare; then
         run_process g-glare "$GLANCE_BIN_DIR/glance-glare --config-file=$GLANCE_CONF_DIR/glance-glare.conf"
         echo "Waiting for Glare [g-glare] ($GLANCE_GLARE_HOSTPORT) to start..."

From 1da4e790eb26d1333d57c7673ba491ca9b6dbde8 Mon Sep 17 00:00:00 2001
From: Mike Trimm <mitrimm@cisco.com>
Date: Wed, 27 Apr 2016 11:40:19 -0500
Subject: [PATCH 1345/3333] Added RHEL rebuild ScientificLinux to supported
 distributions

Change-Id: I8b3844bf28b11254e7cc9a96126bd66efbd1212e
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index e44fea112d..4daa686dba 100644
--- a/functions-common
+++ b/functions-common
@@ -380,6 +380,7 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
+        "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible

From 7b3ae5332813c79b734c99fbba3ab876224aa73c Mon Sep 17 00:00:00 2001
From: John Kasperski <jckasper@us.ibm.com>
Date: Sun, 24 Apr 2016 22:56:04 -0500
Subject: [PATCH 1346/3333] Update is_service_enabled

The nova check in is_service_enabled() is loading the nova repo
when ENABLED_SERVICES=ovn-northd.  Add a comma before each of the
checks to prevent this error with any of the other services.

Change-Id: I9deee735812cde44ea5140b1ad76848f02576609
Closes-Bug: #1574431
---
 functions-common | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/functions-common b/functions-common
index e44fea112d..a56a0abe9c 100644
--- a/functions-common
+++ b/functions-common
@@ -2063,14 +2063,14 @@ function is_service_enabled {
         # TODO(dtroyer): Remove these legacy special-cases after the is_XXX_enabled()
         #                are implemented
 
-        [[ ${service} == n-cell-* && ${ENABLED_SERVICES} =~ "n-cell" ]] && enabled=0
-        [[ ${service} == n-cpu-* && ${ENABLED_SERVICES} =~ "n-cpu" ]] && enabled=0
-        [[ ${service} == "nova" && ${ENABLED_SERVICES} =~ "n-" ]] && enabled=0
-        [[ ${service} == "glance" && ${ENABLED_SERVICES} =~ "g-" ]] && enabled=0
-        [[ ${service} == "neutron" && ${ENABLED_SERVICES} =~ "q-" ]] && enabled=0
-        [[ ${service} == "trove" && ${ENABLED_SERVICES} =~ "tr-" ]] && enabled=0
-        [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
-        [[ ${service} == s-* && ${ENABLED_SERVICES} =~ "swift" ]] && enabled=0
+        [[ ${service} == n-cell-* && ,${ENABLED_SERVICES} =~ ,"n-cell" ]] && enabled=0
+        [[ ${service} == n-cpu-* && ,${ENABLED_SERVICES} =~ ,"n-cpu" ]] && enabled=0
+        [[ ${service} == "nova" && ,${ENABLED_SERVICES} =~ ,"n-" ]] && enabled=0
+        [[ ${service} == "glance" && ,${ENABLED_SERVICES} =~ ,"g-" ]] && enabled=0
+        [[ ${service} == "neutron" && ,${ENABLED_SERVICES} =~ ,"q-" ]] && enabled=0
+        [[ ${service} == "trove" && ,${ENABLED_SERVICES} =~ ,"tr-" ]] && enabled=0
+        [[ ${service} == "swift" && ,${ENABLED_SERVICES} =~ ,"s-" ]] && enabled=0
+        [[ ${service} == s-* && ,${ENABLED_SERVICES} =~ ,"swift" ]] && enabled=0
     done
 
     $xtrace

From 878d7d8f13592bf254cb5f647bd3db87c191d2d3 Mon Sep 17 00:00:00 2001
From: Victor Ryzhenkin <vryzhenkin@mirantis.com>
Date: Wed, 27 Apr 2016 15:15:52 +0300
Subject: [PATCH 1347/3333] Adjust region name for images, networks and volumes
 during deployment

In a multiregion installation of devstack, conflicts occur in the
creation of images, networks, or volume types, when the region is not
set.

This patch adjusts commands to include the region, and
also adjusts the region_name in the nova configuration section of
neutron.conf to include the region.

Change-Id: Ifedff6a124fa49d57cc7b2f35916d8d96f5e5f7a
---
 functions          | 20 +++++++++----------
 lib/cinder         |  2 +-
 lib/neutron-legacy | 49 ++++++++++++++++++++++++----------------------
 lib/nova           | 24 +++++++++++------------
 4 files changed, 49 insertions(+), 46 deletions(-)

diff --git a/functions b/functions
index 1bfb8a5078..0942f17009 100644
--- a/functions
+++ b/functions
@@ -83,7 +83,7 @@ function upload_image {
     # OpenVZ-format images are provided as .tar.gz, but not decompressed prior to loading
     if [[ "$image_url" =~ 'openvz' ]]; then
         image_name="${image_fname%.tar.gz}"
-        openstack --os-cloud=devstack-admin image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
+        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
         return
     fi
 
@@ -197,7 +197,7 @@ function upload_image {
         vmdk_adapter_type="${props[1]:-$vmdk_adapter_type}"
         vmdk_net_adapter="${props[2]:-$vmdk_net_adapter}"
 
-        openstack --os-cloud=devstack-admin image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
+        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
         return
     fi
 
@@ -214,7 +214,7 @@ function upload_image {
             force_vm_mode="--property vm_mode=xen"
         fi
         openstack \
-            --os-cloud=devstack-admin \
+            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
             image create \
             "$image_name" --public \
             --container-format=ovf --disk-format=vhd \
@@ -228,7 +228,7 @@ function upload_image {
     if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
         image_name="${image_fname%.xen-raw.tgz}"
         openstack \
-            --os-cloud=devstack-admin \
+            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
             image create \
             "$image_name" --public \
             --container-format=tgz --disk-format=raw \
@@ -244,7 +244,7 @@ function upload_image {
         fi
 
         openstack \
-            --os-cloud=devstack-admin \
+            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
@@ -327,9 +327,9 @@ function upload_image {
 
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
-            openstack --os-cloud=devstack-admin image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
         else
-            openstack --os-cloud=devstack-admin image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi
     else
         # Use glance client to add the kernel the root filesystem.
@@ -337,12 +337,12 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
-        openstack --os-cloud=devstack-admin image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
+        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
     fi
 }
 
diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..17862327c4 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -560,7 +560,7 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            openstack volume type create --property volume_backend_name="${be_name}" ${be_name}
+            openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..39f8dec9f9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -556,16 +556,16 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -575,7 +575,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(neutron net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -589,17 +589,17 @@ function create_neutron_initial_network {
         fi
     fi
 
-    AUTO_ALLOCATE_EXT=$(neutron ext-list | grep 'auto-allocated-topology' | get_field 1)
-    SUBNETPOOL_EXT=$(neutron ext-list | grep 'subnet_allocation' | get_field 1)
+    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
+    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
     if [[ "$Q_L3_ENABLED" == "True" ]]; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(neutron router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
@@ -609,17 +609,17 @@ function create_neutron_initial_network {
         if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
             EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
             fi
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -974,6 +974,9 @@ function _configure_neutron_common {
     iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
     iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
 
+    # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
+    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
     # If addition config files are set, make sure their path name is set as well
     if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
         die $LINENO "Neutron additional plugin config not set.. exiting"
@@ -1289,7 +1292,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
-    subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -1306,7 +1309,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
-    ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
@@ -1320,7 +1323,7 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
@@ -1333,14 +1336,14 @@ function _neutron_create_public_subnet_v6 {
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    neutron router-interface-add $ROUTER_ID $SUBNET_ID
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -1348,7 +1351,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3; then
@@ -1370,7 +1373,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
+            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
         fi
@@ -1380,7 +1383,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    neutron router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -1392,7 +1395,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
     fi
 
     # This logic is specific to using the l3-agent for layer 3
@@ -1401,7 +1404,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
+        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -1466,7 +1469,7 @@ function teardown_neutron_debug {
 }
 
 function _get_net_id {
-    neutron --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
 }
 
 function _get_probe_cmd_prefix {
diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..3a1fd339f5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -935,21 +935,21 @@ function stop_nova {
 # create_instance_types(): Create default flavors
 function create_flavors {
     if is_service_enabled n-api; then
-        if ! openstack flavor list | grep -q ds512M; then
+        if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q ds512M; then
             # Note that danms hates these flavors and apologizes for sdague
-            openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
-            openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
-            openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
-            openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
-            openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+            openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
+            openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
         fi
 
-        if ! openstack flavor list | grep -q m1.tiny; then
-            openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
-            openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
-            openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
-            openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
-            openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+        if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q m1.tiny; then
+            openstack --os-region-name="$REGION_NAME" flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
+            openstack --os-region-name="$REGION_NAME" flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
+            openstack --os-region-name="$REGION_NAME" flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
+            openstack --os-region-name="$REGION_NAME" flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
+            openstack --os-region-name="$REGION_NAME" flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
         fi
     fi
 }

From 1a791cbc449a3cfdbc3d3b94c6cda3ddefa17af4 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 28 Apr 2016 12:39:26 -0700
Subject: [PATCH 1348/3333] Remove vpnaas code from devstack

This service is now configured by devstack plugin in master.

Change-Id: Ie5fc0d2a45c1b564f98c69ec9ea6fbdeeb465d32
---
 lib/neutron-legacy               | 56 ------------------------------
 lib/neutron_plugins/services/vpn | 58 --------------------------------
 stackrc                          |  4 ---
 3 files changed, 118 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/vpn

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..0d6141680e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -108,7 +108,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
 NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
-NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
@@ -125,9 +124,6 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # Default provider for load balancer service
 DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
 
-# Default provider for VPN service
-DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
-
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -139,7 +135,6 @@ AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
 Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
 Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
 Q_FWAAS_CONF_FILE=$NEUTRON_CONF_DIR/fwaas_driver.ini
-Q_VPN_CONF_FILE=$NEUTRON_CONF_DIR/vpn_agent.ini
 Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
 
 # Default name for Neutron database
@@ -231,10 +226,6 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 # See _configure_neutron_common() for details about setting it up
 declare -a Q_PLUGIN_EXTRA_CONF_FILES
 
-# List of (optional) config files for VPN device drivers to use with
-# the neutron-q-vpn agent
-declare -a Q_VPN_EXTRA_CONF_FILES
-
 
 Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
@@ -359,11 +350,6 @@ source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
 # Hardcoding for 1 service plugin for now
 source $TOP_DIR/lib/neutron_plugins/services/metering
 
-# VPN service plugin functions
-# -------------------------------------------
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/vpn
-
 # Firewall Service Plugin functions
 # ---------------------------------
 source $TOP_DIR/lib/neutron_plugins/services/firewall
@@ -392,19 +378,6 @@ function _determine_config_server {
     echo "$opts"
 }
 
-function _determine_config_vpn {
-    local cfg_file
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE --config-file=$Q_VPN_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
-    for cfg_file in ${Q_VPN_EXTRA_CONF_FILES[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-    echo "$opts"
-
-}
-
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
     if is_service_enabled q-fwaas; then
@@ -419,7 +392,6 @@ function determine_config_files {
     local opts=""
     case "$1" in
         "neutron-server") opts="$(_determine_config_server)" ;;
-        "neutron-vpn-agent") opts="$(_determine_config_vpn)" ;;
         "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
     esac
     if [ -z "$opts" ] ; then
@@ -449,10 +421,6 @@ function configure_neutron {
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
-    if is_service_enabled q-vpn; then
-        deprecated "Configuring q-vpn through devstack is deprecated"
-        _configure_neutron_vpn
-    fi
     if is_service_enabled q-fwaas; then
         deprecated "Configuring q-fwaas through devstack is deprecated"
         _configure_neutron_fwaas
@@ -661,10 +629,6 @@ function install_neutron {
         git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
         setup_develop $NEUTRON_LBAAS_DIR
     fi
-    if is_service_enabled q-vpn; then
-        git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
-        setup_develop $NEUTRON_VPNAAS_DIR
-    fi
 
     if [ "$VIRT_DRIVER" == 'xenserver' ]; then
         local dom0_ip
@@ -763,8 +727,6 @@ function start_neutron_other_agents {
 
     if is_service_enabled neutron-vpnaas; then
         :  # Started by plugin
-    elif is_service_enabled q-vpn; then
-        run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
     else
         run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
     fi
@@ -815,9 +777,6 @@ function stop_neutron_other {
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
-    if is_service_enabled q-vpn; then
-        neutron_vpn_stop
-    fi
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
@@ -1072,10 +1031,6 @@ function _configure_neutron_dhcp_agent {
 function _configure_neutron_l3_agent {
     Q_L3_ENABLED=True
 
-    if is_service_enabled q-vpn; then
-        neutron_vpn_configure_agent
-    fi
-
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -1135,17 +1090,6 @@ function _configure_neutron_fwaas {
     neutron_fwaas_configure_driver
 }
 
-function _configure_neutron_vpn {
-    # Uses oslo config generator to generate VPNaaS sample configuration files
-    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample ]; then
-        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample $NEUTRON_CONF_DIR/neutron_vpnaas.conf
-        iniset $NEUTRON_CONF_DIR/neutron_vpnaas.conf service_providers service_provider $DEFAULT_VPN_PROVIDER
-    fi
-    neutron_vpn_install_agent_packages
-    neutron_vpn_configure_common
-}
-
 function _configure_dvr {
     iniset $NEUTRON_CONF DEFAULT router_distributed True
     iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
deleted file mode 100644
index e790913847..0000000000
--- a/lib/neutron_plugins/services/vpn
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/bash
-
-# Neutron VPN plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_VPN=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_VPN_BINARY="$NEUTRON_BIN_DIR/neutron-vpn-agent"
-VPN_PLUGIN=${VPN_PLUGIN:-"neutron_vpnaas.services.vpn.plugin.VPNDriverPlugin"}
-IPSEC_PACKAGE=${IPSEC_PACKAGE:-"openswan"}
-
-function neutron_vpn_install_agent_packages {
-    install_package $IPSEC_PACKAGE
-    if is_ubuntu && [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
-        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.charon /etc/apparmor.d/disable/
-        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.stroke /etc/apparmor.d/disable/
-        # NOTE: Due to https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1387220
-        # one must use 'sudo start apparmor ACTION=reload' for Ubuntu 14.10
-        restart_service apparmor
-    fi
-}
-
-function neutron_vpn_configure_common {
-    _neutron_service_plugin_class_add $VPN_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_VPNAAS_DIR
-}
-
-function neutron_vpn_configure_agent {
-    # Uses oslo config generator to generate LBaaS sample configuration files
-    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini.sample $Q_VPN_CONF_FILE
-    if [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
-        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
-        if is_fedora; then
-            iniset $Q_VPN_CONF_FILE strongswan default_config_area /usr/share/strongswan/templates/config/strongswan.d
-        fi
-    else
-        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.ipsec.OpenSwanDriver
-    fi
-}
-
-function neutron_vpn_stop {
-    local ipsec_data_dir=$DATA_DIR/neutron/ipsec
-    local pids
-    if [ -d $ipsec_data_dir ]; then
-        pids=$(find $ipsec_data_dir -name 'pluto.pid' -exec cat {} \;)
-    fi
-    if [ -n "$pids" ]; then
-        sudo kill $pids
-    fi
-    stop_process q-vpn
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_VPN
diff --git a/stackrc b/stackrc
index 8858788840..44aa79fbe6 100644
--- a/stackrc
+++ b/stackrc
@@ -248,10 +248,6 @@ NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
 NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
 
-# neutron vpnaas service
-NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
-NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}
-
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}

From 13b3be10a754c0e0f9fb31ce824d5f2d9cc905de Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 30 Apr 2016 06:51:53 +0000
Subject: [PATCH 1349/3333] Updated from generate-devstack-plugins-list

Change-Id: I5fdf1e4a7bb0fbb9fa9b3ca96f42b87bd7f38d0d
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 835d043af1..a2721b4172 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -86,6 +86,7 @@ networking-mlnx                        `git://git.openstack.org/openstack/networ
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
 networking-ofagent                     `git://git.openstack.org/openstack/networking-ofagent <https://git.openstack.org/cgit/openstack/networking-ofagent>`__
+networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
 networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
 networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
@@ -93,7 +94,6 @@ networking-powervm                     `git://git.openstack.org/openstack/networ
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
-neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From aac43e1e71dd27fa7955f0385a67a91916676fee Mon Sep 17 00:00:00 2001
From: Sachin Patil <psachin@redhat.com>
Date: Sat, 30 Apr 2016 14:01:38 +0530
Subject: [PATCH 1350/3333] Suppressed echoing of the line.

I think the objective of the line is to display message, but it was
also echoing entire line before printing the message.

Change-Id: I758759638003deec3205983863f4b7e23ba94e89
Signed-off-by: Sachin Patil <psachin@redhat.com>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a94d60a0ef..970d8009eb 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@
 DEST=/opt/stack
 
 all:
-	echo "This just saved you from a terrible mistake!"
+	@echo "This just saved you from a terrible mistake!"
 
 # Do Some Work
 stack:

From 269704c119940fbbc18e275396770e1e591350f0 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Sun, 1 May 2016 07:22:34 -0700
Subject: [PATCH 1351/3333] Remove NOVA_V2_LEGACY option

There are two implementation code for similar API in Nova repository.
One is newer: v2.1 API, another is legacy: v2 API. v2.1 API has been
used as the default API since Liberty and legacy v2 API has been marked
as deprecated. We have used and tested v2.1 API so well and now is
nice time to remove legacy API code based on the consensus of the
design summit of Austin.
This patch removes NOVA_V2_LEGACY which set up legacy API code.

NOTE: The gate job which uses this NOVA_V2_LEGACY option has been
      removed already since Iac81b7d569b76b99e9d86eaa5001ae7f9b78cdfe.

Partially implements blueprint remove-legacy-v2-api-code

Change-Id: I0e16b7ce608d7eeb3a35fd77e66531dfc8c142ef
---
 lib/nova | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..7c145f8be5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -59,11 +59,6 @@ NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
-# NOVA_V2_LEGACY defines whether we force the Nova v2.0 enpoint onto
-# the Nova v2.0 legacy code base. Remove this option once the Nova
-# v2.0 legacy codebase is removed.
-NOVA_V2_LEGACY=$(trueorfalse False NOVA_V2_LEGACY)
-
 if is_suse; then
     NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/srv/www/htdocs/nova}
 else
@@ -311,13 +306,6 @@ function configure_nova {
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
         # Get the sample configuration file in place
         cp $NOVA_DIR/etc/nova/api-paste.ini $NOVA_CONF_DIR
-
-        # For setting up an environment where v2.0 is running on the
-        # v2.0 legacy code base.
-        if [[ "$NOVA_V2_LEGACY" == "True" ]]; then
-            sed -i s@"^/v2: openstack_compute_api_v21_legacy_v2_compatible$"@"/v2: openstack_compute_api_legacy_v2"@ \
-                "$NOVA_API_PASTE_INI"
-        fi
     fi
 
     if is_service_enabled n-cpu; then

From a046b6052a340b24063be3dc851fa4bbb51d6c00 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 2 May 2016 11:59:52 +0200
Subject: [PATCH 1352/3333] Remove tempest-lib setup

Tempest-lib, as a standalone project, is deprecated in favor of a
"lib/" directory inside Tempest's repo. So remove the installation
of tempest-lib in DevStack.

Change-Id: I507bfe875777fd25bbe5d67c861f3fca99faa22d
---
 lib/tempest                  | 17 -----------------
 stackrc                      |  4 ----
 tests/test_libs_from_pypi.sh |  2 +-
 3 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 46dc1f8d42..6ba04f1680 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -45,8 +45,6 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["tempest-lib"]=$DEST/tempest-lib
-
 TEMPEST_DIR=$DEST/tempest
 TEMPEST_CONFIG_DIR=${TEMPEST_CONFIG_DIR:-$TEMPEST_DIR/etc}
 TEMPEST_CONFIG=$TEMPEST_CONFIG_DIR/tempest.conf
@@ -587,20 +585,6 @@ function configure_tempest {
     IFS=$ifs
 }
 
-
-# install_tempest_lib() - Collect source, prepare, and install ``tempest-lib``
-function install_tempest_lib {
-    if use_library_from_git "tempest-lib"; then
-        git_clone_by_name "tempest-lib"
-        setup_dev_lib "tempest-lib"
-        # NOTE(mtreinish) For testing ``tempest-lib`` from git with Tempest we need to
-        # put the git version of ``tempest-lib`` in the Tempest job's tox venv
-        export PIP_VIRTUAL_ENV=${PROJECT_VENV["tempest"]}
-        setup_dev_lib "tempest-lib"
-        unset PIP_VIRTUAL_ENV
-    fi
-}
-
 # install_tempest() - Collect source and prepare
 function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
@@ -612,7 +596,6 @@ function install_tempest {
     # running pip install -U on tempest requirements
     $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
-    install_tempest_lib
     popd
 }
 
diff --git a/stackrc b/stackrc
index 44aa79fbe6..4ba57c9cb6 100644
--- a/stackrc
+++ b/stackrc
@@ -270,10 +270,6 @@ REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-master}
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 
-# TODO(sdague): this should end up as a library component like below
-GITREPO["tempest-lib"]=${TEMPEST_LIB_REPO:-${GIT_BASE}/openstack/tempest-lib.git}
-GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
-
 
 ##############
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index f01db6df1d..a979c346b8 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -31,7 +31,7 @@ done
 
 ALL_LIBS="python-novaclient oslo.config pbr oslo.context"
 ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
-ALL_LIBS+=" python-glanceclient python-ironicclient tempest-lib"
+ALL_LIBS+=" python-glanceclient python-ironicclient"
 ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"

From 841fdafa0bc542b595b267428c5d929bf0726205 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sun, 21 Jun 2015 10:08:22 -0500
Subject: [PATCH 1353/3333] Use path-mounted keystone when running in httpd

When running in httpd, keystone accepts requests on /identity and
/identity_v2_admin.

The path endpoints should be preferred over the ports so keystone
is configured to point applications to the path endpoints by
setting admin_endpoint and public_endpoint.

Change-Id: I34569b9e03c3f36748c92d803349e22a7ee1a633
---
 files/apache-keystone.template |  4 ++--
 lib/keystone                   | 31 ++++++++++++++++++++++++++-----
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 428544f25c..8a4b0f0c43 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -44,8 +44,8 @@ Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIPassAuthorization On
 </Location>
 
-Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
-<Location /identity_admin>
+Alias /identity_v2_admin %KEYSTONE_BIN%/keystone-wsgi-admin
+<Location /identity_v2_admin>
     SetHandler wsgi-script
     Options +ExecCGI
 
diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..1305623cb9 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -122,8 +122,14 @@ if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
 fi
 
 # complete URIs
-KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
-KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
+if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
+    # If running in Apache, use path access rather than port.
+    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_v2_admin
+    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
+else
+    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
+    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
+fi
 
 # V3 URIs
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
@@ -259,7 +265,15 @@ function configure_keystone {
         # Set the service ports for a proxy to take the originals
         service_port=$KEYSTONE_SERVICE_PORT_INT
         auth_port=$KEYSTONE_AUTH_PORT_INT
+    fi
 
+    # Override the endpoints advertised by keystone (the public_endpoint and
+    # admin_endpoint) so that clients use the correct endpoint. By default, the
+    # keystone server uses the public_port and admin_port which isn't going to
+    # work when you want to use a different port (in the case of proxy), or you
+    # don't want the port (in the case of putting keystone on a path in
+    # apache).
+    if is_service_enabled tls-proxy || [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
         iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
     fi
@@ -582,7 +596,14 @@ function start_keystone {
     # Check that the keystone service is running. Even if the tls tunnel
     # should be enabled, make sure the internal port is checked using
     # unencryted traffic at this point.
-    if ! wait_for_service $SERVICE_TIMEOUT $auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/; then
+    # If running in Apache, use the path rather than port.
+
+    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
+        service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
+    fi
+
+    if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
     fi
 
@@ -625,8 +646,8 @@ function bootstrap_keystone {
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
         --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
+        --bootstrap-public-url "$KEYSTONE_SERVICE_URI" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_URI"
 }
 
 # Restore xtrace

From d1c9198bbe0e90717a9e70c662b806841bc82564 Mon Sep 17 00:00:00 2001
From: Rabi Mishra <ramishra@redhat.com>
Date: Wed, 4 May 2016 16:09:47 +0530
Subject: [PATCH 1354/3333] Change the domain name in keystone.conf

As we are creating a domain with id 'default' and name
'Default', we should iniset the correct name.

Change-Id: If67338fbbd255b8aa1b91e18e4cf8213baebab95
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..3c003483f7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -334,7 +334,7 @@ function configure_keystone {
     # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
     # The users from this project are globally admin as before, but it also
     # allows policy changes in order to clarify the adminess scope.
-    iniset $KEYSTONE_CONF resource admin_project_domain_name default
+    iniset $KEYSTONE_CONF resource admin_project_domain_name Default
     iniset $KEYSTONE_CONF resource admin_project_name admin
 }
 

From 5069b8d8942ddd591d80586acd71bc6ee6de1262 Mon Sep 17 00:00:00 2001
From: pratik-gadiya <pgadiya@redhat.com>
Date: Wed, 4 May 2016 07:33:21 -0400
Subject: [PATCH 1355/3333] Added fix to install zookeeper for fedora

Partially Implements: #1513855

Change-Id: Ic302461f38d76183b75cc8de0a25fa84a8a8ff69
---
 lib/dlm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/dlm b/lib/dlm
index 74eb67ee8f..e391535910 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -93,6 +93,8 @@ function install_dlm {
     if is_dlm_enabled; then
         if is_ubuntu; then
             install_package zookeeperd
+        elif is_fedora; then
+            install_package zookeeper
         else
             die $LINENO "Don't know how to install zookeeper on this platform"
         fi

From b31640af5ef46e00e9cb0d2cffb22a043998eb31 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 2 May 2016 16:33:29 -0400
Subject: [PATCH 1356/3333] Handle common and seperate tempest tox venvs

In order to support the effort to unify the tox venvs being created
by tempest this commit temporarily cases the path of the venv being
created. Once tempest is updated to only use .tox/tempest we can
remove the if blocks and just use it unconditionally.

Change-Id: I34a69020eee07156e64026781a3c0bffdb5ab415
---
 lib/tempest | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6ba04f1680..3164de6638 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -594,8 +594,13 @@ function install_tempest {
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
-    $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-    PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    if [[ -d .tox/tempest ]] ; then
+        $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    else
+        $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    fi
     popd
 }
 

From 440464ccbbaf33e4687bd9fece5e1de64542f263 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 4 May 2016 11:55:12 -0400
Subject: [PATCH 1357/3333] Use common tempest tox venv and add plugin install
 variable

This commit adds a new variable to lib/tempest to provide the plugins
that should be installed into common tox venv that gets created. In
order to make this work the workarounds to handle migrating to a common
tox venv have to be removed otherwise the plugins could be installed in
a venv that isn't used.

Change-Id: I63658b8d8dfa999e0feb79f8f2968f2b32e3ff57
Depends-On: Iab2e6e04b6c5795a4d0c8214564106525b942308
---
 lib/tempest | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 3164de6638..2a99a13eef 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -64,6 +64,10 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 # have tempest installed in DevStack by default.
 INSTALL_TEMPEST=${INSTALL_TEMPEST:-"True"}
 
+# This variable is passed directly to pip install inside the common tox venv
+# that is created
+TEMPEST_PLUGINS=${TEMPEST_PLUGINS:-0}
+
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}
 TEMPEST_DEFAULT_VOLUME_VENDOR="Open Source"
@@ -519,17 +523,17 @@ function configure_tempest {
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
     if [[ "$OFFLINE" != "True" ]]; then
-        tox -revenv --notest
+        tox -revenv-tempest --notest
     fi
-    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
@@ -594,12 +598,10 @@ function install_tempest {
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
-    if [[ -d .tox/tempest ]] ; then
-        $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
-    else
-        $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    if [[ $TEMPEST_PLUGINS != 0 ]] ; then
+        tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
     fi
     popd
 }

From b1518427c63e1c8da87f87b8be4a0d517c574283 Mon Sep 17 00:00:00 2001
From: Bernd Mueller <mueller@b1-systems.de>
Date: Wed, 4 May 2016 22:30:08 +0200
Subject: [PATCH 1358/3333] removed dead link to stack.sh.html

the referenced file was removed with the following change
Ie7f4b265368f1d10a8908d75e11d625b2cc39e7c

Change-Id: I0e25b1f38e0969037d1c8af367432da56bb12e92
---
 doc/source/index.rst | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index c4a7c59fe5..68ec174f3a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,15 +63,12 @@ Quick Start
 
        devstack/tools/create-stack-user.sh; su stack
 
-#. Start the install
+#. Start the install, this will take a few minutes.
 
    ::
 
        cd devstack; ./stack.sh
 
-   It takes a few minutes, we recommend `reading the
-   script <stack.sh.html>`__ while it is building.
-
 Guides
 ======
 

From 655c22c77f21b360ba00b8c41b42fd0d0feec974 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 2 May 2016 13:29:10 -0400
Subject: [PATCH 1359/3333] Add an explicit test-config phase to devstack
 plugins

This commit adds a new phase to the devstack plugin interface for
configuring test environments. It runs after everything in devstack
(except for the final output commands) to ensure that tempest or
any other dependency is installed prior to running it.

Change-Id: I52128756f18d3857963a0687de77f7cdfd11fb3e
---
 doc/source/plugins.rst | 2 ++
 stack.sh               | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 83e5609efa..70469d6876 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,6 +99,8 @@ The current full list of ``mode`` and ``phase`` are:
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
       been started.
+   - **test-config** Called at the end of devstack used to configure tempest
+      or any other test environments
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut
    down.
diff --git a/stack.sh b/stack.sh
index 3de9af2725..0d5f16990f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1367,6 +1367,12 @@ if is_service_enabled cinder; then
     fi
 fi
 
+# Run test-config
+# ---------------
+
+# Phase: test-config
+run_phase stack test-config
+
 
 # Fin
 # ===

From b523f3108f3fccd5b728e4dfe6e3c044b11b7c18 Mon Sep 17 00:00:00 2001
From: Travis Tripp <travis.tripp@hpe.com>
Date: Thu, 5 May 2016 10:19:53 -0600
Subject: [PATCH 1360/3333] Update ElasticSearch version default to 1.7.5

Devstack installs elasticsearch version 1.4.2 by default.
This version is really out of date and you can't run kibana
4.x against it.  We are working towards 2.x support [0],
but in the meantime would like our example to install a more
recent version of ES.

[0] http://lists.openstack.org/pipermail/openstack-dev/2016-April/092583.html

Change-Id: I9ca244f8b817dd9c5f6d7435e347df28282db0a9
---
 pkg/elasticsearch.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 9c4f6f7801..856eaff36f 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -10,7 +10,7 @@ source $TOP_DIR/stackrc
 
 # Package source and version, all pkg files are expected to have
 # something like this, as well as a way to override them.
-ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.4.2}
+ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.7.5}
 ELASTICSEARCH_BASEURL=${ELASTICSEARCH_BASEURL:-https://download.elasticsearch.org/elasticsearch/elasticsearch}
 
 # Elastic search actual implementation

From daa7a41e219f435006f412e4ff45d93cf4c4827d Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 5 May 2016 12:50:52 -0700
Subject: [PATCH 1361/3333] Export the 'short_source' function & don't keep PS4
 in sudo

Export the 'short_source' function so that it will be present in the
environment for child shell scripts. Do this because we are passing PS4
to the child shell scripts and it is using 'short_source'

Don't do an 'env_keep' in the sudoers file for PS4, since it is
difficult to also pass along the 'short_source' function.

Change-Id: I9781010d6eb336d02939c7fd47f18bedeae5ccc6
Closes-Bug: #1563443
---
 functions              | 3 +++
 stack.sh               | 1 -
 tools/create_userrc.sh | 3 +++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 1bfb8a5078..d2609622b2 100644
--- a/functions
+++ b/functions
@@ -41,6 +41,9 @@ function short_source {
     file=${file#$RC_DIR/}
     printf "%-40s " "$file:${called[1]}:${called[0]}"
 }
+# PS4 is exported to child shells and uses the 'short_source' function, so
+# export it so child shells have access to the 'short_source' function also.
+export -f short_source
 
 
 # Retrieve an image from a URL and upload into Glance.
diff --git a/stack.sh b/stack.sh
index 3de9af2725..87f85dbb1b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -240,7 +240,6 @@ echo "$STACK_USER ALL=(root) NOPASSWD:ALL" >$TEMPFILE
 # see them by forcing ``PATH``
 echo "Defaults:$STACK_USER secure_path=/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >> $TEMPFILE
 echo "Defaults:$STACK_USER !requiretty" >> $TEMPFILE
-echo "Defaults env_keep += PS4" >> $TEMPFILE
 chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index a7278e47b3..b6db5d11aa 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -22,6 +22,9 @@ function short_source {
     file=${file#$RC_DIR/}
     printf "%-40s " "$file:${called[1]}:${called[0]}"
 }
+# PS4 is exported to child shells and uses the 'short_source' function, so
+# export it so child shells have access to the 'short_source' function also.
+export -f short_source
 
 set -o xtrace
 

From 3feceb0e4a2e9527be0d5e51ff317851417654d4 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Sun, 17 Apr 2016 11:11:58 -0400
Subject: [PATCH 1362/3333] Support decompressing bz2 image

CoreOS cloud image is compressed with bz2 extension [1]. In such
case, we need to decompress the image before uploading it to glance.

[1] https://coreos.com/os/docs/latest/booting-on-openstack.html

Change-Id: I705d0813d180aefaa2507c00d1ae40af07d12fcf
---
 functions | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/functions b/functions
index 0942f17009..ea737deee8 100644
--- a/functions
+++ b/functions
@@ -295,6 +295,12 @@ function upload_image {
             container_format=bare
             unpack=zcat
             ;;
+        *.img.bz2)
+            image_name=$(basename "$image" ".img.bz2")
+            disk_format=qcow2
+            container_format=bare
+            unpack=bunzip2
+            ;;
         *.qcow2)
             image_name=$(basename "$image" ".qcow2")
             disk_format=qcow2
@@ -328,6 +334,8 @@ function upload_image {
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+        elif [ "$unpack" = "bunzip2" ]; then
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(bunzip2 -cdk "${image}")
         else
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi

From 4f55c2d5c384f576e45f4310595e262039fd8175 Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Wed, 4 May 2016 08:14:01 +0000
Subject: [PATCH 1363/3333] Set config file to db sync and other manage
 operation

Currently, the db sync operation does not specify the config dir or
config file.
If there is a config file in the home path, it will use this one,
but not the right one devstack write.

Set config file to these operations.

Change-Id: Id1fbc3d85280c19596f5ebd301c46bcf018fa2f6
Closes-Bug: #1578098
---
 lib/cinder   | 2 +-
 lib/glance   | 4 ++--
 lib/heat     | 2 +-
 lib/keystone | 6 +++---
 lib/nova     | 6 +++---
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..daeb94a839 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -415,7 +415,7 @@ function init_cinder {
         recreate_database cinder
 
         # Migrate cinder database
-        $CINDER_BIN_DIR/cinder-manage db sync
+        $CINDER_BIN_DIR/cinder-manage --config-file $CINDER_CONF db sync
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
diff --git a/lib/glance b/lib/glance
index cda357fa66..887a14d7ed 100644
--- a/lib/glance
+++ b/lib/glance
@@ -334,10 +334,10 @@ function init_glance {
     recreate_database glance
 
     # Migrate glance database
-    $GLANCE_BIN_DIR/glance-manage db_sync
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
     # Load metadata definitions
-    $GLANCE_BIN_DIR/glance-manage db_load_metadefs
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
 
     create_glance_cache_dir
 }
diff --git a/lib/heat b/lib/heat
index 4326321bd1..730adada26 100644
--- a/lib/heat
+++ b/lib/heat
@@ -241,7 +241,7 @@ function init_heat {
     # (re)create heat database
     recreate_database heat
 
-    $HEAT_BIN_DIR/heat-manage db_sync
+    $HEAT_BIN_DIR/heat-manage --config-file $HEAT_CONF db_sync
     create_heat_cache_dir
 }
 
diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..6a202e518c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -489,16 +489,16 @@ function init_keystone {
     recreate_database keystone
 
     # Initialize keystone database
-    $KEYSTONE_BIN_DIR/keystone-manage db_sync
+    $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl
-        $KEYSTONE_BIN_DIR/keystone-manage pki_setup
+        $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF pki_setup
     fi
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "fernet" ]]; then
         rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
-        $KEYSTONE_BIN_DIR/keystone-manage fernet_setup
+        $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF fernet_setup
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..7f64016dca 100644
--- a/lib/nova
+++ b/lib/nova
@@ -702,18 +702,18 @@ function init_nova {
         recreate_database nova
 
         # Migrate nova database
-        $NOVA_BIN_DIR/nova-manage db sync
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
 
         recreate_database $NOVA_API_DB
-        $NOVA_BIN_DIR/nova-manage api_db sync
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
         # Run online migrations on the new databases
         # Needed for flavor conversion
-        $NOVA_BIN_DIR/nova-manage db online_data_migrations
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
     fi
 
     create_nova_cache_dir

From 6ba17f7d014aa50643a8920ee092424051d78c08 Mon Sep 17 00:00:00 2001
From: "yan.haifeng" <yanheven@qq.com>
Date: Fri, 29 Apr 2016 15:59:56 +0800
Subject: [PATCH 1364/3333] Fix ovs-vsctl executed in worlddump.py failed issue

add sudo before ovs-vsctl command.

Change-Id: I1a7dd9504da766beb452bd749e325931678de64e
Closes-Bug: #1576560
---
 tools/worlddump.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 238a23dab8..e1ef544a55 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -88,7 +88,8 @@ def _header(name):
 
 
 def _bridge_list():
-    process = subprocess.Popen(['ovs-vsctl', 'list-br'], stdout=subprocess.PIPE)
+    process = subprocess.Popen(['sudo', 'ovs-vsctl', 'list-br'],
+                               stdout=subprocess.PIPE)
     stdout, _ = process.communicate()
     return stdout.split()
 

From db01ca6d163f01ad9622da9ab0a60203fee51acc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 May 2016 13:19:09 +1000
Subject: [PATCH 1365/3333] Fix return code detection in plugin list generation

As can be seen in logs of the periodic generation job, our cgit does a
weird thing where sometimes it returns a 404 page with content, and
sometimes a zero response (see [1] for example, the last number is
response size).  This appears to be an openstack CI issue; possibly
due to cgit caching or similar (see [2] for manual test).  It will
have to be investigated with the host apache logs.

This is resulting in a lot of projects incorrectly being picked up as
having plugins (I7116571d2a2b1fc3a61e5f1ed46ac2cbc244775a).  I'm not
sure if this problem is also releated to the original status-code
issues mentioned in the code, but testing shows that cgit is correctly
returning 404's for missing files (you can see in the logs [1]).  Thus
switch the logic to examine the return code which avoids this issue.

[1] http://logs.openstack.org/periodic/propose-devstack-plugins-list/e55790c/console.html.gz#_2016-05-04_06_46_51_660
[2] http://paste.openstack.org/show/496434/

Change-Id: I6a06347d91d091441f6f7b70f99aba6d8e9add4b
---
 tools/generate-devstack-plugins-list.py | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 089a6ef93e..bbad1bf502 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -44,16 +44,10 @@ def is_in_openstack_namespace(proj):
     # stackforge, etc)
     return proj.startswith('openstack/')
 
-# Rather than returning a 404 for a nonexistent file, cgit delivers a
-# 0-byte response to a GET request.  It also does not provide a
-# Content-Length in a HEAD response, so the way we tell if a file exists
-# is to check the length of the entire GET response body.
+# Check if this project has a plugin file
 def has_devstack_plugin(proj):
     r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
-    if len(r.text) > 0:
-        return True
-    else:
-        return False
+    return r.status_code == 200
 
 logging.debug("Getting project list from %s" % url)
 r = requests.get(url)

From 3b79e5f9f76fb1b86731e1053c3749a84f43ebd7 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <divius.inside@gmail.com>
Date: Mon, 9 May 2016 09:36:04 +0000
Subject: [PATCH 1366/3333] Revert "Update auth params in Nova
 Hypervisor-Ironic"

This seems to break Ironic gate with n-cpu not starting
any more.

This reverts commit c527ded91bef5d4c56cbdb2402a4d68015364b37.

Change-Id: Idfb01448e8ecf53fbd2e1df61c8f08f3107981ac
Closes-Bug: #1579683
---
 lib/nova_plugins/hypervisor-ironic | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 7224fe3f42..43e7797371 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,12 +45,10 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
-    iniset $NOVA_CONF ironic username admin
-    iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
-    iniset $NOVA_CONF ironic project_domain_id default
-    iniset $NOVA_CONF ironic user_domain_id default
-    iniset $NOVA_CONF ironic project_name demo
+    iniset $NOVA_CONF ironic admin_username admin
+    iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
+    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $NOVA_CONF ironic admin_tenant_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
 

From 2a242519f71e86416e78541826cac2b54fcd04a5 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 3 May 2016 09:03:09 -0400
Subject: [PATCH 1367/3333] Begin new lib/neutron

Background for this work can be read on the mailing list:

http://lists.openstack.org/pipermail/openstack-dev/2016-May/094063.html

Usage of the new Neutron is by setting the following in
ENABLED_SERVICES:

* neutron-api
* neutron-l3
* neutron-agent
* neutron-dhcp
* neutron-metadata-agent

For now, the new neutron library supports just the ML2 plugin, with the
Open vSwitch and Linux Bridge agents supported. All other Neutron
plugins should be creating their own DevStack plugin if they wish for
DevStack to support them. Many of them already do.

Other notable changes compared to neutron-legacy:

* Rely on the Neutron defaults, and force Neutron to make
  sane defaults instead of all kinds of knobs in DevStack.

* Default to rootwrap daemon support

* Use the security group driver by default

* interface_driver can now use NEUTRON_AGENT (linuxbridge, openvswitch), since
  they are entrypoints in neutron's setup.cfg

* Use NEUTRON_AGENT variable to determine which agent to run
  Works with NEUTRON_AGENT set to either "linuxbridge" or "openvswitch"
  Default is openvswitch for the time being.

* Set ML2 configuration for VXLAN support

* Remove Xen hypervisor stuff - it should be a plugin

* Move L3 crud into separate service file:

  There's a lot of L3 configuration that was in the main neutron file, but
  a lot of it is self contained and can be moved into its own file.

  The new l3 service file will contain all the previous L3 plumbing and
  configuration that the OpenStack Gate expects, while also eventually
  moving the whole l3 network creation step into a single hook that can be
  overridden by plugins.

* Introduce a check for a function "neutron_plugin_create_initial_networks" which
  will become the mechanism through which different topologies, and
  networking plugins can create and wire the initial networks that are
  created during a stack.sh run.

The new lib/neutron is considered experimental, and followup patches
will build upon this one. Existing users of lib/neutron-legacy should
remain unharmed.

Co-Authored-By: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Co-Authored-By: Dean Troyer <dtroyer@gmail.com>
Change-Id: I31b6362c6d9992f425f2dedbbeff2568390a93da
---
 clean.sh                              |   1 +
 exercises/boot_from_volume.sh         |   1 +
 exercises/floating_ips.sh             |   1 +
 exercises/neutron-adv-test.sh         |   1 +
 exercises/volumes.sh                  |   1 +
 lib/neutron                           | 556 ++++++++++++++++++++++++++
 lib/neutron-legacy                    | 427 ++------------------
 lib/neutron_plugins/linuxbridge_agent |   8 +-
 lib/neutron_plugins/openvswitch_agent |   6 +-
 lib/neutron_plugins/services/l3       | 366 +++++++++++++++++
 lib/template                          |   9 +-
 stack.sh                              |  14 +-
 unstack.sh                            |   1 +
 13 files changed, 977 insertions(+), 415 deletions(-)
 create mode 100644 lib/neutron
 create mode 100644 lib/neutron_plugins/services/l3

diff --git a/clean.sh b/clean.sh
index 1176134da6..0641bffcf8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -49,6 +49,7 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 set -o xtrace
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index 54098594ff..84ac08f017 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -32,6 +32,7 @@ source $TOP_DIR/functions
 
 # Import project functions
 source $TOP_DIR/lib/cinder
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # Import configuration
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
index 4b72a0073f..485208ba30 100755
--- a/exercises/floating_ips.sh
+++ b/exercises/floating_ips.sh
@@ -31,6 +31,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/openrc
 
 # Import project functions
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # Import exercise configuration
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a3128a8d71..81150061ca 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -37,6 +37,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/openrc
 
 # Import neutron functions
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # If neutron is not enabled we exit with exitcode 55, which means exercise is skipped.
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index f95c81fdf1..0de1226fee 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -32,6 +32,7 @@ source $TOP_DIR/openrc
 
 # Import project functions
 source $TOP_DIR/lib/cinder
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # Import exercise configuration
diff --git a/lib/neutron b/lib/neutron
new file mode 100644
index 0000000000..51c3a006c7
--- /dev/null
+++ b/lib/neutron
@@ -0,0 +1,556 @@
+#!/bin/bash
+#
+# lib/neutron
+# Install and start **Neutron** network services
+
+# Dependencies:
+#
+# ``functions`` file
+# ``DEST`` must be defined
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - is_XXXX_enabled
+# - install_XXXX
+# - configure_XXXX
+# - init_XXXX
+# - start_XXXX
+# - stop_XXXX
+# - cleanup_XXXX
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+# Set up default directories
+GITDIR["python-neutronclient"]=$DEST/python-neutronclient
+
+NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
+NEUTRON_DIR=$DEST/neutron
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
+
+NEUTRON_BIN_DIR=$(get_python_exec_prefix)
+NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
+
+NEUTRON_CONF_DIR=/etc/neutron
+NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
+NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
+
+NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
+NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
+NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
+
+NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
+
+# By default, use the ML2 plugin
+NEUTRON_PLUGIN=${NEUTRON_PLUGIN:-ml2}
+NEUTRON_PLUGIN_CONF_FILENAME=${NEUTRON_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
+NEUTRON_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_PLUGIN
+NEUTRON_PLUGIN_CONF=$NEUTRON_PLUGIN_CONF_PATH/$NEUTRON_PLUGIN_CONF_FILENAME
+
+NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
+NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
+NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
+
+# Public facing bits
+if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+    NEUTRON_SERVICE_PROTOCOL="https"
+fi
+NEUTRON_SERVICE_HOST=${NEUTRON_SERVICE_HOST:-$SERVICE_HOST}
+NEUTRON_SERVICE_PORT=${NEUTRON_SERVICE_PORT:-9696}
+NEUTRON_SERVICE_PORT_INT=${NEUTRON_SERVICE_PORT_INT:-19696}
+NEUTRON_SERVICE_PROTOCOL=${NEUTRON_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+
+NEUTRON_AUTH_STRATEGY=${NEUTRON_AUTH_STRATEGY:-keystone}
+NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
+NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
+NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
+
+# Add all enabled config files to a single config arg
+NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
+
+# Functions
+# ---------
+
+# Test if any Neutron services are enabled
+# is_neutron_enabled
+function is_neutron_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"neutron-" || ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
+    return 1
+}
+
+# Test if any Neutron services are enabled
+# is_neutron_enabled
+function is_neutron_legacy_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
+    return 1
+}
+
+# cleanup_neutron() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_neutron_new {
+    source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
+    if is_neutron_ovs_base_plugin; then
+        neutron_ovs_base_cleanup
+    fi
+
+    if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
+        neutron_lb_cleanup
+    fi
+    # delete all namespaces created by neutron
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+        sudo ip netns delete ${ns}
+    done
+}
+
+# configure_neutron() - Set config files, create data dirs, etc
+function configure_neutron_new {
+    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+
+    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
+
+    configure_neutron_rootwrap
+
+    mkdir -p $NEUTRON_PLUGIN_CONF_PATH
+
+    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_PLUGIN/$NEUTRON_PLUGIN_CONF_FILENAME.sample $NEUTRON_PLUGIN_CONF
+
+    iniset $NEUTRON_CONF database connection `database_connection_url neutron`
+    iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH
+    iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
+    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
+
+    # Neutron API server & Neutron plugin
+    if is_service_enabled neutron-api; then
+        local policy_file=$NEUTRON_CONF_DIR/policy.json
+        cp $NEUTRON_DIR/etc/policy.json $policy_file
+        # Allow neutron user to administer neutron to match neutron account
+        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
+
+        cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
+
+        iniset $NEUTRON_CONF DEFAULT core_plugin ml2
+
+        iniset $NEUTRON_CONF DEFAULT verbose True
+        iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
+        iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
+
+        iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
+        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
+
+        # Configuration for neutron notifations to nova.
+        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
+        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
+
+        iniset $NEUTRON_CONF nova auth_type password
+        iniset $NEUTRON_CONF nova auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+        iniset $NEUTRON_CONF nova username nova
+        iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
+        iniset $NEUTRON_CONF nova user_domain_id default
+        iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
+        iniset $NEUTRON_CONF nova project_domain_id default
+        iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
+        # Configure VXLAN
+        # TODO(sc68cal) not hardcode?
+        iniset $NEUTRON_PLUGIN_CONF ml2 tenant_network_types vxlan
+        iniset $NEUTRON_PLUGIN_CONF ml2 type_drivers vxlan
+        iniset $NEUTRON_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
+        iniset $NEUTRON_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+    fi
+
+    # Neutron OVS or LB agent
+    if is_service_enabled neutron-agent; then
+        iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
+
+        # Configure the neutron agent
+        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
+            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables
+            iniset $NEUTRON_PLUGIN_CONF vxlan local_ip $HOST_IP
+        else
+            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables_hybrid
+            iniset $NEUTRON_PLUGIN_CONF ovs local_ip $HOST_IP
+        fi
+    fi
+
+    # DHCP Agent
+    if is_service_enabled neutron-dhcp; then
+        cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
+
+        iniset $NEUTRON_DHCP_CONF DEFAULT verbose True
+        iniset $NEUTRON_DHCP_CONF DEFAULT debug True
+        iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
+        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
+    fi
+
+    if is_service_enabled neutron-l3; then
+        cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
+        iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
+        iniset $NEUTRON_CONF DEFAULT service_plugins router
+        iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        iniset $NEUTRON_L3_CONF DEFAULT debug True
+        iniset $NEUTRON_L3_CONF DEFAULT verbose True
+        neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
+    fi
+
+    # Metadata
+    if is_service_enabled neutron-meta; then
+        cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
+
+        iniset $NEUTRON_META_CONF DEFAULT verbose True
+        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
+        iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+
+        # TODO(dtroyer): remove the v2.0 hard code below
+        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI/v2.0
+        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
+    fi
+
+    # Format logging
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
+    else
+        # Show user_name and project_name by default
+        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+    fi
+
+    if is_service_enabled tls-proxy; then
+        # Set the service port for a proxy to take the original
+        iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
+    fi
+
+    if is_ssl_enabled_service "nova"; then
+        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
+    fi
+
+    if is_ssl_enabled_service "neutron"; then
+        ensure_certificates NEUTRON
+
+        iniset $NEUTRON_CONF DEFAULT use_ssl True
+        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
+        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
+    fi
+
+}
+
+# configure_neutron_rootwrap() - configure Neutron's rootwrap
+function configure_neutron_rootwrap {
+    # Set the paths of certain binaries
+    neutron_rootwrap=$(get_rootwrap_location neutron)
+
+    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
+    local rootwrap_sudoer_cmd="${neutron_rootwrap} $NEUTRON_CONF_DIR/rootwrap.conf"
+
+    # Deploy new rootwrap filters files (owned by root).
+    # Wipe any existing rootwrap.d files first
+    if [[ -d $NEUTRON_CONF_DIR/rootwrap.d ]]; then
+        sudo rm -rf $NEUTRON_CONF_DIR/rootwrap.d
+    fi
+
+    # Deploy filters to /etc/neutron/rootwrap.d
+    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
+    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
+
+    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
+    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $NEUTRON_CONF_DIR
+    sudo sed -e "s:^filters_path=.*$:filters_path=$NEUTRON_CONF_DIR/rootwrap.d:" -i $NEUTRON_CONF_DIR/rootwrap.conf
+
+    # Set up the rootwrap sudoers for Neutron
+    tempfile=`mktemp`
+    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd *" >$tempfile
+    chmod 0440 $tempfile
+    sudo chown root:root $tempfile
+    sudo mv $tempfile /etc/sudoers.d/neutron-rootwrap
+}
+
+# Make Neutron-required changes to nova.conf
+function configure_neutron_nova_new {
+    iniset $NOVA_CONF DEFAULT use_neutron True
+    iniset $NOVA_CONF neutron auth_type "password"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron username neutron
+    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF neutron user_domain_name "Default"
+    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF neutron project_domain_name "Default"
+    iniset $NOVA_CONF neutron auth_strategy $NEUTRON_AUTH_STRATEGY
+    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
+    iniset $NOVA_CONF neutron url $NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT
+
+    iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
+
+    if is_service_enabled neutron-meta; then
+        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+    fi
+
+}
+
+# Tenant               User       Roles
+# ------------------------------------------------------------------
+# service              neutron    admin        # if enabled
+
+# create_neutron_accounts() - Create required service accounts
+function create_neutron_accounts_new {
+    if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
+
+        create_service_user "neutron"
+
+        neutron_service=$(get_or_create_service "neutron" \
+            "network" "Neutron Service")
+        get_or_create_endpoint $neutron_service \
+            "$REGION_NAME" \
+            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
+            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
+            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/"
+    fi
+}
+
+# create_neutron_cache_dir() - Part of the init_neutron() process
+function create_neutron_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
+    rm -f $NEUTRON_AUTH_CACHE_DIR/*
+}
+
+# init_neutron() - Initialize databases, etc.
+function init_neutron_new {
+
+    recreate_database neutron
+
+    # Run Neutron db migrations
+    $NEUTRON_BIN_DIR/neutron-db-manage $NEUTRON_CONFIG_ARG upgrade heads
+
+    create_neutron_cache_dir
+}
+
+# install_neutron() - Collect source and prepare
+function install_neutron_new {
+    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
+    setup_develop $NEUTRON_DIR
+
+    # Install neutron-lib from git so we make sure we're testing
+    # the latest code.
+    if use_library_from_git "neutron-lib"; then
+        git_clone_by_name "neutron-lib"
+        setup_dev_lib "neutron-lib"
+    fi
+
+    # L3 service requires radvd
+    if is_service_enabled neutron-l3; then
+        install_package radvd
+    fi
+
+    if is_service_enabled neutron-agent neutron-dhcp neutron-l3; then
+        #TODO(sc68cal) - kind of ugly
+        source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
+        neutron_plugin_install_agent_packages
+    fi
+
+}
+
+# install_neutronclient() - Collect source and prepare
+function install_neutronclient {
+    if use_library_from_git "python-neutronclient"; then
+        git_clone_by_name "python-neutronclient"
+        setup_dev_lib "python-neutronclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
+    fi
+}
+
+# start_neutron_api() - Start the API process ahead of other things
+function start_neutron_api {
+    local service_port=$NEUTRON_SERVICE_PORT
+    local service_protocol=$NEUTRON_SERVICE_PROTOCOL
+    if is_service_enabled tls-proxy; then
+        service_port=$NEUTRON_SERVICE_PORT_INT
+        service_protocol="http"
+    fi
+
+    # Start the Neutron service
+    # TODO(sc68cal) Stop hard coding this
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_PLUGIN_CONF"
+
+    if is_ssl_enabled_service "neutron"; then
+        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
+        local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$NEUTRON_SERVICE_HOST:$service_port"
+        test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
+    else
+        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
+            die $LINENO "neutron-api did not start"
+        fi
+    fi
+
+
+    # Start proxy if enabled
+    if is_service_enabled tls-proxy; then
+        start_tls_proxy '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT &
+    fi
+}
+
+# start_neutron() - Start running processes, including screen
+function start_neutron_new {
+    _set_config_files
+
+    # Start up the neutron agents if enabled
+    # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
+    # can resolve the $NEUTRON_AGENT_BINARY
+    if is_service_enabled neutron-agent; then
+        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY $NEUTRON_CONFIG_ARG"
+    fi
+    if is_service_enabled neutron-dhcp; then
+        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
+        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY $NEUTRON_CONFIG_ARG"
+    fi
+    if is_service_enabled neutron-l3; then
+        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
+        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
+        # of the code in lib/neutron_plugins/services/l3
+        if type -p neutron_plugin_create_initial_networks > /dev/null; then
+            neutron_plugin_create_initial_networks
+        else
+            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
+            source $TOP_DIR/lib/neutron_plugins/services/l3
+            # Create the networks using servic
+            create_neutron_initial_network
+        fi
+    fi
+    if is_service_enabled neutron-meta; then
+        run_process neutron-meta "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
+    fi
+}
+
+# stop_neutron() - Stop running processes (non-screen)
+function stop_neutron_new {
+    for serv in neutron-api neutron-agent neutron-l3; do
+        stop_process $serv
+    done
+
+    if is_service_enabled neutron-dhcp; then
+        stop_process neutron-dhcp
+        pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
+        [ ! -z "$pid" ] && sudo kill -9 $pid
+    fi
+
+    if is_service_enabled neutron-meta; then
+        sudo pkill -9 -f neutron-ns-metadata-proxy || :
+        stop_process neutron-meta
+    fi
+}
+
+# Compile the lost of enabled config files
+function _set_config_files {
+
+    #TODO(sc68cal) - see if we can clean up this and only
+    # pass in config files that make sense for certain agents
+    if is_service_enabled neutron-api; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
+    fi
+
+    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_PLUGIN_CONF (ml2_conf.ini) but others may not
+    if is_service_enabled neutron-agent; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_PLUGIN_CONF"
+    fi
+
+    if is_service_enabled neutron-dhcp; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_DHCP_CONF"
+    fi
+
+    if is_service_enabled neutron-l3; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_L3_CONF"
+    fi
+
+    if is_service_enabled neutron-meta; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_META_CONF"
+    fi
+
+}
+
+# Dispatch functions
+# These are needed for compatibility between the old and new implementations
+# where there are function name overlaps.  These will be removed when
+# neutron-legacy is removed.
+# TODO(sc68cal) Remove when neutron-legacy is no more.
+function cleanup_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        cleanup_mutnauq "$@"
+    else
+        cleanup_neutron_new "$@"
+    fi
+}
+
+function configure_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        configure_mutnauq "$@"
+    else
+        configure_neutron_new "$@"
+    fi
+}
+
+function configure_neutron_nova {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        create_nova_conf_neutron "$@"
+    else
+        configure_neutron_nova_new "$@"
+    fi
+}
+
+function create_neutron_accounts {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        create_mutnauq_accounts "$@"
+    else
+        create_neutron_accounts_new "$@"
+    fi
+}
+
+function init_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        init_mutnauq "$@"
+    else
+        init_neutron_new "$@"
+    fi
+}
+
+function install_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        install_mutnauq "$@"
+    else
+        install_neutron_new "$@"
+    fi
+}
+
+function start_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        start_mutnauq_l2_agent "$@"
+        start_mutnauq_other_agents "$@"
+    else
+        start_neutron_new "$@"
+    fi
+}
+
+function stop_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        stop_mutnauq "$@"
+    else
+        stop_neutron_new "$@"
+    fi
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4aa63890bd..7ebc2e2b3c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -61,45 +61,12 @@
 # Neutron Network Configuration
 # -----------------------------
 
-# Subnet IP version
-IP_VERSION=${IP_VERSION:-"4+6"}
-# Validate IP_VERSION
-if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
-    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
-fi
-# Gateway and subnet defaults, in case they are not customized in localrc
-NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
-PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
-PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
-PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
-
-# Subnetpool defaults
-SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
-
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
-SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
-
-SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
-SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
-# Generate 40-bit IPv6 Global ID to comply with RFC 4193
-IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
-
-# IPv6 gateway and subnet defaults, in case they are not customized in localrc
-IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
-IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
-IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
-IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
-IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
-IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
-IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
-IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
 
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
@@ -171,56 +138,6 @@ Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
-# Specify if the initial private and external networks should be created
-NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
-
-## Provider Network Information
-PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
-IPV6_PROVIDER_SUBNET_NAME=${IPV6_PROVIDER_SUBNET_NAME:-"provider_net_v6"}
-IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
-IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
-
-# Define the public bridge that will transmit traffic from VMs to the
-# physical network - used by both the OVS and Linux Bridge drivers.
-PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
-
-# Use flat providernet for public network
-#
-# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
-# for external interface of neutron l3-agent.  In that case,
-# PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
-# used for the network.  In case of ofagent, you should add the
-# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
-# For openvswitch agent, you should add the corresponding entry to
-# your OVS_BRIDGE_MAPPINGS.
-#
-# eg.  (ofagent)
-#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-#    Q_USE_PUBLIC_VETH=True
-#    PUBLIC_PHYSICAL_NETWORK=public
-#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
-#
-# eg.  (openvswitch agent)
-#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-#    PUBLIC_PHYSICAL_NETWORK=public
-#    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
-PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
-
-# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
-# PUBLIC_BRIDGE.  This is intended to be used with
-# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
-Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
-Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
-Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
-
-# The next two variables are configured by plugin
-# e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
-#
-# The plugin supports L3.
-Q_L3_ENABLED=${Q_L3_ENABLED:-False}
-# L3 routers exist per tenant
-Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 # List of config file names in addition to the main plugin config file
 # See _configure_neutron_common() for details about setting it up
@@ -354,6 +271,9 @@ source $TOP_DIR/lib/neutron_plugins/services/metering
 # ---------------------------------
 source $TOP_DIR/lib/neutron_plugins/services/firewall
 
+# L3 Service functions
+source $TOP_DIR/lib/neutron_plugins/services/l3
+
 # Use security group or not
 if has_neutron_plugin_security_group; then
     Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
@@ -400,16 +320,9 @@ function determine_config_files {
     echo "$opts"
 }
 
-# Test if any Neutron services are enabled
-# is_neutron_enabled
-function is_neutron_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
-    return 1
-}
-
-# configure_neutron()
+# configure_mutnauq()
 # Set common config for all neutron server and agents.
-function configure_neutron {
+function configure_mutnauq {
     _configure_neutron_common
     iniset_rpc_backend neutron $NEUTRON_CONF
 
@@ -482,21 +395,14 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
 }
 
-# create_neutron_cache_dir() - Part of the _neutron_setup_keystone() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
-# create_neutron_accounts() - Set up common required neutron accounts
+# create_mutnauq_accounts() - Set up common required neutron accounts
 
 # Tenant               User       Roles
 # ------------------------------------------------------------------
 # service              neutron    admin        # if enabled
 
 # Migrated from keystone_data.sh
-function create_neutron_accounts {
+function create_mutnauq_accounts {
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
         create_service_user "neutron"
@@ -511,107 +417,15 @@ function create_neutron_accounts {
     fi
 }
 
-function create_neutron_initial_network {
-    local project_id
-    project_id=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
-
-    # Allow drivers that need to create an initial network to do so here
-    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
-        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
-    fi
-
-    if is_provider_network; then
-        die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
-        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
-        fi
-
-        if [[ $Q_AGENT == "openvswitch" ]]; then
-            sudo ip link set $OVS_PHYSICAL_BRIDGE up
-            sudo ip link set br-int up
-            sudo ip link set $PUBLIC_INTERFACE up
-        fi
-    else
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
-        fi
-    fi
-
-    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
-    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
-    if [[ "$Q_L3_ENABLED" == "True" ]]; then
-        # Create a router, and add the private subnet as one of its interfaces
-        if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
-            # create a tenant-owned router.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
-        else
-            # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
-        fi
-
-        # if the extension is available, then mark the external
-        # network as default, and provision default subnetpools
-        EXTERNAL_NETWORK_FLAGS="--router:external"
-        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
-            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
-            if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
-            if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
-        fi
-        # Create an external network, and a subnet. Configure the external network as router gw
-        if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
-        else
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
-        fi
-        die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            # Configure router for IPv4 public access
-            _neutron_configure_router_v4
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            # Configure router for IPv6 public access
-            _neutron_configure_router_v6
-        fi
-    fi
-}
-
-# init_neutron() - Initialize databases, etc.
-function init_neutron {
+# init_mutnauq() - Initialize databases, etc.
+function init_mutnauq {
     recreate_database $Q_DB_NAME
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
 }
 
-# install_neutron() - Collect source and prepare
-function install_neutron {
+# install_mutnauq() - Collect source and prepare
+function install_mutnauq {
     # Install neutron-lib from git so we make sure we're testing
     # the latest code.
     if use_library_from_git "neutron-lib"; then
@@ -649,15 +463,6 @@ function install_neutron {
     fi
 }
 
-# install_neutronclient() - Collect source and prepare
-function install_neutronclient {
-    if use_library_from_git "python-neutronclient"; then
-        git_clone_by_name "python-neutronclient"
-        setup_dev_lib "python-neutronclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
-    fi
-}
-
 # install_neutron_agent_packages() - Collect source and prepare
 function install_neutron_agent_packages {
     # radvd doesn't come with the OS. Install it if the l3 service is enabled.
@@ -704,7 +509,7 @@ function start_neutron_service_and_check {
 
 # Control of the l2 agent is separated out to make it easier to test partial
 # upgrades (everything upgraded except the L2 agent)
-function start_neutron_l2_agent {
+function start_mutnauq_l2_agent {
     run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
 
     if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
@@ -722,7 +527,7 @@ function start_neutron_l2_agent {
     fi
 }
 
-function start_neutron_other_agents {
+function start_mutnauq_other_agents {
     run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
     if is_service_enabled neutron-vpnaas; then
@@ -744,15 +549,16 @@ function start_neutron_other_agents {
 # Start running processes, including screen
 function start_neutron_agents {
     # Start up the neutron agents if enabled
-    start_neutron_l2_agent
-    start_neutron_other_agents
+    start_mutnauq_l2_agent
+    start_mutnauq_other_agents
 }
 
-function stop_neutron_l2_agent {
+function stop_mutnauq_l2_agent {
     stop_process q-agt
 }
 
-function stop_neutron_other {
+# stop_mutnauq_other() - Stop running processes (non-screen)
+function stop_mutnauq_other {
     if is_service_enabled q-dhcp; then
         stop_process q-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
@@ -787,9 +593,9 @@ function stop_neutron_other {
 }
 
 # stop_neutron() - Stop running processes (non-screen)
-function stop_neutron {
-    stop_neutron_other
-    stop_neutron_l2_agent
+function stop_mutnauq {
+    stop_mutnauq_other
+    stop_mutnauq_l2_agent
 }
 
 # _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
@@ -842,9 +648,9 @@ function _move_neutron_addresses_route {
     fi
 }
 
-# cleanup_neutron() - Remove residual data files, anything left over from previous
+# cleanup_mutnauq() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
-function cleanup_neutron {
+function cleanup_mutnauq {
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
@@ -1031,27 +837,6 @@ function _configure_neutron_dhcp_agent {
     neutron_plugin_configure_dhcp_agent
 }
 
-function _configure_neutron_l3_agent {
-    Q_L3_ENABLED=True
-
-    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
-
-    iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    _neutron_setup_interface_driver $Q_L3_CONF_FILE
-
-    neutron_plugin_configure_l3_agent
-
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
-    fi
-}
 
 function _configure_neutron_metadata_agent {
     cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
@@ -1226,164 +1011,6 @@ function _neutron_setup_interface_driver {
 
     neutron_plugin_setup_interface_driver $1
 }
-
-# Create private IPv4 subnet
-function _neutron_create_private_subnet_v4 {
-    local project_id=$1
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 4 "
-    subnet_params+="--gateway $NETWORK_GATEWAY "
-    subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE"
-    local subnet_id
-    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
-    echo $subnet_id
-}
-
-# Create private IPv6 subnet
-function _neutron_create_private_subnet_v6 {
-    local project_id=$1
-    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
-    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
-    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
-    local ipv6_subnet_id
-    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
-    echo $ipv6_subnet_id
-}
-
-# Create public IPv4 subnet
-function _neutron_create_public_subnet_v4 {
-    local subnet_params+="--ip_version 4 "
-    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
-    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
-    local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
-    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
-    echo $id_and_ext_gw_ip
-}
-
-# Create public IPv6 subnet
-function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
-    local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
-    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
-    echo $ipv6_id_and_ext_gw_ip
-}
-
-# Configure neutron router for IPv4 public access
-function _neutron_configure_router_v4 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
-    # Create a public subnet on the external network
-    local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
-    local ext_gw_ip
-    ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
-    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
-    # Configure the external network as the default router gateway
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
-
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
-        # Configure and enable public bridge
-        local ext_gw_interface="none"
-        if is_neutron_ovs_base_plugin; then
-            ext_gw_interface=$(_neutron_get_ext_gw_interface)
-        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Search for the brq device the neutron router and network for $FIXED_RANGE
-            # will be using.
-            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-            ext_gw_interface=brq${EXT_NET_ID:0:11}
-        fi
-        if [[ "$ext_gw_interface" != "none" ]]; then
-            local cidr_len=${FLOATING_RANGE#*/}
-            local testcmd="ip -o link | grep -q $ext_gw_interface"
-            test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
-                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
-                sudo ip link set $ext_gw_interface up
-            fi
-            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
-            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
-        fi
-        _neutron_set_router_id
-    fi
-}
-
-# Configure neutron router for IPv6 public access
-function _neutron_configure_router_v6 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
-    # Create a public subnet on the external network
-    local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
-    local ipv6_ext_gw_ip
-    ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
-    local ipv6_pub_subnet_id
-    ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
-
-    # If the external network has not already been set as the default router
-    # gateway when configuring an IPv4 public subnet, do so now
-    if [[ "$IP_VERSION" == "6" ]]; then
-        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
-    fi
-
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
-        # Configure and enable public bridge
-        # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
-        die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
-
-        if is_neutron_ovs_base_plugin; then
-            local ext_gw_interface
-            ext_gw_interface=$(_neutron_get_ext_gw_interface)
-            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-
-            # Configure interface for public bridge
-            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
-        fi
-        _neutron_set_router_id
-    fi
-}
-
-# Explicitly set router id in l3 agent configuration
-function _neutron_set_router_id {
-    if [[ "$Q_L3_ROUTER_PER_TENANT" == "False" ]]; then
-        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
-    fi
-}
-
-# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
-function _neutron_get_ext_gw_interface {
-    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
-        echo $Q_PUBLIC_VETH_EX
-    else
-        # Disable in-band as we are going to use local port
-        # to communicate with VMs
-        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
-            other_config:disable-in-band=true
-        echo $PUBLIC_BRIDGE
-    fi
-}
-
 # Functions for Neutron Exercises
 #--------------------------------
 
@@ -1485,14 +1112,6 @@ function check_neutron_third_party_integration {
     _neutron_third_party_do check
 }
 
-function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
-        return 0
-    fi
-    return 1
-}
-
-
 # Restore xtrace
 $_XTRACE_NEUTRON
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 096722b096..0a066354ca 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -43,13 +43,15 @@ function neutron_plugin_configure_debug_command {
 }
 
 function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    local conf_file=$1
+    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
 
 function neutron_plugin_configure_l3_agent {
+    local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
-    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
+    iniset $conf_file DEFAULT external_network_bridge
+    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index aba2587ea4..69e38f4df1 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -28,12 +28,14 @@ function neutron_plugin_configure_debug_command {
 }
 
 function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    local conf_file=$1
+    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
 
 function neutron_plugin_configure_l3_agent {
+    local conf_file=$1
     _neutron_ovs_base_configure_l3_agent
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
+    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
new file mode 100644
index 0000000000..177dc1f028
--- /dev/null
+++ b/lib/neutron_plugins/services/l3
@@ -0,0 +1,366 @@
+#!/bin/bash
+# Subnet IP version
+IP_VERSION=${IP_VERSION:-"4+6"}
+# Validate IP_VERSION
+if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
+    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
+fi
+# Specify if the initial private and external networks should be created
+NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
+
+## Provider Network Information
+PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
+IPV6_PROVIDER_SUBNET_NAME=${IPV6_PROVIDER_SUBNET_NAME:-"provider_net_v6"}
+IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
+IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
+
+PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+
+# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
+# PUBLIC_BRIDGE.  This is intended to be used with
+# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
+Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
+Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
+Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
+
+# The next two variables are configured by plugin
+# e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
+#
+# The plugin supports L3.
+Q_L3_ENABLED=${Q_L3_ENABLED:-True}
+# L3 routers exist per tenant
+Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
+
+
+# Use flat providernet for public network
+#
+# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
+# for external interface of neutron l3-agent.  In that case,
+# PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
+# used for the network.  In case of ofagent, you should add the
+# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
+# For openvswitch agent, you should add the corresponding entry to
+# your OVS_BRIDGE_MAPPINGS.
+#
+# eg.  (ofagent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    Q_USE_PUBLIC_VETH=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
+#
+# eg.  (openvswitch agent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OVS_BRIDGE_MAPPINGS=public:br-ex
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
+
+# Generate 40-bit IPv6 Global ID to comply with RFC 4193
+IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
+
+# IPv6 gateway and subnet defaults, in case they are not customized in localrc
+IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
+IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
+IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
+IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
+IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
+IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
+IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
+IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
+
+# Gateway and subnet defaults, in case they are not customized in localrc
+NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
+PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
+PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
+PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
+
+# Subnetpool defaults
+SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
+
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
+SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
+
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
+SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
+
+function _determine_config_l3 {
+    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    echo "$opts"
+}
+
+function _configure_neutron_l3_agent {
+    local cfg_file
+    Q_L3_ENABLED=True
+
+    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
+
+    iniset $Q_L3_CONF_FILE DEFAULT verbose True
+    iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
+    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+
+    _neutron_setup_interface_driver $Q_L3_CONF_FILE
+
+    neutron_plugin_configure_l3_agent
+
+    if [[ $(ip -f inet a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
+    fi
+
+    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
+    fi
+}
+
+# Explicitly set router id in l3 agent configuration
+function _neutron_set_router_id {
+    if [[ "$Q_L3_ROUTER_PER_TENANT" == "False" ]]; then
+        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
+    fi
+}
+
+# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
+function _neutron_get_ext_gw_interface {
+    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
+        echo $Q_PUBLIC_VETH_EX
+    else
+        # Disable in-band as we are going to use local port
+        # to communicate with VMs
+        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+            other_config:disable-in-band=true
+        echo $PUBLIC_BRIDGE
+    fi
+}
+
+function create_neutron_initial_network {
+    local project_id
+    project_id=$(openstack project list | grep " demo " | get_field 1)
+    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
+
+    # Allow drivers that need to create an initial network to do so here
+    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
+        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
+    fi
+
+    if is_provider_network; then
+        die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
+        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
+            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
+        fi
+
+        if [[ $Q_AGENT == "openvswitch" ]]; then
+            sudo ip link set $OVS_PHYSICAL_BRIDGE up
+            sudo ip link set br-int up
+            sudo ip link set $PUBLIC_INTERFACE up
+        fi
+    else
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Create IPv4 private subnet
+            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Create IPv6 private subnet
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
+        fi
+    fi
+
+    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
+    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
+    if [[ "$Q_L3_ENABLED" == "True" ]]; then
+        # Create a router, and add the private subnet as one of its interfaces
+        if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
+            # create a tenant-owned router.
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
+        else
+            # Plugin only supports creating a single router, which should be admin owned.
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
+        fi
+
+        # if the extension is available, then mark the external
+        # network as default, and provision default subnetpools
+        EXTERNAL_NETWORK_FLAGS="--router:external"
+        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
+            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
+            if [[ "$IP_VERSION" =~ 4.* ]]; then
+                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+            if [[ "$IP_VERSION" =~ .*6 ]]; then
+                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+        fi
+        # Create an external network, and a subnet. Configure the external network as router gw
+        if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+        else
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+        fi
+        die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Configure router for IPv4 public access
+            _neutron_configure_router_v4
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Configure router for IPv6 public access
+            _neutron_configure_router_v6
+        fi
+    fi
+}
+
+# Create private IPv4 subnet
+function _neutron_create_private_subnet_v4 {
+    local project_id=$1
+    local subnet_params="--tenant-id $project_id "
+    subnet_params+="--ip_version 4 "
+    subnet_params+="--gateway $NETWORK_GATEWAY "
+    subnet_params+="--name $PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE"
+    local subnet_id
+    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
+    echo $subnet_id
+}
+
+# Create private IPv6 subnet
+function _neutron_create_private_subnet_v6 {
+    local project_id=$1
+    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
+    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
+    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
+    local subnet_params="--tenant-id $project_id "
+    subnet_params+="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
+    local ipv6_subnet_id
+    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
+    echo $ipv6_subnet_id
+}
+
+# Create public IPv4 subnet
+function _neutron_create_public_subnet_v4 {
+    local subnet_params+="--ip_version 4 "
+    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
+    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local id_and_ext_gw_ip
+    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
+    echo $id_and_ext_gw_ip
+}
+
+# Create public IPv6 subnet
+function _neutron_create_public_subnet_v6 {
+    local subnet_params="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local ipv6_id_and_ext_gw_ip
+    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
+    echo $ipv6_id_and_ext_gw_ip
+}
+
+# Configure neutron router for IPv4 public access
+function _neutron_configure_router_v4 {
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
+    # Create a public subnet on the external network
+    local id_and_ext_gw_ip
+    id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
+    local ext_gw_ip
+    ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
+    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
+    # Configure the external network as the default router gateway
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        # Configure and enable public bridge
+        local ext_gw_interface="none"
+        if is_neutron_ovs_base_plugin; then
+            ext_gw_interface=$(_neutron_get_ext_gw_interface)
+        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
+            # Search for the brq device the neutron router and network for $FIXED_RANGE
+            # will be using.
+            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
+            ext_gw_interface=brq${EXT_NET_ID:0:11}
+        fi
+        if [[ "$ext_gw_interface" != "none" ]]; then
+            local cidr_len=${FLOATING_RANGE#*/}
+            local testcmd="ip -o link | grep -q $ext_gw_interface"
+            test_with_retry "$testcmd" "$ext_gw_interface creation failed"
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
+                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+                sudo ip link set $ext_gw_interface up
+            fi
+            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
+            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
+        fi
+        _neutron_set_router_id
+    fi
+}
+
+# Configure neutron router for IPv6 public access
+function _neutron_configure_router_v6 {
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    # Create a public subnet on the external network
+    local ipv6_id_and_ext_gw_ip
+    ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
+    local ipv6_ext_gw_ip
+    ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
+    local ipv6_pub_subnet_id
+    ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
+
+    # If the external network has not already been set as the default router
+    # gateway when configuring an IPv4 public subnet, do so now
+    if [[ "$IP_VERSION" == "6" ]]; then
+        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+    fi
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
+        # Configure and enable public bridge
+        # Override global IPV6_ROUTER_GW_IP with the true value from neutron
+        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+        die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
+
+        if is_neutron_ovs_base_plugin; then
+            local ext_gw_interface
+            ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
+
+            # Configure interface for public bridge
+            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+        fi
+        _neutron_set_router_id
+    fi
+}
diff --git a/lib/template b/lib/template
index 08d10bbf71..b92fb40483 100644
--- a/lib/template
+++ b/lib/template
@@ -35,8 +35,8 @@ XXXX_DIR=$DEST/XXXX
 XXX_CONF_DIR=/etc/XXXX
 
 
-# Entry Points
-# ------------
+# Functions
+# ---------
 
 # Test if any XXXX services are enabled
 # is_XXXX_enabled
@@ -62,6 +62,11 @@ function configure_XXXX {
     :
 }
 
+# create_XXXX_accounts() - Create required service accounts
+function create_XXXX_accounts {
+    :
+}
+
 # init_XXXX() - Initialize databases, etc.
 function init_XXXX {
     # clean up from previous (possibly aborted) runs
diff --git a/stack.sh b/stack.sh
index 3de9af2725..760f4f273d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -559,6 +559,7 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
@@ -1075,7 +1076,7 @@ if is_service_enabled neutron; then
 
     configure_neutron
     # Run init_neutron only on the node hosting the Neutron API server
-    if is_service_enabled $DATABASE_BACKENDS && is_service_enabled q-svc; then
+    if is_service_enabled $DATABASE_BACKENDS && is_service_enabled neutron; then
         init_neutron
     fi
 fi
@@ -1142,7 +1143,7 @@ if is_service_enabled nova; then
 
     # Additional Nova configuration that is dependent on other services
     if is_service_enabled neutron; then
-        create_nova_conf_neutron
+        configure_neutron_nova
     elif is_service_enabled n-net; then
         create_nova_conf_nova_network
     fi
@@ -1219,7 +1220,11 @@ if is_service_enabled n-api; then
     start_nova_api
 fi
 
-if is_service_enabled q-svc; then
+if is_service_enabled neutron-api; then
+    echo_summary "Starting Neutron"
+    start_neutron_api
+    # check_neutron_third_party_integration
+elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
     start_neutron_service_and_check
     check_neutron_third_party_integration
@@ -1240,7 +1245,7 @@ elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
 fi
 
 if is_service_enabled neutron; then
-    start_neutron_agents
+    start_neutron
 fi
 # Once neutron agents are started setup initial network elements
 if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
@@ -1248,6 +1253,7 @@ if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]
     create_neutron_initial_network
     setup_neutron_debug
 fi
+
 if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
diff --git a/unstack.sh b/unstack.sh
index 83703ec28a..a69b2187ce 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -66,6 +66,7 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat

From f5a50a0fa6235c0e18984244a501292806704a16 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 10 May 2016 14:56:12 +0200
Subject: [PATCH 1368/3333] lib/tempest: stop using deprecated config option.

Use the new name instead.

Change-Id: I31f83ec70b8803a29a7be765661517d890ffd6f1
---
 lib/tempest | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index e556935cb5..2d924fe1fe 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -331,14 +331,14 @@ function configure_tempest {
         tempest_compute_max_microversion=None
     fi
     if [ "$tempest_compute_min_microversion" == "None" ]; then
-        inicomment $TEMPEST_CONFIG compute-feature-enabled min_microversion
+        inicomment $TEMPEST_CONFIG compute min_microversion
     else
-        iniset $TEMPEST_CONFIG compute-feature-enabled min_microversion $tempest_compute_min_microversion
+        iniset $TEMPEST_CONFIG compute min_microversion $tempest_compute_min_microversion
     fi
     if [ "$tempest_compute_max_microversion" == "None" ]; then
-        inicomment $TEMPEST_CONFIG compute-feature-enabled max_microversion
+        inicomment $TEMPEST_CONFIG compute max_microversion
     else
-        iniset $TEMPEST_CONFIG compute-feature-enabled max_microversion $tempest_compute_max_microversion
+        iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
@@ -374,7 +374,7 @@ function configure_tempest {
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
-    iniset $TEMPEST_CONFIG network tenant_networks_reachable false
+    iniset $TEMPEST_CONFIG network project_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
     iniset $TEMPEST_CONFIG network public_router_id "$public_router_id"
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"

From 50f22da8958af08a5b1f4ec7e905f3c67d9b69bb Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 10 May 2016 15:04:44 +0200
Subject: [PATCH 1369/3333] Nova conf:don't use deprecated option "fixed_key"
 from group "keymgr"

That option now lives in the "key_manager" group.

Change-Id: I35c2914eaf2a190d6494107260483a6835de3e47
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 3de9af2725..1ca66b09ba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1208,9 +1208,9 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create a randomized default value for the keymgr's fixed_key
+# Create a randomized default value for the key manager's fixed_key
 if is_service_enabled nova; then
-    iniset $NOVA_CONF keymgr fixed_key $(generate_hex_string 32)
+    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 32)
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From 53b63cc97f84ac3d63f20e7f3ba524cf95c684be Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 28 Apr 2016 13:33:38 -0500
Subject: [PATCH 1370/3333] Use arping when moving an IP address

This helps fix an issue where an IPv4 address is moved from an interface
and you lose your SSH session.

Change-Id: Idf37ccbaa6f615fcc714d49c3f0c00c893f56021
---
 lib/neutron-legacy | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..d2a222117f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -859,6 +859,13 @@ function _move_neutron_addresses_route {
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
+        if [[ "$af" == "inet" ]]; then
+            IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
+            ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
+        else
+            ARP_CMD=""
+        fi
+
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
@@ -879,7 +886,7 @@ function _move_neutron_addresses_route {
 
         # The add/del OVS port calls have to happen either before or
         # after the address is moved in order to not leave it orphaned.
-        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
     fi
 }
 

From ea76f319a21edc524efeb4de9f49515c9019e8ef Mon Sep 17 00:00:00 2001
From: Chuck Carmack <carmack@us.ibm.com>
Date: Sat, 22 Aug 2015 15:03:27 +0000
Subject: [PATCH 1371/3333] Use LVM_VOLUME_CLEAR if set

There are a few CI efforts going on related to jobs that use the lvm
image backend for the libvirt driver in Nova. We don't want to waste
time zero'ing out volumes during CI runs, so we need a way to configure
nova to not clear the volumes in these jobs.

This change adds a variable used to set the CONF.libvirt.volume_clear
value in nova.conf. If the variable isn't set, Nova just uses the default.

This will be set to 'none' in the jobs that are going to use LVM.

Co-Authored-By: Matt Riedemann <mriedem@us.ibm.com>

Change-Id: I1e97ba6ab4772a87192ae2689a25050d432358ab
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index ab2bef8ae0..101288903d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -604,6 +604,9 @@ function create_nova_conf {
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
         iniset $NOVA_CONF libvirt images_type "lvm"
         iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
+        if isset LVM_VOLUME_CLEAR; then
+            iniset $NOVA_CONF libvirt volume_clear "$LVM_VOLUME_CLEAR"
+        fi
     fi
 
     if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then

From a2ed055810bc3ef22b91faffb7f6308908527be3 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 15:35:10 -0400
Subject: [PATCH 1372/3333] Fix _configure_neutron_l3_agent

I goofed when moving it over, and it looks like the calls
to _move_neutron_addresses_route got clobbered.

Changes like a0d1b0151a9d9e169e6342f36a073e8154119924 ended up getting
dropped on the floor, so let's reintroduce them.

Change-Id: I3bbfbc56e2c663c47a03659a1dff96443c13af47
---
 lib/neutron_plugins/services/l3 | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 177dc1f028..4c4730e125 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -90,29 +90,25 @@ function _determine_config_l3 {
 }
 
 function _configure_neutron_l3_agent {
-    local cfg_file
     Q_L3_ENABLED=True
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
     neutron_plugin_configure_l3_agent
 
-    if [[ $(ip -f inet a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
-    fi
+    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
 
     if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
     fi
 }
 

From 5394cc101d06bbd3795a1a7ee0e86298418e6dc2 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 15:03:38 -0400
Subject: [PATCH 1373/3333] Neutron refactor: Fix missing call to init RPC
 backend

Change-Id: I2c7f116230f53d3a2460192bc7b513b2e230c736
---
 lib/neutron | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 51c3a006c7..e0f71f585a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -126,6 +126,8 @@ function configure_neutron_new {
     iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
 
+    iniset_rpc_backend neutron $NEUTRON_CONF
+
     # Neutron API server & Neutron plugin
     if is_service_enabled neutron-api; then
         local policy_file=$NEUTRON_CONF_DIR/policy.json

From a464ea767a027b3d3c658b8f997f43f91af0349f Mon Sep 17 00:00:00 2001
From: Yi Zhao <zhaoyi@cmss.chinamobile.com>
Date: Thu, 12 May 2016 10:32:58 +0800
Subject: [PATCH 1374/3333] Fix error reported due to re-add ipv6 address

This commit fixes devstack fails when re-stack due to re-add ipv6
address.

Change-Id: I9ff62023dbc29a88aec3c48af331c0a49a1270bb
Closes-Bug: #1579985
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 177dc1f028..80af0bb190 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -358,7 +358,7 @@ function _neutron_configure_router_v6 {
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
 
             # Configure interface for public bridge
-            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+            sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
             sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
         fi
         _neutron_set_router_id

From 4f4d95a12c5b9de0ea09864c67dcad6a19fb0145 Mon Sep 17 00:00:00 2001
From: "watanabe.isao" <watanabe_isao@jp.fujitsu.com>
Date: Thu, 12 May 2016 20:35:20 +0900
Subject: [PATCH 1375/3333] Add lost function of is_provider_network

This is a follow up patch of [1].
In [1], source has been moved from lib/neutron-legacy to lib/neutron_plugins/services/l3.
However, one necessary function of is_provider_network is lost.
And this cause devstack install fail.

[1]https://review.openstack.org/168438/

Change-Id: I413b3577ec5b11ee0ee01f2368364117962494bb
---
 lib/neutron_plugins/services/l3 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 4c4730e125..5ff8ea5f69 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -360,3 +360,10 @@ function _neutron_configure_router_v6 {
         _neutron_set_router_id
     fi
 }
+
+function is_provider_network {
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
+        return 0
+    fi
+    return 1
+}

From 0afe207cb346fe7468d073e2358abd2ad9b9d9e8 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Thu, 12 May 2016 14:09:03 +0200
Subject: [PATCH 1376/3333] Create service project in service domain

When creating service users, the assumption is that the service
project lies within the service domain, so create it there.

Change-Id: I4880e789f5eaf340634ceb792397eef12a5a6b51
Closes-Bug: 1580998
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..4a0222f970 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -376,7 +376,7 @@ function create_keystone_accounts {
 
     # Create service project/role
     get_or_create_domain "$SERVICE_DOMAIN_NAME"
-    get_or_create_project "$SERVICE_PROJECT_NAME" default
+    get_or_create_project "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME"
 
     # Service role, so service users do not have to be admins
     get_or_create_role service

From 1cd2828da4829649d6af98b4d1eef2d5d5286005 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 15:07:19 -0400
Subject: [PATCH 1377/3333] Neutron refactor: Clarify use of
 neutron-metadata-agent

The commit message of 2a242519f71e86416e78541826cac2b54fcd04a5 indicated
that neutron-metadata-agent was the correct name for the metadata
proxy, but parts of the code were not consistent.

Change-Id: I52f08266a169aeb9005c0f84296fc814d05b90d4
---
 lib/neutron | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e0f71f585a..e14158383d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -204,7 +204,7 @@ function configure_neutron_new {
     fi
 
     # Metadata
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
         iniset $NEUTRON_META_CONF DEFAULT verbose True
@@ -290,7 +290,7 @@ function configure_neutron_nova_new {
 
     iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
     fi
 
@@ -425,8 +425,8 @@ function start_neutron_new {
             create_neutron_initial_network
         fi
     fi
-    if is_service_enabled neutron-meta; then
-        run_process neutron-meta "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
+    if is_service_enabled neutron-metadata-agent; then
+        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
     fi
 }
 
@@ -442,9 +442,9 @@ function stop_neutron_new {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         sudo pkill -9 -f neutron-ns-metadata-proxy || :
-        stop_process neutron-meta
+        stop_process neutron-metadata-agent
     fi
 }
 
@@ -470,7 +470,7 @@ function _set_config_files {
         NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_L3_CONF"
     fi
 
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_META_CONF"
     fi
 

From abde96acd275c71f1ea99fdb1be48db46bc65d93 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 12 May 2016 19:26:20 -0400
Subject: [PATCH 1378/3333] Add a deprecation warning for lib/neutron-legacy

This commit adds a deprecation warning for lib/neutron-legacy. Right
now lib/neutron isn't quite in a place where we can use it by default
but we're getting close. As soon as it's passing in the gate we plan
to make a switch over and a hard delete of lib/neutron-legacy. To give
any users which have a hard dependency on it (which is not actually
a supported use case) a heads up this adds the deprecation warning
in front of that change.

Change-Id: Idf1faf2e9dd497f9b97abfcc6e796ca72d60d955
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7eb8637634..a3a0dcc20d 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -61,7 +61,7 @@
 # Neutron Network Configuration
 # -----------------------------
 
-
+deprecated "Using lib/neutron-legacy is deprecated, and it will be removed in the future"
 
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"

From d894221457efa3a2a0bf3db76a4c5e8ffba36e29 Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Fri, 13 May 2016 12:51:30 +0300
Subject: [PATCH 1379/3333] Replace Q_L3_ENABLED by is_service_enabled q-l3

This patch replaces Q_L3_ENABLED with is_service_enabled q-l3.
Both of them idicates wherever Neutron L3 agent is enabled or not.

Change-Id: I33f0f5a6174d1d170bc2ac1c2e3a096d88d17cc1
---
 doc/source/guides/neutron.rst   | 6 +-----
 lib/neutron_plugins/services/l3 | 9 +++------
 lib/tempest                     | 3 +--
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index a834314bcc..fe6f629235 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -88,7 +88,6 @@ serving as a hypervisor for guest instances.
         FIXED_RANGE="10.0.0.0/24"
         Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-        Q_L3_ENABLED=True
         PUBLIC_INTERFACE=eth0
 
         # Open vSwitch provider networking configuration
@@ -387,7 +386,6 @@ controller node.
         OVS_PHYSICAL_BRIDGE=br-ex
 
         Q_USE_PROVIDER_NETWORKING=True
-        Q_L3_ENABLED=False
 
         # Do not use Nova-Network
         disable_service n-net
@@ -434,13 +432,12 @@ compute node 1.
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_INTERFACE=eth1
         Q_USE_PROVIDER_NETWORKING=True
-        Q_L3_ENABLED=False
 
 Compute node 2's configuration will be exactly the same, except
 ``HOST_IP`` will be ``10.0.0.4``
 
 When DevStack is configured to use provider networking (via
-``Q_USE_PROVIDER_NETWORKING`` is True and ``Q_L3_ENABLED`` is False) -
+``Q_USE_PROVIDER_NETWORKING`` is True) -
 DevStack will automatically add the network interface defined in
 ``PUBLIC_INTERFACE`` to the ``OVS_PHYSICAL_BRIDGE``
 
@@ -543,7 +540,6 @@ setup, with small modifications for the interface mappings.
     FIXED_RANGE="10.0.0.0/24"
     Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
     PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-    Q_L3_ENABLED=True
     PUBLIC_INTERFACE=eth0
 
     Q_USE_PROVIDERNET_FOR_PUBLIC=True
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 5ff8ea5f69..a5a6c81ea4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -23,11 +23,9 @@ Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
 Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
 Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 
-# The next two variables are configured by plugin
+# The next variable is configured by plugin
 # e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
 #
-# The plugin supports L3.
-Q_L3_ENABLED=${Q_L3_ENABLED:-True}
 # L3 routers exist per tenant
 Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
@@ -90,7 +88,6 @@ function _determine_config_l3 {
 }
 
 function _configure_neutron_l3_agent {
-    Q_L3_ENABLED=True
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
@@ -180,7 +177,7 @@ function create_neutron_initial_network {
 
     AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
     SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
-    if [[ "$Q_L3_ENABLED" == "True" ]]; then
+    if is_service_enabled q-l3; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
@@ -362,7 +359,7 @@ function _neutron_configure_router_v6 {
 }
 
 function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ]; then
         return 0
     fi
     return 1
diff --git a/lib/tempest b/lib/tempest
index e556935cb5..298d030e68 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -16,7 +16,6 @@
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
 #   - ``PUBLIC_NETWORK_NAME``
 #   - ``Q_ROUTER_NAME``
-#   - ``Q_L3_ENABLED``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
 #   - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone
@@ -239,7 +238,7 @@ function configure_tempest {
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
-    if [ "$Q_L3_ENABLED" = "True" ]; then
+    if is_service_enabled q-l3; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi

From 958c169d796ab82521b69b35a13ee27037e68e97 Mon Sep 17 00:00:00 2001
From: Brian Ober <bober@us.ibm.com>
Date: Wed, 11 May 2016 19:11:31 -0500
Subject: [PATCH 1380/3333] Enable Swift Account Management

This patch enables account management by default in Swift.  This will be
leveraged by Tempest test cases validating account management APIs.

Depends-On: Id29f5ca48f92cd139535be7064107b8a61b02856
Change-Id: Ic01432939ed9b4cf0cbf20e3244d4d76847f539f
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 8cb94efa66..950b3f20c0 100644
--- a/lib/swift
+++ b/lib/swift
@@ -428,6 +428,7 @@ function configure_swift {
     sed -i "/^pipeline/ { s/proxy-server/${SWIFT_EXTRAS_MIDDLEWARE_LAST} proxy-server/ ; }" ${SWIFT_CONFIG_PROXY_SERVER}
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server account_autocreate true
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server allow_account_management true
 
     # Configure Crossdomain
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:crossdomain use "egg:swift#crossdomain"

From 46f8cb7f208d00f89863cf57f2400309cf8f6bd4 Mon Sep 17 00:00:00 2001
From: Marc Koderer <marc@koderer.com>
Date: Fri, 13 May 2016 09:08:16 +0200
Subject: [PATCH 1381/3333] Add option to download all libs from git

For client debugging that invokes multiple libs it can be useful
to have all libs directly in git and not listing all of them
in LIBS_FROM_GIT.

TrivialFix

Change-Id: Ie631cc4045231ebbe8177d2d113e47e4bf83f61c
---
 doc/source/configuration.rst | 3 +++
 inc/python                   | 2 +-
 stackrc                      | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1f5797c22d..384ceee41a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -427,6 +427,9 @@ can be specified as a comma separated list.
 
       LIBS_FROM_GIT=python-keystoneclient,oslo.config
 
+Setting the variable to ``ALL`` will activate the download for all
+libraries.
+
 Virtual Environments
 --------------------
 
diff --git a/inc/python b/inc/python
index 495150d4b8..e013dfab36 100644
--- a/inc/python
+++ b/inc/python
@@ -192,7 +192,7 @@ function get_from_global_requirements {
 function use_library_from_git {
     local name=$1
     local enabled=1
-    [[ ,${LIBS_FROM_GIT}, =~ ,${name}, ]] && enabled=0
+    [[ ${LIBS_FROM_GIT} = 'ALL' ]] || [[ ,${LIBS_FROM_GIT}, =~ ,${name}, ]] && enabled=0
     return $enabled
 }
 
diff --git a/stackrc b/stackrc
index 4ba57c9cb6..8e1900dd94 100644
--- a/stackrc
+++ b/stackrc
@@ -208,6 +208,9 @@ REQUIREMENTS_DIR=$DEST/requirements
 # ex: LIBS_FROM_GIT=python-keystoneclient,oslo.config
 #
 # Will install those 2 libraries from git, the rest from pypi.
+#
+# Setting the variable to 'ALL' will activate the download for all
+# libraries.
 
 
 ##############

From 69d3b79e03e0ba4c9679bcb5279b226b9606e1ff Mon Sep 17 00:00:00 2001
From: bhargavaregalla <br983u@att.com>
Date: Tue, 17 May 2016 09:34:26 +0100
Subject: [PATCH 1382/3333] Wrong container name in devstack "All-In-One Single
 LXC Container" manual.

Wrong container name in devstack "All-In-One Single LXC Container" manual.

Link: http://docs.openstack.org/developer/devstack/guides/lxc.html

After creating "devstack" container with below command
sudo lxc-create -n devstack -t ubuntu -f devstack-lxc.conf -- --packages=bsdmainutils,git

The name should be 'devstack' instead of 'p2' in the below command
ssh ubuntu@$(sudo lxc-info -n p2 | awk '/IP/ { print $2 }')).

Change-Id: I7a84b97b03b2dd4338f1d946b7eafb8ec6e3767d
Closes-bug: #1582248
---
 doc/source/guides/lxc.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/lxc.rst b/doc/source/guides/lxc.rst
index a719d605aa..9549ed2974 100644
--- a/doc/source/guides/lxc.rst
+++ b/doc/source/guides/lxc.rst
@@ -88,7 +88,7 @@ You can login using the username ``ubuntu`` and password ``ubuntu``.
 
 You can also ssh into your container. On your host, run
 ``sudo lxc-info -n devstack`` to get the IP address (e.g. 
-``ssh ubuntu@$(sudo lxc-info -n p2 | awk '/IP/ { print $2 }')``).
+``ssh ubuntu@$(sudo lxc-info -n devstack | awk '/IP/ { print $2 }')``).
 
 Run Devstack
 -------------

From 53f59d802f9cc76bf898509344463d8ff3a32143 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Tue, 17 May 2016 15:12:24 -0700
Subject: [PATCH 1383/3333] Use Neutron extension information to configure
 Tempest's public network

Neutron L3 may implement a variety of extensions: router, external-net,
dvr, ext-gw-mode, extraroute, l3-ha, etc. The public network uuid is
only going to be made available if and only if the external-net extension
is available, because that's the one that provides Floating IP support.

Rather than making Tempest aware of q-l3 service (when q-* services
are supposed to be legacy), it is better to tune this configuration
based on the extension availability. This decouples Tempest from
Neutron setup internals.

Change-Id: I4889fc3d21bd221785b507995f1b3da0e8f52b46
Related-bug: 1582119
---
 lib/tempest | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cce541cdf0..d4d8cf25df 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -238,7 +238,10 @@ function configure_tempest {
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
-    if is_service_enabled q-l3; then
+    # the public network (for floating ip access) is only available
+    # if the extension is enabled.
+    EXTERNAL_NETWORK_EXT=$(neutron ext-list | grep 'external-net' | get_field 1)
+    if [[ -n $EXTERNAL_NETWORK_EXT ]]; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi

From bda194adb97ba2bc9b45e91b35ff393378095ea6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 18 May 2016 10:42:56 +1000
Subject: [PATCH 1384/3333] Skip EPEL & RDO install for CI nodes

If the nodepool info file is around, assume we're on a OpenStack CI
node and skip re-installing EPEL & RDO

Change-Id: Ife80af015b26514098e0633f568e3da35b9eea8c
---
 stack.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/stack.sh b/stack.sh
index 21f7f35f35..9944d6de9e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -335,6 +335,13 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
+# If we have /etc/nodepool/provider assume we're on a OpenStack CI
+# node, where EPEL is already pointing at our internal mirror and RDO
+# is pre-installed.
+if [[ -f /etc/nodepool/provider ]]; then
+    SKIP_EPEL_INSTALL=True
+fi
+
 if is_fedora && [[ $DISTRO == "rhel7" ]] && \
         [[ ${SKIP_EPEL_INSTALL} != True ]]; then
     _install_epel_and_rdo

From bcfaa0730e2103c65fe5409db8cc5220d3170523 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 18 May 2016 06:50:13 +0000
Subject: [PATCH 1385/3333] Updated from generate-devstack-plugins-list

Change-Id: Ia1ed75b563ee9aabf6b70e0506d8965ca3df6c0a
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a2721b4172..cf9c8735f8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -30,6 +30,7 @@ aodh                                   `git://git.openstack.org/openstack/aodh <
 app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
+bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
 blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
 broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__

From e7d2b563918c9fdb06bd1635cb391d1888336839 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 12 May 2016 12:04:03 -0400
Subject: [PATCH 1386/3333] Always pass $NEUTRON_CONF

When running a compute node that only runs n-cpu and neutron-agent,
there are still configuration items that are needed by the agent that
reside in $NEUTRON_CONF - such as the rabbit rpc information.

Change-Id: Ib7f5dde3afb0c19dc88f351c99bc669217952a14
---
 lib/neutron | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e14158383d..fa2e926995 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -451,11 +451,7 @@ function stop_neutron_new {
 # Compile the lost of enabled config files
 function _set_config_files {
 
-    #TODO(sc68cal) - see if we can clean up this and only
-    # pass in config files that make sense for certain agents
-    if is_service_enabled neutron-api; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
-    fi
+    NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
 
     #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_PLUGIN_CONF (ml2_conf.ini) but others may not
     if is_service_enabled neutron-agent; then

From 17398a3de3fc993b47f8a8fe8af669dbbfa21625 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 18:24:46 +0000
Subject: [PATCH 1387/3333] Make ARP_CMD local

Change-Id: Iaa540f7685197a17f1db4c3351373a6d77a80105
---
 lib/neutron-legacy | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7eb8637634..af0e743fb3 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -621,14 +621,13 @@ function _move_neutron_addresses_route {
         DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
         local DEL_OVS_PORT=""
+        local ARP_CMD=""
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
         if [[ "$af" == "inet" ]]; then
             IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
             ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
-        else
-            ARP_CMD=""
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then

From 153db269705f37d4144ad3fcf26dc67269755d7d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 18 May 2016 14:05:14 +0000
Subject: [PATCH 1388/3333] Revert "Switch fernet to be the default token
 provider"

This reverts commit 181588b9ba50fefea12617a9a5e774daddfed20c.

Since this change landed on 4/29 it's been the cause of the
top two gate failures (besides known latent infra issues) and
hasn't had good progress on landing a fix, so until it's a
priority for the keystone team we need to revert this change
to get the integrated gate jobs moving again.

Change-Id: I588a84c5179eab072d21bc1394aea2df00929650
Related-Bug: #1577558
Related-Bug: #1578866
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 49d819e500..d83092405b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -89,7 +89,7 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
-KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration

From 9278eb78dfc47e3b48e2b72faf90efc6bb44e18f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 18 May 2016 13:38:38 -0400
Subject: [PATCH 1389/3333] Move setting lvm libvirt configs to
 hypervisor-libvirt

When the nova backend is LVM we set some libvirt configs
in nova.conf. Those should happen in the libvirt plugin
file rather than the generic nova file since it's specific
to running nova-compute with libvirt.

Change-Id: I37a63a5fba2e9eea4daafe4ec390b2e7aac236f3
---
 lib/nova                            | 8 --------
 lib/nova_plugins/hypervisor-libvirt | 6 ++++++
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/lib/nova b/lib/nova
index de898b23fd..af5d1222a0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -589,14 +589,6 @@ function create_nova_conf {
 
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
 
-    if [[ "$NOVA_BACKEND" == "LVM" ]]; then
-        iniset $NOVA_CONF libvirt images_type "lvm"
-        iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
-        if isset LVM_VOLUME_CLEAR; then
-            iniset $NOVA_CONF libvirt volume_clear "$LVM_VOLUME_CLEAR"
-        fi
-    fi
-
     if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
     fi
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 1b4f7ae80a..d0e364efc3 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -68,6 +68,12 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF vnc vncserver_proxyclient_address  $HOST_IP
         iniset $NOVA_CONF vnc vncserver_listen $HOST_IP
         iniset $NOVA_CONF vnc keymap
+    elif [[ "$NOVA_BACKEND" == "LVM" ]]; then
+        iniset $NOVA_CONF libvirt images_type "lvm"
+        iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
+        if isset LVM_VOLUME_CLEAR; then
+            iniset $NOVA_CONF libvirt volume_clear "$LVM_VOLUME_CLEAR"
+        fi
     fi
 }
 

From 6d4843ed96fed4ed7ca6a18394fd2a64439d3707 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 12 May 2016 16:14:26 -0400
Subject: [PATCH 1390/3333] Neutron: only do ARP_CMD if IP_BRD is not an empty
 string

Some third party CI systems leave PUBLIC_INTERFACE as the default,
but do not actually create the device. ip would set errno to 1 when
this happens[1], and that's fine - however arping would exit with errno
set to 2, which triggers the exit_trap and stops stacking.[2]

[1]: http://openstack.fit-tecnologia.org.br:10000/36/295836/6/check/hitachi-hnas-ssc/3362683/logs/devstacklog.txt.gz#_2016-05-12_17_24_40_458

[2]: http://openstack.fit-tecnologia.org.br:10000/36/295836/6/check/hitachi-hnas-ssc/3362683/logs/devstacklog.txt.gz#_2016-05-12_17_24_40_545

Change-Id: Iaf08b475eeec5e179a11a42d35fe532b2a15aa41
---
 lib/neutron-legacy | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9144ca4b1e..383944f686 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -625,11 +625,6 @@ function _move_neutron_addresses_route {
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
-        if [[ "$af" == "inet" ]]; then
-            IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-            ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
-        fi
-
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
@@ -646,6 +641,10 @@ function _move_neutron_addresses_route {
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
             IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
             IP_UP="sudo ip link set $to_intf up"
+            if [[ "$af" == "inet" ]]; then
+                IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
+                ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
+            fi
         fi
 
         # The add/del OVS port calls have to happen either before or

From e86b91ba784994285de78ae06a490fc6cac50502 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Tue, 3 May 2016 15:21:47 -0500
Subject: [PATCH 1391/3333] Reference keystone URIs rather than building URI

lib/keystone sets KEYSTONE_AUTH_URI and KEYSTONE_SERVICE_URI that
other projects should use rather than building the URL themselves.
This will allow us to more easily drop the port altogether.

Change-Id: I7467aae680215f3045d32a088af2187e1eba8169
---
 lib/horizon        | 2 +-
 lib/neutron-legacy | 2 +-
 lib/swift          | 4 +---
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index abc1f6d16d..0517e32197 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -96,7 +96,7 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
-    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0d6141680e..faf17be50a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -456,7 +456,7 @@ function configure_neutron {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/swift b/lib/swift
index 8cb94efa66..4330e3bd87 100644
--- a/lib/swift
+++ b/lib/swift
@@ -457,9 +457,7 @@ function configure_swift {
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
 [filter:s3token]
 paste.filter_factory = keystonemiddleware.s3_token:filter_factory
-auth_port = ${KEYSTONE_AUTH_PORT}
-auth_host = ${KEYSTONE_AUTH_HOST}
-auth_protocol = ${KEYSTONE_AUTH_PROTOCOL}
+auth_uri = ${KEYSTONE_AUTH_URI}
 cafile = ${SSL_BUNDLE_FILE}
 admin_user = swift
 admin_tenant_name = ${SERVICE_PROJECT_NAME}

From d04cc4043487ed33c7f78419610ae2c25cb3331d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 20 May 2016 07:08:34 +0000
Subject: [PATCH 1392/3333] Updated from generate-devstack-plugins-list

Change-Id: I60f6c75f2b12a0541d25cf291f18dcce30f2d42d
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cf9c8735f8..e58643fcea 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -95,6 +95,7 @@ networking-powervm                     `git://git.openstack.org/openstack/networ
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From c35110e7c5c35dd1edc310dc3d0bb8693e58d336 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 18 May 2016 10:38:51 -0400
Subject: [PATCH 1393/3333] Neutron: check if a plugin has the l3 API extension

If a plugin has the L3 API extension available, issue the L3 API
extension calls that creates routers and networks

Change-Id: I77e269ce0025054bcf2a2f4156124f2921ba2d59
---
 lib/neutron_plugins/services/l3 | 15 +++++++++------
 lib/tempest                     |  3 +--
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..55597a695d 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -175,9 +175,7 @@ function create_neutron_initial_network {
         fi
     fi
 
-    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
-    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
-    if is_service_enabled q-l3; then
+    if is_networking_extension_supported "router" && is_networking_extension_supported "external-net"; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
@@ -189,10 +187,8 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
-        # if the extension is available, then mark the external
-        # network as default, and provision default subnetpools
         EXTERNAL_NETWORK_FLAGS="--router:external"
-        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
+        if is_networking_extension_supported "auto-allocated-topology" && is_networking_extension_supported "subnet_allocation"; then
             EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
             if [[ "$IP_VERSION" =~ 4.* ]]; then
                 SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
@@ -364,3 +360,10 @@ function is_provider_network {
     fi
     return 1
 }
+
+function is_networking_extension_supported {
+    local extension=$1
+    # TODO(sc68cal) cache this instead of calling every time
+    EXT_LIST=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list -c alias -f value)
+    [[ $EXT_LIST =~ $extension ]] && return 0
+}
diff --git a/lib/tempest b/lib/tempest
index d4d8cf25df..8cae4d987e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -240,8 +240,7 @@ function configure_tempest {
 
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
-    EXTERNAL_NETWORK_EXT=$(neutron ext-list | grep 'external-net' | get_field 1)
-    if [[ -n $EXTERNAL_NETWORK_EXT ]]; then
+    if is_networking_extension_supported 'external-net'; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi

From b65586739098d9c13ff93b3588a25343f82dc7fa Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 20 May 2016 17:30:17 -0400
Subject: [PATCH 1394/3333] Add printing the plugin list after the plugin
 install

This commit just adds a sanity check output to lib/tempest. It will
use tempest list-plugins to print a table of installed plugins after
the pip install phase is run for any provided plugins. This will
enable users to check that the plugins they think they're running are
detected by tempest.

Change-Id: Icff286da6c68ec9a57f2288458976341bc095875
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index e556935cb5..8ff7d91b04 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,6 +600,8 @@ function install_tempest {
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
+        echo "Checking installed Tempest plugins:"
+        tox -evenv-tempest -- tempest list-plugins
     fi
     popd
 }

From 247e44625cdd3b4bf251dabfeca0ca241d9109a8 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Fri, 20 May 2016 13:34:41 +0200
Subject: [PATCH 1395/3333] functions-common: Use `systemctl` when applicable

We live in a new systemd world, use the native commands to talk to it
if available.

Change-Id: Iccdc35f0c9da2997f9e672bc1d24ca15d3403d98
---
 functions-common | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index d473077c3e..9973d8ff03 100644
--- a/functions-common
+++ b/functions-common
@@ -2264,11 +2264,12 @@ function python_version {
 # Service wrapper to restart services
 # restart_service service-name
 function restart_service {
-    if is_ubuntu; then
-        sudo /usr/sbin/service $1 restart
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl restart $1
     else
-        sudo /sbin/service $1 restart
+        sudo service $1 restart
     fi
+
 }
 
 # Only change permissions of a file or directory if it is not on an
@@ -2286,20 +2287,20 @@ function safe_chown {
 # Service wrapper to start services
 # start_service service-name
 function start_service {
-    if is_ubuntu; then
-        sudo /usr/sbin/service $1 start
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl start $1
     else
-        sudo /sbin/service $1 start
+        sudo service $1 start
     fi
 }
 
 # Service wrapper to stop services
 # stop_service service-name
 function stop_service {
-    if is_ubuntu; then
-        sudo /usr/sbin/service $1 stop
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl stop $1
     else
-        sudo /sbin/service $1 stop
+        sudo service $1 stop
     fi
 }
 

From 0578e42fdbb6c626a3b07465ef0df3b5211efb9e Mon Sep 17 00:00:00 2001
From: Rodrigo Duarte <rduartes@redhat.com>
Date: Wed, 16 Mar 2016 12:15:07 -0300
Subject: [PATCH 1396/3333] Tempest: add a Keystone reseller feature flag

A new tempest test is being added in https://review.openstack.org/#/c/285541/
but it is not supported in the Kilo and Liberty branches. This patch
turns on this feature flag at Devstacks's side.

According to tempest policies, this patch must be merged first so the
test can actually run.

Change-Id: I52458a0b36e1dba233667311b35f6c3931e2e66c
Depends-On: Ie69dae09c2b42e825e9d51abf158fc14788387d1
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d4d8cf25df..ee4550155e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -282,6 +282,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    # Identity Features
+    # TODO(rodrigods): Remove the reseller flag when Kilo and Liberty are end of life.
+    iniset $TEMPEST_CONFIG identity-feature-enabled reseller True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From fbba3b9d8b4094b20f55fcf6860d8e5e303a39bc Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 12 May 2016 11:17:53 -0400
Subject: [PATCH 1397/3333] Neutron: Remove verbose and always set debug to
 true

http://lists.openstack.org/pipermail/openstack-dev/2016-May/095166.html

Change-Id: I7c51518c10d96eb84a6ddd2514011bfd42623d5d
---
 lib/neutron | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index fa2e926995..c0db20d4b9 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -126,6 +126,8 @@ function configure_neutron_new {
     iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
 
+    iniset $NEUTRON_CONF DEFAULT debug True
+
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # Neutron API server & Neutron plugin
@@ -139,8 +141,6 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CONF DEFAULT core_plugin ml2
 
-        iniset $NEUTRON_CONF DEFAULT verbose True
-        iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
 
@@ -171,6 +171,7 @@ function configure_neutron_new {
     # Neutron OVS or LB agent
     if is_service_enabled neutron-agent; then
         iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
+        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug True
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
@@ -186,7 +187,6 @@ function configure_neutron_new {
     if is_service_enabled neutron-dhcp; then
         cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
 
-        iniset $NEUTRON_DHCP_CONF DEFAULT verbose True
         iniset $NEUTRON_DHCP_CONF DEFAULT debug True
         iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
@@ -199,7 +199,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT service_plugins router
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_L3_CONF DEFAULT debug True
-        iniset $NEUTRON_L3_CONF DEFAULT verbose True
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
     fi
 
@@ -207,8 +206,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-metadata-agent; then
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
-        iniset $NEUTRON_META_CONF DEFAULT verbose True
-        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_META_CONF DEFAULT debug True
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 

From 5e01c47e4d671166b9396c507a7105a5ac8256dc Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 19 May 2016 11:36:57 -0400
Subject: [PATCH 1398/3333] Neutron: stop creating neutron debug probes

They seem to be more trouble than they are worth.

http://lists.openstack.org/pipermail/openstack-dev/2016-May/095476.html

Neutron has already deprecated the utility in
https://review.openstack.org/#/c/318786/

Change-Id: I470ed5bc1cbe754c4bfae41f411150331bc4335d
---
 lib/neutron-legacy | 40 ----------------------------------------
 stack.sh           |  1 -
 2 files changed, 41 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9144ca4b1e..02be83ac35 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -130,8 +130,6 @@ Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
 # Allow Overlapping IP among subnets
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-# Use neutron-debug command
-Q_USE_DEBUG_COMMAND=${Q_USE_DEBUG_COMMAND:-False}
 # The name of the default q-l3 router
 Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
@@ -361,8 +359,6 @@ function configure_mutnauq {
         _configure_neutron_ceilometer_notifications
     fi
 
-    _configure_neutron_debug_command
-
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
 }
 
@@ -799,24 +795,6 @@ function _configure_neutron_common {
     _neutron_setup_rootwrap
 }
 
-function _configure_neutron_debug_command {
-    if [[ "$Q_USE_DEBUG_COMMAND" != "True" ]]; then
-        return
-    fi
-
-    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_TEST_CONFIG_FILE
-
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
-    iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    _neutron_setup_interface_driver $NEUTRON_TEST_CONFIG_FILE
-
-    neutron_plugin_configure_debug_command
-}
-
 function _configure_neutron_dhcp_agent {
 
     cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
@@ -1027,24 +1005,6 @@ function delete_probe {
     neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
 }
 
-function setup_neutron_debug {
-    if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
-        public_net_id=`_get_net_id $PUBLIC_NETWORK_NAME`
-        if [[ -n $public_net_id ]]; then
-            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
-        fi
-        private_net_id=`_get_net_id $PRIVATE_NETWORK_NAME`
-        if [[ -n $private_net_id ]]; then
-            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
-        fi
-    fi
-}
-
-function teardown_neutron_debug {
-    delete_probe $PUBLIC_NETWORK_NAME
-    delete_probe $PRIVATE_NETWORK_NAME
-}
-
 function _get_net_id {
     neutron --os-cloud devstack-admin --os-region "$REGION_NAME" --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
 }
diff --git a/stack.sh b/stack.sh
index 21f7f35f35..381e94cf26 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1250,7 +1250,6 @@ fi
 if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
     create_neutron_initial_network
-    setup_neutron_debug
 fi
 
 if is_service_enabled nova; then

From 8d0d3115ccf528ff5ae1533a670fc3bd475d0bcc Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Thu, 26 May 2016 23:41:49 +0300
Subject: [PATCH 1399/3333] Allow override of python-brick-cinderclient-ext
 library used by cinder

Added to requirements:
https://review.openstack.org/309084

Functional tests were added
https://review.openstack.org/265811

But they still use the version of python-brick-cinderclient-ext from pip.

This change updates devstack to pull in the changes from
python-brick-cinderclient-ext patch sets instead, when configured to do so.

Change-Id: I6d0f09950ea1200d3367a53aa4a3eea9be7abc66
Needed-by: I34f3b5ceaad7a50b1e9cadcc764f61c0aabe086d
---
 lib/cinder                   | 6 ++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 9c818c6eb2..de67593f72 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -40,6 +40,7 @@ fi
 # set up default directories
 GITDIR["python-cinderclient"]=$DEST/python-cinderclient
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["python-brick-cinderclient-ext"]=$DEST/python-brick-cinderclient-ext
 CINDER_DIR=$DEST/cinder
 
 # Cinder virtual environment
@@ -466,6 +467,11 @@ function install_cinder {
 
 # install_cinderclient() - Collect source and prepare
 function install_cinderclient {
+    if use_library_from_git "python-brick-cinderclient-ext"; then
+        git_clone_by_name "python-brick-cinderclient-ext"
+        setup_dev_lib "python-brick-cinderclient-ext"
+    fi
+
     if use_library_from_git "python-cinderclient"; then
         git_clone_by_name "python-cinderclient"
         setup_dev_lib "python-cinderclient"
diff --git a/stackrc b/stackrc
index 8e1900dd94..969d77d95c 100644
--- a/stackrc
+++ b/stackrc
@@ -285,6 +285,10 @@ TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
 GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
+# os-brick client for local volume attachement
+GITREPO["python-brick-cinderclient-ext"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
+GITBRANCH["python-brick-cinderclient-ext"]=${CINDERCLIENT_BRANCH:-master}
+
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
 GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index a979c346b8..bb58088ef3 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -42,7 +42,7 @@ ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
-ALL_LIBS+=" diskimage-builder os-vif"
+ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 38245da0b8ab1a08ae192ef2c0d5755a8f88841a Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 26 May 2016 17:55:14 -0400
Subject: [PATCH 1400/3333] Fix typo in local variable name in time_stop

This didn't break functionality but it would use a global instead
of a local variable so nested calls to time_* might have issues.

Change-Id: If61ef07c4ce15f1a356975a0b0611fdf5e49109a
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 9973d8ff03..3fdd71bffc 100644
--- a/functions-common
+++ b/functions-common
@@ -2371,7 +2371,7 @@ function time_start {
 function time_stop {
     local name
     local end_time
-    local elpased_time
+    local elapsed_time
     local total
     local start_time
 

From 35f0f09f005e9879d73ba6242cbf8e5409ff70a6 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 28 May 2016 07:05:56 +0000
Subject: [PATCH 1401/3333] Updated from generate-devstack-plugins-list

Change-Id: Ifc10b6f4281f40749f917e7707eab816c3c11876
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e58643fcea..5f796aec15 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -71,6 +71,7 @@ manila                                 `git://git.openstack.org/openstack/manila
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
+monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__

From c47bd1df65d6c327a34d1a9cd771940595bf8c87 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Sun, 29 May 2016 00:01:01 -0700
Subject: [PATCH 1402/3333] Remove verbose setting from l3 service plugin

This is following the nail:
http://lists.openstack.org/pipermail/openstack-dev/2016-May/095166.html

Change-Id: I4380279992e53ec9926bbcba5524e98f5c96ce8b
---
 lib/neutron_plugins/services/l3 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..a53995ef25 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -91,7 +91,6 @@ function _configure_neutron_l3_agent {
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
-    iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then

From 47bf3f931c60237f50f717e4885c2b64590e3160 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 1 Jun 2016 07:01:00 +0000
Subject: [PATCH 1403/3333] Updated from generate-devstack-plugins-list

Change-Id: If7c8f6162d3e846a360cc7f34ce2ebf52054f45f
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5f796aec15..2760f854a4 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -61,6 +61,7 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
@@ -70,6 +71,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__

From 72b233c1e042dd55cc7e7785f2e1ecd6ae4fc1aa Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 1 Jun 2016 16:43:07 +0200
Subject: [PATCH 1404/3333] Allow to use Fedora 24 with devstack

Looks like f24 does not have any special change compared to the
previous release, we just need to add f24 where f23 present.

Change-Id: Ia4a58de4973ef228735c48b33453a0562dc65258
---
 files/rpms/general   | 4 ++--
 files/rpms/nova      | 2 +-
 files/rpms/swift     | 2 +-
 lib/ceph             | 2 +-
 stack.sh             | 2 +-
 tools/install_pip.sh | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index 2d4a97a743..ee2e8a058b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,9 +7,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f22,f23
+iptables-services  # NOPRIME f22,f23,f24
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f22,f23
+java-1.8.0-openjdk-headless  # NOPRIME f22,f23,f24
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 0312e856dd..594393e733 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f22,f23
+kernel-modules # dist:f22,f23,f24
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 46dc59d74d..1e05167bcf 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f22,f23
+rsync-daemon # dist:f22,f23,f24
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/ceph b/lib/ceph
index 3e0839aaa2..e999647ed8 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f22|f23) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f22|f23|f24) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index 68e3d936b8..173628ebba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -185,7 +185,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|f24|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dfa4f42573..12676998d2 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -116,7 +116,7 @@ get_versions
 
 # Eradicate any and all system packages
 
-# Python in f23 and f22 depends on the python-pip package so removing it
+# Python in fedora depends on the python-pip package so removing it
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
 if ! is_fedora ; then

From 07dc2bf7760fa1c5b28d2dd71fb4eebd7a8921f2 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 1 Jun 2016 12:21:00 +0200
Subject: [PATCH 1405/3333] functions-libvirt: Add log filter to capture CPU
 driver errors

Two things:

  (a) Add the log filter to capture libvirt CPU manipulation driver
      related error messages when things fallout (e.g. CPU model
      comparision failures during live migration).

  (b) While we're at it, remove the "1:qemu_monitor" log filter, because
      the existing filter "1:qemu" should take care of logging the
      interactions with QEMU monitor console.  This is the case since
      the introduction of VIR_LOG_INIT() macro in upstream libvirt,
      which performs a substring match on a given file name.  (Available
      from libvirt version v1.2.10 onwards).

Change-Id: I75befd52d9f892eb5a6236eee9a397fab7602ecc
---
 lib/nova_plugins/functions-libvirt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dbb4d4fb4b..09723db166 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -108,9 +108,9 @@ EOF
             # source file paths, not relative paths. This screws with the matching
             # of '1:libvirt' making everything turn on. So use libvirt.c for now.
             # This will have to be re-visited when Ubuntu ships libvirt >= 1.2.3
-            local log_filters="1:libvirt.c 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
+            local log_filters="1:libvirt.c 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:cpu"
         else
-            local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
+            local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:cpu"
         fi
         local log_outputs="1:file:/var/log/libvirt/libvirtd.log"
         if ! sudo grep -q "^log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then

From 09604349f89f59ee2ac07b4daa93bd1ae52d1b79 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Thu, 2 Jun 2016 10:29:43 -0400
Subject: [PATCH 1406/3333] Change ovs_base neutron plugin to use vercmp

This plugin was using a deprecated function, vercmp_numbers(),
that wasn't actually working properly because the call to
'deprecated' at the beginning was causing garbage to be
returned to the caller.  For example, this was always in
stack.sh.log when using OVS:

.../lib/neutron_plugins/ovs_base: line 57: [: too many arguments

Update to use vercmp() like all other users in devstack, and
remove all the old code.

Change-Id: I352362cf59e492fa9f7725190f0243f2436ac347
---
 functions                    | 55 ------------------------------------
 lib/neutron_plugins/ovs_base |  2 +-
 2 files changed, 1 insertion(+), 56 deletions(-)

diff --git a/functions b/functions
index 8cdd6d8171..aa12e1e826 100644
--- a/functions
+++ b/functions
@@ -511,61 +511,6 @@ function check_path_perm_sanity {
 }
 
 
-# This function recursively compares versions, and is not meant to be
-# called by anything other than vercmp_numbers below. This function does
-# not work with alphabetic versions.
-#
-# _vercmp_r sep ver1 ver2
-function _vercmp_r {
-    typeset sep
-    typeset -a ver1=() ver2=()
-    sep=$1; shift
-    ver1=("${@:1:sep}")
-    ver2=("${@:sep+1}")
-
-    if ((ver1 > ver2)); then
-        echo 1; return 0
-    elif ((ver2 > ver1)); then
-        echo -1; return 0
-    fi
-
-    if ((sep <= 1)); then
-        echo 0; return 0
-    fi
-
-    _vercmp_r $((sep-1)) "${ver1[@]:1}" "${ver2[@]:1}"
-}
-
-
-# This function compares two versions and is meant to be called by
-# external callers. Please note the function assumes non-alphabetic
-# versions. For example, this will work:
-#
-#   vercmp_numbers 1.10 1.4
-#
-# The above will return "1", as 1.10 is greater than 1.4.
-#
-#   vercmp_numbers 5.2 6.4
-#
-# The above will return "-1", as 5.2 is less than 6.4.
-#
-#   vercmp_numbers 4.0 4.0
-#
-# The above will return "0", as the versions are equal.
-#
-# vercmp_numbers ver1 ver2
-function vercmp_numbers {
-    typeset v1=$1 v2=$2 sep
-    typeset -a ver1 ver2
-
-    deprecated "vercmp_numbers is deprecated for more generic vercmp"
-
-    IFS=. read -ra ver1 <<< "$v1"
-    IFS=. read -ra ver2 <<< "$v2"
-
-    _vercmp_r "${#ver1[@]}" "${ver1[@]}" "${ver2[@]}"
-}
-
 # vercmp ver1 op ver2
 #  Compare VER1 to VER2
 #   - op is one of < <= == >= >
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 59c7737181..95f4663a52 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -54,7 +54,7 @@ function _neutron_ovs_base_install_ubuntu_dkms {
     local kernel_major_minor
     kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
     # From kernel 3.13 on, openvswitch-datapath-dkms is not needed
-    if [ `vercmp_numbers "$kernel_major_minor" "3.13"` -lt "0" ]; then
+    if vercmp '$kernel_major_minor' '<' '3.13'; then
         install_package "dkms openvswitch-datapath-dkms linux-headers-$kernel_version"
     fi
 }

From 7e603d1bf8689a50ffa3dd93c901a71ea5f5ae36 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 1 Jun 2016 18:16:14 -0400
Subject: [PATCH 1407/3333] Move tempest plugin install to the end

For the tempest plugin install inside the tox venv to hold we need to
ensure that it's the last thing run that touches the tox venv before
devstack ends. Otherwise there is a chance we'll recreate the venv in
a later step of installing and configuring tempest. This commit
moves the plugin installation into it's own function and calls that
function as last phase of the tempest setup to make sure it runs last.

Change-Id: Ie253171537e8c5a9887cc30aba1cad4b31e57663
---
 extras.d/80-tempest.sh | 2 ++
 lib/tempest            | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index fcf79bd4d9..6a3d121497 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -13,6 +13,8 @@ if is_service_enabled tempest; then
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
+        echo_summary "Installing Tempest Plugins"
+        install_tempest_plugins
     elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
         # local.conf Tempest option overrides
         :
diff --git a/lib/tempest b/lib/tempest
index 6f8e29395c..c492182fee 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,6 +600,12 @@ function install_tempest {
     # running pip install -U on tempest requirements
     $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    popd
+}
+
+# install_tempest_plugins() - Install any specified plugins into the tempest venv
+function install_tempest_plugins {
+    pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"

From 6176ae6895c3c62e9406ebca0055fed9a58f35d1 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Wed, 18 May 2016 12:10:08 +0200
Subject: [PATCH 1408/3333] Use transport_url instead of driver-specif options

Future oslo.messaging is going to deprecate usage of driver-specific
options for hosts/port/user/password options.

This change uses transport_url that exists since a while now and
works with all drivers (even devstack handles only the rabbit one).

Change-Id: I3006b96ff93a3468249177c31c359c2f9ddc5db6
---
 lib/nova        | 2 +-
 lib/rpc_backend | 9 ++++-----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index de898b23fd..e928cf264c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -639,7 +639,7 @@ function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
-        iniset $NOVA_CELLS_CONF oslo_messaging_rabbit rabbit_virtual_host child_cell
+        iniset_rpc_backend nova $NOVA_CELLS_CONF DEFAULT child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
         iniset $NOVA_CELLS_CONF cells cell_type compute
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 05e303e3e7..0ee46dca6f 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -104,8 +104,9 @@ function restart_rpc_backend {
 
 # builds transport url string
 function get_transport_url {
+    local virtual_host=$1
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
-        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/"
+        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/$virtual_host"
     fi
 }
 
@@ -114,11 +115,9 @@ function iniset_rpc_backend {
     local package=$1
     local file=$2
     local section=${3:-DEFAULT}
+    local virtual_host=$4
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
-        iniset $file $section rpc_backend "rabbit"
-        iniset $file oslo_messaging_rabbit rabbit_hosts $RABBIT_HOST
-        iniset $file oslo_messaging_rabbit rabbit_password $RABBIT_PASSWORD
-        iniset $file oslo_messaging_rabbit rabbit_userid $RABBIT_USERID
+        iniset $file $section transport_url $(get_transport_url "$virtual_host")
         if [ -n "$RABBIT_HEARTBEAT_TIMEOUT_THRESHOLD" ]; then
             iniset $file oslo_messaging_rabbit heartbeat_timeout_threshold $RABBIT_HEARTBEAT_TIMEOUT_THRESHOLD
         fi

From 214459cdf776a77dacd70a9205c5b8a6ceaff31a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 2 Jun 2016 10:29:59 -0400
Subject: [PATCH 1409/3333] remove addition of gate64 cpu

Nova has been fixed to not need this work around. We shouldn't keep it
in devstack.

Change-Id: Ie2b1c6b8ddce4a2fd94af06745d59455208f0633
---
 lib/nova_plugins/functions-libvirt | 15 +----
 tools/cpu_map_update.py            | 88 ------------------------------
 2 files changed, 3 insertions(+), 100 deletions(-)
 delete mode 100755 tools/cpu_map_update.py

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dbb4d4fb4b..b4a7a7b28f 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -121,18 +121,9 @@ EOF
         fi
     fi
 
-    # Update the libvirt cpu map with a gate64 cpu model. This enables nova
-    # live migration for 64bit guest OSes on heterogenous cloud "hardware".
-    if [[ -f /usr/share/libvirt/cpu_map.xml ]] ; then
-        sudo $TOP_DIR/tools/cpu_map_update.py /usr/share/libvirt/cpu_map.xml
-    fi
-
-    # libvirt detects various settings on startup, as we potentially changed
-    # the system configuration (modules, filesystems), we need to restart
-    # libvirt to detect those changes. Use a stop start as otherwise the new
-    # cpu_map is not loaded properly on some systems (Ubuntu).
-    stop_service $LIBVIRT_DAEMON
-    start_service $LIBVIRT_DAEMON
+    # Service needs to be started on redhat/fedora -- do a restart for
+    # sanity after fiddling the config.
+    restart_service $LIBVIRT_DAEMON
 }
 
 
diff --git a/tools/cpu_map_update.py b/tools/cpu_map_update.py
deleted file mode 100755
index 92b7b8f9a3..0000000000
--- a/tools/cpu_map_update.py
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/usr/bin/env python
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-# This small script updates the libvirt CPU map to add a gate64 cpu model
-# that can be used to enable a common 64bit capable feature set across
-# devstack nodes so that features like nova live migration work.
-
-import sys
-import xml.etree.ElementTree as ET
-from xml.dom import minidom
-
-
-def update_cpu_map(tree):
-    root = tree.getroot()
-    cpus = root#.find("cpus")
-    x86 = None
-    for arch in cpus.findall("arch"):
-        if arch.get("name") == "x86":
-            x86 = arch
-            break
-    if x86 is not None:
-        # Create a gate64 cpu model that is core2duo less monitor, pse36,
-        # vme, and ssse3.
-        gate64 = ET.SubElement(x86, "model")
-        gate64.set("name", "gate64")
-        ET.SubElement(gate64, "vendor").set("name", "Intel")
-        ET.SubElement(gate64, "feature").set("name", "fpu")
-        ET.SubElement(gate64, "feature").set("name", "de")
-        ET.SubElement(gate64, "feature").set("name", "pse")
-        ET.SubElement(gate64, "feature").set("name", "tsc")
-        ET.SubElement(gate64, "feature").set("name", "msr")
-        ET.SubElement(gate64, "feature").set("name", "pae")
-        ET.SubElement(gate64, "feature").set("name", "mce")
-        ET.SubElement(gate64, "feature").set("name", "cx8")
-        ET.SubElement(gate64, "feature").set("name", "apic")
-        ET.SubElement(gate64, "feature").set("name", "sep")
-        ET.SubElement(gate64, "feature").set("name", "pge")
-        ET.SubElement(gate64, "feature").set("name", "cmov")
-        ET.SubElement(gate64, "feature").set("name", "pat")
-        ET.SubElement(gate64, "feature").set("name", "mmx")
-        ET.SubElement(gate64, "feature").set("name", "fxsr")
-        ET.SubElement(gate64, "feature").set("name", "sse")
-        ET.SubElement(gate64, "feature").set("name", "sse2")
-        ET.SubElement(gate64, "feature").set("name", "mtrr")
-        ET.SubElement(gate64, "feature").set("name", "mca")
-        ET.SubElement(gate64, "feature").set("name", "clflush")
-        ET.SubElement(gate64, "feature").set("name", "pni")
-        ET.SubElement(gate64, "feature").set("name", "nx")
-        ET.SubElement(gate64, "feature").set("name", "syscall")
-        ET.SubElement(gate64, "feature").set("name", "lm")
-
-
-def format_xml(root):
-    # Adapted from http://pymotw.com/2/xml/etree/ElementTree/create.html
-    # thank you dhellmann
-    rough_string = ET.tostring(root, encoding="UTF-8")
-    dom_parsed = minidom.parseString(rough_string)
-    return dom_parsed.toprettyxml("  ", encoding="UTF-8")
-
-
-def main():
-    if len(sys.argv) != 2:
-        raise Exception("Must pass path to cpu_map.xml to update")
-    cpu_map = sys.argv[1]
-    tree = ET.parse(cpu_map)
-    for model in tree.getroot().iter("model"):
-        if model.get("name") == "gate64":
-            # gate64 model is already present
-            return
-    update_cpu_map(tree)
-    pretty_xml = format_xml(tree.getroot())
-    with open(cpu_map, 'w') as f:
-        f.write(pretty_xml)
-
-
-if __name__ == "__main__":
-    main()

From 9ee1426847569637346610512fb8c9cd7bbefbb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <michal.dulko@intel.com>
Date: Fri, 3 Jun 2016 15:34:50 +0200
Subject: [PATCH 1410/3333] Set my_ip in cinder.conf

Cinder uses my_ip config option to provide iscsi_targets. It gets
defaulted to the IP of the first interface in the system, which is fine
for some cases, but for example with Vagrant first interface can be used
only to contact with host machine.

To get over it we should set my_ip to HOST_IP from local.conf and this
commit implements that.

Change-Id: I4d2960d92f388ac689dfa6b436dc8bfc1e129fbf
Closes-Bug: 1588825
---
 lib/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cinder b/lib/cinder
index de67593f72..bcf240953b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -270,6 +270,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
+    iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 

From 22c695f08a82d527668ef906e11089e6b0046a50 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Wed, 11 May 2016 12:49:07 -0500
Subject: [PATCH 1411/3333] Have a way to disable Glance v1 in devstack

As part of the process of deprecating Glance's V1, the glance team would
like to start testing V2-only environments. Therefore, this change
provides a way to force other services to use V2.

Change-Id: I87e77d07964eac01e9a796817cbc88bd6e59c721
---
 lib/cinder  | 4 ++++
 lib/glance  | 7 +++++++
 lib/tempest | 3 +++
 3 files changed, 14 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 17862327c4..7763599bae 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -342,6 +342,10 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
+        iniset $CINDER_CONF DEFAULT glance_api_version 2
+    fi
+
     # Register SSL certificates if provided
     if is_ssl_enabled_service cinder; then
         ensure_certificates CINDER
diff --git a/lib/glance b/lib/glance
index cda357fa66..2ad971fed7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -57,6 +57,7 @@ GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
 GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
+GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-True}
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -134,6 +135,12 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
 
+    # NOTE(flaper87): To uncomment as soon as all services consuming Glance are
+    # able to consume V2 entirely.
+    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
+        iniset $GLANCE_API_CONF DEFAULT enable_v1_api False
+    fi
+
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     if is_service_enabled g-glare; then
diff --git a/lib/tempest b/lib/tempest
index e556935cb5..19042ef0c2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -292,6 +292,9 @@ function configure_tempest {
 
     # Image Features
     iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True
+    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
+        iniset $TEMPEST_CONFIG image-feature-enabled api_v1 False
+    fi
 
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED

From b97a60e90c46c101b6c2c9a5dbf42140bd8bb8d1 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Fri, 3 Jun 2016 15:59:11 -0500
Subject: [PATCH 1412/3333] Keystone uwsgi performance tuning

I ran some tests locally that showed that when using the uwsgi
deploy the keystone server wasn't using all the processes
available. When I switched from "threads" to "processes" the
concurrent performance improved considerably. So I'm proposing
that devstack switch to processes to improve performance.

Change-Id: I8cfe9272e098e636441b7cfb51bff08d62c3336e
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index c94bcd3a71..26fa1d43da 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -318,10 +318,10 @@ function configure_keystone {
         fi
 
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi processes $(nproc)
 
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi processes $API_WORKERS
 
         # Common settings
         for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do

From a1c70f2a7519bd7482b2834f380f2a9f5f61fb5a Mon Sep 17 00:00:00 2001
From: Angus Lees <gus@inodes.org>
Date: Tue, 31 May 2016 14:43:14 +1000
Subject: [PATCH 1413/3333] neutron-legacy: Consistently use `--config-file
 foo`

This change adjusts a few instances of `--config-file=foo` to
`--config-file foo` (no `=`) in order to make neutron command
lines more consistent and easier to match in sudoers/rootwrap
filters.

This is particularly useful for oslo.privsep, which needs to start a
helper command with the same `--config-file` arguments (see
Ia9675dff9232e0e987a836ecaf9e842eb5c3cb18).

Change-Id: I91fe18f66f3c3bc2ccd1ca8be91be2915ed3e3ec
---
 lib/neutron-legacy              | 8 ++++----
 lib/neutron_plugins/services/l3 | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5e5207bc63..73123ef1d5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -297,7 +297,7 @@ function _determine_config_server {
 }
 
 function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
     if is_service_enabled q-fwaas; then
         opts+=" --config-file $Q_FWAAS_CONF_FILE"
     fi
@@ -524,7 +524,7 @@ function start_mutnauq_l2_agent {
 }
 
 function start_mutnauq_other_agents {
-    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
+    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
 
     if is_service_enabled neutron-vpnaas; then
         :  # Started by plugin
@@ -532,8 +532,8 @@ function start_mutnauq_other_agents {
         run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
     fi
 
-    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
-    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
+    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
+    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file $LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..3a6f6eb53f 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -83,7 +83,7 @@ SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
     echo "$opts"
 }
 

From f179eb7c4798d5058ebbfd1c7b851070f86fd5ac Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 2 Jun 2016 01:24:22 -0700
Subject: [PATCH 1414/3333] Support installing OpenStack on XenServer 7.0

XenServer 7.0 has changed some iso files' name, this made devstack script
install_os_domU.sh failed to install VM before installing OpenStack. This
patch is to fix the problem, make install_os_domU.sh support 7.0 and other
prior versions of XenServer

Change-Id: I49459bfff2b101fc6927eb4578c5eb47cc8c3ad6
---
 tools/xen/install_os_domU.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 8b97265e21..3a61215b5b 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -183,10 +183,8 @@ if [ -z "$templateuuid" ]; then
         # Copy the tools DEB to the XS web server
         XS_TOOLS_URL="https://github.com/downloads/citrix-openstack/warehouse/xe-guest-utilities_5.6.100-651_amd64.deb"
         ISO_DIR="/opt/xensource/packages/iso"
-        XS_TOOLS_FILE_NAME="xs-tools.deb"
-        XS_TOOLS_PATH="/root/$XS_TOOLS_FILE_NAME"
         if [ -e "$ISO_DIR" ]; then
-            TOOLS_ISO=$(ls -1 $ISO_DIR/xs-tools-*.iso | head -1)
+            TOOLS_ISO=$(ls -1 $ISO_DIR/*-tools-*.iso | head -1)
             TMP_DIR=/tmp/temp.$RANDOM
             mkdir -p $TMP_DIR
             mount -o loop $TOOLS_ISO $TMP_DIR

From 84409516d56417464dfe0c4e6904a1a76f9fa254 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 18 Aug 2015 17:24:44 -0400
Subject: [PATCH 1415/3333] Remove fwaas from DevStack

Depends-On: Iadcee07e873fcb4f099ebccc2e33780e74438140
Change-Id: Ic60cd1fa90c19dfac00be583e2ddc5633dbb68a3
---
 lib/neutron-legacy                    | 25 --------------------
 lib/neutron_plugins/services/firewall | 33 ---------------------------
 2 files changed, 58 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/firewall

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7eb8637634..5f117631cf 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -101,7 +101,6 @@ AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
 # loaded from per-plugin  scripts in lib/neutron_plugins/
 Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
 Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
-Q_FWAAS_CONF_FILE=$NEUTRON_CONF_DIR/fwaas_driver.ini
 Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
 
 # Default name for Neutron database
@@ -267,13 +266,8 @@ source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
 # Hardcoding for 1 service plugin for now
 source $TOP_DIR/lib/neutron_plugins/services/metering
 
-# Firewall Service Plugin functions
-# ---------------------------------
-source $TOP_DIR/lib/neutron_plugins/services/firewall
-
 # L3 Service functions
 source $TOP_DIR/lib/neutron_plugins/services/l3
-
 # Use security group or not
 if has_neutron_plugin_security_group; then
     Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
@@ -334,10 +328,6 @@ function configure_mutnauq {
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
-    if is_service_enabled q-fwaas; then
-        deprecated "Configuring q-fwaas through devstack is deprecated"
-        _configure_neutron_fwaas
-    fi
     if is_service_enabled q-agt q-svc; then
         _configure_neutron_service
     fi
@@ -435,10 +425,6 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
-    if is_service_enabled q-fwaas; then
-        git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
-        setup_develop $NEUTRON_FWAAS_DIR
-    fi
     if is_service_enabled q-lbaas; then
         git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
         setup_develop $NEUTRON_LBAAS_DIR
@@ -580,9 +566,6 @@ function stop_mutnauq_other {
     if is_service_enabled q-lbaas; then
         neutron_lbaas_stop
     fi
-    if is_service_enabled q-fwaas; then
-        neutron_fwaas_stop
-    fi
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
@@ -877,14 +860,6 @@ function _configure_neutron_metering {
     neutron_agent_metering_configure_agent
 }
 
-function _configure_neutron_fwaas {
-    if [ -f $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf ]; then
-        cp $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf $NEUTRON_CONF_DIR
-    fi
-    neutron_fwaas_configure_common
-    neutron_fwaas_configure_driver
-}
-
 function _configure_dvr {
     iniset $NEUTRON_CONF DEFAULT router_distributed True
     iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
deleted file mode 100644
index 40968fa04c..0000000000
--- a/lib/neutron_plugins/services/firewall
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-
-# Neutron firewall plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_FIREWALL=$(set +o | grep xtrace)
-set +o xtrace
-
-FWAAS_PLUGIN=${FWAAS_PLUGIN:-neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin}
-FWAAS_DRIVER=${FWAAS_DRIVER:-neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver}
-
-function neutron_fwaas_configure_common {
-    _neutron_service_plugin_class_add $FWAAS_PLUGIN
-}
-
-function neutron_fwaas_configure_driver {
-    # Uses oslo config generator to generate FWaaS sample configuration files
-    (cd $NEUTRON_FWAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    FWAAS_DRIVER_CONF_FILENAME=/etc/neutron/fwaas_driver.ini
-    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini.sample $FWAAS_DRIVER_CONF_FILENAME
-
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "$FWAAS_DRIVER"
-}
-
-function neutron_fwaas_stop {
-    :
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_FIREWALL

From 8063fee829d1e22bb7958599d8b0359846cde462 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 24 May 2016 11:27:36 -0700
Subject: [PATCH 1416/3333] Add neutron-metering agent and configuration

This is the equivalent of the q-metering from neutron-legacy

Change-Id: Ie2ad6e18cfd6f5cd9af0da30bc36a1cd27e39189
---
 lib/neutron | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index fa2e926995..966bb54b81 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -242,6 +242,13 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
     fi
 
+    # Metering
+    if is_service_enabled neutron-metering; then
+        source $TOP_DIR/neutron_plugins/services/metering
+        neutron_agent_metering_configure_common
+        neutron_agent_metering_configure_agent
+    fi
+
 }
 
 # configure_neutron_rootwrap() - configure Neutron's rootwrap
@@ -428,6 +435,10 @@ function start_neutron_new {
     if is_service_enabled neutron-metadata-agent; then
         run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
     fi
+
+    if is_service_enabled neutron-metering; then
+        run_process neutron-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
+    fi
 }
 
 # stop_neutron() - Stop running processes (non-screen)

From f90c8e105ba71fb8ac019b61d2a0bb94d9164169 Mon Sep 17 00:00:00 2001
From: Mike Turek <mjturek@linux.vnet.ibm.com>
Date: Tue, 19 Jan 2016 19:28:51 +0000
Subject: [PATCH 1417/3333] Set deploywait_timeout via localrc option

Currently a hardcoded value is used for the DEPLOYWAIT timeout in
tempest. The patch in review 269249 adds a config option to use
instead of this hardcoded value. This patch allows the value to be
set via the BUILD_TIMEOUT variable.

Change-Id: Id79014fd6e07f93029111f6c28e3537e2e39be9f
Related-Bug: 1526466
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index fd98c948f2..621bd625f0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -462,6 +462,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
         iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal deploywait_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 36afed43534e5f50e0598ff69c7ea8249c24b5c2 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Mon, 6 Jun 2016 20:17:48 -0700
Subject: [PATCH 1418/3333] Set ima_disk_format to vhd when hypervisor is
 XenServer

When running tempest testcase test_minimum_basic_scenario will always fail
due to lack of configuration [scenario] img_disk_format=vhd in tempest.conf
This patchset is to add this configuration when XenServer is used.

Change-Id: I4b916200e6eefb62f148ec8b644fb23ffc7e00a6
Closes-Bug: #1589787
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index c492182fee..1bb70c16ae 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -290,6 +290,7 @@ function configure_tempest {
     fi
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
+        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
     fi
 
     # Image Features

From a44dd9a741a08d9f586ae8fe1d2543bcf32f6593 Mon Sep 17 00:00:00 2001
From: Timur Sufiev <tsufiev@mirantis.com>
Date: Fri, 29 Apr 2016 14:08:51 +0300
Subject: [PATCH 1419/3333] Support Glance CORS options in devstack
 configuration

To properly test the integration between Glance CORS feature and
Horizon Javascript environment uploading image files directly to Glance
(using this feature), we need to enable CORS support for Glance in
integration tests. Adding corresponding Devstack variable to configure
Glance in such a way that it accepts direct requests from Horizon
Javascript is the prerequisite step for the integration testing of this
feature.

By default Horizon and Glance are located on the same host, hence
default value cors.allowed_origin = http://$SERVICE_HOST should work.
If a more complicated setup is desired, where Horizon is located on a
different host, GLANCE_CORS_ALLOWED_ORIGIN environment variable should
be exported to Devstack.

Partially implements blueprint: horizon-glance-large-image-upload
Change-Id: I4881fb6631c2daa2ad8946210eff4bb021957374
---
 lib/glance | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/glance b/lib/glance
index f2a6db6edc..ce5f867430 100644
--- a/lib/glance
+++ b/lib/glance
@@ -143,6 +143,13 @@ function configure_glance {
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
 
+    # CORS feature support - to allow calls from Horizon by default
+    if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
+        iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
+    else
+        iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
+    fi
+
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift

From 026cad84a34ff914707538470ec3ae6e2015e54b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 7 Jun 2016 10:55:54 -0400
Subject: [PATCH 1420/3333] remove local.conf documentation for phases we don't
 implement

The local.conf docs talk about phases which don't exist for config
file processing, which makes it more confusing then it needs to be.

Change-Id: If7f9255eab0535c3d57a2fd5f1bc18ba4d0801aa
---
 doc/source/configuration.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 384ceee41a..1161b344e2 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -36,10 +36,6 @@ The defined phases are:
 
 -  **local** - extracts ``localrc`` from ``local.conf`` before
    ``stackrc`` is sourced
--  **pre-install** - runs after the system packages are installed but
-   before any of the source repositories are installed
--  **install** - runs immediately after the repo installations are
-   complete
 -  **post-config** - runs after the layer 2 services are configured and
    before they are started
 -  **extra** - runs after services are started and before any files in

From e34ec9901ea04b4fab81742f9556e486849dfb4e Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 7 Jun 2016 12:36:50 -0400
Subject: [PATCH 1421/3333] Neutron/l3 - die if provider settings for v6 are
 not set

If you are using provider networking, and have IP_VERSION set to include
IPv6 (which we do by default) - you must set the required variables.

If you do not want this behavior, set IP_VERSION=4

This arose from a third party CI system which was configured[1] to have
provider networking, but would explode when hitting the router IPv6
setup step[2] since there was no IPv6 subnet created, and IPV6_SUBNET_ID
would be empty, causing a python-neutronclient error and causing
stack.sh to exit.

[1]: http://paste.openstack.org/show/508710/
[2]: https://github.com/openstack-dev/devstack/blob/c35110e7c5c35dd1edc310dc3d0bb8693e58d336/lib/neutron_plugins/services/l3#L320

Change-Id: I267799b62284c3086ed7c3e2d8a9cbadb9ddcd60
---
 lib/neutron_plugins/services/l3 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..dbd2b45d15 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -150,7 +150,9 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
-        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
+            die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
             SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi

From 75ace7a5edbb6496633b97dc1d6b60e000ff3e5f Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Tue, 7 Jun 2016 17:44:06 -0500
Subject: [PATCH 1422/3333] Correct keystone memcached host setting

keystone was configured to connect to memcached on the host IP
address. Unfortunately, memcached is only listening on localhost,
so this setting actually hurts performance as keystone fails to
connect to the memcached server. There's no indication of this in
the keystone logs since this is just how memcache client works
(ignoring errors).

You can verify this by
1) in /etc/memcached.conf, set -vv
2) restart memcached: service memcached restart
3) watch /var/log/memcached.log
4) There will be no output

with this change, there will be output in /var/log/memcached.log

Also the performance should be a lot better.

Change-Id: I95d798d122e2a95e27eb1d2c4e786c3cd844440b
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index c94bcd3a71..5695004c4a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -246,7 +246,7 @@ function configure_keystone {
     # Enable caching
     iniset $KEYSTONE_CONF cache enabled "True"
     iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
-    iniset $KEYSTONE_CONF cache memcache_servers $SERVICE_HOST:11211
+    iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
     # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617
     iniset $KEYSTONE_CONF catalog caching "False"

From febd55a230982bd5a5de9bbf2444b1aa5c459ba3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 8 Jun 2016 07:11:03 +0000
Subject: [PATCH 1423/3333] Updated from generate-devstack-plugins-list

Change-Id: I4ffb619ccdd4928d0772246a7c76353f21be6bb4
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2760f854a4..585c91c29c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -103,6 +103,7 @@ neutron-lbaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
+nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__

From c425977a55dde6b99b07c716dc3cf82990bd4fa2 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Wed, 8 Jun 2016 16:53:06 +0100
Subject: [PATCH 1424/3333] nova.conf: set privsep helper command for os-vif
 plugins

privsep will default to invoking privsep-helper directly
via sudo, which won't work for people with a locked down
sudo config. To deal with this we should explicitly
configure the os-vif plugins to use nova-rootwrap for
running privsep-helper. This change makes such a change
for the two official in-tree os-vif plugins.

Change-Id: I3d26251206a57599385f2b9f3e0ef7d91daafe35
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index af5d1222a0..65609369a9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -483,6 +483,9 @@ function create_nova_conf {
 
     iniset $NOVA_CONF privsep_osbrick helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
 
+    iniset $NOVA_CONF vif_plug_ovs_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
+    iniset $NOVA_CONF vif_plug_linux_bridge_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
+
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From 2ae8b09b6182d2927c684adb14c84800e460c2e2 Mon Sep 17 00:00:00 2001
From: Yi Zhao <zhaoyi@cmss.chinamobile.com>
Date: Thu, 12 May 2016 12:11:24 +0800
Subject: [PATCH 1425/3333] Fix quoting in vercmp check for kernel version

I352362cf59e492fa9f7725190f0243f2436ac347 switched this to vercmp, but
using single-quote (') will mean that the kernel version isn't
actually expanded for the comparision.

I guess, like the original change, the fact it isn't working is
hidden.  Trusty seems to have 3.13 ... I can't imagine we support
anything before this ... so I'd also be happy if someone with some OVS
knowledge wants to just delete it.

(This change was originally an alternative to
I352362cf59e492fa9f7725190f0243f2436ac347 but got the quoting right)

Change-Id: I9fa514885c20b1135fb0680cf61fc04628fbecbe
Closes-Bug: #1580850
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 95f4663a52..ecf252f88b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -54,7 +54,7 @@ function _neutron_ovs_base_install_ubuntu_dkms {
     local kernel_major_minor
     kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
     # From kernel 3.13 on, openvswitch-datapath-dkms is not needed
-    if vercmp '$kernel_major_minor' '<' '3.13'; then
+    if vercmp "$kernel_major_minor" "<" "3.13" ; then
         install_package "dkms openvswitch-datapath-dkms linux-headers-$kernel_version"
     fi
 }

From 90356d82709fd5fa50d496faea978488f351ba3e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 10 Jun 2016 07:59:45 +0000
Subject: [PATCH 1426/3333] Updated from generate-devstack-plugins-list

Change-Id: I121cf87e3c4e26b4a223a3e9b8a028763994ad89
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 585c91c29c..bae2afdb39 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -64,6 +64,7 @@ group-based-policy                     `git://git.openstack.org/openstack/group-
 higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
+ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__

From 5cda4911adde3e8d6b20d90e52520d0587cf4399 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@hpe.com>
Date: Thu, 9 Jun 2016 00:33:30 +0100
Subject: [PATCH 1427/3333] Enable admin_domain_scope by default in Tempest

Tempest introduced a new ability to use domain scoped tokens for
identity v3 admin APIs. Since domain scoped tokens can be used
with the base keystone policy used in the gate, and the
pre-provisioned admin user is assigned a role on the domain, turn
the option alway on.

Change-Id: Ib1bb958eee076364b407fc03e77e6882d92147d2
Depends-on: I91ca907992428a5a14fb8d48a4fad105d2906e27
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 3cd300cca1..4ddff57135 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -261,6 +261,8 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
+    # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation
+    iniset $TEMPEST_CONFIG identity admin_domain_scope True
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"

From 0c0c09af3b14b74b035b50956e545832b26cb6af Mon Sep 17 00:00:00 2001
From: Alex Meade <mr.alex.meade@gmail.com>
Date: Fri, 13 May 2016 10:57:29 -0400
Subject: [PATCH 1428/3333] Set volume service min and max microversions

Implements Blueprint: configure-tempest-volume-microversion
Related to: I3d9b3fe288333721bf3b2c6c988949f2f253bfcc

Change-Id: I80c6a0c46c667291c6f7fe2a036717504c110314
---
 lib/tempest | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 3cd300cca1..4f065c998e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -433,6 +433,19 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
+    local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
+    local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
+    if [ "$tempest_volume_min_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG volume min_microversion
+    else
+        iniset $TEMPEST_CONFIG volume min_microversion $tempest_volume_min_microversion
+    fi
+
+    if [ "$tempest_volume_max_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG volume max_microversion
+    else
+        iniset $TEMPEST_CONFIG volume max_microversion $tempest_volume_max_microversion
+    fi
 
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False

From fd1f7ba066081eb1e2580a241f816a195c9621d3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sun, 12 Jun 2016 08:01:13 +0000
Subject: [PATCH 1429/3333] Updated from generate-devstack-plugins-list

Change-Id: Ia42329d01758cafa5d59ca79eebd5f31515bef47
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bae2afdb39..520181e2a9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -84,6 +84,7 @@ networking-calico                      `git://git.openstack.org/openstack/networ
 networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
 networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__

From a9a2f7199441d80e8d29ae9909e9b82f75f98d2e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 14 Jun 2016 08:08:37 +0000
Subject: [PATCH 1430/3333] Updated from generate-devstack-plugins-list

Change-Id: Ied84c5f38a8002228e01797d56c39315ff997142
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 520181e2a9..0ceb829d96 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -71,6 +71,7 @@ magnum                                 `git://git.openstack.org/openstack/magnum
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__

From 1d23b93568e113169da54cff31ff8a2908648c02 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 13 Jun 2016 09:09:44 +0100
Subject: [PATCH 1431/3333] Fix brick cinderclient override

CINDERCLIENT_REPO cannot refer to both python-cinderclient.git
and python-brick-cinderclient-ext.git so make sure
the overrides have different names.

Bug introduced by: I6d0f09950ea1200d3367a53aa4a3eea9be7abc66

Change-Id: I9cbbf71ba08ef5394537d7b294846faa3c5be5bd
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 969d77d95c..7a5b821d4e 100644
--- a/stackrc
+++ b/stackrc
@@ -286,8 +286,8 @@ GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python
 GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
 # os-brick client for local volume attachement
-GITREPO["python-brick-cinderclient-ext"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
-GITBRANCH["python-brick-cinderclient-ext"]=${CINDERCLIENT_BRANCH:-master}
+GITREPO["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
+GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
 
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}

From 9a0d1f90b8f0b412ebe3fa8a154f1c9222b2dde8 Mon Sep 17 00:00:00 2001
From: ricolin <rico.l@inwinstack.com>
Date: Wed, 15 Jun 2016 01:13:45 +0800
Subject: [PATCH 1432/3333] Remove deprecated auth_plugin config

Config auth_plugin in trustee group is deprecated.
Change to use auth_type in trustee group instead.
Closes-Bug: 1592482

Change-Id: Ib90d9c0299887201b37d26254693dc6b007a41dc
---
 lib/heat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/heat b/lib/heat
index 730adada26..c841e0a499 100644
--- a/lib/heat
+++ b/lib/heat
@@ -156,7 +156,7 @@ function configure_heat {
     # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure
     # the section for the client plugin associated with the trustee
     if [ -z "$HEAT_DEFERRED_AUTH" -o "trusts" == "$HEAT_DEFERRED_AUTH" ]; then
-        iniset $HEAT_CONF trustee auth_plugin password
+        iniset $HEAT_CONF trustee auth_type password
         iniset $HEAT_CONF trustee auth_url $KEYSTONE_AUTH_URI
         iniset $HEAT_CONF trustee username $HEAT_TRUSTEE_USER
         iniset $HEAT_CONF trustee password $HEAT_TRUSTEE_PASSWORD

From 1c4c16ce539b73f3e198cc4f2cc74de1bb9deb13 Mon Sep 17 00:00:00 2001
From: "watanabe.isao" <watanabe_isao@jp.fujitsu.com>
Date: Wed, 8 Jun 2016 14:18:10 +0900
Subject: [PATCH 1433/3333] Don't configure router in flat network

Due to the fix [1] of neutron-refactor, some flat network usages of devstack
installation start fale.

This fix enables ML2_L3_PLUGIN to be set to empty to solve the problem.

By default l3_router_plugin.L3RouterPlugin will be set to ML2_L3_PLUGIN,
and for neutron, in such of configuration, router (ASA some others) will be
set into supported_extension_aliases,
then devstack will create a router that we do not want in a flat network.

Before fix [1], we can disable q-l3 to aviod the issue.
But now we don't, and we need this fix to disable the whole L3 plugin.

[1] https://review.openstack.org/318145

Change-Id: I61a2142d5121e0af4cc6cdf50e6bceafaf791fb0
---
 lib/neutron_plugins/ml2 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 30e1b036f3..b353145c7e 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -38,7 +38,9 @@ Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
 Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 
 # L3 Plugin to load for ML2
-ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
+# For some flat network environment, they not want to extend L3 plugin.
+# Make sure it is able to set empty to ML2_L3_PLUGIN.
+ML2_L3_PLUGIN=${ML2_L3_PLUGIN-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
 
 function populate_ml2_config {
     CONF=$1

From 28128e2f7a509510fe4139bd1905ccf51bd0ceb8 Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Thu, 14 Apr 2016 14:23:53 +0200
Subject: [PATCH 1434/3333] Docs for devstack MacVTap agent setup

MacVTap mechanism driver and agent have been added during
Mitaka [1][2]. Now adding the related doc to run a
multinode devstack with MacVTap compute nodes.

[1] https://review.openstack.org/209538
[2] https://review.openstack.org/275306

Depends-On: I0dd4c0d34d5f1c35b397e5e392ce107fb984b0ba
Change-Id: Ie743a207a5faeab2e2a7274fda503699f3072e98
---
 doc/source/guides/neutron.rst | 100 ++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index a834314bcc..1e207970ae 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -362,6 +362,8 @@ the compute service ``nova-compute``.
 DevStack Configuration
 ----------------------
 
+.. _ovs-provider-network-controller:
+
 The following is a snippet of the DevStack configuration on the
 controller node.
 
@@ -553,3 +555,101 @@ setup, with small modifications for the interface mappings.
     LB_PHYSICAL_INTERFACE=eth0
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
+
+Using MacVTap instead of Open vSwitch
+------------------------------------------
+
+Security groups are not supported by the MacVTap agent. Due to that, devstack
+configures the NoopFirewall driver on the compute node.
+
+MacVTap agent does not support l3, dhcp and metadata agent. Due to that you can
+chose between the following deployment scenarios:
+
+Single node with provider networks using config drive and external l3, dhcp
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This scenario applies, if l3 and dhcp services are provided externally, or if
+you do not require them.
+
+
+::
+
+    [[local|localrc]]
+    HOST_IP=10.0.0.2
+    SERVICE_HOST=10.0.0.2
+    MYSQL_HOST=10.0.0.2
+    RABBIT_HOST=10.0.0.2
+    ADMIN_PASSWORD=secret
+    MYSQL_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
+
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
+    Q_USE_PROVIDER_NETWORKING=True
+
+    #Enable Neutron services
+    disable_service n-net
+    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    ENABLED_SERVICES+=,q-agt,q-svc
+
+    ## MacVTap agent options
+    Q_AGENT=macvtap
+    PHYSICAL_NETWORK=default
+
+    FIXED_RANGE="203.0.113.0/24"
+    NETWORK_GATEWAY=203.0.113.1
+    PROVIDER_SUBNET_NAME="provider_net"
+    PROVIDER_NETWORK_TYPE="vlan"
+    SEGMENTATION_ID=2010
+
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+    [macvtap]
+    physical_interface_mappings = $PHYSICAL_NETWORK:eth1
+
+    [[post-config|$NOVA_CONF]]
+    force_config_drive = True
+
+
+Multi node with MacVTap compute node
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This scenario applies, if you require OpenStack provided l3, dhcp or metadata
+services. Those are hosted on a separate controller and network node, running
+some other l2 agent technology (in this example Open vSwitch). This node needs
+to be configured for VLAN tenant networks.
+
+For OVS, a similar configuration like described in the
+:ref:`OVS Provider Network <ovs-provider-network-controller>` section can be
+used. Just add the the following line to this local.conf, which also loads
+the MacVTap mechanism driver:
+
+::
+
+    [[local|localrc]]
+    ...
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,macvtap
+    ...
+
+For the MacVTap compute node, use this local.conf:
+
+::
+
+    HOST_IP=10.0.0.3
+    SERVICE_HOST=10.0.0.2
+    MYSQL_HOST=10.0.0.2
+    RABBIT_HOST=10.0.0.2
+    ADMIN_PASSWORD=secret
+    MYSQL_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
+
+    # Services that a compute node runs
+    disable_all_services
+    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    ENABLED_SERVICES+=n-cpu,q-agt
+
+    ## MacVTap agent options
+    Q_AGENT=macvtap
+    PHYSICAL_NETWORK=default
+
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+    [macvtap]
+    physical_interface_mappings = $PHYSICAL_NETWORK:eth1

From 24e29f2265e6fd496addf00adfcc13ba8533b912 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephen.finucane@intel.com>
Date: Wed, 15 Jun 2016 14:31:51 +0100
Subject: [PATCH 1435/3333] lib/neutron-plugins: Pass conf file parameter

The 'neutron_plugin_configure_l3_agent' function expects a path to a
configuration file as a parameter. This was not done for one call,
resulting in the generation of a 'DEFAULT' file in the DevStack
directory along with an invalid L3 configuration file. Resolve this.

Change-Id: I5781cb1ec4cfc1699e61dbc324d0bdb824b56be1
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 350aed8e37..0f0ed216d0 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -99,7 +99,7 @@ function _configure_neutron_l3_agent {
 
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
-    neutron_plugin_configure_l3_agent
+    neutron_plugin_configure_l3_agent $Q_L3_CONF_FILE
 
     _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
 

From dbc6a3736ddd1ed7f453898c26c1f7c550f8f8c1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Jun 2016 08:08:45 +0000
Subject: [PATCH 1436/3333] Updated from generate-devstack-plugins-list

Change-Id: I5cd5f2bafb7ace88c28c52994c339b95904ab03b
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0ceb829d96..99681b335c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -110,6 +110,7 @@ nova-lxd                               `git://git.openstack.org/openstack/nova-l
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__

From 8906b481e0d34ae1bf64a623ce5e734f50c5f2ec Mon Sep 17 00:00:00 2001
From: Richard Theis <rtheis@us.ibm.com>
Date: Wed, 8 Jun 2016 10:28:37 -0500
Subject: [PATCH 1437/3333] Support "geneve" ML2 plugin type driver

Add support for the "geneve" ML2 plugin type driver. The
networking-ovn ML2 mechanism driver uses geneve for its
project network type. Geneve is part of core neutron but
didn't have any DevStack configuration for it. This patch
set adds the necessary options. It also removes the default
for ML2 type drivers to rely on the neutron default and
consolidates the tunnel ranges default for gre, vxlan and
geneve by using TENANT_TUNNEL_RANGES.

Change-Id: Id75651dfe57a07045a6932a0369668f33c7eef09
Partial-Bug: #1588966
---
 lib/neutron-legacy      |  6 +++---
 lib/neutron_plugins/ml2 | 12 ++++++++----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73123ef1d5..dca2e98a0c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -179,9 +179,9 @@ fi
 # GRE tunnels are only supported by the openvswitch.
 ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
 
-# If using GRE tunnels for tenant networks, specify the range of
-# tunnel IDs from which tenant networks are allocated. Can be
-# overridden in ``localrc`` in necessary.
+# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
+# specify the range of IDs from which tenant networks are
+# allocated. Can be overridden in ``localrc`` if necessary.
 TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
 
 # To use VLANs for tenant networks, set to True in localrc. VLANs
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 30e1b036f3..dcdf6789c8 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -25,14 +25,14 @@ fi
 
 # List of MechanismDrivers to load
 Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
-# List of Type Drivers to load
-Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,gre,vxlan}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options
-Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS:-vni_ranges=1001:2000}
+Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS:-vni_ranges=$TENANT_TUNNEL_RANGES}
 # Default VLAN TypeDriver options
 Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
+# Default GENEVE TypeDriver options
+Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-vni_ranges=$TENANT_TUNNEL_RANGES}
 # List of extension drivers to load, use '-' instead of ':-' to allow people to
 # explicitly override this to blank
 Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
@@ -111,7 +111,9 @@ function neutron_plugin_configure_service {
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
 
-    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
+    if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
+    fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 extension_drivers=$Q_ML2_PLUGIN_EXT_DRIVERS
 
@@ -125,6 +127,8 @@ function neutron_plugin_configure_service {
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_vlan $Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS
 
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_geneve $Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS
+
     if [[ "$Q_DVR_MODE" != "legacy" ]]; then
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent l2_population=True
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent tunnel_types=vxlan

From 21e3d1e55b3140e8b14105df05c1e5253a3d04ec Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Fri, 6 May 2016 12:35:22 -0400
Subject: [PATCH 1438/3333] Make wait_for_service more robust by checking HTTP
 response

wait_for_service just checked to see if the remote service
was started, not that it was returning data. This caused
problems when the service was behind a proxy because the
proxy would respond quickly but the service may not have
fully started.

Wait for a non-503 HTTP response code and non-7 exit code
(connection error) from curl

Return an error if a successful connection cannot be made.

Change-Id: I059a12b1b920f703f28aca0e2f352714118dee97
---
 functions | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index aa12e1e826..46a7d414a1 100644
--- a/functions
+++ b/functions
@@ -381,12 +381,24 @@ CURL_GET="${CURL_GET:-curl -g}"
 
 # Wait for an HTTP server to start answering requests
 # wait_for_service timeout url
+#
+# If the service we want is behind a proxy, the proxy may be available
+# before the service. Compliant proxies will return a 503 in this case
+# Loop until we get something else.
+# Also check for the case where there is no proxy and the service just
+# hasn't started yet. curl returns 7 for Failed to connect to host.
 function wait_for_service {
     local timeout=$1
     local url=$2
+    local rval=0
     time_start "wait_for_service"
-    timeout $timeout sh -c "while ! $CURL_GET -k --noproxy '*' -s $url >/dev/null; do sleep 1; done"
+    timeout $timeout bash -x <<EOF || rval=$?
+        while [[ \$( ${CURL_GET} -k --noproxy '*' -s -o /dev/null -w '%{http_code}' ${url} ) == 503 || \$? -eq 7 ]]; do
+            sleep 1
+        done
+EOF
     time_stop "wait_for_service"
+    return $rval
 }
 
 

From 9a0c2bd5316853855b6f2f2940b15d13289a2030 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Thu, 28 Apr 2016 15:45:25 -0500
Subject: [PATCH 1439/3333] Default LOG_COLOR based on interactive execution

Change I4a10a49db97d413349bcfceeb8c4164936fbcc40 added colorful PS4 via
tput.  However, if TERM is not set (as is the case when stacking
noninteractively), tput errors with the following:

tput: No value for $TERM and no -T specified

...twice for every log message, thus flooding the logs.

This change set turns LOG_COLOR off by default for noninteractive
execution.  If LOG_COLOR is set to True when noninteractive (TERM is
unset), obviate the above errors by passing tput a simple -T.

Change-Id: I0f8ad82375cde463160bad5bd9918f1e4b19326d
Closes-Bug: 1576405
---
 stackrc | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 7a5b821d4e..acb7d3f650 100644
--- a/stackrc
+++ b/stackrc
@@ -135,12 +135,29 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Default for log coloring is based on interactive-or-not.
+# Baseline assumption is that non-interactive invocations are for CI,
+# where logs are to be presented as browsable text files; hence color
+# codes should be omitted.
+# Simply override LOG_COLOR if your environment is different.
+if [ -t 1 ]; then
+    _LOG_COLOR_DEFAULT=True
+else
+    _LOG_COLOR_DEFAULT=False
+fi
+
 # Use color for logging output (only available if syslog is not used)
-LOG_COLOR=$(trueorfalse True LOG_COLOR)
+LOG_COLOR=$(trueorfalse $_LOG_COLOR_DEFAULT LOG_COLOR)
 
 # Make tracing more educational
 if [[ "$LOG_COLOR" == "True" ]]; then
-    export PS4='+\[$(tput setaf 242)\]$(short_source)\[$(tput sgr0)\] '
+    # tput requires TERM or -T.  If neither is present, use vt100, a
+    # no-frills least common denominator supported everywhere.
+    TPUT_T=
+    if ! [ $TERM ]; then
+        TPUT_T='-T vt100'
+    fi
+    export PS4='+\[$(tput '$TPUT_T' setaf 242)\]$(short_source)\[$(tput '$TPUT_T' sgr0)\] '
 else
     export PS4='+ $(short_source):   '
 fi

From 60f394aee25cfd22c6c5e13622697c27acbb402d Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 17 Jun 2016 16:15:30 -0400
Subject: [PATCH 1440/3333] Fix amateur level mistake.

Happy Friday!

Change-Id: I2b1112ce74577d6e3d50c5ea2131d46c77307571
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index ba26c5f34d..ad68d8e62f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -242,7 +242,7 @@ function configure_neutron_new {
 
     # Metering
     if is_service_enabled neutron-metering; then
-        source $TOP_DIR/neutron_plugins/services/metering
+        source $TOP_DIR/lib/neutron_plugins/services/metering
         neutron_agent_metering_configure_common
         neutron_agent_metering_configure_agent
     fi

From d00cbb77b166e222fdb5adf2aa5ff7dff6294ca4 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 20 Jun 2016 13:53:44 -0400
Subject: [PATCH 1441/3333] Neutron: check if q-l3 or neutron-l3 is enabled

Change-Id: I7aff59fdf0fd75e134d2ae3ba8b7d63db98cc5ed
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 0f0ed216d0..61f0d6c099 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -289,7 +289,7 @@ function _neutron_configure_router_v4 {
     neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
 
     # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
+    if is_service_enabled q-l3 || is_service_enabled neutron-l3;  then
         # Configure and enable public bridge
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
@@ -334,7 +334,7 @@ function _neutron_configure_router_v6 {
     fi
 
     # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
+    if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge

From 66f4524cf491db78caaa93eca848ad897a2e6576 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 22 Jun 2016 08:08:16 +0000
Subject: [PATCH 1442/3333] Updated from generate-devstack-plugins-list

Change-Id: Ie6363f08ac54b62d29096befd733eca0642379d8
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 99681b335c..eed88edbb7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,6 +48,7 @@ devstack-plugin-ceph                   `git://git.openstack.org/openstack/devsta
 devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
 devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
 devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-mariadb                `git://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
 devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
 devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
 devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__

From a9cc38a1986a7c5f78f2d1e331fcc6ac8bd1023c Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Fri, 24 Jun 2016 04:30:12 -0400
Subject: [PATCH 1443/3333] Modify the image property for aarch64

In Aarch64, the default cdrom bus is scsi, and the default scsi
controller is virtio-scsi. The cdrom with virtio bus will not be
recognized by the instance.

Change-Id: Ib8cec79f9e9083239092fa7348793ee3b64a9c94
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index aa12e1e826..dfe3d8bd60 100644
--- a/functions
+++ b/functions
@@ -331,7 +331,7 @@ function upload_image {
     fi
 
     if is_arch "aarch64"; then
-        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=virtio --property os_command_line='console=ttyAMA0'"
+        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
     fi
 
     if [ "$container_format" = "bare" ]; then

From dddb2c7b5f85688de9c9b92f025df25d2f2d3016 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Tue, 3 May 2016 17:34:00 -0700
Subject: [PATCH 1444/3333] Setup the Cinder image-volume cache by default

This will have devstack setup the Cinder internal tenant and generic
image-volume cache by default. If left alone it will use reasonable
defaults.

More information about configuration options and the cache can be found
here: http://docs.openstack.org/admin-guide/blockstorage_image_volume_cache.html

As part of this we switch the default lvm type to thin so it will
work more efficiently with the image cache.

Change-Id: I0b2cc261736f32d38d43c60254f0dc7225b24c01
Implements: blueprint cinder-image-volume-cache
---
 lib/cinder | 44 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..fe49416e76 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -68,9 +68,8 @@ CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
-# Defaults to default, which is thick, the other valid choice
-# is thin, which as the name implies utilizes lvm thin provisioning.
-CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
+# Defaults to thin. For thick provisioning change to 'default'
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-thin}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend
@@ -128,6 +127,17 @@ fi
 CINDER_NOVA_CATALOG_INFO=${CINDER_NOVA_CATALOG_INFO:-compute:nova:publicURL}
 CINDER_NOVA_CATALOG_ADMIN_INFO=${CINDER_NOVA_CATALOG_ADMIN_INFO:-compute:nova:adminURL}
 
+# Environment variables to configure the image-volume cache
+CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
+
+# For limits, if left unset, it will use cinder defaults of 0 for unlimited
+CINDER_IMG_CACHE_SIZE_GB=${CINDER_IMG_CACHE_SIZE_GB:-}
+CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
+
+# Configure which cinder backends will have the image-volume cache, this takes the same
+# form as the CINDER_ENABLED_BACKENDS config option. By default it will
+# enable the cache for all cinder backends.
+CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_ENABLED_BACKENDS}
 
 # Functions
 # ---------
@@ -293,6 +303,7 @@ function configure_cinder {
         if [[ -n "$default_name" ]]; then
             iniset $CINDER_CONF DEFAULT default_volume_type ${default_name}
         fi
+        configure_cinder_image_volume_cache
     fi
 
     if is_service_enabled swift; then
@@ -394,6 +405,8 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+
+        configure_cinder_internal_tenant
     fi
 }
 
@@ -573,6 +586,31 @@ function create_cinder_volume_group {
     :
 }
 
+function configure_cinder_internal_tenant {
+    # Re-use the Cinder service account for simplicity.
+    iniset $CINDER_CONF DEFAULT cinder_internal_tenant_project_id $(get_or_create_project $SERVICE_PROJECT_NAME)
+    iniset $CINDER_CONF DEFAULT cinder_internal_tenant_user_id $(get_or_create_user "cinder")
+}
+
+function configure_cinder_image_volume_cache {
+    # Expect CINDER_CACHE_ENABLED_FOR_BACKENDS to be a list of backends
+    # similar to CINDER_ENABLED_BACKENDS with NAME:TYPE where NAME will
+    # be the backend specific configuration stanza in cinder.conf.
+    for be in ${CINDER_CACHE_ENABLED_FOR_BACKENDS//,/ }; do
+        local be_name=${be##*:}
+
+        iniset $CINDER_CONF $be_name image_volume_cache_enabled $CINDER_IMG_CACHE_ENABLED
+
+        if [[ -n $CINDER_IMG_CACHE_SIZE_GB ]]; then
+            iniset $CINDER_CONF $be_name image_volume_cache_max_size_gb $CINDER_IMG_CACHE_SIZE_GB
+        fi
+
+        if [[ -n $CINDER_IMG_CACHE_SIZE_COUNT ]]; then
+            iniset $CINDER_CONF $be_name image_volume_cache_max_count $CINDER_IMG_CACHE_SIZE_COUNT
+        fi
+    done
+}
+
 
 # Restore xtrace
 $_XTRACE_CINDER

From 68747349359822780e00833bca124558d835b05b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 29 Jun 2016 08:06:00 +0000
Subject: [PATCH 1445/3333] Updated from generate-devstack-plugins-list

Change-Id: If8d8b223f6764990c305274047c811dffb7d9840
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index eed88edbb7..5b6622e75c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -103,6 +103,7 @@ networking-sfc                         `git://git.openstack.org/openstack/networ
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
+neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From bb35715cfe68ad8d1d2ccb2b2e7eb4143e87d678 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 7 Jun 2016 11:20:55 -0400
Subject: [PATCH 1446/3333] add local.conf modifying functions

This adds a set of local.conf modifying functions which make it easier
for consuming projects like devstack-gate to programatically add
elements to local.conf structured files.

Change-Id: I3427968c2bd43aba12b3619acc27f73c74f0dabb
Co-Authored-By: fumihiko kakuma <kakuma@valinux.co.jp>
---
 inc/ini-config          | 164 ++++++++++++++
 tests/test_localconf.sh | 475 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 639 insertions(+)
 create mode 100755 tests/test_localconf.sh

diff --git a/inc/ini-config b/inc/ini-config
index 1f12343ae0..68d48d197b 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -274,6 +274,170 @@ function iniget_sections {
     $xtrace
 }
 
+# Set a localrc var
+function localrc_set {
+    local file=$1
+    local group="local"
+    local conf="localrc"
+    local section=""
+    local option=$2
+    local value=$3
+    localconf_set "$file" "$group" "$conf" "$section" "$option" "$value"
+}
+
+# Check if local.conf has section.
+function localconf_has_section {
+    local file=$1
+    local group=$2
+    local conf=$3
+    local section=$4
+    local sep
+    sep=$(echo -ne "\x01")
+    local line
+    line=$(sed -ne "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+        /\[${section}\]/p
+    }" "$file")
+    [ -n "$line" ]
+}
+
+# Check if local.conf has option.
+function localconf_has_option {
+    local file=$1
+    local group=$2
+    local conf=$3
+    local section=$4
+    local option=$5
+    local sep
+    sep=$(echo -ne "\x01")
+    local line
+    if [[ -z "$section" ]]; then
+        line=$(sed -ne "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /${option}[ \t]*=.*$/p
+        }" "$file")
+    else
+        line=$(sed -ne "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /\[${section}\]/,/\[\[.*\]\]\|\[.*\]/{
+                /${option}[ \t]*=.*$/p}
+        }" "$file")
+    fi
+    [ -n "$line" ]
+}
+
+# Update option in local.conf.
+function localconf_update_option {
+    local sudo=$1
+    local file=$2
+    local group=$3
+    local conf=$4
+    local section=$5
+    local option=$6
+    local value=$7
+    local sep
+    sep=$(echo -ne "\x01")
+    if [[ -z "$section" ]]; then
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            s${sep}^\(${option}[ \t]*=[ \t]*\).*\$${sep}\1${value}${sep}
+        }" "$file"
+    else
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /\[${section}\]/,/\[\[.*\]\]\|\[.*\]/s${sep}^\(${option}[ \t]*=[ \t]*\).*\$${sep}\1${value}${sep}
+        }" "$file"
+    fi
+}
+
+# Add option in local.conf.
+function localconf_add_option {
+    local sudo=$1
+    local file=$2
+    local group=$3
+    local conf=$4
+    local section=$5
+    local option=$6
+    local value=$7
+    local sep
+    sep=$(echo -ne "\x01")
+    if [[ -z "$section" ]]; then
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep} a $option=$value" "$file"
+    else
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /\[${section}\]/ a $option=$value
+        }" "$file"
+    fi
+}
+
+# Add section and option in local.conf.
+function localconf_add_section_and_option {
+    local sudo=$1
+    local file=$2
+    local group=$3
+    local conf=$4
+    local section=$5
+    local option=$6
+    local value=$7
+    local sep
+    sep=$(echo -ne "\x01")
+    $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep} {
+        a [$section]
+        a $option=$value
+    }" "$file"
+}
+
+# Set an option in a local.conf file.
+# localconf_set [-sudo] config-file group conf-name section option value
+#  - if the file does not exist, it is created
+function localconf_set {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local sep
+    sep=$(echo -ne "\x01")
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
+    local file=$1
+    local group=$2
+    local conf=$3
+    local section=$4
+    local option=$5
+    local value=$6
+
+    if [[ -z $group || -z $conf || -z $option || -z $value ]]; then
+        $xtrace
+        return
+    fi
+
+    if ! grep -q "^\[\[${group}|${conf}\]\]" "$file" 2>/dev/null; then
+        # Add meta section at the end if it does not exist
+        echo -e "\n[[${group}|${conf}]]" | $sudo tee --append "$file" > /dev/null
+        # Add section at the end
+        if [[ -n "$section" ]]; then
+            echo -e "[$section]" | $sudo tee --append "$file" > /dev/null
+        fi
+        # Add option at the end
+        echo -e "$option=$value" | $sudo tee --append "$file" > /dev/null
+    elif [[ -z "$section" ]]; then
+        if ! localconf_has_option "$file" "$group" "$conf" "$section" "$option"; then
+            # Add option
+            localconf_add_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+        else
+            # Replace it
+            localconf_update_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+        fi
+    elif ! localconf_has_section "$file" "$group" "$conf" "$section"; then
+        # Add section and option in specified meta section
+        localconf_add_section_and_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+    elif ! localconf_has_option "$file" "$group" "$conf" "$section" "$option"; then
+        # Add option
+        localconf_add_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+    else
+        # Replace it
+        localconf_update_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+    fi
+    $xtrace
+}
+
 # Restore xtrace
 $INC_CONF_TRACE
 
diff --git a/tests/test_localconf.sh b/tests/test_localconf.sh
new file mode 100755
index 0000000000..d8075df442
--- /dev/null
+++ b/tests/test_localconf.sh
@@ -0,0 +1,475 @@
+#!/usr/bin/env bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+# Tests for DevStack INI functions
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import config functions
+source $TOP/inc/ini-config
+
+source $TOP/tests/unittest.sh
+
+echo "Testing INI local.conf functions"
+
+# test that can determine if file has section in specified meta-section
+
+function test_localconf_has_section {
+    local file_localconf
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+
+    cat <<- EOF > $file_localconf
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t1
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t2
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t3
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-extra $file_conf2 conf2_t1
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t4
+    assert_equal $? 1
+    localconf_has_section $file_localconf post-install $file_conf1 conf1_t1
+    assert_equal $? 1
+    localconf_has_section $file_localconf local localrc conf1_t2
+    assert_equal $? 1
+    rm -f $file_localconf $file_conf1 $file_conf2
+}
+
+# test that can determine if file has option in specified meta-section and section
+function test_localconf_has_option {
+    local file_localconf
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1 = conf1_t1_val1
+conf1_t1_opt2 = conf1_t1_val2
+conf1_t1_opt3 = conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+
+    localconf_has_option $file_localconf local localrc "" LOCALRC_VAR1
+    assert_equal $? 0
+    localconf_has_option $file_localconf local localrc "" LOCALRC_VAR2
+    assert_equal $? 0
+    localconf_has_option $file_localconf local localrc "" LOCALRC_VAR3
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t1 conf1_t1_opt1
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t2 conf1_t2_opt2
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t3 conf1_t3_opt3
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt2
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t1_opt4
+    assert_equal $? 1
+    localconf_has_option $file_localconf post-install $file_conf1 conf1_t1_opt1
+    assert_equal $? 1
+    localconf_has_option $file_localconf local localrc conf1_t2 conf1_t2_opt1
+    assert_equal $? 1
+    rm -f $file_localconf $file_conf1 $file_conf2
+}
+
+# test that update option in specified meta-section and section
+function test_localconf_update_option {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[local|localrc]]
+LOCALRC_VAR1 = localrc_val1
+LOCALRC_VAR2 = localrc_val2
+LOCALRC_VAR3 = localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[local|localrc]]
+LOCALRC_VAR1 = localrc_val1
+LOCALRC_VAR2 = localrc_val2_update
+LOCALRC_VAR3 = localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1_update
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2_update
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3_update
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3_update
+EOF
+
+    localconf_update_option "$SUDO" $file_localconf local localrc "" LOCALRC_VAR2 localrc_val2_update
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t1 conf1_t1_opt1 conf1_t1_val1_update
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t2 conf1_t2_opt2 conf1_t2_val2_update
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t3 conf1_t3_opt3 conf1_t3_val3_update
+    localconf_update_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt3 conf2_t1_val3_update
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t2 conf1_t3_opt1 conf1_t3_val1_update
+    localconf_update_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t1_val4_update
+    localconf_update_option "$SUDO" $file_localconf post-install $file_conf2 conf2_t1 conf2_t1_opt1 conf2_t1_val1_update
+    localconf_update_option "$SUDO" $file_localconf local localrc "" LOCALRC_VAR4 localrc_val4_update
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+# test that add option in specified meta-section and section
+function test_localconf_add_option {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1 = conf2_t1_val1
+conf2_t1_opt2 = conf2_t1_val2
+conf2_t1_opt3 = conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt4 = conf1_t1_val4
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt4 = conf1_t2_val4
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt4 = conf1_t3_val4
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR4 = localrc_val4
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt4 = conf2_t1_val4
+conf2_t1_opt1 = conf2_t1_val1
+conf2_t1_opt2 = conf2_t1_val2
+conf2_t1_opt3 = conf2_t1_val3
+EOF
+
+    localconf_add_option "$SUDO" $file_localconf local localrc "" LOCALRC_VAR4 localrc_val4
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t1 conf1_t1_opt4 conf1_t1_val4
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t2 conf1_t2_opt4 conf1_t2_val4
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t3 conf1_t3_opt4 conf1_t3_val4
+    localconf_add_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t1_val4
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    localconf_add_option "$SUDO" $file_localconf local localrc.conf "" LOCALRC_VAR4 localrc_val4_update
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t4 conf1_t4_opt1 conf1_t4_val1
+    localconf_add_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t2 conf2_t2_opt4 conf2_t2_val4
+    localconf_add_option "$SUDO" $file_localconf post-install $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t2_val4
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+# test that add section and option in specified meta-section
+function test_localconf_add_section_and_option {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[post-config|$file_conf1]]
+[conf1_t4]
+conf1_t4_opt1 = conf1_t4_val1
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t2]
+conf2_t2_opt1 = conf2_t2_val1
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+
+    localconf_add_section_and_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t4 conf1_t4_opt1 conf1_t4_val1
+    localconf_add_section_and_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t2 conf2_t2_opt1 conf2_t2_val1
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    localconf_add_section_and_option "$SUDO" $file_localconf post-install $file_conf2 conf2_t2 conf2_t2_opt1 conf2_t2_val1
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+# test that add section and option in specified meta-section
+function test_localconf_set {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2_update
+LOCALRC_VAR3=localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t4]
+conf1_t4_opt1 = conf1_t4_val1
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt4 = conf2_t1_val4
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+
+[[post-install|/etc/neutron/plugin/ml2/ml2_conf.ini]]
+[ml2]
+ml2_opt1 = ml2_val1
+EOF
+
+    if [[ -n "$SUDO" ]]; then
+        SUDO_ARG="-sudo"
+    else
+        SUDO_ARG=""
+    fi
+    localconf_set $SUDO_ARG $file_localconf post-install /etc/neutron/plugin/ml2/ml2_conf.ini ml2 ml2_opt1 ml2_val1
+    localconf_set $SUDO_ARG $file_localconf local localrc "" LOCALRC_VAR2 localrc_val2_update
+    localconf_set $SUDO_ARG $file_localconf post-config $file_conf1 conf1_t4 conf1_t4_opt1 conf1_t4_val1
+    localconf_set $SUDO_ARG $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t1_val4
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+
+test_localconf_has_section
+test_localconf_has_option
+test_localconf_update_option
+test_localconf_add_option
+test_localconf_add_section_and_option
+test_localconf_set

From 9079a40e9ebf6c20d754b8221a55b183de1a0766 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sun, 3 Jul 2016 19:20:27 -0400
Subject: [PATCH 1447/3333] nova: remove explicit file injection being disabled

Change 9ce99a44cf85e431227536e2251ef05b52e61524 disabled file
injection with the libvirt driver by default back in Icehouse,
so devstack doesn't need to do this explicitly anymore.

Change-Id: Id0c521f6f624367bd497463c8c2d99488548fcff
---
 lib/ceph                            | 1 -
 lib/nova_plugins/hypervisor-libvirt | 4 ----
 2 files changed, 5 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index e999647ed8..2353de1758 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -301,7 +301,6 @@ function configure_ceph_nova {
     iniset $NOVA_CONF libvirt rbd_user ${CINDER_CEPH_USER}
     iniset $NOVA_CONF libvirt rbd_secret_uuid ${CINDER_CEPH_UUID}
     iniset $NOVA_CONF libvirt inject_key false
-    iniset $NOVA_CONF libvirt inject_partition -2
     iniset $NOVA_CONF libvirt disk_cachemodes "network=writeback"
     iniset $NOVA_CONF libvirt images_type rbd
     iniset $NOVA_CONF libvirt images_rbd_pool ${NOVA_CEPH_POOL}
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index d0e364efc3..503d4b6c89 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -57,10 +57,6 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF vnc enabled "false"
     fi
 
-    # File injection is being disabled by default in the near future -
-    # disable it here for now to avoid surprises later.
-    iniset $NOVA_CONF libvirt inject_partition '-2'
-
     if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"

From 6d3670a65280d71529f8aad8ca5a0422abffebd0 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sun, 3 Jul 2016 19:40:25 -0400
Subject: [PATCH 1448/3333] Add a way to enable file injection for nova/tempest

File injection is disabled by default for the libvirt
driver in nova. This adds a variable to enable file
injection for the libvirt driver and is also used
to configure tempest.conf for running personality
tests.

Change-Id: I34790fadeffd6e3fdc65bd9feed3d6e62316896c
Related-Bug: #1598581
---
 lib/nova_plugins/hypervisor-libvirt | 8 ++++++++
 lib/tempest                         | 1 +
 2 files changed, 9 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 503d4b6c89..cdd078ca51 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -57,6 +57,14 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF vnc enabled "false"
     fi
 
+    if isset ENABLE_FILE_INJECTION; then
+        if [ "$ENABLE_FILE_INJECTION" == "True" ]; then
+            # -1 means use libguestfs to inspect the guest OS image for the
+            # root partition to use for file injection.
+            iniset $NOVA_CONF libvirt inject_partition '-1'
+        fi
+    fi
+
     if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
diff --git a/lib/tempest b/lib/tempest
index 347b2a7dc7..ebaf4bb1cc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -348,6 +348,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
+    iniset $TEMPEST_CONFIG compute-feature-enabled personality ${ENABLE_FILE_INJECTION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 67700ca5209c8d5605cfd94d6ac264f5247a2b8d Mon Sep 17 00:00:00 2001
From: Luz Cazares <luz.cazares@intel.com>
Date: Wed, 6 Jul 2016 12:13:18 -0700
Subject: [PATCH 1449/3333] Remove large_ops_number from devstack tempest

Option was deleted from Tempest config file. Also test scenario
was deleted. See commit I93b2fb33e97381f7c1e0cb1ef09ebc5c42c16ecc

Change-Id: I750e50ba7cf8fca1dde391c2620b4a815d6b02a1
Closes-Bug: #1599619
---
 lib/tempest | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index aa09e9a39f..bc3a2d897b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -423,9 +423,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
     iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
-    # Large Ops Number
-    iniset $TEMPEST_CONFIG scenario large_ops_number ${TEMPEST_LARGE_OPS_NUMBER:-0}
-
     # Telemetry
     iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
 

From 16edbe4356056daba18a7b912b4514fa11115e18 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 7 Jul 2016 14:43:39 -0400
Subject: [PATCH 1450/3333] Remove check for nova-volumes API

The osapi_volume API in Nova has been gone forever,
so we don't need to check for that anymore.

Change-Id: I7303d3f434fc27a4a1a127e455a7d3b88f588537
---
 lib/cinder | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 0ebf195422..6d56b65ef7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -411,11 +411,7 @@ function create_cinder_cache_dir {
 }
 
 # init_cinder() - Initialize database and volume group
-# Uses global ``NOVA_ENABLED_APIS``
 function init_cinder {
-    # Force nova volumes off
-    NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/osapi_volume,//")
-
     if is_service_enabled $DATABASE_BACKENDS; then
         # (Re)create cinder database
         recreate_database cinder

From 7ef31d0fe4d3b93dd08edcd511a32ae66c51fdba Mon Sep 17 00:00:00 2001
From: xurong00037997 <xu.rong@zte.com.cn>
Date: Tue, 5 Jul 2016 11:09:40 +0800
Subject: [PATCH 1451/3333] neutron_plugin_configure_dhcp_agent invalid config
 file

ADD dhcp config file name for neutron_plugin_configure_dhcp_agent

Change-Id: I6578bcb40c4df2231c0b54f231ac3b78ede5a71d
Closes-Bug: #1598745
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index dca2e98a0c..3a1bc64ec5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -817,7 +817,7 @@ function _configure_neutron_dhcp_agent {
 
     _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
 
-    neutron_plugin_configure_dhcp_agent
+    neutron_plugin_configure_dhcp_agent $Q_DHCP_CONF_FILE
 }
 
 

From d565d62efe9a4476367be58551f6412e8e85688a Mon Sep 17 00:00:00 2001
From: Maxim Nestratov <mnestratov@virtuozzo.com>
Date: Mon, 11 Jul 2016 22:33:39 +0300
Subject: [PATCH 1452/3333] ploop: specify hypervisor_type=vz property for
 ploop images

This is necessary to make it possible to filter out compute nodes,
which don't support such type of images.

Change-Id: I347953876e2057e6f3dca71c2f5e8b638b85aaf8
---
 functions | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions b/functions
index 46a7d414a1..50b72ebf2f 100644
--- a/functions
+++ b/functions
@@ -251,6 +251,7 @@ function upload_image {
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
+            --property hypervisor_type=vz \
             --property vm_mode=$vm_mode < "${image}"
         return
     fi

From a9286886e413fbf055284dc167a7640a5a79b83c Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 20 Jun 2016 13:23:11 -0400
Subject: [PATCH 1453/3333] Neutron: include metering service plugin in conf

The common code for metering calls _neutron_service_plugin_class_add,
which despite the description only just appends a service plugin to
$Q_SERVICE_PLUGIN_CLASSES - it doesn't actually write it into a
configuration file.

So for now, read out the configuration, and append metering to it, then
write it back out.

Change-Id: Ice96cca8b43dcd54f2aa81461000a4597db8260d
---
 lib/neutron | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index ad68d8e62f..5cab8e1716 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -245,6 +245,12 @@ function configure_neutron_new {
         source $TOP_DIR/lib/neutron_plugins/services/metering
         neutron_agent_metering_configure_common
         neutron_agent_metering_configure_agent
+        # TODO(sc68cal) hack because we don't pass around
+        # $Q_SERVICE_PLUGIN_CLASSES like -legacy does
+        local plugins=""
+        plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
+        plugins+=",metering"
+        iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
     fi
 
 }

From 657cdcdbd18cbdbc185fbf6ef853382b357b3370 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Fri, 1 Jul 2016 16:08:15 -0700
Subject: [PATCH 1454/3333] Allow for Nova to use os-brick from git

This option to install os-brick from git was only added
into lib/cinder previously. When testing all-in-one nodes
this worked fine, but if you have multi-node setups with
compute nodes that don't install any c-* services we
only get packaged os-brick. With this change non-cinder
nodes can now test against unreleased os-bricks.

Change-Id: Ibb7423d243d57852dada0b6298463bbdfc6dc63c
---
 lib/cinder   |  8 --------
 lib/os_brick | 29 +++++++++++++++++++++++++++++
 stack.sh     |  6 ++++++
 3 files changed, 35 insertions(+), 8 deletions(-)
 create mode 100644 lib/os_brick

diff --git a/lib/cinder b/lib/cinder
index 0ebf195422..69ff4c4e36 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -39,7 +39,6 @@ fi
 
 # set up default directories
 GITDIR["python-cinderclient"]=$DEST/python-cinderclient
-GITDIR["os-brick"]=$DEST/os-brick
 GITDIR["python-brick-cinderclient-ext"]=$DEST/python-brick-cinderclient-ext
 CINDER_DIR=$DEST/cinder
 
@@ -445,13 +444,6 @@ function init_cinder {
 
 # install_cinder() - Collect source and prepare
 function install_cinder {
-    # Install os-brick from git so we make sure we're testing
-    # the latest code.
-    if use_library_from_git "os-brick"; then
-        git_clone_by_name "os-brick"
-        setup_dev_lib "os-brick"
-    fi
-
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
     if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
diff --git a/lib/os_brick b/lib/os_brick
new file mode 100644
index 0000000000..690e321809
--- /dev/null
+++ b/lib/os_brick
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# lib/os_brick
+# Install **os-brick** python module from source
+
+# Dependencies:
+#
+# - functions
+# - DEST, DATA_DIR must be defined
+
+# stack.sh
+# ---------
+# - install_os_brick
+
+# Save trace setting
+_XTRACE_CINDER=$(set +o | grep xtrace)
+set +o xtrace
+
+
+GITDIR["os-brick"]=$DEST/os-brick
+
+# Install os_brick from git only if requested, otherwise it will be pulled from
+# pip repositories by requirements of projects that need it.
+function install_os_brick {
+    if use_library_from_git "os-brick"; then
+        git_clone_by_name "os-brick"
+        setup_dev_lib "os-brick"
+    fi
+}
diff --git a/stack.sh b/stack.sh
index 6fbb0bee3b..5a5a040b02 100755
--- a/stack.sh
+++ b/stack.sh
@@ -570,6 +570,7 @@ source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm
+source $TOP_DIR/lib/os_brick
 
 # Extras Source
 # --------------
@@ -796,6 +797,11 @@ if is_service_enabled heat horizon; then
     install_heatclient
 fi
 
+# Install shared libraries
+if is_service_enabled cinder nova; then
+    install_os_brick
+fi
+
 # Install middleware
 install_keystonemiddleware
 

From 6267ec01d6b4c503bca21ca6cbf95b443eff3408 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 12 Jul 2016 19:12:30 -0400
Subject: [PATCH 1455/3333] Remove juno/kilo specific tempest config

This removes several config flags for Tempest
now that juno and kilo are end of life. Tempest
has already removed these flags too.

Change-Id: I748429e73073f4202f77dfe1002687f76ee9a451
---
 lib/tempest | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index bc3a2d897b..01ad4f4381 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -356,15 +356,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
-    # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
-    # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_paused_instances True
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
-    # TODO(mriedem): Remove this when kilo-eol happens since the
-    # neutron.allow_duplicate_networks option was removed from nova in Liberty
-    # and is now the default behavior.
-    iniset $TEMPEST_CONFIG compute-feature-enabled allow_duplicate_networks ${NOVA_ALLOW_DUPLICATE_NETWORKS:-True}
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
@@ -434,8 +426,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
-    # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 7886f7eb9fcd0cfdee93e4480a9fdcee2b0a2b74 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 13 Jul 2016 08:19:48 +0000
Subject: [PATCH 1456/3333] Updated from generate-devstack-plugins-list

Change-Id: I4535ce00a7d15d14fdb9c3180b6b821352fe704f
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5b6622e75c..104fca679c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -62,12 +62,14 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
+kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__

From eecb983529a9164a0dabf19ea4c3186a708fa0c3 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 13 Jul 2016 12:34:03 +0200
Subject: [PATCH 1457/3333] Remove support for End Of Life (EOL) Fedora 22

Fedora 22 reaches its EOL on 19-JUL-2016[1].  Remove it as
officially supported distribution.

The current two supported Fedora distributions are Fedora 23 and Fedora
24.  (Change Ia4a58de4973ef228735c48b33453a0562dc65258 already added
support for Fedora 24.)

[1] https://fedoramagazine.org/fedora-22-end-of-life-2016-july/

Change-Id: I5b4e1ddb6165a9065e80e84175246678a7356f18
---
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 lib/ceph           | 2 +-
 stack.sh           | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index ee2e8a058b..d0ceb56621 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,9 +7,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f22,f23,f24
+iptables-services  # NOPRIME f23,f24
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f22,f23,f24
+java-1.8.0-openjdk-headless  # NOPRIME f23,f24
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 594393e733..a883ec4399 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f22,f23,f24
+kernel-modules # dist:f23,f24
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 1e05167bcf..bd249ee71b 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f22,f23,f24
+rsync-daemon # dist:f23,f24
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/ceph b/lib/ceph
index e999647ed8..0c8d160766 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f22|f23|f24) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f23|f24) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index 5a5a040b02..4cace9d0c2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -185,7 +185,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|f24|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From e24707bb594eece8a3172c6763ac8fc3a1a8681f Mon Sep 17 00:00:00 2001
From: Matt McEuen <mm9745@att.com>
Date: Mon, 11 Jul 2016 08:37:59 -0500
Subject: [PATCH 1458/3333] lib/neutron-legacy: replace ip when re-stacking

Replicated Yi Zhao's fix for re-adding ipv6 addresses to neutron-legacy
(review I9ff62023dbc29a88aec3c48af331c0a49a1270bb).
Previously, re-stacking failed with "File exists" for ipv6 addresses
on br-ex.  With this change, the existing address is replaced on
br-ex with the appropriate address.

Change-Id: I6e6235132a34469f4e68b5bb3cf51ebdf01c83a2
---
 lib/neutron-legacy | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3a1bc64ec5..def1674e7c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -610,7 +610,7 @@ function _move_neutron_addresses_route {
         # on configure we will also add $from_intf as a port on $to_intf,
         # assuming it is an OVS bridge.
 
-        local IP_ADD=""
+        local IP_REPLACE=""
         local IP_DEL=""
         local IP_UP=""
         local DEFAULT_ROUTE_GW
@@ -635,7 +635,7 @@ function _move_neutron_addresses_route {
 
         if [[ "$IP_BRD" != "" ]]; then
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
-            IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
+            IP_REPLACE="sudo ip addr replace $IP_BRD dev $to_intf"
             IP_UP="sudo ip link set $to_intf up"
             if [[ "$af" == "inet" ]]; then
                 IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
@@ -645,7 +645,7 @@ function _move_neutron_addresses_route {
 
         # The add/del OVS port calls have to happen either before or
         # after the address is moved in order to not leave it orphaned.
-        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
+        $DEL_OVS_PORT; $IP_DEL; $IP_REPLACE; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
     fi
 }
 

From 5813265ce597dd5eb1105fad5922339a38ea9092 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 14 Jul 2016 12:55:51 +0200
Subject: [PATCH 1459/3333] remove OS_AUTH_TYPE  from the userrc files

The openstack client just gets more confused when it is specified.

Change-Id: I8b498be835b63733cb38d33b02c3a8531a2da45b
---
 tools/create_userrc.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index b6db5d11aa..30d1a01577 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -193,7 +193,6 @@ export OS_PROJECT_NAME="$project_name"
 export OS_AUTH_URL="$OS_AUTH_URL"
 export OS_CACERT="$OS_CACERT"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
-export OS_AUTH_TYPE=v2password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"

From 79fc935640aa4695c26b4bcc8b06c605e2256311 Mon Sep 17 00:00:00 2001
From: Thiago Paiva <thiagop@lsd.ufcg.edu.br>
Date: Thu, 14 Jul 2016 14:16:20 -0300
Subject: [PATCH 1460/3333] Restoring xtrace state for os-brick plugin

The change Ibb7423d243d57852dada0b6298463bbdfc6dc63c that introduced the
os-brick plugin introduced a flaw where the xtrace state wasn't restored
after the end of the plugin's execution. The end behavior is that devstack's
logs were with way less information, difficulting the debugging of the build.
This patch fixes the variable that was intended to hold the xtrace state (it
was using cinder's) and restoring the state at the end of the script.

Change-Id: I47c6c794a9704049b089142eca5603d1183f8a10
---
 lib/os_brick | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/os_brick b/lib/os_brick
index 690e321809..d1cca4af44 100644
--- a/lib/os_brick
+++ b/lib/os_brick
@@ -13,7 +13,7 @@
 # - install_os_brick
 
 # Save trace setting
-_XTRACE_CINDER=$(set +o | grep xtrace)
+_XTRACE_OS_BRICK=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -27,3 +27,6 @@ function install_os_brick {
         setup_dev_lib "os-brick"
     fi
 }
+
+# Restore xtrace
+$_XTRACE_OS_BRICK
\ No newline at end of file

From 7b5c7dce53ab9e9778d1d72fcbbed565bfce65bd Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 15 Jul 2016 20:17:13 +0200
Subject: [PATCH 1461/3333] Introduce PUBLIC_BRIDGE_MTU variable to set br-ex
 MTU

This variable can be used to accommodate for underlying infrastructure
that does not provide full 1500-sized traffic, or maybe instead gives
access to Jumbo frames.

Change-Id: I38a80bac18673a30842a7b997d0669fed5aff976
Related-Bug: #1603268
---
 functions                             | 9 +++++++++
 lib/neutron_plugins/linuxbridge_agent | 1 +
 lib/neutron_plugins/openvswitch_agent | 2 +-
 lib/neutron_plugins/ovs_base          | 7 ++++++-
 lib/neutron_plugins/services/l3       | 1 +
 5 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 4f5e10aaa6..58565788ff 100644
--- a/functions
+++ b/functions
@@ -637,6 +637,15 @@ function create_disk {
     fi
 }
 
+
+# set_mtu - Set MTU on a device
+function set_mtu {
+    local dev=$1
+    local mtu=$2
+    sudo ip link set mtu $mtu dev $dev
+}
+
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 0a066354ca..e5a7b76187 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -50,6 +50,7 @@ function neutron_plugin_configure_dhcp_agent {
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
+    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
     iniset $conf_file DEFAULT external_network_bridge
     iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 69e38f4df1..b4a53e4c38 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -104,7 +104,7 @@ function neutron_plugin_configure_plugin_agent {
         sudo ovs-vsctl -- --may-exist add-port "br-$VLAN_INTERFACE" $VLAN_INTERFACE
 
         # Create external bridge and add port
-        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+        _neutron_ovs_base_add_public_bridge
         sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index ecf252f88b..9e1421f5e6 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -105,11 +105,16 @@ function _neutron_ovs_base_configure_l3_agent {
         sudo ip link set $Q_PUBLIC_VETH_EX up
         sudo ip addr flush dev $Q_PUBLIC_VETH_EX
     else
-        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+        _neutron_ovs_base_add_public_bridge
         sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
     fi
 }
 
+function _neutron_ovs_base_add_public_bridge {
+    _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
+}
+
 function _neutron_ovs_base_configure_nova_vif_driver {
     :
 }
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 4ce87bdf6f..2180099ee4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -15,6 +15,7 @@ IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
 IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with

From d55513a07c610da479a6e59ff50605f48caeabef Mon Sep 17 00:00:00 2001
From: venkatamahesh <Venkata.Kotha@infinite.com>
Date: Tue, 19 Jul 2016 17:34:20 +0530
Subject: [PATCH 1462/3333] Corrected the local.conf configuration file link

Change-Id: Id28a9f85ae5ba789f09269163c6e5b2c8c36a7c8
Closes-Bug: #1603848
---
 samples/local.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/local.conf b/samples/local.conf
index 06ac18572d..6d5351f904 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -10,7 +10,7 @@
 
 # This is a collection of some of the settings we have found to be useful
 # in our DevStack development environments. Additional settings are described
-# in http://devstack.org/local.conf.html
+# in http://docs.openstack.org/developer/devstack/configuration.html#local-conf
 # These should be considered as samples and are unsupported DevStack code.
 
 # The ``localrc`` section replaces the old ``localrc`` configuration file.

From e2b75363699124cfd2c19de69286cfafa98aa9a0 Mon Sep 17 00:00:00 2001
From: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
Date: Sat, 16 Jul 2016 01:02:49 +0900
Subject: [PATCH 1463/3333] Remove remaining fwaas code

Change-Id: I24fe7a559760b985bd53373523276a8f075e5974
---
 lib/neutron-legacy | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f4e577d43b..7dce5f7f3e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -292,9 +292,6 @@ function _determine_config_server {
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
     echo "$opts"
 }
 

From 5d7992a0189d940c0ffbb01e93bf3a0e4eba4ec7 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Tue, 19 Jul 2016 15:52:12 +0000
Subject: [PATCH 1464/3333] Modify the default cpu-mode for aarh64 in Libvirt

For AArch64, KVM don't recognize the cpu-mode "none",
so change the default cpu-mode as host-passthrough for
generating nova.conf

Change-Id: I94a22e5a15a974b9c11e9f9fd996857453b6e2ca
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova_plugins/hypervisor-libvirt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index d0e364efc3..51d807a160 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -55,6 +55,7 @@ function configure_nova_hypervisor {
     if is_arch "aarch64"; then
         # arm64 architecture currently does not support graphical consoles.
         iniset $NOVA_CONF vnc enabled "false"
+        iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
     fi
 
     # File injection is being disabled by default in the near future -

From 881373c049eceefc4fd7f6c69543d42528830a0e Mon Sep 17 00:00:00 2001
From: Oleksii Butenko <obutenko@mirantis.com>
Date: Tue, 21 Jun 2016 17:29:54 +0300
Subject: [PATCH 1465/3333] Add flag for snapshot_backup

We have new feature in cinder and new test for it.
The test is skipped by default.
Need to add flag to unskip this test on master and
Mitaka.

new test: I1964ce6e1298041f8238d76fa4b7029d2d23bbfb

Change-Id: Ib695e60c2ed7edf30c8baef9e00f0307b1156551
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 01ad4f4381..e4f80b835d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -426,6 +426,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
+    # TODO(obutenko): Remove snapshot_backup when liberty-eol happens.
+    iniset $TEMPEST_CONFIG volume-feature-enabled snapshot_backup True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 130a11f8aaf08ea529b6ce60dd9052451cb7bb5c Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Sun, 17 Jul 2016 22:19:30 -0600
Subject: [PATCH 1466/3333] Use real Neutron network for L3 GW by default

Relying on 'external_network_bridge=br-ex' for the L3
agent has been deprecated in Neutron. This patch adjusts
the devstack defaults to setup Neutron in the preferred
manner (empty external_network_bridge value and
correct bridge_mappings for the L2 agent).

This will also help with correct MTU calculations now that
the external network will have the correct segmentation
type on it ('flat' now instead of 'vxlan' by default).

Related-Bug: #1511578
Related-Bug: #1603493
Change-Id: Id20e67aba5dfd2044b82c700f41c6e648b529430
---
 lib/neutron-legacy              | 4 ++--
 lib/neutron_plugins/services/l3 | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f4e577d43b..f83492b931 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -203,7 +203,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 
 # With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
@@ -213,7 +213,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 # port for external connectivity.
 #
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2180099ee4..816679ec79 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -17,6 +17,11 @@ IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
+# If Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=True, assign the gateway IP of the public
+# subnet to the public bridge interface even if Q_USE_PROVIDERNET_FOR_PUBLIC is
+# used.
+Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
+
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
@@ -51,7 +56,7 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
 # Generate 40-bit IPv6 Global ID to comply with RFC 4193
@@ -305,7 +310,7 @@ function _neutron_configure_router_v4 {
             local cidr_len=${FLOATING_RANGE#*/}
             local testcmd="ip -o link | grep -q $ext_gw_interface"
             test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" || $Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From a1e1f5128a22a7d0cdc8136063d27d64c270021d Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Wed, 20 Jul 2016 18:12:09 -0400
Subject: [PATCH 1467/3333] Add keystone VirtualHost for port 443 when USE_SSL
 is True

Add a VirtualHost that defines the necessary options for
enabling SSL. The existing keystone Apache configuration already
does all the location handling.

Change-Id: I836a471a7258f14f051d3dd8bdb428286b5a11aa
---
 files/apache-keystone.template | 6 ++++++
 lib/keystone                   | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 8a4b0f0c43..249eaa5d0e 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -34,6 +34,12 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLKEYFILE%
 </VirtualHost>
 
+%SSLLISTEN%<VirtualHost *:443>
+%SSLLISTEN%    %SSLENGINE%
+%SSLLISTEN%    %SSLCERTFILE%
+%SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%</VirtualHost>
+
 Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
 <Location /identity>
     SetHandler wsgi-script
diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..810acac63f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -161,6 +161,7 @@ function _cleanup_keystone_apache_wsgi {
 function _config_keystone_apache_wsgi {
     local keystone_apache_conf
     keystone_apache_conf=$(apache_site_config_for keystone)
+    keystone_ssl_listen="#"
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
@@ -169,6 +170,7 @@ function _config_keystone_apache_wsgi {
     local venv_path=""
 
     if is_ssl_enabled_service key; then
+        keystone_ssl_listen=""
         keystone_ssl="SSLEngine On"
         keystone_certfile="SSLCertificateFile $KEYSTONE_SSL_CERT"
         keystone_keyfile="SSLCertificateKeyFile $KEYSTONE_SSL_KEY"
@@ -186,6 +188,7 @@ function _config_keystone_apache_wsgi {
         s|%PUBLICPORT%|$keystone_service_port|g;
         s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
         s|%SSLCERTFILE%|$keystone_certfile|g;
         s|%SSLKEYFILE%|$keystone_keyfile|g;

From 2381f336296c80834ca9ce5ed3f1c784acc4d157 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 21 Jul 2016 08:07:43 +0000
Subject: [PATCH 1468/3333] Updated from generate-devstack-plugins-list

Change-Id: Ieffddf42e1b5d77dea651208a18b3de320489745
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 104fca679c..38910b0785 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -64,6 +64,7 @@ gnocchi                                `git://git.openstack.org/openstack/gnocch
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
+horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__

From df6c1ffbe110495d94f607a4344e0703be54c6ce Mon Sep 17 00:00:00 2001
From: Kenneth Giusti <kgiusti@gmail.com>
Date: Thu, 7 Jul 2016 09:28:58 -0400
Subject: [PATCH 1469/3333] Force reinstall of virtualenv to ensure
 installation is valid

On RHEL-based systems pip and yum share the same installation
directory for virtualenv.  If yum pulls in the python-virtualenv
package (e.g. due to a dependency) it will clobber what pip has
already installed. The file tools/fixup_stuff.sh tries to ensure that
the proper virtualenv package is installed via pip. If virtualenv has
already been installed via pip, then clobbered by yum, pip skips the
install since it appears as if virtualenv is already installed and at
the correct version.

The reinstall of virtualenv must use the --force-reinstall argument to
pip to fix up the damage done by yum.

Change-Id: Ib0edf6c4ee8a510e9d671213de35d787f56acfed
Closes-Bug: #1599863
---
 tools/fixup_stuff.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 193a1f7aba..4dec95eb4d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -162,7 +162,11 @@ if is_fedora; then
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
-# connection issues under proxy, hence uninstalling python-virtualenv package
-# and installing the latest version using pip.
-uninstall_package python-virtualenv
-pip_install -U virtualenv
+# connection issues under proxy so re-install the latest version using
+# pip. To avoid having pip's virtualenv overwritten by the distro's
+# package (e.g. due to installing a distro package with a dependency
+# on python-virtualenv), first install the distro python-virtualenv
+# to satisfy any dependencies then use pip to overwrite it.
+
+install_package python-virtualenv
+pip_install -U --force-reinstall virtualenv

From 7da968a8be03229cfa72b215b87f17e28e23a988 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Fri, 22 Jul 2016 06:02:22 +0000
Subject: [PATCH 1470/3333] Revert "Use real Neutron network for L3 GW by
 default"

This reverts commit 130a11f8aaf08ea529b6ce60dd9052451cb7bb5c.
Linux bridge devstack logic needs some changes first.

Change-Id: I5885062ad128518c22f743db016e1a6db64f3313
Closes-Bug: #1605423
---
 lib/neutron-legacy              | 4 ++--
 lib/neutron_plugins/services/l3 | 9 ++-------
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f83492b931..f4e577d43b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -203,7 +203,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 
 # With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
@@ -213,7 +213,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # port for external connectivity.
 #
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
 
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 816679ec79..2180099ee4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -17,11 +17,6 @@ IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
-# If Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=True, assign the gateway IP of the public
-# subnet to the public bridge interface even if Q_USE_PROVIDERNET_FOR_PUBLIC is
-# used.
-Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
-
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
@@ -56,7 +51,7 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
 # Generate 40-bit IPv6 Global ID to comply with RFC 4193
@@ -310,7 +305,7 @@ function _neutron_configure_router_v4 {
             local cidr_len=${FLOATING_RANGE#*/}
             local testcmd="ip -o link | grep -q $ext_gw_interface"
             test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" || $Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE == "True" ) ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From 7d89a798744c24ba82199fd42db995368a2e9322 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 23 Jul 2016 08:03:03 +0000
Subject: [PATCH 1471/3333] Updated from generate-devstack-plugins-list

Change-Id: I222ecc69427f1ddf4498f5af29664544efe43b46
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 38910b0785..bdb8d8bc9c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,7 +69,6 @@ ironic                                 `git://git.openstack.org/openstack/ironic
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__

From c07170abd7a382bda028c6ae14bfde5d912ab78f Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 20 Jul 2016 19:44:05 +0900
Subject: [PATCH 1472/3333] lib/neutron: Create initial networks regardless of
 neutron-l3

Closes-Bug: #1604768
Change-Id: I699977930675512e9767a90f317fc0faa1ea9901
---
 lib/neutron | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 5cab8e1716..7bf31d0a85 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -425,16 +425,16 @@ function start_neutron_new {
     fi
     if is_service_enabled neutron-l3; then
         run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
-        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
-        # of the code in lib/neutron_plugins/services/l3
-        if type -p neutron_plugin_create_initial_networks > /dev/null; then
-            neutron_plugin_create_initial_networks
-        else
-            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
-            source $TOP_DIR/lib/neutron_plugins/services/l3
-            # Create the networks using servic
-            create_neutron_initial_network
-        fi
+    fi
+    # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
+    # of the code in lib/neutron_plugins/services/l3
+    if type -p neutron_plugin_create_initial_networks > /dev/null; then
+        neutron_plugin_create_initial_networks
+    else
+        # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
+        source $TOP_DIR/lib/neutron_plugins/services/l3
+        # Create the networks using servic
+        create_neutron_initial_network
     fi
     if is_service_enabled neutron-metadata-agent; then
         run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"

From c6f857f49ca1459f0874e8dcc83be539829e6ee3 Mon Sep 17 00:00:00 2001
From: zhangyanxian <zhang.yanxian@zte.com.cn>
Date: Mon, 25 Jul 2016 08:44:28 +0000
Subject: [PATCH 1473/3333] Fix the typo in the file

Change-Id: I3a3976bdab6743f6d741d39708b01eacf6a01074
---
 tools/xen/install_os_domU.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 3a61215b5b..66b9eda474 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -247,7 +247,7 @@ else
 fi
 
 if [ -n "${EXIT_AFTER_JEOS_INSTALLATION:-}" ]; then
-    echo "User requested to quit after JEOS instalation"
+    echo "User requested to quit after JEOS installation"
     exit 0
 fi
 

From 88ccd47c88dc39b8d746afae89dea31d46558a68 Mon Sep 17 00:00:00 2001
From: Spyros Trigazis <strigazi@gmail.com>
Date: Sun, 24 Jul 2016 22:13:57 +0200
Subject: [PATCH 1474/3333] Keep old behavior of setuptools for editable
 installs

In the 25.0.0 release [1] of setuptools during any install
operation the package in not overwritten. If a package is
installed from another requirement via pip and then it is
installed again from git, it is not updated causing
check_libs_from_git to fail.

[1] https://setuptools.readthedocs.io/en/latest/history.html#v25-0-0

Change-Id: Ibaa1d4157816ea649f4452756fbde25951347001
Closes-Bug: #1605998
---
 inc/python | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/inc/python b/inc/python
index e013dfab36..9de2831537 100644
--- a/inc/python
+++ b/inc/python
@@ -148,11 +148,15 @@ function pip_install {
     fi
 
     $xtrace
+    # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
+    # the same behaviour of setuptools before version 25.0.0.
+    # related issue: https://github.com/pypa/pip/issues/3874
     $sudo_pip \
         http_proxy="${http_proxy:-}" \
         https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
+        SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
         $cmd_pip $upgrade \
         $@
     result=$?

From ba1a64d8eb7ce8611cf518df882845908c72bb0b Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 25 Jul 2016 11:32:42 -0400
Subject: [PATCH 1475/3333] lib/neutron: Add port_security ml2 extension driver

Tempest currently conducts tests for this extension driver by
default.

Change-Id: I5f9881d0713965b66358dc9cade8d623da98d75d
---
 lib/neutron | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/neutron b/lib/neutron
index ad68d8e62f..22584c6eb8 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -166,6 +166,7 @@ function configure_neutron_new {
         iniset $NEUTRON_PLUGIN_CONF ml2 type_drivers vxlan
         iniset $NEUTRON_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+        iniset $NEUTRON_PLUGIN_CONF ml2 extension_drivers port_security
     fi
 
     # Neutron OVS or LB agent

From 8f0e97c1460f015f4eb03a8221b4b02b61559d9d Mon Sep 17 00:00:00 2001
From: WenyanZhang <zhang.wenyan3@zte.com.cn>
Date: Thu, 7 Jul 2016 18:57:32 +0800
Subject: [PATCH 1476/3333] Remove all *.pyc files in $DEST when executing
 clean.sh

Currentlly, the *.pyc files could not be removed in any scripts or
functions. But the redundant files would lead stack.sh not to find the
correct script for some versions after branch switched from master to
stable/mitaka in migration_helpers.sync_database_to_version.

So this commit adds the process of cleaning all the *.pyc files in
clean.sh.

It is needed to execute clean.sh before re-stack.sh to prevent the
exception.

Change-Id: I9ba0674d6b20b13c0a26b22cd5d1939daa121a94
Closes-Bug: #1599124
---
 clean.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/clean.sh b/clean.sh
index 0641bffcf8..e0ec9f5315 100755
--- a/clean.sh
+++ b/clean.sh
@@ -145,3 +145,8 @@ for file in $FILES_TO_CLEAN; do
 done
 
 rm -rf ~/.config/openstack
+
+# Clean up all *.pyc files
+if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
+    sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
+fi

From c694e55ad9707426c05a2139edee037104b009f4 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 1 Aug 2016 12:52:44 +0100
Subject: [PATCH 1477/3333] XenAPI: Don't assume specific network interfaces

The default for GUEST_INTERFACE_DEFAULT now uses the ip command
to find an interface; so it will work on multiple distributions.

XenAPI should not be setting a specific interface here, as it will
almost always be wrong.  In most cases, the calculated value for
GUEST_INTERFACE_DEFAULT will be a better default.

PUBLIC_INTERFACE_DEFAULT makes even less sense as it's often an
internal bridge for devstack scenarios.

In both cases, the right way to override these is to set
GUEST_INTERFACE / PUBLIC_INTERFACE in the localrc rather than
changing the _DEFAULT values.

Change-Id: I0cf84438d778bf1a2481328165513c59167490e2
---
 lib/nova_plugins/hypervisor-xenserver | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e7f1e87b61..e75226ae64 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -24,8 +24,6 @@ set +o xtrace
 # Defaults
 # --------
 
-PUBLIC_INTERFACE_DEFAULT=eth2
-GUEST_INTERFACE_DEFAULT=eth1
 # Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
 FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
 if is_service_enabled neutron; then

From e56318f9bc87b0ed0e1ce6fcd1216aebe3689fe8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 1 Aug 2016 10:29:03 -0400
Subject: [PATCH 1478/3333] Remove manual setting of privsep helper

The privsep helper should have a sane default for all libraries,
pushing this into devstack means we cheat past a part of the upgrade
that we really shouldn't be.

Change-Id: I52259e2023e277e8fd62be5df4fd7f799e9b36d7
---
 lib/cinder | 2 --
 lib/nova   | 5 -----
 2 files changed, 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 69ff4c4e36..a87f395c8e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -273,8 +273,6 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
-    iniset $CINDER_CONF privsep_osbrick helper_command "sudo cinder-rootwrap \$rootwrap_config privsep-helper --config-file $CINDER_CONF"
-
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index 67a80b9b16..16f6e9b39f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -481,11 +481,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
-    iniset $NOVA_CONF privsep_osbrick helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
-
-    iniset $NOVA_CONF vif_plug_ovs_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
-    iniset $NOVA_CONF vif_plug_linux_bridge_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
-
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From 9124a84a968d00582bd8bada154db22b9544bfd0 Mon Sep 17 00:00:00 2001
From: Cao Xuan Hoang <hoangcx@vn.fujitsu.com>
Date: Mon, 1 Aug 2016 14:56:02 +0700
Subject: [PATCH 1479/3333] q-l3 failed to start in case q-fwaas enabled

In case q-fwaas is enabled. It will causes the q-l3 failed to start
because the DevStack gave a redundant --config-file option to start q-l3

This is a follow-up patch of 84409516d56417464dfe0c4e6904a1a76f9fa254
to remove fwaas from DevStack completely.

Change-Id: I630969b3556bcffba506cab02a09cc83f4430c88
Closes-Bug: #1608401
---
 lib/neutron-legacy | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5d91cdabca..44db16a435 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -292,9 +292,6 @@ function _determine_config_server {
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
     echo "$opts"
 }
 

From 75a6454097071523a8617fcbea0f650d42c03341 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 1 Aug 2016 14:41:10 -0400
Subject: [PATCH 1480/3333] neutron: Wait until ovs-vswitchd creates the bridge

Seeing a race condition where lib/neutron code tries to
set the MTU on br-ex before it exists.

Thanks to some good grepping by sdague, it appears that the difference
between lib/neutron and lib/neutron-legacy is that the initial bridge
being created is br-int while in lib/neutron the initial bridge
created is br-ex, which means there must be some kind of warm-up that
occurs between the first bridge that is created by ovs-vswitchd and the
second, and the second one created is much faster.

So instead, let's just wait for the bridge to be created successfully.

Change-Id: I271dc8b6ae5487c80d2a22153b3fc45fb247707f
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 9e1421f5e6..f6d10ea4f9 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -19,7 +19,7 @@ function is_neutron_ovs_base_plugin {
 
 function _neutron_ovs_base_add_bridge {
     local bridge=$1
-    local addbr_cmd="sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge"
+    local addbr_cmd="sudo ovs-vsctl -- --may-exist add-br $bridge"
 
     if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
         addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"

From 5631ca5e126ec2d4c6802d09e312fcb8c1ab4952 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 2 Aug 2016 13:19:14 -0400
Subject: [PATCH 1481/3333] Clean up Horizon Apache configuration files in
 clean.sh

The horizon cleanup function wasn't being called at all during
cleanup which left the Apache configuration.

Change-Id: Iff5336d0c5e79cfc82f1c648afaabb869d86020e
---
 clean.sh    | 1 +
 lib/horizon | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index 0641bffcf8..452df02d80 100755
--- a/clean.sh
+++ b/clean.sh
@@ -95,6 +95,7 @@ cleanup_keystone
 cleanup_nova
 cleanup_neutron
 cleanup_swift
+cleanup_horizon
 
 if is_service_enabled ldap; then
     cleanup_ldap
diff --git a/lib/horizon b/lib/horizon
index 0517e32197..78cbe8b58d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -69,9 +69,8 @@ function _horizon_config_set {
 # cleanup_horizon() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_horizon {
-    local horizon_conf
-    horizon_conf=$(apache_site_config_for horizon)
-    sudo rm -f $horizon_conf
+    disable_apache_site horizon
+    sudo rm -f $(apache_site_config_for horizon)
 }
 
 # configure_horizon() - Set config files, create data dirs, etc

From 0a099763b022ce476f921c8a4bc2ea20ce5f67b4 Mon Sep 17 00:00:00 2001
From: "Lubosz \"diltram\" Kosnik" <diltram@gmail.com>
Date: Wed, 3 Aug 2016 10:21:41 -0500
Subject: [PATCH 1482/3333] Change python version to 3.5

On Ubuntu Xenial there is no way to install python3.4
Use value specified in PYTHON3_VERSION

Change-Id: Ibc69b1c8270bdd240c82cf2acfdfd0730ef0f182
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9de2831537..e4cfab803c 100644
--- a/inc/python
+++ b/inc/python
@@ -370,7 +370,7 @@ function python3_enabled {
 # Install python3 packages
 function install_python3 {
     if is_ubuntu; then
-        apt_get install python3.4 python3.4-dev
+        apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     fi
 }
 

From b8286a3a06c48c10b9efc50c4f0487eba8cdf706 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 Aug 2016 08:09:54 -0400
Subject: [PATCH 1483/3333] remove neutron 3rd party infrastructure

This was used solely by bigswitch, and everyone else has moved over to
devstack plugins. Cleaning this out makes the core logic much simpler.

Depends-On: I8fd2ec6e651f858d0ce109fc335189796c3264b8
(grenade removal)

Change-Id: I47769fc7faae22d263ffd923165abd48f0791a2c
---
 lib/neutron-legacy                          | 49 -------------------
 lib/neutron_thirdparty/README.md            | 41 ----------------
 lib/neutron_thirdparty/bigswitch_floodlight | 54 ---------------------
 lib/neutron_thirdparty/vmware_nsx           |  4 --
 stack.sh                                    | 12 -----
 unstack.sh                                  |  1 -
 6 files changed, 161 deletions(-)
 delete mode 100644 lib/neutron_thirdparty/README.md
 delete mode 100644 lib/neutron_thirdparty/bigswitch_floodlight
 delete mode 100644 lib/neutron_thirdparty/vmware_nsx

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5d91cdabca..cda919363a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1003,55 +1003,6 @@ function _ssh_check_neutron {
     test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
 }
 
-# Neutron 3rd party programs
-#---------------------------
-
-# please refer to ``lib/neutron_thirdparty/README.md`` for details
-NEUTRON_THIRD_PARTIES=""
-for f in $TOP_DIR/lib/neutron_thirdparty/*; do
-    third_party=$(basename $f)
-    if is_service_enabled $third_party; then
-        source $TOP_DIR/lib/neutron_thirdparty/$third_party
-        NEUTRON_THIRD_PARTIES="$NEUTRON_THIRD_PARTIES,$third_party"
-    fi
-done
-
-function _neutron_third_party_do {
-    for third_party in ${NEUTRON_THIRD_PARTIES//,/ }; do
-        ${1}_${third_party}
-    done
-}
-
-# configure_neutron_third_party() - Set config files, create data dirs, etc
-function configure_neutron_third_party {
-    _neutron_third_party_do configure
-}
-
-# init_neutron_third_party() - Initialize databases, etc.
-function init_neutron_third_party {
-    _neutron_third_party_do init
-}
-
-# install_neutron_third_party() - Collect source and prepare
-function install_neutron_third_party {
-    _neutron_third_party_do install
-}
-
-# start_neutron_third_party() - Start running processes, including screen
-function start_neutron_third_party {
-    _neutron_third_party_do start
-}
-
-# stop_neutron_third_party - Stop running processes (non-screen)
-function stop_neutron_third_party {
-    _neutron_third_party_do stop
-}
-
-# check_neutron_third_party_integration() - Check that third party integration is sane
-function check_neutron_third_party_integration {
-    _neutron_third_party_do check
-}
-
 # Restore xtrace
 $_XTRACE_NEUTRON
 
diff --git a/lib/neutron_thirdparty/README.md b/lib/neutron_thirdparty/README.md
deleted file mode 100644
index 905ae776a8..0000000000
--- a/lib/neutron_thirdparty/README.md
+++ /dev/null
@@ -1,41 +0,0 @@
-Neutron third party specific files
-==================================
-Some Neutron plugins require third party programs to function.
-The files under the directory, ``lib/neutron_thirdparty/``, will be used
-when their service are enabled.
-Third party program specific configuration variables should be in this file.
-
-* filename: ``<third_party>``
-  * The corresponding file name should be same to service name, ``<third_party>``.
-
-functions
----------
-``lib/neutron-legacy`` calls the following functions when the ``<third_party>`` is enabled
-
-functions to be implemented
-* ``configure_<third_party>``:
-  set config files, create data dirs, etc
-  e.g.
-  sudo python setup.py deploy
-  iniset $XXXX_CONF...
-
-* ``init_<third_party>``:
-  initialize databases, etc
-
-* ``install_<third_party>``:
-  collect source and prepare
-  e.g.
-  git clone xxx
-
-* ``start_<third_party>``:
-  start running processes, including screen if USE_SCREEN=True
-  e.g.
-  run_process XXXX "$XXXX_DIR/bin/XXXX-bin"
-
-* ``stop_<third_party>``:
-  stop running processes (non-screen)
-  e.g.
-  stop_process XXXX
-
-* ``check_<third_party>``:
-  verify that the integration between neutron server and third-party components is sane
diff --git a/lib/neutron_thirdparty/bigswitch_floodlight b/lib/neutron_thirdparty/bigswitch_floodlight
deleted file mode 100644
index 45a4f2e263..0000000000
--- a/lib/neutron_thirdparty/bigswitch_floodlight
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/bin/bash
-#
-# Big Switch/FloodLight  OpenFlow Controller
-# ------------------------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_BIGSWITCH=$(set +o | grep xtrace)
-set +o xtrace
-
-BS_FL_CONTROLLERS_PORT=${BS_FL_CONTROLLERS_PORT:-localhost:80}
-BS_FL_OF_PORT=${BS_FL_OF_PORT:-6633}
-
-function configure_bigswitch_floodlight {
-    :
-}
-
-function init_bigswitch_floodlight {
-    install_neutron_agent_packages
-
-    echo -n "Installing OVS managed by the openflow controllers:"
-    echo ${BS_FL_CONTROLLERS_PORT}
-
-    # Create local OVS bridge and configure it
-    sudo ovs-vsctl --no-wait -- --if-exists del-br ${OVS_BRIDGE}
-    sudo ovs-vsctl --no-wait add-br ${OVS_BRIDGE}
-    sudo ovs-vsctl --no-wait br-set-external-id ${OVS_BRIDGE} bridge-id ${OVS_BRIDGE}
-
-    ctrls=
-    for ctrl in `echo ${BS_FL_CONTROLLERS_PORT} | tr ',' ' '`; do
-        ctrl=${ctrl%:*}
-        ctrls="${ctrls} tcp:${ctrl}:${BS_FL_OF_PORT}"
-    done
-    echo "Adding Network conttrollers: " ${ctrls}
-    sudo ovs-vsctl --no-wait set-controller ${OVS_BRIDGE} ${ctrls}
-}
-
-function install_bigswitch_floodlight {
-    :
-}
-
-function start_bigswitch_floodlight {
-    :
-}
-
-function stop_bigswitch_floodlight {
-    :
-}
-
-function check_bigswitch_floodlight {
-    :
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_BIGSWITCH
diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
deleted file mode 100644
index e182fca1ae..0000000000
--- a/lib/neutron_thirdparty/vmware_nsx
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-# REVISIT(roeyc): this file left empty so that 'enable_service vmware_nsx'
-# continues to work.
diff --git a/stack.sh b/stack.sh
index 4cace9d0c2..823b63ba24 100755
--- a/stack.sh
+++ b/stack.sh
@@ -843,7 +843,6 @@ fi
 if is_service_enabled neutron; then
     # Network service
     stack_install_service neutron
-    install_neutron_third_party
 fi
 
 if is_service_enabled nova; then
@@ -1093,15 +1092,6 @@ if is_service_enabled neutron; then
     fi
 fi
 
-# Some Neutron plugins require network controllers which are not
-# a part of the OpenStack project. Configure and start them.
-if is_service_enabled neutron; then
-    configure_neutron_third_party
-    init_neutron_third_party
-    start_neutron_third_party
-fi
-
-
 # Nova
 # ----
 
@@ -1235,11 +1225,9 @@ fi
 if is_service_enabled neutron-api; then
     echo_summary "Starting Neutron"
     start_neutron_api
-    # check_neutron_third_party_integration
 elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
     start_neutron_service_and_check
-    check_neutron_third_party_integration
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}
     if is_service_enabled n-cell; then
diff --git a/unstack.sh b/unstack.sh
index a69b2187ce..ece69acad8 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -168,7 +168,6 @@ fi
 
 if is_service_enabled neutron; then
     stop_neutron
-    stop_neutron_third_party
     cleanup_neutron
 fi
 

From 9162608d6e1d13a64dd387486faa221c694ba913 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 4 Aug 2016 15:17:38 +1000
Subject: [PATCH 1484/3333] Revert "stackrc set the LC_ALL to C"

This reverts commit f327b1e1196eacf25e7c4c9e3a7ad30c53bb961c.

The problem being addressed in the original commit was that
rejoin-stack.sh would run with the user's locale, instead of C that
was set in stack.sh

We overlooked that this gets pulled in by openrc, so it is overriding
the user's locale when using clients, etc.

rejoin-stack.sh was removed in
I2f61bb69cc110468a91dcaa4ee7653ede7048467 so we don't have to worry
about that part.  A revert to not touch the user's locale seems
appropriate.

Change-Id: I7c858bb92ce7ba5b5d323bf3ad6776100026c7a2
Closes-Bug: #1608687
---
 stack.sh | 7 +++++++
 stackrc  | 7 -------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/stack.sh b/stack.sh
index 4cace9d0c2..4805c69418 100755
--- a/stack.sh
+++ b/stack.sh
@@ -27,6 +27,13 @@ set -o xtrace
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
+# Sanitize language settings to avoid commands bailing out
+# with "unsupported locale setting" errors.
+unset LANG
+unset LANGUAGE
+LC_ALL=C
+export LC_ALL
+
 # Make sure umask is sane
 umask 022
 
diff --git a/stackrc b/stackrc
index acb7d3f650..7e565e734d 100644
--- a/stackrc
+++ b/stackrc
@@ -7,13 +7,6 @@
 [[ -z "$_DEVSTACK_STACKRC" ]] || return 0
 declare -r _DEVSTACK_STACKRC=1
 
-# Sanitize language settings to avoid commands bailing out
-# with "unsupported locale setting" errors.
-unset LANG
-unset LANGUAGE
-LC_ALL=C
-export LC_ALL
-
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 

From 6a008fa74bce0497b7902dd95300599a3026e2dd Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 Aug 2016 15:09:01 -0400
Subject: [PATCH 1485/3333] Change to neutron by default.

nova-net is deprecated, and it's long time to switch to neutron by
default. This patch does that, and has an auto configuration mode that
mostly just works for the basic case.

It does this by assuming that unless the user specifies an interface
for it to manage, that it will not automatically have access to a
physical interface. The floating range is put on br-ex (per normal),
fixed ranges stay on their OVS interfaces.

Because there is no dedicated interface managed by neutron, we add an
iptables rule which allows guests to route out. While somewhat
synthetic, it does provide a working out of the box developer
experience, and is not hugely more synthetic then all the other
interface / route setup we have to do for the system.

You should be able to run this with a local.conf of just

[[local|localrc]]
ADMIN_PASSWORD=pass
DATABASE_PASSWORD=pass
RABBIT_PASSWORD=pass
SERVICE_PASSWORD=pass

And get a working neutron on a single interface box

Documentation will come in subsequent patches, however getting the
code out there and getting feedback is going to help shape this
direction.

Change-Id: I185325a684372e8a2ff25eae974a9a2a2d6277e0
---
 lib/neutron_plugins/services/l3 | 18 ++++++++++++++----
 lib/nova                        |  5 +++--
 stackrc                         |  6 +++++-
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2180099ee4..61b8402818 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -102,10 +102,20 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent $Q_L3_CONF_FILE
 
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+    # If we've given a PUBLIC_INTERFACE to take over, then we assume
+    # that we can own the whole thing, and privot it into the OVS
+    # bridge. If we are not, we're probably on a single interface
+    # machine, and we just setup NAT so that fixed guests can get out.
+    if [[ -n "$PUBLIC_INTERFACE" ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
+
+        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+        fi
+    else
+        local default_dev=""
+        default_dev=$(ip route | grep ^default | awk '{print $5}')
+        sudo iptables -t nat -A POSTROUTING -o $default_dev -s $FLOATING_RANGE -j MASQUERADE
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 16f6e9b39f..1369c409fc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -128,7 +128,7 @@ fi
 # --------------------------
 
 NETWORK_MANAGER=${NETWORK_MANAGER:-${NET_MAN:-FlatDHCPManager}}
-PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
+
 VLAN_INTERFACE=${VLAN_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 FLAT_NETWORK_BRIDGE=${FLAT_NETWORK_BRIDGE:-$FLAT_NETWORK_BRIDGE_DEFAULT}
 
@@ -659,8 +659,9 @@ function create_nova_cache_dir {
 }
 
 function create_nova_conf_nova_network {
+    local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
     iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
-    iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
+    iniset $NOVA_CONF DEFAULT public_interface "$public_interface"
     iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
     iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
     if [ -n "$FLAT_INTERFACE" ]; then
diff --git a/stackrc b/stackrc
index acb7d3f650..f42bd944fa 100644
--- a/stackrc
+++ b/stackrc
@@ -70,11 +70,13 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-cauth
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
+    # Neutron
+    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
@@ -710,6 +712,8 @@ S3_SERVICE_PORT=${S3_SERVICE_PORT:-3333}
 PRIVATE_NETWORK_NAME=${PRIVATE_NETWORK_NAME:-"private"}
 PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
+PUBLIC_INTERFACE=""
+
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}
 

From 78801c10f023eba12910e92c16a49e2ba7bb1e2f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 Aug 2016 14:10:07 -0400
Subject: [PATCH 1486/3333] enable dns resolution from guests in neutron

When running a default devstack environment, having guests that
actually can resolve DNS, so that they can do package updates from
well known hosts. This addresses a gap between nova-net and neutron
behavior in devstack.

Change-Id: I42fdc2716affd933e9158f1ef7ecb20bc664ef21
---
 lib/neutron        | 3 +++
 lib/neutron-legacy | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 5cab8e1716..b91e880d64 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -188,6 +188,9 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
 
         iniset $NEUTRON_DHCP_CONF DEFAULT debug True
+        # make it so we have working DNS from guests
+        iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
+
         iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
         neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 44db16a435..2d85787252 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -779,6 +779,8 @@ function _configure_neutron_dhcp_agent {
     cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
 
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    # make it so we have working DNS from guests
+    iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_local_resolv True
     iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"

From 3ac1ea85b16cfd5c0d88d3575fc5453cc5dea7c2 Mon Sep 17 00:00:00 2001
From: bkopilov <bkopilov@redhat.com>
Date: Mon, 6 Jun 2016 16:00:48 +0300
Subject: [PATCH 1487/3333] Add a multibackend list to tempest.conf

A change was made to tempest.conf for volume multibackend. Previously,
tempest used the following, with a limit of 2 backends:
 backend1_name = BACKEND1
 backend2_name = BACKEND2
That was changed to accomodate >2 backends. tempest.conf now uses a comma
separated list:
 backend_names=BACKEND1,BACKEND2,BACKEND3

devstack/lib/cinder uses a comma separated list with "type:backend_name":
 enabled_backends = lvm:BACKEND1,ceph:BACKEND2
This is in order to use scripts in devstack/lib/cinder_backends to setup
devstack basked on "type".

This patch allows parsing of the CINDER_ENABLED_BACKENDS to pass the proper
backend_name to tempest.

Change-Id: I76973c3fad4998a0f9e534fc9f6a271c1923f7b3
---
 lib/tempest | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index aa09e9a39f..501480c7d9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -462,15 +462,26 @@ function configure_tempest {
     fi
 
     # Using ``CINDER_ENABLED_BACKENDS``
+    # Cinder uses a comma separated list with "type:backend_name":
+    #  CINDER_ENABLED_BACKENDS = ceph:cephBE1,lvm:lvmBE2,foo:my_foo
     if [[ -n "$CINDER_ENABLED_BACKENDS" ]] && [[ $CINDER_ENABLED_BACKENDS =~ .*,.* ]]; then
+        # We have at least 2 backends
         iniset $TEMPEST_CONFIG volume-feature-enabled multi_backend "True"
-        local i=1
+        local add_comma_seperator=0
+        local backends_list=''
         local be
+        # Tempest uses a comma separated list of backend_names:
+        #   backend_names = BACKEND_1,BACKEND_2
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
-            local be_name=${be##*:}
-            iniset $TEMPEST_CONFIG volume "backend${i}_name" "$be_name"
-            i=$(( i + 1 ))
+            if [ "$add_comma_seperator" -eq "1" ]; then
+                backends_list+=,${be##*:}
+            else
+            # first element in the list
+                backends_list+=${be##*:}
+                add_comma_seperator=1
+            fi
         done
+        iniset $TEMPEST_CONFIG volume "backend_names" "$backends_list"
     fi
 
     if [ $TEMPEST_VOLUME_DRIVER != "default" -o \

From 04d51e4943fff897b7f81799d267e75897fbe672 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Fri, 5 Aug 2016 13:48:23 +0300
Subject: [PATCH 1488/3333] Fix doc formating issue

Change-Id: I9aa8c1fd114e4f4329e06ac263f337ea566d8355
---
 doc/source/plugins.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 70469d6876..31987bc62b 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ The current full list of ``mode`` and ``phase`` are:
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
       been started.
-   - **test-config** Called at the end of devstack used to configure tempest
+   - **test-config** - Called at the end of devstack used to configure tempest
       or any other test environments
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut

From cea7ec8d4bd9f93568eb2e9e05c306535f0ec292 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 5 Aug 2016 08:29:54 -0400
Subject: [PATCH 1489/3333] update front page of devstack docs

The devstack docs have gotten a bit meandering so even the quick start
guide doesn't get you to a working setup without referencing other
pages. This attempts to pull this back in a bit.

Change-Id: I608331cbdae9cbe4f3e8bd3814415af0390a54d0
---
 doc/source/guides.rst   |  68 +++++++++++++
 doc/source/index.rst    | 206 +++++++++++++++++-----------------------
 doc/source/site-map.rst |  21 ++++
 3 files changed, 176 insertions(+), 119 deletions(-)
 create mode 100644 doc/source/guides.rst
 create mode 100644 doc/source/site-map.rst

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
new file mode 100644
index 0000000000..c2c7b9163a
--- /dev/null
+++ b/doc/source/guides.rst
@@ -0,0 +1,68 @@
+Guides
+======
+
+.. warning::
+
+   The guides are point in time contributions, and may not always be
+   up to date with the latest work in devstack.
+
+Walk through various setups used by stackers
+
+.. toctree::
+   :glob:
+   :maxdepth: 1
+
+   guides/single-vm
+   guides/single-machine
+   guides/lxc
+   guides/multinode-lab
+   guides/neutron
+   guides/devstack-with-nested-kvm
+   guides/nova
+   guides/devstack-with-lbaas-v2
+
+All-In-One Single VM
+--------------------
+
+Run :doc:`OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
+they are running in QEMU (emulation), but it is useful if you don't have
+spare hardware laying around. :doc:`[Read] <guides/single-vm>`
+
+All-In-One Single Machine
+-------------------------
+
+Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can include a
+server-class machine or a laptop at home.
+:doc:`[Read] <guides/single-machine>`
+
+All-In-One LXC Container
+-------------------------
+
+Run :doc:`OpenStack in a LXC container <guides/lxc>`. Beneficial for intermediate
+and advanced users. The VMs launched in this cloud will be fully accelerated but
+not all OpenStack features are supported. :doc:`[Read] <guides/lxc>`
+
+Multi-Node Lab
+--------------
+
+Setup a :doc:`multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management.
+:doc:`[Read] <guides/multinode-lab>`
+
+DevStack with Neutron Networking
+--------------------------------
+
+Building a DevStack cluster with :doc:`Neutron Networking <guides/neutron>`.
+This guide is meant for building lab environments with a dedicated
+control node and multiple compute nodes.
+
+DevStack with KVM-based Nested Virtualization
+---------------------------------------------
+
+Procedure to setup :doc:`DevStack with KVM-based Nested Virtualization
+<guides/devstack-with-nested-kvm>`. With this setup, Nova instances
+will be more performant than with plain QEMU emulation.
+
+Nova and devstack
+--------------------------------
+
+Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 68ec174f3a..c1302eb930 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -1,163 +1,131 @@
-DevStack
-========
+.. Documentation Architecture for the devstack docs.
+
+   It is really easy for online docs to meander over time as people
+   attempt to add the small bit of additional information they think
+   people need, into an existing information architecture. In order to
+   prevent that we need to be a bit strict as to what's on this front
+   page.
+
+   This should *only* be the quick start narrative. Which should end
+   with 2 sections: what you can do with devstack once it's set up,
+   and how to go beyond this setup. Both should be a set of quick
+   links to other documents to let people explore from there.
+
+==========
+ DevStack
+==========
 
 .. image:: assets/images/logo-blue.png
 
 DevStack is a series of extensible scripts used to quickly bring up a
-complete OpenStack environment.  It is used interactively as a
-development environment and as the basis for much of the OpenStack
-project's functional testing.
+complete OpenStack environment based on the latest versions of
+everything from git master.  It is used interactively as a development
+environment and as the basis for much of the OpenStack project's
+functional testing.
 
 The source is available at
 `<https://git.openstack.org/cgit/openstack-dev/devstack>`__.
 
-.. toctree::
-   :glob:
-   :maxdepth: 1
+.. warning::
 
-   overview
-   configuration
-   plugins
-   plugin-registry
-   faq
-   hacking
+   DevStack will make substantial changes to your system during
+   installation. Only run DevStack on servers or virtual machines that
+   are dedicated to this purpose.
 
 Quick Start
------------
-
-#. Select a Linux Distribution
-
-   Only Ubuntu 14.04 (Trusty), Fedora 22 (or Fedora 23) and CentOS/RHEL
-   7 are documented here. OpenStack also runs and is packaged on other
-   flavors of Linux such as OpenSUSE and Debian.
-
-#. Install Selected OS
-
-   In order to correctly install all the dependencies, we assume a
-   specific minimal version of the supported distributions to make it as
-   easy as possible. We recommend using a minimal install of Ubuntu or
-   Fedora server in a VM if this is your first time.
-
-#. Download DevStack
-
-   ::
-
-       git clone https://git.openstack.org/openstack-dev/devstack
-
-   The ``devstack`` repo contains a script that installs OpenStack and
-   templates for configuration files
-
-#. Configure
+===========
 
-   We recommend at least a :ref:`minimal-configuration` be set up.
-
-#. Add Stack User
-
-   Devstack should be run as a non-root user with sudo enabled
-   (standard logins to cloud images such as "ubuntu" or "cloud-user"
-   are usually fine).
-
-   You can quickly create a separate `stack` user to run DevStack with
-
-   ::
-
-       devstack/tools/create-stack-user.sh; su stack
-
-#. Start the install, this will take a few minutes.
-
-   ::
+Install Linux
+-------------
 
-       cd devstack; ./stack.sh
+Start with a clean and minimal install of a Linux system. Devstack
+attempts to support Ubuntu 14.04/16.04, Fedora 23/24, CentOS/RHEL 7,
+as well as Debian and OpenSUSE.
 
-Guides
-======
+If you do not have a preference, Ubuntu 16.04 is the most tested, and
+will probably go the smoothest.
 
-Walk through various setups used by stackers
+Download DevStack
+-----------------
 
-.. toctree::
-   :glob:
-   :maxdepth: 1
+::
 
-   guides/single-vm
-   guides/single-machine
-   guides/lxc
-   guides/multinode-lab
-   guides/neutron
-   guides/devstack-with-nested-kvm
-   guides/nova
-   guides/devstack-with-lbaas-v2
+   git clone https://git.openstack.org/openstack-dev/devstack
 
-All-In-One Single VM
---------------------
+The ``devstack`` repo contains a script that installs OpenStack and
+templates for configuration files
 
-Run :doc:`OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
-they are running in QEMU (emulation), but it is useful if you don't have
-spare hardware laying around. :doc:`[Read] <guides/single-vm>`
+Create a local.conf
+-------------------
 
-All-In-One Single Machine
--------------------------
+Create a ``local.conf`` file with 4 passwords preset
 
-Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can include a
-server-class machine or a laptop at home.
-:doc:`[Read] <guides/single-machine>`
+::
 
-All-In-One LXC Container
--------------------------
+   [[local|localrc]]
+   ADMIN_PASSWORD=secret
+   DATABASE_PASSWORD=$ADMIN_PASSWORD
+   RABBIT_PASSWORD=$ADMIN_PASSWORD
+   SERVICE_PASSWORD=$ADMIN_PASSWORD
 
-Run :doc:`OpenStack in a LXC container <guides/lxc>`. Beneficial for intermediate
-and advanced users. The VMs launched in this cloud will be fully accelerated but
-not all OpenStack features are supported. :doc:`[Read] <guides/lxc>`
+This is the minimum required config to get started with DevStack.
 
-Multi-Node Lab
+Add Stack User
 --------------
 
-Setup a :doc:`multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management.
-:doc:`[Read] <guides/multinode-lab>`
+Devstack should be run as a non-root user with sudo enabled
+(standard logins to cloud images such as "ubuntu" or "cloud-user"
+are usually fine).
 
-DevStack with Neutron Networking
---------------------------------
+You can quickly create a separate `stack` user to run DevStack with
 
-Building a DevStack cluster with :doc:`Neutron Networking <guides/neutron>`.
-This guide is meant for building lab environments with a dedicated
-control node and multiple compute nodes.
+::
 
-DevStack with KVM-based Nested Virtualization
----------------------------------------------
+   devstack/tools/create-stack-user.sh; su stack
 
-Procedure to setup :doc:`DevStack with KVM-based Nested Virtualization
-<guides/devstack-with-nested-kvm>`. With this setup, Nova instances
-will be more performant than with plain QEMU emulation.
+Start the install
+-----------------
 
-Nova and devstack
---------------------------------
+::
 
-Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
+   cd devstack; ./stack.sh
 
-DevStack Documentation
-======================
+This will take a 15 - 20 minutes, largely depending on the speed of
+your internet connection. Many git trees and packages will be
+installed during this process.
 
-Overview
---------
+Profit!
+-------
 
-:doc:`An overview of DevStack goals and priorities <overview>`
+You now have a working DevStack! Congrats!
 
-Configuration
--------------
+Your devstack will have installed ``keystone``, ``glance``, ``nova``,
+``cinder``, ``neutron``, and ``horizon``. Floating IPs will be
+available, guests have access to the external world.
 
-:doc:`Configuring and customizing the stack <configuration>`
+You can access horizon to experience the web interface to
+OpenStack, and manage vms, networks, volumes, and images from
+there.
 
-Plugins
--------
+You can ``source openrc`` in your shell, and then use the
+``openstack`` command line tool to manage your devstack.
 
-:doc:`Extending DevStack with new features <plugins>`
+You can ``cd /opt/stack/tempest`` and run tempest tests that have
+been configured to work with your devstack.
 
-FAQ
----
+Going further
+-------------
 
-:doc:`The DevStack FAQ <faq>`
+Learn more about our :doc:`configuration system <configuration>` to
+customize devstack for your needs.
 
-Contributing
-------------
+Read :doc:`guides <guides>` for specific setups people have (note:
+guides are point in time contributions, and may not always be kept
+up to date to the latest devstack).
 
-:doc:`Pitching in to make DevStack a better place <hacking>`
+Enable :doc:`devstack plugins <plugins>` to support additional
+services, features, and configuration not present in base devstack.
 
+Get :doc:`the big picture <overview>` of what we are trying to do
+with devstack, and help us by :doc:`contributing to the project
+<hacking>`.
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
new file mode 100644
index 0000000000..480d6aaf5e
--- /dev/null
+++ b/doc/source/site-map.rst
@@ -0,0 +1,21 @@
+:orphan:
+
+.. the TOC on the front page actually makes the document a lot more
+   confusing. This lets us bury a toc which we can link in when
+   appropriate.
+
+==========
+ Site Map
+==========
+
+.. toctree::
+   :glob:
+   :maxdepth: 3
+
+   overview
+   configuration
+   plugins
+   plugin-registry
+   faq
+   hacking
+   guides

From 6a42a85b561c35157b14f63ab02536e18e5bb0d9 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Thu, 21 Jul 2016 11:11:54 -0700
Subject: [PATCH 1490/3333] Fixes for linux bridge and Q_USE_PROVIDER_NET

===Set bridge_mappings for linux bridge===
The external network physnet needs a bridge_mapping to the public
bridge when the L2 agent is responsible for wiring.

===Add PUBLIC_PHYSICAL_NETWORK to flat_networks===
This network must be present in the ML2 flat_networks config if
flat_networks is specified.

===Set ext_gw_interface to PUBLIC_BRIDGE in provider net case===
ext_gw_interface must be a bridge in a bridge_mapping when
Q_USE_PROVIDERNET_FOR_PUBLIC is used.

Closes-Bug: #1605423
Change-Id: I95d63f8dfd21499c599d425678bf5327b599efcc
---
 lib/neutron_plugins/linuxbridge_agent |  3 +++
 lib/neutron_plugins/ml2               | 12 ++++++++++--
 lib/neutron_plugins/services/l3       | 11 ++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index e5a7b76187..437aaeb896 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,6 +62,9 @@ function neutron_plugin_configure_plugin_agent {
     if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
+    if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+    fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
     fi
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 2ece210a0b..7e8020930f 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -95,8 +95,16 @@ function neutron_plugin_configure_service {
 
 
     # Allow for setup the flat type network
-    if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" && -n "$PHYSICAL_NETWORK" ]]; then
-            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$PHYSICAL_NETWORK"
+    if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" ]]; then
+        if [[ -n "$PHYSICAL_NETWORK" || -n "$PUBLIC_PHYSICAL_NETWORK" ]]; then
+            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks="
+            if [[ -n "$PHYSICAL_NETWORK" ]]; then
+                Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PHYSICAL_NETWORK},"
+            fi
+            if [[ -n "$PUBLIC_PHYSICAL_NETWORK" ]]; then
+                Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PUBLIC_PHYSICAL_NETWORK},"
+            fi
+        fi
     fi
     # REVISIT(rkukura): Setting firewall_driver here for
     # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 61b8402818..a4e72483b4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -306,10 +306,15 @@ function _neutron_configure_router_v4 {
         if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
         elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Search for the brq device the neutron router and network for $FIXED_RANGE
+            # Get the device the neutron router and network for $FIXED_RANGE
             # will be using.
-            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-            ext_gw_interface=brq${EXT_NET_ID:0:11}
+            if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
+                # in provider nets a bridge mapping uses the public bridge directly
+                ext_gw_interface=$PUBLIC_BRIDGE
+            else
+                # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
+                ext_gw_interface=brq${EXT_NET_ID:0:11}
+            fi
         fi
         if [[ "$ext_gw_interface" != "none" ]]; then
             local cidr_len=${FLOATING_RANGE#*/}

From 894ccc90c0a0795c84ce69afd9a68863a9004f20 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 8 Aug 2016 16:19:05 -0400
Subject: [PATCH 1491/3333] disable metering extension in tempest if q-metering
 not running

We don't run q-metering in default single host configuration, so we
should make it so that tempest won't attempt to test for it either.

Change-Id: I928be70e3b10fc3753fd1081631e54fa839b671d
---
 lib/tempest | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index e4f80b835d..10c1a71805 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -569,6 +569,12 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
     # Neutron API Extensions
+
+    # disable metering if we didn't enable the service
+    if ! is_service_enabled q-metering; then
+        DISABLE_NETWORK_API_EXTENSIONS+=", metering"
+    fi
+
     local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint

From ea270d50d091bad57ee0b21b405c41bf2d798631 Mon Sep 17 00:00:00 2001
From: "watanabe.isao" <watanabe_isao@jp.fujitsu.com>
Date: Tue, 9 Aug 2016 16:28:52 +0900
Subject: [PATCH 1492/3333] Give PUBLIC_INTERFACE a default value

Also means to make it changeable.

Closes-Bug: #1611247
Change-Id: I0dc253b7ecf44a49d152f97f4858f7f2cf2ca6b2
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index f42bd944fa..4fefe8da30 100644
--- a/stackrc
+++ b/stackrc
@@ -712,7 +712,7 @@ S3_SERVICE_PORT=${S3_SERVICE_PORT:-3333}
 PRIVATE_NETWORK_NAME=${PRIVATE_NETWORK_NAME:-"private"}
 PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
-PUBLIC_INTERFACE=""
+PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-""}
 
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}

From 0ffdfbdbd72ae447eb4b5e3d0f255c5498a07a36 Mon Sep 17 00:00:00 2001
From: "Lubosz \"diltram\" Kosnik" <diltram@gmail.com>
Date: Tue, 2 Aug 2016 16:35:22 -0500
Subject: [PATCH 1493/3333] Run n-cpu using LXD_GROUP when LXD virt driver

Enabling nova-lxd require to run n-cpu using lxd group

Change-Id: I0553dafcc797fcc1342501a558c7455261cf3daf
---
 lib/nova | 2 ++
 stackrc  | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 67a80b9b16..8fe4c29d86 100644
--- a/lib/nova
+++ b/lib/nova
@@ -825,6 +825,8 @@ function start_nova_compute {
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
+    elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
diff --git a/stackrc b/stackrc
index acb7d3f650..b5d1bc0b6c 100644
--- a/stackrc
+++ b/stackrc
@@ -586,6 +586,9 @@ case "$VIRT_DRIVER" in
             LIBVIRT_GROUP=libvirtd
         fi
         ;;
+    lxd)
+        LXD_GROUP=${LXD_GROUP:-"lxd"}
+        ;;
     fake)
         NUMBER_FAKE_NOVA_COMPUTE=${NUMBER_FAKE_NOVA_COMPUTE:-1}
         ;;

From 7b229359671f23b73e8df9f6ef6dbbe443cc96ae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 9 Aug 2016 13:29:11 -0400
Subject: [PATCH 1494/3333] delete compute api extension config for tempest

Compute API extensions are deprecated, we should never be setting this
in Tempest in master.

Change-Id: I6ad25fab48277abf8a000a275d3fea73a595cdf6
---
 lib/tempest | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 10c1a71805..e46fc149d7 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -559,15 +559,7 @@ function configure_tempest {
     # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
     tox -evenv -- tempest verify-config -uro $tmp_cfg_file
-    # Nova API extensions
-    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
+
     # Neutron API Extensions
 
     # disable metering if we didn't enable the service

From 5068b291f427a55b40357cc0cb77875294963e39 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 9 Aug 2016 14:52:57 -0400
Subject: [PATCH 1495/3333] tempest: toggle allow_port_security_disabled=True

This enables a new test in Tempest to run on a per-branch
basis since by default it's disabled because it won't pass
on liberty given the bug fix isn't in liberty and won't be
backported there.

Depends-On: I20b8d5d2a300c83a59bdb33374fc20447ce2ede3

Change-Id: I18fd5e0978795fec39a763e1e0f07d758905b9b8
Related-Bug: #1175464
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d1e56a4c4d..9182fea387 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -352,6 +352,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
+    # TODO(mriedem): Remove allow_port_security_disabled after liberty-eol.
+    iniset $TEMPEST_CONFIG compute-feature-enabled allow_port_security_disabled True
     iniset $TEMPEST_CONFIG compute-feature-enabled personality ${ENABLE_FILE_INJECTION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}

From 5c39154c39cb23c78f3f130719614624681bd1f3 Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Wed, 10 Aug 2016 15:58:27 +0100
Subject: [PATCH 1496/3333] Ensure testing configuration can run as late as
 possible

Before the code in the extra.d plugins was removed from the devstack
tree they could define the order they ran. When this code is decomposed
into a plugin, there is still a need to do some form of ordering. This
caused problems with the Ironic devstack plugin and Tempest because the
code is run in this order:

 1. The tempest configuration is run from extra.d, processing
    DEFAULT_INSTANCE_TYPE, and writing the flavor_ref to tempest.conf

 2. The Ironic devstack plugin is run, creating the flavor needed for
    DEFAULT_INSTANCE_TYPE

This leads to build failures as tempest can not find the required
flavor, so it writes which ever flavor it can find at the time into
flavor_ref. Ironic now has code it its devstack plugin duplicated from
the tempest plugin to work around this problem until this is merged.

This patch fixes this by using the test-config phase to move the tempest
plugin as late as possible in the devstack process.

Change-Id: I3d98692e69d94756e0034c83a247e05d85177f02
---
 extras.d/80-tempest.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 6a3d121497..15ecfe39eb 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -11,13 +11,16 @@ if is_service_enabled tempest; then
         # Tempest config must come after layer 2 services are running
         :
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
+        # Tempest config must come after all other plugins are run
+        :
+    elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
+        # local.conf Tempest option overrides
+        :
+    elif [[ "$1" == "stack" && "$2" == "test-config" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
         echo_summary "Installing Tempest Plugins"
         install_tempest_plugins
-    elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
-        # local.conf Tempest option overrides
-        :
     fi
 
     if [[ "$1" == "unstack" ]]; then

From a2ec7fdb48d5df464fec3fae1f93ae3ea1071c54 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 10 Aug 2016 11:14:00 -0700
Subject: [PATCH 1497/3333] Configure project_network_cidr for tempest

This value defaults to something not (necessarily) in our fixed range,
which will cause spurious test behavior. We know the value for this, so
just configure it properly.

Change-Id: I0ee3b71f509377dc7174ce97575e60ee2095f893
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6bfa8890b6..7a1d25f195 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -236,6 +236,8 @@ function configure_tempest {
         fi
     fi
 
+    iniset $TEMPEST_CONFIG network project_network_cidr $FIXED_RANGE
+
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
     # the public network (for floating ip access) is only available

From 14d86e841c964ba12a57a652ece4239ca9283c92 Mon Sep 17 00:00:00 2001
From: Gregory Haynes <greg@greghaynes.net>
Date: Fri, 29 Jul 2016 03:45:37 +0000
Subject: [PATCH 1498/3333] Set oslo_messaging_notifications driver

This config option is requied in order for nova notificaions to
function, and enabling it doesn't cause any harm (there is another
option for turning notifications on).

Change-Id: I309af6cc43af485f795c368d304ebe71fceb1a03
---
 lib/nova | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 67a80b9b16..c59a718b56 100644
--- a/lib/nova
+++ b/lib/nova
@@ -541,7 +541,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
         iniset $NOVA_CONF DEFAULT instance_usage_audit_period "hour"
         iniset $NOVA_CONF DEFAULT notify_on_state_change "vm_and_task_state"
-        iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
     fi
 
     # All nova-compute workers need to know the vnc configuration options
@@ -582,6 +581,9 @@ function create_nova_conf {
         iniset $NOVA_CONF spice enabled false
     fi
 
+    # Set the oslo messaging driver to the typical default. This does not
+    # enable notifications, but it will allow them to function when enabled.
+    iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 

From bd6614a8e0040690aca5121cdf08a7ee17fe7984 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 11 Aug 2016 09:05:16 -0400
Subject: [PATCH 1499/3333] Add development page with devstack

It turns out we never really had a document on how to work with
devstack in the devstack docs. At one point this was just cultural
knowledge passed down, but with the size of our community, we can't
rely on that any more.

Change-Id: I28f896ea507ccbba5164ebfc5415d22207f52e98
---
 doc/source/assets/images/screen_session_1.png | Bin 0 -> 386703 bytes
 doc/source/development.rst                    | 140 ++++++++++++++++++
 doc/source/index.rst                          |   3 +
 doc/source/site-map.rst                       |   1 +
 4 files changed, 144 insertions(+)
 create mode 100644 doc/source/assets/images/screen_session_1.png
 create mode 100644 doc/source/development.rst

diff --git a/doc/source/assets/images/screen_session_1.png b/doc/source/assets/images/screen_session_1.png
new file mode 100644
index 0000000000000000000000000000000000000000..6ad6752bb10870da57b35c0fa3930419a4d0e445
GIT binary patch
literal 386703
zcma&Nb980V*Cl#mCl%YaZQHg{F)Ox>ifvTvq+;8)Z9D1I*Zuq68~t97(SMzD_SyH|
zJ=Wc8t-1D`D_lWN91a=_8UO&mNlJ()0RUiU004**B=Gl$2NLl1_XWgBNKyq75^`-v
z{@>#dXHgAjWjixxS3^frfU<>)v$LtAalkYb06+kc6cJQ$TRqox^+FNF_G!|QzRCjR
zJ)wDA$qFNj2mpccD=MNW3JlN@Q0W$iNvJBKfS$}+LDCi?B1sT;9KBvlK8YhGbeq~;
z(ILip`@E35vfJgPxo&2qfsshW5eNo=LLvQM+#GfX<dITKxOovc<!X*Ve}AMyCID2s
zo5QcT5cZTGMoQ1=GwFIOxPaNR`bvo=ah!M>orGOF?%HBPp3ZsA-8whEt7bW|vMDR(
zPg}*8$@*(QMg|#XV@MC1ImA@{72NjEEi57<e7F&m2cAPZSd2Nz6Efo9pR18wMeX$s
z967!;NOmvv+*-6ZQyBC7w2K4-%f1i@)MQq%)$?Q7GSe!<p>@gr2Vccb;`|5m>w9s`
z!=>GdGILc81;lP}lrcvIYz~~K>ACM=Jx8qWDPr#{Pcobyo|2mJf|MtdTXmhLs)|VU
z-55DH&mxVLwKodeAN=l1W<sBpY(}Eb!`T+T=N?kBBJki*0}YpujzNmiYwWeB5IS`3
zC}@fnFDRXOAxZcK`c=m>8>n~uBEHCnULn!}c=spa`g*;O2sL~UhEo!<xYXzl7R@o$
zHh)uX34%}t@HJTKs&;$O@H#r%t%;U4E9@=_;rABJ)*;TmIun#Erh~c=i5@v)8T3tu
zOX(lihYuhLL&mAO`Eiga>XoDg(}KIaA(<ktfdQjseW58bLH*v#GIYsxce%QjN?<AG
zpv<g>aE4cr^&yQ|BV}lJCVfkzeTyS~YNH+<qo7OWN(m+zb^iwbe7aaErw1t0@+a`?
ze(ux+*ToS39CFN~pf8@{a_`zf(RIK7lH;@XC?Zc`;d!mw;G-{K*w$?lEJ&veo6Sya
zCb!@p?HlM6lmR+9QLH2~&Nvxg8f2D^a*&J-6M>Jpx`1>qW9Dq)a=(0^ckyHy;Hf^M
zMxdR%y10t-nr@!-?pPZ!)zz_ZbS&!n*z{Kw2Ok{RDPuqVXy|frHhSw&Ml}VsC|+33
zeei7#mxq^?yR^TMC}<T%al{5mcC^pKI~P8D(F%f${?iCP(U7L|RUHODGLkn#jy;7<
zQ=K0##JIl^B3>0rMjlG0XZ!h)QRTCUkd#=^m+{6$Lf-6EPe`h!Z`j$(w8lyRrC5xk
zYRqTjNJhuP$$39mD|Q!3iJ~@G$lLU1F;K{hGN-CD(%06Vmht;F%dOj9tT-huh1I(i
zv#DWp5b@$69#vIJntlqKxq8)adUt=dq%Xad1l>kCw&f>7ct-?9Dxu3y3!b~in{jrs
zv*cr`zjK!E%j^{?f271_Tp>w+#h8_KD_XDhpcpGpZu3Q4F!&wX*|RsL=Of$%YuOk3
zvSQbIkXem6YY})_X7N~Oc^#+J#T5KZY9Zfj$REU$(T*3ylz0bM?gyWXzT2;rHnxt5
z4h0^Z3GgkC)<EQ|`*HF3(DQ|t&L0>H(c^|Y#%?$Pv_3Cn?nN@n9vx!5fU%!7FaT_I
zs+bM=5HOBVsY45v2fVv<SAjh!HxQ%B(E&xSZoC4jQlBsWn;~;O2-i?GjC*0|4S(mE
zEb|j@D{8=d1oCaFxg)*PF+U98SMk}fC0B8(?`*NMULC2`$?(*{FURp{dp9`JTjy7z
z;sVjxx;qqX2-NMujCj8J@xlN3+0ZP#dBES~`!=^wKIAlT@H4>c=aiw<)P;vX&b!B=
z`qKSF$fVZw$>-u9_=`jR#W2U>+;KD(4+<vjTcNZ);B3vVuQ_-%+dU%{I;r&yuCtD=
zdMSLIv^u)|>ql+j={KTE!wxZ)1C`MHgx2BTL63zWf0=EL=Jd8Qs&vSbWL4d|oy(Q-
zR9s7FVqNaRB=@U6gtsMHoAS>PjCng`zpS_6L{QHBD6K8frSQjw@D4c1M+;alPJ~GF
z!4K`|!rK~9^~gSdfs^p`60Dl=Jv|nX#Mk8wDf@?M*;_r5eSAn_h(bKxzuaf!`gaP9
z2Lj1*Q^&PZo9-|guMEc(OqR2FwS~M^Z{aKtj5zNJY`$)>C?3grajt|2Z=9JQ`aXqL
zElaXKyI-j<u@>h<yxw|DSWA>9S0B((mBz=hmU8W3pTCb6?VB9-HtPIl{A6BaSB;K-
zJq8vBOj~z}PAo<fk}r}~hZDNIK6i4qDJq-ZPY+;Kx>ahd)C@$MH|JMOF9GWdrd>#f
z22s@CDwb!^UJT{v<<v3xTQaVGC0%8BbpBvHatqD~GMdHHh8l8u@Ja(rv96spv?<rT
ztevZf%{;m1pr^1a7H_4x>Q(sK6k011?}RnBhOWXL;mK4BzxRk+vw2V`As#1$!vnyQ
zz!fy9nK$a#U2Xxj1I#oBTd|MPyLPE#j5PbOOjHbsLQJkZ;&R5MSD^{fHPOqL)w83p
ze1_yDYzpv%iFO3n6iZ@m39e}XdwV0TU+xuk7~DpCGa`+M)V<<p`5W1M&s%{wAlyKb
zZmuA+t>O}NLt+}wun|*+hiv;=$g{898Z}TCGRsMNPP5Y(w^W<feskir)aX5xjFvyt
zh8cIrOUuFI)hRkLy?sYg9|n)^e*EdH=FWrfFWk{6>Q1zwXkAL)w?047P&+$mC5((a
zyGy4A_&s{O9(f7TjhCux-5CaEucgUBQiea@S+Kd=$A(mVj)k%Y720~{g$KHj+6#6j
zPB{&6CN%xAN{f@pIyrJnXsY|2I-;y$CXL05lNQ{eu<44``AbOJ_Um;{w)}B>`crul
z+3}FmZd6NKla5>U%-dnHMwFOz<AwWWy6gbefpp=X*nL@QajR9QsQA3b<u+zQw4tbM
zoAb72p&}OPM=gZ-Og3(l9N)I4mY$^MDI#~m@w7ZzliVVU0#)O@P{c|mZl~PhpHE`4
zWaFo}<NZe~Pd){3(*xp8yWg2OSZ}U<xaz|A>-7R}ZWnU!AI6|oY#}RLn`?F<Wcsj}
zbKUDNcT)J2TA*37@Vwkpf`*ZbsLBXIWI6EGROmzMZWYMW63bXIa{9VZvV8kn67YbA
z(6v+Syb;g#K&hc$^0E3?K_R|}`wDF7BjoRx={R`nYClC~3pe-4Zbm8>X>8oL=wN}o
zX|GWeS32X6@@eeQ+_*UJ$9W)3Ut;-Nf24mWms@L98<|yOYUvxA;gqVig_-7e%9INK
zt(pC4EBzEqwJ2Yk0_&N#UhnBDJgVifAhYGe^HG=E1FM5Ev*}5cYl@2=_ZB5Zm1!OK
zW%8(k;TpP)z<MRTrhFd$+FuAU3Glj<_@5E7Pw14#)2K~N-Wb>EWC(9DaL!Fdm0N4K
zH3t<b`QZIEgn?8xv%^<6lBRgg%QahFO>e{hwI`8sd}4{2cdjjp4pZMb<><vjS5d}%
z0djV|_XG~S;}8=YRQ(yxq;l0l8GnFi?gsumEWcp+RQ-i0nTY%j#ZwT8q^ld|+xKKq
zw|^?CMs-!WLQB(Qu}`DJz}9x}0o_M9Z<kZ+=H&9nCykGC;0VgU`Zpi$d{$b`s&|sc
zh+jAO^I8!!THO4oKF4ZKGWJ;1Fojd;3vTU;3@H{9QD0hiqj*40!=;adP0>D^noP~S
zLaO<0-oDzWI@esE6C^4*MokxD#F*K9*H~{m;IB+8@!ta8K6+J!F#&t$XTY-7RWTY?
z)G#MeaZdvpeF0*-xx~#rhi4PT*o`GjazD=Smaj#$L9ci5?xt0`719@O5q(uxYKXH*
zFN79wC+BVC+ggDA2qWcJO(I%NUka<n2%1#UM+b5e82!RgM6TI=4sYjCrGKW_T9=nt
z$jb`|-`<tJWowUMGt!F90l`s(<nDu`cVvyVxQZp_c|lCOXw6*$CC(zE2(augDj7!=
z-3d0ZZ#??S2r!6ZOX_h{KNf*tD-42Ou0H9A8J=v5u=)hrEQcBW^b@~<qcal+(}%%=
zY68o(9BIIid;?Qv5nw5#h>u+xH$|Dx?<6XY11z0XyFHv;E|W+c7Uu&{HY9v)owW+9
z?yZ{U_H*6mc(_1k3ng5wtxh4f&<Z!(;)KYqJ{+gd(brdB=Kz#ab7Jq_PaDBtY01Cn
zhq0dVxzLsY00w96w*6W8Ii`?D$>>=SGUNUDOi|C<CLGe=k8Li#(~)u&%+J~{heoMJ
z9+PmVdGnPXH<MRThj>3#Ec;GmxCCtfh=?obk4m!I>RngVPWnrskd<D&f^g=)Ko1r9
zi3Kbwu-zV?g%8^~BEx;}8dMuT3y)XKDY?s)vK52G3TC*1bb9=WmI~kiF17Qul!YhF
zzulC-4DVAoA3|acMOHOat82!Sm7~x;GuWS9piMBk6H9n&i7)z!O!<(C&lRT1;9E9^
zT#EAG8qKB{=jNd<FV>l^_BA3TJ*`QP1*N@S3Y}0x*P}I8Rfq$0erg3}UF2B{{>vEE
zq0kRZV+2Q^M7n*cK7#L;i4YLne;(}3MDV$$5kqtw4ZBWal|_U{2QU4Vm+9ar_z@WV
z%KUWrtX~f(6xGkEg!+8WOM#q05PragbB$aq_Z_9<S(OFl@r{+WF;2WGr}?I@gzQa+
z{Nzlyfde%qXgz8z)%Ef(mdO}|F_D!<&%9VMJR9}NdF$92H<jiLd}-QWG#@-h5fBZf
zGXrsKA<jv;>ax#oqch~SO@*&KjQ(XtoNQ*E*P{*g!@m6iQw7ub?}oW!61D*mSjr1F
z_a6z;L{vx<1r*f#?1~O-*InVNX$>_<3<f-Q(Jf{RPd1^R4*E4Cf{Ps}Kzllh-Y%Ur
zdb9TWX$w^>oae1Zq~?}EldSycK&TNQpOEu=vHUMYS<4j&RDVvinU;P;5K?pwie7Cq
z-Hny!vu%l)Nb@5tL5PZE@qT)1s3x2gEgt&`XN>Y~HUX@pjzqvWz>O`i8z2Kxh%Nk<
z4A#^&JWJYvXW{Ll1fK||!F6~e7rKbVKmbhm<KA%IXF|3D`=W)<h6chYTfMug9K@GA
ziFJJ0P`!=OEw=)g`8y2lYuJRH3c&4Hh~~8(=(b68ajF`1NV;RxPF6=oW8Qd$)433v
zSm90C1ePL4s+ZvQj{Sk6yhcLtXrR;Pgnx;gdM<FfVIruWybbo98)OEgyLLNbN-1>4
zW~y23Awro(kuJu*a%-5u*#<9h5@TX2ZhG<ASpWj9ESC6w=iW<B+Zz`zj6mv5A8Gc7
zY{fy&uxi#L)4;D8{InXN0*lKs5!;J<3k>X;o=0s~SXyL(GZb8VP2Ee04zE|*sr+{t
z>OPo_@0Q_z9`0X2P@0qNB2XI5btTNCw-)Qh;VVnzEdKyrJD*jq>xMZBC`JL@iy41?
z6hp_Z8uieMyeH4YY?7G(!|Q<?J<kZ)JS(J^gTeLcO7mWD-_h@hR=Y1>%*aq`2ZnRC
z0Bj(W;K`9rOL7EfbVvwZ%sa^;O%-V|-qEJ7;nHuntCc4!^%eI(AHs_yr=(U?Vl@)p
zJLkbk#D~L`84Mh_2wh4l5*M7$HkvZrzYcEhZyV=QQz37l#3~<MHAV!NvxIAL1~up3
zsHI!L_H^V0Yy9Ew=Zqn!cFHeX)#RjGH0vw&pQdEKRuCnMGY{EDToZYdUPhw}$rI@h
zVho*Hd@n5enc^}yq^`m~*^o!vbDKRXJwS7~a2u8^dstJVw!$0cX}^qzccR;&0HFcY
zUe+9p7~LK-E}=|WW;@R%I`K1gV!bw~7t4Cg7MfhXp6JyF+w(DHO9{W6XvPq&B=r%U
zB#?7li(AmL$5w7i9&PFDlxjNb655JbVbU+|-0vok_rrZl=rzpjPmg)e7DBo>2jJdo
zT2cW~*4IlDi?InsxKppEo;Kk^oY$;doq@O;=;$U|upd$FFZ7n)S}*k8V>^R&Yvl!Q
z0IyoQvWmCg{adr0Al>O()I?56Z2`9@7cWu2=`JlL=XE=G+v6keU_dZM3aw*yekKQu
ztYZQq63Q{EUni0Ipe;%%)4$5ADny7Y=*v@EI#*IQ96p}zC)g3!N4%{AM*}M$JAos=
zPFazfLX^EB^iyL7Q@2l8JW6R!rveJ4J)%?_pbA}0?~2b8j9sr^6LTefNv)%H6DQjB
zuOv5K2-(%hnVuA*v~iZXm|Uj8D{cF|e@Dc1_Id@IHc_CY6!6u&Twdb*hL^EduU^u#
zYDtR4YZobKwt#Dtgjih*Ebc}I5P*%4`Bk3D5r%$8)ioQ^bHVawk6#baN%7PW4O)o5
znnLSH|5d0l|8P!!?lYHbVZF5g#>bRvd+ljK)O3o;92da_Q8P7^Uge42Z<B|ODCtik
z58xV=NChf}jITF#B^iYhkU5)*aZzI(hmdOkMMEk<#!BR9)V9xOWGNO?Uuex0MRd+3
zfz~aCG^vgY)vhtZTn9K)r?~8is<7Bf`~_>4nevNv7xHH0pQVfo)ZQ$eanxg=m_i$7
z)K;ZvJ(Kl>7V5V#M{Mu>u*@E7?SO>Yzg02v(c%Kqt9@y6D8K-0i8e-xFaol+dc>U-
zO$<?Vw<^?)UsO&G%qi+7vfwULvnenAGz|XEec3YV;*QRw)qAw&V7-`$yfx(5ioZ<S
zqDvmsTd?24{1v3|M-_!d@M0UesxAjYc-<=oDyqRQE`^o8c5kI}E5t+ZjXgu{$vY1t
zV3XI9;oW0+e9hVIoQqE%jkzF{&G}gmENH|lepnxi6TRh<UajqIg@V9~vlGt1P05ST
zk$5$sa{)j{R#1yV6$@rm1HH-PQekKj)Y(On)GOM#_ChfgiVW7O8QhGW^((CWe&!I%
zAq;|Lof6sNf6f~$YOqA~&F1`IL&T5jOLh5CzX^Q;><T|tz1!0;)J&TGw!59vq6l04
zBMLVx8jjJ05DC@~2wU9%0VeiW>f9XciXWc_Kjym4yEDqQ*p*aQ{ENW_(Y!YUTx-nE
z)@~<E{7-XO8&G9nB<c>)?k;k(`Mz`n`?k|^FbYzvw!CdDXn(bh?WCyRni3GeLIm8A
zv%xfP2W#9{j(~2C7Y-0nOwmzW{fiZz0p``lpE;#o@UmW6w00<}LH9okfU(AT^&1F>
zfdoDuvLd&>!4NVh+SHKdZh2Sdb(*G4ES<Iosqx^+nDr8#t*`7^9f8gr14s**2_4ke
zV|kxVv3rj8{g_RG#b~a#INiq|_1zSk#ePf!AN*YR(V_uZF5;q^7i?<w4miK{&yQ$D
zWi@^3TGxu2ZEu*xA9?Z5NboZj+ZWKu0cASWTk0mlS0CHSC*27Vt4$Te+%3j0beY`i
zE5ah<4sxshO4HLt$l8-WN{L%;i&OC=K2}i?-Ued`u>lfzeu3f--g43j@b;V@e!I6O
zw{%$;`09L=_zDWqeHL7i+>Jrh--+i|cg61pHI@}iE?+hHy;Zd6Y5(qo()ugSc`teX
z<vL>MZ?VSb;8ptr0*>SkDjzHEXW!2yZLd+Ne5(oPDsf89#8g1G$w!|lP%fa?9Ay~1
zL*UKbQ4}+oCBQ%%bKzQ3OR+mgQzhHS!MP*kE2fj^u%&+NH+pu5FPb9D-J4?okLS=t
z{9OdJn}NAcL)}6#)Tehc+E)^cs8g4`*odP~IR2xaAs+&RqjIX9yu;EiV&msJV#n`A
zWrT%|$Y2P0ZS>5BfYHBWtl3!a7tR2Q7jF00^9l=Az;Iwz2BrVs&$fcImvVqT<J&C1
z2mhUyUXeGOi`Qdz)f@^S%5ziVl{7qTW+^Z0>-_TmB5B4r#i9YQc(lI0c8XkbOCkWO
zzs7=enH!T0+ijXMjeE$h!<HQF+R1oHHst?E#|vgTUExDo^b*5`e_?m$)e>TJwePq;
z8D=+6MBj6RrE>H!`KlUNj~sQ~Nk4|Xs2)~LnnnwsktWJtMF}i0L(qk8!e-mymTEQ4
zBpWaTY$~gAIfC@mgFlby%6_2$Tn%l1yp|2tGHXNrYp~F-(((`ea6ku|@7^Vj=Tp76
zY04Pn+Y;SqG7D0SMuumpJv}lQF=uTkK1bHcX<tr7KJkYP#6B(~-HN0$=yRyNyEK~v
z#oT4#iPsC0u4gE}Ti6oFJSNdw!o_liBd_?a`|v3PvWKE*iLAcO&H^aMSjp%?^@EAl
zyXjw*cMfUOvP<X8F`Rz36EV~5QX1w3dm7rQ136#SM_5Wy(M3C?xprRPOB_PbQx3h#
z!oVo|5pqoRaygA&&Om$ZfcAQxt%$0*FsU{X$nE8X1ph+vA4cYEL_FNu0d(umn~`w1
zBlpkglpIq7_}fgE$>h?#m@2I*P`-(hs<{cSC*5wGH)W#9b-+8Yqj<|H(Htzr7;(!s
zI+pPdUN$k*-{3NA^fdv&fztz^W0_EK<yI`J{rNsH+g-n$9IK)CNcU%7r0I+0ucr9v
zJ(N(th_y>i2|iSF<G%OW$6Jj+99E<XDL5u#LMU^}#FE-PqsAlk<y6#uDhD22Yw8V{
zlxq>bMDHV|8!w7oHs#yM1SC#-WVWFNQtZc2+#J0ALMVEqNhFX|frBss410Mwf<^5U
zpz7GKfWsa_o7~9Ev)vnyCp7g8uzdx@qtT<d9Xu0fzB>@y@)O|K@pGB8tbOg!a0iKl
z&mL=0<=O9&CPYS5AC>L0yW`CKCwe<0yzA3$ENu5f=K~iGz=d!huJ+ipWpf}XnBoxe
zT**Nf{_SAltrbIQN_RA4{{FoY=lAhhvMJsJkAFoNf7hxb5gUY0R*Bc=N`7A_SoB+U
zhq9T=DkB3)jf`yml&sw30<xkP=8?w)_Fv0t8%_7b%TH?rHy+-z=+8H^i!loMC>o_I
z-enqQ0q7|ouF{zjHKkwY99L`cf1^K=H>UIcdft|o=r|gQwQXYp&X8s=R$SG6p1P7C
zV2sn{xU~#&I%wSWr?HG!>R?{lWNIa!96dKxUdF{?(K}<W9ZLg_J^E7d?#i5CMB5?b
zsIUj9qNP;I!Rq`-=4Kv}%>+qN=V3{*BV+5|jQ9fbDFWo|9l>t}J!i8g74Y{W;STXr
zpFM?~{HR&{RRMsUL3G5`BFbZXdsdbTCmsqkfE%$uN)C-7#Z`~YU1vi%H6Rrh5GG`*
zNxak4Kz?xsGyz1X{}y-OnCFGgGffNm%F1sQMYW0ukT^Gl!#|wv!23|AE1O$l1-z<a
zM}q1}pKq63Q+NH8%Bk+kkhe6cP|lIZS|x?b%?!xuH3RkKV|25st(s~R6$NEtZ{?0d
zPW$?(+SPWywmo7!%F4aa)2TkHQyvS<8XNXJ)71TV{f5SO*lqb~Qiyk>^d1GI-hmz*
zo<dJ^Ia>7x2#j7}6@<C*!%=j+LdpzM?wo@rM&-$F0f`TpFUPu?<`g9*+`Tq_SM!&_
zIq%A~3e{><5JOAoEhj$VYd?mxtE){r7sjl6)GDgSqGAKdo?NdLfyLygL6}S@VGSAt
z(xzxL-=sp0Tz#Z}dD4|(pgx=g8-Yx*X)i#U2xd#WE?|qGj;AH#71j54u_-kb#@qL=
zt_oA`=#e3bF0~-L*8zc)!X)WAY_A0T0$FhlNz58O96lg^ua7=~cd`HUk46)b&S##P
zNpduco9ZiPy?}DOMzKpMxEJ%Aw+eDDOn(*ds@$JRlyXa;+1-<i(*wb1hVeRB86AQ<
z?eG$GudyI%$-Jphhlt=6w|uyu3(??{mVa|DF+uDXP|T*KFtOKsVU3H19G^5QJ@~ZY
z@(O`IpJF*5b3X6gfBy-)B_Gv43LBA2kxqa@XDbjNT;T_4rtsK3X<f(>VBtA)aa30Y
z@my%%DPje-wHiSksrMu20f-d6C9}4|Ts)#xLPo7=VPo4#rok0Ef>#hP_=#X;+dJdq
zjYH@#nC?<yBigeqd9KgF9ck4ys1H*`j~COOfrg^n0ALaJXN2+E3G`Nx#Hdb=H!|$T
zVh!xioq~2kYbCQ%?0T1Yv2_&Vwpb$MiUw?Y%*%ztA%wML)pN^<^6}4pYzV_rpAV~X
z@d_*#WQAve)9y{=aOx2%@b`C}=e4sCw<-_;2stNng-pspECSHiNNRrV)-Ff@JboMM
z^v8J=rlE_EhC|ytb(L__(AQ%5`O=7fvmMh>gdC_onZ<6hzMh)TQu$nkaxkdV7G~Xk
z|0jF1Ph0b6f1qh_=qbe#-g(Lj+o();DZO5q)5TtrI;S`}`LvuAcrI#;9Q-YCw4hh9
z6_pfE>*oVQ(?`}-cGir;;!NM88M)9VdIPwwFji71bCDxJJ#5qzOP47JS9yY{(r>Cm
zk^{j0e4in+)hZKNH6Kp=g!j1qG@o}~jIAep4|>^&5`BAdilQMtETW?#JCYaIlPW61
zT6=wX4-jAm2vAa@P48#qC{RK~fT0MR2#2UN`oV}U+;ZdT^etBjm+juIA3)|a_mttz
z{Y{~W4q8)!PlTN|<8yq4cHbI^1zW~!TbnGUN{VF$>t4tKf|V5Vlu6~I*7n|NJ<n-q
zobm3QKDJU4QcBQi|LAioHa(-y{w8}QXUY<0c~W)O5<mAC;Q?}}<S$$wH|<XXUzzyI
z5-%iXQC#X6E>-qdS75G>jj7CAT^stYbe1&7XXnBoA@`?NRLRc~wIS}&pftIY2Y|F@
zWTmDp>keGNd$uvg^$IDV``MG`Yf`(G^zkHCIsyvK=km2@QjET;)Tu#xH=M{2U$Ijd
zm>kTabE9wv*Fsz&1{#pK?yoo^qg4Rr4fdiHw-Qj92w(5}^Ic2#qKdTnNsk>X3q_c(
zf?JVr6bmrIo5uCm#=}6kC?{ZQGI#KO^_`YnRwr+m&#bNT9Q5qybK&Zt4=0ijFYVdN
zF}Q)~-3r_E1`A5OqLDYT?z`TqydSywDEwlUx$Bo&V0Q%!S0;X7MdpEJW?oJtsXBsY
zK^ctJsX(v;=C|E%dsKZ7^1a@R>il|rTWFBioBpE(c>lESJAChW4^UEM68NqC(~JqJ
z60Lz51A0&^t9ssR7xmf2$V>M{MFGfv`uvEM?Lw+DAsTXW(#YyKn8Y-N(uE(DNqEtS
zWbHVFk!$4?Hev|?=nET$24$vbJM@05Lo|*$*;kjDQ*<6CY3d<C$vn#U-E$O)5^F?P
zN9!<9U4$V1hpm;GTsQwVk>$??{HplKR<hb`Ug?S@#(>}e#^g+bP7yP)By<W12<TYb
zfpP;@$gd(L5i_wMa1BZL`_-uMG*%G+5*M#7Te~pJ%TZKR)TvyX%S>l8Bwj+D9W`U?
z){1ZY;qL~Vgw%k<A~2Gh5XkJeBnaa6H^9XB(F!2Y)|VDiT)G>Dp?$I=;MK3|Y_+u-
z$(b<@<R=`6_aJE0t4vdk7{wXhs^Ip<HA}GzB;d<V1#%7PXsmdclyC<#C<jTgA>WI-
z*`hvC*S%EKSI8GJpQKHfbQm-k6$r!6|8#h0`*BJMueSj8FJaTy+azYK${iQ^S??^g
z2Pdtz<7ac5x(|uf(`l-=v6||4B}d16@=-w#{DSlD{r23Db~09AY?1FmHKy*s>o?_Z
z3jjI(G{BAkC)d6V1CoN%1eSx95YRxv4Wbuqp-!4(Wm*}BVaOtQC|a91Ex9y18mAgs
z6P}C#6wFTHRJ}ohWdz#dE2CcCX_<xc8*44DH$IcOoo%P{mKAk5T!;((6Is0%NPtkf
z`I1zQxu>aLfWyzl+wFCg!4_qc6=*%SdSgZZpn`KGdIt!_)DeKaEk#)WcY2%N_cy~_
z^El{$!>gA2sR`47NXE3-VG%&eV0`W<@b)_Yq^_J)a!{7I`?W2#zFp7vvJPr5$)8HV
zSa7Qs7TzF`cl?YxpxVMpWkCXiw3#){-f|(zln53FFzv!kCE&btc?-zYa{m>N&Gu16
ziOVFr5?rp9*xoW;rj7e5f<jM$x?vPlk2Ajxa&f3;#O`FbR*P-y;a!2YsQ&LXxwlD)
z<r)JsKpO^mQ?q~>2tb^p<7z~#xJbcHpMq8{2a?GJCSMwRUfEh}1YwJ9V|s*)HToSv
z55bMw7xZIgo*84RalHP^5vf_f(Y=+&KXf14F1?<lc%J*XzuBi?0|ap60zUB6Hknia
zA|*{`2mf;i6z99>q+X8p7NPtFqXabt?EXGMeaw-n#;kg1+iG6aDkD~=vMsF;Px9jj
zQ6lnk9CKpYHDt+2@4TJ7Df)~pN-L_*SFmxD32{Juz02Wj!djODAwI(<90gTc*my2g
z<w?I8SfT+qm=FgtK?z1r^lp)JS^A{deRGSIbc+P~Xf?zfNz}<=BG*$brMB^kbMoFO
zTM49R&uT?%Q6kl~rG5WvQxO)b`iumJ(Zs8Sigw0pF2>c`;nomhCb(ty01WKt*bk=X
zKL#{{Nd?SgI$Xg~+BKJye4!0S-Kco5x3p@38gAtVD(XAhr+IIBi7Hg}8S<oQ)DXD?
zp7s<hxc*ari9OH{@x>0FAj<+~lEJvq-iFjHUsygb{eNB&s)e=yH~fK7$0}NKqx9NF
zAR$$o_oGscX_(=DGN1A~SqPW)(ZQ&MxL9~vK+JAw`7ntwB|b%h&!S6ZHroYs(Q02h
z0xmWU6^JpWL<={lOEBi--kbV#v<*ASY-;f?30*RerHjxDM>>St{dOymCW#JK12>pJ
z8nmBcf7zrRdS3>{EBneYgymQ8v6tB83_N*>dBW@7y?IV%6t`b*jA(R_jy?&m<m$WH
znOt=ef8u3YQowkABj;TfBnU86rkLcjmos&1PEDd}ac+=wmTSOF!aHzFb1tr_=~Br^
z#x$LPAdwpYN0L`6T`pf6u2}A>){#9rrf@Sz-l^D7n2)P-bw7j}NPv?AB>!sm$mzKP
zn5>X{&wY7Zkby6BYSdgPU15;_SxDQ}W*CbJSHBQ7e0@N+ebwa9P~x__*z$-6TS>a7
z$%~G1nlP97!Y!4WZ84&gRli4)S1<K5#%>9GeYXQ^0%TI2S2gpa=_!>F-U_{p^-ws_
zBy(y@cg=_jWrMqJc%jGwAdsViqPNd(of!F4wJrmno3_}I$dDvrc5Sxycs!gh;Hyq8
zw6!OSS?`^lb>8mdqu2w|FLI4)6a5EE^EmIueaO*!uxlIh*2<$Ds3CL=CQw6Xq9YCg
zkQu}52M3>fa#o~1qLl5T={HvC7NMM_;?<Atu(znvU+1~?*UFrMd#khKC14S79q<Z$
zhnlRptQPbGFIVG^R|WLo)}+vXX_u9+b2Z;ptz5Jun{9P;5?C&<>|xWw^40jYa$)I8
z-zV(4+9t7b{(CD|p5*m*j7RiHPvG;&9wPkFfIAes0W*|Iv7OJ`3d;ttEHv>?-0s(f
zv9IiJZr_PB$a;-jO7~|AU&R)yBp)_rf@FSr4`Nc#WsE(a0~h<KuRai@R6_t%xmP1a
zKZ_#Jnf%DXaWN2vEmEJ;M=(brOKzKOnJXcf30qmR28v7<Mc9ZqxFe4xR3j)FB8&if
z=Az)LHZdyRY69Qc5wNNfFqoJEaXVYCFO&?(Rgr5<h`tuxzuYQr7h1_3arWb{L#FW%
z6wz4$H>B4{d!W>w)uVx~PSP#1R@EMgi9(NT52N~r2Q=}+Ev=OCQLenLKB$?Pn~&D8
zLKz{@VHk?Jv982Vpp3iVEvAU5aIggQ$^z=`+GvH(CNvB%v|5P>mwN3wv<h$|pUYKk
z%V*F60YH-i9;j(kN5<Cj4ZMEW5MtnwPus)qjQp@*M+~m?mtz5qP^qn@yM7oKVXkJq
zJ1l(M5hTO{_UByLC&7X~%Z})|)1CM_{(TNfkJ~&?>&xq7ZwNz4KN2&)cKdwEe7+9&
zeP1d$zS)c2wyD3Q)joD_9cO_iKpo=u@Nu<37rX#E7VCE>&DDlIPq|`j|9oYAnh1<8
zi@iMAo-u?Cm$QdgbHkYMF}_XuT~Ul)FKN1p^<+NF*BD`JeqERC<juCZLic)XOu6<t
z>2(;|Ad{whn~TwNjMv5U&Ieq@uMLMBTV0KtK?=fA9iRC$DfI0bp9g3F)y;0%^(c1i
zpMnbL53i^ESH+U5^^v2jGgs`VF2)HN^v#dQ1hK@*APN`{{bj6t79^TN@adinsC9}h
z+o)J}N$sH`^$p+S=|uPn7LDIT37G0??`B>nevd)F1yN;|um#2<U+S1z<JUQ*PGb%K
zc7|xDKwU{K;Yu+Nc)ds0t;Ri8P*SNZI<{2E>(WssV4yZ+1P)84u79M#_~iU#5WjQ}
zA8Usr_8<S9Z<lIRKt(2`Or;N7Jb71fi9&dZf@~AfYDlTcn4sNtE%;T?=F`2&Co6St
zZ>da)z?ATe>(yN@b0uH84^vnQNJN6C+kd?B3O`m{vjOZKfVnXOdAiqD|73~3r!Jfk
zDBe?9k0BAm8#T+f;_S6)e4hv;F#w(0qoulmCcI44Z^l||KFo_8eZF>$g|lPlU*$ZS
z`n@WHi{p*5S*EFPJBJClXpFL(bfZh3*=OGx?=lMa<$iLY_1{l7oOtCzI3@bcSf^$S
zIAUNJCssG-aV_N-1Es({djFwuWG1N+5$>ww>^ADDA?$cC7IjvHtRQ(ax{zMu{?O!2
zyyZ4~JiBs~<?nop;2L`X1UR^Cat>@}%-=WTf-o0t%iEM^C0If;)mhM3RCgu**z4ly
z%$a_+`>M#1Kb@yK$TisBeCq~%(HeyU`$w#3b=;oqD#C#Hz9=@`uq;^=Zq3n!<e(jH
zumbtLN-g4RULvcpetKvw-f;KVR~}i>Q%4{Dek{?_k&f%lAU&e~xWerRlIYa(s=QZ7
z&Fw^ch90GX?Yjv0p!}ro+ORL9xyx~jQ6KS`FTZbOFpYq}yj<)EuM<^oRt&_+Y$T;7
zBmYb``&wN}s0`w@AY{WK<Es|3^@%FDQ-0EeG-cZ0&`Zp18tUpzr2R>PQ~T>)0j6Ud
zt1xT(Hw0tP6A^j%7i~Zqo5EuZ40<-~l$!GunZ%maUz%MT;X#zoBd7Z)h86MXm&lpI
zZa@*Wj^m3id8M8XU%C<$Kb718aza`%D%0=hEU#_n;<YxFUeR7prH8j^XDW2nm%NT}
z6ViMiPc~<wlw|P5-w6Zh`NS7vn4?Y!4I5r_n$E(mC>JdC5%s}!*XPzdf`q6nzis+|
zw=uSh!KJa|viN<cL~KUWrS*uB+&^RSLH|w&p(*&r%HJ4ew@gfj!d4+mn#@?J8da}F
z)LfIhqw@=7YZVC|O^Gj!O)Ebn#89f~zz<|z5DE=;?;J%nlw@>PG-QzO15zvGMVoU*
zip7u%m{qI!C-(1Zi&D5EEv3N_%rYbMVDrvgi%U)DsPZGkdJ(NQ#f?^17a?ffw|;#^
zjE!HsG#wgtC*xvpfKVUq9XT<$8Or$9P-<YtV6|S;od7e1?xbBVH$#{u-%xq6z=Y;2
z>_#C5=8pIMg;AXp`<dW?jqyrU7aQml$^>my9msBQ_6ybvPMW{xiab7FSm8~oHKNGV
z9_wBZ(w+zNf?L%~!x>@+b9*5ys*>flH6Jv$&i><9+O?uDVLtUIJ33xy9#nVG<S<V}
zUy_;KueV2i<3qNe_0PqK44ZoV#m&|)rwIBVMg-+@9QO;yU$h*GwOR9ddqdpKPn2JF
zvvst;1wJu%Hhtv@0p9mZ!fy^^U1=Q#8zh|2MxU?F&rwrTVccG{{V6DTo&|5E=Lb1m
zw<{qdEDByn_k(E#M-^SPRW<Y!^}%*l>ShxU_|1cSAN)DY*iU5G14?MYrxbI8<18Ng
z&#lPsiGF;{x5u+(SH5+eV)T=00ZcINTXG1{lSHIt{pEObmP`f&!4B(<_$~YWZ{(^=
zgw~-{y6etvgfmF_lR@&3bC;-q?MTT@PC7?~6jdK$g%QI&&1@UKxSumP1Qg+iM8E7c
zPa~YE9Fi2d6MwD;{#--?IJ>^gm*;P~j+@&b@e>gm%GhHUOHu$*9VJ&Us6y{wWax|_
z77Rf*+-M{iC0l8!-eyEo<thx)V{^}9a(@CmlyJt-lgBE$EV({WH|{CP3>a`_K*$pN
z9Y+?eqba%iQW}a6puCD%>!o|}i|vu;3bE(@5(BQe@;hZC=2@qkEV@o;h8i#=*fC)&
zBn5%C{XFSc8uhod0OmX_<d*kI-Oa@<Uv}B(Fc^+5=4^+F3s<tQIVD302mxC-d;E4R
z(7V##IW<3oqkI+At82FPoqsAe#XSI}Yo6)So>Aa;Cak4>>Xw8Z76E6iD7IM%?T4=G
zRj$?h-;BMNZ3KOI4VHAF_{-tC=ND=zspiWWmYl?qC@lQz3T&|JG)2*~&A)Bu2$gzK
zotZaRnlr!m0?hcY9^~|~{K%wT4@--^O8kE4OGg3>qd_Zy66*FAH8ih}?A*H6e$SGi
zR=RVZWZao*Q%N}7h!@x%cq4I~WO+<Y3xxB%r|hS64a=4Jqh`l-CO<=uSOaN2sP7?1
z<$y+cw%VqG0F)96x;(VByTfy37_&CZx>{&+@Jjd^&L3m>4|S)$QZ9*p+~*RY+#dP>
z4)}c2JP&%D40B3Z!~5yJpp}}ajV_M!l0DK`3)JC#NkZIfH3vYweiqCm4n&<#L|wuf
z<8ik2J+C?BqqDo~zm2r)v%RV4drVtQ`<12k;~m&w<lxJe(G1JX!rx4ksPZ%~1ZT*l
zr>YUB4H^T8N4WcR*GEu~%X#!BS8e~683=hW(Mn&1m8GLDCo?A=WIE`0F>Mfq$wRXL
z?pqeqbo+&d2g$1L?t<{Qha(xxfJk&^{Xkd8(jOI5#pTB&bPzKIT^e^YnoW)&Rum8*
zzx?)scctpQaFth<ow9Kui%EOsceMRV|8jyYOLj5PwF3FABEOnOpOBmdW0mz}Cs+po
z(HXH8Dk@V#v44WZ<u2RhW**^AQ@TZGcO<-91Qc*C;mVNAjPGqQI5kld7rv&gl@&h9
zV<+z?>hH9*I~yB<BjDmR1}j)SH?%~c_!5RE^ZtctId@^IruBYqdE;x$bJh~YWRSsV
zAQ%$ezV(R~mBueD=9?2WFBUB2!9eO>|Ngp4gVr6l8|`*BX!+O>90HH^aKX$L)hKxe
zz`Z+~H<h=WIeGDUz1LMNCH574f5j1_2P_6J-Dfmuo5C$c*H68FO&!*LM=*6YtQB2z
zT|JRDlkocFR;pdU(kP1YAZ7V*msRLE)&EVyLsj@+!bak|9EBl&+m9r#YnX<L#cccc
zjQaW@aU37JvA*PbJ?If6Bul(og7;@)IiH|nRr=hkPdd43LGA-zDNVK8=6~NM&hcb?
z)`sZ9w?iSN8e6p$Je#xQIRAy^D}^fKISL7RU$)=%0Wa~d<HT)NP*5|}Q3V*~;2gkn
zI3+|0@h$Pq7jS<x3NZER$Lj>&I=rhfH~*f?6V6a*^og*{07t#me@6Y|DQ9xL2s-B9
z5005=UBX}C$?%E;wr?d4^_1^@KDWFI3b#ZS5dd+Im4rlUj^W=EN!~-raj6XcRG1pP
zd~3y8+4P+IZlYjdbb)<c!YM0r!6o_MS2VxvAx}0dzlRE~A1f5M%dgiH|Nm)_acl3X
z$t9uw|7o3Z%M_@!_rAAXFxfZ27b}z9flO1`^=!DQF%s@2hHs_TV)3W`z<_O)I^;Kf
z`N|gif3@B4q?fS^m24jq-9Neo1)V-)$yHY!`us#qw(dTWHT9i(OM8L3h(PEZtQCcH
zX^62qVt06L8@kf7%6Ra`Aw<FMT`Zj#b{A=%wuF}Z@)N9*hu(TKSm?N49Mw_&d^ia=
z&S2m@-tpY&DvAGRjQ_RxSmJTsz~bpg%x?*Q?WQU}d03YpiJjLC-(N0%D(GR{32Gn!
zxV2tjY}e3j{Q_HxJJCE06MsV;(}Ovx8_v}7O2yS4WZv?RrjU>LKBI2tRCbgI@i`c1
zSQ`XBJVa4e5d{VPw&#e#cZ!ui#qVPj1i!!K`8PCzCTa@V;w<MuPn&~PtQ@b1z*HBt
zr!4jPD0;8#qsn!~|Gh+BnCdqsL;0wzAobO>FBe1DO}!Af`kNE!)EeNG_kv2C&|yds
z;7>WX`iz&H<12$6vIb^D^;hJbD{@(V>`Fu5{hDK5fUcdv3-Jk<Dek>}&qGeUyrne(
z;`9<-=Pm`mQj<r&XIf!AXgNV9>U4~oAz3l2s3H<PzK9o71QjVbG^&E%K^IXDJ+@Xs
zBx$77fBL1C>#zTS=Flx)L-X8opay17jI&dO^}q8jV}zW@)-qtldiRd+y*lXlI^uj5
zo@je6x@p*00mHTR1sce*Jd+1rb<y4xY>bgalZ1tSQz<>l)ka#%IC`-I=6P-Ogt^-l
z07v_09O%N`^#9mGNH$jrjQk7!@w~s**Wg^;1`I;r9SG+<R#4v92G-Gvh}Mb&_UchA
zj6M-iE!MADu^FtrT8Cmk{id-UgMPGIj0kv#FgPN4zXw_@Np4o(IpDOI2S^3<Q)|?t
z9^H!As~V0-In%OtueL5HIQTxUd{@8tQOSC_fIzHfy4{V5Bql{vJ{?GW*Y2QYX^l>>
zcuNOp?fmmajOrNSuMmYFB%-@-6C6p(@r<t6QF%7gM38zhxj=e>Hu{DaxEzhW`1SEk
zaP+v~>aWI_W^{w~9x~5>5l87);0l;tF#{0@7JCrCUYYY1KbIR*7cRmwn!z-HDQ5Bb
zpi}gY1PG3;xY5QU^r%p+VOgbubt#Q@-{7zz<BO9FeFqmgN+?^Bx0eg5UKdG3bzBzh
zU?IjZV+-%ITaY@h<L=h~CS)Y;h3S3O+NaKq7adJ*r^lH>&7E;4>O6@pu)018zU?Ho
zD7U24zO@U?b1TQj0`Cq7k_m$v8ntQBQ!<PO=e=H(Xm|isB<7k*UoQ1A=|(P&ABS+#
z7vB0ChyBAHk<tfa`Nu$WjT`DDibf0$43=gDSI%N8Cphm}02l`xlC9yMSSDR5r*~zR
zu<Ell<*S+T`cTW*cVQG&G&X(9B}O;I+qk}FuprYiuoqn<!4Nh9ovFROfF|()6FDXD
zl&itAt~y=RN04OqA3sL2EC?_j?+)<>D2Ug<&1^s2VXQ+`X4zMe{StX=5^>VUc}HfC
z*g*}b1*xqiET*eS5Qip?8_H=@IFBlUFp|`5Zv`NtMN)!W>-h81@T?lj$un<x{u+!3
zACByf;H4nCz7@^ITK$uDTq*s`iag5YR>hvoW%RDJALa&4BeT+o>XQn01#7(#0gEaY
z-QD}*_TjCwkW8yC7A>X@_n0MMMAyKhv+*Md25`F8VkELOdCj5qt6TOkG8^xk`E#DE
z>#Shsd&A(xMf3*ZCoPBzO<_-f9!qXRD@1~45**z|ME1v@ESLsB*ztUzpmhdP;_oIa
zidaK7p+>+-FV^rna^P$PiLmqV<I4WNUfHY*mh}lJEk$msPfcxr{Pz1_qVsmc<tXKP
zSvP&KrAjpy>KN^ef9V%lyBnquOPcq=483V@P-lmUOa-sB!~TvQWZY=X;+OdJqdz6t
z{fXBMt0Vn-Z4_GL;;4gQkJwg2-}5kPrOy5U*TeyU-uJwYY}@XY6!@`wJT(xpfr^EY
z%M$+|Wn9x55jfvnVrw4G-63iAt&v&W@dJ5!5K$J<W^$&enOHMRr<^LG!Vbr4Se2O$
z%>Y26zeO(r9ZvdaQcHH}81TgO1PB!7ZXGam<y#Mw#sh*gibl7y{*}@85#%78uqOd0
zYP=+Z_3ZzXxeVmN#CZ~``<C%9yex|YKmc0jynfVN+Z6EYJ&WO~D|mJ}=*`r6k+EGp
zrnrD}*>3vkZQm@$y_`36V}z;(<0=rpE(il#Q>1AWXoEg89GZ&ctC%eZQ3!=F)t$4L
z<87UfSW%^9!(NkTwB5?7A64Lf$Rp1$v@$=Vo9R_FgmD8+yLLNwp%jgMasIN3zd14n
za1#QacZj0U9*U-&h&;HAj*Kdz+`G?r3z-lMM*$o<98oX;3I)&-nCl@G=cnFEXT(~<
z{K}W*ns1p2aVP;RTA36q6A=l5Ii0#DnWlx+$Yipy5-65)AVkk<sZ?j2@vd9TzR@6h
z*gR0TKZ$itz>@IIVcKnu>e2UK9sB}qWfEWK_e3kE`_p=q!33J`IH05aMwTPW$ONsJ
zhODY#`NMUk1(C9kU3Yo_)$<krriTINPNt_5mH`e}&Irl+ZE0ZQw#xzxSdZ%NX*<RY
zA-h@jh2^}sR`qtPm0%0UVjs66!Es@dNrjB{YX8*KR2<w2LX5W5&@Vqy2pFDYXzH0B
z<nTh|Q7B=}^xwNtr9txq?0lbw`4w=g6(U>&02$1Ft6YEp1C+~u;kb>)DCcsa6_Na!
zi-7<mgLSCONx)@M#Q*8ty|z=gj}oN-eYZT)9WFCRWW=*+6L7&JiY46`gLJCii-5|r
z$$Kp^@@=tcL5`{5d)@|NdBtv<A{M3Y=OctZ4*J2KJ54vrWOx54^vbuspQ{Ay#|Q=m
z3YRYI)3eU@@W)8!6XI_&#v*L!RG>LyE_GZ$pV1@)C1WAjGlz9JYyEnoG?n1D3_5p?
zp?wxVdIKO}3;-Y`wJiUbX<{=fNH&<6RO>f!i8Ho`hyx8mSJ^%LpPc`)qkeJd-YrSP
z6=W#0nYF1f0_zz1FH4eb??^=mftaIBu_XcPcccv4^tUw4v;l>XWy7;YxLlZkEPtNi
z_UT2;GI9Gg18M8!%iwQ3l~h872MYtufC0dYYBZKp{dTg^_UQ$XleZs5m8{-2>B2At
z4tlY4ygNuSz*sigKqoD!`bCl>wCxYsN!A$8+(4on5A0QiAXOM_;LL})`@H9Lv>+$f
z55Qh<3{(xLLCt#I+D`W7bVMvlr=<UF{3|v4QN2Q4?%3HdL`<yVth_>zYJ{tvAZuEa
z7zG82TKV=}iuQZ3V*Wsf-;6#?MpH%)Q!PppYnBg|00pK;B{Q6D$QFd5&K=cs3?0Id
zUy3x7KWEzLdFXNr=|Vh+Z-?sI5P}4$x9Nl(&{z(m%wkn~6M<Opg6(p8v+AGEi5xjV
z8;3GGcZ~uymYTqg|EIMF3N<NCbDOdAze*j~s}t?S<ce&p{)>}kvnzjVH(=K1W<|R0
z94MvM_5D?WP@2b>ia#<wN)u6Mf#D1wFb4Q3_5ckJGk3X9PsZ<r&kkn~BQ8p`(C$H+
z6EGK`Jv5ralM-0IqxpXe76wp5{W=9(+R$BPS$o2|Q^RD%N6k*hG%Y@W#2WiH`&6U4
ze>yyXZW>>&!C<K3BP#xH)-$2A2UC)^l%}vljj}w30vyZw;Yeu}np~^)Xy`0H>Lo+@
z75|wKEPrF;$J3|nS3<u(j!qFXGG%Um5L^L&ehb$qGjd7fgp&eX7}CU)rURjeud2(l
zJU{TfJ_@=b6g~!~;BD!3ezpG9^mYe{kg+(0gBTrG1$&ermBD1Xzk*&LXvdHHW>0Y<
zU0)+2;jGpcEvz-(lgST)<z{RKmNmU((nSNSu0egmDv(hB!>{qvH>ygaYO5{@4;))1
zS4%{XE2G_a2A5I?quq54PN%tj2y@W(4nDt`GE>)6j3yiP(MWY{A1aT)u+Br|utZZC
z^cE=(x2Qg7TMfa@*l_aR`vq##o?5NpKoi^&%(fX?Q_!L2Q3hY2k7r^wVBuUQ3#gSP
zd@ETL8X%7UqXnSb-UR|T8`S`#qyX^f3J7vZ{P(^zAhuXbU$6p6LsYM`6eX)(v=}1#
zwA9qgNP^}l$SNsq64agc7d2Vn#&RJAY#*sia8+S|LfTg)7uP}#efCz!`f<O$E)^Cd
zD6t)G>)-*W=RLDk4XVA1ZlZd26Fx#JQSh+iD02~B;q*ohoRs(FaZJlH=GCU9*8GbF
z1l#U@Xl+atNZ4vktk~GSo6WqAZYalj_kPGWqS`mVni$CrFi@aLc7=LAyy(#gO1ZJ9
z$M|l}{2poYdnfcQo%9hJE9_XkM1QK_ni^igh;Q)H7w+uE)>30DAMU<*sE&y&jL;<1
z6)A!pdaS&7f!>Q~i{EXnax(D<VyXVwK3|JzOfjf49!JFgAB??oa3)drHTnb-I}=+I
zYhq8#iEZ1qZQHhOCllMr6Weyayzjlg`&C_3-G5GXRd;n)_1Sx$z4lpaAE#m5K~uRF
z>eEqkQJvm0WM!JZLlvY^b;c0TZ&>L;oDMgz0upPqD;6A;SWzAraq~wjuszvpTNBaA
zH<62>qldf}Yr~g|L;gkNKX~~+Nmrk9Em%7tIl77@lP-kS`ap!AiWb0h4FN2i%1Z-b
z48(wwpCDiqn|rdlU$nuN0)}h~lM!l+yOP?6UTT-J5TW;e)t1+vndH=wVV>2J;uK?`
z17z6oM^>QHj*`8;6U-%GfSlxvc^g9b=aQ1UafSG>mF{uGC@;bk-WWw?7XrR1FaFi@
zo+GJzIFW<MG?6cKTpLSn1(Fe1v$b#!+x0-o^Bb-;ny)f(?~e{|;rQ0SSHq5$Q3IXc
zP@qfr%y*8<o!#8gR(-WH4Bq%_+Jk9AiAb%k{$Yc`V%Puiiq$|=WLIyf?$l^tO<rh-
zO9bSjh9U;e?i$R9h|^XJxxK_P>yeF~6a{ZaWC5kDTOS8DP^)EODL(5WQe2qOy@SZu
zWwm0AO85Vza;vtgy!a#=@v1zo5-GAMhyK`YyP!loji&oTOo6WZifc&I+ovhnj3TPW
zUOh43TeZ%3%|i15-jgE~j=+CW;cWpNy#_ZUg=5?cwz6t^HsgDZ8b0M%al`85a=)(>
z_X1(Yi+tSjWqbW_`?A=iy_ZD@anW1jN<H?|;3F9#O|REgwzWds<uv%jeZ~`r1{;p_
z`;Ehw2q`kp=sJY6oFFT;4MZXl=p)-sS(o4X-|i&(<7iI>sSejh8w4<VGiPC{^0~PU
zjTtEcOfHy3f^!_S@sO1*h?%R$Ww3@*B|O1Cv>q<HHTd~T+S!EdkTdjb0^+;8;|yn=
z?2~~N#BOts<>v>OCESJTe(O5#B2S9I)_IS765TGk*$%hec24r#ObwH1*)5n&m4CI;
zUu}7{{Mj^omp};COGFD&!MZK$4R1;%#c}n!*wZgXBp)aXX97Tt&##ktH>SiV{~WBi
z;<rQdnB3IU%<3M7n@EeXE4WtV>Rf;ZFt@SCLt$@UBuJ#%pWCF`^h@&GIGf1&%0(;)
zk(LS%1>0)K)yYM%oQL582wPi!@KG{Uv#A4y{UIq-=9O2boQDm?R9wL_CTTkz=ycPe
z8-}-oO!%>o++ZAh=sc2Ih3QonRD5fUqRLBX&b@X@1s92@S|n$mnL59y^wEh|4f%~3
z6NC23IroG2hHP%uD7bmB?R}5!$RX@b)3LC!zX@kV#uIf_R{h!&``5!ro$UBC#B>C<
zzJ4`%b$DXzL50n>F(a$o)Q2<jiG#Y5DB6hq(?^r%ab?NhldIbqu^Pc>!CfpB1lQ_-
z=HM-0_~HPjKy>_=y70rkS2a))vhGr5gYkdXZ$ke59?0e7l{RP(onRa#1LlsNh<S?{
zX-YK}|DQNb5FA^Y;qwFoIWI0<x{$z;S><?<c#)?WXR7Z)3-46Zl$aD^5iWxV<)=Hc
z^w0kbk&$v2*IxcIh*?tQgzctuwTeK)u}zF#+!C~$%irgF5|W;K>Z!UifccNJ>>ctN
z+R1<e$^ROQ7l?uofiaBXmATC*T*LMqTaR)Dg~o?aqFjXfW&HuOded#iCHT4t?GBUq
zpJ2rAkEyEAm$yBSbP1i>l&_!BXf%2~SK?Zo?h#s3-G7$ysezt!|6z0Xwvw-n@eEk6
z@$>lo%xm`hTT<>RYkTu&L>uz}9MI04xgN#xCi^Z+{i_n=my}SzSA$E|jU1ZJTUwio
zhWiyXQ69M1ao$rj8M7St;O$!N6CD-$xo;`Oa|<<9cz960;)xh}P;zW+>=x@kYv-q}
zv?oCnd9lkbN~mLAKHl22%`^p*sZ2BCTN(X6>J?cy@=V))=>KD&(}_Lw))L*;oqQ7)
z`zesVvZ<Bshidf28piqZ!FG2Rh$_v#^Z$1k<by>9b&}|#G$E(MccfEvl<52ZjP_w5
z>XfMvo)F@x=lwRya-0IVG`pQ!uh?4;ErhbD7`I#Yp3sy}_t$MMPtH$4Jj*8wdGDbj
zu{^U{>-#A77k?76GoAj~qA;J3%%SStXUOBWk*4~s<}1lIW(p>uSMEAOLv_A_l;{*=
zwI@%X!?+-$p>ul%cz&PF@K!c|hvBFxi8?Nx17JXeQ36J_R!PbS8^8EML;K21dd%u=
z@QZ!WJ1}Xah=bFjq`Yl*lnm;N>mID57B5Ef2WyFsb~}=RrntmVTLgNU%KL`!6%P{=
zub7In{pMTD*3E{@3H-gNS8&(;(J*;XNWm+OG}l!YQD4PKqsL{N*;-)Vre_Qv3fFa(
z;$InL$`*^r^xN}%jH}N23`D1Wy!V$)aspQ;tK<TXj{@S!u_6pVV|aDIpN&`U2Dhho
z-jYM7C=W)p_0$tyYo)1nN;;=c`|WDy8%d^pWl2G`x3RgIKS~8N3D$@aadAR~zELTp
z4f8$YCei`R*e&drdBGL}Kdx3?a6#cnAECA0W=?+=D~{f|jEncw!9W6#`1GEsK|faO
zUf8Bi4P`tL#m-V1%(E#xgCiIV%5(q#Rq6Uhf}#b~R^OE5wU@A%LMh~6RU&8KhAU9O
zspPvCKffopt=S=0D9Al<XqF87?jvG9^DfDeDkESZ*)2?VfA{q{yz~pU@$=bw_>y}U
z$2#12V)zt6?J}nN*pY1#*VE`St-T;PW2D|I>sRXOI~k+bw$h85)2nmefYI(>ka=?V
zK^Jrd9jVOsu)m;xzSRbOPn+jl#L6ZBdR}Yo8{^@13oF_*9F*N%{wbYG^G+=#)9q4m
zGugZmcx3v`qxpfH#2i+io7<C?rBw@#-<ZEP2tG$GYoxVfVQ9|y#@#==<}!^D`UV#d
zy06-~aZNld6nA$MG*NrTE~w@=%BM8SjCak`UtI?Um)k-zba|CtA8@d2KCBy9Mt*6K
zRQzHoU7&-;#Js-#_(Xlh>Jm;YPWMsGym^&LLa$c)-ZWH8BQc7wstYl{s~6Ebr|P}|
zRBim4eDhc10ALynv0ah$aG$BBc+7IPMTnstnef>qVuJ{P8i(O!T!>%eQw>KJd-D@I
zYbTG*`^3$i4(1R0wb!ws>g#c3$HGvZX*kFbvHC#-BEzu5xb^{WXLHh&thrqwd}&^$
zF^tB4NK<L27c@ARr{hGGk}4dYLOzz8(1qmKX408gj6!!OI0gJ7zM&K~=f^8?QCi*3
zi}<N;GB+b8K<&0={4!&1Ty=^rG-sAg_p5a0X;sebf=j9#*tm?=o|hmdyjiv+oU-_$
zSY|J@&HE>`L;d;=tmXQ>XP=~^;wau!i}Il`F2U50{`3&Wdglk%0SRB-E$3ct>&=B8
zql-1817N19=i!a^Dw?%M=YBBbaD_vL`*RO{d57n6U0r<>6-l9^?y2YQpMN0Iwk^ry
z1<&&dflm(KMuF*9j84zTYF|JGY}1KQoz|(xPzaaG<j&ca=k|kO^Jp02L`F|>N104b
z$)g6dnP8kTS~MNZq`7*jvgRnu`0~UR2{Y4>{w>4qc?u%;r^f?or~K9>=#sk`g}IIr
z_Lw3iv-n0o^uO2`%Y%g!2zYdNUf~bkScLN<Ct;;_Wll8{Vnw%h&MjMbaG4}Tt9@It
zY`ew}wEUW$#v2mj<@kU+(*0j`R{(uUJxZL^a}m#W1s%kAcOq1F-A+?J$nD+3iETwe
z>6EWe6mJyCaXb6{!5+b>jr2a4c{;N2NIcJK7~$Q{1VkVAt^KH(nLLm?APf!;6lo4n
zPTmE~UL{Md_MhBl3x?v)#glcOHwgMKZb#n?M@OsK+bi0z4pL<WtB|m*3x^2cS6%(Y
zB=aZ4S4Xl_z6x2leXG?W!r$hKtp{rRLQ;4XUK00%2>b&L2MkXNmuz%y7q>_=_g#k$
zBLv^@0_}@>OKjk+-te3uJ}>e0X9(9YX2P#-<Jr$ka-mJM8Yg%5XyyQ&Bxf`;>&-#_
zGGjTugDyH)(K@T~X&MgU_P_AmcLA6{j<6W(YNdquzs(}bV~-n-9Ri_Ob2S4VS#&S&
z7w=Mi47b6)8t5*p#spsWDas$swZ=-(iL}i__-p2^h{(ZJCTDbYpHKO+Lvm?-)F4Qy
zG`?kOact1(B#$^kR55jXK6a}?&-bK#{G=D)d{05WJAnY(ytr8ku}T9*yrDi9IRgZ)
zCi&`G)D#L7%<ytd<*E25dJ|9(#<|p0#T*)f)hVpr@wSV8zA9I<=qZc{sy^_<+JXvm
zl!f2n<LjlyI@m0N$8!O>X-pWWqI(2r@0B!8Xbyoh(Wrw&5F>{+tpQ-ar$7129V?iM
zqEOo5$qq`e4^1PxhCmXa+6E05p_I&V(_SM4ZHj5scwf0nb_7Olc9C4n=1mqI{w1f#
zqd13Pu4f-vCd**-(<X~VqeGtH;`Hp!aX8)h$Aq*imz;)pCyu=Akau90D>^=~4P{<s
z<ESNtpbb>(q)l?r1E1!DJ*N;if!da_uB{)4ut#Y+lPBkM+*uUOlAzT<n!8FDNM%&Y
zKwxviO(oe!qoe&8bA_FwovHGY0Lwkz<(B?|8PLl)^Uh$}dDg<IV>`pyuKUB?XHHYC
ztRyRap}U+pu~gofW$nxBV=zP9342^jKYN~>2038ULNy$@MzuKRs(hy<QHZ--##IK6
z0Tgh9Dnc_K(;h$b3hdc!J{5)*w7Cg4dSzUe^TJF2$LB;kYm`W*msV{M>wxWzl`Emf
zm?tgHeo(15cuJ++CWW#5i9#~&WUDAIa)lU@-J(l)O71m7LQ-Hec7>;md!A88$I$s%
z$`AJLJ$3xHM_M=AEeH4X_38?Y<dK`t$KkTkIg$ys*5ms9dg(ehG=q|dZLPh|W}smj
zsjbm5W>5+$IyPtP<ni$b82QkL_W=0g)w#vB#%9puqpCEqeRj8b((R$+Sg{pOb!_sv
zz-C}0BxAs2PaMbQ%o~T?;;3gSB69wL7mChN(O4noa3&>DX6%(RV}<3_!gr!y`Em=}
z@n&2J`^`OIF-xe5OG@XVZkAk!cZ6S96cU={$NBw=@7|zZtA4*;pRUwYa~@E2D=SQ|
z5WdkKE}49S;Zv%^oYIa8U>FX+qMMIG>@0OVmGq?&=+B-Z?<8zBXSML6|IhD~n-8lF
zQ%!t^9!NeR-yn(BEbh6jb|<O;R=oy34avG3B%<ThOYvDlAa4&2g^EBy`^e{9yYdV*
zK}&rM-i+TvOFDkw&ymy23%@K<!@G;+)T-WF==VNk709R-pJ8h9$U<%we_ux2TP;+H
zJuN>#PebFkL*T_QJo9{{at+SH7pr3^DW{j3_r{5}cUH={3SU?1&6os#Pc0p1?qZSe
zwoF&olv7>d0PJgEP`(XbQ7D63M)@eSQ<rl--{a)lX(~KGwXgWehpO{(I8E?_mpf~K
z@Zjpr=_LVJt@&E<G4+uk!jhQzl=`D4iZRQTY^QlTMlJnY)pP;#i$Dg(Bdy3?p+qxT
z!BDiYxmPmH_+Sq9Zv&F;H>KRWb--uDfTYHAFH}ima?#6qq%Eh1=X!L{3x8UJ*DLzT
zO>K180)ns=(!DocUiDuFH8om~+}wX{-5i1H<)4k}{y?LFO?*QTTg~s`Dq~+WNg)N4
z-*Mr}%~vVzIL?i1Cv$?KSv26m{wr=fbR2eQ)O8Ee8l9ryo5S)1Isjd?&U+iTr{y(g
z2+HNk-dMg1w-6*0{?Y)93nMf?X6AHu>3<=-u?`Xzph3|BEoIE4=}@=_q6dXF2bls^
z%+x8TVkK{b2zX&)Ai?zo_P61jEMUc|dFzJQKlv$oX*V**qP^&j5=((F`;5|&IDfeP
z!=wSE+VwGbA0l++GqMgAqR6grD0|iU-QB)H7#NE>KqRqkOzf>J_YkB4YN%e?_k96T
z`*s-7cI(}hx3UAAk>n_r;9`<Z?K$D~{V4j;gZlL7pKDe{i!4?Aw9ZE7zZ@lV`7gq3
zzt@T32%cb+7~j);e=Yl6nF&odj`237)hwjx^~-x4mX#)l)TwbHKx&M!4j;>zSdx%X
z9WY8yX6tmGJkj3apqQR1$E}0(ZX@q!miP089^&-PDV7w7^;G@k+sC;9tc3ldGyQRX
zz_JZY6a+x(y<A0PQK!NFSM;b<BS`$-XwHwCYPwf_u$-=8i|ZGjh>T+d=la&V?l>sH
z94H+9O3$a{dA>|@ORb(Mn|+Bglo?5<Q@Q<=*0gG`-@AS%mw6(I+2!mwa6e70RoZG4
zx5ebJhogB(yzKU?`W3kVwZwNvXN46tHy1})IcbP}6zvM^RH~B{lt)RnfoyyE0$Ojr
zL3bPS=%iipNNxwr`~{gw>q^CHXu;NfIX*uZ=oOIwWuxsz!b=UX6;6ek4U&Z#?E5)v
zD#~0QK}HY1P7c$yx;pJ;FiKYqEewlF`J0^8UZ>V}hT=>n9SJ8A<l*hD|4vfjQfgS9
zaV!2CU+8oB?1%gXRnWgOZ8CLrF7`wnBu-*lN_`&W`GkEk($iY>OCQrCft@fN{N)dz
z5T*MI@njvoGv8SSnKKflBr<Q7cN;ysRY|)p9Ze#IMG2<P^cYRCQdiXbAo`cSoC59x
zDBnYd=And#bKcgkWDQhQdDLE_mX|mRfqwkuhsXF9Zt4`yawcp8<89Z;E(VFZwBU98
zj7Y47H6^T$q<Rl?MM_Z;rA@s|c2~N^oOqW`l8h!GsDK`Wz!b>dWJI^3q}2(H7aCVb
zP~A>@ZmP&p8|fi`mdQ_K_A!Ki;?(;ayQk)Y`hJcaOfBxYbSo3*H_VkJ;`Ej)ajh{Z
zBwem+^{+G$q_^mOT#{R_U{|vtr`WdV{A*g2jc0#(xIuceN9OpF;$_S!z8kBkPmU?F
z{EPE@e(tMF$>DlcY)@Gio!x#UWr?|4N(8m%rLM-ya#bVR*0^#vo2`2rDL@Ah;^TRQ
z5Pr1`{J17?9B7OM)A?{T_rSIe507E+j5GLQIl`CmL<P_)5#e647}bK-UU?aP3!zag
z2^h$0Q;;=N8C!jP6X$li(s1$SGP>!rS9n^_#x`JYd!8pre?+IAtyFgRGjl%izB|VR
zW4KMOAV$aIIGj;r0))n~(fc$_e~xs}OEhW&k7>GR(?R|m;qAZ^xxPoSx#M!RdyM!o
zp;f{c=H+`SnNi3u(ukR;mPvWFBkRG|@Qm1ya;9L1B=6KNo{0*PU}%MzAm(`xB!19g
zD4G8Q#%<fyl2ne)p%6#i?AETArv8)u>`fyG!=*!rh;Qlsm9kPU2|1bD40byUY|TP7
z0N6FzMrkZ1St!fray`Tll35hZqhqrvU2_u=yue&kqq_gy^YNS@{R8}q>&?e<Sf4;`
z7!f9-O?K~*Xz9aG)mT1X*&i1f4@P4|-?C2hI_r!Y<c+9%_kKDxJ0pq9nsQpNwnk-~
zw6i1`8d;=WZ7&V2Yci57aRM626L=Yb;}D>FiZk5coe(jm3soW)5X7JDIY4Y|WX{rJ
z|6-KNZi#Mma{g?L;Df>)%8Y48LJsYxoLm=`gk~rH%botG3f{cZ{-|9#8mFl)H>2fY
zQl)vDFN8<Iu8MLJj?z+`d`DFS=MVVuwWPcf_IEmS3Vk!ay5H2A9#FGRjoWik?vU3L
zI{W$dm?UNk6n3tOod<tcEqgQ%HrmN{r$Ayh_SM=ObcbY?8iJ&Lhx)bOHYjnxQboI#
zogFbfl=YZQYZ$sjJo#)_BLF+_aNaD{upq%VpV>NSa`MO5GM`={m+S-V&Nux?MmpSk
zl=I!Y0umMO7igD!TepJ{+i|rLAGL|WddH~dD?-q+U%i&z0E5F%;m6z$*@PeiUNv?V
z+|IS!H#8MIHv2ogCY8QkCcHAnilnjFT#z!MTcpoTE;%onVvrFpWmi-c3e02g;lXO-
z9i6{1LwrU*-`R;@-DF~_xm>^Nr+T+Q=KthC7FQ@xW`gzLIxS_WPGNjWg<n<!j)F0=
z?NmA9F9#XYd)XQN#$WcQdqS%#Ltoi>`}bck3RF#TWZ2bSw2g0Z6Lth@)Z{Es%8AcP
z)+%Yn57~LS`WHtgK6J5EL_%=)9dDNiI`xG&Hma88bEUCV{2yKvWzj=!;=$md7oE^B
zt?7T8HI>J(EtNaE!9HG3pZ%JYD<C*pij7(Rg8|U+%a4uJWt~+&8+xpzKsTRx9TsFH
z??3o9tGr^HM75I;dM+JTEVVr7M{s&<aUg}}s_3C7O?rH$$JzVepaP1|xM`wYnjIi~
zbJwLdy9UHAd0#SgTFU}#55RAb3k*JCtPfHcmHv+8^Y6qWHlSD}P~v}qfDhR#|7x*1
zN);3wi1VmypXto_XV-W%*`GaqKzzs7DlAOIst|FOXaHeU8o3E08^xMb5LeDJ)VJ^#
zoOAw<&T8ccZZZG^14#yjH#RxvKp5)*jA`gutu67OKCua~y>vg(n^ZT?#}vY4#wKx0
z!0$Yf0z=~)=IY+(9k>pX1G3;6Y;?o~TPjI<Ot;X{y^!RLFSEjUVrcGV2anPra=rgz
zpVqa*`VB|kcxfTp@?C2@-{H=2Mfeg^%&ERZ;Ft|snf&*r$|lGxSmQ5?5$aZWhUWl4
zCri=M-}(N6zByI3ERW+s6?}C!We7kYZ7&|fQEF6xw$8`P-)`}2MiP_=BS!>B6(Fxk
zDE90CxDa36_`6&xtncmswNA%XHCxNi(yfx}rRs}oe+&HMHoe(?Fb;>73k*nvo7aOS
zkh@29TjW`E=9DY1w+BA=jnkgHMVootbPEXh%+Bivy|S8nRriVL;ptgsZ3m^_0f(8C
z7w*7#83NGWdGA)6vA<V%R5llN%4ioA;sx+!@vTFkJ~E-;M+h(wTV)xpm$2kTO*RXc
zG&4gHdwUknJDJHYl}GB;UnO+kg8H;cjay~kXvb9PhoIZ$<%$Mjlc{5oN%ZzdV=fna
zgjPplP}eaP`{K4J3uP@&DxTio4alBk58VHzEO(MNgFfR1De^O85gN+M5-&WPP9eOL
zy+m-m=r4XsI$tQ2s0EP>-?5Il0ib%-q{FN?aIqCx`cK3{&PwwFt$do?L!IKx3_~3F
zg#IBz^bVDreEu7oUmp9x>N_gT`Qhs=;7cw^uUyfl)cuE(Og5eT>mgXv9MU(kp`DRw
zs$u@8^F8E}Er@g)2`rZbs2}6Pbd-|#w@o{N@IA7bD6Oe1{3nFfaT<Mxuthj?h6XKq
z2{$x=u0C_Sg&@3fWeTh%V1L4Ka}-OUCHuR*&lJ53M+^RK^bi)TGjk?4PCIzlZ-tzm
z-RFJsNisN9wM@gvH%H^^&>*9ppZzl|$3c|s{x&k2H?C%kVBlSeNbC!O>+z03R!2Fk
zY!x-|#SI=3%T^ZJC8F@8SCtzlhoLPtV7^Q}CL52o+VVdD$0Qpan10TEeB{Cq8GzA$
zJw|*_j+fQ>oNt!>VBVYP_+WtO#it^ljH#yUvpMSLojztO@wt088fCyZZ1flQlfd89
z@}kXTyTVK|mj^TeM^EOXTlql#$u9I$!7_e|k?dFb{E+jwhfDTJJMnuP3y<}R1+qtn
z+q;|loCX^9cf%SSj88|O^^Uze8IEnB?o$3ljeLhWa|Oak+o4QyItUWXr=YlX$z_e!
z4p#H1{aBuS16iG|McdP}Nq-GbM$_j{rl8iyb6QaQ#pVR%wL<^OwJ{7wWbc};gNtnY
z$01-jeTv+YO@+Dgp4h6s#(CbDb}=+Uw-F1DM+O6fuT|9uNmnsq_@`rMUA&6DE(zCN
zuJw{o-m<cp$|UoqdwP||v?XA5%Bd#wW+3cHT6-cF7Q+~U<j`vFOs5tG;aoS({bN%w
z$ht?&Cq-*Ykp(LPo6_<-JPif}iuN}rC2{mdGctjHxf0`6e0m>fo2BHexYRT3|IIT@
z@zk%%bU?@WOvV{nk#cifG7H7}No)vj;DX8@O{}z*9~aNJ|ISb@lhgo{PC@~i+D0N2
z+JOa-?TzlFFETR!PSW(5l<?}jA}WCSV`6BcK#7jQ1S<`8I3aLcW2jmE9*t67jjiWj
zE)1=1Nb*2WDX%~z)ZgA!+H6&I;@BSWWvY8(;~?DFbgST#NCBE|r|Z#!iFZ<RZHj8j
z<~>UJ5@{qjTnT~O*#a&6+y{gy@PpLJm;gvCC$p|V4(JYkIK~?TV4Z|ATYy8YUZn2y
z#*54Bd8$?j3~AQkYJp54eQe8B$#Tz1yu5GjCtKJ3ZiNqcvLp7#&PjTSho)eGfK~<6
zUUPqBWIqIkKFebDHvVc;K*_@lh9v7u-!i=4^djO0+iMG?_juV!qoPH(ttsOqfPRzF
zM|0$5vT~K>^Ir?OiZ{3U?5qT{)4JO{ONvd}I<-C>p}P=#`(+*36|l}w%glbF3P(bn
zoSx+(jg(*Uf4Be@Vtb%+N&&k{@)ECYn33X6Plx2=9zJ_ghzgidodTG*KUdrS4D1Cd
zojkNJoQQ95Yl*ct>a~qEM!n7g=oR0`B+QqTY2Wt!vGR2Yh%fgMaxDp35DL0-ka(8s
z@4G5B?^u${Su9}XiI|X(0jXfQgn);FzV6z}BuTPR2!O8I#6+1W+_CoPx2fBbB7NNm
zEXOU(qXI~|0M-m3fQKSK-tT84s;XE)5gdp``C8k+hOE>bz-XW4bzBrJ%Ts>Y;Mo4O
zG`3g4Mi#7pw55xm`2<f}#8FdnDy+X;k*`o#$}QLW@!EUap_zM87k0a8-{&~XmJQ{>
z-obs~>Gy|t*gdGP`5q@?Ku8P3x8z+<51KB3<b*zm+q2LF%JRzFQrR_mg=`c_(IFtM
zYQ?!ZwMG0&qmJ5Z*VoavRk)RGBFfcFc`(H&i3Fc1gTqnV-6nTi>;|%8Od7qfCk0p#
z6X<n8j@ZG=*HDa_<PeVESzYhtkrKBI`PZi;;$N)iQ44Dbc8{LmhL_ySs?3teq^e{G
z%$)4Dm_a|2M^2GpxSdZuY1o4Tx8AUrOL8NX4VPU9C%(1;s13g6Yya?Cn0ta^Tk96n
zbj9tu0Rf)D<dI6(X0e%aToUFn<I_tmj%WusCP;|oB1jvj3y5v$!UT+DPAk*M(?>3w
z_oG*Vb7PZHin;cIO<d&~csm0ysDgMTE?(4TQo7PI*jq!j0b6toeO(@r>^oo}9}3<k
z6K|$68oFeaFnM;!(O(0b?@k>aegnVAJE~DHP@}butQxnKvlAm+Wp?RuQ~PST9)9RN
zVI<s_w$l>dAsyY2{sOEykfr?k#&V_p|AZ9i{VRLg;Br%qj-ay)$}*~7W0Bcmd{RDF
zqy<D_@kC&5zykeqa6Oh6xMH39<oH+>qU<x!n3$h0eqeX7h<HUS+)kOK1EZq|yl3q&
z2}O2M=?5qC?GQta?g~L8f{!I7EsNokMAiI+K0J`>rd}YFCnTs!J*Zm7qeO%A3ZTOG
z8((p3JAc9OBQ)>HOii`ukU*b-dJFK{Rn~z=*_YK<E_hc6CH)q~ZPO7W-yB3>JMFir
z#H*qa-mapl%II!WJ6}ZQ$Pp($CAj=KotCMYtpWl5!>zW_2-PzMBsZ_c9hPF8#e$J@
zN^iYke~8Rt0&qQ2oIn)dGLe;m^x5N5o>TakdHoP}6{6(BwKutyMZhClmZwEzxr71S
zvi9^*?ScHHI&j^MgSN3$bNEWJ`C9W{YCom)R$$R#Z_GYSUZe?>a(kJ&7M!N%py+6C
z^J~ZY;ft-gsd-O^-tibJ^t;4b%Ui~O<?a4$c{0jJcYwgC>LL)Wu|^Hs>Q9oG6kV*O
z9NS-ow7%Pf45(sB)g3!JF!r(f7+8`Vq;_~xjn7Iq_bBGkFXbFMV|44iYXs7tEbHOW
zLMq41_mP7_j=n{;(LS85i!i4Me!YD=V#&?jbc0fPat%Yrs}!qb<X-d`sq49i$&k==
zLf~+yj;OyDQnddLYkk+e<fp;ywuR)ICAWHFR3vQA$Q%ij*Q*g~51S|RV=ch|RE=Jf
z4~9mh#JZH-gs^Ildo(Ta5QyZ#T^q>K10S;YZV$8gN_b^7T+Iuoi7cf<`c*IKMhDyI
zu<tyCDC~4H96F_N(W0?Xp$<Nm94)*`AeZ32CbfW-`J~5GD3atsubG}#!KDy!67A-d
zwRi#TY`MpW2J*m_OM0CP;NFirodcyl7`}V6NAe6qz;gu+&&<UL&ie=ihNpdTx}voU
z=_SqI4Yk)ZM6wc}v&UnFzAkT$u95uy8V|sa^VPpciVJIt#8JZ>^09w}^Wcu(H*F8k
z_BMOIllrqCAT&L=fI!`xp{qBXZn3u4m)qabKj__f8|wFHuL5l_6WfO>D@jn;i5#6n
z4=!YACxY7jTd@I1T@ku-;>sZ~J>eJSGnK^D1>*xi=k|^)r$rpI9(-r^4LH<nE4J}m
zacltnMmk56iL)uBL9E}wQLGuz$!liPzEZIurb$z|DiCx3;}!7&RdaG$M*4%UAXy#$
z)k<x0jYGb9<<Ol%?%}tU7cH<eIHp_VSlvWoe-|DQ<aBr({aY1;t;K;+wQHq89yIXu
zK?;K&VECT!dh^h8px60cW=`YZWXly|vZ>nG*U6kM&o%z9VodGY-*C%~{oyH2@+>pQ
zsOWuyiqZi-EWP54Rqfn$AujPICR)eIpn)|SD;;%2J6%qvN?hr-zo&3hk<A(1iXhCN
z^x?Q-s7}owK}6f^hf~m>?OHo%26tbKS}nvi5G4BYg4l_Nci-3fYa~@~10$zbqFvz*
zIP$|qdCCA&KqMhxmVaSD5AvSjczbkD-XNbeylAXm{<G@0l4cwUpfi%J%bIUTa)X;F
z#SacCL?<e~VR6p%FC{=0#Xew#EBmMC*-A@6UdD2@hwWXMmkDF3iwmEgXfParZdPzD
zfc%Q50DqhVMjlr08qu+cfeBEX^>+fqv%ga)mnuM^+hXfJjY#QDe1ERM%-QO~{XUJS
zKelZ@qNifmT6C)Y2mM9o*ByTWG5i^VGS!kNh*#Mnb4#UhOEyyoR<4F^tto#Nkh`np
zx_IaYkKnn(ErLk?b4Tzc6cK>|IkBnyOm4~hu5gyBe30RkESIK^>?os9(;8$0^bd&f
z(Qn=B(#atd9!Jo9m?;odH*bV@PI(y;YD?qlSdBKYnYSg5gHn=TsHz-OSu2fMiHKc9
z1UH2If`L=e{kfR+cW#tGd3qh^&(nzHbe71XPF=2s>~fukATEGgfn)6_(?w^c^3)hJ
zn_4+Z-Un3uL066v5Ltt2?s7nE@;++Z_Za%11fin6(Rh=mrtUEL9!~kvboZwP6O~yw
z39RJiq+l>KKX0XHpl)Lw38Y0Z2t22}+KF64`>&<vMCMX`6=gaQPJ+pLl(1QFWso$T
zVf${vJ-HJ#=vcnCxBGPWr}5i<Lx|o?YB2p!a(-)tdi^&br<09t6UA8cDlUe<l(>X+
z{EXm{31Do8q8=^a`B_fgE9uuX$0cA;H)hz;yy0SlUN4w&0bEt_nRYS`gt5QG&YPvN
zLJj+YLtex!oeaa;PD@BnXEB`23d06a!|j+1VjFRXm)qj=8c<|DlW;2u^eTBz7Pb!P
zKS>rU7DKyW{ilU^JGiDTvtV|)rQ;#}#qPFphc@<3)lwnVP+ti*%bQSOYu{HUnyf4V
zAUw9QWUDCnWwsEiG9^(q3cB$sJYgC0P7kZl7|c$as6?&u8Cr1$mLn>2SL5n%TP72|
z*zs2(z*|Gvf$6`_>RMW#VkSBZy!E5pZQXj`0N+vv1$0;cncPCp;*$E~*7iEw``wtr
zbI<-o_rp*}?XbtM{7&xQ-QD(joIAGa&dVJ$81xDFvDv%D13nb&rI7RiYhk*E+uD=;
z0+YWFGZ9wRy8pj68W4Bl#@(Pi5mA$*RQ|e6R;-SU{PKs{(4~ES^p*h34d`B_eEO)m
zG!ezgUt@$0y<?J++o=5ai7I%%P~OX6WxcVTI(`enIYII{)oRc2LzVCnA1iJSmN|X8
z2U+(Mx}DA2hk+qLbMg_#i(KmM|DPU8r38b!D1si;*^0yve<=tpp=PYCk%;1|Mf->+
z7VhJGzPbW+;N)Dbo}gU)ujlFOGJWwS;fFY@Y)_oa-`k<=nilj@M24i2B^zot$F)jE
zejQIcWr$Lj96P+7l{We_P0pdXrh_-Ms1M~ft$*sq0WONII3FEj%J-jg-hb4z+bY%X
zf&?qfAWE0FkCeUaD!!&negWVAQFaukQ#<o=+7DVBIf{6Z(|zpNJ;~Ul-+eCq%ut_%
z*NenwSs{4g%USZ?lR{;ow$MpnRu@#dutjsCU0h$;0i(t8zK>hLt2Oik*%*tE+}@08
zKP{*Km~$z{|07O?2}m=s-eznt+i<P7YI5go)izWcy_F1n1S>n@Y+Hc<6l*WY2;BfX
z`);U>4^4bh!X=#ctP6?yMr)YflEy)h5;R~fl%*R@JYBY$h<?!2sD_?O;qukX4_Q`&
zPDZ8J+akmcqcT*+rYI5@@;QA7(pk7msFA^AxDbkVpffL4o)HcL1>nnWvt`tRSc&RE
zlU0a?;L$z5W^8e5UT~8v^$!Muj-maV=q<Sp94vO$oC*be=CLg`vBR+y>na42b*O|8
za`Dd=>DM82Ba6I=B@pePw^Q0O*VzLS+S-`k;(GmNZ!LP%X^tL5(|nQ+`1bj%(#Jz;
zlvS~>s$8e4cXQ~O(;x=6U6F&5OlSbQl5AHjkXnpG13pT6)o`+TZww@bw<H{uvp|F}
z3^{!+i^bk6V~42$kmb$e?srOue{M-;rYa50rw)ZEBv}+|ikJ)r(KZV%tK{doy!Z~o
zVeG1{9hiW9iB$wf;=s89C6#|DKxbk?3}suE@|EtC7_E-RrLRuW<~Q5w+S|OwX%~$P
zfWp2?o0d^}lF<-{2>==A3X6F`6JDVaXdwv(T6HM8RWalFrUz@ZI0i0#KN<HlB*wSp
zeA_huFKG4O#dUK38+>Q%eS`0%$f*kds`cR<Y!$9IS}8*^=zd>*!;hzpVGs%T=wjl%
zx9QSlW!FSB85B;)+nle%sy3;exx(@~KNbg)D^H%Nj2ST+39zyroH6f|Xwt>NL3eD2
zl<m!w<7PXL#a=Bo98+S@-nCuu0G5OT)SEkgIcJUNsdB~ufex$R&TP_2&8CGvZuVbn
zFQo4Os1d2ebTbbdW3NYHybJxj*h2w8@_GEc2!Yb`I~QX8v(4sz+Q%fbkmiQ$`aoJ+
z*ZEpQHd?ZeXEW9$xo6$@mgV0nxYm=FBI!H96ho3*F_Q--$!Vv}St(!ljiJMPl=39v
z3SQ^MQ0xLQPlDd3%T4sEXo~m+YN*4!S{hCM?lJwnc|9w^xYW5Dsk4v1)uQL?uv>zx
zv3w^x&f=TYGU0K~QW^G$@yU`K@S`()F5DsFWGrk!Bz*dtYUh>BVsUp`wTjUDzC2!Y
znQ?PEa>f^>+WA?zT<f7NW&2m_{v8`05uKt%qub-3%Bq63M&0M$%T+ax+1(Y}+rJR5
zwU&)GiS+?63Fe9<ZPj$GH{R##(Z_1jua%~|9!=Rd{Y3dmd%N97S|`qp+))(Y!pj#6
zo6RWEzl)ZqZ*$W%%`)$2y(jvITi!EGE>dU27vAR=J+$eDMc-##Jt`IEi6mhUB4IP8
z4n%+>pn$%+E&b-`_^dWe!NgW4U+tUZZaE}oBZ>{aKdeV6hQj6uJ{?zea^LEcvDv;T
zfd;!8{`ZmTHs_35COa&RTXmUN$yGSm-M&KYM6&kpM6`9_PnRZh@yttD63soU-i*Qi
z0{)bz_#1Mf@mLtkIOx{A(`JCHG;sw5m>qea0W_(y;#Zd-WkM2vXeycV<@Pl(v$%vf
zxJpIaf$cRawd$x=|22l#u(dVa_ewYvQ1a1R?#}jY@e*X&UcN54)PumtMv{#_-E(=9
z#=82wGuKg4z0m;D2f)!5si`bU1g_E?R1bgUdxV1xF{$`J(M3)dD;AF^<o9;~AJM*w
zGqGqzrL^~W|79*%4)T2SjXlnWJF|zLh#yJvfOIyJI|7DgU&2>qLWaV8-0wzJt-U$f
zrQCG-OwGxD8zcxm3F(W2jgr$JA+PnnXSbfh)5JG+q=`ip@=}Y=s~%^@<)$!TlEOHq
zKez8@1-01j>7UIiSXxl3K_I>+I#s&M8^M+YIc%(+yqv6$uD~38#CQ6-I%}eSteF;c
zVjlBa`%04^?{)%KjV%3T^ok6QUhBD`8QOVYduFcp4#G@G4~>r<lD^RJp8Ztp5mYV;
zDd;tBv&nY;jn-_<`E)Ms%<^r=)iLjVcYH?!0o**QKgabL=)BxmVqFGnqkhzcABJd8
za+t~;wcMIM-t|0tGBnIz^|=8pt120=MufkABA9}u3T;H`Xk0xr6;*Pl8mkfiaZAoI
z@76DuOkBsNkdKBR!X{*ZQuf#<gY2gX7p|^03Y$B#%k}xE%k`*etrLsiN>=G9`1C-f
zqXwT;IKn;M)x2^+z3}()Z^}nQxJyY=B?qeKn;;(gsXbeEY??S5X}xrv{bZmB+#~kJ
z>WWqF_mLKKmrJ)U)>0q56%P(NENYY%vO}zz#+$kVdUo{{Z%Rk_f$@a}8IvVc>IFIn
z>5J^&m_gaKG(3d`QcXj3n4M@h^PsTd>Iu3fdXZ<B=xWl}1{ZG&ORY!Zjir-ypM9Wv
zRs87JarW8ZBk2taS7i1zg<(ar{fQ3$qFb$HLcIG~yH**_qF)xr*ab1Se(AcM*&F@F
zLRxySf^&nv!wFpf@3|kq$Ay7jm~+x|?K+Y@lZ3P)P);9g*5FgCbJK65@>6aOP>Mv+
zzr=9La18>p=2<s&RF1$(T(gR(>#!?t6egh!BL}JZr?0}NoeBaOBFSvEoN>*}@zD5P
zG+<#x4YiTc|EU`Z0My_!H^L>2sP43_4@;5icW!G#82q#X=ETBr*y%J`{rsXsyT|C@
zrom>lr%ZJY4RK0HR9b!$-o*jkufKhDGqm0j9y!}D=4l1{!%NROi3OON_9hYKrWN8V
zfBMjv`Wp}+cqDl&M@fd9NtsMFF7eXxP2;l%|8rf!pB1J74t*)ZBSrB!S!W|!h1yiS
zU_jvnS<key+~Ta0#uIR`yb|;LunZ*Qn{6Ah7{T);v3hCTX&<`c@mL-=7z$T7)5&ok
z>7;F1|J2;g(Rq0YO_yoF@M6UA+#|i3t&jv+iQmd(m(YG+8n{cITq+=aNqJG3@-pja
z7Oa=JxSjj^1fLz>^IXKG^L{J>lbE&jc+;gopp{*0mD55zNmYcAY&^ar(=FBZ8tr>Q
z@RhzZqu$U=*A<ptM#2^$oqaPnK}e!I&Qq_qGbz(^?N<Lcqw=Sj@?3W~^Fpco8bj|m
zQ=3j9k_(CMQPIf0;8y~ZJdSf_HtHa+6JLp>56!mn6tz7v650JXsYn%zevOhqjrM49
zqf6m4!~hbtBO0yU=?D8*!oC;verNdF6yt+dh*SQIS?CNII)G}rej*@!tEg&&+A1lq
z^`AhAnQs7wRmxLkrIt+WT^mWVb0$9}AUIqx`8h08jZaLM<JK>!aCx!u&hh%U_o3s1
zX`ZHog)SF`m3P*#CRt!)3G&Za*=%AHq`%)Jm*jVfi=@D*fWXTeKrfY>FgDxr=xV3P
z8WHT~@Z8iq2sJ$=h-UApWZJ>ln{q5~f@ukrS)o}tTH}J{*3?*s!Utut#!BYuJ+Ij~
zm%y@k<0h#D$cn2P47Jr1FEUv)=JaQflUFEA$U)?W@v)eZk$Au&3mN?P{)tG=dMl<2
z+66Ow>9%m&AE5z`ltrQZUkWgZ1aVKEWI0?bP8?$|{`}6BKFoHfelw6Zx7~Z<e8{yJ
z%GO`4x$ZM5mcWhV{+zH@ANA`51v&eC?kdpDwNfL6m{`Q*)@9FIFYh>d*VV5f{I>$Q
z+)l!fNExW~a~TlrSpCoAoys6S#cZxWUizyySTwt<>w?-@61vsz4zpn;Ta-0xp5l~}
z(`dyLP;FBY02;R0&hx&82=B(V#%pRWZy&;wVFNux;P%s~7))=xN}E?ek#UKyd<T{6
z&Nr21+eA4tvpT}{g!gMC7)7$(?d0Ob<|5ugdLV^|?Z9vrHm`votTPz&pt%cZyzy!O
znZ`N_OLbGRRE;ueK7Nf>GtGYBO0>VWzE0K(*gp8t9I#$VRv(-mHggsC_}xr@b%bh(
zUgB*(A%9@#Ylc?gJ5def2eLpBZpqNzR&(LfV8*pFC$&iQgtN4a>1*udnQJd)ZdLex
zq|t256|vU7y%~fgl1t&!NnId{A_MFCZ$6BxDdY9tXH25m<_0T7=Ij*sLCPXaEOlv*
zbLjt;V{0&TK13Jj`_Gs`U9iIgsF+lZ5&nd_$oT(OmUZbo?0iNNWrl_k;D>0zHAE9M
zy>H5g`m=jT>h@J0yyp!ISqSHL6mskqg~S67a5c(^ni^vau<xiM_{LollFW1UuJLJp
z*^LH#0wBhRFFq2KJ+;5Z74C~rGET&gxP*GrW%QQA^#1gDJmQ4_dgBKr-c3i91TX=x
z(?C+Pk3orxruFE@Zpx9V!V7W*{k@m7LP5Ue9)N}nH#bpEa6#G!$atI!&qx7EU?{%8
zQ8$1P?Y6S<bi7zm0`0qkqv6Cn8CM-J<AD$t;daCC_9enW-L(Z*$Wl~n3rgtvtxIL&
zX&<XIqBZ%iVx!e_n@cpMRuRs*Bh%bjfJ;;41SR=IU!Z~yf~QbMmF5-eQxFBIBV2`U
zeyFLZHVX59h>u%l_W#v!q`*KydkExQ`)^aR8_mY2e(N(n6_B!sZTrJ~c)&5B{tkj~
zz=Sx4#b5ABSY8cLhqp<EQpPtE{IOiuxQ#W$S@KMim<t=H2xk+P)xm=dp-o89$O5(d
zkDBBe!{vn`7*&Pjn+pz0w^b251+|K`%wfmTm)2+Z{dz7(QsZp8wUV3ue#G<jC!Kt~
zs4bjN!9Xz;Kx~BTWsUqC_Te^0&EdFWytJk=R5}?12;jde54*8}|A<v~fv^Gs)=NX#
z>tgX2iJ?pa&i&A|3RwTWb9q2_QD%W!B6n`0YSyM8A}!AOzeOv1oF<w_{~r<-&2}Ur
z*(xBJyX=uSA$ewNthRF<VQXWSiw?rO_NA@UNKgVJvR>yzjTtF1_d^N~tjLj3S_&FC
z&!8l|$nRExr<&-E&&}-oC!v<9Ye$4KX?Cv}N|TbztWtlo+DocQw!k-Fo{Z`}(A{A$
z%%@cHHn$7?xF((cwL{x?>?06){2uiXX@^*Dk%qoQ6{@vkva<v09oy{d=>dAY{PTnp
zLQ7x`5`Z^6G01kMw_dVxkI&mp&_y3-QVXSDGrU&RI@f~5m!Iu=_}9`M&1><TLzjZp
zD}245?u_?`mrZ}L3ggC+{Xs5^dT0mq`e%q;_80Ty!y3y@R7~x~{HYHc_=kcJbHnE0
zT;;atjf=s$$FWgoqvOJtx21;;wNlEjL?fr}64R?QI#@Vwxb<Z1Q*28nk8ahEVX{b{
z;cSh9zQbtcl<pAiO2+%1Uq@e{gMmiw&Wh@92nh>lA|&LqquL9TXdC^o&SRq9`Ul@l
zt2G4&lr*&pk+>3qMNriL-LZ~`C^K37P4KT63*x5h3S1Ev(1i+}kVLHCw>jvH50-1X
zGTh7!6Z0I4Q_oF0TuNN>gvRd*dJHiA1DQXa#6}xSD}_4wz1JhB8p(c1w6+a;8b6Ke
zV^!ldzr`-g_Gm0XV>yB<&u?^**$mXsmnB=jiB#0BN;~MLZLh5M(%33WL1I&bf`YKS
z&fm1(eX3lM=TXD^4FBWfZ24Jrh~`dm@zs3n@khNUGmkMIKq&cnH>B=IVJ|FDgZ@r?
z8|S2Hy?*oWTlMMh|LjWGlV8;pVu#S^yW5<9>Pg@6QxIG*L#t&G&imqhP*lDcO0W`%
zYrCIeN&W)t*d0EbAfz!%)e~+IPp+@jQ4^&tELvrE(~P|X#6u!IA?8+Chws>zUFN;Y
zblM+;^CBPtqgbkMffvdJtfKexLiHJJ&MGQ)^TnJdC%jTAwE_DG{A3CLX}WLa5sA9a
z18nOVnL~bn;4w4UrMf>}wC;CLoH-8t0ec<JiQvucyz9N&IZemA$cM369zI;^3eGwB
zW7?NmI8LL*$dP27H00G~tIrIdm`KB#74IaBccDwrQg_Xy6RG}$;h@U)1&isnXa0_W
zR#EBV6HdY7aEk4^TY|$0L$xOk+GOJ5OLl%&jYTqP)-(C}i~a*n3WK`Q^j9cE2ABE=
zDy|msqo-Vfzoga_28|dm-<o60U?zBER6q_wC2mKv?oP~TaylP=lc6odn2g<n8Y`Ke
zOK9DN+m!K(BhiMw*}kb=>{Q(iHJzC&cJS-$v*-^#YDujjT%yK3aJ$gHx)+@412rtK
zOm;^);e1a=Jd<wbQ!2ebn9ZFODQgxq(<vg8NbUE8@H#sR#ceD_O6873cvo{nj{ZCW
zMjw3=(+k~31yT+cg>pf2O>_Sy)?%6!noe+JQP?w)zPqme#{LoZ;Bz8v5Ry=3fiv6s
zO((OYD=MQouo!+fTTrzVYwbL6TCHSlNo?5v7*G52Cz9Eib&-5r^qY%xZErn48Ykv2
zI@>Gc+*k#aOPoLG=?TmkoU>osN@;^fAyi?`IEIx-LRC6R%KyOijaUyF+ip~Sn=!ED
zBgBjG3bcGdiBGc-rD=sQ;<CF^p)j0$&bwef^a|HTQEu8H!TyPQ+5a)S(hO1ogFK6;
zFua4uW9%Iq{)+N+7SU47nz<GJ>3Sl5Up44LEr%Sws<NvEX8j6tz|zC=tp94cv04#E
zAz9bRjD<+sFN$dJ`K5QrHEQyOR`Wa9AQTe8CqUm@ZavA)kRTe+XZ>|9RmpMD?0d+1
zQ_#E|7rJA>a7}^!WnjN_{uXt5Tw^1<t^Eesg3#*1J}1+^g<fx-6#eNY&iR&^{CedB
zj$wG-U0N{A*E@T_9{jny@98&V+Gqwf9Qx<|0cWl%^fW4vdNz7@*hX%3;-*wMz#+NQ
zrz;o^VNWeb%m_hQvx&7MO)Y!T>4L<yIuVAY@|UX)(d&upt>j#orSE8we>YH!(XngK
zG0%KB;yI=y80Dn~abF(?kgQUU;{g^0l@wD5;#-!(ey(g@dz1MSe26*ZJH&t@i4Eel
zr%H3*p`Ogp(cKx(Y}lJE^v3ts$EPEuB3fbmc+)dJlLiY>@Iq-=E}Aq;5mWsiE&xOf
zbztv>ymLU20p1Bi!0FvSt&K`i+RCbw-NK|mi}p7yCn-BP<tDQW7qEfMkuhiK?2Oo>
zXj}{@tZ|SJtJoGeCJ{<DnKPgxTb}uBGNXT?@SHB27Ct9Q=>>+oJi#wZdHI#^c9KEm
z!P|)yvcBf<^$b<!Ose$IixbO4;P93|0E1i3w0jJC^L|l#DeUIirQ_0p?e*|{?dEBR
zPAG<ay@na76+r+CAk+o$wxja0z9&WIX<;{4YN`jtlen6*@JjbuF{;Lbe*zg^5CV1v
z>X@O=duA{B{yJzp&mK@zB)@p0?m)>S5<h6N8}<t-_(@IZfQ^t9kdS|BJbIeFtpzn7
z`KSk^G>3e8oWJxeqq3q|p`Q=lXR#2l_ICmr_K>?_$Z;oeV$@NZOT3g!5`v-~+hxvY
z;zEDwQgBg`*Tg!Q&%ykMshibxT`$nvGWDYf96w;NwW73!UUz3m*vWbDSWJv2md@l*
z8L{q1MjB6cuoLM?5KD%r)c=!N{P62fu%^LPd>T`%!{pkW+AEc_GpxaY6Fd{UIde;~
z;<E7Z+7GlI$q?u4lq%U`wFqW)kpDX;+M<lMYK2Gz4y8T%R~z4=<oc{G_Ac06%Y<eE
zW+T2X2b1ZjZ2tN<{WdgWoMU=PMA@3bl18V#+CvU3U#$&L=ffujU*O!3h~ekp6s*g?
zunJXicv1YlA$-9wQ2;XFTOZf4KbVu+cDkJ!_voVmSIN6ElyJl$o!PPz<R0s+0(0T6
zfG7i~J*vBxDcVm+4@+?i!V=&oQMaf!W+~?$4zmLb6=j%(_8pXbtSbPH3jZ&%zA-wo
zFZ!~=if!9Q$LOSEr(>HP+qP}n?%1|%+h$LG|C#wRv)-3lt8Uf1>(xEC_St8jebI3`
z-~hSTRE`;v!uer63f@YxZ*5CH#IZfhY#lt02*jeQNWPjcqe0OJj_{c%t}$rsQAPY+
z-$|J3>Gs`Kjb%arO+4GI4&#}O&VOIpP(XWTTPWQC+8r3kSABj-ZsVrH-~{j;r`k-#
z=KT6@(UnSg(x9y<ZmNkTFWXdD1)d93ech|x*RmCqYs2Bhgz?SL!+BTd0vdKImTz}Y
z&uk!{`@H6vIN=te19)z>T*UtZd>H_88&PqWxy}0{1ewr%D+p9PVar>C&Q`~Hk(YKd
zSO{K`V9ECe(X=-!w!a|yplV?**8QGUc8wM#q*1rj{QcO)s02Jgbr0AYGf#+JZCTvk
z{8fp{N_8m4C((~{x(-k#RBU^aLkhWH>l;CP5Fr)ivJ-5C|4@8g^Y9YHtT`d@i8=vg
z4ZUQY2-|%~CEpGIP=06uAklJ$&XQIdk)su&4$KmzrgsN4DsiLiRQLOh(EdumgygPc
zZLkv5c@z0|f>J*3)J-cW{%%#J+;E~7b@BBh{e<Fw!Sh+f!;a1l1p@Pgp*Fw;h3<6d
zUSUGU+0B0PJYa4A_urdtS%Lq|cI397Oli9T0_ZiYwg18I0XfdfZd+(_`Q5e$BI736
zwChTwk3#YIvk?=Jcx3P>rsfQa=ZnC>7kSRpn*_=-7p=FN(qwPlTB#Il#V!D<*LN9{
zZ^#yjR|c$okh-9oTd1!8*VTeVdT)1m&q)ggup90Z3FV6%jZn~O?mp98*Twh5eE!gu
zT5Nzt+JP4rf5naH?umnu(UAYE=Cr*W>}<$1h+DBWOdawApV~D%xT{*ia+yRTNIl0N
zl3lGbzG+!k<3s?~CTb|SD772+J97kU+ut(BT0<Zq(zHDz<Nv~1mt1(KUF?!wjY;g#
zG@PVA<4Dh3Gsp7LWPm@M!#Ee8%vK&kW4~<fcvc~(LKB4-iQd?|+3z2DgZcLiJir-l
zeP-7(?Vm7>C9XIXcWbnW;^X+QMdgq%q`gGX3=Pir&(AZ7j~Y=}n$Mv_s$-1jgfUWW
z8Tc)}o2$+nZohYoy~Ixahb`AeHywkD4TO^(SJvTzWSLyK;-##F+yj8r>iDH|sCVP$
zue@!r72fVR2eyH%V6lLrx_TT6?clI}6NTidXq%%O%HDu8xW5#8rx5SR)<924`F-r<
ztZBMjhPd2z3rD!Uv6a)DwEnC{T=It)BAz2D2n^rbK2khYsJi~uY<R7?IA>Jq$plsl
z3Uj)YqDlzBVus*!N$X(|co%6Y0`K>!n$T2dmfw9%GIR3#B67dL1e#CCvI^2r{y&lO
z)Wyhz;#Y3}5R4yg;RUw^I#?O>$aE<ye$(xTRv;vbDl&PCUaZ@aYW!+~V~5C%WC~*C
zu5t*_irvIK5;J5|bWqy)4mkB8eqd{-me}#g-Z}sYVAw2m0Zf00FwlfB$BRaxgour5
zZY54S_e@38C(S`%c|dIfIp$a%3%qhL0<;u5RQbIjoe>HM$D}fZI|gF9%_yUf7Ai%P
zr05>u_tm>cMU0sO=SzG0h~&ETksDap8NnVl2X>!-8#3^;3jIwrJ5Uzt78`xSEEKYI
zI%BerM=~?UURP5`PBF@V7OMN(n#rt##}=@LFe2u&?<^Y$GO(!Fek~n9*6Jo8H5q^;
z$peQD*>(pnrAGd{L_KYLDHq;oG4Kh!3LlqWq#V<_1)llT^;T60bZ2Cw27jkSdQcG7
zd)<FQNDZ5}Ggd7@_3k|8-(=7!T-O_dvyU`>nDK1OBRO8f&l|yRXU->F@A@6T(-T)X
zSOMWaI$j6*V)}q!Bs2xE9eTstUeV-WP{Ubvq;v1SS(X<O{Wmqw4G<2-9%>%F;o)n&
zCa4@8S4T6_#o)-EJ6z(D-3EAHfndZc%t!ARnzgKJ<)|#A;;YmZ<T>iXrPG{%5Cdzn
zWd4B0x2zw``3abk2zh9sxZvGze<p>0AfZ5PBCG(!5cuEV0e!frLH6cVGMYF243UI>
zSJo>F7|pvcPs2P7@{NesmBDHKj7WLtwM(vPrg&e^Odk$6hbbe>`eS5tt}xHMQ2{Cd
zsBqzF+mBWpvB?{Y5X%sQI?8GfShxCcjK+Sf=-q7b4+4=&t8Z@lX{oVdhZ^w9r{je;
zxQ)b|gMVC*Iv_`2PRf#^5pMMTrdyk;seh1ARW}GCW~bQHZqAO_xades8Or#@9DQuV
z?oq8{7U6lizYFHkIq9Pr<vd2;$Yr2){|__(OL$hjr>?V>ZBZ9wu;h&0{m#ZS1=f(W
znlL)3I<*c7LRuSk45Q-gJ-v^N<6|2=HvaaIx{6!z4vih3TD|>;#19B^_;U5i@TO&%
z?TH@Tg4<<ES2q_KqH?tcIYLiIM&2odL&<~D(2D?x&Dp^!_ovbg-LeO`aPDuD<tX;%
z+--T^vzK)o^HSRd1N^ephWZd1%Wn40<}tG(CJQQirMO@)1h@;t9QZ|Gj*}nOS-?b2
z1!4p3`TyR2XwBpot3BQKeV%(ukhcH%I?@V#7h~}0sh)9D3Nkgf<Y;0XkL#0#XJx_L
z^kNZZ7v;>pG11afF3AS(j3u}=T<_L&ECag@uZ2G3u*P(}>y{`NA^?PQoO(7YLpZ?G
z*g>}63ss*Zl$gT%qW#Pq3$E}tXp!5Uu8orJW4xUThlwcsCL{?c0&AdI-8Q{a4!w<M
z0uR;(FBBI?wAyOdprRi<fJJd|wt0@>)@U7L3gjN=)U1W!Nn`V6w<8gS5YyS#Pit<2
z)#!MBBV94>B^X3-nDUXY6Qn0@RMwL;i(6+h26QsLFfTZ_-BC63J(koalQBgKAjm83
zO7=%nJq_#vi&gk0hO)2Dy*+U3$9U`hz*K<vRkC{p8=zVJTvooN3KWWB55h|)x?m5h
zf@zKk$Q$l9)%(U_aV{Qms-#P0<Dtz^4(`ip>R4a`tL@Q{#bX&Sqmo^x!%zzn%R28w
zY6`XKUa#%JX-dV_2WWX=8v+pjWE~(<&3^k!%3O39LX=vS#!mZNxnJQ;qqPSTsa3p$
za7GU5#^`jAMhEg6jAx`vu1={IeZT<d-Xl5Rbk?YoFV-|OQWF$cW(iXlq<?60BZKfB
z(sIpjkVt5}mJwEP(J-F^ACNyb)QZ)kOpLuX1AfG#H?Xg-vHp%VAK(P$hu3=f?6)R`
z8_~TXEZwU_nojzP5g&C$k|qIaf8gtG2YS5ieO)f<a&;k|PZ^kja_97<%TS#JEwA^>
z{R)0#e>_<L8R@?*j^|VPXu|-~_`$1r;OI{Eb#~s)Ffd_{hJX;Q067I<*z~59P8{sU
zLGhZwdTP|wxY|WKMAU8|wWiy1lxg^4T#!+%hs06&brkrxzy<kix0^WMX}u>v&IHZ{
zqijKFB=fF)Rc%6!)hD!kS%RTressO^>@(pN%+lssv2YSIGXV&_qMeS9<D636NI|7;
zcOq6aK>(U8H<JM^Wjq9H+6j&gd&k>$xhO=O`Td$;Og*R-5lW4@__F~!{kQrCtbcuI
z?F#=~R++2L{>JK^QO7z9PpZ+Eus3uXTloY!gZ-P{atc;eaNKn<dH(ybh3a18=L@P>
z6b^}`0DfV>__A8-qM#sHN8${DHW*AoqRbtLfr0`GZC?1ik=)*X|0ynn(z3dlfy=hj
zCHF;^!RK)FK+OXN+E?3&C$QzO|C2M$h2NO`TI})7>x&+*7Nln_;pK^8!wvdsYr$x-
zWYsz2UN?B)()OXhuzIBy69s7#bE_wrO`K*w37yubw4n_Rbqg=hZ%a)#uMom5Lix@s
z2?{?@f#Tzf6^7i2JN_As9Dh{3y={as<cN*RrY?L*C!^mf)s;273(a!7U-KQu>N+K_
zvcGZ_imKm>aS^_=4?_Ah|A$Ul7~GUop^+*Lbvqu15|Y`Ee<;m`c{2syFh_gB?kevt
zaWgFNtUl?!l6aleWT;IE?lKHy%PBq*I}&Oqq0_c>qIS}>B6+<bJd)H@)d5L9EF`Bt
z+X4WE%-oRD)?%kW)_Q2C$UnbGdWd)t5xgz&=TF<YO7R+RgVRa+@vR^lAn~df*GJfv
znXm~?238{)T(>tyt2E}HIAOQ6fC&YN9#a-;mK`kNI^nA>l=<qT5~z7D$3%OUjh;Ey
zO`^o1iQ2q+)P)M_x<Z+nuZ=+8GJPq^HBu;-;t(<<{*DBXwk$k@^4^rI^EtH`Z-*~U
za<|S(!>^V5GPR4J9{h!tn64(sYH6lPbGG4ggn{@r+-Kg&QcLbIZL$k7xwZnRASx7x
z=zTL8?(BT}naYx7nrYK&Q#F&ipppS*p@b9dg?DebO?1!(b-uoSfi6$~7Ci<Gko^Lb
zv~K>8De(2o4Kyw+@%QJWQ?n{jFavb9#&kpj%v_1++6Q1jI=(N(YNgSgdF{*6B&<+V
zs#_RxoxFjDTVTAPGH8Q8T<Y{Q&d*M1>xYy)mNdVfVY%;_Dij$z9~M`Bxt;jimI>JZ
zB`w;*ynEX9_1y~Cv0K7GfyP4wU0491l~d?(1-gMQmMS4f*gKQ_{IxBmuh{G0V{>rf
z*k#dcVao>XfinFiF=C;yeS;-{DTmM#Eq9}=(x20=8@7u;r@`n#lvw~rZE}$FYw-2;
zWJ4hghNv>hdY-olF{o!=Zog|b)S5<1n@JRs*oG%Mf(cunr7tcj0WQm3=z3yY77xM~
z%f^_#lyFNL3(6VgeN3}N?6^i7LXO$MfKj~cg{CO&CqziE>h3)G$`|(67vA;+q%UCJ
zEhVWfP(CD{l#?n~>R&N`Y4v8qM>7d_`{fA-9zXcbOgCa|NT)Hq{*@7m;LPlFldDtp
zAk7>9!eHb0uz%uCNP>maL2*fo`Q?IdDbueIVs1DEzZv93WVIoKZ?NS{u>22E4zZ`C
zW-rQ1M$XhMyPg3`7&NvSRbnbwJ^WTOsWN>wu0y*?4YpdnQd*Id@?RS@d=NpCl32C-
zvpSau`XPqMwaSRfq~mT6#R^sR2?&hu@Cvcuj~@r^+4`DC?~@Y3+Cz30s={Eg&FH{#
zW$0YHjTXVf3lxpm({j0;ykWa>mP~7IkOD0$$rnp(0uMq$n~+-+x^7J54%*k!BD1+r
z8(sk;l(IE?0&%?`AUbtg+sLNm*eG^j0(wZ)UrTYd4ZB3>24uW?)DHZChRzfKQNmgS
z^JigpKq%p&0#wo@9x*Xf2KoXjo?k$0>H3Q^x7~1sK^VH4uu%0bV`t{IS0M$lgt39+
zR71NQb|D<K)9+0bFFRsvo}9neVk{iYqKB@|>Nrz+)5((2Jg@EBM3R<;A3`^ffXWxF
z^B?h$z)*AunXf8?1T|-_?bZ^<VsRuIkXVWar$8)T5L(nJ&*P=WLL%@BUcwy->0dxK
zNu1TB0QIWetsSULt<6I{3|N1!9@G)tIMM&Kx>QO|3F(%+%{0cd2!O=jPb_;sU3-`m
zIP47Od-C0FFt;PRKdRmFQ+{MJg7w%*uRK96d*NJihFr4&58DS1t_SzVk{?v-0f6DM
z9reH6)~6#@>Yw*JygSebm>e4RF1bB0SsZZS{uv9{WROV8s$i_ZJNg-qesQ$w;9cn(
zz@1daE2q*aUglaO#~TK(2lP`-kHb2yDCPp9OJr{tVcd`&i$Bg!ko*7%#5%}$cnqQ$
z%t|Q4ZCJnp;TBr**b+Z~EE~RBdq_Fi#uLnuPJpFN-$X`iJ?eE;U+);?<-6RFO+rS8
z;{Lg3aP<%*fLk^QW1$x*D$ZN{YqrS?iG`2b=W@&=d=TJ+Uk;;hE^4V=qCcC&*@Vh?
zDN+|&3gYVcAV5sJOq4qUlSK(vIQwXEw#GN^lZL%bsrN$OvViFWT2Nr?e!2Qsu~t6-
z2N0E2hh3DOG9W&Gw+Qj?O+^cv?<VTcQxUUv56@V-S_M{I@vw?4+x|_=hcu>3rcw8(
z$^<$ACTbTl@kfoQ9I|g9VeYcVC7E@~;*uQjsaKUFns&+u+tS-L>EK^W=$GOu%;JA9
zC|FB8SV#R?#H0CLJ02cafLse)ykw%r3d>o{3g5E`w(`5?pp3#W#hU`t5&W5_q0SzS
zyB9=lx?H}dGUf=gXyOH}ogS2>zS4@h4s)~UxUql?8(lFeR>d4pKpGbSeK+8x8@fmW
zP`dfH0iJ8ocx(@k!4(?wcD~qLICvsAF-GV?g4=6MZ>kTs2OmJ<Gj1ZZvg=&{E9GC5
z=BxTvI~US~!ZF2_R@Yj`k69kOi>S27(zRzIp2(WThtoEuAFo!Gkg#U_?8G&JDTFZr
zd-x&(u#Vkbl(T7-;z|5c6_f*ZZW;Yx?V#mSpE0TrN|GE#G?)RmsCL206Rh{Yk02(i
z`VxRA<3yv2NQ1}?4)g6T(f1X5n6X2etYQo4@4=eF=U-Y&;;)U<UR)Dp|5XBiKVar>
zWPR7TBss#>b%~S<OTw#9VtH7a7hM0l8jWh)9lL=ENMwzIfNxfQPSf=4A9mXJb?7wj
z`0c<eBb@OW=<1r6dLrD%u-`W5Al#myJq;^@kwQMIbT55S0ArXBIDw{Yw<=C%F#j(E
zkm#Af_<!!m6H+-svG*##^H{PpuK(k>lWW0}{&k=N(gn36PeDZ)rH6`lL~*$^7KcK~
z`yRx$*J_ul$_ot1eMjqHgB!KHIe=WjVK)u`=|k`VSD7(;GFfr+Zrt)|SGW?Z5zT+O
zBc<@ZSwRfGD`>*4@htD0h3M&*d8R_DmK@B1p;w2<fE%`6Y+#Pa`@r^;Myw$Zug0<S
z7)U{$qE^;1uciY_Giwe7>L-U{x5N^x4R~NuOz}8SX{V{I=8}uEkf+Y|VB!@=jVNEH
zVju*~974?@(ggQaB8Z7pS*+&at?*n+ot8(%Q<m|R@6yKpC!-b9k(Y`b@|koZTWc`A
zYE8nd+#23Qq{FV;%6|M#gS-NJ>1Tt;>Ec#WuXsw$!mZfoj4h!dx0i-^9?Tps;%qjn
z7Eq5-p?B#7zdy>seCoaN4A-I4Ut$jb7N1AArVr%($Q+lH=}=5eii|$El#H{7-3xvz
zTXeXud7m?TD#PWr=Q?6L(!w`xLN04+P<G%m!0>FwEfCXJ1K1A{jYNw8&ot~P``Zks
zX;@_)oQ**`z?8?!6*gLI4=?5(f-BOdsL{$N9sV936y<`NVXhb*kmST@7(yOTP_<#p
z73*tV7%4W0t+ZcVJUW-D(a;@pBkY56EM(Kpq9HiHQE_Vxi3CZSy8(XAP?ZD6B^>y_
zp791CZmDGSKmpMH057K9v*D11jFa=H$kJ3^%WTu;Y;Lt#Xh#CU0MDXK`)}VfQXN5a
zj8u|o21#K)Gb;Eep~Y(<1A9JdzDsY!V?r^<b#<9}#flfi*)OzX_yvL;qC<%isaDy7
zvgvIn)96$K^HgYZp40$8b#-;F4-W-7?ajKSH|qr;m7GlxyH(iYN)Lpf7%^KuRg$>K
zp;id-f{WK>=LOT?91(%>d)oZn&`Jj6Z7Ju*L75u7ud6FqRE$G?UFJU2>8R5c9eGL9
zSr@ERVwM9rBbhp5LU>UhOSK`#-itzcZL>J^;YH)z<gFq(&u6>5MjoyYY7~^%tVA;z
z^)zcj42>^)NFFUTjG+0wn9{=7>cQez{oC;_)zFr`G+}V{d8`qbZ>=9z52-mJomnG@
za*qwI21}4TFGLHdm#3ZL=}b#*SLk7!bE(8olZqb*@|K_uYPL&?{*dj%zy8r&?OQxN
zZO-gSu~&u(U5_W6`bV-WpDO*?VE4Va_uV>tMyp@NV0tT_;LDLcFSTv!1Hec>##-X0
zr01Q+YhV@_5LQ!jIcepC7G?Z)-U<sp+KY0BYN%RKYaL8^d%tDVcsy>_pXP*_A3=OL
z+u=t)<`G~M88?))MEg80<8o<m?HhOB+xPyqkYnp;#58dld_P_T3m^kg(&yc8)OK-A
zelBo8cA|#7<D7dz6D@K!{%EEE($3x9pr<OpX@h)m(~?V2HTPoy7-1q7xNjxhtQ+07
z1;A<;Tptl$vIbDc<7hMaKo;0BYW3y(V7b4;C!E`2Y0a3NI#K`LTDjgT|EF6-Qu7ll
z-`L>&bip5f>ukhfsh2ynR1{+|=4f?h6R7-uf^Geyzmsmu)z#T+NRyn&Q5`f;IFzP$
zGBbQMf8tE?ISGqZ58<UyS44|fWmXw^B;H}xi|xOSQsG3-;jgG3)<<hiZhjZkQ|!_k
zDn8Lux#6;wcT+c;T8MQ<?2{utu8i7DsA!ckj*03iJ^i$cqC|!7UQ3-!Y{8RVVx6#u
z;oBgv!zPG(R|>*pUg1i<e?kQRJ)H2Xbh<JsLfcx@ZAk@}Ibykc>~-}fe4Wp9y3CYM
z1~lEiXV+AYKL$dam%LC*lS0-B88{LX;8X1|L(z@><bg(E63~$#wNls~YA?3lBa;S0
z3KVV$r4pGXJ<)iT+rIsAJzoPOy;xuX?@u!$^gm^a5<w`_SA6uZGIWFkgH!u_KO}!3
zuIa-Zh7T<KQs$+VDiC3EDxj!M<Ws!Gb|Fzzp}<`6d&4Shs1`<dC`?e-x=sz|Dns3t
zn02ueCM2PBmQrN8<jkI<yEUuAz`IxwUDD^~IMB)D>><-#vqm{AFKjHRY6Obu1)ZKS
z`Nm|>A07E4lC_}`b0Jp-7gZ&b9NP;Ml2SgiP{%rAiI_*HF1Vfth9R`%OiP#`*vx&|
zk0nV^zo*-hABZdO<lF36`LG_zwHWQLC@_U(>5vcc4m!Cj5w_^kjra!q#1ubKASNH}
zgvS3bPK#pkj5;TJ=Tsz-pKVEXiPSyRjJZOQ3Ha&ufn{r(Hh*>mgqJxY4=E*%Xpn4B
z_@f15C8e}ZY#jLF_tmM(l`az}3|p=c@7g9OE__veC^MWa4)ItsnlFuRNZHiIB|v#{
z>bZ4GdsS(fudF-n$y6?dWRQw=5%_VXo|~pBe;pB^Y57?O?>6gZR-vTcZ18@h1zOlh
zV<Q?;CtsS^2O5kDK{B1Hpjr8yAR40ZbAy&a>elqMc+|Z>eAL3P{`duNrqs5uQ+kn7
zn<bh@T1yTK2FdYJcZc?LD9rNB?aUrDF_wcUhLU1CO;CP@2NJh9@Pq#7LGe>h$<-tM
zkr`Hp_l78l6q4%<nBl`Pq*ciD7e1uP&W5fgNae?RG8AuYj1Kmg8X(<W$qv1sIq6{b
zBq1WI`+5qg=^jc2-i%hfcwx#W2H+s?2C#2)wchP${kIX|V39D-Ar5<2w`=4x&;1jf
zQk(F?+VUY@_B-(__c+jLZ(=gtM`L=WK(hvZ=!y5${}R8;CegoFZP|mE@C5yQHW1@3
z$Myv6B{y&*Ap_AwweA1a!GbA(Ct4J^qa&N#nAv=eFn#B(bRBS;Fp~$<o5kb>Wk#`O
zb?^>zIrd%?3U6uqPMV7Ei&_!ul`O(l`wm__yjzq}%Zyu0<Vv~!Nh+y7-04cb|86Se
z`3#MP1P5+7A$P2GQ6>C`Ox~BSoz}T%>Ua8lTzylsbo?DoVzZi?rHvL+^8V$ro-2j}
zp~zQ*nr{BD)o{io{fR}_YlTXFz$jtLH|;6KuR}d1DJpj7TtsoyNM_xV(!LoNyz$$`
zv5?}3jmKHFxDpF``uE@X>o`(G-IBd9=1@?6jcqgZu`IarXugVZ&dJfU4E9t<*kt}N
zn`c2dTjy~j2fO{g#0L8V7s`2dVfDN<vX(y##o^);LD*2|q0|Ay#yc5~O|PX%CbqtJ
zgh5`Q%T`p&E=U0JA0|_JNsspq#b%&Hp4^06CrRb((N#W7(6!`Hn%leXvU!)q@-RJ9
z<%)$c4*mJhT^xg34Q3%_i7V=}?z=bB7ZY3*$wp<op`u!&A|SQ3`IAC-a*CI-NK9xo
zC{HSOe4_TBApqaQz{D57ST_?PA-T5AQDByOMq6|YX!v%;s@pez;gT)sws+M$V+wic
z4kqVU-oKY^b9N=Ac%ZI>Lk~{;^$A^GxHr@qemeBq^Z#lA>gxO9vc%P}!lzjr;|{;5
zA3Hkr?Z>?3U*1Wpr_rj1|G)rg*U2e7mu=%bA0dZj!>+la&lgekN@X!nRl<XgR9J+A
z`_TLBz?SVemvLih)SN{(%{KnZtx(u{729i<fFY=~32(HwUD4dKGHS{c?kh?9o&B=A
z<}gs02T4*QqNpSTE19Wg?J38hl6u{{I#wHYWhf?Grbhq-q9kX`!VJHc=564q-o-w%
zyc6q><2Jr0X$^qm2!ntuQX8mPYW2`#FpJr&8B-Ji$WrHv3a1A$?J?ih@ebUQuWM4t
zuil_OYj(M1fB+NAy9YQMplZTOg;}!(S5A4t{cFPFtMDzs27}&~<Ay7~I6TU~p%3LT
z%&c;HNc)>bJ6?Nqii;i%Q^N}(L@geC-dH!R`|g3SVtZ$_oxz&hjl~u>if^%HoQ`Tx
z;zfT|gzYt(mJ|EKw|roMxv)F}mzWvAbjBTN@i6?m!tUN??Dz{x#MJ`iXw$c%B%s0Y
z`dY1}cvc<KeZ!g2;M^yJ2^Q5iu=#f9C%WAEtTD-u+upmb{FbEV%Y{hkMFj4VAW-nv
zl|)B7p3hQFqpCZAquc)*Q%{gd9|1tpMqgw$N7t{+zFBc%D9A2Hm8Eso+Zm5kAAA!X
zRZUi+eXQsV<;RgMX9Zn~u6h_bnO>_Vl@tY2r@QREk>LWly*2X|7K~<iNPradmn0B^
zjOfsVmwM;#?#nhgk#B!^reh{sg~c*{_TgtK5p-EE7CXc~z~pD2uIs;$HlANfe`&9~
z7l&_@DXt>=$~TWWG5fb_Zh}CTqkl2>C~WmCzDB58c>X)s9=SmL$9BQ%@+cJ&?Okh{
zt7t!2z2GY8@LlD2N|sdA3An?cwYfCo4r?%DZtDsxx$3Qh7(qd!%F&8=7vW_>Zk__K
z6sHH{l_xC=R}HU^|Bt6B3*(}Xz`g3hHy;sj5)-?7qC*rJ3r9ZXHKq+BkXU&`y>i0~
z7FNr+_K)5e-MpKVPq0fD-ukft!OI50p$(fFmm1^HEoH-Ctrcpo68()HxXH&R;X3sh
z1CNn5xbg7x7>BzAYCn#Pk2gn-Na1n53ZUL|_`j_9M{*^E0w7)TV){&T^w%9uwjPq(
z^kekjfuZacC>FjpHkDs^me;<7ttXS9hzvtd$H-Hk9BZ8?MnywDVL$?%NL`zt6q9Ky
zM9g2{S3a<Ref$-+{wZ&FBh939$Cp%^-)z?&-_)&qaUF?%iqSUz(<|O*Kc36|82|~-
z&gFWCO4p4qML6JfO|)1ZHoyh?W^l_JXtKXmqqX8|`0(dxK({yi$NOtGF$(FY-N*O&
zd;h|m|NXAd&&J}wLOT(FNqBVq5^KKNn00)}5gM*bJ&MUxT!HT6-aE^q`ox7^#4L$s
zm^tzKawL;e7Y)EHC2LA`__=Q|>9__L4GE9KW(M%>xNM2onKTb&F=OSN^d%}}{g5-*
z;t^M3B*C}#KwbuN`?#KHZ!~vDIX8b6L4l~?1;1>YJqwW2@<TP46rjfBqpID|{7BaR
zxbh%gQ(lJ);0M8C1D)>x^r(bu3+xAM%MUV$;%n#5zJHvGhuJsabm-mZVmL5dq(w)t
z%_GY+ea~VhcNdP6ARbT*o&VZcMrtcw-H9@bj68X9T{R-4kwl^L-&D;aKy)Lv(#hDr
zhyVBd{^xW5&kHTQo!(j4RIfAPk9H)!MYPqS-22=$%7yQ-I>kQ&R7TB`B7<S)D!y-N
z`?E)!QGFm}sg;iBsgjibpTP;nZQf_j4k`Xz_HqzO!%_icYVavTH#DV=ZQ+4VX+2D<
zHb+ZV<2`d;i-=489p5YT{Ye@uo;~IwSz%*TH1-;BLKlhIt9Djyn8v=!qkG!h$WD0`
z!cLW}q}$p!CusL|pK)5IY_{)gFu-S=Vp_L7{eMj2hfN(jNzZ*IQ8~J(($_zTNi@g{
zlvy+;Yjz2v5;ys934??`AvfP&w>of!)Qr~%Yh<ikuJ|U|^ad(`;Lb0-2va6LoZa5b
z{GYeizy?|ix_5$;QfGhhE^WhM^O_I)#$QH}i)eUSpA!S(SrMIyhw5La-8~I3^Z+6q
zu$)y!rsOwi#7>Q|t^MUxbyU0-o?uIO^AStkAT|v>F88@}=*@$ehi@;}TPY{ft6hUN
z4z883>nYtjX~OLXQ?u^1x!4D9Ss&$3!Wy+)T(%_lB~}st7KQN#LkiS2&iJmHZUgHA
zboOxH*^il&bE-(M$m@keUP4;s{<&mW=<%R}cE)m2Ni!m71aNp#5PprA^tKj|2f_q&
zIg*mwPs-RIuJ5K_9DUIo_&gZgimdBUVg%VSH5aby<bUox)bDd9)Sn`XB;zj>_mQqX
zU)ucC&xH%7VT^S6#})VM>v29SVWa=h*iQ}bj{(<w>Z)z*-+Y^zvCg36tEVGNV|=bt
zlF?I=*l%uhwU6Z3PBhI_2KqxXaVs*LE1=N%EL3n3&s~0p=%PZJ7!Q)$oWBi#dnFKH
z!=VzMe=NtfR93b;fbj`<&TvdTew!2X5qwzbsi<57c~F}^lWbJK)AGJxJmWp{^e=;E
z{4zUrbvrQ*7q>f@fL@UdM=_O23;Ako6c)0FN99h$l40ZTTUejIeXtb(?L@lii|MvW
z-Tw1+FTZCw-fztQm@|G0;!ynk`489Q{@b=!2I`X|V555k-LOQ!;lg#kZlAuliMS&B
z!M!-II^!YSx`)i-tz@aJNm8`JXiDUy^X<jB&1}0^{T@d9gGD>0^snYUaH}##xA<J%
z=g6@q>c97=@@8g=du%k=^53;JX|Vw(+#6q?OD>Ex9}c4*9JC(Wod0eKo86-?o_qd=
zbMF%uJMR;C9ydVTBKIIuZe0mnlo9&)*cHm1`Vp$qz3t89(UYH@0au;PchCthH5^Da
z{~dL3Agr&;r9WRpoWG?*4)MG7<kL8g+*QsL_yn1f(=Sjn?4`#ncXG}Q5)Gz#Msj{W
zb`1N}v@gk0ZTzNdWrSD1{7$Tbl7+)m*@)E*_I`+hnXfQa|4U#y5#HSaSyEF%_kp6c
z$MJ5;DzB*F74DrI?9agB4YMI!+lAq0Qd?=%D%UShk8VkeX-{1FU6>dZe<A|<HYZ3J
z@2wN#lcaVE0@>3aaqe|Gh#D{;ZTD{(3Z*d8vr6n=cBLx{e{e8`gxLB9^3X&&d6H2h
zd30nJSasyDxduvtuMO{~%aTA*1Vp#ns#3eWo;n9G;Ny>6J((x}$>=sHtv?J_XcwOQ
zeF9%BcZ!U=Cxk_WJ~k3-^x}_3JaTu}^72n#F@I?o=L2#5uho~5bkZKq;+9rpXa2O0
z<;njQv!5fHW#y^z9xZX#?DdZsu%7R~{%UDA7oBtP_yy^EXQ*>t_lJA^O<@T*toBek
z10=kf+f3y>b&7yhExc``)wzDNCEOG8L0?NcT<!cBjc2SQaM?)^F)Y3=Fs0)j|Io($
zQH|IR+)8~oNrq$}T`lCPk8eIcT0bNK6;MOQ_bC4u7ZKsg)PH~{ZtmKgOm%q(+q8IG
z7a9xai*H`R@F-os>59a?EotnEGVb*WqJ`ANXaFH%QU@fwu_U?%`yGUfEwPUN@^qhz
zo`1<j(jQMbJL9g3pQTA#5*;KC_9o+mTSYfDpz-uTQY*~Q|6ZTC{(#t0or8rRLl0!-
zh=9FAcr>$l3afH%hA+n!)6K@6o5P?;e7F1(5P;c?a>W?dx`WI68ulOlv$sXJ$hxz@
zoF5o<4$o%a%ebz$Pi=~W!};FUiq`*6JK4b-J;}J2i#UFQ*29K2%D6VSnv8tPv3i-<
zzweAmqcouFzEiV`Zoi!|y1fw?61?4!QHQ?_L{&8|;=Np`d_pgpH5g}}liFIAYb)}u
z-V|>WD2dS>3-MTXDdX`OWckd^rr9bYJ5uoa@bC;pmahX2Gx>HKq<LRBDQ$=9-^poT
z95IVxc1tglOGoHna#^5n^4;a6CFR;lJtkaR96I3keU-%cWFWFMHe#KR%IOrJ&*w!^
z4>_m}A5?-6!V8#!W-ZIT*6OOLXpLQGsS<?qxJ-k>L%(s+UJX-!ld`>Hz#2}1l&0qW
z2ib*D0k*e<Jk^D%%9boS*T!G99lOZ_d-Z?CoR=#sRryOs9>jHUvUP0mBFEoYJ0b`G
zX1?1VV*B;p(9z|Sd43?<S>fx?@hM{3OEc4N)C`uo(mn;S4kVX0XUWNn#{q+#(`!M*
z^SVLK#%|8jg$GpU9>1)o!`E*EL+ZYAbXQPQn)n;-lxHes+DK{1J(8_b{^IUoYjoEr
zFH`?9RN2_&I0vr~?WQlNEcJ3DbQ~8p?v!SDdOAp9nD73K^B&z?$N*TGBTjXXqZ2FK
zKi)FhX46cri37V!y6?8$=tRW_KHpwq92GFfi?OQWTX$%%afYJQi@SNdX3hEpfpoLF
zTs5ONc~*-bc&8u!-g^#jqcIAk5X;fH&t29NJa2hm?3&h^JNkDViyFyg$4v?TaW@wn
zWzK-uaE|VOzek-oCUFQJX3IRGg%tYMVsc)bAAy#ZSKLg-6RUnpJ{SJW!|8K6Q919%
z<%8rH2kVE@AYEwe%E@gpdV}R3b2yEvs%B&NbpIYa?<az!y=~4BT_CSL|2!N7g{e3t
zo*&t?ZG0Z)6NkkhdUo9GV{^Ra?0Zg8gY9$(d+A9~*D-%Dx>%FL#u_4c4!UEym6b4M
z#rF{N6c92WS_i8)ZG$CAK}8O8If((XG0mbt-3+>mQk%H~!etK{OdM#%eo5yD3Cluz
zseYzOAGU2vJa{N@z~}_cQ-p^~srJwKg34UsAm>Nz79G|3P}xAkQhpkW8l-zEoIbA;
zHJr_qH!-9FN~j*Xivfe-I_VSl+kJw<Waa3pjI+T4(oUTvr}~Ht9i$4UG2K^1!Z~Y}
zWoy9WErf5n5cR#o?g})z)@Yw8=(Y{#Ei^G+4_&2ebLvBalDQ?D#9IDW`Kz_M&O5*G
zE5GVok6=&Vm?ZR6YT>N5I(rVd__C?fre#C`$OroP*_YOx{$w<m6V3S>V7nD|mzpT=
ztkm_7F{ycJvs!p;TAP#@@w4G>5C72>C^q3P&vSJyb3bpp$mxePxZvSz$9c_^OywfU
zG-4O^S=c%lq^P2b`TB>`)O^I4!xWx)-h504>Deys=Ud2cU*#hWRBwUL75_WXqD|N~
z*<By&=nHT_>VwQ5l}lZRd&;OWiFz=9(%YK7WpC<F3(|~+DVvp6l$*Uy;w&nMCAU8K
z973nG*{7?j5^v7aZ=3L0o_v{F5cfP}{M9cM#`z|>fr*S=eDhy}68ERJxoS@BcfIn(
zV)b)O&d^x+p##m5bCv)>nyL@`PTNIxzktsO`|uuYHyfA`_3~*P1AQ*xM%eALGwwh-
z?<HE}pLZ35my~kHN@MC>+HTqC`X}gLhj+ETad<$eqNOTYha7dS5>mG@g3Hc);;)WD
z70ld;WZfUI%@cPqkF=c1l|~6yBa$isl9!Tc?KlW6wrCm-c%gSiN<o>Md6hHYD8y-6
z_^?A7`_FRCA8}p|3duLFb&1F;p0o^>a8dXC;=oIF%8wV0hT66h-Yb)@Iax9~03K0d
z0~l_g4F`)ue>I6CLBAZX6c2>2y4u_iyF*6BFx#IFMH<DGylHue9bUeYzOkjlPGBDc
zRnwv9(QSUWD`}iMKKv2Wu3ghb1C*I3oPv6X&~vlO2Iie*qkPI^Q+J6VsqPM)#dEb-
z-))upNvDcuDF)uHDx+FANs&q<=!te&?x_75CP@~iVG_AO8kE$4R@LV5HCFiI&+7vc
z11P83Ij?xGL{Vpw=!Csp#K8|3^7WmaUB9u(_+c`J5vlU<g0|m^U5J<`a^jbQVk+@4
zOAIv-<ho{geC>Qi<Z|l4v?7Q}^IeMV9fs2}V)Ot(&o;PF!C4!zaAe+x;8SE^_v`6F
zG~C99oqXhOg(t0^z}H|y4akg>lYxYH$|mY{h;~ee&x()}Hz!^>?av_RppVP$oSuZ|
zZl~qu`7M4Wt23VG(Yjz%8=ve_3&tkAX-T<h)@cGSo3!~&KxEhBSSoo~8G>>mh_8*$
z_;3w8?~Us=xx~_WR`gz$A|xQoCsLs02AX5@Ai>>ndMaSmqzt_<FW1Y>yhWc&Rupbk
zF-RQD9od?e=Qpf8>8#s=m?ScSM?&Z{F7~yA=ewO3F#pV@ZlT!ZD>_h2STa#klWo@s
zZy+XB>J{&F08tu-<WlU8lskM~2Xp+=NiJmS`!LSE*=;p=(jlZhbA6iTlkwjwo~p&#
zUX0!c0SjtGS!&c8(v6=<8#`j7(U^fKmfF9p1%hCkB-Pi8$`vU>e_e;vD*|jY<0bLf
z9Fds+=>KiI5b6Ka*P&Ja<ttG}2$hBx`PtIdpP4lOlkJL{e*)F`ePDmJRG$eluT2PF
z_3pQJXQ>a=_^UEqRd5~OC1)_<s=~%wv6}k6ijP9U_d>>Zi`)^LC{`?X^n?{=f+k!u
z>(SUxt~?;B->?ak)SWw2nPU9S+fqH{a&c<<1#$>1O7yBMhV(?T;t0d#Mby+mqs6aQ
zqa!C~eUTE4`(VTeZsv4>=v`pkjZAi-e>cT`8S!b8Ktu8?sd}|JPx;>!=v=)X(s{jI
zyG=8c-Qu9}UT05jdlW@`6qkpCWLo!S@bPCCk8diz423LN1lVnK<`q!7zIE$Vw+O3^
zFnZmoSc>P|3?jPWX~*B{#Dfc#*BdVdsV9GVUA+Tbk3B>jyWDkSW8?gmT~`$ml_|55
zak@C}ZoBO8LIN)sV<ZwOky0C&NoF%zauK!~vLjCZlzHCqXl|lKdHT5ZU&MHHaKnjt
zkG$V;8bH2JpDb{um6@rU+-!Ts92D&?_L8FY4H<%hc2;K>O1+iwI&|Z+!hMpQrjtle
zm2Y{%Ja6K$A1^25P=pN;^ghE=mhe+c)Rh@VaA>`|8*L9{-i}xOr8XtEY5f{&rk!r6
zFF?=u_j30zJ?IawH4&TZaeevGl*p@}H&{&t-=GHukB|$F0tQgYCI@)(`1l(X8zs=E
zBy~V)TX5Kl%V$R8fAm`@6PvnF(LRcA8EoFjt26!%C@0<1O*t7FnwPnjiZ0G$z520v
z2^QC`s+ACy+vPZbrwtSs?$b@n0^vPH7bA%%-0n72hMNUz&0}@s#~9|}Nd@=KU8dXo
zBo+VZ-*TpEayB88JtAP>*wGTNz6vpsWbwVb^b}vsOT}!lF@+y~Q6#JMBFXR|><7Qq
zM@bc~`899+F1nzTTSXd=X~{UdD~x21R}NIATkhg`yjNlm_|E06I^*qXKMYUUQs2_a
zDzE|4o2Afnd`(x{E@#fI`e_{S(Zq*7P$hJY(~Frl>8UU9YudwuvZlEFN#JhlxdTT2
zwi;us_spGU=5%E*!u48HL2tR%G_or3cS{Wasyi4PH?lVa>5Sc~5BQXRzDx4$>3(jX
z&65CZb%?hFjlGNPPH?+D-5m7lZJre*j7i#p+-Ys}*c|Z|r@<Z5yW8#E5`n(;q!qe8
zJJ}q~7_`}hH4D|BBmS00kJ~Lqx4j?j&4fE4T1U_4mnr=1)BZllRlN?6T_QGrPFy^0
zs+YSaZA**caJZdraY^TNFQ0!}z-L~UImos;fBSBmsy=w?ogV)K>tXSB)mxjq#;<nf
zFr_imRl%`Vi*C3@Z%{+JfXx;xy;eTaZj&(m+6}xJ?hEE}+9dMs%Y93``@J_Mkd`i5
z24t3Bxl3Ki7o2f}TucdF-!9FdADdc=O6z~bBf4B0#M+rnvel#B4&_R!l2*?{h&5Lg
z<DSkdhB05ZY-)xScU%29e4elF9K8~SmKKkT{vyii3^j?XpGR8Df^?H;O6=S#1*)BS
zQ-FM1M^J&>K<#8!GX+i_^z*8}k%%ddajh3D*pUNi$KQU_{RKmEU~wuiweNhBYJX-q
zlJz<CAgdt-JH?SR&wKf9B*=#Z)XSa^O(}_~>!`rMCNY&rnvh1>_mo5)5^^{HuCz^1
zgYpGPk1;Msb;kumgeSd9CePO*h=14Q41uKQq{DIGOW`h~p*-7D8nyR-{DTSfYo_Kf
zt9bbz!^Z5P)wGlUT-?7_-Y7&=c+>mknXbUjI}UCaYu~zxq=DPI6Z1Q^w0S*E{Mmj?
z*&N3)3pst*3V&SJh6P;^gprHTwh2>b!vxg(OsBuw>epif9+<cIA_d!TauU`<G612&
z-s2uuW&WE*QBSMCLMk^2Ht_*?-Mq1{RusSIbz@d;LPBOEi$+;7G%5l74E$Yxr(ty-
z%N1s=$KA<vb=@KDebtm?fc&d&qj3C_?<Y;eBFJnlPnPRA-?rMu&sx}@8*Sbk7Y#RH
z9iCs@?1%IXW5TxnLt+9>VV|4OB9!=0{Nrec@3hO+DAVDmWx00^h&11}+E2o6KbN~|
zba!!^2JGkZ1Xtsg>Z{g#`sQbsv!_1q3ys2Wu=sp|18Y{4)@y~4l^Wxij?6!6x(~0j
z?B9yE&k(-7d}}lllibN{>gb>3-57sE0N39l*sK{i$bPLY6~;WI`%!(4*V(c+FzY2G
ze#Tlqkuf-D)V6zv+VGKAee<qhM!@;bF+>~*PnS9t=r%L!B`C#KZP$I;(Fxxy#b_O$
zYuoDOn!c}c*fiSLT<|R@3o?GM)-KX8TeT6|-=Eb<#$Uu3>mVe_XAda|M?#)O6D&m~
zcdP1O+W4oQ`0R;NJUSJGcVUfQrmAlh-`hreeAxyiw6M7=_}x4}=)({iX0UHgrF0#g
zT+vQ`Y*hHg=*&ZCY-{X~SF6+-Drt-bi7D=ka81DCkSw7I{vH=0q4NdS2-Qv3W4oR)
zdD)H_%k|j1KhM(!j;*XZyebPpxzIZcUw#b%cRNM-=xS59(#VEai<*3=u{!1qKN6Mn
z%W2el4UWK9Id0DC0mpt5yuilR36Iqo_G+soep@3fTc&V(t25X26CcmJ2BJ@sqZI`l
z9%yy?bI+lEl&5ao-K%hf8>HIc6y~r?SXk$6!~@P_A|H^i&aC`${yiD5X_V8-A+e%)
z3m+HttYZGv8OLo{ENpf@rP{|MGH3lxajq+qO-U^}gG!V1LPP7h!6Au^?F(Z!wdGw#
z|Cpz*mt9c=%Vjm8qg*j_!8l?_zjJ#04cZ~8yQAnQ+W_K`wxV0-*Z<M=7Cvp3gPTBL
zGv!>f`@5%UofMN82POSITK^u(i<GQw5CquzzNl5pjc!i8pFTll9V~7!BnsJzd58h7
zC~nX{qZ12`IN3<U&OnkWii@}<4y^5*t}2fS>ePPi5cM_vFn;9D_hXyEJ=#=MhGob}
zN=jO1T_Ssd@jejp`Vjjj*WQ>}p#cFBtM+Hdzr{;{j&*h7+9#YF<?|eq+-4J;-Bc^x
zy2f^?r6rV)Y;}q77-7#?OWB}g?u|C!7Zv<fiLJ>iq!TlB1$9r9bKQ&4EiBhlnU1G<
z+4!jLI?3Gsa4lcZnRNxO_k{t1$0g6eaMW>rPdcloi$*sal{e{VjavozeO8r$kGYU)
zsdiKEtFwN#uPg#W9n+bz6PpF&Ex+2&mxRUBhmdq<<3i$jQm5EE6uLv9Nk2oOc|1wp
zg2>Cxq679IT!-A_9gZIl$@<)~QPI4-*B(pLPgYBJN~4coG|lV0(=hdW!d_SZa*x0E
z?b1s2>gU|~wlQz!*tLlqWYuZPQhijvysvwL1fKak8~<GiwDYrO0|Pr?niQ?mDm5V5
zN_z$^*J3CSW45wWj2wP;(-&4Q{6~bAh0wUBNh%RwG$+T`8A|Na{HVoz1Y2(kSoHd2
zs0Z_r02Kp@@<_F)Bx?a)Vl~=f&ZNM4oj>WJ-Lc@9PU0L=nWG&MTX$OHM;p9eZm&-$
zyYg_kL+pWrSvlf=F|as<jZwgM4lmz+t5VGi;@|+rt?MS%V7!)T(tfCoa>_~+f%+Rj
z1A78~{SA4{HNw!yvsN{?$q&@9kN<W{m;C!PGLSNsOr<r23pDJjQAr78sK;Zm1VLSb
z##QqEJMj8m8%#O8ddaJ&?&LX|rgQ9=>)L8zpkVLgSdwMnv><&&x2~r1%5xPb;}HyN
zueIOi=A6D;JoN9wLiKsByLkBD5?oj;N}@d}tHs~Fe{K4hc5>ye7XYnj)(-Pcd>$|H
zhn~gYvY%Zb`ai@d7&h9jdTTJNE}1;MxDtvyzjpYi=?f-Aq&*I+Px_}B`N-Ve-Td6K
zxqNYWJ9!@tlW`tFL`tQ%pKiTwKYV{*>$*JWy5VxPv|kaIc#)e^X+*>BgpGn3K;X#D
zuhbXj8&1Lzj1|T2OM}}gjqyxHWluli2>tz1_IbqNvb4&*D#RV_yMX)33(V&aMZL+M
zDND5_rpO1QBaezt_&+LQJh*7XzP}tTSMz4WT%ILdRNM3vK8zTue?g6d@a8?+2Lf(<
z_4BRw28!qIiGPX2S8*|*ub91v8>|fD&9ZSr73oT1pfd-Z=+E>jjDVX)wTv#d!bbgX
zSu&?aO1%ZXglHdFa(!|mF(WO<F77m9+OKlw2p~$TjPEx-a|xswFO#z)Yr)qu5t<Zm
z<O08i-Us=*%6Z@3R0<&80{6Ay1TGkjT{7>A(qG>1k~?)Dcqj6np+|JGa~UnFE7N96
z?7KgE9hUESGb(*)Yipj@_U9aX{Z$9|?XF-E?)2^;cGYsdHC=V8tj7_Xs}3*JMz{2#
z5_r_C5zB##`Fvc^i4gMX6sD3-P#sOLxj9%@CWSxdi;wed{RQsWt23fw*KrL4fNIa)
zCqh>S17H%|JiYe@*C<xIceRD<_l|eT)m*i`NL2h^Er9(w&n#|8u}xLtGBR`)78hk-
z{fR@w!B4)Qyzqd~tpL_j@CxC)?)pobn@S?ug5hsJ>dxjYr^&v^CNVq&#{L1*waFi)
z@sK@|e-E`b1sLlam?wzP4--zeA3aCL<2CZ;@-!G|IeJ50yKjX<T&Ks5ONxC`7JI5-
zKL1A6zY&aTR#p&5qIF7drW38#M{9e-FSB;eUStRW64}<4k4pW~Z|=B%C$N<b{sHY-
zj3VIu0K`JeolvrUG7|0wO)KBmk!x?X2TSBR_P{q%6pY59RxiFf19G*bvdc@Pc|#Fu
zF&Y)^7yc(6)zqFO;4Y;2mO_`Xa7qnVA5jIZmoDj-b1SWwNL>XJiA=)9RG78@8le-1
z=N5A#CZ`m3l#F!HUc(-AtbPjz3jIUcsy>6m2vpLNZE=Kw5Ab`=CSib`+0%Liz2PV0
zZ}btp_ke=sFU&_xLk_6TksSkq=6|^6I^*edzOQ08kXT$JBGE>hER<R<o9<*P1ZNiM
zUe;78<Gr3^c66NgGKNH(+o<`BP)NOg^m=7$imq1tt3-x8!N8-@o;k@Xc}m*&c*<qC
ze`@~`#E6E^r4{&dmzctzrg=hF=l#3Ht<S}f7@@EbBdn|_)n$VMlL~PI0|HTqLjekz
z6YRhmM!=1bpT-POQAv!+Wms6IN@`KVW1@8cya}@5T@?Q(oVLh(-C6P$;_Z-^ejwIQ
zvD@5h&D$KUJ`N(0N_b`2xnSj6lus6OxMYEK0PIoh%FkP_sV8xBX%;^4(HVeaVh}0E
z>_s|L-_EQ;=ve*WX%|D_1V8bIlFRgrx?oT}p7_L;iJd@FKbLpjB2~v<<Yx!xa4*lU
zudGyJSYU#rq#QgGKhX2%wcExtXo3Qu^Ir1!m)2!+s}*@k6`r)e>fAfEHRF|0PI=TD
zqnAJkeq3z*K2OhN9G8ri0MNkx@{PG6r!tF1J?+t?yhf}#H&QO&wBuhv3p5-BeLMAs
z6J*CLdSZ$7C6XkT1oYg+@BsKXhST^~F53~HQq3dTKrn*7R1P8lgs3|m-85^;^ijop
z@nTNFMF1Ty_ZuytC@4VVCJ|Wb<&8PCuWC+@)FXS&KfN*;86kzi_G_i>wgF2sw#{_1
zQF{>&ncJm+iGQTd-UUZjy6ZkeCBve;HsAUb&-Ods@$s=4YCQ|FOtt^T);kAB8g*;m
z9h(!|>e#lOOl(^d+t$Q0vF(X%+qTV#@nxR#o_fz$=dJ#yyQ=H1uKQkV_g>ff?Q1#Q
z#v|E)0vuk_S0^s>q;dZ4qC0&bZ}DH+{;i3xc<&+=xtg>ktl83nD$dJy<g;SwS@S$m
zN+}?djDwr~pB#$%>Z53=^Qvr)&F4FJxjWzp_yTxX*bL~P`~?+qKF-K8Ib;Q08gA7w
z4w(Tqb3?niMTtJDT$o_$69b<#YK}Unvjt$8e?@j%hC75^HFXcjVEwZkj%-IZEnU^z
z3qvDHUik~rne){~>U*R^YZG*%H)KUX`~L_fRVO*hx2ZMpR6Z}P)(uCxNiHVR&rhi+
za574PgQqk}RoJFW`6J>%aGFZ7!)ekDzX}7F-YO4ns~i`WMK%Z;*k;?=JpQ(lz_**b
zHnn<HNNll?BYUaa0M+D68Wa8O7$iPdjL$k_azDU^+yeI8g)dW2&?GJwuhbWJ+P1!p
zk-J>LF4FM4@rZjZIF%t?Vu7omt3^d7O%bjiV(0kw=`AN^r9Vy3W!_s+r@QfSd#Zp9
z%KGu4bG|=M7#DYB8mZ@bvqxtR!o!Ix-BSNO+GZ8`l9m6HM^=VJ_|=7;ZO*#}GW>)K
zO~sr3Y?!Fs6%`eDp?dRmAA`z19H(Hv=ZHa&H7CUf+by$Ug57TJU`s`5Xu^(=PqqDk
zxzs6;H&km=lWA26G%F`tA-eiZPcz}yMIbFW049%yxIds_NA*B-nGn<KV{yFHihcJ!
z1<R~eaJ5d&GKzvZ(JE`abFcn9C+UM#0*{Oa;*~+i*dXUUZa3G2SXIZuvvC9;RgM?e
zQ|dP0%zuH?<H3vnp(mH(RcO&u`i!wKk58CQJv2+d^On~J!1>3re@8<3MOPefG^gAP
z6c%SXd8zr@*4<@)cWPAG?_n%RbT?60xZE)JEt{jk>UR97q6sv7aYp)S*4BUP_Urx4
z$?{^V2<@hQA1%mmnTUYA(FP8%%mRE=&0Av4-foo~{)=xIY#=lKE2GnEg^1wbVNMPG
zeM31Fsn3PO<CP0|uTo#Gg(K%xpvY2?Y)3DYjSI%JxRHI~wC7F`CjIawN?Lrg?j91&
zXfX%}Z`=c^?H^BSPC(U@>UdZU&E^rP0f}As<l%q(W*wvKcd(Xx^i?WHGr<tGI|(QY
zweXub!+O34#VJ}JoL!}=W<xH2B@S1>+)2s<k~5}n`)j|K#AKC(>T#24lJ0qY`#|e<
zF09_6@HMl{SySD$FM_teOhSQUoJ`oFU%#l-=NL6ZE!fKFymYLzDba?orWp>8Z~G4A
zlp~WvA!`D|hbC1~{gLXuY^K?S;Wdd6$Pw@_=hP%D8!@n{=PV)AY7XBbS$3_$<b0^#
zQ9RGcQpJ85X))8NywlE2>#n@PJiye45|3wkzmCCUjmXo%pNu^|iwwlG7X_1ynxjix
z=OIL`);yUM6mxt+tSZgDWG$cl<K@ge2~VSmxFIdq^AR{@llHz-p6-j_byPi?RY%x1
z$#B*&q;9g1I4c&N!OSc?BmoZ%=x=^XUBc9IYI^%aHwB{d@jhw|!=nFsKQ(2%`Eggj
z75=Ih`6#P@`^Jrq$vWJm-C=&h;W2ku^>#Ohx%Ivm%;$ccK}m3_T=%z%?UY_CZcp>%
z<oRHQ<uW%+!tGi#Y^ciT<_rRXLwrODV=Ted#+Ee~b+HqV=)~)DbIE;A$tg+h2gB!^
zR#-t7QWi~OI}d!v!{iBHFyBwQReL3JAlK-hRrR<~o)j>EH+T&8;I@Qtm?Loyty}8v
zC1=b=2{)V-s_U;AOmSKqT%#eg;UKc}J!m3pKMP-IO6_nKdgN_Q@Qa*8E(apOWN!;E
zD3q$CrFpbCI7~LE$p%h56&7QxD9tFC!vbDBN{pNSpU|_4fX~_ghLO`Z<LLfj&qii<
zjhXPi!4z=RQU=mV2gFNNL4}n`B$qqloq~TJYDOKANqN0B29cB-S{X?XWGH8wKS;S0
zYK;B3BIFwQB0B?`-Y0$w>?DL3OZ1SrdM0Dtp)H*#`E2{v5`iH?>JsHjgd~wMy68N|
z90UgX6VV%0IzJR9Q*dwl@>8aAwM)H@QL9rFo|n&croY=ZO5Acg{x4oVgI26wRIQBD
z?0<9KvIZVdn!kRm=V-^p596Um^Mz}TS!Of?3-aw@*S~o`dbA&q6BnZ$p)?k}nfpR(
zd~{{uGEje5rZ;p$P9cjp$nTVIEn5N3cHWv?!8={unyy6PeB}&xYCo19Apd9;Tk_9)
zy%lof7oY7xg%j-Uf=S!N>iVgn!}`zM%_xxM|5T?mg-iHlxSiai?ra97KOvypmYCOS
zb>fxsM7ipBm+~=Zi<m7VOn@y>$IsQ#f(8ih+S)zni48v8^B`$Qs7(y4KJQ2DO7R=c
zTi0KkX+QEqcydr%+UkQ-x2;Q+8@yra#)cSfEN9h=yNGXR9X~9zSCi95e!ehoRcMOR
zEeh2=_<lDKI6DUl_>F||p>Zs5wozqIPrdFK3Gsl`{)m`w>~`3SCuVGhK2+|;@xsR`
z4IbxGa_Vp)Vfg1=)j~bRJY+aqsgs`PE%wtzuL8K7L?KPFVS0gUFB4ZNYcbB)Ww;UD
z5&9&Dd$nU*>3dXkf915HU#p(*r9`9K^cg=OP$VVc-`#iKj)y1)IylQ5NY(MYBp3gu
zNOkEGL2n;N-?vNtGw8%*PD}ayg+HLpC*u-@@P|GI=<9U+MqHa3XU=XBi9}<)6=nyI
z-lNV}8OaQ+4w%8@C!bBTm2IYKPT;swK3P^{_lC#33ro_22B`9o-(gj~2DRI<u<&dz
zbh)s1Qkj^C{53dv^2A^YX*(xQ@Qq{gLuH>AtE!hSnowu12sF(U?keZB=NnsHuy6})
zZQbygxQhMy1UVA`YBa}3CJXMa2udZTtjFW{Rh|l4FW0Sy=a?$?sX7syZk8Ybx{L<g
zh7R4%9$$VyZ4W=WzesMZUGX_h0r%YRMg+E+Unb3)*lnEdvF_ha(eqFJ((CrixeU^a
zp7cLtAOK#s>4}5k_FaFk>&6a`m3+^aFe$g*ZxLMxA;ucUXxIf9ZM0_A7`Fb--lkJ2
zx>&syKkC094`H7^G>qL=T;IRl+Hl>jEK#d(VE@^hYtTe&NK(z^8l6{)lPR9e5CD!t
zFT<g7(03k`Vs`SHsZ#<qv%dP{WHBk)vHfLE8j4<3Q*wd`<&x+~ek5jv+4$Ywl(%5G
zpIOv48r>Dqsc^`%@lhRcfC3t|RvFnhG1>|NloHP%<Kq5DyrI9RFpMgcQ82&(VJ8tR
zX}=}I%zl@S=(8DIfK72>hDg~Yd)>viMi`y!Qk|s}|Dfbc<i{$zW==&~qu9;*F<EI4
zNycIssq6@@19Q3X@c+XsV;iW_zN+X(Cl*)K%#y5Cy~ouYAgsPi(;I=t<of%cqA|(5
zgSYqJ`X+mR{B)G)r!_anl7TSlm1cH;z0g|Ak8UN9`rm}L(qnE1P8E%t<bqG>M}dms
zE?K$O|G>0&Q!oBpJ~TZOjGPUp5ZU;IopFUUrVCR8c*>>YX~rvwfNa*JA;920$f`Yu
zDh?u5Rz><xrDaNojZjA)C=h=W<3o5gOV=KwsU-f0tH{nN$67bX1Gs_HyC2$ueBWaQ
z2<2K|4E9AhUbmh_k&)(;mR-HIbegCrm(?fa3>AiWIr-iq%9XOzG7ZJ6)vQ+L8Fu>$
z%~R09vh`7+)m*f%<`Gl@rUTC=!rsgC2Cy}|NuviyNAw>(u7^Rp^`=AS(o9q9C^xGM
z;K_|$DFuAb@-7z`QqqOvpmwX{;b(8qMCfFy^j^pJ351odZ13p!T~jih)NEgk{6GS1
zIS>t4TOM|;Q@8TbhH^j%!H6^%t=B;WcI)q7gwVb=oV6xuz77(H+HGfzDm7(gM@5-b
zKE#fbq!-n>f(<@fO`2|BM+7%u#Yva+3tbP~)%+LU2FDX)F-fXA@^#yx0BX860`(hO
z^kq4+%{@Pz-8;Iz=A(W%Ne!B3ClgS=hIPLFTF9Y=f5|cg-1s?0`0d>{8K}%cos84H
zk1D&4{p(?oGdPiZqRaT<@7Z0<#PL7+og%}wl#;fTGX&%(UFe)V`NGwe%XEZwIna)8
zSL4YI=_9~GtJ0e0&j$|NHI5{s(y&XR8#mMMNi8nP0{UrxEJ+;uAuL&P0~pg2;m;NW
zy;)W?36jr(Gf9@L@h;fGYX00hc7r9rh5qYIbtc4X>>!461*?Uxtk6e8?_2x2oof!V
zm&7Ay*ajp3j(bq3q?HM7{|U#h541ca7Q`wJ3l(9lELL-07;fk%$$vvi76}$}+g`Vc
zzfNA9IlI1GfuBj~t-Va#Iw&0egYN=~$gDc~KOiO(Uy)q6uf=uWpuC$~(~rOC#GpgC
z&y`xp>eO&Z1WZ0oB!`K4!SOH0GbzbA-?hqJIVM)cp>BgI!v!_D?0?v=!%bi}mK<*k
zfOwPO>G3l4Ic%FR^lE!(+*FpVe?H5#IceD~e86l1k@fB9y85X%M4Q-}g%gKW=ga@^
za_W?u&1qG0B#ey*(Smule#;ewJsk-QuuoqmB{{=d_75q>WPpxn7F*)^^Rd(()mAtC
zO8UfH)j<geFRU=AjBA&7Wc+vSCA`nA>kzmWVT!bguOBrNCiW9?zAjbQn{7o|tbu}5
z?)85%%IJU8h^_xOy8Oh^6O^BZ#@Y<2V4opSPRtvP`IPGx99HdGRAz>IBzP62x3OIw
zvL1z*LEyc%hG~5r9BUCT6ovbB?T>Pgk}nXN-r);WuF@$wBPit_ewki|cme9~2l27(
zWSSo{x?-qxgk5AC-+4XV3&C5EN_c#`?}YX9_8$qLZx{8sxldny!`V%ur8MDW_ls>&
z`s$ekHmBF#utmd9pD(jrv{~U+iaitd)eP0VgZ1M~d5QSg4L&F^Za!vT8YH^PX*A=l
z2~@wf5T6su*i<!~(M&O`aUAQ}_$gHSelp?f-V!x-eJW^dbeT?J3Yl1t{>Yc>&+r4<
z=@5C;T!{M8)#+;xeBJZV#?X{(6IuAGi-Md0GEQVPvTi6b%u(ty-iY={xW@2^v(zVr
z&NBi}y`ZBZQe(_bd59bFA%|r=TO+%?F_U&4{9+Cx`xdyX6HpXPaQx{Z%vV#oFc!gL
zJptd}><H>eqV<?$EQsgbyM%F;ZoRHe<<~b0!@5DZem&Sio-W-%97Z}&*X-vj;UNMf
z`kb!=A9FX8$r>+IYM5NaXK&OZs{|&9LqLU{nWNhB(=LMCd24-wqg8QhC087^A^8C!
z7L3ZE_rSzvkVHs9X%XRru2nmP&NslB%k@<hRM<z5P4j%!8Sj`z=H@pmC#&+a5|5|@
zgrl=&-UgIq>?V$m=$0e+$q>@t?a*eJUsGw~cLE>YqlgaQw14b@js)3K-dd-2RQ~jx
z?>{;$U+;M|p6RCW^Efkn)5wG1LBLt<hL0^rW*K<bCzXt2zGWb~iMwWEWtHMy4Sa>)
z@L0k>X0l_9ix^5FRj?8HbAKKPv6N$ldHD%Ro&d+Ns<5*%g#t8?1L{c$GTjjHF2k&G
z7|FpHy%?>!x91O4Fc{dCRpoHDyZl`N1M*`r2n2BAc4{LyksZnown47HA(WkMv4I;6
z;;o~v$rh5m*6(6{G=Yy14n{Q@F7i+%e9WPowp)Dieuw-SZ_Kn$wb==Pu!|lv<>&kZ
zYkID4t1fB;iW=Zh?dM8%DBVW4-J)7i_1EQoO1t6|`dmfAuUfd)t&gysd+#HDm^UD8
zF)mq~yEV?|(<q$lQ*FK3;BLDM{kdU$vnZE@AE?qok%MRN7sgyV$&~nccNYJZ_a!Wx
zaf+>Sv<srXAEfp<FpbVC;kIMbRV^rn=<e6Rr6PMPx}#wXJWE^a^%}erHp!|DgnE=`
zhTTg}XT6BN7z}LZT=x$|jmO-V&-1S{xM&MYzQs0DR~^Wx(76!MxiVKdLZZkZ5Guae
zCD0gXO0{s2fq~&UB!OsRf+z)2NMuRV!ji%`EBAVC94i~CukY~)mgy@ac6mvB3Rz)c
z8<}2Hd{-@3T#w_KJU(9&A^)NT%hc}p*i1lDkug5mpotUqZVCe&u6`0`g*mZJ_8U7K
z4f4VHX_FS#YP2GylQ1%XkJ;}A_*R-|=WH#~ZH>(uB4@xXZh?Oq+`rnNt>fsqF|3ZV
zLbB6>m#W8Wy$X!NR`Wxe?DhpsZ?a)&?)Tgtd2t|qs8eZ>ympLFiQj6#x-#b=OXMqB
zdC;|r(aws)orT9J*D~-H8wkW*d@x?@f|f{1F@?Oy$b{ZviM@u*%5NsEL!t?)ka;w)
z^W(?Oy{pv{ycnTG=oiVAH6cjMCgXR+sa?!xaes|lk}9bplnE?r*&}pF#sf(5FzXWL
zcLY&|=G;QMIr03`Cd<=DA$7!=bj6qBY5SV%L1y}^`EJbv0Yu}g0Yp|{mhFngW0?OD
z$*nC_vi)lX5&uh_aaUR2-gTR|BKM{fd+wx$aoU&f7)!PU>GljZnRi})5loLWl?58B
zCbV`Obo?->``EJ`tI<<32EyY--SAB>U{<l`farzTW*hg}zB6=q?i^5K?ZasWl^@ky
za`cx21b1V}8I0U{B-z3{{NWX%Fa0A;ydMxIBfSWuHwk{e?ygekD6x&;Qf$ZMLf`x2
zZ6}9wg}HdeRX_qX3=g#6OXyhaGy*GIVo=~cp{sc#v*?MW*J<q(NB%T0Ddv)KCzT8N
zpL(yi-<2X-hWG<bRKUFWxsf)QZ_e%A>yS<_pQM>c(3)dNTV4+O5B8|e!e)A&>X3OA
z9dTb>clv)=NMMEA_HJ#)7l?53q8bzQgu0_ezz2XnDP!HSr*Q40k~bGZ0IHRi+291a
zg05IVh%9*Zu)`5IYfJ(7y9`Db>^hi_7<|OwAb{8&cS9U;SN~`tK8!8fo>XBJZd|c0
zkDqM2xFlL;7br|HiJqjxD1g!1nky(9S!Ol4asjBmv%~EL`|H_4oXzfxrE3#L8w-CC
zEn4;u<tZGr*4SPd<CzI`v>YXpXVA@MBPyu88GDLOya?m7n;j1ax>hy80xVoeei+QL
zGZoYaJkocZy$rKgbYkISI8v(Uz>!8&3=};m;F~=YH>8k!oF~MYpO8vziEoJJef|QL
zp1<W4X*w8S6tTQZxarLO-dY9cuLeNP-HmHK6M&COzjIa@t{N#U^jkHWrH0dz12!?U
z=19B1V!+S@kp<el4NE3%Ja3R!jaHxS0Ku59EzGC~4c-n4V_QX1YOqKyoEE+3f&{xX
z)q`yO;?N<J(H`17y7xT|<HV-T_{w^CHPrlPV0nmFkGXpu4$EeMu$5gs>g=eATCM1V
zAKjnyaopZ<{k6dFNZxgTSSfc8Hsw=WBeX+vQV&`LN}$StpfUB9Mn8$IdQZ!BWfiyT
zyh3GIjfmN-H@DvzSpe<<Ta95Ec`hgg6M>Z;%7{AJH+%^xd?n?+N*w+l9rT$2?NHyi
zOMcX?u6f6&JRFOR$S2Tz@!M{zV=$xd?PW#YbIJIvaVbYPBRrhR==j%+b8bv74`90S
zs~TP6W3WEUU#i+Ea6JZ0RD`O9$26ZL!&iWJWVHzBmcz~8$64g0j+l@pB7bT#kb4iC
z?GSIlYM^`Kx|iA+<!~!fr32j6N^C&IKpbKxT|iNo5Rv5OU;Rk~0FMl8CE|N#f>+$>
zrY^t`n&|66`O(n8xa9lvgTI2g=7Pgw{mWw42ENyckhB&jn(w7iWEbQuw>Pi!_;>h%
z0I3nhW@;!kE-}S3%sCPzqP{+xgV#_#ZmawDHDR+7$daHeevBMGqZ^kpt3PD=q5&b?
zk)8(cvS8h2-}SqVgXPmR)^=#_UtiK6L!syvOZ%un=H%0^SX(HqXa$RK26{nE0)VqE
zA+5g3=OnzISgMXt=A2i-W*P@>LN0$dBC;bz1PiB|J`lh)iwW$G{TYoM&3WwLvLSTC
z08D(F0>lkE#?<BUNtoZmjyM<In&GN}_k}-Yr)Xz*rj9T)DB{M=p0&f+07Dni5^N%+
z;j?o4J$qGI%!v)W56DmS2ZVgOI=iQ1ANa<eiMuDw0A_+JJ4uFbwb-NEc;M2?r*^gj
zL)$|ZNtOl|p%Mgxw@XY%x@6WM-GzjU<Dx&{7tckw0?MJhlN51fZ;Ol%Br~32vgav0
zjH=No2nFC>1lO;qFnkCXCA)ULXM=r1W;g<Kh+u6^fyR33r2M=e%R#U_yv#VjHNzd|
zeyW&9AS=|@TyK;<k(mv|l|lf~qYx!z1ZFPkUM;|XU*?Gp$x(op3$5Ii(T5GzV~;A_
z96bo0)=JJc%A8UV^QXRYztO)`@@V6fNgK@TB><*W!{3BDj7@gj^nos$8!yrCJ3$}E
zNaY^elvi&<JGDuQGl$35=%@C%^wNE~+)+qyo8nYiFy#<t{5&B{OK~@-VPXChMKrgo
zXU<C=sW6H-|5P*K$m9r4?NSSb%*Tgw9uzb$V09W4`|iu0FvNUa53(12gCrCmvFxm(
zDb0mZD_O4Y;8-0gBVelH04{grWUl6DiUUwIkr9`(|HCW4ZGV1<n|TaNP*}?gur?R5
zfBSxeEp-i@t84o_?g*$sD6SMjWk4bD4?bm#YNXlAS38DH0z75FyY7Q>H{+uF#3S$c
z#w->DQbUp%;{IB>r=SU7j#nSG)TcX_k-S_e3L<$PYVii32|leWkNhsSRKTp_Rqt=0
zuqLMkPlXvyGLFUw7~u3;aj+G`{#orC)H<^JbqZ@4)9`~byb{!3<Ybv2iXp^!NAq35
zZeZJi9a19aJ1Sz9pdo|zCP5V~ns}H5X){>dPwfeGulZ#^X!SCGV@_w>uJQgr#&#Tp
zERi=Cz_lY}+MqFZmM{D)FK-=Q6Dy!b0Itn!p;eSAr8-zHF;U3HRBmw6Xk7=sskaFK
z#S{jxO2D8X^5A<u0fEz*7Ld}1qnIMJ3IhCq3bPs4h=nEic&L0!aUO87kjVShb_^Q}
z=rj_I5%?TTrtuf90M~zz@Pj%BVt7>=f|LJd!X+?uKOogn0qv%SaP17_%60$it;;o4
zGue9#=Sj<Oj4Q5H#OO`|xn{6ru7SJNOLriCL=<)>@q+*W5lQq1&Fjc04w&Es=;i@u
z-VUSV)LDE>P!0UybS>|9t{=w0u*k<wa;TM$%8EP*j=QVHXvOr7^LGT}5g6U61P-BO
z0n~=^(!JpI{FKqD0`-5Ve){Y2rY|rqut}6`-?(*nNF-!KR?o-Ck0rt25A`N&2$dlV
z%D`+@Qfu6lg^gNqEk=0X*tf%M{4d@`;Axe4UkrYue|&s<Zs&|1H-t2_$HerLGgLDC
zi9V!0aTBUIhC2Qm<_NX@KHgXJvaqip*3B*fYsWP{+5|vq>}$%s6mg?5*E|_5DUrna
zJ3K%a*{s-prHi3GfRI7Z+N>V6IGOtYAL^)xJ9&h7-yJGibW13%SrE$LlQ-QDxBx^D
zPgV#ICf&+|wc%n~O8xX)mYAz{6^rZt%>oP{j#_jI&#lrRqh;-Lr9B|!QUPcW=6(uO
zWT!#_>VX#rpsHx<MPR_MSN6cKZ_8ozy;dzGp(R2gbcSt+xwe&B?o1*rat2{lN#Ztf
z;x<XKzvXie&#OMwfZxS-BR}MaqeX?2KN2&dnkz(__-pK*WayAWAs{SR0SMwrmD`qJ
zDtS8nd?Djb;XBByglZ(tmzH7UPBD+e#~ac?xIZ`v*Pa-}XBZvpuvm~}`Wzl4Y*goc
z@NO9)t!qyi!QXVX1Hs81zbh`XBgI;eDM7k_yxRAZNp^w&K3t1*bP0tbaK9XaDN&m^
zHAW1{!`Q*7!G&~*Y-Ro}t)wJF%~jjqYT0rT<iQQ5A5m;xVB-aL#?5TfVE~g2oxZOm
zw*hXOJu-be=BDltxBKPpl<?{N14jsnyn9QL8k^A<2nm5vbRMefezVmmoy?K{)=qQa
zk3<Cqv85kkVX=I;%(>0JxV085a-!<_Lk7#=0YO<C0eCu8Okyoboc_W&#$$P*$mOhk
z-6ZC7!%8`kH9TUp;$}=iE1U9T+h;HW3Qr!rOAx5i&Uk3o8cf~`y!O!bv_A#_=KC2U
z8M(XVN_Lp0<z|ei55Pnvi`1b;aGyF7{GNlol02qd77GBa_?O$R1MAYd1-V*zN?j!R
zpHJ)fjs0^OvO9H(y<`q1H_|^Yp<^6H*G}l28le)0#>d|6_urH=Z$^!RHTy`u)<<CE
za$+<!*8pf)0()t$mEDbpYW<R;v}?S@yM=%{n*EG`u$bm|S|VIZY>uiP@^(J4)XFG!
zJ+~Jp3KM30&M1VmkXeh%!z-QK=1c}elym<Z6){#fu27W|gS99a{8{NUSC)Eaz88%?
z$YHt)w>tGGUN$n<IHl>-6>bm(fb_hKWdueGjpPMUaddl9aBU!4oc8*--go1p?RoHx
z9jDp~LVDXFuXq=wMA!aLaUu_f1n7$WoP!(?X;2_FC&Cj=2>=r+4z&G&1TZaMlb=gt
ze^Kvm)m-q3DfS%#fI3K4e?~m4*$3&677q3exA6*4B*&+=%n@DrCxfhHIIIkTmXH^_
zoM7<6>FF30mg_0h@aEccVU3gb73PpH*0PSthaGj&a6?{)+CGlr!4ioocb4@5Zf^<a
zTPk5F_wM0l%0<wV!V9{%zA3zrA=>Js8r?U1*!j3+LGcBzk<5SbL8Y|&hy{Nc_JPO=
z3jZkf@L_iAVys*V4&XAz3y~%XR82E9sEy*|h<+4$;4iQoFzWx^1Apk%Cg*nUeIg%G
zb!kJL4-M;HLDgxM#R0BmW@7-ge}L17ZXCTfusq5rKKM3jf~Iv^yE|h(9_4%h6RvE0
z?7*2VVagNjCUUOuQYSMWp+?fc9H2@Y|E?c(PGPQJ+5L8S!vc_xDKEaJ2-?aX+<yp<
zsH1JAGm7`?2o#wYg&STMOs&l$^WOMVA5ii%f7kB?y>~LMj%d8U;C-(8{!Lj_tRCQ|
z<Mx-ibc>;ssPeX~@YLjTRhoV=>()E`1g!@iJ~wZ33BBZ08YviSRzvvtzA&y&_f6Ap
z(GgoF3^5lcnGRlG2D%um08J#lOcfWpI1shQ4I*fjIT)NkZCWiaja5TMhdXF}A0vf^
z(?k`3=wPOp$8woqr#4N4d#@eDCx<<~GSiVY`Ing46A>{aPU^`5+3vDuHXngtuHjZf
z0pnZ+FGK5URO0$k#Qjo^Oog}>ZDXw`Kzw3Ej@iu}<fOD{i;Jn9zcvgkPICpv7DeR@
zK)rw8B}C(fysuIMJ}+^jDI1g&1+?#R(gQu_II8XKBwlB(7HUBxwyP<U^>a_>7{|rp
z0t^po3y=hX`HNyyb5!6bk?q_aXxRP?3*B9jsBL7?^N{G0!w1Z3yg&>xbjw`zx<atC
zts~m*YZ;@m0_eMc)*{eR^g68;=(9|JZP1|6($1FfGR1tg^%anS7C;=vT!$`DS{yGd
zE-)rGykDaz!iKNUgC?fS#t6t#WBKBD=%<HR8U@YHVu0&2)4qP|X|+SfAW3`7ngVW!
zE8k-M-CLTTLKPoy2tGA5eYPRoKsu*|637aCgf(gSCftT(fOxO3X}#$;cadn;rRvo9
z*ph2))=;EAB6E{ie`_{1T{|16Z+Xd*m9hrtGA5rKq-~Zfza$Usd3-xb3$dvnbj~NV
z1ho1|Ff4VFF=VtuynU%FpqS{*c;|XlL31h)_|lX-1FH*4a(>7<aF$IuK_vfup$l-K
zlunnAv|D&bKdPrdxjrC!wbz|j1C>}^D+kfGF6-tL5$<zv2}L#X>{|jol?BxvU06}6
zTotSjX;y^Y5`s=S6Sz5#VZ``>FvS~$2-RrZSBP;rO5B_bXwGd5y4h+C&BKf;C`Y&j
zxIjQ}+b(Gw9izG<i7SZkYdRrLTI;hvzv^!N>4%dcRm2G)f5qKOR4O*;fo)fLeZ1A8
z^6!<T)d_N@%jt<Y69f#ppYG`_LvsQozG-_P$qOP$);A|?aaSIggSs9c%pPVa6AIZ9
z=SA*pV53_$rzt*Srf-01vxRl~55c~E?SR>iK4*x3qu8A0r}0Xc6T5}le%svk@MrJz
zTuRyN*Vm}WcIdqhb<)oadE6Sx0v*>3ECz*VjO%U?CK>qcK!koIBX^&ncBTGPoE+f3
z+8A6NjDq&%2kJX9vl70<hO+f>JVDaP4~BcD?k~ocx||g$|BcZFjm+bTQaxj+QF`8@
zN_c@6Yzt*AR-+D8J1Y#y+8_XB9j>JJxgEp61cN2~##Kn>RN8?A=Tmeq+XAnPzWyX1
zB=BnsA6pH77iuuJD%@W_V+VL63++N5xtLfj^N1FGNd_GK?#12Z>yqj^lxPk1ixb)z
ziTFK-IiS?6F#|gzouo!l`|m$#EM7MpX2S5}P#dFfie#Xe1utMNB;_{dOH)egg;X#l
zhiOf(9V|*oA^RMC{UGGq#%HHXP*Lk^l!zKDZI$f=jo$ihvw$s}L3LO}{}I{=!~aV`
z-pCWt)JAaklepFMo#JA<L*F3OSCD!#@m5*UQDZH!e#5)4W$K~ZvW#p#aewe;6jsqS
zX~_bXyR-SjOWB!B0R5tG`8ric4MPJ{+8&5M(jv?qYxXiOrbRn*8|P-%yFQ@{r;@Rk
zO!_-6q+%aj$;xo8E`U77dI2M^XAvKZkI*{B$Q+He>Nhj04dkMpO=g+si^slP_g;{L
zL3S?Bm+)YZ65F3Ui<mels23fBFtwvj9S0fh2MIyh!zDxzhOpFQeLdzH?Tb<_(0w^K
zToP!n(GgeHgV2MYF4Tt%ouNWhVZRY}(DZ`|vmLb-=I>|*VhMPOw~oRbknj=H2y*)~
zrTdvmW%Kt8lE;w4{p3vsyk}@na)31t0Qw|E>3~YMdqEjxYg02z!&q8hWr(yf`9ZHR
zOX!el+zY|=lSl@xYqRoHV1l@$hoQ@$f9&bz`x}19zVfuA`<n5Ty(A`|U%H6?urY*B
zpX3;?yv;x`65~7FeY<~MX$e`48_2gPLZbmWD7w5vCUQK&iNRWUjh5a^ip~y1y|C|0
z?pApGsbL#Sij#en)<L3`W6tfDA;TIbDuPB~J$nFrqx5l~Dm49Se;e#WI`K<pJbJ61
zhKY!AC=q;=&*BeLs$IU~i<e3iQ%F0oZ|0-|s1Cujh`7cvxeU=cOlZL`Y!c>%)#aHI
zD0?%VpmsvPnE}q+ouxzF;xFiCN{AAV+bv5>bJ!z1@wwlQYHhLEz_Fg>IpMLR7&*ET
zNIxuYjSOHsp8+0<Doy>>Uz>QQO}jMm5EQfrjTvuKe~w^nwY{SttQ)LFy1}Zk?aXV%
zzQ>QRf>lWy#(?Zx-H3AtZIh8g_&p8(q@L@E9K}AypP^=_CLoixNEC>ol{!q5GW=mL
z=DH_qfq2KU^#{clW87GzXxoEBM?nH2KpjdJ7V1}^{v0jPE=r@o1<2`B8qKQI@Vg9a
zqm)hdmy~mx6e~hbnhM#q=_rQt;L#5zo|4VP<Ly!+^a7zS-jV01t6Q20og*{^`%+c?
zh0M1MM33J$1TwF4{)ovi8G%+IJx&m!YcZFcnMEMiibc0S1b(CzBG8;Yuemgt$Zi`H
z;dcL8IMHcUcT*a2#u*NN00DGHQq4)WD9<-!1V*j;XZ>Um`VR0{VXG<lQMoD(JGIA!
zk0IAHr{F(J^Z=i7j`lZFP6;AU)}|w5iLht6ZrR?#<(GYo<@avTlcgFHIC{2wpe+Ia
z8^je~DA!z1@}6QDKR1SMKTG-bt_klgRso=N@WP!e@=nUl4}kRm9=h;){Xjp?W#Ana
zUj?vd7|JWYUPfbFXujr9yDW7RQH?a$7p-3XjL8hB6&zpEa2M-uYMA|jC%(4*=tE^&
zxQ4NC;%<tc!W(d+Fz-$~yZb|C#p+`YFL2-&)6qBHS1R%7AyLR_;&%$f`eQXemSZ@t
z3al-QDpOl}42FUF5%*@ytP40m8Od8BEY9vNZy=oZO&$DPXdW<!uF{%o$BlMjXQjuz
zfsjhDT-=OC*{Y$8UeJRoD-8k$fT&6RbO?pV<h)C(9;sT6@`keM3vx4-JKeCY6@<zO
zu<OPUk&!c;vTXCcqP5{)iD;tSS@|--6#W;>jIduKVt!rC(!l`n3_>4;A*-ND_%qbj
z<zkn;m`PVJtrqsr$`khyOrHF7MV&i>HCH7Oc(CFOAx{NP@*SPIU%OJs$Kj`}Nq2O2
zK&Rh5%}wc6Qik9md}_S^gv_0k?+?ZxVZVlUQcwJGBFO#OSlg-WIIMsm(ZTQ1@JGJ~
zam9^F47v`*xe1Cty5a1FUD02iw2`5{#G<nQqq)eNa7+dtGWy-o;qI9C@T#dpa>LiX
zh`?Hm{WxJ{{|Hz!+j4FS7o#;oiF$(~`8%K>uygMP9nbOPJ&hZ#^Ha|;D&(|37uVHx
z@Z+;5z7?vzfyn(zL7rA8X83VufEVk1)2$Je1&Z3by%EQc4@`S>cM1c8P0VvrZ2u>g
z*<;S+JCse)S6AY_2NwzXPP?B3DPf-PX;>r3k|GI}t^U#A@BIhv3?E&ZEbTjr0B=|W
z+|4WwSs5J#6YXTKMh7$jw)+q3a@%euiGB8oETi)8`L`hH5|4#!Cj3~Z!P-!9Q+&wp
z{ECfvwv4R|7CA?ZvPrw|9fMmfPSs-_$Lemy;IX|XlqMMYX@TZM1i0b5Ea9c?0!*F&
z(oEB$^`T<{|8aYiC|*Tn?Vfl=;xRIziHu6^`^>}h120>X$F1;7pOJ|EJG9Q<@cOBR
zfpgJ{4p)F;G+M2o<+dJCRNhzOESp2Lweqd)LK!4f?#EI#(3d{^WnYB#pqVQ$Q{W;x
ziy29{m=JS{U!*bl<0oqe=KJX-y!gZ9F$;L2El5romXe>*JBUi$D@r~T^Q@-Xs893<
z*zg-h?JyWdp7m#gox<8M{HJ7M&o9+YFVeOxapx}RzQ83-#6nC*T^I;Dzb2|ZeCR8)
zhvO9LIF%a%A>-Q6|2$5O<_!{zd%CX&`z1|de5nlop7H<V?QISWTxg?4kC9XquRBTY
z*K9lVuWydg)`gS*(cTxr#O0~aEdEZr|M--8j|K;I!k1&>!=oMeQ;gQ}mz<JU>ydWF
z&lG{r)T-|2CLe8tgy@WzeWZFAO}8_}1LrQ)im<F;$v0+O<;#r{Ga0%SEogpdsv6zp
z+Nfh5VruJT3W}Xe#wgluj}gZ!YM+BxROOVy&TFs1vvQ#HlUIN+*2y=X*6RCFd=_S)
zkg?(XtHcK|+otWS@qFHcmImvsK08tT(8aZ0i^O%%<%^|ob|{(B{FxI4o?o=vB6Qsl
zpcYZD{d6dy(}_EImNR`}=*<LTz10&yGUGH4BC|ChiI3qo|MY$z)9=IR>w~ej)$^G8
zc-acqVZKv`?ES<gkG@sN&ECL*Z}k21-Lc*{8<RtScm`Q`G!e1Vy<T_D$;9G_I9qQq
z-WqNVx9o#4manMe?tM$0d6cy*iUBH;4jJYVh?Ma*(upgEM=YA?X1dh2=S@ZzjS<KV
z=l4o@ObZGDNV2_hV>p49@@}d-Zq42J%_lu8NI&&xuGNRrd(2_~W#_d9Q&4L0k!4_C
z&qKZNmu{pVVKzKwHoPH$n1S&Fq~vPC2KuX|#+tXY)lI+_LAr3kcS71gD6c_(az|zR
zy&Uae6n>2gpD8}?Orp)c@Y~_SS0wd$aPnLm`@rRI8U%6YsctSvwkg`t=kQURd);A4
zg|@wKCWMl`=R`dVxskq9@ne)0rr6Md6XKycHl0lRewipJr~mf-g*C8xIDsE9^*~Cw
zNS#7EvEHnp+H<$y?UT^xb!T8dV2IQu&TDDi#l)nOTk_~OJyA?N#Qd;`)P;9_*E5}7
zYWR9IdXF$I`&in!^|?VRg;J$>-}#_0M80Q2v5AsLW$jf)jf;J`R1%J*RJWLuN>I1<
zi9V;D3*F_x{Zv^y3rU(VGT1S*lYO=WE9QQBK)*%jd~M?~ooiEpNpM`L=&ZdQfXbt{
z;~V0_9<>^xRb*39<h^`iW7I5+;=3n0RQS#055`LYSECh%P_8faBM3qE#kngTn@%qD
zPd@Co50e(Q1ypZ2J56`dUIOb|cyx|2`0A9l8fy+|b$&VRg%7>Wn0K>$lZqj~*3i$Z
zdJ?i%%8M0-dh@RNh7t!N8V>6=yof??iaNd_<!JKD&oGj3VO%|H*;d}z$00#4e0}@D
z7m?;d@#Kf95;^CLaQmX1Cp`M3#sY$aKnHb6-kFV_<xvI5n=|c2l<!AILmc7j(Q{|l
z3-GLUy<)}C8Jp4gC<r)Bwm+M;`bH+g-w^fXLjsZlgr|mnc(N3=V%sfVH-SqX#b1Uh
zYz_k2+U9T4S5x^qtt5x<ibr7plB)ubuch|lDTL2fBbWypS$emJo8Q?*yxP56Wd(Yu
z%U$y^tDY@Af;k*E0DfEuo?cg5goq6co$YR~W!cqwe41qRZOG@pTvKa^t)}MouQ8+e
zyVUR*eP{k4A%$xFy==JuBb{^ydun4M`WZ1fs5lLF^#1e+C2+nWjAK-BelYxDI+N~q
zrcY2hCZIo@ZjT^z4^f#r_ThAMZlhjAACGtaQszMnqZDbir>orPi&nU8r0{Ju<N>e$
zUPrpkx46wQb)G|Yg;>|Iqt{`<*5|==4<un!mq*?}gv+^jO~F8S-Fe7wo6V>fTh3$3
zu<!Nz0*rSrQ&!y<2WW}uMbp5BXmL2(BGc8aI#j&z*d*$%?41gzX*6y9+vOMP@{{;!
zD_?LPwv+0@?oUK}&|M#YxOU3h>f!0&ReYgEcF!fD?+MQ;Sh&43LVYH@hZl27_Vg)N
zqoSq`12T88mrvI~aaZN#VD9dfpZb8<+0&}om$YM*t$us4Sq7_JUaQd3QN#4xm-BM&
ztg?<ccf~g*F>^aSxI*Yz4r%poywAZ&`vGpV{P*@lKSComw#$w?JP^S;QZ?sI&XA1N
z91TK+w@?pS?@HtFx5K9?6*_k)LSX8(=C$=kDMs{?WLF?}`Y%bihH+`i>a%uFaKdMw
z!Bw=fGh@9eKg``*=k?u07e<)pulPrOI68baZP#72e>`((a~>-Tloe-xqkc5+yd;}y
zxlyav@RqY#ISvozTinOCYFy^)hv(`g>>SJM^~*ySN)A*3$uTGdt+-5G4OoI+C5`Pe
zq?)Vie{TZ`VQ*K{D8SmllpMkpAUd-1Y)F@rp!LH;SJJ3K5TncebGoL{h~445oH*yX
zI*s)RiUCP{i}irkBY>7TWDtYK;v4#hn5b&!>9%$dLTwR&uq))6=B*J<ns7WV+}`AO
z9YS)$(x?uj3r5zJX|vOg{n+l!sru6noA(o~S%pv!U+uRfG&>xd{Ayc-58~{&GkceK
z5WvOD@Fc46<P=g#>5tk@g)jLbSY`0-M}<G@Mn19SXIDOrFmn^%#z?EFHVXJ_;d(aj
zNPLAo<Z-ge+o9MEnYFDxQxZc(T`kHx2RB^4;ut!<9&aIqW!JlRxtN!OMK#w<aE8xp
zj8$o6^sme`u`cq(ob#}XF)}h&%@Un)nyAaiO6RxrRjbwvSPuo9+LXU#bUBOXJtuQw
z{SB-KT^cyGu`a*BNG|V&dzWEw3-hyb3jadND7h`oHxdv>EK|YUv_NT;h%dxuxixq`
z29sZLp)J#&_s1k$UR*J2FT=yOmqM>GHcLfhB+I{4g$bi%UAu+htM{c}YUXU{eyRjt
zW%lEkfGtkhzE(O6gmhC2)dvvHze+AHJZ6x*t!pnbe~+d~_oC84Ir&C{zEtfnkBk*x
z!)9Y6(1lvXxx1hQ3#hN#YsKA(^s(z?Q<@!kZd%*H6!_DyI0SJLEzpaO`R+A3P%aKJ
zewkEo-0ADmB;LjdK4@K_FO)gqM4g*bnCU};zGJ@iCuQm5Dd=t|vX9{Jo^Kt$Wo%{i
zbDcq#a~lXdK?4T_xlq;++RjqvG_D$aXHkO<n$HfG#Uea<hN*CiG^Xo?_{kD(f&N7C
z1=Y6QYS7)5m6%eeOaTfZBm3@ptIL<GKj)vZlk0}rh^Z}gbHa^-6?I_#v@7)J&5qlX
zIY`A-l@+F$U-WSGOdH+8El$Yr#P1{E=@7G<^N)(}_J_scZ;*UAhg_&g-gkVi9pRY>
zkK6a|kn!m^NlpB^IIM*6=}arCpOs#I=WEf!2pS(0B<bgWP(B`F!39ExCp1<e<~NR>
z<Sxd0M@Py+;VN5Yaj!yuo35djgZMM>-dqrhDU4?^ExYtx=n%99{(j%;`g>OO_myo*
zKZ`YwshT@R>tltgyg-5U&{j&NL6UmM7aM2}g_8!G+*vZBx{qOvOhk`>zNq=M*0`AZ
zBfI%>{_@j_=W*~l0%*LjtF^df&po;I$4c-#y<=<q)Aw{vJ|@|^$P^Hr8OEmqBc@tV
z*vO2k8ZvDU5;!{vx7e|r*l-!KuvD&fxuHttK}mRxv%wTS$|t6!W^feIinl$Gd|)~1
z#XC{<{JRUsW*KFR+*Y9>eYhSj{{kN%m^f8zzc@gN>&Lv}3%}MOV0tAcg(WB<ZTy7G
z(_&=00XpqVwDxYeIsl;<pI`)w07Z5&?CcZ$fS89BIEuSIaiMdWX>No)YK(S)Db3^Y
z-4Rz2pcKEqu<CBC&>-3RCm(aREOYhykTn8PZmTaXOxa<qU$?3wz+fZj<bi5$2TWQd
zGOwkX&$|>WHiv49gWNE7z0|FRxsrbYiw(btf11K1z%}3NgK+OcVMa^YJ6_#$nqMf1
zJ*4dc|Ccs}QM-66Mty;QB{&M2F>sD4Z<{saf;-LC6$GFsHA?^Es3~ggyBSR<jrktc
z?|5%_o^h{Dmwuvj`A$>`AgthXOa>+4SY)LkRLTX<+GFKWhS%$KLHlVxL+Vup%|yEs
zQHUt_y<cZF-^KD=)R(163isjFIY-K`L+rH<BABm}B)yc-07hSJ2C<1^&6d3|(?L}*
zZrgK#5a0v4J)gK4zBAsuv)$Ss*X=|Z_*#$wc)i`%xc1X@bGs{fCg-5yO*Wn6D%iNw
z(*{ybz0pOhRqc<cqSfbNrIft!2T)kCN8q>`C@E@vXnX#h17^RkW>VRgc+l)UX1GE6
zv+dr6W|$U0YJOp1k?d`&vwbTA^QINYA+_38t!I{A^LAJq0`jexk>rAQy}D*{FmbL*
zPuutU{H%}Bze>Z$N@B6C{4W+vlMTMX8Pw%eqUuX`vC0KcZaPn2=`Z8W3t{7bsSS?8
zy2y}Cpz6jO$gZDR8d41=7gbZoMTd(WUo(`(ArfMi`h!@>FCGMC99sWlD!Rx-B1GPV
z0wLeWCWo5j2<h}8i<l;la(%{W`9mnFm<3BvU7DV7;oUQu>dX~Aw-4I&mWq2ATU2aU
z-ihboMy%CK3z#_IOS@*wX!>=NzM`qug8mYzvt3%p<d<R(LmfW1GA+V&NpsJ@RY^=2
zEqc2ws`B?kXk$v7d3~jSm7r-I3rBYu?%ZFc)w%3EkUWxuQtw?1`lfr3iO#eMlVBxA
zC?O|iDvUaT!S=Kiuf1Wj_o1~ELmz}XCM-^jJ+GW{1|3^Luy)ur{-Myd2H>5Zy9X@f
zbKv6kDObfS!VL`|uGx4b3TqQl8NrBwsP9`oPYwxowog#qZdO=A)6iaLb0ds;n*XLD
z=q6UAAkr|1Uc_%FjV7oOHaKx$g-#SmgK8CmObuHTleiGlPO`+z9E4~@`d_5jTtjQ)
z?O@$Jkro{AlF6Zo)~BF);coOlkVpF4Gakn&5$1k<={|~&l8I=f!U1cX3FQjE=m{k>
z1)>oLvqQE664sWR;3#87ctC@AIMf86)_4+}p~EDM#z~ivf0EoiS}OftIBh}Q&~>7B
zs=<5(I+w`i2<N-y)Ky0=C}6bH_%{bEq7FmwT6b}gyZ*|9#OMm^IL!GT!&+K7WSRYY
zyA1?Dss@A(pU{)I7e%Ss&r42BhHTnO>?lI~W#K^lBQv@XuG9NtX+&SYvK}_G$vKJk
z`D~&#&s7WV#O8dBeQ|}``LY5ToAE6*?7b^eZa&fq8?fx(vQ>TT^E@$Ky*safLtBb#
zgAE{)|ByFmADqmx&34~=YXM?QccNDqg8R%sE7Kcq>aWXr8C^ym!_HAe(FZZ?SsYcN
zIYq9IpjmK{*H&eQ<JB)9+<sG&*T5akh5ELNi|*$%U_>LKmh_A8NuyK4G%}$ci2uQU
zW*L+awO$Et0li;UQUT-jKOnDR<oXQ@O#K8Ge_)mW_)kQ<et2i1q0Zd}UVsLYVc2-V
zv-8KI6e!22wSmT1@ydU*06_zB^*|nHV!EllL^lT-AosRm(UsBZIaDi21OF|AtP$^g
zJ4r${6$N)}0(YKhe}LZqM9Df22`DcPzz=*oi_9pm`Vdnk>QcRL?RwjkK}1%F1J+Nb
znrE%<!e?S#?~0|7PVCB$FMl#2O6i=l*Lww?u!Z1l^q)n?sy|gF<&cNikca0eX{QFo
zw<Ga5aO?VnwEgh6fF^e<wo&PSlMo1YVUG;-;Ar4(>Ea*Cr7d$9B0N1O(W5lxBTHUk
zV}nb>fB5l>j-{Z~?}+wQ+IVfqb_NdLw@D7~-A)Vw1Z!lOf!j|&Gr@)V^X_Usnfdt`
zlP~mV!;hB=)+wrpeGCR4@r%t3>%YK7j!tQ9%ptICVA<?nQE6qrsTT}@wR?4VztAaQ
z)Td-@uTeEZ9k}=Bx%DXK{345Bf{4OchF75u&AERXCq6-osp{gwto>+1NVW66iN+^F
z+`YZR=I}9706+Mw&8cxc&`-a(ROoMCa=0&q8qCB`$z`0zi%Py69*pXss0-sg@*jRl
zMfzofDw;@yo(dq<z!KgcxC|3FnSa$si#X*sS1t;B<}V1NP(?AWG*{}UyoHTfhTd|j
z(&njn;bPRA^$jy)Xa>+}kZeaj>J-%>2L1fcq8MDCLb|wI3(HnZ*pgalrtKzKA+i7f
zYSm*vW9GLIVWV+Mxu#^sK)TZ<Q-AB`U>&Xkwf|Z?asMrzOd=5GsaU1Wlkam1%rt@g
zA9U5W?%%22G)J5|;#~sP5)qdaJ%?$fyd*A0yCm5_G|H?w559MQzVnn4U7t<BXVBED
zTP|gg^8#RX%_TA5b8n5BGyPD?5y$&~oS!*fgz<!@t@mlAw&xcBFZSh`KX)U6#7H?{
z5;Y=VE#LJW4scN7Geu6&`FBWWEV^4~F9unBFn9LDbXqXBB^TLsTfi1>um_nk+Z+|M
z4b_Spg%2st1`tyfWE`LB`P$QhY#AtWa4#&3+XJ2S&Gdy+qZwfji7ezH2X>at3b=Pm
zJ)otABwm#u`~{U1)jfZ|VL_HSY@;bh<s9y8hc~Z!rdSKSaT2OwFF)Y2+PT|svP15)
z{EXK?7$opnBfbHAC>qYFILr2*W}`5DyOQloib1aXfc`HuQEYDeU<N^#*Wn3iy~N*|
zs3>-@2=R9t9yN|&keqeR&k!dDS^}FK%`3wvU-o9!H*a`{zG=^{_-5li*m`Rm*(&2*
z8dh%P)W*K2*y%!|hE2`u|H~(W?NW0E;wyO~m<m1yIH+zr^E(2r1SKbPai$M<!@vOB
z<_>?LeYG)>RhRK&YWt9_qQ0S9SfdCFO;5i3zCS5%`@;n=u-Ulqzg>5H?w)$IP2F>x
zBR0{{feDi*a2;&o7zGXcTLT)HBKqrd+ZrKf|D|e5&vz&4dx&^86zih>-@gYx8BRUU
z%NNugk0kWWpm_J6mYm*y>8k7qBrQ(2-0qf5{d{nrq_Y~Rw$z%T3wm&O{(B^%EO1fF
zuLRcjN`TO$^L;$WiDk64z1{V${7W;q{6#sX=~g+r9&QEh6A%68<7d}<vq+Bu;pGVH
zGqEzhQt9>~ASJNMRfS+mW^n6S=+EW!Xlq()0TNH6!UcWC+IkDAsO(fd8+pD`vWTow
zVjgdCT^2i;OENos?nnyZe?fgmhesJ{1%$h><sgy36v@{|({=o(dsIPj2#INDem666
z^&${}Sfk1OeQTabm}b2yHeo~FAsvjjJS2}J2>yCZWT%E3i}J7Tt>um0kfz8f$^VbA
zcMgv9`NBsh$;RH;$;P&A+uqo=v$2hhZQHhO+qQrCe05Q`>i+ds%}jOo+db#>!E?^z
zCkk<4K4y{x;%mib1smrYdd>VHQ&1qRwSV+_swNU-*iTg`iH?UNJT7w}wt~XL2(E)<
z7Hr6~hg<?>^a?6xkD8cJe8aLg<(Guq_$`SdRz_eVi#^C7an+G!W-SXsawa0^fs4&M
zqZw}+HSbz`?}CdfcXJrCemG6IUS;hG;LeHb2`*b)eHP27VO?SPXS**whT=O_;z*lR
zlsiBorQz4;RF|&ex#dx>MXM?o3b1A8&_=<8nk*A$7>QXEpi>XJ%<uq)PnB^G>aW6|
zfc#JAi~~N-Dqb5fS9PH6UHJX>Cubc;yACfF@5?vB4*>vQ+ttCn?p)~K8;z%1cPoU9
z#>d0?L<(l#D`=aGtIt1HR<C5ax^p5#Qcf&1Fx@ChvmMFK&*l_qhAsxH)KMT8DtBBJ
zA`O=>5#J@Zo1DvgCE*k-<BOkJYw?{*VO&3koFcZ?K1#bVG-Gmw^Dd@E1}W#O=rbb0
zvfFR77L!4;O=C6++<J1dq;0Q1BocF(XKN`cj~xr<mR;TpjZARFcPiQ|f`e-Ss&yCr
zQd!8=$`%u#p<QPtx*RLShCYsbKFtwyoyHB8mj4OBWg6|C?(EO=c;9mw`*QlU_Mo2(
zdE`CgU5skyhXICOB2<YOhZs9#&T=i#Zcf+UcL+V1`7(&(WLJ0u$%DxhdIfif#?b{5
zMNfIQMkyg}qoxuhbg{=BKO|jBc6Am<VdRkp5G$)O0m&&e7(5v#tMSpDd?7Q#lkx9+
zT08(Kd{65V!|}QLB52i2Xaq7Ow}SM?h2GA9eH|-wzlo7`BBfwbQ+0A5=fKWxy@?qh
z9NhVHNw#=Iksj<H6C>FW3`jBLL+I4N;dYO;JF8&~xVj%fgE!J)DRX+d0WVqE#x^%O
zj+R;e$-On#<)5TY`nGIX{)E%ykl?b})o466@T#a#c`qoD+i-k5*33;hDh6K!S|z|y
zJJVM03`o$u*XB&Fa5qap-D4Q08a=T)CqwuXeT-vvk|2P$x@rp*D;TQ5+r(-!dx7T4
z@{wirh_vt>mF0R6mnegRi<?^}!>gf9t?rzeSCmEHT9{clwHsbGLxVwkrR(b^n**0d
zvPwbDpB?L8kx)?xP=3yfYx{F$krkyQ5v@w)lF^+i#Yi1F>buz6!23h*H!lv+5g2#F
zb62=7>8-oRmq(}E1JY~Hju4BIL(Vj{Bv!0Tv<7I?1^)i8tBVb9a|8z4@58ytqV9`(
z;(63f8Gp+e`9>$b*b4J}s)~GM7D8-R3a2#7a4S~tXH{8Ce}pu&BvHyvTpe8P;K#E4
zfc@ACQtKkOfcN3<ow4-55Y!D|28eIpgMN??Or7Owx&Vd6akmyPymmQox@muqqU^RD
z(>fk49#@|4jB%v|C)MWubds1_eNg**`dQ;x{+G1oAi>5YhKPoI=G=cCVssAzpveiy
z);2}sB+Gk&61)^@o7JI_6SgzrsAi~UxK{UM|Kk<1vMws;8h2#6${Uais7{dOg-Y=>
z&g|565hcrep4ISC9<UAMV0$XmxL`K~juMr2Xh+TFPhr*3lWZ)h81E_mzvDPRi8BJ_
zO*wPkMLAz{U!O84Dp0Hp1lQDJ1M(;`8*q{NKoYiW!EKbT)|F_kHS{fH)qiKVA5IOG
zEWp($h!jO%`7}uWmP!u(nQW=(A$|RI;N{@~1t5x2AkC(0+;3xzGoF;vxEF5u5Zb!H
z(mKnk={-R0x)qv*maKKw&LdoO{Jexr5$bpK!mD-QU)bcG2OGoFe?_Sd>JI6L%tFee
zSTLg*I>QtZA01T1{XMj`9`8eiqyQF`$8`u7N2gC$+vsMNVz5vZhWGO&DSFAZYvRnZ
zU!^?w!|y?xW&=vL3#U@-^wpc}H>H^?^tkPqr~FFXkpt~YOZhwF{c2?9jHurhP9Jb9
z_RQ3;RO2!g#L%j-Q*I!G;@N?zgMQ@(fG(0I3(GIPXlAD%%oL+v1@D+HrGGJ*!%DM?
zS{(~;_;V-YO22!ACV%ZX!ECHeZ|LWeu-*YYN(Za7z9Yaf#f<GTP$@7B<P24ay>bMX
zPwgrd1c^s20&p~5WFk_ACS*;J=hKO^A^%FbAkL8kYE^iRTEq_zcVLv6RCBEljy-9O
zbq|dhjPaLMFcRqcT5`LP7zpi5uFNKdwH9+Uvj&e&Ox@_H$oTSrOhb0%!7^F+h)0DJ
z-WjI|f&@){_KLzJwPxnvQjRdMVrM)8z*u)}c^YqYBXW0m@KFs8^~}&GKSL_QTB8MV
z2Y*wm-~{nKR#5Z%{cIs8vq+06q!z{4HuLw<J<Y?nH0eOO@*Ge;R0U*aK6<VW+R<PE
zP4i5#(-#jT`SU>VKLj@5RdB1p0YqhqJm5K4eY^v<qAh04p#tId8c9ER@*4*qgw=`$
zR7-{K$DSwGU(dcdqu@^3j-@bq;+BRgxSVWvXv-d(vfP>zAR5=5^*bjE8^&E_Klk0b
zEUv0LMpu?s{TdS)0n~Lh4M|C*OuHHCs+sPuZ^^%wtJk)8=)0zJ4Me}Gd7*M>CoyNc
z$?MvFJ?v529sV9tP+8m_mFtpHEZBzLO;guMxD{@K0N)17atO!h3^?KN<#>?2C|klT
zyhJYGJqc2cH3uez4->f{v4ARvCHf_n6(>OQhb8M+!+?@r6&An*0!T>L2T~5*=|wP-
zuJN@@H(YNHLai<$tCJK@)%4UsxnNF+(<aj3U7bQ1(7aD`C8v}CE)F|=$RRdoHsz#4
zuD5E;T1~%!(yWEGGQt&Eb=^3bN{Jb9+@@kNMU}{FN$YY5Jg_Re^C3>?Acd~J`#NXu
z%BfhtAOpbZz+{V~ts3;gXs&&<dB1)cS~atuBPlysn2S-Mpsa04>$e7a--c*L!;elW
zE$+ANuO6mn$=CvH3x93&IbSJS=XF5&jN&((M6=M8Qqh!JeqGM4fw$7=oGzSIt)VH2
z3|bt?fTX6|&w6H3uUDa4pyS5+f+h%K<J;8<4?b$<tO0f3i3b7c%0U7mlJAzbT1Og5
zxNg0TKznYZaW+>LZc>=NhrkLmDbNN(Zqbhz$21$v>%y7}t@u`k0dfi!gA%!l7LgIE
z)w+ZnST%|3uMN8Xx|T(obqrQtP8EwPESDS3j7GWTKry*<DbWw(Hz)W{2{)iE^9ft6
z?fPXBR7fKNg=?cydfXX2TN^yRh3_Atiav_-W|Y9Xa~i0;-|}j80#gt%$zW$GA%jaq
zh-cE8zgX7E4#X$l;bpZ7RScxL#;GpqZ&@Y*PWQS{-9QL1Ki8bCf%P$>?Rsi3&-_Xo
znSdD(&Q<7{z@-AMs2RRQ=z&9*RTgqcHV{jMYwY+tO<+~$SDe+NuK1JhJFM7gmt~}D
zY|L<ozwC^WfMBEf53X5Ao2NiH6Z0qMFxlU>&=g-%0P(3a=FBfu&=Q<|rM)Eq=EW7L
zMLuhKm?Pi8$(|B&YS^rBqYqm%&du<CoW(+%n=VAL&2S=MN_JCrQ{T952`CwmPAH1*
z0ib+9RmXRaGNg0U;?bGW#PmYelP~I$Xkb!H6EB?e$;1P3`W19^)YH*)#rbq!lzTak
znCEbeK}Jn0J#$1uYg`tlQ8z&GWYidFx)+Z6aYr?S`^r4VCbNlzgAwbcQewot#g@k+
zo%-QwMY1^qhSlZH0iG!JI)kl{@A>rtMNiV&^r-QfrN&qzw+T!vf9<>Z&8_=VyH}0r
z<dPQ$P3wH^&(6y2*9PGG8~dhQIlZJRs65(H%<`q-Ax=Vv2fUF(sysE_)mVPvbn+?I
zliLueYA0~mYs_9ChBuDgy!;rt?Sue;T)dxFvvWSqzNfr$_)(Dxcqrw7f`IJuqEe7X
zJ+*IfC~8d0ABKLe|6q<AcFGpTLCpdao5N(eW!r=4GABI`=tOiThIAI56!H@13o=!H
zj*dck5;v0s^C?Q(3&?<rk&8SJ!iqvo-JT|>U{zHU5A@Dp`vEsHVCDUP;+8|ax991g
zzVqvO(?Kv=NfjW?Svu`r)jcn@`DB^ka+yOw<xL=g?S}~av_2`d-GaQ!Vg2S-n#Cn^
z16%Vs!Tri$N&=c%+Q6eLiG@8k06u#gGoZz>&6px()o=b3z1H<1C^-xa8+97+>d(ob
zA<A6cnMG5!UwS1{iU&Q79wtelGqwP}rZYm2lGdaNkm`%eS>4i=c1>j@Pe)Lrt@0Aj
zL&~*3-uESJI&ze)XGEOj#l*qx)Fn$BejnUL)?s+JoeHk)y&q6#RF;(LF?V@?#B?%m
zUtcM30Cck}7sk%WMv)qK_Ue$MRNakLUlEUF&jn=smU65!D#n{<xt5lwR*<Q?h3~sF
z30Xg1UMETa5jpFf@625zF{6@eQfTt7<a*-B`CmHwBbL@yWPp~X?`lyzk#jXL1!W|!
zLoO8%UzE?3ww2m>*>F2vJ%f_P&u>1yjfHs4KdOF&gTLAWZcii$g4>?!K4G>QlHhOz
zm}vr$a>mCK#-#<>e4Xf+x0<_ZY2{O-9LWAgW~X2zkT-ClB=~kvqR%H05M5XMHU3<9
zuqx^+U>ugV)+_N7Q~})vn1B(Bl<`xomuD-p95;b=iBx5j%={ZA&QJIMM2Q!F>EKZM
z+#B}D4D^&dRC@mK;SD(26cRxBDLK=DgKavW{z~K!j24p_wkW+t^k@rUpw!Hx_A|%9
z57gT4gL{xeXmr?vf}3Y`!J$&SK8I%H{HT97W;R{gp_Q`l3A`wRj^vb99*rHI9Z)om
zx?OK&P6IJ5+BD!0z(R?4DoW3t;COh06I_CNDpOQd>LZ_?O6pW{I8L6Yo<=DiuG)|I
z=Vol21YEEkcW`TdUtsP>GcCLYra}$n5gJ^c%O);#dD??jTOWlRhwQRG9vnHVYGaYY
zxJ>#nSWuts)SuYt#u}(1x)ID|Z`I-(@-Ig@M2swCW5wNO_4TP;-UA7uo&`YlIN77X
z@CeN0<bjH+t0KLL7C?Nfp^e}Yiaj9PVu$oU8Nx4llET)PdN-JqiSAI>+vspOu36(#
zVVAXt0i&yM!zgQXy2D4w41fI5lk=FTa9Lj(10c_Z%${zI3Q<RhaQ^a4P1h=2_8RM~
z(BURzZc_#`@b95Jv6bdEbGnqj{OZh3Fyr-gW*bjb0`XO*T}>1oA<ng6&?zGkg(_x*
z^dna_K|X?@iVxjo%`n?z{+1ERFxZR<!sYS`4G=<rC;P~!rm7YR24mXeqX2&x*$+@T
zglTp3K$h}t!%V6%w+#b6gr^nn#L^L_Q7%RK>(aFZ@<l8aGUXsrjFCv1m%56Dgb}a@
zJ$a?X9AMwm``hq?OeB)EwhQvnJwPfX&adD~29{)2*9$=}wFDKDGU13PL$^zdOWE<p
zH*YgHv-m-wd&*TzSW&}(v$!x><Q7?<RpRTWbRt+&leeOw>Shhc&L4ng3K@{at+c|b
zC2V5JmU;uA%HqpUT?dUD`Ya+DP2FT=4p^HeJ)XL=g?j3v1x#Nw>?+%?UJmHBFoa$Z
zWD8d}{M>_8CYIrcx`#{L)7zyb@_}Ss>AJ)e(DdvUAll&L$4N;YmyR1)NW|yVMSEyb
zqVpQ+l$_qWa?t&PeR$Eh0)x}V1z|f+vmbLl_)hyS3eteoQ}#GxH+%LzR|{d*=QwdG
zQux~=Vg>0-)(V&nUBuCe)WVhxQ&m)>r4Ts$-q?@HRh?`=ACfc*x`~+S@w3Y4dYG6Q
zO8eUki)af}yh`qq>7$W5$s9IR#h+|ju!YlH>i$3lDU5(^|6;e#?mE_9wSMgYsF=mF
zZR}-hiI;5^U^<`;oEZIc;op@x#{<7k%>C!g=TY!|o4%U|@O|U;rEnrLgKcX@xV{TK
zqW%ZfpCL>B2dW>|3f^yu)!qqMjD0>vpKSnqL-k!fAqHLbEm-&nEPr78=7m<YgOg^1
z6KQCT*kml;GX6ohx9@qd+~ckMzCle*yg-jeNQ+Rld0d%l;<6dOdn-pzy<g7l`M6cS
z6t$0yvu4^Vm3uh6W$eWfZ3>dYJ|tCd>P>$4;HCc<@pM`o@hWnt=X*(!Rq2<~tvMMs
z{;G;L<b-oO$%9CnuiE4#+kJrT{ZPr&ZKF21ZO0L1@p_)f**9<MtlM<2$UB_B^XTsg
z;ukY9*lMhpWZ9`|XKC+%UG1X3=+jMF>Y$e>HmW4LJTGwvMVazd@RjJWJ=Fh*6rE_W
zMEShQqFf!yXt8e#XtLn7UHy_iDd+qeES02?Z~SSlj^IVV7y}M_LBT&8+Mh)GSKVgS
z2jLIl0ey^}3!yqzOM1{7ZiS#}mU~ZVLVUZ>M+IQe{}GNb{fEk@V>g+GM$efIrs>Fq
zLH-A_ad)^_r<5yr>xOG;$#%T;v4!BNLu<3GcvEPc-bM4hT5jS@)Z#DypCg+iFI^Kq
zsFPZ?c5i31iDR1O?qRhBw6ys}lSfp2Z#=>(I0QqG2G-{Xw&<LFL?q*U4!pjiaj)Uh
zP{k?A^w#n=rE#dmS9?6Vx?w(i71Bu$3bOaB8%fRD+-`;@IHL5mw1HFyJ$Sc{jZ!>m
zveNtSu}7DE`@a-vd8cFYwcDq-jJL6rMnQYq<Sv3|97)iYt`DUqTt7@|m5(5>$zKaM
zF;R|O4<JYk2`Jh56Ev0|k-gF+)?H!0<MMI4LVzCQf9!J^MdF-HBGxEX72n#tb`izt
zn*m{cL}WgGv7;}E(p~$ljf?lbGVQ1b%J;o`jw&dYONOTLciARoGr&W`I_*?z`QNP*
zm+1DcpCPKWMP?fS;WNhx_vOeF+E}`{%P4>eH%D(vu>_V={x4ndVJp<H<2{!$1{%Sk
zwNZE8bCw*CmRqySht&CkTKx+S<$g_|wax@<j*5n>qt91UjT?i<P<=plI=1T9c41^m
zdtzUY%%Vm6S|9)ZYS?-i#ok^;YwX>p?&Q`4#OE5N&(R4*L84~_ukDevz2C<-?KmQ&
zreKNIoAAK?0Z-Q_(F*d2ljr;$qQ}J4Sa_WiAiF)Ti*?IvkhMqGGtuXk#qQ+fcK2(4
z_4wXDMZ^S?yiFNH`|8WO6B{tF5N5#)9|#%sFLV%eI7!9*@1UhGor`LXI2W$ay$T|D
z(D^rwW}~o2ynVLf`1Uiv(1=0##eAZLanWa{(dX*Y---Z4rd_N>#;jTadGYqhjXoD0
zh=REdHucP0CUD)Iq{v9IWrK;oIU>gDl0;|7Rp@=sTQ}*BpHJwAEi-XT7cJpX&5lLE
z&H{_x8%BsWFpI|5oO#DDh;dJTFVL*wC1Cd8%V;+qGEILAuVgAxg`9WRVF2aF)u5J#
z(zy+Jz#_9!kXg3!Sxb<@&j0TMkit|{s$0bwo(R~i5hJ5NPB}#X6sa5<S(|?@>g{re
zx*elXJU|i1Bph`o9bo-W@f{M7k@%Z?&HO%ti^z;-maJif!c>*QfMfx&ply^<{`J9i
zOR{~#&sIG(ErLSX-UK1KD`yrgZh%iaICuw}xg!7nUn3Hd*AvM`kmwggfWTJ5r?%A!
zKW4M1Pvc6gk91mLiz5dq_tKnMsLFFm+Yi(IMg8YazPOz}5AQZ==NJdhc$yKW5=Ltc
zh);|*f<jaexH2j1`Ehar#6s#M{Pg+D<f?ryk8G9gGi{?IZc`k-!v#XSR4Mk;4}vT^
zS6{dW@EGQ+FyIFf21OPID@;z&5rjG`CMM>8pV>CHaXI-W`cn+QscD3muh*0J#oyq{
zIFp5OYJ76?S9{W<&Hx_YsN8r8d@{FK1AcRxIW5_0i{<@h`%7>!Xay&2%WohmNL?w+
zV)cf{2GUI|5@g-=2FG24s;jm}$l02qv^5rZiZ3RE16D@9FN`C*Cz}_5#4lcKW+9D-
znfIloiRoXor%z3yQ(jLot)fARrv)!xJaaYzhovrfJ|-VhaAfU{wtaI*y6?aEH}o5F
z$5|>DE5?Hyu(~2~@6_@Hv7Cw2=ab5zEQlSF?v<?H=RxP*@A<^tpEptJblofzl|nf*
z$w$lgy_gqmAuf;M_d=V~&ADd@=W>xxHv+EMkm%;#(NE5k6%^hd{3F)HaunjlkzHsD
zMI^%KW{NSk9_#=y&}Nf}<nOHHdGA8mxf@A+wbRz<Tb($3^2p?YR<R6WRj?p8c$yJ;
z&nhlAR-6FeliGB9kp)fn1E!N>toju-o_xkF4rD;TWooM2iM%ztHq@FxYxJImG#GXM
z2xRG?jN;#B8|E!*>?K$1At17xz!`h*mT_W}{;wo^tIGor5nBRm{9G~(iPA~$Ek8kf
zc~Th<d6}uoUNlwj<TdW8o1^^vQIqvlnUFW(&OO)81)^>N2RQMeChac<Np@+Djz~wG
zz6P3aFDs=}A<l8%!SMxe%kw8dPLVh=K|ZgFIWmE|gn|Wy%XCBK@mXv%KM782tOOgJ
zPsFYryGCAOMDc?EOh+#11(iVExdWa4#&O%Bjtf`wm>O_sIhO;gZsg+KA6Ma!ds0R)
zC3CCGhUiu!3^`z`E6L312={CmDfvQL#j5K52bE`?z}SVLd#0R;LBD*<6%Q_3eFpUG
zsHpOJ#PK0^XW0p@aFn2m8}qtH$PaifGqEOI1ufCqZ=a2wJ|l~cd7H-tc=!Yn^enTj
z{no@F6w`}%EbH!<$>5I(pYFH79&CVM(8;up;EN1UfxFdjK|)~*UlN<pv~ozdCycD*
zS0q9Go}y?HZ^wE|Nl<DkPXht1NzFfuI;OY0aAXwhH(s-OS4JdDy|>wMosFl;aVubh
zy9J808k<mmZ%y}Vq5!7yDkCZWgIwamBLP=00&~RL`;_zpZ7L*|>wg_+o=CWZs*d@E
z9ao*b0XJ&(vw8YQEv|C?MK|*_Uld7}s{N}o0#*&Rr}sMQx0z(0IgLv}Q}I|-`e3}?
z_`Ee}RP6WHsAJJz^2%>$hVG9RW3|nVV!r>y0{qz7>{-7K-3HXeh+HLF*fPCckS|0w
z$tF550<uNGXDzvgfP{BuZ?5vo;CsoU&)s;#NrgI{bUPK{0Ws3`Y=2OZRafU@YSi1a
z_tGAYI05#b4=w5w3{8F+yLzEEyb%`M7<9AkT-}JZuhpelE2<NW7-u@wL;mIr#jW^f
z=(vdVHa~IO;rk=5LDZ^I=o=g<ve-elw7Q`U=ynmDl@cF}*z`w<AozCGsg?uc6F)4(
zht{@sBSZf(qbLA<hS9EVCU^nEQxC->(HZ}$2T=DEkQKKBZIS%|fNccxqkP`YvW&m>
zJ+|=bljx{NxWWJ4CAubN`y@@W8fp*{2@lQ^TDp}bEY$mf&<Hh^sbbfVo<vAL4$1o&
z)UJW)EBW(gU4yC_Uh#@DQk+O=N1%p+cG<uL%)jS1-6=v&2Az9Gp}|~hg%Imo)pWl9
zAFKNDZ5S|ryEZ<tY2b_HCRfr<=g~V49Zu)O?TWG?k{fq9#z)1TtrSr3Jk)70y*-h0
z9}p`FJi^T@V(fQh?T2xJCEGJ!D_y;zJlihys`|z`Xy7}Hf2On6L%l-ibu%OTZop_7
z8;cR}{TZfhGQ1a^-7H8zGuvkBQs+8PGYn#C>)fsu1>){>fW>NB0(M;Oa)z^r)o+=e
zT-usX#Bw)O*$NSuv8wXz6-dg%9##xlZ^cMhHh0ppBIIxp<b|715KGYD@4?ZVes-Ps
z;Q{cSTG**lSN>T8CQZPP@kK`nsxQ|A85Yob-0PNbo82D(1vu#~0+GuE>I7lPJm+S6
zglHsBHXweEMn8iF3>I^s=<vTym^-J^`8|C$d)`&0w3#pHvKi$TB^ckE_0LrQdN5JB
z0@Xq^(wU+F!~PMj+>`}QCFmYylzR~mp*A!&`p>Wa_i(}2V6C@-WxaGxj)$1OgB`tv
zl_fM5|KEUiNX-{VRd8yJxZqtBZyw#zE#-^HY|!9c{kBb<1)FEbH|RWB!N#i`u_+FH
zWq7+=@Cc`d$uW_ydsz>z-Cv6yIXh;KZ%^!_n956W4F^4G`Lt&*|6Ond7J~JAbk5#P
z9{QL|?!Gg^bcA%)t_>^~$IeRU!+1S&)4uezA6#B5f0VFV&%{C#*u&=S-}26JOxgf<
zK@dmBK5@=X^6s;2J<N@L*G}nIY|Z~oWAkzGg5u8LBK6ldbOZ4mrUktSPH#X~tbDqJ
zopqoNUSCZSf&_al+=!P@TFE2vKl^7#+P%T1iOYuU!a8(O%c?8jivEZ_(DUq`T(PD%
z()#4bgYMF@yY9U|n^tNgecG`=uMUzTNwf1%bv@wz?yA{o_~&1*+psBcmI8ieGiBpd
zjq~y&vjaLbxW*jXyCYzFN6m{jeN>ke|9N{O5d9$VVy*fHxixZdNO7n9lHxxHxd->B
zL;4-AK$!O%`Hl(sGFkj&JVv#*?!z|3q;Kc+X4=o?Y7txG!M!^XG7bVb7hYZaixq~d
zY1{Y%uo}%@jGEOIYC{9^V}>gUW}v$3+9Bzp>_7jK2+kilU94~kg}%VXo#E^SL$Cq*
zOR7d&#m^EBPb#kZP?y#~IKujDJZnmyn!@RvyGJi#A8_zjK}xT>-?TPAo)UkrmWjmy
zy1OVdQv$sCx5wEW&@FuU68Hn3fAs10oZ-5f0@0`ex_!tRC%TuacEgcPG4*=l(bv&6
z7<;1$SK#|JvgzO?c?NU1+L$ORT0i8tn1ONH`2h~}yHR@u(!+TaR3$y-FU?&j>1=!g
z0&I(3WvkFo52d2vh#UAryFv%xOvvriySVL42os(;;QRUkID@MfA&jMw*ahxq!*K<<
zE&Atd5ob|{mw=e8sI5f<?Q>Y0`Mqfi4xUyl58i>bq0v0085I>t=k8kOW5rIU*B4;V
zc$Jgj3DKRFPE$mH2`&Pn6R<_+ch<;a(bO9)6DyiVCwm}dyk*l#0&y(w3L@e(;*tN_
z85n#R%(DqOOIP9GBPd_K<I17D9+_B@Vp(Fw-`rB!0k7n|s=VKDVlaVHr?DfuJ}G~C
ziG4c*1wB2K+-A4-2cRF6QYE*KJwi9IjNobp1CJN>NsX%x7;R!nf@Xwoe*ym2&su=Z
zu~-UdkRvdSo@$8&naqd(yAJvyRF^ToO6TZLjDO2&1g8n8$qn@12h3e6-+&HXf=wLw
zasD)+_Bs#}0N>?6ZB?sNfAZZ<e2`6-a4HB%MBnarWe!R@{c3R@8&DDT@f>ufM=Uvr
z?;zR-ckC@?r5Ip)16p@7P>`YX4agWz3OmAS;%2xlq~>ZKX%mGTi|`QsUBA11#1z9H
zMc3fmv7G}nezE6wun3^tUGKqhKS1xnhAjK~QTR7~#KGHFA~ht2yx#LI+3kewea~Ny
zoK0wnhf)!|h(FdL&xq_O_TMRlXJ<Z6-S-dZNwnTJ3=;UhAk@Dd=x7rZ_sZo>l~j-r
zJg!I5_bvka^qv_3o*0`vV&hfjFUAx}8<8MbH=9mltSW{o6e|(1WjASnsY=%xAC$qT
zvk;n|<vXlNwC)c2!uuf#*7YYu1|k3idH}7lfJFC_2M``ixt3pK$bx>a&^`Tjv{%Sf
zkbF=Y=dW62x12v_N?UK~6khq3;>4Qd?$d=8=QpvVpQRFB7F>nP_kIi#UKx;W`gF}m
z9Ie~-xPW7jnN-p7P>BJStLQ=CX;d$6JNk-K4K}n0bI6-tyAuGud((rc_PSwkj>kZk
zpN}TnPzcj7seN>mI@EfhF#neR!HhaT5Z?Pck#!W`U&NT??l4W+>TqxwrRgW;bXFvu
zcQ@;tZ1OOGx47yD_VLqzqv(}paIx?jMli3noHXdqNpRnoOb9?H7aTNzx==RIg5|I?
z*cJ)!o)|JwcdbO0$*lzKf<_y#b2WC%i&|k&bEj+QG%#CujT$3lUWw@I%Q6jg#+qoR
zq^>6{2^?c<$r=TOkB<y~cYSB+q$5|U$~^Jb8^3!O0%cx$<A=!k*=vSWjpn1>+cbCM
z$jaq|Tr2H`a$3PD`SU(2>QiR9@rOljIY)viojt0~MI?^J%?za4{BXHeZ9uUDVEYR4
zzDc1BvFkH*j>H#V%RkyZuL;Y049L;d_E-Iht0_IrU!dQj6pa(bI#^Uuy`y-)%afk4
z(nTIRrb>E6N0XEq6LZ0>mPdL1k+sru40Eo+>rov!hu5lyPMUXosto#46lc6(m>({F
z(AT<_#3OlMy`jIGb^AA|%0RA$SJ2OWVKrljK>$U;gmUTdR?wc;Wa~5rtNO^J5O$y@
zXa7^llYc<APkz67VB*2t4<`CI<M;5xgL6}jG>gr&<5+e@rR>i0(%Cf^QL_PngC2q6
zYB<01otwuOe-ivdSQ5QHMj_LG&g6h&Tgb|W!{`8j#*KYJY>Gs>3y_At*>g~2VMVG1
znG1Gi9AH?=`@enCYn0A3xI~@mrp?=dRKyK_+FhYQaH!I=z=S@C_~{Z>?DMiFIO>w2
z;l~(*Yw7w2vmDeX-e}df?{X?NjfGq31%@(mbz)?@BOv_#f^leVtr&ZB$ir1@f0tB|
zht{c@SpgI(v!byCODCjPaY}B%NF$X;0jHMAs<G()nV*iA@T$Pq$FqpdetRv6-U`UU
zM>>P&PR&#*9iEJyaHvjwIkY#@v#`KNzgp4F&|-C!6_q+i|6_%iUKewZ{B;RH+NQ_!
ziKx8)GG<j~x8rAuLZ`Q-<BHBHrWbj^_cT~x2QDBkGE#PRAMkS|WTKfyM4oA#U6+Z3
zBD}u#_<P4Il@eOQi0FlG(X?CNDu}Hi-F@rvT_e589z_Mozj3|$yFq_V(T2SBH;kj`
z{*=*^H>HMP2U;<x8JMYdHYr&lb5+wN)yT<q4!<54jFK5pv8ZA;Iv8WId5UskIc6Os
zfQbum4QKmf*1pmwu1w|EW7KT1&J(+Glbo>RYUp<%p&75)gg<jqOA=Z$#gkJ#I&V;p
z5AD5kAI)!D1e&YrS_OlGDGV;Gs;AzO3D>>t24#blAK!d;V5y-mvcP~NAT+oj;Niwf
zhJV{;beGvE=~yO|44~Goq9ulWh`-k(iS-f-5fp%wurWc*yWvIYT@ha0ei=cuOIE)t
zsh^T#$iXzb`-{3Ul>Vs#p%Nx5!N)EDbZe8M3x`6O=BRE;(CqF5<qs%JIA6>|@L5wO
z(F{VVt}`RRM-Qbox?V2Sg2N(HLBd{Mf@lr)(#C!#ks^H2z{+m@M%@$5Ho<kelXsRh
z1tZZYXg*%px)roeO8v$c|B>BMW8@IiJrGgg_y+bC#BiSe;%{Hc!uAt@rC*g?A@RL|
zmel$v<PUxxc~CmV3n3j2Or=X+Q3B8n#^Md(h$>vgmSwG%q$ut|sUzj*fv50sOHWQa
zK6?_nQg8z!!1V;np5>(%9?AmK#@L%D!NV77^=%58c_jV&IR*yJc61|vY>OX0`1H7_
znyUY`7hT|3#{~@c6Zx(nk49Cg)Y;<veH*{~a-<wv`0OMvkPOXu#7NnGnU0@^rW3Ns
zyH@P)xj~!;tGw2J-JC^P1OKAPf;FQ62Jjx8g-?h9X-zMT4O*T?PdvX9^=m8?m!|{2
zzi}RVfqpki?6Q*d6G#G*u_Lj(Xfi)l775?U;p2)r(7w`T)@crNA$3GS@F?u1l2JFN
zd|1pOmR?2yse~<TP~f2G{Ts%*)&D3puHg%ws-#0wOHwx)2hINnkbK&&fEso9E1S2K
zP1$Q<^Iv<`<rVdSTKZc&k<3-DN5yGPcJ&ma+>M{#*oanZpoLh4wy$sqvA7xKVX$*D
z-EZQ?)C-;jK9B^*WA;0?ax;`$GtB7+%4xlPWjxq*<V%8nsoJ<WX9cnDyFnjgrSo5V
zf1Ms;N!FX14Kr9g$JK=7k)*E&izfDYAKQ?z^8-~dvnTm#Z;CKv45UcZm$LE8SI7x#
zm|FGP3I-L9AL06C3&r@;*s~6_?@<5YmnAoF9V^KOECGgvjMAudc)T4XIyVvqIFQTn
zuWA}>1_U1fxgfm>kJcmpg5UOKsdAHSp0nbOA1_=GVG9B#+C3g*2*i|%o;c!L?{&9W
zJ1aPEhVUPltVg*sQ051UT<Cs27oiW0M_@FiF=#kf16*g}>|xNoAi*qury&aNV0~%h
zZ!>Q)j^XnI?5RDl1bXIx4Q?PWq;~<@lWkGAsf_@>jK}xVY1|FbtZMJdQnOJ(wUz)9
zvb#7q<^_)k{+RIkg<W%wnz3^uLQhtIK=av*H%=PjRK)_(!{nQT=nXp%wbW4D>E8#k
zDof!Z*8?rVP?k3V;dlq+Nw=RYQKj0nu_V6SffL>Cdy*Nl7G@}KH8KI7gK@3<v-P3<
zF$*-=_7^O2$TN<f*Yz^6>tzrDV9uSui`F^0i&5w0e^-i(dXISM&_EdcwjA~snC=;!
z5&kMj64yJ5E(_%(d!YK&&dv=w15}<HpO8M$r`#6_491&x4-&1Q3m7Lw(U|(sbx4R?
z{PngMzHtCvw_n9l*W!{r=#|v~<=*wRk{IYSWsX#7oDf$ND)eRF{2PFeg@6DGZJt}f
z@VoO-3fXZ0xG^6HpTMcGXFG12y|OyPt0>ja8(SZ)E$AQB=-(z<<C${4I^HuNtu)oO
z>_#Anuu#emK$JP)C(TwOV|?(>F(fgyH$y0rY;RV&Hj@I-Yimex*I}n}#N5<6fh#t9
zC}r`@?N-*zkquQ8Yl(4ee8O2t^i|CI2L&hgL{~_!r|r4efec6lpr?Oog$YR6Q45`C
z6v}g7I3P1AH0GBYIfBA#G%061#<P6Kz@SGN%64{vh@Ah3Qo*S<z~#;_0SU`LlOW21
z>YdF{uso|#w#Y*OU|Qk*Dc+9?to}ZL3-OKjQ-;%D0ZFC*==?GC)n9wDBx9uTzpLuo
zAIH|<Y6Aw}3h;T@8lL@62!XY2^VO8H5OFTVOv&d#d2R_&bX@n(7M>p?(0_exyEz2&
z0_2YP1qW_n!m$2VljNWxL<u~#>u(m;7=jJNhfOmE#>l@SQd=B>4!zZx+rBjZbQ<BT
zKE`do|8pOpvnH;p^~`MVG}(0}I&e>UMij{`vX(J@(=Y&}-SZHuU#Rjq^ENr9jsIE6
ziDuJY0c)YOr~^=no!UFk<DuVw-Tvm37!7j5Yz*M?bM`4&0ZYA)ItjtKkpF)D-{8Ri
z-2VS7VqoWyXSe^&;S1*9zyOwq4aB9Ix7Cu3x`oPDzdf8`<XlnMGYA%+0t*Zy!p%SR
zph5GT#H^0_&`Qh_i4iE@MNp}g94L@2%+n||PSxo)LsO3=GQL;Y2~7D<z~l9?I;1l6
z$Zr5B-u-lgnTdD7^?hg`O$GUI^r0uE{jrl8C;6oawu_T_bzHw~$F@wr_VU!I;(RiI
za6)J9Um+6V)wf0^&o#V0W2c02QnvfKb#5d(8}(epvH}(^5i|GbY($$-arOrMpech@
z9;<^s+HiGZ7cpnhtdi8sisKTL-Nf}E6s)FtoDHcIt9uixbP5_V`%CW3_tR$-#)5kM
z$13<i*2Rry=qaG9te+<<CTS`SuYGMUnYX8CKAAF;tXMK!b5a+;vERhx#z>oQ7oLqm
z<jh4`n~$r*-R3kD6l3L{52(ZCz0iOVho>c(u!O<(MU}Ef!{nW{a5G|=3D_NrKFrZg
z)kYC%s{-N+G;<N3N}M(sPUlGDZX{2!c!{zH0j!-&r`4LouUBUp>20xK)_Q}{ue;2F
zRNOuGqFeJ&R$kK#=V8-c<#bu^+zu0&z&9OiE^uhCEow@=V@ZL#q~f&!FUCl1+Mo)w
zDLkXAF1>lYA3xdnj~V=wUIuL^!=GLM+!1D0HsP<%bt1ugnX=c9|BQD{Lm!(tIiQ}v
zy%he^POJYdKiawl6IiSDOBEYiOJ{S1`^08z`|Q=kWXXv>M_e4`)A{v>3Jd$ysp}P^
zbm!&@IYZ}K)JkhDFk9!|em3prId&RyYQp@-d1ex{$Z0(@QYM0^s=WcNno|dhd`_&g
zg{|jNinI^>S!Mz<W=q#XFXE~M=7}Sru6fOomZ^e*>3fND7Wdhq>PJr$8#~XN=u>_^
z+*BjJ`Gaz$s=9I8ELTBXXnbFOlO|pmq_hMS_m|C>@YAv5LWH=7rO|@F#6z5jmuIr&
zg)IvY6FE84dzXrh%rs}*>2uQ{F{MR5b`7(2&Z&la;_(`!#iCg<_b_{ckM0)#vulQN
zz*WWhzIBdLg3hKX`+d&Aw5a}rHKeKd+ft=bMBe6{Bh~=>dO7E|is;B|ZCtis!xJS!
zbL9LzmaIh72*yi8{o~1xb$KjXvRm0v;mBrOTF6csSTYuCC(hOshBdLuFLj>miM=-{
zGJt6+&+T4k^cBr=gMCjhC=RaH_3hMKI+(M!v5&Vplr%Obyod9{;D7;$uY<DMP~H|L
z@7K#C-%`3FuZ_;<Lki=UQ5n_&%Gp8t<;(l<BlyV{-lV2`WBy37TUA#_UA*8^Ww;E6
zQi_JWF&5^=&lD@SoN+s#uQ&apwT&0^$KP<3?pmMDn`1sn9i6J<Y)QmxHn751l$w2T
zns)u{e`AQqJ$Vn>*}A+vlZDftOm<Hc>vKzPzkcp1RC+OKQ;hkgd-CrU)P2dZAvQ&6
z&3XKw#k<LRs8yc`h$RH73z*)_C(?-8q?DZOuR}UIkl2+^wxDE~U>62r<G90duL}ec
z=}_;v!Rvhy89pjA$5F_2yw!9Kw-;EQh;}xYimOAiCe=LAblt=X30c}Z^ilq$!>eKU
z=L4(bLw=f07yopSCe&euz{}%y*N583%R|LZCJ<<udj2b1`cFs3z@5*5=S?2LZZTOh
z+M0fX=-mCftTzh^2WNz9_fe=*MY9LtCa)?d*3a@qi?(>>d9e{pB3JV}tE*<z3t8Rw
zmU;KMuXWm0HmNAry}v?0w!Ja%tCeX&PhOe#X2`I(`)}v(Nmlo<c}eII3n69`+>#m-
zS7N0(Rgvx}Mvb%^N)+nTGHPqi0|+nMXd@OhagRtJcwgm_Oa6$opDq*967*)#6$yJQ
z?j4@KOGRn^Z91cC^<0dBOR(PAGlFFrXI1ICu1Xa?7HYN9kqLy2gVgiZT9>=v=W$=1
z6OHGaKTF7@#OHtbcJ~0-ie+s><MG5w9WQMtI1!edwdx@KTnKNvq)!<{-l{nyShmY^
z*tZ;jYp{{vZ4#v!(3$(Nsd3Z=!Fa};vPM4cMl!5Nz?P#-7lS@!3cegKyLkL(9iZ1v
z0KRv)b<D}L1`cTnm5k8*Pd04=<kV1aMm8iJcF{qFCwXnK35A|dzb%GNsU0X5B{4U?
zvV;_QFBM6M@VJgbq!gF#mF6BO#w;cCGzsf!(MG2mUG1}CN#3s?0?jXacHT{J3ht-B
zam}rbwH@b%3vZ)~)k7-ol}n_n@^xcZ7iZ#W-x_cU;`1PUqQJw}y<YJ~Gb*6H7^h9e
zG#^~)yl2J<=~BH2#~rVzBAcp3z3eSYkjY@lOyjj?CsZD9+9AiHJ`b;Irv=st`9gqG
z@18??sIV!eBK?&)T<Y}E?F%dE5cHyXii4CmP~>Yxe=KDh>xs%XvfW1->ccHv&WM)i
z$D3s*LaJl?O8%j82C&>tm*a&$9BCk~&T(;BsJv6%7nC#y`m#t_rOv^O1V5pX1sgjp
zH%@B(SXTimfKB$P;Ycvv`wo%<C!>SQry1FO7sq6%7EzS*B6&I=i9q{)K@G`_q0Y%t
zVMtchvDq3e$gh*-R5@X#Ge&_zeU0V%x59BwVASg^ZI=@j)3+K9dkI?jTR)`IxT{{H
zQ)!1sx^;_FmwM>!5ic<1t!Avo{8^zs!qQQ-4t8Ol6ILNra%DwYu3n`5(BgccH5mwK
zn!`=kq(mX$hpso++Rac3YREimQSrEnKgdHT0Ft#B@~(s|%}Ud^W+?D?P2+nYgfx2y
zaz1D1S*u|gxc*P>rETy0ibaOeIit}c4Ga-W>M#rz6b=`z;7%#nS@GMWKYzH=mjLih
zzCOk4)?THtS9CocCC?g$r08*Wsy%-+%DVi;<7KuUe%QzvnjVl0;^^<>b)GCl7i<uc
zt4wyecHH|-!<4{XN`X>%@OMT?o1>Vj?slOyDaD4#{h~7q_m2I2c6(;5H}X`1MzhO|
z-DU2UXNT6shkY-61m0bXHa#&8=$fXpl1|7Z&D6=t$be4iwzHP`{MN=uipjcc-H>Og
z7E63hw9G|UsBjRNPo*g^h!7}`t%of5L+9i%{2R>4d51H2*ZBwEIMqujY?<Z=qf)w%
z3k>=q*e+8CfR8r!9zR<%VSaT-mT0L+tvc(<wAGAtbP5JIgkis-q^Fp49;xgLjOqw2
z<DI$o6}#)*ztb#8*GC~n`gvblnATQ*#Z11Xu*e9P5eBWAMSBo>B}dbYbcD!vFM|(Y
zo^D1-Di%Uf1+tRt{1BqaX5S$Xo0N=AE2y_@GjiS*NQMAXpUre37BusBJba}>;+hI?
zTO38z6miBOaJ-b&!a~H&21|8P3VRl&q0_daVqsEvtf~e7E~h3uMXvnzWAH0<mg>p1
zJx@s1>nh6|&!@(NWmdi$qIgjY+bO}=rrk9^#dyn9_%mI?{ow0)p?s2+f~9?k$G=a<
zsJ}*>y8MGpP51F;HCi@yr%;J2mNNtA`OTQ+f2sY>?u(j_+4tH0KD*oQsM&_bH1Xl`
zfwhbcpgV1=6fgKnOJy;alMsT$*XVsR^t#rZWc4_S$hiElw(OYngWhjmFa0hwf6_&8
zOy0b|5lr@ORa=m5hU$uy%7vT`Lm8EyPiEtkQb%X7sg=yeeL)MSeFIT1JyX7n{&o}U
zgE|Y2e$xi{B;eS90oaRv&u#7g{c?M_AC?;VQH7?(rWST^izqreoCi@kc<C-ZCqk*?
z5~YLv;;j-t6YrYntn!a_k#@ZLW}|Vn#29k~L_gGQBYA2;IqI3ORcnBB^joa!(}d#8
zFATQpgK{$SaAtw~Lm{c+AAt<Rtyiu}ciq=ewHl!-R72Pww4*q;lpXor`zW<Hjba7L
zI#}*o&I`sQyq`p0sagYCEpw*c>-aR&kcXD;mPOBZK;~p9@`6DVKiyeLy)(Cg=%X`N
zslB_BQFYgp15gD6AO%|vGqb@kYjjs{)6%IIElQNu5)OqG90S5B<$iO<%TKZ<RIXwY
zTNyLJ;XFU?v3DW#0?qS5?;iY>R?x`QW+yo6b8?G-hagA~JWP)X_iE`r?6;TacuPr0
z(q-Xjdqm;b9CLF60!vL3l*{-y@kHu0!>?r(UkN&mcw@N}2f*b|IAAsz2NaQUQ3_kf
z&N^V3TC4nd-%uFEC$MEgLm|{<eVcPaew{d|M=R(nD*%?XGSp@1_)W=jYKUrJ!dXjP
z7YA-79HlQ=eWTf9e|~fa2EebRZUe=?i*``IK6&fT_nq7Nu)mQ5HfBCU%zY!7fJo4K
zetm!km})5R$UL=WqMt<((t6r2cAGI(t0^5>u$-dI!F^%`3(NZ4KR+R<WRTk*GnvfD
zX|I=7^(tSus>H1<E^s8R)Xbe@SUGlY2VcUfW8fOdD>DEfq>X)U_@5MMT{JNC+Pg;8
zJrjw)vmS)~AnjivDU8|%lX#q-94%^<pcc#5|7ef9s|Po)+H_jG%nQh_XdRpycJ3Lr
zBvuy4q&NvTzw9DEBzlZ;;{Rd+?9RqrPNRBx3$Wu;A2@gMVA!=L>E{iPm!1&7#&-gc
z*)K^cJmN_}0)Zy-KP2<p<7&&iitLGt3hsR57>Qp+`bYSbt@BlBRz!x5CIUNuJ+l)$
z1vnC57(;cihTSSBo-hBogUT)O5n~UW26dQtz46*O-b}2OZ`7`>fCQK^L_IN&ii02Y
zVpB*6okgu<E2}nK1pb+_e|2QH4mY&jPF){+@{GlHmmFtVC9M;e2^Ho8pPUnB*az`N
z7;d>6hR!pO6B>F<7bQ%+ZA(!6;e}MWf}r=C(QGSN;m=B=$aiSHv96XmA+Pd~o_uEh
zsvnqj_Lg9iTb`q%Zd{1?1^}qTzAO1VEVz|&HD5(?Q9MXJpfXc|)j>B#{Ux@Tq#Kc3
zXCzPhY#v6F>>h#y*0E+i$7J=MrK+QA=6t!scomAu%P|DwQBnQfgx<J6*sAMqw)h9F
z!HLP>uMF?y_)dROHaDsf$)**zf&(h|;pO7IudpNRsVXToECP@iXz5TR9Ja_W`UfO{
zz=DS`leGqGj0i}_=aFR?yCSlkdgo(%Y}uH9pKAcIO;{ZJAHIC$3B=IFKTp=D3>T5U
zs6l?hynjcNOcNeZ9Ot@B-@JL#-%dsgp&?FA=v&+d^b~|Upsco9MMf8Gtxu1k?Q9Yt
zXpchkm=L@6i8HBs47HE=tUU^;j8Q*4AY~_@Qg7Y{U=iawE2b1bMha-_@}y7ue>y5A
z{cwho#pv8L#dOiu$j+~_?-*rRvo=*9@Ud!rw@5Mt#+w~_8zI&7q!f)(GbXDsi`1X_
zF*y`Z7())2ZYM%S!1O>cl-HzJchDsFsMdIJf4G5Ln4a^&i2RrGY5Yg|aB39mQz{DX
zu$#%!PE6OV^JXb^j&#RP2Qx=Iik{k;dHibUv;#3VO>Nao`jC+%!;g8)A)-_Kyc5+B
zLtM|e;#A)=uP)~iG6MX#C^E~$<(uuxujo<?Mtwhy?S*z9ThlC#T{I|B%DV#v#J375
zvv0|@np-3&(WoyeqthkNX~iNnj)_1{YQK=+u(^;bQ?fx}fZFYN3W#m$?h=D6+5Ngg
zr3~~59(=mdCY{;9GDNh+#)tVkITCss_(kR!;<I(S5$ALv?pW*jsfALO;T-+eFP=pE
zL7}N7wnyMug<$_|ML#w@?ZD`tZkrAUyUmqxFcz37y%Ftz>bsa;m8=xw%vei%uv}cG
z9^rK%rfzHmzxsDznGpmy;3;d%SsfU#*%Ava7o(DW)pp+`UDy6=V-+TBIB|M)Y2cAX
zP`i#l1IPCeItsNM-u_37hxJ;VN#?VyZqkI}rqzO`z4gu4q0>s6{lH0m3%D$#*QNc}
zN9<-*7Tq?g0u}>WhFYhi%aN#Ol;^dVpRm)&w&zfl8VCO8$7I&vU-^f4P~~K;*1tUk
z#79jY#uKVjAlZ<-+>CmQt98PUQI;(2RhE$&4^?8YV9(9`_y}VSw_aL|r>AJU{as1g
znpunY2qO1nTY(PZ9PQzyZsb5mVvg8Ss;1JLzq1LbNgP%!Pqt@k7jpLvCt@%>+pKS6
z2@`;$Dj?u7KQa;&<i?08;mrGOO1F=M_L4P!<=Ql><`x<fO212vQUHY{<jp)@j<DLt
zBRN<lmd}>W+`eQP)@Z0Q=MTV466o^W@}H#K-6k6DTo$#c;0(_oJ&s7lI;bUa+V@b4
zpNdNW6~PICxF6)6a;u4?*8ejkegTm=nC!utOKdc5*P}xjCb?@*Avj7!4z?3>w0PJq
zdW+f=sQPxQ<lLl^iiC(xGfekP9m$l*ycUI%Sg<NFHIL`VzWUPQ)rZ;YI5pZJE!A-R
zAFGzw*C<`-JG}bb>nF?O)t3%t{`d#4b8gzBqftN=%FyehYSUCEYBKhU;;!XA#h<=|
zy%!(6a-FB%6R|;~l7;h_0|x;9%Tzx59pkTXAU>?!SrvGu$1mpE&@K=F`DrwzO?#X-
zQ&BHZ+O`NM99R<&V9aKU$U94H;rMKM!N;4IMo)Tw-w2G*m$sJX{P;P^!A&PGcQe(@
zkWlbx7l^zr<gBxJV01*FeC&lBjR-Pb_9VX5xNmhRe$5Kf+rZ=qTn0VBda}}kCi1OV
z?SLBOYNw~_p5nz-=ujBilR~#Pr%Iut(XeqvxDd_qy&eGA;qw`lv{^74;kM?dghiuf
zkzf%ryrR8DzcIf~7%OR`8HEFi@^6FmRcgKHpZu#-t!&i*Djo6^7tN)WOWSoPy0XJC
z`q@xssEJ7~Y8k0nY)`2e7<l<6jmr{zHTNx;;-Z&68?kjmwU$`S^4oaqFYFWd@}5f{
zyEC`soi}msPc$t*@PmsFy>f>5cAWzbN2h<>&4I=E`R~r!?CV2eCn?silD^$t_@K$6
zE}E1ia1ukf+q&<rhF&qngqW1wh2dGe1l=k#=jAtSnTv(Lv1w;|9{b;7ss3Eb4;&4I
zOH09;;H56o`txNvNi8F@DJq@utRo$w!-x2P*!srk$hvObio4@<td4ElPRF)w+qP{R
z9UC3n6&oGfzIos8J7?T+$Ng1%)Q?qb*P33>e5R~M^g%1^aW5mq7A!y_l|`tuf{oGM
zQZ$a>5c@=Loo!6Na%@v18HH~B{o7JA6i4f&hRm{@V?)8M(od<*PWugLnN1rCrm*>;
zU**7MplK+&Q$(G-YXgSoYP@v1^%RTMq=5xD*zP8uqxW9}84d?VF)3~j)?Z3pHWk-a
zyAVb}@AY@_4E>?8?pIB|>tw#aUrWU(xuqvLAezmTMaPG9+Ofx)Rp>6~inL+a_Eu~c
z&%}dbLJ!m2r`OL_|G=>Rs^PMrX5zm^=;7%!7GHwuiD9dxTPYvzJJ^%P&e3q+e8Cku
zB|$&WTw@tnk}kBj<h`1m?hhoZe)a?+x^|o!kALOKa{5#qBOA0o)#V>t-72Y7ybSOq
zIbZVK+?w1xI<hW@x0=M|lIaucSImRgvz@$DxeQ{?6M5NfYvQ>gVn^H$KA3_e)Csve
z66dziLgb0WTOb5qL9!ZzSQZ-9>vtnKzgxgyQ4J0$F(|3l8bt(rgYI1!bQyJqI-Gp=
z{9`9PhE8yVe}rE;27yvzUBM~Toxzw{co6l&?Vbn=)NY`XM<63hzA%*q4L7l#*zF#_
zGy9|IK)~3NTueLKuwJH(L?J#-|3ZNL*}n46ZZ8Liy$n3FM~eU&&MV6f;0O0I4S+<G
z4TZcjWqDS1sVcquj&7!K5q_GIH-o+6G5w3oYIOs(VVkS)lZRld`}pK5+1#tS2h{gD
z@_ACYyxc9j<Ds?2z^}fwxehX^6g6fYUPO8u2%I!GtS<wt`8s4v<@0T4v}twd-`^tZ
zzJ_9d-8ZQT2@pAtsP@6S7d$H^sku9m$_TuW(mL!vM0HWj+}PoraCPK{sO}Mom6m>u
z8uiX?<Q1*y?ruJ9qHTcF{N7#j)t+>*A3QVgD_^4SeCrIH-I8+4qq5zIgUk2No;jIz
zXUhBP@!2!2*cT_Hbt@oDRjKE_*rd4vm03WCs+kQ_=0?YBUoxm1>!VtK^dHZ?oY5?Y
zT`ffdVOs3XVRR&?z`*xlG2IsUlS6nsrz-BKoTq-oaU-yDj4GO$5!a5S*#2N6{1%kQ
zfgi1D<~VPj@PN9Q+kC!k^H(uFv@1$T?P82p#W7dlp6svCo~qf|FK%>fV7o?k0temH
z5^_kPf(;y@nDJjxf>Cm5aATNWe?S)c;X%M|p@aUUj>~lapYP-aCgnE6-t+Dpzk)Om
zE132nQ!+<`7hreY`oV|4Qi+=i<1NS)xolu?#<U`eVc~@dgG)1!ae5`gQW<0A0uq_-
z?%A&_@9;$Q3g@6OJ7wZ>@<PO`TgPPN#ppW?C_fmlfj}{R5C05ox}<{rrwrG{Gird}
z#^(^k9T&Ij#qu_tDp?X_$lAzc-4`7A)nzVpL!-xSwWvUc*X)IDi?8C-h=1B0>V^WX
zlip#aJA2xv!%J-b*!NI=FyR#b)wo7|)T=k>@h1ZB>)#Bfgv16Wc2gb%J5DlFG3%T^
zRX*fMFuRYw*9&U-YsIn`nQMldn;Q?C*>e9@4}L2v??~a`5F8ZlGDcHKOhwhtl^=|*
zpqGJfcX}Ow^0|R*bt9~_l)eEi_uEl7>l1B^z-aQXu1Ijk*tn3t$;^};jf8>C0z%H9
zwWETuqPMkrk=4kl<##`dy)wURHDC(fVvcZ8ihPh8qb>-JO7;K+OZ`a#BO1{pQzY49
zZkm79^rtryApthTCr9Fwc`hWylWm17QYHo+-prrw_q{jvQR4jgF<ew^-zwd(=k)wy
zEsM1cS*~i!&IB|U<zm{ghK;fveiaec_<-V1yf=-nkEK}c3j$i7Z~Zvr&11jwnMn^%
zdn9{{zjHgxc!ngbCdHwVpxXG*q+HG%cQNp0Z&9+#DP_dZH0WxtJk^2&prDbxvweMf
zP1AfAhxQre%U6Eb6Z7qgf5hb8(7w-p42pbc`}R1k>j~+misI;XEAUsF3Xa`Z)QJMI
zDAe-UH9?tqr^GkC^5;zeR~@;B1g2;pfXmCa6J)#%wpqhXYRV$Dx0<!eH4WZIPB+`F
zCvS)`Uczo7FjH`h6kp>wTn;isGF(7`^FA(f!K{Ih?x2VDh*iIe$MEx3i${H({cC*?
z?jbdr>Bh(smh4h_JtTj_W2w}c1Ih2;O<6M2l6VQeM$f4g#KhYA{+hPxGvTXSwHL+t
zIvEJtnAlH(<BUeiH_e6w;6HZ;K<oSg6Dmd5miUjB#LaiUZf&n%AR7W;q~>?+q{26%
z?K3ZyweqBcbYVZb%vAPvFnl633o)gSl*;apU&dXw;i)mUrS)`6=O9yAayxNJCsX*8
z``Ey)if*G_ab`b;E>dI-Pe!%^GElvd>SN&y&_*kUvM+6m&xqR2sxlgZqh{;49=fd_
z=}!8OW;OkzSsY7c2EFEA&d$yK_n{USpE%IAwkacE`S<wIT6H3uFS`UNVEC^q3q&+$
zycJh}qtT$L(Ba<cKt4aDU&1(&xu0oV2OvqtIwGc<*Ik4EnBr66;~Bi6-9x)$8l&i!
z`t9WCTvT7e!{e@NEO$rwWgKaH&vY8fmlHcnZ8IU^a!qIDhnn1F;)tYr`<sls(x7s0
z#&KzMkG48E;b_V<+usupCXlbqP<!TWY`LsoNm;-V=6EQNA)k1dIpAag$insqGh#{x
zWS=$>1exXU5TGhT_lh&kZ*L?x&X2DEQR1=6A!a;wRt40scDDg--&FAkX~GkyXcPOi
z!?(1(PV2n3SocRV4NCIoJTUFvuS!acDizfAkn*odLCbg57u%^YlOzfANVrwkXcqWs
z{O)4iN^U9-%=6Eee-k*Gvvr6u-u=yVA^K|g<jS`vGlRQif)Tz1w5bJ?pmyo?2U1pj
z1*a;t71#I>#d7Qv%?mCAFDJj7Dp@rp&mZ5OQ$_e!pZ1Hhlc!RPSL7M}0-U}hg06p?
ztA1AGy`LQ{^&VfKh@z-l2u>@&K&2>X7}A77`IDfS0JD2MX&+|<$TLT$_S?SH0A44M
zkci2Ir&S<00bp70CS?-=1Op8g-pUJ=t60e_3MJ%!;@}TstRZ--?r3S3T0`L%oF3|7
zd)o?CZL6Ovb76}EbJEg3uTKg>RX88v{yvC|L@3yw54V{KpuGW|1%gj<HfN1*LdrmF
z(Wp)<wQB1p#+v6?9&xr{?IY>BugWFB0Xkd_*LNuuRq{4E6fEuRsCE~ajMWs3J(Dpi
znNkZgDlVIbL^3kBtSq_vif=nlk=Ta&5r0bidRVC1GX4o9oi+XmBxR>0j_<(r-Pk;w
z&3n_J06H@K&+`&k=<EOyk!HN_v{MlLpU;Avitcr_^u+|?#?_y6MJwn=3@W@p!8KEA
zJU1<=sp>T;(F1bzd)WykP;j=mlj(J!kpKXHwo0h}+5ojJVycw%9@H;rSFktu$So-h
zi1}D~8axMEF(dh)yye(1W>+H&qoJi_38KzKM?NfyJH>KlF7}mMGc1uuKDu4+ztqEl
zEr?e-GqnapN5`+Zm=wGs&ugZ34SQT6?{(UF-F{H7_2(S#)&#mAF?yS=%+qCwJ?_xx
zw;`r@ICBgpv|kR>7{6Vay5&^W=*+6AfySErnL0?Y@Xl}t3&s>lnEdiL9mbICk3P2V
z$hlY_8)tttnn=*`-0iROEMe0di6L9xfK~a(Dk7=Nl+PY_lc9IF0w((;_lMhR6zVJg
zM0mzj&PU=66j{x}F<jD?UqhcW?P&cNP#O87nb{E9AF>pmJw=+TIaKr5e=-8XOU{ZH
zf=}54z5%_y2~MRj-EJ?0I#T%-<_oD#Y4Tr;o=*QshB-Rm8zkD2Yjp(qNXGU;0_<*U
z^(RzX^e`WQid%MzL{hdlf2oTfLvUZZo9ChfSaQRDlooq4X^L=$_s**B6e=o3Fikqh
z2!(?d=(^a|WQd(sNR~%GM^grx*VZFTAl^<EimUGlm)$1l&Gc$>5gZ-4r(6>YO2O2s
z^4ia&@)ht+WGpIoWpi$>c5-d!-#%x7^%G55qNQ)Cz7Xxalf{n1(6K+eUQ|&sWkE6=
z^5~J<B@%IPs~=#P&&@7sd;TVUyd%>9N6m`o?@tNv*OIINehC8s$Pi|He}JV`zJIyk
zW`vl7OGlMI9%_Dq-bm77D<8e;3Sc=sPCD7wjx|x9C|gI5VXc_;)Ny>86z&D;Opa~l
zp1*9{ftc3E9)S88B}^a+g4T5Fg}Jey0Vq1sRud%QJ?Tuwk}Q2=y)8hg*K&I34}TS|
zq;!vc-E37^QAw7=BIciLN{Wmg;7U4PlH{`9u%J<^YgTz+Hik6UJA#xxpOH>CBKhWE
zw>+%hkG4a9E>`VZSp4Hr%<@?^)LA%d4W2Ip7kX}+CI?rL9Da&lb{`-x*cXj&WZ};%
zjyC@q=cPLgXnZIRue<9Dw)9nng%hB}W+XaQWr*Bcjozs-@pDcZEyE$H-iKwL20zqU
zx>>f!BZL73#FM_`i)L3iLH(LaV7l2}j(v2fNOw2?fPluEQoIIl!!jX4wLAIa2{Tf6
z10Mkymzh5|#=1kzOjQ|@Zei^%z`=UrR3m@uQbgUr;}|{n<L2mK&*8+L<G$64BTJ)#
z$s6^e$JgPZJiEg%g8a*aJg)N1^Lc*eZoR8qQkb#57r(A2E_Qcvl&?Ew`1$WaLYf8n
z+2r`4aJrnlV-78R`mFg5f}-HKT?YOx$Fo|#S01U*PThdwzMoPneM+{yP`bu~IPi#!
zseZl~3*yjpv37gi>)Dm`@|aR%?<scQ+FJv5!3#*3XsVv7n3T>O{zb4k2`ZtJc7I(P
zT-wAaR;o|Jwl~uahCuBhbq9p=`D_ahMvE;<x_t9~TtdhY#bNiRP<1h1bsaNIT#Xpk
z(eRne8&i=aq4LmO!E$*)M+9w+^Fg^7XrbF02`#BftWnw=KU@xhsiJ=`gka_=v9eEk
zJOFK%mjDYztQnP)(Iii$DbzSB?rJ<H?w(Ez;}S7utGOnRp-VEHPOXN+M2JMn&wwvv
z3B>vpzOzuUw~h-8w=Ah!+wbM@+DaW6+*5iWl!mg`ia?R?_Bv%ypC64a5g8c_#-|<d
z#qcLTG*bP^thg_DMKBLBuMh3oClWD>l-De&awd3mP^~aR<#mhRq(fGG2d+lWtP{kg
zJ4^x=9D1-z;FW0#G1=3&40=dg<ihHqVRnYbvHjg=Ta)-0gJuM5wtqI6^o<xj{9#P%
zC3`{lfc3T&?I-y%Df*UN$*bJv8ury+Fqe^~9^y6s(}%{m9}+aQMWY)yxm04ga{3a+
zbmZe!<5*+zrCz{hD3J`L*piK)nPUYDN^rV@a5SR+TJLh^oIpH8DJb%Le6J!5=Z}}l
zC9#h76ouC`!a1GSQOEb&^M{AA7vmm=4e(M?&fKJ^#~!A1kiC`0Sa^4D`j-3H?&BUY
z#m}0biktw6CdH=hQ^w8~(SA$LcCduK-*q`Fq+iqUf-wp6Ts^MGd$(akkVXs6s!n}s
zr+H|Ojvwczk}rzLDYY6F>0R^_FL~!|mTm3Nfk(mmT63wXpOYYf-JNcOu2_<)qdwH{
zwCy#8UKiFf(>`%7LwcIJ^UqYa9~aLnjVit`rdAualrA#}2p~1x6asZR*yNT)R?)k=
zEO=-#YB*2tqLU$k3gg#4hFX)lbW?5Ap#0azQMpXqCEn{N{mGc0+66k=ojG1gwj3F)
zOoJxaMbGFFF)B}I$iyJxoQiJEclq=p-qs71<PFg|1O&FG^`C{)Eo%7^pJXZtxXi9B
z<#y_AMt#9|j+aXsTivm*K|3+DLj^#lJzuG&9++lhs;}Z^7~JqN0y{nz+t}#AW+h$F
zkHOndR4wY};hr&)wK;JPgY$n4kF)p&85!K6P>rZe!J8q*=Lr2IOwC+4v77TgWV7fA
z{B=?U8>)K3LA6+Gn<0yBV?wOh95>UQjooBQ%VnuSV4NgJr{jK^cjG4_?>-#|uh0g&
z8Qxf7Q8L%$O>mESFZ)N$q4=A*Bu|*GE>MBO1ckMsw)OHLZ@87W7WzAsx%~GmF4bwQ
zU^1h<Z{6m233tQy9hv8oqB!Cs-!_X8Ure;-b%KZ`kn~aOYeSMVmD3>XrG>&#Xf~cc
zw2GyGoGgz44ps{XT7`fADe8Lu#d<Ie&Sd*UY|3*!B>9S}NOmG6z*s65yB`KT`-65P
zJ5pr4&hEXJScy0v+#J{b3LNB`RK1x%9`WsQUwqKu@k{K77KVsd@@9O#v}0=Qi@bk4
z9JO8kRCqk9QRrg++%kQU9?`nL*t@LC9R&$ag|~6@*p1XBF3a4e8nfE7*ch{7Z@FGO
zVu)qoY}6M^5V0Pu_^rZdDj|C?B&$t7DT|O)6nd%6@S5DhDw15*kX$e!`2`0H;rU25
zmxsQ$>2uBco@VY7<@E52g5u+4@rYI7NaxzIpw*LsML{DgMs)J2CKk+3OWZL=e5XeO
z^MDK#^}HD;CD^6^>ERp@Q6NrX6`3UOWvzhqSvSZYVe5>()eHtmqaCL(RpOB}<RrL2
ze~#IER!IcFOmYz8Zn>N*yDN}3Ic;mm9IyizBlZr$q7@_$7DQwcWo(JGhwZA#0@3F7
zzmk`5hf!9mbW&XJKvwMWP^Z6|p`d<g(u&AqKe=l=5{ikBM-Go}_`08o0ePev7&M3I
zOM*)(4x(?i6ia_~c=f>1`#=aI3W|vpU>H-I<}oN(!!7ZMb*oO0D*m@wy4FD29}8E!
z;Ti`DCHU8HPofg<Q{fqeaeDGU)nV3})jNEVA(QKX7~93%OTfr8Ge^FH4oT@ReNFL4
zd#%bjx9*FIWHZ%yg_B*CGUKI4BxG4AUbgYQy5LPvy(w1Q)i`ArS1sxlPO^+{teZ39
z&tT+ubj>8WsD~z{2BAa0=|!zB=l%P?l5{hDp<DxJwBYO+$)ciB_t=;HAk0+ldhc%w
zsC?-)ycIYd7kx?``%PkCylLWcdaDhLF0&^EbCan!WMn0`$R&{LhcW;To&voM$5ho1
zE9$TQZKG#Lo&AZlyk`Wr9{Myey%BocRZH?Ms7j?;I4iRvGq{<38v8^Rf=k}LTLoVO
zaq6eL*@4)Y6zlT5;9y&+uyJ=PyCE3qkFWk=60&YtkGrmkeT|Xkq`M~N+Jp&KdNjIh
zkJ%fQ-Xt;XSZ8ql$a={s9Ol0gl#--g)94wr$Ar4!6q`+q`g=oJj%{qmBa9*llm+w6
zw_stz1<5~AJB9}X33;PSU7l6zj5-JxW6&%rla)&!#}XceuMwKMQUtTt^^lmJuECze
zyYxo$LtE5*-eN1TR*e7cf&TyXJtx!Le8%5~UeSam7TK1orKU$^$j@Oxa1HkV*z&<x
z@?g{}a(DM5GII7WjFVrUQtlh@u6%acYaQBShv%2LuOcWNsk8Sg^?b@JG*CEz9m}yA
zK%_WycLaI75dgq4-|8~lpmS`k>p3=9Cg$mT#SuwA?X7yc0gWpbGplfQ<YJ=RGcA|r
zW0H)UO>6$azeZ)o5G|RPy9@+om2mPjZQZWcRf5~%GHua_nvq56lpZfP+EC3-eo!$V
z>*-<BFtLB(d)H|Ze>C!QJ<x21_XH+A{I}n@?Pu5+#0?nVQjB}B>(W*c7Pf^=i8UFl
zb}8;NVyUquG#p*5G3ghen7fn6jVc|QrH_yird;L?M?#OB0AB~}2{9VyA=4^<g7O}i
z4o{Gk8WK=I9E^sUF7O2hE(CFXo`FIp<KYjBG(6`$bmH1&6gE4NiF7O%4iiGIF}GE4
z5Fewgfl3%Jp9`-Y@mulQBC~g^PBJy9(?oW{ed3k1ho_j!r%|@*)n9O3hK3KEotcee
zt+mY1<k+BjWxCB*oDi*G;<v3CRN7SbJ1+1tNl(idmQskl&ZK<;0Vt$q_7|k{{JWLd
zEn>aq5+S|kVJbLHbu*rANA#_M?|>qljBcT*b#>bd4$PP^D31IkjNKwA%|GSp0Cwg>
zr|Y?R*&-a5zzThjv_E>xcPbalNsjgPTnky$hv*F04F3f^+hm?81B^2V&c#1C3Lf@}
z{<qiof6>ZHFd*E+RlQ&B+Hjpjt(gr=iTBR`AeKGkAqxe1+kV8R2#;qFpORIk?8@{x
zhWxGRI4VyaND5eM*V!F&RwoD7*f;z&AjKtv>v&Y!=1ID{Sub45iuj8Wz%K+!c4hry
zCnFOF*GR7t^HkxJB{SSQZ+2JI?E35ZYTQ6YVnfBrP*+v6%dFo|J@C0~Gm7F1ndb1P
zg_@&SzE;y<Ud?Ges<omcD*jK|<j>I;ASCM?i-+)hL!H-CG3T^|H4M%FU;*+@yb-*R
zjcaW9)Lj|WCsA?y!DDv3VHKXXlqy`M1;he65V6RNQ8%@`D|P7(zd-oC{%-AkKYfvL
zTh|5>Tp-N7W7;`;4FhJp$tk!=vtx_xNNarJZ1xU=f?4~n4%;S@|02gP_Tm0~4`y|B
z-1NaW(ZG;J_C-fF0CtlKZiz8ju@XQ&Ux6}=7d7jwDXf?kxQu!o_8!~J>07crI5z<!
zSrNs^H3RSKT6$tHvKR)X43{D)K)-|uz6(1p&{m#G5l_`QnSl|3(V|IAq19vDV>Sc@
z`@RmUJDgFqCAX?0t?B_f<`Z#>O^{a?p_I}K|MD;*3(x#}SNY3go(_dP=QB;G2nRuR
zzS>-OPThy7_IV+Je?GXxTwQcRK1i1A5K<3RaE^C4g=n{(pJdEH1I+a!(f2x~gK2N5
zAE3SQmUB4jNcRFJL()5}mm;=wmcMx)WMY=rtfk`3rzoI%XWR0tx7QO?hCBpQB3a9*
zRj*HIA|L*{$7ti4j<n9eoC1e)A*Uo!QALl}B`PA*o}_;2(K3r?{@PF!*-5xvH+O5(
zZcSZ<#x;j+F^z|Wab1D1Rfae>hv>{dUNW@D1JCgLjq&yAn-`2sHj80CnvVq&SYM;!
z#o#QZ^nW)`n~kW~+$f`+M{$)vp{?V_o3=iz)G=-8b6;YAGbmXRD-Jt%SW)(G^w6Fk
zLIBK2x0-6NJT~w#;eAaL7i;uh8-qfNX!~m^V&49ZC>Q?_UE@bRNX`@dK>(NiPY~ft
za8Nn0XifcaN$Ph>^ZTfo0um&4e$gFw3X9036zy&udcmXh+*VdXZhkoC(=wFnNG-jJ
zi>gR)SAx5OH1+3owEqW8Hh!wS&{BnMPZBM58{J`FV*}8eibL-CQMjuFw7hR=&N*<z
zrFA-!)_M;QffCL@C(YfWJkZ)m71>@@J#wQvJb=J3vw;^la4%N&)*l!9N~&L~fvpyK
z@})S~(2H_6w!p<a`%5*#L?8?3>85I#>bwrd1GVY0#mb}Xb4GSZqp#|Gr|`=mP5DR;
zTp`Z)&QRotgDc#FUj)UJ<vK9-M<Z>4I&VUhPP^@m2i!ROPJ!<$V9YW2Y`m|A{wqeQ
z6Bg9RGyb-GIkzwbIQ(#p_&PBw#Ki~6O*XNA1Yh;DO3?u$gUp{rPF9ZDbQ&v1j#f=J
z>~`8)vz)D9gp*t(xmyayEs{J51~AGer)Os(wnB7>{}(t96!3*56)N2od`?`J#G=p?
zaxYS}fnl{a#$(;B7(%k-sbR;f88`Ie|MrzH9|mcijYF`Kr9{rHOcynJp(0uKhc6Nh
zs|;9pnu$)8pFyhgK4hiYG|EzD8b(ydYqxD?tc`W+G|GsYdamY0c-4nk>poXZHV{}D
zM>#L%uN;XaJD?t{OSvzU*~^sm1xmgrkDaY@w#Nwev}HXMIJq?`>9t|f)?2QtUe!7b
zP(F%}siGEUw|>1J%E$Dk^RSqF=cQ@$y0(Wcaefe*2aI-w6N<3#bA-WQZWns5j=Y>4
z5{v=5h`bWG08;#><u~FYenBjPu5}XE4z3=)1b$H022a=T#I4iAe8iqyw^N!qkJ&3L
zD`gJur`&C2KLFe>Fhm!-(7Y|@E5-R<hEd``wq@ROd)n`QLPt*ay>>?4l(@^4gbipp
zP7M8wG)Fe@)>$tR)o_k^8534HM#60KWKGLq*+RkjvNxKW36Yh6-UU?*&PZg&<fPp4
zA5t0!$RR@`EULyCO<I)qMCX_L@AC(Nr)Kw>p<k3>a$kdVu+ec+X&?~^<r~^Ws}>WV
z=_3>Bq$#M15~N^1$T?exNeZ9x5?WI=su2U)RQ8^IVt2PxE!@T$V9*gInS4`W#`P^G
z2cu9z21hctQhrs-EXT&~61~aYQB_woSXdqr!g>ZVWy>pcr%wLVI<<WAk&Qp6`vrlP
zd=0uC(AH`iY)6N3o-CUclH7+9b@M~|z5b$!QUXunm|KeH=_2qPwMn}zk36GEg_b&y
zAtMrV0^z0*drO%b8sG+x8Zxz=<a995gF--TAlH=<%c7%<%^)_=oqC|ETCh~-9as&Q
z;(cxrSnyWWe1KhYkNLhTLjl1`TSdq4@rw!-ur1gY22iS!pRnn^JQe6GB*2r8prNG&
z1jFK!Cp0jc16?B0wTzgjh}*jSkjD_*gCD!yFyG4>KfFa8giMsBu{^&EUG5Fw9PCpL
z683kXZ?#h$UMe%;vEHLXN*`9hkBKcQP?40#?HZRj>@BTXP3gZnI&V_)<P{zG$L_Df
z?Lc|VMn@)}>{QbK;1a~tI{X>QDoxdDL)6TghEw?i#-iN;3hQl5B-Z!|^?FB8BVqS`
zj)H0F++&kYJw`W1h3&elWDYKuDxqSyB6=kMu*|*6NpSUDe^N3dA9u?TR{lpaV`cNi
zl%Iu+{$Dwlo{OU~Tr}&>v$OW4a$sUKgfgj-N>nryYh=X&<=JXfI*V5AcOZ4yF2`zx
z<)X)!-jpVQ(?MUr!TjQ2iUO;`1HFMbGk#e$eN$#U=_&T0xAdu-ZO*qxzKFl(uo{O4
zA9u6xIGn&zxMFtlP9oY-!j9M}W5$<#^nKOEuC{%mg8LYLsV>EJeLO!}Nw=;kpRxg3
zma!o7II)6NVKP79$Dr#)_1U^ax%jH|9xTL7^Rt6K2_TD?CZ@Cafl@>yK|z1F!0L*o
zpe;11{cv5~5yaok4K(S_OZ{%kX6=THB?z>*v3}~ZNciArIwBkF1|{P$HVeuRpfpN@
zHaxN4cY2c)Z1P5Os0tFtG(U(m|4hr1tnHcQ7CGz+U{LUQQ_I#Ap1VMsDimIMHn~5Z
zk(@H$ISFlr*B-6uqTGWZ*qQ$l*No<wl(-QO6a7-%hc4)dJybxBe`mia4YPMwmM#Qh
zn;bLj(QxPs#j%KAyi?kMz5C4~ghMzgfU$m1e!eMM6(|~oRCj6o3QRt9wtB4}9&e^w
zBU4VvV^Q0Z?=d-WV(c?$)3YspnK#_D&muFM<30IX;yIO=#;$bG>UM>FO)^_8-y}lO
zARwV2`6u*_#4Dj=c!VN&?2l`?n><Bj5@mfRV*?9Cf(x7dkb&`QW>ay+M3aqbX~7A<
z+swehjqwv8i)d@+?{s<3!n)>}KE_OFEoOIxEF)pkr1QmZGsWfrOI8ERz){LGH9251
zcI*W6Q?li%oT-n7gWTwZz<}@+od`!)x{Ax;YYQnU$bqmTyfZtIfm=+*FeS;|1Oc?)
zlcTo{QIXurtND3A@KK1;szXHo#MF_h(=XMU1~bF22B^-d?DcaMM#C4>Oc88nXFnvE
zRSVS6rgRJKLk;PX<~-JE`RW=>@=g5Q=v`QI2NfTtk=GhiiRPRYRiN5J3iai4GPY0l
z%xRI6iyxwa@&k3Pd)j`=aD^yae=YMA2^{f@O1>(ek(U8iy{_g?wT5;3sIwGRdzKJ(
zWw(Jvpy~L8<*vl*?Bs)lGIlvbejFV^D*}>>0!JFmz1SdDajOegfqPFDpLSXI*k%(M
zssdG5DuSCYFE!#2`;=q06*L)n1zW01r%*^x)B#uQ_S+kPzaBJC6yddpW{c)f7CGSM
zhYtc!G8pm)Fmk)dskvygFf9x}ZE2k32RIRcTwRjlz{~K@dGOfXgm3|;Kk4|W!~{+0
z!wb-(mbIQrI`0U|7BBCc79#q7V1)D`-lX=`(dhkky;#x1NaT*HYTgpV`8Ws5=F5Y#
zW%U5XsqPG&$VX4adb%a%ulff$%D9ma@N|d2m@VqSE+`)Z&8b{`OT1(d6bcS^ui=`k
z7PW@D`RK!x#v=@8ZU{RnJ<N>#fY#sqU;7h*&yi0(FHOnUx?Bm^@*wf9Rk+wMv@#&h
z`Cy?e{n3OXn6FXGxsPM|{){1l<Mr;Z0LOdGF1Vs~NE*osM#aulFcb-)tld@xHx=EP
zR|7{gAxl7o4+<b>^#il#3T;2;04B7wE1K;{AfrpVqrzpZU~`tv3?+_bdoB2_JSPn5
z?WxaLqdBKfV$^L{@#(5%awsmfDI&9`9J2e-C~rPzc~MyJ%WT>LYAkV*K1guGQ9HIM
zgZxc8$+BnPIJ8?t2d=1SZUu<UUw>mP29VPH&Tc&lEQO~TsbR(5GSnW=ukdiG6P-(A
zIU8H|1C}T<fx=0Vt5I)z^&*r16b7GwaDM9-oz`w*a4tfjK>Nn~G0=jHbW_ff1Ouni
z%CAJCC=uxJPWl~eII&*)#{a!hA;6Wc`&AAyQN96_pd0ZUu{DqeZ&c(d-;AZYV^xwn
z9Dp$#zBdHKi>!S~FB$+8e$&huJ34!;JlBbis|5J%f%v6`0n#GReqBzvtq>{9qR!XW
zaMv2HrLuEuwtt;(`GCaN`PSYCIg}(sVu(h0meXWJ!i(-K+4KlPkegT(U%?RJXst}`
zZKdv2N!sYJbj*Hnf9}!K63fxrJDP{PKZIs7GBHbVhksL>VviDCvo|02;&p*WcZ{5Q
zKts7qh<ztMwDeIRa6+o-ZgEixKHSn@bN~_@vL8=JU;^B968~cwZ0gLI>H;2+Sahh%
zPR5L_5!r46Dp<1&KSIXyZ9L!sx$=T7YWsAl3NmbVCbmymb7=}~S+VP5Q>j#t*wX<v
z4Q1n2Ltzl5?`=NTe;u4U24UgGRN*4W6CO7X+lK;#r_bb*)M66N<ZF;~E~moOlA}_d
z@x=r+Kv0$HSCP{61yq{c)45ex+LiCm9HRF<7R_cX=F2htDUqRn{*)UdP?Upd0tvy-
z;wum%KCH>nWGGmeN_5na8K1bal+bt}bmv=^tVJ&LjEDA3Q_SZbMUpV$3&3%|RAnK1
zO!}tvm>-kt1T(M?QVhDP8-0u0o6ev3<K!H!(8L04-?vBz>g2PlYU&j!X2>#7Isiio
zyw5{u+NWprqB;kc^S-lZHDCyFnI}qS-c5V12(29F`9JpE0?U@DSNk+GxpAX$P>z>d
zjskBgvm)t92=1DsUebdVLExN&uTWw8Y`jHut^iDL`=#5s?Da4Vp7=gWv%Wm*eJ5r@
zN?L&`8RQQ_R6lX0!hS!@zMJk3AJi@TAAIB~XI>JVmFI4%9MY>TRVIuwGz-)m_Q0m2
z=Eo6%23ba;FPr{#aPy6z#r5DA-=^CHKw+)fx7A#z$+4UcGFY+V$ygYBq;6ZNQWhYm
z@+)%se<LjgTzd1wBm9DDS=8jRiJREm<_KmEQUbargp7+_7@M{j&IlxxTlfQOSxtVQ
zs$!`(#ydn5s@bjPo-Ue9Ejmvz1{P}EF#?^XIWD>O+e1c-X-zq4vo0N($jB&+t=nu|
zZ=NIfp(kyd%73>M9+{{zYWxjEGrsJQyz>@JT`72qp`j?&X{@InDPwJNukwamG!syD
zB-fm-_<5?b_?xO>jeGP)A|#smNb(z+Tw|;xfJSZ#?baI7!N+$@L>aI>8_DI`)NEI{
zD0$_N$RX|=`3)QT7KtP65ha;txSS-)1!LUPeI^PA&ip=W%d${iQI%GWe^h_6RxX@{
z?qeUwrzt<GdK2-K7Blb=sjzEC`q!*8nfVr6kn8q*m0~yn7Xv8JlW_sD?*JH>hnn#+
zOHZiXN4;eTe9nUd+D>xt>7+836MpG&M$=OG`BS&6!w|Fkbn4hMb8lm9fpKRv;IUe_
zQ-T6-s0DXeb62iOkymq*ep-m}GavVJ*cn@_x!T1>6$^bR*sbskf#PF5UJ8=-!G{+=
zCTy*Y3u>wIODaMptfVO+8e4zRyg2G$?=${YgeXoj`6NJ12{W|W(-7Xas%W-Hoj>DQ
zXsWCcY0=~zjgn(sY8xz&212JuMZgoYBL;KSq}=>h8ssM19b7u2M-s8pbqg^0Bx&o*
z#8-K!U2J6MQ<q}~)+DZBr|r#%{0G)YUzI6dQ<rjv*Jl)1tYq@x2$Y*xxjV6G@!C?e
zH=+f^lA|(Mm)|Yo$7*!Vjb=qBDbR-l8k!`#RwqW=r_4?41`?xnmsV<7Grcxj#+@$?
z8PS=t!<{;F5vUVde92XvkVQ8qA2ExqG%wdpEJDxD$=g?aitTyRs?U72D?AjAu7b)s
z&AH-hfB`X;($Z*71HBp4M>6ovRi?_Z&QzA{2`fA~Myk5-)<puUps5sON_1Ch<~Ncg
z4rqKw<_YbglmbPQb{B8J)t!Uld}&((n~<zz2!gP%@VPoSx!{x{dB!a9wIV{8eQ(KQ
zlucO`=teIRu>uY#^VeCgEiOC8oK=)GPVN2UpIVopK@)}xe}y!3C$B{$3;y<BJ&Duy
z;SE~Sd0Y>RCibXmtWP6&rW>7=6c6H)y1mRL@=+Zmytp-}j?m;DtnnIuTP4fo_>LWn
zA>3N1U?3=s$a$vP-vua=Du(sCs}?*^kp%nZE5+%fRDDuEn}nBC_PGbiOO~}RI$pWG
zQ8-nQpK{$^BEh=s1I+50@<qYJfd#*%StLK?LmF<bO}S=;TyO49s4ODB<q5sk$s7K3
zX{Wu8Iv_liqogS|O(>Jn-z3F7rEy6okFhGv;+3oh^)lqRM4o%tQl6_26Pp5Kwr@%B
zr42?TA<9Ou=zqpaev?f0QCCej^##<7R~1M^I_%1>8Zi0-4T;b3i$RFJ<hn#Y{mcy>
z?J_d+l#=|P;=*RZ6BN|^#=pD1rJpCBeKU5<=AvFzs+MaOD#sWd<|PcvGz*5?<jMBI
zAD9aviZLDz$f%)>)ouGCI<F%~9}sZ`=PwYm`+j{G%et`35o5JKn;UEW{Zv4b(=MKc
zgg`Qe@<91Q5~#*eOi)y@C_0WQcmNOW+lR}gOVpMYyFNa3F_c$Gt~d|bp-ZE%@<?S(
zy^5hX7=Siyuawz_yrJ>MYmykP{jWS)Y??Y|zkXE#rNj`K)y?o^5_OVcsC#*z?QoV%
zBM=>zQxf)ahU>ip&sA6d1_I2&9qz2dbBP9cDbsY58JoOECJ1CLZq>wK&)Ok?1#9mw
z6*~>0LRZ9vFAn6%kfbQh-QFL2`pKTfG(Wb^IlKFndPQMc#ywRQKN~SbHeKhw6X7uh
zT|$$S+}(|4#48cYbK)FhmxJf=OGxi}zRuQ5S|b$u#y?1U4GVZZb_4R1<{}as8#gu3
zo802kPTAqfV^bfgQ(0`(p|<C9nf!CuEkY$K;Uzw&4h?E|G@}kQ9Q=ZAggFAuuxb;i
zE<NIhq;@qQwz-Bt{FL|`WPT_#ghm2uPr3j}OgA5w61k&Vq2_tUhp)=+eT}-SZ@gRX
zj7t`b!ysh^#^I6@!GEvYD<n|M(|mwlT{TV}3Y*zXMU<w{S-)#v+_0f+H1MD&pS6$Q
z*oX1rnX>rIhHSHDN-uimi{Wm|f<aj`Ub?FdaJF_RYu=RrWfO9Y$}lK`pdLSxD4v~J
zWX)&wBbtf1ah^*TUVwJV0!K9?RRW2{r$xAoTgJ>w_E>uPgM)r#Nvp;L&(uxM2dlD&
z>;P!WxuhVv{Rsmtoz}f+t6U>7^32n9{n-+82o9mm=kFeyy)D^a1KsDQ+?3y9^5KSY
zPGf3lQ+3-W-)!p25^9Mrw>{tpn*%)B6e17V>*HP7V!&X#o;JItZngUyCEas66j*d*
z>~$$gRC!wy?%GpM)vBWvoxSFOUi&gGE^Ls%f{FY?`d1)fGEvW5UqN)A$%NX>HV3>V
zlWT$IyUsA0)mi(LeA5c^E$>?QKX#817jN>hGb8EUrjkQgDu0Dfyt?Ci-F#csBklU~
zQPqD$?aMbFqS^2A#l7ond%ol8cJeRYT>%+nEw2BOv>1q$*>fLnAclIscaD*=ZcMR*
z>*68`;zz6goTuRL+2Tx*Ip=QuxrR<MSM%U*t@jfm3uv8EAu%C*vl8}WB7#26r63y!
zZPiK0fkfd=YMs}*WnRJ53U$e1OQG6Hr=ywt!f>J1`q1H)ZNfMCdKvHF`>`Wcy!aR@
zGB+MeUJWOPG6>dVXq@_K@%(7MYVra`f}hoGtYG3m7mgmmM~DsR_L_`QVs5{V6B>fN
zh!P*-;=e}<+7{&*wu@#NtaJH7q42oU$f{4!F|xj27KbEf?o+hqCCo{S08!!$#$b*A
z6&;4R*@n;VK>9=P8~=#1mnGd7QT1^;%Uqpvgfs%jzrXPPOB;>4t0}WpR-MXe+mt3b
zESaUTk7vG?k15dz_~$`v-jH;fH7hkRdv0-FQlhPf2$%Dp_cMk2&*wiI`S*+e>mjD(
zI~^YLCPkO9U%2h&3jydGY<uRB8S6G2V#X$|P$BvNmB-~CYOgaa#@kFW(HlEY=RZsS
zX9cZmM1~WSDzyM>U4!`_ULW5)*y3YV5S_ZvPWk!<@X2g;->%lzmhVV+JC%GeIl(i#
z2dc_UcxZ&y&zGM_Lm*Ck&T!f{VytuZqqdCCm%w0B^w&~ZJ~yy@%7g6cbxn;;2K2U|
zep`R{NY6-#e&GwS#<NJS;CQ(m)GEy;%Y=aBi?+sNafV?{<I|<xoSB7Xl5zAG5}oVP
z{`XCpk=cC{7zAdVck`~r(=30DyIw3#v27PKu(u&!lK4O2lY&a`POt_%AYcDcGO```
zY0Aq*2T4GSK{zvs@S3K(wH=MvlsSN>ShD@X8}<;Q;19M|cVt?mx`NcP*YtGfVN~5W
z0c0-~zhreYA{A}%mkZy(uG>c6mqg!OcBI_wfsD-U8*6aMX!1=abZ46j-M%-yUih`F
z?h@SkS#~<p0t&N~UlHF<Z{TH1KDw;yVIJxt(4*q@j`V?oG=m!p+a6@V4y?UpWHOl9
zhN$*D!CDuMd6%STUEDF$aPQA)Z0QP7N0(MDB1&sTM3p%?F{qiJN=zjatmS6T`_Dge
z#wc?;dIpbK?(WecYdMh>G`oRFEl4q3GpTk5<3L=ET3Ax~uSgWC*KS`4XiYeMQA~rf
ze>Qyw6MY1myS`)GACVS^&^c$ggiJag5E_@?o+z!al-UWUoBh>S0r_@E6l(vt7vH?x
zj8q9dQ_ocr_2(6G{SB4!q>`H*{!+_#2SxeYA4^9>)o?u30>U3HQUg$;>)kj9O^;ZC
z^yg^nYvTgv!<`xqII%sE#<JVV9d@^`?3G&IFZirbAb$>eMlS|ZV5vUujzFVmuU<B2
zE!Rdpy@x>&cG6i}pGfu4j;!M|EMKu&c=b4>vz@J)okH)wW_<>_a&a@m9#i~g4XRnM
zpDkW8x)l?8xjop0!=0qrV=kPyh>OoCZNVm@=Z4i>BHRc_+e~9ds%Bq*0He&;VX)||
z_*cR+uAyVZ`1Fr9vg#uKk`i(+CUc0!K~c`j5wg)htkWa!khtw*AEwv>`2WQF+85~`
z$p6;IoU3A2>B2T6a?t(bZEyC-1Ha^+LL9PF?5VdBdDDG=ap6F-3;VQB;*|)8NPOdF
zi6UA%O!o{x<OGagi0Gj<{~V5!L4TO&)`;G9o6wG)Cev4;{)-#<;jgXSh#kcr5gQ}$
zY<uTfZfp~VVHMNv5Y2WLNO+DoXYnb*ef4zD|HZg%dMI&rP#+)jnZkEEQ@xdD<xaw&
z@F63$rv4i1E60h@awl>}NxZf|B}${}{Es?|AqUx=cNmNju3bCb=c*J_9akouO-3+E
zIoUvzUeLbtKAnzd@X`5#;28q|Zm?L9*E};M(0_Ec0fSKox7VZP8M>l(ef^3I?9f@L
zp)Pu(vFtXG00xu>yxuSsdbO`hyV8D!cHA+At3{~gnsaY*MeKFN;QrjbyypT*Gtiu$
zA!+n!fMU>BSH00MC_e!3Q|&hfm}P1YZ+f(?!|9gP%mXF23$6#Gzsk0ne)cb%&aShn
zEcx%nXmWX!2*XqF%6+3=_!y!Jvbjr>f=g2C_e43zk+;)Ra2PAN?7=+_mZT<79|97-
zQ5Sw&H~9dO(%&8=tnXlJ;#`)@XO)L>oj-kbq8XNU6ZgnxI)nDMKpwZkD%bvq$N!9t
z?HOA10&II-pIKsP#(3)dsgneJ!ws|jL<mhWn1Uaf@U%?&0uUuKv>~j%fboxFR_TNk
zkLH0J<_yAsv^uiNECcWjP*gSpYIFKa)9<|*FFIv^z5oy|6ysOEW6(FVB^jO3@LXb0
zmje);FoU6n3oPls=~eT8L1x}rBFam|?U!pI*&`THdB70uUy+}5q1^2Kq7tvwUaW<V
zBH(}+;M@M5IfAdv^zucx17ceSruij4D|MeIgi-8~*t&wvuz&%m$W4(YqSgzZB+Dx*
zx9w;5Z*Tx&;){OIE&Oi5MAX%oVZ*?g8i-DJ{=VxjwN4x{i=NoZDeTo53zQOYJz%JK
zlX(MD;3@M}k&x|Dfy5AZioO8c&+!|V1)|#zrmHF7@)MHI3Y@yoc>c!qj1sIl1W4SZ
zxb&aHTtm$|$SHlMKn<L_0!_nl+UpQW^WKGq@w#mf9k~NF7DyAd8RztstUdV5HhFLJ
zy1dhmiPjStlcfX}3_BtPt!auT8t}VbD1<+Jm<V)&6~LWcr8ZQ=d^tGO!j%8oF7ujg
z;*UZUREw8#2T=(v1b|E~FSX%bs`%}2bpv8%jOtR}4}i$f%B}Hm(ka7CR8wZW3Lp}c
z&zBfwK@0XGcKRZ4*qr(kX%SJ25A@gC?!{7^62vC@y9R+djStJ-thrfkkch7S94xmh
zQ3-8u3L~Ql0Mw|{bz};x@^{S<P6(gx;4CBfu->Yf*CxE{gir<Q@7>$SIt_k3I&PK$
znFgAWz4<l#+yPZ=e?-{ITWkiD+|F<n^bLc@h3`{Pduu|HA{yC2xC~2;0bBor1pt3+
z8WNk{F?y$#kviIr-R&m_X@?WEgKXX>fHFe@vxlkxXws%sL-?6_R_N*S^voFzO?S|{
zu(x{}CN|I8y|wQ&kRc{SevvoVK$S=hb+)-(spHi1Qw$c69I-;#u1BqP^NS$<T?aA7
z+gw#{@ak_x_d^U&)$K#1!&!^2Wt1zxX9qtf!D5A4xtGWzSJpN;rx!6y!~5YQnE&@M
zU*P@v0~Y0C__b1A5(y_{1X``^OHxa9MU%=;zu21IpRCX&tFB=GG%e|ECbqu27cFBc
zs#-9pMT<l9)Ci^{)Zj)#R9}t2EbHcP(osE7U90{ObrNI4GeQURqxgaAPJAA$9;mBK
zWQ^y-4W`Ka!3G=IN$-txgX&Bb<SI06_SS_Z_G@PgnhpMsr%&rK?!I<o<t(kOSw_Cw
zUd{Kon7uWnYE}cg?22f$%^K;%nBMxljA097RQUH&!#}{~7YLm#?S9p>6tGvl6``xi
zp|RwV#MyQPQdcpu%M4T;*26M-uz69dp1I|En9h6!FZ%m48S2&?bR~`y_hf5<C1VrE
z7%r>7qW8rWrmk-*&bdanA<b1g1}-k?@r^4j=ZK9z{A4gt!WJUYa@avOyN_6KTAF${
zYvX9kRiiX&PW}ztNZSJvJKL{yEeb}YgiF2~T7^*zJb*ncsZhr3ZQ$v*m1Six;C4f_
zUOEq`g7&^RdAV}^jOr&^v-EK=;QN>uijz1>i*nA4+k&}W!&l=EDI&!Pg+KS>&a!J<
zHvE%u&#v~}YT!lj$p!M~N%XL*K)n6iH-IoWDEbnJ=tSqw5T;hgpE7D7deUern+hEY
ziec_B+s?Bv!wRD!hUoMc@KIO2hg(ZhR{*<iw<l4f+COw{{O_^ScBF2gs3i1_{h5!w
zbl7auLg@i1-EeOnjzdVxHKMh0)>Q0-Hr;UgByMNQXVn0|NldkC44ccCVOJrLu|)bu
zQ!fV8=@Nr2{JZMDvs%k7GsCT4^hS^&Zu$qBYF_K3(tB39N{Q-3tMG#OgJj=j*5?S(
zMD<pdo*D*rY|q3ZxZW8HrL?CRU2J=80N_CenhZW|V1a@0yAy3>U)9i<KdVpP$GA9U
z;C?LSPdhqqy1wg=2u3vToDtp;Pu9Qhd!OK!e?vhdZs79v_KeCgJ7hy_eMSW)0|W}7
zHZLN1d7m1DC!w1jKOV#;yRHd0G5tV%)U?Z{u(6O9(ffI>hHXa_8&|?cohw)k+&h}9
z{sa)g)bprdS0W<q*$g{^{Wkf&xuSXK%p^KaXp`gLOUV6XF-goS*th?n!6632wA>P(
zp=)lnV!kP-PHl9ulC5S(MrXFC_Nv-s1h-`Lzmk=JzJ6=E<ee~ytx+H1xw3*PI%l#q
zaKDTV_o-yn>E=rni>=ewFAtDw#lCIX)w&)p!%(jMuVh8Sls*iIclL$3VqC)$=?H9(
z7^ld>4*3C$Y=jKX>#R6D?fC_ly05A}e`SJxkxN&p_<_|HJOA9#;pdQKsWLFW==H(e
zfa(<roZ#_}YwQ1Dg0mQ$1wV`Fx$1exytl*$F*MP)v9<by-7?DhbUb6hFzD~&`{Sl#
zKqY7Z;h-o#$6njFCMgdZWckYa8zVsf&&Wy$G9$Ot75yI<ta21<u70`K%p_;GLk!3b
z|4=T2bA>Z<piAxdy>@<yKDKbUx2Ybq^d>3Wp$8D@K^;?GI~NPO8^6Px{y-wc^PPmd
zsmID6#uXlaXD>CpK4_c0{i}5io?!vs?##5(S(a{D$k_t|f2=-M;q|P(bm2eziqTg^
z^?>!K197`MgWT7Xji>4>CIx^qd`#JE-*-`nf#elW2amJ4xPz@eU7g6|Lp*UPS4J;u
zEiG?OVIrZ%9N7tn5>b95oSoQ&jRp2mLcU$vb1z}%_V_=0p5~(Mw;D5GfPuv~fPF_(
zWfx1V!C4MFSEbeb!x7sBkmBh;g^5l<$6~Z(r)VIZvJaocqM&O%o`#Eq!UlmOPln+r
z=7xyn3FJy4eBCuog#OTpDCHX{UDG>>HAct_&MP-qP>}ua$%es98zQxTQ{B?k{DwZ3
znVb5H_S6-^UDgex?b-Qf=9=9Q=q!{d=;-7k1qw8xbnas@>wbp*m4A4d*JkjeA6cB{
zx0OEyn6EflC+59jTvvj=XRq*dHe7r{+i&*M;ze%(M$ibz?8xkXVORA0&4T4YnBQ)|
zcp}Mu0syoCUYv<yIPH;ymqbH2G}yGTCgjuijT2SVWa+*s?cdHJ<U3{$?&d3x4x->;
z<l}+qtPxA)BUO-w%puQv%XCxcf#kn>wQCI*;aaa*rF!7Pxqcf#z;ilgMZ>(;7fw`_
z9KtL9zQW2{^;dnw*A-Q=<!0&Q2<|AMI>g_pf+#?bDw--?X}tFoIGcxlYs3?JG4#Xx
z02LJ`@Qm)N&;YBT1oRG6YUaNY9%xd5@b90};4L4(oqtV{iyzU6PGqfSRoH14eQ>F@
zQM=x5BWb@qG$_-E+o{V?3l`gA<%gJ9gi(*1WxRyI+m@>F)-HF5LDOFOM_b#hAWV54
z0)T8GIUC`@L*p=TnJife>M)0`LnhHl=<9c;kGFb;c_76W+gXD0Y5usF%XLtiQ`?#4
ztu&CgGG$6pdP|8fcjEsfrWv!)F<GSNnxYmaM`#u)v<+VMn5cfX^ll3#C`kH0e<v44
zEN14MuSKk*kTt|aRWbG=_;W`PJ1Ymf^{U9%>PmuWwJMftn0(G~GA?D4mgfWtA#!2X
z!VlFcr*(iNJGbAOh39|<nX9o?Ph~Id##Y)rGKp6SD=@S-1>l8BLI9%j!vJ&hGrueC
z3h3VaCLF5KsG+E_uNFT%6w%x6-g2xNK<OrhjR|F%`}ZEVw?U00PaY{%k|e|6{K?8o
ziyc{{lfg0c47vqXx`GY^CMwLh5CwWoukXG21C>NZ)A$e~z3hSX>(01nu6>5nKr3O_
zE?u~vr{rTwchtKl{`{<ey+Y<00mR?k9D+)GHsaOyfd7ZEw+yNy+PXzI8Z-n55Zv8@
zySqCCx8UwB3GTt&-QC^Y-Q6~}(T#IC=ezg)xbIcH^|Pz1dR6u4*<;Ny$DD1B!5%&8
z>WsdtZ_J;+HiZMEz6Q>7S~0p_w{}J(rgmSGYLIKz8D4cc_a1T-9PsZ_56YMG`5;~0
z+E)39DAmr)TqzlvtdAB`;gXb8^sF|_-<}oW&CAY_t#-z*BJLm$_wKOi`04eC**cvd
znx6UXuBrz6=(4IG>_#t%mg5W{SX^s94!v=l+rL(g;p3Vj5zC)%f86>=>%P!Zh~sT_
zSB-<Y{e^3A^88$0el|2iGyzcgS8#!5X#U(&c{?fpKL^H1a~KKgqE)Z78HqfbrxlgR
z(tue*e6-JYCLJiAh>|OaEI@1dq?!kwW9?$jSU6ch4uJy9l2`T?9#42le${H6`h-7_
z^xpm%p3GM?eGSAXty}Vz8hl?QB6~KZsJ6mZtr)!9Or!=y?6UlFhCOyiLv~t`t8GQw
zkaJd?p*fHSQ$T6eVPFDy0Rs_bC;@qkO{hHNFSiX^_GZMk=Ye(E_I+E|NdtlH1mexY
zydZ))ubp+T>ziL2&6w(oUjN}>u+F`c_@LZQrXv%`+7paG($(lP-tQW{-{I`OnhwIJ
zE*kcva1tT6M`R|KX$31=KjU8yKHf7#hW2cIcYCRv)#L&Mdhwu|(0CRpe)m_=6scXW
z=3%Zk1{sMW3lc&|0JD%wml#PODpMaBkQHQm8oWczKyFnO-Hst=3(IQww?ka+&BM6h
z9svxeBx0F1dx#Pd#vHWvX--2@_GOFaSP?rjOJ$nABHc7+?diYPF>1z%X{aW<g~^Jn
zxXshS7i!)<2&$DP+WgVlKOKqkmPsd%SQX07#%iNjpD_ZQbas*1Q#@@uk{VfR5F5kK
zG(`fIOYNg^t&d1ZOEqV7{an2l4=1W(V^^?4=vg9+H%F<{w4=|F1PsiGOSA@m4OUV9
z&w-gmtJm-kr4V0OSV$>3;1Rq-GOn0f@I8UG$Y0(2mQQ>;1bl2XDE}*f>E05qxYpgS
zze2j;YA6-H#qj4+RTFriABvGbyc<pNGGNr$fM#HB^PYezmBk+IhactCJ0cgL2-@2b
zIviu$H)IyYV0Qe`15sXsq|7Z7z8XUU{TE3ie)Nx>ZKS(PxA&OB;u;PtX_!6q>CZ}f
z5iY?S`-9(6Aoy<M55d=MYiL{lRv6pM7#7^x-3_5)Ue5>dpD{b?fN$%F`O>l3p(2Ag
zRaxmL9!8b|s`wHen&mLvZ<wTnLuPh6F`1Ioux7%D`W4Tpr)YvRZ=M@yf2Q?%3=wO-
z+`jA{;{LoKN-`_oEH{|vNC7byO$$x)tz-o|B5V_Zu76>oz(}r#Pbj6_LwmoACn3-J
zFfa_%(88$fgMc<G?l=U!Ag*APa{7@I4XDW2A4f6!-Mi;vwqr?Ux6ZuSe{8Nfbzx_}
zhzvoX?IAWiv*d4Es%8vP8|>MPtiwL`r}!6ME3POFE!783zBrt5cJLz#5Q>-n{m0;%
z<+FCRjGwy7^b5B;ekflKTX@X~C}@BBnDf=H<Ze9L2OC#?_mYx{^cyv;z1G~3M%1Va
z(iUfP7CH}Rr-=Wz$k+S4>67pi4EPKo@kAEi!2|A+RmshD-FdS0|AE{sgJL9jEASd-
z!V{sDac3H`F^T@s5?@>|hFrn$5P}M##WK`1Yaxd=IBLbWFzCOqTlp{S4q!B_FqZ3s
zF{_OoqqVJ%aQ*{3d_Plt7ruI{QJiR&=p;!)hYB99L8WnMjmbV2=Dm7Fh`?b3M*%9z
zT3%#-t-%uY|4jvGjbMfax!<$D>AX~zqz6(F`GvU*?+#%w`Egt(flgE>I^YMwA1hNj
zh3AK**)VidACI83Ixvl!jiWj}9J45GGY}vo1tM4VjrHG-Cz@E?54Aho`E0YlwthdG
zw*=n*?QC%(CP?{fRUHD6qsHliC$-kJ7Tg5wzsq6ho+*%}6}G-ymi<DSIaq%SI;m{&
zrFo<|e}Y0(U*uxz@oy&(tX}hr>clqw^LDix8-P=_l=sFN`Ov3Ou2kVsuD%Pg@y>nO
z_LX$lm;^;qQXsey50Ii|H1#9n8DraI;d|YOZ%99%{W6lZ`xg&{Gd)0)4lf%PhkP$v
zr@e*%;3wA36|22Jq-x=QEqRI$deJsCK$={hU^uKzJ!j<>xr=#k$nXSmC45@@-)1$9
z5iAMx<Jy*LJiXeYW`gT*WwRhO5h*POAzi<|81jr=)Q}_S8G)Av+fB{ud^GL4E<dvJ
zcp&?yMxU+-$ldQ-kExI;jxsIl{aN(H`48TB|AKEw*^#pVHsg=&N6>NF6}iQEGXBfq
z@U<K_L1bUJE*4CYaknLJ)qEdrsdnrZI>hLTlKbo%iP5W)3tC~g(<dy>@cxUc#s8wp
z#ES>WxJRcG__ca(^~J%PfSD{YNo9G57#k&~KXV=eF)kdS@C(BwYa#FdLDfDo`+rfj
zc>A~9p3=(vnj7}GWz@8a2~FG7?N#%z3^z4%QqtOP8I77Q+J&;1(=zolU8V=+aQqD<
zsK)eAHC(rSo^4X}ztj0#KSg&V7;6s22GW3UKA`!P2UO2gXXMNfeT|A&G^@)$0<(#|
z_SC#}aO--)&>!0;;PCmxq!r36cOz8aZuBit@G(V*Y3~-_RZr9O&yC}5oEPqlK#?hj
z^hsw{81ZM6!|(qUAa)6$bzzodC*F|8FNgLdKszszbtg2nF+G>R?x_0Y_y5>stoYv&
z1~Q@bL)shB-yD31c7IUoI_Uk_M8TVJ;-tU<%`wt!Z_K`F4s#7e_9Xy*W9Eeu@xm^n
z2=A(&Gj=oE{JwE?U#j>m)LPIk65tR`kgL(;^WVT75{;Nsz4O^~mVHA8^zdC2`yK=D
z3lW@6h`%cDGyk3o2Ggu3K={wqSCMzSyO->_#BY)5W;vDq_0%a~Sa!_Q_X-i(pl8^;
zD@ECBSpPBM^H*fTN-^wCG#j$LDh*IK(F+!ekN+3&>DO6<jC_fcL>vA85ncB4@{}d$
z-66uE-*&(BYl=dq=g|uPSEs0n6N~uKU=Ny-l!A>LcgFv(sPq4pYW}Y)hJ<;P#oZZ|
zA|V7O+-dmGpbUokPX^L|cGq0ud}2=V)8P#Z!H~@bm+$>AJ(q??c=QqS-uQh6spwk5
zrk#`-EkkBAVrEcnjN>u?W_;sJn?S9F`M?Ud{X++)%1i32m{y$0>h1g~B~~H^TST&k
zN59;*oA$R@o+Ds|X!+&3##e@91$Mn|&xALQ-q@7m!K&ECkBL~0E)osar~Q0L(@>GU
zlZVx~)^5&cOg!&7*S3aTuj?OldOo<ydQIe}x?LUHfhJ44aDSRZHFU*Lc<D`&*iU`a
zyOz0lNEnvNFG;>0Z-f6Zf)9RC7Z#45ZFf{9UhnZhhIBay=7kVi7+;|RuD17wj``pA
zcTUmDJ+Athw6f7^Uf2d@J$&wGAybtt`JC(zZ}&;WC^gfmSzdr9|1<+I0N<|or?29v
z<UG6Lg{;Q;jn&m=JUQ+4Wwvx}ei&uT6=3y04@2v_Z0|rmZ*=V>ziDDhQzzcURHbqh
zHYyo+7mVXM>`?|w$sosLMu=P;Yd2LjlTi;KpeNx_EPmK2#sDFsoqcBQZ7v8YC(vK?
zhCLS3LZNT_lX1l5$#gcK4nl(A>w&!By>FbtKkl^T5c9Jz*P84OV3cU(^e8U$DeyN7
z36~1;p9G0wRRXh&!#1yUoP@~8;B+|Q?>dpTvf6dl-kWS*Ahne}(Up>lmsz%lHx{#P
zwc?n(Y>(y^kC??um4Osrvdxz6M;}?}o*{i79(2>bC&wxsce@bB-m6W$c<SBSpH(lp
z2qZ0eP2vw}!5+2CMLgfd5R76wU}O7y{n+$<;LPu3+l9ZrBgd-GdGl4vH5C2Y*n7=q
zYjykb&X0}lFx=#v!m^}jCn~<*QoR1=L&iW#%5Wig97A}G=;kW`b$#Rg+a^0QvMQ#5
zRBL$rGMT<!dtP0Ad|=!dNQ>W0IcV~G0Dp7A_YyjPRw~<BLgTZ75ttnK70Js=Y`Nd!
za~}@ZAFl2e;iK`K#`?+HrZJ%xwG0v^O;q)WDrSb)%Kd*+GbApq<aC2jlERJq87N0}
z#Y?Fs-}{>0Y}Oy#$TSGx?csh<AbAhkUnut%pbVhKATl+o>CaqzzPv&9MziKGQ>?OD
zG);)}s-<Nz^biPCFo_U?78wbWkuAU55%7-QDClkv%VN{GBgxt*bE&0$R}1m0Z{OHm
zs-1jA`ved}hPK*U6CnLpjxMv={p?*%^{=LU+Z)a%R;OR<R;_-;gfu5CfMBl8*`8y;
z-6<TUF!lq{u8^<-FXM#ONVoL7pm8_E?oa(~8`4HIYn2g;bvHh<+;mQ0+t>Mhw`^&j
z&}TQ%Ws~puF3qc_LTXVqRZZMk^S64vaMZ5W2I#a+<Czm1&=FD%zq-x;JVD5ojh}eq
zdQ5w1DKhqcQMz6i@N_G-+Czyo6)v}ts#JK1J3#vITzXOO=i}sIRI1Q?cA3rQrAD{i
z{4)Qtpf-qlWiHHo@JOG4xYzgPmhafHmr&*l%1m1sjV5E^@2n5A!_qXG5n3cxIsR9a
zAgt@Np~h4q=pe}tI+Y5oI#LO(4Tb?^BDFB-J#n!Iia(pJMEY?{C0`6_8$bY<ozqD-
z{2WH4PjPusYCw{KPKe8rk^8{eW4jqHDIvZ!d279tT!fl)HNn}$63bnV3{6kcV{g0+
zvAbEWWrR4lx&xh!8;R4GiQIu-JVVpPbBjV7x%pV*`;t_TuLEkfFFsd~Hg{VWXg+%a
zzP;cR(`!*E=1xT?{rWWH9ehJuIF284UpLs`?eHv8km0|+s8MPjh5lM2nw?*-@?LEA
z9#8ei9>Fgb-vC=w3^xQ~xs87ZP)2&!&(D=Q-%?@|;up{M_Y-*J`Ba>)JT_0rdmAf#
zqwHAR4YM5xyDqyMPgw1Aj9;uXNU1BB&x;*vQcz%&C)cftX#wxA<fOtYym@WO()|bM
z)_$%VjN2q9`B!;fnKbX7yQ{KWoO??%JlkjHV_e*3$?7j{D|Nuo6@oLzz&7OU^2c01
zYCrZ``u1con(#3sEqMQ)ek6C!MxbDy8NwTE>=@bMfI5v=Tu&AmNk)cj5g@V`AgPMw
zXo*<(S)PpyxPE|`GOtv{{x>dEUh-*W$Wi?}xpW=@8RDT|9h-*xD9OKp6(lfA<0&<K
zCfqHzai%j%Hu>Qls&W6}iK3Y#aT?2&83pKp(QnTSo!bOAR{4G-5`D8X`C8cE{ZWlO
zJr@Bs54E{mH7H_rdYXvNnz9iyc#skP09VV_^Z)ooN=C?MRV-YO37!}3v`$?VclP*g
zs+|iP?22ODG!rl2>(W=s$Eh=L(N4Ab-u-Q_qAH^l%O`|kw1D+J=#nC;OX*mlDC<^U
z+4E*Hi-Nu$zv?3-_}XouYClc#JR(>sA_y*fjd<`s5%}44$(~U{i{B)rK@^S+0_S1p
zhZo}Kb@9ysY~YAI!y;{17U|&U=l`(lxivqFXRx=2iA%9{w%3Xrb#NhUX1J$ZtDR0!
zL|fg<G|cSj$9#}i=+XQ0X`kRT9EJHcyu2%J40>U<%<OD4@A;<Et(XuKb04&$J79Ym
z6*V2MAX%TIHIkCr4&y20(@L{#)$%hKYyYkg((XRD9{ho-jjOkHi!x;LiZQzd0O;g=
z#N|6+my6_;)jKKf#1!v6bOA3k<1>*tK5&w2n+uB)RLZNDnq6e4P9A3Ss<6)c3?elO
z^@}DhTfdi^h!l_5U^}cIyQf+Dz2025L<;l+mvF!O%;D>nKC#s6S1k%w*R0{!8?A$)
zupL6StCT7*U)q-H%I;U0PSgXL^CJg4GlK?Ykgt4<+`;@)ApkiGl&QnS@P8$%!BUL3
zdTE<$GcqYP3qKukP#LS9-RCY%K1CvA^z0*9yhrud6O_T&D_q$7+0W?Nx1yi%GnoYy
zbP>pO>+V;pq^g{0X-t}~;xLP6Vhh4Ky&*9O<~&7bTKiCrSx)p#Z(45sNdiFtL9lqM
z8Z*Tajney$l|-oq;UCw1+OLmj+jen8+?$;-rbd*x*?lz6B~bBd9(BJ36)&MD83K`i
z)X6qR`V=Kq-zCq?L(bN&zePF|6VN!Jb6ZxXlca4fW@U3oq;2}JIFyu%lG*b6cKQRW
zZvPY&9cw_lp;0GZYHb^Q-}mQw`p$#mYTkkcia~3new!JvMLB_WH1Jm%SW(r`KXaN(
z4wf*bZ?%|>mHtGb1kS3m5kzDh?Ybzf#TY{2J-W`z7MUB1OBF<rmNbOe`rn@tT9L=l
z5p^G6Ph8gqx6{>tD^GkvOn9S0nD&D}HR;-?*WWY-fiotoSU)~bD=_q{lvnTa>r+Io
z<7NFf<dqaRm7Y#rz5s(smAUSO=;D&*a~|;%cK=85Z?Rv<v^w;;+JqS@W@ea)m8L^G
z-wr3I$H|*;O!3(8DW^L1$Kq?0be!E7a$uM|{s0zaRWMhhi>+D^eyrW<Rvl|Kkn@T?
zDLt*YIokeNXZEspu!E<+IqcStpIn4EokZ3lf+k3O*UBs5$Gyd;z55~TEdr0C$TGQ2
zPWf7vpq>?>n21_?G2TQZf=i<}+%ndbBgoxBG^Ebhb%#koS9w~wV|?}iWt;81uUGK1
z-UzW<6AT-JcfQCZeFr82NXHz#UOiVlTJpdPcdzFiZQ!p^#^o0#rgu$x+Zs9?wL(#g
z_SbmjWu=^Mv;2iJw@5PiAY4_LrsdCX@)EMfy<RRFX#)6Pk9(P@ez4KHy@DnJX$0#A
zKQcd#fPHrCbJ|N!C|#VMoiKz{)M5|6LO~*?61pa3uRBvJ0>v~mNIKMNkg%olJQLSw
zb}_ie4c^Xa3I*`wr5LNIf?Y?xtKI`YP*re?9{!O2{q`X*l!gIF=$otlNT}*0F46B<
zov7cD`-}2LJ4iV_^RUAx+?;aD^4oeKgJ&;~!&WWFjkZF@nAHMHyMEIIkfnnGRi6>@
z3TyP%U)6l|)o1B8!qR%ccD26IjrCyry|N-V2jLbdH;2#h<?cqniAH~ta`V#_@z?T=
z=9FhzrICI*&O#)CaM)s|o`=3X@{{*mic!&yEeN^2%YTvIlMtuw&g@D#mjs8s9_;EA
zU{%04gSk(WD;IR=^CZQ$8Ia6n`k;EDl$rQygq{saD>=K%;V#4xRKy)@poAt_4I^IP
zEDHrKmz0^xx<=qL6mtivbDJW{`3bVJs5T4SqmKhR6YDtTc?%DoZ-gKMb##7k>z7Jv
zN<SD{<|`s3WCYZVtli{T`iSlDNS?SNV||BCu}~rwdP8eb0!lS@R4b>Kj!u+0EdXgT
zH_9jR^h}l{d);thU6h-qV#9%W?&J^Ohc*?Wr)o3l6yv4I@Ch*28Yv;aP*L&F5Po#Y
zBTrO`HOfCqIx7gP6xQEQ+c=oRxXP8}Mw@`wBRi)qLl-VFtlRy#EMWnA>s@Y$8M<C%
zgv0^1nQMDHH~K2g*#j3$KH50lqm2MH$}Z1cIe^g@9{8b;vKPuH<KuWj0(Pf7xO6$E
zPitXyLi<I`_X(eqOfSEbo2^{On9KU3Xy&30ut`S|{xn_cVikMcMAqh23;7aUWXo+@
z($x^<Dr+MWK=_P@-=}{1k6BxHy1`TSre?=x5`-X<IW~ab=-j6HvxWI)=jXWup%9`$
z=|gBgB{>Udx$Zoi-aeLbjogRJ_a@AP)NM9fpGm{M0Uo@j(eO-`rzK~`S_uNBpSDI$
zrsfOMN&lZ(fY1|7Tx(`)wR<3RuP6-T-g3az))y1Mksz(d@c>a#kuVK}$tpMtAT3hn
zXO32SY+4nbqA~<t#Q1>TZgfzMP2<b|W!A*un5)-Tmul|S*{Bz8!3uvEqm=KLHbfBj
z2rEkBYj+e<VzsK&`SmH=V6mhS9!PL>mH+yFpR`B;D7gR4Kauy_T4fBOlngyUARK{B
zm(3Y9n6EE&ii&!B+!Uqip3S?vc;q3u5HiAxS%W5Z)O<D(@h*0f96%)M_|6*+R-qTm
zGs9vaN-%wAz)I?0_;kHeBSpk=bkiqmElLbDL26H1+thSUxnw6;EIF1g#58orgB6ld
zs>+p=)NlYjWn?~Ng||QNciK^0$)k0mzc&`~1oL~e>yJ*oUimft#-fT-f<qs#FQ*@X
z@7F(jy`Kzj5OCCUUj}Y+9L&C~za3<LPVlZ{MgZ-tH1qgyi%mRp*u4)YIp$m3K^c+`
zdBSw4d5b4@I3gZzS-@Xl)}Am;=U-*%#N_}K$7trQ;4+Hd67Gosz3+Ocv(r0Y(75SN
zV6VmsL=NFs$DY7Z-ae+$N3|b!%flG*ME^?oU@2fx_*<f;CmEZ}%@{IYj7{W5M+mA7
zGOjI(Ibiokrn&U91;>3M=GT_w;&Gl$2D<i9Ya4erhggv2hW63^c2pBGQoL$qbX6nF
zNAi)hs+nP&T0a%3xPu-_w0#xcc!k(q5IpSRxb8KD@`mQrer`Rg{{}x!FpbkC#xqhO
z{@OPIk0)vJ&D_u~`DMOocd5d69ro;eAutD5I$EDYIwh8|(-cVC6aT?0<<bejG?Vn7
zq46imE_*6CYctZGDfJD2g&hvN+wqJL3&`5E(6kY?j&UIsPE{&`F_Adveu>DZaQN{4
z^+60Jv3H4fbs12>cT?sJ?RFfzMbdQLO#hgvt|UmLyC->|c^H#zjxFX)=sUwYyKL>{
z$D{UH_0+2AZBE5iudjE_b8kMZfJez|QP+9H*EnNJm$+ZX$cuA>TDW55=QG?7rQ8&!
zLfmlPhw(r{eui<o=$*pIkOAbXQq{c9q$VumN63*3`>5@`$vIXuJVBC|(vW|ZK@}!}
zjg?VSC_D6VwfSTOy2m98@wN+jWon)M<r6riG%<M`NcYn^s8DdRC94&NqRinaG+|z)
ziwMLiR%}^UV5(0)G()3BiCE*G|Kt7k`iV1+aGs`k>)mVHJ-K#v9xZvVw;MIAVLA@z
z@d|kc6t)%?3EgV=`FPDRb+7Egi!pNtKb6?Aunr+z?LstUc9uJ9CQ$n4k<xB^KE5||
z9G7R^R4v&p#(Hq@t~u?uM|?fnYQFIQ38MMfz9Ini>9H`7;s_tzbRr(xoj82f9(}fK
zwV2;vZmBuLoFq(p5RZw8tEl-f{qvSoj>XclF;AXJsP}rf4>%dkCd_htiR(W^1|Jp9
z+ytB1fp}g9Y0H^S%)CX+Z)dg^#5Ms$ZiA6t{0c7DeEMN&lW^Aof<%kaH0OE_udRdy
zl4n>Me$tE&7()-0n?X*}Th~~NH%gFG@jtj!j}$e!42a@f=Q&0GblCV#TF#!%?~Q0b
zPIV?`@=(L@@_Zv;b!a`m%e}OuXTjQ%d~_z>h$y0OAScsPwKum|6`o%ne^LX)B8v6<
z`+ApT$LSR;)rpr=&`9{HlNDEm7i`jJNQBkhP6Anu6Eo)f7Ev7V+v0S+Hse$C>_hUL
z_w&}{D|`|l^>oAF(&EcJP?G*X9MDtSm-eDaw4YjUDe@=vyo~>jAtfCY7E#yR9C}1h
zCO`!<c#Qy<7S!09w%4Vx`RCS=%w#tl6mMo+4C1h5&v<(uaB-53z%VeGWm0Kow2S`H
zRdNo7{J|5_%_}zXLG01TLN12TgIgeFDAItRCP7=~`mTFu17G%6;vp+epqWd8F(dZC
zWE}s}ywx5Pknv7xyoByC{Ha#Y%oWGOn`2zB*Dj$F01o!8ob<dOCaU_lU##;)maQYA
zVF2sEka<7JVy&UGRocC<-i^`0;UfB<+5qn~KO?#3<W8$I9OSn)b`thf514Cz@1~41
zmgdd&`M}@V`5amQOzepl?bx&@WiI(PpI%O|mhW3!sx?n8E?&T;qgSftywH^HvUl}w
z<@`Uq*cXHUA!g;)4vzyh<V@AVc~zbVB?<v>U!I+=Q@?I*r|n?fS8**C&DC+`8pwF`
ztQ_arO-w!0s$HA!a^*DxMi$rQH}0f@t8i#A2a<a2I?;FHQ{I4UY5gWE4=&{<ji|MJ
zONVeK5~&m`Cr688Cz`K4iY79hOpY9PLc7~dFtirrFz-t80u)m}ron3@7c^Cq>ct5H
zAIfEby3BApIG+&I?#u?sKR+h7c@q+B<B$CERTT|F;w*mh{tUdjX>X{m;F3A40kSxh
zI4a(wLLrgRC9=N!v|$MY-xm(Y1R#a%92?kWcS<j^wPbyXD(EMR9*=Kk_$N~V_!mnb
zowoIOUy#&sRl=^4sM!cqDW}ve6<cjH(*I;IOFDu?1X%!bK7Gu$=JlpmdE{I{>dFLG
z)e(frmrpB^AfW63Gs4)^ard*GK-H3#Dn=JnXzbknFmR)<39_AHfmgp~-i`&#%|kk8
z&j=pMMWn^DI-2qcQhu)Le~LSb8Z<IEBO<c<sJ^}Ga-B%AGUNY<`Dozac=dM6Y%b-h
z9&yFDoas{gcb(USe?R`xaJexx?f95JXf<befa-pckD`ySH;hn5&q1J*gq=gqqlZ1;
zWm280U#QvGe7@*5)ptfC;0M~wkIw$VZQJU7>(i+f{1ld_zitTjMkC~Nxz4_dy0hc-
z31gZk#1Ulf(yA+8px*Y+Xf!$swX$tHeqscB%ISC69cD5iKVX0TUK!`gQ1)auj8JIX
zl@K%DzLn(K!HBO@m=JiYF^R#7F;QUZs#WYtxv9qznOXR*PKh-U^qg;0tgK@taO=yZ
zFKj@l>|?j;YYB16r+vblaO--M!nc@|n*LQ%m2&1c7uV=l3+`oRF$+kTos0Y}$NfKu
zM<jm@wy2XOzeRqFRIE!-M%e!4Wj4Y?UC*X8S}r_eK!WB^Dx?eNnAkz0aX|O!Qy+%|
zmitn4hhr?zjV!^gpXoe|iVvE^hBx3{5C)ZHtEboyWF%u99}1y!q+s+q*;{=jnk9YJ
z%CQ_gE{vQ;^9sf_Hj-WZ5QAl1+112opBqNuT;MYGJ1&niWo#CeHGjI0>FR<8i28{D
z{t@cmUC)oQn34%RyOv%Jlw9${S9uMEXJ|jJ$c=)hr?fm$((inWW9*p2afWbR5*5DD
z_&qHexjl)<bR*gP6fZ!Qp7M37{mo~uQ<j|>rjbzE7~^QIwlyUC!~HP^q20J<#Hu#7
zcsYRaQRDqzEuEBuZwK&=J4sVaLpbG1gwSQnjfCM%RY%-0Ik^pL%jiwQ?m=4}LE3aX
zy?vU}yw`3Mh47;FtorM83@U)SShPGzcV4Z30ar;VLcNhdBs{x~hcb5#{y({=wg2Rv
zECb6#Q^gYqk~py9l=3AvpE*kqk5Ss3cq%=r^@_f{tCMA&q1#kfHOv^B0rZtWM^=0$
z{AMz>F-8ITsNzt}C@N#|D>J5y82Laa=h@GyL$TaKuM+yuA9acK<T>B}y5(m_pLh=b
z7=U@oF-lf8?JT%2s7Lt&Trw?V=25y|ZOo5#4??~AxrZ;_@i*uCoV}@PW41t5veG{p
z<uheP_pQqzqZpvVDWueiffuqPH3Dt80@+`nfE53k?~$hjL=s#s<+)JuD|N!jkD1Bf
zj3D6f4eNDJE}!8=OF{)Yk&GUCm<YPJR69DJw&WB7T1MKT+!HdX7jJfglvOV@Ux9lr
zg@77E73qjxp38PS<vX*h?1~50Zij9157vgGWo$d}<>NxHH1gYx5=+<9F2Q_=$O~Uv
zW1!JP{640&9(be~ak(M&+KkDhX~W%K-*j2)NL$w9ZR@0;k)EH-%fl<+mi-!Fc6al@
z`aQjJ?ToCH)n>dHMIOyF`x#X9^331nAfg#iGWd<<zKKE7>*6d>`q&$)fd)L&ZH4mI
z{xEFkE4Au&*Z4Gj|FJt&i6JjT^bJK}g#4bsO4XFgEQW{bIwJ8ex+<)_>L^!lOv<Di
zwj}$9?#n5gW3N+C8de$xOJyD$94VgVf94M8ePb(7*b@@%(NPRBvR*KPIEKpV5jW&v
zut}XBmftn9MP1wayQh0on|<&)2Wy_{QVk)F+Qe%KcKBCMKfcI#4+7G2?8&aj!}&X8
zaN6qlM7*FGfg>d4M|E-w@I~DP_$L%bp)FA1Z@CB0*I4jz+0s$>%HQceJC%po2(kT#
z@S9{?tLk8uhT63N;J|N7w_VR^NS{3WmBhU#ZEDT94@H0DV*j1(W90c@1++Y=hD=RN
zKTY*=`SiQX3cOs6e0uG8x^x2!4<vYJK8}!M23XU}pxnM6F8!NDebUdULQT}Nf#;Dy
zb4{vvYJFT-V^ElkI=O!-<ugsZehzf>XDd$Nt_uA0_Ra>sp)#>5DiJ{$g>uOIx#hjM
z0lvKpWQ903;Q<~)d%*liOuq5%7cz$?-*5G9y=+Zhc(!A<IH_!$sMp2GtaT3P=_e4o
zS!uH}utJkj0Zi^U1bM$}OCyt4tHUQ~+L%4~uSG(>Xlbg`bG9CZP9E9dfxXMI#pTuj
z=DkT1XI@95O)NpUiS@0&fiancx9pUO=495(E{7C>Apa+U=F|hV=Q$S(0n?0R^#C7T
zE6tbxe6iMnXp2<y4-K*J?a_KZP}^LUQ$TG1;QIn~gSANwU~B6k+Ag<28S*jBBdk~e
z!0Z}rX#J-Dl$O@5`d}%>(y08nSosW`<Ru2wL2~Kx*ZmDI#)v@DggxFhz%;8??i}#=
z_dlH+6x?vDvz$Gf)SB6i$3N$>nhn$G29{q{R=yxkXA>UCUsSf_N)<{z`8`zeRE5*p
z2pmsr$Xw-or)59y9R6h_Q$IAIFkdgl-f1SMJHO<t!jWFVv`E%&k*>!^;aW?IFb6H<
zdF;5mmFm<b0D#z?n&|9TV>*7iMnPgZ=CkwI0(Y=D4SnUJN`OWobA)$u&ebKsMwakN
zBi;<2h^Nd_C~GeFa=qn-`9oT0c<d@jzc$h6z)AsqsDI17#H9Z7gzF+^-J)}9F%rqc
zngvz8@Pa>DDnD3ETH8q#0J?ILw*&Qu4d2nqnn{^bd*`*mDylL8N(8cW0D*3ZiGP9%
z<t85_lIbFBRz!3wc~cI5vfF}A#*3d0x}JNhg2VeXLGxvl&70Tn1=yY5zH1uA9wt}4
z9TT6E73~M=oO}#48>_9=BAf`M={lbeYu_$64!7uW3LkskjUuB?_aqcIQTZ8%Gu%c6
z531hvJv-C8W+7cPahsEO+5!n6pxNCD<JxBx;TK1<I<^bG-)IrlAX4?<>A-mZO}}dY
zMoWjLihB$=?`Q$UzL|$I(z<-Qu`f2@f01f+;M)-U`WmotUIQI{+S)$2*r-!Pvq_Ot
zDCMMy*41eS8!NeuY_8z3TkB*>Gwf+<MA1?kZebh2RY+56Fg0jluFio=j+8mJiVuzN
z29(uHU}XGM+_;x&%M0jIFqN{7m<YUr!U4gSSyEUvValXG1zTl~u@KbS%ma6_MAWZ;
z0Zx@(DadW4RaeL@+-11b_|vb6!x(}-$4U7D4Qu*I$pof=G6XfjXk=n4XA^~{<Dkg(
zHg@@9?#3<J?I5*;{*doT&7#i$Hv6Q-<bXg4WrRcs03+uf^g+tb!-IKA^>&j)uktph
zK#sauS0W4z5g5+SuM2jFts-iPWlmg9-G&%4<ZD9V=2r}W`E)J+j>}673*e6kDa9}R
zD__0!e|HIcW6OG_tq+AgQk$n&qp~VA-0r^rFn$llkZLsixNNeMpwskv+(=}<c(RNs
zr>}3S@_r6v43&5;i}czyZ(*X<tOmArWE0!4mTFAO)E+|o+4rP7i`qkxQHjJvCjgEe
z@Uf$Pvp;_E!IW6d(*JiYZ&`jt@S~>MOvBYle2w5tKG0Gk)gj?R8O)Gi7PCibTenUN
zAR+;nd-9B;K?~#*iGT1RXmbI&cDI3DOOsu|je4Q7rjq?ZvCtC<5$|6XKI@5;u|25>
zRJ?uxYyWCFq3FyxSkg*WH%9`}R$FuPKw*}C#RQD%K0`NM;ur_Yrs!(=`)zzGtBpn1
zOZ3f70nLZbmMo-c&Pt@$IC{Df{|E|(C6(_8%@!eLz_A0E;cG}IDycyOQKTap=-Vn*
zpYG;_(;BC+C#{B7M(#h)e~T%amzq#%ThgkTrY-z7<j-8HOn*buldSum%oBz)Js%xH
z;dC4Gy&XNFt~|{Wl0SDTCtu$lAw>S-ufLWf#$oq#72u3HpW>O7cQ|@`UmcEmyaG#M
zOsuqoceW82UT;FBlQoJDN<c1(v6WpWc7B;>hGKQTF~()Sja$;4AGW+3Yq9~$WiLfy
zM`TOEM0b1LPXsX*FP!PNPU;5mvrtInKF%oZzwDUnr9#J~34CW;_miz}Kf|Rj1bS^9
zNG25GJGJ{j5u*7~H!juRb#4R*53fbQLOk&P^k4VzfboW%_b;ku*ZMMJ(31oYD|py?
z#)Xn6a{O&|((Jb;HEoq(k0{REU9DbsEUU8kQ&s%uXlk|BNAOq^3a7Azwd@(I3Y7mN
zjHmmdYkB+zDG^jbm(O}G`;{)XKVLHGKha<}d;dB#b=9vQ5Cf@`GBK<l35U2R;b)^r
z{)csUbb(W`duEDS12=2uDpseoa?c?q&-&*6NAY!CBIX5=V{gxC3$=fnV34gu`p<Om
z7n_Opqq!w_Yg$fjSRd>C{w*m9EU)vMk8kwiXKX|zK7mqKB=~CbJzpNs1=uVS@pf9%
z%OZB`-D|tMW%PDn*2lY_%PMxwM8biI)`$Bn9u<*uZN`lN#cbWgUqQWy0r@!Czi?cu
z7!%qGAeSy%k0TS6l>9bq4Z3j45q6wb)r4{{QkQyKf*WT&#ksH3)gQE}gY~dcw;$im
zcWBMVS2Wu4@c;|lix906=V2&Fv7uSaIZ5nhcpA#Jn+k<`o))*$QFaRuQwmr7j&JL(
zAzR*!!;49p+8P;7u-{sJnwaemDTGhapC)j1+t$jnJT^^Rkb${Xvh4QHI`d}_(1+vc
zbNT}Ij<vQuU0J%Tlh_ts6}YHn=q9%RlB3=lQiqZ3d|O&rQ`P)sQx@*f(8)=s@|pL&
zqEGcJ?}%u>V9z9)6<?D|r1{-gO~aP1of6+}AZL7;&2?HYeGbJy>se3-)Bk{~5GBFa
zDQ!#q!dAyZYbb^R%BB;8PAOC6E6;Jh?HX^B7cpf~)9=TidA!b~v!fheAC0DTD6XAv
za50gLud*bg9FzXWsR=YSlt8)du;F!&UKor?KE?%QpzER;M||IJJPG@%)E^-rhH<Ig
zyXYO|9v$JpQ@z}p5eqT$0rr!T2ET%2ERiK9ABqW9YhLv~RzPxhwB72+TD~79xm?vB
z7x@_!0a`}IQ`tCHvBnZXP{0%qnUCs`tmf-8ftyUh#iHV@t<JmCMuG12{ln~-kSwn=
z^jk<~eXXZ}Khsp^G1~R}i!M)y)gO<?jWOL1#-2V4E#rhO#o7DdZePQ5CpazUGyMCi
z2?*oMHZ#vFz+KnJ+^~So;_Dz)C2jfPsJ5@&tYX-u8pOYe%ycwue)j|5n6GixEAVt{
zH2r~q-b|>IQrB~T@6TBDi~fe1m86E2hV40=9KN;Cnq4Vn_iMo^E}7Am*T+k_(|Xdu
z1`RYAr~5Hj27O`R%V$pV4ugg(=^<qTRk}?+u1)m1qj}+VN#Wl!<xC6axPaauq6%($
zzOn`mPk1@z<9$x2sj?NDm32P%)9if**vMj!UUIu%6Yj!;Ke0@6tyg@j!A>o1_*bxw
zdFqnNr2L*dAr8<^R_BYtOTwToqg-3|@ACt?zjs;U7FB5*3th<CM%b8>h;gZvIAoy%
z6C{eiG%e1wNRrh=fVDbR>tm?WC&c9B*g98ZY2OE9{PG^$C4o-aY(~jiDKL~F<bP)Z
z^tzZ8I}=w;CE?vhlD1nW!+KCJnp!tQ;){JIjO>z%_{AMvL1hTv^dG<6R!nO~8L1xy
ze~i9_lW$191m^-(Os$+IXHu1alYOHe^c|Ofmuw=$cS+Ci3groqtiCN#ol-_aHdkIp
zSYtl35LrKKhyiLV?uw<J@JSQY>r9RZ;0e)DkL4B|`B{RFFEvJ7(m7E`=ZFtMz40+w
z=NCgHh5Jg$I-rr`U8_ri24C;dkM|m^CE}b21y$Qwfu%(*z{~qztR_)jpLzf3Hca36
zK4bA<U2f=+)0Eu9DxrGHUvzOM=2SV)(`i_GTE`m?PA;*KkFXnHR~;}Z+vxCj%oCR9
zyb{Fco6Zj^&Y2n6>QdkP`!x@gJ1y{EmkYwFoon68Ofjb|{&#I`z`vTAMXS7wcB|-v
za=06858nkbpU3xN#D_)Tbn~Ub`<PwdM`OhYm`N=ARmtr3Hggk-^STgv(%~K`^%(%H
z`c1v=pMXK-d+)c=CKslS+ka0Y0`RXYX?Ust{x){A$zq1%dS@T6GGe$fH=(Gg%^N#s
z8(D86RklbsW29{B+OGtQaxnkut3CbtWen497qK-|Oz}-e${u%rO(460b#16O{uMC`
zjB|Br@h9bYm<W5xe$C|VaRUv^1l7L<oU>KyBtB_oc_1v!CpN*jc=!7~Vfa$f3*dco
zo()40rXK5!Qp09vd06bK+lp-9TM`Wfil*|6yks6uBzb0lGOQm~ZBH5N>A<k%VO*g<
zq>H}_ZZ(e)K+(b<Gd+y5d(QKYZ@<)MhPVeobrHicnCQRuCe{m=v6pOC;Nh5Hd*_;n
z>${#4xsAZd=lqdKpx?GPf`D0A0&lb;j7)l!o~V~)_1>PJADn&|ZrT>06DHNO-==v&
zf3<U1NLR~_?YJtdnvYwRT{MGTYh%un(qKc|PfX2_B^@&@-1zE(Rjx%9R8rBfqBzau
z$9TmdgX4u<7uOQs>t>KX6>QdM-VdaX9tzCcYiDPC|55w*><Q=@J?_9$`JZ?eTL#LH
zdG~T3^xvJvbAX(x@MFxf^mw|Lu=TY}vL1hYS{38qfA+fV4}CY*@O_?bDB5Q5I}I4`
z<(NR>xjK^u+=pZd_ys@TAcA?Hmk!lc@!pTF5$!x3BWg9=8ix)OyEpkg46nx(-tWWM
zG?a3lPmUU!>D#WhHHWhJmlHIPOWaJV_&`%3)L7dqCgW>%P8s6W)^xKiEzB;MN3$?8
z8gvm4FhIokrRuJu+~F;|ciZMJcAYUKfbV9=P)}Bh-qO)56a98h9N)hC$l-Ej2fGgJ
z`7rqXrcW(~|J|@IwzvYjdh{^1vmjRk;;UY2*`=TM<R~u}j>yqizV>@o<!fE|I#)AB
zo=gYpP4%bR<*~}nc52mFVj+=}rk|mm%4?p)>i(@q$w_katyb%|6-Ca(a>m1L;rp>9
zR0u$D(;=ySdZwJ!C2Wi^oYncyf*;e)fr<7)=4XvsjuQRR6mi40vNXic6=uyF9?MH9
zxl2fwtK#1WgU&r@AWPqKbJBEkeNBmE7~n(q?W2cs%<h~&6CfwyrlVpAYr50TgiT`e
zfkIq|<X#gA&=IXsTqCXh<@e&V&)ATeMW2}RIo?_TB!Z>#0^S@1GslocSz40F7dK<<
zi%wy+#-K%{{3Rsy6?ug}>u-{;kkWtB$Xt%O7k45A*3@S{f9tqwdc{tv%YX622&pB!
z3m&QGzWJ-&7;9Fx@m45qzA<6*Wk1+~j^m@-K(3^*doU$a*;g`p4IGzM<^8taM9Q#u
zg)Z7lNvvDa%0Piu{vd&k{pdj^6gpusEx9D*03P$--Mh6Pp7#Tl`Jsu7V*VQX9Ax*&
zmi{+!kj!R!cYmo6Kye9WY~X{+_m0bf@-YiLe9bXWUPqDh`3Sf&psx@0MX!b>4nbEz
zf(e#1V)Bq4rZhl3MdyA=cUb><PS5UlSJ~|g4~lN$+C>&E$yKI2!~*7`ji&zk9bUy!
z3-?TFY!Q1;j88__z})`mdj4g$uw{MuRtxb<&_z^?DhLSdW|U?0qPx8D^3oOlllDCD
zaj*eWy{`RQa@}}T&QX;#!CkYSrJJ_vP4_T|>p6A%rN`>ipJmgeQ36{fTi^hG@HK@V
zS7>~DRbJw`O2DTQ5YtYw&{9O_UlN)Hz<YrTYm)9-EVXWMQ#TTP*s86^jO9d2^b%V8
z^~lec`{x>=(q&3?tum!!8w|=C%y~0Ryw8TGrr8}uQZujLuDG(t;~3NA%@`qJ5-hXo
zvOH>>u2QMhybxO>H8Pr7l|P)!y9WV^$^DLq0RLw+$eJZsLj;2$(Ma_&0tzzp)mGc)
zn-|)-oTr9kZ)u2yW`1B}*|g-An<k9Km~|15#l=iQMdLZmS(kKGnJYW^{9Xq_ag15H
zP>Hx>ZAH5TL!TxroYf$X)tU}a!)-ghr`GhfL<|Bts<>-M;%n3V^=$M1gp;9`%!M;n
zQ!=8@wFC1wZ#b=WtRqE#x$tGyP5Zc$PU0EvKGSq0-~e&E4(Z}zQ^>pO$w7ANs0F%Q
zvBlrtzb6$^xUI5g%1ajEUmyeYd*n~G2(6KSW|g-Daj&PP7|+g8UPV)qn7(vG_Ddo+
zAqRQNyRMuVxy1cJ*#cp>B5;xet;#5f>u+pM;Zq*PY(@GgIEK4BCDVs&uDRbJARzwK
zr`+tWXF@+h20}l%P2jFWLi)AAh|xvCiyfj&Ouc{K&#GlX!^iu)5kCj6>G%Js1;C60
zl@!KAbehV19In(!oQ&AR{E&KKNc?NEU{d2VP3?gpOrH5;cKpyBAh;C~y-6)h2>H3p
z9NsBvmwyEhu)U=*vXT((u>T!W5dhs4sJ!h>pW=WcGf`2ysEF*FH0VKBa!@+F^rxId
zG**Gp(Eq<HQt-y^y{XWRSR_w)`#;b6D+UA2&1e1-{!F5RgbYRj0q!iDx*qE%6k?b*
z6}fBy1cX6j2X_>CcX`rEpdR!Tr*rEdcP`=jGe=>;Ry)*_TvLV{#vGwj(E;0g5cE7M
z%7}w}(>`|LqXHqmFm9iCCPne%+%@BvF77zA@1v5L)*n!`%C3furmEnMY=xsPA>TN&
zZgTgpq5I$3S71+=#Z&CZ?_=i-3a;YWNZPik%)xe=xeL+F6K!~2S1ttQXcf+;CZqF*
z8n&+XztP-kzpIr~ybY-B@(ZpAd)&z?cZ%?(453Q?&Ckv1&AyLCKUj5}-%G{|3(<M~
zBDV6KYnK-X8+mVMF_rfPmz;L;B>1fhoxZ+`xFE?!H#cDc8(%}8#wI2HX&MUX6yDTH
z!p~VsDNib?3QZ;H{!?^XSOWL2@w7MYn}=g~Kyjs#qsb#uY_Ke61d?}J-b9Ojqlpqk
zZ@ig7V!6XzL+#1x0d8jOABEhB%bSB#?Fckcx*Az-!ci1%78x!4U4)(<E}V{32UH2Y
z(YPeNxql|CRam($9p?FMA6BLs^4<CtGKa2TC{1B6(k8x!!!QF7KhgRx|I%Hek`J-V
zMqKJH@uo$pfFTiobwJGzjsNd}XnX~$E$FUF1s-BY!RuZ~%F*nf=1zj(q`I3=sAP~y
z817@++BduxvxgNH`r@B@O(9Sq6y9}i&SLU0XmnRs#BiGB$JzO#3$u7TXK`5m026)|
z>|fzI*D{5F`lZ^pn>DO@&RY9&);KkGoWnV9`jnaDqB|AB8|o(*Q&^H7(rL5z_ctEl
z-EQVjHQJQJnoDFGQM`R}O&y0duPr>!>@60^ly4)P=FQ~ZuQA}5aN5Z-9wI~b0p*0^
z?ec|7A``vS&Z#i+YT^>BgqEo@0W-lhv)R<eaG@($oayB{7x{hbFwjtEy>=Pim-;0N
ze2kJp&cZw&J5+zP`tfOgAp>b!MR=V~U;=fCB(xrPDH9vK{Yw(#TsEA!F3pZ-=l;8`
z(cJfv5*z+rzZTZte-_xj4)n@2myhb#4COPQew2_C;{bk2ckNUTeK5Wy8;=u+z7KL+
z5Ut<&D_@#-C71;Af=wMk5N7JsM6p#Y7GOhGx}--~e?Ui4akVSKl<lL&+=pwcodAi7
zf9`XR=c93Bj?};o*A0l8tOYR^pf@hlR6hD)tmYDouK4rRBX_~+JMvcufCTEeuLf5}
z6^A~NdlRoSBz!b6CcL8ipsgziy>X%_7dh)a@OFmDxH80dZbyu@2_=@(@@rWLza^9Y
z^1c@Ac>QHgV>YMX_RQVAJ0kXLL7_rt+b&b%kgS0Unj1u-4c+Owx}3y5VJR3_TBMhy
zOQjs@B=isKL=47KS~Y>e^=D7X%NX=%ZWU(S*@EqF79dER%>YIJ<(o3uq~|UzMF;>9
zTsi|vmRLV2z<<^Kkl}M6fu5a~#Zy6+0F*x={!`#0<M+?~61al))sHP73tR*L61m6m
z-jU#-LM+_e)M2`z-ED;~WzJ%o!3ej#O)}G{zP+I~&cOrTS?E}j_ax`rTeMi_mVzmU
zfdhZ5swRYnt9c)OE&Gb)pM>HTt`G!rduWo>yA(S3gtCZielRxX%=r%kf6O)>pLkTb
zRG3`eS5Ee<M7Jjhw{w*`JB7P`UBq2>(oHp1s{U=p!c>B9Vrr!SQgXTV4Tlb>c2ZlS
zUYVzxZefNTV<ilQxv)pu$vGD^t>|$hw~&@=>mydlO%CptJM=+*vGl57C$%74ymLhp
zm8eQ+Uo1&iFFkYt>~QF1`Qp>-o^7;l3O*Gvk?L;GJV^10TWY4cYFeiLME3Yle;@;n
zSO-$_P1K}evZjl4s_0u-<+JN3nA&75gxbnwvl@}o>!uncK3gZf!SKBE7^~1<xY{T1
zx_S$^Io2pAbz`~iBl5*q!Cr9Ajd!o@1M5<o6o95u3XiM8Mj?PzOIyPLx18UkPLYM1
z&#~vqeB#WVLrkQJ-j|(ogwrJ$_kbN9b$+lX&2in`G*<*!XVKX4P<fPuT2`}sDFX3Z
zRibeHVy6HoSfdum0+G`dYW!V(tzZ*PJhacs3RmouO&@4!#+9z=f~}!yge>+H7MvI!
z-bqIu%Y*li)MEO!(80}Ue?MvsOeovm2HLP&sKa@D$h&4aD7^+=O_!^Eg@Q36!@vE9
zhwpzQdOyO%$>~k1G%u>Bbqn(vG81acd&SdOfy2LP@%r0B8BYHLt)2yIZKs5qeW?qZ
zPN6g48ME##W>HIE?To}?!{_(7v2>}fna;72I<P=@7%e-hBN_s5A#B`d@RGEcc0T?b
zdvd9WQiISQf}B$V4}EB<$56f9_c;;eEV@s19yx<yE@8N^r|DuUU@WHk=V0JOTiP8q
zb+#9J<3W7|V~VcWj%4ZbHyoUq7J>(SS_LiXGjQ3L?)|Uw-tGVVwW>V3x0Y_C`21{l
z{LA?0>fw~}E_lS!e)KGNkKq(mU&M2xdRBQ~I*!$?#zx^Ok(nw-+*bw^cIEz-0pT+s
zr=LGWPRY``+mhPYm^)U;)191-At5~`h7gqRYLJDB-xFa7&`4OF&WI^XrlmD}<ztK&
zXE^GvFbS_322PF?{s-ueqN~@_L-J{j)vVs^hSU{nhN0_?Iq52_P9+a5rp_k8Vx7sE
zd|>WLs#_B0RK)<XPIw#4#Zt8fE0)QMT@SeuGa>xxS%PIr0TX8Agg+1sR)Jb-_H9n#
zTi$%rachwUKC1KU9&9qt$vD2*tPjdv*HA@)^Qan%T@tI^^E3D&mDs1^%|!~9EXw1K
z&EseuudK?TE+@OZu8B5Yi{P_{HJ&5Kl4KyQjm^neMSncbY~^Wu8~fa7F2%1PjJgCu
z2%;G^qNB1GM+m?n-D$V2%Q$Z(wydetq(kGXEam=>k+>{SJs~`N5NQ~XKL~yS{9~Na
zv@z$sQ?OZtEp@fg%D_o^v?86={QG)SloR4<d!Uxg;^cIhi3`B~JjG<_P)>r&x^&`5
zrkx8_XA1G5Hc9)H69JI=_ym;^={|whHuyBmv9ShIvgbnot{`RjMZoOh9C^Tf7Pb)%
z0KrLHQZvyNC*Hi!m3jPHk+cA%=u}TXpDZ09QFGDetRQ)(%*E|*)^#E)Z!upwpJg}S
zvMNwUeh*L@r(1&GFJK_1YsZ^e2(EGhcV;}R)!8U;oNG?r#Ec$qioc)`ucO}&RhkUX
z&9MCuhppS70l?vjy!EQMImDxEs`%~6C}m&m2CI>!I9~-l3;b$Cr%O~53dfNtP_19r
zuVrom|1Y}UDZG-nS^Hi|CYX3)I}=W9n-kl%ZQHhO+qP}nw!X}>_x`SZu;2gLI_cG@
zuI{d1)qN9Nnjq$vhnD;{SX|5xxbFymm9PFI#r!Ks%<aMASKLR)kIY)h3C;(%-nLs9
zz0dR;gS{4H&&8j41%oGNulYj$uhE}(q<>_YIg1q80C-2u28XkVg?xetAltZ9E_8YH
zi;$TsB5Iha<+<2Ut*vx6W8>ahE`=~2heru+DwbTjRQdQP=gU{^mdOmAs5c2R{Lt0K
zgP|gQcJ~~K3b(x;Sb(1ec~u1Y;l!V9B|18^_z5-Xv!1XEI7_->N||-VO?7ofnnu5!
z(!>l?JqspsH7{U|`+aLv2MjC<)s|co5lz*mlaHFQmH_0QGGT2pW`(Irvp;V;k5pvU
zrdEX?l;=|lFW+%98hLP13Xr6t^RUdn72DH93po^-TN&TQ(qdArx?{h~VuVBZM-oRq
z8-tKm8>VwaOD3u_dswFxuVQkTv5n)g_?hP1tqmTsOG03_#psGRI2<MDYy{$_Cj5RA
z4Ec14#GKnkyZrjyDxf7%9G9x56H3e+QyI`cJz$UfG<Acte-hMl@oX7lnrs+j9e)N~
zs433e!<%1NHt3hETg$(x5EX>8^8owe1&C?%?a&9ler3N3A;veIZa4c2<Q|In70yM&
z1EjG4%~4u!Uut#ye^dyB!-;1lEA1?_W-aiXQ&SUHBYzdE-5nH*9ijzw<7KbQv&@KK
zAo{H0E{K8F!U3u|6bDSKfsJ+3EVo4WY~#)KPw`d>efBT*)qmUU{j^QPsij+}WNsQg
z<LCc*>u7__!#YMC3kIFzlQ<}R{&&4;{~)OOjMzJ+y|6$OgSRa(?@_p6eSq`ybYtC<
z3cG<1_9e!Eq!xqO$^a2}7k9PTw$j>7rR?IMA*%Hjrs?AaehBSH5U>K6`>cciECj}{
zA8S?<QTWNUVrA$KkQB}IgjWOKk8zGgFvb|v`vx8V7gl*N0uX>5FjBt;%7yWiNp$;B
zgKastl#2{mtxNv}Hu!~2%TqpGTofA(dsZ#leI}?xUGb24;V-Dm*SnF16n2M<l+<ap
z%st>qXot1F(~|m_l=dwk^&@Qgk8&)LYUnn;OUTT-T3Ka_djUE6*=q_3A+{Nl3%j-g
zGfF9sNtgTya48K{>9*DT&LP)Ceusy1od|szvw8|UaK$vs3W&c)(~%`4QVJ8+r;e*8
zeTJ$D;k0LN<5K`-*0SoE?7vkOO#3p7x%dg@O@3g!1lpec!1IZX+QcN>Hu7%#hKiHt
z(SCfQ*E|GC*21W(#IZBh^F=lT-f8~_>NZ^tT3RF^N2Bw390)<?LSYG8P4a1G)oQ>2
z6zjJt>`Li(8&w)yt}n9L&s?yZs1N;8R2J4NM931jJeO<}&OP^-tC9vPPh@A|Yej&R
z!a4ehEneb>jKnB_P0czE{<lD8$FyK%G4^m1_d8ci6Wx%YbZZ{d#jwLscyUk=Q|8|!
zjd@TB4>&$d8<~deup{4UzqEHTO_Y|uSjZ9zYrF)ueU6&~@x(&Ed}j>=Edr2+1ME5@
z{_ksxK!KJO^Q6nGq=aMUmplyBx@sNuB2jHT<O=JZopL+<Bfea2Hp(Gcesh#;Gk$c>
zU7wsitMY$ePRlpDv(@pvW2OOU>`^7`u({Z$3A>D@?Cai)aAN7w>sw%Ej;-<VdUA9L
zA=A-bqEZs=z0f>tA4bYz1&hqzQ40~48k}zGgf5xiuB@x}W`f#uL5}jAE~DjMqt>z$
zRm2HP<x^)Z-&JeBr0NSNRzS40X^wO$%hRFzggEiri_Zej!M5Y&kMdu}n;64<l31KG
zJiF}~M~u!eRh5DwaI<<uWUo<mralF4BDzq57GU>Dizo=pk$74X?o~Ej#bPP2>`M=K
z$aFUkAa%S?0e>(3<$Q=^hx0R<m|-TCFgcr5FMrI#jCOKXr28phx?vV48eDGI9Er{B
zlpCh*t4+l|I{3#e-0Ttv+~?tQmCtV^S$T+<dv%Kqap_sS93_7e<xR(%vwcrG#Hh%{
zt@kMK!1@dt#y*^!ejd%|Ya@6>GH7QqkolOal^|iRZ7NL2J64#ehug7NDXg=c&Q^Vk
z99gcDFcQ}5sArKHTeYuD>)D-^l+e#Zrk6o#6C*J40%NRN_tdP`bVDDH(pxykkigJ&
zjfywYxCsT-76VPqRR4-d5c)%K>S=IQsMw)*C+k936df5|y7PC|=4DvjkqO(6D)+Av
zl<FRaUZCU0C|;N=Sy6K+XwyfFfyJSv#t{{LbE%+|oQBiyBabBYrC%-Mdw+%V3TDQN
zQ%6hRrgN6Wh|3hxc9a<Hm)8{R&6Ma;!{;H`#oa?3x<ql>dv#rUQc^d`RU0UaWh^l6
zmLJiVvq3p0a#mdzAC%=(@-$K;?(!3*OqYl4VIL@4rS90~6|h_)nC;0^BC9*Ynhz6@
zA+C7K<C)E+2nA)lvJXj>g{?E5@?!}N;;(igyTw&(0_NQaU|vN3RDlD!V($BA3J-vt
z=6NB50{Bc=>HkqaW|iBf>WrY44vH&oVaV$}))%nQ7DP>5^V9$4w-uT>wf6~wn&KXG
z3mI3nhYZp~c2U`5cqLX^j>Qv*QRBnz9RS7N(9wctp#B%)vU}sa+R!cK3Hg#K^${+x
zhqd|L)W{ax*ft-yXKpros+ISK9Fn3`dK)DS<lxh*gnWL9!^T<vw1R5d{@RqZm1a$&
zD>y_tGqc!)+fcUt$RePw;)T=<Tg7isRTZzGYN#csrzf4RW3Gw({w#U9B9mm4a&3g2
zH6Jehy%*&9&m*$^)G$_+ts>ftfM73pX>E5QqhjRq7OW3ZeU{N%&OZl?^*g?L4SGJ9
ziwSLa4+K&e`knzt?@Bk(f`9U_E)sb^oFC67K}0X~Jz%D6ObAo@wI~AS>o(3LH^VCP
z@=ur3d)fI)!7QFZ9o4z$k}@U+v&+PUq%c?aFk(tIy6A>;H7Cd{^m;Z_3luC44K<FK
z=$m&%ua+Dxl+ujcH?5M+#*gUW=rgF%t?Q69D=lA&Ofku)p2HYif3LmgxxvY`>02qy
zR9q;1M+-;Zp81oU*hh!$mmB4|$x)1X9*Vt&1x9T)1sIb)FFosgL#6}gqWq#YaUE;s
zd}XKl>hS%yA>T3A#F_Mx%B*;Mj@AfTbtlRD`Th`G?h~tQQzhjeT)g0Pp^EJm6H5-?
z?H-Jwc6qu9g*ePr4cN>_vamMIRD14`<q?%1C!7&XxE7G5xqt6*h@(_04-a@F@e+{^
zq!C#D55O`%+?0Zp*_HH^MjX)rrXspNvdvx%)Ac$d(=^f&)Jz|I&lV+iKw0pB5}rd}
zFf4*68~TyR=rtO4vzJxOi4*&}ZWOUxfMVD)q7#C5pB)<uZK>b6>HYsgj<i;Kpp={v
z7_<tI0Pgp)HHQ!{;0QC`lJ-#4LfeEq$2wc%c!TSJM0Agp8ozaXLKYt|9GOP<yg0=V
zFlp}Vc<l0h0UE@_xIcpTg*{y5`I1KJ6?v&{UVzN8@;p&?_FKfL4C)L!)RFZu7qpPf
z`O*u_#(p}=R8%5*HAWHmkQBk}>e|^ku@S>}l{JzE!ugT8ufEm|5fUy+Ba1`E2MDZ9
z$uRX1gN5i;E&L^mU5;>(p!h!Uhs8>xQsmMmx;1FB9oUsy%qG@fEWH<Mz^bd(1K-Ii
zyQpk#Pw6ma3oC3EV$}lxnDt<jkTl(tp9(%|u8rApCd&cGa$`M_+QX1zCWos{b*+<i
zp(wKVmxozB{$F&rWu}8;T==lIZUxOA*}!#m8fPh3{^Bix7Ucn~Ubp9aW2F=00!=Y?
z8h80kXRVKA6ZDK%W_B4b>W89*gu%(wPhp28QpE+1+DWZm(AXW)ky}@Pr<jjwRy%XP
z4H?4cZHZMzV7aP9;D&!XjW$S;wt#W7?uU{@xRg_XJ+Aw@&RBGIo<5h){NgB)@o0%3
zy)Tu3LI^?Qbtis)1b9#HFjQhVl$6)s+E?*w7>Qcl1ZooN^}lA`*u6Z7jX1k(bJk9Q
zRrXJJ>gjw*j8L4Rb={)1%8sOET7BwkXyo1o5x{8RJ!nC*xU8T!92He?8xP6c$Jq7@
zhh`DL04Wo5CoUB8s*xYfMR#OU0K`;;N*T!gm6p(BYj?$oWn#eo#s)@!0u+ZVRN6}w
zq9Xn`{&~npB`$5OPSu%D?ST}RB9L%++j4p5C>gRg=|%%ci@9i`;BT*g=RLpwgEH+k
zm7-031;VtZiGj~!Ju#>LOreOfd~s{M9V53q@{TiV->siWc+KK}`vd0Pij`P~3Gnxi
zz$-Q+{=+!s^5PlEMZ|_dEc`IYXf02;%^9=e{kzOly0LV2TjiUGbx%@|1H7sW8>3an
zGx&|W3gUsas|{-Ro#xje(>0TCj4ZO|Bd1$8Mz5+w{0`?b@5n%<r^@7%4bE^_Dde5J
z{t8VMeI$7+G2aC;eSf7Fvz|6G)9xaaOz8r)9WKU|hOQXucT)8xj!*4h5=;)62Xf2(
z3oHr<Nq!lbl$kF73qhG}X)&NP5tI30!%lI}<OQUZgi$xvfp+<Fo{cv$bQfCe>FkKS
zKkl=0?)tyk(;|2~NbOEoQ@@krXo42Hj!ac`iXkQ1HC9qXO3Lvf_fi9BhsIJ%Dbv(=
zdzFROUCX%NUlNBTp>*NWE*mCGg2CsTFVc>{(VyZbn`5uID+@+eOaB#t{)-an`AhTB
z!UZwRV#re^fr&SjF0;Wyt-9LuDD#n)cMl27wSg|*cW$S;xPjwBArJ++bspBry;{@Q
zz9rAdS!BhV)Dzph1C~n^bA17wuE*4KN<wx2(E|RM@fB$N{M~L={D+oJlVi@UdBmPY
zi6nRKRpX?aO60wdclQZje?p>*)iA9OA7U>gpHc=`e^&pWI`wyI@h&ucg`#*dWBz%=
zfBfNlk?^9B!%qk7Z#~cCHf}qzB-B}t^3v~b=Bz7DD)7C#&TJxze4sS+|90n9<~=Tr
zqwMWFW}O<=dEnTCAtuxkaVRY~ZCBYFuaEg=LH`yHhyb`S58Qv~i<I*l_<!ij(Ye}t
z4@O|IUA`s|AUpA<*D8UZyIS(`KDF9+dLc_$sXZ3kc~K>6;w+u7RE|o)XcEJyFyeoJ
zN-Crm5D+Ks&3|wU*~S0DEdq=1|L;W;<&7s@rI9{-oxs-Q85|B@W{v102{HotGVaDV
zLjp*wdu<u1^FCwHhUwV`g2*9g|DQknG3lyIV~5V=f}OTCU{$4efsN)6=x!LGJv{Jy
z1EY?%GbqaN1CBdtD|0Xzknwd+2inyUcGl)_YJfhd9`PWhXWD$N_e67VYVL_y$1i!-
z?CER?!_>9*Y$teMg3vo*vyq@e2sX6oJ5i;Vf0bg8cjKge#~mTIfd0|)X9@jiMAB#E
zN$(ERs1=lbJWC4I3c|iOd`@LMHpagR3gUaE^QE`P)f6N#=%YuR2^wQluNGf^eH-X?
zqT|PXMyVpK<`X+gzuX`%zN`EU-IkHP60H~4()}avrB<+58~MwAnpl|?Q)TVimRtmW
zSI=7LoK9r=im$y9ZD>i)C;;<Fg@EQa0*baVgrkWkwa~54Kr<_UjWs?>gwPWY4d$bH
z&*@Z*##ZDq2-RR0D*hFe`U|5ZDP1-5WivvZD}QBQ<b(62I1(vI7K<*eW(!2sW{_0a
zT8sIcFzc)%o*QJQE5uVpf8%K#k-Z^Rw=$;YJJ5qBMlbkL6tH;TWvLu{L)@Ul_6PHI
z9H>s8^-#VXX`tF(D|MX^v?_@9eM&2AQ;b<xtVer;O^VE>vD9}rTmOT_t*<QrwG$#O
zt<`kQVbJCFUf_5o2=@MHZU7TFgKEz{bNn(khOMXx{Gm7Dj>e3X;Ey)r@+Z5ZSBU$7
zgr$?rH+}neW^-X-Bl7jG;s`D%@1PFD3qB4<kDghWJ$o~-q+LFb#5BT&G%0Upx5@H<
z`(+u=z<bSJ8H)3HvDhkaQkUN<4|)6?2vynhHec@odpSkV@AURmcKBJ^wA1K7>QJPl
z;Dr>`85RTCdE6b9AUocH?sVUC`0$*I#2KiwW8SViQ2V59W)VD0>#Q>~A}-GgDaGYY
z>+pP4R6VeB3w4tUSE(74T4?7%P`z*a?vNk0Ds^XkptJsgu(<9wRMl6jBt1SEIGw_V
zhzPf9P!+MghJEy7ubYIFyFm+y%|#tqv@PaG|BuYo)%gq?&gd3?-ReDyeUGl&Waia|
znL;UPg!%WN?#^Zl^4htbV+f6u+L@9i{Uc%F*SnKl7@x^R8#Wn3rxB5ixit@6nhFXg
zk05jQU16QgfMZdc1uy9%*rq16|2~neu#(H5w)p|Lp0c82;K8b7Dnk-Ud!CLse?VDE
zpXv^SNZd!NUw*ipW@e?au^^n-<Pqm^PkDUTIWx+z)qtc0o^z-W6HZeK+Qlmc?1?X*
zyE`6X05son!64WaaDCKf(I?$Gfki%xdD}MY3}7DIgP$l*v6LD$w_wYNGW3lLD}L02
zXcU|3A#jl(KgbX=Q$kd@cgGL_$8<nupP|>T=4|0)AW}FgZ^j_xvDe#6%It7UB-#u3
z!BTu@xmWuBcI`G0=To$oC5bJBy4Ccjqx74`xL7G~(JS|uH+>sn-s&8m{OnG;Qb`d%
zKGi=d@yf3x8adL?O7t-k&COm7KuQ&NZflM|L1)v2S~e6o$^L`b4}J^KBgQS`^E9Ta
zEi0!cnd?W^)T?pFYK%&$T7geQy9L~qH_ey+rfPzY2ZQmya5MN~+LTNSz%y^<a7KZN
z0ssv6658gmacRMqP^(`=Cug2tHU_z?+>osH0RW=EseX4sde+PWVBWyxC})`iX~LLa
z-?LVhTHzxbJlM-k$W>pcL1sYRv!E1~J@=W_Y|-_IL%FnN)TMJb<7Ugc=N_b6o6Y%{
zk5vPkt4s;gpv_+7yKTLw+Dzx0p-Wvnt=NF=pd-zJ{@(*#Ex@=)>E&fyN86R4Xup6g
z`*Lbgf=GcuR@+~|tU(nVt+P8Jf+XJ+col!b|HPdY%Yv#LidI*D(t5X`Oued7rqx5U
zM&d?gQ1zMulaCxK|9md}0ZqysTE#tJg}I$RBN-+1cKkE{BRFfa?>y}0P$wS4a>xI1
zXd-F1z4Ll!ShBZkbEpsjklo{aEIMA&0~56;jSa9*35K)k?*wgsbpM}TfTrti#p2W>
zCUQcwyF<NC<NKeW-;#9h9bi@kK8WL<5K)0UtH|H&@!rWP&-b?NPc)wyYpWzf3~&3L
zOV(#p*eM&{$aX?L1^6|kE420bz&te0zb!NT@MG}2`vUJXn!h~ct@&eiZPh`nkqy{f
z!L)l8p0>YU3B7^IYh$k$gRpZbERF~90Nm@=xUUaB)WV0F?Kk+13FsI~?2lQ>5hnx9
z_Qa8803P4!S7K;ZZ&2#IL2s=dxTtczBpM#xQL6TLpjh+3^64Y@Z($}6y<en2kgz1X
z3l1#P_ku<qn>2x$^ffflTJMPHl6p+D+iV~lC$no2#<F_YWjeedIAsSH#)5}?NqYfz
z)t@jNogk$?6i(=YYbbhRQp4V=Vd3`W8etR2U@XFE==ZxK6s<6tD}<ZVWH1a5=Qfni
znW*-xic#MMpyQVD)pWhUiNEq%Lf=2Q&9E5bRwDFaV3LE8rtHM#kb4978rI-b1J{%Y
z`*vzs74`s>+Uqn;ZKWij{~oTA8sI}w{{Fo&{n$LuKTh4k4^Zn=rN1<@*Jet|5P87I
z@hKHVtuChsbuk*eNv!tCfd)ocyPe88Ovoy>%5dHz*;#Hb_<&6#IE(UhKiY<&2auNt
z@iC>`!`J{=-;%=yL%o8@%3)WY!iHq$(D*qbR2Cd)tT<L%Kf3gkpR`zVtBu(<PyM<$
zLgrmXdeD{-OSX2r8k+5Xz82^{xFt7X!D)pKSoMgYqjLl4kZW!(O~RB_^3xPkc)sGo
zDiYG+h#TryXsOphqQiFkG*oSyq3;mdY{ffLVY0(~bwZk=Y^uQt=$M9m)!6r>N#z-(
z$*pcU_=4@cdrH$quMp@A{q2$HxE|~qHq96ap?(d@)#WDl$%%tc`PPSshU*{ft3`hB
zt^=5Lf_PtEl<>V7+ZC0dWLXWRo1mctZ-rlc3&SH>ZTS@gyFcSYzE@jwDRKs@;r4Q|
zD<dm*MdrY5<BnM`uvZIi`<Qh*?xg&7T3|u-#tI-&)D;83UUa*$7V8Ix^Enpy1o^Fg
zn^kb|YZ>lcUqqJRi+n;G1YQLRg%44T$uweCxkr#k4p#=(^-RJDhNjps=Kj^1f(~-p
zySON}@8*U?)$&((+C3GHzPvB2yw|M;vVs13176^5c1FoO3t`6@uuS`GR;|$r%95k?
zKnn!haRvoE59)aP&kM|BT$h36U-f!H?W|#cF(a3ORNFI(C3hm{2I&eoy}vTTD&p6Z
zP-XZg@msGzk($m~S|u?<S4acfY=BC`?)5?E{flo6OcR$jT8UQQM9>G0Mba|qaIMgz
z$-Y9T>-osS`%;&K>ltM`Oy8)zIVqX^+$H02+&~|n2y85i$r&9m2~3l>gdPgFZcMg-
zu)@rVe%~V(-XuN7sBijVm(svG1f7;r+-d({KA6S%Bx<oqlgP+1K8ZsgOZ)bi;+siF
z10UBLGgEjYVDJM>Z=XROIjsLFx&rOMQRyN7-z#u;$=NnME&<3SxroQU&62EHXX}p3
zr9K4o?|g@cU1rtL2mZ;XaZiG|F``^dz`a{H8v!&Ry@m1uk$6vJFXi*UIg*1@5J%)X
z(*CP%BjSz0a&6JaX6OZt<}3BN#c0Wa_%HR)v`ju(Y`}YRL{#Nqg`V|L;-D96Ehabi
zP`nFTbRe!L|A+|38fFZgEfQxB>FX0{sCB<W-B6^JSN|rPHm4^?C|uHBqfE0Kdva(W
zH~{ZAma!W6^Y*A<HOlU)0?RJI+v@K6<Uk@Lm9E?s7RW-AMUi}MTw`$EjAjGQjN4Lu
z8z{S{`9l`#3q=bBP{GZ_>#+m3Os;bgR%FF9Y(uFQU>b<igZ=GyF$u&n)i+Ev$i{*~
z*#@aWVY7rNQV-O9#rnKYrOpZMbOiu0mA%<MayFvH8SSnVMN^AHzGCi}DfFP~i9bk2
z@RrKzDGS<gH&$OGdC+GH=8A)#yfLiBEb9N=4X%90<ymU~!hIq9FH-ZqBbD6o-4`1G
z0Wow4>FxsaTbN)Y!$WF4QH32WZP)1lYFQ2(uw}UYZAKHZXEPV5*kPWu*Ba^(`RxV@
zJM{8#GbTxs{YLWx2y?C*+BO3l*DJEa0l*uIn~57X!~0w!I|V6m<oV#S*CLA2P6LF<
zckPhEWrZfNRFixdbk)W8i{6k>qH?YwCb0=~3`5o0fY&05age;<w?%1h=jZdILwoe{
zZo-cU3bkr;*4{CjGsK9nWi-&cH}nH6!tv?Oi2L`^?Szd(m<+?5|3qg>yLPzV8n-Et
zne*>DrlVvXdc=h!Nllugsm!;0CM&cNjPGI!Nx1%aCmA<E4Lcuwb?3!h1p<{y$XXi^
z&k8I@+s{y1%cbJ~%E9dsj)_O*=?cr*Q~QyQ%o#Bv>(IV*j1+YXxE~-srkdArwR^+{
zL#hq^S+K2RvvnsRYYS~H*!uI3F4rv#(^p6n69^$cb%r;><68&2_DOW3eDU>mwqCh2
zpktwdS+D>B`unE{xgg#c^61N{Bu*5LWoS%5o?!Yozx>xLF1F^jVX^)WM&`$PIUdzl
z`h4#-4qRk!V$%(;<XsjbRWA~W=KD{KC-L+Hk(wMlkc3Sa<V}?TF}&5~CZ9ht$rvH;
z6D+yCQ>dPu);RoN!dbl4OdnFOaLzmMzcu{Uz_;6)svAa^TRM~3(I}B|^X;$Mzl8Le
zYTHxjF*ra%F5S1!jR``%gK!5c=4LkPNbS7TGf3wa>ilg`^)AGh-(i_L!W_nc@Ybi=
z=rAjfFlAf;ZpinTGi;s_5pJ^QN;tibuFzS&+Q1@cv`E84leSX+V<KP>yZjq_t$}uP
zaKJoK*>P*k7q?*HH#;u$yka*lfijpT-+-kf<2752p;b7~jiFVrn-99KDR2lw2btpY
z%94Wv((KE}2vO|{W&d?FQRFYQ@b}pG8s`ocf2*wyp+(p2GUTPpx#;wKU5WCws^;-<
z`A*?@Aj=RT)19m)&B+vYG<b(MZ2YKSx@=rz+h?HJX75eo1$v;?R`17Ge;0F~6UXAZ
zuks3f6K2VOhk?Ig>EU<NsJmZ}`0`^L7C?lwL7G&df~hA*rrwRxv`cScGOi3VaX^-t
z!BeF@KX_c7*A0eb1(O9lJt%=YGXVi*_Id1pD=AO6&GneRp?^%PJpTO`04ct{+2T?l
z2Rjk(8J_fa)npF~546W-61$8vlo`Bx$mEd*5%)6)sDZQw!+QNwkBLarTvborUd<Wd
zyNBH!q)*^(AiBsGf(e#qXLe^cpr(5Yasfy&NEMIZM?2cnIxv6%nir`-0sGrqV=+t*
z1O>VceoJHd^eQqMMS}@+t+9_40tFO2idnqOgX)1d8FWFg_(1c94Ljvwdk$NU-{x5S
zDbuf5a?n9)=T+SLL_ygVS+;TaL8^KwgY-^Y{erY?Vb1O=!1;y%Ya^7zF;_saNv7GV
z)eZ9LuhJziZw+=L;5iy4%aESwQnY5u;@O<JFnq`#{vG=7Rp8!Mqmlw9PX`RZo!En7
zzFwv?4;DZvTSnKRu}RbUgOeL}s7okut~kQJd2(zMhXyHY-8ENmshv8o5|oi+5xz_W
zZ4I+JXVHcZ%2Ztik_TQ|dAhUGo^>d=a<wTYQ_IC1)QR&k|1vG`-&5=9mT$-qrb(Zv
zmo>8{CF#~z)Qc$#yu$}JzSPeSQdkAH@lg9r@?9nv4rQ;@xtuMx?}F_iUs?6%zwg{y
zSlILSTHqbd;Dp=2rM!I7Q@D973&A0-p9~Njdbm~tGvrMxJbrkHq*wrD;wq4G9XyG$
zhgW-tFFR9Nnh-8w3>vA_c%H@z`B1YC7Ul*NCOj4dgw#T9UL|f8GwCU{KU0nte7vn`
zD#C)AjPSnJKMz7XQ}f=p>l-kda%hD_*}tiw3BKK!LF^?L%a5OTH~sopufTAhzO5*I
zFAv=i=(h;()%gP{sC#dA*GXOY1+XQ^Xsd|$NDj~d_f|Zx;YoY9KSg!3P(l#VYI^g&
zjNTup9Cd9Avw{_-o`!1(ehEssRG=yzHcv3iZ&<d-A9g7q3Xll7+fu3~Cjt_3RRG0j
z(@ws{>E1gYLyh~CV2JID{6#Kpp3++ejyA|LKbuK;^(H_SY`+E^Ggt8COEVb9qC))1
z@rv)=Z{VSu?lqP|V4m-B)*?)drSNgEsK)rZGTiiqid`i)^@wGu*PkzO)%wtm3iv+T
zdDtXD%59ztnmZR<->N!gt-COO!D!){-CmFNQm7ZFVrggL%OXo_j0`4I-GpDJ>hQIy
z6QEM!P^PZskxk67;ow<AFHJj(!tl=wi-nA9;(Mc}oTorv(~k}Y{&w~b1^;ryY)374
zdk%~Rr`y#i*qyIYL+Fr7U+~h2ZRC*op~^#n8E@R@`E7B?xFuIn^7y2oZ7A=4Q8vOc
z`iy#0+pc4Vt1L$%;lD0$gZg1TNzZq@X}QzIhMK~t{~|JfGJEhLuz97Y!XVYO21ml?
zd@dPkPb`$hr4S(I_tV|eVia!nwkX!Pwjl~?Xg4#`>VB|OOk2>szA=3gyD|ukh;W&}
zaf5Do_%l1TyvV~2#USB9^24-$zqmsa8suM?DMYN4_4q7j#~EyDMlO?~&1|{}!Mts+
z-|?koO<`1-hxGW}N!P$obaK92CUSx_aYm@6d0KiQv+|4>uHQh`W_W{iVFO%s9PRUR
zgeQ0)zUTbFw<J#(u~0}JQP3N<8|nIC1sqTw3mCqL7&*=O-EB55&{PAFsrRhRw$Z$Y
z4jH(NE9@+>JtaXUx@$i#tnTIFp?>J-`wJxmg}Ocm5=OU@)Nz$3bAk=`M?yXom`3M7
zc6s=*Z-MsGY&gfa;4}d_FaqGQk0s+x&Qknny-)9@SFyiCW0iIpW#hMYefYOzP7ZUW
z&^f#9jm&Q_b#G#N9kTu^(7^Xnz2-@UpixGvbRKQ)_FJsYFN)oLM+}}1VPJ=4nd88S
z`j*M&2zA%C!ruwD?~T}9mP1u*H9Ovm{J0gA#TPZM<+Ch#9OddE)S)&Hkm@sKCMCr#
z21Y+&*JkVpTGcpqL_IWG8e@37X1B4VocS?RT^~0SBIv8Z8$yp%`n;D;tRsIi-9^XT
zQyMR3Y2ZGv)M4rqU4-ZTsY4k`9U%*>!eWNN=dna@#%Vg6kNZ#ISW}3CjrvQI44oRT
zUHEaOI{|IgiSoRQ%;is0YrLocrS!1rYW=c!mmI~Q7~xg?$5I`e*Qy&=Lg>PL{@|t5
zGQwE3v1atR`2rp<ks*pt@2FS@2P-(&Gg_TxF9qCgoQ1W3?u|=y)XqYG<cXO670(W6
zvp!wtTWbe9j_31R#xpBABX2S{W~YI(nQ$4VSOe=Y@V67z0A@~L4>P(I4!~}^FN)?2
zrQ8!b>&r*a;h3p(z<0^VZ$y>gAtlgRTMt$!!t7ITL52v$dnG!4HrD~w7sDHAhet8*
zdSpxcNnpJhc&96y31w_B&zjSdRmbBep%A_-pS~181T7>*fmF1o6B0yN3JK&>nFIDA
zC`R6F-WS(17`<ul!fX4@LZk}tAZSk0`Al7l?5({_ppN6$ggfBLUX3^v*{7GJJ)&98
zUg<>DXN9}%J5+rS6uuntC#84?BGNnFpHWns=kWLbWdFkx-m%g?>x_r}8Xxr9T#Yky
zW;5hjR1Y-*Z_xD=7?f$a8Gy?s86&h$E2lXk%~YJxnCvp5=a2}iERYyN?hqI<7FsxE
zuo<QryH94jw@kVo9U?%AZc_|+E|SiIlj7NfxiUGdsB-A&O=bX|u{pyn>mtfb$nXNq
zJao(DD9?#8_f`8wVA{NW(U;kNa3RtIxy#+BYd!2>N960r5R#tf!S|c)b_8O9doNaa
zC~z*#o|gqzo>|W@OEx^~!{u|r?<L+Tq1VmJl-~`1{wq+=fsvhGOrAMH&#w4;@}5iN
zuSOl)pFj*Ld(WPB<~X%=Sd2n-G8wWdVE%ok{hGY-XRgnwFuKxM5z)M^SG?gcL%U&<
zn4}#r%%qLY1f6)Udz6`?Z;L74VcSCsLHZNP7$>K$k+PkBR>LDGi(}4X&v6(9GS=Jr
z*TZtD;{UHh1pOa8#b_)oP7whM_<=Otf{t@csj165N8I>}LLXB8O3A5QZY-6lMlP(y
z4&tIIUKRk|_&4!AGF5Ho;UwX_TMKEu1x-m4Y?o*DclmSw^pF?~vPR4EHpFEInqA}e
z+T-Gg;AgWvtv;R`w_<ygMg?w?1Iq3V+|83<vn$y=`Frw;a#hmr-BnbZF+TNn2u1Iu
zy<?qx47d44aX3J-BYI)O^WKb<&4bgc6dKupvoZ2zJ8&2Zf9cTV)y+EUA4>@}n~gtc
zEB9;Z2FW1jp6E{JjMnu(KMr*j0bFkw$bnjOq-%a<S-lQWG<)vq-vy*vxE*##Kqu#Q
zw>j1aF4w3Dr9QK#|3{zAhVA<;aA@*k3n2a5Qju4^6&^LB-(e4s-H6m>=nD*8JT>_3
zOg3Pk?27(9TcnRY7?Y^Dz5D{SdDl}QM~h~y$e<?ermoR1C4hA8=_W2=QF0n4!w9XU
z4hsc9c0qTxfbpcd^0vWbOpGex>fyh$(eN8GWSmrDAFY2#zeUH9x86Wn=fwG8y&97i
z0-cs)GcjC_?H4d2646`#k_>vSdj5(0_1=EtCJHvR5c!eX_l$?x<k&~Dw)UgYtm_tM
z34JFbTw)l<r<%e1kC|O3=uJ-X6d$tPR8_cj1_kDcTU$};d}DUwkf|HHDzlBIdc>#H
zc21g&GqNpG28EG(*qZ!07wQrf=()%r@b?|<R}K>aB@Cw7M+(C9J#;H$ezmF1wpvfk
zYb3+kz+Y8!+gNethv<YRW8Vb>hsf07^Y1?1iwhwF!7#mveIzBN-^J8?-2&?Dpa{}h
zKK-~ghh>XyDJHgU|7r!^JVpKun42!(UhmjHJ1ai9UOde`K?pqp0#kp{{mAMJv$EnL
z{WUsmO}1Wxk)}i-^lBIGws<lsa*pV=UWc)z9>zoP{u0h#q<!^kN&9Xs8Rgz6!UKqT
zC)Vz7T}pRKw}@A6I>EonGhmnx)Np%vz|Tr=LhJezyZHe*e>FgCRrr~vyc1C)Y9|qH
z-5GEs1(C(_7p5=fN;?0OZ16+wBos`0kwsd&pF!PtV3gXSvxV?oW&6jjk**G!?U=L_
zJa&{|oOI*QHnT}d%onicbu-19JfUBg(>m#d1o!8SRsRmMTjl3W4{g}{#4|<D9n{Q(
zu)Vdqcec2ezrpsTQZ$i#euyUGH0ZN2_dNH|cfDC-Bu2Rr%R?WjNN<6=x>NnR&RYf&
z26kxKu7(C4a5`FjLD7DLUHY<OObAu!hV^x%Tead*wX>+vi_aErC*YsC@reA73$lnq
z@%u!26Zw(BGjlUwP4KO*aEbE#TiFJ+!4bmcVNOEicF~G|?Ef?V_U|nHzm_#q->%fa
z*a|Q(!RU7#lP6Gsla0EVPzxDfQTp~swr#<7@ij17h3I=;O%hm(?NhMDOmFzMFN$pr
z(qHxm8?y)v_Ki2zkv@B-OsGZC<k|u6Z94l&$kf$-$MJH8t)X#$k<xRhLQUAvOQ5Q=
zL8ix%(a@!ahQ=nDCQm|nk_X3qOS13E(Ln)=zf~3|iw4(8hmBzT2P?1WJ7FTejYQXB
z*%_{qh0!~TG*z8GiO-h)n2Qqr2d$A<rrMm)@=M}RJLg+HF-aBh;9m}T4!b;!4_0EL
zA6faWeDktn&7ba5ro>(E=eH4a7{W!ehS*%<5XLLf`8j%4E>1?Bes-D(k9%`auCMi+
zgzxKK=Q7Wq?5<5qA2EDETCdk#U0ZJDvodMUZtXK*F^|oiH&9uxui7P}tWHRmANMgW
zHkM4t4F-!`t{D1E+Moa;>wCgBq)9nkbYn)>gX|TpWoL@>mXaWSMa)J2AX#TMmd-A`
z<?mr@Cm}_;XP~hFE7hY8gN&!rgY~omoDNlovx6TmzD?zKs$YLGHl@2`@V%Ne*YAg*
z6jcVPvVkOi6U5BcH<i;<5!D~K-exUARa)6>g%P;7a-56|QjE82UCvF7t%<QZuVNTH
zVSG0u*6hUc9Qpj+MHwYLjCSl&koY%rX3X#tjtgc}vs!ZHw%u;bZgT#dUO?p&$m@;e
zv-Re^X~|BJBl&G{sbL{}p)PR*|JaH<eDbBl>?sa{f#$hlo|cvMkEdsFs9A+A+45KJ
znp?+HUp0S9UT4Q((G9RXMr;0BR~K$(BK>a?qx(;-w~FL5y@$WfeD8iEUv*9!H!{d;
zU+i{QjrW^~ct0RI0;m*90|;_CdS2^trZjO*<!W?M2SPjW6wiI}6!7j*5M=T2@qO+y
zHzqDS=)1UMqkq&sZEi^9w{zlt;-##o%uS`xU;L$Berzty_8|yb&*u9&YkO}svewj;
zT|K;v`a9E<JFK1jYTc^^9(Q{iTl@6rdWG`^ag<aW+_c2m1vfc%W+w$aBUW|WJj&9R
za7gy>w_Tzx>#~NCkc^u8WIE6?N>i7Hr6lh1dNk)p!XU8@VXxME>y*!VetUa<e8dLo
z1fA<Iqy016sZk^{v+^;N(uvX4A9~a_Cv+cUOEPkETbOUbR)6LsesZTtUQ+4~yo5-d
zt7+9(c_`Rgit<Rga&M;7O1eoh8)Gnj$Wd&==Iy`8iqdqSd_eyAlyk^4jD5u}Z!XO+
z&D#9ZQ|hvn|5hx}u^;Z!ZN37{$23}t{1i=Bh&_9#iV$u0kYfY~Xe6a|ZQU;pESM!y
zx)-!gIY52g?ft&0`MBCtUr6Rdlq(W_YJVBoJ(20|VQNNXIjzC{a&|4(dfCM7a=obg
zcw<g93A+v5o81=Ql+tv;{<=$W(_)j}a#`(=;^-*NGP&*+eoAGmQT=6v96AX(X)0@s
zq&}a3Tkh&wy`2wE|AKC_JLdLvC%iY8BYP7mdq~BckI2n!{}BS8!%BvEvu)NyR7i5P
zz@CFSDJKvjMTzfXJ8CHDXVOoq)1Ak#&uOxyxf!dVP*y<rGQq7H#c0U8xwE};>+^uM
z+22KdVH<*mMPBh0z0zEmlV=GZ7Z~?ypV%2W!bMb!3-d_0g6*2ZxOd>j3ZTZ#nX;DB
z=>|EH041>nhLJJ|TCIg;RoeU@<|9g!d!905Z`!Y^O}7hC8uZT|%Z+*Mj{)bZ;Qp8}
z=gSig;`}fj&$r&bPN52U#gMMQecpw66xz~MRod(wc_k6_ymq;_#yy!ny@l&!F0xEg
zmTUSs2i%6F(0-TKFgV0;usY42=unhYz~xo#!9>J@rL-|ZE}P#EgTUT&<}~%ZU`eI=
z-np*lxbF*xAYmt)wT^EGkWatnn=+_-DSW!y<Q&%<3fQ{iX%f&|tw)`ZY>y*7rE;lx
z1Mvt!ye|ze3$AlJDU_Yc^;}%z)XM5^bhmatk(qr99bVfKhwh|$$cdQHm7NuJaxN&J
ziX1}D_1*d)cigTSozkKhL51F{f@wR6z!{7S!da<Q=%jiq7mKMKY&FlZ^t%%5O=diw
zvNIpMROt!rOC72JK>RiA-WO;*!3L7W!+npVN4z-`+%pQn*O?uhYA^`D^ywpY0WyNo
z2*{}m_6VxKFf)AM@Yy9_o;}zv&_Cz2zkaa)VE;NxZwFiiCwX$Lw(WFr<#AIUzHbwD
zKm&OAslHl$@35iRnCDXllD#~fV(m2Bj*1+J-^V#ITB({U8SOH=-dk}rClgqahlq8)
zR!Q%Cn}iq$$oe;9$DMm-b5zx<=q62(GO*JV3Z@}m{n?pSoF|*I4A>gLgM>D#Gwv$B
zAc-e$M^oHqtj5<~(u+7|rjGqBoB3j5VBLhdF9r)6JP1YIWw|{{&{pKlEtmc1^OFLt
z$U@vixIZjt$03ZD{q)d?G;9BI-<XzK@xs0omA+{r+Rr7Ov<f=+#(__Q)6C`<yoy^n
z-E0QJ&N|j4IiJvJY*8JdRkaHb6dl00dflT3n9FeQb$q(Gh@N;6l`m)6A7+ALpxoMN
z&PLJqGj&9xVZJID%5F|RuV}2bf@Tj?L3iji9uQl&^^a{s%E2&KN{+4}WE3wkRod3e
zW{ad?ZgNpyh>xlvu1LTE7)ZA-_(fg1{0A8Xj<&O{qKGeC2ZzdN+0Lq7$jGde)&Y5l
zw3T-coVB;Foo}vLbB;Qs(`9s(1e2E~@v>8|nKNp)v5j222IjAOMUF%VALyHOTh_(j
ziBC)-3wfv@L&!OZ`67A2AwoGR$$mRQXwWpK%8av2Olt*fqgGmwLhiPsqrYJ6-m1My
ztM+^Pe_MUk&(5)ifXFb%^HuKqdNnZ3=2)Fkx7Cq_{z7m_@_c=3O}?{}8|Q|G;pL!J
zbtA&x$eNe(Qh~lPm0}>cT$1wQho*g>y4msyw0x!e=<bK&W9DFKVn9j;mVmjFm#Zo(
z4A7lI9HT!4@=maHJ}Rm$tLieeAATExM9+`q?DDuCX5Q*}OS^dNp#PnI2@66(<!O^k
zcJ^}8<esVH2nl*%11cBI9Z)g2?kulRNk-X}Q`cxOjc#<X7&)i{(RP0!!M%>sda-kp
z)S0e3vuLN+khkVLrG*)Do7MA0_NhJT;8R3+lx+m?wQ9y4KQU0eq^zp<>par1+WMt&
z{kTwtTW`7ugB)7#lYsk@>fq_^h$#TcY;&|Ih}I+z@^=jdLoByYW~TS?ebw|u@GV;N
zBY=xO;My1-lX{J+s8T=S@Nh(a+qve62m=WkP#&ptk?7=J;E*9)Vx&;}4&!`n^FO@+
zB1Pf>l77Wm+<@g!mCK^p9l}%2HwlzCSQ5_|0TKX0)p{SS$DgDnljD@=<ga5e(BU+k
zq_XpfOq*SG{Y*A3^62XjhDKbNZ~`GKc<;2An5By#JH~q8S4+Mt3S)UC0_%C4*tyPF
zsIm3I6@fTSq&%^MuFQl97_bw5;dV+e?AXQjiF4Dxk7)#txDxNZ!2oM|>J6%*&;HVi
zB1-uH0)rQFacLh+a@C^gQcB(!doRAEWodWx?>nm8roQ&cT<xjVV=lriF&7Ov@7=0}
zQ@@w=3Wv58fCwb*alGGENh)Fz9Y+e=!F3pu<_9J$r)jZqZSd)(RW{D;fFB^q{kWJ6
zUI~Q;FAAiop}lf96cU80gi>;$IqeXkUWeaG0nlE(^>Kme`a_z|M8(~J6MatRmC$)D
z{(^e;{H_3$H(9TVJA-;IBB-Vr43URAsIFh%=`dG=8`;<Zv9yc1LaqYTF`tVo=o%7r
zQu?iPpRtE&A+RvhiWtLFa%hwA5d$n3x=!N=g@GF$uQXO`0q7nr<NlIs{ia?yKEyA?
z@Zq`C0UeQyf<`UPv4o2u8xO5iI#t{|ah)s|FSC<LlPC<gDlX~<=?Xp5?6-Gtgn>d(
zz<3F2OckWg?+-%gWKZV{D<mklQ<xPIRK=6;V_+wPX29TJNZ1q#bN`Y&DQ|;~iluE`
zStF|2?M3iSkvvG&#)-=JnU8Ro;!7z1i|u?{<=$_v!w3EL;*4o`;F$zTKR9D-wLJP9
zsW2PmWoHKx%0_nrX5*}c@aqRqH2KSB!z}Zev&LN|0nuN0BZ+(szwQYRhr0G%RK?#J
zOUfpPWL1Cnj-j-;vsF3cWG0#8RTpyeO@Hg165eNu67E8PHm4{V)rC(T^oljv@?nU9
zum2Vp_+@%@(59@x5^*VZE_?uTH4>l@F|%Tozx+gpfd!rHBFO4P|27ve$(Ljt??IK6
zk`eM&`a%Ri6m6F}!j<|FnF?aN3fWS;3p_EQ%Cn%#>XnY>LB^ThBboMr{u-KxBK;xb
zvX*As(7{<ttw2_MA`~>PyIxPon4UmXT*w-ln0;GeymhmOPY;0avh>T9zJ2SF^^a_K
zbe!)z;Ktra^~2l^>PPP+tp_}$WO3dA12mqP`q8atu;)Oc-?!Pp$K{LsHY!=Q<j|GK
z*Kdb@akws(HF?pWMSL_AdNy&e%~<b8NXao=I4kz5R5bY6Jf1r3y$gWQd=`%FCg$re
zGd@5AbdNB(opr7^zwXsyO<$DK>Ykb0zyKQB>UjRcWJ_9CNjAnqjUGd1%Iwy84}5$3
zf^ZKtR?Rm77mTS6{0RgVc-Te?bTFq9{u1x<{e?ogccyeq=#Q_8F22V5xy(0L)c2U-
zsoeXvWr?rYA>p9nItPYI(G0M^hSvE8+#UD9C;3E<YIc*IUGBnc4LtPDhFj`Av)qrJ
zEcg1+gxV+6_k>&zG8M42AS7J>hF=Q}P_f>zm}3pX&nudou9U&SMDBogjU6!3^v^!a
z^on?OTK=q~dC2_d4{`^MzutTM-OO!EH6noP9cn94@w&OY>{eV8jIDy7CQ*N9&^sM8
zyjYY^7v{#Irs9c``#O!MwW1CR&}D#umu?9%6GiB7o$IE_{3=t|gwiv@;O51`q_%Pu
ztZXci%clf2;G(eOS2<H(5=}v+Oe*~lZA$a^R(IJd6+&4s0s)v)?rD%IdDnDJTg6j2
z?$;I+J8Tf1_h7!4#fmGv>$A!X68WK3mT}JD;gd(YH7*@39oK!ay!0caO+`<;U5Pwz
zlIYFuF*1H@ami_(y!23N^bGDMZPv|WgvVV%<8lwMUk{8DC>$v$e;!LDR(Hl!Z5=rn
zi%zbUKm*EZ4w=}jGe10f*a7{GPoc-}51)8CdVW>+HHPO^5}ZA$Q<yI=n#`iznR{8d
zhVn$w&T4i7xy(QDHQcLQ=*WB2KaQIg2N5FZI&yV3!8x;V1N^wt-#HL%_(6{BEzo~6
zhL>r-MUu%L21=n;S&N*(ibFiM=%!LV6pgNLJS6KK<4Pzc(v;*o_R+q-1t!0A;e4<t
zFg-$lJQ>@b=hfPmG1Uw7DNqYNiH~Hx=M1pz)z|ZcXdc)k*eEjB&$cdPWj(jZ*YX8p
z{<1yF_^DM}Pez?~rqCioqQcAXM+&qD=%%<M;yFhWkse*JpLNhA6Q3@z@e}qZI(hC~
zKnVlmYMZOW5FEug3k)DvO+hJUCH-Rj%WT7@@g;dC2qqT$DdlvhjdUKbbV!hoi%qY!
zMBM#(Th*QkLU58HkSo57yLE>Vx!lt`%*w`H_c2kC4up5?5ph{bn{OQT{!q0ZkEhP2
z;682a<qFz#eTPOdp$!2JC~M418hr_rEmMt`zg(e_#;Wr^m8?xq7$@j6%ARh4gSlRm
z?~xfM4W@>PAWSGL&@)_pg6!cImsE+ARDuFAx@*9t|9Oo;7?~ohLN&HN{7Z~Ln5_w9
z&We<l#_?Dib3w9ckL$+pe0gg8Qk+c!K5!t$LQ1^g5Q>wTzAin3!w?$gR)@q?wayjk
z;g=5%1BY@Y)jLTowZX=5u}Zj`V}5vD?GFV*+RJfoz|G5B7dt+P_cr1olsu{;rf}!|
z*b(!Oq8E}#@rvjf!gVE&v>bd-buYwehn>e$IK6g&Jl6Z=K--nGfn3SypDWY7MO=0F
zgAS0zKQ10xJHCJ127aM}zPsLClQ^c>pyY5`S8hD4ikrP{VWqzJGP62PaQX#KxqlSU
zu1r07G4};FN}<$m*zwc)q2N@VIy}uvU4eJoc{aN(!dT%JTXYTo9@KbQPWU9w;^?5$
zS}euHAf46h-7%!+`@lyKk&qAAs!Ve{g^Ls^)3U6TItvVz3uL(HW&LfX*4Mxx#?uk(
z)9V`BcI)dCNi?4GO6M{r9<h+SH{|eryd7XQ`}&hWRhI$)DJ`lar6#+nP~HfEab&`F
zmq)Y5`Fr|BvHE-SotCnLSy%7j1GbOr9KK}ku?p!kl|1>ml^opUefhHQ?G_c1C%*Ib
zW!#<b+uZE789#C9zfnC|AChhjDr;e^MIfCYVqIVI+i#OZnQr<S?6{ci&$<F^Ju5BW
z)pMQzjUGmKN3dkF(Y~cWkXv%f9V*X=gf+m*=x5Q`-^rbKJ{JXO<qK&5n!J_iQ`XoN
z7I;=}gjP3=b0kxNnZKsA@~Bl}Snpy^#lYN^Vhqo}_0(hbG^<`3paV63NlnZqc*Z%5
zc$Jc);T;#8?Bq3E)EzlIjCd`)Df^!3u+`L^PW_o|K{dr2AlbiU9_(<00$_a+UL}Hu
z&Yc2yaF5pJAnZfmSu5=Fe|oz=KgCILDb{zi4{)U|S8p};{|5H{NNTg|8aYrse!xI`
z=_XCBW3ZSUGlcSn6QlP!dyAKn)6CORUm}$qnf3$ap(-ix!<A5`6CS_iv{xvk^b2H4
zH*HMW>ilr7LavdjJoUPus$&@*x~kHn*Q}Ux{wX=UzdRJU(8XA=UyPkoktTnvfT09q
zq=2d-|1r|G0Du7f%Bd}O>q4cziBi$!GF3WRNmp%bVX_|e(yL;VsXip77j%ihB?7kX
zYeZyrko8fzFo0@pjz-mjxtHL+8NZ518Y3NBs>oa*m0eU$`Xj$G%HWe>^%@}2Dv0)L
zkf|v*Mw1ooz-vY8Gg6JUIupA~irFfa#=5S)!z9#-b?{TY?-Zyu;Vct1=vxk8q}`Vn
zl|r39P~Iv=^VN63MjLZ%>Ff&Y&;6&us)ikxUcq@h9tLkje^u7B6=e)8%Uyp|o;!bw
zf_S|BeMKaZx&%yu`5BZ1loH)VdUnlpPHM|dsR!j35dn3<r||NP#QLff+F}Zt;5=mh
zo4r`rw_jdjnK>ZZiI3T)((yOqm$R>~qQRwivz3n9rm=e%Ikj5*v*D^8#7b=mD@pse
z%)=^wdIU)iK1+qKT#F)ANY1NyOLvHdhowkQb}=S4bC}Igq`Zw{hFS51u6icW%+XU;
zX3O$zoKuo`%Nks~Sn63}YxZOh&rN2QX6wuCNE~(7<;??-ou=|z-^3qDIk~H2|I3K!
z3c2c?@J{Rqif6~mgl#L<>w(!VTOD|K`<D(UEvy+n$Wl%xtmbg~?y^Qs&K9-x?lZ2j
zMw6=*w_(DniF(iXE8-xmDm1ps7RNbXADf*|whXVO|BtVCjE*eox`ivYZFlUBZL?$B
zwrx8d+qTV)ZKq?~$xT1cd*A#0`hL`?8dc}i-eaA$Hs+dp&AOKE9AqxflN?)VNHad4
zlf9!YmdwB2kB^TQlkIuI#4Wi7MM>`-`#sjW%w-4R{sXs<s)g3Jl5Z;Y<&eAiVj?n7
z%;uR{&7+$V+olh{Y!rG<0z+nM0SjaeV?Qh=J^v~~2?R<Ew6J)#f*H*S);(dK8af0>
zFJ_}rpMK**ZYi0`v!bOg)uu70O7OiSs$EAhAlQN=f%>v36{KO{Vc@mEDwDgZD@%B{
zvU^rirb7>q_##fAxumUZ0z}j<Cw0SXcn)PzJ4C{Ezq&1ul@3Gdm)a^5@t{q?sFB$y
z3Bez>eXW}_N?X_-Sa0r|On!JopGpHEb8YcKKj`{uRbA86sRj}8ZmnF?bJlLsO_#4{
zb6G!s>fCsGXeZU#wUON>w9;d|ydVK)z>Y!u=aM3x@Tbz*=+CxP%RlI%Urs;bQd}!X
zgAbmxvz$lz1Fqm_PHZ2&t}Fs&LAn?*Ucd)l_vKPp#|bosm3KmbMb`YXHVmtitUM8<
zstTBIVi;W>jm@bemk)&K3H1z~qYIn@(6QXzzuv+DXKd~SCJaX>$^^@dQ&gSE10R>)
zu=V9c;fA4vyLuPK1BjPXRqEE-Wm>W_ZD*HVi|zF|-xHUeS??puCP5Aj@SMbCO;77^
z#p53~g8*IKRd=Q`uj9kSG8OW_X9m+2|8UF-^l}4Z?7UaM&azDDOmU6Fk-jc-fZMIg
zmRr5xq34%D0zbq^bF!+2n+DR381_9?Apsn?+-HV_2PQ1TalEgeqd#d#){`2g@NW0s
zU$%!|x^vN)a>3rW&9PeT*pH1~17#|v9>sk>xgifP9D-re3m6^u<FK%i1xz3)Ao&B$
zYw1s$8?cx0J23Qa!7bWkE>~J@c?KoPo}X;Fgt~hjm{kU>33W`R?Y?&rf4|n)yeB56
zlrXe%N+?c6M<)L*`HeHPep@!CDPxDZvfn_F^X?9EVaje|Qe+ECRMS=i5fi_wP1Tq6
zjRR(mGeE!=P?as!-F9&wxKeo=oRnDrm78{?77NW_FvTN2_uu%W!L!^4)!7?kv~Ska
zSS~)oMS}&VYFOIS5L*lOHWu^!R!;>xIxqXfflS5a%Wczk`@~yA0`=pD{SNO`^#hIY
zq{rps3P@ziWonnV7r%EDFhATDug<GvgN!Fde0c+#@AcKmUasMlR+rvr*V)oiBaG(#
zO+(F9^tmaYT$9Bj+?FgVOBpkxyFj(zI8!uBY%;FP&H|OX`j1o~Tmy3E;2W6WEt1jV
zp7d-Tk`iS%9NTt%6P;-!Oj(L_RxXsVtr>GWqd{ROzqZQY$U4VJumucY|EvKYwYB$z
zIQGclX^f63u>%*53(vO3c03Q2R~3Xn_(ub}8<%5sn-zAd(x(l7W@~z4;E=NRvR|4~
z8?kY$y21|7N1Q2L2uMP~cD^YH$Y^kPR7ZQd<Hq6*Sb08GF41j-x)SOE78~+QoT<+B
zLc5iEBJae){94y{eqdD`Scg)8XEA6$T2=Gda0VOm?WYiyPx)(~wbrAFhl_Bcn#qcn
z(;J#Rxt=3Bgo`hwhwUafEGWL~lRt8-qkwBy8JpJW*yRw}2%3+-ZY1R!CUP>>k}}n=
z7olT@Jx@Nzv!nh!`0M5>dCP23z|Dz^8}>g6xvSA_8fD^vAx_7P_%Tic_jQdQ-=G1+
zpJb4FWKG{Hh2UK`vZcF`_v09gOLjCqOJ6<P&K)O{E6yYhY|7N*VL@`y*#yQu7r&VA
z^0x@LzyZQnWWSvfhN=Z?_FAdfE3U_mA9~p~ug;CsUmT`vAue191{OxRCYjClz<bA8
zk8~M#jGO`(`+Fs!|D4-;ZXOv<mCha4Y9A$M5Q>6!-wUOlY%NBbnD}NaM^%Bpv@bQd
zL?p2+sl$+!s}x%|#oKBP(RV8zCvWDzqC*0VX&;+bE%kuBykw2Js&3gUKp~^=kZS+{
zqcM_K%BruiX}3?qgOwJeaV}K{bXf>(DQgZ|IthCh@LA$*yJlt2>A}cjfK)s+iiRr_
zn*k}YUbUSw@g&fe8tmyxE4_UM*uuI%h?oC?i76d-PV~8yIvb}A`hE%?<^K6!t%7L3
z`R_UJ@rN<JZ8x9ze9NTDudJpcP*M0(3}UPCM4;Y^GZF1xge%VKZ2dK<hH*VexToS$
z6M(!gaT6kB1QeowNSVyVBl)2g%A(zPkCrpVNU^n6Pv6}L)@`a!T?bJ?Eyict^Xgwu
zUILE1hTZ88m7#1d_>Ga(rfhF;E#_gs=HACaq^8&1N_9QX7UtZ=*5(x2T2VqEgd_tg
z(}b}6JU%DAsE(Jh+~1zh`FM}-$;(zQf^c{S0K`&OooSm8(Ta5q1p@XvdfczCh9d}(
z#|ii^=M<2dn*@<yyMiwXwIfrIBTNg(tKLuDpdykVC~CB_c*IqF!~|~YvNt417*IUL
zFeE4vx5Q<G8|B2{nfP0c_veVzT<6G6M8c%jnZ_5b*?ny^Kpw<1kInMTEg-iZ=Dueo
z2kz1BHl;foJ0@QVlLNtYf#MP@aD?xpbeDUa4dPKhYB}LDm68G?Kw0d*_q({w7V(4-
zNAj(d&Hk=~H*0<cD#}vkzSFwSg1~>}F1ee_7eDGd&ly1EwMjt?lK2GTN!;tZYVf<L
zJL5CcqdYvtaw#Q3=SlCEgE9RyR>se$`2z$gf+qle7$$2#jB_<rXJlt*iBFQhEu&b0
zOwc?kppE&XU@S6p;Px#JMJ*$e@>oZ-zH|3HBKmRzRCE_V2LU!bb^$=wCpg?%wr}?k
zjzTkulI2?-4UffSyd;Jv#Y)9tXcs&KstEOV552*(AsuHeK#sh;+$IWHOkHF9RQr_^
z)I!U-X*cZk&&PpR8e{;(`(@YkWf>H<^c8B1!eul7uh4$=Nk9Vq_*_$n4u<=|AvVs<
zWB1ctb%W5EPMZ6DBJ7gl%g@o}rtGXjadpG2I(cL2dH92l1Mh~xKY`C>bACn0fPgOl
z;&};9-QRv|8V@9W&S-$=SA@SGRgvB-FBrfoG4H-`^y5Z~=<6A|1dQ5YTa<V;$1BpJ
zhDla$C^)G=vjl@LX&osvkN_i{_GI;#=J*OsL2WDyfYHJtpnH%oSI6PUB^PyY2yFSV
zz@u~bkx7;RD-w^Jwsi+(p{1hyQZ#&~WvijscY2X=*=*s-%KRxb8V9^Jn5zkMBVZ(@
z@k%9G?;7vU<7c-a&u0u)-^$D4q2fcWDNnnJ6dCwL#)_L_7&v_P2HfKW4_L_<<zs-%
zc8yt(?U#6&(b{k_&3EmCsMrVdekB5I0^kMI<+1;)_M(~jK}30)csmG<U!t`iG(4-N
ze9YckO@1@H4Z-dVmas`@K8SjBX-t;{)|~|@<WWd)6@TF44rPaL=VEy)ba*?bh;-PP
z6^P?tioYu>=}yO-@6!drd7GZXs6qDvY<AI-8Saa>WUeAkJ>~gw>2P5EChnH)FQwjO
ziSiRe3DvNu%YvRDPq**$^UMk1kQD0P?mg|)S@>>3litC^0MQXv*4Isdus<V1+3WSX
z**Q>iLgM0P15M6a(*T+mTwYSr(k!^7<oZ2mw+F&UEuECr_nP;@kR(AkQvgj4-XDQp
zR3abXqM^#2C{GJ#sQ%F-=Y8Aat%wf3Xm7KyuyT;oOr`jMdQcWeA%Qd8rgEt``wTQe
zL?`&$a&Yg*TV)Ftj_yYRtRolMf;%>qtRQ`1)t8-^^ow=5kBZ6iJ;3x=M=@x~YC~5i
z?kkv1YuDaU&N$9zm0T(psRkBoK}Z-y13nuFzqidpwZ(n*0mj;~f3S~XR9q!xaOI>e
zJvMQE{b!H}NEc28jDG8@$F^UyaD~3s<c66{e8h)IvMq(s_F2F_&i3?UhfRIhhcOow
zfWLW+HOyY21Rs;QFH4x8u43Opt&V5fSj$=Yu4jF#3Hb5qa=P<?BvK~&zo^Y2+EFHu
zu+_Sz`ElEyJSRB!o6TA~sfS40Wplc~_EBm!7<O&jb1&EY`~3hCTLNw#^<_fcWe=Bx
zf2eT3pmOB|)RFSY=SDxt8=Ea1os@Ah;eZ$`o<Y7*?~sy_*OmRl));&pbR7OJH(R8s
z3F{Y^c{gIMVjor!pHxxOV|!-y7=Vi+aTb#d?=NiU9CVKUq<bYwE)fhcApFRi8gFae
z0xa_T5lXs6BL{S88`9T|{e>(Nh+rFS`yJf~xFQk^3v+<5mDd8aVQDBgLp9yaDPk}$
zJ|+az+c+I-4LEZt4zFgli3%YkzYof))Fz^x8<8uvZl;}7JlFV6Qm%JcSc}q%T|6G)
z>+)T79W8%h-yG^Lb{+C~IrDF=f4xxEggdvF)-ex@o(z@>2>50G^uFwgpasM6UG<uS
zSNi(cfbl%+zP?G9+uu@iB-Weg$w|A+>N1+8f}5tGh}G;cJh@G5uu-o&+%MVI@Gj(a
zI(`?!KQ>u+dXu!CCZgD_Tw1GR_axtZ>V2l$I=;PDmh)|EeHo%C%07r#sLIelRU+n8
z1t#@8+V0S>;dWSPpgdX4(LGLhed;zun`jvyt+2`1{Izy-ZP_uI?pCzmXeeT4Ws6tO
zYLw}-T$pcTmM^XlSYWn65d%QxRfL2&02}|CSoL)4PBwRpKF_B!8OeklSs=(BjXh|L
zCvD$&CtO~mA8o9}#n&9;nnoMdiX!&ta45$mQy>U8&bgq5Q*V{1nCRq9w-|j!dQ@!J
z;ScU+F0?${&}}%|0!c#fL(J6yUAjH0;HR#vHPtrw)a*m#PH<UeHTYnvuq<($n!Ea0
zZrZd3;ou}n)jB&cq)g)6uf9bO6(^$i!DWXHL&4?H`@W8YeB2cdr@kQk)17Spbn8l+
zfH=3<()Hf6^J^^rHPeEUEYm7I1y@MJ9AbAaH)paiBpn~_BM24hwn)c;ZPfP(<f|em
z|I*Kx#jIJ=UST3qP)MYFAHx#91nd03OXR!x*3DF>?%&X8G~TJ;vQ$z6Sf(sC6qZ>I
z744v8I+@XQfrEwa4gx@fdiheRbBgI-r2;vIHE317j`-q1KTodn<~8M(U93~)KJ{d1
zz1~A}5w5P9Y}8KVGH69q+(NMg?;>+_ZJK~mK!R&*;C%E2Vy^}wePoW}K|pFwLH;&P
z&wTSQ{_b*S<(}aHMs*U4A(GWE{#aT>ko6va%!tj_r8Sj}kR2LgdZ{0iL3wT81w-IO
zoHVgWZL`Yx7T(>eJ`mV8zrn$H+96NA9S?>$00{koYJ4#*wtr=~D~8nQ?=;Sgx8H)$
zqh7LA%v<s}In34wTxrjL#E$OOuxXx25C5_6ElWj49Z?1{j!0@#P;I$SPFIgC=y?%-
zx<PMSp9mZOu*#vO<0As%-|XHahy<x|uXv-DieSUv?*j?A>RdG2&hDVnT?BVmHo162
z=L;Pk1>8O^<C?Lf7K_)6wMMX4xP@enDUXoYcJb{xYtO#Yq@_7wINQutZZPNB7XXVs
zFg)TTF<928))YNXo;CE)+iinY+(@biP_^%}Txp<;QNeq@>A0K<P)Kk#*1ei#aos9k
zsz?7DdItUtJy;YggSS6m>`Q)<r+W8@wYn!<3h=qB;s?CV)$zz*XEdq~NQpe|pPw1E
z>$PA0xwJCHu4(K$M(AN`c3@7WgRD$i?8wC18WfX5+*4^dH?X#!;gOF?fLBRZKg{8_
z2(g>>CiNsZ@+UPYG^s>ohF&~B8)c*UhUoWt45rX^G!b$>r|b(%FdC$h+M@{Fdvdxv
zRyVB%h4+dfyIB~9=jjF@|0Mo;Y8>sRtK6s@q6u@6Aa-c?I(%!BOe;6E(}o^vpN)5f
zTfPv-GIc$~zBCQi^?tb64d!|6`E3qy&OtDNU*WlbF>>W*lc476G%2OJ@i<s~I2ooR
zgzo*c*jk)(NdIEM`}~UKkMX4lmdksQY>x7mO~-pD-1zRHl>7Z`K9$bR<s0Abklep5
zhjWchSH2x?XyLoteLyYcXg=8QsCGLJ#I^32MzdEjzfjAZgy4H&`nX;1Z}xfD%+|J?
zPVZHiUeHnEH=WXUlL<m9rI%EHdX0|dd3f3Nu<leG!~#gyd6Vd`Iv2i2RT*9$htv-(
z9p1%F32vVO;na-9A$XA<8RytUfBqWkqxGFiUZOihpE`>`M5l-C!~>|o(aWX$@`;bk
zumLUCw%i^b)JY85>H@^9{dAv(ZfmV}S4{s%*<_MA_KBZqKme%8)xLkE$IPj@N@S4b
zT}kJ?S@lkhw~TT1So%=O(d|C+Hm+-ZYf~&3H!R5geP1erp-y`876aFj^_&2z*&T^x
z@j&^`OS!32*!m`n$YJcg!tf*j_^I~6IHDn@xvEV$<YavaK&nyOr@#R=2P`L*<<)pv
znjb#q`%*t|n20Q(qYM0k)|@zE8$qU`UDAn64`#O*&&@Q&O3Pd7*L;+GlhB$Je(j*6
zgy%?5%4ZN?Y0+77KNox_oidaEA;nZx<;Z_2J|)L~Lf#Yv^8zaNMjSN`lq<!z8UkRm
z1v=P{@64;<8?_^goCXz3y(fjrRL>*3uR?m)@u84_G}D~VMv9^<_7y*tTMF;KhBukH
zZsV!t)08uQg>GH^tS|Fj@RX9H#RH?)K!(-1^Yvz0S^^}cq9;(!lbD1k`lS}D`abjb
zo$;y3;VDmPq;RAT@%UISz^EcBZAwn}{$DPD=9fmo!*NCvTn0U*ahphg<@e|Sf#`=;
zq(a|uHJCs^`=D{0eBry1;o>bi0kRyz&7KX+fT7t^&CGTY_zm}hDN!i?1%JLl6FWTK
z%kJX3-<=)I)cm-tYOAra-B9eaw8+l<c9^o`7X+8?1mLEJj_yAl4{Zti7jf2<vlXn>
z$Wv5$WuE4j3U9v@R5#bm+c5w-ni@U6kwuD2Gt5XKyekJoK<7rHo9Sd6IbMoBwR;5Z
z_0kFf5qdLE5diU>0x4k4_K~4|#qG&Mn?I^`rY%30;9!&+m`poWDc{a&?S4%kqFOwS
zxRj~==1^%hz&t<jT8Dmn!f7iWoqG14KBqqlON}l`tO0-(VrO^9wArz|wS^~RD^-~)
zqXgL`N^GTSosLS2extykixq{|^)sHx7mN_K*JF~sFwz-&6h^40ZDaW6^BICQSdH_r
z-%1r+BXB9x^)ZkibVvrxQtnmE6t4A1j@T8jc?zjejDU$wqrjv`l!|)o+BWq&QnLia
z{UJvmTc1!>&EnG)qs_Q~>zNI$0lfdNXF?#jcYqMwb_gKo*RIGulFmw}u;lRUdwgDT
z48r;bx*K2(=x^qX+q<<nT@VMND-v&;g~?BOV4wWHZ}fKrgA7+M&G}5)p?ya{!t=_q
zdF?PLoObu4ibfyquIYJaB<g)eh<3|6G<nt88#I0`V^ioVDYn}^sKZBh>jlB!{#JX%
zHKN)8?)bYKcQ`m5DNK$8jLa<>Hebin!@%`qci@FqOc?`y#?F3v=Uz25fQayY8-A;w
zHg8nj;5sDY-q~XJQRbA$brzuu)Q&Tn){nu3G#4z{)0VL!=OduQO8%_}N-W0$hFe)H
zPtEE^52s}`hI=H@_l)%0gDUE^6~BG|J3MYQ+;1BQLf}bw2`(@8UDz03tu|jiT#Gw`
zV+x`iLi-R`imiU876nKmNKF}r{U#R$0HAdmE+n3=2SD(z{UGReo@MfF79PTFUT^*e
z%h25WLw1QDpThwhIOtzxBsHD4Dml^;i)fW_T{v!7`+xP>%K%Ahml0{o`iRjz(a3B6
zMt=OZs9m0Bn<~cXg`R8a1$#yL!}aKY{{26X=$kw!{YVwy$r|1f|Nblg;gIA%ruc6B
ze}4YgkN@}a7olJ-KHWcKv2zi+`F}Ed^6+#|{kOAbxjv+|IJ2HwU8dE$K&HLx7<l9a
z#QkpBy3n%1&pEcXvXEcDuyKFtvYo(dw4^C7=gjXT^Ksh6)0xwht^ApASsr1Do|EyG
zCiGM@p9JfdKmho~2<uY9cd4IqX&$>UMxRTb&b4xR?D_jbMmeoywD&Ow;itmz(3MzW
zQ1{GC*932t<=CN7ZuU+%jKDh;*I3fid+7Ux;^1E&{|&}{!fVmd^MddB#pl38sk6Py
zc+eTU`9(N2HN`?Fy}qo!r^W5db=d{IEZe_g!=4?H*zDN1m_L2+d<>stE0%HyV_(XL
z?+Gs_!*9VPOEE@a_0vZav>nE?VtU&wsPOE17x(X_$mNTpX<Q;3RwU`G1JMFa$@`y!
zJ6S<+<nOZFB=sl<Q7(DQFZSjPP;lU2P`5(iI8VbULL&=W+B=1sk{-O4+7SFZH1^lR
ziVZ@%Nkh9r@5F>T14lta!uGcxjYi?ts_7)oVmoGxHwM_qKnD9PtK3hjl;l!p%t*sX
z?GkLr1}5w1l0_<2`{jm32KjWmR{QD%k}t%t-a)(rU*t~7*q?dhOH=pG7Y8ErhyoOj
z1N(;G8P$_Qh|KUe=ql6bX^aF_4g$j`zOaS{$7sjpN2mbPQ&Cx=(}Kry#UtJeXEJmd
zQCX&~QNWFe7is0AV?e%5>R#0<dmTJimb<$UMpPl<v0wM+N)-i3A0W%62GLKw!EQ)z
z@YQco|4OCv6U5<coxfw`;CTlcwQ|t8X9tzUyL~77jG+uhnA)XsV4N>sp7Ub>sNv?&
zSnU<Do7%i!y;+l^-i6ThXSOFS0<ECK<ct2Etg0O``OLMF%Q3fCuv{2A@w@ydPtDPH
zWjDGg>Z7ra9^tS-2WWa!+4fY3%pQ&9&s>sO2~hXj7&)UmFgrdhGNk2jAu(i2@bUMI
zaUD`KKzI}(hq~7O(XQdQ42TGqtBCn&TQu{3X|_3E$<R~kL5>@d*_s>I&uR#6H23e(
zZxR0=dvQeFwVA&OGDPQ4-=E8Axtr?5N(lLDalaGEW=nxdUD>F4ky#|zFFPc0FdLWh
zg^=?O@k3Fs-~3^XD0AJ(u3o8!ryfUKMrio4FT+#)0_$9*j-L>uTEpH&LlLsKDi&un
z)UusNhkZvsqzS%Ji`yi#jUB*f%4<Wg^0+frr5tMih3xeV$o}Nhy89tH6?(GxHDkHw
zLlWkH*XT4g{b7$a#x{O{FYA$8b?ZM1$&s;67j|~=@DVIPB5|Sdw!M8fEJo)GPNcC<
z4wav^r_VKd`ZjxAr<5~n^{zFt3i74&=^^W>fWXGRGb<4*+bp-CYV&Zt3WC3`3NkNm
zKQXx=KMgaF6n`vfO}qkX$yz>D_F+O?-3gDR+<F9aG{y$U#Mz1jv95V($tT<lXAall
zzm#`vP9rYZ4~=V92PcLRBhu1e57Q*1;l26hKzefXN$h10Oel_Vy(cWK5ltWkL}<m%
z+leRe@chOg`o!&Rbg%?oD&1Gmv$KEFN`@3UKNXmy1A8r4)b?Up^C_5<Cg}DvEIQRX
z^_Ob>u*!e<c$h$de+<{ko2&7y2J6kpxQqu9&-xyMcq$Ftmw7nEk}Uyv9)oF05Kv^^
z_~FL_e}%zgIAA+wzT5T>JDY)=giF^*sLe2OppbN-+g&sVef3{mdJ!wWKW|`2fO{u9
zojNjKQ7W1_xz32|Kp^?3k{fwTO0Is~cL#_%lL3oe5OG{o6x*YnSpQVxn>$g=n<qRy
zLI5-yq`Z|mJ%<(B<M~(?4(Ol^;J{eEU!y!$E|FRE{4v<x9i&e<2Ib#N_FT!UIk^4B
zwE_7q8sSY}(AVderka$aBjqAazhG1-9lzEB|8NSt$Z5POzY~(+wSEZBcN@iX(aK6<
zN8=rA@7y&c@g#q@{3vslVd26#_olAB?BV|L%b|*EHzMI!s#I-6(Z`Z1_-9<<s(t$F
z9N@a3XPjlriC+%e%s|BC$<g?@lYff)%`kLw4W69~*qIjvGzP;{E?=Mz(0l5(XyZPj
zil@`4c*F5c3Pr(tj@m*6h<7^Bb2a8Kwn*Yj%nBxZWo77~GCUx8Ocx^A2LW$PR5Yj$
zA35k7@3)!?KnD%Ji?LDgZ{4?Q8AAYSpxVP7<6n|^y7<5MR5lc1oW`2+2g#nf`Kom5
z@i^=iW-*4*MR`uW)`Cj7c`iELk&D6e$JK*AO1#(ET53go=u<+KNi-spf)7GYziiE`
zT%s;o<*4dgqZe0igP=F$n{5tSYc|S9P4}cA=#UL94tg-g(Nq8oa3~{R1hj7}-Hsh0
ze#QLp7N3>p>ntYA0E+&@(~wx9K8U$3Z7O!l8`$a>Tw|zqOJh6~`=mB~c*OyA_v*Yj
zPwLac@1x5DG{v-~)5dMotKl+H(Tg0aeMt5n4Xs52>kx*MCDA=PpP*Zlmc7s<C3+gZ
z_b~!tY!tl{YM;nkd`r)%@gVk3R#6c^P5NJ~ogcLD89@9PA;GQ&UgXEt;;Z5NNWYW(
z(n;KIXss5}^`o`zjA7xuqP$H@?fc2x+-UX&^g-3|9<2t}sqG8<`qHm&6{F17c5Xfe
zy%gNqFI>AIpC$+W^sYGzlUtZ12(DNkL+qdy(Z4HyVNR-Ih>uc&3F;A6J#*Zl-~So;
z@{at1^|y6Y>J9SgWvn#k4>7#*P=XsMynJp$g)L<d(d`}xd8m~$D-bQ%@PMvY*`JPN
zd~xXX#WYTrp~>aCY=y=k@9mAx2zcTh*)D?ffsN&fq-<(^FfUa9j%v{EPPn(!-FWLb
zv>t1t5Q5_A-l)D~Yyd!6<oQ5|#<IOm0QWAp_C=(v9v=`TG|1Q@&zOVv;@^Nc=U&PF
zL&wG{*}c!9Y%RyBLjrO%`Kf9TPHg(L;aisFw;`fz2d)l=c-Y|Np(x2Yw-97YZ6|GI
zai$d0EJW^J(t@$lrQu0O>m)d1kW2ax*e(p5obLjvTKcxwn8SCz$>Wy#=hFM+VTSt$
zGBu-%Q(A~*gOKr`rO)BZEfhkho{@%EdBemmM!{CBvs0;1LIlK`ISFGlRQJHSL_bd$
z8T)b2I{r@V*V<zW$!ivwYZcjA|3CJglBR?;0XFUcj8E#grCwOkO+irnr`IO3i9TS5
zMHH7gwq7fxEuJJvIL0a&<a^seMIsWB)T2CC0i$r1<SdkiBYA6`h=bciwl>BVF{g^T
z>=Tu|YW|F9urgW&3oyfsh85nlwb3OrBSxx=L#UTrwt+7obz&C?){2`xYjMyLD=<_@
z+I0aUm&W{P+;KeI>mxFM$dGnGF&)VrGu=nD|Es0ZBgcEs)nab|OR{A`=lag%Uq7v|
zbQB`4*_CRHArw{&RS=A{<+Z7}#Ge}>rr0bGrhAl)!2*jqLX+E`NMlOYFnWze;dChk
z(urgGY$^p^J^sz<kKk1qLSJw@fH#|=#<&>$KGDD;CSVx;|HEFBSp45mE|NAM;fhWc
z@(!5sWzs*X94@9!<RItCJM$6ZxTJ2Ox=mZIO?vv98yZBUdK0b7Kp6(#nsVDU=bx3n
zM3O|IIG&U2-7$QQofI^Q6dFwuoU{IPp*W&0734g5RGQ?v(NGT`!9KPjKlCq>lm10=
zdDNOQ`uyW%9C1oFHoz;>xG2gwhnNenycIC0#eIiU31GjKOqW7vsP2Vi_Sp_PXHvs_
z2Z>u#a)!nViAC>q!X57krbSha8mX^teNi`B5V{_iksW=;<4d!@!gU(&J<HL5<$iyn
zn$Q8KEgE{>g-p5`_Q`Df`q7Et5xhU0V^<1Jbn}}Tihz7)c!=Es#OnE3=AD?>j1V7t
zQ?x~4|GMuX&hdJclMvNV^F5jl_NvEE*0lXTu=SoL(<KZ3VW`n2E{3>cXpqX`C%V&c
z$Crrg*(y3?z9)bRAs70X3z^7$MJp<iUy0jkT^?Zt=4ST_fVf`VPu<MwDZ=ct5<|H^
zGYx^$xcOZu1%rUcZ${ATg$!EeHw#E4!B7vufDeosi;gdjH$mUs^3JQAJVun54d{9_
zMhjbtEowIyVaQ&Z2<Am}Bi=I&g7SBHx6vw#>f{I-(PNe{GIGai5-7*gZt1Pt1T7md
zzyC1l*qR)^#r`-+qU#1~0x&L3Y3UK_(SV5=-GMS;-6Sz;7rS3ns}VrT+nR>9B~H#~
z5GtdkRI%uF=rKSD0j9yp?SGbM!}Qu-l~$+w@0Lc39sqyewKkvI1h0Us-ek#Bx;{cs
zK#oG^HN5gkpzg}bBFK6OlNW&W$YUchwnaLgh}K=pW?%$~4<nGaxZhYjE!yW)Dp-e=
zKU4CUf`P7~9p0sX2Om|ZNSy%@r=HypghK0o(zF0G#9hu)(x!a*s8`nm@ozzG4z{fw
zD<^*w=f}3G&K849oX2jJi&fRT$2iOCck%^ZV}@B8_SGTf3W<1WdcIvNp%lYy*yi$3
zfbLWz3iW|pyYn#aIeulTbbG?$To0=fTksf>*r?UhoS545EyZpV>kVFwC2@0D9ctnE
zd@&1h=Vbig-S@NKSFAlxCMWiD<=MJOg3qgVMm)D%mP)O(zQ%DR@>INkaY6o1bN7tW
zMw0na5PCyv0|nT!QQ-ufNKL*KOnIk+p}$(7PMe9?<^Flt^eJPo>V@G8Ig&f&17ClP
z?cS14f9=#DMShA|#MBXnieyT@NnT|H#>Ejp9DwJ=Lv&!Z3?Typ&e`Jb%*y?L<Ffo_
zHJj|}Jv=6Z5`H3HG9)sOwb{|#&>in`RP|e?c19xlJKa5~Lk*7`(fM=%@nj|?qQnz8
z&MOv(s@+^46Tu#_ftX~Ej=Epta9LHESk7b-t1it2BId(+8~xi#%!{M>(z>Hr(G^pw
zd+0>Ogy(QFSQiVOI~0`~P&qZE%C@sD(Q0bBpJQ~{mqX6r!RcY7zX+ZLKPaV*NK7o3
zEEsVK#m~ruhvrH1Y|Zkh?(eMT4XZmfpdD!U<-&j!`duH&2+__2Y{c)Z+OHdujaIZ6
z4&X!G>w1^*TQ_Eie&8+2v#O|^*$jj6K{SeOcOQ+ynn~|8w4<g!eEZsvXlFYeo21jP
zo$46ny1(k0&)*WgAcSbDCQJAH4;SRy5GH1ERY1W2%Q8tP^b=2@wlkoX5<z!66z6sK
z6Hkxd8XW%vC}(2WP^`|AG-SbW_eh3(EvbhLlLw)o>t-`j%>&cAoxM&;a8!@@ha*Q&
z2w3hVo62e<*IK6-T^2QKBh_{(ZL%XySPOj+fQTD1g!HsYl2sH@sWDxOYl}!oumrMe
z_?NFQAkGTV+PCnyy>uBTbrjYo6jqyP$)dm$jwK#PlC0FUMuCI{duP!m8DItgsPvX|
zJV=3Vf+e4%#Sh+tPA4=lp~{Ulu~aYFHgSBD+G6sqZ@{Sj%XDJ>Nw1vM%sA-mkxZ$$
z9+#i1ijliSIhM*PVr%)*u1sw&`C1Y^uFxL;r^`%>m~!P$n|OXG(%<nH5gSj*CmqT;
z=OQ3bu#Ps^+<+_^bdUQy-u7YZiR!>;)k6Cbuy*(fkfax_hEUDn837oPuSFVHj0$Im
zzBJ4*ReqB3wn5qhJuS-$p`86n-V%G#K6*guQf^|*H#u{;?L=fCP)~<em0j<Og9yx&
z;*|a0B6EBr*JcpRn9G5{l#JIhoD!D_1PRD*6$pAxXZ8hmU`$5Jyti{+#vlnp&R2%2
z+OkFZu+pvHWk+;`{{j0%FTZ-b$$;H$3r8{jP)uzjUtEB^$!HXO?!iXe4RzXWHQRj{
zB@Ujf^c-vBh9lj29*p|eK|`d1kfF}<kEshx->lm$Jgc`a?qfj)Zp0Tpk}ioe*~|W|
z7tEiaI-0W%)%vE0!ic>lAQYf7Dj|@zxxkCqYKc8?o`(j#cE6hoWZ{m0x<|jx?s=G^
zfg5+@QZPh>rMtmm;ro|juSIn3YEbA0%(yN;QCQh4$5*K1bV6mt6c!m%{nsiKz=Yi_
z6ZI&DLw5dNjV9?ceG_uoV;r0=z&_xAia(4}b*`ZxY=y=5Uey?AHZ|Ku|6aqP0nsfS
zK+4M>0zQTD_e%?dXGm?j4sr1*U#u=Ys0>gid<94B$rh$LXlB4h?>9p{ZD=j*<9;uR
zBq@$hzqsAv*`VtCX0qEx0lT)XM#=MqfhMr7qvV?x@=^Kh(k`QiVITnwC~Yp3Rhi%X
z>PbvG)}QIqsT9;+-?w;EAsKxD@Ph#eMTvnABbw`6Lv@TJl-!C+RWY)cD92OTC2Xa>
z9gNCe@!P>H$Bjf(usKpNUF<z+qTvKyj%*0>fPbg0v%e2O1yirP1Bb|47zPi))n%sQ
zAMy;(%@DSYP0l6kZ4%h*RWj+S{B8KCZG0gkvPX~3p?ArO9lLN?dvYi{bmpjQal5&Y
zQA%dZSy`StojGDJo1TCL1msGPqtX0xvjdT?F!)+jj`J7X_yCs(&M9;y_X8%jFdTb<
z)tHSDb^qz9p`^!{sUvI^8x3f{cDTW|a1vc=46d!5P8OQnF)te@G^tKwVx6!gnU2D7
zP;;A5e1h$A0?{wzHK@}4getfoG}6+)SQ~d7c&Qm>x2p%GyAC?b-8ajWSDSgwU(<m*
zV79rnjUq39Vu)d!x)~5#JEFq^?fuL&s196E)AOE!<1;^L7EahRcEC_mxG2)fHUsD7
zHL!h2vN1z8b$9>JPSOX@12#B;#C(L&L;pZpfP#g=|KKsg`Hf~mxI)kgim(9%_=(t!
zdT7z;NVTQ5>nIrDpSt%XrCCwu8%dQB^!K9nDL}SA4`p(N%2x^wav`r6(`4j#*gwLN
z5xmW=3qL{BAxxRmU!^n3;GNFsWJjHG%Zck)5_=Gd8@9*OwDuMMLOQ@<0XBOD$*d5R
z>{th{WoJpbWZ}m!y9!4<ri`BRj1S_1EjvqqX<_pk)St->_|dbX4^Pdn?&6^rNU{4h
z{nT6-B4P#3*tN&jwQlR*c$`gJ+k^r_6l-44awuJN_KGknG54qa^PI*n7Wpk8z1k-k
z>W}dFETUnM22J~*hCEWM+xTybRh@;HeVe5{{>dDk3mg3T?I0eUe?`2<b;VrB#UeNQ
zWezS8T<v&=TrPXt7oW9!g?X>*Gxx-Z>5x67F+_hP{1s6QZywJ$_zzbm(cWg)<WIQD
za%D$VlwgA_mBzoRdOUKi6*lZsk|zg@(vD8bFB{Uv3PWWt1cac%3Pu{FMr%K$!)LAz
z&%VXpg{^qB(}}tP*ZS+&3*Ml}f)bijq98~>74gNd@#;#Y$>FJvQ!{&ph;414UAx&E
zn+Uc$WDKjanEJvqQU0}EtHgb;lvo!+M`WnQ@=qMC)iN@A2mg7Oe2M2`wtZnTEwzMv
zAG6sVhxLd}G_up;Skg;nc^%ym4!r#my07+v1Q?cc?Zwv}VTJ<4b1*;ue4|LH9m;uA
zsjWm_(57#}by#8%G!__(A722dQmG;p@dBu)c7;7otF**-VZxxM-nJt9imgDQIChZf
zD8V&J?soJg^ntWJ2L2#+h>F9;=Uaz&dnB7rgt@BGQsHgc>k_jSAw5VT(zuN1$EyC5
z_Z@`4%NEIcw0i217*CB<=6@C^ONO1|)tvAuPevtrKUxg7$465adW>0>q{Lx^G0caG
zR0LtZDLWZb0D42RWWiLVg)h0be0+d3$Vu5!@nH0NC1OBsL7Ya!RLrfSa4d4Clhu*F
z4b;(Q3FOv~Y*)nrrPHL;<rFiVw;4nvWr&{yd2=lI@02#)azxa|Lui6t2nJvA${gw8
z9Qn&*cg#pjQsUxz=IZcTzXR=AykSPai9xCK@}<fbYLwK~sC!~ieU>;=VVrU`QkhD9
zk_t6bmR0j)kU}>3Ay)23C6yc}3Q6?yg0>KTZ{JE)y%r<T+9l8_qzmNZWK9?TDT8;*
zclclV-X#gNJ?t&i(INBl1Pkv(MVajh5^^Y4h`@<qHZZP7Y2e8nd>g$lKhIcST1QP)
zCgt9Vl2uQB=*krkD>x|OX#XRjTxwKUE?uPjuNS7=NK)sAC|or;L>uT_BS`fnOwVQo
zf#$szR{Y5aX2X3}GuGTmcR!%%x_pxma~b?TKfC#x_@>jA4CA9AhIFIqY%%(%+nVop
zzV)ROyk3zWCA_mD=?xpy=Y!SsZSmXhb^4SnZMl^nY#S{$7}ne39veiU%A=aw@n^3Q
zC^qQeaz>geTrFJ-d0u$NHs5P!Mj_t5M{e>(J_;9K{t=y8(?g5oT*K*HiGUb`mLE{<
zhQ=}f+|%X&C&q3G(N{Z04BmL5@81yEg~~<E=!x21BUp|GAO<&#3tP};0C`16%iQj9
zAR{#{21(7W;fpEfS;Uw_01+{|uyxjqE&|65y9JYN?sxYDJB%9kTa0dLX`I7o^0ae`
zcXQ&TO02tXnRiW9i`lEjNN=f@x8-)j=xp9ea~^F1!Nq~!8)N*9JNumeoC|dgv1HPC
zho3q1k=J0TTc-l`BXz$#yYvM=&H99taqsI=blYL$1zh%iB(-I~j8g5I%c^`^qwWXD
zfaiYtrP~NlH1TBWFPyP7*6ato$ZiqL7Y2^@#0I@NV_a(+Yo^0JD<>?{ACrkN(1hS9
z+U-dxz*BC@tmOM)jUwf>{9BXdrcj?u)bqEJF@tiK`<p+YglvRmp<9?SJ+pV0Wt?WT
z4ScX$-V&xTe&q!eS$5aUh84#HmA-#O1@gIMHwB1n5=D7O{Jq#&OePd{d%4LZP^&7G
zy$Y{6XdMZvMmPy{9T(xKbvzD$;vp?6VGY3z-M4r~_e=W6rO~0*_&Vf{gEXJp6|%s}
z$Rc<N8QKsPdsm%U?YBJJo$nC|*MjM)wpYYTdN}o3YWE8l6o*747XBDcClFRjsX_PP
zB9(8Y_Es5<F@gdahThr<{c>pE`kO3Xph=3@nT}y>mp0HTB8gLY=3QnZ2+ZXZwl4fk
zrkEpbepW*zQCJ4S;$L#5S5zVhqwn4(XoqoXs#m0vY@e)wcJ&F+8o{cn;<Cv$+Z;yX
zH`8dipuXm?i>cNHrI$8#W+Ch*bwKtX9OL?g(_XGx$IDV`mN(Wtios~Ao#1m{fZff1
z6My9W7Wf(*RpH5@rChKwbVdmp^c3C%*D(#929%`oCAaR5j!>-!VAo8==uoaJjO<pD
z6}KMcm@`CQ0Qr53l9f@eRiAQy=e_Ds#W>Bee~=FMHOD4i{%p7J4=op}Z0^Q0SXI9X
z8r!hjZr85!4%opmXo1YWiPACwav6t6INnh=cn5kzf(s^fe&M{O`i>G>A@JUcl{{6_
zT_naEo!R%OB;Ctw)0sm@+##D~veM$|OEKK#Te#&TY?~31P&Mb$3m8&203$TRFc3e#
zFSa&_B{+4(seF$=y^7u(aOVp}w`>S4XajwS8?KaVlbkZKD?|icUvk0q8@;u)665Y4
z&$=IIP2Im4v4$OJ)@Lo4!#EH)dK)w3>yaD?qsrXA2!F%r`UFe3?md)T518P#5Sz%u
zR48>ol$@~-g5caSn3>(tSH$Y85~<-S&S?sx`z`<%VnR4#$IE@7d5Z2d2SaMWIHFc#
zh2*2A`uYD~E`YO|=h!tEEM^cQ5K$I@(4O#zO2JROH)@u~>~v8#{YUu)0?`Qd3ecW+
zWR%NcvFZI-Biu4j7UD4k>K>75P{jKV;5(9=Srm3XAeX(OJhxNHiPg{p@`Y~Wm1{6M
zcW6g~KEJG$^k@zE9z96PXNDpLp22UCc^|6jcBwTQC~s5fO;eC>>{)s1Mf)uDo;{)`
zfeB9V-7F8GxBU4gQ?#RMe8&sdVc8yvAB!uU2=?}fMa6pDm`}2UG;c&aZyOPyr=pWO
zP@%c_*g7P<XQ~LjP&~?&I*#2^3381m8oiSix;FZL`Xq&;n;)JErSQuP7mReFc-&nW
zrK?hY>ytD#hi>oz!-Eva@BZsN%hd~21ZTvz;ox$P>*W4NR}j2nVT6+as0hvT+E7es
z7#bQHD4NJQG(|)NMMVDnmXH|{6cp46k8A42=4GcZsejPM#pNa$Y2S;_Erd}$^ECJL
z_lt{*D?@5N0kUkxwRoZWv<dK6`eX)s&JlRoh05&az$KZI$7sDd>WabNlGT47kTknD
z?~te9=&QY07@-v5v*^}UZI-Gv7d%fkn${+}qT1Et9GI~bDn0L;%*8!*Gg5?lgphuN
zLwjGzTDS74Av}p%I~QcEvTxRX!CyUz3ZRgQ|E26IjfgxGovSugR_-o&7pu@ntgk=H
zQL|JXq8NNXgqBv}IU4U=_{LtX{c_B!YwX0e)Q}`omDS2R&jIfTYnYGw)Rv^-_d0~<
ztMVvufK-lqwh^8$l3~?B*1Zo|y{XhI4Fe638+G8(6p)O6^op`!yQ?Y&0BD=$b<t{m
z&4lb@p2bw3j@KlOC~W?z)R(oV<{js7c(<wc^fj1tHbAeYFKdiK72`eGOxp)&yLO8`
zjo<KGy0?*5upZXGh6RnS+4(wkFg(7Pb+5w}KC4;|F$yttJ!e(9o92Bu(Oq;=xA3lp
zi<dt-<0>b4D@uiUnIn-udjGKn+WzqM>NAj-x9;2@%_TczPw&{Q%dO|@;M;Fav2As%
z*}e4ot5(j5`^GtU=__b=@Re_al<${`K+_SsXuUDI8tQ5Fn+vSL2B?nE1>&%3C{3fC
zq_%MHtijCzSM;J^)U(1zJ^ME+7;u~y>|J+%-zj>d$=-qO^`6m0HhdYRFR6-E#yF2(
z$JS6_B7+T+6M%N$<rjOw<f}|NaBrL@L*W?xbj`r|_QLc>-M4nK$Zt=sA96stAs;=4
zHy%k^(9oP4AB1$1m<1+!sCLIZ+#bS0=495QhCvuUD}KO}zpS?OCw$;s<pygRF~>nz
zNpl8maRHd=d#my6U(710IZHH#XBN0;5gn#`HLh`F)Y>q;>HZ~$hHIo73wW+i;DBFr
zpR%A3qh_Q*Jk>Z~*@%^{CkF9O9#U+d99xMU?Sjjy9hG8meP@`k!%c!SH1_Y%L>n3A
zdut2IBnfG538Pqht+9iwyV6wPfqi<Vxsm-xIfieMX11k|Z$NT}N6=1e3~<`RH7HBo
z{?SkUIX~h3gDuzby+AQ8WBX-Jr%|e-UDRVSm#20fDxb|1WWKeLapn;VWUsM)G+vhs
zdr=|n&1PE8rY2n^I7CS^E{9d48rh68hJxCGY@-5?ne{_!3VH}Bm<%LE^yx8R0%*#9
ze^IJz1|G!j<r%XZno!lr>0!{MMb5yuU0af~?kvzRKSRgJ5ln&HYta;a{kL&QV)Gt;
zD>Snnh9{Eo>H%r7sP<N}U^)O1$jhM)fbd{;BDy&-!-yKjYdPd!`zws0=wl<>^(kcY
zik2XXrvKCULE+V)H>j<gU{ZF~4!bmLdZQ>m@FAU0WgC*j<ag)b=$YJ`cRF!9hfLZC
zF;W=t7%^ed9Wi0QEhis<LAc(FFG5KQAofr0GVcGr{NMNg`=%ANEMVsLR(-F7SaY(e
zC+z3nW8ztICp6-6y}xp8@V{3_S;kB?)ZP7xy02Jv;i+{)bMaBQar9hSMDG9Nl9ilx
zH*jaWzs-iY?`*7415tMeQe_&e%YyUZj>^SnwLzXweOCU5@cj+!P}sa)!LU#v(_Gi`
zQ%l!Aa2C=ub2wliY_K!yzr8B(Ct7$Px(+`!9_+}FR}r&5Wh{pH>xN6!-tOI%uMN|!
z;m;=m>eN^8QIn4;+jQ1BVSs25Km?riVORUgCg7w4P?ckKI9Cnmu8uK8erGgC{_!N-
z$Yw+Wf7PEr5U*7%vBsq{l!@I!-Mo+aMi(V}8nG<2U`68k^G_@Gf4g*Sk_pbbNIeJ_
zid1Ir(IMwJfgOvKg+wDr*SBS@c8fA+=_3)5yUFgwgk^rlXbDm&o6PiIvo2_AsP1C~
zh8Ao?b*h@mVCOT=V2msif1To&IT?2#8z2y&Lq2u4x0Nwpv=ch6y3;%ZZ(6J6Y{gkA
zJ^473;fnJ4iD~K|p;u0e%+vk;i9GJ~`-Ut^X;YMIiFoAbmcCPSf45JZ7eeY=l%5tx
z+gpa!$6`L`jM|0)dp&A?rr0C6b(evdMb>sX)KHwl<vqlRS>v(yxz22OH|9!S<6}C&
z@OsK96oDm43hTdqa7tg*aoULQ#~*=4PV~jL*0sho&fbkS^5xlHUKZM;LNptY2nO(@
z9d*Nc8p(aY#{IR~AsFw58lL<`g74<V6c>@ow(5?osmp5c-twN-SE-vid#e#4&f&@6
zEO+4hDKJaCu>>=FhNMg86`7~zMn3@|KQ}H5H&*mNe)tepdk5q7!p$pD^?4``%j&Ce
zgCVv(A_PJGd9jU-AUyzAl~*DjGbE;~FBX#scgj%y&l_4B^Ro2*I;tW1bsX+iq5=9t
z4L7Zm6~AjYu;U^`3zq01_8JVfeYm|+qbBjmAI$oq4m*jAP=I>+gBYQ7d&3aqs9LIm
z>~7wSqQZs&oA%9aKJR#DGAYky(GSb@24$NaAOM2XR%)TC_XU8$et&@4Si{i6$Hk#W
zCT}l<R43i^?j0PfwoyFYaC>FxAK6}dLtAU~@yEM?Qg`=dbIV*bcO%Imh>pu+0#?I>
zI&S(rGMQBuUdE7NCx;t@TPc75H+>03$4<B?+d|>sJpm9pYC%7M{NPFu_PT12EEkM|
zRSd7yd>do@*br9iP5~*tk^9NpUbN%=f25jL;*vl>g|6OlG$%t06#+}WVW1VPI7p4y
zVIx2CH4#gZ$nP@i;saVNXAAqiD+9n-+$s}VRD*?b(%g=~t<?Qfp9JRQ9TVx?+@Qf(
z0s-PbNHYgabM#I9Lw*<FVl52E&mAwRHAvYDkr7j$t{&9oDm7Sus>IY;AgT2QRF7BU
zI&OrUV0-+1?c9msqfVmIl;^N9OJhN`Gc0W7Em2xRoI$(dgZ*;jt_Oue4~_gqhRz?P
zrA!Kha+Ldv>hcqR`aWPfIZ(bX>3<^LN7at*>sNmYecW;E`cbYolg_GI-2ppaUj9Z6
zGp{!=5!Uk|j**+*94JkCY-sj?LIcVLRzBkjf;}Ih+}+(wF0UFZihF3S6-Wd{fDn>-
zP@0bH47rRbABxX<$e`A5<L4I=x)$^`xXVDftI!cJuQwhVqTk%8)SA25s`kaOfFQ)q
zdc?p^I|qVpX@R_`9Yj(Lm93dEc4x?(OOZUVY$8lo6m*{ORr;OGCOT*1KGX490e(GK
zZkEwqU6HY8cb*7u1{+Xxwt)f|yV24u8#8hz$e|p*ePPA`O@mWNuO)0(I>7)iilIYh
z%r&qqZ@W4G05;xiWPbwa_s?f#jwATJH)+g#`!hY7oBn&U(fGwG#3iiF{F^86Oo{+s
zW@((Dr+2$?uF-_*bC#n(Mr%DO{`{dfB*9Mmr|8<Oel{o#Yg9(ioDCpKC|w&MK?b)t
z6jsGs7wdGVpaif*Zk3_+3c79Skv*K+eaB9fZm$9rM?JYp56o_iIvc!t(w|r1P}+7`
zu0zl<4igIDuo0|^kJQmD9f)j7{dM`-n^-U!w8wgs>XgG&DO8#>&S}YpF<i6KRbrPD
zFqh8_XS`*&Y>kuHbW>AwVx-oO)+~^dpgWxR2*QHV!Q`@jE%faOeRxRh*JKG5nSm(0
zkWXwQ5l8Vxww&^G#{ZpS%owQIQOio=EqcYNH4gQccTdY|!?0Wl8xdo>0zgCoD=7g@
zvHC6;+}+dRn<rJTByoHD?BsOeW(YjBr_}H2$Je$|CAIgSzb)&u@l0exZRsw3;p&P2
z*J4a6)5AiHZcZ3R0Rqg7qcCS%gSWpPPm^k|=+8m;`6*n`cS^Vz2{Df{Ii3d1)5tP8
z;Q_n;eg#?^QNdR`c9Z}s>0Z~TU0-jzFTS|OM$6%0KD$EHl>ok}{fsoXRtWrUm^5M+
z@=9&SV%pC&1gx-2U;;f$ZX@NM@=Eu~SawBd#LUOu^{$zD2w(Ja^}O3PU7wm(R+T|6
z@7ZMpoZD)ryIEI*QV3qnUv&(HSu;AAd;Z(L0x6Y~q8=0Ju-ZQ^HG&$@0V}^loLkJB
z;uHQwHB$^t>3LoGmQMEqnZdmk_cjI&UoRI#d8bXWd_x!(Gt%$aP@S^YaJUwIL7XZ^
zF)5>3TN0L@Ikkp)dm-aGd4=iAC@^buB~gyyHTp#+%hn$a4iom|>6A~SS?+y2zAl^O
z$@?KG>H}S?tI1)7liej>z5Zs;<a$z*A648oI$>h@076@Wtu=os81_th{Ivf=*IP!l
z-925yfg%NpySrP9ySuwfp}4!dyA&(#?(SBgxE6N{4#A!9a{cAG@7LDKTKSZmUovOr
z%*@%dcUUz3l`4$V-i^us#PzsE=jTC`FGv#43Rx-JADB;wMFgoliv<WCb31#9J1F_S
zKuBsaK7W9A-_7)1etyKgLwVX%D?Lo1JwU~M*9Eu}ehlld9H!8{4c8YiOGujAzf?-N
zj&yazkCe+eG&Nnnhv37D4uIr8(J-5Q@_}w2b{q`j*x26j=`8PbloCnn!Cb=18Qf%X
zA%rr7ygXXOl^O>7Xoko}eEO{OY+WZ3YdxI}2q+QIWZH_!3V!0RJ5}|`-Yw$ev%^99
z8BL7dv?}#Qf|I!D!tLs*I&*XC7!@<@=&M*bDcxtXSu0`6c=bCs0MGg}R}Ls}+F)20
zwjvj6zs>9$&KqQ655A+Brg0pVK6hPWgJHW3^da9pJjUJGqSlOYKTlt~_JDLc`w&4|
zfi~eJg59$-<3zBl5Tgw6cb1A1Qapb!uja1tBuH-b(VH>{jFNj6l8^i$Q5G>atbT6)
zn}mMz4c(2r$%*#gshmW2;T^?~O>_gHKCM@dmQ@g=-!?mEN&KJh{#mc1?Y<~Oj%_dO
z6YaQvFZynI9lSUNw4%wU2+a3HI)QJKBjpX;Ls4?9V#G&qa$ZmoG*dyN{ccw+NtYM$
zT)p_UXOeLtWkeoUWzJ!a@|sgdqAj=u*tbxW^X+csn7C9&KHo{cswk2BafJx`&MYBk
z2Iecbwapr6R0pz<18_WC>67P`dWtasVm+(ZA4GHYdB{jLf1-J_!DLl9LEjSF+90Gg
zsyTM~x8Y3og`GyJ?7TWP&8vKm=Fm2P&fnA+%eL#YGFsD4+cgpTJ|_Xku$?ii4!XBL
znV2mvrC3eO7SO+NsNB$}Rc}`f8`M9S<e9tw38F$+gqWJbQy8tHJZQt3Jh3ov_?x?t
z3ws)*lU$K{h!NF=ai-9J@wS{3SzEdtm#XE0l_hvV80IWUn)7=AFa<y&A>(sNU<fd#
z<%P@q*Fh!mNxwglR%vgx+e8HJI~c*9sKTw25>xo)8&~x+>E}nb7B4C>WwTE%U%57s
zlZoS7v5X>_VUYf8px3|h@ZI|iNw_Snb<Ybx1LE{n49U0gzYwKpMt;5vXofPyXn+>y
zXhII87Pg!;(H}&73yAi(SJg`ZY{vvphg(@K5vH@JYNW8ve_Aw7R<1tRaLqzN){0H5
zjeSEue*4A_0~<Y)^Zl-eK27%QIi-70w-R%n)It!V_DkRB-LLmFe%W%=dDO{35Yn3A
zbA4r{Q~Fz`TH=Z{ez{j?5Y;4{$4+4szQ{_E$AIcWP!v(+?l~sn5AYh!%~v8Xh)w(L
z#>eq{l`?HQQQYlgdqYhf<G6|%44a}e&5D0ciDczP=Z%FbO32PI-o`MjTGd!?CP~&%
zqIN#!HqbPZY_ql!H)JPYX&X0hCu^w%#Ty%ZpqVg9fTXGmI*Hs+Nx3@Mn81%X!aJuQ
zdT8#ijV{u^_H_)5P;88%gfQ-xz{?r~<H?W2N=z?&mx6%b_lf$x0G)a~CI$knzV=Vp
zeU(}t>_)H}T^-iWmf^Pt1QLMg0K5CFV<#{<6(IEMA?0nuFrW;=!n*8HUQ6*71x3^E
zr!g%@F2oWM>*}iaN6MHAp<s$QWY>8y;`3zJfrAmD^b#VWW_XK%qI+i})$GQMx(>Yo
zJxJW`12U2xIuUE?L{$wJofzE0&3Kg=+8xtS($9w<e!Zeu4)(++6c~N53pS0uTJVj)
zIAZ`bpCct38<wDRG#q@l7a)Vl&rJJiQ^DbMbRLz_1l-%|e)MJrZ$|sa(c3<knF*W5
ztKZ+t^2-eT4%NzyUAb}az8TXMAIhla<}#IN^ozhcPqT{QMsfu%OW?i9kRG(5eVAbW
z9~1CH@<!`6hQZXTMsnMUv0{_|%z)mwGaoKK!BUIv8$*@${G*)uagKL<n4yNd;nQot
zJfBiuRzUbxpJ<9;JcA^BLL+)SlW2o_@qe>3QYG@MdSei`Tx37J`}c8Z52%4d3IRT(
zl_2|`{yNFa<I_i9<SEPmR+8V?r@giJk+9IWi8yERs=Xwg64yCxpUMZm9l|}n#<I~D
zcx%v~e<f55`(e(&gduv{pEnzTSl_PWT{dIK{Re>yIi~xQHZO$#(Ow-3Rs*zQZGXf|
zy^X-)MIa@Ps$GBs#5l4L49VVBt>d2TFEB&L`EZR`veF|=VEj;p)(D3UZ^)YDUNiUO
z6;6~%h)dJW*<Zg8d+KRh$q1u;Jzz4i55)k85(o$wXrBaL{g^4hA+7#eOx$MD<-dI$
zN_XzHJ=DHT5ROJHhXW@{q;XMs{Z;$7;i=<v(l6WyXKTm)lF8cS*isv4b{#}v+3(iy
zUbj83;{`Wd367qniZ9AXsE{Gwm#5hU3O{}+MM7jUi}~wVkiEu_!C<XxG{5yYgyM)3
zqeCZ24wVPDCAM;#e;b-^K^EErgm{GgeM)siD?reB!HQ#VTpou5mzXcqHJlXo`}aGL
z8|^TGx<2i))JkpBAc5v?7|WPfO=rdeS>0(HtF^@y&(N<u4K`;+vU2U2k9Hc9dTXA}
zx>5!^!8DhSM3hR5tGR-s8f$+a_b(b!4nzr(DoU!`u&fY!bO<31vin;g9+zM;fC6DS
z={t0u-q^qU1G6X^4nGxkY!(owF<yHAq<P8V$HWCR13tP>>yALeKW9r04`N^NgX{Ue
zi(X5=mUzmFkNbUw=xK1T)J}~V7U=8J{rZLlNRU-luV}EraP2>D6^0@qWrP6L{yuos
zv1lc0lpnUXzFLP`=O<J_1xr;N*-r_q{}@=O{pE@f0bS4g)&3l)2&v0@IqxHv8Iswt
zcd-fhJ~p%!xedVOdi!*+=I}tmw+RbXmywte0aaMywvpIgz=qE3AB;`?!_CvO7@Bp@
zfeK2L>N}K>Jl8F!z-#@kw=~|`<n>?^ElR-tk6#a%NE#sJQCgqunDBx+H|83-7Q&Yl
zmJfF>kyZuZI3a|oJprFwf4!}lUZJ^>wBtkW*7Mf>xg*ngE@XfcZ*cZY@dmheN5fJZ
zt(zPHbi!^*9S-16dFv88KEzt3O%dq4s~TDhpUI{=WoPa&`5piYj3QC;#Rnm=9$LT2
z3munS`eIn00;m~MQt1A-iI@Is;uP{a-hZ1o^w*x*KPILfKZ_HrOs>#TVzlFmk{a8r
zF)gAQ(sDn*kYq<sHtnw@zQBVbqM`2#6s$YJelbt~XbAnQ=|hk=P$*mHO#1ujU7~X-
zs|JQIHk*ECBTo(DY7kxa@>KtlY9be(K!-sK<kE@GD>#Ib`+l-)&J{WEYtN1C2U|$Q
zEpdkGf4;1VR4?1?!_x@@8hc4)J1RCRYu!G`XLq~47I1Rqt)av$80{$1ZLPP%Sj6}(
ze6{2zNP<kr2xkeZOZ~M@?8)m;w!hkx*gw9b-N?ZzV>3Z$#duJM>Seo@_V2QAPjFma
zr{8iDTRvc6*dgWb@w3%~U@<)@4y#!~O2C=3)-6xVzTwM2$+u^9(U3k)l<t~g3VQ&}
z<Uo#L-7Y7_U+Y;3vI{@lRvs?v`=b|+BNFEbooH^G5QDY*|5P21$Xg=+{5ORcKWxQh
z#kf4oi@ri%4arIV-+E;K`Mv+^?aEN{b|0z)8YVcFMdF7jVES7+Zp@z@*E2>sn8L*G
z+s|F}AsYL(xATzJJ}|2Ag^r>=?RL}fi5i|;nJqSZ3pZ~0!C$SI+>b@oEkQa+*>*U1
zvz*9Ttu)3m_QAbU2!AJD{M#<~fA0FUf5S;y+Gr@b*}aTO<Sfc=`MTBPR>quL)#<iE
z^J4!yF_k$Yn~eTFlgZXon}y?XU=GqOD%kj_#*;&p*m2O7>$>PpMESgR_nT1H4pNr)
zs29&io8=9Lfpq{iur=}%?A(Cjno2aDODE#iY1TRF(q`oe8Peg_X+QIQsV+^i_?3Ux
zxBB#+1I)msUcY6Dc>dMjo8*Aa-qWT-!Kb&8P?6~4K61up0ZJvir5UF=YkY-$nPe5&
zgG5*6m^h5=nAIp2`n1L13A`#mfX9Q+PG0OBE3;ndU!BJ3kvj>U*ntO5ptUIe>a(?>
zneAJ3WSonS2Ej|c-K)&TBXIW)`BFYpQ}-vvDgtNCd~7ZFZ?Cl{q$E#w8NTMzI6ih{
zH<gn?3R%*3zY&>@y84hxFTtn$i$C1zIo^(+3FvP9n+w8r6cMUd=dXgwLjTk@5bBun
z)~ETVh0c1QNbOVPuhAGkR9@(zz`;RcOF;Ub_OG$_G@pB|by(Nm$vJ&ePAy$xwbt3(
z2nW9ik99qj({uicGHsWu!DH~vS(#@APR|_C?>4rA##q16(yIG$go<fsa)VAi|B_Gk
zuFnHajN@b7Pw45kAE#6c1)jRCePrZhWTt=kx2ALI)H=(1i17JJPtsWQ>Z`Nej^uN2
z^_&ti`ti@RQc@o5-?vQ1&8eRz8VEigFZvV5OG`&e^R4d`O1}Nh+L{*X;v;^mHkXkp
zmDEMAep9#8)HZ9i(@n9WG9XeluxmY)`&elr(tmBDSGm@Gj(TG@MHGRqSvKPq!PnWg
z^he~!1AnX6U1Q2Jxulp{UIJ#Mco&`3GsP>}7EbsXEDCG&sI+=u9V$OPgem-fp&wGt
zzr)=>QKpk&_Osi#YjIuT<<KO8bNGzIaO<tjX;*Cb`m#GS9GaS<Z8&4I@t9&9J;sa)
zH8mG&NZW$6kX&9NYx~JW37!rjK#x<EY<92WoX&v@#Q8n_lwQ*6=t$ayQ)GISd+0+e
zYN~Z@rhDp%2=2Yh+xO+A1ydP-qPu=G(DGnUv)bjdxh9@%HtBs(YHJYODbUbeM`nN$
zZ$?g}fB#f)h1%!Hy9$SMxvtpT%eTx4x>T&(db>WFt!`g6^Bi((&%+noZ1lr=yE$*S
zC#1I)FuMp!<8-|`TJZ%NB~hu<k5$bTdL?R4!efR-w>>4vGe5XE0WOJpVDw(iE?9dt
zeN2{8o0%oubn)?C{<USB*BGwis3^pvHWb=Pm}~%BwgT9%iRU9mI(Kuw1#J#hnBQA(
zeZ;Z$G2t_42w%c~M?bnA=&aK~g)W1&DRrAB;s_#tF%I5RnwA3p>Y9vZLb>e(`ACzU
zIN6Gqc!tvg6zzLd4O_nUS+K20KYnFmQxGt+caa*M>$gX-NlId=>1kDUj>^iMPjE4{
zAoNhB*u~27-i>ac?`2YK8xfW_@T0a8qj9J(liKyU9nteQn(bYTTF&_~QON@FG8E!}
zt!`pyzZNNYE%4Nj(Yi#Xsj=oIClo#LitJCvcz=)M>OJy_e$9z<sN1j0?L$+-Mw5Sp
z?p{h7pTf(l(zW(6)n;1nwtn7D=J74J>ERdN!>&Li<aUUWy<V#m{KmcGSd=Q8m()?A
zVw0sk7x#gD(h6KImc38oIeK;^`kT6?rn1??oP6;|np%Whqst<<`7{~|ge%(HzkCs}
zB4(q%D6dYNEZR@HIFeb(C2Sp+gsRpe+<5cp*94iBUO(rza<-p#yM^7NPhTup8Dd*&
zoF_I6ckqd9{4po-e=~cUhG{WvH7F{ek<Tv%eCCr22v_xFg3F}5y-<{y9x-=U8cl+7
zBi}Kipv{4tf&E0HOgQ><o_r#uW)2u!gB_XAD5oPy2}o7W{4y$4j;LW>s0dFm^}--&
zWpkP6^Nab~FVFP0;(jUA4Zm%vy+AtSW`(5o+TROVCq?}D%AEHIA^?G?l_Ph~_koky
zAB9A0qk}11MaSvrka4ByfC#aEsM|lCM*huBgIDpeg^Z>}He<a*y}%OmP>J$0KBrN#
z#B$u*8m@bcrSh)K&qSj|1iE7p*^c#Z5vZ5%be@QS$>-ic#(e`%Bx@nXDXgr#7s+IC
z-VoNES1%XY^~Xh(-Y|Q@J@d&QX6)a-be;1CZH~n?ny`pVPDRJ69aqGk<-Y`k@pC;B
z{f?z~9kAbVQD>8`S)`B585q2xAL1~w+5Eu<^F?pMX=C|CkFPa9u1o)jBu1as&2F~O
z1<0NU98D%7My{x5V?LttnP>lqTenXKgERld0)VQQ2x80I%>%8`US(w_6w#qNm8Bw(
zw0$|KO#R1ctGRgnm4KShamt;l#%_YA<?iC;&%Eyu(kr+t2Bp>dz!jN%$+6YTYrj(|
zxv_&w4j#ZZ<eMNDYElC!MTL(W68tOJXChFui=W<%ej_ILhYAwgxtW8pe9;r(`K~HY
zt=8Oels*ppfA*Q4Ou5;HYa;K*TKuP$Wv_c__d`XmxH_(2*Q0+n*kmr|8ZhJT2EKaz
z8+{A>+D|m+vvc?%tNL1N_DUT?&o3S9BAAltDre^;42I?2pdTA^FWkhCY(@NBcl4N~
z$~P{1hP&Ntoy|3!4tpO5Qn^@F`rTF0oovVKhXn*Cak(xhA5n>;22zioALc(oVgZPJ
zlPi}M<+3_7G1|kwUO`PoV4)@6Ms8I6M{@h3bI~*9_YyAfk8i8*Ru4-lZul)r?K9*M
zL=Z&4hjJpql32L@eCVwl+D`!P!!2b0scv8#Zg7yGKrZP(s;|W!^|W8B-H^n%Z#ear
zP8I@~FNU`V4)Kpm!_!YEF{8BQDQiG}$Tu#nD0$4<3Yj5XPb{{jR3y6bDm|SgmK*s$
zes$-=@1bXYUPsGA^=7v0niCYZ7w;z<e)ZG0K2)bk<&BV54Erm!xBw9P3Bupwb(NE<
znq*BR_S>bz37zN4L=`W)>h)K+8hPZO^|3syP4ueHs3g|9C<ju5I0|3K!~LpTj3m92
za`c}R(4S_cP!J|J=!dG)5aiPAOCZDG2_+o@g#je^mOH|hTUNHb!O0))oyu&<k!rsf
zd~^2+Ae)-?8hSp@eV5@Y37`Ffw&g%}9T1B}@KdoW<vIq>ii+X{w?4eL=^VOzMh6u)
zTyc0s7L<1VF>{5z5sDB&0>g|Fka5&bxu`mdCj+66-?L}JRDiidE2AJqttpG!Za03`
zKh#AlwlC%1OP4-IIG=gis`Z)AXzewy>e*((J$c3z<;qsXBOt?K%7FI5yuIvpPD$lB
zvB5Wmu`Cbq1EfHs-jXM@%7n6(#@us@VyCA)t8*clsvo`~aQvq`v4D$S;&HN_*<%?{
z>!w`L3k#v-LiV;eYFQ6-Lkrn-7vuL<{5~xehm`_;kw3WsVHFwhB#6u-_Hdp=YJ)d^
za|d7*rz5}lT^)-<r(1Pm4{GdWzQ@`?18{C^ACj-PN=##Lf8uGvELYY0A9mG~f=(H4
zTjar?tl|vp`(dx!eY}+;E`txm5!sS^{Fk1H(a)e4=$534TU3P1D^=o+{Uck4o6Iw(
zvQN-0g^Yr(jJXmD+x3ASMKk2$wm7R$NQfe5yzP-6HQr5B&+}i7i-WvPh?Vk{ZNwmC
z*h=M^tm>jF$S4cyO)C^#HtmMKm)nA*+Cw&C-q58o^AC`UsYdU>DGqp{qHZ&h4|(}|
zVr{XgyRPWB#2C9b$3tA$?fBwc6p9I(?c<W$VNAdUIQ`Ih-e-<bpH@eyTA$l<8mMGD
z$x^C=3LJLCyFF8wq~lk)*LsjBo1;+;zj#Wy$Dc-y{^{SY#JZfw^y3Lmv`vax%jvjB
zz9rX9NwqzK4ELMv(OOgpbP%i!^zEf#3#dhD52!D0!7ulVEz277vsHoPS}{BRzMgJj
zstoCAbXOvJjMJHfRrQBoU*3w%_BI^i2rTO|#qA8<IE672V+cu24$eHuEu>Nz@<~)<
zIMrnNL77Rf@s(v5qCVbZ^K1=5Lqkwy<Vq^>L)RqvsMv05j!w>-XpA|}U(*k*5wtq7
zh8IV1t6cJTfR{#jbDDvg+?O(ER55-5SssfS$(2+oQmX=FO?IMCND0b5B0S9{GDuZf
z(N_9P6tf$j<?Bo}1zU&mF_WD|5Iw7$I%Ahl&+etpb^1F%rRY=uk{(+xF_M?oJ?_uP
z{x8W9<XhmZI(oQ9-FvHwcb<VS$=PpC{rDeB0&Y||?}5lM55qasf_!GXVyGIG2R`z}
z`nrFnwx*511EBSXjiQIRR1cSQR{u8ey0_t=)#_ChMWc=-;rQ7KaB6M!G%(+NW8TH`
z47ai*1478c?~vO5mhV+At=REE_k43`tr{0F7*GPSJs`Q^7!FEDe{myj|DJ3ujIRW$
z6;1yLBDlg#BcW*6%ZZn3N5#0AtSGaMPIc0Csp{kCP@gcnA`CTqWEC;qnShp&hC~#6
zcurMW=1!F8UvJTBatGkbuiJ^s3FI=6v1;sTZT(g0Xew#W1+(dS$+90~b!fh^ks44{
zIFffeP160f{fd2)g>n%3`e|+jp-u@WNLi(<+-zDwPYFZ*MShGvOd!LWI{*ZdY-LE9
zZ19@2;sg{uK?!`YNt`7|-;~Ld@%Zl_TGB1JV!#NF;j#dottpaVmtLuQ9#l=1WLxwa
zy;;)6%C91h2BDv&N<;uCWZeEl(BWmN6tj)w*fSv|U^-w*-%OS@w;ay8%IbZKnu#(f
zu>mvruBr;rwAOipnlj_Qx_TtOsXh8ZF*VMnLP=Sh4A4iGt8FBEV01L*j=Md^<>XmZ
zroK@#n$-9P|FB>6wBqwkv*kEcsea$MJ(SC6q>`{FBVYEF-?v{S+PyZR9k~hI|1uGQ
z9TiR67hSm7bCD!%yt-J`D!`I<gh)>Gg^*{AetR-V?v5sd^PR~#X=+E7=!UPJ?KqeV
zH$YD>Ll3pjau?Z>7!u_Sgo*m*;zuG61G{mi?{#1yy)OQA{UXsL&?s@q<+4+$%0i8@
zT-NO^R&cW&tou0O@vWe_+yeYij7eMQ<PZHep;+VX3y6FF1zyl*J16|wtiG^aldm6I
z4{G}-0kGS_g<nfm<$&^3BqIOwrkCJT_eJ$ipS=BUrGc??f9uA>!foERm&yl=8n*_)
z(*lM2-SWaRw!AVg_ukATZFxSia-tZ$MhYSMxpKXxVdCTy<M89KCbs`*eM*r1D)VDM
ztgb(KE<y9MT1f?BVKs)H6p17q(o!BYEr*Z=mQaG|g3p|*KCSLdxm)lv^l-%O2(eis
z41cF;qfUG>|6(j^1=m=Ul8@eVXFQh=-@|nH0x^pN#ev;bPL9+XbG4#`1NO!9+8`Eq
zaj18W1^#o<k1vrEss8VQSgK+V`!9-^zVeHvon>DF^7g)5?VL&<kXoMC&KI%^x;0%E
z^*>+ZS(U_U(G6=GYOxjVIR&nOpX0(|ZLonZg)>d$X-nA{VA4#xZBbuGV0F%(oVuk?
zsf^@!Jmg5)kKWp5&zT#qo#*tdEQZ_-8B~$qFG-b&iWQSDW9{h;6JwrnG6KgEOcfam
zybS6SiDL~kUP7906PVuuQ1IE)*>0so`ca>5A*||!J|ASn?s!iREv6NdRfg%Q?d`qL
z2&^MN3I45sEu_^J=BA$a>HXfiA#v{N=3V4fefhk1$|M8m^X9yQh+>KQ^0u{lxp0=3
z<aZuE2$Z$JJ}K;(RN8Wq(nQW%=;{`)EZ~FKCpLWeAiU}7W|X{3c5ikYk7Mrev}<LQ
zO(Pg>^FK7o-x7K^1RZy72f*D)*^cNrZEv)KPrMXIayWZr8?0(@^^OK9?e%jXy_PV|
z8S3860^c&mv02+<5JCxww82Ar0E@Z!c)5(X{(7|5kD2-BN|Huh19R$|LMn8TR}z$E
zI&Vy`T&{yT;;hEE`p0WkullsF6`DY%ted%uNwslFI4;G4L!}G_{imQnDIG<iOZ(hZ
zE1gC(lO9U=#vk`1QqYPh?e<FQWnO7-N|wO9ezn;Ur8F9c{^y&5NRZB+!jcqM)4WZ|
zsJ|4qDIoD$On+<B2VIbx+pyX!R)e20_fffpTb=IbVyh!j=yeX~*mPFfU*^x8d=t&*
zV)sN2ie^z=8x8B}(RQM9NGk9it{-E^UO@-^T4osy+GDhzNQ$YVMN4l8J4d}A413m%
z;xVf7tc1mFX}q&f1*DDm$ng>Nk}-Rp*!C>$6h>(xQXo8FI#?F<(`4}HE*?~{&U>y8
zwEgv$Pgz}7K9p#ETFQiA7J<2JE?{Gc#{|lu-UE>>(z9Y|<0<zmP65?l%%8fZI0Rf0
zT10Qk>TRaCOg9hmSUmLB4Id8`4u2z*Qfp%ux43iox+4Mf9{EkD(6y;!0eRLZ&e;$a
zSm5!|gB>D3k!o*o@1x$qW*6OyO+lv3I_?G$pbDQz8qAb#bzE!ya7hj0AU&?Apl`$S
z>5<~_?9UXlr{)1W-l}W0<XHa%eFSXL8CuQZ>!NHa{FMN8Np=c_11Zq{Nk@)&-93LG
z;|QD6wfikV`e^6;<>3hqgu^bt^qC0vO)t0MLDH033)N|el?@1{Yp$efw2GKuc=i!T
z1^f;KYbC6Fj0AB$i!-uQYN=as3<2$!;c)JJZkwVlGto`rKTqfLLkZDsx$TxH(j8T_
z{0UlSdz^HK^ieSM0k%dBm?oc}YD`-Fla!=MmR-~Q4N0+EBZ>bt@L)}5U%M!Iaga0e
zvew~2$XMJbcpW-CnEvDOV$IeYfzG`0<~lbM$P#c?uzM;}+dpWJJefu+al=|eEzWCe
z@5_i!Tc@kAa7;un=>EFkR@e4T7Wnm))q%!2;SQD1g>0hucK6$=F(2quRxukA7qWl4
ze^bCay~4Up0Qp3E?TR3c@?47nQ|AMQSit4uwQ-oFbKoo4o?bCgp`EKEa4f@AQAH0_
z86p_{3GsPw06nj0O}5~j>Ga;PyarB5Ox6~U#U$PAjocK11dzfCKbY9qR!34!BWlf5
z5oK>!P<lH*N|#2X`=5|dx*>7l>gH9nqjParsA<NOI?oS#V>9X<4_s!mXTbWD2@9be
z?&o)!<47(UmwESF5UjfOcslG|(Ir3WDc)kIE1YR2{EX+yYnAq3xtZUb`?S0?&PgRY
zP42M1E@}6<(inOn;}j{)6vkrbB2BWza@BV+EfVXT-TTh#ej~Ctm%r&YWRE&5&YEe(
z&Hte!->=|k$?CG3cvwPF8+_<J@M<k=81=S5)+lRG8vA<J!Y@nb=T@6iIh8g?YYAFw
z*%-HxTpSNIdhL4(DhWwfThG=Q-H<-ibS*q6>s=Uyc9wrNS|`U=JNfM*HC9hrM@`$?
z@`%D7eEW;qr7P#g?cf*xLIx%$VM5ud&|dK)t6NZsGrKCrkTPIX;DmjNQ12@?5!7Fz
z@);OmWMO1(d8UF(TYJzKPioVatklLa6t;i}sBI}F$)GRX^jnzRviH*5XhB}(xudnl
z(Ci3w)}kw?diSF|#Rf%W@{*5|`DfwHRF$xYz#&i1nZN$&CjHJr&PXJ)qHknME%%LN
zq0?yIVaK{HY{~CpF!QTB+JCx7e>@YN&s-~o2bv%FS|jz=A9Eu3`oaMsz#RY*YL559
z(mnI3nA{h)M9^~C0x_&6{}1u85%06qN7#enYTiGwhHe{@tw-XBZ?Sks=pl2tejIE1
z;F-CaAPx+#B1G=Dgz`Q!Zl5s?Uj<SF<*);R>(M)HU6uU39YMa^DG0LKA&DFVWX4P8
zHzv~s+?6MAMeC`S8Kyp5eh+f(k;A2p-1XD1<i|LKPQa$|T{y|Tb*eMM;YOO{47J4-
zvwmFmQH#6t8n(m-v46KxWvc#P^=c9cXh!WV9|~HJlbqW&73#B7<A3|2rexU|&0ne6
zZ<e}5xB^*flkvekPT)Lmx7nzN6H2c~`;|Y={DtSh6f-Xt^h-*hALe=}0^~-cXv=Zl
zl4z~y$u}9#xgP1lw2zX&S<Qk3GLYeK!P`8Zm<u-WOhgI3zjI1a(uM!Wm)#(r@9Xr~
zx;0h;$7iB>7615`f{Cx&c^S1q{vdC%M>tw7i3MM$ytd|r#ayZ+V?Y}6qm;nM$mX}K
zQh+FquwOGK!7!&8#lD2mrSZmNyz8FkNtiq};Fjp(pg`T;r=SC!LV6{%*#tT^=SS_v
zpHo*P?;?nupHeE)8sAW`4(O??2?(3e0N9?2fcV`BGDc(r8u1k{u$Ey<4GQ4@=FMc>
zcku!uCVo3^C~{J~!SCh)ho91ed4T6c=Q%to75VxCRtHO48`h7P&zsKf7%CIqPPe<Z
znM7{~8?lULU~M5x>l)tmw3X(JrwHlV4QyYVo$JD%X|0@G_Mea)yqN73^#ex>_!S#4
zDed0(^RGnWZ-_UY{A=5F!A_^gAx{3>;^`Z=9e5XVe0-#s8s1gP8D!?UP6@l%Bkktp
zP}?C{eyPMf@u1~+o0rb(zt;OvhwzxpY~xfq5~wILTxxc1R482}R=)%yVNoGe?NU&F
z6q~Vf5nn=Sz@O5t-M2p8C$*)v!d2Ue_8T1UBdaJVGtO7JR3mwzE;3j>I3_f*%L1A2
zE<c=bC%c6j74T-^czbk$^*}jzft{H3bA^VQNLb5WU|vxHIx-@}GRem2JUuQYL+<mH
zx<A&(U2tXt^g>hqnJd$aNwx~J3hLHZ2$YNW;<dL0_LaeKz$L;Vglxkc5xU>V^%U`4
z`J>|MFm-sB8C|73oTaqP)d}|QlY+hhKK9&QaRDJE5EqXBUi|s+T?SBB$i+SXQo1H8
z5pw9`moK7bRsZLlHfBw=?P@sarq|WS%FpA$a2mu}e!El(2dgy~UA8AD)vnLDTDL_G
zjfmq+DfH#)Pw0YqXBA99ovtU5lN%i1awibvi&OCaeA^aEIfM~yaOdr(pV^rzZhxHH
zRxPz6LE+-EZ;M*u-urblCks0wjR-L7c}-L>X`_BzYuri4Qh7AC{WR!qOKf9i(931H
z=UBO*EBG90#(J001TnLIUY^uhEZM>latu8C!UB9jiucT%!m#?XTyr`mA5s_4>Syz9
zv(jQ`a1f-*BwN|vQ?pRjEjdPXdiI&JqEK$_uSAC{diRc5kEn6VLMs3;Qr%EHsq=+(
z``i}vh$SOy3ovvv+&xAPi1E_ktavtj!o%xTyLS>tZ&rF#pM0*^@Du@1;HosZ_%LEJ
zkC?&zgqj-Y*U##fyQ7;99u$J=OSXS^YrVLZE(Ntz9GH!<@TT9be3O;j345Wt0e6ib
z!nP-QkK0+OOr=et_`F7fT*XH6Q>pZlzNaIIX?Ia=JjY@`$C3_t7Y~G6lp}6#JTWaT
zi7<I_FG@J=_>F7{$pTmFgCwTwx9ke<cqIAf_UqF=87aT!M;~n!%6{$T6^8^&YkblT
z$l-Ai<{xM}pg0gAMmrhGmx2jsh<3yk`kveiNZwjaKGXl|Dk1iSd!n)vNfF)R=Ig!5
zA(q?mdKwJG4Q1b(7O%bVysZQeWSqY9=~QSrZ|w9;)GVBB*#5cmiinOoV61SObcS^@
z?_H{#To0b&FQ_*q7EFyb*pcV^9JO)nIRrjQHgy|5weoVtIGirzno4=dv`L?b^5BGk
z9l@f5@Y))m){j6ULmri)1+Y#|2|3_TO_Ln*v};IB&ch!CRdf+Dq9G%XP`2HkIIVCW
zFB{V?riCExuf-m|v{HLxtv1LnXvkU%pwE5qCYD##t$xfu1}=LBcU)M(6#qn=LCvW=
zN3|-@5PBYVYkG#|wXE;3FB{PlXn$u+f4*k)N;o5%%AIkBEsLH`hc><pu$j-37N;-M
zQVQls?w&F#$3jq1s<{2qsP`dE(Fh?~TtQxZPwu}Xj!)tX-hPr_m`W>dFEs&(r=yXG
zJ))ZMG?e;0W`~4}(s!u(lvFA7AXqnM^H_>%e$zru?#s~pkdeWea7-`(<l&lE2cTS7
zgJQxO8u-I)f7wOc0_5o47$*_{`IdQaU@HsFMvjUHsq~)|s#IOPhSZng3}^s{Nv~sJ
z*?9eA2oHCplgdV)tHN@hxkgj$p5Chcn&Qp3!ggE7h5|LcVK@Pv1W$jLT+QP4a89?(
z=auqPY`m10e^sSp9doVlS<7gLSd@J21+V=KwVj146C4>$%H;;M=S|-bFE2J+BoIve
zle~4TS#}C))_wj+bafs0Em+A!T%AY4<>n?<^5nw2bZ9gt{gZT>OZ<~`Dr^cLk5Cwy
zAbTB?cD4fmL0ti3tx00U9so+p6Ob~_4aAJUKw_MR;TgR`H&#)FH0|V+h!XykBJ*MD
zLe~uiUl{`gM+P`vP2h(zE{c)6nG3b5t1*#UR`xh6yl=!?lGn-C)4v=bdJ|zJQ#bO{
z$~Jq&CPF>+tE1G6@;}2)bnWR_@;oDn7I2Il{k61~tJx;L=8PFM67JLz{=d-jh{nXw
zRx(NSc`l39$RLFB`&`>|+H#`}dTvg~afPM_)t6eZ=($d6IsV73L{buM1={UYIlKhE
zHtG+#XNL=XCH?%OX+N#}kTMrC$%`;!dvF=WY2Fr)L%!DMb+5Eq48*WrZ6RJ%yL<!H
zLpQXz*&gh&KsCkO*CeZ9&#~apOwlE({d1P3;%>jfcHJr(>zuW^x6D~que2SO=ZiA2
z+KgqI2SgiA5D6T2|24H@U-Gb;v04s5G0EkteIp=%Wv9Q_6gPA4x`4ke0<tM+QswfB
z=u5e{OmY+VWx?R)nPnIPd?lwUuPb9a+_IRz%Y}RqDk#^bx!d81CksmQHUa8!cLEIF
zxO&Ip@4Q?NgP`|`yRL<J+anBKH(Cy@;r*G&x}MooAp<--I<*=%&M58}q<DK=t$FjS
zKiulOLh&V4e_%785RibIo;c?`f<65pr~5T2t;R@QPu>jRRN=z}2QGX}9pGY;Rj71S
zs9w$hy?1ck5>3fEmR9AXV>9Gk{_3DougbF#o?KPB<dOWqjU|^CWB8DW!B+AC!Dq*X
zY9~97%dn>D)}GMRuGU68w{JSq!w;CC4e#Spik<{WHdjeUj$73d4=<h=1hyacVCLTa
zl=oL>or<ItnOfo*Ss}Y)Xmmg_B{m_A$gp$|DP|+<7SQXHO>w=O;C<;5@)>1b-dTaR
zsDCS#sgVCTp#b<^t}<VLa<y!eJmm^M_ractXBys0`|8bROPd^;U~(f38K6>b5;()Q
zI|mykrNj!6;1sJSPxmxqZC)bZ`FhifSsdWHv1fkhW7Sf2r`fJ=nx5h+PMZQjwj8g4
zXI1lsraEX#Z<b<S@Ad#zVsbo>>11pYI!nWy!@sEey!2(-*Wq={L_gS9zj9@ih}OFb
zom|Z{nH#k$<~o<x(qm~nGunA?A2Olmjo#3BSE?1COSmMQxoj!bTVx8>5?dx|?|7v#
z&3{gQDM-z2F~RagF!|XbTXJpmIRc4~M0O!ZcZ4O6oUa@xw@~h>WaO6Wyk7<BfwUdm
zwLYe%Kc1&{=o{{t9W-%a;tOQQn2CM?HoZBm`aKylG+TAbX=`S%9n(lQkTJt<etM))
z7VwWMInVDYe54{`6Vwkr)YGAybxSJX$L?+tQ3LNPY6RYBILsR|=IrJDpL}sqxAcH$
z^L8m6E$U}?ZTIE$M7+WK;ZmKcKep?yr&~raEiqpsPw`xy@!&RGFu53Mfg}mZP)x3$
zbt<>*Y1sL(MxMp6wLL)w_>XyJuf_A`K{R+t@OI3jcCZ+M)ABJU$f=X^CDlJuz;Y^M
zGPnB`Onf*d;<a^uhHlHScA;B)?)+JXr7~r)dcxpaJpZ?*P;4DO{&S!`mOj`xS!Ghi
zZ@tD=9ZT(Z1~!1g@jdR7Iwui##R~bsg5jnGYU|#}lg~=2_`BtMrc<`<)?W}2o8?@J
z$mH0Y`o~rNsTx05kTp-h@7$34!_1JGrW6&gJHn!z^Y#(CR{y35vz&4*0-$Jn1d$rr
z&TO)^K-OQ(am?{D4KF_g+i#(u2a+kmk_O@>n=ixI<5$#lyCt5jj7$<|Y#Ib}ax!tn
z8vKW#a(O+3SVL;bsht-=d9-^~?uaIw-;U)fdcbSjKDByToXLo!*dY=D3LmII`Kj^h
z9ND6=q3w^<NXA|D5&fd*+=ZY_XEKU3%0Q2v-8atuE}7{lFF75GJ`_i+4c%3bRjEst
z18HwfkS^j~r4Vy-<BZ9fH$LT0Z6Z0*Hf*n$%KdBsB+4f~U(308r^reD^znD9bL{pv
zy&6|Q)Z*wLJlALB!{Fe+?*hh!K0wI^{x%|HgmUWgg>bgsz`YybUsyH^l@<7pTV~6T
zQZiX~fzhH+JJMoSG$Nh0xLEiz*{<c<=<>L~+Qsy2D?%|Z&4+4~^jbN(W~#yQ`KpA>
zxhh`T)$jPgN+M8QvEtP9+GKk1rBwm4^rY9@nhL^qfz+$1nmo=6`v*~rgW6I{kB0!u
z?11D|OP$YmxGS0%p7o7_B%X0N#J_Z{HX7Tx#$j-}a-P{(o^7Ppp)=2_L7u83vDL?k
zORRBepduPt18|__YvW|EujIpuTcv$2m15ksia__HJrN)Q@J?ANQWY*URU&&i>rRaB
zq)P8~78_GYbq7w(kurR=-j-xt1ry~oyLp$-4t#B(bvTxVi#o3WCPne9EQZaty`Jw%
zN0arw=)KyM&YKx8a~Y1OMPD<m0{T2CPD`r-a6zrU-j<7tH*96PGr<pdRo+RQ#T9YF
zIvy=1_9^e-V$uMWI4oj%e_FZvUb=I-u_`p&pYR_Yz}|<eMcKg#|6R%zQG(^JlNP9<
z47eqifcF5mu(-EZ>e$=cZ)psj<X7Qr52AG$HOY)+yZAY*_76gKU|QzfOeSBHF*Dx!
zW}5z^INua&jnjXi4&Ox7CDK`oY?D+auH~6M6&hX#NWnR%yGcEBff!J(2QaOos}gHQ
zi0){M2-mCp>u-BQ*lS}iigS<%U;Hj7Q<m&YTdYMY@P4_iD%_*+#$kpxr!r^dVL|kq
zbAuXN^m|pvf<6_UOs|(ieNLNJQJz%OAGljtk(u_TmVAppedtPPN=i-c@3c;t>zH_M
zns|x3=AlgA7=2zB*49+dtWW+g7C`5pF!j^Yh>TJ+!nTxg>&tPT9$Vx?(*C-Qymj2M
zq(vsGPc3gEhHN#<m!$=*6$eIa#$NBJ{oilOm%6do{!Lo_j{fTW!$zI4i>CzlQnDIt
zUUv_r2hFF?2io-C<)2N)zF&1C8+dFtqXvC5y3tK~Z~eXooQ%ln#;VcfFS_<`Wqf<)
znDM8ATCdAT5n35-9sZKE>3tXpO>h4<e|x@`IllXSL4Va?L)|J33;Z$?AiV<W_S&Ma
zyx0!dz2Oz~_PAEfrLbJ{t)Xd@vD_H5;Q>E!mJYwwj@C?blxQ_CR@oLfDzTbR%I#4p
z<Z_Zv0Fq7r*l9Z*Iy3vaR>)=6U|6|LOVm7QmQa?nwQ+AfA@zwMOiK+5q^O|P62$ry
zhUTch=i0njqq3`7O^79>`aHY<gqTV^y^EF+RWyK+LX`g6?&Biis6N9;0P#`jkCA`c
zaSv_)Wsg03{LUKEe(fm~pcorCUzlM~Ow0d$&2EoZaeqw#qKeHvt;v4_h|DIlGQS#W
z&6>Rj82L&y=9nv6uF2qJE+x5`c(K>!rYanL9D0K}E7tzedNGsoHY{QszLD>|J~syR
zrGD@Y&>8U6c4ib~SWXWgxv_3p!2@PgbbNG}*cN|R>A20e+%eX?$@>h_)X>5%D>>=N
zkT#Pzhi>I0?y9!MDLVyqYnDa1jZ*4!=?7(5n#%`f@Jo$H62K-8%DnWZu=P9^+CYDt
z&CMU>G+l88R?&!#EpO$aF48V9gcE6Zf|_lL<Ww?JH7P%}gYEd+Q<MtqKhW2Ch@Y-E
zs*XwVVgekz+y2uq2mzF>E=%UznDIYtOsx;IN~Sq|U1S~`lax^mf0~F5>sYN6S`SK&
zGxPJn>$I_bZhE{>FbC7YaAhP3OT;2);{1kSJ9L??pq@*8)$%%42R^2lmyXLDwsG#p
zjzWnS`!mPp_Er`7+)xgWj;6mB9iz5Bq6<yM(Ca)c4;2fhk2l?FHh={l_6f}ka@zPG
zNAn2)sv5^Nj3r~fbu#A_d2=7P=K%&<&UO{cw+oUYIYeR~fDif$c|UXep;UMsz1Q6$
zXHRDF&3luZOzym*vp#p)hn`g5d@LuQVsJ%sB}F5=*`DrS^eSd?xz5%V4@E!|Md{g*
zf^%R|zS-{wzlNdAjs08JKa;Xa0`Ghv53o8<gWPOT)R8OUZvfg?e@mf-%Qg$C^(e8E
zR9{SMxA7kvIQdqE6X{1O<nO*wy{8@HwDbMbRV@sDyWjnsh_!BxF4z}|TU6v(JLTei
zE%mb~*4dKrxp4`;)0dRCjxc4duYE0Ua3@czo3J97Y$Y6NPKN{((>htf032XM0PP*Z
zCir=u6r0Q{m=vV!CZ>wRZPrq+2&o(<sT>Fb8cvE`Q|~O(9|+BaqgXnV?%MB6B$YK!
zGF-CAai^7dphk7e5QS>89Kt|5lF`lGp*ojI=K-<yOSzyq1i-$Em0W@NADt0#h{xNV
zFL~yQ%i34UtwDR>3a>bk&e-`=46nftKzj^NU()Gys@*(;f(w=4XKy`DFh8l*^t|Tu
zXTp$r`k^VtlNQvsZ2!TcvlyG&AMoZM9|?o}FQ~_(1mTZAYO9m-|AWK;u~`!G<_FAP
zM)(61h(tBtOv_eIGy`2w5e--Lv((I;kE*gjlW<Ez%8i7zTzrXMf|Rgws*LP}9O(zf
z*by<@2j_!B1cGF6xY2EM+3YLWnG*w5uT2o1bJXlfaMmvP996g9=xdFu*qmSB@>sui
zV>_|78=)D`Towe3b9L!W52OtGeqpq&CA1u6?610X5gY)?x&C<mUpeA`Eik=Bv8zz8
zY6A5Cn=XO#rS$4}z%w8xx_gxwJg?b_*diJ7L>BB=ZO(XU)9=Z>%xL+4C<OjDO~C)c
zKK}#G*4gG~_FrqTL+x{x+xlmj$=^>u131KnMSMkrCwnKJzet?#0E0VjXvz9!MvyV6
zAzx4SyfM!R+#XP*_a{X_-XT+}j~tv1JJk_a6ztmR26%ihHPbBhhfqBmTpuq50g^-g
zQ+qUaPbE$pywN934r$l5gkgZ=tur4t#i5!XR_deE26oi9U}>;ldMr{2BFxRGwdbb0
zo>%NK_pPx0dm_bYE>Es1-rKq_rfCiLyMgx)!4D|aH4~G0Wemh_?DSQMt&=itv`mdw
z?j$XunL_{NvB#UhM0VJk<aY;ry$I2cVp0m&BQ~U5fq<^=h^5zN*eT@c?y$5lQafZO
zI-TB85*xkG7XTz|_RUwgZ;f?UbU%^FpHBQx21b)&pwYPFkiSXS`>RAEa+7@jIpfSl
zyGflLQF=+$W0Zh*Y3>_x|9fP({j50k6Ez_sFVq*b)vZ40@IWmKM>2WvLMle>U7w$*
zpyOb6$glm48yoIooi+6|8A`P_ipGC{%*F6C?z_BqZ;Fp}rM)u42B>c-m3RNbF~g!A
zMceH8^IMcz1P^IRh~7wtvEKBESau&j=|s`RI$rcdu`Ffz<DV{5f6kz}Ck}3VS{%%>
zqMU~r$-@9{GN^LI={5C?RfstE{Qbhzz`Y}5xu|ix46|ZW>EG)lNf*8ZUvv&x@4KAh
z&zxKLRxj70-o9~p-rssO&2B00l0MfPO`*!@i%~u>sl|mR?R~k4i$dJ=MY6nEIHsTD
z#}ybuZ$0R3%BNZMi-_D;vAjlNBs!hk4-N(a@c)~w!A$bZZSQi_q^Nqh3bCz73WVk1
zf+f)upcLh+TlYw9vRu<uw}!#c2{)emyTgWeVU@W!Vk>-K*yEg=uNlR=W_P#zFFn`J
zK-&!06VwYlF(6Uw4@!~Li$HC&kzTDf-~Trd)T)cm<tr(Gul=Ap0sW&2O10cHg75qL
z(%TTE8vj4g+g~j6P5s6U!Lc)cctP~3i<vpK#bt9ihZism&I1H5J}660JpTHc#t+e3
zDsUFK&7%o1$*bR+8ywYOM_s=zoze;{Gf>y0Rio-<&i)qac0JXxD!x0`ypSq(sTTX|
z-<0B|3AfMq6!)Rh3fYY@6iID)6R_OF$Uy6~YUs2By`rOQkT(#qDa4Xv5PBQd#CEg*
z6KyAPMa1{Y=#<?)%E%iJZJ5`Icxrv+Z2$j5EwO-zN)YT$W!Rof8?wD%j;b03TI$D%
zT>G=@%Wvi%{d3IvPWYD>{>7<XuOo2ox2lH^tp<N!8t6}q=}3<b0_2(Xt{o#W&X)wV
za$v?ITXzlpR-qv6(|E^T_?X2b!sl5Y)kL8hZCS0jaZ~-anf|PcBAX{c?<GQF@vENP
z^o{QI;s+ubG!hpyku*BO;;3s;Xoh9z&ItY9sHmv!?~*7sWuM{6<d5^ig&?I#pru5-
z+9}*Sd3yzaCO|oLdb`6-`U-$aTUXNEH?O-u6H`+S<N9WV*p+_bJAx|tHL&{lJTAFi
z9XCDK>iW|>x67Kr<(z^?3MVR)PCroz{tgmrU6ZD;Mnkm|EKp7qfHZ6&9%F!S&~CT>
zyH~7$L>VqoP`=Ny;bIbW+FWf`qRg>DSVOSW+W{Q;F-PEbaucYw1Ct=GsY5rya=M`x
z4f(=E<!0&|&8u9QjO3^(aFoyPSKv0<#M@#IFca^Tcr`|Ja#HP7P_hGB(#q|Vt<aQg
z8z<51xMN*E2Lb74=Jn7qsN@GL7x%+cRQtYC=Iyn=0AZH!4>pfMo!6hpfI#1?C;rRo
zKfRLQ>h_-a=?$xe9mx)Af2Zwz<Ap(p(<_pu0i8z~JHPencRK4+ISCt)U}@B;%IMH8
z8Q8WBGsF>hw%vme1nO<pVBdKW-+0H~1t_uDJ!}<^`r~`z3H-*q3IN+uGY)vOvCkoB
zh4`QQCKy~3?<^!HbAR4DKOVV-lm^5!49v{}RTT7vyyA8{ktuQlLq7dV2ZEA+`lZNL
zvW16HTk^+Q6H4-T1NweaoBJ>l$*bctZ*%_yt)_W|p#**s)9BI^=n|o;QksF0^<D9z
zkX@S-<*m6f!NU{h3cDVdO9bJ?EV=cHnEMUtSs55@G}K?5UO^te3X)dntUeZ~UC3Rk
zqH&~NV><1gNJOu!3aZ$j$aMG5ElQc%HAzaI{P^iSIoW3&L_ZP=0&5wSTfwB;3hPfp
z35Y&Tk(bpH14b~bOyZkPJFyI#RIa7j{b2y;vA!!GqVFG%rYO+WHQNpU!D*0Ba(OoG
z-W~V+1YxG3w!Gb*o_Oz>iCm#iV<wr~NHkq<FIK{&cNodmhM5mwZJcxAHjPYH)msBm
z)<Kf)D8f5#&ZU|cqtOG}kkG>v2kNn_M@#1=imDLB<J2Re)%CeyF?*f3;<6I7hn#J^
z84&aMFAhX>QLRiv;he-#5TnT!*^alVRTLt_wAvtxRiZGOKeOMWNle?Fxixg18hvY>
zvn*%AM5nV5<?cxNXN!yTqa)+JKoT1;y>$xFRX_q%iT#cUo3>?7FS7B_GJZ!SYm29>
zEzp&Pjq*5T%(#D6@TIztRZ7%GVCDM5J%;7NF{VScM`Jy3_JM;C0f!o&S05$m*c27f
z13%!43%E{yWS(xZw22tl+Jne*eku~1Xuz}!2{aO?tjZd)m)pciamUS9Kmz^LSL9Zx
zQ>u^w4##82ZE1LOMdu*tV!Q`>IEp5O1X9z(MGx3(&hb<Owl2a^8l@i;rIkHciDNn5
z{9#wNT`Q48cPD5(PT4#KyU17DaU}+M&cARyCSHlnmLAm=U+-Mcr^j;!hSS+|g29Df
zOL%$02euF~5+=3oVFdWKU(!hHf3ZS;`Yp`JRYyn+4k$DOpg?{D`F*iP42J#?)xwNH
zou!c-Iwk&|*^)7{jKvwUx1F}^4{;?CKZG8PiVH<fqWK-<=F^5&&Q2K!hp;8t+c8O+
zJ2lYCeRxWDg2%^)%KzF&=TKCqjOOTWZEOgKuB-zGqjs1Nu0uqnzJ~B`OOSZZ;=<Q&
za2!VVXu#$>5&b;S0YQDGsZf3QU@Im~9Ago`bxrz7oVxx*(q{GZX&u#~MRIM<z*V!B
zJEMd_ykdNTkh99AUHpsPVDqel(TLO_wd|$6pZvkl-}iwsr}aCuI5h~N?}7~7_^?=e
z<>zINB7QSJ)&*;2hZX?e&xVjQ<ezM~@64%Qk~o5&gcDWH)g!ZYs8YQW-CCVDap%B-
zAC0je3&#MZ>|vDf8v$vOM-(!a#&!;mRk`gTI^aaLlQt<jrSYZ2EcduH%_cK7_19?V
zE<s!Vu+ujbj$So<zMAZEMUru_J{?1NJ!0(t#n(4SNBTAEcI=5JwrykLiEZ1Nm=oKc
z*qPY2or!JRHgC`G`@VD5x#zC?U$1_9_4{^pRqeg2>UkdALB!~U#&)ViOU}Kpm)WPH
zXMK*ZWa2}$`UZ?IdF}KnG*K9K=R)tj%Oz}z23Xp}=6it3E{xTyXl<(1DM;aG4eL>k
z%;z4*5+*fS9r{$6`f+FN%b`Dw7z6&2iQW|y`=B%kC*QT%>!`5+=7b2>f&-RCF(|BY
zThQVmdxk?32ER#j7zE>-sMA$!jZy^rh-1@t?m%S;Ij+bi-g^s{(p;4?6PDSP?|+;P
zJZ6iQJxYZvGQyDz3hbELT&O&gQ_KKk{$P@=U8Pk{b`lIjG!M$*eQhcDaX$@&`ZZrN
z@XHR=y7WH$^O9*W0A;2NBv*4UA!Y#n%ix7}6NpR9Fj*3T69d}BFoo(!BFdUk3%gEn
zlh!%>r=muWJr0$XaGa5fp&*bzK_Ebn3sY=jxcrO@7GH|jT!2QgU6t3OP=~@%cc`G>
z#M}!NgD0rsQxRRoXd5;`l1g!oSecjn;-%PSe+p^bnLuLCxMl1&RkBW&^bw~m<)PPp
zS-88YiNg*>{N=8870&X3t;uxqLvv!S*G|uRT9z1Plz5zqa*Ixjzoj|=Tz3Bzo`_4T
z{1tW1WFg)FZx=UlAMfyYc@T4SExWRb>PXi}L(^}$(iL&CheRvyeY5ixhZ{|RT@za9
z@{HeET1jHYQ-DsHiKHS`lsH>-#*td;xbgwq$U>C{6PCdG&m1s>n_rS_owLTox*OG`
z%y3()$=G#!EM_Jw#a1{|newUDoND(C3Cb&%&UtvE$Xws0WvcX?u5g4Ps`JOCiE}V;
zJN86mdxERtE~2!|NXWq$szlKM!DDszQi#9E^Rlt58VNf9iOlWoamr2JhnrA(Yj8^F
zN$&tD06F5o4&~Z2f4*|St;pqqxJH29xSKikN`d|~2c{28RtvHcy6~u>o3Y-LxZ5Lu
zo>fX7!wI&xRnNW|{v$4h8&pqpw-G|T4uJ0YjIVlq6*aI6mTu1O1kINYa}3_O3;@@+
z3+O@yy*{=w_cB0sfZp90{3+!*2WGS)C@t(BP~aQu*W84_=M71LU4@85vf`2VL@4Q7
z`M#YU=5u2Q2^|$!jW_Sh29;d};u}g%rFm`Xh0n2jn2E^-zP?r?v1-Aot8+b&2R+;~
zQ!vbA0Hi!hiGj)*^phMeP`@K;<qJ|PGCEKzzUotI65I$_#A&8s2yx8Z*~8<(L>0eN
zwxo=01h!OEK?GEj7|)Vg%iz(d9D?G4wYD|-9li`BAOdRl0K7~sppkcO3RfGZ?}x6Y
z(BP69Dgj-nzxMn1M`bd&$m-go6!8I|j9f+Pm|Ovn9D8Y!Nzcg%dI$m|6G*|byWEel
zuBE`N2`;xAu&(|BoY~)lTPR2z(pt0~)THXdCREJTKUz(PyNhQD2Yk0KR{VKKH>XT|
z=_bRg1tP%rYe4Un(0ViIOj`bQk=6`POdkH;HMvd-r2AV|tAD|nfo$jScb%}f-!G8?
zLv_e<DASPhpTj1q!&DAb&Az&UQuYtk94+!2pI=bv#U&g{Xu0U>Q0DH=R<i8$|BU9J
zMfiBO(rr#1Oj>l!ZD{>qzB~Uj|3!YD0*!bssGdO1BJ1u_sH7hhkXjV9Jv)&KI}pYU
zP}7@;LtYor3E#J_nn$BSu|{3b`O+MyYBwf2vLbJcwy!QfpNNVW%J!6KWWU!w)_7N*
zrKJAHo9h)`Xi%X_nac{U>}2rXLO7ClBn;BKb0+_v<vLMH{Q?Bi*KIb71%@gCm9NZ0
zpOCYnOsXd^`Zm~ML#?y4(CpOS;<3tUScLB((5;byKtIlvp-e|Ngylh{LglNcVvB#N
z59xPen|&h>l3S(I+>RAVWEE4p6h~I|>1|4@lE}Pb1X&GJS*B0w#f=fZ5=#<<8r!;q
zuKd3&^2l6Dw^q}^py^cN`@jFZ44f9!ZO_HhXO1jt&$J=oS10*L?09U-BADez*)o^G
zyUHOHedScTZ%6^gCfog<kj$|5y8ibt3h!;e)CH9=A_1V<baY59)MCi;(uustn1W<A
zG)`3n-Eg(Da8Z>ydMA^>?!yQf%q9zR5_Ihq7NrcJZw=X*9t5?+<f?U^jk_A*T*PF@
z%Z)pfogPaN!LibtEmm0is#qTbd1E)WU?@kXS~c)Ntq-=4)jyMdt&fYp45QIIEet@~
zfzxjG-}T4(WiUK&4rez83MiA?9@07i%}0Vm?>+agYaWP)8=Nq@v&OXSO&*QYGb29<
z<Ko!4vwVvOb7RAgLar3}4g){!c24h>Id}&FRFEI3OYMr!`U$;Yg^W{d4I$QjmkLeY
z)5k!P3kqm7HXP_nnMa5@^M_9;(*KxzvV_f&?aTT&Qi=L0h21edco=bYDe;6SeN*JO
zQLIjfv3UN6<1+E4=$cI}(RCv%Xbg1c0AwN^?j}fz*ZEzE84~p?n`Tc9Of-1p4mU!9
zE|39I6Tpa}H0z_)DK(Nk@_J9aW>YxR7#HXY&O?tUXF=RtqO)s4DPwqq;EI?tOa-Ro
zgS`WFt63rfehCV=p=wD`n8ch4gj0>1JWVF@siSrNU12y}vL1O&T8=2_vfe0AgfGj*
zF&goE1H9;g5k?@+lRV~hDyS8%0Y?%qBnS=9pb_IpleVwyxa9{!8Lr6g!L_c{ek6Fy
z+62@@e^9ggVrfQLd2RJ{IB;*N)oIYgPhb!lQp6!&+CyP2MtPs-jbFT^{HeZy)xd!r
zM}Tk>^s_?QShyoO2<;3@VRXR1v=Vm#(wUfnawzVWndVqSO4cCO7zrO>Od}w8wtq+?
zLQO$ZAbPXVbemgA`)tir)tjsBvdn0}VxDIr|B~!RDSG5WLja!iT$xh#{0m(+O1y^x
zji$IYJVRt0*<VOwMCh~zjt|6Q)_-Jd3;xhNS_bO3w94ccQ-mmIonOoxMjs6k9a@|Z
z418(7p3`e!6%)cO>N?qER<0uhNMa-Qc3@B9HVi`$xRgn_ND@anaA9yn<ta18ZSV5R
zc;p8i79^gzd?_s0;!f|X3Hg*fJ|@WiQ2Fz}yb!)}kS<>DrGlTeLD+X}wIU#x4XI+`
zB7&;Z0w9X07zmdTD1}NO5zK6dHY|>&F$yz_<$tw=K-GTo`NT+9FsR$9k8;?#MP@`j
z+b=ypbdHyQavgBP*Bef7tLr=J3~C1M!Pd(PON`>`S<!umK{_iO_Xh!Ts<2quN&EkS
z1}xC#Gl@9+8(>(Lr@c^YoP-Y92>a-dYb|ZKg~e8tgWm(h2-8CWDR9_(`ZPSQD$irq
zE#j5nm%!;C9u&T84N!}mE@>|XuZ%Ek@ntLCO<Q=XRjTvV(NdA-A%}HHD)Z3Pap)^>
zxtujlrta^)Y*iLmp_#jhr69fz6WA%uDEM|*bdmV$>LKiZoo~@WdZOYtQ9zg!Xr1U3
zw9i+1`xi870d^L+05zmsJ7b<0R|ZKs2U%U2XoF`ljgTJJZZ&Fq2MdYoGeim#)l>!`
z%b>gR+aUtIDN0m(P)sYt08ar4zr=Hz+UE1bTf^gARB83cx&@t@^>c8?2W>it?=I_e
zzEB_v$u@|i!Y%IFytzoF2!Ptry3sRLUGOzjlOA2!dB2)H6!oVdS9C_QhT!DG{#S~p
z=kVB(KjI);Oc|Hh0dFRTma2{?C-IEAw=3pUp|q||v_taLwZCzB+Q(CosqEVfAykH>
zNORcadqkvAL21<G!>}@TGm^^2mG95&7VMfUtv24QFg%*f&-6T58E!d@(DF%DA~dp9
zSdbar{r5+C2pR!|8_GFIQt3X91rOMNuu51rq`=HYD95b!m`|T+WNu)%OpMOaOW$~z
zJ@Kt)GmU>3!zYs$*;U$sIo#mTGHAwW!SsO9gHPCa8pUD>uzp)JQ{783xblt5_|z!A
zHDT{T8>XtSAuV<JB0D}aGqrl9O>p-7WzrV7edN3!)ai?Tfs1BIiOdm|_l0J}BGe#M
z>w$mz>6bZ>_Xq~K_k#**`8v+~vs~v_W1m0YZndel(aybP^$5A)kgPh7Ad>yl-Sf;1
zIqIH+IDC1$21o$G31TnGa7)=?<cK=zE1NnO4NG4cngyEFO=nY*>{nt#i6D+K3+#H5
z*y;^%v;06?OF1!`ZHp$s#`RzdQPe%y;!fk?^6GG;HyF7zHxh+eH!Z_~<*{<#dIjF<
zDrEa=W@}rp)crdhS|=ooGn!<??Z|nD9lwK|IcgVnMDO$B<Ops3%d!J{()w@uIUTwj
ztZ!WT-y}wzCD{|}_%q_3GgdUbrj`p1Pn3_hgs7%}f$Q}-V@}@35b@|DO<MA_Ye-@|
zdg}6EnI(?VuGr5X2%O!S6|PgDk<=IJB?FMYFO+H+)mbfmtz(4Q>PXP+1XtCUMgala
z&RFs+$w$D!EyIPYh1B6HL@@g~<ATdnWa7eJBu?v-uARD2{^r>tS%6Ii%O@e+()>q+
zoATnbX<D=8R#AtVyuKvrAk-$rC>zr8TagmgclwCmI<|*57!qh{qjqSoEBa_?Hflhq
zh5{8uJBirZsB0Dlw5^7cBF;c<JOo;bAkHCcW*eL4)HJ2iLS5+)x3=w4f`-<I^ArWz
zkGb9&pX*!;k;a|k0XJa{>KWXHCgjEPe9X>@P`}!=<gjMI32Z`kz0u&Q!2F`WqD9*x
zS+Kir0iOArvbrG}S`PmGE94%EDg>tI3EQPK-O1KSG8UR|5kKb~f}lVw%z}e5#~mcH
z$H#Zs(o88d6xl=&-K%~1eC%{yQ0Zz_){~||Jt_+!)5~s1W)5kw(!(vJe(CN}Fgs(i
zgDNqVfD7r0sQ@T`G#^=OyTkjZUF@}I()hAi#mLHv?e7Y=HnmcOLcWnste34dTQCfS
zZQ5lJqkbdzZeF%|WOOC<9~DeQ;0$8|D$KGXyK!yRK18)RDFKg%3iTmj0GilIbVut~
zg(_!71vWs6;c-iu^DKmE3Fsl5pU{tDZyMNJWOiRiw7qpP4HG0Q{%}W@nlTn^@~cBm
z1+5&MHhCX>GANu5Au<ui4x1wS<C%-9{g>ZG;U)ya`V{osntTpDAG#W&Zdw3`&J4Bw
z?=FN3dV44#3wYrifA#}fil?<rcuQTy%|_FOY2!?6jqyHWT<~NXD`)B*OFJ*%e}i05
zz6wk8Dw^4VMYY7-hEepY9*mh`D^Gmb2_3x1Q$YzxUwk>ypf@S{M1qqFjAOAdhn^_3
zz)@r3=}6~tnLp5xeX0wWqZTdBU^ql`j05BBx@WtzpgCTi2OFN|BUaT8n&O+Y?ociq
zuEkh}O<aaQ59?xpo#ae&N2@moFiJG?vsg&%*mcgLupWpzs~?*<_!?*OLC8Hk2^y9~
z;$%6*%vX;uIj8zf4^ojzBwQwYPh#&pL#?6Rb@`b>hC6$do(`401mQ4mwP%SV{>!6%
z=l7Y$nEdd{w`!i2tiJsUtMgS|%h}FGY7UcZ<?@^pF(=K9*KqZB%*_u4LGN*QTH!JX
zYnA|VzHiy-|Ct4VTNznTqdk&NSpLVERcx2yHH1H$ISH2Q72t+G20{vvm&5bWcM(iV
zQrJ&9zVRytCuZ_RHZIz23*G=LvwojQmVi+{n;~HhsM1c;xYFZm%a-KsHYmY{jARe*
zE;A)$JhAtVy)#1qk|wHa4&$x=&jR6w;((Fip$kK4EZ+wo;u2VZzXx%&m?G$yZ*C9l
zMA{`T)$eFBFr(>tI15XH<h#pYb^IYjR_=<zT6lQqd%y&1{7*CF!Y?8*4Gk1stcIKo
zj&^}aV+1ifcqvWT2ZN<m(tQC{^R_y<Hg0Ev%{Bw0II#v0nCy7H2my@D%@0;P_I+Cr
z<#HAW-#D#Xg{uvHvQ*(NDEp)E6dq8c*#@}!LwOEztcWgrFpAoYj=#Ctf4$HNaIDI?
zX4R4`)mUq&-sK-LsB8I<i>+Umeju?9nR+R6rXpp)v)+ArN-t0<>V8Eg(%_AUCa;Tk
z5)DSOFH={Bv53*;4!e!t1Et$EMOjXLFJFhQT(stl8!l&##A7HXmu9^X<a>p#bB|?T
zRIC)2weghy{b)C_NpN*2q&9j_Q2A^57)`OPsHJ!a!P_H$4YisX+B*;*{nxMV`pBm5
zz0r7j^dTF-YjMUGh6MwJqRsBLsQjb*E6pksaY`|c-yj`r^u<0KJv#od1qZWH5~@>;
z${3&o{48@Ll|AB>#YCqw!!t$4&tjT;Pia1PO(dR~^GoZFcm4Bx2%0#Yij|?Kb#hF6
zs8(`U=A;7LGIZOgo^~*3(St3Xn08w71aRbv_3!0tDymM^O)BSVF^)>a(~Jo4iVs7B
zD$xIUwmqWm!TLvF0J@=e?sEUC&7#Zf2~|tuC)-*Z$F)GQ=p=H}jmjtUfp9a)&UByU
z?S|y@5;r=xU)zB}d}lTj0m@pJ!f5gctjX$rxPkVVw(e3tb-CT8!6O(Wnf20+I`D8f
zJ6~{3v(IVCmD;fP_3$b6Wjgc=K)hc*Eur{ac~pubF-g2;|5qWOwlt0U1ItWS@I3kf
zB^Pb78iz1_8>w`0`QP}8TcWs1?{0!KrDBkRNbJTx*5^Iv3X9=2mzifIQf{iEQ&j-U
zB*2y$H0Ti%cq{E??HJ+jj59<m2Td>quus$^w&6A9r1A4)+vApTBmiqWK6n#i>;;z7
zONXI)h=zOmKw^N6bqjT@QpG+0cqyIK)$qKezadty(RKVBhaLWbbo+XRN3gHM&dd}j
z`Y5zdeywb9`;^!>MVwf1UAj4n+9gk@M&GrSkmS#%XwN|ZK(yf;puI1-Dx0&WK}DvZ
zBx_M49b%ho)ZgJ|%cpwgJ3ydR36UN2h?-`mLTrTLFtig4qFz^85=BkU`-$`+DbxZ*
z9vN7J6yeIYB5pX*52HVJ&e?_)j~FTObcbXNm*gFS{Ae^C@$^h!tU|<FDTuGY14Us8
zP3$+G8hWbpX>=?>x+hR6VCWE_ISjWC_|un*+R#h!9^LV7_sIKH8N&5-_La~TY$3aj
zF9hHI>Tqil8(?V2)c*DP52t+j_DM@v6;0ut=)D4IT7#zDu_AnW0E6xT0Z*(ZyroDn
zh3bbdJTl=CJ62QRR>YxQHOf*Hhx_gT4x=-FQf8&&lFw%Or+|@)|5MDcbLMbEHmJJB
zHoL`ROcej-aO`8I+gMNp?yxh+9!iq)?<59lMNAz3NCatcdBUOsJA2*oa>-fBa35q;
zkxF5oN-YLJY?=B1jOvQHSF}o+_@0QQ-;IdHBlB_lxJAM0-i^&%EcqdNh8nRrPqtay
zZj0)A%a>~aA$qkE1vH3}=HM!GF(09gcfg?bP*C*m3QEG?yc#2Oos06OX5Ps>--KF(
z6${^?#@(V0JlJ8C?B79E{{U#DJSH`n(yV+CtT`Y6rOf+3R9Y$ei=YHkGdAUKBhm1T
zLy3EOhWSets)Ea4kH?WyaXf}U2qez#>-&_enUkDr1wZO4%#La6TyoC~6<`HKzqe-G
zB_`-ZO2L`EX#l$bB=we6&HLXfXTew8K??w-8XC3QGj3iw6NwM>6yGSO9@yOZa!Wd?
z-j&wq?K8!uz9{)gs%pbG3nekspydO#g^P~t!7$h$0O~5JyDHb*5Y|fv>Sj*PC2x{k
z(VDWR2wVeH-buInyQ>yId<^NTjRrmyB?`zCe>~@Vs7Znd(_&y~O<qb&4)6aQj~k_j
zK&7_odp>d@d}x8L9BRlvbG14Ls($dicPtgs5U@mLxvRaCw4FROj8g-vDcXX$*Tk|r
zQ1Oe7+Gp$9*FqArtQ+hs=G(YhEvr~?)US27SVJ}L!UL;pdwN5+an>c8j1LI;ee3N$
z>s`IJJAHm{h;*xnx+f!RF1QW2wv<u@122sSV$`~E3>58D&Z)AivibRGnK~5sZ&Az6
zu!%-0*|&<z8HlADR)kr)v9i7HAp0X``I)x4r^+iIs#%~WPz5@pmR$+1FjmuVI?YP`
z!b*(0<VbKRp9Ae^;ueKm<zzUU_<cr;Msw`tHY1KV+V;C&uLK4K$F%&vMRiQ1MI<Nf
zJpV~yLr|nzC|tC;qZRKyx841aX!d4?2b2x|$rGPOr}C=+=nu<a&TI|+;x}BtzIXKL
zuXA$;!EZ(TRpeVXc)?$7M>aC4vFXcmG1P)>Hs=%x`p_BC^2(-NA>1~NxgDIXnyX%y
zj&adfu4Xs%mn702mymcDdO;q**x0K?Vt=FNsphCz7dgJUt?#;K&$7@J#EYc{=}*8E
z>685E>h}eY`(yMfohb4%1<`(y&EEOs1U5dkIllV1_dXl?T*#@!>1ZlfIOGeS8XEle
z6OaS^me(*c${Ps$YV?j&&#TOJcXRHE(KEW&x#|p+t9H}5<W}x!S@5nu5~`L||E?p<
ztqG3b_tdyi{yS76FlA+`(M#f<ovKSnZA|4i4MZw~*#r^aUE1Q$Y|EsFniQ7<2Ze)u
zszl&({k`#ScmNsBZCCf9>&|<N+t#;y<r8WP?9TP-BO-8<?GM}YCEs1%J2YH8OC<3z
zN1+7US&V<Wu0^NfVp7r)23LaJY}z;+fLK_K3(M=_?ApZR(iUo`0>az<ajtR^zPsQC
z?f?}H1`=o8EXCu0{ZQ^ok&NYV59p1IKsyXCh#^xd98834R^B^&6dDGHNp7d&=TIxH
z6VqKfcBv$7#mZB0pmn$p|7|92C+%-rZo|ZPAw{rcWddoOd=h^z|Hq2|{i5EF#kcG2
z;YUleU~{Q!JTkuMMJZlp4_qcscf`qd!C#aA*N4^cS|@rJ7#L?x;~%Vgdnaq|Pgg!|
z5IWU`mX@nJn3WiKZ^_v^g58>K8SYyNwD{-TAD+I~DP*@Sy-X*15x3S>f<hV2E~emB
z{t;Cpt_)>4Pan@_K(jq+24$H@1Wk|3_h|di?Zn`GZ8rvk<wUAr+utclwZwHXBEtea
zaXq9MDzhd|7yZcyj4}b)HYuy0#Nh^NT@RzQPedC8pi}d39@stugIkbOQpO~!-UDs*
za|*KU9ON>+ds(4&A=-XktJOzl#>!UlE(f2Cul~p3Zosm>Xi#SBjy9or<FpBKt{Oqw
z^uL~Khk3$8m7MY_SVpv!xnn&K!8CFxwDJmrFxlu3o%RL7OoXQ;GpFzV=?AlHMSrBq
zR7}#sKW@tH#A;=+P#%SVAMG7-Z4(h@71_;}#aR#f9ph2F;Py2!wizQ#AoO*hLgxH<
z5hS%tZl|RRnZ|HGb@Y!Y-KE-LfZ?523QkZ3PIWDyqSatVyxpw(&Q`u>&id{WcF$w(
za|=HT3W|gTE$Lt?QHj0vDXslxI^)B$#7%f8G0C33iCNH(;|KFh;_*2>5hhBY&mv(S
zN}N3=|Cb6XQ|}mRkLGoLd|R2|51ZnDn>^1%vW^CJ8f<Iy>Kb|YGs>Hxag6zk^<eI2
zRweyh-^*m2O-~$fFcfmHJ<wwpxdRtU<*|}6pFqHUy(<(ZMjEpAdL~<jH>^XMedc=e
z#tg6ZUMrriid=ML)31c*<f8_;0M1T|L8QFjzD(5y!~d#Rr&wCxC&N0|f4p)W(L0C#
zW8C)2RxUEz7v>xCJ_3NOMg5)&odAji^O-g4w&(oTZVVPc)OWp0_jG{enY8ZaYR~)e
z(%RSnMzH1gt>N=>9shAX)GBYgH#RO*E{XL-4HX^}4eFT_Wy0EAEeRGNc)0DR|F!ig
z0FVTme=&$EC9i!ekSP4AfH{ko*|&WO2|H{`>j9RXrF^OeCS=HD1`8P&plPSi!}kUv
zHjaG<FVI~scI|V%EeZldfl}jU;dms8MNaEU@P2}R$Cnvm>zMYG-i9yMMu~|v^SHZP
zu%u92vUybFX2?h!pbx$Wd$t~ps7BmS+c=(#VQ{3e_5>;`1rXq^KEiY23JkmatsS7(
z6KIA(I0c0i*A8{*9nlXfqZ*1G5b{dG{q+KuaK{{ULoZm^S&yo6qA$*|B9t=@@u_d%
zgQHOsafp<l{0-Vd)ta3+v=tIjP6Uy^8WxwTen=E{qw@PN*jsf7ILj+_GFw~da6XRR
z3agrJqxO2Z_~0b4w(TA&%q47I!qm8=aE7k_1w(|4yfJu7`~0u#*jg^39Lh`D3X@-k
z{C9r}CK}CS0>we1N6W{!CaP0|k-4%kGOo>n$|j6m=rn{uWJSVvxe9<=!HcIYK{tY-
zjPK%gOWGOKO#o2i!qnBD(iu_o%gwt`yvuO-?olQGPBP{XXc-W<*WI(6@-P5TfUY+P
z*t(rDM&}=qF!)b^af101bbBCz9?3dR(}burq^@ohH9$Z?^W3?r@@Yo_d{6&aaW93@
z0u=k940#Y5{y}I)j&kmecdiO?qYW#_<9dTSf%yrFs2nu0yi*{X73+OWy$<3SqBvoD
zKPunf^k}gQv9lSYke2opBncpmA3mVaeCs1#vXEnjCHA-zkx5z8%?4Q13xS9+Sf~?k
zXw0vqeY*KpzO#)JF$A^pR>p|cRVk7RRY~9%RKfJfbygvN$x#f)4Pmfe#i<SXDK3rY
z$B<{g3YxFsOZ}GUpSwOa4^|Wb(v2DX1y>P8e_>0FO?*9oz`-E0`x9Z1m_u4C&{Ja_
zwnt~01k|UhcU#e|X)p@xx)Q_29q#AMb6z1n=Ij?k>>0X;?-=$&ct%9{12e1@?67$L
zlcqx4ezxoY5KP{wFE~^`+t_7R{Qr>#p(&HUOAQWM+}W(Uk{rK@(j4vlcKsZ1#T!N7
zBa#)!{*5UYhr4yLa*NV28kU7}1xP^6+IR-AEtYTjos}5|F?8!sJw&Ywq&eGVrg4mB
z`BBJDY<A<%@^RKIM|~UISiY_A;*t_qzszAtsCg?OcK7&w1p-bkA*7AMFht*!5~Wix
zxHxfD7;<NW{pkrSqgvoU3rya3Rl5;SrZOD-Wr$S$t#QnwU;@3NSF!Uo)`{56$R8x4
zn#dZV*00#fy`Y7YBJwc!-dHebfNC;S8vM#rHAf1C_wCUui+H@Iz`<^aCr_A##HF|N
z@I1FeC}nn|F32@rge-{WM>JAZknR<DPYyW5exnO^1oxzBt8XqKgoN-~5!a*Em|HQ*
z9uwbcv`k^d5J3b&8T8B0tNP(=4fN0e<+6Q`k6Raf&8{S*bnmK$_nK!_pzQkR60{vy
zh=bd4nXy<XO}#64Mk_||Hp2oU9BzR07-7}>veu;J&&YQbfM6|*?SqgUVmXaMozQwm
z*Sms;?Qh?vm)}(ws+mnSp+iTjjB|ku$&2*x7Gm-Y@J!n=o3RvDb#ZW}(!oR+O$^;k
zaDZ~YAOhQIOA<2M#orPpOSL(*LzYHp#QJx%yt5c({QX)m2)YvT<{I61>DyX?P`Z_w
z{lTFrQ?fLN<_5uq*7*l&*jkP09Lnf$X!mE*w4A>%>g|8bsx=rR3>m8);F>K-{}h?n
zgE)L!w$D~RK%mp;YdJfECb6iqz0o8U>E=Pep<mk^*$&2Fq`(Ehx^74L5LxcJ{CD&1
zh=5`C-%DUUyg9b8G6g08lc|+u@2h9}+SuhA+&`TSE&IQnjbA`i{@i2PPj{A53UzFh
z@bjY=W6&F4v#cI4VPpdbarf6(w72O+sAa7<ZI#ziU;_qqx&TAF;V4!3^7MM2XXyp)
z;~jg{1`?pBG&)k=l2!G+hv*Drx)MtI;W51f&x6eARLjHm5As>L=%e2iDIf%2$B$)6
zXD`&wLINO|-vmjcZD)I805IRT|F{_+UQQthvDVvKmFC&swmY|r1%1mXoEP=ycXuQ7
zXbYIM&Af9t@xRg+0Vg5G-1bHaRfVJeS&pvCwDpPK!(#t*qtYHX^;A!|N(c9GbQr<1
z8mD{=eP}+Dh=4=&n%JjWJ!v!<01Tt>AoNkV@l>|61P#<f&VEz61dNQkL(|~^I$zU-
z5x)$@tniTRe(MPPm)?CWEFXqJRD$ig3dV<?!$*>Y#r|`qMS~nP+p2)hPtkuz&$Ppq
z2a<YwH^>|WALz)9zRg99&EKwq=b*uOvuM}iT^TYxGUiznN!L;n;%{0Q*LMG9j;+De
z6n4}<tJmAGXHAEkI8ZMYShlj>0pnDvd#XZLzHojTGLz>N+vlft4m`RWQJyf{_HLfV
zUa+pxY7c__%aYJGc0`nB5BH<x!%Tf!AS8kiU}fEM9!%AUFYen6`sSRnRW_xi3%)0?
z07i!sRmv`b=Ok(XQnRSZ%YU~n8eSu+g#d$r+jrC%)s_v&X8ts>O3;6Z(m9XMZFFjO
z{2Zm6?hg%%HRXGZ*lJ)ybglhhQ|J!6Qu3yl4<Qi=If^WFN*tomb=a(dqBjmpun+EM
zKg(=k-CfAhHR%~xZ5OJgOzARqG1D95b?s)dGbaP+{7e%{QypQ24aghK3}0>Denr?8
z>6?<G<0@^toJ6$+6WwFrnlWMtM&$sI^_c}~k0=aI|Gg_uvxPYHTO>^UjS@>oiH3{{
zQ1ho=5Rp-$1BJvy>x!jf+42{AjK|s+*mrO5Y?^i|E7Xe$J%Qriis&CqjD;)-kKT=f
zP~Qu)g4~S`bL%3(_bzlHY2AI#I?V<FkR8S}fnMD~g|xPTgQx1#iLoio*7;h!f)riP
zVGPFu2!n=<gxT&-Bge3-*b`WW!L6`LQy08(IPv}#=I1uko4=U77+LZ@BoGI0wdou(
zB(ol?$)Ig$R^)u~Pl0j!35YK5f4i5_kVNp#oQ8bz)|-{$mpLgF{il|{YC)o6t2Sk9
zf}QoA?;=E*jz+<YKv#TJL%pH9%5=~b#)P=zXSV%;-N~zK%Mg@QV5tmNxgm2Z33ph0
zBH1H4;$5&(3)Y?sZ}P24dldWDAIy&YuU3J|gni2RSJ6E?UAv8JYh7pJI-YE$4B+(c
z-q$G3Uy&#|4Fuu=Z!@G#>6*Dvh~Cs687o_hr`JPl&9@Syr>hSCwLJuPC&UUXBFcMs
z<Hrs-KA$$GOHM{`BV3Tn9TB!?i|n+s_3UCJ;DJS6K{lbVBW(HTTJdh^_Kmw1;C4Y<
zWl)KNFIc+c!GFQN>H$txoz$$`B9xAR5H7vHU0=|PJ^|`E7CuncQ0;l+EoBvz7gz#l
z!IVu93jTO!#<h5}>p(&VmU;=1v@^Khi2rb7&)4h%)|U`!c%uo5vpv*nuXVV&BM0WT
zksPjFqshAzYnp4(l+}ub7=3udUG+CC)8%f~SGPNY)Ey9epUBaDSB5}UmJ+Q(qRO9_
zGy<pmj<yR)(@Ud%xVQZ#A0Ym*64vFqbD6p1CT=k+M)Fr!0K051`sk~!8wky$;R5g4
zN})|@@lq`tff&tnD*<s}VU^_`ZhC92HA$3rK{r?QRWS3{`!xqTD>HqMZRLfjEobVC
zUGQ|SVR1`zr-f{5J!j53D`V3A$UNFQlp*e4N~}$|3oyC@E(QTZVC>Bu%m|2`!B8h3
z>9>5$es2{iulUU6{|*ADBXjyIM7g06f><I@W_GWL8V17^rK1|0)ft6}tz#&9<ZKEd
z$eGXY4|ZeTU-5l*6VQ;qG0^r`v!E&MT;E9l820}|fG>76O*D*7s}pYEcr{S=WCW!c
zAs7XHUk==NYxgoP;fVS4EyIPonv`(M^cfK?rG=I=L*rv|Vk5<==cw?&zAxku!%_Iz
zv&1!_T?I>_pi>AnZmsTP+B0mV$Dr}(Uk@c%^_XqHgAdEk)`ik}*q@rWGvn|Rh?GS7
zPRQ`S{%F-RGp=m2{J+YO^6M(7gE4}u%-|vhlKfNfp0V;id6HfKtAOd2LTm6Yx%P}{
z^YHxy);MhCO>)@{C?p{~ha>`;&Vszy_AxZ`OMJM5Vc$rUh#mmlU9HFP6j|xJ#7Kyd
zI{)yL2qD$g2UI*c`u_HYSX+vO56tY1Kk_fmqb(Gd{YUW22C47q<s)770!AHE-Z>qz
z`dUF7l4!2Sv;S&^@I@0m3O@9(MRlzfjB%B=D*hFove?EIa}&lIakptnYS@Dq+LB(F
z+Hnrg*!`N$HTd^$AIwgy;?7zIF7~TfVp92(_T?;G1FECoi(`W#FkwaVAmCz#Lbk&c
z)wDX9tNXB|<cpub+;edWe{wp3zJNym=cLG`X15biQ+Uyn#s(ELITZEFPKWm52mx>a
z`j+_xc38j}5+7Jxw&|@;2MAR5hUIZC*!8jWUD#en!P($OPWU!pTFqLSX$QSBo}#TW
zA@>dH<3fcFb1H6DQ4_xs0n}&al$A6}PwFVogSBk^00O-wte#g~AJmq?-d1cbkX7Z~
zv#54Mtl|ag9=~1MpWEz;LPHAm2W1G+Nk1Zf(wy+al$RgwWi#sa<AGg^6CibKhMhU(
ztC*iGVx?MD9qbeoxOp?1&TCiH>D!<vf-)L|iUP(WJA8KYvaPz3^J_MF)z&y6cw_C6
zZj<!oc99ba2AZ(k2ytm#bg#A%SG^11O=u`ds?h-OEil5^Z*DhYW130~x+`77M<Cg|
zOS*17@1VpT3SOWEwO-yTvA(ODgYUoW-i<K<s!_kh;vBN>t(U~tSMlcaYatT9sV=Wh
zyCEN*e>eYR&gw)I!yr^rw&1d6!%tu|W3|bKR3<KfwhJn#R4|!Pm{0VNN_YomT+Tt9
z5%~qj(T4IY4BQ|V4dIAID!b@kKMpWSfPx{B{AJp}JWIn8U)y9A_LVH!nY?JpGBt-A
z(dOOmRlrWbnF(cK=XMi2+oW*#{J#o3+yJlx`rZW$q~3RqmyQ!Bwk?<+@0c~B1(2aM
z_&R}`wjn&z@6WXX=y19Ycg+Y|UEN4ApO$B*)u`-TLl*3__FRlJK9oiOsX={6Z87*D
z>i}aJYG{E_?nUnIHG2ll83<y@5r`qeH0y@zD)w|dr0z~UQcI>F4l#;Htc6pMLBb9D
z^RDp3@Q|dJ$<Exm%xk4uF49umCR}G9ji0O5<mLRI8&sNWgV1nVzYrrmT@dDfigtZc
z>0E!Lc(eR=%a9rHSF6cAIzeoqnXaN2Lvnlhy+|nS0OeaMboPWmP$h`fhHXu{6`g$L
z!#<Jr?Fs~cDUV0wf8XNDBK9A*Z*Kp|&5DxCzJW#cr~jH+N9@0?_MZjn|Md<l0zPhs
z|3Fbze-R#&{CaFM7P#8TsU|Ry#xUb?-${yA89UW~4FyT4msbW>{&vHC|Ajh0&~Ulq
zI=#*)^Izw+h$(tvENee?zWx!!_uD-M5_)k$<RoHYPf4w`67=$`ds9*qKhc32j|0zU
z7{NW#w?~O$C0nfray@)7M~ht^Tfw7*4N+Ua#EjClcclfRh>`Hh&`T-D;PfO{9n5%^
zn-!%$=$Wcj_}bLjKU%!+fl?#>@xx|8^ajqKyd>6c5~a;&F=VqeSRL`xR^E7rL|Zn(
zUC}oW6zMm(2oEaJU$J)=>?}gvA6q|9*Ue}nYi4$>^wO7B_JwTj@$OFe;_xz78%yR1
zCfZ)3COsd9KFU!dxC~_T7a)lDy`$oO>1sGP3m8UfI6QtnogFduOnBx{*4@lY5!N}3
z;*+SUR*NpV+R{W3d|R-q3RsbE?2Km*j3sj9UrmX(HHef5qB`AdX{nK03HEdHmc)E4
zF?ciVdwL8Ke6+7vVdY*5i`gEcXOFaf)BC(&D<C?)Y2SWnB^aVda+k@saTY@Mu^Be(
ztF{khkF1Y@H!|aJ`z^Z7lW_UjwSpeZ-y_ywwQW>Dd-im=voSf)$5T~mTPDwsvIT`L
z?fLB<neD&^V=AJMCM!^8$0L$BdHZqJF)3_yquxf#T;@-+G^vBLhr`c3Jg=ofM3%$x
zN!|7lZSv812VvMpx0}hV)Kh=r2_ps9$pNbC)Kr9zR~EwZnh`F!#nXfO=YvTbv6)@f
z%>%_%z<#SN!sl7c#SqIb3yTN-Tibg3G(C`hH@w+B9<HVI*jpvnK!m+Pu;qef^`o=N
z%+&NP&S!<6ZDh(^gq}VxJM`mK-qY07^QBWZd+Z*zk)I5iW3k1`-PF`26-TB%TCGLT
zBsKFlLP1hky2XeTUSmPOndu<G#+=QEItB)h*9?}<a(#|s7iqQL)G19Xu5`@gSft$A
z+DDLtsG4Dn7oLsAPZ1!qmtCM`L~Y@rMds5Z1`hf}PGM^ohl|UnHuisJ0k-+oX(M4<
z6G&ZQ3JlNg)E2C5HJdufRya)9VkagS7M+cBk#`2=X9wJ6E7X|X$sCFNFE}FgXhq!E
zCen<8t|Nk?x07whFF8gTy=$f#FHW&KS>Sgu;HCwq3?A#3#vlCpu+PeHson;gpa$0J
z3KBqkryeG<8$Io;kM%CcJnHI4BY(<$)DBqNJ#u{}%(2S?l}*RIF3TWxh5dwO?)F%=
zj`cp=EUL}6JM}s}Uem##*fGq@2)@1+cpLGr*Em3GJst?#;+EU69ONGAzSO0cn4P_O
znaa%NQr3-x(ua*%s%}YViDu}&O#Ski^FC7@TTQI0kyq+mw6~_z)KkFG?vEt+@Gg=&
zDUH#6q71O&KiGIZpkFs1;XC{lu7mOjEyP^V?}K@t*8|p!e_QfNvGd_ozFk3PH86Mf
z;-i{bUQxB?-#t?hfP=Lbs;0K$LVJlpX!EAsXr3!6DP(qi?Iqz{o6#<qv=(N|adIdz
zGab)MQ`hSS?_0*RSa3NnY^NApZ$|a@{aGZM@3&MD(0AeU1SM_^v~5lU%9)kuIqkV5
zj3Xa9=;0+M3;14~@1HmADOi8#Z%Nq(#Xy5b>x$#f^+B}I)S>^VU0}BJ{%!#F@DPsp
z{6j)r&-MChrFYVsnd1EGeyeHT&{O?5-OEvODYNTru@=~c)>@Ws^4&@9!E&sAot`tb
zGHzTvyLf+nF@fF#?I(q6Pmy8>715(Nx=~u%-5Y%vNX}dJA~$_jZ=+}0^R)sx6RG({
z-nn6<*kHR&Wqn^!P)!w()P<(TsGa(qdgN@4RIJ2ggYmd8IwJUw7XPR_f0R=euEQh+
zlQ&B|{-(AqIa#)osM^TKk2XE}xy#*4VnaD}hM%uL*bkZS7P?nA&-Hm7pGq<{&rkJ7
zOG$v7S|KEJ7H-;o2rp8)uBj$HQp9M&D&%FL0{YBg<mV=o_Hd9~WO$lG#;Dh4A|w>o
zAAUOrWGg4!z)VS#dLa4-B=~}q5L1KfkP}T84`%EJ$P5JZ-5o^VKv!~#PlGXm-ZoIe
z3w(jfPI5<uLnrFE-kUDmBh@xq&Z}GA!7tx{WTSxM&wHA1%vERG^fa^|d~cuLynUE7
zo3E$Ab!WZbu!UCJ7Sgdsb=mU*%Dl9YzrK?BeKu(r7V#aa(U4*=d4!C~c5G_FmC%fq
zv;USNsjEc;U^81$7_ELVbo;&IOFnYvA$&hAv*`QEmM>?%J}W95Lh(x-EL%BCY?_Y%
zYj91qX~Bk+X%c6!Ycj-b4uL9|plxZY>{qY{mBoFt!CQ!D4)Rnr)DRgEZMekvMs8`&
zsP0h1cXq%njoGDcj!}NQsS=GXJQS#tp#p>b*=ex$ZQRpF_=+U>`ts(3J{sL9^T|FU
zsM4B&rLP$wls6vh@wgi<>*hKbCfn(6j`<*QfA)KVd!(Hb_}paP^-1mK_=Dyt((O95
z!{RC?8)kV@aSX}d;`C)R3#;p$N=@wRXxmyNJD;PKdZeIM*9g~l1CfyxJ4YWQAI}3l
zqH}nFfL8}UFK%`VHDNn>$jkGG9W&pyiR<D@xk1W@m8Ypt89q>fU1VkK%#OG2bSR=V
zqX|yf;9m}wAw|{j;|Q~njm3LasdBKD-`ifz^Pn|{y&dweV_ANbFELoJPtq0J=#?R%
zwG**?Y^67Z&l~CuX{t7KI>2+I<%TO1_ILb~9yi|St|mI>0szUg_!&|_Ns;Ya_+7od
zHP+UKxQCA^yY+WxjmX$3D1=>pwBD*D875#h98h6qO~GkgvO9l*tb@V8evIC34Z)Tn
zpsz~HCYffy7Uj3ad<17xw5w=ACV=VNV7a?2d3A_zi|%{aH@IP%cS|anjWPnQerz$J
zng<Xb+P)ku`lp-95*&RV|G~xDS?(y~_c(ba;McWoG209@I7F?Oyn?7g<iPWBemf(h
zGHnx)zer|zc2`gz8EatZku>27La(1zH3#a5cs3N69DojaHSZs`fi?0oIj!~fOIp)`
zZSnf^8pzTY*S2*2$TLaw$eaqUy`QgFNNxPN*uvkqM{1%zRX9O$E`%nfL)7#$p)rDl
zODn}|^pd%Z7Q)y%;vpe0I@hzH{qa#0(WTz?cqQ|cISvjMtftyOQ*lPJWl5V~<`!$j
z6<^Tn9eCi-C-cbH*|hNT&!4LeM^JfTtKa38E6i00G@|6E#e0?=p(-wV&Dm!CjdKq}
zCdz^2o2qd_d^!yeo%xLHSn@N-d32Eb9y<T_GqBjwVmCsuCFcX3@}9I}$i8B?xCjHF
zezO-@HIP?=ov#>pNZI)+u!AMe3H*`|S*l~Tmip2UL|mMzq({xfip%BfOLx5cTd=Y6
z;@GVWDeTPo#B)-C6@H5TIno$T@3Wni?0*`?YF4%X6K{)9pSx~E1zH5-6|yyFw$llI
za0bTAH)r+m?V}H}*%=z6T?Sm>c$?*u<5}4-3hig-<JeWv#oalUsD{OSVZribyH1AJ
zg#c_1<5T68n3>xnbS{AAn@Y=L%&Z(O<%G&=2cbyNTLTp>urz0?@xyeys>opw{*P=a
zq=?nd=5tjA^_vS=+rHc-2!>^M=A&<h=G@#C42PZW6Wd@Zq7DDEqo&g2J<b}5N|=hT
z;E$>39k;Ny<G~`$Z>;kqW1;c&;j=^nod@2Df8-5B!dDm@Z}Cn-`kP>9=m3NmN%R^N
zx;_DVw%K*dW<6Lx5n-)@w3FHL+YN)Ec{Y^LRv_u!C%*mciBr2>jZE*gn5%Q>0&-RL
z7B~*aPX>5|0EY|ERc$o9PnN$ouq)auH$-`W=WnvB&7&v>{hTMiZan6z*=V7-1(Nt<
z{i7YC$7Lk;ZuPp*KJtU6w}Wy%$IMJq6$?nG#Ep?FsZjW(ao2UhmY0K8`-83wCi;Rs
zI-M~vxTQz2+vT0=<A#ByPSXXSDdH06yT4Zth#}KzlkS^0SXuF=O5l;fTmCld2*%i0
z{6}0;RXkijjVARtx5<DQW@~RBDkTIojE`dIZBipIO`^ILg=}BZw)*-rZ5GLMrB|34
zG%}}v@qovEA5DHQx0+IGX;NmQ7Nq`3uXC1ofEF?=BMXg8vQm;b*TCP%S7UbY%h2lo
z?o32qrct0>Cn^1=tx%h+k?QE&_M3keu(E4IUyqins+vNm20mR)X(;pSi#PFpLh&;s
zl$u(CO}x&K-N%K41}~cI2v=4{HX;!lD&BXQQn$8Rv^m2bK_8bdKw}J21N4cR5aD#=
zfbqgZiKjuok8YtEp&a#fqxCeo&lEtIb-p8H?=qh234Yh*EP3={(p6~9<EIhVq1ob@
zt^}h@@Osd)2!K9MzaqV~y1==N!i({8nv#Y90g8%9$`|M{nVk}pq<n5^J$mvVuY>Iu
z+SDB)x=MIGo{GqLlq4FfwypFsx4E>PCt+gfADu5YxKl6<l$MwP{N-o}?1=JAC+?)V
z+O1wc%ENC})}2P>+ZGM1i`6&r;bwe^SYB}^p7T49>h@5=UR=o6&|NCgb3}=o7nlmb
zt(-{)52GSoNp#m+Y`!Txgea>Qn7l^^iU`Oiz~Q0HEJYBorr#_(oJ>kTP*_9W1`rqc
z=q87kSyes!PXwtccGD3}Q@MMUP*?E8+g8h53QZAx@)-Hb0e9u&uJLMwp`ZyJNmFV!
zgvv;&)_$!Jxn%!V)Ndg`byfmgIcqV7{qk6;WgW&pu-0W-5NX+G^|3Aevk7OMDP^v6
zx!vr8fOYu<LcCG`pq`_c8x(6rDh6lgLOws*SJ#qi+(C9$2TXoW#g&^vWlMX@_UhtD
zAenDvz>^?{5|=PvV=9qv;GHd_K?7$24Vn1a9COWFM15Q4?L_Rurv?ts{PE!jVBmFs
z58SlI_pzvA$gYE+_aHf6vFsbZl*E>D=Oj{mU4QH5^F9t>@QYu}_zm@PT-V#;$Sg$d
zQ7;tCev#DzEhYb+PiB%dNB*b%L5nNxMF%K;E5i%LV*>JIQX-Qts%XdZb)7_S$@ouO
zPeqLjLtJ~GsVM~;zAB8e3nX+$*uza-tR*(%>AuR4O|EN$cz6N&vXSBfjiis+k{H01
z3{YaE9bT8vFW}wAu1b<iKFdk7(r0sc)@Ts=i$`4&ZX%T&VQt|-Xutl>8&Jc}hmUnd
zoBK1QbcGCi|N4fW!)M`o9)$DmHkE8>s<dfx4v2!67Vd)m<+Dlxq<!<yS|kj`i4MPV
z%;pspe`(+}l4C1ubwbRenH<?!zLBB0?k>O5@|JsLmSA>)che{2dj2lxkjP%+mW-o^
zc$$>*?dEo*6y}i3w&0rjv5dCPJ!fC7T*u+1$+HGlyUhFJag(4!nUC2rw?$J02h9-8
z+?RnY77I|lBaOVJ^@_B|!j|o%tu}&QU#8dP{c#Pt+SORA7?71|p<(^^7$p)&Et-m+
zfEWL9K>|-8$Kg$?g`;HlhS!_<&EB%9o*C?8{U}E(uyJD{sH@Hr@+#kv7lw!C^BR@L
zDD>#heKxgQTE(Tc5i`JlVm1g0DsHV~CVVrMDh-Dt&1cNq%Yv)SSgl$)Z5ss~pt7Rd
z;q?E8YO`Fc{wpWBgzZDEO9ipqge5u@fIq5N%3z$F7g|7wRT<MiN)C=VL=%^C+%x}4
zL<8ub2*~IkQ#CwtD>c!`jQ;-s&xu|ED8FEKES{wyHcMIPBFV_COl}*rV<{|?cfPWf
zoSlz6QUm7=KF)9x@}wi!){LL`Y-{HO>hXcl%kPa{qz7da1oOlYfX@>W{;VW`uOs3e
zK+;h%>U~qa!8mCXxhjQ7;yVgA_|IZneWx(onRRfH@l}nNpUpJBzlHfb`3^fdn)b@F
z2&xur?{gtIc;}4zcp@GS*V>#3HZQR+H!sg#wf(V@k;aJ}fA+50mS1|Cbw@9D@*B*r
zF$+YoQk3P-W;}Lzg9CW3Z!;w7_;}SP<}?>vs*EHQmtWH8%tJG-m(@7j$U4;ze?2g4
zGuB~&=x)LEw<<ualSFboLY3^S1l?Pm2r+moSG6YI{F-^_N=dRQp|Q^`=I+CdQy`pH
zD#;aCc@aIgRQL<<MXyxKXg7i~^0o5l^&?~WRV$U=VuBW|c%()+-6XFR*1p@2RyVcJ
zqVd*%IP;)0JOK$KEuDn;Nt^wNH2z=ETPsbMn4(I3DvuO+0a5$k@ZIytRyQ!hSFC(X
zQ3YMrGLoJ89trFv3G#oKKjUx8K*X1^dZ#S35Akm%)+4!CboY^|R)_yLw6?yXyqqQx
zDzR8RjwX_I4R(?^$#JV!u;zcFi(e%QxGb}j2v$gURQVb?nE4y<S4PvWwU}ofTv;%F
z@OKF&NB308a%AXu|JYF~7+}6KnnpHStSSnD*HC`&0MX`#=;D+Z{``1aqL2zV_GJm(
z4S=*<HJhX^b$!!0*F9E4m_1%6J8fJM1Dy-n%S>9?TsS#j2E^Wr9h`~XMk@n+a}&kH
zNT#^=nn<jLqyhPPRujCRP8Soskgq?8LDg)dLO}qhrCeB>W{h;Z&QS<IodDmiKjKQ@
z#uEX2qx_Anrx6#<h0{}2MkI<Q=5L$=+*-086EWUq)IMvwS5ZTxFswNT5SkIseIB*k
zbTMuplNU|oDbJj)lU;JMZe>EdM4TTaBv}_q?>)tJ7OLPGhv6f;Dko|(rt^0RS}*fM
zK;24+*A~tuucpNz_n<B#*}BsDAF|X>MQdhrEXW*LeD`W;KVY5lu!q1D#~V>8yc7l1
z#?jz}Xg(J=Z?47p-fz-Y{*fY49<}_}309eFgtcd+u{>UE?BE4r<dYSfq$8IC_Op@x
zEl!0=KQH6H+U^#U{(->WZ2fE3O@8|YLkl+HYRVP$rWND$N>8{kH1gV=V7^n?(_oVW
z1X$zfGGyO7Sj$9LgvUswaY=#%%-d(3>-x3ISGl(~*GElvvP5~Iu!Jcg462#9DG`P0
zh;W3qBROOmO6nOAB;>?GN_Bbg0?CjmAy`t<d;xd44XK+88y_E1BA9kp*UJuY(6z^3
zKJlXy6BA<-W8)X+Cp|}DTAVn1u~$V;k)Q+CGOYWyL`|TCLY<<kMHs7NI?`0J9@Kc5
z1*?|g=^j`*xy?Sh_YuYahq12=itF3HY}_q4jXS|5xVu|$cXxM(;1=AS;BLV^xVuAe
zZQL1t@BQDashRmO-)>iRoxXkVwzJRLYkkfv*cgv_EXbBvnzIZ_h;<R6qlS+|2B1#a
zL9Ph9`9b_Wum3{BO;Tb`Y=F3zL;cC5yT4;|nIbxspCq{g-8gM!@U=8menu^!G7}gR
z1%V4W*=dGdSwwDnkRYmk+_oLg$AfI$AgiR!Y-M<-t5PPlo*l>9a!3AR(v6|Ct(q1m
zua}OlT0+E|GF6JtojgXnSzigVIz}>)czYh%GyZ`>^s>Fi!$&#wa+o@N>Qg$w3Dab$
z9@9+U;i^8<yvTUES}y{0pDQE6vX=^s4P9Es&gq`(o(wmk;UGLaz|9kb*#vH~7p(<v
zQK+s8;ud?Gxgda?mn_yrVEF5Je?Jusu3;gAh$E@TTAC1?R@I4-1lOES++Vr~B;Gx2
zUKiMpVd2?9FxV;|_{+rCuH9nc=*YgKL>dFR%j8&34K3XxG}41ou8qG=7kT{i2$*%>
z$FzrjSRMq{2OAkqXw@@I|JmPJ2v%vLk0_vwzi4QUb!TFL28PkdXqpvIcy&jkpl>7X
z3FU{wltPpSdnnPBI3Pe25|<oYU_ph!!I41%B!axqi=vLDV@2kEZm$WVhlDg>fwzh1
z=!VYr3s(a!b3$w_Mn_!-JXklYsd>m#mK~oeiz@M}HPE+a)_a~-|Lm{+!CWQz4hzT@
z+H|ryp&`HZlxwl$<k|8m7aHSGqq6wJ6lb9F+R<yl&NMk0-4HnRVT{35`c97<z(#aN
z7#@jK5lK-^;dZ^$WLH)540ml)OIAIKTpWGkTrYC^3%MmXyJ-=FiQ8lXpMwJ&fQM2=
z6%W+CTCj%uUP{?<Wm&hDw(UCRdy-Q}YI4x+Vc$2`z+lHaD9Z5ryu#ZR4{8soYhwYp
zpXvWi)1^ZCIXOOTAUsKEJe&pVI(c~S@i`%u6XsO=cVt~=y?c?!SfBB)EwZ<7m0t+B
zxCD6C3SWoklg-7}hH1BITysoK2A|saS}ObNoY82oNtMyLC*fdp*zU0Z(0#|ci8SL&
z_8edEez)H#opj-A?A%!E=L(pjR{m=GVzNLy4e8CeJnzIw<8ud!PICg@T2q;}p-E|1
zcCxCNrO=3iXbctjak-P`CyY9ISP1iA9_CJJwxGOT^%Km~2`A{GbkJiaz}F>{b)Q05
zH}haV&^_s0xQ`ko1;l7%`Z6}IbfgAWCfBdTRugh9p5=^}(fb1J2b_4KGYdGwz#SZ$
z-pc5caP5bt5QapAg+z)vttjUpS#fWmm~($9aP)yYkP6Woa+9Qhkm6ft8##nTF}Y?C
znTVa5g>FO0P{p)-LNYod?i16#LrV9y&4(aMNsW$UoZ1#23h%8nkTr~}CFP<yd$zh;
z;=DPfmZm9Y=z>4Kv`384ihI=ndLa2OMheI)G)5AUi+^#}KfVoWM}ckU>P7^<p^T@Y
zt-NN6ji?SXJtUld@#`vl?*1-tzWKg@z7PLw8eIB*wTJ%9czJZ!=P!oQpoh!lKed={
z&A&Bkb<!;SRjLiN%{k?!T-~0dp4IqpYEIU6f!)>NE<T0r_G;X}8cJqsyV&)`(m}}G
z|7|OSrkY3Zh-ZJTNcv?W9Vd$zBi}B)gjaPuqT%{lk@_IJ5Ilg@Xo$=0imusMzy5G5
zqhjd~rZvO@)ke6ume9_z1kOCCBlsjP9uyR|5iwp*nmQF{df5o%5GGw<dLRDq<y#0+
zW=~_zP^i4f4hhM<IY~<^81>iy&gt71sy?va2^k4wr!rG9s8B-9*I8+*laPqyzYFKr
zvn(%yUoXW9!E=Qhr!5U8OFD|>@&BHjgo+oUb=hshjw8uv*2RkQ?Es7e`FthEMul1>
zoO~q`5=Htz)LN7M#Xz9n57MzRxQ>AqC`Iw7QEL}2NXMH)fZdS2uKE0u0joNA4_^S(
z*Y8F5X|=&v?(gO9cZ}Gn!^qFm8Z+_uv$OMwuJ%;5*?j`|r)&EgyC2dOP6S?7u0t*D
zkbuV;^1&(78;GucaHnp$3bSOj3}a-hL43N^Ynh!;0iLdBGr<-C27Knx=%prH2o*Dp
z?sbJ~eTvyyUQ#%?q<y%6p(QBG)5*{p2*AgS29}XL4WJfG525>Z;SE*5P2Li2a2;iR
zYjyd4Mr^|UR%Z1(T@~3b2aAPP9_VI4d?vyX+Hnz#Sc_^gZ%5879VC5E+usmfc`MKO
zv3!w^RU&uuvn7i?Q`d!T%Z^#KR1yy`v6jhSXDzM>?Ch2wA0hwgcXCw_1+q!#gEQ@}
z#Ft}w;}du)RxNS{Wr3swiWi+K1iSB*)c8p)qncd9zN~1L*vQ3SY)W5tWS+;Xls+H8
z0X$vro6=<rz;$#O4$1GF>YNA-Dz+@McmeTf_7)QJAB-GtF;mH|TZ!cOE23foB`*-N
zrcRwAhBjk2w15D^bI<ZD7DrONo}>lAUZn|>3<FBzBFn=WvMk3{@-$%_dnCCE8UR;X
z%UX?))LNdGLjbX`B$~W^UIyC?xgcr}PPut)BYClT<UgrT5N{%fAl;PR{(i@@4KCWb
z|EQ%IQ8Ws@fFWQ1!GY*rup9u8&u?h~kKxIn%x%wb{&}5ubLVWPNCz%BSez!?L%SR-
zatAAeGLhrsZ?NzNCOnh=SK9RL_gxyhWNO#r4`bD~NG|8Kbrj^u*RHMjl;5^gV-%lh
z5C3pQepG!$c=Gr=*AedYxS*m@Av5RfBG&nsba1O^M}zBLu%E={1&84bZXraaLvJ)p
zR3eUdm;G+TFEj^BXlPX0GQiQg)zk#JmW2kaX%aZoOqT3pqv`scQBKSV*f%BCygTvp
zUOPM^CPBKveH1&|FQMOWLM=FU{dv~-6VI{5ktcVYqwh{kdy>t)zUI>*S-&ZheS_$e
ze>ZuvUbT#1;Q|g8^|M_eFK)@u5e%Hr4jlbdr}R*rIU7YwH$2D(k>J-|eXB3j(N%q!
z0}`hQ<spfzT!)jps@$m@Y9E$4jV9JBw<?Oz&}Cs%kO+0cvV;_F!4-o8FdStc2}C3I
zRr<*Z--K=WgHJhS3ZKS(*z0D3>FIwDK=idt=`3qq`e<fgQ-M=YegQB{XA_U%QSE}J
zCIt>ZrQ8!6Fb{?deje@_dAiIz9t9|;-O$1dcKF~x2f+f^ZnAK<!Pn_lM8pPr_jpT=
zf)N9h%sRx<!FxhIGzn{h{4iw--@{E(>Jno#9gcl~!{Vy&fS$&qG6;GBS1HKt*_HOV
zW~V#Gq4Md0LkxONmFFXDhPMn>ZzEBu>a^HBohIUj_Y3w4dG{&XV{T8?bpq$nqG8&N
z8n&s~`q@yg82gxkwnKeQwMhs-h3~Jy`R2$XB{IDoBcBzqo?`VsZ&mRPl#F`E<(=8}
zP7V~&oIKrEzDML+^$NqeANQ3SOOF^wOZ=nkv68Dsw(0q^4YFL<ad1?W4*l(OW5r<K
zNdO)^5a0BvEOiV4(lYz*SE-nQJf3bW`9;S2<f1J^9nG5$3bxCvKUCqvYZfo!^+FPl
zjX@{lQrlqkhCthqO(T~SOJyl27605>K*GO0NW^keNSeqj!xIjQ54T!Fw%bH|(~kL2
z-D(PaVuLYbaxGqfRjV&361-<FI$K!vQ-_Pq05>2xwMbRcO2~_W?Q`^2umQ1lrb6Yo
zMKsV4(<7PNH^Yd-ZbB%ow6wXVYuM{*Zm+}9WMfn3DL~85@1;xFC7ZkPc@1Z%Vfd<<
zDL3l3M_ZOrSL@;7-NNH>&5^K@W_L$f5qM5jX8XKD`JL@KM3PA=e0>rS1^EV%iSTV}
zBi)7B>zpiKYq<i-_bC3o>rX_d;sYI!HVLySISg}jb~W{982j0i{nklV!+p-5wqg8o
z@?*(UZyejuG>^WVDTyX}T=gCoG*Usi#yr&DvC+;GF~zI*(Llu%NVEXKId{dAQ5QlX
zPM|;y>diowFz18my7fg0tBbJ@CkB3@dXm$ik=HTf`!)&&p{#+R?++dL034mOBD($^
z)wjqtBR8<DRdi?g2_E&ApSk&L0hkwGWZ>WkMw+7p2MtLM%T?N}MCH|OBpFJN4+U2n
zY*#fL^x)fO8x3E4i*R2#_vqTpm9`>4JBlum*GSBI)?|r`32C%u*nMRJr{^}Trk0vC
z-+8O(U{0Zsj46mn*|p{Ar&0%gp*;Q7nY}QTTf>UcH&odARQJ){Qrx-SNfi0P@R3A`
zp%hT^p`Hk_Q6wcVul7Tf6$SJ4UfXYBYSJTL$tY5Osrysu>za)Wpi+cEL@z!JXV<l$
zmxR<Ug3`sy{k?Jd{yqmEo|YjUBih~Fk<#UX|L=(*&7k6RjgjR%QG)Dbe0(=8N;c80
zovyEc^IC8}SJpU>4getBrU=JCesv8cGSChM1M6w35=+Z`(%<l~{{7|VZ@p7b2dLP2
zuA5nPG)DcmzGY6asTd6=Sf6H&1U&UpYqVl+T<W(QR!sknMp=+$fZOP3FSz^>8GSCw
z9><iVj@R>ODl^n`Q(S!vSz@yW(CpVZT|=*Da>UyGOaMcZcEF9%fN(tjn-#y2k>nB&
zu6)t(+~2bOY%~PH)t8whNUsZ>bA>RF*|zkB9RC9cf2tvOv?;@(Wr+(s_U_(-M*gsq
zOUekGr6HG&*OFOgtl)$fv7YyTumC0*W|ZI2s4$ejtjEAzghZk@QEh)6U!y;Gl|D}|
zEfWAa4xjqoQ`iDU5wK80y=KwH1Z6agg2{_dtOpL-rit$>uVMtB=o%I(I3G-WIsZz~
z%+^$@?_9LoJ8gohKC<YGsrhbq)_6+&?q((hUa{Y_*9}jsAH0efe0_DT<RmhB0{5Vy
zty+67^a4=Pxc0kj<_0&qFDIBF20wf`8LdV;RM*sh(5?H8?8TaI#kt5o8%?S~VY5j-
zXnT2pR-@tOmhAQKHWRziX??uqy!ZB-lf83Ri_Qw5Xma***cqlK(HOgUTa#I}I^Cwc
ztq&GAaVV-jUnETTgf-^PRs;f6fpvx7125Mx`}>u3E>Q*WsZuG$nwAmCI*Fo*kqk-X
z5uKHr<S_Mnwa7)=W&K!LofOpIv>;`XKqw68beR377+W0{_s-prCzM&pl@gl1MAN)N
zrn!;`eK{K*4@WpHMFiJ2LPK}`+Z+OqMTL~jmU+BKR^)|jloFygDP>k!HBvhA6*F3f
zyfIs_7A(!oe5EmOR+8MCbVjWbV#egXcTARmu$cX<6>5JG0`oU9)2WdR2mcIQvXtb2
z*2Dlq$c{Aqk1!j4T{<uzOERs1;Eqt520uTvN^Ct_(et;tkUOL8xlcxWsS`sj9oT{&
zKY?=ZVsxr%_+MBD2OyhI1s8GIF7y#Fi_6iz`3KN`#3?KE4P85$3yOJJ2BTgJu-~dy
zJus8d;+nz7a2QTrftd3~Td#3OpC1AIHrrUB(TYbz*@wf{TMa8W3i?ZvWpL(qi>7-5
z{F((csnb8Q=>8bNxhBtDgA|vA#h4DqMus$fgqk$FX=YUUs_qO%<qjZHPWyt0L*qgr
z&kV<)W`d!6AIOoJc{*W#ppq4rD};N3$HDg;-(UpqK-R9QQjP&Au*C`p=5+gy-KOhe
zWFD`>_uorNs>p|C+*`M2af>PH;3ePFbI%`gI11mU{51Us<^t?;9$dhcffkNKQ?4FF
zF<}cX_W;OJ!vsCg{e$2&nR-vb%hwYQp^2&Fp(0R0RQ0fKSK-<;I+1Bk^{SMTR=r0V
z^L0#$wZL5Us<qqc##yqV><LGz+dc#UbgNN2yM(Xm#UK(;QN2dJ)h>Ko=9x|vbG=6|
z@RRuvrKaXng+*QPKCE-!6#DH7b-Ny%{3UtJgj|B0KBm5YFgHau4S2iPlA-z%(!BRJ
z{9DzJgX7~13c!@Ap2OUGv%6@cRNv&XOR%%uOW-DC(}&vB`gbMsT!C}(kCWF6ARR!G
zPt&RVq>yO@G<r)r(hz;9z_6Zybu}Pki)B&oMhROW<m^4h9al_)PFd6~@p1ng>&r)p
z=<f6_nZb+t_%JHAW_fHxS}T~Pd57%|4B{GoH%s^Ow+{)%RPKtdPuDowoAmb-U_#>{
zH<O5|Svq}dtAs4UWSCBK76#~$`W|GMp}rncSax+Wj%X7XrTw@EZ}*j@Gy;gs!b<w>
zvJpLQV75>CXk#aZ%5GKWDKm)H@@5iy?|vFgWI4Wju*e2L%|)DoWY}-!l%d-=j+k1F
z)BqBr<Q}Vpi8^ea>2W+eXG|<YPxAWm;m7V&Y{nwT|1)2V?GF5Rw5e_r+nqr+AKB=&
z+Zb0j**%>lP!s|h_2kkfAG{}!Bp{2txQT2*?K91X@X2(dEpv<|S@a4Di`Q0DOt+Y6
z-BFUOhDRtD>1)>XRcSwbU$4B^<>xnt9v{(H!26}ydV5|ffIpO+z4bmaKxKYewsCMY
z?>sr=8f@j4c|V9UC+Hq~({b}a3c#$(jm0CSdp+A<p)Ijg!g(0>Ha7FA)nAe5ReqZ-
z(4Bh7jc>RLF5T3BLWM}uS#J4<2*EGA(ni0Xe2PT@m}<UvY`-)R=Ucz>uBxp(Ax#s^
zY_4lEq>%2~-A(xGPvmCZcEU&Ji?2>6W99!us0v;gOMP*?=L6kf0L$^uOR5DDj}^*d
z>+|B{`BI9tCz8BGtZYnqU$P=f-Q%8h2`9dj_nf{D*3=AY`Z3{#MVppVfFND|6HMsQ
zCplyWdZ6?NGZAVVa{qEH0U&Z#gT$&cURUijEHNcbu5j6{rJ=<YJm6Z!=vhk4JTsYS
z|KZx^5M<LX6_9>#i5+WG*~zK+C;vcRc8vxRLQqsQ5$C2VUe7~JNR+cK!38+hn2V?-
zJjbB&f?zqyLQ9|crk3^B-M=qnV-PylKo}=L!m=a2yaT{E8!a$^%*cFZNwP4DJ7koC
z+LUvPGu&8#r{r`OJ|Md@&C}>g4xA0OB~nsdE5!a;A<(Garwa0`W6PS!!EU&w6IJ~g
z*ho0VBxu>_U{dAa*<M+=*YvroBS@A2d1KWP3^CIWF(U@RYkgtFO8yp5nN%5LQnNR8
zyu1jpEFYkuBGcx;>Yrr3_F&xa4IZE&KbC0en2v<y&2<-{N7_1N*3LJAHHj?^d~XiW
za%Q*p|7Nxuk%vum?{kerg#2rqcB}hqi<i=;Q!(-7bYZeMEB64=l|H*6I$^O$^9}hj
z+v-t_j42*dPkq3~zjgBFA2eV%8JSYzqR(*;rhp8fe#iBG6oMa3_p6X&U!?Q*f%ukO
z*es5Oyw=w(#xI*XDq5<;W;o0gQQ1rsS9&Pm;hM~Yw0a%4gJ$1D6G89?-Fo4^M>bbu
zD32X1X<!E93|rm(8V%a2<@&gPq9v8_@+?o$sjP+hJvJYjzy{KkJI*4KrjS+b%kn5F
zE@dUh{W&aFY3VP`0%ju%1xolqhVohvI5G1c`_IX{n$RWn3ME+_-9V2ibb8Wk!1U~T
z<j)t`&>-;9kn=m~in#VjT=TJJ|Ag1`mZwsL>KXTsM7*RB`L$jm;v9Rw9Zinc2?C4;
zx(MzfeW_7o%}NMX6}yy`-A<=L|Gi}i`wFDoVYT!p8@E?MHzWJBo8!Q{gIxDHc+>oc
zdG~{-k#*hR^d0nGfDc^E7RhRz$0l1_qR5PVodxWg8>f`6h^L?=CNhJ>Qv1rZ6hLr{
zUQ|QEfSy~X(1X@r(0~WocvS&fwy_q~A;=<l=U2My&nXkpjLuvmJj2M4MmFFkY>~5{
z#F=IvI}RU7>nyk!;dBs1d~y+6(VFxW)bP3HbxhBsCS?_raizvlKjh{hGz8OZmaflP
zjge9@=^OX1s>(0L{N00)51G|Jp;>YA$)Z1@mjZze!gFn^du|2Ze=o!5eT59QRJXr=
zese}eQ1Xh-_HTP7t2YAD>Wh%vUls<z6}ek0%0l66gqE`x@Y0NMcuWpH4XRo-Ct|Ch
zbajd%tL|enP#Efvwuq2Yg1n4eIlt<^eiSOOi_38lBBYgj<Mni+TBKEtu(2`#J_JXL
zrRq68@=e$--3sQb9hXjOo5P;jA1f${(8x>zyf5t9=vMn#RUI{7ABfaV|5?7z|LY+N
zp!M;y)a@u&!u-6|R!<?xZL$n`p>N%0>+8Xxi|Ab~4fNSyf`3XiwI7$O3N+v3g$L<5
zKsCcUtqH6q1*_4Yx814jVl~LAy#l6@PKlLV&Z68@BOD6<&w7ga!l4-?6}a{P{q*09
z$S|l=Nb!x-xkjPJ@>n}^&h{WnUgPb&?p~B9vQO$kRuk2=R(LIU7aJ6J@rAz=nf4aF
z-#Rr)oWsI?<p|vYKUcp|&(8m<vJPu;AI*Lp1-w*o-W_tutmr)Dn_PN2SW3A3$--U#
z6^U=|MaK4TWI2(X_6Kyz-@ExBXpzg|u;S$wy!I5M1z8t&OVW}Ed1KH6OEjoCA8jwT
zg@3TxGd%vMNdwq&6W&~~{gDYI8jA5SFXF8-L9Oj-%K|%I<n=d^kEL3B+~3E*&caC)
z<1G%H3%@EDjT(K3gPMV^g#`hWM}1mKo3kag9E!^7L)PUMl`_AY^jNQ{fiA|H&;?ya
z?=CoA5p)nxuJ2HXvD-0tptof2Y2lBb@q{Ag*9`uXY?JXLyFbB>IQF}zNYDdgNL(B*
zPv?~l(Xo}%g^84vf9JT4xa+c?mno!TA!AH^V}x(nzp_!#yR-tG!^ob9v2vgs#ZCc9
znVF)t1?M<)=^-*a4n@;pZg}>hkAe^`Zo|w{QuW*xNeZqgvS|SkeADYtM!2z;!$JD-
z%7%gG_r{<*QJwV=82@2Yq2G;t<1oyXn5|Cun}JW62_yO|wWs8CzY(JJ2Z!(xOy~uQ
zB{`#$z#gysJzSBIQ`S!iHQVk@@ds6#XB3m@!xHlMW*QK4?ZpO>s2mBzU4Ntn{MtQT
zwWsLP53|Md2s1Y8w*C_)_qICO5VByIo$umq6ny&U_n=cu3KY#<PfDxr5rk~_$$pkV
z40CSbxVYxGTJzTY!*{uD=jzn0R-s*kInb+>iTw#<zw~Rv9bL<k^J9lZXSdHi3;SW&
zr2Jr0`SyAqs&a_2^>%;MNP4+&m5fNy(=ZKy3cCUmA6LqW+yHhDn=Gf!rG3wJE(ojN
z3yj9YmVzaOvIzFDInA3x8hN*^=?}WCg@z+ogL)w_P7cWf3L-c`!Pt!Y{=BDzHzdTk
z&w*}s_x(~)O+TF<?a^j8nNcl^k>3LXZU51dY&3|;7BS`M>PjnVv2nrE_?nG(VM4lu
z{Hc)|nb9{enQ^ak*x`fpZ+Oe?t1ZSk2aBl#4kw21l)(-XwS%wo`bF3rP*JePx*NQp
z5ETisRcDQZS^K#u_z=48ci7TQQ;WtR;c`Lj`&xj`(yBmfW3MwrLSp!6SbVYw_wR(m
z_lbW$D#N|)yX$`*)vV%nu4%mvgkpH8K)zsQPFh{dt5*?xQ&1s*^!fq*shou%b?DCO
zH0|(?J&zYoOn5Fs!(9OOgLM40xA|HwnOxy==s2u7(qE0V>`R?$d!QTf4c~aUVCEgC
zs(FIY-VZK?9v6&azSE`)PAoJny4+wQ1~5nv9Y0~Dp}(;+1Ay%`I9Z{$0{mmpu*X*Y
zp6;y?K6J+8#=SCf;Ff7T2CB2^(7xZgyN+h-kHs939>$mv$tK>Lo^=ke@5D}2bLB9Q
zKA7~FJkiRJ47!62O>)><+t7}MTiMZi<t7FQQ<I7{|HqH)#XOxirAHO!?{01|wMtE(
zy5oc%8;q<eat%5y<62hW@qO3gHrQ3;RjY?tXMBx=I$_|ULG>Qf&=?Rfz@p_M`%6Z1
zE#;gu0S=LZPV5+$#4S7C(=!-X<~59Eq91oku)rM}>{kLM1JiJ^;9LTb{U@^>)8&d(
z1&yWTC(&I#X5XZHs4~*ri}Pg7Z$z;@vrP2rRX|^B0+#VI)&?$zJK)zi)_1iV#|Ze=
zM0x^A#l?8HDQDZ&FR@^vNm*#Si%ZIGz+P8e!SxKZPmEQDw`BN}Djh@jD<1s<766g_
zOf1IRx=%SN>x<D6f+iFI(AmLODg2vWVs&CMMD=|4VlqZg>Fw~}k$=7>DQlljqCi@?
zy`=-Dxu*L4W_3j)MaxwEhy%Rvcb+kmPgXCW0L@yU_Zng019uu}N<sL;fGL^N6CmR+
zoP`Epn_xP{MYIF6r6`Cao*?R9%_B!6V(j%Z-4Z$0-nlTy(h5Z%s<;lD@vtS<dJ#ei
zHx1_wD9((xD4(S}U=-iVs6V;Zd?dLU)x`4R(Zi3c-pn%%pQuqEadK={Oep4!l*<zo
zV>e>_NS1J7*oGh|qnZNE&Cn3Uy@f1&j-d^zN0IFGK-o-H`ek!=p^J4gR}%P*g~DR!
z^jre#tf|ID=myx2OH&iBIGQ&ic8u$Ikv-u>@<ROJ!ah(M_&`T=S*#F(J&HD2VV9eI
zOUD3IZg|FfkxaqXT0mTDp+*N*Y4Qdhb+Hg2K!S(Y7v;hRf<R1~t?QZaWB=>6rrOIQ
zz1k2vhT_3GDi`ve7x6p<AhQ1IMY>WlzM^CyI~c9W`ReZ%Uhm4$%$=Q7M|~bn)_{P&
z7L^*`CGa2#e(bKG9sPv>S4klO!RoziDkBf%J*fD&QMu9ed;cI=o>v3ciatVS29t=g
z)=X^1PxssRiCyr+6qJ6M#Y<WY+Ne(q1Fr}MQ|O3n&Y%8Hp50UbjWez0m%b(A^E)`=
zWG|nygA@R;8~LeGG-nyDAFiw!1!d5)<~%cwzK!OOh~O{il1@r5>5b`$Qi(_(W)wul
z?i+DqX3Fg}z$&TH{zYo_Tx_3Ct*ra^s{J1&JFM74N<%>ehX8|tC(%l+P~T8^pLXFm
z6H`K|7dHu??8dG5$&=!jCdSz|m!X4HM@M?X7Z~A~-?=Y14{F=*E%D{9Y+6!|rY-79
zWG~;M&fH#*ET{BEdK(Z@cwyoodAk9Jr#41O_fssMbPx&<qpXT$DfTKlWAO5h445Y?
z`1Je?l%~N*MyrShFWhqkQG-rU->iHUs<$voc0(Kv6ttuwx^NxY7nK*?{z6Zh+-e%_
zdi7cuXl)MOdnKRwr%th|F41Yl8o$XJo$%L@=U#))c;yij0miWhcv<(Bejd5aePvHG
zlMSF6Z4MU)%iCQs^?^t5#b)p5E+&maK?ey;ZsC5GP|lXWil$%k8YOYnXZL|pqo|4=
z!qEcKw6wiXO!VS)oq9bN4<SaZ08UpE-prX>fsj|_BW;$d9}W=O2;Tgdk+l13YMv72
zN*!037M~52u-Z<MKY<UAI%JA8WJolUEtp4xO+IxzmM_$&38Y!e(iO3SWs=I%YVwn_
zDP&M!JZfYk5Gb+|8t|K2K~4aSGOi{euRhV+Z@W``lB2;=A?+|mR$nFfJ3$kOIJ33)
zR4UI#y9Sl8gL_2VHc%QIw^o4-{=4dAdTG(k=5^aVqVj{<4+gXF)KY$04}qltp;YvA
zmyfQ(FakC&nC8;kb9g_07^(t!S+Eaj1EnjqLbkX(T>C2^=;D#^Lu!bE;-fF!09`m5
zhyH96wLXMeItv54nsCvy;!RNggi@~H8a;q<iwIMDlD79np8^RU6pS2UwCOe?ALTj@
zAg-W+wFPn>IFq^2elB2oJ(0R7ck!8k%#SMsEg1D8NEhBcSNcR9?>&2_iR=B1z&vti
z2K)iBN7#M+1-Bma>~G>M@%AR}RtMsiY^7$fECgkA|2hZg?89M}e7GU&o`OzomEDBK
zxy!>J8Jd&qo~cVlECH5CzX*e78PU`c864`+I<<MX;A(;dL$z-N+xW6?UH$56O_B{F
zz}=oMBl4A+?wMc^gWnJKYw(CsA_vsX<$(XzZhr>3f~EFx?E*f;2HFklHD*o!=xxO~
z<@u4i)(Z<>(!8+oi1g%1IV$<?k{q?;;Id)b7C5UpS-EVNei@fW?72BJCw{iBV;L&o
zR>)#%_e=>V`IFh47=+_D8q~#g0St$lOsfa96?9-Fd1FQqYRvF7ArJzQ_>rwAX%`a6
za)d@#lci?)8Nb@rNxvmibd$)fRKTe5!?egOx1z0pYu)#>I;<Zk>-HwxpTqMdiV;Yy
zC6jf@XVjB*O<qW<r$nQh-JT=W5G)YMS-&#%ARKp-h&ZrmjX3<<J)0uW?*HYU!P8(C
zy<jc*x!9B1nt!`i1;+l?(Y<E(dKt{0OUg;Oz>h8{$3|K!_Hs2<b>*iYJxvJPK?#Nk
z2RAFAEDnpws@EPI%*WQ|fvlkrJ}OCUOPIq*LEF6irHBD(2}2uC_;c0hTrNp^7ddg*
zQ?I0Yj@)0PjkLgD`_jg2T1A=U^UULv&;r8yEYJderWUu~!Gd!8o_OYprY4v{>Q8j0
zI+{|2<TMbdmiO``KmgdUG|gYQ@5FnT^cd!gqg<}-@!DX5k_t13Iel(tUkSN|%L<x}
z=7srNzyZoXTX~4g?M|ic&+}EZ@Mh!fWR%?0=;l~^%~~<1$A8`}kZ*kYoN@{oQsk{i
z(JAwK^y1U9|GJZHF&(o0E99Ii<Hsi-EIkS<zo-ir;59qQ6=iP)c6?p`jq$Lc_WTR9
zXn`+y^M$Y-htH?*4ZgDH$~EC?6Ii|Dq*mQ<2)+NFC|50nzkW|fna3wQfg4guaNQCB
zdj(z{JIu|?iMC3|%Z+{b70h5v%qB~X)%Tj&oj<FF8#jsZx78WGIDb$tbfuR5n-+M0
zWB<*=_AHjoB;<+yM9<L<WD=&(8uU$0zzfB?05%1w@H*aO%I*9d(^iDt1ctf;`E3Ox
z<?B7Rd=doY44%&-jPE+gyKA;N<=d~`H<aEQSjMinLQ_C36(&$`pnu2X*uj=-ie>8a
zjH*#XX_noD8XYk$5^Qq$kr``vrL|bc4H=&E6$KfBm>A;)zU~R__Cd%98UPt41XKA+
zxE5LYqJ<>RAKmh7FsAI|)_C85Mqz7;wu<su!x`J)G$s0(+Rh&M6*n<f2uabirBoJG
zRhtn`JRuH`eg1dP*GG(;vlv{S)8cEjmnL=?nu3Skb*RGCom?{1z=ItJC^srW6`XIf
z8Xq!E=HVRMb2&#lk+xz^T8bB{be;yGSEms|(64vEda-}!HSPBLN9#E3<Yo=i_tA{4
z_=3vbx9>Zu0p?pZe)K5Y%+=@nvf@K6w6~I2F68Fw_b=QOSk}2U&cw4bEH->megxAS
zO&Ly-jF8}4_<<|E7RAxD-W`#6D>bSnEnD`I-tTw=A2Ed!JC1}rmFL1u{Q|7SV$?_j
zQE?D}iC*leS{fuPTnVwlpoFxZ!8!~`JHklVWKkt_$p=lHVICZ8kvD#yG=M!03cMIE
zCjlqHK$H=4sCHTqhhXITMnMk~iDAg6e4L_vkP9=P%t!$VTo)3XkR+$IAt~2DGPx<h
zAmY-(ZrjK9uaoUx`15!gNL4CbP2poh67>Lgg}&9z=GW-7vHng3%X%2Rkx|V)Cp;89
zqFa#YGylMnPe+O)#;~W$30&#(hb3086S1HvMUSA8ZFFcit74=Plr{V@3@Qb22MQv*
z$HhtHErj|-LRk)VGADX)|BU*(Xz^m)I)0eKaOOtc2k<ps>*cVvov9~!szu01YFQ`X
zk;NoOLTS&3(~dzLZQK9cexOK_7Xm<1ecxDJAr!+1{Y-33GzrIaWH{ZQ6?TJ>PmpIT
z8<pIQ#AP3rKtPf+hysdnAO%F}8P}a4oV{RuR1K|`0k&0*PqAZ3fgY#yygWD)NGV%_
z7v6C8uEXVVS5j}}3SCt}OPOeVf>V3H=+y^xQ~gX|lPjSqnx;MKmD!)l6WsBrJQ~ln
zw$Q(xKEN|-VMK{w9<c!IAPr`kSmOi9pzfL6`Jss|&JDHa<FCJ}@z(aOxEw0R^S(Oi
zmBr#;BO+__6pGXeWV{r%2?TZKlSJ<2g$#ZLsV}~TL7K*V((;h(0gUJ{^-X=-Ni{WR
z5*l?^s-V{BKEV?_7{}DHm!e$3GcAE&J%$$g#7G||+;~+<PNwbusgca};raY6N%edP
z;wpP6Hl3b^2tRaU70iv#5D~Ki&AY`CvGsf~H?s4DKW*y9QKUM#6QuwRpkeyLHSYMj
zsjyrNCwpqCbHs*0_{GQ{tDGABzj&lMcQR3-nEL-09x2G(xFA#>!kK-a-gOsNeKrZ~
z|A9LSIr}vOtIy#8$=g&%uP`QOkk$JoEz_h^U2XD9%AAKm_BNu)!J_8bH?lFv7+M#|
zj^KG3QFv6b)LCU#mYC_^!U`q~6oyC+;4C*)XWx=}U`oFpA^Sl#c<(K9cQn+nTd@#&
z7{PwwAPelvgDHf8Kt)2-f=xyp`#b>K5OTh{X8lx)?@JD>Yt5enSN=%8z$>W72e4J@
zu2vTc^}<aC9OArkmGJwz*Tz`Y%{G%fr0kaoNwG)A5I?!0Up?uzIsh(-gsKC!FFafw
z&gT+wc<)I{wqm>q`;va3`U7M*wnZH~+3L(`^ALwdY0rhbs_<PVn5QA?GHusj9Ce?Q
z7rT_?gJ-oYcr{m`3ArdOvhvAX8QQ)tUSjGcrR*G1BOb-@Uo0bk%9j<>t6jTtseFz_
z=Oix))2ME%R(co|fA)NEFhgXz$yO>=Bq||tdL6CZFQSpA^cZFqa_A{4gy5o7|JGE#
zAi<4Rvg!m@%8u0=?fbNU(bQZ_$oj{KwCUB_?lp%=bsc$;GngEhI*<z+p~Rm^pVv+r
zWbh-@;M?l^D}E)sWr(@8H`G91y~aM71A^eF9=2Vv1O&q2s!%Ztv2az`%%DoQwAXvN
zd}3#Iy?@2D$rm_Sb)lY%zuKFxNz}jfNn)B>6`2VxkL2>|U7nI_31fOv6sEbPL2vdx
zdq)%pYxsuZ_+F3JWc|{30oQQ1%k;GHft8@ks`!`b<o{oAnnnFXt^y80x?n+D`w9|h
zh=DKjru_wMR=LU}rC)4ms6$0H`|7bU{;Xu|vk^j)jRH7`YJbs)SZtdIv|(U2ZpsYS
zeZ;3*7?%n641Vb$(4&Jl35J2uhZr}#d#*~v5TUy|o2f*eazzrl$Hxz<b@b>KFyh#m
z@IUb_v4#~=M_xCv$<`^|*LZd1A@nBz?Q?2}PttEs=AF=e)n$bQ&`90aWN9>;a<oDm
z7b6Kp6$HUFPO~ocL@Zh<G8JGjy#>b=o)qf{*CB0rN?B}W3`(zsv6<F=8RYHr*%3Ya
z@X&5N!ewi1V03`9_X%bL157%36#Jd$5rgH94}x>7^P|Sa4DYU8?P@Qq&4cxXa0m?k
zI=nhtb4dT8de<T{)|f0}q3;2)CAyTF20mt)^qF$HqM<P@dbPS^uPU!Bb@|^AnNsI(
zLT2BjJ!Xz<{~Y}oLE}`5W(sosQRAXkU_#fB21OHtw@5p`$XhGy;Vvq(J-nAfP$Q<v
zwTl~GauEL?EC7a9dkDGQA?RLxp{BJ!=~}hC8k&M$Eup*qfP<U{0rM9ii<fRpI>J6R
zIXNV@=v+Fbp1@B8uJZ2Gpr}y%)de;fCchhd_D4@CcrH=5@`0NuZK%%5j_PNpg`TY4
zcO_MLYRlvOi3NU65!RzUQ1C5YT8u0x5C$D*Iv(Rcc$8ZfQ)cyXhJf$hM)LWdhgSaA
ztVww8I}CM6@zV)5?XW8NSWeYm!|2jrsHL>cw5fBq&cx>{?6!2R#6MaSi*&S)72PI6
zy3qIf^N%q0ZS7Cjf8OoH6N!0hTF(1hIV5;lwN**dj`ey8^)FAWwPn>bXAK2&VN1ZH
ztrMN!F8G5k126E6PI5h=3H_`4uZ`I+M)NtbQ638#+Fw7OLkfXELVn&|1HQviqaJxt
zO#OgI<pk)``<kn`B2SLx>fYTre>0T>Y(|Uj2#v2g?Po+E^X6p!Ft_&0(T`Rkb|*4p
z5RSzCHBdb#D1-P=6YIS3qle(}&<5hN*K!34k5%4;1F`AMr3Z7P1Gw>HaUqWj8|DVh
z11O#7$kKIB^_+-QUti)2_fHzM992F1U^Z;+&hCT(Mo?D<Y$7m>C!-5tfQi4KZ|Fqp
z`frCW1W-XQ<-U|erLn?fI$d4S@lMYM=_gsxLeYmw0Hio|EK2v;Jh~TFsi6S=*xIkj
zjnK)Ky+)swMQ7})PST3v<q%$d8u)qgb5)RhtdSaWU&!o9&8GRt@jZQzU2?uwEx-OE
zkg>m*9&2LwL4hQ^;VNjR8mJiCugQM&hh!>mV3mSm1lwSV<kcJYgRpOMPC1kR#8Pq9
zDEWzY%ugh-o(tQNvhgVD0B=kI^VzMUzP_3))Qw`t`3wXcrT-}RBZzYWeUQd%cQJdk
zVqc@|T1Y{N(u(P<?Ehm{F=XvYR4xNI+NG5P0<@yjwpRd#zvcTt%oqgZj<nn*KnO3D
zb>Ew%S+s^4_^vc~Sc2B5Sw^iMqE80FBZCy5Y!rgft%FnHNOySg=w|ewEHiW9Id{A(
zbj(Yt-bT0rwoDKE|0gCQ)`3DUy%d+qV$ININ+KR#Zi4i-MR))3|HMXgojjU|*-HI^
zU2KAUUX-oa3@L(VR=R6$(MS=0D<%2fb`60+7!t9+XI$-L)kd$-@N>GH2b)>7)dMYy
zV`ku{ZpO)W|1X^>SIiIT*IL4UGlQATWe3z`{xlb=RyI2RRVLMlr2ap6G3_sVQ(N>^
z0Gz8ygk{2DW%XzvvM;~dyugpGv`7<!`NBUdNWJLKICKI?bziI(4VPIpt{D7Qq8gnb
z-D}X5X&uF#hRu$M8=>7w3%qMq1+escW@JA*cCj_z7hNT21nV8S+cKWg1W*^S6()n0
z1el<A-#7oP2KqA)O^p;-yFb=mS%Lu!H<%i6+CZF|zqXI}m(ZzXPeLO(MLDK7D~dki
z`7!47!%n+fEyQmKk*ow3*)$@)Su_3h^tnNM=MEnbX7YmkZ8)bOsiXtdSmH|)mE4Gg
zJ4)*I7BF*ZGzvWOf_(X@D7|xl#EwT>m@EgwicDdo47uqK%QI_m6=+S@#fy|MoI}ma
z^o2-%n6XrmuCK+oQ?#ldqvK0}?~EjE;1DK+I5=-XO~#8b3D#t=9eYW4<oL>Rin)lk
z^)!@W9?Y&^MHix2+di9Kw<@(vKa|0^$e&FZ4?*l;%o(TE)Wy6ktfFVv5Od3ligbyD
z!s&9zuKculY+3k}c~B3_o3ytQ*oRHuUX4LH_7@J~7<IF{7~F5<yjS};c<kUCzF_)@
zPj}@}f!~g>AWcY``mowRTW!>JZZG6CRYI0gs%JHHkDqQ%>C=KKLTPkdvFw3gKxJ3s
ze;L>K-xwS*RX1$^N2px?2U#{3g!SZZ3<)fBihV=v&%qpv;s9En&VTPlQXfKMJ^W6S
zOkW#J2!ZTy3QxN(@Y2-as|GrdAvcfAnpI4{EdIjFk7EmaiDb!9|5bFRDmljp10yb=
zlZt+7PH`HP@_V3?UDmbPhNTPv^GF&(C=+FNO)z^Uar1~UR6r<8!O9z;BeCK;W{$Pw
zz-<gEp-{KiLuU;Yxtv~1u#v=W_JssodEOeakmSuXR~OM>+a1JR+r0SMcqjl+$1F8j
z=&M^MaxxH$?mWW4qzgmItV73$kfd6^4Mm3X%Wmu1FagLWRtAUPzhbF=O&l_vRInl6
z7-BiE$kF@tp;ACEcF+Bu6>G~Ea1I$RrmoaHtETnYBb)R1!xug5*}(*dvWcJ^arD7t
z9b7=mj)@sQ3+m_UV8J50H;yW9X}6(TXNAL$cY<%|8m@cJHAri?+QjQ%MMF^tRE+Na
zSzc(osl@xtm6IM&hn^2*0mU$|Q&~U7kr4{$$@6CZHA%#1GtlopddalweAV6Nu>&TX
z1=$QP@!t0;=ZdA$<Z*`UQt@Ov@P-2>N<T1;4xh7_cP@$OJT%o^SR0r^|5f>FS9$z5
z_V<gb3<=5D{<eDP1|n;`ae>$$0t3c-%qAE^pIzuAjaSP#<!;P#8STn1YqjDlSrO`6
z1AOQX>Kwd_2!LqMM-Di|q<v2e3BMk9?sZmF0x)Mo`u)dT5M|sj^mg$kallH*EqPYW
zPB|&e;3o|?9vc8shc}Lbwr*oKqCuF1Uq8U@a?f9Z%#K0X6S%4+dfIgb)zxxaPGidz
zvvj$Sor%J+?Z0=WksO<dX{oRES@FhSETQETS255+oBJ|b;D>?DhyU^i?K3VsR8gO)
zuSTT|?fk&t1x6$NsCIH(q;CclgndErc^4>h2{i{t*72pufv)0HOo%p`VgJYe|7f>&
zCMGTBH4c7#P*?x#I*lH-Y;%E4#SIjG2cS=40px#SU_QBNYDyhRu2v^K;=jCx$s#77
zEzL+$8BNuAJi8vr8_AR)IVx(s)a$IA|C1+dN!vUAohRt_aw%>!x?pA9WltgK4H$;%
zY&Af%44hthC7%b-8HBI;v*HYYeO$`P?aVBKLFX;YFUWnjcki1Y-_Eqd?7UQkn;b4f
zVk+wP;XLAj0otm;9PfVz#-WxuV8G6*W-jHZXepfIId}G<9`}@5Q5SMl8Ld!$^9T8E
z8N{DfaX;ACr5A|bXZG8#3+Lz$Rv{IqDmKWgF%}n4rrH12+N)yM!$gW5b?JCQQsa*u
zWCfj(W_>FotwXGFpz{Fpv-CLl0lgNm2YWlIrck#pN8LGi@GeJ#q>BpewY#4C2g@$P
z&z?q;c@k$40dd+Db;yF*yx}#QhlATrwB0Jhf)4|oHz6ku9{gi5Z5ie1gQWcSV19-k
z=XgHd3Elbw>-P1log;O{wuR)fjoh!){U4tCsuu!&&Qkkoz?#S*p&@==v8!W9$kTcF
zSWHwlYlx{E4@0zq%%E^KkF!syynT$dpE6fxb=p!q9A#`;_d=`&8#J&j;@vGtm7GND
z0+{*uPG6WG$j+!+pGuEoEY#&#aoRld4++w?!2$bEoR7eiw}>xZtS3h)(Jm*lZ4piW
z2wr}eEk1vg@Ac)YaLj4--&9H>#ELmGRqU!j<rcEF_@a7zNqSblEn&xvz8g~3egm&M
zo1vE$6CSB5##6=n7u4X{4YU0IAB@ER20r*N+~A)J2LoJH_^)>O7Fjs*$wBa#Cv@NQ
z`v`004e(B2wZ8>hc@eLM&DBI^Voz3EbhOEE9%c5V-=6R)<`+Z^QgM`=0(Igwd0&}x
z_j=Bk!rn7@h=h0B4<4h+6@fT9Fm?k7<EAivpqtTOk0rh7)x}GdZGk_%j``Rcj|z_e
zOj*{@QPZH>L+017dM~->5XE!7PDX)}%VRcpTlLsiJl@J1&K4m>w7RQ~F;s4>!)o{V
z@+;x+%SdxsEhMKQ*((|M&JbrLWxfogEeP9biYVF{ec~RP6|_M;r#^O}g+(@h@@{1>
zr?|RL%Bf>AZRP)TI99Iet+g^-`6{nHu+zM0HEBS7p7N~Px2DgcrUd8z1bO&F^7QM3
z{dLy3MvCPKWfh0z-UwBYFa~KqvMSWMyANmD@5vL^bouYU-Kuk^gFS+nE4>l)OZ6|q
zF%EQE!uvgLea!9>qNSxR9s9O!hFV&m>2QWlW8-3PZs*6<Qm`B~;usz}?(X!dW+T7G
zNaWgAxnxWH*7rSy`y}R~RLDzGGs|9ny#GTS6H}P<SM&MUbz3u|{`5-Dw2?4&3RX!2
zQDu5j-cr(9Ul=diJnqM#ee7?Gf+S`Bhw+p)bgi!)=DIT6UHP~TI>0tzV4H^X@SKh0
zm=}c<L-eQi98mM4R6n&GBg@50f~WZ)uJF*xE7m;AI*pY7Ebnuc(HQpo(u;o?0bl3j
zC<R1KuTD2gISrz341(<%6O__W=A&0Ih)T~cmW!ESexXoY>_E%!qx9hIX2Se?2CRhq
zWKE6zn}+>wYs-^Ljyd&LJ36#M__}IqM_*s-xOrQ@iJG(x20PkG@uHH&r<D_+$`)&_
zoxD5W)^&T;PMy?73vWRMWlwE36^#FzdTPjg`20L!>ANkDb&<SvY3~;*4yQZ(`t=$*
zjOah*Y&gwhB319<CkYvNXzeW<K(fX=@uImHpQ?%OQZnW5WQnovk5(n^-RISboIDe+
z4H8yXrRlbx$xr%$cA`N9St^pnkzLlS=Iy-!t*i{q+^xyixl!J{P>!3FwgNBdB$e&-
z^Z^tmUz$kzxmtmHOD3z(rKrtJ%|=qO1i5XU+mxbd!}ztgC5#;i{`?gNS7hSjl*ds<
z%|iT9SAoi%psnC`w&mb0H{-#7Xzf0-+T4qNLELZX3FpKVBUs`~F>?l)5PEAh8LYMX
z<Th8}Df1_P1+4kvRo&VkDLSNSD$+L<b|Yu<)6x5ksy6FTcBfFcd5Mf1bll*2^3<7c
z%YC0!p$dhZ#)w4K-zogxAY|UgHTG%*4RhRo8+Kxy+wj5m#1CY5<4K1!1>+qnx)<P~
zEHwv5#I@WSvjz*?6U-;}CB-X=gVZMvBw_B(MK&+=^ul`>I1*>@_T@}Frc(wq_-2vc
zFz)sud8Qk4mv9%}-q`oC*?Y0D{D8@y8BLprW_Nh#9>UjDng$+Fvaly`sp(`6x@R==
z)mlI9)vU4K+~chsyYY@HN6Nv`Ld<MCT5C%P?6E|^I$Qbh&;0PR&(nSfO`P(7T>Kr`
z@EpBn8}Y-voEby0^NP27xeZm2S8c?<>pOdB4g-3*c;B=tC9qI<rr^%F?r6#*RQAfn
z$yn=oyw#i_pgo=Sx51+u9XH?0h$z3z&Ju^!M*LjWdv@JieKcB{+{?}3xBiZ^#`@Z1
zd|hA^F5@h$9D3B51TuSlY0%v=@#)%Cz%O;>bD7!lG0GOUd<s3`U0gw7lj3ap*_Ynx
zZl)D;(Bb=(O*<$}L6Sxih~kXqD=F52(=CFb6Rys=cP^fYx7%YxBF5Pa&EJuh1&1kz
zGoSSJfP#Y}_SUxJ0$zChY#>!#T_-&RjnYD};ej84@Bn5&*LFI(0$DS2_TYj=-8*c(
z{*_yAkdJix^fLIl^~(Hx^5fauc$`G9l4Q*+$-JU6h>;^TwG~I4cl+fw(rsLqnJC*X
z4GB)|B{{bskt{J0+LE8bW$(qV*t_9?0ee*eJ`LoWX6Q7|^8*S#U?*(6-FA@tx4Gv@
zJ?E-V{MLBtTG+9%gs)BG4&^s_*5^GpMt4f~X!R0(sT=~CA4Sy8t8g;*+DxMB53Z}b
zH${5`0i|8=H-1b93mZ*ViS<$vCKR?)i!Y`SovBsUo9Dti54nd$4ZnL)*t}f~y?uw$
zIgn`<YO<3||Hoy1?0E5b54$;PqeqD^h0;b|t7sty^cX-QHeZjs;7Q)U%bm|4N`Qwk
z`7!U}%5a6rPUevap+T1Q?bt&V#`x-|+Jsn--T7zCm`5IRz?&uylzjss2><Lt6#gIJ
zQuFs*;MXX}9`+2%O07z8f)R~&GUuy<;QxY`GG-U-CT*D??2_;YoUIegqomYzdd?P(
zhK#?9_dE6*{GCg~jr8TIr9mOtNn^r~YHa=BNm}3_&4u-02aP5&A4Z{U3W{?1t%lbV
z%L0QbxOqFUic{BS*Ht01Dy;b+)XctnJ;xw(0}OnI?5Oi@ucA{_zY#G!cE#W(&CdSP
zcmF$G@nB)0#RrN@n7wU6X?Cx#f@D}>v~=6D3)It@ZOM>oe!2}N?QCsLP28rLXjl)g
zMwyz`0;C1}KvDYr!LQG=h+DMEO^PISJ|<Hr58=DiHj+d+by}`|-8FjquFUfp5+hr4
zLOKg$bjG1t7ZGXx3H@sg!9mT4aGt8bwj}Ek7>u*t8P`McnrY<D)S1PdY_>XuFWF%h
zr0N!ZLG#KoWJPHNt<1D++1lTjo3mb8V&%@ee0o%^MYG)2)pbAP;qHf3!@J4Af;U#0
z8Gm=NxDDa3W}{(s+vRU(v@!`T1^A}hH_vQ=V{T|7$r#S7u%DBJ`6q-=JfyDrifL+^
z-LqZtMxwK`4sK6>MMY2U1Ddq}1|7U9IT4a?8yu~pE#BU5E+o50FAVYvo3h>?HJ^)$
zU~pC9c{Y8@00>(hnj&!P)**-(b$sqNug}t?q?8snu^Jh_8GQidpELaZ9vnnZ*t=7*
zz%yM$)tv6>Rv70BY8vz>zNS*n`%732lqpm|Rfv9$y{0U5-Qv4ggh@}bl)<hAYIg{?
zJG9+L;YQPfWz7CB&fYR8vZm`6EWGi?-QC^Y-KB8XMjLl%+}+*Xt?|a41{xZN!rk2&
zo_Fr^-Y;fu#6--Wic@v!)H#)zd*{x*R<2E$eKLVT(%00SaMAc1ZmQ!O@^2Hn-NMY*
z!36<sFG`aJw@Ed(9K&K$Qq1Mmd#~Pu?{>Rsdht~Pc5nYHo<{5qCBRYFNNRoOQlxb*
zS`OWLZZVXKo$Sj(_Ud}Tc=tt8RG{M+5hF4JiQZbtw}OY7fWFBiYjO@`76eH#c&iEZ
z_fQ<Ff&w`Fw5~Zg1%nXp9yVP((O)!oe)JxTcYYvzx@lNJ*D#w)cJ-mJVqxB&neT7+
zD@_;x;{EgI>%}f_q7MIn>1+55(#Py_2E$)hJHzI>w0XRO_M<6aQ_hELabdWqf|1$p
zZ`wr){qg5%93Jg#<@79?SWm%;ldrPP>ZvnwH=jhb22YEu810UOG%8=@E>4fhSF0q}
zaex+3hzon?X1u0WTC0G5ZUO9{*u((WwGBmHf>L-S%B}im^4uVz$wXR4>$=Q7;Ws?6
z&*2HCvdoGs1}?>tEff7*v=K_Mr_X9%JcQjU;XXV?0HAFeO8)DkSNNLNVL#CR+c#Vn
zFk25$f-f3m!wY_GTmf4D^wT@&#CCA#m4?3_!#L4gX|)}RkT;?>rjecg(r^+yIROf9
z9CV<b<IlcAAosHT8h~rP4ep%1_8=0?G<PS%$sEjVk?F5ae`6Xb8u8TScuYsqR6fp=
z@c-bM-P5s=j<o_1a+YFua6Z2F1Lmcpk_MYV@EIX7+y+o2<TJj{YJy_Vd_R#FJg~n6
zY_s7!D0E@#8{DOz+$mq;#d+U-F|qpoRLgPX;A@cX_aqD#<F<*`$0T$(%Mk!(btR!T
zZ<uC~rJGLi(^~`$x84`1ObsxaU$L*y@b6CN`KIh857nDh^f8t5;Qfxwci3D*_*S=2
z2!8;_($JfTi00N?y}5d~Cr8+QIpHZMhwFOaz+;GH^~CE!J|d@w@X&>F-EX!?ED-rS
zO&<>6gz-RUmxfA~m>k+uvuNZX?w^{b4ht~xyLwoCY;gB}xSo`m2CF*I!%3eQ#C4!F
z!%}7cX$<Nq)o6lh(%(K9_Df!Mnk3gO$S!$F+1C~vI>f$wll?Fdp@+YGDit_k>gmqc
zk@}OIqtn42cDZ_fO*<!<arL18O7`IGb~D-$PiL7FJ1VOh<n$Iv17joP#ATWFXX=Za
zB{r0kTX5rKcrn950}d_6#I6YPyU6E0Sh2t%(4Sg2H*y~YKKrj|yV2wPULJJ6o`k*?
z|LyT!8qmvA-oAjs+=M^6@_!_9pJ`mtm#|_B&SFl6y#wd?liuC`3>xBp58ao=HHQgq
z^s^1)lUb<4Y~A8^HRg-4d<zt&wca2hu}IRgswPzET+Xbo#QJ@{c8Kx!Bkw_D?|sLK
zCupyg{mR$b7T3s#RB#{MImBP6eA$1i|2AjZGiU236UG#h1)0;V_P8e=08XS?AgJ;@
z{eKcDeFbWZ8^I$GBI7p~Io1V&1svcd_K!t-XK1*~9<xPWnoz)}`}9VPqtmzm;pWYU
z>5d*bjqBT-s~RzO+=(OO7QSR{j1b|vZ2jQ#($2`REWaX$_GFs`v89)ya32<eOQ?A$
z25Yez;l5QCy5&ilP4laA!eD6SkUe)BXe1tK{5kw_R#o-U<;Iz+F(i)pCTXOO<$@3z
z$A&G;ZgNJY<yTM&{^$P}rxBP!vJyRP12MaT>?KSuHV;O>9z0lyWd`vdQsemAC#i7@
z4iPnYBNl6<sEW%9$K>Wj5u%NI=eUq?PsJ7-inb9&H>;hP2kY`j?S>~2wh%$ipQ|M$
zk8Y}O@QXSKurQ29-WINfzCKiuUZz@nuc=YA7o!=-4uYnTfbE4=Z(^r+{v3FaAF@0g
zf5ZLa%}dgi<4G<_2NA1+@KF1O#WX~|wIzwfW!u}4G%~)=-h`T@WYLf1YVMuXqqOO@
z2O#N&&v{dsUv~YaSp|vDbC#HE1UyiRZl#HFsA+9Za(|iTHNo1L*XXjyJ;VpaccD6*
zHQ+ybLn`QYkIPOB-R`1a7;Z7WE)+yxgdri-l^Y7fN$=sp;R3@Y#UUZl!6dvc7=khX
ze36m9I7?j9Keu=95lW1QOziIN6kiei^_sMr<NjIa^P-DSV*m64Vc7d|G6SiBi!r-9
zQPt~brA--vnmNNlDC|kpALt=!TYLc>1P{L_?;2U;sW*<5Lbbza8Xpv?&gO!2v|YtX
z2|Ah#1#`pEK4r}!LyMH)mJ)nE=CjUx52my_w4`4}U3fp@Hg7mmnPoa>`z{&`TB*P6
z*p~_`<-3T<cs7bnkJPeIvM9S5tvuA)G26>^J|{E_==rgr#~k)<$TLYfnL*X<f%TRW
ztvcXNQC)Gxp|z=Pbbphl+p}AGubUgEe_y~<EGmS^HR@o<|LtQkIj0$&31*6;#E|Ec
z$@H5_GB%N~fY>nj>de~RztZv7Rcoj{*N^YfJEVS6J5(8pXk!JgT_}LCemWm{?AepP
zj@cL~*7g0Z$Fl4dBOTJM#z;lmU+vBGK}u_VHattNCg3Z76k9P^Od!VSOc1P(t`_J=
z3Z2_^-xo>`t|XyOXy{~^rnP5I1EzHy(rJ~JvOen#b?XBkJefFNCK%lgVTOhvjm!pq
z+27rGXs=wI*7?n+QYVWU-s5wxEqGcRr^+l&Pa57<FBIiGTyxplS4-;=j6rNhxyoQn
z<&nRp+(Q6b?^{S&rP|4;<KAmOn&yTK7$W2ks_yZ4mZq`CiTTaN*p-^lqg&3v@~PV+
zzuTAy-I3*4;NBGqxnj`Z8hdIFHRtL2F5@l!w6tx5{jmR?l&N`PCNWRP{8Xn)YHYW}
z(Qp-fCEbit>xL#dPWr(p-=Q8V6N%Jw8;ie@uI6;gX^^qU^#*!$O~`Icd7<;ISpBs-
zbSOS77&#{AyDC+Tq+9hjrrSmtB@x(WV4SPKI<%L14vK$Qs#Sp*{#CX*!Nj#XD1~TP
zO2bwWqgsU2+zGExz<;0!mlOk7UCIz;WZ6qfJ&|1swD^0nGRL4LS$n$pP2zAFcf6Dw
z^<Ilkr`(7REol2>ZR@;|gyeRX$U|&O38!y*%)(t{MZ#VRb!}ztt#l%j8z=QmZv0EH
zs$C!r2;c9*usA(m1*>$CJR@kh{u*HmOxcP}<NlivEnW8NGm{F3sbriHNEKIbU9@?Z
zWM7v1q<G&HY4$CYHCHMcheKa-IpvHi%tGx+cNO+R66)6S1<Hvk%_+njAoa(OtCFB%
zf0|WMW-Y}Rqd`GCFg(3rp%Ic|&r_cu4;Ln{wK+<lj0POAkmhEhjI9{0DMi*_)WkfG
z<xxwpeucBY4b5n1rwHjPHJA1jY|Gr^($pibr0ZmcQMaQY1=Wv|%u!E?tKw$vtxzyg
z>&SKgRiGf5Fu5i)e2vhi)o}d^(PmpKNyQLvWjUz$ePS<77)KZe$>asbiK=IR-fPZ$
zqLW`Y_tzV;Lwy-8vPs8_nxzoO{x^B=>aX-xQlzW-G$*>Ipce=vsRgn=SfyzZWmLgc
zL;^tIZg%DTz$5HoMPDwO^k`6OSP>d29h;{8`qhM9x$5Oh-b|-yzi=?;(CIXaF7z<i
zIxd+T^813(2044&&^72QE8>OH@St*dh6B`n09)8a?e<3fNE3sO_jWI+O$Fhnusm+0
z>(u3>$>0f?z(UO+BPL@`eZB*OnJ@I_LB=NP)hbFa!CO@~*-fvK+|1(!^DeKXe^e)u
zc<C8SBTw{|bh%qpfV<%&VsGX{g4WG9Fxd!9Me43l(tLfUHi{iHPF6sk@aXSCAJPfG
zr~OtJBmg!avbS(fh35V9x5ZHHT9sH42vT_N=G$hjZe?{8?))G)tB%VqubMo>fWVX0
z)Sml4i&Rbu=W%Qr4$F5#A6bi6qmg?+)`Q%h$@|lt+lx~|qEPGeGKfW(X$oVIpKJMm
z?Sr%2yEJ=vDZ-2_FI!3ZolVukFW3Nbdw;vv>c5M!;WXphTAgX#|8fDwbs*6eunG`c
z$Eu94CRV|O_ZO_E>!N;M^3#*eT5X<xNeygJrJcqyC%fo!oM`jc*09%INFms0al-g*
zcYZ2DYQaZkCq`p+$Qn-JEkrYJ19xIBhuXs-KD^en8zyB8iQGF}a?V*sA@kC{#u~7F
zZGKI-j*ToOSOHL0W)QXF&Eji`ruzdS?9^d9np`=JJ5@SYN&3E)c<p@s6pik7S>+Pd
zI{#E(Io&ag{XXor@roQ<d<d7933f5tyu%>42RYkf*#V<0i%B6FK(#E@ZVNycew-9t
zuE%LkqbvK(PJseBF<x$=^e0mEeKK+UGO7q7^Ns5|5_{*jUs~7W>3UIkVaj5f+8&Rt
zeXKW7e-vUBt}yv*LFtaLzUvXhPp#wa%W9DNBDGfT9tr0Wkboz~{}RcE8JC=z!>4Ca
z=E@L6`(`rxV{V^^swTg2t{rpw(Vq_npn6X^osmcIDcj=Y|Dq|I-|!%$0=7X5(7Vlz
zj@y{v%`>#iQ6P(3FT;ZZ3ou@^k?|)-VYyy$xy}V;De7TxSZ7GWZyu~=b*}oF0C6D0
z%NJQAg7M00=pY<<C|uGcrZnYEc1|7Sd&a)!uTQxDIOeD_l(+6KnU#9s<tHdL=3C{#
z?-97qQcVckY(uoUHF#*e2s;?W+w=n_Q_<Hccb9r_F56jD`0E!z3(pd-!Z+zO8}g3N
zI)qSe7zH*`vR;@)++053DJUxOVNX~2*h0HmfYtgeN2CbS<X1g^gJ<>sSpwo-9Vzy2
zE!%d)F@DjJSWXu2C$#wvk6~|KXhclqb|rSeEFkch#9>zau?Y1PhB(oRLI4(fP2(_H
z8e_(r!=780U25ZS1A}yJ4sZ<}?J?`TFT<Zs04HpeoSgSder~?1it(WV`+Z&E^fcj{
z!TEv9gdsGkmod&qaL^dqz~HT-O;vd#&ygiQanm+usNo|fE0chj`MddiGLKK{i-<M7
zVP)|ff+IC?2G9mctDhyvQ9JOpi60beKc6kzDgMQ1H8t^v*&v#UIXfvoZ&o1Vq{qf*
zCE=0Vr%W3D>7la&);YQ$imfk|iB*p|7<w3$y8<1|_HI6vE9&aR_#)a6Cxs|knCK9w
zH+*T8oWBgB-o`VzF$)WOc7ycnaR7`QGMtWZbERbd?<Va#8T1oj{=n~88cyJR9-Qly
zbgs{kBqsc=j9PQC!4sK{J$v`vhQ!h_B9*8E2wx^gGA3FMG-Zn#ww2ZhaK>2d;P9`R
zAK;VgWI=hsQ%#q$%mzYgSL0KT_|j6Kug%c|J*J~)!F8FvF%pe3FeS5vIPo!Au6r=e
zOWj03mtK_9Uoi@Em)|VAJPG;34o?7^XW(mDeJV!7kfTkPrzUIj5WVN@wpj+twl@tP
zIJOtdh&J>cQf`=JxqZSI3wC`uJC@ckU7R>aoegYgj$JlANO<|pU#=~*uKDrjSX@~m
zJs<hh3DO4qJnznRZYvHL_mq%%{TUXipWDnc<O1m83Em%ocuIr2{Z%j3(?YsVqfPZg
zn|by?tDM$5#M_#$Ny&Q@R0k<2DtD~+U^Q7h-|Fo2T!YWw%!t~eGagnp1#a%mG@&Ia
zX}Iv|_i>0NEQJUbUe%mwigpLr6yKe}7D(zBlN{=vw?Z^vA`62oh-k=5X|fn?mLJXf
zpG#Z%O6+o2m}@0&6v+;{1Wq30ILGai7AWTDG|Hg(qFH3zO}sa>e5a+@v0B3}oyuPi
z161VmB<9<PNEyM4X}uc0b))`07t2seyc(S@l@y`aTZAKzjf!e{HWCDPB^TjZT84ni
z*S7|GCll^O-L?2LU%7=?2m#F?s{jDO7$DjT$rl&wHm~Ca9zt|@Ko?j(oqH;C@{42X
zo$$&m3Lx4GAYQ=Akl?7jl5+3z<MYb=Zl!CT_?{c0<K3`E4qXmt3_ExL`F?yTa>EgU
z@JE&uE~3k=$nwL<JoqB&ss~LMtx_f}9km=2@!g-rlw2j;Wir_O)7LZ6{bzr{DSx#F
z``*=W96u&y&JlJc(O=t&9yJBm_}UpfCLEgZ7B4EY=VdJqSZ_ccs*A-DQ@v$flr^>`
zs^Y&Mr84@GyZn4l^$T9k9PDb2kXi2Fti*&#6HxRe+e#g~uAQ1^M;GL;9%&#>pUMfA
zEvY+M^tadtZ!$I{^6+ai%NNH|V$SG@c#q!0_3<XMnCgzaPWG3BYqgZZ+KFDK@NIVr
zAQ7@Pq0Polae9pcS@VF+mqYT4L|v(GI~~=PK>7)4)Dw@?qe=tf8)y9<G9zq_HX}F5
z;@=1_I@15Q*Rh5#3D(V!F0cDeb!{#ds*F{s|9x{M)D3*uIaK|0e1CLr;5CWikTJ&b
zJvRhXT&}Qj=5IoyrE>2;jldb4(<Zt@a?z`Jz`RYcOGzL<u^{l;$cchqy7FlWtr+xm
z_z2w4xB1#p^vJ%a{*N~Mmfkt~LJj;-E*YX%XOv**G-Hu~ms+D^VHx!zCpv5UX`olQ
zB&4Jz%l!2{E^<zR4-DHBG^@ThbGtuY|2+x>3tJ$mvJ?vBKp(7fRybU^5u`a{b+lyU
zKtwCix+lp=Tb>f!j$E_F{Hn5_`5(CLBEkG!@HD;%*E3lbtccmk#tuB6+61=?;RdSF
zAV=gxsD+<PJ;-Ec_J>>1^Zt&Of1M<;8I`0CYU_D|j+>|;kVB!M4(|YnDm*;U2Cc$i
z^Q6!x^G#p!0%Ha8dE->o_}!bOj<-4&N7Zjxyw<|e`|zTSo$Jfle!m9BjA;nL2>j@Q
z?s5Zo&3oSD6aZLCtnlLsy+vW}k>vDb+*mgE_Ijy8V;vEpgkOHUStw^yNa7JgnqvWd
zTfgPu0+0wg_vT(s*V;*9{IoN)>@h}AvUc8&fmfeOpgFpXZG~tmOgmh5J4DlT{)dZp
z8x^F1Ar3KGZYH3Ute*9Cvy~r_gJSy0ct{I3wj_JUID)SIV|j+K#(bdnt+96f0|Fj1
z$zWpz?WP(gNxWkEo8v11VBE!%^UiPGG<%=-zc1?_9{1`M%RcqV<Is92m1Wj0V?K&5
z1WC=Jf)|uqfVE9FdsYZ6Ry!|MDkRX;lJg=kEHcU71CfTz@xItfoe@~pyCO=to&QZ1
zDFh+Z)}%Tvf(r-@V21!CCz^mMh@3&tnu|3Am;~DnhG*hB=9feF?DVk&pYbHp3Qp@I
zQSp+U^0J)0L?lYL(VL5n0qhnasOsYH2)eWaa$b~1+Bw><>&pP#UTgt^GFCCLY(^TL
zM4iCbq<gjb048?xyD<_P8ODuQ5&XH<H!RaNKA%EC4OK#zB%2d9KY?Me-imE<rOq6s
zPUO4aZyY6!Z^wuU2a%-H7-t&>9^Oh>P*GicZ{9D3!@*tmgzWj#<$Pr(l?E&;<@%&x
zh{^lk118szXtEqyK?nc?B^HFoY}C)(w0_S^pMC?2#pDRZ5M-2)yN|!_jU|wi_Yd7x
zu+EZX^1&C-kzl67qKyaM3TAQ*IDq1(u{vwff{~~}pO?a=tte17>&d^_qx}<=YaCo(
zM1<xW3P;9OQVahBEqtw5s(6^bwJLv9vgyoP5#itJH=u~7OWqixUHiGA&Wp#trCTPv
z=6UBktUo32J6(TIstP7kLj6eQswhoTjr^K?9zIA4`XkOdN15Se9|7R`H`H2;r8yvH
zJ*S~jGCH3PTwWsi+YV#^?t86|$J9^!WMm;ArLs#h9rh%r%@inti5i0fg5C44BqhY`
zH<8t#0wb%LtIA}hHt;(8=rXcAxbYFJOy92ILX8TJLX^H)ZCj-7@ZwYE((@wlgYlJU
z(<~6PI7JqL$Q3TY2pdJ^$EOAVZFA6PHwov=eT{_0Rf18p%u<xv@?<<_Vg!mi%sc*L
z$QBa5%wJ=m&yg@}4yNdA$axv8Rzn?V5G{P8&R&=U8-6gvXXr9~w-!#tWc8+|*6PI1
z4WI&09BYZ12$w=Tc~e(()`fIrSz_1*Ouq6a)|CG4qfuf&^noUF8!4H3JaqY+#<BuC
zjoe?86aKleP=rndA{l{}hg-mdfIXm!Od4tb7XqM}?bO<8Uc-BE=^GKucK_ULm9sb3
zzAY;ZfK%ax9V`M#jzvI<d6#lmWb52oPHYN7Sli2ta&!A&u&|$&;y@^y{co9%04&gD
zN0D<vyc<cs6j`~rcEzKDpOW2-Q0w)neUa-H7d@ZbQG-glealE-8dJ5W>|wm!j{!!%
zTR<H>a_Y3Fn#LyfZfY)+@#^tOj~{E-!KPCCFDC!XtRg}r8N)KjZ1Ph+^EU*0?+Gjn
zHGU;8xGWM5L~Zg{fKFl(?9ct?qQq%7HlQ>DGd78Hk(R7gnT@B#XtlzUxEw-2KY_a4
zqCF}i3t&xU=WiykCdowA0bZ3m(K~c;7?jde>eHz*y4mlyBg+k-HaWU~8<e5cN<D;y
zsgHe7GJt=MDRd$0eS5w>^X0hDOzN^C4B(A|&?1t8({^o#_J7KH1PaipE92`f5F6%1
z4<AyK@s6&c3&SEjnM394tyy(^l2;Qw=K%E^NG;Yq)u(IbWTn);8Udg7Cy{~Q``kIt
zSQqXkVN+Bp-cKzvZ`N0<PnQb2=nN3%I<ExG>dPH`icUD6ku27MYH2Q5V|XM$b@ZNY
zA^LTaw-M3?@pK(iTHZY6AuoIk)tc*7oqUQqSnC%%s>YrnCm8$MTENIs#vSnQHs4=$
zZCoS)M!RfyN;ZtLcqzwwe@tZO0G;;lYFWgVY6j6u)8UxM<Ks;1$u(zPhze94X?_BX
z?~6;gW&2U}b>_)a$<j-vQ`QCjHS+w|Oy7aSO#{41d_-a`A%M+q@ana83Cm(o$;s&k
z*jhS(0Q|R%P93&oVD>Y$BLzR)?hRL6{)uBpas`Xqgnm_wIjd|5xM5%=@sEJ71?jzk
z>7O*6FdhZuQW;BHDFr^2UCpI+m{@Jpm@l!v_bcS&P(QZ8L6&P-s_LvLI3gNZa}hCc
z)O}yzf*mD=6<Gq)!cyi+j`?tDI*0Uihb6d`4Sds6N#yH@kJm<q@nfw2X57<FM3dS=
zITs10s#f-<1(NNjF{G8Zg?=tlbgN>-Q(DRqBO7|m?|rfRtd-%o+kS|c<BCEnVIWYH
zH@FUm%az4@!tdAg?!{{&aQBCZ{1~(S3h$1AP{MJ{@N-5Viz4ObbXO(j;26p38Xq4{
z#PmwrLHw+@P^{c9E`FSdK)XJv-a)k`(X{?2vc<0;YyuPb*;*ES>tv#xlFI<D_+;f2
zh{{x+KazH<X*b8tObRwnC)?$$GxiXMxF?ZOSxWnvnuUz-n@9anXl003D{U+}5LO3_
z1DOMkjQnScyhHJB+jR^rDHyej<qV8L&PHT>&#F&g)=m$?T>0Fc!E7?0w#P9IIGcYd
zBEYlk%=7kNWBWCH!q61hc$B|!KKgXvcGqNkoKIg_&HVXl>#MR-zFoPzxnVyF$}(|#
zhK8ecWMyF5sWWUavy9*mXoX?7-UKV8fC_Q67h4^tja5qeSxgYn4|xgTPV@?fR47|T
zEK|H-b>@hPE#3&0vMJSO6Qr&Ey%|aeCcL}^Q8@kQ!1?J^l(L>{$E!Rw#>j^;Prnzk
zwHSf#iBt|~H=4<!pI3qbyEb&^Q_+wbM>6J*dxC#M|Ahf+;@Y!V87A+%`HZA?X@>ZE
z!5^CH&O>EbH&-CbNzUDd{Q+C(PW}7utaCJ~mDlECb+t~L_{kfn4|et}IEjl|`fC>&
zTmZG4YFI_LWQ@BbC?RbKjD4;r4|O;(T)t<a(YK?KnqF=(GX9~B*STjTiS5kapqQ~M
zEd75ODy5E<-g^Uo91WWu#K&a#T#(!Mbe8C$zg_T9fZii+0WE)`%pL>3Wct08bf~tj
z%J)jf+Q&;K6RNt3Yx9F2G5(now%%;t2cT*QH=*`0YJusN#`-9t9swpc4h5vtKxi_B
z_0-y{%lS%>jy^5#ZL=~^lhQF$5baVY{`*0;ZdDyf;O(oi;RJOS%|G+toM?z{22Ku;
z#($Gto4xuQXFApxRw%Q8mkP`WsX1hRMQo6DDpi`qnpu*25EJ%9^DX&@9_fOump^km
zD@X0#`N8;x>FJN{$cE@?8nevXVgh7GD04vmC&b!7-KOqJ0^w1(_~ZMJ=+K0^y!3)V
zM_PZn1Z$ye*vX<JTSkT|!T(H(;$oEv;sqM$5SP4cq~*M(#T`Z9q}U>0Go`4_`D=Rd
zc`6U+jgWwnMw@u6U|`a1_wXy}a(zZ~9GBC!f{sYAp*FNJT{_Mk&FUX}`p8-h{1RJD
z?bX_7yr|bpTvS+Z+Zs+(jfFx^>W%096`+}!{nVUS7zq{@JWB(Y&Z*cFl4%{|;Up<5
z0<N$DLr{}t6NUcC6t)ri3J<B^^kAp`*=&Tw+F#tVzgAHq03vVVBIxM@c;*Tw-gBuX
z0fC?~XGgOQE%d;CXRS6ocZt3gkFJj5Z$a30Q9lhrrmTJ3AZ4HfHkVvq>xe=<jZJxl
z3vP(H!NW|dYWh5nD`Y&=9ta{CNT_)}hG3-1-X8a6{kt^@HGk&b-zO=KRe_d$4jzd!
zls+2Xe9fwrEU^OMkut8;TRG1jYm;!Gg?*2sD7Ms6tNGeCK01Sr6yFS<K6NXMhelq+
z^@2(C9L7R4epyE6HSKM7DE$KYS50=W-nt)fE#`TA4{L*G2=?H-Yc}?5Mf5X$@1<<D
zy1w64;$o=nV3A#dtK6La(EdYyJ)g1))#aOHkYt#?H14r==D?&8cXM25TUl*wH!q<*
z^W49ZuP5gB@**+N&X!Q|jT_P>@9}k)nDKPIjxlmwbm)2Jy&E>0dfFiR6Gw#KWBpbu
z)C^nbTjjbSuFz;gmk5fcI-ARIWG#O^3Lt6jO0Sbn!W%s!D;^UsJ(y^7&A5zp*-2nm
zn;cm$AN`blz$FVZx09NHX5UXF4HpsNTMow$mU-6v{UK0#1m1o^!AOS!4W2<K0b(8&
z*F+2+R`0=<FDlbsrxDGjp&ZBd9Z;_~A^!Qk`DT#s-7`&@OG#l~f1=EQ#2Vkm&^0Y5
z|DjaA3oow!MHUthCb2Dt31!`e57BsS4Zt;Q$;EV^DM>cgCYp(C-XRz?_{C(iz?OnH
zjZ9B-0>m%uGtBC{k&jyYbz9!^uF}%;gs5Y561lar+PCR0;k?~HZ{Fg_=%m0=Y3lvj
zJ%@0{VB&Q@`XsTP;p2MpnJd)8-6?ksQ@S><Qd{Z8Sip=`a^W}Zrfq0w+wKv<0TQMq
z9$3j)prH@mI(>vZ%e7l1qf%SkH_2L`49{*K04<F{iw@egeeVTmbTNmW+vUN-hC1g}
z?zzDSke{8CTIb3YoVNB^x2o=t{m)xO>F!G6WEJk*^|8H~&uiU8oSN?G-R})ARbZtm
z(hbb{8VsdYT}8UG@+YE_oLc+b;qht$67ox_;hW+hI^Y-<`B>e4bs+;J8;osaoblhi
zU>eqq3i@TWxw-g0d6sPX{OM6oa)woPY1;K^`B;DB28;ot>QWrw(2^I$y94>*#qzY;
zn1)`SxUv}1%n4$4JW{Hagj+`XlWA6d{ZzY19p@Ct8AfhuSWK<X&bS0--Z>kpb)dH9
z!-DEF?wjE}p=Mj}mDbw7j$3to*CR0e7ULU2la=@xYt&d3Q0ipxNb~hkA)CHlcqpQN
z0J+(`%TF0#80m3p&ko-i5?WV1v<L0PLec$Bc)aYxPm3^Lhp1J{!~UQkdA`ObStv0Q
z$=3!8VU%58jmfXl=E|&bZnz`Oo!HU7lWyr(P(oPorbJc0&u&OJqRkYu;qk}F$w8dR
zj+sQOpezg_q_D`W2>HzLcVw{5uYSuI(iYYBaN)cvh`;tuvHP8LYh|DYm%(?&6`Y!O
z#Z^cb+m3-I@)v^)R^k&WL09%kWg-}a{G^k{Ca6N3@-C37wAa3tHFPvVDxwpZM@K+5
zFyemCCAYbdU?qF{W1@VY{GbdcDJY~AOgZ$J5;8_ELKhzKtnP9ET%M;ksV@VEo|6Y7
zQu8ZsDsN2wa2)Qz9vAMAagUVUCmpbnCO>UxS(TR8o>=(@M6oygp3u&rbVB51yB1jB
z+~9=Lnj5r%hz1j+&{xSkKk>s|1}mNe?&Bmzpi_B*-5?}xf6Itm_LRj9JNfBLx3Z~2
zG9^w#@2F*hGk!K(a>C;guZIAq-SA9W!z-GtPy{-`D=#ogLp~>H&IJJeV`uDet>#$j
z&Mw$IkV!&Zz9n}Wg#wTga}t3uDfJ$8nd@OpqK7216I8LD;0hU58MAS^KjkmUWV>v9
zqyS+g{pxArzwBNm<Z%>LU~B!_SNB=tV=JO^ub5L`Xrt9rc+Y<hXq%1X<WhaJsV@N-
zFYF=Y34b}ydLjx{Oe<o31}RBRzr9AcO)ZMvB^H|2-4W*9tRFD>wYpIvqJspx&;P>0
z`zfNQEn)3056*?|X*<6yDzKOuTyi(ryElr^o6m$+vwN*2hp2TY3u|i*ChSdjJ&c8B
zx;rdNEURnJt&}HOlAOTX1X(m+9mUS&y*z4TVa}8q^4v~MA`7jfSD<l3CKsdr1eC7J
z3oAvMwA=i09D{X7u8bvHV&uqdyP7d6q$p;GC;TB_h6NVDMEP{k7Ot=7wih8x5r$yt
z*?Om3s$dh4PaX*m>Nii*3{isx;Wd+GVEU$O+JOnD{Vp@Wa0RjCjpclVLxwWH6Qrm1
z0gNWetRpx$k8ZT}9x*E?v^s{!<4qD1scD~QL-3TU&2-{Q@Zw6W0p`Wrp-h##?WdJj
zk3g3hwCHKal|1NZ>WHnxDQ(;$!GW~qvb`&xRGuQaEk)Dx1ncD}YY+y&gMdbX{P>R-
zb=8I?{{)L&=pP0uFdbE`FH4)hDLNM>Rsov`Fj(S>ZQC!y^aofQuBKqVx#yD|Ymu+r
z4YnuQ*w;NDCurTEoPhqe#6i{Oin2@%0v|s;bHk^+lMy;Sk;pt7JnwSsd>MO64*o%#
zY(B*JHSD{UC+mryC+D^<G4S0yArBv$o_Q2#)a9;Wz(EEbZPgx^xYDO$dW%=|JgOY(
zfayr}u%3h-ld@L%=&o$zi>~sF2EUs;H*cHIqB}`7e9q!(?W)4%25LzF;|RzWu*Al_
z1@erKgSz%#>uG<;D;D|lZl|6iDKLuL9*eGiUJG62yleJ;SmhVfpT_MT{2G<12*b&Z
z?<zgU*j|QgE-_Sy;PTmKdwLos;RHy_*f0N`TM<=+G><&G*GwuQc#2;76GVsV|Hkp*
z)#vYm`6C|+sv!R7JvjA&1YLHOdu|krc&!Yv<}xt8QG?J%0-odV_~cQy)6>B0WK&Hg
z^rqYi!mzD{p1*~tJNEV1GDGOESTvO?1P`Y(u7O7J`-mU6^|1M1rYsRW{kk(kLg{)L
zn;FFfySmf0&-PXDY`N^LXP;81l;F^b{-K?1F?94*SDrlHO;@FXu%{Ev3_@h37V1XY
zlgcR0!%pAFT=0Yh1*=oBhgruzQD8@@^7iqx`+_V*3vGa8VeB^J#ilC!RCxYzpyNLX
z$M><d_Pm)ZfBCrxfUpZk?#9;HIA`S?c87U;tv&E?Jku(8f+V!n<%WhG@l)9qoao6W
zg;RbonDT9W8$UK5LtNZfys8j<WR_hSwNL*wr?bggx~-ZrlF6mWH`nMDU?u&V#dIFz
zldyphS2H15I-#=y9a7^E<2xk2zrb(zW!IqBmTX^PFq%r_2<1B*{7=%>T+Q(lwT3Io
z4cwqD%lb~vh(<eRPf{)7BV0`T-jd9-#rO~<uB{^2bPlL&+!r+3)WE%vt!0O+Ymev*
z0FUsvBOh+Vwgn5}JAipp2BG|Z=gcm>W#qP9Xc)iiC-zP5aBzgtxZ`)G)HC6+AfLG|
zNLW;IEx;m9V?0Oo&vkzltkp~c0$Q8JVq-cL{w5*rr)GzEJ=WTPzQ#|TPyH+8I$jA|
zcR%6lNT~fsiq9j0&VrF4_xr@Gc0UAC9oHTSsKFji1`YL?$Vuq+nNHC!I6o6+=D`oI
zY%xFSIsr8`<&;4rFgOh5K4^(jvA8+F5xoR1KkGJs{I_F!$%pn^@_3$G3d+~yl0>N&
zB<auFN_(t{h%ARUYJj7gJ3#R7f<$TX#<|i9h1>5<U(J0U8G8sFZrVXbO`p$5D0QgT
zaEMi%6QfbLladndTTJFm6GZmU4O!Du`3Aa?(Tv~$dV*sscF`*%A8A~&UJ9n4aIrP$
zc)*lANjjcbq@RrcP+4$#bmdv|J?ko7Zby<UtDn1mX6Oc(hBF6ul5qP*ltUpMf9XNG
z!){P~dFSy+LwJP{`%eq~bA8~y2mJ$xp->do|NDdgaRxFnWGBeIl9CL@TS(OoPIt5z
z9TXJvvWJIC=r~F+TS|d{6qY}s!5WvmPb3iWKYrJPS<C@)x<7&9@ZuW4^7qa>+dzNh
z=?^WvZq(cf-FxnR<sQZg%7uT7soYmv8-wn3!;vE*!XD=uhSUe+;CP2GHbo=?2Vf1N
zo!Z=Q@S!|{jCUJQO}|UH(hi;*>!b|vb>n#a9zbw$x#Iuh@9;;LpW(5G#C{Bn-KFmu
z+_(p}!Am=hU|kfHy#<j5thKt40EFWZZ7#3k9?xxahRkcfxCKqZpG_jXX+seX3%FrU
zyfBN7as{^-cOTSaUki2dp+>^Y!NEnJA_yXF9ea^dQ`c$SMHasjA6538PEZpkk#{h?
z(~Fp?E8|G9pM<(^490SBU!(X`)-)X7f777tdUfckDpvS!o7+$txJ&fcrn3_;xmCWM
z6@G4T0=GG+8IaugmkY2ncfjmQ;q(Zj%Z-Gx6%Ob+yY#ACF{J5?L0&9MLiwyz1@A3n
zf2~uFcp?xc@j-Iv2>}v_*Hq>dC4$idMS`n35JUuYY5t{)y@n{Mg6T?;L6u>K?^gk{
zi^8char-(i!|ek2KBf$WM?j~|{|b7G0PiWZiJ?tpr~P*b7)=dU;qrSKokcm)3{+U%
z+G%+I=>I~$65>jdjut$m;&BLJLAV&V^SonvIij!;Iyd}At4n0HfX4`FQ`jp+c=x`@
zFSJx6pC}#Zksc0*&3}bz0kbtTt>uN;(FqO?cMnI5752M8S+-W@-+?#}^Ucf=&fav9
z6Q2)mAfK0w8?b%9(`$r)7nE0+03<TjZc_2+6ap70fP7R9&Ko)=Xe+7t0v6UChMaSC
zD!RrF2zdBvn-vS%7@4j}+0*dw1Iy$JNhIEaTd?hK_d#i?thdGR(xlxi3t39{biZA;
z_+o$)+iIT=@TIZWA6&(&lqjV2smCV#9e~1;cDXJoo*ap`gl=Aj>0!+Z%@q_#Oam@t
z-&?U(8Q#9=7=0SR>F3x4g?Nek`i|k(f!OJ`#6x8LYo}dobKEd>>u-riBZ3-8s&Os3
z3vdz;-+;XerH}*2r-tubAZ4#5RiYY9kr6`6ryr<(@~DKewGI$7ffVJ^P{F)LR5K6p
z5i{4p!}LOm%E&WSe46Fy<8JHOKBxliq{tN>WBh57$wP<W33Z1i3aii5RqW#1YKb^J
zgVBkrvTS%(61Nf8645e9x`UH8OKhY$fq!wvuyV-@b%5R(#r5$jXgvFJT&Xx-db;XD
zzHu00Ay{t;AS)cGKX%t+s`w*0C+J~{&)X50OiByF2bFhP_L@>AOhUjL4)+enpP+n4
zp)tT-K^Xd3f9su1!+yp?NzS_GN_cj4EPiW;fVs&Y{wu`wGu>GKzRTf`pt04ohn*fY
zMnska0T?Ho0Op^$M!z7r4?3L(To{I^;T!12dUP+9_x2zfd<&ZQZ@5Kpd1#av(1y~7
zzEype{MQo|kg#%x%2%&L0Ae5~z9P2fja-6RIfR+sHIT0SAE-pzxZjJJeLP>gA%^a;
z+0Z9&ckYl;>{&AkM><lLhWbm;FmG%2+HKscvqN7UtJk17eq>Sk$Q9J!L~L{f3pM52
z2A4gXwlkE{OVx(g_4X$dtZt<}IZh9jDvYWdziQDN1Oqn)H0*|4%wHjI=Z&Ue$#+F2
z24-OsJORp?;dIcqr$}jJ7<g-DxrZl#^ZxOD8L4TmBbG!(bqs}!n?KFauN<AFR8@vt
z79oNCij>kg{DlKo6Q1Zt#yhbrN=8?@>33lEIO30?M%pAG<`TpSfv|yuJ88%MIp?p*
z!P9O)d0V(`3D2DR+@Z%}8EU+OUu2{oqJA8Pt|zgE`=Tj<ppW1U0yJpSW*Q6s*d<mq
z&9AA8>fNHK8O8KgzGwzO0be$#3Fw{qy2tI>TLl7scoj}_!#cOar7vObTcNm$F)Zy&
zJ<fwkAmS_tKpxnmCuN)Xs~e=F)JKoSW2o@-Wt+?(cfPLa;CUYicQPw@zd`FAPqcLF
zZ7dxdE{0|rCG|7Bki)9>#Xve*YDHYe2k$Vl^=@vg8r__a>avI{;Kh#~>b<wJjJp*D
zC_fic1T8UJRa$O87qY-Ni!xyiT1G~}Q8yDo@@>8p&8QfG?daD;{YYcLriwld+Eo`P
zUvH9@`gd@M1ajcuUrF~M4H&sxm**iM0jwIlg=!B2$d>%^vP!r9{`R=(YSXyV@p(mL
zJOLQF^S^tbFu9DZ6}c-7pXXRh8NvV@u<~0oB9y+O_pTsvE2~>}>$dJhBISQA>R;5K
z9qKtxlTb}HK9={u+=`k0stE_6N^H18octEY#iVXs#Ewh%KBzy2rW)znaQGKDhi>`u
z0-9(uEs8lkIZYH~eP|P9C)YsxOxO~&Q|b0a4Z3%$pF|HJ{DYKRKRjnT|0kZkdH5wF
zin+}LqT0gGHRms?rty`7%n;x=-}jwjtP>*|OK)vgs3h{OncBX-qH9lKI>~2&hw)Fo
zfuryOmi{*n<w-~Xv#bB%Tt>*NV%GP_)X_aC;7CsPzX;TObM(Lli6Bh(Cx0$+F+Wag
z4!KCp9!p`oxJ`h9`MuGw@s?Z5Lv0l>0qfRFoZW<8p(Bc<fZqQju|-AwmrAF2zX8?2
zytN}uFI}Dnxp`L%_G(w|9)~vqML0L27)-S74>7Dhh?tcDLT*B!m?_H(%EA}LEAB)a
z$;X*7B0#BsKnNp1IXh6{m#LgQg*mP|imcD&uq}X?N2>vqPnEdj`+wt!_Y;Izkr>k6
zD&uoeMS-YGn!_cC%A2q43`dIM>Fxx;=r8AA{?1n3ZKZCxVK>5TzCFzPFun7{q1Pzi
zT_p%}LGpr0XsV>P7yZIxz2BsSNkIi5(1cT2t>9k6w=k&HjScS=&9n@aYjV2~@<)*f
z{6NP?Z4#1>K(Xr`F)@{AnA5LnLoG%CAaum^M+MFH!vfg70FEjVH=mt`*UyFfh4Rie
zRA~X~(<y^RNNE|jc&*P2;8c7Nm;On`F>d20$m#6gmuKi`%nw=6VX97+?tP~0Mhd`J
z>W;|m(R!d*09Bv0=y+m^;h1#R=yC-RUjBr+CUF*%@-8NnEZjf^)vx^%>HH0&B}9OS
zn>hi)jc)f<REP+k7+;&2gTnFtTJafuGvJCv6*~4H2t4<bAcU~<wnDHvHsnhtB<gzX
z5U^DlZ`#3>fB(i*YX*qL=0I`A%HJh;Rm+9`vvq=e#nD?nQ;WBe{(}p1^IkOArg%o~
zU;EnnHMOa(SG>-g_a_`I19$YSpjdnw`Jy)*pTVqES(&;awtHKe{{d?M6*<Y$WL$nQ
zd+4~PO?AYs#k>TNZ&qD0xzvm4NEjnfWP?7-CyHR_ityWd)}L69F~68avV&}UF|r9c
zScGnqUhF$3dkf7JZf!6PgcS=RNbtw1<<+vpuG8g7G!(?p6EsVmt-!M+L|<|4)b*H7
zfmQIkV)%--X{VuQcSif))Eb=ll90(BH~n>UsHl?`RZ_5%tlN(3C(A`jVH)=574OE+
zHkQz4zvTtQvjBR_jUdeS7kfNr#&fqC5=U|W<F@Ec;k}9Jn!xs2%n&GuOCIU)eLIW7
z$dJGx-r{@kj)tGh!+YZc?!xFKk0+L`J_Lu|`_IKVl6$Sc-$8B|UoIj<I|N=z)7&Qh
z8(}{>uyM1(aD!J+APyyW!iB0PqX4Mcz@4bA6SDi%pv1mQEc2;Q0x~PvpleR7Meuuc
zqW6#v=ZL0b1}Zf@cHSbPF5S^s)CN1KopF-^D`Hx>25jJ(Q93{+_QxB3Xe40=tYV}<
zU7Vh7p9l9loxQy~WjvH!B)rPhBDm@;*>qMj>@_s$k<MSlArJvtm=1{O2YCCbH9!#a
zQ!-UbgyO9E(4lsh(n4gZz!uyqs>%QzH=-;U3>S0xYquVdg2P1v2#-PLP;(cVT<$g=
zxWKjLx;JAoyNLZnYw!ecldESux8L}-r;To|)}ul<UbDHYG6i=x4^6}sQE4<-qBh#4
zaZ}O$7JAsIhcgbqD}zp6Y-B+f9t1PH?JqXcQzZ-U--mBG#bL+8|073Sl{&_OPK@m6
z2o|LCM=OMe8d8rySY$<-;=i#eiPc0TluN*50NpZTf0C}ZiwTN*3u*0?BGl>Zn1;Ic
zFT%rq(!zb5m=09HWn+~oArJxlacNOzE`PYepT$97Gy2EI9nDd9GGaS-8giZ{wc_C4
z^vYl1E)972CP-u<{c1%lRe0CaB-L8kU7zz56hUwW!?!Eg|9AlKTo|hcwgKE8V~b@S
zU$Ld<RBxoXepYIIBdIJE&8}RATN$2EC<xd#We@jmEcmTOJceY9UmmU^mY4~~Ekxg(
zf$$s*4g`0RiRFyr{R>$49ekS710zJHQb-mIgL7aUbK<U7^oflX22d?6jW<x2M^Uk@
zEkZ4gmLAdMm8pHpO*lgOfwPf<QeBHUPAD}JJGoZmHrSqEo%>qt2zUm;Og6*VaKd?!
zQ?OP%a7m%UsUZUyn5wljsEos4F({{6S3$l2TrirSDksl`AWcVb`vch{y#KCFCi;+$
zeym~ZF~kMnxSS$zLEFcG5tpNdmRAYXK$-_dtSe*2gnO+`)%Hu>I5MMB++*`0jQa#@
zZonrw!c~YdTMC{clT8Ik>VKobV?|Yn+}c1#^A1$(e=z1S+5UsR1}!-)esA3i8z~*E
z`C?HeBT349t-Xs6bAVt@?$?1tXe9vU;JM=hsTxVrBn3hVKtb`mBd+>t{+a*m&tJTp
zNL%to`UxjOx3v>M;7=;ER_HDU%{jEaE^-Os$E!TCxW2Nt_uZCE(l?OiqHsqdTSgf6
zM-W~5m+BaR10t|LIfff0woGa>if73W@f+c}-MO}dN}5AB9o;FOt2PLCnkH{G`&URr
z-=i&MY_aej^b7T?<GQ-Gnpf)|DvX}Pi{L|l+FIJGKtjBqMu&RUdcidZ`R)UQeMV~a
zl^wOm_63xCHBAOAsDCB2m!A6#fHC~Q@QYO8E0TSB;r%e~cuQH}HZ}Z<#@USNoCSg}
z&V*3keUkKSU!C(**}@${T!MK2*Et6*P0c9Kz3~iWwLySgS|4AL66iS@OL)f7#SLbS
z<?y2O6Ns1<<-uS1vFu=+32$#F5vjs%-dDc4!Z_$QQV4a)8?J{ZpZ&!g$*;mCIzPf=
zmS8bSS$=aJ!8E9EXeUmb=KR0jsh%|G<|^vT2U49O7+~~jZQ@Y<$@WnlL8_%J#Yzxd
z%<gKD5q;sLtl1V%KKBczbVq0io@0d*o`g2)hE`07lF4`yp!XymJ0>edsfiTjB=$2y
zhE9wdOf-zVN_Q?$kvsorLbrhzbx<0hX6kPe<FWp4UP$Aey<po~8)^RR>egix;3yq6
z@?i75KA(^rqcqzer>Upcd577GT#_vSMMh<b%&!4G4$Xh3#67<)a=j(TSTC(BRGwZd
zcx>lNoQi)D5y0-roejX<tl5!GcbYWRG8=UEy|Qpu4iJf&ha61%ER49-Sm;xPWT&;m
z0}yunPUfd(<mBHBh7j_gTw7FKpIdV~)|=}H!#U4+^}9P@S#mNf97iee57{<4rhQGD
z>{>B~{5YL*opr=<=_g2UTqia~{`=>|>^58118N}_*|JrjB};P1TP5S}|0~Z`ayQ4u
zuZapPCZA`jz5KZDkuqRIc6o{}9JK`A3+>gD`|L*ij-JTd&x2%nGleZSp@JF{BjYiI
ztUJBfC|RmF9;otzgy1I4WCMND3z~KFUgJ}#3MB=E7%h>{XX=GK3KoQ$hD3bpu*NC+
z@2oA-?+-K5y3|V8nHPqp;lS?wD`w7SMux^37`Tgv2+d<)7&}KakoDwHV<gdyTvSUQ
zK^}3Qzr*&KZGm3m@{lmmp*9bCnz*`XsxSI?DvKxHA_?)N!s%=tx%Rx2@0-Az(h4YQ
zuDQWCDZ-?PTf^d!*^tuR2t$W6y#3r!D=@lG80AI8l}iyp2nmVQ=V4jAUlbh(B&NI-
zeW&?^(v(uIbP>*=aSyoxMSG7P2M}IpdH-gm0wGzLse;7%ig2=bSRBm%vRco@Z?!93
zsS_N0HGCti)AMR(ryYB-ns}KZ&4=L+m|E-=AiNW_=a)lW_g8jw6j}7cc7OqN_+-Dp
z*xcto_E^YkamnX|meM=f8(*bys{;P(^<a^isGSYdRG2UKF|J^Pl?bXjqY_boujSV2
zi4Q8N!2dSs|JT9mPout>L`-r4xi<g!<(cYYC|J~DO-hme9o(2#pq`4;%%2cgL<bR>
zk<TP0x$>X&U*-aIq~xe?1tg3&-+{1u!tOq4cN~{kskqLvMB+#q-R41-+Y3~o>CIB&
zg)nGwp}ETor=Ox;ITI~^dj5uu@MCAwfa_s0-e)W+9FdbrSg%C+mvpsswFUTN>jfnU
zwU?~3UQ8MX&6(V)%6Ymt{_<(uI!@79-hs`8dlg<-_<0RNI3F$3qj`8d-s!{78FDta
zXE$LmOTO@+ET^)wfj1C~+<6?m)3ZPF-5Gy_@|@OuU3QOdH&<P?U!qP!YOKi}EXe8T
z>3TN_&HY*!yZXya&vdBUH%9Ik6BFK8%VO4is;y-<ue{&KK{rq}@;0-65qxNWC*(u}
zI`+e4F@`_(YvFW9<5>_&4=dY?lt^w!-Udu=2+b<;s*3El&1*gX1gzsoYMTPi;2NfU
z#Fh4mYIDAUx#r-nCX?L_-dB%+khbGp^(=SuBLBp&;Bhg{vFGl=N0@nOnMRS*a%E5H
zsb2;J<6;z*XHwTJDMGP2^e4Qrtu<zmPNvYo<1jI$hsVoFM7u@%>M#A`1Lnl5CpU0#
zVjC7&oDQ48<++139HDg_8{ACm6l&Ix!0~mAW~{yK%lu(dxS6<A@x)v_+>Bp%(>`|G
zO_N`<ZUY?6OkaMd_8xR3nN}rXG0GyYm(c7#vGzR2n}7W7VH|_u$6M$4w!{-W3{6D^
zd|5p>*L5B=#<$J&VA%ZWdsc+Xd*LUkA`)P+qHz7<=@8boyScl|xQN7M$Sq3pbB2Q&
z59WBIr~TebK{Qz0^;?hy@1*UugGbu#?q+!s!v+Ck9Z7;H%l4T?SRD)%6%3W0{oBq-
ztie8VUvkaViFXG%)lc7U912Z?Ew2#I*2){qLiy!NO23tBd0R&(r^^`ADXbV(>d9Lf
z8<$T$e#mhNzn2%|`pUhI=;vw2!7EInIN*x%{?ek!c>gCeq<V-!U5~B`V|?MXQu(P7
zr@8Xl*If7hMS0nA`ek`+U8?qr%*S8HeVc&{hv-zF)S|7mytAhYANg|rUGL>yuI1j$
zhVsTT+t2rAP$zEFKT<deGVF=QbHAi~cBYgc%?a-hO%_+^X_A8L_&DsWP{YA1quAfu
z?W|n5D6+rVOIN$d@mh5VQE7>q^cH-<?VOb$TnMM#a71so+VHZXRbZY-8Muph^i&*i
z8StDJlcfOkf4Ap!e0CxhY4@d~Yi72;t|TC3_aW&pBEzP{X_K5hk=p^A9MYheb1=vL
zd5r4hyL90yEjG{6O<n^|N_EUbO>fihUo3dLDDgT}1)sZDvbDAFF!@W2KuJe;<{@1I
zl$ulQ3PK#_BKL<s-vSNz3n&4^HmomoXdq-wBE5!78`o7Fc+j$Ef2)7kq9Ue-JT{HS
zPC;GWtLyi0WXEpIDeeb9hl35J7rtG?jrONiP_2PLE|on$Ms=DS!QEUt0o&-0x&vR=
z8hWGMu1^Sb(co{%T;T++O40wt);k9G@&(<(zu2~I+fGhw+di>vJ16#uZQD7qZQJ&n
z|9$TB;jOw~rfN_#d#0v$_wHV6btB<4`A<HYH?tnNz)^wNXTH<zNlmA~dZIg?hS?s8
z-nxw)w2Gk;P700H(CGf5C-norpxKV&s)!554U|cDy~k&?vD{*;8cB@I35f#gQp)Sm
zjGI1x)0b7RO{UzOGx7<?u1M{(qC*$SZpAZ@)P6Y@c||Gq@`SuVL)~qEwy9H3#xuCs
z+pMmSue2VM{|It=RgwPEQXPUC2rgZFSMtjgxOX_#a$O{&0R)gbsJjNrL6VzBB}uwF
zJHs+de(w>1fGj>{Mlb(Dd^ezdznr>>hpp6TrynQZbBl8ZCAz(?IQIl?aw(zdJ)yv~
zcaU<Vj#Gsj)aAFevpz88ZtV9p{iD}Cjq@s1KlzKBW0d;Eu%voLj_t$pIaOGDMqbp{
zqsteabV0M`v|3+*n8-#UrkHi}DP3fAv~ozmfsVp+`jbn7jq0ud1{X-MAt<F0I$J{S
zBdL=-gB5${_3h(GXsk3rnr-j;6O;z0sd4DTH3{o3qf|ZK{9LJ8I7##MWw9y+VNd=$
ztDZW?ily&;h#*MET$G+u&y<`fxAB*H|Cf$iS9IKY#$*ilCjG{ZjU06W=1b#9!*-L3
z*@pXbr^bI=io*Y4a5Z5+`K0+myn-NTe0%A)63>vK-~phi;qsVi?ut9jYBxO<+cmz9
zsQOnG=<%rR7^s<IH$3_p1jK-9|AJ%?bJS;yu$p`Ih|;jUzS!uL<<vtJ^7<&^4>($G
z9Oin20v8nq70=&U(C_^)VU>i(u)jd|g1ET1F{&{c*4Beeu8yOc>`z2F@cY&jL-*Gu
z7oq8}4sm3N(mQTwO6p2&sCgRrhLy~`eUBuDT??kF*9zI<E$36IBPco{-5$LHY}SKK
z@Q-be`>N^i7}GAvSa3hHF`)o6w$967(U~doD}6ZLCr2bJ{LllpRfB?}w-c>%0m^A=
zc$5q57zMvej~GS+wFGk~O7Qlgl-xm><bTXe)y4dsU*vvvBc?0Zc94}|>Zy(c|Gmnn
znCe4CbUC4;y2eI~x%+zUw{UgOx|U+~KPGJ$$TmifJYJCDH@+siAVekPujd3@$7^gj
z%|FKomXMO4KEI@K?o)^%m!v&-U9w0lx1TEw5-nMeapmXKTu|mmq3(Z6<-ZR!)S>~_
zyp}wKr+5!-`#cf;)-PFz%=}QA6s!E}_xD7FkyD*jB2V2<t_1#x^NXl@Gb$+w5sZqc
z)onc`6NA+i2p{TdM^Q>Ef599ORcIoR5gNh8=CklntMDI4YU#zeo%O6GTChl<BU4*n
zk;x7a04L$l{8OI`E;L6XQL}b+F0Iu40})NPz7?Q2n(cSyHLWDC#{V<|KRVjS<dtdD
zhV6Zw0k$@9nR~F4ZM>@W{;N6R{V20<6a$2Uy~<|VyD1md=3|N+BG+g6mtlkw+Vlm2
z9RDQ_DTaE@4JI{VLM{96%kFmMEbp0)He7%OM#&;a;2*cP_v8`SYI?sdc=-2;sbZs~
zB>7JsPOb_41woCn8vk^<{lxVu&8??uRZQUjYYIA2;q{%#*QW<NEZ1w4H2Pl$!uEGS
z(*U(#d94B(<u6(dhRxQJD)Yl<WliN8lF`29?rMcf%y+F{tA&pt>v^hlDz(W_VzyPQ
zs(<gUeG_Zaq}P>ugBrn)zZ}IBePIrXav7WRH?_7R@X)9USR)b_k)o7rWqK4|!_`*;
z{@%?pEJA8-nvIM28u(m>C~G<AD!kTGp@Kj?^I#_^R-uoJptHm-rdm>->?HqOoWUPZ
zu2yY<Q2cE58jrEkx3|2rv1woWq(3UcZ-h(TcIT;#e}{LjHexW@IzJ`n)(%&`N^uu|
zSZRGYUd?hq^tb+K3ysKs8P`Lil(ttDb-LX4;zq&aAGK!7Po4R>y3eq5*zTW*uxYlJ
z60GX-4SgY;bWXiW1;YW6zFPW(X(TPF%F=?!pfVD=$zMmcWc4B|K9544et{3ZW>~<>
zhOxj$_Vd9+na`$gd-mu+8cO&3vD^1bvsug6(6}+g=H@LYf@Y_4IQ7+dJQt1;n_0Sk
ztKP4}JqZ#0$}$Nq$D#CBPtb6f&R`F8-?bTD7W@MB+?B7u_th4NSUvQ=XyRA^<Lgs^
ztV~Yz6sj&>l5A3wFi!sxM^%i~hW#2bT^{2ddf}_f!IB!k0sm$vOR`5`nz%oO7F%zW
zwy=mYKZ&K<c-Xf#i6V8kR3^O4x<hmc10~-m&$QUp4h);>Jo<6K@65lAQ8a*?qQVno
zH^YXN=t@LWpn#3jSO!M^FH{@CS3~bIip%vR=0T@r-vj0-YLJj4nM|lgdF4nV%C<f+
zn<M7?!CTr7m0wNnF*ZwCMwb5Kw{Y~H(rjb?<#h9AxR;0Wvw&Gd7hr;pfN@$@AL{r4
z#%5iFvA)biCjSJ~(0h(%$JZiaN^P9rzP}jjS5Rw<XfyGF9~t@}m}5?mo27i07a~+P
zLO`M-wsah#6zTC2OQCpg+*PYqoDPk1vnDE;)26cHtp&OEWLZ==Pz%;Y%ZoNbOuj|G
z2O6RNc4a6`@Tu8jPPv{)bGfVVj`2;4eN9%lAT;Duja|KPPI=7QDA=v1_%c(VfeHGM
z?3Y1VA{}BIuG+GEZe?H24W*J>ZPv+_UHfULc^(Twr+0qe``(*#x;zvE<;%^7Ud#G<
zIT)stEyC0nZ$ZSpvV#GlKf071Uu!JWNgxV;r2zdB8Qk3<>$u~<Cz^ledhBj7uQR^v
z+omq9vMWsMhWUJ>blDd0^78Vw*}f`|gW)cKkH@K)MM_GoSC;i%_S+)$(kF}Dlb-Ji
z(3yRNeoh8PhO!b_-7w9gA?_ZPp7|*Q)oj`Kavu3rZ)Q0uIrUO%dSQnubvq^<)Wbkw
zr`Iv4FAW;MhPg6D6?9L)Ve%y)m6`t+WU@nv;atO6ceTGV!x~I1=d2_?_1!_^Kq)sv
z)mnpI<?gpf4(pY#x=g%Gs2t15X|_1Yz812z{~(vkJYNf)R0pDnv@@;zb4g^QW*XR%
zWdB3kEj20pRWrjr*yt%Vhh+H|_f2uQH5F?mkb%YH|I`%1AE&cozTpvRK}{0+w_yce
zmWly`(Z4QUhu`F5ACjs{OEuUmXysPqq?n!%8`&dqy*_H1g?~W@YB0aMz@j-RZbjEP
zLD<E*d~H^a@Ybu<NW0ybW=(U*Ty;3O5t?x4>@$lj^3F?qX*Gi97D(NsG|dA(Juox*
z*bQ>Xj9AXAlEsWswI-rYn^Mv+l4jSUu#@Na$WxB=_<mah4Odei@z5RP8Bp_F_fIS;
zqN(s&vN3g0Is^S=>thx!g~Y_<3-P~LfDtrlFy3*_5(kQwKk&LI9nIG>@GASWGW%1F
zK_q~ahS$Q!;S=rW!WZy5AURT|#$p9(>JzwhW5OXsRQ>(@W_wMr<RA}teTBvS#68~L
zrn?nmtiyS9i9MwTYGMD4{myQh%jGPou?pw2b`N^#y+5uurxfnpJrgu1IeI;4^X+I-
z&)7BDBu%+YWTkL0xzv;x9GLwQmPL+{{o%fdmz%*-|HwsO${=CtLt%LAECBwF7F(+j
zTwc}Rxn1Y6QG07&+g|2oZl_(;;VWK4)hp7GWW$3PvJ4De$DechdWp|6%Z;hFp7Js*
zipH$2iWks<{u0-<v={UpJWkiw2!ets>4rkN-6O9rVT==PCAm)1T~2mf{p31boNqhF
z0%n&J!!EZ_b;I&em;U>MBl7$Zf@kN$#vl}%`~rv_1Ru|aILV}~I_*J$!>x|DvD?hI
zC%O#VZ;$!v2#cO@U9Yq0!xQQP+~wAGb=Z?y^3%+dTOu|3TicK_9lMDus^asy?TjGt
zfkr`uqLXb;THg=GUaoi(4LMX+&uM=jt4HQ$X1eJu5&KT?5VzdU=x7LV3^v`@!$$bH
zfuyI57op+sMT4t8oNWuqi9I;5yMR**LY5=Q>EGi04f|&lOJ8NnD(B~WNEDe2#5Id1
zQHW)s_L4Ho(x#bvj%kwy$s(2al5M7G%)|%gp`^?9^BgbKuMP%L<-C9E9H+RrOjtob
z6d2YGcIxq)7KqTJ05c~Q<Q9x1_lFO8?^}_BgbEq$@hzzIGxw<c)?>XwHk=SKITkp8
z?qHw9#-(B;FtHrnI1R>>@|r*y-iV@;=O6{yhjbXTQK2?kwNBFwxP~OMWrTZBjGXlU
zQ`AFt49N(G5-R7sJb^7E(taPPpFD<*X>9Q!YA6iYZj4+_M?Zq6?~y?&p)H^d%U<b6
z`jt-}&+>-n022(!GrrkpMcr13C_-3H4P;?|z&%8*!%7^0*>c0JwtZKkC{$Z*`q-uD
zf>#!^&Qzg1n^&xh6&4lIqHIhy{*|z}vdbcKvM2+y6=b2nIsGkGRvAJSJ1mcZvY%YV
zK!tuBLVX-dhx82Nchl~Fwt1-kWx-HsP_GyrZv}Jig|3qIcF`+e&7Ad7buy|dw;f#T
zWq19VZTD75VP(ZhDB+}seX~VeW*~hEW4CS{Q>^JGDwDa7^3d5P%2J4~&hHt-=Pj`?
z_TCv+HRj6_0%XAE!Ubm;lKWA;vkee^_7W=uhyWzqjs6{WyPSquDMM?{KmYpjU7kR$
z6}bMh9~}u=-+{LhjM*7HljE!Y$=BX8d3VC$0!N4K;w!da{|x?NO&sg3|1b(Q7z?E}
zSK)ED#8f?Y&|?$3P_(-~&jWl{yw5D`&5%h^^kFfzdfbb=Uu)|ui}h#R>YF!&r{=u-
zBeimoD$-JLCHv2483Og(*+T*uc8z=Y`b@!V!*<K^&nj3$abMj>$0ehQM5N8-lOjYQ
zdE5ojXe4aQLHv4J<17oq242=u<B)r%)<8<3CuLx=jhXNXl9=*Xi~Y2%a)E87+CgME
zEH>q(@6ojbp34oi0bTqIeH{ov^^uuR!AbPhxRTY0fAhoc$Z9nO)2G0Bo)Yy!b?Jc6
znKHXx=M3w_^A_W3$6o?GhJ15u#cul+J2p+RKbS1BXYz4PZVG@1+b-2^4NbLL<NXNp
zd`73ktL{B>;Q1zPdyK)TYO|c5z@!k%*w8hJF2BMVNL@sj%j4>(BhoRHN7}Xf*AziH
zbY^$?2OFhGO?PY`6)9y?th!vb411QB(4i{Wu%=S;>ued7LP;O#M4UtzRhp+~fS8!n
z51Co>0wtt=TGQt9;nyx$?sy7d?iieiQJkwab{xQIHU6M<$R~u0IUXlawZJ*O;VmL^
zdNML7L7+lLLvgorz!;L>+>U0--?)w2KX*9s$2{?3V5KZKZ9MKFjXpYttRp97+{U&T
zpQ)?2UNfelF9!s8mv<~%@P^ZB%vj8H0{jdQA_G(`%1o_)ZVAM{rXyrAzDxyJezhMB
z7`kzbEH7~Nz63gpKKv^$rVGRN5WW`^9N7M`gqxM}>-@_O1`UAdJ@5&Tt{Y<A4apT~
zqbFs{`~FdY1^XoaXl$9r+Ao2>2lnL4GV$o?;P5Xe+2;3qzGSeWTjrJ5wbmI)Kug``
z@t!YFhKRCTcM!xCpt?!T9Og^^J>ZAP9dxvIpsu&Vc~M-uIqmZkro>?7k!xkC^W9u6
z3$zmeroX<f#Fo1}T2rhIm!7M|^Zxqa%^`YiC1*7`LIP0znl4fnHFI1_iJUUw41o}#
z4t`Y=+a@1ne+9{Sd`8Lgz!ZWy$O#wR=PJ2=PCep&|CGZM@~gwW9M%0rJsJLnLYt1j
zz-{Jt@>;$*8tzCmdvP59DE$!om-tj4XmevV9PKGT3Z>`=mqu9%l8>*Corgjj?}tl@
z(h+r~D%V&wzqh@iyl5)saPHHuxiLygEfs49kqk?7&=dh6do}AcGkoA;DyQv{PkqSP
zGFGRKv6U)Yg!er;=)}|Fm;qaTHX{@~)0#C&Jb-)^sZa;w;2S`Sa#2W|NVnkIR7s=C
z>Q}zfC8+;~u;tO5nrp^ztk3j;8Vs!!?y80!IPu%Og1#Dq<o4_W4zCY^`Qw`UV!~Q0
zULCg!oYmT*l2v1Eq4|Ll4Zxjg&3Y#td*V}<$_=1!=TvAZ9U?TKIj1+pAj9Q`o1|NF
zRK4PIbg;@vc&D$9HP+2rcY_p_4z#USlo9Ifth%s}%+{mQ%gK005LI|r!$SYob4Cpg
z3GU%LXyPL->R4g?OaQO%6%L{o;#I+MVWB@$@JmUn^r4IYDLE5}@VaFqlYmmT3D}=#
z$<80@1nE)PN+$^eaQIRq=I2*QT2{ZxpP6>k#AEaZ;(vbJ;nY2~>-qACkM!6pn(^s*
zmWW~F3b;<r)!;cGh!M-qap2pR=mLF)LIM<3ro?(SK9`djg>Ki;$WcODXnZaY$*pI$
z9Kn4sA6=h^>Sq5&5r2F8cChLjSIZ9D37(4e_+7al!)2;TADqo(t$3_%qeGX$Ht!H|
zIM6~1fCT&A(wTERxyJx=);Aq@v@~cgQu$p0mvQetfffSRW6o4#acxN=CRn!ZIwzE=
zlAvn-8i<PX_AxHxYZ)^Av1Z>I-R{d1tQke(67{$uve+eq(fYEKyIPqUa=ZIm8wUUM
zut4E8?0m@10}q0|q4T}a^gbAA{h)Bzvi%cv{f5U0U_z1lMMh4V=)c(+DHMrRogqxi
zbAZ8bss?{y^a?(J_a{WC=ij>(y-E36rI;*gY_qlEp1jfC&dRWrj=|{!FcED4<SCq=
zekv_RNMr#9^dCLs2}!A8&!Seu<CBc&W-FG*3)<6CEEQ@Kyta<2Nd_yG(~4gcILY-_
z3-(G>ly)^4lG7vD)znU;<6&;>%}QLArxRBBo4PkOdqZJbDY#lHNPgTejz+r2WAxx3
z(>mM{I@G`3ZvND?D$Om(^jjw(UWRNm!O;{<K8!#0tl49zUP(F(%Q_1JuR093AQ7MX
zHep^4&G#5SR+tV-i1wNW%t+%pfv}-cW$N$IgX{YV_p(_movi<fzXHr0BMsaT0_+bP
zqH7K+QQ$VpjGsQrf)0y_ty&o^faQ4xe>gd~GSU7~XYS<#)h9jh*_tGr_ion}NluCI
zspIV}H&T5LM1rSZ1p2L~bE^#uT}Kg<0n$0^FQ2lL-P*<co1V`${``Ex(N*>>Y}Gp$
z9JOx#pEo5nHIo5~f;UCaTYMz-=>(QW{9ZdulYpA7$A=64I+E(wm%;|TG{ug`W~4eK
zphVOen%fk&*kM{<pMi>bkO=yTwQEmMt+nNpP^Ftiwt4!tyA%q3sVB|1*KRwz@askx
z28E_yTV3_L+toE`8{T$b4rHff9?RBueQcH7N@)+Jr4_7XaI+1X$ugn5)@e=+PpPG>
zNudz^?V0H~%W5|7$&Ofk1rnbfZ0~J&CI<t1c~lE6d=P7vMoa32!iJ@O0c`+i;28yM
zG~jjHBCSx1U<*(h19bTBFSz6UiuuaE1i^lKWE6eY3BM7>Z{2~1B2fQX7=Q(23}h&s
zWLdr23M3~j6|R4czPT~K2n-SHAi`4NFj<HkXzU%G%wN`K0V06toDHoIf5o<Kc^OHJ
zi@1E1oNiEtD;g5)Iy}d+UVF$IpHy35JSeeFts}p*ppiM4YuJ8A&2M^!vwabtPWQE6
zI4E5d!;1ccGBDwx`xT4m$<`5FBr&(Q#czI_f!vo84Ax3hoep8(!`B3yRG+)kmx>re
zzE4R#0zd$&8AQ+|f-28<JFM{((~bAUq3^vb{Z5p%k7%@_*1K*R7F)m8pQNqxmo>;%
z_Z;QvPRl!K58}e-O~GcB+c}oH7&bNT>2G)R%a-&X=I*}Z_=KEyd*<GU##zRk>?<QA
zWEPggr>Nvi0f}8MPcCfbJNNUa^OCP`(}+!`8JuPW(wAEooBejgELX{|V>4J!E6N?3
zCLKiQxO7z&0dMPD{+@UYKWxvJm7ButcYY>q(1U!d&595F(Q;+MGyHl-*^S>uz9+@`
zN$svD%OVq6xMkXvCHUpLrrdpw8mn58W>ch-6;JU(tcc#va$7e|J^ctDeI^01kq#Ku
zm%L4&Hx!SqXxvGm{?}VmCLqzjFya0QOtcBUh3Vg@lr7{_lg~$iBPU($L-$r_C{jfS
zmDMaHT~Pb};ov{uZq0!r2@WoS-Dj|J$eC*MPiaawOJ1+e*o}6ZR=Qf!jA^Y;+KlUH
zt~P6as=l<>tJT`Nug+?Yg85lJ^t89dj)9Z|A44V3yFMVeWh%%Pz5{Mx$w+jY3Mk@j
z=b@;RFaB61E#Mg+G6RP;WkrM+zCZ4T?^1qgOj$hk5my+Q(OgipDbLC_sHLA>!YthE
z!QJJk-sLPxwQ=CN=Pr<lVwg?mIwpBjo0}!3Sr=*2z&Yjq8K(OS-m3~#{iqVB8&N_)
z)l|eLXi_LJ?(1gzuLEGwk{JlPkfedC%ML!WwVdnWlMM!7|4PT=b6B=%nT&hgX}a)q
zf=hcB8+KF1{^EWvO8CU*)+jO7`TJfk-_t$xa7|@=wW&9GdlTfOztMh`Gp(n&?z9Td
zqCVvPl(*0772fvxmU4K|{Ct(g5X<{`O=BnB>NY>@`f$f{XWP+KBaXeH=xs4x6W09k
zHd!KIa>es>0TUPZ`4)P4i7-cedl#w{b7YgzuA}DK8Dq3IK`mzw*2|>kES&aK%V@#7
z`X;`=Xnhb}?L4qtGBJ#YD})rBKWhvnN+7{q+&vg2;a`=nsp0I<fwzDF91u0&qO<iB
zIOB&Dqfh^&1@DxY_?E3?dkQ*{g8{WA3L5QH)aIluRa3`ME!Xfi@Bg~@;!#L0$yJ-X
zJbHsi1e-m_S`E4)&26qI;Q#=jaT7SfXr_llu9Q!W38&nH(v%e_MhvF?$ndk0qbBFF
zdao7ySh(r`Shy$cl3ua48og};(F6f;z<Gbt{p#7yi+H5J`?~yqowcNDD*+H9A{k%`
zw~3Fue_=VSldpL<EYMA<<ZJ%uL<ZW!#&!}z-UKoz?CXB6*6_RbcTE+8?aOXlB>#sp
zkpCqc7gD!?4jwyA`Nu%#aOaM5(M7e~s&3bl*L|5j1mA<jLb$%%Ws~L2IffjNc|u4F
zpSc2odK~M9Qz0>sbqKJ8VfVlHy}=m<0O1`&AV5tG1|Y0*Q}GSY;+x@ms@%keOOpfV
z{;|%_(TUz***{u^?t+&P-nN+{zOMKBZ@9AzAv_KVz~m02m-ySw@}`2j8hjGFp4mg-
z#$}twb7i?Rt?Ma#{Lnh<T{O=0m+l<EeW>|kJQTy_+$NH>zTT+*B{Sgpb#1P~<t^>F
z{){j@L5RV7+o?P5uq=e4XVfNNEzFm1pfdL-M6js|LzZQj$FP1)aq%8L?C&*G7Q7||
zlv=2LwOJWJc>BmN8_-!zb7LW5o9%7|0RCl(!#ZhwCHI{6myGFxS?|lm`X4o&U^$J0
zN@Z8JqW(08We}KpC!4D^C~9AQZm7&Su1dIHPIy@_6oMJzAJHjmJ7)D`tC{3(GqaG#
z^YT^md9*$GXH4cnxjGUlRb&Y>)XkS2#>_2>22}`x9C2vgmLbFnOpfR;fe2^M1q2d}
ztW%_;W*QMXn`W`%Ysz+3r+nn%s*r2Of+Uq+gDy@Ue^;aX?#7l*?`Dt1_!^YjQ23tp
z=q!a=AL2xp(FV^{|2w6-&9FqtgDU-%F$U+CBfC?nbODGwSFg3k8O&5P;vNp52;3wq
z&7Eo@1dd7MkZRFTT~?OKc63EQ9Ev0?6uQF^4RCYCRz~r1d%%0CHKpoX4?J88NdOH4
z0uVQpVnW>DQvf|XRLy)iNUX>|&+L(UtovQk?eHm1muofQ_c`zL*tV|PX*kr-as6u2
z|G>E)D&kU}Hf^-rI`E&FCz~hXap{Bxm)bJ~X1IpN#dfaaU$)3&yR2#_jyV{AYY+fi
zdzB$~%nJgsQRR4Vlcw6^?BKvdGg7Dn3jF4wA(#Y_^E9|14315QATLEgWGeHsyM%3z
z>3b0ai$Tgr_YT3-qUJ|pIhm6O7^uZRB@amdZhIRF`_;cwwM{JL>o0jeiXoWcwI!uq
zn><yfq}gnMQDz>B(A8KTv&lNDm9$NkAfK{_=1E9?weCi*SS7$`3uBkq=>QD^T6-{W
zSg~ZLwN%E{9}J&JnOE8>R@E!<i7lf@aCq9n#O0BQgETKy`VI`l5!i}>@VJ#AWGk$V
zW8`Inuw6}$nF+zpQ<5cQ^bFJ}KY&y2HAlr4Lzwft-ABq?=%!K+(MGTU(h<Pnvp}F^
zHlvYv?p){9;oyo3g*-auK{A^BIn>5!s8*m>yXDR*0ia<@YxYUx4E(#mgOq-5+%BB1
z1o3qX3zIOlmN(kEl>npPwO+n1(G}X*bX-bdYrnOjyu)A-Lp~qRBOAp7kvgyJi9mLE
zNKLZ(UT2@1-&AN*ReNr=F5xP?DF$b%sAQ6<xh(>6fev;bN$_piH*~GT7&Lvn$CTAv
zd>2PlOEh)WhV}Yj_7mEO&-+@=Onwpo%TF3h;;F3ILlvlnnlONEraJXU(N%LaOV4L7
zcghO*>JKD>TrYvsCeDesx&BIodF`x*JdvIpLtBdfQW5wFs?W@y3T^UStrA&$iMctw
z>yrS)JrGvkY|__0n9{1nFYFC1Fn>E=d9H=}RrNpL+k&drrTeBukf$Ob(Utj+uzeEw
z@4(<0H{MZvmx?};YNP2YPCV0JauI$ykmq6&^w;rnT<Rvhg2C{=Z5=YR*{r}99eBvx
zTEtXGDv+`bc>1ylef!o#%9P0lXAF=Ym@T(VCw;vVSlt5aFPVle0;NMyr9|^x@$>5h
z9zmwL3!6xaeaV&PIZ=opJ5_M`a#TJK);ikAe0gfvNjOt5DQmuIr6CKp1TU!=@mMS5
zZ7S6idWuolHP~uEV1)<)szW;K0VO46j;c51(7mFea^$6EuV8c)$ZqnFE2<4PvQG<k
z%gLKA`<LTyKCQ%yK-k=uPhdnV??cUwm!Qh2kMHpJB2lT6(H{@<!eDtq1!m6y*3Vyo
z^OvaVeM{Hf&d=3vt@T~Q0eLT&`t3D(1);Ss3VFqiYO{ksZg+qcgw=j;d)eDldF5&Z
zL+{%#WuApD%~LiPGqgTej!j^^7;d6{OErw0vBFwEl{KUEjL+DJlG<<F+U*_u7qTB1
z8|O+wP);F%2<{`uZ!iNu%RMzqAh;qy*{+1Hh`<>_ntULTg8LWwmLC@$bJ)d;W`VSi
znW<*q*o5%(EvrG0(jfp)gT$&Ly2$T4JSAne8`3kHyf}AZZRw0UmNDs@tOXbx{|VpD
zChs=vwD540rlcx@Uwj82K`PWPkIH8*zNjFM0S?>#hG-i)VJCG9<^}n4`!%VdEd&ac
z`Y`Q`(p@1xdat*I_0J?`ixi@2Q&N+{AEHDi#-A-q_;iv@lL@c#YMGP|88j>619jS5
zUFg;N;@A%@RYK2m3X6H6x~jGHRz$YAkKelQwKjm_zMru^8q$M&0H-=pxY^&es9^A6
zGIgikeQ0G?sq&6(>nXeXt?UhLUGthZwZ*A*a+aNyG{_duaxw{tis|OS0dToeOr#IQ
zqCN(eRFWtGXrXdULe+d)6C2$;R6@b4iWbX#*XYu>AiL^%=g(UO=uR{y+{24>F)6r~
z3ldn#ermxCUF4)+nfb637Pa4O4Pv<EE6QL1sqDRAOdQ$Mgtr0{NeKib1?r4D18tSM
z&u^KYy(;o=n2e?U?Db%~>*+6(xJ@WV)&I5OEGKZpSs#;`fHt5`&k+7^HTU4nyPZt6
z%@Tqi0y{jry{9gLo15QjSSHIhuj5gp_<!DYLoRlKu9*+N{L1taQctbf5W>&db)L3}
zI3)cTW}iHMyJsIBUV+&g91Tk#z9gn<53@px@F8kP;Bp`SYx`Gn$6!WJ`tv&s9`mv+
zofL^h8iSSZpSWW7ltJ*dZ&xA<)&y63bDuq1ey1B^;9l;17;rCsaeZX$=&}5%iKz^>
zpt08M#Ewnnq8jYmyqw=~{GSm(l(P;NncS*BeU{J3iYz16QsKK)5#2^1ns2nQe*QtI
zU<6dpXR|Uan??jk;4l<Ujj|;lNPZ~c((tiQI2I&qs_51<&gXw#%S{=4KOHHV9<oTC
z;|#FG0754!R)Fd09i2aBF7~(eG7tEYA|M*wSb#$OL5$Lg5b~o~UK_4a(mM4hhXBg=
zR>Rohum7TGzt{1^NRV^(;$_DL^3VH-$?>hP<s*G!{r3T8`_=7g*a@He@9uv#g~E|?
zI`Nov5wj#gK&B5LMSfIG7{6aVv=d-ze}5l4y{GcGygkPm>3?=H+K**VPdszAot3$8
z)6*&tw75>6=VH*czm9LK3w#d0$%wC{9mes_jI=#2vAxmbD->v+pRN|Inm_m;$ef=B
z<@j~%oldK<ZekWygVoGVe?90-CtX6wt1|WEpj5w{?*ZNA^mNtNc<|f8G%R(j%~`-S
zls_#N2?-zhee73NZ}KSL(cQ%1biAa{ywQxtb=In1H_Aj8*P(C$OAdk(@kV2GR-iU*
zBwuXix>_$??4aw-xyNTB3KfVuiUq3E#$-yuu~q)%yWT5dzs-pXxpgDF2bcpjj_^`1
z)J7Y_Ma*<d%VE*Mb!%j-iHvfM>Hfk#sfyE~n0`rd>CjBO;Ye&sZ9trJqAq%slG?8q
zoI$p<AZ3s<T*5{aKxT^)G)tzt=1IEOgbQ9VHQJ<)6%<xJY(%xEo5%@@GWQ<Mx5GgG
z7IJ*HkHQ)Rwe!pQ^chHaIb*HhOZJ!*+A>dxx96*mbHoU;6m0O^o|5~$GYb<e`JC_v
zf(wB-0cC@=;JgUQsY#<H`<{@vaBL*bl1~0)0GCr45)Mo_<fMtVK%=ITxyNktTWUmr
z-t2m(3H}A%`nf+ETD&sN)C_U}1&rWk-;ect((+US??EHm%d*s3VH|_m&x}bO28DoF
zb2JNLIk$0JNlnlBK-b8Z+U+%=6-%Ym$Z`}8-;-$U^|z3&)Gf+3M33KhudMO7--a1O
zS&)1y6K&6fe(o|C(EILQs#_?pn|9ANv6Qdmz9LCrH72a{+%FHNe!C}5N#sJJ0RKHc
zYhQb@Z0qN1wjySOJCBnfTP6xC<vWujYg`w}6|t_@K0h>qvTaF4?fbXP=GVAEpRanu
zNA}e3l^Y22*$o8f?@CYrGHUDHC*$(h8j2Y7M>NS%i0)hzfp7Ioylm!nyRn%3C-TRW
zs*hh3^{16~_To4z4?3q0LE2fXmaeGkPhG^YsryT5G9PWT`%6KqOXReH@lMI_c!Y);
z#uQMCPy6|o^`xBRt-G<@d7KKLnfD-8Tc)}&%jGqLeX>G+ft>A~tFi-_@L6GU_bskp
z<#iELJ=qNIdWyYfJgWWhYm25RaS{vqK9PKg&8spteP$&h0OdU$JO)9Bb$xwW?|rR_
zqKD?>WkX$B?F@UN7Vg?q-Rp1uS!>)jSqVdM;-RrNt>#kfi8|i@R!J6b>YoJr)KYk~
z!})BuxGp+A`(+ynAwH82bb?|3MtmyNs`2OTHxsGjzguy1*>pcVcmKAd=HM}e_V)wR
zZipHGMpJ15UWey$DP%n{vh=h|af{{=dwDMDrZ~v%vH$5J0mEy9KqIg@MM%pb4tXm1
z8B@6-*}hHoWZ3y5wxUTCGJC~R*4Gz{cZ}!On4vqtt$X4ZNBKEgMgIbSU3gKc%2FD$
zj@7o#r}|coB!4Cu`0u=kGei}=AI$x^knb0Yuhb~-;;dHEy8B^-+5U?YhCj2OM<fd%
z3&Xc)ke~d)^B-cpJk@Auln6A@Lt0i!;Czc`m?#KY<&w?ydeq<)(ub8nWC`C0a$-f{
zg<UPp_viuw<(T-%NpY9bl#ZGjEI_qq^w4++2qAoUQYSXQ3&r4DnZ9&Ehy@T33`;={
zRICAj#QoK=m`9(jssbW7R1?W1gy~Ro(iO4jF`olds!&`=aER;A{WG0{1v6r=#=Q(D
zmewt7!>IPOKV4fnGBuTOUr2rIMcKs)Y}l>bQ|S29ymt*n%vIR&JG={+M=Vut>$hIi
z$lKbiJsoG?EVSs$*nC*NmdmFG+36v&?jKtLVi!`6WYzV2UIQq$b#47$Ul`=|z1JIf
z9(_nF*y(G&?yn-E#`Juimdv+$Qh?b?Tr0cJ>%+Fjms+N^lg(mE%u~(Q6A%QXJ05Cw
zdDLqrT~3E!&#0;LU{d+LRSTi)lW;d1@7_kfZY9S%TGp@h<&Xat3(#NrSl!IJR;Vfa
zem0jE$XCH=@ERk(iAW3l)E|VS-~BXNA|O560N?9w!;cVy5~>5k>EY7u_yR)qe2^Z%
zVo=Rl{yNQdH;lG1)z$>Md)ptb4dlOgGqyQ4o0~j0j1pkQ(eBFRutRG&Bj{hiuDbeN
zq-152(VF8uV46$ukWC7U2@7xuq5Y1p-fucfJhZ82H2FK@#<a7S%#+-;&0a-8X}ZCd
z_M|CA1pq&nOu74;xLq${Ff`U@HySQ&*+aI&#(S+2q+Vfs1<46Ns;!sz$$*r9Jfi{q
zuT)mqF@ip0F*n06{*US3ZBRoCU_dRm?c`C)FD~t+(GFC@8QL{FD1&1&mL0eyrLjuU
z)o(JaCjY0Z)L+fjT0#hB<8o>|N!axol44$F^Y4dMHBcZJGx#u+U^_c(mX+;%@1hHw
zMx7@Z>^HvDxQdR_Ykx^%lF9JYmQz?4*h)2hu6Fj~r7gCH{FBvF0Cnb5Z5Mi^zC=ZW
zmx`v>$781m9rU7HxoiqLJpxINt9`c5x)=}3;=*FRnu;w>E*>HQq&(g2TrmRpUekM}
z;`BjW1?=mQLfNeK%e5yh`T{=SrvH>HgnO-RakIMX!1Fpg(<agh+8CpOJ9#JXzCgfe
zdTMw+fn0_=C{pTID1Q11UoitqZxU26<NH)K`$|(5(Uyp6G_t;p2?Ez9qK<bwqgB84
zUCj*C?7dxXEm+TY2-v%v1kF<dv@JKMWSfVxfvxtf{K3V`=K$01%uW%g?-!efewi}A
zxl&qeM?JVCEkCfkkFKMbX})J|UV|J`mGhPoK3uNozG=tLgS+#vd$jh;XDgdv?R*R^
zQ_cxy)i>shyEy=Q+E<*71GZ|;2IT!|5MKNOS!hMte)`FuyJ5-V<x{g%%H`N9U<HN-
zq=JF?x@Zf$c$H}xcT196M4#nGSMfuxy&_GWm3*@mS)UF%t%icihAnnY()4KP<j|=x
zAr*<&Z*z~E=+za8h95U0)ff#!(#5l@sR6)_aPsSeyy4Tw6slL`XPPx_l};hue=Kr`
z01Bz&cTqsXfuSf1wRcCa8TaJ_xLpz^q+?EPmxv8=`CZkBVgTlrLTZSmtn_C-8Hu*B
zD>udu$G^))fE}0Yl<Y-o@J9!poR0N;DS5U%Nj}MNrQxAE;hqRWf1@K)oWn-_#;NSn
zXsskP8cDz7+xw6eL*brT0HOL#;DuQjKUTOOAW7N2>CRo7nk8)RL^}8i@VoOup6gLu
zZ4*<q(+JYPbjV2MK4lwwdFe3=s4|PJrx3O~@<~S`A}G}+9^rfNF=yYB@bim0l>KYr
zQ>u<f;j7qb*$`kLCN(#XSs(n=rBx_6X=plq4EOw$qZ;oCLsCN|g;v8|h`UmWdeE4b
zTPkqr{-ZIdI|HU`uP6AAZSJFGka8Oa$_e8H;`(&%!>#CR6WcesbDQy7m1*HcfE36f
z&;7PzE<VTH4RQbRT>SXzWNCZG)bYPN%zz!kAkKXn4t)4Q@(ZWZ@|Iz>=fQlH2wory
zVL12s@j-4Ou9ZTy;?ckIlC9gdudu{xSF{R;tK(jB#d5lOIwqJ<7<CJht%6}Fpk1R$
zi;%*@i}Tksxj_}e{M@L0r-$=k09C|W20-My^)kI_wW3Pow&<d3Pb8!cQS#q;Jkq&u
z$ujlY_b@a&9yfeW`EhI!#C~!p2Yx`F%3WfU;~DqS-Z$3-Mk#5>PGI0aQzKG9-VWOF
zS0lZL^UoNCFg~7viDs9jgXHZ<sm>B5)I&DFbo0!q=l^@V?@PU_%|Aa)E!ZMi;#8Mi
zM@yv>|L48`@76_EU3dBae9ZszHU59+{^yAOm0+-7N8!&7`zk+Tr;ubSf*#|}epmyA
zF>$|h0KvS3C@3bqJGzW+n5muuAtqstpI31VfBaX4o8z~eS0oW2=#40krpQ$&6~T41
zO?pcACKo8exkEUsZtlNg4_QUwAWyJDt{i@!b-uIYa{4ibj>KIFi5e!ohZgKT7tBAA
zkg{v+BR!GeZ$wp$VA;@Z!?d1qCtFl2h#qq8r|r<!>!t5MZ=yNkYY+e^mYRNbJEIZt
zmwVaDZU~a;Ki0L7;QEn|cDsA=uAQPFH!spJ_gv9S^~X1(FZU!H8=rx(RG2<^?0jK^
zJ21&Xu@;8^Tvl#@%pkI?Gqj`6Lol{SV&kyCbn!f@!!3?mFN-vX;*hU;V>y`moqbO&
zF8Ee%?YdO5bMxpcmU8k1mUIyrZ|zoYmtL#;<Qk5@RW>-|b~jd>#93Fie!F~m{g5id
zzG_Ba{eVOnkX*Bmf1|wo=f9|fLj%{{S6vTJrYFuE@67`+B>!L_p37I$^*9z^Z`Q8E
z?u)aI^vCgDaI3CzZbzVi>x*>^A!&_Bw@`-pnVHYvHcH^K{aLtBj5W1?LH?GYbc9J1
zMwdc4B05xD9=$_n@QgzQXFw#*7edwZ3CH`^qGD_5>zdtcXASw5_<IbBy_Jb6l_a1}
z$zCj-a`sV9RoTP&?&~=Wv~U!syY6;3KT?}9EZtB|F*xkXN1M9LHfcH1N&9Q5PB(7+
z@M&1{iYEVgy1MEdXW@WP7_(jhG7i|`c8pJI%&l^4iBVJbBULbyW<hkMn>Z9V$<HsY
z4^I-HkoR#L%^wh6xLzcjCd<_xK$D%BD=eV_Nhwh)Fjkp;$rtU^3lhl_Mg7d~(VYxA
zEXQM8@uLXnG5qe>4Y_Y%c+=W2kXEt=!Fc1y%Z9VsacjjLPOw*?aLmo%iQ+>)j1#5U
z3gtC<c`6=a;7mzsAOUzPTWc@~E)?JbGnysVVTWewHc-P|iAdfi8QBfJ@J-$88ds<V
zU;c=m4}7?c@T%^s%t1V_HAm6=02;bWXMop_UZ(FmN7!9w=CIflIQ+K~lr{QtZ0vqQ
zby3}RQ}5f+I0GD=#(_)=@=kZ0vd1#)viGN@R!De8VS{BCH*vPwVO_o<k^sv)kK@Uu
zJyvu=CmfVUPcw`qOP)2SssQ!zt((WH#s{6FB_nHG-2RrPwpm%Nicie1(mM5L0?=8x
z_oKGW8kr&T;-|p=ZP(0=ftyY7^g&PsJ>|xg+eF;v(sYUuW_@J5gcvMk&?K=InJkbe
zVe7|#N2n;LCEV;i^r&;a$EKF$&1X82Y~163P4bXVB6s)a`y-7@yW1L@Dpp%if@d48
z6TrgL9LjY@@c~_qJsq3>mvxtjXkkjO+OXPU&Agg(^u$W2L9{)F{GaNR_errnVergL
zQNO=o;Uk_;DAC@*I;B#QF%Bop-`iBk{dVJX7O5uXT<R{#-1VX_pWO*lFdR)6Js#Up
z#a(p-m6}wR`%GVF6SgKhK}k_!B0#654ntB&qxXCqyd3E|wl+H*@VNaCST8BZ#8RIT
z{nx&E#2=%iDh5jQs<tAfJY4rUD9}OCcZQPC{ju5XETGO59%pD#QpI^oQD~l})n`g-
zuCeZEMCyi%y{Tu@D}PwZC07(5wX(Cow<oDXAo$+(=ie^&yi5GBX>8#C`nI>k6CCkJ
zCrS|1bYe3$ThE<TYF#@|I727|`XRBbxo?r-BHLQ_bM#i~pscA8c~GOw_SrzH-!PX_
zkP+}=QW<!hJZVCASH&6I;kUhEtT||VFzqlMHjhhfyq7Tp$;KVd!`aJe7fTjL9KNYL
zzX3VjNa|go%uhXgs>PTxcOwZk3Paxo`_!E61mXdd+fF<v*3+%{GaFRC3$NVB37jbV
zal4C7<mQ{**J|SHJ;H7J^9<fz`_-ZcCjF~e^=I+1Q(dGTMzJMd?*hQ)WNzQ$4Z~bJ
zC&Ckdzpa1j-#g7~tiKGcK%2iKae4N{jlPCXgd8rHORdfM??}14WKlXkueeqJ@{PoH
zBt;&MEpa4SVF1)dizMem(zZ3!EE^_p=%d>M#@^GdQEf&#f+c?C1s+~=H4uOjo)9ys
z?2Y6mvqb*jh+smQ%x7dGMnMlr-I~h_yN1J+ZS#LYFvy9Re6wIPlKzHg%SgVoqfvzi
zR5og5xUj`s7UNDX%?A<H`6a(SAHEWdh5c!rqqkEzR7Y5u(-5-4X$`WBbLWg>98thd
zkbo<r3$yS2CMGf}(QzK0tNQ^`6@@C9p3^+S(W<2}$o1%9vIde}E)pgz-|U&d1AN1^
z<t&kCHpZt@)2T!b*^BOIiBc8SA!awexIQ$C%3-G9+$((|5g8V;MIT=mx&y+;YlKYL
zu3j5`E;Bv7`0K&Mx!0XIy5s)H6)s(auLbXwIILSdd?ANrR_RM4xu2o0{87xD*}D`<
zHEIO9<_(dD0SaUVnw}o4e0=$f3+Nx&{nSRf=zZEx<K3A^Sj=4tdZonw#Hu*nKl;*0
zfd1++yz8PMPTQ|isr`;|m}Z;I-WA8lujIY|WFJGy;tl>&GET&>;fEC;SF+savUO4l
z^VM?k`tj7%U^9KJ6?EJZ_Vv7S|E)**yJC%Y`v;JR<F^7k4oxdBIDu`_x|SNpOSPU&
zxcMHR6&WgvyO8_Ps&T@U_yz&+Z%8`yCMB2#jV9$ptv2y}n=d&txyq6&@J#$u6oVru
zitHAIsFL^lJqH0tEYsD*vRm4aRfr1QS{G89)RQs3;2@Q?@c52yB3%&20$p;OqUh_9
zC+SxtM%Q}$086ez(Gie8N!VefVTd-Cbdr{fy}=DIDrHO#sWzub!=?!67s?<}>P$Rh
z?{EdR_QhTTI3x%}?^~v~drOCHi0IoE-P4tbC^X{&u5zqj87fCp*4k0azz$n5c%b=b
z`NGT0E{H`u22C9sU(=ORB}#Ari^OOgUGwe?B{m-H`0~Wu3T7jL$&j?=g9$O&eZxyg
zm=|3Bp3U(T2;BEGJ~^x&rKmHA!(AjPnJF9#hvR{OI4*noOBf2!4!d4XVd2L=+DC%e
z^ph3!!SK+yj+a{sU92kh&PK~iZlPT@m|({(tr#1lrTj6!W=<2_+c@Gxz`u>oT)cOw
zvc|J|NkAxnf8Mx-GXt^x0=}|RkA;~Fa73D<ap+v0h0z@lP-~2NwKLxI?7Wlc46DNo
zEjBJNU}CJ|naZo%!V2C>VlFDyeRu~A^52HHKi+#imiSK+?nYYT`TNf=aBA(`(rcIj
zuXa`^D!Gq=WVJkLFT7;c^)>a=MApkv+>mVntCz=P`Ms)*HwPv|_#?Q1yer5@Ah0yJ
z+#Y|oAG)CF0^~*)CQ3&Tw}S=7)(7~A4S+CYf0u``3IbLRcQdL}V&W_&Lx%So-1Y1o
ze{2CI)oo;Vk<-Fj)k!C~hm4pXnA~5p&JSZtCuri0fvM|e?;Lac1?rFoVSj#)g|1|o
zbfX1vK%}=yqU!hT=-s2xc@0AwY!n`@eG+k#W)E!#E@VhTWBhS{CKD$Chi}lgwBS5<
z7|?teaLJ9AgUAwRE!LtjQw4)BH3Uex-0rd6?Xg*FamVRwsQ@1w)_I*FxS4*WTWmqT
zGBH<QUV5t&Ja||jK#qp_dCxAlcO#s)mch0Mn8kD8UxE{=onPQ(3<214M%X)fo*Sz-
znBefON#_?=?84bhpf97rlte8osdmQ9lrOA2_-<&JLq8Zmk>&Q%(ffmQYkavcA*HE>
zs~X;7Tp1g7gy0^-ppWta8r1&``Qw9sYZ3rKxZ4hKliGdr*FW&0!2P*_oXd-zCZ@6K
zP#o~n%uwWH9)>*j55(<~`HF6twT{cTj~Q8U@@`~_LMZ@nJ20k-=?w~_FJ^P^&el$)
zhvy06c4eJ^7J&wd0BlltIZ%<iSE`zdzCfq8{`@Eum#%>t%=Y~&MLIWDg;z|x(t3XF
zQ9{XdsU%+r552<dk}ef}n0{cKrS_DLw+kW?eqvX|VcAIL3J6Kz_rI~hv&9v|rC9Zh
zI=Ribg-&e>v$(xqnaVtPuggxBr2>x{;#yCY3CfL)*B%dQ(`wY3BFQA%L@&EQsNS(S
z9Kx2)Ssghe$?!UloQ`O8cxC1lu`5pN*bBz$h9dSO#4@pAKTqLIk3hg~%0uG#$tZZ?
zQY^CQl7!|Ny6@A2n(bUA|8vaI?CPjt*Jf+B%Jx6-b*)K><INOY2V8T`kWvERiV6r&
zNPHBME3^Iu{TV=wTswO^{lDm7C(8eW4i26FLwyak*Q??CVOcc1>i8$&r~|mOO9)tE
z!d*-IAB|I{jpZ#dP=G!Dp&X$*F56*UKC>B!O`hie1N@8=M`u7rYr_X<<)TQsjV!>$
zfC@rc-ICQwk%;q1N}+CxnHRXG+DkG`I;=&}=IobP0G;C<43;TEb{|8pMpS5=O98$Y
zN=cc>mJ9#;lcP7B=vujR-p7!n{y2km04K(NJr$#PZ7fqnW{=I2qWX6nn~l3XW6MM-
zX~)h}U)vbtJVr}o^hal5B6JY)3@qu8Ju{ZuT@$KZ43PlIEQ`&)La29krID5F$B7mj
z@sEGxG$<gaQp!cBH}ln`;Q@B|!ofrCKlGEvw9@u0KAf4D^j6;zjU0gGQod5MNP1ai
zFu7+Z|5+_nqnP;aVNp0VK{TMNZUtFNxar+gC~1Ni!^Y%N%0T{<vzU11>m_>`C1g6o
zGNd$)QX?m$hINUfJ;E<O!gLJnPN;|J5Q#5n-5@H;4(f$r14`#OQd!8tQBssfgbr6~
zHbx_;vR+m)qSeAk+YSLdn$Ul7F8MSuuLn4~rq0sXC(nNL^|*!9Y%KH_*XmA5vS0@n
zISTyXb2Ov40l00ZvQWOWrkHjEHQEmKz^<YGf`zP4$-*OhLF+roVbeVUEU>Av107xV
z^9>Sif;S^+_!8e}0&Diy$PbbuV{uG=Sol4_QQIN0$f&pbh=n_gBDN`^#NfsTpzI&v
z#%z!=BZ-<Cn>fogf+;BWMvvAnnxZ$5ysWEmYbRyy*IJaTFYYLap@XAz<y&q!B5_N4
zhgUF$XJH;bgyy>@4UO1rSS>@lRU-+T%*)6qZ{Ypjn2WvfP>_>D%}S_1v$yfCeL$^|
zw_h~?#C<u`Gx^NlYoXVF7|p3e-}a`bIN>NvX!W#1$3ERJ%{4fMNoFRYy$VvnVEZ5t
z2rDsjeL{^GXtn&&;`XLS?Ek?75=0nz!Tmm>jnP4$deQ#eS^=uPv5F!?(I0}Sz$1Vp
zUg47~oj8?Ro?@db_NV}ZjJ)@#<nM$o2>erGY$6tzj^#KMjj$un`$42CJiB<I(hPl(
z5DuFt|D3aBH7#Ei`J9bk9N?@z>`!SsS3sV5BR<tG9Tq=Y;Co7p*A!rHMgC#|WHx8y
z1wEO6+YHg<QCAG*rN7_ELdh__NE55Q8JtQbvDna+YF8FtpHu(wcGwq-kK1pc?c!Ft
zNBx-=G&}euo58HG7wR?OtnIeCH6t<14c^0Ej&p{~QmK!26y3k+UoiI8?G(!iZBfx-
zhXC85s|B8&bK$V%+)6Dp*=c;?IMjLRemul*aIw5g2`PLPUZw3%Jjh*a^~q983WxtP
zVuI+S38Hpn;RyJpk<xIZKXS48&D56@Je$wL`6?_F=Boq6_kuc*bONrs#bfa{e;HV^
z(3OtFz$i}Tj7UDpxV2kzVeyF?0LVc}DojNhs;nBQ0wZr8N5acm*|C2FJ;iPH`R{6j
z_Kj{HDL`?9Md{H<d|pP?b*L<>_B#F_0N{!`b&-$Lo$&~lY?=<t8@ufeLjRDC{1Bq$
z<!ebJ@ozfwV-NrnGLpR};REu>h9I2S*iouG$|UZRvl-j$75$6)?VgB?Ey8_@%UvC&
z<qg_gmZ+YrWGx3zqc9T>&J)~Yw!CFo{pV1qv4bN_QMz=dYizJHgg<{AW+()ZKTYoc
zN7Xw9Nzz4I!_~HJ+wN)Gwr$(iv~3&Hwr$()p7ylux1W3CMtt9|%F4)!O6;BI>~+>&
z%hZR=Jcm;k>~3LN%97VQ8!fA3eRXaOaagIUzg8~1OSj|n0bzLJxGY7hT@Qwo96r{z
zY6L8Gh8A%EIXr&HC{1A+y~Lzt%^sL)eZwdPd=K9H9tzrBBao6fclqLIiH$O0N4mT~
zX#F-wNfQF#>ACRmLl{f2dA=GkOUgO<s`+UnpnUzc&{Q&zzfWt)Z~}W=1RLO9#|^$z
zt;@kE&i&K%v^=Ib<5jW+gjk})9F0Q~0#TPuO_!A{aecH@nR)3aN8bo+AnJJ#-D$Dg
zPfFEZ!9-D3Z@k+&D+};=CIj}^IFafZCXw9mTtR@t&FF?b6oV@0q1`PMZRG033zSPl
zb8gz)xL=I7AF#nVpsBwPc;AV9<W%zo@vcNWG?m`h58V8UC~^hV@j>Y8{N@%v%*}!G
zcQWE<M>V?hd6?|$;8)}WW_S=O57&|PRerdHOFj_Mp2p{1sTu9(GC*0$8!(@ASe4ky
z11;TqK>~zBgKMb=is?9G!IHHZg2{0L8Q22#=<ZPNNL6_t@m0^5r&Ma+(i>eprXPnc
z>$A(i11b1#`GP^O9{e`SKWc_w0=4hcf)lpqafbnhc3g&DVjOyNzZ>6e7vIYaMB2|;
z?2ouYAi4RXSexsJquu{wjiea!o-5dZ2531xsC;+WR@mw-t3NXvmG9j*z!Pv#8JIj|
zqzCY;TUiM5KV$|N#JVeO)PHKnkhof3kG1{D9e^Zf7&Ia9dFRpNzk)9d;>D?l008Z;
z8IB;V{t#D~qh?C0mOjfBd*!>ML4NKNJB<ErWN+-SZC1f4Rx9225oZTTjbZvK2F`O3
z5R>pegv~f$5v%s!%iTM8rS$!PG!*91Z@6VGErnJMy4_VMB&hWB&|N<vs>L!ASNZvc
zgv{oPs1K{TRPbdwwZ)AK=eCgc)%{yXjdyZAIlGo_eXz!m%2c8@Xm`Fv#vc*6`uw;Z
zj}i*zw$+4G-Ls*stF{6V!K~Lb7YS@^T+b>JU#8LS-+zp+BuJOis<+JHRAbxFE*6*!
z3B}&nB$(Y`3j-0J21-~4TXL#-TFvpW#HVXgN!EfOzG8Ws0f;pQXN10vhXcutCyq+I
zi)=z0UZkUhj4)YRR~@Pq?DF<_9UoL%+js!#=e^L&_|1$TC~l9{8X@rtq>m*z+Qog5
zF*Z^DNJhW@xmjtd8Lk(|pwi~$u+LMdIO_5(xN)Tw#iAPqg8wf10#ZPRlv5D1AsW72
zy~<OG-ahq61C2%dX9@Z0U)LZ>c*IMn@VNQ<C{nh-p0M|HKAAoX1PELKkzd`{xYgFv
zCg{Qc5|yPqnfBz3FrY!Mlm3q4$e$odtl=8&v0@_v^8MmqIlS0x?dSih<5Bmf#hG(h
zRlq-qWk_^e5DND5)d0$kL`#Hv`<K+MUZ(y&uxCG1`%K6XIn2KPw0ppn><9idC?1dC
zG~2wV+?5!eQW9Ue-P@{P;+ObDU?vKLbn6%|{IR?INwc9TL&<$i5Pkl9sX=l}${6TC
z+ioQ~VOC(k55ZsV^F5ecIBpS<<QCq>L66?q+jMcJA@g&KFErLi16E_!DN(a}TiNdy
zZ3S-8J^`c#tHtp--x^crd4AOluS5YRM#x8A{K_ee=s0H`E(ywBccW;F0}~`M<em#K
zY6o^5FtKj{wT260UN6jhn$ZiV2bpDd2}7t+8^PVTL$6hT4rgj1jrepAR$T1R48o12
z-D2&#e$Y7mRyWX0i~X6SD$#T#zGgWecfpLQARFSkWUFPal-QXH&ll(0M_68B{OZ(X
zF(YYM;i-DI!k#HGKpnq<(+e)d5aC?QQ}dX~0N3a<KnjlTG;e1L3oJL(#QDU*<!MCq
zIav$k7#>)9w9L|0h8i@w9kO*sU{?T8_X~({?V@T@N?*t#Ad-ZW()hu_!`5yCsK$AV
z<)f7gO%gsj3-;S2ohl3gD6+0~0_C7VDS#;)0rXFEQ@&MwW)FfdlkJF1JhV?<iMlx6
zLo&P;HybfmIn#HCf>K0_-3TWOaHU37X)_4p9>cS-4@cD(1|Qe_-R#B)ZK#nCW2B#G
zBsV+TVG6xwa{-BK=bZ-3Wurz)@f`KHo5Fu-^rz^_>ly2pD27>Fp*w|1CA-E?`Q;ky
zI1jLq0Y+hR=869uGkiH)m;36cy)c*NxV5nyVu1P?1oBqZ=(**fm+oYT;Sqmk#p1a8
z-7Z+7Ys>s`OMgc)Z%&yiJMa#^^+678y8SwK2p=m#q|FHt4kQLuqeS1D!0rJj?c1M$
zB;*5<zZ4LSg2E8m9`76gx&Rb0bl0deO^6MI0x3Wm4&Ii%_vg9=voKcOChb|la)o(=
z1^%dF51t-`-2cWY)g=!F099OOd9}tG>(Z<EkBEx<yF_Izkd5@i$#DzT@doMS3l$Ls
z2}oOYGf4?Pb$Wq=gLXbGEinUOvCWXwoaIEI&&TnDM=9xN!D;rw<Rum{OwRFl5n3--
zf5IrWT-&R!0dR?&nvNDf!_m>GXRio0dX-9A(@W#|wA3<e{j-2u$11rt0MYoqTrhkd
zqRv_K*Jo5JiXX6FD#8t^o(QlF+H}+2fg5)@0q8+ZkE7#Hx8N5dl!@vFYxTBsCO2B+
z0RTYF%8ILMljwnh#5j|3JY$QcaqeDu76BGKgw@J^-qvvDg9WHLylcS-`HHgmaH?N*
zN>55&x=wbAqWECO0YC=9XR`Uu8RNNXsGZ=0+P?sXkEXF@=#$roUi&2o-4VGV4gvG7
zY>e&&Yv92IG9rgonEfz20*<CQvP{*^4(E$IO&7O+HU7N=`|r*-ams)=PP&+U1;D~H
zpp-+Q5+ZlODr6hD)&UU#?U{P)!2|LIZ;I+Px!zv{7MzT>naU;mW4?!`(+(r8>mRg=
zF9)*p_w!36-vu!aSEIDM4qzR23!GPg0!UBig7_Fm2$>Ko_?zqrLZHRX?R8w`>#>kR
zYE;qxj|)IrP>R~Z-n8P5q}L8w=C+^FO{qTTONyWAMsKpr7q4jc`!5KIrCWDqkK^o(
zzTL3<JCi5v2-u#xftEXJjjg8FIrwihfJ{&ex>bATu+Z}Jqa4^EV=WG}zgUZOZ7kO*
z6<(8D9?{GB%pzS!X=4d1Te(ra%H+nyQT7~4-M}#qOJaoqy3Za&GHPd9idokJ3C%Ot
zLIX`)^PFCkt^L)L2KKo;?~0;#fvDX4@Aah9ZLIY_balmst#}cOh+PoPyo?O6;`}z8
zXeHfPD<He}(%AUsxcxXi0+JPanrv}66QNWmPpZv1$!Dy8rbm!Fm@zt?>a7`CQuY>y
z+t~4G<W8r>bKM=f0ymTm0Pg){!q8;IirlHgs{NJJ02C~)jQq?a3_t*)aIomyWU*%&
z+xucvaXU(~Z5)+Z+D4}xu_%yx5auUjpW(@}8R#f7$kC&CAf({~>oguP%GnOa)AW?i
zF1@P98CQu_80J>q9O}&F*799)UMh;UU31VIn=ADHQE<~FTA4sarS3+he(ZObiSf8f
zrpFaw{J4R|khd`y=R!{4rv34j(@avDELv`)+ztqlj}@$o7RSh@;E5Ph<D*A<Srh9Z
zZ*=TZfc}@E4jP9^2&GV!voyHB*Y&tVw`ARqxF7?Ae0v968S0IK7BLPpwQ*qi88Ka)
zVt-NZHd`2mKV?_3&{t)Zv^Am|(4fiZl3!9|{jdX5nw|XIy*pQW=w@e)wSk*4v5%2b
z^hN5FIA`C(SiryjnXF@G-AdYSml@H4;8Zgf5D58)U}Wi#EQhYr86gr*t&blS7+W|m
z1d^f6YJZQe)a|{ch_f+gUr|sH4l%$0NHvp6RwNxmX9fLmWikPogB2o-qp1BARr($m
zH|PuIW=f>EroRYBan**iRs$A;h`zsrY<i~)wO4jP_WO4eS8*0oF$6H>d7L(L7zy;)
zuZS7mWZgS)K)n8@C1fS@%>Z=O!)UR{RvTh1LZ5FO$vX6Km{wm8((JXpq7xPRWzNXC
z)*Mv#2np!Ro`p0lE<6@vpUCF4;_s1VLswf*Xy*aqB7e*-Nth_BB}%hs2<Y1}h%sdV
zq3+O+dsfUQQl=}Pt(<uXh7KE@kAklb+Ba_pkSI!>3G0*QT;5(3uXzX5VTTjiGofDd
zHjeG&v#Zb;;Si8Mfy4EkooUIUvWiQw<t24ullgu`D^4lXR4G@pMU9|p)N<WZSm5oc
zbh<mnl@D;wtf8w|QjZEF4Lm2{THv{10i~AJw50H7v{@MXC%84Yt7V(x&rKi0p64bY
zei{2~nrij;kB#a1KbvKA@vSiXL`GX`a&QuVE+IURBY{Cmyzx4`dh;BtGP=$NAU~oG
z(`8yaoi-;sdGDg_j2Su$m8@!ZCbW_Q>{Fx#qvOKdI3DwPK(0Q&W$ocB1tOoq>2_9$
zS@{z(Ea{UK6Fs6S!RqcH9GUd`W8wm9_j8G`J=&1&T_9bT+KR{Ow3Z0J5y0xa_SxZf
z!1(l+<SBkXb0i>WuA(X8I2I60JBTP2GLk{@ND>ydO=)mcwM084k1E8zl9%i#Mi7-|
zTKN1k8|}NB1`s|H_6V5Ld))hl^rWu^?ZN|M@(p`_L@@X=Hz;vIF8w<ZSu-WL+Zs(P
zRD1LsdB|UY9w9jEh}ATx9x}x~TRF0S9k2z7c@-E@xH~#<*D{k>AU-Bw!yB_d6nzD}
znov|*vRqXKBf>@q*@Y#j)-gBEIrG4+%^A??kyw<6|M9)zPh^HGEg=4b(CYDL37Bxl
zPvAbd;z8TnTadu)S)~F-a+zH77fm(t!8_6_Le<880`gRs!o{)2|DRXhz(p$Qn%Ulg
z0Q}?=+e6BVnPN+zsK{W>uq&6k+zz4s>nXF|gZQmRSPBmy5<4J)L^WOq6lRw3waUO_
zS&%CMLO&1>FtNnL#^6FF5i!BFN^rbn+Y@LaP*@5&E~ci<h~B^0mf2vN?N2DYIrT|*
zKiqFNuOZrObXawkjbdMdK-dAh#`7>kanb>d=7~GJqE5xyw8{GXbpZw7EOL7y$Zau7
z(Bslx+URQEoG@@&jl^*nX`v>v>{E|kN$D^F*mn0rinddW3c+*@`u@%LN&d5J#_C}u
zIE_Oh;#6AWi{;|96RxTT3y|3THoxW?EGqA~`H^vv_PP#5_9ASWE0GcxLJ<`h4vK_B
zeH;waP*k)e4hoM{LLL55H{X%AAR;A-kCzqln!O@l&uHI`BP9(qF=NjX==03`kR*4$
zIy;%l;eOUaqB`Qneu5ufVt+Xh^Up^V4M_0Jt#H-R_DGE_!a-WY+5VMX*#lFw)rNel
zof-rOmClWw)L1ay*L$|=F7;Y6*EyIFC~1@KL&ndc<^E4U*x1_V22_XPaG6cws5TE^
zwTMR9Uk^)TQ_QGjVyjZtDs7cGJD6J(>7qRtw17`@dAUj|H5>#smh~I!-oO*%qDJMR
z9yytAJ)Fr{f&kQ3Jg6kK68c^>r{mA281$zU@yQZ}J!Nixd;J%C0Q-4|Rd7tz^e;7K
zwd@4!HZ4gh)OUtNh{HgpvGa&6VNOMp=9sGLZRQOHHOKS2$|Nw%U4-fuqSB>~E~2d&
zuhfZ;7L^Vz%1M_j4#Ip8odA;d<=n91iv&6r&SPF5E4yLkhh<rzn+uz<Nv*gfAu(cF
zRBVKS>=WZ6L7<hWTU%+|;0S$&k#%@ae@$Wp^(j;Zl<Ddgy>L!tm;l;L?~;Qts|atP
zw%8Lcj|E&1TGS^ZnMS)1a%d=Z>N584<3?}C%M+)L?c`@;tw#a0*#?7%pJg@k0t9ft
z>Wqv4lGMRaHgLX*43F67o3pPOWW-6usR*!mJv<MuduAkn_F*B;XfH`7kE3lUxTy^_
zHpiM4Z0uEf?7H7AXK?)*S^8fF`XMH}ba+%DDnNcwZgFLB4L^>MDN;-1baORa&eHP&
zuCpZ?&*C2w)4LWY(tP}oSCc`u>w)WN0W{TtDaa;Mo0Z)8g1ph3vdu2WSV>Xg>2MS7
z3?uly4{6EI|4-0w7$I+-VCis)iei+mQ-;wYAI@^jVdLhSk>`tY(EDV@XF|^eTNu5<
zDCV28`ZZ!QCSATmxBFyA;ujAShDjn7Rx;$&8F%oGmgwZ8Q!ISgg-xRv%P;Lk$|FVf
zf%A@~;N~yI)M31&-{(8+*iG6bBTqCtlPTkp`Ys3^azuW~H-hYvhZ#395{Mvpn`gd6
zY1mwFusdW`LEV>}%@@`~4n@4ck?aj`;nMuAmL{gkJu<30t+T)#Xvvzkd{QU^i`BK#
ztWvHy*|XFcH-uIn(AoQWxH!t{F`>*py-0&*hU?aAE}*8l=`I{?CbazXjE%^Wqw!4G
z&rgH;{!34(eem|v{WBJ*+=g2Yr_S|n8ZqjW<RHj_igCo&44@pRMfK;nL(Cs_K!dsc
z2d%f0exzxHb=u7<qILw?@q!jm|Jd@iXaDe{>-9&tgo}v`t7Ub$2{H*VJJQz&y`J(T
ztwYGq1i$k$z8YIGnEV^yU;P6fMZdi_KG28-Xu60j2px+Z&hP<KuO(CWmN}1Dz!b^A
z9vQ$Z-6P}2jTUl3VwF4PN8UqH^?Vyd;5Qh%e|ZD>@C8k~>p$JUj;7;ZcKX{NlS^U<
zMm7g#kWXXeSIenY$b}3~Xi8}|6S~+d(M(w0X%u0D(~3J{q60L-6Fn6iK;ts6fd{6@
zr6lt26~AbABw2m_h!dVHKYd^w#0GUmMDTAt12RJF&^ycRq$X<Q4RrO9sLbWz#z3PB
zuIh-v5M>i(kou2b2T)STY~^szkL2Vn&0Zdz#|N2=^Js~zM9)kSEvFY$(!lN2;93eS
zw>+nAAI8bwg;?8HDdMNvk{7ohcpBzrAb!`5b4@$A21o!Lwq)fcr9q-%QtWO=k6%_w
zTVcbvq`TWoI6ba}K!}5YMPKaA=igXDk<EzvCZh?lT37UR8DYnMP3DQ4<Oz+YuH>4;
zMs4!n?6<#gn^vuK8}S`hQ87Q?x$?G;s3y$@#Qvx)AZsq%2;=JE1qm1|$6DDJ*i_WD
zyfijMDyP+~*!P!<*L|>kc)$jE+m^|!q;S~D^G=%kX;c5G`I&ae26dVlbp@2GU;^!?
zVy>bX5wB2CR*SPw@8NF9)Lv2$m%@ne7SfUYxJ%k>Iso>ZEv$@&!zeP<Y+8SZ$BW<3
zK$f||R7k4voJ#G|pabisukb>Fgom<T=<_|v*N4}78TuWd6dbCQ4ts<pFI3@utnXHc
z?yqSrJW0;nZ)8=zw+j$@i>~iC0z{w4f4p}#{RlTp5CG})5sEag#S;~=i4uOh%q@eQ
zrR$twKnhY(M#Di9>rzazoNrWIvSu4RV@v|`n)_>Sk@ty!zuyyid+RN}>vi}5!c+xg
zVmemp#MWHGp=ubxgmm3*HN{N#RN|1AH{y3LaSV%dx%$CFRr@|^`FjYp`kaya%QB|A
zxh@i+zw#-gc_72z8t_p%zYT3HAOZ?sf)Lvk$5`3pag<E#_889BQa{&Y12hDZP-t>T
zq~&hjJzEw%TBb?+gq#teMmf}R$^0(O8u2WD<r)SYQ0~8Y5mg?8q@)vx*pY6JGTD*`
zqpK>WKDlKbJD@7mMA2AEyqlb1`CX67bb4!iBgrs=+)&1%!NNHLTH{6O@G@4EF~I{M
zjep9LnD|8d&@NZOOmj<5uwVxhw2rOGFd1NgmeS!l+m4()x$Y>l?c}3RiO_6JS>=fE
z6BEyj@eC=C3%>+bA-us3`D?IT3OfkZ%NMa8b`;X@y5<)1e=^=%98kFNF6j3w`zEry
z+RQgI2p-nNW-@^a;g?Wox)L)`Ja1UJ83FYu1z;9bHA94Qnmae}-~ocq#tO~+dh5|x
z{^Qs0gXa5>q3QR8<Z{5;k%#`q^Ql(eSQfWyET>wpo8c9hKqB<R{}!QZ)CwOZV4eGB
z{Rw*mQ*Tnt3K(G#<bHz(1T0Oy_`tcTT{We7L$mCR8Xq#5ppMi5;)-Ejq}SKAS~P$J
zCi!lFSC&^+(#ZEi(bC=dOSkm(&f+nHqr^m!*O}?5H;0}%_8%QRs<tkWX}aXNlxWX9
zUfH%dfSz53jd_9kl7szG`T)d;?<{(Uw;KLkYcQa7=?RGelVYO(`ywzEA(?>*9x=oe
zkPZL9(Em_!3=1D{EIDlD1mC6DUl*|9@)CAX#QnzKJ#*L<2mwz0psvAY(5H&{oP>y9
z0<*j2^f`Rzfz#?JWJL-sboDDCRXT4-=xSY6Pg+1ve$ueC7oV2Qo<%R3?)3Py9HI>g
zOe^s5q{&6O`H<k@0%IhhN2n9eD5umPKbIO1Tlo3?$r6M88nAW~k?%4(j^ukItI1E|
z7yl$aGjhb*GfwUofs1(^+cq@Lx>9FJb3yUJQfSks2egMFE`ARJBQZ4|hhLhW`c50(
zBW>QRZH0?d@`cBPm?b&x+ur<_LEwT<_F61k@9NgISOb2A!Yx7Qb<{?9Np_jsatJh9
zix5t@eNX>a>ztha;q|9pe}Bs9A9Xeru(a5<54sjUAa$qFPB1fuk$$in<8Pe99mftO
z<lZ5CXN<#H@%{2Q=fy$WguqUopkRID_(gxVCwmCi;+SHpO7t$YuYVk<5WT}wKhCZv
zPXtvi+1NVND&-0Vg|uL`zA<cZ#;-O!ov@B(s$|WBys%LxeH2);KK8@FxZT1z++TNQ
ztn0JSE<l*4VNw1>$}jTK?|BPohXIDX{QzBX!)SCEzvi<kyk)U(swUh>C_9O9QK~?D
zX_<dfTOi@IJuJ2^S!UNGjR~x#P%t~CnJUgRwlUnz3l%J!|8o++fCcyisvvoCLWQ!K
zy(J*vYc+??=wFkFB|4(mJWufWH|3uP8MC+l#>uJe?ssm$*|S4$b}^s%OK4_Ll*@=h
zgjdLDKLDL~S06Xsc%OePO9jo{A20);VgU+?Q6#;_NBWe7?u9XSi~qJg*b|F%%E0V5
zxyp~TH@!;_;j3Ll*s7t?e$J!~JT-VM_)lbcr;QaPZJ}%HOKXTf-i0>|Y&e6`@*km4
zXf#=-{mOOi<>LQ2UZLQ>UH@|l|DTOWZV+6JV|KGVM{>LBh*U+m^`ZQF^CkIm)pCU*
znNaBFBt>p4v{qA<3Wb7$mVn%|N30WNqy|>A9x}d9Im9SV7G1p~VA_NFxEI<YYDKhv
zZ<benm}xsLL!~=49d~{@i;Wo`FKB$7dgcvIcx_0|>DCaO#eQn&SevY%i)`+Bt#kfL
z^4*nT=*5|F-`O7v2Zddm2UQYk-rpl~Q6CGxcXP0{OG}rzAzCLWaO`#1Ccd%^Bqll7
z@Ia{jWl`L^NiefM$ce2eirkp3W@`^h%_iL7ms<x6b-a1*FK?Ter7R6Uo)AVkI&ZVh
zMtu7q$~?T>+@dzj{54i*p1W_CcgvDsCS)jb?JHb@B)oKdC!wyt9r?ublT%HzcRr5C
z05K^_Qg^hzkLWkFvg?*F=p@yF%8fy2_)2AaJ6=}88*dX$g1DW%o{43wSJO{gWP_HH
zr<IvZl}$*M%}A4MAh~A2S*vSn5!RzIdet%IuZykDp4JjvJtcVBucPxYY`h~Z@F_A#
z@@{ihm+?#?6}ghVbFsOamoeBN&;2^P&(xH#zM(Ld+hdzjDf2IEK7X;lKIXZtqL4>|
zJv;+$$*yMph_HbOK^&K!MUnuaw9%7DpzwUM`11OnqD&TurnVK64<vLCezUjuRAFp4
z4lrIfColV_M~c*|ROJrje6?108vd4_bJbj$_jJ{1>sPom&r%nVO=+BYdgj^v=(IJ&
zK<=>h6;T%qFyxkn|2V&%xeap&E_h$}*Pg|xSX^1G4)11ZXHsA0tD!}eP$^@_Y`Gt#
z`-=W&#~7l&wtKvcw1JI$=0c)x`FP##5KP3gukxG0yz@m%KQTP`^IvZV4lJH|E3wp3
z3ch-#dDcQ0s_B6N$5~Fx?}Guju$y~ttzLGmvc?4p+j-R-^knQbkLTN03+2&9sC{r@
zkEI=U81mE02)3tc4pYmBV&0Y=q(8J1R{nAqeRTTOx(|rP>aX8#v0EpVY$QH*riq=Q
zI*MM8IFkkPw7>a|s=ZB?6X!T8-#Qeptvh0j{@JZ~Tm2XG894j*(d<Ue<YOgf%ed7M
z8r7BrYcAe?aabGS%bDmY-g2G%#W6p7k3i65p|`GP!JE9T^ohU#vQeY{JI}A%q1<Ux
z@5Ob8!uMa#7ks}1bMkie74~_CYS!!4Cwnw8_Ytxy$u_p%y1y=VuVGzgcpopqW_!4u
z&Fo_vz670gMvNc+kZ9u<a`R=}->xql7adRen`@`*KG)RdFjGn4CGt#4xJY}XHvV|Q
zR*fzb9DiJ2M;4vEOc}33<FK81U(~`$UeGLopZH&^Z|<DgiEfyN8zT~d6It<_@?h@z
z*`%#v&N93%mRUU7sMqE6CM!K!kEcX_P4q*s3UYR44FtBi7->Zx^K`vzTMse+v9S2Y
z(($lY!loIyLIx8*z#sA8ObQX({!%S&FQWu_i?<kGb5lS-Ne+w??2Si7oc$4Ll~c#P
z#Tj@Ji8{&JLLXVOL3BpWLKc5hyLtvC^!h4k-%Zu?f1@%4e)I0Vx7=eSAUqx!>gPO*
zuP5`|$CnlbpJ6{%o7|z__tUS2IlUaq+s%Dno-I8s>e7&GS*C17$MV$w&{Fzq!Eqp1
zTc+M>cop%rr!z<^QSPksszOPXkjySImmEKR&4ux!R@o+H!98xjqJH_0T)fv+CLe%l
zH}?BdUB2*L4NGlgE?<zZ@ubDBte5eeBneHt*fDdSpgChRLW8Jwsx6Uc^C_N0G-FXt
zW8Uu;@peyre3Bt)F2YaVcYWrt;56-7EkknRCqh%2_*Z%9FRtsIgcVk4UN872r3_tz
z2_F1hEVX?%Ue)8Mo9%h2CZ$L(>mOqkvi4mtxDCqMiXv3|wFl5dBLY(agmo-HZfXx9
z@I8bT1MPS!O(Ziv{_!ZB^7ek$T&BJ`8{_3UGQvfBu%hM%M^S%+tbd`=UqZ<ksi`eq
zzPjcDBn&9q8}gLsp#FgdaB=}*oi|A)oyRt=KDn2tqyOtAPg-!Ub(;eM9R6}s#xEH)
zV`IqcKL#dP%NC=ei~X=wNAGrw2`e2&`A(;l)%;e__P$6ZmWY+^B3PrDTbg}WVH^ja
z<{@5KI^s<sb+ybrBJE(~k=6z>_%OpQd6)yyd(^lla;^O-NSb<>Z7sBU8)s!u{NJt$
z@7OrKN>?#96ysE8nlB_fTbqz3fAN<|C2Tkrsat!yC^#?(2kEbfRs8_i0YPk>9d=u%
z%NqsHEE`q>iCM07S)YiqLsqiZ`fT3Y`;;6modH=aH2onAtFfMc0-tSfd=+u(lkb<7
zTd^+sVl=DImI@=VMhf&NVZ!Vx-*y?drz}T(*Vhdo<32l=M_BebYBUYHc>Os-zPVy6
z+0-2b^>FCJaAI4tQ3sap5SG7+Vc>XdAo)N3`1+zwp5d?K+i_yf$yM6uoMjRdB{Z?)
z;_~z1*{z+eYQX@aJ1-*d_rv(RfG4fXf4|GC56E|2Sm-OVH7WbUaAZSX6}B456~7MJ
z9>V3Q(O-FNQ^P`envSIWU1v{AEUdC6aF|2%J5}}eJ>u{6rQNC<Ec;c~_g^q&^GnB0
zvR)kSDYw_Cq8xNiBKkcgK@U^c+ka9{YUy)<+eRvkQzlJx<Fy@CHcP8prcD`TL(V0y
z>}_e)Ktg4g#du`7Dx9u(m7YLf^3JNLF$sO-Es9kwfbLL587;{jw_KQD>bs3uU2Y>S
z=aRd~w32OjA1`_MSZML`OKWvk<GrT3P0>W>0&Pa)J%yT$G5@Co&cH$EQ0Lr8^Gw?b
z{~U8C^!MY@u>?S9cKv$Ln*C0YyRqxMoZ^DyqxN^DR`1jCexlk`J_noQ@0-X4yUV_~
z@Z|x2czQeij0qad!eN8k6+P@kqzoECKeXssyQxJ@)qL`?=9`uA{ghXnX8m;<MK^pe
zv&U2+Wh3(hK!bw7Jl)7y>O5P&Cb(g$o897P1eR(lu;sPhHuo+3TK)9T(3kZatM=>B
z5n`}K{!w7pawj=^FLzzMCT7C`E^LtW4tt3+;%vlxHIKpIp7`B#J>`Zw`vw}2JfB@8
z^nlK^tMbDwVNZv_8)@?f1XvV<QG^=fB=-m=7Sb9EXE-)jug^t9`$HO1Mb5%tutT2x
zQa#%-r$j*=X?sQK27wfieONG(mO*AM*s5EPwoEeJy^?ygkT~_uj8`&z-V~}A`=Zew
z$za79WWN~U>;wpCmZm?@5jaZ%sV6$%_q$%nXLm!v`~Y)&)FR*H=&361<8Nb?e>+Vr
zFSwtNxV8s9JOJdGY0?hUWRET9f3AoHHl|jaXzbxTe)35D<JZY#gK!zO%*wH6jjHtk
zQ$Tp(z0lN%)rP`VJ#1H*g%^U*x%x*1%F+skNp|n#R2k3j2WJbMa>r&80Q77bFC!D%
zpRGvT)%*QEbprQm{Jyz?L|*>lu3JsNiDoz|){Q`U&>7#c<|qP?xd9dDzq{)Cn(28&
ztzLpC2d&QX0+0ZMrMH@}yWY~$IP7F(UFe(Ca{osD50dA1U6(iZRX+}^z69qW52{-B
zeW*=;y*=Hx#94ywyUC-CoeT9&amsyZ0G)nJY;o7n{8f*7@QI8Y^jy(i!|fk}_-YTG
zGZRXpgktuG>TL*b!t=%K5M}_PGtBDc-ssN7{30C<8BA5KvylN)WQwZr*i;#0!vVLd
zEX?)rJ)SX!-V0&pYr15W5U+F`&2%HJOM&0T%F7e1fo8xg+x2Gp+wlQ3j-+yn{S_wY
z{&P1O8q|cvn=!)om`ZC+4VHStk<S9UuB4WNoetBP#4<QWs*H0aSRg%Yk-%(=LTZA<
zhOupwLIq_K1n(WiB}zX$6so^`4Vn1w7{gIGBVb&GRN*+=Lw{ZY*(PFcgslEYc%q&w
z10cS<+_&G~ju>oe)zm_jL|Y*RGU43i5n|UE>|aF3H?3^yk*-qr3<@qmNh}JGh{!Me
zvK;D$yIDekB?tW;r>HtrTY1BtoU0Waj!z`m=zEra#U6f1@!DrrO6o^{8d*&NZg}f+
zx6$^Dh5)O=P$;7<E+St2OB1_yIk71umb<n1SdrG0%;7stqXWaZAPK92mdDG)uPF~E
z-CUE;U?}5)b_$Uq1QbLe+O*I{edseVr=I?S9sE#lk$1(avLX%C8H<|mvze;jI7CMX
zT#1><w{Dg+W5YtcpX<j|be0pyI^$yH$&W`PN3^4Uy!OC=gRPD%{)R8EG`QLx1i3r@
z?yuI#-^ffwrf~+_&u3=&4+rk|{Gj=k%25>UJC80QG_hR|!<r~X^L<8&TTm0xlVt=S
z@5p-ISBqtS*>w*x^}1_Qt6}H#bf4@}^IBFvm}w0=^X!vhoQ!=L2spo&{7qsxXB6=S
zfYq+w&frsw=cCSf>(%(TJOxgzy6a^!k-L3&Gm){cr>(;@!Rz_pRoNFt3+cv30G;9p
zMHCqDA->d_?}HXY-)Y2153@3KUGmD<OLndk{7?xC&I+EWKTJEB)bVw=KH?B1)2a#q
z`6F)|5DON)Xx9S_8n5Ji;8sBDz*k(z$3kSKZy94rS?In0JhRlp&QQMy8vT4)DXn+y
zP}_!r-JXqD9+BP#W%|GL<L5eFee&Ns$Ieq|SnaQzE2Fg7@R6eJ$r#})XrAo=gLdL$
z4a_`zk=C?S6%~e&S-6qvLP<b5W^1CnQNi_8*kfgN&XdW2{)rD>yt`0adUR=32F(9)
z0hpn?DI#H#9m#l?(I(nF7nAuzw~S7+Sbo}oK(wLX`H-L|Z4xm|nUN(o$NT^s2G}Iz
z5g5-(9!R}C%lI0THVY}JpqU-H3@${~1g5%4A&Z;TMrEw~8~lXdO_<(6sVRZ?CYdot
z-ZT9>?jb@^Z1|Ii*W)_1f~3AVM@^TD9DoPgZvD)CB?nUPL;K^(U&OVCKCHv)lP9#8
zc5~i%E3(VvA35y)k{QMbwZG(B-`1Jz*0MxJQ4QEg_$<GdL1oW(rs8^8F)khkb8oSD
z2Kq0HeAdwhe7vr#<1)LsU+Mh%zdjO&(B_E&_2r}$#M28QdCI+jzU3Y@k;6h)pj-S?
z$68~_t&D@yN~7gxu^Bl8IAf%YE_yK&PT<^?r)Y^Lw<>d(vI_gxR%W!GCuPZD)R?BO
zY`YEhOa9Z}&b`Ieo#A`Ac1gm2Fj&A2rFcG8>HeD&Xs^8o?4k`04muuC%0Ae?N>WHO
zX|DbXSWhIo(;W7$*;~g7T>S3pV%M5$efDbMZ@+Vuvx#7C;oSBm01FW<fz>yr$8y)b
zO-)qy()pQNfzWNX`ED=oHohX)_51SVd6q6C9E2i8$&@r~Fy4_FbZub)CjbMcIc@-}
zQ!#{D6R#$pu4J}?l_QU*hgdZQWvyA$&<{2+roVm)qm?kolxSu$N-m0zO=%X^p!LsC
zi;4`cL4rk|9lVOsP&&yQSYz-Xa|MTH+P9=sr2vwGeNsZ{k9Tt|5u~M@OK#0Wn+95L
z5m5kWfil}H93fW1Kq-HPE{)ri#1&chQBKT~jJ<IUs_+jfmu!NsyXkt&19V}jH)M<W
zG$=jwbFGKoWfi&pqhI^{kB)0<Y1PF9T>7xZ!q5<1p=N-wdW)y{$g<!(Z0yE3>!aL=
z(4sNoLXu-W%Cs1u&U$h!kbFpW%UXJu{!!z2$OA0t<MIOyWzmxO0+~UiTD<Xny(a0D
z-&#~}g9FpZ9OCOwy4l|#;f$@CVuMbLj;u#Vv0;_$V)Bx1-8a26jq+apO-RX!1szH8
z^61AS(gQvZ$9q*EfQGm|MLuJ<!tV1S|H|}D+unkmf=g~d3!mH_45lj`glh|k&@mpJ
z4vGZ=;q}&WT(19HlJ9!M`{-nhwwK+0w{yoot%etux2oW>Ha_?EuUC)jR|=W7Pz%W1
zD0!c!TmBq^XRf>bxCr#&WFWEGVhRiw55Lz|2H^aNULJnKk;ukjmDq*`?+bO(l4^z`
zxDoS@gE$CMpE*xc9V{CivN7c(C_VZ;$QP*!pWKD$jwgh)m&>R>$4hLyZAiS-<`cD$
zzulF{M)4S*L`L&TW1t_UK&#1FHgNa%M$sBY$Hy~?7T4johe*UJ!TxO`qO-bn$1AP%
zC7ZqhA{^O@mt96`1bFTYUn_u&w3ywWon^9O|5`KykBmm1_#@T&N0=ce9qup2-nyVp
zQgMf|Jmou5R6q)d_$5R3?c`KH!UbQW&a4KK`<O+<b{l#oGymNE(y$yMH!1)TnIww`
zG|q-7k5{&m_TQ9Li48HX1@a(6=1`ERkRWCNqs}sHPGNLIQ;mt9$^a$>_M=Qb*o-IZ
z=TwZ){M5D(IRIFJiC3THgJ@(`m{KO~KKsw}5A{i~##$azO>;(c0h~u#jI(R0?&jtZ
z)b-MrKmE`2hKJ)vW#}t$-LLDQp2b$>PjEW=Hx`Hv_#S)tIg@Wp{x^RxPvSnSSIE4t
ziIsI_<Ff>RX}oFtlDbZ>E`w3Qi$p*XNrrkTdmN}gI|?B2n|&%f%d;O6uwhX4<dvVX
zdySF#z7B+F^d;qe@fcmyzPz#y>S@o5xdacO_2<cZFh*7-uJu*#ZU0OkI>I1lV9o&Y
zN%3{GE^Ec3ku5UVdXpsG*5~r53y4>pa`CTTP8`?iT6}${hX%&1y{omIl%dI$x~gM3
zt+ve};4wVt_{H_@ZMsz^7Miu^0gvF-t$ubw(m=2MBT7LdHA%x(gFD-BL{)T?l@bbo
z1bLJ86U(ZL6YB(}XVPsMQ(zZ8`N!afb1OFItFG*>hkp5S3E_SSDDYX2h~c9us0@n)
zldU@u&+GU#tmpe&8#!%Sd})pHKktqoP=y-LG}55p{R{E;w8^_i)VuZA*w!Xq`?nUl
zZ7CV*8Xb9Weg=EwWk(*r*6R;4OnkLQl?wb9aoMNu5mQ1Zc8&)rlhExPpyUz%{o*|@
z5jbcRsrD}8&;B6)Wio#`mExiVTn14@F=J@6CNPk9w0MWQYh5b28TwBt0J0t1_Byw!
zH7Y%s!d<n4OM17GsQSv><@KNdfrj7}wA7Qv`mZW?M(OrAYA)hyPjnvt!Xc2*RtK^P
zbVfVeT<fG&@m^DUB6u%T^duRRCjlLlu{Rrq7yPiu1V?_T8i+Ggw^wRQxIs>ir3~yC
zp#yzNr2!cm6^c0Wv(#u1-Paakc}@dz4Jolo;3FBS5g(_sue?gC(_a(%JeLO>_F9ke
zhLP@eh<L2m&C$3xJU*X)!uD5gIUoD{y*zrC+_ob``KnpaO?Jlxoq=w;hYfPm+)YkQ
zd7pl-E2O6yZE-pGAKN|4M*68vhXp%4AWeHW+=JQ>?!Kp;A<Q(CMIO6VHT`__*fG*$
zeH3b<V6s|0#%GA?h2ae!-H%zh$@M+O?6_WCZ|g6K&9n5s^cOhUCpHHNG<9yBJ(9-M
zztM@rINzZBJ+S<}qBQm<cOJ3J%F!s$mJ7YKt{-yUhGbqD?6KrWHqk~%jQmQPN+pQ0
zetWws`PnOyvIV<jjfTP-;9gcCDyKF~WwmsSn(|=rBc#Vdg7I+TapDcB)W;9BZ$F;E
zENLk>K1Tu%g0_-?0>pv6kcz{pq*{a*llq?WZ-snx=t8&1YwQGWnTWIl#1RJASxt}F
zjd(B-C@|w9MISkR)RffOXEji2=ePPqH^NnaaJCI1Wk^6yPS=UbOj&&V37c*wv0cKE
zO|abV5>|fypbm)Q+dX;GaIB+)0q#GGfBfVLjn}K$KoWBX82-t2TH2J3wDsM!HKx+O
zukr!f!M2X3JejP2o-^R-NVvDqIPAOE?OkpVV6t<d02VsUb^>lHJ888;@>%HoCrLsl
zOo2FRo@%?sq7t*d`(H0*Cna`#lOnX%-$$QZF~FW6*G_i=<F&mR);V7a%rznGq@+sV
zOmqv$vuQbz`_^h)2Z-hNSEPDtiS0CCTIe;xzW8TlhAC@fJNxUeHDvtQD?<@0lQjHx
z+dPw}k@t>%cBa3RFb0!qLU0a*F+zZ1Gcy^+tjcJQQK!7AKZ}z_3wH-+a<83S%(FOt
zI|K66@>M1u7gd7=P)_STr0@4hzmG;23#F^-{sWjK{{xs}6f!84!v`7%dUTjwC@Xe`
zy+W94^2OojBWriTyw3F#%rmY8o6&Swy5oU3lbm|*V2ybM;&2f?>0G!@n<RcoQ%P@l
z?mp>AF0IRL-I#795Lmy-nXfGl?AHz_dU0}y8nS}zotk{AT2r#%N5^r?h==kxgN)U<
zG0WB^)$1TRdwRH$(E_}Y=Wve~3lr=EdUOkVp@=8OBhUkY67Jy&DR2WR7X}WO4g{Oj
zhpT`Upl9kETqLZN$d%4})Va{HXY*{M!7AH2=!I;X_}uA+LJp>g`&L&qWpsEKjM)I>
zdyX9FqFA9)dS?oe3x|`tx;@p1fUkAu@!s8i%|_y&9=%izKG(m@PQo9vAk<%*H<GO_
z40-g5jPy91m+u65bN)>EC)prisP}r<?H0Q&>-;_~&BIN2uPTX7hy8B37n1F7E(V4J
zU$wb0dmXy32Va`J$N%0&Bi%7twyc{U$(s9L<UPJC@*81N^N?_H@%lN>H3Q~<ac)@O
z%bKdC>Bg?D3sVX_T4o{#r=uy44hr|AJ10N`W}+-H*8A_*=J-r@dsD<~6E1e(RQ|b;
zWLi*#W+50VWDG%ZLRg^6v>|dA0?GVZj!X*8oHoerL)M_AW%~GvTX#cAPhD(}KO5tx
z)_Kt!qqhM}Fte3jIY#jA1GXim#}e3@Ph`S_h_&4mrzj0Sz>&A1te}j7coI70SgFRS
zL|}5jQ)MPr*~4RWwqFY8O@h)`IDw@HmDFrV6y-VllGXE=id{`fbcoydiX`S0_f<&g
z_V?FP;BfNCoT;U8Z>_*Fsr22F;C~a&^x*bQzjaSmWuia05d(BSH1cUBtzw|KEj-H@
zyj4FEJI)94pJhwn#);_IQEfd~axXETzBFoQ>@n~u>91W+*X<X3)=2<;frX?5qxu97
z*vDy~vQA)?O;gCe#e{DX{VV!+wI672ch-Ko-(5~yq$IUT93aUhXbT<OJZFw67Da9m
zq^t&0NPw6$l0*(2*i8VS2ceF3sLBXn@VS-dw_ozk=k_n?fH*Sry1lEu{jq2=$n8;f
zO`Xz~<bZ|QpriM!(O$NY_YiQ94<gX?RFxCPp>6Uv1y?=H9834?^5kpnIK%9iE(*Cd
zw^0Mvm1Nh3UA9aD2Qa;!$6PP1B|y_%D>o%Yk>q!N6I4W1BVZ`7tgp@<bnp89l7@~1
z9||)<@nKSapcd$RA+FgjvVd=G8-lz}sr)1tf3+=k-II11uVDK$4F_=gQ*GUd+7HXg
zrFS7|^<YHC)2GJ6yY?eFNTRnKTmGs)^R}5++2Jf5<lqB?=9_MZz-$`9){<RUGs^%5
z2&<k|JxY$?od+C8gHy*^Q7nRTW1-0QL|++3f1>x}PI*{ZI30n;$M|}G(ovq_s35>2
zia<&Zw9Bd_(Pn}{0%LYYLZ+@1yA(@o(cr-p&wsSvvQnWGuxs~P75+va5!VylwKL59
zXBZ3sJQ2A!17dz9(C&6>HJ~`<-`_bJC{O|moGqWa^zqK6fJ~S>M8?hJ@hta#d;kje
ze2g+09CJG535umPzdpzB^oA3AjQ738&1x^Wi`(r+Gms@GVjwm>YbcIzN{t$3a;Ak4
z`0crah-q}!QoXDH8{nFBOX24P8*gN;2CP8!`4d=-E#p?4<+NUvf?!N^G*LxYPu|J-
zf-?c)_KX1<VqgL%I?eXv^Fo6{j7rdbGK~xS>zR)8QNPsKA(mw50#-m&aXKx-bMS_Y
zbl&$`9ughg5)hAMe6Ec)#p--F6G&iQXq97LnfKm!c~cZp#dHsqP?`Y)c3(2n#v7Ii
z%)D7cA;wGofQt)ybOfWv5~HPz3!JVyE4OYDbPW#+9w>3ESL}7Q8oTuO#Z5t0p?o;u
z_MbqtRq<0jQN8@*G?Cb$^imk6wA7$n6$bi1DuE*BLxBndQ0QYa1PMo;tq9QMsTYCG
z91fjXwBTzV(*21CX_%V3fSYL+^_Jx|{nX>3Z~!z5Xu!QY(O7vD%I#8FTHbvHVgqH(
z(gLQ<ozD~)ehynMS3YLy)&dWryL?z6AuvF;*8+%>|77E%py^?Z3SapF$SpupY$wPC
zXfJ5nI!(R5EwWirnb;DQB9nP<t%7${EENjS$9ho!LifvC6?AWHyr{M1-=@CIQAxxs
z^^1?@ZILwYJ2=yOp{Qg{`kbSjR=nqC=S(I0ma}%Jj2;e)L7<|R-kD>GXX;7{{gAJZ
zw2qd?Ye@<j51?-2cb2SmwFFMeIhvAjOhth4>|O<3{G+g3)dH}lyzcr7c{C^IlqLrA
z_~gs@%jE7*#Bz@Oe@V11^<O!g37Hbhd^E;Om7UuMcP&;c3zvQm)HeuJ{=p@A2+Ez`
zrtw7sV~h{zc&FKynI7*cOy&-(?6~tsnr^4OyFI8-+u%d8>2u`!Ra@wc>>(h%CgyFb
zZ|$1eUJ?ym{=!!RL|yb#iT2BdEo74<&lq%Vhj!t^s#BKgG}qYIHlL`U&jL^Lk!CVz
z&-1fr4Fp93_boPU3%#zXfU+831*EK+<is}xxzMsY%<d`>+0&^nlPn#VwOFNc=&yCr
z!EEQ{uCyHBUi8by-S^$Xy*D1gSdAa$K-|xpZp=m68)LR!4QdZMF)=@GxI~h<?#|-S
z+$`=Yz7{q(dO9moZE1o3QgizAXmtjKYKjiikc@-Ceh<r7^SQH=6OY~em4HZhZVl!;
z7VoDw*5Od{rpNB8pypB=-MS>Fx$%~`!HDnad6Q2KoAIEC>+raVB}_pZ)BIG@8r#$r
zH=i1rCbxQWuW0K$0>xM+1X`YPd?bu9!Ksp~@yB+O6J!K58~~cx5T!&>x(GR-`RW;(
zPGWX6Sb%V-<Vjtit3Hw>yd&wgtsZMc)cwZc|JNH@ePp-ROo$#_;2-XVq-NM4&InrL
z@D$HlD_JUOrgQx{1&6F9(Bv)&Itns#qAg17g0avFT(wiX$kQsF1bqP&hTuj+wbrsy
zESgh^<?z#|0LzQxh@g{dVGqgSc)=d+5suJK2WetULOPw<@n8?Z#l8WXsiiIz3lAL)
z&;>l4vN*p;)l)WgZf#`3^?k&8@wATYg;|WgvhovpvEV9&2&a41>FK;R|L`psYCaW2
zWJ7)y>-bKOT!O{heAll3EZz4y9u2FM?EKl=<6gXSq787sLh%4fC}hswKh*@$^*SK0
z8#2W+qw43K<zQjIGu1|5&u8>fVfXJrxteA+FX$1~s+dgV@dw!3c5kP-GorXuv=eh~
ze%9>4jBI010AVtu>0Z!hEgqu?Po`r)ym7IUPDH}>=(fB5@@x`~G+^==gJI@lLx-HA
z_MvToNBSaCi5fVhk~j8;CnkeMluJ<k@Wh1S*ECS>!O`b+J~0B79WS2AzZ?7Qx>AC6
zQgbbiw$|#GT%G&_Q&)%oObi=|J+X%IAS(1v{*d+knm6K;xb8_IU}7qs+=iuCP#(Wq
za+-<qB((LlP~z$K_<2OrE)))A&!l;u+<DWCcq7cKZ>-MHp(M91_EihY-ma-<P?mmB
zxZbL+SuFyWCYfdw%Ge}-m66v{p#Fs~ETVO;QD1LbU%sZivB<;m-!he1`8<(b;)uYY
zBZgxC==lmrYZ!%+mmIH#FW1izepTH>^g+8fCRSo2S=}q+JokYlIm_9;Q`DpvzMQ_>
zU*$d>L3DmU=swvS{<f^$y0+4|?S%`IQo{ZYJOqEU=KQw13P8kXItr9=KHuSgD$@)Y
z0J-+Z{B<<g%-sv8*Kz;nBEWn%#z8`(!5}LL1iN^Yj<3bXcOxVN$Gyh)<o+^Es@qG>
z-_`D-!B^f^(QPgWb=FB8C(Zo#4aPCN-F^Ui?bh=Q0!*b`bYe@8?u&P?{~GaI-x-Z(
zp>kBuGw-hoUjKh7vvO*+KCX(Xo$7ixKOap!P3(7t2$z-YqJKAe2neA@5waCJk|XcU
zgWeU}kn?(~S}|mG>57+iLTz_rp~_QVEQqGVE7NgJeKEi7ROb5V(=GXu=g}k37R%AS
zOfhVkA};S?>2nGTVHRyr2hk&LPiT(ArhdPkI>?SPWeQG*6jNHwGu1pztkD(SW(@~q
z*zBs09UZDX5YmA&$wVUR{_?$G*F-s%UMvzdMhZu{#S!a^YG;!lJ60YduIpcHOB_V4
z32E;e6$_qFObuIVL&xq_eDKf2dtqn7Eed@l^jhOy9MT^$GPM+w!C)9})CF&V&u98x
zNz9rcgZ7H2`6W<+W5{sBbRsC~<(h=}!G&|zuyR-&p8yFHIuguy^15cBV5-v&Z_3LH
zB){Tc>G4^R;wIC2(v}RfbRd$sJ6-2#^e+PXVw2K7=RY)Bh~bkGoNxTWGgz8OB1(FH
ztvyv8>2W@VIM&h(Sj**bpbV;_Vvi@BJhc}QY+|u#vFVYqWt2oBx)2@d?MbBKM1^4s
z?BG@2<4Lt<8+Yb`J})s!OhnS<EvvV!*0X-FMsL0MlEXZ?uV4ElCGoZYEs?p;hy8O=
z7@uIq>b+5ZB(Hv{wsO-K4@h_rcKVeQ?z(!uE>o^1z<{52fVXVO$;4cd9N`pC?~9A@
z)X33=nStxPWA~7)1C94n@U8tW1$9_-Qaznm&$j1F`EuhE{X}nv0nQj!Uw=CZ1~4@3
zdW+2<ZE`!z3MAK2Q`B_@Rbb99!*86J*810HBZz;y_eZhGzIRIYT{_zBZNI;d4MZZA
z=DCZI>IZ&~9y!WGmDRw!IpoM}h6r6b^d03&^KE5(rbYmaEN1kYb;y2pO;boSKkF6X
z>+<A!3fce4Y@!og$*}AnJ}6rDdxk~@V9ucC(0x<NDCuQ5l6j_%fBZkT-Z{vUF8K4l
zJ#E`|_cW$$8`HLJ+qP}nwrykDwry@dyRpAF;*I_9)Q!3ow{B&gIw$j!`3-wrkN?be
zt^21hHGJjD-?*^xuk)=QM0`9D^6Gf4ri!OA<~(rsN&0Bd2%h{S)BGLVgI!BpLw1<;
zqJ-NtB(oC(yu_m#7h>rC_!&)`WldklY}_76+@lf}@i(&35`j~WDaJII&V44y?XlR?
ztzLRcW)L!%tD`<xv+$YnSE7GHIQ7_GG4W(2#FU2B;6A#kH|7Ja?KEP`Mac(lUs9vT
zaX9_E={KR}jWazVG9Vl-VwljfV>Qzlo>_forAQC0dsNXR?YVDn2zSv3$730qWS6PP
zda$J?NwX~LZ^E^qDG;+J|8ZSqLNZpgqDEF;rA<xOam!E+saJq$FF;_5nM4u5Mh6nR
zP}t~Hc$E|#6ntY+M(+Q{52@lLTxum_1!#rE_6|>5ZoU^qr|~7dtq=!hmQ?9{eRv;W
z+ds_0m+`d!>Ml2me&R;6+@dSJYdMwd&Vg(9$Xws_K><*7-HeqI_Rq^4PwQ}NMSP_4
zZeuc@cL|R3KqX_Ppk26iZwFQuU2{KPrH5eVo{aZ3%}9B^RtOoLul+orwzXESjA^fX
z!HX60F8HcV^ID1`nBn-i@yHwooAMewimA}GrkA+oZEbV~gEk4R#KWtkWsxi{NwsYe
zXo=}2^b*;bBg>KyKL&LK^2|?lIugyCUQH4E&5G~r!S9CHbV_F9-VW0BM@j%fgy|I`
z;Tb$(gS}|(o)2}1aP<HkOCvC!oF{+i28AJ3#k_3)G1@&v^OTn5`wz}&uk@F_z|^K8
z9{IyN`;sZ!iV?DQc0;iLc1j5x97=6*KF*9gNDmN7M;1D_4MF+3EENh-!kSQRkk*{Q
zA7Ofz6plkKrFJA0anM?1^3sLRczLDwDN5G|(_6r%Oou>4o%B?)vMU_SO^#u{KA<{@
zK*Sn<wV%pzh(xL^M)Ln6)I**mT7PqqpoP${P3VhA(<uG36jhHl!N_HkVC&XyZPr{;
zc02zsG))@!(QRZIV)wVf4hA?k5p5_ObQo+lDc*%R4f`d6quI!(nV0}gQEvJ>iMOx8
z>b+i%8^A}MH!P%X+SqSU)5If}15JCsS}jxm8WFfR%tn(NPdPE2Qb3*!=c*UHo>1d%
z&!;9mme;h3`seUvUW(D+6uYm1{I!b%@%45nOeBzHcGNlRvq#hWvMGPWpA;`wIL0aR
zy#zwn)R_YlahG!|0?5?aayPxLEW(Gf?TO#+<19j9aECSL=G&HtUvI2Oa!*G?S+iRx
zUT?4v#<?Hm`&|o?z*q>q+I#mbUT3OE;sBM}XQu7OR&!?qoLdKL5<q8^jI(A`u37b)
zxf;fhBz_Uh^ln%(fw}LR`}$GBM_=N%=Bv<ri6~XF;%t6?3z_D)7pLx<<kYp1@7_Ez
zFIKiIFI5{*rig@gn_ZD>vft{<ZQ?|7%jdO6zFHtRKs{5-{V11RN0u+`C%0*SD~C=`
zGu`SSzQ?+KkUh~MzWphwE{nur1+L@U+SNQ*<^HO{M&WMst7)t|KGEt<6`M$rcD!;-
zdv&je{-WTrV*Gfl35_QKmp3+R1v**N-L>HGxT{f7?UegH%SevMWk%QdMTicdBV^zb
z_UP)i#ncur*k@g*3$gCbM*qR*#zzMss+>2`WjXrO3YfG>Q8mMTp5rHB4%KoS0?Oiu
zvEa<0Tm1U!%PmBOBl@$T@gygnpA<w{fK(tLA=kJSBG|lN-<v_|?mL0(d&Hx-^F^cf
zt0XHT^r~^BUb&iymjQVU{8fDxDXWpa_8+~x*8{PQ-h?R0E|XOrMh06A%xc_JtPnAb
zEA%}2WINF3>#VM{`yZb>r^qL^!(}zNUJ3k;kF>T=C^aZCEwd{A@I$!@L<N0cG=P<~
zheDycaH)FKIz8|$!a&!Ui#2&KT<%@^W5UCN3Y$UEuv9!L{t&<6oai8L1beyQ5O(z=
zRh%YAWPN53%l%1M_oaNHS`Nj+HuCObqb%j#xqG}J8c5JBHX)VMJEgLAC4z!$Q_F#i
zb?a)=DMlgEWgPNV+m5@OQTL#L|IP1Ks4M=*6JKc}?0tt88}J?0n7K69&bIfR(>AvO
z10dR%45)ncGEDQz@k?K7K)<R&gVx&w$;xMbE<REs{EikWh+FY89zW!-uOwRj_`@6j
z51`Cx*d(a@KS%#Fu%qhpGg71}t%ZY=Hsz`z#Cd3WEp`bEh-fb<Kf`9_JNKV$wv|)3
z%7Rvgu0E}b_{YvCxHy@61dIB6@kNRFzn|N}{vV*MR%M2s%QnWrsD*BR?G|!xFPpSH
zI;(r4XsPZOu&qA>RhboKEoDe$;~#BM=S4c~s%nS4@6XE9mkp0dd(6J|S$C{43Da4X
zffzW`TMbV?tMzDbUTITh!-R5}5$s*Fvm@d7kM)f&%XnvJ8RN>n0ko378W*jqug`|c
z8}FgZENH6TuIf;&|J<D`Ab=`y?YVfhblDQ;W6#)iv+C}clYo&au5*sWe!6NLyG0z=
zk|Ry0>Y_y@u>6OCFU$M-3F~AzQBh*R?;Qex4Q^tpwM@{S<3M6exTgh{;wrYLJ+B4B
zJ?r<`lHm2tvmuZ-J_v>tiBC#3;swl*@1D`(Br29|{9hJere%*O3cQ~?4~U~}r?Bw2
zmcul0eFPPmOjq9pgk6AXZ;_Dt3sk(Qsdm$ux;s5|k;e4|UQ?ma0D96JVnE%Os;^E<
z^?_>s_1xxy0dnH1?=Gc|y#lSiNv9~3H@NW2_1mel6CfJ?b&e^~_E=<B@ZZ0rzHl~s
zd!jdJvM%esZl)O`w@ENeTz``str6@*RVN7CLN|HkfxKF4u6gd3e8W)%oVc_I)*`ow
zH*tz((ZN-O*~(&#?+wpr<H~kCqc>?nr(RY8HVxC_bg>P@eyn^LwO$Cvk~LYQ{8aq)
zP(Z@Fym|QK376wkbDJV_ytj<QyjmtZ2V!hn85B#B`2m#OnVRa2T^8~JtLK?NbpOaU
zGn?#T<%c%l{!84|2zEY@tWYv!N!9gFc=S%&<0xWPYuy9XkxxW5S2NR290-gEPt+<Q
zTPw7NJpxWJ<Urluh_dZI)dkJ$-51BbM|kB-^eqq6UD6jb#z>%49<ZEqIs@)-s_TDl
zx_6FT|C*wu#qZ4dVYD^<nH_GY4N}`-)b@Nh1ewDhvC|mXU~s~Dj_V#+6kB;9T-f(F
z$PVT-II4Y1#e{&oqgkKDC)4fD`y2vXwFcHtjyx*&U^FYD;4B5275?GlXzaH6iM0pT
z2hS!+v9xCyd`pkAxBRx*Xm+|$Hu7$&XEmc3ong?b#*K|B;w6-+gqVc>etnMnt+-Lm
z$c7Ntp);zawDpp<JOD=uNr8}_T(J3$;0aCl?r~mhGtPayp`B@AYV%<Ni!^SV=gB-v
zTi6qzwrkpiXj0K-IQyd8hfJ5lXBUIz5)v)kidKQP^Iieqr;dmT)?ab{NQVV%b=4hF
zwx;ay!MwHfcpIKp9FE5HTlnZ&ffzRr^h3YM;8U$)EZJC&w=k+d25=6ILnHiGN@AIf
z-G6Q^s`c*=@G@L@Afs66N7TyhP#7Q7)+(4}LS0<=cQWsG_s>15@&EXZgLm?&0c55l
zAIlfJzvrW>BkFIg(>@OUCgoGV;~$u<P5PM*56?I3=nzTKr_nHMMwW~s((azz9UQ?o
z{iJ9pIhBNO=HV^!zATkGpZ=ca_FwX@sX&`v1LgwRME7Q+e`auCcL^jVs&fy`PXsU5
zYARUT@Iw$nQqEJmwU%FOMvkufSJ(!aL*4*}3p@ZJs&S{#)-pg<1Sq;Ot;S5HTe<_A
z)!k_bSE+qImSx7FN*y^GNC+hhU7tnSp496Pq2Kp{qXX(w7bS`+pw~Op_y_v(Tt~|I
zJ(9FRE&gxq?rP=LYA9!UW<)};t$Nl4M8rwNlz<Dj7myEm&O2OAh5CKEj5;GD(8EV(
z#O8oO<t-2i31HeveTD&J4QPgu8;QG!(5sSlgv9rX798&mnQ!Us@?+~jE0JP-fGxNk
z=WBfM!$XJ)<%&erupNT|)DGkyo+z+SwVLB~%k*sd6T0jM-Ja|LnGXhSU@@vi!!=FH
z%HstY%jPm6qgQ_>iR!cLK;o9=&D=81(Syc(27W*C{lnIw2@V8Osb%civ)fy=MtSJ3
zWqIMoCW>_d^|2hz-mHZwD{2<k=?Z?iT(M&fju|S)IG~{RLwX{`_~JO~*qw80H3b6n
z<gIYwZg=_B$O8xrQM6AYl)r2Zf$-?bYdyKADLI8@#{B_+Wfs>ro{dc?j_^VX&o(&l
zdej?gi_dm$<zZG7*`rKEdbs^|;z3jZ6vNF3R%LWbhExS!z^)R#>yZPOM?IH~?yx4;
zEEpUN0RcT!g->ZQtp9AD>rd-NcYlD9h$ct0%1_}LF#QQLY|d7c7S-)EJ%sWm6%dVx
zV*o}Ba*z_WxJUG4t37+kv>htn_}fplSF=Eu6DcgHHaI8OErWUppG=%B7L`wLoTl);
zgvp!>x`8d)m4<J{F8~5LwYGosF`YMMxDhv+FYcBmgbk~&=!H1-C!U;$uyXA5?>kIY
z%yifx5LV0AUnw->mWGnXu{X}7>6I>MN%yKnuV=%ZgrcjQFf&pD-^M$DzQBo;T4x%#
zBdXC$C`Nf)JCdw*t1+i}H^Fv;M7$R7r0F_j@2rT$N7oB{h@>O$E8-2E@G_g;+@>aV
zaXY2!%6#Rg4CU4HEY?CsA5zek>6Z`o*5Uovp;k>R!~)0vTn)2zHID?==<Fd13N?x~
zz~KYBn~8s}XAOP_?61Kf$?cvt)StcO7UPN{!l{uu9^*M%S?ckkPQJ$KQL33LBmE5t
zp0J?qAGGe;y*`;rKRW34l;6?AEDQn=$+~|Gwy!*=$m4}P4x2f3!Z;|24Vr+v@PXHS
zJaI6)?isCSt+{Fzgr~Vp`S;Xp_d};K5~+*Tj!rI5pPNfcYX-eNb}6R5TD<?%s?jqc
z;kOp#C@;-$cCL}p4p*9S!AiD6?K5uPZ2nJej{_+zP)E10KNVhPn6tR63zY;w7NfpA
z{2?&x#Gqg2JvJ7&0Rmk`NM$<6?WupcK{qAxkvDG=8X4Tc2?Eat-mXYDYpwxv@2lU2
zY%(o!$xihHm#BC*>YdJvIgyE%#$!OLcb>7SbL;jr6pm-*7JC}KuYr^deqc@6)sT=j
z1;|LX1IEYJ_BuS}eOX}12cg>?Lx8Az9n@7%x9NM%)!<)<sq+9$(^XP0o1UV@O-h_>
zmGA50Nad00D;Sam?G(9tqn+@V8VVrmt$)GyGffQmLqos;qsW&O*W&A!Z|<5Rp;wc6
z@mQcvwEiGLAiI7{|G$#>r=(yTa!1Ji9-kdgLd}fb?l09d|94*DV*eyfc{C7Bj@|RN
z8;KEkUV=?H<YB#C3)d&7O!|piY7;NWn4~9Iweg>~otEzxT&pe2Hl{2={{pl)C={CD
zKdb=0t;2E^4f?p3Hwvh6-Rq#bXWd=N)LSxIH9&6xda{(DHA(WPp8%8$J_v?hb<<de
zzp%@GFRN=${g{G#jpH3;KOef#cckXfwVu(i(ow=AhRWI-16pFEfWfK6^!Yd<!Cngu
zg?;~up6Vh@!!hwZ1#h(?OtP*C4p>ND0&?{curCk5N^LO9S3GRw7l1ZvPzG}reAmxU
z^}?4jB93NUgWpZLj2W29z1VrsprCJLCuBmx>OY6Nb2dt^)Im#n`f;f8=1xMX)h^B@
zF7V@ul}^mGU+FF*t#pkpm8pGk)BibD6-)dRm4<y5laYqKRu@$kJz@#XPs`$~j^8}#
zOE0-SobukH>ADt8@w??)YQj|)tQGakyf$JcUlM^2qKt5+G2K_Knj?7VtVbqkJjp>d
zz^W>d?a;v}LZo>@S>tkf`F$p~^D`6{yiSEuAOnU_;AoJbMgZN`a!iiH;E{dR+mAnc
zPMqxm|A))!YDWJ4t8dTcxkjHItuH|cVEZ3%OHf_P<N|7t82?U91n~b6Unh_fMI%XB
z3Fd;Tvn!7R<57Qp)W+@d<z_(CcQQp6W;Q5LrZ#8{e-Qvs7w(w{@bx{p1N$98pO-SI
z%w!7(iG*Wz(HbX*@)Vk8sxS;{56Dw(TwiinK&RPLA9?a60J<JXER($ryQyBKdpfit
z`XfpYF?{Q;mg@l*)i14}T<jQzLk6?OsIg%YPEt>)bxxepDS(dJPblxy;N$k)p#lWZ
z!AxKPuglJ`d*y&2a^6&L0kmBm44}DK|NcQDWpt=t*tS*AM7DbeY?VFI6C~iW*4bdl
z01_~aIkO$|(?HUKL-yVjOa$JeR~2AI<@o}lS*?F2fD#7bY`vo}4|}ZJhOO0wI<q6T
zq5?Vj@@bPv3j~qR^wP-c-mw#-S@gVQ%@1451C#Ts^M+O$14uUqC_}q9lCIOW(ww8l
zIs1p*JFUwvv>BBpJK=@>#I1cLrjDtz7jLtKfns}tj|L(jKmotMJtsan4wEzk>}<nv
z=uUB5P?WyMDFwta-iX*(YWc~?D0;EvA84xuJ_K<Nm77u(Dl=49%BXW!H$EECP?!Y`
z&nGo5D-F;2%h;8J0GhRjV`O&6v{RcpM5uI*Tb+gogctc$ISdrBKOAs~5KzF#b#1tW
zf|Ld#qk0q#gH<^_=Ycn~Y76+Lp~f2|eww2Zdb;bz;(mSMrsXqWuf}5*c4?`7R>}Nl
z^+vDd)t!XGY5`>nJJ}&7+f}aA&-?V%k4-5g3~gF^BIQFO_TEb0nk9n<=PBowrH+fC
zR(2=rK%1GrDZrltd2b%=R4pr&$6L!~l;x=2r^+uLXRznfdXVbY?T8?%Q|c<Jl}aB+
zXJEvD!ar~O_W^tjwT76@B!XGPKjsdU_YjwGtIL(C%k>*AiJ1u+Wz|F2PtSiH@s}?#
zP#1*!U?L1a_y0j9X#sQ5pbN`0inX|Do&bjDrpGhX_L$SLTg9;JB(Uq$ISrxsU$?Yc
zk}KW>_QSTU#n?kv;=_9ivwA7<a6Njvk9^dHYH=WBmBHwAQBR?|;rQsGP&*aG*dxV&
z^t$v)e2;0R#n?SRvC^Pgeh<8w;zYE6k<ZIE*gIhGAlEnz<kj4E<(<u3Uh(@t^Q;3w
z`m`JnE`>f!P?%=IkI)2B06cBJ!ctLErh)lt6}+yht@)$S!Q6>13232e7Y3x^B^hWH
z0v&yu>A98HSPgSWMrA|oUU-@jok4Wx9H^IQe>Rl1I~tWaV1TQnZtp`720zxV-i81~
zLzQ>rQQ$v&QP!&OKwmRkPNJf6PPf~MG^btY1bKm50@q@qg2+OAK&ZTks3_3+`YFZ!
zD2PJ*vH48GvD&a%vjSLtiT^d@dCGFz#uq0b9J?@N&6~bHz=2Df?0DStIPPY(K~ti=
zo7|?_yEV2Ijn!zC&5#-5Mrb$QOHzY|QqTKxB(=UvB7DZ8&6q9JIuxUbzT%c^q{A|K
zG+l>|M(NGfvLL`czNgW<Qbyq;9Bp$}6Qn3#MDP=yE-nG{9UqF;(6=&FGOS%&Hv|3X
zLfnZ0*t~S`i-b)F{KBIm)BcCU3L=u+R**q8FGF13epIo#LMx%dydt(zL)|QJ$<@rV
z)be`)QIi7-H%f1cA6S<@7dzHp5Oc|xs!sDCPq|pyXSb1aM8%)DxSj*DtuKJW@=kNv
z+fx+jty+l9@ow7b2_vperJz66mNz`EB_Y3mAV=UzLL?>W(696l_tQKq>zg!=wG#NE
zR=!9eM_<l6mc%Xr;Z=F+Tnr*?hQfK8PGVuTsR;UEM|(tMhH$v_K`<GCJ~di*&J<$n
z;|K+ebt?)b&*Tmien+yE7L&Dy>Vjius@8h0_mzIQ(b2Nn6$_zaGzM@AiquM+EMIZ}
z=~+SJU?>di0i3M7F^@$5N-x^zXoX%)S(}5cM1plsS?V$<I_v(zO@~^7^KiwdodfzF
zq-A1mQZA4L7&bc_uq!T;Zw9g$i}4Hqum%dp#3bybg(jPXe|kj>!vTn;M^o$Y2W8h-
z0iqqKb8$Vq&FWpO7=d~ZZY!Zi#|&@CEd!ro#SOa75t%phbi-rE`QY5?@<wfMk#l{u
z`0IhTPiF98IG8;=Ue&6pSoZf~5kgkbpmq7r<hBJ|IN-rf<e_@)GQgF<F{rAB-h^L|
zYB8tU92~j6DRz~gU+HBui>>`xNG^Z)3F6_*zgn6N;^BVelAC$){3uri*f*ZuCJ2d$
z=syb?;<<3sEycIK7Ri^ZjKZKI3V7VIUdGbcZe7Ul@Muo_F+bPJQdcF14Frs|x&YwV
zG`X&742L?c$m;TzIQE|U6{x01)gSGE$_Yo|I<^Ag9B*6hka#eRGrv(MBa;->geoC>
zBYwp=hIg-t3p5oSCxq9kh#3GIO?753I81X-s9Y2RA}P0{WUTErC!3ID<WFib5mhEJ
zu;*P>9TJOY7w7hJ%C+N;)C;pHJEl|qDHvrAfw&i!S*uOx_dMxPp)^lZVb7SB)}%0p
z{1$hbvEJWjgtJMLV#}$`C1ApTcGLwQ913E`v>(dOOZJ44EvHhO3(cip+5&9I1SJ@2
z^3`WRnPBF<bGR_$>j(_4tG%kfxXT`7?QVGuH!6)P`~}tNcR*CYUdirhPxXKc+L1Qp
z*B2C-xi~$PciQs9espOC2@OHIFZ@ojQawuNE!tW9Oh^22BfJc#HeO-AF2huK_$uM-
zKutFR(o7OE*7C0X;9}CXo`;2R$H<~=KxL#(^k{xtAftJO*P^m*2K>?iNPHd;(8Rx!
zG&SXDw(gN?y`}J|F0lKF@4-;g5cYsH#_v*EUeETyvd_RahC_M?f`EP5(5{uQa1TZd
z<~*tGgl2eL-AIyIN7nIEtQ5cjG)LYMc{Y1dGP*s09_1}Kt0Qd(h$}GGos`jWEaYAG
zM}cLi^NhM&h#xVmWvpyr?W)m|6xhh2B%(YzEk6n@H^Av8JqrqY1cHFxeVa#s(j%UR
z6hWESQfZr@mI4SGWJ|Is#D`tkTdzh{b!8X~QI{59!kWg*K}o%+rZ({lh0>hAKOWU@
z?SCk&AfiV<g{{rg|IQ`;TC!G90bxVFC#}ZOgktN<B5P4G;?C{NG@LA>b8E(};a|CX
z`kZQKX~h1I5q(ZxBrE9<5&L`&9dlBM@dND~nf|*k0D(lhx|E23)nNBj2D0>^vsUh0
z=t~0RT2^>47wll@2*~vbrWWVT=Iqx?{+^u*v0@xg{cCTt@i``0Gr`x39=HCTK5a>2
zTkPfaTi7B1E|SWSsr-6cRv@nX%>&5lw;%W6l{ux#BftP|8ojp%JpK2C_x>g#uBwm{
z&piy;#b)F`bc;5skR1`~9ls^%qwl3I*tLex9{Do3S+oE^H{A1`CkuXe*K9RM4mCHp
z$&-tccXLV<^?lz49ZF_jCiipon5oU~6sT*#$8pu6ED-x{Y8%X$NUyKKvTrcPfmZS{
z$3qCREk$+o^A3|GbQ)qx!<lhorD8A8<>nc8v0`H`J-Er;&N|LeSSympGx?n}jiXY+
zBPf^h3TvP!E%$c}Twh>ua(DSy0Uvx3)kVc1Y&N**z0CD65zae!!xAv<iHh5m#lp?1
z$x2!jrNfQDfH_fYZ<j!<fh<L=uLCHWyL8q9O@jy|z;%6@OdC=|HWRhH$O3l8xU(AS
zqa&X<Vl*6a1?R_H%*BR|K$x(D>wpO+26tiX@HEKP3X0*BrVwA?E;4ji^(|dty)BvH
zF{IXkIWi|IgQ6<KVe~t-WD|-#aX2FeOzd8$qqULO9^}US`|+q~wUzLHtcK-?KqLZe
z6M>-Ot9*1tyP(><IZmtxDU>~V5cW1(C#d={jrNI7o`Q=PM}dR*8ip2SnZFrnC`njO
zc>Lm-y#ZQSz=FtUiZ~){hG=&gXPQqwda*l>Adj|>1$SaxUurJys5m)p<0Iht8-MfC
zfQ3FY@kDRCdFfJ7;kOP9*$$}kGd>|L3bIvrn>GtbPTzK<$=ajd1)n|~vI1!Pt%mFN
zavD#LLb*d>DIgK4Ihw={Tu1-1gWDF9%3@!NA>Y-Bo&tQ_ga8ydN9C52k}N*SR|I!u
zHcV3;OO>_!uL@bbcN!DssAGEgpqTzao~1Ua{j%d9S<iHpXA=SA`g#K)t3a;~iFBqJ
zC9huJC=EJWj^wGKB}TedgGmKlh1w5+O-IuB8A1n)>`T9{jtUK++P;zoTRJFGI1GA-
zajwcTPq-eDAR*lo$x$A-Y0z<s%5JbN-)&Zd9T@6Y98PH>VeoG_RQYnCWl$GOuxDWe
zTg@Q2tn06O3P^N@-U>uajl8MTKqTMs{-!~Oqk=DfA=VEYI8Au|{Rl{{ST~T6E1a3J
zTrKccMq3*Ifbfz&7lOU6Ri0q)ENcW=Bk~l+3x??2^jfLkM-123tYOy{!%PIku~Ol?
zY|J0*<BRjHCrGEeugAo;0nmul9li2O9xptzonHCppw7Qr&)5)eghhYl7~`98Eo-C<
zBoTqF-7jo#P0VhgFSLP`o(x4tdN>YcrFDQ1i&q=iraug#lMX~jW+1wPVsCe@UOsP0
zpKI%p-<3o@oX~-<hR_!>PU(n8#TOrqj~;$uOK_MAXS8ali<y5ngl9VRwd2BoVvoDz
z>m*qq%b!H|#n3Pacv@CSPpXjp99m;G6E*NeeW0OsIccV#HqTTMCPp{%6pRCt>bH<C
zqhnA3MTj8h?RZD(NqB}voIcWV-D4Uv2+>WJBL)KoE*Aj);k#ly#Lvj|8r)Ezs3uBB
z4H<LLwZkYKr8&2DBs^N>-yrO6T+@pc{#(rO_;c+gk}LW{<;N!e?uxat$}bkACn|dS
zk@!|UI0471X~$v554;fg_W^uWuiW%3>SRMIL`^jerNT+?9)^xrF;l678aG46TeaF~
zSj>QBE?XMRArPJ@dLon!nvXaNZac|X*%sW)X+??rQte3Een)-G1$~fBT@WeY*@QjS
zZdom8eNQs<x}Y;Qe`^l3!c@iliG&BA7qsiyNoHv!H*qPSAxBR{+&iXy&Q!QUAY=)B
zc2p(seuve;m2hi@>|&rBS@IjX^VUUwiLA%UsbXv>vQqQ~s2%9*JI&e&$G$<P^XbM@
z5I|>iDYAH+`eIjRIA;UaWww$32mmmrG+*deeFn~cd=n1YFuXH#%!i5aihpE@`WPl9
z2b-^G+3Dw!)3>9rqOiH3l}s}n1q4l^Gn5J2s=8Venf9{h;>m%fFdRVD{}ot&k?H~T
z$14W2;AYZv6ewR*9%gUwwa|nB@ZbgKMfJg8hFyHY+%qtm7!~s)R|t*44Hk)a{5`an
zg^H$l=;{Wxmhx?L0|Em^<lQ?tK~$YwFoporIPkPdQCeUG?ZvRA9mYPR_u){47cq#j
zA-kORy=d6iDVci5tc@4;B}ktM^j9o;cuSq;aaq?(F9vlVn>osIve(0b-Wny_Iwpk^
z*q01F1es4zGfULgo7h`HR};SxBofp`G<q|-jjVG6`q~i)6r)K@s<+C%`eBvAJOG`H
zAIw*9jiypHBH&*Z+XU*)JE`d#DUUlY{e2$8zr8JU#6?)V-rzGl=Ai%VdCRT#)t!n5
z%P&RJDv@IRtsf1g*`H3!!WHeQeUf6(E%zD%1|$>=G30hXy8gN<w2%r%SW>^19@FN<
z;C%HrVYP8gRZk@$*{|(4__50!q?iRI-f(ikSjLAiiam>Cl_ept`z`A-vLG6Yi@Lpi
zrGKr2Tz6I6t_cGgf;aQ7d=agly=Y+CivRQOPfayY+n`Gj1U*&HICaf@fv)iZ4540(
zl?vmbG<U02Q%C=nH}2t0+w>%9B)ePYs!w~NRvk%);&<sStd0d9Ceq~cW%eN)I}>(+
zL?RK3y#WwBkF-0ny;2G!CV6k~dj-}AcoY@pb=aB*S)JD%E3qlW09xWf@ju7H(j*bS
zFg;Vr1Fj58sOTMH>xV8#Uyeyv6ykX$<ra||Gs16lW|w!xv)*M^{{Ads_YqmMb4UO1
z_a_8){NZ6})-@L^5`x|*Ug7roAaO6$6C2vlseMAF&Iw~pCX}WsD|Byd?u%Euk?4zz
za%u(|!J@b{=Nein6dprniNTY!qWG8{0cCw6itr#h;gM_4zoe^WG|ko0fl1kK&^qdA
zyD#0Bd#DIO<_D%52Q71(Rk(rcKe-xxhesrhDT&JN{YyTTII{94qkE7-up1`e1}-WR
zG?@UpY};&oB@?WWg2z0D#~X&{RT#3*47DBY-y?9gvj~97j@q?{Zb&A))02&Z`Qzhv
zY{544G!E5icPm~$ZBQN+thEbi*$s6ymisPr8tya_7zSY+=Y@RV(--$K;*-u3?)_*>
zMl7o0corr11jwBjNb9LH{}Vp8Z(2akuprKONZ<U0jPXh;=Grgs_}bGPWy&f1=wm3h
z3oVJqJ%+~`hKEi^?V8|7(G`0>PJ!_n5`?);@Um1Z+9DhDvPV9_6wmVWAPM-xFOf*j
zC4UC~KkK{y{mK7t;5y&ypGQg~mY#TXz;7(s5RdkAmT?*gWrL*ayxy_z+r49W&>bRg
zLbm=ci4RC>WvL0}>yL@VO38_~Z-!Ln#PPPwCRz<GcU!rSW~WDH<X{^t;3>-`Ii_5z
z)zlLR=^tV4GvbM`SX7L)*Y70gf;NM4x}tfJlNNc|gob*tE#{k^aF}#or%p?lU{d~F
z$llJryNciQ{E~wpjQnV$sX~7@gmM2(v-A@_8UcqNCqIv=W}3+UJF7TLUa#zZ_$_rD
z?b%m${jSI5q(Ln1_AMR)13bK!gm=>tAQv@=t$GVh%MEkvBy0M})QuZ_h;Lw1eZqbg
z*p{<HiM;iGw{^X+4Lqa$vTtPhg~40G(>|kh!UhQ~cr!$lIqD(iR#|SsF<8C#d}w+s
z&A5~!!-^mfzW4kGV>S1TouSd<+J-i5^j}(3`S};!wAF~$$9+$V0u*dIv<+yO6$0df
z5?Ium`}3n_G=lzUXXj-Cp?AHyF*JX6Pz?_tJ4n<SqftTX_wM`yU)+=o;<I`wtll}a
z#ejU+f#L+b(SXXtz|!bI@`QWOGzg23u#K_cik`)RUXo9H3k?lUnR3o}4(0b@?Q6X>
zu~~<GF@;O<HJ01=E{YcY`X>cGOI5!+Hte#u<#Wxr2*wQ$_6CU4U6sgM)SWHxrBoY-
zI(i(6>&kL642gFYrGC}v+iJ+0YT=rBeKqyVfhwUv!s%kmutG$X-57kByyYd&3etl;
zy1iwQ`Sivja|iPfSIsdMm{|z?lanIu4OA<+^crV%7_?H^?~jZ7n+lvM4AJ$HZS$A)
zZk9Pn+^4@viLiW(RU>cTA2#c*N~IG2ZqIhf9D*sRH4*bEG(^kInaZ=P)fC{Qi~lbR
z5E@%5Vm14BeJtuL?4(paNF>MdZCBTgGz=x2@S2s!lSZ)!N~(2nuOv-+t4W3<G3#=&
z3s<RJnGst-{}8p9YO+BoPs`MBeA;*teM)*Ls9Z5`Ifgln^KV{hk&Jpl1r`m3P|DrK
zQIoAjMFnKuZza=%+v1!k`8D~bx|$(kXi1WbI<y&CyN1fQl0&qMJLbEgKl3byJ~fs@
z)vCnU7ms{7yZAUNfg9Q;T#r?^i!R0L%y2^gj2~5q>k_vqnm2XB<L<tI19MT&ZnYgu
zZ>f2(LH3zHYVj(b_Jh$l_66rMOc`*fh6%2jrqLIR@ehM#T}C_S*2Xpxa(?aQ*r=IA
zW`)yGA#~%BtLUGCFv%*;I5*H`YR1s$C4sfr1jg_T-9AEmLvBY2Gm`=bInV4JxJN#g
zdas<-APwdS)`NF{L2TmS$&b{On>?L7cL{29$_WAZmQIo`$(6a39BofCZ6egW*p36V
z$S>X+z0M8wRzXTEv0yUWEH^*sbavF4ZzqaIL_5Ad^J5IQinKC%zAwj<_S^Q#q50bz
z*K7ZoICqP|d2(9JDR~X#H5_@>)kH~+JURR^6JoC+m@y`CC*aCx_+_wPI(WHl;&o%Q
z3Qi!Uc5E+{Y}fy+UJc8Cp7AfZ2x%_S3m{z9I+_sZT+rn~cX>2_#hXT}LxjpGzw5m)
z1r?>IC9n2qbPO8btHmv$E6Uzfj16nB$@N!s`3{W!G_u&Uq&82B(u*43Bk=fwa+#$u
zgE&bR9h}KwY-4D9*Ln{b|D6;u`#_5bV0oFQtc8zXher?1<4T2475)P+raI<Z{@gx(
z{?TS;m$uKfiy`G&P0BI)_AC6uFa7dhur+?a$t=qI7|e-$wP=nSfgjNP@zpIrN5x~|
z@zaghW?3kU`Sx&t1@CO0g7JGqt6kqCqwkMvXLm8>r{f~)@|m%qK$PPYI46HtU?V?h
zB>dJ>k-^y5<ZDHnv4LmtH;z6d%h`eh4iI0%Cpwc3V{oQwl{%{6uQ&Ip%uNy@Om4@#
zVzliY1ET>nmaNV6@}N%R6R0~&EkYV51}glf`q%g`&zBj>2^%>Y(f7_Lh0yf~xog}W
z3o^o-MiG_%FHJ_R;bp6TN4`(upxE6r(ncts+Bcr3A;#km=lI#E7CO+PEL3r|BkEj&
zRl$NX#n1d-y@JW8cn~Te9H?_Zxw-{FmUwAfelk95RN+0^T1DiCpCNrvkFGUz2N)}u
zV#DtiabI*^Yg5&bN4ybxjIIvI_7=$F58|mUc$ZQuY1%Fuvlw?A#$d!B5Y9(LwXh<v
z{S546A7D;K0j(i>9dpkts%r3_kAwnFFAms?-l<GDR4A$Skfevtzc=Wdk+dyzxb1c;
zg6LgMD3_*((f=6qGZ^wBaq^2#*K}QsyK8hU86(<X4xm8+ayN5U(`826PGKcIG%LUF
z*XJP#NfCW;$H<hPO-Hf1+{FaN&Wh19R+p@){0X$i?_c+E#5LxsBE`vc*D$jSX|Acs
z4xsNXrSrjmHYccnHIs2Q0cq}Qy*_XFJddim;M~V4^8x*^M8_2TL&1_{mxUz7(UQB`
z!%7)9;3h|S=@K-etD>^r=L0<|H5pO@{VdTrKip;!o*i~|Z9kK6_txTOD<8ELEVa;W
zVuT<GHLJZ(*@kB^)4RBaU+ez3-6BivbArXt9eDh6<!}`qN@`^Whs56I74kvDU+b<D
zNwei1Xr?mHJxX~UBDMcSfLVGC?xSS?z2?&QIWqgm?y7_*f0ZcZmGCwyspcyVEq>;e
z+x8%|v9<TB3Gxx?S*@)8X~!w&I9U*a12k6LkDuq2Z{mFwsm)J4&J@l<>#VIOAA-IH
z_6R7U|5~TCm_s&WYg6kie=H}hx>^k)B&fk`_vg|$mKPwN$aoK`5RmaQt)TwipP30N
zhjV2%6n-gWZf7{2@pn80+q~!;M+Y_P+Y(jGQ|X~msKj_zXQ@{^ho0fDFfQGpMlM%U
zubo&P^--nK;mC5%^$jtDpAI+-&;K|c9pEv!7;JOeyy`1+GFF+-n>ZZM@u-~UaUZRy
z;b<24RFe(+<K4f@s`qZ|)Is-375MEN{Wz990|=}cVe*mlsk{+_KJK`X`T*Odnr*hv
zBEIhr&#AKlYgXP0Sa>4+ISabm=ukf96hbFP?#f7oyF>rkJ+Nl@10F%!C?)FVAEzk?
z*6uld3utM`%x%S4T2NGklo@rS8NGEWIMI<+_yRB>$Khh6$37>6D=+2!tPlpT_#%{>
z*XL!VS;+&YMhk21d#m+~LHDa4h~;)WP--2aqzqM|-w_jAg&ZqbUrJ3Ofogh`F*mQ3
zK{3^2x8iY%ai87uFbwzmp6%1SXE%blX-@>Km(7)306C+gqAoylVAS}kNdUWliM0au
z9w{s!dShdpHB*Z9l+P%Wpb0yYe2vH#eL1;=ayyTy;*j{OtWi&tOMETPoG#OB*3a4T
z7eEj#r*jL%Vc{cVEIMFiNsCexUt$<QCXdjkvps%TcFhCea5mB4mFj2%!ivuk&8z3T
zBl|ls*JwjGgpjCtoX_fj>9Q4OL{S6e$cMc)lp??8_bW7bLsLJJ{#iMql9bbytZLPq
z%dSxqh@t#YrCyiY<-wsk5E!uD{I?=5G6kOkc#L~O`0@aHa1bK=?wfC^FOBmSQpJ>-
ziWw|&Bx)wA&McSv#QEF66PR*M?2h)v{Lk8-REDj+>aRf~l<?SP7&Cq;s1u1<e|<-z
zwkV3$2LlbbLaj}JuS!CH#75iH-czEQxlUAt8<nb@=L?6F$5fXOe24KDg9$bi-`wNF
zv1p0#nZ%!lEb@1smv9SF-gK1H=+Er8+h@=+7r4UMvG>k1-gn_+XC5ZL@cBl>?=5d1
zZ~o%8P3U^voPd!Je;|M$Ym-XS7YmJn>GmQ8w=RPS-n3dRr_DYhgISJ4Ou55)wiCdI
zv8UaXkG|{Z<yrAexihhGU)c$o3-xN(kqnoBRS82>R(pKQcq7EGVVL8EQqEP<YaM(P
zQA&kP9a4;>6xIlN+1onwgO;@q0PxhF3kEJW$#y!wh|fxg6&d50r7M5E>+Cf`MF3gM
zw~lAN(`1<8arS;-Wrq!k(GxmTORc7xIf__F=D}WacX=|v=uIr)t|PrnAT?q^!dq?5
z^8&Q?#GFfLVVh4~85EZxYp!vckR7Jpi(5F7n({k1z8)~T#E8-vn<+%yxa6B5x;Gme
zG9p2GR5~##nkJ`#v){v?q76ShAAd`iVO^B645T4?nelRB*pIb&6>EJX!cs!F0+-Zk
z1yI_k(D|16YH}F9?L)|IZz=^2f3C^_pXjO}z=m;*S*=bTr{kGbQwQ(sHe3A}pG(jO
z<P)-+w3YU}5M{Ma(iWt553yJa)G_rIyl|j56mfmmD=xUz$Ii2ef;+FI*K^wYFl4qH
zIvs+oH0rBI7j^+tVi91;C-#n5?Jz)P&z@BbONgvMEve3?Lxm3=)X-Hq9z?UXc3&)K
z9O)^U85+!b(FHdPOZv2~`+>Q_ve5LO72c8GKe<}KxW5Fj?2MaLejw9h0b<?sr(qr}
z0Bt~V$8md6eo=Cs$j~Y~iLK9hiBUI|ywzXf6H1X=t{7X_0R(?2fV87R7gXDjStao?
ztZH4^+ml?{lxO;eBR#B8Hjr&%gg99dnDeRda0Caos?(93!ytv#5%_X~PC8z}!`OW}
zQIe*6dPmJnlfqNJ2f?#!pOeVg-&%m;ZRrXsHQOCgg0$#rDZi$H;19_4o>_1>p$vQ;
z%)S2r_p4kJc=N(>1@X`5I>FdiZI=k^&5EWT`==c31lLtUH&`KgQ}IrSj6(Ih(<&w1
zZd9LR0djFN9B+i5wk+6hPQLmvwkI;a+MRwQD)@7N{$?>Y1^SHIKB55-Sg6CMOmpkN
zI}E3}_;i-%88Ki)<(~^NI!a;ges2wKu=aRd#>nw%Qr4L<T3rE#rtp_U!`IAc1{>Nc
z9w!^DGRhJJQ22UMvf(tbFilXH831XLxzHFneF@~8!&<y9Z}#DD+Da<C43nD{bu5#r
z+m$Snk|b!wDBZCIS{m|`koG0=xk-tW&7MT|bZ1om$SdP(of8!_ilszRz9$Y(2Oq8}
zasW4Rp4r1lWM(cL55!CBaIfgC*pze#6q|DL=}$188^0A8fQ^2>5_6_3sXk}@MPl_Q
zMFmC}fV&uQdL<N1eb~eWSa~w`kSTmM{2I3V1wUTmQ4~VxCfPjmS3PZPd!ygX@+4S>
zF>AX(+RJ+UU$RkmFfqm-ni{C%i2Km6f`jQ%bi3RX`mh=1dF?EUA-nv2$z?V(eDu=i
zn<8#bBl6~FrgW)8n=67&&VRM=>ztvSZLw6d8t53frZIfwx;>QQf-QJcY(oxl8M8a=
z#h)1VCn{Tp%G$e1lt1&{>Ce1p>|_)bm6)}1wQu%mboHjKPmnmDP``k1uJeg-v|5Q;
zsj+B&^m>I-($C1Q@io6SeJBOBB&lrQ(P+Zo;MHSZr{~YLyZzuM3Hy}AW!$yp+Tpd)
zD-#|8**gm6v;J``SKqj=7U4agOpyp|;`)efd0byhuwaQWHk$Dsztqq)6W?N0^G8Y(
za|n1R!fDLNFOkGj<{c5B@u`iNmaqYtXoBBja_MBJB9U)>@3PHm@91hr5D=OOOV2eW
zPZxKVjY!!ByT3K6*I&{d#VqXby_nQw8hB`gitJ<kB?Yg!9@o7K_KUM461F<ET4)y4
zRiaewzhw(+{iFY>SR|zNQ$fgh{?~7@?$QxeVGUk)6Be6sTK42X*5VhLx8tQ6xy<^u
z5$vwgLLGYpr@a+@)P1zKrm(-bjmj0+b~5g0@hbmKkH%?x_KWYV8(*9wg}}%wQ(nVA
zDrWa{0q7PF#!Y!Fr+gl*^C+&r0EK);zgEC#QS3w6a~d^O`q3&;wOXvN@)+#hdX%XI
zW|kr?rHS-nn)HLArWxodx`%PEh_Dev@IT{Nm9<fzywsi~L<_Tyoyi8eU^hMDE8`k|
z(xO5#fMjz_iC3fhZ)@@)5Fp&ND+8lwto?e0KybdiLy*;suChr8>vP`0VtPhTi1+IG
zmm#!#(il1wv}+18@ebGcMW5DABns?#{?An&{*5r3Hll#g$?3cu27C`c3>e+bQ!v4_
z=?2>m=;~1jTN0~;ve7W}JEZ;0Nv$mvWxX@xvs`<HMiUR25~EYkJ!$QUzHaV?TGUHR
zlkR|fRb?H4q{v#-%DP-;RFn|n^SGTz^kPC1Or0w~IDp^pck6S#MN`KG-D^ma1A&Qw
zF-*C`PwHpd7b6Z!`Px$%3@*BM{3Ve6q#A@0@cqzfScDdIA2T`&>hwXqF&l`C(3lau
zNvu$}FNiZJbU0p3{(lFD|Db3(ZFl}?{t5O#7=|0HiK2JnvBm@ddus)6Qfsd7cWM8F
zIbTQTl>ti$-Hry}oha<u7-p+>0bt9?5-c#jxUbj|(wuu|$>=r(1cDlNyxjHN1uNe$
z!jj-aOA<}bBK<2UK-67AI-tlKV&PuE_?@xbdsF?IJb(yt*T#rkAFTxzbw|`-t|C~T
z*pxM|*UbYf2}+OaGasfn*R34@y(=CZ0AWnw@v8`Do76qDOO$!m-#LPef57k8u~GTG
z*4F@i4%28=k1e3FK341fE!y8tLeZ<wKvQ%7bTYm#DxF1>Y1=aCxj&HBt4i*9YaFv&
z_yfR0+jrUy`ky1<n!JYgC;fSmqVh$-Oi8oi<X85p4$rrN_>f#Wna#(?D@X@7M)$6o
zAdD+*q_Lewlfq1yZft)^_9=SzEL+s)xqR&un|<$fa674yJKL7rX|aiKoCXL@o>w%|
z6y@egk|%ebOUP~QtJ!eI-*nOcZXQp@#{-Sy0%$C!A7>_$Tp!y%{K!d;9cXbfW=nh8
z^W^5H2hTa8J#Xt*&jJAD>-9kU*DSbLGWk|euZ++VJ@LIICABhL;;dG}SzWd+^z$ea
zI@@v+;5M*1NbofXYn$0JG`|4vvTJB0S46v#r_n`+ZJICn^;fDA;g#Pc#lqlUlbHHW
zl%i07?#oVZFr_&+4-}*kw6KdM1trGv1CdB=V85tK#r3oxHD)WTD{JGd6vBbRHV2cU
zHBAr>(h!>kw5VI{OMGOfc)e^s^GvTkr$F4ElCg<-sekYIS-sAUFP)RWJZQ;($k3wD
zbn@bpPP`I(uYd==a`lc%>1lTj;{Fj|d}9oGd{SrSwzSUq!-b&TVJ1ygTDh*dQ0BKS
z1MHjVqqJabB3uE)hj%io3CVQx%GsV50}G%vws|YTH_D!>sGT9}b&zrWX)}xA(v$Qd
z%792*W95;v%6&3;IA?%v(FpLKZmTPKJbpSnEP!ZF7AL_uyV$_+ouJL*oVMz8q{hCs
z_1b`q2ELSg<Ei3rxNAy8)A+@+x%?Cajny2`wZB`4_@hLF=fBTGu~R_%h8oadgK0P8
zY|3~CHOD;CunLl>)@ZGS2nYvTm5W_%oa)z;{*q*Fi8K~j5<1MLw!{3e>up^(1Gl+l
z>2Chys0FCBUk*y-pv)?1O@XTAzV}~i;^^D>w6$E=V(PuCGuN|+1#&O#VgBZt7<?QU
z3)}qYHT%o@(-Vyp^VEcs=(^VKmL;FKSB~e<YIQL0?|VXV!y)|b8p&5Lzc##VN$3T3
zvjYD3Da_b0A+#>pLveWjkKEgx`LE0)g~L0{uGHl3R9ZCNaZNQK8adp9AERqsG*s)k
z{X60Ov3ehvI(5M{#xZULlndxLK^X<>67%S=6UGGi{Xp$hW<JC?_u|7z<CH7u<5D8b
z-qFe^HzjC^%xsqI?Rxv<O>aomhJjVOQJ__2xe)ROapi*q#Qt}-XY!9-s7^4+Utu2i
z892xz1N7(%JtC)Dd!J(~T%b0A`bTB;ylsenz%6rBFjISV*BJI|26Du$4YFxfHKt5f
zFowG#QZp0k7ppN796JzC<h##dt_{Fj?9kbQlgxk{JJ51xTNGD2rh_zBGahRUfUXQy
zv()byKeyB#3}+>22v$_(xU8YrvJ;a4otB;HzLG}bEv%4rk6J2V+xFvE)Mnpygu7wY
zo8Ot%2K}BW_YjVi`!>y`)qO80YaUxMaM7`-Adi~G2{zRm6-t6<X%TM42MsC?fAd+H
zCN#0zfz%LvXxtCe_ye-tZW9Wo4bXAcZY6?RTFp3nhNUKE3;i<k$5)u=jBv1;O)m<&
z+U;Jm4Jj~Mc^J>DN;;_q#T$s1@u`n634%&`FcwK_KO=fbG0f>1B&7e^;GZ0lB(Q@%
zyE!=-_NE?!d!JnY4Z~Xf=tAque4H{Z$Zq{D`X#-PMry=c(sEZEZu5K4)})6yOWU};
zGvUvJvHP@<FzT72+F~_AP}!2s7<hymvWEC8D|p!P-hL&ISX3@WIH1<$hX9LmcJO_p
z*3r!3oV#j_!DcdP6+l)6RRw)v>JIItA3R$TjdjR8HszoT%m>sa>YziFd72wzYRQ<C
z&fI_=Qk|zm(2jsCM=NG^h5YTkrNE75{l!Faet^1U*mX9Jg^enTKvN3mu#((m=8^F}
z_!HVWgIC<)Gx0fTvH6E#Wy;C9HXS^OH-A%U6%)+F2m0V}7vz0jBm66ewE0mP1e8+J
z=R@=C0)gsr^&n5HrV%3CbdJ$_nyhN3ws)J?!Lbm)cSP+1WKVSO<Id~7H~6Bqjm8f5
zyxqChwTDTiDYCUbGt|RFZndt&VX1bXldUi+G<v?h&<ESD<zrT1<rA7ml?(f$itHy7
zGmDZ6lcN7O$pO>oxW@9NSM++4BOZz!_!vlA!DAGIo~6FY!yvoi3jW_3TldpldWi<(
zjIra8J9~Fq`Opw{-k5k^`Ac$66VQcGQc7<*e%cI8=Dqr`FnG(5PfMG7*XC+~6ffrB
zuVTl!Ya;dH3J$-?ZL6{A;DA#9XKnGA`G5W0Xwm;?RpS_(o@PWO=a|G9Ckl(fr&Ou1
zsXjkVU?PpE^(q}88RCX4=u&CjlxiyONVX%E^p@m-y#{+Q>C-6=7xW8?UA_jXUzYGk
zx>Lo;FWx~D4!lJgg_x{?F>!>hc}CxD#oTS>CtY!i0uav1sn;yBzqb!MqE4x)+Q0aq
zP}W&eW>8kG?fy-%3vnD>O)CaFlGRmmif%g=sGN1hEi*D2pvMmc2Fxd@h-0*41)i8I
zCN#nO$V9}}cxwKoXqU#h#!m3~(B)w`&eiXGF2{!Mb}bWFe#b+A7Er8b4W9W1iml}0
z^OJLT$GrUnf>7KZ_8csavx5$LOqh=prU2=@wEdQw`){kXu$LvNDXvVvb9p&RUX8ie
z3<kJ-4u=ld`%AwBPB@#R^L2RVB@D1VS&`btD=CqIhkh|q(>E)aH5)y8x$K(o(A;)5
zecCe0f@qKY9*p|gK7G`=9IJh!B2BuvjP4=78-IO$W{V)hqagIfox?BPTkejca;6JI
zlKXfQM_$H0>^m%QPI1_mqHPLTTvata3R@Jwwdzx1YuE;rt`yIey<DVX;n6_7Y+wfh
z+h)o1^gUz@G+u~gv1xvtHjNi?3MXYb4p@X{_YOtm%XN>X|FQs23(b`o%ZvSAguP>U
zW!<*#J7XtRv29drS8Ut1Z6_7mwr$%^Dt5)TbyM#;Yn^@e+4tUOe3>7{^UOK=><y#!
z-@moq6d_5c+QgKva@HgOP+0IaDon@A;8$ItDj&Tdi=n6y9GiT?LM3rO9FKy?>s>A~
z+An%vcw3Rp;5w;}1UM29rdAYF^iXA(RUlX}gU<8fCSh$osm1)Niu&092{u(w{Aw&q
zE*rH;-6Q?kzHv9!cH@`>V0)(XB~UYshMISAJI!uOcqg-Ra@?wBerel_Nhk?p^+B9&
zFu%QL#I@q3eW@;J*d$R|Dz4@n0_yP@9Myhk*S<nOim(3>l#t9jRKge}X9E3rMlQO#
zcGKC)bN(sDQB6-&9Y6+$J{K-J>C{B0MZa32O$Y>6;=s;#pckDm$+~I@4!AtT0QYo;
z0?_eP@xC49E~CFrn2-#D-geu+xN5{FCxKxfXW8b7E(<3ted`wMO1oULaMf6aPsjuY
zkTe@v8j@DdMs)Z)PF`6GtB9|y_%LP8^0hnI{mHTr&hOM8A%i2O6f^_DZzWR@X_k1j
zsJK(UTEY08!mH6?RUJx&j1fe=l$fa7sfBuOifpWMw=xpQtK`y(qNg)1j7s}eonLeg
zmNzy@Z7~&(x+MA<j@KYsGUMd{<hu_2x*9P!1N`vdQWhn?kTeBKXC%|#GzBQ>#T$cA
z`JfWn&!1MByzUNOt!V2IWx{l2^Doq8N?ytATecP`{ZqeQ2${$D_YI)P<(-RPv0~kl
z0wZU#p=Q%{qKuY`3d4e0)dwX(cD*SGCnh$a{XXG)s`?0aPLA$5sWEUCAfaTRNnbD+
z+#Z6w)PonsiFTT$28`iG)(g(`0y|@FQT{(Hu<d&2Y6GM8d31XFHyPc0&`MA^S%&42
zUW}g89H8|KzB+mjaKOwD+nijApExe|Wk2S&XcZfP$tn)(c$PCc!~YOj=X->(TuhiL
z9Yd-1a%1@oXo}M7tYA7I+UH(f)#b|#fcSnmD}ryITu$Uoz(`C@VR800-$|NPUA<&h
z#bLBX;gH=c75vz8t!;>-H^xr+Tu4pDYJ0RPVY3w?W3%TrUop?3!EP0&B7I$5uynk+
zZpf9@l<=uP*j!cZc3!Osqgu>%HkQRU8hw>2lFS1-<K_qH@U!*pySCoW-;1H&{v8OI
zi93UBVa?4<@T{s@yq!1opUBjw$Yr&Z;1p<FMdfQ4fF$SQQ$ln56^ssaQF1K4FH;$>
zFApK}=l@1^g$om?S~b9`3=<;Zo)B%7;Qflqeg|ei#VABv^}&hQOJA>QIFVM@kPfEh
zlfpnBjhSN|+t{n1ImAXKxX2W#q0e&%a@?j;XxzaRFKF<`n0#T*2B1GWtbkjb7~>w4
zICPTshOPi%4D7!5PI)nE@nFvqTO024<&w*P*g9)@mYGuZ^Q26v98>@#bO*<`{H<;C
zOl-IS(IGgZo)<RdLo@gHR0+}um6sI&CgTmNu`K}WNWHUz@F;9i*eEnmF0N!W(ChSo
z8cA;(;A=f229($Co(`eAwOU!eUgI57#59p!2ctqw<z`mu^$2(oM5Y}<*{}}`!2X@_
zetxKk|9Ft)Y~T}l{GO_=s;$@7#|3jL{{4)D0h0A_%iSe$3KS6GX&(?OC1{qf*{P{s
z!2wruiOrV#z0PMk5~clzO>R|%=4sy9nXwfl?r!df^IoNsou|+t(qE&hDirL))kyy*
z)g`(lba6xGECFe)kEo&n09ZM5-p+|rK`eda5N|ItN^XH-@_8LpC|O^_6!0Lb%1)V~
z7K|4vPbjQ<%6q>%q-qI2I~B!DX+2e*!EXOdvYt<GYeta{q-2z!WChs)ERN2(?_QU6
z2`Vu#tM!`0sH^d-&5h6V!LhXk@VjCC1gFJ9m&mDZ=!y*gB-k~k(LlkT3j-o+VHjau
zgVW#nU(odH#_djyd{!nm)s^Nfr15lb?l%Ttod>=<=?U(@FrAuOC_zrtGu1OJjh!iz
zD;t@P8z6nBUsQaj;I?^k?kDkmNIZP@z$Z<f@$7w2qBN!9wUBqDeDH-M$vBj%{HoKB
z&bB#`n@zN@lgT>S%U>tJrrf5F-qq2z{m+wR4ilV_7mK}D{*ObF*xQ|UyH@ZyS{(4^
zz`Lox8aU694OT<XHOkt*iYsCo6(JI`zT955cQdrDA~Bq@8A^SrIISPL%+rAL_1*bQ
zES+n%+v}0iQ)>+BdVhu%9|Q!$&rHSZ-zk{Fs7}>%=ICn6FL@1mYWQdK|7HQ;R9v7<
zDNV6ymTs4RXxxNVcMzNdOy_z)1SM`@w&&uS;_ZZl0WqxkIDY=1R{*v+_rO5OJPm}R
zK9?nX)~^8`o4zJ6MRo=}99=_!lYhZx9ADU4klVkwGt%z>J5I%y3%kVfXGvMcv6gV!
z2FGf@3i|nD67|@gOr7a+s>1+(15YtLQdh`)xS$VM7n8xX>HT_`6yXiiVi3(PT!7{3
z`~~$5EusR7n^hS$MUE7Ssd#HUA+6RneQL=ElNzZ_BO;WAyyZ#7ia+y7*$+!lUs}TE
zPv(7;F>t9bYC6VCA^{An0>9^PZdw}<@7_W8u2pT_yWYo*DV1oJ@S<b)z=>-xv|Oc~
zv#7{BDmt|C)_s~T6_h7JhT7VO3<o%h5C4JehJdwyRLjU34`Ny*WkVuK5{u#4`1o)(
zkjLkvLG^QUR|un?J3IaC>UKTPpE4jche{nQk%R&1^v`Y7zI&9<EX~pMohyi`$}k#4
zZA+ZT4?F-Hj>(r<OUy5cN5>VeW7YtYJzU<aNvocIRqqZ}wrMD}-C5MQbJU+_4!|8Y
zfcv5){8M7<Ya<N20t_mDy5j5a-7v5$d+kul&|1y5Q!V^it4=x|8v~cV`W<W&l;Zq#
z;B>Rv34=&@X0bBTm>{}rV8JL5WTHmnpPa_~P5J=7?Nu`qYY;7vUaMUJq8W)B$h2%j
zfoVKmg5p4AymRU>S~txtwwo4_+ikt2%-Tz+gr!_vwkdBz4OyFn)ECm^fphu+7!ExP
z-BDMQAYbp#X^H(f2^hzdbM863-5@G=C{Nx(@_wSElyV6S477@@6Z~IHT~`u;X(MFr
zQLvLU4<x(<W(IHrjg!%tPGg3*{tGNPw-L!Y_4Qkd2Udg0cb~#JGv-zOZ#_#uqSXVp
zE1nVOLC&vsxno=m9`I2U5Dxvaw%`sA+ga+u9xygPT3-FptwLP30<GA(xcm)?_-xNG
zv(6*=H<w+pa%OUQGkgW?oH`(i^)yBzS~8Sa^Nk9D2~018Et)4k?S!ao{oQ|@ZgYLU
zEw4+w!Ve~XOUQVCiO>I<Y;|zNyEzVz)|m42;V@N}h-ca5pcyyOJpGHOi(#=jfT|}b
zIMRnlBHh{ZanzAW_HJtlhH!}X>3;jA2M>PJ`Qm*jS<e|tf_IJV&n;Y^qr?==RsxUt
zYEnSAcdh=XRHw+H7~Yh%KHK%Gv|YB|w?8ZE3orXCKkm*~-Z58lXJ2=_p1eLbXoaCP
zdP(ofyV01!UM}tBc`j#4URypR&8#^dKOWJjl*zuZ%?s_@)e<wqF9>8d7(EnJBdN<#
z7XjF0tekWAn1623_Bip8do_5*8zl~jf-u$2NCGGV?R?G8mSGum4h~}GM!(B)wnsEB
zDn{5K#hTIf7I7!@2wcFdC?&dEdl73ci$y4C?CaFx-l~U01To*=xd|mTVdT70b6Z66
z%EP`nT+^5^0+fL@tjjtqvTbdKzVK#H7g$@@>GS)apY*duDW?aECJ}oFcpaagN7i`t
zp*sbF2(L{js7?{Y-Y}Q19P@_`;!aV>D8BN2i?PHP+k<$lr(C{vE)eS&TikElc;kDF
zPwCf^?K}}Uq7ysN_kMl@HoNad^c!2n)|q4-SPLbzQpNUiiD)L``*0Z}C(=l43XYCn
zUF&6TPd+3^B$b^bN+N4)$lO!KGddO|h%3bGzSZbPw$)7u|1dDJ>JSq~uKoeO&-V;l
zp!?_6eo$Su2m0q%c72q`z_YT`_K=Ax(zf^JB%fXykXhVE#QfzfI6!hb)2=rtn!)DN
ztsckT$daBKTrifPWf$Pg7RU8uRZ=5j8=b+~*8KFUS~+%80|wPd`OF?SX}y71#q;DP
zJ38}r=W+Wn<HxrQHK}N{#KV%Se+POk+s?b(=*VE=w7Yh3#wfqrzpCN_WPeOaEV`o;
ziCY&q*vdBGom@N8wYK5!h7EOew4EMjzwf@x2Nr$47+P_cDy)%1fC0O75tE57!3L5b
zE(WW2zODU{yM6yqC3|Jguwa;b#SrPYxxKYc2k?2ZTc{+B2ck%IYo$4Hg|;+0q+gfK
zxw5$Fl&z!+L)#=|R9^WY_`v&~h+i+vCHH~uGYhDEB|qqhFb{=K9WT<mBy|({*Vr~h
zrz<smMmw<-95o>h(Z*v*8yO;Sbxt!$)ae;D+><XRIu31!O*t4_HJMNTaQ3$bXV_U?
zxBTSs$1m4;8s-*fR9ycmn1x}O8z(J*n~}LL;FDfO9TMNJ5v8brk8L{b{V3U9OuLwe
zHS>^67WAZFPU*AZ7LY-R_gYQh#gl@DmF4KAPu_B?Thx2m*((z_Myr|x^aNjAk)~rx
zMZhce7n_o1M|a99FF_eOBZ+lOrokF=ND1i^)8ELl6qm73*CEc7fM9XNN=Sg53XlGk
zVJs?HtA7ju{o(XKer8FuP5p*8*6wkB5-HN~Qr8hzItsn0CMyZ1^hl?>iwc_&W#mwM
z4-0#Nev7<}Ox-QZsujBDFoGRy;-Pzaal%rzygjeRh8~0n5rGbBgu9qgem52M|F42z
zhyq&54^)M|2*=-UfyUw3dN-0o{9)*;Ld4M2mjpzX08m7&B1xjhyGI~w+wpPOc8A2&
zkv#IBAYyYQ17|c{0=j@*#{%$)dcczZl%}pi{?+1ca@~V!z#)JaFv79wk$8nC523qi
z$%ZYQ_8kaENP}N?+Gxe&_JG&mfXSl$D)>7c=?7O)^jSz^cE`s(pR(8KcHZn~y33yn
zQqeW(Y^$~P<~N`CB<l=Nd&j_Wg?1RAqx^21)$G@u_LbX3$+&#{gKXMhna`7i7M0+j
zqqsf;n|t)c_kNXXuU2OUIApS*&o5{D=q-)BRDrs;GV$dG)f}ugE^DXXrf+{&dngLm
z5(Tgr7tIn4Pp58Ig5IUZiX=(CAKk*yC%&xz+x^9w5d6#inV$tG6d*nZOP-GU`XLY5
zsrc+DLOqgV6cbn$Qp8(wFlC!U$(i&q{xbW-1Y8XgU&5lbrjJwddKB-)Tr*8Kp^r3J
z0)0ymboj2(LVdr%6jRezf-}Z+KFVYR254LJJVBAuIo@Y%sn3qfp(CxKnWshuNVXEw
z)XtT!{~ywX0^+c-%r?mRP$S9k?~VcAnc(<j!VI4K?6dAwB!|&v31k?%0*?7G>2isa
z6c&uTZDuLD3gBqE2Tcx?4Z{DosNp$6V*_kn3~An-c-|3Km)Nbi<#z4jJ%uE@S8G$a
z(I?ninbJl+wd4O(D#VGR>+e;H5$Z{WQI>&HtJYUl)P7Hvil{sy-8I7mAUFZzHAYF$
ze6#9JtHhtU1pzkUdeZ)VH12I9WB0rjazU*-vXJ@0Tx_{NT(HGKljMob<`6L*k}vm7
zC$2<zoFmV2e(|w*AAbMS;nlJfOZ0lY@((-;2-E0j4tR)L^j!{69Fj(Zv-4^kP8(-6
z>~M7}eHOyop3)XrJ_YhIJZ)rldqsg`JAu^gXzE1Cb=Nez0w5bhso~&!O~S?OUVm>t
z;&Uo23;U4w73|UFbr!&+)}|oBw9g3^c$DUc5enJ}6j!%@psKd5V&m4a6+TCdR_V_C
z++J^_K`Cl?U7T-y;B~=zyb(M-#~1q1hgYW3JtbWl@Q@SJac~5EZ3(V^pLg9Hk^LIw
z(a4`d1CWo)??$Ym*%pkDq|e;4YN)}<#x3S)VY1t3>#%r!JZARfhk^b{V6y`!`@<o*
zO%XQh_Eor29A9}w#n!N#Yw^o*Stl)!y6<0w7^EbpZAoRL`7o!|rNnxr%xdXQ5EVD0
zH{+4zJ<wk5o!ATwhMvv8AMxk&gB0l_dIUCan?8iZmzRwf_cdYwzE#4ZFvS)5#fe_L
zkzP!N)Aglx>Lwrihng*Bn$3Ty-f-l|;s~7zrQp=krC5<AWoe60deAmC($$n(QO+4N
z4^omqj*Sg~Xeh`5mc8LF<s$X}_^XvKe&esd!W&@^QISkx2B+nL81o(Zq%)!Vb8@7}
zBS6Wr+0#C)dqr_pT6HpBH`qe2>$g{)QV)biwYHS<#fc3U=hGW;wGf`kkgshf{15t-
z;Qyvy@wtemz`~mxu0W%6hehX}`V1fBv}=xu-QCA9)%ocD>LZ2z>j{XFHoQeWid2AZ
z27b*YKPL*Yh6lr@dLZMF?xR&cTTma?x<p8=7nA#c@%Q(TU+BAMWQ9}y3rSu|8?PeD
z1sY*8@{hl4J^~E+m`@bfnZr<2Y5H}?R&2<7Pa74kUSdlpIgG~O%d*52K`#7%WEqrr
zM4SJEEMu!$MqR@UOt~)gAKKs5SE)k^|D2Qvf2KGNv9jRXUkQL~gaA(hP(mhR4mrdc
z#O+FQ2n785itv<RrVLwHotY@>iTJUM9s8VkdtjR{0g8i9@2X0TC+VhYFk5L?8Bmo~
zjUj4>Je`374a@dlEk@yTfshz?HXFW^?LYd0zJS0-!9^@U%tI#uq4HeF-(SMjl|#N&
z`Y&4FCr$~d6^6^50qz{&J5H49Avyc%N)+26_;UlF8@pQW$r<?#MINGf$n0nZ{YNvM
z1qR_@xoB{5ch9Z$f=)*ru#IMgO%=&sal?O=GDM@Hqjo^a8`KEP#>mm#G`0`2LUu8C
zfGCyx^sFsV{vX8;Tz)Z}xkij^vk08o$S@?gs%9V8@uG7D|5Yk+0fPH-sDeeU9e#Ch
z#7pZcL0Zn(kmY}+LpO3Pmg|AQ@s3b#LLjP5%QY|k^rV5U;Va8oo^p2<ly7nEKONBA
zw@WtLkLM6bQdUWNI_Cc<rcH74U-THVV3rFyu;`)E=APXMFCl*XAS@MqKp2{<y2g(p
zl8s3gH$1BRez`b3!$f&UA7d6k8xR-qjfZLne@SuQMd=pPK~^wyFvB>($CYfnxD*5F
zynpz8*X%tnN1|>%Vuzs;IrNS1Ko8psEsoF<&iJiAW$SGMQ)%^eiE219IQ<9PWAqR`
zl>W1peer;{lX?4WAXiFsgz-&J_}K4ko~S!e(O&~;f=ExdpvM4rjsuPHBV><C+7d@R
zrr8a?CSHgKmBZ5(wePuaBmTsHANa&Gm`5Mg(~-z$a@2X`G-U;8wD`Io^(`}ShF|r8
z>uijdtjB%39D)8f9A~rM28knj6w0n1?M2yt7C(>-bZ%)NTbAhpNX1`ib~_uk?J?a1
zcPVN&jW~8s1tD7SOMyh~ime_F3X=CVN>C)`8muTJ?;2He0fcYd<QwJi$#l&%3m-vJ
zZyykP3tqeZgihjrHqBL_@A-bzr?><kYJ7KJ!`v?TPdi($6&=O5f>sBG4jy<J=3sw(
zc0^t)@@|!H50$kREORV7`vTkIJ|z9=FxMHlNIbz|UkvDfXT`psDWKndKWN=9WN*;}
z1!My)vp{uwMPw@w+zw=594!ItK?tXb2C+b}@}Edit9nX-%ZVvTHtYeL=n={nIe-96
z*6H1MIC6YKCW`)q71u6`GgDsyed5KpAFI&7j)MYGy<fXw_vbzu6KKWE|3#cN>T`?y
zvgS6cOJEiWjO_Up1?dd#+b4OZ9nO5M)KwyqKQ8F`h#XbXhjuvDsVJ+$9Az0WI6hn1
z!QAE!&tk0DM(;|#c@Z_#Rbv7`(*L3ROsYxMS{}Kb<?2Da+Ui&GJ=3N7IFKue|FIW+
z6_w_F#~K22n|ZkbvOHc;?b9yqC^nj%c><Z>zd)LTL*<yBb9EVU7si{=KRb#2R80bC
zlXG-fhP;B;umQ60s&&YfReE~}ExR{AtZM&Au?_E5lC&7LaMtm_%({FS{M3ivh6htB
z^82vzCB~*^hU+cNCqMJ|le%_+cikzMCm{N_E4bQov_0q!r^wze`o3*z$c>nB-NzJ2
zygSbQHDUV3Ch@&g!Qzbp3m4<*-NkTO_c!E3b~r0fA4(+#=82#tOP&T=3obtk0)T<`
z&R*zbOY{)X(+T693ZIT_`GN$F5OER0-0QkeHK68l0`>n&wwPALK>BK+QK$dvfTUiF
zBm{P$eJahR+4`id5WD&n+Cyt1XX;xCk>!T@rxIUKg((5(Xg9Fre573V6-J}C97WxA
zr$?tn8}<=D0_T?wmcfbVI>WCRl^AO;GelkPt9_FrqmUzqC#j&HxEHvhKPsxc7;(e1
z`+QEX?zzv?F<ntHSA2Dn^;lt+9$c$cn8zNiBb|ZRI<S_)x7Pu??mG}<T#q<)Y=Eot
z@NBXGi2)mtFEwo`mp?{yqQQUTdRp@;u2RJAN`^Dct-fAA3ACWp|H2rxu_LZZl^v*u
z$o0zKf@Le_cXY8|8u=|C)_;7RA>pOb|7w>tTi(_-?E#*g-9Tw(C@cQSscVXqVomS`
zv?d@*Wy;y21o53-*sAOpqRs(r;g3l7<GU)+qA>hNq$VQ`0kL_s6P11p;5Vn1PeeBq
zl*N_SD$_h3qtj#PfWCf6Zpi`nMWVFy!cth>&U7$d1cYL~{+a0n<6zt7BLILp2h(1S
zyP*S((A#lgJJ7#d2%Z3ReHd6|da-g-+{)mU(QE{_d#vuD1?pYTID<1DRDVNWP%9?v
zBLZE)`2nl8=St>{0mGOh0zw=@Y~cZ5VfY<@_M))*FR|w=<ORHn|AHLK0I~rX&BNKS
z5soeBYy8!#V8;s3Wd@jyvNllLeX$sHCuv?XP7}?*O$sKQ_$ZwrG|xpCH`Vn982aE9
zH5WrjiUnYM7y7QuuME}aGkl!G_h$j@mXnYQ+1V5b@~6pV+ip4e;say7hq(J?(2Rgh
zE|pXnd6*~VgZ=$#)%j{obNRARC(B*g60rNZ7QbT5rpC{o_%Yze+=s-6XH%X&#D1Xm
z#*Z2CAjD_4<9IQnQyuSKCeFsFD%t=C`YNqoo$!FC+;7=B7g-34m%VwPy%$Lj?bsrj
z+y@Q$M76|&b%^G&0?M1mq9z^YtPHLh3dFUjck3Ug9E<1baEIR}P6GC^dVLFeA%Q<8
ztOeW-XqOWLXWmui4j8VdI>6)KuQufq=m9y(PayXTbdP<EJ|ZIonr+`2VMlv&)GNVZ
z(dl%1e1Sl~rSW6|JKn24CSiR8qS)Gzos@4CSM`0V(eK#YuL7?Q6WAI)A|Qh+?|eWb
zDIBOH!#9KgIw5^YbZBLw`rPMf1e-o(Fc6Wx?%gLx22lpcZCe0xTrxHg1Zys+>k+}5
z0Ylu|dVz3XiNp0KVTCuIkC(5^j{s>JS5E73{mF>$+po2y3x2>Zjj}bU8j7&EAiS4D
z_qoKCDeM4h7(Ao4EYvi+QQqqr+m1)3EDM|GBCoXjy9y-iS7#7Dd)a!_VDMaB8hAF2
zRR|f@C=RCyyPaHMG51o2*a~UB49D*nTt#XXU@mr&73EVsFT$|wNWGvjbdKL_(Xpu3
zxa6A=TsA{2P<LbIK5i!OPOp1xE1nT}#yF$4#SItpO?k`K9E9x3zn1A=>*e<Yp_3Iu
z;sX-UXS_SSV&#1aIje-UWT>BsgG5H;33Ae=r;O~}x#bznr!XyKR4HA}CTAH!0g39*
zaX~fJxmUu1<KqFn^ojSQ4f?kF=Ye|12Sw9y`#|orW``p@eAQq)mRu2`9ot1}MY5&M
zkd;3P6p}#fwbO0;*5ceuHQ0q<EZhOUD%45q;qHrc+;4w6By$Pf-8`_I*bP7TW$f)X
zv&DsaYc@<k4>6GM9)wR$$)DwTO&tB&Vib`~j)R8F+@E6ZP*Q5oOww(0Im1jYSHLQ3
zs>7$(gQywom<B&<U{f-F3GlY4mfC%HAk_&F5jMC*<Z634Dx<gXh5H2wL_4U}3;@6h
zd<&`smn>iSyMz8&njW(Te}^~AAiM1rn}jl!-#`!huFewa6oKj>ILSl4YggU(DO^yy
z{c?0*v5~H377oXytFj27B0qmh(3}5^z{_wlwG_fW1n@-@MC8i>P1J-n$5Ac6p@ls(
zQaE?+LGl@~WNG|L4zL>%d^`8-SVVB)`RzHwhcA|5yQsST?cx*RMhP$yXZL8Rr9Q)6
zh0Z-p2>di%Wl)$a0#lj%k@vP;VKYyev$D|A6;JGtBg}7({04=oIXQanx(znbhVto(
z?l-;Nd1hc{k!-BR-Cn0kkk;@Gb3+^k$Go-};qT%>a{W#uzW*WIGLxgK+!Yn?KeCN6
zsZZ0AO&lHR)b2gFW7k3lmu?XwUSlZWvG%wM#((1GYR|>c)dw=Z_JnD}r;GybBmgM{
z0s@d=`s2Hf&DN+6_ir<V&ER3PM(vYbfV5x(UTb0-uc-pQewXzCtT9G^oN*L1vrWCh
zJ%c7s3@zl#*21ToM?ZAbLWl0o4zIqYFMmh>LDYG^5d-H0_=e?b*-Qe)_bph+bfU;x
z)4!Qj;8->)?X|QQZ)-OS!Iw@lYCegW4IQM!mh|jIje9ptZ|IH*9|Ef^YM~mJ2Ah9R
z7dAe&vvYx3TCzUe&Wn5$oO&EsYOv5tP(^4N=6c!SsSH_#wg-j6Dmhehwxa$}-4>r`
z1V@9i|3!QtJ2V&QyxHC2pEYAWXnBzJBX;_k!|zw&iAB~(7(hh>X^LvG0}1T0yKs2D
z6Dj)5T8NuxksZ2*7{Y6MC`dt%a>z!=-GgOt$B(^4Jp_ywyLoHUkJlNPA_aG?W0BDl
z`ls){nr_;EbzxW|!_wZFs@({;b60yxs<8;&qM%0Gk(s*io^SL;>%pH~k=cuSIw&P5
z*S$|CJ|hdwe(P@NcqTg^6r!M;AB_tWTYk|=`m0i|_duR)@KK@@oG|u0+H1dySSqK7
z`E?(Z$kpHi`{JSo+k1R7x@GB5mbQX&wq%b4=O8yKJci{ypIbQL%UuY%QH$_1*pXyw
z$~8lXQ7YE`sf_=Wo?h?6|E3d!^VOy~!cc*f045FApKhMSv-Q(Zzv|C-(N*I(@weS{
zRHdqM6-aj=uQElAJmnN)c)R{S<&AxNIXn}o8Xv$BwGAoSesw|Lj#YLw##qDUe|pJ3
zOZ3#JDWUx0-n731pgUDh_<&-DU3Bc|RIq5<?-`b$J4fw!W9!lkdIKkhzoZN2?qoY@
zpcmQBB@{ae;0pl$>j%P^$!Gk38GDIl`t8W^As2bhAKad-)=CfFRNHQBv`}Ne@(6Y1
zH6Lch&wxBJBJ_*kyc<pOTT%i;%ykbZ)wbvX^(FVCMoWm~yMiS(dopUToBtD7{<?*2
zN3~vxk=~C*2wOH5@4!!W+gU+aK!(y2NwJ%<W-W>eZ%}t;G(|m~1~BrT@wUjjPM@yo
zGn{o7LelwDu2rjM6VMVxivey`2l{}YmXBU<@v!&ek{h~=R~W=}|JH#(WiKs6TB-TO
zU}m*J?_i1#J)j00dpV%<B?{TCU(SHS9DFxyTn{)W&zAS&{YR40Nu1#Unk!%L*3<y6
zNB}^Z^Ui|bLzBQgLJ0Xv&jZPZTb=xRSm+iXq?NN~TflNrq~29?OKeUp&;z$e$iZ%k
z?#&7rusn9H0e@t7DEphT<Bs8lD-^<JC@W}Er~La&MX`wqeby6tw6<?~IyDP~dlX)x
zO<yDJPEsq|BXA1P=C1&c7^N*BRF5{h-(m()zF(o<i6$S0=}29fCo&!r)3Fkae$u_>
zlXeeYNR?%=sTrOy%!zLU*E1p9hxpI@{ki3p-GYN713<D3Jzo9&X8W+^MTFc}J`4iw
zPZX7HFPCWK@)J_l=gCo}<R9gK$F09!+L1lQ?sZ)C9sSSxC*k;$N9~IgY<<>|9cO+8
zY}DV2gSOjUALn{li+1<b;=Aa-(u03Fcc_4Mf=*Qs&CS!&Ww~NUo>oWhs2N9H0$2|p
z!BBVg2#>Z|OIt%*!>dz;8Gs}f7&L5V;EFNVLt`z>(Ekn*P(mUV+bLJgWVWH<9^B2J
zSf9)5D+P1+Y+tm01V2-aA;j-_gZ24H;{c+sOK0m~TvXE?!+nf=BP2-1K#1gDG5DW|
z!xoE=GbiGSFwnm2pq&|VwmL<YSTz*;?`ZU&@BIJz;HQ8^>O+Yo|CI<`F@S)p;|t{B
za-#*pzo`T01LEc-&Wsh38{q<siJ;KwX2f(0^L643(zKE;-3C&%3?T>k4#A;{1TK@2
zGA#S+#m(MB>z!M>xpv{*_mEVBXxW<#voH~B3j%3X(RpnWn12tH!<=Jvk95E8uZk~X
zBv7Q%YI7Vtx8xn0pcr$&u3d1jsj(cl+riOta`THthe&}SsegE=YF!7a`;6)IA23Kb
zBR)m4W;&rfa9>PNJBC{YPBKKM_Riy}+)#4(MwDPp7`)atK2jJ(7K=Frl{^>8c|9#A
zC-x_5jk8FX;bn@ZG5=9B=Q{-x!{oS0LSVslww<!5^Km<PvrgL0hRnXYQx3Xp>Gbd@
z=aoN-3CDFmEVg=HfL|*L8u?;v0r&thL4L(G_aiNQ#Au6i`p42s=j8GX2a)ThX}qk|
z?Ss6$6l1$nu^hE^hnc(T6E`f&P71ZdVOJ-v(_E&3RWylyg{TR`p7){^oAg6!mT9+1
zrX6Dn_QFZ?&J4=z&SkFR^XV1>DKKn|r;_LOB%Q3z8KxUg%$cudtO=wvEHbH5rl-$)
zSO@jhHusz1gr0R=7dn&NlAS6SD_C7x>n>MkE{Qakl<iAcTix_CZus$mtv53m1zO2P
z--#)KnUVq_vOz6qUj)@|{T(K6rz+MJ1XVwP9%;_6n`hsmmu^wHWNV%{HE0aJ>V)=?
zZI_4N-MWW}agee>0?<qf_xBrLp4lmLD@O`-KOL+ko-d~Z80~{UZ6ga?K`7zc=&m!f
zgAEVA?u%T$*0=;?q%lT-A^w9W85Qk+9$gNFgWZ|{o*1mT@cv3ebaOMupnTuz6Wj_X
zf;v9o;ql(YNJC3YV`A~yY>g1=#Jds;_+0bBj!kC0de9c6?fzpo$mF4P5b90}<b9iU
z)J{tEb-UFgUMC*gn!epUX=iMr1YFn<$*h4v*1O|&R7OKbM}wBngPUd5LUv2OPP7NA
z196jTG`C`QawCj|&vWD8!C`fQH;s=C4*91?t(ow|D6BnMEaenJ=cVS~1qu)Is0RJ|
zyZS|_hSX$IgQxSn$xh%}#;I4-lo6?IJ-UJUM<nN;ZpC)NmE|}1EwX`n%o>40^4%HB
z!;6S66Ak>^VyrSOc{yU4ERdJFyO{{?hZ32w0g@ZluloDl(`9N+roAxCAk~_-TT4_R
zr0}g)N=^<?Qg3Zi?e7bZXj7pO&P_y_HP;B<@AF7V0aQ)ioqL6!)>|JYtzFc#*vY~f
z?+<O&ReRlCw!;pbm<q-l*CR;02oG5FXMU9|T6w5*6}_`!xoQ$HaXK|9Av|5XUD;{8
zz2ym(<nwCMq1pGEm_N@g#J@HrIg}(JvCKwe*gPaAr#9vbAktG}r75vF>sIMA?~ID=
zWh*#fQc0E%)-|ea*Ch&o$neXVS0n0|ythv>`<)~@MQFFWG?u_uzxxB|BJjAYUM9kn
zy`E$Xst6U!eZU(?p`SrS5D-YFF&LRObflO```Rr$v&zOBJt2y7&e4DdXY*n04M=fZ
zMMY=dv>4wD(d)%ajvPCS#%v&Cezq&UojPpI;ZuxY05$msrOyuD)B(A=vd%1JSa88$
z=dE5}3ZKy<Ey|^*o`g<yO_H_8B=o7a=JU`JT%(^iW7V%VH#<Cc>6dv<PGbT8al6KV
ziWs6;CegXKtZZHk&E_)Koi+0<H#^qO_!AesmwYTmc;7LFtm9@^T%Bj<&2$gfxq_6n
z%acs=$&|1DR~Nxj=~LcK(^>()u-?ogs0vov?G=94TV}nwcPAIuEL`q&H)X@N;9m?i
z%M(>eb{|gXn<K6iu+|~2)t}lGKK)`%CWhlwz2A{21dB7eL783Znp<*reSAN?KUwO}
zVrECws2IjQVfLSjA*D9x&eGR#mVs8nhI8ux0{CUaUCrxk$N8$p{B%03&UlX9{%9E1
zWM@!+z7_C7$#=0$C26-^m{GuFPG)2M>WXay2Mf*>K%}7ch?(ljiDQTI{vJ866{j^5
z?YiP&0?zc#cs1c7!M5e*;{yYj8FApP-1F?0qL4bBu>V7njdzf-Wc6$;M8WGF9bEdl
zmAuAA`?NRK^>IPt06k1HoBURK)8`XyMJg}e=8dx(R2?~o<UYt`VdrT7mEi*A*r`+>
zdQOta;Z~4@XWa|`Yr7dlRXE;Z9jGlebgVVU{T7*Y(2n0#M@>(E*p4`>-c=KiyQH6X
z(~4>W=6Kjv4IVe4Ws&JjNz<5>l>U9v^@%*6F<7)&E9}lNgP~h!R-J0Hb+pq7$5Zz=
z^nBT|?4yFDGSIGv;U1jN>%{H@)#$<PCT3i6a?-Oxb>Z54)K)!TK2i6i#On)J>jpV7
znGnrNdQx-ka7Whp2Jp;@N)k}0#qHeU=B3TGU`djNx7fHwW{mkFYZaRY6dR%h5&l)H
zm6_Z4ANO=1-{6q0E>4=u_L703Gwkml-2rClS+I9DQz8cv-D2Zw30%KVhSEgGl)UP1
z!8@OCdJLTPAfFb{RYdDuNJ&ms)@k*ev{%z!-z#Z+-kyRRI&=)=4RKhGBP$xt)YyKU
zv#{V784XvInw*7oG~m!O!6-+2bDydyyz1lKjR^#4lZJJ^?=PXI>$t6T9FbxQ`YL=i
zF&Hfjix~hrV2_pn;+R|&7wNR-IZR5T78ZT0JYcs;N8~&#N<oS!BF;+7;f;^siB3D@
zq7`{@A;zfvWSVvpifYJkzCmE0W-_UDQ#DVnfeScTi~{ba>n?ID)A<ZH7SbCh$~I&M
z22j23M%s+gcAd;I5^eFQ4&)?QKksC|^1i-J;$gE|bK8v7?$BAD^qCaD81Zr+z97_F
zTF2t!s@%XJ<l6pTO^YroYZO9(FF2xt7-S09@RF)W=6=0T)Y<&j_^>%zpS@+Yw8RLY
zASXp{nz#W^hWY&AzUaCLWA>}DngY%$>Mqys@-?AwUC0B0Oo*!0Ba_~`8YrcUhAClS
zI<GF%>bYz36zyH$1tAtZi*}IMm(BIro%x+g*@%-P6*`?7Aw{^K2;jSLdop<vOya(E
z`^$aNkSfJ7oyG}EIzRx>BiCooEBkOZf5GnB#$^f%6-7h}CF{C?+VrZ>n5Qi=9Z0-s
zf{9yJ<*8cf%px*WdRzNA@+==ZAXz9DV5Z7d3+@Y8AA0OOTaPc#N1=O60@vi*^*{{G
zw{A|W6{MkjOf%+9d#J$HDf)PzU0A&PNfZ<1r47GTN$ruz-WZ6@C4g&B3Kd0)*kjdU
z*_rkMS8m4k2L=;6^qy)lhYu4|namW$LYCAEm%fmNrVBQCT6>*K{aGW5S);S-c!*Qx
zyYb*t%&AR81_MuyO&-PXXh6w|*Hat}v<vgGSdxfV;@2#q9U?^XYO|-^UH=g6GD<dk
zf}l~Z>&s9VEesB(DBzBwnXdg}fyW;el#8pKx+fUTXVHOK0AICi*l~*&E4|qYF|gxE
z-#_d38Y_%jN}dh=Iv);4PrIG0vhcubDl6K^gmbAdh|@JJZ?CHXIu|yVB%0+WzrhQE
z=%^}RzTZdyzyE0CeU5?&K&&X))bSyQC!go8V#ED1GV%UZPEUJK=T6nET>wB??slho
zto0L(p0c7L2RTj&KF@ZsKFPBnNzsnDwYGipH}}iF2rwg>F_%^ngGW|@!qnev!J>}=
z|DxZ;K!ijTF-LJ(<p+)D)4nlIsK<j0l%)U5c{bc6LCNOB2HqHRaxfeW4UcM(QT*nJ
zcnN={o!UiPe(tK8KCLYweV{y!{X>xnT+{&SX=X@Rha{Hg#-ryMwwXBLD@%7~>&^Dc
zoLju<PXPA5XaDrrl8>DRQYb0Ixw)I93?ddhlx*44;{KQkmFxSgme3KiP!?z611v=I
z^_|km+@)&kTxsbXje>S!FFhoGFJGiH2~icRV5Pd6e0|(C7C9VS_7Eu&v@KTksGb^L
znUIq9LLgHZd?$aH4C(JtDwf(8^t73Hw#RbLP5JP$^m>OYHn$meCPLtv>oI6xmxp2r
z3i(IS1fP<mwe`{0w0mLzZ=8EEMFB)Co4HE~hQz|3u^;N`jX&@08+GF{=+ZAn^@k_w
zsRQ<|S><lMozBb6BkPIEXr*XOSAu1X>9t>CQ6~xE%+;c1keIR(GqJihtv~>X>mIIL
z;y&wY!6kMo6X9DAqpYt>*gXr}!lW8JlyxAH9-prxi~vcmRXLL*4AyC=!M66TWxae-
zqzvhe`?R4J@!6B?haEo+osR4J)@sY@TP)9a5Cxi7?PuNODx7J;v_^F=$@<T2iytzL
zfcR=|GPl_(>f)*_pp?G2e*D47mXosWiVdtq>+xz{<=^Lzu$3m<Nx{Jn%!Rp=vD)O%
z73zgMAio;o@J5$^i%WjcOcnL5EEh?~RBFQG69^Ra63M>CtIy_`yhja?_?_#cu*m#s
zh)N*Sl-UPvx|EnA6dMzC`-$MRP;ahe;BeaV++dg9_9}9*J%A|%Y^ixD>~1%W=|>w^
z#7#a7o?{>1#)=0IZ$W%g=5&9?8zW47(}%YZrmh-i8ht(2@~un%dp+ZMRwF5Zc%O@6
zXzE6}eigc^WB@yC3|g!50O)35t+X-ai)UVaGaX}}EAbdf8&0%ucVS|!@wXg6DA?gI
ztHcECfnrkTn!_w95WgVg=*@O)do<?3FCwoRgmKk|wB3L;4t+hkDvUmRcp*U($F!CF
zeo!_!GeN;)qr7QV+xemKcjf~C0Gs+$ibTcV=@*l02buR?ZLz7-2J6d3xj@-cBF+1d
zcS!~XD*KS4ONp3(V%A;t2cEY1)bsHbQ8>0AQT|0s>k^uu+B|Mm<-V_B+V#(FmxDCu
zPinUd8js9Dj`O6HQAXgttV+s7SZyH`1Wk)*T;#`_%#U_799Qm4Al*i|)=8j@Lr=LU
za6s#OCt=Yy2T0MofnT36mLsd$$=<(kxNVTJ9ru}_G;Vm;`%5Hqt{x744V;k)IU}^)
z%|2;2r9pfw&2$J79jG*EK1g>L4;vgNhw!e4@5$+*Jy>RvIz>=jc`adw7Jgse-~}HG
z<Ax>#rcE&t|16?(aUlB904tWGlgLoma1kBwG`tX+?9=_(>A0{;dxB>Y7w}0jZ8;;7
zWZ8PO64=`gUDR!1!*-cc$2U;zs!2b&8l|lKIUW+yMWcX;PZAy3v7e-kS08~fy@ttL
zC|AwoD;%T%JOt#cvQOc=P7{$6VX;zhSchmaQ)x#uBwUpG)TDFf{EuUy`RiDMLZCY(
z5zJl6x+7VnG6j5m^3Nr}#pgbZ+pIyMS<7_xzZy?u+P0Q@l-xdFx)DJbGT=uNC)8zk
zZ8u_z5f#{>rTJS;sVv!o`|9=-7HN>h{GmB1-g4;Ho;ypu*-$=2l4#9z(JyoCM+5=D
zy+mn;ox;hLD<>g8T4IpOw1lR?*MsQLw}<uU$&Y;nmmCW)5m~tye9T12GH*Hf)uSAk
zf*4DuC9)&uS|&?eoex|Ez$esA;5hlXk;muWFG9QB^)){Xt}s>fwa)s?1?lQr9w^<j
z?dAy#!8WN_VY2u}8FHhhD(&=@Wxq%+J772j!w~beFn2Dv1ivmO(w~(S9N!m`msvcS
z!>^~J2bjW{OX$O|jln@jWIk_i1t<ZcezW|1QgV?_>keC9u1<o&q9+A+;wWAQ{te9-
z>h6-5e<1EOYq}0L1bqOBoV-2{P3bzSYDI42?TamuoM<0gI07ov?rs{hQsvEK2Gfx5
zA8qu}mUTPCc|@jFYj<-F;~|=8jTfoY@N7<xu(DJ%W7QWvYZiEKNC4ieeJh7*Z!Zy?
zr4zNS`m92R+K0x1SwBUJbz=cVNJHSl{pS=csrsn5UY`Br!{{oRbm1{Z;ij`b_L3^C
zp?l8+-xnkpp?<xKQ8ZY|f~BC}npIWaRc?*syjx8B_NAX+?LKi1eSPo<{Y<>`P=7nx
zPWKfE>mQES0&yLZn7AL<U5ek`Ssu1_ml#C?<ftSM=<^GXz9ngtF4Rj`8rN;;Fbq~I
zBON=j-<KPoW|_4)WZ_IDPq!sLV2Cc-+(a2ig*8UN<%xBQ?HEt_`T7ljdb@UCaH~3J
zHA~W1faaj?rIAi2gToq~vf_HJlZXJ*n3~Iy!__XhS;u4Ft5s}@BV|HX?Fp@|F$~H!
zh67z8Jnnf0A1WRPv^^wt1X)C9a%sE_@_3cDIv#J{URIat_Z%i-Eb`-NVzM6ZuU?Mp
z9pk+|X)3Ikte9-6XpI6!D<(qO6}EUhw6|I=nuqv21c~0@ttvj88a;M`)I~=L8mE~@
zX|)gl&%FCuJ}P3u+<=t$fEP7CYr8Guf`Mls*~d56r&);bC6$I%lX&F!{*wYlfUUQS
z#)V0%CPMc||DOv?8HA1`yPaDWPG6U?hYz}=>z<@G;o+7ny8^jf5m8@tbrBJ+8H?E<
zd*_*p@P{%=Q^k39?U3_(tlL*wDfhcW0u{@;(SDEsA5PcJ@Ouv0-q4J!yX~VPpK0=q
zOF_joQaEp+UGv!r48m}WO`m#jK<>7VGRh;y+t~_1Xt?ETCMNgV+_=g@(4;H*ah^cX
z_yc3N>*r{{5ueqn^PfT~Xu}1$E?w~`&xgU9oCyJ$k7du+2-R-w`-;KXWqs}k+1f99
zEx!6KN~&EO6KhhraVPd;3sUjz!1Kdlv&U~s?IW{j+*qt%nc`HV=;<NgY{{tNJHAEB
zv6<VRAYxsV3PVa<fdpAh+QOIvUadQPg%OzXEscpdNS6xBlCyEy06$b6%5QOh2#EkP
zM57SS>?b=Vn_n9DhGHtyX`<EPrG;UYZbkcpiQ)?G$C^ho73;3|EXua%cJ*c>JW1Vg
ztguPK#ox*!I707I1<XQUmTt`(K>#=KsYO#uw1$Xt0Xcz6Yo0NW=a%DClUsRX<FV6i
zQ4d&R%GF%zNX`qZ71pdK@nV9+QEI)V>Qzak@(xkzM?+OSv<<r7SA#E&={KKZNhi}B
z;40N3h8gi+?j8)N&_sIMCQ-yMUT}=UE}Rq;T*X0U>-N(Rt2kX=?i{K;pB`smveiEJ
zohqdj=6wUTz0zjeH3Iiry0jvxzzXj!QS`U2XDxX5`UnZ$);X;?shSc|nLHkFxQZ~g
z7c8<<HaXpv6F(>IT4otflsB2E*+~Zsp^w?GFKsTx(;io=t0kdG+T0ht7l};GbObPY
z^2)#xbtq1?tv}RWDHPPR(U<e9eE8K~%j(XllyRssuYD`Zbx9}d=am~dG45z@BTgG_
zUUFiYIFRp8Rh7oEbk<NCCHbEq=k6@eQLP~`y7+ME{J>vYdy9;x`%s+XmJzr#Ca28F
zl-idVMWi?&zM&Uv)L-%unQ4Mrp8hrmtNXetVis&ci<?|RI?|aq8Pvpx2#1i6fXGA9
z`D6#gxn5KaHozMtg$6_k-AZ+6;KKeU1JPD<#cULcv3q8@p{8$t6w>FT!9iyLyjiX5
zLx!K%6v+5u@dAHlpN>74{ihLMht=KhYFOTh1D%%l)$UInOd?k{zfL_qObltB25?=R
zZ-%46AdmobL23QIby|rw8|hvvMk_8IvPfK<cB5;tm6xh=;glC0Y_A7kLD`o%4%+9B
zi-V}~@ZLz%kYRlNOIyopS|2lvReYGhQFnegoBHMQ*cy-IRu1G)q76l$wGq|g%E&#`
z1diqt%)3%?xH!)cZ@aNG!P7UJllm98<=j;kY0QQs!=PI)#-EcO^Y#cu`$h<^mUQ1t
z&0kL{-?P-*?)|aCSs;YCKF_yt+C!>z77urh8FH`}-|x|;4HpRLNQ67yl*Sz8ou-{a
z=CRgiszbOf?7qr{GTe&&<Boa8A#HX3l9}S_OT*tmOv#_xm^+>ggT|UahLA&}M9ppb
ztPe2;`RL5*%13&cfIT;KB<cJ0{RSiaaWW)`ncL<SNJjbs_KvI5On6K%UDy+wN-aKj
zXBTRQe`8rUw#_p}=FsodRH{&M*I;KRVug&&C_*xj@$myN`HB2xyR#PDA8I|Iyn*;|
zTuQnoU*X!-QvG8H&Q(UVDp(8}*Ma`{tb-1>>S#U2IP7~&988_~AKoJ8T0L2#?iS*O
znmHR(%~~s&5dhH>(*=VL#rQ(DI2q)41`;<`6`=l#gfoUfosLk2^(ECrBh77U5uOf5
zo0@I8ZY0xrZ3PD;eb&-?zpbWQr^Vl8s~|982#-vVtmsIZew=oo1wVG0Xaq#r6%LH^
zyqsMwvXVx$?N*ydfw@e3dhbs+`@GE|Y|y?ohQWN9Sx50of0hRA_`+U=`yrmg-VVf8
z%TrOTONHvi5Ei&imXpS7Tj4B_;^@FMo;kBR?L5<7?Hu<He{~e9t#Ktl`^rw|+#cAR
zZ>{0J4NbN-(Qw5T%a&umWk)O#b+BxMr88*^i0<6?kzaW9KutHw1Vf|e&NKL;pwjS%
zxJC;O@+X?ByY{Vz`z7kt#-6!J3yyr#c_x!JDcjUL(3ieh3q_Inan92`8D_6Y7&Q}2
zlNl?@yS;%8uR_Glrd1~FYu`A<!=UuQ@UNk2-p{l@EZ#Baz7hc2bS(qiBbDzKvJ#m3
z<+sbEUSaV+QJ|s{fu4(OLN<RZ$IbGC@`+}Eve^rHNEV1y!?{~H-uggqO{Lr=RMrwv
z>^ZqLO5jc<fx~;Btd|f(FTE)(DaKym;9+}zBA@_1$|fVB-d@5=%<POV4_V{KaHj5@
z7LHHLe4gq~wxdBV-0-cJA0b#*nV#UnihOr%;as$!LWdWKA|KchMRU3|!6fDUMs(_2
zt`GsgItAl;#7_ZyVK6@Xk>ukdsfRquD&w_RIs^z_o3E=X@yZe7YHCD_-$PSVZQVM~
z3lS_QvcY{pRRQ1XyZ21w&!pkJgLchlDhQ~`Kee*&TMN_Q%MTIWYUYn&8zwwk){IcK
z<^ZnGW&SY1xY9>Pk&QKTgbbHH@0YL*MoOo!%UR=N5+k*G(_SlH(tMK!hlg*pm*kBc
zcc*I8FMkW4?YQDhoswH?!XJmzZxx^MFNY24UN9iOH_ET88I3g{etsflnJh}$0l=b@
zw}_vz0K=j80}QKA%H`GPQhOW?``?i|cBld&I{Y{g>RNGsE@1PNI(MwgKe9r3>46^f
zWk?$~6|D!v4SST2j|I~}I^5_-n%#7E;GAawXejn*<&#l9*PaYzw6*`3PvT$maj2S=
z?!&;(b}|UBRl)A$6<w+q=`14k7$=Cp;$f3lPcH`c^_gaD3%FcKsMgZs7`GqO3k`$H
zDbWMWxRQ55Ldw7<`W2N*ZM=y5=wRwPPV#AVe*_BYvI`K=<QbK}S`|r8r-U|{t%mt*
zym&wumJ+LdYwP4+uD{&op2U6d)C8s6Xw63^+Rb~1G~Z~@__7p{*9)<Js<J)7ua`iU
zjrdzBar$N;zu6psgDpx8D4rC-0Bk&HW0nKJSzA4DWRq!NY-~evXMHNummOGywvXXE
zFK-P8HoM?zi_FG#M;lejKo-G$CQ+mW$tkXaxRur7xUa!{dRCT}{C=Q<A4S|qL1ukL
z*C|FuIkYY*;<+h8qa9h!N0p_`tC^d2xfK>B6Kl}Qmf{+E>8q{0x_|)GR&%JwQ<fU3
zGH;DLP8_m1zd!&-!B^}_u5@P_>179H9b_4eYSG4VUMM@Jz`=ViN1*V1`JjRDv3BUD
zrrqiX{6;SK#m4(7dnTT3c^dv|6KQ5#%u+sk48wq8BopjUP$UW?3t=K;@YSWBxKI`Y
zaFy37%@+k@ed#_rG~}d#GSN)>1jGX8T^_E;Ck=0tt%I|Bk|eAVHBiE-OC`LW<6YNK
zcuezEVx0rttl9kr@{NsLKVs#&H@T_kE-yj(^L3%k0u3xmB9Cf5HHMO7y91wb#9t?v
z#*}%zk{7n~s*@WDw;b)33Rgw4UR60MYv=H>rz`07(z~7?2r%lY)I9Ef8Ydj?y3jZA
z@)O@y@uqM??#0fnXtVhNcWi9j#q$5*>z%_R>zek_jx))0jEQYcl8!U6ZQHgru`#i2
z+xARs+vddj<$2!s`<?6h&biKC-Mzbe@3nW;s#UA*yQ)YDx1td}CnCyzZoj@=n$|81
z6$^G}-JOw(8bmk`3l8cO5um5fTRZL__dmrJf_b6?gdhQQ#qm=7R}d#B4Ka|5s^DAQ
z-T5}Q?MtefQ|KiQ=pUBuPdY_L^_87thKFKba1vi7HdUB7>y2Jw*jwO!6A@lauH7l|
z19EQaSjM`#Gc^WL_W!g1a`L(`V2LrlM1^y?Z)($ll;s-f%c>`I(i@?G<R(|oZ3xU_
zlMRGTK!ORDj%yOeah)-iwDTXL%da-K!C*FrHl1H>$P7J)4tbLe2F5>A9^a$y_R=RK
zdWOi#M;c~z`rnPq%fJ7vD;+mAG+PQi?%ZB$FTDEg5MFP$k13gc-JR{C%;>#KeZL|S
zcqayDl{<$!Pl8fHSE|VJ&#F;`m6N+m@bRPAZjoZ~FQ{LUPR&yWiy&wwGN95n%6_`O
z%9N#|@GWa_WswYMTf(XEI}RUH-jQUrIm+`F>lhUXwg%H5Y;A(3Tn~#6LZgeu;zBaO
z?-}<yfSN(A*BuED6!6;y-(PRPq5%%f&|GX36ZjT9Erykt9@7bvJbxv~OLfY#16z1)
zZ;jW50Jw(#TXT5-nv8h{bxd=2GB0Cxt33%ggTnPAW$FmPOGvDZlX!d}o6yqfdN`6D
z)W;(W!Wajrfvvg%a+wS86)EZTgND}?El<dzJXb(ZoY;hGZ{~PnB*sdYQ%MEE7z5aI
zbU?rPR*U%s!rf?SvF-1zCFN;n%e-Q9Cx_1~FpT4PS|XUQ>fYayYJbdU;#e$J^WG>X
zYmbBJT&Y@9(cT_By|hQdcbIwaH*czd-d?jxpGh^<X?I0OC~bc?gYg;Kj2B^lO~JvP
z$IUM6MXiv-c0sRo$^Kzj5Lq@P=z{n9uC53<I;aX2)KskT-&q5CWozGwaroNClqY)o
zP#;j8L2u~!6#Ur*7)J?aZ|{+W;2SaWx)C2;^`VAREuE~fw$t=<HqM3>AS3(3@$&AY
zmaE|rJ%*-8ot9>T10r<Ir(tH=QIhW%>**|gn(;o(RJVGu^Xo}&MTb_;vAgt$b?L|=
z+qtLrVeMcW!kfoJeL8L!-2xDC{)&msU-id}GfNDPgOj7ZJ7+mK7IW1;5-OSCWFFJ5
z=53=V&E_~Y|MSq*npKzU<#cv`Qx#t#^f={<3RQl?N9$iPsH1!d5z{0mdFHD!Xvk<D
zjo~&hJY^&RCHLjek*rGV4ZT_>6$Pk|YXu=+)1Cc!PmVmZmMdru#PV1b*l*YP-WC7D
z1)vfhDY3f-hSSTX=Z=rC=E~@(9OxIW$ZH_22Fo5|XT8LxnAjd*OaD;17Q|8C7Ex)5
z#akK7ypYn}m!xm4@j9Ixtv_KuS>V09x=il8`+K=L-1V#}{V{sc$qu@_dr8`B44pvZ
zz3vFRCg<>RW6voXPyHz#)_FB~se<PM&hqoe-B{AoWJmK^z@BOn9$e;C48<Yj9<9fj
zDPFcbQjBKvcB3r9WT($@-9y&n1H%h;zKFKZhju3(jqRsxI7AWxSvEc=9r!kIU8b%5
z0IXkj9)-nV;=dUrsKNV~e>~r(UL60l=2H9P-xkw;6zu+%0DS0bXm$2+n6F=`UzxF+
zua|qlo|)>8o$}u`zj2F}Lt&N)kKPH2nD4iKxOpm`2~?To)#;C@Ps0=~{D#e&QBM9y
zHk(j7r!|_EET8$h1-Idy1-i#LTOCn{J!g%OXr%RYy<Pd`T^W~Ug3Z1PDosyokKm#M
z&FK=fB4oXBNVe!;yD}_y$JWEnc%u|TS$K@zST6+?_11P!X3j7AL&mn4L&B9)+NOix
z)#wWLM)!gnadQJrC{vHOG=9Jf!t(wtO?%CmyTx}LFll@QWZ)LT3b?+snC7_9m1h$d
zZqTQ{Z{5j2B9P(LPtX3TPp*4RFAR%`?*Mib!41HD==p3(sua6PI?isQ`HU)D=5+SS
z-Ex%kR!vToDj1O>Q4N0dM8AnO5#afhYyIlY<R{&yrB<#RljbC)TJTRXp)(JylvyjQ
z<PS>T%XzWmIA?0CL2`g(G^WOCkA9br|3RTm#P&Mq{w<a%;YWLn^^b*>J9mlUe4@^y
zZHE5MH`5RF{LwCTV+I>Oz6P?goV{aNY+PS&(dh_F;;h!vOH9VWP1BneeSJ(I<Y(1;
zGY)dI=Wp@iOh7m&r4Mt*zEPZv)1>(%N?(?(tPfJs^GeA{Rka-B0S<Z7hn>|d`jzE|
z_`It7#zkw#3)!bV;aku0jNbhG%Pf)GPjn{+4nU}%%g~LpzoyXqP!mo#TB9z1_;-&h
zi)zJY_Mln+VSBg>@#pCb5AR^2S6f-`#w6ztEcTm1$n6$vBuCOD5$`ukhPestl&j^J
zq6d}o&dHb`Y)jXhLFgf9fRas>8)xyQ!jFsFzPvbI#GBAu<mT7)6RqqQN53M(o0CrG
zQ_VMCYI&$%&7Cfyv$@}iy0LfR%ojqx!j$<;#Js%ldUje-zyHuQ_9<dk&|r!1BnP>B
z9X)m}fEfxN$~+*}Ep~b+PhbXZgy_+!hq09C<Gd$pZ-?BB`~c%W#C;-6$UA$lH~HDg
z_Kg1UZy=`gN)E{22opr3zTrgm6uQ4x$Iv9UD9yZ%S79?EI6%l*%K-ONuIc1aA(lDY
zyDfSHH2l|$pouX+l|v86Z^!Xsfv(yHscdjtrRS+~!(1%(r@JNt#oK*~E402Kf^FRD
zvYPvy`#6$Ie1dhNU+j#1UFi!A-1v#*rYY?;H0M3hQ;&ttVrUQ1g?PRTYW?J|wiq&Z
zUi|j<<yDJ;7}CjK{ucV@{OvL1q_WbRGiA>w8jb4Z>PY8VB6CuAkC%tx)XIxjTJQ#|
zSNmH1j=U(dXX9G^FJ*Rr;y%vRr(A#6duICH_Hf;jr|G!AZKr3akuP5A-mgKiao61(
znFxKv#&~xbDU5#5>;9eI-|EiBbXjnn|17tolfokGy+7EFukO`~rR>@D)8JnELnHt4
zsLD)B=WW<}_b{pJrWz;P>wy|>4qxkSqY`uNb^^@1eKH7S+3=iXvO4j=JHh=Be8h73
z_UmwNmARz8<yRK(&)&jXm7H3)#n0S+_p58fhXxM){W8-^)5gN>IFs0WmV(?6l4N{M
z)gBVX0)AC61f9&ni^rI>WXB4&;IRbJhWDRUbzVfxjyk%LNBA=}IAFf>H{s4FRhM&d
zN$svDNnDFetsfwBzMsDN^n&YkN_3^XoK)ja&9gj`Cyv2$wuAr>t^w4lGhU(jQbC16
z0so<-_W_uUPOZrL<I}Y4ere$v$FKV=St>yAGj7s*m&R0+lfLjt)8wBTNApeiUQ74)
z-UBn@3w6OH;ge@k_ZSX^8>CWOYyjnc#}(ggujA%j#X;%m#?aJ9yvGCtV57&9S>4$i
zCa`Jfd?b5vdd{)n5et+G4tK&d&piVMVtX-9O3M_5A+38m$IC5K?>~W7y!BC8n@9t1
zeu>3DRD_#5S77tWJK=sL`NzK0f(BHIr^`zDqvOa%bRy<<rOXL?%G}@mSe?;nRGMkY
zNG9^V)6Sk!R4^B+h84Z8spneHvi`z1k*&EqF99D!M||@;^v6Ao$8Cobhh(cK_Ylc8
zc^EF<;pGywU32guIL(Z@iLPxsUH0bX2Mi;Kdn`X#zgxP~@wuxbr!rF9zf!_o)s3aO
zUQ&BKjRup5Ce~wKW=_TtynDVfV<OFgUYjUi{8UfVnm80j93l!^Z+96G$N)4l)#_e{
zxx%`uICod&oIl%0cFQUT+N(l4Jei>MXw22>`xfdDRX|nHpig)hg8S!j7rgYJk2boK
z4dyVq=7aI>!>*PtcS)$~N^hr&uJB=0`fjfM4@$YkmgD-4ZeHcIO|bc-P~A#<VUT5y
z&d1v8+r;oL!?R~I$2-7HTYdL_{+?P{bW#Z0+4aFRq^@86ZWII0?c*&xGm+wGgeey~
zs3zrQ7@YLXPguXQf45Kk*!IA#`Y+AdGEKx?pI~FhSmu%Pkk2ZK_UfhCm&T_b#R|lk
zyz*^&pbT`cbA?09pAOoonb&w9&OAT)cubixeZVMl=5EH&#{$ZiWu?m+<leZ-vxx7q
zWNvs4!Wn3=eyGo&TllCfl+E~>H(Un!W~wTKz3V-H{RC#r7O6E8600TNCiB-P^3nM6
zJ!kZwXg#w*k5*LnopFmz{x?O~wZ=7NV%R^U6JUFWBtPVsy7cFx={3{wG9jhoQQn^X
z2x5FfRCNnaR*XBR{6CQww#BQVPvpgudGSA4F%-D(PFIcxSgH!~T(O+@*#{iezhf~3
zy(q98e!AZq%;sEl;SD&9Gnl)VqbiIC_xwZS-%<i23WFbW#7_n<m<>G+rIB{rNZ1AE
z0xJdar#&`3t-%z^oqoZtEnhG>c)yt&JV;$ssIM)Wx;s%5g#4uEx{JO4(o&*cLnt;7
z6LZ}@ltr0=1q(|dBuigPx=e}3Q8=y``72q3OpXve1g>Ms25ImQ&03p%uRl!)yaGVP
z|BmN5ajYaXh1TjxSzWzHP2@w>@bYb@MTD;W5;CD)z<CzNsE=i)MYHDKxv{LbMq5@7
zi!$mB=8i^gk=EK2BHC{P!4PWL*RKizRor`EZg%k8X5W@$!HUJGpdCE2pz}bomkIm6
z{(O=qNI6)HlhJ@7-VhA%FV_|O=AQ@WN1xFx{>oD1_l54`$68}*5XV<}Q!y&A&orc~
z9fE|&Y_4%Gid9ZymPFBPN$`sADt6q=fbOihxcn+l!OHJCa?a8~obP%$<({oSU9q<e
zTuVr@l^3y?nEo#p*=|IsnyIB$d@W)p8>N$t0P8>U`hU`y{>u?={v`7TqkVp`b0B;Q
z$V%zV5~*PR=PV@Q*x#qf_yWY$Yz<hoW<ul77412RUL9t!Os^^*sG(Sj|F)2(Aav@=
z*wq0isS9=1I1ku1oEDUq9$J{|Ya+yE0Du&+J}oL|S|BW-{(8kK>7D<uC3B+ZIQU3&
z%+RC$Uk+{;-qEAlqP%>AWzVnR+<cjM#ZTUsq=S^B{m29N&KNyY#jem&;w7~R1T-fT
zajVU_K`Q+-=WL0M)p;jRbq=RDB#$4c9f!i(G~T9a>o@7P7S%}6#dBhL<^(z|sX68L
z%Us<G>S*=L?hGsnIv5-Z{#V<-(zH3np`@KmGZR+MJbX)9?gL5+?fmPR<H%zEhPhdN
zhk^S_?$5mD$Hc=$UsVsHYnb=v>dlO3Ljx8MuGTISA(lOOQT6dG(_DZ=tW7R{3JW=|
zTGnMCtvQ-BSpvDyFKt%m|GBFON&#9R$xzlaC#SbVcz|hlIoj`<uL;o6#{zIX;yOi}
zRbI-B*w~<{Tx9VnkC{9()w-yOZ+^0b;}=8Xo67~OH0<_@W>TE1>tBkg75vd~BEuQn
zNO*H!J-%0^mD{|3i-qHon^Pt|);2opP+7eG9vcYq=XU;Fyer|?WJSc!5^qZE3y31l
z-y+K2Nxdk;BFJFsS|^4L$x*<2vWxx-se72_EcblrrNS4Mr8ED=c<<D-q)1o%U8gn?
z;tKK1f`*-9a5PfPY%Wi`Yy`b23uJjI(KL-kaz!Ooe`$3C;uJ>bPEuo^{Jr-&N06Lr
zkf@<AHpAyR3Zp_ZhkJ2^vN)O^BGx|~+qOT^-L*AN(E5rIcr@-un&EN^HY~Hio-!m=
zaPakDtC({fT1H8Pw=lni2nbOe9^IxQ!>ISz<yWP(AFc_sWV2fl(&LyTP;ScqcpxAK
za_feR1MIJE?kt{FD_WKRr8o_N1O6cb+PuHqG~-$}5#Mm$w)mV?za&ZwPgh9^?x(WF
zuRm}hCP1KsrAov@&(^pZ00CevQJ0>}trX42vf|mRdpezAQeeR=>nB--7V_?+9=%`P
zf2WeNr-=cYuj@W9##T|(yRMEYjxF)%Q`m6cNq4X@;|p)*B};5Scdo*m)DTIt*US+K
z8E;cxXwz?Q2Mb`AP`iK`$?|R+a(=2<Q19A0zR6)EWsgoF<=a-)T)L2*4<~u4gY_T&
z6EKmBjO-hws)E#zsoJ)OslkcjSa4S%*?y9zLeT{D0|`A_>tcIt#!p0gdCP2Ry!hKo
zL+qJ1E3Ot#Bz8AfET{hV{h8{)TGq{5wcuW_pAZ*VU#d0f@-|h6HZu@+(TLQ|4?^?$
zh_SE+;H|_2Kh+wfKg>f&y%P>+zuEUqZ=sKSkRG$iVcYRUNt2^(vFgP4*YPMtl%;iY
zS=DjtVFP16c~+C<Y~?sfk6zOfBnM{hY_CT(6yrX*zJ29Qb?cI=+%(~00*L5?oDBI#
zR3%UXD3{DYL}gW;3Kg!;QmEnPCthdP9AR`jVzfZ}BGecEqKb}yU~PA++N$$#k?CAE
zvFks9obH3<Dg=V49w>)C&cm7(@{I@)^KyBXqtkV2w_>wnr>kXtwLn+uL6^&tnK3Gj
zRBi66!@3*#@Mlsk&)opd6LCau-L*1zwm_A^qk7*WWMSdP@D^57Q(%mx03J5lAWi0c
zqoo@3pIzI$gSV3v)p_j0Fu7P&cikM_+QD#=xE5uzbJ9=*Pbrzt*2NknDy#tCO*8kK
zO|vJ@iKtWO1Y7WEkhP#yJm+B?fHLneeMm}Rn`>l28XI&P7LRYDmJ8iEp4(MgJup)f
zWI0V69S?qqu~LAK7v@;Py=`Ou4?~Cqpe8zkT2<@-w)#M38cS-N$DJFpvQ~D}C!3Il
zH1ncC1yWtVXSU^ZUP^%gM3Le4+mAUf7kw8%v#Do^PjtvaGc<KCSGR^zRWd*j-j5}t
zLRVf@J0QQX<BKj>HxbXj=*gA^4O4x9foRh(y{c8_dea0vrD7@W<y5<J7TDLOvJ)r=
zgK}<gHkLkvNZfo`Zd{ER_1==o=>*aoqS(%e>bETlHj7)BfT#j<#F1LClC^@1@sNOi
z?65Wq?cMM!=b8$(M6E9iL^E60=je?P=0d~_ukw{8L1ba~-x#9cw`njKxgh>G17u~+
zi`a+7nRHL=wc>YGTi$$_wID4p)@L;lT2#BVYab`~9%`2pvCe@a3QL^!=M6M80F*Wq
zl=}{2a(mNJO%NvS-xjaD{6h;6jx8uxih*%8#Dc3j6G)0?>fY&#N|*T*i01an^lY=A
zteUz5HJ%pN@HL)dO-MRq*{?c9TX^d`l`$a@XqJVjDLS%yFgs*@azW4<fNBZ)Qe!{=
zaM#3s5PIH9Wjk+W%t7`G#jKjSuolc~(6S=TJ1Ug)UXH)wmOeZyP2);S)W96pup*ej
z?9T|!Q4I|uor<0+X{ZQUe3@=S04wJaI2Ebp`rVf{ZCYUZaB}xBnsmhc&hNr~Gxdr(
z)#WRZTZy#RWRMZ3erm-+E<-(hPO4%chZ1)cTip$L_%l71r;W45T|spY)|Vjk{7b^<
zJnVm!*aSFfDL@CbP>b$5(P+qG%7Px@)5S*3T|mn`%gD<wd-yK-Uk&a^I`@zSc8g-W
zBY)hI6a~)as>*dKFW1U1;s_#(rftwQh-W&A%b|GZa(kdqJx{e-$Fq*7+0Ue_QD|&j
z(}z5lbfHKJ#+yX3Q(f8QN?V+WF^7!M%AfFNRB8^lhW%~(l{Pv*KUs<n1pLajO>=OU
zq!IPTC~uw-qVT72pLSVz&f*e9CPd}^=^LLLlP<8xuIfEGKFtTTHM?__AYXkWvpn?Y
z9+LD?l>{L9*5^^r{-rUuI%PLLbRV6o69HK8SDD{<nfJ&w`Q+miyZH|z!5?}uY5XuC
z?xZjFnYUVJmTnfT?|-^cZ=T_S`134{{p$Z~>B+$gFzNm$HH*r_bb6v?#}uo~g%R++
z9XBd-&i#Pd_{o2;_++q}B%tB-InaQ?A2Wx{pxjj-&Rf6$_VAdbGpl2CrSU%LrMxsv
z<yEH625;d{=%=by@z|16oDG*2S~#PVB2v^*UyY=*@!_TN-?!A$Ta(i-N_lG)K=}7p
zJ8URYaSBr{;q#omb!xzZl31aUn|o{ymEI=0ouXX{b(MZ426GI_86gjCDLQ4Vab~*0
zvQPR%V_C^F(iiSq)H_lyz(k_;QT^eYE*r1rz9~MlfQ5<fEIAZDb+q$_(6pjDeAe-&
z{nS@N{?~rG85i|eamNR{>>bXps`cs*j298TsJ%;Ud{@KH6sTZ239Z6CaS$P`!KI5Z
zp6_tug5eW54lRc*)l1(nSFic*&Y#$ovBOjkKg8lrMl+dTQe9tfs&XiOaZjE4<y-<+
z*t?CB@CwSiF?@7Is=n&Bf*j3KE_>fhWf5G7PE``MltYw`_7u{6^Olw>slG*-CY-Z=
zK5BDH{BX1%fwItW@3V~0qxkJ8X*I3NY&(=op(DLHxwz`@ei5Qe>%$4UXE@t&i`h{%
zin+XDjycu4L^<rZ6ccgP46DudLDtezl1eekWUA25d|PL&sDkO-k`F)SMk~<<Yx&WG
zQR&JZZBGd(S6@g-ez-(~K7H~0ci!>^HUAM-NApE4BeA)!r5{GvDByt4QYg)jjUUa<
zICFLI`=PNyE5Gl81(?NgMeO*fDs675$?3tHbpItx0Mv-ew?XXaPN<+FQ<eWREKqDX
ztZlVACr{vASdMY?k-kAH`HM`263%_t|D9iBtj^*-R2_?5pkeUScIGcfJxOjGwAFm`
zXjIurx{tw1&Oehax-b4yT3|<V$Rz$vS}q3z%@a?#({tPOL|pI-9GfFL9~qYx@g1HR
zg!DKLSErlp9~$PCQz~Co1e#x@|APN-c`9vgqT202s}xh)@O!^>)h@_Y4iCz$42a%y
z$B7T&npJ)6J1gl8qucK@dSipP<Z?tpq}%T0>?>}W!d<}WTKZ!zz4#SX@FfF0Vlf*E
zb17~dOTG$00}dc5Ll-&bBuCBjI#wGUI(R3&#HmU@d%tf?a|FFaQ`_Fi!<ZbR9t3pF
z<}Aw3?V6EaLAjnkEv<}YwoRm`O{pgBf=|4iw1v!}mXg@s_`nQsZswSz)-lh69^p8k
zxi8TR)gBI=I(NkMR6Py?FlKI96{WZ*JvLe&S`f3^=5ktA{&o&}Bnh(YpXo;xFk3cA
zI>M-=+l<3H2?;FQzySS)dR{}n)Fd|7AyV+poS=<_Dl>8I<;bC|#r!s2Lzd1b!2*gJ
zvZ^}4vKd8lyI_=l7N%YA!$E^Yh=-O%5@NEcC!+qw<d;|7mWX1e1xww%TdArU#v2PZ
zDm6QnYVH1Ip({QiMW3-(J+D{$W%tBWg<?(wkb?q1qKO65G=7=$?5|EC0jhsFFFRHL
z%%C2S_R&0DEH6Z1Yy3IZ65UzR;x{Bsnk2oJDilvFf1SH1S^_ZH{cMc!O<?<vOV(6u
z0;ih1xT4dpv8UT+7>HV{^4`H*-0dMG83a!%{u=hB2DAOI$p0q=;n+u!2=UisTWwHz
zc)n@MT|-+Whs_FeJ(w@)ah<qdNVs99s(eGd89%RR*DaK^x;rg!M_6YnA=opvd)J{P
zISGQ$tc;ry-8h@_<%WyB-qlOynoJr0kfgfq_RkIfruoz<<%vBA_0fOzeyxf1cB#EH
z{3{-IH75oI*`+7JsTWibrmYceqC$`=MyvkQh8<~{(cdu`s<0F2Imf|igkEr9c-eTo
zQEl2rC6#H6CFx|nNXWmk1CivO9m1%<BnGUuqJ9_MIzs<J?oe>|I~@7&yo2M=xnm*t
zmr)#dWP;a01;=IrC~_{OuZdtK9v4;oo3NeQ`rplibk8zlPB;Hkwsof3XTN#DkLi{z
z#yPmG#0?YMZ_WR~mp51L9~vtsL|b+izZ8QjlE#J|1?v1G!zOc=qlK4ua-c@u)P=EA
z+vA;BoJWa+v8wju$-wjcU^U`a<-IknDMU;*;b3rmn|NGf?D@(DvM#aZRv}sFk+dLf
z#oBs*GX}~g%=g*Y$u!Lm&ML%Z-7|D+Y}cP|g7tE7YrV>R2!2~ke}=qIq7Ub_dr9xV
zmR{nTYf-B|q$reKdZ@De3xOJCthP$q=g%`=+FT|E*rcO*l&~+jqYKMQ)7e!~`=*M`
zMGzAH3Xb?ja}QM{sFEe#A7Zayx~J;CjBT>H*~_6c>j24_cRh0jAKE6ke6O0`xQp=T
z3@=MjOjK_EFX?fM*Pgb^{R)h>TWS%S(C$gZ*YlOc3CffFjGYn8wWh;`#?*G_%=Xw`
zWjc?zlQu<;%l1fTyx39h2`7*Wwmp?{y_&Tw=aEL~nQ^1eLn&+2(fLUGU}9v}Q%<I}
z#z34+91QLER2?UibIaXIVjx_Zv^U1859C5AzpP`4+C&=0sq%tZvPt!B!EbUX&KV*a
z4h4~YlPW+*Mxu)N`tZyz-T4s_z!i>2OhXfz&Du183YQ$N&>4AKNEi!cNb;S$$sVzJ
z_=<<Q;FDtJswVom%s)K$RX7tyCCGOQJ|I&o-u7n4HM!E%eWGqucSn*Ly7d;S%#5n9
ztXKY>p%)ByCxc9N+LZHyEp1s)bDV$yUf3ybb1WJ|GG&FBYlVTEB1OlG+tXN5mJ*Z|
z<>DqzMF#V|#?Od~&8sh-G=#t#(~s9@z=mb_38D&{{0WC*U2(2`riR8M<E0>+&!IO%
zZh%SL{AO!2P1Mj-3E$j%!5OCmS$t~I25nFw@~p+h_~6|?O2J>R7FUs>%0lP^0;*Ll
zz-?03VEY_V6y~jf-l(w&LT28cAIo+^SRE!ce%#trTPYmn?x-Cqqy12B)MMB>5+v@I
zw_lo7&>;k3GOC=xYc*G_?JxdE7u+^J&=B)WK0UATxo);e@AXzkRW2$WJq~(j(s=wu
z38E;gQ3|>TMpuwBUb>>&r(%!-yL+NXMK_F1ZM~<I$@0m7*DW3;7K>F*BJ$Y>3A^6C
z>l%g9)(0lqhb~5T=oH?%i;cS0SvT(8>uQJI^taz<)x|f{3$G-c$8jv)2;E1VXF^M@
z?ienti(IfewcVSSs+=ZZ5I?b8swme{?+d0{(+p3?JBumj#!|_ED&iV?phvu*_Ne--
zLFWi|mDxSLOn5m%@;~~KicxYb4bT1mM(cj8tn}%KBeWqV&(bTx!xM=jDHg@m!e?Bc
z;L4CA8#gMLhqR^6k0lBysZ<@(aKQ0)L_K7YM|D8MxY$z!G;Z1_U5JKkQezs~nIegE
zL`WpkDn1yyDS$`83(v<4<GtG7oE6f(o0#wHlG;L4mx9;!@um<w#?4c$yy8DAN&Cp1
ze1_u<>NUIoG6;&0x$TK#e@!TyII5ye!6>0BFcfCc9r|@MLXfEhm+LjlPaJN%vug)%
zj+R39Aj;jfNx(xIG(dCx)uwT1f>x@T%O?WG60xy-1!x}-T+d<bwLW)Or|@o--YNt4
z#*%^*5@1`NK9245*Rq9QDg~&kw+Gd=_G>Ctn1a)x$5^G02X9;*Ln617uv=8sZ#zXa
z?oK7&dYIX2>PV;pYdW;3^0<IaHFeNY_QI8Y?Yw|V^Mzjpndfhb!`T#>_7s1Xhupt~
z;Vqg>^PUOJZmH=cOq^Kq`-`oCz=M<%c8&UQJTX=amIMcDC(<cB$}DpK7rg2G67)+9
zyUL(q3A4e-+2L&D<@cpFS|Kv1lmQS2N-etN^k~e*AGI$e>7G`wV8UHxKNdtylN3<8
zG;xmFP}ncem_b%z5hr<KYSpI`rOd?=wIoHnjdfjK)+BJ+H`bUziYX5%yFZuEMZ1F%
z>dF~*(3&^daBI#o)gBhtU35NIO)s|Cz#QhhbWEj4jV9dTZgr)d^iZH{hDe{sGj|%$
zY8^&6?CRf8uUKLoa4EFqf%R3bUuU44d2=|yt2-Aj<l77x(;5=@#yF)0_pIWlyS(q}
zI(e*^Mz&Xw^KLDW5G76c@Yp^Y?#E`ODn~P)dQ!-C_l;MrkZ1GRxSut^C6i3(#3&t3
zo#FFUzI}xl&zLi{=lRn5F}dL!EGqB3?K+b5cLN^D!#4L}gA~LM35j#R!NVt9L0JMq
z79Q|N6P82fzVOBVA1(ltypRWwE|9c<Pr$==wT{`bn?PJlz{S+W6_tqnGM->LGt+b8
z$6HcseYPC{E^rUBC<KOzc|<eeJ&bFd(fWm1+XKv3kF>44pkYD_laXB>Io=$bGG<%W
z`oP#m9cF7GWWisn)rcrAZNl+`Hh*<}5HcpW-`rQwojY6P&q?*K@ocvMAtA<X?bN1N
zKo9z_$Z|C0#t_NKs=ZD?ATEyw&AcPZx(TP4I#4?dy~ylh%c7{Cv~8I*4O)-b_*x)L
z#^vXEVgaOTp3A&bW!2vjxs4zd3V04E)+5!n?kEVDMnpfOH)<z0KNI>J^Ckk&E@RTU
z`imp=!=Zu!p>HZ_HS6gRlQr~AWigm9qqJButsLb@IZhB0QFqhc7pgYCsW`Z=Lhme8
zZA?|+kWQX%Nko5UeylNO9kYkqaN&LbwPVnOC2-e(lr8!Rr7SR;WBUTM!;xOlvvndh
z;YH8X*T@HdC~+@vpa|Q_(p{OqUQbS++Z64C0E8m&Z;3Tr$mVJ>wb8#%RF)I_V>fdt
zsrTT+hL0}Zs2uq-wWx+2Dvp0QGD}08Tu8-Suw2vMv*dCw%2#1C6thnxem=Za8Ru-V
z=E{VjMh#YTTOJ2eF0PXR1s#)l2chGU?U6L?KVf-MDC0uj{K5NbmE*YAHpiZomNm7f
zoR;$k=cx~acc*Uj^(3>5`clovO3T#;Wr72caZf)MJD68($TMqC4x*x(G%8xGLst_s
zuD7DZGg4&TVg{uiL{oS6J1PcMPwf?=2Q?ykqRr&i+VQHZu}Li1@hJw&7*4e~I4#=o
zkRJUxEznQPYfnwk=gm_&Pn3sJ-(6F?l${ds*AY~T`S=BUOsl9Z@No9Z!~~}OiOb0$
zMpEHY3)3D`%bb7pDaY?g#0D#*Q_1D<^;#p`Ph8-mO2N428O8kldYZ|vdK~M|HSC^Q
zuA`wuFaTh7g>hN7W?$`#KMIGHm6sVm#_*<^mFLkdUh>a_5>}BmLb?z}eD%F!iv8TY
zIVAPXcaJO2j$=0$N25{xbA|ITE-&ceO2l)>PjmVEXF$~q36v|Wl2ZF%S<*%l1BRE1
z{ok`pw#R@Kcpr$=1A0IYW?aVl+WrrJb$bqB`0$D}Sg|lW`_$zGiAa;6@}HUIMHwtM
zvUvXt-_L)w5mNErR|Y1I<{a&cvxKS^`h)};CWX(V;7}3^|NIIZ3hv*r{I54HKel&*
zhqwxp4RVdsn!G46@GS<V&_Gz<Eoz!K=>?<Um0bUB4091Kgz=sGMO$z4(_9q(-;-@c
zhrp4T>aS|xK4HTw80^*`*{63j_zM(=Ewv+{dReuE-S=1$?DV{ZI>kN~eh}h5V&4j;
z|E>8N`(XI-@@=Pbsn+_)i#OUUY#P5gp$aw0wkNi_{QUy{wK=6GwyKgl;!&@f!rq9k
z&C-?u@6H`VlqYdiS+U{pxmLy}!wTiw6<l;h`#Q^#-o01(POv|DihUYfg$U{33i>~f
zogdZjoB~VnDz)N-7oj#{jOwXreP!E*7AvZJxRx3$0f*S%PBUX!B=-)|iwT(eVn33!
zI8p9}bPSI^wG3e@wAs~bmJ?TvA}f{ZU-|?20FFPTUbNN#MnM{5$%YGAS4wzDW^6qO
z$KT1?&-Bnh3BE=oV=ZQ%mngmcX~<@_=9#|29c%TL7G(KE&A%gFfY8@oy|YiouHzDt
z^6~r6QDOhEr=A5V3U=fv7!mUHXE}>Sn><ZF+r@1}^p3Wz<@XO_9M<W^OjBe6rFOoH
ztTyPySm$;FmMG`Pl(iQ9uvPa<J)h2PI9KG)5~vd*>hm$qH@kb4*Hc`GK(onaY8y&3
z2dv^_BbRdIQge-VO~<jQzLJS6Wq!)xumH7d)H?Q7^!$qQfAu0qd~)kMkJEruk+&*b
z&6_o<MdS&vU?&myd&iapxus!frd{3zSJqa<kFI)zRl9$udOEXz0@~}2B&t?+YdML%
zj(`guX#+}8#IO;&{u9rr`t40}Jw2BmQc^*%p&lys+42)X8}>k|hXQ-88*6|5!NTji
zHv;~tP2oLirv^$0riwv-gxe|6m_`)$w#@erB9iG#6crY1DC=*~ZM!?HXm9P8rmd;;
zF)3yP0RE~E8*2-AZ7w$(BmyfpJeDr)Wjr?8lcOuvz4m#p?G-p#M1BhtYHR@&gyW;l
zWTRP8!Ij&}a2&WajUjV^)O8CXi?oHRFMU%0+;?Cpw9sF^IY>}G<E7^}B5lTzj<SDM
zJniahw4$xcRe!^fP~9%_(nJ<xa13fB73H=q1K8RROg}O=mw4-0HUQz)4sXj+%`5Dq
zBZLCAU8@7zl#fw&&@jog1r7b2hNJ?N-XD_h86xi0oUX1Jp<*mNy8hCsfFL($g2;iA
z&POT&!0U@azu^_@wjC~XV|QxZ<Gcjgu--JiRb=0*i<$@42)ql~v<0B!%Yt_B)n?9%
z?d=*8&k~xkvF=*USO0`tvC?-Tj_sgQKF*C5Lw&M)m1D8qpQBmmlq<GlX6_Wi1+Tj)
zJ{`~fo0Qt&9Gyr_s9`3@;qnv8{~8559RJJ~g~WzF++^xEMa8mTZHm9SDPaYbn#Q;0
zHVQXUU%INEJ#GyuBq0Fbk9eVX+wu%4y|not{PEM1w{I<#yT6`9n-=NwQ69l%@CG;X
z63QR~sDIMBq4cNmYx|`rw%~`#SIQ*?BJ%XgyH5(5Yi?c0X)T31K6@lixpgo>B7;qV
z`y)&b*SJu`eFXq0Xmta8=4W-Y8G4G&+SnA$IFKe~Mc4?C@aQoY+JyS&2m8jbw&g4U
zU{b9uUb~tIs<&XeW+j|A8QcV!GuKmykGc$V6`AFX9q@L*m%4Ij6Vne7ae_#T0NooR
zfbe3CB^Sag@YW9A5wxRfOK8vV{>^V1_1Ya5&PaCKt*IB4`FkEZ2(py%@k|qU0tT>x
zSKSrBxbL<{r^WioZs+xSpq!{4?lasHzN|zE=E@`2SCDP^3+Wq&d$!_x7e<IC(j7ji
z<7Nj|l>$a+M%pyl%T~P|@wbf?OWiR3khfRSl+>*W%p&smbJiD2T7DIbqyeCDMh_?&
zPW{0|lgkyHq3XDy3lF1}t(8!Pu5eEc%m6E~`-o_125Oo44$pt9_^2W>B0~@-fZPfc
z)e$*OnnEea=x@8U>yX3Hw%`2e2^GArKZIg*1K?}bACz!v3;k0rN8ewy6}Xt(w+X+6
z^b@+Al}Lm_5}s~&`{~^b{i`bU7LqHrCF`!i-HUzUZZJ0pCyYvG>4_?C{KknC<<w|E
zynKOPG>&*z4H-C6qsC|{nyI&8%F2W7_jY=<Ab!Q9aewJwT&yq0Tmz^UbwFXY8HhE&
zVie_O5_^hGaUHc<u4*BY#||A?w$ZKOWe^)uD}|-a<9~6-h~bD9VumSW;J|L!%o48R
zj9cC}0wS|-QQaRVoM3dc?Zg*vr-quU5VrQ6>?yfJ<@oa%DMdO|QU7P{bA+aNx6Lh)
zTaXRHCGueaEO|YDk9pH28AN>;7j0MS=)@5LK$^R=7!N0u9u*JU!o(^70sx4z0~ku$
zf6oIL2tsC^t=_@VeNs5To@(xFyZ+Jx-;LfF|8<4qv#{HGY?kSZzDa1os*~<#eo9mv
z8F>WHfL}hLsa6Ab6o>%!xNE9K9bgMt6w^1P;-*IxN8<};r4^-3+tI$e&ySG?#1CgU
z@aqn@y@&Amrf|we{nP86CvCocaHkZt0cWTYIyo{y;|rG=625J;bM>~xI<1WP^bqPG
zrX0A_1>z<McSINi2^VahF$Lhr%K8co&`%N~@@X_F5|6>7_-;bk*0ST<F>A-oxjTxv
zog8)9CD?>oB-J+~>~^A@!Nx~97~Xi)fpj_E*HN8w+uH|2n9&PEQC4ItbOF`#ynRmg
zZO?y{;#wM80`l>hs8ML>fG~pf3mTc^EiJ*y_pjG{XEBrso%koSFy*HC-?7VGa}#>l
z07RVMLTP2~1FJ%l#Yffov_M_lesOT@FZw&$YR@PaKk>v5h7uAJ5LJkUdM3H#4}!z;
zYdWy9v?I+jLE4O)YzDgE!Or}qY(^LmzO0beSfm-jI>Fk?#K&KKe*3Y0eL(1i!yMD{
z^WxWl_sg87`}*^|uTa5_wLg+yZQsw6N5H02I|^erxB@wx1|J)d9$}MgbUs$BB7QD5
zrExUAfF;yiZp2_;1RdMk#NY`Q_Z{vst0G)=htBh1Ah>utE9`tVb~N8zR_et6zDk*y
zeTPw$m?`u`Y^}<u$x3wX7bTC-{#hu)QZ^>3Va1WMJ#b~R-fhgDG>t>fTYO|0*|TYr
zd~i3oqe9=*rHPC9&#dhzzu6G@`Sd2vpF8p_GmNT>BObI{fBR>g0*4v&{Le&@e_XFE
z*34e<wfRRx7UY6q677g-6Ct#nBlS^7nl|=|SFm7@{kgMLJBFU!OX49|fTv>Zz7IEg
zm}!j4+nxmI{r5l)WrOrU7R2w%Xk)sqQR1k0gGiBd6+ZeZwe&May$78PX7HEV2kfr&
zsAA8pAXFr`0c}WMLfaf4yqw;(Qn|ye-oh3IFhDzVjknC5lr&KieTZZyOmu6Uhqo!?
zJ=j;rzM)EG2yQ?FS5~Uu*!m+CPRUE%7Y%q*K2>mMnvM@xZYD-csu9S*cDAeCadS+4
ze7}qL8xuRF6c$7<GPif@j0LcsUXYb1{)1~TJOvS8|BG4!gsyad`5*RKf=(&5E9*N{
z>zxOMZy=lit(rH8im-b7*_IY*iECO^x|ja+ty?u5n=hYH@S1JSS9yawwxl0}$ZdH#
z<aDO^6dwcP05nQ}lEKGgu&-Cbadd}SOJnsdh$=6aaWQrauz>dX>o-HU21NW1oDST!
z1+Q$v1K2Tb#wy@DHxwA`DLC6!wh%0nVJ4WS>sAJG4$@^HqGxU~&O2r7jKE!I_p6Sx
zZ6qAQov<$A8FfN54ioYeykO?l%V!_Ny<;)Zg7}Hp*vh^!kWp<mr)6*?f;s`t@N(GF
zyVjGAhg191o;fy2IfVsh<8$Jjm+@O6g@{+~58-me_SQugoJp9BvJL~o{s_o(aP7cH
z??JgUF5D<{sQ2?^4H`z1Opp1UND?!!n@rxX7Pzhbif6$cowyewb$^c9jF{EGk{Wt{
ze$m8Q>x7&P1n1ipr{#*o8LSo?q;yyQ*PUN$YH>G{HK$AljIj7R0CTjw_!OH{coP|(
zJ&4|5cgkaoM>(VFaXIh&9oKc!puW>m=H!9r^!_%_<j;YZi&ns@S34d?8qb&1W&g9)
znvOFQqpmYch~9!05zol>AzVCP>8BQ%6(jt^?ysbkMEO(Oy7o7tq2Zr=Mx6s%fo^zp
z@$xh5F@5Qh^5Bpoo@_NEh=N|R&XB5Z?B?4AK~J1<Uo>2N+n(9PJ+G#X|NaC_HVoRH
z+E*xTbZSJN!xDj|@8CS9{^Z~u#oCBG{t_2C+tjgjwqm{qUfmg7985I!hyKF4m}c8J
z&cS5LlbE$?Ahz1>(b6gl2-uK`8m&L`=z@d7w2u}%wQ+t^#a~bN>fU3LNttp+TBGvi
zZ=T@8kU?MW*K(lcBkG%NQd4!eogo9jy0*JN4;ifacDS({kd}a-i6xbjT&pcEEy!3R
zVTac61ws+e!B9)M{KcqM<B%7Q^3?6I{84lLgO*GCp@Hy}uH0*S5=VU)$+Cvx;CEai
zI$qdn;<`r7xPh&INe13ckjN-JFqOq>PhDlKmL`owLC0<?3x^Pq6&(8)4VQz2J4)6E
z0lr$y*t2Ck_`61oD$gLMXwG>6P?k6)QJHb1l;Yn#Os{ol`lO*gR~-p{Iej4fQ$Y1C
zS@Yjc|43#n-?LYZ(F2pcZ#fPD!Qh8_r;y-al<L(FWF|(Zxh?@oac-UPyO5@Y?MNMo
z;>_2McGMwY{rEjQJnZ#Qwz#EOL{nLAM(lAu0>pmt7!4R8zS6A%XkD;g*dJTFU~wUs
z*^q!0cpK2)LZJ3<1!tIHCeRTJShsY^t#^=Ur8+CZux!s77&SsNlVuBfck)7yWKf;f
zk$ApZCgh~TRG@w+1^tK7Do<#g8uwrNgUu+c+wYF}J2Cp_tQqzD>^NLU;hw2F5);-%
zTf6Oc=ifGXg1qo^e_Y*sUxl>EuCRg#;f7G6pOS0T87GgqknWOodSt{7c+RPYxd-bP
zh;3a}P^N<*#{-yQnbRdKqWT0O1C*pPk0B!L1>cdJv|yQBx69P4qDc+3Ni^FfO|3jn
zhS0RfTffC&qt&XZ%LnmSWB4LGho|S~h>b?VulZ(Jjn>6QayS?ntBWeQ7&l{BH7=!_
zYzpmtt^^<*9kZnhebh+@gJ|#Rir5?ffcrBye5<b@LRDafA}rjj9W8KJW?K${Rl5JP
z*FYz+JflEImQt|jKZbuQ(8TT$?P3hN%p%Z+(BlH*cK9?GV$HiZhcmwfX$#VkL#kln
z>TFEkh+;X#+07^c4FAeRZa_R@Wb%uNHeOpGpvApdfowACz0s}ehg2LlOo%|cxSJ<{
z{&FCXSHD7df(mzCt!B2?)T5G%V&}on?eS+Q8*%Qp%=F%XV0i!_ir3$F4h?ihn=yii
z&*#yq1x$hn=Dp^3%FKn=)u=bsL=Pl$)Q=pVS8>}$&d`i@l6lt21uw*1dFo9qBPqmT
zi3)?5n+oR<P~iwNg_(>qTSnyRNoI7m=7Uxh4pVDFqgi9LgT+saWI4ZnwN%ELJ};)}
zH>mu_Z&m&_jre<@kHJ0@#upNU0T?g5h@54tQ#o$xi#lfP{HmH!6?!@R>R0ief*;0Q
zXeO#Z`X^m`EKggVy2CogdErpGauAq$bsT!o^I%FB0v}O_665UPL~4Fc90wxZy_+n9
z4)oV?>QU4T$itw~KUWT{Jra!c#Fp(uSbV5utQFBErn@Ci0hr2uN*C3U)R-)f#J)Yw
zYB{=v2*I9%O=pzp*8daoUso55o);g&ZO>2jo=+}-#%nMwSH=5%7JY~YQ(sTQAxvJk
zBM%O`1tU{t)WNK#NVMkoAJGOH#JQiadWbi05EO?qS_4+j_$!bB;GTIf5lgdE`3na|
z2;J7TozDI=*FA1d_k0eY%?G{PbGRY~Zk@{*1+id}&Y+Fvx1WTNix35xJ24d6_c++g
z2x-FwuI*`;yl+pEh_Gb4b?b9P+qVjfx4j^3FGb6+2-)qBT@i<lddix^9=;(UZcPS4
z>&TdIpi?tX?2pWET?>qv#nchl56)aCC14=_2$%?Rb3kWm-)SGdI{3!@jzdj)$@1xk
zJ-ZB4us+Ty5ID~Ixg1>tM5Hd1aigW@+y&DBJM|zYXXFf>NPqdq4>ma}{}H4@cnwc6
zczs0*hT3+D%Xca_Qb7RtRk6B#iuwyASPt2N9PNyAps77UMa)#!(VrcI^LnDfqwq%`
zVa}$4t-<S*EJS65_mL!H)#w4vV|V3K`(0=)&D~DXt<=aMoL{}`++cG>TzUh4aB-YS
z@lW?of0s2zNW{_f`JvVsX^IByV9=l|mw6=kkx9xm03H~8pRBz+fkI`*jyyYGzilAu
zd&U|xamYxFj<iJ^tt5(#)l%4m3Mx%RE!MrlT8UN~{9O2@?~KAY>}O_TDik-9lYejZ
zR<@q1Z6bs+$-cuKF{mc$5Pp^<$k_wIt^-S~%$PQCD*o>-`JZV#&?CpQPDux0%?@yL
zDHI&hlR|=%z>e>Qvsww4k1@O>w&IG0)0M&jyXRcUut`x5n~VRA71Iv0)vTSQ!kuw7
z<hX<x;lL(^4YVd&$gZf*DUj_~)>{ks{Q}d0*--oVN*oC1)eM!NH4x5LyNgtXgS?Wz
z;M)wIY%r*1!GVU{!)tyt-F`4SW67Qg<PS-COk*(rBzh{*)9X|k@Z75kJ@n_pZ@p3c
z?M<17;dr?|j0%v!aykXmh3*;$<Y>D_(hB=<PhgI=co^m!Mw)l(hYLpPR6%#YAoOSV
zCSPtp?21uCR|?l~xxD)-A>>RMQy)NXj}Erz0c7;mZ9ClAin99;q)I)ZaF+tFZ4C|t
zoVbGWsVFJz9>7oofQ(4K3H@ROVNVQw=L|+E$P4v8M8T-yDHvhRhx#AR>`#5?Ogxoy
zIk4JTQ-OM+6gxirIzO1v56k+cI?w`17+Z9p6LFxUpx6h{em9yTw<S(#53}g?aqr=S
zap#5&K7WJV(IKZdMS#h--&E`1BH*IWQS#Llg}2O3I_B*A*B7*%V{f1g(3O-rh2ccc
zo(so8aT@f_9?s^vzLHEik1DWknfOy*J{0NvS*2;nOQxOiXdC8H|8eq8C%;_a0f`XC
zoLuuv0<^#{Av&{QlTA9vLTOX0AYV8H8D4whZH8g^KKffHk{7N(gLNzY$2T5yOWmRS
zdZdo;cE8TpsRUJsIZ>KvI2ebs{>QvH-1v7khQIw|Uc!cOL-JC+k;NqfqL=C)m0y_K
zGb;3d?Ebz+tNnH=CR4k>6y$fym?|m-?Zl@CNq!e>hn}to5L1p+xGVTKeA_}|VmGI>
zDyqJDBAfeAlgszM5^jizojmv&@0QZ<IQ#tpUk*K#BNA%WsIx*zWjZlhTJ>s1D3T+5
zJ!$Aq>qH78koK1c7<|`YYTN190dB_~-bPCJi>W`u;6_53N9Ps@|Mi=!Oz%Lc9K=AN
zrM=j%=J^F)TtM(fKyG7KM-$$|2f6nJVseOT@=oi^cW3Nxs4{QS`&^cp*f~RjvU#3&
z#f<gep+j|oOeg=eXhba-GLAs;UI^5lRcZv8+JCgWnK1>&^g}{#{qn%-o(ALqhx?{m
z?wOkkl+o)xta^j0+{{?tUtwGQmpTDs%Wm$-CQ`lH>(_F&fGNzaYP2a|K#Icks|IZg
z4D%%zpf|MKzC}S39<rEq8wY6em0z?+ODmt>zAY~F2!?k{Q&LdczDmlS^4$OBfDg)7
zROGW8tFN~(kgr+7K;6w1M<+8dgqrT&Liy)lr<B&jHLn43NC@<H5Kj)E9_*M(Y~fGd
zDeUA9PYP-TB=2Vhb9ult$uomjTmFf+IMZ?Xi;p`lYvE3*oE4Y+BxB{O^6nrfhds&D
zcZK#|8suTP)AeeBKnf{UdFmw-RR@Di7Cdpy_Rcu8#n1gixF*+$%#K$Fxb?<Rxh$a#
z)eL)BQoQS~IsRniU;r~11WGu-R0($G69%aeaw4_){C~8!y&&$6gH1<L;jMqC9jWE-
zTF%&%T|H1e198~xS?CW*EoZ{|2vJgd%j8`u1IC5e41-EzxFW5Vzx@FLJ%A#EjEx9j
zw;Io=)PFF57RMZfK~>%DDIBxn%G)>J&pw2BZI<X?=6mu{n|?;E$MnQ21QHo2xVb<@
z)AA$TZsvFn|B;BkRGe_Lhw|}8s!I55TY#4)^!MT(@EO9-wfRuqRMjJ?_*C=!RR2{X
z;<pfo@PGBz?rR0Hf4CFvGYSs=P@3uWoCWDOv{<!ZSIi1G1hB>HJ#rk@tyh@bFTF?%
zT2H{%*Ps3uKP6Ne;6?7BflfH#Uo2>!#CI~eJ{$J5_=U!%>;(N4NTGxj(X;r8hA-mu
zl=(@Xi<qxB;eZ(77{tY<J)p$*Fg;cM?`?h=`HBEA!s|6e<H_)si((2eghG4O?4`k)
ztQ3hPCYA?X!vEA8g}V9xwtY~k*LHpG;^@@($n=jrmvjr3>cLxy=GJjKp$)@n0N>#4
zUok6QfW~_=bFpxUok5=7w7T3MU$Qv!zX=5l;tmR4TD|=nm;#5o3zvYJ*HeSVO&CN(
zHk6nD4j)eV9|T6N4mO&vCec(xV&<1x(QmQ;jPw5or1|%&Q8|v;k^bdRw?n5W=Z_zh
zAPqN-+!Uxn#ywoZ&z~HeZvD`ZHK)vm#6Ds?Y&l#G4P-5M;nW;t6{^nu1eRR<@=%d^
z-V^N}-F1DE6&XX5w`+?SW|rp3poYy|*}R}AEWz}(*r(%tCcG|>{Q8PIzsuC}aG!rU
zU({$om9okEa7$&`Xm?t<<E;BjTDY6`JXOK7Ax8HHosR1&0l_|tCJSX8u6EDyONq#M
zZ)@_{q9jgM_$**P)LqPD7B}1e^yb}qtRCF*Dk~qG{a1!}kR(HA<?+V5im7GHkqdnz
zg}vFNj;xP2b-6#1LR!ni+n;gJ-Q^Yj>xTOOA?z*N;%cHc?Z!P2G!QgEa7b`>cXxMp
zcXxMpcXxMhoZ#;6H2QMSGc(70d+P`E-bdG}wO3uW>b#;gU7Lf7NCCqQXOYX@&+qFG
z@$l~_CcpNpQA6h!g(clwmW#l%QRL$stY6Oz1QeNtt>m(YYBs^Mhcujjb}5LQZlCY%
z(CZLU?P+rq=2<_PbC$(~Z;f<Jv><sL%j02{|MskoR<DUxFTi<&MBD6~P9#~2#_Q3>
zQ+lfLSsn+EKD`fi*MCUaODT7kD%L7j5(Lo;ELVic<Q}i?jma$T9WARr<?nDsUVKU`
zArR~6X*65!!_C6SxB5kF_G+=`;Vu>Cp7<8=7uRkK%VGwgUkHFezTXNvH*EZxOl%IL
zy-m5>*E3_?GhioH4tz9-@lOT5RZ3~pl6$?=dZiJj2Ck0vUHEvo7r%c;aaPE5bkfN|
zNlR8fvx(6W)rw=doOa=wf6L&~qAj`q_wHL<4winx$#oyG)$zMnsJQ5%^IGK$%7Dq7
z;|s^Kl2uLsMKhli7>Td;g#vKQTHakg&NefPOF?c@V-?ma5y6@Ir=tGu^p~E7hW@}Z
z1epB*+vvpuaj^S#Zo@S{$Ii7D9>1nz*S^ci!DxwLk!Ej~{;0fG02lY)k9=#?X4DSF
zW~=`{y#NJuv%m4;l9Z6bXN%rmp*(A==7SPP8yiPceO9T{@|}t;XKOZSBA!Io^)DV}
z-L#FruYNmEe>gpGFe^FTvf!x8sZ@!AYfa+2#IzR@Jyba?AV`n#9$aZ4;T^DmUAv-r
z7<@P_l~Ekf)+H{l;Ldqnlsi+RDF<3VWmkO7sW}E=g?!RsIs_yNct3>i3@b(4+_uh|
zk}lKL)-dN*InIf5NHF}Fa2yFy&-vCx&4r_lOGQJM$oUolvh~xyK6!9JIVSR_>vh8S
zqE}_w=i0{kb*RtRliZ2eY9KCUSvXdrLW3Nz`or8z@sI7SzhftK=ga(+4U!!l=j(iO
zOb?sSM-I4~nsy@X1;fYP9>-BU54WfF3Y5Z~9gxP`LI$fOdjl(LaRRl89Ei%*PRc1^
z=4WTW{Ohjc=;O&_u|lA2Jpn{NL2=`8kp!IrnwYqw_ex98uiTO#0NP;ra88j-FrODm
zC{*jACk>C_{%S<VWA#004t;!&<Zww|khUfDXe+!=j~TX5Qi_!Th{F5q*nne=7cgw-
zbDr&uym#@H64r~tYypKIizILO-@N@?iaI-HxGxpO3-AMJV*48)eH*Ce%WCNV=H`wm
zlJO0k_^R&2lU{8rfEc#=QqZc6KVO%m5zYAf7T3g-SCuzif(V`M<|1@5ti89Gg+dT-
zea;GI<iL0}-(v+k%wikvUgjVU%l~E9P*o;jasCSEer7JLp>i>^*}>vDHIT98cWS5_
zc551?c)2GtNUNAneSOPT-3soedhCioY9Q*P)H)%gS|$E#CacGwVePZl^(H$#2Lv_G
z`{RG+XU*ULW0Agv1WbMN>3M%K+uuGiJKGigH{)xfW4R&i;kFLr{&TZ#w0ziS=5S~_
z5$QcCmukGh;GkG_qSAeQ^^qzVLFDWD?C-QwR;J@R;3{Y`$_tc(!xXksNL-KFVshq~
zrkmrW(ci8^_3^mZ=_t%_&ix6a(zIx-rS8gK?R{aXRxh%PY0(nGj@aTix$V_Y(6W-e
zq0x`w_c!VXn5^v_gf#OMyR4tX%H}(Tfxqp+pPej<D{DnrLMNs;z|1pvE<cC-^0)8#
z#rzx)xtbfkxNS-0u+R1=XgiSC?EI{$Q&QdJwdqeuIAvviaC+bya?iwn<9wQWoM*bG
zs;2S9;@_eIG$}uw@EVCyVj~bZOaZ=+S*=x}u?aCOHJY%x0#_T^La-DuA8tPQWj!kV
zi@R|=4}pa?*=tKH%~i1Zjuf9BpF3j1WbfsvhW&>GSfaz}oA&%QtU!6Lb|%h<FPMG6
zB@f@|tjGKLzbhi=8sfQ9jg&TI?F?zr$z57?w&opx*4O7q;h`0#{K&3Jv4dqn&f*_o
z%W3gi-QIGAhf}N_om5ayWwiRliv<|Ahb<%5znil~;;X#HrgnjMjTjPkWEG(*m8Nfs
zx7q&102;hDVXmFO96&2m5(^WKTC}AK_LkNu!vlK4U3>KyAk3mhhW=s#_gQ)}CibUC
zMb#1U*_B%EyO)nx#G4ta#b5Y3J#UR_!Q!m&)TQ|5>i~5fGxlJ7i3rZ-88w3#StjK3
zC`k^~Icb`hYS(7elekt!P0f_72+1|91$87qW6RO1M4Va28$VS;L(CKM@-La5i&M>{
zti=ZJXh{ydO(_e3XbbKdD}D7NCo1-hMg)Pv9#lsmH|NR1L3QO8WVU!rH^;n&=9dwh
z>`2L1;#@YWf&X%1B3Hy*QO1J<T<PZD3UlmM9-7<!5GDVl0-aa&<c025WcK~MFZmnO
zgQM1BsY1o8S{uZAAq>_skDsYAfguz`D=X49);h{;;pF1{=KgSfl34D&I3ioMsTkuW
zz_o*+E)ifh9QmTi<k{5jBcqm7PQvJ=xQ8{X4lhaNd@nz&ut@%^OtR^MKV9B#7TwMI
z8s}uG-=dlF)IllrsAogR<9KsZ*+e8pmDP<+DOw?mee%aq$nj7Hnk0a5pWyla$lv2|
z3TOWn)MN>!seOM*hw0tpwQ(6fGA)hc?ZA4E({>*aCmnVrH1)~MXM?u9>xfNegN%b=
z^inRO1gbyphi6Pt`4)ah?cG%8X8cB0$<?|i*JDtFm{H3)Oju(Ch}7`qxW9oCu4r&n
zR!?qS1~Xfba=6IReialQUiDDcWE`)H3eHFPAvVXH2a0e!!&iLd(_dSt=0z;}I{DyF
zE%qOot>g>+Xqpbj1CeBP&}aQ-03*t!6zzlKb}o^vtihIaLo(oq&hPR9@Xo}=GrWz_
z+&V*twNS6nxRkFz7ONqzZa@Gi?SmF-+FD6Yk~c&evR>sc`4YpySmkkPG*^eQP7NC+
z<?=oi9<KM1yQfo9D}L>brnTDdf#ieXe~5)R<#qW}R3VW29*fPvJ7|_iR`|9v&D&Ap
zt;g%bj?>+wv|O)1eY-ms6!GqbKDzVi8aSg`7S%fOo>04zSnqD~-(O9A{n30zIKGji
z56CA2kv;#*36kGKLQXo4YxVxxp#DOFt3Yd`tmaELZ%|#Vw!bZc;qdmtXz~YAMrS)c
z7ycaK6k?=;_L%gUba@7(H0M#ukiqkw6jgeZ7!N9*h8cMP5wxCbU4SU*i8#ofDIcpN
zLnkcX3T4YeI8k4AHG$TAjJ)Cuh_gK=-Sv&EBIZy2<wi5z5JWU!fIVgxnTj`NVvqHi
zdsVdFG=q<EA0L&S;&;Pod?46E*K(3mK&+x61-#s3E>s>w)36MFXEX82T)TIbhbyrO
z<br0Ev*4>l8~c>%kB@c778Dxsc&9Wz-fqkG-5b$Dk^H%t=12U)fYcaxc}f5;IraM^
zvi0r;cURZ#++DA!8VinbmTXoQXkFj`&(Cag*`{lqx_?aGCkIcr88WHEqlpcyT6Wn*
zBCdD=-5V(XI0E$m)ibuX7Q<&$<&Gqq^$rfpf3ADp3@YLI*x#!m)*%`?+dU37CsOLg
zL<~vG`6$}?PjAv?t)`g@Grphl&C~Cni%y_&p|+@wa4Jqt6!LvJ7rzMo9S{i8sa{5Q
zR!o7LEX;EZMWBQq9phS;2?^_t7s6mV^=`J2pq%-M*o%?S;A6jaMb@6KC1lE!nMEIO
zeS(xvRu}SI)e#6@E#^Qf{}2>eqLziykdb<(;)R%*CFjm-i$C(*4sR6Kc$yx2G5zc+
zr}*AK^C+G)fkID*!r&)MXqXk?my!ZQdPW6*`MxskGRw{Fn~jbkU#bDlBF;sT^h9dT
zK#@Ikid*&~ju^dYtXvbmB-)K!@!Ep*jcz~O9M84rbU50}zrAtBvxzsH3S;pQyIIL1
zya)`;DCN1es>xjUMqTmJH|D=W$&j|@vW-T$iBKDDywqUmgjuhm;U96ChuYm(4($n;
zuf5F%@ej8it;rCb&(~t8oV7QH+u4d%o_v*7V})k0KUyH;n^%CM6*b8Zpr4GO+wQYO
zj`qwvCB~%j%0oJ&7VTH}t(fZly-17~kI^E?zJ&G;D{6tH>V;i+Df-Jzt*Dxr9yqOq
zpE@rMf#`8veVz0d&RC5GLe?$F!w(LJ!6w_IzbIj3T5EZO+I)gW;8eS#NX{kC?mj++
zBMq7J`Xh`!t$CKvvEp{!DKD_3i$i{r&z{&|US0e^^TLvIvY6coyn?h6;b1oDWDd=!
z=Pt;8Hw6s?9hyj(d|_>%uo;WPm3yifL5w4GTY`z8|6BAnvR5xwMtSvPj#$R@O^P=$
zM&R6w0<HTm2jVW*3DlFNlxWW+BuBnkvyX8nMHEvnIqhE+Mn}?(GUQ{=QFPP+zayi6
z^xi)azN)}O^R*k5fdLjhQPFf!=AvPZf&%v_n#jW8jkJ_p3`002EF1z0t2#Hsti7@3
zUyV+WGc^7B{$@w<yZ`d%nBBDQ?1lvVLs?DWvtx`?AYpeY?0OS>sqxffYn(a>-8qki
z{n!riGz)T!8Ehh?HL)`b)yR5h9!rRv(kz2neBm2rNaATJ5f>~*2k-{P)<#Ph<z9?C
zV(Z2btXxpYOSL@soOs8??}0RYm<=&uGlP+2lT4J&Lybea=XciBP7}8pFl#DpFAkp8
z(W<;1rG7lPt6_uvSWHD;^Z6^3bR%<F4@5k`xhN%r2#&J5dC6rJp?5XHqII9y-eNNy
zx|>c>*4Fw-1wa{(EK>r@EPPA7p#Uu1YJX1(S%paaM9JyUih?_uFklEuKZ;u4IE>au
z@p@ll^)sfh9i00SC(rS>n`Yg(>-)O6PWv&8fzlZHrj9bhYsBLfQtuF++Lkt-t4+-b
zjYWwVwxf{emV3-#(avf=8({r|^&5A!!bq9E53MwpLBFHaGK#xNcJDzFL2GcyC34oC
z#qF@F_S)uE8Q($^9m1|ra&@KgFbt8F{+x)-pC4o!ikP7fU#A(Yz`5w;nzdJ}Lpo6A
zcS%>CEwUWThb&vSN&7A_c^vj>*i~Rgarw7p!XY!<Ugo>}SeZi0Id8Qvi<#f;-0z;m
zO8e{D0er!kcxGzlUuEQ(Z%DX%8g8Q2{^w}{4z|$eyV-^ibb7d_=!30{Vdkz&aeoT}
zmuqx+P>CC;W>652eELHyXdkZUQ*<1*-<|%wq+<Qya8V=-;LAUvR$c<5z&88VtP`d{
zW!$g&NLmG|sv6`?|D&>0(cSy!8Y@UY-~fb2MrNDFpB#;JC5q)-BK`>f@?FxG!y5lo
ztwwR^jU$Uk#|@n~4&_cD;DGO_?|gfuF_uyj6w(_5e=76-^Py026RT!w&<(T3f#g&S
z#$0Z!eDhRk7H2F`V&=;c*QC0%lRTW*y(<#`hMb#hFy}W0hOXC%@m}gCa3`nbS-v4s
zT@gQ3_V*}+5KqD?OhK3#U+3>cF6~;;7BP*iA$+mTiSDQVM@f9Z4;3GlT*eN?HJ_Dg
zo2#d`^I2<C%kMGGVAgYMh)mxFI@rNzurkRvP)-qZk9QxDv)y(F0zmO4of5N5TAJ=p
z4jYd(ns&6WH^e3@-Vj_qUaeQV^X}{XjF7;C5+3bGljV^2=$_AarH1olFm(wN9lDe2
z$@Cf>0B`lBtMT|3y(<x|EcsyL?0DDdd820YBJOEXgJT{9U5m6<VjHTB%!6Eu-g>GH
z#aWEwvIir!zInh@abK=|o~pgrVOxDO^7x&NdUiT7IQVbGzk!}`bEYh1tZR{Er729U
zo@yNKkdqk!R_{!d-ZrEm-$9#0EA9oYa--QW7E0USKact4xtT|Xm#J9y8!ZXTJV2gk
zyf;CVPFtIiJt48`B#ZTuRl^7=&ajzMDoTnKY>f(Gwr}s_3`aqgXXl|MC(K!;XeD@i
zX}Q;_gpS1n>I&E<uwa_(a+I-^hASSmh$L17IX2+EB_-v-Q-<u$XwsSGZ5!q>f{lb_
zd~*MjHpFrzP#o3S7Z9I*#d~#Imq4PAzydP6F5I{WysP*9c$z7#PU<pXfa#BZS5xvw
zR$cUNdS-P1OS<;Ti?@f$+&rprZyMiXf$a<hMbH*m^rwzk9N>>REv0U3r@&q4wBs9H
zLPg&QWXYrgsSj=)P3H^_B};<M9q;qV9oY8EmD!!nWLG5wz^PTkgJy>MIAvlgAQNzH
z*JIRmV?G_$ul{P;|K>sfX8{8^)B+ZI=ZNp$FSmKjL_i!@eA%byRI>n{e|?T$PTRCA
zFEh~}uPzhc=pOD406ewXHXP(ClIB+gTO=5&uQ^S7#!J$v?kxy9HuWt2{q$(xbWsOB
z+B$untro^O(j)iX;Nd-*6U>tt+{RB`cbFkbb@u2x7P%%P#<3OYR8c|k&JuEjJFGf_
zbUQ_k#l7m)@{PPK`||8-{?-IdjZXecp=O2RKtAgO_dIAugRznqR7N^LD7W20=DxL$
z0D8W*ln)pUKAg!;$p2S-bZ{xIPZ;(|e!D~!o-%m>A%vXX$8~p*!GF@zZAnK$K5Mjo
zbecc17QYf*3feg}xBq^tllcR-AeZkRbHNmN%PJiXS=yhf7Em@vyk0Nm9}O4@bZmMV
z<C7fGX=5;wN~5Y!%1I6$6JHc5%Tw;tB}u~)jUXT1$Qm5-!+~EK7~kZUNGkWL<v}(t
zWtL;injp}gPEiE#su!E@PY&0R9qfBqG^LRM<CSt0xy)o}C~2u~D)O1+g_wKgrKbUT
z?OkQJoaWs3RC2EnMT4VbrLj=)uPiwTzTly;T9r6lDc|mQBpMEu^5bo<B+OvLIyBEP
z?Px-m1M5c+Fprt-DjH^pv7hFyvU=L=%S3s+i(@6Y?1*v_y6RL9Hr8QAqdweL2GB%e
zvRR)Vdbmn@K98b9EV!hkIszNb6@r$gJQ*KWn}t*CEH?9!LU#I#nK~5m^tQQf+DwEY
zm*)HpC!%0F+@M9r>RN<bzFl!YWhBD?R2K&IjdX;-xRxs7(}Zx|x=H?PWb&!RxfB~S
zS9{SO$qi2hIqFbeWHgb9Th&Ji3(ZPjK8Kh07_0@Zg5qQLWIVq-k*BiOC=wy*A+YM|
z;f>499n~wGOW1n~@ELSo%A{9Q9-jg)TV*x7zFKw;@7P?Q3MsE>B7Q^5a$(lu!OT}T
z<2I13)E^f^P&RUj{>n+!B{E%IqUSTC2HQUUy<xxS_gEC*naeYsVynxf%Y;H7C=dSR
zoID-d5_c5tO0*1_1C|&LZaQ8<9Art<GK$YVA#)4j^mG@?8KcXCqCg6l5LiDwZypmK
zqS*<DCpf@{pO0Dlx)ruM6y$98>&E94YRQe)0VlUV*bQ=^(aNA~)FLbkg6aGB)$tyb
z8fXqq3720^np<~xzw$W{B~@!zP#C%2I!G@szi5V>i`u;2lCvf?B-7bh&+8#YmuUPg
zo|hW0kr><^*B}qn9M#ymcW}I>_IHyfQ$_lhpX@VJFvB_C%&M6mu>vZBIKQ~!VTh>I
zbtaWEqxMb@WyeVs*Vd(4I~iPjzA_M}2sGy(-l5UixP}RZ2(GBD5-U-ZFQ6c!))}Y7
zXgHFskGoa~gUT<38lhrRXU#b%Tct%U_lEU)S=svSx^o6=?g^h0`yKffwAa;6?sTZu
zO4K&_W*KE91)IQ^%6}`Kj7o2}18Q}`KkqF}{$~+-a4Ggr80O!D`_#tbu*H{a5xhDU
za`8nIkSYNe@Al7iz(;1d2B@VfutyJYd$Y<LskUevkw<R^z)OOKA);_juweB{oj;_q
zsp86kt3otG@+gq<?%}Ck<W9x0D&YLR?aVJHp^qw&+>J3m9mxXg!+n~v8=bzFI$Ql7
zYd})U5#loce_Fl>@6MU+)YyKBRmUm<XsvbmQvo)uB6HK!jeh9ir<2>NPy(PRlMreZ
z5wHKWZhY<p@LW6lM$9U%Yq$&P9m*V)IbQWxGq&VoX03{bRbp&io7%yYqhv5Yzsvr`
z2LrDqh+F~uM}6631xk~hAe2<;DmRa*Y<a-*9k2YguR#nCKE~t0X+=`<;a_Ko-I#z1
z@2p3?m}a^hhVk5q!0FBVcj8qUm?!T`Tev>|lwn$))}xgx?#&JTM}i^2#)IL2J<hci
zd#f#4DYp9|1v$$Yi=53n*P5fpPqP8|0OF@`Y`wuoH@vvp>6SX-HOqp&|8mK;#3{AK
zkNLn(Rw`2OI$7JGYXB{rno6o3LTdDTX@HMXk9$<RnO5GZpD~||B&0SNderIEG`cEQ
zsbQhac$hrci@!S2up}b%jI}O#D%_;qdY+MF2ZiGxZu0>ydd@c8=jc%iGw+1{Q+b|T
zU#0{#EzHU)y$(ngnRvsVIJz;50&^x(DGE<RW$zN*=q5^(`KA(0ewwJ31#O$CFaZ9W
zpLa}d3ovm?uqGs@<6b?p6_eEtNnGszS!wpjhG363I_+HAD)ArI=zthP=u%OPHG_Uc
zt$9!bw-Nz8cMs>iR#zDj8_9v0k%qR6A-j{COTNxBiv)6tiZaQ5|FW76-Zt2_t(v*-
znamR?3V!_a)E%Ruupif>ljPBL>=JKi+57DIHb3{WNBirt&v8u#50au`66#q}EUOmV
zT<tpXcerDCSKfo8@H35S#}#mZ-xEDzV5dDm*S}N6>$GGAoyShh4ZCm7h4ZTle(77(
zdwngzrN&tPj`4@tP`dVGujav@;R1YI2*OvMgF%{dS~vN)hFl9So7Aw#$@}J&S%#V6
zT+`d>NvL5(iQ)0VxPhs@5G>YT;6$OrD5!A`+B~q+(tH&eFWY62EO8X^-{ZvitR}(n
z7Xl-KJY|kFLBU(JVn;dH`@%xaJ7$n(Ng26_q)T$soET(+jBUp<PgJyYo`D5GUszo>
zrVRkIb!u|-L?9CWrdvKtI-LzD{fn?@aQZQ>wRYcDuSj(&2IVJm@kRC?MWgOT_>!_C
z)<RF)b+`NOa<eKUcd3=iKke}g8_^MtBdC#Ge%53+x-}|wFryu<43`7_)!F~+$E$ut
zu$V@+FMPzrjV+WV`O(|%CVzQB!JMP`Jpa)Reu1QrPrc$USoc0GXGHegFgrNf*TgYz
zWDBv7&s4`8`0bW=mR27fM;L*gW`us@w}sP^JIRE;1-PD>zT@wgr{moTT!}rf-nN5Y
zOhUVo8VQxu!?#3m(>HKU(?ocH?s()Bbf*B9TCTmRg17$7y;@(AN$DMFO11K6!P%z6
zw5-%ix|9he6}-bEfy5Tu$9c<p2+Q)D-6r{}{a&A4_Jw8JrlREL5Q5t=#{QLH-lTAc
z)4ujZGdkn$<)f(1jYIsH@S15YT&C>TZc?q13&>)}CWzen5&#_t-w%QFl<tHjj)VcB
zEdmRG7@G*Tu~-$LLjT9AB8oVOSn6fYg;$lInMs(qH(W4LO!Coh&pn(4k2~5JrT@}W
z5KXspd+%gCcv=HDX0}49Vw}oW>PeAYe+}uh*M!LL`b|~=abpI*oXptwGlN6tDJZK@
za+R6HwOaDh=jNqbG6G*wo8m$&u5f;E+Q~S1j-792EVi%|lZ2660B2X(<e?lF2^Hm6
zbFdl($N0;tZ&O8l_S|(`4@m;Vb4_+<bICNQzK~EFAe%k_VOa|kglqAFKJA_O=E$q$
zGL9-4b*rr!9nmqFS23;vkvO1fN(p{&Au+!V1t45enFRdYw?2u4PB?j1`^L~jB<-u6
z-$S~>*&FPkaan`dUSA~FBC<=~Qx5dAIC`W;)9Ql&Y*eN|54sX50Jc|GN^077&+uNx
z3r7x;JnP%v`jV>O2aW^k{K-`uN5rhnWf2~obz~#f=Q}#2wtld<hDmq!>^cs)VWuP%
z7d`F6lF&$bn`s^NQx{|}TRK~)&6Q%(<$SN10BCxI0L}e6ui$qNE}v=@l)qKi$<fjR
zz1Hm0b1nzQ#&k$wo1$d?TR|(s_+c8AH29R4Mz?aV!8|NMcpCxhs)j7+5WX=8vhR-Z
z<4DrHZf*At=<UA%`&V?&cTQxl<8xP#)u#iZxAr^p>5nt8P{l9AGT~s~U44nweD0F4
zBVc{uF&PSolgg3YWEnYBl+kf`CdeKb^%u$Lt|Aoql--<jPb<D|McSG$E7EMBLd3OE
zlgVX_#T6#uge4}>b8+^UU0*6*J{``DmDgS-PNTgTiiXf*V9aIkWBR=O?9PPoMNPh>
zPqpvFtV+YWkg(uG)jt#0h{mjZP{}?}EnYLMnpTh5&rLS@No%u}5Rxr3X|3^qf2JoR
zdD~Y;6LMQ*HI&+UCHl903SaG^5anXg!O<eMM$lwERr;?9?wg$jhW9g9v1+VH3PWPr
zHpcfu^{KK|x_&J337R8P4Qo!;Nd{hzZ?1P&iIJ&O$c<lTjx?qk-w3utIwzLRbBqj%
zjMSdQRU=d<5<OzXvgEw=ZSwn+*GzwymWE<Cu9A>s5j&%^pB^^;)E)H&pg>Si1{V`w
z$iFWMJ87)q%@pwhdK2#716yaaMr13aJPd=tiE4h(zMICJraZ7am3XP4XSIQNIr0(>
zKc?}v1h>UtU>2nq4gln2DjXWks#%3PUtCwS#c_U9i_T=QA9HY;6gpSX&ay;0qcr{w
z8snMb@YM@%7{+6%7%98hzOl3<T0uuYe(SSJ9l>KiOqVG&>A&=p;5`1h_|>kUycYIo
zBxld39*?SyvYcya7OI-nR56ExE*kVbl0{M3*p2dHWku?|JmJBBV9?Ea8$0vfN4!4w
zWI4Xawf=lC?5EE`7%3#-Nyx-)ZW{B{%8I!r;R;!}H>jxg_Ug*DTdqDym?0M{0({Tu
z%hXI>LMA1D58b7w9Cp$XyAsMIatxDtlcN?ZLSLbnPuS;^Vk-DB+s!&VS&=HB+R|*{
zA};XrHzqzg?@=4~ccm+!a}G!P5Xe742+;cz1Yf(;$D;j55X5Kz*3BzY*ovCJC6)TO
z;P7hJNw~N3J&5YAhfz`Ve-xYD`d@*tfFbp0WqS4MZ{##yJgP?oy5#S=Rnm`)rCIg%
zw%{cP5K}p3Bk%XFbE^?7SZDP27CIBmk6&ljR@bs{bPYtVCxJZCvANYu84(EjLHe>@
zuPQu)f(jeLGnKs4+9}pm+wroH<yHVODH4^hIWRi;T1wQDL<#pjaCQY8F-@`$a^`=0
zdzaN(P#}4w{whMKlrtaj#hp{{BeV_K;`ctcvMQFXs_=;&dQ~`O!2+Wdy^?6q6DAe-
zhbf5m5@WFiCU33LQj(~})GOj9$tOe30KXMUH6w_zN5Woz3~z;@8;#Xw{%jz*g{HW*
znElBhn1uYXkGWP2W$~V5z^43vi@vKa7x%suE}!3tXo)$lU)v`WpU2Iu9_Z?iipGI+
zmCGARjn^I;vqg9%DC9Io64fE-r)%iv(bBZ1Lmc{#6({lu#6*1Wr}yKuE1UHvr|0t4
z+18K$(+l90mK~7e&M{7EbP&%)uU$YW-SW1dKBcB`XtU9BQzi5GJMGOKsP?RX79J3D
zk@&<8`M=~|S|Dv4u!prW2tmD*ey{2(d8zZSxF&*h+|}Ey_m^^VRE+^=P4fbDbyWAb
z+@~VQDa*>KY@&9mX=JQy(qtlLEG&QzgF&_CwvZoZK3@h0)b=?(1Hfe{b9wfzMCh09
z)SO&m*;@((%#l7tDaOP~({YW!kGJsyRr)A0t-0fsQ{a^5OO5TVc+CDrojj4mPowq)
zSTjc(j|UD)DA~>1Mn*&_I;H30tVYU25g8+0oKORIC`EUji43{tKQSml=-)j{F$K)n
zvtp{UyC2f4Pf<nd4WP8J$yq2((V?WtsY^8^3K5KS`%M~#4Is18z0x9LpyJHc7zN`d
ztvsJABqvf9xlNukEB>IBdXm4$6Sp8H;-NVXq&WlY%OM0!f-P7g=GU7CBvD)7`(*wI
zY!=Q*$It1@s<U<^RB!~^Ps?Rf`6S##%v`dyCt-=VAhf$%xknp%dV%Tuc5Sh}lc>)+
z#+PY0NeNqtGUxU;4i9{urzfGPhWa`?DI~IX+EpoH8jV{=Z#?c3o<3xt?|qRicfGWi
zoQk2mU_0kta!o~{3vZho(rO2tPA$;_6>#u}|D7+pxZ1ep4SaBecnIkCf9&km+(-bu
zY#Qpo|7ebW9G3!LV_M$-5*{tPqAqM$2$K<3>4`RgSr@#PD@K+#ko9uJgx}KsNsqar
znm7PdO-$$n2WnBobWOumr)Rr>qHKhwyHdRB?CHBYEvMAI7Wxk}c;sz34V|y{KIh2U
zFD51-f&jd3Zq@&`O`>Ug;)e#L=Djk%OkKu;o*IB>MXwf}iB0<|S3u)0LN&R|8d1Tt
z7zaCU>rFAFT>DqcrRkSAoHt(us<j-Si@oZRx8m$?$;M@!?b^*K3QEHT98Vv7B%U#y
zB`_0IPre`F+?*WV?Gvltg)MNM#B+;^S10C_KCI9s!o)gvpYtCG=;i-UtAU_lt9s{=
z`wTH%qk7&rh$9XwQxPI#xt)5GUMK|l8h1u{tuE&%adz4|_;&G5-h0xP6H;PKTr&W*
zd580rn+zR&sI7IwX)j0?*X1N<&M=Gk1;gh5h{fWrX*8p(<b_ej{Whx7<<|y`ch}^L
z5|?i$jL(k6A&o-A)|Zu$ae<)r+6&fq*TmB(=KivY!d7r~<W?+L4&?8b(c9(t_adzm
zT#9&PrNJ$z)jGd0sMptKt5sSHdQiooaJJ8?+tBcJEvDt;DitpR-d9#6<GZo=35s63
zhPAo)$E9p9)X&Tfl)db4yPMjjBTYogxkU(Rso3Hhm5JdBNrGerC@x`D3;{mE<XQc$
z*Zh3hm24xGUkq6C;$?_d9Dzyj#*4El%YP~n%F)^U$AmKIpUPK#1Z?WHn>u0>b>b~!
z>RF5UV`cCymLMW)zO`xs&A$+b6<>YV`RYxN4`iEoL#OdiG#M|)y8%oY-?KbuR=SN$
zA4=G$Sf;>09`VbeTBHEU6dqibOr3|>h=^sNTmkFla?5Ydk7+r#n9J~4Qc{>~>_4P7
ziySdsU3&OPiCP@>Hz#FuK6Xl*mkx5-q}9x{z?TReFD#xLxzB>1E+uIP&4{a+34Aiy
zZMw?2n12oi&vkBkD{Q=fs+g#hG$j{ZCM5?eWrOunR63v_mL$NRS>YwrB6Tzo#@;&a
zu4SHZB9{`9!o3C2ff^Gtx@HZi*BTy=6fc2AgS?@%FdyF~pGLmUKZ%1zK&e`u)(>I4
z2R`XBaF!u*k|W;$d?2GQrb$jk1spF$PAbw~Dl<gdV-}z{m7*{w<$*lvhS4R|fL+FT
zRT5&d@S5Dm++zv>2gIp=DcF)NHV=S2mJj?_^L(H2yR8A_uvT`7cG5i0H$M7cp)@Pl
zX#}Tcd`GrP_+3uYRi)U91YiqAvS+>+a1^ynpEFGGiMw%WtS$`!&?otioKg)|Uw*>*
z1f>7EBqn+NgFO?PHF4z5OcCN*^PmLIQy*vJucB!4J*?7+TwW(al{BV3^&|yK02;>M
zv|_*8A0G?G+J^x=yXq)MYMNh_Jei%6d;nydMk^K0Z+(<`I27^GhYBZSxBm-qDW1!=
zX*VBQJ#ZB#_GP*9U~@igi#@t}a(B$5Lr_Hj5o0}Bqb|NHxpp{`u-u=Mh1qCJ8U97e
zKAoxaBj<2J`mmgeDk9DyrSjq($3IQHHo@jic(XK@RNOY?!65|Q6#dkmRIM9u-IF^Q
zd{8ll->Kn2efv;^FB<Mq{!Oc{rQHUKFAiG3H6EYb_TZ%89Sx(=`t&>;&q4gn_I@zc
z!{g$n&3_#61nOptgw6#r;cwK`Y{F0ptAKwUBPT(RK2(X#EA3oy?mdkYisz`eU&bxO
zNGn>E5gHlUNQzN<G8j%vOkEZG+0UO`&EvbVT)9ImJnO$F<x>qeKq9sqF(gdcKm%P1
z)e;#1^4T`*K7+E86Q*hU?mY{;0oMG={?=RL6*^u@u64&c?Ddk00r@kf9FX9N%lS##
zO#^##d39&<p#m=$Rx3miPQ3y}os-GONpx=*Bb@)biv!skW+xBm6GHwdy!L8}Mq4p`
zJ|o8^tw7oD{JguZIM*6Do>kz3(8LbgqWfoOe|0gIROF|5Yu;c@J#S37;f@3Nl4kBL
z0l7`+P_RxIzifSR5J_9)n;3}LVzZ)V*ZUSFL&O{##2Ar!6`#xtl>SQ@i<F{?|D}u&
zWoJPnQW~){rg&Pv*gVk<8CC!kzdiW;KtSS{2Yk~r*(Kvh;|0+11Pb6EcU&DWul2RD
z2CTo#sK-*JP)|OKTJ*X5kkW_*TB9|w$Kn4ED@E9sVZ$iReNt21NW$y?P-Nr=T_XCN
zb;&AKoUCVC1sOk0uG;qsD3=}?9Hy<AyPjq=3R7l^;KB0=e~mZky`Sr2O&q9Sc9oX?
zt0iPce^9Tb!h}rPB!WaG^a})l%}xAX;W9aVC596db)H_?pmxe8@QKaLOmo@1?Yx>y
zV>k*fqF|#!OQ@3HLH!yf2(V)5Mp^fXsHLJ>qL~rb<(N&emp~0Nu4>4c1giV8(<eu~
zILdcb{@uzDRKSo>Q9sqrLSe8ZmNyv5-yoFO(H(IMgtdD-hw-F4hNaYxDzn0%fCBcE
z6czCx(XWv?l!&ZBg=z``3-`@5jis5CWV#Jb2s{c|U<_CppN00G-Ao)$#fpk*!a+^q
z)?5@2(O`_QX<xZY?PS;v9+{6<LPbPbPQS9$w%Vs(7SHg*PNl*Q;2S{4##|)f^*>Jl
zWst1vo@A>&?dg?$hl6YR&Kdg>a3#gHLidqb?k%(S{rgG8*8@Bj{e7JoXNIiBM!=Ni
zzkqH;|9?XdTAcU2g~kg313u{`IreK%Qxe$?2L#7nOAk^C$ln$QHh!GYyTjS&5``%w
z?)NeNL7AMMc&u$izJG%+!wQ@K_SZ!n#!0_|VD`4cYc1|mb^?l__KCverEhgB7G?ES
zj%jvmiK_&U<LIjZ6j(iu9HU@nzb0jBZkF8cFy?sL7rSD`_FhaBA|;U?p<I4gY@nVW
zTDQcW39j<~cZ9Kk4eTY8Gj?&imAoIjuAmu^e=b)`_sTUoXZm-Wd&gU5STs*1kxkiS
z?*Ju28kRyn>&*3lRW0!Z)?ZTkJ{()`^b*a5%SS@;?Zxa(jetq5>)PA>+-M{?i}u6+
zmuG6aCs<TCgxz&Lb@qE#vrWtj#H&>Rje!l};IuMu?zUp`(SkbZ$L5&lrSD5tp+QY3
zfwU@GNgN3~Dmuw8Nc*XN-k<RXGCn`EIM{~zo~Re>m7bkc+L75K5Iw{5Cp&eRjO5_P
z5=!)vs9N2}RqritqZs1+Wb!93Z}(3$B2Wdj&9Ujh%wpIYZhva+;Pm#gnRlkyVT*8&
z#V0q5KUJ9OYw%Y*&tkkZU#S*3pT3JzCw<ZUZwkyTan^{)Mgi1cAxbEs^VDt4gV1dy
zEVk}+>Pu8e8F2BDaRx?`&k`0x{Q78{&@vKD2+0euS_1=_nfOnll0msQci$KYnpx&}
z`r4Etjny61k7Qf31>N*d;qvm%tTg*Oi04bv@1$AtsU4*ExQ}<f|L<2fNRyF)R{mx7
zdNS_TCEBpnvOLjO(Kei`Vq4vJl4!RdP-cjJ@fnM%G*+Md#{~R>QJZTE*tW}XxnD9@
zgIE-ABj?uSsoTH@+>LJ7oxfkw7T+Q&d}BG<(pdtHv=9zjp2x$k7IWdQsX58uaQLgc
z(8KU-7$vi+VdDk)oCL`u%m17cK9ZM?i>;%xV^(R~t(aRQC4u<a=i|%%W_+qLbvO4t
zWqp!>^)@fXA>^BK^eO6Ptj9Mm-|L74a)hl18!Mom?=fk(Q!hEwjmpu7zru-1uzZ;w
z7<u#Z7RrpoiFX-l2JG%Ol*L0MY2{<NI6JVJWCRTGQjSGa`u^(Qf?L5%d}@3ad-rcE
z##|`+rI@;F@x~<<FNXaI0{|a}C!q0AxC1wc2@7t^vBd#wqv|-65j*l&h|UTX2Meyp
zd#RRr=w$ycFkIFZ92fiJE2mE1EuWfg)y`4Q!;uFzrj<6HNC@zQ_1YyG`Q%=#S}<x8
z?(;W|5Tc^WP{Zfm>`GaVn7Hc&@&5F@Vwlc?nWW)zlyBD(Mq@__D)0>HzDt1KbK0mW
z%3yc?-Q;ulb{ErLGom5d;-kT?c;>@dl;VN*FOfuBa1lQFMW8@P<c^^1>56Zlm%(RY
z0^IEC&a{<>L;tDU-Io+lc+$Zm&05|WzY_WTy@P6lw#cpu4yrXP#kej~$X)v{z?aZ7
zan*`CDiji++$X_&dd7VN%1;_4i+aNbyqV>gRDS6B4o9#w;N>v4t86Fi!b0(lqBM;R
zG18;f-sSg0%b-SXhBD*MnwdcH$K%)CBh7!lm1yrm`uff$|DCVvxYW{|4INxXv9IK#
z{&70a@#8sZ1pjQc#+32Gt0I0TU6zb)y_ZtoOdn=<a-pTG=qM@mS`~u0{SlWqrs=UI
zvZtsH`-g^0j&tE0M;W3+IBN*b!&zH(r-59Kp^1&YEUwY!VE1$R&I$@R<^x5fs-j{=
zs0D-F(sk=^Mm@goI@m*TL~rh;0yZT}l3ouL?k8ey_?JqXSpQVc>-2?DbuipH;EKJn
z6%)oEdXA2TlmOd2vUpBtG_Jrl@2ap{sXxC2woqORzY{Z2OBobvKt~Psxin7wL^Na`
z_+N;BsQ-=lU#%7SF-CnT#^;FOH5VBr*naD;RNkQWi0XVSGc2r{uGKgDtzKZQH6Z|_
zc0fbc%sc<cZi+CPxZsWIayfQtklQSklxxQXLG1XO;aQuAc_##jDz$(|>Qt~EA@axA
z8Cx`qeAxhj;)lC5T{Sd7!^i2FMsdo>qi2^oyb&+&n@!EK_9CcnNZpM5#IXQ1xylBV
zw%i%6lm!J?6k&VW4HQ_V*$FgVx30k`x-cYdjz6e0Gz!w34`V_U8o{b`M7Pm9`Pn)E
z#uVP1mW$YmMU`E>=*`Q5gFoQVvy3pIXCbi`qb$<6{OQR@=afp0QeZm1_oY{bGaq*#
z_x9;U@Vnu;g$*M>I+nzVy=}+1>tVmC&prwy5#@QVOjO3V%|MHQ{yI#sY%F|dD7%1N
zdo8nmDzTzdhUOGh<|@Ka#JN9P2f}AEHuKzQ^i})-%>2M1hz=)6-I#Dv^FdvPe{ojU
zJlO%4y(jel^{z`>qdjDYCuJE#jIB+#JxD%~t?Zvp>vB1h+&#`nXUM!zs6*iNe6e7k
zdZE!z=>+*8x9VJ?=ht+n_w~n(I;wXGZQT&N*y=|R`8ij=c5h;W3gdW|ZFx_Olbz7T
ze_gOjV&jgcbPbya(>;m>z~WVZ>q)P-Z1#W>VGJXf)Ac^n#kMhDfw$~R%of<dpFJ^y
z0$P!LQH%|c^!r3rHhTkg+>YzOdw%sXwlh&^mtTB!B&Sg1dE74ynK~5BnNWUSa1~>_
zSI&lNx<|*2n0GWe*(_8Ss&P<u(UMSSC9z4`b-)I*38e}Qy}K7s*{Cjjp)wt6(1g>F
z^+p4~0-bb_+FbU(K-XKk?)=SIpX+xN`pVRhO`ix|#*2mXvn=H>>oilJQ5)D$m>M^z
z60|uzp?a#}J}4mmN%b5alZwgbp(6n@wpw#nkU<n8rjNAFlL^Nz(`)<5Ace;ozfWUt
zy`oFqKqTWn;FN!WcV%B1b4pdmjA+EX{XZc-BMi;9fS{}=qWU5afVIa6ZF^bL1n_>B
zcwettq?fUPrfVpy)%lx&ZHSAeHizc@NS3E(TWAl1@;7w#TkXI|Djs7l&9VBiwz0Dv
z(s`C5rG$L@qmjjutu+x|iJXOB_pMu3Ej-{GZf#_D@g=2*5OhWDED0HZxa+3!(sd|-
z2!1Z=C%`vhQ%0>{neFo>Tf@LtUVCx-s?o7|k7{Xhg*TGmU4RGP7m#^?p+VajJ<PP=
zO$r1l0c)UhkBl{hrBvD<j4hB(vSV9Mz5*HOK9-ieX;>u9x!LaBka7xI1k57PEb&1k
zrphL3LBcla9k1in<b9A@PBk!@C^rniEFfGKXLTer{fvBRYJl)S$&f7YSGA@9Ko-pa
zt|Oz?C#0SjegBb{BYU{&V!#nqt>(YbDIY>k=oZQ5zoL;2tnJmP60P0Rw=lxVD~~(U
z8DUz?@w01-y@#)qo1BFTlvr^vhmK7Pg30Jq9%a8V>}Y|4*?gwo+8;Odea>>d#V@Xr
zyyQ{xybJG0#A8l<fQu5ifLMo7dgB*6g*?_IFxXI8PV8AT3n-xFf3c}FSf^V`MTei3
zc1;Cr)SG<kG(?!-ihK@Zbfn|BCaXCuL$s8zq#O@}!^D^jh0HeCud56sSQ!V4{j+KV
zO%!A~z~O{|iAh&TpQ4Zs%-i**(LNb>z<h9Wew;k(9NW+)WysSBQ(GvhfbduSqf*gY
zIfZz}4m9VlgPL-Sp755+eP(%AMQt)Zfw=?vc3!z9qo1jHE`|zadE7s2&BUdYdp(+s
zK$p#aYxcIg7$B+PT>8@v<xOf__ySW~xY%T#12*cm*5;Ma*1uM}dLMrlsC>^F@>1T7
zYA*17qB3=N?65%NJRz8wK2D%Z4`Zt@Aw7?@zEJchI5V245v_!KFK{rX)VBd$9LA|P
zYQbIga}Vm$5ElNg-R}?<2i%$>`8y`T2jWwlYLVI0KZ<X?;b+W!t1Ks=`Ni~#-7Zme
zqAzy=XaP6{ed6sDehBX+D?3P`C}mqsexljE#OeZ5Q*wamH^4fu2h>BOQ*tDuK>Uhk
z#KmH|CLBKvu~l$2W;zVJP<3OUSZs&LEBi-wUx{^=9ESkzRlZ9w;1mXMPDpjYNP_Js
zkg(W|_Hr<)(|2Fp=tR%fn(dH8@{MG)YR&Lq(Z0*2q4OJK<o333H3YeSNDQS``#hn<
z1tteww#IFK*7^f_Z${_uIg+Tty6?4gixHZf1+;5}R3Y=-4GS|x)E*F2E_ZUwH^g9i
zO_WDCHPn`lot@9+R9m)dIWG2vgd~XMOgjnH#EHUlqq>UJHCw^kQF1s@$C0)E9K^R;
z|9!&^tYqnK{p*+~|L}xN^C|*#rG5QdC-P}7*qGv5+T^5Qw@>KIM5s7-ACm)GbuKx|
zI>$t4QnO^#5nrbLwHr!DEPsbWxx9l0|F3I6_Lpmbq}LSM%UEL^i(3y=>og1byV6>=
z<%wGr4np=_xO3s;d6agP=(Y;KFnjmh>JGkyB{(qkY<*)tpoEr&yqekTsxJFLR)EVx
zl{jq@XKH-if3aAD0ldb+bYdZatiqVpjqHL^k3o*qVEP6Bjsc)N7*1tsn+*K+^R^V{
zyJ(TJvOlx{k?zMJ_&)@k+V}*59!l=mG>kg&(mp+sea`$t2NA@mFnvbwMUPhFeklR6
zvH-H!`lgpdsZMbLS%RV?TR*SXjp$>PQpnxmFbr=@));0w2s?*PcP4=B&{<JDARpX&
zk7jR#WhpP>zxj1KHx?;3eS_U?@#D~#RhA>y+<%}_1T;9nh?r96T^n-9sQQTGQD2!#
zE!@0mbxy$I;N_*bwl$J)z79yFL8X&`4T3A;+og?Wbu{*5tHhVgJT8~wRrB4bdmW{?
zcb|}9n6o_iubm1jseUq-rBzgW4ruupI|F3V6}TxvW%Y?Eb?MC07=C`uEn=NN=sSoO
z6Vd6QjyV*|txxvn<=-AG>ec#e2twD$uT~dOL{k@xx+JB}0lJR(fgSfPB}Y#AkNYgB
zE@Qcv6-g8X>sN=p)yci%$8c=*#2R(X5|S$qpi{U1a7?8Mb((w>)<N42Xfsk&aSRr_
zj20o`n3)%98Fvbnx;D3Tl~V}c;>Sj?`(vx{EvH4JY17G4WbXv-s{F&gSi^_d031_~
zC}oaXj*0_PZIJKLmt!0oAoh=W-i$cg(}8POiul753{}W<A5|M#t#JN_DIo%z_ro(d
z>e1Bs^7cXJWc18Zp%a1qz0dTV1WnaTZ1|sl40@bR&9Q@EkRcC91WVaiO8Ily16o%#
zvSCvMmEgg2hW2EcIMi~2q*I+;X6BvUssRlSWVxStRvYW1Y_4f-Eq>?J7I-p0st1K?
zZ{xzN(u=IE;K(X=N1}h#qai&QKwWlwo{6BcLnyC)vRMr1jJW(x6X}ef+CE3NF~l^F
z=V<*_numh>TdhlFi&;emiOBAVO6xa;K>S!bS(CwGw98^cV-$h~*<NS-8WT%(`#lxQ
zds@bmm|o!0{TUY0O<x9+g{AdHI=fU=Z(B8(a=t8`C~qzj7A{pZlrg_bw%I@kr&&D6
zDZ3|J$+($3BK;cIFUr(^?ukC%X1@7t!}Q{xN111wf~bV3k^`Ap+yAl+V29QcOv}R*
zd`~wBHhv!`iFhF|X$^;Jd2iFRI<(e0qGf0;7m|_Fa$!I6O3_?KZJXSa6xmDkR*~Zh
zNOH>MvR1r3I>9K`S^T4GqcTfVZ5SA-7$M%gW3+VY+_Xj=aUf(eyeT|OS)ZG`%6L>a
z#ZW7T;GQlp<j#DrT2n9FK<_b?@GA%X-{=|cshVTXu3KpZ>n*m;4@G(!JufV~DT(m!
zv+1f7HEh|!VZ~s)An)4bZT2m(BH=Rf)lnv2tXhL1@s2*md#tWfoG)PL%$~|wF~YhW
z6e&0+eAUiqCi$eut}JP9|I*cNQeEdAE9p$m5iYabB;FIMgFuT@i5#VPGn0GJ_?+B{
z5Anmq+_F#a={zq6a3d<UT6`qh(j);dW^&Ti3y=(q#-zCDKsj2j94rVJ4^L^h{VpDI
zBW?s=zI;3~u5suldP&eZ!DAY8V|d_F>@2-#va5=N7g(RuxRB*^*gUt-k$8=+uQt}j
z*1Gu>5_E=`7V#L@yObn|g?>FJM*T_l%HzoIg&4`Iw3&QpyLQy`>#gCSyodFM3fimN
z{v0Gv`5$@IIe0Y6tH?^fd@9@=7KOm6V0gj({W$N4zk)(GZDKY}P$>7hwxp<&_a`l@
zGA_b;WA#@FgX}g(a%aJL<S-@hC8I?@skS@suH0p<DP)YjfCKH!h?5$7<lw4|Gca>p
zF|{Pb7VFu9S^^cBR<DuG|0hhCp|zCgg;!CYEQHJdCrlVi7^9$EERuwq(lVT~)+V>Z
z|FaNa`mzvsbn8*8zT-}DOFgkHoWK(ojO#u{>dFsce=#oF`q6A(=8;jRRo_x^jQN@r
z8+R(=7;5$M1@y~Z1%V-WEVXg0RYGa0WE4{$hx<vX&1B%7ssn@ZzdR;vNgG@^DXP0Q
zS4Yp(GE8Q@!jJN*8wz7w2U_F*>UqgLuZ$sI@OIoK6{<EL{ozGnidXM*cxtVK>I-0t
zev&U^RFSDryR^UN(y1NPNF+i|n0&|-igzY9dtYqNWls-s_F7D=cnE;W6GoM2Z)U*A
zyosll7DlxyQdWfXBBsj94?L~xooq>C^mawKVpKlyfp{#kCkwdf{QY(+^SW7ec)35V
zJNF1)j$U^^Eb=EfN-jU&mz;D5M){M1ZW!6CxW!xZ<T{qgzQEg%AQLxPl;6el#BAGm
z_zZy+l>JrH;*E!vh)%O>t0U?Q@WO6AVNkIgSy9JaY!uw%=Rx{ky=+{xlMtr;X3kaA
z9*;4!%^K*IUt3w8v&uJe6miytaVdorE9UEHQrh}isPsv@K)~sRH^GBH8F*kw6?b78
zN-$AFf2`uD<oXD+-8KoGUTN6jvjdlqbazFprooC#W+#9{^BOGEa38tnW>%SxNRm1j
zLpr0X*GExgX!E9a{-p#s-FAH%h_%f1$&|h--`<)-KA0PaX-*g!$*OBrD8Em+vC27{
zcR2r;(vnf3N~|)*C`j5*D>q`RvHexrvK9j=xN198x2yVRZn5l!>MCuE1G6ZuQ3(rB
zxJaI!tnO2qjSaLjBL4Ifx3^$zww+7+y;N+Sc&>Y}xGDahqX4S>qG`dyqWPkE^dEi~
z^AoeC%L6^`+b_qop8?hRlcGO&y{AMMJ9W|w<aBt^5sW!Ul&lV=95dRMnPgttt1Y@$
zIkoP(Q_nhqM%jk!{-a~&C9K&uk=n9wmJ2OKGu{ddk87D8$R0;^`d<n_QfeH|G>OE&
zXe`D9IVO<y;zwk%#chH>wd-8wNV~o+kj4~!V{`fc<Lj$};_S9<8+Uhyph1GW1`^zZ
z25H>g8xQV;;10pv-QC^Y-CY{F{Cl5$Z`C<<&wS{Ie)y_;)%fOGYmPbQP-n{I{OLyv
zGnXh+)S6Kjn)Q2dy*Iyeo)FOOKGn;nVqEF>=Z7Ggb2_zGACY)`1i^_%|HOA;^Czge
z8&btrD#^s0|MUX9ZT=KETO^Agsq+tH+EFL%QKY}Sz&jS!RImFAmighXUF?*B$OGD<
z_j<*P6gC^Mzs0g{$ei|0nkLbse(7xgiK1p?Cxp2)(g>U7YivU2B?i)r|NJ?;W1h=Q
zI*~$p;tkMQ?A9lwyKEL2ss0>$pQwx&S8#lScS74rr_>x4|ByQ`>yo<(Jw3bd7T%DV
zTYH}8Bn1H|^CerAfal?6*WJi+FR9-KrFd5TVTr2G_YJys5*&ERq3=iYnP^^Dh(B|W
z0>h03M5%*0UwE~^)~FS`zOkn5$EElcPC}V3DTn}7Ud9C$06fBloMQhqkwwPMUu$9#
zNp0fm2ckR6?PBsx!I-508X2E?wG-)vs@f5btUq{oP!M{~Bcji&=cn@gas}7`vG2Gt
z9>58v{-QwcH^zG@`v5iT={HZ+BfjMNWZBQY7P<-J(u5T;HI&c!3Q`?IwKp7>)$Z%)
zJGZrd895aoqBdrAK3N!m?%b#w%8Ps!$^!98WVw7i5H$9pTSYfw>Y+9xBo<PWrNn8~
z@2I^*R|uEqTNgdupdh%BC)hO{?amN?;SlzqTqWQ&f|ol%T`LpGb<ce%rEn9&y|lD~
z&k@F!m_d2E5TR23GK?Jl955D8rPuAKJ#Vu9t>LPzoaykSd0e#)<i77!<<&M}OlriJ
z7e5V#RK9PkxkqR1M|)MUToIGYkVk7bc!|+5ymvVxGU&i$$0TIl&TTIb9#?x_EykXh
zlat%gxydDncJAw3*H9$>2afH7gzGoCh0hL5@eMUx5T&^zWfm%H3R3FDQX+4j1IN|{
z?xe?jQJw=t21TP98|>aDPgXrh?jL3A7MagQ`vcxn^<E=ue1XF?yipZ-e0L!&8+=DN
zoWp1zv<za*f+kH{Q9qoNoFs#!PC6?&1l1M&2(_&yU!P3TxMWc-mytEizxfM$NR=W;
z1Ti{@Ix;2;L|ude7hF_cx7y_|5$f3X>FDqEwQJ<cZPF7JzuU>n$eo>oWV?Hgo+gU6
z<^*o!m~JZLj*VoT_e~;aX2k!Yg#HQ6-yf8Wc;)Zir36%rF(9McNR`FS68DooC-Kw)
zgEbU{2=lIl_oU0)=y>It<uszQ`axy68^X$4YYktjI&Yo|txhpJuVq>W*Pnk_laDB5
zc%i0>@TAHjL2;`3v25=fA16a1^$&kDSo*)vFk6C<{$IW3d6e{jj9a~;<7BHH(O{Y)
zV>8Uo*arUvk~5m#wGY+!o<LUy{nf$?P$tm*_aFH9G!<mTcf=7&jgBYNd-81M#`02#
zohU_j>VTHn=<Su{w)vawwhhDRgZudxtPcS@@`!LJla%RgE%N6D!=)O042su9!P`bs
zhK;_!?1EaL&!|pFJlX793)i_3!j?(L`7mQh*PE-sp66{<x-J(X4;I4)3&ULU;e=e%
zxPU?i2L3aPT05v&tFrIqN#!c2mmtZ09J|qo>geoWKam!LHp9ruyu_&^jHaHtHjGRs
z+ZG(9I`7FYN}X=1^(Qr#x?W7{nZD$`6#Ba)FmDZ=a3)40`f%jn&}E*@&!vr6K{v$9
z@=_XBl4W^dr<TX~ch=0eRw10=1bwe6q6f`SF_<t&la$y*fg9mUFM6!D<18Ou0wd4a
zs^}UpTooTfnSbl7MJ(!k>Ech^+Qig;Ac<mND<m<|4X!%NQqx~!8+|1NEr)X7XN0LU
z_gkWEg&U4>th}g337-5GM1BVmqX~v`8k<TTMl@l+GF(ni6y7W0c_&TcS)p;oXRKzY
zPgX#MulF+J20ZkRQqU?PH#|E7O}--kgwl6W&<S4|tOFK#xAQfQGTL&`o<;cVB+!7q
zu0(}0XLrl#aPINl2!Jd;-JXgeJ>L{<qlB`5*-7I~UZbW=PhKZo#a)o=UL*~v_Ki0@
z%S?LUM76YWXbE>$7X65As<O>Vy5)BY>f%4fO#0){%jT`_?U{~!rmI5`>11!xB^H%u
zebc%}ToG}m*E=#CRK8BlJ%3gSqKI8Cxz!x9_Syps`W7KXxJY$FdY;X5+dJix9C?T5
zH_!X%>`cpw-Gxnje1!-TYBvX@Klg9^N+zjvAV|Q@a#oOSLa+E~KNnnRW))J1-Ria!
z`a^}2@ZB5xv+Cmuk_y#!N~qf!+5)pUXsyjVCdmcG=49vZJ(e!hQXm-E-wk(pE7y3e
zN^EE<b{K*0-^G6!HsM}b*ZoAX_(l*We~uR@f2uBVOp^<F^_8}P%eerEW@HnCZv`TH
zTCWh;k2JBqeJ~wFD}Vp4D6uLCx#Y2BhM)s7&WWuUVkcudnkWe4rW&t}aD+8>NsMqZ
zac=<%i1%+_kj3bP-g~i{e_B=?eIzSh-MTk9kwW;0(AWk)EbkaX<E@srvNK*}^tNwR
zsQ7s_Z^x@ZfL)xm;aw`NRqlb2pa1hd@I=iHd-_>T#=$fL++J_Zw4hZFnH6#?p^7Vg
zJ0k;11O_)^j=l`G?GXX=7TY0LwA4t0HgG?U{7UC+`ISI%VZNH-7nNzC<!>sLpds+&
zQ@HAT{T6wC?t-9P>IRnbbb=?BRKHxskI)ILxPc%yLC0MW3bA-;L+TmluQI)wBg8J)
zuDZBfr&|3OrOHnsj9?uSC5F*;wJ%@kn6nYf<S5g-nOw*);g$okGqV1!wx-Za_5g(4
z-9E}p1z~y=TT$8DJk<o$wlgnXTN&iOa3<B~p9c#o^1&_KN|aD9?r@Bpl^_3WT@c8a
zMQ7Pr|HCK9+`Qn7PG!<Ke_Dch33zh3G^?}5-)InFF57V!0ZA|1C|<?ZTcg;TBnSQv
zMo1skhEeZTe%$-<&VL!moDs?G2ml}kMf3#d9wr17iYWRnRXu`Q+dA%<cfgw&MffSu
z$DQ+YN$<QaOAwuy{+g}^DnuG2k~+~)_V_Cp#vWIzCmP1*UUXXg+8F`X7y99CQq)cu
zq@=&@t12N%Ayd^1-!M<hpaGAD=a%@|1&<A;TRE**&U0IytFE8jCH&O&O!fU`u)qG2
zTla)&44Rg<%X+4BA$>0k@_G`%evzc~(sf5_KG@EmxRUgl6$VxrI4S4}dykdWz3mGt
zvY{LD@2q&TWSI%KgCR%WeI1?HEjhM7JWotNdp7~_bp0A!vpa7w<uy!K?P0zg!V5>8
zs<hU@`y4<4P`Y;B`x_lzHf9zzVF0ZDS65|=&4B3gpf9ZrY6KKX90al8Y%zR59C4Q`
zQk5PWPgh{Hp$m^qTHu;IAcV}Hxx6b_VKaTTUnp7mB327HphJXW<N~D@ae`D2M<jhh
zB1VM+@Ut<rTi|huhJ+x-S!^LiV-{uQ#`*jO%n6~cWRhhHz}0>SyiF1O!k(;R#z7LY
zLC^`+$M*-kT=}47|A1TMsjlA~i>}I_RO#4W^f4h7C+Wda*#3<Qpu)e=6@NHuyv2!2
zy<~XY$#g`=LN$}z2vHXjwFvyo;FRPG4$3lw^ureEDMxX$X02cFnp#TY9?c%Zmqi%(
z!~Oe+!;}(YA$e0Oaot8d)(=$L=|>}=wtHswZ6B(lKO9eQDb>xL#0iUO;I?<|2Wu&c
zibw;cBlEfk8bi38T~rc5#I_{%8jaR{2sg4cRCb176wJhpAH@J6Yh|Zj#t7p+vF+k$
z`0+>tjNpT5m#QsWOL8fNFJ8<xNWRFDq7_fKgGk@QZbHC_Py35}JU;*lpL^^-fd3~E
z>?nx#Y)bB-k{h7ck>~|Sv+|pXXie6c)zV=}wnR`eimhmM2t^OZ%tB_=`<*~z)9(Mn
zr2RKS$Pw)1#0Umx>NnowQkm`~lPSXZQXXh{EwS#gA=mE=2*;@UN(W7{<l@ZgMi7R$
z+6KQvFuoB-nQ3z&BJpkR`%vZ(O2fm}e(jHb?2qy&$o>Jl?-e4Yz7xv8;tVkw7jp(j
zp*_H$l?u|sSs~Feyc*$NR0=A*PvXM8aPCEM{Cxx<cDqpZEco;njg)X+wg!RnY8?3x
ze7VI&PDn}k5=jkfD;&-xXJdXpi$EBGke+4yspM;S6j{*9%Jvv-WraO1EteCj*cDeC
zKro1$9?plPPoF$nkg-Gwh3BU7QUYK$mqy>Kexjao`e?z_ANg&9oRQm=P~Hr!6%6=$
zb9pr|cry?;lyrlC?oO=5&?U`kE95Q^_O2U9aFO!~GkP6Rk1;XVRI;fHu;9o5VfH{)
zIg$vCenk*d;i#68wL-O+r~UO;)-ZXjXC9GKH0GWfQBD{wk~l=YLVSy+^_fJP_pd>W
z#xH3bdgaz5b#&u?caz0Bgp2a;p->Q0jk^Y;AoPWIERXc|*?1-7dGeU8RBAe;eriM3
z1{9O={(Qt8@9$N>Kp;CyF|9lFjv^~y5p(MM*M8VVxkpu$dz;<^2|dd|pNP&@5!uXO
zPZO)aM$*GI#15Zel00}ze}<r~ct!1}Pf=W&Hns`evSW&Vb~E26UAA^)Yq&7&(z7GK
zt=q`QmXlX!#SEkv<AnX1VSRvnc@=uADgV-js1<b>9Oz29i{AbSDdAju7Ca<qud8^5
z7?tFRob=U<vI>}NwFI@!LZ=<zeouodFo6_A%+N|-pLM_%&O1Q#G1B0fZMKH{?X*cD
z4Ai4Nf62n{F)F!#x}uN2T-XW1$NV))gQTGHT@n5{qBjEC>Jfb@MbpMrRYCe+okXoT
z#M=@ootlVw{(PI_7J{YkSCFo3(1GaFjqX<$1yqleA6Ba%fteC2HUt2lpv4&pDqvi@
z{(zmy(e*4HB0Ur`qg`Xd`5{0cYSn3X*)ALF45`Y(@y3z?r{(hcpwLQLUPq9G0;cg*
zSh5V#H*e{2*L^kKFS*3x-RObl#R0yDCVPbRrIq-}>(Z0|ThZWD1a!{fDh5y3S~;!<
z{Z)^$RS{%@{*kw*C+GQjIC#PDXt9n2uubWk@9axf-hw<&*=UdI!VlOC_J7<?X^u}3
z9Ze4Jq+uquq?YS1H+Vt8--~__Dofvl$f9UGKqP*K03JX@3Uht6h6m6~>z##|zN2La
z+szTjvDTuRZ!M%c*7txQo_mwDx~evd2|}2<ye9O-U;r=4{uAdtcY^lsd@NZ4P|;q2
z4+Yy-vR1@?Z*xg?h3Ao6S8dQe<^7c+o>#=WD|`F-_EidmLspn1LF9frXB^x%Qj$Sr
zm3A23pY5Nx$0WkIUlDUgH75AxUxS<h@bCk}2A*C}LE`!q{0AA0Of@{PC)*E0cvVe^
z0Pn%xcblFvD0?tj<b1Wx{R#a&ud;gg5)u~QPQ#s^NJ$1ftlB9A`;c?|<1NF-dcjY>
zUWxkLBK0#<i>np3Jgj6|T*%dJ_I<_24!b~%1ocoEfDLnny`OO<l6i>`n#L!^KiP68
za(=Tj{#rGVVu)kV^>}jCOa8(_#%yDDDeaeKj8xuCi1EGgBzalNsx@dRebga}z{G4_
zT-@8Z+PDGKqgSO^_|ZVomD;KoWtiGwL1XDgQ<LP_s?W|`%<SK~nJ(;c9&51963f{-
zGM>TmhZmgB+!v$<Khj&B57xrbexo{<g7ocnc6+lm+i%oS{5L!w3CCn7G%*;;MT~J>
zIXn&{L@_0>u#dsjgs*Jm@N_$%4zm;8`T4ej1GvfZ2hHVKFTEBktP1EOewmNC_pncy
zxmB8fS?GwH7-Do)!Kpn&m6~D?Z}4U>iSn@DVIYW6eMMPkn*AC@vWW9&qV|V$BIWqp
zQT;j)l0D!kU7c?xI2xh&rz^kQ_4=eb5H5(&e`$q@zUwP?y;72Yt%zmrXQ9=7hVeU~
z9{-f9PR@))-44Q8*9^lXA75?w#WaPF5!k~}r4`(P^2Wu3Mjo3Zrmk`FW^ys%W=|Wm
z>g&<GIRK-fV{xua)b9#4(kXGo^fKN-kUS=9+kXc&(F^M;WLNJ46$Pmv@T)~UJKj`j
z-@5}=$)wN}2I@<f2eaWG_z?`n*iH!e^y0-(bL8HR3$s%7U94a|a%VxigSOXuNWQd8
zyh0zI!q;zI(6>hexEpGhY!3JeW_f5V-(PRz2V^;4hK_KLUBixEZNV6dAYQ8GYZ8Sv
zjW4Xrzy8J!R<k$53C@+&2r<9Mbt@%MtJ)@e*a>ZSyXbK97TcNe({8W|?cRhZ){U%{
zR^S<kE7x9>JXI&v>Jp3=gb)?<_&86DATcF#uEs54AGr0J2n{3YK06}qekIF-$-5>m
zh`Z?Xirx%@;hA*;1#LaRxILn@)?n8E(r}~2RQa)Llb;dy&sF*o<G3j0fATd%Bz|H!
z<|WXJK1RmlSS5({(Z(-IVB@Qo9HUXj<$AoKH-E>@CK>Pvh#G`w?Gw4YMTlK7=jvT_
z0DcUQmj*!oYJGu?9!uv@Mv!57f#+b>I?y8~&lkEFNgu4~Aw(u(eQXWijs}odpf`uZ
za9{EAa2~nLq9h5T6A5>9sLfBHo8iCNa@>1I3KG9@DH73%FkUu@y85bip?(YUBkO^3
zg#@5TumrZ%<{@cLyE#~O`)y%e?evOwxCU@(7|&FiFs13}PgU+Hw$*NX6p?i^(eWel
zKZGt23|c{VsNrJ-r2|_U(Ec)_aKFMeXh$)a=shFnR`kD2RQ9FQ-DCmn<CY?CS3!un
z&G=yTo#ea0g_v19v`7bqt&F2#K{FmT1R3%dNq>c!<dcVhkLJlo2dp5J-Ymrz#0cr`
zY_gP+V!5nlNPtyX70z%f-G&kj05?x5d7aTVDbr70vN!vp^27R799H|l&=&3V*Tgwr
z`!{u;FG1NbFr=1Ys@S)-a4MbWJTWjZObox^VWW0AD;UJaS#wJEt&Mj7L4i)Rp#Gg)
z)<22C6_jmU6QsqKx<x#(I4S|^lJU70LVJc}qEkgWz>exBE*<YWzI!}@7fJ~uIAb+!
zfM_6^jdie~{wS5$PpjD}4*iF(0SQX~i?4YTcREd!_3vVDxE3cay9q;_)GLH0gafE`
zmjEnzB-gCk+$-9x%QFZ?x5w3+WtD@dVmTEo22O>DQ*9(*&@o|PoW&~1=gGz$RBps)
zY9f6oZ7WhWB?h|K$gwdH!#E5%CBQwJQ-vETfvnOgF}#fVzeZ6Cq=F7M(Ww;r*~O|H
z5lF!(swmAjwvp@fv*wSWpZ@&JT?z*~`x3u(10xJ>&HNR^=wSigtRZmKHLDpT1f#d2
z=!m-ssdak1icdrtE3;<De-q~~mg;+VhE5dYqr6D$-{18|w0AA~AK2ieIjJNleL1G5
zuTt`VLX}n`04Yi|yKh8H#GLRWBsbS)`-SvGi~kC`d86(JZoXhN9x1oFke++|b)jrN
zcul#~_}BR!=?gwGad*zewl6AxfS#1txEN?_#09F$POEyeOW+Ix+IRRZD!jr32kZSr
z<VyIIycz3E8>CU=J*T~OCbZC`tM1%KM1!$}V*Tsg+9u;m%3OTX$>`$X<O)nm>1eO;
zMsYeiTZ>)y%%q=aH0S00a@5r#Qj#6_`7^CwMxTer@fo$5W`#H>I{JKT`KVn~b~!W`
zCOBSyg!D29-#`#tZX65hs`=TsQ>x#8g3LQ$$aPct%vPI~_;z|-jF-FyPTMwixu+>e
z>fLgR16Y4LIdM^6wNX?Uw&wk(sw5=tFR;HG>;kZk%UxVf5wf7F^E)^<uY?OGFXjHq
zDeRtW&o1w6#XK1%KG%j~X)fmHd!2?w#$K)b;h$|iCPA#vL9yOo=(um_#rh}cZ%x@f
zxBcs+`uAl7(?|2iE3DSGsWBa1;+C0TX16R?kaj8xw@Ou}mN^!s)yTw>@Ip%ab>AiN
zgVx8|OjR6F$Dx?Ho*s;?M-towxDfg*Sx$nnGHp~%w$DxN)z>;abj47Af0SB*-|MmL
z^qyR@n7%}ma5`;F!NYium~9Pww)W`S?oG%sVQS1rM>xo~BCF3|c$X<#u@tjvJR-fN
z>n&Bk92Dhg-Yl}OBPv5VFYB%#$Qo)acD#XmB_4zEo1#@#+{<nxtcQnIdNAS&!okZ2
zXlkgRwySWm#Th(3G(JF)6X%RdB%gR&DypIa?7yCWOV*emj)0ieL&;n6Zi~?*_Lqy{
zfPYoV<=REb@rJ3o80@3fJaoXwkNmX<?>)i3r_R*lT&`BAeba9b?c81BSarxnRXoNB
za6X4p(O<*hwxZhSyWw&;Iun(%_^#28+fmVXVR<#+GL;`Kj*IP4icvBfbx5A!i76Ac
z^{m-gZ@s3Xv{=nf)<QpJ!tzs7U`xtSr>Q<hssqz5inf&^NO7Xwa!CNnL$SmygHzTm
z9pb>P%Y>BePYg`ko#}$Q;P@#GfmE7(FIzazd}^9O^ImT`Jd6WUS7hT_)_-jutb|jb
zDTSYJB6qEDDjmX&xC;FD5_=A3dObN`R56nQ#QJ-335!VHv*BO{uX9zXgsNh|vJIPR
z)Db~ZU5W7445Q$Vn=WAq9TWo1l_3I$n#Sf%7w_d%0lo*nt`~A<*)K}OAI!e)fC_7~
zWYy49XC4QPFJxh49hT>z!NPCO%-(WhAQl=RycPv+spYN6P=>!(X8@7C70j*O;`HUc
z3k#gk8?@m?Z)?Hj9FRvbFt;6rrWN&65-W68pK2M3!C}%><ds?G!BC7;14em<h;c3O
zFEP19l^3w=(tN{kMsJl538SMc!?y%>dywtLW%U`+{o#9@Um+LZ_bQyBbWCPcSszU~
zDKji2i!-3um153j-jB>DV(MXY?R~p|b5RS~LQE7s!86JVh5QgiP#!waQd3oisS$ku
zw^=m8YK??T#@3vu|0L0P_*vEmyKTWx6?d3d^iy`Ofj&L{?>laXfz1Rs^cQ|qzNup1
zj3~0@gMkI&hqIY6+$LGzX1ZHWzn`DCTqiRIWq0L?7O~}azCls5{DA+JMsgUGaV50j
zqML|V@ev)?t(Jcn)FPT}+OHgjUo4M#`d{gjc!qo3=PwUvwE0Qjn_z&}VxPsF8cZ_0
zxHc-d*}@Ggzj)KiiL|hNbM2h%%35-3gRsTFW%$UZ9ZX$gXxqo|r?1Fx9FE?5GUZs8
z{a4CDAmV3ns44tcx!8%rpOds0Jbq~wt}oJq&Meh2RSh2bQdKa0q?Wz(cV84E)H4D%
ztX8kluT6FmA#)NKuC^xdy$JS&1DLt|19x8Z^Fh-A|4wNH<5vOPz33-Pu1u*zNE!3=
z8Kx-gy0p8*6^o<n;%wDfAAC~#G022FmQ&l5m_6pxwuY@kSV;oHcn3`4v7}%KB6+zW
z4H{r2xKFcx)kfq0UC|OIxLUJZJHqN);{I58pW<1sG^{RNZso=Y1c+{+na0Xapq^L)
zzeStZ-qg{<4A&o>;GP6J2QMBCG}iE+ail8)ka08_&%6X177uzxfWfJptNb_%Itbe$
z#~Vp^$wkreDfG<_S5r0uZV3Hl-DqQDvC*)bVMU6+POX#b;E9NA6P-!BX2^DciCfP{
zlQLBtCH1<@i@rp_?(`paL&lYmt%P7#ik?-qm85w9%e8cb)#b=5aPyfg(iPu);PR1p
z)r09vDq<etiBI<`H43Smmi<in;g5%z#u66P#al!Z8&>-|)bxHsEAsXi)V_S+4BcwP
z$-95*m%c-Uq(T5;wd=M7BA|ZW?N;>k9X4}!7Pp!~sH<N0qucW3{!<j&R2v`-<aWra
z%?g9}&?N^2=+yPys1bpHRWaRZe@b$u&Icj@N)f>>`mSOOcBSv|WY1e+7>BSt;U`RV
z=L_g(aFm1^v#TmU7*+3B<L-Ow7CIqC2D)Th+tE94>qI*02>B!4J%a{lck&6N*VOrS
z?c+l4(%z^^XY6KJR)x`_?bJSTBPHYHKi`R)*dvoliHUQF%lB*eu2dblwqB{8J^Ycq
zXNY>e)_J5Oa;4s?sgr}8sRKSmos3?J?{5sAM_vkQ=q&DfBP|DKyOT*Ldw3fMooFu&
zF0Kg9<u3XeMB{kye-L!79BAp8T|2IN3&gu-uuP_JzAetH?4;cCaP%=s(9oS-5uoXa
z{|m>6|AHgY0gS?y+&s&UGvxTypD_VLs;bfT$C@rxX111(hTe4>8s%@qCvx)kb8KJl
zl%P@jBYUy{bA5}I*hn4Lo(ajnKNJ=J#JHqJ?ByHy@dPMY&-wg18C-QOcUvWeGDlg<
z-~I>?ej)1)Q3>kI`>-BU6AE?PTRnUzorzCgq=j(PBW>@%`1<Yn#yptaugzn_H~zxF
z=(33rjA_$Nec(1`f>{7XnJ&ir{U1I9QZWy)^%o^xbX#~J_fB1M<B6(~igY|jbVx>$
zE3*OG=6Lk#qOT)r_dn^R3M@f9HxcSR@mXg|B!UEhcuN`@swVJM*TwCcD=b4S0cK6Y
zj9L{{!RoCWFcwpM<mQUcOy{bGX%?_lEBV$$vzFb*BO!jcWDWcm15ktM05hOPtQ)!l
zubbpYCEVn<0}0Jaf{_vG0sLO95`%6HM*;h2M0ER6V|SERx4{0m8k49HuY~iy_f>y7
zn!q&q%s~bD8f++y4p6}{7;A95k%+shnG(lcz2$h@+AduxtJo=zoTm60;b;_)v34K-
z&lQJ921zV5!S}D9`EN8~=qMA4G2+aB%eAIhG^uJO{K8$ur5!2@WRE5PS)u<ewylDw
zeTNfksHu$Nq$G)h5d+<wfF^eZod4+su#;)07cI@&T~%(GbC`b)iqoWlKnP`r{<jW`
z%jl_mX<QJb{29}fOA`L<wJ_z-=p<t%N;OTuR=uTo=R9vfxWn<1dLaLHMvT(in$l!U
zDv7TX*JO(tj$y$EwAlqR{%+cfR2X(Qtl%*kIni?I=YNEHv|@@TAFuFS4kR!>prJE=
zSCDz=Z6-rI8OfMukpCFdt!*;I4*e#^gg4r`UXXSKw?@d-O{)PLxnr(i&Kt-?E`D1!
z-*r$m7j5=5cOdB;czBcmk^Zy~THg9wGr}!zPMj{AjPl6HTe;;&g>vF^0C$4M&vTIH
zks#z@PSla_`VIO0!X(l*b*a2*j*Pl=0Y{<rW+nlO8WkMmv7D+yj`?6|DZD4VaYi@E
zdk{sb)&6+!_>CJ6r;jbXA_FqHj|mRgnCr*gy}zQB`hr{<>LEB8#QAjPw2mE>`2~@6
zizwkShJE9Sl5(SqcL9mr+vDlDU+D8;qLarg+m-c6F3h}Cg=Wx3cCF2dS)Hz&8uL%R
z^x4Oa-@2SI#7A$;C)Cazt!7bq?|B@R<KL*H37R_j+&^Wb9K_mcFgNFQIWmWZC>{Uy
zS*T~(*RK<!B_m_l+w{P-NX50_pC5)wq#7qKq_PiN_8>M-$Tg!1je?G(#GokXT)Dxu
zEYY<qPdOPK6q1X>L4O=9II|@jOq`fVzSB7OyErwDP^}3XqIitS1n<3It{g*qqatel
zj`<Tiv$-)b6&k5p9ssTFsj!0PbKb;Wa)HMEIL9RtPdf8w{i$dnBP}j1&3ncBg2S>k
zbFK$66guE{KI5WiM-U6^r^Mwf=?a3g_KjI)T3X`+U^*FzsWrzZ;f^ab*B37jX?c0+
z`TcU+G2}?ccO_f|<fJFVj<mFMc7Dv79h?V-gryQTg;_R)+stRDL{);%yu6?J6I|U-
zKM4zSdrcGRG}UGm0x{Wn?wcl>ZAYYshNPr)rk;jA*8{eryaa7D1wK^`xD#jZ|1H&A
zY%Z=~svK{NdR};KD{Favh8$^J{2}E~ph!QC)^?%&Vb(bpp5hS=U7EWhe8SL=@LqMB
zF7m1{k7bvrc`d6cb?LtX#(@_d&<fI(E?%h0p=PSRCvb}*c^y`&j)@<bd_ya#>N1V7
zO*`h{OJ*a&Uhrw<5O}H=mf;0xEU&%nWmW(cpHD_=bm`8#*GeVY-`MTGRd~G77cpgr
z`lME|1HF94bD{M-*q0H=o*x&41qDCl+TAQ<w%%^dmoXrY8iVvZIIjOTEHE}jy<c~?
zP1u&$@NcazDZH=FbO194xK`wfe$v%+g~*4FimNHUh*|O6UbRKPsDPgo&JLSBWB1}7
zbrtHeNuKYs34;H|J^!`3^k-iClh#gCusq2fr?%kr1|ETW@P6ozwKZZ$r(N|P7>$0v
zoDe*Z?Y5)(S_VHf_2Ye;<4-?|s=Kgw&iZt{)jo<XlV<VRSlN4(g^x83Ha=2Do-Np)
z@^`>}*4Y<j%A7i3T(;n31WIazg_6(ylFocG!2Vlu%&A!Mpx=y{q$Xo-TPCRF<dR21
zl3$P|(^&r_Wt`G>I$V10kH*NW@&eIrtbmMB85Ujnj)v!1x3|CLj;(_`;pS+)*;6Nb
z^;s1<k~p|<7w6*sm{pQRG4isQHq|7o+%O;#?FLT9J-XsjqasebFfw@_$apOOjGW_K
zu@`k~q5N*^siTU!D}26u$dBukk5};O>M>#^X}46tI)o@eH4SUd+17(M5fJz8Y&5>&
zo>+9%&=Gqo%yb4kaYFSi&dC(C?NWI=SmCuj-!2pHANS1qQEhz?aBynlNvl++eXD%{
z=Z?<ZZ#h|^XmT+ur!-RRJp6L=L0L0w@Lv9;Idai_v9_g_&`rFb40C4>_58qd=<AYm
zhqUN!YG&<mO^4f*%zy(<htfj->Z3H?$`(m<Ij1EMO^b^-X3<bEO0fdNvz_fl{eHx}
z-uNL-vQH_#rv!lhxB}sG6Dy2~59gq`@rGpjMwQE8E&M$)Y)XxhO`X*p?gP$@<%E26
zQ2FQweAaiSrPAJzeLr}n?>H-BFxbsI2yUaf$DQRe0_}TmHi&RFKAfoZk)j>iU#H5w
z0U|kHo=QV*oEsX-G)>iF->&-f$3ai|wh1IVat~%2%dZ=@F5`}Pzy<2gHe-4H4yt`J
z1}E>!yRJG>`Z62Mp2w~Q*raUTs!?%DK2EmqvJV4}lLd$NW3nmIQtI&YJ8`1Olj`4F
zH;%jt>1#74!`v_Y5yVM~53-ZXdodjAowR*5Bz%`BCjmsq8D}e!*Bzy?x<7VKa8oVs
zH*YU2wsoa{3LB+!03)j)Xzn*3?^HjMEQup^9Tz?-uVx7tB8Mp!SA(x_=$6W!rc?Zf
zZjF5FSdSx-=kA$>y7M-qOtecuayevh{YLW4!<oL^Jwws_knP>@M`C#|+9}Zbk#eq?
z#j3QipX({8X`K)_t2UK+DnF#T;cXGTFArgM$<SdVRpO|uCQP__5UTuYqmlBbhK+T}
zq8w;nj~O9Z8rhk3(2%?PLbx%62;lf+^%fPEcJVjXqT11@_W=BZO8^U7F*UtR-7EG_
zO}4XbDiLq_S;Q9)2lrOq3NS(o3-k`>p*mfS>lbQ^C3oHJ;j}o_XxPQ$x5pyq&%7PI
z^{R4@x!lcc*QWX%wPTx|i_Ii838?lX4$AdyiX|E!g8)m7#ZJNvCrjXQ#FIljTK-9j
z?br2pdn@KF5b_0rJOyg>qJK;@X$AA3Q=BY`NLV)9uhN}0BYp?8l*O*sQ>7=T8pyL*
z{Bd*m`y?yM_dddBUQUQJ`NyDl%{KiujBw9&{7BfT+ISk$GIO`4n>%+D1q$YE>y7h9
z<-J^8Hl#m)DV)6+!gr6^XD8K<!Bm@*@%Zc&guGlOC)|2-_}=bz12<ruN*gT{gW5AN
z3bKiK&v=(_HdYE+W5VctrGLZ7#*Sk1I4dc3*VN61vL1`~H%RVN_hPESWVe6I1g;Ub
zJ#Q&t9ptN}SQ7YR5)(msxPOfw3G~5ZB3eBO<Ra{HUthbqkQCr~9|o<I$Ucc1?}s@L
z_}J~{8S_upkJGM+;%tBkEWv=Y*~Hz~p*4>$-EPL8J4davv#InURT-A@FNg%aSvQPD
znDfAS(pH~B{P9ZXW)dn5JYJ3H|GWH^6`Uq9TfJ2&Dw!H8o!ZVpg$*E<(7cCRE^q5+
z3f3;X$Nwg}9r_)DL$@{b>`|7vlx2#ILMmG0Iq1me?FX~{Jljsv(W2MOt8!p(RCbyB
z^d+<b5;R0(`bGM|YP|I}z1~@_Q%eMm6FH*96ROt%t-J281vc<Z+`(*s=j(&d$$bhO
z;a8_iZBB#W`xDQ74rPZyp1K7VOiVFs-xbi?Pr)-HwV%!cqA222^%aYLkk<Ha>6^ui
ze)LBID}S_W9;emY%)VON!r1bvS>HeB5?y@yo`i!XYTLwQaXZ=hMJj>C2QtfPV9Q6_
zg{7`vzL-x>d^(3);#MZNwbtTkph=-sCC%eS1ToyX_nlhMPDkUy4e@f?KR(r)@Afin
zn^L?5kC9~CM<-(u0>GkgpP81jK{}es!p2=jIGI+|aUcxV*^(G}<P;7@u_kQ$YQeI&
z{&!y^gs#VgI^DL!{k8uUXw3D1Ufw0>9<K(YQ3rblKOp1xQsGv6*EZvaWlc9!%7cxz
zn|iK3D&dELP^W)_%}S41#Efgi3-HBB`11U{W%qgzVr#%5`fF8D7xp-!T4MTLP9JgE
z>Y|RVIUc*Mi{f)y`umtIzkRWR^2D}x9~)73h1Sd8Kzk@m9GFQ&hWD4-P2q#NWyw_s
zk(Dg9$qpSQRhh3i_ZJD4+}b$nw5Nk_o|Kul;_9MEgm)v=3$s7!Zp@6!v81x&QYLG-
znTR4JPpj6y7t#$!bS-#Jz$qw;(^lD{aj>hO^C~3^{GoyER_a`ME%kckZdeF0qcE&c
zhjS*k$4~^6CE32ofj8K6l{!k`NhC^s^iQH<Y`SFJC%zrImWuG_<gu0g&~1&)f%6md
zRo;;n*R~BQCp4Dok?!wknLbk{Tu4#;K!G{#h(_)Kj)yANwAnIPjXIk%TVA*Emul~H
zFKTack*$Z!1Vho-IEC0ODc;PWWaoG|BEsrYW_hjZGWB1*7+pPA+6$ujSip<awO7LA
z{kJW;mHdkr6=7wkgn1Jb#p~1zer35dNmt`aEE6AZ!P)GFAC~#;&#G;+OPF(s**FoN
zJ+w9W%sYdUCNVIP0uuNLun)!K&cKUGC;-CIEH}h}_i9G;A;p5c++y`(>ZmH%&I|lj
z_9`@70$uFt!vod?B#e(Gv7f&1(*){|`P*96{0N7UFF0}^%K|dl?kRX&Ev_-I-*<ej
zuwr_+0F4+LzTCH8e=RN|nfR0(S^liC@0-D`9eWBF(R{T%&s<=_BUgvqiMh^4EdA0*
zz%I(>QmWOqC(;*MY}0Oxzjji^MJR06dN~x_%%8Y%dAiJo=IJjUoyOYhzDm0m=;9lH
z$nlp*>1}s_ovRK*MntFb$WD#B7)ymn9ZJfKInPu$?ll)rEm^aJ@~W&;Su<NgbosfY
z$2QyI%f}hhR4Mli-r3FLwc_A*`*^uTEPv*h={bt5$sbD#8KKrOmguODi3lBtEeFz$
zMEW)b>-7M^!(*jH$ILqCAmU1x+>7>Bh?me+fnzPKLV!7(*fvU^Y(FB71(<fJ#?%^e
zP^+#MEkEid4EihjL%r<(C!uzyb;KE2^A9-Z_@vR02=Gmj?7_yi-8Kp9^|j#;2s-et
zz)R?vPpBs=i!!TtfAZ5kW+9DPL^Kc#ucNr<oA6RTfWx!Q%g&vNl-8(k-#hq;qiQ<G
zxKJIzU1tSTuPZ%~ozWXJ5Mwawl$ZopfySg6`+me7AB>o^U(o+^7;R1?q?q!3&3Q_7
zzBChc!g~p0R`_|HpU;~hj`cp%*qB(6aYvWuBK>oMKSPwzyP9!RruAuhRZc%lkg&RE
z@9)-YM6#ADwtR_~RxqSXYpbm{AynsZakV8vnyDA)5(Qv!<MEv_dtUK(5=KlSoT{-E
zlLCM5@dh^{Lc2|=pBx<SnSl!Rq?@DTH-kI%zsoSdyNZCQ`{@CpiejC=7}4r?EzjvU
zZ~WLR9ek~3+&|IaGv~AQQ#ht7$nSNcKQ{U-7l^9KgtKXM0;eTtnPu+2C8846u?qE1
zIt~%$1H*|I13C+|IyYYX9_Gzwt%of^F|QZ6x$4PSGIuT8O}!aKO?Y2QOH({WHOUDp
z8i7@#{l5}`RZdgcwjVV<x-vM4HIV5*^wPM!<Jnx$a^YmLNDd_(#15b{+>t}X8cY87
zM5O1mqfRK(p;||be~vPv=g9Q1G?x2)zHtslsNj6~KPLc!IO_!;GBX19(6=k`onYj+
z+*PBdCNk9Wg+wFDVp<aK$UL1S$Mc8Q6e#+m1X0ZBs?7FXW8$*s&tmzSqNn5P>h`d{
zSu3guEy1yrskamD2X7?tp*wSM*5d`jd+{&G3Bw#O1`t`pt0jrs?qW`JbTVOD_a`~1
z9qB(&YrJGM@}jbYq*u;47$;{Dqq6>z|8Ej^2#B7!E%hG>V=fh&Av9NFt1G_<*nA&Z
z>kU2FOVV`@yf6nB-)xiFlWGadkgep@gv<6;ChnI<$M4Gyq<YN1q4TTEYs`t6|3-Am
zu8MItUmq%L?`_{I(Ts4lr%KSY`s%M4!Oc!C@_O+KB%X#4K?p;DmA;X-7Rz|InYxSN
z7mJn1$2mI0B(iE9o2+;p)O`~P*0hwtqk#d?Ex+|SKCE7KXFdfLv=ZHEwRw&2J>2Ww
zU$-)W8Y)&xQH6w0!KrX#>v{v9zsU@0w{PVg_?$R9-lmwoH%yo}8~ZMst^fK{{?K~g
z^$K`wuQ*S3czv<nTP-wpd~gR}Hs9?<14-RaUkeg<kI%tDb+67Btv(>L;~&mKM{k&@
z4J#NVi18vNM5?FO2?zu4dKL9fHm}dMc^!P^K5JjnUZ0PFP02RqfUBHBzEQ!LDN#Q8
zoOwvEy_>p{?{KIZ;=mlIvyu7IEn@gXS?tT(K6e{)qy|P=3o4stLcGBmU5ETUZjhQm
z{+@J3o63jkJw(^63Y9RcH=z3TQ%-{1PtNqS$1rmnoevS%g5o=7{r*x4`@zx{)G>_f
z%=p^SGRpeUs8VA}6=|(1t%Duqfry@~0fcaxxjUNL|J2bhENq-Re1l}b|EXArQndg&
zk0r(-DD4)HO@sfu4bmb)3;VYs{c`sec_NPu&g+ihePUg8K;6Fd%+%#ULpxLil1ehn
zvPxN--Yt7oRHq0mk-nTKFJo&Psq9b4#7S2hSKkPYhH&-!w}^H$)xqhwrw<i{==gbt
zBPMwh_~p^xsG9wvRp?@Te3x-!&GX8tk?Lh*;V8UaKK=EZF)z$~JT(E>$3>_25l6Kn
zp>vY<<%zd>+jge>r6Y_D@zUMiWKqKze43nRGLgwCRKH1>B!5xy=v82O9?1T?dq%k;
zHD{xl1R(#K;0UG+l)?o}N`Q3@pqs^C(q@^up+)$ru0|ada88-5YbR)mXM)m|>;apP
zdvB+<HOVPY?kG`iM#zbGHq$Q)Wn2I<yaJoU_f~~AVRhDW4|e6jNq>+CJ)5Ig=IPbF
zC&k#qqo0ZtB;HT3dHLG&x=z8fC&}Gv{;!1rtw0JPZ=Z~`yZrBa6g(6^axw^&ZZgfk
z6QBlgg#)i|;)&ElO}^u4Dn1>7;{ot+_hO*06%ZA=M;m+AmO*0Krj`anE{>bE1v$8B
z<6uhvluvCm$QXbkmzB_9zRx`+^VKjqPJ<=3u+KD^-u8xTTWr_YcZH^T1VfgkE4cKw
z#>Ja@E8f{ZYz`!x|E{Et#<ZBwNxwU_wnwS5Z!)_dQ>^`Ec<fr~YrB*2T#<SPlhwkK
zw<Mi!bYI%{`k*o7On$#w(2=Ki4Xf~yVnSY&bG&=@=)d;z!9i20GcDdt$AqTjp}ZpM
zM8lWp%_-Nu+F{)IZL5k!oi12HDOkRTyyvvQaK~IuRj!2=ABfsF8mUU0-(-qzk8_YI
zuV8IB2la@t7NX>vOxtGSpq*X2<6P8@3g9hpj>RiBWxI-|pv%RX=L!LHxnHI?w-h?C
z1xhv8CnD4GH*oF-kZ^LdlbJd}BA|Y)L6m>OEh<DRn25X9UYtAlg^gU@Jmpe?uW%|E
zW71a_G)>=shJ*faK{>{b=W(6^m1l6jp40dDxVh*{p%#mx+hxImO)9JNaRgDu6NBCx
zgO+z=+0?>pn(F~++wo+LW#v{{dwS#u*yUuVXT#-o#Fg8qr<2mG-~T}Y(UuCPFJlGO
zW(K)3Y>ip=j6m=)XoCIh%PsOvJ+*&M&x<qP`=Y(8XA(N+#oES3GQNn)UFl1y>0}>c
zt1Z>g(@R@h{FftGz+ns1v*$rU&0s~txR5%n;MXO0`-!k-pO%hngB@mAc}b5Abk_=O
zw2A_ptruej#9~Yn<pw_MZvsc}f4rB^hH1U*D6|Uz8uyde&)n_v{>oJ$S=qVwOU3@9
zuxv&}lMfE#1H0WEI35XQg|S}}ee<NuKQjebEV!E#${GPYJ>xxW_&=WTjiuBh7ZJk`
z!ViKYT8-_oug)o`HJoE5)?6ROZvdSHf(LUokvtQ(*;z9Ol&Qi<;l{Hi7+3KJdasG1
z!rA7;D0SOU@%!HbXs54Z4;vaJG~+9&H(XV_OltIQkw^UyR2F_dR2J=;I-ebxs?-}P
zX!<q46^?o(BpJp_sa}19lwJm?_f3q(M?bZC<EJbWo}MrOlQ4%+zqSLa(MT1vYU$3p
zxanWZkFV!~DIzB{Vy<P#nz_!-^FSw24(#f>*Ijk6>0wVUO{3iSbHZ;%mQ(sA1nNOV
zZ0yQ#?)zDF+O=eS6kL(ny)EHYsmyXefsLGa?xYa0JvO8{J9C4BBj9yYsN#+>&3I9r
z%!=#AadWlJc=UbO4X_t#F6xL7FC%T)MKy$Pboo(9LxM*>HIB^1u<$0)%ku<O6e(Hl
zL$vOMEDqo*;&=tPx}$osOQhqcUV6b5A1CaxlH6;7w|inTA<h10LBo|vrE6H_?{#5q
zS)6Q!EaAaGmsb;@Qm{p1EfEKk|CSa9WMifxgXBUaLl1b7EYl4{-t_CbKh63}3JZno
zzDsHxL2IABEU3z+)Y!q|oag;)**q1_`&L;C#%hQPvQDsVoIRGF&}PBIg+9?O8bujX
zN^WA6#I6e^cLor{cfvS!wO5|zsh;b&O!VxcBqi%utTY0>(s08s$rc@gR=XV7fA*b{
z>mD%L5fe;j6p*Z_{U~9WgLzo^{O`95?MyPm1aF>@$s`_jn?&5RJ46Bh3N=WE78cP|
z>d$DPs)$=7+1Rt0`$rFR<9Gwibs>GB%FT8l>+Gq|L!T?RDr9Fu#|-7bscyBA$t*2H
zjRj7R&$GJu22l55f!7xK=yh?+0%zx12iNQAjHLfv*ZatypB_I!i0}2zI+ax8W<KaV
z+?(07TCjmcpkQe%gD7#2p1r}x^FmgCaOhpP#puyrtD*5Ss4LdgI4e5Y)evaZe*4{^
z&axRI`-YS3LZfEV^~661*E_}BH5Kw#QY*P?mVI(QUodXE-S+ITxfFdYfVjX^`3XVh
zsXb?~UihR!mvW50)tPopk)cE%9+{H(n42F9etojY&ZzgBlW$#aOt?KuDoPr&8zh|n
zPC(-;r;rUQUX4bGPQ-Pa^7MnUy)nZr<3lMaED3R-tWnuyjY^Asocehaiu$tdHvsaC
z^GpGEd?OhJ(|X7*<``}Y2!AW_TK|m$kE)uzG*vs?ClV<3vkd;uvf6SK<tgkMQ)N4-
zb-t-A);bJH6z2*F51>CZ;h(^<XG9Bx>=gEcJ6&?{kbS(mxPRCCwuS~Gqlxrc`Z<$=
z&E_aSr#_K;^$Oc6K<Tu36VE?dM}WZpyp*i)o&eC3P<2U~h+YVm52bs%RUs)FJ(pbl
z5z|;;(1W%|%YE;4Iuz2?k+Ev4np9y+i&~j!?`@qm-DuG`bsb^EqxU%mpi_t@?-kFt
z$pC<V$D8oSP5yXg;N1^8vV)joO&QtMSs8tX-jAFGZ8Zt%oSpXTr9lKSl}G7#5<fSd
zN2S|%Y|(9@0Dm90<@l!d6_YAX8xc7eE{6~A1{>PWk1Vv_-RFZ0QG=uPpV@Wr2vqE$
z^r%-H4^a7Lnu1wZMZ&L#S}&djb`9l<6pt#`4&sB+yP<&KY_RObuyGB0$B22BTA=6J
ziRNp>F6X=|5_Onb{<$?J*c2<(31x$}M(K_T9Ux73X6dNX1^f7zHs+GDYd`m?bD>P8
z6%z2<T;Z^Q^OZr^5L__aWIGghUt!7-LF6E4I$_}?8CJp&BK{OqQg-Y?qx%hR5ph*>
z()~{p1|<f-GPwoG9JaFAKyjttD@Jvt6U0CCn_t7m<vjcVDaLE)M0};pK%klul%k_;
zS&MG>j2L@ftbRWobmOlgxT41yZw{wmc>5cI;^mwe0nlo|e1huo=`GG7=!kBd@fQWh
zXsQ@BjBm<J=#z+IA^@ULXF2IXi2uELaQVkuUf7PNi}TJiijKhgZ}52{oCQ0g#M{LP
zaQUVaFNfBJ{lz=?XZ=CF{{ctK(hV<Z;o;)cC*<fuqfdnnO16TadSjiiB&RXzL7l4~
z?vXOhUp<2a8_d^G^ud_~f~I@+C2+a$I*kBQ)zEX#4Jup~hRqoSVv#dhNMvsmih#rH
z9STi+C_TgPPw+=WPekUS;S_00Nl=q;Ia}n6B&^9IV?1CCbGc@xTj$SR(E-5zhm4`<
zC`yln(C_m!IILM9w;wY#KZ=R%LM8*zf7M<xS+3k6_fug^Vr5ubBh|6Nk-t)tn!DEt
zlqk=mz@%8Noo4=VrrPj=|6IHa2`>|EYSV6t8!`oLq0}X%`I$~q5r%uWZrr?t5P^*a
zHaXV75+sq<L1Z^yZ1%bA;)y{%-1qiKkd~X17nl&AmIa_kq7n(YrKPi@QE)#TivV{Y
z=l_UT-Z4XB`+oK9Psp!kbSS-`oZ5V3D!PCjawUM?QxU32$ff0x+fYi1VDL9a4i_#6
zwZJE}T^V0=lG$rd)rgW5A~{nkG{=NGfY2*5#-o3ot$kB@4~pKLgu;)HulyyB&oV!T
z_M^BPDE0ZMrPzX2Or5YBm|}*N`|i^BO5ik`L6_6wJ!=j6lP`0$Uw|etnH4XM*Bm1^
z!{|gD{IEwO?4({DKcNA-K86e51y${HGTM}NtEtg0n>e1E&*^^t_)~gc)|T3OeMv%e
zb?<!{z6i=r;5IS!Oc5nw$V7Z<UZ@HGXQNVQR9PRM&AIh;a*JYdhUeEJtc-^espM9C
zcm6YuN7HGg_C~d+4D0)PSLKvzUR6QgK&iMl`mSE}M}<CrN=)!J$K*QwA-rICnJZR_
zfLhDDcbrP(63*Uhubc)65)g`W@wYw#*8xYYkbei#7g`2qQwCYU;+y(*dx>)4SXObG
z5%5fq+Y)g+`ml>}U+stFLoRs*k#*zzWpC83`MqA5Qo%*?_AgauBG{zJrdzf~jA(1A
z6D}P6!?ketg*8LLt#i$;#rL^;gS|@i^s9k!2jrg|P3JNcU+fNNGwgCnNBOnn?RTxg
zZzp`74_czUs@&yfCB<L$WaAVB^PVS@(6fps89(2zx?Coi_#)xoya1Cy2$r@{b3Hnr
z@eOIC5WXu-5A~Za@f>N+)gUf^isgL>{!cH!0{ayaTZ!<f2Y11e_B4vu>T9OZT8G)0
zU-Af=n~D_M?<APC_Mm(+6C0<Ti~c9bdVvppo`xnbvKQ~gv&Z+lHeTV*KM05-22EN7
zH+#<tlz!o4Unents-RvdrTM%@2IY5Yhxk@QjZJjr#h>2VZf7tPKsFAB<ipy+ipUDt
z+^_z5tzK36z3v%J%G6k2e?s8Pl-Ly<09{x8Yueza25iN8Z_JpqGSORnhEj|&-4wF#
z{`4&)wCs){je|DD82>@qPaQPx+YV<eo1Io;S06&KJq09v6uqPJSHzF)XAFg)%yGV$
z@$2yE+@^n);~(|8<C??@?UJFVDzs~k1_#1)utFaJzIdPXz`g3(n#X-6Z<!wiqpO4}
z2J+252*i7b#OPzYG$EWg{|08zw1_n`W{Dv9l9l@$hXb&vX4qkva*YC-rNiyRY1;&7
zr2kgX^1QF!f*iJ#Ur`x-$Q<^>FK?UT&Z3?w##iU$P8pZ%@}7}?|MK;n$j|WjeB!=E
zzu1@Z|FHFzQE_zL)@WnFJ-E9&1a}V>+})kVg1fuByA#~q-JPJp2@Z{Od0zR>ckex8
z^p6_VRW)|ivc1=udrgX$aez=o$~j5_*~}-AMnDIgpNf&;ca^z7rc!#1*{jQGP$k$%
zd#JMg$Do;d#(xYcf<*$1wDG)J<xc1FhmokBcaL&f_01B9zG5QJ?q+-dT>gCO_eCta
zuTH}IR^8!P`~MgX7X9b!PRBtH^Z7*{ljWD86HuCz0UC$9{hf?51|ee*Hi>|zcvE`}
zsP$!@H_EiMZgDZh*Sw0rpB5@Z@wGu?66kH_V9wV2ZQMjfLYj&jg041XCM<++8LDhF
z03c+-y&X=4#Ni$&9%*UF-8p>Kw{=mMs#?Sv<S1NEHQJUQ%^m=95D*h8PvoWM5wZ)R
zOt$Uk)&SOJrdwG{3+r*NJ6G>^6O1jKk7*S)hdR1?2u^J%+&(NUz)tRt->5#W^c<$*
zuQyT*O&V;y+_3pFJnwA#zTtM?%!~^}683x}KI-~-p)JjEX&(hP42z!zjgkoavD+N>
z`(mu$yg!+~;6VRq+doi8V)Qb-C(0G?xg9z2o4E7_mi#>2nD|!SDk1EnbKCuMB`4kK
zWyQD3XIC(D!CHh#_jQnr|L?|yR_z53BzH!#)<%lir6DpuYkmi3yI}WDFvkR*T~tD9
zfaR);V9z{1aAY^pbg|{-80zPAhu9|QQ5za}gvy+sj=ype(VTxpHE8&LiRABP(xJKB
z_*sZ$FM-T+{&8qwH#*kqnT<x-iZli;{+M{IAq=r$;gftm{UzCn>_V599#H2<VnR@D
z3{L4ZqR<N)i#te~C#|5(E|J?CqnfUeXLYQ)>V?l|kzY!1uuO2}9xkS~z;fiwO0@a6
z(H^sIPo?vI$M-eZNy8oR&PAN8?BeReZ2KcgL3!2(HeA{E*rQe*n!0W;JT84s;;aKI
zB^it`rtmZo;`#Z65@EJfHUC&Wa+OOn7-F4-v@DpC#fB<)!_uDkg4{i0q6KK8IJo*9
zgIOr_3pYFvg38~LlyI+2h=2=wGhnYdie+|m4pPbkM|5W<5r}VWZG?70IO^)gSX1yv
z!!gZNlW!u3E!s2g3^i=rWzkVS7cB894uv=<c2g)*Kf!h{WRvO-B}*vN$+z(R2@A(g
zIQelI;T$sxyHV?GugZEzakaGY3(+9M$f8a@m_D&odP)lRSH)@pNnIwDO9T42E9t%P
z{VDBC>kb|nOK%mbL&00o*^1B?8v@1G1y^lhj!s@25hwVMuI6>5)tJMcHoC`Timo1H
zx<`(5aReltS>#d6?EGNn?Q${~9=#PoKwM|ZBm!-@>-ke*#Sh4+tyu4QZrY_Rx9>#)
zA^GZ|dTW6M??2z`){WZRPJe@{*m94XALQOn|04CEW)o)jA9y)FUn&8J{lVzef_acK
zlxL)_I1su??@l#b?~-51)DE81hy)wXSMrc+&hE9vb~!gH87TJ`Eq2c3VC(m3g?uD#
zHh*bsc^6tu-%M}&RA_f8pK|khh2*~79u${~1AgH%zSc2cwSU}s?Emfem9O6s?gMQa
zI-gH%B~@AkR*^1sw#?1s>yiVwB`ac<eZEri>IVZ&E!D0NG!HW6#W$}VVlmnSdgjTk
z=5?2=6&t)}f+7jgnM+#gF3bG5mAkxb50g2~d~%Q4;MMk$J0UTg2dwArDU*`2uO7Od
z&x3yyxV`3nHY=gJNxsyyl(@k?^AD!gNT(a!kZ>xwnKS30%JlJ#>#>cvP!yyQfbM&1
z19ru?2=f)~m5`3mJWmnYjmiFY>N<WWSF;P9Bl4keesiUCg{k<n)RC04Iy@}@r;u}D
zQp5!~%Qh-0O=X{9d3s6ji0Qi~N`A|1>`(61XjNgt1~+t0_olsmAaA$0AhIlPR^vY-
zw9=}Gp<ui4cu^=dJ$%@a$v-6_OYVVtsSRa}u;L9#!mYH|C$XkJGCqY{9ng9)5SB!r
z?de;iQ*w%bA@h%)a{NDjYT&l&s<O75x2_S?tFBDoM|QUFzVCe537Y)Pq<~6~<J<WS
zG;Q9(VIy&e+imk(egDi?>-8ZuvhO_ugX<&}4!|L8ufw9~aWo~F^JY;;ctGXjy<0)S
z^j8UVQnT4wwRib4GD+icRNSGb<3a|llD*mX+}#%IomFfHYNMZmtG1PCxL+-`PB7nG
zvs^hv<VI@Z4|Mwa2iSnc*u}UBv-p+VMi+RiJmU*27&Did_E7UsOUIM9`~px``G8s7
zTacMq<Dsm?8!i*h24lT!VmjpT_){f6u3g2Q8tlCPvJJDUDIVc`hfYJ)(8lqsfEDuX
zom+deK5GrT;cK2Ug5V<~AWyZ*IX3AkQbog;G|oNJm=oh!cK78040}>~zOS}eL}s9X
z{Z<fZ1H-F!;!)-qOz7S+!&7Xjlzr)X&o%y1F!PcF+2Pl`?)<w8qWXcf_~cydSzFvb
z;D-jQ<zA_h-NIt<p-kvXd>>ou)@@(KYI&l|mRPqrl-{9?XRa{|+tabX*QH^TDtk(*
zDrnbz<DULN%2Qx4&-!uI{j))lrYdXouf_oDN^a8kTU@N497NpFk%s`(Llc_NM(`;Y
z*9_9)0|)Pp*{BqO{EAKSDF`m_FANs>CA~J3Xl$AL0H=UP-|C{90U~#r(FOV$ME7cC
z3)LiI(Oq?;3jbJ~2@r$@6mRkpd2IpI=lhP$YU<Q#dD|_Yift@ueAn)Tb9uei*xMY)
zCTgd-nx+zg?A251vUUOf-T>AeW^N>|EzBWLM!Fd>jxS7VV&2&n$IC&G3A%yKD+_l_
z?V$rzf3Gu{%3$=??Rl}<nmwNXKr$E_ORgjw)4mqHUsFh45csYuRhZjGc9Yx&nY`rN
zo&E6VyOV8j*1m-+n4r1gpC&NKJgD$wB7W!RzeKhiR)=)lKAy}c!%2*>Iz%_ekVt+_
zzdTmdtltDQ+JG2&%w(E&e%a4F-rbDP#V?{nL^4%t$(P&lZ--m$3>Z}vr)}IP#WO$k
zUM*Uzxq5ZbKWwK7n6R>~f^B5%y1(y_&s70351N8;VvfkLHs@SQumEO^HQe<JYK-N_
z=~t-&>u*cKcd`)&u`LY(Z;f{vYwn+<8EOIb%*QW55ad^5Ef9DeBM1BF+cPGFW9rT3
zvFytb@T&E!>YeH=Z?}-X6BLLvi~dVUb#b};F}b|pF-pxZ)+3+~X4UxY`odgZy&1Hc
zoL;$XcqEicjT^Po;kk1xD%J00kCAG!e>~+WxUJJxQ_`a{s80}*GY5a8ZU2N@@f0vH
zJ~;5hD&rZ7AEQokN)Fs>PWH;x)LGHQht3=3u$$G%NSQ`%O}MOApR~*nc29`bNVIT=
z!E)!=hVo0scw?Y^6QesP_{M3i0V%iJ;Z|1_jR?A`m{7^itb$gGTZwMgwstd;ykYmO
zU!Khq4*Y_6M4-3nw{o{&x8q#nc6t?h&$f*!f`I$N$Q&fluS#_C{L_9z7=hECFr}fv
zDNE0|^$Q{{yAC~Z(S*|5<dM7myRXH3ALp@IH<Q?7BZN}h^lK~fJzLHmMAVVxU`$5l
z$qP)P;JiXl@Pai*a7^lm75!{p{y-oI{E}SR@Eey{v}gsoAk(}%HVJWG>g^nl#}(G8
z0j~ObC9~X|&aW8%e9F{xTU=3gi_hC2I=rw8!&*>@2UjXxdYsy^cX<_$347^HWl0AY
zqt65q7S9tR82<V>W>5|JN-*}M6L}-M_E06OTeqJfA-p{*f*eb9ELT<-Y<lNrxAIjT
z*e#BaXX9JVUFziJf6_hmcAv!!lP%#Gz^oXPTvFxn1QNRIPSUMt%*UX1OTj<`{&blN
zrd3^wettJx9*0-Tc+RtDmzs}j*^wOjJAat2sLMk{fD#SeDlw(473XDEmFHk~7PHZp
z>u(~JJFTUF5{>CNn!iuADivLMr)g-*dBUQSEsnJpSuKgb^B<HO`>U>{{(1I4Z!0_?
zp4bIvuucg?PVkK><A3^}fBw%U|2k-e1mi0O{v%7QFP&Jew+$=Gw=VxYVm80;DZV#H
zthUX=wmQEL!|kQu?;lY}?2V`V9Wg&&&km=6kKFm4yrFiQpH3-%8|x1X2vZ+{fvG1U
z(PXAC<x9KottBk&Ckoeph#6{5iL({~0G|0L+}-(&p!eIyoW#~J4I^ozoa6A2TSzia
zqhh;b`fd=y=Pzb>VLs;lO{>)N4jn6QucutqYQul}-lh6Loc9a6oyDwkJ=uu&Q8hu-
zj3MY)Qh_4ax5-`B5>)rXH-CPrRcO54jg*MBxBYXs531D%Zuow%Tr8_jAE5^G&1@&J
zL$MvpvI2Q<_w{;l!p(;i4Ybo(6~z-h6k@uw2P~_9lORLr0INJCdqJt+m`N9A%rT*l
zn`V3bQJHkbo4B4Ggg|bEVtA4Oe-NdXUVFCh*hkKejV~2P6v4;EnS;Gva(McMieG8|
zp~}V9ua~=jcC5%M*O@Q6FZ3~3v^}f`9dj?J9N9_Seq%o|tDF~n1P++k8s~t*TRCpB
z))S#=X;mA}95XN1mX1RAyGw<>Mvb?IRTYl%6m!b;lSyL|!{B%Xg!d$vUzxSbN6_qA
zQ)|t@v@Q%uGJ`lZV%56ptQ1HG)GxUYxNakJPkzAem?4|0so`MM+n|EUsmAk$Ld$hF
z!R&aj$hH1uLtFo_ll>J%e^4xM9jG{2cBJ|^!<V%c@m90hnGZkw3+34F{hf=Lj%*8%
z?NN*3$L+-Yle)l5h=HpSp3X<eRSw<+l;a<JL~74(_XuT<bFx5yyy-{tn?%KUTdnh*
z>}Kc?87U()S$+Ta$gi5RU^{I)Q>l&6^E$UD8op)(&x-ZXPtx|j@U+ojiuwJ&SC|6b
zY(y8K^Ou^4ytTJ3#yT|GJioq>kWP(XQfJ-KBU|)ntvt`hPY=L27J27>Uq*5ez>(~?
zM`0w8t5CK$MWS?%&l4sm%`z!wNsbMTCWG|DT4BH(3diD{N=ha)0(5%4tJ88}p<uOP
zb+xwUKWQLl1UGNDGHrPDJ#NN#e)o*}jm0vBRr>d~PiIo(J;8r4+w<@~&5<T9dPIG9
za!BRZ-9`ApN}d(+#V6;9dI|yu)%CeKHocKIo!;88;qz}dVocr^BX8IOXoG2$s>S{G
z8AHqQn>a%^C%fDFJd}vkoZeqnUM)x|(;8kF@5a4y)`m5{%P3J#k-(MDeQ2rn)m;9e
z+rt%-SN+wkb`%lo12?C>pG@{Wii5oxO033MAFW@DH;R>_6LGa@iLj&NSkt>i@tJCg
zMv-ykCbjW-yUkrvb>0y~7Katk23?~4->|E3dV{0)@1z%}8C^3tvT9%N3myt^IoU0E
z%1=zr2ECuuqGxc~H`D`8ly+}6xI_^r6eQfTc$>lv&@0#!fr@`Q(H*7`VQPCJ^xM_C
z%aiBod>yKq4!TV-SpP~@{6=iVcw#abW4?RDmBh0hm<u*sBltBmz}Gpp;B9V@Mo7ds
zkXi~BU_w|cKb$o6SceVZi5{%zKv4-KpkjVVI3$~BSuWrMQ+N+pVgq{Or%*KoCh5Uk
ziL^ECn%DY!^{jbmn4|F0t<h1`l)6-dpWIh5GU5Z6#aeF)+k2S)@wzA?b_=oHK^JZ!
z^wxJ{xpr~PZ+4Eau##%9y@|iZbQS@O%n8_C!T>YV6FPjVdh3s*yLSEKxkMOzAw?G*
zp6jM0eI<RSG)e?~nO7cELIX9mPWA7v;c99f?Wd%QfiM#&kr_UvrI%x%><RH<w46RK
zo$t>TK00ep%Q#g;CmtBvE-*(&$bbitjJI?*Qr)Fi`CJZ1vMsd!Q#kAM!G@T|5(=xH
za*>btL8gFXHzAV)=#y*vqWK2iO_)~+__x}_fIu)hIyzfD8CM>C>M<!FiSIK!OO;3!
zE;sEY1Bl#D&69{J?*(KhNjzi@jNa)$7w=#iWQS#Y{EhdD+O-p@?NsMFj(PnV88d}`
z3`rjSF<8uuU-{i%m3S$ZVip#2;Q<q?)T-`IfsDK0a*e&G?llP6Sfg#*?_378c2F7F
z!s#=R{^&v7%B^_@fILh!pwK!<H504)t5-~d%fKL_kD@&sKupaijPRp<tih2`dRgSa
zD?3#0EA##S%k*J?AuKdAUFBpEjlR^=fy=%gfCgp$;KNxIyvTM&3Ihpnl~I=2iBdkp
zn{b<CMm~f1Bt>NpAJKV(0OxVgOyDlm5OBz~qQRK-NncNdBgX|z7hRgdT;oI!G?9`N
zjJu&zSry?e`aZ3cM6V*K!}<15VkLRf9Xbe}IijLVtw241=zf+G`*KrV??u_YxnnAV
z)zE0%rlN)jC_(KH(r!ywih1)?g=A01p*ftn>DD!MMf4Lb4Q`L$j|bJcQS14eapd&z
z=aMlAD^yq6lE(0HRtbM+pQz<9akSUWRv{}?(->+D%CO1k%E{T1IN{2+#=r;T><-$n
zZt|vnf2_J#vCbWO;cikfykpm4LGkV&9>l{Js@8bH72wkZrJ@D`Klq|fz^7x#I<B{V
zav4GabgAgOpwZh!>?QksvfxIN2+O{YRDSd^x}Ywv60A7)%`I_x#o&Tk(PCpoWwE0G
zO*=bwoh^hXO-Rc@E89b5&xoIPHI(`^Wh?l=%Eyiu7|=&AMQdx6Ah5-7j%Y|qYil4R
zM}ix}h!U@g5Y#J_apm;z_c%3DyJz47G1OjErFRglSNc^^24Nt-=LZY8vd8X`(T}`y
zav#mmo{s=yBX|znr{xBzji_xZ!&3w=H*ksyIr==T3q3z+eglJ1`Ce#!14&>t(SS0O
zVFu36PQM~6z%e_V^~GR(?A4&1RQ=2{%K$Q)x#9AU!7l(IaWEgv;Mh|I8x%(0r0w?#
z6+H;R@NWM>i<1bW+=u@h%DiosgL{<93T<6ylToqYi90+|90S4Dpp_th<rt)2hDZpB
zg)3JlV;oAnX0?mNsx2mwSs^#Cr78_NMFFzVnr68SwV-U`e)?}DlAtpWDBqL7$0Mln
z`elrV190BDP5ojewy58&Y2p2?*p?f3O2u^0V%NHlFuqA|gI2i7B=_FIKxBtu@Qn8+
z6As|-nnNb<sB;fJ`Z}6PEC5zNqUU!Qkc4Juk_VjY7h{-7jEdo8&t-Y#EvyE2Z0H+^
z;l`xJhy8$#U!BoPmKX?%I+NHwje;A`-<lKwSM55jUZ|1{mZyRU`Q%2<iTF}>-4Uz_
z+3~Lpjvh;>P4ar2f7(c>wlUlK3>cNvyW^9)CtG6@8wdM>5vf9aH8`LEHRxEVFcV*5
zW6{{-uc)O)EZRJ&LV@JY<ihDmsS{SNEStS9F(SedBT!lLud7&Yxla0o_*k5^MFpYk
zyrHDI(F4JA@NF3b^ViXn(_wY!*UhZufA!HvU+~?%YoZ&ILoLim9;bC;>t3nto9}hC
zc!i;2$?fx5yQkThtgz{Ix`P(7^EJ=P<pO35y0rxvdpqocee;WUx}!cverAkeBOI=t
zBNVLHW+|C7OJB>)iYw#QHfy2Ot;uJ3@H}(ywonw*bnL+(=tj6vpAiw!Jd0GG(D0Q4
z9z%J^`=h!N|J3seq7*Gdw(|UxH9c}3z5SB&&wjU8C4H_YhTNkNoJSN<x8K_>1x8@2
z@QTxUoSSn`1qjuVO=&#$z`JAo92ftDT_2kz=a26$7k;g5Lk7%Q&Ws}UrJI?l?N{KR
zwtT6ES1nOSP|A|DI8M_zZOOrJ5-4_eHo#-+_;*-sK~Xb6O%DNZ%?$`q0ml62D@PLH
z;p7lC-8VZ?GgzCi?_g3@wLHO5y;L#=Ji$%deS{Hh=vRvLcAl^_96N6gmg+?|g9>VV
zTtxiJzxJFab%IK<47MbHC~HOGgbTr5;`g<^*!Mr@D`5M4z>ZX+paniD|7wS}(~Cji
zH5fTfeiRp)HQ@W!9BfB6vcHc<V!C@<Ekr%c@r<WS<@E^Ho^v)IyIavRd(K5Ljir7U
zl;%Gv0bdzbr!kLsDHvT<QpsQ>RtrcX5{H`gWfyV$)rDg2H;R4iTKL7`kMWWOAk0c}
z*Hjy?vj9Wze5mmndnd4GDLZ6;n<$qrVAiWjGtdkDaI*h~3V5l^Wdu<@7y+97fPH=8
z*?gp-?{nKTn}u+5vDbZ)IMf7)Q0wW0)NM(vht4?t5Jp9dIFAU?Di`Xw@(!8h_rzX^
zC%onM4sX2WC~w3C$Y;;X>F8{a8%XD4lC2DZ^{}S+27MFY8_hw68T<pq%zEsu+sioe
zpr782{$s2H?=3q`HughEo69-5zQ3nP1OREk-lM~L|AmoHqk>QSp`k8IuxJk#pk&u<
z*Dun2N!<Rk2fnuJO#%(Vm?{C6zkrM%)2Rfm{RpFO6x=U|o8mJce6|#O9<83n1Ouy2
z9pu?C*@7QF=BQn*g{}Us8F2#%*Go70#9{a?rAw2x1}sdaVj;FO>GF?4!vp~0gd=eu
zu9%=!2E!FF%3Yn=`Qx`2hABB4*^~LfeZ{_IcBj|D5gn7hd$x+(Zh^@2^l;O>vL#I9
zzKEBF9R=VKVZXCi35gk5@XuanSiI;I4reSkxes{-o>lV#Ewlw(H6#&F))h?-VTP2<
z$!<&fMV2>oW5RdB1$t--0nd9<K8+hK8qh1z<E1R;;)&C6tjkPF<{eq+jSITUqBIVC
zGRP&zO_AUP$Y4%g+M!p@WcOXCg)mwTi1h>RVoWLruU=1l3-hb{K_9#khQ~n;fxCPI
zn*iO&S2bYTVUF;iYL+h#e^az7@{Xi4nFN?w0WD7pQ^g;8@i7rgC_1iwKpepCI65e4
z{xSAUAN!c^a4GmI=;8(Osg-HFV$fVNqw#~v?$yT7Aw`2-38rb`&H8No>`JUVqAemy
zzGAZGp8V9q@Tz$9X%={%*RCQq$JYASNkwYTmd?5|jBEl?FUL&p+xz&@)(uZNb>Z@7
zlx4+sOpLc4RDm}7UU&9mq6uRHw)2f31M73cXCsOag~kmlS_PPa)3@$+SP;?xM91kn
z`8~0ZV00bZ94}(#yTr9Y=Q05axZ_vz(R_8}Je2b32>x$2t5E|>y=pcB;T(|;+bDdU
zSStPD#sCyl$SmzXmYtBcS*)Fu1F0s6-VnYjZJn7{C3;_it)nb!2DL1<pI{62!;t7|
zzR`Og5Qnc0AK+PAenhumA0-Ve{qVn3gtj4SH^Dv@TJ5+is0-e-o`!R>j2&eAcjQlL
zxp;JblJ(PG%|?c`0D7D8y>3zLaQ#9-{@{mS`JNyIvO`N*9Sqn*Rt!$C?)4kT1Z9|A
zQHMQ@e^<JJAhn!<B6VSL`C_XBMJP4O0D3$N_qPj+GvRW#{2v>%z6H%1<LAU%-8&GE
zzlgCzfO?ta#$3XhiA{~S1gzxFxZCF7N0-Qe0s;VAn%2Aatw6b3Hws_Y)l0e-`cfie
zAZ-0$K?Efp1!;icZ+g`*6a;|Ktp&yY>t64WsG++Vxh^A^OyazfNl%isrB2gKg%f^q
zI6`Xw2o^O2)+E$R|IN>V$_g_)(aq25cvRB2qS0ej=tUmQCr8GqmU1utisV-EH?w`#
zuOFht0y@t4V;eJRLOij=qsfl&d=E)Ezm<w255Qq=keFeGaQKx+K^G%W$EVFK9mu?N
zGDg$z&bDdLqql9R#0|RBh?=yI_9biAi|2dr=0?PNU@r9Lqz%adtWDMO-Z7QWS%b_7
zK43z{aM{jw`8VCuqD;7-&@8j^Nmx%NIGR@0!sZ4jalN)F#Oc6RVtdJ)1^N+l4whiy
z0%CB$59nV1Mm6W|(XyLaB`cask4Ti0p@eNTc!uhfF&z|zPn?Mbp2|B3VdMg0s~!x*
zgu5jD4{z8=Nw$PJX%3uv|G}+V_(&6)T3)4@Ht_j!$OHaBDgntR+jc|K2rpMQtFp;6
zt)e!J{aTr=j%eGDS5d5hc>mEioUwbYpOl25n8u?HZhuAgn?eEuu!H~|1UtQz^{hdj
z5T<1+eHoj-xmr;ICHfn&Fex&ipGZM7hn^;<ke_YtIXEL=(mZ%`@B?&ncP6qzK6|J}
z*CB0w@SZzpr2>;k)&gp9$}BPmgb0$$0R3G{(#&7?MI6k?lqk}o06Sd42qCKivzMaP
zDhr&uQ!-b_Q`m?$Ug#ZkOZ?V@cink3kE}S;l(efhJ6?V0KhWpEmJ=klX8Wd_c}$wJ
zQWWtZw*h-UVNoN}yU<r?K5L_8(#8dFw^z9|QSAXLf0L02OqNK!zT84ErtUH}XrZ1$
z`wOX<dwQ8O_7j=*{2IQ*48uYN3^@P3JCQruEA^tJnH$IpEc{{U$`D(5p_v?K1@PMk
z^TQ4YXiR98Y$ZO8&q(>J*Ly5oH_GdE4-P$jgTAyC{x23FrB<>S4Xb$DM#qzuq3n=!
z7*&+dNerk+LjBgiuTTcCGIjm(!Q9`M{g)4HfO}g07T(&J`?C#)N9?{xU=bX$j7+_`
zubWguzlY{0rwRJr!^&eTx6Y&yi7U%E=)3f`%uvPl1gv+k^v|W4ipJeYZ;pTTF7jEn
z8qj-N;jA<)a^RgUskaz;4AAyp$YDaGDa%#dSPLMn-8}qqP0TpD5r4!!akbWzHordi
zWK=jVDg(B|t9eWmy4Pg%T)zBg3F<m1$EmQIxIW-5X&9I_I)0-&`%S@&{AgpzWE3Cv
zFPui2g}uK44(z!5ml-eljRUh!-Qu-s&0cA;dvzJ}Y$^Yn>wBel_2niKFF6;V`j_w#
zJcNJgMi@3VL|BD-@ua^O-CZ|x!r_VtN9h_Q6LHU?^qA}ke%AW@d{E}~ISl?I+{|B_
zR+=pMUIO&^cd~hGSqTRT2f$okQK$)YbqEH`12kPf83+Ktg3(7>{@&<FtEax}Bpl$c
zZn&>1x3t=$m@GG#)8%mIFF$y_fVem=IDvywCaOwOHBEymOZkJ1{EL|}k`Pf;2t>K_
zADc7HV1ue)&ZEi6imIzv%DF)4-Ikc~wf3^UK{SAM2;B6k)R7GAwA6L(O182pi30@V
z&l*Q?mJA_=A0H%T+fvgoDG944ROAi+MksMF-hou3yJH=`=|kg_I+KVIJ8l;?^VPJQ
zTdRjMc3svc=aGD6&<ifL>b3(aA*xQ_{X2ZCPPHKJl;2geI}t^8W+5XN9A0<Ug;3&K
zM!%gdRh6Oi@pJn^FaYnBogl)`p^n>jYfte$cnYw_sIS7l1vd!t<v-DHq@$my?K%Cg
z7^_nx`xMq8h{{vU{mJ2~0{H3+&7U$j!B*KxO+VcAkK(bK*kDm!4?Ma7N(QoMVEnuM
ztBmv`h*Sb<TbN~VdTk?!3U5VDyhelz=a#bZ8rO_g6BcjBUZ_gN7Bs9pW8ycWhiE5d
zZf=r^T5U)FEQXJh@Tv`e+ieJ7eRc<kNmQ~>rC<5L>~;$_QS5S1iK|7gE!g=-r@rBS
ze2dm1z0<8&=sJ;-wl|t^L`%9xIQ5dBsM9Wn{N2RrE<k5hweb|9oUt^d&*`EhAz^Ft
zazvDXf!WIh$#<H{z!Q|d!(3Q$jUbM{>i_DDC4+%>QvvXWyrx#pD);+=j-NugzwDS!
z#xRRNTaG#v9j$$hj~~#g=>|kdSl%CFD6?bFqQMP>gt@J=^eLn=-)Wg}*!Uo6!=*Vm
z-o|*xw*sMH^N@g#PK%wX?SAgXhIX8?qOka4qkVPSM@hj@UcXz(q6?Yw+wauG<i2;{
z=g!sHC`NK_v8zf%7<@36Wq&cH2t4W!SHExoUB38%7f3Pd<5Ecz5s>!9$z1ykoztxL
z3lSs%bY0ysJ~e~H5ld%k%!Oc|jbYUa`_{&w<8+zE_w4(dQ#4y+K}Ip5A;qQKA19{*
zuQWCu@+1r;!KPla_Ir=<YFygk+?n<q6LR9E0-s<YcABYhcqi7H3UjbA1V6VY@F%OK
z7|ex!M*%YgqR!$6JjIoxGfXOsvV^5d*J_t`!q+QpF42<454QEVyV3E~igbItUZ<1P
z54oxR$JLWgTWqTbDe=Q)Vi}V*-@2`jy=Mg~USFWCIxg05@N?cNC(G`6ysQV~g`I!{
z_S|2S9G!(chlfyTcFqR7#Mn%)l7G-kMwY>Lr_nklkP)nlQ<YiSTQi&1E;H@?^U|9C
z%pwWh=g`#jqDN7)K$zv<zcF#mDE&HMy(1+Nrsm(btN+Zf{7WO#tn}J=^k?3R*mw*6
zrIDzb(?1I`-!&yYHfzro5>0!KxKi@${yL-npfIM9cTpl{X}NmmxZ7EOzD?6+O3~F&
zSS97;Yq8_B-Ins$o`O!6?s%uue1=E2-w%~9;pOaT?piGO$~Lw8oDi~#3dkXM(=YSU
z-g$^g>H~|+DwFe^X7auVOdGY(!g?5)PCr$ZeO8<CrY+P^eSgPD%9}0@H~YTtQV+j7
zPT~dXWyWbB0(M1N#Dt9as{FbYq0INyFM^5|O?JNDfh0rbRlP|dm^Fmf<0(s*Rx5h_
zr1W=W(KA3PhVL2(>pDL@WYE18d7ve+{He?fypU7uEV?@eQ~Y1_ELYq6-S_8ScAC(c
z?8KWP3?5&wYufOY2hQx!iC9tJdsC9swgMMyiJg(~8CB@|_=`0hU@N*Mtz>wlqgwBM
z?wE%7FL&;Qs@mXZ6b2Haf6)nOM++)3*E7|e1%L3Q7xo@}4{th<<(1Kv<lUZ*^~o|h
zH)l_CCYs@BT*h-Uq-;k<4Pi*Qxgmx`*R4-W0!V0zQ<Ck6w<^;&2=fTh9bLVnF(^98
z#EeekoAH-k4cJSlfjj-cX5t>H&1@wB!L~_H?#i^w?LD$)R6URKbhBZh`rSkyc|GnM
zSn4l~c02)R60^Lk>hT9*m;_VqAvhw(Z~5P%zrKAXdPx&_^izq0f(~R%a~K)=GuR%t
z@2rC{1CHWkiSbx=7JNz&1%)Oc%?H$>F?RZOXK$Ix+oq@hugRO<_C){!FL`una)n=h
zTvV@iy<r(j_E1#B4@JNc!nPGfQLo$TaD&pnU-@LgD<fwZ8F$1pF#B=gz#~x|f2B<k
zypL8>7%maJig&1pq`h1Hgz_P;G={AM(8D!NrMh`vDS~EsI+fm=0Giut$Pb>)vJq(I
zJu=T5T7ugjZyL{e18Y@a%h39HN1E@!DGJz4z_rm2neo4Mf#}!tA#GCee@qCYfh1+H
zec^Tf-D0QUthDt{T&L1olu-6Hk8gOKAS6u>#epZ^EzG?0$}jrSl&M8|14M>t?@1p5
z%N1tqc~9C8VI!imhyUK$&g?;9FKH{;kdd~R?t2)}R<;F@T7+a|5&o^1jTJ-7k+LUC
zB}ewyYO#vUHXnJW)3PHv1hlHL4AyWJ=F8{%$4Y+M<Py83%(7(_cTy*>`a#Uk8E(#U
zi%cp?wnvC0)O%&SV|=bWQ%N8UFzz1lNI!y5KzRn<ijxfYlWb+T+@EIhf~GQWK0_Ac
z`4sYEjTpNhuUxUd_~4Gl7l!SQT?j^OK)lihw?xxeR3P{ErTZ0EImO^0@zD(VoFt7C
zwx6aGZ=2_{E1)-ZE80p_->|;cdYMtb6Y^fHSeiGBHEmS!qlJFr6!9{?37Gn3K!GnY
zRDW6+a;*P)-65T98#G<c2=WH70#`SLz5aW#lY`L+*_THuXi-MnN7Do8!J|N}xVTN~
z`o{r;I1&7b3NnFfb$t9_-c(Wx_^S9;J4m=@qY2G{BNhu75w{>`D8JUeG@bB06MP!=
zIS*Hy-C+0Bf<s8ODl3XsGepX*ScUiK?FZs6{4CUXAB_)!dT~F4ULE?FUaFbBGQ`!`
z6~>|46@z!fD*oy_`k`(8z44>ED_Df}Slx7HwnwNyh2DxFo_iG6&N&BFJ(tc_-9Im%
zlkF)8{3_?vMqk~9$UAJf9yDb{uStz=A|blf@+zK=rXuEVglpRAFnK{{MOUJ)nyO9h
zE2e@G*QDE??1BbdfLSZEF{5NTE6+(YQkDj8BxWk9mzD3dEmaU#1bsMtO0g|*PfPfy
zAMVkS9T~A%!{SbUFi!PJqAF9V|1V$&fH>t>C%wq&L-ts7<s&^ni<saw10j3pJ_A{8
ziMfWa0y$zs?Z(>-sA~?y_rq07mZhVwI67necbIvobV=?ga|e{p<Uvs|j;gzN+d?20
zBactNet+ScydEjSUqQ~e&SgZfMbj8$m`INXLrSTeH%y-fwMU(CBLga&ENb>*U`4>8
zQB~&lhO^A8&Z$M|VUZ=TrHg^8jpId37qgoxqDZx5f#wcf*3~a2WM{6^=H+4B&p>`G
zM|=RB45i$w$~ePFa4^*~eQn|mChg@J-*v(N54%9!)vFZeSj10cG|S<2&Id49VwhAH
zJ~L_E-5l}guY@mFzj0l3Wv>jQA$&5|l3j3h3Y0{b42M^I6j3Z5R?0dlQt*v|xC?wD
z3B-H#+*?@GS;eh87jYADw{x@mZMP~wG=!WXR^j8aNWdnxc49wd_ZHk5th2>C)gsWe
z6aV$#Y_oFotSAHF$p)2bS1{qD;dO`i>1KsOb;9i^M>u*0h}pp(pVukiNeJAW;N;V^
zcEgR$QeFyauBGa_{3>$ld+Jy{3q|cS)BR$x@f^M9-6}U2c<V6GMC?j_-aBs}H~*au
z+>^0ecBqhz*%s?tqsl$qU4MW(ir;ym#xoQWdvabOfT^m_$qBe1B9*+FrP*RzLr&Pz
z8SHszFsyS7rWTk;6;~ktoLvBB@Y;mEeVj_QvRe{8e)JwD?q<bJ*h%Pg<X_wOzJ2xV
zkv78v#c$UIZB91ac*cy#^@v2sRaMYL$X{w4!P)%*bx<K{b3(Ft$7+`y9j?AZONbJm
z9TbfZz%INVRLOdU)nCe4mc5=)=i)(WVeC)gRFpc%f!Y}zF;+0@!`I=*Zqb7SETg@q
z!y@HbP{H_W2;LHq4DKus@XTLwyiJz6F<rc(dFKx=nK`pqWdDPDfD5pno$}HTyPD&g
zV{u=Kv7po|x^-#CAv*Suuu!r57pMg4xMOEQq3(@)5GV81XL5h_N#F|}2NFkb57DxB
z2;xs-zeePM;1~vEfrLmHp&`lx5G;YQj;#bPPt3K)lCG9BV;Ulo;(lDnH~&kqd{00_
z5=%IWGH1<;lv0BXZL>wx32|pa{*%!IH+fvgxhl!85YtX3v#d6aG<Tp<@jpliT)?W+
z^&ct?7rZTR0H{VRLe5zFlX%t-1DW*v>&4T2Fd`QgCP8PwK5qb<fAMD(vxlYT8yO-2
zBo7*>it$_7!Egfdc?Xgu-~245jM6a#st3;Y6ds^RN$r=g?7A31#{L=hKSS7i;I0ZF
z^qf*moT?zeLgi(WulN^sLzH3qd{7tCeo`1KP^}M`f$e<i-;2Q4iU!;4D%SK5!b8U^
zXRMO<=<gr8Z!a`jhRbe6pW~i7`Um*&Iey0-s2`~7mDK5wLXtbP-K=x}I{R;2$iF}z
z|GF-7=N^Tz+gtsM{V~s-9W!a~=+D))lef7R&R6cK&VLQ$zZd5Z<bTMmKEake>(2t^
z+`KVdebhjg&sVqNL6Q6I-`S30OSgNsYYozV-j?iw430dlW(WoCS#hrcuJ0}0xnYbm
zmGZ{dAoJF)NLrjG$;L>wzuI!SOiA0bvq)s}p8m?QMV1}^gIxKtyQwdm6TOSs*#ygB
z%U%MejsPY%&^La|yJEJ#em(T^s2ke**_rXqoqV7es9UOu6=g^=3-<N~%sa^@_OSQs
z5Mp(#Q4h$kjxk09XEsMVL=sOzE`thnH5@`7tx**J8_l%);FLnQ$D(tONzZr_!6{U#
zC6VKxH1ITg1b@KE-q;c56d&w?)3dus)}&wy`Wu30X7t@R=vZiKwF8mPXE5E#K7sU@
zAA)E`e9L3=3Lc-a$?D%9|5G@>8ZWZ+qcWouN3P{F5iO(oO?|i?5XYx4<G)XhB!6N(
zV1<Hao~Gn<aaIsBtmXICW|%bwpV_byqt^9mGXe+hI<AH2UG0XR(ZrB@v&uEfM_h6T
z`jbo>_wl~Ie0%LLg}%TGJ$GK!4pb)`JAQSle=Fp;e-e2@MEuLJr(=_^H*C*!FZEY>
z0}&OQD1-nn-d1!HWwH}amwWS(q2hD8KFZw5y>cRh_@wq9v`}COeCl%c&pYfu;t)`x
z&<E!*|2Dfa{tNWTJIKw2k*K*!q=Z2F0N__W>I)_ll0UM-Rnhu0nB*3Q^~{%)l8+B-
zbO=6E%MIN#-=t{QS0<OkV%}cHel4C)>6&nITlr%^zf31)XaKc|&@y_ng%M%m!jFOQ
zaF^kZc)Q|XCikgt4qznbuL!w<(XmdMKHRJbzFuk|EXnskPvpfn!T)dVu`Uwgl*Jat
z0(Wo5&VnlK`D+g1AcIW&DZnpmOrxbWhZX?oO|`#ed5i@PzRDoA9Xrw^<o*|4m9VgM
zH^TpT1Bzs82Vga{zH+tuPYfeAV!p@?Wzp?j1DbGdy&zFlMY|n^rZ+HKQyW15@(KVw
zRsE8d1_0;Q6V%sAtWItr5jAiDtp(i9gizSpo=C-e@iyety@^-M_rsWxSvE|GkjViz
zU&M!`3fz{FWH&E-qkaR(GAQVu`(5`^Elc-LdvLPU{Q;(23}Arkp@^2bOKh_qhz7W>
z0N5FN$x<O9u^X_?TM9J#iXs$GC_>z5!uYFQFjT6&>kBRX%AVV%5)^53Pt<>vcXyt#
zv~{VB<%yR+uyBxESV_aW5Rj*a^9-2b6Ta)l$450+?iNk*s7VCSva88&-~|qRh6*RN
z=I&Um2Vtc-r&6$1d%|JYV1SgGNs;lr)j9oVX6FxoU;@FIX3Kca?;AWg!q3E*-9~`U
zOa!6E)(EZpXC|s$p`ml;dN8v*E&c`AhwhzXnVg!}x%~s3!(_+5xRprx)Ds3j>|-<3
zkA1TT9LKeEh^B#H*8dx&bnp4b91~WHPv{38()OVQ^~V3GfFT_h;z#nYdp46VJI@=a
zsnJ-Ri?-a16J^$*%UA_MVGDufD&cNeCo{vR#8waueq9@L4h!7=Yy2bschw$bL_+`M
z$R8dkbiTqAqEgsA+6Kmmu+Ld-*rr3nwxjg^(fxveaEfYXyHOagddL!GjTeIR{4`!L
zqM^O!)Ho%G|E;?948<@M9{6a&M0<V(HxyM__o}#ghcHiIJ4VN=Ry)W99`I$qu1@}=
zf^A6QOz|KRNBPP_o$rbsNh@gt@hnup@bQfbzg9#F;ZULPl(5yEoAq3X<6WvR2<-SW
za^V1Aa2~bAr?h9Nny=m@CFpkvXAsrjGi(^liCH7WqM9P&=8F)~pWCzJMgiV#)Thz8
zA8WlWmcQt=oW)dg49fzM?z%!B^tiK3N0QT<fzZSnfgc-dACwe4(*mB4&AAMPGiKSr
zBhM3<1)0pQCcJ@{YLB^hFTHwAqgTVQO?{8g{<ZQVaNDv<J5&VrcZkt4Kxa=`y)Pcb
z4VNRVCUN6YTyM_#8WO;pa?n84oTnBb|9#9+K&@F-FW_Q<{?du>+Uz^q4LPG*!OX>3
z(Wm^eI5wlE?L5g{ZlVbyYrq{~C7?<6v-;7gdPk50NA`!M27P1BC60E)qJ|Re+&(N#
zn!Y0a(dPJ1?80TtfI||sV|9#9I~9_paV4<IfID;e9Su|2E6PN=1rFG7yqXeiwFD4u
z9ra(_t<J$1Ju=S)OOoyz0Mxwwx9PIpqYogr-jSNs@YQ3*;dj*oD459daRJ}V_bW3U
zE}8j$!6zA<lSbVSx2s=Ygr__w{j!ID03#+w;GMYMpTb5Da8{q@2d10BQpJD?iJ|P!
zW3?ErWpb$?0`OR`{_3_mL8iPyNl&%@FJ+}95<@C{2%tEV%^EVC7@{B3l>%;Af!-46
z^&Xi^2N8ul^J>@u;eO~6<GWIs@59mdX^!0N?o>SXNv!_&%*v;`OqRZ&CH)nQkVP^Z
zuHnq9jT!2q&+Jw&qEkLoFT+H<6|^6syGDyfb=03mT|}ybUD<#e+{&`QO~s4^CEG!z
zl12lbZfxCiM`o=2pI?m>GI@6k>kP9FmDKEB<;-c(EhNRXs7RgG({;_B`YXKY(|I^U
zSz;dFA8(saM%023Pxgrye1*>R*C@Vl_?(l57ap2R&P6fAnSushLg{R;L{2gRI53=5
zkBfIT!WH^~H(fxUGm+kge*+Z$G%|>(_XP2gg^26OgZ2LoEl5pAcPAn&jF9H8q^bd9
zFo~!!%A*Ehe<8Z)CNeEW`&d!*FTlg8_7!3H-q<g){iqYQ8=Sp$bYUdEkp84fI71fX
zLyr|DeMSt$0+5w}pyc{e$K+E)`53ePm+Xy?N>{IOmKnkQh?O_yt9Wv2MaNk1G3T66
zWNTtGJMf?>5U@2tHsWXx%LY3dkEnhldGEbA=S)tatx;lr#FRq8U#H!_y>S7=UcNDH
z%XSecAobNKT$#p1-d%n2*cCwvnv^BSGeQP>#dmB>fm#Tyc+G`U9mImkXz_Ie^2w|y
zs7vc2){%r_efgtGLk;eGuC=@t76P(BRq%af#93?6Vwt=Gk{GpFqf&acn<)X-xEl!d
zUJs*~i&DQ3ceEBA;>}bAMi}guC4haR-gd!Ut6wa{D>lPu4xRb#d|RK$vIIamG!cS=
z{rew7BfN(A{;DA2`ga%A%_Z!!UhSSjab$-7D~R^xKad-5!EXuesII!HCT?%M^;Hs1
zq67oMq@L%RyirucTklObeGoA>!-6?U-9Llfmrz~q>EURg^--q&riD`k1k|@<FGJ#A
zxc^Sy%Qr`YG6Gv_hR1%p0R<x{oN)q1C|fD9L2d`QVqe$tZbSTgCw1^rx#R4Ex3DC@
z;UOA!UIMXs!O7mPp_%jH<?StKD%JdP;Q`q0rZj0YhTUDb0B5hno4)@kJUBl|Xy{Vc
z97iqm5KrW*Np!;M3Hi{Fx0vkZH+zCcI6*lKa~xTb`P9NV(FaM5T`4mI9T1orf2RZ|
z<4@8-AxuBwwpnYxddJ}EHPMq%bUA9n)mYgyoMs~A^4CGBqS-*S;&SK|XnwBWW-^-;
zb*_Ho^2Y|+`l}UHBpbttS|Yg~8Gt^?HhNQU9gGoDN(27aDu{`8Q{u1xIw~wns8H6O
zEOk%<hFNbjR4t)R{bmAf{yTQosv^u60cnd2SeC^wKSGJ47yt43t98e!s{zw}hclZ_
zPgp{ac0026m;D@qTrhxS#>@)%W3Zp(oASRi>LLE?iZrB*U-clDjwsJ~WO1RghS76(
zk{|&z;P1IzXECt_79ZPdjz3SjLQzC68Jx@K6^p`d&<7)GyUySr*WqbtY1Pi5gcWV5
z!{$AiNa9eWq{vA4Q#W-l?0z1CB+(Lt?0z~)T3mn<1&I^0-JfsIC(kGM2RNe7V5e}k
z&lYfYq0FJqWzSmg5veBO<z;?1Nc)o56PHjJ#o`dabZ@vnI7=70E@|vmtHPfWA3G4}
z;Rlh?F<)K|vloZNO@~2uZ?8NqDiqdNlyEb55>Cl2##c1aNzJ>0EBLD1ibz#QF!9}U
zlv&i#F6*%|A9nczk$2upcVB1)6e<@|MP}*=Tzh$c0W~edxhv|GX5;I1%OB1qHh+ZF
zXJyu!GoY^WyCrZmYGhkY0(moN9R9fKU2W#*Hd`&^IYPSfmb#^7^N-Qs#-|22=9$94
z>|lfvf(Kb@a8z&U>qH9H_Gf>HHyc?;bTdeXA`$R7AI}0|cd{a43nr12nZ59uxgvjc
zLCz5<#`{CixCly@W;oPO9*YqZ@XoBw>cv4k=9`Cohn8ns{)h?ffec{g`_2|wGg2*~
zN&ygi&Y8NbVI4#g;Z>fpC-p2$_4{+0__gvEC58_4=3-6V<t#Qe6jw5LlElb;&|!Pa
z2^=%A)?c{j)%Rlt;_~;kIIH~}VGGW?uW_z<7rzJM125<2eE3SDgWPaG{#e)3VMNne
z3%i8S!rf99*zg`!IkzQTZeU(A_OARSldv!WFVj`XgX2};6qcMOJ*O7GGq}4_ERa)`
zWUSUzOi-d(zU&p`y_!L);w@@CDfIu6%%HZmKI4!Sd6Y8{A+pH>%{j8tO-uW5PT#MH
zr-dX0Uw5q*%`#G4rE?}#s7o`5|8p;d_3Oc=7r%9EuUxRCrfA?&`5-=WL3$>tv|M1$
zdc&ET3u1-1!9iG27BI<DEut>x&(|sb5oZxVoHF>ARrwu%b)fIxnZU?6sIRttqL-u#
z<?|Jy{}ltxPFDX&IKc=D2P)H6K-1b4T<|ukmjleAzkSb881(fT-J=t4OsYQ{$vP38
zkA=ffAb1oDHf~s9Pr+wLPJVATM+u_`<Et0wHu=Wm-+4_7&U}Qy4AP@De#fDG#$d40
zLt5M_*e$pzHd&CAn*jj~Lc~#H8d;w#t(-C}r-Yrn$P>*2s1fDrqNBqFzw-dp%f5lv
zGse$4cdNnGCuJsA$Y8la3W-7#Hk*-|BYOvHk0->FUk$VIG+%7IbQCOVY@5tTAh3V(
z!f^^A1<>FS5mngU_YVRsRQ-P~r||%ED7Q9rL3!h?dTtMfRnij0L^XJb%CMN1RV``s
z`<EE4x4=o5;cL^;l*YB>`kSPtypZLAIDpNlNNu-E4}0$5#cO-E0KsscIyOoOYEPC^
zbWK<eORuHLTBeaYlGh7?#P87Hnf+3^(Haq(S_#6R#bhqlKNS+jaaEc%Os#8Ix^zN*
z>IGlpO!|O7&Fs_~HRaeoT46}Y_Pr<=JPFJa>nvSuF&?B9($YZ@&}<~9r0vW9*Xo*J
z&IS0!aJ8!BSq|O4PHjd?S>fId<|Jz`ag<?lCe??WMHLPyCmB^yaSy4^K&np-ljBIY
z{Q|_pw$?CNd`T&S05lQP6xTpA0+InVz4-`SVAL(Av-$rPz78B47mg&b>OI6fM0b0K
zj?4}_V%o0(p>n}`tM&WC?s6({gggp66qb+pbItia+gVI%2<Z2##q(ThG~bJdh@htb
zFBSmAawH+!g9@;~I8`=f3Tnf%%YjApi`qnYyHu{C;YZ$IR%v#3bH~YPNBSunYBPKq
zh3gaPx+f2dtT0rCCyXz(9>qOzS_A2NxF7D`YRFo163+V!?$?C<Q4|P49d|=^DBWtz
zO!yZXoXd7pdIUDI1jwJ?R&vj-_lP+o-&eg<-Gs}R9ks}e(1BD4FdN$Pz3Nlo08v=t
zxAfw1$_4{W2nVxj>q<!^lO?a^C@*4%>It|yR$Xn?$A2sbu=ekNQZ7eht6ip2rS2~a
zo{sX?;iU7UB!$>g9Pu%clAt^wq**SUSGaN7`ND(bhMSZP0BHnNv84C(e>-O5+nYM*
zq)icNwX5oz3U|q;wc+P3#Q9v9Vx}ciiso;_lih@d1C4<%&b=XvO1*e7>+;FQF%?x`
zor`SLwTxmsfucC$j&|KS$z;E%uE?z|>Ue_F_6^ycm`G_B&cpdD8!N1SFxa(5NR2Po
z{9odJ0Dna2{TtW^@xXen7p>rH`%2IDFW34n`7#>xio(|&aEo1k!~ko#G!Z?}v<1Wz
z5|y9_@nRVUFIxsuj~~3ogd@K&@px>8FytDhZTBpJT-Z?=jbldUWJiio;@`!&#sA|c
z@<s82;Mt;BzK8}ooFji7#Y*am<hbbhu9k%?aSsK3haCd@g%8v)p3SQcV3h1=XOCw_
zOAP#UK)k{x;3WuRV`k^oovbb<H$eC0DihJ-qRavJNbdH}-OkTT|Ix?e$CW+sshvTP
zB-hn%VVxbvXQSws+Jt13h)lD*Ccpmuv=6xD6ul=qC+_v7Vi@obgFBpnv2MT*)quY}
zdjo<$`f9`o!dv&DUUMTG%#b@nUqHuSfLlf}7y0VVJ}$@q(fjwI+8_S}p!~uoV_RqN
z0$ndQrJUeKI9-W<o&B$4{O_RtYc2o1{qxRi`_SVl*!HiVhh4HG2VXunb1hVfjvN@e
zJgcklIO|X{1K+mLNUcu4x!&QJYjrbzB}nBA6I?N_LD?_j)lY<Dz?xnUmhVpsZDYey
zJ?K7I&2+Ss8pI~zGxxb$>@E?CPd-|AeM@_L?2l0L;HFOG+-z+;3n+V?Q$H%<a^C26
zbf~kbe;QuuI^TwkA?IUo4KIJQ&*^-CT5}vDO2K3o#m^dTo{q128&qVg`v96ZKfT88
zaY%JOW8(X6r6+h^-@H@EHXy0P<k0B3U~GVjl8n2HM!N2*Ys&F~1YV~Kdk+5(UvC){
zXVkRo4iF@`LvVKu?(Xi+;O-XOLU4z{CAdRy2=4Cg4#8z`J-qL(ul7E*Po2NdRLxVf
zrn*<JURU3Dkl)3Ni&oB0RtrVFx0Aw@LDyV3qMK2{2twad4O2OQuh9ek`@=}?OZ^z(
z;sy$pl>wzP(NZ$Y)4>)p&R8_-(DB<?E)hOCC#wzpY~{K)nw93oisLOjf^DGRL%(%9
zi%ws?gREE(kg4>c3c-If)7CVawd~*3=u^_(R8%EmAz0tJcPKO>3JC)zLhRyTZx>%)
z2A(kF`tt$)JK~w4L3aYv6kc`J+ri_LNv=$m()k~XWa6e}78A&wlP)EHBV3`j&A&Kd
z+dIA8sW#rYPleNe?b(#Vd9_zdW;d0J`uJ{rblmg>QKiSt@`i9{t>Sk@rM2N&q|wg;
z&?*H2A{y?HjuxRO=f~y5wKoMn3^JUggqq&pDtW*z*dG>EzvmTCsbRZ5s!y`-w8W$8
zck63DcIW#mE4_s(dQI>mvmPEg4|^VKG~M|UH*F8>2Q!elJ5L*ymEO;CQb1{-g_mt1
z`=e+Mymf}Lh-M)kE_hDCYC3kOeN{Yyt+y1-uFLam5XjR^t*zA*5sCXd-jLwRVXjz&
zj!wk!3$Nd;vas3Q0~;#wW!U?_Y|z3%9;Y~c*XSPI+}Vt6h3ZuQknIV=d2=z9g*hdW
z;g-jyXF+WQ=W#@(zKycAKDr>uZlk#YaxwMi$5i%K59?-0T-K5P8y7n1<mOTCYhsOF
zI(zOq)W$O=eZe|eTIXAtf8j0}v4_O<$4P#mm6@E)<4jgLayNI<w$@X0lUkLsY(w`o
ze*QUI7-2$m6!V&Xq|JC#OxSu0o9d|iV=T_K%T%IjMdgZ(UzAy3sGtD$Imyz|Ek<qd
z`iF0FX@^l7<OU}!iP!>ge2P(YOblHL#1E>?e~VoyDt&CF!`iqqz5&9kE?%AYe6%u`
z+69h~TvK&i-(SFzxp^DJ>*|IW%;8#NDkvQ<1FsP?-FcFQ80`PbazA{HO9MtabGv*_
zE1+OGF>S|gBKKTK_k=b(O|V~1W5R$!R&m4+S8U9cCx;7dN9}%^3i+CaI=>2{MC&uK
zJ(&YA6#ZVV0zN8RX|(8;bqZ^<RQ(t2t!cn=?Y#2otM~KFHB2(BFYeiHmuEcmyjOmI
z1zLyTr_2V>wy;CYMr1N^ae5_?cYVh9M1>OXFHP?-^q*{wJry?sDijyhMFi1|j&FM0
z5d|rJ(=XYyqoPw)y(IHCm`TNoZ_!cQQ{Q7|)TNAeQncXX>?+O9WVzBOgU(C=?S4;8
zZ+8(8gsBSd=p4aO(#2u;U}PS(O)#S<Wky24PF40wot5)o5e2<k=C-X#{Ojk1V`oFI
zUmO392~1emmBm>p-1fg#(g-ly?rr4R(`hzGZO5>xDl_vJ3Q4~kcliL|@zqJ9l79o$
zWxSPrv;81+Bd@`8&y)sMr=h6>a@!AQzKe`~E#&N6q_0dv8Yp#<1hg_g8`3ttpQ7GD
znTk^%+73b-Cpk*Io(gjQ9wp-dr`~WaKBk;ePXDaC9hF5B?S8Si#&aXy?-v{uRbM$7
zV*{!-Obui(9yPvcC0I<2Diq~F_w7IMF%gI~`zCh$`*O@rd2$iQ8!|5IZz7hRk!&}M
zp+mb?f9m}7FCL}Kb_Q&=vgC+$cs01g6}I)R=%co|)5_OyvNVyS!K2!w-7GL~`e-nK
zq9gY4x4-Gk5VIV&yiOYn0Le_hy->)TDn5z+j7*_XcDrmr<&(5cL_wEmR>%q%R0dEq
zvGKG<utG(g!v{V-LzFaXmcz%>_ngV+$1_IDIPo&S<ae8IF4-22A^9Q_AIBvUr)L`|
z`)}Yrpf~gWpcsi1BtBDnQ`+ju#b)uaa-b#$IOQ!d(VN>H30yBAKzw?XF;1CAYh1jU
z+mrJBhznglsqU(ZK43^+*le@bL&F@R-1%r0v1q+SDkV*HWcA@QZ;g7k`PwncUg7NK
zY^Avf*)6g0_h)U@2hQQ3KT46MKzt}~*WDo7U0QCB_F#p8{FS;URrMBZsB`ne<X(n!
znB`|y{i@>M$l#7T$jo_rT)3kX+b>|8_SlK)0LgyV!+MYY`8>Kkfo*;-TEA2Yy+bM-
z11HL!{I0!Z&m}NIPTwresX6nAlRc>sAv@%2)IfC=6RXY>qAYjf!s%YmQKiDy&{M&a
z91tk&#xk=A7JX`?zWZ0$dj{wc>@HfMB5j3szfs#?Y4BA|&o$;%qyzYkZ^&UxcAax+
z?O&{NOmmgu_$vBb&u@GE1G}Q`ggSO#U*J}5S|e3?6$GGVyZZr!+TslxTQ56XEI5EW
zz2!v$c$pDx+H#!QU%BBdAg_>y5z$rTr>nVyg5$wsixUdjMYl&cdzLOkduR6#x1N&T
z`BdLg?VMPsi;eZPCfrlxr-C;bJ%^7bL8>iJH+8<pP~|eOi@oM<50}lC3W=_ZyUKDu
zbK=`!F{}=G+ItUlY(~y@aP7{y54RAczO0WE6O%?r|0JutZ_dMv-C}4?@8duy+FZD&
z!@^J!=M?^+pl#X}h2?H{^S+cHNv!7*%b(_ASq-c~|J_HgtcXBI^5~o?*vJX8#1r*3
z(nA+ICZ^9Og-?u|Ga9>C)?@85*_9~xbh0J2X`!_z0Z>CybMl~GqsSGF(6?!sQn(5c
zh+Xxuow|$f*lO+cZ-^R9TiDw{FO>fBc7vkDd$IXrBfP%PczXD$CgxVw$9(s!My*OA
zU)M{2lb$>9XF;znxU5`10k|vN-sGa3ZgH@9Se%ZMd-Xn;`;O6cKC**>O|jB&hZy(}
zbrr@@)G~U&kR6qyk#i@Eck;T3uhaxu0~Dy&qs^1Qaf)N{bw&>g4K|)j+;G(uE1auZ
zutBM>g|JBF4><?NT)cJkgc6>MdH*<Sliwvb5hkeg49jW{PSH6vEDjDu$d+>MAq5CC
zR{F-ZgZb?FekS{9nvdl+WOX;64LrdD0t*5y{AmdVsyFLDtnzFFc8Mj#iQ=_a481+m
z^-X4`*+^?Yuza9L@pDtgvN;l*_uUBiz<#t!WRfn7f1O2U`uCwAS?KvXr@h$K#ORHz
z#(w1VN;FgPiyat04gYZQuN`9dagM0@IwNr-#5}Ti!l4Ru=!PVH{L^sgSN@mtP)PEh
zVA^9C#(#!Z8^jdfe`Qomwj{z!jXrBE{tjkWuT;#_(D?~z{SdvJ=Y3O@%Hr=lVKqR^
z({urTEX1GUmtdurgdOkXbL%I`y{|R-jRRpMnDr2#=8{x?M*-*O7?JH`>2!%3n_jUP
zkO}T;9(9={kS4_o-NbrXuIwgKA?O}&ZR!Zf@pkcFv2NTzFgY#dI5pM%9PVR0PS<!_
zTYq)#b4ff8+?RhY`M0no+o>~VQ4LSvR{ih{@Be#94nImXgqWZDo=$DSr#biaSlsmV
z`EJh@qz;W+=>0}>Bj?-UkcR(o#omRBF{-4kC;=gnF{BYI1y4XL+c(eY=?Ry($)NZH
z0AOSdcuRFVza#bg3GWKullesmSrMUXg4;#pn^+W;?*d5^Jn%8varBkE26I3uZPYfo
z{-)(KX?5+m$38#L4R^BgqexRW#mKql8fq7iALMlG`RNJ2yNhWkz}0C7=rM12s3}i%
z&rwIs|2Nm$DBJ62w01D5^C8&rDE7lRWx??H%+`OdJoagN7@b!-@ACcDN?^omxc0N{
zeQQswTV^+qD>~{rs37fJpYp9eU8h0@bEH)7*L#(W8H=Ydo$1SaN+)oP!M!bV+9HI-
zi(-ivcYHLFYeX)fU|`l<0VKMB!<K`=z-~?Hnxl7jeRUt|C2&VH6!ttDDXz#b1Acpo
zClQ@wM9efSlWo177dbThJ;3fLWLMY3U#bg4dqlzfYuNWI1fZ#@D?0t>i$jXHD&u9v
zyoC)r{Q{589cb4!R;n?5OmhH__Exd4JJt=XU)Hc0q-BC)eAcmlrEe)&i>E<m{qTFb
zm=TRTFn{-tubXuTo^~tt0&k6s?k&k#i2Cx?I(DkAa`jh^`P$Jv!$Hj@8Y!D8_{nS`
z;wDJIwc{E+-md@xI??6s%o52<;LTV>)wdRoJf*DbOkaE>q5B248c5VNjzlBKn!i6x
zNScJ+dqn7|Bb|6TmTc+vWS{ij`D49M+PxkglD2r1j~DFk+Y<)&E`8Grt%vH-Cv2)F
z<m-PluUUAoK=wIyQC*xDs+Sb!K!l4pi)<GRuDe79oa|(;-COESV!Q7Nh@I;+7eOez
zqHq2qMBQ{)HbBTdv3h#RVUAsG6sky%x6@^E?aBVym5@EMoD~ti**HnnXYHs=4M#=w
z7$11y+q_x&sKzvd-qkLxjxbH3YvNvl&T@wqI(`^J;QdN1DJJu(Y%Cqze$3H2ZaBy5
z#A~_5O#J?n2bc911~L6yOM+pmCCCkblv0pV{Q0+Avo8ZaGK?Ax-5AH+*~Tw~2=mr}
zVM;8PrfqbXYbdDY)#kF8@`uWMNa5X@J#ssCTZAea<3xGHAR5M*d7FO>h<@R0*~LSt
zqngZ2?|7Y;7-pwn)!GTRj0!77y!<w&9{;*V0ze2ZQ@qrQVR4c4?Zr6sullU5gGAZ1
z-PRDa-svx1d-!!Ld6Nls*vSW#3`ph`u3J>*DQ)84VdI;c!9nRa?;0FrbtO;$0`@yG
z+N7{DzAgKBKL7oul2Z2#!Pjd&sL^H|#<u~F@-$gVQqf9&jVe+_+<VoM8prR2AL$R{
zYsg!I#wc5Bhf-VfDoR@FEP*&f?K9U&BPJK2!AnAQ8h8o?7g4x^gVg^T>*h{W8q7A&
zo35%=5Qwh@Up)q2Mlb<YrK6Q!w;A4s)=>a(F_&0qP>2vDJ7Qwh4^^@P%IUt5i++y#
zmt3}(aUCl_;-V~JlG?#dw1}Q46#Ii8bM-U!m4{wJ>I=!yqp$FT-*Vl2%~6rxk{|9^
z`|pr47XSKZ%(GMnU$z}e>)>@(wUd)n3DA-D{}|<FeM+qx7x0j0^N8Eg#8fT&<MJl6
z9$<SmzNO@w!;r}vx*?R7^;*d-VR}r5>*&c?tfxBpPsv_mDO&@Z=DLEv`uoI5tfraH
z+g%wjs*vu=8A|lBt!AS6b~p`Mv#p$+K^3dzk5TMAL3Ph)9fh#fH*w|u&t&7LLu>m-
zW-k;GP62b}eStIczljF#KZzzNjLth9Tb&^B<Cr=&Yq;v=_YN796#6CV<yp+S!A+!m
zh{s;&IHn#nFV5@a86v9mkvO`V^v7$021~=g36w0VXT9u82Xjn-$WdlLY-s$P&w+Ut
zTMg%HNNw*P)e(YRdW^xKdTaGFnVztq_?TVH)TO7F2(JW~K~&$ex{#U{s8FQ^MtkRe
z(U@{CD&ODYxd}Qc0LWU;q8u@zcz;65<J(qL0!=}r(c(xHIQcp1V=tqP>E9<t-D711
zjzt*Dbr;&~G%6F$pb<NatUM1RamB;?D>ab_MrhWQ)I8Y2phRhwTnM%vjO{!{IQcl{
z^YKzIO`l2u$?v@<#L>lt&<7dH;1|(?J;TNSq?+<6_!|DdugQpjcE=WCqe-qzn9ldL
zrRGqAum4yWTGb_A;Dqk%LkB~QH#!0rT|Lr-V(ws+y{(>XQ8r%&2gw%HHWvmPi8BJ;
z`UDm`JDdXE1@!K}LRG`RzD>SQoi*)}?fOpZx4u*@eO&lkF5hc)O*z?IeA|}S_xJEB
zfyMEAq5-5_&;3kt^!qTPR6EsKtG^I|>JqJh^~lv;#sb`=PPCkYF%-|IIE~@MbgJMG
z0)<HyT(F#*xi7|v2~stgOZAFyUf@ih=P!DBXdU(X8uVqmy)ekb%J~l`kzmNI*<#o*
z$Mg(q(iul5v8BfM`R?-9n%Q7Ho5}gLN6}k9jeRQaD!D0T$Vw0r1R35KEnP-=pu<vf
z>=|4e_03?z^~vy_9}fDUtSriOr|=pxL{UD(i>MkS3n%0!E3zB{8lT6#GEy1!-vCS1
z2rIQ~Y#HBVn^aaowlgXF7siNJ$D-nY+CLe2qZRE%yw+i4;mHxqFr_2Dhu?f23j!C3
z<j{<zHp(h^qnbyZ3g5L=%Le)fcz1xKHz@38k@*Y}kXN5qZ7+xqWwS6|YkWH3=Ipl{
zyEELUQH9Xnq9LjYj#L#RuVXZ|C1%G+yrw_94<@*L5`scH49|l0uK{CnwB7iH5okXf
z2{VQm?$1A#{p?9SJhN9d-j`B}f8k6@!z+%QJ4E@|astdg(m7sggUPW0Ed5XJ>=29v
z{sQR42hhTT&r+N9O4*w#s*bq|QCA>6T{i&W$PwjJ1#qO{>U4wcq*g?KFrR!5TiYHW
zNXy$)cM9%obdL#j-q@4oNqY*p3e?vgxyxBPJhv9j*xJF59r@n!=Y-jvaPi@C@}i+(
zpuXboR{I*=?akfC(Z0K*E<4k=kXVOnb)gp@Q+OqAG>=8RjPG5td*w5gcw|bMU60d<
zflfw3plpYw^Tun4T1P!4ZVm4yDjdghL_Ba8HdofDforh0gb&IkCBWsb2?NDmRYdb>
z45z<kdTA5!MvmuhmzX1LjOKKyAZLO5zXwe9l`;075zco>sfk0_kU0e;&;9Dln8biA
zgp_(Zn972cxNx??YXL49zEPX{1)1k1JR8_yO{!1r#&5EaP4%kqwa@``s3x0a9q&ku
zEJpYfthg8W<3HXFR@Iz&)DG%S*qr~gl|F|<z@RnJd7O~gawI%FSW3kOBmP9)HgN=+
zg35iIgi!Eg+9C+FNE{7GQuzQRr^(zd-r%Jq-J8yeRe6xbLb*~^j#~+~MheKK!X##Y
z81~EV0TRpXo)@cAh3nkqI4W|Q4yZ6sw7AkJTOSYzh(1h>D6n)+Ag$v8+A@~If4uh(
zFVB$Q5veQ&yC{@C`Q;@zGrLyUhL9soxzrGFx4Ag)+ij_lnO|^gQ&?|mGr$am0ib;X
zyxt~lrQ$k07UxbOOFEt(lzuF}WMqINtmmp>?Dax%r;gVaTH1lWC7cjVKerfkKb=71
zwrz?1uTF-&b(POspSC$C0Q6h;z5kk=1uXqQ7gnNErR$zbQ!U{D6+|n6+v>O^U3r7s
zB|dV<h~k`uT=yTcav&hjkCn=urFGAxIpD>8dZ*dc%^C*cs`&w$td{f|&f=?`p5*C~
z+*4`$9+LH1+w4151Ak(dP0sH!BPtHZk~^Cpvv-tzX)7l{cb7bUPZEYTYn}7R8uuD~
z3epy?GXEwM=K7%9401Q3-Y3q3G=YU2EH1+M<ya$Y7hM~2k$P(ZwzQ;g0HDxaP9};z
z4GtFMsYk1Ruu+K7mx&?^m=ENbY|<_93_{w5?$~${aSDKxC@;qTT(Ihof0gUBI3sY!
z1^!fBk=XO>rT?uB)~GVEaDLIDbJ4M2-xH_mWE*D1p&acEsJ=I;_V_6C!^UIxLFF3*
z?^|_tbWJX$O+|yto~fz+wg1PHB7vv+BS`V951#>u*D`|9#&^AW>gfdofC_~qBCMi%
zETvRDk(O|Og>UikwRX#oK=&gWi>GTp0e|iyJE`rJgzI`EmUzPolj92C2LyyG_kSN)
z{C69c;*3?8*PXyQ-QKbIedJT+bDkv(Jy%<;omikQ-^d;rksne@a-CCpzwzJj+R?iu
zWJTxHGdqYg8+hkzFjq-NPulwtgu-{ulal83ot3@{?79H}*6z&e?Fr27-thc5y1Yiv
zxw38k8Rm1QJ$G?D14(iKvIW)o)bTQ-nu=jphZ8G|=CrUex0Zi>cCWYOh)rf(G(gd~
z{vN|ZoXnLHpFl42_RL+#h6C5+M_=(&ZD{fGo`*hl=P<L}kP$=3gY=kW(*}P&_$$zU
zOP&%cS`rs&m}eMQi8lmzuTHD(SB<A2PVzfB{RgWh9BWqouLC2*V8{C0*nj>5xV^s~
zd+L5_ax+;8tjtUNer`;sn@}iy##<;zcoaw7g4@Lx@fH1j%>rw#<3%P@7QzD{7P?~f
z6=!+H;BkZ~mJXhUVdJg_j!Q3l8vldr>yP{F&EQMQQv;$6a~AXOfW9U^=w`#e4vu6H
z@EA*Kotc3Zt|JLBaF)`E^ayl;!_om6wVrmvCIJ2MY!QAs#mq*Ab{3eIY6)g0U2~Yg
zt|j6)qK5MvAF8IuvyEsQIRxAngVi`On|I#R7{l}2Wnhu9zM#h-*VdN#vyt>x7*{IW
zxR>u)a7+c!^L-Vl%HmaH5Yxv&&{MHKQ()=A-u1ay=^~frmiMVA=Hb@M^L$G|+xTjK
zWw18{#y?%)qdQax+3s;K%+X)4^XN*h=A&loq1my?ldNKJJl)evjLGp&r3y#_A?`2D
z^_bN)D-{&CJUI5c@8~KUHa_NK-mpV*Qdg_=>36zrdNwIduv6*AnLNp(@O->r1P&U6
zt#b$Jo*5@Tx6suWMVKQM>$y|kuo3-U`Mf*%<n#ErR~nr3DX}TpDLf<09R{NqCRmO}
z%hu-tBEya&3*WhWDo7&&`dGp><-PY1c5iakB&(+B+qdwuF{v-p1o8iHwY5|#d~A6Y
zEgH$jfqsmNItYn%FbjowcJ2;qX7#)I$`Y^S(84W8OGFRs$!0CY5U8jFP_gnw0#vVm
zBn*U3w7|LRadC(~D>g#8n02F-k(W7&du?t$Ppf|}rZTy-G_@$swo|=;m8qYS3KA9}
zms4C}F_Co7WNn;+d|4xFV@b`aHLqo7`^4F~X*dhuhorVjy4UAlu7TuJ<N8{nqkA?9
zl6wTS(%q^IP$p^2bzOXm=X`+hSD_qO#>y`MLAu9ml-}sALj4zgbLhU;RLJ+{_Ve@0
zCT%_zzXBZ{DGC$2@o}qDJ)mwG*AdjN=@((d&GuB9l`Ohfy4VWQ`p8Q8Pf6mfi_VlL
zEQIfxL@vC3F{Zf=Jbk4ycmVp%WVRwHLwS6)!UXKYq%t8l@BXC>-D*~&HfDMhQgN7$
zceRQL!NVh}qK|kDsVbPaPu+cw&v0xiBa&6`kYBSQU;7hj;3u#}+p&43hYG-4T3b4-
z3`DxRvp;*p9xSH_tnp&LM*bo^IL;Am{iyX`JeFHNXd^-I%JOBt<{7WuOB7%R&!Z;T
z5FN2HPbHSp<JIaJWm~D*(d`wV77oys!w=Z7@AR%4an!rBWi!vn)V|}$Pnqmp__4J3
zM(KV8>!s?WhC(4DSB4Y}B)Ptn4k0^)JL(mq#X<DRpjv^E$ApO{$Ku=f^U(o)*~;;4
zCOyi-u8L}8)mI0|2AFExzFLVC9Iy*snA^HnbI+R9x(7{XH9cU$+@D~NI*uhmbhq7U
zRCUK*OlsD!WJ??mu!KrHI<cq${^ZI|!Umf{LH~YUD0UfQn{$Y)78EmJ63W_{=By65
zOz(^4iRxTYGf?3Me`I{j-iLJ(ag%L6E(OsId~O{%b7vM)NAd%hM7-MJf+{<PU$7J!
z^ptW0==nG!w#uWC_#&O8!nlbc5x~NlG1{&SIKu^GE7_Nsg>&QZkD))IN`H<7&U86!
z{K6%<`RrRm{Hg8r4QV=nly7K>p!kmO3K<&j4U~%NA46zBw-hvJB2GnNicfl#+1K!W
ziFoZsHhXbZ&1>wjJ8rcV)%Es}0bwY9HK9S1CI>2W^&}RO{SONOoHCM60YL4vg3t3b
z55MfY&jy9!c+|nWuPNuX^0t1E>%D-hyc0y(aHN;7H^wL2Ek3<!gc<QD%1WWJkZj^Z
z>lRw=7V<@429p<AD$J$yYmi!OH13kY#7|>NGJ&rHe$-kV+`tqp;v&F!iMen%G70y&
zY_8i@CN)ubsc{L}!Y0E*uk7p$Ir`tIJjvhaljuIQ(oQr(BE^92n>Zc_($TJ3HoUX@
z^A`$vt^rR7O)UR0@aOj+IAj5l_H0rl#bT3H(v1a>wyFuC{cFTv0M+Ki<k|~8YM6nJ
zOY!e8L#aYK6-hbj+V7ifpysY~zCX~-tm$;B1MZ!ZQ-JT5?o&K>p*}|Dan`xSgg03d
z>A(YLkhNwCsMh_e@C!k1!0t6l1&)PRA0wk>!vaN&?)7LZZHj((v*Wr#mGYy#bL8S1
zk;CX{9|z~|9{6ghsw7lrGtF%`N?mvBk^SFNM^5H&Lfru8fEcJlo=^6E_=Oswz^9fi
z>a6KI0PY&Xrb`k1Z5vu$vphh`m=?Nw(T|MSihD&X!Ie_kovB>g7(#T_1wvBSPUvAG
z>B>kQh9ad|v3gQF8j=ieB05LCTw(ZU<Vx$`e3noSe^n(mO~2KfPEoA=L<^Mi&Wwk9
zH|wbq4!P#>L3XCGvUv+#isO7q6HsMuWFR;CQWB=`CA$*3-YrFnu(p!0Kym~{F|$Zc
z`wM;Rr>llb&?#q#r(x7$$J5=ByiwT*Qc;xzLiOW<1y4+z&x&p~eQd+;9Lu#>2B1dx
z=EI~F&^7Mv%BKdQr}~l;t87hnA%a71blP-qIHLyG@_Vyjt=G%W@gn^g)AC}FICXJ5
zOekrzw8@!L?-!xSS4Ll3T8<FP5J)U&P@T=x1Z<o&OiQ=ORE^w}g0736E!6r#aM@kB
zh%pVnOWnH;CzJQ$ZDnL5`({0r|LLH;>)mhV<U(^j?WA0dkOYeLPlEOK(f?2~&oun#
z6`;pN(`{GTfH*k$dG}lu6MCN|WF!L%O;VrL82#jIFoc>H;bUga%E<6@3c&RHzRs{F
zN53?1R=|?jN^0V4K6m!s5f`%cUumdyF*@M-#=ZVXvLY$Vl;r%0(;n}u{lpR*Ko9vR
z^H(InDP-9wD-qiEH4IBCdO^(xwZsx*P5l@P0DBnGl<+pLpz)U>tm$>v$ug|9D<~jZ
z*w)As%|$YY`;I7dGO>DUVI+1kN2v}Tyyj84hQZHdp7L&3F*nvRHT$Vef7vR->Nr2;
z;wS#8?R`6%sh`fmwolWOk%WAcuj<7hw!j0sYMKz|6Lm+&ROg_BOPaU4rNon5cUqTv
zGx`E&Wnzc{jTKG6AIpp%nKNE>0on>4hiyo#BIUB9B{70N8pIIh_iCI-uMR9neV%)a
z{y{Nintd%9MKkf_SRV@XI>6}adQo(nPiu=@4&Cmc-RvR&iPi`*ob!w&6D}DkBeXD6
z6AMTAzs*!N$CkW{BOzi<h{=OEqRhASiM+v2PqR^W`mz67Td)&VvES<BE9-`J-Wz*{
zOuVkXU{B2b{!bu%&01_85Ly;_e#+UqB<5|?UiuAu@OB{kZ0M|g`K%M`sJ<{GyxAf|
zoftN^ws5DX1l<yAzo21AdFxMnO+FvfysUa;VT86O?)g5qTx;qs<h4j2R4#cKuQSOz
z_}Wr!ieL75D&rSEfH}oZhJ@)&`fTHJ(xT9rS?Y=-jBX2rqg-E?s=C(%t4_Qyo$^9w
z2$VgS`_Pz{c+9LDu>Zgj0QG0B5~-ztsAT?@CuGsk249j0Y8Fz*)vce82Ott(49J4n
zwI|bc(CwLNS8Zq5*u)oz-!YRp4E_^4COk}o9llkQlu~#kuUnssy4iekIWHSJO2{nK
z;V>vwQ~4rrvk@?!ZNcwlYP9(B@y1l4nP+l4eHtnmCF)jVB&?Xl{q_NG*NX4ImVESO
zJQL{eetD}U1O%I}^VupwBe#AGL<k-`3N_32alnu6X<q0zP&nS471;^~>~t&)og4dE
zPWn|=neJ`SHyDKd7O&T}1<#%(Jr0}p={@~kNaAY0I)D9(Uy$6m4SJldscDkkZ2vH$
zy|d-G3jL5jr#bh%sS>yYCspJu<Y=UZM&*E>C`mE8o(~+3?yE+4EFOm*GQF3O2=_N!
zfm`N0D9_L#R!k14Vk8l`!(m~y>jN%^eT0RZge_^_H38$}iY1Hku{UV?Zp>6sSCM<W
zQZAwJx@<8gX4Fe{nrcrF4?B;7l29!vd)%GD#e~%nnN9YpF8Rym!Q7QaS?T>*l1$Tj
z_^rq(O<9BEhp>V&if1P5Aq{wg&O9zI=ePFL?6rCnV@ky-@TfxQ9FfBLlmke%5d^vr
zf)1g|jWMM0PEv)*W-N_4SYnubjq<TRk&bU6q-JrxyikfTtRYTenXQ(;P4F9|xB2)f
z!cWr&zHSl4D7tbHDyB3gOKy#!_~n?Ln;m{f#b|%i8B}Uey-7Yi=^A+hd3dJTVtfI+
z*zlB0btm{*(V&h>)f8F+6VC_kyoHB(db9i~-fd!;i)h<8q*ZkgKJQv&#8ys{KY2l#
z+F-Ya6H1E7cvn}_5L8wP-bD2WsfGLXU5h*$HdB!hAu>V%Uysw3#p(&QNulyYaPB+p
z<D3*<)w$N~7}eS_-D3!Tp9{R9j_Lux4i>z%j(2k+a2^oN{pJH7b@I(k42R_O6_HW=
zG3J6fvVEBYHNHbi0g<WN#Q~_MLIOdRODz~>?OgetM=!r~aC0dn#<B0dD>0zdn_9wr
zApfBX<7klCYwqfaswAN6YDmgiCpTLc2nnE|aoQ;{p6mb(-IzUo^NB@hE9T&Pw0Vc9
z;O)`~1LwR5JQifGzJ1g9W2Xih7-Q!}=5|#J-fgkDEBuV^*+1IY9V)C|{^Jk8@Lb1)
zHO0vG#jWdw*F-h+Pjg9}SAA5sIiK@Q&o-kz8SGi|{mwS|Ny79B7j?gQ5OKx2%H@Y~
z?f1Y+C@k0tA$YZYEpvT|3=J|d$(8c6(l#RddS(6&CWT_dU5)FzW=fiS`IZ)upr5Om
zyeM#4{HtqInok#u$3lnRM8OMYMU^6-={e`qUm;R1?)lNc^-z>XhPS=Pw|6(fALOIC
zC%s}KaHWjJYzyzgHCs93yZ&u#q)_PM;F5q+@PherQdC;Y!OCa9I{Dt(Gs($f&U~%a
zhbnTash}<P&v#gPh%4q|dQR5k$loUf+Rf5Z-Vxc<;pD5+XMN+O-Ca;eKJu&2eB@-@
z!VWDb!)C&zd~y<vs_rNkmX_3f?*cJzC|uhCqJ!9))?tnh-c=Jich(~>)hE1^|H)PS
zL3Nc4(z6;d;yPZu<bB}{5_F9sn_?45Pk?l69GeW+@wKVd*xi@)&}fRoLKb&^ON+h^
z-G=9L+R!L?@fG4vm5YMUZT?B4ksx)?uu1bMk(^Ou=f~EYlbhnpMGc`V<Ycr`F*4Sc
z*T=CBkcd)SvC_+LG$3b1yZPHp+m!2A7ry38SGr>W8;0G6yNK3@CUUp`evC8u{*O)H
zv-ANrBpSZw7X*w8FYAgXr5~U{^Mg}j0`}Ic?9>bY>p4B{-@E%MQ^aXE{nX!94X?1Q
zHLdLpGpfQmA2|<JKSCVee9cqTY^S!fN?coI=8o1ets&1!k`|fT&&!Uw1Xqo;O8$?`
zbl|xbp$5Tr>3MN)1o0<(_2VJ4nIGKS%y9(eoevzPbJe!u-@3!@?ip1(_?bJRb8P8j
z+O3`U<L$#zHekw<bC96~EvNgT9Uou?O~1lK{YHf|p981<)a;6n#T&EB_X84_E^gQ-
zbrd?~?`P9JXO1)0@dwscEdoG2JD&%Z-A`7nQE!#v+JO4{yckkZvrc2PvHc=gvNfKk
z&B?yR^*@vUybAB4lRUPGe8A1FtlRb!TOp*%VDsF{2&z$misA3T&1(j^wBaH5qcv*C
zK=pAKHXA{H$IhGs2CtW)f6fA1-gJOJbeajGV~j_n6{{%H_=ZQk`h8MyJG<P%qUMoV
z5|dC99R3+}CFaiArpFP3f_dK^i$ELPeP6x*Ch$O8fXTilaU++?C;nhe;P8JesDw7p
z02O^6qUoy2@yuu*6?rZ8F<`(30Nu$tHoWnh>A9QDqQVDv{WcpP!HR`njkedx7J+B_
zVDX#eH`cgyyxZK?JjiXD>eXj2l?l~EGax75uQ%q4yfPKnlHUwf-}{0mkF3pVE@p@s
zdF$OUZ`RjHjj(>W$-K2eZfmOueq&>GQN@M*laC25i929=Ejt-68MTgzQz&s(+QND}
z!Gv^O5OOS;@M*5|22&2rjL*I9AJ1^Xpa<qCax(kx&#wuso#{S;vI7Kt_fzJVha8ao
ze7Rw}b(I_4s~SCsD`#8ily{_6@QhaE;*>D<482*-Mtb@)tlzJy$GLvY+m#t%VNEFt
z8s7Mhj}PtD90kh0TwK;)c(<~=@XtTWzLv*Sh}Xm0r7V@?Itdc{^%*cydqWw4B<`W~
z?9A&zbG~jpTx-_c{q`zL;c&F{y_Oisn?-OlOV5YFGG=#+{31Qw-u&|<Z0M;kQApmB
z=vb@PGLB&p3Pl54S1evb_B^HXejn>jIiE9?tqLJzO(Rr9oJDE3rg{{IpH@7sxYART
zh44MZHq^DCBoL|)KBX?@ud~Z#k&K2ZvkUd6yYAr4dG+q9B6MImLq-w`AS(hjkW(EF
z1c36)|I8w6q+apa75B3ETL*jwLyhgRdw^y9CQiMD63WZA%3w_E`@$2jmARCP=1HQP
z0lALqH~i4?MtMkOd8NXe4oK}^O*P76{wW@EzAr((&4K{oiZsff>5QKzZ|Lo%IJO`{
zzV+egxWCx?;0hZa_&vj7&64hf|IU$E!FalE7;;6Y4@4-Gp^y=C$oopcah&Y74WsgY
z#lVg-(Brry8C=t(wy=*l{<N5?{tw@q3J({NZJPGTf7y3h_lfg{NHvy9|7~|jd&In)
zFwo9tUTjIFlL~ei`h<C}w>x^;O4ZYl6lGH54|}IF`zg>N(Z7epVH|I6m8#|PblHK9
zv4(zyBO=}tXj;!f=l|yoT28}ZWzg5G5Fw9Vxw*_u?w@dThqAb<N)QcD!u}S>dO<ms
zAo#ODYzTy$;N~f5cfMP>vKvRB_i+4uRv#kN#l9H)4q2`^4TVs+{@s8gm6gmAE&&j@
z-b~=5=H~Su7<mXQt4rqA-Xt|`_2cjueI~D9<mz<DD~M3(?=<ndex)<BPHebC)aOq)
z)<9_2a~5RskmIeh_9|i`|KF7O{~z+)5cp8twpQmw8hGU9b^6~oB24CfX{3Y^m<QTS
zgKMh&2ze)oeP5@2IVHZNF@d25A_4=WoPodmk=ra$WybGBxA=Zlt35SoxvEq}9KhA{
zy0_}z{0EN4@&OJtccnN6FiQQHOQe63%fEU-BzGW@I4#p~*bHiii7?IG9Wm5Z_hDqX
zKJpf%rb4DHYAd}U{LAk4kJF3t$Zx4iD=mxsf(?;C0e+FgN3r$H^#Qu@Y5mpb;K_d)
z(fRgVe+DK}WcRVe^HkEN=~QKe@cfkLAaR5imxr)sJtoYtd!m4)fw3+r;iv^O63VR=
zJ9i^0kx+WhcMS?Bu*7f>Odj7(Sc2I|EQm{=3)PJOGM@Tb#`Wtwy5W6)AO-gthR^gT
zeabGmG7?*WlHN_~E?k7C&GH_kRcqA*vj(^2Udc&;y-Uw<gdsC=F25Z4JcykSJmByc
z+*&daV!k;4iF8YOYD-QizU%g%131syhiD%+@u;eR7M&N$RKH?5%$yln=gRUxMjJdb
zy?tOcjecXEuGQ-Iytfm;5$zT24*K#^Fn!~Qf=4$yZCV*CH$mmjPI*b+V93q`lu<cw
z8Q;K(KXe6O9-O><Ax-KJ+KcC(N;jPU{YwS_ZCcu7G3qAdqV_^p4}a~On%R=(*{e|-
zjC9kpRjTm!(c|E&22(DUbem;Aa)RZDfB-|4f2!=AA=j(Vbrp=uj(zw}L%V;coq$p*
z*{7P?RE*@HM|%?dZdeG7IuG+#Vmm&FOND{5#^r@%J-&Waicrxne_@Q`^6$OK#n0by
z!bg%=i@0<jgLVHn(qq4e$or6+HFsg>%8OjUk3S<>emP!)N15m?)kH1-<I0Hr8tr?0
z2J0g~(6(eWgQ0D>EZrQ_{Jrp8{LrZV6*I>Zd5w8{-#W?CDPPhFZRGZkKLRlz;WJLn
zM)<n89UXjCDm>A7<o@x+s~63hW~QGh1pCC7N+%`^vI`QiCZhs2^?hwIDS@l(YMOO%
z5Lfqa&Ewnp;=}1TIgV&_Gts^VxHkV;V&n}m=B@UcW$&4NUrGtk80!yUFFP=!b1KZ~
z>)cc9hD-sM{}{-~gGyx>dys-V`!6wvm^0z%omVhQ<IFAA{I`ilLVA63HwW#(tTU5U
z5Vbn30DXOXZXw;4cMyNjC4ZWFj*(?P_cfLMB^F=9Px7e4cZIR~GO({s5JbT<WV+{#
z+P;CT+D}1y)(>xWyCEn!<@MxL{TCU2Fr~Mwwlh(U&mPOYA^$v{-lB;F>+WCU8>@EP
zZUtb^tTI|&gs1E1idwoTu3<)0Ki%sef)w2GtiXrp7Wc1owz(XkMyvAc8}-*cAic4;
z-I?a=V^hx^<n>!7c;@+#K>y4ZsX16GjD5Gm7P9JMF1I5eBnnUfAJ>OAK2iWQsV*DV
z*F#;ZZs+jTHfJ<3o<6h_qg37rUMBUo$V3H~2qstqJYKiV_BwE<O9hi9;or-Oo{Acl
zeZ@&D%O~3Kv*}@C?nn}??_r3#UwwF7|FvmkLWu1BQcfWBlaU>R3fG^+e@4bJS>#s2
z2FkbHgwPdPexpO4{X2m{HG9q*tnamzvHFc5r~ggrY&!P9my~e5XCM3$+e6xqpm9vo
zRmh;zeOHgF6C2iPy?U$Ac#mS=od+f?dw<6~MkXlRL~6i(V&2XXZ_tVSdDpZPj^=s6
zwCqt(r}VRg4;Up5CFqa5l?4f>>e<eTUZA;mL<WHSlt#Fe{6m--XW}$eFQw^FC8>jc
z_!c@vZQ=ntF60tqDEdp-F<IyI{c<Dw@_R&FIE3?`T|$=|c-=YOfH)my<JaAcF6Q^)
zT6bd6OLoLFX|5@d?5ST9^*!p~rX2E=y9Fi`e+2GG<G(>@35+BZxbDicN7191@e?7+
zb0W-7H%mxZWp#p-I3^I-mT)#8dfJcW8iks_yRy<MEbA44L(AF&DPYzGa;pyKh!_Bf
zh0J&=a=UH8>k9n;z$R7VVffzj!O~4lWnoReN3{BGw!LiXL@9B;T5-Uoy~yleDk#p2
z=94j}HjZ&PGDoTXiymGZV3#85$*F|2>nx)@8G3wq3)`;3%?f%PIFDVF*50twnFNHJ
z{F168(&~s!k|Y0@y^w+v{^>LL6BjBtJSI1y0q9R_*~ULN0ymSF8Gf^}BUB4#-vI3`
zIm~$NkPs1|^MbHcPEXAqDv$u?mv^XN)k{vKq=6t%%Df&I+y5G}p^99YvCOi5QrH`=
zK-ls^$N4739jKGelU?l3c$B&j?Ss}JEPWO*U>I~WSaRS(4e*RZl~Nq4J<6tSwIQID
z6Js4Le+(|K<o_9I(0VRKG+k-JQ_Yxyu;=|6_UYN2l>|B~PJv@8=5Wr5NAagPO0~WE
zH5N}tsiXo{79(~(I}5dtI-Zm&oa2lu`>UOxEP^+>S(Wtw(!)BCe{IQ``dSORIec=l
z#sYZWVT5k=U<F*PH;Rdgs%=a2l$Q>AG{Tqr*CFRJ-4lndD;4^+X;>|ye_M~@8O6Ju
zAIqTLqmk>wtCXx4eg9>0US*Y}>sClXe~<x0yO+;s4bEAWK31-s`9?sSn!`Jsh1igG
zcpj$Ub6g<_l8a4#ldhsuCeq@_pj|6WyoUe`R`>q)`7F`B*4pZH_WUUm#D741KggO}
zSPaTXnx6@avX}cFwLq3Qqyel~UP!illZ3ktVlZ{iZt0KpEs6c}N=vxDxeV*(AO!=_
z+#a&B;IV*j+gbT^muPuqtl4;Aw2d2m8ar7FcLxEhOrO#o8>h7RYOb!t&yDrdq=(1J
z2!HbfLaGWt5^6f>hr5Xm1DohU%7<RC`g@n#&<91YaUrBwvqcaaR%qzm71A;D+S7#w
zoy-Wb6xyeG=M9V7&;Z@jxQ7g}bc5jLn!q<Hps7+9_)Cf^PYNy#T1pm=0u7iec@JXw
zYJrby#4NmFjF0|3GEf;;2Fgn@BZi5mWe@hX8RhjvACCMl1a&P{m*mUKVqQD3WMf~A
z#Bbqanb#(Q)1@As`~)7ngGDxJy_l}*!GE^b*D9E{its__PM1h6f03dQ(`6q2+1fFc
zPqurWP)3*a8!&H6V*x@?x|=_Gf(FvskQO9q5WTXtZZq^PU;%2x#=~}s!+ApiChW=m
zC|IEs!yHxL#|+5Qp`_Q=p1S3|KIk;xp3(#e0sld=oEAY}Oi)SDKU-*7)bG54y^{4!
z(~;;@BmJo1vuqhjDowe?XBNn?A<ESU+?|(w%U7Z?V9y_i!M!?@mo74t^4I#kaK=`_
z?bk@3+(SGyQ?i_|Z1}CnvBQ%#Cjnxyvif4N4W&QCC6m51!`Pb`Q(0gwbSg_YF>d!_
zr-J?bFLqoyghqueH|$Ws{&dB;Jvs9V9Gn28t%t95cV1=7#ow#J6pS7&Xnx_&P!;)r
z?q9AdB7Z7xA8ACG(N`dENOcc4dE^Pco+>HR9UZc~Xol+O%Ohkd-g!b&XA!?bUiw_9
z+ub#n5zU_AmAi1>p}{B~oxL3N1+c)97d!2m3T)Ni#B@s2FBfJAXbmxf1v3l*f}yr-
zX~f%oi%j_oh;(a(kzvUHFU+kHN15<{vysY4Jm2pzL)ZHvyx2{l8%M6rM}~gvK>FEi
zUNNU&uP=QL6JVNFMlzR<jAB^*q33!V#>fCMO7)mT5aVD=jcUqKSLrX&`U+=cHGE-o
z{51YE4+v1C)Bv_1mZ{!ga-e`>W%z_j(|On%cG}{o*neqqvmeySv7!GZ=1Tt0?v|gW
z1Fi5ZjqD$M=?b-Wg#-$2CE{|m%XM=~Exv=JjKwU7w6W8w{(XW2*qICQ?~{ICntW?p
zuwG0w-iYF%o8!yz(qS_vFt;w9txOI8**Z#OsxKr&UeYhUj@q7=SdZEOuG|m8Ke@lG
z6D|6TTd^dIvE)+KUFn55eq1e{jIwrS8rv@KK{M1Ndcb*WIO<B}btV-vIx3tLx+|dP
zjYo}hg1%7GY4dv9L-@eHufDvdwRHBq5@pFBF|Ta)`u49(SiEr-TuOV;$d`2<DQ2&D
zwLkZAg|NGaEC1pnaJ2H_0b-iQ8}ohpw75nC#P|t@i1-r1B#E|1m!dB_^*-C67)qgT
zv{2f<+7^xr->+pJSMUGU(8~h0ap;M1LYvC8AF-$=yFVPd=Le?0f6JLB7Wux(6X?2t
zJ_DUicD2OJtsgY~MIQgx)Y^8_6ZZ~);PKVqm5QW=ItO=Mx_PGWYJ@SK?P@`n1X1kt
zEe1C>4k$6^8Wk^=c7;8evAg%mQq5S1Azj0Th01~Z(7)IBL0Yi$3SiAMAQ?r@C-}#U
zny0g@9>`C^3$e?&3}GoK_yz^gWyj0M(mTCr!4f*}PBZ>@7<IR**!T5c<P?#ZwqWNQ
z_LE_nFX7=--<#4-AkuvFugii{{dN}&hbPDs)bS1^Hx$DP%WBA&ga1VbQYCWEaf{Wq
zAGo&`!UO8+2hiAT^}aEb&716+WM46xKfzkPK?M>#1q!#fLr8k_Gs8HzJ3ME9>xE#e
zD1Z2&3NP@AVZT34I|{!z0u6xcw(?Ks_QuB15n5dSzaT*MD16cXlRX5_j=nC&X13}w
z)j^3fp&`A!-0VQG*JCOthuY9MvL%7(O4fiNct(JgVUyDxlztnN*^on{a}_%u5*lHP
zGBCpw2CyYQiO=AU0=^Psn#@e&UIwr8=fpfFVPF4o%*RrkR=0s6UJSb`%OSd#l>7JI
zobIV8n{PqqBVUg`zkjw7du2o`x1WU&;QN<;ZQ5dr+P~VXX?$$DiwoHIyIg_JvoxV0
zbJ!XB<`CMY6$((N7(rf=tAaI}NCUVu+9Zs1*pD`MJFRFOh#VhiF4Kb57iVlKAvd?C
zk;F0wDuY0<2>p0xqXI%VSr%F@np3ouzCsftVxLN{+uReI!{vXk-*zKpgehlGbD6oy
zlldhk#H@Mv`~o3Jg7h!-;Ar#Ogvtz9Pz6#J2Es!whL8^0Yu3xDEG;wIPjMWUDe^2s
z)t7;AuG0o`HpNRj5&jysSkRg3pAnl<C>@pgE5|S4t`<CPXkQd=W9GznXf>U`X1J*T
zO-co?{rg0_$-72%2gqJkLkiD#%X}h0Wrka0l)y_BY?}}&%C7c%v{dHBJYeisZ5FA)
zB;&09EPe!ldtzG;!O!ss(d*_fS6Wi<60naJI!E1aLK1Xu+2IYIF&x&_ag>xHA*}^W
zdsOF1p#r#FtyaGu_t$1ne+qB#&<?X2H(-3FT>e{g-HJ7)(*6cDX^72gH0bt-vzL>a
zpbibFV7uO^Y7s(1v9EecGWEG$qD9OJzqi(IB$5!g_NEVkA6Df6BA>4Upt%oi>V`r=
z6}4UP+EELiZAL`?X@s~70Lb|k6(9}`bu_t+%W4acSmONROW+FV9@YP}3_2yDOzQ#&
z9`OjDNc|5BkTt*v%I#|ltZg=K!4U*T=Ie4ezk6Q6Wa&oaf`bA>*VDF<v`3AterjEc
zcGIr26JudIzaKrN+*XP?8OG%7tXepUue%|Tjb0B&E!#r`#^`9@!#SLXO8p3i1eK*d
zV05NMmM9uc3E$S5PA(yJT46*|gxpj0dQgSA>;(O(EHrQQxvBCw$Uhc!ueh1y`=qag
zeP6p_Z_s*Js9ZKH%+x4EtbcwZNZpoM#_gPQVj=+mC}05=w>Gbi^gl)==0f5HL$(Ig
zpE(o$hv=J};D`XixPBJ{evSeb5z(e09OR1{88D{Gp+*CQUCYv)-wC_V1ue0kDxJSY
zaw@lC;4B60Uzo^~u)e{$*fc|XH*g=U=o#8F#gqI%NrFh8ZHMgi!<p2oTv0v|B&fWF
za}^L-vioMJFp1@pZV$I)8;klU!{VYCq@eFaCAmweP3}U)sweaFo8N(^R@01`k6>>+
z+=p;?We=5s4-L+LakNecolT5du5Fr-D7aAfM*S1f_S6vUj9wM+(`Tu>o&s|uVyJvi
zK4q<$Sf7&BOQMDf0Vu`T7S6!SWyUDyzfHCo)!Sqe_o+{AE`*HIYduSh2sskLn}7o2
z9V^4uu1$!3(O%@6wVu$@_3TdwR-n^VZp7lTe*2A!Hld2c9hdD2T_}e{Ck3Nq5^J&L
z);FepaAvVMt-Zt{3-%iCQi$A~ID5e%I%2!Y9io#?pet5*nZ&rc|7ab7U@S7no@DM=
zLB@Bfko-L7fh@hy*@AzIPf9yp$vFal2OoS;;v7J|Q#hb+9iyo{11FyNa41W{^ZpTs
zWC0UY@u|Tcrd#s2Cs3DFr5_$=h1<}m-8%s8tBe~+GQU98G!AKQOZ<C9skry6Rfs6O
z34zym@YITrnT=gfP@nEaHyVpK=iy!N;?$Lb=0**l{?8so{zn`FCm!ZK28l>$My22F
zUa>Xq87j!)&sK9rxS^qBmnZ~DJLZr8OHM_WhKnzKit4s^k96%TXmMMgI!(lmCVG9e
zqCFN+N3c18-e_olu$RVq6g`SHp2qEUW$jU4AtM5$$S_%@xN(SNTaA|I(h5mwVE=Cr
z2_D@<lfL(r6qV+OA|gwq6E?ddlr>pb9pU50{Un=UWI4j#)OgBmPCP1Hh_Z$^n)Pg^
zEKVVfMz<&ymUs_jIHC1TFd3P|7xAJ8vb<0txRCgekoe7)rq;_aio*Ep?2QR3Iqr{K
zVl!$!*CWA_je0eJp+$9fmH;)Z-81d;9lb!9_upaj*osbiihVFgn+vCi{NB)u7uns9
zddED-5dC5cr|Uz{G#8#YTfQ7EgzE@so>0myi<q_>!;8O&Y<hC}Q|~OU<1mY3`QXad
zs<%sgog`A<?$ev+8uGVxCbJSI9hV1#_pJ6KJqb&YuJ2_-a@Dh4pSBOS3xqILl35ZN
z(ddec3kg@13DLU7N%R>HbbRXXA5)t7!MAL6S<JXu^huUK*~pp0UlN{7vC}R0Tq3_+
zKSkhz(sLlY%Tn8QFen^nHhq*6Ts0^Yre9b7VCtqgsi0<DwWkyf;2YZ?W+iCb;Z*&O
z+(kdqz!^5yb?1S?R#9g7o`&Pfpq2S8%QC4xbj00Y;1F1l-z?$RbyK!H3=GnUUoK@R
z7F1(pG&)60VaUp@g6VF(fhSrWkL+qu^^P%{ET!;Ieb{~blrvKro=rYy|C%8B@48p6
zG!diK5bXJZtv~NPsLa75VSxfmBG@YKqw+I^pC-$wuV)=$3-=4m|I^%CaK+JdZKDt@
zxVyVUaEIU?EVwhcTNoUI2X}YZ!QCB#ySux)9q#*i-fz9<`vd3H%<9#vx~IB&&%R2o
z+O@ZRtoN!JUf+Sp5u`Tg)GFt1<Py^TchAzy#NwQTO^mw47KN^!`=&a~ENHAw+H_!l
zJW<mFR}apqb@z%N3^&wi{A3B~E;;t4J-BR7IuP6!=#L(?D);kpySj?nCcw{@8L%-@
z08uIXhbax~U|jTu0YhswoRLqfIfF3ZbGxht(F~XjGKSDs*=~X5XQ`h9f1CCEO=`<^
znr63->$cH8W{r{59_zOqbz<<D3|%mEDh_!1j{G>W1PK{M$GLozI+uocwE4dBd~=N>
zo%x;@*b^7$w6_{VbL7c5<uGo7_Z_I?aVAsJ)m@Xnh8RyTren~-{MU0e@YI%7I|0SB
zf=t9xP*x^DQgppvLW<>H%?W?J5jA^v#jAqh$ze=F$JI|0z;=0x>@@IdzN}e2gUc~d
z>d|ttaqO4DlQmv50AWIyW`7_!LnZCuTFWHjag@~4&piTY)*^2>7C<FGOObArRzhav
z21Q_VPZg_90@#jAX$wtxzn_ye9MCELX34-(bYx{?>cB`t6kt(X#fF4+GFi4x#;3k}
zL1pt8-QUL`locf34OBPxY?xQVy~RLH+x0T32zG2aSuQJ*z56>xtg0$5(q5~Cx^7c*
zaU)p6ndhck9IcvV$ElRqCYMCsjKGy$nOXd~0WVBVF>n`FSP0JBZX_$MNYS$rwq5;i
zQa=X9AB1V6A5YENxqgN2DUba4bsBLei0y#HL?8J&Y19aY)0c#(e75NWNvtsZ?YwO|
z5ibGnG1loVy<nB=@=a5+6l^<W;|(sOek+kVvu-8n7mz&qIxNGh){%bTF9vFuHkGSi
z5F*ecF!8qiY<52wEsYN7v3Y!Jsf}rPp`hB%vWJ68^Eu2Nj@Y*^aF<Faw+yj1zW{Nk
z5uOVP^js!)<9Tg=w_oe<09-1Rj7BMEV!97D?af)ghVhabWA76Sd;jTOniH1g+3j^O
zaQ$P4)b&2@>cn)uOU_O>cH9#v+1)<O$)SiI68gRWJ_2*x9^9y=fG!zvm#}*wNw&Vu
zIi(*ML2J2PTRqh2KLqV+2M6*FOGa}X64;Y!?W+TmMU9;{x#PWL3U;>mT)?#I7h2Y;
z(=j;q99qrU%wgnt!^@}2Q=?947in@$+jFax@G?PiVc`AI^W|MhE`I;8LEcS)hZU66
z5-2nEecqPL4n3#!F-=kDcDFXUwfL&MTo{6MxBA2biuS+?JiwTgMILK1dFGYTIC&N*
zB}8frOqjc%9<hR-<Iz=i5l4_6F^a4m$a^$>YwB8y1*Ox0_}bl=C5_J(po1}nD|XY`
z$epZ4XuqWJR9bxdR9?0Lom09cFm66c^aITy<La0C65LS19oLOiDYzsTy(5NuGB%sC
zb-NV9321BOS<%4H8t7t8O7A=5ZwlH}yEOp6Y!_sq%1#8^d8}`RFv+t2RjYw>V?l`E
zRsiM?q@=own~ExgV?IDpxq-q3^lx_Z1%=Q?iE5j9#7A-)t>nWe;6U97{k4divzB8K
z1{QO*nBg*gD!0q|>F~)kPD-#zjqzU7`A^N|mgI)bwT2zQw8NJMogJX@xkU?`(2-;6
zutyuM)r{;{e)HA60{6Q)_2xe-`Q}ino)XnPdz4ypFV_-I7(ME#txC$6v&6U*w8hLo
zS>;Ir<{6<0XvX<+chQYx%3b}qn;5<STbqrhXPJGxC?bRU*Tve$YnInVGzhx7Yw;@~
z!(iFAB{k7YJK%6tpAP8vS_yQt9Tj2!z?wv*IU^%#-DEO}$nk>F96LsSx4Z?M$i!JH
zp;MFNV$ZOYqvH{FRd|A3TKLa9uEL2hWiw25FE!4^lO3NEZc?&42{+{=$+~k&()09y
z65O@q^{{X@Payje@NS;i5ia}^Vc@e~mFaqL-H{@5srHe@o_R)B!d9nMvalnM^fC2Y
zdiXZqj;fIRaseUJU<lN<n{(JxgGHA%+Z7&NP~2!*-3yzKjlLrOWq*`0`IACXCrGTQ
z&l9noxV7a{f18%L0(p$I4Q{j_+nCqagC!fYho5lPD*X0AsexxGmhy?eUZdeVhaizb
zdR!f@R!VTv;osZmuNwf)$iyP&-L&WCqJG_wiKyL8w&|RTX^Ajvl%!4}qvF*0Qf^#v
ziT%1Jh#n)$^52cW&3vu$+OM|kiL?{YB|`6E|B>#apqEIsO8b^AwxGwVpwOkV->OdI
z?U2!B)Od94$x!z3dwM69i4+YFIuK@XV|Kk6ifYf3aodIA6uJ9>P;+6T`4IloAyqo#
zX@=&mzDPseB3&Q+Lys|I>tBK{TVjru4dab~O4VFngA@kR_#+%gh<efr%!&5$!>RAC
z_HiY9_O?BI>vNe)fb5VutI?I;Yt1ASLXJOwgha-=&F*B_1nhc33}UX(J)a_X-Lhb7
z>xV}}X=boozt$pv2#9mroyxw^gpJm&*o!+6WBJGq4SzZ4n>!s7rq9=UCu}iF225;o
z(w^twxm+mZ-2d$8rM@2eo><`r2y^sCp-VRF<l22I!gbm)CS6|PLagw(31|&Yz97*&
zSkmcJ9a!bgiY&O-QKd7^z;tvUN*#@-|4~JNNT7}P29dmIeHd1~-C<x3Djfjzy$v}6
z5@S_H!zS8bE*5aW4i+*xF&WNE5>>hAXftyssLqy0QfGfZ)9v70)x*I%8Lwj0sA5Ks
zlv1FDP6R!z+k{>?UE)yK9rlV~A1Pn^%C?-?JaLNdf-i79P%wN&JSk%?4Oz)|g;K3q
zo<OnnE=usCuw#|YY?Z=~v(z(=#&Wvdvz@_YH=fuxBbYfxyke0Z?xZ>(Z_leKz8K+-
zN=&anX!r%zRS%_45C4=SA|s)yzW@9><me#k`SV}U8Hd!pE$`l6o9z$TM6%h)cL?+C
zW=smoRp7L;;?m|#13Q8`=@0lle?yYKR2S9dpUxCC#?_}%HVRSguH4)~U)50Pnpfqg
z8&%5%%ll+MtZ1+huZ#<y{V^0E_3=#*#+*qAY4Ht6y0oM|UC~_+q;q+6#zNW<X+Vd*
z`)xxvuS@fbRN9uE?Dso*j58W9*W!B5GCs=eVjE`rMt{x3)q;;}bkuT%>@KS4M0d#s
zB6!!Zd7XF1WAEt8*U;c-|4lwhOHyoO2puw8F)XC_c_N*2-;$e6Z^-5joHZiYLHpg9
zXVyAvL<L;_lP}-n)D9E=?D91wG8vxa1y%|K2_VneKpx1b+TWPoCjY+EH~QdNm4&f`
z*Ec&|j-+Ai%6U?3(?dVO-gYOlN8R9$n$YjREL%j=Hm)k_r1usEct_t0Rg^CoXyzIE
z1{GvZ>8>h0-$fw&(XI#D7=!B?%Y&2p3xqI)WAo&M{}P>LDTIn93kd$J)ml~VDQy<>
z-pDCMZ?&p4-$n@b^@)Kx)+F(GqMDzN$>7@r#8P)ln6|SC(~l8;a$~N8ge?&fnG`f(
z;JXUeH$}Cgz;Xv|u*t%z;1~j!f&BDJ6Gh#b%-0~h>(J3gX8mB8x}lD|ute{QoUZNr
zuM-`EBesXR5k8aQvO;cY%C@BfHSv2a-+O!1%^jbI@qX>&BSHASnv)I~G#zj^CKA*H
z?8dT9Xe|E<dj8ym7JGru3ks+pI~t2;Not5L<7-lbcpT{Mu37Ydp}fv|cblhVkyq*1
zlFEc3A)yv&su#wNi!ALY@W5)6c0eBMEElL3xj!Z8I48-3$u`mi282(){UQ|xJ|Tm~
zNII0d`6Xpa?O2h`CytFL?)LGKVXigYc@2<-i;Xayr&^q>rmj^r-wZ!({6~27A=Ic@
z@t*<ZJWi^rE|lkziTJev=|*avSh0aswVq{>=~Vq8kv^&sGNDC>wbFy8{Kz!g!&;4W
zkr$1Es5R*HWJ#*x6c|~EH|;Bs8%a;YTKBs(_vUcKY!p?CLiO)syYdp($VvF#!yrSi
zJ4sB3G>pn@#g;$lZ88Tniu0DG3~$;Q`6g}eLnM^@ha+qIG&HvVMIXdG6X{24X4Gxe
zU%!sZT|9*Z53IMcd#mf^@7I=hODC$jDJKu)BmIb1O43UD8_z?&sub|T8%L>;`zMI|
zJeab)`R(t_Y{#@e3st@Lqhv1JCpUo!>9z3A4>@iOyKoLIHye3N_8n9BjzmK(pw_B_
zOL;d{jW8<xt~9MtyrAmJ-zwyf?E5yN=1>)eb1aL_*cZs(H`o@nGxsQ#0e#<weixr4
zf4W^tXyBFq(y<t>5Nz}+b;#=QE%#DnBA!I<75oCJ+c!t?i(KGKBP!jPisdZ0uWe<H
z_8;Vni>^nnpsbfX`JO>pmJ>t-Lg*AY?1!Bd-68M%4z#%S{ye;*3-enjCg#D>GPDM)
zsVZW3K7#|>d|A$$S$dpK$T;XcNuM?bh`JECZb2e2>yynq!KM%71}y#x&932!ru8pz
z1Dit+QW%%Un>U$`n~u#zh+q9&Q?GE!aGE6aW@1cp-N)z9*-ghY%Q&=HHhn^aI4pib
z3Zp;@|D=zvuQr5uf5DKqmi1ac5`_c_(`%>Z80n-M4caa8L4gt;;S<yMGron4c3c*S
zNA+H3Pfa7BVs)1Uw`J0gNCS8yYi|xt+Pg}|4`ZFojY@}g{)8{30+0>{fbUx8g+^Oe
zbz2VetSR$6bbcgX{YWyoXIYXvi8|Z<B(SmAK#AO#%lsW|=Sdv%dw^(b9S(uF9}VW^
z4j{$Qi3<#UKHsyGd&+tq#Y`pdL6cRcS=*e`+`j+=Yx$X2rH=n;Tk<V6)sjV>4A5|%
z+{+q(zhVAUi9sJAK4X!QNA~%&uiMfTOel5^kG5YeR}^6+?P#_0z*l=%tf2gE=$?ik
z4TmI7Pp**M&y7@sP*`g$BER}&CyRax1_e^dD|(pJTv#YGG`<`Tls-s}`me<Pz4njj
zq(ln?R-ZvjH4eVHTKduh!-n)_4Q55o-A)l(J#ilY=kA|;sS%Q!?zavl(>u#sEBYvp
z+FL$$k3Z*0!udhffPLM|VIcPv<}z>m+U&V5Bq;Iu^h#!?_)QM-{nl6rRo4?_>D>Ki
z<6CnBMMS1pW{BCcda{7J>MBWQSNKhSHWyh;J^H^j(*SepKQCV}s2k}<hRLp(bhVl6
z<OuktGhV*xM(3o%;jQm43fIIjI2xJ2jgS{<^_q-HWPSn*H8~2EB-7b1aRhd$njhoc
z8oQ!#tn|ZC9Rb%b$7b{3D=CcnxWSTsh_W=^SyO-V>!PE$2L$tnF9G?1j44E*aYT8K
zXc;l4`KKE+t`KUb9SzMC5;U$`iG1pr<&0Mr7ZP_a|DrD<oa0$NHJzwM9IOpa=KNqn
z$o;*#IIZ}%<`)0z1zjC`*<{AAvp^)S>Q$rO`a4lGv(?3*y1!oe%1b-PD4w|8-{lAY
zR>(*2fM5Y?YlA%-lQLnt4)ggjduOE#{Lk(FDR-!@2(8MBMLa>b-Efo=c4A0u<x@vC
zQZ97wUDe=)K=E0DVtOOc=ydV5+4XP{*;#YxHuP1#34s+oy4ZHmddRJ@R;#?c^Uc7K
zSIA${?^Xz&xWC-OU(lZh`dlU&9=&M}*A@S*ErUv`fD-#5Bru4B6eTlqN9{ftYL)vB
zzQTr%fFQD@w{QR+=@FPOAmrnVU8A_akp0?bJv{>I0*cZt^ElE4B9zf(|8Ga{KNWNl
zAw?sZu*w^;Q#HKe`MXXy-k?L`!I)-@%0~YUrT~ll&u|!Af@ywjB*u;8JO3c)YwmUo
z@T%`<7wyAkpi3BM7Wz&XoP->_)u+4V+czXH!2uC2x%A*xJh0*=cs{+s0fkE^xudeM
zmF-KrK#$f2xEUtQ_f9MFHnuMU_+3GybT}U`?XwP)Ibs|0C_N~*hkh<sO5mH9I?Qq>
zVTGBSV84*gb^C%l$=f$!RB?Il#XqoIL7e=AT@WHn4W9n>4~T^7UpTZ42fjI%BI-q0
znN_><*&fIwn}NZFXZb5dY<5BLia`U`_Cu5D9ZoOLWSnU%4=XZ)<*)W$$KsJEs|2la
z$v{S9rs=W?&a2SOTfLyKmqCmqyPMaV<?DeSZh<d4bqH&5-?rKMKBKBQ_0$kg-9ke%
zOEy5Z`VnF=h$C`+593R!@<jJ@q9{@96fy;hLFjY;1!J^@G2FvirE!<7rb8u-y3Z9i
zX5ECv-?>;UU4a)}tvaC&u*$dS%kefFB??a@GT`|t%^^XKYL&zqM|Prt3Pq_=o?M?4
zAo;@b*g+jx(T$Cr9anXLH^$<H(=r=KFu6zeO62{9`TGdXDALvV+peV1I-|n`RX-xc
zl#X+z{5{mnjbAs870s708uRDmen2G8lw1#PN+$MbwOLHXzOf6frYIyEfB$W|ave+~
zmIenQ$S}DYVau|8ti+ll+qa8i(1izDL1G3+ZaK2~Y*UPb>Ys)O1#`Vylb3i#aG;(a
zEZW0x%It94HyVBsCjtRHQ!nIi^d*`rVdPuTSM@d)T>0E8bLMMsFpI6g72Q<BHv-pw
zz>R6&is2ARJU>Xx`fYL!s_`=z!u3TC(OI<-f-*Cp-`1Gb)jdxQ=~~0#x8Ntqv1_zJ
zE0#~9;2TD7Tkx~XL0|>&wo>Kc%eazr-!plxp-ybaBvCBW!w=u&g?lnVE{f>EjNl3-
zyD|6()l^iyt5b4y0(Y9&+m0!CnEOy^3HxY<U6cMTo2#QDECt?yXYkUYJ#Aalj^G)F
zt9BFDcdPx%3PMgJ)Se?csyF9wonR~-B@GFzp?*>$Xp&@CrmF1Axo*!r<l?j8Pjv>T
zt|1dCEQGSn83e{p(|Imi)1G=J3FmG{?6!LWv|lC@sX&pBpvfR|5u0?NLuB$TT3ur`
zk4~vX$J*r$_aRyJ70zZLNH=^^YIM0^EMKq>gWb4VIS(%Cp8U#2;WNZKCDa+dsE3Q4
zzkXpa4;G&bi4x2QC(bOv1UHt8eIFq5_Yg^GOp~tkYAvio?{^yP3^OOs?%OtlZv&yW
znCg?aEMbELPPr*LY^>DGpYyB2&soW8bRvh`=s1-mg~jvyg<p%~Ca$xy<Rc)0S`SIm
ztnN6-q2udv2u;Q8qFych`u$+40!j(=zyE!JI4`&6InD;bg|2T`&IpdPLsw*F^>srG
zb_84Bs&F{tvpGt1D4V)WQV(1>5zGa`s9r!e0T?%CgiUQ&B>fY~9bZp|;Ta=&$My;&
zXBTtlj$+Vy=WufbaU*%<m#DJ7<QV%O-7B&v>BwL(c~!so3+www+0gbigW)CZ!NFi6
zNxu>LD14_@SY_L9rk04(3|`>^%P!>0uEd(?HQU&c5d=F$9L%yawDf56BH*PR9P3^8
zZ%Rcb=<R-4<cFTo-f6!<!SRF0vH1NSVZTcT*;UDt?i*)_g0QSQmHF`quYLoL1U$Xe
z<*Re($w3gM!|;08cnjP>RNH*PzVw54NouZ=iu6XGTtn)7S6al0jRf*J*Y>{q#L!61
z3_$~eMN&RJF*>Ltf_V@d4W1}-pw+t2ve8BgLiIDMY5m;7IOHPAYV&O`yYf=}qm3qZ
zU*2`dVz1C!CmtBKn5u<fNyD)(^#@_k%6JGwalUleWSFf<!#lD6=*QzGtQF4aQx;!t
zxcpx*zlM(v!|yNE9&yqVapfB$-qh66qDrTB0FlUskU?AA_m6iKtZmP@rnAt#v+$4m
z>~+&dd>7%k<S4D!K7$aq*R22POdyEI6+bj-z!!5joKQrnkA6UH+*DqQs4MhAZG(_p
z8mejo_rXJ>=-u3A8WA<P{iY+hZ{J8LzGQj&S*&fDnN1%?2!VRgnVU$dP=MF)LVw_U
zFd0)D{M+N*61SefAMYd~ZM%*(s!R~TnpQMjMq^K&M3ikeOR*5Od&VDk2GaXY2va*1
zAJ@WB($#asvALam5g60J9h#C&|8Dl!ffIbup)9^!1YWE``ttrTS>f`c0(e`cYevaW
zNkmEpWwv(}Y*yNr;L-9=O~bO7$-lnM%UK=RD6YVG3trv`+aS|$m%xQ;md6+8_7y)|
zN?W}?Q+B}8z15Mtd8oPO`txm%Z>wd}vPe$r98F2Bg5=b?xx*O!5Bbyf;IT&FF;h6g
z32O6`0m|&PihAE>GU-W>wS3_S5@2~KUx-X6`U8H2c(n<TZyxe`KB9Xg1=x7JUNd>_
z#Tt3UsZWag6C?cwb&~$mbM`n6eUf0U-=Qx#?NvzVQJXQ}rV&#F2*4VXsxS7Gv#<%&
z$vC|ak3*w7BU+KjPOzvLyLZ)Dj0hwmdoyY^+7Z<w+|nap2N}6H9(U2Oi_D{=VFJ;u
zxp(nW4<tk{d+D2eu)>(gG=rBbu7rU*RI7E(tVo~nakK4x5reHwR~=HIubLHkyAwr`
zAV#{!M-Hcnn431gO}29yJtV5D%6?CP0Bd0Fr85@dd^+|7Qyh{>I9j7NF!az_4po4N
z@Fp+s`P`97>cU0Fq0AAx)J+tk5I9aDKU(J!Y`VyKrW6KxY{r4c#HiMgRuT_#x$`C1
zEge};Ca*C|fk^iac)ULNYcLwas{XHfe@a;+jB&;bJ>{PU%h4^zs5VFmkcj3a7iNm}
z7v6Na_Q`D$?dN7O9e2^Ue2E=v_Hn&FAJ|29gq<%{x1isP<E=(A$g3~-h6pYVn>O7L
z>0exA4rgyEtpC+&I*>ox8T}z^49r(cW6P;N_<MqDO&*R28F(5)`sX0I-{4Vi&XptL
zoY6o?eSN0-RXT2v*fG!-rb@8MnUccrr-k98DQzN8o|C#9UU<TU!98^#c5a&Ys^p*<
zSeKK@1Q(3`eE@>^hH}>mQmS=va*mr?wiyfw7IDQO1R+?!-z#sR^dN`XDB9<wyr_|o
zT~m>zWRTI&`Lf2Js_3z`I~ZjFwRdG(nJU$O(LKkyHD9NduJSUm)X$Kc9XCKc1EmK3
zCMv!to|He+U+D56;aXd0Z(OxIS=TBar#1!;x6UOdWfXqU?*o(RYoN{)l!7#rIODu;
zJvI@}O{eI`QE~%Vr2f`Il~Ma=E2AO|wb+^{q^@if8STww_CK}&-OXtKC_KXXQa}@F
z<Ribf?F8D5A8c|QN4`czcQU|{9i4|f?#A!wz8qMFo3i$rZe;4hNnIpGagN05+d{M{
zvzz1yXw@aGix(9nfC)-^bOyTz4x~9b1T&5NtMa*io0V(A_6(31f*(<Kep3;Owv0(Q
z5ZpNl!BPpq&Y0F~TN=+VsmAHDffsB;p?&py{U4Y_>Toi*7Vu)5A}v>WbU30^KTf;L
zH^8`@D{0-_Z;2ayU#-C|9T+@1uxFH7(eakBytikdEB2aHFDb;Y+)Pm*eYqw@X&;*Q
z!<$_>GN7Oz@!SI?&afvXA~$0vg4mr`C0+l+9%EJt%(5)v{T^U8bY-SNvuD?f)x}lR
z(Sh<OEKN-oLODA4W>>kce@%#Q)Zh5{#yA_BGy`Ti3pX?v2uaR9O|j#N=h>QF;J>(t
zV41(LEN-Tp7KDD_aLXT=Ie3L{gzXitthj1~D4x*6<{mO3*bAZv&kE*x4NDBo^_ZvF
zaUnW(@y*J8tv~}rt~XCt#)!3|{oyI>Lv#>3SaS48B>ElEUtUhyeT>jYz?Pfx2X#2w
zZ-2S=y@JZj<qxVf|4vAhCc{8#oC?K7^L*{+%8at?D}Oe1!$Bb6Sv^_pb|X9?1UeRi
z#R)2x{okRxUop*Ytt4Q<Ma%*moSJj1V1nhEysj;T4Ry%W{@$12bG9!EM)rfe5Swb^
z_ly$%Y**#jP9V<sMsHPv20PLqQP(*757NgYXh;rDJBcV<jStHEtloC#%ZAHeOuQgS
zYs;K6dfSh%{J~J*m68A-+QovH!8amf;jI9sH!wy&mHhF@AqV&&H{X}8k)3FquT4Gs
zSo2V#ihvp7!#7T~(ZL2MMGqqlg&|@C6BJ0CR5QjOx&!!cRmQCEEs=8IdJ_pZD`rps
zz)D=(DGwF)HY+4QZnC-i9&3J`X4x|M_nQ(kyxtv4Im9DPIUL=4?(fe@?~Eq5C;ZY6
zoLQJpGdEyPU(_%!!BQaC#vl%GbtMQ!%ff|{DYFSKsQCY4DVdq}(r(4An7iNw-rY_)
zTHxwRp(seSOu}_bs@>?_JHt$}b}BzENr>yUlWu-_;o&y8%$O?c2s?yvV5o-5lMs${
z`i+Umy@OrBJJ9q`X5Lg?fw?2}A0t=oz(I03Grg@dT_pqTL1OG^jr6oEgYo}^LFH>d
zi~nHIe3XSgH3cgMfz~`yAk2<KpjLJm@0l$ULjg6cdVd$g%VU4ijTQO?<rRg;R{;!K
z0GSj`n+##lg%qY682T~XN`k+M=0J`%+w~tblJRldcvV#%26M>s3noXQieAdl%efPQ
zIjY#Rf8i$qE2SCLi*Tzn+_eHD*(JZ`JWp)fOxfC|vaah60l6Yg=I<DYZH3a`!3{8X
z=XW1Y5i^f~G3JVdMp;GsB3*v*X0|J#6{J%|V@=zMSjYj(?(MZNe})R4q1$W<WWx%k
zT)Dg=k;8-4r9zUx%Cx(NYAfk4H^h0t<L2;F0IWA`tA7cbxXH*!uI$fea;+5L{vH>c
z{59Y}iWkHKU|LP}W#-(O$-&XDs{afdsQvX$q*3?~u}VirFf{9(&Qm|OZ-?stMVATY
zovtim1X|QrpS=Q@-zV+Vw?oQEenjwsO`dT$(_d}95#n@Ky1H%^q0XV%8gi#SFFs&?
zwf}VGmEz~%l7JTQM`&}66z3a;jBknk2dBtLait`A@4W4?Tqr$_ZT0qi<g|P`abnIC
zndd8#Ewgytd{<`ggHa0-+q2=e6bW*Ug|EP@I3H#d5A=bI7`a1h>_6Qb{&vVj?cTjL
zH*<0*kEUqo+@DW)=cQPnN_&p(FV_C9Fg13$3Zbw)Q|1@{7v8sLDgJb*NQB?2;f;Oi
z2!&y;Mmh_!OsMcyVE^swzJC9cGJ^7mYx(ydE}*sf_?Gm`LUuyMA`-X9sAiA=`qog4
zfHt8rM!BQbkMEoA&Q9)HURmGJ+F1rq%_THM#oR+3;r<=pE1)}`5a-G>I{)fj^OBks
zz#Q}{-46wRzc}cIU~Jtop%i>s>EZ*Hf-B_eYEpx@f9peJDN%H|gzcJ)loE&-S(;NJ
z*M@1INS)g!)t22?G-L_puX8_<{g<}761#zPwtv<Cj%aZ5>+rLxf~roG4}FI$#mth^
z0t|0xgVUv*BLaV1Od{;<T_jtvS^7}Hu2me)^~;xn8Po_llnth_aS9GJYZufEmnm68
z;KF!zbLO=5{}n<AwFhpW##U(X&Y?2kGlxEW<`U7jGSfqXH5WBe+)3=e)R{u}UteDC
z|4pW;At|VQ|L@g*@(uSCVS@kDUjBRRS<XR1`d2*v`Bgx@C?Uar1pl9-)hA{6zYCm4
z`epymc<+C{<%GwZ|Eqjq4Zhj#fARR=8>(E2{r|)I{pTr$Xa65p;D5dB|9-E}^F9^C
zBIl|kq35L0@v*TW4_-5o^V2<pSw^$;h_Yb9wR{OWl>F>l99cLm2nF{-a^^gmXZ91>
zciCtO$T_<F&6%+B`@XoR)Aemr&QEWX-XEs5b&P8SWov(U?^ZMWMX>qvW*=bMtb(Hy
z3JZu+H6*WP!kkX(Ie8z(mvibd6M$snZx1CJsEtCF<rJ8u-vf)VlqXmJecXJ;kra7o
zZa(wV=f~nFEL7-3bVLl^Tt=3A^G!Z#Kd<uS^86{8?eH+6j?HCp^B^t3sX={(;QCuX
zbEWyxUCQ0ANk#TrYo~6w3fll{FOoM$6DYGDjafZj2s>SLq#5Q1<9TY8$z2ZjSzZ*O
zhxLdtPpdm$LMLCM+u1|~@L1uA-hNJ2uSO;{V6{v?5|6|E7QdELfZ+jSZ8`ko{$d3A
z1_vOQ=IL}XP5RE6kmnarF((0aqco5Iv=?+oTvu0%C!{=k%6W6JlQV2Nkj%t!I}`;-
z<+jhyUW)%yov1STb;IWvv(B@S4F{HIkQ1KCB4zzKsBN@#s;p8aOP8k{Lwy}YPVPm|
zE~{4m@mEJX{Bif-O`X`d*va1%a%kA6VgM#VUa+H=NV5Hd(rmg|hq`PgFR4>!sYzXu
z*p2cz#-=NpvemBe5C?D^P{xOKTUL;*RbXj}IfJoFkcHoR?J9-@kV|rT>Ef!KZ!EB!
z3E=RUGH$xpa5>x^M^0VBtF>$XxU~uo#C{VzW!)@}EYLP=jH)eLF<b9M#s!>SC789-
zN;=_&3DsGjr%!O{s<XKG?1eE!G3f0t?Y#+ssDwgyk4Uu#;?Ex(#xvAc%@_=CqEidb
zx_v3ZeMieSQeVPN&Tv)Alx<4BH+`D9v2L)mlG~nZz8!hYnEAAv|NH_tUFWhnW32T1
zT`{Ku#b$rpED&aLak^(r=}mEy=Bza`3w(cbcpqJYS0j!z3GWA;9goKNVQ!ahVLBs5
zh9u!$dns4pgqiYQaci1mcJzKo8HXnvZAMEdh)6S*R-R<%@!s3dj4nuGvbLG|3P?Vy
znJ1RZeC)09GIFPM<H$C*S?v|oQXyKN_r!f@MIc{~%fp0cD30bYo!GJs*fN+~isBvN
zIv&u%3leRNM^v&4Z42lvCwFPQcH0$2d3pWqVI<WW5b3nGQSkmbTpv0N_xEjmF|A)?
zJLbadN9t>L>Blrq*vjODKUvO{)je7I%f+zS)J8qXn~=cmOo?wB2e6d%!IOBKOv&T&
zL>W_!Pb^>s0oHclYhw|v>$=jpX}9}}I_u}B;1B$&A>1EM*$hT+`$q)LwU1xpCp-y8
zHCC62KqfEgXbiBvUMI}9Y>9O_Met^r^NL0o4U9<=tXNN~vf8p`1_o9fs$0Xyn;}+^
zt<P(po_$i{YOYqb!zn+O`+sB9Wg<m_Ly3E3VU(wr4rNP#Wm{jKm+)gXd+n?#6B0}x
z!rGfbJYRDRW|^Ii(o{O`C*9V+BSn&WVcr!I44W{Rjw}w`6C7D32x?fSJZ>N34ESMl
z7V(=4;5l$eWXx6vm+@jGCb4!7A3)yQ@7=iM$ILm~i(%GTbWo&Mhg51|>k%C-Iy^xP
zfF>-mNuVNhYWdn9XZCKi1##yKcMftisrBsMx8qG-n23|NE13%&evDDSJ0E*90pz6G
zz0TcTmXMG}A|r>5!&y{yCKGuwWH#_iF3+#eOWzg%pFj@Zqh1quHYxJkI6BkvY}$EU
z3-E&v`Bef$V$PcEX*No2;fxsYV!4<zWon2x2#T+#XgyFDG(MfyjsmH;cshu(qW|dJ
z>V?>B(?>RDIJod;atEGITG)J<dFL9wxYEmHm;G|E{PKWNDERI!PyRz)v+P1ro0)&e
zB%GyCy4B~`#{-1do~gE|1xCa{;5V#}rsjx1Rg?{_v!9CdSxrYWIz#{lE?)ayApUq?
zX)^EmXcUB{;4^5oY@{5~EY}eiAhLYsB?}|ek|RE$+EEnLETHAV%#E6m!-%6YJtm-!
z1j@$W>ceD+<J4QKG~)4jaHuhbI!o>R7%VwavN-lLzrEbv=gANVKO8=ZG6l1Kh4H?6
zh%hDuFi>C5E|;9?xRnfIhE*pN7~pPHCc<5xGmkE!;G~d#8%T~$Li=SnHlo*t;e}|%
z3vZck&3#iY<8{?*dN+{8ywqJ1gopbI(qncyYh(+nwxYaHthTx7g&45)nbjb*_?f$I
z!{UV*u^&{GuIu$TW{WmFm#jIwjAfqzptR9Y!&o_ELn5n|@Zo6t)>y#e0+hD$m{xDw
z$6jds<U+2OqWp2gH0OqgkFAv0wi7h^X-Z=#vp!7=W7^JJ)p5ggmU9n_Ocuajt~FPW
z?_K89$ji!A<<uv=4yAK`Y7ckpw1^G-h`QP@%kv8=MZLQ7J51F*e^_o|L$%-?&=3S@
zaRB5niQ9m}+QHX@#Fz8c`~x+9oJ{Zb=i47=u)}6izwC|fne@5Mp39+5#*M!vIvIpl
zo=#05qrXcVhEwV<HW*#CE!7HYT#hM>49u%1KAx}1XN|ibtUX}av?UKG-)~EfozYL`
zVnh(tQjB|y;trrK{HjZG`{lV)p`OM&Y}Jn2x7dq0u>!uyA56T!igo{s8e4#FrCy(K
zkbO|XJ*ieVmlE9NOue7=E@n#)?L;(XVsq>&yt){IeqX`IV;N?H@COHL;~$_scS?kR
ztA1Hd*bmd{(_Xu|%1LU$&yMS}ZT$iDf@FoRv7S<ZuAkLNolt$MqA%}u5=??A`_|ry
z4tAOOHZQ?a2)|Zsyxd27<I|oxp>cZ*f*La#uNH0u_m}i?(d(_l79<vE@>S=3#3-S7
zIO7AHm(%WSxO%<v!TYqv4r&~3V>Kicl7L<6`Mcz^-Cb1&cGwlbVfCd~RfMf)33`oV
zcV><lGkhFE3Ry%bPMK5Pc-ct80iG5by`Q$y1Fe2ge52BNX_Mdb|J@fwPXu7B$R^sT
z41)V>8M&M_qR|H`V54ro8t4NacsHBs{*g458d7s-%b?_leNhldDdOd7t&V-bRd4ZE
zd1FWW03|0m5cxmsvuuq9NG3_Iuxk^HYb+i>0Y!0e5{jP_XBRr&j=2+k&R;Bc^v>1>
zDrfmPGh1lrQb+pKAE9fEF`t+ZI1Ln-0A|#4vA@;hy;^!ziYm>=?1qsd`(%P{TunT9
zRfvi8wN3Z%Qm`xg=p>XPcJ<Em@c3OXt4dDt81MDs9XV<&swu*&PxETEcpWxR(|qiI
z^!IdFnCa_s)Ld)zyFz6=pZ+yW&Fd9tR_?@E*L^In;iWS##zWO-meQzox|cU2l3m!{
z5By-AloZnn9`B@Jbpbj|F@L>wCj%-u*uH(p`8e~yyIyR0IO2q9tmmyl8>CpZTjPy!
zml>9l=UH7R)={{<Epg$rK8UM4FyY7I0vh)@@7?#R5>4KhW~#GqmaN9S25@BImtT*P
zu`Lt5DAUTvwUh3~OO0jyMn*htG*3(Kr!!@(R`y@a2eucm*EncyJWd?NUF>(kYi%*^
z=XTz4&MM0TLKr&gTS^Qz3~j!I={~g)rn_H^nxg7ARQ(<qdHESwWUz94A~mq>eXe^*
z(>6HblmDsC3zir!e(|lv+?f#iCu1Z7=bo!#nwoH5{`y{h<g>c$)NW${65tXe)Ina2
zg)A-(jyABv^8Bew_1Z+ei*LldybggeK7XY#RkCPK&HoTBd=Ia$@^km<T&Df{5^05w
z!>5v*89uGfKclHkzWy@T$rhlU#aRpW*TudxM<RCv^MQ5T>M_T&@N@T04h`oR)*67p
zdCN(r*Ml>=gVJlV`Xse%3Klo@3o!<n%MYuqA%P5~pZrPEnp?7MVWrcrjoGFKu!hKR
z#A+GtUN5Vl%$lN~`ctW$$9&w^Eh-bR3=UpgW>%Hr^mKX&Dl9UZNz$#kogy6D1lpsk
zNuxL;umWDZIwQ*OnX{7(&z8n}^`TdA*LwaR<Ho1&cIYb$clLL;R`bAnA=-Yz2+N{u
zR}LeCc7w?gYdpE7q;W^&@Qc=6CIC?V_MV30`+DKyfUllzJ4%Dw$=GU-Lh?|y=0F6w
z;pS`V{Le4GDrsEqOYk3zI_|8h-#iCOtHw5n7HIgQtTlNWFG>L8x-xST8J(Hsj1~+c
z$5R$Id~Nl|Qd(gwSvG>$Y4#3lefvN9eRAx}PLT4&3N1(Z+>ONG_+Qs3bx(847d}jc
z#6bGqWa1ZM*GTnv>~#5ty2$u>Oz-motDFrl^p*0Om)g<2LySo-atOuSz({p{%w&mz
zKpom0lHzOj=#?QJ8VG2FE6LpfeNgck;XmnYj>}~O1!K&EGuoLlqNj0UaD{nrpH-N;
zs%>Rt<;xGj@q{@?_2;N1oF+q*MziTn=E^<ITE8fZ7`Gion$4M}pq?tf+$p)EjY@sS
z)s@GSy>dUWl0U0YJFxY+y_eUynnyc$*Z_Kh_743s46*ey!VkgkgAryxAFg^JdD1kJ
z(a#3DxFd!T(bgz$ob->AI%2zhAyS8F{)oN~tF94^>no06CzA~7&yE#*ksX(#P!LqP
z=B{qz`g3584pZj7q)~hB%0-Dr=NOn#!?|d;_*Zl!%=XTwCD(j!uSVuZKd`kECffBW
z%Wj=uvS`A$8a}cW>En1v-wsQ#cJpYaQO3$!)Cej({rwAeyTjd+oK;ly=h_;>0N$3#
zd~VF>@W&D~liLDU#VS4&KJF^aXzEn$;kN&A(Nvs9SqSq{?7f`V-3c4h&U{v9R(c|a
z*UsjH|LX5s7>i}gl5BGhqgD5uHio4FJNmRV{fRXf<E3;P>3ZHf&xY9u-Pc-iUAvUp
zDD-HoI8Z{NvYr-GcAdICn5&1KopyfU#zd?ddi85SvGd}5@s`1`UJer<3%vck0~XoB
z-Hqa-0&lYE#Tk{Tnn)q&P$71rGGo1{Bh06<gdQTWA#NdSh2?xov>F#3r)y-iT_AG@
zY#_g4ZWmOq`+N7&81>}WQ6mRKU3BZmn8$qa24gba`|_~YijN-uRzFhK>NU>e81)%p
zDQ||LINgx0RWsP#ex|}W9R-`al{(S5;5Zscr@`v&>5phw@G{Yx(P`Iu`*XyrfeHoP
znXccpR^_{=`;Al)ptdD^6(y&^7K%7Z{b`8~!+8pUmWF5y4nr=2E=K<vJ&(;`XU}8;
zpBogz(vXXK^JZB<(ls5~G1G8UmqpB;b=TRObM!~JvvXlgn^au?O3tjiW)3(M+xQA%
z)^?LW*gX79=JXJ*_%M<ll==c3XfGgAW<UwG&vFv&1#f*NGV)7e+`t_AIA|HQgr&_4
zV1+50Jr@3WabN*q2HE{m-?+jf7^w79i)n|hXOC{!2mBlKTz^8C+I#iGP)vIoRuq0S
zmEP6%3Iy?5-0jaJ`hxv~(qo>yzrKb$nWB9cog04}@3nsZ<v)q49#9QWsAXb{|7sPr
zbbElYlJ)FD$YnQvqI*1d+R5K`R5vDc>wf!l#j<cJPQ46AZ;FyAb75&@uG8%$a)PT;
zzibTK@Vn>a7`rZqs$xDKi(~sGPU;Y1FaG?|>t2K>soO@Hyw$H{AaDCF&oFsdqS5kg
zFs`qeZ_$@(I$G4`_$`Wp;;F*SEb=G<+QP!y;yr|4mNJ=?Wi*MnE<9L-+FTFu84>f~
zzFu$RcU`tH0yJKJ49v%~Ew}=aff=ycQ^0wH&M|tjdNB6kEoomMx*a8&Y9Vs(Kx+qe
z>^Y_EF^wgg5gT|TuPqs!ah5)}XPw>euoG5W3BmhTa&(Pu@wnVw$xQyNaB2BtZu=p_
zV#m@nxXC`El}o4DW@Fu9fg%AZm>Tu)^fvmA-GkJ8d>%?VVPUXAq5X}92z~suuZ;(Y
zDYtjJh+sN3DGjE_Yzd@D2aESJ5PSpf`Z|*iL!oKSqsy4_exGZ{c`2OaoDlYvCwkWS
z4IIZ!-xJc~t!Pql@d1oMf*X}oa9DCK+bMG@t?%r;t#`g$8z0-X7Yetog$lK_lGDl6
zOQnuRd7>jz%*)@aZ?%r6(XzY=;#s}jT7znt_Ecpf`pBx9lB#dJ_Oy3`6}-%RH`c3w
z5-<Cw8TS*S8Tn)jLt6btHtG5J3vrVmQ$#)_%~RU2Txdt!nf(&n)3s9*qqo@W+JDA3
z?8B(ERae(8n=!OtzI69${F{0!sz~NpoL-2tuV}aRB-g0|`d-j1Bk#>cHP8PlQbhHD
zTKHc12+j;Fni@K0uv6MX>r!9&sxz%WxG&ZF<aGam>HB(haOYT#)zh3p9(9#kO!6jc
zt{=0+Z>RGbOGnYZ4?9_V+q+xVDNC_!cVX)>rd<jXjCTd2XFz+=ZEkz<1u_343OIUE
zyLnHAr>1&Cy7F*~*SoM87p#8b(|y+R9Q49Hq?z_?z_o}Afs{xZ@Y9R3XPWB+5ZY~X
zd;TMKWJW3u$B`Lbk^dQ7M5^796%PE3*DWp1>@>@*xt{goc{s$A)~BMwXIFzCukA|0
z38tM?<>qpBTnKKdLx{WmbokIwr3M`6gM4)|XpMh+y8CCg3WjHX_x_Xr`Tpx+VM%5G
z1G9p*{=okQfHK+c@LcfmBVp58O6%%cG$|t<(WBEHR8zxI_5;k7NB@Y>#Uu_FU(h14
z&ZMuaAgN{%Jv*C1Wu_?GoLyx@$e9}paUjx8_3<mb+Zrib%V()Toe55Bb<@7ZP_fmA
zEKexe$8fr>>v2keyF8*ug>Y|HHJhNeDjLs$;Nf~jGEr{_5|oh-{)W}iHDBp*g;H~-
z(d0-CbH($9F6iyW$&49iE2e61g?xD0#fI^CW&UDn7+#w6p>}BoTO4t(rVWN`dvmE;
zoA9j>;&3EZbsiI0h#)yK5#Wxwe$m}pe>8)V+L}aMnkDjIr65RmIuRa=_IfwaSVvbJ
zmP$5j$HP@;No-|8cZ{vY;Xn4ErIRMK(MyE01^12=H!Hh^yM(MktNk^n{Es%U^vs>6
zh3hxI5pJyZ-X!S_l@#hxX+=nBGfU~zCM`rT#jsa;a-2*k@lg?X=y=RM_X2Cr@R3Sk
zC}fu-m|PBSAE<Tocn*HLE}Y>%=!DB*pYk6=4<UQjY$_^ml{AH~*QnR-U5?%2trd-X
z4wIU$4X)(UZ`ytdv|A9?^}=-Am_PRgopr_Jq1_N=uD<D~Lk|gd8h2l@e7syg5@lgZ
zvSkt8Y*~S($_{K9xy#Gv7k%y{6qY)<F6VpYy4M@;$}XZD4U>{iBk8mp4>pz>$e(*3
z%))J6Pqw44r>iP_CbshUZ)EC}CoTktQq*(Fc63_h@V7F6p1n)X7GANdvii*YoVIJL
zaUV}iFKiko4?WSa6~Dg%Oan}Ggq-m+s9!INVDSBv%3{{Go`{KMu(+ds<A1oxI-QSJ
zB+GHXG!k=~h@tCFN^a<k{x(rXS<|vnom^0Dd!DP?kbJ#)Du~ABvgUCl=S%{Y;%*Yw
zyPq#_|I+ea{OzPU6XezDB_AQ=UrX?s)=HT6vh_|OjM-qNzANb@xKXdv?5HnQYM|e$
z{sw2YA3|%s;Q4n&KIV4eR}m4pgh1+kJUvWgfGOL_&q;#5Jk9fhf{QbPcAN3589^cI
z_SlP$>pEZyy`3kESy6y2*yx|?PowSgmpKLD#m3KwH>m?j9|9N{iOH4aQ`VCnXW4?@
zR5Fwt+L~YA@Q$W!Gk8>AgWIBfc)P@P_z5veK$&>BAzjeza=#81DnDL~-&V5NyDFYW
zm`v3}fZD8~4Z5!v>UXvo9qvN%_N5CBeY1uW=FFaty#=esNB-M4)+9-LYpYc(*3Xh*
zNav2)zc%$c0D0Z--(`*>|70>~ioe4fXX;(g?ZxQ7xj#1Yjvx=Vba2~DeGd*H7UGMh
z;17JpD}JIpw93)K@U?jZP0*sakk!fUS!Lj*pjYPq42PaKVYqpI*LHPSoe&y)^%U1G
ztL}|?A||XdP9N>4a+F<-9`+%4zY9}^xhQGN^m)tUL7XdEU&bsbNyO8%sW56ua&Q3`
zfO#-q&R1;|20+)_4+}It7EIxXg_q*d(R^Y;i}_Hq7N0q6y7Gg1#gE7{{4^H~4B|mr
zO!y~O8?x?DBqC3PkyM2rlS0ZtVz132t=i>y2ATEo?TdZy@ML_CI-~KrP_6Ax!v4IA
znq+u&z+5;>qPNFI>~G9DFCeb7UxF|<=jBxEzT3h<kqv^(<hOyE3&LmjkdM691&n$a
z=C=pSt=0`(z|zBnwdaL+rLvb$^M`g32gAisev3(#^7bM?o5~|xRz*grf1_g#n>1WN
zW2!q@(*J6laYM(0mp6)KK-m^bZ<zI&_AOnu^}!{`_>)kg+PZ#@@pc5O!D|<KyOGn#
z;crH+e0^D4#2WWBDJH3@UoKI6WhymFcRw37HOvxFf3#^<F9Le=62$6ci+OLKy%9Ik
zz4bXaD{P3v^whvL4C=kQiA}ZNa^3}bHov&*G<1DZ_X()PE`}q!&@%A!hn%|smyhhh
zqc-_fdQgai^bWU@Y+w!Gq8+RFv2@=C9P=j1eHy(ScGfo?#Er^7_lZ8dSr%t|)dIZ*
z@nVbVaKfqX){i2bTIQo=rx$caSje>#PB-Jdu~j){hc<!YZRIo*cZ<<|8snMjR+j@2
zGPA9W`IVw!NBEH&;q=kpgx&`_hzA;-O9lkZ%`*{qS<~Dry?q#18#lw2N0ZYA)sPqo
zsqc)3>2CE?)E6Ea^+Hux1~jyW&L{Ls3tYACI5ckX=NFV&=DiMC2uI#p6_y^BG;A0x
zf3%_9uv(n3j#u~B*>KIsR8ldN#@MuX%erjHO<|^6?H=9D=+U&8H{)3vSJa0d!F>|A
z88fW9`~D}AoZf<k6~S%G9w{0eWCgKPwWf`Df0t8!ZOuA)s0}|fBxb&t5`Rw9IL(E%
zsR7KuO@Wv4NMi<v8G60K2Wf_@OmXGkKV6qGD5Qj^L)gi@r1hsCN-CeE$)`iMDQKmB
z21}7zO8fTstb&XOY9f6m2Q*t)hP|FY>~%++7ZRPFSq^?+A8$s(<!3*^q2-fUh~dR_
z<TD@1u7Q6Rm&+{;hc+ju4Cbqw2djM{Zs#+mew~-V9o!HG8h~OtKDXF+x-SNPr~5Rq
zpqGmF%SW{kdq&G=o_qc0%pn$oA`^@IDbLJAHb9+bI8+MC4}$_q`m>@WUa-?i>||2p
lpBevW#qa<BCk)*m;Oji$6RsZ{%V3{LTKtC?NW{SJ{{aH}#isxO

literal 0
HcmV?d00001

diff --git a/doc/source/development.rst b/doc/source/development.rst
new file mode 100644
index 0000000000..776ac6cb64
--- /dev/null
+++ b/doc/source/development.rst
@@ -0,0 +1,140 @@
+==========================
+ Developing with Devstack
+==========================
+
+Now that you have your nifty DevStack up and running, what can you do
+with it?
+
+Inspecting Services
+===================
+
+By default most services in DevStack are running in a `screen
+<https://www.gnu.org/software/screen/manual/screen.html>`_
+session.
+
+.. code-block:: bash
+
+   os3:~> screen -list
+   There is a screen on:
+        28994.stack	(08/10/2016 09:01:33 PM)	(Detached)
+   1 Socket in /var/run/screen/S-sdague.
+
+You can attach to this screen session using ``screen -r`` which gives
+you a view of the services in action.
+
+.. image:: assets/images/screen_session_1.png
+   :width: 100%
+
+Basic Screen Commands
+---------------------
+
+The following minimal commands will be useful to using screen:
+
+* ``ctrl-a n`` - go to next window. Next is assumed to be right of
+  current window.
+* ``ctrl-a p`` - go to previous window. Previous is assumed to be left
+  of current window.
+* ``ctrl-a [`` - entry copy/scrollback mode. This allows you to
+  navigate back through the logs with the up arrow.
+* ``ctrl-a d`` - detach from screen. Gets you back to a normal
+  terminal, while leaving everything running.
+
+For more about using screen, see the excellent `screen manual
+<https://www.gnu.org/software/screen/manual/screen.html>`_.
+
+Patching a Service
+==================
+
+If you want to make a quick change to a running service the easiest
+way to do this is:
+
+* attach to screen
+* navigate to the window in question
+* ``ctrl-c`` to kill the service
+* make appropriate changes to the code
+* ``up arrow`` in the screen window to display the command used to run
+  that service
+* ``enter`` to restart the service
+
+This works for services, except those running under Apache (currently
+just ``keystone`` by default).
+
+.. warning::
+
+   All changes you are making are in checked out git trees that
+   DevStack thinks it has full control over. Uncommitted work, or
+   work committed to the master branch, may be overwritten during
+   subsequent DevStack runs.
+
+Testing a Patch Series
+======================
+
+When testing a larger set of patches, or patches that will impact more
+than one service within a project, it is often less confusing to use
+custom git locations, and make all your changes in a dedicated git
+tree.
+
+In your ``local.conf`` you can add ``**_REPO``, ``**_BRANCH`` for most projects
+to use a custom git tree instead of the default upstream ones.
+
+For instance:
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   NOVA_REPO=/home/sdague/nova
+   NOVA_BRANCH=fold_disk_config
+
+Will use a custom git tree and branch when doing any devstack
+operations, such as ``stack.sh``.
+
+When testing complicated changes committing to these trees, then doing
+``./unstack.sh && ./stack.sh`` is often a valuable way to
+iterate. This does take longer per iteration than direct patching, as
+the whole devstack needs to rebuild.
+
+You can use this same approach to test patches that are up for review
+in gerrit by using the ref name that gerrit assigns to each change.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   NOVA_BRANCH=refs/changes/10/353710/1
+
+
+Testing Changes to Apache Based Services
+========================================
+
+When testing changes to Apache based services, such as ``keystone``,
+you can either use the Testing a Patch Series approach above, or make
+changes in the code tree and issue an apache restart.
+
+
+Testing Changes to Libraries
+============================
+
+When testing changes to libraries consumed by OpenStack services (such
+as oslo or any of the python-fooclient libraries) things are a little
+more complicated. By default we only test with released versions of
+these libraries that are on pypi.
+
+You must first override this with the setting ``LIBS_FROM_GIT``. This
+will enable your DevStack with the git version of that library instead
+of the released version.
+
+After that point you can also specify ``**_REPO``, ``**_BRANCH`` to use
+your changes instead of just upstream master.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   LIBS_FROM_GIT=oslo.policy
+   OSLOPOLICY_REPO=/home/sdague/oslo.policy
+   OSLOPOLICY_BRANCH=better_exception
+
+Because libraries are used by many services, library changes really
+need to go through a full ``./unstack.sh && ./stack.sh`` to see your
+changes in action.
+
+To figure out the repo / branch names for every library that's
+supported, you'll need to read the devstack source.
diff --git a/doc/source/index.rst b/doc/source/index.rst
index c1302eb930..d89637e796 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -113,6 +113,9 @@ You can ``source openrc`` in your shell, and then use the
 You can ``cd /opt/stack/tempest`` and run tempest tests that have
 been configured to work with your devstack.
 
+You can :doc:`make code changes to OpenStack and validate them
+<development>`.
+
 Going further
 -------------
 
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
index 480d6aaf5e..74b944b5e1 100644
--- a/doc/source/site-map.rst
+++ b/doc/source/site-map.rst
@@ -17,5 +17,6 @@
    plugins
    plugin-registry
    faq
+   development
    hacking
    guides

From 3d5f03abe515009aea34599c0e5b0d541afcac0a Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Wed, 10 Aug 2016 12:46:50 +0300
Subject: [PATCH 1500/3333] fix nova's fake virt driver plugin

nova's config was changed -
now virt driver parameter needs not full path for virt driver

Change-Id: I2a32b4dee3f27efc78bd1e546a96cfbc1225b8b5
---
 lib/nova_plugins/hypervisor-fake | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 2434dce884..6ac219961e 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -36,7 +36,7 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    iniset $NOVA_CONF DEFAULT compute_driver "nova.virt.fake.FakeDriver"
+    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
     # Disable arbitrary limits
     iniset $NOVA_CONF DEFAULT quota_instances -1
     iniset $NOVA_CONF DEFAULT quota_cores -1

From bc883df1c23fab66f681f2c4fe9c0d3affadc671 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 12 Aug 2016 07:21:59 -0400
Subject: [PATCH 1501/3333] add networking write up for devstack

This explains the current state of networking in devstack, and a
couple of scenarios that people might want to try out for local
testing.

Change-Id: I2be35f4345bf9306c981ef6f0186b48da7d06772
---
 doc/source/index.rst      |  3 +-
 doc/source/networking.rst | 97 +++++++++++++++++++++++++++++++++++++++
 doc/source/site-map.rst   |  1 +
 3 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/networking.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index d89637e796..435011bb96 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -120,7 +120,8 @@ Going further
 -------------
 
 Learn more about our :doc:`configuration system <configuration>` to
-customize devstack for your needs.
+customize devstack for your needs. Including making adjustments to the
+default :doc:`networking <networking>`.
 
 Read :doc:`guides <guides>` for specific setups people have (note:
 guides are point in time contributions, and may not always be kept
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
new file mode 100644
index 0000000000..1d56c3367e
--- /dev/null
+++ b/doc/source/networking.rst
@@ -0,0 +1,97 @@
+=====================
+ DevStack Networking
+=====================
+
+An important part of the DevStack experience is networking that works
+by default for created guests. This might not be optimal for your
+particular testing environment, so this document tries it's best to
+explain what's going on.
+
+Defaults
+========
+
+If you don't specify any configuration you will get the following:
+
+* neutron (including l3 with openvswitch)
+* private project networks for each openstack project
+* a floating ip range of 172.24.4.0/24 with the gateway of 172.24.4.1
+* the demo project configured with fixed ips on 10.0.0.0/24
+* a ``br-ex`` interface controlled by neutron for all it's networking
+  (this is not connected to any physical interfaces).
+* DNS resolution for guests based on the resolv.conf for you host
+* an ip masq rule that allows created guests to route out
+
+This creates an environment which is isolated to the single
+host. Guests can get to the external network for package
+updates. Tempest tests will work in this environment.
+
+.. note::
+
+   By default all OpenStack environments have security group rules
+   which block all inbound packets to guests. If you want to be able
+   to ssh / ping your created guests you should run the following.
+
+   .. code-block:: bash
+
+      openstack security group rule create --proto icmp --dst-port 0 default
+      openstack security group rule create --proto tcp --dst-port 22 default
+
+Locally Accessible Guests
+=========================
+
+If you want to make you guests accessible other machines on your
+network, we have to connect ``br-ex`` to a physical interface.
+
+Dedicated Guest Interface
+-------------------------
+
+If you have 2 or more interfaces on your devstack server, you can
+allocate an interface to neutron to fully manage. This **should not**
+be the same interface you use to ssh into the devstack server itself.
+
+This is done by setting with the ``PUBLIC_INTERFACE`` attribute.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   PUBLIC_INTERFACE=eth1
+
+That will put all layer 2 traffic from your guests onto the main
+network. When running in this mode the ip masq rule is **not** added
+in your devstack, you are responsible for making routing work on your
+local network.
+
+Shared Guest Interface
+----------------------
+
+.. warning::
+
+   This is not a recommended configuration. Because of interactions
+   between ovs and bridging, if you reboot your box with active
+   networking you may loose network connectivity to your system.
+
+If you need your guests accessible on the network, but only have 1
+interface (using something like a NUC), you can share your one
+network. But in order for this to work you need to manually set a lot
+of addresses, and have them all exactly correct.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   PUBLIC_INTERFACE=eth0
+   HOST_IP=10.42.0.52
+   FLOATING_RANGE=10.42.0.52/24
+   PUBLIC_NETWORK_GATEWAY=10.42.0.1
+   Q_FLOATING_ALLOCATION_POOL=start=10.42.0.250,end=10.42.0.254
+
+In order for this scenario to work the floating ip network must match
+the default networking on your server. This breaks HOST_IP detection,
+as we exclude the floating range by default, so you have to specify
+that manually.
+
+The ``PUBLIC_NETWORK_GATEWAY`` is the gateway that server would normally
+use to get off the network. ``Q_FLOATING_ALLOCATION_POOL`` controls
+the range of floating ips that will be handed out. As we are sharing
+your existing network, you'll want to give it a slice that your local
+dhcp server is not allocating. Otherwise you could easily have
+conflicting ip addresses, and cause havoc with your local network.
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
index 74b944b5e1..801fc66b80 100644
--- a/doc/source/site-map.rst
+++ b/doc/source/site-map.rst
@@ -14,6 +14,7 @@
 
    overview
    configuration
+   networking
    plugins
    plugin-registry
    faq

From b1a4f34bfc6adb9ab4577520601c44e8ccff277d Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew@lascii.com>
Date: Fri, 27 May 2016 15:23:54 -0400
Subject: [PATCH 1502/3333] Setup cellsv2 for Nova

Run "nova-manage cell_v2 simple_cell_setup --transport_url ..." after
Nova is started. This will add all compute hosts into a new cell, and
setup a db for cell0.

Change-Id: I50a955b97d0e18426406c15397bdfbc9e807d908
Depends-On: I559f9c87e89926414b368cac9442dec4eadcb89b
---
 lib/nova | 5 +++++
 stack.sh | 1 +
 2 files changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index af5d1222a0..4c079f46b9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -937,6 +937,11 @@ function create_flavors {
     fi
 }
 
+# create_cell(): Group the available hosts into a cell
+function create_cell {
+    nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
+}
+
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index 68e3d936b8..948475a270 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1263,6 +1263,7 @@ if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
     create_flavors
+    create_cell
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"

From 06f3639a70dc5884107a4045bef5a9de1fb725a5 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 12 Aug 2016 09:35:42 -0500
Subject: [PATCH 1503/3333] Add os-client-config and osc-lib from source

There is currently a hole in our testing that lets os-client-config,
which sits at the bottom of the dependency chain for some key pieces
like neutronclient and python-openstackclient, introduce gate breakages.
Step one in fixing this is allowing os-client-config to be optionally
installed from source so that jobs can be put into its gate to exercise
its master vs devstack installs.

Additionally, osc-lib is a new and lovely library that's going to need
the same things.

We're putting both in install_oslo, even though they're not oslo
libraries, because that'll make grenade work properly.

Co-Authored-By: Monty Taylor <mordred@inaugust.com>
Change-Id: I747480b6063a62e82ca2b030f274d3e87bf28b3b
---
 lib/oslo                     | 4 ++++
 stackrc                      | 9 +++++++++
 tests/test_libs_from_pypi.sh | 4 ++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/oslo b/lib/oslo
index 1773da2975..e34e48ad03 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -26,6 +26,8 @@ GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
+GITDIR["os-client-config"]=$DEST/os-client-config
+GITDIR["osc-lib"]=$DEST/osc-lib
 GITDIR["oslo.cache"]=$DEST/oslo.cache
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
@@ -71,6 +73,8 @@ function install_oslo {
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
+    _do_install_oslo_lib "osc-lib"
+    _do_install_oslo_lib "os-client-config"
     _do_install_oslo_lib "oslo.cache"
     _do_install_oslo_lib "oslo.concurrency"
     _do_install_oslo_lib "oslo.config"
diff --git a/stackrc b/stackrc
index 4fefe8da30..bfb897b338 100644
--- a/stackrc
+++ b/stackrc
@@ -508,10 +508,19 @@ GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 
+# os-client-config to manage clouds.yaml and friends
+GITREPO["os-client-config"]=${OS_CLIENT_CONFIG_REPO:-${GIT_BASE}/openstack/os-client-config.git}
+GITBRANCH["os-client-config"]=${OS_CLIENT_CONFIG_BRANCH:-master}
+GITDIR["os-client-config"]=$DEST/os-client-config
+
 # os-vif library to communicate between Neutron to Nova
 GITREPO["os-vif"]=${OS_VIF_REPO:-${GIT_BASE}/openstack/os-vif.git}
 GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
 
+# osc-lib OpenStackClient common lib
+GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
+GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-master}
+
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index bb58088ef3..fb55023886 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -36,8 +36,8 @@ ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
-ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
-ALL_LIBS+=" oslo.utils python-swiftclient"
+ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
+ALL_LIBS+=" oslo.i18n oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"

From 14b12a74f6a258b6e97dbf85b0ccfd74028b83b0 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Fri, 12 Aug 2016 19:07:12 -0700
Subject: [PATCH 1504/3333] Remove stale config l3|dhcp_agent_manager options

There is no longer a trace of these options anywhere in the
Neutron codebase. These can be safely removed.

Change-Id: Ibf00e158248e2a20248917c8cfc0011d30da6a82
---
 lib/neutron_plugins/linuxbridge_agent | 3 +--
 lib/neutron_plugins/openvswitch_agent | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 0a066354ca..67d0405c23 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -44,14 +44,13 @@ function neutron_plugin_configure_debug_command {
 
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
-    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    :
 }
 
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
     iniset $conf_file DEFAULT external_network_bridge
-    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 69e38f4df1..02eebe1bfd 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -29,13 +29,12 @@ function neutron_plugin_configure_debug_command {
 
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
-    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    :
 }
 
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     _neutron_ovs_base_configure_l3_agent
-    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {

From b08b673def8f5c80b7a91ba2127edbb13c39c26a Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <pshchelokovskyy@mirantis.com>
Date: Sun, 14 Aug 2016 13:26:13 +0300
Subject: [PATCH 1505/3333] Allow properly overriding DEST

Change the order of variable declarations in stackrc so that setting
custom DEST in local.conf is also affecting DATA_DIR, SERVICE_DIR and
SUBUNIT_OUTPUT.

Change-Id: I00847bb6733febf105855ae6fc577a7c904ec4b4
Closes-Bug: #1285720
---
 stackrc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stackrc b/stackrc
index 4fefe8da30..9513e5a714 100644
--- a/stackrc
+++ b/stackrc
@@ -23,15 +23,6 @@ source $RC_DIR/functions
 # Destination path for installation
 DEST=/opt/stack
 
-# Destination for working data
-DATA_DIR=${DEST}/data
-
-# Destination for status files
-SERVICE_DIR=${DEST}/status
-
-# Path for subunit output file
-SUBUNIT_OUTPUT=${DEST}/devstack.subunit
-
 # Determine stack user
 if [[ $EUID -eq 0 ]]; then
     STACK_USER=stack
@@ -137,6 +128,15 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Destination for working data
+DATA_DIR=${DATA_DIR:-$DEST/data}
+
+# Destination for status files
+SERVICE_DIR=${SERVICE_DIR:-$DEST/status}
+
+# Path for subunit output file
+SUBUNIT_OUTPUT=${SUBUNIT_OUTPUT:-$DEST/devstack.subunit}
+
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From 65be33f68e613cb054d8bf3057535976b6df4918 Mon Sep 17 00:00:00 2001
From: Isaac Beckman <isaacb@il.ibm.com>
Date: Sun, 14 Aug 2016 15:27:40 +0300
Subject: [PATCH 1506/3333] Remove lib/cinder_backends/xiv

Since support for sections was added to devstack local.conf parsing
we don't need this, and actually prefer just using the
sections in local.conf.

Change-Id: I5908fdf7ad127997bb1f4a6bbb16d0d8cf073ddd
---
 lib/cinder_backends/xiv | 86 -----------------------------------------
 1 file changed, 86 deletions(-)
 delete mode 100644 lib/cinder_backends/xiv

diff --git a/lib/cinder_backends/xiv b/lib/cinder_backends/xiv
deleted file mode 100644
index e8b5da05d5..0000000000
--- a/lib/cinder_backends/xiv
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2014 IBM Corp.
-# Copyright (c) 2014 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-# Authors:
-#   Alon Marx <alonma@il.ibm.com>
-#
-
-# lib/cinder_plugins/xiv
-# Configure the xiv_ds8k driver for xiv testing
-
-# Enable xiv_ds8k driver for xiv with:
-#
-#   CINDER_ENABLED_BACKENDS+=,xiv:<volume-type-name>
-#   XIV_DRIVER_VERSION=<version-string>
-#   SAN_IP=<storage-ip-or-hostname>
-#   SAN_LOGIN=<storage-admin-account>
-#   SAN_PASSWORD=<storage-admin-password>
-#   SAN_CLUSTERNAME=<cluster-name>
-#   CONNECTION_TYPE=<connection-type> iscsi|fc
-#   XIV_CHAP=<chap-type> disabled|enabled
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# configure_cinder_backend_xiv - Configure Cinder for xiv backends
-
-# Save trace setting
-_XTRACE_CINDER_XIV=$(set +o | grep xtrace)
-set +o xtrace
-
-# Defaults
-# --------
-# Set up default directories
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_backend_xiv - Set config files, create data dirs, etc
-function configure_cinder_backend_xiv {
-
-    local be_name=$1
-
-    python -c 'from xiv_ds8k_openstack.xiv_nova_proxy import XIVNovaProxy'
-    if [ $? -ne 0 ]; then
-        die $LINENO "XIV_DS8K driver is missing. Please install first"
-    fi
-
-    # For reference:
-    # ``XIV_DS8K_BACKEND='IBM-XIV_'${SAN_IP}'_'${SAN_CLUSTERNAME}'_'${CONNECTION_TYPE}``
-    iniset $CINDER_CONF DEFAULT xiv_ds8k_driver_version $XIV_DRIVER_VERSION
-
-    iniset $CINDER_CONF $be_name san_ip $SAN_IP
-    iniset $CINDER_CONF $be_name san_login $SAN_LOGIN
-    iniset $CINDER_CONF $be_name san_password $SAN_PASSWORD
-    iniset $CINDER_CONF $be_name san_clustername $SAN_CLUSTERNAME
-    iniset $CINDER_CONF $be_name xiv_ds8k_connection_type $CONNECTION_TYPE
-    iniset $CINDER_CONF $be_name volume_backend_name $be_name
-    iniset $CINDER_CONF $be_name volume_driver 'cinder.volume.drivers.ibm.xiv_ds8k.XIVDS8KDriver'
-    iniset $CINDER_CONF $be_name xiv_ds8k_proxy 'xiv_ds8k_openstack.xiv_nova_proxy.XIVNovaProxy'
-    iniset $CINDER_CONF $be_name xiv_chap $XIV_CHAP
-}
-
-# Restore xtrace
-$_XTRACE_CINDER_XIV
-
-# Local variables:
-# mode: shell-script
-# End:

From 9301e8875b8c50e486a3751b3d894d4ccdc94f84 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Mon, 15 Aug 2016 14:58:00 -0400
Subject: [PATCH 1507/3333] Revert "Setup cellsv2 for Nova"

This reverts commit b1a4f34bfc6adb9ab4577520601c44e8ccff277d, which
breaks Ironic's jobs. For example:
http://logs.openstack.org/90/355390/1/check/gate-tempest-dsvm-ironic-ipa-wholedisk-agent_ssh-tinyipa/b9e264a/logs/devstacklog.txt.gz#_2016-08-15_17_31_13_358

Change-Id: Iafc579f73fe4a97056944872e2f2c8cd1a62c21c
---
 lib/nova | 5 -----
 stack.sh | 1 -
 2 files changed, 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8ac82008b4..1369c409fc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -936,11 +936,6 @@ function create_flavors {
     fi
 }
 
-# create_cell(): Group the available hosts into a cell
-function create_cell {
-    nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
-}
-
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index b1903e7095..823b63ba24 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1257,7 +1257,6 @@ if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
     create_flavors
-    create_cell
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"

From 62f6eb68fdca2ecd30fbf0a1092b6b36dad368b0 Mon Sep 17 00:00:00 2001
From: lvdongbing <dongbing.lv@kylin-cloud.com>
Date: Wed, 17 Aug 2016 03:44:42 -0400
Subject: [PATCH 1508/3333] Change quota_injected_file_path_bytes to
 quota_injected_file_path_length

'quota_injected_file_path_bytes' has been renamed to
'quota_injected_file_path_length' long time ago, this patch fixes this
issue in devstack.

Change-Id: I5d3c52c5ded5321435d2d395b682c4c0725279a7
---
 lib/nova_plugins/hypervisor-fake | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 6ac219961e..f9b95c1816 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -45,7 +45,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT quota_fixed_ips -1
     iniset $NOVA_CONF DEFAULT quota_metadata_items -1
     iniset $NOVA_CONF DEFAULT quota_injected_files -1
-    iniset $NOVA_CONF DEFAULT quota_injected_file_path_bytes -1
+    iniset $NOVA_CONF DEFAULT quota_injected_file_path_length -1
     iniset $NOVA_CONF DEFAULT quota_security_groups -1
     iniset $NOVA_CONF DEFAULT quota_security_group_rules -1
     iniset $NOVA_CONF DEFAULT quota_key_pairs -1

From 023ac218059934a0746fa41c1473bd93ba9cc04a Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 17 Aug 2016 08:11:12 +0000
Subject: [PATCH 1509/3333] Updated from generate-devstack-plugins-list

Change-Id: I9379f01103bcb1ae7417c8bd14746aee9fb722ea
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bdb8d8bc9c..bb8527041e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -73,6 +73,7 @@ kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__

From d7a3f5c4cc55e61bdcb5eb57bf823cee2e059828 Mon Sep 17 00:00:00 2001
From: Matt Van Dijk <mvandijk@tesora.com>
Date: Tue, 16 Aug 2016 15:46:58 +0000
Subject: [PATCH 1510/3333] Make the Neutron l3 plugin use the subnetpools

The plugin creates subnetpools but does not use them when creating the
default subnets. It uses CIDR values that overlap with the
default pools. Change this to use the subnetpools.

Change-Id: I6171c13507e420f146801d323cb1011be36c1e8c
Closes-bug: 1613717
---
 lib/neutron_plugins/services/l3 | 51 ++++++++++++++++++++++++---------
 1 file changed, 38 insertions(+), 13 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 61b8402818..5e52306206 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -149,6 +149,15 @@ function create_neutron_initial_network {
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
     fi
 
+    if is_networking_extension_supported "auto-allocated-topology"; then
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+        fi
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+        fi
+    fi
+
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
@@ -156,14 +165,20 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            if [ -z $SUBNETPOOL_V4_ID ]; then
+                fixed_range_v4=$FIXED_RANGE
+            fi
+            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} $NET_ID $fixed_range_v4 | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
             die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
-            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            if [ -z $SUBNETPOOL_V6_ID ]; then
+                fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
+            fi
+            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -200,14 +215,8 @@ function create_neutron_initial_network {
         fi
 
         EXTERNAL_NETWORK_FLAGS="--router:external"
-        if is_networking_extension_supported "auto-allocated-topology" && is_networking_extension_supported "subnet_allocation"; then
+        if is_networking_extension_supported "auto-allocated-topology"; then
             EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
-            if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
-            if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
@@ -232,11 +241,15 @@ function create_neutron_initial_network {
 # Create private IPv4 subnet
 function _neutron_create_private_subnet_v4 {
     local project_id=$1
+    if [ -z $SUBNETPOOL_V4_ID ]; then
+        fixed_range_v4=$FIXED_RANGE
+    fi
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE"
+    subnet_params+="${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} "
+    subnet_params+="$NET_ID $fixed_range_v4"
     local subnet_id
     subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
@@ -249,11 +262,15 @@ function _neutron_create_private_subnet_v6 {
     die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
     die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
+    if [ -z $SUBNETPOOL_V6_ID ]; then
+        fixed_range_v6=$FIXED_RANGE_V6
+    fi
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
+    subnet_params+="${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} "
+    subnet_params+="$NET_ID $fixed_range_v6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
@@ -321,7 +338,11 @@ function _neutron_configure_router_v4 {
             fi
             ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
+            local replace_range=${SUBNETPOOL_PREFIX_V4}
+            if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
+                replace_range=${FIXED_RANGE}
+            fi
+            sudo ip route replace $replace_range via $ROUTER_GW_IP
         fi
         _neutron_set_router_id
     fi
@@ -360,7 +381,11 @@ function _neutron_configure_router_v6 {
 
             # Configure interface for public bridge
             sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+            local replace_range=${SUBNETPOOL_PREFIX_V6}
+            if [[ -z "${SUBNETPOOL_V6_ID}" ]]; then
+                replace_range=${FIXED_RANGE_V6}
+            fi
+            sudo ip -6 route replace $replace_range via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
         fi
         _neutron_set_router_id
     fi

From 556139e710392c4f2586504b17490d8b63c4b21d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <seb@redhat.com>
Date: Thu, 18 Aug 2016 15:09:44 +0200
Subject: [PATCH 1511/3333] fix ceph config file path variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CEPH_CONF does not exist anymore, resulting both cinder-volume and
cinder-backup being configured with an empty rbd_ceph_conf option.
Using CEPH_CONF_FILE to fix this.

Change-Id: I1aa590aba900a4a94698917e45a0ea5c6f497f18
Signed-off-by: Sébastien Han <seb@redhat.com>
---
 lib/cinder_backends/ceph | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 9bff5bef4f..ba86ccf8f4 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -45,7 +45,7 @@ function configure_cinder_backend_ceph {
 
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.rbd.RBDDriver"
-    iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF"
+    iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF_FILE"
     iniset $CINDER_CONF $be_name rbd_pool "$CINDER_CEPH_POOL"
     iniset $CINDER_CONF $be_name rbd_user "$CINDER_CEPH_USER"
     iniset $CINDER_CONF $be_name rbd_uuid "$CINDER_CEPH_UUID"
@@ -66,7 +66,7 @@ function configure_cinder_backend_ceph {
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
         iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph"
-        iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF"
+        iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
         iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
         iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
         iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0

From 0a318ab8a6ede38a330b5bff10479772ab4776f0 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 18 Aug 2016 13:50:18 -0500
Subject: [PATCH 1512/3333] Switch keystone to dogpile.cache.memcached backend

memcache_pool is there to keep a limited number of thread-associated
connections open rather than a connection for every thread. If you
don't have a huge number of threads it doesn't offer anything.
Keystone is an example of a service where memcache_pool doesn't
improve things -- eventlet isn't supported anymore and more threads
is not useful due to GIL.

As such, keystone cache backend is changed to dogpile.cache.memcached.

See https://review.openstack.org/357407 for the oslo.cache help text
change.

Change-Id: I4452a8c4968073cdea4c0f384453a5a28519fa08
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..6d8a43c0c2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -245,7 +245,7 @@ function configure_keystone {
 
     # Enable caching
     iniset $KEYSTONE_CONF cache enabled "True"
-    iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
+    iniset $KEYSTONE_CONF cache backend "dogpile.cache.memcached"
     iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
     # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617

From 7682ea88a6ab8693b215646f16748dbbc2476cc4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 18 Aug 2016 16:19:36 -0400
Subject: [PATCH 1513/3333] Change default for FORCE_CONFIG_DRIVE

We really should be using the metadata server more in our normal
testing, this changes the default to use it.

Change-Id: I8ef14e6110da1160163c0106e32032d27226f929
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index e187220198..235b533d77 100644
--- a/lib/nova
+++ b/lib/nova
@@ -83,7 +83,7 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
-FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
+FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.

From 85ad108adf84718d5d7747e892ba236a21fc2dac Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Mon, 22 Aug 2016 17:00:50 +0000
Subject: [PATCH 1514/3333] Fix typo in tools/info.sh comment

A trivial fix to a typo in tools/info.sh discovered while looking at
it to see what it was.

Change-Id: I9fb8906c375f99e43cdd0f41f7e4510c901fd3a1
---
 tools/info.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/info.sh b/tools/info.sh
index c056fa73f8..282667f9d0 100755
--- a/tools/info.sh
+++ b/tools/info.sh
@@ -8,7 +8,7 @@
 # Output types are git,localrc,os,pip,pkg:
 #
 #   git|<project>|<branch>[<shaq>]
-#   localtc|<var>=<value>
+#   localrc|<var>=<value>
 #   os|<var>=<value>
 #   pip|<package>|<version>
 #   pkg|<package>|<version>

From 31813e92199386f19dd7e993a9e951d293503a01 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Mon, 22 Aug 2016 15:39:22 -0400
Subject: [PATCH 1515/3333] Let neutron use default gateway IP for subnets

By default, FIXED_RANGE and NETWORK_GATEWAY (and the
IPv6 equivalents) are in the same subnet.  But if
FIXED_RANGE is over-ridden in local.conf we could
create a subnet with an invalid gateway address.

Since neutron will pick the lowest host IP as the
gateway by default, do not specify them unless the
user has specifically set them.

Do this for both the private and public subnets, as
well as the public IPv4 subnet.

Change-Id: Ifc71400a3af1f131bb8a9722188e13de5bd3c806
---
 lib/neutron_plugins/services/l3 | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a4e72483b4..c6f14d35f6 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -63,14 +63,14 @@ IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
 IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
 IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
 FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
-IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
+IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-}
 IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
 IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
 IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
 
 # Gateway and subnet defaults, in case they are not customized in localrc
-NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
-PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
+NETWORK_GATEWAY=${NETWORK_GATEWAY:-}
+PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-}
 PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
@@ -234,7 +234,9 @@ function _neutron_create_private_subnet_v4 {
     local project_id=$1
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 4 "
-    subnet_params+="--gateway $NETWORK_GATEWAY "
+    if [[ -n "$NETWORK_GATEWAY" ]]; then
+        subnet_params+="--gateway $NETWORK_GATEWAY "
+    fi
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
@@ -251,7 +253,9 @@ function _neutron_create_private_subnet_v6 {
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    if [[ -n "$IPV6_PRIVATE_NETWORK_GATEWAY" ]]; then
+        subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    fi
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
@@ -262,9 +266,11 @@ function _neutron_create_private_subnet_v6 {
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local subnet_params+="--ip_version 4 "
+    local subnet_params="--ip_version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
-    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
+        subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    fi
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"

From 01acdabb1d65594a5fd74a6c72dcd5f5b0c1b0c6 Mon Sep 17 00:00:00 2001
From: igor <igor.milovanovic@ammeon.com>
Date: Fri, 29 Jul 2016 13:11:53 +0200
Subject: [PATCH 1516/3333] Fixes language: "following allowing" -> "allowing"

Stops propagation of initially erroneous construct.

Change-Id: I2197de57cbac98e87fb39fa0dca4c691fe5e856f
---
 HACKING.rst                   | 2 +-
 exercises/aggregates.sh       | 2 +-
 exercises/boot_from_volume.sh | 2 +-
 exercises/client-args.sh      | 2 +-
 exercises/client-env.sh       | 2 +-
 exercises/floating_ips.sh     | 2 +-
 exercises/neutron-adv-test.sh | 2 +-
 exercises/sec_groups.sh       | 2 +-
 exercises/swift.sh            | 2 +-
 exercises/volumes.sh          | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d763c75b8b..b76cb6c4a7 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -219,7 +219,7 @@ These scripts are executed serially by ``exercise.sh`` in testing situations.
     set -o errexit
 
     # Print the commands being run so that we can see the command that triggers
-    # an error.  It is also useful for following allowing as the install occurs.
+    # an error.  It is also useful for following as the install occurs.
     set -o xtrace
 
 * Settings and configuration are stored in ``exerciserc``, which must be
diff --git a/exercises/aggregates.sh b/exercises/aggregates.sh
index 808ef76e2f..8cbca54fb2 100755
--- a/exercises/aggregates.sh
+++ b/exercises/aggregates.sh
@@ -20,7 +20,7 @@ echo "**************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index 84ac08f017..7478bdf138 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -16,7 +16,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 2c8fe81390..b380968da8 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
index 6ab4d08715..fff04df9f2 100755
--- a/exercises/client-env.sh
+++ b/exercises/client-env.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
index 485208ba30..5abc7137b3 100755
--- a/exercises/floating_ips.sh
+++ b/exercises/floating_ips.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 81150061ca..dc6bbbb5c7 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -20,7 +20,7 @@ echo "*********************************************************************"
 set -o errtrace
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 # Environment
diff --git a/exercises/sec_groups.sh b/exercises/sec_groups.sh
index 5f8b0a4d5d..2f78e393eb 100755
--- a/exercises/sec_groups.sh
+++ b/exercises/sec_groups.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/swift.sh b/exercises/swift.sh
index 4a41e0f1ed..8aa376b8a7 100755
--- a/exercises/swift.sh
+++ b/exercises/swift.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index 0de1226fee..e7c3560894 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 

From 7eb672d1a95794644db8c34411f44734927bd87f Mon Sep 17 00:00:00 2001
From: Jan Stodt <stodtj@de.ibm.com>
Date: Wed, 24 Aug 2016 15:29:06 +0200
Subject: [PATCH 1517/3333] Update doc to reflect neutron became devstack
 default

Removing the explicit enablment of Neutron services, as with [1] they are configured as defaults in stackrc.

[1] https://review.openstack.org/#/c/350750/

Change-Id: Ic8910cd28fe37842f7d824e68bd2ea705e7e52de
---
 doc/source/guides/neutron.rst | 21 +--------------------
 1 file changed, 1 insertion(+), 20 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c5b1634f62..b26fd1e8ee 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -76,12 +76,6 @@ serving as a hypervisor for guest instances.
         RABBIT_PASSWORD=secret
         SERVICE_PASSWORD=secret
 
-        # Do not use Nova-Network
-        disable_service n-net
-        # Enable Neutron
-        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
-
-
         ## Neutron options
         Q_USE_SECGROUP=True
         FLOATING_RANGE="172.18.161.0/24"
@@ -389,11 +383,7 @@ controller node.
 
         Q_USE_PROVIDER_NETWORKING=True
 
-        # Do not use Nova-Network
-        disable_service n-net
-
-        # Neutron
-        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt
+        disable_service q-l3
 
         ## Neutron Networking options used to create Neutron Subnets
 
@@ -530,12 +520,6 @@ setup, with small modifications for the interface mappings.
     RABBIT_PASSWORD=secret
     SERVICE_PASSWORD=secret
 
-    # Do not use Nova-Network
-    disable_service n-net
-    # Enable Neutron
-    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
-
-
     ## Neutron options
     Q_USE_SECGROUP=True
     FLOATING_RANGE="172.18.161.0/24"
@@ -582,10 +566,7 @@ you do not require them.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
     Q_USE_PROVIDER_NETWORKING=True
 
-    #Enable Neutron services
-    disable_service n-net
     enable_plugin neutron git://git.openstack.org/openstack/neutron
-    ENABLED_SERVICES+=,q-agt,q-svc
 
     ## MacVTap agent options
     Q_AGENT=macvtap

From 88f8558d874072536e7660a233f24207a7089651 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Sun, 14 Aug 2016 06:55:42 -0700
Subject: [PATCH 1518/3333] Enable neutron to work in a multi node setup

On the controller node where devstack is being run should create
the neutron network. The compute node should not.

The the case that we want to run a multi-node neutron setup we need
to configure the following (in the case that a plugin does not
have any agents running on the compute node):
ENABLED_SERVICES=n-cpu,neutron

In addition to this the code did not enable decomposed plugins to
configure their nova configurations if necessary.

This patch ensure that the multi-node support works.

Change-Id: I8e80edd453a1106ca666d6c531b2433be631bce4
Closes-bug: #1613069
---
 lib/neutron                     | 3 +++
 lib/neutron_plugins/services/l3 | 8 ++++++++
 stack.sh                        | 5 +----
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index c1552e3d06..7442efd2c1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -305,6 +305,9 @@ function configure_neutron_nova_new {
 
     iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
+    # optionally set options in nova_conf
+    neutron_plugin_create_nova_conf
+
     if is_service_enabled neutron-metadata-agent; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
     fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a4e72483b4..334cd7a694 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -140,6 +140,14 @@ function _neutron_get_ext_gw_interface {
 }
 
 function create_neutron_initial_network {
+    if ! is_service_enabled q-svc && ! is_service_enabled neutron-api; then
+        echo "Controller services not enabled. No networks configured!"
+        return
+    fi
+    if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "False" ]]; then
+        echo "Network creation disabled!"
+        return
+    fi
     local project_id
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
diff --git a/stack.sh b/stack.sh
index 823b63ba24..ce34cd5ef3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1248,10 +1248,7 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
-    echo_summary "Creating initial neutron network elements"
-    create_neutron_initial_network
-fi
+create_neutron_initial_network
 
 if is_service_enabled nova; then
     echo_summary "Starting Nova"

From c12d1d9ce06ad9f524430469b15a066edadcddde Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 23 Aug 2016 19:07:57 -0500
Subject: [PATCH 1519/3333] Accept IPv6 RAs on the interface with the default
 route

Because neutron sets ipv6 forwarding settings, we stop accepting RAs
from IPv6-only host environments. This leads to a loss of external
connectivity, which is bad for zuul running tests and stuff.

Setting accept_ra to 2 will cause the RAs to be accepted.

Change-Id: Ia044fff2a1731ab6c04f82aea47096b425e0c0a0
---
 lib/neutron_plugins/services/l3 | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a4e72483b4..6bbac2c6a9 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -83,6 +83,9 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
+default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
     echo "$opts"
@@ -113,9 +116,7 @@ function _configure_neutron_l3_agent {
             _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
         fi
     else
-        local default_dev=""
-        default_dev=$(ip route | grep ^default | awk '{print $5}')
-        sudo iptables -t nat -A POSTROUTING -o $default_dev -s $FLOATING_RANGE -j MASQUERADE
+        sudo iptables -t nat -A POSTROUTING -o $default_route_dev -s $FLOATING_RANGE -j MASQUERADE
     fi
 }
 
@@ -351,6 +352,11 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+        # Ensure IPv6 RAs are accepted on the interface with the default route.
+        # This is needed for neutron-based devstack clouds to work in
+        # IPv6-only clouds in the gate. Please do not remove this without
+        # talking to folks in Infra.
+        sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge

From 7e40c6406b553c489515a6ca79014bcaaa5a7db3 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougwig@parkside.io>
Date: Sat, 20 Aug 2016 16:32:14 +0000
Subject: [PATCH 1520/3333] Remove lbaas from devstack proper, take 2

p-c patches have merged, neutron-lbaas removal is in the merge queue.

This reverts commit b3f26cb66c70b599c4d77945f2bdadd9537c7c35.

Depends-On: I506949e75bc62681412358ba689cb07b16311b68
Change-Id: I98d62c13ef90b20a9c67ef4f1720efcaa366fb31
---
 lib/neutron-legacy                        | 40 +-----------------
 lib/neutron_plugins/services/loadbalancer | 51 -----------------------
 stackrc                                   |  4 --
 3 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 25fb6b7847..e8f9aeb938 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -74,7 +74,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
@@ -88,9 +87,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# Default provider for load balancer service
-DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
-
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -252,12 +248,6 @@ if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
     source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 fi
 
-# Agent loadbalancer service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
-
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -316,10 +306,6 @@ function configure_mutnauq {
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-    if is_service_enabled q-lbaas; then
-        deprecated "Configuring q-lbaas through devstack is deprecated"
-        _configure_neutron_lbaas
-    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -418,10 +404,6 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
-    if is_service_enabled q-lbaas; then
-        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-        setup_develop $NEUTRON_LBAAS_DIR
-    fi
 
     if [ "$VIRT_DRIVER" == 'xenserver' ]; then
         local dom0_ip
@@ -452,10 +434,6 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
-
-    if is_service_enabled q-lbaas; then
-        neutron_agent_lbaas_install_agent_packages
-    fi
 }
 
 # Start running processes, including screen
@@ -516,7 +494,6 @@ function start_mutnauq_other_agents {
     fi
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
-    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file $LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -556,9 +533,6 @@ function stop_mutnauq_other {
         stop_process q-meta
     fi
 
-    if is_service_enabled q-lbaas; then
-        neutron_lbaas_stop
-    fi
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
@@ -662,7 +636,7 @@ function cleanup_mutnauq {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
@@ -818,18 +792,6 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
-function _configure_neutron_lbaas {
-    # Uses oslo config generator to generate LBaaS sample configuration files
-    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
-        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
-    fi
-    neutron_agent_lbaas_configure_common
-    neutron_agent_lbaas_configure_agent
-}
-
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
deleted file mode 100644
index 30e9480f2e..0000000000
--- a/lib/neutron_plugins/services/loadbalancer
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-
-# Neutron loadbalancer plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
-LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
-
-function neutron_agent_lbaas_install_agent_packages {
-    if is_ubuntu || is_fedora || is_suse; then
-        install_package haproxy
-    fi
-}
-
-function neutron_agent_lbaas_configure_common {
-    _neutron_service_plugin_class_add $LBAAS_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
-}
-
-function neutron_agent_lbaas_configure_agent {
-    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
-    mkdir -p $LBAAS_AGENT_CONF_PATH
-
-    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
-
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
-
-    if is_fedora; then
-        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
-        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
-    fi
-}
-
-function neutron_lbaas_stop {
-    pids=$(ps aux | awk '/haproxy/ { print $2 }')
-    [ ! -z "$pids" ] && sudo kill $pids || true
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/stackrc b/stackrc
index bfb897b338..446510c291 100644
--- a/stackrc
+++ b/stackrc
@@ -266,10 +266,6 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
-# neutron lbaas service
-NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
-NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
-
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}

From 1c5fc97136cfd9f89afc1d51239af343e0dda6a3 Mon Sep 17 00:00:00 2001
From: zhurong <aaronzhu1121@gmail.com>
Date: Thu, 25 Aug 2016 23:35:21 +0800
Subject: [PATCH 1521/3333] Add files/*.deb and files/*.deb.* to gitignore

Change-Id: Ieb8bc6a0852eabce987fef9441cca8770b711a38
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index a470ff5d27..d1781bc730 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,8 @@ files/*.gz
 files/*.vmdk
 files/*.rpm
 files/*.rpm.*
+files/*.deb
+files/*.deb.*
 files/*.qcow2
 files/*.img
 files/images

From 1554adef26bd3bd184ddab668660428bdf392232 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Fri, 22 Jul 2016 09:40:19 -0700
Subject: [PATCH 1522/3333] Revert "Revert "Use real Neutron network for L3 GW
 by default""

This reverts commit 7da968a8be03229cfa72b215b87f17e28e23a988.

Change-Id: I9ed28ccf6af611b280ada3420d7d2a833178fcac
---
 lib/neutron-legacy              | 4 ++--
 lib/neutron_plugins/services/l3 | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e8f9aeb938..b1b5230fdd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -199,7 +199,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 
 # With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
@@ -209,7 +209,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 # port for external connectivity.
 #
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 6eefb77597..b598241c78 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -17,6 +17,11 @@ IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
+# If Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=True, assign the gateway IP of the public
+# subnet to the public bridge interface even if Q_USE_PROVIDERNET_FOR_PUBLIC is
+# used.
+Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
+
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
@@ -51,7 +56,7 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
 # Generate 40-bit IPv6 Global ID to comply with RFC 4193
@@ -327,7 +332,7 @@ function _neutron_configure_router_v4 {
             local cidr_len=${FLOATING_RANGE#*/}
             local testcmd="ip -o link | grep -q $ext_gw_interface"
             test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" || $Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From 69d4a71dfe86e8111101dcd1bcf5a4138a7956a4 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Sat, 27 Aug 2016 01:01:37 +0000
Subject: [PATCH 1523/3333] Allow setup of credential encryption using fernet

With the addition of encrypted credential in keystone, we need to be able to
add setup steps in devstack to configure the credential repository with
encryption keys.

Depends-On: I97e7701bc5b8765d207cc721793643bcefa2d4e2
Depends-On: Id3e8922adc154cfec5f7a36613e22eb0b49eeffe
Change-Id: I433da9a257daa21ec3b5996b2bca571211f1fbba
---
 lib/keystone | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..797ff50646 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -345,6 +345,8 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 
+    iniset $KEYSTONE_CONF credential key_repository "$KEYSTONE_CONF_DIR/credential-keys/"
+
     # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
     # The users from this project are globally admin as before, but it also
     # allows policy changes in order to clarify the adminess scope.
@@ -514,6 +516,9 @@ function init_keystone {
         rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
         $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF fernet_setup
     fi
+    rm -rf "$KEYSTONE_CONF_DIR/credential-keys/"
+    $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF credential_setup
+
 }
 
 # install_keystoneauth() - Collect source and prepare

From 8f586fbefe10893343c6cf9d906f1e6734e89e88 Mon Sep 17 00:00:00 2001
From: Janki Chhatbar <jchhatba@redhat.com>
Date: Mon, 18 Jul 2016 08:19:25 +0530
Subject: [PATCH 1524/3333] Start virtlogd service

Ensure the virtlogd service is started, to work-around various
platform issues where it isn't started correctly.

Closes-Bug: #1603009
Change-Id: I548b377df6b2f0c287429e4387ee33184a82a64d
---
 lib/nova_plugins/functions-libvirt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4e5a748e45..cc013c3181 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -124,6 +124,12 @@ EOF
     # Service needs to be started on redhat/fedora -- do a restart for
     # sanity after fiddling the config.
     restart_service $LIBVIRT_DAEMON
+
+    # Restart virtlogd companion service to ensure it is running properly
+    #  https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1577455
+    #  https://bugzilla.redhat.com/show_bug.cgi?id=1290357
+    # (not all platforms have it; libvirt 1.3+ only, thus the ignore)
+    restart_service virtlogd || true
 }
 
 

From 26edd7b071f84e2fd2a9953086209e02b0c27ef3 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Mon, 8 Aug 2016 07:23:36 +0000
Subject: [PATCH 1525/3333] Install conntrack in XenServer Dom0

Neutron openvswitch agent running in compute node will control the
actual connection of the VMs in Dom0 via conntrack-tools, but Dom0
doesn't install conntrack-tools RPM by default.
This patch is to add such support with XenServer 7.0 and above.

Change-Id: Iec56db761015d4b7baa5a5f54314f4ff3fa67e02
---
 lib/nova_plugins/hypervisor-xenserver |  1 +
 tools/xen/functions                   | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e75226ae64..e5d25da3a3 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -87,6 +87,7 @@ CRONTAB
         cat $TOP_DIR/tools/xen/functions
         echo "create_directory_for_images"
         echo "create_directory_for_kernels"
+        echo "install_conntrack_tools"
     } | $ssh_dom0
 
 }
diff --git a/tools/xen/functions b/tools/xen/functions
index cf145686b5..e1864eb4bb 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -305,3 +305,25 @@ function get_domid {
 
     xe vm-list name-label="$vm_name_label" params=dom-id minimal=true
 }
+
+function install_conntrack_tools {
+    local xs_host
+    local xs_ver_major
+    local centos_ver
+    local conntrack_conf
+    xs_host=$(xe host-list --minimal)
+    xs_ver_major=$(xe host-param-get uuid=$xs_host param-name=software-version param-key=product_version_text_short | cut -d'.' -f 1)
+    if [ $xs_ver_major -gt 6 ]; then
+        # Only support conntrack-tools in Dom0 with XS7.0 and above
+        if [ ! -f /usr/sbin/conntrackd ]; then
+            sed -i s/#baseurl=/baseurl=/g /etc/yum.repos.d/CentOS-Base.repo
+            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'.' -f1-2 | tr '-' '.')
+            yum install -y --enablerepo=base --releasever=$centos_ver conntrack-tools
+            # Backup conntrackd.conf after install conntrack-tools, use the one with statistic mode
+            mv /etc/conntrackd/conntrackd.conf /etc/conntrackd/conntrackd.conf.back
+            conntrack_conf=$(find /usr/share/doc -name conntrackd.conf |grep stats)
+            cp $conntrack_conf /etc/conntrackd/conntrackd.conf
+        fi
+        service conntrackd restart
+    fi
+}

From 4d6017566a2fd550b418609c8452e6cf35dd29a7 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 12 Jul 2016 19:34:09 +0000
Subject: [PATCH 1526/3333] Add support for placement API to devstack

Uses lib/placement, but relies on some functionality from
lib/nova. This leads to some weirdness since the nova has
special status in stack.sh. If/when placement is extracted
it may be good to follow the devstack plugin structure
instead.

Because the placement code is currently a part of nova, there
are dependencies in lib/placement on a some $NOVA_* variable
and, if virtenv is being used, the virtualenv used by nova.

Because placement currently runs using nova's configuration
settings, not a lot actually happens in lib/placement: apache
is configured and keystone accounts and endpoints are created.

If PLACEMENT_DB_ENABLED is true then a separate placement db
will be configured.

When complete the initial version of the placement service will
provide support for managing resource providers, inventories and
allocations.

The placement api only runs under mod-wsgi.

Change-Id: I53dd3e6b41de17387a0e179fc9ac64c143b6a9eb
---
 clean.sh                            |   1 +
 files/apache-placement-api.template |  25 ++++
 lib/placement                       | 201 ++++++++++++++++++++++++++++
 stack.sh                            |  17 +++
 unstack.sh                          |   5 +
 5 files changed, 249 insertions(+)
 create mode 100644 files/apache-placement-api.template
 create mode 100644 lib/placement

diff --git a/clean.sh b/clean.sh
index 452df02d80..bace3f53fe 100755
--- a/clean.sh
+++ b/clean.sh
@@ -46,6 +46,7 @@ source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
+source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
new file mode 100644
index 0000000000..b89ef96776
--- /dev/null
+++ b/files/apache-placement-api.template
@@ -0,0 +1,25 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup placement-api
+    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/placement-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+Alias /placement %PUBLICWSGI%
+<Location /placement>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup placement-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/placement b/lib/placement
new file mode 100644
index 0000000000..4e80c55c26
--- /dev/null
+++ b/lib/placement
@@ -0,0 +1,201 @@
+#!/bin/bash
+#
+# lib/placement
+# Functions to control the configuration and operation of the **Placement** service
+#
+# Currently the placement service is embedded in nova. Eventually we
+# expect this to change so this file is started as a separate entity
+# despite making use of some *NOVA* variables and files.
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
+# - ``FILES``
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - install_placement
+# - cleanup_placement
+# - configure_placement
+# - init_placement
+# - start_placement
+# - stop_placement
+
+# Save trace setting
+_XTRACE_LIB_PLACEMENT=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+PLACEMENT_CONF_DIR=/etc/nova
+PLACEMENT_CONF=$PLACEMENT_CONF_DIR/nova.conf
+PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
+
+
+# The placement service can optionally use a separate database
+# connection. Set PLACEMENT_DB_ENABLED to True to use it.
+# NOTE(cdent): This functionality depends on some code that is not
+# yet merged in nova but is coming soon.
+PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
+
+if is_suse; then
+    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/srv/www/htdocs/placement}
+else
+    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/var/www/placement}
+fi
+
+if is_ssl_enabled_service "placement-api" || is_service_enabled tls-proxy; then
+    PLACEMENT_SERVICE_PROTOCOL="https"
+fi
+
+# Public facing bits
+PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
+PLACEMENT_SERVICE_PORT=${PLACEMENT_SERVICE_PORT:-8778}
+
+# Functions
+# ---------
+
+# Test if any placement services are enabled
+# is_placement_enabled
+function is_placement_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"placement-" ]] && return 0
+    return 1
+}
+
+# cleanup_placement() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_placement {
+    sudo rm -f $(apache_site_config_for placement-api)
+}
+
+# _config_placement_apache_wsgi() - Set WSGI config files
+function _config_placement_apache_wsgi {
+    sudo mkdir -p $PLACEMENT_WSGI_DIR
+
+    local placement_api_apache_conf
+    local placement_api_port=$PLACEMENT_SERVICE_PORT
+    local venv_path=""
+    placement_api_apache_conf=$(apache_site_config_for placement-api)
+
+    # reuse nova's cert if a cert is being used
+    if is_ssl_enabled_service "placement-api"; then
+        placement_ssl="SSLEngine On"
+        placement_certfile="SSLCertificateFile $NOVA_SSL_CERT"
+        placement_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
+    fi
+    # reuse nova's venv if there is one as placement code lives
+    # there
+    if [[ ${USE_VENV} = True ]]; then
+        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
+    fi
+
+    # copy wsgi application file
+    sudo cp $NOVA_DIR/nova/api/openstack/placement/placement-api.py $PLACEMENT_WSGI_DIR/placement-api
+
+    sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$placement_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%PUBLICWSGI%|$PLACEMENT_WSGI_DIR/placement-api|g;
+        s|%SSLENGINE%|$placement_ssl|g;
+        s|%SSLCERTFILE%|$placement_certfile|g;
+        s|%SSLKEYFILE%|$placement_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+        s|%APIWORKERS%|$API_WORKERS|g
+    " -i $placement_api_apache_conf
+}
+
+# configure_placement() - Set config files, create data dirs, etc
+function configure_placement {
+    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
+        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
+    fi
+
+    iniset $NOVA_CONF placement auth_type "password"
+    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF placement username placement
+    iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF placement user_domain_name "Default"
+    iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF placement project_domain_name "Default"
+    iniset $NOVA_CONF placement region_name "$REGION_NAME"
+    # TODO(cdent): auth_strategy, which is common to see in these
+    # blocks is not currently used here. For the time being the
+    # placement api uses the auth_strategy configuration setting
+    # established by the nova api. This avoids, for the time, being,
+    # creating redundant configuration items that are just used for
+    # testing.
+
+    _config_placement_apache_wsgi
+}
+
+# create_placement_accounts() - Set up required placement accounts
+# and service and endpoints.
+function create_placement_accounts {
+    create_service_user "placement" "admin"
+    local placement_api_url="$PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement"
+    get_or_create_service "placement" "placement" "Placement Service"
+    get_or_create_endpoint \
+        "placement" \
+        "$REGION_NAME" \
+        "$placement_api_url" \
+        "$placement_api_url" \
+        "$placement_api_url"
+}
+
+# init_placement() - Create service user and endpoints
+# If PLACEMENT_DB_ENABLED is true, create the separate placement db
+# using, for now, the api_db migrations.
+function init_placement {
+    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
+        recreate_database placement
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
+    fi
+    create_placement_accounts
+}
+
+# install_placement() - Collect source and prepare
+function install_placement {
+    install_apache_wsgi
+    if is_ssl_enabled_service "placement-api"; then
+        enable_mod_ssl
+    fi
+}
+
+# start_placement_api() - Start the API processes ahead of other things
+function start_placement_api {
+    # Get right service port for testing
+    local service_port=$PLACEMENT_SERVICE_PORT
+    local placement_api_port=$PLACEMENT_SERVICE_PORT
+
+    enable_apache_site placement-api
+    restart_apache_server
+    tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
+
+    echo "Waiting for placement-api to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
+        die $LINENO "placement-api did not start"
+    fi
+}
+
+function start_placement {
+    start_placement_api
+}
+
+# stop_placement() - Disable the api service and stop it.
+function stop_placement {
+    disable_apache_site placement-api
+    restart_apache_server
+}
+
+# Restore xtrace
+$_XTRACE_LIB_PLACEMENT
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/stack.sh b/stack.sh
index 98cdfc40df..cf157ab520 100755
--- a/stack.sh
+++ b/stack.sh
@@ -569,6 +569,7 @@ source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
+source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
@@ -859,6 +860,13 @@ if is_service_enabled nova; then
     configure_nova
 fi
 
+if is_service_enabled placement; then
+    # placement api
+    stack_install_service placement
+    cleanup_placement
+    configure_placement
+fi
+
 if is_service_enabled horizon; then
     # django openstack_auth
     install_django_openstack_auth
@@ -1160,6 +1168,11 @@ if is_service_enabled nova; then
     init_nova_cells
 fi
 
+if is_service_enabled placement; then
+    echo_summary "Configuring placement"
+    init_placement
+fi
+
 
 # Extras Configuration
 # ====================
@@ -1265,6 +1278,10 @@ if is_service_enabled nova; then
     start_nova
     create_flavors
 fi
+if is_service_enabled placement; then
+    echo_summary "Starting Placement"
+    start_placement
+fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
     start_cinder
diff --git a/unstack.sh b/unstack.sh
index ece69acad8..d93b8353db 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -63,6 +63,7 @@ source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
+source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
@@ -111,6 +112,10 @@ if is_service_enabled nova; then
     stop_nova
 fi
 
+if is_service_enabled placement; then
+    stop_placement
+fi
+
 if is_service_enabled glance; then
     stop_glance
 fi

From 5237d16d69cf54487b72dd8d12862cb4339efcbc Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Tue, 30 Aug 2016 10:59:52 -0400
Subject: [PATCH 1527/3333] LVM: Handle missing loop device at cleanup

When the loop device is not present because something
has gone wrong, this will print an error:
"losetup: option requires an argument -- 'd'"

Just skip the losetup -d in this case.

Change-Id: Iedc439b1ae924e9a599f6522eb081b83d43190c7
---
 lib/lvm | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index b9d7c390a2..d35a76fb5f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -58,7 +58,9 @@ function _clean_lvm_backing_file {
     if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
         local vg_dev
         vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
-        sudo losetup -d $vg_dev
+        if [[ -n "$vg_dev" ]]; then
+            sudo losetup -d $vg_dev
+        fi
         rm -f $backing_file
     fi
 }

From c9f6327844c794789ea3c3905cc8e04523262f71 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 30 Aug 2016 17:21:30 -0400
Subject: [PATCH 1528/3333] Remove lib/ceph

All jobs using ceph as a storage backend have been moved over
to using the devstack-plugin-ceph repo in project-config so we
should be safe to remove the now unused lib/ceph file.

The files are left in place because the devstack plugin does not
install xfsprogs but it's used by the create_disk function.

And the ceph cinder backend file is left in place since the
devstack-plugin-ceph repo uses that by setting
CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-ceph}.

Change-Id: I3fb09fc92bc6ab614e86d701ea46d5741a76b7a8
---
 extras.d/60-ceph.sh |  75 ---------
 functions-common    |   2 +-
 lib/ceph            | 381 --------------------------------------------
 3 files changed, 1 insertion(+), 457 deletions(-)
 delete mode 100644 extras.d/60-ceph.sh
 delete mode 100644 lib/ceph

diff --git a/extras.d/60-ceph.sh b/extras.d/60-ceph.sh
deleted file mode 100644
index cc90128176..0000000000
--- a/extras.d/60-ceph.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-# ceph.sh - DevStack extras script to install Ceph
-
-if is_service_enabled ceph; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/ceph
-    elif [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
-        echo_summary "Installing Ceph"
-        check_os_support_ceph
-        if [ "$REMOTE_CEPH" = "False" ]; then
-            install_ceph
-            echo_summary "Configuring Ceph"
-            configure_ceph
-            # NOTE (leseb): Do everything here because we need to have Ceph started before the main
-            # OpenStack components. Ceph OSD must start here otherwise we can't upload any images.
-            echo_summary "Initializing Ceph"
-            init_ceph
-            start_ceph
-        else
-            install_ceph_remote
-        fi
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        if is_service_enabled glance; then
-            echo_summary "Configuring Glance for Ceph"
-            configure_ceph_glance
-        fi
-        if is_service_enabled nova; then
-            echo_summary "Configuring Nova for Ceph"
-            configure_ceph_nova
-        fi
-        if is_service_enabled cinder; then
-            echo_summary "Configuring Cinder for Ceph"
-            configure_ceph_cinder
-        fi
-        if is_service_enabled n-cpu; then
-            # NOTE (leseb): the part below is a requirement to attach Ceph block devices
-            echo_summary "Configuring libvirt secret"
-            import_libvirt_secret_ceph
-        fi
-
-        if [ "$REMOTE_CEPH" = "False" ]; then
-            if is_service_enabled glance; then
-                echo_summary "Configuring Glance for Ceph"
-                configure_ceph_embedded_glance
-            fi
-            if is_service_enabled nova; then
-                echo_summary "Configuring Nova for Ceph"
-                configure_ceph_embedded_nova
-            fi
-            if is_service_enabled cinder; then
-                echo_summary "Configuring Cinder for Ceph"
-                configure_ceph_embedded_cinder
-            fi
-        fi
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        if [ "$REMOTE_CEPH" = "True" ]; then
-            cleanup_ceph_remote
-        else
-            cleanup_ceph_embedded
-            stop_ceph
-        fi
-        cleanup_ceph_general
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        if [ "$REMOTE_CEPH" = "True" ]; then
-            cleanup_ceph_remote
-        else
-            cleanup_ceph_embedded
-        fi
-        cleanup_ceph_general
-    fi
-fi
diff --git a/functions-common b/functions-common
index 3fdd71bffc..6312188ea8 100644
--- a/functions-common
+++ b/functions-common
@@ -1880,7 +1880,7 @@ function run_phase {
             # white listed elements in tree. We want these to move out
             # over time as well, but they are in tree, so we need to
             # manage that.
-            local exceptions="60-ceph.sh 80-tempest.sh"
+            local exceptions="80-tempest.sh"
             local extra
             extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
diff --git a/lib/ceph b/lib/ceph
deleted file mode 100644
index 1e55c48d68..0000000000
--- a/lib/ceph
+++ /dev/null
@@ -1,381 +0,0 @@
-#!/bin/bash
-#
-# lib/ceph
-# Functions to control the configuration and operation of the **Ceph** storage service
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``CEPH_DATA_DIR`` or ``DATA_DIR`` must be defined
-
-# ``stack.sh`` calls the entry points in this order (via ``extras.d/60-ceph.sh``):
-#
-# - install_ceph
-# - configure_ceph
-# - init_ceph
-# - start_ceph
-# - stop_ceph
-# - cleanup_ceph
-
-# Save trace setting
-_XTRACE_LIB_CEPH=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set ``CEPH_DATA_DIR`` to the location of Ceph drives and objects.
-# Default is the common DevStack data directory.
-CEPH_DATA_DIR=${CEPH_DATA_DIR:-/var/lib/ceph}
-CEPH_DISK_IMAGE=${CEPH_DATA_DIR}/drives/images/ceph.img
-
-# Set ``CEPH_CONF_DIR`` to the location of the configuration files.
-# Default is ``/etc/ceph``.
-CEPH_CONF_DIR=${CEPH_CONF_DIR:-/etc/ceph}
-
-# DevStack will create a loop-back disk formatted as XFS to store the
-# Ceph data. Set ``CEPH_LOOPBACK_DISK_SIZE`` to the disk size in
-# kilobytes.
-# Default is 1 gigabyte.
-CEPH_LOOPBACK_DISK_SIZE_DEFAULT=4G
-CEPH_LOOPBACK_DISK_SIZE=${CEPH_LOOPBACK_DISK_SIZE:-$CEPH_LOOPBACK_DISK_SIZE_DEFAULT}
-
-# Common
-CEPH_FSID=$(uuidgen)
-CEPH_CONF_FILE=${CEPH_CONF_DIR}/ceph.conf
-
-# Glance
-GLANCE_CEPH_USER=${GLANCE_CEPH_USER:-glance}
-GLANCE_CEPH_POOL=${GLANCE_CEPH_POOL:-images}
-GLANCE_CEPH_POOL_PG=${GLANCE_CEPH_POOL_PG:-8}
-GLANCE_CEPH_POOL_PGP=${GLANCE_CEPH_POOL_PGP:-8}
-
-# Nova
-NOVA_CEPH_POOL=${NOVA_CEPH_POOL:-vms}
-NOVA_CEPH_POOL_PG=${NOVA_CEPH_POOL_PG:-8}
-NOVA_CEPH_POOL_PGP=${NOVA_CEPH_POOL_PGP:-8}
-
-# Cinder
-CINDER_CEPH_POOL=${CINDER_CEPH_POOL:-volumes}
-CINDER_CEPH_POOL_PG=${CINDER_CEPH_POOL_PG:-8}
-CINDER_CEPH_POOL_PGP=${CINDER_CEPH_POOL_PGP:-8}
-CINDER_CEPH_USER=${CINDER_CEPH_USER:-cinder}
-CINDER_CEPH_UUID=${CINDER_CEPH_UUID:-$(uuidgen)}
-
-# Set ``CEPH_REPLICAS`` to configure how many replicas are to be
-# configured for your Ceph cluster. By default we are configuring
-# only one replica since this is way less CPU and memory intensive. If
-# you are planning to test Ceph replication feel free to increase this value
-CEPH_REPLICAS=${CEPH_REPLICAS:-1}
-CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
-
-# Connect to an existing Ceph cluster
-REMOTE_CEPH=$(trueorfalse False REMOTE_CEPH)
-REMOTE_CEPH_ADMIN_KEY_PATH=${REMOTE_CEPH_ADMIN_KEY_PATH:-$CEPH_CONF_DIR/ceph.client.admin.keyring}
-
-# Cinder encrypted volume tests are not supported with a Ceph backend due to
-# bug 1463525.
-ATTACH_ENCRYPTED_VOLUME_AVAILABLE=False
-
-
-# Functions
-# ------------
-
-function get_ceph_version {
-    local ceph_version_str
-    ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4 | cut -f 1,2 -d '.')
-    echo $ceph_version_str
-}
-
-# import_libvirt_secret_ceph() - Imports Cinder user key into libvirt
-# so it can connect to the Ceph cluster while attaching a Cinder block device
-function import_libvirt_secret_ceph {
-    cat > secret.xml <<EOF
-<secret ephemeral='no' private='no'>
-   <uuid>${CINDER_CEPH_UUID}</uuid>
-   <usage type='ceph'>
-     <name>client.${CINDER_CEPH_USER} secret</name>
-   </usage>
-</secret>
-EOF
-    sudo virsh secret-define --file secret.xml
-    sudo virsh secret-set-value --secret ${CINDER_CEPH_UUID} --base64 $(sudo ceph -c ${CEPH_CONF_FILE} auth get-key client.${CINDER_CEPH_USER})
-    sudo rm -f secret.xml
-}
-
-# undefine_virsh_secret() - Undefine Cinder key secret from libvirt
-function undefine_virsh_secret {
-    if is_service_enabled cinder || is_service_enabled nova; then
-        local virsh_uuid
-        virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
-        sudo virsh secret-undefine ${virsh_uuid} >/dev/null 2>&1
-    fi
-}
-
-
-# check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
-function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f23|f24) ]]; then
-        echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
-        if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
-            die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
-        fi
-        NO_UPDATE_REPOS=False
-    fi
-}
-
-# cleanup_ceph() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_ceph_remote {
-    # do a proper cleanup from here to avoid leftover on the remote Ceph cluster
-    if is_service_enabled glance; then
-        sudo ceph osd pool delete $GLANCE_CEPH_POOL $GLANCE_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-        sudo ceph auth del client.$GLANCE_CEPH_USER > /dev/null 2>&1
-    fi
-    if is_service_enabled cinder; then
-        sudo ceph osd pool delete $CINDER_CEPH_POOL $CINDER_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-        sudo ceph auth del client.$CINDER_CEPH_USER > /dev/null 2>&1
-    fi
-    if is_service_enabled c-bak; then
-        sudo ceph osd pool delete $CINDER_BAK_CEPH_POOL $CINDER_BAK_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-        sudo ceph auth del client.$CINDER_BAK_CEPH_USER > /dev/null 2>&1
-    fi
-    if is_service_enabled nova; then
-        iniset $NOVA_CONF libvirt rbd_secret_uuid ""
-        sudo ceph osd pool delete $NOVA_CEPH_POOL $NOVA_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-    fi
-}
-
-function cleanup_ceph_embedded {
-    sudo killall -w -9 ceph-mon
-    sudo killall -w -9 ceph-osd
-    sudo rm -rf ${CEPH_DATA_DIR}/*/*
-    if egrep -q ${CEPH_DATA_DIR} /proc/mounts; then
-        sudo umount ${CEPH_DATA_DIR}
-    fi
-    if [[ -e ${CEPH_DISK_IMAGE} ]]; then
-        sudo rm -f ${CEPH_DISK_IMAGE}
-    fi
-
-    # purge ceph config file and keys
-    sudo rm -rf ${CEPH_CONF_DIR}/*
-}
-
-function cleanup_ceph_general {
-    undefine_virsh_secret
-}
-
-
-# configure_ceph() - Set config files, create data dirs, etc
-function configure_ceph {
-    local count=0
-
-    # create a backing file disk
-    create_disk ${CEPH_DISK_IMAGE} ${CEPH_DATA_DIR} ${CEPH_LOOPBACK_DISK_SIZE}
-
-    # populate ceph directory
-    sudo mkdir -p ${CEPH_DATA_DIR}/{bootstrap-mds,bootstrap-osd,mds,mon,osd,tmp}
-
-    # create ceph monitor initial key and directory
-    sudo ceph-authtool /var/lib/ceph/tmp/keyring.mon.$(hostname) \
-        --create-keyring --name=mon. --add-key=$(ceph-authtool --gen-print-key) \
-        --cap mon 'allow *'
-    sudo mkdir /var/lib/ceph/mon/ceph-$(hostname)
-
-    # create a default ceph configuration file
-    sudo tee ${CEPH_CONF_FILE} > /dev/null <<EOF
-[global]
-fsid = ${CEPH_FSID}
-mon_initial_members = $(hostname)
-mon_host = ${SERVICE_HOST}
-auth_cluster_required = cephx
-auth_service_required = cephx
-auth_client_required = cephx
-filestore_xattr_use_omap = true
-osd crush chooseleaf type = 0
-osd journal size = 100
-EOF
-
-    # bootstrap the ceph monitor
-    sudo ceph-mon -c ${CEPH_CONF_FILE} --mkfs -i $(hostname) \
-        --keyring /var/lib/ceph/tmp/keyring.mon.$(hostname)
-
-    if is_ubuntu; then
-        sudo touch /var/lib/ceph/mon/ceph-$(hostname)/upstart
-        sudo initctl emit ceph-mon id=$(hostname)
-    else
-        sudo touch /var/lib/ceph/mon/ceph-$(hostname)/sysvinit
-        sudo service ceph start mon.$(hostname)
-    fi
-
-    # wait for the admin key to come up otherwise we will not be able to do the actions below
-    until [ -f ${CEPH_CONF_DIR}/ceph.client.admin.keyring ]; do
-        echo_summary "Waiting for the Ceph admin key to be ready..."
-
-        count=$(($count + 1))
-        if [ $count -eq 3 ]; then
-            die $LINENO "Maximum of 3 retries reached"
-        fi
-        sleep 5
-    done
-
-    # pools data and metadata were removed in the Giant release so depending on the version we apply different commands
-    local ceph_version
-    ceph_version=$(get_ceph_version)
-    # change pool replica size according to the CEPH_REPLICAS set by the user
-    if [[ ${ceph_version%%.*} -eq 0 ]] && [[ ${ceph_version##*.} -lt 87 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set data size ${CEPH_REPLICAS}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata size ${CEPH_REPLICAS}
-    else
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
-    fi
-
-    # create a simple rule to take OSDs instead of host with CRUSH
-    # then apply this rules to the default pool
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd crush rule create-simple devstack default osd
-        RULE_ID=$(sudo ceph -c ${CEPH_CONF_FILE} osd crush rule dump devstack | awk '/rule_id/ {print $3}' | cut -d ',' -f1)
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd crush_ruleset ${RULE_ID}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set data crush_ruleset ${RULE_ID}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata crush_ruleset ${RULE_ID}
-    fi
-
-    # create the OSD(s)
-    for rep in ${CEPH_REPLICAS_SEQ}; do
-        OSD_ID=$(sudo ceph -c ${CEPH_CONF_FILE} osd create)
-        sudo mkdir -p ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}
-        sudo ceph-osd -c ${CEPH_CONF_FILE} -i ${OSD_ID} --mkfs
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create osd.${OSD_ID} \
-            mon 'allow profile osd ' osd 'allow *' | \
-            sudo tee ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/keyring
-
-        # ceph's init script is parsing ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/ and looking for a file
-        # 'upstart' or 'sysinitv', thanks to these 'touches' we are able to control OSDs daemons
-        # from the init script.
-        if is_ubuntu; then
-            sudo touch ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/upstart
-        else
-            sudo touch ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/sysvinit
-        fi
-    done
-}
-
-function configure_ceph_embedded_glance {
-    # configure Glance service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${GLANCE_CEPH_POOL} size ${CEPH_REPLICAS}
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${GLANCE_CEPH_POOL} crush_ruleset ${RULE_ID}
-    fi
-}
-
-# configure_ceph_glance() - Glance config needs to come after Glance is set up
-function configure_ceph_glance {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${GLANCE_CEPH_POOL} ${GLANCE_CEPH_POOL_PG} ${GLANCE_CEPH_POOL_PGP}
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} \
-        mon "allow r" \
-        osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | \
-        sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
-    sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
-
-    iniset $GLANCE_API_CONF DEFAULT show_image_direct_url True
-    iniset $GLANCE_API_CONF glance_store default_store rbd
-    iniset $GLANCE_API_CONF glance_store stores "file, http, rbd"
-    iniset $GLANCE_API_CONF glance_store rbd_store_ceph_conf $CEPH_CONF_FILE
-    iniset $GLANCE_API_CONF glance_store rbd_store_user $GLANCE_CEPH_USER
-    iniset $GLANCE_API_CONF glance_store rbd_store_pool $GLANCE_CEPH_POOL
-}
-
-function configure_ceph_embedded_nova {
-    # configure Nova service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} size ${CEPH_REPLICAS}
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} crush_ruleset ${RULE_ID}
-    fi
-}
-
-# configure_ceph_nova() - Nova config needs to come after Nova is set up
-function configure_ceph_nova {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${NOVA_CEPH_POOL} ${NOVA_CEPH_POOL_PG} ${NOVA_CEPH_POOL_PGP}
-    iniset $NOVA_CONF libvirt rbd_user ${CINDER_CEPH_USER}
-    iniset $NOVA_CONF libvirt rbd_secret_uuid ${CINDER_CEPH_UUID}
-    iniset $NOVA_CONF libvirt inject_key false
-    iniset $NOVA_CONF libvirt disk_cachemodes "network=writeback"
-    iniset $NOVA_CONF libvirt images_type rbd
-    iniset $NOVA_CONF libvirt images_rbd_pool ${NOVA_CEPH_POOL}
-    iniset $NOVA_CONF libvirt images_rbd_ceph_conf ${CEPH_CONF_FILE}
-
-    if ! is_service_enabled cinder; then
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
-            mon "allow r" \
-            osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | \
-            sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
-        sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
-    fi
-}
-
-function configure_ceph_embedded_cinder {
-    # Configure Cinder service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_CEPH_POOL} size ${CEPH_REPLICAS}
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_CEPH_POOL} crush_ruleset ${RULE_ID}
-    fi
-}
-
-# configure_ceph_cinder() - Cinder config needs to come after Cinder is set up
-function configure_ceph_cinder {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_CEPH_POOL} ${CINDER_CEPH_POOL_PG} ${CINDER_CEPH_POOL_PGP}
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
-        mon "allow r" \
-        osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | \
-        sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
-    sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
-}
-
-# init_ceph() - Initialize databases, etc.
-function init_ceph {
-    # clean up from previous (possibly aborted) runs
-    # make sure to kill all ceph processes first
-    sudo pkill -f ceph-mon || true
-    sudo pkill -f ceph-osd || true
-}
-
-# install_ceph() - Collect source and prepare
-function install_ceph_remote {
-    install_package ceph-common
-}
-
-function install_ceph {
-    install_package ceph
-}
-
-# start_ceph() - Start running processes, including screen
-function start_ceph {
-    if is_ubuntu; then
-        sudo initctl emit ceph-mon id=$(hostname)
-        for id in $(sudo ceph -c ${CEPH_CONF_FILE} osd ls); do
-            sudo start ceph-osd id=${id}
-        done
-    else
-        sudo service ceph start
-    fi
-}
-
-# stop_ceph() - Stop running processes (non-screen)
-function stop_ceph {
-    if is_ubuntu; then
-        sudo service ceph-mon-all stop > /dev/null 2>&1
-        sudo service ceph-osd-all stop > /dev/null 2>&1
-    else
-        sudo service ceph stop > /dev/null 2>&1
-    fi
-}
-
-
-# Restore xtrace
-$_XTRACE_LIB_CEPH
-
-## Local variables:
-## mode: shell-script
-## End:

From 0385caa2ee503486cab1a81dbdda691aa259134c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 31 Aug 2016 10:07:06 +1000
Subject: [PATCH 1529/3333] Fix comment in plugin-registry header

Fix the comment to actually be a comment.  Regenerate page.

Although we've got a pretty cool system for generating this, I wonder
if anyone actually looks at it?  Maybe it's just helpful as a form of
SEO.

Change-Id: I15aaa983716f9ee897293c2954ca7ae561951372
---
 data/devstack-plugins-registry.header | 20 +++++++++-----------
 doc/source/plugin-registry.rst        | 20 +++++++++-----------
 2 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 6119ab5284..576dbbd35a 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -1,18 +1,16 @@
-..
+.. Note to patch submitters:
 
-  Note to patch submitters:
+   # ============================= #
+   # THIS FILE IS AUTOGENERATED !  #
+   # ============================= #
 
-  # ============================= #
-  # THIS FILE IS AUTOGENERATED !  #
-  # ============================= #
+   ** Plugins are found automatically and added to this list **
 
-  ** Plugins are found automatically and added to this list **
+   This file is created by a periodic proposal job.  You should not
+   edit this file.
 
-  This file is created by a periodic proposal job.  You should not
-  edit this file.
-
-  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header to modify this text.
+   You should edit the files data/devstack-plugins-registry.footer
+   data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bb8527041e..d6df1efa4f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,18 +1,16 @@
-..
+..  Note to patch submitters:
 
-  Note to patch submitters:
+    # ============================= #
+    # THIS FILE IS AUTOGENERATED !  #
+    # ============================= #
 
-  # ============================= #
-  # THIS FILE IS AUTOGENERATED !  #
-  # ============================= #
+    ** Plugins are found automatically and added to this list **
 
-  ** Plugins are found automatically and added to this list **
+    This file is created by a periodic proposal job.  You should not
+    edit this file.
 
-  This file is created by a periodic proposal job.  You should not
-  edit this file.
-
-  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header to modify this text.
+    You should edit the files data/devstack-plugins-registry.footer
+    data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry

From d3fab7bfc16284a24a66f1724805c35535432fc0 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Tue, 30 Aug 2016 18:13:52 -0700
Subject: [PATCH 1530/3333] Revert "Allow properly overriding DEST"

After I00847bb6733febf105855ae6fc577a7c904ec4b4, we cannot see the
test result (testr_result.html) on gate jobs.
So let's revert the patch for verifying the test result on the gate.

Change-Id: I9db1ff9f43b22d1634a43c7d5e502cc205aa26f2
Closes-Bug: #1617476
---
 stackrc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stackrc b/stackrc
index f7bdbc2b04..c14085a910 100644
--- a/stackrc
+++ b/stackrc
@@ -16,6 +16,15 @@ source $RC_DIR/functions
 # Destination path for installation
 DEST=/opt/stack
 
+# Destination for working data
+DATA_DIR=${DEST}/data
+
+# Destination for status files
+SERVICE_DIR=${DEST}/status
+
+# Path for subunit output file
+SUBUNIT_OUTPUT=${DEST}/devstack.subunit
+
 # Determine stack user
 if [[ $EUID -eq 0 ]]; then
     STACK_USER=stack
@@ -121,15 +130,6 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
-# Destination for working data
-DATA_DIR=${DATA_DIR:-$DEST/data}
-
-# Destination for status files
-SERVICE_DIR=${SERVICE_DIR:-$DEST/status}
-
-# Path for subunit output file
-SUBUNIT_OUTPUT=${SUBUNIT_OUTPUT:-$DEST/devstack.subunit}
-
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From 43ff27b7e8e9d209d8f1fc0483da717296be93bc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 30 Aug 2016 21:13:15 -0400
Subject: [PATCH 1531/3333] Use wsgi-script installed nova-placement-api

We should use the standard install nova-placement-api script which is
managed by the python package instead of a one off copy procedure.

Depends-On: I00d032554de273d7493cfb467f81687c08fd5389

Change-Id: I74b39d6a0cedea7c18ce8080dcddb43d13df1de8
---
 lib/placement | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/lib/placement b/lib/placement
index 4e80c55c26..56a4b56675 100644
--- a/lib/placement
+++ b/lib/placement
@@ -40,12 +40,6 @@ PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
 # yet merged in nova but is coming soon.
 PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
 
-if is_suse; then
-    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/srv/www/htdocs/placement}
-else
-    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/var/www/placement}
-fi
-
 if is_ssl_enabled_service "placement-api" || is_service_enabled tls-proxy; then
     PLACEMENT_SERVICE_PROTOCOL="https"
 fi
@@ -73,11 +67,11 @@ function cleanup_placement {
 
 # _config_placement_apache_wsgi() - Set WSGI config files
 function _config_placement_apache_wsgi {
-    sudo mkdir -p $PLACEMENT_WSGI_DIR
-
     local placement_api_apache_conf
     local placement_api_port=$PLACEMENT_SERVICE_PORT
     local venv_path=""
+    local nova_bin_dir=""
+    nova_bin_dir=$(get_python_exec_prefix)
     placement_api_apache_conf=$(apache_site_config_for placement-api)
 
     # reuse nova's cert if a cert is being used
@@ -90,16 +84,14 @@ function _config_placement_apache_wsgi {
     # there
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
+        nova_bin_dir=${PROJECT_VENV["nova"]}/bin
     fi
 
-    # copy wsgi application file
-    sudo cp $NOVA_DIR/nova/api/openstack/placement/placement-api.py $PLACEMENT_WSGI_DIR/placement-api
-
     sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$placement_api_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$PLACEMENT_WSGI_DIR/placement-api|g;
+        s|%PUBLICWSGI%|$nova_bin_dir/nova-placement-api|g;
         s|%SSLENGINE%|$placement_ssl|g;
         s|%SSLCERTFILE%|$placement_certfile|g;
         s|%SSLKEYFILE%|$placement_keyfile|g;

From 11817482c03b3994cde93320f138d5a7ccd821d3 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 16:02:49 +0900
Subject: [PATCH 1532/3333] lib/neutron: Use NEUTRON_PLUGIN instead of
 hardcoding ml2

Change-Id: Ia60381694f30978984cdf33e3141dc153d294e17
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c1552e3d06..3fbcbd9a4d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -139,7 +139,7 @@ function configure_neutron_new {
 
         cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
 
-        iniset $NEUTRON_CONF DEFAULT core_plugin ml2
+        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_PLUGIN
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True

From a25ae6c03de2d87bca4f708ffc338c66164eec3b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 31 Aug 2016 08:56:37 -0400
Subject: [PATCH 1533/3333] convert apache logs to color for screen

If we left the ansi color codes in apache logs, we can run a sed
script to convert the escaped escapes back to ansi escapes which make
the logs colorized again.

There are 8 \ because we need to end up with 2 in the final sed, and
we get interopolated twice. How much fun is escape interpolation? All
the fun.

Change-Id: Id8531cf03ba80f0df62f20add02e757bd63d4f2d
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 3fdd71bffc..7524eab68f 100644
--- a/functions-common
+++ b/functions-common
@@ -1686,7 +1686,7 @@ function tail_log {
     local logfile=$2
 
     if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_process "$name" "sudo tail -f $logfile"
+        screen_process "$name" "sudo tail -f $logfile | sed 's/\\\\\\\\x1b/\o033/g'"
     fi
 }
 

From 44bf88cd3990c5255e1a0b94842446b8a472b87d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 31 Aug 2016 10:39:46 -0400
Subject: [PATCH 1534/3333] Fix region name placement config option

The placement config option for setting the region is
actually 'os_region_name', not 'region_name', see:

https://review.openstack.org/#/c/358797/13/nova/conf/placement.py

Change-Id: I62e79c6860e2329428e3115d14ee86f5ff15d7e8
---
 lib/placement | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/placement b/lib/placement
index 56a4b56675..165c670206 100644
--- a/lib/placement
+++ b/lib/placement
@@ -114,7 +114,7 @@ function configure_placement {
     iniset $NOVA_CONF placement user_domain_name "Default"
     iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
     iniset $NOVA_CONF placement project_domain_name "Default"
-    iniset $NOVA_CONF placement region_name "$REGION_NAME"
+    iniset $NOVA_CONF placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the
     # placement api uses the auth_strategy configuration setting

From eb6ef2f80ea11aa7ba3f9ff52cb03704db3547d4 Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew@lascii.com>
Date: Mon, 29 Aug 2016 10:02:41 -0400
Subject: [PATCH 1535/3333] Create the nova_api_cell0 database

As part of Nova cellsv2 there is now a third database that must be setup
for use by Nova. This database is an exact copy of the 'nova' database.
Only do this if NOVA_CONFIGURE_CELLSV2 is overridden.

Change-Id: I8775b8066ba85fbdbcdfb42c28cb567fc7759fe5
---
 lib/nova | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 235b533d77..f5a798c923 100644
--- a/lib/nova
+++ b/lib/nova
@@ -85,6 +85,9 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
+# Option to initialize CellsV2 environment
+NOVA_CONFIGURE_CELLSV2=$(trueorfalse False NOVA_CONFIGURE_CELLSV2)
+
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-filter_scheduler}
@@ -682,10 +685,15 @@ function init_nova {
     # All nova components talk to a central database.
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
-        # (Re)create nova database
+        # (Re)create nova databases
         recreate_database nova
+        if [ "$NOVA_CONFIGURE_CELLSV2" != "False" ]; then
+            recreate_database nova_api_cell0
+        fi
 
-        # Migrate nova database
+        # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
+        # been run this migrates the "nova" and "nova_api_cell0" database.
+        # Otherwise it just migrates the "nova" database.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
         if is_service_enabled n-cell; then

From 0bf25506b03c78dd809e3638cabcf1fc11e9f1a0 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 30 Aug 2016 22:14:04 +0000
Subject: [PATCH 1536/3333] Move RABBIT_USERID to lib/rpc_backend

This moves setting of RABBIT_USERID from stack.sh to lib/rpc_backend
so it may be used in grenade runs, which don't have the defaulted
value from stack.sh. The RABBIT_USERID is needed in order to call
get_transport_url in lib/rpc_backend.

Change-Id: I6f211e9102f79418f9f94a15784f91c4150ab8a7
---
 lib/rpc_backend | 2 ++
 stack.sh        | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 0ee46dca6f..97b1aa409a 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -24,6 +24,8 @@
 _XTRACE_RPC_BACKEND=$(set +o | grep xtrace)
 set +o xtrace
 
+RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
+
 # Functions
 # ---------
 
diff --git a/stack.sh b/stack.sh
index cf157ab520..09466a6894 100755
--- a/stack.sh
+++ b/stack.sh
@@ -664,7 +664,6 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 # Rabbit connection info
 # In multi node DevStack, second node needs ``RABBIT_USERID``, but rabbit
 # isn't enabled.
-RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
 if is_service_enabled rabbit; then
     RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
     read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."

From 542abbab3bc58c40a499531165943df4bf2e4ab0 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Wed, 31 Aug 2016 15:47:56 -0500
Subject: [PATCH 1537/3333] Keystone uwsgi set lazy-apps=true
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keystone had a problem where there was a memcached socket
opened very early on startup which then got shared between
worker processes when running under uwsgi. This can be
prevented by setting lazy-apps so this is the recommended
setting.

See http://uwsgi-docs.readthedocs.io/en/latest/ThingsToKnow.html

"""uWSGI tries to (ab)use the Copy On Write semantics of the
fork() call whenever possible. By default it will fork after
having loaded your applications to share as much of their
memory as possible. If this behavior is undesirable for some
reason, use the lazy-apps option. This will instruct uWSGI to
load the applications after each worker’s fork(). Beware as
there is an older options named lazy that is way more invasive
and highly discouraged (it is still here only for backward
compatibility) """

Change-Id: I6f271dc906528f0c86060452deaf15df81b267d2
Related-Bug: 1600394
---
 lib/keystone | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..6e5d3dc42c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -338,6 +338,8 @@ function configure_keystone {
             iniset "$file" uwsgi buffer-size 65535
             # Make sure the client doesn't try to re-use the connection.
             iniset "$file" uwsgi add-header "Connection: close"
+            # This ensures that file descriptors aren't shared between processes.
+            iniset "$file" uwsgi lazy-apps true
         done
     fi
 

From eb77eef8a57f8a4d012d8bee316e56b1764919de Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Wed, 31 Aug 2016 16:26:17 -0500
Subject: [PATCH 1538/3333] Keystone re-enable catalog caching

Catalog caching was disabled due to bug 1537617, but this has been
fixed for some time. Re-enabling to get some performance back.

Change-Id: Ic0edf5c70a5040edf3393dbd1e110ab5fb56c110
Related-Bug: 1537617
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..f8119ebeea 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -248,9 +248,6 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
     iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
-    # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617
-    iniset $KEYSTONE_CONF catalog caching "False"
-
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
     # Register SSL certificates if provided

From 40b433fb07d2612075a30e2e18fbae094c2c8ec0 Mon Sep 17 00:00:00 2001
From: Clay Gerrard <clay.gerrard@gmail.com>
Date: Thu, 1 Sep 2016 02:07:12 -0700
Subject: [PATCH 1539/3333] Make unstack.sh more independently deterministic

In some initialization conditions (having never ran stack.sh) the
result of unstack.sh is dependent on if the user had previously
installed lvm2 or disabled the cinder service.

This change makes all results the same with a bit of LBYL.

There's also a drive-by to put a comment back where it belongs after
being accidentally moved in the related change.

Related-Change: I09b1a7bee0785e5e1bb7dc96158a654bd3f15c83

Change-Id: I9a7e052677d60cbbbdd582877f3c6c48c387f668
Closes-Bug: #1619195
---
 unstack.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index d93b8353db..f888896cb9 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -189,11 +189,13 @@ if [[ -n "$SCREEN" ]]; then
     fi
 fi
 
-# BUG: maybe it doesn't exist? We should isolate this further down.
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
-# enabled backends. So if Cinder is enabled, we are sure lvm (lvremove,
-# /etc/lvm/lvm.conf, etc.) is here.
-if is_service_enabled cinder; then
+# enabled backends. So if Cinder is enabled, and installed successfully we are
+# sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.
+if is_service_enabled cinder && is_package_installed lvm2; then
+    # Using /bin/true here indicates a BUG - maybe the
+    # DEFAULT_VOLUME_GROUP_NAME doesn't exist?  We should
+    # isolate this further down in lib/cinder cleanup.
     clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
     clean_lvm_filter
 fi

From 6930ba312f787e0459f7455ac6ba2a70b3c7c37d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 1 Sep 2016 07:25:28 -0500
Subject: [PATCH 1540/3333] Specify a cloud for openstack complete

there is a bug in openstackclient that is causing a password prompt

Related-Bug: 1619274
here.

Change-Id: I3aee25845ece846ed2b35aa242dc684b55ac2381
---
 stack.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 09466a6894..1cc4eca1b9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1383,7 +1383,12 @@ check_libs_from_git
 # ===============
 
 # Prepare bash completion for OSC
-openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+#
+# BUG: https://bugs.launchpad.net/python-openstackclient/+bug/1619274
+# the os-cloud param should not be required but if we don't provide it
+# then this command hangs indefinitely if something is wrong with
+# default environment credentials.
+openstack --os-cloud=devstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
 # If cinder is configured, set global_filter for PV devices
 if is_service_enabled cinder; then

From 71119b47a0e3fb86b349732a1777be8c83d2e6c2 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 15 Aug 2016 12:06:55 -0700
Subject: [PATCH 1541/3333] Setup cellsv2 for Nova

This patch setup cellsv2 for Nova after plugin initialization phase.
Since this requires compute hosts to be started, we need to do it
after we have initialized all other plugins. Things like ironic
aren't setup when we were running this as part of nova setup, and
thus this command can fail.

When cellsv1 is used (n-cell is enabled) skip calling
cells_v2 simple_cell_setup, which will never have hosts
at the top level and which will always fail.

Change-Id: Ic7d0115da51d6ea17ee49071af259a7789c62ab9
Depends-On: I9bbaa4c92503222c9fd015fe075926b50f3dcc8c
---
 lib/nova | 9 +++++++++
 stack.sh | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/lib/nova b/lib/nova
index f5a798c923..670f605fd6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -946,6 +946,15 @@ function create_flavors {
     fi
 }
 
+# create_cell(): Group the available hosts into a cell
+function create_cell {
+    if ! is_service_enabled n-cell; then
+        nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
+    else
+        echo 'Skipping cellsv2 setup for this cellsv1 configuration'
+    fi
+}
+
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index 1cc4eca1b9..4b071841b8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1379,6 +1379,14 @@ service_check
 check_libs_from_git
 
 
+# Configure nova cellsv2
+# ----------------------
+
+# Do this late because it requires compute hosts to have started
+if is_service_enabled n-api && [ "$NOVA_CONFIGURE_CELLSV2" == "True" ]; then
+    create_cell
+fi
+
 # Bash completion
 # ===============
 

From 085f2fb0e2d399281b137c9fa95a7a39e270be7d Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Fri, 2 Sep 2016 14:00:39 -0700
Subject: [PATCH 1542/3333] Remove the same configurations as the default

The default value of force_dhcp_release is True on Nova side:
https://github.com/openstack/nova/blob/master/nova/conf/network.py#L306
The default value of vnc.enabled is True on Nova side:
https://github.com/openstack/nova/blob/master/nova/conf/vnc.py#L27
The default value of spice.enabled is False on Nova side:
https://github.com/openstack/nova/blob/master/nova/conf/spice.py#L30

So it is not necessary to set them on Devstack.

Change-Id: I67cc103269d2d612ad443c72f2a77d7ae2ca09e3
---
 lib/nova | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 670f605fd6..8496868821 100644
--- a/lib/nova
+++ b/lib/nova
@@ -461,7 +461,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
-    iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
     iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
@@ -557,7 +556,6 @@ function create_nova_conf {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF vnc enabled true
         iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
@@ -575,8 +573,6 @@ function create_nova_conf {
         iniset $NOVA_CONF spice server_listen "$SPICESERVER_LISTEN"
         iniset $NOVA_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-    else
-        iniset $NOVA_CONF spice enabled false
     fi
 
     # Set the oslo messaging driver to the typical default. This does not

From 0a40710b9f82555abd0478498d743a973680f5d9 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Sun, 4 Sep 2016 12:52:01 +0000
Subject: [PATCH 1543/3333] Adding vfio to cgroup_device_acl during libvirt
 configuration

vfio should be added to cgroups on some of the Distributions like
Ubuntu 16-04

Change-Id: I7239858b6307e37bf1237b92d69a0520ab5ad304
---
 lib/nova_plugins/functions-libvirt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index cc013c3181..6b7c7c263b 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -65,6 +65,7 @@ cgroup_device_acl = [
     "/dev/random", "/dev/urandom",
     "/dev/ptmx", "/dev/kvm", "/dev/kqemu",
     "/dev/rtc", "/dev/hpet","/dev/net/tun",
+    "/dev/vfio/vfio",
 ]
 EOF
     fi

From 0063495b00409651c3bd02a7b3a31ba5b6ea40c0 Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Fri, 26 Aug 2016 10:29:20 +0200
Subject: [PATCH 1544/3333] Make PIP_GET_PIP_URL configurable via local.conf

The default get_pip url regulary times out when starting devstack
from behind company firewalls. Making this a configureable variable,
user can make use of internal git-pip.py mirrors without modifying
any code.

Change-Id: I66a5534d51ab23a4d8586c27d37b4b6b8a6892c9
---
 tools/install_pip.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 12676998d2..a5ccb19399 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -24,7 +24,20 @@ set -o xtrace
 
 FILES=$TOP_DIR/files
 
-PIP_GET_PIP_URL=https://bootstrap.pypa.io/get-pip.py
+# The URL from where the get-pip.py file gets downloaded. If a local
+# get-pip.py mirror is available, PIP_GET_PIP_URL can be set to that
+# mirror in local.conf to avoid download timeouts.
+# Example:
+#  PIP_GET_PIP_URL="http://local-server/get-pip.py"
+#
+# Note that if get-pip.py already exists in $FILES this script will
+# not re-download or check for a new version.  For example, this is
+# done by openstack-infra diskimage-builder elements as part of image
+# preparation [1].  This prevents any network access, which can be
+# unreliable in CI situations.
+# [1] http://git.openstack.org/cgit/openstack-infra/project-config/tree/nodepool/elements/cache-devstack/source-repository-pip
+
+PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
 LOCAL_PIP="$FILES/$(basename $PIP_GET_PIP_URL)"
 
 GetDistro

From f3daa9548efd53e09d141f588342d4d94683b6c8 Mon Sep 17 00:00:00 2001
From: scottda <scott.dangelo@hpe.com>
Date: Tue, 6 Sep 2016 13:45:32 -0600
Subject: [PATCH 1545/3333] Add thin-provisioning-tools for Cinder

Ubuntu's LVM packaging does not support thin provisioning by
default:
 /usr/sbin/thin_check: execvp failed: No such file or directory
This is fixed with install of thin-provisioning-tools.

Change-Id: I31f572934ea94cae6e2aea27a2c731ee5bca68d3
Closes-Bug: #1615134
---
 files/debs/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/cinder b/files/debs/cinder
index 3595e011da..c1b79fda47 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -3,3 +3,4 @@ open-iscsi
 open-iscsi-utils # Deprecated since quantal dist:precise
 qemu-utils
 tgt # NOPRIME
+thin-provisioning-tools

From 95469032656c442982730ea307644d47d7755a81 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 8 Sep 2016 17:08:36 -0700
Subject: [PATCH 1546/3333] Set sensible default for LB_PHYSICAL_INT

Configure the linux bridge physical interface to use the interface for
the default route on the current host. In the future we should consider
using a dangling interface so that we aren't affecting the host
instances networking but this roughly matches what testing has been
using in the past.

Change-Id: I7859437f97e6cab929e90208fe56f7efd62dfe01
---
 lib/neutron-legacy | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b1b5230fdd..1b7c4db507 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -211,13 +211,15 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
+default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the network interface to use for the physical
 # network.
 #
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
-LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-}
+LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-$default_route_dev}
 
 # When Neutron tunnels are enabled it is needed to specify the
 # IP address of the end point in the local server. This IP is set

From 9c69eacabaac45a7ea3574744975fac5cf1ac10d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 12 Sep 2016 14:58:20 +1000
Subject: [PATCH 1547/3333] Don't add deb-* packaging repos to plugin list

A couple of hundred of these were added with
Ia02f4e1819ac47b12b4ce4381e04253eb26e9f70 and you can see in some of
the proposals at I21fd2b3866efe66dd1f7173003c2521688aa7fd6 they're
starting to match.  Just ignore packaging repos as they're not really
relevant for the purposes of plugin list.

Change-Id: Iaf9e0c0fb672a70c3aee1bbcf587bb0d387e5945
---
 tools/generate-devstack-plugins-list.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index bbad1bf502..56f12e7ab6 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -46,6 +46,9 @@ def is_in_openstack_namespace(proj):
 
 # Check if this project has a plugin file
 def has_devstack_plugin(proj):
+    # Don't link in the deb packaging repos
+    if "openstack/deb-" in proj:
+        return False
     r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
     return r.status_code == 200
 

From 6390d5ef8236028c8dc00c5514e7ceac60ffd627 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 12 Sep 2016 11:23:19 -0400
Subject: [PATCH 1548/3333] libvirt: install python-guestfs when
 ENABLE_FILE_INJECTION=True

There is a bit of a weird history here, but the net is we're not
installing python-guestfs when ENABLE_FILE_INJECTION is set, which
it is in the gate-tempest-dsvm-neutron-full-ssh job, which makes
file injection (personality) tests fail.

The history:

Commit 0ae942b41c6dcd0fe7353e7d68574194fb72a66d moved installing
python-guestfs to the hypervisor-libvirt file and it was conditional
on a flag to enable file injection and the backing distro.

Commit a3c94468baa159840a47c34cf94d97d816208313 removed the ability
to configure nova for file injection, which never made any Tempest
tests fail because we didn't have a job that tested file injection
with ssh, which is what gate-tempest-dsvm-neutron-full-ssh does.

Commit 6d3670a65280d71529f8aad8ca5a0422abffebd0 added the ability
back to enable file injection and the gate-tempest-dsvm-neutron-full-ssh
job uses it, but missed added the condition back in from 0ae942b41
which installed the python-guestfs package. This change adds that
back in.

Change-Id: I1c1ef093b70007100646c086dc5724cd64751d00
Closes-Bug: #1622649
---
 lib/nova_plugins/hypervisor-libvirt | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 20dde8ecc5..b4eb3c12a2 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -100,6 +100,14 @@ function install_nova_hypervisor {
             yum_install libcgroup-tools
         fi
     fi
+
+    if [[ "$ENABLE_FILE_INJECTION" == "True" ]] ; then
+        if is_ubuntu; then
+            install_package python-guestfs
+        elif is_fedora || is_suse; then
+            install_package python-libguestfs
+        fi
+    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From 14cb490d1e9837c237ade5c0a63de56faae5e89d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 8 Sep 2016 13:07:59 -0400
Subject: [PATCH 1549/3333] nova: stop setting deprecated use_usb_tablet option

The use_usb_tablet option is replaced by the pointer_model
option.

Depends-On: Id18b5503799922e4096bde296a9e7bb4f2a994aa

Change-Id: Ic2a49f88df988c6404c1c72e9ee28a487e4f7908
---
 lib/nova_plugins/hypervisor-libvirt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b4eb3c12a2..167ab6f2e7 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -40,7 +40,8 @@ function configure_nova_hypervisor {
     configure_libvirt
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
     iniset $NOVA_CONF libvirt cpu_mode "none"
-    iniset $NOVA_CONF libvirt use_usb_tablet "False"
+    # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
+    iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
     iniset $NOVA_CONF DEFAULT default_ephemeral_format "ext4"
     iniset $NOVA_CONF DEFAULT compute_driver "libvirt.LibvirtDriver"

From 57d390c5d7a52befc21d4d50ee676fb904b76d6d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 14 Sep 2016 06:59:40 +0000
Subject: [PATCH 1550/3333] Updated from generate-devstack-plugins-list

Change-Id: I21fd2b3866efe66dd1f7173003c2521688aa7fd6
---
 doc/source/plugin-registry.rst | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index d6df1efa4f..a59a5464b9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,16 +1,16 @@
-..  Note to patch submitters:
+.. Note to patch submitters:
 
-    # ============================= #
-    # THIS FILE IS AUTOGENERATED !  #
-    # ============================= #
+   # ============================= #
+   # THIS FILE IS AUTOGENERATED !  #
+   # ============================= #
 
-    ** Plugins are found automatically and added to this list **
+   ** Plugins are found automatically and added to this list **
 
-    This file is created by a periodic proposal job.  You should not
-    edit this file.
+   This file is created by a periodic proposal job.  You should not
+   edit this file.
 
-    You should edit the files data/devstack-plugins-registry.footer
-    data/devstack-plugins-registry.header to modify this text.
+   You should edit the files data/devstack-plugins-registry.footer
+   data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
@@ -24,6 +24,7 @@ official OpenStack projects.
 ====================================== ===
 Plugin Name                            URL
 ====================================== ===
+almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
 app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
@@ -61,11 +62,12 @@ gce-api                                `git://git.openstack.org/openstack/gce-ap
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
-higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
+karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
+karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
@@ -110,6 +112,7 @@ neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutro
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
+nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
@@ -122,8 +125,6 @@ scalpels                               `git://git.openstack.org/openstack/scalpe
 searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
 searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
-smaug                                  `git://git.openstack.org/openstack/smaug <https://git.openstack.org/cgit/openstack/smaug>`__
-smaug-dashboard                        `git://git.openstack.org/openstack/smaug-dashboard <https://git.openstack.org/cgit/openstack/smaug-dashboard>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
@@ -137,6 +138,8 @@ watcher                                `git://git.openstack.org/openstack/watche
 watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
 zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
 zaqar-ui                               `git://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
+zun                                    `git://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
+zun-ui                                 `git://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
 ====================================== ===
 
 

From cb3a216c2315041f1665dda2b81555883ba2dc6b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 15 Sep 2016 06:52:36 +0000
Subject: [PATCH 1551/3333] Updated from generate-devstack-plugins-list

Change-Id: Ib75ecf5c822f3778978177c793399afbd802bf70
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a59a5464b9..e9b0480344 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -129,6 +129,7 @@ solum                                  `git://git.openstack.org/openstack/solum
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
+trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
 trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__

From 81d89cf3584a5edadbaa2514305cf5721b29cdff Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 16 Sep 2016 06:52:00 +0000
Subject: [PATCH 1552/3333] Updated from generate-devstack-plugins-list

Change-Id: I20039918452f6aa430037ae986f7cd88bd220d76
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e9b0480344..9d023bf5e2 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -103,6 +103,7 @@ networking-ovs-dpdk                    `git://git.openstack.org/openstack/networ
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
 networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__

From 734f144f5d47c9b76562d5b5c705428be0963aec Mon Sep 17 00:00:00 2001
From: Henry Gessau <HenryG@gessau.net>
Date: Sat, 17 Sep 2016 19:28:53 -0400
Subject: [PATCH 1553/3333] Neutron L3: account for all default routes

Some systems may have more than one default route.
Set up iptables NAT rules on all v4 default route devices.
Accept RAs on all v6 default route devices.

Closes-Bug: #1624773

Change-Id: If58509297497ea33c6c156f083a4394000bd0561
---
 lib/neutron_plugins/services/l3 | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2e96284357..09c08e3280 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -88,8 +88,10 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
-default_route_dev=$(ip route | grep ^default | awk '{print $5}')
-die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
+die_if_not_set $LINENO default_v4_route_devs "Failure retrieving default IPv4 route devices"
+
+default_v6_route_devs=$(ip -6 route | grep ^default | awk '{print $5}')
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
@@ -121,7 +123,9 @@ function _configure_neutron_l3_agent {
             _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
         fi
     else
-        sudo iptables -t nat -A POSTROUTING -o $default_route_dev -s $FLOATING_RANGE -j MASQUERADE
+        for d in $default_v4_route_devs; do
+            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
+        done
     fi
 }
 
@@ -371,11 +375,13 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-        # Ensure IPv6 RAs are accepted on the interface with the default route.
+        # Ensure IPv6 RAs are accepted on interfaces with a default route.
         # This is needed for neutron-based devstack clouds to work in
         # IPv6-only clouds in the gate. Please do not remove this without
         # talking to folks in Infra.
-        sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
+        for d in $default_v6_route_devs; do
+            sudo sysctl -w net.ipv6.conf.$d.accept_ra=2
+        done
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge

From d2ef615d8f2edc9d8b535c94fca1a5afde3d0694 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Tue, 20 Sep 2016 04:12:11 -0700
Subject: [PATCH 1554/3333] Neutron: enable setting debug as True or False

The flag ENABLE_DEBUG_LOG_LEVEL indicates if this should be
set or not.

This will now be supported in Neutron.

Change-Id: I3afe0546b379873247fee1ef9f4cc2708a7b5713
---
 lib/neutron | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 7442efd2c1..3efa685caf 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -126,7 +126,7 @@ function configure_neutron_new {
     iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
 
-    iniset $NEUTRON_CONF DEFAULT debug True
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     iniset_rpc_backend neutron $NEUTRON_CONF
 
@@ -172,7 +172,7 @@ function configure_neutron_new {
     # Neutron OVS or LB agent
     if is_service_enabled neutron-agent; then
         iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
-        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug True
+        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
@@ -188,7 +188,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-dhcp; then
         cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
 
-        iniset $NEUTRON_DHCP_CONF DEFAULT debug True
+        iniset $NEUTRON_DHCP_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         # make it so we have working DNS from guests
         iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
 
@@ -202,7 +202,7 @@ function configure_neutron_new {
         iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
         iniset $NEUTRON_CONF DEFAULT service_plugins router
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
-        iniset $NEUTRON_L3_CONF DEFAULT debug True
+        iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
     fi
 
@@ -210,7 +210,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-metadata-agent; then
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
-        iniset $NEUTRON_META_CONF DEFAULT debug True
+        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 

From 4b49e409f853104dae021dfca1a9342ec9ac4709 Mon Sep 17 00:00:00 2001
From: Gregory Haynes <greg@greghaynes.net>
Date: Wed, 31 Aug 2016 18:19:51 -0700
Subject: [PATCH 1555/3333] Use apache for tls-proxy ssl termination

Stud is now abandonware (see https://github.com/bumptech/stud) and is
not packaged in xenial. Lets use Apache for SSL termination since its
there already.

Change-Id: Ifcba410f5969521e8b3d30f02795541c1661f83a
---
 files/debs/tls-proxy |  2 +-
 functions-common     | 10 ++++++
 lib/apache           | 31 +++++++++++++++---
 lib/cinder           |  4 +--
 lib/glance           |  4 +--
 lib/keystone         |  4 +--
 lib/neutron          |  2 +-
 lib/neutron-legacy   |  2 +-
 lib/nova             |  2 +-
 lib/swift            |  2 +-
 lib/tls              | 78 +++++++++++++++++++++++++++++++-------------
 stack.sh             |  1 +
 12 files changed, 103 insertions(+), 39 deletions(-)

diff --git a/files/debs/tls-proxy b/files/debs/tls-proxy
index dce9c07d3f..5bd8e213a2 100644
--- a/files/debs/tls-proxy
+++ b/files/debs/tls-proxy
@@ -1 +1 @@
-stud
+apache2
diff --git a/functions-common b/functions-common
index 1a4a8f8eea..4716567be3 100644
--- a/functions-common
+++ b/functions-common
@@ -2304,6 +2304,16 @@ function stop_service {
     fi
 }
 
+# Service wrapper to stop services
+# reload_service service-name
+function reload_service {
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl reload $1
+    else
+        sudo service $1 reload
+    fi
+}
+
 # Test with a finite retry loop.
 #
 function test_with_retry {
diff --git a/lib/apache b/lib/apache
index 2c84c7a481..740f58835e 100644
--- a/lib/apache
+++ b/lib/apache
@@ -42,24 +42,40 @@ fi
 
 # Functions
 # ---------
+
+# Enable apache mod and restart apache if it isn't already enabled.
+function enable_apache_mod {
+    local mod=$1
+    # Apache installation, because we mark it NOPRIME
+    if is_ubuntu || is_suse ; then
+        if ! a2query -m $mod ; then
+            sudo a2enmod $mod
+            restart_apache_server
+        fi
+    elif is_fedora; then
+        # pass
+        true
+    else
+        exit_distro_not_supported "apache enable mod"
+    fi
+}
+
 # install_apache_wsgi() - Install Apache server and wsgi module
 function install_apache_wsgi {
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Install apache2, which is NOPRIME'd
         install_package apache2 libapache2-mod-wsgi
-        # WSGI isn't enabled by default, enable it
-        sudo a2enmod wsgi
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
     elif is_suse; then
         install_package apache2 apache2-mod_wsgi
-        # WSGI isn't enabled by default, enable it
-        sudo a2enmod wsgi
     else
-        exit_distro_not_supported "apache installation"
+        exit_distro_not_supported "apache wsgi installation"
     fi
+    # WSGI isn't enabled by default, enable it
+    enable_apache_mod wsgi
 
     # ensure mod_version enabled for <IfVersion ...>.  This is
     # built-in statically on anything recent, but precise (2.2)
@@ -192,6 +208,11 @@ function restart_apache_server {
     time_stop "restart_apache_server"
 }
 
+# reload_apache_server
+function reload_apache_server {
+    reload_service $APACHE_NAME
+}
+
 # Restore xtrace
 $_XTRACE_LIB_APACHE
 
diff --git a/lib/cinder b/lib/cinder
index a87f395c8e..0fe950b6c2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -305,8 +305,8 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-
         iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+        iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
     fi
 
     if [ "$SYSLOG" != "False" ]; then
@@ -534,7 +534,7 @@ function start_cinder {
 
     # Start proxies if enabled
     if is_service_enabled c-api && is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT &
+        start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index 8d95aad73f..a31e564104 100644
--- a/lib/glance
+++ b/lib/glance
@@ -383,8 +383,8 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT &
-        start_tls_proxy '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT &
+        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..f52cc3fb4b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -609,8 +609,8 @@ function start_keystone {
 
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT &
-        start_tls_proxy '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT &
+        start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
+        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
     fi
 
     # (re)start memcached to make sure we have a clean memcache.
diff --git a/lib/neutron b/lib/neutron
index c1552e3d06..e37701879d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -409,7 +409,7 @@ function start_neutron_api {
 
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT &
+        start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
     fi
 }
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b1b5230fdd..18100994f3 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -460,7 +460,7 @@ function start_neutron_service_and_check {
 
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $Q_PORT $Q_HOST $Q_PORT_INT &
+        start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 235b533d77..8970a7c693 100644
--- a/lib/nova
+++ b/lib/nova
@@ -800,7 +800,7 @@ function start_nova_api {
 
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT &
+        start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
     fi
 
     export PATH=$old_path
diff --git a/lib/swift b/lib/swift
index 0c74411a9c..f9ea028cea 100644
--- a/lib/swift
+++ b/lib/swift
@@ -806,7 +806,7 @@ function start_swift {
     done
     if is_service_enabled tls-proxy; then
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
-        start_tls_proxy '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT &
+        start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
     run_process s-proxy "$SWIFT_DIR/bin/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
diff --git a/lib/tls b/lib/tls
index ca57ed44e0..2c4e18d388 100644
--- a/lib/tls
+++ b/lib/tls
@@ -16,7 +16,6 @@
 #
 # - configure_CA
 # - init_CA
-# - cleanup_CA
 
 # - configure_proxy
 # - start_tls_proxy
@@ -221,19 +220,6 @@ function init_CA {
     fi
 }
 
-# Clean up the CA files
-# cleanup_CA
-function cleanup_CA {
-    if is_fedora; then
-        sudo rm -f /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
-        sudo update-ca-trust
-    elif is_ubuntu; then
-        sudo rm -f /usr/local/share/ca-certificates/devstack-int.crt
-        sudo rm -f /usr/local/share/ca-certificates/devstack-root.crt
-        sudo update-ca-certificates
-    fi
-}
-
 # Create an initial server cert
 # init_cert
 function init_cert {
@@ -455,26 +441,72 @@ function enable_mod_ssl {
 # Starts the TLS proxy for the given IP/ports
 # start_tls_proxy front-host front-port back-host back-port
 function start_tls_proxy {
-    local f_host=$1
-    local f_port=$2
-    local b_host=$3
-    local b_port=$4
-
-    stud $STUD_PROTO -f $f_host,$f_port -b $b_host,$b_port $DEVSTACK_CERT 2>/dev/null
+    local b_service="$1-tls-proxy"
+    local f_host=$2
+    local f_port=$3
+    local b_host=$4
+    local b_port=$5
+
+    local config_file
+    config_file=$(apache_site_config_for $b_service)
+    local listen_string
+    # Default apache configs on ubuntu and centos listen on 80 and 443
+    # newer apache seems fine with duplicate listen directive but older
+    # apache does not so special case 80 and 443.
+    if [[ "$f_port" == "80" ]] || [[ "$f_port" == "443" ]]; then
+        listen_string=""
+    elif [[ "$f_host" == '*' ]] ; then
+        listen_string="Listen $f_port"
+    else
+        listen_string="Listen $f_host:$f_port"
+    fi
+    sudo bash -c "cat >$config_file" << EOF
+$listen_string
+
+<VirtualHost $f_host:$f_port>
+    SSLEngine On
+    SSLCertificateFile $DEVSTACK_CERT
+
+    <Location />
+        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
+        ProxyPassReverse http://$b_host:$b_port/
+    </Location>
+</VirtualHost>
+EOF
+    for mod in ssl proxy proxy_http; do
+        enable_apache_mod $mod
+    done
+    enable_apache_site $b_service
+    # Only a reload is required to pull in new vhosts
+    # Note that a restart reliably fails on centos7 and trusty
+    # because apache can't open port 80 because the old apache
+    # still has it open. Using reload fixes trusty but centos7
+    # still doesn't work.
+    reload_apache_server
 }
 
 
 # Cleanup Functions
 # =================
 
-# Stops all stud processes. This should be done only after all services
+# Stops the apache service. This should be done only after all services
 # using tls configuration are down.
 function stop_tls_proxy {
-    killall stud
+    stop_apache_server
 }
 
-# Remove CA along with configuration, as well as the local server certificate
+# Clean up the CA files
+# cleanup_CA
 function cleanup_CA {
+    if is_fedora; then
+        sudo rm -f /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
+        sudo update-ca-trust
+    elif is_ubuntu; then
+        sudo rm -f /usr/local/share/ca-certificates/devstack-int.crt
+        sudo rm -f /usr/local/share/ca-certificates/devstack-root.crt
+        sudo update-ca-certificates
+    fi
+
     rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
 }
 
diff --git a/stack.sh b/stack.sh
index 09466a6894..119ca8561b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1052,6 +1052,7 @@ EOF
 
     if is_service_enabled tls-proxy; then
         echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
+        start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
     fi
 
     source $TOP_DIR/userrc_early

From 4c813ac0fb64c7b4eeec7f67692ccfd7affd2153 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Wed, 21 Sep 2016 19:39:36 +0200
Subject: [PATCH 1556/3333] Fix the logic of if used with is_service_enabled

The value to be evaluated is the returned value, not the output of the
command.

Change-Id: I22d7c967e911bcfee6b1910f666dbbc647c00085
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index b491bf82ef..048f3464b3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -317,7 +317,7 @@ function configure_tempest {
     # set the equiv validation option here as well to ensure they are
     # in sync. They shouldn't be separate options.
     iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
-    if [[ ! $(is_service_enabled n-cell) && ! $(is_service_enabled neutron) ]]; then
+    if ! is_service_enabled n-cell && ! is_service_enabled neutron; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi
 

From a5d965a3d7c558239d770428e1dd815943a8d887 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Wed, 3 Aug 2016 14:44:53 -0700
Subject: [PATCH 1557/3333] Use userrc_early for all nodes

Instead of only using the userrc_early when keystone
is an enabled service we will do it on all runs of
stack.sh. This way services can be split up more
across devstack nodes, and you can do configuration
requiring credentials on nodes that don't install
keystone.

Change-Id: I74574ae9f45a74bcbcc8e3149228ecb795ab4fb7
---
 stack.sh | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6a5a2a318f..8f548997d4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1021,21 +1021,12 @@ start_dstat
 # Keystone
 # --------
 
-if is_service_enabled keystone; then
-    echo_summary "Starting Keystone"
-
-    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
-        init_keystone
-        start_keystone
-        bootstrap_keystone
-    fi
-
-    # Rather than just export these, we write them out to a
-    # intermediate userrc file that can also be used to debug if
-    # something goes wrong between here and running
-    # tools/create_userrc.sh (this script relies on services other
-    # than keystone being available, so we can't call it right now)
-    cat > $TOP_DIR/userrc_early <<EOF
+# Rather than just export these, we write them out to a
+# intermediate userrc file that can also be used to debug if
+# something goes wrong between here and running
+# tools/create_userrc.sh (this script relies on services other
+# than keystone being available, so we can't call it right now)
+cat > $TOP_DIR/userrc_early <<EOF
 # Use this for debugging issues before files in accrc are created
 
 # Set up password auth credentials now that Keystone is bootstrapped
@@ -1050,12 +1041,21 @@ export OS_REGION_NAME=$KEYSTONE_REGION_NAME
 
 EOF
 
-    if is_service_enabled tls-proxy; then
-        echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
-        start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
-    fi
+if is_service_enabled tls-proxy; then
+    echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
+    start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
+fi
+
+source $TOP_DIR/userrc_early
+
+if is_service_enabled keystone; then
+    echo_summary "Starting Keystone"
 
-    source $TOP_DIR/userrc_early
+    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
+        init_keystone
+        start_keystone
+        bootstrap_keystone
+    fi
 
     create_keystone_accounts
     create_nova_accounts

From a80d4097a973acaff9c7718334487a1182ba7dc6 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Thu, 11 Aug 2016 10:41:34 +0000
Subject: [PATCH 1558/3333] Modify the default Qemu packages name for AArch64.

In Debian jessie and later release,there is no packages
called "qemu-kvm" for AArch64. Also modify the libguestfs0
packages for AArch64

Closes-bug: #1612182

Change-Id: I5eb6bd137896eb9abfc4f8dbb41b41105e4820cd
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova_plugins/functions-libvirt | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4e5a748e45..790227beb5 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -23,12 +23,7 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
     if is_ubuntu; then
-        if is_arch "aarch64" && [[ ${DISTRO} == "trusty" ]]; then
-            install_package qemu-system
-        else
-            install_package qemu-kvm
-            install_package libguestfs0
-        fi
+        install_package qemu-system
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
         if [[ "$EBTABLES_RACE_FIX" == "True" ]]; then

From a4705403aa6a4ba0f5ea8c67bff89a67d0be2070 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 23 Sep 2016 15:08:48 +1000
Subject: [PATCH 1559/3333] yum_install: fix awk return code

TIL:

  Similarly, all the END rules are merged, and executed when all the
  input is exhausted (or when an exit statement is executed).

i.e. matching YUM_FAILED calls "exit", which falls through to the END
rules which calls "exit result" ... which is zero.  i.e. if the return
code is 1 then we actually hide that and return with zero.

This is rather annoying because errors that should halt to alert us of
a package install failure pass through, only for you to have to debug
much later on seemingly unrelated problems.

This always sets "result" and thus should be returning the right
thing.  I've updated the documentation to hopefully make it clearer
what's going on.

Change-Id: Ia15b7dc55efb8d3e3e945241b67a468b8a914672
---
 functions-common | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 1a4a8f8eea..120aa970d9 100644
--- a/functions-common
+++ b/functions-common
@@ -1346,20 +1346,26 @@ function yum_install {
 
     time_start "yum_install"
 
-    # - We run with LC_ALL=C so string matching *should* be OK
-    # - Exit 1 if the failure might get better with a retry.
-    # - Exit 2 if it is fatal.
-    parse_yum_result='             \
-        BEGIN { result=0 }         \
-        /^YUM_FAILED/ { exit $2 }  \
-        /^No package/ { result=2 } \
-        /^Failed:/    { result=2 } \
-        //{ print }                \
+    # This is a bit tricky, because yum -y assumes missing or failed
+    # packages are OK (see [1]).  We want devstack to stop if we are
+    # installing missing packages.
+    #
+    # Thus we manually match on the output (stack.sh runs in a fixed
+    # locale, so lang shouldn't change).
+    #
+    # If yum returns !0, we echo the result as "YUM_FAILED" and return
+    # that from the awk (we're subverting -e with this trick).
+    # Otherwise we use awk to look for failure strings and return "2"
+    # to indicate a terminal failure.
+    #
+    # [1] https://bugzilla.redhat.com/show_bug.cgi?id=965567
+    parse_yum_result='              \
+        BEGIN { result=0 }          \
+        /^YUM_FAILED/ { result=$2 } \
+        /^No package/ { result=2 }  \
+        /^Failed:/    { result=2 }  \
+        //{ print }                 \
         END { exit result }'
-
-    # The manual check for missing packages is because yum -y assumes
-    # missing or failed packages are OK.
-    # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
     (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
         | awk "$parse_yum_result" && result=$? || result=$?
 

From 499a9e39c1bfeb39928b04a9f1cc84a91521dcad Mon Sep 17 00:00:00 2001
From: John Hua <john.hua@citrix.com>
Date: Mon, 26 Sep 2016 11:43:49 +0800
Subject: [PATCH 1560/3333] XenAPI: Remove legacy tty image

UPLOAD_LEGACY_TTY was for console access, but it's no longer used.

Change-Id: I294c8716be2e6ee9f53108d4eb41faf99e975538
---
 stack.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6a5a2a318f..9aa770f2b9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1221,11 +1221,6 @@ if is_service_enabled g-reg; then
 
     echo_summary "Uploading images"
 
-    # Option to upload legacy ami-tty, which works with xenserver
-    if [[ -n "$UPLOAD_LEGACY_TTY" ]]; then
-        IMAGE_URLS="${IMAGE_URLS:+${IMAGE_URLS},}https://github.com/downloads/citrix-openstack/warehouse/tty.tgz"
-    fi
-
     for image_url in ${IMAGE_URLS//,/ }; do
         upload_image $image_url
     done

From 323b726783d6d4ef24a0c9f0d7c77b9e8b152c61 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 23 Sep 2016 13:33:40 -0700
Subject: [PATCH 1561/3333] Don't make root CA if it exists

To support multinode testing where we just copy the CA to all the
instances don't remake the CA if it already exists.

The end result is that you can trusty a single chain and all your
clients will be happy regardless of which host they are talking to.

Change-Id: I90892e6828a59fa37af717361a2f1eed15a87ae4
---
 lib/tls | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/tls b/lib/tls
index 2c4e18d388..2443d7d31d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -322,15 +322,17 @@ function make_root_CA {
     create_CA_base $ca_dir
     create_CA_config $ca_dir 'Root CA'
 
-    # Create a self-signed certificate valid for 5 years
-    $OPENSSL req -config $ca_dir/ca.conf \
-        -x509 \
-        -nodes \
-        -newkey rsa \
-        -days 21360 \
-        -keyout $ca_dir/private/cacert.key \
-        -out $ca_dir/cacert.pem \
-        -outform PEM
+    if [ ! -r "$ca_dir/cacert.pem" ]; then
+        # Create a self-signed certificate valid for 5 years
+        $OPENSSL req -config $ca_dir/ca.conf \
+            -x509 \
+            -nodes \
+            -newkey rsa \
+            -days 21360 \
+            -keyout $ca_dir/private/cacert.key \
+            -out $ca_dir/cacert.pem \
+            -outform PEM
+    fi
 }
 
 # If a non-system python-requests is installed then it will use the
@@ -507,7 +509,7 @@ function cleanup_CA {
         sudo update-ca-certificates
     fi
 
-    rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
+    rm -rf "$INT_CA_DIR" "$ROOT_CA_DIR" "$DEVSTACK_CERT"
 }
 
 # Tell emacs to use shell-script-mode

From 890342ed878f4a8f556ae733b6bd6c872308a937 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Tue, 13 Sep 2016 22:41:41 +0200
Subject: [PATCH 1562/3333] Work around issue in glance_store swift driver

With [1] glance_store introduced default settings for user_domain_id and
project_domain_id. Sadly since these are always passed to the keystone
client, they override any settings to user_domain_name and
project_domain_name that are made in the config, leading to authentication
failures.

So as a workaround until [2] is fixed, we explicitly place the corresponding
domain_ids into the config.

[1] https://review.openstack.org/297665
[2] https://bugs.launchpad.net/tempest/+bug/1620999

Change-Id: Ica81a1a176614392291f2db4cc6398ed30663aed
---
 lib/glance | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 8d95aad73f..5274714a6c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -187,8 +187,6 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_name $SERVICE_DOMAIN_NAME
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_name $SERVICE_DOMAIN_NAME
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
@@ -312,6 +310,11 @@ function create_glance_accounts {
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+
+        # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
+        service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id $service_domain_id
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id $service_domain_id
     fi
 
     # Add glance-glare service and endpoints

From 04e69de6c513e1cddaaa74eb2ff428a5db4d223b Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Wed, 27 Jul 2016 08:05:05 +1000
Subject: [PATCH 1563/3333] Mount identity admin script at /identity_admin

The /identity_admin endpoint is the port 80/443 equivalent of the
service that typically runs on port 35357. In v2 some operations must be
performed on the admin endpoint whereas on v3 the services on 5000 and
35357 are exactly the same. This would be why the service was mounted at
/identity_v2_admin however that is misleading because both the v2 and v3
services are present on that endpoint.

This is particularly confusing because we set this as the OS_AUTH_URL
endpoint and it makes it seem like we are doing v2 authentication when
we are not.

Change-Id: If73735026079fb19ca5bd44b3a4dc1f507b5c99d
---
 files/apache-keystone.template | 4 ++--
 lib/keystone                   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 8a4b0f0c43..428544f25c 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -44,8 +44,8 @@ Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIPassAuthorization On
 </Location>
 
-Alias /identity_v2_admin %KEYSTONE_BIN%/keystone-wsgi-admin
-<Location /identity_v2_admin>
+Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
+<Location /identity_admin>
     SetHandler wsgi-script
     Options +ExecCGI
 
diff --git a/lib/keystone b/lib/keystone
index 851db042ba..23f09a5499 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -124,7 +124,7 @@ fi
 # complete URIs
 if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
     # If running in Apache, use path access rather than port.
-    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_v2_admin
+    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
     KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
 else
     KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}

From 69e3c0aac99981f17c76c22111e5c397824b8428 Mon Sep 17 00:00:00 2001
From: Ian Cordasco <graffatcolmingov@gmail.com>
Date: Mon, 26 Sep 2016 12:53:14 -0500
Subject: [PATCH 1564/3333] Update certificate creation for urllib3

urllib3 1.18 was released today and contains new more correct hostname
matching that takes into account the ipAddress portion of a certificate
and disallows matching an IP Address against a DNS hostname.

Change-Id: I37d247b68911dc85f55adec6a7952ed321c1b1d8
---
 functions-common | 12 ++++++++++++
 lib/tls          |  5 ++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 4716567be3..9544c8102f 100644
--- a/functions-common
+++ b/functions-common
@@ -2207,6 +2207,18 @@ function cidr2netmask {
     echo ${1-0}.${2-0}.${3-0}.${4-0}
 }
 
+# Check if this is a valid ipv4 address string
+function is_ipv4_address {
+    local address=$1
+    local regex='([0-9]{1,3}.){3}[0-9]{1,3}'
+    # TODO(clarkb) make this more robust
+    if [[ "$address" =~ $regex ]] ; then
+        return 0
+    else
+        return 1
+    fi
+}
+
 # Gracefully cp only if source file/dir exists
 # cp_it source destination
 function cp_it {
diff --git a/lib/tls b/lib/tls
index 2c4e18d388..78d476fbf2 100644
--- a/lib/tls
+++ b/lib/tls
@@ -226,7 +226,7 @@ function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
             # Lie to let incomplete match routines work
-            TLS_IP="DNS:$TLS_IP"
+            TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 
@@ -249,6 +249,9 @@ function make_cert {
         else
             alt_names="$alt_names,DNS:$SERVICE_HOST"
         fi
+        if is_ipv4_address "$SERVICE_HOST" ; then
+            alt_names="$alt_names,IP:$SERVICE_HOST"
+        fi
     fi
 
     # Only generate the certificate if it doesn't exist yet on the disk

From 4a55d2a66092e351726251bb21a1d82b3501bdcd Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 24 Aug 2016 15:30:09 +0900
Subject: [PATCH 1565/3333] lib/neutron: Rename core plugin variables

NEUTRON_PLUGIN -> NEUTRON_CORE_PLUGIN
NEUTRON_PLUGIN_* -> NEUTRON_CORE_PLUGIN_*

Change-Id: I1d93d8bd1e6e3bbca0e56a2da0684ab3f3fbb525
---
 lib/neutron | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index ab84f7eefe..5370392796 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -47,10 +47,10 @@ NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # By default, use the ML2 plugin
-NEUTRON_PLUGIN=${NEUTRON_PLUGIN:-ml2}
-NEUTRON_PLUGIN_CONF_FILENAME=${NEUTRON_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
-NEUTRON_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_PLUGIN
-NEUTRON_PLUGIN_CONF=$NEUTRON_PLUGIN_CONF_PATH/$NEUTRON_PLUGIN_CONF_FILENAME
+NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
+NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
+NEUTRON_CORE_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_CORE_PLUGIN
+NEUTRON_CORE_PLUGIN_CONF=$NEUTRON_CORE_PLUGIN_CONF_PATH/$NEUTRON_CORE_PLUGIN_CONF_FILENAME
 
 NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
 NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
@@ -117,9 +117,9 @@ function configure_neutron_new {
 
     configure_neutron_rootwrap
 
-    mkdir -p $NEUTRON_PLUGIN_CONF_PATH
+    mkdir -p $NEUTRON_CORE_PLUGIN_CONF_PATH
 
-    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_PLUGIN/$NEUTRON_PLUGIN_CONF_FILENAME.sample $NEUTRON_PLUGIN_CONF
+    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
 
     iniset $NEUTRON_CONF database connection `database_connection_url neutron`
     iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH
@@ -139,7 +139,7 @@ function configure_neutron_new {
 
         cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
 
-        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_PLUGIN
+        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_CORE_PLUGIN
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
@@ -162,25 +162,25 @@ function configure_neutron_new {
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
-        iniset $NEUTRON_PLUGIN_CONF ml2 tenant_network_types vxlan
-        iniset $NEUTRON_PLUGIN_CONF ml2 type_drivers vxlan
-        iniset $NEUTRON_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
-        iniset $NEUTRON_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_PLUGIN_CONF ml2 extension_drivers port_security
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 type_drivers vxlan
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
     fi
 
     # Neutron OVS or LB agent
     if is_service_enabled neutron-agent; then
-        iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
-        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_CORE_PLUGIN_CONF agent tunnel_types vxlan
+        iniset $NEUTRON_CORE_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables
-            iniset $NEUTRON_PLUGIN_CONF vxlan local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables
+            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
         else
-            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables_hybrid
-            iniset $NEUTRON_PLUGIN_CONF ovs local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
+            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
     fi
 
@@ -397,7 +397,7 @@ function start_neutron_api {
 
     # Start the Neutron service
     # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_PLUGIN_CONF"
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
 
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
@@ -475,9 +475,9 @@ function _set_config_files {
 
     NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
 
-    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_PLUGIN_CONF (ml2_conf.ini) but others may not
+    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_CORE_PLUGIN_CONF (ml2_conf.ini) but others may not
     if is_service_enabled neutron-agent; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_PLUGIN_CONF"
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
     fi
 
     if is_service_enabled neutron-dhcp; then

From 1aa436813566081c24f0223b2ac48c2389c244ce Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 19:37:04 +0900
Subject: [PATCH 1566/3333] Move Q_ROUTER_NAME to where it belongs

The motivation is to make it more friendly with lib/neutron.
ie. independent from lib/neutron-legacy

Change-Id: I19821b009cbf1bc715a6c7b2854e4c77d2041ec4
---
 lib/neutron-legacy              | 2 --
 lib/neutron_plugins/services/l3 | 3 +++
 lib/tempest                     | 1 -
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 123ba4238f..9e926a000f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -125,8 +125,6 @@ Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
 # Allow Overlapping IP among subnets
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-# The name of the default q-l3 router
-Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..54dae2b4c7 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -22,6 +22,9 @@ PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 # used.
 Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
 
+# The name of the default router
+Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
+
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
diff --git a/lib/tempest b/lib/tempest
index b491bf82ef..0845ad0afa 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -15,7 +15,6 @@
 #   - ``SERVICE_HOST``
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
 #   - ``PUBLIC_NETWORK_NAME``
-#   - ``Q_ROUTER_NAME``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
 #   - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone

From b34d459bbc100e65fbc308438b3b7f72bd5fb5b6 Mon Sep 17 00:00:00 2001
From: Drago Rosson <drago@rosson.me>
Date: Mon, 26 Sep 2016 13:23:23 -0500
Subject: [PATCH 1567/3333] Allow default IPv6 route device names to have dots

When dots are used with sysctl, they are reinterpreted as slashes.
Route devices can have dots in their names, so when they are used in a
sysctl command that also uses dots, its dot will be replaced with a
slash, causing an error.

Change-Id: Ie32126a3aa8d646568d7d37ec4874419b9658935
Closes-Bug: #1627770
---
 lib/neutron_plugins/services/l3 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..8c26b2b199 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -401,7 +401,10 @@ function _neutron_configure_router_v6 {
         # IPv6-only clouds in the gate. Please do not remove this without
         # talking to folks in Infra.
         for d in $default_v6_route_devs; do
-            sudo sysctl -w net.ipv6.conf.$d.accept_ra=2
+            # Slashes must be used in this sysctl command because route devices
+            # can have dots in their names. If dots were used, dots in the
+            # device name would be reinterpreted as a slash, causing an error.
+            sudo sysctl -w net/ipv6/conf/$d/accept_ra=2
         done
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1

From aa7ec81fd794d4ab02b96f726ae08f53abc90073 Mon Sep 17 00:00:00 2001
From: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
Date: Wed, 28 Sep 2016 20:21:57 +0900
Subject: [PATCH 1568/3333] Fix typo in documentation

This patch just removes a duplicate 'the'.

Change-Id: I3393a51d55ba8ec1639c2548781f8972f0d5c9d0
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index b26fd1e8ee..05f60bae5f 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -595,7 +595,7 @@ to be configured for VLAN tenant networks.
 
 For OVS, a similar configuration like described in the
 :ref:`OVS Provider Network <ovs-provider-network-controller>` section can be
-used. Just add the the following line to this local.conf, which also loads
+used. Just add the following line to this local.conf, which also loads
 the MacVTap mechanism driver:
 
 ::

From 0009869caebe3b671c84f19cbde694547e3dd11b Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew@lascii.com>
Date: Wed, 28 Sep 2016 15:05:31 -0400
Subject: [PATCH 1569/3333] Don't install Nova policy.json

Nova ships with an empty policy.json file which it does not need.
oslo.policy previously required the empty file to be there but as of
version 1.14.0 it is possible to run with no policy file at all. Since
there are no policies defined in the sample file let's no install it.

Change-Id: I85a251376dfe38caa4b100861bf764014a98bc37
Depends-On: I09fa842ffbe75bed269cef6edc9c82d18bfe9297
---
 lib/nova | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 334cba6dd7..3e9857a778 100644
--- a/lib/nova
+++ b/lib/nova
@@ -302,8 +302,6 @@ function configure_nova {
     # Put config files in ``/etc/nova`` for everyone to find
     sudo install -d -o $STACK_USER $NOVA_CONF_DIR
 
-    install_default_policy nova
-
     configure_rootwrap nova
 
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then

From b3a210f643989603d192b32a40b2001664f8ed73 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 29 Sep 2016 13:26:30 +0000
Subject: [PATCH 1570/3333] Enable bridge firewalling if iptables are used

With the plan [1] to stop enabling it by Neutron iptables firewall
driver itself, deployment tools should catch up and enable the firewall
themselves.

This is needed for distributions that decided to disable the kernel
firewall by default (upstream kernel has it enabled). This is also
needed for distributions that ship newer kernels but don't load the
br_netfilter module before starting nova-network or Neutron iptables
firewall driver. In the latter case, firewall may not work, depending on
the order of operations executed by the driver.

To isolate devstack setups from the difference in distribution
kernel configuration and version, the following steps are done:

- we load bridge kernel module, and br_netfilter if present, to get
  access to sysctl knobs controlling the firewall;
- once knobs are available, we unconditionally set them to 1, to make
  sure the firewall is in effect.

More details at:
http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf

[1] I9137ea017624ac92a05f73863b77f9ee4681bbe7

Change-Id: Id6bfd9595f0772a63d1096ef83ebbb6cd630fafd
Related-Bug: #1622914
---
 functions                             | 18 ++++++++++++++++++
 lib/neutron                           |  2 ++
 lib/neutron_plugins/linuxbridge_agent |  1 +
 lib/neutron_plugins/ovs_base          |  1 +
 lib/nova                              |  6 +++++-
 5 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 58565788ff..6a0ac67b69 100644
--- a/functions
+++ b/functions
@@ -646,6 +646,24 @@ function set_mtu {
 }
 
 
+# enable_kernel_bridge_firewall - Enable kernel support for bridge firewalling
+function enable_kernel_bridge_firewall {
+    # Load bridge module. This module provides access to firewall for bridged
+    # frames; and also on older kernels (pre-3.18) it provides sysctl knobs to
+    # enable/disable bridge firewalling
+    sudo modprobe bridge
+    # For newer kernels (3.18+), those sysctl settings are split into a separate
+    # kernel module (br_netfilter). Load it too, if present.
+    sudo modprobe br_netfilter 2>> /dev/null || :
+    # Enable bridge firewalling in case it's disabled in kernel (upstream
+    # default is enabled, but some distributions may decide to change it).
+    # This is at least needed for RHEL 7.2 and earlier releases.
+    for proto in arp ip ip6; do
+        sudo sysctl -w net.bridge.bridge-nf-call-${proto}tables=1
+    done
+}
+
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/lib/neutron b/lib/neutron
index 5370392796..9e9eb2d2b1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -182,6 +182,8 @@ function configure_neutron_new {
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
+
+        enable_kernel_bridge_firewall
     fi
 
     # DHCP Agent
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 7d59e1347c..d0de2f5e5d 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -69,6 +69,7 @@ function neutron_plugin_configure_plugin_agent {
     fi
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
+        enable_kernel_bridge_firewall
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index f6d10ea4f9..3cd6c85053 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -84,6 +84,7 @@ function _neutron_ovs_base_configure_debug_command {
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
+        enable_kernel_bridge_firewall
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
diff --git a/lib/nova b/lib/nova
index 334cba6dd7..d321b73205 100644
--- a/lib/nova
+++ b/lib/nova
@@ -866,9 +866,13 @@ function start_nova_rest {
     run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
-
     run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
+
+    if is_service_enabled n-net; then
+        enable_kernel_bridge_firewall
+    fi
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
+
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
     run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
 

From c12c12f6630f591d20dd5098be1fe105f2cc790b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 30 Sep 2016 06:57:24 +0000
Subject: [PATCH 1571/3333] Updated from generate-devstack-plugins-list

Change-Id: Id9ce2cbdad53665ca2f6b7e57cb2553cb89cd982
---
 doc/source/plugin-registry.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9d023bf5e2..f29b0d7ae2 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -59,6 +59,7 @@ freezer                                `git://git.openstack.org/openstack/freeze
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
+glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
@@ -69,6 +70,7 @@ ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
@@ -111,6 +113,7 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+nimble                                 `git://git.openstack.org/openstack/nimble <https://git.openstack.org/cgit/openstack/nimble>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__

From c58a15575d3d202c1ecb19ebba82a908dfb66028 Mon Sep 17 00:00:00 2001
From: rajinir <rajini_ram@dell.com>
Date: Tue, 27 Sep 2016 17:14:59 -0500
Subject: [PATCH 1572/3333] Neutron L3 subnetpool creation should be optional

Added an option to make subnetpools to be optional
as it ignores the public network specified in
FIXED_RANGE.

DocImpact
Change-Id: Ic89ceca76afda67da5545111972c3348011f294f
Closes-Bug: #1628267
---
 doc/source/guides/neutron.rst   |  2 ++
 lib/neutron_plugins/services/l3 | 13 ++++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index b26fd1e8ee..78150f3742 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -392,6 +392,7 @@ controller node.
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010
+        USE_SUBNETPOOL=False
 
 In this configuration we are defining FIXED_RANGE to be a
 publicly routed IPv4 subnet. In this specific instance we are using
@@ -577,6 +578,7 @@ you do not require them.
     PROVIDER_SUBNET_NAME="provider_net"
     PROVIDER_NETWORK_TYPE="vlan"
     SEGMENTATION_ID=2010
+    USE_SUBNETPOOL=False
 
     [[post-config|/$Q_PLUGIN_CONF_FILE]]
     [macvtap]
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..33db4cb538 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -80,6 +80,7 @@ PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
 # Subnetpool defaults
+USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
 SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
@@ -168,11 +169,13 @@ function create_neutron_initial_network {
     fi
 
     if is_networking_extension_supported "auto-allocated-topology"; then
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
-        fi
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+        if [[ "$USE_SUBNETPOOL" == "True" ]]; then
+            if [[ "$IP_VERSION" =~ 4.* ]]; then
+                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+            if [[ "$IP_VERSION" =~ .*6 ]]; then
+                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
         fi
     fi
 

From c271b3ea1fe16561b7a46507fdf961668182b256 Mon Sep 17 00:00:00 2001
From: Mike Perez <thingee@gmail.com>
Date: Mon, 3 Oct 2016 16:00:33 -0700
Subject: [PATCH 1573/3333] Update OpenStackClient role list commands

This command is deprecated. The new command is role assignment list.

Change-Id: I8dba0be21d5af6751bea13d8ff29cd4b7589ab3e
---
 doc/source/guides/multinode-lab.rst |  2 +-
 exercises/neutron-adv-test.sh       |  2 +-
 functions-common                    | 32 +++++++++--------------------
 3 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c996f95743..8751eb8d6a 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -260,7 +260,7 @@ for scripting:
     openstack user create $NAME --password=$PASSWORD --project $PROJECT
     openstack role add Member --user $NAME --project $PROJECT
     # The Member role is created by stack.sh
-    # openstack role list
+    # openstack role assignment list
 
 Swift
 -----
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index dc6bbbb5c7..e003c56331 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -148,7 +148,7 @@ function get_user_id {
 function get_role_id {
     local ROLE_NAME=$1
     local ROLE_ID
-    ROLE_ID=`openstack role list | grep $ROLE_NAME | awk '{print $2}'`
+    ROLE_ID=`openstack role assignment list | grep $ROLE_NAME | awk '{print $2}'`
     die_if_not_set $LINENO ROLE_ID "Failure retrieving ROLE_ID for $ROLE_NAME"
     echo "$ROLE_ID"
 }
diff --git a/functions-common b/functions-common
index 9544c8102f..87e6bb453d 100644
--- a/functions-common
+++ b/functions-common
@@ -865,11 +865,9 @@ function get_or_add_user_project_role {
     domain_args=$(_get_domain_args $4 $5)
 
     # Gets user role id
-    user_role_id=$(openstack role list \
+    user_role_id=$(openstack role assignment list \
         --user $2 \
-        --column "ID" \
         --project $3 \
-        --column "Name" \
         $domain_args \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
@@ -878,11 +876,9 @@ function get_or_add_user_project_role {
             --user $2 \
             --project $3 \
             $domain_args
-        user_role_id=$(openstack role list \
+        user_role_id=$(openstack role assignment list \
             --user $2 \
-            --column "ID" \
             --project $3 \
-            --column "Name" \
             $domain_args \
             | grep " $1 " | get_field 1)
     fi
@@ -894,22 +890,18 @@ function get_or_add_user_project_role {
 function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
-    user_role_id=$(openstack role list \
+    user_role_id=$(openstack role assignment list \
         --user $2 \
-        --column "ID" \
         --domain $3 \
-        --column "Name" \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
             --domain $3
-        user_role_id=$(openstack role list \
+        user_role_id=$(openstack role assignment list \
             --user $2 \
-            --column "ID" \
             --domain $3 \
-            --column "Name" \
             | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
@@ -920,13 +912,11 @@ function get_or_add_user_domain_role {
 function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
-    user_role_id=$(openstack role list \
+    user_role_id=$(openstack role assignment list \
         --user $2 \
         --os-url=$KEYSTONE_SERVICE_URI_V3 \
         --os-identity-api-version=3 \
-        --column "ID" \
         --domain $3 \
-        --column "Name" \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
@@ -935,13 +925,11 @@ function get_or_add_user_domain_role {
             --domain $3 \
             --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3
-        user_role_id=$(openstack role list \
+        user_role_id=$(openstack role assignment list \
             --user $2 \
             --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3 \
-            --column "ID" \
             --domain $3 \
-            --column "Name" \
             | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
@@ -952,19 +940,19 @@ function get_or_add_user_domain_role {
 function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
-    group_role_id=$(openstack role list \
+    group_role_id=$(openstack role assignment list \
         --group $2 \
         --project $3 \
-        -c "ID" -f value)
+        -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
         openstack role add $1 \
             --group $2 \
             --project $3
-        group_role_id=$(openstack role list \
+        group_role_id=$(openstack role assignment list \
             --group $2 \
             --project $3 \
-            -c "ID" -f value)
+            -f value)
     fi
     echo $group_role_id
 }

From ca89d071b3c249fba55a824f7f4fc247b7c22948 Mon Sep 17 00:00:00 2001
From: Miguel Angel Ajo <majopela@redhat.com>
Date: Tue, 4 Oct 2016 18:17:44 +0200
Subject: [PATCH 1574/3333] Reduce the scope of the subnet pool prefix in
 neutron

Some of the clouds used for CI use the 10.2xx.0.0/16 range
for VMs, and collide with the wider 10.0.0.0/8.

This setting allows for creation of 256 subnets out of the pool.

Change-Id: I48c86f94098f1501f0e7f90a265dda7e81440eb0
Closes-Bug: 1629133
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 54dae2b4c7..d998c065cf 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -85,7 +85,7 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 # Subnetpool defaults
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/16}
 SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}

From 57df186c132c522231aab1e577d879f7fa51c992 Mon Sep 17 00:00:00 2001
From: Clenimar Filemon <clenimar.filemon@gmail.com>
Date: Thu, 30 Jun 2016 17:30:26 -0300
Subject: [PATCH 1575/3333] Make Nova/Ironic communication use Identity v3

As long as nova already supports an Identity v3 auth flow when talking
to ironic (Id837d26bb21c158de0504627e488c0692aef1e24), make it use
v3 by default.

This way we don't fail in a keystone v3-only situation, for
example.

Change-Id: I028dfb52108d0630f47a53f8b420b70d4979eb55
---
 lib/nova_plugins/hypervisor-ironic | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c40427c089..7ffd14d046 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,11 +45,13 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
-    iniset $NOVA_CONF ironic admin_username admin
-    iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
-    iniset $NOVA_CONF ironic admin_tenant_name demo
-    iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
+    iniset $NOVA_CONF ironic auth_type password
+    iniset $NOVA_CONF ironic username admin
+    iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic project_domain_id default
+    iniset $NOVA_CONF ironic user_domain_id default
+    iniset $NOVA_CONF ironic project_name demo
 }
 
 # install_nova_hypervisor() - Install external components

From a283526c88d98f7668d369f4c20db44d3d06425a Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Fri, 15 Jul 2016 19:13:38 +0200
Subject: [PATCH 1576/3333] Set cinder coordination backend url

If DLM is enabled, cinder should be configured to use the correct
backend url for the dlm.
At the moment only zookeeper is supported, as it is the only backend
currently supported in devstack.

Change-Id: I7afc8dc95bc5b3f11b888e10607615c1212c45f4
---
 lib/cinder | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 0fe950b6c2..4ed944cfcb 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -358,6 +358,13 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+    # Set the backend url according to the configured dlm backend
+    if is_dlm_enabled; then
+        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
+            iniset $CINDER_CONF coordination backend_url "zake://"
+        fi
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts

From 66ce5c257ae32e269ede901f1737d04e194a6457 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 5 Oct 2016 12:11:05 -0700
Subject: [PATCH 1577/3333] Update apache tls proxy logs

This creates log files per proxy vhost and sets the log level to info to
help debug potential issues with tls proxying.

Change-Id: I02a62224662b021b35c293909ba045b4b74e1df8
---
 lib/apache | 1 +
 lib/tls    | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/lib/apache b/lib/apache
index 740f58835e..8a38cc45e5 100644
--- a/lib/apache
+++ b/lib/apache
@@ -39,6 +39,7 @@ elif is_suse; then
     APACHE_NAME=apache2
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/vhosts.d}
 fi
+APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 
 # Functions
 # ---------
diff --git a/lib/tls b/lib/tls
index c78ea5b191..6697dc875e 100644
--- a/lib/tls
+++ b/lib/tls
@@ -476,6 +476,11 @@ $listen_string
         ProxyPass http://$b_host:$b_port/ retry=5 nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
+    ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log
+    ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
+    LogLevel info
+    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log common
+    LogFormat "%v %h %l %u %t \"%r\" %>s %b"
 </VirtualHost>
 EOF
     for mod in ssl proxy proxy_http; do

From 05dc1aad6c4633dbad53bc8e5a574d871becec43 Mon Sep 17 00:00:00 2001
From: Jan Stodt <stodtj@de.ibm.com>
Date: Thu, 25 Aug 2016 15:46:02 +0200
Subject: [PATCH 1578/3333] Fix provider networking error message

This fix replaces Q_USE_PROVIDERNET_FOR_PUBLIC with
Q_USE_PROVIDER_NETWORKING in the error messages introduced by
[1].

The error is thrown when provider networking with IPv6 has been
requested via local.conf, but no provider IPv6 range or provider
IPv6 gateway is provided. But if a provider network should be used
over the private network is determined along the variable
Q_USE_PROVIDER_NETWORKING and not Q_USE_PROVIDERNET_FOR_PUBLIC.

The variable Q_USE_PROVIDERNET_FOR_PUBLIC determines if a provider
network should be used as public network. This happens a few lines
later in the code and is not related to those error messages.

[1] https://review.openstack.org/#/c/326638/1/lib/neutron_plugins/
services/l3

Change-Id: I50aa1e9d2027eef598c95404851e51c31a397fbb
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..14928fb09c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -191,8 +191,8 @@ function create_neutron_initial_network {
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
-            die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
-            die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
+            die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDER_NETWORKING is true and IP_VERSION includes 6"
+            die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDER_NETWORKING is true and IP_VERSION includes 6"
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi

From ec498cd0619805c409b28f81c6a7bcd3a01136ed Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 6 Oct 2016 15:00:44 -0400
Subject: [PATCH 1579/3333] remove sites-enabled/keystone.conf link on clean

doing a clean.sh / stack.sh cycle with USE_SSL=True was failing
because we were no longer cleaning up the keystone site fully, so some
of the early mod_ssl queries hit an invalid apache configuration.

Change-Id: Ic6f3f601e532ec50c0234d928c25b378d9e95e32
---
 lib/keystone | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 13fa50b17e..f9ee8eb761 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -25,7 +25,6 @@
 # - create_keystone_accounts
 # - stop_keystone
 # - cleanup_keystone
-# - _cleanup_keystone_apache_wsgi
 
 # Save trace setting
 _XTRACE_KEYSTONE=$(set +o | grep xtrace)
@@ -149,11 +148,7 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    _cleanup_keystone_apache_wsgi
-}
-
-# _cleanup_keystone_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_keystone_apache_wsgi {
+    disable_apache_site keystone
     sudo rm -f $(apache_site_config_for keystone)
 }
 

From 148d0e6e08caaaa9c6ca828c8404e5e82b6de8ee Mon Sep 17 00:00:00 2001
From: Clay Gerrard <clay.gerrard@gmail.com>
Date: Thu, 1 Sep 2016 02:38:06 -0700
Subject: [PATCH 1580/3333] Clarify default IP_VERSION in docs

The prior art on other options in the same document seemed to be
calling out the default in a pre-formatted block after describing the
possible values.

I believe the default value for the option was first changed [1], then
the docs were fixed [2], then the information was unintentionally
dropped from the docs [3].

1. Related-Change: If0e0b818355e4cb1338f7fa72af5e81e24361574
2. Related-Change: Ib6603b4f6ea0b4079f9a4ea46e723ecbb2ea371d
3. Related-Change: Iddd27cb54f1d9f062b9c47ff9ad6a2bef3650d6b

Change-Id: I662403db3b08a351a680587440ad1f15a6f8ee5d
---
 doc/source/configuration.rst | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1161b344e2..22809ebd7a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -521,16 +521,14 @@ created flavors as follows:
 IP Version
 ----------
 
-``IP_VERSION`` can be used to configure DevStack to create either an
-IPv4, IPv6, or dual-stack self service project data-network by with
+``IP_VERSION`` can be used to configure Neutron to create either an
+IPv4, IPv6, or dual-stack self-service project data-network by with
 either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
-respectively.  This functionality requires that the Neutron networking
-service is enabled by setting the following options:
+respectively.
 
     ::
 
-        disable_service n-net
-        enable_service q-svc q-agt q-dhcp q-l3
+        IP_VERSION=4+6
 
 The following optional variables can be used to alter the default IPv6
 behavior:

From f06455e1b55b5419b6546a0d85ebfa734bf3c6b4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 7 Oct 2016 06:57:03 -0400
Subject: [PATCH 1581/3333] Add a screen session for tls logs

When tls is enabled, we aren't bringing the logs to the forefront,
which makes it hard to debug when things go wrong. This does that.

Change-Id: I7c6c7e324e16da6b9bfa44f4bad17401ca4ed7e3
---
 lib/tls  | 7 +++++++
 stack.sh | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/lib/tls b/lib/tls
index 6697dc875e..40f3e81438 100644
--- a/lib/tls
+++ b/lib/tls
@@ -495,6 +495,13 @@ EOF
     reload_apache_server
 }
 
+# Follow TLS proxy
+function follow_tls_proxy {
+    sudo touch /var/log/$APACHE_NAME/tls-proxy_error.log
+    tail_log tls-error /var/log/$APACHE_NAME/tls-proxy_error.log
+    sudo touch /var/log/$APACHE_NAME/tls-proxy_access.log
+    tail_log tls-proxy /var/log/$APACHE_NAME/tls-proxy_access.log
+}
 
 # Cleanup Functions
 # =================
diff --git a/stack.sh b/stack.sh
index 9aa770f2b9..5170d1b8a4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -993,6 +993,10 @@ if [[ "$USE_SCREEN" == "True" ]]; then
     fi
     screen -r $SCREEN_NAME -X hardstatus alwayslastline "$SCREEN_HARDSTATUS"
     screen -r $SCREEN_NAME -X setenv PROMPT_COMMAND /bin/true
+
+    if is_service_enabled tls-proxy; then
+        follow_tls_proxy
+    fi
 fi
 
 # Clear ``screenrc`` file

From cac6ef09c5a7ecc0e9959b1e3ace48c41a0add71 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 11 Oct 2016 08:23:48 +0200
Subject: [PATCH 1582/3333] Remove the heat stack owner role

We should not require any special role for heat
since very long time.

We should use the same roles as with the primary user.

Change-Id: Id9150f94c30505ed0da33b8fbc2a5a7bd4fcf5d0
---
 lib/tempest | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..27023c2081 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -390,11 +390,6 @@ function configure_tempest {
 
     # Orchestration Tests
     if is_service_enabled heat; then
-        # Though this is not needed by heat, some tempest tests explicitly
-        # try to set this role. Removing them from the tempest tests breaks
-        # some non-devstack CIs.
-        get_or_create_role "heat_stack_owner"
-
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
             iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
@@ -408,7 +403,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
-        iniset $TEMPEST_CONFIG orchestration stack_owner_role "heat_stack_owner"
+        iniset $TEMPEST_CONFIG orchestration stack_owner_role Member
     fi
 
     # Scenario

From 5ff77d6a2ac81a411505dc1d3b7b814eb7fbb259 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <s.martinelli@gmail.com>
Date: Tue, 6 Sep 2016 19:10:22 +0000
Subject: [PATCH 1583/3333] Remove workaround for `openstack complete`

This reverts commit 6930ba312f787e0459f7455ac6ba2a70b3c7c37d.

By reverting this patch we are no longer using the bandaid fix mentioned
in the code. The latest openstackclient release (3.3.0) fixes the bug.

Related-Bug: 1619274

Change-Id: I20e3c5a92b97bf46c8d2318cd37044f0f36e1745
---
 stack.sh | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/stack.sh b/stack.sh
index 1cc4eca1b9..09466a6894 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1383,12 +1383,7 @@ check_libs_from_git
 # ===============
 
 # Prepare bash completion for OSC
-#
-# BUG: https://bugs.launchpad.net/python-openstackclient/+bug/1619274
-# the os-cloud param should not be required but if we don't provide it
-# then this command hangs indefinitely if something is wrong with
-# default environment credentials.
-openstack --os-cloud=devstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
 # If cinder is configured, set global_filter for PV devices
 if is_service_enabled cinder; then

From 2bd8d906813679cfc22f5bc62882a289906a64af Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 13 Oct 2016 08:24:57 +0200
Subject: [PATCH 1584/3333] Objects versions new style config

allow_versions is going to be a deprecated option.
Setting up the object versining in the new way.

[1] http://docs.openstack.org/developer/swift/overview_object_versioning.html

Change-Id: Ia520fbb6eb535b08ce83c0cb4bea31e7bba55eb3
---
 lib/swift | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index f9ea028cea..b175f2e5c1 100644
--- a/lib/swift
+++ b/lib/swift
@@ -397,6 +397,9 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server node_timeout 120
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server conn_timeout 20
 
+    # Versioned Writes
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:versioned_writes allow_versioned_writes true
+
     # Configure Ceilometer
     if is_service_enabled ceilometer; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"
@@ -489,8 +492,6 @@ EOF
         generate_swift_config_services ${swift_node_config} ${node_number} $(( CONTAINER_PORT_BASE + 10 * (node_number - 1) )) container
         iniuncomment ${swift_node_config} DEFAULT bind_ip
         iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
-        iniuncomment ${swift_node_config} app:container-server allow_versions
-        iniset ${swift_node_config} app:container-server allow_versions  "true"
 
         swift_node_config=${SWIFT_CONF_DIR}/account-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/account-server.conf-sample ${swift_node_config}

From d8682dbdf9f8247c20c4aa9612a560d2a9022c09 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Fri, 14 Oct 2016 14:36:29 -0400
Subject: [PATCH 1585/3333] worlddump: Add cinder-volume guru meditation report

cinder also supports GMR, it would be good
to have this when debugging gate failures.

Change-Id: I4db6dfd810d011faaca084e0dacaec4031b2a4ff
---
 tools/worlddump.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index e1ef544a55..1ce931efd5 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -34,6 +34,7 @@
     'neutron-linuxbridge-agent',
     'neutron-metadata-agent',
     'neutron-openvswitch-agent',
+    'cinder-volume',
 )
 
 

From 51db6d33c11b12fae0b2a404062cbee2b18a4427 Mon Sep 17 00:00:00 2001
From: Chuck Short <chuck.short@canonical.com>
Date: Sat, 15 Oct 2016 09:39:52 -0400
Subject: [PATCH 1586/3333] Replace wily support with yakkety

Ubuntu wily support is EOL so lets make room for yakkety.

Change-Id: Ib13d43f6d89bdf7c684cd34655a077a13e237be3
Signed-off-by: Chuck Short <chuck.short@canonical.com>
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 5e566e0388..fab2edd299 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From bc5cfc05842a4d4514082a2431020c5b881e52a1 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Sun, 9 Oct 2016 16:31:15 +0000
Subject: [PATCH 1587/3333] Allow running nova compute with docker group

A use case is from Zun project that needs to start n-cpu with
"docker" group.

Change-Id: Ib8f193ea1edf1f148e9ba505205495170ebf6d67
---
 lib/nova | 2 ++
 stackrc  | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 334cba6dd7..8da8ef2d29 100644
--- a/lib/nova
+++ b/lib/nova
@@ -829,6 +829,8 @@ function start_nova_compute {
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
+    elif [[ "$VIRT_DRIVER" = 'docker' ]]; then
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
diff --git a/stackrc b/stackrc
index c419ef4b15..bf92a77d81 100644
--- a/stackrc
+++ b/stackrc
@@ -589,6 +589,9 @@ case "$VIRT_DRIVER" in
     lxd)
         LXD_GROUP=${LXD_GROUP:-"lxd"}
         ;;
+    docker)
+        DOCKER_GROUP=${DOCKER_GROUP:-"docker"}
+        ;;
     fake)
         NUMBER_FAKE_NOVA_COMPUTE=${NUMBER_FAKE_NOVA_COMPUTE:-1}
         ;;

From 201c01f19b855aec3521c206fc0add5a01940c4b Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 18 Oct 2016 07:24:00 -0500
Subject: [PATCH 1588/3333] Don't clone dib-utils in install_heat

It's not used, and a recent change to trim down projects lists in
devstack-gate broke devstack in the gate that enabled heat.

Change-Id: I405423bdc9ba8dd9b30fce6fdceacccf662d5da3
---
 lib/heat | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/heat b/lib/heat
index c841e0a499..0863128f81 100644
--- a/lib/heat
+++ b/lib/heat
@@ -40,7 +40,6 @@ HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
 OCC_DIR=$DEST/os-collect-config
-DIB_UTILS_DIR=$DEST/dib-utils
 ORC_DIR=$DEST/os-refresh-config
 OAC_DIR=$DEST/os-apply-config
 
@@ -276,7 +275,6 @@ function install_heat_other {
     git_clone $OAC_REPO $OAC_DIR $OAC_BRANCH
     git_clone $OCC_REPO $OCC_DIR $OCC_BRANCH
     git_clone $ORC_REPO $ORC_DIR $ORC_BRANCH
-    git_clone $DIB_UTILS_REPO $DIB_UTILS_DIR $DIB_UTILS_BRANCH
 }
 
 # start_heat() - Start running processes, including screen
@@ -420,7 +418,7 @@ function create_heat_accounts {
 
 # build_heat_pip_mirror() - Build a pip mirror containing heat agent projects
 function build_heat_pip_mirror {
-    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR $DIB_UTILS_DIR"
+    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
     local projpath proj package
 
     rm -rf $HEAT_PIP_REPO

From 94ab1a4aa8ed1e438b66cc41f3637e78c8323dd0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 19 Oct 2016 08:16:16 +0000
Subject: [PATCH 1589/3333] Updated from generate-devstack-plugins-list

Change-Id: I15cdb23e00664efe637de5cbc7b5a1e8efa21d13
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f29b0d7ae2..771f2ef6a7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -121,7 +121,6 @@ nova-powervm                           `git://git.openstack.org/openstack/nova-p
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
-python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__

From aa47a0a8be9a9aced97d6a083d955949635fa3b3 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 20 Oct 2016 22:27:25 -0400
Subject: [PATCH 1590/3333] ceph: set rbd_secret_uuid in cinder.conf, not
 rbd_uuid

The ceph cinder backend script was setting the wrong
config option in cinder.conf for the secret uuid. This
was being masked by a bug in nova which is failing on
this bug when trying to fix the nova bug...right. It
makes sense.

See:

http://docs.ceph.com/docs/master/rbd/rbd-openstack/#configuring-cinder

Change-Id: I4655cae3212d589177d2570403b563a83aad529a
Closes-Bug: #1635488
---
 lib/cinder_backends/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 9bff5bef4f..a213d5e005 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -48,7 +48,7 @@ function configure_cinder_backend_ceph {
     iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF"
     iniset $CINDER_CONF $be_name rbd_pool "$CINDER_CEPH_POOL"
     iniset $CINDER_CONF $be_name rbd_user "$CINDER_CEPH_USER"
-    iniset $CINDER_CONF $be_name rbd_uuid "$CINDER_CEPH_UUID"
+    iniset $CINDER_CONF $be_name rbd_secret_uuid "$CINDER_CEPH_UUID"
     iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
     iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
     iniset $CINDER_CONF DEFAULT glance_api_version 2

From 4440da85637aa8239f24bd4f23a9a8e1ac2d0b8d Mon Sep 17 00:00:00 2001
From: Adam Young <ayoung@redhat.com>
Date: Wed, 26 Oct 2016 11:40:08 +0200
Subject: [PATCH 1591/3333] Unset admin_project config options for Keystone

Until the policy changes land for Nova, Glance, etc, this
value is not used.  Additionally, by having it set, it actually
makes it hard/impossible for the required changes to land in
the other services.  Disable/comment out the changes in the
Keystone specific lib file for now, and we will re-enable once
the Services can make use of them.

Change-Id: Ia1de9083c21107dac2f0abb56bda166bdb37a69d
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index f9ee8eb761..8db0876f8b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -344,8 +344,8 @@ function configure_keystone {
     # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
     # The users from this project are globally admin as before, but it also
     # allows policy changes in order to clarify the adminess scope.
-    iniset $KEYSTONE_CONF resource admin_project_domain_name Default
-    iniset $KEYSTONE_CONF resource admin_project_name admin
+    #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
+    #iniset $KEYSTONE_CONF resource admin_project_name admin
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts

From d5f730caf41430a142fcf37b216dfa4d69ec4d2c Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 18:39:44 +0900
Subject: [PATCH 1592/3333] lib/neutron: Remove remaining references to Q_
 variables

Q_ variables belong to neutron-legacy.

These are True by default in neutron.
Remove them in favor of post-config meta section.

Change-Id: If691a79b09003f85a07c9f33e0379a2b21e48141
---
 lib/neutron | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 9e9eb2d2b1..53fc5fcd15 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -147,10 +147,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
 
-        # Configuration for neutron notifations to nova.
-        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
-        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
-
         iniset $NEUTRON_CONF nova auth_type password
         iniset $NEUTRON_CONF nova auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
         iniset $NEUTRON_CONF nova username nova

From 07edde1c14d8ab91533c1ef6fe0470f088d5c8bb Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 19 Oct 2016 19:21:00 +0000
Subject: [PATCH 1593/3333] lib/neutron: Create initial topology only on
 controller node

To avoid it being created multiple times for multinode setup.

Note: This reverts "Enable neutron to work in a multi node setup"
(commit 88f8558d874072536e7660a233f24207a7089651) partly and fixes
the issue differently.
The configuration in question uses the new lib/neutron. (not neutron-legacy)
In that case, calling create_neutron_initial_network from stack.sh directly
is a wrong way, as create_neutron_initial_network is sourced by
neutron-legacy.  The new neutron code should not rely on the legacy one.

Closes-Bug: #1613069
Change-Id: I868afeb065d80d8ccd57630b90658e330ab94251
---
 lib/neutron                     | 20 +++++++++++---------
 lib/neutron_plugins/services/l3 |  8 --------
 stack.sh                        |  5 ++++-
 3 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 53fc5fcd15..9923721e74 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -431,15 +431,17 @@ function start_neutron_new {
     if is_service_enabled neutron-l3; then
         run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
     fi
-    # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
-    # of the code in lib/neutron_plugins/services/l3
-    if type -p neutron_plugin_create_initial_networks > /dev/null; then
-        neutron_plugin_create_initial_networks
-    else
-        # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
-        source $TOP_DIR/lib/neutron_plugins/services/l3
-        # Create the networks using servic
-        create_neutron_initial_network
+    if is_service_enabled neutron-api; then
+        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
+        # of the code in lib/neutron_plugins/services/l3
+        if type -p neutron_plugin_create_initial_networks > /dev/null; then
+            neutron_plugin_create_initial_networks
+        else
+            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
+            source $TOP_DIR/lib/neutron_plugins/services/l3
+            # Create the networks using servic
+            create_neutron_initial_network
+        fi
     fi
     if is_service_enabled neutron-metadata-agent; then
         run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index aa61a109fa..9c9143a225 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -154,14 +154,6 @@ function _neutron_get_ext_gw_interface {
 }
 
 function create_neutron_initial_network {
-    if ! is_service_enabled q-svc && ! is_service_enabled neutron-api; then
-        echo "Controller services not enabled. No networks configured!"
-        return
-    fi
-    if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "False" ]]; then
-        echo "Network creation disabled!"
-        return
-    fi
     local project_id
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
diff --git a/stack.sh b/stack.sh
index fab2edd299..2783efed6b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1267,7 +1267,10 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-create_neutron_initial_network
+if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
+    echo_summary "Creating initial neutron network elements"
+    create_neutron_initial_network
+fi
 
 if is_service_enabled nova; then
     echo_summary "Starting Nova"

From 7b07ccf5e4b7f724eceedb069a51c29284b357aa Mon Sep 17 00:00:00 2001
From: Eric Brown <browne@vmware.com>
Date: Thu, 27 Oct 2016 06:14:00 -0700
Subject: [PATCH 1594/3333] Remove deprecated/obsolete ldap options

The devstack ldap configuration for keystone is still using some
old options that are no longer valid. The write support is
being removed this release. And in previous releases, the ldap
assignment driver support was removed and was not removed here.

Change-Id: I538626b681eaee6a7ac10dfbc29605b73fbe13bf
---
 lib/keystone | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index f9ee8eb761..b2dfa833e3 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -221,13 +221,6 @@ function configure_keystone {
         iniset $KEYSTONE_CONF ldap password $LDAP_PASSWORD
         iniset $KEYSTONE_CONF ldap user $LDAP_MANAGER_DN
         iniset $KEYSTONE_CONF ldap suffix $LDAP_BASE_DN
-        iniset $KEYSTONE_CONF ldap use_dumb_member "True"
-        iniset $KEYSTONE_CONF ldap user_attribute_ignore "enabled,email,tenants,default_project_id"
-        iniset $KEYSTONE_CONF ldap tenant_attribute_ignore "enabled"
-        iniset $KEYSTONE_CONF ldap tenant_domain_id_attribute "businessCategory"
-        iniset $KEYSTONE_CONF ldap tenant_desc_attribute "description"
-        iniset $KEYSTONE_CONF ldap tenant_tree_dn "ou=Projects,$LDAP_BASE_DN"
-        iniset $KEYSTONE_CONF ldap user_domain_id_attribute "businessCategory"
         iniset $KEYSTONE_CONF ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
         iniset $KEYSTONE_CONF DEFAULT member_role_id "9fe2ff9ee4384b1894a90878d3e92bab"
         iniset $KEYSTONE_CONF DEFAULT member_role_name "_member_"

From fb73d85afe7df7b93b9a460372a8ad6558e887e0 Mon Sep 17 00:00:00 2001
From: Eric Brown <browne@vmware.com>
Date: Fri, 28 Oct 2016 02:03:37 -0700
Subject: [PATCH 1595/3333] Remove unused KEYSTONE_CATALOG_BACKEND

This patch simply removes a var noted to be removed back in Newton.

Change-Id: I7c66e1d8d65f562596543ed8ca402dba8c8ea271
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index f9ee8eb761..e2303c08de 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -51,9 +51,6 @@ KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 
-# NOTE(sdague): remove in Newton
-KEYSTONE_CATALOG_BACKEND="sql"
-
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 # Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}

From dc486bc12fb63ecb5939f8d29dd9cf7a659847cd Mon Sep 17 00:00:00 2001
From: Steve Martinelli <s.martinelli@gmail.com>
Date: Thu, 8 Sep 2016 02:29:25 +0000
Subject: [PATCH 1596/3333] Switch fernet to be the default token provider

this is the first patch in a series to actually make fernet the default
token provider in keystone. the patches for grenade, release notes, and
actually switching the value in keystone all depend on this patch first.

reasons for switching over:

- fernet tokens are the recommended token provider
- the install guide for newton recommends deployers use fernet tokens [0]
- we previously attempted this switch but ran into timing issues [1],
  the timing issues have been resolved [2]

[0] http://docs.openstack.org/newton/install-guide-ubuntu/keystone-install.html
[1] 153db269705f37d4144ad3fcf26dc67269755d7d
[2] https://review.openstack.org/#/q/topic:make-fernet-default

Change-Id: I3b819ae8d2924f3bece03902e05d1a8c5e5923f1
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index b2dfa833e3..fd92f31afb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -88,7 +88,7 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
-KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration

From ade65b813b33bfb71c707b5ac6995e8ca4099fb5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 1 Nov 2016 06:46:36 +0000
Subject: [PATCH 1597/3333] Updated from generate-devstack-plugins-list

Change-Id: I1b357b2e668ff5ed56c5deb9d71709a7526e17ea
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 771f2ef6a7..7c97171806 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,6 +69,7 @@ ironic-inspector                       `git://git.openstack.org/openstack/ironic
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
+keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__

From c9c9d31d3eb98f3d6382cedfd2aebc75ce236d1f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 15 Sep 2016 20:33:22 -0400
Subject: [PATCH 1598/3333] tempest: set network-feature-enabled.port_security

Sets the port_security feature flag in tempest.conf
if the port_security extension is enabled, which it's not
by default in neutron but is set by default in devstack.

This adds global variable for setting the port_security
extension in ml2.conf and in tempest.conf so we only have
to set this in one place.

Depends-On: I1efd5c838aa0d73cc6e8864e3041eea25850198d

Change-Id: I6334b200e42edd785f74cfb41520627393039619
Related-Bug: #1624082
---
 lib/neutron             | 4 +++-
 lib/neutron_plugins/ml2 | 6 +++++-
 lib/tempest             | 1 +
 stackrc                 | 3 +++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 53fc5fcd15..415344e88d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -162,7 +162,9 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 type_drivers vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
+        if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
+        fi
     fi
 
     # Neutron OVS or LB agent
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 7e8020930f..e429714f06 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -35,7 +35,11 @@ Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-vni_ranges=$TENANT_TUNNEL_RANGES}
 # List of extension drivers to load, use '-' instead of ':-' to allow people to
 # explicitly override this to blank
-Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
+if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
+    Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
+else
+    Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-}
+fi
 
 # L3 Plugin to load for ML2
 # For some flat network environment, they not want to extend L3 plugin.
diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..0d018432af 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -387,6 +387,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6 "$IPV6_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
+    iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
     # Orchestration Tests
     if is_service_enabled heat; then
diff --git a/stackrc b/stackrc
index c419ef4b15..ea8b044faf 100644
--- a/stackrc
+++ b/stackrc
@@ -778,6 +778,9 @@ fi
 
 HOST_IPV6=$(get_default_host_ip "" "" "$HOST_IP_IFACE" "$HOST_IPV6" "inet6")
 
+# Whether or not the port_security extension should be enabled for Neutron.
+NEUTRON_PORT_SECURITY=$(trueorfalse True NEUTRON_PORT_SECURITY)
+
 # SERVICE IP version
 # This is the IP version that services should be listening on, as well
 # as using to register their endpoints with keystone.

From 2d9959c53b7866e0dbfb0bcda15c59db1c3de6b6 Mon Sep 17 00:00:00 2001
From: "Castulo J. Martinez" <castulo.martinez@intel.com>
Date: Tue, 1 Nov 2016 13:34:20 -0700
Subject: [PATCH 1599/3333] Removing config values no longer in tempest.conf

This commit removes some config values for tempest that no
longer exist in tempest/config.py therefore are no longer needed
in tempest.conf.

Change-Id: I5778973012e57e8d9df9bf864590f8ed7fe05561
---
 lib/tempest | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..3f9ebca225 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -267,8 +267,7 @@ function configure_tempest {
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"
-        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_project_name
-        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_project_id
+        iniset $TEMPEST_CONFIG auth admin_project_name $admin_project_name
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
@@ -306,15 +305,10 @@ function configure_tempest {
     fi
 
     # Compute
-    iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt
-    iniset $TEMPEST_CONFIG compute image_alt_ssh_user ${ALT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
-    iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
-    # set the equiv validation option here as well to ensure they are
-    # in sync. They shouldn't be separate options.
     iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
     if ! is_service_enabled n-cell && ! is_service_enabled neutron; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
@@ -419,9 +413,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
     iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
-    # Telemetry
-    iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
-
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4

From 54482cd80b9d64f2d7043cd8560504d9d5752fc1 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sun, 9 Oct 2016 09:47:48 +0000
Subject: [PATCH 1600/3333] Stop q-domua process when XenServer is used

When using XenServer, it will create two neutron-openvswitch-agent
q-agt and q-domua even it's single box environment, but it didn't
stop the q-domua, this patch is to stop q-domua in unstack.sh

Change-Id: I511ed534bfb7d5fe6136f6a0b33f1d749d30862c
Closes-Bug: #1631721
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9e926a000f..938d5662ec 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -511,6 +511,10 @@ function start_neutron_agents {
 
 function stop_mutnauq_l2_agent {
     stop_process q-agt
+
+    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
+        stop_process q-domua
+    fi
 }
 
 # stop_mutnauq_other() - Stop running processes (non-screen)

From 75bf9722392c9fc1ca7c6a95b99e8897c86d4271 Mon Sep 17 00:00:00 2001
From: Paulo Ewerton <pauloewerton@lsd.ufcg.edu.br>
Date: Fri, 22 Jan 2016 19:13:31 +0000
Subject: [PATCH 1601/3333] Move default Keystone API version to v3

This patch sets Keystone v3 as default in services
configuration files and in the openrc and stackrc scripts.

Change-Id: I24546f02067ea23d088d383b85e3a78d7b43f166
Partially-Implements: bp keystonev3
---
 lib/glance             |  2 +-
 lib/tempest            | 12 +++++++-----
 openrc                 |  4 ++--
 stackrc                |  2 +-
 tools/create_userrc.sh |  2 +-
 5 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/glance b/lib/glance
index 5259174799..da9cd43536 100644
--- a/lib/glance
+++ b/lib/glance
@@ -235,7 +235,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/tempest b/lib/tempest
index 0d018432af..166a521bd9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -271,13 +271,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_project_id
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        # Only Identity v3 is available; then skip Identity API v2 tests
+    if [ "$ENABLE_IDENTITY_V2" == "True" ]; then
+        # Run Identity API v2 tests ONLY if needed
+        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True
+        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
+    else
+        # Skip Identity API v2 tests by default
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-        # In addition, use v3 auth tokens for running all Tempest tests
+        # Use v3 auth tokens for running all Tempest tests
         iniset $TEMPEST_CONFIG identity auth_version v3
-    else
-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     fi
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
diff --git a/openrc b/openrc
index 8d8ae8b030..d1c61297a1 100644
--- a/openrc
+++ b/openrc
@@ -81,12 +81,12 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/project has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the 2.0 *identity api*.
+# We currently recommend using the version 3 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
diff --git a/stackrc b/stackrc
index ea8b044faf..e4ff1b7eee 100644
--- a/stackrc
+++ b/stackrc
@@ -158,7 +158,7 @@ else
 fi
 
 # Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
 # deployment will be deploying the Identity v2 pipelines. If this option is set
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 30d1a01577..f4a4edcbe2 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v2.0/
+    export OS_AUTH_URL=http://localhost:5000/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then

From 30ab23cd9b103470a7d89c4c88bccba789884c36 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Wed, 2 Nov 2016 16:30:31 -0400
Subject: [PATCH 1602/3333] Fix stevedore warning with neutron firewall_driver

The initial start of the neutron OVS agent always prints
a warning:

 WARNING stevedore.named [] Could not load
 neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

There's an alias for that in setup.cfg called
iptables_hybrid that would avoid it.

Change-Id: I3f5bf782f4f27dc123e462e494741a8a941641ec
---
 lib/neutron_plugins/ovs_base | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 3cd6c85053..baf7d7f34b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -83,10 +83,10 @@ function _neutron_ovs_base_configure_debug_command {
 
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid
         enable_kernel_bridge_firewall
     else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver noop
     fi
 }
 

From f881a0e4ee995a2e2122e0e048cc8b7ccc88d6a0 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 27 Sep 2016 05:57:06 +0000
Subject: [PATCH 1603/3333] XenAPI: Enable linux bridge in Dom0 for neturon

When using neutron network under xenserver, we must enable linux bridge
in Dom0 as neutron will use linux bridge qbr in compute node for
security group. But by default XenServer use openvswitch and disabled
linux bridge. This patch is to remove this restriction.

Change-Id: I0e8124ff2323810fdc46c717a750ce7e8f4aa0c6
---
 lib/nova_plugins/hypervisor-xenserver | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e5d25da3a3..a63e72e764 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -90,6 +90,10 @@ CRONTAB
         echo "install_conntrack_tools"
     } | $ssh_dom0
 
+    if is_service_enabled neutron; then
+        # Remove restriction on linux bridge in Dom0 when neutron is enabled
+        $ssh_dom0 "rm -f /etc/modprobe.d/blacklist-bridge*"
+    fi
 }
 
 # install_nova_hypervisor() - Install external components

From 62f29a98d70298372590957bcec7b9f7bc59d963 Mon Sep 17 00:00:00 2001
From: Pierre Riteau <priteau@uchicago.edu>
Date: Thu, 3 Nov 2016 10:10:03 +0000
Subject: [PATCH 1604/3333] Update stable branch example

The stable/juno branch was deleted 11 months ago:
http://lists.openstack.org/pipermail/openstack-announce/2015-December/000869.html

Update the example to Newton, which should keep it valid for a while.

Change-Id: I4cd8738862a529fd319be2ec5694d00defd94f84
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 4ba4619c6d..ff5598b0c5 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,9 @@ in a clean and disposable vm when you are first getting started.
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a juno OpenStack cloud:
+following to create a Newton OpenStack cloud:
 
-    git checkout stable/juno
+    git checkout stable/newton
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate

From 4f11ff30cf2f7c674316fe8c98f1c006f397013f Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Thu, 27 Oct 2016 06:15:23 -0700
Subject: [PATCH 1605/3333] Adopt openstack client for neutron commands

The neutron client is going to be deprecated during the
Ocata timeframe, so it is time to start switching to the
openstack client to invoke networking commands.

use of neutron client in neutron-legacy has been left as is.

The command for setting the router gateway is left as follow up.

Change-Id: I0a63e03d7d4a08ad6c27f2729fc298322baab397
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 12 ++--
 exercises/neutron-adv-test.sh                | 12 ++--
 lib/neutron_plugins/services/l3              | 76 ++++++++++----------
 lib/tempest                                  |  2 +-
 tools/ping_neutron.sh                        |  2 +-
 5 files changed, 51 insertions(+), 53 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 0c439ad3ad..21bea9973b 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -66,21 +66,21 @@ Run stack.sh and do some sanity checks
     ./stack.sh
     . ./openrc
 
-    neutron net-list  # should show public and private networks
+    openstack network list  # should show public and private networks
 
 Create two nova instances that we can use as test http servers:
 
   ::
 
     #create nova instances on private network
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
     nova list # should show the nova instances just created
 
     #add secgroup rules to allow ssh etc..
-    neutron security-group-rule-create default --protocol icmp
-    neutron security-group-rule-create default --protocol tcp --port-range-min 22 --port-range-max 22
-    neutron security-group-rule-create default --protocol tcp --port-range-min 80 --port-range-max 80
+    openstack security group rule create default --protocol icmp
+    openstack security group rule create default --protocol tcp --dst-port 22:22
+    openstack security group rule create default --protocol tcp --dst-port 80:80
 
 Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
 
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index e003c56331..bfd45eca5c 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -156,7 +156,7 @@ function get_role_id {
 function get_network_id {
     local NETWORK_NAME="$1"
     local NETWORK_ID
-    NETWORK_ID=`neutron net-list -F id  -- --name=$NETWORK_NAME | awk "NR==4" | awk '{print $2}'`
+    NETWORK_ID=`openstack network list | grep $NETWORK_NAME | awk '{print $2}'`
     echo $NETWORK_ID
 }
 
@@ -234,9 +234,9 @@ function create_network {
     PROJECT_ID=$(get_project_id $PROJECT)
     source $TOP_DIR/openrc $PROJECT $PROJECT
     local NET_ID
-    NET_ID=$(neutron net-create --project-id $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
+    NET_ID=$(openstack network create --project $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PROJECT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --project-id $PROJECT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
+    openstack subnet create --ip-version 4 --project $PROJECT_ID --gateway $GATEWAY --subnet-pool None --network $NET_ID --subnet-range $CIDR "${NET_NAME}_subnet"
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
@@ -325,10 +325,10 @@ function delete_network {
     PROJECT_ID=$(get_project_id $PROJECT)
     #TODO(nati) comment out until l3-agent merged
     #for res in port subnet net router;do
-    for net_id in `neutron net-list -c id -c name | grep $NET_NAME | awk '{print $2}'`;do
+    for net_id in `openstack network list -c ID -c Name | grep $NET_NAME | awk '{print $2}'`;do
         delete_probe $net_id
-        neutron subnet-list | grep $net_id | awk '{print $2}' | xargs -I% neutron subnet-delete %
-        neutron net-delete $net_id
+        openstack subnet list | grep $net_id | awk '{print $2}' | xargs -I% openstack subnet delete %
+        openstack network delete $net_id
     done
     source $TOP_DIR/openrc demo demo
 }
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index aa61a109fa..ddc615589f 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -174,10 +174,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default | grep ' id ' | get_field 2)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default | grep ' id ' | get_field 2)
             fi
         fi
     fi
@@ -185,14 +185,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} $NET_ID $fixed_range_v4 | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID --subnet-range $fixed_range_v4 | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -202,7 +202,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -212,7 +212,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -230,23 +230,23 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
-        EXTERNAL_NETWORK_FLAGS="--router:external"
+        EXTERNAL_NETWORK_FLAGS="--external"
         if is_networking_extension_supported "auto-allocated-topology"; then
-            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
+            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --default"
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type flat --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -268,16 +268,16 @@ function _neutron_create_private_subnet_v4 {
     if [ -z $SUBNETPOOL_V4_ID ]; then
         fixed_range_v4=$FIXED_RANGE
     fi
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 4 "
+    local subnet_params="--project $project_id "
+    subnet_params+="--ip-version 4 "
     if [[ -n "$NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $NETWORK_GATEWAY "
     fi
-    subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} "
-    subnet_params+="$NET_ID $fixed_range_v4"
+    subnet_params+="${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} "
+    subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
+    subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -291,52 +291,50 @@ function _neutron_create_private_subnet_v6 {
     if [ -z $SUBNETPOOL_V6_ID ]; then
         fixed_range_v6=$FIXED_RANGE_V6
     fi
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 6 "
+    local subnet_params="--project $project_id "
+    subnet_params+="--ip-version 6 "
     if [[ -n "$IPV6_PRIVATE_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     fi
-    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} "
-    subnet_params+="$NET_ID $fixed_range_v6 $ipv6_modes"
+    subnet_params+="${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} "
+    subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6 $ipv6_modes} "
+    subnet_params+="--network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local subnet_params="--ip_version 4 "
+    local subnet_params="--ip-version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     fi
-    subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
+    subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
+    subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip_version 6 "
+    local subnet_params="--ip-version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
+    subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
+    subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
+    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -371,7 +369,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+            ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             local replace_range=${SUBNETPOOL_PREFIX_V4}
             if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
@@ -385,7 +383,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -416,7 +414,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+        IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -446,6 +444,6 @@ function is_provider_network {
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
-    EXT_LIST=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list -c alias -f value)
+    EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..2444ee9967 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -242,7 +242,7 @@ function configure_tempest {
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
     if is_networking_extension_supported 'external-net'; then
-        public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
+        public_network_id=$(openstack network list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi
 
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index dba7502652..c75575406a 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -54,7 +54,7 @@ fi
 REMAINING_ARGS="${@:2}"
 
 # BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(neutron net-list | grep "$NET_NAME" | awk '{print $2}')
+NET_ID=$(openstack network list | grep "$NET_NAME" | awk '{print $2}')
 PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
 
 # This runs a command inside the specific netns

From f166081d0e4a3b04b157a25e94f0bb2a1769f813 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 1 Nov 2016 15:44:06 -0400
Subject: [PATCH 1606/3333] Always setup cells v2

Nova is going to land a database migration in Ocata
under change I72fb724dc13e1a5f4e97c58915b538ba761c582d
which enforces that at least the simple cells v2 setup
is performed, which creates the cell mappings, cell0 and
host mappings. Before we can land that change in Nova
we have to make cells v2 setup a default in the integrated
gate jobs.

Depends-On: Ie44e615384df464516aa30b9044b5e54b7d995bb

Change-Id: If1af9c478e8ea2420f2523a9bb8b70fafddc86b7
---
 lib/nova | 7 +------
 stack.sh | 2 +-
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index f38fb8b146..09b4aa5587 100644
--- a/lib/nova
+++ b/lib/nova
@@ -85,9 +85,6 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
-# Option to initialize CellsV2 environment
-NOVA_CONFIGURE_CELLSV2=$(trueorfalse False NOVA_CONFIGURE_CELLSV2)
-
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-filter_scheduler}
@@ -681,9 +678,7 @@ function init_nova {
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova databases
         recreate_database nova
-        if [ "$NOVA_CONFIGURE_CELLSV2" != "False" ]; then
-            recreate_database nova_api_cell0
-        fi
+        recreate_database nova_api_cell0
 
         # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
         # been run this migrates the "nova" and "nova_api_cell0" database.
diff --git a/stack.sh b/stack.sh
index fab2edd299..e908a9a335 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1380,7 +1380,7 @@ check_libs_from_git
 # ----------------------
 
 # Do this late because it requires compute hosts to have started
-if is_service_enabled n-api && [ "$NOVA_CONFIGURE_CELLSV2" == "True" ]; then
+if is_service_enabled n-api; then
     create_cell
 fi
 

From 8c7cec52d0a263d6e5e54afdfdb73f408df68a75 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 4 Nov 2016 11:31:22 +0000
Subject: [PATCH 1607/3333] Updated from generate-devstack-plugins-list

Change-Id: Id23209fa26e39d569b7e4b4e95d42e72fd92c32e
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7c97171806..69311350ae 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -119,6 +119,7 @@ nova-docker                            `git://git.openstack.org/openstack/nova-d
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
+oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__

From 7c0af1bfb8d39fe4edad4b79b930d90077f4454e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 10 Nov 2016 06:49:01 +0000
Subject: [PATCH 1608/3333] Updated from generate-devstack-plugins-list

Change-Id: Ifce4376733d55452a1ce85df75a4203ac2f2aff9
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 69311350ae..6ece9978ac 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -78,6 +78,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
@@ -85,6 +86,7 @@ monasca-log-api                        `git://git.openstack.org/openstack/monasc
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
 networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__

From bac2e4ddc28393fbd3c6f45248737893b5d0fd97 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <carlos.goncalves@neclab.eu>
Date: Fri, 11 Nov 2016 15:02:57 +0100
Subject: [PATCH 1609/3333] Update local.sh sample file to use OSC

Besides updating to OSC CLI, this patch also fixes an argument name typo
present before in 'nova keypair-add' (--pub_key should be --pub-key).

Specifying $OS_PROJECT_NAME in case user is associated to multiple
projects containing security groups with same name (e.g. 'default').

Change-Id: I776f6edfc4c6c798a39d3260827a18c695f05c87
---
 samples/local.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/samples/local.sh b/samples/local.sh
index 634f6ddb17..9cd0bdcc17 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -36,7 +36,7 @@ if is_service_enabled nova; then
     # Add first keypair found in localhost:$HOME/.ssh
     for i in $HOME/.ssh/id_rsa.pub $HOME/.ssh/id_dsa.pub; do
         if [[ -r $i ]]; then
-            nova keypair-add --pub_key=$i `hostname`
+            openstack keypair create --public-key $i `hostname`
             break
         fi
     done
@@ -53,8 +53,8 @@ if is_service_enabled nova; then
     MI_NAME=m1.micro
 
     # Create micro flavor if not present
-    if [[ -z $(nova flavor-list | grep $MI_NAME) ]]; then
-        nova flavor-create $MI_NAME 6 128 0 1
+    if [[ -z $(openstack flavor list | grep $MI_NAME) ]]; then
+        openstack flavor create $MI_NAME --id 6 --ram 128 --disk 0 --vcpus 1
     fi
 
 
@@ -62,7 +62,7 @@ if is_service_enabled nova; then
     # ----------
 
     # Add tcp/22 and icmp to default security group
-    nova secgroup-add-rule default tcp 22 22 0.0.0.0/0
-    nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0
+    openstack security group rule create --project $OS_PROJECT_NAME default --protocol tcp --ingress --dst-port 22
+    openstack security group rule create --project $OS_PROJECT_NAME default --protocol icmp
 
 fi

From bd42d4918eebc7ca2a72bb459bc5f8d953623e5f Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Sat, 12 Nov 2016 11:09:15 -0800
Subject: [PATCH 1610/3333] Remove call to undefined teardown_neutron_debug

Previously the usage of neutron debug ports was removed by
5e01c47e4d671166b9396c507a7105a5ac8256dc but there was still call to
teardown_neutron_debug. Recently a change to devstack-gate
1d6cc0771a3399300117f488e9d71e7ea46a4d82 caused that call to be
triggered and breaking the gate-devstack-dsvm-updown job.

This patch deletes the call and comments regarding setup_neutron_debug
and teardown_neutron_debug.

Change-Id: Ifdacb0cec1307db469bd66f551474539184cf2cd
---
 lib/neutron-legacy | 2 --
 unstack.sh         | 5 -----
 2 files changed, 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9e926a000f..613e0f1365 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -24,11 +24,9 @@
 # - check_neutron_third_party_integration
 # - start_neutron_agents
 # - create_neutron_initial_network
-# - setup_neutron_debug
 #
 # ``unstack.sh`` calls the entry points in this order:
 #
-# - teardown_neutron_debug
 # - stop_neutron
 # - stop_neutron_third_party
 # - cleanup_neutron
diff --git a/unstack.sh b/unstack.sh
index f888896cb9..c05d1f0952 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -97,11 +97,6 @@ set -o xtrace
 # Phase: unstack
 run_phase unstack
 
-if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
-    source $TOP_DIR/openrc
-    teardown_neutron_debug
-fi
-
 # Call service stop
 
 if is_service_enabled heat; then

From 2b3ac6dc64a6d31a1dae2ede6483bf9f73a3918f Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Wed, 9 Nov 2016 12:50:00 +0800
Subject: [PATCH 1611/3333] Specify the correct image parameters for XenServer

The deprecated AMI image file opts will be removed soon.
See https://review.openstack.org/#/c/338377.
So we can't use the fallback mechanism anymore. This patch is to
specify the correct image parameters for XenServer.

Change-Id: Ic287a3ed1725c42ea29022158bc9720c9a96533f
---
 lib/tempest | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 657c3ad592..56c97d52a9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -295,7 +295,6 @@ function configure_tempest {
     fi
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
-        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
     fi
 
     # Image Features
@@ -407,12 +406,20 @@ function configure_tempest {
     fi
 
     # Scenario
-    SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+    if [ "$VIRT_DRIVER" = "xenserver" ]; then
+        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
+        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.vhd.tgz"
+        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
+        iniset $TEMPEST_CONFIG scenario img_container_format ovf
+    else
+        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
+    fi
     iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
+    iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
     iniset $TEMPEST_CONFIG scenario ami_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img"
     iniset $TEMPEST_CONFIG scenario ari_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd"
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
-    iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}

From 8f985b6ff1179d19872e83c97035fa49a8f660f6 Mon Sep 17 00:00:00 2001
From: xiaolihope <dixiaobj@cn.ibm.com>
Date: Wed, 18 May 2016 00:32:08 +0800
Subject: [PATCH 1612/3333] Remove heat code from devstack tree

This removes all of the heat code from the devstack tree, in favor of the
devstack plugin in Heat's tree.

Depends-On: I4bed1e5cef5afa7b049b07640086a86a3f881e13
Depends-On: Ic392bcc24bc374ee8511a94f1d8f6ac23131c7e3

Change-Id: I5b60422bf1f5fa78aa8f3383f7a222e0356d9e42
---
 clean.sh                                  |   3 +-
 files/apache-heat-api-cfn.template        |  27 --
 files/apache-heat-api-cloudwatch.template |  27 --
 files/apache-heat-api.template            |  27 --
 files/apache-heat-pip-repo.template       |  15 -
 files/debs/heat                           |   1 -
 lib/heat                                  | 467 ----------------------
 stack.sh                                  |  27 --
 stackrc                                   |   8 -
 tests/test_libs_from_pypi.sh              |   2 +-
 unstack.sh                                |   5 -
 11 files changed, 2 insertions(+), 607 deletions(-)
 delete mode 100644 files/apache-heat-api-cfn.template
 delete mode 100644 files/apache-heat-api-cloudwatch.template
 delete mode 100644 files/apache-heat-api.template
 delete mode 100644 files/apache-heat-pip-repo.template
 delete mode 100644 files/debs/heat
 delete mode 100644 lib/heat

diff --git a/clean.sh b/clean.sh
index bace3f53fe..b59635a821 100755
--- a/clean.sh
+++ b/clean.sh
@@ -49,7 +49,6 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
@@ -108,7 +107,7 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
 fi
 
 # Clean out /etc
-sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/heat /etc/neutron /etc/openstack/
+sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/neutron /etc/openstack/
 
 # Clean out tgt
 sudo rm -f /etc/tgt/conf.d/*
diff --git a/files/apache-heat-api-cfn.template b/files/apache-heat-api-cfn.template
deleted file mode 100644
index ab33c66f7e..0000000000
--- a/files/apache-heat-api-cfn.template
+++ /dev/null
@@ -1,27 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess heat-api-cfn processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup heat-api-cfn
-    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cfn
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    AllowEncodedSlashes On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/heat-api-cfn.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-
-    <Directory %HEAT_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
-</VirtualHost>
diff --git a/files/apache-heat-api-cloudwatch.template b/files/apache-heat-api-cloudwatch.template
deleted file mode 100644
index 06c91bbdb1..0000000000
--- a/files/apache-heat-api-cloudwatch.template
+++ /dev/null
@@ -1,27 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess heat-api-cloudwatch processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup heat-api-cloudwatch
-    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cloudwatch
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    AllowEncodedSlashes On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/heat-api-cloudwatch.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-
-    <Directory %HEAT_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
-</VirtualHost>
diff --git a/files/apache-heat-api.template b/files/apache-heat-api.template
deleted file mode 100644
index 4924b3978b..0000000000
--- a/files/apache-heat-api.template
+++ /dev/null
@@ -1,27 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess heat-api processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup heat-api
-    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    AllowEncodedSlashes On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/heat-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-
-    <Directory %HEAT_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
-</VirtualHost>
diff --git a/files/apache-heat-pip-repo.template b/files/apache-heat-pip-repo.template
deleted file mode 100644
index d88ac3e35a..0000000000
--- a/files/apache-heat-pip-repo.template
+++ /dev/null
@@ -1,15 +0,0 @@
-Listen %HEAT_PIP_REPO_PORT%
-
-<VirtualHost *:%HEAT_PIP_REPO_PORT%>
-    DocumentRoot %HEAT_PIP_REPO%
-    <Directory %HEAT_PIP_REPO%>
-        DirectoryIndex index.html
-        Require all granted
-        Order allow,deny
-        allow from all
-    </Directory>
-
-    ErrorLog /var/log/%APACHE_NAME%/heat_pip_repo_error.log
-    LogLevel warn
-    CustomLog /var/log/%APACHE_NAME%/heat_pip_repo_access.log combined
-</VirtualHost>
diff --git a/files/debs/heat b/files/debs/heat
deleted file mode 100644
index 1ecbc780b1..0000000000
--- a/files/debs/heat
+++ /dev/null
@@ -1 +0,0 @@
-gettext # dist:trusty
diff --git a/lib/heat b/lib/heat
deleted file mode 100644
index 0863128f81..0000000000
--- a/lib/heat
+++ /dev/null
@@ -1,467 +0,0 @@
-#!/bin/bash
-#
-# lib/heat
-# Install and start **Heat** service
-
-# To enable, add the following to localrc
-#
-#   ENABLED_SERVICES+=,heat,h-api,h-api-cfn,h-api-cw,h-eng
-
-# Dependencies:
-# (none)
-
-# stack.sh
-# ---------
-# - install_heatclient
-# - install_heat
-# - configure_heatclient
-# - configure_heat
-# - _config_heat_apache_wsgi
-# - init_heat
-# - start_heat
-# - stop_heat
-# - cleanup_heat
-
-# Save trace setting
-_XTRACE_HEAT=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# set up default directories
-GITDIR["python-heatclient"]=$DEST/python-heatclient
-
-# Toggle for deploying Heat-API under HTTPD + mod_wsgi
-HEAT_USE_MOD_WSGI=${HEAT_USE_MOD_WSGI:-False}
-
-HEAT_DIR=$DEST/heat
-HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
-HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
-OCC_DIR=$DEST/os-collect-config
-ORC_DIR=$DEST/os-refresh-config
-OAC_DIR=$DEST/os-apply-config
-
-HEAT_PIP_REPO=$DATA_DIR/heat-pip-repo
-HEAT_PIP_REPO_PORT=${HEAT_PIP_REPO_PORT:-8899}
-
-HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
-HEAT_STANDALONE=$(trueorfalse False HEAT_STANDALONE)
-HEAT_ENABLE_ADOPT_ABANDON=$(trueorfalse False HEAT_ENABLE_ADOPT_ABANDON)
-HEAT_CONF_DIR=/etc/heat
-HEAT_CONF=$HEAT_CONF_DIR/heat.conf
-HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
-HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
-HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
-HEAT_API_PORT=${HEAT_API_PORT:-8004}
-HEAT_SERVICE_USER=${HEAT_SERVICE_USER:-heat}
-HEAT_TRUSTEE_USER=${HEAT_TRUSTEE_USER:-$HEAT_SERVICE_USER}
-HEAT_TRUSTEE_PASSWORD=${HEAT_TRUSTEE_PASSWORD:-$SERVICE_PASSWORD}
-HEAT_TRUSTEE_DOMAIN=${HEAT_TRUSTEE_DOMAIN:-default}
-
-# Support entry points installation of console scripts
-HEAT_BIN_DIR=$(get_python_exec_prefix)
-
-# other default options
-if [[ "$HEAT_STANDALONE" = "True" ]]; then
-    # for standalone, use defaults which require no service user
-    HEAT_STACK_DOMAIN=$(trueorfalse False HEAT_STACK_DOMAIN)
-    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-password}
-    if [[ ${HEAT_DEFERRED_AUTH} != "password" ]]; then
-        # Heat does not support keystone trusts when deployed in
-        # standalone mode
-        die $LINENO \
-            'HEAT_DEFERRED_AUTH can only be set to "password" when HEAT_STANDALONE is True.'
-    fi
-else
-    HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
-    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-}
-fi
-HEAT_PLUGIN_DIR=${HEAT_PLUGIN_DIR:-$DATA_DIR/heat/plugins}
-ENABLE_HEAT_PLUGINS=${ENABLE_HEAT_PLUGINS:-}
-
-# Functions
-# ---------
-
-# Test if any Heat services are enabled
-# is_heat_enabled
-function is_heat_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"h-" ]] && return 0
-    return 1
-}
-
-# cleanup_heat() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_heat {
-    sudo rm -rf $HEAT_AUTH_CACHE_DIR
-    sudo rm -rf $HEAT_ENV_DIR
-    sudo rm -rf $HEAT_TEMPLATES_DIR
-    sudo rm -rf $HEAT_CONF_DIR
-}
-
-# configure_heat() - Set config files, create data dirs, etc
-function configure_heat {
-
-    sudo install -d -o $STACK_USER $HEAT_CONF_DIR
-    # remove old config files
-    rm -f $HEAT_CONF_DIR/heat-*.conf
-
-    HEAT_API_CFN_HOST=${HEAT_API_CFN_HOST:-$HOST_IP}
-    HEAT_API_CFN_PORT=${HEAT_API_CFN_PORT:-8000}
-    HEAT_ENGINE_HOST=${HEAT_ENGINE_HOST:-$SERVICE_HOST}
-    HEAT_ENGINE_PORT=${HEAT_ENGINE_PORT:-8001}
-    HEAT_API_CW_HOST=${HEAT_API_CW_HOST:-$HOST_IP}
-    HEAT_API_CW_PORT=${HEAT_API_CW_PORT:-8003}
-    HEAT_API_PASTE_FILE=$HEAT_CONF_DIR/api-paste.ini
-    HEAT_POLICY_FILE=$HEAT_CONF_DIR/policy.json
-
-    cp $HEAT_DIR/etc/heat/api-paste.ini $HEAT_API_PASTE_FILE
-    cp $HEAT_DIR/etc/heat/policy.json $HEAT_POLICY_FILE
-
-    # common options
-    iniset_rpc_backend heat $HEAT_CONF
-    iniset $HEAT_CONF DEFAULT heat_metadata_server_url http://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT
-    iniset $HEAT_CONF DEFAULT heat_waitcondition_server_url http://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1/waitcondition
-    iniset $HEAT_CONF DEFAULT heat_watch_server_url http://$HEAT_API_CW_HOST:$HEAT_API_CW_PORT
-    iniset $HEAT_CONF database connection `database_connection_url heat`
-    iniset $HEAT_CONF DEFAULT auth_encryption_key $(generate_hex_string 16)
-
-    iniset $HEAT_CONF DEFAULT region_name_for_services "$REGION_NAME"
-
-    # logging
-    iniset $HEAT_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $HEAT_CONF DEFAULT use_syslog $SYSLOG
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$HEAT_USE_MOD_WSGI" == "False" ]  ; then
-        # Add color to logging output
-        setup_colorized_logging $HEAT_CONF DEFAULT tenant user
-    fi
-
-    if [ ! -z "$HEAT_DEFERRED_AUTH" ]; then
-        iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
-    fi
-
-    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        _config_heat_apache_wsgi
-    fi
-
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        iniset $HEAT_CONF paste_deploy flavor standalone
-        iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
-    else
-        configure_auth_token_middleware $HEAT_CONF heat $HEAT_AUTH_CACHE_DIR
-    fi
-
-    # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure
-    # the section for the client plugin associated with the trustee
-    if [ -z "$HEAT_DEFERRED_AUTH" -o "trusts" == "$HEAT_DEFERRED_AUTH" ]; then
-        iniset $HEAT_CONF trustee auth_type password
-        iniset $HEAT_CONF trustee auth_url $KEYSTONE_AUTH_URI
-        iniset $HEAT_CONF trustee username $HEAT_TRUSTEE_USER
-        iniset $HEAT_CONF trustee password $HEAT_TRUSTEE_PASSWORD
-        iniset $HEAT_CONF trustee user_domain_id $HEAT_TRUSTEE_DOMAIN
-    fi
-
-    # clients_keystone
-    iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
-
-    # OpenStack API
-    iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
-    iniset $HEAT_CONF heat_api workers "$API_WORKERS"
-
-    # Cloudformation API
-    iniset $HEAT_CONF heat_api_cfn bind_port $HEAT_API_CFN_PORT
-
-    # Cloudwatch API
-    iniset $HEAT_CONF heat_api_cloudwatch bind_port $HEAT_API_CW_PORT
-
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
-        iniset $HEAT_CONF clients_keystone ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
-        iniset $HEAT_CONF clients_nova ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
-        iniset $HEAT_CONF clients_cinder ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if [[ "$HEAT_ENABLE_ADOPT_ABANDON" = "True" ]]; then
-        iniset $HEAT_CONF DEFAULT enable_stack_adopt true
-        iniset $HEAT_CONF DEFAULT enable_stack_abandon true
-    fi
-
-    iniset $HEAT_CONF cache enabled "True"
-    iniset $HEAT_CONF cache backend "dogpile.cache.memory"
-
-    sudo install -d -o $STACK_USER $HEAT_ENV_DIR $HEAT_TEMPLATES_DIR
-
-    # copy the default environment
-    cp $HEAT_DIR/etc/heat/environment.d/* $HEAT_ENV_DIR/
-
-    # copy the default templates
-    cp $HEAT_DIR/etc/heat/templates/* $HEAT_TEMPLATES_DIR/
-
-    # Enable heat plugins.
-    # NOTE(nic): The symlink nonsense is necessary because when
-    # plugins are installed in "developer mode", the final component
-    # of their target directory is always "resources", which confuses
-    # Heat's plugin loader into believing that all plugins are named
-    # "resources", and therefore are all the same plugin; so it
-    # will only load one of them.  Linking them all to a common
-    # location with unique names avoids that type of collision,
-    # while still allowing the plugins to be edited in-tree.
-    local err_count=0
-
-    if [ -n "$ENABLE_HEAT_PLUGINS" ]; then
-        mkdir -p $HEAT_PLUGIN_DIR
-        # Clean up cruft from any previous runs
-        rm -f $HEAT_PLUGIN_DIR/*
-        iniset $HEAT_CONF DEFAULT plugin_dirs $HEAT_PLUGIN_DIR
-    fi
-
-    for heat_plugin in $ENABLE_HEAT_PLUGINS; do
-        if [ -d $HEAT_DIR/contrib/$heat_plugin ]; then
-            setup_package $HEAT_DIR/contrib/$heat_plugin -e
-            ln -s $HEAT_DIR/contrib/$heat_plugin/$heat_plugin/resources $HEAT_PLUGIN_DIR/$heat_plugin
-        else
-            : # clear retval on the test so that we can roll up errors
-            err $LINENO "Requested Heat plugin(${heat_plugin}) not found."
-            err_count=$(($err_count + 1))
-        fi
-    done
-    [ $err_count -eq 0 ] || die $LINENO "$err_count of the requested Heat plugins could not be installed."
-}
-
-# init_heat() - Initialize database
-function init_heat {
-
-    # (re)create heat database
-    recreate_database heat
-
-    $HEAT_BIN_DIR/heat-manage --config-file $HEAT_CONF db_sync
-    create_heat_cache_dir
-}
-
-# create_heat_cache_dir() - Part of the init_heat() process
-function create_heat_cache_dir {
-    # Create cache dirs
-    sudo install -d -o $STACK_USER $HEAT_AUTH_CACHE_DIR
-}
-
-# install_heatclient() - Collect source and prepare
-function install_heatclient {
-    if use_library_from_git "python-heatclient"; then
-        git_clone_by_name "python-heatclient"
-        setup_dev_lib "python-heatclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-heatclient"]}/tools/,/etc/bash_completion.d/}heat.bash_completion
-    fi
-}
-
-# install_heat() - Collect source and prepare
-function install_heat {
-    git_clone $HEAT_REPO $HEAT_DIR $HEAT_BRANCH
-    setup_develop $HEAT_DIR
-    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        install_apache_wsgi
-    fi
-}
-
-# install_heat_other() - Collect source and prepare
-function install_heat_other {
-    git_clone $HEAT_CFNTOOLS_REPO $HEAT_CFNTOOLS_DIR $HEAT_CFNTOOLS_BRANCH
-    git_clone $HEAT_TEMPLATES_REPO $HEAT_TEMPLATES_REPO_DIR $HEAT_TEMPLATES_BRANCH
-    git_clone $OAC_REPO $OAC_DIR $OAC_BRANCH
-    git_clone $OCC_REPO $OCC_DIR $OCC_BRANCH
-    git_clone $ORC_REPO $ORC_DIR $ORC_BRANCH
-}
-
-# start_heat() - Start running processes, including screen
-function start_heat {
-    run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
-
-    # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file
-    enabled_site_file=$(apache_site_config_for heat-api)
-    if [ -f ${enabled_site_file} ] && [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        enable_apache_site heat-api
-        enable_apache_site heat-api-cfn
-        enable_apache_site heat-api-cloudwatch
-        restart_apache_server
-        tail_log heat-api /var/log/$APACHE_NAME/heat-api.log
-        tail_log heat-api-cfn /var/log/$APACHE_NAME/heat-api-cfn.log
-        tail_log heat-api-cloudwatch /var/log/$APACHE_NAME/heat-api-cloudwatch.log
-    else
-        run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
-        run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
-        run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
-    fi
-}
-
-# stop_heat() - Stop running processes
-function stop_heat {
-    # Kill the screen windows
-    stop_process h-eng
-
-    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site heat-api
-        disable_apache_site heat-api-cfn
-        disable_apache_site heat-api-cloudwatch
-        restart_apache_server
-    else
-        local serv
-        for serv in h-api h-api-cfn h-api-cw; do
-            stop_process $serv
-        done
-    fi
-
-}
-
-# _cleanup_heat_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_heat_apache_wsgi {
-    sudo rm -f $(apache_site_config_for heat-api)
-    sudo rm -f $(apache_site_config_for heat-api-cfn)
-    sudo rm -f $(apache_site_config_for heat-api-cloudwatch)
-}
-
-# _config_heat_apache_wsgi() - Set WSGI config files of Heat
-function _config_heat_apache_wsgi {
-
-    local heat_apache_conf
-    heat_apache_conf=$(apache_site_config_for heat-api)
-    local heat_cfn_apache_conf
-    heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
-    local heat_cloudwatch_apache_conf
-    heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
-    local heat_ssl=""
-    local heat_certfile=""
-    local heat_keyfile=""
-    local heat_api_port=$HEAT_API_PORT
-    local heat_cfn_api_port=$HEAT_API_CFN_PORT
-    local heat_cw_api_port=$HEAT_API_CW_PORT
-    local venv_path=""
-
-    sudo cp $FILES/apache-heat-api.template $heat_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$heat_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
-        s|%SSLENGINE%|$heat_ssl|g;
-        s|%SSLCERTFILE%|$heat_certfile|g;
-        s|%SSLKEYFILE%|$heat_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $heat_apache_conf
-
-    sudo cp $FILES/apache-heat-api-cfn.template $heat_cfn_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$heat_cfn_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
-        s|%SSLENGINE%|$heat_ssl|g;
-        s|%SSLCERTFILE%|$heat_certfile|g;
-        s|%SSLKEYFILE%|$heat_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $heat_cfn_apache_conf
-
-    sudo cp $FILES/apache-heat-api-cloudwatch.template $heat_cloudwatch_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$heat_cw_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
-        s|%SSLENGINE%|$heat_ssl|g;
-        s|%SSLCERTFILE%|$heat_certfile|g;
-        s|%SSLKEYFILE%|$heat_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $heat_cloudwatch_apache_conf
-}
-
-
-# create_heat_accounts() - Set up common required heat accounts
-function create_heat_accounts {
-    if [[ "$HEAT_STANDALONE" != "True" ]]; then
-
-        create_service_user "heat" "admin"
-        get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-        get_or_create_endpoint \
-            "orchestration" \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
-
-        get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-        get_or_create_endpoint \
-            "cloudformation"  \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
-
-        # heat_stack_user role is for users created by Heat
-        get_or_create_role "heat_stack_user"
-    fi
-
-    if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
-        # domain -> heat and user -> heat_domain_admin
-        domain_id=$(get_or_create_domain heat 'Owns users and projects created by heat')
-        iniset $HEAT_CONF DEFAULT stack_user_domain_id ${domain_id}
-        get_or_create_user heat_domain_admin $SERVICE_PASSWORD heat
-        get_or_add_user_domain_role admin heat_domain_admin heat
-        iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
-        iniset $HEAT_CONF DEFAULT stack_domain_admin_password $SERVICE_PASSWORD
-    fi
-}
-
-# build_heat_pip_mirror() - Build a pip mirror containing heat agent projects
-function build_heat_pip_mirror {
-    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
-    local projpath proj package
-
-    rm -rf $HEAT_PIP_REPO
-    mkdir -p $HEAT_PIP_REPO
-
-    echo "<html><body>" > $HEAT_PIP_REPO/index.html
-    for projpath in $project_dirs; do
-        proj=$(basename $projpath)
-        mkdir -p $HEAT_PIP_REPO/$proj
-        pushd $projpath
-        rm -rf dist
-        python setup.py sdist
-        pushd dist
-        package=$(ls *)
-        mv $package $HEAT_PIP_REPO/$proj/$package
-        popd
-
-        echo "<html><body><a href=\"$package\">$package</a></body></html>" > $HEAT_PIP_REPO/$proj/index.html
-        echo "<a href=\"$proj\">$proj</a><br/>" >> $HEAT_PIP_REPO/index.html
-
-        popd
-    done
-
-    echo "</body></html>" >> $HEAT_PIP_REPO/index.html
-
-    local heat_pip_repo_apache_conf
-    heat_pip_repo_apache_conf=$(apache_site_config_for heat_pip_repo)
-
-    sudo cp $FILES/apache-heat-pip-repo.template $heat_pip_repo_apache_conf
-    sudo sed -e "
-        s|%HEAT_PIP_REPO%|$HEAT_PIP_REPO|g;
-        s|%HEAT_PIP_REPO_PORT%|$HEAT_PIP_REPO_PORT|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-    " -i $heat_pip_repo_apache_conf
-    enable_apache_site heat_pip_repo
-    restart_apache_server
-    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $HEAT_PIP_REPO_PORT -j ACCEPT || true
-}
-
-# Restore xtrace
-$_XTRACE_HEAT
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index 54485b60b9..aa3b1f6709 100755
--- a/stack.sh
+++ b/stack.sh
@@ -572,7 +572,6 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
@@ -800,9 +799,6 @@ fi
 if is_service_enabled neutron nova horizon; then
     install_neutronclient
 fi
-if is_service_enabled heat horizon; then
-    install_heatclient
-fi
 
 # Install shared libraries
 if is_service_enabled cinder nova; then
@@ -873,13 +869,6 @@ if is_service_enabled horizon; then
     stack_install_service horizon
 fi
 
-if is_service_enabled heat; then
-    stack_install_service heat
-    install_heat_other
-    cleanup_heat
-    configure_heat
-fi
-
 if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
     configure_CA
     init_CA
@@ -1071,10 +1060,6 @@ if is_service_enabled keystone; then
         create_swift_accounts
     fi
 
-    if is_service_enabled heat; then
-        create_heat_accounts
-    fi
-
 fi
 
 # Write a clouds.yaml file
@@ -1284,18 +1269,6 @@ if is_service_enabled cinder; then
     create_volume_types
 fi
 
-# Configure and launch Heat engine, api and metadata
-if is_service_enabled heat; then
-    # Initialize heat
-    echo_summary "Configuring Heat"
-    init_heat
-    echo_summary "Starting Heat"
-    start_heat
-    if [ "$HEAT_BUILD_PIP_MIRROR" = "True" ]; then
-        echo_summary "Building Heat pip mirror"
-        build_heat_pip_mirror
-    fi
-fi
 
 if is_service_enabled horizon; then
     echo_summary "Starting Horizon"
diff --git a/stackrc b/stackrc
index ea8b044faf..b47cd18d13 100644
--- a/stackrc
+++ b/stackrc
@@ -239,10 +239,6 @@ CINDER_BRANCH=${CINDER_BRANCH:-master}
 GLANCE_REPO=${GLANCE_REPO:-${GIT_BASE}/openstack/glance.git}
 GLANCE_BRANCH=${GLANCE_BRANCH:-master}
 
-# heat service
-HEAT_REPO=${HEAT_REPO:-${GIT_BASE}/openstack/heat.git}
-HEAT_BRANCH=${HEAT_BRANCH:-master}
-
 # django powered web control panel for openstack
 HORIZON_REPO=${HORIZON_REPO:-${GIT_BASE}/openstack/horizon.git}
 HORIZON_BRANCH=${HORIZON_BRANCH:-master}
@@ -301,10 +297,6 @@ GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
 GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
 
-# python heat client library
-GITREPO["python-heatclient"]=${HEATCLIENT_REPO:-${GIT_BASE}/openstack/python-heatclient.git}
-GITBRANCH["python-heatclient"]=${HEATCLIENT_BRANCH:-master}
-
 # ironic client
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
 GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index fb55023886..415fec506d 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -32,7 +32,7 @@ done
 ALL_LIBS="python-novaclient oslo.config pbr oslo.context"
 ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
 ALL_LIBS+=" python-glanceclient python-ironicclient"
-ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
+ALL_LIBS+=" oslo.messaging oslo.log cliff stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
diff --git a/unstack.sh b/unstack.sh
index c05d1f0952..6cd039f638 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -66,7 +66,6 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
@@ -99,10 +98,6 @@ run_phase unstack
 
 # Call service stop
 
-if is_service_enabled heat; then
-    stop_heat
-fi
-
 if is_service_enabled nova; then
     stop_nova
 fi

From c30b8def82c14e161c0242307e117697e24e1ece Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Mon, 14 Nov 2016 13:23:14 +0000
Subject: [PATCH 1613/3333] Move certificate setup earlier in deployment

Currently the x509 certificate setup is done after all the
openstack services have been deployed. This is OK because
none of the services require that the x509 certs exist
when they are being deployed. With the integration of TLS
into the nova novnc proxy (and later spice & serial proxy)
service, x509 certs will need to exist before Nova is
deployed.

The CA setup must thus be moved earlier in the devstack
deployment flow, prior to the setup of any services. One
part of the CA setup, however, fixes up the global cert
bundle locations and this can only be done after the
python requests module is install, thus must remain in
its current location.

Change-Id: Idcd264fb73bb88dc2f4280c53c013dfe4364afff
---
 lib/tls            |  1 -
 stack.sh           | 14 ++++++++------
 tools/make_cert.sh |  1 +
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/lib/tls b/lib/tls
index 40f3e81438..14cdf19d8e 100644
--- a/lib/tls
+++ b/lib/tls
@@ -201,7 +201,6 @@ subjectAltName          = \$ENV::SUBJECT_ALT_NAME
 # Create root and intermediate CAs
 # init_CA
 function init_CA {
-    fix_system_ca_bundle_path
     # Ensure CAs are built
     make_root_CA $ROOT_CA_DIR
     make_int_CA $INT_CA_DIR $ROOT_CA_DIR
diff --git a/stack.sh b/stack.sh
index 54485b60b9..f20c9d9ae3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -809,6 +809,13 @@ if is_service_enabled cinder nova; then
     install_os_brick
 fi
 
+# Setup TLS certs
+if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+    configure_CA
+    init_CA
+    init_cert
+fi
+
 # Install middleware
 install_keystonemiddleware
 
@@ -881,14 +888,9 @@ if is_service_enabled heat; then
 fi
 
 if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
-    configure_CA
-    init_CA
-    init_cert
-    # Add name to ``/etc/hosts``.
-    # Don't be naive and add to existing line!
+    fix_system_ca_bundle_path
 fi
 
-
 # Extras Install
 # --------------
 
diff --git a/tools/make_cert.sh b/tools/make_cert.sh
index 2628b40524..e91464fc0f 100755
--- a/tools/make_cert.sh
+++ b/tools/make_cert.sh
@@ -45,6 +45,7 @@ DEVSTACK_CERT=$DATA_DIR/$DEVSTACK_CERT_NAME.pem
 
 # Make sure the CA is set up
 configure_CA
+fix_system_ca_bundle_path
 init_CA
 
 # Create the server cert

From caa822fce46d0fab1163bbae4fb5d520745aef20 Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Fri, 11 Nov 2016 18:23:17 +0800
Subject: [PATCH 1614/3333] XenAPI: correct the ml2 configuration for neutron

XenAPI requires two instances of L2Agent: the standard one manages OVS
bridges in DomU and the service name is called as q-agt in Devstack;
the other new L2Agent manages OVS bridges in Dom0 and the service name
is called as q-domuA. In order to support the new agent q-domuA, it
requires some XenAPI-specific configurations. But unfortunately those
XenAPI-specific configurations were configured in the standard agent
file, meaning other changes made to the standard agent file would not
have the correct effect. So it has caused issues, for example, floating
IP addresses are not reachable.
This fix is to move the XenAPI-specific configurations from the stardard
agent configuration file to the XenAPI-specific agent configuration file
so that it won't impact the standard agent's behavior.

Change-Id: I45944e84a1f81d016aa00da6d782801ee8457ea4
---
 lib/neutron_plugins/openvswitch_agent | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e27b8a634a..0af2f2035c 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -81,19 +81,19 @@ function neutron_plugin_configure_plugin_agent {
         # integration bridge.  This is enabled by using a root wrapper
         # that executes commands on dom0 via a XenAPI plugin.
         # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
-        iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_DOM0_COMMAND"
-        iniset /$Q_PLUGIN_CONF_FILE agent root_helper_daemon ""
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_DOM0_COMMAND"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon ""
 
         # Disable minimize polling, so that it can always detect OVS and Port changes
         # This is a problem of xenserver + neutron, bug has been reported
         # https://bugs.launchpad.net/neutron/+bug/1495423
-        iniset /$Q_PLUGIN_CONF_FILE agent minimize_polling False
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent minimize_polling False
 
         # Set "physical" mapping
-        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
 
         # XEN_INTEGRATION_BRIDGE is the integration bridge in dom0
-        iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $XEN_INTEGRATION_BRIDGE
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $XEN_INTEGRATION_BRIDGE
 
         # Set up domU's L2 agent:
 
@@ -107,11 +107,11 @@ function neutron_plugin_configure_plugin_agent {
         sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
+        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
         # Set integration bridge to domU's
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $OVS_BRIDGE
+        iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $OVS_BRIDGE
         # Set root wrap
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_COMMAND"
+        iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
     fi
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
     iniset /$Q_PLUGIN_CONF_FILE ovs datapath_type $OVS_DATAPATH_TYPE

From df5e69114fa2af663c50e734b4a842c727e6a7e9 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 15 Nov 2016 15:02:23 -0800
Subject: [PATCH 1615/3333] Stop setting route pointing back to tenant router

This removes the logic to add a route pointing to the IPv4
tenant private network range since the router is performing
SNAT. If reaching the IPs via the route worked at all, it was
by accident since this behavior is certainly not guaranteed
by Neutron.

Change-Id: If45e3fc15c050cfbac11b57c1eaf137dd7ed816f
---
 lib/neutron_plugins/services/l3 | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index aa61a109fa..e9ee03f865 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -373,11 +373,6 @@ function _neutron_configure_router_v4 {
             fi
             ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            local replace_range=${SUBNETPOOL_PREFIX_V4}
-            if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
-                replace_range=${FIXED_RANGE}
-            fi
-            sudo ip route replace $replace_range via $ROUTER_GW_IP
         fi
         _neutron_set_router_id
     fi

From 4bfbc291eefd92d8b7885f36275b7ff541e067ab Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 15 Nov 2016 17:26:05 -0800
Subject: [PATCH 1616/3333] Derive IP ranges from new ADDRS_SAFE_TO_USE vars

The switch to using subnetpools caused quite a bit of confusion
because it didn't respect the value of FIXED_RANGE. This caused
conflicts in the gate with it's default IPv4 value of 10.0.0.0/8.

This patch does a few things to address the issue:
* It introduces the IPV4_ADDRS_SAFE_TO_USE and IPV6_ADDRS_SAFE_TO_USE
  values and adjusts all of the FIXED_RANGE and SUBNETPOOL_PREFIX values
  to dervive from them by default.
  * This addresses the concern that was raised about implying that
    SUBNETPOOL_PREFIX and FIXED_RANGE are equivalent when setting
    SUBNETPOOL_PREFIX=FIXED_RANGE by default. Now we have a new value
    for the operator specify a chunk of addresses that are safe to
    use for private networks without implementation implications.
  * Backwards compatibility is maintained by alloing users to override
    override all of these values.
* The default for IPV4_ADDRS_SAFE_TO_USE uses /22 instead of /24
  * Because we want to be able to use subnetpools for auto allocated
    topologies and we want to be able to have a large chunk of
    instances on each network, we needed a little more breathing room
    in the default v4 network size.
* SUBNET_POOL_SIZE_V4 default is changed from 24 to 26
  * In conjuction with this change and the one above, the default
    subnetpool will support up to 16 64-address allocations.
  * This should be enough to cover any regular gate scenarios.
  * If someone wants a bigger/smaller subnet, they can ask for that
    in the API request, change this value themselves, or use a different
    network entirely.
* FIXED_RANGE_V6 defaults to a max prefix of /64 from IPV6_ADDRS_SAFE_TO_USE
  * This avoids the private subnet in the non-subnetpool case from being
    larger than /64 to avoid issues identified in rfc 7421.
  * Users can still explicitly set this value to whatever they want.
    This 'max' behavior is only for the default.
  * This allows IPV6_ADDRS_SAFE_TO_USE to default to a /56, which leaves
    tons of room for v6 subnetpools.

Closes-Bug: #1629133
Change-Id: I7b32804d47bec743c0b13e434e6a7958728896ea
---
 doc/source/configuration.rst    | 16 ++++++++--------
 doc/source/guides/neutron.rst   | 12 ++++++------
 doc/source/networking.rst       | 21 ++++++++++++++++++++-
 lib/neutron_plugins/services/l3 | 11 +++++++----
 stackrc                         |  3 ++-
 5 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 22809ebd7a..bc3f5584b7 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -63,7 +63,7 @@ exists it will be used instead to preserve backward-compatibility.
 ::
 
     [[local|localrc]]
-    FIXED_RANGE=10.254.1.0/24
+    IPV4_ADDRS_SAFE_TO_USE=10.254.1.0/24
     ADMIN_PASSWORD=speciale
     LOGFILE=$DEST/logs/stack.sh.log
 
@@ -161,8 +161,8 @@ values that most often need to be set.
 
 -  no logging
 -  pre-set the passwords to prevent interactive prompts
--  move network ranges away from the local network (``FIXED_RANGE`` and
-   ``FLOATING_RANGE``, commented out below)
+-  move network ranges away from the local network (``IPV4_ADDRS_SAFE_TO_USE``
+   and ``FLOATING_RANGE``, commented out below)
 -  set the host IP if detection is unreliable (``HOST_IP``, commented
    out below)
 
@@ -173,7 +173,7 @@ values that most often need to be set.
     DATABASE_PASSWORD=$ADMIN_PASSWORD
     RABBIT_PASSWORD=$ADMIN_PASSWORD
     SERVICE_PASSWORD=$ADMIN_PASSWORD
-    #FIXED_RANGE=172.31.1.0/24
+    #IPV4_ADDRS_SAFE_TO_USE=172.31.1.0/24
     #FLOATING_RANGE=192.168.20.0/25
     #HOST_IP=10.3.4.5
 
@@ -537,12 +537,12 @@ behavior:
 
         IPV6_RA_MODE=slaac
         IPV6_ADDRESS_MODE=slaac
-        FIXED_RANGE_V6=fd$IPV6_GLOBAL_ID::/64
+        IPV6_ADDRS_SAFE_TO_USE=fd$IPV6_GLOBAL_ID::/56
         IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
 
-*Note*: ``FIXED_RANGE_V6`` and ``IPV6_PRIVATE_NETWORK_GATEWAY`` can be
-configured with any valid IPv6 prefix. The default values make use of
-an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
+*Note*: ``IPV6_ADDRS_SAFE_TO_USE`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
+can be configured with any valid IPv6 prefix. The default values make
+use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
 
 Service Version
 ~~~~~~~~~~~~~~~
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index bc6816c7e6..092809a1cf 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -79,7 +79,7 @@ serving as a hypervisor for guest instances.
         ## Neutron options
         Q_USE_SECGROUP=True
         FLOATING_RANGE="172.18.161.0/24"
-        FIXED_RANGE="10.0.0.0/24"
+        IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/22"
         Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"
         PUBLIC_INTERFACE=eth0
@@ -387,17 +387,17 @@ controller node.
 
         ## Neutron Networking options used to create Neutron Subnets
 
-        FIXED_RANGE="203.0.113.0/24"
+        IPV4_ADDRS_SAFE_TO_USE="203.0.113.0/24"
         NETWORK_GATEWAY=203.0.113.1
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010
         USE_SUBNETPOOL=False
 
-In this configuration we are defining FIXED_RANGE to be a
+In this configuration we are defining IPV4_ADDRS_SAFE_TO_USE to be a
 publicly routed IPv4 subnet. In this specific instance we are using
 the special TEST-NET-3 subnet defined in `RFC 5737 <http://tools.ietf.org/html/rfc5737>`_,
-which is used for documentation.  In your DevStack setup, FIXED_RANGE
+which is used for documentation.  In your DevStack setup, IPV4_ADDRS_SAFE_TO_USE
 would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the
 public internet.
@@ -524,7 +524,7 @@ setup, with small modifications for the interface mappings.
     ## Neutron options
     Q_USE_SECGROUP=True
     FLOATING_RANGE="172.18.161.0/24"
-    FIXED_RANGE="10.0.0.0/24"
+    IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/24"
     Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
     PUBLIC_NETWORK_GATEWAY="172.18.161.1"
     PUBLIC_INTERFACE=eth0
@@ -573,7 +573,7 @@ you do not require them.
     Q_AGENT=macvtap
     PHYSICAL_NETWORK=default
 
-    FIXED_RANGE="203.0.113.0/24"
+    IPV4_ADDRS_SAFE_TO_USE="203.0.113.0/24"
     NETWORK_GATEWAY=203.0.113.1
     PROVIDER_SUBNET_NAME="provider_net"
     PROVIDER_NETWORK_TYPE="vlan"
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 1d56c3367e..2301a2e931 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -15,7 +15,8 @@ If you don't specify any configuration you will get the following:
 * neutron (including l3 with openvswitch)
 * private project networks for each openstack project
 * a floating ip range of 172.24.4.0/24 with the gateway of 172.24.4.1
-* the demo project configured with fixed ips on 10.0.0.0/24
+* the demo project configured with fixed ips on a subnet allocated from
+  the 10.0.0.0/22 range
 * a ``br-ex`` interface controlled by neutron for all it's networking
   (this is not connected to any physical interfaces).
 * DNS resolution for guests based on the resolv.conf for you host
@@ -95,3 +96,21 @@ the range of floating ips that will be handed out. As we are sharing
 your existing network, you'll want to give it a slice that your local
 dhcp server is not allocating. Otherwise you could easily have
 conflicting ip addresses, and cause havoc with your local network.
+
+
+Private Network Addressing
+==========================
+
+The private networks addresses are controlled by the ``IPV4_ADDRS_SAFE_TO_USE``
+and the ``IPV6_ADDRS_SAFE_TO_USE`` variables. This allows users to specify one
+single variable of safe internal IPs to use that will be referenced whether or
+not subnetpools are in use.
+
+For IPv4, ``FIXED_RANGE`` and ``SUBNETPOOL_PREFIX_V4`` will just default to
+the value of ``IPV4_ADDRS_SAFE_TO_USE`` directly.
+
+For IPv6, ``FIXED_RANGE`` will default to the first /64 of the value of
+``IPV6_ADDRS_SAFE_TO_USE``. If ``IPV6_ADDRS_SAFE_TO_USE`` is /64 or smaller,
+``FIXED_RANGE`` will just use the value of that directly.
+``SUBNETPOOL_PREFIX_V6`` will just default to the value of
+``IPV6_ADDRS_SAFE_TO_USE`` directly.
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ddc615589f..56eb22387b 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -70,7 +70,10 @@ IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
 IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
 IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
 IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
+IPV6_ADDRS_SAFE_TO_USE=${IPV6_ADDRS_SAFE_TO_USE:-fd$IPV6_GLOBAL_ID::/56}
+# if we got larger than a /64 safe to use, we only use the first /64 to
+# avoid side effects outlined in rfc7421
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-$(echo $IPV6_ADDRS_SAFE_TO_USE | awk -F '/' '{ print ($2>63 ? $2 : 64) }')}
 IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-}
 IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
 IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
@@ -86,10 +89,10 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/16}
-SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-$IPV4_ADDRS_SAFE_TO_USE}
+SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
 
-SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
diff --git a/stackrc b/stackrc
index ea8b044faf..8210eb9ad2 100644
--- a/stackrc
+++ b/stackrc
@@ -765,7 +765,8 @@ ENABLE_DEBUG_LOG_LEVEL=$(trueorfalse True ENABLE_DEBUG_LOG_LEVEL)
 # Note that setting ``FIXED_RANGE`` may be necessary when running DevStack
 # in an OpenStack cloud that uses either of these address ranges internally.
 FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
-FIXED_RANGE=${FIXED_RANGE:-10.0.0.0/24}
+IPV4_ADDRS_SAFE_TO_USE=${IPV4_ADDRS_SAFE_TO_USE:-10.0.0.0/22}
+FIXED_RANGE=${FIXED_RANGE:-$IPV4_ADDRS_SAFE_TO_USE}
 FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
 HOST_IP_IFACE=${HOST_IP_IFACE:-}
 HOST_IP=${HOST_IP:-}

From 21d84c29b22fb69b00739ae40d69f80d5182a94e Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Fri, 11 Nov 2016 15:26:11 -0800
Subject: [PATCH 1617/3333] If plugin is enabled multiple times fail

When using the enable_plugin command and grenade jobs it can be
easy to enable the same plugin twice, as the grenade job has a
registration section and the configuration in project-config can also
enable it due to code-reuse in project-config.

If a plugin is enabled twice it will likely fail, though it won't be
obvious that it was due to the plugin being enabled multiple times.

This change makes it so if it sees the same plugin name is enabled
more than once it will die and an error message outputted.

Change-Id: I9f1d7e58b861b04473b6a57c9ad404203fb7277a
---
 functions-common | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/functions-common b/functions-common
index 87e6bb453d..eeced621a9 100644
--- a/functions-common
+++ b/functions-common
@@ -1767,6 +1767,9 @@ function enable_plugin {
     local name=$1
     local url=$2
     local branch=${3:-master}
+    if [[ ",${DEVSTACK_PLUGINS}," =~ ,${name}, ]]; then
+        die $LINENO "Plugin attempted to be enabled twice: ${name} ${url} ${branch}"
+    fi
     DEVSTACK_PLUGINS+=",$name"
     GITREPO[$name]=$url
     GITDIR[$name]=$DEST/$name

From ea1abcde180ec0f7fbcec604650f0e95db503102 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 16 Nov 2016 18:47:44 +0100
Subject: [PATCH 1618/3333] Swift: fix rsyncd.conf, ports were incorrect

Swift port base was changed in Ifd95b99004aead5ddc8ae1a8dd3ccd9c4f2abe91
but we forgot to update the rsyncd.conf. This patch update the rsyncd.conf
file.

Change-Id: Id457c047c672a810c4c0c7721b6beeb01b719879
---
 files/swift/rsyncd.conf | 48 ++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/files/swift/rsyncd.conf b/files/swift/rsyncd.conf
index c670531b31..c49f716fa7 100644
--- a/files/swift/rsyncd.conf
+++ b/files/swift/rsyncd.conf
@@ -4,76 +4,76 @@ log file = %SWIFT_DATA_DIR%/logs/rsyncd.log
 pid file = %SWIFT_DATA_DIR%/run/rsyncd.pid
 address = 127.0.0.1
 
-[account6012]
+[account6612]
 max connections = 25
 path = %SWIFT_DATA_DIR%/1/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6012.lock
+lock file = %SWIFT_DATA_DIR%/run/account6612.lock
 
-[account6022]
+[account6622]
 max connections = 25
 path = %SWIFT_DATA_DIR%/2/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6022.lock
+lock file = %SWIFT_DATA_DIR%/run/account6622.lock
 
-[account6032]
+[account6632]
 max connections = 25
 path = %SWIFT_DATA_DIR%/3/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6032.lock
+lock file = %SWIFT_DATA_DIR%/run/account6632.lock
 
-[account6042]
+[account6642]
 max connections = 25
 path = %SWIFT_DATA_DIR%/4/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6042.lock
+lock file = %SWIFT_DATA_DIR%/run/account6642.lock
 
 
-[container6011]
+[container6611]
 max connections = 25
 path = %SWIFT_DATA_DIR%/1/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6011.lock
+lock file = %SWIFT_DATA_DIR%/run/container6611.lock
 
-[container6021]
+[container6621]
 max connections = 25
 path = %SWIFT_DATA_DIR%/2/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6021.lock
+lock file = %SWIFT_DATA_DIR%/run/container6621.lock
 
-[container6031]
+[container6631]
 max connections = 25
 path = %SWIFT_DATA_DIR%/3/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6031.lock
+lock file = %SWIFT_DATA_DIR%/run/container6631.lock
 
-[container6041]
+[container6641]
 max connections = 25
 path = %SWIFT_DATA_DIR%/4/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6041.lock
+lock file = %SWIFT_DATA_DIR%/run/container6641.lock
 
 
-[object6010]
+[object6613]
 max connections = 25
 path = %SWIFT_DATA_DIR%/1/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6010.lock
+lock file = %SWIFT_DATA_DIR%/run/object6613.lock
 
-[object6020]
+[object6623]
 max connections = 25
 path = %SWIFT_DATA_DIR%/2/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6020.lock
+lock file = %SWIFT_DATA_DIR%/run/object6623.lock
 
-[object6030]
+[object6633]
 max connections = 25
 path = %SWIFT_DATA_DIR%/3/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6030.lock
+lock file = %SWIFT_DATA_DIR%/run/object6633.lock
 
-[object6040]
+[object6643]
 max connections = 25
 path = %SWIFT_DATA_DIR%/4/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6040.lock
+lock file = %SWIFT_DATA_DIR%/run/object6643.lock

From 56b39126853ff47525c89c7ba3c02422a639ddc3 Mon Sep 17 00:00:00 2001
From: "Gary W. Smith" <gary.smith@hpe.com>
Date: Wed, 16 Nov 2016 22:03:43 -0800
Subject: [PATCH 1619/3333] Use -y on zypper remove to avoid hanging

When using zypper remove, include the -y option to avoid stack.sh from
hanging waiting for user confirmation.  Due to output buffering, the
script could hang before giving the user the prompt to enter Y to
continue, making it unclear why the script was hanging.

Change-Id: I5ea761e5ae0829439953c385f8e7d0546acba886
Closes-Bug: 1642736
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 8e14b5ec7b..d5014fd80a 100644
--- a/functions-common
+++ b/functions-common
@@ -1318,7 +1318,7 @@ function uninstall_package {
     elif is_fedora; then
         sudo ${YUM:-yum} remove -y "$@" ||:
     elif is_suse; then
-        sudo zypper rm "$@" ||:
+        sudo zypper remove -y "$@" ||:
     else
         exit_distro_not_supported "uninstalling packages"
     fi

From f5069f35a176109e3e28347ce7e0418ffc57c4cb Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 8 Nov 2016 12:10:12 +0100
Subject: [PATCH 1620/3333] lib/lvm: don't use $VOLUME_GROUP variable anymore

We should be using $VOLUME_GROUP_NAME instead since Icehouse.
$VOLUME_GROUP_NAME has been introduced in
I93b8ef32832269d730c76a6dc24ddb4f20c6d9df and $VOLUME_GROUP is nowadays
only use as a fallback to $VOLUME_GROUP_NAME.

As a code comment in lib/lvm says it we kept the $VOLUME_GROUP around as
"for compatibility with icehouse-generation Grenade". Icehouse is long
gone so now seems a good time to remove any usage of $VOLUME_GROUP.

Change-Id: Id3051b5a196c45266c39fde4f08401aaacf0f6bd
---
 doc/source/configuration.rst        | 4 ++--
 doc/source/guides/multinode-lab.rst | 6 +++---
 lib/lvm                             | 6 +-----
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 22809ebd7a..391e5bec70 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -703,13 +703,13 @@ Cinder
 ~~~~~~
 
 The logical volume group used to hold the Cinder-managed volumes is
-set by ``VOLUME_GROUP``, the logical volume name prefix is set with
+set by ``VOLUME_GROUP_NAME``, the logical volume name prefix is set with
 ``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
 with ``VOLUME_BACKING_FILE_SIZE``.
 
     ::
 
-        VOLUME_GROUP="stack-volumes"
+        VOLUME_GROUP_NAME="stack-volumes"
         VOLUME_NAME_PREFIX="volume-"
         VOLUME_BACKING_FILE_SIZE=10250M
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 8751eb8d6a..81c08dc747 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -294,10 +294,10 @@ created inside OpenStack. The size can be overridden by setting
 
 ``stack-volumes`` can be pre-created on any physical volume supported by
 Linux's LVM. The name of the volume group can be changed by setting
-``VOLUME_GROUP`` in ``localrc``. ``stack.sh`` deletes all logical
-volumes in ``VOLUME_GROUP`` that begin with ``VOLUME_NAME_PREFIX`` as
+``VOLUME_GROUP_NAME`` in ``localrc``. ``stack.sh`` deletes all logical
+volumes in ``VOLUME_GROUP_NAME`` that begin with ``VOLUME_NAME_PREFIX`` as
 part of cleaning up from previous runs. It is recommended to not use the
-root volume group as ``VOLUME_GROUP``.
+root volume group as ``VOLUME_GROUP_NAME``.
 
 The details of creating the volume group depends on the server hardware
 involved but looks something like this:
diff --git a/lib/lvm b/lib/lvm
index d35a76fb5f..99c7ba9b9f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -23,11 +23,7 @@ set +o xtrace
 # Defaults
 # --------
 # Name of the lvm volume groups to use/create for iscsi volumes
-# This monkey-motion is for compatibility with icehouse-generation Grenade
-# If ``VOLUME_GROUP`` is set, use it, otherwise we'll build a VG name based
-# on ``VOLUME_GROUP_NAME`` that includes the backend name
-# Grenade doesn't use ``VOLUME_GROUP2`` so it is left out
-VOLUME_GROUP_NAME=${VOLUME_GROUP:-${VOLUME_GROUP_NAME:-stack-volumes}}
+VOLUME_GROUP_NAME=${VOLUME_GROUP_NAME:-stack-volumes}
 DEFAULT_VOLUME_GROUP_NAME=$VOLUME_GROUP_NAME-default
 
 # Backing file name is of the form $VOLUME_GROUP$BACKING_FILE_SUFFIX

From 7938d83d3bd37ef63cfea60e188918848ea87858 Mon Sep 17 00:00:00 2001
From: Michael Turek <mjturek@linux.vnet.ibm.com>
Date: Tue, 12 Apr 2016 14:55:21 -0400
Subject: [PATCH 1621/3333] Allow provider network to be used for ssh
 validation

Currently devstack assumes that the network used for ssh
validation is the private network. This patch adds a hook that
sets the network used for ssh validation based on whether or not
provider networking is being used. It also moves the function
'is_provider_network' into functions-common as it will now be
used by both tempest and neutron.

Change-Id: I265c9e26c9bfb18b7e201f27d8912b8bec235872
---
 functions-common                | 8 ++++++++
 lib/neutron_plugins/services/l3 | 7 -------
 lib/tempest                     | 7 ++++++-
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/functions-common b/functions-common
index 8e14b5ec7b..56d0a64f39 100644
--- a/functions-common
+++ b/functions-common
@@ -2260,6 +2260,14 @@ function maskip {
     echo $subnet
 }
 
+function is_provider_network {
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ]; then
+        return 0
+    fi
+    return 1
+}
+
+
 # Return the current python as "python<major>.<minor>"
 function python_version {
     local python_version
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ddc615589f..9c475e9171 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -434,13 +434,6 @@ function _neutron_configure_router_v6 {
     fi
 }
 
-function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ]; then
-        return 0
-    fi
-    return 1
-}
-
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
diff --git a/lib/tempest b/lib/tempest
index f43036e12b..5e636379d0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -414,12 +414,17 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
     iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
+    # If using provider networking, use the physical network for validation rather than private
+    TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME
+    if is_provider_network; then
+        TEMPEST_SSH_NETWORK_NAME=$PHYSICAL_NETWORK
+    fi
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
     iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
-    iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
+    iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
     # TODO(obutenko): Remove snapshot_backup when liberty-eol happens.

From 37f48f3c208de1031ef4589d15194c4079ad4a97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Tr=C4=99bski?= <tomasz.trebski@ts.fujitsu.com>
Date: Mon, 14 Nov 2016 09:10:57 +0100
Subject: [PATCH 1622/3333] Always set ALLOWED_HOSTS for horizon

If devstack is deployed in the VM with defined
public IP address (like 192.168.10.6) it is not possible to
access the Horizon from the browser.
This is because DEBUG=True means that ALLOWED_HOSTS, if not set,
is equal to ['localhost', '127.0.0.1', '[::1]'] according
to Django's documentation.

Change-Id: I74ae99569dafa10eee7066713a05fb49183e3fca
---
 lib/horizon | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..50896503a1 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,6 +97,11 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
+    # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed
+    # from outside the virtual machine. This fixes is meant primarily for local development
+    # purpose
+    _horizon_config_set $local_settings "" ALLOWED_HOSTS [\"$HOST_IP\"]
+
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi

From d038b60e65dcf6916445a03fe87a11a39c6516c8 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 4 Nov 2016 13:32:39 +0100
Subject: [PATCH 1623/3333] Neutron: use "OSC show -f value -c id" instead of
 "OSC list + grep"

We should leverage server-side filtering.

Change-Id: I3deef791868769b0b7cfc405d73dff57458ca427
---
 exercises/neutron-adv-test.sh | 2 +-
 lib/tempest                   | 3 +--
 tools/ping_neutron.sh         | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index bfd45eca5c..e8c8f62140 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -156,7 +156,7 @@ function get_role_id {
 function get_network_id {
     local NETWORK_NAME="$1"
     local NETWORK_ID
-    NETWORK_ID=`openstack network list | grep $NETWORK_NAME | awk '{print $2}'`
+    NETWORK_ID=`openstack network show -f value -c id $NETWORK_NAME`
     echo $NETWORK_ID
 }
 
diff --git a/lib/tempest b/lib/tempest
index f43036e12b..2816740180 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -242,8 +242,7 @@ function configure_tempest {
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
     if is_networking_extension_supported 'external-net'; then
-        public_network_id=$(openstack network list | grep $PUBLIC_NETWORK_NAME | \
-            awk '{print $2}')
+        public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index c75575406a..73fe3f3bdf 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -54,7 +54,7 @@ fi
 REMAINING_ARGS="${@:2}"
 
 # BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(openstack network list | grep "$NET_NAME" | awk '{print $2}')
+NET_ID=$(openstack network show -f value -c id "$NET_NAME")
 PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
 
 # This runs a command inside the specific netns

From a5afa7d81ad380eeb91f7c58dd07facb214b347b Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 18 Nov 2016 12:32:19 -0800
Subject: [PATCH 1624/3333] Fix default ipv6 fixed range var

The intent was to make any ipv6 safe addr range bigger than a /64 a /64
when setting the fixed range. Unfortunately the awk only emited the mask
and not the addr. Fix this by sprinkling the address back in.

Fixes-Bug: 1643055
Change-Id: I526d4c748fd404ecb3c77afcbb056aa95090c409
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2099757b03..6d518e25d8 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -73,7 +73,7 @@ IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
 IPV6_ADDRS_SAFE_TO_USE=${IPV6_ADDRS_SAFE_TO_USE:-fd$IPV6_GLOBAL_ID::/56}
 # if we got larger than a /64 safe to use, we only use the first /64 to
 # avoid side effects outlined in rfc7421
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-$(echo $IPV6_ADDRS_SAFE_TO_USE | awk -F '/' '{ print ($2>63 ? $2 : 64) }')}
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-$(echo $IPV6_ADDRS_SAFE_TO_USE | awk -F '/' '{ print $1"/"($2>63 ? $2 : 64) }')}
 IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-}
 IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
 IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}

From 90742fc1be7b4ad77bf3fda110d5a9bda4eb2100 Mon Sep 17 00:00:00 2001
From: Jakub Wachowski <jakub.wachowski@ts.fujitsu.com>
Date: Fri, 18 Nov 2016 14:28:47 +0100
Subject: [PATCH 1625/3333] Pass branch parameter to git clone

Without this parameter, when we set GIT_DEPTH,
it may happen that we clone only master and
then cannot checkout branch

Change-Id: I39376914f8bfc286a308c99db6bc92cddab195b5
---
 functions-common | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index d5014fd80a..458f3de363 100644
--- a/functions-common
+++ b/functions-common
@@ -534,10 +534,8 @@ function git_clone {
                 echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "Cloning not allowed in this configuration"
             fi
-            git_timed clone $git_clone_flags $git_remote $git_dest
-            cd $git_dest
-            # This checkout syntax works for both branches and tags
-            git checkout $git_ref
+            # '--branch' can also take tags
+            git_timed clone $git_clone_flags $git_remote $git_dest --branch $git_ref
         elif [[ "$RECLONE" = "True" ]]; then
             # if it does exist then simulate what clone does if asked to RECLONE
             cd $git_dest

From 82fa946d8fad036d9d5fae57f9f138c31cc210d4 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 2 Nov 2016 11:15:42 +0100
Subject: [PATCH 1626/3333] lib/tempest: use OSC to create nova flavors.

OSC is the future and it's available now.

Change-Id: Ib0dac761673a0c4f05a328ee530018e8bb269c4c
---
 lib/tempest | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index f43036e12b..928fbbdb6c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -193,11 +193,11 @@ function configure_tempest {
         available_flavors=$(nova flavor-list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
-                nova flavor-create m1.nano 42 64 0 1
+                openstack flavor create --id 42 --ram 64 --disk 0 --vcpus 1 m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
-                nova flavor-create m1.micro 84 128 0 1
+                openstack flavor create --id 84 --ram 128 --disk 0 --vcpus 1 m1.micro
             fi
             flavor_ref_alt=84
         else
@@ -398,7 +398,7 @@ function configure_tempest {
             # build a specialized heat flavor
             available_flavors=$(nova flavor-list)
             if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
-                nova flavor-create m1.heat 451 512 0 1
+                openstack flavor create --id 451 --ram 512 --disk 0 --vcpus 1 m1.heat
             fi
             iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi

From 541617b15ef678cd5daf05d19ceea84ec1c8ebf9 Mon Sep 17 00:00:00 2001
From: Hidekazu Nakamura <hid-nakamura@vf.jp.nec.com>
Date: Wed, 9 Nov 2016 15:27:19 +0900
Subject: [PATCH 1627/3333] Improve Live Migration section in multinode-lab.rst

Added root user login check to ensure SSH keys exchanged.


Change-Id: I8513bc883ac273af8dcc2f61562a838d33b45a82
---
 doc/source/guides/multinode-lab.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 8751eb8d6a..a98c2700a5 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -400,6 +400,10 @@ SSH keys need to be exchanged between each compute node:
 
         ssh-keyscan -H DEST_HOSTNAME | sudo tee -a /root/.ssh/known_hosts
 
+3. Verify that login via ssh works without a password::
+
+        ssh -i /root/.ssh/id_rsa.pub stack@DESTINATION
+
 In essence, this means that every compute node's root user's public RSA key
 must exist in every other compute node's stack user's authorized_keys file and
 every compute node's public ECDSA key needs to be in every other compute

From a5b72b053efec9af8a57c59b35f96142e4f38433 Mon Sep 17 00:00:00 2001
From: Kaitlin Farr <kaitlin.farr@jhuapl.edu>
Date: Tue, 26 Jan 2016 22:46:13 -0500
Subject: [PATCH 1628/3333] Set fixed-key key manager

With the key manager refactoring in nova and cinder, the key manager
class will need to be explicitly set.

Nova key manager refactoring: Ib563b0ea4b8b4bc1833bf52bf49a68546c384996
Cinder key manager refactoring: Ief8885bb4ca8d62b03cf1a52c25dd0e62c835bfe

Change-Id: I733279864ee1a4aaffc9c8eed81b5e12f8d8821b
Implements: blueprint use-castellan-key-manager
---
 lib/cinder | 2 ++
 lib/nova   | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index c4a49cd992..c7ce0f5aa3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -283,6 +283,8 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
+    iniset $CINDER_CONF key_manager api_class cinder.keymgr.conf_key_mgr.ConfKeyManager
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index ca9a6c7f50..d3e8ce85af 100644
--- a/lib/nova
+++ b/lib/nova
@@ -475,6 +475,8 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
+    iniset $NOVA_CONF key_manager api_class nova.keymgr.conf_key_mgr.ConfKeyManager
+
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to
         # install things in /usr/bin

From 2ccd1203423ea29cc7b8c462aa17e18981d32d60 Mon Sep 17 00:00:00 2001
From: David Lyle <dklyle0@gmail.com>
Date: Mon, 21 Nov 2016 22:16:17 +0000
Subject: [PATCH 1629/3333] Revert "Always set ALLOWED_HOSTS for horizon"

This reverts commit 37f48f3c208de1031ef4589d15194c4079ad4a97.

Change-Id: I8c853c35c5b0b61925c27b461ad625266381f73b
---
 lib/horizon | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 50896503a1..78cbe8b58d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,11 +97,6 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
-    # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed
-    # from outside the virtual machine. This fixes is meant primarily for local development
-    # purpose
-    _horizon_config_set $local_settings "" ALLOWED_HOSTS [\"$HOST_IP\"]
-
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi

From b6cbf922d79d7189dab7d68dc6014fa8682aad9d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 21 Nov 2016 21:10:49 -0500
Subject: [PATCH 1630/3333] Change CINDER_LVM_TYPE back to 'default' as the
 default

Change dddb2c7b5f85688de9c9b92f025df25d2f2d3016 recently
changed devstack to enable the Cinder image cache by default
and changed to use thinly provisioned LVM volumes by default.

Since then we've had a spike in thin LVM snapshot test failures
in the gate, which is by far our top gate bug at 219 hits in the
last 10 days.

So unless there is a fix on the Cinder side, this changes the
default lvm_type back to 'default' for thick provisioning.

Change-Id: I1c53bbe40177fe104ed0a222124bbc45c553b817
Related-Bug: #1642111
---
 lib/cinder | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index c4a49cd992..9ff74e80be 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -68,8 +68,12 @@ CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
-# Defaults to thin. For thick provisioning change to 'default'
-CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-thin}
+# Defaults to default, which is thick, the other valid choice
+# is thin, which as the name implies utilizes lvm thin provisioning.
+# Thinly provisioned LVM volumes may be more efficient when using the Cinder
+# image cache, but there are also known race failures with volume snapshots
+# and thinly provisioned LVM volumes, see bug 1642111 for details.
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend

From 7f95baa5706980a0910741693abee73abea98b89 Mon Sep 17 00:00:00 2001
From: John Schwarz <jschwarz@redhat.com>
Date: Mon, 21 Nov 2016 15:52:36 +0200
Subject: [PATCH 1631/3333] Fix devstack with linuxbridge without l3 agent

The linuxbridge agent for Neutron expects that the public bridge will
already be created by the time it starts. On devstack, this only occurs
as part of the l3 agent configuration. If a compute node doesn't have an
l3 agent and is using a linuxbridge agent, then br-ex won't be created
and the process will not be able to start (causing stack.sh to fail).

This causes the gate-grenade-dsvm-neutron-linuxbridge-multinode-nv gate
to fail.

Closes-Bug: #1643562
Change-Id: I6f441c6febb5070ad885569d9c798634d0272b6c
---
 lib/neutron_plugins/linuxbridge_agent | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index d0de2f5e5d..194981ee40 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,7 +62,9 @@ function neutron_plugin_configure_plugin_agent {
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
     if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        if is_service_enabled neutron-l3; then
+            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        fi
     fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS

From 471855ecd1b36c744162ec7c6c52768e1a1073e2 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 23 Nov 2016 12:24:52 +0100
Subject: [PATCH 1632/3333] Add Fedora 25 support

Fedora 25 released,
adding the required knobs.

Change-Id: I8ce86aa9f23e9572d69eadcfc81af2e96d5be64f
---
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 stack.sh           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index d0ceb56621..77d2fa5f0a 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,9 +7,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f23,f24
+iptables-services  # NOPRIME f23,f24,f25
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f23,f24
+java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index a883ec4399..45f1c94f1f 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f23,f24
+kernel-modules # dist:f23,f24,f25
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index bd249ee71b..2f12df0e3b 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f23,f24
+rsync-daemon # dist:f23,f24,f25
 sqlite
 xfsprogs
 xinetd
diff --git a/stack.sh b/stack.sh
index f20c9d9ae3..d5dbfb275c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|f25|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From bcaadd63d8739b528f0121775d6612aebd333a4f Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 23 Nov 2016 12:43:02 +0100
Subject: [PATCH 1633/3333] Apache reload issue when it is stopped

Since 4b49e409f853104dae021dfca1a9342ec9ac4709 devstack
started to use reload instead of restart.

Using reload in devstack for a fresh install,
does not makes too much sense unless multiple service
plugin touches the same service configs.

Systemd rejects to reload something,
which was not loaded before.

 $ sudo /bin/systemctl reload httpd
 httpd.service is not active, cannot reload.

We will switch to `reload-or-restart` action instead of `reload`,
it is more likely the action what the previous patch wanted.

Change-Id: I70d597fbe4a8923d937ba8432e29edefb27d1058
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index d5014fd80a..951010fdad 100644
--- a/functions-common
+++ b/functions-common
@@ -2310,11 +2310,12 @@ function stop_service {
     fi
 }
 
-# Service wrapper to stop services
+# Service wrapper to reload services
+# If the service was not in running state it will start it
 # reload_service service-name
 function reload_service {
     if [ -x /bin/systemctl ]; then
-        sudo /bin/systemctl reload $1
+        sudo /bin/systemctl reload-or-restart $1
     else
         sudo service $1 reload
     fi

From 203716646472135e81bc7e8984bb200d87c0bf1c Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 23 Nov 2016 15:51:10 +0100
Subject: [PATCH 1634/3333] stackrc: update code comment now that Neutron is
 enabled by default

No need to explain how to enable Neutron now that it's enabled by
default. Keep but reformat the 'how to enable swift' part though.

Change-Id: I3f9b7796fad10abf1039e4c68eb2cd5ef6cdbc99
---
 stackrc | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/stackrc b/stackrc
index 31f07594ad..b5018dea0f 100644
--- a/stackrc
+++ b/stackrc
@@ -44,20 +44,10 @@ KEYSTONE_REGION_NAME=${KEYSTONE_REGION_NAME:-$REGION_NAME}
 # Specify which services to launch.  These generally correspond to
 # screen tabs. To change the default list, use the ``enable_service`` and
 # ``disable_service`` functions in ``local.conf``.
-# For example, to enable Swift add this to ``local.conf``:
-#  enable_service s-proxy s-object s-container s-account
-# In order to enable Neutron (a single node setup) add the following
+# For example, to enable Swift as part of DevStack add the following
 # settings in ``local.conf``:
 #  [[local|localrc]]
-#  disable_service n-net
-#  enable_service q-svc
-#  enable_service q-agt
-#  enable_service q-dhcp
-#  enable_service q-l3
-#  enable_service q-meta
-#  # Optional, to enable tempest configuration as part of DevStack
-#  enable_service tempest
-
+#  enable_service s-proxy s-object s-container s-account
 # This allows us to pass ``ENABLED_SERVICES``
 if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone

From 5c4691af3e9cf9d0fe9a2afa2bbe1fc73796610d Mon Sep 17 00:00:00 2001
From: Dan Kolb <openstack@dankolb.net>
Date: Wed, 16 Nov 2016 13:47:49 -0600
Subject: [PATCH 1635/3333] remove listen directive bound to only ipv4

Using devstack on a  RHEL based system results in
"Listen 0.0.0.0:80" being added to the
/etc/httpd/conf/httpd.conf.
This configures Apache to only listen to port 80 on an IPv4 interface.
This makes it not possible to access Horizon via IPv6 without
re-configuring and restarting httpd.

Removing this sed leaves the default "Listen 80" from the rpm package,
 which binds to all interfaces and will allow connection to Horizon
via IPv6.

Change-Id: I9fe8cbebff0ca6a30ceeaae0f7e035c9bb828d44
---
 lib/horizon | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..3271e2a654 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -121,9 +121,7 @@ function configure_horizon {
     if is_ubuntu; then
         disable_apache_site 000-default
         sudo touch $horizon_conf
-    elif is_fedora; then
-        sudo sed '/^Listen/s/^.*$/Listen 0.0.0.0:80/' -i /etc/httpd/conf/httpd.conf
-    elif is_suse; then
+    elif is_fedora || is_suse; then
         : # nothing to do
     else
         exit_distro_not_supported "horizon apache configuration"

From 868a6631721219bac4042eca88e290c278589e26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Tr=C4=99bski?= <tomasz.trebski@ts.fujitsu.com>
Date: Mon, 14 Nov 2016 09:10:57 +0100
Subject: [PATCH 1636/3333] Always set ALLOWED_HOSTS=['*'] for horizon

If devstack is deployed in the VM with defined
public IP address (like 192.168.10.6) it is not possible to
access the Horizon from the browser.
This is because DEBUG=True means that ALLOWED_HOSTS, if not set,
is equal to ['localhost', '127.0.0.1', '[::1]'] according
to Django's documentation.

Change-Id: I0ab2b57e459dbfa3b01b3e9388bbcefac076a142
Co-Authored-By: David Lyle <dklyle0@gmail.com>
Closes-Bug: #1643050
---
 lib/horizon | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..f5e9c7e0a7 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,6 +97,11 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
+    # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed
+    # from outside the virtual machine. This fixes is meant primarily for local development
+    # purpose
+    _horizon_config_set $local_settings "" ALLOWED_HOSTS [\"*\"]
+
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi

From 0dab8d63b3e5431bd5edb562f466296478285251 Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Mon, 21 Nov 2016 20:36:31 +0000
Subject: [PATCH 1637/3333] (doc) Fixed references to FIXED_RANGE_V6

In the 'Private Network Addressing' section of the doc,
there are references to FIXED_RANGE when referring to V6
networks.  These have been changed to FIXED_RANGE_V6.

Also fixed a few typos and grammatical errors when
giving the doc a quick read-through looking for more
references to FIXED_RANGE.

Change-Id: Iaa530c476ce2b36a3f616945ddd2e24fa599a16c
---
 doc/source/networking.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 2301a2e931..bdbeaaa7a8 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -4,7 +4,7 @@
 
 An important part of the DevStack experience is networking that works
 by default for created guests. This might not be optimal for your
-particular testing environment, so this document tries it's best to
+particular testing environment, so this document tries its best to
 explain what's going on.
 
 Defaults
@@ -17,9 +17,9 @@ If you don't specify any configuration you will get the following:
 * a floating ip range of 172.24.4.0/24 with the gateway of 172.24.4.1
 * the demo project configured with fixed ips on a subnet allocated from
   the 10.0.0.0/22 range
-* a ``br-ex`` interface controlled by neutron for all it's networking
+* a ``br-ex`` interface controlled by neutron for all its networking
   (this is not connected to any physical interfaces).
-* DNS resolution for guests based on the resolv.conf for you host
+* DNS resolution for guests based on the resolv.conf for your host
 * an ip masq rule that allows created guests to route out
 
 This creates an environment which is isolated to the single
@@ -40,7 +40,7 @@ updates. Tempest tests will work in this environment.
 Locally Accessible Guests
 =========================
 
-If you want to make you guests accessible other machines on your
+If you want to make you guests accessible from other machines on your
 network, we have to connect ``br-ex`` to a physical interface.
 
 Dedicated Guest Interface
@@ -109,8 +109,8 @@ not subnetpools are in use.
 For IPv4, ``FIXED_RANGE`` and ``SUBNETPOOL_PREFIX_V4`` will just default to
 the value of ``IPV4_ADDRS_SAFE_TO_USE`` directly.
 
-For IPv6, ``FIXED_RANGE`` will default to the first /64 of the value of
+For IPv6, ``FIXED_RANGE_V6`` will default to the first /64 of the value of
 ``IPV6_ADDRS_SAFE_TO_USE``. If ``IPV6_ADDRS_SAFE_TO_USE`` is /64 or smaller,
-``FIXED_RANGE`` will just use the value of that directly.
+``FIXED_RANGE_V6`` will just use the value of that directly.
 ``SUBNETPOOL_PREFIX_V6`` will just default to the value of
 ``IPV6_ADDRS_SAFE_TO_USE`` directly.

From f0252a9d8147cfbeaedbae4d6c2a8be0e97e72b0 Mon Sep 17 00:00:00 2001
From: Rob Cresswell <robert.cresswell@outlook.com>
Date: Fri, 25 Nov 2016 11:29:31 +0000
Subject: [PATCH 1638/3333] Remove Horizon setup scripts usage of run_tests.sh

Horizon is removing run_tests in favour of tox during Ocata, as part of
https://blueprints.launchpad.net/horizon/+spec/enhance-tox. To complete
this move, we need to remove any reliance on run_tests.

Change-Id: Ia8ad073aee68d1660d3bb5a68ec07516d8ce0665
---
 lib/horizon | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..08d6259526 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -81,7 +81,7 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    (cd $HORIZON_DIR; ./run_tests.sh -N --compilemessages)
+    (cd $HORIZON_DIR; python manage.py compilemessages)
 
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py

From 02f3f9a6bbb6c4af989ad6cf504d5c49d7c9b4e2 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Sat, 26 Nov 2016 00:43:07 +0900
Subject: [PATCH 1639/3333] meta-config: Fix consecutive same sections

The current coding fails to process local.conf like
the following.  Note: This example is taken from a
real use case. [1]

    [[post-config|$NEUTRON_CONF]]
    [qos]
    notification_drivers = midonet
    [[post-config|$NEUTRON_CONF]]

    [quotas]
    # x10 of default quotas (at the time of writing)
    quota_network=100
    quota_subnet=100
    quota_port=500
    quota_router=100
    quota_floatingip=500
    quota_security_group=100
    quota_security_group_rule=1000

[1] https://review.openstack.org/#/c/400627/

Closes-Bug: #1583214
Change-Id: Ie571b5fa5a33d9ed09f30ba7c7724b958ce17616
---
 inc/meta-config           | 10 ++++------
 tests/test_meta_config.sh | 29 ++++++++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index 6eb7a00f69..6252135747 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -40,12 +40,10 @@ function get_meta_section {
     $CONFIG_AWK_CMD -v matchgroup=$matchgroup -v configfile=$configfile '
         BEGIN { group = "" }
         /^\[\[.+\|.*\]\]/ {
-            if (group == "") {
-                gsub("[][]", "", $1);
-                split($1, a, "|");
-                if (a[1] == matchgroup && a[2] == configfile) {
-                    group=a[1]
-                }
+            gsub("[][]", "", $1);
+            split($1, a, "|");
+            if (a[1] == matchgroup && a[2] == configfile) {
+                group=a[1]
             } else {
                 group=""
             }
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 327fb56185..92f9c01f69 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -125,6 +125,14 @@ foo=bar
 [[test10|does-not-exist-dir/test.conf]]
 foo=bar
 
+[[test11|test-same.conf]]
+[DEFAULT]
+foo=bar
+
+[[test11|test-same.conf]]
+[some]
+random=config
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -147,6 +155,9 @@ cfg_item1 = abcd
 cfg_item2 = efgh
 cfg_item2 = \${FOO_BAR_BAZ}
 
+[[test11|test-same.conf]]
+[another]
+non = sense
 EOF
 
 echo -n "get_meta_section_files: test0 doesn't exist: "
@@ -385,8 +396,24 @@ EXPECT_VAL=255
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
+echo -n "merge_config_file test11 same section: "
+rm -f test-same.conf
+merge_config_group test.conf test11
+VAL=$(cat test-same.conf)
+EXPECT_VAL='
+[DEFAULT]
+foo = bar
+
+[some]
+random = config
+
+[another]
+non = sense'
+check_result "$VAL" "$EXPECT_VAL"
+
+
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \
-    test-multi-sections.conf
+    test-multi-sections.conf test-same.conf
 rm -rf test-etc

From d9ec42028df9ad12aa7760e21c664d6927790d9e Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 16:14:52 +0900
Subject: [PATCH 1640/3333] lib/neutron: Add a utility method to add service
 plugin

Partial-Bug: #1604664
Change-Id: I6d49ac188f7f1cfc8da314a26c9c5fc4b6d65bf4
---
 lib/neutron | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 1bb14f21b2..d30e18562f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -200,7 +200,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-l3; then
         cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
         iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
-        iniset $NEUTRON_CONF DEFAULT service_plugins router
+        neutron_service_plugin_class_add router
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
@@ -249,14 +249,8 @@ function configure_neutron_new {
         source $TOP_DIR/lib/neutron_plugins/services/metering
         neutron_agent_metering_configure_common
         neutron_agent_metering_configure_agent
-        # TODO(sc68cal) hack because we don't pass around
-        # $Q_SERVICE_PLUGIN_CLASSES like -legacy does
-        local plugins=""
-        plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
-        plugins+=",metering"
-        iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
+        neutron_service_plugin_class_add metering
     fi
-
 }
 
 # configure_neutron_rootwrap() - configure Neutron's rootwrap
@@ -496,6 +490,16 @@ function _set_config_files {
 
 }
 
+# neutron_service_plugin_class_add() - add service plugin class
+function neutron_service_plugin_class_add_new {
+    local service_plugin_class=$1
+    local plugins=""
+
+    plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
+    plugins+=",${service_plugin_class}"
+    iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
+}
+
 # Dispatch functions
 # These are needed for compatibility between the old and new implementations
 # where there are function name overlaps.  These will be removed when
@@ -555,6 +559,15 @@ function install_neutron {
     fi
 }
 
+function neutron_service_plugin_class_add {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        _neutron_service_plugin_class_add "$@"
+    else
+        neutron_service_plugin_class_add_new "$@"
+    fi
+}
+
 function start_neutron {
     if is_neutron_legacy_enabled; then
         # Call back to old function

From 89a855f784644f2c4d88331a0d29f85e5fcd741c Mon Sep 17 00:00:00 2001
From: Sharat Sharma <sharat.sharma@nectechnologies.in>
Date: Mon, 3 Oct 2016 12:10:23 +0530
Subject: [PATCH 1641/3333] Changed the order of steps in the devstack install
 document

The order of the steps were a bit confusing for the first timers
in the devstack document. So, changed the order of installation
steps to make it clear.

Change-Id: Ifaa051887dab95719b9ca5d1b2fbe2f5f549d269
Closes-Bug: #1627939
---
 doc/source/index.rst | 43 ++++++++++++++++++++++++++-----------------
 1 file changed, 26 insertions(+), 17 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 435011bb96..b8dd506aab 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -45,12 +45,34 @@ as well as Debian and OpenSUSE.
 If you do not have a preference, Ubuntu 16.04 is the most tested, and
 will probably go the smoothest.
 
+Add Stack User
+--------------
+
+Devstack should be run as a non-root user with sudo enabled
+(standard logins to cloud images such as "ubuntu" or "cloud-user"
+are usually fine).
+
+You can quickly create a separate `stack` user to run DevStack with
+
+::
+
+   $ adduser stack
+
+Since this user will be making many changes to your system, it should
+have sudo privileges:
+
+::
+
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    $ su stack
+
 Download DevStack
 -----------------
 
 ::
 
-   git clone https://git.openstack.org/openstack-dev/devstack
+   $ git clone https://git.openstack.org/openstack-dev/devstack
+   $ cd devstack
 
 The ``devstack`` repo contains a script that installs OpenStack and
 templates for configuration files
@@ -58,8 +80,8 @@ templates for configuration files
 Create a local.conf
 -------------------
 
-Create a ``local.conf`` file with 4 passwords preset
-
+Create a ``local.conf`` file with 4 passwords preset at the root of the
+devstack git repo.
 ::
 
    [[local|localrc]]
@@ -70,25 +92,12 @@ Create a ``local.conf`` file with 4 passwords preset
 
 This is the minimum required config to get started with DevStack.
 
-Add Stack User
---------------
-
-Devstack should be run as a non-root user with sudo enabled
-(standard logins to cloud images such as "ubuntu" or "cloud-user"
-are usually fine).
-
-You can quickly create a separate `stack` user to run DevStack with
-
-::
-
-   devstack/tools/create-stack-user.sh; su stack
-
 Start the install
 -----------------
 
 ::
 
-   cd devstack; ./stack.sh
+   ./stack.sh
 
 This will take a 15 - 20 minutes, largely depending on the speed of
 your internet connection. Many git trees and packages will be

From 2a5981402ff26973c77ccf534164e4318dd8897a Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Tue, 29 Nov 2016 03:48:34 -0800
Subject: [PATCH 1642/3333] Provide configuration file to ovs-cleanup utility

There may be cases when the configuration of the OVS is different
from the default one. This enables one to make use of the neutron
configuration file to contain all of the OVS settings.

Change-Id: I728cf8cdc653667c076b07b39c13c1278281c01b
Closes-bug: #1645691
---
 lib/neutron_plugins/ovs_base | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index baf7d7f34b..10043252d6 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -30,7 +30,7 @@ function _neutron_ovs_base_add_bridge {
 
 function _neutron_ovs_base_setup_bridge {
     local bridge=$1
-    neutron-ovs-cleanup
+    neutron-ovs-cleanup --config-file $NEUTRON_CONF
     _neutron_ovs_base_add_bridge $bridge
     sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
 }
@@ -97,7 +97,7 @@ function _neutron_ovs_base_configure_l3_agent {
         iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
     fi
 
-    neutron-ovs-cleanup
+    neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||
         sudo ip link add $Q_PUBLIC_VETH_INT type veth \

From cfb9f057ea5896687d95cdcc5aa5216ef32b87f8 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 29 Nov 2016 10:43:05 -0800
Subject: [PATCH 1643/3333] Tune apache connections for tls proxy

We are seeing connection errors to the proxy occasionally. These errors
do not result in a logged http request or error to the backends,
resulting in a theory that the proxy itself may just not be able to
handle the number of connections. More than double the total number of
connections that will be accepted by the proxy in an attempt to fix
this.

Change-Id: Iefa6c43451dd1f95927528d2ce0003c84248847f
Related-bug: 1630664
---
 lib/apache |  5 +++++
 lib/tls    | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/lib/apache b/lib/apache
index 8a38cc45e5..2dc626f130 100644
--- a/lib/apache
+++ b/lib/apache
@@ -29,15 +29,20 @@ APACHE_GROUP=${APACHE_GROUP:-$(id -gn $APACHE_USER)}
 
 
 # Set up apache name and configuration directory
+# Note that APACHE_CONF_DIR is really more accurately apache's vhost
+# configuration dir but we can't just change this because public interfaces.
 if is_ubuntu; then
     APACHE_NAME=apache2
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/sites-available}
+    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf-enabled}
 elif is_fedora; then
     APACHE_NAME=httpd
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/conf.d}
+    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
 elif is_suse; then
     APACHE_NAME=apache2
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/vhosts.d}
+    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
 fi
 APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 
diff --git a/lib/tls b/lib/tls
index 14cdf19d8e..57b5e525ac 100644
--- a/lib/tls
+++ b/lib/tls
@@ -442,6 +442,52 @@ function enable_mod_ssl {
 # Proxy Functions
 # ===============
 
+function tune_apache_connections {
+    local tuning_file=$APACHE_SETTINGS_DIR/connection-tuning.conf
+    if ! [ -f $tuning_file ] ; then
+        sudo bash -c "cat > $tuning_file" << EOF
+# worker MPM
+# StartServers: initial number of server processes to start
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
+#              graceful restart. ThreadLimit can only be changed by stopping
+#              and starting Apache.
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxClients: maximum number of simultaneous client connections
+# MaxRequestsPerChild: maximum number of requests a server process serves
+#
+# The apache defaults are too conservative if we want reliable tempest
+# testing. Bump these values up from ~400 max clients to 1024 max clients.
+<IfModule mpm_worker_module>
+# Note that the next three conf values must be changed together.
+# MaxClients = ServerLimit * ThreadsPerChild
+ServerLimit          32
+ThreadsPerChild      32
+MaxClients         1024
+StartServers          3
+MinSpareThreads      96
+MaxSpareThreads     192
+ThreadLimit          64
+MaxRequestsPerChild   0
+</IfModule>
+<IfModule mpm_event_module>
+# Note that the next three conf values must be changed together.
+# MaxClients = ServerLimit * ThreadsPerChild
+ServerLimit          32
+ThreadsPerChild      32
+MaxClients         1024
+StartServers          3
+MinSpareThreads      96
+MaxSpareThreads     192
+ThreadLimit          64
+MaxRequestsPerChild   0
+</IfModule>
+EOF
+        restart_apache_server
+    fi
+}
+
 # Starts the TLS proxy for the given IP/ports
 # start_tls_proxy front-host front-port back-host back-port
 function start_tls_proxy {
@@ -451,6 +497,8 @@ function start_tls_proxy {
     local b_host=$4
     local b_port=$5
 
+    tune_apache_connections
+
     local config_file
     config_file=$(apache_site_config_for $b_service)
     local listen_string

From 6653d74fc4cbff1b06888fe53a0712117e2394dc Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Tue, 29 Nov 2016 23:30:18 +0000
Subject: [PATCH 1644/3333] Revert "Fix devstack with linuxbridge without l3
 agent"

I am seeing red all over the linuxbridge gate.

This reverts commit 7f95baa5706980a0910741693abee73abea98b89.

Change-Id: I179f761f991db4b63c0e3445a9a13e43ffe68992
---
 lib/neutron_plugins/linuxbridge_agent | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 194981ee40..d0de2f5e5d 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,9 +62,7 @@ function neutron_plugin_configure_plugin_agent {
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
     if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        if is_service_enabled neutron-l3; then
-            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
-        fi
+        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
     fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS

From 2864150940bfb003e86bf103cb18b32bdb4a080b Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 20 Sep 2016 06:49:50 +0000
Subject: [PATCH 1645/3333] Make neutron ml2 use ovs native interface

Neutron has changed to use ovs native interface by default, but when
the hypervisor is XenServer, we cannot use ovs native interface without
extra configurations in neutron-openvswitch-agent(q-agt) in compute
node.

This patch is to add the needed configurations automatically during
deployment, so user needn't to do it manually and restart q-agt.

Change-Id: Ibc69d3cdb4d75833f2ac16840c62bcacf460dd4f
---
 lib/neutron_plugins/openvswitch_agent | 5 +++++
 lib/nova_plugins/hypervisor-xenserver | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e27b8a634a..8860d7b0f2 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -95,6 +95,11 @@ function neutron_plugin_configure_plugin_agent {
         # XEN_INTEGRATION_BRIDGE is the integration bridge in dom0
         iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $XEN_INTEGRATION_BRIDGE
 
+        # Set OVS native interface for ovs-agent in compute node
+        XEN_DOM0_IP=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3)
+        iniset /$Q_PLUGIN_CONF_FILE ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
+        iniset /$Q_PLUGIN_CONF_FILE ovs of_listen_address $HOST_IP
+
         # Set up domU's L2 agent:
 
         # Create a bridge "br-$VLAN_INTERFACE"
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index a63e72e764..b053856348 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -93,6 +93,15 @@ CRONTAB
     if is_service_enabled neutron; then
         # Remove restriction on linux bridge in Dom0 when neutron is enabled
         $ssh_dom0 "rm -f /etc/modprobe.d/blacklist-bridge*"
+
+        count=`$ssh_dom0 "iptables -t filter -L XenServerDevstack |wc -l"`
+        if [ "$count" = "0" ]; then
+        {
+            echo "iptables -t filter --new XenServerDevstack"
+            echo "iptables -t filter -I INPUT -j XenServerDevstack"
+            echo "iptables -t filter -I XenServerDevstack -p tcp --dport 6640 -j ACCEPT"
+        } | $ssh_dom0
+        fi
     fi
 }
 

From 50bf4fc0758df3dfb0bf9fa6e5f56ecebd1200e4 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 30 Nov 2016 14:27:36 -0500
Subject: [PATCH 1646/3333] lib/neutron-legacy - Use stevedore alias for ML2
 plugin

Similar to 30ab23cd9b103470a7d89c4c88bccba789884c36, fix the
plugin name to avoid warnings like:

WARNING stevedore.named [-] Could not load neutron.plugins.ml2.plugin.Ml2Plugin

Change-Id: Ibb45f1305816b255ba2419ba662d9e29eff68f58
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e429714f06..eed0fc2da4 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -63,7 +63,7 @@ function populate_ml2_config {
 function neutron_plugin_configure_common {
     Q_PLUGIN_CONF_PATH=etc/neutron/plugins/ml2
     Q_PLUGIN_CONF_FILENAME=ml2_conf.ini
-    Q_PLUGIN_CLASS="neutron.plugins.ml2.plugin.Ml2Plugin"
+    Q_PLUGIN_CLASS="ml2"
     # The ML2 plugin delegates L3 routing/NAT functionality to
     # the L3 service plugin which must therefore be specified.
     _neutron_service_plugin_class_add $ML2_L3_PLUGIN

From df875c5f16980228e2443c50298f35063f2b54ae Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Wed, 30 Nov 2016 19:47:24 -0800
Subject: [PATCH 1647/3333] Reconfig ml2 ovs configuration for neutron on
 XenServer

XenServer already support OVS native mode and I have a patch for
configuring it https://review.openstack.org/#/c/372952/ which
is fine. But we have another patch which revert the usage of
ml2_confi.ini and ml2_conf.ini.domU
https://review.openstack.org/#/c/396573/. Both patches work well
separately. But the two should have some dependent relationship.
Once one merged, the other should change accordingly. Sorry that
we missed the dependency.
This patch is to fix the ovs config based on reverted ml2_conf.ini
and ml2_conf.ini.domU to make sure we configure the correct IP for
ovs agent

Change-Id: Ib53e37e210cc849f161dd6630f81e5b2331a91d5
---
 lib/neutron_plugins/openvswitch_agent | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index f009966a01..76a1a4f3a1 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -97,8 +97,8 @@ function neutron_plugin_configure_plugin_agent {
 
         # Set OVS native interface for ovs-agent in compute node
         XEN_DOM0_IP=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3)
-        iniset /$Q_PLUGIN_CONF_FILE ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
-        iniset /$Q_PLUGIN_CONF_FILE ovs of_listen_address $HOST_IP
+        iniset /$Q_PLUGIN_CONF_FILE.domU ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
+        iniset /$Q_PLUGIN_CONF_FILE.domU ovs of_listen_address $HOST_IP
 
         # Set up domU's L2 agent:
 

From 1d83a08a385ad079c546d8a0ac9558dc72eaa9fd Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 30 Nov 2016 14:22:24 -0500
Subject: [PATCH 1648/3333] lib/neutron: Remove type_driver configuration

Instead, rely on what Neutron ships by default.

Change-Id: I8bdc646d24b3edf10f421e4472a790caeb8e4887
---
 lib/neutron | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index d30e18562f..4915dcce31 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -159,7 +159,6 @@ function configure_neutron_new {
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 type_drivers vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then

From 50ce0a8032bf315df20c594df1dd3d0822168b4d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <ghanshyammann@gmail.com>
Date: Thu, 1 Dec 2016 08:45:43 +0000
Subject: [PATCH 1649/3333] Revert "Set cinder coordination backend url"

gate-tempest-dsvm-layer4 job is failing due to this change as no module found on zake[1]. Heat not able to create cinder stack.
This is blocking tempest now so we will revert revert this once find the real cause.

This reverts commit a283526c88d98f7668d369f4c20db44d3d06425a.

..1 http://logs.openstack.org/64/405064/2/check/gate-tempest-dsvm-layer4/feb21fe/logs/screen-c-vol.txt.gz#_2016-12-01_05_43_40_369

Change-Id: I50981db7760688a25a2bf4de9a41153ede76f4aa
---
 lib/cinder | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 4ed944cfcb..0fe950b6c2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -358,13 +358,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-    # Set the backend url according to the configured dlm backend
-    if is_dlm_enabled; then
-        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
-            iniset $CINDER_CONF coordination backend_url "zake://"
-        fi
-    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts

From c74315e055a770ef3508276442816fffde07cfc6 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 17:49:43 +0900
Subject: [PATCH 1650/3333] Load neutron-legacy only if enabled

To avoid using legacy functions accidentially.

Depends-On: Ida1f83b6b3ef9b76be13c063c7e35a8703214078
Change-Id: I3ff136fc8330c92007cdfe91b77d7f9865eabd8d
---
 lib/neutron        | 13 +++++++++++++
 lib/neutron-legacy |  2 +-
 stack.sh           |  1 -
 unstack.sh         |  1 -
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index d30e18562f..852787db36 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -90,6 +90,10 @@ function is_neutron_legacy_enabled {
     return 1
 }
 
+if is_neutron_legacy_enabled; then
+    source $TOP_DIR/lib/neutron-legacy
+fi
+
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron_new {
@@ -568,6 +572,15 @@ function neutron_service_plugin_class_add {
     fi
 }
 
+function install_neutron_agent_packages {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        install_neutron_agent_packages_mutnauq "$@"
+    else
+        :
+    fi
+}
+
 function start_neutron {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0b0caf18b5..37d278344e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -423,7 +423,7 @@ function install_mutnauq {
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
-function install_neutron_agent_packages {
+function install_neutron_agent_packages_mutnauq {
     # radvd doesn't come with the OS. Install it if the l3 service is enabled.
     if is_service_enabled q-l3; then
         install_package radvd
diff --git a/stack.sh b/stack.sh
index 74edb10afc..17cc248a59 100755
--- a/stack.sh
+++ b/stack.sh
@@ -574,7 +574,6 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm
diff --git a/unstack.sh b/unstack.sh
index c05d1f0952..fe2bb8bfea 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -68,7 +68,6 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm

From 8b1bbd690c3aea36dea804542c1bc56274b2ad31 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 1 Dec 2016 22:29:12 +0900
Subject: [PATCH 1651/3333] Make deprecated() output to stderr

So that it can be used by functions like _determine_config_server,
which is used like RESULT=$(_determine_config_server).

Change-Id: Ia4e641c5529b95ada30ae662221f370bc7fa88a7
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index cc1d42b0d6..f07b382ce6 100644
--- a/functions-common
+++ b/functions-common
@@ -216,7 +216,7 @@ function die_if_not_set {
 function deprecated {
     local text=$1
     DEPRECATED_TEXT+="\n$text"
-    echo "WARNING: $text"
+    echo "WARNING: $text" >&2
 }
 
 # Prints line number and "message" in error format

From eede9ddb1d0f0970672f02bcdfb33923603e65e7 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Fri, 15 Jul 2016 10:27:53 +0900
Subject: [PATCH 1652/3333] Deprecate Q_PLUGIN_EXTRA_CONF_PATH

This single global variable is no longer useful as we have multiple
repositories and devstack plugins nowadays.

Also, add a utility function, neutron_server_config_add, for devstack
plugins to add an extra config file.

Related-Bug: #1599936
Change-Id: I90112823ef96ae2fba97d7b09b00bec8cb816d8d
---
 lib/neutron        | 26 ++++++++++++++++++++-
 lib/neutron-legacy | 56 +++++++++++++++++++++++++++++-----------------
 2 files changed, 60 insertions(+), 22 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 852787db36..590e03818d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -73,6 +73,9 @@ NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CON
 # Add all enabled config files to a single config arg
 NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
 
+# Additional neutron api config files
+declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
+
 # Functions
 # ---------
 
@@ -393,9 +396,17 @@ function start_neutron_api {
         service_protocol="http"
     fi
 
+    local opts = ""
+    opts+="--config-file $NEUTRON_CONF"
+    opts+="--config-file $NEUTRON_CORE_PLUGIN_CONF"
+    local cfg_file
+    for cfg_file in ${_NEUTRON_SERVER_EXTRA_CONF_FILES_ABS[@]}; do
+        opts+=" --config-file $cfg_file"
+    done
+
     # Start the Neutron service
     # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $ops"
 
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
@@ -504,6 +515,10 @@ function neutron_service_plugin_class_add_new {
     iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 
+function neutron_server_config_add_new {
+    _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
+}
+
 # Dispatch functions
 # These are needed for compatibility between the old and new implementations
 # where there are function name overlaps.  These will be removed when
@@ -581,6 +596,15 @@ function install_neutron_agent_packages {
     fi
 }
 
+function neutron_server_config_add {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        mutnauq_server_config_add "$@"
+    else
+        neutron_server_config_add_new "$@"
+    fi
+}
+
 function start_neutron {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 37d278344e..29c187e1e1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -128,10 +128,24 @@ Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
+# The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
+# /etc/neutron is assumed by many of devstack plugins.  Do not change.
+_Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
+
 # List of config file names in addition to the main plugin config file
-# See _configure_neutron_common() for details about setting it up
+# To add additional plugin config files, use ``neutron_server_config_add``
+# utility function.  For example:
+#
+#    ``neutron_server_config_add file1``
+#
+# These config files are relative to ``/etc/neutron``.  The above
+# example would specify ``--config-file /etc/neutron/file1`` for
+# neutron server.
 declare -a Q_PLUGIN_EXTRA_CONF_FILES
 
+# same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
+declare -a _Q_PLUGIN_EXTRA_CONF_FILES_ABS
+
 
 Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
@@ -270,9 +284,23 @@ set +o xtrace
 # ---------
 
 function _determine_config_server {
+    if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" != '' ]]; then
+        if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" = "$_Q_PLUGIN_EXTRA_CONF_PATH" ]]; then
+            deprecated "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        else
+            die $LINENO "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        fi
+    fi
+    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 ]]; then
+        deprecated "Q_PLUGIN_EXTRA_CONF_FILES is deprecated.  Use neutron_server_config_add instead."
+    fi
+    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+        _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($_Q_PLUGIN_EXTRA_CONF_PATH/$cfg_file)
+    done
+
     local cfg_file
     local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+    for cfg_file in ${_Q_PLUGIN_EXTRA_CONF_FILES_ABS[@]}; do
         opts+=" --config-file $cfg_file"
     done
     echo "$opts"
@@ -668,11 +696,6 @@ function _configure_neutron_common {
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For additional plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
-    # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
-    #
-    #    ``Q_PLUGIN_EXTRA_CONF_PATH=/path/to/plugins``
-    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1 file2)``
     neutron_plugin_configure_common
 
     if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
@@ -699,20 +722,6 @@ function _configure_neutron_common {
     # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
     iniset $NEUTRON_CONF nova region_name $REGION_NAME
 
-    # If addition config files are set, make sure their path name is set as well
-    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
-        die $LINENO "Neutron additional plugin config not set.. exiting"
-    fi
-
-    # If additional config files exist, copy them over to neutron configuration
-    # directory
-    if [[ $Q_PLUGIN_EXTRA_CONF_PATH != '' ]]; then
-        local f
-        for (( f=0; $f < ${#Q_PLUGIN_EXTRA_CONF_FILES[@]}; f+=1 )); do
-            Q_PLUGIN_EXTRA_CONF_FILES[$f]=$Q_PLUGIN_EXTRA_CONF_PATH/${Q_PLUGIN_EXTRA_CONF_FILES[$f]}
-        done
-    fi
-
     if [ "$VIRT_DRIVER" = 'fake' ]; then
         # Disable arbitrary limits
         iniset $NEUTRON_CONF quotas quota_network -1
@@ -863,6 +872,11 @@ function _neutron_service_plugin_class_add {
     fi
 }
 
+# mutnauq_server_config_add() - add server config file
+function mutnauq_server_config_add {
+    _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)
+}
+
 # _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
 function _neutron_deploy_rootwrap_filters {
     if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then

From 8bf8c8f3810766d19b92f9cb21231095beca30c6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 1 Dec 2016 10:24:06 -0500
Subject: [PATCH 1653/3333] Add test-config local.conf processing

We need a local.conf processing phase after every run phase which lets
us override config options after that point. We didn't explicitly
support this for test-config before, which broke some CI systems when
we moved tempest to use this later phase.

Closes-Bug: #1646391

Change-Id: I7d693afa19acf3e8231e84e45b7a868628ebdbc0
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index 9aa770f2b9..4b8552c30a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1407,6 +1407,9 @@ fi
 # Phase: test-config
 run_phase stack test-config
 
+# Apply late configuration from ``local.conf`` if it exists for layer 2 services
+# Phase: test-config
+merge_config_group $TOP_DIR/local.conf test-config
 
 # Fin
 # ===

From 1c442eebc8fe005af453bd610e750a1919a2b3ed Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Wed, 30 Nov 2016 20:44:44 +0000
Subject: [PATCH 1654/3333] Fix libguestfs on Ubuntu

libguestfs does not work on ubuntu because the kernel is not
world readable. This breaks file injection with libvirt.
See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725
for more details.

The workaround proposed by Ubuntu is to relax the kernel ACL
if needed, so we need to do that in case file injection is
enabled on an Ubuntu host running libvirt.

Partial-bug: #1646002
Change-Id: I405793b9e145308e51a08710d8e5df720aec6fde
---
 lib/nova_plugins/hypervisor-libvirt | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 167ab6f2e7..f3c8add696 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -105,6 +105,16 @@ function install_nova_hypervisor {
     if [[ "$ENABLE_FILE_INJECTION" == "True" ]] ; then
         if is_ubuntu; then
             install_package python-guestfs
+            # NOTE(andreaf) Ubuntu kernel can only be read by root, which breaks libguestfs:
+            # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725)
+            INSTALLED_KERNELS="$(ls /boot/vmlinuz-*)"
+            for kernel in $INSTALLED_KERNELS; do
+                STAT_OVERRIDE="root root 644 ${kernel}"
+                # unstack won't remove the statoverride, so make this idempotent
+                if [[ ! $(dpkg-statoverride --list | grep "$STAT_OVERRIDE") ]]; then
+                    sudo dpkg-statoverride --add --update $STAT_OVERRIDE
+                fi
+            done
         elif is_fedora || is_suse; then
             install_package python-libguestfs
         fi

From 1c08b191fd04e028a8d908c9ccb4fdc536248c96 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Tue, 29 Nov 2016 15:58:53 -0800
Subject: [PATCH 1655/3333] Fix devstack with linuxbridge without l3 agent

The linuxbridge agent for Neutron expects that the public bridge will
already be created by the time it starts. On devstack, this only occurs
as part of the l3 agent configuration. If a compute node doesn't have an
l3 agent and is using a linuxbridge agent, then br-ex won't be created
and the process will not be able to start (causing stack.sh to fail).

This causes the gate-grenade-dsvm-neutron-linuxbridge-multinode-nv gate
to fail. To avoid the issue, skip the bridge mappings setup unless L3 is
configured. This is done in a backward compatible fashion: if localrc
uses the old q-l3 tags, the is_service_enabled neutron-l3 would not be
able to succeed.

Closes-Bug: #1643562

Change-Id: I292ff0dc080fb84b5f879ba2f00f03eff295b55b
---
 lib/neutron_plugins/linuxbridge_agent | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index d0de2f5e5d..0c8ccb8718 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,7 +62,9 @@ function neutron_plugin_configure_plugin_agent {
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
     if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        fi
     fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS

From 6b8a115b95c7a637e01b8145aa961892ca3b9cd1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 3 Dec 2016 06:56:32 +0000
Subject: [PATCH 1656/3333] Updated from generate-devstack-plugins-list

Change-Id: I21c31b0778486971719f1281428c7a089f583656
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6ece9978ac..89f74c3afc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -76,6 +76,7 @@ kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__

From 8a834940b893b0535887d8cf08504dab4b9b710e Mon Sep 17 00:00:00 2001
From: jeckxie <xiexiaozhe@inspur.com>
Date: Mon, 5 Dec 2016 15:32:25 +0800
Subject: [PATCH 1657/3333] Missing parameter in comment

Change-Id: Iba55013b3be00974321ad58a276bb37ff2cac4da
---
 lib/lvm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index 99c7ba9b9f..0cebd92f77 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -101,7 +101,7 @@ function _create_lvm_volume_group {
 # init_lvm_volume_group() initializes the volume group creating the backing
 # file if necessary
 #
-# Usage: init_lvm_volume_group() $vg
+# Usage: init_lvm_volume_group() $vg $size
 function init_lvm_volume_group {
     local vg=$1
     local size=$2

From ae61e6f3d25df98f4ebeca9695a3c73239ce82b2 Mon Sep 17 00:00:00 2001
From: Anton Merzlyakov <amerzlyakov@selit.ru>
Date: Wed, 30 Nov 2016 14:29:18 +0300
Subject: [PATCH 1658/3333] Postgres: fix detection of existing roles

Role "root" it is hardcode.
In general case role name comes from  local.conf: string  "DATABASE_USER="

Change-Id: Iedfca48e04d23c313851f48d68ac40ba29340805
---
 lib/databases/postgresql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 14425a53b7..1f347f5548 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -47,7 +47,7 @@ function recreate_database_postgresql {
 }
 
 function configure_database_postgresql {
-    local pg_conf pg_dir pg_hba root_roles version
+    local pg_conf pg_dir pg_hba check_role version
     echo_summary "Configuring and starting PostgreSQL"
     if is_fedora; then
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
@@ -85,8 +85,8 @@ function configure_database_postgresql {
     restart_service postgresql
 
     # Create the role if it's not here or else alter it.
-    root_roles=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='root'")
-    if [[ ${root_roles} == *HERE ]];then
+    check_role=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='$DATABASE_USER'")
+    if [[ ${check_role} == *HERE ]];then
         sudo -u root sudo -u postgres -i psql -c "ALTER ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
     else
         sudo -u root sudo -u postgres -i psql -c "CREATE ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"

From 6d66e647ca35910cbca4d940b5203d7307efa1db Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 5 Dec 2016 06:28:26 -0500
Subject: [PATCH 1659/3333] don't setup cells if n-cpu isn't also running

create_cell requires n-api and at least one n-cpu up and running. If
we have a configuration where it is not guarunteed that there is an
n-cpu at the end of a devstack run we have to skip this step and make
the user run it manually later.

Change-Id: I2287ab29f3c1a7252271dcce81673ef365615296
---
 stack.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 9c63f5feac..05a7666ce5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1386,7 +1386,15 @@ check_libs_from_git
 
 # Do this late because it requires compute hosts to have started
 if is_service_enabled n-api; then
-    create_cell
+    if is_service_enabled n-cpu; then
+        create_cell
+    else
+        # Some CI systems like Hyper-V build the control plane on
+        # Linux, and join in non Linux Computes after setup. This
+        # allows them to delay the processing until after their whole
+        # environment is up.
+        echo_summary "SKIPPING Cell setup because n-cpu is not enabled. You will have to do this manually before you have a working environment."
+    fi
 fi
 
 # Bash completion

From 8e0fc9dc8e89994cedfa152e4ff5d2895d19c8a8 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 6 Dec 2016 09:35:02 +0200
Subject: [PATCH 1660/3333] Fix doc formating

Fix formating issue in the doc/source/plugin.rst

Trivial fix.

Change-Id: Ifc9a43aebdab0c15c83485cf0b6d4133d7194a9d
---
 doc/source/plugins.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 31987bc62b..5b3c6cf714 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ The current full list of ``mode`` and ``phase`` are:
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
       been started.
-   - **test-config** - Called at the end of devstack used to configure tempest
+   -  **test-config** - Called at the end of devstack used to configure tempest
       or any other test environments
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut

From 9abb26d69666e836d310ad769d65cb811e2708e7 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 7 Dec 2016 21:12:55 +0100
Subject: [PATCH 1661/3333] Try to set initial mysql root password also on
 Ubuntu

On Ubuntu nodes, devstack tries to predefine the initial mysql root
password by doing some debconf-set-selections, but these will not take
effect if the corresponding package has been installed earlier. So
just try to set it every time, like we do on other distros.

Change-Id: I2c167051fc5e53dd0ccf82a60ab085cd9cdea28d
---
 lib/databases/mysql | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index f6cc9224af..89ae082c81 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -82,10 +82,9 @@ function configure_database_mysql {
     fi
 
     # Set the root password - only works the first time. For Ubuntu, we already
-    # did that with debconf before installing the package.
-    if ! is_ubuntu; then
-        sudo mysqladmin -u root password $DATABASE_PASSWORD || true
-    fi
+    # did that with debconf before installing the package, but we still try,
+    # because the package might have been installed already.
+    sudo mysqladmin -u root password $DATABASE_PASSWORD || true
 
     # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
     sudo mysql -uroot -p$DATABASE_PASSWORD -h127.0.0.1 -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"

From 470580bba68e5dc727ceb4d575649cb143eef7d5 Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyam.mann@nectechnologies.in>
Date: Thu, 8 Dec 2016 13:10:59 +0900
Subject: [PATCH 1662/3333] Remove baremetal tempest config setting from
 devstack

Now all configuration are present in Ironic tempest plugin
and those are going to be removed from tempest in
Id518a6d87d0949737cd1c50cb6a83149b85e5f85

Patch- I73c649625d106fc7f068e12e21eaacba8f43cbbb set
those in ironic devstack plugin.

We can remove all baremetal config setting from devstack.

Along with moved one this patch deletes other unused baremetal
config setting.

Change-Id: If826321ebc0c20ea372d206d49383f3826c9b547
Depends-On: Id518a6d87d0949737cd1c50cb6a83149b85e5f85
Depends-On: I73c649625d106fc7f068e12e21eaacba8f43cbbb
---
 lib/tempest | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..39b565f62f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -494,12 +494,6 @@ function configure_tempest {
 
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
-        iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal deploywait_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
-        iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
         iniset $TEMPEST_CONFIG compute-feature-enabled console_output False
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False

From 8040232e05a68ce18e4ddfa233140d604c94cc77 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 8 Dec 2016 06:54:23 +0000
Subject: [PATCH 1663/3333] Updated from generate-devstack-plugins-list

Change-Id: I857aea09db183a03393acdaa9bfcde8f24cec4f8
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 89f74c3afc..9a75090713 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -58,6 +58,7 @@ ec2-api                                `git://git.openstack.org/openstack/ec2-ap
 freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
+fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__

From 30b58bfa277820e0d41a7dc5edd06d8b4ff53500 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 9 Dec 2016 00:58:54 +0100
Subject: [PATCH 1664/3333] Update openvswitch restart for suse

Starting with SLE12 SP2 and with openSUSE Leap the distro-shipped
openvswitch is the normal systemd openvswitch.service service file
and no longer the older openvswitch-switch Sysv5 init script. Add
a special case for that.

Change-Id: I5152f2585c3d4d18853988d6290039d6b1713b99
---
 lib/neutron_plugins/ovs_base | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 10043252d6..62a4d00bcd 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -69,7 +69,11 @@ function _neutron_ovs_base_install_agent_packages {
         restart_service openvswitch
         sudo systemctl enable openvswitch
     elif is_suse; then
-        restart_service openvswitch-switch
+        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
+            restart_service openvswitch-switch
+        else
+            restart_service openvswitch
+        fi
     fi
 }
 

From ea774b684d5116c626eb7b64eed9de4ecd5821a4 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 9 Dec 2016 00:57:57 +0100
Subject: [PATCH 1665/3333] [opensuse] add python-xml to general deps list

the python-xml is a subpackage from the standard cpython package that
that contains elementtree and other bits that are needed almost
everywhere in OpenStack but isn't installed on a absolutely minimal
openSUSE Leap installation. This package doesn't exist on pip but
is a SUSE only invention, so just treat it similar to a bindep.

Change-Id: I82887c2e6895740d1b16d1269574519450ca783e
---
 files/rpms-suse/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 3b19071770..1044c25288 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -21,6 +21,7 @@ postgresql-devel  # psycopg2
 psmisc
 python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
+python-xml
 screen
 tar
 tcpdump

From 16fb9bddf2dfc4ecdda5aeed5d09d10e78558f16 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 9 Dec 2016 06:53:39 +0000
Subject: [PATCH 1666/3333] Updated from generate-devstack-plugins-list

Change-Id: Ia08c86b2adff782b42a83509359c38d7d531e481
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9a75090713..358e1e4ba5 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -79,6 +79,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
+meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__

From f575aefdfa2db204f975b3b4b178da1e292f4372 Mon Sep 17 00:00:00 2001
From: Roman Podoliaka <rpodolyaka@mirantis.com>
Date: Tue, 11 Oct 2016 13:15:55 +0300
Subject: [PATCH 1667/3333] lib/nova: create api db first

Since I21ae13a6c029e8ac89484faa212434911160fd51 nova-manage db sync
may try to make a request to api db in order to get cell mapping and
will fail, as the db is not created yet. While this is non fatal, we
could avoid the error anyway.

Change-Id: I19483e9420071d484f029779bcc8c6d623c210ce
Related-Bug: #1631033
---
 lib/nova | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index d5db5eaeb7..9f0cddeaf3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -676,6 +676,9 @@ function init_nova {
     # All nova components talk to a central database.
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
+        recreate_database $NOVA_API_DB
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
+
         # (Re)create nova databases
         recreate_database nova
         recreate_database nova_api_cell0
@@ -689,9 +692,6 @@ function init_nova {
             recreate_database $NOVA_CELLS_DB
         fi
 
-        recreate_database $NOVA_API_DB
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
-
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations

From 22b63666de41bf62b008cff709168c5e84a0bf3b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 9 Dec 2016 07:33:01 -0500
Subject: [PATCH 1668/3333] Warn instead of die on undefined config names

When using local.conf in multinode envs not everything is going to be
defined in all places. Eventually we probably want to make it so we
have a host role for these sections or something. But for now warn
instead of die when we can't find a config var.

Change-Id: I6959099373f035fbfe9e540a44e4c52b8e7c95c0
Closes-Bug: #2000824
---
 inc/meta-config           |  3 ++-
 tests/test_meta_config.sh | 11 +++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index 6252135747..be73b60800 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -181,7 +181,8 @@ function merge_config_group {
 
             realconfigfile=$(eval "echo $configfile")
             if [[ -z $realconfigfile ]]; then
-                die $LINENO "bogus config file specification: $configfile is undefined"
+                warn $LINENO "unknown config file specification: $configfile is undefined"
+                break
             fi
             dir=$(dirname $realconfigfile)
             if [[ -d $dir ]]; then
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 92f9c01f69..087aaf468b 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -29,6 +29,10 @@ function die {
     exit -1
 }
 
+function warn {
+    return 0
+}
+
 TEST_1C_ADD="[eee]
 type=new
 multi = foo2"
@@ -92,7 +96,7 @@ $TEST_1C_ADD
 [[test3|test-space.conf]]
 [DEFAULT]
 attribute=value
- 
+
 # the above line has a single space
 
 [[test4|\$TEST4_DIR/\$TEST4_FILE]]
@@ -378,11 +382,10 @@ set -e
 
 echo -n "merge_config_group test9 undefined conf file: "
 set +e
-# function is expected to fail and exit, running it
-# in a subprocess to let this script proceed
+# function is expected to trigger warn and continue
 (merge_config_group test.conf test9)
 VAL=$?
-EXPECT_VAL=255
+EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 

From 7f68548538a5855cff8fe1debf4e65ff74074e09 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Tue, 13 Dec 2016 15:47:11 +1100
Subject: [PATCH 1669/3333] Always add the service role to service users

When creating a service user we allow the user to be created with a
different role. Currently in auth_token middleware we want to check that
the service token is specified with the service role so we should always
add the service role and optionally add additional roles.

Change-Id: Ie954a679674b4795079b539ebc8d4d2dcbd7dacc
---
 lib/keystone | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index fd1d1d4a61..a8de3efa51 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -445,14 +445,16 @@ function create_keystone_accounts {
 #
 # create_service_user <name> [role]
 #
-# The role defaults to the service role. It is allowed to be provided as optional as historically
+# We always add the service role, other roles are also allowed to be added as historically
 # a lot of projects have configured themselves with the admin or other role here if they are
 # using this user for other purposes beyond simply auth_token middleware.
 function create_service_user {
-    local role=${2:-service}
-
     get_or_create_user "$1" "$SERVICE_PASSWORD" "$SERVICE_DOMAIN_NAME"
-    get_or_add_user_project_role "$role" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
+    get_or_add_user_project_role service "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
+
+    if [[ -n "$2" ]]; then
+        get_or_add_user_project_role "$2" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
+    fi
 }
 
 # Configure the service to use the auth token middleware.

From edcb7e5bb321d247c9667933f3ff7c72973caa6f Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 15 Dec 2016 11:29:28 -0500
Subject: [PATCH 1670/3333] lib/neutron: Fix some settings

* Set ml2_type_flat setting so that the public flat network is created
correctly

* Set securitygroup driver correctly

It should be set as:

[securitygroup]
firewall_driver = iptables

Change-Id: I7369b45fbc5a47ce958693c67a1902a8cb24f367
---
 lib/neutron | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4915dcce31..5d03543180 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -161,6 +161,7 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
         fi
@@ -173,10 +174,10 @@ function configure_neutron_new {
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
             iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
         else
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables_hybrid
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
 

From a09cb5acf908e04b6509484fdff43016ebebf2cf Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 14 Dec 2016 07:57:26 -0800
Subject: [PATCH 1671/3333] Use java version independent package on Ubuntu

Different versions of Ubuntu ship with different versions of Java.
Trusty had 7, Xenial has 8, and so on. This causes problems when we
hardcode a versioned package name into our dep lists as that version may
not exist everywhere. Thankfully Ubuntu provides a default-jre-headless
package that we can use instead that maps properly onto whatever java
version is correct.

Change-Id: I4e5da215c8f7aa426494686d5043995ce5d3c3af
---
 files/debs/general   | 2 +-
 pkg/elasticsearch.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index a1f2a4b159..c121770fa2 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -2,6 +2,7 @@ bc
 bridge-utils
 bsdmainutils
 curl
+default-jre-headless  # NOPRIME
 g++
 gcc
 gettext  # used for compiling message catalogs
@@ -17,7 +18,6 @@ libxml2-dev  # lxml
 libxslt1-dev  # lxml
 libyaml-dev
 lsof # useful when debugging
-openjdk-7-jre-headless  # NOPRIME
 openssh-server
 openssl
 pkg-config
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 856eaff36f..fefd454312 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -83,7 +83,7 @@ function install_elasticsearch {
         return
     fi
     if is_ubuntu; then
-        is_package_installed openjdk-7-jre-headless || install_package openjdk-7-jre-headless
+        is_package_installed default-jre-headless || install_package default-jre-headless
 
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10

From 8e14240d232366b8b1dd7de59800595211698fc1 Mon Sep 17 00:00:00 2001
From: Eric Berglund <esberglu@us.ibm.com>
Date: Tue, 29 Nov 2016 17:33:28 -0600
Subject: [PATCH 1672/3333] Confirm network is created before setting
 public_network_id

The current code assumes that there exists a public openstack network
and uses that assumption to set the public_network_id variable in
tempest lib. If NEUTRON_CREATE_INITIAL_NETWORKS is set to false this
step will fail as there is no public network to be found. This change
adds a check for NEUTRON_CREATE_INITIAL_NETWORKS before attempting to
set this variable.

Change-Id: I62e74d350d6533fa842d64c15b01b1a3d42c71c2
Closes-Bug: #1645900
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..a1b84b6bfc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -241,7 +241,9 @@ function configure_tempest {
 
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
-    if is_networking_extension_supported 'external-net'; then
+    # If NEUTRON_CREATE_INITIAL_NETWORKS is not true, there is no network created
+    # and the public_network_id should not be set.
+    if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
     fi
 

From 51a225c5d7f7d8655be62cab0e4d677b6839f35a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 15 Dec 2016 16:32:08 -0500
Subject: [PATCH 1673/3333] Create mechanism for enabling placement-client on
 subnodes

When doing multinode devstack we need a way to specify that we've
enabled for the placement service. We use a pseudo service of
placement-client for this.

Change-Id: I04a655fbc58913b3d607400a7f677be299499142
---
 lib/placement | 15 ++++++++-------
 stack.sh      | 10 ++++++++++
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/lib/placement b/lib/placement
index 165c670206..ff630e29d8 100644
--- a/lib/placement
+++ b/lib/placement
@@ -55,7 +55,7 @@ PLACEMENT_SERVICE_PORT=${PLACEMENT_SERVICE_PORT:-8778}
 # Test if any placement services are enabled
 # is_placement_enabled
 function is_placement_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"placement-" ]] && return 0
+    [[ ,${ENABLED_SERVICES} =~ ,"placement-api" ]] && return 0
     return 1
 }
 
@@ -101,12 +101,7 @@ function _config_placement_apache_wsgi {
     " -i $placement_api_apache_conf
 }
 
-# configure_placement() - Set config files, create data dirs, etc
-function configure_placement {
-    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
-        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
-    fi
-
+function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_type "password"
     iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF placement username placement
@@ -121,7 +116,13 @@ function configure_placement {
     # established by the nova api. This avoids, for the time, being,
     # creating redundant configuration items that are just used for
     # testing.
+}
 
+# configure_placement() - Set config files, create data dirs, etc
+function configure_placement {
+    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
+        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
+    fi
     _config_placement_apache_wsgi
 }
 
diff --git a/stack.sh b/stack.sh
index f4bac30dac..1817f61704 100755
--- a/stack.sh
+++ b/stack.sh
@@ -869,6 +869,16 @@ if is_service_enabled placement; then
     configure_placement
 fi
 
+# create a placement-client fake service to know we need to configure
+# placement connectivity. We configure the placement service for nova
+# if placement-api or placement-client is active, and n-cpu on the
+# same box.
+if is_service_enabled placement placement-client; then
+    if is_service_enabled n-cpu; then
+        configure_placement_nova_compute
+    fi
+fi
+
 if is_service_enabled horizon; then
     # django openstack_auth
     install_django_openstack_auth

From ea3e87d4e5a7a23870e86bbe133064a99e9519cf Mon Sep 17 00:00:00 2001
From: Julia Varlamova <jvarlamova@mirantis.com>
Date: Fri, 16 Dec 2016 14:39:31 +0400
Subject: [PATCH 1674/3333] Add new parameter RECREATE_KEYSTONE_DB

If 'RECREATE_KEYSTONE_DB=False' database won't be recreated.
It would be useful for multinode Grenade tests for Keystone. This parameter
will help us to deploy multiple services on different machines talking to
the same DB.

Devstack recreates Keystone DB each time during Keystone service installation.
If our controller node is already deployed, Keystone DB already contains
important information about OpenStack services and their endpoints. When
the second Keystone node is being deployed, we don't want to delete
records about controllers' services endpoints.

Partially-Implements: bp rolling-upgrade-testing

Change-Id: Ia8d07b4295ca165be01e44466c95d5275f596e83
---
 lib/keystone | 6 ++++--
 stackrc      | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index fd1d1d4a61..0d54dee2db 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -488,8 +488,10 @@ function init_keystone {
         init_ldap
     fi
 
-    # (Re)create keystone database
-    recreate_database keystone
+    if [[ "$RECREATE_KEYSTONE_DB" == True ]]; then
+        # (Re)create keystone database
+        recreate_database keystone
+    fi
 
     # Initialize keystone database
     $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
diff --git a/stackrc b/stackrc
index e7771cfab5..ae87b22e13 100644
--- a/stackrc
+++ b/stackrc
@@ -819,6 +819,10 @@ GIT_DEPTH=${GIT_DEPTH:-0}
 # Use native SSL for servers in ``SSL_ENABLED_SERVICES``
 USE_SSL=$(trueorfalse False USE_SSL)
 
+# We may not need to recreate database in case 2 Keystone services
+# sharing the same database. It would be useful for multinode Grenade tests.
+RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
+
 # ebtables is inherently racey. If you run it by two or more processes
 # simultaneously it will collide, badly, in the kernel and produce
 # failures or corruption of ebtables. The only way around it is for

From 3f771b7bcb04a22c056f87e9e9bae76209fd3555 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Sat, 17 Dec 2016 04:12:24 +0000
Subject: [PATCH 1675/3333] iptables: don't enable arptables firewall

Neutron doesn't use any arptables based firewall rules. This should
somewhat optimize kernel packet processing performance.

I think the setting came from:
http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf

but does not apply to the way we use iptables.

Change-Id: I41796c76172f5243e4f9c4902363abb1f19d0d12
Closes-Bug: #1651765
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 6a0ac67b69..0be9794d9a 100644
--- a/functions
+++ b/functions
@@ -658,7 +658,7 @@ function enable_kernel_bridge_firewall {
     # Enable bridge firewalling in case it's disabled in kernel (upstream
     # default is enabled, but some distributions may decide to change it).
     # This is at least needed for RHEL 7.2 and earlier releases.
-    for proto in arp ip ip6; do
+    for proto in ip ip6; do
         sudo sysctl -w net.bridge.bridge-nf-call-${proto}tables=1
     done
 }

From 91070d7e408de28ae6971fb480f499aa5ba41919 Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Mon, 19 Dec 2016 18:07:55 +0100
Subject: [PATCH 1676/3333] Add placement services to default devstack

Now that the placement service is mandatory for running Nova in Ocata,
we want to enable it by default when running devstack by default.

In the past, we added a placement-client service with
I04a655fbc58913b3d607400a7f677be299499142

Devstack-gate will also be able to run a multinode devstack with the
help of Ibd760c642e3c1ffff2dd61be48e30530b0d24720

Change-Id: I273c3c8299ee329bed425f3e7cd4b583ed1187a4
---
 stackrc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/stackrc b/stackrc
index e7771cfab5..f6cf0ce171 100644
--- a/stackrc
+++ b/stackrc
@@ -54,6 +54,8 @@ if ! isset ENABLED_SERVICES ; then
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
     ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth
+    # Placement service needed for Nova
+    ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder

From 7cdefd4e08e52e246582d5a91a71207e3b0a7bf9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 20 Dec 2016 07:02:50 +0000
Subject: [PATCH 1677/3333] Updated from generate-devstack-plugins-list

Change-Id: Ica922f54ffd53e81b3ec034c2ce9b91715304954
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 358e1e4ba5..a6f509e238 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -95,6 +95,7 @@ networking-bgpvpn                      `git://git.openstack.org/openstack/networ
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
 networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
 networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
 networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
@@ -121,6 +122,7 @@ neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutro
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 nimble                                 `git://git.openstack.org/openstack/nimble <https://git.openstack.org/cgit/openstack/nimble>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
+nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__

From 95ed7c6f0513debdc0c692e78b898c08b84eab99 Mon Sep 17 00:00:00 2001
From: Zane Bitter <zbitter@redhat.com>
Date: Tue, 20 Dec 2016 17:29:14 -0500
Subject: [PATCH 1678/3333] Don't buffer log output in sed

Services that run inside Apache use tail -f on the corresponding log
file to display output in the screen session. However, they also use sed
to replace some control characters, and this means that the output is
buffered. This results in debugging experiences that range from
"impossible" (the log you want isn't shown) to "Kafkaesque nightmare"
(the log you want isn't shown, except that sometimes it is, and
sometimes it isn't even though you double-checked and you're completely
sure that you must have output a log, but when you check back later you
realise it actually is and you wonder if history is actually not mutable
after all and begin to question what is real and what is not).

This adds the --unbuffered option to ensure streaming output.

Change-Id: I665ff5f047156401d8152f478d834ac40ff31658
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index cc1d42b0d6..9423f9ed90 100644
--- a/functions-common
+++ b/functions-common
@@ -1678,7 +1678,7 @@ function tail_log {
     local logfile=$2
 
     if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_process "$name" "sudo tail -f $logfile | sed 's/\\\\\\\\x1b/\o033/g'"
+        screen_process "$name" "sudo tail -f $logfile | sed -u 's/\\\\\\\\x1b/\o033/g'"
     fi
 }
 

From 20eb274b753ed7cfeabd4eca8865774fe4bed182 Mon Sep 17 00:00:00 2001
From: Pawel Koniszewski <pawel.koniszewski@intel.com>
Date: Wed, 21 Dec 2016 13:27:09 +0100
Subject: [PATCH 1679/3333] Move RABBIT_HOST to lib/rpc_backend

This moves setting of RABBIT_HOST from stack.sh to lib/rpc_backend
so it may be used in grenade runs, which don't have the defaulted
value from stack.sh. The RABBIT_HOST is needed in order to call
get_transport_url in lib/rpc_backend.

Change-Id: I504f7fac7bb9a8c158e20046dbd1dd2d507db02b
Closes-Bug: #1649586
Depends-On: I3d4d7b309e50f4e2970cda55aada02d68c4fa705
---
 lib/rpc_backend | 3 +++
 stack.sh        | 1 -
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 97b1aa409a..a21f781b4e 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -25,6 +25,9 @@ _XTRACE_RPC_BACKEND=$(set +o | grep xtrace)
 set +o xtrace
 
 RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
+if is_service_enabled rabbit; then
+    RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
+fi
 
 # Functions
 # ---------
diff --git a/stack.sh b/stack.sh
index 1817f61704..5de2b6366f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -664,7 +664,6 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 # In multi node DevStack, second node needs ``RABBIT_USERID``, but rabbit
 # isn't enabled.
 if is_service_enabled rabbit; then
-    RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
     read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."
 fi
 

From 70a620846483c3f65500dbfe26aef7f3dc1ce50c Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Tue, 20 Dec 2016 15:34:29 +0100
Subject: [PATCH 1680/3333] Placement service only using default HTTPd ports

The placement API configuration was binding a specific port *and* was supporting
to be called by the default HTTPd ports using a Location directive.

Given that the corresponding service catalog entry for the placement service type
doesn't mention the specific application port but is rather using the default
port 80, we can remove that specific port and just use the default config.

Note that we still need to use a VirtualHost directive for the specific placement
config because ErrorLog is only scoped for either server or virtualhost but can't
be set for a Location (or a Directory) context.

Change-Id: I9a26dcff4b879cf9e82e43a3d1aca2e4fe6aa3e6
---
 files/apache-placement-api.template | 8 +++++---
 lib/placement                       | 7 -------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
index b89ef96776..011abb95fc 100644
--- a/files/apache-placement-api.template
+++ b/files/apache-placement-api.template
@@ -1,6 +1,8 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
+# NOTE(sbauza): This virtualhost is only here because some directives can
+# only be set by a virtualhost or server context, so that's why the port is not bound.
+# TODO(sbauza): Find a better way to identify a free port that is not corresponding to an existing
+# vhost.
+<VirtualHost *:8780>
     WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup placement-api
     WSGIScriptAlias / %PUBLICWSGI%
diff --git a/lib/placement b/lib/placement
index ff630e29d8..93b72eb5e0 100644
--- a/lib/placement
+++ b/lib/placement
@@ -47,7 +47,6 @@ fi
 # Public facing bits
 PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
-PLACEMENT_SERVICE_PORT=${PLACEMENT_SERVICE_PORT:-8778}
 
 # Functions
 # ---------
@@ -68,7 +67,6 @@ function cleanup_placement {
 # _config_placement_apache_wsgi() - Set WSGI config files
 function _config_placement_apache_wsgi {
     local placement_api_apache_conf
-    local placement_api_port=$PLACEMENT_SERVICE_PORT
     local venv_path=""
     local nova_bin_dir=""
     nova_bin_dir=$(get_python_exec_prefix)
@@ -89,7 +87,6 @@ function _config_placement_apache_wsgi {
 
     sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
     sudo sed -e "
-        s|%PUBLICPORT%|$placement_api_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%PUBLICWSGI%|$nova_bin_dir/nova-placement-api|g;
         s|%SSLENGINE%|$placement_ssl|g;
@@ -161,10 +158,6 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    # Get right service port for testing
-    local service_port=$PLACEMENT_SERVICE_PORT
-    local placement_api_port=$PLACEMENT_SERVICE_PORT
-
     enable_apache_site placement-api
     restart_apache_server
     tail_log placement-api /var/log/$APACHE_NAME/placement-api.log

From 8a92b7f1deeb1b9e99b41b7d7b8e22ca9636b6af Mon Sep 17 00:00:00 2001
From: Pawel Koniszewski <pawel.koniszewski@intel.com>
Date: Wed, 5 Oct 2016 16:14:19 +0200
Subject: [PATCH 1681/3333] Add new configuration option for LM+grenade job

In order to test whether live migration is backward compatible
we need to live migrate VM back and forth between two versions
of nova. This configuration option will allow to reuse existing
tests just by adding if condition in a method that invokes live
migration and validates outcome:

* If set to False, it will use existing behaviour
* If set to True, it will live migrate VM, validate whether it
succeded, then live migrate the same VM once again and again
validate the result

Depends-On: Icaeca404ec3e4b8f3cd489789fdac6117740ec43
Change-Id: I8da2b3bd0c08d9a3111d3531c346d06bd52cae7b
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..efd698db1c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -354,6 +354,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
+    iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_back_and_forth ${LIVE_MIGRATE_BACK_AND_FORTH:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving

From 36f81ff6d568395bd2fd7f48bc983b9756924e3d Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 2 Nov 2016 17:50:56 -0700
Subject: [PATCH 1682/3333] Switch to using openstack client for setting the
 router's gateway

Depends-on: Ifb5a4d1965cd7e75c0c8cf2cfb677e0628b699dc
Change-Id: Iba58f5275cacc7bc82fa2f2d2b96315c2350ab70
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 569a366c79..ae086ce9a3 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -337,7 +337,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3;  then
@@ -385,7 +385,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using the l3-agent for layer 3

From afa8a00c14f100cf610ac076f07db2379cfcee20 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 19 Dec 2016 09:51:01 -0500
Subject: [PATCH 1683/3333] Switch to python 3.5

Use trueorfalse to normalize the values for USE_PYTHON3

Install 3.5 instead of 3.4 When USE_PYTHON3 is specified.
Also, since not many packages are classified correctly, fallback
to looking for just "Programming Language :: Python :: 3" and
log a message for the package to highlight the problem.

Also special case some services that are *almost* ready

Depends-On: Id48e1b328230fcdf97ed1cb4b97f4c3f9cf6eb8a
Depends-On: Ib7d9aa0e0b74a936002e0eea0b3af05102b06a62
Change-Id: I243ea4b76f0d5ef57a03b5b0798a05468ee6de9b
---
 inc/python  | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/apache  | 10 +++++++++-
 lib/horizon | 12 ++++++++++--
 stackrc     |  4 ++--
 4 files changed, 73 insertions(+), 6 deletions(-)

diff --git a/inc/python b/inc/python
index e4cfab803c..54fd90533a 100644
--- a/inc/python
+++ b/inc/python
@@ -76,6 +76,27 @@ function get_python_versions_for_package {
         | grep 'Language' | cut -f5 -d: | grep '\.' | tr '\n' ' '
 }
 
+# Check for python3 classifier in local directory
+function check_python3_support_for_package_local {
+    local name=$1
+    cd $name
+    set +e
+    classifier=$(python setup.py --classifiers \
+        | grep 'Programming Language :: Python :: 3$')
+    set -e
+    echo $classifier
+}
+
+# Check for python3 classifier on pypi
+function check_python3_support_for_package_remote {
+    local name=$1
+    set +e
+    classifier=$(curl -s -L "https://pypi.python.org/pypi/$name/json" \
+        | grep '"Programming Language :: Python :: 3"')
+    set -e
+    echo $classifier
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
@@ -123,9 +144,39 @@ function pip_install {
                 # default pip
                 local package_dir=${!#}
                 local python_versions
-                if [[ -d "$package_dir" ]]; then
+
+                # Special case some services that have experimental
+                # support for python3 in progress, but don't claim support
+                # in their classifier
+                echo "Check python version for : $package_dir"
+                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || ${package_dir##*/} == "cinder" ]]; then
+                    echo "Using $PYTHON3_VERSION version to install $package_dir"
+                    sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                    cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                elif [[ -d "$package_dir" ]]; then
                     python_versions=$(get_python_versions_for_package $package_dir)
                     if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
+                        echo "Using $PYTHON3_VERSION version to install $package_dir"
+                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                    else
+                        # The package may not have yet advertised python3.5
+                        # support so check for just python3 classifier and log
+                        # a warning.
+                        python3_classifier=$(check_python3_support_for_package_local $package_dir)
+                        if [[ ! -z "$python3_classifier" ]]; then
+                            echo "Using $PYTHON3_VERSION version to install $package_dir"
+                            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                        fi
+                    fi
+                else
+                    # Check pypi as we don't have the package on disk
+                    package=$(echo $package_dir | grep -o '^[.a-zA-Z0-9_-]*')
+                    python3_classifier=$(check_python3_support_for_package_remote $package)
+                    if [[ ! -z "$python3_classifier" ]]; then
+                        echo "Using $PYTHON3_VERSION version to install $package"
+                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                     fi
                 fi
diff --git a/lib/apache b/lib/apache
index 2dc626f130..d1a11ae18b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -71,7 +71,15 @@ function install_apache_wsgi {
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Install apache2, which is NOPRIME'd
-        install_package apache2 libapache2-mod-wsgi
+        install_package apache2
+        if python3_enabled; then
+            if is_package_installed libapache2-mod-wsgi; then
+                uninstall_package libapache2-mod-wsgi
+            fi
+            install_package libapache2-mod-wsgi-py3
+        else
+            install_package libapache2-mod-wsgi
+        fi
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
diff --git a/lib/horizon b/lib/horizon
index 830da095f6..4cabbe483c 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -81,7 +81,11 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    (cd $HORIZON_DIR; python manage.py compilemessages)
+    if python3_enabled; then
+        (cd $HORIZON_DIR; python${PYTHON3_VERSION} manage.py compilemessages)
+    else
+        (cd $HORIZON_DIR; python manage.py compilemessages)
+    fi
 
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
@@ -162,7 +166,11 @@ function install_django_openstack_auth {
         git_clone_by_name "django_openstack_auth"
         # Compile message catalogs before installation
         _prepare_message_catalog_compilation
-        (cd $dir; python setup.py compile_catalog)
+        if python3_enabled; then
+            (cd $dir; python${PYTHON3_VERSION} setup.py compile_catalog)
+        else
+            (cd $dir; python setup.py compile_catalog)
+        fi
         setup_dev_lib "django_openstack_auth"
     fi
     # if we aren't using this library from git, then we just let it
diff --git a/stackrc b/stackrc
index ae87b22e13..cb9b8176ca 100644
--- a/stackrc
+++ b/stackrc
@@ -101,12 +101,12 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
 fi
 
 # Control whether Python 3 should be used.
-export USE_PYTHON3=${USE_PYTHON3:-False}
+export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
-export PYTHON3_VERSION=${PYTHON3_VERSION:-3.4}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-3.5}
 
 # Just to be more explicit on the Python 2 version to use.
 export PYTHON2_VERSION=${PYTHON2_VERSION:-2.7}

From 09cef5a2330031ce4e3dd28dff02ad926e83be19 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:03:28 +0100
Subject: [PATCH 1684/3333] lib/tempest: Liberty EOL: remove an useless feature
 flag

The snapshot_backup feature flag was introduced in
Ib695e60c2ed7edf30c8baef9e00f0307b1156551 to enable Tempest tests
introduced in I1964ce6e1298041f8238d76fa4b7029d2d23bbfb

But I1964ce6e1298041f8238d76fa4b7029d2d23bbfb was never merged so that
feature flag was never really useful.

Change-Id: I4e0bc786d2320907cb101fc788ad51444628537d
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..7d68092893 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -430,8 +430,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
-    # TODO(obutenko): Remove snapshot_backup when liberty-eol happens.
-    iniset $TEMPEST_CONFIG volume-feature-enabled snapshot_backup True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 2bf5b416a748ff6c1489b870bab3956aa1b24aee Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:22:17 +0100
Subject: [PATCH 1685/3333] lib/tempest: don't set cli_dir and dashboard_url
 config options

CLI tests have been removed from Tempest in
I4f8638f1c048bbdb598dd181f4af272ef9923806

Dashboard tests have been removed from Tempest in
I2a69ebed2947a5ab5e5ca79557130bd093e168dd

Change-Id: I6df74a07e209b07fd3feae762c9cdab16e09414f
---
 lib/tempest | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..c3cfae3c7f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -486,12 +486,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
-    # Dashboard
-    iniset $TEMPEST_CONFIG dashboard dashboard_url "http://$SERVICE_HOST/"
-
-    # CLI
-    iniset $TEMPEST_CONFIG cli cli_dir $NOVA_BIN_DIR
-
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True

From 42e73db840213b581c2848aef1ae87b5f6e61faa Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:34:06 +0100
Subject: [PATCH 1686/3333] lib/tempest: remove the
 allow_port_security_disabled option

Now that Liberty is EOLed, the feature flag is not needed anymore.

Change-Id: I5206535761773d4bcb02ebb8f25d1b0c1b59110c
Depends-On: If0b2168080a0b0ecdc6682ef69856a0879f4f6d3
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..7e4c7788b3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -347,8 +347,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
-    # TODO(mriedem): Remove allow_port_security_disabled after liberty-eol.
-    iniset $TEMPEST_CONFIG compute-feature-enabled allow_port_security_disabled True
     iniset $TEMPEST_CONFIG compute-feature-enabled personality ${ENABLE_FILE_INJECTION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}

From ee3383f7198fbe4563425a3d4fdc1dc2529f2950 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 3 Jan 2017 07:02:56 +0000
Subject: [PATCH 1687/3333] Updated from generate-devstack-plugins-list

Change-Id: I8ea9f059757ef9b40dc38b93a9ae8072c5be9e4c
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a6f509e238..cb9c437458 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -95,6 +95,7 @@ networking-bgpvpn                      `git://git.openstack.org/openstack/networ
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
 networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
 networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-cumulus                     `git://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
 networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
@@ -130,6 +131,7 @@ oaktree                                `git://git.openstack.org/openstack/oaktre
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
+picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__

From 0c0d848b8ce151c72b21114ac741508351a0bf37 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 3 Jan 2017 08:52:25 -0500
Subject: [PATCH 1688/3333] Add swift and uwsgi to py35 whitelist

Really close to getting swift and keystone under uwsgi working, so
let's white list them. Won't affect any existing jobs, so we should
be good.

Change-Id: I51d56d16a5b175bd45dee09edc0b2748d72a5d06
---
 inc/python | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 54fd90533a..5a9a9ed588 100644
--- a/inc/python
+++ b/inc/python
@@ -149,7 +149,9 @@ function pip_install {
                 # support for python3 in progress, but don't claim support
                 # in their classifier
                 echo "Check python version for : $package_dir"
-                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || ${package_dir##*/} == "cinder" ]]; then
+                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || \
+                        ${package_dir##*/} == "cinder" || ${package_dir##*/} == "swift" || \
+                        ${package_dir##*/} == "uwsgi" ]]; then
                     echo "Using $PYTHON3_VERSION version to install $package_dir"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)

From 2a7e909b3f9480d3a61bd9ec497a954c833d14c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 3 Jan 2017 21:11:55 -0500
Subject: [PATCH 1689/3333] Explicitly set use_neutron=False in nova.conf when
 running nova-net

nova-network has been deprecated since Netwon and Nova change
I8388c29ad310cd8800084b4d5c026013158bfbed is switching the default
value of use_neutron to True, so we need devstack to explicitly
set use_neutron=False when running and configuring nova-network.

Part of blueprint use-neutron-by-default

Change-Id: I82721b5d10711401b9b0ebc2b0ed07cc8287bbf7
---
 lib/nova | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova b/lib/nova
index d5db5eaeb7..50c0d4708e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -663,6 +663,7 @@ function create_nova_conf_nova_network {
     if [ -n "$FLAT_INTERFACE" ]; then
         iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi
+    iniset $NOVA_CONF DEFAULT use_neutron False
 }
 
 # create_nova_keys_dir() - Part of the init_nova() process

From 52b10746154d57c067b152009bbc13024c2951d9 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Thu, 1 Dec 2016 16:11:17 +0100
Subject: [PATCH 1690/3333] cinder: configure dlm when this one is zookeeper

Previous this was set the zake, but that was revert to missing
dependencies issue and because zake is a test fixture and not somthing
to deploy.

This change configures the Cinder dlm with this one is zookeeper.
And it installs tooz and the extra dependencies needed for the
zookeeper driver.

To do it, this commit have to introduce a new method for package
installation: 'pip_install_gr_extras package extra1,extra2'.

Change-Id: Idca310c08e345db59840eb31434c6cb1f849fa70
---
 inc/python | 14 ++++++++++++++
 lib/cinder |  7 +++++++
 lib/dlm    |  1 +
 3 files changed, 22 insertions(+)

diff --git a/inc/python b/inc/python
index 5a9a9ed588..04cde34fe1 100644
--- a/inc/python
+++ b/inc/python
@@ -69,6 +69,20 @@ function pip_install_gr {
     pip_install $clean_name
 }
 
+# Wrapper for ``pip install`` that only installs versions of libraries
+# from the global-requirements specification with extras.
+#
+# Uses globals ``REQUIREMENTS_DIR``
+#
+# pip_install_gr_extras packagename extra1,extra2,...
+function pip_install_gr_extras {
+    local name=$1
+    local extras=$2
+    local clean_name
+    clean_name=$(get_from_global_requirements $name)
+    pip_install $clean_name[$extras]
+}
+
 # Determine the python versions supported by a package
 function get_python_versions_for_package {
     local name=$1
diff --git a/lib/cinder b/lib/cinder
index f6ad780bb9..40f0f16d6b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -373,6 +373,13 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+    # Set the backend url according to the configured dlm backend
+    if is_dlm_enabled; then
+        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
+            iniset $CINDER_CONF coordination backend_url "zookeeper://${SERVICE_HOST}:2181"
+        fi
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
diff --git a/lib/dlm b/lib/dlm
index e391535910..b5ac0f5d33 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -91,6 +91,7 @@ function configure_dlm {
 # install_dlm() - Collect source and prepare
 function install_dlm {
     if is_dlm_enabled; then
+        pip_install_gr_extras tooz zookeeper
         if is_ubuntu; then
             install_package zookeeperd
         elif is_fedora; then

From 80b1d0ae7db263dada7fdc4d9d8190d0518b8f6c Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 4 Jan 2017 16:58:04 +0100
Subject: [PATCH 1691/3333] Fix placement service for identity-v3

The domain_name to be used needs to be $SERVICE_DOMAIN_NAME, as this is
changed in devstack from "Default" to "service".

Change-Id: I6351c1b2ca7ea4448e13eb87455bff4058df4fa7
---
 lib/placement | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index 93b72eb5e0..871e282f32 100644
--- a/lib/placement
+++ b/lib/placement
@@ -103,9 +103,9 @@ function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF placement username placement
     iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF placement user_domain_name "Default"
+    iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF placement project_domain_name "Default"
+    iniset $NOVA_CONF placement project_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the

From 53a49d104a59678ec36c5b8f4406ad51d69cf5f7 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Fri, 23 Dec 2016 16:16:50 -0600
Subject: [PATCH 1692/3333] Add virt driver 'zun' to devstack

According to the feedback in the TC meeting [1], we renamed the Nova
virt driver from "docker" to "zun" [2] to avoid name collision
to nova-docker. This rename also help to clarify the difference
between these two drivers.

[1] http://eavesdrop.openstack.org/meetings/tc/2016/
    tc.2016-11-29-20.01.log.html
[2] https://review.openstack.org/#/c/414651/

Change-Id: I747080953ae4d1d35ed334831100413b6e4466c4
---
 lib/nova | 2 +-
 stackrc  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 50c0d4708e..8f11e0f311 100644
--- a/lib/nova
+++ b/lib/nova
@@ -823,7 +823,7 @@ function start_nova_compute {
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
-    elif [[ "$VIRT_DRIVER" = 'docker' ]]; then
+    elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
diff --git a/stackrc b/stackrc
index 7ce6c513b0..19f5b53372 100644
--- a/stackrc
+++ b/stackrc
@@ -573,7 +573,7 @@ case "$VIRT_DRIVER" in
     lxd)
         LXD_GROUP=${LXD_GROUP:-"lxd"}
         ;;
-    docker)
+    docker|zun)
         DOCKER_GROUP=${DOCKER_GROUP:-"docker"}
         ;;
     fake)

From 85879f1f8157a60fc190eb2731e4edd0deb1dae3 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 4 Jan 2017 19:51:50 -0500
Subject: [PATCH 1693/3333] Use the installed swift scripts

This commit switches how scripts we use to launch the installed version
in the path. Previously the scripts were manually executed in the source
repo, but this has issues if you're trying to run with py3 in a system
where python == py2. Setuptools already does the shebang magic for us
at install time, so we just need to use the installed version of the
script.

Change-Id: Iaa4d80ec607a2aa200400330e16cad3a4ca782ac
---
 lib/swift | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index b175f2e5c1..761ae74b6b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -809,10 +809,10 @@ function start_swift {
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
-    run_process s-proxy "$SWIFT_DIR/bin/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
+    run_process s-proxy "swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
         for type in object container account; do
-            run_process s-${type} "$SWIFT_DIR/bin/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
+            run_process s-${type} "swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
         done
     fi
 

From 0f97841dfa0187a34f3345ba5f6e58d398e82832 Mon Sep 17 00:00:00 2001
From: yatin <yatin.karel@nectechnologies.in>
Date: Thu, 5 Jan 2017 12:32:57 +0530
Subject: [PATCH 1694/3333] Remove duplicate entry for flat_networks

Currently if PHYSICAL_NETWORK and PUBLIC_PHYSICAL_NETWORK are
same then duplicate entry is created in ml2_conf.ini like below:
flat_networks = public,public,

With this patch, if PHYSICAL_NETWORK and PUBLIC_PHYSICAL_NETWORK
are same then add only PHYSICAL_NETWORK to flat_networks in
ml2_conf.ini

Change-Id: Iae4d1ee3882f6d96b4e4abd52ecc673a620563b5
Closes-Bug: #1654148
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e429714f06..d798929d36 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -105,7 +105,7 @@ function neutron_plugin_configure_service {
             if [[ -n "$PHYSICAL_NETWORK" ]]; then
                 Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PHYSICAL_NETWORK},"
             fi
-            if [[ -n "$PUBLIC_PHYSICAL_NETWORK" ]]; then
+            if [[ -n "$PUBLIC_PHYSICAL_NETWORK" ]] && [[ "${PHYSICAL_NETWORK}" != "$PUBLIC_PHYSICAL_NETWORK" ]]; then
                 Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PUBLIC_PHYSICAL_NETWORK},"
             fi
         fi

From 80f3635521c23235b75c6a9cbb8e8edcaf667ae6 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 2 Jan 2017 09:30:16 -0500
Subject: [PATCH 1695/3333] Run Swift services under py35

* iniuncomment followed by iniset for reseller_prefix just adds a
  duplicate line in the config file that configparser does not like
  so just remove the uncomment
* fall back to http:// url for glance->swift keystone authentication
* insecure flag to talk to swift

Depends-On: I51d56d16a5b175bd45dee09edc0b2748d72a5d06
Change-Id: I02ed01e20f8dce195c51273e8384130af53384ce
---
 lib/glance | 11 ++++++++++-
 lib/swift  |  1 -
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index da9cd43536..4ba1d20bd7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -161,6 +161,9 @@ function configure_glance {
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift
         iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
+        if python3_enabled; then
+            iniset $GLANCE_API_CONF glance_store swift_store_auth_insecure True
+        fi
 
         iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
         iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
@@ -186,7 +189,13 @@ function configure_glance {
         fi
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+        if python3_enabled; then
+            # NOTE(dims): Currently the glance_store+swift does not support either an insecure flag
+            # or ability to specify the CACERT. So fallback to http:// url
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address ${KEYSTONE_SERVICE_URI/https/http}/v3
+        else
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+        fi
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
diff --git a/lib/swift b/lib/swift
index b175f2e5c1..aafe09d310 100644
--- a/lib/swift
+++ b/lib/swift
@@ -454,7 +454,6 @@ function configure_swift {
     # out. Make sure we uncomment Tempauth after we uncomment Keystoneauth
     # otherwise, this code also sets the reseller_prefix for Keystoneauth.
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
-    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix "TEMPAUTH"
 
     if is_service_enabled swift3; then

From b51a8862b1f80a947815094148bc229ba3d58ae1 Mon Sep 17 00:00:00 2001
From: Rodrigo Duarte <rduartes@redhat.com>
Date: Mon, 26 Sep 2016 15:22:35 -0300
Subject: [PATCH 1696/3333] Adds keystone security compliance settings

The PCI-DSS feature has been introduced during the Newton
release and its settings are disabled by default. This
patch adds the possibility to enable some of them during
DevStack setup.

Change-Id: If6b5eb3e3cbc43eb241c94d18af80ad50be08772
Depends-On: Id97ca26f93b742cc3d8d49e98afc581f22360504
---
 lib/keystone | 12 ++++++++++++
 lib/tempest  |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 825fe44fca..34730b892a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -131,6 +131,12 @@ fi
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
 KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 
+# Security compliance
+KEYSTONE_SECURITY_COMPLIANCE_ENABLED=${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-True}
+KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS=${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}
+KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-5}
+KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
+
 
 # Functions
 # ---------
@@ -339,6 +345,12 @@ function configure_keystone {
     # allows policy changes in order to clarify the adminess scope.
     #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
     #iniset $KEYSTONE_CONF resource admin_project_name admin
+
+    if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
+        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
+        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
+        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
+    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index 3915c570ee..4b8fbb7a46 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -261,6 +261,9 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
+    iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
+    iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION
+    iniset $TEMPEST_CONFIG identity user_unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation
     iniset $TEMPEST_CONFIG identity admin_domain_scope True
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
@@ -285,6 +288,9 @@ function configure_tempest {
     fi
 
     # Identity Features
+    if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
+        iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
+    fi
     # TODO(rodrigods): Remove the reseller flag when Kilo and Liberty are end of life.
     iniset $TEMPEST_CONFIG identity-feature-enabled reseller True
 

From 51ecf0a869720ae5e8845b95fd2973b2760dcecf Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 5 Jan 2017 16:11:17 -0500
Subject: [PATCH 1697/3333] Introduce a PYTHON env var

* $PYTHON will have the path to python runtime to be used
* Use $PYTHON to run all the scripts

Change-Id: Ib5ab7820fc18cae5e50ea47302b610494197ad47
---
 functions-common         |  6 +++---
 lib/horizon              | 12 ++----------
 tools/install_prereqs.sh |  3 +++
 3 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 8d03b88d24..8d32bb4148 100644
--- a/functions-common
+++ b/functions-common
@@ -87,7 +87,7 @@ function write_clouds_yaml {
         CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
     fi
     # demo -> devstack
-    $TOP_DIR/tools/update_clouds_yaml.py \
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack \
         --os-region-name $REGION_NAME \
@@ -99,7 +99,7 @@ function write_clouds_yaml {
         --os-project-name demo
 
     # alt_demo -> devstack-alt
-    $TOP_DIR/tools/update_clouds_yaml.py \
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-alt \
         --os-region-name $REGION_NAME \
@@ -111,7 +111,7 @@ function write_clouds_yaml {
         --os-project-name alt_demo
 
     # admin -> devstack-admin
-    $TOP_DIR/tools/update_clouds_yaml.py \
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
         --os-region-name $REGION_NAME \
diff --git a/lib/horizon b/lib/horizon
index 4cabbe483c..9c7ec005a2 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -81,11 +81,7 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    if python3_enabled; then
-        (cd $HORIZON_DIR; python${PYTHON3_VERSION} manage.py compilemessages)
-    else
-        (cd $HORIZON_DIR; python manage.py compilemessages)
-    fi
+    (cd $HORIZON_DIR; $PYTHON manage.py compilemessages)
 
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
@@ -166,11 +162,7 @@ function install_django_openstack_auth {
         git_clone_by_name "django_openstack_auth"
         # Compile message catalogs before installation
         _prepare_message_catalog_compilation
-        if python3_enabled; then
-            (cd $dir; python${PYTHON3_VERSION} setup.py compile_catalog)
-        else
-            (cd $dir; python setup.py compile_catalog)
-        fi
+        (cd $dir; $PYTHON setup.py compile_catalog)
         setup_dev_lib "django_openstack_auth"
     fi
     # if we aren't using this library from git, then we just let it
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 8895e1e77c..da59093581 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -83,6 +83,9 @@ fi
 
 if python3_enabled; then
     install_python3
+    export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null || which python3 2>/dev/null)
+else
+    export PYTHON=$(which python 2>/dev/null)
 fi
 
 # Mark end of run

From 09698d0e0e21f2cb401418db94d725d305acdc7d Mon Sep 17 00:00:00 2001
From: Vincent Untz <vuntz@suse.com>
Date: Fri, 6 Jan 2017 11:25:46 +0100
Subject: [PATCH 1698/3333] Fix typo in commands to enable nested KVM with
 kvm-amd

Change-Id: Ie3c6df2409385d9c6bbc50b3b1f8b20689478466
---
 doc/source/guides/devstack-with-nested-kvm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 85a5656198..3732f06fd8 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -73,7 +73,7 @@ back:
 ::
 
     sudo rmmod kvm-amd
-    sudo sh -c "echo 'options amd nested=1' >> /etc/modprobe.d/dist.conf"
+    sudo sh -c "echo 'options kvm-amd nested=1' >> /etc/modprobe.d/dist.conf"
     sudo modprobe kvm-amd
 
 Ensure the Nested KVM Kernel module parameter for AMD is enabled on the

From 0c6956862e6ac1cdb51b674c872183074df98c50 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 23 Dec 2016 14:35:45 +0000
Subject: [PATCH 1699/3333] Remove default image logic for Ironic from DevStack

The logic to set the default image for Ironic has been moved into the
Ironic tree. This patch is just removing it from DevStack.

Change-Id: Iaeb177f194adc83e40d86696e5553f9f72bbd1f9
Depends-On: Id828b41dc44113ce1cd094ce5fc245989699d4ff
---
 stackrc | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/stackrc b/stackrc
index 19f5b53372..d8d0ee4b3e 100644
--- a/stackrc
+++ b/stackrc
@@ -647,14 +647,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
         ironic)
-            # Ironic can do both partition and full disk images, depending on the driver
-            if [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]]; then
-                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-disk}
-            else
-                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}
-            fi
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz"
-            IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-disk.img";;
+            # NOTE(lucasagomes): The logic setting the default image
+            # now lives in the Ironic tree
+            ;;
         *) # Default to Cirros with kernel, ramdisk and disk image
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
             IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;

From 78c26504e28291c6e5b7d04b6fb985cc82c53bb8 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 22:53:33 +0100
Subject: [PATCH 1700/3333] lib/tempest: remove the
 identity_feature_enabled.reseller flag.

Now that Liberty is EOLed, all supported versions of OpenStack have
the 'reseller' [1] feature.

[1]: http://specs.openstack.org/openstack/keystone-specs/specs/kilo/reseller.html

Change-Id: Id823f1969fbd2cf28542a0ef0f905ddae4a0318c
Depends-On: Ia86c6f351919bddf2611524bf0b143aa09dbddee
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 4b8fbb7a46..aa3877b4ab 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -291,8 +291,6 @@ function configure_tempest {
     if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
         iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
     fi
-    # TODO(rodrigods): Remove the reseller flag when Kilo and Liberty are end of life.
-    iniset $TEMPEST_CONFIG identity-feature-enabled reseller True
 
     # Image
     # We want to be able to override this variable in the gate to avoid

From c60818421152e5711fc93cab79122379c4e243aa Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Wed, 16 Nov 2016 00:40:32 -0800
Subject: [PATCH 1701/3333] XenAPI: Use XenServer DevStack plugins

Hypervisor XenServer will change to use os-xenapi in the future,
this will need DevStack changes, this patch is to remove install
Dom0 plugins part to our own DevStack plugins.

Change-Id: Ic327135b893a77672fd42af919f47f181e932773
---
 lib/nova_plugins/hypervisor-xenserver | 27 ++++++++++++++++++---------
 tools/xen/xenrc                       |  1 +
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index b053856348..0046a366c9 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -48,6 +48,21 @@ function configure_nova_hypervisor {
     if [ -z "$XENAPI_CONNECTION_URL" ]; then
         die $LINENO "XENAPI_CONNECTION_URL is not specified"
     fi
+
+    # Check os-xenapi plugin is enabled
+    local plugins="${DEVSTACK_PLUGINS}"
+    local plugin
+    local found=0
+    for plugin in ${plugins//,/ }; do
+        if [[ "$plugin" = "os-xenapi" ]]; then
+            found=1
+            break
+        fi
+    done
+    if [[ $found -ne 1 ]]; then
+        die $LINENO "os-xenapi plugin is not specified. Please enable this plugin in local.conf"
+    fi
+
     read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
     iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
     iniset $NOVA_CONF xenserver connection_url "$XENAPI_CONNECTION_URL"
@@ -64,14 +79,6 @@ function configure_nova_hypervisor {
     local ssh_dom0
     ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
 
-    # Find where the plugins should go in dom0
-    xen_functions=`cat $TOP_DIR/tools/xen/functions`
-    PLUGIN_DIR=`$ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location"`
-
-    # install nova plugins to dom0
-    tar -czf - -C $NOVA_DIR/plugins/xenserver/xenapi/etc/xapi.d/plugins/ ./ |
-        $ssh_dom0 "tar -xzf - -C $PLUGIN_DIR && chmod a+x $PLUGIN_DIR/*"
-
     # install console logrotate script
     tar -czf - -C $NOVA_DIR/tools/xenserver/ rotate_xen_guest_logs.sh |
         $ssh_dom0 'tar -xzf - -C /root/ && chmod +x /root/rotate_xen_guest_logs.sh && mkdir -p /var/log/xen/guest'
@@ -107,7 +114,9 @@ CRONTAB
 
 # install_nova_hypervisor() - Install external components
 function install_nova_hypervisor {
-    pip_install_gr xenapi
+    # xenapi functionality is now included in os-xenapi library which houses the plugin
+    # so this function intentionally left blank
+    :
 }
 
 # start_nova_hypervisor - Start any required external services
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index bb27454e30..2161247b76 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -101,6 +101,7 @@ set +u
 
 ## Note that the lines below are coming from stackrc to support
 ## new-style config files
+source $RC_DIR/functions-common
 
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then

From 94129c7d02902e0f000c09c8245be341df1c5965 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Mon, 9 Jan 2017 21:24:24 +0000
Subject: [PATCH 1702/3333] allow config to manage python3 use explicitly

Add variables ENABLED_PYTHON3_PACKAGES and DISABLED_PYTHON3_PACKAGES to
work like ENABLED_SERVICES and DISABLED_SERVICES and to manage which
packages are installed using Python 3. Move the list of whitelisted
packages in pip_install to the default for ENABLED_PYTHON3_PACKAGES,
except swift which is not enabled by default for now.

Add enable_python3_package and disable_python3_package functions to make
editing the variables from local.conf easier.

Add python3_enabled_for and python3_disabled_for functions to check the
settings against packages being installed by pip.

Update pip_install to check if python3 is disabled for a service, then
see if it is explicitly enabled, and only then fall back to looking at
the classifiers in the packaging metadata.

Update pip_install messages to give more detail about why the choice
between python 2 and 3 is being made for a given package.

Change-Id: I69857d4e11f4767928614a3b637c894bcd03491f
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 inc/python           | 119 ++++++++++++++++++++++++++++++++++++++++---
 stackrc              |  12 ++++-
 tests/test_python.sh |  30 +++++++++++
 3 files changed, 153 insertions(+), 8 deletions(-)
 create mode 100755 tests/test_python.sh

diff --git a/inc/python b/inc/python
index 5a9a9ed588..1c581ba22b 100644
--- a/inc/python
+++ b/inc/python
@@ -97,6 +97,111 @@ function check_python3_support_for_package_remote {
     echo $classifier
 }
 
+# python3_enabled_for() checks if the service(s) specified as arguments are
+# enabled by the user in ``ENABLED_PYTHON3_PACKAGES``.
+#
+# Multiple services specified as arguments are ``OR``'ed together; the test
+# is a short-circuit boolean, i.e it returns on the first match.
+#
+# Uses global ``ENABLED_PYTHON3_PACKAGES``
+# python3_enabled_for dir [dir ...]
+function python3_enabled_for {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local enabled=1
+    local dirs=$@
+    local dir
+    for dir in ${dirs}; do
+        [[ ,${ENABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
+    done
+
+    $xtrace
+    return $enabled
+}
+
+# python3_disabled_for() checks if the service(s) specified as arguments are
+# disabled by the user in ``DISABLED_PYTHON3_PACKAGES``.
+#
+# Multiple services specified as arguments are ``OR``'ed together; the test
+# is a short-circuit boolean, i.e it returns on the first match.
+#
+# Uses global ``DISABLED_PYTHON3_PACKAGES``
+# python3_disabled_for dir [dir ...]
+function python3_disabled_for {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local enabled=1
+    local dirs=$@
+    local dir
+    for dir in ${dirs}; do
+        [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
+    done
+
+    $xtrace
+    return $enabled
+}
+
+# enable_python3_package() adds the repositories passed as argument to the
+# ``ENABLED_PYTHON3_PACKAGES`` list, if they are not already present.
+#
+# For example:
+#   enable_python3_package nova
+#
+# Uses global ``ENABLED_PYTHON3_PACKAGES``
+# enable_python3_package dir [dir ...]
+function enable_python3_package {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local tmpsvcs="${ENABLED_PYTHON3_PACKAGES}"
+    local python3
+    for dir in $@; do
+        if [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]]; then
+            warn $LINENO "Attempt to enable_python3_package ${dir} when it has been disabled"
+            continue
+        fi
+        if ! python3_enabled_for $dir; then
+            tmpsvcs+=",$dir"
+        fi
+    done
+    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$tmpsvcs")
+
+    $xtrace
+}
+
+# disable_python3_package() prepares the services passed as argument to be
+# removed from the ``ENABLED_PYTHON3_PACKAGES`` list, if they are present.
+#
+# For example:
+#   disable_python3_package swift
+#
+# Uses globals ``ENABLED_PYTHON3_PACKAGES`` and ``DISABLED_PYTHON3_PACKAGES``
+# disable_python3_package dir [dir ...]
+function disable_python3_package {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local disabled_svcs="${DISABLED_PYTHON3_PACKAGES}"
+    local enabled_svcs=",${ENABLED_PYTHON3_PACKAGES},"
+    local dir
+    for dir in $@; do
+        disabled_svcs+=",$dir"
+        if python3_enabled_for $dir; then
+            enabled_svcs=${enabled_svcs//,$dir,/,}
+        fi
+    done
+    DISABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$disabled_svcs")
+    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$enabled_svcs")
+
+    $xtrace
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
@@ -149,16 +254,16 @@ function pip_install {
                 # support for python3 in progress, but don't claim support
                 # in their classifier
                 echo "Check python version for : $package_dir"
-                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || \
-                        ${package_dir##*/} == "cinder" || ${package_dir##*/} == "swift" || \
-                        ${package_dir##*/} == "uwsgi" ]]; then
-                    echo "Using $PYTHON3_VERSION version to install $package_dir"
+                if python3_disabled_for ${package_dir##*/}; then
+                    echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
+                elif python3_enabled_for ${package_dir##*/}; then
+                    echo "Explicitly using $PYTHON3_VERSION version to install $package_dir based on ENABLED_PYTHON3_PACKAGES"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                 elif [[ -d "$package_dir" ]]; then
                     python_versions=$(get_python_versions_for_package $package_dir)
                     if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
-                        echo "Using $PYTHON3_VERSION version to install $package_dir"
+                        echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on classifiers"
                         sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                     else
@@ -167,7 +272,7 @@ function pip_install {
                         # a warning.
                         python3_classifier=$(check_python3_support_for_package_local $package_dir)
                         if [[ ! -z "$python3_classifier" ]]; then
-                            echo "Using $PYTHON3_VERSION version to install $package_dir"
+                            echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on local package settings"
                             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                             cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                         fi
@@ -177,7 +282,7 @@ function pip_install {
                     package=$(echo $package_dir | grep -o '^[.a-zA-Z0-9_-]*')
                     python3_classifier=$(check_python3_support_for_package_remote $package)
                     if [[ ! -z "$python3_classifier" ]]; then
-                        echo "Using $PYTHON3_VERSION version to install $package"
+                        echo "Automatically using $PYTHON3_VERSION version to install $package based on remote package settings"
                         sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                     fi
diff --git a/stackrc b/stackrc
index 19f5b53372..ae7177214f 100644
--- a/stackrc
+++ b/stackrc
@@ -102,9 +102,19 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
 fi
 
-# Control whether Python 3 should be used.
+# Control whether Python 3 should be used at all.
 export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
+# Control whether Python 3 is enabled for specific services by the
+# base name of the directory from which they are installed. See
+# enable_python3_package to edit this variable and use_python3_for to
+# test membership.
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi"
+
+# Explicitly list services not to run under Python 3. See
+# disable_python3_package to edit this variable.
+export DISABLED_PYTHON3_PACKAGES=""
+
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
diff --git a/tests/test_python.sh b/tests/test_python.sh
new file mode 100755
index 0000000000..8652798778
--- /dev/null
+++ b/tests/test_python.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Tests for DevStack INI functions
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+source $TOP/functions-common
+source $TOP/inc/python
+
+source $TOP/tests/unittest.sh
+
+echo "Testing Python 3 functions"
+
+# Initialize variables manipulated by functions under test.
+export ENABLED_PYTHON3_PACKAGES=""
+export DISABLED_PYTHON3_PACKAGES=""
+
+assert_false "should not be enabled yet" python3_enabled_for testpackage1
+
+enable_python3_package testpackage1
+assert_equal "$ENABLED_PYTHON3_PACKAGES" "testpackage1"  "unexpected result"
+assert_true "should be enabled" python3_enabled_for testpackage1
+
+assert_false "should not be disabled yet" python3_disabled_for testpackage2
+
+disable_python3_package testpackage2
+assert_equal "$DISABLED_PYTHON3_PACKAGES" "testpackage2"  "unexpected result"
+assert_true "should be disabled" python3_disabled_for testpackage2
+
+report_results

From a2eb89417fbb6d61526b1819cbe3d0a60537eedd Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Mon, 9 Jan 2017 22:11:49 +0000
Subject: [PATCH 1703/3333] install LIBS_FROM_GIT using python 2 and 3 where
 appropriate

When installing a library from source and python 3 is enabled, first run
the installation process with python 2 enabled to ensure the library is
also installed under python 2 for any services not yet running under
3. The python 3 version is installed second so that command line tools
installed with libraries are installed under python 3 when python 3 is
enabled.

Change-Id: Ibb0f7a68d21081bf7652a0c1515080c0c54888ca
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 inc/python | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/inc/python b/inc/python
index 1c581ba22b..086056350f 100644
--- a/inc/python
+++ b/inc/python
@@ -399,6 +399,16 @@ function setup_lib {
 function setup_dev_lib {
     local name=$1
     local dir=${GITDIR[$name]}
+    if python3_enabled; then
+        # Turn off Python 3 mode and install the package again,
+        # forcing a Python 2 installation. This ensures that all libs
+        # being used for development are installed under both versions
+        # of Python.
+        echo "Installing $name again without Python 3 enabled"
+        USE_PYTHON3=False
+        setup_develop $dir
+        USE_PYTHON3=True
+    fi
     setup_develop $dir
 }
 

From 14e16e42f95cd02aaee1db0d5357027ea81a50e2 Mon Sep 17 00:00:00 2001
From: Pushkar Umaranikar <pushkar.umaranikar@intel.com>
Date: Fri, 9 Dec 2016 20:20:42 +0000
Subject: [PATCH 1704/3333] Setup service user configuration in nova.conf

In Nova, service token will be passed along with user token to communicate
with services when dealing with long running tasks like live migration.

This change addresses adding service user configuration for nova in
devstack.

Part of Nova blueprint use-service-tokens

Depends-On: I51eb0a8937fa39a2e5dafb1ad915e7113ea61f72

Co-Authored-By: Sarafraj Singh <sarafraj.singh@intel.com>

Change-Id: I2d7348c4a72af96c0ed2ef6c0ab75d16e9aec8fc
---
 lib/nova | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/nova b/lib/nova
index 8f11e0f311..bdfab3dea9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -161,6 +161,14 @@ NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
 TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
 TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 
+# Other Nova configurations
+# ----------------------------
+
+# ``NOVA_USE_SERVICE_TOKEN`` is a mode where service token is passed along with
+# user token while communicating to external RESP API's like Neutron, Cinder
+# and Glance.
+NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
+
 # Functions
 # ---------
 
@@ -619,6 +627,22 @@ function create_nova_conf {
     fi
 
     iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+
+    if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
+        init_nova_service_user_conf
+    fi
+}
+
+function init_nova_service_user_conf {
+    iniset $NOVA_CONF service_user send_service_user_token True
+    iniset $NOVA_CONF service_user auth_type password
+    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT"
+    iniset $NOVA_CONF service_user username nova
+    iniset $NOVA_CONF service_user password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF service_user project_name "$SERVICE_PROJECT_NAME"
+    iniset $NOVA_CONF service_user project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
 function init_nova_cells {

From afac732d5d9b03da7abbd61f814c2f0d1a9039da Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 11 Jan 2017 18:45:27 +0100
Subject: [PATCH 1705/3333] lib/tempest: allow tweaking
 volume-feature-enabled/manage_snapshot

Only a few Cinder backends support the 'manage snapshot' feature. So
we need a feature flag here. Luckily the LVM driver does support this
feature so default the feature flag to True in devstack(/Gate) but
introduce a variable to tweak the config.

Change-Id: Ifcb9f91059f08bdf2faf2a8d65229aba5742ee1c
Depends-On: I77be1cf85a946bf72e852f6378f0d7b43af8023a
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index aa3877b4ab..60ba542894 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -434,6 +434,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
+    iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse True TEMPEST_VOLUME_MANAGE_SNAPSHOT)
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 92575baa6b010ec09fea3e715030da8be61c0c64 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 21 Sep 2016 16:15:31 -0400
Subject: [PATCH 1706/3333] tempest: configure
 compute-feature-enabled.swap_volume if libvirt

The only virt driver in nova that supports the swap volume API is
libvirt so enable testing that in Tempest only if using libvirt.

Depends on two changes:

1. The Tempest change that adds the new config option and test.

Depends-On: I2d4779de8d21aa84533f4f92d347e932db2de58e

2. A nova fix for correctly waiting for the block copy job in the guest
   to complete.

Depends-On: I0c52917a5555a70c4973f37dea1aebf878dd73b4

Change-Id: Ibb6b309574d2c6a06fcecb0626ea21527fb7f412
---
 lib/tempest | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index aa3877b4ab..2f2721311e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -508,13 +508,17 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
     fi
 
-    # Libvirt-LXC
-    if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
-        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
-        iniset $TEMPEST_CONFIG compute-feature-enabled resize False
-        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
-        iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
-        iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+    # Libvirt
+    if [ "$VIRT_DRIVER" = "libvirt" ]; then
+        # Libvirt-LXC
+        if [ "$LIBVIRT_TYPE" = "lxc" ]; then
+            iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
+            iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+            iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
+            iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
+            iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+        fi
+        iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
     fi
 
     # ``service_available``

From e194330f2753c8cacbcb18668ee32b4722cba2ec Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 4 Jan 2017 07:26:58 -0800
Subject: [PATCH 1707/3333] Don't skip cellsv2 setup for cellsv1

Since cellsv2 setup is no longer optional, we can't even exclude
cellsv1 from this step. Since cellsv1 users can't use the simple
command, this does the individual steps as needed.

Depends-On: Icfbb17cce8ce8b03dc8b7b4ffb202db01e5218a6
Change-Id: I3c9101a34b2bb0804fc4deda62dbb8637e7b8f94
---
 lib/nova | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index d5db5eaeb7..cb3ec51d6c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -948,7 +948,11 @@ function create_cell {
     if ! is_service_enabled n-cell; then
         nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
     else
-        echo 'Skipping cellsv2 setup for this cellsv1 configuration'
+        # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
+        (nova-manage cell_v2 map_cell0 || true)
+        nova-manage --config-file $NOVA_CELLS_CONF  --verbose cell_v2 map_cell_and_hosts \
+                --transport-url $(get_transport_url child_cell) --name 'cell1'
+        nova-manage db sync
     fi
 }
 

From 1ec93a8fc21850c98fbfd4b292d329b4349e5cff Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Thu, 12 Jan 2017 16:11:11 -0500
Subject: [PATCH 1708/3333] Create private IPv6 subnet specifying mode flags

$ipv6_modes should always be passed when creating the
default IPv6 subnet, not just when fixed_range_v6 is
set.  Without it the default was DHCPv6, which cirros
doesn't support out of the box.  Was broken in
change-over from neutron to openstack cli.

Change-Id: Iadd39b1ce02fe0b3781bd3ae04adfd20d7e12d9f
Closes-bug: #1656098
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index cd0c1ed59a..cead46ff3b 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -292,8 +292,8 @@ function _neutron_create_private_subnet_v6 {
         subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     fi
     subnet_params+="${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} "
-    subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6 $ipv6_modes} "
-    subnet_params+="--network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
+    subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
     ipv6_subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"

From dd07151366175e8f9c61c4a1eabde4ed5d38dd62 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 13 Jan 2017 07:11:15 +0000
Subject: [PATCH 1709/3333] Updated from generate-devstack-plugins-list

Change-Id: I65fd56546af13453274601ec2b923c5d03b8a8ab
---
 doc/source/plugin-registry.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cb9c437458..4cfbcb16ba 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -82,6 +82,7 @@ masakari                               `git://git.openstack.org/openstack/masaka
 meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
+mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
@@ -121,7 +122,6 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-nimble                                 `git://git.openstack.org/openstack/nimble <https://git.openstack.org/cgit/openstack/nimble>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
@@ -129,6 +129,7 @@ nova-mksproxy                          `git://git.openstack.org/openstack/nova-m
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__

From b612b6281a424556f6ed30d421214d0aa32ded55 Mon Sep 17 00:00:00 2001
From: Victor Morales <victor.morales@intel.com>
Date: Thu, 12 Jan 2017 19:53:07 -0600
Subject: [PATCH 1710/3333] Use delete action for clean up *.pyc files

Findutils added in release 4.2.3 a new --delete action for deleting
matching files. This action performs better than -exec rm {} \;
because it doesn't have to spawn an external process.  This change
uses a new action whenever is possible.

Change-Id: Iff16a86b18e924cfe78ac7c6107910940ce51e03
---
 clean.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index e369eda26c..90b21eb353 100755
--- a/clean.sh
+++ b/clean.sh
@@ -149,5 +149,10 @@ rm -rf ~/.config/openstack
 
 # Clean up all *.pyc files
 if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
-    sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
+    find_version=`find --version | awk '{ print $NF; exit}'`
+    if vercmp "$find_version" "<" "4.2.3" ; then
+        sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
+    else
+        sudo find $DEST -name "*.pyc" -delete
+    fi
 fi

From 29bb53fd3e7762c1fea023842ba09fcbfab60252 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Sun, 15 Jan 2017 09:50:40 -0800
Subject: [PATCH 1711/3333] Fix cellsv2 cell0 database name

For some reason we were defaulting the name of the cell0 database
to nova_api_cell0 instead of nova_cell0. Devstack inherited that to
make things work, but we don't really want that. This patch makes us
use the proper name and create the cell0 mapping accordingly. As a
side effect, it also starts the process of unifying the cellsv1 and
cellsv2 paths by creating the cell0 mapping the same for both.

Change-Id: I4e7f6c5eaa068c98e5c4ef3feaee50d8e4f5d484
---
 lib/nova | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index cb3ec51d6c..d8bc6c9593 100644
--- a/lib/nova
+++ b/lib/nova
@@ -678,10 +678,10 @@ function init_nova {
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova databases
         recreate_database nova
-        recreate_database nova_api_cell0
+        recreate_database nova_cell0
 
         # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
-        # been run this migrates the "nova" and "nova_api_cell0" database.
+        # been run this migrates the "nova" and "nova_cell0" database.
         # Otherwise it just migrates the "nova" database.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
@@ -945,11 +945,12 @@ function create_flavors {
 
 # create_cell(): Group the available hosts into a cell
 function create_cell {
+    # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
+    (nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`|| true)
+
     if ! is_service_enabled n-cell; then
         nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
     else
-        # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
-        (nova-manage cell_v2 map_cell0 || true)
         nova-manage --config-file $NOVA_CELLS_CONF  --verbose cell_v2 map_cell_and_hosts \
                 --transport-url $(get_transport_url child_cell) --name 'cell1'
         nova-manage db sync

From ba3c8f48bb07707e421f1c5aac5acedd1e63d3fd Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sun, 15 Jan 2017 20:07:04 -0800
Subject: [PATCH 1712/3333] Change the way to get conntrack-tools version

In the incoming XenServer, it failed to install conntrack-tools
in Dom0 due to the bash script which is trying to find the correct
CentOS release version to be used in yum command. This patch is to
fix the problem

Change-Id: If7f169e118ccb7c29fc479c361417a916dc40b40
---
 tools/xen/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/functions b/tools/xen/functions
index e1864eb4bb..93f3413d6d 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -317,7 +317,7 @@ function install_conntrack_tools {
         # Only support conntrack-tools in Dom0 with XS7.0 and above
         if [ ! -f /usr/sbin/conntrackd ]; then
             sed -i s/#baseurl=/baseurl=/g /etc/yum.repos.d/CentOS-Base.repo
-            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'.' -f1-2 | tr '-' '.')
+            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'/' -f 1 | cut -d'-' -f 1)
             yum install -y --enablerepo=base --releasever=$centos_ver conntrack-tools
             # Backup conntrackd.conf after install conntrack-tools, use the one with statistic mode
             mv /etc/conntrackd/conntrackd.conf /etc/conntrackd/conntrackd.conf.back

From 3eb7c97a6ddc4780ebcb833c1b86cf4b86b5e14d Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Fri, 13 Jan 2017 11:44:54 -0800
Subject: [PATCH 1713/3333] Restrict enabling the manage_snapshot volume
 feature

The test that is in tempest for this feature is
specific to LVM and will *not* work for other backends
regardless of them supporting the feature. It shouldn't
default to enabled for everyone, only for LVM.

If others want to opt-in they can, but its definitely
the minority that would.

Change-Id: I21347f2a5069059e6413208b254d5acd246faaea
---
 lib/tempest | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 5a072291f1..deffcfae61 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -434,7 +434,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
-    iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse True TEMPEST_VOLUME_MANAGE_SNAPSHOT)
+    # Only turn on TEMPEST_VOLUME_MANAGE_SNAPSHOT by default for "lvm" backends
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
+        TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse False TEMPEST_VOLUME_MANAGE_SNAPSHOT)
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 1b457c9acfe7c0bcf7ba06dd4029d1e4ef9cdded Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 18 Jan 2017 07:53:33 -0500
Subject: [PATCH 1714/3333] remove db setting when no nova service need it

We shouldn't have the db connection laying around if services don't
need it.

Change-Id: I9290e80c499c0c4644094e3c0666fd0ab002a23c
---
 lib/nova | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 450242b579..3e29c1320d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -465,8 +465,6 @@ function create_nova_conf {
     else
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
     fi
-    iniset $NOVA_CONF database connection `database_connection_url nova`
-    iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
@@ -478,6 +476,14 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
+    # only setup database connections if there are services that
+    # require them running on the host. The ensures that n-cpu doesn't
+    # leak a need to use the db in a multinode scenario.
+    if is_service_enabled n-api n-cond n-sched; then
+        iniset $NOVA_CONF database connection `database_connection_url nova`
+        iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
+    fi
+
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From f80e2cfee85a200ba204ac00bada74695abcd964 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 18 Jan 2017 15:42:32 -0500
Subject: [PATCH 1715/3333] add install_devstack_tools

An initial install for devstack-tools, this will need to use all the
fun pip extra variables for installation, however the current
pip_install always prefers python2, and we only want to do python3
here.

Change-Id: I3dcdb35130f76fad81cb7b0d4001b7e96efbbd84
---
 inc/python | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/inc/python b/inc/python
index 04cde34fe1..5afc07f636 100644
--- a/inc/python
+++ b/inc/python
@@ -441,6 +441,13 @@ function install_python3 {
     fi
 }
 
+function install_devstack_tools {
+    # intentionally old to ensure devstack-gate has control
+    local dstools_version=${DSTOOLS_VERSION:-0.1.2}
+    install_python3
+    sudo pip3 install -U devstack-tools==${dstools_version}
+}
+
 # Restore xtrace
 $INC_PY_TRACE
 

From b6753cea8cd0e07d982048d2f856c6168fc74a92 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 5 Apr 2016 11:52:44 -0400
Subject: [PATCH 1716/3333] simplify colorized logging setup

This makes setup_colorized_logging be a thing which takes a single
parameter and doesn't let projects do things differently. It also
changes the order of values from user / project to project / user to
represent the hierachy more clearly.

Change-Id: I8c0ba7da54be588e3e068734feb4f78ed7c5a14a
---
 functions          | 8 ++++----
 lib/cinder         | 2 +-
 lib/glance         | 6 +++---
 lib/keystone       | 2 +-
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 6 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/functions b/functions
index 0be9794d9a..3e0e0d5559 100644
--- a/functions
+++ b/functions
@@ -578,11 +578,11 @@ function vercmp {
 # setup_colorized_logging something.conf SOMESECTION
 function setup_colorized_logging {
     local conf_file=$1
-    local conf_section=$2
-    local project_var=${3:-"project_name"}
-    local user_var=${4:-"user_name"}
+    local conf_section="DEFAULT"
+    local project_var="project_name"
+    local user_var="user_name"
     # Add color to logging output
-    iniset $conf_file $conf_section logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %("$user_var")s %("$project_var")s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
diff --git a/lib/cinder b/lib/cinder
index 40f0f16d6b..cf5bb25cfe 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -334,7 +334,7 @@ function configure_cinder {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-        setup_colorized_logging $CINDER_CONF DEFAULT "project_id" "user_id"
+        setup_colorized_logging $CINDER_CONF
     else
         # Set req-id, project-name and resource in log format
         iniset $CINDER_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(project_name)s] %(resource)s%(message)s"
diff --git a/lib/glance b/lib/glance
index 4ba1d20bd7..17361143df 100644
--- a/lib/glance
+++ b/lib/glance
@@ -230,8 +230,8 @@ function configure_glance {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $GLANCE_API_CONF DEFAULT tenant user
-        setup_colorized_logging $GLANCE_REGISTRY_CONF DEFAULT tenant user
+        setup_colorized_logging $GLANCE_API_CONF
+        setup_colorized_logging $GLANCE_REGISTRY_CONF
     fi
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
@@ -273,7 +273,7 @@ function configure_glance {
     if is_service_enabled g-glare; then
         local dburl
         dburl=`database_connection_url glance`
-        setup_colorized_logging $GLANCE_GLARE_CONF DEFAULT tenant user
+        setup_colorized_logging $GLANCE_GLARE_CONF
         iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
diff --git a/lib/keystone b/lib/keystone
index 34730b892a..474af8be1d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -284,7 +284,7 @@ function configure_keystone {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" != "mod_wsgi" ] ; then
-        setup_colorized_logging $KEYSTONE_CONF DEFAULT
+        setup_colorized_logging $KEYSTONE_CONF
     fi
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 29c187e1e1..cf59b2d6dd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -733,7 +733,7 @@ function _configure_neutron_common {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
+        setup_colorized_logging $NEUTRON_CONF
     else
         # Show user_name and project_name by default like in nova
         iniset $NEUTRON_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
diff --git a/lib/nova b/lib/nova
index 450242b579..617cf5c3aa 100644
--- a/lib/nova
+++ b/lib/nova
@@ -520,7 +520,7 @@ function create_nova_conf {
     fi
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$NOVA_USE_MOD_WSGI" == "False" ]  ; then
-        setup_colorized_logging $NOVA_CONF DEFAULT
+        setup_colorized_logging $NOVA_CONF
     else
         # Show user_name and project_name instead of user_id and project_id
         iniset $NOVA_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"

From 9751be66fa45681d069af200632515c3693833d0 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 5 Apr 2016 12:08:57 -0400
Subject: [PATCH 1717/3333] unify logging setup on all services

This provides a single setup_logging function which builds consistent
colorization if the config supports it, otherwise builds the identity
strings that we need to actually keep track of requests.

Change-Id: Iffe30326a5b974ad141aed6288f61e0d6fd18ca9
---
 functions          | 18 ++++++++++++++++++
 lib/cinder         |  7 +------
 lib/glance         |  8 +++-----
 lib/neutron-legacy |  7 +------
 lib/nova           |  8 ++------
 5 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/functions b/functions
index 3e0e0d5559..89ee3672d3 100644
--- a/functions
+++ b/functions
@@ -569,6 +569,19 @@ function vercmp {
     esac
 }
 
+# This sets up defaults we like in devstack for logging for tracking
+# down issues, and makes sure everything is done the same between
+# projects.
+function setup_logging {
+    local conf_file=$1
+    local other_cond=${2:-"False"}
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
+        setup_colorized_logging $conf_file
+    else
+        setup_standard_logging_identity $conf_file
+    fi
+}
+
 # This function sets log formatting options for colorizing log
 # output to stdout. It is meant to be called by lib modules.
 # The last two parameters are optional and can be used to specify
@@ -588,6 +601,11 @@ function setup_colorized_logging {
     iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
 }
 
+function setup_standard_logging_identity {
+    local conf_file=$1
+    iniset $conf_file DEFAULT logging_user_identity_format "%(project_name)s %(user_name)s"
+}
+
 # These functions are provided for basic fall-back functionality for
 # projects that include parts of DevStack (Grenade).  stack.sh will
 # override these with more specific versions for DevStack (with fancy
diff --git a/lib/cinder b/lib/cinder
index cf5bb25cfe..870ee0b905 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -333,12 +333,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-        setup_colorized_logging $CINDER_CONF
-    else
-        # Set req-id, project-name and resource in log format
-        iniset $CINDER_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(project_name)s] %(resource)s%(message)s"
-    fi
+    setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 
     if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
         _cinder_config_apache_wsgi
diff --git a/lib/glance b/lib/glance
index 17361143df..26c41507ed 100644
--- a/lib/glance
+++ b/lib/glance
@@ -229,10 +229,8 @@ function configure_glance {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $GLANCE_API_CONF
-        setup_colorized_logging $GLANCE_REGISTRY_CONF
-    fi
+    setup_logging $GLANCE_API_CONF
+    setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
 
@@ -273,7 +271,7 @@ function configure_glance {
     if is_service_enabled g-glare; then
         local dburl
         dburl=`database_connection_url glance`
-        setup_colorized_logging $GLANCE_GLARE_CONF
+        setup_logging $GLANCE_GLARE_CONF
         iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index cf59b2d6dd..5ec61f9645 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -732,12 +732,7 @@ function _configure_neutron_common {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF
-    else
-        # Show user_name and project_name by default like in nova
-        iniset $NEUTRON_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
-    fi
+    setup_logging $NEUTRON_CONF
 
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
diff --git a/lib/nova b/lib/nova
index 617cf5c3aa..c47f81a530 100644
--- a/lib/nova
+++ b/lib/nova
@@ -519,12 +519,8 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$NOVA_USE_MOD_WSGI" == "False" ]  ; then
-        setup_colorized_logging $NOVA_CONF
-    else
-        # Show user_name and project_name instead of user_id and project_id
-        iniset $NOVA_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
-    fi
+    setup_logging $NOVA_CONF $NOVA_USE_MOD_WSGI
+
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         _config_nova_apache_wsgi
     fi

From fb1c7b51b57b11d263c8b08d4f12992fb58748cb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 17 Jan 2017 12:17:48 -0500
Subject: [PATCH 1718/3333] remove obsolete s3 conf from nova.conf

Change-Id: If0b42c647382b739ee4f1d98ea0394ec7b171ebf
---
 lib/nova | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 3e29c1320d..85561ca570 100644
--- a/lib/nova
+++ b/lib/nova
@@ -457,8 +457,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
-    iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
-    iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
         iniset $NOVA_CONF DEFAULT use_ipv6 "True"
@@ -468,7 +466,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
-    iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to

From 465ee459867bc972fdd6568839db800a12289e05 Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Tue, 8 Nov 2016 17:49:45 +0800
Subject: [PATCH 1719/3333] XenAPI: enable root_helper_daemon for XenServer

The daemon mode of root helper for XenAPI has been implemented by
this change which has been merged to neutron:
https://review.openstack.org/#/c/390931/
It will help to import the performance. Let's enable this mode
by default in devstack.

Change-Id: I52246bef3e4434dfc49446535b122580bc475ac3
---
 lib/neutron_plugins/openvswitch_agent | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 76a1a4f3a1..c5c616a7df 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -81,8 +81,11 @@ function neutron_plugin_configure_plugin_agent {
         # integration bridge.  This is enabled by using a root wrapper
         # that executes commands on dom0 via a XenAPI plugin.
         # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_DOM0_COMMAND"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon ""
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper ""
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon "xenapi_root_helper"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_url "$XENAPI_CONNECTION_URL"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_username "$XENAPI_USER"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_password "$XENAPI_PASSWORD"
 
         # Disable minimize polling, so that it can always detect OVS and Port changes
         # This is a problem of xenserver + neutron, bug has been reported

From 10db2b8e6559724673a3efc691c595f307eb12d6 Mon Sep 17 00:00:00 2001
From: Michelle Mandel <mmandel@us.ibm.com>
Date: Wed, 20 Jul 2016 11:39:42 -0400
Subject: [PATCH 1720/3333] Enable VNC console in tempest.conf

If the NoVNC service is enabled, enable vnc_console in tempest.conf.
This will allow tempest tests that interact with VNC to be executed.

Change-Id: Idb38a3b11e2f61f23adf1ec23c04ddccd72e7539
Depends-On: I09aed8de28f1ba2637382e870134ced38808df29
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 331252267c..9f89dbe120 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -377,6 +377,10 @@ function configure_tempest {
         fi
     fi
 
+    if is_service_enabled n-novnc; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
+    fi
+
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
     iniset $TEMPEST_CONFIG network project_networks_reachable false

From 5713497aa5819f240050fee05d047c480845a8cd Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 20 Jan 2017 09:01:49 -0500
Subject: [PATCH 1721/3333] Add discover_hosts.sh script

This adds a simple script to run the
'nova-manage cell_v2 discover_hosts'
command which will be used by
devstack-gate to discover the compute
hosts after devstack is fully setup.

This allows us to manage the branches
where this can run from devstack rather
than require branch logic in devstack-gate.

Change-Id: Icc595d60de373471aa7ee8fb9f3a81fc12d80438
Depends-On: I4823737246a8e9cc4eaebf67ff6bdba8bf42ab29
---
 tools/discover_hosts.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100755 tools/discover_hosts.sh

diff --git a/tools/discover_hosts.sh b/tools/discover_hosts.sh
new file mode 100755
index 0000000000..65966c3d04
--- /dev/null
+++ b/tools/discover_hosts.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# **discover_hosts.sh**
+
+# This is just a very simple script to run the
+# "nova-manage cell_v2 discover_hosts" command
+# which is needed to discover compute nodes and
+# register them with a parent cell in Nova.
+# This assumes that /etc/nova/nova.conf exists
+# and has the following entries filled in:
+#
+# [api_database]
+# connection = This is the URL to the nova_api database
+#
+# In other words this should be run on the primary
+# (API) node in a multi-node setup.
+
+nova-manage cell_v2 discover_hosts --verbose

From 5c6aa56e11b2dc79adc70154187d3a029e8e0976 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Thu, 26 Jan 2017 11:31:58 +0100
Subject: [PATCH 1722/3333] Don't assume nova-manage is present

tools/discover_hosts.sh is run by devstack-gate, and breaks all dsvm job
that doesn't use nova.

nova-manage is perhaps not installed if nova services are not enabled.

This change checks the presence of nova-.

Change-Id: Ic555d241f98d0fa027897c69a7115d1be88f6c96
---
 tools/discover_hosts.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/discover_hosts.sh b/tools/discover_hosts.sh
index 65966c3d04..4ec6a40511 100755
--- a/tools/discover_hosts.sh
+++ b/tools/discover_hosts.sh
@@ -15,4 +15,6 @@
 # In other words this should be run on the primary
 # (API) node in a multi-node setup.
 
-nova-manage cell_v2 discover_hosts --verbose
+if [[ -x $(which nova-manage) ]]; then
+    nova-manage cell_v2 discover_hosts --verbose
+fi

From e9a9fbef8fc29437d1f69727e2ab73c31e957488 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 30 Jan 2017 22:22:43 -0500
Subject: [PATCH 1723/3333] Don't run swap_volume tests in Tempest if cells v1
 is enabled

Cells v1 apparently doesn't support the swap volume API which
was recently enabled for testing in change:

92575baa6b010ec09fea3e715030da8be61c0c64

Rather than revert that change, we should just handle the cells
v1 case and not enable that test in that environment.

Change-Id: I80f52e8299641098d90d3c374a80770fc45b8122
Closes-Bug: #1660511
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 050ac382c5..7cafadbf3f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -516,8 +516,10 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+        elif ! is_service_enabled n-cell; then
+            # cells v1 does not support swapping volumes
+            iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi
-        iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
     fi
 
     # ``service_available``

From e1644ac1d86d4836ca26e89258b5aa6e93b9f770 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 31 Jan 2017 11:59:09 -0500
Subject: [PATCH 1724/3333] Remove OS_NO_CACHE from openrc

Nothing uses this variable either in devstack or libraries,
so it's dead code (at least on master), and we can remove it.

Change-Id: I5975c476ae5b26402c209d6e5746e7a5a5a91507
---
 openrc | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/openrc b/openrc
index d1c61297a1..483b5af387 100644
--- a/openrc
+++ b/openrc
@@ -53,10 +53,6 @@ export OS_USERNAME=${OS_USERNAME:-demo}
 # or NOVA_PASSWORD.
 export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
 
-# Don't put the key into a keyring by default. Testing for development is much
-# easier with this off.
-export OS_NO_CACHE=${OS_NO_CACHE:-1}
-
 # Region
 export OS_REGION_NAME=${REGION_NAME:-RegionOne}
 

From ac5fdb4c4090efd682cc5c55aa30ec433da29fc7 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 31 Jan 2017 15:20:18 -0500
Subject: [PATCH 1725/3333] nova: call map_cell0 much earlier in the setup

The map_cell0 command creates a cell mapping record in the
nova_api database, and the nova-manage db sync command
will migrate the db schema for the nova_cell0 database. This
patch takes advantage of that by moving the map_cell0 call
much earlier in the setup process so we get the nova_cell0
db schema migrated at the same time as the main nova db.

This also removes the || true condition around map_cell0
since it's idempotent now due to fix:

aa7b6ebbb254f00fcb548832941ca9dbd3996d9f

Change-Id: Ice4fbb1771270c618b2acbc933d4fbfb6805df81
---
 lib/nova | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index 4d336f6271..ba9cac5161 100644
--- a/lib/nova
+++ b/lib/nova
@@ -683,9 +683,13 @@ function init_nova {
         recreate_database nova
         recreate_database nova_cell0
 
-        # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
-        # been run this migrates the "nova" and "nova_cell0" database.
-        # Otherwise it just migrates the "nova" database.
+        # map_cell0 will create the cell mapping record in the nova_api DB so
+        # this needs to come after the api_db sync happens. We also want to run
+        # this before the db sync below since that will migrate both the nova
+        # and nova_cell0 databases.
+        nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
+
+        # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
         if is_service_enabled n-cell; then
@@ -945,9 +949,6 @@ function create_flavors {
 
 # create_cell(): Group the available hosts into a cell
 function create_cell {
-    # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
-    (nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`|| true)
-
     if ! is_service_enabled n-cell; then
         nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
     else

From 705b3785ca5383179c970c7d707bde9f69d96635 Mon Sep 17 00:00:00 2001
From: PranaliD <pdeore@redhat.com>
Date: Wed, 1 Feb 2017 11:32:09 +0530
Subject: [PATCH 1726/3333] Corrected router gateway set command

While configuring the external network as the default
router gateway for IPV6 in lib/neutron_plugins/services/l3,
"router" keyword is missing in the command.

Corrected the command.

Change-Id: I055bea5137a841f709d4865ec9a43d6b53f8f4c9
Closes-Bug: 1660712
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index cd0c1ed59a..00b5a63756 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -385,7 +385,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" set --external-gateway $EXT_NET_ID $ROUTER_ID
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using the l3-agent for layer 3

From debc695ddfc8b7b2aeb53c01c624e15f69ed9fa2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 1 Feb 2017 07:27:18 +0000
Subject: [PATCH 1727/3333] Updated from generate-devstack-plugins-list

Change-Id: Ia858ddf2e688903af2c76d532ddf7780bd591ef9
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4cfbcb16ba..2721eda776 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -80,6 +80,7 @@ manila                                 `git://git.openstack.org/openstack/manila
 manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
+meteos-ui                              `git://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__

From 6d79ebcae10dddb804856e7838aa391749266ebb Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 2 Feb 2017 10:52:53 -0500
Subject: [PATCH 1728/3333] Add top memory consuming process to dstat output

Right now we under pressure because of increasing memory consumption in
dsvm jobs. So it'll be good to see which process is eating the most ram
at a given time. It may not end up being useful, but it doesn't hurt to
at least display just in case.

Change-Id: I096bf4b425db51358240335e41f6238d1ec1bb40
---
 tools/dstat.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 3c0b3be089..1c80fb70f8 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -13,7 +13,7 @@
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --swap"
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap"
 
 # Command-line arguments for secondary background DStat process.
 DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"

From 06f2ea2b962ffafeb415770d7eec5ee7886ee3b5 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Thu, 2 Feb 2017 16:47:00 -0800
Subject: [PATCH 1729/3333] Cut back on the number of workers ran for neutron

The dedicated RPC worker is overkill in single or multinode
devstack deployments. Also metadata API workers was left
default, which meant they were as many as the CPU cores.

Related-bug: 1656386

Change-Id: Ibbf7787dfa48e13a51f961f3e0ee2b8f49964759
---
 lib/neutron        | 1 +
 lib/neutron-legacy | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index f6c705c2b0..9b032b72e2 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -219,6 +219,7 @@ function configure_neutron_new {
 
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
+        iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 
         # TODO(dtroyer): remove the v2.0 hard code below
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5ec61f9645..af91470e65 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -359,6 +359,10 @@ function configure_mutnauq {
     fi
 
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
+    # devstack is not a tool for running uber scale OpenStack
+    # clouds, therefore running without a dedicated RPC worker
+    # for state reports is more than adequate.
+    iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 }
 
 function create_nova_conf_neutron {
@@ -788,6 +792,7 @@ function _configure_neutron_metadata_agent {
 
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
     iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"

From 18682324856285743c7f2b54f1dc0523ea74a70f Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:12:42 +0100
Subject: [PATCH 1730/3333] lib/tempest: Liberty EOL: remove the
 volume_services feature flag

Now that Liberty is EOLed, the feature flag is not needed anymore.

Change-Id: Ib82cb21edbda383d17f8cf69fedc884f2357fead
Depends-On: I7073106988a79aad19c6b95bb050d2eaf00c36c0
---
 lib/tempest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 2efaebc694..5c1113130c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -443,8 +443,7 @@ function configure_tempest {
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse False TEMPEST_VOLUME_MANAGE_SNAPSHOT)
-    # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
-    iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
+
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}

From 9d49ed983435cd0ff3791224dff47a4d51f0bf01 Mon Sep 17 00:00:00 2001
From: Joanna Taryma <joanna.taryma@intel.com>
Date: Mon, 6 Feb 2017 11:30:15 -0800
Subject: [PATCH 1731/3333] Added printing exit code of component process if it
 failed to start

When command failed and component failed to start, original exit code
was overwritten due to original command being executed in background.
This commit adds information about command's exit code to echoed message
about component's start up failure.

Change-Id: I8a3dd485b1b1f2d70d42c5610baac7c0c713f53a
Signed-off-by: Joanna Taryma <joanna.taryma@intel.com>
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 8d32bb4148..be8b07b0f7 100644
--- a/functions-common
+++ b/functions-common
@@ -1552,7 +1552,7 @@ function screen_process {
     # Append the process to the screen rc file
     screen_rc "$name" "$command"
 
-    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
+    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start. Exit code: \$?\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
 }
 
 # Screen rc file builder

From 09949e0dc61d9ef420b1528d0549092f88bc422a Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Mon, 6 Feb 2017 13:46:32 -0800
Subject: [PATCH 1732/3333] worlddump: Use __future__ print_function

Commit e7361775c112e32ea517eddc344641897d273d25 changed the code to
use Python 3 style print function, but when doing 'print()' in Python
2.7 it would print '()':
    >>> print()
    ()

Import the __future__ print function so that a blank line will be
printed as expected. This will now work the same in Python 2 & 3.

Change-Id: I61742e107278f2327c18c9ab0de52d1914f16c97
---
 tools/worlddump.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1ce931efd5..1244dfbec3 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -17,6 +17,8 @@
 
 """Dump the state of the world for post mortem."""
 
+from __future__ import print_function
+
 import argparse
 import datetime
 from distutils import spawn

From fd406772975a4a16c8c510d8bb11b2097017347c Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 7 Feb 2017 14:43:32 +0100
Subject: [PATCH 1733/3333] lib/tempest: remove an unused network option

Tempest doesn't support the `api_version` config option for networking
anymore. I can't track which Tempest patch removed it, but it's been more
than 2 years.

Change-Id: I4012f470e8c317803203b6fa1e265600dbc49b3d
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 2efaebc694..937436dc5c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -382,7 +382,6 @@ function configure_tempest {
     fi
 
     # Network
-    iniset $TEMPEST_CONFIG network api_version 2.0
     iniset $TEMPEST_CONFIG network project_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
     iniset $TEMPEST_CONFIG network public_router_id "$public_router_id"

From 40aae6adbfce1bd896d5f7b0e281e798b56d1ca8 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Wed, 8 Feb 2017 00:08:53 +0900
Subject: [PATCH 1734/3333] Down PUBLIC_BRIDGE before trying to delete it

When cleanup devstack with linuxbridge, PUBLIC_BRIDGE should be
DOWN before trying to delete it.

Change-Id: I2d205cbe4d92a03ee5c376a23282d9880dd9a1df
Closes-Bug: #1662543
---
 lib/neutron_plugins/linuxbridge_agent | 1 +
 1 file changed, 1 insertion(+)
 mode change 100644 => 100755 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
old mode 100644
new mode 100755
index 0c8ccb8718..5885616951
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -8,6 +8,7 @@ _XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_lb_cleanup {
+    sudo ip link set $PUBLIC_BRIDGE down
     sudo brctl delbr $PUBLIC_BRIDGE
 
     if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then

From 88b84094ec1e2a18b6edba91f510cae53bc9c821 Mon Sep 17 00:00:00 2001
From: Roman Podoliaka <rpodolyaka@mirantis.com>
Date: Tue, 7 Feb 2017 13:34:12 +0200
Subject: [PATCH 1735/3333] mysql: set default sql_mode to TRADITIONAL

We currently use a more permisive STRICT_ALL_TABLES mode, but that's
not what modern MySQL versions default to (i.e. TRADITIONAL):

https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html#sql-mode-changes

(non-Devstack deployments will most likely use TRADITIONAL as well)

Due to the fact that we default to TRADITIONAL in oslo.db, this
produces annoying warnings on MySQL 5.7 versions we use in the gate:

    Warning: (3090, u"Changing sql mode 'NO_AUTO_CREATE_USER' is
              deprecated. It will be removed in a future release.")

https://git.openstack.org/cgit/openstack/oslo.db/tree/oslo_db/options.py#n49

Unlike STRICT_ALL_TABLES, TRADITIONAL mode includes NO_AUTO_CREATE_USER,
and MySQL emits this warning on switching it on:

https://dev.mysql.com/worklog/task/?id=8326

So we have two options here:

1) make oslo.db default to STRICT_ALL_TABLES
2) make Devstack default to TRADITIONAL

The latter seems to be more appropriate as:

1) it's what modern MySQL versions default to
2) it's what people are actually using, if they do not override the
   oslo.db default
3) it's more strict

Closes-Bug: #1652452

Change-Id: Ie6d823c9f8465ac9f2ce4825929d1a50438fab45
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 89ae082c81..7bbcace399 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -94,7 +94,7 @@ function configure_database_mysql {
     # Change bind-address from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
     iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
-    iniset -sudo $my_conf mysqld sql_mode STRICT_ALL_TABLES
+    iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024
     iniset -sudo $my_conf mysqld query_cache_type OFF

From cfc3edc97c3075c800e8366e3ff4e1d21578caca Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Wed, 8 Feb 2017 10:54:29 +0800
Subject: [PATCH 1736/3333] Add "--nvram" to virsh undefine domain when
 clean_nova

For the instance which has boot by uefi, we should use
virsh undefine --nvram to undefine it. Check the libvirt
version for whether it supports nvram and use new undefine
parameters since this parameters is compatible with those
instance which don't use uefi.

Closes-bug: #1612613

Change-Id: Ibca1450e965df1481e6cd6b0d597b4323d667e60
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 4d336f6271..5f7a658e6a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -202,7 +202,10 @@ function cleanup_nova {
         instances=`sudo virsh list --all | grep $INSTANCE_NAME_PREFIX | sed "s/.*\($INSTANCE_NAME_PREFIX[0-9a-fA-F]*\).*/\1/g"`
         if [ ! "$instances" = "" ]; then
             echo $instances | xargs -n1 sudo virsh destroy || true
-            echo $instances | xargs -n1 sudo virsh undefine --managed-save || true
+            if ! xargs -n1 sudo virsh undefine --managed-save --nvram <<< $instances; then
+                # Can't delete with nvram flags, then just try without this flag
+                xargs -n1 sudo virsh undefine --managed-save <<< $instances
+            fi
         fi
 
         # Logout and delete iscsi sessions

From d9aaae95f2b84170bf35e037715e4963d89f940c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 8 Feb 2017 07:49:26 -0500
Subject: [PATCH 1737/3333] Generate deprecation warning for postgresql

Change-Id: I599e6d84b70bb6a7718ae48dd0cfc91796af189e
---
 lib/databases/postgresql | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 1f347f5548..618834b550 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -95,6 +95,7 @@ function configure_database_postgresql {
 
 function install_database_postgresql {
     echo_summary "Installing postgresql"
+    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
     local pgpass=$HOME/.pgpass
     if [[ ! -e $pgpass ]]; then
         cat <<EOF > $pgpass

From 26e5a00957768df61ed81bba7ba3011c97d1290b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 8 Feb 2017 14:19:00 +0000
Subject: [PATCH 1738/3333] Updated from generate-devstack-plugins-list

Change-Id: I4cf11a25b1d107cc5ab9664cae47a5a13f7a2450
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2721eda776..17da67b816 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -123,7 +123,6 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__

From 999dd7e989ae850bec7158a0058c0d38893ecdae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 9 Feb 2017 17:56:40 -0500
Subject: [PATCH 1739/3333] only apply ebtables race fix on trusty

Change-Id: Ifc83e7301d9d921ce9ceed349f116584ce03842b
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 5e7695a2b2..47b054bc58 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -26,7 +26,7 @@ function install_libvirt {
         install_package qemu-system
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
-        if [[ "$EBTABLES_RACE_FIX" == "True" ]]; then
+        if [[ ${DISTRO} == "trusty" && ${EBTABLES_RACE_FIX} == "True" ]]; then
             # Work around for bug #1501558. We can remove this once we
             # get to a version of Ubuntu that has new enough libvirt.
             TOP_DIR=$TOP_DIR $TOP_DIR/tools/install_ebtables_workaround.sh

From 47bcf4fbcb6572cb72a8f4e268a09bf3edff23d8 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 13 Jan 2017 18:27:38 +0000
Subject: [PATCH 1740/3333] Removed neutron_plugin_configure_debug_command
 functions

Those are not called by devstack anymore. This cleanup also gets rid of
code that attempts to set external_network_bridge to an empty value,
which triggers a deprecation warning for the option since it's going to
be removed in a next Neutron release.

Change-Id: I5adcbab877b4e8742522de81b1a85acfc33160d7
---
 lib/neutron_plugins/README.md            | 1 -
 lib/neutron_plugins/bigswitch_floodlight | 4 ----
 lib/neutron_plugins/brocade              | 4 ----
 lib/neutron_plugins/cisco                | 5 -----
 lib/neutron_plugins/linuxbridge_agent    | 4 ----
 lib/neutron_plugins/nuage                | 4 ----
 lib/neutron_plugins/openvswitch_agent    | 4 ----
 lib/neutron_plugins/ovs_base             | 8 --------
 8 files changed, 34 deletions(-)

diff --git a/lib/neutron_plugins/README.md b/lib/neutron_plugins/README.md
index f03000e7cb..ed40886fda 100644
--- a/lib/neutron_plugins/README.md
+++ b/lib/neutron_plugins/README.md
@@ -24,7 +24,6 @@ functions
 * ``neutron_plugin_configure_common`` :
   set plugin-specific variables, ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``,
   ``Q_PLUGIN_CLASS``
-* ``neutron_plugin_configure_debug_command``
 * ``neutron_plugin_configure_dhcp_agent``
 * ``neutron_plugin_configure_l3_agent``
 * ``neutron_plugin_configure_plugin_agent``
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 586ded79b4..52c6ad58b5 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -26,10 +26,6 @@ function neutron_plugin_configure_common {
     BS_FL_CONTROLLER_TIMEOUT=${BS_FL_CONTROLLER_TIMEOUT:-10}
 }
 
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
 function neutron_plugin_configure_dhcp_agent {
     :
 }
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 6ba0a66c3f..1b42e7794e 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -49,10 +49,6 @@ function neutron_plugin_configure_service {
 
 }
 
-function neutron_plugin_configure_debug_command {
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge
-}
-
 function neutron_plugin_configure_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index fc2cb8ad17..b397169b59 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -45,7 +45,6 @@ source $TOP_DIR/lib/neutron_plugins/openvswitch
 _prefix_function neutron_plugin_create_nova_conf ovs
 _prefix_function neutron_plugin_install_agent_packages ovs
 _prefix_function neutron_plugin_configure_common ovs
-_prefix_function neutron_plugin_configure_debug_command ovs
 _prefix_function neutron_plugin_configure_dhcp_agent ovs
 _prefix_function neutron_plugin_configure_l3_agent ovs
 _prefix_function neutron_plugin_configure_plugin_agent ovs
@@ -83,10 +82,6 @@ function neutron_plugin_configure_common {
     Q_PLUGIN_CLASS="neutron.plugins.cisco.network_plugin.PluginV2"
 }
 
-function neutron_plugin_configure_debug_command {
-    :
-}
-
 function neutron_plugin_configure_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 5885616951..f1216377fa 100755
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -39,10 +39,6 @@ function neutron_plugin_install_agent_packages {
     install_package bridge-utils
 }
 
-function neutron_plugin_configure_debug_command {
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge
-}
-
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
     :
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 61e634e453..1c04aaac9a 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -33,10 +33,6 @@ function neutron_plugin_configure_common {
     NUAGE_CNA_DEF_NETPART_NAME=${NUAGE_CNA_DEF_NETPART_NAME:-''}
 }
 
-function neutron_plugin_configure_debug_command {
-    :
-}
-
 function neutron_plugin_configure_dhcp_agent {
     :
 }
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 76a1a4f3a1..61305e1779 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -23,10 +23,6 @@ function neutron_plugin_install_agent_packages {
     _neutron_ovs_base_install_agent_packages
 }
 
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
     :
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 62a4d00bcd..795d2bb5b2 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -77,14 +77,6 @@ function _neutron_ovs_base_install_agent_packages {
     fi
 }
 
-function _neutron_ovs_base_configure_debug_command {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge ""
-    else
-        iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    fi
-}
-
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid

From 952ecb6fec87e98bf7677cd4b481a20a8ffe36aa Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 13 Jan 2017 18:30:19 +0000
Subject: [PATCH 1741/3333] Don't set external_network_bridge by default

Since the empty value is the default for the option, and when explcitly
set in config file, it triggers a deprecation warning for the option,
avoid setting it unless we actually need to override the new default
value.

Change-Id: If423114d7a52da29b97d1fb473a955d9d69a1a3e
---
 lib/neutron_plugins/brocade           | 1 -
 lib/neutron_plugins/linuxbridge_agent | 1 -
 lib/neutron_plugins/ovs_base          | 4 +---
 3 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 1b42e7794e..310b72e5ad 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -54,7 +54,6 @@ function neutron_plugin_configure_dhcp_agent {
 }
 
 function neutron_plugin_configure_l3_agent {
-    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
     iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index f1216377fa..dfed49b5e4 100755
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -48,7 +48,6 @@ function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
     set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
-    iniset $conf_file DEFAULT external_network_bridge
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 795d2bb5b2..1a97001824 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -87,9 +87,7 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge ""
-    else
+    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
         iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
     fi
 

From e0a37cf21e43fbb4ba3f9f8fa5321a0a0e1bedf1 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 10 Feb 2017 15:01:37 +0100
Subject: [PATCH 1742/3333] tls proxy: immediately close a connection to the
 backend

Force mod_proxy to immediately close a connection to the backend
after being used, and thus, disable its persistent connection and
pool for that backend.

Let's see if that helps fixing bug #1630664 (the
Connection aborted/ BadStatusLine thing).

We already have an ER query (in queries/1630664.yaml) that should show
whether this is effective.

Change-Id: I03b09f7df5c6e134ec4091a2f8dfe8ef614d1951
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 57b5e525ac..d96ca4f197 100644
--- a/lib/tls
+++ b/lib/tls
@@ -520,7 +520,7 @@ $listen_string
     SSLCertificateFile $DEVSTACK_CERT
 
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
+        ProxyPass http://$b_host:$b_port/ retry=5 disablereuse=on keepalive=off nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 9f2dcd333103553626db1924a019e151e3e7252e Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@hpe.com>
Date: Sun, 12 Feb 2017 22:14:15 +0000
Subject: [PATCH 1743/3333] Use the latest 0.3.5 version of CirrOS

This new version of CirrOS is built on top of 0.3 branch, so wrt
version 0.3.4 it includes only two commits:

- Cherry-pick of the fix for https://launchpad.net/bugs/1564948
- One extra fix to make the above working on 0.3

Cherry-picked commit is http://bazaar.launchpad.net/~cirros-dev/cirros/trunk/revision/366

A Tempest test for hard reboot in some cases hits the case where
host key are empty. This triggers bugs/1564948, i.e. the ssh
daemon does not start at all, and the Tempest test fails with
"connection refused", which is misleading.

The new version of CirrOS solves this problem as it ensure host
keys are generated if missing, and the sshd deamon started.

I tested the scenario of missing host keys in Iea74c63925be17a1df894c1a2c23f5ba2793e0c6
using a private build of what then became 0.3.5.

Change-Id: I5c154ec25555e768954538fc22b4f5d5975b2deb
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index d8d0ee4b3e..52a0ff9cb9 100644
--- a/stackrc
+++ b/stackrc
@@ -614,7 +614,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.4"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.3.5"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From ee37d20f80d3a4871edd17a16c12e8ea5f0afadf Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 8 Feb 2017 11:24:31 -0500
Subject: [PATCH 1744/3333] pass role by name not id

Change-Id: Ie67758bed3563c9a46a5180eaa9c8d47721fffd8
---
 lib/keystone | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 474af8be1d..c1a6d43410 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -384,8 +384,7 @@ function create_keystone_accounts {
     admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
-    local admin_role
-    admin_role=$(openstack role show "admin" -f value -c id)
+    local admin_role="admin"
 
     get_or_add_user_domain_role $admin_role $admin_user default
 
@@ -403,13 +402,20 @@ function create_keystone_accounts {
     get_or_create_role ResellerAdmin
 
     # The Member role is used by Horizon and Swift so we need to keep it:
-    local member_role
-    member_role=$(get_or_create_role "Member")
+    local member_role="member"
+
+    # Captial Member role is legacy hard coded in Horizon / Swift
+    # configs. Keep it around.
+    get_or_create_role "Member"
+
+    # The reality is that the rest of the roles listed below honestly
+    # should work by symbolic names.
+    get_or_create_role $member_role
 
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
-    local another_role
-    another_role=$(get_or_create_role "anotherrole")
+    local another_role="anotherrole"
+    get_or_create_role $another_role
 
     # invisible project - admin can't see this one
     local invis_project

From 9ef346f59da92416b0e27ead8a846bc8dbd68c0b Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 13 Feb 2017 15:09:35 +0100
Subject: [PATCH 1745/3333] Using sudo in the Quick start section

Adding sudo to the example commands in the quick start section.

Also adding '-' as su argument in order to use
the stack user's env (home).

Change-Id: I23ab38104d05c3f4c8d48b55e66cf19dc4e4f90d
---
 doc/source/index.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index b8dd506aab..edd6595da2 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -56,15 +56,15 @@ You can quickly create a separate `stack` user to run DevStack with
 
 ::
 
-   $ adduser stack
+   $ sudo adduser stack
 
 Since this user will be making many changes to your system, it should
 have sudo privileges:
 
 ::
 
-    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-    $ su stack
+    $ sudo tee <<<"stack ALL=(ALL) NOPASSWD: ALL" /etc/sudoers
+    $ sudo su - stack
 
 Download DevStack
 -----------------

From 11eb2017ef70a758c54cc984e90e445205886e7e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 13 Feb 2017 16:16:59 -0500
Subject: [PATCH 1746/3333] simplify endpoints used in devstack

The proliferation of internal/admin endpoints is mostly legacy and
based on some specific deployment patterns. These are not used by
everyone, and for the devstack case aren't really that useful. We
should simplify our service catalog down to the minimum we need for
development.

Change-Id: Ided7a65c81b3a0b56f0184847fc82e17c29a771e
---
 functions-common   | 12 ++++++++----
 lib/cinder         |  6 ------
 lib/glance         |  4 ----
 lib/neutron        |  2 --
 lib/neutron-legacy |  2 --
 lib/nova           |  4 ----
 lib/placement      |  2 --
 lib/swift          |  3 +--
 8 files changed, 9 insertions(+), 26 deletions(-)

diff --git a/functions-common b/functions-common
index 8d32bb4148..f0940e57cf 100644
--- a/functions-common
+++ b/functions-common
@@ -992,7 +992,7 @@ function _get_or_create_endpoint_with_interface {
 }
 
 # Gets or creates endpoint
-# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+# Usage: get_or_create_endpoint <service> <region> <publicurl> [adminurl] [internalurl]
 function get_or_create_endpoint {
     # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
     # creating one endpoint with multiple urls to multiple endpoints each with
@@ -1004,9 +1004,13 @@ function get_or_create_endpoint {
     # endpoints they need.
     local public_id
     public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
-    _get_or_create_endpoint_with_interface $1 admin $4 $2
-    _get_or_create_endpoint_with_interface $1 internal $5 $2
-
+    # only create admin/internal urls if provided content for them
+    if [[ -n "$4" ]]; then
+        _get_or_create_endpoint_with_interface $1 admin $4 $2
+    fi
+    if [[ -n "$5" ]]; then
+        _get_or_create_endpoint_with_interface $1 internal $5 $2
+    fi
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
 }
diff --git a/lib/cinder b/lib/cinder
index 870ee0b905..24967d4151 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -395,24 +395,18 @@ function create_cinder_accounts {
         get_or_create_endpoint \
             "volume" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
         get_or_create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
 
         get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
         get_or_create_endpoint \
             "volumev3" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
         configure_cinder_internal_tenant
diff --git a/lib/glance b/lib/glance
index 26c41507ed..58f1deff6f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -314,8 +314,6 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
@@ -331,8 +329,6 @@ function create_glance_accounts {
 
         get_or_create_endpoint "artifact" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT"
     fi
 }
diff --git a/lib/neutron b/lib/neutron
index 9b032b72e2..19568eaf25 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -330,8 +330,6 @@ function create_neutron_accounts_new {
             "network" "Neutron Service")
         get_or_create_endpoint $neutron_service \
             "$REGION_NAME" \
-            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
-            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
             "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/"
     fi
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index af91470e65..b381b642c6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -410,8 +410,6 @@ function create_mutnauq_accounts {
         get_or_create_endpoint \
             "network" \
             "$REGION_NAME" \
-            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
             "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
     fi
 }
diff --git a/lib/nova b/lib/nova
index 4d336f6271..7c2fddbc75 100644
--- a/lib/nova
+++ b/lib/nova
@@ -407,16 +407,12 @@ function create_nova_accounts {
         get_or_create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
-            "$nova_api_url/v2/\$(project_id)s" \
-            "$nova_api_url/v2/\$(project_id)s" \
             "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
         get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
-            "$nova_api_url/v2.1" \
-            "$nova_api_url/v2.1" \
             "$nova_api_url/v2.1"
     fi
 
diff --git a/lib/placement b/lib/placement
index 871e282f32..e7ffe3330b 100644
--- a/lib/placement
+++ b/lib/placement
@@ -132,8 +132,6 @@ function create_placement_accounts {
     get_or_create_endpoint \
         "placement" \
         "$REGION_NAME" \
-        "$placement_api_url" \
-        "$placement_api_url" \
         "$placement_api_url"
 }
 
diff --git a/lib/swift b/lib/swift
index 03fd454dc6..5b510e5930 100644
--- a/lib/swift
+++ b/lib/swift
@@ -636,8 +636,7 @@ function create_swift_accounts {
         "object-store" \
         "$REGION_NAME" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s"
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT"
 
     local swift_project_test1
     swift_project_test1=$(get_or_create_project swiftprojecttest1 default)

From bfff93e1568a236be26a8e6c67e758b877f55a2a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 13 Feb 2017 16:18:08 -0500
Subject: [PATCH 1747/3333] remove keystone internal uri

There is really no reason to have an internal uri referenced for
keystone in devstack.

Change-Id: If0588a0ab512d94451992e7131dd3c8a33c5797c
---
 lib/keystone | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 474af8be1d..45f0fa4fff 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -654,8 +654,7 @@ function bootstrap_keystone {
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
         --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_URI" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_URI"
+        --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 
 # Restore xtrace

From ff10ac318ce4be49d8bceafb7fea92ae1655b497 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 13 Feb 2017 12:44:24 -0500
Subject: [PATCH 1748/3333] Remove distro support based on new libvirt minimum

Nova is going to increase the minimum required libvirt
in Pike to 1.2.9 in change:

I9a972e3fde2e4e552f6fc98350820c07873c3de3

Based on the libvirt distro support matrix wiki [1] that
drops support for Ubuntu Trusty and Debian 7.0/Wheezy.

Trusty has libvirt 1.2.2 and Wheezy has 0.9.12 (the Wheezy
support should have been removed long ago apparently). The
7.0 removed here is for Wheezy also based on commit
b2ef890db3d78b24f9da2f4dd80502165c669ad0.

This does not undo the check for "trusty" with the
EBTABLES_RACE_FIX in lib/nova_plugins/function-libvirt
since you can still force devstack to run on Trusty if
you specify the FORCE=yes variable.

Note that RHEL 7.1 has libvirt 1.2.8 so it won't technically
work with devstack and nova + pike + libvirt, but with the
way os_RELEASE is calculated the minor version is dropped
for RHEL distros so we just get "rhel7".

Also note that this doesn't attempt to continue supporting
Trusty or Wheezy if nova is not configured to use libvirt,
simply in order to start moving forward on devstack distro
support in general and to keep some sanity and closeness
to what we test with in the CI system.

While we're in here, we also drop Fedora 23 and add
Ubuntu Zesty.

[1] https://wiki.openstack.org/wiki/LibvirtDistroSupportMatrix

Depends-On: I9a972e3fde2e4e552f6fc98350820c07873c3de3
Depends-On: If69f99bd789e646b0261e27a8a061efde32436f7

Change-Id: I6617283afd798af37e64913b7865cea3c8a62aba
---
 functions-common | 4 ++--
 stack.sh         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 8d32bb4148..f4171049c0 100644
--- a/functions-common
+++ b/functions-common
@@ -302,9 +302,9 @@ function warn {
 # such as "install_package" further abstract things in better ways.
 #
 # ``os_VENDOR`` - vendor name: ``Ubuntu``, ``Fedora``, etc
-# ``os_RELEASE`` - major release: ``14.04`` (Ubuntu), ``20`` (Fedora)
+# ``os_RELEASE`` - major release: ``16.04`` (Ubuntu), ``23`` (Fedora)
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
-# ``os_CODENAME`` - vendor's codename for release: ``trusty``
+# ``os_CODENAME`` - vendor's codename for release: ``xenial``
 
 declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 
diff --git a/stack.sh b/stack.sh
index 7d440a7c20..02bcc58c0a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (14.04 Trusty or newer), **Fedora** (F20 or newer), or **CentOS/RHEL**
+# (16.04 Xenial or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|f25|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|sid|testing|jessie|f24|f25|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 6fc332d85279865c32f50b081efb25ba7b671a9a Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 6 Jul 2016 13:44:55 -0400
Subject: [PATCH 1749/3333] Switch devstack to use qcow cirros img

This commit switches devstack to use the published qcow2 cirros image
instead of the AMI version. Using AMI was mostly a historical artifact
dating pretty far back, but in the real world no one really uses AMI
images with openstack clouds. This change reflects that and also
enables tempest ro remove its deprecated config options for using AMI
as a fallback on misconfiguration (which was just there to support
devstack's defaults)

Change-Id: Id65ebae73b28da7185cb349b714b659af51ef77f
---
 lib/tempest |  7 ++-----
 stackrc     | 12 ++++++------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 937436dc5c..108256ef81 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -415,14 +415,11 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG scenario img_disk_format vhd
         iniset $TEMPEST_CONFIG scenario img_container_format ovf
     else
-        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
+        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
+        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_NAME
     fi
     iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
-    iniset $TEMPEST_CONFIG scenario ami_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img"
-    iniset $TEMPEST_CONFIG scenario ari_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd"
-    iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
 
     # If using provider networking, use the physical network for validation rather than private
     TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME
diff --git a/stackrc b/stackrc
index d8d0ee4b3e..b1c0825dd6 100644
--- a/stackrc
+++ b/stackrc
@@ -634,9 +634,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz";;
-                *) # otherwise, use the uec style image (with kernel, ramdisk, disk)
-                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;
+                *) # otherwise, use the qcow image
+                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
                 esac
             ;;
         vsphere)
@@ -650,9 +650,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             # NOTE(lucasagomes): The logic setting the default image
             # now lives in the Ironic tree
             ;;
-        *) # Default to Cirros with kernel, ramdisk and disk image
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;
+        *) # Default to Cirros qcow2 image file
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From bc3d01c8ec4f79c852b9cd2b0a7d679b2a777aa6 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 14 Feb 2017 15:35:59 +0000
Subject: [PATCH 1750/3333] Revert "tls proxy: immediately close a connection
 to the backend"

This reverts commit e0a37cf21e43fbb4ba3f9f8fa5321a0a0e1bedf1.

This didn't help fixing bug #1630664. Issue seems to be between
client<--->Apache2, not between Apache2<--->eventlet

Change-Id: I092c1bbf0c5848b50fc9e491d1e9211451208a89
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index d96ca4f197..57b5e525ac 100644
--- a/lib/tls
+++ b/lib/tls
@@ -520,7 +520,7 @@ $listen_string
     SSLCertificateFile $DEVSTACK_CERT
 
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=5 disablereuse=on keepalive=off nocanon
+        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 437092518172770c549dabafaf9f81e3766719ce Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 14 Feb 2017 16:48:20 +0100
Subject: [PATCH 1751/3333] TLS proxy: disable HTTP KeepAlive

There's a race condition when a client makes a request "at the same
time" the HTTP connection is being closed by Apache because the
`KeepAliveTimeout` is expired.

This is explained in detail and can be reproduce using
https://github.com/mikem23/keepalive-race or
https://github.com/JordanP/openstack-snippets/blob/master/keepalive-race/keep-alive-race.py

Just disable KeepAlive to fix the
('Connection aborted.', BadStatusLine("''",)) error we are seeing.

Change-Id: I46e9f70ee740ec7996c98d386d5289c1491e9436
---
 lib/tls | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tls b/lib/tls
index d96ca4f197..e044066c6a 100644
--- a/lib/tls
+++ b/lib/tls
@@ -519,6 +519,10 @@ $listen_string
     SSLEngine On
     SSLCertificateFile $DEVSTACK_CERT
 
+    # Disable KeepAlive to fix bug #1630664 a.k.a the
+    # ('Connection aborted.', BadStatusLine("''",)) error
+    KeepAlive Off
+
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=5 disablereuse=on keepalive=off nocanon
         ProxyPassReverse http://$b_host:$b_port/

From c6e6939e89a44a408065eb4585963175f8d0d6e3 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Mon, 6 Feb 2017 14:24:42 -0800
Subject: [PATCH 1752/3333] Fix error in 'ip netns' parsing

Sometimes when doing worlddump would see a command line like this:
 sudo ip netns exec (id: ip addr

This would cause an error to be seen in console.log:
  2017-02-07 00:03:03.659570 | /bin/sh: 1: Syntax error: "(" unexpected

This is caused by there sometimes being extra data returned from the
'ip netns' command [1]. For example it might look like:
    qrouter-0805fd7d-c493-4fa6-82ca-1c6c9b23cd9e (id: 1)
    qdhcp-bb2cc6ae-2ae8-474f-adda-a94059b872b5 (id: 0)

[1] https://lwn.net/Articles/629715/

Change-Id: Icece442023125ef55696b8d92a975d37e358b1b4
Closes-Bug: 1653969
---
 tools/worlddump.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1ce931efd5..8b418ede5a 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -151,7 +151,11 @@ def iptables_dump():
 def _netns_list():
     process = subprocess.Popen(['ip', 'netns'], stdout=subprocess.PIPE)
     stdout, _ = process.communicate()
-    return stdout.split()
+    # NOTE(jlvillal): Sometimes 'ip netns list' can return output like:
+    #   qrouter-0805fd7d-c493-4fa6-82ca-1c6c9b23cd9e (id: 1)
+    #   qdhcp-bb2cc6ae-2ae8-474f-adda-a94059b872b5 (id: 0)
+    output = [x.split()[0] for x in stdout.splitlines()]
+    return output
 
 
 def network_dump():

From 88312fa61f889307de85cd04b12250db57210470 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 15 Feb 2017 16:48:04 +0100
Subject: [PATCH 1753/3333] Do not run cinder API V1 tests anymore by default

I think now is a good time to stop running Cinder V1 tests. It should
save quite some Infra resources and jobs should run faster too.

Also, remove some useless variables in lib/tempest.

Change-Id: I0edf1d88c136c3b910a5773690a603eeacb50266
---
 lib/tempest | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 937436dc5c..4cceda6942 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -48,10 +48,6 @@ TEMPEST_CONFIG_DIR=${TEMPEST_CONFIG_DIR:-$TEMPEST_DIR/etc}
 TEMPEST_CONFIG=$TEMPEST_CONFIG_DIR/tempest.conf
 TEMPEST_STATE_PATH=${TEMPEST_STATE_PATH:=$DATA_DIR/tempest}
 
-NOVA_SOURCE_DIR=$DEST/nova
-
-BUILD_INTERVAL=1
-
 # This is the timeout that tempest will wait for a VM to change state,
 # spawn, delete, etc.
 # The default is set to 196 seconds.
@@ -446,6 +442,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     if [ "$tempest_volume_min_microversion" == "None" ]; then

From 0b259c3abdafa99e7194e62c9a47483ddcf6b65a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 17 Feb 2017 11:51:36 -0500
Subject: [PATCH 1754/3333] only set nova catalog if it's not the default

This ensures we only set the nova catalog when it's not the default,
instead of also putting defaults in devstack.

Change-Id: Ibb0dcb8bae2e9223db302d7b19e8fbee4ebbf0e3
---
 lib/cinder | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 24967d4151..767fd00d34 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -125,12 +125,6 @@ if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     done
 fi
 
-# Change the default nova_catalog_info and nova_catalog_admin_info values in
-# cinder so that the service name cinder is searching for matches that set for
-# nova in keystone.
-CINDER_NOVA_CATALOG_INFO=${CINDER_NOVA_CATALOG_INFO:-compute:nova:publicURL}
-CINDER_NOVA_CATALOG_ADMIN_INFO=${CINDER_NOVA_CATALOG_ADMIN_INFO:-compute:nova:adminURL}
-
 # Environment variables to configure the image-volume cache
 CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
 
@@ -268,8 +262,15 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
-    iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
-    iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
+    # Change the default nova_catalog_info and nova_catalog_admin_info values in
+    # cinder so that the service name cinder is searching for matches that set for
+    # nova in keystone.
+    if [[ -n "$CINDER_NOVA_CATALOG_INFO" ]]; then
+        iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
+    fi
+    if [[ -n "$CINDER_NOVA_CATALOG_ADMIN_INFO" ]]; then
+        iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
+    fi
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL

From 6e49cab0913c13cb2fbf2620a9abe20cfc5f7ce3 Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Wed, 22 Feb 2017 11:42:22 +0800
Subject: [PATCH 1755/3333] Xen: support Ubuntu Xenial for xen DevStack

Upgrade xen tool to install Ubuntu Xenial; change the upstart
task to systemd task to finish the OpenStack installation
by using devstack.

Change-Id: I8129923be3c41e7f60e9d32348a5ea8e07d4845b
---
 tools/xen/build_xva.sh                       | 78 ++++++++++----------
 tools/xen/install_os_domU.sh                 |  2 +-
 tools/xen/scripts/install_ubuntu_template.sh |  2 +-
 tools/xen/xenrc                              |  4 +-
 4 files changed, 42 insertions(+), 44 deletions(-)

diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
index 25bf58cb8a..34ef719ab9 100755
--- a/tools/xen/build_xva.sh
+++ b/tools/xen/build_xva.sh
@@ -96,48 +96,27 @@ mkdir -p $STAGING_DIR/opt/stack/devstack
 tar xf /tmp/devstack.tar -C $STAGING_DIR/opt/stack/devstack
 cd $TOP_DIR
 
-# Create an upstart job (task) for devstack, which can interact with the console
-cat >$STAGING_DIR/etc/init/devstack.conf << EOF
-start on stopped rc RUNLEVEL=[2345]
-
-console output
-task
-
-pre-start script
-    rm -f /opt/stack/runsh.succeeded
-end script
-
-script
-    initctl stop hvc0 || true
-
-    # Read any leftover characters from standard input
-    while read -n 1 -s -t 0.1 -r ignored; do
-        true
-    done
-
-    clear
-
-    chown -R $STACK_USER /opt/stack
-
-    su -c "/opt/stack/run.sh" $STACK_USER
-
-    # Update /etc/issue
-    {
-        echo "OpenStack VM - Installed by DevStack"
-        IPADDR=\$(ip -4 address show eth0 | sed -n 's/.*inet \\([0-9\.]\\+\\).*/\1/p')
-        echo "  Management IP:   \$IPADDR"
-        echo -n "  Devstack run:    "
-        if [ -e /opt/stack/runsh.succeeded ]; then
-            echo "SUCCEEDED"
-        else
-            echo "FAILED"
-        fi
-        echo ""
-    } > /etc/issue
-    initctl start hvc0 > /dev/null 2>&1
-end script
+# Create an systemd task for devstack
+cat >$STAGING_DIR/etc/systemd/system/devstack.service << EOF
+[Unit]
+Description=Install OpenStack by DevStack
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStartPre=/bin/rm -f /opt/stack/runsh.succeeded
+ExecStart=/bin/su -c "/opt/stack/run.sh" stack
+StandardOutput=tty
+StandardError=tty
+
+[Install]
+WantedBy=multi-user.target
+
 EOF
 
+# enable this service
+ln -s $STAGING_DIR/etc/systemd/system/devstack.service $STAGING_DIR/etc/systemd/system/multi-user.target.wants/devstack.service
+
 # Configure the hostname
 echo $GUEST_NAME > $STAGING_DIR/etc/hostname
 
@@ -178,6 +157,8 @@ set -eux
 (
   flock -n 9 || exit 1
 
+  sudo chown -R stack /opt/stack
+
   [ -e /opt/stack/runsh.succeeded ] && rm /opt/stack/runsh.succeeded
   echo \$\$ >> /opt/stack/run_sh.pid
 
@@ -187,7 +168,24 @@ set -eux
 
   # Got to the end - success
   touch /opt/stack/runsh.succeeded
+
+  # Update /etc/issue
+  (
+      echo "OpenStack VM - Installed by DevStack"
+      IPADDR=$(ip -4 address show eth0 | sed -n 's/.*inet \([0-9\.]\+\).*/\1/p')
+      echo "  Management IP:   $IPADDR"
+      echo -n "  Devstack run:    "
+      if [ -e /opt/stack/runsh.succeeded ]; then
+          echo "SUCCEEDED"
+      else
+          echo "FAILED"
+      fi
+      echo ""
+  ) > /opt/stack/issue
+  sudo cp /opt/stack/issue /etc/issue
+
   rm /opt/stack/run_sh.pid
 ) 9> /opt/stack/.runsh_lock
 EOF
+
 chmod 755 $STAGING_DIR/opt/stack/run.sh
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 66b9eda474..d2e2c572c6 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -424,7 +424,7 @@ else
     echo "looking at the console of your domU / checking the log files."
     echo ""
     echo "ssh into your domU now: 'ssh stack@$OS_VM_MANAGEMENT_ADDRESS' using your password"
-    echo "and then do: 'sudo service devstack status' to check if devstack is still running."
+    echo "and then do: 'sudo systemctl status devstack' to check if devstack is still running."
     echo "Check that /opt/stack/runsh.succeeded exists"
     echo ""
     echo "When devstack completes, you can visit the OpenStack Dashboard"
diff --git a/tools/xen/scripts/install_ubuntu_template.sh b/tools/xen/scripts/install_ubuntu_template.sh
index d80ed095e8..6ea364255e 100755
--- a/tools/xen/scripts/install_ubuntu_template.sh
+++ b/tools/xen/scripts/install_ubuntu_template.sh
@@ -50,7 +50,7 @@ disk_size=$(($OSDOMU_VDI_GB * 1024 * 1024 * 1024))
 # however these need to be answered before the netinstall
 # is ready to fetch the preseed file, and as such must be here
 # to get a fully automated install
-pvargs="-- quiet console=hvc0 partman/default_filesystem=ext3 \
+pvargs="quiet console=hvc0 partman/default_filesystem=ext3 \
 console-setup/ask_detect=false locale=${UBUNTU_INST_LOCALE} \
 keyboard-configuration/layoutcode=${UBUNTU_INST_KEYBOARD} \
 netcfg/choose_interface=eth0 \
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 2161247b76..60be02f3fe 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -63,8 +63,8 @@ PUB_IP=${PUB_IP:-172.24.4.10}
 PUB_NETMASK=${PUB_NETMASK:-255.255.255.0}
 
 # Ubuntu install settings
-UBUNTU_INST_RELEASE="trusty"
-UBUNTU_INST_TEMPLATE_NAME="Ubuntu 14.04 (64-bit) for DevStack"
+UBUNTU_INST_RELEASE="xenial"
+UBUNTU_INST_TEMPLATE_NAME="Ubuntu 16.04 (64-bit) for DevStack"
 # For 12.04 use "precise" and update template name
 # However, for 12.04, you should be using
 # XenServer 6.1 and later or XCP 1.6 or later

From 447f141d4f0e1b7be7f186714f18236c069b486e Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Thu, 28 Jul 2016 18:42:25 +0300
Subject: [PATCH 1756/3333] Added support for fake drivers as Cinder backend

FakeLoggingVolumeDriver  will be used for functional Cinder tests to
prevent dependencies on any storage.

FakeGateDriver is based on LVM and will be used to run Tempest tests for
such features like CG's, replication, etc.

Depends-On: I383bcdb531c7d52c0fdbb6875de73f1274a92854
Change-Id: I2dc8ea416f5eb3fcc9d2e959533497e464220ff5
---
 lib/cinder_backends/fake      | 47 ++++++++++++++++++++++
 lib/cinder_backends/fake_gate | 74 +++++++++++++++++++++++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 lib/cinder_backends/fake
 create mode 100644 lib/cinder_backends/fake_gate

diff --git a/lib/cinder_backends/fake b/lib/cinder_backends/fake
new file mode 100644
index 0000000000..4749aced69
--- /dev/null
+++ b/lib/cinder_backends/fake
@@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# lib/cinder_backends/fake
+# Configure the Fake backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,fake:fake
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# CINDER_CONF
+
+# clean_cinder_backend_fake - called from clean_cinder()
+# configure_cinder_backend_fake - called from configure_cinder()
+# init_cinder_backend_fake - called from init_cinder()
+
+
+# Save trace setting
+_XTRACE_CINDER_FAKE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+function cleanup_cinder_backend_fake {
+    local be_name=$1
+}
+
+function configure_cinder_backend_fake {
+    local be_name=$1
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeLoggingVolumeDriver"
+
+}
+
+function init_cinder_backend_fake {
+    local be_name=$1
+}
+
+# Restore xtrace
+$_XTRACE_CINDER_FAKE
+
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backends/fake_gate b/lib/cinder_backends/fake_gate
new file mode 100644
index 0000000000..6b1f848790
--- /dev/null
+++ b/lib/cinder_backends/fake_gate
@@ -0,0 +1,74 @@
+#!/bin/bash
+#
+# lib/cinder_backends/lvm
+# Configure the LVM backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,fake_gate:lvmname
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# CINDER_CONF
+# DATA_DIR
+# VOLUME_GROUP_NAME
+
+# clean_cinder_backend_lvm - called from clean_cinder()
+# configure_cinder_backend_lvm - called from configure_cinder()
+# init_cinder_backend_lvm - called from init_cinder()
+
+
+# Save trace setting
+_XTRACE_CINDER_LVM=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# TODO: resurrect backing device...need to know how to set values
+#VOLUME_BACKING_DEVICE=${VOLUME_BACKING_DEVICE:-}
+
+# Entry Points
+# ------------
+
+# cleanup_cinder_backend_lvm - Delete volume group and remove backing file
+# cleanup_cinder_backend_lvm $be_name
+function cleanup_cinder_backend_lvm {
+    local be_name=$1
+
+    # Campsite rule: leave behind a volume group at least as clean as we found it
+    clean_lvm_volume_group $VOLUME_GROUP_NAME-$be_name
+    clean_lvm_filter
+}
+
+# configure_cinder_backend_lvm - Set config files, create data dirs, etc
+# configure_cinder_backend_lvm $be_name
+function configure_cinder_backend_lvm {
+    local be_name=$1
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeGateDriver"
+    iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
+    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
+
+    if [[ "$CINDER_VOLUME_CLEAR" == "non" ]]; then
+        iniset $CINDER_CONF $be_name volume_clear none
+    fi
+}
+
+# init_cinder_backend_lvm - Initialize volume group
+# init_cinder_backend_lvm $be_name
+function init_cinder_backend_lvm {
+    local be_name=$1
+
+    # Start with a clean volume group
+    init_lvm_volume_group $VOLUME_GROUP_NAME-$be_name $VOLUME_BACKING_FILE_SIZE
+}
+
+# Restore xtrace
+$_XTRACE_CINDER_LVM
+
+# mode: shell-script
+# End:

From ed887d8b9f91f8c75b45770d5c250b9939f36619 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 22 Feb 2017 14:21:33 -0500
Subject: [PATCH 1757/3333] lib/neutron: Fix conf handling

- Remove extra spaces
- Fix a missing space in the generated option string
- Fix a fatal typo

Change-Id: Ieca1c3e3c7e2ff59089ef45435e126ce7ff4f9b5
Closes-Bug: #1667073
---
 lib/neutron | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 19568eaf25..7d427555a4 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -395,9 +395,9 @@ function start_neutron_api {
         service_protocol="http"
     fi
 
-    local opts = ""
-    opts+="--config-file $NEUTRON_CONF"
-    opts+="--config-file $NEUTRON_CORE_PLUGIN_CONF"
+    local opts=""
+    opts+=" --config-file $NEUTRON_CONF"
+    opts+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
     local cfg_file
     for cfg_file in ${_NEUTRON_SERVER_EXTRA_CONF_FILES_ABS[@]}; do
         opts+=" --config-file $cfg_file"
@@ -405,7 +405,7 @@ function start_neutron_api {
 
     # Start the Neutron service
     # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $ops"
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
 
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"

From 84e45c91434c3c7e6796f9a201fd9b0fb8f7adcd Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 22 Feb 2017 14:25:14 -0500
Subject: [PATCH 1758/3333] lib/neutron: Fix an extra comma in service_plugins

Closes-Bug: #1667077
Change-Id: Ib63a94a931c38a7b2a5fc91a8339a9cd657f7927
---
 lib/neutron | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 7d427555a4..f277062b32 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -510,7 +510,10 @@ function neutron_service_plugin_class_add_new {
     local plugins=""
 
     plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
-    plugins+=",${service_plugin_class}"
+    if [ $plugins ]; then
+        plugins+=","
+    fi
+    plugins+="${service_plugin_class}"
     iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 

From f58b37356323262d9ce22815a4cf4e129195c679 Mon Sep 17 00:00:00 2001
From: Prashant Shetty <prashantshetty@vmware.com>
Date: Thu, 23 Feb 2017 13:48:12 +0000
Subject: [PATCH 1759/3333] Enable placement section on controller in multinode
 setup

Currently placement api section will be configured on controller
only if service n-cpu is running. It breaks multi node setup.
Closes-Bug: #1667219

Change-Id: I8b0f60f253859f704bb9831d7dac8f55df353ac7
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 7d440a7c20..9a0cec601f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -872,7 +872,7 @@ fi
 # if placement-api or placement-client is active, and n-cpu on the
 # same box.
 if is_service_enabled placement placement-client; then
-    if is_service_enabled n-cpu; then
+    if is_service_enabled n-cpu || is_service_enabled n-sch; then
         configure_placement_nova_compute
     fi
 fi

From 6f0205b03630ecb308877f65ca3d4ab9020bc28d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 22 Feb 2017 05:59:30 -0800
Subject: [PATCH 1760/3333] Refactor rpc backend vhost creation

The creation of the cellsv1 rpc vhost was buried in the restart function,
which makes it hard to extend. This breaks it out into a helper method
and moves the conditional logic into the nova module itself.

Change-Id: Ib0e377aabe45c27bb6ce59ca275ce73085e8b9d2
---
 lib/nova        |  1 +
 lib/rpc_backend | 19 +++++++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index 4c264209d5..f5ab20100e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -644,6 +644,7 @@ function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
+        rpc_backend_add_vhost child_cell
         iniset_rpc_backend nova $NOVA_CELLS_CONF DEFAULT child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
diff --git a/lib/rpc_backend b/lib/rpc_backend
index a21f781b4e..3c1404e998 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -97,13 +97,20 @@ function restart_rpc_backend {
 
             break
         done
-        if is_service_enabled n-cell; then
-            # Add partitioned access for the child cell
-            if [ -z `sudo rabbitmqctl list_vhosts | grep child_cell` ]; then
-                sudo rabbitmqctl add_vhost child_cell
-                sudo rabbitmqctl set_permissions -p child_cell $RABBIT_USERID ".*" ".*" ".*"
-            fi
+    fi
+}
+
+# adds a vhost to the rpc backend
+function rpc_backend_add_vhost {
+    local vhost="$1"
+    if is_service_enabled rabbit; then
+        if [ -z `sudo rabbitmqctl list_vhosts | grep $vhost` ]; then
+            sudo rabbitmqctl add_vhost $vhost
+            sudo rabbitmqctl set_permissions -p $vhost $RABBIT_USERID ".*" ".*" ".*"
         fi
+    else
+        echo 'RPC backend does not support vhosts'
+        return 1
     fi
 }
 

From 615e115474a570a9d3b7f6edfec365d1bbd31dc3 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 23 Feb 2017 10:41:51 +0000
Subject: [PATCH 1761/3333] lib/neutron: set variables needed for sane l3 agent
 setup

Since for the new devstack library we still rely on some functions from
ovs_base, we need to initialize them with sane default values so that
setup works as intended and as lib/neutron-legacy behaves by default for
external connectivity setup.

Change-Id: I412ed4f988b8e03a3e3a08066375b55a6e6aa3e6
---
 lib/neutron | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index d80e9d90a1..10f488de90 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -70,6 +70,14 @@ NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
 NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
+# This is needed because _neutron_ovs_base_configure_l3_agent will set
+# external_network_bridge
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
+# This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
+# an external network bridge
+PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
+
 # Additional neutron api config files
 declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 

From bf697f50650beecea46b665b706fa5bb5ecb1ede Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 23 Feb 2017 12:09:01 +0000
Subject: [PATCH 1762/3333] lib/neutron: untangle metering configuration from
 legacy

The old code assumed _neutron_service_plugin_class_add presence, as well
as used a configuration file path that is not standard (under
/etc/neutron/services/ instead of /etc/neutron/metering_agent.ini).

The patch untangles metering configuration in the new library from that
old and bad code, and reimplements it inline.

This should help the effort to switch gate from lib/neutron-legacy to
lib/neutron.

Change-Id: I0d235498af4b6a70bd5dae6ea178d5aa8ba41e80
---
 lib/neutron | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index d80e9d90a1..1aabf04b8a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -52,9 +52,13 @@ NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.
 NEUTRON_CORE_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_CORE_PLUGIN
 NEUTRON_CORE_PLUGIN_CONF=$NEUTRON_CORE_PLUGIN_CONF_PATH/$NEUTRON_CORE_PLUGIN_CONF_FILENAME
 
+NEUTRON_METERING_AGENT_CONF_FILENAME=${NEUTRON_METERING_AGENT_CONF_FILENAME:-metering_agent.ini}
+NEUTRON_METERING_AGENT_CONF=$NEUTRON_CONF_DIR/$NEUTRON_METERING_AGENT_CONF_FILENAME
+
 NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
 NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
 NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
+NEUTRON_METERING_BINARY=${NEUTRON_METERING_BINARY:-neutron-metering-agent}
 
 # Public facing bits
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
@@ -251,9 +255,7 @@ function configure_neutron_new {
 
     # Metering
     if is_service_enabled neutron-metering; then
-        source $TOP_DIR/lib/neutron_plugins/services/metering
-        neutron_agent_metering_configure_common
-        neutron_agent_metering_configure_agent
+        cp $NEUTRON_DIR/etc/metering_agent.ini.sample $NEUTRON_METERING_AGENT_CONF
         neutron_service_plugin_class_add metering
     fi
 }
@@ -454,7 +456,7 @@ function start_neutron_new {
     fi
 
     if is_service_enabled neutron-metering; then
-        run_process neutron-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
+        run_process neutron-metering "$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
     fi
 }
 

From 1d0841286e8eb4fbb18334cf664d89d78fef8efe Mon Sep 17 00:00:00 2001
From: Daniel Alvarez <dalvarez@redhat.com>
Date: Thu, 16 Feb 2017 09:38:13 +0000
Subject: [PATCH 1763/3333] Adding haproxy package to Neutron

This patch adds haproxy package to devstack as Neutron will rely on it
for serving metadata instead of the current Python implementation.

haproxy will reduce the memory footprint from ~50MB to ~1.5MB for
serving metadata. It will be spawned for every Neutron router so,
for large deployments, it will be a significant memory reduction.

Change-Id: I36a5531cacc21c0d4bb7f20d4bec6da65d04c262
---
 files/debs/neutron      | 1 +
 files/rpms-suse/neutron | 1 +
 files/rpms/neutron      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/neutron b/files/debs/neutron
index 2307fa54d5..e30f678f7a 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -2,6 +2,7 @@ acl
 dnsmasq-base
 dnsmasq-utils # for dhcp_release only available in dist:precise
 ebtables
+haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils-arping
 iputils-ping
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index e9abc6eca6..d1cc73f115 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -2,6 +2,7 @@ acl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
+haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
 mariadb # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 2e49a0cf93..a4e029a6eb 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -2,6 +2,7 @@ acl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
+haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
 mysql-devel

From 79b55f51e4a2a44e7e2a7a8c7df435e3451a4e22 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Wed, 22 Feb 2017 07:00:59 -0800
Subject: [PATCH 1764/3333] Fix file permissions for
 lib/neutron_plugins/linuxbridge_agent

The permissions changed with commit
40aae6adbfce1bd896d5f7b0e281e798b56d1ca8

TrivialFix

Change-Id: I100cb9589309f9289b4581265a5e4206464ddc0e
---
 lib/neutron_plugins/linuxbridge_agent | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
old mode 100755
new mode 100644

From 807de8e5907f4bce8a697c194383d161b0e9c572 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Fri, 24 Feb 2017 14:55:33 +0100
Subject: [PATCH 1765/3333] Set OS_AUTH_TYPE to password

Devstack configures keystone for auth mechanism but don't tell
keystoneauth1 library that it should use keystone too.

In simple case, this is not an issue because some application
set 'password' by default (like the openstack cli).

But applications can have no default or another default.

Change-Id: Idd1e1d2e7546fce7531175440788a8c7cb27aec1
---
 openrc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/openrc b/openrc
index 483b5af387..7d5f0bbf3e 100644
--- a/openrc
+++ b/openrc
@@ -79,6 +79,9 @@ KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
+# Ask keystoneauth1 to use keystone
+export OS_AUTH_TYPE=password
+
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/project has access to - including nova, glance, keystone, swift, ...

From f069acf9ee4ecb0532d55158c99356faa4ff6fc9 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Fri, 24 Feb 2017 16:25:59 +0100
Subject: [PATCH 1766/3333] Make subnet pool names unique

Using the same name for two different subnet pools means that one needs
to reference them by their UUID. Choosing unique names will allow us to
use the name to reference the pool later on.

At the same time simplify the command used for pool creation by
instructing OSC to only output the value that we are interested in.

Change-Id: Idedcb6328925d44cdd0f415450ec4ebbc272401d
---
 lib/neutron_plugins/services/l3 | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index e87a30cadb..381162693d 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -87,7 +87,8 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
 # Subnetpool defaults
 USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
-SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
+SUBNETPOOL_NAME_V4=${SUBNETPOOL_NAME:-"shared-default-subnetpool-v4"}
+SUBNETPOOL_NAME_V6=${SUBNETPOOL_NAME:-"shared-default-subnetpool-v6"}
 
 SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-$IPV4_ADDRS_SAFE_TO_USE}
 SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
@@ -169,10 +170,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default | grep ' id ' | get_field 2)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default | grep ' id ' | get_field 2)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
             fi
         fi
     fi

From a1875b1ffcf29a7c1645d8e21402da331c102b6e Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 23 Feb 2017 05:44:22 +0900
Subject: [PATCH 1767/3333] neutron-legacy: Defer service_plugins configuration

This allows post-config phase to use neutron_service_plugin_class_add
so that devstack plugins can use it in the same way for both of
neutron-legacy and its "modern" counterpart, lib/neutron.

Closes-Bug: #1667037
Change-Id: I9068fd608e82e70db8d725f92269a26920efebcb
---
 lib/neutron-legacy | 13 ++++++++-----
 stack.sh           |  1 +
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b381b642c6..446c7144f5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -20,6 +20,7 @@
 # - init_neutron_third_party
 # - start_neutron_third_party
 # - create_nova_conf_neutron
+# - configure_neutron_after_post_config
 # - start_neutron_service_and_check
 # - check_neutron_third_party_integration
 # - start_neutron_agents
@@ -331,7 +332,6 @@ function configure_mutnauq {
     _configure_neutron_common
     iniset_rpc_backend neutron $NEUTRON_CONF
 
-    # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -464,6 +464,13 @@ function install_neutron_agent_packages_mutnauq {
     fi
 }
 
+# Finish neutron configuration
+function configure_neutron_after_post_config {
+    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
+        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
+    fi
+}
+
 # Start running processes, including screen
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
@@ -836,10 +843,6 @@ function _configure_neutron_service {
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
 
-    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
-        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
-    fi
-
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
diff --git a/stack.sh b/stack.sh
index 7d440a7c20..19b07ab06b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1241,6 +1241,7 @@ if is_service_enabled neutron-api; then
     start_neutron_api
 elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
+    configure_neutron_after_post_config
     start_neutron_service_and_check
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}

From c043b6f8a84a575ea5cedc71499a81414a610e70 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 23 Feb 2017 22:30:08 -0500
Subject: [PATCH 1768/3333] lib/neutron: Add neutron_deploy_rootwrap_filters

Change-Id: Icfa2cfa662013324d38099b82ce0f58ed8377e60
---
 lib/neutron | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index f277062b32..c43cb674ba 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -521,6 +521,13 @@ function neutron_server_config_add_new {
     _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
 }
 
+# neutron_deploy_rootwrap_filters() - deploy rootwrap filters
+function neutron_deploy_rootwrap_filters_new {
+    local srcdir=$1
+    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
+    sudo install -o root -g root -m 644 $srcdir/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
+}
+
 # Dispatch functions
 # These are needed for compatibility between the old and new implementations
 # where there are function name overlaps.  These will be removed when
@@ -626,5 +633,14 @@ function stop_neutron {
     fi
 }
 
+function neutron_deploy_rootwrap_filters {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        _neutron_deploy_rootwrap_filters "$@"
+    else
+        neutron_deploy_rootwrap_filters_new "$@"
+    fi
+}
+
 # Restore xtrace
 $XTRACE

From 3a6916e76811cbd1962636e4fe8016f79ed6028e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Sat, 25 Feb 2017 05:12:38 +0000
Subject: [PATCH 1769/3333] Install same packages for neutron-* services as for
 q-*

This patch creates symlinks between neutron-* files tracking runtime
dependencies for services, and q-* files. Since lib/neutron is the
new recommended way to deploy neutron with devstack, this patch made
neutron-* files real files, while q-* files are just symlinks.

Change-Id: I0f361f31160d0fee40ad3e8de873edd05173e54e
---
 files/debs/neutron-agent      | 1 +
 files/debs/neutron-l3         | 3 +++
 files/debs/q-agt              | 2 +-
 files/debs/q-l3               | 4 +---
 files/rpms-suse/neutron-agent | 1 +
 files/rpms-suse/neutron-l3    | 2 ++
 files/rpms-suse/q-agt         | 2 +-
 files/rpms-suse/q-l3          | 3 +--
 files/rpms/neutron-agent      | 1 +
 files/rpms/neutron-l3         | 2 ++
 files/rpms/q-agt              | 2 +-
 files/rpms/q-l3               | 3 +--
 12 files changed, 16 insertions(+), 10 deletions(-)
 create mode 100644 files/debs/neutron-agent
 create mode 100644 files/debs/neutron-l3
 mode change 100644 => 120000 files/debs/q-agt
 mode change 100644 => 120000 files/debs/q-l3
 create mode 100644 files/rpms-suse/neutron-agent
 create mode 100644 files/rpms-suse/neutron-l3
 mode change 100644 => 120000 files/rpms-suse/q-agt
 mode change 100644 => 120000 files/rpms-suse/q-l3
 create mode 100644 files/rpms/neutron-agent
 create mode 100644 files/rpms/neutron-l3
 mode change 100644 => 120000 files/rpms/q-agt
 mode change 100644 => 120000 files/rpms/q-l3

diff --git a/files/debs/neutron-agent b/files/debs/neutron-agent
new file mode 100644
index 0000000000..ea8819e884
--- /dev/null
+++ b/files/debs/neutron-agent
@@ -0,0 +1 @@
+ipset
diff --git a/files/debs/neutron-l3 b/files/debs/neutron-l3
new file mode 100644
index 0000000000..106a6a35aa
--- /dev/null
+++ b/files/debs/neutron-l3
@@ -0,0 +1,3 @@
+conntrack
+conntrackd
+keepalived
diff --git a/files/debs/q-agt b/files/debs/q-agt
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/debs/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/debs/q-agt b/files/debs/q-agt
new file mode 120000
index 0000000000..99fe353094
--- /dev/null
+++ b/files/debs/q-agt
@@ -0,0 +1 @@
+neutron-agent
\ No newline at end of file
diff --git a/files/debs/q-l3 b/files/debs/q-l3
deleted file mode 100644
index 106a6a35aa..0000000000
--- a/files/debs/q-l3
+++ /dev/null
@@ -1,3 +0,0 @@
-conntrack
-conntrackd
-keepalived
diff --git a/files/debs/q-l3 b/files/debs/q-l3
new file mode 120000
index 0000000000..0a5ca2a45f
--- /dev/null
+++ b/files/debs/q-l3
@@ -0,0 +1 @@
+neutron-l3
\ No newline at end of file
diff --git a/files/rpms-suse/neutron-agent b/files/rpms-suse/neutron-agent
new file mode 100644
index 0000000000..ea8819e884
--- /dev/null
+++ b/files/rpms-suse/neutron-agent
@@ -0,0 +1 @@
+ipset
diff --git a/files/rpms-suse/neutron-l3 b/files/rpms-suse/neutron-l3
new file mode 100644
index 0000000000..a7a190c063
--- /dev/null
+++ b/files/rpms-suse/neutron-l3
@@ -0,0 +1,2 @@
+conntrack-tools
+keepalived
diff --git a/files/rpms-suse/q-agt b/files/rpms-suse/q-agt
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/rpms-suse/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/rpms-suse/q-agt b/files/rpms-suse/q-agt
new file mode 120000
index 0000000000..99fe353094
--- /dev/null
+++ b/files/rpms-suse/q-agt
@@ -0,0 +1 @@
+neutron-agent
\ No newline at end of file
diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
deleted file mode 100644
index a7a190c063..0000000000
--- a/files/rpms-suse/q-l3
+++ /dev/null
@@ -1,2 +0,0 @@
-conntrack-tools
-keepalived
diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
new file mode 120000
index 0000000000..0a5ca2a45f
--- /dev/null
+++ b/files/rpms-suse/q-l3
@@ -0,0 +1 @@
+neutron-l3
\ No newline at end of file
diff --git a/files/rpms/neutron-agent b/files/rpms/neutron-agent
new file mode 100644
index 0000000000..ea8819e884
--- /dev/null
+++ b/files/rpms/neutron-agent
@@ -0,0 +1 @@
+ipset
diff --git a/files/rpms/neutron-l3 b/files/rpms/neutron-l3
new file mode 100644
index 0000000000..a7a190c063
--- /dev/null
+++ b/files/rpms/neutron-l3
@@ -0,0 +1,2 @@
+conntrack-tools
+keepalived
diff --git a/files/rpms/q-agt b/files/rpms/q-agt
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/rpms/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/rpms/q-agt b/files/rpms/q-agt
new file mode 120000
index 0000000000..99fe353094
--- /dev/null
+++ b/files/rpms/q-agt
@@ -0,0 +1 @@
+neutron-agent
\ No newline at end of file
diff --git a/files/rpms/q-l3 b/files/rpms/q-l3
deleted file mode 100644
index a7a190c063..0000000000
--- a/files/rpms/q-l3
+++ /dev/null
@@ -1,2 +0,0 @@
-conntrack-tools
-keepalived
diff --git a/files/rpms/q-l3 b/files/rpms/q-l3
new file mode 120000
index 0000000000..0a5ca2a45f
--- /dev/null
+++ b/files/rpms/q-l3
@@ -0,0 +1 @@
+neutron-l3
\ No newline at end of file

From 1e7f738f284b85ed95d514fb13fbc1afb6b31087 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 27 Feb 2017 11:19:40 +1100
Subject: [PATCH 1770/3333] Ensure we install setuptools from requirements

Use pip_install_gr so we get the version pinned by requirements.  The
depends-on is an example of where we're trying to pin to workaround
issues.

Depends-On: I9c57c08a150571c5bb62235d502839394d53a4c1
Change-Id: I780cca681b12a3e9d228dbf2fd9fa6e8ab1a82e1
---
 tools/install_pip.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index a5ccb19399..dbe52782a4 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -144,6 +144,9 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
 fi
 
 set -x
-pip_install -U setuptools
+
+# Note setuptools is part of requirements.txt and we want to make sure
+# we obey any versioning as described there.
+pip_install_gr setuptools
 
 get_versions

From 52bb64105fd559ee69a8ec1c0733e1f7448401a5 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 27 Feb 2017 15:11:11 +1100
Subject: [PATCH 1771/3333] Use qemu-kvm-ev package on centos

For the latest qemu-kvm, you have to use the qemu-kvm-ev package,
which is based off the qemu-kvm-rhev package, which is explained in
[1] but you probably can't read it.  The gist is, that qemu-kvm-rhev
is a later build of kvm that is incompatible with the base version
provided.  qemu-kvm-rhev is only provided with the RHV (ovirt) and
RHOS (openstack) products.  CentOS rebuilds this package as
qemu-kvm-ev as part of it's virtualisation SIG.

I9a972e3fde2e4e552f6fc98350820c07873c3de3 has bumped up the minimum
qemu version to 2.1.0.  It seems there is a an issue (bug #1668164)
where having the qemu-system package installed gets picked up if
installed, and reports the incorrect version to nova, causing failure.

This removes the installs from files/rpms/nova as it is all being done
in function-libvirt.  We only install the qemu-kvm-ev package on
centos and remove the old work-around.

[1] https://access.redhat.com/solutions/629513
[2] https://wiki.centos.org/SpecialInterestGroup/Virtualization

Change-Id: Ide91b261f35fb19d8bd7155ca016fa3b76a45ea1
---
 files/rpms/nova                    |  5 -----
 lib/nova_plugins/functions-libvirt | 21 +++++++++++++--------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/files/rpms/nova b/files/rpms/nova
index 45f1c94f1f..a368c552aa 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -9,10 +9,6 @@ iptables
 iputils
 kernel-modules # dist:f23,f24,f25
 kpartx
-kvm # NOPRIME
-libvirt-bin # NOPRIME
-libvirt-devel # NOPRIME
-libvirt-python # NOPRIME
 libxml2-python
 m2crypto
 mysql-devel
@@ -21,7 +17,6 @@ mysql-server # NOPRIME
 numpy # needed by websockify for spice console
 parted
 polkit
-qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 sqlite
 sudo
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 47b054bc58..d225ef84fb 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -34,18 +34,23 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         # On "KVM for IBM z Systems", kvm does not have its own package
-        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
+        if [[ ! ${DISTRO} =~ "kvmibm1" && ! ${DISTRO} =~ "rhel7" ]]; then
             install_package kvm
         fi
-        # there is a dependency issue with kvm (which is really just a
-        # wrapper to qemu-system-x86) that leaves some bios files out,
-        # so install qemu-kvm (which shouldn't strictly be needed, as
-        # everything has been merged into qemu-system-x86) to bring in
-        # the right packages. see
-        # https://bugzilla.redhat.com/show_bug.cgi?id=1235890
-        install_package qemu-kvm
+
+        if [[ ${DISTRO} =~ "rhel7" ]]; then
+            # On centos7 install the qemu-kvm-ev package, which is a
+            # later version of qemu-kvm rebuilt from the qemu-kvm-rhev
+            # package by the virt SIG (as required by nova).  This
+            # package is only provided for RHOS (openstack) or RHV
+            # (ovirt) in RHEL.  We have already insalled the RDO
+            # repositories which provide this.
+            install_package qemu-kvm-ev
+        fi
+
         install_package libvirt libvirt-devel
         pip_install_gr libvirt-python
+
     fi
 }
 

From 0bf75a471ecce8c05718644e7e070b4d5a8657d6 Mon Sep 17 00:00:00 2001
From: Denis Buliga <dbuliga@cloudbasesolutions.com>
Date: Mon, 6 Feb 2017 16:56:46 +0200
Subject: [PATCH 1772/3333] Skips enabling kernel bridge firewall in container

Calling enable_kernel_bridge_firewall inside a
container, devstack will crash because it tries to
load a kernel module by calling 'sudo modprobe' on
net.bridge.

Change-Id: Id4718c065d5a8c507d49f38e19c2796a64221aa4
Closes-Bug: #1662194
---
 functions                             | 10 ++++++++++
 lib/neutron                           |  4 +++-
 lib/neutron_plugins/linuxbridge_agent |  4 +++-
 lib/neutron_plugins/ovs_base          |  4 +++-
 lib/nova                              |  4 +++-
 5 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index 89ee3672d3..f262fbccc4 100644
--- a/functions
+++ b/functions
@@ -664,6 +664,16 @@ function set_mtu {
 }
 
 
+# running_in_container - Returns true otherwise false
+function running_in_container {
+    if grep -q lxc /proc/1/cgroup; then
+        return 0
+    fi
+
+    return 1
+}
+
+
 # enable_kernel_bridge_firewall - Enable kernel support for bridge firewalling
 function enable_kernel_bridge_firewall {
     # Load bridge module. This module provides access to firewall for bridged
diff --git a/lib/neutron b/lib/neutron
index f6c705c2b0..a43fdeb903 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -188,7 +188,9 @@ function configure_neutron_new {
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
 
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     fi
 
     # DHCP Agent
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 0c8ccb8718..f031fc7c59 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -71,7 +71,9 @@ function neutron_plugin_configure_plugin_agent {
     fi
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 62a4d00bcd..733a5c13e2 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -88,7 +88,9 @@ function _neutron_ovs_base_configure_debug_command {
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver noop
     fi
diff --git a/lib/nova b/lib/nova
index 4d336f6271..d1c0d470a7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -864,7 +864,9 @@ function start_nova_rest {
     run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
 
     if is_service_enabled n-net; then
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     fi
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
 

From 4af6eeac524f2ba316b0198a72ef8d916df9d56f Mon Sep 17 00:00:00 2001
From: Eli Qiao <liyong.qiao@intel.com>
Date: Tue, 28 Feb 2017 15:13:02 +0800
Subject: [PATCH 1773/3333] cinder: wait for cinder-api for wsgi too

Wait for cinder-api's status if CINDER_USE_MOD_WSGI=True

Change-Id: I40e5e08633572f877a25280496141423f232d447
---
 lib/cinder | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 767fd00d34..130345f560 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -528,10 +528,11 @@ function start_cinder {
         tail_log c-api /var/log/$APACHE_NAME/c-api.log
     else
         run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-        echo "Waiting for Cinder API to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-            die $LINENO "c-api did not start"
-        fi
+    fi
+
+    echo "Waiting for Cinder API to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
+        die $LINENO "c-api did not start"
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"

From e624e48ddf8ba9e8bd12e1de5990ae74bb269922 Mon Sep 17 00:00:00 2001
From: Eli Qiao <liyong.qiao@intel.com>
Date: Tue, 28 Feb 2017 15:16:16 +0800
Subject: [PATCH 1774/3333] nova: Fix comments for _config_nova_apache_wsgi

Comments cleanup.

Change-Id: I02748b906f7bb75240bc4e5259005cd72ef49f6b
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index f5ab20100e..b4a5fb143c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -247,7 +247,7 @@ function _cleanup_nova_apache_wsgi {
     sudo rm -f $(apache_site_config_for nova-metadata)
 }
 
-# _config_nova_apache_wsgi() - Set WSGI config files of Keystone
+# _config_nova_apache_wsgi() - Set WSGI config files of Nova API
 function _config_nova_apache_wsgi {
     sudo mkdir -p $NOVA_WSGI_DIR
 

From 19f4b3faae5f64a497bf6c13fb29b65301ae499c Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 23 Feb 2017 20:44:18 +0000
Subject: [PATCH 1775/3333] lib/neutron: stop loading all config files into all
 processes

DHCP agent should not load core plugin config file; L3 agent has no
interest in metadata agent configuration file; etc. It's a mistake to
form a single global list of configuration files and pass it into all
processes. Every process should have its own list, that may or may not
have some files in common with other processes.

The only file that is common to all neutron processes is neutron.conf,
and we could in theory keep it into the common list. But I decided at
this point it's better to be explicit about what's loaded into services.
Also the order of arguments is important, and neutron.conf should always
be the first CLI argument, which is hard to achieve by keeping
neutron.conf file in the global list.

Plugins may be interested in loading additional files into neutron
processes. For example, dragonflow needs to load /etc/neutron/dragonflow.ini
into neutron-server. But we should not necessarily load all those files
into all processes, so such extendable lists should be per process.
Besides, neutron_server_config_add_new is already available to use to
append additional configuration files for neutron-server. That's why the
patch completely kills the NEUTRON_CONFIG_ARG variable.

Depends-On: I4bd54a41a45486a5601373f9a9cce74d7686d1aa
Change-Id: Ia3c3862399bba335db5edf9ea70f850fb2638d09
---
 lib/neutron | 40 ++++++----------------------------------
 1 file changed, 6 insertions(+), 34 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 19568eaf25..d80e9d90a1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -70,9 +70,6 @@ NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
 NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
-# Add all enabled config files to a single config arg
-NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
-
 # Additional neutron api config files
 declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
@@ -347,7 +344,7 @@ function init_neutron_new {
     recreate_database neutron
 
     # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage $NEUTRON_CONFIG_ARG upgrade heads
+    $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
 
     create_neutron_cache_dir
 }
@@ -426,20 +423,19 @@ function start_neutron_api {
 
 # start_neutron() - Start running processes, including screen
 function start_neutron_new {
-    _set_config_files
-
     # Start up the neutron agents if enabled
     # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
     # can resolve the $NEUTRON_AGENT_BINARY
     if is_service_enabled neutron-agent; then
-        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY $NEUTRON_CONFIG_ARG"
+        # TODO(ihrachys) stop loading ml2_conf.ini into agents, instead load agent specific files
+        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
     fi
     if is_service_enabled neutron-dhcp; then
         neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
-        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY $NEUTRON_CONFIG_ARG"
+        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_DHCP_CONF"
     fi
     if is_service_enabled neutron-l3; then
-        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
+        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_L3_CONF"
     fi
     if is_service_enabled neutron-api; then
         # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
@@ -454,7 +450,7 @@ function start_neutron_new {
         fi
     fi
     if is_service_enabled neutron-metadata-agent; then
-        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
+        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_META_CONF"
     fi
 
     if is_service_enabled neutron-metering; then
@@ -480,30 +476,6 @@ function stop_neutron_new {
     fi
 }
 
-# Compile the lost of enabled config files
-function _set_config_files {
-
-    NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
-
-    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_CORE_PLUGIN_CONF (ml2_conf.ini) but others may not
-    if is_service_enabled neutron-agent; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
-    fi
-
-    if is_service_enabled neutron-dhcp; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_DHCP_CONF"
-    fi
-
-    if is_service_enabled neutron-l3; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_L3_CONF"
-    fi
-
-    if is_service_enabled neutron-metadata-agent; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_META_CONF"
-    fi
-
-}
-
 # neutron_service_plugin_class_add() - add service plugin class
 function neutron_service_plugin_class_add_new {
     local service_plugin_class=$1

From 0b1ea080a256b02610f1c9a840a3c2a3f4ea0e68 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 28 Feb 2017 14:04:59 -0500
Subject: [PATCH 1776/3333] install OSC with py3 by default

Add python-openstackclient to the list of packages installed under
Python 3 by default, so that jobs running with Python 3 exercise the
client that way.

Change-Id: I9778a6810bb3e4850132cfc19e583d50fed23ef5
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 95f017b9b1..9673074a5e 100644
--- a/stackrc
+++ b/stackrc
@@ -109,7 +109,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 # base name of the directory from which they are installed. See
 # enable_python3_package to edit this variable and use_python3_for to
 # test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi"
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient"
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.

From f119121d21fa0446197b26378091677daac1606a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 16 Feb 2017 16:33:08 -0500
Subject: [PATCH 1777/3333] clean up virt drivers that we do image logic for

openvz is not in the nova tree, and is referencing a crazy old image,
we're going to assume that if anyone is using this they can build a
devstack plugin.

drop doing anything by default because this actually requires that we
special case things like ironic in tree to *not* do anything by
default.

Change-Id: I9d33b98263c3d52a95b9983e90eb0b341fa1d363
---
 stackrc | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/stackrc b/stackrc
index 95f017b9b1..97819d712b 100644
--- a/stackrc
+++ b/stackrc
@@ -636,9 +636,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
         IMAGE_URLS+=","
     fi
     case "$VIRT_DRIVER" in
-        openvz)
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ubuntu-12.04-x86_64}
-            IMAGE_URLS+="http://download.openvz.org/template/precreated/ubuntu-12.04-x86_64.tar.gz";;
         libvirt)
             case "$LIBVIRT_TYPE" in
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
@@ -656,13 +653,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
-        ironic)
-            # NOTE(lucasagomes): The logic setting the default image
-            # now lives in the Ironic tree
-            ;;
-        *) # Default to Cirros qcow2 image file
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From b1d8519b40845c3b28c32e530010aa015f970185 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 23 Feb 2017 08:01:32 -0800
Subject: [PATCH 1778/3333] Move rpc backend start/configure to earlier

Because things like nova may need to create vhosts in the rpc backend,
we need to have started and created credentials before we configure
the service.

Change-Id: I01c9c5288e197fc50a8a4a032e3a32cd166eb180
---
 stack.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 94315e1368..2f43db7418 100755
--- a/stack.sh
+++ b/stack.sh
@@ -761,6 +761,7 @@ install_infra
 run_phase stack pre-install
 
 install_rpc_backend
+restart_rpc_backend
 
 # NOTE(sdague): dlm install is conditional on one being enabled by configuration
 install_dlm
@@ -952,11 +953,6 @@ EOF
 fi
 
 
-# Finalize queue installation
-# ----------------------------
-restart_rpc_backend
-
-
 # Export Certificate Authority Bundle
 # -----------------------------------
 

From 94c400cc5428f24d96ed98678a988bd26485e63e Mon Sep 17 00:00:00 2001
From: Rodrigo Duarte Sousa <rduartes@redhat.com>
Date: Thu, 2 Feb 2017 14:48:28 -0300
Subject: [PATCH 1779/3333] Add allow_global_implied_dsr_disabled feature flag

This patch enabled the "allow_global_implied_dsr_disabled" feature
flag. This is a feature flag toggle for bug 1590578 which is fixed
in Newton and Ocata. This option can be removed after Mitaka is
end of life.

Change-Id: I70e3ce79ee6d9b00cc48bb178bd423d0196f6588
Related-Bug: #1590578
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 128e9728fe..d95a9f5c3d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -290,6 +290,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
     fi
 
+    # TODO(rodrigods): This is a feature flag for bug 1590578 which is fixed in
+    # Newton and Ocata. This option can be removed after Mitaka is end of life.
+    iniset $TEMPEST_CONFIG identity-feature-enabled forbid_global_implied_dsr True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 008aa3e095904130e191f5867ec47d4cf53353da Mon Sep 17 00:00:00 2001
From: Evgeny Antyshev <eantyshev@virtuozzo.com>
Date: Thu, 2 Mar 2017 11:14:25 +0000
Subject: [PATCH 1780/3333] Fix install_libvirt for other RHEL-based distros

Since https://review.openstack.org/#/c/438325 landed
it only works for Centos 7, but not for other
RHEL-based distributions: Virtuozzo and, probably, RHEV.

Both of above have own version for qemu-kvm package: qemu-kvm-vz and qemu-kvm-rhev,
accordingly. These packages provide "qemu-kvm", like qemu-kvm-ev,
and, when you call "yum install qemu-kvm", they replace the default OS package.

Change-Id: I46da627c0da8925064862fdc283db81591979285
---
 lib/nova_plugins/functions-libvirt | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d225ef84fb..56bb6bda1c 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -39,13 +39,11 @@ function install_libvirt {
         fi
 
         if [[ ${DISTRO} =~ "rhel7" ]]; then
-            # On centos7 install the qemu-kvm-ev package, which is a
-            # later version of qemu-kvm rebuilt from the qemu-kvm-rhev
-            # package by the virt SIG (as required by nova).  This
-            # package is only provided for RHOS (openstack) or RHV
-            # (ovirt) in RHEL.  We have already insalled the RDO
-            # repositories which provide this.
-            install_package qemu-kvm-ev
+            # This should install the latest qemu-kvm build,
+            # which is called qemu-kvm-ev in centos7
+            # (as the default OS qemu-kvm package is usually rather old,
+            # and should be updated by above)
+            install_package qemu-kvm
         fi
 
         install_package libvirt libvirt-devel

From 1e66388c5f2b81b4fc5d544dbf5fde2935218bd0 Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@amrith.org>
Date: Mon, 27 Feb 2017 13:29:03 -0500
Subject: [PATCH 1781/3333] put mysql on a memory diet

We propose several MySQL configuration parameter changes (with
explanations) to reduce the memory footprint of MySQL. A demonstration
of the improvement is provided in
https://etherpad.openstack.org/p/change-438668.

As Clint provided some of the descriptions that I've used, I have
listed him as a co-author (thanks Clint). Let this serve as a warning
to all that commetors may be enlisted :)

Change-Id: Icb2d6ea91d3d45a68ce99c817a746b10039479cc
Co-Authored-By: Clint 'SpamapS' Byrum <clint@fewbar.com>
---
 lib/databases/mysql | 183 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 182 insertions(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7bbcace399..e2c83433d2 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -96,10 +96,191 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
-    iniset -sudo $my_conf mysqld max_connections 1024
+
+    # the number of connections has been throttled to 256. In the
+    # event that the gate jobs report "Too many connections" it is
+    # indicative of a problem that could be the result of one of many
+    # things. For more details about debugging this error, refer
+    # https://dev.mysql.com/doc/refman/5.5/en/too-many-connections.html.
+    # Note that the problem may not ONLY be an issue with MySQL
+    # connections. If the number of fd's at the OS is too low, you
+    # could see errors manifest as MySQL "too many connections".
+    iniset -sudo $my_conf mysqld max_connections 256
     iniset -sudo $my_conf mysqld query_cache_type OFF
     iniset -sudo $my_conf mysqld query_cache_size 0
 
+    # Additional settings to put MySQL on a memory diet. These
+    # settings are used in conjunction with the cap on max_connections
+    # as the total memory used by MySQL can be simply viewed as
+    # fixed-allocations + max_connections * variable-allocations. A
+    # nifty tool to help with this is
+    # http://www.mysqlcalculator.com/. A short description of each of
+    # the settings follows.
+
+    # binlog_cache_size, determines the size of cache to hold changes
+    # to the binary log during a transaction, for each connection. For
+    # more details, refer
+    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_cache_size
+    # When binary logging is enabled, a smaller binlog cache could
+    # result in more frequent flushes to the disk and a larger value
+    # would result in less flushes to the disk but higher memory
+    # usage. This however only has to do with large transactions; if
+    # you have a small transaction the binlog cache is necessarily
+    # flushed on a transaction commit. This is a per-connection cache.
+    iniset -sudo $my_conf mysqld binlog_cache_size 4K
+
+    # binlog_stmt_cache_size determines the size of cache to hold non
+    # transactional statements in the binary log. For more details,
+    # refer
+    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_stmt_cache_size
+    # This cache holds changes to non-transactional tables (read:
+    # MyISAM) or any non-transactional statements which cause
+    # modifications to data (truncate is an example). These are
+    # written to disk immediately on completion of the statement or
+    # when the cache is full. If the cache is too small, you get
+    # frequent writes to the disk (flush) and if the cache is too
+    # large, it takes up more memory. This is a per-connection cache.
+    iniset -sudo $my_conf mysqld binlog_stmt_cache_size 4K
+
+    # bulk_insert_buffer_size for MyISAM tables that use a special
+    # cache for insert statements and load statements, this cache is
+    # used to optimize writes to the disk. If the value is set to 0,
+    # the optimization is disabled. For more details refer
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_bulk_insert_buffer_size
+    # We set this to 0 which could result in higher disk I/O (I/O on
+    # each insert block completion).
+    iniset -sudo $my_conf mysqld bulk_insert_buffer_size 0
+
+    # host_cache_size controls a DNS lookup optimization. For more
+    # details refer
+    # https://dev.mysql.com/doc/refman/5.6/en/host-cache.html
+    iniset -sudo $my_conf mysqld host_cache_size 0
+
+    # innodb_buffer_pool_size This is the size of the server wide
+    # buffer pool. It is the cache for all data blocks being used by
+    # the server and is managed as a LRU chain. Dirty blocks either
+    # age off the list or are forced off when the list is
+    # full. Setting this to 5MB (default 128MB) reduces the amount of
+    # memory used by the server and this will result in more disk I/O
+    # in cases where (a) there is considerable write activity that
+    # overwhelms the allocated cache, or (b) there is considerable
+    # read activity on a data set that exceeds the allocated
+    # cache. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.6/en/innodb-parameters.html#sysvar_innodb_buffer_pool_size
+    iniset -sudo $my_conf mysqld innodb_buffer_pool_size 5M
+
+    # innodb_ft_cache_size and innodb_ft_total_cache_size control the
+    # per-connection full text search cache and the server wide
+    # maximum full text search cache. We should not be using full text
+    # search and the value is set to the minimum allowable. The former
+    # is a per-connection cache size and the latter is server
+    # wide. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_cache_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_total_cache_size
+    iniset -sudo $my_conf mysqld innodb_ft_cache_size 1600000
+    iniset -sudo $my_conf mysqld innodb_ft_total_cache_size 32000000
+
+    # innodb_log_buffer_size This buffer is used to buffer
+    # transactions in-memory before writing them to the innodb
+    # internal transaction log. Large transactions, or high amounts of
+    # concurrency, will cause the system to fill this faster and thus
+    # make the system more disk-bound. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_log_buffer_size
+    iniset -sudo $my_conf mysqld innodb_log_buffer_size 256K
+
+    # innodb_sort_buffer_size, This buffer is used for sorting when
+    # InnoDB is creating indexes. Could cause that to be slower, but
+    # only if tables are large. This is a per-connection setting. For
+    # more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
+    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
+
+    # join_buffer_size, This buffer makes table and index scans
+    # faster. So this setting could make some queries more disk
+    # bound. This is a per-connection setting. For more details refer
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_join_buffer_size.
+    iniset -sudo $my_conf mysqld join_buffer_size 128
+
+    # key_buffer_size defines the index blocks used for MyISAM tables
+    # and shared between threads. This is a server wide setting. For
+    # more details see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_key_buffer_size
+    iniset -sudo $my_conf mysqld key_buffer_size 8
+
+    # max_heap_table_size sets the maximum amount of memory for MEMORY
+    # tables (which we don't use). The value is set to 16k, the
+    # minimum allowed. For more details, see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_max_heap_table_size
+    iniset -sudo $my_conf mysqld max_heap_table_size 16K
+
+    # net_buffer_length Each client has a buffer for incoming and
+    # outgoing data, both start with a size of net_buffer_length and
+    # can grow (in steps of 2x) upto a size of max_allowed_packet. For
+    # more details see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_net_buffer_length
+    iniset -sudo $my_conf mysqld net_buffer_length 1K
+
+    # read_buffer_size, read_rnd_buffer_size are per-thread buffer
+    # used for scans on MyISAM tables. It is a per-connection setting
+    # and so we set it to the minimum value allowable. Same for
+    # read_rnd_buffer_size. For more details refer
+    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_buffer_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_rnd_buffer_size
+    iniset -sudo $my_conf mysqld read_buffer_size 8200
+    iniset -sudo $my_conf mysqld read_rnd_buffer_size 8200
+
+    # sort_buffer_size when a sort is requested, it will be performed
+    # in memory in a buffer of this size (allocated per connection)
+    # and if the data exceeds this size it will spill to disk. The
+    # innodb and myisam variables are used in computing indices for
+    # tables using the specified storage engine. Since we don't
+    # dynamically reindex (except during upgrade) these values should
+    # never be material. Obviously performance of disk based sorts is
+    # worse than in memory sorts and therefore a high value here will
+    # improve sort performance for large data. For more details,
+    # refer:
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_sort_buffer_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_myisam_sort_buffer_size
+    iniset -sudo $my_conf mysqld sort_buffer_size 32K
+    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
+    iniset -sudo $my_conf mysqld myisam_sort_buffer_size 4K
+
+    # thread_cache_size specifies how many internal threads to cache
+    # for use with incoming connections. We set this to 0 whic means
+    # that each connection will cause a new thread to be created. This
+    # could cause connections to take marginally longer on os'es with
+    # slow pthread_create calls. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_thread_cache_size
+    iniset -sudo $my_conf mysqld thread_cache_size 0
+
+    # thread_stack is the per connection stack size, the minimum is
+    # 128k and the default is 192k on 32bit and 256k on 64bit
+    # systems. We set this to 192k. Complex queries which require
+    # recursion, stored procedures or other memory intensive
+    # operations could exhaust this and generate a very characteristic
+    # failure ("stack overflow") which is cleanly detected and the
+    # query is killed. For more details see
+    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_thread_stack
+    iniset -sudo $my_conf mysqld thread_stack 196608
+
+    # tmp_table_size is the maximum size of an in-memory temporary
+    # table. Temporary tables are created by MySQL as part of a
+    # multi-step query plan. The actual size of the temp table will be
+    # the lesser of tmp_table_size and max_heap_table_size. If a
+    # temporary table exceeds this size, it will be spooled to disk
+    # using the internal_tmp_disk_storage_engine (default
+    # MyISAM). Queries that often generate in-memory temporary tables
+    # include queries that have sorts, distinct, or group by
+    # operations, also queries that perform IN joins. For more details
+    # see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_tmp_table_size
+    iniset -sudo $my_conf mysqld tmp_table_size 1K
+
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"
         if is_fedora; then

From 0ce4ba915bb6649884e1a3b6c72a8e879eb562f9 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 24 Feb 2017 05:13:53 +0000
Subject: [PATCH 1782/3333] Use lib/keystone to configure [nova] section in
 neutron.conf

This simplifies neutron library code and makes it less prone to breakage
in the future. So far there are no specific known issues with existing
code per se, it works, still.

Change-Id: I28f1997d226baae902dae5ca8ee6cd4fd89efe31
---
 lib/neutron | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index f277062b32..f9d044225f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -153,15 +153,7 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
-
-        iniset $NEUTRON_CONF nova auth_type password
-        iniset $NEUTRON_CONF nova auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
-        iniset $NEUTRON_CONF nova username nova
-        iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
-        iniset $NEUTRON_CONF nova user_domain_id default
-        iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
-        iniset $NEUTRON_CONF nova project_domain_id default
-        iniset $NEUTRON_CONF nova region_name $REGION_NAME
+        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -240,10 +232,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
     fi
 
-    if is_ssl_enabled_service "nova"; then
-        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
-    fi
-
     if is_ssl_enabled_service "neutron"; then
         ensure_certificates NEUTRON
 

From f15224c740b880842e8d34e9a6c2ad08ba34448f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 2 Mar 2017 12:45:47 -0500
Subject: [PATCH 1783/3333] Create cell1 cell before n-api starts

Change ac5fdb4c4090efd682cc5c55aa30ec433da29fc7 introduced
a problem for gnocchi CI because the deployments steps
are now:

1. create cell0
2. start nova-api (with multiple workers)
3. install ceilometer via extras
4. ceilometer calls nova-api to list servers; at this point
   nova-api getes the list of cells and caches them, which
   will just be cell0
5. create cell1 via simple_cell_setup which also discovers
   the n-cpu node so we can schedule instances
6. gnocchi tests create and list instances and at this point it hits
   an n-api worker that only has cell0 cached so it does not
   find some test servers it created and fails.

The cell0 and cell1 cells should be created in the nova_api db
before starting n-api so that when we first list instances, we
store both cells in the cache that's in n-api. This deployment
order is also how the nova docs describe rolling out cells v2
but the way we were doing this devstack wasn't following that,
or accounting for when devstack plugins are loaded via extras.

This change creates the main cell1 cell earlier in the setup
before n-api is started, and then changes to just run
discover_hosts at the end after n-cpu is running (which is what
simple_cell_setup and map_cell_and_hosts would do implicitly).

Change-Id: I38eab6707340253a10159a169ae61d34784c2d28
Related-Bug: #1669473
---
 lib/nova | 19 ++++++++-----------
 stack.sh |  2 +-
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/lib/nova b/lib/nova
index 0ce6699ad1..ac6df9dcf2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -664,6 +664,10 @@ function init_nova_cells {
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
         $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
+
+        # Creates the single cells v2 cell for the child cell (v1) nova db.
+        nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
+            --transport-url $(get_transport_url child_cell) --name 'cell1'
     fi
 }
 
@@ -720,6 +724,10 @@ function init_nova {
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
+
+        # create the cell1 cell for the main nova db where the hosts live
+        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
+            --name 'cell1'
     fi
 
     create_nova_cache_dir
@@ -968,17 +976,6 @@ function create_flavors {
     fi
 }
 
-# create_cell(): Group the available hosts into a cell
-function create_cell {
-    if ! is_service_enabled n-cell; then
-        nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
-    else
-        nova-manage --config-file $NOVA_CELLS_CONF  --verbose cell_v2 map_cell_and_hosts \
-                --transport-url $(get_transport_url child_cell) --name 'cell1'
-        nova-manage db sync
-    fi
-}
-
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index 2f43db7418..4cee385a33 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1364,7 +1364,7 @@ check_libs_from_git
 # Do this late because it requires compute hosts to have started
 if is_service_enabled n-api; then
     if is_service_enabled n-cpu; then
-        create_cell
+        $TOP_DIR/tools/discover_hosts.sh
     else
         # Some CI systems like Hyper-V build the control plane on
         # Linux, and join in non Linux Computes after setup. This

From 80e82eac4cd127a68fceea37270d09f9cbd71c75 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 15 Jul 2016 22:53:17 -0400
Subject: [PATCH 1784/3333] Disable glance v1 by default

Nova has been supporting glance v2 since Newton and removed
support for glance v1 in Ocata:

97e7b97210139a7f7888f0d6901e499664de02a3

We should disable glance v1 by default because there are several
test paths in Tempest which don't get run when glance v1 is
available because it uses glance v1 rather than v2.

Depends-On: I54db379f6fbe859fd9f1b0cdd5b74102539ab265

Change-Id: I7f962a07317cdad917ee896d79e49ee18938d074
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 58f1deff6f..0077de5e17 100644
--- a/lib/glance
+++ b/lib/glance
@@ -57,7 +57,7 @@ GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
 GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
-GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-True}
+GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"

From dc6e55021861afceae2a7778b299df94ceab0a6e Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Fri, 3 Mar 2017 16:55:50 -0800
Subject: [PATCH 1785/3333] Change auth_version to v3 on Tempest

Keystone v3 API is CURRENT and the v2 API is deprecated now.
So we need to change the default config of auth_version to fit
for current API status.

Depends-On: Id5e5ed9bf4f8b0f9eb376bfc7c5801f0956da1d9
Change-Id: I801e6740258ddea2a1b628a209970e0307d39d12
---
 lib/tempest | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d95a9f5c3d..b48dd07f1b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -273,13 +273,11 @@ function configure_tempest {
     if [ "$ENABLE_IDENTITY_V2" == "True" ]; then
         # Run Identity API v2 tests ONLY if needed
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True
-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     else
         # Skip Identity API v2 tests by default
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-        # Use v3 auth tokens for running all Tempest tests
-        iniset $TEMPEST_CONFIG identity auth_version v3
     fi
+    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE

From 2b4735f1b3ac2834fa46a288ba5d09290acfbf3d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 10 Feb 2017 06:17:37 +0000
Subject: [PATCH 1786/3333] Added list of mlock-using processes to
 peakmem_tracker output

The change makes peakmem_tracker list processes that lock memory pages
from swapping to disk. It may be helpful when debugging oom-killer job
failures in gate in case when dstat shows that swap is not fully used
when oom-killer is triggered.

The peakmem_tracker service was renamed into memory_tracker to reflect
its new broader scope.

Needed-By: I5862d92478397eac2e61b8a61ce3437b698678be
Change-Id: I1dca120448ee87930fe903fd81277b58efaefc92
---
 lib/dstat                                     | 14 ++--
 .../{peakmem_tracker.sh => memory_tracker.sh} | 64 ++++++++++++-------
 tools/mlock_report.py                         | 59 +++++++++++++++++
 3 files changed, 111 insertions(+), 26 deletions(-)
 rename tools/{peakmem_tracker.sh => memory_tracker.sh} (51%)
 create mode 100755 tools/mlock_report.py

diff --git a/lib/dstat b/lib/dstat
index b705948094..62795f5e72 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -21,16 +21,22 @@ function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     run_process dstat "$TOP_DIR/tools/dstat.sh $LOGDIR"
 
-    # To enable peakmem_tracker add:
-    #    enable_service peakmem_tracker
+    # To enable memory_tracker add:
+    #    enable_service memory_tracker
     # to your localrc
-    run_process peakmem_tracker "$TOP_DIR/tools/peakmem_tracker.sh"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh"
+
+    # remove support for the old name when it's no longer used (sometime in Queens)
+    if is_service_enabled peakmem_tracker; then
+        deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
+        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh"
+    fi
 }
 
 # stop_dstat() stop dstat process
 function stop_dstat {
     stop_process dstat
-    stop_process peakmem_tracker
+    stop_process memory_tracker
 }
 
 # Restore xtrace
diff --git a/tools/peakmem_tracker.sh b/tools/memory_tracker.sh
similarity index 51%
rename from tools/peakmem_tracker.sh
rename to tools/memory_tracker.sh
index ecbd79a0bc..dac0267a7e 100755
--- a/tools/peakmem_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -21,11 +21,15 @@ SLEEP_TIME=20
 # around reclaimable memory.  However, it is not available until 3.14
 # kernel (i.e. Ubuntu LTS Trusty misses it).  In that case, we fall
 # back to free+buffers+cache as the available memory.
-USE_MEM_AVAILBLE=0
+USE_MEM_AVAILABLE=0
 if grep -q '^MemAvailable:' /proc/meminfo; then
     USE_MEM_AVAILABLE=1
 fi
 
+function get_mem_unevictable {
+    awk '/^Unevictable:/ {print $2}' /proc/meminfo
+}
+
 function get_mem_available {
     if [[ $USE_MEM_AVAILABLE -eq 1 ]]; then
         awk '/^MemAvailable:/ {print $2}' /proc/meminfo
@@ -37,40 +41,56 @@ function get_mem_available {
     fi
 }
 
-# whenever we see less memory available than last time, dump the
-# snapshot of current usage; i.e. checking the latest entry in the
-# file will give the peak-memory usage
 function tracker {
     local low_point
+    local unevictable_point
     low_point=$(get_mem_available)
+    # log mlocked memory at least on first iteration
+    unevictable_point=0
     while [ 1 ]; do
 
         local mem_available
         mem_available=$(get_mem_available)
 
-        if [[ $mem_available -lt $low_point ]]; then
-            low_point=$mem_available
+        local unevictable
+        unevictable=$(get_mem_unevictable)
+
+        if [ $mem_available -lt $low_point -o $unevictable -ne $unevictable_point ]; then
             echo "[[["
             date
+
+            # whenever we see less memory available than last time, dump the
+            # snapshot of current usage; i.e. checking the latest entry in the file
+            # will give the peak-memory usage
+            if [[ $mem_available -lt $low_point ]]; then
+                low_point=$mem_available
+                echo "---"
+                # always available greppable output; given difference in
+                # meminfo output as described above...
+                echo "memory_tracker low_point: $mem_available"
+                echo "---"
+                cat /proc/meminfo
+                echo "---"
+                # would hierarchial view be more useful (-H)?  output is
+                # not sorted by usage then, however, and the first
+                # question is "what's using up the memory"
+                #
+                # there are a lot of kernel threads, especially on a 8-cpu
+                # system.  do a best-effort removal to improve
+                # signal/noise ratio of output.
+                ps --sort=-pmem -eo pid:10,pmem:6,rss:15,ppid:10,cputime:10,nlwp:8,wchan:25,args:100 |
+                    grep -v ']$'
+            fi
             echo "---"
-            # always available greppable output; given difference in
-            # meminfo output as described above...
-            echo "peakmem_tracker low_point: $mem_available"
-            echo "---"
-            cat /proc/meminfo
-            echo "---"
-            # would hierarchial view be more useful (-H)?  output is
-            # not sorted by usage then, however, and the first
-            # question is "what's using up the memory"
-            #
-            # there are a lot of kernel threads, especially on a 8-cpu
-            # system.  do a best-effort removal to improve
-            # signal/noise ratio of output.
-            ps --sort=-pmem -eo pid:10,pmem:6,rss:15,ppid:10,cputime:10,nlwp:8,wchan:25,args:100 |
-                grep -v ']$'
+
+            # list processes that lock memory from swap
+            if [[ $unevictable -ne $unevictable_point ]]; then
+                unevictable_point=$unevictable
+                sudo ./tools/mlock_report.py
+            fi
+
             echo "]]]"
         fi
-
         sleep $SLEEP_TIME
     done
 }
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
new file mode 100755
index 0000000000..1d23af90d7
--- /dev/null
+++ b/tools/mlock_report.py
@@ -0,0 +1,59 @@
+#!/usr/bin/env python
+
+# This tool lists processes that lock memory pages from swapping to disk.
+
+import re
+import subprocess
+
+import psutil
+
+
+SUMMARY_REGEX = re.compile(r".*\s+(?P<locked>[\d]+)\s+KB")
+
+
+def main():
+    try:
+        print _get_report()
+    except Exception as e:
+        print "Failure listing processes locking memory: %s" % str(e)
+
+
+def _get_report():
+    mlock_users = []
+    for proc in psutil.process_iter():
+        pid = proc.pid
+        # sadly psutil does not expose locked pages info, that's why we
+        # call to pmap and parse the output here
+        try:
+            out = subprocess.check_output(['pmap', '-XX', str(pid)])
+        except subprocess.CalledProcessError as e:
+            # 42 means process just vanished, which is ok
+            if e.returncode == 42:
+                continue
+            raise
+        last_line = out.splitlines()[-1]
+
+        # some processes don't provide a memory map, for example those
+        # running as kernel services, so we need to skip those that don't
+        # match
+        result = SUMMARY_REGEX.match(last_line)
+        if result:
+            locked = int(result.group('locked'))
+            if locked:
+                mlock_users.append({'name': proc.name(),
+                                    'pid': pid,
+                                    'locked': locked})
+
+    # produce a single line log message with per process mlock stats
+    if mlock_users:
+        return "; ".join(
+            "[%(name)s (pid:%(pid)s)]=%(locked)dKB" % args
+            # log heavy users first
+            for args in sorted(mlock_users, key=lambda d: d['locked'])
+        )
+    else:
+        return "no locked memory"
+
+
+if __name__ == "__main__":
+    main()

From 45da777d2526acd355da974eb338695559dd64c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sun, 5 Mar 2017 13:07:39 -0500
Subject: [PATCH 1787/3333] Change to messagingv2 for
 oslo_messaging_notifications.driver

The oslo.messaging docs on the notification messaging driver
says that "messaging" (1.0) is a legacy format and you should
use messagingv2 unless otherwise required for that old format.

By default we should be testing with messagingv2.

Change-Id: I3031afe7551a0c8dde46e1ccfacff445fb68e122
---
 lib/cinder         | 2 +-
 lib/glance         | 4 ++--
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 767fd00d34..c17cea06c7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -315,7 +315,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled ceilometer; then
-        iniset $CINDER_CONF oslo_messaging_notifications driver "messaging"
+        iniset $CINDER_CONF oslo_messaging_notifications driver "messagingv2"
     fi
 
     if is_service_enabled tls-proxy; then
diff --git a/lib/glance b/lib/glance
index 58f1deff6f..0ba2cfa3d4 100644
--- a/lib/glance
+++ b/lib/glance
@@ -112,7 +112,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
-    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messaging
+    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -125,7 +125,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
-    iniset $GLANCE_API_CONF oslo_messaging_notifications driver messaging
+    iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b381b642c6..1a16a44986 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -798,7 +798,7 @@ function _configure_neutron_metadata_agent {
 }
 
 function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
+    iniset $NEUTRON_CONF oslo_messaging_notifications driver messagingv2
 }
 
 function _configure_neutron_metering {
diff --git a/lib/nova b/lib/nova
index 79f07f2a99..4c9f30f593 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
 
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
-    iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
+    iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 

From e65ab4a1c57a56161ebbf51a10b3c47a665037d7 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 24 Feb 2017 17:47:55 +0000
Subject: [PATCH 1788/3333] lib/neutron: configure root_helper for agents

Before the patch, we were only configuring root_helper_daemon to point
to oslo.rootwrap, but not root_helper. (The former is used for long
running commands only, while the latter is used for short lived
commands.) This made neutron agents to directly call to sudo when a
privileged process was to be executed. This failed because /etc/sudoers
was not configured to allow anything except the rootwrap call itself.

This patch simplifies rootwrap handling in the code; it also sets
root_helper to point to rootwrap; as well as configure daemon in
sudoers. While at it, we also set l2 agent to use rootwrap too.
Hopefully, it will be enough for agents to actually configure backend as
needed.

Change-Id: Ib05a6e0e024f534d7f616d41d70fb67ecf6daeaf
---
 lib/neutron | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 44d41f8cf5..e72c9fe6ea 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -72,7 +72,8 @@ NEUTRON_SERVICE_PROTOCOL=${NEUTRON_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NEUTRON_AUTH_STRATEGY=${NEUTRON_AUTH_STRATEGY:-keystone}
 NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
 NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
+NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
+NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
 # Additional neutron api config files
 declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
@@ -115,6 +116,13 @@ function cleanup_neutron_new {
     done
 }
 
+# configure_root_helper_options() - Configure agent rootwrap helper options
+function configure_root_helper_options {
+    local conffile=$1
+    iniset $conffile agent root_helper "sudo $NEUTRON_ROOTWRAP_CMD"
+    iniset $conffile agent root_helper_daemon "sudo $NEUTRON_ROOTWRAP_DAEMON_CMD"
+}
+
 # configure_neutron() - Set config files, create data dirs, etc
 function configure_neutron_new {
     sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
@@ -171,6 +179,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-agent; then
         iniset $NEUTRON_CORE_PLUGIN_CONF agent tunnel_types vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        configure_root_helper_options $NEUTRON_CORE_PLUGIN_CONF
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
@@ -194,7 +203,7 @@ function configure_neutron_new {
         # make it so we have working DNS from guests
         iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
 
-        iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        configure_root_helper_options $NEUTRON_DHCP_CONF
         iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
         neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
     fi
@@ -203,7 +212,7 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
         iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
         neutron_service_plugin_class_add router
-        iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        configure_root_helper_options $NEUTRON_L3_CONF
         iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
     fi
@@ -215,7 +224,8 @@ function configure_neutron_new {
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
         iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
-        iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
+        configure_root_helper_options $NEUTRON_META_CONF
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI/v2.0
@@ -252,12 +262,6 @@ function configure_neutron_new {
 
 # configure_neutron_rootwrap() - configure Neutron's rootwrap
 function configure_neutron_rootwrap {
-    # Set the paths of certain binaries
-    neutron_rootwrap=$(get_rootwrap_location neutron)
-
-    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
-    local rootwrap_sudoer_cmd="${neutron_rootwrap} $NEUTRON_CONF_DIR/rootwrap.conf"
-
     # Deploy new rootwrap filters files (owned by root).
     # Wipe any existing rootwrap.d files first
     if [[ -d $NEUTRON_CONF_DIR/rootwrap.d ]]; then
@@ -274,7 +278,8 @@ function configure_neutron_rootwrap {
 
     # Set up the rootwrap sudoers for Neutron
     tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd *" >$tempfile
+    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_CMD *" >$tempfile
+    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_DAEMON_CMD" >>$tempfile
     chmod 0440 $tempfile
     sudo chown root:root $tempfile
     sudo mv $tempfile /etc/sudoers.d/neutron-rootwrap

From c2c89e4b35a9ad5fb1a2670943328a9725b37001 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 23 Feb 2017 20:15:47 -0600
Subject: [PATCH 1789/3333] Use KEYSTONE_SERVICE_URI consistently

lib/keystone builds KEYSTONE_SERVICE_URI so that other services
don't need to reconstruct the identity URI. Many services already
use it, but some parts were still building the identity URI from
the different parts.

This will allow changing the identity URI to include a path
(e.g., to http://<host>/identity) in 1 place rather than in
multiple places.

Change-Id: I58cbdbe591d8869807545e0815480fc3375e0479
---
 lib/neutron   | 2 +-
 lib/nova      | 2 +-
 lib/placement | 2 +-
 lib/tempest   | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index b30c5c8e89..ab005a9a01 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -282,7 +282,7 @@ function configure_neutron_rootwrap {
 function configure_neutron_nova_new {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI/v3"
     iniset $NOVA_CONF neutron username neutron
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "Default"
diff --git a/lib/nova b/lib/nova
index 4c9f30f593..a36a740265 100644
--- a/lib/nova
+++ b/lib/nova
@@ -631,7 +631,7 @@ function create_nova_conf {
 function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user send_service_user_token True
     iniset $NOVA_CONF service_user auth_type password
-    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT"
+    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_URI"
     iniset $NOVA_CONF service_user username nova
     iniset $NOVA_CONF service_user password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/placement b/lib/placement
index e7ffe3330b..4cc5cd8b6a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -100,7 +100,7 @@ function _config_placement_apache_wsgi {
 
 function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_type "password"
-    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI/v3"
     iniset $NOVA_CONF placement username placement
     iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/tempest b/lib/tempest
index d95a9f5c3d..25db046829 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -17,7 +17,7 @@
 #   - ``PUBLIC_NETWORK_NAME``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
-#   - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone
+#   - ``KEYSTONE_SERVICE_URI``, ``KEYSTONE_SERVICE_URI_V3`` from lib/keystone
 #
 # Optional Dependencies:
 #
@@ -257,7 +257,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume build_timeout $BUILD_TIMEOUT
 
     # Identity
-    iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
+    iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_URI/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
     iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION

From 73a3e2decd2e7d9fd652fb40c4e697794d9abd05 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 7 Mar 2017 08:49:22 +0000
Subject: [PATCH 1790/3333] Updated from generate-devstack-plugins-list

Change-Id: Iffde64ae167fa32a377d20a9628c17286f1bf958
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 17da67b816..58d393ae74 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -108,7 +108,6 @@ networking-midonet                     `git://git.openstack.org/openstack/networ
 networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
-networking-ofagent                     `git://git.openstack.org/openstack/networking-ofagent <https://git.openstack.org/cgit/openstack/networking-ofagent>`__
 networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
 networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
 networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__

From f511c368f8e1e6690b7be4da926cad97d07ee85f Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Tue, 7 Mar 2017 06:31:49 +0000
Subject: [PATCH 1791/3333] lib/neutron: allow to add more ml2 extension
 drivers

The patch will allow jobs to append new ml2 extension drivers without
overriding port_security.

Change-Id: I45f017d1b8a3054452c3166ed4fb460d21959adb
---
 lib/neutron        | 23 ++++++++++++++++++++++-
 lib/neutron-legacy | 10 ++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c97104ec46..e69e25fd55 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -163,7 +163,7 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
+            neutron_ml2_extension_driver_add port_security
         fi
     fi
 
@@ -481,6 +481,18 @@ function neutron_service_plugin_class_add_new {
     iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 
+function _neutron_ml2_extension_driver_add {
+    local driver=$1
+    local drivers=""
+
+    drivers=$(iniget $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers)
+    if [ $drivers ]; then
+        drivers+=","
+    fi
+    drivers+="${driver}"
+    iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers $drivers
+}
+
 function neutron_server_config_add_new {
     _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
 }
@@ -553,6 +565,15 @@ function neutron_service_plugin_class_add {
     fi
 }
 
+function neutron_ml2_extension_driver_add {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        _neutron_ml2_extension_driver_add_old "$@"
+    else
+        _neutron_ml2_extension_driver_add "$@"
+    fi
+}
+
 function install_neutron_agent_packages {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index ccab527f66..86a2b1d58e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -870,6 +870,16 @@ function _neutron_service_plugin_class_add {
     fi
 }
 
+# _neutron_ml2_extension_driver_add_old() - add ML2 extension driver
+function _neutron_ml2_extension_driver_add_old {
+    local extension=$1
+    if [[ $Q_ML2_PLUGIN_EXT_DRIVERS == '' ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS=$extension
+    elif [[ ! ,${Q_ML2_PLUGIN_EXT_DRIVERS}, =~ ,${extension}, ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS="$Q_ML2_PLUGIN_EXT_DRIVERS,$extension"
+    fi
+}
+
 # mutnauq_server_config_add() - add server config file
 function mutnauq_server_config_add {
     _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)

From afef8bf097356d7bb37c57d0daa44653c7905c17 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 6 Mar 2017 14:07:23 -0500
Subject: [PATCH 1792/3333] Make declared variables global

When variables use the 'declare' directive, it is by default a local
variable. While other variables have global scope.

For example:
   declare -A AN_ARRAY   # local in scope
   foo=1                 # global in scope

This causes errors to occur as some of the variables will be local only
and others will be global.

Update the code, as appropriate, so that variables using the 'declare'
directive also include the '-g' flag to have them also be global. Not
every instance of a declared variable has been updated.

Closes-Bug: #1669509
Co-Authored-By: John L. Villalovos <john.l.villalovos@intel.com>
Change-Id: I2180b68fe861ad19c6d4ec0df0f9f8a528347862
---
 functions          |  2 +-
 functions-common   | 18 +++++++++---------
 inc/python         |  2 +-
 lib/neutron        |  2 +-
 lib/neutron-legacy |  4 ++--
 stackrc            |  2 +-
 6 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/functions b/functions
index 89ee3672d3..48c821c0a6 100644
--- a/functions
+++ b/functions
@@ -12,7 +12,7 @@
 
 # ensure we don't re-source this in the same environment
 [[ -z "$_DEVSTACK_FUNCTIONS" ]] || return 0
-declare -r _DEVSTACK_FUNCTIONS=1
+declare -r -g _DEVSTACK_FUNCTIONS=1
 
 # Include the common functions
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
diff --git a/functions-common b/functions-common
index 0d1b01f2fe..64f97f005a 100644
--- a/functions-common
+++ b/functions-common
@@ -37,12 +37,12 @@ set +o xtrace
 
 # ensure we don't re-source this in the same environment
 [[ -z "$_DEVSTACK_FUNCTIONS_COMMON" ]] || return 0
-declare -r _DEVSTACK_FUNCTIONS_COMMON=1
+declare -r -g _DEVSTACK_FUNCTIONS_COMMON=1
 
 # Global Config Variables
-declare -A GITREPO
-declare -A GITBRANCH
-declare -A GITDIR
+declare -A -g GITREPO
+declare -A -g GITBRANCH
+declare -A -g GITDIR
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
@@ -306,7 +306,7 @@ function warn {
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
 # ``os_CODENAME`` - vendor's codename for release: ``xenial``
 
-declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
+declare -g os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 
 # Make a *best effort* attempt to install lsb_release packages for the
 # user if not available.  Note can't use generic install_package*
@@ -361,7 +361,7 @@ function GetOSVersion {
 
 # Translate the OS version values into common nomenclature
 # Sets global ``DISTRO`` from the ``os_*`` values
-declare DISTRO
+declare -g DISTRO
 
 function GetDistro {
     GetOSVersion
@@ -2376,9 +2376,9 @@ function sudo_with_proxies {
 # Resolution is only in whole seconds, so should be used for long
 # running activities.
 
-declare -A _TIME_TOTAL
-declare -A _TIME_START
-declare -r _TIME_BEGIN=$(date +%s)
+declare -A -g _TIME_TOTAL
+declare -A -g _TIME_START
+declare -r -g _TIME_BEGIN=$(date +%s)
 
 # time_start $name
 #
diff --git a/inc/python b/inc/python
index 5afc07f636..d0e45df489 100644
--- a/inc/python
+++ b/inc/python
@@ -19,7 +19,7 @@ set +o xtrace
 
 # PROJECT_VENV contains the name of the virtual environment for each
 # project.  A null value installs to the system Python directories.
-declare -A PROJECT_VENV
+declare -A -g PROJECT_VENV
 
 
 # Python Functions
diff --git a/lib/neutron b/lib/neutron
index 19568eaf25..4a547ac0bf 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -74,7 +74,7 @@ NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CON
 NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
 
 # Additional neutron api config files
-declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
+declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
 # Functions
 # ---------
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b381b642c6..96d86743ab 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -141,10 +141,10 @@ _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 # These config files are relative to ``/etc/neutron``.  The above
 # example would specify ``--config-file /etc/neutron/file1`` for
 # neutron server.
-declare -a Q_PLUGIN_EXTRA_CONF_FILES
+declare -a -g Q_PLUGIN_EXTRA_CONF_FILES
 
 # same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
-declare -a _Q_PLUGIN_EXTRA_CONF_FILES_ABS
+declare -a -g _Q_PLUGIN_EXTRA_CONF_FILES_ABS
 
 
 Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
diff --git a/stackrc b/stackrc
index afe385c2a1..14c5960ed4 100644
--- a/stackrc
+++ b/stackrc
@@ -5,7 +5,7 @@
 
 # ensure we don't re-source this in the same environment
 [[ -z "$_DEVSTACK_STACKRC" ]] || return 0
-declare -r _DEVSTACK_STACKRC=1
+declare -r -g _DEVSTACK_STACKRC=1
 
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)

From d5919d08ba131ac2bde27251c8b4e77bf428e876 Mon Sep 17 00:00:00 2001
From: "jeremy.zhang" <zhangjun_inspur@163.com>
Date: Wed, 8 Mar 2017 15:27:37 +0800
Subject: [PATCH 1793/3333] Restrict enabling the manage_volume volume feature

Not all Cinder backends support the 'manage volume' feature. The test that
in tempest for this feature is specific to LVM and will *not* work for
other work backends regardless of them supporting the feature.

Change-Id: I055aa66738deb5ae2fb925429cec565e3901340c
---
 lib/tempest | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d95a9f5c3d..95b25bcf4e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -439,7 +439,11 @@ function configure_tempest {
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse False TEMPEST_VOLUME_MANAGE_SNAPSHOT)
-
+    # Only turn on TEMPEST_VOLUME_MANAGE_VOLUME by default for "lvm" backends
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
+        TEMPEST_VOLUME_MANAGE_VOLUME=${TEMPEST_VOLUME_MANAGE_VOLUME:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled manage_volume $(trueorfalse False TEMPEST_VOLUME_MANAGE_VOLUME)
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)

From b75a4928707feb53d0e306f8b289096eb5c0b37b Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Fri, 16 Oct 2015 15:57:50 +0200
Subject: [PATCH 1794/3333] Add a new FAQ entry for dev environments

Since it's pretty common to see blogposts recommending to mount /opt/stack
remotely or editing inline the code, adding some notes about the potential
risk of a reclone that could impact weeks of work.

Change-Id: I733d40b76fb02d8edf3719533fc8202547771871
Co-Authored-By: Stephen Finucane <sfinucan@redhat.com>
---
 doc/source/faq.rst | 51 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7793d8eb68..e6c1d6ed41 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -18,6 +18,57 @@ production systems.
 Your best choice is probably to choose a `distribution of OpenStack
 <https://www.openstack.org/marketplace/distros/>`__.
 
+Can I use DevStack as a development environment?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Sure, you can. That said, there are a couple of things you should note before
+doing so:
+
+- DevStack makes a lot of configuration changes to your system and should not
+  be run in your main development environment.
+
+- All the repositories that DevStack clones when deploying are considered
+  volatile by default and thus are subject to hard resets. This is necessary to
+  keep you in sync with the latest upstream, which is what you want in a CI
+  situation, but it can result in branches being overwritten and files being
+  removed.
+
+  The corollary of this is that if you are working on a specific project, using
+  the DevStack project repository (defaulted to ``/opt/stack/<project>``) as
+  the single master repository for storing all your work is not recommended.
+  This behavior can be overridden by setting the ``RECLONE`` config option to
+  ``no``.  Alternatively, you can avoid running ``stack.sh`` to redeploy by
+  restarting services manually. In any case, you should generally ensure work
+  in progress is pushed to Gerrit or otherwise backed up before running
+  ``stack.sh``.
+
+- If you use DevStack within a VM, you may wish to mount a local OpenStack
+  directory, such as ``~/src/openstack``, inside the VM and configure DevStack
+  to use this as the clone location using the ``{PROJECT}_REPO`` config
+  variables. For example, assuming you're using Vagrant and sharing your home
+  directory, you should place the following in ``local.conf``:
+
+  .. code-block:: shell
+
+     NEUTRON_REPO=/home/vagrant/src/neutron
+     NOVA_REPO=/home/vagrant/src/nova
+     KEYSTONE_REPO=/home/vagrant/src/keystone
+     GLANCE_REPO=/home/vagrant/src/glance
+     SWIFT_REPO=/home/vagrant/src/swift
+     HORIZON_REPO=/home/vagrant/src/horizon
+     CINDER_REPO=/home/vagrant/src/cinder
+     HEAT_REPO=/home/vagrant/src/heat
+     TEMPEST_REPO=/home/vagrant/src/tempest
+     HEATCLIENT_REPO=/home/vagrant/src/python-heatclient
+     GLANCECLIENT_REPO=/home/vagrant/src/python-glanceclient
+     NOVACLIENT_REPO=/home/vagrant/src/python-novaclient
+     NEUTRONCLIENT_REPO=/home/vagrant/src/python-neutronclient
+     OPENSTACKCLIENT_REPO=/home/vagrant/src/python-openstackclient
+     HEAT_CFNTOOLS_REPO=/home/vagrant/src/heat-cfntools
+     HEAT_TEMPLATES_REPO=/home/vagrant/src/heat-templates
+     NEUTRON_FWAAS_REPO=/home/vagrant/src/neutron-fwaas
+     # ...
+
 Why a shell script, why not chef/puppet/...
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

From 93a415601562853301d44e82ab07ee6bf1734945 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89douard=20Thuleau?= <ethuleau@juniper.net>
Date: Thu, 9 Mar 2017 18:53:18 +0100
Subject: [PATCH 1795/3333] Don't create keystone account for disabled service

If service is disabled, don't expect to create the corresponding
keystone account.

Change-Id: I007088862de1c8643eca3a6b9b313f0125b9b8d1
---
 stack.sh | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 4cee385a33..f08d56f60a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1057,11 +1057,18 @@ if is_service_enabled keystone; then
     fi
 
     create_keystone_accounts
-    create_nova_accounts
-    create_glance_accounts
-    create_cinder_accounts
-    create_neutron_accounts
-
+    if is_service_enabled nova; then
+        create_nova_accounts
+    fi
+    if is_service_enabled glance; then
+        create_glance_accounts
+    fi
+    if is_service_enabled cinder; then
+        create_cinder_accounts
+    fi
+    if is_service_enabled neutron; then
+        create_neutron_accounts
+    fi
     if is_service_enabled swift; then
         create_swift_accounts
     fi

From 9bc7708c801221a009a8e5f963c4343d81a6c913 Mon Sep 17 00:00:00 2001
From: Dave Chen <wei.d.chen@intel.com>
Date: Fri, 10 Mar 2017 05:34:21 +0800
Subject: [PATCH 1796/3333] Update the enabled service on compute nodes

Change the service from 'n-network' to 'q-agt' since
Nova network is not supported by default.

Change-Id: I085aac75d4c1b721498afa568c8ecfd5abc7b20c
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index dfc9936915..1b7f4cd356 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -176,7 +176,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,n-net,n-api-meta,c-vol
+    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP

From 1be04a0769124c8d44a22189d42d42712e87fed9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 10 Mar 2017 08:05:05 +0000
Subject: [PATCH 1797/3333] Updated from generate-devstack-plugins-list

Change-Id: I95309e2857f0361b65dc6fbaf686aab94626c086
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 58d393ae74..266ab0dcc0 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -149,6 +149,7 @@ trove-dashboard                        `git://git.openstack.org/openstack/trove-
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
 vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
 vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
+vmware-vspc                            `git://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
 watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
 watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
 zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__

From d15f222e2b2c3ab40ae719cca115f984178e71e4 Mon Sep 17 00:00:00 2001
From: Ben Swartzlander <ben@swartzlander.org>
Date: Tue, 24 Jan 2017 00:23:41 -0500
Subject: [PATCH 1798/3333] Fix IPv6 provider networks

Add a missing --subnet-range argument when creating an ipv6 provider
network. Also changed SUBNET_V6_ID to IPV6_SUBNET_ID. And remove the
--ipv6-address-mode arg because it doesn't apply to subnets on routers.

Change-Id: I82796804a06e758e458606dc9eb400bcd08ad6e4
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index e87a30cadb..07974feb10 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -197,8 +197,8 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            SUBNET_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID --subnet-range $fixed_range_v6 | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then

From b763dbda739c644ca048059d402d5667fe0e45ef Mon Sep 17 00:00:00 2001
From: wangxiyuan <wangxiyuan@huawei.com>
Date: Tue, 7 Mar 2017 20:47:58 +0800
Subject: [PATCH 1799/3333] Remove glare from glance

glare has been removed from glance already. Now error will be raised
if enable g-glare in local.conf.

Remove the glare support by glance.

Change-Id: I9a389af194dd2b8aed75d3c921293d800f8c591b
---
 lib/glance | 73 ------------------------------------------------------
 1 file changed, 73 deletions(-)

diff --git a/lib/glance b/lib/glance
index 6125f45cd8..2f4aa5f0f8 100644
--- a/lib/glance
+++ b/lib/glance
@@ -55,8 +55,6 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
-GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
-GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
 GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
@@ -72,8 +70,6 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
-GLANCE_GLARE_PORT=${GLANCE_GLARE_PORT:-9494}
-GLANCE_GLARE_HOSTPORT=${GLANCE_GLARE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_GLARE_PORT}
 
 # Functions
 # ---------
@@ -98,9 +94,6 @@ function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
     # Copy over our glance configurations and update them
-    if is_service_enabled g-glare; then
-        cp $GLANCE_DIR/etc/glance-glare.conf $GLANCE_GLARE_CONF
-    fi
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -143,9 +136,6 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    if is_service_enabled g-glare; then
-        iniset $GLANCE_GLARE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    fi
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
@@ -172,22 +162,6 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
 
-        # Store the glare in swift if enabled.
-        if is_service_enabled g-glare; then
-            iniset $GLANCE_GLARE_CONF glance_store default_store swift
-            iniset $GLANCE_GLARE_CONF glance_store swift_store_create_container_on_put True
-
-            iniset $GLANCE_GLARE_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
-            iniset $GLANCE_GLARE_CONF glance_store default_swift_reference ref1
-            iniset $GLANCE_GLARE_CONF glance_store stores "file, http, swift"
-            iniset $GLANCE_GLARE_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-            # commenting is not strictly necessary but it's confusing to have bad values in conf
-            inicomment $GLANCE_GLARE_CONF glance_store swift_store_user
-            inicomment $GLANCE_GLARE_CONF glance_store swift_store_key
-            inicomment $GLANCE_GLARE_CONF glance_store swift_store_auth_address
-        fi
-
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         if python3_enabled; then
             # NOTE(dims): Currently the glance_store+swift does not support either an insecure flag
@@ -266,29 +240,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
-
-    # Configure GLANCE_GLARE (Glance Glare)
-    if is_service_enabled g-glare; then
-        local dburl
-        dburl=`database_connection_url glance`
-        setup_logging $GLANCE_GLARE_CONF
-        iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
-        inicomment $GLANCE_GLARE_CONF DEFAULT log_file
-        iniset $GLANCE_GLARE_CONF DEFAULT workers "$API_WORKERS"
-
-        iniset $GLANCE_GLARE_CONF database connection $dburl
-        iniset $GLANCE_GLARE_CONF paste_deploy flavor keystone
-        configure_auth_token_middleware $GLANCE_GLARE_CONF glare $GLANCE_AUTH_CACHE_DIR/artifact
-        # Register SSL certificates if provided
-        if is_ssl_enabled_service glance; then
-            ensure_certificates GLANCE
-            iniset $GLANCE_GLARE_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-            iniset $GLANCE_GLARE_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-        fi
-        cp $GLANCE_DIR/etc/glance-glare-paste.ini $GLANCE_GLARE_PASTE_INI
-    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -298,7 +249,6 @@ function configure_glance {
 # SERVICE_PROJECT_NAME  glance          service
 # SERVICE_PROJECT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
 # SERVICE_PROJECT_NAME  glance-search   search (if Search is enabled)
-# SERVICE_PROJECT_NAME  glare           service (if enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -321,16 +271,6 @@ function create_glance_accounts {
         iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id $service_domain_id
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id $service_domain_id
     fi
-
-    # Add glance-glare service and endpoints
-    if is_service_enabled g-glare; then
-        create_service_user "glare"
-        get_or_create_service "glare" "artifact" "Glance Artifact Service"
-
-        get_or_create_endpoint "artifact" \
-            "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT"
-    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
@@ -400,15 +340,6 @@ function start_glance {
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
-
-    #Start g-glare after g-reg/g-api
-    if is_service_enabled g-glare; then
-        run_process g-glare "$GLANCE_BIN_DIR/glance-glare --config-file=$GLANCE_CONF_DIR/glance-glare.conf"
-        echo "Waiting for Glare [g-glare] ($GLANCE_GLARE_HOSTPORT) to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT; then
-            die $LINENO " Glare [g-glare] did not start"
-        fi
-    fi
 }
 
 # stop_glance() - Stop running processes
@@ -416,10 +347,6 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
-
-    if is_service_enabled g-glare; then
-        stop_process g-glare
-    fi
 }
 
 # Restore xtrace

From 3345a6d316bd50f005d22bfd231a4f9c0a5b7d62 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Mon, 13 Mar 2017 13:47:34 -0700
Subject: [PATCH 1800/3333] Use string comparison to compare UUID values

Was using the '-ne' integer comparison operator to compare UUID
values. This caused error messages like:

/opt/stack/new/devstack/lib/tempest: line 226: [[: dfae26ac-1780-4677-902d: value too great for base (error token is "902d")

Change it to use '!=' string comparison operator

Change-Id: Ib7c9197dd0fe58addf33b4f82beea6de64f6b10b
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index a9461d42ff..cf7eb6f722 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -223,7 +223,7 @@ function configure_tempest {
             # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
             # Some resize instance in tempest tests depends on this.
             for f in ${flavors[@]:1}; do
-                if [[ $f -ne $flavor_ref ]]; then
+                if [[ "$f" != "$flavor_ref" ]]; then
                     flavor_ref_alt=$f
                     break
                 fi

From 99d5d1ce82e59347d6e90a8756dd6a08153a1486 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 15 Mar 2017 13:42:25 +0100
Subject: [PATCH 1801/3333] FAQ: remove references to stable/kilo: use
 stable/ocata instead

It's 2017, some of our newest OpenStack developers/users may not
even know what stable/kilo is/was.

Change-Id: I00f39cc80af7e1632293bf057d95040b6bfa48e0
---
 doc/source/faq.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7793d8eb68..f03304f37f 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -130,8 +130,8 @@ How do I run a specific OpenStack release?
 DevStack master tracks the upstream master of all the projects. If you
 would like to run a stable branch of OpenStack, you should use the
 corresponding stable branch of DevStack as well. For instance the
-``stable/kilo`` version of DevStack will already default to all the
-projects running at ``stable/kilo`` levels.
+``stable/ocata`` version of DevStack will already default to all the
+projects running at ``stable/ocata`` levels.
 
 Note: it's also possible to manually adjust the ``*_BRANCH`` variables
 further if you would like to test specific milestones, or even custom

From 4b59fbb8573c57b27cf1ceb2a043cbe9cf7fd111 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 15 Mar 2017 21:58:48 +0000
Subject: [PATCH 1802/3333] Revert "put mysql on a memory diet"

The diet seems to be too strict, jobs failing with "out of sort memory". Needs more investigation before resubmitting.

This reverts commit 1e66388c5f2b81b4fc5d544dbf5fde2935218bd0.

Change-Id: Ic10effaaf047eb3527082baab889772c5e57fa90
---
 lib/databases/mysql | 183 +-------------------------------------------
 1 file changed, 1 insertion(+), 182 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index e2c83433d2..7bbcace399 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -96,191 +96,10 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
-
-    # the number of connections has been throttled to 256. In the
-    # event that the gate jobs report "Too many connections" it is
-    # indicative of a problem that could be the result of one of many
-    # things. For more details about debugging this error, refer
-    # https://dev.mysql.com/doc/refman/5.5/en/too-many-connections.html.
-    # Note that the problem may not ONLY be an issue with MySQL
-    # connections. If the number of fd's at the OS is too low, you
-    # could see errors manifest as MySQL "too many connections".
-    iniset -sudo $my_conf mysqld max_connections 256
+    iniset -sudo $my_conf mysqld max_connections 1024
     iniset -sudo $my_conf mysqld query_cache_type OFF
     iniset -sudo $my_conf mysqld query_cache_size 0
 
-    # Additional settings to put MySQL on a memory diet. These
-    # settings are used in conjunction with the cap on max_connections
-    # as the total memory used by MySQL can be simply viewed as
-    # fixed-allocations + max_connections * variable-allocations. A
-    # nifty tool to help with this is
-    # http://www.mysqlcalculator.com/. A short description of each of
-    # the settings follows.
-
-    # binlog_cache_size, determines the size of cache to hold changes
-    # to the binary log during a transaction, for each connection. For
-    # more details, refer
-    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_cache_size
-    # When binary logging is enabled, a smaller binlog cache could
-    # result in more frequent flushes to the disk and a larger value
-    # would result in less flushes to the disk but higher memory
-    # usage. This however only has to do with large transactions; if
-    # you have a small transaction the binlog cache is necessarily
-    # flushed on a transaction commit. This is a per-connection cache.
-    iniset -sudo $my_conf mysqld binlog_cache_size 4K
-
-    # binlog_stmt_cache_size determines the size of cache to hold non
-    # transactional statements in the binary log. For more details,
-    # refer
-    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_stmt_cache_size
-    # This cache holds changes to non-transactional tables (read:
-    # MyISAM) or any non-transactional statements which cause
-    # modifications to data (truncate is an example). These are
-    # written to disk immediately on completion of the statement or
-    # when the cache is full. If the cache is too small, you get
-    # frequent writes to the disk (flush) and if the cache is too
-    # large, it takes up more memory. This is a per-connection cache.
-    iniset -sudo $my_conf mysqld binlog_stmt_cache_size 4K
-
-    # bulk_insert_buffer_size for MyISAM tables that use a special
-    # cache for insert statements and load statements, this cache is
-    # used to optimize writes to the disk. If the value is set to 0,
-    # the optimization is disabled. For more details refer
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_bulk_insert_buffer_size
-    # We set this to 0 which could result in higher disk I/O (I/O on
-    # each insert block completion).
-    iniset -sudo $my_conf mysqld bulk_insert_buffer_size 0
-
-    # host_cache_size controls a DNS lookup optimization. For more
-    # details refer
-    # https://dev.mysql.com/doc/refman/5.6/en/host-cache.html
-    iniset -sudo $my_conf mysqld host_cache_size 0
-
-    # innodb_buffer_pool_size This is the size of the server wide
-    # buffer pool. It is the cache for all data blocks being used by
-    # the server and is managed as a LRU chain. Dirty blocks either
-    # age off the list or are forced off when the list is
-    # full. Setting this to 5MB (default 128MB) reduces the amount of
-    # memory used by the server and this will result in more disk I/O
-    # in cases where (a) there is considerable write activity that
-    # overwhelms the allocated cache, or (b) there is considerable
-    # read activity on a data set that exceeds the allocated
-    # cache. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.6/en/innodb-parameters.html#sysvar_innodb_buffer_pool_size
-    iniset -sudo $my_conf mysqld innodb_buffer_pool_size 5M
-
-    # innodb_ft_cache_size and innodb_ft_total_cache_size control the
-    # per-connection full text search cache and the server wide
-    # maximum full text search cache. We should not be using full text
-    # search and the value is set to the minimum allowable. The former
-    # is a per-connection cache size and the latter is server
-    # wide. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_cache_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_total_cache_size
-    iniset -sudo $my_conf mysqld innodb_ft_cache_size 1600000
-    iniset -sudo $my_conf mysqld innodb_ft_total_cache_size 32000000
-
-    # innodb_log_buffer_size This buffer is used to buffer
-    # transactions in-memory before writing them to the innodb
-    # internal transaction log. Large transactions, or high amounts of
-    # concurrency, will cause the system to fill this faster and thus
-    # make the system more disk-bound. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_log_buffer_size
-    iniset -sudo $my_conf mysqld innodb_log_buffer_size 256K
-
-    # innodb_sort_buffer_size, This buffer is used for sorting when
-    # InnoDB is creating indexes. Could cause that to be slower, but
-    # only if tables are large. This is a per-connection setting. For
-    # more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
-    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
-
-    # join_buffer_size, This buffer makes table and index scans
-    # faster. So this setting could make some queries more disk
-    # bound. This is a per-connection setting. For more details refer
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_join_buffer_size.
-    iniset -sudo $my_conf mysqld join_buffer_size 128
-
-    # key_buffer_size defines the index blocks used for MyISAM tables
-    # and shared between threads. This is a server wide setting. For
-    # more details see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_key_buffer_size
-    iniset -sudo $my_conf mysqld key_buffer_size 8
-
-    # max_heap_table_size sets the maximum amount of memory for MEMORY
-    # tables (which we don't use). The value is set to 16k, the
-    # minimum allowed. For more details, see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_max_heap_table_size
-    iniset -sudo $my_conf mysqld max_heap_table_size 16K
-
-    # net_buffer_length Each client has a buffer for incoming and
-    # outgoing data, both start with a size of net_buffer_length and
-    # can grow (in steps of 2x) upto a size of max_allowed_packet. For
-    # more details see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_net_buffer_length
-    iniset -sudo $my_conf mysqld net_buffer_length 1K
-
-    # read_buffer_size, read_rnd_buffer_size are per-thread buffer
-    # used for scans on MyISAM tables. It is a per-connection setting
-    # and so we set it to the minimum value allowable. Same for
-    # read_rnd_buffer_size. For more details refer
-    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_buffer_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_rnd_buffer_size
-    iniset -sudo $my_conf mysqld read_buffer_size 8200
-    iniset -sudo $my_conf mysqld read_rnd_buffer_size 8200
-
-    # sort_buffer_size when a sort is requested, it will be performed
-    # in memory in a buffer of this size (allocated per connection)
-    # and if the data exceeds this size it will spill to disk. The
-    # innodb and myisam variables are used in computing indices for
-    # tables using the specified storage engine. Since we don't
-    # dynamically reindex (except during upgrade) these values should
-    # never be material. Obviously performance of disk based sorts is
-    # worse than in memory sorts and therefore a high value here will
-    # improve sort performance for large data. For more details,
-    # refer:
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_sort_buffer_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_myisam_sort_buffer_size
-    iniset -sudo $my_conf mysqld sort_buffer_size 32K
-    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
-    iniset -sudo $my_conf mysqld myisam_sort_buffer_size 4K
-
-    # thread_cache_size specifies how many internal threads to cache
-    # for use with incoming connections. We set this to 0 whic means
-    # that each connection will cause a new thread to be created. This
-    # could cause connections to take marginally longer on os'es with
-    # slow pthread_create calls. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_thread_cache_size
-    iniset -sudo $my_conf mysqld thread_cache_size 0
-
-    # thread_stack is the per connection stack size, the minimum is
-    # 128k and the default is 192k on 32bit and 256k on 64bit
-    # systems. We set this to 192k. Complex queries which require
-    # recursion, stored procedures or other memory intensive
-    # operations could exhaust this and generate a very characteristic
-    # failure ("stack overflow") which is cleanly detected and the
-    # query is killed. For more details see
-    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_thread_stack
-    iniset -sudo $my_conf mysqld thread_stack 196608
-
-    # tmp_table_size is the maximum size of an in-memory temporary
-    # table. Temporary tables are created by MySQL as part of a
-    # multi-step query plan. The actual size of the temp table will be
-    # the lesser of tmp_table_size and max_heap_table_size. If a
-    # temporary table exceeds this size, it will be spooled to disk
-    # using the internal_tmp_disk_storage_engine (default
-    # MyISAM). Queries that often generate in-memory temporary tables
-    # include queries that have sorts, distinct, or group by
-    # operations, also queries that perform IN joins. For more details
-    # see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_tmp_table_size
-    iniset -sudo $my_conf mysqld tmp_table_size 1K
-
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"
         if is_fedora; then

From dab52d755481500dce3bf5f990037cde5d8022eb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Mar 2017 07:51:22 +0000
Subject: [PATCH 1803/3333] Updated from generate-devstack-plugins-list

Change-Id: I55dea8141046350f9cf06afb7edc957c35397b38
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 266ab0dcc0..cc55c0bd20 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -128,6 +128,7 @@ nova-mksproxy                          `git://git.openstack.org/openstack/nova-m
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__

From 5f8bd0e452957c2b8f7c2a9c962342e69d33b17e Mon Sep 17 00:00:00 2001
From: jianghua <jianghua.wang@citrix.com>
Date: Tue, 14 Mar 2017 08:04:53 +0000
Subject: [PATCH 1804/3333] Xen: restrict devstack VM use upto 8 vCPUs.

Change-Id: Iea6086a3feb03dff581d9c04560133c4f57a6f6c
Closes-Bug: 1672642
---
 tools/xen/functions | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/xen/functions b/tools/xen/functions
index 93f3413d6d..bc0c515e01 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -294,6 +294,18 @@ function max_vcpus {
     # Assert ithas a numeric nonzero value
     expr "$cpu_count" + 0
 
+    # 8 VCPUs should be enough for devstack VM; avoid using too
+    # many VCPUs:
+    # 1. too many VCPUs may trigger a kernel bug which result VM
+    #    not able to boot:
+    #    https://kernel.googlesource.com/pub/scm/linux/kernel/git/wsa/linux/+/e2e004acc7cbe3c531e752a270a74e95cde3ea48
+    # 2. The remaining CPUs can be used for other purpose:
+    #    e.g. boot test VMs.
+    MAX_VCPUS=8
+    if [ $cpu_count -ge $MAX_VCPUS ]; then
+        cpu_count=$MAX_VCPUS
+    fi
+
     xe vm-param-set uuid=$vm VCPUs-max=$cpu_count
     xe vm-param-set uuid=$vm VCPUs-at-startup=$cpu_count
 }

From fe1d3d6a7b3faa804800292c48f6ed2d75157963 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 15 Mar 2017 13:27:20 +0100
Subject: [PATCH 1805/3333] Apache Keystone Template: reduce the number of
 processes to 3

Now Apache2 has 5 dedicated processes for Keystone Admin and 5 for
Keystone Public. As each Apache process consumes some memory and
we arbitrarly decided 5 was a good number more than 2 years ago,
maybe now (with the recent memory pressure we feel) is a good time
to reconcider.

With 5 processes our peakmem_tracker.py script reports a max RSS size
for the "wsgi:keystone-ad" and "wsgi:keystone-pu" processes of
2 (public and admin) * 5 (number of processes) * 90 Mo (RSS of each
process) = 900 Mo.

With 3 processes, the overall max RSS for Keystone is
2 * 3 * 90 = 540 Mo.

Note that this is RSS memory, but using the "smem" linux command on
my laptop, I noticed that the USS (Unique set size, i.e RSS excluding
shared memory) is around 80Mo per process. So reducing the number of
processes will actually reduce memory consumption.

Change-Id: Iba72d94aa15ecaa87c0115ad26d6bpeakmem_tracker62d5b3bea0a
---
 files/apache-keystone.template | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 84dc273200..128436027d 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -7,7 +7,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 </Directory>
 
 <VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIDaemonProcess keystone-public processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-public
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
@@ -21,7 +21,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 </VirtualHost>
 
 <VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-admin
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
     WSGIApplicationGroup %{GLOBAL}

From 8cf9acd577a30bf9e6a54a9d82b9b7fc9ae769fb Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 16 Mar 2017 14:06:58 -0700
Subject: [PATCH 1806/3333] Tune apache connection limits down

We are facing memory pressure in gate testing. Apache is fairly large so
tune its connection limits down to try and squeeze out more useable
memory. THis should be fine for dev envs, also tlsproxy is not enabled
by default so we can check that this tuning works well on a subset of
jobs before making it default everywhere.

Data comparisons done with gate-tempest-dsvm-neutron-full-ubuntu-xenial
jobs.

Old: http://logs.openstack.org/37/447037/2/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/721fc6f/logs/screen-peakmem_tracker.txt.gz
       PID   %MEM             RSS       PPID       TIME     NLWP WCHAN                     COMMAND
     20504    0.2           16660      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     20505    0.2           16600      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     20672    0.2           16600      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     20503    0.1           14388      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     19589    0.1            9964          1   00:00:00        1 -                         /usr/sbin/apache2 -k start
Total RSS: 74212

New: http://logs.openstack.org/41/446741/1/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/fa4d2e6/logs/screen-peakmem_tracker.txt.gz
       PID   %MEM             RSS       PPID       TIME     NLWP WCHAN                     COMMAND
      8036    0.1           15316       8018   00:00:01       34 -                         /usr/sbin/apache2 -k start
      8037    0.1           15228       8018   00:00:01       34 -                         /usr/sbin/apache2 -k start
      8018    0.1            8584          1   00:00:00        1 -                         /usr/sbin/apache2 -k start
Total RSS: 39128

Note RSS here is in KB. Total difference is 35084KB or about
34MB. Not the biggest change, but we seem to be functional and it
almost halves the apache overhead.

Change-Id: If82fa347db140021197a215113df4ce38fb4fd17
---
 lib/tls | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/tls b/lib/tls
index f9ef554a6c..fb2fa3a17b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -457,29 +457,30 @@ function tune_apache_connections {
 # MaxClients: maximum number of simultaneous client connections
 # MaxRequestsPerChild: maximum number of requests a server process serves
 #
-# The apache defaults are too conservative if we want reliable tempest
-# testing. Bump these values up from ~400 max clients to 1024 max clients.
+# We want to be memory thrifty so tune down apache to allow 256 total
+# connections. This should still be plenty for a dev env yet lighter than
+# apache defaults.
 <IfModule mpm_worker_module>
 # Note that the next three conf values must be changed together.
 # MaxClients = ServerLimit * ThreadsPerChild
-ServerLimit          32
+ServerLimit           8
 ThreadsPerChild      32
-MaxClients         1024
-StartServers          3
-MinSpareThreads      96
-MaxSpareThreads     192
+MaxClients          256
+StartServers          2
+MinSpareThreads      32
+MaxSpareThreads      96
 ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>
 <IfModule mpm_event_module>
 # Note that the next three conf values must be changed together.
 # MaxClients = ServerLimit * ThreadsPerChild
-ServerLimit          32
+ServerLimit           8
 ThreadsPerChild      32
-MaxClients         1024
-StartServers          3
-MinSpareThreads      96
-MaxSpareThreads     192
+MaxClients          256
+StartServers          2
+MinSpareThreads      32
+MaxSpareThreads      96
 ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>

From 4ae92b846b45ac9ef02e9d19b5d9ddcb4ac05bf3 Mon Sep 17 00:00:00 2001
From: Julian Edwards <bigjools@gmail.com>
Date: Thu, 16 Mar 2017 09:01:39 +1000
Subject: [PATCH 1807/3333] Make running_in_container work in more containers

Instead of grepping for 'lxc' in /proc/1/cgroup, use systemd's
features. This now at least also works in LXD containers.

Change-Id: I35e807c26f0b1fbba83ddbe04cfb4901a7a95cbe
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 1aa7517a8a..4435f2de2f 100644
--- a/functions
+++ b/functions
@@ -666,7 +666,7 @@ function set_mtu {
 
 # running_in_container - Returns true otherwise false
 function running_in_container {
-    if grep -q lxc /proc/1/cgroup; then
+    if [[ $(systemd-detect-virt --container) == 'none' ]]; then
         return 0
     fi
 

From a4c57cadf2fcc448dbee04a5f911af5613038678 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Fri, 17 Mar 2017 16:14:00 +0100
Subject: [PATCH 1808/3333] Replace "sid" and "testing" by "stretch"

Supported Debian distros (codenames) are "sid", "testing",
and "jessie", but it should be "stretch" and "jessie".

"testing" is no codename and therefore should be replaced by
"stretch".

"sid" changes all the time and cannot be guaranteed to run
correctly or is at least not tested.

Change-Id: Id4b80a055452bbff69036d4dc1adeda46ce99664
Closes-Bug: #1673810
Closes-Bug: #1674416
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index f08d56f60a..20cdc1dfcc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|sid|testing|jessie|f24|f25|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From bacfb94390e0680fac13cb7f7236b9d5d0e89b89 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Mon, 20 Mar 2017 22:27:20 -0700
Subject: [PATCH 1809/3333] Enable openSUSE to work in Python 3.x environments

Add packages required to run devstack with USE_PYTHON3=True.

Change-Id: Iee43c9335bd82c10cfaeffb02d1d99290c34bb83
---
 inc/python | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/inc/python b/inc/python
index a4819c2d9d..2443c4d465 100644
--- a/inc/python
+++ b/inc/python
@@ -553,6 +553,8 @@ function python3_enabled {
 function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
+    elif is_suse; then
+        install_package python3-devel python3-dbm
     fi
 }
 

From 583c52066da6738d12201bf3fcbb02b6c6690cfc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 21 Mar 2017 11:15:05 -0400
Subject: [PATCH 1810/3333] rebuild the tempest tox env during install

When redoing a stack.sh over and over again, tempest venv can get out
of sync and cause issues until deleted. We should rebuild that tempest
venv on every stack.

Change-Id: I2f66bb1a7ccf9f89e11db1326d8553589e52fbf2
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cf7eb6f722..1160ee723c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -618,7 +618,7 @@ function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
     pip_install tox
     pushd $TEMPEST_DIR
-    tox --notest -efull
+    tox -r --notest -efull
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements

From 983cccb75be919677bacb8c9b292550075b0358f Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Tue, 21 Mar 2017 18:37:24 -0400
Subject: [PATCH 1811/3333] Enable baremetal scheduler filters when using
 ironic

These are recommended for all ironic deploys; turn them on.

Change-Id: Ia3df144e626266ed1774c4cd9863aedb876c409f
---
 lib/nova_plugins/hypervisor-ironic | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 7ffd14d046..c9544fe6c7 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -42,6 +42,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
+    iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From c779b00840b79ce9c0b3a3c80ade5267e6fcb5f8 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 16 Feb 2017 20:10:36 -0800
Subject: [PATCH 1812/3333] Remove XenServer specific ovs agent config

With XenServer we have two neutron-openvswitch-agent(q-agt, q-domua)
For the q-domua it is specific for XenServer, this patch is to move
the specific configurations to os-xenapi which we have devstack plugin
in that repo

Depends-On: Ic816404c84f6a8899d01a77cb67fbfb421653e6b

Change-Id: I8a31c81d9475387fe4ed7030b70b26098e588771
---
 lib/neutron-legacy                    | 27 -----------
 lib/neutron_plugins/openvswitch_agent | 65 ---------------------------
 lib/nova_plugins/hypervisor-xenserver | 14 ------
 3 files changed, 106 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index ccab527f66..41bd0c0d78 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -432,24 +432,6 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
-
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        local dom0_ip
-        dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
-
-        local ssh_dom0
-        ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
-
-        # Find where the plugins should go in dom0
-        local xen_functions
-        xen_functions=$(cat $TOP_DIR/tools/xen/functions)
-        local plugin_dir
-        plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
-
-        # install neutron plugins to dom0
-        tar -czf - -C $NEUTRON_DIR/neutron/plugins/ml2/drivers/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
-            $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
-    fi
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
@@ -523,11 +505,6 @@ function start_mutnauq_other_agents {
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
-
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        # For XenServer, start an agent for the domU openvswitch
-        run_process q-domua "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
-    fi
 }
 
 # Start running processes, including screen
@@ -539,10 +516,6 @@ function start_neutron_agents {
 
 function stop_mutnauq_l2_agent {
     stop_process q-agt
-
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        stop_process q-domua
-    fi
 }
 
 # stop_mutnauq_other() - Stop running processes (non-screen)
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index acab582212..b65a2587c2 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -11,12 +11,6 @@ source $TOP_DIR/lib/neutron_plugins/ovs_base
 
 function neutron_plugin_create_nova_conf {
     _neutron_ovs_base_configure_nova_vif_driver
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        iniset $NOVA_CONF xenserver vif_driver nova.virt.xenapi.vif.XenAPIOpenVswitchDriver
-        iniset $NOVA_CONF xenserver ovs_integration_bridge $XEN_INTEGRATION_BRIDGE
-        # Disable nova's firewall so that it does not conflict with neutron
-        iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
-    fi
 }
 
 function neutron_plugin_install_agent_packages {
@@ -58,65 +52,6 @@ function neutron_plugin_configure_plugin_agent {
     fi
     AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-openvswitch-agent"
 
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        # Make a copy of our config for domU
-        sudo cp /$Q_PLUGIN_CONF_FILE "/$Q_PLUGIN_CONF_FILE.domU"
-
-        # change domU's config file to STACK_USER
-        sudo chown $STACK_USER:$STACK_USER /$Q_PLUGIN_CONF_FILE.domU
-
-        # Deal with Dom0's L2 Agent:
-        Q_RR_DOM0_COMMAND="$NEUTRON_BIN_DIR/neutron-rootwrap-xen-dom0 $Q_RR_CONF_FILE"
-
-        # For now, duplicate the xen configuration already found in nova.conf
-        iniset $Q_RR_CONF_FILE xenapi xenapi_connection_url "$XENAPI_CONNECTION_URL"
-        iniset $Q_RR_CONF_FILE xenapi xenapi_connection_username "$XENAPI_USER"
-        iniset $Q_RR_CONF_FILE xenapi xenapi_connection_password "$XENAPI_PASSWORD"
-
-        # Under XS/XCP, the ovs agent needs to target the dom0
-        # integration bridge.  This is enabled by using a root wrapper
-        # that executes commands on dom0 via a XenAPI plugin.
-        # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper ""
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon "xenapi_root_helper"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_url "$XENAPI_CONNECTION_URL"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_username "$XENAPI_USER"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_password "$XENAPI_PASSWORD"
-
-        # Disable minimize polling, so that it can always detect OVS and Port changes
-        # This is a problem of xenserver + neutron, bug has been reported
-        # https://bugs.launchpad.net/neutron/+bug/1495423
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent minimize_polling False
-
-        # Set "physical" mapping
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
-
-        # XEN_INTEGRATION_BRIDGE is the integration bridge in dom0
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $XEN_INTEGRATION_BRIDGE
-
-        # Set OVS native interface for ovs-agent in compute node
-        XEN_DOM0_IP=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3)
-        iniset /$Q_PLUGIN_CONF_FILE.domU ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
-        iniset /$Q_PLUGIN_CONF_FILE.domU ovs of_listen_address $HOST_IP
-
-        # Set up domU's L2 agent:
-
-        # Create a bridge "br-$VLAN_INTERFACE"
-        _neutron_ovs_base_add_bridge "br-$VLAN_INTERFACE"
-        # Add $VLAN_INTERFACE to that bridge
-        sudo ovs-vsctl -- --may-exist add-port "br-$VLAN_INTERFACE" $VLAN_INTERFACE
-
-        # Create external bridge and add port
-        _neutron_ovs_base_add_public_bridge
-        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
-
-        # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
-        # Set integration bridge to domU's
-        iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $OVS_BRIDGE
-        # Set root wrap
-        iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
-    fi
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
     iniset /$Q_PLUGIN_CONF_FILE ovs datapath_type $OVS_DATAPATH_TYPE
 }
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 0046a366c9..4abb92a654 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -96,20 +96,6 @@ CRONTAB
         echo "create_directory_for_kernels"
         echo "install_conntrack_tools"
     } | $ssh_dom0
-
-    if is_service_enabled neutron; then
-        # Remove restriction on linux bridge in Dom0 when neutron is enabled
-        $ssh_dom0 "rm -f /etc/modprobe.d/blacklist-bridge*"
-
-        count=`$ssh_dom0 "iptables -t filter -L XenServerDevstack |wc -l"`
-        if [ "$count" = "0" ]; then
-        {
-            echo "iptables -t filter --new XenServerDevstack"
-            echo "iptables -t filter -I INPUT -j XenServerDevstack"
-            echo "iptables -t filter -I XenServerDevstack -p tcp --dport 6640 -j ACCEPT"
-        } | $ssh_dom0
-        fi
-    fi
 }
 
 # install_nova_hypervisor() - Install external components

From fca0da5069f0c90ddcd38d489cb81597d569953a Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Fri, 17 Mar 2017 14:47:18 +0100
Subject: [PATCH 1813/3333] Create /opt/stack and make it home directory

single-machine.rst and index.rst

Before this, one had to create /opt/stack
manually and chown it to the stack user.
Now it is created when the user is created.

This is the same way the multi-node guide
handles it. A stack group is created too.

Change-Id: I5363d81c8fb38796f565cc6ebf6ab2dee2673989
Closes-Bug: #1673787
Closes-Bug: #1671409
---
 doc/source/guides/single-machine.rst | 2 +-
 doc/source/index.rst                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 011c41fbce..48a4fa8b12 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -47,7 +47,7 @@ below)
 
 ::
 
-    adduser stack
+    useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it will need
 to have sudo privileges:
diff --git a/doc/source/index.rst b/doc/source/index.rst
index edd6595da2..f8d500813e 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -56,7 +56,7 @@ You can quickly create a separate `stack` user to run DevStack with
 
 ::
 
-   $ sudo adduser stack
+   $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it should
 have sudo privileges:

From 530d90c9c245e11feaae5b4031bd4d8b95e4db84 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Wed, 22 Mar 2017 08:25:26 +0100
Subject: [PATCH 1814/3333] Delete unnecessary groupadd in multinode-lab

Change-Id: I13c86a19c421d8ef102f35bcae63f6dc69317268
Closes-Bug: #1674897
---
 doc/source/guides/multinode-lab.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 1b7f4cd356..484ebba571 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -73,8 +73,7 @@ Otherwise create the stack user:
 
 ::
 
-    groupadd stack
-    useradd -g stack -s /bin/bash -d /opt/stack -m stack
+    useradd -s /bin/bash -d /opt/stack -m stack
 
 This user will be making many changes to your system during installation
 and operation so it needs to have sudo privileges to root without a

From 9e64bad03ab11918f6b08f7926685bfb9d7e4596 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 9 Mar 2017 20:05:57 -0800
Subject: [PATCH 1815/3333] Use br-int when XenServer is hypervisor

Previously we use a specific integration bridge for neutron ovs agent
which is running in compute node, but this isn't necessary, this
patch is to remove the specific integration bridge for XenSever and
remove the custom integration bridge definition

Depends-On: I675565e1ea6c887d40d7a53f62968c4aa385ecca

Change-Id: If5886e3711765a97f40f20e478f958b988b5a620
---
 lib/nova_plugins/hypervisor-xenserver |  4 ----
 tools/xen/README.md                   |  5 -----
 tools/xen/install_os_domU.sh          | 12 +-----------
 tools/xen/xenrc                       |  1 -
 4 files changed, 1 insertion(+), 21 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 0046a366c9..67b3d76932 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -26,10 +26,6 @@ set +o xtrace
 
 # Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
 FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
-if is_service_enabled neutron; then
-    XEN_INTEGRATION_BRIDGE_DEFAULT=$(sed -e 's/.* xen_integration_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
-    XEN_INTEGRATION_BRIDGE=${XEN_INTEGRATION_BRIDGE:-$XEN_INTEGRATION_BRIDGE_DEFAULT}
-fi
 
 VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
 
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 7062ecb48c..9559e773d3 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -171,8 +171,3 @@ VM as `TEMPLATE_FILENAME`:
     umount "$mountdir"
     rm -rf "$mountdir"
 
-### Migrate OpenStack DomU to another host
-
-Given you need to migrate your DomU with OpenStack installed to another host,
-you need to set `XEN_INTEGRATION_BRIDGE` in localrc if neutron network is used.
-It is the bridge for `XEN_INT_BRIDGE_OR_NET_NAME` network created in Dom0
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index d2e2c572c6..ac7af0df43 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -66,10 +66,6 @@ setup_network "$VM_BRIDGE_OR_NET_NAME"
 setup_network "$MGT_BRIDGE_OR_NET_NAME"
 setup_network "$PUB_BRIDGE_OR_NET_NAME"
 
-# With neutron, one more network is required, which is internal to the
-# hypervisor, and used by the VMs
-setup_network "$XEN_INT_BRIDGE_OR_NET_NAME"
-
 if parameter_is_specified "FLAT_NETWORK_BRIDGE"; then
     if [ "$(bridge_for "$VM_BRIDGE_OR_NET_NAME")" != "$(bridge_for "$FLAT_NETWORK_BRIDGE")" ]; then
         cat >&2 << EOF
@@ -292,15 +288,9 @@ add_interface "$GUEST_NAME" "$PUB_BRIDGE_OR_NET_NAME" "$PUB_DEV_NR"
 #
 $THIS_DIR/build_xva.sh "$GUEST_NAME"
 
-# Attach a network interface for the integration network (so that the bridge
-# is created by XenServer). This is required for Neutron. Also pass that as a
-# kernel parameter for DomU
-attach_network "$XEN_INT_BRIDGE_OR_NET_NAME"
-
 XEN_INTEGRATION_BRIDGE_DEFAULT=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
 append_kernel_cmdline \
-    "$GUEST_NAME" \
-    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE_DEFAULT}"
+    "$GUEST_NAME"
 
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 60be02f3fe..169e0427a8 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -29,7 +29,6 @@ OSDOMU_VDI_GB=8
 # Get the management network from the XS installation
 VM_BRIDGE_OR_NET_NAME="OpenStack VM Network"
 PUB_BRIDGE_OR_NET_NAME="OpenStack Public Network"
-XEN_INT_BRIDGE_OR_NET_NAME="OpenStack VM Integration Network"
 
 # VM Password
 GUEST_PASSWORD=${GUEST_PASSWORD:-secret}

From d18d7c86581b419541b291990173f5fb33a45445 Mon Sep 17 00:00:00 2001
From: kesper <paresh.h.sao@gmail.com>
Date: Thu, 23 Mar 2017 05:52:33 +0000
Subject: [PATCH 1816/3333] Change for the 'running_in_container' check

This commit change check of 'running_in_container'
method so that other services ironic, nova and neutron
will not break.

Change-Id: I42eb587cfaebf37944cb10e459b8b8f7b4b4e4ba
---
 functions | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/functions b/functions
index 4435f2de2f..872f21691a 100644
--- a/functions
+++ b/functions
@@ -666,11 +666,7 @@ function set_mtu {
 
 # running_in_container - Returns true otherwise false
 function running_in_container {
-    if [[ $(systemd-detect-virt --container) == 'none' ]]; then
-        return 0
-    fi
-
-    return 1
+    [[ $(systemd-detect-virt --container) != 'none' ]]
 }
 
 

From 5ae945244ec22634f95897cb50e44fb7c2da43a6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 23 Mar 2017 12:45:29 -0400
Subject: [PATCH 1817/3333] run memory_tracker as root

In order to get memlocked pages this needs to be run as root, just
start it as root so that we don't have issues with the inability to
run sudo later in the run.

Change-Id: I7adab8cbb6d89d4717e427aec22e316d27bea075
---
 lib/dstat               | 4 ++--
 tools/memory_tracker.sh | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/dstat b/lib/dstat
index 62795f5e72..517e4237ac 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -24,12 +24,12 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh"
+    run_process memory_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
 
     # remove support for the old name when it's no longer used (sometime in Queens)
     if is_service_enabled peakmem_tracker; then
         deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
-        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh"
+        run_process peakmem_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
     fi
 }
 
diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index dac0267a7e..7397c03941 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -86,7 +86,7 @@ function tracker {
             # list processes that lock memory from swap
             if [[ $unevictable -ne $unevictable_point ]]; then
                 unevictable_point=$unevictable
-                sudo ./tools/mlock_report.py
+                ./tools/mlock_report.py
             fi
 
             echo "]]]"

From 682e0abe1a58edcdde40a92df1f060dc8fa758c8 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Fri, 17 Mar 2017 19:19:00 +0100
Subject: [PATCH 1818/3333] Do not use libvirt-bin package anymore

The package libvirt-bin is a transitional package in Debian and should
not be used anymore.

Ubuntu Xenial is an exception here.

Because of that this change also adds the possibility to use "not:" to
exclude distros in files/debs/* just as "dist:" limits distros.

Depends-On: Icc59ea79f54d4ff8751f2e353ee3530fff3d961e
Closes-Bug: #1673840
Change-Id: I3998a7178d14ec40eae5cb199d66da9546cd6ccf
---
 files/debs/nova                    |  4 +++-
 functions-common                   | 15 +++++++++++++++
 lib/nova_plugins/functions-libvirt |  6 +++++-
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/files/debs/nova b/files/debs/nova
index 58dad411a8..5e14aec836 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -10,7 +10,9 @@ iputils-arping
 kpartx
 libjs-jquery-tablesorter # Needed for coverage html reports
 libmysqlclient-dev
-libvirt-bin # NOPRIME
+libvirt-bin # dist:xenial NOPRIME
+libvirt-clients # not:xenial NOPRIME
+libvirt-daemon-system # not:xenial NOPRIME
 libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
diff --git a/functions-common b/functions-common
index a86cfd8a63..82881e6dc0 100644
--- a/functions-common
+++ b/functions-common
@@ -1148,6 +1148,19 @@ function _parse_package_files {
                 fi
             fi
 
+            # Look for # not:xxx in comment
+            if [[ $line =~ (.*)#.*not:([^ ]*) ]]; then
+                # We are using BASH regexp matching feature.
+                package=${BASH_REMATCH[1]}
+                distros=${BASH_REMATCH[2]}
+                # In bash ${VAR,,} will lowercase VAR
+                # Look for a match in the distro list
+                if [[ ${distros,,} =~ ${DISTRO,,} ]]; then
+                    # If match then skip this package
+                    inst_pkg=0
+                fi
+            fi
+
             if [[ $inst_pkg = 1 ]]; then
                 echo $package
             fi
@@ -1166,6 +1179,8 @@ function _parse_package_files {
 # - ``# NOPRIME`` defers installation to be performed later in `stack.sh`
 # - ``# dist:DISTRO`` or ``dist:DISTRO1,DISTRO2`` limits the selection
 #   of the package to the distros listed.  The distro names are case insensitive.
+# - ``# not:DISTRO`` or ``not:DISTRO1,DISTRO2`` limits the selection
+#   of the package to the distros not listed. The distro names are case insensitive.
 function get_packages {
     local xtrace
     xtrace=$(set +o | grep xtrace)
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 56bb6bda1c..7af23cfd2a 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,7 +24,11 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 function install_libvirt {
     if is_ubuntu; then
         install_package qemu-system
-        install_package libvirt-bin libvirt-dev
+        if [[ ${DISTRO} == "xenial" ]]; then
+            install_package libvirt-bin libvirt-dev
+        else
+            install_package libvirt-clients libvirt-daemon-system libvirt-dev
+        fi
         pip_install_gr libvirt-python
         if [[ ${DISTRO} == "trusty" && ${EBTABLES_RACE_FIX} == "True" ]]; then
             # Work around for bug #1501558. We can remove this once we

From 2954e337e2d2993bd3fee3f2861b3fc2f85312bc Mon Sep 17 00:00:00 2001
From: Luz Cazares <luz.cazares@intel.com>
Date: Thu, 23 Mar 2017 17:34:19 +0000
Subject: [PATCH 1819/3333] Update devstack supported OS's on documentation

Since Feb 25th devstack supported operating systems changed
due to Nova increasing its minimum required libvirt version.
Further details see: I6617283afd798af37e64913b7865cea3c8a62aba

This patch is to update versions on devstack documentation.

Change-Id: I12bb59b0903a728376ee9422213c2903b9138249
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index edd6595da2..eb10bdd420 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -39,7 +39,7 @@ Install Linux
 -------------
 
 Start with a clean and minimal install of a Linux system. Devstack
-attempts to support Ubuntu 14.04/16.04, Fedora 23/24, CentOS/RHEL 7,
+attempts to support Ubuntu 16.04/17.04, Fedora 24/25, CentOS/RHEL 7,
 as well as Debian and OpenSUSE.
 
 If you do not have a preference, Ubuntu 16.04 is the most tested, and

From 1298f1bacd039347c1d2a58ddea6efc2e0db25e1 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 23 Mar 2017 10:59:49 +0100
Subject: [PATCH 1820/3333] Remove the EBTABLES_RACE_FIX added for Trusty

Now that we don't support Ubuntu Trusty anymore, we can remove
the ebtables race workaround.

Closes-Bug: #1675714
Change-Id: I70483f871e35fcaa933d1b7bac7dbb396aa22cef
---
 files/ebtables.workaround            | 23 ---------------------
 lib/nova_plugins/functions-libvirt   |  5 -----
 stackrc                              | 11 ----------
 tools/install_ebtables_workaround.sh | 31 ----------------------------
 4 files changed, 70 deletions(-)
 delete mode 100644 files/ebtables.workaround
 delete mode 100755 tools/install_ebtables_workaround.sh

diff --git a/files/ebtables.workaround b/files/ebtables.workaround
deleted file mode 100644
index c8af51fad5..0000000000
--- a/files/ebtables.workaround
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2015 Hewlett-Packard Development Company, L.P.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-#
-#
-# This is a terrible, terrible, truly terrible work around for
-# environments that have libvirt < 1.2.11. ebtables requires that you
-# specifically tell it you would like to not race and get punched in
-# the face when 2 run at the same time with a --concurrent flag.
-
-flock -w 300 /var/lock/ebtables.nova /sbin/ebtables.real $@
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 56bb6bda1c..a0242388e5 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -26,11 +26,6 @@ function install_libvirt {
         install_package qemu-system
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
-        if [[ ${DISTRO} == "trusty" && ${EBTABLES_RACE_FIX} == "True" ]]; then
-            # Work around for bug #1501558. We can remove this once we
-            # get to a version of Ubuntu that has new enough libvirt.
-            TOP_DIR=$TOP_DIR $TOP_DIR/tools/install_ebtables_workaround.sh
-        fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         # On "KVM for IBM z Systems", kvm does not have its own package
diff --git a/stackrc b/stackrc
index c3b94d02f8..3ae3b0c8ef 100644
--- a/stackrc
+++ b/stackrc
@@ -820,17 +820,6 @@ USE_SSL=$(trueorfalse False USE_SSL)
 # sharing the same database. It would be useful for multinode Grenade tests.
 RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
 
-# ebtables is inherently racey. If you run it by two or more processes
-# simultaneously it will collide, badly, in the kernel and produce
-# failures or corruption of ebtables. The only way around it is for
-# all tools running ebtables to only ever do so with the --concurrent
-# flag. This requires libvirt >= 1.2.11.
-#
-# If you don't have this then the following work around will replace
-# ebtables with a wrapper script so that it is safe to run without
-# that flag.
-EBTABLES_RACE_FIX=$(trueorfalse False EBTABLES_RACE_FIX)
-
 # Following entries need to be last items in file
 
 # Compatibility bits required by other callers like Grenade
diff --git a/tools/install_ebtables_workaround.sh b/tools/install_ebtables_workaround.sh
deleted file mode 100755
index 45ced87f13..0000000000
--- a/tools/install_ebtables_workaround.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/bash -eu
-#
-# Copyright 2015 Hewlett-Packard Development Company, L.P.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-#
-#
-# This replaces the ebtables on your system with a wrapper script that
-# does implicit locking. This is needed if libvirt < 1.2.11 on your platform.
-
-EBTABLES=/sbin/ebtables
-EBTABLESREAL=/sbin/ebtables.real
-FILES=$TOP_DIR/files
-
-if [[ -f "$EBTABLES" ]]; then
-    if file $EBTABLES | grep ELF; then
-        sudo mv $EBTABLES $EBTABLESREAL
-        sudo install -m 0755 $FILES/ebtables.workaround $EBTABLES
-        echo "Replaced ebtables with locking workaround"
-    fi
-fi

From 9573edb4ebc8af68002f499f54da3616a1bfaa48 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 28 Mar 2017 19:37:39 +1100
Subject: [PATCH 1821/3333] Run mlock_report under python3

psutil is only installed under python3 for the 3.5 gate jobs.  Call
mlock_report.py with $PYTHON so we support both environments.

Updates to mlock_report.py for python3 compatability

Change-Id: If7926ce6a2996b766c49b010a7f6640ae624f860
---
 tools/memory_tracker.sh | 4 +++-
 tools/mlock_report.py   | 7 ++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index 7397c03941..cbdeb8f420 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -14,6 +14,8 @@
 
 set -o errexit
 
+PYTHON=${PYTHON:-python}
+
 # time to sleep between checks
 SLEEP_TIME=20
 
@@ -86,7 +88,7 @@ function tracker {
             # list processes that lock memory from swap
             if [[ $unevictable -ne $unevictable_point ]]; then
                 unevictable_point=$unevictable
-                ./tools/mlock_report.py
+                ${PYTHON} ./tools/mlock_report.py
             fi
 
             echo "]]]"
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 1d23af90d7..2169cc2dce 100755
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -8,14 +8,15 @@
 import psutil
 
 
-SUMMARY_REGEX = re.compile(r".*\s+(?P<locked>[\d]+)\s+KB")
+SUMMARY_REGEX = re.compile(b".*\s+(?P<locked>[\d]+)\s+KB")
 
 
 def main():
     try:
-        print _get_report()
+        print(_get_report())
     except Exception as e:
-        print "Failure listing processes locking memory: %s" % str(e)
+        print("Failure listing processes locking memory: %s" % str(e))
+        raise
 
 
 def _get_report():

From 5edae54855b6b9af4283cef07e0b0d1a0f90cd3e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 21 Mar 2017 20:50:24 -0400
Subject: [PATCH 1822/3333] initial work to enable systemd service running

During the PTG there was a discussion that the screen developer
workflow wasn't nearly as useful as it once was. There were now too
many services to see them all on one screen, and one of the most
common service restart scenarios was not restarting one service, but a
bunch to get code to take effect.

This implements a 3rd way of running services instead of direct
forking via bash, or running under screen, which is running as systemd
units.

Logging is adjusted because it's redundant to log datetime in oslo.log
when journald has that.

Swift needed to have services launched by absolute path to work.

This is disabled by default, but with instructions on using it. The
long term intent is to make this the way to run devstack, which would
be the same between both the gate and local use.

Some changes were also needed to run_process to pass the run User
in. A hack around the keystone uwsgi launcher was done at the same
time to remove a run_process feature that only keystone uwsgi uses.

Change-Id: I836bf27c4cfdc449628aa7641fb96a5489d5d4e7
---
 SYSTEMD.rst      | 177 +++++++++++++++++++++++++++++++++++++++++++++++
 functions        |  15 +++-
 functions-common |  75 +++++++++++++++++++-
 lib/dstat        |   4 +-
 lib/keystone     |   7 +-
 lib/swift        |  13 +++-
 stackrc          |  17 +++++
 7 files changed, 298 insertions(+), 10 deletions(-)
 create mode 100644 SYSTEMD.rst

diff --git a/SYSTEMD.rst b/SYSTEMD.rst
new file mode 100644
index 0000000000..b6ed19335d
--- /dev/null
+++ b/SYSTEMD.rst
@@ -0,0 +1,177 @@
+===========================
+ Using Systemd in DevStack
+===========================
+
+.. note::
+
+   This is an in progress document as we work out the way forward here
+   with DevStack and systemd.
+
+DevStack can be run with all the services as systemd unit
+files. Systemd is now the default init system for nearly every Linux
+distro, and systemd encodes and solves many of the problems related to
+poorly running processes.
+
+Why this instead of screen?
+===========================
+
+The screen model for DevStack was invented when the number of services
+that a DevStack user was going to run was typically < 10. This made
+screen hot keys to jump around very easy. However, the landscape has
+changed (not all services are stoppable in screen as some are under
+Apache, there are typically at least 20 items)
+
+There is also a common developer workflow of changing code in more
+than one service, and needing to restart a bunch of services for that
+to take effect.
+
+To enable this add the following to your local.conf::
+
+  USE_SYSTEMD=True
+
+
+
+Unit Structure
+==============
+
+.. note::
+
+   Originally we actually wanted to do this as user units, however
+   there are issues with running this under non interactive
+   shells. For now, we'll be running as system units. Some user unit
+   code is left in place in case we can switch back later.
+
+All DevStack user units are created as a part of the DevStack slice
+given the name ``devstack@$servicename.service``. This lets us do
+certain operations at the slice level.
+
+Manipulating Units
+==================
+
+Assuming the unit ``n-cpu`` to make the examples more clear.
+
+Enable a unit (allows it to be started)::
+
+  sudo systemctl enable devstack@n-cpu.service
+
+Disable a unit::
+
+  sudo systemctl disable devstack@n-cpu.service
+
+Start a unit::
+
+  sudo systemctl start devstack@n-cpu.service
+
+Stop a unit::
+
+  sudo systemctl stop devstack@n-cpu.service
+
+Restart a unit::
+
+  sudo systemctl restart devstack@n-cpu.service
+
+See status of a unit::
+
+  sudo systemctl status devstack@n-cpu.service
+
+
+Querying Logs
+=============
+
+One of the other major things that comes with systemd is journald, a
+consolidated way to access logs (including querying through structured
+metadata). This is accessed by the user via ``journalctl`` command.
+
+
+Logs can be accessed through ``journalctl``. journalctl has powerful
+query facilities. We'll start with some common options.
+
+Follow logs for a specific service::
+
+  journalctl -f --unit devstack@n-cpu.service
+
+Following logs for multiple services simultaneously::
+
+  journalctl -f --unit devstack@n-cpu.service --user-unit
+  devstack@n-cond.service
+
+Use higher precision time stamps::
+
+  journalctl -f -o short-precise --unit devstack@n-cpu.service
+
+
+Known Issues
+============
+
+Be careful about systemd python libraries. There are 3 of them on
+pypi, and they are all very different. They unfortunately all install
+into the ``systemd`` namespace, which can cause some issues.
+
+- ``systemd-python`` - this is the upstream maintained library, it has
+  a version number like systemd itself (currently ``233``). This is
+  the one you want.
+- ``systemd`` - a python 3 only library, not what you want.
+- ``python-systemd`` - another library you don't want. Installing it
+  on a system will break ansible's ability to run.
+
+
+If we were using user units, the ``[Service]`` - ``Group=`` parameter
+doesn't seem to work with user units, even though the documentation
+says that it should. This means that we will need to do an explicit
+``/usr/bin/sg``. This has the downside of making the SYSLOG_IDENTIFIER
+be ``sg``. We can explicitly set that with ``SyslogIdentifier=``, but
+it's really unfortunate that we're going to need this work
+around. This is currently not a problem because we're only using
+system units.
+
+Future Work
+===========
+
+oslo.log journald
+-----------------
+
+Journald has an extremely rich mechanism for direct logging including
+structured metadata. We should enhance oslo.log to take advantage of
+that. It would let us do things like::
+
+  journalctl REQUEST_ID=......
+
+  journalctl INSTANCE_ID=......
+
+And get all lines related to the request id or instance id.
+
+sub targets/slices
+------------------
+
+We might want to create per project slices so that it's easy to
+follow, restart all services of a single project (like swift) without
+impacting other services.
+
+log colorizing
+--------------
+
+We lose log colorization through this process. We might want to build
+a custom colorizer that we could run journalctl output through
+optionally for people.
+
+user units
+----------
+
+It would be great if we could do services as user units, so that there
+is a clear separation of code being run as not root, to ensure running
+as root never accidentally gets baked in as an assumption to
+services. However, user units interact poorly with devstack-gate and
+the way that commands are run as users with ansible and su.
+
+Maybe someday we can figure that out.
+
+References
+==========
+
+- Arch Linux Wiki - https://wiki.archlinux.org/index.php/Systemd/User
+- Python interface to journald -
+  https://www.freedesktop.org/software/systemd/python-systemd/journal.html
+- Systemd documentation on service files -
+  https://www.freedesktop.org/software/systemd/man/systemd.service.html
+- Systemd documentation on exec (can be used to impact service runs) -
+  https://www.freedesktop.org/software/systemd/man/systemd.exec.html
diff --git a/functions b/functions
index 872f21691a..f6679fdebe 100644
--- a/functions
+++ b/functions
@@ -575,7 +575,9 @@ function vercmp {
 function setup_logging {
     local conf_file=$1
     local other_cond=${2:-"False"}
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
+    if [[ "$USE_SYSTEMD" == "True" ]]; then
+        setup_systemd_logging $conf_file
+    elif [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
         setup_colorized_logging $conf_file
     else
         setup_standard_logging_identity $conf_file
@@ -601,6 +603,17 @@ function setup_colorized_logging {
     iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
 }
 
+function setup_systemd_logging {
+    local conf_file=$1
+    local conf_section="DEFAULT"
+    local project_var="project_name"
+    local user_var="user_name"
+    iniset $conf_file $conf_section logging_context_format_string "%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s] %(instance)s%(message)s"
+    iniset $conf_file $conf_section logging_default_format_string "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
+}
+
 function setup_standard_logging_identity {
     local conf_file=$1
     iniset $conf_file DEFAULT logging_user_identity_format "%(project_name)s %(user_name)s"
diff --git a/functions-common b/functions-common
index a86cfd8a63..ec68644757 100644
--- a/functions-common
+++ b/functions-common
@@ -1443,6 +1443,59 @@ function _run_process {
     exit 0
 }
 
+function write_user_unit_file {
+    local service=$1
+    local command="$2"
+    local group=$3
+    local user=$4
+    local extra=""
+    if [[ -n "$group" ]]; then
+        extra="Group=$group"
+    fi
+    local unitfile="$SYSTEMD_DIR/$service"
+    mkdir -p $SYSTEMD_DIR
+
+    iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "User" "$user"
+    iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    if [[ -n "$group" ]]; then
+        iniset -sudo $unitfile "Service" "Group" "$group"
+    fi
+    iniset -sudo $unitfile "Install" "WantedBy" "multi-user.target"
+
+    # changes to existing units sometimes need a refresh
+    $SYSTEMCTL daemon-reload
+}
+
+function _run_under_systemd {
+    local service=$1
+    local command="$2"
+    local cmd=$command
+    local systemd_service="devstack@$service.service"
+    local group=$3
+    local user=${4:-$STACK_USER}
+    write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+
+    $SYSTEMCTL enable $systemd_service
+    $SYSTEMCTL start $systemd_service
+    _journal_log $service $systemd_service
+}
+
+function _journal_log {
+    local service=$1
+    local unit=$2
+    local logfile="${service}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
+    if [[ -n ${LOGDIR} ]]; then
+        $JOURNALCTL_F $2 > "$real_logfile" &
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+        fi
+    fi
+}
+
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
 # This is used for ``service_check`` when all the ``screen_it`` are called finished
 # Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
@@ -1478,16 +1531,24 @@ function run_process {
     local service=$1
     local command="$2"
     local group=$3
-    local subservice=$4
+    local user=$4
 
-    local name=${subservice:-$service}
+    local name=$service
 
     time_start "run_process"
     if is_service_enabled $service; then
-        if [[ "$USE_SCREEN" = "True" ]]; then
+        if [[ "$USE_SYSTEMD" = "True" ]]; then
+            _run_under_systemd "$name" "$command" "$group" "$user"
+        elif [[ "$USE_SCREEN" = "True" ]]; then
+            if [[ "$user" == "root" ]]; then
+                command="sudo $command"
+            fi
             screen_process "$name" "$command" "$group"
         else
             # Spawn directly without screen
+            if [[ "$user" == "root" ]]; then
+                command="sudo $command"
+            fi
             _run_process "$name" "$command" "$group" &
         fi
     fi
@@ -1618,6 +1679,14 @@ function stop_process {
 
     if is_service_enabled $service; then
         # Kill via pid if we have one available
+        if [[ "$USE_SYSTEMD" == "True" ]]; then
+            # Only do this for units which appear enabled, this also
+            # catches units that don't really exist for cases like
+            # keystone without a failure.
+            $SYSTEMCTL stop devstack@$service.service
+            $SYSTEMCTL disable devstack@$service.service
+        fi
+
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
             pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid)
             # oslo.service tends to stop actually shutting down
diff --git a/lib/dstat b/lib/dstat
index 517e4237ac..982b70387e 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -24,12 +24,12 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
 
     # remove support for the old name when it's no longer used (sometime in Queens)
     if is_service_enabled peakmem_tracker; then
         deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
-        run_process peakmem_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
+        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
     fi
 }
 
diff --git a/lib/keystone b/lib/keystone
index 530f3b42d9..af607c344b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -602,8 +602,11 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
-        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
-        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
+        # TODO(sdague): we should really get down to a single keystone here
+        enable_service key-p
+        enable_service key-a
+        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" ""
+        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" ""
     fi
 
     echo "Waiting for keystone to start..."
diff --git a/lib/swift b/lib/swift
index 5b510e5930..6c2af61551 100644
--- a/lib/swift
+++ b/lib/swift
@@ -38,6 +38,15 @@ fi
 # Set up default directories
 GITDIR["python-swiftclient"]=$DEST/python-swiftclient
 
+# Swift virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["swift"]=${SWIFT_DIR}.venv
+    SWIFT_BIN_DIR=${PROJECT_VENV["swift"]}/bin
+else
+    SWIFT_BIN_DIR=$(get_python_exec_prefix)
+fi
+
+
 SWIFT_DIR=$DEST/swift
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
@@ -807,10 +816,10 @@ function start_swift {
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
-    run_process s-proxy "swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
+    run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
         for type in object container account; do
-            run_process s-${type} "swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
+            run_process s-${type} "$SWIFT_BIN_DIR/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
         done
     fi
 
diff --git a/stackrc b/stackrc
index c3b94d02f8..61501b5696 100644
--- a/stackrc
+++ b/stackrc
@@ -87,6 +87,23 @@ HORIZON_APACHE_ROOT="/dashboard"
 # be disabled for automated testing by setting this value to False.
 USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
+# Whether to use SYSTEMD to manage services
+USE_SYSTEMD=$(trueorfalse False USE_SYSTEMD)
+USER_UNITS=$(trueorfalse False USER_UNITS)
+if [[ "$USER_UNITS" == "True" ]]; then
+    SYSTEMD_DIR="$HOME/.local/share/systemd/user"
+    SYSTEMCTL="systemctl --user"
+    JOURNALCTL_F="journalctl -f -o short-precise --user-unit"
+else
+    SYSTEMD_DIR="/etc/systemd/system"
+    SYSTEMCTL="sudo systemctl"
+    JOURNALCTL_F="journalctl -f -o short-precise --unit"
+fi
+
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    USE_SCREEN=False
+fi
+
 # When using screen, should we keep a log file on disk?  You might
 # want this False if you have a long-running setup where verbose logs
 # can fill-up the host.

From 213c9a151f907988b283e4223404d0a09a5d4aa3 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Tue, 28 Mar 2017 14:32:28 +0000
Subject: [PATCH 1823/3333] Remove installation of keystone policy file

As of Id6e3c0ac54b21d85e68625a5b52fe2559fb70f24 keystone's policy
file is empty and it is no longer required at runtime. This commit
updates devstack to not deploy a policy file for keystone because
devstack doesn't specify any policy overrides. Instead, we can remove
the sample policy file and rely on the defaults that have been
registered in code. This is the same approach nova took with policy
in I85a251376dfe38caa4b100861bf764014a98bc37.

Change-Id: Ib1d9a51a78e2a84a3d7294dc8782605a681fa9e8
---
 lib/keystone | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 530f3b42d9..ea33abae96 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -202,7 +202,6 @@ function configure_keystone {
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
         install -m 600 $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
-        cp -p $KEYSTONE_DIR/etc/policy.json $KEYSTONE_CONF_DIR
         if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
             cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
         fi

From 50686fe244cf5df95c59ffdfa124bedb4f253dbf Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 29 Mar 2017 08:28:40 +0000
Subject: [PATCH 1824/3333] Updated from generate-devstack-plugins-list

Change-Id: Id1313b029df86ea446b90ad086cc436702379dc9
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cc55c0bd20..cfa54551ae 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -68,6 +68,7 @@ horizon-mellanox                       `git://git.openstack.org/openstack/horizo
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
+ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__

From 980d65f58672388538e588cdd52c9169feec4a91 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 27 Mar 2017 14:29:58 +0200
Subject: [PATCH 1825/3333] Swift: Optionally start only the necessary services

Currently Devstack starts all Swift services, including those
in charge of "consistency convergence" (remember Swift is eventually
consistent), data scrubbing, hard-deletion (*-reaper services)
cleanup.

But when running with Replication Factor 1 some of those services
are not needed at all. Besides, the fonctionnalities provided by
some of these services are not tested at all (neither in Tempest
nor in Swift functional tests).

Thus, in light of saving some Mo of RAM, this patch introduces a config
flag to start only a minimal set of Swift services, just what's required
to make all of our current tests pass.

The default value for this new config flag is set to start all services,
that is to maintain Devstack's current behavior.

For sake of completeness, here is the list of services that are not
going to be started is the config flag is toggled, and the associated RSS
according to our peakmem_tracker

40004  swift-object-replicator /etc/swift/object-server/1.conf
34320  swift-container-replicator /etc/swift/container-server/1.conf
33584  swift-object-auditor /etc/swift/object-server/1.conf
33328  swift-object-reconstructor /etc/swift/object-server/1.conf
31936  swift-object-updater /etc/swift/object-server/1.conf
31492  swift-account-reaper /etc/swift/account-server/1.conf
31076  swift-account-replicator /etc/swift/account-server/1.conf
29540  swift-container-updater /etc/swift/container-server/1.conf
29220  swift-account-auditor /etc/swift/account-server/1.conf
29036  swift-container-auditor /etc/swift/container-server/1.conf

So we are looking at saving at most ~350Mo of RAM (could be less
because RSS doesn't account for shared memory).

A follow-up patch will soon be proposed in devstack-gate to not run
those additional services in our Gate jobs.

Change-Id: I8a0d03ac0296a74e38efd185beb8513866eaf0c4
---
 lib/swift | 55 +++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 37 insertions(+), 18 deletions(-)

diff --git a/lib/swift b/lib/swift
index 6c2af61551..96e2f03e5f 100644
--- a/lib/swift
+++ b/lib/swift
@@ -128,6 +128,11 @@ SWIFT_PARTITION_POWER_SIZE=${SWIFT_PARTITION_POWER_SIZE:-9}
 SWIFT_REPLICAS=${SWIFT_REPLICAS:-1}
 SWIFT_REPLICAS_SEQ=$(seq ${SWIFT_REPLICAS})
 
+# Set ``SWIFT_START_ALL_SERVICES`` to control whether all Swift
+# services (including the *-auditor, *-replicator, *-reconstructor, etc.
+# daemons) should be started.
+SWIFT_START_ALL_SERVICES=$(trueorfalse True SWIFT_START_ALL_SERVICES)
+
 # Set ``SWIFT_LOG_TOKEN_LENGTH`` to configure how many characters of an auth
 # token should be placed in the logs. When keystone is used with PKI tokens,
 # the token values can be huge, seemingly larger the 2K, at the least. We
@@ -786,8 +791,11 @@ function start_swift {
     fi
 
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
+        # Apache should serve the "PACO" a.k.a "main" services
         restart_apache_server
+        # The rest of the services should be started in backgroud
         swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+        # Be we still want the logs of Swift Proxy in our screen session
         tail_log s-proxy /var/log/$APACHE_NAME/proxy-server
         if [[ ${SWIFT_REPLICAS} == 1 ]]; then
             for type in object container account; do
@@ -797,31 +805,42 @@ function start_swift {
         return 0
     fi
 
-    # By default with only one replica we are launching the proxy,
-    # container, account and object server in screen in foreground and
-    # other services in background. If we have ``SWIFT_REPLICAS`` set to something
-    # greater than one we first spawn all the Swift services then kill the proxy
-    # service so we can run it in foreground in screen.  ``swift-init ...
-    # {stop|restart}`` exits with '1' if no servers are running, ignore it just
-    # in case
-    local todo type
-    swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
+
+    # By default with only one replica we are launching the proxy, container
+    # account and object server in screen in foreground. Then, the rest of
+    # the services is optionally started.
+    #
+    # If we have ``SWIFT_REPLICAS`` set to something greater than one
+    # we first spawn *all* the Swift services then kill the proxy service
+    # so we can run it in foreground in screen.
+    #
+    # ``swift-init ... {stop|restart}`` exits with '1' if no servers are
+    #  running, ignore it just in case
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
-        todo="object container account"
+        local foreground_services type
+
+        foreground_services="object container account"
+        for type in ${foreground_services}; do
+            run_process s-${type} "$SWIFT_BIN_DIR/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
+        done
+
+        if [[ "$SWIFT_START_ALL_SERVICES" == "True" ]]; then
+            swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+        else
+            # The container-sync daemon is strictly needed to pass the container
+            # sync Tempest tests.
+            swift-init --run-dir=${SWIFT_DATA_DIR}/run container-sync start
+        fi
+    else
+        swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
+        swift-init --run-dir=${SWIFT_DATA_DIR}/run proxy stop || true
     fi
-    for type in proxy ${todo}; do
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run ${type} stop || true
-    done
+
     if is_service_enabled tls-proxy; then
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
     run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
-    if [[ ${SWIFT_REPLICAS} == 1 ]]; then
-        for type in object container account; do
-            run_process s-${type} "$SWIFT_BIN_DIR/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
-        done
-    fi
 
     if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
         swift_configure_tempurls

From f85e0ba353c71fc5c8bacebe006e68bebf2af024 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 17 Mar 2017 12:54:30 -0700
Subject: [PATCH 1826/3333] Enable Kernel Samepage Merging by default

In an effort to reduce memory consumption enable KSM by default. The
biggest win here is when using libvirt with nova or ironic with its
fake baremetal instances. In theory any process that runs duplicates
with mergeable memory will benefit though.

Change-Id: I4c5addfd3e83b6516023b36cbaabd5169f0d5ceb
---
 stack.sh | 16 ++++++++++++++++
 stackrc  |  8 ++++++++
 2 files changed, 24 insertions(+)

diff --git a/stack.sh b/stack.sh
index 20cdc1dfcc..504d94f148 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1006,6 +1006,22 @@ init_service_check
 # Save configuration values
 save_stackenv $LINENO
 
+# Kernel Samepage Merging (KSM)
+# -----------------------------
+
+# Processes that mark their memory as mergeable can share identical memory
+# pages if KSM is enabled. This is particularly useful for nova + libvirt
+# backends but any other setup that marks its memory as mergeable can take
+# advantage. The drawback is there is higher cpu load; however, we tend to
+# be memory bound not cpu bound so enable KSM by default but allow people
+# to opt out if the CPU time is more important to them.
+
+if [[ "ENABLE_KSM" == "True" ]] ; then
+    if [[ -f /sys/kernel/mm/ksm/run ]] ; then
+        sudo sh -c "echo 1 > /sys/kernel/mm/ksm/run"
+    fi
+fi
+
 
 # Start Services
 # ==============
diff --git a/stackrc b/stackrc
index 61501b5696..b53f791380 100644
--- a/stackrc
+++ b/stackrc
@@ -104,6 +104,14 @@ if [[ "$USE_SYSTEMD" == "True" ]]; then
     USE_SCREEN=False
 fi
 
+# Whether or not to enable Kernel Samepage Merging (KSM) if available.
+# This allows programs that mark their memory as mergeable to share
+# memory pages if they are identical. This is particularly useful with
+# libvirt backends. This reduces memory useage at the cost of CPU overhead
+# to scan memory. We default to enabling it because we tend to be more
+# memory constrained than CPU bound.
+ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
+
 # When using screen, should we keep a log file on disk?  You might
 # want this False if you have a long-running setup where verbose logs
 # can fill-up the host.

From bfcc760b9650b09af073e1c6beb489069e5eec0d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 29 Mar 2017 11:52:06 +1100
Subject: [PATCH 1827/3333] Enable libvirt coredumps

This adds a flag and basic config for enabling coredumps for libvirt.

Partial-Bug: 1643911
Co-Authored-By: Matthew Booth <mbooth@redhat.com>

Change-Id: If7cd54e804a5a389a0d82a325b58f5b41b8ef0db
---
 lib/nova_plugins/functions-libvirt | 49 +++++++++++++++++++++++++-----
 tools/worlddump.py                 |  9 ++++++
 2 files changed, 50 insertions(+), 8 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 56bb6bda1c..1ae049226a 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -20,8 +20,46 @@ set +o xtrace
 # extremely verbose.)
 DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 
+# Try to enable coredumps for libvirt
+# Currently fairly specific to OpenStackCI hosts
+DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
+
+# Only Xenial is left with libvirt-bin.  Everywhere else is libvirtd
+if is_ubuntu && [ ! -f /etc/init.d/libvirtd ]; then
+    LIBVIRT_DAEMON=libvirt-bin
+else
+    LIBVIRT_DAEMON=libvirtd
+fi
+
+# Enable coredumps for libvirt
+#  Bug: https://bugs.launchpad.net/nova/+bug/1643911
+function _enable_coredump {
+    local confdir=/etc/systemd/system/${LIBVIRT_DAEMON}.service.d
+    local conffile=${confdir}/coredump.conf
+
+    # Create a coredump directory, and instruct the kernel to save to
+    # here
+    sudo mkdir -p /var/core
+    sudo chmod a+wrx /var/core
+    echo '/var/core/core.%e.%p.%h.%t' | \
+        sudo tee /proc/sys/kernel/core_pattern
+
+    # Drop a config file to up the core ulimit
+    sudo mkdir -p ${confdir}
+    sudo tee ${conffile} <<EOF
+[Service]
+LimitCORE=infinity
+EOF
+
+    # Tell systemd to reload the unit (service restarts later after
+    # config anyway)
+    sudo systemctl daemon-reload
+}
+
+
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
+
     if is_ubuntu; then
         install_package qemu-system
         install_package libvirt-bin libvirt-dev
@@ -48,7 +86,10 @@ function install_libvirt {
 
         install_package libvirt libvirt-devel
         pip_install_gr libvirt-python
+    fi
 
+    if [[ $DEBUG_LIBVIRT_COREDUMPS == True ]]; then
+        _enable_coredump
     fi
 }
 
@@ -68,14 +109,6 @@ cgroup_device_acl = [
 EOF
     fi
 
-    # Since the release of Debian Wheezy the libvirt init script is libvirtd
-    # and not libvirtd-bin anymore.
-    if is_ubuntu && [ ! -f /etc/init.d/libvirtd ]; then
-        LIBVIRT_DAEMON=libvirt-bin
-    else
-        LIBVIRT_DAEMON=libvirtd
-    fi
-
     if is_fedora || is_suse; then
         # Starting with fedora 18 and opensuse-12.3 enable stack-user to
         # virsh -c qemu:///system by creating a policy-kit rule for
diff --git a/tools/worlddump.py b/tools/worlddump.py
index eb109b9d51..6fff1497a7 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -223,6 +223,14 @@ def guru_meditation_reports():
         print("guru meditation report in %s log" % service)
 
 
+def var_core():
+    if os.path.exists('/var/core'):
+        _header("/var/core dumps")
+        # NOTE(ianw) : see DEBUG_LIBVIRT_COREDUMPS.  We could think
+        # about getting backtraces out of these.  There are other
+        # tools out there that can do that sort of thing though.
+        _dump_cmd("ls -ltrah /var/core")
+
 def main():
     opts = get_options()
     fname = filename(opts.dir, opts.name)
@@ -238,6 +246,7 @@ def main():
         ebtables_dump()
         compute_consoles()
         guru_meditation_reports()
+        var_core()
 
 
 if __name__ == '__main__':

From def07b21f86ee70cae223785f0195c91de1f2b64 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 30 Mar 2017 07:18:49 -0400
Subject: [PATCH 1828/3333] Updated docs from finding more things about systemd

Change-Id: I3d807cd342f30eada04a6be2af7db482f9c4a796
---
 SYSTEMD.rst | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/SYSTEMD.rst b/SYSTEMD.rst
index b6ed19335d..729fdf47b6 100644
--- a/SYSTEMD.rst
+++ b/SYSTEMD.rst
@@ -74,6 +74,20 @@ See status of a unit::
 
   sudo systemctl status devstack@n-cpu.service
 
+Operating on more than one unit at a time
+-----------------------------------------
+
+Systemd supports wildcarding for unit operations. To restart every
+service in devstack you can do that following::
+
+  sudo systemctl restart devstack@*
+
+Or to see the status of all Nova processes you can do::
+
+  sudo systemctl status devstack@n-*
+
+We'll eventually make the unit names a bit more meaningful so that
+it's easier to understand what you are restarting.
 
 Querying Logs
 =============
@@ -92,9 +106,13 @@ Follow logs for a specific service::
 
 Following logs for multiple services simultaneously::
 
-  journalctl -f --unit devstack@n-cpu.service --user-unit
+  journalctl -f --unit devstack@n-cpu.service --unit
   devstack@n-cond.service
 
+or you can even do wild cards to follow all the nova services::
+
+  journalctl -f --unit devstack@n-*
+
 Use higher precision time stamps::
 
   journalctl -f -o short-precise --unit devstack@n-cpu.service
@@ -138,14 +156,8 @@ that. It would let us do things like::
 
   journalctl INSTANCE_ID=......
 
-And get all lines related to the request id or instance id.
-
-sub targets/slices
-------------------
-
-We might want to create per project slices so that it's easy to
-follow, restart all services of a single project (like swift) without
-impacting other services.
+And get all lines related to the request id or instance id. (Note:
+this work has been started at https://review.openstack.org/#/c/451525/)
 
 log colorizing
 --------------

From 571ba8b3bb6b600a9b2479be1e88f829b086631b Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Wed, 29 Mar 2017 22:06:54 -0400
Subject: [PATCH 1829/3333] Change mode of DATA_DIR to 0755 as well

It looks libvirt/qemu requires mode 0755 to functioning properly,
but DATA_DIR won't be set to 0755 if it is different from default.

Change-Id: I37ca0b02b6a75b3756860b547e84c37ccfc99d13
Closes-Bug: #1677421
---
 stack.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stack.sh b/stack.sh
index 20cdc1dfcc..310676ac5c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -328,6 +328,7 @@ fi
 DATA_DIR=${DATA_DIR:-${DEST}/data}
 sudo mkdir -p $DATA_DIR
 safe_chown -R $STACK_USER $DATA_DIR
+safe_chmod 0755 $DATA_DIR
 
 # Configure proper hostname
 # Certain services such as rabbitmq require that the local hostname resolves

From 87535a5b9fa77471d67432a8da793e00fafc8870 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 3 Apr 2017 08:24:23 +0000
Subject: [PATCH 1830/3333] Updated from generate-devstack-plugins-list

Change-Id: I68d8812558e1f1f09ab5f30145ce5c0943cae7db
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cfa54551ae..beb6abbb9e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,6 +69,7 @@ ironic                                 `git://git.openstack.org/openstack/ironic
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
+k8s-cloud-provider                     `git://git.openstack.org/openstack/k8s-cloud-provider <https://git.openstack.org/cgit/openstack/k8s-cloud-provider>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__

From 9c5ffd8d132866bd6120696e138e5b7b42dc3f23 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 29 Mar 2017 16:47:57 -0400
Subject: [PATCH 1831/3333] Handle uwsgi on systemd properly

uwsgi is a different service type under systemd and shouldn't be run as
a standard oneshot type. The uwsgi docs outline a good pattern for
writing systemd unit files:

http://uwsgi-docs.readthedocs.io/en/latest/Systemd.html

This commit takes those suggestions and creates a separate path for
writing uwsgi unit files.

Change-Id: I9b541b86781afdded311dba058cedd783e1a0dfa
---
 functions-common | 32 +++++++++++++++++++++++++++++++-
 lib/keystone     |  7 +++++--
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index ec68644757..5b096c60f7 100644
--- a/functions-common
+++ b/functions-common
@@ -1467,6 +1467,32 @@ function write_user_unit_file {
     $SYSTEMCTL daemon-reload
 }
 
+function write_uwsgi_user_unit_file {
+    local service=$1
+    local command="$2"
+    local group=$3
+    local user=$4
+    local unitfile="$SYSTEMD_DIR/$service"
+    mkdir -p $SYSTEMD_DIR
+
+    iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "User" "$user"
+    iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    iniset -sudo $unitfile "Service" "Type" "notify"
+    iniset -sudo $unitfile "Service" "KillSignal" "SIGQUIT"
+    iniset -sudo $unitfile "Service" "Restart" "Always"
+    iniset -sudo $unitfile "Service" "NotifyAccess" "all"
+    iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
+
+    if [[ -n "$group" ]]; then
+        iniset -sudo $unitfile "Service" "Group" "$group"
+    fi
+    iniset -sudo $unitfile "Install" "WantedBy" "multi-user.target"
+
+    # changes to existing units sometimes need a refresh
+    $SYSTEMCTL daemon-reload
+}
+
 function _run_under_systemd {
     local service=$1
     local command="$2"
@@ -1474,7 +1500,11 @@ function _run_under_systemd {
     local systemd_service="devstack@$service.service"
     local group=$3
     local user=${4:-$STACK_USER}
-    write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    if [[ "$command" =~ "uwsgi" ]] ; then
+        write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    else
+        write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    fi
 
     $SYSTEMCTL enable $systemd_service
     $SYSTEMCTL start $systemd_service
diff --git a/lib/keystone b/lib/keystone
index d4b3a66e24..3db3c8d4aa 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -604,8 +604,8 @@ function start_keystone {
         # TODO(sdague): we should really get down to a single keystone here
         enable_service key-p
         enable_service key-a
-        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" ""
-        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" ""
+        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_FILE" ""
+        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_FILE" ""
     fi
 
     echo "Waiting for keystone to start..."
@@ -638,6 +638,9 @@ function stop_keystone {
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         disable_apache_site keystone
         restart_apache_server
+    else
+        stop_process key-p
+        stop_process key-a
     fi
     # Kill the Keystone screen window
     stop_process key

From 5cd44dbe6c0a641258f36d7959952bc971435b74 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 5 Apr 2017 07:23:37 -0400
Subject: [PATCH 1832/3333] add use_journal if we are enabling systemd

This is going to be a new option in oslo.log, which we can start
setting early to make it take effect.

Change-Id: If0e5e4717a1810c759058f33608fbac7543f2d85
---
 functions | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index f6679fdebe..c99e435175 100644
--- a/functions
+++ b/functions
@@ -606,11 +606,13 @@ function setup_colorized_logging {
 function setup_systemd_logging {
     local conf_file=$1
     local conf_section="DEFAULT"
-    local project_var="project_name"
-    local user_var="user_name"
-    iniset $conf_file $conf_section logging_context_format_string "%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s] %(instance)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+    iniset $conf_file $conf_section use_journal "True"
+    iniset $conf_file $conf_section logging_context_format_string \
+           "%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s] %(instance)s%(message)s"
+    iniset $conf_file $conf_section logging_default_format_string \
+           "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_debug_format_suffix \
+           "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 

From eb235814d3436953d548bb83c65851f7cec6d1e7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 6 Apr 2017 10:52:48 -0400
Subject: [PATCH 1833/3333] Install systemd python bindings by default

These are needed for oslo.log to use journald support. They are
*probably* already installed, but just in case we force install them.

Change-Id: I0dc66bd2628ff4b3e1caa7ab4366d7f36ff7ea94
---
 files/debs/general | 1 +
 files/rpms/general | 1 +
 2 files changed, 2 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index c121770fa2..3a0e24182a 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -25,6 +25,7 @@ psmisc
 python2.7
 python-dev
 python-gdbm # needed for testr
+python-systemd
 screen
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 77d2fa5f0a..baba06b5ab 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,6 +27,7 @@ pyOpenSSL # version in pip uses too much memory
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 screen
+systemd-python
 tar
 tcpdump
 unzip

From 9fecc2ad04a9414bfb3127d80ee02fed1d36a30d Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 7 Apr 2017 12:28:40 -0500
Subject: [PATCH 1834/3333] Add OpenStackSDK as a lib install

This is required to install python-openstacksdk from source for testing
other projects against master.

Change-Id: Iee7b043ac7d381dadf89d26098f69e935ed81d6b
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index e34e48ad03..1a78bdfe73 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -48,6 +48,7 @@ GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
 GITDIR["osprofiler"]=$DEST/osprofiler
 GITDIR["pycadf"]=$DEST/pycadf
+GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
@@ -95,6 +96,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.vmware"
     _do_install_oslo_lib "osprofiler"
     _do_install_oslo_lib "pycadf"
+    _do_install_oslo_lib "python-openstacksdk"
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
     _do_install_oslo_lib "tooz"
diff --git a/stackrc b/stackrc
index 5ace0fbf20..00aab8d3c4 100644
--- a/stackrc
+++ b/stackrc
@@ -529,6 +529,10 @@ GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
 GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
 GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-master}
 
+# python-openstacksdk OpenStack Python SDK
+GITREPO["python-openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/python-openstacksdk.git}
+GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-master}
+
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 415fec506d..3d4bcd2596 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -37,7 +37,7 @@ ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
 ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
-ALL_LIBS+=" oslo.i18n oslo.utils python-swiftclient"
+ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"

From 7f80649eaf1969a4b3d22fa8c654dc68f7000f30 Mon Sep 17 00:00:00 2001
From: Leticia Wanderley <leticiafwanderley@gmail.com>
Date: Thu, 6 Apr 2017 20:40:19 -0300
Subject: [PATCH 1835/3333] Removes double colon on script comments

A few comment lines on stack.sh had two colons where only one colon
was necessary.

Change-Id: Ia02e1ca28a8fadc2e5477201887a1f4d59996db8
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index d8f3ad6b53..759a8dbacc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -161,16 +161,16 @@ rm -f $TOP_DIR/.localrc.auto
 extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
 
 # ``stack.sh`` is customizable by setting environment variables.  Override a
-# default setting via export::
+# default setting via export:
 #
 #     export DATABASE_PASSWORD=anothersecret
 #     ./stack.sh
 #
-# or by setting the variable on the command line::
+# or by setting the variable on the command line:
 #
 #     DATABASE_PASSWORD=simple ./stack.sh
 #
-# Persistent variables can be placed in a ``local.conf`` file::
+# Persistent variables can be placed in a ``local.conf`` file:
 #
 #     [[local|localrc]]
 #     DATABASE_PASSWORD=anothersecret

From 2a2db2efc522306acf90b2fb9cf0106cf7cf8e6d Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sun, 9 Apr 2017 22:37:50 -0700
Subject: [PATCH 1836/3333] XenAPI: Remove final references to Integration
 bridge

The change to remove references of XEN_INTEGRATION_BRIDGE
(If5886e3711765a97f40f20e478f958b988b5a620) unfortunately left some
code which should have been removed.  This remaining code caused an
error in some situations when deploying from scratch (which the CI
avoids for expediency)

Change-Id: Ia568462c9cca8cff8fcfada8148d185609d61a7d
---
 tools/xen/install_os_domU.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index ac7af0df43..f4ca71a906 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -288,10 +288,6 @@ add_interface "$GUEST_NAME" "$PUB_BRIDGE_OR_NET_NAME" "$PUB_DEV_NR"
 #
 $THIS_DIR/build_xva.sh "$GUEST_NAME"
 
-XEN_INTEGRATION_BRIDGE_DEFAULT=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
-append_kernel_cmdline \
-    "$GUEST_NAME"
-
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"
 

From c9a9e415b9a955525a407b78650f93e9193c8117 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 29 Mar 2017 10:28:55 -0700
Subject: [PATCH 1837/3333] Test using UCA for libvirt 2.5.0

We have had issues with libvirt 1.3.1 which is stock on Xenial. Try
using 2.5.0 from UCA instead.

Related-Bug: 1643911
Related-Bug: 1646779
Related-Bug: 1638982
Change-Id: Ia4434541c71f050fe1ffb54f4c4c1e302391d00b
---
 stackrc              |  8 ++++++--
 tools/fixup_stuff.sh | 27 +++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index b53f791380..fc03f49f29 100644
--- a/stackrc
+++ b/stackrc
@@ -599,8 +599,12 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        if [[ "$os_VENDOR" =~ (Debian) ]]; then
-            LIBVIRT_GROUP=libvirt
+        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
+            # The groups change with newer libvirt. Older Ubuntu used
+            # 'libvirtd', but now uses libvirt like Debian. Do a quick check
+            # to see if libvirtd group already exists to handle grenade's case.
+            LIBVIRT_GROUP=$(cut -d ':' -f 1 /etc/group | grep 'libvirtd$' || true)
+            LIBVIRT_GROUP=${LIBVIRT_GROUP:-libvirt}
         else
             LIBVIRT_GROUP=libvirtd
         fi
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 4dec95eb4d..6f680b860e 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -67,6 +67,33 @@ else
     echo_summary "WARNING: unable to reserve keystone ports"
 fi
 
+# Ubuntu Cloud Archive
+#---------------------
+# We've found that Libvirt on Xenial is flaky and crashes enough to be
+# a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
+# get newer Libvirt.
+if [[ "$DISTRO" = "xenial" ]]; then
+    # This pulls in apt-add-repository
+    install_package "software-properties-common"
+    # Use UCA for newer libvirt. Should give us libvirt 2.5.0.
+    if [[ -f /etc/ci/mirror_info.sh ]] ; then
+        # If we are on a nodepool provided host and it has told us about where
+        # we can find local mirrors then use that mirror.
+        source /etc/ci/mirror_info.sh
+
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
+
+        # Disable use of libvirt wheel here as presence of mirror implies
+        # presence of cached wheel build against older libvirt binary.
+        # TODO(clarkb) figure out how to use wheel again.
+        sudo bash -c 'echo "no-binary = libvirt-python" >> /etc/pip.conf'
+    else
+        # Otherwise use upstream UCA
+        sudo add-apt-repository -y cloud-archive:ocata
+    fi
+    sudo apt-get update
+fi
+
 
 # Python Packages
 # ---------------

From a48ffa8c5823d2e0c26fff6ec9804f9da1981ffa Mon Sep 17 00:00:00 2001
From: Cyril Roelandt <cyril@redhat.com>
Date: Thu, 6 Apr 2017 15:23:13 +0200
Subject: [PATCH 1838/3333] Do not ask users to overwrite their /etc/sudoers
 file

Give instructions to add permissions for stack user without touching
main config.

Closes-Bug: #1680459
Closes-Bug: #1681418
Change-Id: Idd27e684e63c616466de28c07551729a1e091bdd
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index c3bac9db72..cbd697112a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,7 +63,7 @@ have sudo privileges:
 
 ::
 
-    $ sudo tee <<<"stack ALL=(ALL) NOPASSWD: ALL" /etc/sudoers
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
     $ sudo su - stack
 
 Download DevStack

From f68f6f2e33cd83c6a0a317abf12bd8a26d5504b6 Mon Sep 17 00:00:00 2001
From: youri jeong <prises0221@gmail.com>
Date: Wed, 12 Apr 2017 19:23:40 +0900
Subject: [PATCH 1839/3333] fix typo

fix typo for tools/dstat.sh
retreive must be retrieve

Change-Id: I7a817ec02e7156c886d7d6abb28688bfe2ef5998
---
 tools/dstat.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 1c80fb70f8..ae7306ecb7 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -9,7 +9,7 @@
 # Assumes:
 #  - dstat command is installed
 
-# Retreive log directory as argument from calling script.
+# Retrieve log directory as argument from calling script.
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.

From 3d4c6d2dd16280de150b462ae51ccf85a932c7c1 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 12 Apr 2017 13:57:36 -0700
Subject: [PATCH 1840/3333] Install netcat for libvirt live migration

Libvirt live migration requires netcat. It appears that newer UCA
packages may not automagically pull this in so explicitly list it as a
dependency of nova compute here. Note that netcat/netcat-traditional do
not appear to work and netcat-openbsd is required.

Change-Id: If2dbc53d082fea779448998ea12b821bd037a14e
---
 files/debs/n-cpu | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 69ac430290..d8bbf59d07 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -2,6 +2,7 @@ cryptsetup
 genisoimage
 gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
+netcat-openbsd
 open-iscsi
 python-guestfs # NOPRIME
 qemu-utils

From 8f8b274e60ac94bd6b2486ea075217411550c257 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 09:34:12 -0400
Subject: [PATCH 1841/3333] Clean up apache 2.2 cruft from Ubuntu 12.04

All the apache 2.2 handling is obsolete now, as we don't support those
distros, so get rid of it.

Change-Id: I9c0f78af2b32afabb2c4264aebc92089c4694f91
---
 lib/apache | 48 +++---------------------------------------------
 1 file changed, 3 insertions(+), 45 deletions(-)

diff --git a/lib/apache b/lib/apache
index d1a11ae18b..f438407aca 100644
--- a/lib/apache
+++ b/lib/apache
@@ -90,49 +90,15 @@ function install_apache_wsgi {
     fi
     # WSGI isn't enabled by default, enable it
     enable_apache_mod wsgi
-
-    # ensure mod_version enabled for <IfVersion ...>.  This is
-    # built-in statically on anything recent, but precise (2.2)
-    # doesn't have it enabled
-    sudo a2enmod version || true
-}
-
-# get_apache_version() - return the version of Apache installed
-# This function is used to determine the Apache version installed. There are
-# various differences between Apache 2.2 and 2.4 that warrant special handling.
-function get_apache_version {
-    if is_ubuntu; then
-        local version_str
-        version_str=$(sudo /usr/sbin/apache2ctl -v | awk '/Server version/ {print $3}' | cut -f2 -d/)
-    elif is_fedora; then
-        local version_str
-        version_str=$(rpm -qa --queryformat '%{VERSION}' httpd)
-    elif is_suse; then
-        local version_str
-        version_str=$(rpm -qa --queryformat '%{VERSION}' apache2)
-    else
-        exit_distro_not_supported "cannot determine apache version"
-    fi
-    if [[ "$version_str" =~ ^2\.2\. ]]; then
-        echo "2.2"
-    elif [[ "$version_str" =~ ^2\.4\. ]]; then
-        echo "2.4"
-    else
-        exit_distro_not_supported "apache version not supported"
-    fi
 }
 
 # apache_site_config_for() - The filename of the site's configuration file.
 # This function uses the global variables APACHE_NAME and APACHE_CONF_DIR.
 #
-# On Ubuntu 14.04, the site configuration file must have a .conf suffix for a2ensite and a2dissite to
+# On Ubuntu 14.04+, the site configuration file must have a .conf suffix for a2ensite and a2dissite to
 # recognise it. a2ensite and a2dissite ignore the .conf suffix used as parameter. The default sites'
 # files are 000-default.conf and default-ssl.conf.
 #
-# On Ubuntu 12.04, the site configuration file may have any format, as long as it is in
-# /etc/apache2/sites-available/. a2ensite and a2dissite need the entire file name to work. The default
-# sites' files are default and default-ssl.
-#
 # On Fedora and openSUSE, any file in /etc/httpd/conf.d/ whose name ends with .conf is enabled.
 #
 # On RHEL and CentOS, things should hopefully work as in Fedora.
@@ -141,22 +107,14 @@ function get_apache_version {
 # +----------------------+--------------------+--------------------------+--------------------------+
 # | Distribution         | File name          | Site enabling command    | Site disabling command   |
 # +----------------------+--------------------+--------------------------+--------------------------+
-# | Ubuntu 12.04         | site               | a2ensite site            | a2dissite site           |
 # | Ubuntu 14.04         | site.conf          | a2ensite site            | a2dissite site           |
 # | Fedora, RHEL, CentOS | site.conf.disabled | mv site.conf{.disabled,} | mv site.conf{,.disabled} |
 # +----------------------+--------------------+--------------------------+--------------------------+
 function apache_site_config_for {
     local site=$@
     if is_ubuntu; then
-        local apache_version
-        apache_version=$(get_apache_version)
-        if [[ "$apache_version" == "2.2" ]]; then
-            # Ubuntu 12.04 - Apache 2.2
-            echo $APACHE_CONF_DIR/${site}
-        else
-            # Ubuntu 14.04 - Apache 2.4
-            echo $APACHE_CONF_DIR/${site}.conf
-        fi
+        # Ubuntu 14.04 - Apache 2.4
+        echo $APACHE_CONF_DIR/${site}.conf
     elif is_fedora || is_suse; then
         # fedora conf.d is only imported if it ends with .conf so this is approx the same
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"

From 1f92d44544998291165942ae59626ccac7731fc8 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 13 Apr 2017 12:07:57 -0400
Subject: [PATCH 1842/3333] Use apt_get_update after we setup UCA

It is possible some CI system are using an http_proxy. Use the helper
function to cover this use case.

Change-Id: Iee685147ca0244fc7de328a765f937602223de20
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 tools/fixup_stuff.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 6f680b860e..f3ba702a3b 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -91,7 +91,9 @@ if [[ "$DISTRO" = "xenial" ]]; then
         # Otherwise use upstream UCA
         sudo add-apt-repository -y cloud-archive:ocata
     fi
-    sudo apt-get update
+    # Force update our APT repos, since we added UCA above.
+    REPOS_UPDATED=False
+    apt_get_update
 fi
 
 

From 13a29ab787657491aff3b463e1a328a0872f65d0 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 08:31:00 -0400
Subject: [PATCH 1843/3333] Add python3-systemd package

Otherwise journal logging under python3 doesn't work

Change-Id: Ib136d88a522c40482a3e94d0386a26600236f135
---
 files/debs/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/general b/files/debs/general
index 3a0e24182a..edf64ce932 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -23,6 +23,7 @@ openssl
 pkg-config
 psmisc
 python2.7
+python3-systemd
 python-dev
 python-gdbm # needed for testr
 python-systemd

From bc4b8eb5bf4804cb2e6e5d9d07f1b87d46a6a689 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 13 Apr 2017 15:06:36 -0400
Subject: [PATCH 1844/3333] Enable EPEL mirror by default

We recently disabled EPEL in openstack-infra, enable it again.

Change-Id: I213b302b34b740354d63b69e8ac7f4e1b3d3cdd7
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 759a8dbacc..dfc2bd9162 100755
--- a/stack.sh
+++ b/stack.sh
@@ -348,6 +348,10 @@ SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 # is pre-installed.
 if [[ -f /etc/nodepool/provider ]]; then
     SKIP_EPEL_INSTALL=True
+    if is_fedora; then
+        # However, EPEL is not enabled by default.
+        sudo yum-config-manager --enable epel
+    fi
 fi
 
 if is_fedora && [[ $DISTRO == "rhel7" ]] && \

From 4222ee35f64d1950ecfc146b51738b74c316e758 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 20:33:42 -0400
Subject: [PATCH 1845/3333] Make auth_uri available in the swift test setup

The swift functional tests use a config which requires keystone ports,
we're about to make those go away. This exposes the actual auth_uri to
swift for consumption.

Change-Id: I5868dfdb8e5f0972ba04e359d212b04351502436
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 96e2f03e5f..5eac904559 100644
--- a/lib/swift
+++ b/lib/swift
@@ -538,6 +538,7 @@ EOF
         auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
         iniset ${testfile} func_test auth_port ${KEYSTONE_AUTH_PORT}
+        iniset ${testfile} func_test auth_uri ${KEYSTONE_AUTH_URI}
         if [[ $auth_vers == "3" ]]; then
             iniset ${testfile} func_test auth_prefix /v3/
         else

From 968ebeee4146b306c026ca9b51d43ae6a993d1e2 Mon Sep 17 00:00:00 2001
From: Brianna Poulos <Brianna.Poulos@jhuapl.edu>
Date: Fri, 14 Apr 2017 11:33:56 -0400
Subject: [PATCH 1846/3333] Add castellan to LIBS_FROM_GIT

Allow castellan to be installed from git instead of pip.

Castellan has recently been moved under the oslo framework,
and the barbican-tempest-plugin tests which use castellan
would benefit from the ability to usd castellan from git
instead of pip.

Change-Id: I96edca90c61aec84637b7b1ce842eff04c521923
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 3 files changed, 7 insertions(+)

diff --git a/lib/oslo b/lib/oslo
index 1a78bdfe73..182295c167 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -23,6 +23,7 @@ set +o xtrace
 # Defaults
 # --------
 GITDIR["automaton"]=$DEST/automaton
+GITDIR["castellan"]=$DEST/castellan
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
@@ -71,6 +72,7 @@ function _do_install_oslo_lib {
 # install_oslo() - Collect source and prepare
 function install_oslo {
     _do_install_oslo_lib "automaton"
+    _do_install_oslo_lib "castellan"
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
diff --git a/stackrc b/stackrc
index 88f75413c4..72ad52d765 100644
--- a/stackrc
+++ b/stackrc
@@ -364,6 +364,10 @@ GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 #
 ###################
 
+# castellan key manager interface
+GITREPO["castellan"]=${CASTELLAN_REPO:-${GIT_BASE}/openstack/castellan.git}
+GITBRANCH["castellan"]=${CASTELLAN_BRANCH:-master}
+
 # cliff command line framework
 GITREPO["cliff"]=${CLIFF_REPO:-${GIT_BASE}/openstack/cliff.git}
 GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 3d4bcd2596..314a9d56e3 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -43,6 +43,7 @@ ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
+ALL_LIBS+=" castellan"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From f9c2a68338aa566051bb301aa0f1b3dec44f5c90 Mon Sep 17 00:00:00 2001
From: Brianna Poulos <Brianna.Poulos@jhuapl.edu>
Date: Fri, 14 Apr 2017 13:00:19 -0400
Subject: [PATCH 1847/3333] Add cursive to LIBS_FROM_GIT

Allow cursive to be installed from git instead of pip.

The barbican-tempest-plugin, which uses cursive indirectly
through nova and glance, would benefit from the ability to
use cursive from git instead of pip.

Change-Id: Icae7d310f1ee392d080e7c8e421a26d7c0ef4727
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 1a78bdfe73..8eada67c0f 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -24,6 +24,7 @@ set +o xtrace
 # --------
 GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
+GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["os-client-config"]=$DEST/os-client-config
@@ -72,6 +73,7 @@ function _do_install_oslo_lib {
 function install_oslo {
     _do_install_oslo_lib "automaton"
     _do_install_oslo_lib "cliff"
+    _do_install_oslo_lib "cursive"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
     _do_install_oslo_lib "osc-lib"
diff --git a/stackrc b/stackrc
index 88f75413c4..56c19cd7f2 100644
--- a/stackrc
+++ b/stackrc
@@ -483,6 +483,10 @@ GITBRANCH["pbr"]=${PBR_BRANCH:-master}
 #
 ##################
 
+# cursive library
+GITREPO["cursive"]=${CURSIVE_REPO:-${GIT_BASE}/openstack/cursive.git}
+GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
+
 # glance store library
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
 GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 3d4bcd2596..ad36312778 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -40,7 +40,7 @@ ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
-ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
+ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 

From 4da0fa8c1387e3888de1f4174b478e82e7cc7a67 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 08:56:44 -0400
Subject: [PATCH 1848/3333] Always install apache and proxy-uwsgi

We're going to want to start using it by default so just start with
always installing it. This should not negatively impact anything else.

Also had to fix the test using cowsay, now that cowsay depends on
cowsay-off.

Part of uwsgi in devstack.

Change-Id: I8306a992d9d006bc0130a255145a6880065aa0df
---
 files/debs/general      | 3 +++
 files/rpms/general      | 2 ++
 tests/test_functions.sh | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index edf64ce932..20490c6072 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,3 +1,5 @@
+apache2
+apache2-dev
 bc
 bridge-utils
 bsdmainutils
@@ -9,6 +11,7 @@ gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
 iputils-ping
+libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
diff --git a/files/rpms/general b/files/rpms/general
index baba06b5ab..106aa6ae88 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,6 +7,8 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
+httpd
+httpd-devel
 iptables-services  # NOPRIME f23,f24,f25
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index 8aae23dcb8..adf20cdb80 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -224,7 +224,7 @@ fi
 
 # test against removed package...was a bug on Ubuntu
 if is_ubuntu; then
-    PKG=cowsay
+    PKG=cowsay-off
     if ! (dpkg -s $PKG >/dev/null 2>&1); then
         # it was never installed...set up the condition
         sudo apt-get install -y cowsay >/dev/null 2>&1

From 2b85cf0f06b099f9a771e9fbdbdef173c9d04784 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 09:02:14 -0400
Subject: [PATCH 1849/3333] Just use normal restart for apache

We're now in a systemd world where systemd is managing the restart
effectively, there is no reason to be tricksy with apache now that
we're not working around weird upstartd issues.

Change-Id: Ifadfd504eb10a90db5177ea9180b9cd8331a2948
---
 lib/apache | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/apache b/lib/apache
index f438407aca..e36d0c998f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -173,11 +173,7 @@ function restart_apache_server {
     # Apache can be slow to stop, doing an explicit stop, sleep, start helps
     # to mitigate issues where apache will claim a port it's listening on is
     # still in use and fail to start.
-    time_start "restart_apache_server"
-    stop_service $APACHE_NAME
-    sleep 3
-    start_service $APACHE_NAME
-    time_stop "restart_apache_server"
+    restart_service $APACHE_NAME
 }
 
 # reload_apache_server

From 2f8c88e0532b6b712cc386a9c15d833d3629b19a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 09:08:39 -0400
Subject: [PATCH 1850/3333] Factor out code to write uwsgi config files

Instead of this code all existing in keystone inline, factor out into
a dedicated set of functions, and make keystone use this. This drops
uwsgi supporting https directly, but that's not going to be a
supported model going forward once we get to proxy only anyway.

Change-Id: I1d89be1f1b36f26eaf543b99bde6fdc5701474fe
---
 lib/apache   | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/keystone | 47 ++++++++--------------------------------------
 2 files changed, 61 insertions(+), 39 deletions(-)

diff --git a/lib/apache b/lib/apache
index e36d0c998f..fc73b49912 100644
--- a/lib/apache
+++ b/lib/apache
@@ -181,6 +181,59 @@ function reload_apache_server {
     reload_service $APACHE_NAME
 }
 
+function write_uwsgi_config {
+    local file=$1
+    local wsgi=$2
+    local url=$3
+    local http=$4
+    local name=""
+    name=$(basename $wsgi)
+    local socket="/tmp/${name}.socket"
+
+    # always cleanup given that we are using iniset here
+    rm -rf $file
+    iniset "$file" uwsgi wsgi-file "$wsgi"
+    iniset "$file" uwsgi socket "$socket"
+    iniset "$file" uwsgi processes $API_WORKERS
+    # This is running standalone
+    iniset "$file" uwsgi master true
+    # Set die-on-term & exit-on-reload so that uwsgi shuts down
+    iniset "$file" uwsgi die-on-term true
+    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi enable-threads true
+    iniset "$file" uwsgi plugins python
+    # uwsgi recommends this to prevent thundering herd on accept.
+    iniset "$file" uwsgi thunder-lock true
+    # Override the default size for headers from the 4k default.
+    iniset "$file" uwsgi buffer-size 65535
+    # Make sure the client doesn't try to re-use the connection.
+    iniset "$file" uwsgi add-header "Connection: close"
+    # This ensures that file descriptors aren't shared between processes.
+    iniset "$file" uwsgi lazy-apps true
+    iniset "$file" uwsgi chmod-socket 666
+
+    # If we said bind directly to http, then do that and don't start the apache proxy
+    if [[ -n "$http" ]]; then
+        iniset "$file" uwsgi http $http
+    else
+        local apache_conf=""
+        apache_conf=$(apache_site_config_for $name)
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\"" | sudo tee $apache_conf
+        enable_apache_site $name
+        reload_apache_server
+    fi
+}
+
+function remove_uwsgi_config {
+    local file=$1
+    local wsgi=$2
+    local name=""
+    name=$(basename $wsgi)
+
+    rm -rf $file
+    disable_apache_site $name
+}
+
 # Restore xtrace
 $_XTRACE_LIB_APACHE
 
diff --git a/lib/keystone b/lib/keystone
index 3db3c8d4aa..936af6a5e1 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -50,6 +50,10 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
+KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
+KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
+KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
+KEYSTONE_ADMIN_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-admin
 
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 # Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
@@ -293,44 +297,9 @@ function configure_keystone {
         _config_keystone_apache_wsgi
     else # uwsgi
         # iniset creates these files when it's called if they don't exist.
-        KEYSTONE_PUBLIC_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-        KEYSTONE_ADMIN_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
-
-        rm -f "$KEYSTONE_PUBLIC_UWSGI_FILE"
-        rm -f "$KEYSTONE_ADMIN_UWSGI_FILE"
-
-        if is_ssl_enabled_service key; then
-            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi https $KEYSTONE_SERVICE_HOST:$service_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
-            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi https $KEYSTONE_ADMIN_BIND_HOST:$auth_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
-        else
-            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi http $KEYSTONE_SERVICE_HOST:$service_port
-            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi http $KEYSTONE_ADMIN_BIND_HOST:$auth_port
-        fi
 
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi processes $(nproc)
-
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi processes $API_WORKERS
-
-        # Common settings
-        for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do
-            # This is running standalone
-            iniset "$file" uwsgi master true
-            # Set die-on-term & exit-on-reload so that uwsgi shuts down
-            iniset "$file" uwsgi die-on-term true
-            iniset "$file" uwsgi exit-on-reload true
-            iniset "$file" uwsgi enable-threads true
-            iniset "$file" uwsgi plugins python
-            # uwsgi recommends this to prevent thundering herd on accept.
-            iniset "$file" uwsgi thunder-lock true
-            # Override the default size for headers from the 4k default.
-            iniset "$file" uwsgi buffer-size 65535
-            # Make sure the client doesn't try to re-use the connection.
-            iniset "$file" uwsgi add-header "Connection: close"
-            # This ensures that file descriptors aren't shared between processes.
-            iniset "$file" uwsgi lazy-apps true
-        done
+        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "$KEYSTONE_SERVICE_HOST:$service_port"
+        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin" "$KEYSTONE_ADMIN_BIND_HOST:$auth_port"
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -604,8 +573,8 @@ function start_keystone {
         # TODO(sdague): we should really get down to a single keystone here
         enable_service key-p
         enable_service key-a
-        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_FILE" ""
-        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_FILE" ""
+        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
+        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."

From f3b2f4c85307b14f115a020f5eaf6c92026b55b4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 10:11:48 -0400
Subject: [PATCH 1851/3333] Remove USE_SSL support

tls-proxy is the way we're now doing a standard install using https
between services. There is a lot more work to make services directly
handle https, and having python daemons do that directly is a bit of
an anti pattern. Nothing currently tests this in project-config from
my recent grepping, so in the interest of long term maintenance,
delete it all.

Change-Id: I910df4ceab6f24f3d9c484e0433c93b06f17d6e1
---
 lib/cinder         | 20 ++------------------
 lib/glance         | 17 +++--------------
 lib/keystone       | 17 +----------------
 lib/neutron        | 21 +++------------------
 lib/neutron-legacy | 17 +----------------
 lib/nova           | 24 +++---------------------
 lib/placement      | 11 +----------
 lib/swift          |  9 +--------
 lib/tempest        |  2 +-
 lib/tls            | 25 ++++++-------------------
 stack.sh           | 11 ++---------
 stackrc            |  3 ---
 unstack.sh         |  3 ---
 13 files changed, 24 insertions(+), 156 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index c17cea06c7..ac61537c41 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -58,7 +58,7 @@ CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
 # Public facing bits
-if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     CINDER_SERVICE_PROTOCOL="https"
 fi
 CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
@@ -215,11 +215,6 @@ function _cinder_config_apache_wsgi {
     local cinder_api_port=$CINDER_SERVICE_PORT
     local venv_path=""
 
-    if is_ssl_enabled_service c-api; then
-        cinder_ssl="SSLEngine On"
-        cinder_certfile="SSLCertificateFile $CINDER_SSL_CERT"
-        cinder_keyfile="SSLCertificateKeyFile $CINDER_SSL_KEY"
-    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["cinder"]}/lib/python2.7/site-packages"
     fi
@@ -347,7 +342,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
     iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
-    if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
@@ -356,14 +351,6 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_api_version 2
     fi
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service cinder; then
-        ensure_certificates CINDER
-
-        iniset $CINDER_CONF DEFAULT ssl_cert_file "$CINDER_SSL_CERT"
-        iniset $CINDER_CONF DEFAULT ssl_key_file "$CINDER_SSL_KEY"
-    fi
-
     # Set os_privileged_user credentials (used for os-assisted-snapshots)
     iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
@@ -464,9 +451,6 @@ function install_cinder {
 
     if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
-        if is_ssl_enabled_service "c-api"; then
-            enable_mod_ssl
-        fi
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index 2f4aa5f0f8..23a1cbf2c7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -57,7 +57,7 @@ GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
-if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
 fi
 
@@ -187,18 +187,7 @@ function configure_glance {
         iniset $GLANCE_REGISTRY_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
     fi
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service glance; then
-        ensure_certificates GLANCE
-
-        iniset $GLANCE_API_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-        iniset $GLANCE_API_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-
-        iniset $GLANCE_REGISTRY_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-        iniset $GLANCE_REGISTRY_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-    fi
-
-    if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT registry_client_protocol https
     fi
 
@@ -233,7 +222,7 @@ function configure_glance {
 
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR
 
-    if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
         CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 
diff --git a/lib/keystone b/lib/keystone
index 936af6a5e1..45ba2c5352 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -116,7 +116,7 @@ SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
 SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols
-if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     KEYSTONE_AUTH_PROTOCOL="https"
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
@@ -171,12 +171,6 @@ function _config_keystone_apache_wsgi {
     local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
-    if is_ssl_enabled_service key; then
-        keystone_ssl_listen=""
-        keystone_ssl="SSLEngine On"
-        keystone_certfile="SSLCertificateFile $KEYSTONE_SSL_CERT"
-        keystone_keyfile="SSLCertificateKeyFile $KEYSTONE_SSL_KEY"
-    fi
     if is_service_enabled tls-proxy; then
         keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
         keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
@@ -247,11 +241,6 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service key; then
-        ensure_certificates KEYSTONE
-    fi
-
     local service_port=$KEYSTONE_SERVICE_PORT
     local auth_port=$KEYSTONE_AUTH_PORT
 
@@ -297,7 +286,6 @@ function configure_keystone {
         _config_keystone_apache_wsgi
     else # uwsgi
         # iniset creates these files when it's called if they don't exist.
-
         write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "$KEYSTONE_SERVICE_HOST:$service_port"
         write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin" "$KEYSTONE_ADMIN_BIND_HOST:$auth_port"
     fi
@@ -546,9 +534,6 @@ function install_keystone {
 
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         install_apache_wsgi
-        if is_ssl_enabled_service "key"; then
-            enable_mod_ssl
-        fi
     elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
         pip_install uwsgi
     fi
diff --git a/lib/neutron b/lib/neutron
index dd914664ae..492a0ee8fb 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -61,7 +61,7 @@ NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
 NEUTRON_METERING_BINARY=${NEUTRON_METERING_BINARY:-neutron-metering-agent}
 
 # Public facing bits
-if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     NEUTRON_SERVICE_PROTOCOL="https"
 fi
 NEUTRON_SERVICE_HOST=${NEUTRON_SERVICE_HOST:-$SERVICE_HOST}
@@ -243,14 +243,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
     fi
 
-    if is_ssl_enabled_service "neutron"; then
-        ensure_certificates NEUTRON
-
-        iniset $NEUTRON_CONF DEFAULT use_ssl True
-        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
-        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
-    fi
-
     # Metering
     if is_service_enabled neutron-metering; then
         cp $NEUTRON_DIR/etc/metering_agent.ini.sample $NEUTRON_METERING_AGENT_CONF
@@ -404,17 +396,10 @@ function start_neutron_api {
     # TODO(sc68cal) Stop hard coding this
     run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
 
-    if is_ssl_enabled_service "neutron"; then
-        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
-        local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$NEUTRON_SERVICE_HOST:$service_port"
-        test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
-    else
-        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
-            die $LINENO "neutron-api did not start"
-        fi
+    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
+        die $LINENO "neutron-api did not start"
     fi
 
-
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 74f36e0ce3..1dfd5fec7d 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -61,7 +61,7 @@
 
 deprecated "Using lib/neutron-legacy is deprecated, and it will be removed in the future"
 
-if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
@@ -461,9 +461,6 @@ function start_neutron_service_and_check {
     # Start the Neutron service
     run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
     echo "Waiting for Neutron to start..."
-    if is_ssl_enabled_service "neutron"; then
-        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
-    fi
 
     local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port"
     test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
@@ -714,18 +711,6 @@ function _configure_neutron_common {
         iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
     fi
 
-    if is_ssl_enabled_service "nova"; then
-        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "neutron"; then
-        ensure_certificates NEUTRON
-
-        iniset $NEUTRON_CONF DEFAULT use_ssl True
-        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
-        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
-    fi
-
     _neutron_setup_rootwrap
 }
 
diff --git a/lib/nova b/lib/nova
index a36a740265..cba9acdd79 100644
--- a/lib/nova
+++ b/lib/nova
@@ -68,7 +68,7 @@ fi
 # Toggle for deploying Nova-API under HTTPD + mod_wsgi
 NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
 
-if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
 fi
 
@@ -262,11 +262,6 @@ function _config_nova_apache_wsgi {
     local nova_metadata_port=$METADATA_SERVICE_PORT
     local venv_path=""
 
-    if is_ssl_enabled_service nova-api; then
-        nova_ssl="SSLEngine On"
-        nova_certfile="SSLCertificateFile $NOVA_SSL_CERT"
-        nova_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
-    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
     fi
@@ -501,7 +496,7 @@ function create_nova_conf {
     fi
 
     if is_service_enabled cinder; then
-        if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+        if is_service_enabled tls-proxy; then
             CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
             CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
             iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
@@ -586,20 +581,10 @@ function create_nova_conf {
 
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
 
-    if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
     fi
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service nova; then
-        ensure_certificates NOVA
-
-        iniset $NOVA_CONF DEFAULT ssl_cert_file "$NOVA_SSL_CERT"
-        iniset $NOVA_CONF DEFAULT ssl_key_file "$NOVA_SSL_KEY"
-
-        iniset $NOVA_CONF DEFAULT enabled_ssl_apis "$NOVA_ENABLED_APIS"
-    fi
-
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
@@ -790,9 +775,6 @@ function install_nova {
 
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
-        if is_ssl_enabled_service "nova-api"; then
-            enable_mod_ssl
-        fi
     fi
 }
 
diff --git a/lib/placement b/lib/placement
index 4cc5cd8b6a..a29784b93c 100644
--- a/lib/placement
+++ b/lib/placement
@@ -40,7 +40,7 @@ PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
 # yet merged in nova but is coming soon.
 PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
 
-if is_ssl_enabled_service "placement-api" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     PLACEMENT_SERVICE_PROTOCOL="https"
 fi
 
@@ -72,12 +72,6 @@ function _config_placement_apache_wsgi {
     nova_bin_dir=$(get_python_exec_prefix)
     placement_api_apache_conf=$(apache_site_config_for placement-api)
 
-    # reuse nova's cert if a cert is being used
-    if is_ssl_enabled_service "placement-api"; then
-        placement_ssl="SSLEngine On"
-        placement_certfile="SSLCertificateFile $NOVA_SSL_CERT"
-        placement_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
-    fi
     # reuse nova's venv if there is one as placement code lives
     # there
     if [[ ${USE_VENV} = True ]]; then
@@ -149,9 +143,6 @@ function init_placement {
 # install_placement() - Collect source and prepare
 function install_placement {
     install_apache_wsgi
-    if is_ssl_enabled_service "placement-api"; then
-        enable_mod_ssl
-    fi
 }
 
 # start_placement_api() - Start the API processes ahead of other things
diff --git a/lib/swift b/lib/swift
index 5eac904559..d764b25fdb 100644
--- a/lib/swift
+++ b/lib/swift
@@ -31,7 +31,7 @@ set +o xtrace
 # Defaults
 # --------
 
-if is_ssl_enabled_service "s-proxy" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     SWIFT_SERVICE_PROTOCOL="https"
 fi
 
@@ -398,13 +398,6 @@ function configure_swift {
         iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT}
     fi
 
-    if is_ssl_enabled_service s-proxy; then
-        ensure_certificates SWIFT
-
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT cert_file "$SWIFT_SSL_CERT"
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT key_file "$SWIFT_SSL_KEY"
-    fi
-
     # DevStack is commonly run in a small slow environment, so bump the timeouts up.
     # ``node_timeout`` is the node read operation response time to the proxy server
     # ``conn_timeout`` is how long it takes a connect() system call to return
diff --git a/lib/tempest b/lib/tempest
index f6fc57dc72..04f8f6a3f6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -279,7 +279,7 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
 
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
diff --git a/lib/tls b/lib/tls
index fb2fa3a17b..c2c92a1bae 100644
--- a/lib/tls
+++ b/lib/tls
@@ -343,7 +343,7 @@ function make_root_CA {
 # one. If the value for the CA is not rooted in /etc then we know
 # we need to change it.
 function fix_system_ca_bundle_path {
-    if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+    if is_service_enabled tls-proxy; then
         local capath
         capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
 
@@ -362,27 +362,14 @@ function fix_system_ca_bundle_path {
 }
 
 
-# Certificate Input Configuration
-# ===============================
-
-# check to see if the service(s) specified are to be SSL enabled.
-#
-# Multiple services specified as arguments are ``OR``'ed together; the test
-# is a short-circuit boolean, i.e it returns on the first match.
-#
-# Uses global ``SSL_ENABLED_SERVICES``
+# Only for compatibility, return if the tls-proxy is enabled
 function is_ssl_enabled_service {
-    local services=$@
-    local service=""
-    if [ "$USE_SSL" == "False" ]; then
-        return 1
-    fi
-    for service in ${services}; do
-        [[ ,${SSL_ENABLED_SERVICES}, =~ ,${service}, ]] && return 0
-    done
-    return 1
+    return is_service_enabled tls-proxy
 }
 
+# Certificate Input Configuration
+# ===============================
+
 # Ensure that the certificates for a service are in place. This function does
 # not check that a service is SSL enabled, this should already have been
 # completed.
diff --git a/stack.sh b/stack.sh
index 759a8dbacc..635a328190 100755
--- a/stack.sh
+++ b/stack.sh
@@ -539,13 +539,6 @@ rm -f $SSL_BUNDLE_FILE
 source $TOP_DIR/lib/database
 source $TOP_DIR/lib/rpc_backend
 
-# Service to enable with SSL if ``USE_SSL`` is True
-SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron"
-
-if is_service_enabled tls-proxy && [ "$USE_SSL" == "True" ]; then
-    die $LINENO "tls-proxy and SSL are mutually exclusive"
-fi
-
 # Configure Projects
 # ==================
 
@@ -806,7 +799,7 @@ if is_service_enabled cinder nova; then
 fi
 
 # Setup TLS certs
-if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+if is_service_enabled tls-proxy; then
     configure_CA
     init_CA
     init_cert
@@ -886,7 +879,7 @@ if is_service_enabled horizon; then
     stack_install_service horizon
 fi
 
-if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
 fi
 
diff --git a/stackrc b/stackrc
index 88f75413c4..3ceb78c0d6 100644
--- a/stackrc
+++ b/stackrc
@@ -846,9 +846,6 @@ SYSLOG_PORT=${SYSLOG_PORT:-516}
 # Set to 0 to disable shallow cloning
 GIT_DEPTH=${GIT_DEPTH:-0}
 
-# Use native SSL for servers in ``SSL_ENABLED_SERVICES``
-USE_SSL=$(trueorfalse False USE_SSL)
-
 # We may not need to recreate database in case 2 Keystone services
 # sharing the same database. It would be useful for multinode Grenade tests.
 RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
diff --git a/unstack.sh b/unstack.sh
index b0ebaf725e..485fed7f80 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -129,9 +129,6 @@ if is_service_enabled tls-proxy; then
     stop_tls_proxy
     cleanup_CA
 fi
-if [ "$USE_SSL" == "True" ]; then
-    cleanup_CA
-fi
 
 SCSI_PERSIST_DIR=$CINDER_STATE_PATH/volumes/*
 

From a1446b960fa7c21bc1e7141921d6fc95c6e212d2 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 17 Apr 2017 14:31:21 -0400
Subject: [PATCH 1852/3333] always retry proxy errors

When an apache worker gets a proxy error, it will not retry talking to
the backend server until the retry timeout expires. We bring up the
proxy server *before* the backend server, and poll it. If we are
running a small number of workers, there is a likely chance that we're
going to hit one that errored before the backend was up, thus failing
for now real reason.

Set this to 0 instead to mean always retry failed connections.

Change-Id: I9e584f087bd375f71ddf0c70f83205c425094a17
Ref: https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypass
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index c2c92a1bae..7a7b10454e 100644
--- a/lib/tls
+++ b/lib/tls
@@ -512,7 +512,7 @@ $listen_string
     KeepAlive Off
 
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
+        ProxyPass http://$b_host:$b_port/ retry=0 nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 604e598e2abca37c84d6cd3c84ad8fa5295fb327 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 13:28:12 -0400
Subject: [PATCH 1853/3333] Install and enable apache uwsgi proxy

The uwsgi proxy version that comes with Ubuntu xenial is too old, so
we have to build it from source. This is a temporary solution until
the next LTS.

This lays the ground work for using it in keystone.

Change-Id: I00fb1759e6988c7df0ce0f3df5ff1ce9fd7cd381
---
 lib/apache | 42 ++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |  3 +++
 2 files changed, 45 insertions(+)

diff --git a/lib/apache b/lib/apache
index fc73b49912..9fed1003a4 100644
--- a/lib/apache
+++ b/lib/apache
@@ -66,6 +66,48 @@ function enable_apache_mod {
     fi
 }
 
+# NOTE(sdague): Install uwsgi including apache module, we need to get
+# to 2.0.6+ to get a working mod_proxy_uwsgi. We can probably build a
+# check for that and do it differently for different platforms.
+function install_apache_uwsgi {
+    local apxs="apxs2"
+    if is_fedora; then
+        apxs="apxs"
+    fi
+
+    # Ubuntu xenial is back level on uwsgi so the proxy doesn't
+    # actually work. Hence we have to build from source for now.
+    #
+    # Centos 7 actually has the module in epel, but there was a big
+    # push to disable epel by default. As such, compile from source
+    # there as well.
+
+    local dir
+    dir=$(mktemp -d)
+    pushd $dir
+    pip_install uwsgi
+    pip download uwsgi -c $REQUIREMENTS_DIR/upper-constraints.txt
+    local uwsgi
+    uwsgi=$(ls uwsgi*)
+    tar xvf $uwsgi
+    cd uwsgi*/apache2
+    sudo $apxs -i -c mod_proxy_uwsgi.c
+    popd
+    # delete the temp directory
+    sudo rm -rf $dir
+
+    if is_ubuntu; then
+        # we've got to enable proxy and proxy_uwsgi for this to work
+        sudo a2enmod proxy
+        sudo a2enmod proxy_uwsgi
+    elif is_fedora; then
+        # redhat is missing a nice way to turn on/off modules
+        echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
+            | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
+    fi
+    restart_apache_server
+}
+
 # install_apache_wsgi() - Install Apache server and wsgi module
 function install_apache_wsgi {
     # Apache installation, because we mark it NOPRIME
diff --git a/stack.sh b/stack.sh
index 635a328190..e12b3fe06e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -780,6 +780,9 @@ echo_summary "Installing OpenStack project source"
 # Install Oslo libraries
 install_oslo
 
+# Install uwsgi
+install_apache_uwsgi
+
 # Install client libraries
 install_keystoneauth
 install_keystoneclient

From 64ffff9b7d79b9e75616cf43f9f7b31c89026f30 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 13:36:42 -0400
Subject: [PATCH 1854/3333] Convert placement to new uwsgi mode

This converts the placement API to use the new WSGI_MODE variable
(which is not introduced until the next changeset). We do this so that
placement and keystone patches can be reviewed independently, but
there are some hidden coupling of mod_wsgi setup which happens only in
keystone, so if we do keystone first, it breaks placement.

Change-Id: Id5b2c67701bcc7b12c8e3764c7199d10f85df80f
---
 lib/placement | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/lib/placement b/lib/placement
index a29784b93c..fd09cd8c4e 100644
--- a/lib/placement
+++ b/lib/placement
@@ -32,7 +32,15 @@ set +o xtrace
 PLACEMENT_CONF_DIR=/etc/nova
 PLACEMENT_CONF=$PLACEMENT_CONF_DIR/nova.conf
 PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
-
+# Nova virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["nova"]=${NOVA_DIR}.venv
+    PLACEMENT_BIN_DIR=${PROJECT_VENV["nova"]}/bin
+else
+    PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
+fi
+PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/nova-placement-api
+PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 # The placement service can optionally use a separate database
 # connection. Set PLACEMENT_DB_ENABLED to True to use it.
@@ -114,7 +122,13 @@ function configure_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
     fi
-    _config_placement_apache_wsgi
+    # TODO(sdague): this really should flag off of something else, but
+    # it won't really work without systemd today.
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
+    else
+        _config_placement_apache_wsgi
+    fi
 }
 
 # create_placement_accounts() - Set up required placement accounts
@@ -147,9 +161,13 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    enable_apache_site placement-api
-    restart_apache_server
-    tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --ini $PLACEMENT_UWSGI_CONF"
+    else
+        enable_apache_site placement-api
+        restart_apache_server
+        tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
+    fi
 
     echo "Waiting for placement-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
@@ -163,8 +181,13 @@ function start_placement {
 
 # stop_placement() - Disable the api service and stop it.
 function stop_placement {
-    disable_apache_site placement-api
-    restart_apache_server
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        stop_process "placement-api"
+        remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
+    else
+        disable_apache_site placement-api
+        restart_apache_server
+    fi
 }
 
 # Restore xtrace

From 6ed53156b6198e69d59d1cf3a3497e96f5b7a870 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 13:33:16 -0400
Subject: [PATCH 1855/3333] Convert keystone to use uwsgi with the proxy

This makes keystone use the proxy uwsgi module when running in uwsgi
mode. It also introduces a new stackrc variable which is WSGI_MODE
that we can use to control the conditionals in services that current
work with mod_wsgi.

Also update retry timeouts on proxy pass so that workers don't disable
their connections during polling for initial activity.

Change-Id: I46294fb24e3c23fa19fcfd7d6c9ee8a932354702
---
 lib/apache   |  2 +-
 lib/keystone | 56 +++++++++++++++++++++-------------------------------
 openrc       |  4 +---
 stackrc      |  6 ++++++
 4 files changed, 30 insertions(+), 38 deletions(-)

diff --git a/lib/apache b/lib/apache
index 9fed1003a4..20700d802f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -260,7 +260,7 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\"" | sudo tee $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
         enable_apache_site $name
         reload_apache_server
     fi
diff --git a/lib/keystone b/lib/keystone
index 45ba2c5352..a26ef8afd2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -55,21 +55,13 @@ KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
 KEYSTONE_ADMIN_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-admin
 
-# Toggle for deploying Keystone under HTTPD + mod_wsgi
-# Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
-KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
-
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
 # - uwsgi : Run keystone under uwsgi
-if [ -z "$KEYSTONE_DEPLOY" ]; then
-    if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
-        KEYSTONE_DEPLOY=mod_wsgi
-    elif [ "$KEYSTONE_USE_MOD_WSGI" == True ]; then
-        KEYSTONE_DEPLOY=mod_wsgi
-    else
-        KEYSTONE_DEPLOY=uwsgi
-    fi
+if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    KEYSTONE_DEPLOY=uwsgi
+else
+    KEYSTONE_DEPLOY=mod_wsgi
 fi
 
 # Select the token persistence backend driver
@@ -121,15 +113,8 @@ if is_service_enabled tls-proxy; then
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
 
-# complete URIs
-if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-    # If running in Apache, use path access rather than port.
-    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
-    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
-else
-    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
-    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
-fi
+KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
+KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
 
 # V3 URIs
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
@@ -155,8 +140,15 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    disable_apache_site keystone
-    sudo rm -f $(apache_site_config_for keystone)
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
+        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
+        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
+    else
+        disable_apache_site keystone
+        sudo rm -f $(apache_site_config_for keystone)
+    fi
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
@@ -256,10 +248,8 @@ function configure_keystone {
     # work when you want to use a different port (in the case of proxy), or you
     # don't want the port (in the case of putting keystone on a path in
     # apache).
-    if is_service_enabled tls-proxy || [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
-        iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
-    fi
+    iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
+    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
@@ -285,9 +275,8 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
     else # uwsgi
-        # iniset creates these files when it's called if they don't exist.
-        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "$KEYSTONE_SERVICE_HOST:$service_port"
-        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin" "$KEYSTONE_ADMIN_BIND_HOST:$auth_port"
+        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
+        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin"
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -568,10 +557,7 @@ function start_keystone {
     # unencryted traffic at this point.
     # If running in Apache, use the path rather than port.
 
-    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
-    fi
+    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
@@ -595,6 +581,8 @@ function stop_keystone {
     else
         stop_process key-p
         stop_process key-a
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
     fi
     # Kill the Keystone screen window
     stop_process key
diff --git a/openrc b/openrc
index 483b5af387..4cdb50efef 100644
--- a/openrc
+++ b/openrc
@@ -73,8 +73,6 @@ else
 fi
 
 SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
-KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
-KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
@@ -84,7 +82,7 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 # the user/project has access to - including nova, glance, keystone, swift, ...
 # We currently recommend using the version 3 *identity api*.
 #
-export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
+export OS_AUTH_URL=$KEYSTONE_AUTH_URI
 
 # Currently, in order to use openstackclient with Identity API v3,
 # we need to set the domain which the user and project belong to.
diff --git a/stackrc b/stackrc
index 3ceb78c0d6..adcb9426ea 100644
--- a/stackrc
+++ b/stackrc
@@ -225,6 +225,12 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # Zero disables timeouts
 GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 
+# How should we be handling WSGI deployments. By default we're going
+# to allow for 2 modes, which is "uwsgi" which runs with an apache
+# proxy uwsgi in front of it, or "mod_wsgi", which runs in
+# apache. mod_wsgi is deprecated, don't use it.
+WSGI_MODE=${WSGI_MODE:-"uwsgi"}
+
 # Repositories
 # ------------
 

From 921da2654bfece3d5352d42e8f92b57cac21b9cd Mon Sep 17 00:00:00 2001
From: Prabhuraj Kamaraj <k.prabhuraj@ericsson.com>
Date: Tue, 18 Apr 2017 05:11:52 +0000
Subject: [PATCH 1856/3333] Adding placement-client to compute node local.conf
 for multinode setup

Change-Id: Ie98f908d5a932da259ae13934af45d535fcffb82
Closes-Bug: #1682362
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 484ebba571..1a8ddbc194 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -175,7 +175,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol
+    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol,placement-client
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP

From e0be9e3a2e527754a72d6282883370c09159fac1 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 18 Apr 2017 16:52:25 +0100
Subject: [PATCH 1857/3333] Remove a TODO that no longer applies

The removed TODO was talking about USE_SYSTEMD, not WSGI_MODE.

WSGI_MODE makes sense, so the TODO has been done.

Change-Id: Ib574ef123ea4c82d4d88012c990cd1ad660d7879
---
 lib/placement | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index fd09cd8c4e..4755a58bf2 100644
--- a/lib/placement
+++ b/lib/placement
@@ -122,8 +122,7 @@ function configure_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
     fi
-    # TODO(sdague): this really should flag off of something else, but
-    # it won't really work without systemd today.
+
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
     else

From 2fcdaac56e20f1002ae76c6ae1b30a093452d21b Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 18 Apr 2017 16:54:12 +0100
Subject: [PATCH 1858/3333] Make a2dissite fail softly if the site is not
 enabled

a2dissite will return a non-zero error code if the site that is being
disabled is not currently enabled (that is, if the conf file for it does
not exist). This can happen during development if you've been messing
with files by hand. Rather than exploding out of a ./stack.sh, accept
the missing file as meaning "it's disabled" and carry one. The rpm
version of disable, which does not use a2dissite, does this already.

Change-Id: Ie5dfd42efdff4bdba5ffaa765af000dd8e1d596e
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 20700d802f..f88f1d3504 100644
--- a/lib/apache
+++ b/lib/apache
@@ -186,7 +186,7 @@ function enable_apache_site {
 function disable_apache_site {
     local site=$@
     if is_ubuntu; then
-        sudo a2dissite ${site}
+        sudo a2dissite ${site} || true
     elif is_fedora || is_suse; then
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         # Do nothing if no site config exists

From 0effa1a6cb6960b0d1cf82087e6d60c066b7a5f6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 18 Apr 2017 15:16:37 -0400
Subject: [PATCH 1859/3333] remove some unused *_PROTOCOL from export

Things like SERVICE_PROTOCOL and KEYSTONE_AUTH_PROTOCOL shouldn't
really be exported in openrc as they encourage using them directly to
build up keystone urls instead of actually using the OS_AUTH_URL.

Remove them.

Change-Id: I4b7cc680f7f14dae29b706a227be540c9e212cad
---
 functions-common | 4 ++--
 openrc           | 2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 90c92000b3..56dd20307f 100644
--- a/functions-common
+++ b/functions-common
@@ -48,8 +48,8 @@ TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
-    KEYSTONE_AUTH_PROTOCOL KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
-    LOGFILE OS_CACERT SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP \
+    KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
+    LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
     HOST_IPV6 SERVICE_IP_VERSION"
 
 
diff --git a/openrc b/openrc
index 4cdb50efef..828cab3c6d 100644
--- a/openrc
+++ b/openrc
@@ -72,8 +72,6 @@ else
     GLANCE_HOST=${GLANCE_HOST:-$HOST_IP}
 fi
 
-SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
-
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 

From f43ea4776668e259b3053e0c1d4b7d13685f424d Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 18 Apr 2017 21:51:57 -0700
Subject: [PATCH 1860/3333] Send useful auth_port and auth_prefix to swift's
 test.conf

Until we can test with a version of swiftclient that knows how to eat
auth_uri, swift still needs a working gate.

Change-Id: I09f9ad5c87b542df962a79898e06fbf1e968b1e3
Related-Change: I46294fb24e3c23fa19fcfd7d6c9ee8a932354702
Related-Change: Ie427f3b0b9eb834ff940fa5d52444a5a6cdcab15
---
 lib/swift | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/swift b/lib/swift
index d764b25fdb..8b75fcc505 100644
--- a/lib/swift
+++ b/lib/swift
@@ -530,12 +530,16 @@ EOF
         local auth_vers
         auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
-        iniset ${testfile} func_test auth_port ${KEYSTONE_AUTH_PORT}
+        if [[ "$KEYSTONE_AUTH_PROTOCOL" == "https" ]]; then
+            iniset ${testfile} func_test auth_port 443
+        else
+            iniset ${testfile} func_test auth_port 80
+        fi
         iniset ${testfile} func_test auth_uri ${KEYSTONE_AUTH_URI}
-        if [[ $auth_vers == "3" ]]; then
-            iniset ${testfile} func_test auth_prefix /v3/
+        if [[ "$auth_vers" == "3" ]]; then
+            iniset ${testfile} func_test auth_prefix /identity/v3/
         else
-            iniset ${testfile} func_test auth_prefix /v2.0/
+            iniset ${testfile} func_test auth_prefix /identity/v2.0/
         fi
     fi
 

From 09a08aacf4235b673de948278aa3cbfdc6cbbdc0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 19 Apr 2017 09:24:43 +0000
Subject: [PATCH 1861/3333] Updated from generate-devstack-plugins-list

Change-Id: If6c07fd6b56d776a5548564b72e637f6bd3dfbfc
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index beb6abbb9e..96a2733690 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -44,6 +44,7 @@ devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devsta
 devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
 devstack-plugin-bdd                    `git://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
 devstack-plugin-ceph                   `git://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
+devstack-plugin-container              `git://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
 devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
 devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
 devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
@@ -86,6 +87,7 @@ meteos-ui                              `git://git.openstack.org/openstack/meteos
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
+mogan-ui                               `git://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__

From 37c7843aad745fcde7584777e8a7ec896bb154e2 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 19 Apr 2017 13:19:21 -0400
Subject: [PATCH 1862/3333] Increase rsyslog buffer sizes.

Swift proxy logs to syslog during the devstack-gate tempest runs. To
better capture the swift logs increase the rsyslog buffer size to 6k
bytes allowing for longer messages like tracebacks.

This was setup by openstack-infra previous during our diskimage
builds.

  I03e42964e14d9f930c07ed047851bdf775639c59

Change-Id: Iaa232335865410600c93f47d4777ed4f1bce08e2
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 8b75fcc505..16f398a613 100644
--- a/lib/swift
+++ b/lib/swift
@@ -554,6 +554,7 @@ EOF
     if [[ $SYSLOG != "False" ]]; then
         sed "s,%SWIFT_LOGDIR%,${swift_log_dir}," $FILES/swift/rsyslog.conf | sudo \
             tee /etc/rsyslog.d/10-swift.conf
+        echo "MaxMessageSize 6k" | sudo tee /etc/rsyslog.d/99-maxsize.conf
         # restart syslog to take the changes
         sudo killall -HUP rsyslogd
     fi

From 1b245cef7f078139f95260b080558422063f363f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Apr 2017 15:51:52 -0400
Subject: [PATCH 1863/3333] Cleanup duplicate get_or_add_user_domain_role

It turns out that we ended up with duplicate versions of this function
merging on top of each other within 3 days, and gerrit didn't catch
it. Boo gerrit. Boo bash.

Change-Id: Ic6aa2f9bafdec906de2bc51d5929beeec48a6a40
---
 functions-common | 28 ----------------------------
 1 file changed, 28 deletions(-)

diff --git a/functions-common b/functions-common
index 90c92000b3..35b48603c5 100644
--- a/functions-common
+++ b/functions-common
@@ -905,34 +905,6 @@ function get_or_add_user_domain_role {
     echo $user_role_id
 }
 
-# Gets or adds user role to domain
-# Usage: get_or_add_user_domain_role <role> <user> <domain>
-function get_or_add_user_domain_role {
-    local user_role_id
-    # Gets user role id
-    user_role_id=$(openstack role assignment list \
-        --user $2 \
-        --os-url=$KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
-        --domain $3 \
-        | grep " $1 " | get_field 1)
-    if [[ -z "$user_role_id" ]]; then
-        # Adds role to user and get it
-        openstack role add $1 \
-            --user $2 \
-            --domain $3 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3
-        user_role_id=$(openstack role assignment list \
-            --user $2 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
-            --domain $3 \
-            | grep " $1 " | get_field 1)
-    fi
-    echo $user_role_id
-}
-
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {

From 9bfabc68c4ff2094ed8463b11382d6982743b768 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 20 Apr 2017 15:11:43 -0400
Subject: [PATCH 1864/3333] Make openrc more robust for grenade scenarios

This makes openrc more robust for the grenade scenarios by having a
sane fallback when stackrc is not found.

Change-Id: I297ba519d581d2b6fb4d80d59434acace054bada
---
 openrc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/openrc b/openrc
index 4cdb50efef..b748055be1 100644
--- a/openrc
+++ b/openrc
@@ -82,7 +82,12 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 # the user/project has access to - including nova, glance, keystone, swift, ...
 # We currently recommend using the version 3 *identity api*.
 #
-export OS_AUTH_URL=$KEYSTONE_AUTH_URI
+
+# If you don't have a working .stackenv, this is the backup possition
+KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
+KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_URI:-$KEYSTONE_BACKUP}
+
+export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_AUTH_URI}
 
 # Currently, in order to use openstackclient with Identity API v3,
 # we need to set the domain which the user and project belong to.

From ef1e88ec09bda30cad19589629744b59e12b4093 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Thu, 20 Apr 2017 23:37:32 +0100
Subject: [PATCH 1865/3333] Enable ssh validation by default

The -ssh job with ssh validation enabled has been quite stable
for a while now [0] so I think it's time to add ssh validation
to the integration gate to prevent regressions from lurking in.

Doing this in devstack ensures that the change only affects
master as we didn't test ssh validation on on stable branches.

[0] http://status.openstack.org/openstack-health/#/g/build_name/gate-tempest-dsvm-neutron-full-ssh?duration=P3M

Change-Id: I187e560911f5d5d482eb7959e5174068c4c9a801
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cf7eb6f722..1640f2c21a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -425,7 +425,7 @@ function configure_tempest {
         TEMPEST_SSH_NETWORK_NAME=$PHYSICAL_NETWORK
     fi
     # Validation
-    iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
+    iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-True}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
     iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}

From aa26baacb8206967d61aef74686be94e3f8c90b8 Mon Sep 17 00:00:00 2001
From: rabi <ramishra@redhat.com>
Date: Thu, 20 Apr 2017 10:55:16 +0530
Subject: [PATCH 1866/3333] Create custom dir for uwsgi domain sockets

On Centos, apache has a private view of /tmp and thus can't see this
socket, causing keystone to fail. This happened after
I46294fb24e3c23fa19fcfd7d6c9ee8a932354702.

Move it to /var/run.

Closes-Bug: #1684360
Change-Id: I47f091656802719c259752454ec88bf50760b967
---
 lib/apache | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index f88f1d3504..afeac158ca 100644
--- a/lib/apache
+++ b/lib/apache
@@ -230,7 +230,12 @@ function write_uwsgi_config {
     local http=$4
     local name=""
     name=$(basename $wsgi)
-    local socket="/tmp/${name}.socket"
+
+    # create a home for the sockets; note don't use /tmp -- apache has
+    # a private view of it on some platforms.
+    local socket_dir='/var/run/uwsgi'
+    sudo install -d -o $STACK_USER -m 755 $socket_dir
+    local socket="$socket_dir/${name}.socket"
 
     # always cleanup given that we are using iniset here
     rm -rf $file

From 26e431dbd76dff958f65871c852eb9d61d8d00d8 Mon Sep 17 00:00:00 2001
From: Thomas Herve <therve@redhat.com>
Date: Thu, 13 Apr 2017 14:27:35 +0200
Subject: [PATCH 1867/3333] Define a new function for notifications URL

This defines a new function get_notification_url, which returns the URL
of RabbitMQ when you want connect to it, and uses in
ceilometermiddleware. This fixes an issue when we try to use AMQP for
RPC, but not for notifications.

Change-Id: I14450b2440806a17a90e5ddefc243868fdbe4f2c
---
 lib/rpc_backend | 9 +++++++++
 lib/swift       | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3c1404e998..3177e88ef2 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -122,6 +122,15 @@ function get_transport_url {
     fi
 }
 
+# Repeat the definition, in case get_transport_url is overriden for RPC purpose.
+# get_notification_url can then be used to talk to rabbit for notifications.
+function get_notification_url {
+    local virtual_host=$1
+    if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
+        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/$virtual_host"
+    fi
+}
+
 # iniset configuration
 function iniset_rpc_backend {
     local package=$1
diff --git a/lib/swift b/lib/swift
index 96e2f03e5f..f3ff2412bd 100644
--- a/lib/swift
+++ b/lib/swift
@@ -419,7 +419,7 @@ function configure_swift {
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer paste.filter_factory "ceilometermiddleware.swift:filter_factory"
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer control_exchange "swift"
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer url $(get_transport_url)
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer url $(get_notification_url)
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer driver "messaging"
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer topic "notifications"
         SWIFT_EXTRAS_MIDDLEWARE_LAST="${SWIFT_EXTRAS_MIDDLEWARE_LAST} ceilometer"

From f6a2d2cd4edd06408690081d6207ff73b76f543a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 26 Apr 2017 10:50:29 +1000
Subject: [PATCH 1868/3333] Always restart apache

As described in [1], it seems that mod_wsgi is not "graceful" reload
safe.  Upon re-init, it can end up in a segfault loop.

The "reload" (not *restart*) after setting up uwsgi was added with
I1d89be1f1b36f26eaf543b99bde6fdc5701474fe but not causing an issue
until uwsgi was enabled.

We do not notice in the gate, because the TLS setup ends up doing a
restart after this setup.  In the period between the
write_uwsgi_config and that restart, Apache is sitting in a segfault
loop, but we never noticed because we don't try talking to it.  Other
jobs that don't do any further apache configuration have started
failing, however.

Looking at the original comments around "reload_apache_server" I'm not
sure if it is still necessary.  [2] shows it is not used outside these
two calls.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1445540
[2] http://codesearch.openstack.org/?q=reload_apache_server&i=nope&files=&repos=

Closes-Bug: #1686210
Change-Id: I5234bae0595efdcd30305a32bf9c121072a3625e
---
 lib/apache | 7 +------
 lib/tls    | 7 +------
 2 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/lib/apache b/lib/apache
index afeac158ca..34ac660266 100644
--- a/lib/apache
+++ b/lib/apache
@@ -218,11 +218,6 @@ function restart_apache_server {
     restart_service $APACHE_NAME
 }
 
-# reload_apache_server
-function reload_apache_server {
-    reload_service $APACHE_NAME
-}
-
 function write_uwsgi_config {
     local file=$1
     local wsgi=$2
@@ -267,7 +262,7 @@ function write_uwsgi_config {
         apache_conf=$(apache_site_config_for $name)
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
         enable_apache_site $name
-        reload_apache_server
+        restart_apache_server
     fi
 }
 
diff --git a/lib/tls b/lib/tls
index 7a7b10454e..238687c5dd 100644
--- a/lib/tls
+++ b/lib/tls
@@ -526,12 +526,7 @@ EOF
         enable_apache_mod $mod
     done
     enable_apache_site $b_service
-    # Only a reload is required to pull in new vhosts
-    # Note that a restart reliably fails on centos7 and trusty
-    # because apache can't open port 80 because the old apache
-    # still has it open. Using reload fixes trusty but centos7
-    # still doesn't work.
-    reload_apache_server
+    restart_apache_server
 }
 
 # Follow TLS proxy

From 92e6b1a0e83cbfeeb1d29bbe2b8c71e212f885fd Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Wed, 26 Apr 2017 13:40:42 +0200
Subject: [PATCH 1869/3333] default gateway regex: use exact match for iface
 name

If the current interface has a default gateway configured is
determined by the regex

  default.+<interface-name>

If for example 'enc1' is used, but also an interface 'enc1800' is
present, the regex will also match the 'enc1800' default gateway.

This patch fixes this by looking for <interface-name><white-space>.
This way 'enc1800' is not matched.

Change-Id: Id1d58f5be6296c3a37aef788359ae8fe0fe11d8b
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 1dfd5fec7d..a409164386 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -570,7 +570,7 @@ function _move_neutron_addresses_route {
         local IP_DEL=""
         local IP_UP=""
         local DEFAULT_ROUTE_GW
-        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
+        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf\s/ { print \$3; exit }")
         local ADD_OVS_PORT=""
         local DEL_OVS_PORT=""
         local ARP_CMD=""

From befe0925e7cb3d3b34ee9e856c4bc822a499975f Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 16 Feb 2017 15:45:11 -0500
Subject: [PATCH 1870/3333] Differentiate between DEFAULT_IMAGE_NAME and
 filename

The DEFAULT_IMAGE_NAME variable is used to reference the name of the
default image in glance after it has been uploaded by devstack. It is
used both inside and outside of devstack for that purpose. However, when
configuring tempest there are some tests which also do image uploads and
need a filename for specifying which file they should upload into glance
for testing purposes. Previously we were just using DEFAULT_IMAGE_NAME
for both purposes, but this causes a conflict if the name of the image
we upload into glance does not have a file extension. So instead of
conflating the things this commit differentiates between them and adds a
new DEFAULT_IMAGE_FILE_NAME variable to use for this purpose.

Change-Id: Icf74badcf2093d8c75db538232b10b3ac7b86eb8
---
 lib/tempest |  3 ++-
 stackrc     | 12 ++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 128e9728fe..69a2500a5d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -11,6 +11,7 @@
 #   - ``DEST``, ``FILES``
 #   - ``ADMIN_PASSWORD``
 #   - ``DEFAULT_IMAGE_NAME``
+#   - ``DEFAULT_IMAGE_FILE_NAME``
 #   - ``S3_SERVICE_PORT``
 #   - ``SERVICE_HOST``
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
@@ -412,7 +413,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG scenario img_container_format ovf
     else
         SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
-        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_NAME
+        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
     fi
     iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
diff --git a/stackrc b/stackrc
index 97819d712b..399e45ee28 100644
--- a/stackrc
+++ b/stackrc
@@ -640,17 +640,21 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             case "$LIBVIRT_TYPE" in
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz";;
+                    DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
-                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
+                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
+                    DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
-            IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/cirros-0.3.2-i386-disk.vmdk";;
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-$DEFAULT_IMAGE_NAME}
+            IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/${DEFAULT_IMAGE_FILE_NAME}";;
         xenserver)
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk.vhd.tgz}
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
     esac

From 71d20e6582e07a4567abc785e7237872574b6ac8 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 21 Apr 2017 11:48:12 +1000
Subject: [PATCH 1871/3333] Always disable use of libvirt wheel with UCA

It's not only using our upstream caches that you might get an old
libvirt-python wheel that is incompatible with UCA.  Move the ignore
out of the mirror check to apply it globally.

This is an alternative to Iba301a8c80c9ed584f5fb5a816f3d2cf5f5f0e77

Change-Id: I588b1e8e49aa60f3ce976dc1b6c8013ba1d88079
---
 tools/fixup_stuff.sh | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f3ba702a3b..d07d2675c6 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -82,15 +82,17 @@ if [[ "$DISTRO" = "xenial" ]]; then
         source /etc/ci/mirror_info.sh
 
         sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
-
-        # Disable use of libvirt wheel here as presence of mirror implies
-        # presence of cached wheel build against older libvirt binary.
-        # TODO(clarkb) figure out how to use wheel again.
-        sudo bash -c 'echo "no-binary = libvirt-python" >> /etc/pip.conf'
     else
         # Otherwise use upstream UCA
         sudo add-apt-repository -y cloud-archive:ocata
     fi
+
+    # Disable use of libvirt wheel since a cached wheel build might be
+    # against older libvirt binary.  Particularly a problem if using
+    # the openstack wheel mirrors, but can hit locally too.
+    # TODO(clarkb) figure out how to use upstream wheel again.
+    iniset -sudo /etc/pip.conf "global" "no-binary" "libvirt-python"
+
     # Force update our APT repos, since we added UCA above.
     REPOS_UPDATED=False
     apt_get_update

From a881b887211a6bc9ce24a9b42400dffe88abdb67 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 19 Apr 2017 15:42:34 +1000
Subject: [PATCH 1872/3333] Switch to lioadm for centos cinder

Centos/RHEL 7 doesn't support tgtd.  While the packages are still in
EPEL, there's no point in testing because nobody runs like this.
Switch cinder to use lioadm which uses LIO, and update package
installations.

Depends-On: I964917d13d9415223845ac17eb804ee7faceaf6f
Change-Id: Idc5a4e856bfc93e9dc650d565a98a8e9b3df3481
---
 files/rpms/cinder |  3 ++-
 lib/cinder        | 21 ++++++++++++++-------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 0274642fd6..2c7b45baaf 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,4 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # NOPRIME
+scsi-target-utils # not:rhel7,f24,f25 NOPRIME
+targetcli # dist:rhel7,f24,f25 NOPRIME
\ No newline at end of file
diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..3c182ccb26 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -109,7 +109,16 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # https://bugs.launchpad.net/cinder/+bug/1180976
 CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
-CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
+# Centos7 switched to using LIO and that's all that's supported,
+# although the tgt bits are in EPEL we don't want that for CI
+if is_fedora; then
+    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
+    if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
+        die "lioadm is the only valid Cinder iscsi_helper config on this platform"
+    fi
+else
+    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
+fi
 
 # Toggle for deploying Cinder under HTTPD + mod_wsgi
 CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-False}
@@ -443,12 +452,10 @@ function init_cinder {
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
-    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
-        if is_fedora; then
-            install_package scsi-target-utils
-        else
-            install_package tgt
-        fi
+    if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
+        install_package tgt
+    elif [[ "$CINDER_ISCI_HELPER" == "lioadm" ]]; then
+        install_package targetcli
     fi
 
     if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then

From bc6c992e3c5cf7ae48e64203cc83cb7665c5050e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 27 Apr 2017 16:07:51 +1000
Subject: [PATCH 1873/3333] Remove fping requirement

The os-fping API was deprecated in nova in
I92064cbcb5f6414da0c9d294f912a860428af698.  I can't see anything
obviously using it on codesearch.

This is only in EPEL for centos, which I'm trying to remove.  But I
think less dependencies is always better than more in general hence
the removal.

This is essentially a revert of
Ibdc7479a9038321e4fc3953774a6f3e1dac90530

Change-Id: I163fc48c860bae2a92c83cfdaed26b2e54630e20
---
 files/debs/n-api      | 1 -
 files/rpms-suse/n-api | 1 -
 files/rpms/n-api      | 1 -
 3 files changed, 3 deletions(-)
 delete mode 100644 files/debs/n-api
 delete mode 100644 files/rpms/n-api

diff --git a/files/debs/n-api b/files/debs/n-api
deleted file mode 100644
index 0928cd56b9..0000000000
--- a/files/debs/n-api
+++ /dev/null
@@ -1 +0,0 @@
-fping
diff --git a/files/rpms-suse/n-api b/files/rpms-suse/n-api
index af5ac2fc54..0f08daace3 100644
--- a/files/rpms-suse/n-api
+++ b/files/rpms-suse/n-api
@@ -1,2 +1 @@
-fping
 python-dateutil
diff --git a/files/rpms/n-api b/files/rpms/n-api
deleted file mode 100644
index 0928cd56b9..0000000000
--- a/files/rpms/n-api
+++ /dev/null
@@ -1 +0,0 @@
-fping

From faffde1f970c0786d0256e4d51725fbe2ceda063 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 27 Apr 2017 09:54:27 -0700
Subject: [PATCH 1874/3333] Use string cert CA defaults

Switch from sha1 to sha256 and from 1024 bits to 2048 bits. Do this
because things don't like the old inseucre sha1+1024bits combo.

Change-Id: Iae2958969aed0cd880844e19e8055c8bdc7d064d
---
 lib/tls | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index 238687c5dd..7c6b967bc4 100644
--- a/lib/tls
+++ b/lib/tls
@@ -113,11 +113,11 @@ new_certs_dir           = \$dir/newcerts
 certificate             = \$dir/cacert.pem
 private_key             = \$dir/private/cacert.key
 RANDFILE                = \$dir/private/.rand
-default_md              = default
+default_md              = sha256
 
 [ req ]
-default_bits            = 1024
-default_md              = sha1
+default_bits            = 2048
+default_md              = sha256
 
 prompt                  = no
 distinguished_name      = ca_distinguished_name

From e43f60ba2a3a227918e5fdb652a0adc2643f618d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 27 Apr 2017 18:27:36 -0500
Subject: [PATCH 1875/3333] Use the proper keystone endpoints in clouds.yaml

KEYSTONE_SERVICE_API is the keystone endpoint and it is what we should
use. The admin url should DIAF - but until it does, it CERTAINLY should
not be the thing we put into clouds.yaml.

Change-Id: If8196a04f852f633e0b7548793f68c92376aa6da
---
 functions-common | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 35b48603c5..be34bd6ee5 100644
--- a/functions-common
+++ b/functions-common
@@ -93,7 +93,7 @@ function write_clouds_yaml {
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
@@ -105,7 +105,7 @@ function write_clouds_yaml {
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username alt_demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name alt_demo
@@ -117,7 +117,7 @@ function write_clouds_yaml {
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username admin \
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin

From c006bbdeb26df2c60f43d222bdf918f9e24d551f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 26 Apr 2017 06:57:58 -0400
Subject: [PATCH 1876/3333] make USE_SCREEN=False imply USE_SYSTEMD=True

In order to start making the transition in the gate make
USE_SCREEN=False also mean USE_SYSTEMD=True. We'll never actually
declare USE_SYSTEMD=True in the gate (as that doesn't exist for stable
branches), but this will let us roll over the existing transition.

We also have to install systemd-python 234 because we are recording
exception info in the journal, and all versions before that had a bug
in processing that.

Remove the somewhat pointless screen following journalctl commands. We
really don't want or need those, and they tend to build up over time.

Depends-On: I24513f5cbac2c34cf0130bf812ff2df6ad76657c

Change-Id: I6af6d1857effaf662a9d72bd394864934eacbe70
---
 files/debs/general |  3 +--
 files/rpms/general |  2 +-
 functions-common   | 22 ++++------------------
 stack.sh           |  3 +++
 stackrc            |  9 +++++++++
 5 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 20490c6072..1dde03b7fe 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -17,6 +17,7 @@ libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
+libsystemd-dev # for systemd-python
 libxml2-dev  # lxml
 libxslt1-dev  # lxml
 libyaml-dev
@@ -26,10 +27,8 @@ openssl
 pkg-config
 psmisc
 python2.7
-python3-systemd
 python-dev
 python-gdbm # needed for testr
-python-systemd
 screen
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 106aa6ae88..1393d18328 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -29,7 +29,7 @@ pyOpenSSL # version in pip uses too much memory
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 screen
-systemd-python
+systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
diff --git a/functions-common b/functions-common
index 35b48603c5..65c38a58eb 100644
--- a/functions-common
+++ b/functions-common
@@ -1495,22 +1495,6 @@ function _run_under_systemd {
 
     $SYSTEMCTL enable $systemd_service
     $SYSTEMCTL start $systemd_service
-    _journal_log $service $systemd_service
-}
-
-function _journal_log {
-    local service=$1
-    local unit=$2
-    local logfile="${service}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    if [[ -n ${LOGDIR} ]]; then
-        $JOURNALCTL_F $2 > "$real_logfile" &
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
-        fi
-    fi
 }
 
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
@@ -1700,8 +1684,10 @@ function stop_process {
             # Only do this for units which appear enabled, this also
             # catches units that don't really exist for cases like
             # keystone without a failure.
-            $SYSTEMCTL stop devstack@$service.service
-            $SYSTEMCTL disable devstack@$service.service
+            if $SYSTEMCTL is-enabled devstack@$service.service; then
+                $SYSTEMCTL stop devstack@$service.service
+                $SYSTEMCTL disable devstack@$service.service
+            fi
         fi
 
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
diff --git a/stack.sh b/stack.sh
index 31ea2e1112..8864a18d4f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -746,6 +746,9 @@ fi
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
 
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    pip_install_gr systemd-python
+fi
 
 # Virtual Environment
 # -------------------
diff --git a/stackrc b/stackrc
index ed1cf6e074..6ff9585984 100644
--- a/stackrc
+++ b/stackrc
@@ -157,6 +157,15 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# if we are forcing off USE_SCREEN (as we do in the gate), force on
+# systemd. This allows us to drop one of 3 paths through the code.
+if [[ "$USE_SCREEN" == "False" ]]; then
+    # Remove in Pike: this gets us through grenade upgrade
+    if [[ "$GRENADE_PHASE" != "target" ]]; then
+        USE_SYSTEMD="True"
+    fi
+fi
+
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From fa898f5174e3aff9c65366024c170ce3cdda306d Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 25 Apr 2017 01:30:10 -0400
Subject: [PATCH 1877/3333] Add external lock dir to glance api config

As we move to enabling glance-api to use a wsgi script that might be run
as multiple processes, there are a couple places where external
synchronization is necessary. To use this we need to set the lock_path
config option from oslo.concurrency so external locks will work.

Change-Id: I9a66a8636d12037ff9aa4fb73cc3f9b9343dd7e9
---
 lib/glance | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/glance b/lib/glance
index 23a1cbf2c7..57f07f5aba 100644
--- a/lib/glance
+++ b/lib/glance
@@ -43,6 +43,7 @@ fi
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
+GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
 GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
@@ -116,6 +117,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
+    iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2

From 38d4782c9f6b8558fea2c5268b9bf5de5070a0fe Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Apr 2017 16:12:00 -0400
Subject: [PATCH 1878/3333] remove auth_uri from keystonemiddleware config

auth_uri is not a keystonemiddleware option, and it's use in config
files is confusing at best. Remove it for clarity.

Change-Id: Ie3a9ab30d81809363444d5f3b41588b3889dc185
---
 lib/keystone | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index a26ef8afd2..75a06791de 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -434,14 +434,13 @@ function configure_auth_token_middleware {
     local section=${4:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
-    iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
+    iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
     iniset $conf_file $section user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
-    iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers $SERVICE_HOST:11211

From bb4431126b80be4805f1072442676797e6019576 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Apr 2017 16:22:42 -0400
Subject: [PATCH 1879/3333] Try to remove /identity_admin

We should be able to operate without the identity admin endpoint,
given that in v3 it's all the same. This floats that out there to see
if we can or not.

Change-Id: Ic233f6b43dd1e3cfdadff0f18aba4ea78825a996
---
 lib/keystone | 14 ++++++--------
 lib/tempest  |  4 ++++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 75a06791de..fd1e29ce28 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -113,8 +113,9 @@ if is_service_enabled tls-proxy; then
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
 
-KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
+# for compat
+KEYSTONE_AUTH_URI=$KEYSTONE_SERVICE_URI
 
 # V3 URIs
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
@@ -141,6 +142,7 @@ function is_keystone_enabled {
 # runs that a clean run would need to clean up
 function cleanup_keystone {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        # TODO: remove admin at pike-2
         remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
         remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
         sudo rm -f $(apache_site_config_for keystone-wsgi-public)
@@ -543,11 +545,7 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
-        # TODO(sdague): we should really get down to a single keystone here
-        enable_service key-p
-        enable_service key-a
-        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
-        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_CONF" ""
+        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."
@@ -578,9 +576,9 @@ function stop_keystone {
         disable_apache_site keystone
         restart_apache_server
     else
-        stop_process key-p
-        stop_process key-a
+        stop_process keystone
         remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        # TODO(remove in at pike-2)
         remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
     fi
     # Kill the Keystone screen window
diff --git a/lib/tempest b/lib/tempest
index f19686a862..c5853c9a83 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -278,6 +278,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
     fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
+    if [[ "$TEMPEST_AUTH_VERSION" != "v2.0" ]]; then
+        # we're going to disable v2 admin unless we're using v2.0 by default.
+        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2_admin False
+    fi
 
     if is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE

From c13b8a1f33a3ea78388794896a3e7f3256c89ec9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 20 Apr 2017 06:54:51 -0400
Subject: [PATCH 1880/3333] try to use unversioned keystone endpoints
 everywhere

Change-Id: Iad2a3654d8ba181a7ad452d8aba872a8313d4ece
---
 lib/glance                         | 2 +-
 lib/neutron                        | 4 ++--
 lib/neutron-legacy                 | 2 +-
 lib/nova_plugins/hypervisor-ironic | 2 +-
 lib/placement                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/glance b/lib/glance
index 57f07f5aba..d6438a6b48 100644
--- a/lib/glance
+++ b/lib/glance
@@ -207,7 +207,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/neutron b/lib/neutron
index 492a0ee8fb..c7f62ed4a9 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -226,7 +226,7 @@ function configure_neutron_new {
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 
         # TODO(dtroyer): remove the v2.0 hard code below
-        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI/v2.0
+        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
         configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
     fi
 
@@ -284,7 +284,7 @@ function configure_neutron_rootwrap {
 function configure_neutron_nova_new {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI"
     iniset $NOVA_CONF neutron username neutron
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "Default"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index af9a3d25b9..fa508f8180 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -368,7 +368,7 @@ function configure_mutnauq {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c9544fe6c7..7d47ef070c 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -49,7 +49,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin
     iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
diff --git a/lib/placement b/lib/placement
index 4755a58bf2..2c51ed69b4 100644
--- a/lib/placement
+++ b/lib/placement
@@ -102,7 +102,7 @@ function _config_placement_apache_wsgi {
 
 function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_type "password"
-    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI/v3"
+    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI"
     iniset $NOVA_CONF placement username placement
     iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"

From 803acffcf9254e328426ad67380a99f4f5b164ec Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 1 May 2017 10:52:38 -0400
Subject: [PATCH 1881/3333] Make ./clean.sh work in more situations

When transitioning between different wsgi modes, or service modes, we
should really safely stop and cleanup things that are started in any
service mode, which makes it easier to ensure that we don't leave
things around from past runs.

Change-Id: I33acbee39e1a2da2bfd79a5dd54b84a12a778be1
---
 functions-common | 15 ++++++---------
 lib/keystone     | 20 ++++++++++----------
 lib/placement    |  1 +
 3 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/functions-common b/functions-common
index 65c38a58eb..90f540017c 100644
--- a/functions-common
+++ b/functions-common
@@ -1679,15 +1679,12 @@ function stop_process {
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
 
     if is_service_enabled $service; then
-        # Kill via pid if we have one available
-        if [[ "$USE_SYSTEMD" == "True" ]]; then
-            # Only do this for units which appear enabled, this also
-            # catches units that don't really exist for cases like
-            # keystone without a failure.
-            if $SYSTEMCTL is-enabled devstack@$service.service; then
-                $SYSTEMCTL stop devstack@$service.service
-                $SYSTEMCTL disable devstack@$service.service
-            fi
+        # Only do this for units which appear enabled, this also
+        # catches units that don't really exist for cases like
+        # keystone without a failure.
+        if $SYSTEMCTL is-enabled devstack@$service.service; then
+            $SYSTEMCTL stop devstack@$service.service
+            $SYSTEMCTL disable devstack@$service.service
         fi
 
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
diff --git a/lib/keystone b/lib/keystone
index fd1e29ce28..61b0a0c287 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -141,16 +141,16 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        # TODO: remove admin at pike-2
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
-        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
-    else
-        disable_apache_site keystone
-        sudo rm -f $(apache_site_config_for keystone)
-    fi
+    # TODO: remove admin at pike-2
+    # These files will be created if we are running WSGI_MODE="uwsgi"
+    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+    remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
+    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
+    sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
+
+    # These files will be created if we are running WSGI_MODE="mod_wsgi"
+    disable_apache_site keystone
+    sudo rm -f $(apache_site_config_for keystone)
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
diff --git a/lib/placement b/lib/placement
index 2c51ed69b4..ad12824a38 100644
--- a/lib/placement
+++ b/lib/placement
@@ -69,6 +69,7 @@ function is_placement_enabled {
 # cleanup_placement() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_placement {
+    sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
 }
 

From 8b8441f3becbae2e704932569bff384dcc5c6713 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 06:14:11 -0400
Subject: [PATCH 1882/3333] Default developer use case to systemd

This moves the developer use case over to systemd, and updates all the
relevant docs to discuss the systemd workflow instead of screen. It
does so by defaulting USE_SCREEN=False, so will not impact people that
set it explicitly.

Change-Id: I6d664612bc2b850eb7f56852afbc841867223ab7
---
 doc/source/configuration.rst          | 42 +++-----------
 doc/source/development.rst            | 81 ++++++++++-----------------
 doc/source/faq.rst                    |  5 +-
 doc/source/site-map.rst               |  1 +
 SYSTEMD.rst => doc/source/systemd.rst | 36 +++---------
 stack.sh                              |  7 +++
 stackrc                               | 16 ++++--
 7 files changed, 68 insertions(+), 120 deletions(-)
 rename SYSTEMD.rst => doc/source/systemd.rst (85%)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 53ae82ff8a..318e044909 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -278,43 +278,22 @@ number of days of old log files to keep.
 
         LOGDAYS=1
 
-The some of the project logs (Nova, Cinder, etc) will be colorized by
-default (if ``SYSLOG`` is not set below); this can be turned off by
-setting ``LOG_COLOR`` to ``False``.
-
-    ::
+Some coloring is used during the DevStack runs to make it easier to
+see what is going on. This can be disabled with::
 
         LOG_COLOR=False
 
 Logging the Service Output
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-DevStack will log the ``stdout`` output of the services it starts.
-When using ``screen`` this logs the output in the screen windows to a
-file.  Without ``screen`` this simply redirects stdout of the service
-process to a file in ``LOGDIR``.
-
-    ::
-
-        LOGDIR=$DEST/logs
+By default, services run under ``systemd`` and are natively logging to
+the systemd journal.
 
-Note the use of ``DEST`` to locate the main install directory; this
-is why we suggest setting it in ``local.conf``.
-
-Enabling Syslog
-~~~~~~~~~~~~~~~
-
-Logging all services to a single syslog can be convenient. Enable
-syslogging by setting ``SYSLOG`` to ``True``. If the destination log
-host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be used
-to direct the message stream to the log host.
-
-    ::
+To query the logs use the ``journalctl`` command, such as::
 
-        SYSLOG=True
-        SYSLOG_HOST=$HOST_IP
-        SYSLOG_PORT=516
+  journalctl --unit devstack@*
 
+More examples can be found in :ref:`journalctl-examples`.
 
 Example Logging Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -326,7 +305,6 @@ a file, keep service logs and disable color in the stored files.
 
        [[local|localrc]]
        DEST=/opt/stack/
-       LOGDIR=$DEST/logs
        LOGFILE=$LOGDIR/stack.sh.log
        LOG_COLOR=False
 
@@ -587,9 +565,7 @@ Swift
 
 Swift is disabled by default.  When enabled, it is configured with
 only one replica to avoid being IO/memory intensive on a small
-VM. When running with only one replica the account, container and
-object services will run directly in screen. The others services like
-replicator, updaters or auditor runs in background.
+VM.
 
 If you would like to enable Swift you can add this to your ``localrc``
 section:
@@ -630,7 +606,7 @@ install the swift3 middleware emulation. Swift will be configured to
 act as a S3 endpoint for Keystone so effectively replacing the
 ``nova-objectstore``.
 
-Only Swift proxy server is launched in the screen session all other
+Only Swift proxy server is launched in the systemd system all other
 services are started in background and managed by ``swift-init`` tool.
 
 Heat
diff --git a/doc/source/development.rst b/doc/source/development.rst
index 776ac6cb64..a3f2747604 100644
--- a/doc/source/development.rst
+++ b/doc/source/development.rst
@@ -8,56 +8,33 @@ with it?
 Inspecting Services
 ===================
 
-By default most services in DevStack are running in a `screen
-<https://www.gnu.org/software/screen/manual/screen.html>`_
-session.
+By default most services in DevStack are running as `systemd` units
+named `devstack@$servicename.service`. You can see running services
+with.
 
 .. code-block:: bash
 
-   os3:~> screen -list
-   There is a screen on:
-        28994.stack	(08/10/2016 09:01:33 PM)	(Detached)
-   1 Socket in /var/run/screen/S-sdague.
+   sudo systemctl status --unit="devstack@*"
 
-You can attach to this screen session using ``screen -r`` which gives
-you a view of the services in action.
-
-.. image:: assets/images/screen_session_1.png
-   :width: 100%
-
-Basic Screen Commands
----------------------
-
-The following minimal commands will be useful to using screen:
-
-* ``ctrl-a n`` - go to next window. Next is assumed to be right of
-  current window.
-* ``ctrl-a p`` - go to previous window. Previous is assumed to be left
-  of current window.
-* ``ctrl-a [`` - entry copy/scrollback mode. This allows you to
-  navigate back through the logs with the up arrow.
-* ``ctrl-a d`` - detach from screen. Gets you back to a normal
-  terminal, while leaving everything running.
-
-For more about using screen, see the excellent `screen manual
-<https://www.gnu.org/software/screen/manual/screen.html>`_.
+To learn more about the basics of systemd, see :doc:`/systemd`
 
 Patching a Service
 ==================
 
 If you want to make a quick change to a running service the easiest
-way to do this is:
+way to do that is to change the code directly in /opt/stack/$service
+and then restart the affected daemons.
+
+.. code-block:: bash
+
+   sudo systemctl restart --unit=devstack@n-cpu.service
+
+If your change impacts more than one daemon you can restart by
+wildcard as well.
 
-* attach to screen
-* navigate to the window in question
-* ``ctrl-c`` to kill the service
-* make appropriate changes to the code
-* ``up arrow`` in the screen window to display the command used to run
-  that service
-* ``enter`` to restart the service
+.. code-block:: bash
 
-This works for services, except those running under Apache (currently
-just ``keystone`` by default).
+   sudo systemctl restart --unit="devstack@n-*"
 
 .. warning::
 
@@ -102,14 +79,6 @@ in gerrit by using the ref name that gerrit assigns to each change.
    NOVA_BRANCH=refs/changes/10/353710/1
 
 
-Testing Changes to Apache Based Services
-========================================
-
-When testing changes to Apache based services, such as ``keystone``,
-you can either use the Testing a Patch Series approach above, or make
-changes in the code tree and issue an apache restart.
-
-
 Testing Changes to Libraries
 ============================
 
@@ -132,9 +101,17 @@ your changes instead of just upstream master.
    OSLOPOLICY_REPO=/home/sdague/oslo.policy
    OSLOPOLICY_BRANCH=better_exception
 
-Because libraries are used by many services, library changes really
-need to go through a full ``./unstack.sh && ./stack.sh`` to see your
-changes in action.
+As libraries are not installed `editable` by pip, after you make any
+local changes you will need to:
+
+* cd to top of library path
+* sudo pip install -U .
+* restart all services you want to use the new library
+
+You can do that with wildcards such as
+
+.. code-block:: bash
+
+   sudo systemctl restart --unit="devstack@n-*"
 
-To figure out the repo / branch names for every library that's
-supported, you'll need to read the devstack source.
+which will restart all nova services.
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index f03304f37f..cb2f3281f6 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -41,8 +41,9 @@ Why not use packages?
 ~~~~~~~~~~~~~~~~~~~~~
 
 Unlike packages, DevStack leaves your cloud ready to develop -
-checkouts of the code and services running in screen. However, many
-people are doing the hard work of packaging and recipes for production
+checkouts of the code and services running locally under systemd,
+making it easy to hack on and test new patches. However, many people
+are doing the hard work of packaging and recipes for production
 deployments.
 
 Why isn't $MY\_FAVORITE\_DISTRO supported?
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
index 801fc66b80..022cc73959 100644
--- a/doc/source/site-map.rst
+++ b/doc/source/site-map.rst
@@ -21,3 +21,4 @@
    development
    hacking
    guides
+   systemd
diff --git a/SYSTEMD.rst b/doc/source/systemd.rst
similarity index 85%
rename from SYSTEMD.rst
rename to doc/source/systemd.rst
index 729fdf47b6..efe79e4b0c 100644
--- a/SYSTEMD.rst
+++ b/doc/source/systemd.rst
@@ -2,12 +2,7 @@
  Using Systemd in DevStack
 ===========================
 
-.. note::
-
-   This is an in progress document as we work out the way forward here
-   with DevStack and systemd.
-
-DevStack can be run with all the services as systemd unit
+By default DevStack is run with all the services as systemd unit
 files. Systemd is now the default init system for nearly every Linux
 distro, and systemd encodes and solves many of the problems related to
 poorly running processes.
@@ -25,12 +20,6 @@ There is also a common developer workflow of changing code in more
 than one service, and needing to restart a bunch of services for that
 to take effect.
 
-To enable this add the following to your local.conf::
-
-  USE_SYSTEMD=True
-
-
-
 Unit Structure
 ==============
 
@@ -42,8 +31,9 @@ Unit Structure
    code is left in place in case we can switch back later.
 
 All DevStack user units are created as a part of the DevStack slice
-given the name ``devstack@$servicename.service``. This lets us do
-certain operations at the slice level.
+given the name ``devstack@$servicename.service``. This makes it easy
+to understand which services are part of the devstack run, and lets us
+disable / stop them in a single command.
 
 Manipulating Units
 ==================
@@ -89,6 +79,8 @@ Or to see the status of all Nova processes you can do::
 We'll eventually make the unit names a bit more meaningful so that
 it's easier to understand what you are restarting.
 
+.. _journalctl-examples:
+
 Querying Logs
 =============
 
@@ -126,7 +118,7 @@ pypi, and they are all very different. They unfortunately all install
 into the ``systemd`` namespace, which can cause some issues.
 
 - ``systemd-python`` - this is the upstream maintained library, it has
-  a version number like systemd itself (currently ``233``). This is
+  a version number like systemd itself (currently ``234``). This is
   the one you want.
 - ``systemd`` - a python 3 only library, not what you want.
 - ``python-systemd`` - another library you don't want. Installing it
@@ -145,20 +137,6 @@ system units.
 Future Work
 ===========
 
-oslo.log journald
------------------
-
-Journald has an extremely rich mechanism for direct logging including
-structured metadata. We should enhance oslo.log to take advantage of
-that. It would let us do things like::
-
-  journalctl REQUEST_ID=......
-
-  journalctl INSTANCE_ID=......
-
-And get all lines related to the request id or instance id. (Note:
-this work has been started at https://review.openstack.org/#/c/451525/)
-
 log colorizing
 --------------
 
diff --git a/stack.sh b/stack.sh
index 40ebf5a853..2c10200f75 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1474,6 +1474,13 @@ if [[ -n "$DEPRECATED_TEXT" ]]; then
     echo_summary "WARNING: $DEPRECATED_TEXT"
 fi
 
+# If USE_SYSTEMD is enabled, tell the user about using it.
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    echo "Services are running under systemd unit files."
+    echo "For more information see: "
+    echo "https://docs.openstack.org/developer/devstack/systemd.html"
+fi
+
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)
 echo_summary "stack.sh completed in $SECONDS seconds."
 
diff --git a/stackrc b/stackrc
index d5c0d74e25..1300f45cda 100644
--- a/stackrc
+++ b/stackrc
@@ -80,12 +80,19 @@ NOVA_ENABLED_APIS=osapi_compute,metadata
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 
+# TODO(sdague): Queens
+#
+# All the non systemd paths should be removed in queens, they only
+# exist in Pike to support testing from grenade. Ensure that all this
+# is cleaned up and purged, which should dramatically simplify the
+# devstack codebase.
+
 # Whether to use 'dev mode' for screen windows. Dev mode works by
 # stuffing text into the screen windows so that a developer can use
 # ctrl-c, up-arrow, enter to restart the service. Starting services
 # this way is slightly unreliable, and a bit slower, so this can
 # be disabled for automated testing by setting this value to False.
-USE_SCREEN=$(trueorfalse True USE_SCREEN)
+USE_SCREEN=$(trueorfalse False USE_SCREEN)
 
 # Whether to use SYSTEMD to manage services
 USE_SYSTEMD=$(trueorfalse False USE_SYSTEMD)
@@ -100,9 +107,6 @@ else
     JOURNALCTL_F="journalctl -f -o short-precise --unit"
 fi
 
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    USE_SCREEN=False
-fi
 
 # Whether or not to enable Kernel Samepage Merging (KSM) if available.
 # This allows programs that mark their memory as mergeable to share
@@ -157,6 +161,10 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# TODO(sdague): Delete all this in Queens.
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    USE_SCREEN=False
+fi
 # if we are forcing off USE_SCREEN (as we do in the gate), force on
 # systemd. This allows us to drop one of 3 paths through the code.
 if [[ "$USE_SCREEN" == "False" ]]; then

From 27f66e9830727addd3d84b7a23eee907210540bb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 09:08:17 -0400
Subject: [PATCH 1883/3333] Fix logging when under systemd

Both keystone and neutron didn't yet have systemd awareness for
setting up logging (i.e. drop the extra date / time stamps)

Change-Id: Ib442c603c9afb679676976c37c2c6122201ae846
---
 lib/keystone | 4 +---
 lib/neutron  | 7 +------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 61b0a0c287..4bb6893089 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -267,9 +267,7 @@ function configure_keystone {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" != "mod_wsgi" ] ; then
-        setup_colorized_logging $KEYSTONE_CONF
-    fi
+    setup_logging $KEYSTONE_CONF
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
diff --git a/lib/neutron b/lib/neutron
index c7f62ed4a9..941a697816 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -231,12 +231,7 @@ function configure_neutron_new {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
-    else
-        # Show user_name and project_name by default
-        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
-    fi
+    setup_logging $NEUTRON_CONF
 
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original

From 29c1f981feded19f81f873e5147428ec87cd7c52 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 08:40:26 -0400
Subject: [PATCH 1884/3333] convert README to rst

Everything else in our documentation is RST, we should convert the
Readme to RST as well (as github supports this, so it's fine to read
it there)

Change-Id: If2aabf629affc09b5daa570f4ca3bdf268cb53b0
---
 README.md => README.rst | 26 ++++++++++++++++----------
 setup.cfg               |  2 +-
 2 files changed, 17 insertions(+), 11 deletions(-)
 rename README.md => README.rst (89%)

diff --git a/README.md b/README.rst
similarity index 89%
rename from README.md
rename to README.rst
index ff5598b0c5..dfa68b927f 100644
--- a/README.md
+++ b/README.rst
@@ -1,6 +1,7 @@
 DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud.
 
-# Goals
+Goals
+=====
 
 * To quickly build dev OpenStack environments in a clean Ubuntu or Fedora
   environment
@@ -20,12 +21,13 @@ execute before you run them, as they install software and will alter your
 networking configuration.  We strongly recommend that you run `stack.sh`
 in a clean and disposable vm when you are first getting started.
 
-# Versions
+Versions
+========
 
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a Newton OpenStack cloud:
+following to create a Newton OpenStack cloud::
 
     git checkout stable/newton
     ./stack.sh
@@ -38,7 +40,8 @@ milestone-proposed branches that need to be tested::
     GLANCE_REPO=git://git.openstack.org/openstack/glance.git
     GLANCE_BRANCH=milestone-proposed
 
-# Start A Dev Cloud
+Start A Dev Cloud
+=================
 
 Installing in a dedicated disposable VM is safer than installing on your
 dev machine!  Plus you can pick one of the supported Linux distros for
@@ -54,14 +57,15 @@ endpoints, like so:
 * Keystone: http://myhost:5000/v2.0/
 
 We also provide an environment file that you can use to interact with your
-cloud via CLI:
+cloud via CLI::
 
     # source openrc file to load your environment with OpenStack CLI creds
     . openrc
     # list instances
-    nova list
+    openstack server list
 
-# DevStack Execution Environment
+DevStack Execution Environment
+==============================
 
 DevStack runs rampant over the system it runs on, installing things and
 uninstalling other things.  Running this on a system you care about is a recipe
@@ -81,10 +85,12 @@ check it out to see what DevStack's expectations are for the account
 it runs under.  Many people simply use their usual login (the default
 'ubuntu' login on a UEC image for example).
 
-# Customizing
+Customizing
+===========
 
 DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
-by reading the [configuration guide](doc/source/configuration.rst) for
-details of the configuration file and the many available options.
+by reading the `configuration guide
+<https://docs.openstack.org/developer/devstack/configuration.html>_`
+for details of the configuration file and the many available options.
diff --git a/setup.cfg b/setup.cfg
index e4b2888dcb..3487f6541b 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -2,7 +2,7 @@
 name = DevStack
 summary = OpenStack DevStack
 description-file =
-    README.md
+    README.rst
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
 home-page = http://docs.openstack.org/developer/devstack

From 2686b36c32cf99e3fad5e55466d8c582b58f82cb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 08:49:17 -0400
Subject: [PATCH 1885/3333] Correct various inaccuracies in overview.rst

This still was referencing nova-network

Change-Id: Id584d3fd26482330f42319aee4cb36981066db55
---
 doc/source/overview.rst | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index d245035a1a..e64819372e 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -20,11 +20,11 @@ Base OS
 
 *The OpenStack Technical Committee (TC) has defined the current CI
 strategy to include the latest Ubuntu release and the latest RHEL
-release (for Python 2.6 testing).*
+release.*
 
 -  Ubuntu: current LTS release plus current development release
 -  Fedora: current release plus previous release
--  RHEL: current major release
+-  RHEL/Centos: current major release
 -  Other OS platforms may continue to be included but the maintenance of
    those platforms shall not be assumed simply due to their presence.
    Having a listed point-of-contact for each additional OS will greatly
@@ -38,7 +38,6 @@ Databases
 *As packaged by the host OS*
 
 -  MySQL
--  PostgreSQL
 
 Queues
 ------
@@ -46,7 +45,6 @@ Queues
 *As packaged by the host OS*
 
 -  Rabbit
--  Qpid
 
 Web Server
 ----------
@@ -58,9 +56,6 @@ Web Server
 OpenStack Network
 -----------------
 
-*Defaults to nova network, optionally use neutron*
-
--  Nova Network: FlatDHCP
 -  Neutron: A basic configuration approximating the original FlatDHCP
    mode using linuxbridge or OpenVSwitch.
 
@@ -68,9 +63,9 @@ Services
 --------
 
 The default services configured by DevStack are Identity (keystone),
-Object Storage (swift), Image Service (glance), Block Storage (cinder),
-Compute (nova), Networking (nova), Dashboard (horizon), Orchestration
-(heat)
+Object Storage (swift), Image Service (glance), Block Storage
+(cinder), Compute (nova), Networking (neutron), Dashboard (horizon),
+Orchestration (heat)
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call
@@ -80,8 +75,7 @@ Node Configurations
 -------------------
 
 -  single node
--  multi-node is not tested regularly by the core team, and even then
-   only minimal configurations are reviewed
+-  multi-node configurations as are tested by the gate
 
 Exercises
 ---------

From 3336b4bed6455e9e77a7696b353d8798270c5b2e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 08:45:34 -0400
Subject: [PATCH 1886/3333] remove out of date heat references

This removes some remnant heat code and references now that heat is
running in a plugin. Before merging this patch the heat team should
verify they got everything they needed into their heat plugin, as
there were more parts left than I was expecting.

Change-Id: I477e3a6e75591aa8ff836c28f7ef56aa1b5f8727
---
 doc/source/configuration.rst | 23 -----------------------
 doc/source/faq.rst           | 10 ----------
 doc/source/overview.rst      |  3 +--
 lib/tempest                  | 18 ------------------
 stack.sh                     |  6 +-----
 stackrc                      |  8 --------
 6 files changed, 2 insertions(+), 66 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 318e044909..66b8702f76 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -609,29 +609,6 @@ act as a S3 endpoint for Keystone so effectively replacing the
 Only Swift proxy server is launched in the systemd system all other
 services are started in background and managed by ``swift-init`` tool.
 
-Heat
-~~~~
-
-Heat is disabled by default (see ``stackrc`` file). To enable it
-explicitly you'll need the following settings in your ``localrc``
-section
-
-::
-
-    enable_service heat h-api h-api-cfn h-api-cw h-eng
-
-Heat can also run in standalone mode, and be configured to orchestrate
-on an external OpenStack cloud. To launch only Heat in standalone mode
-you'll need the following settings in your ``localrc`` section
-
-::
-
-    disable_all_services
-    enable_service rabbit mysql heat h-api h-api-cfn h-api-cw h-eng
-    HEAT_STANDALONE=True
-    KEYSTONE_SERVICE_HOST=...
-    KEYSTONE_AUTH_HOST=...
-
 Tempest
 ~~~~~~~
 
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index cb2f3281f6..a186336f54 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -159,16 +159,6 @@ to a working IP address; setting it to 127.0.0.1 in ``/etc/hosts`` is
 often good enough for a single-node installation. And in an extreme
 case, use ``clean.sh`` to eradicate it and try again.
 
-Configure ``local.conf`` thusly:
-
-    ::
-
-        [[local|localrc]]
-        HEAT_STANDALONE=True
-        ENABLED_SERVICES=rabbit,mysql,heat,h-api,h-api-cfn,h-api-cw,h-eng
-        KEYSTONE_SERVICE_HOST=<keystone-host>
-        KEYSTONE_AUTH_HOST=<keystone-host>
-
 Why are my configuration changes ignored?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index e64819372e..c07a8e6d67 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -64,8 +64,7 @@ Services
 
 The default services configured by DevStack are Identity (keystone),
 Object Storage (swift), Image Service (glance), Block Storage
-(cinder), Compute (nova), Networking (neutron), Dashboard (horizon),
-Orchestration (heat)
+(cinder), Compute (nova), Networking (neutron), Dashboard (horizon)
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call
diff --git a/lib/tempest b/lib/tempest
index fd8e3e7e14..47785ec06b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -394,24 +394,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
-    # Orchestration Tests
-    if is_service_enabled heat; then
-        if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
-            iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
-        fi
-        # Nova might not be enabled, especially when we want to test tempest scenario/API that only create Neutron resources
-        if is_service_enabled nova; then
-            # build a specialized heat flavor
-            available_flavors=$(nova flavor-list)
-            if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
-                openstack flavor create --id 451 --ram 512 --disk 0 --vcpus 1 m1.heat
-            fi
-            iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
-        fi
-        iniset $TEMPEST_CONFIG orchestration build_timeout 900
-        iniset $TEMPEST_CONFIG orchestration stack_owner_role Member
-    fi
-
     # Scenario
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
diff --git a/stack.sh b/stack.sh
index 2c10200f75..bddf11f830 100755
--- a/stack.sh
+++ b/stack.sh
@@ -2,7 +2,7 @@
 
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
-# **Heat**, **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
+# **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
 
 # This script's options can be changed by setting appropriate environment
 # variables.  You can configure things like which git repositories to use,
@@ -1328,10 +1328,6 @@ if is_service_enabled nova && is_service_enabled keystone; then
         USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"
     fi
 
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        USERRC_PARAMS="$USERRC_PARAMS --heat-url http://$HEAT_API_HOST:$HEAT_API_PORT/v1"
-    fi
-
     $TOP_DIR/tools/create_userrc.sh $USERRC_PARAMS
 fi
 
diff --git a/stackrc b/stackrc
index 1300f45cda..35856ca73e 100644
--- a/stackrc
+++ b/stackrc
@@ -518,14 +518,6 @@ GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
 GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
 
-# heat-cfntools server agent
-HEAT_CFNTOOLS_REPO=${HEAT_CFNTOOLS_REPO:-${GIT_BASE}/openstack/heat-cfntools.git}
-HEAT_CFNTOOLS_BRANCH=${HEAT_CFNTOOLS_BRANCH:-master}
-
-# heat example templates and elements
-HEAT_TEMPLATES_REPO=${HEAT_TEMPLATES_REPO:-${GIT_BASE}/openstack/heat-templates.git}
-HEAT_TEMPLATES_BRANCH=${HEAT_TEMPLATES_BRANCH:-master}
-
 # django openstack_auth library
 GITREPO["django_openstack_auth"]=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/django_openstack_auth.git}
 GITBRANCH["django_openstack_auth"]=${HORIZONAUTH_BRANCH:-master}

From b2bfe5617ac43a678a9113d5c955f5456c151319 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 May 2017 09:58:21 -0400
Subject: [PATCH 1887/3333] Turn off use_journal because of eventlet concerns

use_journal uses the systemd native path for logging, however there
are concerns that this might be negatively interacting with
eventlet. To be on the safe side fall back to stdout.

This introduces a USE_JOURNAL option which will let folks turn this
back on for testing.

This also adjusts the debug lines. When using the journal the pid
reported by systemd is correct. When using stdout, it will be the
parent process id, so we need to keep it to see which child each thing
is coming from.

Change-Id: Id7891c532bf99c099252e82d511a37a49506fea9
---
 functions | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index c99e435175..8968a1861b 100644
--- a/functions
+++ b/functions
@@ -606,13 +606,25 @@ function setup_colorized_logging {
 function setup_systemd_logging {
     local conf_file=$1
     local conf_section="DEFAULT"
-    iniset $conf_file $conf_section use_journal "True"
+    # NOTE(sdague): this is a nice to have, and means we're using the
+    # native systemd path, which provides for things like search on
+    # request-id. However, there may be an eventlet interaction here,
+    # so going off for now.
+    USE_JOURNAL=$(trueorfalse USE_JOURNAL False)
+    if [[ "$USE_JOURNAL" == "True" ]]; then
+        iniset $conf_file $conf_section use_journal "True"
+        # if we are using the journal directly, our process id is already correct
+        iniset $conf_file $conf_section logging_debug_format_suffix \
+               "{{%(funcName)s %(pathname)s:%(lineno)d}}"
+    else
+        iniset $conf_file $conf_section logging_debug_format_suffix \
+               "{{(pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d}}"
+    fi
+
     iniset $conf_file $conf_section logging_context_format_string \
            "%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s] %(instance)s%(message)s"
     iniset $conf_file $conf_section logging_default_format_string \
            "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_debug_format_suffix \
-           "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 

From 401de4d20cb204b811dd5877e9e7688d72eb6e39 Mon Sep 17 00:00:00 2001
From: TommyLike <tommylikehu@gmail.com>
Date: Thu, 4 May 2017 17:56:22 +0800
Subject: [PATCH 1888/3333] Copy 'resource_filters.json' file to cinder config
 folder

Cinder use 'resource_filters.json' to config allowed filters,
copy the new added json file when set config files.

Change-Id: I397cb5859e2b3349af3cb07ee02b6463c6eccc35
Depends-On: 27aeba0b5d3cf64286125937e8336ba1d3b26b16
---
 lib/cinder | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..e3a687b4f2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -244,6 +244,10 @@ function configure_cinder {
 
     configure_rootwrap cinder
 
+    if [[ -f "$CINDER_DIR/etc/cinder/resource_filters.json" ]]; then
+        cp -p "$CINDER_DIR/etc/cinder/resource_filters.json" "$CINDER_CONF_DIR/resource_filters.json"
+    fi
+
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI
 
     inicomment $CINDER_API_PASTE_INI filter:authtoken auth_host

From 148d58c3519aca4723edd6eb59fc7150b92e74d7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 May 2017 13:08:25 -0400
Subject: [PATCH 1889/3333] Make devstack fail early for common systemd
 pitfalls

There are a couple of issues that have ended up being hit by devstack
plugin authors which we can detect and error in a much nicer way
instead of them having a cryptic systemd failure.

Change-Id: I45e4ac363aeefb4503015f9e1b57c58f79b58f40
---
 functions-common | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 90f540017c..fe608b4a48 100644
--- a/functions-common
+++ b/functions-common
@@ -1480,10 +1480,41 @@ function write_uwsgi_user_unit_file {
     $SYSTEMCTL daemon-reload
 }
 
+function _common_systemd_pitfalls {
+    local cmd=$1
+    # do some sanity checks on $cmd to see things we don't expect to work
+
+    if [[ "$cmd" =~ "sudo" ]]; then
+        local msg=<<EOF
+You are trying to use run_process with sudo, this is not going to work under systemd.
+
+If you need to run a service as a user other than $STACK_USER call it with:
+
+   run_process \$name \$cmd \$group \$user
+EOF
+        die $LINENO $msg
+    fi
+
+    if [[ ! "$cmd" =~ ^/ ]]; then
+        local msg=<<EOF
+The cmd="$cmd" does not start with an absolute path. It will fail to
+start under systemd.
+
+Please update your run_process stanza to have an absolute path.
+EOF
+        die $LINENO $msg
+    fi
+
+}
+
+# Helper function to build a basic unit file and run it under systemd.
 function _run_under_systemd {
     local service=$1
     local command="$2"
     local cmd=$command
+    # sanity check the command
+    _common_systemd_pitfalls "$cmd"
+
     local systemd_service="devstack@$service.service"
     local group=$3
     local user=${4:-$STACK_USER}
@@ -1527,7 +1558,7 @@ function is_running {
 # If an optional group is provided sg will be used to run the
 # command as that group.
 # Uses globals ``USE_SCREEN``
-# run_process service "command-line" [group]
+# run_process service "command-line" [group] [user]
 function run_process {
     local service=$1
     local command="$2"

From c2200bc880f8d7ea4b6489f8daafa9c02136e174 Mon Sep 17 00:00:00 2001
From: "Ian Y. Choi" <ianyrchoi@gmail.com>
Date: Thu, 4 May 2017 21:13:29 +0200
Subject: [PATCH 1890/3333] Fix systemctl option: removes --unit option in doc

--unit option is for journalctl, not systemctl.
Just executing systemctl without "--unit=" works.

Change-Id: I9752561332e62ec6327b17b12d2d868892718041
---
 doc/source/development.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/source/development.rst b/doc/source/development.rst
index a3f2747604..957de9b0e1 100644
--- a/doc/source/development.rst
+++ b/doc/source/development.rst
@@ -14,7 +14,7 @@ with.
 
 .. code-block:: bash
 
-   sudo systemctl status --unit="devstack@*"
+   sudo systemctl status "devstack@*"
 
 To learn more about the basics of systemd, see :doc:`/systemd`
 
@@ -27,14 +27,14 @@ and then restart the affected daemons.
 
 .. code-block:: bash
 
-   sudo systemctl restart --unit=devstack@n-cpu.service
+   sudo systemctl restart devstack@n-cpu.service
 
 If your change impacts more than one daemon you can restart by
 wildcard as well.
 
 .. code-block:: bash
 
-   sudo systemctl restart --unit="devstack@n-*"
+   sudo systemctl restart "devstack@n-*"
 
 .. warning::
 
@@ -112,6 +112,6 @@ You can do that with wildcards such as
 
 .. code-block:: bash
 
-   sudo systemctl restart --unit="devstack@n-*"
+   sudo systemctl restart "devstack@n-*"
 
 which will restart all nova services.

From e264b4ab323385e8c861da79c96cf9d643ca395d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 May 2017 15:56:37 -0400
Subject: [PATCH 1891/3333] disable journald rate limiting

systemd-journald has rate limiting built in, but that's not sufficient
for the level of logging of OpenStack services during test
runs. Disable the rate limiting so that no log messages are lost.

Change-Id: I64599aba74c5a39276bb8f946cd236600b9cc81b
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 2c10200f75..9fdb47ecbd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -748,6 +748,10 @@ source $TOP_DIR/tools/fixup_stuff.sh
 
 if [[ "$USE_SYSTEMD" == "True" ]]; then
     pip_install_gr systemd-python
+    # the default rate limit of 1000 messages / 30 seconds is not
+    # sufficient given how verbose our logging is.
+    iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"
+    sudo systemctl restart systemd-journald
 fi
 
 # Virtual Environment

From eaadffe07b0516f103321c84013b755061ba7fb5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 May 2017 16:05:19 -0400
Subject: [PATCH 1892/3333] Always have ./clean.sh run ./unstack.sh

There was detection code in clean.sh to only run it if a screen
session was found, but in systemd world, that's obviously not
true. This was causing me (and others) substantial confusion.

Change-Id: I204e94cd86b8c67012aabfca74796e593151c3a4
---
 clean.sh | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/clean.sh b/clean.sh
index 90b21eb353..ef38fbf4f8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -64,13 +64,8 @@ if [[ -d $TOP_DIR/extras.d ]]; then
     done
 fi
 
-# See if there is anything running...
-# need to adapt when run_service is merged
-SESSION=$(screen -ls | awk '/[0-9].stack/ { print $1 }')
-if [[ -n "$SESSION" ]]; then
-    # Let unstack.sh do its thing first
-    $TOP_DIR/unstack.sh --all
-fi
+# Let unstack.sh do its thing first
+$TOP_DIR/unstack.sh --all
 
 # Run extras
 # ==========

From f41bf2a92fab6ffcea48d8b295c04ace4d2fa7ff Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 5 May 2017 07:50:52 -0400
Subject: [PATCH 1893/3333] Set SyslogIdentifier for uwsgi processes

Now that we aren't using native journal messages by default, the
syslog identifier of all the uwsgi processes is the same. We should be
more explicit with those.

Change-Id: Id5406d02407b022d4016517c2e18890973876d88
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index 90f540017c..c3f37b9493 100644
--- a/functions-common
+++ b/functions-common
@@ -1463,6 +1463,7 @@ function write_uwsgi_user_unit_file {
     mkdir -p $SYSTEMD_DIR
 
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "SyslogIdentifier" "$service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "Type" "notify"

From 621704f4b3503b2509db18a9a0db134d54789fab Mon Sep 17 00:00:00 2001
From: Mike Perez <thingee@gmail.com>
Date: Fri, 5 May 2017 08:59:25 -0700
Subject: [PATCH 1894/3333] Stop setting osapi_volume_base_URL

This option is a duplicate of public_endpoint for Cinder.

Change-Id: I8aee1b9f93a09d2e92bde80c0e413e1540723bac
Depends-On: I2a74af7906d14cbc49b8cf0a88c344ca30fcbd26
---
 lib/cinder | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..b3de1915e4 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -319,7 +319,6 @@ function configure_cinder {
         # Set the service port for a proxy to take the original
         iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
         iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
-        iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
     fi
 
     if [ "$SYSLOG" != "False" ]; then

From 1df17c94f512f0d1a084ba70cc0d4feb05feb8fb Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Mon, 1 May 2017 17:00:42 +0900
Subject: [PATCH 1895/3333] lib/neutron: Don't assume plugin config is provided
 by neutron repo

It isn't the case for plugins provided by subprojects.

Change-Id: Ic28a9da9f11355e5e1eae5db9b2d4ee6ed081b55
---
 lib/neutron | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 492a0ee8fb..fd08a125be 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -135,7 +135,11 @@ function configure_neutron_new {
 
     mkdir -p $NEUTRON_CORE_PLUGIN_CONF_PATH
 
-    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
+    # NOTE(yamamoto): A decomposed plugin should prepare the config file in
+    # its devstack plugin.
+    if [ -f $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample ]; then
+        cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
+    fi
 
     iniset $NEUTRON_CONF database connection `database_connection_url neutron`
     iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH

From f28e7ef6ba48030d7bc5c6ea27f28b8a1fc281e9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Sun, 7 May 2017 22:02:10 -0400
Subject: [PATCH 1896/3333] uninstall libvirt-python and reinstall

libvirt-python compiles against the currently installed libvirt. If
you upgrade that, it needs to rebuild, however it won't change
versions, so pip install just noops. Force an uninstall / reinstall of
it every time to handle potential upgrades of libvirt.

Change-Id: If34541b34aa6d55eedaf6c603fd1fe92eb887308
---
 inc/python                         | 14 ++++++++++++++
 lib/nova_plugins/functions-libvirt |  3 +++
 2 files changed, 17 insertions(+)

diff --git a/inc/python b/inc/python
index 2443c4d465..a004217b4a 100644
--- a/inc/python
+++ b/inc/python
@@ -351,6 +351,20 @@ function pip_install {
     return $result
 }
 
+function pip_uninstall {
+    local name=$1
+    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
+        local sudo_pip="env"
+    else
+        local cmd_pip
+        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        local sudo_pip="sudo -H"
+    fi
+    # don't error if we can't uninstall, it might not be there
+    $sudo_pip $cmd_pip uninstall $name || /bin/true
+}
+
 # get version of a package from global requirements file
 # get_from_global_requirements <package>
 function get_from_global_requirements {
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 47605af991..326c8bf4ae 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -67,6 +67,8 @@ function install_libvirt {
         else
             install_package libvirt-clients libvirt-daemon-system libvirt-dev
         fi
+        # uninstall in case the libvirt version changed
+        pip_uninstall libvirt-python
         pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
@@ -84,6 +86,7 @@ function install_libvirt {
         fi
 
         install_package libvirt libvirt-devel
+        pip_uninstall libvirt-python
         pip_install_gr libvirt-python
     fi
 

From db8a199b309e22f1341186517c00ec875ae421bb Mon Sep 17 00:00:00 2001
From: vmud213 <vinay50muddu@yahoo.com>
Date: Thu, 11 May 2017 09:33:43 +0000
Subject: [PATCH 1897/3333] Add files/ironic-inspector* to .gitignore

When ironic-inspector is enabled through devstack, these two files
are created which needs to be masked.

Change-Id: I7a3db6fd6197da20cca1e938727d54195957ac18
Closes-Bug: #1690105
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index d1781bc730..7967e14a19 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,7 @@ files/images
 files/pip-*
 files/get-pip.py*
 files/ir-deploy*
+files/ironic-inspector*
 local.conf
 local.sh
 localrc

From f24e29920b9ec40e924c71bbe1999e027d61390e Mon Sep 17 00:00:00 2001
From: Angel Noam <noama@mellanox.com>
Date: Thu, 11 May 2017 15:13:29 +0300
Subject: [PATCH 1898/3333] Add support for image name end with .raw

Change-Id: If3bd42825a29755fa8e68fa5661d068c6f0019d2
---
 functions | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/functions b/functions
index 8968a1861b..f842f63038 100644
--- a/functions
+++ b/functions
@@ -310,6 +310,11 @@ function upload_image {
             disk_format=qcow2
             container_format=bare
             ;;
+        *.raw)
+            image_name=$(basename "$image" ".raw")
+            disk_format=raw
+            container_format=bare
+            ;;
         *.iso)
             image_name=$(basename "$image" ".iso")
             disk_format=iso

From 2a6112ea9ab698714c6b4e92ddb829e2d4574a7c Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 12 May 2017 10:16:33 -0700
Subject: [PATCH 1899/3333] Document testing of new devstack features

At the Boston 2017 Summit I had mentioned that the pattern of using non
voting/experimental jobs was not working for getting new features into
Devstack. It is slow and leads people to being too conservative when it
comes to pushing new things in. Instead I suggested that since Devstack
changes are self testing we add the features, have change that enables
the feature, and if that changes passes we move forward with merging
(assuming code review is fine and necessary communication is done).

Document this process in the HACKING file so that we have something we
can point to when people want to add a new experimental job for every
new little thing (ipv6, tls, systemd, etc).

Change-Id: I5190cc3d3de4e81d52748347306133b5034d5531
---
 HACKING.rst | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/HACKING.rst b/HACKING.rst
index b76cb6c4a7..fc67f09a7b 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -322,7 +322,7 @@ Variables and Functions
 
 
 Review Criteria
-===============
+---------------
 
 There are some broad criteria that will be followed when reviewing
 your change
@@ -364,3 +364,26 @@ your change
 
 * **Reviewers** -- please see ``MAINTAINERS.rst`` for a list of people
   that should be added to reviews of various sub-systems.
+
+
+Making Changes, Testing, and CI
+-------------------------------
+
+Changes to Devstack are tested by automated continuous integration jobs
+that run on a variety of Linux Distros using a handful of common
+configurations. What this means is that every change to Devstack is
+self testing. One major benefit of this is that developers do not
+typically need to add new non voting test jobs to add features to
+Devstack. Instead the features can be added, then if testing passes
+with the feature enabled the change is ready to merge (pending code
+review).
+
+A concrete example of this was the switch from screen based service
+management to systemd based service management. No new jobs were
+created for this. Instead the features were added to devstack, tested
+locally and in CI using a change that enabled the feature, then once
+the enabling change was passing and the new behavior communicated and
+documented it was merged.
+
+Using this process has been proven to be effective and leads to
+quicker implementation of desired features.

From 84ce2f1c9b0e2aaba95015aea8ed9acaacb62e1b Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 9 May 2017 07:35:08 -0400
Subject: [PATCH 1900/3333] add a table of contents

Add a table of contents help readers find the information they need
without having to read all of the prose on every page. Remove the
site-map file, which doesn't appear to be linked anywhere.

Change-Id: Ib5761c9cfdd5a083df562413d727cb4ac7547c9e
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 doc/source/index.rst    |  9 +++++++++
 doc/source/site-map.rst | 24 ------------------------
 2 files changed, 9 insertions(+), 24 deletions(-)
 delete mode 100644 doc/source/site-map.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index cbd697112a..47087c5a0b 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -142,3 +142,12 @@ services, features, and configuration not present in base devstack.
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
+
+Contents
+--------
+
+.. toctree::
+   :glob:
+   :maxdepth: 2
+
+   *
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
deleted file mode 100644
index 022cc73959..0000000000
--- a/doc/source/site-map.rst
+++ /dev/null
@@ -1,24 +0,0 @@
-:orphan:
-
-.. the TOC on the front page actually makes the document a lot more
-   confusing. This lets us bury a toc which we can link in when
-   appropriate.
-
-==========
- Site Map
-==========
-
-.. toctree::
-   :glob:
-   :maxdepth: 3
-
-   overview
-   configuration
-   networking
-   plugins
-   plugin-registry
-   faq
-   development
-   hacking
-   guides
-   systemd

From 1f55d38911cec5e597e7b10cc7324804c2ba063f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 16 May 2017 08:50:53 -0700
Subject: [PATCH 1901/3333] Add systemd ulimit override function and set an
 override for NOFILE

This sets our default ulimit NOFILE to 2048, which is double what we
set things like mysql'd max_connections to.

Change-Id: I5126bed1e6b9f8c64db00eae4151ac61e47b1bf8
---
 functions | 16 ++++++++++++++++
 stack.sh  |  3 +++
 stackrc   |  3 +++
 3 files changed, 22 insertions(+)

diff --git a/functions b/functions
index f842f63038..bc2d26b496 100644
--- a/functions
+++ b/functions
@@ -720,6 +720,22 @@ function enable_kernel_bridge_firewall {
 }
 
 
+# Set a systemd system override
+#
+# This sets a system-side override in system.conf. A per-service
+# override would be /etc/systemd/system/${service}.service/override.conf
+function set_systemd_override {
+    local key="$1"
+    local value="$2"
+
+    local sysconf="/etc/systemd/system.conf"
+    iniset -sudo "${sysconf}" "Manager" "$key" "$value"
+    echo "Set systemd system override for ${key}=${value}"
+
+    sudo systemctl daemon-reload
+}
+
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/stack.sh b/stack.sh
index d6837ef5d0..e83eaea326 100755
--- a/stack.sh
+++ b/stack.sh
@@ -765,6 +765,9 @@ install_infra
 # Phase: pre-install
 run_phase stack pre-install
 
+# NOTE(danms): Set global limits before installing anything
+set_systemd_override DefaultLimitNOFILE ${ULIMIT_NOFILE}
+
 install_rpc_backend
 restart_rpc_backend
 
diff --git a/stackrc b/stackrc
index 35856ca73e..ea1bcdf3f0 100644
--- a/stackrc
+++ b/stackrc
@@ -925,6 +925,9 @@ fi
 # ``LOGDIR`` is always set at this point so it is not useful as a 'enable' for service logs
 # ``SCREEN_LOGDIR`` may be set, it is useful to enable the compat symlinks
 
+# System-wide ulimit file descriptors override
+ULIMIT_NOFILE=${ULIMIT_NOFILE:-2048}
+
 # Local variables:
 # mode: shell-script
 # End:

From 954fd1b729f792dc6cbc470285a5e147053147a8 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Tue, 16 May 2017 12:24:45 -0400
Subject: [PATCH 1902/3333] Use -y with 'pip uninstall'

'pip uninstall' will hang running stack.sh if it has to
prompt the user for input, use -y.

Change-Id: Ic94639e444b87fd3538463d5a51c01a0208a2ab2
Closes-bug: #1691172
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index a004217b4a..4c443d6a00 100644
--- a/inc/python
+++ b/inc/python
@@ -362,7 +362,7 @@ function pip_uninstall {
         local sudo_pip="sudo -H"
     fi
     # don't error if we can't uninstall, it might not be there
-    $sudo_pip $cmd_pip uninstall $name || /bin/true
+    $sudo_pip $cmd_pip uninstall -y $name || /bin/true
 }
 
 # get version of a package from global requirements file

From 8cd310d7638843f07f4c88adaf3aed9db7668073 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Tue, 16 May 2017 13:52:03 -0500
Subject: [PATCH 1903/3333] Restore log colors under devstack/systemd

One of the pending issues with the conversion to systemd was the loss of
log coloring.  It turns out that journalctl by default strips out
characters it considers "unprintable" - including the color codes
emitted by the old-style logging.  However, journalctl can be made to
print them by adding the `-a` flag.

This change makes devstack's log formatter conf settings include color
codes like the old screen-based setup used to

We also remove stackrc's setting of JOURNALCTL_F, whose usage was
removed via I6af6d1857effaf662a9d72bd394864934eacbe70.

Change-Id: I2401e267913a24d18dae355aa933072dbbdab1d8
---
 doc/source/systemd.rst | 18 +++++++++++-------
 functions              | 15 ++++++---------
 stackrc                |  2 --
 3 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index efe79e4b0c..60a7719262 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -109,6 +109,17 @@ Use higher precision time stamps::
 
   journalctl -f -o short-precise --unit devstack@n-cpu.service
 
+By default, journalctl strips out "unprintable" characters, including
+ASCII color codes. To keep the color codes (which can be interpreted by
+an appropriate terminal/pager - e.g. ``less``, the default)::
+
+  journalctl -a --unit devstack@n-cpu.service
+
+When outputting to the terminal using the default pager, long lines
+appear to be truncated, but horizontal scrolling is supported via the
+left/right arrow keys.
+
+See ``man 1 journalctl`` for more.
 
 Known Issues
 ============
@@ -137,13 +148,6 @@ system units.
 Future Work
 ===========
 
-log colorizing
---------------
-
-We lose log colorization through this process. We might want to build
-a custom colorizer that we could run journalctl output through
-optionally for people.
-
 user units
 ----------
 
diff --git a/functions b/functions
index f842f63038..9bb64cc3c4 100644
--- a/functions
+++ b/functions
@@ -616,21 +616,18 @@ function setup_systemd_logging {
     # request-id. However, there may be an eventlet interaction here,
     # so going off for now.
     USE_JOURNAL=$(trueorfalse USE_JOURNAL False)
+    local pidstr=""
     if [[ "$USE_JOURNAL" == "True" ]]; then
         iniset $conf_file $conf_section use_journal "True"
         # if we are using the journal directly, our process id is already correct
-        iniset $conf_file $conf_section logging_debug_format_suffix \
-               "{{%(funcName)s %(pathname)s:%(lineno)d}}"
     else
-        iniset $conf_file $conf_section logging_debug_format_suffix \
-               "{{(pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d}}"
+        pidstr="(pid=%(process)d) "
     fi
+    iniset $conf_file $conf_section logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
 
-    iniset $conf_file $conf_section logging_context_format_string \
-           "%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s] %(instance)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string \
-           "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
+    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 
 function setup_standard_logging_identity {
diff --git a/stackrc b/stackrc
index 35856ca73e..2a2007f581 100644
--- a/stackrc
+++ b/stackrc
@@ -100,11 +100,9 @@ USER_UNITS=$(trueorfalse False USER_UNITS)
 if [[ "$USER_UNITS" == "True" ]]; then
     SYSTEMD_DIR="$HOME/.local/share/systemd/user"
     SYSTEMCTL="systemctl --user"
-    JOURNALCTL_F="journalctl -f -o short-precise --user-unit"
 else
     SYSTEMD_DIR="/etc/systemd/system"
     SYSTEMCTL="sudo systemctl"
-    JOURNALCTL_F="journalctl -f -o short-precise --unit"
 fi
 
 

From d1fe0e62e77b2eaf711e0b4c157dc571be9ad13e Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 16 May 2017 22:27:58 -0700
Subject: [PATCH 1904/3333] Always setup libvirt for tap devices when using
 Neutron

This logic has been tied to OVS since it was introduced in [1] and
revised in [2]. However, many other backends may use tap devices that
aren't related to OVS, such as Calico[3] and Linux Bridge after [4]
merges.

This patch just removes the dependency on OVS specifically so
/dev/net/tun is added to cgroups whenever any Neutron backend is used.
This is done in other deployment tools like Juju[5] so it's not
unprecedented.

1. Ifab268f739b004db13024633e8abeb17691b9e46
2. Ic1da132fa421f1c70c10a319ee3239831b0f956f
3.
http://docs.projectcalico.org/master/getting-started/openstack/installation/ubuntu#compute-node-install
4. I23c5faaeab69aede1fd038a36f4a0b8f928498ce
5.
https://github.com/openstack/charm-nova-compute/blob/2790f81ecd32d9962617c4c3126621fffdc318a0/templates/qemu.conf

Change-Id: I075595158d8f3b5a6811c4794aa7b91912940db5
Partial-Bug: #1675343
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 326c8bf4ae..3e38b898ec 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -98,7 +98,7 @@ function install_libvirt {
 # Configures the installed libvirt system so that is accessible by
 # STACK_USER via qemu:///system with management capabilities.
 function configure_libvirt {
-    if is_service_enabled neutron && is_neutron_ovs_base_plugin && ! sudo grep -q '^cgroup_device_acl' $QEMU_CONF; then
+    if is_service_enabled neutron && ! sudo grep -q '^cgroup_device_acl' $QEMU_CONF; then
         # Add /dev/net/tun to cgroup_device_acls, needed for type=ethernet interfaces
         cat <<EOF | sudo tee -a $QEMU_CONF
 cgroup_device_acl = [

From 54a8dc291f271c6782a7381d6f981223fdabd459 Mon Sep 17 00:00:00 2001
From: Isaac Beckman <isaacb@il.ibm.com>
Date: Wed, 17 May 2017 14:18:18 +0300
Subject: [PATCH 1905/3333] cleanup: remove DEVSTACK_CINDER_SECURE_DELETE

DEVSTACK_CINDER_SECURE_DELETE is deprecated from liberty release.
This should have been removed after kilo-eol

Change-Id: I82c15a19f8fe0326d4a5c2a076baa6d3e53fcf32
---
 lib/cinder              | 14 --------------
 lib/cinder_backends/lvm |  3 ---
 2 files changed, 17 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..60379475f7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -84,20 +84,6 @@ CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
 # CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2}
 CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 
-
-# Should cinder perform secure deletion of volumes?
-# Defaults to zero. Can also be set to none or shred.
-# This was previously CINDER_SECURE_DELETE (True or False).
-# Equivalents using CINDER_VOLUME_CLEAR are zero and none, respectively.
-# Set to none to avoid this bug when testing:
-# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1023755
-if [[ -n $CINDER_SECURE_DELETE ]]; then
-    CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
-    if [[ $CINDER_SECURE_DELETE == "False" ]]; then
-        CINDER_VOLUME_CLEAR_DEFAULT="none"
-    fi
-    deprecated "Configure secure Cinder volume deletion using CINDER_VOLUME_CLEAR instead of CINDER_SECURE_DELETE."
-fi
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index d927f9cd6b..03e188029f 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -53,9 +53,6 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
-    if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
-        iniset $CINDER_CONF $be_name volume_clear none
-    fi
 }
 
 # init_cinder_backend_lvm - Initialize volume group

From fc572a5da0cad4f0f6f247abfe835a5948d3aa47 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 16 May 2017 23:04:46 +0000
Subject: [PATCH 1906/3333] Add --tcp option to dstat command for connection
 stats

This enables tcp stats (listen, established, syn, time_wait, close) in
dstat to allow us to get a high-level view of performance changes in
the system during gate runs.

Change-Id: Ifbffbed22446e7e6a3b825c18266b63d2f2e7718
---
 tools/dstat.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index ae7306ecb7..01c6d9b7e9 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -13,10 +13,10 @@
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap"
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap --tcp"
 
 # Command-line arguments for secondary background DStat process.
-DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"
+DSTAT_CSV_OPTS="-tcmndrylpg --tcp --output $LOGDIR/dstat-csv.log"
 
 # Execute and background the secondary dstat process and discard its output.
 dstat $DSTAT_CSV_OPTS >& /dev/null &

From 00ff904b09e07880a274cc9b0cf35b6433dc5877 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 19 May 2017 13:40:56 +0100
Subject: [PATCH 1907/3333] stack: Workaround libvirt issue with multiple of 16
 byte fixed_key values

Unable to use LUKS passphrase that is exactly 16 bytes long
https://bugzilla.redhat.com/show_bug.cgi?id=1447297

Change-Id: I565339762549b076119ffedb6b83abfa12977f5e
---
 stack.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 9fdb47ecbd..5b73291bcf 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1253,8 +1253,13 @@ if is_service_enabled g-reg; then
 fi
 
 # Create a randomized default value for the key manager's fixed_key
+# NOTE(lyarwood): This is currently set to 36 as a workaround to the following
+# libvirt bug that incorrectly pads passphrases that are a multiple of 16 bytes
+# in length.
+# Unable to use LUKS passphrase that is exactly 16 bytes long
+# https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 32)
+    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From 4db30f9f05ad8aba9001d444313ee2915f86ecd1 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 9 May 2017 07:35:45 -0400
Subject: [PATCH 1908/3333] update sphinx

Update sphinx to the version used to build the documentation elsewhere
and turn on the option to treat warnings as errors to ensure that no
poorly constructed rst is introduced. Cap sphinx<1.6.1, since that
version has a conflict with pbr right now.

Change-Id: I19b3332229e2094988cbf8968c42a0323194a209
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 setup.cfg | 1 +
 tox.ini   | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 3487f6541b..73d22b5268 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -15,6 +15,7 @@ classifier =
 all_files = 1
 build-dir = doc/build
 source-dir = doc/source
+warning-is-error = 1
 
 [pbr]
 warnerrors = True
diff --git a/tox.ini b/tox.ini
index 55a06d0cae..cc7c5444a8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -37,8 +37,8 @@ commands = bash -c "find {toxinidir}             \
 deps =
    Pygments
    docutils
-   sphinx>=1.1.2,<1.2
-   pbr>=0.6,!=0.7,<1.0
+   sphinx>=1.5.1,<1.6.1
+   pbr>=2.0.0,!=2.1.0
    oslosphinx
    nwdiag
    blockdiag
@@ -52,8 +52,8 @@ commands =
 
 [testenv:venv]
 deps =
-   pbr>=0.6,!=0.7,<1.0
-   sphinx>=1.1.2,<1.2
+   pbr>=2.0.0,!=2.1.0
+   sphinx>=1.5.1,<1.6.1
    oslosphinx
    blockdiag
    sphinxcontrib-blockdiag

From ac2ae8c04779e4ad78d3813b8bc4bc4200b6d686 Mon Sep 17 00:00:00 2001
From: Nir Magnezi <nmagnezi@redhat.com>
Date: Mon, 22 May 2017 12:40:57 +0300
Subject: [PATCH 1909/3333] Remove nova cert from devstack

As a followup to I2c78a0c6599b92040146cf9f0042cff8fd2509c3, the nova
cert service should be removed from devstack.

Without this fix, stacking will fail is USE_SCREEN=True

Change-Id: I115580352fa380b896bae290f9a4efbfe4ff0dfd
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 lib/nova                                     | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 21bea9973b..4ed64bf12f 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -45,7 +45,7 @@ Edit your ``local.conf`` to look like
     # Horizon
     ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
diff --git a/lib/nova b/lib/nova
index de053ab389..e580abb4b0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -878,7 +878,6 @@ function start_nova_rest {
     run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
-    run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
 
     if is_service_enabled n-net; then
         if ! running_in_container; then
@@ -929,7 +928,7 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
+    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }

From 546656fc0543ec2bc5b422fd9eee17f1b8122758 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 14 Mar 2017 07:05:19 -0400
Subject: [PATCH 1910/3333] etcd3 as a base service

ETCD_DOWNLOAD_URL is set to github url, in our CI, we can point
ETCD_DOWNLOAD_URL to a url in tarballs.openstack.org possibly
in devstack-gate

Download the etcd binaries and drop them into /opt/stack/bin and
use it from there. Cache the tgz for subsequent use (local workflow)

daemon-reload is called twice once from inside the write_user_unit_file
and then when we adjust the entries with additional things recommended
by the etcd team. We need a better way to do this in the future.

Added a TODO to verify the downloaded artifact later. The etcd team
posts gpg signature, we could verify that or run sha256sum and hard
code that in lib/etcd3 file. We would have to update it whenever we
bump the etcd3 version.

We use the public key "CoreOS Application Signing Key <security@coreos.com>"
with ID FC8A365E to verify the integrity of the downloaded file

Any jobs that need to be run on architectures where v3.1.7 is not available
should rey the v3.2.0-rcX release candidates. We can switch to v3.2.0
when it gets released.

Initial version of this code was borrowed from the dragonflow
repo:
http://git.openstack.org/cgit/openstack/dragonflow/tree/devstack

Change-Id: Ibbb430fb1dbf66942168e0cb52d990ab6a2eb8d7
---
 lib/etcd3  | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |   6 +++
 stackrc    |   2 +-
 unstack.sh |   6 +++
 4 files changed, 139 insertions(+), 1 deletion(-)
 create mode 100644 lib/etcd3

diff --git a/lib/etcd3 b/lib/etcd3
new file mode 100644
index 0000000000..fa60a392c9
--- /dev/null
+++ b/lib/etcd3
@@ -0,0 +1,126 @@
+#!/bin/bash
+#
+# lib/etcd3
+#
+# Functions to control the installation and configuration of etcd 3.x
+# that provides a key-value store (and possibly other functions).
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - start_etcd3
+# - stop_etcd3
+# - cleanup_etcd3
+
+# Save trace setting
+_XTRACE_ETCD3=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# Set up default values for etcd
+ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
+ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
+ETCD_DATA_DIR="$DEST/data/etcd"
+ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
+ETCD_BIN_DIR="$DEST/bin"
+
+if is_ubuntu ; then
+    UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
+fi
+
+# start_etcd3() - Starts to run the etcd process
+function start_etcd3 {
+    _install_etcd
+
+    local cmd="$ETCD_BIN_DIR/etcd"
+    cmd+=" --name $HOSTNAME --data-dir $ETCD_DATA_DIR"
+    cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
+    cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
+    cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
+    cmd+=" --advertise-client-urls http://$SERVICE_HOST:2379"
+    cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
+    cmd+=" --listen-client-urls http://$SERVICE_HOST:2379"
+
+    local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
+    write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"
+
+    iniset -sudo $unitfile "Unit" "After" "network.target"
+    iniset -sudo $unitfile "Service" "Type" "notify"
+    iniset -sudo $unitfile "Service" "Restart" "on-failure"
+    iniset -sudo $unitfile "Service" "LimitNOFILE" "65536"
+
+    $SYSTEMCTL daemon-reload
+    $SYSTEMCTL enable $ETCD_SYSTEMD_SERVICE
+    $SYSTEMCTL start $ETCD_SYSTEMD_SERVICE
+}
+
+# stop_etcd3() stops the etcd3 process
+function stop_etcd3 {
+    $SYSTEMCTL stop $ETCD_SYSTEMD_SERVICE
+}
+
+function cleanup_etcd {
+    $SYSTEMCTL disable $ETCD_SYSTEMD_SERVICE
+
+    local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
+    sudo rm -f $unitfile
+
+    $SYSTEMCTL daemon-reload
+
+    sudo rm -rf $ETCD_DATA_DIR
+}
+
+function _install_etcd {
+    echo "Installing etcd"
+
+    # Make sure etcd3 downloads the correct architecture
+    if is_arch "x86_64"; then
+        ETCD_ARCH="amd64"
+    elif is_arch "aarch64"; then
+        ETCD_ARCH="arm64"
+    elif is_arch "ppc64le"; then
+        ETCD_ARCH="ppc64le"
+    else
+        exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
+    fi
+
+    # Install the libraries needed. Note: tooz for example does not have a hard dependency on these libraries
+    pip_install etcd3
+    pip_install etcd3gw
+
+    # Create the necessary directories
+    sudo mkdir -p $ETCD_BIN_DIR
+    sudo mkdir -p $ETCD_DATA_DIR
+
+    # Download and cache the etcd tgz for subsequent use
+    if [ ! -f "$DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
+        mkdir -p $DEST/etcd
+        ETCD_DOWNLOAD_FILE=etcd-$ETCD_VERSION-linux-$ETCD_ARCH.tar.gz
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $DEST/etcd/$ETCD_DOWNLOAD_FILE
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE.asc -O $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc
+
+        # use gpg to verify the artifact, use a backup key server in case the first one is down for some reason
+        gpg --keyserver hkps.pool.sks-keyservers.net --recv-key FC8A365E || gpg --keyserver pgpkeys.mit.edu --recv-key FC8A365E
+        gpg --verify $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc $DEST/etcd/$ETCD_DOWNLOAD_FILE
+
+        tar xzvf $DEST/etcd/$ETCD_DOWNLOAD_FILE -C $DEST/etcd
+        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+    fi
+    if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
+        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+    fi
+}
+
+# Restore xtrace
+$_XTRACE_ETCD3
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/stack.sh b/stack.sh
index e83eaea326..ecf068a4a9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -574,6 +574,7 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm
+source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os_brick
 
 # Extras Source
@@ -1043,6 +1044,11 @@ fi
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+# Etcd
+# -----
+
+# etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines
+start_etcd3
 
 # Keystone
 # --------
diff --git a/stackrc b/stackrc
index 41ff268bbe..9203f8b5b9 100644
--- a/stackrc
+++ b/stackrc
@@ -65,7 +65,7 @@ if ! isset ENABLED_SERVICES ; then
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,etcd3,dstat
 fi
 
 # Global toggle for enabling services under mod_wsgi. If this is set to
diff --git a/unstack.sh b/unstack.sh
index 485fed7f80..a9826f5a97 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -69,6 +69,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/dlm
 
 # Extras Source
@@ -162,6 +163,11 @@ if is_service_enabled neutron; then
     cleanup_neutron
 fi
 
+if is_service_enabled etcd3; then
+    stop_etcd3
+    cleanup_etcd3
+fi
+
 if is_service_enabled dstat; then
     stop_dstat
 fi

From 0d9fd60ad4a999ba3d57042b7bc861d86126651a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20J=C3=B3zefczyk?= <maciej.jozefczyk@corp.ovh.com>
Date: Tue, 23 May 2017 10:17:48 +0200
Subject: [PATCH 1911/3333] Change version of noVNC to stable

In master branch of noVNC project file vnc_auto.html was renamed to
vnc_lite.html Because of that nova-novncproxy looks for file that
actually doesn't exist.

We need to change branch of noVNC to latest stable, because other
projects are not ready yet to rename the path. Those projects
depends on noVNC package installed in system, but it is too old
for now for both CentOS (version 0.5) and Ubuntu (version 0.4).
The only way to make noVNC console working on Devstack is to change
the branch to stable one.

Unit test also has to be modified in order to ignore novnc repo
from checking against cloning non-master branch.

Change-Id: Iaf4761aedf93bc6b914a6a0c5cf1cfedcc29583c
Closes-bug: #1692513
---
 stackrc            | 2 +-
 tests/test_refs.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index ea8b044faf..f96688bf6c 100644
--- a/stackrc
+++ b/stackrc
@@ -563,7 +563,7 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/kanaka/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-master}
+NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
diff --git a/tests/test_refs.sh b/tests/test_refs.sh
index bccca5dff7..65848cdc72 100755
--- a/tests/test_refs.sh
+++ b/tests/test_refs.sh
@@ -15,7 +15,7 @@
 
 echo "Ensuring we don't have crazy refs"
 
-REFS=`grep BRANCH stackrc | grep -v -- '-master'`
+REFS=`grep BRANCH stackrc | grep -v -- '-master' | grep -v 'NOVNC_BRANCH'`
 rc=$?
 if [[ $rc -eq 0 ]]; then
     echo "Branch defaults must be master. Found:"

From d8283fde660bee2d4a5f639197a6a7010988b269 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 23 May 2017 22:12:39 -0400
Subject: [PATCH 1912/3333] Avoid installing etcd3 in subnodes

We need to handle this better, for now, just don't install
etcd in the sub nodes. We need to setup the proper clustering
mechanism if we want to have etcd3 running in multiple nodes

Change-Id: I8dd385e3c993942473e67d04367cdf74495dbeef
---
 lib/etcd3 | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index fa60a392c9..2a4fa2a6af 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -36,6 +36,11 @@ fi
 
 # start_etcd3() - Starts to run the etcd process
 function start_etcd3 {
+    # Don't install in sub nodes (multinode scenario)
+    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
+        return
+    fi
+
     _install_etcd
 
     local cmd="$ETCD_BIN_DIR/etcd"
@@ -62,10 +67,20 @@ function start_etcd3 {
 
 # stop_etcd3() stops the etcd3 process
 function stop_etcd3 {
+    # Don't install in sub nodes (multinode scenario)
+    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
+        return
+    fi
+
     $SYSTEMCTL stop $ETCD_SYSTEMD_SERVICE
 }
 
 function cleanup_etcd {
+    # Don't install in sub nodes (multinode scenario)
+    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
+        return
+    fi
+
     $SYSTEMCTL disable $ETCD_SYSTEMD_SERVICE
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"

From 2715fd0b4acf44842ceb67760bbc348093e7d70d Mon Sep 17 00:00:00 2001
From: Lucian Petrut <lpetrut@cloudbasesolutions.com>
Date: Wed, 24 May 2017 11:31:56 +0300
Subject: [PATCH 1913/3333] Do not upload vhdx images as vhd

This change ensures that when uploading vhdx images, we use the
proper format.

At the moment, vhdx images are uploaded as vhd, which can be
troublesome: first because this is misleading, second because the
actual image format may be checked, having the image rejected.

Change-Id: I9578be41ea9dc252404b7553679ac527e08a0ff6
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 52a82faf0a..689aad074e 100644
--- a/functions
+++ b/functions
@@ -323,7 +323,7 @@ function upload_image {
         *.vhd|*.vhdx|*.vhd.gz|*.vhdx.gz)
             local extension="${image_fname#*.}"
             image_name=$(basename "$image" ".$extension")
-            disk_format=vhd
+            disk_format=$(echo $image_fname | grep -oP '(?<=\.)vhdx?(?=\.|$)')
             container_format=bare
             if [ "${image_fname##*.}" == "gz" ]; then
                 unpack=zcat

From bba924121c8ad5e95f5cf55ab489d4276dcc39b1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 24 May 2017 07:56:10 -0400
Subject: [PATCH 1914/3333] Use sha256sum instead of gpg for verification

gpg verification requires network connectivity which is non
mirrorable. We try to avoid that in devstack whenever possible. A
sha256sum is a totally reasonable way of knowing if the downloaded
package is valid.

Closes-Bug: #1693092

Change-Id: Id496ab53f76444f08dc6961f1ecd25f450cc96d7
---
 lib/etcd3 | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index fa60a392c9..15c29132be 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -29,6 +29,10 @@ ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
 ETCD_DATA_DIR="$DEST/data/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
+ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
+# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
+ETCD_SHA256_ARM64=""
+ETCD_SHA256_PPC64=""
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -82,14 +86,19 @@ function _install_etcd {
     # Make sure etcd3 downloads the correct architecture
     if is_arch "x86_64"; then
         ETCD_ARCH="amd64"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_AMD64}
     elif is_arch "aarch64"; then
         ETCD_ARCH="arm64"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_ARM64}
     elif is_arch "ppc64le"; then
         ETCD_ARCH="ppc64le"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
     else
         exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
     fi
 
+    ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
+
     # Install the libraries needed. Note: tooz for example does not have a hard dependency on these libraries
     pip_install etcd3
     pip_install etcd3gw
@@ -99,21 +108,18 @@ function _install_etcd {
     sudo mkdir -p $ETCD_DATA_DIR
 
     # Download and cache the etcd tgz for subsequent use
-    if [ ! -f "$DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
-        mkdir -p $DEST/etcd
-        ETCD_DOWNLOAD_FILE=etcd-$ETCD_VERSION-linux-$ETCD_ARCH.tar.gz
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $DEST/etcd/$ETCD_DOWNLOAD_FILE
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE.asc -O $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc
-
-        # use gpg to verify the artifact, use a backup key server in case the first one is down for some reason
-        gpg --keyserver hkps.pool.sks-keyservers.net --recv-key FC8A365E || gpg --keyserver pgpkeys.mit.edu --recv-key FC8A365E
-        gpg --verify $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc $DEST/etcd/$ETCD_DOWNLOAD_FILE
-
-        tar xzvf $DEST/etcd/$ETCD_DOWNLOAD_FILE -C $DEST/etcd
-        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+    if [ ! -f "files/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
+        ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O files/$ETCD_DOWNLOAD_FILE
+        echo "${ETCD_SHA256} files/${ETCD_DOWNLOAD_FILE}" > files/etcd.sha256sum
+        # NOTE(sdague): this should go fatal if this fails
+        sha256sum -c files/etcd.sha256sum
+
+        tar xzvf files/$ETCD_DOWNLOAD_FILE -C files
+        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
-        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
 }
 

From 94b9fae4e9f43eb1329384cbeb1977baac60846e Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Wed, 24 May 2017 13:31:13 +0200
Subject: [PATCH 1915/3333] Allow disabling etcd3

Etcd3 was enabled recently as new service in devstack [1]. But there's
no way to disable etcd3. This is required on architectures where no etcd
binaries are available (e.g. s390x). The long term goal of course should
be to have those binaries available. The short term circumvention is to
allow disabling the service in local.conf:

   disable_service etcd3

[1] https://github.com/openstack-dev/devstack/commit/546656fc0543ec2bc5b422fd9eee17f1b8122758
Change-Id: I6184ed193482dad9643ccb2b97133d4957485408
Partial-Bug: #1693192
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index ecf068a4a9..a63f6b9e7c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1048,7 +1048,9 @@ start_dstat
 # -----
 
 # etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines
-start_etcd3
+if is_service_enabled etcd3; then
+    start_etcd3
+fi
 
 # Keystone
 # --------

From c0d16c279ad2a24bd13e2dbd6ae6986c37c4f230 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Fri, 19 May 2017 10:23:46 -0400
Subject: [PATCH 1916/3333] Get rid of zookeeper from devstack

In Ibbb430fb1dbf66942168e0cb52d990ab6a2eb8d7, we are adding
etcd3 as a new base service. We should drop zookeeper
and use etcd3 as the backend.

Since cinder is the first service for this tooz+etcd3 DLM
scenario and cinder uses eventlet we have cannnot use the
grpc based driver in tooz. So new CINDER_COORDINATION_URL
that defaults to the etcd3's grpc HTTP gateway based
tooz backend.

We need to hold this change until the tooz change (see
Depends-On) is available in a tooz release.

Depends-On: I6184ed193482dad9643ccb2b97133d4957485408
Change-Id: Ia187e1a86413edf25b909b6bb57e84fb4930a696
---
 files/debs/zookeeper             |   1 -
 files/rpms/zookeeper             |   1 -
 files/zookeeper/environment      |  36 ----------
 files/zookeeper/log4j.properties |  69 -------------------
 files/zookeeper/myid             |   1 -
 files/zookeeper/zoo.cfg          |  74 ---------------------
 lib/cinder                       |   9 ++-
 lib/dlm                          | 111 -------------------------------
 stack.sh                         |   5 --
 unstack.sh                       |   1 -
 10 files changed, 4 insertions(+), 304 deletions(-)
 delete mode 100644 files/debs/zookeeper
 delete mode 100644 files/rpms/zookeeper
 delete mode 100644 files/zookeeper/environment
 delete mode 100644 files/zookeeper/log4j.properties
 delete mode 100644 files/zookeeper/myid
 delete mode 100644 files/zookeeper/zoo.cfg
 delete mode 100644 lib/dlm

diff --git a/files/debs/zookeeper b/files/debs/zookeeper
deleted file mode 100644
index f41b559007..0000000000
--- a/files/debs/zookeeper
+++ /dev/null
@@ -1 +0,0 @@
-zookeeperd
diff --git a/files/rpms/zookeeper b/files/rpms/zookeeper
deleted file mode 100644
index 1bfac538a2..0000000000
--- a/files/rpms/zookeeper
+++ /dev/null
@@ -1 +0,0 @@
-zookeeper
diff --git a/files/zookeeper/environment b/files/zookeeper/environment
deleted file mode 100644
index afa2d2f89f..0000000000
--- a/files/zookeeper/environment
+++ /dev/null
@@ -1,36 +0,0 @@
-#
-# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# Modified from http://packages.ubuntu.com/saucy/zookeeperd
-NAME=zookeeper
-ZOOCFGDIR=/etc/zookeeper/conf
-
-# seems, that log4j requires the log4j.properties file to be in the classpath
-CLASSPATH="$ZOOCFGDIR:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar"
-
-ZOOCFG="$ZOOCFGDIR/zoo.cfg"
-ZOO_LOG_DIR=/var/log/zookeeper
-USER=$NAME
-GROUP=$NAME
-PIDDIR=/var/run/$NAME
-PIDFILE=$PIDDIR/$NAME.pid
-SCRIPTNAME=/etc/init.d/$NAME
-JAVA=/usr/bin/java
-ZOOMAIN="org.apache.zookeeper.server.quorum.QuorumPeerMain"
-ZOO_LOG4J_PROP="INFO,ROLLINGFILE"
-JMXLOCALONLY=false
-JAVA_OPTS=""
diff --git a/files/zookeeper/log4j.properties b/files/zookeeper/log4j.properties
deleted file mode 100644
index 6c45a4aad9..0000000000
--- a/files/zookeeper/log4j.properties
+++ /dev/null
@@ -1,69 +0,0 @@
-#
-# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# From http://packages.ubuntu.com/saucy/zookeeperd
-
-# ZooKeeper Logging Configuration
-#
-
-# Format is "<default threshold> (, <appender>)+
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-# Example: console appender only
-# log4j.rootLogger=INFO, CONSOLE
-
-# Example with rolling log file
-#log4j.rootLogger=DEBUG, CONSOLE, ROLLINGFILE
-
-# Example with rolling log file and tracing
-#log4j.rootLogger=TRACE, CONSOLE, ROLLINGFILE, TRACEFILE
-
-#
-# Log INFO level and above messages to the console
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=INFO
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=WARN
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/zookeeper.log
-
-# Max log file size of 10MB
-log4j.appender.ROLLINGFILE.MaxFileSize=10MB
-# uncomment the next line to limit number of backup files
-#log4j.appender.ROLLINGFILE.MaxBackupIndex=10
-
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
-
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.log.dir}/zookeeper_trace.log
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/files/zookeeper/myid b/files/zookeeper/myid
deleted file mode 100644
index c227083464..0000000000
--- a/files/zookeeper/myid
+++ /dev/null
@@ -1 +0,0 @@
-0
\ No newline at end of file
diff --git a/files/zookeeper/zoo.cfg b/files/zookeeper/zoo.cfg
deleted file mode 100644
index b8f55827e3..0000000000
--- a/files/zookeeper/zoo.cfg
+++ /dev/null
@@ -1,74 +0,0 @@
-#
-# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# http://hadoop.apache.org/zookeeper/docs/current/zookeeperAdmin.html
-
-# The number of milliseconds of each tick
-tickTime=2000
-# The number of ticks that the initial
-# synchronization phase can take
-initLimit=10
-# The number of ticks that can pass between
-# sending a request and getting an acknowledgement
-syncLimit=5
-# the directory where the snapshot is stored.
-dataDir=/var/lib/zookeeper
-# Place the dataLogDir to a separate physical disc for better performance
-# dataLogDir=/disk2/zookeeper
-
-# the port at which the clients will connect
-clientPort=2181
-
-# Maximum number of clients that can connect from one client
-maxClientCnxns=60
-
-# specify all zookeeper servers
-# The fist port is used by followers to connect to the leader
-# The second one is used for leader election
-
-server.0=127.0.0.1:2888:3888
-
-# To avoid seeks ZooKeeper allocates space in the transaction log file in
-# blocks of preAllocSize kilobytes. The default block size is 64M. One reason
-# for changing the size of the blocks is to reduce the block size if snapshots
-# are taken more often. (Also, see snapCount).
-#preAllocSize=65536
-
-# Clients can submit requests faster than ZooKeeper can process them,
-# especially if there are a lot of clients. To prevent ZooKeeper from running
-# out of memory due to queued requests, ZooKeeper will throttle clients so that
-# there is no more than globalOutstandingLimit outstanding requests in the
-# system. The default limit is 1,000.ZooKeeper logs transactions to a
-# transaction log. After snapCount transactions are written to a log file a
-# snapshot is started and a new transaction log file is started. The default
-# snapCount is 10,000.
-#snapCount=1000
-
-# If this option is defined, requests will be will logged to a trace file named
-# traceFile.year.month.day.
-#traceFile=
-
-# Leader accepts client connections. Default value is "yes". The leader machine
-# coordinates updates. For higher update throughput at thes slight expense of
-# read throughput the leader can be configured to not accept clients and focus
-# on coordination.
-#leaderServes=yes
-
-# Autopurge every hour to avoid using lots of disk in bursts
-# Order of the next 2 properties matters.
-# autopurge.snapRetainCount must be before autopurge.purgeInterval.
-autopurge.snapRetainCount=3
-autopurge.purgeInterval=1
\ No newline at end of file
diff --git a/lib/cinder b/lib/cinder
index e3a687b4f2..1b4f4e6da2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -363,11 +363,10 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    # Set the backend url according to the configured dlm backend
-    if is_dlm_enabled; then
-        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
-            iniset $CINDER_CONF coordination backend_url "zookeeper://${SERVICE_HOST}:2181"
-        fi
+    if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then
+        iniset $CINDER_CONF coordination backend_url "$CINDER_COORDINATION_URL"
+    elif is_service_enabled etcd3; then
+        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:2379"
     fi
 }
 
diff --git a/lib/dlm b/lib/dlm
deleted file mode 100644
index b5ac0f5d33..0000000000
--- a/lib/dlm
+++ /dev/null
@@ -1,111 +0,0 @@
-#!/bin/bash
-#
-# lib/dlm
-#
-# Functions to control the installation and configuration of software
-# that provides a dlm (and possibly other functions). The default is
-# **zookeeper**, and is going to be the only backend supported in the
-# devstack tree.
-
-# Dependencies:
-#
-# - ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - is_dlm_enabled
-# - install_dlm
-# - configure_dlm
-# - cleanup_dlm
-
-# Save trace setting
-_XTRACE_DLM=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# <define global variables here that belong to this project>
-
-# Set up default directories
-ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
-ZOOKEEPER_CONF_DIR=/etc/zookeeper
-
-
-# Entry Points
-# ------------
-#
-# NOTE(sdague): it is expected that when someone wants to implement
-# another one of these out of tree, they'll implement the following
-# functions:
-#
-# - dlm_backend
-# - install_dlm
-# - configure_dlm
-# - cleanup_dlm
-
-# This should be declared in the settings file of any plugin or
-# service that needs to have a dlm in their environment.
-function use_dlm {
-    enable_service $(dlm_backend)
-}
-
-# A function to return the name of the backend in question, some users
-# are going to need to know this.
-function dlm_backend {
-    echo "zookeeper"
-}
-
-# Test if a dlm is enabled (defaults to a zookeeper specific check)
-function is_dlm_enabled {
-    [[ ,${ENABLED_SERVICES}, =~ ,"$(dlm_backend)", ]] && return 0
-    return 1
-}
-
-# cleanup_dlm() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_dlm {
-    # NOTE(sdague): we don't check for is_enabled here because we
-    # should just delete this regardless. Some times users updated
-    # their service list before they run cleanup.
-    sudo rm -rf $ZOOKEEPER_DATA_DIR
-}
-
-# configure_dlm() - Set config files, create data dirs, etc
-function configure_dlm {
-    if is_dlm_enabled; then
-        sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
-        sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
-        # clean up from previous (possibly aborted) runs
-        # create required data files
-        sudo rm -rf $ZOOKEEPER_DATA_DIR
-        sudo mkdir -p $ZOOKEEPER_DATA_DIR
-        # restart after configuration, there is no reason to make this
-        # another step, because having data files that don't match the
-        # zookeeper running is just going to cause tears.
-        restart_service zookeeper
-    fi
-}
-
-# install_dlm() - Collect source and prepare
-function install_dlm {
-    if is_dlm_enabled; then
-        pip_install_gr_extras tooz zookeeper
-        if is_ubuntu; then
-            install_package zookeeperd
-        elif is_fedora; then
-            install_package zookeeper
-        else
-            die $LINENO "Don't know how to install zookeeper on this platform"
-        fi
-    fi
-}
-
-# Restore xtrace
-$_XTRACE_DLM
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index ecf068a4a9..6ff2464fce 100755
--- a/stack.sh
+++ b/stack.sh
@@ -573,7 +573,6 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
-source $TOP_DIR/lib/dlm
 source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os_brick
 
@@ -772,10 +771,6 @@ set_systemd_override DefaultLimitNOFILE ${ULIMIT_NOFILE}
 install_rpc_backend
 restart_rpc_backend
 
-# NOTE(sdague): dlm install is conditional on one being enabled by configuration
-install_dlm
-configure_dlm
-
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
diff --git a/unstack.sh b/unstack.sh
index a9826f5a97..77a151f933 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -70,7 +70,6 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/etcd3
-source $TOP_DIR/lib/dlm
 
 # Extras Source
 # --------------

From c0644f39a47958a416a82f10f1091d07fec97896 Mon Sep 17 00:00:00 2001
From: Kirill Zaitsev <k.zaitsev@me.com>
Date: Wed, 24 May 2017 13:00:47 +0300
Subject: [PATCH 1917/3333] Use correct argument order in truorfalse for
 USE_JOURNAL

truorfalse function from common-functions accepts default as the first
parameter. The arguments for USE_JOURNAL were mixed up and this commit
restores correct order.

Change-Id: Id3621b0e1910a625d6cfb8e81bd27bea82543ae9
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 52a82faf0a..d3a2b5104f 100644
--- a/functions
+++ b/functions
@@ -615,7 +615,7 @@ function setup_systemd_logging {
     # native systemd path, which provides for things like search on
     # request-id. However, there may be an eventlet interaction here,
     # so going off for now.
-    USE_JOURNAL=$(trueorfalse USE_JOURNAL False)
+    USE_JOURNAL=$(trueorfalse False USE_JOURNAL)
     local pidstr=""
     if [[ "$USE_JOURNAL" == "True" ]]; then
         iniset $conf_file $conf_section use_journal "True"

From bb436d3373715253a17b6e1fd9211c2bc110a96f Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@amrith.org>
Date: Wed, 10 May 2017 08:21:04 -0400
Subject: [PATCH 1918/3333] Make use of Ubuntu Cloud Archive switchable

The trove development environment is typically a linux VM within which
openstack is installed, and trove launches guest vm's within that
environment. To make it possible for these vm's to launch in one human
lifetime, one must set vt/x and enable nested hypervisors to use with
kvm; qemu emulation will take way too long.

The new libvirtd (v2.5.0) in Ubuntu Cloud Archive doesn't handle
nested hypervisors well and if you use it, you end up with a guest
hanging on the GRUB line.

To enable that use-case, we provide ENABLE_UBUNTU_CLOUD_ARCHIVE which
the trove developer can set (to False) before running devstack.

Change-Id: Ia0265c67bb7d2a438575a03c0ddbf2d9c53266ed
Closes-Bug: #1689370
---
 stackrc              | 2 ++
 tools/fixup_stuff.sh | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 1300f45cda..f7a0c876f2 100644
--- a/stackrc
+++ b/stackrc
@@ -665,6 +665,8 @@ case "$VIRT_DRIVER" in
         ;;
 esac
 
+# By default, devstack will use Ubuntu Cloud Archive.
+ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
 
 # Images
 # ------
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d07d2675c6..0b78bdeb00 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -72,7 +72,10 @@ fi
 # We've found that Libvirt on Xenial is flaky and crashes enough to be
 # a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
 # get newer Libvirt.
-if [[ "$DISTRO" = "xenial" ]]; then
+# Make it possible to switch this based on an environment variable as
+# libvirt 2.5.0 doesn't handle nested virtualization quite well and this
+# is required for the trove development environment.
+if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; then
     # This pulls in apt-add-repository
     install_package "software-properties-common"
     # Use UCA for newer libvirt. Should give us libvirt 2.5.0.

From 853b475bfd79621ce7189b133625cb404d618efb Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 25 May 2017 13:03:10 -0400
Subject: [PATCH 1919/3333] Fix typo

should be etcd3

Change-Id: Icfa24654699a4e4e4be8a53f7bbe4634badbff7b
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index d62214c111..5cab3f556a 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -79,7 +79,7 @@ function stop_etcd3 {
     $SYSTEMCTL stop $ETCD_SYSTEMD_SERVICE
 }
 
-function cleanup_etcd {
+function cleanup_etcd3 {
     # Don't install in sub nodes (multinode scenario)
     if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
         return

From e123edeebf1559731b451cec0fd3c06ff974bbf2 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 23 May 2017 15:53:48 -0400
Subject: [PATCH 1920/3333] Add global_request_id to systemd logs

With cinder supporting this now, start logging global_request_id in
systemd logs. It will be None for all the services until the work
starts coming together, but it is safe to do.

Change-Id: Ic6ba1a42da88c03e43d89658b453f6a0b353e0db
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 52a82faf0a..ebc4c282d3 100644
--- a/functions
+++ b/functions
@@ -625,7 +625,7 @@ function setup_systemd_logging {
     fi
     iniset $conf_file $conf_section logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
 
-    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }

From d0db62a476e29355ca08db0237295139c8fce4f6 Mon Sep 17 00:00:00 2001
From: Kirill Zaitsev <k.zaitsev@me.com>
Date: Fri, 26 May 2017 19:02:52 +0300
Subject: [PATCH 1921/3333] Use systemd-tmpfiles to create /var/run/uwsgi

On ubuntu contents of /var/run do not persist between reboots. Devstack
uses /var/run/uwsgi as home for wsgi sockets. This means that after
rebooting the machine services, that rely on uwsgi would fail to start.
Currently it affects keystone.service and placement-api.service.
This patch changes delegates directory creation to systemd-tmpfiles,
which would run on startup.

Change-Id: I27d168cea93698739ef08ac76c828695a49176c7
Closes-Bug: #1692767
---
 lib/apache | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 34ac660266..3be6c1dbb1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -229,7 +229,13 @@ function write_uwsgi_config {
     # create a home for the sockets; note don't use /tmp -- apache has
     # a private view of it on some platforms.
     local socket_dir='/var/run/uwsgi'
-    sudo install -d -o $STACK_USER -m 755 $socket_dir
+
+    # /var/run will be empty on ubuntu after reboot, so we can use systemd-temptiles
+    # to automatically create $socket_dir.
+    sudo mkdir -p /etc/tmpfiles.d/
+    echo "d $socket_dir 0755 $STACK_USER root" | sudo tee /etc/tmpfiles.d/uwsgi.conf
+    sudo systemd-tmpfiles --create /etc/tmpfiles.d/uwsgi.conf
+
     local socket="$socket_dir/${name}.socket"
 
     # always cleanup given that we are using iniset here

From de8580691d133fb8ad479ef53008d197e651332b Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Wed, 24 May 2017 18:42:33 +0000
Subject: [PATCH 1922/3333] Expose etcd port as a variable

This allows devstack plugins to retrieve the etcd port from devstack
instead of hard-coding it.

Change-Id: I106b559b8ac0fb99a0426bce97a27f67e32d264d
---
 lib/etcd3 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index d62214c111..5472926f64 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -33,6 +33,7 @@ ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3
 # NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
 ETCD_SHA256_ARM64=""
 ETCD_SHA256_PPC64=""
+ETCD_PORT=2379
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -52,9 +53,9 @@ function start_etcd3 {
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
     cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
     cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
-    cmd+=" --advertise-client-urls http://$SERVICE_HOST:2379"
+    cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
     cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
-    cmd+=" --listen-client-urls http://$SERVICE_HOST:2379"
+    cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From fabc976e41ae1d036403403719aac42f111caa35 Mon Sep 17 00:00:00 2001
From: root <root@localhost.localdomain>
Date: Sat, 27 May 2017 15:01:16 +0800
Subject: [PATCH 1923/3333] Fix configuration link syntax error

The configuration guide link has syntax problem in README.rst,
and the click the link will lead to page 404.

Fix the syntax problem

Change-Id: I47a1641a6898930dca508cdac98b1b43c05dc446
---
 README.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.rst b/README.rst
index dfa68b927f..b4240bdc91 100644
--- a/README.rst
+++ b/README.rst
@@ -92,5 +92,5 @@ DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
 by reading the `configuration guide
-<https://docs.openstack.org/developer/devstack/configuration.html>_`
+<https://docs.openstack.org/developer/devstack/configuration.html>`_
 for details of the configuration file and the many available options.

From 4baac6572573945f49b3b3df7b7ea27f15955477 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 27 May 2017 20:53:20 -0700
Subject: [PATCH 1924/3333] Use proper python when configuring certs

We have to do silly overrides of cert locations for requests for
reasons. If we are running under python3 then we were previously looking
in the wrong location for the requests certs. Update the cert fixing
function to properly use python3 to find the certs if python3 is
enabled.

Change-Id: Id1369da0d812edcf9b1204e9c567f8bfe77c48b2
---
 lib/tls  | 3 ++-
 stack.sh | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 7c6b967bc4..65c2cba300 100644
--- a/lib/tls
+++ b/lib/tls
@@ -345,7 +345,8 @@ function make_root_CA {
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy; then
         local capath
-        capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
+        local python_cmd=${1:-python}
+        capath=$($python_cmd -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
 
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
diff --git a/stack.sh b/stack.sh
index 7a24ed947f..1615b1c046 100755
--- a/stack.sh
+++ b/stack.sh
@@ -888,6 +888,9 @@ fi
 
 if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
+    if python3_enabled ; then
+        fix_system_ca_bundle_path python3
+    fi
 fi
 
 # Extras Install

From 309b99ebcfa9d8bcf18c1d3eed1e52787c63f8c7 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 23 May 2017 15:18:31 -0400
Subject: [PATCH 1925/3333] Add a function to get an available random port

This commit adds a new function get_random_port to return a randomly
available port from the local port range.

Change-Id: Icaed180cc14602a74cdb3fd3456b690d8a4c729c
---
 functions | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/functions b/functions
index 52a82faf0a..4d2703f150 100644
--- a/functions
+++ b/functions
@@ -732,6 +732,24 @@ function set_systemd_override {
     sudo systemctl daemon-reload
 }
 
+# Get a random port from the local port range
+#
+# This function returns an available port in the local port range. The search
+# order is not truly random, but should be considered a random value by the
+# user because it depends on the state of your local system.
+function get_random_port {
+    read lower_port upper_port < /proc/sys/net/ipv4/ip_local_port_range
+    while true; do
+        for (( port = upper_port ; port >= lower_port ; port-- )); do
+            sudo lsof -i ":$port" &> /dev/null
+            if [[ $? > 0 ]] ; then
+                break 2
+            fi
+        done
+    done
+    echo $port
+}
+
 
 # Restore xtrace
 $_XTRACE_FUNCTIONS

From e6217a9719b88b550ccbbce7c9bc064cb746c1a3 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 24 Apr 2017 16:49:04 -0400
Subject: [PATCH 1926/3333] Use uwsgi for glance-api

This commit adds support for deploying glance as a wsgi script under
uwsgi. To get around limitations in the uwsgi protocol when using
python3 for chunked encoding we have to setup uwsgi in http mode on a
random port listening on localhost and use mod_proxy to forward the
incoming requests. The alternative approach of having apache buffer the
requests locally with the send_cl option with mod_proxy_uwsgi only
worked on python2 and also has the limitation that apache is buffering
the entire chunked object, which could be several gigabytes in size.

Depends-On: I089a22a4be4227a551c32442dba27c426f54c87d
Change-Id: Ie98fb7da5e8ecfa49cd680b88139cb7034d5f88f
---
 lib/apache | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/cinder |  2 +-
 lib/glance | 39 ++++++++++++++++++++++++++++-----------
 lib/nova   |  2 +-
 4 files changed, 83 insertions(+), 14 deletions(-)

diff --git a/lib/apache b/lib/apache
index 34ac660266..f2de7f2ea9 100644
--- a/lib/apache
+++ b/lib/apache
@@ -260,12 +260,64 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
+        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
 }
 
+# For services using chunked encoding, the only services known to use this
+# currently are Glance and Swift, we need to use an http proxy instead of
+# mod_proxy_uwsgi because the chunked encoding gets dropped. See:
+# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
+# but that involves having apache buffer the request before sending it to
+# uswgi.
+function write_local_uwsgi_http_config {
+    local file=$1
+    local wsgi=$2
+    local url=$3
+    name=$(basename $wsgi)
+
+    # create a home for the sockets; note don't use /tmp -- apache has
+    # a private view of it on some platforms.
+
+    # always cleanup given that we are using iniset here
+    rm -rf $file
+    iniset "$file" uwsgi wsgi-file "$wsgi"
+    port=$(get_random_port)
+    iniset "$file" uwsgi http "127.0.0.1:$port"
+    iniset "$file" uwsgi processes $API_WORKERS
+    # This is running standalone
+    iniset "$file" uwsgi master true
+    # Set die-on-term & exit-on-reload so that uwsgi shuts down
+    iniset "$file" uwsgi die-on-term true
+    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi enable-threads true
+    iniset "$file" uwsgi plugins python
+    # uwsgi recommends this to prevent thundering herd on accept.
+    iniset "$file" uwsgi thunder-lock true
+    # Override the default size for headers from the 4k default.
+    iniset "$file" uwsgi buffer-size 65535
+    # Make sure the client doesn't try to re-use the connection.
+    iniset "$file" uwsgi add-header "Connection: close"
+    # This ensures that file descriptors aren't shared between processes.
+    iniset "$file" uwsgi lazy-apps true
+    iniset "$file" uwsgi chmod-socket 666
+    iniset "$file" uwsgi http-raw-body true
+    iniset "$file" uwsgi http-chunked-input true
+    iniset "$file" uwsgi http-auto-chunked true
+
+    enable_apache_mod proxy
+    enable_apache_mod proxy_http
+    local apache_conf=""
+    apache_conf=$(apache_site_config_for $name)
+    echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
+    enable_apache_site $name
+    restart_apache_server
+}
+
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/cinder b/lib/cinder
index e3a687b4f2..dc6f443051 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -347,7 +347,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
-    iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
diff --git a/lib/glance b/lib/glance
index d6438a6b48..19564183cd 100644
--- a/lib/glance
+++ b/lib/glance
@@ -71,6 +71,16 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
+# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
+# TODO(mtreinish): Remove the eventlet path here and in all the similar
+# conditionals below after the Pike release
+if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
+else
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+fi
 
 # Functions
 # ---------
@@ -103,16 +113,13 @@ function configure_glance {
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
-    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -140,8 +147,6 @@ function configure_glance {
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
-    iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
         iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
@@ -198,7 +203,6 @@ function configure_glance {
     setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
-
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
@@ -231,6 +235,13 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+    else
+        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -255,7 +266,7 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+            "$GLANCE_URL"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
@@ -320,15 +331,21 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        fi
         start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
-    run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
+    else
+        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    fi
 
-    echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
+    echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
         die $LINENO "g-api did not start"
     fi
 }
diff --git a/lib/nova b/lib/nova
index de053ab389..f9cad2551d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -574,7 +574,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From 35649ae0d2a356c310fd92f16356bdd086cab290 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 27 May 2017 17:52:55 -0700
Subject: [PATCH 1927/3333] Make stack.sh work on SUSE

This adds packages to suse for systemd python linkages as well as
apache2 and which. And configures mod_proxy and mod_proxy_uwsgi with
a2enmod.

We also properly query if apache mods are enabled to avoid running
into systemd service restart limits. Enable mod_version across the board
as we use it and it may not be enabled by default (like in SUSE).

Also in addition to enabling mod_ssl we enable the SSL flag so that TLS
will work...

Finally we tell the system to trust the devstack CA.

Change-Id: I3442cebfb2e7c2550733eb95a12fab42e1229ce7
---
 files/rpms-suse/general |  4 ++++
 lib/apache              | 15 ++++++++++++---
 lib/tls                 | 12 ++++++++++++
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 1044c25288..370f2409f7 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -1,3 +1,5 @@
+apache2
+apache2-devel
 bc
 bridge-utils
 ca-certificates-mozilla
@@ -23,9 +25,11 @@ python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
 python-xml
 screen
+systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
 util-linux
 wget
+which
 zlib-devel
diff --git a/lib/apache b/lib/apache
index 34ac660266..43d5000808 100644
--- a/lib/apache
+++ b/lib/apache
@@ -53,8 +53,15 @@ APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 function enable_apache_mod {
     local mod=$1
     # Apache installation, because we mark it NOPRIME
-    if is_ubuntu || is_suse ; then
-        if ! a2query -m $mod ; then
+    if is_ubuntu; then
+        # Skip mod_version as it is not a valid mod to enable
+        # on debuntu, instead it is built in.
+        if [[ "$mod" != "version" ]] && ! a2query -m $mod ; then
+            sudo a2enmod $mod
+            restart_apache_server
+        fi
+    elif is_suse; then
+        if ! a2enmod -q $mod ; then
             sudo a2enmod $mod
             restart_apache_server
         fi
@@ -96,7 +103,7 @@ function install_apache_uwsgi {
     # delete the temp directory
     sudo rm -rf $dir
 
-    if is_ubuntu; then
+    if is_ubuntu || is_suse ; then
         # we've got to enable proxy and proxy_uwsgi for this to work
         sudo a2enmod proxy
         sudo a2enmod proxy_uwsgi
@@ -171,6 +178,8 @@ function apache_site_config_for {
 # enable_apache_site() - Enable a particular apache site
 function enable_apache_site {
     local site=$@
+    # Many of our sites use mod version. Just enable it.
+    enable_apache_mod version
     if is_ubuntu; then
         sudo a2ensite ${site}
     elif is_fedora || is_suse; then
diff --git a/lib/tls b/lib/tls
index 238687c5dd..de7a3affa1 100644
--- a/lib/tls
+++ b/lib/tls
@@ -212,6 +212,9 @@ function init_CA {
     if is_fedora; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
         sudo update-ca-trust
+    elif is_suse; then
+        sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/trust/anchors/devstack-chain.pem
+        sudo update-ca-certificates
     elif is_ubuntu; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/local/share/ca-certificates/devstack-int.crt
         sudo cp $ROOT_CA_DIR/cacert.pem /usr/local/share/ca-certificates/devstack-root.crt
@@ -354,6 +357,9 @@ function fix_system_ca_bundle_path {
             elif is_ubuntu; then
                 sudo rm -f $capath
                 sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
+            elif is_suse; then
+                sudo rm -f $capath
+                sudo ln -s /etc/ssl/ca-bundle.pem $capath
             else
                 echo "Don't know how to set the CA bundle, expect the install to fail."
             fi
@@ -416,6 +422,9 @@ function enable_mod_ssl {
 
     if is_ubuntu; then
         sudo a2enmod ssl
+    elif is_suse; then
+        sudo a2enmod ssl
+        sudo a2enflag SSL
     elif is_fedora; then
         # Fedora enables mod_ssl by default
         :
@@ -522,6 +531,9 @@ $listen_string
     LogFormat "%v %h %l %u %t \"%r\" %>s %b"
 </VirtualHost>
 EOF
+    if is_suse ; then
+        sudo a2enflag SSL
+    fi
     for mod in ssl proxy proxy_http; do
         enable_apache_mod $mod
     done

From 14728c7a51c56141eafbf58617814680887c6690 Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Mon, 29 May 2017 15:39:21 +0200
Subject: [PATCH 1928/3333] docs: add "kvm on s390x" specific configuration in
 `local.conf`

The upstream CI runs exclusively on nodes with x86 architectures, but
OpenStack supports even more platforms. One of them is the KVM
on s390x (IBM z systems), which is supported since the *Kilo* release.
This change describes the additional settings in the ``local.conf`` file
to enable Devstack on that platform. This is useful for PoCs.

Change-Id: I943b552ca2e36210ac57f36c16db930eb5e58623
---
 doc/source/configuration.rst | 60 ++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 66b8702f76..064bf515e6 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -195,6 +195,9 @@ will not be set if there is no IPv6 address on the default Ethernet interface.
 Setting it here also makes it available for ``openrc`` to set ``OS_AUTH_URL``.
 ``HOST_IPV6`` is not set by default.
 
+For architecture specific configurations which differ from the x86 default
+here, see `arch-configuration`_.
+
 Historical Notes
 ================
 
@@ -749,3 +752,60 @@ overridden by setting them in the ``localrc`` section.
     ::
 
         TERMINATE_TIMEOUT=30
+
+
+.. _arch-configuration:
+
+Architectures
+-------------
+
+The upstream CI runs exclusively on nodes with x86 architectures, but
+OpenStack supports even more architectures. Some of them need to configure
+Devstack in a certain way.
+
+KVM on s390x (IBM z Systems)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+KVM on s390x (IBM z Systems) is supported since the *Kilo* release. For
+an all-in-one setup, these minimal settings in the ``local.conf`` file
+are needed::
+
+    [[local|localrc]]
+    ADMIN_PASSWORD=secret
+    DATABASE_PASSWORD=$ADMIN_PASSWORD
+    RABBIT_PASSWORD=$ADMIN_PASSWORD
+    SERVICE_PASSWORD=$ADMIN_PASSWORD
+
+    DOWNLOAD_DEFAULT_IMAGES=False
+    IMAGE_URLS="https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-s390x-disk1.img"
+
+    enable_service n-sproxy
+    disable_service n-novnc
+    disable_service etcd3  # https://bugs.launchpad.net/devstack/+bug/1693192
+
+    [[post-config|$NOVA_CONF]]
+
+    [serial_console]
+    base_url=ws://$HOST_IP:6083/  # optional
+
+Reasoning:
+
+* The default image of Devstack is x86 only, so we deactivate the download
+  with ``DOWNLOAD_DEFAULT_IMAGES``. The referenced guest image
+  in the code above (``IMAGE_URLS``) serves as an example. The list of
+  possible s390x guest images is not limited to that.
+
+* This platform doesn't support a graphical console like VNC or SPICE.
+  The technical reason is the missing framebuffer on the platform. This
+  means we rely on the substitute feature *serial console* which needs the
+  proxy service ``n-sproxy``. We also disable VNC's proxy ``n-novnc`` for
+  that reason . The configuration in the ``post-config`` section is only
+  needed if you want to use the *serial console* outside of the all-in-one
+  setup.
+
+* The service ``etcd3`` needs to be disabled as long as bug report
+  https://bugs.launchpad.net/devstack/+bug/1693192 is not resolved.
+
+.. note:: To run *Tempest* against this *Devstack* all-in-one, you'll need
+   to use a guest image which is smaller than 1GB when uncompressed.
+   The example image from above is bigger than that!

From 2dfca047d97d4867048dbc9eec34b6f7ff54655e Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 25 May 2017 14:57:19 -0700
Subject: [PATCH 1929/3333] Don't run and check c-api if it is disabled

Previously we didn't block out the c-api startup code because the
devstack functions to start services check that for us. However, since
the cinder devstack code checks the service is up and runs the tls proxy
if tls is enabled we need to block it all off to avoid doing those
things if c-api is disabled.

Change-Id: I1c4f22f785af96caaf4baa21ff28714b9afd3458
---
 lib/cinder | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index e3a687b4f2..f36c179cf2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -512,17 +512,24 @@ function start_cinder {
         fi
     fi
 
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        enable_apache_site osapi-volume
-        restart_apache_server
-        tail_log c-api /var/log/$APACHE_NAME/c-api.log
-    else
-        run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-    fi
+    if is_service_enabled c-api ; then
+        if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+            enable_apache_site osapi-volume
+            restart_apache_server
+            tail_log c-api /var/log/$APACHE_NAME/c-api.log
+        else
+            run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
+        fi
 
-    echo "Waiting for Cinder API to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-        die $LINENO "c-api did not start"
+        echo "Waiting for Cinder API to start..."
+        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
+            die $LINENO "c-api did not start"
+        fi
+
+        # Start proxies if enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
+        fi
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
@@ -532,11 +539,6 @@ function start_cinder {
     # NOTE(jdg): For cinder, startup order matters.  To ensure that repor_capabilities is received
     # by the scheduler start the cinder-volume service last (or restart it) after the scheduler
     # has started.  This is a quick fix for lp bug/1189595
-
-    # Start proxies if enabled
-    if is_service_enabled c-api && is_service_enabled tls-proxy; then
-        start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
-    fi
 }
 
 # stop_cinder() - Stop running processes

From 29ec28216f91eab118134b5444e0276ef845e0d0 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Tue, 30 May 2017 14:21:39 -0500
Subject: [PATCH 1930/3333] Configure volume_clear setting per backend

volume_clear is currently set in the DEFAULT section,
but this is a backend specific setting, and therefore
needs to be set in the backend config section.

Change-Id: Ifa3a659bb4768b8915a0f23e7f14b0f3348d93d2
---
 lib/cinder | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2f302c0204..762edc4393 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -289,6 +289,9 @@ function configure_cinder {
                 default_name=$be_name
             fi
             enabled_backends+=$be_name,
+
+            iniset $CINDER_CONF $be_name volume_clear $CINDER_VOLUME_CLEAR
+
         done
         iniset $CINDER_CONF DEFAULT enabled_backends ${enabled_backends%,*}
         if [[ -n "$default_name" ]]; then
@@ -318,8 +321,6 @@ function configure_cinder {
 
     iniset_rpc_backend cinder $CINDER_CONF
 
-    iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
-
     # Format logging
     setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 

From 6f962a2ee5e131282b1e2bc117784ae41b083cad Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <rodolfo.alonso.hernandez@intel.com>
Date: Wed, 31 May 2017 11:00:08 +0100
Subject: [PATCH 1931/3333] Change "files" directory in etcd project

Function "_install_etcd" is trying to use "files" directory
to download a file. Instead of this, this directory should be
$FILES, which is defined previously in parent script.

TrivialFix
Change-Id: I643ce3b9aba1f65f03524430c748bf120d071509
---
 lib/etcd3 | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 5cab3f556a..a1a2ac6a74 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -123,18 +123,18 @@ function _install_etcd {
     sudo mkdir -p $ETCD_DATA_DIR
 
     # Download and cache the etcd tgz for subsequent use
-    if [ ! -f "files/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
+    if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
         ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O files/$ETCD_DOWNLOAD_FILE
-        echo "${ETCD_SHA256} files/${ETCD_DOWNLOAD_FILE}" > files/etcd.sha256sum
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
+        echo "${ETCD_SHA256} $FILES/${ETCD_DOWNLOAD_FILE}" > $FILES/etcd.sha256sum
         # NOTE(sdague): this should go fatal if this fails
-        sha256sum -c files/etcd.sha256sum
+        sha256sum -c $FILES/etcd.sha256sum
 
-        tar xzvf files/$ETCD_DOWNLOAD_FILE -C files
-        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        tar xzvf $FILES/$ETCD_DOWNLOAD_FILE -C $FILES
+        sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
-        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
 }
 

From 07b3bc24a3dc30cf4ec7ab2448128bf5a07fbfc0 Mon Sep 17 00:00:00 2001
From: gong yong sheng <gong.yongsheng@99cloud.net>
Date: Mon, 5 Jun 2017 14:02:28 +0800
Subject: [PATCH 1932/3333] Change restart Always to always

Change-Id: I1cb00cc012eda72ff50e958ba1fb04daeac69e26
Closes-bug: #1695822
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 30933ea4c2..26d1c28cac 100644
--- a/functions-common
+++ b/functions-common
@@ -1468,7 +1468,7 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "Type" "notify"
     iniset -sudo $unitfile "Service" "KillSignal" "SIGQUIT"
-    iniset -sudo $unitfile "Service" "Restart" "Always"
+    iniset -sudo $unitfile "Service" "Restart" "always"
     iniset -sudo $unitfile "Service" "NotifyAccess" "all"
     iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
 

From 1ade00da55cfc383b4832f8da03df01001b40fcd Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 5 Jun 2017 11:01:45 -0400
Subject: [PATCH 1933/3333] Fix scheduler_default_filters usage

The scheduler_default_filters config option moved out of the
DEFAULT option group into a more specific group, and the old
option is deprecated as a result so we need to update our usage.

Change-Id: I5d6574d19c3f16abadddb19f34cb645dcdcc07f4
---
 lib/nova                         | 2 +-
 lib/nova_plugins/hypervisor-fake | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index e580abb4b0..9c3ba33013 100644
--- a/lib/nova
+++ b/lib/nova
@@ -454,7 +454,7 @@ function create_nova_conf {
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
-    iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
+    iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index f9b95c1816..49c8dee83a 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -49,7 +49,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT quota_security_groups -1
     iniset $NOVA_CONF DEFAULT quota_security_group_rules -1
     iniset $NOVA_CONF DEFAULT quota_key_pairs -1
-    iniset $NOVA_CONF DEFAULT scheduler_default_filters "RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter,RamFilter,DiskFilter"
+    iniset $NOVA_CONF filter_scheduler enabled_filters "RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter,RamFilter,DiskFilter"
 }
 
 # install_nova_hypervisor() - Install external components

From 7a74c2ab24dc7083996df5c9ed7baf89cbf219f3 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Mon, 5 Jun 2017 16:06:06 +0000
Subject: [PATCH 1934/3333] Start placement before services that might like to
 use it

Otherwise those services, notably n-cpu, will try to register
resource providers before placement is ready.

Change-Id: I89fd4fa42baf3d19ee209c59cd85b97adb97c58b
Closes-Bug: #1695634
---
 stack.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 048acf8e52..24f534d2a5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1300,6 +1300,13 @@ elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF floating create --ip_range=$TEST_FLOATING_RANGE --pool=$TEST_FLOATING_POOL
 fi
 
+# Start placement before any of the service that are likely to want
+# to use it to manage resource providers.
+if is_service_enabled placement; then
+    echo_summary "Starting Placement"
+    start_placement
+fi
+
 if is_service_enabled neutron; then
     start_neutron
 fi
@@ -1314,10 +1321,6 @@ if is_service_enabled nova; then
     start_nova
     create_flavors
 fi
-if is_service_enabled placement; then
-    echo_summary "Starting Placement"
-    start_placement
-fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
     start_cinder

From e28db4c2f297c8438fdc614954339f9178c07d54 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 1 Jun 2017 16:07:32 -0700
Subject: [PATCH 1935/3333] Set swift functest config when using tls

Because the swift functests (which use test.conf) run out of a
virtualenv they don't get access to the system wide trust of the
devstack CA. Handle this by explicitly configuring the cafile to trust
in the test.conf file.

We also set the web_front_end to apache2 as that is what is terminating
TLS for us. The tests handle different web server behaviors using this
flag.

Swift's functests will need to read these values in and properly
configure things on its end.

Change-Id: I4cdba36ccab6acd76205184882ee29e4f1e12333
---
 lib/swift | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/swift b/lib/swift
index 8fad6b8f97..79ead6c104 100644
--- a/lib/swift
+++ b/lib/swift
@@ -541,6 +541,10 @@ EOF
         else
             iniset ${testfile} func_test auth_prefix /identity/v2.0/
         fi
+        if is_service_enabled tls-proxy; then
+            iniset ${testfile} func_test cafile ${SSL_BUNDLE_FILE}
+            iniset ${testfile} func_test web_front_end apache2
+        fi
     fi
 
     local user_group

From e61e19ee82b8b35decdaa4151aa9d4762b8153cb Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 27 May 2017 23:43:05 +0200
Subject: [PATCH 1936/3333] Enable opensuse-42.2 as a tested distro

openSUSE 42.2 passes testing on the experimental gate and
in order to add it as continuosly tested target we need to
add it to the positive list of tested distributions.

Change-Id: I46f94cfad828534f324994c3d21bddff40e8f9a2
---
 stack.sh                 | 2 +-
 tools/install_prereqs.sh | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 83da1c61cb..8989ad6141 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index da59093581..a77eae6fe7 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -60,6 +60,14 @@ export_proxy_variables
 # Install Packages
 # ================
 
+if [[ "${DISTRO}" == "opensuse-42.2" ]]; then
+    # temporary workaround until https://bugzilla.suse.com/show_bug.cgi?id=1041161 is fixed
+    sudo zypper ar -f http://download.opensuse.org/update/leap/42.2-test/ leap42.2-test-updates
+    sudo zypper --non-interactive --gpg-auto-import-keys --no-gpg-checks ref
+    sudo zypper --non-interactive install liberasurecode-devel
+    sudo zypper rr leap42.2-test-updates
+fi
+
 # Install package requirements
 PACKAGES=$(get_packages general,$ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"

From f4dbd12f78236c7c98b68d7841783ed29d6e77d7 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 31 May 2017 13:17:22 -0700
Subject: [PATCH 1937/3333] Set specified header size when enabling tls-proxy

As part of getting swift's functional testing to work properly through
the tls-proxy we need to increase the allowed request header size in
apache. This was a non issue without tls proxy as requests hit the
eventlet webserver directly which was configured via the swift config
which sets this relatively large limit (by default devstack configures
swift to have a header size limit of 16384).

Now we pass in an optional parameter to start_tls_proxy that includes
the desired header size. lib/swift then passes in the value it also
configures in its swift.conf.

If not explicitly set we default to 8190 which is apache2's default.

Change-Id: Ib2811c8d3cbb49cf94b70294788526b15a798edd
---
 lib/swift | 2 +-
 lib/tls   | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 8fad6b8f97..8769e98cd8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -837,7 +837,7 @@ function start_swift {
 
     if is_service_enabled tls-proxy; then
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
-        start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
+        start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT $SWIFT_MAX_HEADER_SIZE
     fi
     run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
 
diff --git a/lib/tls b/lib/tls
index 65c2cba300..3f59d5b8a3 100644
--- a/lib/tls
+++ b/lib/tls
@@ -485,6 +485,8 @@ function start_tls_proxy {
     local f_port=$3
     local b_host=$4
     local b_port=$5
+    # 8190 is the default apache size.
+    local f_header_size=${6:-8190}
 
     tune_apache_connections
 
@@ -512,6 +514,11 @@ $listen_string
     # ('Connection aborted.', BadStatusLine("''",)) error
     KeepAlive Off
 
+    # This increase in allowed request header sizes is required
+    # for swift functional testing to work with tls enabled. It is 2 bytes
+    # larger than the apache default of 8190.
+    LimitRequestFieldSize $f_header_size
+
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=0 nocanon
         ProxyPassReverse http://$b_host:$b_port/

From aefc926cd45b2dc74d98f89e3a3b4cc92f2090ff Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 31 May 2017 15:39:48 -0400
Subject: [PATCH 1938/3333] Support installing os-traits from git

This will be used in a src job for running os-traits changes
in a dsvm/tempest setup.

Change-Id: I3c4433fb1ca2787e96b577a15d584b625c364ef3
---
 lib/oslo                     | 6 ++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 2895503de6..d15a3031a2 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -54,6 +54,11 @@ GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
+# TODO(mriedem): This is a common pattern so even though os-traits isn't
+# officially an oslo library, it is nice to re-use this script for non-oslo
+# things like os-traits. We should rename this script to be more generic
+# and then fold os-brick into it also.
+GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -104,6 +109,7 @@ function install_oslo {
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
     _do_install_oslo_lib "tooz"
+    _do_install_oslo_lib "os-traits"
 }
 
 # Restore xtrace
diff --git a/stackrc b/stackrc
index e9b8df2131..6d11589f11 100644
--- a/stackrc
+++ b/stackrc
@@ -570,6 +570,10 @@ GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git
 GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-master}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
+# os-traits library for resource provider traits in the placement service
+GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
+GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-master}
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 608ef6ae91..1f2d3c23b8 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -39,7 +39,7 @@ ALL_LIBS+=" oslo.serialization django_openstack_auth"
 ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
-ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
+ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"

From bbf14db3a7cb72703ee19040e29242ed128ddf0f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 6 Jun 2017 23:28:26 +0200
Subject: [PATCH 1939/3333] Remove temporary openSUSE-42.2 workaround

We required initially 42.2 test updates to be enabled as the
liberasurecode-devel update wasn't released. It is now released
so we can stop pulling that part in.

Change-Id: I4e514e317da8a95809593a49c6dce619bc4c021f
---
 tools/install_prereqs.sh | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index a77eae6fe7..da59093581 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -60,14 +60,6 @@ export_proxy_variables
 # Install Packages
 # ================
 
-if [[ "${DISTRO}" == "opensuse-42.2" ]]; then
-    # temporary workaround until https://bugzilla.suse.com/show_bug.cgi?id=1041161 is fixed
-    sudo zypper ar -f http://download.opensuse.org/update/leap/42.2-test/ leap42.2-test-updates
-    sudo zypper --non-interactive --gpg-auto-import-keys --no-gpg-checks ref
-    sudo zypper --non-interactive install liberasurecode-devel
-    sudo zypper rr leap42.2-test-updates
-fi
-
 # Install package requirements
 PACKAGES=$(get_packages general,$ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"

From a40e036d808a1db5961351c506bfb2bacc61cd2f Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 7 Jun 2017 08:24:31 +0000
Subject: [PATCH 1940/3333] Updated from generate-devstack-plugins-list

Change-Id: I5980980fe5071a781b5b95efd69f479359f8ee6e
---
 doc/source/plugin-registry.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 96a2733690..9bfedcf0ef 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,6 +48,7 @@ devstack-plugin-container              `git://git.openstack.org/openstack/devsta
 devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
 devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
 devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-libvirt-qemu           `git://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
 devstack-plugin-mariadb                `git://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
 devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
 devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
@@ -62,7 +63,6 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
-gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
@@ -136,6 +136,7 @@ octavia-dashboard                      `git://git.openstack.org/openstack/octavi
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
+patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
@@ -145,6 +146,7 @@ searchlight                            `git://git.openstack.org/openstack/search
 searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
+stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__

From 886d7dbe12bb0f25a3612d54877a41a917dee1f0 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 5 Jun 2017 11:32:32 -0400
Subject: [PATCH 1941/3333] nova: fix usage of scheduler_driver config option

The scheduler_driver option has been moved and deprecated. This
change uses the new group and name for the option.

Change-Id: I27aeff5911510c9f47191acaa0c0b5b71f977cd7
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 9c3ba33013..b7a03695df 100644
--- a/lib/nova
+++ b/lib/nova
@@ -453,7 +453,7 @@ function create_nova_conf {
     fi
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
-    iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
+    iniset $NOVA_CONF scheduler driver "$SCHEDULER"
     iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then

From 902158bb8fb8452d747225e5986fb789828e4e67 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 30 May 2017 14:11:09 -0700
Subject: [PATCH 1942/3333] Don't treat service as enabled if in disabled list

The old implementation for is_$service_enabled simply checked if any of
the subservices were enabled and if so the service was considered to be
enabled. This makes disabling services complicated as it means you have
to list every single subservice which can and do change over time.

Instead also check if the generic service name is in the disabled
services list and if so don't treat the service as enabled.

Change-Id: I7fe4dfca2cd9c15069d50a04161a29c5638291cb
---
 lib/cinder   | 1 +
 lib/glance   | 1 +
 lib/keystone | 1 +
 lib/neutron  | 2 ++
 lib/nova     | 1 +
 lib/swift    | 1 +
 lib/template | 1 +
 7 files changed, 8 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 2cbab2030b..291eebee87 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -129,6 +129,7 @@ CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_E
 # Test if any Cinder services are enabled
 # is_cinder_enabled
 function is_cinder_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"cinder" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"c-" ]] && return 0
     return 1
 }
diff --git a/lib/glance b/lib/glance
index d6438a6b48..57b5f45113 100644
--- a/lib/glance
+++ b/lib/glance
@@ -78,6 +78,7 @@ GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 # Test if any Glance services are enabled
 # is_glance_enabled
 function is_glance_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"glance" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"g-" ]] && return 0
     return 1
 }
diff --git a/lib/keystone b/lib/keystone
index 4bb6893089..eaed937d2e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,6 +134,7 @@ KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 # Test if Keystone is enabled
 # is_keystone_enabled
 function is_keystone_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"keystone" ]] && return 1
     [[ ,${ENABLED_SERVICES}, =~ ,"key", ]] && return 0
     return 1
 }
diff --git a/lib/neutron b/lib/neutron
index efca88050b..5c88a50bad 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -91,6 +91,7 @@ declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 # Test if any Neutron services are enabled
 # is_neutron_enabled
 function is_neutron_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"neutron" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"neutron-" || ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
     return 1
 }
@@ -98,6 +99,7 @@ function is_neutron_enabled {
 # Test if any Neutron services are enabled
 # is_neutron_enabled
 function is_neutron_legacy_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"neutron" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
     return 1
 }
diff --git a/lib/nova b/lib/nova
index 9c3ba33013..5832f11d67 100644
--- a/lib/nova
+++ b/lib/nova
@@ -175,6 +175,7 @@ NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 # Test if any Nova services are enabled
 # is_nova_enabled
 function is_nova_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"nova" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"n-" ]] && return 0
     return 1
 }
diff --git a/lib/swift b/lib/swift
index 8fad6b8f97..1472e4407b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -174,6 +174,7 @@ SWIFT_STORAGE_IPS=${SWIFT_STORAGE_IPS:-}
 # Test if any Swift services are enabled
 # is_swift_enabled
 function is_swift_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"swift" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"s-" ]] && return 0
     return 1
 }
diff --git a/lib/template b/lib/template
index b92fb40483..25d653cb46 100644
--- a/lib/template
+++ b/lib/template
@@ -41,6 +41,7 @@ XXX_CONF_DIR=/etc/XXXX
 # Test if any XXXX services are enabled
 # is_XXXX_enabled
 function is_XXXX_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"XXXX" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"XX-" ]] && return 0
     return 1
 }

From f15fd26943c0209859d2b6ee7c0d500134b34f3f Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sat, 27 May 2017 01:30:52 -0700
Subject: [PATCH 1943/3333] XenAPI: Move dom0 related operations to os-xenapi
 devstack plugin

When installing OpenStack via DevStack on XenServer, we need to
some preparation operations in dom0 which will refer the function
in devstack/tools/xen/functions file, but we are planning to move
the whole folder of tools/xen from devstack to os-xenapi, so it
this patch is to moving the dom0 related operation to os-xenapi
repo first.

Change-Id: Ib59d802a7a4eab4ccce0e29d80f29efa4655bc0b
Depends-On: I712ee74ce945859ba5118e09b7d9436ca2686cb7
---
 lib/nova_plugins/hypervisor-xenserver | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 880b87f291..6f79e4ff7c 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -84,14 +84,6 @@ function configure_nova_hypervisor {
 * * * * * /root/rotate_xen_guest_logs.sh >/dev/null 2>&1
 CRONTAB
 
-    # Create directories for kernels and images
-    {
-        echo "set -eux"
-        cat $TOP_DIR/tools/xen/functions
-        echo "create_directory_for_images"
-        echo "create_directory_for_kernels"
-        echo "install_conntrack_tools"
-    } | $ssh_dom0
 }
 
 # install_nova_hypervisor() - Install external components

From dcd4b64c990660f9b11b999a3b70e17c36323c4c Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Mon, 12 Jun 2017 14:41:42 +0000
Subject: [PATCH 1944/3333] Increase KEYSTONE_LOCKOUT_DURATION to 10

Transient failures were being reported because the current lockout
period for users was too short. While this does increase the
run time IdentityV3UsersTest.test_user_account_lockout, it
allows for more flexibility if there is network latency or some
other factor that cause the lockout to expired before the
next authentication.

Change-Id: I61bc39bbc35ac414b4a72929a90845956c99eb1a
Closes-Bug: 1693917
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index eaed937d2e..b185ae63f2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -124,7 +124,7 @@ KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 # Security compliance
 KEYSTONE_SECURITY_COMPLIANCE_ENABLED=${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-True}
 KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS=${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}
-KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-5}
+KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-10}
 KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 
 

From f63aa021cf996b500b6a570c0114c490bb57461a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 8 Jun 2017 08:22:38 -0400
Subject: [PATCH 1945/3333] Fleetify nova conductor for N cells

This makes us start two levels of nova-conductor processes, and one per cell.

Change-Id: Ice4aceac5dc44954db3661480b9365f54e47a4c9
---
 lib/nova | 111 +++++++++++++++++++++++++++++++++++++++++++++++++------
 stack.sh |   4 +-
 2 files changed, 102 insertions(+), 13 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5832f11d67..8eac254262 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,10 +53,18 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
+NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
+# The total number of cells we expect. Must be greater than one and doesn't
+# count cell0.
+NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
+# Our cell index, so we know what rabbit vhost to connect to.
+# This should be in the range of 1-$NOVA_NUM_CELLS
+NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
+
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
 if is_suse; then
@@ -479,7 +487,7 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova`
+        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -614,6 +622,20 @@ function create_nova_conf {
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
+
+    if is_service_enabled n-cond; then
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            local vhost
+            conf=$(conductor_conf $i)
+            vhost="nova_cell${i}"
+            iniset $conf database connection `database_connection_url nova_cell${i}`
+            iniset $conf conductor workers "$API_WORKERS"
+            iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
+            rpc_backend_add_vhost $vhost
+            iniset_rpc_backend nova $conf DEFAULT $vhost
+        done
+    fi
 }
 
 function init_nova_service_user_conf {
@@ -628,6 +650,11 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
+function conductor_conf {
+    local cell="$1"
+    echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
+}
+
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
@@ -692,8 +719,6 @@ function init_nova {
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
-        # (Re)create nova databases
-        recreate_database nova
         recreate_database nova_cell0
 
         # map_cell0 will create the cell mapping record in the nova_api DB so
@@ -705,6 +730,12 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
+        # (Re)create nova databases
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            recreate_database nova_cell${i}
+            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
+        done
+
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -713,9 +744,13 @@ function init_nova {
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
 
+        # FIXME(danms): Should this be configurable?
+        iniset $NOVA_CONF workarounds disable_group_policy_check_upcall True
+
         # create the cell1 cell for the main nova db where the hosts live
-        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
-            --name 'cell1'
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
+        done
     fi
 
     create_nova_cache_dir
@@ -823,25 +858,38 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
+    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
+        # NOTE(danms): Don't setup conductor fleet for cellsv1
+        nomulticellflag='nomulticell'
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
+    if [ "$nomulticellflag" = 'nomulticell' ]; then
+        # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
+        # skip these bits and use the normal config.
+        NOVA_CPU_CONF=$compute_cell_conf
+        echo "Skipping multi-cell conductor fleet setup"
+    else
+        cp $compute_cell_conf $NOVA_CPU_CONF
+        iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
@@ -850,13 +898,13 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
-            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf --config-file $fake_conf"
+            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
         if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
             start_nova_hypervisor
         fi
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF"
     fi
 
     export PATH=$old_path
@@ -876,7 +924,6 @@ function start_nova_rest {
     fi
 
     # ``run_process`` checks ``is_service_enabled``, it is not needed here
-    run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
 
@@ -899,8 +946,38 @@ function start_nova_rest {
     export PATH=$old_path
 }
 
+function enable_nova_fleet {
+    if is_service_enabled n-cond; then
+        enable_service n-super-cond
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            enable_service n-cond-cell${i}
+        done
+    fi
+}
+
+function start_nova_conductor {
+    if is_service_enabled n-cell; then
+        echo "Starting nova-conductor in a cellsv1-compatible way"
+        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
+        return
+    fi
+
+    enable_nova_fleet
+    if is_service_enabled n-super-cond; then
+        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
+    fi
+    for i in $(seq 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled n-cond-cell${i}; then
+            local conf
+            conf=$(conductor_conf $i)
+            run_process n-cond-cell${i} "$NOVA_BIN_DIR/nova-conductor --config-file $conf"
+        fi
+    done
+}
+
 function start_nova {
     start_nova_rest
+    start_nova_conductor
     start_nova_compute
 }
 
@@ -929,14 +1006,24 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
+    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }
 
+function stop_nova_conductor {
+    enable_nova_fleet
+    for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled $srv; then
+            stop_process $srv
+        fi
+    done
+}
+
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova {
     stop_nova_rest
+    stop_nova_conductor
     stop_nova_compute
 }
 
diff --git a/stack.sh b/stack.sh
index 6793d45cc1..5148ae1d77 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1268,7 +1268,9 @@ fi
 # Unable to use LUKS passphrase that is exactly 16 bytes long
 # https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
+    key=$(generate_hex_string 36)
+    iniset $NOVA_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From f266a2dc81be050fec41a180906723ab5cf61df5 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 12 Jun 2017 14:57:59 -0700
Subject: [PATCH 1946/3333] Install test-requirements with main install

To reduce the total number of invocations necessary for pip which isn't
the quickest thing ever (due to needing to evaluate constraints and deps
lists and what is currently installed) combine the main installation of
software with its test-requirements.txt file which should roughly halve
our pip invocations.

Change-Id: Ibcc3264136e66d34a879ad1c90a62e1bb6a84243
---
 inc/python | 24 +++++++++---------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/inc/python b/inc/python
index 4c443d6a00..718cbb23b1 100644
--- a/inc/python
+++ b/inc/python
@@ -320,6 +320,14 @@ function pip_install {
     fi
 
     $xtrace
+
+    # Also install test requirements
+    local install_test_reqs=""
+    local test_req="${!#}/test-requirements.txt"
+    if [[ -e "$test_req" ]]; then
+        install_test_reqs="-r $test_req"
+    fi
+
     # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
     # the same behaviour of setuptools before version 25.0.0.
     # related issue: https://github.com/pypa/pip/issues/3874
@@ -329,24 +337,10 @@ function pip_install {
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
-        $cmd_pip $upgrade \
+        $cmd_pip $upgrade $install_test_reqs \
         $@
     result=$?
 
-    # Also install test requirements
-    local test_req="${!#}/test-requirements.txt"
-    if [[ $result == 0 ]] && [[ -e "$test_req" ]]; then
-        echo "Installing test-requirements for $test_req"
-        $sudo_pip \
-            http_proxy=${http_proxy:-} \
-            https_proxy=${https_proxy:-} \
-            no_proxy=${no_proxy:-} \
-            PIP_FIND_LINKS=$PIP_FIND_LINKS \
-            $cmd_pip $upgrade \
-            -r $test_req
-        result=$?
-    fi
-
     time_stop "pip_install"
     return $result
 }

From 2b6e9ac47127453fdf907f3d9b56c71260ed0ba2 Mon Sep 17 00:00:00 2001
From: Boris Pavlovic <boris@pavlovic.me>
Date: Mon, 12 Jun 2017 17:08:33 -0700
Subject: [PATCH 1947/3333] Improve OpenStack performance by redcuing bcrypt
 hasing rounds number

Reduce bcrypt hashing rounds from 12 to 4 (minimal possilbe).

This is going to imporve a lot of perforamcne of OpenStack.

Bcrypt is hashing algorithm that is designed to use a lot of resources and
in that way stops brutforce attacks. It's exponential algorithm that depends
on amount of rounds. By default they use 12 rounds which is quite high value,
good enough for real secure production enviorments.

In case of DevStack it's going to slow down all authentication by many times.
Rally shows about 5 times slownest (adding 2-5 seconds to every authenticate)
DevStack is meant for developemnt & CI so performance is way more important than
security.

Change-Id: Id8c763d63cb91f37a774f9400f35c309f37d6f12
---
 lib/keystone | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index eaed937d2e..7994065bbd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -127,6 +127,12 @@ KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS=${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}
 KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-5}
 KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 
+# Number of bcrypt hashing rounds, increasing number exponentially increases required
+# resources to generate password hash. This is very effective way to protect from
+# bruteforce attacks. 4 is minimal value that can be specified for bcrypt and
+# it works way faster than default 12. Minimal value is great for CI and development
+# however may not be suitable for real production.
+KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 
 # Functions
 # ---------
@@ -225,6 +231,7 @@ function configure_keystone {
     fi
 
     iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
+    iniset $KEYSTONE_CONF identity password_hash_rounds $KEYSTONE_PASSWORD_HASH_ROUNDS
     iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
     iniset $KEYSTONE_CONF role driver "$KEYSTONE_ROLE_BACKEND"
     iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"

From 15b0a5f1eb849a30bcea9a1e437e9a88ae2c6f92 Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Wed, 31 May 2017 11:21:22 +0200
Subject: [PATCH 1948/3333] systemd: Always create the systemd unit files

Commit 5edae54 introduced the usage of systemd in Devstack. This allowed
the transition away from 'screen'. Systemd needs "user unit files" to
describe the services. Currently, those unit files get only created when
an openstack service (n-cpu, c-sch, g-api, ...) is in the list of enabled
services (`ENABLED_SERVICES`). This means, when Devstack is fully stacked,
there is no way to start the systemd unit of an openstack service which
is *not* in that list.

This commit changes that behavior, and creates the systemd unit files
independently of the list ENABLED_SERVICES. This means, when Devstack
is fully stacked, I can start a systemd unit of an openstack service which
wasn't in the ENABLED_SERVICES list. This allows more flexible lifecycle
management of openstack services in the gate, which is useful for tests
which test components which are not in the "default configuration" (e.g.
the "nova-serialproxy" service).

The `clean.sh` script purges all traces of systemd user unit files created
by devstack.

Change-Id: I0f7e1ee8723f4de47cbc56b727182f90a2b32bfb
---
 clean.sh         |  7 +++++++
 functions-common | 23 +++++++++++++++++------
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/clean.sh b/clean.sh
index ef38fbf4f8..9ffe3bee6b 100755
--- a/clean.sh
+++ b/clean.sh
@@ -125,6 +125,13 @@ if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
     sudo rm -rf $SCREEN_LOGDIR
 fi
 
+# Clean out the sytemd user unit files if systemd was used.
+if [[ "$USE_SYSTEMD" = "True" ]]; then
+    sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
+    # Make systemd aware of the deletion.
+    $SYSTEMCTL daemon-reload
+fi
+
 # Clean up venvs
 DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]} .config/openstack"
 rm -rf $DIRS_TO_CLEAN
diff --git a/functions-common b/functions-common
index 30933ea4c2..48ce72524e 100644
--- a/functions-common
+++ b/functions-common
@@ -1508,8 +1508,13 @@ EOF
 
 }
 
-# Helper function to build a basic unit file and run it under systemd.
-function _run_under_systemd {
+# Defines a systemd service which can be enabled and started later on.
+# arg1: The openstack service name ('n-cpu', 'c-sch', ...).
+# arg2: The command to start (e.g. path to service binary + config files).
+# arg3: The group which owns the process.
+# arg4: The user which owns the process.
+# Returns: The systemd service name which got defined.
+function _define_systemd_service {
     local service=$1
     local command="$2"
     local cmd=$command
@@ -1524,9 +1529,7 @@ function _run_under_systemd {
     else
         write_user_unit_file $systemd_service "$cmd" "$group" "$user"
     fi
-
-    $SYSTEMCTL enable $systemd_service
-    $SYSTEMCTL start $systemd_service
+    echo $systemd_service
 }
 
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
@@ -1567,11 +1570,19 @@ function run_process {
     local user=$4
 
     local name=$service
+    local systemd_service
 
     time_start "run_process"
+    # Note we deliberately make all service files, even if the service
+    # isn't enabled, so it can be enabled by a dev manually on command
+    # line.
+    if [[ "$USE_SYSTEMD" = "True" ]]; then
+        systemd_service=$(_define_systemd_service "$name" "$command" "$group" "$user")
+    fi
     if is_service_enabled $service; then
         if [[ "$USE_SYSTEMD" = "True" ]]; then
-            _run_under_systemd "$name" "$command" "$group" "$user"
+            $SYSTEMCTL enable $systemd_service
+            $SYSTEMCTL start $systemd_service
         elif [[ "$USE_SCREEN" = "True" ]]; then
             if [[ "$user" == "root" ]]; then
                 command="sudo $command"

From d095e97624467fb1e0fa38955b45960d3cbc5651 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 13 Jun 2017 10:18:36 -0700
Subject: [PATCH 1949/3333] Support unicode via en_US.utf8

Because C.utf8 is not everywhere and is sometimes called C.UTF-8 (just
to confuse people) use en_US.utf8 which is in most places. This isn't
language/region agnostic but gives a consistent unicode aware locale to
devstack.

Change-Id: I67a8c77a5041e9cee740adf0e02fdc9b183c5bc4
fixes-bug: 1697733
---
 stack.sh | 32 +++++++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6793d45cc1..39f0d1080c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -27,11 +27,37 @@ set -o xtrace
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
-# Sanitize language settings to avoid commands bailing out
-# with "unsupported locale setting" errors.
+# NOTE(sdague): why do we explicitly set locale when running stack.sh?
+#
+# Devstack is written in bash, and many functions used throughout
+# devstack process text comming off a command (like the ip command)
+# and do transforms using grep, sed, cut, awk on the strings that are
+# returned. Many of these programs are interationalized, which is
+# great for end users, but means that the strings that devstack
+# functions depend upon might not be there in other locales. We thus
+# need to pin the world to an english basis during the runs.
+#
+# Previously we used the C locale for this, every system has it, and
+# it gives us a stable sort order. It does however mean that we
+# effectively drop unicode support.... boo!  :(
+#
+# With python3 being more unicode aware by default, that's not the
+# right option. While there is a C.utf8 locale, some distros are
+# shipping it as C.UTF8 for extra confusingness. And it's support
+# isn't super clear across distros. This is made more challenging when
+# trying to support both out of the box distros, and the gate which
+# uses diskimage builder to build disk images in a different way than
+# the distros do.
+#
+# So... en_US.utf8 it is. That's existed for a very long time. It is a
+# compromise position, but it is the least worse idea at the time of
+# this comment.
+#
+# We also have to unset other variables that might impact LC_ALL
+# taking effect.
 unset LANG
 unset LANGUAGE
-LC_ALL=C
+LC_ALL=en_US.utf8
 export LC_ALL
 
 # Make sure umask is sane

From 633dbc3d8e7d3f06e13d532748c71ffba6cd21ea Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 14 Jun 2017 12:09:21 -0700
Subject: [PATCH 1950/3333] Track db sync command time useage

We are trying to keep better track of what pieces of devstack consume
the most time. Add the db sync commands to the time tracking as they run
the database migrations which can take more time than expected.

Change-Id: Ib92f2b8304ccf703712d45fd7207444de3599e2d
---
 lib/cinder         | 2 ++
 lib/glance         | 2 ++
 lib/keystone       | 2 ++
 lib/neutron        | 2 ++
 lib/neutron-legacy | 2 ++
 lib/nova           | 2 ++
 lib/placement      | 2 ++
 7 files changed, 14 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 291eebee87..20688129fd 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -407,8 +407,10 @@ function init_cinder {
         # (Re)create cinder database
         recreate_database cinder
 
+        time_start "dbsync"
         # Migrate cinder database
         $CINDER_BIN_DIR/cinder-manage --config-file $CINDER_CONF db sync
+        time_stop "dbsync"
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
diff --git a/lib/glance b/lib/glance
index 57b5f45113..baf8c6191c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -285,11 +285,13 @@ function init_glance {
     # (Re)create glance database
     recreate_database glance
 
+    time_start "dbsync"
     # Migrate glance database
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
+    time_stop "dbsync"
 
     create_glance_cache_dir
 }
diff --git a/lib/keystone b/lib/keystone
index eaed937d2e..9de660b4e2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -458,8 +458,10 @@ function init_keystone {
         recreate_database keystone
     fi
 
+    time_start "dbsync"
     # Initialize keystone database
     $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
+    time_stop "dbsync"
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
diff --git a/lib/neutron b/lib/neutron
index 5c88a50bad..2a660ec8e1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -336,8 +336,10 @@ function init_neutron_new {
 
     recreate_database neutron
 
+    time_start "dbsync"
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
+    time_stop "dbsync"
 
     create_neutron_cache_dir
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 67cf110644..784f3a8167 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -417,8 +417,10 @@ function create_mutnauq_accounts {
 # init_mutnauq() - Initialize databases, etc.
 function init_mutnauq {
     recreate_database $Q_DB_NAME
+    time_start "dbsync"
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
+    time_stop "dbsync"
 }
 
 # install_mutnauq() - Collect source and prepare
diff --git a/lib/nova b/lib/nova
index aae3108013..18715fc418 100644
--- a/lib/nova
+++ b/lib/nova
@@ -649,7 +649,9 @@ function init_nova_cells {
             iniset $NOVA_CELLS_CONF DEFAULT enabled_apis metadata
         fi
 
+        time_start "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
+        time_stop "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
         $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
 
diff --git a/lib/placement b/lib/placement
index ad12824a38..8adbbdec68 100644
--- a/lib/placement
+++ b/lib/placement
@@ -149,7 +149,9 @@ function create_placement_accounts {
 function init_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         recreate_database placement
+        time_start "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
+        time_stop "dbsync"
     fi
     create_placement_accounts
 }

From 3e9b562d0b1f1815597daa5346ba32ef48f868af Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 14 Jun 2017 15:29:47 -0700
Subject: [PATCH 1951/3333] Actually check if roles are set

In the helper functions to check if roles are set and if not add the
role and return the id we weren't actually checking if the role was set.
The reason for this was we grepped for name values while outputing only
uuid values with OSC. Fix for this is straightforward, we just add the
--role argument to OSC which will filter for us then we don't have to
use a grep on the wrong value type.

Change-Id: I2691b347d2a6273100deb4a1750ab353a8e49673
---
 functions-common | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 30933ea4c2..35613ab7e9 100644
--- a/functions-common
+++ b/functions-common
@@ -864,10 +864,11 @@ function get_or_add_user_project_role {
 
     # Gets user role id
     user_role_id=$(openstack role assignment list \
+        --role $1 \
         --user $2 \
         --project $3 \
         $domain_args \
-        | grep " $1 " | get_field 1)
+        | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
@@ -875,10 +876,11 @@ function get_or_add_user_project_role {
             --project $3 \
             $domain_args
         user_role_id=$(openstack role assignment list \
+            --role $1 \
             --user $2 \
             --project $3 \
             $domain_args \
-            | grep " $1 " | get_field 1)
+            | grep '^|\s[a-f0-9]\+' | get_field 1)
     fi
     echo $user_role_id
 }
@@ -889,18 +891,20 @@ function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
     user_role_id=$(openstack role assignment list \
+        --role $1 \
         --user $2 \
         --domain $3 \
-        | grep " $1 " | get_field 1)
+        | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
             --domain $3
         user_role_id=$(openstack role assignment list \
+            --role $1 \
             --user $2 \
             --domain $3 \
-            | grep " $1 " | get_field 1)
+            | grep '^|\s[a-f0-9]\+' | get_field 1)
     fi
     echo $user_role_id
 }
@@ -911,6 +915,7 @@ function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
     group_role_id=$(openstack role assignment list \
+        --role $1 \
         --group $2 \
         --project $3 \
         -f value)
@@ -920,6 +925,7 @@ function get_or_add_group_project_role {
             --group $2 \
             --project $3
         group_role_id=$(openstack role assignment list \
+            --role $1 \
             --group $2 \
             --project $3 \
             -f value)

From 85cf2933ccdd70f4f6d505c9aca36f063eddf229 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 27 Mar 2017 15:35:13 -0400
Subject: [PATCH 1952/3333] Provide timings for OSC during devstack run

The OSC number remain high, and it's useful to understand how much
time we spend making OSC calls, especially to surface it relative to
other items. The way we embed this in our code makes it hard to
instrument.

This patch creates a wrapper function for OSC which collects the timings
then aliases `openstack` to that function. This means any invocations of
the openstack utility goes through our function while devstack is
running. Because this is an alias it only affects the stack.sh shell and
any subshells.

This also moves the time tracking infrastructure to count in ms,
instead of s, because some of these operations are close enough to a
second that rounding early is losing way to many significant
digits. We divide by 1000 before reporting to the user.

Change-Id: Ic5f1844ce732d447ee980b3c9fdc417f72482609
---
 functions-common | 51 ++++++++++++++++++++++++++++++++++++++++++++++--
 stack.sh         |  9 +++++++++
 2 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index ec68644757..98e9a4bf66 100644
--- a/functions-common
+++ b/functions-common
@@ -2459,7 +2459,7 @@ function time_start {
     if [[ -n "$start_time" ]]; then
         die $LINENO "Trying to start the clock on $name, but it's already been started"
     fi
-    _TIME_START[$name]=$(date +%s)
+    _TIME_START[$name]=$(date +%s%3N)
 }
 
 # time_stop $name
@@ -2480,7 +2480,7 @@ function time_stop {
     if [[ -z "$start_time" ]]; then
         die $LINENO "Trying to stop the clock on $name, but it was never started"
     fi
-    end_time=$(date +%s)
+    end_time=$(date +%s%3N)
     elapsed_time=$(($end_time - $start_time))
     total=${_TIME_TOTAL[$name]:-0}
     # reset the clock so we can start it in the future
@@ -2488,6 +2488,49 @@ function time_stop {
     _TIME_TOTAL[$name]=$(($total + $elapsed_time))
 }
 
+function oscwrap {
+    local out
+    local rc
+    local start
+    local end
+    # Cannot use timer_start and timer_stop as we run in subshells
+    # and those rely on modifying vars in the same process (which cannot
+    # happen from a subshell.
+    start=$(date +%s%3N)
+    out=$(command openstack "$@")
+    rc=$?
+    end=$(date +%s%3N)
+    echo $((end - start)) >> $OSCWRAP_TIMER_FILE
+
+    echo "$out"
+    return $rc
+}
+
+function install_oscwrap {
+    # File to accumulate our timing data
+    OSCWRAP_TIMER_FILE=$(mktemp)
+    # Bash by default doesn't expand aliases, allow it for the aliases
+    # we want to whitelist.
+    shopt -s expand_aliases
+    # Remove all aliases that might be expanded to preserve old unexpanded
+    # behavior
+    unalias -a
+    # Add only the alias we want for openstack
+    alias openstack=oscwrap
+}
+
+function cleanup_oscwrap {
+    local total=0
+    if python3_enabled ; then
+        local python=python3
+    else
+        local python=python
+    fi
+    total=$(cat $OSCWRAP_TIMER_FILE | $python -c "import sys; print(sum(int(l) for l in sys.stdin))")
+    _TIME_TOTAL["osc"]=$total
+    rm $OSCWRAP_TIMER_FILE
+}
+
 # time_totals
 #  Print out total time summary
 function time_totals {
@@ -2506,6 +2549,8 @@ function time_totals {
         fi
     done
 
+    cleanup_oscwrap
+
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
@@ -2517,6 +2562,8 @@ function time_totals {
     echo
     for t in ${!_TIME_TOTAL[*]}; do
         local v=${_TIME_TOTAL[$t]}
+        # because we're recording in milliseconds
+        v=$(($v / 1000))
         printf "%-${len}s %3d\n" "$t" "$v"
     done
     echo "========================="
diff --git a/stack.sh b/stack.sh
index 20cdc1dfcc..89b61fc2c5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -493,6 +493,11 @@ function exit_trap {
         kill 2>&1 $jobs
     fi
 
+    #Remove timing data file
+    if [ -f "$OSCWRAP_TIMER_FILE" ] ; then
+        rm "$OSCWRAP_TIMER_FILE"
+    fi
+
     # Kill the last spinner process
     kill_spinner
 
@@ -903,6 +908,10 @@ else
     pip_install_gr python-openstackclient
 fi
 
+# Installs alias for osc so that we can collect timing for all
+# osc commands. Alias dies with stack.sh.
+install_oscwrap
+
 if [[ $TRACK_DEPENDS = True ]]; then
     $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
     if ! diff -Nru $DEST/requires-pre-pip $DEST/requires-post-pip > $DEST/requires.diff; then

From 19279b0f87e2ab1c684d62078df296211d3a60cc Mon Sep 17 00:00:00 2001
From: Antoni Segura Puimedon <antonisp@celebdor.com>
Date: Fri, 16 Jun 2017 16:03:32 +0200
Subject: [PATCH 1953/3333] etcd3: Allow for multi-host deployments

In Multi host deployments, it is possible to run ETCD in a different
host than the SERVICE_HOST (where all the controllers run). This patch
brings that distinction.

Change-Id: I15fe6f25eedf1efebaab81cce26b080577b856cc
Signed-off-by: Antoni Segura Puimedon <antonisp@celebdor.com>
---
 lib/etcd3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index f8b113bae6..75c2ae93ae 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -53,9 +53,9 @@ function start_etcd3 {
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
     cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
     cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
-    cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    cmd+=" --advertise-client-urls http://${HOST_IP}:$ETCD_PORT"
     cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
-    cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    cmd+=" --listen-client-urls http://${HOST_IP}:$ETCD_PORT"
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From 41da1a9feb397d2536acd2f59daab55937a04513 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 19 Jun 2017 08:55:47 +0000
Subject: [PATCH 1954/3333] Updated from generate-devstack-plugins-list

Change-Id: Ida1d6d012e1e05f35ba45670436acd6f920c9575
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9bfedcf0ef..c1c66b9bb6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -149,6 +149,7 @@ solum                                  `git://git.openstack.org/openstack/solum
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
+tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__

From 62b56601a9c6d6e9ad573e87bdecf360a3dd915e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 19 Jun 2017 08:27:16 -0400
Subject: [PATCH 1955/3333] rework etcd3 install to be like other devstack
 services

This separates out the install phase early from the start phase to
make this mirror other services in devstack.

Depends-On: I4124dc7e3fd3b4d973979da85209ec991c0f8c4b

Change-Id: I76f8740448b25a48869ee80006e826baa6cafc2b
---
 lib/etcd3 | 13 +------------
 lib/oslo  |  7 +++++++
 stack.sh  |  4 ++++
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index f8b113bae6..25de238ff8 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -41,13 +41,6 @@ fi
 
 # start_etcd3() - Starts to run the etcd process
 function start_etcd3 {
-    # Don't install in sub nodes (multinode scenario)
-    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
-        return
-    fi
-
-    _install_etcd
-
     local cmd="$ETCD_BIN_DIR/etcd"
     cmd+=" --name $HOSTNAME --data-dir $ETCD_DATA_DIR"
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
@@ -96,7 +89,7 @@ function cleanup_etcd3 {
     sudo rm -rf $ETCD_DATA_DIR
 }
 
-function _install_etcd {
+function install_etcd3 {
     echo "Installing etcd"
 
     # Make sure etcd3 downloads the correct architecture
@@ -115,10 +108,6 @@ function _install_etcd {
 
     ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
 
-    # Install the libraries needed. Note: tooz for example does not have a hard dependency on these libraries
-    pip_install etcd3
-    pip_install etcd3gw
-
     # Create the necessary directories
     sudo mkdir -p $ETCD_BIN_DIR
     sudo mkdir -p $ETCD_DATA_DIR
diff --git a/lib/oslo b/lib/oslo
index d15a3031a2..cbfd5fb513 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -109,7 +109,14 @@ function install_oslo {
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
     _do_install_oslo_lib "tooz"
+    # installation of additional libraries
+    #
+    # os-traits for nova
     _do_install_oslo_lib "os-traits"
+
+    # etcd (because tooz does not have a hard dependency on these)
+    pip_install etcd3
+    pip_install etcd3gw
 }
 
 # Restore xtrace
diff --git a/stack.sh b/stack.sh
index cfdc2c4c50..c46859567c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -813,6 +813,10 @@ if is_service_enabled neutron; then
     install_neutron_agent_packages
 fi
 
+if is_service_enabled etcd3; then
+    install_etcd3
+fi
+
 # Check Out and Install Source
 # ----------------------------
 

From 3ed99c0b27122ff00e2d236086ab16b0cc1887c1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 20 Jun 2017 14:09:30 -0400
Subject: [PATCH 1956/3333] mv lib/oslo to lib/libraries

There is confusion about where installation of new libraries should
end up, to prevent lots of little files being added make a
lib/libraries which is the old lib/oslo. Put compat functions and
includes in place to help with transition.

Change-Id: Ieeab605d187ef6aec571211ab235ea67fa95a607
---
 lib/libraries | 135 ++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/oslo      | 121 +-------------------------------------------
 stack.sh      |   6 +--
 3 files changed, 140 insertions(+), 122 deletions(-)
 create mode 100644 lib/libraries

diff --git a/lib/libraries b/lib/libraries
new file mode 100644
index 0000000000..9feb503f1b
--- /dev/null
+++ b/lib/libraries
@@ -0,0 +1,135 @@
+#!/bin/bash
+#
+# lib/oslo
+#
+# Functions to install **Oslo** libraries from git
+#
+# We need this to handle the fact that projects would like to use
+# pre-released versions of oslo libraries.
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - install_oslo
+
+# Save trace setting
+_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+GITDIR["automaton"]=$DEST/automaton
+GITDIR["castellan"]=$DEST/castellan
+GITDIR["cliff"]=$DEST/cliff
+GITDIR["cursive"]=$DEST/cursive
+GITDIR["debtcollector"]=$DEST/debtcollector
+GITDIR["futurist"]=$DEST/futurist
+GITDIR["os-client-config"]=$DEST/os-client-config
+GITDIR["osc-lib"]=$DEST/osc-lib
+GITDIR["oslo.cache"]=$DEST/oslo.cache
+GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
+GITDIR["oslo.config"]=$DEST/oslo.config
+GITDIR["oslo.context"]=$DEST/oslo.context
+GITDIR["oslo.db"]=$DEST/oslo.db
+GITDIR["oslo.i18n"]=$DEST/oslo.i18n
+GITDIR["oslo.log"]=$DEST/oslo.log
+GITDIR["oslo.messaging"]=$DEST/oslo.messaging
+GITDIR["oslo.middleware"]=$DEST/oslo.middleware
+GITDIR["oslo.policy"]=$DEST/oslo.policy
+GITDIR["oslo.privsep"]=$DEST/oslo.privsep
+GITDIR["oslo.reports"]=$DEST/oslo.reports
+GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
+GITDIR["oslo.serialization"]=$DEST/oslo.serialization
+GITDIR["oslo.service"]=$DEST/oslo.service
+GITDIR["oslo.utils"]=$DEST/oslo.utils
+GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
+GITDIR["oslo.vmware"]=$DEST/oslo.vmware
+GITDIR["osprofiler"]=$DEST/osprofiler
+GITDIR["pycadf"]=$DEST/pycadf
+GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
+GITDIR["stevedore"]=$DEST/stevedore
+GITDIR["taskflow"]=$DEST/taskflow
+GITDIR["tooz"]=$DEST/tooz
+# TODO(mriedem): This is a common pattern so even though os-traits isn't
+# officially an oslo library, it is nice to re-use this script for non-oslo
+# things like os-traits. We should rename this script to be more generic
+# and then fold os-brick into it also.
+GITDIR["os-traits"]=$DEST/os-traits
+
+# Support entry points installation of console scripts
+OSLO_BIN_DIR=$(get_python_exec_prefix)
+
+
+# Functions
+# ---------
+
+function _install_lib_from_source {
+    local name=$1
+    if use_library_from_git "$name"; then
+        git_clone_by_name "$name"
+        setup_dev_lib "$name"
+    fi
+}
+
+# install_oslo - install libraries that oslo needs
+function install_oslo {
+    install_libs
+}
+
+# install_libs() - Install additional libraries that we need and want
+# on all environments. Some will only install here if from source,
+# others will always install.
+function install_libs {
+    _install_lib_from_source "automaton"
+    _install_lib_from_source "castellan"
+    _install_lib_from_source "cliff"
+    _install_lib_from_source "cursive"
+    _install_lib_from_source "debtcollector"
+    _install_lib_from_source "futurist"
+    _install_lib_from_source "osc-lib"
+    _install_lib_from_source "os-client-config"
+    _install_lib_from_source "oslo.cache"
+    _install_lib_from_source "oslo.concurrency"
+    _install_lib_from_source "oslo.config"
+    _install_lib_from_source "oslo.context"
+    _install_lib_from_source "oslo.db"
+    _install_lib_from_source "oslo.i18n"
+    _install_lib_from_source "oslo.log"
+    _install_lib_from_source "oslo.messaging"
+    _install_lib_from_source "oslo.middleware"
+    _install_lib_from_source "oslo.policy"
+    _install_lib_from_source "oslo.privsep"
+    _install_lib_from_source "oslo.reports"
+    _install_lib_from_source "oslo.rootwrap"
+    _install_lib_from_source "oslo.serialization"
+    _install_lib_from_source "oslo.service"
+    _install_lib_from_source "oslo.utils"
+    _install_lib_from_source "oslo.versionedobjects"
+    _install_lib_from_source "oslo.vmware"
+    _install_lib_from_source "osprofiler"
+    _install_lib_from_source "pycadf"
+    _install_lib_from_source "python-openstacksdk"
+    _install_lib_from_source "stevedore"
+    _install_lib_from_source "taskflow"
+    _install_lib_from_source "tooz"
+    # installation of additional libraries
+    #
+    # os-traits for nova
+    _install_lib_from_source "os-traits"
+
+    # etcd (because tooz does not have a hard dependency on these)
+    pip_install etcd3
+    pip_install etcd3gw
+}
+
+# Restore xtrace
+$_XTRACE_LIB_OSLO
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/oslo b/lib/oslo
index cbfd5fb513..3ae64c8210 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -6,123 +6,6 @@
 #
 # We need this to handle the fact that projects would like to use
 # pre-released versions of oslo libraries.
-
-# Dependencies:
 #
-# - ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_oslo
-
-# Save trace setting
-_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-GITDIR["automaton"]=$DEST/automaton
-GITDIR["castellan"]=$DEST/castellan
-GITDIR["cliff"]=$DEST/cliff
-GITDIR["cursive"]=$DEST/cursive
-GITDIR["debtcollector"]=$DEST/debtcollector
-GITDIR["futurist"]=$DEST/futurist
-GITDIR["os-client-config"]=$DEST/os-client-config
-GITDIR["osc-lib"]=$DEST/osc-lib
-GITDIR["oslo.cache"]=$DEST/oslo.cache
-GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
-GITDIR["oslo.config"]=$DEST/oslo.config
-GITDIR["oslo.context"]=$DEST/oslo.context
-GITDIR["oslo.db"]=$DEST/oslo.db
-GITDIR["oslo.i18n"]=$DEST/oslo.i18n
-GITDIR["oslo.log"]=$DEST/oslo.log
-GITDIR["oslo.messaging"]=$DEST/oslo.messaging
-GITDIR["oslo.middleware"]=$DEST/oslo.middleware
-GITDIR["oslo.policy"]=$DEST/oslo.policy
-GITDIR["oslo.privsep"]=$DEST/oslo.privsep
-GITDIR["oslo.reports"]=$DEST/oslo.reports
-GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
-GITDIR["oslo.serialization"]=$DEST/oslo.serialization
-GITDIR["oslo.service"]=$DEST/oslo.service
-GITDIR["oslo.utils"]=$DEST/oslo.utils
-GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
-GITDIR["oslo.vmware"]=$DEST/oslo.vmware
-GITDIR["osprofiler"]=$DEST/osprofiler
-GITDIR["pycadf"]=$DEST/pycadf
-GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
-GITDIR["stevedore"]=$DEST/stevedore
-GITDIR["taskflow"]=$DEST/taskflow
-GITDIR["tooz"]=$DEST/tooz
-# TODO(mriedem): This is a common pattern so even though os-traits isn't
-# officially an oslo library, it is nice to re-use this script for non-oslo
-# things like os-traits. We should rename this script to be more generic
-# and then fold os-brick into it also.
-GITDIR["os-traits"]=$DEST/os-traits
-
-# Support entry points installation of console scripts
-OSLO_BIN_DIR=$(get_python_exec_prefix)
-
-
-# Functions
-# ---------
-
-function _do_install_oslo_lib {
-    local name=$1
-    if use_library_from_git "$name"; then
-        git_clone_by_name "$name"
-        setup_dev_lib "$name"
-    fi
-}
-
-# install_oslo() - Collect source and prepare
-function install_oslo {
-    _do_install_oslo_lib "automaton"
-    _do_install_oslo_lib "castellan"
-    _do_install_oslo_lib "cliff"
-    _do_install_oslo_lib "cursive"
-    _do_install_oslo_lib "debtcollector"
-    _do_install_oslo_lib "futurist"
-    _do_install_oslo_lib "osc-lib"
-    _do_install_oslo_lib "os-client-config"
-    _do_install_oslo_lib "oslo.cache"
-    _do_install_oslo_lib "oslo.concurrency"
-    _do_install_oslo_lib "oslo.config"
-    _do_install_oslo_lib "oslo.context"
-    _do_install_oslo_lib "oslo.db"
-    _do_install_oslo_lib "oslo.i18n"
-    _do_install_oslo_lib "oslo.log"
-    _do_install_oslo_lib "oslo.messaging"
-    _do_install_oslo_lib "oslo.middleware"
-    _do_install_oslo_lib "oslo.policy"
-    _do_install_oslo_lib "oslo.privsep"
-    _do_install_oslo_lib "oslo.reports"
-    _do_install_oslo_lib "oslo.rootwrap"
-    _do_install_oslo_lib "oslo.serialization"
-    _do_install_oslo_lib "oslo.service"
-    _do_install_oslo_lib "oslo.utils"
-    _do_install_oslo_lib "oslo.versionedobjects"
-    _do_install_oslo_lib "oslo.vmware"
-    _do_install_oslo_lib "osprofiler"
-    _do_install_oslo_lib "pycadf"
-    _do_install_oslo_lib "python-openstacksdk"
-    _do_install_oslo_lib "stevedore"
-    _do_install_oslo_lib "taskflow"
-    _do_install_oslo_lib "tooz"
-    # installation of additional libraries
-    #
-    # os-traits for nova
-    _do_install_oslo_lib "os-traits"
-
-    # etcd (because tooz does not have a hard dependency on these)
-    pip_install etcd3
-    pip_install etcd3gw
-}
-
-# Restore xtrace
-$_XTRACE_LIB_OSLO
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
+# Included for compatibility with grenade, remove in Queens
+source $TOP_DIR/lib/libraries
diff --git a/stack.sh b/stack.sh
index c46859567c..7034bc4ca2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -592,7 +592,7 @@ source $TOP_DIR/lib/tls
 
 # Source project function libraries
 source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/oslo
+source $TOP_DIR/lib/libraries
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
@@ -822,8 +822,8 @@ fi
 
 echo_summary "Installing OpenStack project source"
 
-# Install Oslo libraries
-install_oslo
+# Install additional libraries
+install_libs
 
 # Install uwsgi
 install_apache_uwsgi

From d064acce4ceca5c897b31304439e235a230ac8f3 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>
Date: Wed, 21 Jun 2017 09:06:37 +0000
Subject: [PATCH 1957/3333] Ignore etcd files downloaded to files/ dir

Change-Id: Ic1458a612ccdefdcc34880529a259513135fa7a1
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 7967e14a19..d2c127d099 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,7 @@ files/pip-*
 files/get-pip.py*
 files/ir-deploy*
 files/ironic-inspector*
+files/etcd*
 local.conf
 local.sh
 localrc

From 99a6477c498588b4639c8669eb1a04a128dc7f2b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 21 Jun 2017 10:46:12 -0400
Subject: [PATCH 1958/3333] remove lib/os_brick

Fold this back into lib/libraries

Change-Id: I2c4e3ebf1a1cc65841e4470d5cfe073f9b505d5f
---
 lib/libraries |  4 ++++
 lib/os_brick  | 32 --------------------------------
 stack.sh      |  6 ------
 3 files changed, 4 insertions(+), 38 deletions(-)
 delete mode 100644 lib/os_brick

diff --git a/lib/libraries b/lib/libraries
index 9feb503f1b..946872c3ad 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -59,6 +59,7 @@ GITDIR["tooz"]=$DEST/tooz
 # things like os-traits. We should rename this script to be more generic
 # and then fold os-brick into it also.
 GITDIR["os-traits"]=$DEST/os-traits
+GITDIR["os-brick"]=$DEST/os-brick
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -120,6 +121,9 @@ function install_libs {
     #
     # os-traits for nova
     _install_lib_from_source "os-traits"
+    # os-brick for nova/cinder
+    _install_lib_from_source "os-brick"
+
 
     # etcd (because tooz does not have a hard dependency on these)
     pip_install etcd3
diff --git a/lib/os_brick b/lib/os_brick
deleted file mode 100644
index d1cca4af44..0000000000
--- a/lib/os_brick
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/bash
-#
-# lib/os_brick
-# Install **os-brick** python module from source
-
-# Dependencies:
-#
-# - functions
-# - DEST, DATA_DIR must be defined
-
-# stack.sh
-# ---------
-# - install_os_brick
-
-# Save trace setting
-_XTRACE_OS_BRICK=$(set +o | grep xtrace)
-set +o xtrace
-
-
-GITDIR["os-brick"]=$DEST/os-brick
-
-# Install os_brick from git only if requested, otherwise it will be pulled from
-# pip repositories by requirements of projects that need it.
-function install_os_brick {
-    if use_library_from_git "os-brick"; then
-        git_clone_by_name "os-brick"
-        setup_dev_lib "os-brick"
-    fi
-}
-
-# Restore xtrace
-$_XTRACE_OS_BRICK
\ No newline at end of file
diff --git a/stack.sh b/stack.sh
index 7034bc4ca2..59f25973ea 100755
--- a/stack.sh
+++ b/stack.sh
@@ -605,7 +605,6 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/etcd3
-source $TOP_DIR/lib/os_brick
 
 # Extras Source
 # --------------
@@ -841,11 +840,6 @@ if is_service_enabled neutron nova horizon; then
     install_neutronclient
 fi
 
-# Install shared libraries
-if is_service_enabled cinder nova; then
-    install_os_brick
-fi
-
 # Setup TLS certs
 if is_service_enabled tls-proxy; then
     configure_CA

From 7e41c6ce669a082fcb5f50ef3503b8d66d19b35f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 21 Jun 2017 10:55:16 -0400
Subject: [PATCH 1959/3333] cleanup comments

Change-Id: I685f726178722e58ccfd008bad16a671cc8b8e2a
---
 lib/libraries | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/lib/libraries b/lib/libraries
index 946872c3ad..761ce66694 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -2,7 +2,7 @@
 #
 # lib/oslo
 #
-# Functions to install **Oslo** libraries from git
+# Functions to install libraries from git
 #
 # We need this to handle the fact that projects would like to use
 # pre-released versions of oslo libraries.
@@ -13,10 +13,10 @@
 
 # ``stack.sh`` calls the entry points in this order:
 #
-# - install_oslo
+# - install_libraries
 
 # Save trace setting
-_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
+_XTRACE_LIB_LIBRARIES=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -54,12 +54,11 @@ GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
-# TODO(mriedem): This is a common pattern so even though os-traits isn't
-# officially an oslo library, it is nice to re-use this script for non-oslo
-# things like os-traits. We should rename this script to be more generic
-# and then fold os-brick into it also.
-GITDIR["os-traits"]=$DEST/os-traits
+
+# Non oslo libraries are welcomed below as well, this prevents
+# duplication of this code.
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -120,18 +119,20 @@ function install_libs {
     # installation of additional libraries
     #
     # os-traits for nova
-    _install_lib_from_source "os-traits"
-    # os-brick for nova/cinder
     _install_lib_from_source "os-brick"
+    _install_lib_from_source "os-traits"
 
 
     # etcd (because tooz does not have a hard dependency on these)
+    #
+    # NOTE(sdague): this is currently a work around because tooz
+    # doesn't pull in etcd3.
     pip_install etcd3
     pip_install etcd3gw
 }
 
 # Restore xtrace
-$_XTRACE_LIB_OSLO
+$_XTRACE_LIB_LIBRARIES
 
 # Tell emacs to use shell-script-mode
 ## Local variables:

From 43304849cfde41fa86a6fdd334ab6e703598ef8d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 21 Jun 2017 21:45:14 +0100
Subject: [PATCH 1960/3333] Set public_endpoint to GLANCE_URL for glance-api

We run glance behind uwsgi. This means that the URL glance knows about
itself is wrong, and version discovery fails. Set the public endpoint to
the value of GLANCE_URL which should always be correct.

Change-Id: Ia7c69024a0ef6cc0fdc284ffcd06eee5678a1007
---
 lib/glance | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 99941232f3..41145f980d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -186,9 +186,12 @@ function configure_glance {
         inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
+    # We need to tell glance what it's public endpoint is so that the version
+    # discovery document will be correct
+    iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_URL
+
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI

From 3410e3e01bdbdbfd360d9baebeac081c33ee0821 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 21 Jun 2017 22:07:53 +1000
Subject: [PATCH 1961/3333] Revert "Use uwsgi for glance-api"

This reverts commit e6217a9719b88b550ccbbce7c9bc064cb746c1a3.

Unfortunately it seems to break glance; for examples see some of the
nodepool dib jobs which have all failed to upload images into glance.

Note this has a revert for 43304849cfde41fa86a6fdd334ab6e703598ef8d as
well, since that uses GLANCE_URL defined here.

[1] http://logs.openstack.org/51/475051/2/gate/gate-dsvm-nodepool-redhat-src/e1bdb34/
[2] http://logs.openstack.org/51/475051/2/gate/gate-dsvm-nodepool-ubuntu-src/6a7665b/
[3] http://logs.openstack.org/51/475051/2/gate/gate-dsvm-nodepool-opensuse-src/b357de1/

Change-Id: I2aea120e733b05e806801121ec994f4e31a337d9
---
 lib/apache | 54 +-----------------------------------------------------
 lib/cinder |  2 +-
 lib/glance | 44 ++++++++++++--------------------------------
 lib/nova   |  2 +-
 4 files changed, 15 insertions(+), 87 deletions(-)

diff --git a/lib/apache b/lib/apache
index 25c65fe672..c1b6bf8b41 100644
--- a/lib/apache
+++ b/lib/apache
@@ -275,64 +275,12 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
 }
 
-# For services using chunked encoding, the only services known to use this
-# currently are Glance and Swift, we need to use an http proxy instead of
-# mod_proxy_uwsgi because the chunked encoding gets dropped. See:
-# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
-# but that involves having apache buffer the request before sending it to
-# uswgi.
-function write_local_uwsgi_http_config {
-    local file=$1
-    local wsgi=$2
-    local url=$3
-    name=$(basename $wsgi)
-
-    # create a home for the sockets; note don't use /tmp -- apache has
-    # a private view of it on some platforms.
-
-    # always cleanup given that we are using iniset here
-    rm -rf $file
-    iniset "$file" uwsgi wsgi-file "$wsgi"
-    port=$(get_random_port)
-    iniset "$file" uwsgi http "127.0.0.1:$port"
-    iniset "$file" uwsgi processes $API_WORKERS
-    # This is running standalone
-    iniset "$file" uwsgi master true
-    # Set die-on-term & exit-on-reload so that uwsgi shuts down
-    iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload true
-    iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins python
-    # uwsgi recommends this to prevent thundering herd on accept.
-    iniset "$file" uwsgi thunder-lock true
-    # Override the default size for headers from the 4k default.
-    iniset "$file" uwsgi buffer-size 65535
-    # Make sure the client doesn't try to re-use the connection.
-    iniset "$file" uwsgi add-header "Connection: close"
-    # This ensures that file descriptors aren't shared between processes.
-    iniset "$file" uwsgi lazy-apps true
-    iniset "$file" uwsgi chmod-socket 666
-    iniset "$file" uwsgi http-raw-body true
-    iniset "$file" uwsgi http-chunked-input true
-    iniset "$file" uwsgi http-auto-chunked true
-
-    enable_apache_mod proxy
-    enable_apache_mod proxy_http
-    local apache_conf=""
-    apache_conf=$(apache_site_config_for $name)
-    echo "KeepAlive Off" | sudo tee $apache_conf
-    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
-    enable_apache_site $name
-    restart_apache_server
-}
-
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/cinder b/lib/cinder
index 243b639a11..20688129fd 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -335,7 +335,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
-    iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
+    iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
diff --git a/lib/glance b/lib/glance
index 41145f980d..baf8c6191c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -71,16 +71,6 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
-GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
-GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
-# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
-# TODO(mtreinish): Remove the eventlet path here and in all the similar
-# conditionals below after the Pike release
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
-else
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-fi
 
 # Functions
 # ---------
@@ -114,13 +104,16 @@ function configure_glance {
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
+    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
+    cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -148,6 +141,8 @@ function configure_glance {
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
+    iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
         iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
@@ -186,12 +181,9 @@ function configure_glance {
         inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
-    # We need to tell glance what it's public endpoint is so that the version
-    # discovery document will be correct
-    iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_URL
-
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
+        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
@@ -207,6 +199,7 @@ function configure_glance {
     setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
+
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
@@ -239,13 +232,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
-
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
-    else
-        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -270,7 +256,7 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_URL"
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
@@ -337,21 +323,15 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
-        fi
+        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
         start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
-    else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
-    fi
+    run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
 
-    echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
+    echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
 }
diff --git a/lib/nova b/lib/nova
index f56509ac1a..18715fc418 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
+    iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From 599ecfbd4c71de5f71663b1cadf2700b31a84ec2 Mon Sep 17 00:00:00 2001
From: TommyLike <tommylikehu@gmail.com>
Date: Tue, 20 Jun 2017 11:32:25 +0800
Subject: [PATCH 1962/3333] Download etcd3 only zip file not exists

Give a change to manually prepare the zip file
for etcd.

Change-Id: I54283cf2ed62bb716af34df21e8c168014264c8c
---
 lib/etcd3 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index ea58403b24..0e1fbd5bc2 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -115,7 +115,9 @@ function install_etcd3 {
     # Download and cache the etcd tgz for subsequent use
     if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
         ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
+        if [ ! -f "$FILES/$ETCD_DOWNLOAD_FILE" ]; then
+            wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
+        fi
         echo "${ETCD_SHA256} $FILES/${ETCD_DOWNLOAD_FILE}" > $FILES/etcd.sha256sum
         # NOTE(sdague): this should go fatal if this fails
         sha256sum -c $FILES/etcd.sha256sum

From ed7dbe5754b95f54f663f695b27c7c14b1fdbd6c Mon Sep 17 00:00:00 2001
From: Kaitlin Farr <kaitlin.farr@jhuapl.edu>
Date: Mon, 19 Jun 2017 16:50:38 -0400
Subject: [PATCH 1963/3333] Add python-barbicanclient to LIBS_FROM_GIT

Allow python-barbicanclient to be installed from git instead of pip.

Change-Id: I99cd72724e11bab362bcaaeb773f33b2abfe815c
---
 lib/libraries                | 3 +++
 stackrc                      | 5 +++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/libraries b/lib/libraries
index 761ce66694..4ceb80423c 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -121,6 +121,9 @@ function install_libs {
     # os-traits for nova
     _install_lib_from_source "os-brick"
     _install_lib_from_source "os-traits"
+    #
+    # python client libraries we might need from git can go here
+    _install_lib_from_source "python-barbicanclient"
 
 
     # etcd (because tooz does not have a hard dependency on these)
diff --git a/stackrc b/stackrc
index cfe2496240..50f7c89ba3 100644
--- a/stackrc
+++ b/stackrc
@@ -341,6 +341,11 @@ GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 GITREPO["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
 GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
 
+# python barbican client library
+GITREPO["python-barbicanclient"]=${BARBICANCLIENT_REPO:-${GIT_BASE}/openstack/python-barbicanclient.git}
+GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-master}
+GITDIR["python-barbicanclient"]=$DEST/python-barbicanclient
+
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
 GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 1f2d3c23b8..5b4ff32f2a 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -43,7 +43,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan"
+ALL_LIBS+=" castellan python-barbicanclient"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 13e81ad1cf6d652946b78082b280fb12d190f6f2 Mon Sep 17 00:00:00 2001
From: Yuval Brik <yuval@brik.org.il>
Date: Fri, 23 Jun 2017 10:32:16 +0300
Subject: [PATCH 1964/3333] Fedora mariadb: disable cracklib

In Fedora mariadb, cracklib has been enabled [0] in order to verify the
password strength.
Disable cracklib in Fedora devstack in order to allow simple passwords
in dev environments.

[0] https://src.fedoraproject.org/cgit/rpms/mariadb.git/
    commit: 9442da192282aa74f43e86c96202109a173bbaba

Change-Id: I2d5e965f0f19f86992794eec78134e862899c931
---
 lib/databases/mysql | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7bbcace399..a0cf7a4296 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -71,6 +71,10 @@ function configure_database_mysql {
     elif is_fedora; then
         mysql=mariadb
         my_conf=/etc/my.cnf
+        local cracklib_conf=/etc/my.cnf.d/cracklib_password_check.cnf
+        if [ -f "$cracklib_conf" ]; then
+            inicomment -sudo "$cracklib_conf" "mariadb" "plugin-load-add"
+        fi
     else
         exit_distro_not_supported "mysql configuration"
     fi

From c087c71834a6eb1d44040142f888b33ffefb5192 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 15 Jun 2017 12:10:45 +0000
Subject: [PATCH 1965/3333] Revert "systemd: Always create the systemd unit
 files"

This reverts commit 15b0a5f1eb849a30bcea9a1e437e9a88ae2c6f92.

The change had an assumption that a service
is properly configured even when it isn't enabled.
The assumption is not true.

Change-Id: Ib5a8ffe63eaec15bc29bfdd133db7169507bab82
Closes-Bug: #1698129
---
 functions-common | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/functions-common b/functions-common
index 48ce72524e..30933ea4c2 100644
--- a/functions-common
+++ b/functions-common
@@ -1508,13 +1508,8 @@ EOF
 
 }
 
-# Defines a systemd service which can be enabled and started later on.
-# arg1: The openstack service name ('n-cpu', 'c-sch', ...).
-# arg2: The command to start (e.g. path to service binary + config files).
-# arg3: The group which owns the process.
-# arg4: The user which owns the process.
-# Returns: The systemd service name which got defined.
-function _define_systemd_service {
+# Helper function to build a basic unit file and run it under systemd.
+function _run_under_systemd {
     local service=$1
     local command="$2"
     local cmd=$command
@@ -1529,7 +1524,9 @@ function _define_systemd_service {
     else
         write_user_unit_file $systemd_service "$cmd" "$group" "$user"
     fi
-    echo $systemd_service
+
+    $SYSTEMCTL enable $systemd_service
+    $SYSTEMCTL start $systemd_service
 }
 
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
@@ -1570,19 +1567,11 @@ function run_process {
     local user=$4
 
     local name=$service
-    local systemd_service
 
     time_start "run_process"
-    # Note we deliberately make all service files, even if the service
-    # isn't enabled, so it can be enabled by a dev manually on command
-    # line.
-    if [[ "$USE_SYSTEMD" = "True" ]]; then
-        systemd_service=$(_define_systemd_service "$name" "$command" "$group" "$user")
-    fi
     if is_service_enabled $service; then
         if [[ "$USE_SYSTEMD" = "True" ]]; then
-            $SYSTEMCTL enable $systemd_service
-            $SYSTEMCTL start $systemd_service
+            _run_under_systemd "$name" "$command" "$group" "$user"
         elif [[ "$USE_SCREEN" = "True" ]]; then
             if [[ "$user" == "root" ]]; then
                 command="sudo $command"

From 0ffd5a944c371ae441c2c8d977486c5a20bc75fc Mon Sep 17 00:00:00 2001
From: Chris <chris.friesen@windriver.com>
Date: Fri, 23 Jun 2017 11:28:20 -0600
Subject: [PATCH 1966/3333] remove unnecessary cleanup in nova startup

nova's instances directory may be a shared directory (ie nfs), in
these cases, we do not want to call nova_cleanup at startup since it
deletes everything under $NOVA_INSTANCES_PATH.

The nova_cleanup routine will still be called by the clean.sh script
which is fine since we're presumably cleaning up the whole openstack
cluster at that point.

Change-Id: Ieb4e5d0508d4ed4c5349c497554c5da2993c9cb0
Closes-Bug: #1649389
---
 stack.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 326d186b19..2be4528991 100755
--- a/stack.sh
+++ b/stack.sh
@@ -893,7 +893,6 @@ fi
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
-    cleanup_nova
     configure_nova
 fi
 

From 1fa653635781cd975a1031e212b35b6c38196ba4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 23 Jun 2017 22:32:37 +0000
Subject: [PATCH 1967/3333] Revert "Revert "Use uwsgi for glance-api""

This reverts commit 3410e3e01bdbdbfd360d9baebeac081c33ee0821.

Change-Id: Ic58711311eb8534cb3c4b25c333197c412ffdce5
---
 lib/apache | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/cinder |  2 +-
 lib/glance | 44 ++++++++++++++++++++++++++++++++------------
 lib/nova   |  2 +-
 4 files changed, 87 insertions(+), 15 deletions(-)

diff --git a/lib/apache b/lib/apache
index c1b6bf8b41..25c65fe672 100644
--- a/lib/apache
+++ b/lib/apache
@@ -275,12 +275,64 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
+        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
 }
 
+# For services using chunked encoding, the only services known to use this
+# currently are Glance and Swift, we need to use an http proxy instead of
+# mod_proxy_uwsgi because the chunked encoding gets dropped. See:
+# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
+# but that involves having apache buffer the request before sending it to
+# uswgi.
+function write_local_uwsgi_http_config {
+    local file=$1
+    local wsgi=$2
+    local url=$3
+    name=$(basename $wsgi)
+
+    # create a home for the sockets; note don't use /tmp -- apache has
+    # a private view of it on some platforms.
+
+    # always cleanup given that we are using iniset here
+    rm -rf $file
+    iniset "$file" uwsgi wsgi-file "$wsgi"
+    port=$(get_random_port)
+    iniset "$file" uwsgi http "127.0.0.1:$port"
+    iniset "$file" uwsgi processes $API_WORKERS
+    # This is running standalone
+    iniset "$file" uwsgi master true
+    # Set die-on-term & exit-on-reload so that uwsgi shuts down
+    iniset "$file" uwsgi die-on-term true
+    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi enable-threads true
+    iniset "$file" uwsgi plugins python
+    # uwsgi recommends this to prevent thundering herd on accept.
+    iniset "$file" uwsgi thunder-lock true
+    # Override the default size for headers from the 4k default.
+    iniset "$file" uwsgi buffer-size 65535
+    # Make sure the client doesn't try to re-use the connection.
+    iniset "$file" uwsgi add-header "Connection: close"
+    # This ensures that file descriptors aren't shared between processes.
+    iniset "$file" uwsgi lazy-apps true
+    iniset "$file" uwsgi chmod-socket 666
+    iniset "$file" uwsgi http-raw-body true
+    iniset "$file" uwsgi http-chunked-input true
+    iniset "$file" uwsgi http-auto-chunked true
+
+    enable_apache_mod proxy
+    enable_apache_mod proxy_http
+    local apache_conf=""
+    apache_conf=$(apache_site_config_for $name)
+    echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
+    enable_apache_site $name
+    restart_apache_server
+}
+
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/cinder b/lib/cinder
index 20688129fd..243b639a11 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -335,7 +335,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
-    iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
diff --git a/lib/glance b/lib/glance
index baf8c6191c..41145f980d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -71,6 +71,16 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
+# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
+# TODO(mtreinish): Remove the eventlet path here and in all the similar
+# conditionals below after the Pike release
+if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
+else
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+fi
 
 # Functions
 # ---------
@@ -104,16 +114,13 @@ function configure_glance {
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
-    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -141,8 +148,6 @@ function configure_glance {
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
-    iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
         iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
@@ -181,9 +186,12 @@ function configure_glance {
         inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
+    # We need to tell glance what it's public endpoint is so that the version
+    # discovery document will be correct
+    iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_URL
+
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
@@ -199,7 +207,6 @@ function configure_glance {
     setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
-
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
@@ -232,6 +239,13 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+    else
+        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -256,7 +270,7 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+            "$GLANCE_URL"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
@@ -323,15 +337,21 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        fi
         start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
-    run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
+    else
+        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    fi
 
-    echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
+    echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
         die $LINENO "g-api did not start"
     fi
 }
diff --git a/lib/nova b/lib/nova
index 18715fc418..f56509ac1a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From 580a506f250162078f1aaf970f58033bfeb859e9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sun, 25 Jun 2017 08:01:06 +0000
Subject: [PATCH 1968/3333] Updated from generate-devstack-plugins-list

Change-Id: I6e040449252aae43f330d545d979b3bdba6f855a
---
 doc/source/plugin-registry.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c1c66b9bb6..92e5ecdb89 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -53,6 +53,7 @@ devstack-plugin-mariadb                `git://git.openstack.org/openstack/devsta
 devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
 devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
 devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
+devstack-plugin-vmax                   `git://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
 devstack-plugin-zmq                    `git://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
 dragonflow                             `git://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
 drbd-devstack                          `git://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
@@ -123,9 +124,11 @@ networking-vsphere                     `git://git.openstack.org/openstack/networ
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
+neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+neutron-vpnaas-dashboard               `git://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
@@ -154,6 +157,7 @@ tricircle                              `git://git.openstack.org/openstack/tricir
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
 trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
+valet                                  `git://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
 vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
 vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__

From 20eeff813d21e86c1d529d5cbc4f7b0ad732e69d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 26 Jun 2017 07:53:08 +0000
Subject: [PATCH 1969/3333] Revert "Fleetify nova conductor for N cells"

This reverts commit f63aa021cf996b500b6a570c0114c490bb57461a.

Change-Id: I541abe7311e5721d79e300fcb2a0b8ffdcd3c015
Related-Bug: #1700364
---
 lib/nova | 111 ++++++-------------------------------------------------
 stack.sh |   4 +-
 2 files changed, 13 insertions(+), 102 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8eac254262..5832f11d67 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,18 +53,10 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
-NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
-# The total number of cells we expect. Must be greater than one and doesn't
-# count cell0.
-NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
-# Our cell index, so we know what rabbit vhost to connect to.
-# This should be in the range of 1-$NOVA_NUM_CELLS
-NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
-
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
 if is_suse; then
@@ -487,7 +479,7 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
+        iniset $NOVA_CONF database connection `database_connection_url nova`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -622,20 +614,6 @@ function create_nova_conf {
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
-
-    if is_service_enabled n-cond; then
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            local conf
-            local vhost
-            conf=$(conductor_conf $i)
-            vhost="nova_cell${i}"
-            iniset $conf database connection `database_connection_url nova_cell${i}`
-            iniset $conf conductor workers "$API_WORKERS"
-            iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
-            rpc_backend_add_vhost $vhost
-            iniset_rpc_backend nova $conf DEFAULT $vhost
-        done
-    fi
 }
 
 function init_nova_service_user_conf {
@@ -650,11 +628,6 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
-function conductor_conf {
-    local cell="$1"
-    echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
-}
-
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
@@ -719,6 +692,8 @@ function init_nova {
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
+        # (Re)create nova databases
+        recreate_database nova
         recreate_database nova_cell0
 
         # map_cell0 will create the cell mapping record in the nova_api DB so
@@ -730,12 +705,6 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
-        # (Re)create nova databases
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            recreate_database nova_cell${i}
-            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
-        done
-
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -744,13 +713,9 @@ function init_nova {
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
 
-        # FIXME(danms): Should this be configurable?
-        iniset $NOVA_CONF workarounds disable_group_policy_check_upcall True
-
         # create the cell1 cell for the main nova db where the hosts live
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
-        done
+        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
+            --name 'cell1'
     fi
 
     create_nova_cache_dir
@@ -858,38 +823,25 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
-    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
-        # NOTE(danms): Don't setup conductor fleet for cellsv1
-        nomulticellflag='nomulticell'
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
-    if [ "$nomulticellflag" = 'nomulticell' ]; then
-        # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
-        # skip these bits and use the normal config.
-        NOVA_CPU_CONF=$compute_cell_conf
-        echo "Skipping multi-cell conductor fleet setup"
-    else
-        cp $compute_cell_conf $NOVA_CPU_CONF
-        iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
-    fi
-
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LIBVIRT_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LXD_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $DOCKER_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
@@ -898,13 +850,13 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
-            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
+            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf --config-file $fake_conf"
         done
     else
         if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
             start_nova_hypervisor
         fi
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF"
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
 
     export PATH=$old_path
@@ -924,6 +876,7 @@ function start_nova_rest {
     fi
 
     # ``run_process`` checks ``is_service_enabled``, it is not needed here
+    run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
 
@@ -946,38 +899,8 @@ function start_nova_rest {
     export PATH=$old_path
 }
 
-function enable_nova_fleet {
-    if is_service_enabled n-cond; then
-        enable_service n-super-cond
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            enable_service n-cond-cell${i}
-        done
-    fi
-}
-
-function start_nova_conductor {
-    if is_service_enabled n-cell; then
-        echo "Starting nova-conductor in a cellsv1-compatible way"
-        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
-        return
-    fi
-
-    enable_nova_fleet
-    if is_service_enabled n-super-cond; then
-        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
-    fi
-    for i in $(seq 1 $NOVA_NUM_CELLS); do
-        if is_service_enabled n-cond-cell${i}; then
-            local conf
-            conf=$(conductor_conf $i)
-            run_process n-cond-cell${i} "$NOVA_BIN_DIR/nova-conductor --config-file $conf"
-        fi
-    done
-}
-
 function start_nova {
     start_nova_rest
-    start_nova_conductor
     start_nova_compute
 }
 
@@ -1006,24 +929,14 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-api-meta n-sproxy; do
+    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }
 
-function stop_nova_conductor {
-    enable_nova_fleet
-    for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
-        if is_service_enabled $srv; then
-            stop_process $srv
-        fi
-    done
-}
-
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova {
     stop_nova_rest
-    stop_nova_conductor
     stop_nova_compute
 }
 
diff --git a/stack.sh b/stack.sh
index 5148ae1d77..6793d45cc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1268,9 +1268,7 @@ fi
 # Unable to use LUKS passphrase that is exactly 16 bytes long
 # https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    key=$(generate_hex_string 36)
-    iniset $NOVA_CONF key_manager fixed_key "$key"
-    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From b90bb1a46193b052cd98513213eed688e8e29d23 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 18 Apr 2017 16:30:14 +0000
Subject: [PATCH 1970/3333] Use uwsgi for nova when NOVA_USE_MOD_WSGI is not
 False

Unless NOVA_USE_MOD_WSGI is False, run nova-api and nova-metadata
using uwsgi.

Because the metadata server is always expected to run on a port and
without a prefix, we have it configured to use uwsgi but not to
proxy from apache: uwsgi listens on the configured port itself.

uwsgi process that listen themselve do not need a socket or to
chmod-socket, so those config lines have been moved to the block
that is also writing proxy configuration for apache.

Because this change only uses uwsgi for nova-api and nova-api-meta,
nova-api-meta is set to default to enabled in stackrc because the
nova-api wsgi application used by wsgi only presents the one service
(osapi_compute).

If NOVA_USE_MOD_WSGI is False and tls_proxy service is enabled,
nova-api is run on an internal port reached via the tls_proxy.

Depends-On: I8ff08d61520ccf04e32dcd02f4cecc39dae823cb
Change-Id: If2d7e363a6541854f2e30c03171bef7a41aff745
---
 lib/apache |   4 +-
 lib/nova   | 144 ++++++++++++++---------------------------------------
 stackrc    |   2 +-
 3 files changed, 40 insertions(+), 110 deletions(-)

diff --git a/lib/apache b/lib/apache
index 25c65fe672..8f517d2e61 100644
--- a/lib/apache
+++ b/lib/apache
@@ -250,7 +250,6 @@ function write_uwsgi_config {
     # always cleanup given that we are using iniset here
     rm -rf $file
     iniset "$file" uwsgi wsgi-file "$wsgi"
-    iniset "$file" uwsgi socket "$socket"
     iniset "$file" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$file" uwsgi master true
@@ -267,7 +266,6 @@ function write_uwsgi_config {
     iniset "$file" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
     iniset "$file" uwsgi lazy-apps true
-    iniset "$file" uwsgi chmod-socket 666
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
@@ -276,6 +274,8 @@ function write_uwsgi_config {
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
         echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
+        iniset "$file" uwsgi socket "$socket"
+        iniset "$file" uwsgi chmod-socket 666
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
diff --git a/lib/nova b/lib/nova
index f56509ac1a..3fa5de67eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -17,7 +17,6 @@
 #
 # - install_nova
 # - configure_nova
-# - _config_nova_apache_wsgi
 # - create_nova_conf
 # - init_nova
 # - start_nova
@@ -28,7 +27,6 @@
 _XTRACE_LIB_NOVA=$(set +o | grep xtrace)
 set +o xtrace
 
-
 # Defaults
 # --------
 
@@ -56,17 +54,20 @@ NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
+NOVA_UWSGI=$NOVA_BIN_DIR/nova-api-wsgi
+NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
+NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
+NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
-if is_suse; then
-    NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/srv/www/htdocs/nova}
-else
-    NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/var/www/nova}
-fi
-
-# Toggle for deploying Nova-API under HTTPD + mod_wsgi
-NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
+# Toggle for deploying Nova-API under a wsgi server. We default to
+# true to use UWSGI, but allow False so that fall back to the
+# eventlet server can happen for grenade runs.
+# NOTE(cdent): We can adjust to remove the eventlet-base api service
+# after pike, at which time we can stop using NOVA_USE_MOD_WSGI to
+# mean "use uwsgi" because we'll be always using uwsgi.
+NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
 
 if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
@@ -236,66 +237,10 @@ function cleanup_nova {
     #    cleanup_nova_hypervisor
     #fi
 
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        _cleanup_nova_apache_wsgi
-    fi
-}
-
-# _cleanup_nova_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_nova_apache_wsgi {
-    sudo rm -f $NOVA_WSGI_DIR/*
-    sudo rm -f $(apache_site_config_for nova-api)
-    sudo rm -f $(apache_site_config_for nova-metadata)
-}
-
-# _config_nova_apache_wsgi() - Set WSGI config files of Nova API
-function _config_nova_apache_wsgi {
-    sudo mkdir -p $NOVA_WSGI_DIR
-
-    local nova_apache_conf
-    nova_apache_conf=$(apache_site_config_for nova-api)
-    local nova_metadata_apache_conf
-    nova_metadata_apache_conf=$(apache_site_config_for nova-metadata)
-    local nova_ssl=""
-    local nova_certfile=""
-    local nova_keyfile=""
-    local nova_api_port=$NOVA_SERVICE_PORT
-    local nova_metadata_port=$METADATA_SERVICE_PORT
-    local venv_path=""
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
-    fi
-
-    # copy proxy vhost and wsgi helper files
-    sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
-    sudo cp $NOVA_DIR/nova/wsgi/nova-metadata.py $NOVA_WSGI_DIR/nova-metadata
-
-    sudo cp $FILES/apache-nova-api.template $nova_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$nova_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-api|g;
-        s|%SSLENGINE%|$nova_ssl|g;
-        s|%SSLCERTFILE%|$nova_certfile|g;
-        s|%SSLKEYFILE%|$nova_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $nova_apache_conf
-
-    sudo cp $FILES/apache-nova-metadata.template $nova_metadata_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$nova_metadata_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-metadata|g;
-        s|%SSLENGINE%|$nova_ssl|g;
-        s|%SSLCERTFILE%|$nova_certfile|g;
-        s|%SSLKEYFILE%|$nova_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $nova_metadata_apache_conf
+    stop_process "n-api"
+    stop_process "n-api-meta"
+    remove_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI"
+    remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI"
 }
 
 # configure_nova() - Set config files, create data dirs, etc
@@ -489,7 +434,7 @@ function create_nova_conf {
             NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
         fi
         iniset $NOVA_CONF DEFAULT enabled_apis "$NOVA_ENABLED_APIS"
-        if is_service_enabled tls-proxy; then
+        if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
             # Set the service port for a proxy to take the original
             iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
@@ -524,11 +469,10 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
     # Format logging
-    setup_logging $NOVA_CONF $NOVA_USE_MOD_WSGI
+    setup_logging $NOVA_CONF
 
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        _config_nova_apache_wsgi
-    fi
+    write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
+    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" ":${METADATA_SERVICE_PORT}"
 
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
@@ -777,10 +721,6 @@ function install_nova {
     git_clone $NOVA_REPO $NOVA_DIR $NOVA_BRANCH
     setup_develop $NOVA_DIR
     sudo install -D -m 0644 -o $STACK_USER {$NOVA_DIR/tools/,/etc/bash_completion.d/}nova-manage.bash_completion
-
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # start_nova_api() - Start the API process ahead of other things
@@ -788,6 +728,7 @@ function start_nova_api {
     # Get right service port for testing
     local service_port=$NOVA_SERVICE_PORT
     local service_protocol=$NOVA_SERVICE_PROTOCOL
+    local nova_url
     if is_service_enabled tls-proxy; then
         service_port=$NOVA_SERVICE_PORT_INT
         service_protocol="http"
@@ -797,29 +738,23 @@ function start_nova_api {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file
-    enabled_site_file=$(apache_site_config_for nova-api)
-    if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        enable_apache_site nova-api
-        enable_apache_site nova-metadata
-        restart_apache_server
-        tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
-        tail_log nova-metadata /var/log/$APACHE_NAME/nova-metadata.log
-    else
+    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
         run_process n-api "$NOVA_BIN_DIR/nova-api"
+        nova_url=$service_protocol://$SERVICE_HOST:$service_port
+        # Start proxy if tsl enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
+        fi
+    else
+        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --ini $NOVA_UWSGI_CONF"
+        nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
     fi
 
     echo "Waiting for nova-api to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$SERVICE_HOST:$service_port; then
+    if ! wait_for_service $SERVICE_TIMEOUT $nova_url; then
         die $LINENO "nova-api did not start"
     fi
 
-    # Start proxies if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
-    fi
-
     export PATH=$old_path
 }
 
@@ -890,7 +825,11 @@ function start_nova_rest {
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
-    run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
+    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
+        run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
+    else
+        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --ini $NOVA_METADATA_UWSGI_CONF"
+    fi
 
     run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
     run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
@@ -921,17 +860,8 @@ function stop_nova_compute {
 }
 
 function stop_nova_rest {
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site nova-api
-        disable_apache_site nova-metadata
-        restart_apache_server
-    else
-        stop_process n-api
-    fi
-    # Kill the nova screen windows
-    # Some services are listed here twice since more than one instance
-    # of a service may be running in certain configs.
-    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
+    # Kill the non-compute nova processes
+    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-sproxy; do
         stop_process $serv
     done
 }
diff --git a/stackrc b/stackrc
index 50f7c89ba3..eccc52aac5 100644
--- a/stackrc
+++ b/stackrc
@@ -53,7 +53,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth,n-api-meta
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova

From 2c0faca0380050b697b7d7fe6589102fa8a0cb5d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 28 Jun 2017 09:13:04 -0400
Subject: [PATCH 1971/3333] Add devstack-version script

This will help in collecting information about the devstack version
being used.

Change-Id: I23a8ca023bda6d097051cd57ae45401806451ad5
---
 functions | 15 +++++++++++++++
 stack.sh  | 14 +++++++++++++-
 stackrc   |  1 +
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index e056c3fba2..738040d7bc 100644
--- a/functions
+++ b/functions
@@ -751,6 +751,21 @@ function get_random_port {
 }
 
 
+function write_devstack_version {
+    pushd $TOP_DIR
+    local git_version=""
+    git_version=$(git log --format="%H %s %ci" -1)
+    cat - > /tmp/devstack-version <<EOF
+#!/bin/bash
+
+echo "DevStack Version: ${DEVSTACK_SERIES} - ${git_version}"
+echo "OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}"
+
+EOF
+    sudo install -m 755 /tmp/devstack-version /usr/local/bin/devstack-version
+    rm /tmp/devstack-version
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/stack.sh b/stack.sh
index 59f25973ea..fd1865129f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -216,6 +216,9 @@ if [[ ! -r $TOP_DIR/stackrc ]]; then
 fi
 source $TOP_DIR/stackrc
 
+# this installs a devstack-version script to make it easy to report the version back
+write_devstack_version
+
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
 if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|rhel7|kvmibm1) ]]; then
@@ -1521,19 +1524,28 @@ fi
 
 # Warn that a deprecated feature was used
 if [[ -n "$DEPRECATED_TEXT" ]]; then
-    echo_summary "WARNING: $DEPRECATED_TEXT"
+    echo
+    echo -e "WARNING: $DEPRECATED_TEXT"
+    echo
 fi
 
 # If USE_SYSTEMD is enabled, tell the user about using it.
 if [[ "$USE_SYSTEMD" == "True" ]]; then
+    echo
     echo "Services are running under systemd unit files."
     echo "For more information see: "
     echo "https://docs.openstack.org/developer/devstack/systemd.html"
+    echo
 fi
 
+# devstack version
+devstack-version
+echo
+
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)
 echo_summary "stack.sh completed in $SECONDS seconds."
 
+
 # Restore/close logging file descriptors
 exec 1>&3
 exec 2>&3
diff --git a/stackrc b/stackrc
index 50f7c89ba3..5da9a2abec 100644
--- a/stackrc
+++ b/stackrc
@@ -272,6 +272,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
+DEVSTACK_SERIES="pike"
 
 ##############
 #

From 82d0610f14e09931e00443364c7da25f42aa89de Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 28 Jun 2017 17:42:31 -0400
Subject: [PATCH 1972/3333] Ensure keepalive isn't used on uwsgi http mode

According to the uwsgi docs [1] for http keepalive there is a separate
option for http keep alive, and just setting connection close isn't
enough. This commit makes sure we disable http keepalive. This will
hopefully fix the random connection issues we get on image uploads to
glance, which uses uwsgi http mode.

[1] http://uwsgi-docs.readthedocs.io/en/latest/HTTP.html#http-keep-alive

Change-Id: Ic5f83c5c93f28b2bd62ca9ac96ca8c87797ea5c9
Closes-Bug: #1701088
---
 lib/apache | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/apache b/lib/apache
index 25c65fe672..35a9e7b733 100644
--- a/lib/apache
+++ b/lib/apache
@@ -322,6 +322,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi http-raw-body true
     iniset "$file" uwsgi http-chunked-input true
     iniset "$file" uwsgi http-auto-chunked true
+    iniset "$file" uwsgi http-keepalive false
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http

From daf1274409ce8b9bd6b21955f4172bd70a7e5c68 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean_mcginnis@dell.com>
Date: Fri, 3 Mar 2017 18:09:35 +0000
Subject: [PATCH 1973/3333] Run cinder-api with uWSGI

Per the Pike goal, switching the Cinder API control plane to
use WSGI in Apache.

Co-Authored-By: Ivan Kolodyazhny <e0ne@e0ne.info>
Depends-On: Ie8a0eeab1bf31887d6f37cf155b2d161ddfb172d
Depends-On: I14b68f36e7fcc5341bbdbcf165274d9d50f7dd04
Change-Id: I8cef6c98f9242cc38d66de0ac499490e2a237887
---
 lib/cinder | 155 +++++++++++++++++++++++++----------------------------
 1 file changed, 72 insertions(+), 83 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index b585416f7a..4274be740a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -55,6 +55,8 @@ CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
+CINDER_UWSGI=$CINDER_BIN_DIR/cinder-wsgi
+CINDER_UWSGI_CONF=$CINDER_CONF_DIR/cinder-api-uwsgi.ini
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
 # Public facing bits
@@ -106,8 +108,9 @@ else
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 fi
 
-# Toggle for deploying Cinder under HTTPD + mod_wsgi
-CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-False}
+# Toggle for deploying Cinder under a wsgi server. Legacy mod_wsgi
+# reference should be cleaned up to more accurately refer to uwsgi.
+CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-True}
 
 # Source the enabled backends
 if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -196,38 +199,8 @@ function cleanup_cinder {
         done
     fi
 
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        _cinder_cleanup_apache_wsgi
-    fi
-}
-
-# _cinder_config_apache_wsgi() - Set WSGI config files
-function _cinder_config_apache_wsgi {
-    local cinder_apache_conf
-    cinder_apache_conf=$(apache_site_config_for osapi-volume)
-    local cinder_ssl=""
-    local cinder_certfile=""
-    local cinder_keyfile=""
-    local cinder_api_port=$CINDER_SERVICE_PORT
-    local venv_path=""
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["cinder"]}/lib/python2.7/site-packages"
-    fi
-
-    # copy proxy vhost file
-    sudo cp $FILES/apache-cinder-api.template $cinder_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$cinder_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%APIWORKERS%|$API_WORKERS|g
-        s|%CINDER_BIN_DIR%|$CINDER_BIN_DIR|g;
-        s|%SSLENGINE%|$cinder_ssl|g;
-        s|%SSLCERTFILE%|$cinder_certfile|g;
-        s|%SSLKEYFILE%|$cinder_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $cinder_apache_conf
+    stop_process "c-api"
+    remove_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI"
 }
 
 # configure_cinder() - Set config files, create data dirs, etc
@@ -319,9 +292,18 @@ function configure_cinder {
     fi
 
     if is_service_enabled tls-proxy; then
-        # Set the service port for a proxy to take the original
-        iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-        iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+        if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
+            # Set the service port for a proxy to take the original
+            if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
+                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
+            else
+                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+            fi
+        fi
     fi
 
     if [ "$SYSLOG" != "False" ]; then
@@ -333,9 +315,7 @@ function configure_cinder {
     # Format logging
     setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        _cinder_config_apache_wsgi
-    fi
+    write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
         configure_cinder_driver
@@ -374,29 +354,47 @@ function configure_cinder {
 
 # Migrated from keystone_data.sh
 function create_cinder_accounts {
-
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
         create_service_user "cinder"
 
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
-        get_or_create_endpoint \
-            "volume" \
-            "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
-
-        get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-        get_or_create_endpoint \
-            "volumev2" \
-            "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
-
-        get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-        get_or_create_endpoint \
-            "volumev3" \
-            "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
+            get_or_create_endpoint \
+                "volume" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
+
+            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+            get_or_create_endpoint \
+                "volumev2" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
+
+            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
+            get_or_create_endpoint \
+                "volumev3" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+        else
+            get_or_create_endpoint \
+                "volume" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v1/\$(project_id)s"
+
+            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+            get_or_create_endpoint \
+                "volumev2" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v2/\$(project_id)s"
+
+            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
+            get_or_create_endpoint \
+                "volumev3" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
+        fi
 
         configure_cinder_internal_tenant
     fi
@@ -449,10 +447,6 @@ function install_cinder {
     elif [[ "$CINDER_ISCI_HELPER" == "lioadm" ]]; then
         install_package targetcli
     fi
-
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # install_cinderclient() - Collect source and prepare
@@ -483,7 +477,8 @@ function _configure_tgt_for_config_d {
 function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
+    local cinder_url
+    if is_service_enabled tls-proxy && ["$CINDER_USE_MOD_WSGI" == "False"]; then
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi
@@ -507,24 +502,23 @@ function start_cinder {
         fi
     fi
 
-    if is_service_enabled c-api ; then
-        if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-            enable_apache_site osapi-volume
-            restart_apache_server
-            tail_log c-api /var/log/$APACHE_NAME/c-api.log
-        else
+    if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
+        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
             run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
+            cinder_url=$service_protocol://$SERVICE_HOST:$service_port
+            # Start proxy if tsl enabled
+            if is_service_enabled tls_proxy; then
+                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_POR_INT
+            fi
+        else
+            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --ini $CINDER_UWSGI_CONF"
+            cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
         fi
+    fi
 
-        echo "Waiting for Cinder API to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-            die $LINENO "c-api did not start"
-        fi
-
-        # Start proxies if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
-        fi
+    echo "Waiting for Cinder API to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $cinder_url; then
+        die $LINENO "c-api did not start"
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
@@ -538,12 +532,7 @@ function start_cinder {
 
 # stop_cinder() - Stop running processes
 function stop_cinder {
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site osapi-volume
-        restart_apache_server
-    else
-        stop_process c-api
-    fi
+    stop_process c-api
 
     # Kill the cinder screen windows
     local serv

From 3415521d5659b2268b8984bf89ede8e34f1b76f7 Mon Sep 17 00:00:00 2001
From: Manjeet Singh Bhatia <manjeetingh1156@gmail.com>
Date: Fri, 30 Jun 2017 01:46:12 +0000
Subject: [PATCH 1974/3333] Don't dump commit message header to
 devstack-version

Dumping commit message to /usr/local/bin/devstack-version
has broken devstack build, because of bash error in formatting.
error log [1].

[1]. http://logs.openstack.org/20/418720/6/check/gate-tempest-dsvm-networking-odl-boron-snapshot-v2driver/ed9fd45/logs/devstacklog.txt.gz

Change-Id: I4c269a7f3d63ee9a976e7c3636fc3e5e8dab9ae3
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 738040d7bc..f04bc1fcbb 100644
--- a/functions
+++ b/functions
@@ -754,7 +754,7 @@ function get_random_port {
 function write_devstack_version {
     pushd $TOP_DIR
     local git_version=""
-    git_version=$(git log --format="%H %s %ci" -1)
+    git_version=$(git log --format="%H %ci" -1)
     cat - > /tmp/devstack-version <<EOF
 #!/bin/bash
 

From 1560efe9c93b17438ab37d94443832dde3842637 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 30 Jun 2017 12:15:26 -0400
Subject: [PATCH 1975/3333] Switch local http uwsgi conf to http-socket mode

Previously the local uwsgi server mode was using uwsgi in http mode.
This was unessecary and actually not recommend by the uwsgi docs [1][2]
This is because http mode starts a frontend http process that forwards
requests to the workers running the python code. This is done for the
largely the same reasons we're using apache as a proxy and is
unnecessary. http-socket mode doesn't do this and just exposes the
workers as an http interface to the proxy. (in our case apache)

[1] http://uwsgi-docs.readthedocs.io/en/latest/HTTP.html#http-sockets
[2] http://uwsgi-docs.readthedocs.io/en/latest/ThingsToKnow.html

Change-Id: I5671687c8083fa4bdee066c07b083a0f00be532b
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index cf438a0794..445241e707 100644
--- a/lib/apache
+++ b/lib/apache
@@ -301,7 +301,7 @@ function write_local_uwsgi_http_config {
     rm -rf $file
     iniset "$file" uwsgi wsgi-file "$wsgi"
     port=$(get_random_port)
-    iniset "$file" uwsgi http "127.0.0.1:$port"
+    iniset "$file" uwsgi http-socket "127.0.0.1:$port"
     iniset "$file" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$file" uwsgi master true

From b79531a9f96736225a8991052a0be5767c217377 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 30 Jun 2017 12:10:06 -0400
Subject: [PATCH 1976/3333] Increase the socket timeout on uwsgi local mode

This commit increases the socket timeout value from 4 secs to a much
higher 30 secs. This is just for sanity, the load is high when we're
seeing the wsgi.input timeouts, so uwsgi might be just closing the
socket waiting for data over the wire. 30 seconds is overly conservative
just so we can rule this out. This will likely be shrunk to a more
reasonable value in the future.

Change-Id: Iae85d3a084fb33b2a63550d6e353413e98c0b39c
Partial-Bug: #1701088
---
 lib/apache | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/apache b/lib/apache
index 445241e707..e29acf29b3 100644
--- a/lib/apache
+++ b/lib/apache
@@ -323,6 +323,8 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi http-chunked-input true
     iniset "$file" uwsgi http-auto-chunked true
     iniset "$file" uwsgi http-keepalive false
+    # Increase socket timeout for slow chunked uploads
+    iniset "$file" uwsgi socket-timeout 30
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http

From 07cbc4494255efa2c394b4b60e5beaa3d10f244e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 30 Jun 2017 12:29:19 +1000
Subject: [PATCH 1977/3333] Put devstack-version info into separate file

As a follow on to I4c269a7f3d63ee9a976e7c3636fc3e5e8dab9ae3; the
quoting gets tricky when putting arbitrary command-substitution
strings into saved echo-able strings.  As they say, "the only winning
move is not to play" :)

An alternative proposal is to not write this into a script but just
dump info into a file.  To my mind, this has several advantages --
avoid getting involved in quoting, not dropping a script into the
global environment -- it's just as easy to "cat" -- and the plain-text
file can be collected as an artifact during log collection (also moved
git commit line to separate line for easier parsing during log search,
etc).

Change-Id: Ic7391dd087657c0daf74046e4a052c53f4eb6e1a
---
 functions | 17 +++++++----------
 stack.sh  |  6 +++---
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/functions b/functions
index f04bc1fcbb..6f2164a777 100644
--- a/functions
+++ b/functions
@@ -750,19 +750,16 @@ function get_random_port {
     echo $port
 }
 
-
+# Save some state information
+#
+# Write out various useful state information to /etc/devstack-version
 function write_devstack_version {
-    pushd $TOP_DIR
-    local git_version=""
-    git_version=$(git log --format="%H %ci" -1)
     cat - > /tmp/devstack-version <<EOF
-#!/bin/bash
-
-echo "DevStack Version: ${DEVSTACK_SERIES} - ${git_version}"
-echo "OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}"
-
+DevStack Version: ${DEVSTACK_SERIES}
+Change: $(git log --format="%H %s %ci" -1)
+OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}
 EOF
-    sudo install -m 755 /tmp/devstack-version /usr/local/bin/devstack-version
+    sudo install -m 644 /tmp/devstack-version /etc/devstack-version
     rm /tmp/devstack-version
 }
 
diff --git a/stack.sh b/stack.sh
index fd1865129f..c453b917e2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -216,7 +216,7 @@ if [[ ! -r $TOP_DIR/stackrc ]]; then
 fi
 source $TOP_DIR/stackrc
 
-# this installs a devstack-version script to make it easy to report the version back
+# write /etc/devstack-version
 write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
@@ -1538,8 +1538,8 @@ if [[ "$USE_SYSTEMD" == "True" ]]; then
     echo
 fi
 
-# devstack version
-devstack-version
+# Useful info on current state
+cat /etc/devstack-version
 echo
 
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)

From 17cdecc689b20bfa3dc06ea23edacccf9e37497d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 5 Jul 2017 20:25:02 -0400
Subject: [PATCH 1978/3333] Enable tempest testing for extending an attached
 volume

In Pike, Cinder and Nova will support extending the size of
an attached volume, but it's not supported by all volume and
compute backends. Tempest will also test it but uses a config
option that we need to set based on how devstack is configured.

Depends-On: Ibace6c2f91be9753a44e5f79fd013df11654851b

Related to cinder blueprint extend-attached-volume
Related to nova blueprint nova-support-attached-volume-extend

Change-Id: I52cc2952a2938ce44c442aa3e3b69a905b2b55d5
---
 lib/tempest | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..537da614d1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -430,6 +430,12 @@ function configure_tempest {
         TEMPEST_VOLUME_MANAGE_VOLUME=${TEMPEST_VOLUME_MANAGE_VOLUME:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled manage_volume $(trueorfalse False TEMPEST_VOLUME_MANAGE_VOLUME)
+    # Only turn on TEMPEST_EXTEND_ATTACHED_VOLUME by default for "lvm" backends
+    # in Cinder and the libvirt driver in Nova.
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]] && [ "$VIRT_DRIVER" = "libvirt" ]; then
+        TEMPEST_EXTEND_ATTACHED_VOLUME=${TEMPEST_EXTEND_ATTACHED_VOLUME:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_volume $(trueorfalse False TEMPEST_EXTEND_ATTACHED_VOLUME)
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)

From f3d533157267a1568eeb36a349aee637195e9c8a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 8 Jun 2017 08:22:38 -0400
Subject: [PATCH 1979/3333] Fleetify nova conductor for N cells

This makes us start two levels of nova-conductor processes, and one per cell.

Note that this also sets the notification transport_url to the top-level mq
so that we continue to get a unified stream of notifications.

Related-Bug: #1700496
Change-Id: I08d7da843d18b426dda8a8a231039d950a4c0ce5
Depends-On: I64b600b30f6e54db0ec9083c6c176e895c6d0cc2
Depends-On: If59453f1899e99040c554bcb9ad54c8a506adc56
---
 lib/nova | 111 +++++++++++++++++++++++++++++++++++++++++++++++++------
 stack.sh |   4 +-
 2 files changed, 102 insertions(+), 13 deletions(-)

diff --git a/lib/nova b/lib/nova
index 3fa5de67eb..11c746911b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -51,6 +51,7 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
+NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
@@ -59,6 +60,13 @@ NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
 NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
 NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
+# The total number of cells we expect. Must be greater than one and doesn't
+# count cell0.
+NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
+# Our cell index, so we know what rabbit vhost to connect to.
+# This should be in the range of 1-$NOVA_NUM_CELLS
+NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
+
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
 # Toggle for deploying Nova-API under a wsgi server. We default to
@@ -424,7 +432,7 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova`
+        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -518,6 +526,7 @@ function create_nova_conf {
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
+    iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_transport_url)
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
@@ -558,6 +567,20 @@ function create_nova_conf {
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
+
+    if is_service_enabled n-cond; then
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            local vhost
+            conf=$(conductor_conf $i)
+            vhost="nova_cell${i}"
+            iniset $conf database connection `database_connection_url nova_cell${i}`
+            iniset $conf conductor workers "$API_WORKERS"
+            iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
+            rpc_backend_add_vhost $vhost
+            iniset_rpc_backend nova $conf DEFAULT $vhost
+        done
+    fi
 }
 
 function init_nova_service_user_conf {
@@ -572,6 +595,11 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
+function conductor_conf {
+    local cell="$1"
+    echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
+}
+
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
@@ -638,8 +666,6 @@ function init_nova {
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
-        # (Re)create nova databases
-        recreate_database nova
         recreate_database nova_cell0
 
         # map_cell0 will create the cell mapping record in the nova_api DB so
@@ -651,6 +677,12 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
+        # (Re)create nova databases
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            recreate_database nova_cell${i}
+            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
+        done
+
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -660,8 +692,9 @@ function init_nova {
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
 
         # create the cell1 cell for the main nova db where the hosts live
-        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
-            --name 'cell1'
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
+        done
     fi
 
     create_nova_cache_dir
@@ -760,25 +793,40 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
+    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
+        # NOTE(danms): Don't setup conductor fleet for cellsv1
+        nomulticellflag='nomulticell'
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
+    if [ "$nomulticellflag" = 'nomulticell' ]; then
+        # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
+        # skip these bits and use the normal config.
+        NOVA_CPU_CONF=$compute_cell_conf
+        echo "Skipping multi-cell conductor fleet setup"
+    else
+        cp $compute_cell_conf $NOVA_CPU_CONF
+        # FIXME(danms): Should this be configurable?
+        iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
+        iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
@@ -787,13 +835,13 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
-            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf --config-file $fake_conf"
+            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
         if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
             start_nova_hypervisor
         fi
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF"
     fi
 
     export PATH=$old_path
@@ -813,7 +861,6 @@ function start_nova_rest {
     fi
 
     # ``run_process`` checks ``is_service_enabled``, it is not needed here
-    run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
 
@@ -840,8 +887,38 @@ function start_nova_rest {
     export PATH=$old_path
 }
 
+function enable_nova_fleet {
+    if is_service_enabled n-cond; then
+        enable_service n-super-cond
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            enable_service n-cond-cell${i}
+        done
+    fi
+}
+
+function start_nova_conductor {
+    if is_service_enabled n-cell; then
+        echo "Starting nova-conductor in a cellsv1-compatible way"
+        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
+        return
+    fi
+
+    enable_nova_fleet
+    if is_service_enabled n-super-cond; then
+        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
+    fi
+    for i in $(seq 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled n-cond-cell${i}; then
+            local conf
+            conf=$(conductor_conf $i)
+            run_process n-cond-cell${i} "$NOVA_BIN_DIR/nova-conductor --config-file $conf"
+        fi
+    done
+}
+
 function start_nova {
     start_nova_rest
+    start_nova_conductor
     start_nova_compute
 }
 
@@ -861,14 +938,24 @@ function stop_nova_compute {
 
 function stop_nova_rest {
     # Kill the non-compute nova processes
-    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-sproxy; do
+    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-sproxy; do
         stop_process $serv
     done
 }
 
+function stop_nova_conductor {
+    enable_nova_fleet
+    for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled $srv; then
+            stop_process $srv
+        fi
+    done
+}
+
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova {
     stop_nova_rest
+    stop_nova_conductor
     stop_nova_compute
 }
 
diff --git a/stack.sh b/stack.sh
index fd1865129f..8a19438eba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1304,7 +1304,9 @@ fi
 # Unable to use LUKS passphrase that is exactly 16 bytes long
 # https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
+    key=$(generate_hex_string 36)
+    iniset $NOVA_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From cc36397134716116d802ba82b9ea9a0bc4830a42 Mon Sep 17 00:00:00 2001
From: Leticia Wanderley <leticiafwanderley@gmail.com>
Date: Mon, 26 Jun 2017 23:52:52 -0300
Subject: [PATCH 1980/3333] Fixes devstack ldap plugin

When the ldap service is enable on local.conf devstack ldap
plugin starts slapd service using its default config on Ubuntu
and installs ldap-utils package.
Enables domain specific drivers on Keystone and creates LDAP
domain 'Users' with a demo user.

Change-Id: I8d7aa260b01f675e4ed201ef93bfd66474f4b228
---
 files/ldap/user.ldif.in | 23 +++++++++++++
 lib/horizon             |  4 +++
 lib/keystone            | 72 +++++++++++++++++++++++++++++++++++------
 lib/ldap                | 24 ++++++++++++--
 4 files changed, 112 insertions(+), 11 deletions(-)
 create mode 100644 files/ldap/user.ldif.in

diff --git a/files/ldap/user.ldif.in b/files/ldap/user.ldif.in
new file mode 100644
index 0000000000..16a980757d
--- /dev/null
+++ b/files/ldap/user.ldif.in
@@ -0,0 +1,23 @@
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+# Demo LDAP user
+dn: cn=demo,ou=Users,${BASE_DN}
+cn: demo
+displayName: demo
+givenName: demo
+mail: demo@openstack.org
+objectClass: inetOrgPerson
+objectClass: top
+sn: demo
+uid: demo
+userPassword: demo
diff --git a/lib/horizon b/lib/horizon
index 9c7ec005a2..becc5a0e67 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -106,6 +106,10 @@ function configure_horizon {
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi
 
+    if is_service_enabled ldap; then
+        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT "True"
+    fi
+
     # Create an empty directory that apache uses as docroot
     sudo mkdir -p $HORIZON_DIR/.blackhole
 
diff --git a/lib/keystone b/lib/keystone
index eb46526264..1061081a5e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -219,17 +219,10 @@ function configure_keystone {
     fi
 
     # Rewrite stock ``keystone.conf``
-
     if is_service_enabled ldap; then
-        #Set all needed ldap values
-        iniset $KEYSTONE_CONF ldap password $LDAP_PASSWORD
-        iniset $KEYSTONE_CONF ldap user $LDAP_MANAGER_DN
-        iniset $KEYSTONE_CONF ldap suffix $LDAP_BASE_DN
-        iniset $KEYSTONE_CONF ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
-        iniset $KEYSTONE_CONF DEFAULT member_role_id "9fe2ff9ee4384b1894a90878d3e92bab"
-        iniset $KEYSTONE_CONF DEFAULT member_role_name "_member_"
+        iniset $KEYSTONE_CONF identity domain_config_dir "$KEYSTONE_CONF_DIR/domains"
+        iniset $KEYSTONE_CONF identity domain_specific_drivers_enabled "True"
     fi
-
     iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
     iniset $KEYSTONE_CONF identity password_hash_rounds $KEYSTONE_PASSWORD_HASH_ROUNDS
     iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
@@ -410,6 +403,10 @@ function create_keystone_accounts {
     get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
     get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
     get_or_add_group_project_role $admin_role $admin_group $admin_project
+
+    if is_service_enabled ldap; then
+        create_ldap_domain
+    fi
 }
 
 # Create a user that is capable of verifying keystone tokens for use with auth_token middleware.
@@ -615,6 +612,63 @@ function bootstrap_keystone {
         --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 
+# create_ldap_domain() - Create domain file and initialize domain with a user
+function create_ldap_domain {
+    # Creates domain Users
+    openstack --os-identity-api-version=3 domain create --description "LDAP domain" Users
+
+    # Create domain file inside etc/keystone/domains
+    KEYSTONE_LDAP_DOMAIN_FILE=$KEYSTONE_CONF_DIR/domains/keystone.Users.conf
+    mkdir -p "$KEYSTONE_CONF_DIR/domains"
+    touch "$KEYSTONE_LDAP_DOMAIN_FILE"
+
+    # Set identity driver 'ldap'
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE identity driver "ldap"
+
+    # LDAP settings for Users domain
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_delete "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_update "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_create "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_delete "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_update "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_create "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_objectclass "inetOrgPerson"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_mail_attribute "mail"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_id_attribute "uid"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user "cn=Manager,dc=openstack,dc=org"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap url "ldap://localhost"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap suffix $LDAP_BASE_DN
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap password $LDAP_PASSWORD
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_tree_dn "ou=Groups,$LDAP_BASE_DN"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_objectclass "groupOfNames"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_name_attribute "cn"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_id_attribute "cn"
+
+    # Restart apache and identity services to associate domain and conf file
+    sudo service apache2 reload
+    sudo systemctl restart devstack@keystone
+
+    # Create LDAP user.ldif and add user to LDAP backend
+    local tmp_ldap_dir
+    tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)
+
+    _ldap_varsubst $FILES/ldap/user.ldif.in $slappass >$tmp_ldap_dir/user.ldif
+    sudo ldapadd -x -w $LDAP_PASSWORD -D "$LDAP_MANAGER_DN" -H $LDAP_URL -c -f $tmp_ldap_dir/user.ldif
+    rm -rf $tmp_ldap_dir
+
+    local admin_project
+    admin_project=$(get_or_create_project "admin" default)
+    local ldap_user
+    ldap_user=$(openstack user show --domain=Users demo -f value -c id)
+    local admin_role="admin"
+    get_or_create_role $admin_role
+
+    # Grant demo LDAP user access to project and role
+    get_or_add_user_project_role $admin_role $ldap_user $admin_project
+}
+
 # Restore xtrace
 $_XTRACE_KEYSTONE
 
diff --git a/lib/ldap b/lib/ldap
index 4cea812d3c..5a53d0eaee 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -119,8 +119,7 @@ function install_ldap {
 
     printf "installing OpenLDAP"
     if is_ubuntu; then
-        # Ubuntu automatically starts LDAP so no need to call start_ldap()
-        :
+        configure_ldap
     elif is_fedora; then
         start_ldap
     elif is_suse; then
@@ -148,6 +147,27 @@ function install_ldap {
     rm -rf $tmp_ldap_dir
 }
 
+# configure_ldap() - Configure LDAP - reconfigure slapd
+function configure_ldap {
+    sudo debconf-set-selections <<EOF
+    slapd slapd/internal/generated_adminpw password $LDAP_PASSWORD
+    slapd slapd/internal/adminpw password $LDAP_PASSWORD
+    slapd slapd/password2 password $LDAP_PASSWORD
+    slapd slapd/password1 password $LDAP_PASSWORD
+    slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
+    slapd slapd/domain string Users
+    slapd shared/organization string $LDAP_DOMAIN
+    slapd slapd/backend string HDB
+    slapd slapd/purge_database boolean true
+    slapd slapd/move_old_database boolean true
+    slapd slapd/allow_ldap_v2 boolean false
+    slapd slapd/no_configuration boolean false
+    slapd slapd/dump_database select when needed
+EOF
+    sudo apt-get install -y slapd ldap-utils
+    sudo dpkg-reconfigure -f noninteractive $LDAP_SERVICE_NAME
+}
+
 # start_ldap() - Start LDAP
 function start_ldap {
     sudo service $LDAP_SERVICE_NAME restart

From 254116305c4a471ee857a9301e310bd2c406d937 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Tue, 11 Jul 2017 11:25:19 -0400
Subject: [PATCH 1981/3333] Remove mysql.qcow2 from stackrc

We no longer host this on tarballs.o.o, additionally it is no longer
used my trove.

Change-Id: I2034e8ebc530704d6e63a231056f92e14a8654e4
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 stackrc | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/stackrc b/stackrc
index c57e485343..4f16c3edf7 100644
--- a/stackrc
+++ b/stackrc
@@ -727,23 +727,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
     DOWNLOAD_DEFAULT_IMAGES=False
 fi
 
-# Staging area for new images.  These images are cached by a run of
-# ./tools/image_list.sh during CI image build (see
-# project-config:nodepool/elements/cache-devstack/extra-data.d/55-cache-devstack-repos).
-#
-# To avoid CI failures grabbing the images, new images should be here
-# for at least 24hrs (nodepool builds images at 14:00UTC) so the they
-# are in the cache.
-PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
-if [[ "$PRECACHE_IMAGES" == "True" ]]; then
-    # required for trove devstack tests; see
-    #  git.openstack.org/cgit/openstack/trove/tree/devstack/plugin.sh
-    IMAGE_URL="http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"
-    if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
-        IMAGE_URLS+=",$IMAGE_URL"
-    fi
-fi
-
 # Detect duplicate values in IMAGE_URLS
 for image_url in ${IMAGE_URLS//,/ }; do
     if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then

From 2f7df51cfa422ae79942953ca63d6b3a4aa37dd3 Mon Sep 17 00:00:00 2001
From: Jeremy Liu <liujiong@gohighsec.com>
Date: Wed, 12 Jul 2017 10:09:48 +0800
Subject: [PATCH 1982/3333] Correct 'uswgi' to 'uwsgi'

Change-Id: I22026e5640a626f45b7508b60f492dbdb30631af
---
 lib/apache | 2 +-
 lib/glance | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/apache b/lib/apache
index e29acf29b3..ffd7966de1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -287,7 +287,7 @@ function write_uwsgi_config {
 # mod_proxy_uwsgi because the chunked encoding gets dropped. See:
 # https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
 # but that involves having apache buffer the request before sending it to
-# uswgi.
+# uwsgi.
 function write_local_uwsgi_http_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/glance b/lib/glance
index 41145f980d..0a5b9f59b6 100644
--- a/lib/glance
+++ b/lib/glance
@@ -72,7 +72,7 @@ GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
-GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
+GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
 # TODO(mtreinish): Remove the eventlet path here and in all the similar
 # conditionals below after the Pike release

From 8175df1912a5722c2e308dc27623063ac542f496 Mon Sep 17 00:00:00 2001
From: Bogdan Katynski <bogdan.katynski@workday.com>
Date: Wed, 28 Jun 2017 12:34:52 +0100
Subject: [PATCH 1983/3333] Remove VGs when cleaning LVM up in devstack

This patch adds removing of the volume group
before removing the loopback device and
the backing file when performing LVM cleanup
in unstack.sh

Without this commit:

unstack.sh removes logical volumes, removes the
loopback devices and deletes the backing file
but leaves a dangling volume group

  $ ./stack.sh && ./unstack.sh
  $ sudo vgs
  VG                    #PV #LV #SN Attr   VSize  VFree
  stack-volumes-default   1   0   0 wz--n- 10.01g 10.01g
  $ sudo losetup -a
  $ sudo vgremove stack-volumes-default
  /dev/loop0: lseek 4096 failed: Invalid argument
  vg_remove_mdas stack-volumes-default failed

With this commit:

unstack.sh removes volume groups after removing
all logical volumes but before removing
the loopback device and deleting the backing file

Partial-Bug: 1441236
Change-Id: Id9c06fa50f6cad28764f5a3396f559cac9999649
---
 lib/lvm | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index 0cebd92f77..f0471816bf 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -35,7 +35,7 @@ BACKING_FILE_SUFFIX=-backing-file
 
 # _clean_lvm_volume_group removes all default LVM volumes
 #
-# Usage: clean_lvm_volume_group $vg
+# Usage: _clean_lvm_volume_group $vg
 function _clean_lvm_volume_group {
     local vg=$1
 
@@ -43,6 +43,16 @@ function _clean_lvm_volume_group {
     sudo lvremove -f $vg
 }
 
+# _remove_lvm_volume_group removes the volume group
+#
+# Usage: _remove_lvm_volume_group $vg
+function _remove_lvm_volume_group {
+    local vg=$1
+
+    # Remove the volume group
+    sudo vgremove -f $vg
+}
+
 # _clean_lvm_backing_file() removes the backing file of the
 # volume group
 #
@@ -69,6 +79,7 @@ function clean_lvm_volume_group {
     local vg=$1
 
     _clean_lvm_volume_group $vg
+    _remove_lvm_volume_group $vg
     # if there is no logical volume left, it's safe to attempt a cleanup
     # of the backing file
     if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then

From 331b3de88e02d6cc480b386766f47b7a2d943125 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Fri, 14 Jul 2017 13:11:19 -0400
Subject: [PATCH 1984/3333] Reduce tools/image_list.sh down to 4 images

Now that mysql.qcow2 has been removed, we only have 4 images to worry
about. This fixes cache-devstack element for openstack-infra.

Change-Id: Ia06f0e0679e253a1a6614f7c38abf1f5cd13991b
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 tools/image_list.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/image_list.sh b/tools/image_list.sh
index 27b3d4612d..29b93ed1d8 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -36,7 +36,7 @@ echo $ALL_IMAGES | tr ',' '\n' | sort | uniq
 
 # Sanity check - ensure we have a minimum number of images
 num=$(echo $ALL_IMAGES | tr ',' '\n' | sort | uniq | wc -l)
-if [[ "$num" -lt 5 ]]; then
+if [[ "$num" -lt 4 ]]; then
     echo "ERROR: We only found $num images in $ALL_IMAGES, which can't be right."
     exit 1
 fi

From a6467d36dbcb50c7501d5b237e32ed69ed1b4a44 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 27 Jun 2017 08:31:26 +0200
Subject: [PATCH 1985/3333] Prepare guestfs-support for openSUSE

With libguestfs usage for file injection now being enabled by
default as part of I568c56dbcb62ec541661364c142eff2397e3eed7
the opensuse job started to fail due to lack of guestfs images
being available.

The error in question was
NovaException: libguestfs installed but not usable (cannot
find any suitable libguestfs supermin, fixed or old-style
appliance on LIBGUESTFS_PATH (search path: /usr/lib64/guestfs)

This part is being fixed by explicitly adding the missing package
dependencies to the compute node rpm package list while the maintenance
update for Leap 42.2 is in preparation.

Change-Id: Ie76ac0a51c1ee2ad6559917825dee1c7a91a3a76
---
 lib/nova_plugins/hypervisor-libvirt | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index f3c8add696..0c08a0fe42 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -115,7 +115,10 @@ function install_nova_hypervisor {
                     sudo dpkg-statoverride --add --update $STAT_OVERRIDE
                 fi
             done
-        elif is_fedora || is_suse; then
+        elif is_suse; then
+            # Workaround for missing dependencies in python-libguestfs
+            install_package python-libguestfs guestfs-data augeas augeas-lenses
+        elif is_fedora; then
             install_package python-libguestfs
         fi
     fi

From 04016a5dd117d1696221de1e32b9d2c389b795c8 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 15 Jul 2017 12:16:58 +0200
Subject: [PATCH 1986/3333] List openSUSE 42.3 as a supported distro

openSUSE 42.3 is a relatively minor update over 42.2 and I'd
like to maintain it and keep it passing.

Experimental gates are being proposed, once those are passing
(which should be the case with this patch included), we could
enable it as a non-voting gate.

Change-Id: Ia421ada0ed3751c65a2a93a208e3f4a43edf8b16
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index c453b917e2..b786f7bd83 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From ecbebd5d7b2f332d3e2432bb7f612d6191bc23b2 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 19 Jul 2017 14:01:22 -0400
Subject: [PATCH 1987/3333] Only setup nova-dhcpbridge if using nova-network

Closes-Bug: #1705324

Change-Id: I3abc84483bbd256e0bbbfe64d570903080f2a2b7
---
 lib/nova | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/lib/nova b/lib/nova
index 3fa5de67eb..d91ccbbea1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -541,19 +541,21 @@ function create_nova_conf {
     # Setup logging for nova-dhcpbridge command line
     sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
 
-    local service="n-dhcp"
-    local logfile="${service}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    if [[ -n ${LOGDIR} ]]; then
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-        iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+    if is_service_enabled n-net; then
+        local service="n-dhcp"
+        local logfile="${service}.log.${CURRENT_LOG_TIME}"
+        local real_logfile="${LOGDIR}/${logfile}"
+        if [[ -n ${LOGDIR} ]]; then
+            bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
+            iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
+            if [[ -n ${SCREEN_LOGDIR} ]]; then
+                # Drop the backward-compat symlink
+                ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+            fi
         fi
-    fi
 
-    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+        iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+    fi
 
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf

From ab7035040319d8b145e1ad4ffcefa184ad6bd8a9 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Wed, 19 Jul 2017 09:55:26 -0700
Subject: [PATCH 1988/3333] When configuring temp urls, give Swift time to
 start up

Otherwise, we've seen intermittent "Unable to establish connection"
failures, with the main devstack log reporting things like

   2017-07-19 13:54:29.973 -> start proxy service
   2017-07-19 13:54:30.082 -> start OSC to store temp url key
   2017-07-19 13:54:31.908 -> OSC reports failure

Meanwhile, the s-proxy screen session tells us things like

   Jul 19 13:54:31.919988 -> start child worker
   Jul 19 13:54:32.206598 -> still loading the WSGI app

... and ports aren't actually bound until *after* the app is loaded.

Add a wait_for_service call to wait for the proxy to come up.

Change-Id: I1a722de31b144797230991700e110353a2d937dd
---
 lib/swift | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/swift b/lib/swift
index fc09093925..455740ea82 100644
--- a/lib/swift
+++ b/lib/swift
@@ -846,6 +846,14 @@ function start_swift {
     fi
     run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
 
+    # We also started the storage services, but proxy started last and
+    # will take the longest to start, so by the time it comes up, we're
+    # probably fine.
+    echo "Waiting for swift proxy to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/info; then
+        die $LINENO "swift proxy did not start"
+    fi
+
     if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
         swift_configure_tempurls
     fi

From fa0077707e15abfbecddbd22fe8594ffe3b4ecc4 Mon Sep 17 00:00:00 2001
From: Takashi NATSUME <natsume.takashi@lab.ntt.co.jp>
Date: Sat, 22 Jul 2017 08:59:43 +0900
Subject: [PATCH 1989/3333] Update URLs

Some URLs are broken, so fix them.
The others are redirect to new URLs,
so replace them with new ones.

The config options of nova serial console proxy
have been gathered in nova/conf/serial_console.py.
So the description in doc/source/guides/nova.rst
is fixed.

Change-Id: Ifd81cc09969341fbf8f135a913fc6003b94e0acc
---
 README.rst                 |  4 ++--
 doc/source/guides/nova.rst | 10 ++++------
 inc/python                 |  8 ++++----
 samples/local.conf         |  2 +-
 setup.cfg                  |  2 +-
 stack.sh                   |  2 +-
 tools/fixup_stuff.sh       |  2 +-
 7 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/README.rst b/README.rst
index b4240bdc91..adbf59a637 100644
--- a/README.rst
+++ b/README.rst
@@ -14,7 +14,7 @@ Goals
 * To provide an environment for the OpenStack CI testing on every commit
   to the projects
 
-Read more at http://docs.openstack.org/developer/devstack
+Read more at https://docs.openstack.org/devstack/latest
 
 IMPORTANT: Be sure to carefully read `stack.sh` and any other scripts you
 execute before you run them, as they install software and will alter your
@@ -92,5 +92,5 @@ DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
 by reading the `configuration guide
-<https://docs.openstack.org/developer/devstack/configuration.html>`_
+<https://docs.openstack.org/devstack/latest/configuration.html>`_
 for details of the configuration file and the many available options.
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index a91e0d194c..6bbab53aea 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -13,7 +13,7 @@ In Juno, nova implemented a `spec
 <http://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
 to allow read/write access to the serial console of an instance via
 `nova-serialproxy
-<http://docs.openstack.org/developer/nova/man/nova-serialproxy.html>`_.
+<https://docs.openstack.org/nova/latest/cli/nova-serialproxy.html>`_.
 
 The service can be enabled by adding ``n-sproxy`` to
 ``ENABLED_SERVICES``.  Further options can be enabled via
@@ -62,11 +62,9 @@ The service can be enabled by adding ``n-sproxy`` to
 
 Enabling the service is enough to be functional for a single machine DevStack.
 
-These config options are defined in `nova.console.serial
-<https://github.com/openstack/nova/blob/master/nova/console/serial.py#L33-L52>`_
-and `nova.cmd.serialproxy
-<https://github.com/openstack/nova/blob/master/nova/cmd/serialproxy.py#L26-L33>`_.
+These config options are defined in `nova.conf.serial_console
+<https://github.com/openstack/nova/blob/master/nova/conf/serial_console.py>`_.
 
 For more information on OpenStack configuration see the `OpenStack
 Configuration Reference
-<http://docs.openstack.org/trunk/config-reference/content/list-of-compute-config-options.html>`_
+<https://docs.openstack.org/ocata/config-reference/compute.html>`_
diff --git a/inc/python b/inc/python
index 718cbb23b1..f388f48e91 100644
--- a/inc/python
+++ b/inc/python
@@ -441,7 +441,7 @@ function setup_dev_lib {
 # project_dir: directory of project repo (e.g., /opt/stack/keystone)
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <project_dir>[<extras>]"
 function setup_install {
     local project_dir=$1
@@ -455,7 +455,7 @@ function setup_install {
 # project_dir: directory of project repo (e.g., /opt/stack/keystone)
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install -e <project_dir>[<extras>]"
 function setup_develop {
     local project_dir=$1
@@ -487,7 +487,7 @@ function is_in_projects_txt {
 # flags: pip CLI options/flags
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <flags> <project_dir>[<extras>]"
 function _setup_package_with_constraints_edit {
     local project_dir=$1
@@ -523,7 +523,7 @@ function _setup_package_with_constraints_edit {
 # flags: pip CLI options/flags
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <flags> <project_dir>[<extras>]"
 function setup_package {
     local project_dir=$1
diff --git a/samples/local.conf b/samples/local.conf
index 6d5351f904..8b76137c38 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -10,7 +10,7 @@
 
 # This is a collection of some of the settings we have found to be useful
 # in our DevStack development environments. Additional settings are described
-# in http://docs.openstack.org/developer/devstack/configuration.html#local-conf
+# in https://docs.openstack.org/devstack/latest/configuration.html#local-conf
 # These should be considered as samples and are unsupported DevStack code.
 
 # The ``localrc`` section replaces the old ``localrc`` configuration file.
diff --git a/setup.cfg b/setup.cfg
index 73d22b5268..fcd2b13f41 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -5,7 +5,7 @@ description-file =
     README.rst
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
-home-page = http://docs.openstack.org/developer/devstack
+home-page = https://docs.openstack.org/devstack/latest
 classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License
diff --git a/stack.sh b/stack.sh
index b786f7bd83..018ed3e3cc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1534,7 +1534,7 @@ if [[ "$USE_SYSTEMD" == "True" ]]; then
     echo
     echo "Services are running under systemd unit files."
     echo "For more information see: "
-    echo "https://docs.openstack.org/developer/devstack/systemd.html"
+    echo "https://docs.openstack.org/devstack/latest/systemd.html"
     echo
 fi
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 0b78bdeb00..55cd7252ea 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -157,7 +157,7 @@ if is_fedora; then
         # [1] https://bugzilla.redhat.com/show_bug.cgi?id=1099031
         # [2] https://bugs.launchpad.net/neutron/+bug/1455303
         # [3] https://github.com/redhat-openstack/openstack-puppet-modules/blob/master/firewall/manifests/linux/redhat.pp
-        # [4] http://docs.openstack.org/developer/devstack/guides/neutron.html
+        # [4] https://docs.openstack.org/devstack/latest/guides/neutron.html
         if is_package_installed firewalld; then
             sudo systemctl disable firewalld
             # The iptables service files are no longer included by default,

From d2fbcd275dfe9c7d11dc9dd5e8ab93244f653b79 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 24 Jul 2017 10:34:22 +1000
Subject: [PATCH 1990/3333] doc: Switch from oslosphinx to openstackdocstheme

Per the manuals migration effort, switch to openstackdocstheme [1]

[1] https://specs.openstack.org/openstack/docs-specs/specs/pike/os-manuals-migration.html

Change-Id: I0463f7d39bd72f1d27cfe3f6d5395608b9ed6b29
---
 doc/source/conf.py | 10 ++++++++--
 tox.ini            |  8 ++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 6e3ec029e9..780237fe58 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -26,7 +26,13 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'oslosphinx', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+extensions = [ 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+
+# openstackdocstheme options
+repository_name = 'openstack-dev/devstack'
+bug_project = 'devstack'
+bug_tag = ''
+html_last_updated_fmt = '%Y-%m-%d %H:%M'
 
 todo_include_todos = True
 
@@ -87,7 +93,7 @@
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
-html_theme = 'nature'
+html_theme = 'openstackdocs'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
diff --git a/tox.ini b/tox.ini
index cc7c5444a8..46b15f4cb1 100644
--- a/tox.ini
+++ b/tox.ini
@@ -37,9 +37,9 @@ commands = bash -c "find {toxinidir}             \
 deps =
    Pygments
    docutils
-   sphinx>=1.5.1,<1.6.1
+   sphinx>=1.6.2
    pbr>=2.0.0,!=2.1.0
-   oslosphinx
+   openstackdocstheme>=1.11.0
    nwdiag
    blockdiag
    sphinxcontrib-blockdiag
@@ -53,8 +53,8 @@ commands =
 [testenv:venv]
 deps =
    pbr>=2.0.0,!=2.1.0
-   sphinx>=1.5.1,<1.6.1
-   oslosphinx
+   sphinx>=1.6.2
+   openstackdocstheme>=1.11.0
    blockdiag
    sphinxcontrib-blockdiag
    sphinxcontrib-nwdiag

From 7bbd4e95d02d2c54b673a93e53fc91dee61f2c90 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 13 Jul 2017 15:12:55 +0200
Subject: [PATCH 1991/3333] Add f26 to the supported distros

The only mentionable diff is the kvm alias
does not exists so we will install
qemu-kvm as with rhel7 which also exists
in the older supported fedoras.

kvm also just an alias in suse so
switching to qemu-kvm  in suse as well.

Change-Id: I5c79ad1ef0b11dba30c931a59786f9eb7e7f8587
---
 files/rpms/cinder                  |  4 ++--
 files/rpms/general                 |  4 ++--
 files/rpms/nova                    |  2 +-
 files/rpms/swift                   |  2 +-
 lib/nova_plugins/functions-libvirt | 10 +---------
 stack.sh                           |  2 +-
 6 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 2c7b45baaf..3bc4e7ae72 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f24,f25 NOPRIME
-targetcli # dist:rhel7,f24,f25 NOPRIME
\ No newline at end of file
+scsi-target-utils # not:rhel7,f24,f25,f26 NOPRIME
+targetcli # dist:rhel7,f24,f25,f26 NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index 1393d18328..2443cc8cd7 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f23,f24,f25
+iptables-services  # NOPRIME f23,f24,f25,f26
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25
+java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25,f26
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index a368c552aa..632e796d07 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f23,f24,f25
+kernel-modules # dist:f23,f24,f25,f26
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index 2f12df0e3b..2e09cec28f 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f23,f24,f25
+rsync-daemon # dist:f23,f24,f25,f26
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 3e38b898ec..8d74c77517 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -73,15 +73,7 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         # On "KVM for IBM z Systems", kvm does not have its own package
-        if [[ ! ${DISTRO} =~ "kvmibm1" && ! ${DISTRO} =~ "rhel7" ]]; then
-            install_package kvm
-        fi
-
-        if [[ ${DISTRO} =~ "rhel7" ]]; then
-            # This should install the latest qemu-kvm build,
-            # which is called qemu-kvm-ev in centos7
-            # (as the default OS qemu-kvm package is usually rather old,
-            # and should be updated by above)
+        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
             install_package qemu-kvm
         fi
 
diff --git a/stack.sh b/stack.sh
index b786f7bd83..2ceb93323c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 46a54c90895cf5d90ebe4921fc5ce958e960d31c Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sun, 23 Jul 2017 14:14:23 +0200
Subject: [PATCH 1992/3333] Switch to cirrors 0.3.5 also for the xen case

This image is available on the download site since Feb 2016,
so let's use it.

Change-Id: I3b89211f6e57f2c35056d7e9c57d08651a3a314f
---
 stackrc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index 4f16c3edf7..e526b548b5 100644
--- a/stackrc
+++ b/stackrc
@@ -719,9 +719,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-$DEFAULT_IMAGE_NAME}
             IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/${DEFAULT_IMAGE_FILE_NAME}";;
         xenserver)
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
-            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk.vhd.tgz}
-            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk}
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk.vhd.tgz}
+            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.5-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False

From d325875508e7d35d6dd62302d852e83815be2278 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 21 Jul 2017 08:19:16 +0200
Subject: [PATCH 1993/3333] Resolve openSUSE devstack failures

This update resolves multiple issues with python-cryptography
causing keystone server and nova deployment to fail.

This is a temporary workaround until I196f025dbf1a9ac297946b8165620676645f7210
has landed and the extraneous dependency on python-cryptography (the
package) has been removed.

Change-Id: Ifb29b9089197c0429a5fc1cd08a25d2095d481f1
---
 tools/install_prereqs.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index da59093581..933491081c 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -88,6 +88,22 @@ else
     export PYTHON=$(which python 2>/dev/null)
 fi
 
+if is_suse; then
+    # novnc has an extraneous dependency on pyOpenSSL, which causes symbol conflicts
+    # in the bundled libssl of python-cryptography. when both are loaded into the same
+    # process, they start hanging or segfaulting.
+    install_package novnc
+    # deinstall the extra but irrelevant dependencies
+    sudo rpm -e --nodeps python-cffi python-cryptography python-pyOpenSSL
+    # reinstall cffi which got overwriten by the package.
+    sudo pip install -I cffi
+    # now reinstall cryptography from source, in order to rebuilt it against the
+    # system libssl rather than the bundled openSSL 1.1, which segfaults when combined
+    # with the system provided (which libpython links against) openSSL 1.0
+    sudo pip install cryptography --no-binary :all:
+fi
+
+
 # Mark end of run
 # ---------------
 

From c63ecadb08245eda3f4ef2327a2b9ca85cf4b4f9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 25 Jul 2017 17:08:50 -0400
Subject: [PATCH 1994/3333] Add instructions for discovering hosts in the
 multinode guide

When doing a multi-node devstack deployment starting in Ocata
the child compute nodes must be discovered and mapped to the
single nova cell (cell1). In the upstream CI we do this discovery
in devstack-gate after the subnodes are stacked, but for anyone
doing this manually we need to provide some notes on what needs
to happen after child compute nodes are stacked for a multinode
environment.

Change-Id: I68418bcf28d86c60fe42537186d89458fa778bda
Closes-Bug: #1688397
---
 doc/source/guides/multinode-lab.rst | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 1a8ddbc194..b4e2891c10 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -197,6 +197,22 @@ A stream of activity ensues. When complete you will see a summary of
 to poke at your shiny new OpenStack. The most recent log file is
 available in ``stack.sh.log``.
 
+Starting in the Ocata release, Nova requires a `Cells v2`_ deployment. Compute
+node services must be mapped to a cell before they can be used.
+
+After each compute node is stacked, verify it shows up in the
+``nova service-list --binary nova-compute`` output. The compute service is
+registered in the cell database asynchronously so this may require polling.
+
+Once the compute node services shows up, run the ``./tools/discover_hosts.sh``
+script from the control node to map compute hosts to the single cell.
+
+The compute service running on the primary control node will be
+discovered automatically when the control node is stacked so this really
+only needs to be performed for subnodes.
+
+.. _Cells v2: https://docs.openstack.org/nova/latest/user/cells.html
+
 Cleaning Up After DevStack
 --------------------------
 

From 2f09dcfc98959db87d6d6d7804364c9db3fa5111 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 26 Jul 2017 08:12:17 +0000
Subject: [PATCH 1995/3333] Updated from generate-devstack-plugins-list

Change-Id: Ic5ccbd05b9be0739b486d0b816b94eaa5d8f355f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 92e5ecdb89..ea406aa967 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -106,6 +106,7 @@ networking-cumulus                     `git://git.openstack.org/openstack/networ
 networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-hpe                         `git://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
 networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__

From dcdf8c8e60a9db0adb4ee5cae98ed7cc511ecf83 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 25 Jul 2017 19:51:08 -0400
Subject: [PATCH 1996/3333] Wait for compute service to check in

With cell v2, on initial bring up, discover hosts can't run unless all
the compute nodes have checked in. The documentation says that you
should run ``nova service-list --binary nova-compute`` and see all
your hosts before running discover hosts. This isn't really viable in
a multinode devstack because of how things are brought up in parts.

We can however know that stack.sh will not complete before the compute
node is up by waiting for the compute node to check in before moving
forward. This puts a few more seconds into the run, but ensures
everything is solid in multinode environments.

Change-Id: I667e6a9be3fee8bb5bfd73426eef567489e3d88d
---
 functions | 14 ++++++++++++++
 lib/nova  |  7 +++++++
 2 files changed, 21 insertions(+)

diff --git a/functions b/functions
index 6f2164a777..faa6b761ab 100644
--- a/functions
+++ b/functions
@@ -407,6 +407,20 @@ EOF
     return $rval
 }
 
+function wait_for_compute {
+    local timeout=$1
+    time_start "wait_for_service"
+    timeout $timeout bash -x <<EOF || rval=$?
+        ID=""
+        while [[ "\$ID" == "" ]]; do
+            sleep 1
+            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+        done
+EOF
+    time_stop "wait_for_service"
+    return $rval
+}
+
 
 # ping check
 # Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
diff --git a/lib/nova b/lib/nova
index 3fa5de67eb..5a8dc371f3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -795,6 +795,13 @@ function start_nova_compute {
         fi
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
+    # NOTE(sdague): with cells v2 all the compute services must be up
+    # and checked into the database before discover_hosts is run. This
+    # happens in all in one installs by accident, because > 30 seconds
+    # happen between here and the script ending. However, in multinode
+    # tests this can very often not be the case. So ensure that the
+    # compute is up before we move on.
+    wait_for_compute 60
 
     export PATH=$old_path
 }

From 5adfef0a53a19436cd759b1d345bcad0a46fc1bf Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 26 Jul 2017 11:14:37 -0400
Subject: [PATCH 1997/3333] Introduce CELLSV2_SETUP variable

Some environments, like grenade and ironic, need a way to revert to
the non fleet version of the conductor setup. This really comes down
to a global topology for CELLSV2_SETUP. The prefered is with a
superconductor, but allow a downgrade to singleconductor.

Depends-On: I5390ec14c41da0237c898852935aba3569e7acae

Change-Id: I10fb048ef2175909019461e585d117b4284448c6
---
 lib/nova | 23 ++++++++++++++++-------
 stackrc  |  8 ++++++++
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index 0500fc27a8..5362e3fef4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -432,7 +432,16 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
+        # If we're in multi-tier cells mode, we want our control services pointing
+        # at cell0 instead of cell1 to ensure isolation. If not, we point everything
+        # at the main database like normal.
+        if [[ "$CELLSV2_SETUP" == "singleconductor" ]]; then
+            local db="nova_cell1"
+        else
+            local db="nova_cell0"
+        fi
+
+        iniset $NOVA_CONF database connection `database_connection_url $db`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -676,15 +685,15 @@ function init_nova {
         # and nova_cell0 databases.
         nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
 
-        # Migrate nova and nova_cell0 databases.
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
-
         # (Re)create nova databases
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             recreate_database nova_cell${i}
             $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
         done
 
+        # Migrate nova and nova_cell0 databases.
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
+
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -795,7 +804,6 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
-    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
@@ -803,17 +811,18 @@ function start_nova_compute {
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
         # NOTE(danms): Don't setup conductor fleet for cellsv1
-        nomulticellflag='nomulticell'
+        CELLSV2_SETUP="singleconductor"
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
-    if [ "$nomulticellflag" = 'nomulticell' ]; then
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
         # skip these bits and use the normal config.
         NOVA_CPU_CONF=$compute_cell_conf
         echo "Skipping multi-cell conductor fleet setup"
     else
+        # "${CELLSV2_SETUP}" is "superconductor"
         cp $compute_cell_conf $NOVA_CPU_CONF
         # FIXME(danms): Should this be configurable?
         iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
diff --git a/stackrc b/stackrc
index e526b548b5..877da82261 100644
--- a/stackrc
+++ b/stackrc
@@ -77,6 +77,14 @@ ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=osapi_compute,metadata
 
+# CELLSV2_SETUP - how we should configure services with cells v2
+#
+# - superconductor - this is one conductor for the api services, and
+#   one per cell managing the compute services. This is prefered
+# - singleconductor - this is one conductor for the whole deployment,
+#   this is not recommended, and will be removed in the future.
+CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
+
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 

From 97430cd9e062b907c5937eb50ca6b95ae6fcdeeb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 27 Jul 2017 08:21:35 +0000
Subject: [PATCH 1998/3333] Updated from generate-devstack-plugins-list

Change-Id: I4e47d524df32d3d41cc00c608edc6c9c588726b5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ea406aa967..f9ca05583f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -92,6 +92,7 @@ mogan-ui                               `git://git.openstack.org/openstack/mogan-
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
+monasca-events-api                     `git://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__

From afc14c8e8585e6f6f00fafc78daa4e478b1635ae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 27 Jul 2017 07:09:48 -0400
Subject: [PATCH 1999/3333] Fix last place where we need singleconductor

The actual logic of launching a singleconductor didn't get all the way
to the launch of the conductor itself, so we were still launching 2
conductors in the Ironic case. This attempts to fix that.

Change-Id: I7ddb123dbdf3e1ec9a991e474a9990d2ccbc30d3
---
 lib/nova | 38 +++++++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5362e3fef4..8311a54930 100644
--- a/lib/nova
+++ b/lib/nova
@@ -51,6 +51,7 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
+NOVA_COND_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
@@ -588,8 +589,13 @@ function create_nova_conf {
             iniset $conf database connection `database_connection_url nova_cell${i}`
             iniset $conf conductor workers "$API_WORKERS"
             iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
-            rpc_backend_add_vhost $vhost
-            iniset_rpc_backend nova $conf DEFAULT $vhost
+            # if we have a singleconductor, we don't have per host message queues.
+            if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+                iniset_rpc_backend nova $conf DEFAULT
+            else
+                rpc_backend_add_vhost $vhost
+                iniset_rpc_backend nova $conf DEFAULT $vhost
+            fi
         done
     fi
 }
@@ -632,6 +638,9 @@ function init_nova_cells {
             iniset $NOVA_CELLS_CONF DEFAULT enabled_apis metadata
         fi
 
+        # Cells v1 conductor should be the nova-cells.conf
+        NOVA_COND_CONF=$NOVA_CELLS_CONF
+
         time_start "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
         time_stop "dbsync"
@@ -802,6 +811,16 @@ function start_nova_api {
     export PATH=$old_path
 }
 
+# Detect and setup conditions under which singleconductor setup is
+# needed. Notably cellsv1.
+function _set_singleconductor {
+    # NOTE(danms): Don't setup conductor fleet for cellsv1
+    if is_service_enabled n-cell; then
+        CELLSV2_SETUP="singleconductor"
+    fi
+}
+
+
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
     # Hack to set the path for rootwrap
@@ -810,8 +829,6 @@ function start_nova_compute {
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
-        # NOTE(danms): Don't setup conductor fleet for cellsv1
-        CELLSV2_SETUP="singleconductor"
     else
         local compute_cell_conf=$NOVA_CONF
     fi
@@ -908,15 +925,15 @@ function enable_nova_fleet {
 }
 
 function start_nova_conductor {
-    if is_service_enabled n-cell; then
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         echo "Starting nova-conductor in a cellsv1-compatible way"
-        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
+        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_COND_CONF"
         return
     fi
 
     enable_nova_fleet
     if is_service_enabled n-super-cond; then
-        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
+        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_COND_CONF"
     fi
     for i in $(seq 1 $NOVA_NUM_CELLS); do
         if is_service_enabled n-cond-cell${i}; then
@@ -928,9 +945,16 @@ function start_nova_conductor {
 }
 
 function start_nova {
+    # this catches the cells v1 case early
+    _set_singleconductor
     start_nova_rest
     start_nova_conductor
     start_nova_compute
+    if is_service_enabled n-api; then
+        # dump the cell mapping to ensure life is good
+        echo "Dumping cells_v2 mapping"
+        nova-manage cell_v2 list_cells --verbose
+    fi
 }
 
 function stop_nova_compute {

From 01c0cc6d37ccca13e0e7e48a58dcc7ba98967f1c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 27 Jul 2017 20:53:57 +0000
Subject: [PATCH 2000/3333] Revert "Wait for compute service to check in"

This reverts commit dcdf8c8e60a9db0adb4ee5cae98ed7cc511ecf83.

Change-Id: Ib14016a3bc6f2714758ad0291396233218c593c6
---
 functions | 14 --------------
 lib/nova  |  7 -------
 2 files changed, 21 deletions(-)

diff --git a/functions b/functions
index faa6b761ab..6f2164a777 100644
--- a/functions
+++ b/functions
@@ -407,20 +407,6 @@ EOF
     return $rval
 }
 
-function wait_for_compute {
-    local timeout=$1
-    time_start "wait_for_service"
-    timeout $timeout bash -x <<EOF || rval=$?
-        ID=""
-        while [[ "\$ID" == "" ]]; do
-            sleep 1
-            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
-        done
-EOF
-    time_stop "wait_for_service"
-    return $rval
-}
-
 
 # ping check
 # Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
diff --git a/lib/nova b/lib/nova
index 5a8dc371f3..3fa5de67eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -795,13 +795,6 @@ function start_nova_compute {
         fi
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
-    # NOTE(sdague): with cells v2 all the compute services must be up
-    # and checked into the database before discover_hosts is run. This
-    # happens in all in one installs by accident, because > 30 seconds
-    # happen between here and the script ending. However, in multinode
-    # tests this can very often not be the case. So ensure that the
-    # compute is up before we move on.
-    wait_for_compute 60
 
     export PATH=$old_path
 }

From 6effdf370a1a638e72319337db57c5ef1fa1312d Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Thu, 27 Jul 2017 20:28:43 +0200
Subject: [PATCH 2001/3333] Remove extra websockify dependency cleanup step

This started to fail due to a missing || : / --force option now
that the dependencies got fixed:

2017-07-30 19:38:37.260 | ++ tools/install_prereqs.sh:source:97       :   sudo rpm -e --nodeps python-cffi python-cryptography python-pyOpenSSL
2017-07-30 19:38:37.293 | error: package python-cffi is not installed
2017-07-30 19:38:37.293 | error: package python-cryptography is not installed
2017-07-30 19:38:37.293 | error: package python-pyOpenSSL is not installed

Change-Id: Ia59afb7ee564cf2044ebdb3c5ad3e54ee91d1222
---
 tools/install_prereqs.sh | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 933491081c..6189085e9e 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -89,17 +89,10 @@ else
 fi
 
 if is_suse; then
-    # novnc has an extraneous dependency on pyOpenSSL, which causes symbol conflicts
-    # in the bundled libssl of python-cryptography. when both are loaded into the same
-    # process, they start hanging or segfaulting.
-    install_package novnc
-    # deinstall the extra but irrelevant dependencies
-    sudo rpm -e --nodeps python-cffi python-cryptography python-pyOpenSSL
-    # reinstall cffi which got overwriten by the package.
-    sudo pip install -I cffi
     # now reinstall cryptography from source, in order to rebuilt it against the
     # system libssl rather than the bundled openSSL 1.1, which segfaults when combined
-    # with the system provided (which libpython links against) openSSL 1.0
+    # with a system provided openSSL 1.0
+    # see https://github.com/pyca/cryptography/issues/3804 and followup issues
     sudo pip install cryptography --no-binary :all:
 fi
 

From dea3083d984569eac9647f1a28f10ae98afc42f7 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 1 Aug 2017 00:16:51 +0300
Subject: [PATCH 2002/3333] Fix path to mlock_report

This patch fixes path to mlock_report.py. Also add python-psutil
to dstat depends as it is required by mlock_report.

Change-Id: Ia2b507a7b923f1e3393a9cb7746c66d39d6abfde
---
 files/debs/dstat        | 1 +
 files/rpms/dstat        | 1 +
 tools/memory_tracker.sh | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/debs/dstat b/files/debs/dstat
index 2b643b8b1b..0d9da4434f 100644
--- a/files/debs/dstat
+++ b/files/debs/dstat
@@ -1 +1,2 @@
 dstat
+python-psutil
diff --git a/files/rpms/dstat b/files/rpms/dstat
index 2b643b8b1b..0d9da4434f 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1 +1,2 @@
 dstat
+python-psutil
diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index cbdeb8f420..63f25ca2de 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -88,7 +88,7 @@ function tracker {
             # list processes that lock memory from swap
             if [[ $unevictable -ne $unevictable_point ]]; then
                 unevictable_point=$unevictable
-                ${PYTHON} ./tools/mlock_report.py
+                ${PYTHON} $(dirname $0)/mlock_report.py
             fi
 
             echo "]]]"

From fa55cb5f978f6bd9476f1b09a94c8d6aaa18beb4 Mon Sep 17 00:00:00 2001
From: Mathieu Mitchell <mmitchell@iweb.com>
Date: Tue, 24 Jan 2017 11:32:24 -0500
Subject: [PATCH 2003/3333] Ensure valid service names are passed to
 stack_install_service

Currently, stack_install_service will accept any service name. This is
problematic because a project plugin can pass an invalid name without
noticing. This has been the case in ironic-inspector[0].

This commit ensures that stack_install_service will not silently fail
when passing an invalid service name.

[0] https://review.openstack.org/#/c/424680/

Change-Id: I1a8105bdbaf4aecb630df08da416808bf7180824
Closes-Bug: #1659042
---
 lib/stack | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/stack b/lib/stack
index f09ddcee85..bada26f1c2 100644
--- a/lib/stack
+++ b/lib/stack
@@ -33,5 +33,8 @@ function stack_install_service {
         if [[ ${USE_VENV} = True && -n ${PROJECT_VENV[$service]:-} ]]; then
             unset PIP_VIRTUAL_ENV
         fi
+    else
+        echo "No function declared with name 'install_${service}'."
+        exit 1
     fi
 }

From ab980ce5d6792a273db3e93eb3d163bfdc38b1de Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 1 Aug 2017 16:38:42 -0400
Subject: [PATCH 2004/3333] Disable track_instance_changes when in
 superconductor mode

When configured for superconductor mode, which is the default,
nova-compute can't reach the MQ for nova-scheduler so there is
no point in even enabling the track_instance_changes code since
it's a waste of time as the scheduler will never get the message.

Change-Id: I2662ebd47323428b403d3c2236bec78f1fb1050f
---
 lib/nova | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index 8311a54930..7266ac70e9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -440,6 +440,9 @@ function create_nova_conf {
             local db="nova_cell1"
         else
             local db="nova_cell0"
+            # When in superconductor mode, nova-compute can't send instance
+            # info updates to the scheduler, so just disable it.
+            iniset $NOVA_CONF filter_scheduler track_instance_changes False
         fi
 
         iniset $NOVA_CONF database connection `database_connection_url $db`
@@ -843,6 +846,9 @@ function start_nova_compute {
         cp $compute_cell_conf $NOVA_CPU_CONF
         # FIXME(danms): Should this be configurable?
         iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
+        # Since the nova-compute service cannot reach nova-scheduler over
+        # RPC, we also disable track_instance_changes.
+        iniset $NOVA_CPU_CONF filter_scheduler track_instance_changes False
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
     fi
 

From c2fe916fc7c6c00cdfa0085e198eaf2ad4d915d1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 28 Jul 2017 11:29:18 +0000
Subject: [PATCH 2005/3333] Wait for compute service to check in

With cell v2, on initial bring up, discover hosts can't run unless all
the compute nodes have checked in. The documentation says that you
should run ``nova service-list --binary nova-compute`` and see all
your hosts before running discover hosts. This isn't really viable in
a multinode devstack because of how things are brought up in parts.

We can however know that stack.sh will not complete before the compute
node is up by waiting for the compute node to check in before
completing. This happens quite late in the stack.sh run, so shouldn't
add any extra time in most runs.

Cells v1 and Xenserver don't use real hostnames in the service table
(they encode complex data that is hostname like to provide more
topology information than just hostnames). They are exempted from this
check.

Related-Bug: #1708039

Change-Id: I32eb59b9d6c225a3e93992be3a3b9f4b251d7189
---
 functions | 20 ++++++++++++++++++++
 lib/nova  | 22 ++++++++++++++++++++++
 stack.sh  |  7 +++++++
 3 files changed, 49 insertions(+)

diff --git a/functions b/functions
index 6f2164a777..d55cd74609 100644
--- a/functions
+++ b/functions
@@ -407,6 +407,26 @@ EOF
     return $rval
 }
 
+function wait_for_compute {
+    local timeout=$1
+    local rval=0
+    time_start "wait_for_service"
+    timeout $timeout bash -x <<EOF || rval=$?
+        ID=""
+        while [[ "\$ID" == "" ]]; do
+            sleep 1
+            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+        done
+EOF
+    time_stop "wait_for_service"
+    # Figure out what's happening on platforms where this doesn't work
+    if [[ "$rval" != 0 ]]; then
+        echo "Didn't find service registered by hostname after $timeout seconds"
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list
+    fi
+    return $rval
+}
+
 
 # ping check
 # Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
diff --git a/lib/nova b/lib/nova
index 8311a54930..8e75157b44 100644
--- a/lib/nova
+++ b/lib/nova
@@ -944,6 +944,28 @@ function start_nova_conductor {
     done
 }
 
+function is_nova_ready {
+    # NOTE(sdague): with cells v2 all the compute services must be up
+    # and checked into the database before discover_hosts is run. This
+    # happens in all in one installs by accident, because > 30 seconds
+    # happen between here and the script ending. However, in multinode
+    # tests this can very often not be the case. So ensure that the
+    # compute is up before we move on.
+    if is_service_enabled n-cell; then
+        # cells v1 can't complete the check below because it munges
+        # hostnames with cell information (grumble grumble).
+        return
+    fi
+    # TODO(sdague): honestly, this probably should be a plug point for
+    # an external system.
+    if [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
+        # xenserver encodes information in the hostname of the compute
+        # because of the dom0/domU split. Just ignore for now.
+        return
+    fi
+    wait_for_compute 60
+}
+
 function start_nova {
     # this catches the cells v1 case early
     _set_singleconductor
diff --git a/stack.sh b/stack.sh
index 015ee6ec43..51e12168ba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1433,6 +1433,13 @@ fi
 # Sanity checks
 # =============
 
+# Check that computes are all ready
+#
+# TODO(sdague): there should be some generic phase here.
+if is_service_enabled n-cpu; then
+    is_nova_ready
+fi
+
 # Check the status of running services
 service_check
 

From eca7ce749204f01f0041bf1bb5f00fd04c9109c7 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@arm.com>
Date: Fri, 4 Aug 2017 11:50:36 +0800
Subject: [PATCH 2006/3333] ETCD need to add UNSUPPORT environment in AArch64

Closes-bug: #1708575

Change-Id: I77e78389ac7b8df9ba9f84b072f446d2e03d84d1
Signed-off-by: Kevin Zhao <kevin.zhao@arm.com>
---
 lib/etcd3 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index 0e1fbd5bc2..bc24790782 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -57,6 +57,9 @@ function start_etcd3 {
     iniset -sudo $unitfile "Service" "Type" "notify"
     iniset -sudo $unitfile "Service" "Restart" "on-failure"
     iniset -sudo $unitfile "Service" "LimitNOFILE" "65536"
+    if is_arch "aarch64"; then
+        iniset -sudo $unitfile "Service" "Environment" "ETCD_UNSUPPORTED_ARCH=arm64"
+    fi
 
     $SYSTEMCTL daemon-reload
     $SYSTEMCTL enable $ETCD_SYSTEMD_SERVICE

From 801494550a58220e1bcbd531e810e1ca59efa7e8 Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Thu, 3 Aug 2017 12:41:36 +0100
Subject: [PATCH 2007/3333] Disable baremetal sched filters when using resource
 classes

When using resource classes to schedule baremetal nodes the baremetal
filters like ExactRam etc should not be used. This patch disables them
in the nova config if devstack is configured to enable ironic resource
classes.

Change-Id: Ic262ccaf8b541308042d61113a953653d2261964
---
 lib/nova_plugins/hypervisor-ironic | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 7d47ef070c..d59473ca1c 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -42,7 +42,11 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
-    iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
+
+    if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
+        iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
+    fi
+
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From 49144e627120f9ec1cf72dfc84e02b9b81e669b6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 2 Aug 2017 09:49:27 -0400
Subject: [PATCH 2008/3333] Remove glance api_servers from nova config

This should now be able to be discovered from the service catalog,
there is no reason to set it.

Change-Id: I7383b589fbcef9423beeab735db42c594f7b56fd
get auth from context for glance endpoints:
Depends-On: I4e755b9c66ec8bc3af0393e81cffd91c56064717
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8311a54930..26f65637c5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -538,7 +538,6 @@ function create_nova_conf {
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_transport_url)
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From b645904d4aae46a8be5cee3a23710565b211f458 Mon Sep 17 00:00:00 2001
From: Kenneth Giusti <kgiusti@gmail.com>
Date: Fri, 4 Aug 2017 18:08:37 -0400
Subject: [PATCH 2009/3333] Use get_notification_url when configuring
 notifications

If a project manually configures the oslo.messaging transport url for
notifications it should use 'get_notification_url', not
'get_transport_url'.  get_transport_url should only be used to obtain
the RPC transport address.

Change-Id: I77772dfa9f30a3db2db6d0387260dfe3452a26ef
Closes-Bug: #1708754
---
 lib/nova        | 2 +-
 lib/rpc_backend | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8311a54930..c988c2f06b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -536,7 +536,7 @@ function create_nova_conf {
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
-    iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_transport_url)
+    iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_notification_url)
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3177e88ef2..fb1cf73b99 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -114,7 +114,7 @@ function rpc_backend_add_vhost {
     fi
 }
 
-# builds transport url string
+# Returns the address of the RPC backend in URL format.
 function get_transport_url {
     local virtual_host=$1
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
@@ -122,8 +122,9 @@ function get_transport_url {
     fi
 }
 
-# Repeat the definition, in case get_transport_url is overriden for RPC purpose.
-# get_notification_url can then be used to talk to rabbit for notifications.
+# Returns the address of the Notification backend in URL format.  This
+# should be used to set the transport_url option in the
+# oslo_messaging_notifications group.
 function get_notification_url {
     local virtual_host=$1
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then

From 41e6e12318718c3c5eb6f47ed75a215ed67eccf2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 8 Aug 2017 15:06:26 +1000
Subject: [PATCH 2010/3333] Switch Centos/Fedora to Apache woker MPM

In trying to debug periodic gate instability of CentOS, I noticed that
it is using the prefork mpm, while Ubuntu is defaulting to the
multi-threaded worker mpm.

One of the problems seems related to 502 proxy errors from the TLS
proxy.  We see out-of-sync timestamps in the centos TLS proxy access
logs, which might be innocent behaviour based on the prefork model or
indicate something else.

Before going too deep down this rabbit-hole, I think it is better for
consistency to use the same mpm model on all our platforms, and start
debugging from there.

Change-Id: I9881f2e7d51fdd9fc0f7fb3e37179aa53171b531
---
 lib/apache | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/apache b/lib/apache
index ffd7966de1..dfca25a764 100644
--- a/lib/apache
+++ b/lib/apache
@@ -132,6 +132,10 @@ function install_apache_wsgi {
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
+        # For consistency with Ubuntu, switch to the worker mpm, as
+        # the default is prefork
+        sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
+        sudo sed -i '/mod_mpm_worker.so/s/^#//g' /etc/httpd/conf.modules.d/00-mpm.conf
     elif is_suse; then
         install_package apache2 apache2-mod_wsgi
     else

From 139837d69d8566088125d29739089aec7b2a9e7c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 8 Aug 2017 17:51:29 +1000
Subject: [PATCH 2011/3333] Make TLS logs more readable

After looking at these for I9881f2e7d51fdd9fc0f7fb3e37179aa53171b531 I
found them not as useful as they could be.

Fix the CustomLog command, that wants the logfile then the format
string (or a nickname, which the LogFormat line wasn't setting).  Use
standard micro-second timestamps, and trim the access log to have more
relevant info.

Change-Id: I9f4c8ef38ab9e08aeced7b309d4a5276de07af4b
---
 lib/tls | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index 6a3d260ebd..7bde5e6496 100644
--- a/lib/tls
+++ b/lib/tls
@@ -533,10 +533,9 @@ $listen_string
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log
-    ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
+    ErrorLogFormat "%{cu}t [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
     LogLevel info
-    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log common
-    LogFormat "%v %h %l %u %t \"%r\" %>s %b"
+    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log "%{%Y-%m-%d}t %{%T}t.%{msec_frac}t [%l] %a \"%r\" %>s %b"
 </VirtualHost>
 EOF
     if is_suse ; then

From 2d57f93f68ae14e17313486e0d5ad2513af58fd1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 Aug 2017 14:35:37 +1000
Subject: [PATCH 2012/3333] Don't reinstall python-virtualenv on infra nodes

In the original change I said "for infra nodes, it shouldn't do
anything anyway ...".  Well that was pre-Fedora 26 :)

It seems that dnf > 2.0 now intentionally throws an error when trying
to explicitly install an ignored package.  Thus, as described in the
comment, take a simpler approach of skipping this on infra nodes.
pip-and-virtualenv in dib should have installed the latest pip,
virtualenv and setuptools, so we don't want to fiddle with that
anyway.

[1] https://review.openstack.org/#/c/338998/

Change-Id: Ib300b58377a0d0fe1bd7444c71acdb9a87dc033b
---
 tools/fixup_stuff.sh | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 55cd7252ea..f1552ab2f7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -202,5 +202,22 @@ fi
 # on python-virtualenv), first install the distro python-virtualenv
 # to satisfy any dependencies then use pip to overwrite it.
 
-install_package python-virtualenv
-pip_install -U --force-reinstall virtualenv
+# ... but, for infra builds, the pip-and-virtualenv [1] element has
+# already done this to ensure the latest pip, virtualenv and
+# setuptools on the base image for all platforms.  It has also added
+# the packages to the yum/dnf ignore list to prevent them being
+# overwritten with old versions.  F26 and dnf 2.0 has changed
+# behaviour that means re-installing python-virtualenv fails [2].
+# Thus we do a quick check if we're in the infra environment by
+# looking for the mirror config script before doing this, and just
+# skip it if so.
+
+# [1] https://git.openstack.org/cgit/openstack/diskimage-builder/tree/ \
+#        diskimage_builder/elements/pip-and-virtualenv/ \
+#            install.d/pip-and-virtualenv-source-install/04-install-pip
+# [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
+
+if [[ ! -f /etc/ci/mirror_info.sh ]]; then
+    install_package python-virtualenv
+    pip_install -U --force-reinstall virtualenv
+fi

From 32608da2c4ecc523fb331212c441fc86aabb6355 Mon Sep 17 00:00:00 2001
From: zhangbailin <zhangbailin@inspur.com>
Date: Wed, 9 Aug 2017 01:43:00 -0700
Subject: [PATCH 2013/3333] Modify some spelling mistakes

There are some comment errors, it's modify 'Captial' to 'Capital' in
keystone file, and modify 'possition' to 'position' in openrc file, and
modify 'comming' to 'coming' in stack file, and
modify 'prefered' to 'preferred' in stackrc file.

Change-Id: I0fdd539cbfff842a4ba7fca9100b881443300f9a
---
 lib/keystone | 2 +-
 openrc       | 2 +-
 stack.sh     | 2 +-
 stackrc      | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1061081a5e..749e219e67 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -350,7 +350,7 @@ function create_keystone_accounts {
     # The Member role is used by Horizon and Swift so we need to keep it:
     local member_role="member"
 
-    # Captial Member role is legacy hard coded in Horizon / Swift
+    # Capital Member role is legacy hard coded in Horizon / Swift
     # configs. Keep it around.
     get_or_create_role "Member"
 
diff --git a/openrc b/openrc
index 23c173c8a1..37724c552e 100644
--- a/openrc
+++ b/openrc
@@ -84,7 +84,7 @@ export OS_AUTH_TYPE=password
 # We currently recommend using the version 3 *identity api*.
 #
 
-# If you don't have a working .stackenv, this is the backup possition
+# If you don't have a working .stackenv, this is the backup position
 KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
 KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_URI:-$KEYSTONE_BACKUP}
 
diff --git a/stack.sh b/stack.sh
index 015ee6ec43..e92418233b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -30,7 +30,7 @@ unset GREP_OPTIONS
 # NOTE(sdague): why do we explicitly set locale when running stack.sh?
 #
 # Devstack is written in bash, and many functions used throughout
-# devstack process text comming off a command (like the ip command)
+# devstack process text coming off a command (like the ip command)
 # and do transforms using grep, sed, cut, awk on the strings that are
 # returned. Many of these programs are interationalized, which is
 # great for end users, but means that the strings that devstack
diff --git a/stackrc b/stackrc
index 877da82261..b03426ffa8 100644
--- a/stackrc
+++ b/stackrc
@@ -80,7 +80,7 @@ NOVA_ENABLED_APIS=osapi_compute,metadata
 # CELLSV2_SETUP - how we should configure services with cells v2
 #
 # - superconductor - this is one conductor for the api services, and
-#   one per cell managing the compute services. This is prefered
+#   one per cell managing the compute services. This is preferred
 # - singleconductor - this is one conductor for the whole deployment,
 #   this is not recommended, and will be removed in the future.
 CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
@@ -117,7 +117,7 @@ fi
 # Whether or not to enable Kernel Samepage Merging (KSM) if available.
 # This allows programs that mark their memory as mergeable to share
 # memory pages if they are identical. This is particularly useful with
-# libvirt backends. This reduces memory useage at the cost of CPU overhead
+# libvirt backends. This reduces memory usage at the cost of CPU overhead
 # to scan memory. We default to enabling it because we tend to be more
 # memory constrained than CPU bound.
 ENABLE_KSM=$(trueorfalse True ENABLE_KSM)

From a6c782722378827ecc4606afae26f3fb7a48b92d Mon Sep 17 00:00:00 2001
From: linxuhua <linxuhua@unionpay.com>
Date: Wed, 9 Aug 2017 17:25:03 +0800
Subject: [PATCH 2014/3333] modify the default url of noVNC

i had sync the all repos of devstack for installing in intranet
environment, and found the url of noVNC had changed to
https://github.com/novnc/noVNC. This module upgrade from individual to
an organization. the old url had redirect to the new one.

Change-Id: I19fc1e2ad30dcd97cad232c9ad58f53a523616b4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 877da82261..3bced58b25 100644
--- a/stackrc
+++ b/stackrc
@@ -624,7 +624,7 @@ IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironi
 IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
 
 # a websockets/html5 or flash powered VNC console for vm instances
-NOVNC_REPO=${NOVNC_REPO:-https://github.com/kanaka/noVNC.git}
+NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
 NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 
 # a websockets/html5 or flash powered SPICE console for vm instances

From 8ea8660e363b0bd1fd8bc40a9b74f76e42649f90 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Wed, 2 Aug 2017 11:40:41 -0400
Subject: [PATCH 2015/3333] Fix Cinder tls-proxy WSGI test

This currently will throw errors like:

lib/cinder: line 480: [True: command not found

Change-Id: I6bc08532cf99411f39d23523f9fc7851e7804131
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 4274be740a..03328f31b6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -478,7 +478,7 @@ function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
     local cinder_url
-    if is_service_enabled tls-proxy && ["$CINDER_USE_MOD_WSGI" == "False"]; then
+    if is_service_enabled tls-proxy && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi

From 0629c4fe22ce02aefde7ee9a18ef75a2687bee01 Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Thu, 10 Aug 2017 15:34:29 +0200
Subject: [PATCH 2016/3333] Remove DiskFilter and RamFilter from Nova
 scheduling defaults

In Ocata, we replaced the verification logic for CPU, RAM and disk by calling
the Placement API instead of using those legacy scheduler filters, it's time
to remove them from the default list of filters that are run, especially
since Nova now removes them from the conf opt defaults thanks to
Ibe1cee1cb2642f61a8d6bf9c3f6bbee4f2c2f414

Change-Id: I2e81f1bbce7476d63e84e70dcdd59a1163f89f09
Related-Bug: #1709328
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8311a54930..f1be7ce41d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -101,7 +101,7 @@ SCHEDULER=${SCHEDULER:-filter_scheduler}
 
 # The following FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-FILTERS="RetryFilter,AvailabilityZoneFilter,RamFilter,DiskFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 

From 0ed3b6208952e546b7ce5c0d3dc13cb628e3f00d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 11 Aug 2017 08:26:44 +0000
Subject: [PATCH 2017/3333] Updated from generate-devstack-plugins-list

Change-Id: Ibb3f6cd6aa01daf79413b2abfb5adb3d5f121321
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f9ca05583f..0ec31b36de 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -138,6 +138,7 @@ nova-powervm                           `git://git.openstack.org/openstack/nova-p
 oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
+omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__

From 63962fbbe41fe966df96fe2e1bb30943e7ae4047 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Fri, 11 Aug 2017 19:37:07 +0000
Subject: [PATCH 2018/3333] Remove keystone configs for ldap read/write

Configuration options that toggle support for LDAP read/write
were deprecated and removed as of the Ocata release:

  I13eada3d5c3a166223c3e3ce70b7054eaed1003a

This means we no longer need to clutter the domain-specific
configuration with these values since they are no longer used.

Change-Id: I23b5b994862f066c3d48ce524c396faecabf60f8
---
 lib/keystone | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1061081a5e..4a4a30f0cc 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -626,12 +626,6 @@ function create_ldap_domain {
     iniset $KEYSTONE_LDAP_DOMAIN_FILE identity driver "ldap"
 
     # LDAP settings for Users domain
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_delete "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_update "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_create "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_delete "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_update "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_create "False"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_objectclass "inetOrgPerson"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"

From 87d2396d225533aefd8d52bb5fa574ea57dbb987 Mon Sep 17 00:00:00 2001
From: Sampath Priyankara <sam47priya@gmail.com>
Date: Thu, 3 Aug 2017 16:12:40 +0900
Subject: [PATCH 2019/3333] Don't uninstall pip packages if OFFLINE=True

lib/nova does a pip re-install of libvirt-python to rebuild the python
library incase the underlying libvirt version changed during package
installs.  In offline mode, the underlying version of libvirt can't
have changed; so we have the situation that we've removed the libvirt
python bindings but can't reinstall them (because we're offline).

This fixes that particular situation, but skipping uninstalls in
offline mode seems generically OK.

Change-Id: I2b75d45d94d82f87d996c7570c125d46f5f99f6a
Closes-Bug: #1708369
---
 inc/python | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inc/python b/inc/python
index f388f48e91..5e7f742d48 100644
--- a/inc/python
+++ b/inc/python
@@ -346,6 +346,9 @@ function pip_install {
 }
 
 function pip_uninstall {
+    # Skip uninstall if offline
+    [[ "${OFFLINE}" = "True" ]] && return
+
     local name=$1
     if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip

From a3488d5f0067b570974c14572c58bbf8cedf7ed2 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 10 Aug 2017 14:55:15 -0400
Subject: [PATCH 2020/3333] Remove proxy-sendcl from mod_proxy_uwsgi apache
 path

Calling setenv appears to be globally scoped which is breaking the
glance path which relies on chunked uploads. The glance path is
separated by using mod_proxy instead of mod_proxy_uwsgi because
mod_proxy_uwsgi doesn't support chunked encoding.[1] The proxy-sendcl [2]
was set on the mod_proxy_uwsgi path just in case someone tried to send a
chunked request to the api server we would be able to handle it. It
tells apache to locally cache the chunked request and send the
content-length as a normal upload to the upstream server. However, if we
can only set it globally across then small potential benefit is not worth
having all glance uploads cached by apache. This commit just removes
setting the flag. In the future if we can have devstack isolate this
flag it might be worth adding back to the mod_proxy_uwsgi path, but for
right now it's not worth the tradeoff.

[1] https://github.com/unbit/uwsgi/issues/1540
[2] https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#request-bodies

Depends-On: Idf6b4b891ba31cccbeb53d373b40fce5380cea64
Change-Id: Iab2e2848877fa1497008d18c05b0154892941589
Closes-Bug: #1709970
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index dfca25a764..5838a4df9b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -277,7 +277,6 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
         iniset "$file" uwsgi socket "$socket"
         iniset "$file" uwsgi chmod-socket 666
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
@@ -335,6 +334,7 @@ function write_local_uwsgi_http_config {
     local apache_conf=""
     apache_conf=$(apache_site_config_for $name)
     echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
     echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server

From 6b354a909535a9dfef164c3e844544989d17514a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 14 Aug 2017 13:58:30 -0700
Subject: [PATCH 2021/3333] Don't special case Grenade + systemd

Now that the pike branch exists we don't want to special case grenade +
system on the target side. We should use systemd for both sides of the
pike -> master upgrade. Note this change should not be backported so
that we do not attempt to use systemd on the ocata -> pike upgrade path.

Depends-On: Iedf824a1772115e0dff287a898636f8e58471269
Change-Id: I6198bf1842a44773fce80672c81eee3afc3c6f38
---
 stackrc | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/stackrc b/stackrc
index 877da82261..18c1ce76ce 100644
--- a/stackrc
+++ b/stackrc
@@ -174,10 +174,7 @@ fi
 # if we are forcing off USE_SCREEN (as we do in the gate), force on
 # systemd. This allows us to drop one of 3 paths through the code.
 if [[ "$USE_SCREEN" == "False" ]]; then
-    # Remove in Pike: this gets us through grenade upgrade
-    if [[ "$GRENADE_PHASE" != "target" ]]; then
-        USE_SYSTEMD="True"
-    fi
+    USE_SYSTEMD="True"
 fi
 
 # Default for log coloring is based on interactive-or-not.

From 0525e77d9f297bff5b3a37276b1c28440a384229 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 15 Aug 2017 22:02:30 +0300
Subject: [PATCH 2022/3333] Increase host_subset_size for ironic

This patch increase host_subset_size when ironic is used to 999
to minimize race conditions.

Change-Id: I0874fe3b3628cb3e662ee01f24c4599247fdc82d
---
 lib/nova_plugins/hypervisor-ironic | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index d59473ca1c..062afb7f7c 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,6 +47,8 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
     fi
 
+    iniset $NOVA_CONF filter_scheduler host_subset_size 999
+
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From 59fb961180caf0981aa5e3fc5a022fbe3bf3e463 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 15 Aug 2017 13:48:04 -0700
Subject: [PATCH 2023/3333] Allow both Keystone and Tempauth reseller prefixes

... to be used with domain_remap. Swift will start functionally testing
domain_remap in I63428132283986bda9e5c082ffe85741449b71ba.

Change-Id: I4c1ab06d040d91fd8c314d0aa2cecbbb00adf8ad
---
 lib/swift | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/swift b/lib/swift
index 455740ea82..72a810352f 100644
--- a/lib/swift
+++ b/lib/swift
@@ -464,6 +464,9 @@ function configure_swift {
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix "TEMPAUTH"
 
+    # Allow both reseller prefixes to be used with domain_remap
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:domain_remap reseller_prefixes "AUTH, TEMPAUTH"
+
     if is_service_enabled swift3; then
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
 [filter:s3token]

From cdfcff511fa0c9f21a700d87530d56066bdad7cf Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 16 Aug 2017 08:06:13 +0000
Subject: [PATCH 2024/3333] Updated from generate-devstack-plugins-list

Change-Id: I38170528cf78a89b71a616a4d9c6179c4e3f49c5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0ec31b36de..84a57428d2 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -99,6 +99,7 @@ murano                                 `git://git.openstack.org/openstack/murano
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
 networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
+networking-baremetal                   `git://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
 networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
 networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__

From 98c95f4fa1029adff778902be3afb92c080e15b3 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 16 Aug 2017 09:10:04 -0400
Subject: [PATCH 2025/3333] Stop nova conductor properly (singleconductor mode)

stop_nova_conductor dropped the ball when the CELLSV2_SETUP mode is
set to "singleconductor". We should cleanup the older style "n-cond"
in this case.

Change-Id: I9ffd6d09df6f390a842b8a374097f144564d2db4
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 31b51c7c07..fa09fd8fc1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -988,6 +988,11 @@ function stop_nova_rest {
 }
 
 function stop_nova_conductor {
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        stop_process n-cond
+        return
+    fi
+
     enable_nova_fleet
     for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
         if is_service_enabled $srv; then

From ebbbc0500c7bb7a975967e4b1fadad7d1681c9a7 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Wed, 16 Aug 2017 16:00:16 +0100
Subject: [PATCH 2026/3333] Make reference to service-types-authority from
 plugins.rst

We want people creating plugins (that add services) to be aware of the
service-types-authority (STA), so this change adds a Prerequisites
section and notes the existince of the STA there, and the need to apply
there to create a service-type.

Change-Id: I1aa48fe231aaa4499f8b4fe336abea668841b9af
---
 doc/source/plugins.rst | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 5b3c6cf714..fae1a1d8f5 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -12,6 +12,15 @@ tree. They are called through a strong contract, so these plugins can
 be sure that they will continue to work in the future as DevStack
 evolves.
 
+Prerequisites
+=============
+
+If you are planning to create a plugin that is going to host a service in the
+service catalog (that is, your plugin will use the command
+``get_or_create_service``) please make sure that you apply to the `service
+types authority`_ to reserve a valid service-type. This will help to make sure
+that all deployments of your service use the same service-type.
+
 Plugin Interface
 ================
 
@@ -250,3 +259,5 @@ See Also
 
 For additional inspiration on devstack plugins you can check out the
 `Plugin Registry <plugin-registry.html>`_.
+
+.. _service types authority: https://specs.openstack.org/openstack/service-types-authority/

From 1d141daaf673d7e28e4980812b4bff953a97518b Mon Sep 17 00:00:00 2001
From: Leticia Wanderley <leticiafwanderley@gmail.com>
Date: Fri, 4 Aug 2017 00:42:59 -0300
Subject: [PATCH 2027/3333] Feature flag on tempest conf to notify enabled LDAP

This adds a new feature flag on tempest conf whenever LDAP is enabled.
When this flag is set to True Tempest users and groups identity tests
adapt to fetch users and groups from different domains.

Change-Id: I368ddf34908b906355c422bd1afd6ab9b1a80053
Depends-On: Iedb470c51fa2174ab7651e6b7e22eff1f25f7aac
---
 lib/tempest | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..61fda7f1b9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -297,6 +297,12 @@ function configure_tempest {
     # Newton and Ocata. This option can be removed after Mitaka is end of life.
     iniset $TEMPEST_CONFIG identity-feature-enabled forbid_global_implied_dsr True
 
+    # When LDAP is enabled domain specific drivers are also enabled and the users
+    # and groups identity tests must adapt to this scenario
+    if is_service_enabled ldap; then
+        iniset $TEMPEST_CONFIG identity-feature-enabled domain_specific_drivers True
+    fi
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From aceb27e858b594ae80bf07bb0278a715e5a4cd3b Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 17 Aug 2017 08:59:59 -0400
Subject: [PATCH 2028/3333] Add procname for uwsgi based services

Code in grenade and elsewhere rely on the process/service name
when one runs "ps auxw" and they grep for example "grep -e glance-api"
to check if the service is running. with uwsgi, let us make sure
we use process name prefix so it is easier to spot the services
and be compatible with code elsewhere that relies on this.

Change-Id: I4d1cd223ed9904fcb19b26fc9362b676e0b4f9b3
---
 lib/cinder    | 2 +-
 lib/glance    | 2 +-
 lib/keystone  | 2 +-
 lib/nova      | 4 ++--
 lib/placement | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..22c5168089 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -511,7 +511,7 @@ function start_cinder {
                 start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_POR_INT
             fi
         else
-            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --ini $CINDER_UWSGI_CONF"
+            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
             cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
         fi
     fi
diff --git a/lib/glance b/lib/glance
index 0a5b9f59b6..7b42488b59 100644
--- a/lib/glance
+++ b/lib/glance
@@ -345,7 +345,7 @@ function start_glance {
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
+        run_process g-api "$GLANCE_BIN_DIR/uwsgi --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
     fi
diff --git a/lib/keystone b/lib/keystone
index 749e219e67..08aa675d43 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -550,7 +550,7 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
-        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
+        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."
diff --git a/lib/nova b/lib/nova
index fa09fd8fc1..976bf35ad5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -805,7 +805,7 @@ function start_nova_api {
             start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
         fi
     else
-        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --ini $NOVA_UWSGI_CONF"
+        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
         nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
     fi
 
@@ -912,7 +912,7 @@ function start_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
         run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
     else
-        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --ini $NOVA_METADATA_UWSGI_CONF"
+        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
     run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
diff --git a/lib/placement b/lib/placement
index 8adbbdec68..aef9b7454e 100644
--- a/lib/placement
+++ b/lib/placement
@@ -164,7 +164,7 @@ function install_placement {
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --ini $PLACEMENT_UWSGI_CONF"
+        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
     else
         enable_apache_site placement-api
         restart_apache_server

From aa33c878d8da59369aed737cb636b628a1f444bb Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 16 Aug 2017 22:51:07 -0400
Subject: [PATCH 2029/3333] Fix Cleanups for keystone/placement/nova

* Check KEYSTONE_DEPLOY flag and cleanup appropriately
* When we stop process, we should not wipe uwsgi config we should
  remove files only on cleanup
* We should not call cleanup *BEFORE* configure, we are just wiping
  out the uwsgi ini files
* cleanup_placement should be called from clean.sh

Change-Id: I066f5f87ff22d7da2e3814f8c2de75f2af625d2b
---
 clean.sh     |  1 +
 lib/keystone | 25 ++++++++++++-------------
 stack.sh     |  2 --
 3 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/clean.sh b/clean.sh
index 9ffe3bee6b..2333596c1f 100755
--- a/clean.sh
+++ b/clean.sh
@@ -88,6 +88,7 @@ cleanup_cinder || /bin/true
 cleanup_glance
 cleanup_keystone
 cleanup_nova
+cleanup_placement
 cleanup_neutron
 cleanup_swift
 cleanup_horizon
diff --git a/lib/keystone b/lib/keystone
index 749e219e67..685891e8bc 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -148,16 +148,18 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    # TODO: remove admin at pike-2
-    # These files will be created if we are running WSGI_MODE="uwsgi"
-    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-    remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
-    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-    sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
-
-    # These files will be created if we are running WSGI_MODE="mod_wsgi"
-    disable_apache_site keystone
-    sudo rm -f $(apache_site_config_for keystone)
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
+        # These files will be created if we are running WSGI_MODE="mod_wsgi"
+        disable_apache_site keystone
+        sudo rm -f $(apache_site_config_for keystone)
+    else
+        stop_process "keystone"
+        # TODO: remove admin at pike-2
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
+        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
+        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
+    fi
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
@@ -582,9 +584,6 @@ function stop_keystone {
         restart_apache_server
     else
         stop_process keystone
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-        # TODO(remove in at pike-2)
-        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
     fi
     # Kill the Keystone screen window
     stop_process key
diff --git a/stack.sh b/stack.sh
index e92418233b..301e1e7c6b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -896,14 +896,12 @@ fi
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
-    cleanup_nova
     configure_nova
 fi
 
 if is_service_enabled placement; then
     # placement api
     stack_install_service placement
-    cleanup_placement
     configure_placement
 fi
 

From 64edfd47caba71a0c351269663dd457fd911fcac Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 17 Aug 2017 13:21:25 -0700
Subject: [PATCH 2030/3333] Correct spelling for 'lose' from 'loose'

We can 'lose' networking configuration, not 'loose' it.

Change-Id: I538270c05da6fce63340cc75ec53c3834efcecfe
---
 doc/source/networking.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index bdbeaaa7a8..74010cd01a 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -69,7 +69,7 @@ Shared Guest Interface
 
    This is not a recommended configuration. Because of interactions
    between ovs and bridging, if you reboot your box with active
-   networking you may loose network connectivity to your system.
+   networking you may lose network connectivity to your system.
 
 If you need your guests accessible on the network, but only have 1
 interface (using something like a NUC), you can share your one

From af9f71d693cd548b18986e99f58503fa57f815f1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 18 Aug 2017 08:21:34 +0000
Subject: [PATCH 2031/3333] Updated from generate-devstack-plugins-list

Change-Id: I4747e03aa29828cba364a5887fada0721c8da56e
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 84a57428d2..35b78da44c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -110,6 +110,7 @@ networking-fortinet                    `git://git.openstack.org/openstack/networ
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
 networking-hpe                         `git://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
 networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
+networking-hyperv                      `git://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
 networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
@@ -117,6 +118,7 @@ networking-mlnx                        `git://git.openstack.org/openstack/networ
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
 networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
+networking-opencontrail                `git://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
 networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
 networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__

From 5158486124814cbf032c0e79413c6f856225fd98 Mon Sep 17 00:00:00 2001
From: Omer Anson <omer.anson@toganetworks.com>
Date: Thu, 24 Aug 2017 17:47:37 +0300
Subject: [PATCH 2032/3333] Add function is_plugin_enabled

Add a function which tests if a plugin has been enabled with
enable_plugin. This is helpful if two co-ordinating projects want to run
specific setup in devstack in one only if the other is enabled.

Change-Id: Ibf113755595b19d028374cdc1c86e19b5170be4f
---
 functions-common | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 660df795db..a5f770f579 100644
--- a/functions-common
+++ b/functions-common
@@ -1882,7 +1882,7 @@ function enable_plugin {
     local name=$1
     local url=$2
     local branch=${3:-master}
-    if [[ ",${DEVSTACK_PLUGINS}," =~ ,${name}, ]]; then
+    if is_plugin_enabled $name; then
         die $LINENO "Plugin attempted to be enabled twice: ${name} ${url} ${branch}"
     fi
     DEVSTACK_PLUGINS+=",$name"
@@ -1891,6 +1891,19 @@ function enable_plugin {
     GITBRANCH[$name]=$branch
 }
 
+# is_plugin_enabled <name>
+#
+# Check if the plugin was enabled, e.g. using enable_plugin
+#
+# ``name`` The name with which the plugin was enabled
+function is_plugin_enabled {
+    local name=$1
+    if [[ ",${DEVSTACK_PLUGINS}," =~ ",${name}," ]]; then
+        return 0
+    fi
+    return 1
+}
+
 # fetch_plugins
 #
 # clones all plugins

From 6d213dfda7d0c3446595ce9edc56408e3924b355 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 22 Aug 2017 16:05:16 +1000
Subject: [PATCH 2033/3333] Get default python versions from interpreter

Query the python2/python3 interpreter for it's version to fill in
PYTHON3_VERSION and PYTHON2_VERSION defaults.  This means on a
python3.6 platform such as Fedora 26, we don't need to override the
default.

Change-Id: Id826f275b99b9f397b95e817941019fc503daa1d
---
 functions-common | 17 ++++++++++++++++-
 stackrc          |  6 ++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 660df795db..85054883d5 100644
--- a/functions-common
+++ b/functions-common
@@ -2380,13 +2380,28 @@ function is_provider_network {
 }
 
 
+# Return just the <major>.<minor> for the given python interpreter
+function _get_python_version {
+    local interp=$1
+    local version
+    version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    echo ${version}
+}
+
 # Return the current python as "python<major>.<minor>"
 function python_version {
     local python_version
-    python_version=$(python -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    python_version=$(_get_python_version python2)
+    echo "python${python_version}"
+}
+
+function python3_version {
+    local python3_version
+    python3_version=$(_get_python_version python3)
     echo "python${python_version}"
 }
 
+
 # Service wrapper to restart services
 # restart_service service-name
 function restart_service {
diff --git a/stackrc b/stackrc
index b123d8ac7c..625ce3f27b 100644
--- a/stackrc
+++ b/stackrc
@@ -153,10 +153,12 @@ export DISABLED_PYTHON3_PACKAGES=""
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
-export PYTHON3_VERSION=${PYTHON3_VERSION:-3.5}
+_DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION}}
 
 # Just to be more explicit on the Python 2 version to use.
-export PYTHON2_VERSION=${PYTHON2_VERSION:-2.7}
+_DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
+export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION}}
 
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then

From 9d7e74e57c73d25e214e0269dbd9d342e8cd960c Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 25 Aug 2017 10:17:18 -0400
Subject: [PATCH 2034/3333] Setup logging for nova_cell1.conf

When run in the default superconductor mode, the screen-n-cond-cell1
logs are not formatting in oslo format or colorized like the other
logs. This is because screen-n-super-cond is running using nova.conf
which is configured for oslo format logging with color.

The oslo format logging is also needed to correctly index the logs
from screen-n-cond-cell1 in logstash.

This change simply configures nova_cell*.conf files for logging
like nova.conf.

Change-Id: I44fc11f09bb7283be0b068f5e02a424f3e5dafe2
Closes-Bug: #1713070
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index fa09fd8fc1..581cd548ff 100644
--- a/lib/nova
+++ b/lib/nova
@@ -602,6 +602,8 @@ function create_nova_conf {
                 rpc_backend_add_vhost $vhost
                 iniset_rpc_backend nova $conf DEFAULT $vhost
             fi
+            # Format logging
+            setup_logging $conf
         done
     fi
 }

From 08367bac0bb46a4ada14ed6b9416d570e976dd9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C5=82awek=20Kap=C5=82o=C5=84ski?= <slawek@kaplonski.pl>
Date: Sun, 27 Aug 2017 08:44:27 +0000
Subject: [PATCH 2035/3333] Switch from $DEST/data/etcd to $DATA_DIR/etcd

Etcd should use $DATA_DIR/etcd instead of "hardcoded"
$DEST/data/etcd directory for its data.

Change-Id: Icdc65f52a9d75981b63789036248e00d8ab72f11
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index bc24790782..6e32cb31ca 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -26,7 +26,7 @@ set +o xtrace
 # Set up default values for etcd
 ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
 ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
-ETCD_DATA_DIR="$DEST/data/etcd"
+ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
 ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"

From c09eaf8e401b12c7b37f18b79d761876953d54a8 Mon Sep 17 00:00:00 2001
From: Le Hou <houl7@chinaunicom.cn>
Date: Mon, 28 Aug 2017 17:25:38 +0800
Subject: [PATCH 2036/3333] Update OS_AUTH_URL in Configuration.rst

I am a new participant, and when I read the document I found that the command in the OS_AUTH_URL example is v2.0, so I want to update it.

Change-Id: I973adc303a3cb37ce377ca4e31d1d666cd41b358
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 064bf515e6..c4834b7a84 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -136,7 +136,7 @@ OS\_AUTH\_URL
 
     ::
 
-        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v3.0
 
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented

From 787412ce6cf9447733dd8986c07883d791b520b2 Mon Sep 17 00:00:00 2001
From: Dima Kuznetsov <dima.kuznetsov@toganetworks.com>
Date: Mon, 28 Aug 2017 09:09:38 +0300
Subject: [PATCH 2037/3333] tempest: Disable l3_agent_scheduler when running
 without L3 agent

Dragonflow can operate without L3 agent, and does not advertise L3 agent
scheduler extension when running this way

Change-Id: I23d0e558c8454636fcde0a1903c78965b70bc324
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..33bd74f7a3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -574,6 +574,11 @@ function configure_tempest {
         DISABLE_NETWORK_API_EXTENSIONS+=", metering"
     fi
 
+    # disable l3_agent_scheduler if we didn't enable L3 agent
+    if ! is_service_enabled q-l3; then
+        DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
+    fi
+
     local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint

From 4639984b96a3ff7be28357ccbd7c8ffa60371c42 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 28 Aug 2017 11:43:37 +0000
Subject: [PATCH 2038/3333] Update function description for start_tls_proxy

In [1] the definition of the function was changed, adding the service
name as first parameter. Since this seems to have caused failures in
some plugins, at least update the function template accordingly.

[1] Ifcba410f5969521e8b3d30f02795541c1661f83a

Change-Id: I4d03957f8d3a18625f06379fb21aa7ba55e32797
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 7bde5e6496..b7ad644f5c 100644
--- a/lib/tls
+++ b/lib/tls
@@ -487,7 +487,7 @@ EOF
 }
 
 # Starts the TLS proxy for the given IP/ports
-# start_tls_proxy front-host front-port back-host back-port
+# start_tls_proxy service-name front-host front-port back-host back-port
 function start_tls_proxy {
     local b_service="$1-tls-proxy"
     local f_host=$2

From 0e58d22897457831b9dbf02d66a2f29d43803597 Mon Sep 17 00:00:00 2001
From: Clay Gerrard <clay.gerrard@gmail.com>
Date: Mon, 28 Aug 2017 14:03:18 -0700
Subject: [PATCH 2039/3333] Create correct directory layout for swift on
 purpose.

The pre-existing configuration for swift on devstack set's the
*-server's devices option (the root of the servers list of devices) to:

    devices = /opt/stack/data/swift/1

where "1" is the node_number, and will be 2, 3, ... N if the devstack
machine is built with more than one swift node/device (pretty sure no
one does that on devstack ever).

The device(s) in the rings are named (perhaps confusingly similar to the
swift loopback image) just "sdb1", so all storage servers expect to have
a $STACK_USER writeable file system at:

    os.path.join(<devices_root>, "sdb1")

That directory does not exist when you start up a devstack [1].

Currently Swift's object-server's require that directory exist before
they write data into it (even with mount_check = false!).

Unfortunately however, with mount_check=false the account/container
servers are able to create the device directory when it does not exist
[2].  Which can lead to some unfortunate results with permissions on
some deployments using mount_check = false (e.g. testing or
containerized environments).  Fixing this issue [3] uncovered the
previously benign [4] mis-configuration in devstack.

Attempting

1. It was lost a long while ago I7c65303791689523f02e5ae44483a6c50b2eed1e
2. Essentially they want to:

    mkdir -p /opt/stack/data/swift/1/sdb1/containers/<part#>

... but end up creating the "sdb1" dir too!
3. I3362a6ebff423016bb367b4b6b322bb41ae08764
4. Benign because the object-server share their device with the
account-container devices and they would create the dirs before trying
to write an object.  It was incorrect, but worked by happenstance, which
is nearly as good as worked on purpose.

Change-Id: I52c4ecb70b1ae47e613ba243da5a4d94e5adedf2
---
 lib/swift | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/lib/swift b/lib/swift
index 455740ea82..3b87610007 100644
--- a/lib/swift
+++ b/lib/swift
@@ -608,15 +608,13 @@ function create_swift_disk {
     # create all of the directories needed to emulate a few different servers
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do
-        sudo ln -sf ${SWIFT_DATA_DIR}/drives/sdb1/$node_number ${SWIFT_DATA_DIR}/$node_number;
-        local drive=${SWIFT_DATA_DIR}/drives/sdb1/${node_number}
-        local node=${SWIFT_DATA_DIR}/${node_number}/node
-        local node_device=${node}/sdb1
-        [[ -d $node ]] && continue
-        [[ -d $drive ]] && continue
-        sudo install -o ${STACK_USER} -g $user_group -d $drive
-        sudo install -o ${STACK_USER} -g $user_group -d $node_device
-        sudo chown -R ${STACK_USER}: ${node}
+        # node_devices must match *.conf devices option
+        local node_devices=${SWIFT_DATA_DIR}/${node_number}
+        local real_devices=${SWIFT_DATA_DIR}/drives/sdb1/$node_number
+        sudo ln -sf $real_devices $node_devices;
+        local device=${real_devices}/sdb1
+        [[ -d $device ]] && continue
+        sudo install -o ${STACK_USER} -g $user_group -d $device
     done
 }
 

From 411c34da69f423059a04431a542be2b1b7a65f38 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 29 Aug 2017 14:40:26 +0000
Subject: [PATCH 2040/3333] Fix URLs when running with tls-proxy enabled

Various services are returning broken links when running behind
tls-proxy. These issues can be fixed by setting the X-Forwarded-Proto
header in the apache config and letting oslo_middleware parse it.

Change-Id: Ibe5dbdc4644ec812f0435f59319666fc336c195a
Partial-Bug: 1713731
---
 lib/cinder         | 3 +--
 lib/neutron        | 1 +
 lib/neutron-legacy | 1 +
 lib/nova           | 1 +
 lib/tls            | 3 ++-
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..67939f18e9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -296,8 +296,7 @@ function configure_cinder {
             # Set the service port for a proxy to take the original
             if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
                 iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
-                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
+                iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
             else
                 iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
                 iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
diff --git a/lib/neutron b/lib/neutron
index 2a660ec8e1..92c585a70f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -242,6 +242,7 @@ function configure_neutron_new {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
+        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
     # Metering
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 784f3a8167..f9e0bd6ded 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -718,6 +718,7 @@ function _configure_neutron_common {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
+        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
     _neutron_setup_rootwrap
diff --git a/lib/nova b/lib/nova
index fa09fd8fc1..887a70d475 100644
--- a/lib/nova
+++ b/lib/nova
@@ -555,6 +555,7 @@ function create_nova_conf {
 
     if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
+        iniset $NOVA_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
     if is_service_enabled n-sproxy; then
diff --git a/lib/tls b/lib/tls
index 7bde5e6496..5bf5d96ede 100644
--- a/lib/tls
+++ b/lib/tls
@@ -527,6 +527,7 @@ $listen_string
     # for swift functional testing to work with tls enabled. It is 2 bytes
     # larger than the apache default of 8190.
     LimitRequestFieldSize $f_header_size
+    RequestHeader set X-Forwarded-Proto "https"
 
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=0 nocanon
@@ -541,7 +542,7 @@ EOF
     if is_suse ; then
         sudo a2enflag SSL
     fi
-    for mod in ssl proxy proxy_http; do
+    for mod in headers ssl proxy proxy_http; do
         enable_apache_mod $mod
     done
     enable_apache_site $b_service

From 81f67fd7eb33fe3b197dd9b337d900a2271963b9 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 29 Aug 2017 09:52:58 +0000
Subject: [PATCH 2041/3333] Delete the default guest user from rabbitmq

Leaving the default user enabled is a security issue, as it can be used
without credentials. It also may mask issues like seen in [1].

[1] https://bugs.launchpad.net/bugs/1651576

Change-Id: I75b4e5696c0f8017b869127a10f3c14e2f8bd121
---
 lib/rpc_backend | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3177e88ef2..5479db3333 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -97,6 +97,8 @@ function restart_rpc_backend {
 
             break
         done
+        # NOTE(frickler): Remove the default guest user
+        sudo rabbitmqctl delete_user guest || true
     fi
 }
 

From f96f675ddb6448d3e4ab0114935e79690f88b4c6 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 30 Aug 2017 09:27:06 +0000
Subject: [PATCH 2042/3333] Updated from generate-devstack-plugins-list

Change-Id: I0dae4374fcfc05ae883d782635954dbd8268accd
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 35b78da44c..a1d5ad822b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -147,6 +147,7 @@ osprofiler                             `git://git.openstack.org/openstack/osprof
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
+qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__

From def67a47e80c1ed1ed8f1bdcf105563935f6d921 Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Wed, 30 Aug 2017 11:39:16 +0100
Subject: [PATCH 2043/3333] Stop using ironic host manager with resource
 classes

There should be no needs to use the ironic host manager when using
resource classes.

Change-Id: I9a51ea6582dfef28e4da5f8510742230d88cbaf3
---
 lib/nova_plugins/hypervisor-ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 062afb7f7c..ebb6a31541 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -41,9 +41,9 @@ function configure_nova_hypervisor {
 
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
 
     if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
+        iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
         iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
     fi
 

From b79be36cdb9e0368d7976e0876ee1273110d5b5c Mon Sep 17 00:00:00 2001
From: Vladyslav Drok <vdrok@mirantis.com>
Date: Wed, 30 Aug 2017 19:19:56 +0300
Subject: [PATCH 2044/3333] Remove setting some of the scheduler settings

It makes sense to set them only if resource classes are not used.

Change-Id: I76d8501a1d1a20357acadad4cd8f2d6cef3896c1
---
 lib/nova_plugins/hypervisor-ironic | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 062afb7f7c..034e403768 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,12 +45,11 @@ function configure_nova_hypervisor {
 
     if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
         iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
+        iniset $NOVA_CONF filter_scheduler host_subset_size 999
+        iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
+        iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     fi
 
-    iniset $NOVA_CONF filter_scheduler host_subset_size 999
-
-    iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
-    iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin

From 52609c684af195b84d99473cfb7d286a972e334e Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 28 Aug 2017 11:49:28 +0000
Subject: [PATCH 2045/3333] Fix errors in tls-proxy startup for cinder

Two typos made starting tls-proxy fail when CINDER_USE_MOD_WSGI is
False.

Change-Id: I0435282182087a36d987843699152c1c08c4a494
---
 lib/cinder | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..71b0683d75 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -506,9 +506,9 @@ function start_cinder {
         if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
             run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
             cinder_url=$service_protocol://$SERVICE_HOST:$service_port
-            # Start proxy if tsl enabled
-            if is_service_enabled tls_proxy; then
-                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_POR_INT
+            # Start proxy if tls enabled
+            if is_service_enabled tls-proxy; then
+                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
             fi
         else
             run_process "c-api" "$CINDER_BIN_DIR/uwsgi --ini $CINDER_UWSGI_CONF"

From cdba1b371628aa0e8bc5b687351c5ee9b39e9bc6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 30 Aug 2017 11:11:06 -0400
Subject: [PATCH 2046/3333] Remove screen support from devstack completely

This tears out the alternative path of using screen, so that we only
use systemd enabled paths. This simplifies the number of ways that
devstack can be run, and provides a much more reliable process
launcher than the screen based approach.

Change-Id: I8c27182f60b0f5310b3a8bf5feb02beb7ffbb26a
---
 files/debs/general      |   1 -
 files/rpms-suse/general |   1 -
 files/rpms/general      |   1 -
 functions-common        | 341 ++--------------------------------------
 lib/nova                |   4 -
 stack.sh                |  60 -------
 stackrc                 |  60 +------
 tests/run-process.sh    | 109 -------------
 unstack.sh              |   9 --
 9 files changed, 15 insertions(+), 571 deletions(-)
 delete mode 100755 tests/run-process.sh

diff --git a/files/debs/general b/files/debs/general
index 1dde03b7fe..8e0018d284 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -29,7 +29,6 @@ psmisc
 python2.7
 python-dev
 python-gdbm # needed for testr
-screen
 tar
 tcpdump
 unzip
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 370f2409f7..0c1a2819b1 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -24,7 +24,6 @@ psmisc
 python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
 python-xml
-screen
 systemd-devel # for systemd-python
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 2443cc8cd7..f3f870823c 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -28,7 +28,6 @@ psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
-screen
 systemd-devel # for systemd-python
 tar
 tcpdump
diff --git a/functions-common b/functions-common
index 660df795db..fdbb9c067e 100644
--- a/functions-common
+++ b/functions-common
@@ -1380,62 +1380,6 @@ function zypper_install {
         zypper --non-interactive install --auto-agree-with-licenses "$@"
 }
 
-
-# Process Functions
-# =================
-
-# _run_process() is designed to be backgrounded by run_process() to simulate a
-# fork.  It includes the dirty work of closing extra filehandles and preparing log
-# files to produce the same logs as screen_it().  The log filename is derived
-# from the service name.
-# Uses globals ``CURRENT_LOG_TIME``, ``LOGDIR``, ``SCREEN_LOGDIR``, ``SCREEN_NAME``, ``SERVICE_DIR``
-# If an optional group is provided sg will be used to set the group of
-# the command.
-# _run_process service "command-line" [group]
-function _run_process {
-    # disable tracing through the exec redirects, it's just confusing in the logs.
-    xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-
-    local service=$1
-    local command="$2"
-    local group=$3
-
-    # Undo logging redirections and close the extra descriptors
-    exec 1>&3
-    exec 2>&3
-    exec 3>&-
-    exec 6>&-
-
-    local logfile="${service}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    if [[ -n ${LOGDIR} ]]; then
-        exec 1>&"$real_logfile" 2>&1
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
-        fi
-
-        # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
-        export PYTHONUNBUFFERED=1
-    fi
-
-    # reenable xtrace before we do *real* work
-    $xtrace
-
-    # Run under ``setsid`` to force the process to become a session and group leader.
-    # The pid saved can be used with pkill -g to get the entire process group.
-    if [[ -n "$group" ]]; then
-        setsid sg $group "$command" & echo $! >$SERVICE_DIR/$SCREEN_NAME/$service.pid
-    else
-        setsid $command & echo $! >$SERVICE_DIR/$SCREEN_NAME/$service.pid
-    fi
-
-    # Just silently exit this process
-    exit 0
-}
-
 function write_user_unit_file {
     local service=$1
     local command="$2"
@@ -1535,21 +1479,6 @@ function _run_under_systemd {
     $SYSTEMCTL start $systemd_service
 }
 
-# Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
-# This is used for ``service_check`` when all the ``screen_it`` are called finished
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
-# init_service_check
-function init_service_check {
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-    if [[ ! -d "$SERVICE_DIR/$SCREEN_NAME" ]]; then
-        mkdir -p "$SERVICE_DIR/$SCREEN_NAME"
-    fi
-
-    rm -f "$SERVICE_DIR/$SCREEN_NAME"/*.failure
-}
-
 # Find out if a process exists by partial name.
 # is_running name
 function is_running {
@@ -1576,135 +1505,11 @@ function run_process {
 
     time_start "run_process"
     if is_service_enabled $service; then
-        if [[ "$USE_SYSTEMD" = "True" ]]; then
-            _run_under_systemd "$name" "$command" "$group" "$user"
-        elif [[ "$USE_SCREEN" = "True" ]]; then
-            if [[ "$user" == "root" ]]; then
-                command="sudo $command"
-            fi
-            screen_process "$name" "$command" "$group"
-        else
-            # Spawn directly without screen
-            if [[ "$user" == "root" ]]; then
-                command="sudo $command"
-            fi
-            _run_process "$name" "$command" "$group" &
-        fi
+        _run_under_systemd "$name" "$command" "$group" "$user"
     fi
     time_stop "run_process"
 }
 
-# Helper to launch a process in a named screen
-# Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
-# ``SERVICE_DIR``, ``SCREEN_IS_LOGGING``
-# screen_process name "command-line" [group]
-# Run a command in a shell in a screen window, if an optional group
-# is provided, use sg to set the group of the command.
-function screen_process {
-    local name=$1
-    local command="$2"
-    local group=$3
-
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-    screen -S $SCREEN_NAME -X screen -t $name
-
-    local logfile="${name}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    echo "LOGDIR: $LOGDIR"
-    echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
-    echo "log: $real_logfile"
-    if [[ -n ${LOGDIR} ]]; then
-        if [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
-            screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
-            screen -S $SCREEN_NAME -p $name -X log on
-        fi
-        # If logging isn't active then avoid a broken symlink
-        touch "$real_logfile"
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${name}.log"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${1}.log
-        fi
-    fi
-
-    # sleep to allow bash to be ready to be send the command - we are
-    # creating a new window in screen and then sends characters, so if
-    # bash isn't running by the time we send the command, nothing
-    # happens.  This sleep was added originally to handle gate runs
-    # where we needed this to be at least 3 seconds to pass
-    # consistently on slow clouds. Now this is configurable so that we
-    # can determine a reasonable value for the local case which should
-    # be much smaller.
-    sleep ${SCREEN_SLEEP:-3}
-
-    NL=`echo -ne '\015'`
-    # This fun command does the following:
-    # - the passed server command is backgrounded
-    # - the pid of the background process is saved in the usual place
-    # - the server process is brought back to the foreground
-    # - if the server process exits prematurely the fg command errors
-    # and a message is written to stdout and the process failure file
-    #
-    # The pid saved can be used in stop_process() as a process group
-    # id to kill off all child processes
-    if [[ -n "$group" ]]; then
-        command="sg $group '$command'"
-    fi
-
-    # Append the process to the screen rc file
-    screen_rc "$name" "$command"
-
-    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start. Exit code: \$?\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
-}
-
-# Screen rc file builder
-# Uses globals ``SCREEN_NAME``, ``SCREENRC``, ``SCREEN_IS_LOGGING``
-# screen_rc service "command-line"
-function screen_rc {
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
-    if [[ ! -e $SCREENRC ]]; then
-        # Name the screen session
-        echo "sessionname $SCREEN_NAME" > $SCREENRC
-        # Set a reasonable statusbar
-        echo "hardstatus alwayslastline '$SCREEN_HARDSTATUS'" >> $SCREENRC
-        # Some distributions override PROMPT_COMMAND for the screen terminal type - turn that off
-        echo "setenv PROMPT_COMMAND /bin/true" >> $SCREENRC
-        echo "screen -t shell bash" >> $SCREENRC
-    fi
-    # If this service doesn't already exist in the screenrc file
-    if ! grep $1 $SCREENRC 2>&1 > /dev/null; then
-        NL=`echo -ne '\015'`
-        echo "screen -t $1 bash" >> $SCREENRC
-        echo "stuff \"$2$NL\"" >> $SCREENRC
-
-        if [[ -n ${LOGDIR} ]] && [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
-            echo "logfile ${LOGDIR}/${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
-            echo "log on" >>$SCREENRC
-        fi
-    fi
-}
-
-# Stop a service in screen
-# If a PID is available use it, kill the whole process group via TERM
-# If screen is being used kill the screen window; this will catch processes
-# that did not leave a PID behind
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
-# screen_stop_service service
-function screen_stop_service {
-    local service=$1
-
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-    if is_service_enabled $service; then
-        # Clean up the screen window
-        screen -S $SCREEN_NAME -p $service -X kill || true
-    fi
-}
-
 # Stop a service process
 # If a PID is available use it, kill the whole process group via TERM
 # If screen is being used kill the screen window; this will catch processes
@@ -1724,150 +1529,28 @@ function stop_process {
             $SYSTEMCTL stop devstack@$service.service
             $SYSTEMCTL disable devstack@$service.service
         fi
-
-        if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
-            pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid)
-            # oslo.service tends to stop actually shutting down
-            # reliably in between releases because someone believes it
-            # is dying too early due to some inflight work they
-            # have. This is a tension. It happens often enough we're
-            # going to just account for it in devstack and assume it
-            # doesn't work.
-            #
-            # Set OSLO_SERVICE_WORKS=True to skip this block
-            if [[ -z "$OSLO_SERVICE_WORKS" ]]; then
-                # TODO(danms): Remove this double-kill when we have
-                # this fixed in all services:
-                # https://bugs.launchpad.net/oslo-incubator/+bug/1446583
-                sleep 1
-                # /bin/true because pkill on a non existent process returns an error
-                pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid) || /bin/true
-            fi
-            rm $SERVICE_DIR/$SCREEN_NAME/$service.pid
-        fi
-        if [[ "$USE_SCREEN" = "True" ]]; then
-            # Clean up the screen window
-            screen_stop_service $service
-        fi
     fi
 }
 
-# Helper to get the status of each running service
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
-# service_check
+# use systemctl to check service status
 function service_check {
     local service
-    local failures
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-
-    if [[ ! -d "$SERVICE_DIR/$SCREEN_NAME" ]]; then
-        echo "No service status directory found"
-        return
-    fi
-
-    # Check if there is any failure flag file under $SERVICE_DIR/$SCREEN_NAME
-    # make this -o errexit safe
-    failures=`ls "$SERVICE_DIR/$SCREEN_NAME"/*.failure 2>/dev/null || /bin/true`
-
-    for service in $failures; do
-        service=`basename $service`
-        service=${service%.failure}
-        echo "Error: Service $service is not running"
+    for service in ${ENABLED_SERVICES//,/ }; do
+        # because some things got renamed like key => keystone
+        if $SYSTEMCTL is-enabled devstack@$service.service; then
+            # no-pager is needed because otherwise status dumps to a
+            # pager when in interactive mode, which will stop a manual
+            # devstack run.
+            $SYSTEMCTL status devstack@$service.service --no-pager
+        fi
     done
-
-    if [ -n "$failures" ]; then
-        die $LINENO "More details about the above errors can be found with screen"
-    fi
-}
-
-# Tail a log file in a screen if USE_SCREEN is true.
-# Uses globals ``USE_SCREEN``
-function tail_log {
-    local name=$1
-    local logfile=$2
-
-    if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_process "$name" "sudo tail -f $logfile | sed -u 's/\\\\\\\\x1b/\o033/g'"
-    fi
-}
-
-
-# Deprecated Functions
-# --------------------
-
-# _old_run_process() is designed to be backgrounded by old_run_process() to simulate a
-# fork.  It includes the dirty work of closing extra filehandles and preparing log
-# files to produce the same logs as screen_it().  The log filename is derived
-# from the service name and global-and-now-misnamed ``SCREEN_LOGDIR``
-# Uses globals ``CURRENT_LOG_TIME``, ``SCREEN_LOGDIR``, ``SCREEN_NAME``, ``SERVICE_DIR``
-# _old_run_process service "command-line"
-function _old_run_process {
-    local service=$1
-    local command="$2"
-
-    # Undo logging redirections and close the extra descriptors
-    exec 1>&3
-    exec 2>&3
-    exec 3>&-
-    exec 6>&-
-
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        exec 1>&${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME} 2>&1
-        ln -sf ${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${1}.log
-
-        # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
-        export PYTHONUNBUFFERED=1
-    fi
-
-    exec /bin/bash -c "$command"
-    die "$service exec failure: $command"
-}
-
-# old_run_process() launches a child process that closes all file descriptors and
-# then exec's the passed in command.  This is meant to duplicate the semantics
-# of screen_it() without screen.  PIDs are written to
-# ``$SERVICE_DIR/$SCREEN_NAME/$service.pid`` by the spawned child process.
-# old_run_process service "command-line"
-function old_run_process {
-    local service=$1
-    local command="$2"
-
-    # Spawn the child process
-    _old_run_process "$service" "$command" &
-    echo $!
 }
 
-# Compatibility for existing start_XXXX() functions
-# Uses global ``USE_SCREEN``
-# screen_it service "command-line"
-function screen_it {
-    if is_service_enabled $1; then
-        # Append the service to the screen rc file
-        screen_rc "$1" "$2"
-
-        if [[ "$USE_SCREEN" = "True" ]]; then
-            screen_process "$1" "$2"
-        else
-            # Spawn directly without screen
-            old_run_process "$1" "$2" >$SERVICE_DIR/$SCREEN_NAME/$1.pid
-        fi
-    fi
-}
 
-# Compatibility for existing stop_XXXX() functions
-# Stop a service in screen
-# If a PID is available use it, kill the whole process group via TERM
-# If screen is being used kill the screen window; this will catch processes
-# that did not leave a PID behind
-# screen_stop service
-function screen_stop {
-    # Clean up the screen window
-    stop_process $1
+function tail_log {
+    deprecated "With the removal of screen support, tail_log is deprecated and will be removed after Queens"
 }
 
-
 # Plugin Functions
 # =================
 
diff --git a/lib/nova b/lib/nova
index 581cd548ff..bd6695afdf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -573,10 +573,6 @@ function create_nova_conf {
         if [[ -n ${LOGDIR} ]]; then
             bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
             iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
-            if [[ -n ${SCREEN_LOGDIR} ]]; then
-                # Drop the backward-compat symlink
-                ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
-            fi
         fi
 
         iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
diff --git a/stack.sh b/stack.sh
index 301e1e7c6b..6e930ad234 100755
--- a/stack.sh
+++ b/stack.sh
@@ -228,16 +228,6 @@ if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-4
     fi
 fi
 
-# Check to see if we are already running DevStack
-# Note that this may fail if USE_SCREEN=False
-if type -p screen > /dev/null && screen -ls | egrep -q "[0-9]\.$SCREEN_NAME"; then
-    echo "You are already running a stack.sh session."
-    echo "To rejoin this session type 'screen -x stack'."
-    echo "To destroy this session, type './unstack.sh'."
-    exit 1
-fi
-
-
 # Local Settings
 # --------------
 
@@ -491,24 +481,6 @@ else
     exec 6> >( $TOP_DIR/tools/outfilter.py -v >&3 )
 fi
 
-# Set up logging of screen windows
-# Set ``SCREEN_LOGDIR`` to turn on logging of screen windows to the
-# directory specified in ``SCREEN_LOGDIR``, we will log to the file
-# ``screen-$SERVICE_NAME-$TIMESTAMP.log`` in that dir and have a link
-# ``screen-$SERVICE_NAME.log`` to the latest log file.
-# Logs are kept for as long specified in ``LOGDAYS``.
-# This is deprecated....logs go in ``LOGDIR``, only symlinks will be here now.
-if [[ -n "$SCREEN_LOGDIR" ]]; then
-
-    # We make sure the directory is created.
-    if [[ -d "$SCREEN_LOGDIR" ]]; then
-        # We cleanup the old logs
-        find $SCREEN_LOGDIR -maxdepth 1 -name screen-\*.log -mtime +$LOGDAYS -exec rm {} \;
-    else
-        mkdir -p $SCREEN_LOGDIR
-    fi
-fi
-
 # Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
 check_path_perm_sanity ${DEST}
 
@@ -1015,38 +987,6 @@ if is_service_enabled $DATABASE_BACKENDS; then
     configure_database
 fi
 
-
-# Configure screen
-# ----------------
-
-USE_SCREEN=$(trueorfalse True USE_SCREEN)
-if [[ "$USE_SCREEN" == "True" ]]; then
-    # Create a new named screen to run processes in
-    screen -d -m -S $SCREEN_NAME -t shell -s /bin/bash
-    sleep 1
-
-    # Set a reasonable status bar
-    SCREEN_HARDSTATUS=${SCREEN_HARDSTATUS:-}
-    if [ -z "$SCREEN_HARDSTATUS" ]; then
-        SCREEN_HARDSTATUS='%{= .} %-Lw%{= .}%> %n%f %t*%{= .}%+Lw%< %-=%{g}(%{d}%H/%l%{g})'
-    fi
-    screen -r $SCREEN_NAME -X hardstatus alwayslastline "$SCREEN_HARDSTATUS"
-    screen -r $SCREEN_NAME -X setenv PROMPT_COMMAND /bin/true
-
-    if is_service_enabled tls-proxy; then
-        follow_tls_proxy
-    fi
-fi
-
-# Clear ``screenrc`` file
-SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
-if [[ -e $SCREENRC ]]; then
-    rm -f $SCREENRC
-fi
-
-# Initialize the directory for service status check
-init_service_check
-
 # Save configuration values
 save_stackenv $LINENO
 
diff --git a/stackrc b/stackrc
index b123d8ac7c..787ae28a29 100644
--- a/stackrc
+++ b/stackrc
@@ -88,22 +88,9 @@ CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 
-# TODO(sdague): Queens
-#
-# All the non systemd paths should be removed in queens, they only
-# exist in Pike to support testing from grenade. Ensure that all this
-# is cleaned up and purged, which should dramatically simplify the
-# devstack codebase.
-
-# Whether to use 'dev mode' for screen windows. Dev mode works by
-# stuffing text into the screen windows so that a developer can use
-# ctrl-c, up-arrow, enter to restart the service. Starting services
-# this way is slightly unreliable, and a bit slower, so this can
-# be disabled for automated testing by setting this value to False.
-USE_SCREEN=$(trueorfalse False USE_SCREEN)
-
-# Whether to use SYSTEMD to manage services
-USE_SYSTEMD=$(trueorfalse False USE_SYSTEMD)
+# Whether to use SYSTEMD to manage services, we only do this from
+# Queens forward.
+USE_SYSTEMD="True"
 USER_UNITS=$(trueorfalse False USER_UNITS)
 if [[ "$USER_UNITS" == "True" ]]; then
     SYSTEMD_DIR="$HOME/.local/share/systemd/user"
@@ -122,16 +109,6 @@ fi
 # memory constrained than CPU bound.
 ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
 
-# When using screen, should we keep a log file on disk?  You might
-# want this False if you have a long-running setup where verbose logs
-# can fill-up the host.
-# XXX: Ideally screen itself would be configured to log but just not
-# activate.  This isn't possible with the screerc syntax.  Temporary
-# logging can still be used by a developer with:
-#    C-a : logfile foo
-#    C-a : log on
-SCREEN_IS_LOGGING=$(trueorfalse True SCREEN_IS_LOGGING)
-
 # Passwords generated by interactive devstack runs
 if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
@@ -167,16 +144,6 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
-# TODO(sdague): Delete all this in Queens.
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    USE_SCREEN=False
-fi
-# if we are forcing off USE_SCREEN (as we do in the gate), force on
-# systemd. This allows us to drop one of 3 paths through the code.
-if [[ "$USE_SCREEN" == "False" ]]; then
-    USE_SYSTEMD="True"
-fi
-
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color
@@ -755,9 +722,6 @@ PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
 PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-""}
 
-# Set default screen name
-SCREEN_NAME=${SCREEN_NAME:-stack}
-
 # Allow the use of an alternate protocol (such as https) for service endpoints
 SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 
@@ -877,15 +841,6 @@ RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
 
 # Following entries need to be last items in file
 
-# Compatibility bits required by other callers like Grenade
-
-# Old way was using SCREEN_LOGDIR to locate those logs and LOGFILE for the stack.sh trace log.
-# LOGFILE       SCREEN_LOGDIR       output
-# not set       not set             no log files
-# set           not set             stack.sh log to LOGFILE
-# not set       set                 screen logs to SCREEN_LOGDIR
-# set           set                 stack.sh log to LOGFILE, screen logs to SCREEN_LOGDIR
-
 # New way is LOGDIR for all logs and LOGFILE for stack.sh trace log, but if not fully-qualified will be in LOGDIR
 # LOGFILE       LOGDIR              output
 # not set       not set             (new) set LOGDIR from default
@@ -893,9 +848,6 @@ RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
 # not set       set                 screen logs to LOGDIR
 # set           set                 stack.sh log to LOGFILE, screen logs to LOGDIR
 
-# For compat, if SCREEN_LOGDIR is set, it will be used to create back-compat symlinks to the LOGDIR
-# symlinks to SCREEN_LOGDIR (compat)
-
 # Set up new logging defaults
 if [[ -z "${LOGDIR:-}" ]]; then
     default_logdir=$DEST/logs
@@ -910,12 +862,6 @@ if [[ -z "${LOGDIR:-}" ]]; then
             # LOGFILE had no path, set a default
             LOGDIR="$default_logdir"
         fi
-
-        # Check for duplication
-        if [[ "${SCREEN_LOGDIR:-}" == "${LOGDIR}" ]]; then
-            # We don't need the symlinks since it's the same directory
-            unset SCREEN_LOGDIR
-        fi
     fi
     unset default_logdir logfile
 fi
diff --git a/tests/run-process.sh b/tests/run-process.sh
deleted file mode 100755
index 301b9a032b..0000000000
--- a/tests/run-process.sh
+++ /dev/null
@@ -1,109 +0,0 @@
-#!/bin/bash
-# tests/exec.sh - Test DevStack run_process() and stop_process()
-#
-# exec.sh start|stop|status
-#
-# Set USE_SCREEN True|False to change use of screen.
-#
-# This script emulates the basic exec environment in ``stack.sh`` to test
-# the process spawn and kill operations.
-
-if [[ -z $1 ]]; then
-    echo "$0 start|stop"
-    exit 1
-fi
-
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-source $TOP_DIR/functions
-
-USE_SCREEN=${USE_SCREEN:-False}
-
-ENABLED_SERVICES=fake-service
-
-SERVICE_DIR=/tmp
-SCREEN_NAME=test
-SCREEN_LOGDIR=${SERVICE_DIR}/${SCREEN_NAME}
-
-
-# Kill background processes on exit
-trap clean EXIT
-clean() {
-    local r=$?
-    jobs -p
-    kill >/dev/null 2>&1 $(jobs -p)
-    exit $r
-}
-
-
-# Exit on any errors so that errors don't compound
-trap failed ERR
-failed() {
-    local r=$?
-    jobs -p
-    kill >/dev/null 2>&1 $(jobs -p)
-    set +o xtrace
-    [ -n "$LOGFILE" ] && echo "${0##*/} failed: full log in $LOGFILE"
-    exit $r
-}
-
-function status {
-    if [[ -r $SERVICE_DIR/$SCREEN_NAME/fake-service.pid ]]; then
-        pstree -pg $(cat $SERVICE_DIR/$SCREEN_NAME/fake-service.pid)
-    fi
-    ps -ef | grep fake
-}
-
-function setup_screen {
-if [[ ! -d $SERVICE_DIR/$SCREEN_NAME ]]; then
-    rm -rf $SERVICE_DIR/$SCREEN_NAME
-    mkdir -p $SERVICE_DIR/$SCREEN_NAME
-fi
-
-if [[ "$USE_SCREEN" == "True" ]]; then
-    # Create a new named screen to run processes in
-    screen -d -m -S $SCREEN_NAME -t shell -s /bin/bash
-    sleep 1
-
-    # Set a reasonable status bar
-    if [ -z "$SCREEN_HARDSTATUS" ]; then
-        SCREEN_HARDSTATUS='%{= .} %-Lw%{= .}%> %n%f %t*%{= .}%+Lw%< %-=%{g}(%{d}%H/%l%{g})'
-    fi
-    screen -r $SCREEN_NAME -X hardstatus alwayslastline "$SCREEN_HARDSTATUS"
-fi
-
-# Clear screen rc file
-SCREENRC=$TOP_DIR/tests/$SCREEN_NAME-screenrc
-if [[ -e $SCREENRC ]]; then
-    echo -n > $SCREENRC
-fi
-}
-
-# Mimic logging
-    # Set up output redirection without log files
-    # Copy stdout to fd 3
-    exec 3>&1
-    if [[ "$VERBOSE" != "True" ]]; then
-        # Throw away stdout and stderr
-        #exec 1>/dev/null 2>&1
-        :
-    fi
-    # Always send summary fd to original stdout
-    exec 6>&3
-
-
-if [[ "$1" == "start" ]]; then
-    echo "Start service"
-    setup_screen
-    run_process fake-service "$TOP_DIR/tests/fake-service.sh"
-    sleep 1
-    status
-elif [[ "$1" == "stop" ]]; then
-    echo "Stop service"
-    stop_process fake-service
-    status
-elif [[ "$1" == "status" ]]; then
-    status
-else
-    echo "Unknown command"
-    exit 1
-fi
diff --git a/unstack.sh b/unstack.sh
index 77a151f933..5d3672e25d 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -171,15 +171,6 @@ if is_service_enabled dstat; then
     stop_dstat
 fi
 
-# Clean up the remainder of the screen processes
-SCREEN=$(which screen)
-if [[ -n "$SCREEN" ]]; then
-    SESSION=$(screen -ls | awk "/[0-9]+.${SCREEN_NAME}/"'{ print $1 }')
-    if [[ -n "$SESSION" ]]; then
-        screen -X -S $SESSION quit
-    fi
-fi
-
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.

From 0eebeb415ada3437b598d0ceb6952dc7ad9134d9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 30 Aug 2017 14:16:58 -0400
Subject: [PATCH 2047/3333] clean up screen and tail_log references

Change-Id: I6bcfa09931ed1f70e071ccb16688c15c7ef2898f
---
 lib/cinder         | 11 ++++-------
 lib/dstat          |  2 +-
 lib/glance         |  3 +--
 lib/horizon        |  5 ++---
 lib/keystone       |  6 +-----
 lib/neutron        |  4 ++--
 lib/neutron-legacy |  4 ++--
 lib/nova           |  4 ++--
 lib/swift          | 13 +++----------
 lib/template       |  4 ++--
 10 files changed, 20 insertions(+), 36 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..ba5bd04a0d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -473,7 +473,7 @@ function _configure_tgt_for_config_d {
     fi
 }
 
-# start_cinder() - Start running processes, including screen
+# start_cinder() - Start running processes
 function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
@@ -533,12 +533,9 @@ function start_cinder {
 # stop_cinder() - Stop running processes
 function stop_cinder {
     stop_process c-api
-
-    # Kill the cinder screen windows
-    local serv
-    for serv in c-bak c-sch c-vol; do
-        stop_process $serv
-    done
+    stop_process c-bak
+    stop_process c-sch
+    stop_process c-vol
 }
 
 # create_volume_types() - Create Cinder's configured volume types
diff --git a/lib/dstat b/lib/dstat
index 982b70387e..fe38d75585 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -16,7 +16,7 @@
 _XTRACE_DSTAT=$(set +o | grep xtrace)
 set +o xtrace
 
-# start_dstat() - Start running processes, including screen
+# start_dstat() - Start running processes
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     run_process dstat "$TOP_DIR/tools/dstat.sh $LOGDIR"
diff --git a/lib/glance b/lib/glance
index 0a5b9f59b6..6e4a925488 100644
--- a/lib/glance
+++ b/lib/glance
@@ -333,7 +333,7 @@ function install_glance {
     setup_develop $GLANCE_DIR
 }
 
-# start_glance() - Start running processes, including screen
+# start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
@@ -358,7 +358,6 @@ function start_glance {
 
 # stop_glance() - Stop running processes
 function stop_glance {
-    # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
 }
diff --git a/lib/horizon b/lib/horizon
index becc5a0e67..3d2f68d09d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -181,13 +181,12 @@ function install_horizon {
     git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH
 }
 
-# start_horizon() - Start running processes, including screen
+# start_horizon() - Start running processes
 function start_horizon {
     restart_apache_server
-    tail_log horizon /var/log/$APACHE_NAME/horizon_error.log
 }
 
-# stop_horizon() - Stop running processes (non-screen)
+# stop_horizon() - Stop running processes
 function stop_horizon {
     stop_apache_server
 }
diff --git a/lib/keystone b/lib/keystone
index 685891e8bc..69aadb66e0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -536,7 +536,7 @@ function install_keystone {
     fi
 }
 
-# start_keystone() - Start running processes, including screen
+# start_keystone() - Start running processes
 function start_keystone {
     # Get right service port for testing
     local service_port=$KEYSTONE_SERVICE_PORT
@@ -549,8 +549,6 @@ function start_keystone {
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
-        tail_log key /var/log/$APACHE_NAME/keystone.log
-        tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
         run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
@@ -585,8 +583,6 @@ function stop_keystone {
     else
         stop_process keystone
     fi
-    # Kill the Keystone screen window
-    stop_process key
 }
 
 # bootstrap_keystone() - Initialize user, role and project
diff --git a/lib/neutron b/lib/neutron
index 2a660ec8e1..a5312888c3 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -409,7 +409,7 @@ function start_neutron_api {
     fi
 }
 
-# start_neutron() - Start running processes, including screen
+# start_neutron() - Start running processes
 function start_neutron_new {
     # Start up the neutron agents if enabled
     # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
@@ -446,7 +446,7 @@ function start_neutron_new {
     fi
 }
 
-# stop_neutron() - Stop running processes (non-screen)
+# stop_neutron() - Stop running processes
 function stop_neutron_new {
     for serv in neutron-api neutron-agent neutron-l3; do
         stop_process $serv
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 784f3a8167..c8d2540ca5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -455,7 +455,7 @@ function configure_neutron_after_post_config {
     fi
 }
 
-# Start running processes, including screen
+# Start running processes
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
     local service_protocol=$Q_PROTOCOL
@@ -524,7 +524,7 @@ function stop_mutnauq_l2_agent {
     stop_process q-agt
 }
 
-# stop_mutnauq_other() - Stop running processes (non-screen)
+# stop_mutnauq_other() - Stop running processes
 function stop_mutnauq_other {
     if is_service_enabled q-dhcp; then
         stop_process q-dhcp
diff --git a/lib/nova b/lib/nova
index bd6695afdf..5b78972571 100644
--- a/lib/nova
+++ b/lib/nova
@@ -882,7 +882,7 @@ function start_nova_compute {
     export PATH=$old_path
 }
 
-# start_nova() - Start running processes, including screen
+# start_nova() - Start running processes
 function start_nova_rest {
     # Hack to set the path for rootwrap
     local old_path=$PATH
@@ -999,7 +999,7 @@ function stop_nova_conductor {
     done
 }
 
-# stop_nova() - Stop running processes (non-screen)
+# stop_nova() - Stop running processes
 function stop_nova {
     stop_nova_rest
     stop_nova_conductor
diff --git a/lib/swift b/lib/swift
index 455740ea82..45f679302c 100644
--- a/lib/swift
+++ b/lib/swift
@@ -7,7 +7,7 @@
 #
 # - ``functions`` file
 # - ``apache`` file
-# - ``DEST``, ``SCREEN_NAME``, `SWIFT_HASH` must be defined
+# - ``DEST``, `SWIFT_HASH` must be defined
 # - ``STACK_USER`` must be defined
 # - ``SWIFT_DATA_DIR`` or ``DATA_DIR`` must be defined
 # - ``lib/keystone`` file
@@ -780,7 +780,7 @@ function install_ceilometermiddleware {
     fi
 }
 
-# start_swift() - Start running processes, including screen
+# start_swift() - Start running processes
 function start_swift {
     # (re)start memcached to make sure we have a clean memcache.
     restart_service memcached
@@ -799,13 +799,6 @@ function start_swift {
         restart_apache_server
         # The rest of the services should be started in backgroud
         swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
-        # Be we still want the logs of Swift Proxy in our screen session
-        tail_log s-proxy /var/log/$APACHE_NAME/proxy-server
-        if [[ ${SWIFT_REPLICAS} == 1 ]]; then
-            for type in object container account; do
-                tail_log s-${type} /var/log/$APACHE_NAME/${type}-server-1
-            done
-        fi
         return 0
     fi
 
@@ -859,7 +852,7 @@ function start_swift {
     fi
 }
 
-# stop_swift() - Stop running processes (non-screen)
+# stop_swift() - Stop running processes
 function stop_swift {
     local type
 
diff --git a/lib/template b/lib/template
index 25d653cb46..e6d003284f 100644
--- a/lib/template
+++ b/lib/template
@@ -81,7 +81,7 @@ function install_XXXX {
     :
 }
 
-# start_XXXX() - Start running processes, including screen
+# start_XXXX() - Start running processes
 function start_XXXX {
     # The quoted command must be a single command and not include an
     # shell metacharacters, redirections or shell builtins.
@@ -89,7 +89,7 @@ function start_XXXX {
     :
 }
 
-# stop_XXXX() - Stop running processes (non-screen)
+# stop_XXXX() - Stop running processes
 function stop_XXXX {
     # for serv in serv-a serv-b; do
     #     stop_process $serv

From 730faa2626cb2522dd07465b8c8cf87e39a99ace Mon Sep 17 00:00:00 2001
From: Anna Khmelnitsky <akhmelnitsky@vmware.com>
Date: Fri, 1 Sep 2017 16:25:09 -0700
Subject: [PATCH 2048/3333] Cap tox != 2.8.0 temporarily to avoid ValueError

This is proposed temporary change to avoid
"ValueError: need more than 1 value to unpack" error in stack.

Change-Id: I743febbef3a1f201cea37471356518be31585277
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..0ce663c7ab 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -608,7 +608,7 @@ function configure_tempest {
 # install_tempest() - Collect source and prepare
 function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
-    pip_install tox
+    pip_install 'tox!=2.8.0'
     pushd $TEMPEST_DIR
     tox -r --notest -efull
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that

From c63d9331a78159833a784806db4b2cd6b58a3eed Mon Sep 17 00:00:00 2001
From: zhangbailin <zhangbailin@inspur.com>
Date: Fri, 1 Sep 2017 19:46:16 -0700
Subject: [PATCH 2049/3333] Replace http with https for doc links in devstack's
 document

1) Update doc links according to OpenStack document migration
2) Use https instead of http for docs links

Change-Id: I81b560d1e4c5210dc00a6a6ac06c03bb1e69d595
---
 HACKING.rst        | 4 ++--
 doc/source/faq.rst | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index fc67f09a7b..d5d6fbcf02 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -20,7 +20,7 @@ in `How To Contribute`__ in the OpenStack wiki.  `DevStack's LaunchPad project`_
 contains the usual links for blueprints, bugs, etc.
 
 __ contribute_
-.. _contribute: http://docs.openstack.org/infra/manual/developers.html
+.. _contribute: https://docs.openstack.org/infra/manual/developers.html
 
 __ lp_
 .. _lp: https://launchpad.net/~devstack
@@ -255,7 +255,7 @@ These scripts are executed serially by ``exercise.sh`` in testing situations.
 * The ``OS_*`` environment variables should be the only ones used for all
   authentication to OpenStack clients as documented in the CLIAuth_ wiki page.
 
-.. _CLIAuth: http://wiki.openstack.org/CLIAuth
+.. _CLIAuth: https://wiki.openstack.org/CLIAuth
 
 * The exercise MUST clean up after itself if successful.  If it is not successful,
   it is assumed that state will be left behind; this allows a chance for developers
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index a186336f54..ed9b4da6bb 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -32,9 +32,9 @@ That isn't a question, but please do! The source for DevStack is at
 `git.openstack.org
 <https://git.openstack.org/cgit/openstack-dev/devstack>`__ and bug
 reports go to `LaunchPad
-<http://bugs.launchpad.net/devstack/>`__. Contributions follow the
+<https://bugs.launchpad.net/devstack/>`__. Contributions follow the
 usual process as described in the `developer guide
-<http://docs.openstack.org/infra/manual/developers.html>`__. This
+<https://docs.openstack.org/infra/manual/developers.html>`__. This
 Sphinx documentation is housed in the doc directory.
 
 Why not use packages?

From 5f2ed3697c39ee1e579fe3d0927927b2ca6a4fc4 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 4 Sep 2017 08:48:08 +0000
Subject: [PATCH 2050/3333] Updated from generate-devstack-plugins-list

Change-Id: Ifbb6d64834d6f3609c56c85163dc367d778ed21f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a1d5ad822b..2c8805ff16 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -144,6 +144,7 @@ octavia-dashboard                      `git://git.openstack.org/openstack/octavi
 omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__

From d8bb220606737719bcdf7c5b4f54906f2974c71c Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 3 Sep 2017 12:13:59 -0500
Subject: [PATCH 2051/3333] Make list_images.sh emit the etcd3 tarball

We need this for every devstack run now, so downloading it from github
every time isn't the most awesome thing in the world.

Add an extra variable EXTRA_CACHE_URLS which will be appended to the
output of tools/image_list.sh.  This way, these files will be
downloaded during the daily nodepool build, but they will not be in
the IMAGE_LIST and hence be considered as images to upload.

Add a function get_extra_file which echos the path to a file given the
URL.  It will first check the cache at $FILES, and if not present
download it.

Update the documentation in image_list.sh to reflect what's happening.

Move the defaults for etcd variables into stackrc, since it is a base
service now.

Change-Id: I86104824a29d973a6288df1f24b7891feb86267c
---
 functions           | 31 +++++++++++++++++++++++++++++++
 lib/etcd3           | 32 ++++----------------------------
 stackrc             | 34 ++++++++++++++++++++++++++++++++++
 tools/image_list.sh | 23 ++++++++++++++++++++---
 4 files changed, 89 insertions(+), 31 deletions(-)

diff --git a/functions b/functions
index 6f2164a777..ebcae334e0 100644
--- a/functions
+++ b/functions
@@ -45,6 +45,37 @@ function short_source {
 # export it so child shells have access to the 'short_source' function also.
 export -f short_source
 
+# Download a file from a URL
+#
+# Will check cache (in $FILES) or download given URL.
+#
+# Argument is the URL to the remote file
+#
+# Will echo the local path to the file as the output.  Will die on
+# failure to download.
+#
+# Files can be pre-cached for CI environments, see EXTRA_CACHE_URLS
+# and tools/image_list.sh
+function get_extra_file {
+    local file_url=$1
+
+    file_name=$(basename "$file_url")
+    if [[ $file_url != file* ]]; then
+        # If the file isn't cache, download it
+        if [[ ! -f $FILES/$file_name ]]; then
+            wget --progress=dot:giga -c $file_url -O $FILES/$file_name
+            if [[ $? -ne 0 ]]; then
+                die "$file_url could not be downloaded"
+            fi
+        fi
+        echo "$FILES/$file_name"
+        return
+    else
+        # just strip the file:// bit and that's the path to the file
+        echo $file_url | sed 's/$file:\/\///g'
+    fi
+}
+
 
 # Retrieve an image from a URL and upload into Glance.
 # Uses the following variables:
diff --git a/lib/etcd3 b/lib/etcd3
index 6e32cb31ca..60e827add2 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -24,15 +24,9 @@ set +o xtrace
 # --------
 
 # Set up default values for etcd
-ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
-ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
 ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
-ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
-# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
-ETCD_SHA256_ARM64=""
-ETCD_SHA256_PPC64=""
 ETCD_PORT=2379
 
 if is_ubuntu ; then
@@ -95,37 +89,19 @@ function cleanup_etcd3 {
 function install_etcd3 {
     echo "Installing etcd"
 
-    # Make sure etcd3 downloads the correct architecture
-    if is_arch "x86_64"; then
-        ETCD_ARCH="amd64"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_AMD64}
-    elif is_arch "aarch64"; then
-        ETCD_ARCH="arm64"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_ARM64}
-    elif is_arch "ppc64le"; then
-        ETCD_ARCH="ppc64le"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
-    else
-        exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
-    fi
-
-    ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
-
     # Create the necessary directories
     sudo mkdir -p $ETCD_BIN_DIR
     sudo mkdir -p $ETCD_DATA_DIR
 
     # Download and cache the etcd tgz for subsequent use
+    local etcd_file
+    etcd_file="$(get_extra_file $ETCD_DOWNLOAD_LOCATION)"
     if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
-        ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
-        if [ ! -f "$FILES/$ETCD_DOWNLOAD_FILE" ]; then
-            wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
-        fi
-        echo "${ETCD_SHA256} $FILES/${ETCD_DOWNLOAD_FILE}" > $FILES/etcd.sha256sum
+        echo "${ETCD_SHA256} $etcd_file" > $FILES/etcd.sha256sum
         # NOTE(sdague): this should go fatal if this fails
         sha256sum -c $FILES/etcd.sha256sum
 
-        tar xzvf $FILES/$ETCD_DOWNLOAD_FILE -C $FILES
+        tar xzvf $etcd_file -C $FILES
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
diff --git a/stackrc b/stackrc
index b123d8ac7c..0757d78775 100644
--- a/stackrc
+++ b/stackrc
@@ -732,6 +732,40 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
     DOWNLOAD_DEFAULT_IMAGES=False
 fi
 
+# This is a comma separated list of extra URLS to be listed for
+# download by the tools/image_list.sh script.  CI environments can
+# pre-download these URLS and place them in $FILES.  Later scripts can
+# then use "get_extra_file <url>" which will print out the path to the
+# file; it will either be downloaded on demand or acquired from the
+# cache if there.
+EXTRA_CACHE_URLS=""
+
+# etcd3 defaults
+ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
+ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
+# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
+ETCD_SHA256_ARM64=""
+ETCD_SHA256_PPC64=""
+# Make sure etcd3 downloads the correct architecture
+if is_arch "x86_64"; then
+    ETCD_ARCH="amd64"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_AMD64}
+elif is_arch "aarch64"; then
+    ETCD_ARCH="arm64"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_ARM64}
+elif is_arch "ppc64le"; then
+    ETCD_ARCH="ppc64le"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
+else
+    exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
+fi
+ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
+ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
+ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
+ETCD_DOWNLOAD_LOCATION=$ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE
+# etcd is always required, so place it into list of pre-cached downloads
+EXTRA_CACHE_URLS+=",$ETCD_DOWNLOAD_LOCATION"
+
 # Detect duplicate values in IMAGE_URLS
 for image_url in ${IMAGE_URLS//,/ }; do
     if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then
diff --git a/tools/image_list.sh b/tools/image_list.sh
index 29b93ed1d8..3a27c4acfd 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -1,5 +1,14 @@
 #!/bin/bash
 
+# Print out a list of image and other files to download for caching.
+# This is mostly used by the OpenStack infrasturucture during daily
+# image builds to save the large images to /opt/cache/files (see [1])
+#
+# The two lists of URL's downloaded are the IMAGE_URLS and
+# EXTRA_CACHE_URLS, which are setup in stackrc
+#
+# [1] project-config:nodepool/elements/cache-devstack/extra-data.d/55-cache-devstack-repos
+
 # Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
@@ -31,12 +40,20 @@ for driver in $DRIVERS; do
     ALL_IMAGES+=$URLS
 done
 
-# Make a nice list
-echo $ALL_IMAGES | tr ',' '\n' | sort | uniq
-
 # Sanity check - ensure we have a minimum number of images
 num=$(echo $ALL_IMAGES | tr ',' '\n' | sort | uniq | wc -l)
 if [[ "$num" -lt 4 ]]; then
     echo "ERROR: We only found $num images in $ALL_IMAGES, which can't be right."
     exit 1
 fi
+
+# This is extra non-image files that we want pre-cached.  This is kept
+# in a separate list because devstack loops over the IMAGE_LIST to
+# upload files glance and these aren't images.  (This was a bit of an
+# after-thought which is why the naming around this is very
+# image-centric)
+URLS=$(source $TOP_DIR/stackrc && echo $EXTRA_CACHE_URLS)
+ALL_IMAGES+=$URLS
+
+# Make a nice combined list
+echo $ALL_IMAGES | tr ',' '\n' | sort | uniq

From 477a962861afe2e859179245d6d39cb41f6c499d Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 4 Aug 2017 11:09:26 -0400
Subject: [PATCH 2052/3333] Enable graceful shutdown for services

1] Process using uwsgi:
   uwsgi services doesn't support for graceful shutting down [1].
   It requires some changes in unit files [2] including adding below
   graceful shutdown hook and changing KillSignal:
      --hook-master-start "unix_signal:15 gracefully_kill_them_all
   All the steps and changes required are specified in etherpad [1].

2] Non uwsgi services needs below changes:
   In [service] section:
   a. Add KillMode = process
   b. Add TimeoutStopSec = infinity

NOTE:
Creating unit file for services other than uwsgi is handled by the
'write_user_unit_file' function [3]. This function is common for all
the services so this patch adds the above mentioned parameters for
services using ServiceLauncher also though they don't require.

Added a new stackrc variable WORKER_TIMEOUT which is required to add
graceful shutdown support to uwsgi services. It will be set as a value
to 'worker-reload-mercy' [4] in uwsgi file of service. The default
value set to this variable is 90.

[1] https://etherpad.openstack.org/p/uwsgi-issues
[2] https://www.freedesktop.org/software/systemd/man/systemd.kill.html
[3] https://github.com/openstack-dev/devstack/blob/2967ca3dfd0d64970dfa5dfa7ac2330ee7aa90ed/functions-common#L1439-L1461
[4] http://uwsgi-docs.readthedocs.io/en/latest/Options.html#worker-reload-mercy

Co-Authored-By: Dinesh Bhor <dinesh.bhor@nttdata.com>
Change-Id: Ia95291325ce4858b47102dd49504250183f339ab
---
 functions-common |  4 +++-
 lib/apache       | 10 ++++++++++
 stackrc          |  3 +++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index a5f770f579..52f53ef147 100644
--- a/functions-common
+++ b/functions-common
@@ -1451,6 +1451,8 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    iniset -sudo $unitfile "Service" "KillMode" "process"
+    iniset -sudo $unitfile "Service" "TimeoutStopSec" "infinity"
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1473,7 +1475,7 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "Type" "notify"
-    iniset -sudo $unitfile "Service" "KillSignal" "SIGQUIT"
+    iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "Restart" "always"
     iniset -sudo $unitfile "Service" "NotifyAccess" "all"
     iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
diff --git a/lib/apache b/lib/apache
index dfca25a764..39d5b7b071 100644
--- a/lib/apache
+++ b/lib/apache
@@ -260,10 +260,15 @@ function write_uwsgi_config {
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$file" uwsgi die-on-term true
     iniset "$file" uwsgi exit-on-reload true
+    # Set worker-reload-mercy so that worker will not exit till the time
+    # configured after graceful shutdown
+    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$file" uwsgi enable-threads true
     iniset "$file" uwsgi plugins python
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
+    # Set hook to trigger graceful shutdown on SIGTERM
+    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
     # Override the default size for headers from the 4k default.
     iniset "$file" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
@@ -316,6 +321,11 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi plugins python
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
+    # Set hook to trigger graceful shutdown on SIGTERM
+    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
+    # Set worker-reload-mercy so that worker will not exit till the time
+    # configured after graceful shutdown
+    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     # Override the default size for headers from the 4k default.
     iniset "$file" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
diff --git a/stackrc b/stackrc
index 3591994f79..e936b337e7 100644
--- a/stackrc
+++ b/stackrc
@@ -778,6 +778,9 @@ SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 # Service graceful shutdown timeout
 SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 
+# Service graceful shutdown timeout
+WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
+
 # Support alternative yum -- in future Fedora 'dnf' will become the
 # only supported installer, but for now 'yum' and 'dnf' are both
 # available in parallel with compatible CLIs.  Allow manual switching

From acb48a1a192b9531c6b30ed42426cb96f012ebb0 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 6 Sep 2017 10:55:39 +0000
Subject: [PATCH 2053/3333] Update link to nova config reference

For devstack master branch we should point to the latest version and not
to some possibly outdated older branch.

Change-Id: I4af3aef90a2c295df3de4a5b49d127e85ab517ac
---
 doc/source/guides/nova.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 6bbab53aea..0f105d7c58 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -66,5 +66,5 @@ These config options are defined in `nova.conf.serial_console
 <https://github.com/openstack/nova/blob/master/nova/conf/serial_console.py>`_.
 
 For more information on OpenStack configuration see the `OpenStack
-Configuration Reference
-<https://docs.openstack.org/ocata/config-reference/compute.html>`_
+Compute Service Configuration Reference
+<https://docs.openstack.org/nova/latest/admin/configuration/index.html>`_

From a7e9a5d447b3eeacfb52d7ddc94445058a8d6fd1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 6 Sep 2017 10:58:04 +0000
Subject: [PATCH 2054/3333] Update to using pike cloud-archive

Now that Pike has been released, switch to using the pike version of
UCA instead of ocata, too.

One reason to do so it that it adds python3-ceph packages, allow to have
progress with the python3 compatibility of the Ceph integration.

Change-Id: I7d95e53892b697c72af75ad0ce7ce2dec6d31fde
---
 tools/fixup_stuff.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f1552ab2f7..efe0125741 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,10 +84,10 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; the
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:ocata
+        sudo add-apt-repository -y cloud-archive:pike
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From 486376e91b1f9a7680371036e470b8692804e917 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Tue, 5 Sep 2017 19:56:06 -0500
Subject: [PATCH 2055/3333] Change CINDER_LVM_TYPE to 'auto' as the default

This was previously set to thin as the default, but at the time
there were failures seen with what appeared to be race conditions
when creating snapshots.

These failures are not seen locally, and we have a lot of installs
using the default auto by this point with no reports from the field
of seeing this failure. This is to be able to more extensively test
this in the gate, and hopefully get this switched over to be able
to thinly provision by default when possible.

Change-Id: I3e99adadd1c37ba8b24b6cb71a8969ffc93f75a1
Related-bug: #1642111
---
 lib/cinder | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..9a2be653d1 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -70,12 +70,11 @@ CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
-# Defaults to default, which is thick, the other valid choice
-# is thin, which as the name implies utilizes lvm thin provisioning.
-# Thinly provisioned LVM volumes may be more efficient when using the Cinder
-# image cache, but there are also known race failures with volume snapshots
-# and thinly provisioned LVM volumes, see bug 1642111 for details.
-CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
+# Defaults to auto, which will do thin provisioning if it's a fresh
+# volume group, otherwise it will do thick. The other valid choices are
+# default, which is thick, or thin, which as the name implies utilizes lvm
+# thin provisioning.
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-auto}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend

From a066abedac916751660c73548e7eab2d216323c5 Mon Sep 17 00:00:00 2001
From: Roman Podoliaka <rpodolyaka@mirantis.com>
Date: Tue, 18 Apr 2017 16:18:14 +0300
Subject: [PATCH 2056/3333] placement: install osc-placement

This makes sure that the openstack client placement plugin gets
installed when either LIBS_FROM_GIT includes osc-placement or
placement is used, which is always now if you've enabled nova,
which is enabled by default.

Co-Authored-By: Matt Riedemann <mriedem.os@gmail.com>

Depends-On: Ica83e29780722dd1555904e46b9ff1d1fdf72516

Change-Id: I7c5a5c10288b356302bb3027837d4ed4f0fbad8c
---
 lib/libraries                | 2 ++
 lib/placement                | 3 +++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 3 ++-
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/libraries b/lib/libraries
index 4ceb80423c..6d52f642a1 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -30,6 +30,7 @@ GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["os-client-config"]=$DEST/os-client-config
 GITDIR["osc-lib"]=$DEST/osc-lib
+GITDIR["osc-placement"]=$DEST/osc-placement
 GITDIR["oslo.cache"]=$DEST/oslo.cache
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
@@ -91,6 +92,7 @@ function install_libs {
     _install_lib_from_source "debtcollector"
     _install_lib_from_source "futurist"
     _install_lib_from_source "osc-lib"
+    _install_lib_from_source "osc-placement"
     _install_lib_from_source "os-client-config"
     _install_lib_from_source "oslo.cache"
     _install_lib_from_source "oslo.concurrency"
diff --git a/lib/placement b/lib/placement
index aef9b7454e..d3fb8c848d 100644
--- a/lib/placement
+++ b/lib/placement
@@ -159,6 +159,9 @@ function init_placement {
 # install_placement() - Collect source and prepare
 function install_placement {
     install_apache_wsgi
+    # Install the openstackclient placement client plugin for CLI
+    # TODO(mriedem): Use pip_install_gr once osc-placement is in g-r.
+    pip_install osc-placement
 }
 
 # start_placement_api() - Start the API processes ahead of other things
diff --git a/stackrc b/stackrc
index 3591994f79..af0709a225 100644
--- a/stackrc
+++ b/stackrc
@@ -388,6 +388,10 @@ GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
 # this doesn't exist in a lib file, so set it here
 GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
+# placement-api CLI
+GITREPO["osc-placement"]=${OSC_PLACEMENT_REPO:-${GIT_BASE}/openstack/osc-placement.git}
+GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-master}
+
 
 ###################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 5b4ff32f2a..0bd8d49357 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -36,7 +36,8 @@ ALL_LIBS+=" oslo.messaging oslo.log cliff stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
-ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
+ALL_LIBS+=" python-openstackclient osc-lib osc-placement"
+ALL_LIBS+=" os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"

From a7f32720228968a589aab9dd10a08a03834b81a5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 7 Sep 2017 11:16:40 -0400
Subject: [PATCH 2057/3333] Fix up main readme

A few tweaks to make this more accurate.

Change-Id: I36ae24870be2ca6b5ac0e0507dd457b688739348
---
 README.rst                                   | 9 +++++----
 doc/source/guides/devstack-with-lbaas-v2.rst | 1 -
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.rst b/README.rst
index adbf59a637..6885546c94 100644
--- a/README.rst
+++ b/README.rst
@@ -1,4 +1,5 @@
-DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud.
+DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud
+from git source trees.
 
 Goals
 =====
@@ -27,9 +28,9 @@ Versions
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a Newton OpenStack cloud::
+following to create a Pike OpenStack cloud::
 
-    git checkout stable/newton
+    git checkout stable/pike
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate
@@ -54,7 +55,7 @@ When the script finishes executing, you should be able to access OpenStack
 endpoints, like so:
 
 * Horizon: http://myhost/
-* Keystone: http://myhost:5000/v2.0/
+* Keystone: http://myhost/identity/v2.0/
 
 We also provide an environment file that you can use to interact with your
 cloud via CLI::
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 4ed64bf12f..3592844efb 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -39,7 +39,6 @@ Edit your ``local.conf`` to look like
     LOGFILE=$DEST/logs/stack.sh.log
     VERBOSE=True
     LOG_COLOR=True
-    SCREEN_LOGDIR=$DEST/logs
     # Pre-requisite
     ENABLED_SERVICES=rabbit,mysql,key
     # Horizon

From 12fcd619302556d98a8b8191a97c914bd014bb3f Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Thu, 7 Sep 2017 13:36:00 -0500
Subject: [PATCH 2058/3333] doc: How to pdb under systemd

Add a section to the systemd doc describing how to use regular pdb in a
systemd environment.

Change-Id: Ib1f616f407eccc087de1c60624fa74e2555971c2
---
 doc/source/systemd.rst | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 60a7719262..f9971abf5a 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -98,8 +98,7 @@ Follow logs for a specific service::
 
 Following logs for multiple services simultaneously::
 
-  journalctl -f --unit devstack@n-cpu.service --unit
-  devstack@n-cond.service
+  journalctl -f --unit devstack@n-cpu.service --unit devstack@n-cond.service
 
 or you can even do wild cards to follow all the nova services::
 
@@ -121,6 +120,29 @@ left/right arrow keys.
 
 See ``man 1 journalctl`` for more.
 
+Debugging with pdb
+==================
+
+In order to break into a regular pdb session on a systemd-controlled
+service, you need to invoke the process manually - that is, take it out
+of systemd's control.
+
+Discover the command systemd is using to run the service::
+
+  systemctl show devstack@n-sch.service -p ExecStart --no-pager
+
+Stop the systemd service::
+
+  sudo systemctl stop devstack@n-sch.service
+
+Inject your breakpoint in the source, e.g.::
+
+  import pdb; pdb.set_trace()
+
+Invoke the command manually::
+
+  /usr/local/bin/nova-scheduler --config-file /etc/nova/nova.conf
+
 Known Issues
 ============
 

From 16ab25c187aa7972f85e96197cf182b009bb8465 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Thu, 7 Sep 2017 15:44:34 -0500
Subject: [PATCH 2059/3333] doc: How to remote-pdb under systemd

Add instructions for installing and enabling remote-pdb [1] under
systemd.

[1] https://pypi.python.org/pypi/remote-pdb

Thanks to clarkb for pointing me to this.  TIL.

Change-Id: I640ac36cfbcc5b199e911c0e3f6b18705c3fbbc4
---
 doc/source/systemd.rst | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index f9971abf5a..c1d2944057 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -120,8 +120,11 @@ left/right arrow keys.
 
 See ``man 1 journalctl`` for more.
 
-Debugging with pdb
-==================
+Debugging
+=========
+
+Using pdb
+---------
 
 In order to break into a regular pdb session on a systemd-controlled
 service, you need to invoke the process manually - that is, take it out
@@ -143,6 +146,37 @@ Invoke the command manually::
 
   /usr/local/bin/nova-scheduler --config-file /etc/nova/nova.conf
 
+Using remote-pdb
+----------------
+
+`remote-pdb`_ works while the process is under systemd control.
+
+Make sure you have remote-pdb installed::
+
+  sudo pip install remote-pdb
+
+Inject your breakpoint in the source, e.g.::
+
+  import remote_pdb; remote_pdb.set_trace()
+
+Restart the relevant service::
+
+  sudo systemctl restart devstack@n-api.service
+
+The remote-pdb code configures the telnet port when ``set_trace()`` is
+invoked.  Do whatever it takes to hit the instrumented code path, and
+inspect the logs for a message displaying the listening port::
+
+  Sep 07 16:36:12 p8-100-neo devstack@n-api.service[772]: RemotePdb session open at 127.0.0.1:46771, waiting for connection ...
+
+Telnet to that port to enter the pdb session::
+
+  telnet 127.0.0.1 46771
+
+See the `remote-pdb`_ home page for more options.
+
+.. _`remote-pdb`: https://pypi.python.org/pypi/remote-pdb
+
 Known Issues
 ============
 

From ef60f2b7180f269a53f405efa7449618eddf86a1 Mon Sep 17 00:00:00 2001
From: Dinesh Bhor <dinesh.bhor@nttdata.com>
Date: Tue, 5 Sep 2017 14:40:32 +0530
Subject: [PATCH 2060/3333] Enable reloadable config in services

uwsgi services:
[1] By default uwsgi is set to exit on reload this breaks config reloading
    of the service [1][2]. It needs to be set to 'false'.
[2] Requires to add 'systemctl reload' command support by adding ExecReload
    in unit file.

Non uwsgi services:
[1] Non uwsgi services only requires to add ExecReload in unit file.

There was a similar patch submitted by Matthew Treinish [3] but it was
already set to workflow +1(not merged as having dependency on other patch)
and it was having some issues as specified in comment and missing reload
functionality for other services.

[1] https://etherpad.openstack.org/p/uwsgi-issues
[2] http://uwsgi-docs.readthedocs.io/en/latest/Options.html#exit-on-reload
[3] https://review.openstack.org/#/c/490904/2

Change-Id: I78f5e9d4574671c74a52af64724946feb41c2d7a
---
 functions-common | 3 +++
 lib/apache       | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 52f53ef147..1e6ae5cc76 100644
--- a/functions-common
+++ b/functions-common
@@ -45,6 +45,7 @@ declare -A -g GITBRANCH
 declare -A -g GITDIR
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
+KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
@@ -1453,6 +1454,7 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "TimeoutStopSec" "infinity"
+    iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1474,6 +1476,7 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "SyslogIdentifier" "$service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
     iniset -sudo $unitfile "Service" "Type" "notify"
     iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "Restart" "always"
diff --git a/lib/apache b/lib/apache
index 39d5b7b071..5dc0e98192 100644
--- a/lib/apache
+++ b/lib/apache
@@ -259,7 +259,7 @@ function write_uwsgi_config {
     iniset "$file" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi exit-on-reload false
     # Set worker-reload-mercy so that worker will not exit till the time
     # configured after graceful shutdown
     iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
@@ -316,7 +316,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi exit-on-reload false
     iniset "$file" uwsgi enable-threads true
     iniset "$file" uwsgi plugins python
     # uwsgi recommends this to prevent thundering herd on accept.

From cbd5f4e0ad2ccc5903d12df73e3f0b033df1b3ae Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 10 Sep 2017 15:00:29 -0600
Subject: [PATCH 2061/3333] Check that generate-subunit exists before using it

If stack.sh fails before os-testr is installed, the generate-subunit
command won't exist.

Change-Id: I7998ed81e419e25d183e5a780df0b4459cca237c
---
 stack.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 301e1e7c6b..10ffc5e23c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -537,14 +537,20 @@ function exit_trap {
 
     if [[ $r -ne 0 ]]; then
         echo "Error on exit"
-        generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
+        # If we error before we've installed os-testr, which will fail.
+        if type -p generate-subunit > /dev/null; then
+            generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
+        fi
         if [[ -z $LOGDIR ]]; then
             $TOP_DIR/tools/worlddump.py
         else
             $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
     else
-        generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
+        # If we error before we've installed os-testr, which will fail.
+        if type -p generate-subunit > /dev/null; then
+            generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
+        fi
     fi
 
     exit $r

From 35a0c573b36236c8d73a0699cc7882170787f494 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Sun, 10 Sep 2017 15:37:56 -0700
Subject: [PATCH 2062/3333] Update gate clone error message for Zuul v3

Change-Id: I351de28aa5d5f25187953f1a4502445bc2ce76cc
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index deebdec249..c0fbcafa0c 100644
--- a/functions-common
+++ b/functions-common
@@ -519,7 +519,7 @@ function git_clone {
         if [[ ! -d $git_dest ]]; then
             if [[ "$ERROR_ON_CLONE" = "True" ]]; then
                 echo "The $git_dest project was not found; if this is a gate job, add"
-                echo "the project to the \$PROJECTS variable in the job definition."
+                echo "the project to 'required-projects' in the job definition."
                 die $LINENO "Cloning not allowed in this configuration"
             fi
             git_timed clone $git_clone_flags $git_remote $git_dest

From 02f9e8bbdddd69603cbb0afc93279c4151afd5f5 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sun, 10 Sep 2017 02:51:10 +0200
Subject: [PATCH 2063/3333] Replace pmap shellout with pure python
 implementation

Without this patch, the pmap -XX call fails on openSUSE Leap
distributions as those have a fairly ancient procps version that
does not support the -XX parameter. A pure python implementation
is more portable, faster and even shorter than the subprocess
call.

Closes-Bug: #1716066
Change-Id: I2fdb457e65359a1c9d40452c922cfdca0e6e74dc
---
 tools/mlock_report.py | 37 +++++++++++++++----------------------
 1 file changed, 15 insertions(+), 22 deletions(-)

diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 2169cc2dce..07716b04d6 100755
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -3,12 +3,12 @@
 # This tool lists processes that lock memory pages from swapping to disk.
 
 import re
-import subprocess
 
 import psutil
 
 
-SUMMARY_REGEX = re.compile(b".*\s+(?P<locked>[\d]+)\s+KB")
+LCK_SUMMARY_REGEX = re.compile(
+    "^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
 
 
 def main():
@@ -22,28 +22,21 @@ def main():
 def _get_report():
     mlock_users = []
     for proc in psutil.process_iter():
-        pid = proc.pid
         # sadly psutil does not expose locked pages info, that's why we
-        # call to pmap and parse the output here
+        # iterate over the /proc/%pid/status files manually
         try:
-            out = subprocess.check_output(['pmap', '-XX', str(pid)])
-        except subprocess.CalledProcessError as e:
-            # 42 means process just vanished, which is ok
-            if e.returncode == 42:
-                continue
-            raise
-        last_line = out.splitlines()[-1]
-
-        # some processes don't provide a memory map, for example those
-        # running as kernel services, so we need to skip those that don't
-        # match
-        result = SUMMARY_REGEX.match(last_line)
-        if result:
-            locked = int(result.group('locked'))
-            if locked:
-                mlock_users.append({'name': proc.name(),
-                                    'pid': pid,
-                                    'locked': locked})
+            s = open("%s/%d/status" % (psutil.PROCFS_PATH, proc.pid), 'r')
+        except EnvironmentError:
+            continue
+        with s:
+            for line in s:
+                result = LCK_SUMMARY_REGEX.search(line)
+                if result:
+                    locked = int(result.group('locked'))
+                    if locked:
+                        mlock_users.append({'name': proc.name(),
+                                            'pid': proc.pid,
+                                            'locked': locked})
 
     # produce a single line log message with per process mlock stats
     if mlock_users:

From e43dfdd453cd8d2c71f63ebbc96ad261d13e48eb Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Tue, 12 Sep 2017 16:13:26 -0600
Subject: [PATCH 2064/3333] Change lib/neutron-legacy to not enable linuxbridge
 for DVR

DVR isn't supported by the Linux Bridge agent, but the
mechanism driver is enabled by default, so Neutron attempts
port-bindings for it, generating ERRORS in the neutron-server
log in the check and gate jobs.  Just remove it in the DVR case.

Change-Id: Ic50e12e5fecf366a182c141b5c99649e653254cb
Closes-bug: #1716782
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f9e0bd6ded..0e326d600a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -168,7 +168,7 @@ fi
 #
 Q_DVR_MODE=${Q_DVR_MODE:-legacy}
 if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,l2population
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,l2population
 fi
 
 # Provider Network Configurations

From 941940a92cd5424bbe5125569b083f1059569bdb Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Wed, 13 Sep 2017 00:24:02 +0200
Subject: [PATCH 2065/3333] Add etcd3 support for s390x

Since [1] devstack is failing on s390x with "Distro not supported".
The reason for this is the missing etcd3 support. It worked before
[1] as we were able to disable etcd3 via local.conf. But as etcd3 is
a base service, we might not be able to rely on this workarond in
the future anymore.

As there is no etcd3 binary hosted on github like it is for other
architectures, the user needs to specify an alternative download
URL via local.conf. Otherwise devstack will exit with an appropriate
error message.

  ETCD_DOWNLOAD_URL=<custom-download-url>

[1] https://github.com/openstack-dev/devstack/commit/d8bb220606737719bcdf7c5b4f54906f2974c71c

Change-Id: I1c378a0456dcf2e94d79a02de9d3e16753d946d6
Partial-Bug: #1693192
---
 doc/source/configuration.rst | 15 ++++++++++++---
 stackrc                      | 11 +++++++++++
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index c4834b7a84..23f680a59c 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -779,9 +779,15 @@ are needed::
     DOWNLOAD_DEFAULT_IMAGES=False
     IMAGE_URLS="https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-s390x-disk1.img"
 
+    # Provide a custom etcd3 binary download URL and ints sha256.
+    # The binary must be located under '/<etcd version>/etcd-<etcd-version>-linux-s390x.tar.gz'
+    # on this URL.
+    # Build instructions for etcd3: https://github.com/linux-on-ibm-z/docs/wiki/Building-etcd
+    ETCD_DOWNLOAD_URL=<your-etcd-download-url>
+    ETCD_SHA256=<your-etcd3-sha256>
+
     enable_service n-sproxy
     disable_service n-novnc
-    disable_service etcd3  # https://bugs.launchpad.net/devstack/+bug/1693192
 
     [[post-config|$NOVA_CONF]]
 
@@ -803,8 +809,11 @@ Reasoning:
   needed if you want to use the *serial console* outside of the all-in-one
   setup.
 
-* The service ``etcd3`` needs to be disabled as long as bug report
-  https://bugs.launchpad.net/devstack/+bug/1693192 is not resolved.
+* A link to an etcd3 binary and its sha256 needs to be provided as the
+  binary for s390x is not hosted on github like it is for other
+  architectures. For more details see
+  https://bugs.launchpad.net/devstack/+bug/1693192. Etcd3 can easily be
+  built along https://github.com/linux-on-ibm-z/docs/wiki/Building-etcd.
 
 .. note:: To run *Tempest* against this *Devstack* all-in-one, you'll need
    to use a guest image which is smaller than 1GB when uncompressed.
diff --git a/stackrc b/stackrc
index c2bbe21aca..92a939f164 100644
--- a/stackrc
+++ b/stackrc
@@ -719,6 +719,7 @@ ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3
 # NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
 ETCD_SHA256_ARM64=""
 ETCD_SHA256_PPC64=""
+ETCD_SHA256_S390X=""
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"
@@ -729,6 +730,16 @@ elif is_arch "aarch64"; then
 elif is_arch "ppc64le"; then
     ETCD_ARCH="ppc64le"
     ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
+elif is_arch "s390x"; then
+    # An etcd3 binary for s390x is not available on github like it is
+    # for other arches. Only continue if a custom download URL was
+    # provided.
+    if [[ -n "${ETCD_DOWNLOAD_URL}" ]]; then
+        ETCD_ARCH="s390x"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
+    else
+        exit_distro_not_supported "etcd3. No custom ETCD_DOWNLOAD_URL provided."
+    fi
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi

From c04ac03e21546a3d25a2b6794802c4988f4ff532 Mon Sep 17 00:00:00 2001
From: Gyorgy Szombathelyi <gyurco@freemail.hu>
Date: Tue, 23 May 2017 16:52:35 +0200
Subject: [PATCH 2066/3333] Change deprecated nova settings

Change-Id: I0d129150411ede344c9b710d1aca5af1df3478b6
---
 lib/cinder | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index bc0c13fb88..59bcf8235c 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -230,16 +230,6 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
-    # Change the default nova_catalog_info and nova_catalog_admin_info values in
-    # cinder so that the service name cinder is searching for matches that set for
-    # nova in keystone.
-    if [[ -n "$CINDER_NOVA_CATALOG_INFO" ]]; then
-        iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
-    fi
-    if [[ -n "$CINDER_NOVA_CATALOG_ADMIN_INFO" ]]; then
-        iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
-    fi
-
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
@@ -254,8 +244,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
-    iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
-
     iniset $CINDER_CONF key_manager api_class cinder.keymgr.conf_key_mgr.ConfKeyManager
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -332,10 +320,9 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_api_version 2
     fi
 
-    # Set os_privileged_user credentials (used for os-assisted-snapshots)
-    iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
-    iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
-    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
+    # Set nova credentials (used for os-assisted-snapshots)
+    configure_auth_token_middleware $CINDER_CONF nova $CINDER_AUTH_CACHE_DIR nova
+    iniset $CINDER_CONF nova region_name "$REGION_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
     if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then

From 868746b5dac21e4c97a03f53459fca4e5aba73db Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 13 Sep 2017 15:44:18 -0600
Subject: [PATCH 2067/3333] lib/neutron: fix metering agent startup with
 systemd

With systemd, we now require absolute paths passed to run_process.

Change-Id: Iabd425a6d0ebaaaa5b13bc4a7b062158940958e6
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 2ffabd416b..a672d399ea 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -443,7 +443,7 @@ function start_neutron_new {
     fi
 
     if is_service_enabled neutron-metering; then
-        run_process neutron-metering "$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
+        run_process neutron-metering "$NEUTRON_BIN_DIR/$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
     fi
 }
 

From 387aadd14e87f2890ad8969c15edbe9f1d218a5a Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 14 Sep 2017 09:25:59 -0600
Subject: [PATCH 2068/3333] Install neutron rpms/debs when lib/neutron is used

lib/neutron service prefixes are neutron-* not q-*. We should install
those packages either way.

The patch moves files/*/neutron into files/*/neutron-common so that we
can correctly match */neutron against service specific dependency files
(f.e. */neutron-agent) and load the common packages if any neutron-*
service is present.

Change-Id: I57b36f2ed3f33737223a35d9ed734bb414f31e0b
---
 files/debs/{neutron => neutron-common}      | 0
 files/rpms-suse/{neutron => neutron-common} | 0
 files/rpms/{neutron => neutron-common}      | 0
 functions-common                            | 6 +++---
 4 files changed, 3 insertions(+), 3 deletions(-)
 rename files/debs/{neutron => neutron-common} (100%)
 rename files/rpms-suse/{neutron => neutron-common} (100%)
 rename files/rpms/{neutron => neutron-common} (100%)

diff --git a/files/debs/neutron b/files/debs/neutron-common
similarity index 100%
rename from files/debs/neutron
rename to files/debs/neutron-common
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron-common
similarity index 100%
rename from files/rpms-suse/neutron
rename to files/rpms-suse/neutron-common
diff --git a/files/rpms/neutron b/files/rpms/neutron-common
similarity index 100%
rename from files/rpms/neutron
rename to files/rpms/neutron-common
diff --git a/functions-common b/functions-common
index deebdec249..33639c5936 100644
--- a/functions-common
+++ b/functions-common
@@ -1211,9 +1211,9 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/keystone ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/keystone"
             fi
-        elif [[ $service == q-* ]]; then
-            if [[ ! $file_to_parse =~ $package_dir/neutron ]]; then
-                file_to_parse="${file_to_parse} ${package_dir}/neutron"
+        elif [[ $service == q-* || $service == neutron-* ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/neutron-common ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/neutron-common"
             fi
         elif [[ $service == ir-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/ironic ]]; then

From 4324f4ecd99f3cc50dea585bc8b5a680327e54bc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 14 Sep 2017 12:59:25 -0600
Subject: [PATCH 2069/3333] Fix devstack python detection if python3 is missing

On platforms without python3 installed devstack fails the python
version check. This does it more gracefully.

Change-Id: I4d79a41eb2d66852ab1a1aa8bd383f8e3e89cdc0
---
 functions-common | 5 ++++-
 stackrc          | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index deebdec249..b9bf0c9788 100644
--- a/functions-common
+++ b/functions-common
@@ -2080,7 +2080,10 @@ function is_provider_network {
 function _get_python_version {
     local interp=$1
     local version
-    version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    # disable erroring out here, otherwise if python 3 doesn't exist we fail hard.
+    if [[ -x $(which $interp) ]]; then
+        version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    fi
     echo ${version}
 }
 
diff --git a/stackrc b/stackrc
index 92a939f164..d60e186448 100644
--- a/stackrc
+++ b/stackrc
@@ -131,11 +131,11 @@ export DISABLED_PYTHON3_PACKAGES=""
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
-export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION}}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.5}}
 
 # Just to be more explicit on the Python 2 version to use.
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
-export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION}}
+export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then

From df17927fe84b4e50d5bc7376b6ff12bb70767a61 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 15 Sep 2017 10:09:54 +0000
Subject: [PATCH 2070/3333] Updated from generate-devstack-plugins-list

Change-Id: I3012b07f87a1d9c432e1b97b7400fae693c9331a
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2c8805ff16..6aa2e93739 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -39,6 +39,7 @@ cloudkitty                             `git://git.openstack.org/openstack/cloudk
 collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
 cue                                    `git://git.openstack.org/openstack/cue <https://git.openstack.org/cgit/openstack/cue>`__
+cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
 designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
 devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
 devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__

From 6bd4924cec73908225e6744b1b00dd86cb39d3ed Mon Sep 17 00:00:00 2001
From: Javier Pena <jpena@redhat.com>
Date: Fri, 15 Sep 2017 15:55:00 +0200
Subject: [PATCH 2071/3333] Ignore stderr when checking for Python version

https://review.openstack.org/504171 prevented Python version detection
from failing when python3 is not installed. However, "which python3"
returns a message in stderr when python3 is not there, and this output
can make diskimage-builder get confused when parsing
source-repository-images.

Change-Id: Idb649dc341ede73c39954b0432ef3cacf379ed37
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 283a6cf3d5..e53c72dc6e 100644
--- a/functions-common
+++ b/functions-common
@@ -2081,7 +2081,7 @@ function _get_python_version {
     local interp=$1
     local version
     # disable erroring out here, otherwise if python 3 doesn't exist we fail hard.
-    if [[ -x $(which $interp) ]]; then
+    if [[ -x $(which $interp 2> /dev/null) ]]; then
         version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
     fi
     echo ${version}

From 5ad4e58868bf48a72841bee313fd2aae61b6ddf7 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 7 Sep 2017 15:33:57 -0700
Subject: [PATCH 2072/3333] Display unaccounted time in "DevStack Component
 Timing"

In the "DevStack Component Timing" section, display the unaccounted
time.

Also add the units (seconds) to the output to make it clear to viewers.

Change-Id: Iaca82cc54a355f7077e20e548b771e53387f6628
---
 functions-common | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 4fc7c6db92..f2b8d98b39 100644
--- a/functions-common
+++ b/functions-common
@@ -2270,11 +2270,13 @@ function cleanup_oscwrap {
 function time_totals {
     local elapsed_time
     local end_time
-    local len=15
+    local len=20
     local xtrace
+    local unaccounted_time
 
     end_time=$(date +%s)
     elapsed_time=$(($end_time - $_TIME_BEGIN))
+    unaccounted_time=$elapsed_time
 
     # pad 1st column this far
     for t in ${!_TIME_TOTAL[*]}; do
@@ -2291,16 +2293,19 @@ function time_totals {
     echo
     echo "========================="
     echo "DevStack Component Timing"
+    echo " (times are in seconds)  "
     echo "========================="
-    printf "%-${len}s %3d\n" "Total runtime" "$elapsed_time"
-    echo
     for t in ${!_TIME_TOTAL[*]}; do
         local v=${_TIME_TOTAL[$t]}
         # because we're recording in milliseconds
         v=$(($v / 1000))
         printf "%-${len}s %3d\n" "$t" "$v"
+        unaccounted_time=$(($unaccounted_time - $v))
     done
+    echo "-------------------------"
+    printf "%-${len}s %3d\n" "Unaccounted time" "$unaccounted_time"
     echo "========================="
+    printf "%-${len}s %3d\n" "Total runtime" "$elapsed_time"
 
     $xtrace
 }

From b2330c89196c65662fcf98a2295b7e41b1652b28 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Sep 2017 09:10:21 +0000
Subject: [PATCH 2073/3333] Fix memcached_servers setting

By default memcached is bound to 127.0.0.1 and we have no code in place
to change that. So instead of using the $SERVICE_HOST variable, we
hardcode it to localhost, just as we do for the cache settings, see [1].

This also avoids a bug that occurs when $SERVICE_HOST contains an IPv6
address, as in that case it would have to be prefixed by "inet6:" [2].

[1] I95d798d122e2a95e27eb1d2c4e786c3cd844440b
[2] https://bugs.launchpad.net/swift/+bug/1610064

Change-Id: I46bed8a048f4b0d669dfc65b28ddeb36963553e0
Partial-Bug: 1656329
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index c38d953742..870a1fa992 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -450,7 +450,7 @@ function configure_auth_token_middleware {
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
-    iniset $conf_file $section memcached_servers $SERVICE_HOST:11211
+    iniset $conf_file $section memcached_servers localhost:11211
 }
 
 # init_keystone() - Initialize databases, etc.

From ee22ca8373abd3b5a4c44a9c5c4da39c511195c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 20 Sep 2017 00:29:36 +0000
Subject: [PATCH 2074/3333] Revert "Update to using pike cloud-archive"

This reverts commit a7e9a5d447b3eeacfb52d7ddc94445058a8d6fd1.

The jobs that run live migration tests are failing at about
a rate of 50% since this merged. There are no recent changes
to nova in the last 24 hours that are related to live
migration, and this is failing on the master branch only,
so I suspect the failures are due to new qemu packages
getting pulled in from this change.

Change-Id: Ic8481539c6a0cc7af08a736a625b672979435908
Closes-Bug: #1718295
---
 tools/fixup_stuff.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index efe0125741..f1552ab2f7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,10 +84,10 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; the
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:pike
+        sudo add-apt-repository -y cloud-archive:ocata
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From 7617ac208596665061453dfa04b75e4cc8a76ac9 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Sep 2017 17:43:48 +0000
Subject: [PATCH 2075/3333] Make is_ipv4_address a bit more robust

Still not ideal, but at least should avoid matching IPv6 addresses.

Change-Id: Ibb64263fdb0308f56c18518289501dd4642dcbad
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 713d92e717..ffdacef32e 100644
--- a/functions-common
+++ b/functions-common
@@ -2014,7 +2014,7 @@ function cidr2netmask {
 # Check if this is a valid ipv4 address string
 function is_ipv4_address {
     local address=$1
-    local regex='([0-9]{1,3}.){3}[0-9]{1,3}'
+    local regex='([0-9]{1,3}\.){3}[0-9]{1,3}'
     # TODO(clarkb) make this more robust
     if [[ "$address" =~ $regex ]] ; then
         return 0

From 146332e349416ac0b3c9653b0ae68d55dbb3f9de Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 20 Sep 2017 06:18:08 +0000
Subject: [PATCH 2076/3333] Make etcd3 setup work with IPv6 addresses

The client are told to connect to SERVICE_HOST instead of HOST_IP, so
we need to start etcd3 with matching listening parameters.

Change-Id: I96389090180d21d25d72df8f9e8905b850bcaee9
Partial-Bug: 1656329
---
 lib/etcd3 | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 60e827add2..e6a04f11de 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -40,9 +40,13 @@ function start_etcd3 {
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
     cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
     cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
-    cmd+=" --advertise-client-urls http://${HOST_IP}:$ETCD_PORT"
-    cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
-    cmd+=" --listen-client-urls http://${HOST_IP}:$ETCD_PORT"
+    cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    if [ "$SERVICE_LISTEN_ADDRESS" == "::" ]; then
+        cmd+=" --listen-peer-urls http://[::]:2380 "
+    else
+        cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
+    fi
+    cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From 917ad0998be8c48bfcc0e3031bc1b75cd9ed1927 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 20 Sep 2017 14:46:48 +0000
Subject: [PATCH 2077/3333] Update to using pike cloud-archive

This reverts commit ee22ca8373abd3b5a4c44a9c5c4da39c511195c8

Depends-On: Iae2962bb86100f03fd3ad9aac3767da876291e74

Change-Id: I4d5fa052bdc5eef1795f6507589e2eaf4e093e23
Related-Bug: #1718295
---
 tools/fixup_stuff.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f1552ab2f7..efe0125741 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,10 +84,10 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; the
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:ocata
+        sudo add-apt-repository -y cloud-archive:pike
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From e3915938f35737fc231ab7b8b9981dae9048438e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 24 Feb 2017 06:24:47 +0000
Subject: [PATCH 2078/3333] Configure bridge_mappings for ovs and linuxbridge
 agents

Otherwise neutron will fail to bind external ports because of missing
entries for external physical network in the mapping.

Configure it only when l3 agent is also installed on the node (otherwise
the l2 agent is not exposed to external network and hence doesn't have
the bridge).

Change-Id: I561b74538acb0dc39f1af3e832108ce6a99441b0
---
 lib/neutron | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index f277062b32..6da1705525 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -211,6 +211,13 @@ function configure_neutron_new {
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
+
+        # Configure the neutron agent to serve external network ports
+        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF linux_bridge bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
+        else
+            iniset $NEUTRON_CORE_PLUGIN_CONF ovs bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
+        fi
     fi
 
     # Metadata

From c652a498fb6ae1cdd7480b590be0f1e843768666 Mon Sep 17 00:00:00 2001
From: yuanke wei <weiyuanke123@gmail.com>
Date: Sun, 17 Sep 2017 22:18:07 +0800
Subject: [PATCH 2079/3333] Fix partial download problem

(1) when checksum fails, better delete the broken files and try the second time;
(2) amazon s3 is not good in mainland China, better try one more time with wget

Change-Id: I24ee73f216b78bd80564863cd335e5d5a9b56360
---
 functions | 2 +-
 lib/etcd3 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 33a0e6aaf5..8b69c73bba 100644
--- a/functions
+++ b/functions
@@ -63,7 +63,7 @@ function get_extra_file {
     if [[ $file_url != file* ]]; then
         # If the file isn't cache, download it
         if [[ ! -f $FILES/$file_name ]]; then
-            wget --progress=dot:giga -c $file_url -O $FILES/$file_name
+            wget --progress=dot:giga -t 2 -c $file_url -O $FILES/$file_name
             if [[ $? -ne 0 ]]; then
                 die "$file_url could not be downloaded"
             fi
diff --git a/lib/etcd3 b/lib/etcd3
index 60e827add2..934bbb004f 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -98,8 +98,8 @@ function install_etcd3 {
     etcd_file="$(get_extra_file $ETCD_DOWNLOAD_LOCATION)"
     if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
         echo "${ETCD_SHA256} $etcd_file" > $FILES/etcd.sha256sum
-        # NOTE(sdague): this should go fatal if this fails
-        sha256sum -c $FILES/etcd.sha256sum
+        # NOTE(yuanke wei): rm the damaged file when checksum fails
+        sha256sum -c $FILES/etcd.sha256sum || (sudo rm -f $etcd_file; exit 1)
 
         tar xzvf $etcd_file -C $FILES
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd

From c4b0059c6b9818e622f9fb010719d6c92de9d91d Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 22 Sep 2017 15:07:36 -0400
Subject: [PATCH 2080/3333] Disable the v2.0 identity API by default

The v2.0 identity API is being removed in the Queens release, but in
order to do so we need to stop some v2.0 tempests tests from being
run. This commit switches the default to disable the keystone v2 api.
In a future commit after the removal of the api from keystone the bits
to deploy the v2 api will be removed.

Change-Id: I5afcba6321f496b8170be27789bee7c9ad8eacce
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0ffcb67219..e7e584b8f2 100644
--- a/stackrc
+++ b/stackrc
@@ -184,7 +184,7 @@ IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 # will to be set to ``3`` in order to make DevStack register the Identity
 # endpoint as v3. This flag is experimental and will be used as basis to
 # identify the projects which still have issues to operate with Identity v3.
-ENABLE_IDENTITY_V2=$(trueorfalse True ENABLE_IDENTITY_V2)
+ENABLE_IDENTITY_V2=$(trueorfalse False ENABLE_IDENTITY_V2)
 if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
     IDENTITY_API_VERSION=3
 fi

From 03ae3c485e497296146a102f89853fd4063a20db Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 19 Sep 2017 14:22:19 -0500
Subject: [PATCH 2081/3333] Fix comment wording nit

Change-Id: I558522121099f14d380c163a2c397b34335b03df
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 10ffc5e23c..08cdbe422b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -537,7 +537,7 @@ function exit_trap {
 
     if [[ $r -ne 0 ]]; then
         echo "Error on exit"
-        # If we error before we've installed os-testr, which will fail.
+        # If we error before we've installed os-testr, this will fail.
         if type -p generate-subunit > /dev/null; then
             generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
         fi
@@ -547,7 +547,7 @@ function exit_trap {
             $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
     else
-        # If we error before we've installed os-testr, which will fail.
+        # If we error before we've installed os-testr, this will fail.
         if type -p generate-subunit > /dev/null; then
             generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
         fi

From 66a14df49ebe99805e6a332a2c346ba3e1290a68 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 22 Sep 2017 20:51:38 -0400
Subject: [PATCH 2082/3333] doc: prefix journalctl examples with sudo

In a devstack environment you likely need to use sudo
to run the journalctl command, so this adds that to
the examples.

Change-Id: Ibe6b71285a3014e80e06a50130f18bfbdb4ff3ab
---
 doc/source/systemd.rst | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index c1d2944057..523d399c62 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -94,25 +94,25 @@ query facilities. We'll start with some common options.
 
 Follow logs for a specific service::
 
-  journalctl -f --unit devstack@n-cpu.service
+  sudo journalctl -f --unit devstack@n-cpu.service
 
 Following logs for multiple services simultaneously::
 
-  journalctl -f --unit devstack@n-cpu.service --unit devstack@n-cond.service
+  sudo journalctl -f --unit devstack@n-cpu.service --unit devstack@n-cond.service
 
 or you can even do wild cards to follow all the nova services::
 
-  journalctl -f --unit devstack@n-*
+  sudo journalctl -f --unit devstack@n-*
 
 Use higher precision time stamps::
 
-  journalctl -f -o short-precise --unit devstack@n-cpu.service
+  sudo journalctl -f -o short-precise --unit devstack@n-cpu.service
 
 By default, journalctl strips out "unprintable" characters, including
 ASCII color codes. To keep the color codes (which can be interpreted by
 an appropriate terminal/pager - e.g. ``less``, the default)::
 
-  journalctl -a --unit devstack@n-cpu.service
+  sudo journalctl -a --unit devstack@n-cpu.service
 
 When outputting to the terminal using the default pager, long lines
 appear to be truncated, but horizontal scrolling is supported via the

From 3a59c9d7e3e54f3d3d4e64cd6c42fc1572d9ca17 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 23 Sep 2017 14:37:58 +0200
Subject: [PATCH 2083/3333] Remove deprecated forbid_global_implied_dsr

This setting was only useful for Mitaka and older, however Mitaka
is now EOL.

Change-Id: Ia1eb87d68a6265d8541cb87a88523246885e5a8a
---
 lib/tempest | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index f086f9a65d..96a170839b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -293,10 +293,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
     fi
 
-    # TODO(rodrigods): This is a feature flag for bug 1590578 which is fixed in
-    # Newton and Ocata. This option can be removed after Mitaka is end of life.
-    iniset $TEMPEST_CONFIG identity-feature-enabled forbid_global_implied_dsr True
-
     # When LDAP is enabled domain specific drivers are also enabled and the users
     # and groups identity tests must adapt to this scenario
     if is_service_enabled ldap; then

From 5ef8a125cc3a8b8f461a9636001c0ad7f6f88957 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 25 Sep 2017 13:08:51 +0200
Subject: [PATCH 2084/3333] Install minimal lsb-release package on openSUSE

lsb-release is a dependency of "lsb", so it used to work
before just fine as well, but it was installing about 300MB
of "stuff" that we don't actually need..

Change-Id: I25c7c750cbaeb40bf4f2e8695608c4b1003289ea
---
 functions-common | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 1b8ca96fd4..a09f972e6e 100644
--- a/functions-common
+++ b/functions-common
@@ -319,10 +319,7 @@ function _ensure_lsb_release {
     if [[ -x $(command -v apt-get 2>/dev/null) ]]; then
         sudo apt-get install -y lsb-release
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
-        # XXX: old code paths seem to have assumed SUSE platforms also
-        # had "yum".  Keep this ordered above yum so we don't try to
-        # install the rh package.  suse calls it just "lsb"
-        sudo zypper -n install lsb
+        sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
     elif [[ -x $(command -v yum 2>/dev/null) ]]; then

From 07a8823d4f42ceb8146cf5eb8b1fffcbb4599e25 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 25 Sep 2017 11:36:20 +0000
Subject: [PATCH 2085/3333] Update default etcd version

There have been a couple of new stable releases in the meantime, update
to using v3.1.10 which is the currently latest stable version.

Change-Id: Ifa1421c9f12af9753052f992929deb7ebd45e804
---
 stackrc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index 0ffcb67219..44a42a1ed9 100644
--- a/stackrc
+++ b/stackrc
@@ -714,9 +714,9 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
-ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
-# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
+ETCD_VERSION=${ETCD_VERSION:-v3.1.10}
+ETCD_SHA256_AMD64="2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"
+# NOTE(sdague): etcd v3.1.10 doesn't have anything for these architectures, though 3.2.x does.
 ETCD_SHA256_ARM64=""
 ETCD_SHA256_PPC64=""
 ETCD_SHA256_S390X=""

From 721f7c2cd0f8c1e4dba95f5f6be7ff342b355f01 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 25 Sep 2017 13:53:10 +0200
Subject: [PATCH 2086/3333] Switch DEVSTACK_SERIES to queens

pike is handled in stable/pike branch for some time
already.

Change-Id: I47dc5bf661c50b3b05c19ad665c2671f807233ae
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0ffcb67219..4901009c09 100644
--- a/stackrc
+++ b/stackrc
@@ -246,7 +246,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="pike"
+DEVSTACK_SERIES="queens"
 
 ##############
 #

From 062829c3f600bef1187c3d8a4baca6f66327b62a Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 20 Sep 2017 22:49:44 +0200
Subject: [PATCH 2087/3333] Drop MySQL-python installation from packages

We want that one to be installed via pip, if we still use it
(by default PyMySQL is used, which is already installed via
pip as well).

Change-Id: I76454aa7f84379aa387b144686bcfaa327b141ed
---
 files/rpms/keystone       | 1 -
 files/rpms/neutron-common | 1 -
 files/rpms/nova           | 1 -
 3 files changed, 3 deletions(-)

diff --git a/files/rpms/keystone b/files/rpms/keystone
index 170308373a..5f19c6f70c 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,4 +1,3 @@
 memcached
 mod_ssl
-MySQL-python
 sqlite
diff --git a/files/rpms/neutron-common b/files/rpms/neutron-common
index a4e029a6eb..0cc8d11ceb 100644
--- a/files/rpms/neutron-common
+++ b/files/rpms/neutron-common
@@ -6,7 +6,6 @@ haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
 mysql-devel
-MySQL-python
 mysql-server # NOPRIME
 openvswitch # NOPRIME
 rabbitmq-server # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 632e796d07..64ed480632 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -12,7 +12,6 @@ kpartx
 libxml2-python
 m2crypto
 mysql-devel
-MySQL-python
 mysql-server # NOPRIME
 numpy # needed by websockify for spice console
 parted

From 32712717788d9ff373afd4ecd20b3c4f9079b260 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Fri, 22 Sep 2017 07:49:15 -0500
Subject: [PATCH 2088/3333] Change Cinder api_class setting to backend

Castellan switched the `api_class` config option to `backend` in commit
8980bf7da55dd084ad84c84534fe937f0d43b9c0. The old setting will still be
recognized for now, but we should switch to using the new, correct config
option.

Change-Id: I5e46c738531d5d56777e91a00f4cee9531356f2e
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 7a6caf345b..07f82a1580 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -243,7 +243,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
-    iniset $CINDER_CONF key_manager api_class cinder.keymgr.conf_key_mgr.ConfKeyManager
+    iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""

From 5085dc0fa50da4a78820c814005f89ab02d36d84 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 22 Sep 2017 20:54:39 -0400
Subject: [PATCH 2089/3333] doc: add journalctl example for grepping the logs

I had to dig around for awhile to figure this out, so
this adds an example on how to grep journalctl nova logs
for a server instance UUID.

Change-Id: I6a5c47fbcba3af1822e2f9efc2ac20ebe0387f3f
---
 doc/source/systemd.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 523d399c62..c9614db8a6 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -118,6 +118,11 @@ When outputting to the terminal using the default pager, long lines
 appear to be truncated, but horizontal scrolling is supported via the
 left/right arrow keys.
 
+You can pipe the output to another tool, such as ``grep``. For
+example, to find a server instance UUID in the nova logs::
+
+  sudo journalctl -a --unit devstack@n-* | grep 58391b5c-036f-44d5-bd68-21d3c26349e6
+
 See ``man 1 journalctl`` for more.
 
 Debugging

From ef5ebed6c9ca3d9d47fd2a732a1542555a0f65ba Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Mon, 25 Sep 2017 09:38:38 +1000
Subject: [PATCH 2090/3333] Remove cache dirs from the services

PKI tokens have been actively deprecated from keystone and there are
deprecations being emitted from keystonemiddleware. Because of this we
no longer need an auth cache directory in the services where the PKI
certifcates used to be stored.

Remove the creation and use of all these AUTH_CACHE directories.

Change-Id: I5680376e70e74882e9fdb87ee1b95d5f40570ad7
---
 lib/cinder         | 12 +-----------
 lib/glance         | 16 +++-------------
 lib/keystone       |  6 ++----
 lib/neutron        | 17 +++--------------
 lib/neutron-legacy |  6 ++----
 lib/nova           | 13 ++-----------
 lib/swift          |  7 +------
 7 files changed, 14 insertions(+), 63 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..387fc1ac2c 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -51,7 +51,6 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
-CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -225,9 +224,8 @@ function configure_cinder {
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_tenant_name
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_user
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
-    inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
 
-    configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
+    configure_auth_token_middleware $CINDER_CONF cinder
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -385,13 +383,6 @@ function create_cinder_accounts {
     fi
 }
 
-# create_cinder_cache_dir() - Part of the init_cinder() process
-function create_cinder_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
-    rm -f $CINDER_AUTH_CACHE_DIR/*
-}
-
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     if is_service_enabled $DATABASE_BACKENDS; then
@@ -420,7 +411,6 @@ function init_cinder {
     fi
 
     mkdir -p $CINDER_STATE_PATH/volumes
-    create_cinder_cache_dir
 }
 
 # install_cinder() - Collect source and prepare
diff --git a/lib/glance b/lib/glance
index 74734c7516..8241c5f9d7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -44,7 +44,6 @@ fi
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
-GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -98,7 +97,7 @@ function is_glance_enabled {
 function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -115,7 +114,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
+    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
@@ -127,7 +126,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
-    configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
+    configure_auth_token_middleware $GLANCE_API_CONF glance
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -279,13 +278,6 @@ function create_glance_accounts {
     fi
 }
 
-# create_glance_cache_dir() - Part of the init_glance() process
-function create_glance_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
-}
-
 # init_glance() - Initialize databases, etc.
 function init_glance {
     # Delete existing images
@@ -306,8 +298,6 @@ function init_glance {
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
     time_stop "dbsync"
-
-    create_glance_cache_dir
 }
 
 # install_glanceclient() - Collect source and prepare
diff --git a/lib/keystone b/lib/keystone
index 714f089cca..7bd887ca2d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -429,7 +429,7 @@ function create_service_user {
 
 # Configure the service to use the auth token middleware.
 #
-# configure_auth_token_middleware conf_file admin_user signing_dir [section]
+# configure_auth_token_middleware conf_file admin_user [section]
 #
 # section defaults to keystone_authtoken, which is where auth_token looks in
 # the .conf file. If the paste config file is used (api-paste.ini) then
@@ -437,8 +437,7 @@ function create_service_user {
 function configure_auth_token_middleware {
     local conf_file=$1
     local admin_user=$2
-    local signing_dir=$3
-    local section=${4:-keystone_authtoken}
+    local section=${3:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
@@ -449,7 +448,6 @@ function configure_auth_token_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers localhost:11211
 }
 
diff --git a/lib/neutron b/lib/neutron
index 21c8d4c735..359f19820d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -30,7 +30,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
@@ -44,7 +43,6 @@ NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
 NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # By default, use the ML2 plugin
 NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
@@ -175,8 +173,8 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
-        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+        configure_auth_token_middleware $NEUTRON_CONF neutron keystone_authtoken
+        configure_auth_token_middleware $NEUTRON_CONF nova nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -250,7 +248,7 @@ function configure_neutron_new {
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
+        configure_auth_token_middleware $NEUTRON_META_CONF neutron DEFAULT
     fi
 
     # Format logging
@@ -337,13 +335,6 @@ function create_neutron_accounts_new {
     fi
 }
 
-# create_neutron_cache_dir() - Part of the init_neutron() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
@@ -353,8 +344,6 @@ function init_neutron_new {
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
     time_stop "dbsync"
-
-    create_neutron_cache_dir
 }
 
 # install_neutron() - Collect source and prepare
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..a0e79bc684 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -73,7 +73,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
 if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
@@ -815,7 +814,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+    configure_auth_token_middleware $NEUTRON_CONF nova nova
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -906,8 +905,7 @@ function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
 
-    create_neutron_cache_dir
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
+    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $section
 }
 
 function _neutron_setup_interface_driver {
diff --git a/lib/nova b/lib/nova
index 1112f29bd3..dcf2a1c376 100644
--- a/lib/nova
+++ b/lib/nova
@@ -46,7 +46,6 @@ fi
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
-NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
@@ -240,7 +239,7 @@ function cleanup_nova {
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
 
-    sudo rm -rf $NOVA_STATE_PATH $NOVA_AUTH_CACHE_DIR
+    sudo rm -rf $NOVA_STATE_PATH
 
     # NOTE(dtroyer): This really should be called from here but due to the way
     #                nova abuses the _cleanup() function we're moving it
@@ -464,7 +463,7 @@ function create_nova_conf {
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
-        configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR
+        configure_auth_token_middleware $NOVA_CONF nova
     fi
 
     if is_service_enabled cinder; then
@@ -658,13 +657,6 @@ function init_nova_cells {
     fi
 }
 
-# create_nova_cache_dir() - Part of the init_nova() process
-function create_nova_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
-    rm -f $NOVA_AUTH_CACHE_DIR/*
-}
-
 function create_nova_conf_nova_network {
     local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
     iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
@@ -722,7 +714,6 @@ function init_nova {
         done
     fi
 
-    create_nova_cache_dir
     create_nova_keys_dir
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
diff --git a/lib/swift b/lib/swift
index 1601e2b1f8..ab014de909 100644
--- a/lib/swift
+++ b/lib/swift
@@ -48,7 +48,6 @@ fi
 
 
 SWIFT_DIR=$DEST/swift
-SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
 
@@ -450,7 +449,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
+    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
@@ -745,10 +744,6 @@ function init_swift {
         swift-ring-builder container.builder rebalance 42
         swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
-
-    # Create cache dir
-    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
-    rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
 function install_swift {

From 602a057fe0d0b357533feb84d87256edfb7970e2 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 26 Sep 2017 10:15:28 +0200
Subject: [PATCH 2091/3333] Fix dstat dependencies for memory_tracker on SUSE

Memory_tracker imports psutil, but does not run inside a pip/virtualenv
so the system provided psutil library needs to be provided. This
is matching what is done for other non-SUSE distributions

Change-Id: I96f944730dc8644333d906d71339351b29b03e08
---
 files/rpms-suse/dstat | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/dstat b/files/rpms-suse/dstat
index 2b643b8b1b..0d9da4434f 100644
--- a/files/rpms-suse/dstat
+++ b/files/rpms-suse/dstat
@@ -1 +1,2 @@
 dstat
+python-psutil

From ba4830b84e529943353e71f375ab6538f37efa02 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 27 Sep 2017 16:45:25 -0400
Subject: [PATCH 2092/3333] Download default image when using VIRT_DRIVER=fake

Change f119121d21fa0446197b26378091677daac1606a removed
the default image to download which meant if you were using
the fake virt driver, no image would get downloaded and
tempest setup would fail.

This adds it back in but doesn't use a wildcard.

The default image is the same as before, but uses the
variables that are also used for the default libvirt image
case.

Change-Id: I80eddd0d3a99572ed494b5cd36fed8ceb4d05d77
Closes-Bug: #1720003
---
 stackrc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/stackrc b/stackrc
index e7e584b8f2..61555173db 100644
--- a/stackrc
+++ b/stackrc
@@ -701,6 +701,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk.vhd.tgz}
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.5-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
+        fake)
+            # Use the same as the default for libvirt
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From 59251693e7e0e576b26a33633cfff5d92d0a700e Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 28 Sep 2017 11:56:40 +0000
Subject: [PATCH 2093/3333] Add a note about overriding the journalctl nowrap
 default

Hoping that this helps people who consider this as annoying as I do.

Change-Id: I45e71301efb8d9a17989b57232a142e786175c2a
---
 doc/source/systemd.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index c1d2944057..2009f7407c 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -115,8 +115,9 @@ an appropriate terminal/pager - e.g. ``less``, the default)::
   journalctl -a --unit devstack@n-cpu.service
 
 When outputting to the terminal using the default pager, long lines
-appear to be truncated, but horizontal scrolling is supported via the
-left/right arrow keys.
+will be truncated, but horizontal scrolling is supported via the
+left/right arrow keys. You can override this by setting the
+``SYSTEMD_LESS`` environment variable to e.g. ``FRXM``.
 
 See ``man 1 journalctl`` for more.
 

From 5b419ffb1f20dfe613bd694fab8c1f08c8db7cce Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 29 Sep 2017 08:42:34 +1000
Subject: [PATCH 2094/3333] Don't check_libs_from_git for now

"pip freeze" reports an error when checking because the repos don't
have a remote under zuulv3

---
Error when trying to get requirement for VCS system Command "git
config --get-regexp remote\..*\.url" failed with error code 1 in
/opt/stack/new/keystone, falling back to uneditable format

Could not determine repository location of /opt/stack/new/keystone
Complete output from command git config --get-regexp remote\..*\.url:

---

This means this check fails.  I think we can fix this by looking at
"pip list" which I will propose in a follow-on, but this fixes the
immediate breaking issue.

Depends-On: Ib12ddf768ee20fd7614622179f6842f5d57864ff
Change-Id: I21ff749ab3e7911fa074e6d53056768f42f8aa57
---
 stack.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index c545c56de3..f5aa7659f9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1389,7 +1389,11 @@ service_check
 
 # ensure that all the libraries we think we installed from git,
 # actually were.
-check_libs_from_git
+#
+# NOTE(ianw) 2017-09-27 : "pip freeze" is currently having issues
+# with zuulv3 and the way it clones remotes.  We will restore this
+# with a slightly different check soon
+#check_libs_from_git
 
 
 # Configure nova cellsv2

From ae9c6ab759d9dc1c7e72159092539444ca03cf33 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 29 Sep 2017 10:16:47 +1000
Subject: [PATCH 2095/3333] Use "pip list" in check_libs_from_git

As described in the change, "pip freeze" has issues with the way
zuulv3 clones repos without a remote.  This is an attempt to use "pip
list" to check for local install

Change-Id: I33d25f86b6afcadb4b190a0f6c53311111c64521
---
 inc/python | 15 ++++++++++++++-
 stack.sh   |  6 +-----
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/inc/python b/inc/python
index 5e7f742d48..4bc1856fbd 100644
--- a/inc/python
+++ b/inc/python
@@ -386,7 +386,20 @@ function use_library_from_git {
 # determine if a package was installed from git
 function lib_installed_from_git {
     local name=$1
-    pip freeze 2>/dev/null | grep -- "$name" | grep -q -- '-e git'
+    # Note "pip freeze" doesn't always work here, because it tries to
+    # be smart about finding the remote of the git repo the package
+    # was installed from.  This doesn't work with zuul which clones
+    # repos with no remote.
+    #
+    # The best option seems to be to use "pip list" which will tell
+    # you the path an editable install was installed from; for example
+    # in response to something like
+    #  pip install -e 'git+http://git.openstack.org/openstack-dev/bashate#egg=bashate'
+    # pip list shows
+    #  bashate (0.5.2.dev19, /tmp/env/src/bashate)
+    # Thus we look for "path after a comma" to indicate we were
+    # installed from some local place
+    pip list 2>/dev/null | grep -- "$name" | grep -q -- ', .*)$'
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed
diff --git a/stack.sh b/stack.sh
index f5aa7659f9..c545c56de3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1389,11 +1389,7 @@ service_check
 
 # ensure that all the libraries we think we installed from git,
 # actually were.
-#
-# NOTE(ianw) 2017-09-27 : "pip freeze" is currently having issues
-# with zuulv3 and the way it clones remotes.  We will restore this
-# with a slightly different check soon
-#check_libs_from_git
+check_libs_from_git
 
 
 # Configure nova cellsv2

From 1f82f43016f5e3c51560c8b7c0b9c07350731f6c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 4 Oct 2017 09:51:02 +1100
Subject: [PATCH 2096/3333] Revert "Remove cache dirs from the services"

This reverts commit ef5ebed6c9ca3d9d47fd2a732a1542555a0f65ba.

The problem here is a backwards-incompatible change to
configure_auth_token_middleware.  Plugins are still passing a
"signing_dir" which is interpreted now as the "section" argument
... this leads to an interesting red-herring issue; because "v" is a
gnu sed command for checking the version, a signing_dir of "/var/..."
(as done in most plugins) gives the weird error:

 sed: -e expression #1, char 32: expected newer version of sed

I think we'll either need a new function, or dummy arguments to get
this back in.

Change-Id: I2098d4eb2747282622cf486fa7dbf216f932f58b
---
 lib/cinder         | 12 +++++++++++-
 lib/glance         | 16 +++++++++++++---
 lib/keystone       |  6 ++++--
 lib/neutron        | 17 ++++++++++++++---
 lib/neutron-legacy |  6 ++++--
 lib/nova           | 13 +++++++++++--
 lib/swift          |  7 ++++++-
 7 files changed, 63 insertions(+), 14 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 387fc1ac2c..07f82a1580 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -51,6 +51,7 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
+CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -224,8 +225,9 @@ function configure_cinder {
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_tenant_name
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_user
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
+    inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
 
-    configure_auth_token_middleware $CINDER_CONF cinder
+    configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -383,6 +385,13 @@ function create_cinder_accounts {
     fi
 }
 
+# create_cinder_cache_dir() - Part of the init_cinder() process
+function create_cinder_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
+    rm -f $CINDER_AUTH_CACHE_DIR/*
+}
+
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     if is_service_enabled $DATABASE_BACKENDS; then
@@ -411,6 +420,7 @@ function init_cinder {
     fi
 
     mkdir -p $CINDER_STATE_PATH/volumes
+    create_cinder_cache_dir
 }
 
 # install_cinder() - Collect source and prepare
diff --git a/lib/glance b/lib/glance
index 8241c5f9d7..74734c7516 100644
--- a/lib/glance
+++ b/lib/glance
@@ -44,6 +44,7 @@ fi
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
+GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -97,7 +98,7 @@ function is_glance_enabled {
 function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -114,7 +115,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance
+    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
@@ -126,7 +127,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
-    configure_auth_token_middleware $GLANCE_API_CONF glance
+    configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -278,6 +279,13 @@ function create_glance_accounts {
     fi
 }
 
+# create_glance_cache_dir() - Part of the init_glance() process
+function create_glance_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
+    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
+}
+
 # init_glance() - Initialize databases, etc.
 function init_glance {
     # Delete existing images
@@ -298,6 +306,8 @@ function init_glance {
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
     time_stop "dbsync"
+
+    create_glance_cache_dir
 }
 
 # install_glanceclient() - Collect source and prepare
diff --git a/lib/keystone b/lib/keystone
index 7bd887ca2d..714f089cca 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -429,7 +429,7 @@ function create_service_user {
 
 # Configure the service to use the auth token middleware.
 #
-# configure_auth_token_middleware conf_file admin_user [section]
+# configure_auth_token_middleware conf_file admin_user signing_dir [section]
 #
 # section defaults to keystone_authtoken, which is where auth_token looks in
 # the .conf file. If the paste config file is used (api-paste.ini) then
@@ -437,7 +437,8 @@ function create_service_user {
 function configure_auth_token_middleware {
     local conf_file=$1
     local admin_user=$2
-    local section=${3:-keystone_authtoken}
+    local signing_dir=$3
+    local section=${4:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
@@ -448,6 +449,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
+    iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers localhost:11211
 }
 
diff --git a/lib/neutron b/lib/neutron
index 359f19820d..21c8d4c735 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -30,6 +30,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
@@ -43,6 +44,7 @@ NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
 NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # By default, use the ML2 plugin
 NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
@@ -173,8 +175,8 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_auth_token_middleware $NEUTRON_CONF neutron keystone_authtoken
-        configure_auth_token_middleware $NEUTRON_CONF nova nova
+        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
+        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -248,7 +250,7 @@ function configure_neutron_new {
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_auth_token_middleware $NEUTRON_META_CONF neutron DEFAULT
+        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
     fi
 
     # Format logging
@@ -335,6 +337,13 @@ function create_neutron_accounts_new {
     fi
 }
 
+# create_neutron_cache_dir() - Part of the init_neutron() process
+function create_neutron_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
+    rm -f $NEUTRON_AUTH_CACHE_DIR/*
+}
+
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
@@ -344,6 +353,8 @@ function init_neutron_new {
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
     time_stop "dbsync"
+
+    create_neutron_cache_dir
 }
 
 # install_neutron() - Collect source and prepare
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index a0e79bc684..0ccb17c084 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -73,6 +73,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
 if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
@@ -814,7 +815,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_auth_token_middleware $NEUTRON_CONF nova nova
+    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -905,7 +906,8 @@ function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
 
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $section
+    create_neutron_cache_dir
+    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
 }
 
 function _neutron_setup_interface_driver {
diff --git a/lib/nova b/lib/nova
index dcf2a1c376..1112f29bd3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -46,6 +46,7 @@ fi
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
+NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
@@ -239,7 +240,7 @@ function cleanup_nova {
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
 
-    sudo rm -rf $NOVA_STATE_PATH
+    sudo rm -rf $NOVA_STATE_PATH $NOVA_AUTH_CACHE_DIR
 
     # NOTE(dtroyer): This really should be called from here but due to the way
     #                nova abuses the _cleanup() function we're moving it
@@ -463,7 +464,7 @@ function create_nova_conf {
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
-        configure_auth_token_middleware $NOVA_CONF nova
+        configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR
     fi
 
     if is_service_enabled cinder; then
@@ -657,6 +658,13 @@ function init_nova_cells {
     fi
 }
 
+# create_nova_cache_dir() - Part of the init_nova() process
+function create_nova_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
+    rm -f $NOVA_AUTH_CACHE_DIR/*
+}
+
 function create_nova_conf_nova_network {
     local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
     iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
@@ -714,6 +722,7 @@ function init_nova {
         done
     fi
 
+    create_nova_cache_dir
     create_nova_keys_dir
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
diff --git a/lib/swift b/lib/swift
index ab014de909..1601e2b1f8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -48,6 +48,7 @@ fi
 
 
 SWIFT_DIR=$DEST/swift
+SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
 
@@ -449,7 +450,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift filter:authtoken
+    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
@@ -744,6 +745,10 @@ function init_swift {
         swift-ring-builder container.builder rebalance 42
         swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
+
+    # Create cache dir
+    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
+    rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
 function install_swift {

From 56131eb11fa431a13028e90f179e5444c0297f2a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 30 Sep 2017 09:55:38 -0700
Subject: [PATCH 2097/3333] Move glance auth cache creation to configure_glance

We install the glance api on all nodes in multinode testing. This has
been failing because we don't configure the glance auth cache dirs if
we only install the glance api service. This was done as part of
init_glance which is only run when installing g-reg.

Fix this by moving the auth cache dir creation step into
configure_glance which is run for the glance api.

Change-Id: Ie669827507df0f524e6e53fe4ab3dff848dd4bd7
---
 lib/glance | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/glance b/lib/glance
index 74734c7516..ad286bacb9 100644
--- a/lib/glance
+++ b/lib/glance
@@ -105,6 +105,11 @@ function cleanup_glance {
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
+    # We run this here as this configures cache dirs for the auth middleware
+    # which is used in the api server and not in the registry. The api
+    # Server is configured through this function and not init_glance.
+    create_glance_cache_dir
+
     # Copy over our glance configurations and update them
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -279,7 +284,7 @@ function create_glance_accounts {
     fi
 }
 
-# create_glance_cache_dir() - Part of the init_glance() process
+# create_glance_cache_dir() - Part of the configure_glance() process
 function create_glance_cache_dir {
     # Create cache dir
     sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
@@ -306,8 +311,6 @@ function init_glance {
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
     time_stop "dbsync"
-
-    create_glance_cache_dir
 }
 
 # install_glanceclient() - Collect source and prepare

From 9e7ead9ac2e791f70542741aa2c84e7ad828ac7a Mon Sep 17 00:00:00 2001
From: Zane Bitter <zbitter@redhat.com>
Date: Thu, 5 Oct 2017 16:51:09 -0400
Subject: [PATCH 2098/3333] Calculate package directory correctly in
 pip_install

Strip the [<extras>] string from a <package_dir>[<extras>] argument
when looking for the package directory.  Explain what the heck is
going on.

Change-Id: I79beb5c3e9e7c35c91cdd0d5a1d91532bebc4b6d
Closes-Bug: #1721638
---
 inc/python | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index 4bc1856fbd..9c810ec9b9 100644
--- a/inc/python
+++ b/inc/python
@@ -219,7 +219,8 @@ function disable_python3_package {
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
-# pip_install package [package ...]
+# Usage:
+#  pip_install pip_arguments
 function pip_install {
     local xtrace result
     xtrace=$(set +o | grep xtrace)
@@ -241,6 +242,26 @@ function pip_install {
     if [[ -z "$os_PACKAGE" ]]; then
         GetOSVersion
     fi
+
+    # Try to extract the path of the package we are installing into
+    # package_dir.  We need this to check for test-requirements.txt,
+    # at least.
+    #
+    # ${!#} expands to the last positional argument to this function.
+    # With "extras" syntax included, our arguments might be something
+    # like:
+    #  -e /path/to/fooproject[extra]
+    # Thus this magic line grabs just the path without extras
+    #
+    # Note that this makes no sense if this is a pypi (rather than
+    # local path) install; ergo you must check this path exists before
+    # use.  Also, if we had multiple or mixed installs, we would also
+    # likely break.  But for historical reasons, it's basically only
+    # the other wrapper functions in here calling this to install
+    # local packages, and they do so with single call per install.  So
+    # this works (for now...)
+    local package_dir=${!#%\[*\]}
+
     if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
         # TRACK_DEPENDS=True installation creates a circular dependency when
         # we attempt to install virtualenv into a virtualenv, so we must global
@@ -261,7 +282,6 @@ function pip_install {
                 # versions supported, and if we find the version of
                 # python3 we've been told to use, use that instead of the
                 # default pip
-                local package_dir=${!#}
                 local python_versions
 
                 # Special case some services that have experimental
@@ -323,7 +343,7 @@ function pip_install {
 
     # Also install test requirements
     local install_test_reqs=""
-    local test_req="${!#}/test-requirements.txt"
+    local test_req="${package_dir}/test-requirements.txt"
     if [[ -e "$test_req" ]]; then
         install_test_reqs="-r $test_req"
     fi

From b8335eebe88f5ebe0c1d42344ced60e55ead3c5e Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Tue, 26 Sep 2017 08:32:50 +0200
Subject: [PATCH 2099/3333] Drop support for "kvmibm" distro

The IBM hypervisor distro "KVM for IBM z Systems" gets discontiued,
like announced in March 2017 [1]. The key dates are:

* 03/2017: announcement
* 08/2017: the last day to order (EOM)
* 03/2018: the End of Service (EOL)

As the CI which tests OpenStack with KVM on IBM Z doesn't rely on this
distro anymore and EOM has reached, we remove the Devstack support for
this distro.

This basically reverts commit a5ea08b of Dec 2015.

NOTE: This doesn't affect other distros which have KVM on Z support.

References:
[1] FAQ for KVM for IBM z Systems Delivery Strategy Change
    https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=ZSQ03110USEN&

Change-Id: I009ae4779588615633bff81d0c47a1b879ec9279
---
 functions-common                   | 4 +---
 lib/nova_plugins/functions-libvirt | 5 -----
 stack.sh                           | 2 +-
 3 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index c968531fd1..c6ba99e1a1 100644
--- a/functions-common
+++ b/functions-common
@@ -385,8 +385,6 @@ function GetDistro {
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
         DISTRO="xs${os_RELEASE%.*}"
-    elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
-        DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -440,7 +438,7 @@ function is_fedora {
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
-        [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
+        [ "$os_VENDOR" = "Virtuozzo" ]
 }
 
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 8d74c77517..c8527387ab 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -72,11 +72,6 @@ function install_libvirt {
         pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
-        # On "KVM for IBM z Systems", kvm does not have its own package
-        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
-            install_package qemu-kvm
-        fi
-
         install_package libvirt libvirt-devel
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
diff --git a/stack.sh b/stack.sh
index c545c56de3..8632cf1378 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 2b97a81640df1f8d537d6cf7b291f15d8f084a18 Mon Sep 17 00:00:00 2001
From: Radoslav Gerganov <rgerganov@vmware.com>
Date: Tue, 10 Oct 2017 16:51:12 +0300
Subject: [PATCH 2100/3333] Remove references to $USE_SCREEN in comments

The USE_SCREEN variable is not used any more

Change-Id: I29ad9cdb6c8498404502d91fbc4e1299bf4a633e
---
 functions-common | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index c968531fd1..263ce264f0 100644
--- a/functions-common
+++ b/functions-common
@@ -1492,7 +1492,6 @@ function is_running {
 # If the command includes shell metachatacters (;<>*) it must be run using a shell
 # If an optional group is provided sg will be used to run the
 # command as that group.
-# Uses globals ``USE_SCREEN``
 # run_process service "command-line" [group] [user]
 function run_process {
     local service=$1
@@ -1513,7 +1512,7 @@ function run_process {
 # If a PID is available use it, kill the whole process group via TERM
 # If screen is being used kill the screen window; this will catch processes
 # that did not leave a PID behind
-# Uses globals ``SERVICE_DIR``, ``USE_SCREEN``
+# Uses globals ``SERVICE_DIR``
 # stop_process service
 function stop_process {
     local service=$1

From cda2cb557f7176c431d151b32bc44eee03f73774 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Tue, 10 Oct 2017 11:49:06 -0500
Subject: [PATCH 2101/3333] Create block-storage endpoint for cinder

block-storage is the official service type for cinder, according to the
service-types-authority.  Add it as a service in devstack, with cinder's
unversioned endpoint, to enable proper discovery.

Change-Id: I75cf7212678f7f270c3c32f0bce227dbbf6b466d
---
 lib/cinder | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..c35b89d63b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -344,8 +344,15 @@ function create_cinder_accounts {
 
         create_service_user "cinder"
 
+        # block-storage is the official service type
+        get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
         if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
+            get_or_create_endpoint \
+                "block-storage" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/"
+
             get_or_create_endpoint \
                 "volume" \
                 "$REGION_NAME" \
@@ -363,6 +370,11 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
         else
+            get_or_create_endpoint \
+                "block-storage" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/"
+
             get_or_create_endpoint \
                 "volume" \
                 "$REGION_NAME" \

From 2da019f133bb3e53ef67e33cfd269a9b6a72d27a Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Wed, 11 Oct 2017 09:57:25 -0700
Subject: [PATCH 2102/3333] Replace the deprecated nova_metadata_ip

As [1], the option nova_metadata_ip has been deprecated and
we can use nova_metadata_host instead. This patch makes devstack
do it.

[1]: http://git.openstack.org/cgit/openstack/neutron/tree/neutron/conf/agent/metadata/config.py#n49

Change-Id: Ifda43ec8c7743af6acdd3003c55c081ef5b1311c
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 21c8d4c735..c5839f5c3e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -243,7 +243,7 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
+        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $SERVICE_HOST
         iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
         # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
         configure_root_helper_options $NEUTRON_META_CONF

From 843b039b3ca24c79865d991df43bfcd5ebe0b97b Mon Sep 17 00:00:00 2001
From: jianghua wang <jianghua.wang@citrix.com>
Date: Thu, 21 Sep 2017 14:16:06 +0000
Subject: [PATCH 2103/3333] Use the renamed vnc options

As the following commit has renamed the two vnc options; let's
use the new options in devstack:
https://review.openstack.org/#/c/498387/

Change-Id: Id125666814ea9bb8a22b579aee0f6bc1c65ade80
---
 lib/nova                            | 4 ++--
 lib/nova_plugins/hypervisor-libvirt | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 1112f29bd3..ea0d2f7b89 100644
--- a/lib/nova
+++ b/lib/nova
@@ -520,8 +520,8 @@ function create_nova_conf {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
-        iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CONF vnc server_listen "$VNCSERVER_LISTEN"
+        iniset $NOVA_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 0c08a0fe42..3d676b9b8d 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -71,8 +71,8 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
         iniset $NOVA_CONF DEFAULT force_raw_images  "False"
-        iniset $NOVA_CONF vnc vncserver_proxyclient_address  $HOST_IP
-        iniset $NOVA_CONF vnc vncserver_listen $HOST_IP
+        iniset $NOVA_CONF vnc server_proxyclient_address  $HOST_IP
+        iniset $NOVA_CONF vnc server_listen $HOST_IP
         iniset $NOVA_CONF vnc keymap
     elif [[ "$NOVA_BACKEND" == "LVM" ]]; then
         iniset $NOVA_CONF libvirt images_type "lvm"

From 135ebe955e19992e54350e2ed70c5f0517c93b26 Mon Sep 17 00:00:00 2001
From: Sumit Jamgade <sjamgade@suse.com>
Date: Fri, 13 Oct 2017 15:08:27 +0200
Subject: [PATCH 2104/3333] Revert "Resolve openSUSE devstack failures"

This reverts commit d325875508e7d35d6dd62302d852e83815be2278.
the issue mentioned in the comment is now resolved.

Change-Id: I2705daead3d3b95f6ad82261212f2a1f40a77fb5
---
 tools/install_prereqs.sh | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 6189085e9e..da59093581 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -88,15 +88,6 @@ else
     export PYTHON=$(which python 2>/dev/null)
 fi
 
-if is_suse; then
-    # now reinstall cryptography from source, in order to rebuilt it against the
-    # system libssl rather than the bundled openSSL 1.1, which segfaults when combined
-    # with a system provided openSSL 1.0
-    # see https://github.com/pyca/cryptography/issues/3804 and followup issues
-    sudo pip install cryptography --no-binary :all:
-fi
-
-
 # Mark end of run
 # ---------------
 

From c0d9373e860726570b27f5c560f0fe84448598cc Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sun, 15 Oct 2017 08:26:37 +0000
Subject: [PATCH 2105/3333] Updated from generate-devstack-plugins-list

Change-Id: I474294bdbb1052f8f99522415dd0c1d26d8a995b
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6aa2e93739..5fd6697d35 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -114,6 +114,7 @@ networking-huawei                      `git://git.openstack.org/openstack/networ
 networking-hyperv                      `git://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
+networking-lagopus                     `git://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
 networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
 networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
@@ -159,6 +160,7 @@ searchlight-ui                         `git://git.openstack.org/openstack/search
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
+storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From 36ddea31a257b38aa22d3232f4c4389c851f5456 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 2 Oct 2017 10:05:17 -0500
Subject: [PATCH 2106/3333] Add devstack base job for zuul v3

This should be managed in the devstack repo, since it's a base job to
run devstack.

Change-Id: Iffe54fbccbccd68db08f79a1b51dd7f76dbff408
Depends-On: Ie2119f24360d56690ffd772b95a9ea6b98dd4a39
---
 .zuul.yaml                                    |  85 ++++++++
 playbooks/devstack.yaml                       |   3 +
 playbooks/post.yaml                           |   4 +
 playbooks/pre.yaml                            |  22 +++
 roles/configure-swap/README.rst               |  11 ++
 roles/configure-swap/defaults/main.yaml       |   1 +
 roles/configure-swap/tasks/ephemeral.yaml     | 110 +++++++++++
 roles/configure-swap/tasks/main.yaml          |  63 ++++++
 roles/configure-swap/tasks/root.yaml          |  63 ++++++
 roles/export-devstack-journal/README.rst      |  15 ++
 .../defaults/main.yaml                        |   1 +
 roles/export-devstack-journal/tasks/main.yaml |  29 +++
 roles/fetch-devstack-log-dir/README.rst       |  10 +
 .../fetch-devstack-log-dir/defaults/main.yaml |   1 +
 roles/fetch-devstack-log-dir/tasks/main.yaml  |   5 +
 roles/run-devstack/README.rst                 |   8 +
 roles/run-devstack/defaults/main.yaml         |   1 +
 roles/run-devstack/tasks/main.yaml            |   6 +
 roles/setup-devstack-cache/README.rst         |  15 ++
 roles/setup-devstack-cache/defaults/main.yaml |   2 +
 roles/setup-devstack-cache/tasks/main.yaml    |  14 ++
 roles/setup-devstack-log-dir/README.rst       |  11 ++
 .../setup-devstack-log-dir/defaults/main.yaml |   1 +
 roles/setup-devstack-log-dir/tasks/main.yaml  |   5 +
 roles/setup-devstack-source-dirs/README.rst   |  11 ++
 .../defaults/main.yaml                        |   1 +
 .../tasks/main.yaml                           |  22 +++
 roles/setup-stack-user/README.rst             |  16 ++
 roles/setup-stack-user/defaults/main.yaml     |   2 +
 roles/setup-stack-user/files/50_stack_sh      |   1 +
 roles/setup-stack-user/tasks/main.yaml        |  45 +++++
 roles/setup-tempest-user/README.rst           |  10 +
 roles/setup-tempest-user/files/51_tempest_sh  |   3 +
 roles/setup-tempest-user/tasks/main.yaml      |  20 ++
 roles/start-fresh-logging/README.rst          |  11 ++
 roles/start-fresh-logging/defaults/main.yaml  |   1 +
 roles/start-fresh-logging/tasks/main.yaml     |  56 ++++++
 roles/write-devstack-local-conf/README.rst    |  63 ++++++
 .../defaults/main.yaml                        |   2 +
 .../library/devstack_local_conf.py            | 185 ++++++++++++++++++
 .../write-devstack-local-conf/tasks/main.yaml |   9 +
 41 files changed, 944 insertions(+)
 create mode 100644 .zuul.yaml
 create mode 100644 playbooks/devstack.yaml
 create mode 100644 playbooks/post.yaml
 create mode 100644 playbooks/pre.yaml
 create mode 100644 roles/configure-swap/README.rst
 create mode 100644 roles/configure-swap/defaults/main.yaml
 create mode 100644 roles/configure-swap/tasks/ephemeral.yaml
 create mode 100644 roles/configure-swap/tasks/main.yaml
 create mode 100644 roles/configure-swap/tasks/root.yaml
 create mode 100644 roles/export-devstack-journal/README.rst
 create mode 100644 roles/export-devstack-journal/defaults/main.yaml
 create mode 100644 roles/export-devstack-journal/tasks/main.yaml
 create mode 100644 roles/fetch-devstack-log-dir/README.rst
 create mode 100644 roles/fetch-devstack-log-dir/defaults/main.yaml
 create mode 100644 roles/fetch-devstack-log-dir/tasks/main.yaml
 create mode 100644 roles/run-devstack/README.rst
 create mode 100644 roles/run-devstack/defaults/main.yaml
 create mode 100644 roles/run-devstack/tasks/main.yaml
 create mode 100644 roles/setup-devstack-cache/README.rst
 create mode 100644 roles/setup-devstack-cache/defaults/main.yaml
 create mode 100644 roles/setup-devstack-cache/tasks/main.yaml
 create mode 100644 roles/setup-devstack-log-dir/README.rst
 create mode 100644 roles/setup-devstack-log-dir/defaults/main.yaml
 create mode 100644 roles/setup-devstack-log-dir/tasks/main.yaml
 create mode 100644 roles/setup-devstack-source-dirs/README.rst
 create mode 100644 roles/setup-devstack-source-dirs/defaults/main.yaml
 create mode 100644 roles/setup-devstack-source-dirs/tasks/main.yaml
 create mode 100644 roles/setup-stack-user/README.rst
 create mode 100644 roles/setup-stack-user/defaults/main.yaml
 create mode 100644 roles/setup-stack-user/files/50_stack_sh
 create mode 100644 roles/setup-stack-user/tasks/main.yaml
 create mode 100644 roles/setup-tempest-user/README.rst
 create mode 100644 roles/setup-tempest-user/files/51_tempest_sh
 create mode 100644 roles/setup-tempest-user/tasks/main.yaml
 create mode 100644 roles/start-fresh-logging/README.rst
 create mode 100644 roles/start-fresh-logging/defaults/main.yaml
 create mode 100644 roles/start-fresh-logging/tasks/main.yaml
 create mode 100644 roles/write-devstack-local-conf/README.rst
 create mode 100644 roles/write-devstack-local-conf/defaults/main.yaml
 create mode 100644 roles/write-devstack-local-conf/library/devstack_local_conf.py
 create mode 100644 roles/write-devstack-local-conf/tasks/main.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
new file mode 100644
index 0000000000..cee195cf39
--- /dev/null
+++ b/.zuul.yaml
@@ -0,0 +1,85 @@
+- nodeset:
+    name: openstack-single-node
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: openstack-two-node
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+      - name: compute1
+        label: ubuntu-xenial
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+
+- job:
+    name: devstack
+    parent: multinode
+    description: Base devstack job
+    nodeset: openstack-single-node
+    required-projects:
+      - openstack-dev/devstack
+      - openstack/cinder
+      - openstack/glance
+      - openstack/keystone
+      - openstack/neutron
+      - openstack/nova
+      - openstack/requirements
+      - openstack/swift
+    timeout: 7200
+    vars:
+      devstack_localrc:
+        DATABASE_PASSWORD: secretdatabase
+        RABBIT_PASSWORD: secretrabbit
+        ADMIN_PASSWORD: secretadmin
+        SERVICE_PASSWORD: secretservice
+        NETWORK_GATEWAY: 10.1.0.1
+        Q_USE_DEBUG_COMMAND: True
+        FIXED_RANGE: 10.1.0.0/20
+        IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
+        FLOATING_RANGE: 172.24.5.0/24
+        PUBLIC_NETWORK_GATEWAY: 172.24.5.1
+        FLOATING_HOST_PREFIX: 172.24.4
+        FLOATING_HOST_MASK: 23
+        SWIFT_REPLICAS: 1
+        SWIFT_START_ALL_SERVICES: False
+        LOGFILE: /opt/stack/logs/devstacklog.txt
+        LOG_COLOR: False
+        VERBOSE: True
+        NETWORK_GATEWAY: 10.1.0.1
+        NOVNC_FROM_PACKAGE: True
+        ERROR_ON_CLONE: True
+        # NOTE(dims): etcd 3.x is not available in debian/ubuntu
+        # etc. As a stop gap measure, devstack uses wget to download
+        # from the location below for all the CI jobs.
+        ETCD_DOWNLOAD_URL: "http://tarballs.openstack.org/etcd/"
+      devstack_services:
+        horizon: False
+        tempest: False
+    pre-run: playbooks/pre
+    post-run: playbooks/post
+
+
+- project:
+    name: openstack-dev/devstack
+    check:
+      jobs:
+        - devstack:
+            files:
+              - ^playbooks/pre
+              - ^playbooks/post
+              - ^playbooks/devstack
+              - ^roles/
+              - .zuul.yaml
diff --git a/playbooks/devstack.yaml b/playbooks/devstack.yaml
new file mode 100644
index 0000000000..ede8382632
--- /dev/null
+++ b/playbooks/devstack.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - run-devstack
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
new file mode 100644
index 0000000000..6f5126ff16
--- /dev/null
+++ b/playbooks/post.yaml
@@ -0,0 +1,4 @@
+- hosts: all
+  roles:
+    - export-devstack-journal
+    - fetch-devstack-log-dir
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
new file mode 100644
index 0000000000..4d07960fe8
--- /dev/null
+++ b/playbooks/pre.yaml
@@ -0,0 +1,22 @@
+- hosts: all
+  roles:
+    - configure-swap
+    - setup-stack-user
+    - setup-tempest-user
+    - setup-devstack-source-dirs
+    - setup-devstack-log-dir
+    - setup-devstack-cache
+    - start-fresh-logging
+    - write-devstack-local-conf
+  # TODO(jeblair): remove when configure-mirrors is fixed  
+  tasks:
+    - name: Hack mirror_info
+      shell:
+        _raw_params: |
+          mkdir /etc/ci
+          cat << "EOF" > /etc/ci/mirror_info.sh
+          export NODEPOOL_UCA_MIRROR=http://mirror.dfw.rax.openstack.org/ubuntu-cloud-archive
+          EOF
+      args:
+        executable: /bin/bash
+      become: true
diff --git a/roles/configure-swap/README.rst b/roles/configure-swap/README.rst
new file mode 100644
index 0000000000..eaba5cf595
--- /dev/null
+++ b/roles/configure-swap/README.rst
@@ -0,0 +1,11 @@
+Configure a swap partition
+
+Creates a swap partition on the ephemeral block device (the rest of which
+will be mounted on /opt).
+
+**Role Variables**
+
+.. zuul:rolevar:: configure_swap_size
+   :default: 8192
+
+   The size of the swap partition, in MiB.
diff --git a/roles/configure-swap/defaults/main.yaml b/roles/configure-swap/defaults/main.yaml
new file mode 100644
index 0000000000..4d622321c7
--- /dev/null
+++ b/roles/configure-swap/defaults/main.yaml
@@ -0,0 +1 @@
+configure_swap_size: 8192
diff --git a/roles/configure-swap/tasks/ephemeral.yaml b/roles/configure-swap/tasks/ephemeral.yaml
new file mode 100644
index 0000000000..c2316eac2b
--- /dev/null
+++ b/roles/configure-swap/tasks/ephemeral.yaml
@@ -0,0 +1,110 @@
+# Configure attached ephemeral devices for storage and swap
+
+- assert:
+    that:
+      - "ephemeral_device is defined"
+
+- name: Set partition names
+  set_fact:
+    swap_partition: "{{ ephemeral_device}}1"
+    opt_partition: "{{ ephemeral_device}}2"
+
+- name: Ensure ephemeral device is unmounted
+  become: yes
+  mount:
+    name: "{{ ephemeral_device }}"
+    state: unmounted
+
+- name: Get existing partitions
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    unit: MiB
+  register: ephemeral_partitions
+
+- name: Remove any existing partitions
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    number: "{{ item.num }}"
+    state: absent
+  with_items:
+    - "{{ ephemeral_partitions.partitions }}"
+
+- name: Create new disk label
+  become: yes
+  parted:
+    label: msdos
+    device: "{{ ephemeral_device }}"
+
+- name: Create swap partition
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    number: 1
+    state: present
+    part_start: '0%'
+    part_end: "{{ configure_swap_size }}MiB"
+
+- name: Create opt partition
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    number: 2
+    state: present
+    part_start: "{{ configure_swap_size }}MiB"
+    part_end: "100%"
+
+- name: Make swap on partition
+  become: yes
+  command: "mkswap {{ swap_partition }}"
+
+- name: Write swap to fstab
+  become: yes
+  mount:
+    path: none
+    src: "{{ swap_partition }}"
+    fstype: swap
+    opts: sw
+    passno: 0
+    dump: 0
+    state: present
+
+# XXX: does "parted" plugin ensure the partition is available
+# before moving on?  No udev settles here ...
+
+- name: Add all swap
+  become: yes
+  command: swapon -a
+
+- name: Create /opt filesystem
+  become: yes
+  filesystem:
+    fstype: ext4
+    dev: "{{ opt_partition }}"
+
+# Rackspace at least does not have enough room for two devstack
+# installs on the primary partition.  We copy in the existing /opt to
+# the new partition on the ephemeral device, and then overmount /opt
+# to there for the test runs.
+#
+# NOTE(ianw): the existing "mount" touches fstab.  There is currently (Sep2017)
+# work in [1] to split mount & fstab into separate parts, but for now we bundle
+# it into an atomic shell command
+# [1] https://github.com/ansible/ansible/pull/27174
+- name: Copy old /opt
+  become: yes
+  shell: |
+    mount {{ opt_partition }} /mnt
+    find /opt/ -mindepth 1 -maxdepth 1 -exec mv {} /mnt/ \;
+    umount /mnt
+
+# This overmounts any existing /opt
+- name: Add opt to fstab and mount
+  become: yes
+  mount:
+    path: /opt
+    src: "{{ opt_partition }}"
+    fstype: ext4
+    opts: noatime
+    state: mounted
diff --git a/roles/configure-swap/tasks/main.yaml b/roles/configure-swap/tasks/main.yaml
new file mode 100644
index 0000000000..8960c726c8
--- /dev/null
+++ b/roles/configure-swap/tasks/main.yaml
@@ -0,0 +1,63 @@
+# On RAX hosts, we have a small root partition and a large,
+# unallocated ephemeral device attached at /dev/xvde
+- name: Set ephemeral device if /dev/xvde exists
+  when: ansible_devices["xvde"] is defined
+  set_fact:
+    ephemeral_device: "/dev/xvde"
+
+# On other providers, we have a device called "ephemeral0".
+#
+# NOTE(ianw): Once [1] is in our ansible (2.4 era?), we can figure
+# this out more directly by walking the device labels in the facts
+#
+# [1] https://github.com/ansible/ansible/commit/d46dd99f47c0ee5081d15bc5b741e9096d8bfd3e
+- name: Set ephemeral device by label
+  when: ephemeral_device is undefined
+  block:
+    - name: Get ephemeral0 device node
+      command: /sbin/blkid -L ephemeral0
+      register: ephemeral0
+      # If this doesn't exist, returns !0
+      ignore_errors: yes
+      changed_when: False
+
+    - name: Set ephemeral device if LABEL exists
+      when: "ephemeral0.rc == 0"
+      set_fact:
+        ephemeral_device: "{{ ephemeral0.stdout }}"
+
+# If we have ephemeral storage and we don't appear to have setup swap,
+# we will create a swap and move /opt to a large data partition there.
+- include: ephemeral.yaml
+  static: no
+  when:
+    - ephemeral_device is defined
+    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
+
+# If no ephemeral device and no swap, then we will setup some swap
+# space on the root device to ensure all hosts a consistent memory
+# environment.
+- include: root.yaml
+  static: no
+  when:
+    - ephemeral_device is undefined
+    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
+
+# ensure a standard level of swappiness.  Some platforms
+# (rax+centos7) come with swappiness of 0 (presumably because the
+# vm doesn't come with swap setup ... but we just did that above),
+# which depending on the kernel version can lead to the OOM killer
+# kicking in on some processes despite swap being available;
+# particularly things like mysql which have very high ratio of
+# anonymous-memory to file-backed mappings.
+#
+# This sets swappiness low; we really don't want to be relying on
+# cloud I/O based swap during our runs if we can help it
+- name: Set swappiness
+  become: yes
+  sysctl:
+    name: vm.swappiness
+    value: 30
+    state: present
+
+- debug:  var=ephemeral_device
diff --git a/roles/configure-swap/tasks/root.yaml b/roles/configure-swap/tasks/root.yaml
new file mode 100644
index 0000000000..f22b53700f
--- /dev/null
+++ b/roles/configure-swap/tasks/root.yaml
@@ -0,0 +1,63 @@
+# If no ephemeral devices are available, use root filesystem
+
+- name: Calculate required swap
+  set_fact:
+    swap_required: "{{ configure_swap_size - ansible_memory_mb['swap']['total'] | int }}"
+
+- block:
+    - name: Get root filesystem
+      shell: df --output='fstype' /root | tail -1
+      register: root_fs
+
+    - name: Save root filesystem
+      set_fact:
+        root_filesystem: "{{ root_fs.stdout }}"
+
+    - debug: var=root_filesystem
+
+# Note, we don't use a sparse device to avoid wedging when disk space
+# and memory are both unavailable.
+
+# Cannot fallocate on filesystems like XFS, so use slower dd
+- name: Create swap backing file for non-EXT fs
+  when: '"ext" not in root_filesystem'
+  become: yes
+  command: dd if=/dev/zero of=/root/swapfile bs=1M count={{ swap_required }}
+  args:
+    creates: /root/swapfile
+
+- name: Create sparse swap backing file for EXT fs
+  when: '"ext" in root_filesystem'
+  become: yes
+  command: fallocate -l {{ swap_required }}M /root/swapfile
+  args:
+    creates: /root/swapfile
+
+- name: Ensure swapfile perms
+  become: yes
+  file:
+    path: /root/swapfile
+    owner: root
+    group: root
+    mode: 0600
+
+- name: Make swapfile
+  become: yes
+  command: mkswap /root/swapfile
+
+- name: Write swap to fstab
+  become: yes
+  mount:
+    path: none
+    src: /root/swapfile
+    fstype: swap
+    opts: sw
+    passno: 0
+    dump: 0
+    state: present
+
+- name: Add all swap
+  become: yes
+  command: swapon -a
+
+- debug: var=swap_required
diff --git a/roles/export-devstack-journal/README.rst b/roles/export-devstack-journal/README.rst
new file mode 100644
index 0000000000..5f00592a03
--- /dev/null
+++ b/roles/export-devstack-journal/README.rst
@@ -0,0 +1,15 @@
+Export journal files from devstack services
+
+Export the systemd journal for every devstack service in native
+journal format as well as text.  Also, export a syslog-style file with
+kernal and sudo messages.
+
+Writes the output to the ``logs/`` subdirectory of
+``devstack_base_dir``.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/export-devstack-journal/defaults/main.yaml b/roles/export-devstack-journal/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/export-devstack-journal/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
new file mode 100644
index 0000000000..b9af02a591
--- /dev/null
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -0,0 +1,29 @@
+# TODO: convert this to ansible
+- name: Export journal files
+  become: true
+  shell:
+    cmd: |
+      u=""
+      name=""
+      for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
+        name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
+        journalctl -o short-precise --unit $u | tee {{ devstack_base_dir }}/logs/$name.txt > /dev/null
+      done
+
+      # Export the journal in export format to make it downloadable
+      # for later searching. It can then be rewritten to a journal native
+      # format locally using systemd-journal-remote. This makes a class of
+      # debugging much easier. We don't do the native conversion here as
+      # some distros do not package that tooling.
+      journalctl -u 'devstack@*' -o export | \
+          xz --threads=0 - > {{ devstack_base_dir }}/logs/devstack.journal.xz
+
+      # The journal contains everything running under systemd, we'll
+      # build an old school version of the syslog with just the
+      # kernel and sudo messages.
+      journalctl \
+          -t kernel \
+          -t sudo \
+          --no-pager \
+          --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
+        | tee {{ devstack_base_dir }}/logs/syslog.txt > /dev/null
diff --git a/roles/fetch-devstack-log-dir/README.rst b/roles/fetch-devstack-log-dir/README.rst
new file mode 100644
index 0000000000..360a2e3dd0
--- /dev/null
+++ b/roles/fetch-devstack-log-dir/README.rst
@@ -0,0 +1,10 @@
+Fetch content from the devstack log directory
+
+Copy logs from every host back to the zuul executor.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/fetch-devstack-log-dir/defaults/main.yaml b/roles/fetch-devstack-log-dir/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/fetch-devstack-log-dir/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/fetch-devstack-log-dir/tasks/main.yaml b/roles/fetch-devstack-log-dir/tasks/main.yaml
new file mode 100644
index 0000000000..5a198b21b4
--- /dev/null
+++ b/roles/fetch-devstack-log-dir/tasks/main.yaml
@@ -0,0 +1,5 @@
+- name: Collect devstack logs
+  synchronize:
+    dest: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}"
+    mode: pull
+    src: "{{ devstack_base_dir }}/logs"
diff --git a/roles/run-devstack/README.rst b/roles/run-devstack/README.rst
new file mode 100644
index 0000000000..d77eb15e99
--- /dev/null
+++ b/roles/run-devstack/README.rst
@@ -0,0 +1,8 @@
+Run devstack
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/run-devstack/defaults/main.yaml b/roles/run-devstack/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/run-devstack/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
new file mode 100644
index 0000000000..bafebafd65
--- /dev/null
+++ b/roles/run-devstack/tasks/main.yaml
@@ -0,0 +1,6 @@
+- name: Run devstack
+  command: ./stack.sh
+  args:
+    chdir: "{{devstack_base_dir}}/devstack"
+  become: true
+  become_user: stack
diff --git a/roles/setup-devstack-cache/README.rst b/roles/setup-devstack-cache/README.rst
new file mode 100644
index 0000000000..b8938c3dea
--- /dev/null
+++ b/roles/setup-devstack-cache/README.rst
@@ -0,0 +1,15 @@
+Set up the devstack cache directory
+
+If the node has a cache of devstack image files, copy it into place.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: devstack_cache_dir
+   :default: /opt/cache
+
+   The directory with the cached files.
diff --git a/roles/setup-devstack-cache/defaults/main.yaml b/roles/setup-devstack-cache/defaults/main.yaml
new file mode 100644
index 0000000000..c56720b4f5
--- /dev/null
+++ b/roles/setup-devstack-cache/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+devstack_cache_dir: /opt/cache
diff --git a/roles/setup-devstack-cache/tasks/main.yaml b/roles/setup-devstack-cache/tasks/main.yaml
new file mode 100644
index 0000000000..84f33f0e16
--- /dev/null
+++ b/roles/setup-devstack-cache/tasks/main.yaml
@@ -0,0 +1,14 @@
+- name: Copy cached devstack files
+  # This uses hard links to avoid using extra space.
+  command: "find {{ devstack_cache_dir }}/files -mindepth 1 -maxdepth 1 -exec cp -l {} {{ devstack_base_dir }}/devstack/files/ ;"
+  become: true
+
+- name: Set ownership of cached files
+  file:
+    path: '{{ devstack_base_dir }}/devstack/files'
+    state: directory
+    recurse: true
+    owner: stack
+    group: stack
+    mode: a+r
+  become: yes
diff --git a/roles/setup-devstack-log-dir/README.rst b/roles/setup-devstack-log-dir/README.rst
new file mode 100644
index 0000000000..9d8dba3442
--- /dev/null
+++ b/roles/setup-devstack-log-dir/README.rst
@@ -0,0 +1,11 @@
+Set up the devstack log directory
+
+Create a log directory on the ephemeral disk partition to save space
+on the root device.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/setup-devstack-log-dir/defaults/main.yaml b/roles/setup-devstack-log-dir/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/setup-devstack-log-dir/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/setup-devstack-log-dir/tasks/main.yaml b/roles/setup-devstack-log-dir/tasks/main.yaml
new file mode 100644
index 0000000000..b9f38dfacb
--- /dev/null
+++ b/roles/setup-devstack-log-dir/tasks/main.yaml
@@ -0,0 +1,5 @@
+- name: Create logs directory
+  file:
+    path: '{{ devstack_base_dir }}/logs'
+    state: directory
+  become: yes
diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
new file mode 100644
index 0000000000..4ebf8399c2
--- /dev/null
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -0,0 +1,11 @@
+Set up the devstack source directories
+
+Ensure that the base directory exists, and then move the source repos
+into it.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/setup-devstack-source-dirs/defaults/main.yaml b/roles/setup-devstack-source-dirs/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/setup-devstack-source-dirs/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
new file mode 100644
index 0000000000..e6bbae23b7
--- /dev/null
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -0,0 +1,22 @@
+- name: Find all source repos used by this job
+  find:
+    paths:
+      - src/git.openstack.org/openstack
+      - src/git.openstack.org/openstack-dev
+      - src/git.openstack.org/openstack-infra
+    file_type: directory
+  register: found_repos
+
+- name: Copy Zuul repos into devstack working directory
+  command: rsync -a {{ item.path }} {{ devstack_base_dir }}
+  with_items: '{{ found_repos.files }}'
+  become: yes
+
+- name: Set ownership of repos
+  file:
+    path: '{{ devstack_base_dir }}'
+    state: directory
+    recurse: true
+    owner: stack
+    group: stack
+  become: yes
diff --git a/roles/setup-stack-user/README.rst b/roles/setup-stack-user/README.rst
new file mode 100644
index 0000000000..80c4d39eff
--- /dev/null
+++ b/roles/setup-stack-user/README.rst
@@ -0,0 +1,16 @@
+Set up the `stack` user
+
+Create the stack user, set up its home directory, and allow it to
+sudo.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: devstack_stack_home_dir
+   :default: {{ devstack_base_dir }}
+
+   The home directory for the stack user.
diff --git a/roles/setup-stack-user/defaults/main.yaml b/roles/setup-stack-user/defaults/main.yaml
new file mode 100644
index 0000000000..6d0be666d4
--- /dev/null
+++ b/roles/setup-stack-user/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+devstack_stack_home_dir: '{{ devstack_base_dir }}'
diff --git a/roles/setup-stack-user/files/50_stack_sh b/roles/setup-stack-user/files/50_stack_sh
new file mode 100644
index 0000000000..4c6b46bdb1
--- /dev/null
+++ b/roles/setup-stack-user/files/50_stack_sh
@@ -0,0 +1 @@
+stack ALL=(root) NOPASSWD:ALL
diff --git a/roles/setup-stack-user/tasks/main.yaml b/roles/setup-stack-user/tasks/main.yaml
new file mode 100644
index 0000000000..8384515ebe
--- /dev/null
+++ b/roles/setup-stack-user/tasks/main.yaml
@@ -0,0 +1,45 @@
+- name: Create stack group
+  group:
+    name: stack
+  become: yes
+
+# NOTE(andreaf) Create a user home_dir is not safe via
+# the user module since it will fail if the containing
+# folder does not exists. If the folder does exists and
+# it's empty, the skeleton is setup and ownership set.
+- name: Create the stack user home folder
+  file:
+    path: '{{ devstack_stack_home_dir }}'
+    state: directory
+  become: yes
+
+- name: Create stack user
+  user:
+    name: stack
+    shell: /bin/bash
+    home: '{{ devstack_stack_home_dir }}'
+    group: stack
+  become: yes
+
+- name: Set stack user home directory permissions
+  file:
+    path: '{{ devstack_stack_home_dir }}'
+    mode: 0755
+  become: yes
+
+- name: Copy 50_stack_sh file to /etc/sudoers.d
+  copy:
+    src: 50_stack_sh
+    dest: /etc/sudoers.d
+    mode: 0440
+    owner: root
+    group: root
+  become: yes
+
+- name: Create new/.cache folder within BASE
+  file:
+    path: '{{ devstack_stack_home_dir }}/.cache'
+    state: directory
+    owner: stack
+    group: stack
+  become: yes
diff --git a/roles/setup-tempest-user/README.rst b/roles/setup-tempest-user/README.rst
new file mode 100644
index 0000000000..bb29c50a28
--- /dev/null
+++ b/roles/setup-tempest-user/README.rst
@@ -0,0 +1,10 @@
+Set up the `tempest` user
+
+Create the tempest user and allow it to sudo.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/setup-tempest-user/files/51_tempest_sh b/roles/setup-tempest-user/files/51_tempest_sh
new file mode 100644
index 0000000000..f88ff9f4f2
--- /dev/null
+++ b/roles/setup-tempest-user/files/51_tempest_sh
@@ -0,0 +1,3 @@
+tempest ALL=(root) NOPASSWD:/sbin/ip
+tempest ALL=(root) NOPASSWD:/sbin/iptables
+tempest ALL=(root) NOPASSWD:/usr/bin/ovsdb-client
diff --git a/roles/setup-tempest-user/tasks/main.yaml b/roles/setup-tempest-user/tasks/main.yaml
new file mode 100644
index 0000000000..892eaf655a
--- /dev/null
+++ b/roles/setup-tempest-user/tasks/main.yaml
@@ -0,0 +1,20 @@
+- name: Create tempest group
+  group:
+    name: tempest
+  become: yes
+
+- name: Create tempest user
+  user:
+    name: tempest
+    shell: /bin/bash
+    group: tempest
+  become: yes
+
+- name: Copy 51_tempest_sh to /etc/sudoers.d
+  copy:
+    src: 51_tempest_sh
+    dest: /etc/sudoers.d
+    owner: root
+    group: root
+    mode: 0440
+  become: yes
diff --git a/roles/start-fresh-logging/README.rst b/roles/start-fresh-logging/README.rst
new file mode 100644
index 0000000000..11b029e182
--- /dev/null
+++ b/roles/start-fresh-logging/README.rst
@@ -0,0 +1,11 @@
+Restart logging on all hosts
+
+Restart syslog so that the system logs only include output from the
+job.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/start-fresh-logging/defaults/main.yaml b/roles/start-fresh-logging/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/start-fresh-logging/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/start-fresh-logging/tasks/main.yaml b/roles/start-fresh-logging/tasks/main.yaml
new file mode 100644
index 0000000000..6c7ba66de7
--- /dev/null
+++ b/roles/start-fresh-logging/tasks/main.yaml
@@ -0,0 +1,56 @@
+- name: Check for /bin/journalctl file
+  command: which journalctl
+  changed_when: False
+  failed_when: False
+  register: which_out
+
+- block:
+    - name: Get current date
+      command: date +"%Y-%m-%d %H:%M:%S"
+      register: date_out
+
+    - name: Copy current date to log-start-timestamp.txt
+      copy:
+        dest: "{{ devstack_base_dir }}/log-start-timestamp.txt"
+        content: "{{ date_out.stdout }}"
+  when: which_out.rc == 0
+  become: yes
+
+- block:
+    - name: Stop rsyslog
+      service: name=rsyslog state=stopped
+
+    - name: Save syslog file prior to devstack run
+      command: mv /var/log/syslog /var/log/syslog-pre-devstack
+
+    - name: Save kern.log file prior to devstack run
+      command: mv /var/log/kern.log /var/log/kern_log-pre-devstack
+
+    - name: Recreate syslog file
+      file: name=/var/log/syslog state=touch
+
+    - name: Recreate syslog file owner and group
+      command: chown /var/log/syslog --ref /var/log/syslog-pre-devstack
+
+    - name: Recreate syslog file permissions
+      command: chmod /var/log/syslog --ref /var/log/syslog-pre-devstack
+
+    - name: Add read permissions to all on syslog file
+      file: name=/var/log/syslog mode=a+r
+
+    - name: Recreate kern.log file
+      file: name=/var/log/kern.log state=touch
+
+    - name: Recreate kern.log file owner and group
+      command: chown /var/log/kern.log --ref /var/log/kern_log-pre-devstack
+
+    - name: Recreate kern.log file permissions
+      command: chmod /var/log/kern.log --ref /var/log/kern_log-pre-devstack
+
+    - name: Add read permissions to all on kern.log file
+      file: name=/var/log/kern.log mode=a+r
+
+    - name: Start rsyslog
+      service: name=rsyslog state=started
+  when: which_out.rc == 1
+  become: yes
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
new file mode 100644
index 0000000000..e30dfa1e9f
--- /dev/null
+++ b/roles/write-devstack-local-conf/README.rst
@@ -0,0 +1,63 @@
+Write the local.conf file for use by devstack
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: devstack_local_conf_path
+   :default: {{ devstack_base_dir }}/devstack/local.conf
+
+   The path of the local.conf file.
+
+.. zuul:rolevar:: devstack_localrc
+   :type: dict
+
+   A dictionary of variables that should be written to the localrc
+   section of local.conf.  The values (which are strings) may contain
+   bash shell variables, and will be ordered so that variables used by
+   later entries appear first.
+
+.. zuul:rolevar:: devstack_local_conf
+   :type: dict
+
+   A complex argument consisting of nested dictionaries which combine
+   to form the meta-sections of the local_conf file.  The top level is
+   a dictionary of phases, followed by dictionaries of filenames, then
+   sections, which finally contain key-value pairs for the INI file
+   entries in those sections.
+
+   The keys in this dictionary are the devstack phases.
+
+   .. zuul:rolevar:: [phase]
+      :type: dict
+
+      The keys in this dictionary are the filenames for this phase.
+
+      .. zuul:rolevar:: [filename]
+         :type: dict
+
+         The keys in this dictionary are the INI sections in this file.
+
+         .. zuul:rolevar:: [section]
+            :type: dict
+
+            This is a dictionary of key-value pairs which comprise
+            this section of the INI file.
+
+.. zuul:rolevar:: devstack_services
+   :type: dict
+
+   A dictionary mapping service names to boolean values.  If the
+   boolean value is ``false``, a ``disable_service`` line will be
+   emitted for the service name.  If it is ``true``, then
+   ``enable_service`` will be emitted.  All other values are ignored.
+
+.. zuul:rolevar:: devstack_plugins
+   :type: dict
+
+   A dictionary mapping a plugin name to a git repo location.  If the
+   location is a non-empty string, then an ``enable_plugin`` line will
+   be emmitted for the plugin name.
diff --git a/roles/write-devstack-local-conf/defaults/main.yaml b/roles/write-devstack-local-conf/defaults/main.yaml
new file mode 100644
index 0000000000..491fa0fdb9
--- /dev/null
+++ b/roles/write-devstack-local-conf/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+devstack_local_conf_path: "{{ devstack_base_dir }}/devstack/local.conf"
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
new file mode 100644
index 0000000000..4134beb048
--- /dev/null
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -0,0 +1,185 @@
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+#
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import re
+
+
+class VarGraph(object):
+    # This is based on the JobGraph from Zuul.
+
+    def __init__(self, vars):
+        self.vars = {}
+        self._varnames = set()
+        self._dependencies = {}  # dependent_var_name -> set(parent_var_names)
+        for k, v in vars.items():
+            self._varnames.add(k)
+        for k, v in vars.items():
+            self._addVar(k, str(v))
+
+    bash_var_re = re.compile(r'\$\{?(\w+)')
+    def getDependencies(self, value):
+        return self.bash_var_re.findall(value)
+
+    def _addVar(self, key, value):
+        if key in self.vars:
+            raise Exception("Variable {} already added".format(key))
+        self.vars[key] = value
+        # Append the dependency information
+        self._dependencies.setdefault(key, set())
+        try:
+            for dependency in self.getDependencies(value):
+                if dependency == key:
+                    # A variable is allowed to reference itself; no
+                    # dependency link needed in that case.
+                    continue
+                if dependency not in self._varnames:
+                    # It's not necessary to create a link for an
+                    # external variable.
+                    continue
+                # Make sure a circular dependency is never created
+                ancestor_vars = self._getParentVarNamesRecursively(
+                    dependency, soft=True)
+                ancestor_vars.add(dependency)
+                if any((key == anc_var) for anc_var in ancestor_vars):
+                    raise Exception("Dependency cycle detected in var {}".
+                                    format(key))
+                self._dependencies[key].add(dependency)
+        except Exception:
+            del self.vars[key]
+            del self._dependencies[key]
+            raise
+
+    def getVars(self):
+        ret = []
+        keys = sorted(self.vars.keys())
+        seen = set()
+        for key in keys:
+            dependencies = self.getDependentVarsRecursively(key)
+            for var in dependencies + [key]:
+                if var not in seen:
+                    ret.append((var, self.vars[var]))
+                    seen.add(var)
+        return ret
+
+    def getDependentVarsRecursively(self, parent_var):
+        dependent_vars = []
+
+        current_dependent_vars = self._dependencies[parent_var]
+        for current_var in current_dependent_vars:
+            if current_var not in dependent_vars:
+                dependent_vars.append(current_var)
+            for dep in self.getDependentVarsRecursively(current_var):
+                if dep not in dependent_vars:
+                    dependent_vars.append(dep)
+        return dependent_vars
+
+    def _getParentVarNamesRecursively(self, dependent_var, soft=False):
+        all_parent_vars = set()
+        vars_to_iterate = set([dependent_var])
+        while len(vars_to_iterate) > 0:
+            current_var = vars_to_iterate.pop()
+            current_parent_vars = self._dependencies.get(current_var)
+            if current_parent_vars is None:
+                if soft:
+                    current_parent_vars = set()
+                else:
+                    raise Exception("Dependent var {} not found: ".format(
+                                    dependent_var))
+            new_parent_vars = current_parent_vars - all_parent_vars
+            vars_to_iterate |= new_parent_vars
+            all_parent_vars |= new_parent_vars
+        return all_parent_vars
+
+
+class LocalConf(object):
+
+    def __init__(self, localrc, localconf, services, plugins):
+        self.localrc = []
+        self.meta_sections = {}
+        if plugins:
+            self.handle_plugins(plugins)
+        if services:
+            self.handle_services(services)
+        if localrc:
+            self.handle_localrc(localrc)
+        if localconf:
+            self.handle_localconf(localconf)
+
+    def handle_plugins(self, plugins):
+        for k, v in plugins.items():
+            if v:
+                self.localrc.append('enable_plugin {} {}'.format(k, v))
+
+    def handle_services(self, services):
+        for k, v in services.items():
+            if v is False:
+                self.localrc.append('disable_service {}'.format(k))
+            elif v is True:
+                self.localrc.append('enable_service {}'.format(k))
+
+    def handle_localrc(self, localrc):
+        vg = VarGraph(localrc)
+        for k, v in vg.getVars():
+            self.localrc.append('{}={}'.format(k, v))
+
+    def handle_localconf(self, localconf):
+        for phase, phase_data in localconf.items():
+            for fn, fn_data in phase_data.items():
+                ms_name = '[[{}|{}]]'.format(phase, fn)
+                ms_data = []
+                for section, section_data in fn_data.items():
+                    ms_data.append('[{}]'.format(section))
+                    for k, v in section_data.items():
+                        ms_data.append('{} = {}'.format(k, v))
+                    ms_data.append('')
+                self.meta_sections[ms_name] = ms_data
+
+    def write(self, path):
+        with open(path, 'w') as f:
+            f.write('[[local|localrc]]\n')
+            f.write('\n'.join(self.localrc))
+            f.write('\n\n')
+            for section, lines in self.meta_sections.items():
+                f.write('{}\n'.format(section))
+                f.write('\n'.join(lines))
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            plugins=dict(type='dict'),
+            services=dict(type='dict'),
+            localrc=dict(type='dict'),
+            local_conf=dict(type='dict'),
+            path=dict(type='str'),
+        )
+    )
+
+    p = module.params
+    lc = LocalConf(p.get('localrc'),
+                   p.get('local_conf'),
+                   p.get('services'),
+                   p.get('plugins'))
+    lc.write(p['path'])
+
+    module.exit_json()
+
+
+from ansible.module_utils.basic import *  # noqa
+from ansible.module_utils.basic import AnsibleModule
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
new file mode 100644
index 0000000000..1d67616dd4
--- /dev/null
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -0,0 +1,9 @@
+- name: Write a job-specific local_conf file
+  become: true
+  become_user: stack
+  devstack_local_conf:
+    path: "{{ devstack_local_conf_path }}"
+    plugins: "{{ devstack_plugins|default(omit) }}"
+    services: "{{ devstack_services|default(omit) }}"
+    localrc: "{{ devstack_localrc|default(omit) }}"
+    local_conf: "{{ devstack_local_conf|default(omit) }}"

From 9640d3bfbf55e74560677f9a13c241303666543a Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Sun, 15 Oct 2017 16:23:57 -0700
Subject: [PATCH 2107/3333] Zuul: remove file matcher for devstack job

The file matcher was from the early versions of this when we were
running both v2 and v3.  We should always run the new devstack
job on all changes to devstack now that v3 is in production and we
plan on building jobs off of this one.

Change-Id: I7dd336b0059043f6653bdfdcba0ee5cded3e67b1
---
 .zuul.yaml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cee195cf39..bb7239abae 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -76,10 +76,4 @@
     name: openstack-dev/devstack
     check:
       jobs:
-        - devstack:
-            files:
-              - ^playbooks/pre
-              - ^playbooks/post
-              - ^playbooks/devstack
-              - ^roles/
-              - .zuul.yaml
+        - devstack

From 6839d42819c8349d8f1e72a58037198c97baca06 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Tue, 17 Oct 2017 12:58:18 +0900
Subject: [PATCH 2108/3333] neutron-legacy: Remove no longer necessary vpnaas
 conditional

VPNaaS agent is going to be an L3 agent extention.

Related-Bug: #1692128
Depends-On: I0b86c432e4b2210e5f2a73a7e3ba16d10467f0f2
Change-Id: Id827274b7c74cdf71db6d1f2ab3eadb5fef099f5
---
 lib/neutron-legacy | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..e2e0bb92a9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -503,11 +503,7 @@ function start_mutnauq_l2_agent {
 function start_mutnauq_other_agents {
     run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
 
-    if is_service_enabled neutron-vpnaas; then
-        :  # Started by plugin
-    else
-        run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
-    fi
+    run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"

From 2c2ca80ce0caadc9efa18c9f9289f6b98b3c486e Mon Sep 17 00:00:00 2001
From: Jan Zerebecki <jan.openstack@zerebecki.de>
Date: Tue, 17 Oct 2017 18:27:47 +0200
Subject: [PATCH 2109/3333] Fix libvirt daemon name condition

This makes the condition that chooses which daemon name libvirt to call
the same as for choosing the livirt package names.

Without this fix the condition checking for a directory is incorrect
when livirt is not yet installed, but is used before installing the
packages.

Change-Id: Ib5eb12769128527a6f4b3b5f7674bd2dad0ed160
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 8d74c77517..dd299761e4 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -25,7 +25,7 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
 
 # Only Xenial is left with libvirt-bin.  Everywhere else is libvirtd
-if is_ubuntu && [ ! -f /etc/init.d/libvirtd ]; then
+if is_ubuntu && [ ${DISTRO} == "xenial" ]; then
     LIBVIRT_DAEMON=libvirt-bin
 else
     LIBVIRT_DAEMON=libvirtd

From 7b8f1e7964cec6ec9b69c7a40136aedcb888ebc2 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Mon, 16 Oct 2017 19:10:09 +0000
Subject: [PATCH 2110/3333] Set default disk driver to virtio-blk on Power

Reason is to be identical to the upstream KVM CI. Some Tempest
tests rely on vdX virtio-blk device naming. Others simply create
their own with a brand new image. Also, the scsi support on the
CirrOS image is limited, tests booting from volume fail.

Change-Id: I389147a58042aa6098a695e6dd32f3e697fbbbab
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 8b69c73bba..20b83b3cd0 100644
--- a/functions
+++ b/functions
@@ -364,7 +364,7 @@ function upload_image {
     esac
 
     if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
-        img_property="--property hw_disk_bus=scsi --property hw_scsi_model=virtio-scsi --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
+        img_property="--property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then

From f0cd9a8b08d92524fc8e2c3f05d08cdebc638e2a Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 6 Oct 2017 13:11:48 -0500
Subject: [PATCH 2111/3333] Update lib_install_from_git to use column format

The pip list command supports a --format=columns option which outputs
things in space delimited columns. Switch to using that.

Change-Id: I5140a7d83bf567b1c3c67516112eb4c57074fa53
---
 inc/python | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/inc/python b/inc/python
index 9c810ec9b9..686efd40cf 100644
--- a/inc/python
+++ b/inc/python
@@ -415,11 +415,11 @@ function lib_installed_from_git {
     # you the path an editable install was installed from; for example
     # in response to something like
     #  pip install -e 'git+http://git.openstack.org/openstack-dev/bashate#egg=bashate'
-    # pip list shows
-    #  bashate (0.5.2.dev19, /tmp/env/src/bashate)
-    # Thus we look for "path after a comma" to indicate we were
-    # installed from some local place
-    pip list 2>/dev/null | grep -- "$name" | grep -q -- ', .*)$'
+    # pip list --format columns shows
+    #  bashate 0.5.2.dev19 /tmp/env/src/bashate
+    # Thus we check the third column to see if we're installed from
+    # some local place.
+    [[ -z $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed

From e9870eb18d19dbb807d4d312cf4aead23c6f8f40 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 10 Nov 2016 13:03:32 +0000
Subject: [PATCH 2112/3333] nova: add support for TLS between novnc proxy &
 compute nodes

Nova is gaining the ability to run TLS over the connection between the
novnc proxy service and the QEMU/KVM compute node VNC server.

This adds a new config param - 'NOVA_CONSOLE_PROXY_COMPUTE_TLS=True' -
which instructs devstack to configure libvirt/QEMU to enable TLS for the
VNC server, and to configure the novncproxy to use TLS when connecting.
NB this use of TLS is distinct from use of TLS for the public facing API
controlled by USE_SSL, they can be enabled independently.

This is done in a generic manner so that it is easy to extend to cover
use of TLS with the SPICE and serial console proxy services too.

Change-Id: Ib29d3f5f18533115b9c51e27b373e92fc0a28d1a
Depends-on: I9cc9a380500715e60bd05aa5c29ee46bc6f8d6c2
Implements bp: websocket-proxy-to-host-security
---
 lib/nova                           | 22 ++++++++++++++++++++++
 lib/nova_plugins/functions-libvirt | 12 ++++++++++++
 lib/tls                            | 18 ++++++++++++++++++
 3 files changed, 52 insertions(+)

diff --git a/lib/nova b/lib/nova
index ea0d2f7b89..c48aba625f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -82,6 +82,10 @@ if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
 fi
 
+# Whether to use TLS for comms between the VNC/SPICE/serial proxy
+# services and the compute node
+NOVA_CONSOLE_PROXY_COMPUTE_TLS=${NOVA_CONSOLE_PROXY_COMPUTE_TLS:-False}
+
 # Public facing bits
 NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
@@ -197,6 +201,13 @@ function is_n-cell_enabled {
     return 1
 }
 
+# is_nova_console_proxy_compute_tls_enabled() - Test if the Nova Console Proxy
+# service has TLS enabled
+function is_nova_console_proxy_compute_tls_enabled {
+    [[ ${NOVA_CONSOLE_PROXY_COMPUTE_TLS} = "True" ]] && return 0
+    return 1
+}
+
 # Helper to clean iptables rules
 function clean_iptables {
     # Delete rules
@@ -524,6 +535,17 @@ function create_nova_conf {
         iniset $NOVA_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+
+        if is_nova_console_proxy_compute_tls_enabled ; then
+            iniset $NOVA_CONF vnc auth_schemes "vencrypt"
+            iniset $NOVA_CONF vnc vencrypt_client_key "/etc/pki/nova-novnc/client-key.pem"
+            iniset $NOVA_CONF vnc vencrypt_client_cert "/etc/pki/nova-novnc/client-cert.pem"
+            iniset $NOVA_CONF vnc vencrypt_ca_certs "/etc/pki/nova-novnc/ca-cert.pem"
+
+            sudo mkdir -p /etc/pki/nova-novnc
+            deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
+            deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
+        fi
     else
         iniset $NOVA_CONF vnc enabled false
     fi
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 8d74c77517..85b2689c59 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -147,6 +147,18 @@ EOF
         fi
     fi
 
+    if is_nova_console_proxy_compute_tls_enabled ; then
+        if is_service_enabled n-novnc ; then
+            echo "vnc_tls = 1" | sudo tee -a $QEMU_CONF
+            echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
+
+            sudo mkdir -p /etc/pki/libvirt-vnc
+            sudo chown libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
+            deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
+            deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
+        fi
+    fi
+
     # Service needs to be started on redhat/fedora -- do a restart for
     # sanity after fiddling the config.
     restart_service $LIBVIRT_DAEMON
diff --git a/lib/tls b/lib/tls
index 0baf86caa9..bd9272cc18 100644
--- a/lib/tls
+++ b/lib/tls
@@ -340,6 +340,24 @@ function make_root_CA {
     fi
 }
 
+# Deploy the service cert & key to a service specific
+# location
+function deploy_int_cert {
+    local cert_target_file=$1
+    local key_target_file=$2
+
+    sudo cp "$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt" "$cert_target_file"
+    sudo cp "$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key" "$key_target_file"
+}
+
+# Deploy the intermediate CA cert bundle file to a service
+# specific location
+function deploy_int_CA {
+    local ca_target_file=$1
+
+    sudo cp "$INT_CA_DIR/ca-chain.pem" "$ca_target_file"
+}
+
 # If a non-system python-requests is installed then it will use the
 # built-in CA certificate store rather than the distro-specific
 # CA certificate store. Detect this and symlink to the correct

From d8753b7dc997b5b5558ae4bbe3e14ffd0209666b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Oct 2017 14:21:33 +1100
Subject: [PATCH 2113/3333] Use configure-swap from o-z-j

Use the generic role

Change-Id: I534ed0256b7dfe5bef4ab13ae57cd73c51e8bd15
Depends-On: I0e9c846ace7fac8a1340746c6818fba6ec963018
---
 .zuul.yaml                                |   2 +
 roles/configure-swap/README.rst           |  11 ---
 roles/configure-swap/defaults/main.yaml   |   1 -
 roles/configure-swap/tasks/ephemeral.yaml | 110 ----------------------
 roles/configure-swap/tasks/main.yaml      |  63 -------------
 roles/configure-swap/tasks/root.yaml      |  63 -------------
 6 files changed, 2 insertions(+), 248 deletions(-)
 delete mode 100644 roles/configure-swap/README.rst
 delete mode 100644 roles/configure-swap/defaults/main.yaml
 delete mode 100644 roles/configure-swap/tasks/ephemeral.yaml
 delete mode 100644 roles/configure-swap/tasks/main.yaml
 delete mode 100644 roles/configure-swap/tasks/root.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index bb7239abae..8d3b2f4e6d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,6 +38,8 @@
       - openstack/nova
       - openstack/requirements
       - openstack/swift
+    roles:
+      - zuul: openstack-infra/openstack-zuul-jobs
     timeout: 7200
     vars:
       devstack_localrc:
diff --git a/roles/configure-swap/README.rst b/roles/configure-swap/README.rst
deleted file mode 100644
index eaba5cf595..0000000000
--- a/roles/configure-swap/README.rst
+++ /dev/null
@@ -1,11 +0,0 @@
-Configure a swap partition
-
-Creates a swap partition on the ephemeral block device (the rest of which
-will be mounted on /opt).
-
-**Role Variables**
-
-.. zuul:rolevar:: configure_swap_size
-   :default: 8192
-
-   The size of the swap partition, in MiB.
diff --git a/roles/configure-swap/defaults/main.yaml b/roles/configure-swap/defaults/main.yaml
deleted file mode 100644
index 4d622321c7..0000000000
--- a/roles/configure-swap/defaults/main.yaml
+++ /dev/null
@@ -1 +0,0 @@
-configure_swap_size: 8192
diff --git a/roles/configure-swap/tasks/ephemeral.yaml b/roles/configure-swap/tasks/ephemeral.yaml
deleted file mode 100644
index c2316eac2b..0000000000
--- a/roles/configure-swap/tasks/ephemeral.yaml
+++ /dev/null
@@ -1,110 +0,0 @@
-# Configure attached ephemeral devices for storage and swap
-
-- assert:
-    that:
-      - "ephemeral_device is defined"
-
-- name: Set partition names
-  set_fact:
-    swap_partition: "{{ ephemeral_device}}1"
-    opt_partition: "{{ ephemeral_device}}2"
-
-- name: Ensure ephemeral device is unmounted
-  become: yes
-  mount:
-    name: "{{ ephemeral_device }}"
-    state: unmounted
-
-- name: Get existing partitions
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    unit: MiB
-  register: ephemeral_partitions
-
-- name: Remove any existing partitions
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    number: "{{ item.num }}"
-    state: absent
-  with_items:
-    - "{{ ephemeral_partitions.partitions }}"
-
-- name: Create new disk label
-  become: yes
-  parted:
-    label: msdos
-    device: "{{ ephemeral_device }}"
-
-- name: Create swap partition
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    number: 1
-    state: present
-    part_start: '0%'
-    part_end: "{{ configure_swap_size }}MiB"
-
-- name: Create opt partition
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    number: 2
-    state: present
-    part_start: "{{ configure_swap_size }}MiB"
-    part_end: "100%"
-
-- name: Make swap on partition
-  become: yes
-  command: "mkswap {{ swap_partition }}"
-
-- name: Write swap to fstab
-  become: yes
-  mount:
-    path: none
-    src: "{{ swap_partition }}"
-    fstype: swap
-    opts: sw
-    passno: 0
-    dump: 0
-    state: present
-
-# XXX: does "parted" plugin ensure the partition is available
-# before moving on?  No udev settles here ...
-
-- name: Add all swap
-  become: yes
-  command: swapon -a
-
-- name: Create /opt filesystem
-  become: yes
-  filesystem:
-    fstype: ext4
-    dev: "{{ opt_partition }}"
-
-# Rackspace at least does not have enough room for two devstack
-# installs on the primary partition.  We copy in the existing /opt to
-# the new partition on the ephemeral device, and then overmount /opt
-# to there for the test runs.
-#
-# NOTE(ianw): the existing "mount" touches fstab.  There is currently (Sep2017)
-# work in [1] to split mount & fstab into separate parts, but for now we bundle
-# it into an atomic shell command
-# [1] https://github.com/ansible/ansible/pull/27174
-- name: Copy old /opt
-  become: yes
-  shell: |
-    mount {{ opt_partition }} /mnt
-    find /opt/ -mindepth 1 -maxdepth 1 -exec mv {} /mnt/ \;
-    umount /mnt
-
-# This overmounts any existing /opt
-- name: Add opt to fstab and mount
-  become: yes
-  mount:
-    path: /opt
-    src: "{{ opt_partition }}"
-    fstype: ext4
-    opts: noatime
-    state: mounted
diff --git a/roles/configure-swap/tasks/main.yaml b/roles/configure-swap/tasks/main.yaml
deleted file mode 100644
index 8960c726c8..0000000000
--- a/roles/configure-swap/tasks/main.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# On RAX hosts, we have a small root partition and a large,
-# unallocated ephemeral device attached at /dev/xvde
-- name: Set ephemeral device if /dev/xvde exists
-  when: ansible_devices["xvde"] is defined
-  set_fact:
-    ephemeral_device: "/dev/xvde"
-
-# On other providers, we have a device called "ephemeral0".
-#
-# NOTE(ianw): Once [1] is in our ansible (2.4 era?), we can figure
-# this out more directly by walking the device labels in the facts
-#
-# [1] https://github.com/ansible/ansible/commit/d46dd99f47c0ee5081d15bc5b741e9096d8bfd3e
-- name: Set ephemeral device by label
-  when: ephemeral_device is undefined
-  block:
-    - name: Get ephemeral0 device node
-      command: /sbin/blkid -L ephemeral0
-      register: ephemeral0
-      # If this doesn't exist, returns !0
-      ignore_errors: yes
-      changed_when: False
-
-    - name: Set ephemeral device if LABEL exists
-      when: "ephemeral0.rc == 0"
-      set_fact:
-        ephemeral_device: "{{ ephemeral0.stdout }}"
-
-# If we have ephemeral storage and we don't appear to have setup swap,
-# we will create a swap and move /opt to a large data partition there.
-- include: ephemeral.yaml
-  static: no
-  when:
-    - ephemeral_device is defined
-    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
-
-# If no ephemeral device and no swap, then we will setup some swap
-# space on the root device to ensure all hosts a consistent memory
-# environment.
-- include: root.yaml
-  static: no
-  when:
-    - ephemeral_device is undefined
-    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
-
-# ensure a standard level of swappiness.  Some platforms
-# (rax+centos7) come with swappiness of 0 (presumably because the
-# vm doesn't come with swap setup ... but we just did that above),
-# which depending on the kernel version can lead to the OOM killer
-# kicking in on some processes despite swap being available;
-# particularly things like mysql which have very high ratio of
-# anonymous-memory to file-backed mappings.
-#
-# This sets swappiness low; we really don't want to be relying on
-# cloud I/O based swap during our runs if we can help it
-- name: Set swappiness
-  become: yes
-  sysctl:
-    name: vm.swappiness
-    value: 30
-    state: present
-
-- debug:  var=ephemeral_device
diff --git a/roles/configure-swap/tasks/root.yaml b/roles/configure-swap/tasks/root.yaml
deleted file mode 100644
index f22b53700f..0000000000
--- a/roles/configure-swap/tasks/root.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# If no ephemeral devices are available, use root filesystem
-
-- name: Calculate required swap
-  set_fact:
-    swap_required: "{{ configure_swap_size - ansible_memory_mb['swap']['total'] | int }}"
-
-- block:
-    - name: Get root filesystem
-      shell: df --output='fstype' /root | tail -1
-      register: root_fs
-
-    - name: Save root filesystem
-      set_fact:
-        root_filesystem: "{{ root_fs.stdout }}"
-
-    - debug: var=root_filesystem
-
-# Note, we don't use a sparse device to avoid wedging when disk space
-# and memory are both unavailable.
-
-# Cannot fallocate on filesystems like XFS, so use slower dd
-- name: Create swap backing file for non-EXT fs
-  when: '"ext" not in root_filesystem'
-  become: yes
-  command: dd if=/dev/zero of=/root/swapfile bs=1M count={{ swap_required }}
-  args:
-    creates: /root/swapfile
-
-- name: Create sparse swap backing file for EXT fs
-  when: '"ext" in root_filesystem'
-  become: yes
-  command: fallocate -l {{ swap_required }}M /root/swapfile
-  args:
-    creates: /root/swapfile
-
-- name: Ensure swapfile perms
-  become: yes
-  file:
-    path: /root/swapfile
-    owner: root
-    group: root
-    mode: 0600
-
-- name: Make swapfile
-  become: yes
-  command: mkswap /root/swapfile
-
-- name: Write swap to fstab
-  become: yes
-  mount:
-    path: none
-    src: /root/swapfile
-    fstype: swap
-    opts: sw
-    passno: 0
-    dump: 0
-    state: present
-
-- name: Add all swap
-  become: yes
-  command: swapon -a
-
-- debug: var=swap_required

From 065779517f9c99a80fbc39d51784c614e4ee341c Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 20 Oct 2017 12:14:29 -0700
Subject: [PATCH 2114/3333] Properly get pip version

The old code was strip()ing the version string instead of split()ing the
version string so we always got the first character of the version
string. This worked fine as long as the pip version was single digit but
as soon as it rolls over to '10.stuff' we will compare:

  pip version 1 (instead of 10) > 6

Which fails bceause 1 is less than six. Instaed we really do want to
compare 10 > 6 so use split on '.' instead.

Change-Id: Ic7d0c04d7fa77774ab2d70fb9d11f182becec553
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9c810ec9b9..8064014f36 100644
--- a/inc/python
+++ b/inc/python
@@ -333,7 +333,7 @@ function pip_install {
     # packages like setuptools?
     local pip_version
     pip_version=$(python -c "import pip; \
-                        print(pip.__version__.strip('.')[0])")
+                        print(pip.__version__.split('.')[0])")
     if (( pip_version<6 )); then
         die $LINENO "Currently installed pip version ${pip_version} does not" \
             "meet minimum requirements (>=6)."

From c9e109f1359e2310fab1190d164a28822fc09208 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 21 Oct 2017 18:04:49 +0200
Subject: [PATCH 2115/3333] Disable nested virt in base devstack job

We were doing this in devstack-gate. The gate can't handle nested virt.

Change-Id: Ie71663c3144908ddd134fa5a5b1b2d265a60edcf
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index bb7239abae..9e00231265 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -61,6 +61,8 @@
         NETWORK_GATEWAY: 10.1.0.1
         NOVNC_FROM_PACKAGE: True
         ERROR_ON_CLONE: True
+        # Gate jobs can't deal with nested virt. Disable it.
+        LIBVIRT_TYPE: qemu
         # NOTE(dims): etcd 3.x is not available in debian/ubuntu
         # etc. As a stop gap measure, devstack uses wget to download
         # from the location below for all the CI jobs.

From e8db8674855634dadd90adaadd4381f70c7227ed Mon Sep 17 00:00:00 2001
From: Chandan Kumar <chkumar@redhat.com>
Date: Thu, 26 Oct 2017 15:34:05 +0530
Subject: [PATCH 2116/3333] Change ENABLE_KSM to $ENABLE_KSM

* Since ENABLE_KSM param will be used in local.conf file
  and it's value is received in a variable and while compairing,
  the variable needs to be compared. So we need to change the
  same.

Change-Id: Id4ed17c0642acd2313e456503cfc375ca6f61409
Closes-Bug: #1724690
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index c545c56de3..f14ed96b9b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1006,7 +1006,7 @@ save_stackenv $LINENO
 # be memory bound not cpu bound so enable KSM by default but allow people
 # to opt out if the CPU time is more important to them.
 
-if [[ "ENABLE_KSM" == "True" ]] ; then
+if [[ $ENABLE_KSM == "True" ]] ; then
     if [[ -f /sys/kernel/mm/ksm/run ]] ; then
         sudo sh -c "echo 1 > /sys/kernel/mm/ksm/run"
     fi

From 228d90d5eb7784f3d4cbd889f478329a8d3a6868 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Thu, 26 Oct 2017 16:46:15 -0700
Subject: [PATCH 2117/3333] Zuul: add run attribute

A proposed change[1] to Zuul removes the implied run attribute.
Add an explicit run attribute here to prepare for that.

[1] Ia8f23bce9898cd4f387554e6787b091b63e75519

Change-Id: I1fbc36c3d1b8c4ed70fceef1c587255dad50da04
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9e00231265..826410c2c7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -71,6 +71,7 @@
         horizon: False
         tempest: False
     pre-run: playbooks/pre
+    run: playbooks/devstack
     post-run: playbooks/post
 
 

From c0d8c1c72d61d53bf723de4e0bea6318c6b951b2 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Sat, 28 Oct 2017 10:23:58 -0700
Subject: [PATCH 2118/3333] Zuul: add file extension to playbook path

Zuul now supports including the file extension on the playbook path
and omitting the extension is now deprecrated.  Update references
to include the extension.

Change-Id: I4bff5f12742364f7cc92e17869a047fd2185dda4
---
 .zuul.yaml | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 389ada52c2..710b229d5b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,7 +48,7 @@
         ADMIN_PASSWORD: secretadmin
         SERVICE_PASSWORD: secretservice
         NETWORK_GATEWAY: 10.1.0.1
-        Q_USE_DEBUG_COMMAND: True
+        Q_USE_DEBUG_COMMAND: true
         FIXED_RANGE: 10.1.0.0/20
         IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
         FLOATING_RANGE: 172.24.5.0/24
@@ -56,25 +56,24 @@
         FLOATING_HOST_PREFIX: 172.24.4
         FLOATING_HOST_MASK: 23
         SWIFT_REPLICAS: 1
-        SWIFT_START_ALL_SERVICES: False
+        SWIFT_START_ALL_SERVICES: false
         LOGFILE: /opt/stack/logs/devstacklog.txt
-        LOG_COLOR: False
-        VERBOSE: True
-        NETWORK_GATEWAY: 10.1.0.1
-        NOVNC_FROM_PACKAGE: True
-        ERROR_ON_CLONE: True
+        LOG_COLOR: false
+        VERBOSE: true
+        NOVNC_FROM_PACKAGE: true
+        ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it.
         LIBVIRT_TYPE: qemu
         # NOTE(dims): etcd 3.x is not available in debian/ubuntu
         # etc. As a stop gap measure, devstack uses wget to download
         # from the location below for all the CI jobs.
-        ETCD_DOWNLOAD_URL: "http://tarballs.openstack.org/etcd/"
+        ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
-        horizon: False
-        tempest: False
-    pre-run: playbooks/pre
-    run: playbooks/devstack
-    post-run: playbooks/post
+        horizon: false
+        tempest: false
+    pre-run: playbooks/pre.yaml
+    run: playbooks/devstack.yaml
+    post-run: playbooks/post.yaml
 
 
 - project:

From 32ecccaeef1b06bb48fc6fe066be4f42332e5a2a Mon Sep 17 00:00:00 2001
From: caowei <cao.wei@99cloud.net>
Date: Wed, 1 Nov 2017 11:45:21 +0800
Subject: [PATCH 2119/3333] Add "sudo" before the journalctl command

Change-Id: I41c396f704918e88168c9a9c6cc9e633e7a81437
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 23f680a59c..d932d8cd86 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -294,7 +294,7 @@ the systemd journal.
 
 To query the logs use the ``journalctl`` command, such as::
 
-  journalctl --unit devstack@*
+  sudo journalctl --unit devstack@*
 
 More examples can be found in :ref:`journalctl-examples`.
 

From a794b12cf2a6b349272ce44892635d07231059d1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 1 Nov 2017 06:34:13 +0000
Subject: [PATCH 2120/3333] Updated from generate-devstack-plugins-list

Change-Id: Ic6d3cdb0b1fcc674ab5adcbaf45fa5a80f10b10f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5fd6697d35..c3063ac2ed 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -67,6 +67,7 @@ gce-api                                `git://git.openstack.org/openstack/gce-ap
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
+heat-dashboard                         `git://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__

From 1d968d7a542c7a271d72aac08fdd7fe8b235011f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 23 Sep 2017 14:45:42 +0200
Subject: [PATCH 2121/3333] Switch to mariadb on openSUSE

The mysql-community-server is a compat provide, openSUSE uses
mariadb for quite some time. Make it futureproof in case
the compat provide goes away in the future. Cleanup
mysql service name to MYSQL_SERVICE_NAME and consistently
use it.

Change-Id: I2df7b8d8b798dfa7ceade90e0c127e0609524a8b
---
 lib/databases/mysql | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index a0cf7a4296..0089663285 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -15,10 +15,9 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 
 register_database mysql
 
-# Linux distros, thank you for being incredibly consistent
-MYSQL=mysql
+MYSQL_SERVICE_NAME=mysql
 if is_fedora && ! is_oraclelinux; then
-    MYSQL=mariadb
+    MYSQL_SERVICE_NAME=mariadb
 fi
 
 # Functions
@@ -34,17 +33,17 @@ function get_database_type_mysql {
 
 # Get rid of everything enough to cleanly change database backends
 function cleanup_database_mysql {
-    stop_service $MYSQL
+    stop_service $MYSQL_SERVICE_NAME
     if is_ubuntu; then
         # Get ruthless with mysql
         apt_get purge -y mysql* mariadb*
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return
-    elif is_suse || is_oraclelinux; then
+    elif is_oraclelinux; then
         uninstall_package mysql-community-server
         sudo rm -rf /var/lib/mysql
-    elif is_fedora; then
+    elif is_suse || is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
     else
@@ -64,12 +63,9 @@ function configure_database_mysql {
 
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
-        mysql=mysql
     elif is_suse || is_oraclelinux; then
         my_conf=/etc/my.cnf
-        mysql=mysql
     elif is_fedora; then
-        mysql=mariadb
         my_conf=/etc/my.cnf
         local cracklib_conf=/etc/my.cnf.d/cracklib_password_check.cnf
         if [ -f "$cracklib_conf" ]; then
@@ -82,7 +78,7 @@ function configure_database_mysql {
     # Start mysql-server
     if is_fedora || is_suse; then
         # service is not started by default
-        start_service $mysql
+        start_service $MYSQL_SERVICE_NAME
     fi
 
     # Set the root password - only works the first time. For Ubuntu, we already
@@ -124,7 +120,7 @@ function configure_database_mysql {
         iniset -sudo $my_conf mysqld log-queries-not-using-indexes 1
     fi
 
-    restart_service $mysql
+    restart_service $MYSQL_SERVICE_NAME
 }
 
 function install_database_mysql {
@@ -151,13 +147,11 @@ EOF
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
-    if is_suse || is_oraclelinux; then
-        if ! is_package_installed mariadb; then
-            install_package mysql-community-server
-        fi
-    elif is_fedora; then
+    if is_oraclelinux; then
+        install_package mysql-community-server
+    elif is_fedora || is_suse; then
         install_package mariadb-server
-        sudo systemctl enable mariadb
+        sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_ubuntu; then
         install_package mysql-server
     else

From 1db9b5d3cab9ecfdc3505ea40ac4f504075fbea0 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 3 Nov 2017 08:37:21 +0000
Subject: [PATCH 2122/3333] Remove apache tls-proxy sites when stopping

Currently doing a cycle of

    ./stack.sh; ./unstack.sh; ./stack.sh

fails because the leftover tls-proxy sites will cause apache startup to
fail on the second stack.sh run. So we need to disable these sites on
running stop_tls_proxy.

Change-Id: I03e6879be332289d19ca6a656f5f9f139dffff6f
Closes-Bug: 1718189
---
 lib/tls | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/tls b/lib/tls
index 0baf86caa9..0bc389bb88 100644
--- a/lib/tls
+++ b/lib/tls
@@ -564,6 +564,20 @@ function follow_tls_proxy {
 # using tls configuration are down.
 function stop_tls_proxy {
     stop_apache_server
+
+    # NOTE(jh): Removing all tls-proxy configs is a bit of a hack, but
+    # necessary so that we can restart after an unstack.  A better
+    # solution would be to ensure that each service calling
+    # start_tls_proxy will call stop_tls_proxy with the same
+    # parameters on shutdown so we can use the disable_apache_site
+    # function and remove individual files there.
+    if is_ubuntu; then
+        sudo rm -f /etc/apache2/sites-enabled/*-tls-proxy.conf
+    else
+        for i in $APACHE_CONF_DIR/*-tls-proxy.conf; do
+            sudo mv $i $i.disabled
+        done
+    fi
 }
 
 # Clean up the CA files

From efc5168245406156a98a6623b9bebae757275cf7 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 10 Nov 2017 00:50:48 -0500
Subject: [PATCH 2123/3333] Replace deprecated nova_metadata_ip

Option nova_metadata_ip was deprecated in favor
of nova_metadata_host.  lib/neutron was updated
recently but lib/neutron-legacy was missed.

Change-Id: Iadd42458dda705ad0c24aa4ab2afd5b27dd8f0e1
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..bb76c5f9ce 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -757,7 +757,7 @@ function _configure_neutron_metadata_agent {
     cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
 
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_host $Q_META_DATA_IP
     iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
     iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then

From 3b815a3cb2537885b501ad559bfd69ad5efb9085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Tue, 14 Nov 2017 16:04:51 +0100
Subject: [PATCH 2124/3333] Provide finite value for systemd's TimeoutStopSec

This commit switches TimeoutStopSec in DevStack's systemd unit files
from "infinity" to "300". There are two motivations for that change:

* 5 minutes should be more than enough to stop a service.
* systemd included in CentOS 7 and RHEL 7 doesn't support "infinity" as
  a value, "0" should be provided instead. When "infinity" is set,
  systemd will kill the service instantly, leaving service children
  processes orphaned. Instead of differentiating here, we can just set a
  sane, finite number.

Closes-Bug: 1731275
Change-Id: I0a079ea9879fa4fbba23104c2f5ab6e0721a2a2a
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 030ff8c02d..0160c622b7 100644
--- a/functions-common
+++ b/functions-common
@@ -1394,7 +1394,7 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "KillMode" "process"
-    iniset -sudo $unitfile "Service" "TimeoutStopSec" "infinity"
+    iniset -sudo $unitfile "Service" "TimeoutStopSec" "300"
     iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"

From 83194f956e1c5308386adbf7146626e75875bcfe Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 3 Nov 2017 14:14:53 +0000
Subject: [PATCH 2125/3333] Update supported Ubuntu releases

With the release of 17.10(artful), support for 16.10(yakkety) has ended.
Update our list of supported distros accordingly.

Change-Id: Id85e00f109cfd43141dec0c0d2bfedb66f14e664
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index a125d4a0d7..1d0381483a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From e340a7bfff80889361085cfb592b1880d27b5a21 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Nov 2017 06:17:45 +0000
Subject: [PATCH 2126/3333] Updated from generate-devstack-plugins-list

Change-Id: I884ae2ff23f8c23874e166dd7643b188f7450109
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c3063ac2ed..43dd3c2eae 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -151,6 +151,7 @@ oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
+python-openstacksdk                    `git://git.openstack.org/openstack/python-openstacksdk <https://git.openstack.org/cgit/openstack/python-openstacksdk>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__

From 4bc42c7197c291639be6841d75f02dc008b8b915 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Tue, 7 Nov 2017 15:22:00 -0500
Subject: [PATCH 2127/3333] Change lib/neutron-legacy to use openstackclient

neutronclient has been deprecated, use openstack.

Change-Id: I55ea7b8c90b54c05aa0e3f3d4543732e516dc2e6
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..39f41fdccc 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -929,7 +929,7 @@ function delete_probe {
 }
 
 function _get_net_id {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
+    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
 }
 
 function _get_probe_cmd_prefix {

From 0d0b69027bc2b0195ed365619be78466867311ec Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Nov 2017 10:33:11 +1100
Subject: [PATCH 2128/3333] Restore qemu-kvm install for CentOS

The kvmibm removal I009ae4779588615633bff81d0c47a1b879ec9279
incorrectly removed this (the check was install if *not* kvmibm).
Since we don't support kvmibm any more, it should be safe to install
everywhere as done here.

For the full history, it started with us installing qemu-kvm-ev with
Ide91b261f35fb19d8bd7155ca016fa3b76a45ea1, then we fixed it to be more
generic and just install qemu-kvm with
I46da627c0da8925064862fdc283db81591979285, then Fedora 26 support in
I5c79ad1ef0b11dba30c931a59786f9eb7e7f8587 made this install everywhere
*but* kvmibm.

Change-Id: If3e9661451ad1055e7c8d670605a53095f0aeda4
---
 lib/nova_plugins/functions-libvirt | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index c8527387ab..dbfa3b5cac 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -72,6 +72,13 @@ function install_libvirt {
         pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
+
+        # Note that in CentOS/RHEL this needs to come from the RDO
+        # repositories (qemu-kvm-ev ... which provides this package)
+        # as the base system version is too old.  We should have
+        # pre-installed these
+        install_package qemu-kvm
+
         install_package libvirt libvirt-devel
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python

From 1a2c86cff99d5628f93105c8d4ed815baf781941 Mon Sep 17 00:00:00 2001
From: jiangyikun <yikunkero@gmail.com>
Date: Thu, 7 Sep 2017 17:56:13 +0800
Subject: [PATCH 2129/3333] Cleanup nova cell configuration before config it

Some old configuration(such as, LOG_COLOR config) will remain
if we don't cleanup.

So, we should cleanup the configuration before we config it.

Change-Id: I7aff609dadf3acba13a36894614b35005f51280d
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index ea0d2f7b89..50deeeb220 100644
--- a/lib/nova
+++ b/lib/nova
@@ -589,6 +589,8 @@ function create_nova_conf {
             local vhost
             conf=$(conductor_conf $i)
             vhost="nova_cell${i}"
+            # clean old conductor conf
+            rm -f $conf
             iniset $conf database connection `database_connection_url nova_cell${i}`
             iniset $conf conductor workers "$API_WORKERS"
             iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"

From c5853ac1afe79c9b96a2c4cbd30069566ab12955 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Tue, 21 Nov 2017 09:44:42 -0800
Subject: [PATCH 2130/3333] Allow plugins to express dependency info

Add a no-op function, "plugin_requires" to allow plugins to indicate
their dependencies on each other.  This will be used by the Devstack
Ansible module when writing local.conf files.

Also add define_plugin to allow plugins to indicate their canonical
names.

Change-Id: Ibd8c7222ed7dfb08d7ea821d871fc6f3b88de24b
---
 doc/source/plugins.rst | 25 +++++++++++++++++++++++++
 functions-common       | 29 +++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index fae1a1d8f5..89b9381813 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -54,6 +54,31 @@ directory. Inside this directory there can be 3 files.
   default value only if the variable is unset or empty; e.g. in bash
   syntax ``FOO=${FOO:-default}``.
 
+  The file should include a ``define_plugin`` line to indicate the
+  plugin's name, which is the name that should be used by users on
+  "enable_plugin" lines.  It should generally be the last component of
+  the git repo path (e.g., if the plugin's repo is
+  openstack/devstack-foo, then the name here should be "foo") ::
+
+    define_plugin <YOUR PLUGIN>
+
+  If your plugin depends on another plugin, indicate it in this file
+  with one or more lines like the following::
+
+    plugin_requires <YOUR PLUGIN> <OTHER PLUGIN>
+
+  For a complete example, if the plugin "foo" depends on "bar", the
+  ``settings`` file should include::
+
+    define_plugin foo
+    plugin_requires foo bar
+
+  Devstack does not currently use this dependency information, so it's
+  important that users continue to add enable_plugin lines in the
+  correct order in ``local.conf``, however adding this information
+  allows other tools to consider dependency information when
+  automatically generating ``local.conf`` files.
+
 - ``plugin.sh`` - the actual plugin. It is executed by devstack at
   well defined points during a ``stack.sh`` run. The plugin.sh
   internal structure is discussed below.
diff --git a/functions-common b/functions-common
index 6d565916fa..aee569bee2 100644
--- a/functions-common
+++ b/functions-common
@@ -1703,6 +1703,35 @@ function run_phase {
     fi
 }
 
+# define_plugin <name>
+#
+# This function is a no-op.  It allows a plugin to define its name So
+# that other plugins may reference it by name.  It should generally be
+# the last component of the canonical git repo name.  E.g.,
+# openstack/devstack-foo should use "devstack-foo" as the name here.
+#
+# This function is currently a noop, but the value may still be used
+# by external tools (as in plugin_requires) and may be used by
+# devstack in the future.
+#
+# ``name`` is an arbitrary name - (aka: glusterfs, nova-docker, zaqar)
+function define_plugin {
+    :
+}
+
+# plugin_requires <name> <other>
+#
+# This function is a no-op.  It is currently used by external tools
+# (such as the devstack module for Ansible) to automatically generate
+# local.conf files.  It is not currently used by devstack itself to
+# resolve dependencies.
+#
+# ``name`` is an arbitrary name - (aka: glusterfs, nova-docker, zaqar)
+# ``other`` is the name of another plugin
+function plugin_requires {
+    :
+}
+
 
 # Service Functions
 # =================

From b5fb7fd627fe24876a8dd2782fce065cf1957b55 Mon Sep 17 00:00:00 2001
From: rabi <ramishra@redhat.com>
Date: Wed, 22 Nov 2017 08:14:29 +0530
Subject: [PATCH 2131/3333] Fix lib_installed_from_git

In commit f0cd9a8b08d92524fc8e2c3f05d08cdebc638e2a we changed to
use column format, but it checks for zero length string and
check_libs_from_git fails.

Change-Id: I97b52b80efb33749647229a55147a08afa112dd2
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9a65bfefb1..9f56ec5e7f 100644
--- a/inc/python
+++ b/inc/python
@@ -419,7 +419,7 @@ function lib_installed_from_git {
     #  bashate 0.5.2.dev19 /tmp/env/src/bashate
     # Thus we check the third column to see if we're installed from
     # some local place.
-    [[ -z $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
+    [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed

From 007f588f275ac9d7320d4b24f1d05378d3df3d37 Mon Sep 17 00:00:00 2001
From: DamonLi <damonl@vmware.com>
Date: Thu, 23 Nov 2017 10:05:46 +0800
Subject: [PATCH 2132/3333] Convert to safe name in lib_installed_from_git

The 'pip list' command prints the "safe name" which converts _'s to
-'s amongst other things; e.g. glance_store becomes

  "glance-store             0.21.1.dev22      /opt/stack/glance_store"

Because people may use these more familiar "file system" names in
LIBS_FROM_GIT automatically convert names when checking if libraries
are installed.

Change-Id: I30524f80a341f38dfa794a8f629d859e85a4a448
---
 inc/python | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9f56ec5e7f..9938f98545 100644
--- a/inc/python
+++ b/inc/python
@@ -406,6 +406,9 @@ function use_library_from_git {
 # determine if a package was installed from git
 function lib_installed_from_git {
     local name=$1
+    local safe_name
+    safe_name=$(python -c "from pkg_resources import safe_name; \
+        print(safe_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
     # be smart about finding the remote of the git repo the package
     # was installed from.  This doesn't work with zuul which clones
@@ -419,7 +422,7 @@ function lib_installed_from_git {
     #  bashate 0.5.2.dev19 /tmp/env/src/bashate
     # Thus we check the third column to see if we're installed from
     # some local place.
-    [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
+    [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$safe_name/ {print \$3}") ]]
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed

From 34c1679f2ee42df40c32ad96b4269f94721dc8d4 Mon Sep 17 00:00:00 2001
From: Claudiu Belu <cbelu@cloudbasesolutions.com>
Date: Mon, 12 Jun 2017 09:32:21 -0700
Subject: [PATCH 2133/3333] use master upper-constraints when building tempest
 venv

The local requirements repo can be checked out to a stable branch,
in which case, the requirements might conflict with tempest's master
requirements.

Master branch's upper-constraints should be used when building tempest's
venv.

Closes-Bug: #1706009

Change-Id: Ifd64638cae2886671421149dbbff3a57f9c64257
---
 lib/tempest | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index bdbaaa5678..fc88f37e21 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -551,7 +551,10 @@ function configure_tempest {
     if [[ "$OFFLINE" != "True" ]]; then
         tox -revenv-tempest --notest
     fi
-    tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+
+    # The requirements might be on a different branch, while tempest needs master requirements.
+    git -C $REQUIREMENTS_DIR show master:upper-constraints.txt > u-c-m.txt
+    tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"

From ad180e0e35d45ebe15840e02dbba835d864a2c58 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin034@gmail.com>
Date: Wed, 29 Nov 2017 13:21:30 -0500
Subject: [PATCH 2134/3333] Install etcdctl along with etcd3

It is better to have this command line tool for debugging etcd.

Change-Id: Ie0eb79d4e543df29ce6a38b57c8ef57a5d2211b4
---
 lib/etcd3 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index 51df8e4c1e..d3f72264b0 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -107,9 +107,11 @@ function install_etcd3 {
 
         tar xzvf $etcd_file -C $FILES
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        sudo cp $FILES/$ETCD_NAME/etcdctl $ETCD_BIN_DIR/etcdctl
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        sudo cp $FILES/$ETCD_NAME/etcdctl $ETCD_BIN_DIR/etcdctl
     fi
 }
 

From 27367bea48a14ce991f6e60400d61ab2aa11532b Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 28 Nov 2017 08:20:48 -0500
Subject: [PATCH 2135/3333] Allow overrides for ETCD ports

This will enable us to run one etcd for devstack and another
for kubernetes in the same box if necessary

Change-Id: Ib71ded24727b80afd4d98eb68bade0f8c0f72311
---
 lib/cinder | 2 +-
 lib/etcd3  | 9 ++++-----
 stackrc    | 2 ++
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..2851966bcf 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -327,7 +327,7 @@ function configure_cinder {
     if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then
         iniset $CINDER_CONF coordination backend_url "$CINDER_COORDINATION_URL"
     elif is_service_enabled etcd3; then
-        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:2379"
+        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
     fi
 }
 
diff --git a/lib/etcd3 b/lib/etcd3
index 51df8e4c1e..dc68524476 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -27,7 +27,6 @@ set +o xtrace
 ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
-ETCD_PORT=2379
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -38,13 +37,13 @@ function start_etcd3 {
     local cmd="$ETCD_BIN_DIR/etcd"
     cmd+=" --name $HOSTNAME --data-dir $ETCD_DATA_DIR"
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
-    cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
-    cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
+    cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:$ETCD_PEER_PORT"
+    cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:$ETCD_PEER_PORT"
     cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
     if [ "$SERVICE_LISTEN_ADDRESS" == "::" ]; then
-        cmd+=" --listen-peer-urls http://[::]:2380 "
+        cmd+=" --listen-peer-urls http://[::]:$ETCD_PEER_PORT "
     else
-        cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
+        cmd+=" --listen-peer-urls http://0.0.0.0:$ETCD_PEER_PORT "
     fi
     cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
 
diff --git a/stackrc b/stackrc
index ffe405012d..ed356ee237 100644
--- a/stackrc
+++ b/stackrc
@@ -748,6 +748,8 @@ elif is_arch "s390x"; then
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi
+ETCD_PORT=${ETCD_PORT:-2379}
+ETCD_PEER_PORT=${ETCD_PEER_PORT:-2380}
 ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
 ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
 ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz

From 1d127849121974fe6c8161eabe5ebd7151fa4f4d Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Thu, 30 Nov 2017 14:15:04 -0600
Subject: [PATCH 2136/3333] Remove Cinder policy.json install

Cinder has now implemented "policy in code" and policy.json is
only needed for overriding default policies. The default policy.json
file has been removed in Cinder so we need to stop trying to copy
it during Cinder setup.

Change-Id: I364e401227fe43e2bacf8a799e10286ee445f835
---
 lib/cinder | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..01686f7ddf 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -206,8 +206,6 @@ function cleanup_cinder {
 function configure_cinder {
     sudo install -d -o $STACK_USER -m 755 $CINDER_CONF_DIR
 
-    cp -p $CINDER_DIR/etc/cinder/policy.json $CINDER_CONF_DIR
-
     rm -f $CINDER_CONF
 
     configure_rootwrap cinder

From 9ef3e8448580e9d166e1a4669a036da0205243b5 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 3 Dec 2017 10:11:12 -0600
Subject: [PATCH 2137/3333] Add python-openstacksdk to python3 enabled list

It's perfectly with with python3, add it to the list.

Change-Id: Ieb9f563a2f95e78a994cef388e56a6d5a84c8935
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ffe405012d..286a04d3fe 100644
--- a/stackrc
+++ b/stackrc
@@ -121,7 +121,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 # base name of the directory from which they are installed. See
 # enable_python3_package to edit this variable and use_python3_for to
 # test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient"
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,python-openstacksdk"
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.

From e46f22db7fcb6e9aae5922d650eda14a15231fb8 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 3 Dec 2017 10:21:26 -0600
Subject: [PATCH 2138/3333] Add workaround for openstacksdk in
 check_libs_from_git

python-openstacksdk does not match its pip name which is openstacksdk.
So setting python-openstacksdk in LIBS_FROM_GIT leads to devstack
thinking there is a problem.

Put in a workaround for now. It would be better to either:

  a) rename python-openstacksdk repo to openstacksdk
  b) rename the pip name for openstacksdk back to python-openstacksdk
  c) add general support in the various GIT hashes for a pip name

Change-Id: I57cf95763d54ad2060a4ce2af91c3ba18ca04db0
---
 inc/python | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/inc/python b/inc/python
index 9938f98545..2e4eff02ea 100644
--- a/inc/python
+++ b/inc/python
@@ -407,6 +407,12 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
+    # TODO(mordred) This is a special case for python-openstacksdk, where the
+    # repo name and the pip name do not match. We should either add systemic
+    # support for providing aliases, or we should rename the git repo.
+    if [[ $name == 'python-openstacksdk' ]] ; then
+        name=openstacksdk
+    fi
     safe_name=$(python -c "from pkg_resources import safe_name; \
         print(safe_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to

From cb8256f22531b59470703ca4090064cba4a0b55e Mon Sep 17 00:00:00 2001
From: lkuchlan <lkuchlan@redhat.com>
Date: Wed, 30 Aug 2017 07:36:11 +0300
Subject: [PATCH 2139/3333] Add fixed_key parameter under key_manager section
 in cinder conf

This change is necessary for uploading an encrypted volume to glance.

Change-Id: I0975fc0c49ec243025d076f0406e28c4f5522d3a
---
 lib/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..a966a4b28e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -244,6 +244,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
+    iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""

From 5551170ad3902de9c3f271122821a9822658ad50 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Thu, 30 Nov 2017 15:49:39 +0000
Subject: [PATCH 2140/3333] Allow jobs to disable all services

Several legacy jobs use the OVERRIDE_ENABLED_SERVICES variable
from d-g so set the list of services that should be enabled and
ignore the default set calculated via the feature matrix.

Add support for a similar functionality in the zuulv3 jobs
using the 'disable_all_services' localconf function.

Change-Id: I690554ec62cef3be600054071efbb3f92a99249e
---
 roles/write-devstack-local-conf/README.rst                 | 7 ++++++-
 .../library/devstack_local_conf.py                         | 3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index e30dfa1e9f..1b7eb1b4c0 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -53,7 +53,12 @@ Write the local.conf file for use by devstack
    A dictionary mapping service names to boolean values.  If the
    boolean value is ``false``, a ``disable_service`` line will be
    emitted for the service name.  If it is ``true``, then
-   ``enable_service`` will be emitted.  All other values are ignored.
+   ``enable_service`` will be emitted. All other values are ignored.
+   The special key ``base`` can be used to enable or disable the base set of
+   services enabled by default. If ``base`` is found, it will processed before
+   all other keys. If its value is ``False`` a ``disable_all_services`` will be
+   emitted; if its value is ``True`` nothing will be emitted since base
+   services are enabled by default.
 
 .. zuul:rolevar:: devstack_plugins
    :type: dict
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 4134beb048..dbd60f52b9 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -124,6 +124,9 @@ def handle_plugins(self, plugins):
                 self.localrc.append('enable_plugin {} {}'.format(k, v))
 
     def handle_services(self, services):
+        base_services = services.pop('base', True)
+        if not base_services:
+            self.localrc.append('disable_all_services')
         for k, v in services.items():
             if v is False:
                 self.localrc.append('disable_service {}'.format(k))

From 1489b9e7101fef6270eea008917b08f3da91a771 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 5 Dec 2017 23:46:58 +0000
Subject: [PATCH 2141/3333] Move remove_uwsgi_config to cleanup_placement

It had been in stop_placement, but we don't want it there: the old
side of grenade needs to call that but should not remove the uwsgi
configuration when doing so. It is configuration, after all.

Change-Id: Iee763adf7895145d97b184924896db3f1f48a015
Partial-Bug: #1736385
---
 lib/placement | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/placement b/lib/placement
index d3fb8c848d..1875857552 100644
--- a/lib/placement
+++ b/lib/placement
@@ -71,6 +71,7 @@ function is_placement_enabled {
 function cleanup_placement {
     sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
+    remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files
@@ -188,7 +189,6 @@ function start_placement {
 function stop_placement {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         stop_process "placement-api"
-        remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
     else
         disable_apache_site placement-api
         restart_apache_server

From 7d4446541d6265491999efc536bc88520beadace Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 1 Dec 2017 17:36:38 +0000
Subject: [PATCH 2142/3333] Set the base set of services

Use the test-matrix role from devstack-gate to define a base set of
services to be enabled for the controller and compute nodes.

Extend the local conf module to handle the base set of services.

Since the test-matrix defines services for primary and subnode nodes, we
need a multinode job to test that this works. Add a new host group
called subnode that includes the non-controller hosts. Add a new job
that runs devstack on a two nodes environment.

Using service from the test matrix enables swift in the gate, so we need
to set SWIFT_HASH for devstack to work.

Depends-on: Ie36ba0cd7cfcd450b75000a76a64d856f2a83eba
Depends-on: Id9ad3be4be25e699f77d6b5a252f046ce8234f45
Change-Id: I379abf482c89122533324e64fefbff3d5a618a89
---
 .zuul.yaml                                      | 16 ++++++++++++++++
 playbooks/pre.yaml                              | 12 +++++++++++-
 roles/write-devstack-local-conf/README.rst      | 13 +++++++++++--
 .../defaults/main.yaml                          |  1 +
 .../library/devstack_local_conf.py              | 17 +++++++++++------
 roles/write-devstack-local-conf/tasks/main.yaml |  1 +
 6 files changed, 51 insertions(+), 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 710b229d5b..b9ffb34622 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -23,6 +23,9 @@
         nodes:
           - controller
           - compute1
+      - name: subnode
+        nodes:
+          - compute1
 
 - job:
     name: devstack
@@ -39,9 +42,11 @@
       - openstack/requirements
       - openstack/swift
     roles:
+      - zuul: openstack-infra/devstack-gate
       - zuul: openstack-infra/openstack-zuul-jobs
     timeout: 7200
     vars:
+      test_matrix_configs: ['neutron', 'tlsproxy']
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
         RABBIT_PASSWORD: secretrabbit
@@ -57,6 +62,7 @@
         FLOATING_HOST_MASK: 23
         SWIFT_REPLICAS: 1
         SWIFT_START_ALL_SERVICES: false
+        SWIFT_HASH: 1234123412341234
         LOGFILE: /opt/stack/logs/devstacklog.txt
         LOG_COLOR: false
         VERBOSE: true
@@ -75,9 +81,19 @@
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
 
+- job:
+    name: devstack-multinode
+    parent: devstack
+    description: Base devstack multinode job
+    nodeset: openstack-two-node
+    # NOTE(andreaf) The multinode job is useful to see the setup of different
+    # services on different nodes, however the subnode configuration is not
+    # ready yet. Until then this job should stay non-voting.
+    voting: false
 
 - project:
     name: openstack-dev/devstack
     check:
       jobs:
         - devstack
+        - devstack-multinode
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 4d07960fe8..d61fd45de0 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -1,3 +1,13 @@
+- hosts: controller
+  roles:
+    - role: test-matrix
+      test_matrix_role: primary 
+
+- hosts: subnode
+  roles:
+    - role: test-matrix
+      test_matrix_role: subnode
+
 - hosts: all
   roles:
     - configure-swap
@@ -8,7 +18,7 @@
     - setup-devstack-cache
     - start-fresh-logging
     - write-devstack-local-conf
-  # TODO(jeblair): remove when configure-mirrors is fixed  
+  # TODO(jeblair): remove when configure-mirrors is fixed
   tasks:
     - name: Hack mirror_info
       shell:
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index 1b7eb1b4c0..73f9f0d6fd 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -47,6 +47,14 @@ Write the local.conf file for use by devstack
             This is a dictionary of key-value pairs which comprise
             this section of the INI file.
 
+.. zuul:rolevar:: devstack_base_services
+   :type: list
+   :default: {{ base_services | default(omit) }}
+
+   A list of base services which are enabled. Services can be added or removed
+   from this list via the ``devstack_services`` variable. This is ignored if
+   ``base`` is set to ``False`` in ``devstack_services``.
+
 .. zuul:rolevar:: devstack_services
    :type: dict
 
@@ -54,11 +62,12 @@ Write the local.conf file for use by devstack
    boolean value is ``false``, a ``disable_service`` line will be
    emitted for the service name.  If it is ``true``, then
    ``enable_service`` will be emitted. All other values are ignored.
+
    The special key ``base`` can be used to enable or disable the base set of
    services enabled by default. If ``base`` is found, it will processed before
    all other keys. If its value is ``False`` a ``disable_all_services`` will be
-   emitted; if its value is ``True`` nothing will be emitted since base
-   services are enabled by default.
+   emitted; if its value is ``True`` services from ``devstack_base_services``
+   will be emitted via ``ENABLED_SERVICES``.
 
 .. zuul:rolevar:: devstack_plugins
    :type: dict
diff --git a/roles/write-devstack-local-conf/defaults/main.yaml b/roles/write-devstack-local-conf/defaults/main.yaml
index 491fa0fdb9..7bc1dec9b8 100644
--- a/roles/write-devstack-local-conf/defaults/main.yaml
+++ b/roles/write-devstack-local-conf/defaults/main.yaml
@@ -1,2 +1,3 @@
 devstack_base_dir: /opt/stack
 devstack_local_conf_path: "{{ devstack_base_dir }}/devstack/local.conf"
+devstack_base_services: "{{ enabled_services | default(omit) }}"
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index dbd60f52b9..55ba4afb69 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -106,13 +106,13 @@ def _getParentVarNamesRecursively(self, dependent_var, soft=False):
 
 class LocalConf(object):
 
-    def __init__(self, localrc, localconf, services, plugins):
+    def __init__(self, localrc, localconf, base_services, services, plugins):
         self.localrc = []
         self.meta_sections = {}
         if plugins:
             self.handle_plugins(plugins)
-        if services:
-            self.handle_services(services)
+        if services or base_services:
+            self.handle_services(base_services, services or {})
         if localrc:
             self.handle_localrc(localrc)
         if localconf:
@@ -123,9 +123,12 @@ def handle_plugins(self, plugins):
             if v:
                 self.localrc.append('enable_plugin {} {}'.format(k, v))
 
-    def handle_services(self, services):
-        base_services = services.pop('base', True)
-        if not base_services:
+    def handle_services(self, base_services, services):
+        enable_base_services = services.pop('base', True)
+        if enable_base_services and base_services:
+            self.localrc.append('ENABLED_SERVICES={}'.format(
+                ",".join(base_services)))
+        else:
             self.localrc.append('disable_all_services')
         for k, v in services.items():
             if v is False:
@@ -164,6 +167,7 @@ def main():
     module = AnsibleModule(
         argument_spec=dict(
             plugins=dict(type='dict'),
+            base_services=dict(type='list'),
             services=dict(type='dict'),
             localrc=dict(type='dict'),
             local_conf=dict(type='dict'),
@@ -174,6 +178,7 @@ def main():
     p = module.params
     lc = LocalConf(p.get('localrc'),
                    p.get('local_conf'),
+                   p.get('base_services'),
                    p.get('services'),
                    p.get('plugins'))
     lc.write(p['path'])
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index 1d67616dd4..cc21426b89 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -4,6 +4,7 @@
   devstack_local_conf:
     path: "{{ devstack_local_conf_path }}"
     plugins: "{{ devstack_plugins|default(omit) }}"
+    base_services: "{{ devstack_base_services|default(omit) }}"
     services: "{{ devstack_services|default(omit) }}"
     localrc: "{{ devstack_localrc|default(omit) }}"
     local_conf: "{{ devstack_local_conf|default(omit) }}"

From 986cd13a21d34886688a1f22c6dc4a5ba8bfc6d2 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 25 Oct 2017 16:05:46 -0500
Subject: [PATCH 2143/3333] Collect devstack config files in post.

Co-Authored-By: yong sheng gong <gong.yongsheng@99cloud.net>
Co-Authored-By: Dean Troyer <dtroyer@gmail.com>
Co-Authored-By: Andrea Frittoli <andrea.frittoli@gmail.com>

Change-Id: Id9ad3be4be25e699f77d6b5a252f046ce8234f45
---
 playbooks/post.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 6f5126ff16..95c366975c 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -1,4 +1,14 @@
 - hosts: all
+  become: True
+  vars:
+    devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
+    stage_dir: "{{ devstack_base_dir|default('/opt/stack') }}"
   roles:
     - export-devstack-journal
+    - role: stage-output
+      zuul_copy_output:
+        { '{{ devstack_conf_dir }}/local.conf': 'logs',
+          '{{ devstack_conf_dir }}/.stackenv': 'logs' }
+      extensions_to_txt:
+        - conf
     - fetch-devstack-log-dir

From 52804403ca821abc887e616cba758c997b46386a Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 6 Dec 2017 09:11:07 -0600
Subject: [PATCH 2144/3333] Gate on v3 devstack job

The devstack base job in in use in many projects, but it is not being
gated here in devstack. Let's add it to the list so that we don't
accidentally break it.

Change-Id: Iea13235a8438d4b540f9f27b94aed13e719481dc
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index b9ffb34622..7c53d45e94 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -97,3 +97,6 @@
       jobs:
         - devstack
         - devstack-multinode
+    gate:
+      jobs:
+        - devstack

From 501aaeb4e7ee07d4c52db987d748ac75dabcaaa6 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 11 Dec 2017 12:01:32 +0100
Subject: [PATCH 2145/3333] lioadm make sure targetcli is there

Without installing the targetcli package
tools and configs can be missing.

The code was correct baside a typo,
it is `ISCSI` not `ICSI`

Change-Id: I32e5d84d87560458f0eaaf820dcd00c86e6dec8b
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index a966a4b28e..7c5cefe018 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -430,7 +430,7 @@ function install_cinder {
     setup_develop $CINDER_DIR
     if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
         install_package tgt
-    elif [[ "$CINDER_ISCI_HELPER" == "lioadm" ]]; then
+    elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
         install_package targetcli
     fi
 }

From e1b0c3886ba5551d3fa8c79849d6a6406037c811 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 6 Dec 2017 09:07:47 -0600
Subject: [PATCH 2146/3333] Add base jobs for functional tests

I keep copy-pasting these to projects from the shade repo. Let's make
some base jobs people can more easily use.

devstack-tox-functional runs devstack and a tox functional environment.

devstack-tox-functional-consumer is the same, but runs devstack in pre.
It's intended for projects for whom patches to the project won't
actually impact the devstack deployment (shade, nodepool, gophercloud
are all examples of such things)

Change-Id: I84de60181cb88574e341ff83cd4857cce241f2dd
---
 .zuul.yaml                  | 54 +++++++++++++++++++++++++++++++++++++
 playbooks/tox/post.yaml     |  5 ++++
 playbooks/tox/pre.yaml      |  8 ++++++
 playbooks/tox/run-both.yaml | 10 +++++++
 playbooks/tox/run.yaml      |  3 +++
 5 files changed, 80 insertions(+)
 create mode 100644 playbooks/tox/post.yaml
 create mode 100644 playbooks/tox/pre.yaml
 create mode 100644 playbooks/tox/run-both.yaml
 create mode 100644 playbooks/tox/run.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index 7c53d45e94..a699dbaa7d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -91,6 +91,60 @@
     # ready yet. Until then this job should stay non-voting.
     voting: false
 
+- job:
+    name: devstack-tox-base
+    parent: devstack
+    description: |
+      Base job for devstack-based functional tests that use tox.
+
+      This job is not intended to be run directly. It's just here
+      for organizational purposes for devstack-tox-functional and
+      devstack-tox-functional-consumer.
+    post-run: playbooks/tox/post.yaml
+    vars:
+      tox_envlist: functional
+      tox_install_siblings: false
+
+- job:
+    name: devstack-tox-functional
+    parent: devstack-tox-base
+    description: |
+      Base job for devstack-based functional tests that use tox.
+
+      Runs devstack, then runs the tox ``functional`` environment,
+      then collects tox/testr build output like normal tox jobs.
+
+      Turns off tox sibling installation. Projects may be involved
+      in the devstack deployment and so may be in the required-projects
+      list, but may not want to test against master of the other
+      projects in their tox env. Child jobs can set tox_install_siblings
+      to True to re-enable sibling processing.
+    run: playbooks/tox/run-both.yaml
+
+- job:
+    name: devstack-tox-functional-consumer
+    parent: devstack
+    description: |
+      Base job for devstack-based functional tests for projects that
+      consume the devstack cloud.
+
+      This base job should only be used by projects that are not involved
+      in the devstack deployment step, but are instead projects that are using
+      devstack to get a cloud against which they can test things.
+
+      Runs devstack in pre-run, then runs the tox ``functional`` environment,
+      then collects tox/testr build output like normal tox jobs.
+
+      Turns off tox sibling installation. Projects may be involved
+      in the devstack deployment and so may be in the required-projects
+      list, but may not want to test against master of the other
+      projects in their tox env. Child jobs can set tox_install_siblings
+      to True to re-enable sibling processing.
+    pre-run:
+      - playbooks/devstack.yaml
+      - playbooks/tox/pre.yaml
+    run: playbooks/tox/run.yaml
+
 - project:
     name: openstack-dev/devstack
     check:
diff --git a/playbooks/tox/post.yaml b/playbooks/tox/post.yaml
new file mode 100644
index 0000000000..d9e299ff4d
--- /dev/null
+++ b/playbooks/tox/post.yaml
@@ -0,0 +1,5 @@
+- hosts: all
+  roles:
+    - fetch-tox-output
+    - fetch-testr-output
+    - fetch-stestr-output
diff --git a/playbooks/tox/pre.yaml b/playbooks/tox/pre.yaml
new file mode 100644
index 0000000000..d7e4670a80
--- /dev/null
+++ b/playbooks/tox/pre.yaml
@@ -0,0 +1,8 @@
+- hosts: all
+  roles:
+    # Run bindep and test-setup after devstack so that they won't interfere
+    - role: bindep
+      bindep_profile: test
+      bindep_dir: "{{ zuul_work_dir }}"
+    - test-setup
+    - ensure-tox
diff --git a/playbooks/tox/run-both.yaml b/playbooks/tox/run-both.yaml
new file mode 100644
index 0000000000..e85c2eee96
--- /dev/null
+++ b/playbooks/tox/run-both.yaml
@@ -0,0 +1,10 @@
+- hosts: all
+  roles:
+    - run-devstack
+    # Run bindep and test-setup after devstack so that they won't interfere
+    - role: bindep
+      bindep_profile: test
+      bindep_dir: "{{ zuul_work_dir }}"
+    - test-setup
+    - ensure-tox
+    - tox
diff --git a/playbooks/tox/run.yaml b/playbooks/tox/run.yaml
new file mode 100644
index 0000000000..22f82096c7
--- /dev/null
+++ b/playbooks/tox/run.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - tox

From 44a19b4fdceb0d13190b26af04e5092873cd0866 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 11 Dec 2017 18:07:50 -0500
Subject: [PATCH 2147/3333] Clean up Glance config files

The current Glance config files are a combination of copied and
generated files.  This patch makes all the files generated and
removes now unnecssary ini(un)comment statements.  It additionally
removes some ini(un)comment statements that weren't having any
effect on the previously generated files.

Change-Id: I6e4b7694e8bebb7fe6661ead034ee257c768e342
---
 lib/glance | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/lib/glance b/lib/glance
index ad286bacb9..aad4726145 100644
--- a/lib/glance
+++ b/lib/glance
@@ -110,11 +110,9 @@ function configure_glance {
     # Server is configured through this function and not init_glance.
     create_glance_cache_dir
 
-    # Copy over our glance configurations and update them
-    cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
+    # Set non-default configuration options for registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-    inicomment $GLANCE_REGISTRY_CONF DEFAULT log_file
     local dburl
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
@@ -125,8 +123,8 @@ function configure_glance {
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
+    # Set non-default configuration options for the API server
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
@@ -184,11 +182,6 @@ function configure_glance {
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         fi
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
-
-        # commenting is not strictly necessary but it's confusing to have bad values in conf
-        inicomment $GLANCE_API_CONF glance_store swift_store_user
-        inicomment $GLANCE_API_CONF glance_store swift_store_key
-        inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -214,18 +207,13 @@ function configure_glance {
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
-    cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
+    # Set non-default configuration options for the glance-cache
     iniset $GLANCE_CACHE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    inicomment $GLANCE_CACHE_CONF DEFAULT log_file
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
     iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
     iniset $GLANCE_CACHE_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 

From 38a23d901aa1fd55dbe0d57718124c00d4f658cb Mon Sep 17 00:00:00 2001
From: liumk <liumk@rc.inesa.com>
Date: Wed, 13 Dec 2017 15:09:02 +0800
Subject: [PATCH 2148/3333] ceph plugin installation: umount correct device if
 it existed.

The loopback device is created for ceph osd. If the directory
${storage_data_dir} has been mounted when create disk, we should
umount ${storage_data_dir} instead of ${storage_data_dir}/drives/sdb1.

Change-Id: Ie9fe81c820c485dab9f049cf5a81c02424925728
Closes-Bug: #1689089
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 20b83b3cd0..ee35723745 100644
--- a/functions
+++ b/functions
@@ -712,7 +712,7 @@ function create_disk {
     # Create a loopback disk and format it to XFS.
     if [[ -e ${disk_image} ]]; then
         if egrep -q ${storage_data_dir} /proc/mounts; then
-            sudo umount ${storage_data_dir}/drives/sdb1
+            sudo umount ${storage_data_dir}
             sudo rm -f ${disk_image}
         fi
     fi

From 7a8d850dcc31597d80ddecd4c4bbba3dd37914ce Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyammann@gmail.com>
Date: Thu, 14 Dec 2017 09:16:56 +0000
Subject: [PATCH 2149/3333] Add variable to set volume service version on
 tempest

Tempest is going to test volume v3 APIs as default
in gate and running a separate job to run tests on v2 APIs.

To give this ability, this commit provide a var to tell
which API version need to be tested and accordingly it
configure the catalog_type and microversion setting on tempest.

Change-Id: I531f3b32e81ac5d282461597ca286c09429cb143
Needed-By: I0c9193501eb9eaa25eb5f0786bb72eb7855099fb
---
 lib/tempest | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index bdbaaa5678..c7dc19b311 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -422,6 +422,13 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
+    # Set the service catalog entry for Tempest to run on. Typically
+    # used to try different Volume API version targets. The tempest
+    # default it to 'volumev3'(v3 APIs endpoint) , so only set this
+    # if you want to change it.
+    if [[ -n "$TEMPEST_VOLUME_TYPE" ]]; then
+        iniset $TEMPEST_CONFIG volume catalog_type $TEMPEST_VOLUME_TYPE
+    fi
     # Only turn on TEMPEST_VOLUME_MANAGE_SNAPSHOT by default for "lvm" backends
     if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
@@ -443,6 +450,12 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
+    # Reset microversions to None where v2 is running which does not support microversion.
+    # Both "None" means no microversion testing.
+    if [[ "$TEMPEST_VOLUME_TYPE" == "volumev2" ]]; then
+        tempest_volume_min_microversion=None
+        tempest_volume_max_microversion=None
+    fi
     if [ "$tempest_volume_min_microversion" == "None" ]; then
         inicomment $TEMPEST_CONFIG volume min_microversion
     else

From 4187d2fc4adbebf84e5d03e2f5c1c587b4bc9d04 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 18 Dec 2017 11:11:03 -0600
Subject: [PATCH 2150/3333] Add doc/requirements.txt file with doc requirements

The sphinx jobs need to find doc requirements in either
test-requiremnts.txt or doc/requirements.txt. Putting them directly in
to tox.ini, not so much.

Change-Id: I98a43b511a6949fa4f00c26eec224d24d6fa6588
---
 doc/requirements.txt | 10 ++++++++++
 tox.ini              | 19 ++-----------------
 2 files changed, 12 insertions(+), 17 deletions(-)
 create mode 100644 doc/requirements.txt

diff --git a/doc/requirements.txt b/doc/requirements.txt
new file mode 100644
index 0000000000..e140bc0689
--- /dev/null
+++ b/doc/requirements.txt
@@ -0,0 +1,10 @@
+pbr>=2.0.0,!=2.1.0
+
+Pygments
+docutils
+sphinx>=1.6.2
+openstackdocstheme>=1.11.0
+nwdiag
+blockdiag
+sphinxcontrib-blockdiag
+sphinxcontrib-nwdiag
diff --git a/tox.ini b/tox.ini
index 46b15f4cb1..74436b0f26 100644
--- a/tox.ini
+++ b/tox.ini
@@ -34,16 +34,7 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
-deps =
-   Pygments
-   docutils
-   sphinx>=1.6.2
-   pbr>=2.0.0,!=2.1.0
-   openstackdocstheme>=1.11.0
-   nwdiag
-   blockdiag
-   sphinxcontrib-blockdiag
-   sphinxcontrib-nwdiag
+deps = -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
@@ -51,11 +42,5 @@ commands =
   python setup.py build_sphinx
 
 [testenv:venv]
-deps =
-   pbr>=2.0.0,!=2.1.0
-   sphinx>=1.6.2
-   openstackdocstheme>=1.11.0
-   blockdiag
-   sphinxcontrib-blockdiag
-   sphinxcontrib-nwdiag
+deps = -r{toxinidir}/doc/requirements.txt
 commands = {posargs}

From 290d9d87f4e8048078a83c19d056db0c320e1c63 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Mon, 11 Dec 2017 14:30:59 +0000
Subject: [PATCH 2151/3333] Use stage_dir instead of /opt/stack

Historically we have collected devstack logs under /opt/stack.
Stop doing that and collect them in the stage_dir instead, so that
once the base job logs pull service comes around we are ready for it.

This add the benefit of writing things into a folder which is
already owned by the ansible user (ansible_user_dir), so we don't
run into issue writing there.

A few logs (devstack log, log summary and dstat) use to show up on
logs.o.o. just because they happened to already be in /opt/stack/logs.
With this change they would be lost, so adding them to post.yaml.

Depends-on: I5ad4dfccbc1389da3afc53f3c866d3475e006db6

Change-Id: Ib4be2f5056c0dc2b776de4a0d18b47b12624be92
---
 playbooks/post.yaml                              | 16 +++++++++++++---
 roles/apache-logs-conf/README.rst                | 12 ++++++++++++
 roles/export-devstack-journal/README.rst         | 10 ++++++++--
 roles/export-devstack-journal/defaults/main.yaml |  1 +
 roles/export-devstack-journal/tasks/main.yaml    | 14 +++++++++++---
 5 files changed, 45 insertions(+), 8 deletions(-)
 create mode 100644 roles/apache-logs-conf/README.rst

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 95c366975c..aaa5cdd5ae 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -1,14 +1,24 @@
 - hosts: all
   become: True
   vars:
+    devstack_log_dir: "{{ devstack_base_dir|default('/opt/stack') }}/logs/"
     devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
-    stage_dir: "{{ devstack_base_dir|default('/opt/stack') }}"
   roles:
     - export-devstack-journal
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
-          '{{ devstack_conf_dir }}/.stackenv': 'logs' }
+          '{{ devstack_conf_dir }}/.stackenv': 'logs' ,
+          '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
+          '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
+          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs' }
       extensions_to_txt:
         - conf
-    - fetch-devstack-log-dir
+        - log
+        - summary
+    # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
+    # starts pulling logs for us from {{ ansible_user_dir }}/logs.
+    # Meanwhile we already store things in ansible_user_dir and use
+    # fetch-devstack-log-dir setting devstack_base_dir
+    - role: fetch-devstack-log-dir
+      devstack_base_dir: "{{ ansible_user_dir }}"
diff --git a/roles/apache-logs-conf/README.rst b/roles/apache-logs-conf/README.rst
new file mode 100644
index 0000000000..eccee403a5
--- /dev/null
+++ b/roles/apache-logs-conf/README.rst
@@ -0,0 +1,12 @@
+Prepare apache configs and logs for staging
+
+Make sure apache config files and log files are available in a linux flavor
+independent location. Note that this relies on hard links, to the staging
+directory must be in the same partition where the logs and configs are.
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/export-devstack-journal/README.rst b/roles/export-devstack-journal/README.rst
index 5f00592a03..a34e0706a9 100644
--- a/roles/export-devstack-journal/README.rst
+++ b/roles/export-devstack-journal/README.rst
@@ -5,11 +5,17 @@ journal format as well as text.  Also, export a syslog-style file with
 kernal and sudo messages.
 
 Writes the output to the ``logs/`` subdirectory of
-``devstack_base_dir``.
+``stage_dir``.
 
 **Role Variables**
 
 .. zuul:rolevar:: devstack_base_dir
    :default: /opt/stack
 
-   The devstack base directory.
+   The devstack base directory. This is used to obtain the
+   ``log-start-timestamp.txt``, used to filter the systemd journal.
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/export-devstack-journal/defaults/main.yaml b/roles/export-devstack-journal/defaults/main.yaml
index fea05c8146..1fb04fedc8 100644
--- a/roles/export-devstack-journal/defaults/main.yaml
+++ b/roles/export-devstack-journal/defaults/main.yaml
@@ -1 +1,2 @@
 devstack_base_dir: /opt/stack
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index b9af02a591..3efa5755b2 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -1,3 +1,11 @@
+# NOTE(andreaf) This bypasses the stage-output role
+- name: Ensure {{ stage_dir }}/logs exists
+  become: true
+  file:
+    path: "{{ stage_dir }}/logs"
+    state: directory
+    owner: "{{ ansible_user }}"
+
 # TODO: convert this to ansible
 - name: Export journal files
   become: true
@@ -7,7 +15,7 @@
       name=""
       for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
-        journalctl -o short-precise --unit $u | tee {{ devstack_base_dir }}/logs/$name.txt > /dev/null
+        journalctl -o short-precise --unit $u | tee {{ stage_dir }}/logs/$name.txt > /dev/null
       done
 
       # Export the journal in export format to make it downloadable
@@ -16,7 +24,7 @@
       # debugging much easier. We don't do the native conversion here as
       # some distros do not package that tooling.
       journalctl -u 'devstack@*' -o export | \
-          xz --threads=0 - > {{ devstack_base_dir }}/logs/devstack.journal.xz
+          xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
 
       # The journal contains everything running under systemd, we'll
       # build an old school version of the syslog with just the
@@ -26,4 +34,4 @@
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | tee {{ devstack_base_dir }}/logs/syslog.txt > /dev/null
+        | tee {{ stage_dir }}/logs/syslog.txt > /dev/null

From 71bf831a906a02c9801500bcabd4ee2b9c773f22 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Thu, 14 Dec 2017 20:35:38 +0000
Subject: [PATCH 2152/3333] Add a few more devstack confs and logs

Add localrc for places where it may be still used.
Collect verify_tempest_conf.

Change-Id: I733c6472e8452ed6fc04c6de1c170713812a436f
---
 playbooks/post.yaml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index aaa5cdd5ae..f5f189ddc5 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -3,18 +3,34 @@
   vars:
     devstack_log_dir: "{{ devstack_base_dir|default('/opt/stack') }}/logs/"
     devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
+  tasks:
+    # NOTE(andreaf) If the tempest service is enabled, a tempest.log is
+    # generated as part of lib/tempest, as a result of verify_tempest_config
+    - name: Check if a tempest log exits
+      stat:
+        path: "{{ devstack_conf_dir }}/tempest.log"
+      register: tempest_log
+    - name: Link post-devstack tempest.log
+      file:
+        src: "{{ devstack_conf_dir }}/tempest.log"
+        dest: "{{ stage_dir }}/verify_tempest_conf.log"
+        state: hard
+      when: tempest_log.stat.exists
   roles:
     - export-devstack-journal
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
+          '{{ devstack_conf_dir }}/localrc': 'logs',
           '{{ devstack_conf_dir }}/.stackenv': 'logs' ,
           '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
-          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs' }
+          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
+          '{{ stage_dir }}/verify_tempest_conf.log': 'logs' }
       extensions_to_txt:
         - conf
         - log
+        - localrc
         - summary
     # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
     # starts pulling logs for us from {{ ansible_user_dir }}/logs.

From b7f8624bed8aabf52a0fbb5ac73a9fdd41400273 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Thu, 14 Dec 2017 16:08:51 +0000
Subject: [PATCH 2153/3333] Setup devstack-early log

The whole devstack log is written into the console output
(job-output.txt) and into devstacklog.txt.

Remove it from job-output and add a devstack-early log file (same as in
legacy job) that includes all the output of stack.sh.

Make sure the log file is pulled into the stage folder so that it will
end up on logs.o.o.

Change-Id: Ia7c1d8fe5cc03d15f455c6e62ebf4a5f6d62ab1f
---
 playbooks/post.yaml                   | 2 ++
 roles/run-devstack/README.rst         | 6 ++++++
 roles/run-devstack/defaults/main.yaml | 1 +
 roles/run-devstack/tasks/main.yaml    | 2 +-
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index f5f189ddc5..d99ec10bfe 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -3,6 +3,7 @@
   vars:
     devstack_log_dir: "{{ devstack_base_dir|default('/opt/stack') }}/logs/"
     devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
+    devstack_full_log: "{{ devstack_early_log|default('/opt/stack/logs/devstack-early.txt') }}"
   tasks:
     # NOTE(andreaf) If the tempest service is enabled, a tempest.log is
     # generated as part of lib/tempest, as a result of verify_tempest_config
@@ -26,6 +27,7 @@
           '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
+          '{{ devstack_full_log}}': 'logs',
           '{{ stage_dir }}/verify_tempest_conf.log': 'logs' }
       extensions_to_txt:
         - conf
diff --git a/roles/run-devstack/README.rst b/roles/run-devstack/README.rst
index d77eb15e99..e53f060602 100644
--- a/roles/run-devstack/README.rst
+++ b/roles/run-devstack/README.rst
@@ -6,3 +6,9 @@ Run devstack
    :default: /opt/stack
 
    The devstack base directory.
+
+.. zuul:rolevar:: devstack_early_log
+   :default: /opt/stack/log/devstack-early.txt
+
+   The full devstack log that includes the whatever stack.sh logs before
+   the LOGFILE variable in local.conf is honoured.
diff --git a/roles/run-devstack/defaults/main.yaml b/roles/run-devstack/defaults/main.yaml
index fea05c8146..dc4528f692 100644
--- a/roles/run-devstack/defaults/main.yaml
+++ b/roles/run-devstack/defaults/main.yaml
@@ -1 +1,2 @@
 devstack_base_dir: /opt/stack
+devstack_early_log: /opt/stack/logs/devstack-early.txt
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index bafebafd65..f53212904a 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -1,5 +1,5 @@
 - name: Run devstack
-  command: ./stack.sh
+  shell: ./stack.sh 2>&1 {{ devstack_early_log }}
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From 9c977b56eb74944b45b0f0513ac36347b526c096 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 8 Dec 2017 17:41:40 +0000
Subject: [PATCH 2154/3333] Stage apache logs

Add apache logs to the list of things we stage.

Change-Id: I9d3d8e710ae87a71b74f96538cad6fad58dbef79
---
 playbooks/post.yaml                       |  5 +-
 roles/apache-logs-conf/defaults/main.yaml |  2 +
 roles/apache-logs-conf/tasks/main.yaml    | 80 +++++++++++++++++++++++
 3 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 roles/apache-logs-conf/defaults/main.yaml
 create mode 100644 roles/apache-logs-conf/tasks/main.yaml

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index d99ec10bfe..40c39beb69 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -19,6 +19,7 @@
       when: tempest_log.stat.exists
   roles:
     - export-devstack-journal
+    - apache-logs-conf
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
@@ -28,7 +29,9 @@
           '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
           '{{ devstack_full_log}}': 'logs',
-          '{{ stage_dir }}/verify_tempest_conf.log': 'logs' }
+          '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
+          '{{ stage_dir }}/apache': 'logs',
+          '{{ stage_dir }}/apache_config': 'logs' }
       extensions_to_txt:
         - conf
         - log
diff --git a/roles/apache-logs-conf/defaults/main.yaml b/roles/apache-logs-conf/defaults/main.yaml
new file mode 100644
index 0000000000..1fb04fedc8
--- /dev/null
+++ b/roles/apache-logs-conf/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
new file mode 100644
index 0000000000..7fd490ea4c
--- /dev/null
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -0,0 +1,80 @@
+- name: Ensure {{ stage_dir }}/apache exists
+  file:
+    path: "{{ stage_dir }}/apache"
+    state: directory
+
+- name: Link apache logs on Debian/SuSE
+  block:
+  - name: Find logs
+    find:
+      path: "/var/log/apache2"
+      file_type: any
+    register: debian_suse_apache_logs
+  - name: Dereference files
+    stat:
+      path: "{{ item.path }}"
+    with_items: "{{ debian_suse_apache_logs.files }}"
+    register: debian_suse_apache_deref_logs
+  - name: Create hard links
+    file:
+      src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
+      dest: "{{ stage_dir }}/apache/{{ item.stat.path | basename }}"
+      state: hard
+    with_items: "{{ debian_suse_apache_deref_logs.results }}"
+    when:
+      - item.stat.isreg or item.stat.islnk
+  when: ansible_os_family in ('Debian', 'Suse')
+
+- name: Link apache logs on RedHat
+  block:
+  - name: Find logs
+    find:
+      path: "/var/log/httpd"
+      file_type: any
+    register: redhat_apache_logs
+  - name: Dereference files
+    stat:
+      path: "{{ item.path }}"
+    with_items: "{{ redhat_apache_logs.files }}"
+    register: redhat_apache_deref_logs
+  - name: Create hard links
+    file:
+      src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
+      dest: "{{ stage_dir }}/apache/{{ item.stat.path | basename }}"
+      state: hard
+    with_items: "{{ redhat_apache_deref_logs.results }}"
+    when:
+      - item.stat.isreg or item.stat.islnk
+  when: ansible_os_family == 'Redhat'
+
+- name: Ensure {{ stage_dir }}/apache_config apache_config exists
+  file:
+    path: "{{ stage_dir }}/apache_config"
+    state: directory
+
+- name: Define config paths
+  set_fact:
+    apache_config_paths:
+      'Debian': '/etc/apache2/sites-enabled/'
+      'Suse': '/etc/apache2/conf.d/'
+      'Redhat': '/etc/httpd/conf.d/'
+
+- name: Discover configurations
+  find:
+    path: "{{ apache_config_paths[ansible_os_family] }}"
+    file_type: any
+  register: apache_configs
+
+- name: Dereference configurations
+  stat:
+    path: "{{ item.path }}"
+  with_items: "{{ apache_configs.files }}"
+  register: apache_configs_deref
+
+- name: Link configurations
+  file:
+    src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
+    dest: "{{ stage_dir }}/apache_config/{{ item.stat.path | basename }}"
+    state: hard
+  with_items: "{{ apache_configs_deref.results }}"
+  when: item.stat.isreg or item.stat.islnk

From d04658eb50d7e1f59625039deaef17208a0c9eb9 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 8 Dec 2017 17:52:29 +0000
Subject: [PATCH 2155/3333] Stage rabbitmq and DB logs

Stage rabbitmq and DB logs so they are copied to logs.o.o

Change-Id: Ica8a86c2649b2871f366e3ca48a8b47f455879bc
---
 playbooks/post.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 40c39beb69..fd30bdbf2a 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -31,7 +31,11 @@
           '{{ devstack_full_log}}': 'logs',
           '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
           '{{ stage_dir }}/apache': 'logs',
-          '{{ stage_dir }}/apache_config': 'logs' }
+          '{{ stage_dir }}/apache_config': 'logs',
+          '/var/log/rabbitmq': 'logs',
+          '/var/log/postgresql': 'logs',
+          '/var/log/mysql.err': 'logs',
+          '/var/log/mysql.log': 'logs' }
       extensions_to_txt:
         - conf
         - log

From e6b0169a0207bed66ae7bec683b5a7a816e1dd13 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 8 Dec 2017 18:19:23 +0000
Subject: [PATCH 2156/3333] Stage libvirt logs and sudoers

Stage libvirt logs and sudoers configuration.

Change-Id: I46112c52f05c6015a9f397eda130404beeb5e899
---
 playbooks/post.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index fd30bdbf2a..ee8a87820e 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -35,7 +35,10 @@
           '/var/log/rabbitmq': 'logs',
           '/var/log/postgresql': 'logs',
           '/var/log/mysql.err': 'logs',
-          '/var/log/mysql.log': 'logs' }
+          '/var/log/mysql.log': 'logs',
+          '/var/log/libvirt': 'logs',
+          '/etc/sudoers': 'logs',
+          '/etc/sudoers.d': 'logs' }
       extensions_to_txt:
         - conf
         - log

From 5a9872a9b90c06cddbbd4a18b16e715e3db9a939 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 15 Dec 2017 13:55:50 +0000
Subject: [PATCH 2157/3333] Stage openstack config files

Stage config files from openstack and all projects used by the
devstack run.

Change-Id: I99f1bc71856b0da7fc5b438d13d4f508d2341e44
---
 playbooks/post.yaml                           |  2 ++
 roles/devstack-project-conf/README.rst        | 11 +++++++++
 .../devstack-project-conf/defaults/main.yaml  |  1 +
 roles/devstack-project-conf/tasks/main.yaml   | 24 +++++++++++++++++++
 4 files changed, 38 insertions(+)
 create mode 100644 roles/devstack-project-conf/README.rst
 create mode 100644 roles/devstack-project-conf/defaults/main.yaml
 create mode 100644 roles/devstack-project-conf/tasks/main.yaml

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index ee8a87820e..36023a625a 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -20,6 +20,7 @@
   roles:
     - export-devstack-journal
     - apache-logs-conf
+    - devstack-project-conf
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
@@ -32,6 +33,7 @@
           '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
           '{{ stage_dir }}/apache': 'logs',
           '{{ stage_dir }}/apache_config': 'logs',
+          '{{ stage_dir }}/etc': 'logs',
           '/var/log/rabbitmq': 'logs',
           '/var/log/postgresql': 'logs',
           '/var/log/mysql.err': 'logs',
diff --git a/roles/devstack-project-conf/README.rst b/roles/devstack-project-conf/README.rst
new file mode 100644
index 0000000000..3f2d4c9697
--- /dev/null
+++ b/roles/devstack-project-conf/README.rst
@@ -0,0 +1,11 @@
+Prepare OpenStack project configurations for staging
+
+Prepare all relevant config files for staging.
+This is helpful to avoid staging the entire /etc.
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/devstack-project-conf/defaults/main.yaml b/roles/devstack-project-conf/defaults/main.yaml
new file mode 100644
index 0000000000..f8fb8deac9
--- /dev/null
+++ b/roles/devstack-project-conf/defaults/main.yaml
@@ -0,0 +1 @@
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/devstack-project-conf/tasks/main.yaml b/roles/devstack-project-conf/tasks/main.yaml
new file mode 100644
index 0000000000..9c6e06bea9
--- /dev/null
+++ b/roles/devstack-project-conf/tasks/main.yaml
@@ -0,0 +1,24 @@
+- name: Ensure {{ stage_dir }}/etc exists
+  file:
+    path: "{{ stage_dir }}/etc"
+    state: directory
+
+- name: Check which projects have a config folder
+  stat:
+    path: "/etc/{{ item.value.short_name }}"
+  with_dict: "{{ zuul.projects }}"
+  register: project_configs
+
+- name: Copy configuration files
+  command: cp -pRL {{ item.stat.path }} {{ stage_dir }}/etc/{{ item.item.value.short_name }}
+  when: item.stat.exists
+  with_items: "{{ project_configs.results }}"
+
+- name: Check if openstack has a config folder
+  stat:
+    path: "/etc/openstack"
+  register: openstack_configs
+
+- name: Copy configuration files
+  command: cp -pRL /etc/openstack {{ stage_dir }}/etc/
+  when: openstack_configs.stat.exists

From a2b174168a5d9bd3558e60297bea9dd91f39a546 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 15 Dec 2017 17:35:31 +0000
Subject: [PATCH 2158/3333] Stage a number of system type logs

This could be ansiblesed a more, for now more or less the bash code
from d-g wrapped in a role.

Change-Id: Ia7fe40f05ca394da9a65fef6383d72f29a532e2f
---
 playbooks/post.yaml                          | 19 +++++++++-
 roles/capture-system-logs/README.rst         | 20 +++++++++++
 roles/capture-system-logs/defaults/main.yaml |  1 +
 roles/capture-system-logs/tasks/main.yaml    | 38 ++++++++++++++++++++
 4 files changed, 77 insertions(+), 1 deletion(-)
 create mode 100644 roles/capture-system-logs/README.rst
 create mode 100644 roles/capture-system-logs/defaults/main.yaml
 create mode 100644 roles/capture-system-logs/tasks/main.yaml

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 36023a625a..41d3c54121 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -21,6 +21,8 @@
     - export-devstack-journal
     - apache-logs-conf
     - devstack-project-conf
+    # capture-system-logs should be the last role before stage-output
+    - capture-system-logs
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
@@ -40,7 +42,22 @@
           '/var/log/mysql.log': 'logs',
           '/var/log/libvirt': 'logs',
           '/etc/sudoers': 'logs',
-          '/etc/sudoers.d': 'logs' }
+          '/etc/sudoers.d': 'logs',
+          '{{ stage_dir }}/iptables.txt': 'logs',
+          '{{ stage_dir }}/df.txt': 'logs',
+          '{{ stage_dir }}/pip2-freeze.txt': 'logs',
+          '{{ stage_dir }}/pip3-freeze.txt': 'logs',
+          '{{ stage_dir }}/dpkg-l.txt': 'logs',
+          '{{ stage_dir }}/rpm-qa.txt': 'logs',
+          '{{ stage_dir }}/core': 'logs',
+          '{{ stage_dir }}/listen53.txt': 'logs',
+          '{{ stage_dir }}/deprecations.log': 'logs',
+          '/var/log/ceph': 'logs',
+          '/var/log/openvswitch': 'logs',
+          '/var/log/glusterfs': 'logs',
+          '/etc/glusterfs/glusterd.vol': 'logs',
+          '/etc/resolv.conf': 'logs',
+          '/var/log/unbound.log': 'logs' }
       extensions_to_txt:
         - conf
         - log
diff --git a/roles/capture-system-logs/README.rst b/roles/capture-system-logs/README.rst
new file mode 100644
index 0000000000..c28412457a
--- /dev/null
+++ b/roles/capture-system-logs/README.rst
@@ -0,0 +1,20 @@
+Stage a number of system type logs
+
+Stage a number of different logs / reports:
+- snapshot of iptables
+- disk space available
+- pip[2|3] freeze
+- installed packages (dpkg/rpm)
+- ceph, openswitch, gluster
+- coredumps
+- dns resolver
+- listen53
+- unbound.log
+- deprecation messages
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/capture-system-logs/defaults/main.yaml b/roles/capture-system-logs/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/capture-system-logs/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
new file mode 100644
index 0000000000..cd8f4f0eab
--- /dev/null
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -0,0 +1,38 @@
+# TODO(andreaf) Make this into proper Ansible
+- name: Stage various logs and reports
+  shell:
+    cmd: |
+      sudo iptables-save > {{ stage_dir }}/iptables.txt
+      df -h > {{ stage_dir }}/df.txt
+
+      for py_ver in 2 3; do
+          if [[ `which python${py_ver}` ]]; then
+              python${py_ver} -m pip freeze > {{ stage_dir }}/pip${py_ver}-freeze.txt
+          fi
+      done
+
+      if [ `command -v dpkg` ]; then
+          dpkg -l> {{ stage_dir }}/dpkg-l.txt
+      fi
+      if [ `command -v rpm` ]; then
+          rpm -qa | sort > {{ stage_dir }}/rpm-qa.txt
+      fi
+
+      # gzip and save any coredumps in /var/core
+      if [ -d /var/core ]; then
+          sudo gzip -r /var/core
+          sudo cp -r /var/core {{ stage_dir }}/
+      fi
+
+      sudo ss -lntup | grep ':53' > {{ stage_dir }}/listen53.txt
+
+      # NOTE(andreaf) Service logs are already in logs/ thanks for the
+      # export-devstack-journal log. Apache logs are under apache/ thans to the
+      # apache-logs-conf role.
+      grep -i deprecat {{ stage_dir }}/logs/*.txt {{ stage_dir }}/apache/*.log | \
+          sed -r 's/[0-9]{1,2}\:[0-9]{1,2}\:[0-9]{1,2}\.[0-9]{1,3}/ /g' | \
+          sed -r 's/[0-9]{1,2}\:[0-9]{1,2}\:[0-9]{1,2}/ /g' | \
+          sed -r 's/[0-9]{1,4}-[0-9]{1,2}-[0-9]{1,4}/ /g' |
+          sed -r 's/\[.*\]/ /g' | \
+          sed -r 's/\s[0-9]+\s/ /g' | \
+          awk '{if ($0 in seen) {seen[$0]++} else {out[++n]=$0;seen[$0]=1}} END { for (i=1; i<=n; i++) print seen[out[i]]" :: " out[i] }' > {{ stage_dir }}/deprecations.log

From b040af4d85c695ba4da210eb714b053d8aa834ad Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 20 Dec 2017 06:18:43 +0000
Subject: [PATCH 2159/3333] Updated from generate-devstack-plugins-list

Change-Id: Ib7ed514446fbb39f87369fa941dfa87c28046942
---
 doc/source/plugin-registry.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 43dd3c2eae..907671adc8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,7 +26,6 @@ Plugin Name                            URL
 ====================================== ===
 almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
-app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
@@ -127,6 +126,7 @@ networking-ovs-dpdk                    `git://git.openstack.org/openstack/networ
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
 networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-spp                         `git://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
 networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
@@ -135,6 +135,7 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
+neutron-tempest-plugin                 `git://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 neutron-vpnaas-dashboard               `git://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__

From 49f3cc76bffaa09c710212ef6779943071bb050d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 11 Dec 2017 09:24:15 +0000
Subject: [PATCH 2160/3333] Make stackenv file visible

The file won't be listed as long as it is called .stackenv.txt.gz, with
this it will be called _stackenv.txt.gz instead.

Change-Id: Ib3b44c287ffb2ec0e48fefef1662a1c02d162657
---
 playbooks/post.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 36023a625a..a2f695cb21 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -45,6 +45,7 @@
         - conf
         - log
         - localrc
+        - stackenv
         - summary
     # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
     # starts pulling logs for us from {{ ansible_user_dir }}/logs.

From f0636bac05dfb1c963cc1eda2832259075127809 Mon Sep 17 00:00:00 2001
From: Harald Jensas <hjensas@redhat.com>
Date: Wed, 20 Dec 2017 12:07:40 +0100
Subject: [PATCH 2161/3333] Fixing a typo - internationalized

Assuming confusingness a few lines down is intentional ...

Change-Id: I3bd18aa32e1166bb1012ac65e83461b75be4f006
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index a125d4a0d7..ee857c516f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -32,7 +32,7 @@ unset GREP_OPTIONS
 # Devstack is written in bash, and many functions used throughout
 # devstack process text coming off a command (like the ip command)
 # and do transforms using grep, sed, cut, awk on the strings that are
-# returned. Many of these programs are interationalized, which is
+# returned. Many of these programs are internationalized, which is
 # great for end users, but means that the strings that devstack
 # functions depend upon might not be there in other locales. We thus
 # need to pin the world to an english basis during the runs.

From 421753f71d1e2e88b55dcbe58672395afbeced87 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 20 Dec 2017 08:31:15 -0600
Subject: [PATCH 2162/3333] Switch to consolidated fetch-subunit-output role

fetch-testr-output and fetch-stestr-output are being merged.

Change-Id: I00d448c4e6b98a1f504b048c74eff4e110c0b511
Depends-On: I833320cf9a932d8e119645eb798ce0c93d854321
---
 playbooks/tox/post.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/playbooks/tox/post.yaml b/playbooks/tox/post.yaml
index d9e299ff4d..7f0cb19824 100644
--- a/playbooks/tox/post.yaml
+++ b/playbooks/tox/post.yaml
@@ -1,5 +1,4 @@
 - hosts: all
   roles:
     - fetch-tox-output
-    - fetch-testr-output
-    - fetch-stestr-output
+    - fetch-subunit-output

From 6a25fb96c1e2c00ec2ec2c2b456d549c092ae495 Mon Sep 17 00:00:00 2001
From: bhagyashris <bhagyashri.shewale@nttdata.com>
Date: Thu, 14 Dec 2017 13:23:41 +0530
Subject: [PATCH 2163/3333] Initialize newly added glance-image-import config
 file

This patch creates a new config file glance-image-import.conf
at /etc/glance path. Also, each config option is initialized
with default values.

Need these changes to implement specs [1]:

[1]: https://blueprints.launchpad.net/glance/+spec/inject-automatic-metadata

Related-Change-Id: If14c7dc4f38360006f9cb350fbba54fa2f33be61
Change-Id: I665507db1838a50e344d3be909d7490f1f52040c
---
 lib/glance | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/glance b/lib/glance
index ad286bacb9..95d2450da7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -56,6 +56,7 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
+GLANCE_IMAGE_IMPORT_CONF=$GLANCE_CONF_DIR/glance-image-import.conf
 GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_service_enabled tls-proxy; then
@@ -232,6 +233,11 @@ function configure_glance {
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
+    # Set default configuration options for the glance-image-import
+    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins []
+    iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
+    iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
+
     cp -p $GLANCE_DIR/etc/policy.json $GLANCE_POLICY_JSON
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
 

From f6d566c21d0b33344e58fcbc9ec388d7503570da Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 22 Dec 2017 11:39:29 -0500
Subject: [PATCH 2164/3333] Configure nova_cell1.conf to use placement for
 reschedules

Nova now calculates alternate hosts in the scheduler and
sends those to the cell for reschedules in case a build on
a given compute node fails.

The cell conductor needs to claim resources against the
alternate hosts in Placement during a reschedule, therefore
it needs to be configured to talk to the placement service.

Part of blueprint return-alternate-hosts

Change-Id: Ie599968d9e7537e551fe6d9deb63a91b256b1e11
---
 lib/nova      |  6 ++++++
 lib/placement | 18 ++++++++++--------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/lib/nova b/lib/nova
index 50deeeb220..c40c43af6c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -600,6 +600,12 @@ function create_nova_conf {
             else
                 rpc_backend_add_vhost $vhost
                 iniset_rpc_backend nova $conf DEFAULT $vhost
+                # When running in superconductor mode, the cell conductor
+                # must be configured to talk to the placement service for
+                # reschedules to work.
+                if is_service_enabled placement placement-client; then
+                    configure_placement_nova_compute $conf
+                fi
             fi
             # Format logging
             setup_logging $conf
diff --git a/lib/placement b/lib/placement
index 1875857552..1d68f8a185 100644
--- a/lib/placement
+++ b/lib/placement
@@ -103,14 +103,16 @@ function _config_placement_apache_wsgi {
 }
 
 function configure_placement_nova_compute {
-    iniset $NOVA_CONF placement auth_type "password"
-    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF placement username placement
-    iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF placement os_region_name "$REGION_NAME"
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+    iniset $conf placement auth_type "password"
+    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $conf placement username placement
+    iniset $conf placement password "$SERVICE_PASSWORD"
+    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
+    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the
     # placement api uses the auth_strategy configuration setting

From b4d772b9fdb00fbdec1304ce6fbeafaa77915071 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sat, 23 Dec 2017 20:17:33 +0100
Subject: [PATCH 2165/3333] devstack job: Add irrelevant-files

Do not run devstack and its siblings if only rst files, releasenotes, or
files in doc directory change.

This is the minimal set of irrelevant files shared by most projects
already.

Needed-By: Ie8504ba3d5d46f6338a228ed2d248ba6363e37ae
Change-Id: Id0095763eb91592c2fd1a913526883987df704bd
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index a699dbaa7d..037e9a9ea8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -80,6 +80,14 @@
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
+    irrelevant-files:
+      # Documentation related
+      - ^.*\.rst$
+      - ^api-ref/.*$
+      - ^doc/.*$
+      - ^releasenotes/.*$
+      # Translations
+      - ^.*/locale/.*po$
 
 - job:
     name: devstack-multinode

From f8dc558486fdb484b31338aa30933e33c061638c Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Sun, 24 Dec 2017 08:17:01 +0900
Subject: [PATCH 2166/3333] Drop django_openstack_auth related code

In Queens cycle, the code of django_openstack_auth was merged into
the horizon repository. The master branch of django_openstack_auth
will be retired. (horizon blueprint merge-openstack-auth)
This commit drops django_openstack_auth related code from DevStack.

_prepare_message_catalog_compilation in lib/horizon was used only
in install_django_openstack_auth, so it is dropped too.

Change-Id: If9467c520a1e07d1968b29e485df0097330356bc
---
 lib/horizon                  | 24 ------------------------
 stack.sh                     |  2 --
 stackrc                      |  4 ----
 tests/test_libs_from_pypi.sh |  2 +-
 4 files changed, 1 insertion(+), 31 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 3d2f68d09d..fab41bbeca 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -26,9 +26,6 @@ set +o xtrace
 # Defaults
 # --------
 
-# Set up default directories
-GITDIR["django_openstack_auth"]=$DEST/django_openstack_auth
-
 HORIZON_DIR=$DEST/horizon
 
 # local_settings.py is used to customize Dashboard settings.
@@ -159,20 +156,6 @@ function init_horizon {
 
 }
 
-# install_django_openstack_auth() - Collect source and prepare
-function install_django_openstack_auth {
-    if use_library_from_git "django_openstack_auth"; then
-        local dir=${GITDIR["django_openstack_auth"]}
-        git_clone_by_name "django_openstack_auth"
-        # Compile message catalogs before installation
-        _prepare_message_catalog_compilation
-        (cd $dir; $PYTHON setup.py compile_catalog)
-        setup_dev_lib "django_openstack_auth"
-    fi
-    # if we aren't using this library from git, then we just let it
-    # get dragged in by the horizon setup.
-}
-
 # install_horizon() - Collect source and prepare
 function install_horizon {
     # Apache installation, because we mark it NOPRIME
@@ -191,13 +174,6 @@ function stop_horizon {
     stop_apache_server
 }
 
-# NOTE: It can be moved to common functions, but it is only used by compilation
-# of django_openstack_auth catalogs at the moment.
-function _prepare_message_catalog_compilation {
-    pip_install_gr Babel
-}
-
-
 # Restore xtrace
 $_XTRACE_HORIZON
 
diff --git a/stack.sh b/stack.sh
index a125d4a0d7..db7261a380 100755
--- a/stack.sh
+++ b/stack.sh
@@ -894,8 +894,6 @@ if is_service_enabled placement placement-client; then
 fi
 
 if is_service_enabled horizon; then
-    # django openstack_auth
-    install_django_openstack_auth
     # dashboard
     stack_install_service horizon
 fi
diff --git a/stackrc b/stackrc
index 286a04d3fe..7d5c75df41 100644
--- a/stackrc
+++ b/stackrc
@@ -500,10 +500,6 @@ GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
 GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
 
-# django openstack_auth library
-GITREPO["django_openstack_auth"]=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/django_openstack_auth.git}
-GITBRANCH["django_openstack_auth"]=${HORIZONAUTH_BRANCH:-master}
-
 # keystone middleware
 GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
 GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 0bd8d49357..a544b56577 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -35,7 +35,7 @@ ALL_LIBS+=" python-glanceclient python-ironicclient"
 ALL_LIBS+=" oslo.messaging oslo.log cliff stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
-ALL_LIBS+=" oslo.serialization django_openstack_auth"
+ALL_LIBS+=" oslo.serialization"
 ALL_LIBS+=" python-openstackclient osc-lib osc-placement"
 ALL_LIBS+=" os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"

From 7b1b6f3446965dda570806dfab06538e6796012e Mon Sep 17 00:00:00 2001
From: Takashi NATSUME <natsume.takashi@lab.ntt.co.jp>
Date: Wed, 20 Dec 2017 11:38:23 +0900
Subject: [PATCH 2167/3333] Fix that DISTRO is not set in unstack.sh

Change-Id: I36cab41fdb767e8e31073a4fa1f929090f702910
Closes-Bug: #1738938
---
 unstack.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index 5d3672e25d..ccea0ef585 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -45,6 +45,10 @@ fi
 # Configure Projects
 # ==================
 
+# Determine what system we are running on.  This provides ``os_VENDOR``,
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME`` and ``DISTRO``
+GetDistro
+
 # Plugin Phase 0: override_defaults - allow plugins to override
 # defaults before other services are run
 run_phase override_defaults
@@ -83,10 +87,6 @@ fi
 
 load_plugin_settings
 
-# Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
-GetOSVersion
-
 set -o xtrace
 
 # Run extras

From b3ed561c7af82fabc4a46ff0affcb71737b23a3d Mon Sep 17 00:00:00 2001
From: Toshiaki Takahashi <takahashi.tsc@ncos.nec.co.jp>
Date: Thu, 4 Jan 2018 02:15:08 +0900
Subject: [PATCH 2168/3333] Fix "Centos" to official notation "CentOS".

Change-Id: I2f76fe3a19cd2ebf004d0a7c14852f20f3dadd9e
---
 doc/source/overview.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index c07a8e6d67..814a2b148b 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -24,7 +24,7 @@ release.*
 
 -  Ubuntu: current LTS release plus current development release
 -  Fedora: current release plus previous release
--  RHEL/Centos: current major release
+-  RHEL/CentOS: current major release
 -  Other OS platforms may continue to be included but the maintenance of
    those platforms shall not be assumed simply due to their presence.
    Having a listed point-of-contact for each additional OS will greatly

From 2700bf88a549088285bef41fe86ac323965c8727 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 4 Jan 2018 10:16:16 -0800
Subject: [PATCH 2169/3333] Gzip openstack service logs

These files are quite large and disk space is limited so make sure we
compress the log files before copying them to storage. Additionally
os-loganalyze will only operate on gzipped log files so this should fix
os-loganalyze with tempest-full job's logs.

This is mostly a check to confirm everything works as expected but we
probably want to move the gzip step into the log publication roles so
that all log files end up compressed.

Change-Id: Ie87962428e0ca755c211cc5e664a14a9f2a79ac4
---
 roles/export-devstack-journal/tasks/main.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index 3efa5755b2..6e760c1f6f 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -15,7 +15,7 @@
       name=""
       for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
-        journalctl -o short-precise --unit $u | tee {{ stage_dir }}/logs/$name.txt > /dev/null
+        journalctl -o short-precise --unit $u | gzip - > {{ stage_dir }}/logs/$name.txt.gz
       done
 
       # Export the journal in export format to make it downloadable
@@ -34,4 +34,4 @@
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | tee {{ stage_dir }}/logs/syslog.txt > /dev/null
+        | gzip - > {{ stage_dir }}/logs/syslog.txt.gz

From c396355befb37d31ee8118fb5994aed63b139843 Mon Sep 17 00:00:00 2001
From: Hunt Xu <mhuntxu@gmail.com>
Date: Mon, 8 Jan 2018 16:11:33 +0800
Subject: [PATCH 2170/3333] Use "ip neigh" instead of "arp -n" in worlddump.py

Worlddumping on a system without net-tools package gets an error showing
"arp: not found". As iproute2 can also show arp tables, we use it
instead.

Change-Id: I0cd83e6d14959dc5a1147c487b11f27fb92aa20a
---
 tools/worlddump.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 6fff1497a7..750608210a 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -164,8 +164,7 @@ def network_dump():
     _header("Network Dump")
 
     _dump_cmd("brctl show")
-    _dump_cmd("arp -n")
-    ip_cmds = ["addr", "link", "route"]
+    ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():

From fabaa991ca28a181909b420701bbd8e195177814 Mon Sep 17 00:00:00 2001
From: Shachar Snapiri <shachar@snapiri.net>
Date: Wed, 6 Dec 2017 14:45:06 +0200
Subject: [PATCH 2171/3333] Added the ability to specify checksum for etcd

It is possibe for the user to override te etcd version, thus download a
different etcd file, but the checksum is constant, so the checksum
verification will fail in that case.
Added the ability to specify a different checksum, so the user would be
able to specify the new version checksum

Change-Id: I85af3af841ae957964f18d4e37a86ab0703882bc
Closes-Bug: #1736718
---
 stackrc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stackrc b/stackrc
index 286a04d3fe..d344981c75 100644
--- a/stackrc
+++ b/stackrc
@@ -720,11 +720,11 @@ EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
 ETCD_VERSION=${ETCD_VERSION:-v3.1.10}
-ETCD_SHA256_AMD64="2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"}
 # NOTE(sdague): etcd v3.1.10 doesn't have anything for these architectures, though 3.2.x does.
-ETCD_SHA256_ARM64=""
-ETCD_SHA256_PPC64=""
-ETCD_SHA256_S390X=""
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-""}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-""}
+ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"

From fe4c3cfcf54f863ec10f970805528f9d3d0cc750 Mon Sep 17 00:00:00 2001
From: Shachar Snapiri <shachar.snapiri@huawei.com>
Date: Tue, 19 Sep 2017 09:52:00 +0300
Subject: [PATCH 2172/3333] Modified the subnet-range parameter to be optional

The subnet-range parameter is only sent now if a valid value exists so
the command will not fail

Change-Id: I5296f5b59bc6d3d3db90a685a8678db9a156eece
Closes-Bug: #1718111
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 98315b7dd3..41a467df4c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -188,7 +188,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID --subnet-range $fixed_range_v4 | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -198,7 +198,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID --subnet-range $fixed_range_v6 | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 

From b9891eea1f981fa51682f2c94f8e04f047f3dec4 Mon Sep 17 00:00:00 2001
From: Victor Stinner <vstinner@redhat.com>
Date: Mon, 8 Jan 2018 15:20:36 +0100
Subject: [PATCH 2173/3333] Fix Python3 get_python_exec_prefix on Fedora 27

On Fedora 27, the default Pytho 3 install prefix changed from /usr
to /usr/local:
https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe

Closes-Bug: #1741901
Change-Id: Id40620efdf173189df053b5d380a801092933f83
---
 inc/python | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 2e4eff02ea..e074ea498f 100644
--- a/inc/python
+++ b/inc/python
@@ -49,7 +49,11 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if is_fedora || is_suse; then
+    if python3_enabled && [ "$os_VENDOR" = "Fedora" -a $os_RELEASE -gt 26 ]; then
+        # Default Python 3 install prefix changed to /usr/local in Fedora 27:
+        # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+        echo "/usr/local/bin"
+    elif is_fedora || is_suse; then
         echo "/usr/bin"
     else
         echo "/usr/local/bin"

From 9aaa529f65011e4bfa649043c35ee808970dc426 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Wed, 20 Sep 2017 14:23:05 -0400
Subject: [PATCH 2174/3333] Add DVR support to lib/neutron

Added NEUTRON_DISTRIBUTED_ROUTING to more easily control DVR
configuration.  If set to True, DVR will be enabled and the
default agent mode will be set to 'dvr_snat' since that works
with all types of routers by default.  Advanced users can
override that by setting NEUTRON_DVR_MODE, for example in
multi-node configurations where different agent modes are
desired.

This should bring lib/neutron inline with lib/neutron-legacy
in supporting all the different DVR modes.

Change-Id: I9f25921eefc5b935aad3bb1edc5e41ee0ce43a84
---
 lib/neutron | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c5839f5c3e..d33b49e890 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -32,6 +32,17 @@ NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
+NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
+# Distributed Virtual Router (DVR) configuration
+# Can be:
+# - ``legacy``          - No DVR functionality
+# - ``dvr_snat``        - Controller or single node DVR
+# - ``dvr``             - Compute node in multi-node DVR
+# - ``dvr_no_external`` - Compute node in multi-node DVR, no external network
+#
+# Default is 'dvr_snat' since it can handle both DVR and legacy routers
+NEUTRON_DVR_MODE=${NEUTRON_DVR_MODE:-dvr_snat}
+
 NEUTRON_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
 
@@ -173,6 +184,7 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
+        iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
@@ -181,7 +193,15 @@ function configure_neutron_new {
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
+
+        local mech_drivers="openvswitch"
+        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
+            mech_drivers+=",l2population"
+        else
+            mech_drivers+=",linuxbridge"
+        fi
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
+
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
@@ -202,6 +222,11 @@ function configure_neutron_new {
         else
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables_hybrid
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
+
+            if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
+                iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
+                iniset $NEUTRON_CORE_PLUGIN_CONF agent enable_distributed_routing True
+            fi
         fi
 
         if ! running_in_container; then
@@ -236,6 +261,10 @@ function configure_neutron_new {
         else
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
         fi
+
+        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
+            iniset $NEUTRON_L3_CONF DEFAULT agent_mode $NEUTRON_DVR_MODE
+        fi
     fi
 
     # Metadata

From 9fd38e79701b65d41116a8915e47978fc50176c6 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 11 Dec 2017 12:20:25 +0100
Subject: [PATCH 2175/3333] Add Fedora 27 support

Removing the (f23,)f24 support they are EOL.
The only non-trivial change is the apache-httpd default worker change,
however might not be bad idea to use `event` instead of `worker`
in the future, but for now keep it AS-IS and continue to use `worker`.

Change-Id: I96d414a30b58bc4b43da45066fdf310a6a830079
Closes-Bug: #1740194
---
 files/rpms/cinder  | 4 ++--
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 lib/apache         | 3 ++-
 stack.sh           | 2 +-
 6 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 3bc4e7ae72..e6addc62aa 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f24,f25,f26 NOPRIME
-targetcli # dist:rhel7,f24,f25,f26 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27 NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index f3f870823c..878b935a1b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f23,f24,f25,f26
+iptables-services  # NOPRIME f25,f26,f27
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25,f26
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 64ed480632..9fb7282df5 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f23,f24,f25,f26
+kernel-modules # dist:f25,f26,f27
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index 2e09cec28f..be0db140e3 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f23,f24,f25,f26
+rsync-daemon # dist:f25,f26,f27
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/apache b/lib/apache
index 3af341174e..84cec73234 100644
--- a/lib/apache
+++ b/lib/apache
@@ -133,8 +133,9 @@ function install_apache_wsgi {
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
         # For consistency with Ubuntu, switch to the worker mpm, as
-        # the default is prefork
+        # the default is event
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
+        sudo sed -i '/mod_mpm_event.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
         sudo sed -i '/mod_mpm_worker.so/s/^#//g' /etc/httpd/conf.modules.d/00-mpm.conf
     elif is_suse; then
         install_package apache2 apache2-mod_wsgi
diff --git a/stack.sh b/stack.sh
index 1d0381483a..32eb43f292 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 23e87ef6188514b17435897fac067568f0f71ac6 Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyammann@gmail.com>
Date: Sun, 10 Dec 2017 05:11:53 +0300
Subject: [PATCH 2176/3333] Remove deprecated 'deactivate_image' feature flag
 setting

'deactivate_image' feature flag was added long back during kilo
cycle. Tempest is going to remove this feature flag.

Depends-On: I843d4c64f24407d9d217005d5ea59d50d7ad62e7
Change-Id: I1ae8efc0e62acc5e05c1c00dc8970b74d8b16da0
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index bdbaaa5678..35dbb7b6a1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -310,7 +310,6 @@ function configure_tempest {
     fi
 
     # Image Features
-    iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True
     if [ "$GLANCE_V1_ENABLED" != "True" ]; then
         iniset $TEMPEST_CONFIG image-feature-enabled api_v1 False
     fi

From 4eb998fd5a494db19b40a0ede71dde73e2d1f5ec Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 13 Jan 2018 06:17:40 +0000
Subject: [PATCH 2177/3333] Updated from generate-devstack-plugins-list

Change-Id: I6b1214c9b080fbad43609548bf89be50c8191d87
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 907671adc8..31812aeefb 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -167,6 +167,7 @@ storlets                               `git://git.openstack.org/openstack/storle
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
+telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
@@ -174,6 +175,7 @@ trove-dashboard                        `git://git.openstack.org/openstack/trove-
 valet                                  `git://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
 vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
+vitrage-tempest-plugin                 `git://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
 vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
 vmware-vspc                            `git://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
 watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__

From dc04b5aa24411b4081f0ad08021e0dc694c982e8 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 4 Dec 2017 11:32:36 +1100
Subject: [PATCH 2178/3333] CentOS: Fix EPEL mirroring and RDO install on CI
 nodes

CentOS tests have reverted to using upstream for EPEL rather than
local mirrors, introducing some unnecessary instability.  The root of
the problem is that /etc/nodepool/provider disappeared with zuulv3, so
we now always re-install the EPEL repo and overwrite the local EPEL
.repos files that were made during test setup and point to local
mirrors.

The other change is that we stopped installing the RDO repositories on
the testing nodes too.  That we were incorrectly taking this path and
reinstalling EPEL has hidden the removal of these packages from the
base image in the test, since it ends up installing them too.

Split the install into two parts -- epel and RDO.  Check for
/etc/ci/mirror_info.sh (the sourcable mirror script provided by base
test setup) and if so, just enable EPEL so we get the CI-mirror
version correctly.  Install the RDO repositories (if not already
installed) unconditionally.

Change-Id: Iccb045a6695deb10da4d68a5694e1fa45ccbb810
---
 stack.sh | 49 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 16 deletions(-)

diff --git a/stack.sh b/stack.sh
index 32eb43f292..e57ab7b6fc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -282,7 +282,7 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-function _install_epel_and_rdo {
+function _install_epel {
     # NOTE: We always remove and install latest -- some environments
     # use snapshot images, and if EPEL version updates they break
     # unless we update them to latest version.
@@ -313,12 +313,27 @@ EOF
     yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
+}
 
-    # ... and also optional to be enabled
-    sudo yum-config-manager --enable rhel-7-server-optional-rpms
+function _install_rdo {
+    # There are multiple options for this, including using CloudSIG
+    # repositories (centos-release-*), trunk versions, etc.  Since
+    # we're not interested in the actual openstack distributions
+    # (since we're using git to run!) but only peripherial packages
+    # like kvm or ovs, this has been reliable.
+
+    # TODO(ianw): figure out how to best mirror -- probably use infra
+    # mirror RDO reverse proxy.  We could either have test
+    # infrastructure set it up disabled like EPEL, or fiddle it here.
+    # Per the point above, it's a bunch of repos so starts getting a
+    # little messy...
+    if ! is_package_installed rdo-release ; then
+        yum_install https://rdoproject.org/repos/rdo-release.rpm
+    fi
 
-    # install the lastest RDO
-    is_package_installed rdo-release || yum_install https://rdoproject.org/repos/rdo-release.rpm
+    # Also enable optional for RHEL7 proper.  Note this is a silent
+    # no-op on other platforms.
+    sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
@@ -362,20 +377,22 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-# If we have /etc/nodepool/provider assume we're on a OpenStack CI
-# node, where EPEL is already pointing at our internal mirror and RDO
-# is pre-installed.
-if [[ -f /etc/nodepool/provider ]]; then
-    SKIP_EPEL_INSTALL=True
-    if is_fedora; then
-        # However, EPEL is not enabled by default.
+if [[ $DISTRO == "rhel7" ]]; then
+    # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
+    # node, where EPEL is installed (but disabled) and already
+    # pointing at our internal mirror
+    if [[ -f /etc/ci/mirror_info.sh ]]; then
+        SKIP_EPEL_INSTALL=True
         sudo yum-config-manager --enable epel
     fi
-fi
 
-if is_fedora && [[ $DISTRO == "rhel7" ]] && \
-        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-    _install_epel_and_rdo
+    if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
+        _install_epel
+    fi
+    # Along with EPEL, CentOS (and a-likes) require some packages only
+    # available in RDO repositories (e.g. OVS, or later versions of
+    # kvm) to run.
+    _install_rdo
 fi
 
 # Ensure python is installed

From 6bcd8cad16c39dd8596d654eb4587e848d0db1fe Mon Sep 17 00:00:00 2001
From: Peter Penchev <openstack-dev@storpool.com>
Date: Fri, 12 Jan 2018 23:49:04 +0200
Subject: [PATCH 2179/3333] Bump the Cinder LVM backing file size to 24Gb.

This follows a change made to devstack-gate in commit 841ebc3 to allow
tempest to succeed even if it happens to run several volume tests in
parallel.  Right now it's possible for a tempest-full test (run without
devstack-gate) to fail with an "Insufficient free virtual space" error in
the cinder-scheduler log.

Suggested by: Clark Boylan <clark.boylan@gmail.com>
Closes-Bug: 1743597
Change-Id: I16ccb9976d1bc7c9f56a6a4d73e35042a5867ef9
---
 doc/source/configuration.rst | 2 +-
 stackrc                      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d932d8cd86..49cad05554 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -667,7 +667,7 @@ with ``VOLUME_BACKING_FILE_SIZE``.
 
         VOLUME_GROUP_NAME="stack-volumes"
         VOLUME_NAME_PREFIX="volume-"
-        VOLUME_BACKING_FILE_SIZE=10250M
+        VOLUME_BACKING_FILE_SIZE=24G
 
 
 Keystone
diff --git a/stackrc b/stackrc
index 286a04d3fe..d7ebdd87d4 100644
--- a/stackrc
+++ b/stackrc
@@ -762,8 +762,8 @@ for image_url in ${IMAGE_URLS//,/ }; do
     fi
 done
 
-# 10Gb default volume backing file size
-VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-10250M}
+# 24Gb default volume backing file size
+VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-24G}
 
 # Prefixes for volume and instance names
 VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}

From 789301240adc7fa91cd34405bf87e15c3b21bc51 Mon Sep 17 00:00:00 2001
From: chengebj5238 <chengebj@inspur.com>
Date: Thu, 18 Jan 2018 15:53:27 +0800
Subject: [PATCH 2180/3333] URL changes are modified to be correct

Change-Id: Ied5ee7da0a37405f130f7cecff48919f16435952
---
 doc/source/configuration.rst                 | 2 +-
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 doc/source/guides/neutron.rst                | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d932d8cd86..919a053317 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -643,7 +643,7 @@ the instructions in ``./tools/xen/README.md``.
 Cells
 ~~~~~
 
-`Cells <http://wiki.openstack.org/blueprint-nova-compute-cells>`__ is
+`Cells <https://wiki.openstack.org/wiki/Blueprint-nova-compute-cells>`__ is
 an alternative scaling option.  To setup a cells environment add the
 following to your ``localrc`` section:
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 3592844efb..7dee520a23 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -2,7 +2,7 @@ Configure Load-Balancer Version 2
 =================================
 
 Starting in the OpenStack Liberty release, the
-`neutron LBaaS v2 API <http://developer.openstack.org/api-ref-networking-v2-ext.html>`_
+`neutron LBaaS v2 API <https://developer.openstack.org/api-ref/network/v2/index.html>`_
 is now stable while the LBaaS v1 API has been deprecated.  The LBaaS v2 reference
 driver is based on Octavia.
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 092809a1cf..1b8dccd7f3 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -396,7 +396,7 @@ controller node.
 
 In this configuration we are defining IPV4_ADDRS_SAFE_TO_USE to be a
 publicly routed IPv4 subnet. In this specific instance we are using
-the special TEST-NET-3 subnet defined in `RFC 5737 <http://tools.ietf.org/html/rfc5737>`_,
+the special TEST-NET-3 subnet defined in `RFC 5737 <https://tools.ietf.org/html/rfc5737>`_,
 which is used for documentation.  In your DevStack setup, IPV4_ADDRS_SAFE_TO_USE
 would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the

From ffd0047afa78bfd4d6576afe1d4b8c79435b158c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 18 Jan 2018 15:12:29 +0000
Subject: [PATCH 2181/3333] functions-common: Don't reguess Python versions

We have already established the correct version of Python to use during
installation, either automatically or through user-provided information
(USE_PYTHON3, PYTHON3_VERSION). Don't do it again.

Change-Id: I7bdf2be9a885994bf2c437dd104048a1ff2f6666
Closes-Bug: #1744096
---
 functions-common | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index df295a3395..78710deeb0 100644
--- a/functions-common
+++ b/functions-common
@@ -2301,12 +2301,7 @@ function install_oscwrap {
 
 function cleanup_oscwrap {
     local total=0
-    if python3_enabled ; then
-        local python=python3
-    else
-        local python=python
-    fi
-    total=$(cat $OSCWRAP_TIMER_FILE | $python -c "import sys; print(sum(int(l) for l in sys.stdin))")
+    total=$(cat $OSCWRAP_TIMER_FILE | $PYTHON -c "import sys; print(sum(int(l) for l in sys.stdin))")
     _TIME_TOTAL["osc"]=$total
     rm $OSCWRAP_TIMER_FILE
 }

From bb7d2f233b92a3f9ee17ad0702fecb68bbf1e712 Mon Sep 17 00:00:00 2001
From: Tim Swanson <tiswanso@cisco.com>
Date: Sat, 16 Dec 2017 17:14:10 -0500
Subject: [PATCH 2182/3333] Allow public router external net to use a non-flat
 provider network.

Allow users to auto-create a neutron non-flat providernet public network
and use it for external router interfaces.  By default, keep the existing
flat network type behavior.

Change-Id: I64f71b0c9fcac97b9b84b7d30ee61659b2a690f1
---
 lib/neutron_plugins/services/l3 | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 41a467df4c..9be32b79aa 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -39,9 +39,9 @@ Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 
-# Use flat providernet for public network
+# Use providernet for public network
 #
-# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
+# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a provider network
 # for external interface of neutron l3-agent.  In that case,
 # PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
 # used for the network.  In case of ofagent, you should add the
@@ -59,6 +59,10 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
+#
+# The provider-network-type defaults to flat, however, the values
+# PUBLIC_PROVIDERNET_TYPE and PUBLIC_PROVIDERNET_SEGMENTATION_ID could
+# be set to specify the parameters for an alternate network type.
 Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
@@ -240,7 +244,7 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type flat --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
             EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi

From ffe691ecd5f77795666baa9317910de8d6b858e1 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 12 Jan 2016 17:58:44 -0800
Subject: [PATCH 2183/3333] tempest: set
 compute-feature-enabled.volume_multiattach

This adds the ENABLE_VOLUME_MULTIATTACH flag and if True
configures Tempest to run volume multiattach tests.

Note that due to https://bugzilla.redhat.com/show_bug.cgi?id=1378242
we can't run multiattach tests with the Pike UCA packages since
those include qemu 2.10 and libvirt 3.6, and the valid versions for
multiattach support with libvirt is qemu<2.10 or libvirt>=3.10.

Depends-On: I80c20914c03d7371e798ca3567c37307a0d54aaa
Depends-On: I158c6f20e3e6a24bd2e5299abbeb3fc5208e5885

Part of nova blueprint multi-attach-volume

Change-Id: I46b7eabf6a28f230666f6933a087f73cb4408348
---
 lib/tempest          |  4 ++++
 stackrc              | 12 +++++++++++-
 tools/fixup_stuff.sh |  7 ++++++-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 35dbb7b6a1..3b39dae422 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -382,6 +382,10 @@ function configure_tempest {
         fi
     fi
 
+    if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
+    fi
+
     if is_service_enabled n-novnc; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
diff --git a/stackrc b/stackrc
index 286a04d3fe..ba218b9a38 100644
--- a/stackrc
+++ b/stackrc
@@ -601,6 +601,11 @@ NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
 SPICE_BRANCH=${SPICE_BRANCH:-master}
 
+# Global flag used to configure Tempest and potentially other services if
+# volume multiattach is supported. In Queens, only the libvirt compute driver
+# and lvm volume driver support multiattach, and qemu must be less than 2.10
+# or libvirt must be greater than or equal to 3.10.
+ENABLE_VOLUME_MULTIATTACH=$(trueorfalse False ENABLE_VOLUME_MULTIATTACH)
 
 # Nova hypervisor configuration.  We default to libvirt with **kvm** but will
 # drop back to **qemu** if we are unable to load the kvm module.  ``stack.sh`` can
@@ -612,7 +617,12 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
+        # If ENABLE_VOLUME_MULTIATTACH is True, the Ubuntu Cloud Archive can't
+        # be used until it provides libvirt>=3.10, and with older versions of
+        # Ubuntu the group is "libvirtd".
+        # TODO(mriedem): Remove the ENABLE_VOLUME_MULTIATTACH check when
+        # UCA has libvirt>=3.10.
+        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) && "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check
             # to see if libvirtd group already exists to handle grenade's case.
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index efe0125741..f78f05f2f8 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -75,7 +75,12 @@ fi
 # Make it possible to switch this based on an environment variable as
 # libvirt 2.5.0 doesn't handle nested virtualization quite well and this
 # is required for the trove development environment.
-if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; then
+# The Pike UCA has qemu 2.10 but libvirt 3.6, therefore if
+# ENABLE_VOLUME_MULTIATTACH is True, we can't use the Pike UCA
+# because multiattach won't work with those package versions.
+# We can remove this check when the UCA has libvirt>=3.10.
+if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" && \
+        "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
     # This pulls in apt-add-repository
     install_package "software-properties-common"
     # Use UCA for newer libvirt. Should give us libvirt 2.5.0.

From 0b45e2f8e8d120d9103e735c580e6f7396df3e29 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 18 Jan 2018 17:41:04 -0600
Subject: [PATCH 2184/3333] Remove hack for ubuntu cloud archive

There is a hack here to set up ubuntu cloud archive, pinning it to
mirror.dfw.rax.openstack.org. The mirror-info role seems to be doing
this correctly now though, so let's remove the hack and let things work
normally.

Change-Id: I283cb3452245b64e9492806f06404b484f21c358
---
 playbooks/pre.yaml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index d61fd45de0..6681fb20a5 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -18,15 +18,3 @@
     - setup-devstack-cache
     - start-fresh-logging
     - write-devstack-local-conf
-  # TODO(jeblair): remove when configure-mirrors is fixed
-  tasks:
-    - name: Hack mirror_info
-      shell:
-        _raw_params: |
-          mkdir /etc/ci
-          cat << "EOF" > /etc/ci/mirror_info.sh
-          export NODEPOOL_UCA_MIRROR=http://mirror.dfw.rax.openstack.org/ubuntu-cloud-archive
-          EOF
-      args:
-        executable: /bin/bash
-      become: true

From 64039ef3008ccacbacad5c45dbc1881af4e868fa Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 23 Jan 2018 12:06:57 +0200
Subject: [PATCH 2185/3333] Increse api_max_retries and api_retry_interval for
 ironic

There is no way to upgrade ironic before nova because of
grenade design. In multinode job we do not restart nova
as we test partial upgrade of ironic there.
On slow nodes upgrading ironic takes time and nova looses
ironic connectivity

This patch increases api_retry_interval and api_max_retries
to make sure we have a time to upgrade ironic before nova
compute stuck.

Change-Id: I3b1429d6561431a82edda04a0e574cac38771837
---
 lib/nova_plugins/hypervisor-ironic | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index ee1a0e0a5e..c91f70b9bb 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -58,6 +58,9 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
+
+    iniset $NOVA_CONF ironic api_max_retries 300
+    iniset $NOVA_CONF ironic api_retry_interval 5
 }
 
 # install_nova_hypervisor() - Install external components

From 8dd918c59e630cc9e7be87b8eb35aa12079e3693 Mon Sep 17 00:00:00 2001
From: Kaitlin Farr <kaitlin.farr@jhuapl.edu>
Date: Tue, 24 Oct 2017 09:34:03 -0400
Subject: [PATCH 2186/3333] Update nova api_class setting to backend

Castellan switches the `api_class` config option to `backend`. The change
is still backwards compatible with the old `api_class` setting, but cinder
already updated to use the new option (see I5e46c738531d5d56777e91a00f4cee9531356f2e)
and it is better to use the new setting.

Change-Id: Ib609c82e7076d19676baaf4f08abd79ea11db0e3
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index c40c43af6c..db88474f55 100644
--- a/lib/nova
+++ b/lib/nova
@@ -424,7 +424,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
-    iniset $NOVA_CONF key_manager api_class nova.keymgr.conf_key_mgr.ConfKeyManager
+    iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to

From 842d54a2997adaf65369e56942e1d4f2b27aeb77 Mon Sep 17 00:00:00 2001
From: Ryota MIBU <r-mibu@cq.jp.nec.com>
Date: Mon, 25 Dec 2017 16:28:50 +0900
Subject: [PATCH 2187/3333] use openstack command instead of nova command

In function 'get_instance_ip', 'nova' client command is used to get
instance information in order to retrive IP address of the instance.

There is no need to use the nova command, since 'openstack' client
already supports such basic operation.

Moreover, 'openstack' client has an option to get value of specified
column. That brings more accurate way of retriving IP address.

This patch replaces nova command in 'get_instance_ip' by 'openstack'
command. Note, this nova command is the only one in devstack tree.

Change-Id: Iee0b81a994a4da5b3f4572c2e8eb30514cd43f89
Signed-off-by: Ryota MIBU <r-mibu@cq.jp.nec.com>
---
 functions | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index 20b83b3cd0..959133ce5c 100644
--- a/functions
+++ b/functions
@@ -503,13 +503,13 @@ function ping_check {
 function get_instance_ip {
     local vm_id=$1
     local network_name=$2
-    local nova_result
+    local addresses
     local ip
 
-    nova_result="$(nova show $vm_id)"
-    ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
+    addresses=$(openstack server show -c addresses -f value "$vm_id")
+    ip=$(echo $addresses | sed -n "s/^.*$network_name=\([0-9\.]*\).*$/\1/p")
     if [[ $ip = "" ]];then
-        echo "$nova_result"
+        echo "addresses of server $vm_id : $addresses"
         die $LINENO "[Fail] Couldn't get ipaddress of VM"
     fi
     echo $ip

From 7f3248229b170fe954af9a67a578bf6cd34d2b23 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 26 Jan 2018 06:19:49 +0000
Subject: [PATCH 2188/3333] Updated from generate-devstack-plugins-list

Change-Id: I0648e5cd08bb88d5972726241da3d396ad1d0129
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 31812aeefb..1dab9ce9f5 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -33,7 +33,6 @@ blazar                                 `git://git.openstack.org/openstack/blazar
 broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
-cerberus                               `git://git.openstack.org/openstack/cerberus <https://git.openstack.org/cgit/openstack/cerberus>`__
 cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
 collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
@@ -95,6 +94,7 @@ monasca-api                            `git://git.openstack.org/openstack/monasc
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
 monasca-events-api                     `git://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
+monasca-tempest-plugin                 `git://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__

From 744a829ce0b0a61a9b3be5afa8dfb4a258c69f11 Mon Sep 17 00:00:00 2001
From: shutingm <shutingm@vmware.com>
Date: Sun, 28 Jan 2018 23:06:40 -0800
Subject: [PATCH 2189/3333] Add the dependent package for python-pcre
 installation

This patch add libpcre3-dev and pcre-devel package for python-pcre
installation.

Closes-Bug: #1745606

Change-Id: I59fc688519341c90dc33b79d536f0625a6c4dd17
---
 files/debs/general | 1 +
 files/rpms/general | 1 +
 2 files changed, 2 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 8e0018d284..df872a0a6c 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -15,6 +15,7 @@ libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
+libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libsystemd-dev # for systemd-python
diff --git a/files/rpms/general b/files/rpms/general
index 878b935a1b..5d9a4ad5a5 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -22,6 +22,7 @@ net-tools
 openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
+pcre-devel # for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc

From 540141cc1c32dbd451c0cc7805eda84c2e248a8f Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Tue, 30 Jan 2018 03:18:17 +0000
Subject: [PATCH 2190/3333] Remove libpcre3-dev&pcre-devel from horizon
 prerequisite

As libpcre3-dev&pcre-devel are now added as general prerequisite,
remove it from horizon prerequisite.

Change-Id: I872aec210028373c39baee0ab846469fd9920de9
---
 files/debs/horizon | 1 -
 files/rpms/horizon | 1 -
 2 files changed, 2 deletions(-)

diff --git a/files/debs/horizon b/files/debs/horizon
index 1f45b54f7c..48332893b1 100644
--- a/files/debs/horizon
+++ b/files/debs/horizon
@@ -1,3 +1,2 @@
 apache2  # NOPRIME
 libapache2-mod-wsgi  # NOPRIME
-libpcre3-dev  # pyScss
diff --git a/files/rpms/horizon b/files/rpms/horizon
index aeb2cb5c96..fa5601a95f 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,5 +1,4 @@
 Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pcre-devel  # pyScss
 pyxattr

From a904caded4269039a087292a8b7b95eb2de21142 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 22 Jan 2018 16:18:55 -0600
Subject: [PATCH 2191/3333] Move zuul_copy_output to be a job variable

The zuul_copy_output variable is designed to be able to be used as
a zuul job variable so that zuul dictionary merging will work. However,
it's currently being set in the playbook rather than as a job variable,
so it's not possible to supplement it in a child job.

Move it to be a job variable. Also remove the wrapping {} as they should
not be needed to make zuul_copy_output a dictionary.

Change-Id: I78c7fed47c2ab868384c74dbff7904d33d510dd9
---
 .zuul.yaml          | 34 ++++++++++++++++++++++++++++++++++
 playbooks/post.yaml | 34 ----------------------------------
 2 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 037e9a9ea8..0de71f7c5f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -77,6 +77,40 @@
       devstack_services:
         horizon: false
         tempest: false
+      zuul_copy_output:
+        '{{ devstack_conf_dir }}/local.conf': 'logs'
+        '{{ devstack_conf_dir }}/localrc': 'logs'
+        '{{ devstack_conf_dir }}/.stackenv': 'logs'
+        '{{ devstack_log_dir }}/dstat-csv.log': 'logs'
+        '{{ devstack_log_dir }}/devstacklog.txt': 'logs'
+        '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs'
+        '{{ devstack_full_log}}': 'logs'
+        '{{ stage_dir }}/verify_tempest_conf.log': 'logs'
+        '{{ stage_dir }}/apache': 'logs'
+        '{{ stage_dir }}/apache_config': 'logs'
+        '{{ stage_dir }}/etc': 'logs'
+        '/var/log/rabbitmq': 'logs'
+        '/var/log/postgresql': 'logs'
+        '/var/log/mysql.err': 'logs'
+        '/var/log/mysql.log': 'logs'
+        '/var/log/libvirt': 'logs'
+        '/etc/sudoers': 'logs'
+        '/etc/sudoers.d': 'logs'
+        '{{ stage_dir }}/iptables.txt': 'logs'
+        '{{ stage_dir }}/df.txt': 'logs'
+        '{{ stage_dir }}/pip2-freeze.txt': 'logs'
+        '{{ stage_dir }}/pip3-freeze.txt': 'logs'
+        '{{ stage_dir }}/dpkg-l.txt': 'logs'
+        '{{ stage_dir }}/rpm-qa.txt': 'logs'
+        '{{ stage_dir }}/core': 'logs'
+        '{{ stage_dir }}/listen53.txt': 'logs'
+        '{{ stage_dir }}/deprecations.log': 'logs'
+        '/var/log/ceph': 'logs'
+        '/var/log/openvswitch': 'logs'
+        '/var/log/glusterfs': 'logs'
+        '/etc/glusterfs/glusterd.vol': 'logs'
+        '/etc/resolv.conf': 'logs'
+        '/var/log/unbound.log': 'logs'
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 0c5e83b6a0..d8ee99e783 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -24,40 +24,6 @@
     # capture-system-logs should be the last role before stage-output
     - capture-system-logs
     - role: stage-output
-      zuul_copy_output:
-        { '{{ devstack_conf_dir }}/local.conf': 'logs',
-          '{{ devstack_conf_dir }}/localrc': 'logs',
-          '{{ devstack_conf_dir }}/.stackenv': 'logs' ,
-          '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
-          '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
-          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
-          '{{ devstack_full_log}}': 'logs',
-          '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
-          '{{ stage_dir }}/apache': 'logs',
-          '{{ stage_dir }}/apache_config': 'logs',
-          '{{ stage_dir }}/etc': 'logs',
-          '/var/log/rabbitmq': 'logs',
-          '/var/log/postgresql': 'logs',
-          '/var/log/mysql.err': 'logs',
-          '/var/log/mysql.log': 'logs',
-          '/var/log/libvirt': 'logs',
-          '/etc/sudoers': 'logs',
-          '/etc/sudoers.d': 'logs',
-          '{{ stage_dir }}/iptables.txt': 'logs',
-          '{{ stage_dir }}/df.txt': 'logs',
-          '{{ stage_dir }}/pip2-freeze.txt': 'logs',
-          '{{ stage_dir }}/pip3-freeze.txt': 'logs',
-          '{{ stage_dir }}/dpkg-l.txt': 'logs',
-          '{{ stage_dir }}/rpm-qa.txt': 'logs',
-          '{{ stage_dir }}/core': 'logs',
-          '{{ stage_dir }}/listen53.txt': 'logs',
-          '{{ stage_dir }}/deprecations.log': 'logs',
-          '/var/log/ceph': 'logs',
-          '/var/log/openvswitch': 'logs',
-          '/var/log/glusterfs': 'logs',
-          '/etc/glusterfs/glusterd.vol': 'logs',
-          '/etc/resolv.conf': 'logs',
-          '/var/log/unbound.log': 'logs' }
       extensions_to_txt:
         - conf
         - log

From bf1e6e7a34cfdbb859aa072666b7018ef7387e9e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 1 Feb 2018 06:18:22 +0000
Subject: [PATCH 2192/3333] Updated from generate-devstack-plugins-list

Change-Id: Idda642196d42d6ae930f4978c88c1b53124b7ead
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1dab9ce9f5..d830507f07 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -78,6 +78,7 @@ keystone                               `git://git.openstack.org/openstack/keysto
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
+kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
@@ -130,6 +131,7 @@ networking-spp                         `git://git.openstack.org/openstack/networ
 networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-classifier                     `git://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
 neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__

From 854cb67636c478143ed0071d44a84447a72e87a7 Mon Sep 17 00:00:00 2001
From: Peter Penchev <openstack-dev@storpool.com>
Date: Thu, 14 Dec 2017 21:45:52 +0000
Subject: [PATCH 2193/3333] Allow a non-127.0.0.1 definition for the hostname.

In some environments it might be useful to resolve the hostname to
an IP address that is reachable by other hosts in the local network.
If some of the configuration scripts have taken care of putting
a proper line in /etc/hosts, do not try to override it by appending
a 127.0.0.1 one.

Change-Id: I7ae20a66c473b0c683803cc44654cd95fcce3639
Closes-Bug: 1746751
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 32eb43f292..266ae7c11a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -353,7 +353,7 @@ safe_chmod 0755 $DATA_DIR
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
 LOCAL_HOSTNAME=`hostname -s`
-if [ -z "`grep ^127.0.0.1 /etc/hosts | grep $LOCAL_HOSTNAME`" ]; then
+if ! fgrep -qwe "$LOCAL_HOSTNAME" /etc/hosts; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 

From 6e316daf45032ce9a43e0c995ced2682c950cc3b Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Wed, 24 Jan 2018 16:52:00 -0800
Subject: [PATCH 2194/3333] Zuul: Remove project name

Zuul no longer requires the project-name for in-repo configuration.
Omitting it makes forking or renaming projects easier.

Change-Id: I32868cec22149ec1c18fe2737a65e88d32bff531
---
 .zuul.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 037e9a9ea8..0595b98400 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -46,7 +46,7 @@
       - zuul: openstack-infra/openstack-zuul-jobs
     timeout: 7200
     vars:
-      test_matrix_configs: ['neutron', 'tlsproxy']
+      test_matrix_configs: [neutron, tlsproxy]
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
         RABBIT_PASSWORD: secretrabbit
@@ -154,7 +154,6 @@
     run: playbooks/tox/run.yaml
 
 - project:
-    name: openstack-dev/devstack
     check:
       jobs:
         - devstack

From 0f39756f6158bf5cf9a7bfc7eda655b883002722 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 2 Feb 2018 17:03:24 +0000
Subject: [PATCH 2195/3333] Make the apache-logs-conf role less verbose

The role is logging a lot of useless data with all the stat info
from various config and log files. Remove verbosity using no_log.

Change-Id: I72c721573ffc4a14adc3e2b29285c1071b7ec4f7
---
 roles/apache-logs-conf/tasks/main.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 7fd490ea4c..60b4fbfead 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,12 +64,14 @@
     path: "{{ apache_config_paths[ansible_os_family] }}"
     file_type: any
   register: apache_configs
+  no_log: true
 
 - name: Dereference configurations
   stat:
     path: "{{ item.path }}"
   with_items: "{{ apache_configs.files }}"
   register: apache_configs_deref
+  no_log: true
 
 - name: Link configurations
   file:
@@ -78,3 +80,4 @@
     state: hard
   with_items: "{{ apache_configs_deref.results }}"
   when: item.stat.isreg or item.stat.islnk
+  no_log: true

From 63171eeae238c09cbda8c37fc55af0cd43edd82c Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 31 Jan 2018 21:01:36 +0000
Subject: [PATCH 2196/3333] Move extensions_to_txt to the job defintion

Move extensions_to_txt to the job defintion so that it may be
extended by descendant jobs.

Depends-on: https://review.openstack.org/540485/

Change-Id: I6e9009faa1451698ed781ce1ffdd9f22c97daa93
---
 .zuul.yaml          | 6 ++++++
 playbooks/post.yaml | 6 ------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0de71f7c5f..8fe4535814 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -111,6 +111,12 @@
         '/etc/glusterfs/glusterd.vol': 'logs'
         '/etc/resolv.conf': 'logs'
         '/var/log/unbound.log': 'logs'
+      extensions_to_txt:
+        conf: True
+        log: True
+        localrc: True
+        stackenv: True
+        summary: True
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index d8ee99e783..9e66f20e9e 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -24,12 +24,6 @@
     # capture-system-logs should be the last role before stage-output
     - capture-system-logs
     - role: stage-output
-      extensions_to_txt:
-        - conf
-        - log
-        - localrc
-        - stackenv
-        - summary
     # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
     # starts pulling logs for us from {{ ansible_user_dir }}/logs.
     # Meanwhile we already store things in ansible_user_dir and use

From da6de10f5dda20fc023a8215b13b873a068b6a37 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 22 Jan 2018 11:42:01 +0000
Subject: [PATCH 2197/3333] fixed_key: By default use a hardcoded fixed_key
 across devstack envs

This change mimics how fixed_key would actually be deployed in a real
world environment, with a single key shared across Nova and Cinder
across all hosts.

Change-Id: I50a48e2da57a1cc1ecd250150ea6e9c3745baaca
---
 stack.sh | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/stack.sh b/stack.sh
index 32eb43f292..f72347557a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1241,16 +1241,17 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create a randomized default value for the key manager's fixed_key
-# NOTE(lyarwood): This is currently set to 36 as a workaround to the following
-# libvirt bug that incorrectly pads passphrases that are a multiple of 16 bytes
-# in length.
-# Unable to use LUKS passphrase that is exactly 16 bytes long
-# https://bugzilla.redhat.com/show_bug.cgi?id=1447297
+# NOTE(lyarwood): By default use a single hardcoded fixed_key across devstack
+# deployments.  This ensures the keys match across nova and cinder across all
+# hosts.
+FIXED_KEY=${FIXED_KEY:-bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec}
 if is_service_enabled nova; then
-    key=$(generate_hex_string 36)
-    iniset $NOVA_CONF key_manager fixed_key "$key"
-    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CONF key_manager fixed_key "$FIXED_KEY"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$FIXED_KEY"
+fi
+
+if is_service_enabled cinder; then
+    iniset $CINDER_CONF key_manager fixed_key "$FIXED_KEY"
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From 838b833b638ee13599707d8a0be899815f201927 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sun, 4 Feb 2018 17:55:54 +0100
Subject: [PATCH 2198/3333] Add Zuul v3 native unit-tests

Add new job to replace legacy-devstack-unit-tests.

Change-Id: I4fe59b1954514a7146a4412e3103a0a05a9250f2
---
 .zuul.yaml                    | 11 +++++++++++
 playbooks/unit-tests/pre.yaml | 13 +++++++++++++
 playbooks/unit-tests/run.yaml | 12 ++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 playbooks/unit-tests/pre.yaml
 create mode 100644 playbooks/unit-tests/run.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index f03d30a497..802bb79802 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -187,11 +187,22 @@
       - playbooks/tox/pre.yaml
     run: playbooks/tox/run.yaml
 
+- job:
+    name: devstack-unit-tests
+    description: |
+      Runs unit tests on devstack project.
+
+      It runs  ``run_tests.sh``.
+    pre-run: playbooks/unit-tests/pre.yaml
+    run: playbooks/unit-tests/run.yaml
+
 - project:
     check:
       jobs:
         - devstack
         - devstack-multinode
+        - devstack-unit-tests
     gate:
       jobs:
         - devstack
+        - devstack-unit-tests
diff --git a/playbooks/unit-tests/pre.yaml b/playbooks/unit-tests/pre.yaml
new file mode 100644
index 0000000000..cfa1676378
--- /dev/null
+++ b/playbooks/unit-tests/pre.yaml
@@ -0,0 +1,13 @@
+- hosts: all
+
+  tasks:
+
+    - name: Install prerequisites
+      shell:
+        chdir: '{{ zuul.project.src_dir }}'
+        executable: /bin/bash
+        cmd: |
+          set -e
+          set -x
+          echo "IPV4_ADDRS_SAFE_TO_USE=10.1.0.0/20" >> localrc
+          ./tools/install_prereqs.sh
diff --git a/playbooks/unit-tests/run.yaml b/playbooks/unit-tests/run.yaml
new file mode 100644
index 0000000000..181521f072
--- /dev/null
+++ b/playbooks/unit-tests/run.yaml
@@ -0,0 +1,12 @@
+- hosts: all
+
+  tasks:
+
+    - name: Run run_tests.sh
+      shell:
+        chdir: '{{ zuul.project.src_dir }}'
+        executable: /bin/bash
+        cmd: |
+          set -e
+          set -x
+          ./run_tests.sh

From b355a9489f5da99daa5b4eb827353630a37a8138 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 5 Feb 2018 10:54:48 +1100
Subject: [PATCH 2199/3333] Add pcre-devel for opensuse

As a follow-on for I59fc688519341c90dc33b79d536f0625a6c4dd17 add to
suse as well.

Change-Id: I72a3cf33cb98ee2eca7f027c9e28f6fbf1404002
---
 files/rpms-suse/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0c1a2819b1..0b69cb1c01 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -19,6 +19,7 @@ make
 net-tools
 openssh
 openssl
+pcre-devel # python-pcre
 postgresql-devel  # psycopg2
 psmisc
 python-cmd2 # dist:opensuse-12.3

From 81fac768b5a414c7ddd347e799fb49c0ccbc1d0a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 19 Jan 2018 10:14:45 -0800
Subject: [PATCH 2200/3333] Remove unneed devstack early log file

In the run devstack role we specify a path to devstack_early_log then
hand it to stack.sh as a parameter which stack.sh does nothing with.
While looking at a fix for this it was pointed out that these early logs
make it into the job's output log now so we don't need a special file
for them. Rather than handle this as a special case just let the
job-output.txt log file pick up the logs for us which allows us to
remove this unneeded feature.

Change-Id: I9bedbe91c60257d94173b1c70676dd6c2b49dc91
---
 roles/run-devstack/README.rst         | 6 ------
 roles/run-devstack/defaults/main.yaml | 1 -
 roles/run-devstack/tasks/main.yaml    | 2 +-
 3 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/roles/run-devstack/README.rst b/roles/run-devstack/README.rst
index e53f060602..d77eb15e99 100644
--- a/roles/run-devstack/README.rst
+++ b/roles/run-devstack/README.rst
@@ -6,9 +6,3 @@ Run devstack
    :default: /opt/stack
 
    The devstack base directory.
-
-.. zuul:rolevar:: devstack_early_log
-   :default: /opt/stack/log/devstack-early.txt
-
-   The full devstack log that includes the whatever stack.sh logs before
-   the LOGFILE variable in local.conf is honoured.
diff --git a/roles/run-devstack/defaults/main.yaml b/roles/run-devstack/defaults/main.yaml
index dc4528f692..fea05c8146 100644
--- a/roles/run-devstack/defaults/main.yaml
+++ b/roles/run-devstack/defaults/main.yaml
@@ -1,2 +1 @@
 devstack_base_dir: /opt/stack
-devstack_early_log: /opt/stack/logs/devstack-early.txt
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index f53212904a..64f769c0d0 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -1,5 +1,5 @@
 - name: Run devstack
-  shell: ./stack.sh 2>&1 {{ devstack_early_log }}
+  shell: ./stack.sh 2>&1
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From ac475bbb2a906f481b953494ba28690a716a3554 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Wed, 7 Feb 2018 18:35:40 +0000
Subject: [PATCH 2201/3333] Correct configuration setting using
 NUMBER_FAKE_NOVA_COMPUTE

In Change-Id Ia3843818014f7c6c7526ef3aa9676bbddb8a85ca the 'host'
setting used for each of the fake compute hosts was accidentally named
'nhost' ('\nhost' was edited poorly), so the setting doesn't actually do
anything: you create multiple nova-compute processes they think they are
all on the same host and only one hypervisor and resource provider is
created.

With the correction in place, the wait_for_compute function needs to be
updated to be aware of the fact that the hostnames on the compute
services will have a numeric prefix when the fake virt driver is used.

Change-Id: I5e8430d170c0b1c4f195ebe510aff8be59e4a3bc
---
 functions | 7 ++++++-
 lib/nova  | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 959133ce5c..eabe249894 100644
--- a/functions
+++ b/functions
@@ -446,7 +446,12 @@ function wait_for_compute {
         ID=""
         while [[ "\$ID" == "" ]]; do
             sleep 1
-            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+            if [[ "$VIRT_DRIVER" = 'fake' ]]; then
+                # When using the fake driver the compute hostnames have a suffix of 1 to NUMBER_FAKE_NOVA_COMPUTE
+                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname`1 --service nova-compute -c ID -f value)
+            else
+                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+            fi
         done
 EOF
     time_stop "wait_for_service"
diff --git a/lib/nova b/lib/nova
index fea2b8509a..a6ad907cf4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -877,7 +877,7 @@ function start_nova_compute {
             # creating or modifying real configurations. Each fake
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
-            iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
+            iniset $fake_conf DEFAULT host "${HOSTNAME}${i}"
             run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else

From 34b4ff0bfd0d6fe5a769bb60cdaeba9886ee9317 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 8 Feb 2018 06:15:13 +0000
Subject: [PATCH 2202/3333] Updated from generate-devstack-plugins-list

Change-Id: I681735a1c29e4b41eb9fa71c2838df1a820f5f75
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index d830507f07..ba747203c6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -169,6 +169,7 @@ storlets                               `git://git.openstack.org/openstack/storle
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
+tatu                                   `git://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
 telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__

From 21e3be8a5e2768f35246e2c8ac03e09a51070225 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 6 Feb 2018 17:19:38 -0500
Subject: [PATCH 2203/3333] Add the nova-next job to the experimental queue

The nova-next job is being moved from openstack-zuul-jobs
to the nova repo and so we'll remove it's usage from
project-config, therefore we need to define it's usage for
devstack here.

The related project-config change is:

I36d96f89b3e5323746fcbcef5cc7e4d0384a184d

Depends-On: I24a5f73c29094a23e2fdef8ee8b43601300af593
Change-Id: I28971dc7e5cb0b5cf9698e5251a7bb099e63f3db
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8bc5103588..a90df2f06a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -212,3 +212,6 @@
       jobs:
         - devstack
         - devstack-unit-tests
+    experimental:
+      jobs:
+        - nova-next

From a4922067009b4e293811ec6aa976ef7f72363069 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Thu, 15 Feb 2018 07:45:10 -0600
Subject: [PATCH 2204/3333] Centralize setting default branch for stable
 branching

One of the steps when we create a new stable branch is to
branch devstack, then update the default branch for most
repos to use the new stable branch for each repo.

This requires making multiple updates throughout stackrc,
and to further complicate things, there are some repo
branch variables for branchless repos that should not be
updated along with the others.

This can be error prone if not fully aware of these
exceptions. To simplify this process a little, this
patch adds two common variables - one that can be set to
the new stable branch name for all of the repos that
should be branched, and one that can be used for all of
the branchless repos to make it explicit that those
values should be left alone. The cycle-trailing repos
have until two weeks after final release to branch, so
also adding another variable for those to make it easy
to update them at a later time, separately from the
other repos.

Change-Id: I82aa19e739eeda3721bac1cb5153ad0bf2d1125a
---
 stackrc            | 154 ++++++++++++++++++++++++---------------------
 tests/test_refs.sh |   4 +-
 2 files changed, 85 insertions(+), 73 deletions(-)

diff --git a/stackrc b/stackrc
index c243d271b8..b7105d368e 100644
--- a/stackrc
+++ b/stackrc
@@ -13,6 +13,18 @@ RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 # Source required DevStack functions and globals
 source $RC_DIR/functions
 
+# Set the target branch. This is used so that stable branching
+# does not need to update each repo below.
+TARGET_BRANCH=master
+
+# Cycle trailing projects need to branch later than the others.
+TRAILING_TARGET_BRANCH=master
+
+# And some repos do not create stable branches, so this is used
+# to make it explicit and avoid accidentally setting to a stable
+# branch.
+BRANCHLESS_TARGET_BRANCH=master
+
 # Destination path for installation
 DEST=/opt/stack
 
@@ -256,35 +268,35 @@ DEVSTACK_SERIES="queens"
 
 # block storage service
 CINDER_REPO=${CINDER_REPO:-${GIT_BASE}/openstack/cinder.git}
-CINDER_BRANCH=${CINDER_BRANCH:-master}
+CINDER_BRANCH=${CINDER_BRANCH:-$TARGET_BRANCH}
 
 # image catalog service
 GLANCE_REPO=${GLANCE_REPO:-${GIT_BASE}/openstack/glance.git}
-GLANCE_BRANCH=${GLANCE_BRANCH:-master}
+GLANCE_BRANCH=${GLANCE_BRANCH:-$TARGET_BRANCH}
 
 # django powered web control panel for openstack
 HORIZON_REPO=${HORIZON_REPO:-${GIT_BASE}/openstack/horizon.git}
-HORIZON_BRANCH=${HORIZON_BRANCH:-master}
+HORIZON_BRANCH=${HORIZON_BRANCH:-$TARGET_BRANCH}
 
 # unified auth system (manages accounts/tokens)
 KEYSTONE_REPO=${KEYSTONE_REPO:-${GIT_BASE}/openstack/keystone.git}
-KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-master}
+KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-$TARGET_BRANCH}
 
 # neutron service
 NEUTRON_REPO=${NEUTRON_REPO:-${GIT_BASE}/openstack/neutron.git}
-NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
+NEUTRON_BRANCH=${NEUTRON_BRANCH:-$TARGET_BRANCH}
 
 # neutron fwaas service
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
-NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
+NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-$TARGET_BRANCH}
 
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
-NOVA_BRANCH=${NOVA_BRANCH:-master}
+NOVA_BRANCH=${NOVA_BRANCH:-$TARGET_BRANCH}
 
 # object storage service
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
-SWIFT_BRANCH=${SWIFT_BRANCH:-master}
+SWIFT_BRANCH=${SWIFT_BRANCH:-$TARGET_BRANCH}
 
 ##############
 #
@@ -294,11 +306,11 @@ SWIFT_BRANCH=${SWIFT_BRANCH:-master}
 
 # consolidated openstack requirements
 REQUIREMENTS_REPO=${REQUIREMENTS_REPO:-${GIT_BASE}/openstack/requirements.git}
-REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-master}
+REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-$TARGET_BRANCH}
 
 # Tempest test suite
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
-TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
+TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 
 ##############
@@ -310,56 +322,56 @@ TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 
 # volume client
 GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
-GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
+GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # os-brick client for local volume attachement
 GITREPO["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
-GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
+GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # python barbican client library
 GITREPO["python-barbicanclient"]=${BARBICANCLIENT_REPO:-${GIT_BASE}/openstack/python-barbicanclient.git}
-GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-master}
+GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-$TARGET_BRANCH}
 GITDIR["python-barbicanclient"]=$DEST/python-barbicanclient
 
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
-GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
+GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-$TARGET_BRANCH}
 
 # ironic client
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
-GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
+GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-$TARGET_BRANCH}
 # ironic plugin is out of tree, but nova uses it. set GITDIR here.
 GITDIR["python-ironicclient"]=$DEST/python-ironicclient
 
 # the base authentication plugins that clients use to authenticate
 GITREPO["keystoneauth"]=${KEYSTONEAUTH_REPO:-${GIT_BASE}/openstack/keystoneauth.git}
-GITBRANCH["keystoneauth"]=${KEYSTONEAUTH_BRANCH:-master}
+GITBRANCH["keystoneauth"]=${KEYSTONEAUTH_BRANCH:-$TARGET_BRANCH}
 
 # python keystone client library to nova that horizon uses
 GITREPO["python-keystoneclient"]=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
-GITBRANCH["python-keystoneclient"]=${KEYSTONECLIENT_BRANCH:-master}
+GITBRANCH["python-keystoneclient"]=${KEYSTONECLIENT_BRANCH:-$TARGET_BRANCH}
 
 # neutron client
 GITREPO["python-neutronclient"]=${NEUTRONCLIENT_REPO:-${GIT_BASE}/openstack/python-neutronclient.git}
-GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
+GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # python client library to nova that horizon (and others) use
 GITREPO["python-novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
-GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-master}
+GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-$TARGET_BRANCH}
 
 # python swift client library
 GITREPO["python-swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
-GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
+GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # consolidated openstack python client
 GITREPO["python-openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
-GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
+GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-$TARGET_BRANCH}
 # this doesn't exist in a lib file, so set it here
 GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
 # placement-api CLI
 GITREPO["osc-placement"]=${OSC_PLACEMENT_REPO:-${GIT_BASE}/openstack/osc-placement.git}
-GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-master}
+GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-$TARGET_BRANCH}
 
 
 ###################
@@ -371,119 +383,119 @@ GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-master}
 
 # castellan key manager interface
 GITREPO["castellan"]=${CASTELLAN_REPO:-${GIT_BASE}/openstack/castellan.git}
-GITBRANCH["castellan"]=${CASTELLAN_BRANCH:-master}
+GITBRANCH["castellan"]=${CASTELLAN_BRANCH:-$TARGET_BRANCH}
 
 # cliff command line framework
 GITREPO["cliff"]=${CLIFF_REPO:-${GIT_BASE}/openstack/cliff.git}
-GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
+GITBRANCH["cliff"]=${CLIFF_BRANCH:-$TARGET_BRANCH}
 
 # async framework/helpers
 GITREPO["futurist"]=${FUTURIST_REPO:-${GIT_BASE}/openstack/futurist.git}
-GITBRANCH["futurist"]=${FUTURIST_BRANCH:-master}
+GITBRANCH["futurist"]=${FUTURIST_BRANCH:-$TARGET_BRANCH}
 
 # debtcollector deprecation framework/helpers
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
-GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-master}
+GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-$TARGET_BRANCH}
 
 # helpful state machines
 GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
-GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-master}
+GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-$TARGET_BRANCH}
 
 # oslo.cache
 GITREPO["oslo.cache"]=${OSLOCACHE_REPO:-${GIT_BASE}/openstack/oslo.cache.git}
-GITBRANCH["oslo.cache"]=${OSLOCACHE_BRANCH:-master}
+GITBRANCH["oslo.cache"]=${OSLOCACHE_BRANCH:-$TARGET_BRANCH}
 
 # oslo.concurrency
 GITREPO["oslo.concurrency"]=${OSLOCON_REPO:-${GIT_BASE}/openstack/oslo.concurrency.git}
-GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-master}
+GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-$TARGET_BRANCH}
 
 # oslo.config
 GITREPO["oslo.config"]=${OSLOCFG_REPO:-${GIT_BASE}/openstack/oslo.config.git}
-GITBRANCH["oslo.config"]=${OSLOCFG_BRANCH:-master}
+GITBRANCH["oslo.config"]=${OSLOCFG_BRANCH:-$TARGET_BRANCH}
 
 # oslo.context
 GITREPO["oslo.context"]=${OSLOCTX_REPO:-${GIT_BASE}/openstack/oslo.context.git}
-GITBRANCH["oslo.context"]=${OSLOCTX_BRANCH:-master}
+GITBRANCH["oslo.context"]=${OSLOCTX_BRANCH:-$TARGET_BRANCH}
 
 # oslo.db
 GITREPO["oslo.db"]=${OSLODB_REPO:-${GIT_BASE}/openstack/oslo.db.git}
-GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-master}
+GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-$TARGET_BRANCH}
 
 # oslo.i18n
 GITREPO["oslo.i18n"]=${OSLOI18N_REPO:-${GIT_BASE}/openstack/oslo.i18n.git}
-GITBRANCH["oslo.i18n"]=${OSLOI18N_BRANCH:-master}
+GITBRANCH["oslo.i18n"]=${OSLOI18N_BRANCH:-$TARGET_BRANCH}
 
 # oslo.log
 GITREPO["oslo.log"]=${OSLOLOG_REPO:-${GIT_BASE}/openstack/oslo.log.git}
-GITBRANCH["oslo.log"]=${OSLOLOG_BRANCH:-master}
+GITBRANCH["oslo.log"]=${OSLOLOG_BRANCH:-$TARGET_BRANCH}
 
 # oslo.messaging
 GITREPO["oslo.messaging"]=${OSLOMSG_REPO:-${GIT_BASE}/openstack/oslo.messaging.git}
-GITBRANCH["oslo.messaging"]=${OSLOMSG_BRANCH:-master}
+GITBRANCH["oslo.messaging"]=${OSLOMSG_BRANCH:-$TARGET_BRANCH}
 
 # oslo.middleware
 GITREPO["oslo.middleware"]=${OSLOMID_REPO:-${GIT_BASE}/openstack/oslo.middleware.git}
-GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-master}
+GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-$TARGET_BRANCH}
 
 # oslo.policy
 GITREPO["oslo.policy"]=${OSLOPOLICY_REPO:-${GIT_BASE}/openstack/oslo.policy.git}
-GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-master}
+GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-$TARGET_BRANCH}
 
 # oslo.privsep
 GITREPO["oslo.privsep"]=${OSLOPRIVSEP_REPO:-${GIT_BASE}/openstack/oslo.privsep.git}
-GITBRANCH["oslo.privsep"]=${OSLOPRIVSEP_BRANCH:-master}
+GITBRANCH["oslo.privsep"]=${OSLOPRIVSEP_BRANCH:-$TARGET_BRANCH}
 
 # oslo.reports
 GITREPO["oslo.reports"]=${OSLOREPORTS_REPO:-${GIT_BASE}/openstack/oslo.reports.git}
-GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-master}
+GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-$TARGET_BRANCH}
 
 # oslo.rootwrap
 GITREPO["oslo.rootwrap"]=${OSLORWRAP_REPO:-${GIT_BASE}/openstack/oslo.rootwrap.git}
-GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-master}
+GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-$TARGET_BRANCH}
 
 # oslo.serialization
 GITREPO["oslo.serialization"]=${OSLOSERIALIZATION_REPO:-${GIT_BASE}/openstack/oslo.serialization.git}
-GITBRANCH["oslo.serialization"]=${OSLOSERIALIZATION_BRANCH:-master}
+GITBRANCH["oslo.serialization"]=${OSLOSERIALIZATION_BRANCH:-$TARGET_BRANCH}
 
 # oslo.service
 GITREPO["oslo.service"]=${OSLOSERVICE_REPO:-${GIT_BASE}/openstack/oslo.service.git}
-GITBRANCH["oslo.service"]=${OSLOSERVICE_BRANCH:-master}
+GITBRANCH["oslo.service"]=${OSLOSERVICE_BRANCH:-$TARGET_BRANCH}
 
 # oslo.utils
 GITREPO["oslo.utils"]=${OSLOUTILS_REPO:-${GIT_BASE}/openstack/oslo.utils.git}
-GITBRANCH["oslo.utils"]=${OSLOUTILS_BRANCH:-master}
+GITBRANCH["oslo.utils"]=${OSLOUTILS_BRANCH:-$TARGET_BRANCH}
 
 # oslo.versionedobjects
 GITREPO["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_REPO:-${GIT_BASE}/openstack/oslo.versionedobjects.git}
-GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-master}
+GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-$TARGET_BRANCH}
 
 # oslo.vmware
 GITREPO["oslo.vmware"]=${OSLOVMWARE_REPO:-${GIT_BASE}/openstack/oslo.vmware.git}
-GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-master}
+GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-$TARGET_BRANCH}
 
 # osprofiler
 GITREPO["osprofiler"]=${OSPROFILER_REPO:-${GIT_BASE}/openstack/osprofiler.git}
-GITBRANCH["osprofiler"]=${OSPROFILER_BRANCH:-master}
+GITBRANCH["osprofiler"]=${OSPROFILER_BRANCH:-$TARGET_BRANCH}
 
 # pycadf auditing library
 GITREPO["pycadf"]=${PYCADF_REPO:-${GIT_BASE}/openstack/pycadf.git}
-GITBRANCH["pycadf"]=${PYCADF_BRANCH:-master}
+GITBRANCH["pycadf"]=${PYCADF_BRANCH:-$TARGET_BRANCH}
 
 # stevedore plugin manager
 GITREPO["stevedore"]=${STEVEDORE_REPO:-${GIT_BASE}/openstack/stevedore.git}
-GITBRANCH["stevedore"]=${STEVEDORE_BRANCH:-master}
+GITBRANCH["stevedore"]=${STEVEDORE_BRANCH:-$TARGET_BRANCH}
 
 # taskflow plugin manager
 GITREPO["taskflow"]=${TASKFLOW_REPO:-${GIT_BASE}/openstack/taskflow.git}
-GITBRANCH["taskflow"]=${TASKFLOW_BRANCH:-master}
+GITBRANCH["taskflow"]=${TASKFLOW_BRANCH:-$TARGET_BRANCH}
 
 # tooz plugin manager
 GITREPO["tooz"]=${TOOZ_REPO:-${GIT_BASE}/openstack/tooz.git}
-GITBRANCH["tooz"]=${TOOZ_BRANCH:-master}
+GITBRANCH["tooz"]=${TOOZ_BRANCH:-$TARGET_BRANCH}
 
 # pbr drives the setuptools configs
 GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack-dev/pbr.git}
-GITBRANCH["pbr"]=${PBR_BRANCH:-master}
+GITBRANCH["pbr"]=${PBR_BRANCH:-$TARGET_BRANCH}
 
 
 ##################
@@ -494,65 +506,65 @@ GITBRANCH["pbr"]=${PBR_BRANCH:-master}
 
 # cursive library
 GITREPO["cursive"]=${CURSIVE_REPO:-${GIT_BASE}/openstack/cursive.git}
-GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
+GITBRANCH["cursive"]=${CURSIVE_BRANCH:-$TARGET_BRANCH}
 
 # glance store library
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
-GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
+GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-$TARGET_BRANCH}
 
 # keystone middleware
 GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
-GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
+GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 
 # s3 support for swift
 SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/openstack/swift3.git}
-SWIFT3_BRANCH=${SWIFT3_BRANCH:-master}
+SWIFT3_BRANCH=${SWIFT3_BRANCH:-$TARGET_BRANCH}
 
 # ceilometer middleware
 GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
-GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
+GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 
 # os-brick library to manage local volume attaches
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
-GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
+GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-$TARGET_BRANCH}
 
 # os-client-config to manage clouds.yaml and friends
 GITREPO["os-client-config"]=${OS_CLIENT_CONFIG_REPO:-${GIT_BASE}/openstack/os-client-config.git}
-GITBRANCH["os-client-config"]=${OS_CLIENT_CONFIG_BRANCH:-master}
+GITBRANCH["os-client-config"]=${OS_CLIENT_CONFIG_BRANCH:-$TARGET_BRANCH}
 GITDIR["os-client-config"]=$DEST/os-client-config
 
 # os-vif library to communicate between Neutron to Nova
 GITREPO["os-vif"]=${OS_VIF_REPO:-${GIT_BASE}/openstack/os-vif.git}
-GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
+GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-$TARGET_BRANCH}
 
 # osc-lib OpenStackClient common lib
 GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
-GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-master}
+GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-$TARGET_BRANCH}
 
 # python-openstacksdk OpenStack Python SDK
 GITREPO["python-openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/python-openstacksdk.git}
-GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-master}
+GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-$TARGET_BRANCH}
 
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
-GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
+GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-$TARGET_BRANCH}
 # this doesn't exist in a lib file, so set it here
 GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 # diskimage-builder tool
 GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
-GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-master}
+GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
 # neutron-lib library containing neutron stable non-REST interfaces
 GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git}
-GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-master}
+GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
 # os-traits library for resource provider traits in the placement service
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
-GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-master}
+GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
 
 ##################
 #
@@ -562,19 +574,19 @@ GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-master}
 
 # run-parts script required by os-refresh-config
 DIB_UTILS_REPO=${DIB_UTILS_REPO:-${GIT_BASE}/openstack/dib-utils.git}
-DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-master}
+DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 # os-apply-config configuration template tool
 OAC_REPO=${OAC_REPO:-${GIT_BASE}/openstack/os-apply-config.git}
-OAC_BRANCH=${OAC_BRANCH:-master}
+OAC_BRANCH=${OAC_BRANCH:-$TRAILING_TARGET_BRANCH}
 
 # os-collect-config configuration agent
 OCC_REPO=${OCC_REPO:-${GIT_BASE}/openstack/os-collect-config.git}
-OCC_BRANCH=${OCC_BRANCH:-master}
+OCC_BRANCH=${OCC_BRANCH:-$TRAILING_TARGET_BRANCH}
 
 # os-refresh-config configuration run-parts tool
 ORC_REPO=${ORC_REPO:-${GIT_BASE}/openstack/os-refresh-config.git}
-ORC_BRANCH=${ORC_BRANCH:-master}
+ORC_BRANCH=${ORC_BRANCH:-$TRAILING_TARGET_BRANCH}
 
 
 #################
@@ -587,7 +599,7 @@ ORC_BRANCH=${ORC_BRANCH:-master}
 
 # ironic python agent
 IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironic-python-agent.git}
-IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
+IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
@@ -595,7 +607,7 @@ NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
-SPICE_BRANCH=${SPICE_BRANCH:-master}
+SPICE_BRANCH=${SPICE_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 # Global flag used to configure Tempest and potentially other services if
 # volume multiattach is supported. In Queens, only the libvirt compute driver
diff --git a/tests/test_refs.sh b/tests/test_refs.sh
index 65848cdc72..0f9aa4a5ca 100755
--- a/tests/test_refs.sh
+++ b/tests/test_refs.sh
@@ -15,10 +15,10 @@
 
 echo "Ensuring we don't have crazy refs"
 
-REFS=`grep BRANCH stackrc | grep -v -- '-master' | grep -v 'NOVNC_BRANCH'`
+REFS=`grep BRANCH stackrc | grep -v 'TARGET_BRANCH' | grep -v 'NOVNC_BRANCH'`
 rc=$?
 if [[ $rc -eq 0 ]]; then
-    echo "Branch defaults must be master. Found:"
+    echo "Branch defaults must be one of the *TARGET_BRANCH values. Found:"
     echo $REFS
     exit 1
 fi

From 22d70554acf711558c1a5018f9162eb5f1f4086c Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 15 Feb 2018 16:41:19 -0600
Subject: [PATCH 2205/3333] Add /volume to block-storage endpoint

The block-storage endpoint was added to the catalog, but in the suburl
case it was not added with the /volume suburl. This leads to find it and
attempting to use it but not being able to because it's mis-formed.

Needed-By: https://review.openstack.org/545117
Change-Id: I84721c8ae637417e4b01be9e546ff77c250fc149
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 96a7d5bb8e..75486adda5 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,7 +372,7 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/"
 
             get_or_create_endpoint \
                 "volume" \

From 4d835e33b6e901ef87023ce9b7d71bc21170a9e3 Mon Sep 17 00:00:00 2001
From: IWAMOTO Toshihiro <iwamoto@valinux.co.jp>
Date: Mon, 5 Feb 2018 16:57:41 +0900
Subject: [PATCH 2206/3333] Break up fixup_stuff

Neutron functional tests want to use ubuntu cloud archive but it's
not possible to source the fixup_stuff.sh from a neutron CI setup
script. Break it up so that only the UCA portion can be executed
from neutron.

Change-Id: Ie18833bfa30f1789e63cbe9c86f5ece3453f43fb
---
 stack.sh             |   1 +
 tools/fixup_stuff.sh | 114 +++++++++++++++++++++++++------------------
 2 files changed, 68 insertions(+), 47 deletions(-)

diff --git a/stack.sh b/stack.sh
index 9b496c0e20..81d2ed2bcc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -773,6 +773,7 @@ fi
 
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
+fixup_all
 
 if [[ "$USE_SYSTEMD" == "True" ]]; then
     pip_install_gr systemd-python
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f78f05f2f8..90b2c8bf1f 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -45,27 +45,29 @@ fi
 # where Keystone will try and bind to the port and the port will already be
 # in use as an ephemeral port by another process. This places an explicit
 # exception into the Kernel for the Keystone AUTH ports.
-keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
-
-# Only do the reserved ports when available, on some system (like containers)
-# where it's not exposed we are almost pretty sure these ports would be
-# exclusive for our DevStack.
-if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
-    # Get any currently reserved ports, strip off leading whitespace
-    reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-    if [[ -z "${reserved_ports}" ]]; then
-        # If there are no currently reserved ports, reserve the keystone ports
-        sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+function fixup_keystone {
+    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
+
+    # Only do the reserved ports when available, on some system (like containers)
+    # where it's not exposed we are almost pretty sure these ports would be
+    # exclusive for our DevStack.
+    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
+        # Get any currently reserved ports, strip off leading whitespace
+        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
+
+        if [[ -z "${reserved_ports}" ]]; then
+            # If there are no currently reserved ports, reserve the keystone ports
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+        else
+            # If there are currently reserved ports, keep those and also reserve the
+            # Keystone specific ports. Duplicate reservations are merged into a single
+            # reservation (or range) automatically by the kernel.
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+        fi
     else
-        # If there are currently reserved ports, keep those and also reserve the
-        # Keystone specific ports. Duplicate reservations are merged into a single
-        # reservation (or range) automatically by the kernel.
-        sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+        echo_summary "WARNING: unable to reserve keystone ports"
     fi
-else
-    echo_summary "WARNING: unable to reserve keystone ports"
-fi
+}
 
 # Ubuntu Cloud Archive
 #---------------------
@@ -79,8 +81,12 @@ fi
 # ENABLE_VOLUME_MULTIATTACH is True, we can't use the Pike UCA
 # because multiattach won't work with those package versions.
 # We can remove this check when the UCA has libvirt>=3.10.
-if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" && \
-        "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
+function fixup_uca {
+    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" || \
+            "${ENABLE_VOLUME_MULTIATTACH}" == "True" ]]; then
+        return
+    fi
+
     # This pulls in apt-add-repository
     install_package "software-properties-common"
     # Use UCA for newer libvirt. Should give us libvirt 2.5.0.
@@ -104,8 +110,7 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" && \
     # Force update our APT repos, since we added UCA above.
     REPOS_UPDATED=False
     apt_get_update
-fi
-
+}
 
 # Python Packages
 # ---------------
@@ -120,27 +125,32 @@ function get_package_path {
 # Pre-install affected packages so we can fix the permissions
 # These can go away once we are confident that pip 1.4.1+ is available everywhere
 
-# Fix prettytable 0.7.2 permissions
-# Don't specify --upgrade so we use the existing package if present
-pip_install 'prettytable>=0.7'
-PACKAGE_DIR=$(get_package_path prettytable)
-# Only fix version 0.7.2
-dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)
-if [[ -d $dir ]]; then
-    sudo chmod +r $dir/*
-fi
+function fixup_python_packages {
+    # Fix prettytable 0.7.2 permissions
+    # Don't specify --upgrade so we use the existing package if present
+    pip_install 'prettytable>=0.7'
+    PACKAGE_DIR=$(get_package_path prettytable)
+    # Only fix version 0.7.2
+    dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)
+    if [[ -d $dir ]]; then
+        sudo chmod +r $dir/*
+    fi
 
-# Fix httplib2 0.8 permissions
-# Don't specify --upgrade so we use the existing package if present
-pip_install httplib2
-PACKAGE_DIR=$(get_package_path httplib2)
-# Only fix version 0.8
-dir=$(echo $PACKAGE_DIR-0.8*)
-if [[ -d $dir ]]; then
-    sudo chmod +r $dir/*
-fi
+    # Fix httplib2 0.8 permissions
+    # Don't specify --upgrade so we use the existing package if present
+    pip_install httplib2
+    PACKAGE_DIR=$(get_package_path httplib2)
+    # Only fix version 0.8
+    dir=$(echo $PACKAGE_DIR-0.8*)
+    if [[ -d $dir ]]; then
+        sudo chmod +r $dir/*
+    fi
+}
 
-if is_fedora; then
+function fixup_fedora {
+    if ! is_fedora; then
+        return
+    fi
     # Disable selinux to avoid configuring to allow Apache access
     # to Horizon files (LP#1175444)
     if selinuxenabled; then
@@ -198,7 +208,7 @@ if is_fedora; then
             pip_install --upgrade --force-reinstall requests
         fi
     fi
-fi
+}
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
 # connection issues under proxy so re-install the latest version using
@@ -222,7 +232,17 @@ fi
 #            install.d/pip-and-virtualenv-source-install/04-install-pip
 # [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
 
-if [[ ! -f /etc/ci/mirror_info.sh ]]; then
-    install_package python-virtualenv
-    pip_install -U --force-reinstall virtualenv
-fi
+function fixup_virtualenv {
+    if [[ ! -f /etc/ci/mirror_info.sh ]]; then
+        install_package python-virtualenv
+        pip_install -U --force-reinstall virtualenv
+    fi
+}
+
+function fixup_all {
+    fixup_keystone
+    fixup_uca
+    fixup_python_packages
+    fixup_fedora
+    fixup_virtualenv
+}

From 8f7216290aebdd07f2277a92ae1baab5418c087c Mon Sep 17 00:00:00 2001
From: Josh <jhershbe@redhat.com>
Date: Thu, 1 Feb 2018 09:45:47 +0200
Subject: [PATCH 2207/3333] Restore NEUTRON_CREATE_INITIAL_NETWORKS flag

Somehow this feature was lost in the transition
from q-svc to neutron-api. This patch does not
modify the default behavior but allows specifying
the flag to false to prevent devstack from creating
the public and private networks.

Change-Id: I952672496d007552c0c4d83db0d0df9be50326fc
Signed-off-by: Josh <jhershbe@redhat.com>
---
 lib/neutron | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c5839f5c3e..08347926f7 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -42,6 +42,7 @@ NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
 NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
 NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
 NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
+NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
@@ -438,7 +439,7 @@ function start_neutron_new {
     if is_service_enabled neutron-l3; then
         run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_L3_CONF"
     fi
-    if is_service_enabled neutron-api; then
+    if is_service_enabled neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
         # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
         # of the code in lib/neutron_plugins/services/l3
         if type -p neutron_plugin_create_initial_networks > /dev/null; then

From a3844240ab80626adbfdfda59df0fa8133340a50 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sun, 18 Feb 2018 17:14:48 -0500
Subject: [PATCH 2208/3333] Set [scheduler]workers=$API_WORKERS

Since blueprint placement-claims in Pike, the Nova FilterScheduler
uses the placement service to make resource allocation 'claims'
before sending the build request to the chosen compute host to
perform the legacy style resource claim. This allows us to safely
scale out the number of scheduler workers when using the FilterScheduler.

The [scheduler]workers option defaults to ncpu if using the
FilterScheduler (which is the default scheduler driver) so to avoid
out of memory issues, we need to set $API_WORKERS scheduler workers
if using the FilterScheduler in devstack.

Depends-On: Ifdcd363d7bc22e73d76d69777483e5aaff4036e3
Change-Id: Ieae234eb5388560b3f66bf60c156a91a8e831bc4
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index fea2b8509a..1257967c30 100644
--- a/lib/nova
+++ b/lib/nova
@@ -413,6 +413,9 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF scheduler driver "$SCHEDULER"
     iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
+    if [[ $SCHEDULER == "filter_scheduler" ]]; then
+        iniset $NOVA_CONF scheduler workers "$API_WORKERS"
+    fi
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"

From fddf3430d8b3bb6bc60c6c69c344e7ae437ee894 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Mon, 19 Feb 2018 18:34:43 +0000
Subject: [PATCH 2209/3333] Render devstack ansible roles via zuul-sphinx

Change-Id: Ie0db5bcfdacc2543488704fe4428b68910bd6bf1
---
 doc/requirements.txt | 1 +
 doc/source/conf.py   | 2 +-
 doc/source/index.rst | 2 ++
 doc/source/roles.rst | 4 ++++
 4 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/roles.rst

diff --git a/doc/requirements.txt b/doc/requirements.txt
index e140bc0689..f65e9dfece 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -8,3 +8,4 @@ nwdiag
 blockdiag
 sphinxcontrib-blockdiag
 sphinxcontrib-nwdiag
+zuul-sphinx>=0.2.0
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 780237fe58..e9708fae1d 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -26,7 +26,7 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+extensions = [ 'sphinx.ext.autodoc', 'zuul_sphinx', 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
 
 # openstackdocstheme options
 repository_name = 'openstack-dev/devstack'
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 47087c5a0b..9254c23cae 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -139,6 +139,8 @@ up to date to the latest devstack).
 Enable :doc:`devstack plugins <plugins>` to support additional
 services, features, and configuration not present in base devstack.
 
+Use devstack in your CI with :doc:`Ansible roles <roles>` for Zuul V3.
+
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
diff --git a/doc/source/roles.rst b/doc/source/roles.rst
new file mode 100644
index 0000000000..5baa1e4e82
--- /dev/null
+++ b/doc/source/roles.rst
@@ -0,0 +1,4 @@
+Roles
+=====
+
+.. zuul:autoroles::

From 4d55aa734de178e610e0bb8a3e3f55b82c5f2366 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 20 Feb 2018 06:10:39 +0000
Subject: [PATCH 2210/3333] Updated from generate-devstack-plugins-list

Change-Id: I7c5b33448df43c77fd188a3c44099d9c932d3173
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ba747203c6..591e226645 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -157,6 +157,7 @@ picasso                                `git://git.openstack.org/openstack/picass
 python-openstacksdk                    `git://git.openstack.org/openstack/python-openstacksdk <https://git.openstack.org/cgit/openstack/python-openstacksdk>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
+rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
 scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__

From 2e9e90b9a862fee3a47ad211b712171497f13e97 Mon Sep 17 00:00:00 2001
From: Daniel Mellado <dmellado@redhat.com>
Date: Tue, 20 Feb 2018 12:17:55 +0100
Subject: [PATCH 2211/3333] Fix RedHat entry in apache_config_path

With CentOS 7, ansible is expecting to have RedHat as an attribute for
the dict so Discover configurations task fails with an undefined
variable error.

Closes-Bug: #1750573
Change-Id: I5bf9c4057ca9f75d730add9e429d0ef050c6d900
---
 roles/apache-logs-conf/tasks/main.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 60b4fbfead..339ee358be 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -57,7 +57,7 @@
     apache_config_paths:
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
-      'Redhat': '/etc/httpd/conf.d/'
+      'RedHat': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:

From c9c39a4b043af60d06e71976dab218115ffdf524 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 21 Feb 2018 14:23:10 -0500
Subject: [PATCH 2212/3333] Make the apache-logs-conf role even less verbose

Round 2 to add no_log to more things. Specific looping over stats, it
is pretty noise in logs and doesn't seem to add any value.

Change-Id: I580171e0061fa331f3ed510713f1ac7a1a6cb5ea
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 roles/apache-logs-conf/tasks/main.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 339ee358be..bcc1353a87 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -10,11 +10,13 @@
       path: "/var/log/apache2"
       file_type: any
     register: debian_suse_apache_logs
+
   - name: Dereference files
     stat:
       path: "{{ item.path }}"
     with_items: "{{ debian_suse_apache_logs.files }}"
     register: debian_suse_apache_deref_logs
+
   - name: Create hard links
     file:
       src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
@@ -24,6 +26,7 @@
     when:
       - item.stat.isreg or item.stat.islnk
   when: ansible_os_family in ('Debian', 'Suse')
+  no_log: true
 
 - name: Link apache logs on RedHat
   block:
@@ -32,11 +35,13 @@
       path: "/var/log/httpd"
       file_type: any
     register: redhat_apache_logs
+
   - name: Dereference files
     stat:
       path: "{{ item.path }}"
     with_items: "{{ redhat_apache_logs.files }}"
     register: redhat_apache_deref_logs
+
   - name: Create hard links
     file:
       src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
@@ -46,6 +51,7 @@
     when:
       - item.stat.isreg or item.stat.islnk
   when: ansible_os_family == 'Redhat'
+  no_log: true
 
 - name: Ensure {{ stage_dir }}/apache_config apache_config exists
   file:

From d3106720d22eed7861e14b746e36715adc2933ee Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 21 Feb 2018 16:06:49 -0500
Subject: [PATCH 2213/3333] Suppress more stats tasks

By default stat is pretty verbose, we can set no_log: true to avoid
adding this info to our logs.

Change-Id: Ia18ebfe179443382cc670ffc4363ab037c43bb85
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 roles/devstack-project-conf/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/devstack-project-conf/tasks/main.yaml b/roles/devstack-project-conf/tasks/main.yaml
index 9c6e06bea9..917cdbc370 100644
--- a/roles/devstack-project-conf/tasks/main.yaml
+++ b/roles/devstack-project-conf/tasks/main.yaml
@@ -8,6 +8,7 @@
     path: "/etc/{{ item.value.short_name }}"
   with_dict: "{{ zuul.projects }}"
   register: project_configs
+  no_log: true
 
 - name: Copy configuration files
   command: cp -pRL {{ item.stat.path }} {{ stage_dir }}/etc/{{ item.item.value.short_name }}

From a9e946471ef029755d7dd22f70a20273578c9813 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Feb 2018 08:03:03 +1100
Subject: [PATCH 2214/3333] Role apache-logs-conf: fix redhat matching

Ansible complains:

  The task includes an option with an undefined variable. The error
  was: 'dict object' has no attribute 'RedHat'

which is just a mismatch on the "Redhat" string

Change-Id: I447038256561740c224c68388fa5b6a068cc8fed
---
 roles/apache-logs-conf/tasks/main.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index bcc1353a87..bd64574c9b 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -50,7 +50,7 @@
     with_items: "{{ redhat_apache_deref_logs.results }}"
     when:
       - item.stat.isreg or item.stat.islnk
-  when: ansible_os_family == 'Redhat'
+  when: ansible_os_family == 'RedHat'
   no_log: true
 
 - name: Ensure {{ stage_dir }}/apache_config apache_config exists

From e033e1b80f70c6e31364218b69f9a4fe5c8135a1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 16 Jun 2017 12:56:53 +1000
Subject: [PATCH 2215/3333] py3 changes for outfilter.py

I started running this with dib where we have pure python3
environments and it failed.

You can't have unbuffered text i/o in python3 for ... reasons? [1]
Changing the file to binary mode works around this.  Python3 opens
sys.stdin in text mode, so we need to manually convert the unicode
strings to bytes before we write them to the binary file.

[1] http://bugs.python.org/issue17404

Change-Id: Iebb26f0d3c2347d262cbc10dfd0912840cd05878
---
 tools/outfilter.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index f82939be1d..296cf8dfe5 100755
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -50,15 +50,13 @@ def main():
     opts = get_options()
     outfile = None
     if opts.outfile:
-        outfile = open(opts.outfile, 'a', 0)
+        # note, binary mode so we can do unbuffered output.
+        outfile = open(opts.outfile, 'ab', 0)
 
     # Otherwise fileinput reprocess args as files
     sys.argv = []
-    while True:
-        line = sys.stdin.readline()
-        if not line:
-            return 0
 
+    for line in iter(sys.stdin.readline, ''):
         # put skip lines here
         if skip_line(line):
             continue
@@ -75,8 +73,16 @@ def main():
         if opts.verbose:
             sys.stdout.write(line)
             sys.stdout.flush()
+
         if outfile:
-            outfile.write(line)
+            # We've opened outfile as a binary file to get the
+            # non-buffered behaviour.  on python3, sys.stdin was
+            # opened with the system encoding and made the line into
+            # utf-8, so write the logfile out in utf-8 bytes.
+            if sys.version_info < (3,):
+                outfile.write(line)
+            else:
+                outfile.write(line.encode('utf-8'))
             outfile.flush()
 
 

From 83ecb97fec7efde09f543fb1f5ef65bd6d4f1011 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Feb 2018 10:03:34 +1100
Subject: [PATCH 2216/3333] Add VERBOSE_NO_TIMESTAMP flag

As described in the documentation, this flag is intended for the case
where the console output is being captured by a tool that appends its
own timestamps.

In the gate this is the job-output.txt.  We want the console output as
people like to watch that scrolling by as part of the live console
log.  Although this gets saved to job-output.txt, we still want to
keep logging to the individual log files even though it's technically
a duplicate -- in the multinode case the job-output.txt gets
interleaved by all the running nodes; it's much easier to just look at
the individual log files.  Also, people are used to it where it is :)

Change-Id: I3486636f1c76139581f6cd9668426f507b7c621d
---
 .zuul.yaml                   |  1 +
 doc/source/configuration.rst | 12 ++++++++++++
 stack.sh                     |  7 ++++++-
 tools/outfilter.py           | 27 ++++++++++++++++++++-------
 4 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a90df2f06a..cc29466f35 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -66,6 +66,7 @@
         LOGFILE: /opt/stack/logs/devstacklog.txt
         LOG_COLOR: false
         VERBOSE: true
+        VERBOSE_NO_TIMESTAMP: true
         NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it.
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 49cad05554..1d02395058 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -286,6 +286,18 @@ see what is going on. This can be disabled with::
 
         LOG_COLOR=False
 
+When using the logfile, by default logs are sent to the console and
+the file.  You can set ``VERBOSE`` to ``false`` if you only wish the
+logs to be sent to the file (this may avoid having double-logging in
+some cases where you are capturing the script output and the log
+files).  If ``VERBOSE`` is ``true`` you can additionally set
+``VERBOSE_NO_TIMESTAMP`` to avoid timestamps being added to each
+output line sent to the console.  This can be useful in some
+situations where the console output is being captured by a runner or
+framework (e.g. Ansible) that adds its own timestamps.  Note that the
+log lines sent to the ``LOGFILE`` will still be prefixed with a
+timestamp.
+
 Logging the Service Output
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/stack.sh b/stack.sh
index 9b496c0e20..1d1f12e116 100755
--- a/stack.sh
+++ b/stack.sh
@@ -405,6 +405,7 @@ is_package_installed python || install_package python
 
 # Set up logging level
 VERBOSE=$(trueorfalse True VERBOSE)
+VERBOSE_NO_TIMESTAMP=$(trueorfalse False VERBOSE)
 
 # Draw a spinner so the user knows something is happening
 function spinner {
@@ -470,8 +471,12 @@ if [[ -n "$LOGFILE" ]]; then
     # stdout later.
     exec 3>&1
     if [[ "$VERBOSE" == "True" ]]; then
+        _of_args="-v"
+        if [[ "$VERBOSE_NO_TIMESTAMP" == "True" ]]; then
+            _of_args="$_of_args --no-timestamp"
+        fi
         # Set fd 1 and 2 to write the log file
-        exec 1> >( $TOP_DIR/tools/outfilter.py -v -o "${LOGFILE}" ) 2>&1
+        exec 1> >( $TOP_DIR/tools/outfilter.py $_of_args -o "${LOGFILE}" ) 2>&1
         # Set fd 6 to summary log file
         exec 6> >( $TOP_DIR/tools/outfilter.py -o "${SUMFILE}" )
     else
diff --git a/tools/outfilter.py b/tools/outfilter.py
index 296cf8dfe5..cf091247d0 100755
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -36,6 +36,13 @@ def get_options():
     parser.add_argument('-o', '--outfile',
                         help='Output file for content',
                         default=None)
+    # NOTE(ianw): This is intended for the case where your stdout is
+    # being captured by something like ansible which independently
+    # logs timestamps on the lines it receives.  Note that if using a
+    # output file, those log lines are still timestamped.
+    parser.add_argument('-b', '--no-timestamp', action='store_true',
+                        help='Do not prefix stdout with timestamp (bare)',
+                        default=False)
     parser.add_argument('-v', '--verbose', action='store_true',
                         default=False)
     return parser.parse_args()
@@ -61,17 +68,23 @@ def main():
         if skip_line(line):
             continue
 
-        # This prevents us from nesting date lines, because
-        # we'd like to pull this in directly in Grenade and not double
-        # up on DevStack lines
+        # This prevents us from nesting date lines, because we'd like
+        # to pull this in directly in Grenade and not double up on
+        # DevStack lines.
+        # NOTE(ianw): we could actually strip the extra ts in "bare"
+        # mode (which came after this)? ... as we get more experience
+        # with zuulv3 native jobs and ansible capture it may become
+        # clearer what to do
         if HAS_DATE.search(line) is None:
             now = datetime.datetime.utcnow()
-            line = ("%s | %s" % (
+            ts_line = ("%s | %s" % (
                 now.strftime("%Y-%m-%d %H:%M:%S.%f")[:-3],
                 line))
+        else:
+            ts_line = line
 
         if opts.verbose:
-            sys.stdout.write(line)
+            sys.stdout.write(line if opts.no_timestamp else ts_line)
             sys.stdout.flush()
 
         if outfile:
@@ -80,9 +93,9 @@ def main():
             # opened with the system encoding and made the line into
             # utf-8, so write the logfile out in utf-8 bytes.
             if sys.version_info < (3,):
-                outfile.write(line)
+                outfile.write(ts_line)
             else:
-                outfile.write(line.encode('utf-8'))
+                outfile.write(ts_line.encode('utf-8'))
             outfile.flush()
 
 

From 2346e9a8b531d621c1adc167d8117474f69638bc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 9 Feb 2018 12:49:22 +1100
Subject: [PATCH 2217/3333] Run swift-container-sync under run_process

All the evidence from [1] suggests that on opensuse swift-init is not
detaching the daemon process correctly.  It's possible there's a pipe
still in play that somehow holds our ansible-streamer open.

This is a minimal fix to avoid swift-init.  Although it's possible in
non-default paths to still use swift-init (and hence possibly hit
another variant of this issue), after discussions with swift
developers it was decided the intersection of tests running under our
current ansible, on suse, that would enable these services is
sufficiently small that this is the best course for now.

[1] https://storyboard.openstack.org/#!/story/2001528

Change-Id: I1b68c08c07cf6653ea58506f738cbe0054b38f3a
---
 lib/swift | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 1601e2b1f8..1187846dfc 100644
--- a/lib/swift
+++ b/lib/swift
@@ -827,7 +827,8 @@ function start_swift {
         else
             # The container-sync daemon is strictly needed to pass the container
             # sync Tempest tests.
-            swift-init --run-dir=${SWIFT_DATA_DIR}/run container-sync start
+            enable_service s-container-sync
+            run_process s-container-sync "$SWIFT_BIN_DIR/swift-container-sync ${SWIFT_CONF_DIR}/container-server/1.conf"
         fi
     else
         swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true

From 11641ce14ddec3567187099e87f03b148aadc584 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 5 Feb 2018 14:39:18 +1100
Subject: [PATCH 2218/3333] Move platform jobs to zuulv3 native

We've called the jobs that don't run on our main Ubuntu targets
"platform" jobs; start at moving these jobs to native jobs.

Depends-On: https://review.openstack.org/541010

Change-Id: Ib64d91206a9ac677f4d77873bc54c6a84702d6c3
---
 .zuul.yaml                         | 58 ++++++++++++++++++++++++++++++
 roles/run-devstack/tasks/main.yaml |  5 ++-
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc29466f35..22ba121c2f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,36 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-7
+    nodes:
+      - name: controller
+        label: centos-7
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: devstack-single-node-opensuse-423
+    nodes:
+      - name: controller
+        label: opensuse-423
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: devstack-single-node-fedora-27
+    nodes:
+      - name: controller
+        label: fedora-27
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -140,6 +170,31 @@
     # ready yet. Until then this job should stay non-voting.
     voting: false
 
+# NOTE(ianw) Platform tests have traditionally been non-voting because
+# we often have to rush things through devstack to stabilise the gate,
+# and these platforms don't have the round-the-clock support to avoid
+# becoming blockers in that situation.
+- job:
+    name: devstack-platform-centos-7
+    parent: tempest-full
+    description: Centos 7 platform test
+    nodeset: devstack-single-node-centos-7
+    voting: false
+
+- job:
+    name: devstack-platform-opensuse-423
+    parent: tempest-full
+    description: OpenSuSE 43.2 platform test
+    nodeset: devstack-single-node-opensuse-423
+    voting: false
+
+- job:
+    name: devstack-platform-fedora-27
+    parent: tempest-full
+    description: Fedora 27 platform test
+    nodeset: devstack-single-node-fedora-27
+    voting: false
+
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -207,6 +262,9 @@
     check:
       jobs:
         - devstack
+        - devstack-platform-centos-7
+        - devstack-platform-opensuse-423
+        - devstack-platform-fedora-27
         - devstack-multinode
         - devstack-unit-tests
     gate:
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index 64f769c0d0..1ff82950e4 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -1,5 +1,8 @@
 - name: Run devstack
-  shell: ./stack.sh 2>&1
+  shell:
+    cmd: |
+      ./stack.sh 2>&1
+      echo "*** FINISHED ***"
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From e619603bdab1eebc05690e42de887614a778022a Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Fri, 23 Feb 2018 03:49:18 +0000
Subject: [PATCH 2219/3333] XenAPI: remove xen tools

The xen tools have been moved to the project of *os-xenapi* since
os-xenapi 0.3.0. We also did some refact work on these tools in
os-xenapi. This commit is to remove these tools from devstack. So
that os-xenapi will be the single place for xen tools.

Change-Id: I4fdbe6bce12dfedd0d1e975ab8dd624ee3740c11
---
 tools/xen/README.md                          | 174 +------
 tools/xen/build_xva.sh                       | 191 --------
 tools/xen/devstackubuntu_latecommand.sh      |  14 -
 tools/xen/devstackubuntupreseed.cfg          | 471 -------------------
 tools/xen/functions                          | 341 --------------
 tools/xen/install_os_domU.sh                 | 418 ----------------
 tools/xen/mocks                              |  92 ----
 tools/xen/prepare_guest.sh                   | 123 -----
 tools/xen/prepare_guest_template.sh          |  94 ----
 tools/xen/scripts/install-os-vpx.sh          | 135 ------
 tools/xen/scripts/install_ubuntu_template.sh |  84 ----
 tools/xen/scripts/manage-vdi                 |  96 ----
 tools/xen/scripts/on_exit.sh                 |  24 -
 tools/xen/scripts/uninstall-os-vpx.sh        |  88 ----
 tools/xen/test_functions.sh                  | 205 --------
 tools/xen/xenrc                              | 114 -----
 16 files changed, 2 insertions(+), 2662 deletions(-)
 delete mode 100755 tools/xen/build_xva.sh
 delete mode 100644 tools/xen/devstackubuntu_latecommand.sh
 delete mode 100644 tools/xen/devstackubuntupreseed.cfg
 delete mode 100644 tools/xen/functions
 delete mode 100755 tools/xen/install_os_domU.sh
 delete mode 100644 tools/xen/mocks
 delete mode 100755 tools/xen/prepare_guest.sh
 delete mode 100755 tools/xen/prepare_guest_template.sh
 delete mode 100755 tools/xen/scripts/install-os-vpx.sh
 delete mode 100755 tools/xen/scripts/install_ubuntu_template.sh
 delete mode 100755 tools/xen/scripts/manage-vdi
 delete mode 100755 tools/xen/scripts/on_exit.sh
 delete mode 100755 tools/xen/scripts/uninstall-os-vpx.sh
 delete mode 100755 tools/xen/test_functions.sh
 delete mode 100644 tools/xen/xenrc

diff --git a/tools/xen/README.md b/tools/xen/README.md
index 9559e773d3..22263bb074 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -1,173 +1,3 @@
-# Getting Started With XenServer and Devstack
-
-The purpose of the code in this directory it to help developers bootstrap a
-XenServer 6.2 (older versions may also work) + OpenStack development
-environment. This file gives some pointers on how to get started.
-
-Xenserver is a Type 1 hypervisor, so it is best installed on bare metal.  The
-OpenStack services are configured to run within a virtual machine (called OS
-domU) on the XenServer host. The VM uses the XAPI toolstack to communicate with
-the host over a network connection (see `MGT_BRIDGE_OR_NET_NAME`).
-
-The provided localrc helps to build a basic environment.
-
-## Introduction
-
-### Requirements
-
- - An internet-enabled network with a DHCP server on it
- - XenServer box plugged in to the same network
-This network will be used as the OpenStack management network. The VM Network
-and the Public Network will not be connected to any physical interfaces, only
-new virtual networks will be created by the `install_os_domU.sh` script.
-
-### Steps to follow
-
- - Install XenServer
- - Download Devstack to XenServer
- - Customise `localrc`
- - Start `install_os_domU.sh` script
-
-### Brief explanation
-
-The `install_os_domU.sh` script will:
- - Setup XenAPI plugins
- - Create the named networks, if they don't exist
- - Preseed-Netinstall an Ubuntu Virtual Machine (NOTE: you can save and reuse
-   it, see [Reuse the Ubuntu VM](#reuse-the-ubuntu-vm)), with 1 network
-   interface:
-   - `eth0` - Connected to `UBUNTU_INST_BRIDGE_OR_NET_NAME`, defaults to
-     `MGT_BRIDGE_OR_NET_NAME`
- - After the Ubuntu install process finished, the network configuration is
- modified to:
-   - `eth0` - Management interface, connected to `MGT_BRIDGE_OR_NET_NAME`. Xapi
-     must be accessible through this network.
-   - `eth1` - VM interface, connected to `VM_BRIDGE_OR_NET_NAME`
-   - `eth2` - Public interface, connected to `PUB_BRIDGE_OR_NET_NAME`
- - Start devstack inside the created OpenStack VM
-
-## Step 1: Install Xenserver
-Install XenServer on a clean box. You can download the latest XenServer for
-free from: http://www.xenserver.org/
-
-The XenServer IP configuration depends on your local network setup. If you are
-using dhcp, make a reservation for XenServer, so its IP address won't change
-over time. Make a note of the XenServer's IP address, as it has to be specified
-in `localrc`. The other option is to manually specify the IP setup for the
-XenServer box. Please make sure, that a gateway and a nameserver is configured,
-as `install_os_domU.sh` will connect to github.com to get source-code snapshots.
-
-## Step 2: Download devstack
-On your XenServer host, run the following commands as root:
-
-    wget --no-check-certificate https://github.com/openstack-dev/devstack/zipball/master
-    unzip -o master -d ./devstack
-    cd devstack/*/
-
-## Step 3: Configure your localrc inside the devstack directory
-Devstack uses a localrc for user-specific configuration.  Note that
-the `XENAPI_PASSWORD` must be your dom0 root password.
-Of course, use real passwords if this machine is exposed.
-
-    cat > ./localrc <<EOF
-    # At the moment, we depend on github's snapshot function.
-    GIT_BASE="http://github.com"
-
-    # Passwords
-    # NOTE: these need to be specified, otherwise devstack will try
-    # to prompt for these passwords, blocking the install process.
-
-    DATABASE_PASSWORD=my_super_secret
-    ADMIN_PASSWORD=my_super_secret
-    SERVICE_PASSWORD=my_super_secret
-    RABBIT_PASSWORD=my_super_secret
-    SWIFT_HASH="66a3d6b56c1f479c8b4e70ab5c2000f5"
-    # This will be the password for the OpenStack VM (both stack and root users)
-    GUEST_PASSWORD=my_super_secret
-
-    # XenAPI parameters
-    # NOTE: The following must be set to your XenServer root password!
-
-    XENAPI_PASSWORD=my_xenserver_root_password
-
-    XENAPI_CONNECTION_URL="http://address_of_your_xenserver"
-    VNCSERVER_PROXYCLIENT_ADDRESS=address_of_your_xenserver
-
-    # Explicitly set virt driver
-    VIRT_DRIVER=xenserver
-
-    # Explicitly enable multi-host for nova-network HA
-    MULTI_HOST=1
-
-    # Give extra time for boot
-    ACTIVE_TIMEOUT=45
-
-    EOF
-
-## Step 4: Run `./install_os_domU.sh` from the `tools/xen` directory
-
-    cd tools/xen
-    ./install_os_domU.sh
-
-Once this script finishes executing, log into the VM (openstack domU) that it
-installed and tail the run.sh.log file. You will need to wait until it run.sh
-has finished executing.
-
-# Appendix
-
-This section contains useful information for running devstack in CI
-environments / using ubuntu network mirrors.
-
-## Use a specific Ubuntu mirror for installation
-
-To speed up the Ubuntu installation, you can use a specific mirror. To specify
-a mirror explicitly, include the following settings in your `localrc` file:
-
-    UBUNTU_INST_HTTP_HOSTNAME="archive.ubuntu.com"
-    UBUNTU_INST_HTTP_DIRECTORY="/ubuntu"
-
-These variables set the `mirror/http/hostname` and `mirror/http/directory`
-settings in the ubuntu preseed file. The minimal ubuntu VM will use the
-specified parameters.
-
-## Use an http proxy to speed up Ubuntu installation
-
-To further speed up the Ubuntu VM and package installation, an internal http
-proxy could be used. `squid-deb-proxy` has prooven to be stable. To use an http
-proxy, specify:
-
-    UBUNTU_INST_HTTP_PROXY="http://ubuntu-proxy.somedomain.com:8000"
-
-in your `localrc` file.
-
-## Reuse the Ubuntu VM
-
-Performing a minimal ubuntu installation could take a lot of time, depending on
-your mirror/network speed. If you run `install_os_domU.sh` script on a clean
-hypervisor, you can speed up the installation, by re-using the ubuntu vm from
-a previous installation.
-
-### Export the Ubuntu VM to an XVA
-
-Given you have an nfs export `TEMPLATE_NFS_DIR`:
-
-    TEMPLATE_FILENAME=devstack-jeos.xva
-    TEMPLATE_NAME=jeos_template_for_devstack
-    mountdir=$(mktemp -d)
-    mount -t nfs "$TEMPLATE_NFS_DIR" "$mountdir"
-    VM="$(xe template-list name-label="$TEMPLATE_NAME" --minimal)"
-    xe template-export template-uuid=$VM filename="$mountdir/$TEMPLATE_FILENAME"
-    umount "$mountdir"
-    rm -rf "$mountdir"
-
-### Import the Ubuntu VM
-
-Given you have an nfs export `TEMPLATE_NFS_DIR` where you exported the Ubuntu
-VM as `TEMPLATE_FILENAME`:
-
-    mountdir=$(mktemp -d)
-    mount -t nfs "$TEMPLATE_NFS_DIR" "$mountdir"
-    xe vm-import filename="$mountdir/$TEMPLATE_FILENAME"
-    umount "$mountdir"
-    rm -rf "$mountdir"
+Note: XenServer relative tools have been moved to `os-xenapi`_ and be maintained there.
 
+.. _os-xenapi: https://github.com/openstack/os-xenapi/
diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
deleted file mode 100755
index 34ef719ab9..0000000000
--- a/tools/xen/build_xva.sh
+++ /dev/null
@@ -1,191 +0,0 @@
-#!/bin/bash
-
-# This script is run by install_os_domU.sh
-#
-# It modifies the ubuntu image created by install_os_domU.sh
-# and previously moodified by prepare_guest_template.sh
-#
-# This script is responsible for:
-# - pushing in the DevStack code
-# - creating run.sh, to run the code on boot
-# It does this by mounting the disk image of the VM.
-#
-# The resultant image is then templated and started
-# by install_os_domU.sh
-
-# Exit on errors
-set -o errexit
-# Echo commands
-set -o xtrace
-
-# This directory
-TOP_DIR=$(cd $(dirname "$0") && pwd)
-
-# Include onexit commands
-. $TOP_DIR/scripts/on_exit.sh
-
-# xapi functions
-. $TOP_DIR/functions
-
-# Source params - override xenrc params in your localrc to suite your taste
-source xenrc
-
-#
-# Parameters
-#
-GUEST_NAME="$1"
-
-function _print_interface_config {
-    local device_nr
-    local ip_address
-    local netmask
-
-    device_nr="$1"
-    ip_address="$2"
-    netmask="$3"
-
-    local device
-
-    device="eth${device_nr}"
-
-    echo "auto $device"
-    if [ $ip_address == "dhcp" ]; then
-        echo "iface $device inet dhcp"
-    else
-        echo "iface $device inet static"
-        echo "  address $ip_address"
-        echo "  netmask $netmask"
-    fi
-
-    # Turn off tx checksumming for better performance
-    echo "  post-up ethtool -K $device tx off"
-}
-
-function print_interfaces_config {
-    echo "auto lo"
-    echo "iface lo inet loopback"
-
-    _print_interface_config $PUB_DEV_NR $PUB_IP $PUB_NETMASK
-    _print_interface_config $VM_DEV_NR $VM_IP $VM_NETMASK
-    _print_interface_config $MGT_DEV_NR $MGT_IP $MGT_NETMASK
-}
-
-#
-# Mount the VDI
-#
-STAGING_DIR=$($TOP_DIR/scripts/manage-vdi open $GUEST_NAME 0 1 | grep -o "/tmp/tmp.[[:alnum:]]*")
-add_on_exit "$TOP_DIR/scripts/manage-vdi close $GUEST_NAME 0 1"
-
-# Make sure we have a stage
-if [ ! -d $STAGING_DIR/etc ]; then
-    echo "Stage is not properly set up!"
-    exit 1
-fi
-
-# Only support DHCP for now - don't support how different versions of Ubuntu handle resolv.conf
-if [ "$MGT_IP" != "dhcp" ] && [ "$PUB_IP" != "dhcp" ]; then
-    echo "Configuration without DHCP not supported"
-    exit 1
-fi
-
-# Copy over devstack
-rm -f /tmp/devstack.tar
-cd $TOP_DIR/../../
-tar --exclude='stage' --exclude='xen/xvas' --exclude='xen/nova' -cvf /tmp/devstack.tar .
-mkdir -p $STAGING_DIR/opt/stack/devstack
-tar xf /tmp/devstack.tar -C $STAGING_DIR/opt/stack/devstack
-cd $TOP_DIR
-
-# Create an systemd task for devstack
-cat >$STAGING_DIR/etc/systemd/system/devstack.service << EOF
-[Unit]
-Description=Install OpenStack by DevStack
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStartPre=/bin/rm -f /opt/stack/runsh.succeeded
-ExecStart=/bin/su -c "/opt/stack/run.sh" stack
-StandardOutput=tty
-StandardError=tty
-
-[Install]
-WantedBy=multi-user.target
-
-EOF
-
-# enable this service
-ln -s $STAGING_DIR/etc/systemd/system/devstack.service $STAGING_DIR/etc/systemd/system/multi-user.target.wants/devstack.service
-
-# Configure the hostname
-echo $GUEST_NAME > $STAGING_DIR/etc/hostname
-
-# Hostname must resolve for rabbit
-HOSTS_FILE_IP=$PUB_IP
-if [ $MGT_IP != "dhcp" ]; then
-    HOSTS_FILE_IP=$MGT_IP
-fi
-cat <<EOF >$STAGING_DIR/etc/hosts
-$HOSTS_FILE_IP $GUEST_NAME
-127.0.0.1 localhost localhost.localdomain
-EOF
-
-# Configure the network
-print_interfaces_config > $STAGING_DIR/etc/network/interfaces
-
-# Gracefully cp only if source file/dir exists
-function cp_it {
-    if [ -e $1 ] || [ -d $1 ]; then
-        cp -pRL $1 $2
-    fi
-}
-
-# Copy over your ssh keys and env if desired
-COPYENV=${COPYENV:-1}
-if [ "$COPYENV" = "1" ]; then
-    cp_it ~/.ssh $STAGING_DIR/opt/stack/.ssh
-    cp_it ~/.ssh/id_rsa.pub $STAGING_DIR/opt/stack/.ssh/authorized_keys
-    cp_it ~/.gitconfig $STAGING_DIR/opt/stack/.gitconfig
-    cp_it ~/.vimrc $STAGING_DIR/opt/stack/.vimrc
-    cp_it ~/.bashrc $STAGING_DIR/opt/stack/.bashrc
-fi
-
-# Configure run.sh
-cat <<EOF >$STAGING_DIR/opt/stack/run.sh
-#!/bin/bash
-set -eux
-(
-  flock -n 9 || exit 1
-
-  sudo chown -R stack /opt/stack
-
-  [ -e /opt/stack/runsh.succeeded ] && rm /opt/stack/runsh.succeeded
-  echo \$\$ >> /opt/stack/run_sh.pid
-
-  cd /opt/stack/devstack
-  ./unstack.sh || true
-  ./stack.sh
-
-  # Got to the end - success
-  touch /opt/stack/runsh.succeeded
-
-  # Update /etc/issue
-  (
-      echo "OpenStack VM - Installed by DevStack"
-      IPADDR=$(ip -4 address show eth0 | sed -n 's/.*inet \([0-9\.]\+\).*/\1/p')
-      echo "  Management IP:   $IPADDR"
-      echo -n "  Devstack run:    "
-      if [ -e /opt/stack/runsh.succeeded ]; then
-          echo "SUCCEEDED"
-      else
-          echo "FAILED"
-      fi
-      echo ""
-  ) > /opt/stack/issue
-  sudo cp /opt/stack/issue /etc/issue
-
-  rm /opt/stack/run_sh.pid
-) 9> /opt/stack/.runsh_lock
-EOF
-
-chmod 755 $STAGING_DIR/opt/stack/run.sh
diff --git a/tools/xen/devstackubuntu_latecommand.sh b/tools/xen/devstackubuntu_latecommand.sh
deleted file mode 100644
index 2afbe2cdf3..0000000000
--- a/tools/xen/devstackubuntu_latecommand.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-set -eux
-
-# Need to set barrier=0 to avoid a Xen bug
-# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/824089
-sed -i -e 's/errors=/barrier=0,errors=/' /etc/fstab
-
-# Allow root to login with a password
-sed -i -e 's/.*PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config
-
-# Install the XenServer tools so IP addresses are reported
-wget --no-proxy @XS_TOOLS_URL@ -O /root/tools.deb
-dpkg -i /root/tools.deb
-rm /root/tools.deb
diff --git a/tools/xen/devstackubuntupreseed.cfg b/tools/xen/devstackubuntupreseed.cfg
deleted file mode 100644
index 80f334ba8e..0000000000
--- a/tools/xen/devstackubuntupreseed.cfg
+++ /dev/null
@@ -1,471 +0,0 @@
-### Contents of the preconfiguration file (for squeeze)
-### Localization
-# Preseeding only locale sets language, country and locale.
-d-i debian-installer/locale string en_US
-
-# The values can also be preseeded individually for greater flexibility.
-#d-i debian-installer/language string en
-#d-i debian-installer/country string NL
-#d-i debian-installer/locale string en_GB.UTF-8
-# Optionally specify additional locales to be generated.
-#d-i localechooser/supported-locales en_US.UTF-8, nl_NL.UTF-8
-
-# Keyboard selection.
-# Disable automatic (interactive) keymap detection.
-d-i console-setup/ask_detect boolean false
-#d-i keyboard-configuration/modelcode string pc105
-d-i keyboard-configuration/layoutcode string us
-# To select a variant of the selected layout (if you leave this out, the
-# basic form of the layout will be used):
-#d-i keyboard-configuration/variantcode string dvorak
-
-### Network configuration
-# Disable network configuration entirely. This is useful for cdrom
-# installations on non-networked devices where the network questions,
-# warning and long timeouts are a nuisance.
-#d-i netcfg/enable boolean false
-
-# netcfg will choose an interface that has link if possible. This makes it
-# skip displaying a list if there is more than one interface.
-d-i netcfg/choose_interface select auto
-
-# To pick a particular interface instead:
-#d-i netcfg/choose_interface select eth1
-
-# If you have a slow dhcp server and the installer times out waiting for
-# it, this might be useful.
-d-i netcfg/dhcp_timeout string 120
-
-# If you prefer to configure the network manually, uncomment this line and
-# the static network configuration below.
-#d-i netcfg/disable_autoconfig boolean true
-
-# If you want the preconfiguration file to work on systems both with and
-# without a dhcp server, uncomment these lines and the static network
-# configuration below.
-#d-i netcfg/dhcp_failed note
-#d-i netcfg/dhcp_options select Configure network manually
-
-# Static network configuration.
-#d-i netcfg/get_nameservers string 192.168.1.1
-#d-i netcfg/get_ipaddress string 192.168.1.42
-#d-i netcfg/get_netmask string 255.255.255.0
-#d-i netcfg/get_gateway string 192.168.1.1
-#d-i netcfg/confirm_static boolean true
-
-# Any hostname and domain names assigned from dhcp take precedence over
-# values set here. However, setting the values still prevents the questions
-# from being shown, even if values come from dhcp.
-d-i netcfg/get_hostname string stack
-d-i netcfg/get_domain string stackpass
-
-# Disable that annoying WEP key dialog.
-d-i netcfg/wireless_wep string
-# The wacky dhcp hostname that some ISPs use as a password of sorts.
-#d-i netcfg/dhcp_hostname string radish
-
-# If non-free firmware is needed for the network or other hardware, you can
-# configure the installer to always try to load it, without prompting. Or
-# change to false to disable asking.
-#d-i hw-detect/load_firmware boolean true
-
-### Network console
-# Use the following settings if you wish to make use of the network-console
-# component for remote installation over SSH. This only makes sense if you
-# intend to perform the remainder of the installation manually.
-#d-i anna/choose_modules string network-console
-#d-i network-console/password password r00tme
-#d-i network-console/password-again password r00tme
-
-### Mirror settings
-# If you select ftp, the mirror/country string does not need to be set.
-#d-i mirror/protocol string ftp
-d-i mirror/country string manual
-d-i mirror/http/hostname string archive.ubuntu.com
-d-i mirror/http/directory string /ubuntu
-d-i mirror/http/proxy string
-
-# Alternatively: by default, the installer uses CC.archive.ubuntu.com where
-# CC is the ISO-3166-2 code for the selected country. You can preseed this
-# so that it does so without asking.
-#d-i mirror/http/mirror select CC.archive.ubuntu.com
-
-# Suite to install.
-#d-i mirror/suite string squeeze
-# Suite to use for loading installer components (optional).
-#d-i mirror/udeb/suite string squeeze
-# Components to use for loading installer components (optional).
-#d-i mirror/udeb/components multiselect main, restricted
-
-### Clock and time zone setup
-# Controls whether or not the hardware clock is set to UTC.
-d-i clock-setup/utc boolean true
-
-# You may set this to any valid setting for $TZ; see the contents of
-# /usr/share/zoneinfo/ for valid values.
-d-i time/zone string US/Pacific
-
-# Controls whether to use NTP to set the clock during the install
-d-i clock-setup/ntp boolean true
-# NTP server to use. The default is almost always fine here.
-d-i clock-setup/ntp-server string 0.us.pool.ntp.org
-
-### Partitioning
-## Partitioning example
-# If the system has free space you can choose to only partition that space.
-# This is only honoured if partman-auto/method (below) is not set.
-# Alternatives: custom, some_device, some_device_crypto, some_device_lvm.
-#d-i partman-auto/init_automatically_partition select biggest_free
-
-# Alternatively, you may specify a disk to partition. If the system has only
-# one disk the installer will default to using that, but otherwise the device
-# name must be given in traditional, non-devfs format (so e.g. /dev/hda or
-# /dev/sda, and not e.g. /dev/discs/disc0/disc).
-# For example, to use the first SCSI/SATA hard disk:
-#d-i partman-auto/disk string /dev/sda
-# In addition, you'll need to specify the method to use.
-# The presently available methods are:
-# - regular: use the usual partition types for your architecture
-# - lvm:     use LVM to partition the disk
-# - crypto:  use LVM within an encrypted partition
-d-i partman-auto/method string regular
-
-# If one of the disks that are going to be automatically partitioned
-# contains an old LVM configuration, the user will normally receive a
-# warning. This can be preseeded away...
-d-i partman-lvm/device_remove_lvm boolean true
-# The same applies to pre-existing software RAID array:
-d-i partman-md/device_remove_md boolean true
-# And the same goes for the confirmation to write the lvm partitions.
-d-i partman-lvm/confirm boolean true
-
-# For LVM partitioning, you can select how much of the volume group to use
-# for logical volumes.
-#d-i partman-auto-lvm/guided_size string max
-#d-i partman-auto-lvm/guided_size string 10GB
-#d-i partman-auto-lvm/guided_size string 50%
-
-# You can choose one of the three predefined partitioning recipes:
-# - atomic: all files in one partition
-# - home:   separate /home partition
-# - multi:  separate /home, /usr, /var, and /tmp partitions
-d-i partman-auto/choose_recipe select atomic
-
-# Or provide a recipe of your own...
-# If you have a way to get a recipe file into the d-i environment, you can
-# just point at it.
-#d-i partman-auto/expert_recipe_file string /hd-media/recipe
-
-# If not, you can put an entire recipe into the preconfiguration file in one
-# (logical) line. This example creates a small /boot partition, suitable
-# swap, and uses the rest of the space for the root partition:
-#d-i partman-auto/expert_recipe string                         \
-#      boot-root ::                                            \
-#              40 50 100 ext3                                  \
-#                      $primary{ } $bootable{ }                \
-#                      method{ format } format{ }              \
-#                      use_filesystem{ } filesystem{ ext3 }    \
-#                      mountpoint{ /boot }                     \
-#              .                                               \
-#              500 10000 1000000000 ext3                       \
-#                      method{ format } format{ }              \
-#                      use_filesystem{ } filesystem{ ext3 }    \
-#                      mountpoint{ / }                         \
-#              .                                               \
-#              64 512 300% linux-swap                          \
-#                      method{ swap } format{ }                \
-#              .
-
-# If you just want to change the default filesystem from ext3 to something
-# else, you can do that without providing a full recipe.
-d-i partman/default_filesystem string ext3
-
-# The full recipe format is documented in the file partman-auto-recipe.txt
-# included in the 'debian-installer' package or available from D-I source
-# repository. This also documents how to specify settings such as file
-# system labels, volume group names and which physical devices to include
-# in a volume group.
-
-# This makes partman automatically partition without confirmation, provided
-# that you told it what to do using one of the methods above.
-d-i partman-partitioning/confirm_write_new_label boolean true
-d-i partman/choose_partition select finish
-d-i partman/confirm boolean true
-d-i partman/confirm_nooverwrite boolean true
-
-## Partitioning using RAID
-# The method should be set to "raid".
-#d-i partman-auto/method string raid
-# Specify the disks to be partitioned. They will all get the same layout,
-# so this will only work if the disks are the same size.
-#d-i partman-auto/disk string /dev/sda /dev/sdb
-
-# Next you need to specify the physical partitions that will be used. 
-#d-i partman-auto/expert_recipe string \
-#      multiraid ::                                         \
-#              1000 5000 4000 raid                          \
-#                      $primary{ } method{ raid }           \
-#              .                                            \
-#              64 512 300% raid                             \
-#                      method{ raid }                       \
-#              .                                            \
-#              500 10000 1000000000 raid                    \
-#                      method{ raid }                       \
-#              .
-
-# Last you need to specify how the previously defined partitions will be
-# used in the RAID setup. Remember to use the correct partition numbers
-# for logical partitions. RAID levels 0, 1, 5, 6 and 10 are supported;
-# devices are separated using "#".
-# Parameters are:
-# <raidtype> <devcount> <sparecount> <fstype> <mountpoint> \
-#          <devices> <sparedevices>
-
-#d-i partman-auto-raid/recipe string \
-#    1 2 0 ext3 /                    \
-#          /dev/sda1#/dev/sdb1       \
-#    .                               \
-#    1 2 0 swap -                    \
-#          /dev/sda5#/dev/sdb5       \
-#    .                               \
-#    0 2 0 ext3 /home                \
-#          /dev/sda6#/dev/sdb6       \
-#    .
-
-# For additional information see the file partman-auto-raid-recipe.txt
-# included in the 'debian-installer' package or available from D-I source
-# repository.
-
-# This makes partman automatically partition without confirmation.
-d-i partman-md/confirm boolean true
-d-i partman-partitioning/confirm_write_new_label boolean true
-d-i partman/choose_partition select finish
-d-i partman/confirm boolean true
-d-i partman/confirm_nooverwrite boolean true
-
-## Controlling how partitions are mounted
-# The default is to mount by UUID, but you can also choose "traditional" to
-# use traditional device names, or "label" to try filesystem labels before
-# falling back to UUIDs.
-#d-i partman/mount_style select uuid
-
-### Base system installation
-# Configure APT to not install recommended packages by default. Use of this
-# option can result in an incomplete system and should only be used by very
-# experienced users.
-#d-i base-installer/install-recommends boolean false
-
-# The kernel image (meta) package to be installed; "none" can be used if no
-# kernel is to be installed.
-d-i base-installer/kernel/image string linux-virtual
-
-### Account setup
-# Skip creation of a root account (normal user account will be able to
-# use sudo). The default is false; preseed this to true if you want to set
-# a root password.
-d-i passwd/root-login boolean true
-# Alternatively, to skip creation of a normal user account.
-d-i passwd/make-user boolean false
-
-# Root password, either in clear text
-d-i passwd/root-password password stackpass
-d-i passwd/root-password-again password stackpass
-# or encrypted using an MD5 hash.
-#d-i passwd/root-password-crypted password [MD5 hash]
-
-# To create a normal user account.
-#d-i passwd/user-fullname string Ubuntu User
-#d-i passwd/username string ubuntu
-# Normal user's password, either in clear text
-#d-i passwd/user-password password insecure
-#d-i passwd/user-password-again password insecure
-# or encrypted using an MD5 hash.
-#d-i passwd/user-password-crypted password [MD5 hash]
-# Create the first user with the specified UID instead of the default.
-#d-i passwd/user-uid string 1010
-# The installer will warn about weak passwords. If you are sure you know
-# what you're doing and want to override it, uncomment this.
-d-i user-setup/allow-password-weak boolean true
-
-# The user account will be added to some standard initial groups. To
-# override that, use this.
-#d-i passwd/user-default-groups string audio cdrom video
-
-# Set to true if you want to encrypt the first user's home directory.
-d-i user-setup/encrypt-home boolean false
-
-### Apt setup
-# You can choose to install restricted and universe software, or to install
-# software from the backports repository.
-d-i apt-setup/restricted boolean true
-d-i apt-setup/universe boolean true
-d-i apt-setup/backports boolean true
-# Uncomment this if you don't want to use a network mirror.
-#d-i apt-setup/use_mirror boolean false
-# Select which update services to use; define the mirrors to be used.
-# Values shown below are the normal defaults.
-#d-i apt-setup/services-select multiselect security
-#d-i apt-setup/security_host string security.ubuntu.com
-#d-i apt-setup/security_path string /ubuntu
-
-# Additional repositories, local[0-9] available
-#d-i apt-setup/local0/repository string \
-#       http://local.server/ubuntu squeeze main
-#d-i apt-setup/local0/comment string local server
-# Enable deb-src lines
-#d-i apt-setup/local0/source boolean true
-# URL to the public key of the local repository; you must provide a key or
-# apt will complain about the unauthenticated repository and so the
-# sources.list line will be left commented out
-#d-i apt-setup/local0/key string http://local.server/key
-
-# By default the installer requires that repositories be authenticated
-# using a known gpg key. This setting can be used to disable that
-# authentication. Warning: Insecure, not recommended.
-#d-i debian-installer/allow_unauthenticated boolean true
-
-### Package selection
-#tasksel tasksel/first multiselect ubuntu-desktop
-#tasksel tasksel/first multiselect lamp-server, print-server
-#tasksel tasksel/first multiselect kubuntu-desktop
-tasksel tasksel/first multiselect openssh-server
-
-# Individual additional packages to install
-d-i pkgsel/include string cracklib-runtime curl wget ssh openssh-server tcpdump ethtool git sudo python-netaddr coreutils
-
-# Whether to upgrade packages after debootstrap.
-# Allowed values: none, safe-upgrade, full-upgrade
-d-i pkgsel/upgrade select safe-upgrade
-
-# Language pack selection
-#d-i pkgsel/language-packs multiselect de, en, zh
-
-# Policy for applying updates. May be "none" (no automatic updates),
-# "unattended-upgrades" (install security updates automatically), or
-# "landscape" (manage system with Landscape).
-d-i pkgsel/update-policy select unattended-upgrades
-
-# Some versions of the installer can report back on what software you have
-# installed, and what software you use. The default is not to report back,
-# but sending reports helps the project determine what software is most
-# popular and include it on CDs.
-#popularity-contest popularity-contest/participate boolean false
-
-# By default, the system's locate database will be updated after the
-# installer has finished installing most packages. This may take a while, so
-# if you don't want it, you can set this to "false" to turn it off.
-d-i pkgsel/updatedb boolean false
-
-### Boot loader installation
-# Grub is the default boot loader (for x86). If you want lilo installed
-# instead, uncomment this:
-#d-i grub-installer/skip boolean true
-# To also skip installing lilo, and install no bootloader, uncomment this
-# too:
-#d-i lilo-installer/skip boolean true
-
-# With a few exceptions for unusual partitioning setups, GRUB 2 is now the
-# default. If you need GRUB Legacy for some particular reason, then
-# uncomment this:
-d-i grub-installer/grub2_instead_of_grub_legacy boolean false
-
-# This is fairly safe to set, it makes grub install automatically to the MBR
-# if no other operating system is detected on the machine.
-d-i grub-installer/only_debian boolean true
-
-# This one makes grub-installer install to the MBR if it also finds some other
-# OS, which is less safe as it might not be able to boot that other OS.
-d-i grub-installer/with_other_os boolean true
-
-# Alternatively, if you want to install to a location other than the mbr,
-# uncomment and edit these lines:
-#d-i grub-installer/only_debian boolean false
-#d-i grub-installer/with_other_os boolean false
-#d-i grub-installer/bootdev  string (hd0,0)
-# To install grub to multiple disks:
-#d-i grub-installer/bootdev  string (hd0,0) (hd1,0) (hd2,0)
-
-# Optional password for grub, either in clear text
-#d-i grub-installer/password password r00tme
-#d-i grub-installer/password-again password r00tme
-# or encrypted using an MD5 hash, see grub-md5-crypt(8).
-#d-i grub-installer/password-crypted password [MD5 hash]
-
-# Use the following option to add additional boot parameters for the
-# installed system (if supported by the bootloader installer).
-# Note: options passed to the installer will be added automatically.
-#d-i debian-installer/add-kernel-opts string nousb
-
-### Finishing up the installation
-# During installations from serial console, the regular virtual consoles
-# (VT1-VT6) are normally disabled in /etc/inittab. Uncomment the next
-# line to prevent this.
-d-i finish-install/keep-consoles boolean true
-
-# Avoid that last message about the install being complete.
-d-i finish-install/reboot_in_progress note
-
-# This will prevent the installer from ejecting the CD during the reboot,
-# which is useful in some situations.
-#d-i cdrom-detect/eject boolean false
-
-# This is how to make the installer shutdown when finished, but not
-# reboot into the installed system.
-#d-i debian-installer/exit/halt boolean true
-# This will power off the machine instead of just halting it.
-#d-i debian-installer/exit/poweroff boolean true
-
-### X configuration
-# X can detect the right driver for some cards, but if you're preseeding,
-# you override whatever it chooses. Still, vesa will work most places.
-#xserver-xorg xserver-xorg/config/device/driver select vesa
-
-# A caveat with mouse autodetection is that if it fails, X will retry it
-# over and over. So if it's preseeded to be done, there is a possibility of
-# an infinite loop if the mouse is not autodetected.
-#xserver-xorg xserver-xorg/autodetect_mouse boolean true
-
-# Monitor autodetection is recommended.
-xserver-xorg xserver-xorg/autodetect_monitor boolean true
-# Uncomment if you have an LCD display.
-#xserver-xorg xserver-xorg/config/monitor/lcd boolean true
-# X has three configuration paths for the monitor. Here's how to preseed
-# the "medium" path, which is always available. The "simple" path may not
-# be available, and the "advanced" path asks too many questions.
-xserver-xorg xserver-xorg/config/monitor/selection-method \
-       select medium
-xserver-xorg xserver-xorg/config/monitor/mode-list \
-       select 1024x768 @ 60 Hz
-
-### Preseeding other packages
-# Depending on what software you choose to install, or if things go wrong
-# during the installation process, it's possible that other questions may
-# be asked. You can preseed those too, of course. To get a list of every
-# possible question that could be asked during an install, do an
-# installation, and then run these commands:
-#   debconf-get-selections --installer > file
-#   debconf-get-selections >> file
-
-
-#### Advanced options
-### Running custom commands during the installation
-# d-i preseeding is inherently not secure. Nothing in the installer checks
-# for attempts at buffer overflows or other exploits of the values of a
-# preconfiguration file like this one. Only use preconfiguration files from
-# trusted locations! To drive that home, and because it's generally useful,
-# here's a way to run any shell command you'd like inside the installer,
-# automatically.
-
-# This first command is run as early as possible, just after
-# preseeding is read.
-#d-i preseed/early_command string anna-install some-udeb
-# This command is run immediately before the partitioner starts. It may be
-# useful to apply dynamic partitioner preseeding that depends on the state
-# of the disks (which may not be visible when preseed/early_command runs).
-#d-i partman/early_command \
-#       string debconf-set partman-auto/disk "$(list-devices disk | head -n1)"
-# This command is run just before the install finishes, but when there is
-# still a usable /target directory. You can chroot to /target and use it
-# directly, or use the apt-install and in-target commands to easily install
-# packages and run commands in the target system.
-d-i preseed/late_command string
diff --git a/tools/xen/functions b/tools/xen/functions
deleted file mode 100644
index bc0c515e01..0000000000
--- a/tools/xen/functions
+++ /dev/null
@@ -1,341 +0,0 @@
-#!/bin/bash
-
-function die_with_error {
-    local err_msg
-
-    err_msg="$1"
-
-    echo "$err_msg" >&2
-    exit 1
-}
-
-function xapi_plugin_location {
-    for PLUGIN_DIR in "/etc/xapi.d/plugins/" "/usr/lib/xcp/plugins/" "/usr/lib/xapi/plugins" "/usr/lib64/xapi/plugins"; do
-        if [ -d $PLUGIN_DIR ]; then
-            echo $PLUGIN_DIR
-            return 0
-        fi
-    done
-    return 1
-}
-
-function create_directory_for_kernels {
-    if [ -d "/boot/guest" ]; then
-        echo "INFO: /boot/guest directory already exists, using that" >&2
-    else
-        local local_path
-        local_path="$(get_local_sr_path)/os-guest-kernels"
-        mkdir -p $local_path
-        ln -s $local_path /boot/guest
-    fi
-}
-
-function create_directory_for_images {
-    if [ -d "/images" ]; then
-        echo "INFO: /images directory already exists, using that" >&2
-    else
-        local local_path
-        local_path="$(get_local_sr_path)/os-images"
-        mkdir -p $local_path
-        ln -s $local_path /images
-    fi
-}
-
-function get_local_sr {
-    xe pool-list params=default-SR minimal=true
-}
-
-function get_local_sr_path {
-    pbd_path="/var/run/sr-mount/$(get_local_sr)"
-    pbd_device_config_path=`xe pbd-list sr-uuid=$(get_local_sr) params=device-config | grep " path: "`
-    if [ -n "$pbd_device_config_path" ]; then
-        pbd_uuid=`xe pbd-list sr-uuid=$(get_local_sr) minimal=true`
-        pbd_path=`xe pbd-param-get uuid=$pbd_uuid param-name=device-config param-key=path || echo ""`
-    fi
-    echo $pbd_path
-}
-
-function find_ip_by_name {
-    local guest_name="$1"
-    local interface="$2"
-
-    local period=10
-    local max_tries=10
-    local i=0
-
-    while true; do
-        if [ $i -ge $max_tries ]; then
-            echo "Timeout: ip address for interface $interface of $guest_name"
-            exit 11
-        fi
-
-        ipaddress=$(xe vm-list --minimal \
-                    name-label=$guest_name \
-                    params=networks | sed -ne "s,^.*${interface}/ip: \([0-9.]*\).*\$,\1,p")
-
-        if [ -z "$ipaddress" ]; then
-            sleep $period
-            i=$((i+1))
-        else
-            echo $ipaddress
-            break
-        fi
-    done
-}
-
-function _vm_uuid {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    xe vm-list name-label="$vm_name_label" --minimal
-}
-
-function _create_new_network {
-    local name_label
-    name_label=$1
-
-    xe network-create name-label="$name_label"
-}
-
-function _multiple_networks_with_name {
-    local name_label
-    name_label=$1
-
-    # A comma indicates multiple matches
-    xe network-list name-label="$name_label" --minimal | grep -q ","
-}
-
-function _network_exists {
-    local name_label
-    name_label=$1
-
-    ! [ -z "$(xe network-list name-label="$name_label" --minimal)" ]
-}
-
-function _bridge_exists {
-    local bridge
-    bridge=$1
-
-    ! [ -z "$(xe network-list bridge="$bridge" --minimal)" ]
-}
-
-function _network_uuid {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    if _bridge_exists "$bridge_or_net_name"; then
-        xe network-list bridge="$bridge_or_net_name" --minimal
-    else
-        xe network-list name-label="$bridge_or_net_name" --minimal
-    fi
-}
-
-function add_interface {
-    local vm_name_label
-    local bridge_or_network_name
-
-    vm_name_label="$1"
-    bridge_or_network_name="$2"
-    device_number="$3"
-
-    local vm
-    local net
-
-    vm=$(_vm_uuid "$vm_name_label")
-    net=$(_network_uuid "$bridge_or_network_name")
-    xe vif-create network-uuid=$net vm-uuid=$vm device=$device_number
-}
-
-function setup_network {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    if ! _bridge_exists "$bridge_or_net_name"; then
-        if _network_exists "$bridge_or_net_name"; then
-            if _multiple_networks_with_name "$bridge_or_net_name"; then
-                cat >&2 << EOF
-ERROR: Multiple networks found matching name-label to "$bridge_or_net_name"
-please review your XenServer network configuration / localrc file.
-EOF
-                exit 1
-            fi
-        else
-            _create_new_network "$bridge_or_net_name"
-        fi
-    fi
-}
-
-function bridge_for {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    if _bridge_exists "$bridge_or_net_name"; then
-        echo "$bridge_or_net_name"
-    else
-        xe network-list name-label="$bridge_or_net_name" params=bridge --minimal
-    fi
-}
-
-function xenapi_ip_on {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    ip -4 addr show $(bridge_for "$bridge_or_net_name") |\
-    awk '/inet/{split($2, ip, "/"); print ip[1];}'
-}
-
-function xenapi_is_listening_on {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    ! [ -z $(xenapi_ip_on "$bridge_or_net_name") ]
-}
-
-function parameter_is_specified {
-    local parameter_name
-    parameter_name=$1
-
-    compgen -v | grep "$parameter_name"
-}
-
-function append_kernel_cmdline {
-    local vm_name_label
-    local kernel_args
-
-    vm_name_label="$1"
-    kernel_args="$2"
-
-    local vm
-    local pv_args
-
-    vm=$(_vm_uuid "$vm_name_label")
-    pv_args=$(xe vm-param-get param-name=PV-args uuid=$vm)
-    xe vm-param-set PV-args="$pv_args $kernel_args" uuid=$vm
-}
-
-function destroy_all_vifs_of {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    local vm
-
-    vm=$(_vm_uuid "$vm_name_label")
-    IFS=,
-    for vif in $(xe vif-list vm-uuid=$vm --minimal); do
-        xe vif-destroy uuid="$vif"
-    done
-    unset IFS
-}
-
-function have_multiple_hosts {
-    xe host-list --minimal | grep -q ","
-}
-
-function attach_network {
-    local bridge_or_net_name
-
-    bridge_or_net_name="$1"
-
-    local net
-    local host
-
-    net=$(_network_uuid "$bridge_or_net_name")
-    host=$(xe host-list --minimal)
-
-    xe network-attach uuid=$net host-uuid=$host
-}
-
-function set_vm_memory {
-    local vm_name_label
-    local memory
-
-    vm_name_label="$1"
-    memory="$2"
-
-    local vm
-
-    vm=$(_vm_uuid "$vm_name_label")
-
-    xe vm-memory-limits-set \
-        static-min=${memory}MiB \
-        static-max=${memory}MiB \
-        dynamic-min=${memory}MiB \
-        dynamic-max=${memory}MiB \
-        uuid=$vm
-}
-
-function max_vcpus {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    local vm
-    local host
-    local cpu_count
-
-    host=$(xe host-list --minimal)
-    vm=$(_vm_uuid "$vm_name_label")
-
-    cpu_count=$(xe host-param-get \
-        param-name=cpu_info \
-        uuid=$host |
-        sed -e 's/^.*cpu_count: \([0-9]*\);.*$/\1/g')
-
-    if [ -z "$cpu_count" ]; then
-        # get dom0's vcpu count
-        cpu_count=$(cat /proc/cpuinfo | grep processor | wc -l)
-    fi
-
-    # Assert cpu_count is not empty
-    [ -n "$cpu_count" ]
-
-    # Assert ithas a numeric nonzero value
-    expr "$cpu_count" + 0
-
-    # 8 VCPUs should be enough for devstack VM; avoid using too
-    # many VCPUs:
-    # 1. too many VCPUs may trigger a kernel bug which result VM
-    #    not able to boot:
-    #    https://kernel.googlesource.com/pub/scm/linux/kernel/git/wsa/linux/+/e2e004acc7cbe3c531e752a270a74e95cde3ea48
-    # 2. The remaining CPUs can be used for other purpose:
-    #    e.g. boot test VMs.
-    MAX_VCPUS=8
-    if [ $cpu_count -ge $MAX_VCPUS ]; then
-        cpu_count=$MAX_VCPUS
-    fi
-
-    xe vm-param-set uuid=$vm VCPUs-max=$cpu_count
-    xe vm-param-set uuid=$vm VCPUs-at-startup=$cpu_count
-}
-
-function get_domid {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    xe vm-list name-label="$vm_name_label" params=dom-id minimal=true
-}
-
-function install_conntrack_tools {
-    local xs_host
-    local xs_ver_major
-    local centos_ver
-    local conntrack_conf
-    xs_host=$(xe host-list --minimal)
-    xs_ver_major=$(xe host-param-get uuid=$xs_host param-name=software-version param-key=product_version_text_short | cut -d'.' -f 1)
-    if [ $xs_ver_major -gt 6 ]; then
-        # Only support conntrack-tools in Dom0 with XS7.0 and above
-        if [ ! -f /usr/sbin/conntrackd ]; then
-            sed -i s/#baseurl=/baseurl=/g /etc/yum.repos.d/CentOS-Base.repo
-            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'/' -f 1 | cut -d'-' -f 1)
-            yum install -y --enablerepo=base --releasever=$centos_ver conntrack-tools
-            # Backup conntrackd.conf after install conntrack-tools, use the one with statistic mode
-            mv /etc/conntrackd/conntrackd.conf /etc/conntrackd/conntrackd.conf.back
-            conntrack_conf=$(find /usr/share/doc -name conntrackd.conf |grep stats)
-            cp $conntrack_conf /etc/conntrackd/conntrackd.conf
-        fi
-        service conntrackd restart
-    fi
-}
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
deleted file mode 100755
index f4ca71a906..0000000000
--- a/tools/xen/install_os_domU.sh
+++ /dev/null
@@ -1,418 +0,0 @@
-#!/bin/bash
-
-# This script must be run on a XenServer or XCP machine
-#
-# It creates a DomU VM that runs OpenStack services
-#
-# For more details see: README.md
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-export LC_ALL=C
-
-# This directory
-THIS_DIR=$(cd $(dirname "$0") && pwd)
-
-# Include onexit commands
-. $THIS_DIR/scripts/on_exit.sh
-
-# xapi functions
-. $THIS_DIR/functions
-
-#
-# Get Settings
-#
-TOP_DIR=$(cd $THIS_DIR/../../ && pwd)
-source $TOP_DIR/inc/meta-config
-rm -f $TOP_DIR/.localrc.auto
-extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
-
-# Source params - override xenrc params in your localrc to suit your taste
-source $THIS_DIR/xenrc
-
-xe_min()
-{
-    local cmd="$1"
-    shift
-    xe "$cmd" --minimal "$@"
-}
-
-#
-# Prepare Dom0
-# including installing XenAPI plugins
-#
-
-cd $THIS_DIR
-
-# Die if multiple hosts listed
-if have_multiple_hosts; then
-    cat >&2 << EOF
-ERROR: multiple hosts found. This might mean that the XenServer is a member
-of a pool - Exiting.
-EOF
-    exit 1
-fi
-
-#
-# Configure Networking
-#
-
-MGT_NETWORK=`xe pif-list management=true params=network-uuid minimal=true`
-MGT_BRIDGE_OR_NET_NAME=`xe network-list uuid=$MGT_NETWORK params=bridge minimal=true`
-
-setup_network "$VM_BRIDGE_OR_NET_NAME"
-setup_network "$MGT_BRIDGE_OR_NET_NAME"
-setup_network "$PUB_BRIDGE_OR_NET_NAME"
-
-if parameter_is_specified "FLAT_NETWORK_BRIDGE"; then
-    if [ "$(bridge_for "$VM_BRIDGE_OR_NET_NAME")" != "$(bridge_for "$FLAT_NETWORK_BRIDGE")" ]; then
-        cat >&2 << EOF
-ERROR: FLAT_NETWORK_BRIDGE is specified in localrc file, and either no network
-found on XenServer by searching for networks by that value as name-label or
-bridge name or the network found does not match the network specified by
-VM_BRIDGE_OR_NET_NAME. Please check your localrc file.
-EOF
-        exit 1
-    fi
-fi
-
-if ! xenapi_is_listening_on "$MGT_BRIDGE_OR_NET_NAME"; then
-    cat >&2 << EOF
-ERROR: XenAPI does not have an assigned IP address on the management network.
-please review your XenServer network configuration / localrc file.
-EOF
-    exit 1
-fi
-
-HOST_IP=$(xenapi_ip_on "$MGT_BRIDGE_OR_NET_NAME")
-
-# Set up ip forwarding, but skip on xcp-xapi
-if [ -a /etc/sysconfig/network ]; then
-    if ! grep -q "FORWARD_IPV4=YES" /etc/sysconfig/network; then
-        # FIXME: This doesn't work on reboot!
-        echo "FORWARD_IPV4=YES" >> /etc/sysconfig/network
-    fi
-fi
-# Also, enable ip forwarding in rc.local, since the above trick isn't working
-if ! grep -q  "echo 1 >/proc/sys/net/ipv4/ip_forward" /etc/rc.local; then
-    echo "echo 1 >/proc/sys/net/ipv4/ip_forward" >> /etc/rc.local
-fi
-# Enable ip forwarding at runtime as well
-echo 1 > /proc/sys/net/ipv4/ip_forward
-
-
-#
-# Shutdown previous runs
-#
-
-DO_SHUTDOWN=${DO_SHUTDOWN:-1}
-CLEAN_TEMPLATES=${CLEAN_TEMPLATES:-false}
-if [ "$DO_SHUTDOWN" = "1" ]; then
-    # Shutdown all domU's that created previously
-    clean_templates_arg=""
-    if $CLEAN_TEMPLATES; then
-        clean_templates_arg="--remove-templates"
-    fi
-    ./scripts/uninstall-os-vpx.sh $clean_templates_arg
-
-    # Destroy any instances that were launched
-    for uuid in `xe vm-list | grep -1 instance | grep uuid | sed "s/.*\: //g"`; do
-        echo "Shutting down nova instance $uuid"
-        xe vm-uninstall uuid=$uuid force=true
-    done
-
-    # Destroy orphaned vdis
-    for uuid in `xe vdi-list | grep -1 Glance | grep uuid | sed "s/.*\: //g"`; do
-        xe vdi-destroy uuid=$uuid
-    done
-fi
-
-
-#
-# Create Ubuntu VM template
-# and/or create VM from template
-#
-
-GUEST_NAME=${GUEST_NAME:-"DevStackOSDomU"}
-TNAME="jeos_template_for_devstack"
-SNAME_TEMPLATE="jeos_snapshot_for_devstack"
-SNAME_FIRST_BOOT="before_first_boot"
-
-function wait_for_VM_to_halt {
-    set +x
-    echo "Waiting for the VM to halt.  Progress in-VM can be checked with XenCenter or xl console:"
-    mgmt_ip=$(echo $XENAPI_CONNECTION_URL | tr -d -c '1234567890.')
-    domid=$(get_domid "$GUEST_NAME")
-    echo "ssh root@$mgmt_ip \"xl console $domid\""
-    while true; do
-        state=$(xe_min vm-list name-label="$GUEST_NAME" power-state=halted)
-        if [ -n "$state" ]; then
-            break
-        else
-            echo -n "."
-            sleep 20
-        fi
-    done
-    set -x
-}
-
-templateuuid=$(xe template-list name-label="$TNAME")
-if [ -z "$templateuuid" ]; then
-    #
-    # Install Ubuntu over network
-    #
-    UBUNTU_INST_BRIDGE_OR_NET_NAME=${UBUNTU_INST_BRIDGE_OR_NET_NAME:-"$MGT_BRIDGE_OR_NET_NAME"}
-
-    # always update the preseed file, incase we have a newer one
-    PRESEED_URL=${PRESEED_URL:-""}
-    if [ -z "$PRESEED_URL" ]; then
-        PRESEED_URL="${HOST_IP}/devstackubuntupreseed.cfg"
-
-        HTTP_SERVER_LOCATION="/opt/xensource/www"
-        if [ ! -e $HTTP_SERVER_LOCATION ]; then
-            HTTP_SERVER_LOCATION="/var/www/html"
-            mkdir -p $HTTP_SERVER_LOCATION
-        fi
-
-        # Copy the tools DEB to the XS web server
-        XS_TOOLS_URL="https://github.com/downloads/citrix-openstack/warehouse/xe-guest-utilities_5.6.100-651_amd64.deb"
-        ISO_DIR="/opt/xensource/packages/iso"
-        if [ -e "$ISO_DIR" ]; then
-            TOOLS_ISO=$(ls -1 $ISO_DIR/*-tools-*.iso | head -1)
-            TMP_DIR=/tmp/temp.$RANDOM
-            mkdir -p $TMP_DIR
-            mount -o loop $TOOLS_ISO $TMP_DIR
-            # the target deb package maybe *amd64.deb or *all.deb,
-            # so use *amd64.deb by default. If it doesn't exist,
-            # then use *all.deb.
-            DEB_FILE=$(ls $TMP_DIR/Linux/*amd64.deb || ls $TMP_DIR/Linux/*all.deb)
-            cp $DEB_FILE $HTTP_SERVER_LOCATION
-            umount $TMP_DIR
-            rmdir $TMP_DIR
-            XS_TOOLS_URL=${HOST_IP}/$(basename $DEB_FILE)
-        fi
-
-        cp -f $THIS_DIR/devstackubuntupreseed.cfg $HTTP_SERVER_LOCATION
-        cp -f $THIS_DIR/devstackubuntu_latecommand.sh $HTTP_SERVER_LOCATION/latecommand.sh
-
-        sed \
-            -e "s,\(d-i mirror/http/hostname string\).*,\1 $UBUNTU_INST_HTTP_HOSTNAME,g" \
-            -e "s,\(d-i mirror/http/directory string\).*,\1 $UBUNTU_INST_HTTP_DIRECTORY,g" \
-            -e "s,\(d-i mirror/http/proxy string\).*,\1 $UBUNTU_INST_HTTP_PROXY,g" \
-            -e "s,\(d-i passwd/root-password password\).*,\1 $GUEST_PASSWORD,g" \
-            -e "s,\(d-i passwd/root-password-again password\).*,\1 $GUEST_PASSWORD,g" \
-            -e "s,\(d-i preseed/late_command string\).*,\1 in-target mkdir -p /tmp; in-target wget --no-proxy ${HOST_IP}/latecommand.sh -O /root/latecommand.sh; in-target bash /root/latecommand.sh,g" \
-            -i "${HTTP_SERVER_LOCATION}/devstackubuntupreseed.cfg"
-
-        sed \
-            -e "s,@XS_TOOLS_URL@,$XS_TOOLS_URL,g" \
-            -i "${HTTP_SERVER_LOCATION}/latecommand.sh"
-    fi
-
-    # Update the template
-    $THIS_DIR/scripts/install_ubuntu_template.sh $PRESEED_URL
-
-    # create a new VM from the given template with eth0 attached to the given
-    # network
-    $THIS_DIR/scripts/install-os-vpx.sh \
-        -t "$UBUNTU_INST_TEMPLATE_NAME" \
-        -n "$UBUNTU_INST_BRIDGE_OR_NET_NAME" \
-        -l "$GUEST_NAME"
-
-    set_vm_memory "$GUEST_NAME" "1024"
-
-    xe vm-start vm="$GUEST_NAME"
-
-    # wait for install to finish
-    wait_for_VM_to_halt
-
-    # set VM to restart after a reboot
-    vm_uuid=$(xe_min vm-list name-label="$GUEST_NAME")
-    xe vm-param-set actions-after-reboot=Restart uuid="$vm_uuid"
-
-    # Make template from VM
-    snuuid=$(xe vm-snapshot vm="$GUEST_NAME" new-name-label="$SNAME_TEMPLATE")
-    xe snapshot-clone uuid=$snuuid new-name-label="$TNAME"
-else
-    #
-    # Template already installed, create VM from template
-    #
-    vm_uuid=$(xe vm-install template="$TNAME" new-name-label="$GUEST_NAME")
-fi
-
-if [ -n "${EXIT_AFTER_JEOS_INSTALLATION:-}" ]; then
-    echo "User requested to quit after JEOS installation"
-    exit 0
-fi
-
-#
-# Prepare VM for DevStack
-#
-xe vm-param-set other-config:os-vpx=true uuid="$vm_uuid"
-
-# Install XenServer tools, and other such things
-$THIS_DIR/prepare_guest_template.sh "$GUEST_NAME"
-
-# Set virtual machine parameters
-set_vm_memory "$GUEST_NAME" "$OSDOMU_MEM_MB"
-
-# Max out VCPU count for better performance
-max_vcpus "$GUEST_NAME"
-
-# Wipe out all network cards
-destroy_all_vifs_of "$GUEST_NAME"
-
-# Add only one interface to prepare the guest template
-add_interface "$GUEST_NAME" "$MGT_BRIDGE_OR_NET_NAME" "0"
-
-# start the VM to run the prepare steps
-xe vm-start vm="$GUEST_NAME"
-
-# Wait for prep script to finish and shutdown system
-wait_for_VM_to_halt
-
-## Setup network cards
-# Wipe out all
-destroy_all_vifs_of "$GUEST_NAME"
-# Tenant network
-add_interface "$GUEST_NAME" "$VM_BRIDGE_OR_NET_NAME" "$VM_DEV_NR"
-# Management network
-add_interface "$GUEST_NAME" "$MGT_BRIDGE_OR_NET_NAME" "$MGT_DEV_NR"
-# Public network
-add_interface "$GUEST_NAME" "$PUB_BRIDGE_OR_NET_NAME" "$PUB_DEV_NR"
-
-#
-# Inject DevStack inside VM disk
-#
-$THIS_DIR/build_xva.sh "$GUEST_NAME"
-
-FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
-append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"
-
-# Add a separate xvdb, if it was requested
-if [[ "0" != "$XEN_XVDB_SIZE_GB" ]]; then
-    vm=$(xe vm-list name-label="$GUEST_NAME" --minimal)
-
-    # Add a new disk
-    localsr=$(get_local_sr)
-    extra_vdi=$(xe vdi-create \
-        name-label=xvdb-added-by-devstack \
-        virtual-size="${XEN_XVDB_SIZE_GB}GiB" \
-        sr-uuid=$localsr type=user)
-    xe vbd-create vm-uuid=$vm vdi-uuid=$extra_vdi device=1
-fi
-
-# create a snapshot before the first boot
-# to allow a quick re-run with the same settings
-xe vm-snapshot vm="$GUEST_NAME" new-name-label="$SNAME_FIRST_BOOT"
-
-#
-# Run DevStack VM
-#
-xe vm-start vm="$GUEST_NAME"
-
-function ssh_no_check {
-    ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
-}
-
-# Get hold of the Management IP of OpenStack VM
-OS_VM_MANAGEMENT_ADDRESS=$MGT_IP
-if [ $OS_VM_MANAGEMENT_ADDRESS == "dhcp" ]; then
-    OS_VM_MANAGEMENT_ADDRESS=$(find_ip_by_name $GUEST_NAME $MGT_DEV_NR)
-fi
-
-# Get hold of the Service IP of OpenStack VM
-if [ $HOST_IP_IFACE == "eth${MGT_DEV_NR}" ]; then
-    OS_VM_SERVICES_ADDRESS=$MGT_IP
-    if [ $MGT_IP == "dhcp" ]; then
-        OS_VM_SERVICES_ADDRESS=$(find_ip_by_name $GUEST_NAME $MGT_DEV_NR)
-    fi
-else
-    OS_VM_SERVICES_ADDRESS=$PUB_IP
-    if [ $PUB_IP == "dhcp" ]; then
-        OS_VM_SERVICES_ADDRESS=$(find_ip_by_name $GUEST_NAME $PUB_DEV_NR)
-    fi
-fi
-
-# Create an ssh-keypair, and set it up for dom0 user
-rm -f /root/dom0key /root/dom0key.pub
-ssh-keygen -f /root/dom0key -P "" -C "dom0"
-DOMID=$(get_domid "$GUEST_NAME")
-
-xenstore-write /local/domain/$DOMID/authorized_keys/$DOMZERO_USER "$(cat /root/dom0key.pub)"
-xenstore-chmod -u /local/domain/$DOMID/authorized_keys/$DOMZERO_USER r$DOMID
-
-function run_on_appliance {
-    ssh \
-        -i /root/dom0key \
-        -o UserKnownHostsFile=/dev/null \
-        -o StrictHostKeyChecking=no \
-        -o BatchMode=yes \
-        "$DOMZERO_USER@$OS_VM_MANAGEMENT_ADDRESS" "$@"
-}
-
-# Wait until we can log in to the appliance
-while ! run_on_appliance true; do
-    sleep 1
-done
-
-# Remove authenticated_keys updater cronjob
-echo "" | run_on_appliance crontab -
-
-# Generate a passwordless ssh key for domzero user
-echo "ssh-keygen -f /home/$DOMZERO_USER/.ssh/id_rsa -C $DOMZERO_USER@appliance -N \"\" -q" | run_on_appliance
-
-# Authenticate that user to dom0
-run_on_appliance cat /home/$DOMZERO_USER/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
-
-# If we have copied our ssh credentials, use ssh to monitor while the installation runs
-WAIT_TILL_LAUNCH=${WAIT_TILL_LAUNCH:-1}
-COPYENV=${COPYENV:-1}
-if [ "$WAIT_TILL_LAUNCH" = "1" ]  && [ -e ~/.ssh/id_rsa.pub  ] && [ "$COPYENV" = "1" ]; then
-    set +x
-
-    echo "VM Launched - Waiting for run.sh"
-    while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e /opt/stack/run_sh.pid"; do
-        sleep 10
-    done
-    echo -n "devstack service is running, waiting for stack.sh to start logging..."
-
-    pid=`ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "cat /opt/stack/run_sh.pid"`
-    if [ -n "$SCREEN_LOGDIR" ]; then
-        while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e ${SCREEN_LOGDIR}/stack.log"; do
-            sleep 10
-        done
-
-        ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "tail --pid $pid -n +1 -f ${SCREEN_LOGDIR}/stack.log"
-    else
-        echo -n "SCREEN_LOGDIR not set; just waiting for process $pid to finish"
-        ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "wait $pid"
-    fi
-
-    set -x
-    # Fail if devstack did not succeed
-    ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS 'test -e /opt/stack/runsh.succeeded'
-
-    set +x
-    echo "################################################################################"
-    echo ""
-    echo "All Finished!"
-    echo "You can visit the OpenStack Dashboard"
-    echo "at http://$OS_VM_SERVICES_ADDRESS, and contact other services at the usual ports."
-else
-    set +x
-    echo "################################################################################"
-    echo ""
-    echo "All Finished!"
-    echo "Now, you can monitor the progress of the stack.sh installation by "
-    echo "looking at the console of your domU / checking the log files."
-    echo ""
-    echo "ssh into your domU now: 'ssh stack@$OS_VM_MANAGEMENT_ADDRESS' using your password"
-    echo "and then do: 'sudo systemctl status devstack' to check if devstack is still running."
-    echo "Check that /opt/stack/runsh.succeeded exists"
-    echo ""
-    echo "When devstack completes, you can visit the OpenStack Dashboard"
-    echo "at http://$OS_VM_SERVICES_ADDRESS, and contact other services at the usual ports."
-fi
diff --git a/tools/xen/mocks b/tools/xen/mocks
deleted file mode 100644
index 3b9b05c747..0000000000
--- a/tools/xen/mocks
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/bin/bash
-
-test ! -e "$LIST_OF_ACTIONS" && {
-    echo "Mocking is not set up properly."
-    echo "LIST_OF_ACTIONS should point to an existing file."
-    exit 1
-}
-
-test ! -e "$LIST_OF_DIRECTORIES" && {
-    echo "Mocking is not set up properly."
-    echo "LIST_OF_DIRECTORIES should point to an existing file."
-    exit 1
-}
-
-test ! -e "$XE_RESPONSE" && {
-    echo "Mocking is not set up properly."
-    echo "XE_RESPONSE should point to an existing file."
-    exit 1
-}
-
-test ! -e "$XE_CALLS" && {
-    echo "Mocking is not set up properly."
-    echo "XE_CALLS should point to an existing file."
-    exit 1
-}
-
-function mktemp {
-    if test "${1:-}" = "-d";
-    then
-        echo "tempdir"
-    else
-        echo "tempfile"
-    fi
-}
-
-function wget {
-    if [[ $@ =~ "failurl" ]]; then
-        return 1
-    fi
-    echo "wget $@" >> $LIST_OF_ACTIONS
-}
-
-function mkdir {
-    if test "${1:-}" = "-p";
-    then
-        echo "$2" >> $LIST_OF_DIRECTORIES
-    fi
-}
-
-function unzip {
-    echo "Random rubbish from unzip"
-    echo "unzip $@" >> $LIST_OF_ACTIONS
-}
-
-function rm {
-    echo "rm $@" >> $LIST_OF_ACTIONS
-}
-
-function ln {
-    echo "ln $@" >> $LIST_OF_ACTIONS
-}
-
-function [ {
-    if test "${1:-}" = "-d";
-    then
-        echo "[ $@" >> $LIST_OF_ACTIONS
-        for directory in $(cat $LIST_OF_DIRECTORIES)
-        do
-            if test "$directory" = "$2"
-            then
-                return 0
-            fi
-        done
-        return 1
-    fi
-    echo "Mock test does not implement the requested function: ${1:-}"
-    exit 1
-}
-
-function die_with_error {
-    echo "$1" >> $DEAD_MESSAGES
-}
-
-function xe {
-    cat $XE_RESPONSE
-    {
-    for i in $(seq "$#")
-    do
-        eval "echo \"\$$i\""
-    done
-    } >> $XE_CALLS
-}
diff --git a/tools/xen/prepare_guest.sh b/tools/xen/prepare_guest.sh
deleted file mode 100755
index 6de1afc199..0000000000
--- a/tools/xen/prepare_guest.sh
+++ /dev/null
@@ -1,123 +0,0 @@
-#!/bin/bash
-
-# This script is run on an Ubuntu VM.
-# This script is inserted into the VM by prepare_guest_template.sh
-# and is run when that VM boots.
-# It customizes a fresh Ubuntu install, so it is ready
-# to run stack.sh
-#
-# This includes installing the XenServer tools,
-# creating the user called "stack",
-# and shuts down the VM to signal the script has completed
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-# Configurable nuggets
-GUEST_PASSWORD="$1"
-STACK_USER="$2"
-DOMZERO_USER="$3"
-
-
-function setup_domzero_user {
-    local username
-
-    username="$1"
-
-    local key_updater_script
-    local sudoers_file
-    key_updater_script="/home/$username/update_authorized_keys.sh"
-    sudoers_file="/etc/sudoers.d/allow_$username"
-
-    # Create user
-    adduser --disabled-password --quiet "$username" --gecos "$username"
-
-    # Give passwordless sudo
-    cat > $sudoers_file << EOF
-    $username ALL = NOPASSWD: ALL
-EOF
-    chmod 0440 $sudoers_file
-
-    # A script to populate this user's authenticated_keys from xenstore
-    cat > $key_updater_script << EOF
-#!/bin/bash
-set -eux
-
-DOMID=\$(sudo xenstore-read domid)
-sudo xenstore-exists /local/domain/\$DOMID/authorized_keys/$username
-sudo xenstore-read /local/domain/\$DOMID/authorized_keys/$username > /home/$username/xenstore_value
-cat /home/$username/xenstore_value > /home/$username/.ssh/authorized_keys
-EOF
-
-    # Give the key updater to the user
-    chown $username:$username $key_updater_script
-    chmod 0700 $key_updater_script
-
-    # Setup the .ssh folder
-    mkdir -p /home/$username/.ssh
-    chown $username:$username /home/$username/.ssh
-    chmod 0700 /home/$username/.ssh
-    touch /home/$username/.ssh/authorized_keys
-    chown $username:$username /home/$username/.ssh/authorized_keys
-    chmod 0600 /home/$username/.ssh/authorized_keys
-
-    # Setup the key updater as a cron job
-    crontab -u $username - << EOF
-* * * * * $key_updater_script
-EOF
-
-}
-
-# Make a small cracklib dictionary, so that passwd still works, but we don't
-# have the big dictionary.
-mkdir -p /usr/share/cracklib
-echo a | cracklib-packer
-
-# Make /etc/shadow, and set the root password
-pwconv
-echo "root:$GUEST_PASSWORD" | chpasswd
-
-# Put the VPX into UTC.
-rm -f /etc/localtime
-
-# Add stack user
-groupadd libvirtd
-useradd $STACK_USER -s /bin/bash -d /opt/stack -G libvirtd
-echo $STACK_USER:$GUEST_PASSWORD | chpasswd
-echo "$STACK_USER ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-
-setup_domzero_user "$DOMZERO_USER"
-
-# Add an udev rule, so that new block devices could be written by stack user
-cat > /etc/udev/rules.d/50-openstack-blockdev.rules << EOF
-KERNEL=="xvd[b-z]", GROUP="$STACK_USER", MODE="0660"
-EOF
-
-# Give ownership of /opt/stack to stack user
-chown -R $STACK_USER /opt/stack
-
-function setup_vimrc {
-    if [ ! -e $1 ]; then
-        # Simple but usable vimrc
-        cat > $1 <<EOF
-se ts=4
-se expandtab
-se shiftwidth=4
-EOF
-    fi
-}
-
-# Setup simple .vimrcs
-setup_vimrc /root/.vimrc
-setup_vimrc /opt/stack/.vimrc
-
-# remove self from local.rc
-# so this script is not run again
-rm -rf /etc/rc.local
-
-# Restore rc.local file
-cp /etc/rc.local.preparebackup /etc/rc.local
-
-# shutdown to notify we are done
-shutdown -h now
diff --git a/tools/xen/prepare_guest_template.sh b/tools/xen/prepare_guest_template.sh
deleted file mode 100755
index 6cddddaa84..0000000000
--- a/tools/xen/prepare_guest_template.sh
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/bin/bash
-
-# This script is run by install_os_domU.sh
-#
-# Parameters:
-# - $GUEST_NAME - hostname for the DomU VM
-#
-# It modifies the ubuntu image created by install_os_domU.sh
-#
-# This script is responsible for cusomtizing the fresh ubuntu
-# image so on boot it runs the prepare_guest.sh script
-# that modifies the VM so it is ready to run stack.sh.
-# It does this by mounting the disk image of the VM.
-#
-# The resultant image is started by install_os_domU.sh,
-# and once the VM has shutdown, build_xva.sh is run
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-# This directory
-TOP_DIR=$(cd $(dirname "$0") && pwd)
-
-# Include onexit commands
-. $TOP_DIR/scripts/on_exit.sh
-
-# xapi functions
-. $TOP_DIR/functions
-
-# Source params - override xenrc params in your localrc to suite your taste
-source xenrc
-
-#
-# Parameters
-#
-GUEST_NAME="$1"
-
-# Mount the VDI
-STAGING_DIR=$($TOP_DIR/scripts/manage-vdi open $GUEST_NAME 0 1 | grep -o "/tmp/tmp.[[:alnum:]]*")
-add_on_exit "$TOP_DIR/scripts/manage-vdi close $GUEST_NAME 0 1"
-
-# Make sure we have a stage
-if [ ! -d $STAGING_DIR/etc ]; then
-    echo "Stage is not properly set up!"
-    exit 1
-fi
-
-# Copy prepare_guest.sh to VM
-mkdir -p $STAGING_DIR/opt/stack/
-cp $TOP_DIR/prepare_guest.sh $STAGING_DIR/opt/stack/prepare_guest.sh
-
-# backup rc.local
-cp $STAGING_DIR/etc/rc.local $STAGING_DIR/etc/rc.local.preparebackup
-
-# run prepare_guest.sh on boot
-cat <<EOF >$STAGING_DIR/etc/rc.local
-#!/bin/sh -e
-bash /opt/stack/prepare_guest.sh \\
-    "$GUEST_PASSWORD" "$STACK_USER" "$DOMZERO_USER" \\
-    > /opt/stack/prepare_guest.log 2>&1
-EOF
-
-# Update ubuntu repositories
-cat > $STAGING_DIR/etc/apt/sources.list << EOF
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates main restricted
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates main restricted
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} universe
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} universe
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates universe
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates universe
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} multiverse
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} multiverse
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates multiverse
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates multiverse
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-backports main restricted universe multiverse
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-backports main restricted universe multiverse
-
-deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security main restricted
-deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security main restricted
-deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security universe
-deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security universe
-deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
-deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
-EOF
-
-rm -f $STAGING_DIR/etc/apt/apt.conf
-if [ -n "$UBUNTU_INST_HTTP_PROXY" ]; then
-    cat > $STAGING_DIR/etc/apt/apt.conf << EOF
-Acquire::http::Proxy "$UBUNTU_INST_HTTP_PROXY";
-EOF
-fi
diff --git a/tools/xen/scripts/install-os-vpx.sh b/tools/xen/scripts/install-os-vpx.sh
deleted file mode 100755
index 66f7ef4763..0000000000
--- a/tools/xen/scripts/install-os-vpx.sh
+++ /dev/null
@@ -1,135 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2011 Citrix Systems, Inc.
-# Copyright 2011 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-
-set -eux
-
-BRIDGE=
-NAME_LABEL=
-TEMPLATE_NAME=
-
-usage()
-{
-cat << EOF
-
-  Usage: $0 -t TEMPLATE_NW_INSTALL -l NAME_LABEL [-n BRIDGE]
-
-  Install a VM from a template
-
-  OPTIONS:
-
-     -h           Shows this message.
-     -t template  VM template to use
-     -l name      Specifies the name label for the VM.
-     -n bridge    The bridge/network to use for eth0. Defaults to xenbr0
-EOF
-}
-
-get_params()
-{
-    while getopts "hbn:r:l:t:" OPTION; do
-        case $OPTION in
-            h) usage
-                exit 1
-                ;;
-            n)
-                BRIDGE=$OPTARG
-                ;;
-            l)
-                NAME_LABEL=$OPTARG
-                ;;
-            t)
-                TEMPLATE_NAME=$OPTARG
-                ;;
-            ?)
-                usage
-                exit
-                ;;
-        esac
-    done
-    if [[ -z $BRIDGE ]]; then
-        BRIDGE=xenbr0
-    fi
-
-    if [[ -z $TEMPLATE_NAME ]]; then
-        echo "Please specify a template name" >&2
-        exit 1
-    fi
-
-    if [[ -z $NAME_LABEL ]]; then
-        echo "Please specify a name-label for the new VM" >&2
-        exit 1
-    fi
-}
-
-
-xe_min()
-{
-    local cmd="$1"
-    shift
-    xe "$cmd" --minimal "$@"
-}
-
-
-find_network()
-{
-    result=$(xe_min network-list bridge="$1")
-    if [ "$result" = "" ]; then
-        result=$(xe_min network-list name-label="$1")
-    fi
-    echo "$result"
-}
-
-
-create_vif()
-{
-    local v="$1"
-    echo "Installing VM interface on [$BRIDGE]"
-    local out_network_uuid
-    out_network_uuid=$(find_network "$BRIDGE")
-    xe vif-create vm-uuid="$v" network-uuid="$out_network_uuid" device="0"
-}
-
-
-
-# Make the VM auto-start on server boot.
-set_auto_start()
-{
-    local v="$1"
-    xe vm-param-set uuid="$v" other-config:auto_poweron=true
-}
-
-
-destroy_vifs()
-{
-    local v="$1"
-    IFS=,
-    for vif in $(xe_min vif-list vm-uuid="$v"); do
-        xe vif-destroy uuid="$vif"
-    done
-    unset IFS
-}
-
-
-get_params "$@"
-
-vm_uuid=$(xe_min vm-install template="$TEMPLATE_NAME" new-name-label="$NAME_LABEL")
-destroy_vifs "$vm_uuid"
-set_auto_start "$vm_uuid"
-create_vif "$vm_uuid"
-xe vm-param-set actions-after-reboot=Destroy uuid="$vm_uuid"
diff --git a/tools/xen/scripts/install_ubuntu_template.sh b/tools/xen/scripts/install_ubuntu_template.sh
deleted file mode 100755
index 6ea364255e..0000000000
--- a/tools/xen/scripts/install_ubuntu_template.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/bin/bash
-#
-# This creates an Ubuntu Server 32bit or 64bit template
-# on Xenserver 5.6.x, 6.0.x and 6.1.x
-# The template does a net install only
-#
-# Based on a script by: David Markey <david.markey@citrix.com>
-#
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-# This directory
-BASE_DIR=$(cd $(dirname "$0") && pwd)
-
-# For default setings see xenrc
-source $BASE_DIR/../xenrc
-
-# Get the params
-preseed_url=$1
-
-# Delete template or skip template creation as required
-previous_template=$(xe template-list name-label="$UBUNTU_INST_TEMPLATE_NAME" \
-    params=uuid --minimal)
-if [ -n "$previous_template" ]; then
-    if $CLEAN_TEMPLATES; then
-        xe template-param-clear param-name=other-config uuid=$previous_template
-        xe template-uninstall template-uuid=$previous_template force=true
-    else
-        echo "Template $UBUNTU_INST_TEMPLATE_NAME already present"
-        exit 0
-    fi
-fi
-
-# Get built-in template
-builtin_name="Debian Squeeze 6.0 (32-bit)"
-builtin_uuid=$(xe template-list name-label="$builtin_name" --minimal)
-if [[ -z $builtin_uuid ]]; then
-    echo "Can't find the Debian Squeeze 32bit template on your XenServer."
-    exit 1
-fi
-
-# Clone built-in template to create new template
-new_uuid=$(xe vm-clone uuid=$builtin_uuid \
-    new-name-label="$UBUNTU_INST_TEMPLATE_NAME")
-disk_size=$(($OSDOMU_VDI_GB * 1024 * 1024 * 1024))
-
-# Some of these settings can be found in example preseed files
-# however these need to be answered before the netinstall
-# is ready to fetch the preseed file, and as such must be here
-# to get a fully automated install
-pvargs="quiet console=hvc0 partman/default_filesystem=ext3 \
-console-setup/ask_detect=false locale=${UBUNTU_INST_LOCALE} \
-keyboard-configuration/layoutcode=${UBUNTU_INST_KEYBOARD} \
-netcfg/choose_interface=eth0 \
-netcfg/get_hostname=os netcfg/get_domain=os auto \
-url=${preseed_url}"
-
-if [ "$UBUNTU_INST_IP" != "dhcp" ]; then
-    netcfgargs="netcfg/disable_autoconfig=true \
-netcfg/get_nameservers=${UBUNTU_INST_NAMESERVERS} \
-netcfg/get_ipaddress=${UBUNTU_INST_IP} \
-netcfg/get_netmask=${UBUNTU_INST_NETMASK} \
-netcfg/get_gateway=${UBUNTU_INST_GATEWAY} \
-netcfg/confirm_static=true"
-    pvargs="${pvargs} ${netcfgargs}"
-fi
-
-xe template-param-set uuid=$new_uuid \
-    other-config:install-methods=http \
-    other-config:install-repository="http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY}" \
-    PV-args="$pvargs" \
-    other-config:debian-release="$UBUNTU_INST_RELEASE" \
-    other-config:default_template=true \
-    other-config:disks='<provision><disk device="0" size="'$disk_size'" sr="" bootable="true" type="system"/></provision>' \
-    other-config:install-arch="$UBUNTU_INST_ARCH"
-
-if ! [ -z "$UBUNTU_INST_HTTP_PROXY" ]; then
-    xe template-param-set uuid=$new_uuid \
-        other-config:install-proxy="$UBUNTU_INST_HTTP_PROXY"
-fi
-
-echo "Ubuntu template installed uuid:$new_uuid"
diff --git a/tools/xen/scripts/manage-vdi b/tools/xen/scripts/manage-vdi
deleted file mode 100755
index 909ce328b0..0000000000
--- a/tools/xen/scripts/manage-vdi
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/bin/bash
-
-set -eux
-
-action="$1"
-vm="$2"
-device="${3-0}"
-part="${4-}"
-
-function xe_min() {
-  local cmd="$1"
-  shift
-  xe "$cmd" --minimal "$@"
-}
-
-function run_udev_settle() {
-  which_udev=$(which udevsettle) || true
-  if [ -n "$which_udev" ]; then
-      udevsettle
-  else
-      udevadm settle
-  fi
-}
-
-vm_uuid=$(xe_min vm-list name-label="$vm")
-vdi_uuid=$(xe_min vbd-list params=vdi-uuid vm-uuid="$vm_uuid" \
-                           userdevice="$device")
-
-dom0_uuid=$(xe_min vm-list is-control-domain=true)
-
-function get_mount_device() {
-  vbd_uuid=$1
-
-  dev=$(xe_min vbd-list params=device uuid="$vbd_uuid")
-  if [[ "$dev" =~ "sm/" || "$dev" =~ "blktap-2/" ]]; then
-    DEBIAN_FRONTEND=noninteractive \
-        apt-get --option "Dpkg::Options::=--force-confold" --assume-yes \
-        install kpartx &> /dev/null || true
-    mapping=$(kpartx -av "/dev/$dev" | sed -ne 's,^add map \([a-z0-9\-]*\).*$,\1,p' | sed -ne "s,^\(.*${part}\)\$,\1,p")
-    if [ -z "$mapping" ]; then
-       echo "Failed to find mapping"
-       exit -1
-    fi
-
-    local device="/dev/mapper/${mapping}"
-    for (( i = 0; i < 5; i++ )) ; do
-        if [ -b $device ] ; then
-            echo $device
-            return
-        fi
-        sleep 1
-    done
-    echo "ERROR: timed out waiting for dev-mapper"
-    exit 1
-  else
-    echo "/dev/$dev$part"
-  fi
-}
-
-function clean_dev_mappings() {
-  dev=$(xe_min vbd-list params=device uuid="$vbd_uuid")
-  if [[ "$dev" =~ "sm/" || "$dev" =~ "blktap-2/" ]]; then
-    kpartx -dv "/dev/$dev"
-  fi
-}
-
-function open_vdi() {
-  vbd_uuid=$(xe vbd-create vm-uuid="$dom0_uuid" vdi-uuid="$vdi_uuid" \
-                         device=autodetect)
-  mp=$(mktemp -d)
-  xe vbd-plug uuid="$vbd_uuid"
-
-  run_udev_settle
-
-  mount_device=$(get_mount_device "$vbd_uuid")
-  mount "$mount_device" "$mp"
-  echo "Your vdi is mounted at $mp"
-}
-
-function close_vdi() {
-  vbd_uuid=$(xe_min vbd-list vm-uuid="$dom0_uuid" vdi-uuid="$vdi_uuid")
-  mount_device=$(get_mount_device "$vbd_uuid")
-  run_udev_settle
-  umount "$mount_device"
-
-  clean_dev_mappings
-
-  xe vbd-unplug uuid=$vbd_uuid
-  xe vbd-destroy uuid=$vbd_uuid
-}
-
-if [ "$action" == "open" ]; then
-  open_vdi
-elif [ "$action" == "close" ]; then
-  close_vdi
-fi
diff --git a/tools/xen/scripts/on_exit.sh b/tools/xen/scripts/on_exit.sh
deleted file mode 100755
index 2846dc42d0..0000000000
--- a/tools/xen/scripts/on_exit.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/bash
-
-set -e
-set -o xtrace
-
-if [ -z "${on_exit_hooks:-}" ]; then
-    on_exit_hooks=()
-fi
-
-on_exit()
-{
-    for i in $(seq $((${#on_exit_hooks[*]} - 1)) -1 0); do
-        eval "${on_exit_hooks[$i]}"
-    done
-}
-
-add_on_exit()
-{
-    local n=${#on_exit_hooks[*]}
-    on_exit_hooks[$n]="$*"
-    if [[ $n -eq 0 ]]; then
-        trap on_exit EXIT
-    fi
-}
diff --git a/tools/xen/scripts/uninstall-os-vpx.sh b/tools/xen/scripts/uninstall-os-vpx.sh
deleted file mode 100755
index 96dad7e852..0000000000
--- a/tools/xen/scripts/uninstall-os-vpx.sh
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2011 Citrix Systems, Inc.
-# Copyright 2011 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-
-set -ex
-
-# By default, don't remove the templates
-REMOVE_TEMPLATES=${REMOVE_TEMPLATES:-"false"}
-if [ "$1" = "--remove-templates" ]; then
-    REMOVE_TEMPLATES=true
-fi
-
-xe_min()
-{
-    local cmd="$1"
-    shift
-    xe "$cmd" --minimal "$@"
-}
-
-destroy_vdi()
-{
-    local vbd_uuid="$1"
-    local type
-    type=$(xe_min vbd-list uuid=$vbd_uuid params=type)
-    local dev
-    dev=$(xe_min vbd-list uuid=$vbd_uuid params=userdevice)
-    local vdi_uuid
-    vdi_uuid=$(xe_min vbd-list uuid=$vbd_uuid params=vdi-uuid)
-
-    if [ "$type" == 'Disk' ] && [ "$dev" != 'xvda' ] && [ "$dev" != '0' ]; then
-        xe vdi-destroy uuid=$vdi_uuid
-    fi
-}
-
-uninstall()
-{
-    local vm_uuid="$1"
-    local power_state
-    power_state=$(xe_min vm-list uuid=$vm_uuid params=power-state)
-
-    if [ "$power_state" != "halted" ]; then
-        xe vm-shutdown vm=$vm_uuid force=true
-    fi
-
-    for v in $(xe_min vbd-list vm-uuid=$vm_uuid | sed -e 's/,/ /g'); do
-        destroy_vdi "$v"
-    done
-
-    xe vm-uninstall vm=$vm_uuid force=true >/dev/null
-}
-
-uninstall_template()
-{
-    local vm_uuid="$1"
-
-    for v in $(xe_min vbd-list vm-uuid=$vm_uuid | sed -e 's/,/ /g'); do
-        destroy_vdi "$v"
-    done
-
-    xe template-uninstall template-uuid=$vm_uuid force=true >/dev/null
-}
-
-# remove the VMs and their disks
-for u in $(xe_min vm-list other-config:os-vpx=true | sed -e 's/,/ /g'); do
-    uninstall "$u"
-done
-
-# remove the templates
-if [ "$REMOVE_TEMPLATES" == "true" ]; then
-    for u in $(xe_min template-list other-config:os-vpx=true | sed -e 's/,/ /g'); do
-        uninstall_template "$u"
-    done
-fi
diff --git a/tools/xen/test_functions.sh b/tools/xen/test_functions.sh
deleted file mode 100755
index 324e6a1a1e..0000000000
--- a/tools/xen/test_functions.sh
+++ /dev/null
@@ -1,205 +0,0 @@
-#!/bin/bash
-
-# Tests for functions.
-#
-# The tests are sourcing the mocks file to mock out various functions. The
-# mocking-out always happens in a sub-shell, thus it does not have impact on
-# the functions defined here.
-
-# To run the tests, please run:
-#
-# ./test_functions.sh run_tests
-#
-# To only print out the discovered test functions, run:
-#
-# ./test_functions.sh
-
-. functions
-
-# Setup
-function before_each_test {
-    LIST_OF_DIRECTORIES=$(mktemp)
-    truncate -s 0 $LIST_OF_DIRECTORIES
-
-    LIST_OF_ACTIONS=$(mktemp)
-    truncate -s 0 $LIST_OF_ACTIONS
-
-    XE_RESPONSE=$(mktemp)
-    truncate -s 0 $XE_RESPONSE
-
-    XE_CALLS=$(mktemp)
-    truncate -s 0 $XE_CALLS
-
-    DEAD_MESSAGES=$(mktemp)
-    truncate -s 0 $DEAD_MESSAGES
-}
-
-# Teardown
-function after_each_test {
-    rm -f $LIST_OF_DIRECTORIES
-    rm -f $LIST_OF_ACTIONS
-    rm -f $XE_RESPONSE
-    rm -f $XE_CALLS
-}
-
-# Helpers
-function setup_xe_response {
-    echo "$1" > $XE_RESPONSE
-}
-
-function given_directory_exists {
-    echo "$1" >> $LIST_OF_DIRECTORIES
-}
-
-function assert_directory_exists {
-    grep "$1" $LIST_OF_DIRECTORIES
-}
-
-function assert_previous_command_failed {
-    [ "$?" != "0" ] || exit 1
-}
-
-function assert_xe_min {
-    grep -qe "^--minimal\$" $XE_CALLS
-}
-
-function assert_xe_param {
-    grep -qe "^$1\$" $XE_CALLS
-}
-
-function assert_died_with {
-    diff -u <(echo "$1") $DEAD_MESSAGES
-}
-
-function mock_out {
-    local FNNAME="$1"
-    local OUTPUT="$2"
-
-    . <(cat << EOF
-function $FNNAME {
-    echo "$OUTPUT"
-}
-EOF
-)
-}
-
-function assert_symlink {
-    grep -qe "^ln -s $2 $1\$" $LIST_OF_ACTIONS
-}
-
-# Tests
-function test_plugin_directory_on_xenserver {
-    given_directory_exists "/etc/xapi.d/plugins/"
-
-    PLUGDIR=$(. mocks && xapi_plugin_location)
-
-    [ "/etc/xapi.d/plugins/" = "$PLUGDIR" ]
-}
-
-function test_plugin_directory_on_xcp {
-    given_directory_exists "/usr/lib/xcp/plugins/"
-
-    PLUGDIR=$(. mocks && xapi_plugin_location)
-
-    [ "/usr/lib/xcp/plugins/" = "$PLUGDIR" ]
-}
-
-function test_no_plugin_directory_found {
-    set +e
-
-    local IGNORE
-    IGNORE=$(. mocks && xapi_plugin_location)
-
-    assert_previous_command_failed
-
-    grep "[ -d /etc/xapi.d/plugins/ ]" $LIST_OF_ACTIONS
-    grep "[ -d /usr/lib/xcp/plugins/ ]" $LIST_OF_ACTIONS
-}
-
-function test_create_directory_for_kernels {
-    (
-        . mocks
-        mock_out get_local_sr_path /var/run/sr-mount/uuid1
-        create_directory_for_kernels
-    )
-
-    assert_directory_exists "/var/run/sr-mount/uuid1/os-guest-kernels"
-    assert_symlink "/boot/guest" "/var/run/sr-mount/uuid1/os-guest-kernels"
-}
-
-function test_create_directory_for_kernels_existing_dir {
-    (
-        . mocks
-        given_directory_exists "/boot/guest"
-        create_directory_for_kernels
-    )
-
-    diff -u $LIST_OF_ACTIONS - << EOF
-[ -d /boot/guest ]
-EOF
-}
-
-function test_create_directory_for_images {
-    (
-        . mocks
-        mock_out get_local_sr_path /var/run/sr-mount/uuid1
-        create_directory_for_images
-    )
-
-    assert_directory_exists "/var/run/sr-mount/uuid1/os-images"
-    assert_symlink "/images" "/var/run/sr-mount/uuid1/os-images"
-}
-
-function test_create_directory_for_images_existing_dir {
-    (
-        . mocks
-        given_directory_exists "/images"
-        create_directory_for_images
-    )
-
-    diff -u $LIST_OF_ACTIONS - << EOF
-[ -d /images ]
-EOF
-}
-
-function test_get_local_sr {
-    setup_xe_response "uuid123"
-
-    local RESULT
-    RESULT=$(. mocks && get_local_sr)
-
-    [ "$RESULT" == "uuid123" ]
-
-    assert_xe_param "pool-list" params=default-SR minimal=true
-}
-
-function test_get_local_sr_path {
-    local RESULT
-    RESULT=$(mock_out get_local_sr "uuid1" && get_local_sr_path)
-
-    [ "/var/run/sr-mount/uuid1" == "$RESULT" ]
-}
-
-# Test runner
-[ "$1" = "" ] && {
-    grep -e "^function *test_" $0 | cut -d" " -f2
-}
-
-[ "$1" = "run_tests" ] && {
-    for testname in $($0); do
-        echo "$testname"
-        before_each_test
-        (
-            set -eux
-            $testname
-        )
-        if [ "$?" != "0" ]; then
-            echo "FAIL"
-            exit 1
-        else
-            echo "PASS"
-        fi
-
-        after_each_test
-    done
-}
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
deleted file mode 100644
index 169e0427a8..0000000000
--- a/tools/xen/xenrc
+++ /dev/null
@@ -1,114 +0,0 @@
-#!/bin/bash
-
-#
-# XenServer specific defaults for the /tools/xen/ scripts
-# Similar to stackrc, you can override these in your localrc
-#
-
-# Name of this guest
-GUEST_NAME=${GUEST_NAME:-DevStackOSDomU}
-
-# Template cleanup
-CLEAN_TEMPLATES=${CLEAN_TEMPLATES:-false}
-
-# Size of image
-VDI_MB=${VDI_MB:-5000}
-
-# Devstack now contains many components.  4GB ram is not enough to prevent
-# swapping and memory fragmentation - the latter of which can cause failures
-# such as blkfront failing to plug a VBD and lead to random test fails.
-#
-# Set to 6GB so an 8GB XenServer VM can have a 1GB Dom0 and leave 1GB for VMs
-OSDOMU_MEM_MB=6144
-OSDOMU_VDI_GB=8
-
-# Network mapping. Specify bridge names or network names. Network names may
-# differ across localised versions of XenServer. If a given bridge/network
-# was not found, a new network will be created with the specified name.
-
-# Get the management network from the XS installation
-VM_BRIDGE_OR_NET_NAME="OpenStack VM Network"
-PUB_BRIDGE_OR_NET_NAME="OpenStack Public Network"
-
-# VM Password
-GUEST_PASSWORD=${GUEST_PASSWORD:-secret}
-
-# Extracted variables for OpenStack VM network device numbers.
-# Make sure they form a continuous sequence starting from 0
-MGT_DEV_NR=0
-VM_DEV_NR=1
-PUB_DEV_NR=2
-
-# Host Interface, i.e. the interface on the nova vm you want to expose the
-# services on. Usually the device connected to the management network or the
-# one connected to the public network is used.
-HOST_IP_IFACE=${HOST_IP_IFACE:-"eth${MGT_DEV_NR}"}
-
-#
-# Our nova host's network info
-#
-
-# Management network
-MGT_IP=${MGT_IP:-dhcp}
-MGT_NETMASK=${MGT_NETMASK:-ignored}
-
-# VM Network
-VM_IP=${VM_IP:-10.255.255.255}
-VM_NETMASK=${VM_NETMASK:-255.255.255.0}
-
-# Public network
-# Aligned with stack.sh - see FLOATING_RANGE
-PUB_IP=${PUB_IP:-172.24.4.10}
-PUB_NETMASK=${PUB_NETMASK:-255.255.255.0}
-
-# Ubuntu install settings
-UBUNTU_INST_RELEASE="xenial"
-UBUNTU_INST_TEMPLATE_NAME="Ubuntu 16.04 (64-bit) for DevStack"
-# For 12.04 use "precise" and update template name
-# However, for 12.04, you should be using
-# XenServer 6.1 and later or XCP 1.6 or later
-# 11.10 is only really supported with XenServer 6.0.2 and later
-UBUNTU_INST_ARCH="amd64"
-UBUNTU_INST_HTTP_HOSTNAME="archive.ubuntu.com"
-UBUNTU_INST_HTTP_DIRECTORY="/ubuntu"
-UBUNTU_INST_HTTP_PROXY=""
-UBUNTU_INST_LOCALE="en_US"
-UBUNTU_INST_KEYBOARD="us"
-# network configuration for ubuntu netinstall
-UBUNTU_INST_IP="dhcp"
-UBUNTU_INST_NAMESERVERS=""
-UBUNTU_INST_NETMASK=""
-UBUNTU_INST_GATEWAY=""
-
-# Create a separate xvdb. Tis could be used as a backing device for cinder
-# volumes. Specify
-#   XEN_XVDB_SIZE_GB=10
-#   VOLUME_BACKING_DEVICE=/dev/xvdb
-# in your localrc to avoid kernel lockups:
-#   https://bugs.launchpad.net/cinder/+bug/1023755
-#
-# Set the size to 0 to avoid creation of additional disk.
-XEN_XVDB_SIZE_GB=0
-
-STACK_USER=stack
-DOMZERO_USER=domzero
-
-RC_DIR="../.."
-
-restore_nounset=$(set +o | grep nounset)
-set +u
-
-## Note that the lines below are coming from stackrc to support
-## new-style config files
-source $RC_DIR/functions-common
-
-# allow local overrides of env variables, including repo config
-if [[ -f $RC_DIR/localrc ]]; then
-    # Old-style user-supplied config
-    source $RC_DIR/localrc
-elif [[ -f $RC_DIR/.localrc.auto ]]; then
-    # New-style user-supplied config extracted from local.conf
-    source $RC_DIR/.localrc.auto
-fi
-
-$restore_nounset

From 730ce45466a903c639554b2e70f6e40a02e9e29d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 23 Feb 2018 13:56:48 +0000
Subject: [PATCH 2220/3333] Create NOVA_READY_TIMEOUT in is_nova_ready function

The function was introduced in [0] using a hardcoded timeout of 60
seconds which turns out to be too small on slow machines. Create a new
global variable NOVA_READY_TIMEOUT instead so that users can
override the timeout if necessary.

[0] I32eb59b9d6c225a3e93992be3a3b9f4b251d7189

Co-Authored-By: Mohammed Naser <mnaser@vexxhost.com>
Change-Id: I0cd7f193589a1a0776ae76dc30cecefe7ba9e5db
---
 lib/nova | 2 +-
 stackrc  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8691c8eb33..d89d64e72f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1000,7 +1000,7 @@ function is_nova_ready {
         # because of the dom0/domU split. Just ignore for now.
         return
     fi
-    wait_for_compute 60
+    wait_for_compute $NOVA_READY_TIMEOUT
 }
 
 function start_nova {
diff --git a/stackrc b/stackrc
index b7105d368e..aebf152bad 100644
--- a/stackrc
+++ b/stackrc
@@ -813,6 +813,9 @@ fi
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 
+# Timeout for compute node registration in Nova
+NOVA_READY_TIMEOUT=${NOVA_READY_TIMEOUT:-$SERVICE_TIMEOUT}
+
 # Service graceful shutdown timeout
 SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 

From 7880904d15c1dbbea5c26ece1a30eb0850bf10ab Mon Sep 17 00:00:00 2001
From: Jacky Hu <hudayou@hotmail.com>
Date: Mon, 26 Feb 2018 18:36:59 +0800
Subject: [PATCH 2221/3333] Run local script after nova cellsv2 is configured

If user try to create a server in local script before nova cells is
configured, it will run into the following error:
Host 'x' is not mapped to any cell.

Change-Id: I4fe76865fd6e16d5beb5ed9e5d6a9f3542e990a5
---
 stack.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stack.sh b/stack.sh
index 1d1f12e116..1803169e2d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1385,15 +1385,6 @@ run_phase stack extra
 merge_config_group $TOP_DIR/local.conf post-extra
 
 
-# Run local script
-# ----------------
-
-# Run ``local.sh`` if it exists to perform user-managed tasks
-if [[ -x $TOP_DIR/local.sh ]]; then
-    echo "Running user script $TOP_DIR/local.sh"
-    $TOP_DIR/local.sh
-fi
-
 # Sanity checks
 # =============
 
@@ -1428,6 +1419,15 @@ if is_service_enabled n-api; then
     fi
 fi
 
+# Run local script
+# ----------------
+
+# Run ``local.sh`` if it exists to perform user-managed tasks
+if [[ -x $TOP_DIR/local.sh ]]; then
+    echo "Running user script $TOP_DIR/local.sh"
+    $TOP_DIR/local.sh
+fi
+
 # Bash completion
 # ===============
 

From 7b1d5b64ac53e4fea9c2bdb0a6e44fc90fbac067 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Mon, 26 Feb 2018 22:23:02 +0000
Subject: [PATCH 2222/3333] Define devstack-base abstract job

Define an abstract job devstack base that does not require any
project apart from devstack. This job defines basic devstack_localrc
settings that are common to any devstack job (mostly to work with
infra) and devstack_services to emit "disable_all_services" so to
cancel any devstack default.

The variables are defined as global ones as well as host-vars for
the controller and group-vars for peer nodes, so that any
descendent job may extend them, thanks for Zuul dict merging.

Change-Id: I2cdb723f6ee209683044fecec59ff7b510a2752b
---
 .zuul.yaml | 96 +++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 74 insertions(+), 22 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc29466f35..0ae1187527 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -26,43 +26,43 @@
       - name: subnode
         nodes:
           - compute1
+      - name: switch
+        nodes:
+          - controller
+      - name: peers
+        nodes:
+          - compute1
 
 - job:
-    name: devstack
+    name: devstack-base
     parent: multinode
-    description: Base devstack job
-    nodeset: openstack-single-node
+    abstract: true
+    description: |
+      Base abstract Devstack job.
+
+      Defines plays and base variables, but it does not include any project
+      and it does not run any service by default. This is a common base for
+      all single Devstack jobs, single or multinode.
+      Variables are defined in job.vars, which is what is then used by single
+      node jobs and by multi node jobs for the controller, as well as in
+      job.group-vars.peers, which is what is used by multi node jobs for peer
+      nodes (everything but the controller).
     required-projects:
       - openstack-dev/devstack
-      - openstack/cinder
-      - openstack/glance
-      - openstack/keystone
-      - openstack/neutron
-      - openstack/nova
-      - openstack/requirements
-      - openstack/swift
     roles:
       - zuul: openstack-infra/devstack-gate
       - zuul: openstack-infra/openstack-zuul-jobs
-    timeout: 7200
     vars:
-      test_matrix_configs: [neutron, tlsproxy]
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
         RABBIT_PASSWORD: secretrabbit
         ADMIN_PASSWORD: secretadmin
         SERVICE_PASSWORD: secretservice
         NETWORK_GATEWAY: 10.1.0.1
-        Q_USE_DEBUG_COMMAND: true
         FIXED_RANGE: 10.1.0.0/20
         IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
         FLOATING_RANGE: 172.24.5.0/24
         PUBLIC_NETWORK_GATEWAY: 172.24.5.1
-        FLOATING_HOST_PREFIX: 172.24.4
-        FLOATING_HOST_MASK: 23
-        SWIFT_REPLICAS: 1
-        SWIFT_START_ALL_SERVICES: false
-        SWIFT_HASH: 1234123412341234
         LOGFILE: /opt/stack/logs/devstacklog.txt
         LOG_COLOR: false
         VERBOSE: true
@@ -76,8 +76,7 @@
         # from the location below for all the CI jobs.
         ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
-        horizon: false
-        tempest: false
+        base: false
       zuul_copy_output:
         '{{ devstack_conf_dir }}/local.conf': 'logs'
         '{{ devstack_conf_dir }}/localrc': 'logs'
@@ -117,7 +116,28 @@
         log: True
         localrc: True
         stackenv: True
-        summary: True
+    group-vars:
+      peers:
+        devstack_localrc:
+          DATABASE_PASSWORD: secretdatabase
+          RABBIT_PASSWORD: secretrabbit
+          ADMIN_PASSWORD: secretadmin
+          SERVICE_PASSWORD: secretservice
+          NETWORK_GATEWAY: 10.1.0.1
+          FIXED_RANGE: 10.1.0.0/20
+          IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
+          FLOATING_RANGE: 172.24.5.0/24
+          PUBLIC_NETWORK_GATEWAY: 172.24.5.1
+          LOGFILE: /opt/stack/logs/devstacklog.txt
+          LOG_COLOR: false
+          VERBOSE: true
+          VERBOSE_NO_TIMESTAMP: true
+          NOVNC_FROM_PACKAGE: true
+          ERROR_ON_CLONE: true
+          LIBVIRT_TYPE: qemu
+          ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
+        devstack_services:
+          base: false
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
@@ -130,9 +150,41 @@
       # Translations
       - ^.*/locale/.*po$
 
+- job:
+    name: devstack
+    parent: devstack-base
+    description: |
+      Single node devstack job for integration gate.
+    nodeset: openstack-single-node
+    required-projects:
+      - openstack/cinder
+      - openstack/glance
+      - openstack/keystone
+      - openstack/neutron
+      - openstack/nova
+      - openstack/requirements
+      - openstack/swift
+    timeout: 7200
+    vars:
+      test_matrix_configs: [neutron, tlsproxy]
+      devstack_localrc:
+        # Common OpenStack services settings
+        SWIFT_REPLICAS: 1
+        SWIFT_START_ALL_SERVICES: false
+        SWIFT_HASH: 1234123412341234
+        CINDER_PERIODIC_INTERVAL: 10
+        DEBUG_LIBVIRT_COREDUMPS: True
+        NOVA_VNC_ENABLED: true
+        VNCSERVER_LISTEN: 0.0.0.0
+        VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+      devstack_services:
+        base: true
+        horizon: false
+        tempest: false
+
 - job:
     name: devstack-multinode
-    parent: devstack
+    parent: devstack-base
     description: Base devstack multinode job
     nodeset: openstack-two-node
     # NOTE(andreaf) The multinode job is useful to see the setup of different

From b59c93cc44bc9ff0e041ff24805880294117f745 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>
Date: Mon, 26 Feb 2018 16:36:54 +0000
Subject: [PATCH 2223/3333] Actually generate pip freeze outputs

the shell script used is actually being run thru 'sh', not bash,
which does not understand "[[" test operators.

Explicitly run this script with /bin/bash instead.

Change-Id: I551d2631bcb6aef49550d69b3830ffcb509abfb7
---
 roles/capture-system-logs/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index cd8f4f0eab..de4f8eda08 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -1,6 +1,7 @@
 # TODO(andreaf) Make this into proper Ansible
 - name: Stage various logs and reports
   shell:
+    executable: /bin/bash
     cmd: |
       sudo iptables-save > {{ stage_dir }}/iptables.txt
       df -h > {{ stage_dir }}/df.txt

From ca61966f47af9070a7c6ed6fef3f2d630c43c919 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Wed, 28 Feb 2018 14:46:05 +0100
Subject: [PATCH 2224/3333] neutron: Do no longer set "url" in nova.conf

Since[1], "url" in the [neutron] section in nova.conf should no
longer be set.

[1]
https://github.com/openstack/nova/commit/6cde77ebbab85bc8ccd2ab7ad977b1d4af4a13fa

Depends-On: https://review.openstack.org/548572
Related-Bug: #1752289
Change-Id: Ied6c155da9d51a25ba7a524e69d018d39ed3442c
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index c5839f5c3e..72c5872ccd 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -306,7 +306,6 @@ function configure_neutron_nova_new {
     iniset $NOVA_CONF neutron project_domain_name "Default"
     iniset $NOVA_CONF neutron auth_strategy $NEUTRON_AUTH_STRATEGY
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-    iniset $NOVA_CONF neutron url $NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT
 
     iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index bb76c5f9ce..5f6cee73fb 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -376,7 +376,6 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF neutron project_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-    iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
 
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver

From f63ddd609f8ba0c6000d7d07074dc64232830351 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Sun, 25 Feb 2018 14:48:05 +0000
Subject: [PATCH 2225/3333] Replace depricated iscsi_helper with target_helper

Cinder change I5231f8fe3399deb9c57e6efb121d0d008dc9c7f4
replaces iscsi_helper with more general one.



Change-Id: I49fe0365b170e5a5b0449d80003bcf970e4c191d
---
 lib/cinder                    | 4 ++--
 lib/cinder_backends/fake_gate | 2 +-
 lib/cinder_backends/lvm       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 75486adda5..a1d68712b6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -101,7 +101,7 @@ CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 if is_fedora; then
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
-        die "lioadm is the only valid Cinder iscsi_helper config on this platform"
+        die "lioadm is the only valid Cinder target_helper config on this platform"
     fi
 else
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
@@ -230,7 +230,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF DEFAULT target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
diff --git a/lib/cinder_backends/fake_gate b/lib/cinder_backends/fake_gate
index 6b1f848790..3ffd9a6785 100644
--- a/lib/cinder_backends/fake_gate
+++ b/lib/cinder_backends/fake_gate
@@ -50,7 +50,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeGateDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
     if [[ "$CINDER_VOLUME_CLEAR" == "non" ]]; then
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 03e188029f..497081c9e4 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -50,7 +50,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
 }

From 3360ffb5f27cef3f22da944e8a1314678a4bf970 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 2 Mar 2018 21:08:34 +0100
Subject: [PATCH 2226/3333] devstack master is rocky now

See #snowpenstack!

Change-Id: I2df485c2acf1bec0d0f7ddc6538bff2c2ec141e3
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index aebf152bad..4f627ccbd7 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="queens"
+DEVSTACK_SERIES="rocky"
 
 ##############
 #

From 6bab8321b44db260f9e001d8276a660d1ff56ed4 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 2 Mar 2018 21:13:12 +0100
Subject: [PATCH 2227/3333] Remove references to hardcoded file writing in /tmp

/tmp is a world writeable directory, so using hardcoded filenames
in there is just a bad coding style (susceptible to symlink attacks).
Avoid using it to not give a bad precedent.

Change-Id: Ia66763a0e4714f2226e98dbd85600b2035bd5088
---
 functions | 4 +---
 stack.sh  | 6 ++----
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/functions b/functions
index 3fcc38dc4b..24994c0470 100644
--- a/functions
+++ b/functions
@@ -810,13 +810,11 @@ function get_random_port {
 #
 # Write out various useful state information to /etc/devstack-version
 function write_devstack_version {
-    cat - > /tmp/devstack-version <<EOF
+    cat - <<EOF | sudo tee /etc/devstack-version >/dev/null
 DevStack Version: ${DEVSTACK_SERIES}
 Change: $(git log --format="%H %s %ci" -1)
 OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}
 EOF
-    sudo install -m 644 /tmp/devstack-version /etc/devstack-version
-    rm /tmp/devstack-version
 }
 
 # Restore xtrace
diff --git a/stack.sh b/stack.sh
index 1d1f12e116..c02b663646 100755
--- a/stack.sh
+++ b/stack.sh
@@ -962,17 +962,15 @@ fi
 if [[ $SYSLOG != "False" ]]; then
     if [[ "$SYSLOG_HOST" = "$HOST_IP" ]]; then
         # Configure the master host to receive
-        cat <<EOF >/tmp/90-stack-m.conf
+        cat <<EOF | sudo tee /etc/rsyslog.d/90-stack-m.conf >/dev/null
 \$ModLoad imrelp
 \$InputRELPServerRun $SYSLOG_PORT
 EOF
-        sudo mv /tmp/90-stack-m.conf /etc/rsyslog.d
     else
         # Set rsyslog to send to remote host
-        cat <<EOF >/tmp/90-stack-s.conf
+        cat <<EOF | sudo tee /etc/rsyslog.d/90-stack-s.conf >/dev/null
 *.*		:omrelp:$SYSLOG_HOST:$SYSLOG_PORT
 EOF
-        sudo mv /tmp/90-stack-s.conf /etc/rsyslog.d
     fi
 
     RSYSLOGCONF="/etc/rsyslog.conf"

From d9c1275c5df55e822a7df6880a9a1430ab4f24a0 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 21 Feb 2018 14:35:58 +0000
Subject: [PATCH 2228/3333] Define devstack services without the test-matrix

Emit a disable_all_services and define which service we run in
the job directly. This drops the dependency from the test matrix,
from devstack default list of services and it makes it easier for
jobs to add/remove services based on the list in the base job.

Change-Id: Ib1debefd541b933dbfc54d484c263cc0ed60423d
---
 .zuul.yaml | 79 +++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 76 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0ae1187527..2deb769d30 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -76,6 +76,8 @@
         # from the location below for all the CI jobs.
         ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
+        # Ignore base set of services setup by test-matrix.
+        # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
       zuul_copy_output:
         '{{ devstack_conf_dir }}/local.conf': 'logs'
@@ -154,7 +156,7 @@
     name: devstack
     parent: devstack-base
     description: |
-      Single node devstack job for integration gate.
+      Single or multi node devstack job for integration gate.
     nodeset: openstack-single-node
     required-projects:
       - openstack/cinder
@@ -166,7 +168,6 @@
       - openstack/swift
     timeout: 7200
     vars:
-      test_matrix_configs: [neutron, tlsproxy]
       devstack_localrc:
         # Common OpenStack services settings
         SWIFT_REPLICAS: 1
@@ -178,9 +179,81 @@
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
       devstack_services:
-        base: true
+        # Core services enabled for this branch.
+        # This list replaces the test-matrix.
+        # Shared services
+        dstat: true
+        etcd3: true
+        mysql: true
+        peakmem_tracker: true
+        rabbit: true
+        tls-proxy: true
+        # Keystone services
+        key: true
+        # Glance services
+        g-api: true
+        g-reg: true
+        # Nova services
+        n-api: true
+        n-api-meta: true
+        n-cauth: true
+        n-cond: true
+        n-cpu: true
+        n-novnc: true
+        n-obj: true
+        n-sch: true
+        placement-api: true
+        # Neutron services
+        neutron-api: true
+        neutron-agent: true
+        neutron-dhcp: true
+        neutron-l3: true
+        neutron-metadata-agent: true
+        neutron-metering: true
+        # Swift services
+        s-account: true
+        s-container: true
+        s-object: true
+        s-proxy: true
+        # Cinder services
+        c-api: true
+        c-bak: true
+        c-sch: true
+        c-vol: true
+        cinder: true
+        # Services we don't need.
+        # This section is not really needed, it's for readability.
         horizon: false
         tempest: false
+        # Test matrix emits ceilometer but ceilomenter is not installed in the
+        # integrated gate, so specifying the services has not effect.
+        # ceilometer-*: false
+    group-vars:
+      subnode:
+        devstack_services:
+          # Core services enabled for this branch.
+          # This list replaces the test-matrix.
+          # Shared services
+          dstat: true
+          peakmem_tracker: true
+          tls-proxy: true
+          # Nova services
+          n-cpu: true
+          placement-client: true
+          # Neutron services
+          neutron-agent: true
+          # Cinder services
+          c-bak: true
+          c-vol: true
+          # Services we don't run at all on subnode.
+          # This section is not really needed, it's for readability.
+          # keystone: false
+          # s-*: false
+          horizon: false
+          tempest: false
+          # Test matrix emits ceilometer but ceilomenter is not installed in the
+          # integrated gate, so specifying the services has not effect.
+          # ceilometer-*: false
 
 - job:
     name: devstack-multinode

From acca80414ff3db373138ed5e7124ced7306c28df Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Sat, 3 Mar 2018 22:16:50 +0000
Subject: [PATCH 2229/3333] Ensure that stack home is owned by stack

The role that sets up the user and its home folder must ensure that
the home folder is owned by stack as well.

Change-Id: I2e72d7b9d68a2a14f8a148ef82cbb3f569bd1cea
---
 roles/setup-stack-user/tasks/main.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/roles/setup-stack-user/tasks/main.yaml b/roles/setup-stack-user/tasks/main.yaml
index 8384515ebe..0fc7c2d78b 100644
--- a/roles/setup-stack-user/tasks/main.yaml
+++ b/roles/setup-stack-user/tasks/main.yaml
@@ -21,10 +21,12 @@
     group: stack
   become: yes
 
-- name: Set stack user home directory permissions
+- name: Set stack user home directory permissions and ownership
   file:
     path: '{{ devstack_stack_home_dir }}'
     mode: 0755
+    owner: stack
+    group: stack
   become: yes
 
 - name: Copy 50_stack_sh file to /etc/sudoers.d
@@ -36,7 +38,7 @@
     group: root
   become: yes
 
-- name: Create new/.cache folder within BASE
+- name: Create .cache folder within BASE
   file:
     path: '{{ devstack_stack_home_dir }}/.cache'
     state: directory

From 2a2349be5f82455c462b294dfada76820d4d2aa4 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 14 Feb 2018 19:24:04 +0000
Subject: [PATCH 2230/3333] Stage .localrc.auto

Change-Id: I9beb713a0b037e0229b13fd13d7d4de156ed0b59
Depends-on: https://review.openstack.org/544606
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index dc3a42939e..2176a4c2a4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -110,6 +110,7 @@
       zuul_copy_output:
         '{{ devstack_conf_dir }}/local.conf': 'logs'
         '{{ devstack_conf_dir }}/localrc': 'logs'
+        '{{ devstack_conf_dir }}/.localrc.auto': 'logs'
         '{{ devstack_conf_dir }}/.stackenv': 'logs'
         '{{ devstack_log_dir }}/dstat-csv.log': 'logs'
         '{{ devstack_log_dir }}/devstacklog.txt': 'logs'
@@ -146,6 +147,7 @@
         log: True
         localrc: True
         stackenv: True
+        auto: True
     group-vars:
       peers:
         devstack_localrc:

From 1610cc22199f84395c87f4d37d079e8398934378 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Mar 2018 11:40:46 +1100
Subject: [PATCH 2231/3333] Add a note on experimental jobs

With I4161e1f1c8d47070dd35fad38b00715438d94eb2 and
I37fe007dc6f387d43cbaf55771027718005ac40d we have removed most of the
legacy experimental jobs.

Add a short note so we don't go back to the Hotel California model of
"you can check in but never check out".  With zuulv3 it is possible to
have self-testing changes for testing indiviual jobs.  Experimental
should be for things with wider application to run against all
changes.

Change-Id: Ibfb902b17a8f7d5355689f2a584c061c001df0d8
---
 .zuul.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index dc3a42939e..2a2648e4ec 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -323,6 +323,12 @@
       jobs:
         - devstack
         - devstack-unit-tests
+    # Please add a note on each job and conditions for the job not
+    # being experimental any more, so we can keep this list somewhat
+    # pruned.
+    #
+    # * nova-next: maintained by nova for unreleased/undefaulted
+    #    things like cellsv2 and placement-api
     experimental:
       jobs:
         - nova-next

From 36c3aaa07e638af0b581efa28828e04146ae1364 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 5 Mar 2018 10:03:27 -0500
Subject: [PATCH 2232/3333] Add nova-cells-v1 to experimental queue jobs

The legacy-tempest-dsvm-cells job is being moved into the
nova repo and renamed to nova-cells-v1. This change adds
the new job name to the in-tree definition of the experimental
queue jobs that run on devstack changes. A project-config change
will depend on this patch to undefine the legacy job name from
being used on devstack changes.

Depends-On: https://review.openstack.org/549780
Change-Id: I22fa1411809c46ffc423e0dd1cde0d8f40362635
---
 .zuul.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 25bd757ab3..49bf08b091 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -329,8 +329,15 @@
     # being experimental any more, so we can keep this list somewhat
     # pruned.
     #
+    # * nova-cells-v1: maintained by nova for cells v1 (nova-cells service);
+    #    nova gates on this job, it's in experimental for testing cells v1
+    #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
     #    things like cellsv2 and placement-api
     experimental:
       jobs:
+        - nova-cells-v1:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - nova-next

From 21221d1ad1462cdcaed4d052c3324ae384b407d4 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 6 Mar 2018 10:08:36 -0500
Subject: [PATCH 2233/3333] Configure nova to auto-calculate compute RPC
 upgrade levels

The openstack-ansible team found a regression in Queens when setting
the compute RPC upgrade_levels to 'auto' on a fresh install before any
computes had started up. The dependent change fixes the issue in nova
but for future proofing against this sort of issue again, we can set
the compute RPC upgrade levels in devstack to 'auto' for fresh installs
as well. Note that grenade already sets 'auto' for compute upgrade
levels, which is why we didn't catch this in grenade testing with the
compute RPC 5.0 version bump that caused the issue.

Depends-On: https://review.openstack.org/549737/

Change-Id: I07f34dbc09b6108ba8f5b2a83a28c75eb42be495
Related-Bug: #1753443
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index 580f87f277..3b50950bb0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -506,6 +506,8 @@ function create_nova_conf {
     # Format logging
     setup_logging $NOVA_CONF
 
+    iniset $NOVA_CONF upgrade_levels compute "auto"
+
     write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
     write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" ":${METADATA_SERVICE_PORT}"
 

From 5e714d33081455af4bd7a45bb9e60a905ad6f2e7 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Sat, 17 Feb 2018 22:21:26 +0000
Subject: [PATCH 2234/3333] Fix multinode mode for devstack

Extend the devstack job so that it can support both single and multinode
cases.  Multinode mode require extra settings in devstack configuration,
some of which as subnode specific, some controller specific.

Also keep a simple devstack-multinode job defined for now so we can run
a multinode job in devstack gate, until the full tempest multinode job
is ready to match the old
gate-tempest-dsvm-neutron-multinode-full-ubuntu-xenial-nv.

Fixing multinode also requires sharing the CA configuration between
controller and peers, overlay network configuration for communication
between virtual machines and running discover_hosts for nova after the
subnode has been setup.

The extra orchestration required for multinode is encoded in a
dedicated role to allow for jobs in other repos to re-use it.

Change-Id: I2dcbd9bdb401860820e655d97aa3c4775af2827f
---
 .zuul.yaml                                    | 44 +++++++++++++----
 playbooks/devstack.yaml                       |  2 +-
 playbooks/pre.yaml                            | 30 ++++++++----
 roles/orchestrate-devstack/README.rst         | 24 ++++++++++
 roles/orchestrate-devstack/defaults/main.yaml |  1 +
 roles/orchestrate-devstack/tasks/main.yaml    | 38 +++++++++++++++
 roles/sync-devstack-data/README.rst           | 12 +++++
 roles/sync-devstack-data/defaults/main.yaml   |  1 +
 roles/sync-devstack-data/tasks/main.yaml      | 48 +++++++++++++++++++
 9 files changed, 179 insertions(+), 21 deletions(-)
 create mode 100644 roles/orchestrate-devstack/README.rst
 create mode 100644 roles/orchestrate-devstack/defaults/main.yaml
 create mode 100644 roles/orchestrate-devstack/tasks/main.yaml
 create mode 100644 roles/sync-devstack-data/README.rst
 create mode 100644 roles/sync-devstack-data/defaults/main.yaml
 create mode 100644 roles/sync-devstack-data/tasks/main.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index 2deb769d30..2ef23c89ff 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -16,19 +16,24 @@
       - name: compute1
         label: ubuntu-xenial
     groups:
+      # Node where tests are executed and test results collected
       - name: tempest
         nodes:
           - controller
+      # Nodes running the compute service
       - name: compute
         nodes:
           - controller
           - compute1
+      # Nodes that are not the controller
       - name: subnode
         nodes:
           - compute1
+      # Switch node for multinode networking setup
       - name: switch
         nodes:
           - controller
+      # Peer nodes for multinode networking setup
       - name: peers
         nodes:
           - compute1
@@ -45,7 +50,7 @@
       all single Devstack jobs, single or multinode.
       Variables are defined in job.vars, which is what is then used by single
       node jobs and by multi node jobs for the controller, as well as in
-      job.group-vars.peers, which is what is used by multi node jobs for peer
+      job.group-vars.peers, which is what is used by multi node jobs for subnode
       nodes (everything but the controller).
     required-projects:
       - openstack-dev/devstack
@@ -76,7 +81,6 @@
         # from the location below for all the CI jobs.
         ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
-        # Ignore base set of services setup by test-matrix.
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
       zuul_copy_output:
@@ -119,7 +123,7 @@
         localrc: True
         stackenv: True
     group-vars:
-      peers:
+      subnode:
         devstack_localrc:
           DATABASE_PASSWORD: secretdatabase
           RABBIT_PASSWORD: secretrabbit
@@ -156,7 +160,9 @@
     name: devstack
     parent: devstack-base
     description: |
-      Single or multi node devstack job for integration gate.
+      Base devstack job for integration gate.
+
+      This base job can be used for single node and multinode devstack jobs.
     nodeset: openstack-single-node
     required-projects:
       - openstack/cinder
@@ -178,6 +184,15 @@
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+        # Multinode specific settings
+        SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+      devstack_localconf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              global_physnet_mtu: "{{ external_bridge_mtu }}"
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -254,16 +269,25 @@
           # Test matrix emits ceilometer but ceilomenter is not installed in the
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
+        devstack_localrc:
+          # Multinode specific settings
+          HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+          SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+          # Subnode specific settings
+          DATABASE_TYPE: mysql
+          GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
+          Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          DATABASE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
 
 - job:
     name: devstack-multinode
-    parent: devstack-base
-    description: Base devstack multinode job
+    parent: devstack
     nodeset: openstack-two-node
-    # NOTE(andreaf) The multinode job is useful to see the setup of different
-    # services on different nodes, however the subnode configuration is not
-    # ready yet. Until then this job should stay non-voting.
-    voting: false
+    description: |
+      Simple multinode test to verify multinode functionality on devstack side.
+      This is not meant to be used as a parent job.
 
 - job:
     name: devstack-tox-base
diff --git a/playbooks/devstack.yaml b/playbooks/devstack.yaml
index ede8382632..93d19f1c7a 100644
--- a/playbooks/devstack.yaml
+++ b/playbooks/devstack.yaml
@@ -1,3 +1,3 @@
 - hosts: all
   roles:
-    - run-devstack
+    - orchestrate-devstack
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 6681fb20a5..4689a6354f 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -1,15 +1,25 @@
-- hosts: controller
-  roles:
-    - role: test-matrix
-      test_matrix_role: primary 
-
-- hosts: subnode
-  roles:
-    - role: test-matrix
-      test_matrix_role: subnode
-
 - hosts: all
+  pre_tasks:
+    - name: Gather minimum local MTU
+      set_fact:
+        local_mtu: >
+          {% set mtus = [] -%}
+          {% for interface in ansible_interfaces -%}
+            {% set interface_variable = 'ansible_' + interface -%}
+            {% if interface_variable in hostvars[inventory_hostname] -%}
+              {% set _ = mtus.append(hostvars[inventory_hostname][interface_variable]['mtu']|int) -%}
+            {% endif -%}
+          {% endfor -%}
+          {{- mtus|min -}}
+    - name: Calculate external_bridge_mtu
+      # 50 bytes is overhead for vxlan (which is greater than GRE
+      # allowing us to use either overlay option with this MTU.
+      # TODO(andreaf) This should work, but it may have to be reconcilied with
+      # the MTU setting used by the multinode setup roles in multinode pre.yaml
+      set_fact:
+        external_bridge_mtu: "{{ local_mtu | int - 50 }}"
   roles:
+    - test-matrix
     - configure-swap
     - setup-stack-user
     - setup-tempest-user
diff --git a/roles/orchestrate-devstack/README.rst b/roles/orchestrate-devstack/README.rst
new file mode 100644
index 0000000000..7803ee4d74
--- /dev/null
+++ b/roles/orchestrate-devstack/README.rst
@@ -0,0 +1,24 @@
+Orchestrate a devstack
+
+Runs devstack in a multinode scenario, with one controller node
+and a group of subnodes.
+
+The reason for this role is so that jobs in other repository may
+run devstack in their plays with no need for re-implementing the
+orchestration logic.
+
+The "run-devstack" role is available to run devstack with no
+orchestration.
+
+This role sets up the controller and CA first, it then pushes CA
+data to sub-nodes and run devstack there. The only requirement for
+this role is for the controller inventory_hostname to be "controller"
+and for all sub-nodes to be defined in a group called "subnode".
+
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/orchestrate-devstack/defaults/main.yaml b/roles/orchestrate-devstack/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/orchestrate-devstack/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
new file mode 100644
index 0000000000..12db58c520
--- /dev/null
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -0,0 +1,38 @@
+- name: Run devstack on the controller
+  include_role:
+    name: run-devstack
+  when: inventory_hostname == 'controller'
+
+- name: Setup devstack on sub-nodes
+  block:
+
+  - name: Sync CA data to subnodes (when any)
+    # Only do this if the tls-proxy service is defined and enabled
+    include_role:
+      name: sync-devstack-data
+    when: devstack_services['tls-proxy']|default(false)
+
+  - name: Run devstack on the sub-nodes
+    include_role:
+      name: run-devstack
+    when: inventory_hostname in groups['subnode']
+
+  - name: Discover hosts
+    # Discovers compute nodes (subnodes) and maps them to cells. Only run
+    # on the controller node.
+    # NOTE(mriedem): We want to remove this if/when nova supports
+    # auto-registration of computes with cells, but that's not happening in
+    # Ocata.
+    # NOTE(andreaf) This is taken (NOTE included) from the discover_hosts
+    # function in devstack gate. Since this is now in devstack, which is
+    # branched, we know that the discover_hosts tool exists.
+    become: true
+    become_user: stack
+    shell: ./tools/discover_hosts.sh
+    args:
+      chdir: "{{ devstack_base_dir }}/devstack"
+    when: inventory_hostname == 'controller'
+
+  when:
+    - '"controller" in hostvars'
+    - '"subnode" in groups'
diff --git a/roles/sync-devstack-data/README.rst b/roles/sync-devstack-data/README.rst
new file mode 100644
index 0000000000..500e8cccc4
--- /dev/null
+++ b/roles/sync-devstack-data/README.rst
@@ -0,0 +1,12 @@
+Sync devstack data for multinode configurations
+
+Sync any data files which include certificates to be used if TLS is enabled.
+This role must be executed on the controller and it pushes data to all
+subnodes.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/sync-devstack-data/defaults/main.yaml b/roles/sync-devstack-data/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/sync-devstack-data/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/sync-devstack-data/tasks/main.yaml b/roles/sync-devstack-data/tasks/main.yaml
new file mode 100644
index 0000000000..46000159d4
--- /dev/null
+++ b/roles/sync-devstack-data/tasks/main.yaml
@@ -0,0 +1,48 @@
+- name: Ensure the data folder exists
+  become: true
+  file:
+    path: "{{ devstack_base_dir }}/data"
+    state: directory
+    owner: stack
+    group: stack
+    mode: 0755
+  when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Ensure the CA folder exists
+  become: true
+  file:
+    path: "{{ devstack_base_dir }}/data/CA"
+    state: directory
+    owner: stack
+    group: stack
+    mode: 0755
+  when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Pull the CA certificate and folder
+  become: true
+  synchronize:
+    src: "{{ item }}"
+    dest: "{{ zuul.executor.work_root }}/{{ item | basename }}"
+    mode: pull
+  with_items:
+    - "{{ devstack_base_dir }}/data/ca-bundle.pem"
+    - "{{ devstack_base_dir }}/data/CA"
+  when: inventory_hostname == 'controller'
+
+- name: Push the CA certificate
+  become: true
+  become_user: stack
+  synchronize:
+    src: "{{ zuul.executor.work_root }}/ca-bundle.pem"
+    dest: "{{ devstack_base_dir }}/data/ca-bundle.pem"
+    mode: push
+  when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Push the CA folder
+  become: true
+  become_user: stack
+  synchronize:
+    src: "{{ zuul.executor.work_root }}/CA/"
+    dest: "{{ devstack_base_dir }}/data/"
+    mode: push
+  when: 'inventory_hostname in groups["subnode"]|default([])'

From 067e36582b8d1589c831524e921f396b270d4f44 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 23 Feb 2018 16:04:46 +0000
Subject: [PATCH 2235/3333] Document jobs

Add inline documentation to jobs and render it in the jobs doc page.
Adjust the roles page to match jobs for title and filename.

Change-Id: I47a2b4b379c8517b0dea59a75943f3f871c29046
---
 .zuul.yaml                | 19 +++++++++++++++++++
 doc/source/index.rst      |  3 ++-
 doc/source/roles.rst      |  4 ----
 doc/source/zuul_jobs.rst  |  4 ++++
 doc/source/zuul_roles.rst |  4 ++++
 5 files changed, 29 insertions(+), 5 deletions(-)
 delete mode 100644 doc/source/roles.rst
 create mode 100644 doc/source/zuul_jobs.rst
 create mode 100644 doc/source/zuul_roles.rst

diff --git a/.zuul.yaml b/.zuul.yaml
index 2ef23c89ff..693cd774b1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -163,6 +163,25 @@
       Base devstack job for integration gate.
 
       This base job can be used for single node and multinode devstack jobs.
+
+      With a single node nodeset, this job sets up an "all-in-one" (aio)
+      devstack with the six OpenStack services included in the devstack tree:
+      keystone, glance, cinder, neutron, nova and swift.
+
+      With a two node nodeset, this job sets up an aio + compute node.
+      The controller can be customised using host-vars.controller, the
+      sub-nodes can be customised using group-vars.subnode.
+
+      Descendent jobs can enable / disable services, add devstack configuration
+      options, enable devstack plugins, configure log files or directories to be
+      transferred to the log server.
+
+      The job assumes that there is only one controller node. The number of
+      subnodes can be scaled up seamlessly by setting a custom nodeset in
+      job.nodeset.
+
+      The run playbook consists of a single role, so it can be easily rewritten
+      and extended.
     nodeset: openstack-single-node
     required-projects:
       - openstack/cinder
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9254c23cae..4c53203d97 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -139,7 +139,8 @@ up to date to the latest devstack).
 Enable :doc:`devstack plugins <plugins>` to support additional
 services, features, and configuration not present in base devstack.
 
-Use devstack in your CI with :doc:`Ansible roles <roles>` for Zuul V3.
+Use devstack in your CI with :doc:`Ansible roles <zuul_roles>` and
+:doc:`Jobs <zuul_jobs>` for Zuul V3.
 
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
diff --git a/doc/source/roles.rst b/doc/source/roles.rst
deleted file mode 100644
index 5baa1e4e82..0000000000
--- a/doc/source/roles.rst
+++ /dev/null
@@ -1,4 +0,0 @@
-Roles
-=====
-
-.. zuul:autoroles::
diff --git a/doc/source/zuul_jobs.rst b/doc/source/zuul_jobs.rst
new file mode 100644
index 0000000000..cf203a8973
--- /dev/null
+++ b/doc/source/zuul_jobs.rst
@@ -0,0 +1,4 @@
+Zuul CI Jobs
+============
+
+.. zuul:autojobs::
diff --git a/doc/source/zuul_roles.rst b/doc/source/zuul_roles.rst
new file mode 100644
index 0000000000..4939281057
--- /dev/null
+++ b/doc/source/zuul_roles.rst
@@ -0,0 +1,4 @@
+Zuul CI Roles
+=============
+
+.. zuul:autoroles::

From f32f3f5266fe9a88955129fb01a9284465b9e7e5 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Mon, 19 Feb 2018 21:45:22 +0000
Subject: [PATCH 2236/3333] Document v2 to v3 devstack job migration

Document how to map DEVSTACK_GATE flags into the zuul v3 ansible
world. This is just an initial structure, the idea is to document
most of the flags as well as provide example in-line and links to
finished jobs.

Change-Id: I377ebb529bcd8f4971906563c577e8cfc48b98e6
---
 doc/source/index.rst                  |   3 +-
 doc/source/zuul_ci_jobs_migration.rst | 301 ++++++++++++++++++++++++++
 2 files changed, 303 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/zuul_ci_jobs_migration.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 4c53203d97..2ff4ff088a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -140,7 +140,8 @@ Enable :doc:`devstack plugins <plugins>` to support additional
 services, features, and configuration not present in base devstack.
 
 Use devstack in your CI with :doc:`Ansible roles <zuul_roles>` and
-:doc:`Jobs <zuul_jobs>` for Zuul V3.
+:doc:`Jobs <zuul_jobs>` for Zuul V3. Migrate your devstack Zuul V2 jobs to Zuul
+V3 with this full migration :doc:`how-to <zuul_ci_jobs_migration>`.
 
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
new file mode 100644
index 0000000000..c00f06e41a
--- /dev/null
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -0,0 +1,301 @@
+===============================
+Migrating Zuul V2 CI jobs to V3
+===============================
+
+The OpenStack CI system moved from Zuul v2 to Zuul v3, and all CI jobs moved to
+the new CI system. All jobs have been migrated automatically to a format
+compatible with Zuul v3; the jobs produced in this way however are suboptimal
+and do not use the capabilities introduced by Zuul v3, which allow for re-use of
+job parts, in the form of Ansible roles, as well as inheritance between jobs.
+
+DevStack hosts a set of roles, plays and jobs that can be used by other
+repositories to define their DevStack based jobs. To benefit from them, jobs
+must be migrated from the legacy v2 ones into v3 native format.
+
+This document provides guidance and examples to make the migration process as
+painless and smooth as possible.
+
+Where to host the job definitions.
+==================================
+
+In Zuul V3 jobs can be defined in the repository that contains the code they
+excercise. If you are writing CI jobs for an OpenStack service you can define
+your DevStack based CI jobs in one of the repositories that host the code for
+your service. If you have a branchless repo, like a Tempest plugin, that is
+a convenient choice to host the job definitions since job changes do not have
+to be backported. For example, see the beginning of the ``.zuul.yaml`` from the
+sahara Tempest plugin repo:
+
+.. code:: yaml
+
+  # In http://git.openstack.org/cgit/openstack/sahara-tests/tree/.zuul.yaml:
+  - job:
+      name: sahara-tests-tempest
+      description: |
+        Run Tempest tests from the Sahara plugin.
+      parent: devstack-tempest
+
+Which base job to start from
+============================
+
+If your job needs an OpenStack cloud deployed via DevStack, but you don't plan
+on running Tempest tests, you can start from one of the base
+:doc:`jobs <zuul_jobs>` defined in the DevStack repo.
+
+The ``devstack`` job can be used for both single-node jobs and multi-node jobs,
+and it includes the list of services used in the integrated gate (keystone,
+glance, nova, cinder, neutron and swift). Different topologies can be achieved
+by switching the nodeset used in the child job.
+
+The ``devstack-base`` job is similar to ``devstack`` but it does not specify any
+required repo or service to be run in DevStack. It can be useful to setup
+children jobs that use a very narrow DevStack setup.
+
+If your job needs an OpenStack cloud deployed via DevStack, and you do plan
+on running Tempest tests, you can start from one of the base jobs defined in the
+Tempest repo.
+
+The ``devstack-tempest`` job can be used for both single-node jobs and
+multi-node jobs. Different topologies can be achieved by switching the nodeset
+used in the child job.
+
+Jobs can be customized as follows without writing any Ansible code:
+
+- add and/or remove DevStack services
+- add or modify DevStack and services configuration
+- install DevStack plugins
+- extend the number of sub-nodes (multinode only)
+- define extra log files and/or directories to be uploaded on logs.o.o
+- define extra log file extensions to be rewritten to .txt for ease of access
+
+Tempest jobs can be further customized as follows:
+
+- define the Tempest tox environment to be used
+- define the test concurrency
+- define the test regular expression
+
+Writing Ansible code, or importing existing custom roles, jobs can be further
+extended by:
+
+- adding pre and/or post playbooks
+- overriding the run playbook, add custom roles
+
+The (partial) example below extends a Tempest single node base job
+"devstack-tempest" in the Kuryr repository. The parent job name is defined in
+job.parent.
+
+.. code:: yaml
+
+  # https://git.openstack.org/cgit/openstack/kuryr-kubernetes/tree/.zuul.yaml:
+  - job:
+      name: kuryr-kubernetes-tempest-base
+      parent: devstack-tempest
+      description: Base kuryr-kubernetes-job
+      required-projects:
+        - openstack/devstack-plugin-container
+        - openstack/kuryr
+        - openstack/kuryr-kubernetes
+        - openstack/kuryr-tempest-plugin
+        - openstack/neutron-lbaas
+      vars:
+        tempest_test_regex: '^(kuryr_tempest_plugin.tests.)'
+        tox_envlist: 'all'
+        devstack_localrc:
+          KURYR_K8S_API_PORT: 8080
+          TEMPEST_PLUGINS: '/opt/stack/kuryr-tempest-plugin'
+        devstack_services:
+          kubernetes-api: true
+          kubernetes-controller-manager: true
+          kubernetes-scheduler: true
+          kubelet: true
+          kuryr-kubernetes: true
+          (...)
+        devstack_plugins:
+          kuryr-kubernetes: https://git.openstack.org/openstack/kuryr
+          devstack-plugin-container: https://git.openstack.org/openstack/devstack-plugin-container
+          neutron-lbaas: https://git.openstack.org/openstack/neutron-lbaas
+        (...)
+
+Job variables
+=============
+
+Variables can be added to the job in three different places:
+
+- job.vars: these are global variables available to all node in the nodeset
+- job.host-vars.[HOST]: these are variables available only to the specified HOST
+- job.group-vars.[GROUP]: these are variables available only to the specified
+  GROUP
+
+Zuul merges dict variables through job inheritance. Host and group variables
+override variables with the same name defined as global variables.
+
+In the example below, for the sundaes job, hosts that are not part of the
+subnode group will run vanilla and chocolate. Hosts in the subnode group will
+run stracciatella and strawberry.
+
+.. code:: yaml
+
+  - job:
+      name: ice-creams
+      vars:
+        devstack_service:
+          vanilla: true
+          chocolate: false
+      group-vars:
+        subnode:
+          devstack_service:
+            pistacchio: true
+            stracciatella: true
+
+  - job:
+      name: sundaes
+      parent: ice-creams
+      vars:
+        devstack_service:
+          chocolate: true
+      group-vars:
+        subnode:
+          devstack_service:
+            strawberry: true
+            pistacchio: false
+
+
+DevStack Gate Flags
+===================
+
+The old CI system worked using a combination of DevStack, Tempest and
+devstack-gate to setup a test environment and run tests against it. With Zuul
+V3, the logic that used to live in devstack-gate is moved into different repos,
+including DevStack, Tempest and grenade.
+
+DevStack-gate exposes an interface for job definition based on a number of
+DEVSTACK_GATE_* environment variables, or flags. This guide shows how to map
+DEVSTACK_GATE flags into the new
+system.
+
+The repo column indicates in which repository is hosted the code that replaces
+the devstack-gate flag. The new implementation column explains how to reproduce
+the same or a similar behaviour in Zuul v3 jobs. For localrc settings,
+devstack-gate defined a default value. In ansible jobs the default is either the
+value defined in the parent job, or the default from DevStack, if any.
+
+==============================================  ============= ==================
+DevStack gate flag                              Repo          New implementation
+==============================================  ============= ==================
+OVERRIDE_ZUUL_BRANCH                            zuul          override-checkout:
+                                                              [branch]
+                                                              in the job definition.
+DEVSTACK_GATE_NET_OVERLAY                       zuul-jobs     A bridge called
+                                                              br-infra is set up for
+                                                              all jobs that inherit
+                                                              from multinode with
+                                                              a dedicated `bridge role <https://docs.openstack.org/infra/zuul-jobs/roles.html#role-multi-node-bridge>`_.
+DEVSTACK_GATE_FEATURE_MATRIX                    devstack-gate ``test_matrix_features``
+                                                              variable of the
+                                                              test-matrix role in
+                                                              devstack-gate. This
+                                                              is a temporary
+                                                              solution, feature
+                                                              matrix will go away.
+                                                              In the future services
+                                                              will be defined in
+                                                              jobs only.
+DEVSTACK_CINDER_VOLUME_CLEAR                    devstack      *CINDER_VOLUME_CLEAR: true/false*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_NEUTRON                           devstack      True by default. To
+                                                              disable, disable all
+                                                              neutron services in
+                                                              devstack_services in
+                                                              the job definition.
+DEVSTACK_GATE_CONFIGDRIVE                       devstack      *FORCE_CONFIG_DRIVE: true/false*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_INSTALL_TESTONLY                  devstack      *INSTALL_TESTONLY_PACKAGES: true/false*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_VIRT_DRIVER                       devstack      *VIRT_DRIVER: [virt driver]*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_LIBVIRT_TYPE                      devstack      *LIBVIRT_TYPE: [libvirt type]*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST                           devstack      Defined by the job
+                                                tempest       that is used. The
+                                                              ``devstack`` job only
+                                                              runs devstack.
+                                                              The ``devstack-tempest``
+                                                              one triggers a Tempest
+                                                              run as well.
+DEVSTACK_GATE_TEMPEST_FULL                      tempest       *tox_envlist: full*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_ALL                       tempest       *tox_envlist: all*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_ALL_PLUGINS               tempest       *tox_envlist: all-plugin*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_SCENARIOS                 tempest       *tox_envlist: scenario*
+                                                              in the job vars.
+TEMPEST_CONCURRENCY                             tempest       *tempest_concurrency: [value]*
+                                                              in the job vars. This
+                                                              is available only on
+                                                              jobs that inherit from
+                                                              ``devstack-tempest``
+                                                              down.
+DEVSTACK_GATE_TEMPEST_NOTESTS                   tempest       *tox_envlist: venv-tempest*
+                                                              in the job vars. This
+                                                              will create Tempest
+                                                              virtual environment
+                                                              but run no tests.
+DEVSTACK_GATE_SMOKE_SERIAL                      tempest       *tox_envlist: smoke-serial*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_DISABLE_TENANT_ISOLATION  tempest       *tox_envlist: full-serial*
+                                                              in the job vars.
+                                                              *TEMPEST_ALLOW_TENANT_ISOLATION: false*
+                                                              in devstack_localrc in
+                                                              the job vars.
+==============================================  ============= ==================
+
+The following flags have not been migrated yet or are legacy and won't be
+migrated at all.
+
+=====================================  ======  ==========================
+DevStack gate flag                     Status  Details
+=====================================  ======  ==========================
+DEVSTACK_GATE_TOPOLOGY                 WIP     The topology depends on the base
+                                               job that is used and more
+                                               specifically on the nodeset
+                                               attached to it. The new job
+                                               format allows project to define
+                                               the variables to be passed to
+                                               every node/node-group that exists
+                                               in the topology. Named topologies
+                                               that include the nodeset and the
+                                               matching variables can be defined
+                                               in the form of base jobs.
+DEVSTACK_GATE_GRENADE                  TBD     Grenade Zuul V3 jobs will be
+                                               hosted in the grenade repo.
+GRENADE_BASE_BRANCH                    TBD     Grenade Zuul V3 jobs will be
+                                               hosted in the grenade repo.
+DEVSTACK_GATE_NEUTRON_DVR              TBD     Depends on multinode support.
+DEVSTACK_GATE_EXERCISES                TBD     Can be done on request.
+DEVSTACK_GATE_IRONIC                   TBD     This will probably be implemented
+                                               on ironic side.
+DEVSTACK_GATE_IRONIC_DRIVER            TBD     This will probably be implemented
+                                               on ironic side.
+DEVSTACK_GATE_IRONIC_BUILD_RAMDISK     TBD     This will probably be implemented
+                                               on ironic side.
+DEVSTACK_GATE_POSTGRES                 Legacy  This flag exists in d-g but the
+                                               only thing that it does is
+                                               capture postgres logs. This is
+                                               already supported by the roles in
+                                               post, so the flag is useless in
+                                               the new jobs. postgres itself can
+                                               be enabled via the
+                                               devstack_service job variable.
+DEVSTACK_GATE_ZEROMQ                   Legacy  This has no effect in d-g.
+DEVSTACK_GATE_MQ_DRIVER                Legacy  This has no effect in d-g.
+DEVSTACK_GATE_TEMPEST_STRESS_ARGS      Legacy  Stress is not in Tempest anymore.
+DEVSTACK_GATE_TEMPEST_HEAT_SLOW        Legacy  This is not used anywhere.
+DEVSTACK_GATE_CELLS                    Legacy  This has no effect in d-g.
+DEVSTACK_GATE_NOVA_API_METADATA_SPLIT  Legacy  This has no effect in d-g.
+=====================================  ======  ==========================

From dc7b4294632172d0b743f98448942fe260a8a3ff Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Sep 2017 10:52:32 +0000
Subject: [PATCH 2237/3333] Fix running with SERVICE_IP_VERSION=6

- There are some locations where we need the raw IPv6 address instead of the
  url-quoted version enclosed in brackets.
- Make nova-api-metadata service listen on IPv6 when we need that.
- Use SERVICE_HOST instead of HOST_IP for TLS_IP.

Change-Id: Id074be38ee95754e88b7219de7d9beb06f796fad
Partial-Bug: 1656329
---
 functions-common    |  5 +++++
 lib/cinder          |  2 +-
 lib/databases/mysql |  2 +-
 lib/glance          |  6 +++---
 lib/neutron-legacy  |  4 ++--
 lib/nova            |  4 ++--
 lib/swift           |  2 +-
 lib/tls             | 12 ++++--------
 stackrc             |  4 ++--
 9 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/functions-common b/functions-common
index df295a3395..5f933d67cf 100644
--- a/functions-common
+++ b/functions-common
@@ -2049,6 +2049,11 @@ function is_ipv4_address {
     fi
 }
 
+# Remove "[]" around urlquoted IPv6 addresses
+function ipv6_unquote {
+    echo $1 | tr -d []
+}
+
 # Gracefully cp only if source file/dir exists
 # cp_it source destination
 function cp_it {
diff --git a/lib/cinder b/lib/cinder
index c0356fe09c..4d6085fe48 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -67,7 +67,7 @@ CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
 CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to auto, which will do thin provisioning if it's a fresh
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 0089663285..cf61056389 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -93,7 +93,7 @@ function configure_database_mysql {
 
     # Change bind-address from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
-    iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
+    iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024
diff --git a/lib/glance b/lib/glance
index 95d2450da7..4a3e25e9a2 100644
--- a/lib/glance
+++ b/lib/glance
@@ -65,7 +65,7 @@ fi
 
 # Glance connection info.  Note the port must be specified.
 GLANCE_SERVICE_HOST=${GLANCE_SERVICE_HOST:-$SERVICE_HOST}
-GLANCE_SERVICE_LISTEN_ADDRESS=${GLANCE_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+GLANCE_SERVICE_LISTEN_ADDRESS=${GLANCE_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
@@ -152,7 +152,7 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
+    iniset $GLANCE_API_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
@@ -228,7 +228,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
-    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
+    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9701ee7632..3c6ec68b67 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -111,7 +111,7 @@ Q_HOST=${Q_HOST:-$SERVICE_HOST}
 # Default protocol
 Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
 # Default listen address
-Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 # Default admin username
 Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
 # Default auth strategy
@@ -121,7 +121,7 @@ Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
 Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
 Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 # Meta data IP
-Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
+Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
 # Allow Overlapping IP among subnets
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
diff --git a/lib/nova b/lib/nova
index 580f87f277..da07579b74 100644
--- a/lib/nova
+++ b/lib/nova
@@ -92,7 +92,7 @@ NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
 NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
-NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
@@ -507,7 +507,7 @@ function create_nova_conf {
     setup_logging $NOVA_CONF
 
     write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
-    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" ":${METADATA_SERVICE_PORT}"
+    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
 
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
diff --git a/lib/swift b/lib/swift
index 1187846dfc..62b8a32fed 100644
--- a/lib/swift
+++ b/lib/swift
@@ -56,7 +56,7 @@ SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 SWIFT_DEFAULT_BIND_PORT=${SWIFT_DEFAULT_BIND_PORT:-8080}
 SWIFT_DEFAULT_BIND_PORT_INT=${SWIFT_DEFAULT_BIND_PORT_INT:-8081}
 SWIFT_SERVICE_LOCAL_HOST=${SWIFT_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
-SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 
 # TODO: add logging to different location.
 
diff --git a/lib/tls b/lib/tls
index a72b7084d0..e3ed3cc2ac 100644
--- a/lib/tls
+++ b/lib/tls
@@ -37,7 +37,7 @@
 
 if is_service_enabled tls-proxy; then
     # TODO(dtroyer): revisit this below after the search for HOST_IP has been done
-    TLS_IP=${TLS_IP:-$SERVICE_IP}
+    TLS_IP=${TLS_IP:-$(ipv6_unquote $SERVICE_HOST)}
 fi
 
 DEVSTACK_HOSTNAME=$(hostname -f)
@@ -67,9 +67,9 @@ function configure_CA {
     # build common config file
 
     # Verify ``TLS_IP`` is good
-    if [[ -n "$HOST_IP" && "$HOST_IP" != "$TLS_IP" ]]; then
+    if [[ -n "$SERVICE_HOST" && "$(ipv6_unquote $SERVICE_HOST)" != "$TLS_IP" ]]; then
         # auto-discover has changed the IP
-        TLS_IP=$HOST_IP
+        TLS_IP=$(ipv6_unquote $SERVICE_HOST)
     fi
 }
 
@@ -228,6 +228,7 @@ function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
             # Lie to let incomplete match routines work
+            # see https://bugs.python.org/issue23239
             TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
@@ -246,11 +247,6 @@ function make_cert {
     local alt_names=$4
 
     if [ "$common_name" != "$SERVICE_HOST" ]; then
-        if [[ -z "$alt_names" ]]; then
-            alt_names="DNS:$SERVICE_HOST"
-        else
-            alt_names="$alt_names,DNS:$SERVICE_HOST"
-        fi
         if is_ipv4_address "$SERVICE_HOST" ; then
             alt_names="$alt_names,IP:$SERVICE_HOST"
         fi
diff --git a/stackrc b/stackrc
index 59442529f4..0b49fbca57 100644
--- a/stackrc
+++ b/stackrc
@@ -894,10 +894,10 @@ if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
 
     DEF_SERVICE_HOST=[$HOST_IPV6]
     DEF_SERVICE_LOCAL_HOST=::1
-    DEF_SERVICE_LISTEN_ADDRESS=::
+    DEF_SERVICE_LISTEN_ADDRESS="[::]"
 fi
 
-# This is either 0.0.0.0 for IPv4 or :: for IPv6
+# This is either 0.0.0.0 for IPv4 or [::] for IPv6
 SERVICE_LISTEN_ADDRESS=${SERVICE_LISTEN_ADDRESS:-${DEF_SERVICE_LISTEN_ADDRESS}}
 
 # Allow the use of an alternate hostname (such as localhost/127.0.0.1) for

From 02bb57bfefbe3658b570060a9eb084377dddaddd Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 9 Mar 2018 17:12:38 +0000
Subject: [PATCH 2238/3333] Enforce linear strategy for orchestrate-devstack

Document that orchestrate-devstack requires a linear strategy in the
invoking play. Also enforce the strategy in devstack.yaml.

Change-Id: Ia081225ec2be959fc5a4ddfd491f526296a8ca10
---
 playbooks/devstack.yaml               | 4 ++++
 roles/orchestrate-devstack/README.rst | 1 +
 2 files changed, 5 insertions(+)

diff --git a/playbooks/devstack.yaml b/playbooks/devstack.yaml
index 93d19f1c7a..d0906380ab 100644
--- a/playbooks/devstack.yaml
+++ b/playbooks/devstack.yaml
@@ -1,3 +1,7 @@
 - hosts: all
+  # This is the default strategy, however since orchestrate-devstack requires
+  # "linear", it is safer to enforce it in case this is running in an
+  # environment configured with a different default strategy.
+  strategy: linear
   roles:
     - orchestrate-devstack
diff --git a/roles/orchestrate-devstack/README.rst b/roles/orchestrate-devstack/README.rst
index 7803ee4d74..097dcea55e 100644
--- a/roles/orchestrate-devstack/README.rst
+++ b/roles/orchestrate-devstack/README.rst
@@ -15,6 +15,7 @@ data to sub-nodes and run devstack there. The only requirement for
 this role is for the controller inventory_hostname to be "controller"
 and for all sub-nodes to be defined in a group called "subnode".
 
+This role needs to be invoked from a playbook that uses a "linear" strategy.
 
 **Role Variables**
 

From 4404f680f2447912dcdbcecde14339bc6d1f5175 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 2 Mar 2018 00:37:58 +0100
Subject: [PATCH 2239/3333] Add an openSUSE Tumbleweed devstack non-voting
 check job

This adds the necessary fixes to pass a devstack run
on openSUSE Tumbleweed. Also removes opensuse 42.2 as it
is EOL for some time already and no longer actively tested
in the OpenStack infra.

Depends-On: I1b68c08c07cf6653ea58506f738cbe0054b38f3a
Change-Id: I2894482deef063fd02b0818c695a2ddbf6767039
---
 .zuul.yaml           | 20 +++++++++++++++++++-
 functions-common     |  3 +++
 lib/rpc_backend      | 15 ++++++++++++++-
 lib/swift            |  6 +++++-
 stack.sh             |  2 +-
 tools/install_pip.sh |  4 ++--
 6 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 25bd757ab3..ebe5a78ca5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -28,6 +28,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-opensuse-tumbleweed
+    nodes:
+      - name: controller
+        label: opensuse-tumbleweed
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-fedora-27
     nodes:
@@ -238,10 +248,17 @@
 - job:
     name: devstack-platform-opensuse-423
     parent: tempest-full
-    description: OpenSuSE 43.2 platform test
+    description: openSUSE 43.2 platform test
     nodeset: devstack-single-node-opensuse-423
     voting: false
 
+- job:
+    name: devstack-platform-opensuse-tumbleweed
+    parent: tempest-full
+    description: openSUSE Tumbleweed platform test
+    nodeset: devstack-single-node-opensuse-tumbleweed
+    voting: false
+
 - job:
     name: devstack-platform-fedora-27
     parent: tempest-full
@@ -318,6 +335,7 @@
         - devstack
         - devstack-platform-centos-7
         - devstack-platform-opensuse-423
+        - devstack-platform-opensuse-tumbleweed
         - devstack-platform-fedora-27
         - devstack-multinode
         - devstack-unit-tests
diff --git a/functions-common b/functions-common
index df295a3395..279cfcfdd8 100644
--- a/functions-common
+++ b/functions-common
@@ -373,6 +373,9 @@ function GetDistro {
         DISTRO="f$os_RELEASE"
     elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
         DISTRO="opensuse-$os_RELEASE"
+        # Tumbleweed uses "n/a" as a codename, and the release is a datestring
+        # like 20180218, so not very useful.
+        [ "$os_CODENAME" = "n/a" ] && DISTRO="opensuse-tumbleweed"
     elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
         # just use major release
         DISTRO="sle${os_RELEASE%.*}"
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 44d0717116..1c7c82fcd3 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -52,7 +52,20 @@ function install_rpc_backend {
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-        if is_fedora; then
+        if is_suse; then
+            install_package rabbitmq-server-plugins
+            # the default systemd socket activation only listens on the loopback interface
+            # which causes rabbitmq to try to start its own epmd
+            sudo mkdir -p /etc/systemd/system/epmd.socket.d
+            cat <<EOF | sudo tee /etc/systemd/system/epmd.socket.d/ports.conf >/dev/null
+[Socket]
+ListenStream=
+ListenStream=[::]:4369
+EOF
+            sudo systemctl daemon-reload
+            sudo systemctl restart epmd.socket epmd.service
+        fi
+        if is_fedora || is_suse; then
             sudo systemctl enable rabbitmq-server
         fi
     fi
diff --git a/lib/swift b/lib/swift
index 1187846dfc..6cda9c84b2 100644
--- a/lib/swift
+++ b/lib/swift
@@ -557,7 +557,11 @@ EOF
 
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
     sudo rm -rf ${swift_log_dir}
-    sudo install -d -o ${STACK_USER} -g adm ${swift_log_dir}/hourly
+    local swift_log_group=adm
+    if is_suse; then
+        swift_log_group=root
+    fi
+    sudo install -d -o ${STACK_USER} -g ${swift_log_group} ${swift_log_dir}/hourly
 
     if [[ $SYSLOG != "False" ]]; then
         sed "s,%SWIFT_LOGDIR%,${swift_log_dir}," $FILES/swift/rsyslog.conf | sudo \
diff --git a/stack.sh b/stack.sh
index ba546c0ab1..caef76e18a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dbe52782a4..1bd7392b9d 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -129,10 +129,10 @@ get_versions
 
 # Eradicate any and all system packages
 
-# Python in fedora depends on the python-pip package so removing it
+# Python in fedora/suse depends on the python-pip package so removing it
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
-if ! is_fedora ; then
+if ! is_fedora  && ! is_suse; then
     uninstall_package python-pip
     uninstall_package python3-pip
 fi

From 1c9f1bf41435dc79234c5fef33b144453d423bd5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 12 Mar 2018 06:14:09 +0000
Subject: [PATCH 2240/3333] Updated from generate-devstack-plugins-list

Change-Id: I5147dda76b476a6d3caf977077f41f904b304059
---
 doc/source/plugin-registry.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 591e226645..04b7698fbd 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -31,12 +31,12 @@ barbican                               `git://git.openstack.org/openstack/barbic
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
 blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
 broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
+castellan-ui                           `git://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
 cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
 collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
-cue                                    `git://git.openstack.org/openstack/cue <https://git.openstack.org/cgit/openstack/cue>`__
 cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
 designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
 devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
@@ -71,7 +71,6 @@ ironic                                 `git://git.openstack.org/openstack/ironic
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
-k8s-cloud-provider                     `git://git.openstack.org/openstack/k8s-cloud-provider <https://git.openstack.org/cgit/openstack/k8s-cloud-provider>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__

From db5a5b3c20b4dfeb2325594e700adb3b98d7d8fd Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Mon, 12 Mar 2018 10:34:01 +0000
Subject: [PATCH 2241/3333] Remove use of git -C option from tempest venv
 creation

The -C option is not available in git versions older than "1.8.5" which
are still shipped by several distributions including centos 7.

Due to this incompatibility the patch has broken third party CI for
Cisco on Ironic.

Change-Id: I09a6f83f8b2fee870e6e1c50cbfdf2da4d70dfb2
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index ab1d63980b..f60b477c72 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -556,7 +556,7 @@ function configure_tempest {
     fi
 
     # The requirements might be on a different branch, while tempest needs master requirements.
-    git -C $REQUIREMENTS_DIR show master:upper-constraints.txt > u-c-m.txt
+    (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
     tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:

From dc78ef8880b65f56abb0e0c2b80c25d9a0a495e1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 12 Mar 2018 14:48:53 +0000
Subject: [PATCH 2242/3333] Save rc from stack.sh in run-devstack role

Avoid overriding the failure state of stack.sh by the trailing echo
command.

Change-Id: I74820709edc98f67ff1a0c620ce5db3a3571b7f5
---
 roles/run-devstack/tasks/main.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index 1ff82950e4..f58b31d477 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -2,7 +2,9 @@
   shell:
     cmd: |
       ./stack.sh 2>&1
+      rc=$?
       echo "*** FINISHED ***"
+      exit $rc
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From c81947a37d06fa07a53a891750e4864b89622e58 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 23 Jan 2018 09:30:31 +0000
Subject: [PATCH 2243/3333] Remove remnants of SCREEN_LOGDIR

These appear to have been missed in commit 'cdba1b371'.

Change-Id: Ibb7fd7a0d54750c16360dfceb8e6b024ed8f504e
---
 clean.sh | 3 ---
 stackrc  | 1 -
 2 files changed, 4 deletions(-)

diff --git a/clean.sh b/clean.sh
index 2333596c1f..a29ebd94f0 100755
--- a/clean.sh
+++ b/clean.sh
@@ -122,9 +122,6 @@ fi
 if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
     sudo rm -rf $LOGDIR
 fi
-if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
-    sudo rm -rf $SCREEN_LOGDIR
-fi
 
 # Clean out the sytemd user unit files if systemd was used.
 if [[ "$USE_SYSTEMD" = "True" ]]; then
diff --git a/stackrc b/stackrc
index 59442529f4..e8c35f423e 100644
--- a/stackrc
+++ b/stackrc
@@ -949,7 +949,6 @@ if [[ -z "${LOGDIR:-}" ]]; then
 fi
 
 # ``LOGDIR`` is always set at this point so it is not useful as a 'enable' for service logs
-# ``SCREEN_LOGDIR`` may be set, it is useful to enable the compat symlinks
 
 # System-wide ulimit file descriptors override
 ULIMIT_NOFILE=${ULIMIT_NOFILE:-2048}

From 165199eebdef5d43bdc34683bdad9054f8c897d0 Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Mon, 6 Nov 2017 18:17:39 +0200
Subject: [PATCH 2244/3333] Remove default value for Cinder Auth Strategy

Cinder supports both noauth and keystone auth mode. So now we can
configure this value via local.conf:

[[post-config|$CINDER_CONF]]
[DEFAULT]
auth_strategy = noauth

Change-Id: I1e434362117ab30dae71a8f3a80bc139e78f51bc
---
 lib/cinder | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 655908c2e4..b67fe261be 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -227,7 +227,6 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
-    iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
@@ -529,7 +528,17 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
+            # NOTE (e0ne): openstack client doesn't work with cinder in noauth mode
+            if is_service_enabled keystone; then
+                openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
+            else
+                # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
+                # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
+                local cinder_url
+                cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
+                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create ${be_name}
+                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key ${be_name} set volume_backend_name=${be_name}
+            fi
         done
     fi
 }

From e6faf84ec347470b32362098e69fe2b1844d3fed Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 13 Mar 2018 12:21:34 +0000
Subject: [PATCH 2245/3333] Revert to using neutron-legacy based services

The patch to remove the use of the test-matrix [0] also switched from
using the neutron-legacy based service names (q-*) to the new neutron-*
names. However it turns out that the new implementation is not yet working
properly for most neutron-consuming projects, so we switch back to the
previous situation for now.

[0] https://review.openstack.org/546765

Change-Id: Id6de87211d6c4ea8fd14aa9203d8d5b17e9e2f04
---
 .zuul.yaml | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5fda6b155b..4636b8cd81 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -280,12 +280,20 @@
         n-sch: true
         placement-api: true
         # Neutron services
-        neutron-api: true
-        neutron-agent: true
-        neutron-dhcp: true
-        neutron-l3: true
-        neutron-metadata-agent: true
-        neutron-metering: true
+        # We need to keep using the neutron-legacy based services for
+        # now until all issues with the new lib/neutron code are solved
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+        q-svc: true
+        # neutron-api: true
+        # neutron-agent: true
+        # neutron-dhcp: true
+        # neutron-l3: true
+        # neutron-metadata-agent: true
+        # neutron-metering: true
         # Swift services
         s-account: true
         s-container: true

From cb1448495b3c8ea63febeeda862040447839f716 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 6 Mar 2018 19:22:59 +0000
Subject: [PATCH 2246/3333] Add bionic as supported distro

Add the upcoming release Ubuntu 18.04 Bionic Beaver to the list of
supported distros. Drop the now unsupported 17.04 (zesty) instead.

Change-Id: Iea0b4bfdc510797f7886fac96eff6fdfb730252d
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index badc1a1047..ce6e6fe83d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 18abffb72b514e0b364f54459df62c2ebc12d4bf Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 14 Mar 2018 20:09:14 -0400
Subject: [PATCH 2247/3333] Mention test-config phase in config docs

I had to dig into the stack.sh code to figure out why
my tempest.conf post-config wasn't work, and it's because
post-config isn't the thing to use to configure tempest,
test-config is.

Change-Id: Ic5bbe36b5d44880d0a3a602f653b4f61fd89e9c8
Related-Bug: #1755947
---
 doc/source/configuration.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1d02395058..fc0a620441 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -41,6 +41,7 @@ The defined phases are:
 -  **extra** - runs after services are started and before any files in
    ``extra.d`` are executed
 -  **post-extra** - runs after files in ``extra.d`` are executed
+-  **test-config** - runs after tempest (and plugins) are configured
 
 The file is processed strictly in sequence; meta-sections may be
 specified more than once but if any settings are duplicated the last to

From 1ab9a2d144ee1229cdd52c0a074931c719bc7ba0 Mon Sep 17 00:00:00 2001
From: Felipe Monteiro <felipe.monteiro@att.com>
Date: Fri, 16 Mar 2018 02:02:12 +0000
Subject: [PATCH 2248/3333] Add project_tags identity feature flag

This PS adds the project_tags identity feature flag which allows
identity v3 project tags API functionality to be enabled for
releases after Pike. Once Pike is no longer supported in Tempest
this feature flag can be removed.

Depends-On: Ibaec1df79c9ac69c65cf5075c3519092bc609546
Change-Id: Iec6b34c10ea1bd7103720c773b48ce130643115d
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index f60b477c72..0605ffb082 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -299,6 +299,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled domain_specific_drivers True
     fi
 
+    # TODO(felipemonteiro): Remove this once Tempest no longer supports Pike
+    # as this is supported in Queens and beyond.
+    iniset $TEMPEST_CONFIG identity-feature-enabled project_tags True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 34e09dd3a90e7782a96c5a500368cad04f553e1c Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Sun, 18 Mar 2018 17:56:27 +0100
Subject: [PATCH 2249/3333] Fix devstack job: the dict name is
 devstack_local_conf

It looks like a typo.

Change-Id: Id017b169f25a7589da3eca509c28f5d867fd5962
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 4636b8cd81..07d8f48cff 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -249,7 +249,7 @@
         SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
         HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
         PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
-      devstack_localconf:
+      devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
             DEFAULT:

From 23df4da0d4e61e2149e0ec164d0bad02fc8a3f07 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 19 Mar 2018 14:27:01 -0400
Subject: [PATCH 2250/3333] Use Queens UCA

This updates the UCA usage from Pike to Queens. As a result,
the various volume multiattach checks can also be removed
because the Queens UCA has libvirt 4.0.0.

Change-Id: Icb971831c8d4fe5f940d9e7993d53f1c3765e30f
---
 stackrc              |  7 +------
 tools/fixup_stuff.sh | 13 ++++---------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/stackrc b/stackrc
index e8c35f423e..d3ea33ef44 100644
--- a/stackrc
+++ b/stackrc
@@ -625,12 +625,7 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        # If ENABLE_VOLUME_MULTIATTACH is True, the Ubuntu Cloud Archive can't
-        # be used until it provides libvirt>=3.10, and with older versions of
-        # Ubuntu the group is "libvirtd".
-        # TODO(mriedem): Remove the ENABLE_VOLUME_MULTIATTACH check when
-        # UCA has libvirt>=3.10.
-        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) && "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
+        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check
             # to see if libvirtd group already exists to handle grenade's case.
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 90b2c8bf1f..914793245e 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -77,28 +77,23 @@ function fixup_keystone {
 # Make it possible to switch this based on an environment variable as
 # libvirt 2.5.0 doesn't handle nested virtualization quite well and this
 # is required for the trove development environment.
-# The Pike UCA has qemu 2.10 but libvirt 3.6, therefore if
-# ENABLE_VOLUME_MULTIATTACH is True, we can't use the Pike UCA
-# because multiattach won't work with those package versions.
-# We can remove this check when the UCA has libvirt>=3.10.
 function fixup_uca {
-    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" || \
-            "${ENABLE_VOLUME_MULTIATTACH}" == "True" ]]; then
+    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
         return
     fi
 
     # This pulls in apt-add-repository
     install_package "software-properties-common"
-    # Use UCA for newer libvirt. Should give us libvirt 2.5.0.
+    # Use UCA for newer libvirt.
     if [[ -f /etc/ci/mirror_info.sh ]] ; then
         # If we are on a nodepool provided host and it has told us about where
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/queens main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:pike
+        sudo add-apt-repository -y cloud-archive:queens
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From 6f27fca4a76aceaadab3776c87c48743671ce502 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Tue, 21 Nov 2017 17:05:43 -0800
Subject: [PATCH 2251/3333] Zuul: support plugin dependencies

Change-Id: I81302e8988fe6498fea9f08ed66f5d0cc1fce161
---
 .gitignore                                    |   1 +
 .../library/devstack_local_conf.py            | 219 +++++++++++++-----
 .../write-devstack-local-conf/library/test.py | 166 +++++++++++++
 .../write-devstack-local-conf/tasks/main.yaml |   1 +
 tests/test_write_devstack_local_conf_role.sh  |   9 +
 5 files changed, 341 insertions(+), 55 deletions(-)
 create mode 100644 roles/write-devstack-local-conf/library/test.py
 create mode 100755 tests/test_write_devstack_local_conf_role.sh

diff --git a/.gitignore b/.gitignore
index d2c127d099..8553b3f849 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 *.log
 *.log.[1-9]
 *.pem
+*.pyc
 .localrc.auto
 .localrc.password
 .prereqs
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 55ba4afb69..746f54f921 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -14,16 +14,69 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import os
 import re
 
 
-class VarGraph(object):
+class DependencyGraph(object):
     # This is based on the JobGraph from Zuul.
 
+    def __init__(self):
+        self._names = set()
+        self._dependencies = {}  # dependent_name -> set(parent_names)
+
+    def add(self, name, dependencies):
+        # Append the dependency information
+        self._dependencies.setdefault(name, set())
+        try:
+            for dependency in dependencies:
+                # Make sure a circular dependency is never created
+                ancestors = self._getParentNamesRecursively(
+                    dependency, soft=True)
+                ancestors.add(dependency)
+                if name in ancestors:
+                    raise Exception("Dependency cycle detected in {}".
+                                    format(name))
+                self._dependencies[name].add(dependency)
+        except Exception:
+            del self._dependencies[name]
+            raise
+
+    def getDependenciesRecursively(self, parent):
+        dependencies = []
+
+        current_dependencies = self._dependencies[parent]
+        for current in current_dependencies:
+            if current not in dependencies:
+                dependencies.append(current)
+            for dep in self.getDependenciesRecursively(current):
+                if dep not in dependencies:
+                    dependencies.append(dep)
+        return dependencies
+
+    def _getParentNamesRecursively(self, dependent, soft=False):
+        all_parent_items = set()
+        items_to_iterate = set([dependent])
+        while len(items_to_iterate) > 0:
+            current_item = items_to_iterate.pop()
+            current_parent_items = self._dependencies.get(current_item)
+            if current_parent_items is None:
+                if soft:
+                    current_parent_items = set()
+                else:
+                    raise Exception("Dependent item {} not found: ".format(
+                                    dependent))
+            new_parent_items = current_parent_items - all_parent_items
+            items_to_iterate |= new_parent_items
+            all_parent_items |= new_parent_items
+        return all_parent_items
+
+
+class VarGraph(DependencyGraph):
     def __init__(self, vars):
+        super(VarGraph, self).__init__()
         self.vars = {}
         self._varnames = set()
-        self._dependencies = {}  # dependent_var_name -> set(parent_var_names)
         for k, v in vars.items():
             self._varnames.add(k)
         for k, v in vars.items():
@@ -38,28 +91,21 @@ def _addVar(self, key, value):
             raise Exception("Variable {} already added".format(key))
         self.vars[key] = value
         # Append the dependency information
-        self._dependencies.setdefault(key, set())
+        dependencies = set()
+        for dependency in self.getDependencies(value):
+            if dependency == key:
+                # A variable is allowed to reference itself; no
+                # dependency link needed in that case.
+                continue
+            if dependency not in self._varnames:
+                # It's not necessary to create a link for an
+                # external variable.
+                continue
+            dependencies.add(dependency)
         try:
-            for dependency in self.getDependencies(value):
-                if dependency == key:
-                    # A variable is allowed to reference itself; no
-                    # dependency link needed in that case.
-                    continue
-                if dependency not in self._varnames:
-                    # It's not necessary to create a link for an
-                    # external variable.
-                    continue
-                # Make sure a circular dependency is never created
-                ancestor_vars = self._getParentVarNamesRecursively(
-                    dependency, soft=True)
-                ancestor_vars.add(dependency)
-                if any((key == anc_var) for anc_var in ancestor_vars):
-                    raise Exception("Dependency cycle detected in var {}".
-                                    format(key))
-                self._dependencies[key].add(dependency)
+            self.add(key, dependencies)
         except Exception:
             del self.vars[key]
-            del self._dependencies[key]
             raise
 
     def getVars(self):
@@ -67,48 +113,105 @@ def getVars(self):
         keys = sorted(self.vars.keys())
         seen = set()
         for key in keys:
-            dependencies = self.getDependentVarsRecursively(key)
+            dependencies = self.getDependenciesRecursively(key)
             for var in dependencies + [key]:
                 if var not in seen:
                     ret.append((var, self.vars[var]))
                     seen.add(var)
         return ret
 
-    def getDependentVarsRecursively(self, parent_var):
-        dependent_vars = []
-
-        current_dependent_vars = self._dependencies[parent_var]
-        for current_var in current_dependent_vars:
-            if current_var not in dependent_vars:
-                dependent_vars.append(current_var)
-            for dep in self.getDependentVarsRecursively(current_var):
-                if dep not in dependent_vars:
-                    dependent_vars.append(dep)
-        return dependent_vars
-
-    def _getParentVarNamesRecursively(self, dependent_var, soft=False):
-        all_parent_vars = set()
-        vars_to_iterate = set([dependent_var])
-        while len(vars_to_iterate) > 0:
-            current_var = vars_to_iterate.pop()
-            current_parent_vars = self._dependencies.get(current_var)
-            if current_parent_vars is None:
-                if soft:
-                    current_parent_vars = set()
-                else:
-                    raise Exception("Dependent var {} not found: ".format(
-                                    dependent_var))
-            new_parent_vars = current_parent_vars - all_parent_vars
-            vars_to_iterate |= new_parent_vars
-            all_parent_vars |= new_parent_vars
-        return all_parent_vars
+
+class PluginGraph(DependencyGraph):
+    def __init__(self, base_dir, plugins):
+        super(PluginGraph, self).__init__()
+        # The dependency trees expressed by all the plugins we found
+        # (which may be more than those the job is using).
+        self._plugin_dependencies = {}
+        self.loadPluginNames(base_dir)
+
+        self.plugins = {}
+        self._pluginnames = set()
+        for k, v in plugins.items():
+            self._pluginnames.add(k)
+        for k, v in plugins.items():
+            self._addPlugin(k, str(v))
+
+    def loadPluginNames(self, base_dir):
+        if base_dir is None:
+            return
+        git_roots = []
+        for root, dirs, files in os.walk(base_dir):
+            if '.git' not in dirs:
+                continue
+            # Don't go deeper than git roots
+            dirs[:] = []
+            git_roots.append(root)
+        for root in git_roots:
+            devstack = os.path.join(root, 'devstack')
+            if not (os.path.exists(devstack) and os.path.isdir(devstack)):
+                continue
+            settings = os.path.join(devstack, 'settings')
+            if not (os.path.exists(settings) and os.path.isfile(settings)):
+                continue
+            self.loadDevstackPluginInfo(settings)
+
+    define_re = re.compile(r'^define_plugin\s+(\w+).*')
+    require_re = re.compile(r'^plugin_requires\s+(\w+)\s+(\w+).*')
+    def loadDevstackPluginInfo(self, fn):
+        name = None
+        reqs = set()
+        with open(fn) as f:
+            for line in f:
+                m = self.define_re.match(line)
+                if m:
+                    name = m.group(1)
+                m = self.require_re.match(line)
+                if m:
+                    if name == m.group(1):
+                        reqs.add(m.group(2))
+        if name and reqs:
+            self._plugin_dependencies[name] = reqs
+
+    def getDependencies(self, value):
+        return self._plugin_dependencies.get(value, [])
+
+    def _addPlugin(self, key, value):
+        if key in self.plugins:
+            raise Exception("Plugin {} already added".format(key))
+        self.plugins[key] = value
+        # Append the dependency information
+        dependencies = set()
+        for dependency in self.getDependencies(key):
+            if dependency == key:
+                continue
+            dependencies.add(dependency)
+        try:
+            self.add(key, dependencies)
+        except Exception:
+            del self.plugins[key]
+            raise
+
+    def getPlugins(self):
+        ret = []
+        keys = sorted(self.plugins.keys())
+        seen = set()
+        for key in keys:
+            dependencies = self.getDependenciesRecursively(key)
+            for plugin in dependencies + [key]:
+                if plugin not in seen:
+                    ret.append((plugin, self.plugins[plugin]))
+                    seen.add(plugin)
+        return ret
 
 
 class LocalConf(object):
 
-    def __init__(self, localrc, localconf, base_services, services, plugins):
+    def __init__(self, localrc, localconf, base_services, services, plugins,
+                 base_dir):
         self.localrc = []
         self.meta_sections = {}
+        self.plugin_deps = {}
+        self.base_dir = base_dir
         if plugins:
             self.handle_plugins(plugins)
         if services or base_services:
@@ -119,7 +222,8 @@ def __init__(self, localrc, localconf, base_services, services, plugins):
             self.handle_localconf(localconf)
 
     def handle_plugins(self, plugins):
-        for k, v in plugins.items():
+        pg = PluginGraph(self.base_dir, plugins)
+        for k, v in pg.getPlugins():
             if v:
                 self.localrc.append('enable_plugin {} {}'.format(k, v))
 
@@ -171,6 +275,7 @@ def main():
             services=dict(type='dict'),
             localrc=dict(type='dict'),
             local_conf=dict(type='dict'),
+            base_dir=dict(type='path'),
             path=dict(type='str'),
         )
     )
@@ -180,14 +285,18 @@ def main():
                    p.get('local_conf'),
                    p.get('base_services'),
                    p.get('services'),
-                   p.get('plugins'))
+                   p.get('plugins'),
+                   p.get('base_dir'))
     lc.write(p['path'])
 
     module.exit_json()
 
 
-from ansible.module_utils.basic import *  # noqa
-from ansible.module_utils.basic import AnsibleModule
+try:
+    from ansible.module_utils.basic import *  # noqa
+    from ansible.module_utils.basic import AnsibleModule
+except ImportError:
+    pass
 
 if __name__ == '__main__':
     main()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
new file mode 100644
index 0000000000..843ca6e9fd
--- /dev/null
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -0,0 +1,166 @@
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+#
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import shutil
+import tempfile
+import unittest
+
+from devstack_local_conf import LocalConf
+from collections import OrderedDict
+
+class TestDevstackLocalConf(unittest.TestCase):
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+
+    def tearDown(self):
+        shutil.rmtree(self.tmpdir)
+
+    def test_plugins(self):
+        "Test that plugins without dependencies work"
+        localrc = {'test_localrc': '1'}
+        local_conf = {'install':
+                      {'nova.conf':
+                       {'main':
+                        {'test_conf': '2'}}}}
+        services = {'cinder': True}
+        # We use ordereddict here to make sure the plugins are in the
+        # *wrong* order for testing.
+        plugins = OrderedDict([
+            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('baz', 'git://git.openstack.org/openstack/baz-plugin'),
+            ])
+        p = dict(localrc=localrc,
+                 local_conf=local_conf,
+                 base_services=[],
+                 services=services,
+                 plugins=plugins,
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'))
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'))
+        lc.write(p['path'])
+
+        plugins = []
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('enable_plugin'):
+                    plugins.append(line.split()[1])
+        self.assertEqual(['bar', 'baz', 'foo'], plugins)
+
+    def test_plugin_deps(self):
+        "Test that plugins with dependencies work"
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', '.git'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', '.git'))
+        with open(os.path.join(
+                self.tmpdir,
+                'foo-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin foo\n')
+        with open(os.path.join(
+                self.tmpdir,
+                'bar-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin bar\n')
+            f.write('plugin_requires bar foo\n')
+
+        localrc = {'test_localrc': '1'}
+        local_conf = {'install':
+                      {'nova.conf':
+                       {'main':
+                        {'test_conf': '2'}}}}
+        services = {'cinder': True}
+        # We use ordereddict here to make sure the plugins are in the
+        # *wrong* order for testing.
+        plugins = OrderedDict([
+            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ])
+        p = dict(localrc=localrc,
+                 local_conf=local_conf,
+                 base_services=[],
+                 services=services,
+                 plugins=plugins,
+                 base_dir=self.tmpdir,
+                 path=os.path.join(self.tmpdir, 'test.local.conf'))
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'))
+        lc.write(p['path'])
+
+        plugins = []
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('enable_plugin'):
+                    plugins.append(line.split()[1])
+        self.assertEqual(['foo', 'bar'], plugins)
+
+    def test_plugin_circular_deps(self):
+        "Test that plugins with circular dependencies fail"
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', '.git'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', '.git'))
+        with open(os.path.join(
+                self.tmpdir,
+                'foo-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin foo\n')
+            f.write('plugin_requires foo bar\n')
+        with open(os.path.join(
+                self.tmpdir,
+                'bar-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin bar\n')
+            f.write('plugin_requires bar foo\n')
+
+        localrc = {'test_localrc': '1'}
+        local_conf = {'install':
+                      {'nova.conf':
+                       {'main':
+                        {'test_conf': '2'}}}}
+        services = {'cinder': True}
+        # We use ordereddict here to make sure the plugins are in the
+        # *wrong* order for testing.
+        plugins = OrderedDict([
+            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ])
+        p = dict(localrc=localrc,
+                 local_conf=local_conf,
+                 base_services=[],
+                 services=services,
+                 plugins=plugins,
+                 base_dir=self.tmpdir,
+                 path=os.path.join(self.tmpdir, 'test.local.conf'))
+        with self.assertRaises(Exception):
+            lc = LocalConf(p.get('localrc'),
+                           p.get('local_conf'),
+                           p.get('base_services'),
+                           p.get('services'),
+                           p.get('plugins'),
+                           p.get('base_dir'))
+            lc.write(p['path'])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index cc21426b89..2a9f8985fc 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -8,3 +8,4 @@
     services: "{{ devstack_services|default(omit) }}"
     localrc: "{{ devstack_localrc|default(omit) }}"
     local_conf: "{{ devstack_local_conf|default(omit) }}"
+    base_dir: "{{ devstack_base_dir|default(omit) }}"
diff --git a/tests/test_write_devstack_local_conf_role.sh b/tests/test_write_devstack_local_conf_role.sh
new file mode 100755
index 0000000000..b2bc0a2c46
--- /dev/null
+++ b/tests/test_write_devstack_local_conf_role.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import common functions
+source $TOP/functions
+source $TOP/tests/unittest.sh
+
+python ./roles/write-devstack-local-conf/library/test.py

From 236250f1c3e9f328f0dc23ab168afbcfa639a33b Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 23 Mar 2018 08:27:57 -0500
Subject: [PATCH 2252/3333] Rename python-openstacksdk to openstacksdk

Change-Id: Ia77163f330f674146b369dfebea56bd97820057e
Depends-On: https://review.openstack.org/554662
---
 doc/source/plugin-registry.rst |  2 +-
 inc/python                     |  6 ------
 lib/libraries                  |  2 +-
 stackrc                        | 10 +++++-----
 tests/test_libs_from_pypi.sh   |  2 +-
 5 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 04b7698fbd..a5d3ff28c6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -147,13 +147,13 @@ oaktree                                `git://git.openstack.org/openstack/oaktre
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
 omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
+openstacksdk                           `git://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
-python-openstacksdk                    `git://git.openstack.org/openstack/python-openstacksdk <https://git.openstack.org/cgit/openstack/python-openstacksdk>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
diff --git a/inc/python b/inc/python
index e074ea498f..ec4233b156 100644
--- a/inc/python
+++ b/inc/python
@@ -411,12 +411,6 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
-    # TODO(mordred) This is a special case for python-openstacksdk, where the
-    # repo name and the pip name do not match. We should either add systemic
-    # support for providing aliases, or we should rename the git repo.
-    if [[ $name == 'python-openstacksdk' ]] ; then
-        name=openstacksdk
-    fi
     safe_name=$(python -c "from pkg_resources import safe_name; \
         print(safe_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
diff --git a/lib/libraries b/lib/libraries
index 6d52f642a1..52ec784d3b 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -28,6 +28,7 @@ GITDIR["cliff"]=$DEST/cliff
 GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
+GITDIR["openstacksdk"]=$DEST/openstacksdk
 GITDIR["os-client-config"]=$DEST/os-client-config
 GITDIR["osc-lib"]=$DEST/osc-lib
 GITDIR["osc-placement"]=$DEST/osc-placement
@@ -51,7 +52,6 @@ GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
 GITDIR["osprofiler"]=$DEST/osprofiler
 GITDIR["pycadf"]=$DEST/pycadf
-GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
diff --git a/stackrc b/stackrc
index e8c35f423e..f05bc6ec3a 100644
--- a/stackrc
+++ b/stackrc
@@ -133,7 +133,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 # base name of the directory from which they are installed. See
 # enable_python3_package to edit this variable and use_python3_for to
 # test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,python-openstacksdk"
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,openstacksdk"
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.
@@ -525,6 +525,10 @@ GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/opensta
 GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 
+# openstacksdk OpenStack Python SDK
+GITREPO["openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/openstacksdk.git}
+GITBRANCH["openstacksdk"]=${OPENSTACKSDK_BRANCH:-$TARGET_BRANCH}
+
 # os-brick library to manage local volume attaches
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-$TARGET_BRANCH}
@@ -542,10 +546,6 @@ GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-$TARGET_BRANCH}
 GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
 GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-$TARGET_BRANCH}
 
-# python-openstacksdk OpenStack Python SDK
-GITREPO["python-openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/python-openstacksdk.git}
-GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-$TARGET_BRANCH}
-
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index a544b56577..c3b4457171 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -38,7 +38,7 @@ ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization"
 ALL_LIBS+=" python-openstackclient osc-lib osc-placement"
 ALL_LIBS+=" os-client-config oslo.rootwrap"
-ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
+ALL_LIBS+=" oslo.i18n oslo.utils openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"

From 63beab524368875820db453c244468105584bc85 Mon Sep 17 00:00:00 2001
From: Huan Xiong <huan.xiong@hxt-semitech.com>
Date: Fri, 23 Mar 2018 14:42:37 +0000
Subject: [PATCH 2253/3333] init_cinder() shouldn't always create
 DEFAULT_VOLUME_GROUP_NAME

DEFAULT_VOLUME_GROUP_NAME volume group is LVM ephemeral storage used by
Nova. It is created by init_nova() if user sets NOVA_BACKEND to "LVM".
However, init_cinder() is also hardcoded to create it, based on the
asumption that CINDER_ENABLED_BACKENDS includes it. That assumption
doesn't hold for the current code. What's more important, even if user
wants to use DEFAULT_VOLUME_GROUP_NAME as one of cinder backends and
adds it to CINDER_ENABLED_BACKENDS, the current code in init_cinder()
are general enough and should work fine. This change removes relevant
code in init_cinder(). It also moves DEFAULT_VOLUME_GROUP_NAME clean-up
code from unstack.sh to cleanup_nova().

Change-Id: I53762f8eda6256f962cc4e1f1098406879bbcf5c
---
 lib/cinder | 4 ----
 lib/nova   | 4 ++++
 unstack.sh | 4 ----
 3 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 3a8097f894..e0b8971dcb 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -420,10 +420,6 @@ function init_cinder {
             be_type=${be%%:*}
             be_name=${be##*:}
             if type init_cinder_backend_${be_type} >/dev/null 2>&1; then
-                # Always init the default volume group for lvm.
-                if [[ "$be_type" == "lvm" ]]; then
-                    init_default_lvm_volume_group
-                fi
                 init_cinder_backend_${be_type} ${be_name}
             fi
         done
diff --git a/lib/nova b/lib/nova
index 56e309333b..ee682db86a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -264,6 +264,10 @@ function cleanup_nova {
     stop_process "n-api-meta"
     remove_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI"
     remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI"
+
+    if [[ "$NOVA_BACKEND" == "LVM" ]]; then
+        clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME
+    fi
 }
 
 # configure_nova() - Set config files, create data dirs, etc
diff --git a/unstack.sh b/unstack.sh
index ccea0ef585..cfbf22e0fa 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -175,9 +175,5 @@ fi
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.
 if is_service_enabled cinder && is_package_installed lvm2; then
-    # Using /bin/true here indicates a BUG - maybe the
-    # DEFAULT_VOLUME_GROUP_NAME doesn't exist?  We should
-    # isolate this further down in lib/cinder cleanup.
-    clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
     clean_lvm_filter
 fi

From 2b3bb30d9906f70894a1945956fb8216cd929ad0 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 23 Mar 2018 19:56:26 -0400
Subject: [PATCH 2254/3333] Only sync the local cell in superconductor mode

When nova-manage db sync runs on cell1 in superconductor
mode, the [api_database]/connection config option isn't
set in the config file on purpose so the cell can't
reach the API database.

As a result, the db sync on the cell config can't hit
the API DB to sync cell0, which is not something we need
here anyway, but it results in an error message.

This tells the cell config db sync to just run it on the
cell database and not try to sync cell0.

Change-Id: Iac092762decd6de9e90e264f2998d255e8e40d00
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 56e309333b..2c5307ccec 100644
--- a/lib/nova
+++ b/lib/nova
@@ -734,7 +734,7 @@ function init_nova {
         # (Re)create nova databases
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             recreate_database nova_cell${i}
-            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
+            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync --local_cell
         done
 
         # Migrate nova and nova_cell0 databases.

From 3e813ae7c3a74f1e7069c57a311c454a8570ee92 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 24 Mar 2018 06:13:44 +0000
Subject: [PATCH 2255/3333] Updated from generate-devstack-plugins-list

Change-Id: I64ec2bd77785744df7791c13ea2b3065a781db3e
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a5d3ff28c6..c21e0efcc8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -35,7 +35,7 @@ castellan-ui                           `git://git.openstack.org/openstack/castel
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
 cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
-collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
+collectd-openstack-plugins             `git://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
 cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
 designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__

From b8fcb2594cbee90c559bfc68840ac4380c8567c7 Mon Sep 17 00:00:00 2001
From: esberglu <esberglu@us.ibm.com>
Date: Wed, 21 Mar 2018 11:04:37 -0500
Subject: [PATCH 2256/3333] Update default ETCD_VERSION to latest 3.2 etcd
 release

This updates the default ETCD_VERSION to the latest 3.2 etcd release,
v3.2.17.  3.2 is chosen as it is packaged in bionic and fedora; we
hope to move to packaged versions for distros that support it in due
course.

This version supports arm64 and ppc64le which were not supported by the
previous default, v3.1.10.

We have removed the override to tarballs.o.o, as these files are now
cached as described in [1]

[1] http://lists.openstack.org/pipermail/openstack-infra/2018-March/005871.html

Depends-On: https://review.openstack.org/556688
Change-Id: I5103b4331a8d7c5660848fc148ebe4139ce6dad9
---
 .zuul.yaml |  5 -----
 stackrc    | 10 +++++-----
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 07d8f48cff..bbcdfef977 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -116,10 +116,6 @@
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it.
         LIBVIRT_TYPE: qemu
-        # NOTE(dims): etcd 3.x is not available in debian/ubuntu
-        # etc. As a stop gap measure, devstack uses wget to download
-        # from the location below for all the CI jobs.
-        ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
@@ -183,7 +179,6 @@
           NOVNC_FROM_PACKAGE: true
           ERROR_ON_CLONE: true
           LIBVIRT_TYPE: qemu
-          ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
         devstack_services:
           base: false
     pre-run: playbooks/pre.yaml
diff --git a/stackrc b/stackrc
index e8c35f423e..9c98bc983d 100644
--- a/stackrc
+++ b/stackrc
@@ -737,11 +737,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.1.10}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"}
-# NOTE(sdague): etcd v3.1.10 doesn't have anything for these architectures, though 3.2.x does.
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-""}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-""}
+ETCD_VERSION=${ETCD_VERSION:-v3.2.17}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"0a75e794502e2e76417b19da2807a9915fa58dcbf0985e397741d570f4f305cd"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"0ab4621c44c79d17d94e43bd184d0f23b763a3669056ce4ae2d0b2942410a98f"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"69e1279c4a2a52256b78d2a8dd23346ac46b836e678b971a459f2afaef3c275e"}
+# etcd v3.3.2 doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then

From 40a58d0525d493ab6ec11fda5d123d11a7437308 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 28 Mar 2018 06:36:09 +0000
Subject: [PATCH 2257/3333] Updated from generate-devstack-plugins-list

Change-Id: I35e087b203f463532788284227fddd233cb6ba0d
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c21e0efcc8..01ba9d1eac 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,6 +75,7 @@ karbor                                 `git://git.openstack.org/openstack/karbor
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kolla-cli                              `git://git.openstack.org/openstack/kolla-cli <https://git.openstack.org/cgit/openstack/kolla-cli>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__

From aab248bc89b11aa527ebf185ec4b12a2e951b11c Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 28 Mar 2018 10:05:05 -0500
Subject: [PATCH 2258/3333] Another openstacksdk rename fix

Missed one, this is blocking OSc's functional-tips tests

Change-Id: Iecf848c1791b1f204b0867e9da3e2ed994f02da3
---
 lib/libraries | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/libraries b/lib/libraries
index 52ec784d3b..b4f3c31d5e 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -91,6 +91,7 @@ function install_libs {
     _install_lib_from_source "cursive"
     _install_lib_from_source "debtcollector"
     _install_lib_from_source "futurist"
+    _install_lib_from_source "openstacksdk"
     _install_lib_from_source "osc-lib"
     _install_lib_from_source "osc-placement"
     _install_lib_from_source "os-client-config"
@@ -114,7 +115,6 @@ function install_libs {
     _install_lib_from_source "oslo.vmware"
     _install_lib_from_source "osprofiler"
     _install_lib_from_source "pycadf"
-    _install_lib_from_source "python-openstacksdk"
     _install_lib_from_source "stevedore"
     _install_lib_from_source "taskflow"
     _install_lib_from_source "tooz"

From d9060111d9496306c90e0349f4df1167e9b01ad5 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Thu, 29 Mar 2018 12:10:28 +1100
Subject: [PATCH 2259/3333] [trivial] Comment fix

In I5103b4331a8d7c5660848fc148ebe4139ce6dad9 it was noted that the
comment was wrong.  While this has no functional impact let's clean it
up while it's fresh.

Change-Id: Ia6cf8125214c69f8289fa7cff948afc10801ed2f
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index e4e76249a1..166b7cf1bb 100644
--- a/stackrc
+++ b/stackrc
@@ -741,7 +741,7 @@ ETCD_VERSION=${ETCD_VERSION:-v3.2.17}
 ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"0a75e794502e2e76417b19da2807a9915fa58dcbf0985e397741d570f4f305cd"}
 ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"0ab4621c44c79d17d94e43bd184d0f23b763a3669056ce4ae2d0b2942410a98f"}
 ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"69e1279c4a2a52256b78d2a8dd23346ac46b836e678b971a459f2afaef3c275e"}
-# etcd v3.3.2 doesn't have anything for s390x
+# etcd v3.2.x doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then

From d6558b885785f6634d493e31000fb34c35e1213d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 31 Mar 2018 06:11:19 +0000
Subject: [PATCH 2260/3333] Updated from generate-devstack-plugins-list

Change-Id: I12b31df6f53926dd79a6094ca998957f485e8133
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 01ba9d1eac..c21e0efcc8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,7 +75,6 @@ karbor                                 `git://git.openstack.org/openstack/karbor
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kolla-cli                              `git://git.openstack.org/openstack/kolla-cli <https://git.openstack.org/cgit/openstack/kolla-cli>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__

From a62ede7d5034185a85c8ee99a916f41c0f2bde75 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 14 Mar 2018 11:58:56 -0400
Subject: [PATCH 2261/3333] Use NOVA_BIN_DIR / SWIFT_BIN_DIR for binaries

Fix a few path issues where we didn't properly use NOVA_BIN_DIR /
SWIFT_BIN_DIR.

This is part of the effort to start using a virtualenv for openstack
services.

Change-Id: I6eb383db65cc902c67c43e5cb1a16a9716a914b2
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 lib/nova  |  8 ++++----
 lib/swift | 45 ++++++++++++++++++++++-----------------------
 2 files changed, 26 insertions(+), 27 deletions(-)

diff --git a/lib/nova b/lib/nova
index 56e309333b..2eef8c411f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -685,7 +685,7 @@ function init_nova_cells {
         $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
 
         # Creates the single cells v2 cell for the child cell (v1) nova db.
-        nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
             --transport-url $(get_transport_url child_cell) --name 'cell1'
     fi
 }
@@ -729,7 +729,7 @@ function init_nova {
         # this needs to come after the api_db sync happens. We also want to run
         # this before the db sync below since that will migrate both the nova
         # and nova_cell0 databases.
-        nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
+        $NOVA_BIN_DIR/nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
 
         # (Re)create nova databases
         for i in $(seq 1 $NOVA_NUM_CELLS); do
@@ -750,7 +750,7 @@ function init_nova {
 
         # create the cell1 cell for the main nova db where the hosts live
         for i in $(seq 1 $NOVA_NUM_CELLS); do
-            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
+            $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
         done
     fi
 
@@ -1015,7 +1015,7 @@ function start_nova {
     if is_service_enabled n-api; then
         # dump the cell mapping to ensure life is good
         echo "Dumping cells_v2 mapping"
-        nova-manage cell_v2 list_cells --verbose
+        $NOVA_BIN_DIR/nova-manage cell_v2 list_cells --verbose
     fi
 }
 
diff --git a/lib/swift b/lib/swift
index 6cda9c84b2..933af1005b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -37,6 +37,7 @@ fi
 
 # Set up default directories
 GITDIR["python-swiftclient"]=$DEST/python-swiftclient
+SWIFT_DIR=$DEST/swift
 
 # Swift virtual environment
 if [[ ${USE_VENV} = True ]]; then
@@ -46,8 +47,6 @@ else
     SWIFT_BIN_DIR=$(get_python_exec_prefix)
 fi
 
-
-SWIFT_DIR=$DEST/swift
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
@@ -341,7 +340,7 @@ function configure_swift {
     local user_group
 
     # Make sure to kill all swift processes first
-    swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
+    $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
 
     sudo install -d -o ${STACK_USER} ${SWIFT_CONF_DIR}
     sudo install -d -o ${STACK_USER} ${SWIFT_CONF_DIR}/{object,container,account}-server
@@ -704,7 +703,7 @@ function create_swift_accounts {
 function init_swift {
     local node_number
     # Make sure to kill all swift processes first
-    swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
+    $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
 
     # Forcibly re-create the backing filesystem
     create_swift_disk
@@ -715,9 +714,9 @@ function init_swift {
 
         rm -f *.builder *.ring.gz backups/*.builder backups/*.ring.gz
 
-        swift-ring-builder object.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
-        swift-ring-builder container.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
-        swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
+        $SWIFT_BIN_DIR/swift-ring-builder object.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
+        $SWIFT_BIN_DIR/swift-ring-builder container.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
+        $SWIFT_BIN_DIR/swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
 
         # The ring will be created on each node, and because the order of
         # nodes is identical we can use a seed for rebalancing, making it
@@ -728,26 +727,26 @@ function init_swift {
             node_number=1
 
             for node in ${SWIFT_STORAGE_IPS}; do
-                swift-ring-builder object.builder add z${node_number}-${node}:${OBJECT_PORT_BASE}/sdb1 1
-                swift-ring-builder container.builder add z${node_number}-${node}:${CONTAINER_PORT_BASE}/sdb1 1
-                swift-ring-builder account.builder add z${node_number}-${node}:${ACCOUNT_PORT_BASE}/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder object.builder add z${node_number}-${node}:${OBJECT_PORT_BASE}/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder container.builder add z${node_number}-${node}:${CONTAINER_PORT_BASE}/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder account.builder add z${node_number}-${node}:${ACCOUNT_PORT_BASE}/sdb1 1
                 let "node_number=node_number+1"
             done
 
         else
 
             for node_number in ${SWIFT_REPLICAS_SEQ}; do
-                swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-                swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-                swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
             done
         fi
 
         # We use a seed for rebalancing. Doing this allows us to create
         # identical rings on multiple nodes if SWIFT_STORAGE_IPS is the same
-        swift-ring-builder object.builder rebalance 42
-        swift-ring-builder container.builder rebalance 42
-        swift-ring-builder account.builder rebalance 42
+        $SWIFT_BIN_DIR/swift-ring-builder object.builder rebalance 42
+        $SWIFT_BIN_DIR/swift-ring-builder container.builder rebalance 42
+        $SWIFT_BIN_DIR/swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
 
     # Create cache dir
@@ -803,7 +802,7 @@ function start_swift {
         # Apache should serve the "PACO" a.k.a "main" services
         restart_apache_server
         # The rest of the services should be started in backgroud
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
         return 0
     fi
 
@@ -827,7 +826,7 @@ function start_swift {
         done
 
         if [[ "$SWIFT_START_ALL_SERVICES" == "True" ]]; then
-            swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+            $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
         else
             # The container-sync daemon is strictly needed to pass the container
             # sync Tempest tests.
@@ -835,8 +834,8 @@ function start_swift {
             run_process s-container-sync "$SWIFT_BIN_DIR/swift-container-sync ${SWIFT_CONF_DIR}/container-server/1.conf"
         fi
     else
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run proxy stop || true
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run proxy stop || true
     fi
 
     if is_service_enabled tls-proxy; then
@@ -863,12 +862,12 @@ function stop_swift {
     local type
 
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run rest stop && return 0
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run rest stop && return 0
     fi
 
     # screen normally killed by ``unstack.sh``
-    if type -p swift-init >/dev/null; then
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
+    if type -p $SWIFT_BIN_DIR/swift-init >/dev/null; then
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
     fi
     # Dump all of the servers
     # Maintain the iteration as stop_process() has some desirable side-effects

From 87c0de5240d33cf053815d90ba8e766958f412bb Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 3 Apr 2018 15:16:30 +0000
Subject: [PATCH 2262/3333] Export OS_CACERT after sourcing .stackenv file

This makes sure that it is available to subprocesses like the other
authentication data.

Change-Id: I513b7c2620b171ce20a1ceb5536226f3a69f2b82
Closes-Bug: 1760901
---
 openrc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/openrc b/openrc
index 37724c552e..01ec6c6114 100644
--- a/openrc
+++ b/openrc
@@ -29,6 +29,7 @@ source $RC_DIR/stackrc
 # Load the last env variables if available
 if [[ -r $RC_DIR/.stackenv ]]; then
     source $RC_DIR/.stackenv
+    export OS_CACERT
 fi
 
 # Get some necessary configuration

From 4d7e33757670890ec2c8a862d504c018df744f1c Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 15 Nov 2017 09:45:56 -0600
Subject: [PATCH 2263/3333] Extract a devstack-minimal base job

For folks who are doing functional testing with less than the full set
of normal base services. Should be a no-op/ignorable for most people.

Change-Id: If14ee018c01995e0a5b6bcdaac9ddc8810c6d503
---
 .zuul.yaml | 53 ++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 40 insertions(+), 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b7724816cb..880658b504 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -199,8 +199,47 @@
       - ^.*/locale/.*po$
 
 - job:
-    name: devstack
+    name: devstack-minimal
     parent: devstack-base
+    description: |
+      Minimal devstack base job, intended for use by jobs that need
+      less than the normal minimum set of required-projects.
+    nodeset: openstack-single-node
+    required-projects:
+      - openstack/requirements
+    vars:
+      devstack_localrc:
+        # Multinode specific settings
+        SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+      devstack_services:
+        # Shared services
+        dstat: true
+        etcd3: true
+        mysql: true
+        peakmem_tracker: true
+        rabbit: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Shared services
+          dstat: true
+          peakmem_tracker: true
+        devstack_localrc:
+          # Multinode specific settings
+          HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+          SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+          # Subnode specific settings
+          DATABASE_TYPE: mysql
+          RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          DATABASE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+
+
+- job:
+    name: devstack
+    parent: devstack-minimal
     description: |
       Base devstack job for integration gate.
 
@@ -231,7 +270,6 @@
       - openstack/keystone
       - openstack/neutron
       - openstack/nova
-      - openstack/requirements
       - openstack/swift
     timeout: 7200
     vars:
@@ -245,10 +283,6 @@
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
-        # Multinode specific settings
-        SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-        HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -339,16 +373,9 @@
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
-          # Multinode specific settings
-          HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
-          SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
           # Subnode specific settings
-          DATABASE_TYPE: mysql
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          DATABASE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
 
 - job:
     name: devstack-multinode

From f3f7c079257701efcc3eb50125e09171ad88811e Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Fri, 30 Mar 2018 20:56:04 +0000
Subject: [PATCH 2264/3333] Add documention for setting up LDAP

Devstack supports deploying an LDAP server and configuring keystone
to use it, but we didn't have any documentation for it. This commit
adds some basic documentation that should help developers setup
LDAP-backed development environments.

Change-Id: I8ba07d73f52cb7f575ff2953977e9fdcade92d83
---
 doc/source/guides.rst                    |   6 +
 doc/source/guides/devstack-with-ldap.rst | 174 +++++++++++++++++++++++
 2 files changed, 180 insertions(+)
 create mode 100644 doc/source/guides/devstack-with-ldap.rst

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index c2c7b9163a..82e0dd6ac6 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -20,6 +20,7 @@ Walk through various setups used by stackers
    guides/devstack-with-nested-kvm
    guides/nova
    guides/devstack-with-lbaas-v2
+   guides/devstack-with-ldap
 
 All-In-One Single VM
 --------------------
@@ -66,3 +67,8 @@ Nova and devstack
 --------------------------------
 
 Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
+
+Deploying DevStack with LDAP
+----------------------------
+
+Guide to setting up :doc:`DevStack with LDAP <guides/devstack-with-ldap>`.
diff --git a/doc/source/guides/devstack-with-ldap.rst b/doc/source/guides/devstack-with-ldap.rst
new file mode 100644
index 0000000000..ec411419b5
--- /dev/null
+++ b/doc/source/guides/devstack-with-ldap.rst
@@ -0,0 +1,174 @@
+============================
+Deploying DevStack with LDAP
+============================
+
+The OpenStack Identity service has the ability to integrate with LDAP. The goal
+of this guide is to walk you through setting up an LDAP-backed OpenStack
+development environment.
+
+Introduction
+============
+
+LDAP support in keystone is read-only. You can use it to back an entire
+OpenStack deployment to a single LDAP server, or you can use it to back
+separate LDAP servers to specific keystone domains. Users within those domains
+will can authenticate against keystone, assume role assignments, and interact
+with other OpenStack services.
+
+Configuration
+=============
+
+To deploy an OpenLDAP server, make sure ``ldap`` is added to the list of
+``ENABLED_SERVICES``::
+
+    enable_service ldap
+
+Devstack will require a password to set up an LDAP administrator. This
+administrative user is also the bind user specified in keystone's configuration
+files, similar to a ``keystone`` user for MySQL databases.
+
+Devstack will prompt you for a password when running ``stack.sh`` if
+``LDAP_PASSWORD`` is not set. You can add the following to your
+``local.conf``::
+
+    LDAP_PASSWORD=super_secret_password
+
+At this point, devstack should have everything it needs to deploy OpenLDAP,
+bootstrap it with a minimal set of users, and configure it to back to a domain
+in keystone::
+
+    ./stack.sh
+
+Once ``stack.sh`` completes, you should have a running keystone deployment with
+a basic set of users. It is important to note that not all users will live
+within LDAP. Instead, keystone will back different domains to different
+identity sources. For example, the ``default`` domain will be backed by MySQL.
+This is usually where you'll find your administrative and services users. If
+you query keystone for a list of domains, you should see a domain called
+``Users``. This domain is set up by devstack and points to OpenLDAP.
+
+User Management
+===============
+
+Initially, there will only be two users in the LDAP server. The ``Manager``
+user is used by keystone to talk to OpenLDAP. The ``demo`` user is a generic
+user that you should be able to see if you query keystone for users within the
+``Users`` domain. Both of these users were added to LDAP using basic LDAP
+utilities installed by devstack (e.g. ``ldap-utils``) and LDIFs. The LDIFs used
+to create these users can be found in ``devstack/files/ldap/``.
+
+Listing Users
+-------------
+
+To list all users in LDAP directly, you can use ``ldapsearch`` with the LDAP
+user bootstrapped by devstack::
+
+    ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost -b dc=openstack,dc=org
+
+As you can see, devstack creates an OpenStack domain called ``openstack.org``
+as a container for the ``Manager`` and ``demo`` users.
+
+Creating Users
+--------------
+
+Since keystone's LDAP integration is read-only, users must be added directly to
+LDAP. Users added directly to OpenLDAP will automatically be placed into the
+``Users`` domain.
+
+LDIFs can be used to add users via the command line. The following is an
+example LDIF that can be used to create a new LDAP user, let's call it
+``peter.ldif.in``::
+
+    dn: cn=peter,ou=Users,dc=openstack,dc=org
+    cn: peter
+    displayName: Peter Quill
+    givenName: Peter Quill
+    mail: starlord@openstack.org
+    objectClass: inetOrgPerson
+    objectClass: top
+    sn: peter
+    uid: peter
+    userPassword: im-a-better-pilot-than-rocket
+
+Now, we use the ``Manager`` user to create a user for Peter in LDAP::
+
+    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost -c -f peter.ldif.in
+
+We should be able to assign Peter roles on projects. After Peter has some level
+of authorization, he should be able to login to Horizon by specifying the
+``Users`` domain and using his ``peter`` username and password. Authorization
+can be given to Peter by creating a project within the ``Users`` domain and
+giving him a role assignment on that project::
+
+    $ openstack project create --domain Users awesome-mix-vol-1
+    +-------------+----------------------------------+
+    | Field       | Value                            |
+    +-------------+----------------------------------+
+    | description |                                  |
+    | domain_id   | 61a2de23107c46bea2d758167af707b9 |
+    | enabled     | True                             |
+    | id          | 7d422396d54945cdac8fe1e8e32baec4 |
+    | is_domain   | False                            |
+    | name        | awesome-mix-vol-1                |
+    | parent_id   | 61a2de23107c46bea2d758167af707b9 |
+    | tags        | []                               |
+    +-------------+----------------------------------+
+    $ openstack role add --user peter --user-domain Users \
+          --project awesome-mix-vol-1 --project-domain Users admin
+
+
+Deleting Users
+--------------
+
+We can use the same basic steps to remove users from LDAP, but instead of using
+LDIFs, we can just pass the ``dn`` of the user we want to delete::
+
+    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost cn=peter,ou=Users,dc=openstack,dc=org
+
+Group Management
+================
+
+Like users, groups are considered specific identities. This means that groups
+also fall under the same read-only constraints as users and they can be managed
+directly with LDAP in the same way users are with LDIFs.
+
+Adding Groups
+-------------
+
+Let's define a specific group with the following LDIF::
+
+    dn: cn=guardians,ou=UserGroups,dc=openstack,dc=org
+    objectClass: groupOfNames
+    cn: guardians
+    description: Guardians of the Galaxy
+    member: cn=peter,dc=openstack,dc=org
+    member: cn=gamora,dc=openstack,dc=org
+    member: cn=drax,dc=openstack,dc=org
+    member: cn=rocket,dc=openstack,dc=org
+    member: cn=groot,dc=openstack,dc=org
+
+We can create the group using the same ``ldapadd`` command as we did with
+users::
+
+    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost -c -f guardian-group.ldif.in
+
+If we check the group membership in Horizon, we'll see that only Peter is a
+member of the ``guardians`` group, despite the whole crew being specified in
+the LDIF. Once those accounts are created in LDAP, they will automatically be
+added to the ``guardians`` group. They will also assume any role assignments
+given to the ``guardians`` group.
+
+Deleting Groups
+---------------
+
+Just like users, groups can be deleted using the ``dn``::
+
+    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost cn=guardians,ou=UserGroups,dc=openstack,dc=org
+
+Note that this operation will not remove users within that group. It will only
+remove the group itself and the memberships any users had with that group.

From 295610c89edc60faba1f5d8d80f40ab00b73a39c Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 20 Mar 2018 10:54:39 -0400
Subject: [PATCH 2265/3333] Remove [placement]/os_region_name usage

The [placement]/os_region_name config option is deprecated
and no longer required to be set (the default is fine for
devstack) with the dependent nova change.

Depends-On: I973180d6a384b32838ab61d4e6aaf73c255fd116

Change-Id: I6379acf179ed511f1cdadbd7fb09e2454182a5d3
---
 lib/placement | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/placement b/lib/placement
index 1d68f8a185..2343ac9f2a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -112,7 +112,6 @@ function configure_placement_nova_compute {
     iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf placement project_name "$SERVICE_TENANT_NAME"
     iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the
     # placement api uses the auth_strategy configuration setting

From c77c9497a5ef79dab74e23a21783044241fe1670 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Thu, 5 Apr 2018 20:56:22 +0200
Subject: [PATCH 2266/3333] Fix indentation in devstack-with-lbaas-v2

guides/devstack-with-lbaas-v2 contained an indentation misstake,
that formatted some of the text unintentionally as quotations.

Change-Id: Ibbad4974c45f028d3de461ba69e0cea837d9c871
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 7dee520a23..df3c7ce2ac 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -15,7 +15,7 @@ make sure it is updated. Install git and any other developer tools you find usef
 
 Install devstack
 
-  ::
+::
 
     git clone https://git.openstack.org/openstack-dev/devstack
     cd devstack
@@ -23,7 +23,7 @@ Install devstack
 
 Edit your ``local.conf`` to look like
 
-  ::
+::
 
     [[local|localrc]]
     # Load the external LBaaS plugin.
@@ -60,7 +60,7 @@ Edit your ``local.conf`` to look like
 
 Run stack.sh and do some sanity checks
 
-  ::
+::
 
     ./stack.sh
     . ./openrc
@@ -69,7 +69,7 @@ Run stack.sh and do some sanity checks
 
 Create two nova instances that we can use as test http servers:
 
-  ::
+::
 
     #create nova instances on private network
     nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
@@ -83,7 +83,7 @@ Create two nova instances that we can use as test http servers:
 
 Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
 
- ::
+::
 
     MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
     while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
@@ -91,7 +91,7 @@ Set up a simple web server on each of these instances. ssh into each instance (u
 Phase 2: Create your load balancers
 ------------------------------------
 
- ::
+::
 
     neutron lbaas-loadbalancer-create --name lb1 private-subnet
     neutron lbaas-loadbalancer-show lb1  # Wait for the provisioning_status to be ACTIVE.

From 931f82dc291dae10b9a484f25e044aed788311e1 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen@gazlene.net>
Date: Sun, 18 Feb 2018 14:11:10 +0100
Subject: [PATCH 2267/3333] Enable tempest tests for application credentials

In Queens and later, the application credentials feature is available on
keystone and enabled by default. It should be tested in devstack.

Depends-on: https://review.openstack.org/545627
Change-Id: I4b0dc823487e79df16e1e603012ba4a7dc438389
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 0605ffb082..9de9b91870 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -303,6 +303,10 @@ function configure_tempest {
     # as this is supported in Queens and beyond.
     iniset $TEMPEST_CONFIG identity-feature-enabled project_tags True
 
+    # In Queens and later, application credentials are enabled by default
+    # so remove this once Tempest no longer supports Pike.
+    iniset $TEMPEST_CONFIG identity-feature-enabled application_credentials True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 486057f3391ce3a262f8226f7652ed14b3b444f3 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 21 Mar 2018 13:59:18 +0100
Subject: [PATCH 2268/3333] Start OVS as root on Tumblweed to workaround
 bsc#1085971

There is currently a OVS 2.9.0 update in Tumbleweed that
fails to start as it is having a race with systemd on creating
the home directory. Workaround is to run it as root for now.

Change-Id: Ief610c6473834b02a1d644d8f50d11138a48e6e6
---
 lib/neutron_plugins/ovs_base | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 50b9ae506b..36e2ed2ca2 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -72,7 +72,14 @@ function _neutron_ovs_base_install_agent_packages {
         if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
             restart_service openvswitch-switch
         else
-            restart_service openvswitch
+            # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
+            if [[ $DISTRO =~ "tumbleweed" ]]; then
+                sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
+            fi
+            restart_service openvswitch || {
+                journalctl -xe || :
+                systemctl status openvswitch
+            }
         fi
     fi
 }

From c114449bdb6fc8c4ede2b7845aa2ba049bdc332f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 11 Apr 2018 21:33:50 +0200
Subject: [PATCH 2269/3333] Switch to mkisofs for openSUSE distributions

In Tumbleweed genisoimage was dropped in favor of cdrtools,
so installing that no longer works. We can however install
mkisofs directly and switch to that as that is also available
in Leap 42.3 and Leap 15.0+ family distros.

Also drop dependency on libmysqlclient-devel which appears
unnecessary (and is no longer available with mariadb 10.2+)

Change-Id: Ie8402204b6cdf94c21865caba116d3fd1298c5ad
---
 files/rpms-suse/general | 1 -
 files/rpms-suse/n-cpu   | 2 +-
 files/rpms-suse/nova    | 2 +-
 lib/nova                | 6 ++++++
 4 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0b69cb1c01..b870d72149 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -11,7 +11,6 @@ graphviz # docs
 iputils
 libffi-devel  # pyOpenSSL
 libjpeg8-devel # Pillow 3.0.0
-libmysqlclient-devel # MySQL-python
 libopenssl-devel # to rebuild pyOpenSSL if needed
 libxslt-devel  # lxml
 lsof # useful when debugging
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index 9ece11534d..d0c572e97d 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,7 +1,7 @@
 cryptsetup
-genisoimage
 libosinfo
 lvm2
+mkisofs
 open-iscsi
 sg3_utils
 # Stuff for diablo volumes
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index ae115d2138..4103a407d2 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -4,7 +4,6 @@ dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
 gawk
-genisoimage # required for config_drive
 iptables
 iputils
 kpartx
@@ -12,6 +11,7 @@ kvm # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
 mariadb # NOPRIME
+mkisofs # required for config_drive
 parted
 polkit
 # qemu as fallback if kvm cannot be used
diff --git a/lib/nova b/lib/nova
index 2eef8c411f..939806ff95 100644
--- a/lib/nova
+++ b/lib/nova
@@ -506,6 +506,12 @@ function create_nova_conf {
     if [ "$FORCE_CONFIG_DRIVE" != "False" ]; then
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
+
+    # nova defaults to genisoimage but only mkisofs is available for 15.0+
+    if is_suse; then
+        iniset $NOVA_CONF DEFAULT mkisofs_cmd /usr/bin/mkisofs
+    fi
+
     # Format logging
     setup_logging $NOVA_CONF
 

From dc5d88bc0b2233ee8490d31ce67d6a8f6e503b23 Mon Sep 17 00:00:00 2001
From: Daniel Mellado <dmellado@redhat.com>
Date: Thu, 12 Apr 2018 11:41:59 -0400
Subject: [PATCH 2270/3333] Apply contraints to tempest plugins

This commit applies the constraints for the tempest plugin installation
so they won't go over the upper reqs.

Closes-Bug: 1763436
Change-Id: I5cf91157bbdae79dec01d5b3db32efea21f1b2b7
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 0605ffb082..2321cd5a56 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -646,7 +646,7 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
+        tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi

From f99d1771ba1882dfbb69186212a197edae3ef02c Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin034@gmail.com>
Date: Sat, 14 Apr 2018 19:33:15 +0000
Subject: [PATCH 2271/3333] Do not use pip 10 or higher

It looks pip 10 failed the uninstallation of distutils installed
packages. This patch temporarily cap the version of pip to work-around.

Closes-Bug: #1763966
Change-Id: I8bf80efc04883cd754c19bea0303064080112c6e
---
 tools/cap-pip.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
index c280267641..f5278d7c86 100644
--- a/tools/cap-pip.txt
+++ b/tools/cap-pip.txt
@@ -1 +1 @@
-pip!=8
+pip!=8,<10

From e1edde38edb697f56e111f55e5992e7bf22f6284 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Fri, 2 Mar 2018 15:05:14 +0000
Subject: [PATCH 2272/3333] Automatically set LIBS_FROM_GIT based on required
 projects

If a project shows up in zuul's required-projects list, add it
to LIBS_FROM_GIT automatically.  This way, when a user specifies
that a job requires a zuul-project, it gets used in testing, but
otherwise, it doesn't (pypi is used instead).

Also add information about what happens behind the scenes for both
LIBS_FROM_GIT and plugin dependencies.

This moves the check performed in check_libs_from_git to
a helper function which is installed for most kinds of
installations.  This means that if someone sets LIBS_FROM_GIT to
"foobar", devstack won't error anymore, as nothing is going to
try to install foobar, therefore the check won't run on that.
However, as we move to automated generation of the local config,
that error is not likely to happen.  This check was originally
added due to an error in the upper-constraints file (where a
constraint name did not match a package name).  This location of
the check would still catch that type of error.

Change-Id: Ifcf3ad008cf42d3d4762cfb3b6c31c93cfeb40db
---
 inc/python                                    | 23 ++----
 roles/write-devstack-local-conf/README.rst    | 12 +++
 .../library/devstack_local_conf.py            | 29 ++++++--
 .../write-devstack-local-conf/library/test.py | 74 +++++++++++++++++--
 .../write-devstack-local-conf/tasks/main.yaml |  1 +
 stack.sh                                      |  5 --
 6 files changed, 110 insertions(+), 34 deletions(-)

diff --git a/inc/python b/inc/python
index e074ea498f..37b4617777 100644
--- a/inc/python
+++ b/inc/python
@@ -435,22 +435,6 @@ function lib_installed_from_git {
     [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$safe_name/ {print \$3}") ]]
 }
 
-# check that everything that's in LIBS_FROM_GIT was actually installed
-# correctly, this helps double check issues with library fat fingering.
-function check_libs_from_git {
-    local lib=""
-    local not_installed=""
-    for lib in $(echo ${LIBS_FROM_GIT} | tr "," " "); do
-        if ! lib_installed_from_git "$lib"; then
-            not_installed+=" $lib"
-        fi
-    done
-    # if anything is not installed, say what it is.
-    if [[ -n "$not_installed" ]]; then
-        die $LINENO "The following LIBS_FROM_GIT were not installed correct: $not_installed"
-    fi
-}
-
 # setup a library by name. If we are trying to use the library from
 # git, we'll do a git based install, otherwise we'll punt and the
 # library should be installed by a requirements pull from another
@@ -561,6 +545,13 @@ function _setup_package_with_constraints_edit {
 
     setup_package $project_dir "$flags" $extras
 
+    # If this project is in LIBS_FROM_GIT, verify it was actually installed
+    # correctly.  This helps catch errors caused by constraints mismatches.
+    if use_library_from_git "$project_dir"; then
+        if ! lib_installed_from_git "$project_dir"; then
+            die $LINENO "The following LIBS_FROM_GIT was not installed correctly: $project_dir"
+        fi
+    fi
 }
 
 # ``pip install -e`` the package, which processes the dependencies
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index 73f9f0d6fd..bfce9c98cd 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -20,6 +20,14 @@ Write the local.conf file for use by devstack
    bash shell variables, and will be ordered so that variables used by
    later entries appear first.
 
+   As a special case, the variable ``LIBS_FROM_GIT`` will be
+   constructed automatically from the projects which appear in the
+   ``required-projects`` list defined by the job.  To instruct
+   devstack to install a library from source rather than pypi, simply
+   add that library to the job's ``required-projects`` list.  To
+   override the automatically-generated value, set ``LIBS_FROM_GIT``
+   in ``devstack_localrc`` to the desired value.
+
 .. zuul:rolevar:: devstack_local_conf
    :type: dict
 
@@ -75,3 +83,7 @@ Write the local.conf file for use by devstack
    A dictionary mapping a plugin name to a git repo location.  If the
    location is a non-empty string, then an ``enable_plugin`` line will
    be emmitted for the plugin name.
+
+   If a plugin declares a dependency on another plugin (via
+   ``plugin_requires`` in the plugin's settings file), this role will
+   automatically emit ``enable_plugin`` lines in the correct order.
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 746f54f921..9728fef37b 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -207,17 +207,17 @@ def getPlugins(self):
 class LocalConf(object):
 
     def __init__(self, localrc, localconf, base_services, services, plugins,
-                 base_dir):
+                 base_dir, projects):
         self.localrc = []
         self.meta_sections = {}
         self.plugin_deps = {}
         self.base_dir = base_dir
+        self.projects = projects
         if plugins:
             self.handle_plugins(plugins)
         if services or base_services:
             self.handle_services(base_services, services or {})
-        if localrc:
-            self.handle_localrc(localrc)
+        self.handle_localrc(localrc)
         if localconf:
             self.handle_localconf(localconf)
 
@@ -241,9 +241,22 @@ def handle_services(self, base_services, services):
                 self.localrc.append('enable_service {}'.format(k))
 
     def handle_localrc(self, localrc):
-        vg = VarGraph(localrc)
-        for k, v in vg.getVars():
-            self.localrc.append('{}={}'.format(k, v))
+        lfg = False
+        if localrc:
+            vg = VarGraph(localrc)
+            for k, v in vg.getVars():
+                self.localrc.append('{}={}'.format(k, v))
+                if k == 'LIBS_FROM_GIT':
+                    lfg = True
+
+        if not lfg and self.projects:
+            required_projects = []
+            for project_name, project_info in self.projects.items():
+                if project_info.get('required'):
+                    required_projects.append(project_info['short_name'])
+            if required_projects:
+                self.localrc.append('LIBS_FROM_GIT={}'.format(
+                    ','.join(required_projects)))
 
     def handle_localconf(self, localconf):
         for phase, phase_data in localconf.items():
@@ -277,6 +290,7 @@ def main():
             local_conf=dict(type='dict'),
             base_dir=dict(type='path'),
             path=dict(type='str'),
+            projects=dict(type='dict'),
         )
     )
 
@@ -286,7 +300,8 @@ def main():
                    p.get('base_services'),
                    p.get('services'),
                    p.get('plugins'),
-                   p.get('base_dir'))
+                   p.get('base_dir'),
+                   p.get('projects'))
     lc.write(p['path'])
 
     module.exit_json()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 843ca6e9fd..7ccb68f08d 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -56,7 +56,8 @@ def test_plugins(self):
                        p.get('base_services'),
                        p.get('services'),
                        p.get('plugins'),
-                       p.get('base_dir'))
+                       p.get('base_dir'),
+                       p.get('projects'))
         lc.write(p['path'])
 
         plugins = []
@@ -66,6 +67,7 @@ def test_plugins(self):
                     plugins.append(line.split()[1])
         self.assertEqual(['bar', 'baz', 'foo'], plugins)
 
+
     def test_plugin_deps(self):
         "Test that plugins with dependencies work"
         os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))
@@ -101,20 +103,80 @@ def test_plugin_deps(self):
                  plugins=plugins,
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
+
+    def test_libs_from_git(self):
+        "Test that LIBS_FROM_GIT is auto-generated"
+        projects = {
+            'git.openstack.org/openstack/nova': {
+                'required': True,
+                'short_name': 'nova',
+            },
+            'git.openstack.org/openstack/oslo.messaging': {
+                'required': True,
+                'short_name': 'oslo.messaging',
+            },
+            'git.openstack.org/openstack/devstack-plugin': {
+                'required': False,
+                'short_name': 'devstack-plugin',
+            },
+        }
+        p = dict(base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 projects=projects)
         lc = LocalConf(p.get('localrc'),
                        p.get('local_conf'),
                        p.get('base_services'),
                        p.get('services'),
                        p.get('plugins'),
-                       p.get('base_dir'))
+                       p.get('base_dir'),
+                       p.get('projects'))
         lc.write(p['path'])
 
-        plugins = []
+        lfg = None
         with open(p['path']) as f:
             for line in f:
-                if line.startswith('enable_plugin'):
-                    plugins.append(line.split()[1])
-        self.assertEqual(['foo', 'bar'], plugins)
+                if line.startswith('LIBS_FROM_GIT'):
+                    lfg = line.strip().split('=')[1]
+        self.assertEqual('nova,oslo.messaging', lfg)
+
+    def test_overridelibs_from_git(self):
+        "Test that LIBS_FROM_GIT can be overridden"
+        localrc = {'LIBS_FROM_GIT': 'oslo.db'}
+        projects = {
+            'git.openstack.org/openstack/nova': {
+                'required': True,
+                'short_name': 'nova',
+            },
+            'git.openstack.org/openstack/oslo.messaging': {
+                'required': True,
+                'short_name': 'oslo.messaging',
+            },
+            'git.openstack.org/openstack/devstack-plugin': {
+                'required': False,
+                'short_name': 'devstack-plugin',
+            },
+        }
+        p = dict(localrc=localrc,
+                 base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 projects=projects)
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'),
+                       p.get('projects'))
+        lc.write(p['path'])
+
+        lfg = None
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('LIBS_FROM_GIT'):
+                    lfg = line.strip().split('=')[1]
+        self.assertEqual('oslo.db', lfg)
 
     def test_plugin_circular_deps(self):
         "Test that plugins with circular dependencies fail"
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index 2a9f8985fc..a294cae608 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -9,3 +9,4 @@
     localrc: "{{ devstack_localrc|default(omit) }}"
     local_conf: "{{ devstack_local_conf|default(omit) }}"
     base_dir: "{{ devstack_base_dir|default(omit) }}"
+    projects: "{{ zuul.projects }}"
diff --git a/stack.sh b/stack.sh
index 9b496c0e20..5643b4db1b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1402,11 +1402,6 @@ fi
 # Check the status of running services
 service_check
 
-# ensure that all the libraries we think we installed from git,
-# actually were.
-check_libs_from_git
-
-
 # Configure nova cellsv2
 # ----------------------
 

From fe628b9fb2e9511e78a7dc6883fa1d4766413a54 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Tue, 17 Apr 2018 17:01:46 +0000
Subject: [PATCH 2273/3333] Remove the sample configuration file for keystone

This commit just makes sure that the configuration file for keystone
exists on the system. We use iniset to actually populate the values
we want before we run keystone anyway.

This results in a cleaner configuration file that isn't bloated with
comments and help text.

Change-Id: I7a1f879e9e242a11e2c4663ec116e33da28db7f5
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 714f089cca..696e351ab0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -202,7 +202,7 @@ function configure_keystone {
     sudo install -d -o $STACK_USER $KEYSTONE_CONF_DIR
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
-        install -m 600 $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
+        install -m 600 /dev/null $KEYSTONE_CONF
         if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
             cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
         fi
@@ -220,7 +220,7 @@ function configure_keystone {
         inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
     fi
 
-    # Rewrite stock ``keystone.conf``
+    # Populate ``keystone.conf``
     if is_service_enabled ldap; then
         iniset $KEYSTONE_CONF identity domain_config_dir "$KEYSTONE_CONF_DIR/domains"
         iniset $KEYSTONE_CONF identity domain_specific_drivers_enabled "True"

From afe141401997db054cd9987ca17d989415c65ad4 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 20 Apr 2018 13:36:22 +0100
Subject: [PATCH 2274/3333] Ensure passwordless ssh with stack between nodes

For compute migration to work, the stack user needs to be configured
with passwordless ssh between all hosts involved in the migration.

Reuse the build ssh-key for this, which is already distributed for
user root.

Depends-on: https://review.openstack.org/563584

Change-Id: Id07f55fea06509466add35315c135dbfba6aa714
---
 roles/orchestrate-devstack/tasks/main.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index 12db58c520..f747943f3c 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -6,6 +6,12 @@
 - name: Setup devstack on sub-nodes
   block:
 
+  - name: Distribute the build sshkey for the user "stack"
+    include_role:
+      name: copy-build-sshkey
+    vars:
+      copy_sshkey_target_user: 'stack'
+
   - name: Sync CA data to subnodes (when any)
     # Only do this if the tls-proxy service is defined and enabled
     include_role:

From 05da9a9b1e86babe829c1c2349fa7e9838095ee8 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 25 Apr 2018 13:52:44 +0100
Subject: [PATCH 2275/3333] Enable nova VNC configuration on the subnode

The n-novnc service only runs on the controller node, however novnc
settings must be enabled on both nodes for vnc to work, since both
hosts are compute hosts.

Change-Id: Icc29441f507e6e4df9fd900eb7f35b0862f52043
---
 .zuul.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a979fa4fbb..609f0feea4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -277,7 +277,7 @@
         DEBUG_LIBVIRT_COREDUMPS: True
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
-        VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+        VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -371,6 +371,9 @@
           # Subnode specific settings
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          NOVA_VNC_ENABLED: true
+          VNCSERVER_LISTEN: 0.0.0.0
+          VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
 
 - job:
     name: devstack-multinode

From e8bad5cd6a65821c54d66bbc5f7ba17091439d34 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Wed, 25 Apr 2018 13:01:03 +0100
Subject: [PATCH 2276/3333] Init placement before nova

With change I7e1e89cd66397883453935dcf7172d977bf82e84 the placement
service may optionally use its own database. In order for this to
work, however, the ordering of how both nova and placement are
configured and initialized in stack.sh requires careful control.

* nova.conf must be created first
* then placement must make some adjustments to it
* then lib/placement needs to create the placement database
* before nova does a database sync (of both databases)

Otherwise, when the placement_database/connection is defined, the nova
db_sync command will fail because the placement database does not yet
exist. If we try to do a sync before the nova_api database is created
_that_ sync will fail.

This patch adjusts the ordering and also removes a comment that will
no longer be true when I7e1e89cd66397883453935dcf7172d977bf82e84 is
merged.

Change-Id: Id5b5911c04d198fe7b94c7d827afeb5cdf43a076
---
 lib/placement |  8 +++-----
 stack.sh      | 14 +++++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/placement b/lib/placement
index 1d68f8a185..d70596734c 100644
--- a/lib/placement
+++ b/lib/placement
@@ -44,8 +44,6 @@ PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 # The placement service can optionally use a separate database
 # connection. Set PLACEMENT_DB_ENABLED to True to use it.
-# NOTE(cdent): This functionality depends on some code that is not
-# yet merged in nova but is coming soon.
 PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
 
 if is_service_enabled tls-proxy; then
@@ -152,9 +150,9 @@ function create_placement_accounts {
 function init_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         recreate_database placement
-        time_start "dbsync"
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
-        time_stop "dbsync"
+        # Database migration will be handled when nova does an api_db sync
+        # TODO(cdent): When placement is extracted we'll do our own sync
+        # here.
     fi
     create_placement_accounts
 }
diff --git a/stack.sh b/stack.sh
index 6899fa0d8b..30f24b6a3f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -894,6 +894,8 @@ if is_service_enabled neutron; then
     stack_install_service neutron
 fi
 
+# Nova configuration is used by placement so we need to create nova.conf
+# first.
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
@@ -1184,6 +1186,13 @@ if is_service_enabled cinder; then
     init_cinder
 fi
 
+# Placement Service
+# ---------------
+
+if is_service_enabled placement; then
+    echo_summary "Configuring placement"
+    init_placement
+fi
 
 # Compute Service
 # ---------------
@@ -1202,11 +1211,6 @@ if is_service_enabled nova; then
     init_nova_cells
 fi
 
-if is_service_enabled placement; then
-    echo_summary "Configuring placement"
-    init_placement
-fi
-
 
 # Extras Configuration
 # ====================

From ed2d491960138f92e819b6f6ed9dd5eb99d4a54f Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 18 Jul 2017 22:29:41 +0000
Subject: [PATCH 2277/3333] Run console proxies per cell instead of globally

Along with converting to the database backend for console token auth,
the console proxies need to run per cell instead of globally. This way,
the instance UUID isn't needed in the access url as users will be
handed an access url local to the cell their instances is in. With
console proxies sharded across cells, a large cloud will no longer have
a bottleneck of one console proxy for the entire deployment.

This also disables the novnc tempest tests with a TODO to re-enable
them once the nova patch series that converts from the nova-consoleauth
backend -> cell database backend lands.

Change-Id: I67894a31b887a93de26f3d2d8a1fa84be5b9ea89
---
 lib/nova    | 62 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 lib/tempest |  9 +++++++-
 2 files changed, 65 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index fea2b8509a..3a00ab376c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -921,11 +921,46 @@ function start_nova_rest {
         run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
-    run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
-    run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
-    run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
+    # nova-consoleauth always runs globally
     run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
-    run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
+
+    export PATH=$old_path
+}
+
+function enable_nova_console_proxies {
+    for i in $(seq 1 $NOVA_NUM_CELLS); do
+        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+            if is_service_enabled $srv; then
+                enable_service ${srv}-cell${i}
+            fi
+        done
+    done
+}
+
+function start_nova_console_proxies {
+    # Hack to set the path for rootwrap
+    local old_path=$PATH
+    # This is needed to find the nova conf
+    export PATH=$NOVA_BIN_DIR:$PATH
+
+    local api_cell_conf=$NOVA_CONF
+    # console proxies run globally for singleconductor, else they run per cell
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
+        run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
+        run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
+        run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
+    else
+        enable_nova_console_proxies
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            conf=$(conductor_conf $i)
+            run_process n-novnc-cell${i} "$NOVA_BIN_DIR/nova-novncproxy --config-file $conf --web $NOVNC_WEB_DIR"
+            run_process n-xvnc-cell${i} "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $conf"
+            run_process n-spice-cell${i} "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $conf --web $SPICE_WEB_DIR"
+            run_process n-sproxy-cell${i} "$NOVA_BIN_DIR/nova-serialproxy --config-file $conf"
+        done
+    fi
 
     export PATH=$old_path
 }
@@ -985,6 +1020,7 @@ function start_nova {
     # this catches the cells v1 case early
     _set_singleconductor
     start_nova_rest
+    start_nova_console_proxies
     start_nova_conductor
     start_nova_compute
     if is_service_enabled n-api; then
@@ -1010,11 +1046,26 @@ function stop_nova_compute {
 
 function stop_nova_rest {
     # Kill the non-compute nova processes
-    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-sproxy; do
+    for serv in n-api n-api-meta n-net n-sch n-cauth n-cell n-cell; do
         stop_process $serv
     done
 }
 
+function stop_nova_console_proxies {
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+            stop_process $srv
+        done
+    else
+        enable_nova_console_proxies
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            for srv in n-novnc n-xvnc n-spice n-sproxy; do
+                stop_process ${srv}-cell${i}
+            done
+        done
+    fi
+}
+
 function stop_nova_conductor {
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         stop_process n-cond
@@ -1032,6 +1083,7 @@ function stop_nova_conductor {
 # stop_nova() - Stop running processes
 function stop_nova {
     stop_nova_rest
+    stop_nova_console_proxies
     stop_nova_conductor
     stop_nova_compute
 }
diff --git a/lib/tempest b/lib/tempest
index 3b39dae422..d22bb95e14 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -386,7 +386,14 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    if is_service_enabled n-novnc; then
+    # TODO(melwitt): If we're running per-cell console proxies, the novnc tests
+    # won't work until the nova patch series lands that converts from the
+    # nova-consoleauth backend -> cell database backend. So disable them unless
+    # we're running Cells v1. Cells v1 will never support the cell database
+    # backend, so it will always run with a global nova-consoleauth.
+    # Once the patch that converts from the nova-consoleauth backend -> cell
+    # database backend lands, we can re-enable the novnc tests for Cells v2.
+    if is_service_enabled n-novnc && is_service_enabled n-cell; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
 

From 6645cf7a26428f3af1e4739ac29c6a90b67f99dc Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 13 Dec 2017 23:59:09 +0000
Subject: [PATCH 2278/3333] Re-enable novnc tempest tests

Once the nova patch series that converts from the nova-consoleauth
backend -> cell database backend lands, we can re-enable the novnc
tests in tempest.

Depends-On: If1b6e5f20d2ea82d94f5f0550f13189fc9bc16c4

Change-Id: I2939191a1c3ce49fa2104b4ffdf795fc416a1c33
---
 lib/tempest | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d22bb95e14..3b39dae422 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -386,14 +386,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    # TODO(melwitt): If we're running per-cell console proxies, the novnc tests
-    # won't work until the nova patch series lands that converts from the
-    # nova-consoleauth backend -> cell database backend. So disable them unless
-    # we're running Cells v1. Cells v1 will never support the cell database
-    # backend, so it will always run with a global nova-consoleauth.
-    # Once the patch that converts from the nova-consoleauth backend -> cell
-    # database backend lands, we can re-enable the novnc tests for Cells v2.
-    if is_service_enabled n-novnc && is_service_enabled n-cell; then
+    if is_service_enabled n-novnc; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
 

From 69057d46556db95267a4bc4156dadc88b5064ab9 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 1 May 2018 05:57:21 -0500
Subject: [PATCH 2279/3333] Register versioned endpoint for block-storage
 service

cinder does not yet support operations without project_id in the url.
The unversioned endpoint is not a usable endpoint for a user that
requests the block-storage service. Although it would be lovely to have
the block-storage service have the unversioned endpoint in the catalog,
we need to get project-id out of the urls first.

Change-Id: I4246708b6ea31496ba4d565ab422abc76f730ee7
Needed-By: https://review.openstack.org/564494
---
 lib/cinder | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 3a8097f894..f6cad9d9f2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -349,7 +349,7 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
             get_or_create_endpoint \
                 "volume" \
@@ -371,7 +371,7 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
 
             get_or_create_endpoint \
                 "volume" \

From 7e36ded0cff9d753c1bfa4ae05d5c97ccf0dd957 Mon Sep 17 00:00:00 2001
From: Artom Lifshitz <alifshit@redhat.com>
Date: Wed, 2 May 2018 10:38:57 -0400
Subject: [PATCH 2280/3333] docs: Add placement-client to compute's
 ENABLED_SERVICES

In a multinode setup, the compute node needs to report to the
placement service. If it does not do so, it effectively does not exist
from the scheduler's point of view. This patch adds placement-client
to the compute node's ENABLED_SERVICES so that this can happen.

Change-Id: Ibfcd84e4626301bcdea70f719ade7f8365d03497
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 1b8dccd7f3..7f360c63cc 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -244,7 +244,7 @@ The host `devstack-2` has a very minimal `local.conf`.
 
     ## Neutron options
     PUBLIC_INTERFACE=eth0
-    ENABLED_SERVICES=n-cpu,rabbit,q-agt
+    ENABLED_SERVICES=n-cpu,rabbit,q-agt,placement-client
 
 Network traffic from `eth0` on the compute nodes is then NAT'd by the
 controller node that runs Neutron's `neutron-l3-agent` and provides L3

From 59e6ff10ce65509beefb3fdee7aa0c8ca966a8a9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 2 May 2018 11:45:09 -0400
Subject: [PATCH 2281/3333] Remove IRONIC_USE_RESOURCE_CLASSES check

Nova has dropped support for non-resource class
baremetal scheduling, so the IRONIC_USE_RESOURCE_CLASSES
flag is no longer useful and has been removed.

Depends-On: https://review.openstack.org/565805/
Change-Id: Ib2e6c96409c98877f6a43b76f176c1420d2d415e
---
 lib/nova_plugins/hypervisor-ironic | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c91f70b9bb..49110a8643 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -42,14 +42,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 
-    if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
-        iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
-        iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
-        iniset $NOVA_CONF filter_scheduler host_subset_size 999
-        iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
-        iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
-    fi
-
     # ironic section
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin

From bed03ea77a93ad09ce8f06a467d5de02ef48e603 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Tue, 1 May 2018 21:36:37 -0400
Subject: [PATCH 2282/3333] Switch to fedora-latest for nodeset name

To help avoid the amount zuul.yaml chrun when we bring a new version
of fedora online, switch to using fedora-latest. As of writing,
fedora-28 is the latest release which we update our testing for.

Also add fedora-28 support to stash.sh and remove fedora-25 /
fedora-26 as they are EOL.

Change-Id: I3d716554e8f270f4434cc9cac3408f8e890e0665
Depends-On: https://review.openstack.org/565758/
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 .zuul.yaml | 18 ++++++++++++++----
 stack.sh   |  2 +-
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a979fa4fbb..87eb8c5c8d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,6 +48,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-fedora-latest
+    nodes:
+      - name: controller
+        label: fedora-28
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -406,10 +416,10 @@
     voting: false
 
 - job:
-    name: devstack-platform-fedora-27
+    name: devstack-platform-fedora-latest
     parent: tempest-full
-    description: Fedora 27 platform test
-    nodeset: devstack-single-node-fedora-27
+    description: Fedora latest platform test
+    nodeset: devstack-single-node-fedora-latest
     voting: false
 
 - job:
@@ -482,7 +492,7 @@
         - devstack-platform-centos-7
         - devstack-platform-opensuse-423
         - devstack-platform-opensuse-tumbleweed
-        - devstack-platform-fedora-27
+        - devstack-platform-fedora-latest
         - devstack-multinode
         - devstack-unit-tests
     gate:
diff --git a/stack.sh b/stack.sh
index 6899fa0d8b..2528e2b46b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 12579c3db7b28381c8ec97945aa23ee02d54d22b Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Sat, 5 May 2018 23:55:32 +0000
Subject: [PATCH 2283/3333] Set console proxy configuration according to cells
 v2 setup

Change 969239029d4a13956747e6e0b850d6c6ab4035f0 completed the
conversion of console token authorization storage from the
nova-consoleauth service to the database backend. With this change,
console proxies need to be configured on a per cell basis instead
of globally.

There was a devstack change 6645cf7a26428f3af1e4739ac29c6a90b67f99dc
following it that re-enabled the novnc tempest tests, but the nova-next
job that runs the console proxies with TLS is *not* part of the normal
set of jobs that run on devstack changes (it's in the experimental
queue), so it was able to merge without the nova-next job passing.

This configures the nova console proxies in the per cell configuration
file if cells v2 is configured for multiple cells in order to pass the
nova-next job.

Closes-Bug: #1769286

Change-Id: Ic4fff4c59eda43dd1bc6e7b645b513b46b57c235
---
 lib/nova | 119 ++++++++++++++++++++++++++++++++-----------------------
 1 file changed, 69 insertions(+), 50 deletions(-)

diff --git a/lib/nova b/lib/nova
index 1489298ad2..0182996713 100644
--- a/lib/nova
+++ b/lib/nova
@@ -524,52 +524,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT notify_on_state_change "vm_and_task_state"
     fi
 
-    # All nova-compute workers need to know the vnc configuration options
-    # These settings don't hurt anything if n-xvnc and n-novnc are disabled
-    if is_service_enabled n-cpu; then
-        NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        iniset $NOVA_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
-        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        iniset $NOVA_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
-        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
-        iniset $NOVA_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
-    fi
-
-    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
-        # Address on which instance vncservers will listen on compute hosts.
-        # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF vnc server_listen "$VNCSERVER_LISTEN"
-        iniset $NOVA_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
-        iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-
-        if is_nova_console_proxy_compute_tls_enabled ; then
-            iniset $NOVA_CONF vnc auth_schemes "vencrypt"
-            iniset $NOVA_CONF vnc vencrypt_client_key "/etc/pki/nova-novnc/client-key.pem"
-            iniset $NOVA_CONF vnc vencrypt_client_cert "/etc/pki/nova-novnc/client-cert.pem"
-            iniset $NOVA_CONF vnc vencrypt_ca_certs "/etc/pki/nova-novnc/ca-cert.pem"
-
-            sudo mkdir -p /etc/pki/nova-novnc
-            deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
-            deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
-        fi
-    else
-        iniset $NOVA_CONF vnc enabled false
-    fi
-
-    if is_service_enabled n-spice; then
-        # Address on which instance spiceservers will listen on compute hosts.
-        # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF spice enabled true
-        iniset $NOVA_CONF spice server_listen "$SPICESERVER_LISTEN"
-        iniset $NOVA_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
-        iniset $NOVA_CONF spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-    fi
-
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
@@ -588,10 +542,6 @@ function create_nova_conf {
         iniset $NOVA_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
-    if is_service_enabled n-sproxy; then
-        iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $NOVA_CONF serial_console enabled True
-    fi
     iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
     # Setup logging for nova-dhcpbridge command line
@@ -641,6 +591,75 @@ function create_nova_conf {
             setup_logging $conf
         done
     fi
+
+    # Console proxy configuration has to go after conductor configuration
+    # because the per cell config file nova_cellN.conf is cleared out as part
+    # of conductor configuration.
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        configure_console_proxies
+    else
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            conf=$(conductor_conf $i)
+            configure_console_proxies $conf
+        done
+    fi
+}
+
+function configure_console_proxies {
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+
+    # All nova-compute workers need to know the vnc configuration options
+    # These settings don't hurt anything if n-xvnc and n-novnc are disabled
+    if is_service_enabled n-cpu; then
+        NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        iniset $conf vnc novncproxy_base_url "$NOVNCPROXY_URL"
+        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
+        iniset $conf vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
+        iniset $conf spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
+    fi
+
+    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
+        # Address on which instance vncservers will listen on compute hosts.
+        # For multi-host, this should be the management ip of the compute host.
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        iniset $conf vnc server_listen "$VNCSERVER_LISTEN"
+        iniset $conf vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+
+        if is_nova_console_proxy_compute_tls_enabled ; then
+            iniset $conf vnc auth_schemes "vencrypt"
+            iniset $conf vnc vencrypt_client_key "/etc/pki/nova-novnc/client-key.pem"
+            iniset $conf vnc vencrypt_client_cert "/etc/pki/nova-novnc/client-cert.pem"
+            iniset $conf vnc vencrypt_ca_certs "/etc/pki/nova-novnc/ca-cert.pem"
+
+            sudo mkdir -p /etc/pki/nova-novnc
+            deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
+            deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
+        fi
+    else
+        iniset $conf vnc enabled false
+    fi
+
+    if is_service_enabled n-spice; then
+        # Address on which instance spiceservers will listen on compute hosts.
+        # For multi-host, this should be the management ip of the compute host.
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        iniset $conf spice enabled true
+        iniset $conf spice server_listen "$SPICESERVER_LISTEN"
+        iniset $conf spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
+        iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+    fi
+
+    if is_service_enabled n-sproxy; then
+        iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf serial_console enabled True
+    fi
 }
 
 function init_nova_service_user_conf {

From f774ecf4f9f44b38f345bb614b72c83b3ec15136 Mon Sep 17 00:00:00 2001
From: Matt Smith <mss@datera.io>
Date: Mon, 7 May 2018 16:43:56 -0500
Subject: [PATCH 2284/3333] Changing openrc default Cinder API version to v3

* v3 is a superset of v2 and has been the defacto Cinder version for
several years now.
* Devstack installs Cinder v3 API by default, so the default environment
variables should reflect this.

Change-Id: I86e1ae4e020e2be043cf8e190d7959b65b6c093c
---
 openrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/openrc b/openrc
index 37724c552e..cc8cad406c 100644
--- a/openrc
+++ b/openrc
@@ -108,5 +108,5 @@ fi
 
 # Currently cinderclient needs you to specify the *volume api* version. This
 # needs to match the config of your catalog returned by Keystone.
-export CINDER_VERSION=${CINDER_VERSION:-2}
+export CINDER_VERSION=${CINDER_VERSION:-3}
 export OS_VOLUME_API_VERSION=${OS_VOLUME_API_VERSION:-$CINDER_VERSION}

From b89bfa21b0e144d8160478b54a45a1087ea3e1df Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 8 May 2018 06:12:17 +0000
Subject: [PATCH 2285/3333] Updated from generate-devstack-plugins-list

Change-Id: I202b685740fe2b4ea53d115524d3bad01b038af6
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c21e0efcc8..92c63800b9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -163,6 +163,7 @@ scalpels                               `git://git.openstack.org/openstack/scalpe
 searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
 searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
+slogging                               `git://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__

From 827f6c1a4a8af662eba038da0fd0ab5eab1305c8 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 10 May 2018 06:19:41 +0000
Subject: [PATCH 2286/3333] Updated from generate-devstack-plugins-list

Change-Id: I3695c066799fb14f63050bf1ec05301b1d132d5d
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 92c63800b9..9b2cb7eec1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,7 @@ Plugin Name                            URL
 ====================================== ===
 almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
+apmec                                  `git://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__

From 65ad79409537a76aec5cdba4360094a3047a025d Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 9 May 2018 17:55:40 +0000
Subject: [PATCH 2287/3333] Configure console proxy settings for nova-cpu.conf

Change 12579c3db7b28381c8ec97945aa23ee02d54d22b moved console-related
settings from the global nova.conf to the per cell nova_cellN.conf
because of a recent change in nova that moved console token
authorizations from the nova-consoleauth service backend to the
database backend and thus changed the deployment layout requirements
from global console proxies to per cell console proxies.

The change erroneously also removed console configuration settings from
the nova-compute config file nova-cpu.conf because the nova-cpu.conf
begins as a copy of the global nova.conf.

This adds configuration of console proxies to the nova-cpu.conf in the
start_nova_compute routine. The settings have also been split up to
clarify which settings are used by the console proxy and which settings
are used by nova-compute.

Closes-Bug: #1770143

Change-Id: I2a98795674183e2c05c29e15a3a3bad1a22c0891
---
 lib/nova | 54 +++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 35 insertions(+), 19 deletions(-)

diff --git a/lib/nova b/lib/nova
index 0182996713..b0af48aec4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -606,19 +606,16 @@ function create_nova_conf {
     fi
 }
 
-function configure_console_proxies {
-    # Use the provided config file path or default to $NOVA_CONF.
-    local conf=${1:-$NOVA_CONF}
-
+function configure_console_compute {
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        iniset $conf vnc novncproxy_base_url "$NOVNCPROXY_URL"
+        iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        iniset $conf vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
         SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
-        iniset $conf spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
+        iniset $NOVA_CPU_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
 
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
@@ -626,8 +623,32 @@ function configure_console_proxies {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $conf vnc server_listen "$VNCSERVER_LISTEN"
-        iniset $conf vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CPU_CONF vnc server_listen "$VNCSERVER_LISTEN"
+        iniset $NOVA_CPU_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+    else
+        iniset $NOVA_CPU_CONF vnc enabled false
+    fi
+
+    if is_service_enabled n-spice; then
+        # Address on which instance spiceservers will listen on compute hosts.
+        # For multi-host, this should be the management ip of the compute host.
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        iniset $NOVA_CPU_CONF spice enabled true
+        iniset $NOVA_CPU_CONF spice server_listen "$SPICESERVER_LISTEN"
+        iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
+    fi
+
+    if is_service_enabled n-sproxy; then
+        iniset $NOVA_CPU_CONF serial_console enabled True
+    fi
+}
+
+function configure_console_proxies {
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+
+    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
 
@@ -641,24 +662,14 @@ function configure_console_proxies {
             deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
             deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
         fi
-    else
-        iniset $conf vnc enabled false
     fi
 
     if is_service_enabled n-spice; then
-        # Address on which instance spiceservers will listen on compute hosts.
-        # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $conf spice enabled true
-        iniset $conf spice server_listen "$SPICESERVER_LISTEN"
-        iniset $conf spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
         iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     fi
 
     if is_service_enabled n-sproxy; then
         iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf serial_console enabled True
     fi
 }
 
@@ -911,6 +922,11 @@ function start_nova_compute {
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
     fi
 
+    # Console proxies were configured earlier in create_nova_conf. Now that the
+    # nova-cpu.conf has been created, configure the console settings required
+    # by the compute process.
+    configure_console_compute
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From a99ab7002cfea539e035e203c0d05415fac3eb6a Mon Sep 17 00:00:00 2001
From: Jakub Libosvar <libosvar@redhat.com>
Date: Mon, 14 May 2018 16:12:52 +0200
Subject: [PATCH 2288/3333] neutron: Use openvswitch firewall driver by default

openvswitch firewall has been in Neutron tree since Newton and has gone
through lots of improvements since including simple upgrade path from
the iptables hybrid driver.

We have a tempest job running in Neutron tree with openvswitch firewall
that's been voting and stable for a while. For neutron_tempest_plugin,
we have had the openvswitch firewall in use since the beginning.

This patch proposes openvswitch firewall driver to become a default
driver for openvswitch agent deployments.

Change-Id: If26d0180e459210511f25f1faa83dd8ccea25ff4
---
 lib/neutron                  | 4 ++--
 lib/neutron_plugins/ovs_base | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index cef8d1f2ae..3cad80a414 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -220,8 +220,8 @@ function configure_neutron_new {
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
             iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
-        else
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables_hybrid
+        elif [[ $NEUTRON_AGENT == "openvswitch" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver openvswitch
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
 
             if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 36e2ed2ca2..523024e2fe 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -86,7 +86,7 @@ function _neutron_ovs_base_install_agent_packages {
 
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver openvswitch
         if ! running_in_container; then
             enable_kernel_bridge_firewall
         fi

From 306fca807bbe69d104aeb3a135eceb18d47e7f93 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 14 May 2018 11:31:54 -0400
Subject: [PATCH 2289/3333] Add dosfstools to files

dosfstools provides mkfs.vfat which is needed if n-cpu is
configured with 'config_drive_format=vfat'.

Change-Id: If1e1537a079e71847d91ae03ed0c18290a467c4e
Related-Bug: #1770640
---
 files/debs/n-cpu      | 1 +
 files/rpms-suse/n-cpu | 1 +
 files/rpms/n-cpu      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index d8bbf59d07..636644f10d 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,4 +1,5 @@
 cryptsetup
+dosfstools
 genisoimage
 gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index d0c572e97d..c11e9f0763 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,4 +1,5 @@
 cryptsetup
+dosfstools
 libosinfo
 lvm2
 mkisofs
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 26c5ced196..68e5472685 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,4 +1,5 @@
 cryptsetup
+dosfstools
 genisoimage
 iscsi-initiator-utils
 libosinfo

From f8755bd468cae234ca7acca018ccee31f0e474b2 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 16 May 2018 14:40:01 +0000
Subject: [PATCH 2290/3333] Allow plugins to override initial network creation

The same code is already in place for the new lib/neutron library, allow
this functionality to be used also when the neutron legacy services are
still being deployed. This was mangled in [0].

[0] I868afeb065d80d8ccd57630b90658e330ab94251

Change-Id: I7214c4893943fbfbeb42ad140f433eecd6c3e9f0
---
 stack.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 2528e2b46b..446d894f8a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1315,7 +1315,14 @@ fi
 # Once neutron agents are started setup initial network elements
 if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
-    create_neutron_initial_network
+    # Here's where plugins can wire up their own networks instead
+    # of the code in lib/neutron_plugins/services/l3
+    if type -p neutron_plugin_create_initial_networks > /dev/null; then
+        neutron_plugin_create_initial_networks
+    else
+        create_neutron_initial_network
+    fi
+
 fi
 
 if is_service_enabled nova; then

From 1fccf0b3391ca9d60fa47cc2f9f7ccbae841d483 Mon Sep 17 00:00:00 2001
From: Sumit Jamgade <sjamgade@suse.com>
Date: Thu, 24 May 2018 16:24:00 +0200
Subject: [PATCH 2291/3333] swift expects an internal client config to start

using the sample form the source

Change-Id: I01874b650cd5d662ca2feabe58cc880155c9421e
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 933af1005b..762f1dd8fc 100644
--- a/lib/swift
+++ b/lib/swift
@@ -368,6 +368,7 @@ function configure_swift {
 
     SWIFT_CONFIG_PROXY_SERVER=${SWIFT_CONF_DIR}/proxy-server.conf
     cp ${SWIFT_DIR}/etc/proxy-server.conf-sample ${SWIFT_CONFIG_PROXY_SERVER}
+    cp ${SWIFT_DIR}/etc/internal-client.conf-sample ${SWIFT_CONF_DIR}/internal-client.conf
 
     # To run container sync feature introduced in Swift ver 1.12.0,
     # container sync "realm" is added in container-sync-realms.conf

From 43f25c0fc3bee28ccd50b1bd6c40046b5cd12b4f Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 31 May 2018 14:49:59 +0100
Subject: [PATCH 2292/3333] doc: Describe running a command as a separate group

Some commands must be run as a separate group to work. Users can use the
'sg' tool to do this.

This may be assumed knowledge for many users but it's helpful to note in
this, the definitive resource for DevStack's systemd integration.

Change-Id: I271c1d21b44fa972c152780c1caa01c21c265159
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 doc/source/systemd.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 9cc401771a..1bc9911879 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -152,6 +152,19 @@ Invoke the command manually::
 
   /usr/local/bin/nova-scheduler --config-file /etc/nova/nova.conf
 
+Some executables, such as :program:`nova-compute`, will need to be executed
+with a particular group. This will be shown in the systemd unit file::
+
+  sudo systemctl cat devstack@n-cpu.service | grep Group
+
+::
+
+  Group = libvirt
+
+Use the :program:`sg` tool to execute the command as this group::
+
+  sg libvirt -c '/usr/local/bin/nova-compute --config-file /etc/nova/nova-cpu.conf'
+
 Using remote-pdb
 ----------------
 

From 0f4af398a98e7a9e742162910135e300521ea026 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sat, 2 Jun 2018 09:34:20 -0400
Subject: [PATCH 2293/3333] Set workers=$API_WORKERS in glance-registry.conf

We use $API_WORKERS to throttle the number of workers
in other services but were not doing it for g-reg for
some reason, which by default will run ncpu workers
up to a limit of 8.

Change-Id: Idc81ce05546e6d625c10e2229256eafbe7c057a5
Closes-Bug: #1774781
---
 lib/glance | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/glance b/lib/glance
index 6a0e719cad..528a05fcf8 100644
--- a/lib/glance
+++ b/lib/glance
@@ -114,6 +114,7 @@ function configure_glance {
     # Set non-default configuration options for registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+    iniset $GLANCE_REGISTRY_CONF DEFAULT workers $API_WORKERS
     local dburl
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl

From 5e832d3061a9edd77dff6b9a051df7f116104ea2 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sat, 2 Jun 2018 12:40:58 -0400
Subject: [PATCH 2294/3333] Modernize VIRT_DRIVER=fake usage

This makes three changes:

1. The quota options set when using the fake
   virt driver have been renamed so we're getting
   deprecation warnings on using the old names.
   Rather than set each quota limit value individually,
   we can just use the noop quota driver for the same
   effect.

2. The enabled_filters list for the scheduler was last
   updated when using the fake virt driver back in Juno
   via Ic7ec87e4d497d9db58eec93f2b304fe9770a2bbc - with
   the Placement service, we don't need the CoreFilter,
   RamFilter or DiskFilter. Also, in general, we just
   don't need to hard-code a list of scheduler filters
   when using the fake virt driver. If one needs to set
   their own scheduler filter list, they can do so using
   the $FILTERS variable (or post-config for nova.conf).

3. The largeops job, which ran the Tempest scenario tests,
   has been gone for a few years now, as have the Tempest
   scenario tests, so the API_WORKERS modification when
   using the fake virt driver should be removed. If we had
   a CI job like the largeops job today, we would set the
   worker config via the job rather than in devstack.

Change-Id: I8d2bb2af40b5db8a555482a0852b1604aec29f15
---
 lib/nova_plugins/hypervisor-fake | 13 +------------
 stackrc                          |  7 +------
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 49c8dee83a..87ee49fa4b 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -38,18 +38,7 @@ function cleanup_nova_hypervisor {
 function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
     # Disable arbitrary limits
-    iniset $NOVA_CONF DEFAULT quota_instances -1
-    iniset $NOVA_CONF DEFAULT quota_cores -1
-    iniset $NOVA_CONF DEFAULT quota_ram -1
-    iniset $NOVA_CONF DEFAULT quota_floating_ips -1
-    iniset $NOVA_CONF DEFAULT quota_fixed_ips -1
-    iniset $NOVA_CONF DEFAULT quota_metadata_items -1
-    iniset $NOVA_CONF DEFAULT quota_injected_files -1
-    iniset $NOVA_CONF DEFAULT quota_injected_file_path_length -1
-    iniset $NOVA_CONF DEFAULT quota_security_groups -1
-    iniset $NOVA_CONF DEFAULT quota_security_group_rules -1
-    iniset $NOVA_CONF DEFAULT quota_key_pairs -1
-    iniset $NOVA_CONF filter_scheduler enabled_filters "RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter,RamFilter,DiskFilter"
+    iniset $NOVA_CONF quota driver nova.quota.NoopQuotaDriver
 }
 
 # install_nova_hypervisor() - Install external components
diff --git a/stackrc b/stackrc
index 3c4e4370e8..6c4d7d6848 100644
--- a/stackrc
+++ b/stackrc
@@ -800,12 +800,7 @@ SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 # the memory used where there are a large number of CPUs present
 # (the default number of workers for many services is the number of CPUs)
 # Also sets the minimum number of workers to 2.
-if [[ "$VIRT_DRIVER" = 'fake' ]]; then
-    # we need more workers for the large ops job
-    API_WORKERS=${API_WORKERS:=$(( ($(nproc)/2)<2 ? 2 : ($(nproc)/2) ))}
-else
-    API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
-fi
+API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
 
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}

From c7c67658c1daa40bfcdddfc99d1e05a70d205e66 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Mon, 4 Jun 2018 10:59:57 +0200
Subject: [PATCH 2295/3333] iniset: fix handling of keys with spaces

Ceph for example uses them. Creation already worked, but not
updates of existing keys.

Closes-Bug: 1774956

Change-Id: I20cb61c08079b9cd9ad56ac875525abf1442bff6
---
 inc/ini-config           |  2 +-
 tests/test_ini_config.sh | 22 ++++++++++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 68d48d197b..6fe7788158 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -200,7 +200,7 @@ $option = $value
         local sep
         sep=$(echo -ne "\x01")
         # Replace it
-        $sudo sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
+        $sudo sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('"${option}"'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
     fi
     $xtrace
 }
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index a5e110736e..f7dc89a28d 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -44,6 +44,9 @@ empty =
 multi = foo1
 multi = foo2
 
+[key_with_spaces]
+rgw special key = something
+
 # inidelete(a)
 [del_separate_options]
 a=b
@@ -82,8 +85,9 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee del_separate_options \
-del_same_option del_missing_option del_missing_option_multi del_no_options"
+assert_equal "$VAL" "default aaa bbb ccc ddd eee key_with_spaces \
+del_separate_options del_same_option del_missing_option \
+del_missing_option_multi del_no_options"
 
 # Test with missing arguments
 BEFORE=$(cat ${TEST_INI})
@@ -209,6 +213,20 @@ iniset $SUDO_ARG ${INI_TMP_ETC_DIR}/test.new.ini test foo bar
 VAL=$(iniget ${INI_TMP_ETC_DIR}/test.new.ini test foo)
 assert_equal "$VAL" "bar" "iniset created file"
 
+# test creation of keys with spaces
+iniset ${SUDO_ARG} ${TEST_INI} key_with_spaces "rgw another key" somethingelse
+VAL=$(iniget ${TEST_INI} key_with_spaces "rgw another key")
+assert_equal "$VAL" "somethingelse" "iniset created a key with spaces"
+
+# test update of keys with spaces
+iniset ${SUDO_ARG} ${TEST_INI} key_with_spaces "rgw special key" newvalue
+VAL=$(iniget ${TEST_INI} key_with_spaces "rgw special key")
+assert_equal "$VAL" "newvalue" "iniset updated a key with spaces"
+
+inidelete ${SUDO_ARG} ${TEST_INI} key_with_spaces "rgw another key"
+VAL=$(iniget ${TEST_INI} key_with_spaces "rgw another key")
+assert_empty VAL "inidelete removed a key with spaces"
+
 $SUDO rm -rf ${INI_TMP_DIR}
 
 report_results

From 51aec325e6252703371ab001bea0853af05ca2d8 Mon Sep 17 00:00:00 2001
From: qingszhao <zhao.daqing@99cloud.net>
Date: Tue, 12 Jun 2018 08:25:20 +0800
Subject: [PATCH 2296/3333] fix tox python3 overrides

We want to default to running all tox environments under python 3, so
set the basepython value in each environment.

We do not want to specify a minor version number, because we do not
want to have to update the file every time we upgrade python.

We do not want to set the override once in testenv, because that
breaks the more specific versions used in default environments like
py35 and py36.

Change-Id: Id83cb3cdd62517045c45388f88cb3de0e3d75da1
---
 tox.ini | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tox.ini b/tox.ini
index 74436b0f26..f643fdb930 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,6 +8,7 @@ usedevelop = False
 install_command = pip install {opts} {packages}
 
 [testenv:bashate]
+basepython = python3
 # if you want to test out some changes you have made to bashate
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
@@ -34,6 +35,7 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
+basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
@@ -42,5 +44,6 @@ commands =
   python setup.py build_sphinx
 
 [testenv:venv]
+basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 commands = {posargs}

From 0417858afa5cb65726579640231019de2215e530 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 12 Jun 2018 15:37:00 -0400
Subject: [PATCH 2297/3333] fix typo in python3_version

The function was using an undefined variable to show the version of
python3 being used.

Change-Id: Ibc956975d620ed5174de8823f9c202a680c56aaf
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index b1b0995a79..25e28bd74a 100644
--- a/functions-common
+++ b/functions-common
@@ -2128,7 +2128,7 @@ function python_version {
 function python3_version {
     local python3_version
     python3_version=$(_get_python_version python3)
-    echo "python${python_version}"
+    echo "python${python3_version}"
 }
 
 

From 7f33552d347f400fc1f2c290da3d3fa863197cee Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 14 Jun 2018 21:11:10 +1000
Subject: [PATCH 2298/3333] Switch to dnf when it exists

This has all been around for a *long* time, like when dnf was a weird
new thing.  Now it's the opposite and yum is a weird old thing :)
Choose it by default for platforms with it (Fedora, for now).

Change-Id: Id2bd7d145354b996de31944929fd0267ec24a08e
---
 stackrc | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/stackrc b/stackrc
index 3c4e4370e8..66d6f238a5 100644
--- a/stackrc
+++ b/stackrc
@@ -819,11 +819,14 @@ SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 # Service graceful shutdown timeout
 WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
 
-# Support alternative yum -- in future Fedora 'dnf' will become the
-# only supported installer, but for now 'yum' and 'dnf' are both
-# available in parallel with compatible CLIs.  Allow manual switching
-# till we get to the point we need to handle this automatically
-YUM=${YUM:-yum}
+# Choose DNF on RedHat/Fedora platforms with it, or otherwise default
+# to YUM.  Can remove this when only dnf is supported (i.e. centos7
+# disappears)
+if [[ -e /usr/bin/dnf ]]; then
+    YUM=${YUM:-dnf}
+else
+    YUM=${YUM:-yum}
+fi
 
 # Common Configuration
 # --------------------

From 8e5f8c29b27c8dc83da31fbce5d92a173b91ba10 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Fri, 15 Jun 2018 10:10:35 -0700
Subject: [PATCH 2299/3333] Add the project under test to LIBS_FROM_GIT

This automatically always adds the project under test to LIBS_FROM_GIT
which effectively makes the normal "tempest full" job the same as the
"forward testing" job when it is applied to a library repo.

Change-Id: Ibbdd8a86e0ff55f67bef73e08e693b34a61b24df
---
 roles/write-devstack-local-conf/README.rst    | 11 ++++++-----
 .../library/devstack_local_conf.py            | 19 +++++++++++++------
 .../write-devstack-local-conf/library/test.py | 17 ++++++++++++-----
 .../write-devstack-local-conf/tasks/main.yaml |  1 +
 4 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index bfce9c98cd..e9739cdea8 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -22,11 +22,12 @@ Write the local.conf file for use by devstack
 
    As a special case, the variable ``LIBS_FROM_GIT`` will be
    constructed automatically from the projects which appear in the
-   ``required-projects`` list defined by the job.  To instruct
-   devstack to install a library from source rather than pypi, simply
-   add that library to the job's ``required-projects`` list.  To
-   override the automatically-generated value, set ``LIBS_FROM_GIT``
-   in ``devstack_localrc`` to the desired value.
+   ``required-projects`` list defined by the job plus the project of
+   the change under test.  To instruct devstack to install a library
+   from source rather than pypi, simply add that library to the job's
+   ``required-projects`` list.  To override the
+   automatically-generated value, set ``LIBS_FROM_GIT`` in
+   ``devstack_localrc`` to the desired value.
 
 .. zuul:rolevar:: devstack_local_conf
    :type: dict
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 9728fef37b..bba7e31f96 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -207,12 +207,13 @@ def getPlugins(self):
 class LocalConf(object):
 
     def __init__(self, localrc, localconf, base_services, services, plugins,
-                 base_dir, projects):
+                 base_dir, projects, project):
         self.localrc = []
         self.meta_sections = {}
         self.plugin_deps = {}
         self.base_dir = base_dir
         self.projects = projects
+        self.project = project
         if plugins:
             self.handle_plugins(plugins)
         if services or base_services:
@@ -249,11 +250,15 @@ def handle_localrc(self, localrc):
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
 
-        if not lfg and self.projects:
+        if not lfg and (self.projects or self.project):
             required_projects = []
-            for project_name, project_info in self.projects.items():
-                if project_info.get('required'):
-                    required_projects.append(project_info['short_name'])
+            if self.projects:
+                for project_name, project_info in self.projects.items():
+                    if project_info.get('required'):
+                        required_projects.append(project_info['short_name'])
+            if self.project:
+                if self.project['short_name'] not in required_projects:
+                    required_projects.append(self.project['short_name'])
             if required_projects:
                 self.localrc.append('LIBS_FROM_GIT={}'.format(
                     ','.join(required_projects)))
@@ -291,6 +296,7 @@ def main():
             base_dir=dict(type='path'),
             path=dict(type='str'),
             projects=dict(type='dict'),
+            project=dict(type='dict'),
         )
     )
 
@@ -301,7 +307,8 @@ def main():
                    p.get('services'),
                    p.get('plugins'),
                    p.get('base_dir'),
-                   p.get('projects'))
+                   p.get('projects'),
+                   p.get('project'))
     lc.write(p['path'])
 
     module.exit_json()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 7ccb68f08d..791552d1ad 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -57,7 +57,8 @@ def test_plugins(self):
                        p.get('services'),
                        p.get('plugins'),
                        p.get('base_dir'),
-                       p.get('projects'))
+                       p.get('projects'),
+                       p.get('project'))
         lc.write(p['path'])
 
         plugins = []
@@ -120,17 +121,22 @@ def test_libs_from_git(self):
                 'short_name': 'devstack-plugin',
             },
         }
+        project = {
+            'short_name': 'glance',
+        }
         p = dict(base_services=[],
                  base_dir='./test',
                  path=os.path.join(self.tmpdir, 'test.local.conf'),
-                 projects=projects)
+                 projects=projects,
+                 project=project)
         lc = LocalConf(p.get('localrc'),
                        p.get('local_conf'),
                        p.get('base_services'),
                        p.get('services'),
                        p.get('plugins'),
                        p.get('base_dir'),
-                       p.get('projects'))
+                       p.get('projects'),
+                       p.get('project'))
         lc.write(p['path'])
 
         lfg = None
@@ -138,7 +144,7 @@ def test_libs_from_git(self):
             for line in f:
                 if line.startswith('LIBS_FROM_GIT'):
                     lfg = line.strip().split('=')[1]
-        self.assertEqual('nova,oslo.messaging', lfg)
+        self.assertEqual('nova,oslo.messaging,glance', lfg)
 
     def test_overridelibs_from_git(self):
         "Test that LIBS_FROM_GIT can be overridden"
@@ -168,7 +174,8 @@ def test_overridelibs_from_git(self):
                        p.get('services'),
                        p.get('plugins'),
                        p.get('base_dir'),
-                       p.get('projects'))
+                       p.get('projects'),
+                       p.get('project'))
         lc.write(p['path'])
 
         lfg = None
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index a294cae608..9a6b083a2f 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -10,3 +10,4 @@
     local_conf: "{{ devstack_local_conf|default(omit) }}"
     base_dir: "{{ devstack_base_dir|default(omit) }}"
     projects: "{{ zuul.projects }}"
+    project: "{{ zuul.project }}"
\ No newline at end of file

From a7d0c6fa2c443b2b4b5f4680faff09c6b2bd00d2 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Mon, 18 Jun 2018 15:06:48 +0000
Subject: [PATCH 2300/3333] Use `member` instead of `Member`

Keystone now provides a set of default roles in addition to `admin`
by default [0]. This is done during the `keystone-manage bootstrap`
process.

This change aligns the `Member` role override from devstack with the
`member` role provided from keystone.

[0] https://review.openstack.org/#/c/572243/

Change-Id: I3da3530aa73a8a1500116bcefdcba7b947d5e05e
Closes-Bug: 1777359
---
 lib/horizon  |  2 +-
 lib/keystone | 29 ++++++++++-------------------
 2 files changed, 11 insertions(+), 20 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index fab41bbeca..293a627c78 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -87,7 +87,7 @@ function configure_horizon {
     _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
-    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"member\"
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
diff --git a/lib/keystone b/lib/keystone
index 696e351ab0..7978feaf16 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -309,30 +309,32 @@ function configure_keystone {
 # service              --         --
 # --                   --         service
 # --                   --         ResellerAdmin
-# --                   --         Member
+# --                   --         member
 # demo                 admin      admin
-# demo                 demo       Member, anotherrole
+# demo                 demo       member, anotherrole
 # alt_demo             admin      admin
-# alt_demo             alt_demo   Member, anotherrole
-# invisible_to_admin   demo       Member
+# alt_demo             alt_demo   member, anotherrole
+# invisible_to_admin   demo       member
 
 # Group                Users            Roles                 Project
 # ------------------------------------------------------------------
 # admins               admin            admin                 admin
-# nonadmins            demo, alt_demo   Member, anotherrole   demo, alt_demo
+# nonadmins            demo, alt_demo   member, anotherrole   demo, alt_demo
 
 
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
-    # The keystone bootstrapping process (performed via keystone-manage bootstrap)
-    # creates an admin user, admin role and admin project. As a sanity check
-    # we exercise the CLI to retrieve the IDs for these values.
+    # The keystone bootstrapping process (performed via keystone-manage
+    # bootstrap) creates an admin user, admin role, member role, and admin
+    # project. As a sanity check we exercise the CLI to retrieve the IDs for
+    # these values.
     local admin_project
     admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
     local admin_role="admin"
+    local member_role="member"
 
     get_or_add_user_domain_role $admin_role $admin_user default
 
@@ -349,17 +351,6 @@ function create_keystone_accounts {
     # role is also configurable in swift-proxy.conf
     get_or_create_role ResellerAdmin
 
-    # The Member role is used by Horizon and Swift so we need to keep it:
-    local member_role="member"
-
-    # Capital Member role is legacy hard coded in Horizon / Swift
-    # configs. Keep it around.
-    get_or_create_role "Member"
-
-    # The reality is that the rest of the roles listed below honestly
-    # should work by symbolic names.
-    get_or_create_role $member_role
-
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
     local another_role="anotherrole"

From e95f2a36645b58b172855213cb8311a3486bfcd9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 18 Jun 2018 16:17:29 -0400
Subject: [PATCH 2301/3333] Configure [neutron] in nova_cell*.conf

The nova-conductor service running in the cell
needs to be configured to talk to neutron for
things like deallocating networks during server
build failure. This changes the configure_neutron_nova
flows such that the top-level nova.conf is configured
as before, but we also configure each nova_cell*.conf
cell conductor config files to also be able to talk
to neutron.

Change-Id: Ic5e17298996b5fb085272425bb3b68583247aa34
Closes-Bug: #1777505
---
 lib/neutron               | 48 ++++++++++++++++++++++++++-------------
 lib/neutron-legacy        | 31 +++++++++++++------------
 lib/neutron_plugins/nuage |  5 ++--
 3 files changed, 51 insertions(+), 33 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 3cad80a414..b857e3120d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -325,25 +325,27 @@ function configure_neutron_rootwrap {
 }
 
 # Make Neutron-required changes to nova.conf
+# Takes a single argument which is the config file to update.
 function configure_neutron_nova_new {
-    iniset $NOVA_CONF DEFAULT use_neutron True
-    iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF neutron username neutron
-    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron user_domain_name "Default"
-    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF neutron project_domain_name "Default"
-    iniset $NOVA_CONF neutron auth_strategy $NEUTRON_AUTH_STRATEGY
-    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-
-    iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
+    local conf="$1"
+    iniset $conf DEFAULT use_neutron True
+    iniset $conf neutron auth_type "password"
+    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $conf neutron username neutron
+    iniset $conf neutron password "$SERVICE_PASSWORD"
+    iniset $conf neutron user_domain_name "Default"
+    iniset $conf neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $conf neutron project_domain_name "Default"
+    iniset $conf neutron auth_strategy $NEUTRON_AUTH_STRATEGY
+    iniset $conf neutron region_name "$REGION_NAME"
+
+    iniset $conf DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
     # optionally set options in nova_conf
-    neutron_plugin_create_nova_conf
+    neutron_plugin_create_nova_conf $conf
 
     if is_service_enabled neutron-metadata-agent; then
-        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+        iniset $conf neutron service_metadata_proxy "True"
     fi
 
 }
@@ -568,9 +570,23 @@ function configure_neutron {
 function configure_neutron_nova {
     if is_neutron_legacy_enabled; then
         # Call back to old function
-        create_nova_conf_neutron "$@"
+        create_nova_conf_neutron $NOVA_CONF
+        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
+            for i in $(seq 1 $NOVA_NUM_CELLS); do
+                local conf
+                conf=$(conductor_conf $i)
+                create_nova_conf_neutron $conf
+            done
+        fi
     else
-        configure_neutron_nova_new "$@"
+        configure_neutron_nova_new $NOVA_CONF
+        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
+            for i in $(seq 1 $NOVA_NUM_CELLS); do
+                local conf
+                conf=$(conductor_conf $i)
+                configure_neutron_nova_new $conf
+            done
+        fi
     fi
 }
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0cd7e31d39..2e8992de61 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -366,31 +366,32 @@ function configure_mutnauq {
 }
 
 function create_nova_conf_neutron {
-    iniset $NOVA_CONF DEFAULT use_neutron True
-    iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI"
-    iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
-    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $NOVA_CONF neutron project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
-    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
+    local conf="$1"
+    iniset $conf DEFAULT use_neutron True
+    iniset $conf neutron auth_type "password"
+    iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"
+    iniset $conf neutron username "$Q_ADMIN_USERNAME"
+    iniset $conf neutron password "$SERVICE_PASSWORD"
+    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
+    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
+    iniset $conf neutron region_name "$REGION_NAME"
 
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-        iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
+        iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     fi
 
     # optionally set options in nova_conf
-    neutron_plugin_create_nova_conf
+    neutron_plugin_create_nova_conf $conf
 
     if is_service_enabled q-meta; then
-        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+        iniset $conf neutron service_metadata_proxy "True"
     fi
 
-    iniset $NOVA_CONF DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
-    iniset $NOVA_CONF DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
+    iniset $conf DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
+    iniset $conf DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
 }
 
 # create_mutnauq_accounts() - Set up common required neutron accounts
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 1c04aaac9a..f39c7c4f5b 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -8,10 +8,11 @@ _XTRACE_NEUTRON_NU=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_plugin_create_nova_conf {
+    local conf="$1"
     NOVA_OVS_BRIDGE=${NOVA_OVS_BRIDGE:-"br-int"}
-    iniset $NOVA_CONF neutron ovs_bridge $NOVA_OVS_BRIDGE
+    iniset $conf neutron ovs_bridge $NOVA_OVS_BRIDGE
     LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-    iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
+    iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 }
 
 function neutron_plugin_install_agent_packages {

From 2f5771541209b6016c07c25d6808e1e3162f9d3b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 22 Jun 2018 15:17:05 +1000
Subject: [PATCH 2302/3333] Remove old packages from rpms/horizon

I'm not sure what the history of the (capital-D) Django package or
pyxattr; they've been there for a long time and should just be
installed like other dependencies these days.

Change-Id: I423230cc5cbb13d2cfb7b926a9571a8157ce5c46
---
 files/rpms/horizon | 2 --
 1 file changed, 2 deletions(-)

diff --git a/files/rpms/horizon b/files/rpms/horizon
index fa5601a95f..a88552bc84 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,4 +1,2 @@
-Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pyxattr

From 53e9aca6ce196d874b96829c32b51f8112174d69 Mon Sep 17 00:00:00 2001
From: Sumit Jamgade <sjamgade@suse.com>
Date: Wed, 13 Jun 2018 17:30:41 +0200
Subject: [PATCH 2303/3333] install and start elasticsearch on openSUSE

this will allow install and start of elasticsearch on openSUSE based
distributions

Change-Id: I4d778c260247e73b500ca7d17835655c21941541
---
 pkg/elasticsearch.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index fefd454312..afbf11de3d 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -37,7 +37,7 @@ function wget_elasticsearch {
 function download_elasticsearch {
     if is_ubuntu; then
         wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.deb
-    elif is_fedora; then
+    elif is_fedora || is_suse; then
         wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
     fi
 }
@@ -61,6 +61,9 @@ function start_elasticsearch {
     elif is_fedora; then
         sudo /bin/systemctl start elasticsearch.service
         _check_elasticsearch_ready
+    elif is_suse; then
+        sudo /usr/bin/systemctl start elasticsearch.service
+        _check_elasticsearch_ready
     else
         echo "Unsupported architecture...can not start elasticsearch."
     fi
@@ -71,6 +74,8 @@ function stop_elasticsearch {
         sudo /etc/init.d/elasticsearch stop
     elif is_fedora; then
         sudo /bin/systemctl stop elasticsearch.service
+    elif is_suse ; then
+        sudo /usr/bin/systemctl stop elasticsearch.service
     else
         echo "Unsupported architecture...can not stop elasticsearch."
     fi
@@ -92,6 +97,11 @@ function install_elasticsearch {
         yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
         sudo /bin/systemctl daemon-reload
         sudo /bin/systemctl enable elasticsearch.service
+    elif is_suse; then
+        is_package_installed java-1_8_0-openjdk-headless || install_package java-1_8_0-openjdk-headless
+        zypper_install --no-gpg-checks ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
+        sudo /usr/bin/systemctl daemon-reload
+        sudo /usr/bin/systemctl enable elasticsearch.service
     else
         echo "Unsupported install of elasticsearch on this architecture."
     fi
@@ -103,6 +113,8 @@ function uninstall_elasticsearch {
             sudo apt-get purge elasticsearch
         elif is_fedora; then
             sudo yum remove elasticsearch
+        elif is_suse; then
+            sudo zypper rm elasticsearch
         else
             echo "Unsupported install of elasticsearch on this architecture."
         fi

From 78dff2852b4070168e103976aa3e7d72beb098b0 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 22 Jun 2018 22:17:00 +1000
Subject: [PATCH 2304/3333] Update all rpms for Fedora 28

Bring along the required rpms for the ride on Fedora 28 (we really
should find a way to maybe do f* or something to avoid this
... consider it a todo :)

Change-Id: I37fd38de9baab478c86d23ea2cebca59dc8a5ed1
---
 files/rpms/cinder  | 4 ++--
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index e6addc62aa..058c2354dc 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27,f28 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27,f28 NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index 5d9a4ad5a5..c7863e4320 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27
+iptables-services  # NOPRIME f25,f26,f27,f28
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 9fb7282df5..4140cd7bae 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27
+kernel-modules # dist:f25,f26,f27,f28
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index be0db140e3..f2f5de69b0 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27
+rsync-daemon # dist:f25,f26,f27,f28
 sqlite
 xfsprogs
 xinetd

From e63859362487856f1f53c173909cb8aa3bb55bab Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 28 Jun 2018 11:00:28 +0100
Subject: [PATCH 2305/3333] Make configure_neutron_nova_new and
 create_nova_conf_neutron param optional

The commit e95f2a36645b58b172855213cb8311a3486bfcd9 broke
networking-ovn (and potentially other ml2 drivers) by making the config
parameter mandatory. It doesn't need to be.

Change-Id: I0d5738ac3a6d27ddb7655835d77689409a6ff6f4
---
 lib/neutron        | 5 +++--
 lib/neutron-legacy | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index b857e3120d..9f9b132377 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -325,9 +325,10 @@ function configure_neutron_rootwrap {
 }
 
 # Make Neutron-required changes to nova.conf
-# Takes a single argument which is the config file to update.
+# Takes a single optional argument which is the config file to update,
+# if not passed $NOVA_CONF is used.
 function configure_neutron_nova_new {
-    local conf="$1"
+    local conf=${1:-$NOVA_CONF}
     iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2e8992de61..bee032a704 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -366,7 +366,7 @@ function configure_mutnauq {
 }
 
 function create_nova_conf_neutron {
-    local conf="$1"
+    local conf=${1:-$NOVA_CONF}
     iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"

From 6f38cf4ad846f394489334caae7a38b8e49b646c Mon Sep 17 00:00:00 2001
From: Prabhat Ranjan <pranjank@in.ibm.com>
Date: Fri, 16 Mar 2018 16:33:46 +0530
Subject: [PATCH 2306/3333] Fix wait_for_compute to work for modified compute
 host name

When we change the name of compute host then devstack is breaking
because it is using default host name from host.

How to change compute host name in local.conf
[[post-config|$NOVA_CONF]]
[DEFAULT]
host = foo

Change-Id: I4d4392f1f58f0431b10764610668565af88d392f
Signed-off-by: Prabhat Ranjan <pranjank@in.ibm.com>
---
 functions | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 24994c0470..f63595d433 100644
--- a/functions
+++ b/functions
@@ -441,7 +441,12 @@ EOF
 function wait_for_compute {
     local timeout=$1
     local rval=0
+    local compute_hostname
     time_start "wait_for_service"
+    compute_hostname=$(iniget $NOVA_CONF DEFAULT host)
+    if [[ -z $compute_hostname ]]; then
+        compute_hostname=$(hostname)
+    fi
     timeout $timeout bash -x <<EOF || rval=$?
         ID=""
         while [[ "\$ID" == "" ]]; do
@@ -450,7 +455,7 @@ function wait_for_compute {
                 # When using the fake driver the compute hostnames have a suffix of 1 to NUMBER_FAKE_NOVA_COMPUTE
                 ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname`1 --service nova-compute -c ID -f value)
             else
-                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host "$compute_hostname" --service nova-compute -c ID -f value)
             fi
         done
 EOF

From 16d46483dd83dd4117fd4980208910d4be6a2c8e Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Tue, 3 Jul 2018 07:14:16 -0700
Subject: [PATCH 2307/3333] Keystone no longer uses paste-ini

With the move to flask, Keystone does not utilize paste-ini. This
patchset removes the paste-ini support from devstack for Keystone.

Change-Id: I8dd629937c9178660992fd648175dbef80ffa3c2
---
 lib/keystone | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 7978feaf16..28603257dd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -49,7 +49,6 @@ fi
 
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
-KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
 KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
@@ -203,23 +202,7 @@ function configure_keystone {
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
         install -m 600 /dev/null $KEYSTONE_CONF
-        if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
-            cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
-        fi
     fi
-    if [[ -f "$KEYSTONE_PASTE_INI" ]]; then
-        iniset "$KEYSTONE_CONF" paste_deploy config_file "$KEYSTONE_PASTE_INI"
-    else
-        # compatibility with mixed cfg and paste.deploy configuration
-        KEYSTONE_PASTE_INI="$KEYSTONE_CONF"
-    fi
-
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        # Only Identity v3 API should be available; then disable v2 pipelines
-        inidelete $KEYSTONE_PASTE_INI composite:main \\/v2.0
-        inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
-    fi
-
     # Populate ``keystone.conf``
     if is_service_enabled ldap; then
         iniset $KEYSTONE_CONF identity domain_config_dir "$KEYSTONE_CONF_DIR/domains"

From 19eefe5e61187bab5fb893d51e0f771101441b4a Mon Sep 17 00:00:00 2001
From: Sylvain Afchain <safchain@gmail.com>
Date: Wed, 4 Jul 2018 17:59:34 +0200
Subject: [PATCH 2308/3333] Increase the Elasticsearch service timeout

On some slow system with recent version of
Elasticsearch we saw that the service
becomes ready after more than 1 minute.

Change-Id: Id2b21ab24a96d10fffdcccd652a7d3ec4e8ce39c
---
 pkg/elasticsearch.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index afbf11de3d..bd4415315f 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -49,7 +49,7 @@ function configure_elasticsearch {
 
 function _check_elasticsearch_ready {
     # poll elasticsearch to see if it's started
-    if ! wait_for_service 30 http://localhost:9200; then
+    if ! wait_for_service 120 http://localhost:9200; then
         die $LINENO "Maximum timeout reached. Could not connect to ElasticSearch"
     fi
 }

From c3a33fb6911a5618eb1dc2e7448652ab844a191a Mon Sep 17 00:00:00 2001
From: Maxim Nestratov <mnestratov@virtuozzo.com>
Date: Wed, 4 Jul 2018 22:07:20 +0300
Subject: [PATCH 2309/3333] Fix Virtuozzo CI

Don't specify hypervisor_type=vz property for hds images as nova
now reports only really connected hypervisors and not all supported
by a compute host

Change-Id: Ibec0856519ffe593d44d123f3b401eae19f7d95a
---
 functions | 1 -
 1 file changed, 1 deletion(-)

diff --git a/functions b/functions
index f63595d433..051c8160f7 100644
--- a/functions
+++ b/functions
@@ -282,7 +282,6 @@ function upload_image {
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
-            --property hypervisor_type=vz \
             --property vm_mode=$vm_mode < "${image}"
         return
     fi

From c58c5d60ce5fc1a0c8bee3eb3ba4da790ba92475 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 10 Jul 2018 06:24:09 +0000
Subject: [PATCH 2310/3333] Updated from generate-devstack-plugins-list

Change-Id: Ief0f093a0612e89d07469cb9d0201556e455dfa5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9b2cb7eec1..2d5259d51e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -60,6 +60,7 @@ drbd-devstack                          `git://git.openstack.org/openstack/drbd-d
 ec2-api                                `git://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
 freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
+freezer-tempest-plugin                 `git://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
 fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__

From ef3571338ababf4627c32118fc082f195a9e136c Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Tue, 10 Jul 2018 14:22:48 -0400
Subject: [PATCH 2311/3333] use fqdn for zuul projects

When setting up a 3pci zuul, there is an edge case where a downstream
zuul may already have openstack/foo projects, eg:
review.rdoproject.org/openstack/foo.  In this case, if openstack
projects are not namespaced to include the connection information zuul
gets confused and complains.  We can avoid this by using the fqdn for
git.o.o for devstack jobs and both upstream and downstream zuul will
properly use the correct connection.

Change-Id: I01419ea9f51ce7491aa319b6240aec9c0d4f2356
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 .zuul.yaml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c8bb337d2f..57cbf88e1d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -103,10 +103,10 @@
       job.group-vars.peers, which is what is used by multi node jobs for subnode
       nodes (everything but the controller).
     required-projects:
-      - openstack-dev/devstack
+      - git.openstack.org/openstack-dev/devstack
     roles:
-      - zuul: openstack-infra/devstack-gate
-      - zuul: openstack-infra/openstack-zuul-jobs
+      - zuul: git.openstack.org/openstack-infra/devstack-gate
+      - zuul: git.openstack.org/openstack-infra/openstack-zuul-jobs
     vars:
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
@@ -211,7 +211,7 @@
       less than the normal minimum set of required-projects.
     nodeset: openstack-single-node
     required-projects:
-      - openstack/requirements
+      - git.openstack.org/openstack/requirements
     vars:
       devstack_localrc:
         # Multinode specific settings
@@ -270,12 +270,12 @@
       and extended.
     nodeset: openstack-single-node
     required-projects:
-      - openstack/cinder
-      - openstack/glance
-      - openstack/keystone
-      - openstack/neutron
-      - openstack/nova
-      - openstack/swift
+      - git.openstack.org/openstack/cinder
+      - git.openstack.org/openstack/glance
+      - git.openstack.org/openstack/keystone
+      - git.openstack.org/openstack/neutron
+      - git.openstack.org/openstack/nova
+      - git.openstack.org/openstack/swift
     timeout: 7200
     vars:
       devstack_localrc:

From 274287598252b04f0ddf9741d7145a71cbb953a1 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 10 Jul 2018 09:21:46 +0000
Subject: [PATCH 2312/3333] Cleanup keystone's removed config options

token.provider.drvier.uuid and token.driver
has been removed from keystone[1].

Devstack has reference/setting of those config
options which is confusing for user and it can
lead to import error like[2]

This commit cleanup the devstack bits of removed
config options.

bp removed-as-of-rocky

[1] https://blueprints.launchpad.net/keystone/+spec/removed-as-of-rocky

[2] http://paste.openstack.org/show/725391/

Change-Id: I29b3b356622c485c4c1046679234a38e7b645071
---
 lib/keystone | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 28603257dd..57cb24d4cb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -63,9 +63,6 @@ else
     KEYSTONE_DEPLOY=mod_wsgi
 fi
 
-# Select the token persistence backend driver
-KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
-
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 
@@ -79,7 +76,8 @@ KEYSTONE_ROLE_BACKEND=${KEYSTONE_ROLE_BACKEND:-sql}
 KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
-# Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
+# Refer keystone doc for supported token provider:
+# https://docs.openstack.org/keystone/latest/admin/token-provider.html
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
@@ -245,8 +243,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF database connection `database_connection_url keystone`
 
-    iniset $KEYSTONE_CONF token driver "$KEYSTONE_TOKEN_BACKEND"
-
     # Set up logging
     if [ "$SYSLOG" != "False" ]; then
         iniset $KEYSTONE_CONF DEFAULT use_syslog "True"
@@ -443,11 +439,6 @@ function init_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
     time_stop "dbsync"
 
-    if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
-        # Set up certificates
-        rm -rf $KEYSTONE_CONF_DIR/ssl
-        $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF pki_setup
-    fi
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "fernet" ]]; then
         rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
         $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF fernet_setup

From 3b5477d6356a62d7d64a519a4b1ac99309d251c0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 12 Jul 2018 06:17:32 +0000
Subject: [PATCH 2313/3333] Updated from generate-devstack-plugins-list

Change-Id: I8f702373c76953a0a29285f410d368c975ba4024
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2d5259d51e..7ad65f741b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -100,6 +100,7 @@ monasca-tempest-plugin                 `git://git.openstack.org/openstack/monasc
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-ansible                     `git://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
 networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
 networking-baremetal                   `git://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__

From e484f3b1c8086567ce5dc1e55ee503def8e5b429 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 10 Jul 2018 16:28:44 +0200
Subject: [PATCH 2314/3333] Remove devstack exercises

These seem to be not run for quite some time and they don't
succeed anymore - drop the code to avoid somebody accidentally
running it and wondering. A good example of "if it isn't tested
its broken".

Depends-On: https://review.openstack.org/583146
Depends-On: https://review.openstack.org/583147

Change-Id: I99e8a5ca2925217a5a2401984f3f4f6f032017be
---
 HACKING.rst                          |  86 -----
 doc/source/configuration.rst         |  41 +--
 doc/source/guides/single-machine.rst |   4 -
 doc/source/overview.rst              |   8 -
 exercise.sh                          |  74 -----
 exerciserc                           |  26 --
 exercises/aggregates.sh              | 150 ---------
 exercises/boot_from_volume.sh        | 224 -------------
 exercises/client-args.sh             | 174 ----------
 exercises/client-env.sh              | 171 ----------
 exercises/floating_ips.sh            | 216 -------------
 exercises/neutron-adv-test.sh        | 466 ---------------------------
 exercises/sec_groups.sh              |  81 -----
 exercises/swift.sh                   |  69 ----
 exercises/volumes.sh                 | 225 -------------
 15 files changed, 1 insertion(+), 2014 deletions(-)
 delete mode 100755 exercise.sh
 delete mode 100644 exerciserc
 delete mode 100755 exercises/aggregates.sh
 delete mode 100755 exercises/boot_from_volume.sh
 delete mode 100755 exercises/client-args.sh
 delete mode 100755 exercises/client-env.sh
 delete mode 100755 exercises/floating_ips.sh
 delete mode 100755 exercises/neutron-adv-test.sh
 delete mode 100755 exercises/sec_groups.sh
 delete mode 100755 exercises/swift.sh
 delete mode 100755 exercises/volumes.sh

diff --git a/HACKING.rst b/HACKING.rst
index d5d6fbcf02..38e2dac131 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -50,10 +50,6 @@ level.
 ``tools/build_docs.sh`` is used to generate the HTML versions of the
 DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
 
-``exercises`` - Contains the test scripts used to sanity-check and
-demonstrate some OpenStack functions. These scripts know how to exit
-early or skip services that are not enabled.
-
 ``extras.d`` - Contains the dispatch scripts called by the hooks in
 ``stack.sh``, ``unstack.sh`` and ``clean.sh``. See :doc:`the plugins
 docs <plugins>` for more information.
@@ -183,88 +179,6 @@ The complete docs build is also handled with <code>tox -edocs</code> per the
 OpenStack project standard.
 
 
-Exercises
----------
-
-The scripts in the exercises directory are meant to 1) perform basic operational
-checks on certain aspects of OpenStack; and b) document the use of the
-OpenStack command-line clients.
-
-In addition to the guidelines above, exercise scripts MUST follow the structure
-outlined here.  ``swift.sh`` is perhaps the clearest example of these guidelines.
-These scripts are executed serially by ``exercise.sh`` in testing situations.
-
-* Begin and end with a banner that stands out in a sea of script logs to aid
-  in debugging failures, particularly in automated testing situations.  If the
-  end banner is not displayed, the script ended prematurely and can be assumed
-  to have failed.
-
-  ::
-
-    echo "**************************************************"
-    echo "Begin DevStack Exercise: $0"
-    echo "**************************************************"
-    ...
-    set +o xtrace
-    echo "**************************************************"
-    echo "End DevStack Exercise: $0"
-    echo "**************************************************"
-
-* The scripts will generally have the shell ``xtrace`` attribute set to display
-  the actual commands being executed, and the ``errexit`` attribute set to exit
-  the script on non-zero exit codes::
-
-    # This script exits on an error so that errors don't compound and you see
-    # only the first error that occurred.
-    set -o errexit
-
-    # Print the commands being run so that we can see the command that triggers
-    # an error.  It is also useful for following as the install occurs.
-    set -o xtrace
-
-* Settings and configuration are stored in ``exerciserc``, which must be
-  sourced after ``openrc`` or ``stackrc``::
-
-    # Import exercise configuration
-    source $TOP_DIR/exerciserc
-
-* There are a couple of helper functions in the common ``functions`` sub-script
-  that will check for non-zero exit codes and unset environment variables and
-  print a message and exit the script.  These should be called after most client
-  commands that are not otherwise checked to short-circuit long timeouts
-  (instance boot failure, for example)::
-
-    swift post $CONTAINER
-    die_if_error "Failure creating container $CONTAINER"
-
-    FLOATING_IP=`euca-allocate-address | cut -f2`
-    die_if_not_set FLOATING_IP "Failure allocating floating IP"
-
-* If you want an exercise to be skipped when for example a service wasn't
-  enabled for the exercise to be run, you can exit your exercise with the
-  special exitcode 55 and it will be detected as skipped.
-
-* The exercise scripts should only use the various OpenStack client binaries to
-  interact with OpenStack.  This specifically excludes any ``*-manage`` tools
-  as those assume direct access to configuration and databases, as well as direct
-  database access from the exercise itself.
-
-* If specific configuration needs to be present for the exercise to complete,
-  it should be staged in ``stack.sh``, or called from ``stack.sh``.
-
-* The ``OS_*`` environment variables should be the only ones used for all
-  authentication to OpenStack clients as documented in the CLIAuth_ wiki page.
-
-.. _CLIAuth: https://wiki.openstack.org/CLIAuth
-
-* The exercise MUST clean up after itself if successful.  If it is not successful,
-  it is assumed that state will be left behind; this allows a chance for developers
-  to look around and attempt to debug the problem.  The exercise SHOULD clean up
-  or graciously handle possible artifacts left over from previous runs if executed
-  again.  It is acceptable to require a reboot or even a re-install of DevStack
-  to restore a clean test environment.
-
-
 Bash Style Guidelines
 ~~~~~~~~~~~~~~~~~~~~~
 DevStack defines a bash set of best practices for maintaining large
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 7efe4d6eee..46e50df6bb 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -665,8 +665,7 @@ following to your ``localrc`` section:
     enable_service n-cell
 
 Be aware that there are some features currently missing in cells, one
-notable one being security groups.  The exercises have been patched to
-disable functionality not supported by cells.
+notable one being security groups.
 
 Cinder
 ~~~~~~
@@ -729,44 +728,6 @@ use the v3 API. It is possible to setup keystone without v2 API, by doing:
 
     ENABLE_IDENTITY_V2=False
 
-Exercises
-~~~~~~~~~
-
-``exerciserc`` is used to configure settings for the exercise scripts.
-The values shown below are the default values. These can all be
-overridden by setting them in the ``localrc`` section.
-
-* Max time to wait while vm goes from build to active state
-
-    ::
-
-        ACTIVE_TIMEOUT==30
-
-* Max time to wait for proper IP association and dis-association.
-
-    ::
-
-        ASSOCIATE_TIMEOUT=15
-
-* Max time till the vm is bootable
-
-    ::
-
-        BOOT_TIMEOUT=30
-
-* Max time from run instance command until it is running
-
-    ::
-
-        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
-
-* Max time to wait for a vm to terminate
-
-    ::
-
-        TERMINATE_TIMEOUT=30
-
-
 .. _arch-configuration:
 
 Architectures
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 48a4fa8b12..515ea9a9ee 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -127,7 +127,3 @@ computers on the local network. In this example that would be
 http://192.168.1.201/ for the dashboard (aka Horizon). Launch VMs and if
 you give them floating IPs and security group access those VMs will be
 accessible from other machines on your network.
-
-Some examples of using the OpenStack command-line clients ``nova`` and
-``glance`` are in the shakedown scripts in ``devstack/exercises``.
-``exercise.sh`` will run all of those scripts and report on the results.
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 814a2b148b..2479cd0bc8 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -75,11 +75,3 @@ Node Configurations
 
 -  single node
 -  multi-node configurations as are tested by the gate
-
-Exercises
----------
-
-The DevStack exercise scripts are no longer used as integration and gate
-testing as that job has transitioned to Tempest. They are still
-maintained as a demonstrations of using OpenStack from the command line
-and for quick operational testing.
diff --git a/exercise.sh b/exercise.sh
deleted file mode 100755
index 90670333a1..0000000000
--- a/exercise.sh
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-
-# **exercise.sh**
-
-# Keep track of the current DevStack directory.
-TOP_DIR=$(cd $(dirname "$0") && pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Load local configuration
-source $TOP_DIR/stackrc
-
-# Run everything in the exercises/ directory that isn't explicitly disabled
-
-# comma separated list of script basenames to skip
-# to refrain from exercising foo.sh use ``SKIP_EXERCISES=foo``
-SKIP_EXERCISES=${SKIP_EXERCISES:-""}
-
-# comma separated list of script basenames to run
-# to run only foo.sh use ``RUN_EXERCISES=foo``
-basenames=${RUN_EXERCISES:-""}
-
-EXERCISE_DIR=$TOP_DIR/exercises
-
-if [[ -z "${basenames}" ]]; then
-    # Locate the scripts we should run
-    basenames=$(for b in `ls $EXERCISE_DIR/*.sh`; do basename $b .sh; done)
-else
-    # If ``RUN_EXERCISES`` was specified, ignore ``SKIP_EXERCISES``.
-    SKIP_EXERCISES=
-fi
-
-# Track the state of each script
-passes=""
-failures=""
-skips=""
-
-# Loop over each possible script (by basename)
-for script in $basenames; do
-    if [[ ,$SKIP_EXERCISES, =~ ,$script, ]]; then
-        skips="$skips $script"
-    else
-        echo "====================================================================="
-        echo Running $script
-        echo "====================================================================="
-        $EXERCISE_DIR/$script.sh
-        exitcode=$?
-        if [[ $exitcode == 55 ]]; then
-            skips="$skips $script"
-        elif [[ $exitcode -ne 0 ]]; then
-            failures="$failures $script"
-        else
-            passes="$passes $script"
-        fi
-    fi
-done
-
-# Output status of exercise run
-echo "====================================================================="
-for script in $skips; do
-    echo SKIP $script
-done
-for script in $passes; do
-    echo PASS $script
-done
-for script in $failures; do
-    echo FAILED $script
-done
-echo "====================================================================="
-
-if [[ -n "$failures" ]]; then
-    exit 1
-fi
diff --git a/exerciserc b/exerciserc
deleted file mode 100644
index 978e0b3791..0000000000
--- a/exerciserc
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-#
-# source exerciserc
-#
-# Configure the DevStack exercise scripts
-# For best results, source this _after_ stackrc/localrc as it will set
-# values only if they are not already set.
-
-# Max time to wait while vm goes from build to active state
-export ACTIVE_TIMEOUT=${ACTIVE_TIMEOUT:-30}
-
-# Max time to wait for proper IP association and dis-association.
-export ASSOCIATE_TIMEOUT=${ASSOCIATE_TIMEOUT:-15}
-
-# Max time till the vm is bootable
-export BOOT_TIMEOUT=${BOOT_TIMEOUT:-30}
-
-# Max time from run instance command until it is running
-export RUNNING_TIMEOUT=${RUNNING_TIMEOUT:-$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))}
-
-# Max time to wait for a vm to terminate
-export TERMINATE_TIMEOUT=${TERMINATE_TIMEOUT:-30}
-
-# The size of the volume we want to boot from; some storage back-ends
-# do not allow a disk resize, so it's important that this can be tuned
-export DEFAULT_VOLUME_SIZE=${DEFAULT_VOLUME_SIZE:-1}
diff --git a/exercises/aggregates.sh b/exercises/aggregates.sh
deleted file mode 100755
index 8cbca54fb2..0000000000
--- a/exercises/aggregates.sh
+++ /dev/null
@@ -1,150 +0,0 @@
-#!/usr/bin/env bash
-
-# **aggregates.sh**
-
-# This script demonstrates how to use host aggregates:
-#
-# *  Create an Aggregate
-# *  Updating Aggregate details
-# *  Testing Aggregate metadata
-# *  Testing Aggregate delete
-# *  Testing General Aggregates (https://blueprints.launchpad.net/nova/+spec/general-host-aggregates)
-# *  Testing add/remove hosts (with one host)
-
-echo "**************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "**************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Test as the admin user
-# note this imports stackrc/functions, etc
-. $TOP_DIR/openrc admin admin
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Cells does not support aggregates.
-is_service_enabled n-cell && exit 55
-
-# Create an aggregate
-# ===================
-
-AGGREGATE_NAME=test_aggregate_$RANDOM
-AGGREGATE2_NAME=test_aggregate_$RANDOM
-AGGREGATE_A_ZONE=nova
-
-function exit_if_aggregate_present {
-    aggregate_name=$1
-
-    if [ $(nova aggregate-list | grep -c " $aggregate_name ") == 0 ]; then
-        echo "SUCCESS $aggregate_name not present"
-    else
-        die $LINENO "found aggregate: $aggregate_name"
-        exit -1
-    fi
-}
-
-exit_if_aggregate_present $AGGREGATE_NAME
-
-AGGREGATE_ID=$(nova aggregate-create $AGGREGATE_NAME $AGGREGATE_A_ZONE | grep " $AGGREGATE_NAME " | get_field 1)
-die_if_not_set $LINENO AGGREGATE_ID "Failure creating AGGREGATE_ID for $AGGREGATE_NAME $AGGREGATE_A_ZONE"
-
-AGGREGATE2_ID=$(nova aggregate-create $AGGREGATE2_NAME $AGGREGATE_A_ZONE | grep " $AGGREGATE2_NAME " | get_field 1)
-die_if_not_set $LINENO AGGREGATE2_ID "Fail creating AGGREGATE2_ID for $AGGREGATE2_NAME $AGGREGATE_A_ZONE"
-
-# check aggregate created
-nova aggregate-list | grep -q " $AGGREGATE_NAME " || die $LINENO "Aggregate $AGGREGATE_NAME not created"
-
-
-# Ensure creating a duplicate fails
-# =================================
-
-if nova aggregate-create $AGGREGATE_NAME $AGGREGATE_A_ZONE; then
-    die $LINENO "could create duplicate aggregate"
-fi
-
-
-# Test aggregate-update (and aggregate-details)
-# =============================================
-AGGREGATE_NEW_NAME=test_aggregate_$RANDOM
-
-nova aggregate-update $AGGREGATE_ID $AGGREGATE_NEW_NAME
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_NEW_NAME
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_A_ZONE
-
-nova aggregate-update $AGGREGATE_ID $AGGREGATE_NAME $AGGREGATE_A_ZONE
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_NAME
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_A_ZONE
-
-
-# Test aggregate-set-metadata
-# ===========================
-META_DATA_1_KEY=asdf
-META_DATA_2_KEY=foo
-META_DATA_3_KEY=bar
-
-#ensure no additional metadata is set
-nova aggregate-details $AGGREGATE_ID | egrep "\|[{u ]*'availability_zone.+$AGGREGATE_A_ZONE'[ }]*\|"
-
-nova aggregate-set-metadata $AGGREGATE_ID ${META_DATA_1_KEY}=123
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | grep 123
-
-nova aggregate-set-metadata $AGGREGATE_ID ${META_DATA_2_KEY}=456
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_2_KEY
-
-nova aggregate-set-metadata $AGGREGATE_ID $META_DATA_2_KEY ${META_DATA_3_KEY}=789
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_3_KEY
-
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_2_KEY && die $LINENO "ERROR metadata was not cleared"
-
-nova aggregate-set-metadata $AGGREGATE_ID $META_DATA_3_KEY $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | egrep "\|[{u ]*'availability_zone.+$AGGREGATE_A_ZONE'[ }]*\|"
-
-
-# Test aggregate-add/remove-host
-# ==============================
-if [ "$VIRT_DRIVER" == "xenserver" ]; then
-    echo "TODO(johngarbutt) add tests for add/remove host from pool aggregate"
-fi
-FIRST_HOST=$(nova host-list | grep compute | get_field 1 | head -1)
-# Make sure can add two aggregates to same host
-nova aggregate-add-host $AGGREGATE_ID $FIRST_HOST
-nova aggregate-add-host $AGGREGATE2_ID $FIRST_HOST
-if nova aggregate-add-host $AGGREGATE2_ID $FIRST_HOST; then
-    die $LINENO "could add duplicate host to single aggregate"
-fi
-nova aggregate-remove-host $AGGREGATE2_ID $FIRST_HOST
-nova aggregate-remove-host $AGGREGATE_ID $FIRST_HOST
-
-# Test aggregate-delete
-# =====================
-nova aggregate-delete $AGGREGATE_ID
-nova aggregate-delete $AGGREGATE2_ID
-exit_if_aggregate_present $AGGREGATE_NAME
-
-set +o xtrace
-echo "**************************************************"
-echo "End DevStack Exercise: $0"
-echo "**************************************************"
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
deleted file mode 100755
index 7478bdf138..0000000000
--- a/exercises/boot_from_volume.sh
+++ /dev/null
@@ -1,224 +0,0 @@
-#!/usr/bin/env bash
-
-# **boot_from_volume.sh**
-
-# This script demonstrates how to boot from a volume.  It does the following:
-#
-# *  Create a bootable volume
-# *  Boot a volume-backed instance
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import project functions
-source $TOP_DIR/lib/cinder
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If cinder is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled cinder || exit 55
-
-# Ironic does not support boot from volume.
-[ "$VIRT_DRIVER" == "ironic" ] && exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-boot_secgroup}
-
-# Instance and volume names
-VM_NAME=${VM_NAME:-ex-bfv-inst}
-VOL_NAME=${VOL_NAME:-ex-vol-bfv}
-
-
-# Launching a server
-# ==================
-
-# List servers for project:
-nova list
-
-# Images
-# ------
-
-# List the images available
-openstack image list
-
-# Grab the id of the image to launch
-IMAGE=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-# Security Groups
-# ---------------
-
-# List security groups
-nova secgroup-list
-
-if is_service_enabled n-cell; then
-    # Cells does not support security groups, so force the use of "default"
-    SECGROUP="default"
-    echo "Using the default security group because of Cells."
-else
-    # Create a secgroup
-    if ! nova secgroup-list | grep -q $SECGROUP; then
-        nova secgroup-create $SECGROUP "$SECGROUP description"
-        if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova secgroup-list | grep -q $SECGROUP; do sleep 1; done"; then
-            echo "Security group not created"
-            exit 1
-        fi
-    fi
-fi
-
-# Configure Security Group Rules
-if ! nova secgroup-list-rules $SECGROUP | grep -q icmp; then
-    nova secgroup-add-rule $SECGROUP icmp -1 -1 0.0.0.0/0
-fi
-if ! nova secgroup-list-rules $SECGROUP | grep -q " tcp .* 22 "; then
-    nova secgroup-add-rule $SECGROUP tcp 22 22 0.0.0.0/0
-fi
-
-# List secgroup rules
-nova secgroup-list-rules $SECGROUP
-
-# Set up instance
-# ---------------
-
-# List flavors
-nova flavor-list
-
-# Select a flavor
-INSTANCE_TYPE=$(nova flavor-list | grep $DEFAULT_INSTANCE_TYPE | get_field 1)
-if [[ -z "$INSTANCE_TYPE" ]]; then
-    # grab the first flavor in the list to launch if default doesn't exist
-    INSTANCE_TYPE=$(nova flavor-list | head -n 4 | tail -n 1 | get_field 1)
-fi
-
-# Clean-up from previous runs
-nova delete $VM_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while nova show $VM_NAME; do sleep 1; done"; then
-    echo "server didn't terminate!"
-    exit 1
-fi
-
-# Setup Keypair
-KEY_NAME=test_key
-KEY_FILE=key.pem
-nova keypair-delete $KEY_NAME || true
-nova keypair-add $KEY_NAME > $KEY_FILE
-chmod 600 $KEY_FILE
-
-# Set up volume
-# -------------
-
-# Delete any old volume
-cinder delete $VOL_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not deleted"
-    exit 1
-fi
-
-# Create the bootable volume
-start_time=$(date +%s)
-cinder create --image-id $IMAGE --display-name=$VOL_NAME --display-description "test bootable volume: $VOL_NAME" $DEFAULT_VOLUME_SIZE || \
-    die $LINENO "Failure creating volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not created"
-    exit 1
-fi
-end_time=$(date +%s)
-echo "Completed cinder create in $((end_time - start_time)) seconds"
-
-# Get volume ID
-VOL_ID=$(cinder list | grep $VOL_NAME  | get_field 1)
-die_if_not_set $LINENO VOL_ID "Failure retrieving volume ID for $VOL_NAME"
-
-# Boot instance
-# -------------
-
-# Boot using the --block-device-mapping param. The format of mapping is:
-# <dev_name>=<id>:<type>:<size(GB)>:<delete_on_terminate>
-# Leaving the middle two fields blank appears to do-the-right-thing
-VM_UUID=$(nova boot --flavor $INSTANCE_TYPE --image $IMAGE --block-device-mapping vda=$VOL_ID --security-groups=$SECGROUP --key-name $KEY_NAME $VM_NAME | grep ' id ' | get_field 2)
-die_if_not_set $LINENO VM_UUID "Failure launching $VM_NAME"
-
-# Check that the status is active within ACTIVE_TIMEOUT seconds
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-    echo "server didn't become active!"
-    exit 1
-fi
-
-# Get the instance IP
-IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
-
-die_if_not_set $LINENO IP "Failure retrieving IP address"
-
-# Private IPs can be pinged in single node deployments
-ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
-
-# Clean up
-# --------
-
-# Delete volume backed instance
-nova delete $VM_UUID || die $LINENO "Failure deleting instance $VM_NAME"
-if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q $VM_UUID; do sleep 1; done"; then
-    echo "Server $VM_NAME not deleted"
-    exit 1
-fi
-
-# Wait for volume to be released
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not released"
-    exit 1
-fi
-
-# Delete volume
-start_time=$(date +%s)
-cinder delete $VOL_ID || die $LINENO "Failure deleting volume $VOLUME_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not deleted"
-    exit 1
-fi
-end_time=$(date +%s)
-echo "Completed cinder delete in $((end_time - start_time)) seconds"
-
-if [[ $SECGROUP = "default" ]] ; then
-    echo "Skipping deleting default security group"
-else
-    # Delete secgroup
-    nova secgroup-delete $SECGROUP || die $LINENO "Failure deleting security group $SECGROUP"
-fi
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
deleted file mode 100755
index b380968da8..0000000000
--- a/exercises/client-args.sh
+++ /dev/null
@@ -1,174 +0,0 @@
-#!/usr/bin/env bash
-
-# **client-args.sh**
-
-# Test OpenStack client authentication arguments handling
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Unset all of the known NOVA_* vars
-unset NOVA_API_KEY
-unset NOVA_ENDPOINT_NAME
-unset NOVA_PASSWORD
-unset NOVA_PROJECT_ID
-unset NOVA_REGION_NAME
-unset NOVA_URL
-unset NOVA_USERNAME
-
-# Save the known variables for later
-export x_PROJECT_NAME=$OS_PROJECT_NAME
-export x_USERNAME=$OS_USERNAME
-export x_PASSWORD=$OS_PASSWORD
-export x_AUTH_URL=$OS_AUTH_URL
-
-# Unset the usual variables to force argument processing
-unset OS_PROJECT_NAME
-unset OS_USERNAME
-unset OS_PASSWORD
-unset OS_AUTH_URL
-
-# Common authentication args
-PROJECT_ARG="--os-project-name=$x_PROJECT_NAME"
-ARGS="--os-username=$x_USERNAME --os-password=$x_PASSWORD --os-auth-url=$x_AUTH_URL"
-
-# Set global return
-RETURN=0
-
-# Keystone client
-# ---------------
-if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "key" ]]; then
-        STATUS_KEYSTONE="Skipped"
-    else
-        echo -e "\nTest Keystone"
-        if openstack $PROJECT_ARG $ARGS catalog show identity; then
-            STATUS_KEYSTONE="Succeeded"
-        else
-            STATUS_KEYSTONE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Nova client
-# -----------
-
-if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
-        STATUS_NOVA="Skipped"
-    else
-        # Test OSAPI
-        echo -e "\nTest Nova"
-        if nova $PROJECT_ARG $ARGS flavor-list; then
-            STATUS_NOVA="Succeeded"
-        else
-            STATUS_NOVA="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Cinder client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "c-api" ]]; then
-        STATUS_CINDER="Skipped"
-    else
-        echo -e "\nTest Cinder"
-        if cinder $PROJECT_ARG $ARGS list; then
-            STATUS_CINDER="Succeeded"
-        else
-            STATUS_CINDER="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Glance client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "g-api" ]]; then
-        STATUS_GLANCE="Skipped"
-    else
-        echo -e "\nTest Glance"
-        if openstack $PROJECT_ARG $ARGS image list; then
-            STATUS_GLANCE="Succeeded"
-        else
-            STATUS_GLANCE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Swift client
-# ------------
-
-if [[ "$ENABLED_SERVICES" =~ "swift" || "$ENABLED_SERVICES" =~ "s-proxy" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "swift" ]]; then
-        STATUS_SWIFT="Skipped"
-    else
-        echo -e "\nTest Swift"
-        if swift $PROJECT_ARG $ARGS stat; then
-            STATUS_SWIFT="Succeeded"
-        else
-            STATUS_SWIFT="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-set +o xtrace
-
-
-# Results
-# =======
-
-function report {
-    if [[ -n "$2" ]]; then
-        echo "$1: $2"
-    fi
-}
-
-echo -e "\n"
-report "Keystone" $STATUS_KEYSTONE
-report "Nova" $STATUS_NOVA
-report "Cinder" $STATUS_CINDER
-report "Glance" $STATUS_GLANCE
-report "Swift" $STATUS_SWIFT
-
-if (( $RETURN == 0 )); then
-    echo "*********************************************************************"
-    echo "SUCCESS: End DevStack Exercise: $0"
-    echo "*********************************************************************"
-fi
-
-exit $RETURN
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
deleted file mode 100755
index fff04df9f2..0000000000
--- a/exercises/client-env.sh
+++ /dev/null
@@ -1,171 +0,0 @@
-#!/usr/bin/env bash
-
-# **client-env.sh**
-
-# Test OpenStack client environment variable handling
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc admin
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Unset all of the known NOVA_* vars
-unset NOVA_API_KEY
-unset NOVA_ENDPOINT_NAME
-unset NOVA_PASSWORD
-unset NOVA_PROJECT_ID
-unset NOVA_REGION_NAME
-unset NOVA_URL
-unset NOVA_USERNAME
-
-for i in OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_AUTH_URL; do
-    is_set $i
-    if [[ $? -ne 0 ]]; then
-        echo "$i expected to be set"
-        ABORT=1
-    fi
-done
-if [[ -n "$ABORT" ]]; then
-    exit 1
-fi
-
-# Set global return
-RETURN=0
-
-# Keystone client
-# ---------------
-if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "key" ]]; then
-        STATUS_KEYSTONE="Skipped"
-    else
-        echo -e "\nTest Keystone"
-        if openstack endpoint show identity; then
-            STATUS_KEYSTONE="Succeeded"
-        else
-            STATUS_KEYSTONE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Nova client
-# -----------
-
-if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
-        STATUS_NOVA="Skipped"
-    else
-        # Test OSAPI
-        echo -e "\nTest Nova"
-        if nova flavor-list; then
-            STATUS_NOVA="Succeeded"
-        else
-            STATUS_NOVA="Failed"
-            RETURN=1
-        fi
-
-    fi
-fi
-
-# Cinder client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "c-api" ]]; then
-        STATUS_CINDER="Skipped"
-    else
-        echo -e "\nTest Cinder"
-        if cinder list; then
-            STATUS_CINDER="Succeeded"
-        else
-            STATUS_CINDER="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Glance client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "g-api" ]]; then
-        STATUS_GLANCE="Skipped"
-    else
-        echo -e "\nTest Glance"
-        if openstack image list; then
-            STATUS_GLANCE="Succeeded"
-        else
-            STATUS_GLANCE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Swift client
-# ------------
-
-
-if [[ "$ENABLED_SERVICES" =~ "swift" || "$ENABLED_SERVICES" =~ "s-proxy" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "swift" ]]; then
-        STATUS_SWIFT="Skipped"
-    else
-        echo -e "\nTest Swift"
-        if swift stat; then
-            STATUS_SWIFT="Succeeded"
-        else
-            STATUS_SWIFT="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-set +o xtrace
-
-
-# Results
-# =======
-
-function report {
-    if [[ -n "$2" ]]; then
-        echo "$1: $2"
-    fi
-}
-
-echo -e "\n"
-report "Keystone" $STATUS_KEYSTONE
-report "Nova" $STATUS_NOVA
-report "Cinder" $STATUS_CINDER
-report "Glance" $STATUS_GLANCE
-report "Swift" $STATUS_SWIFT
-
-if (( $RETURN == 0 )); then
-    echo "*********************************************************************"
-    echo "SUCCESS: End DevStack Exercise: $0"
-    echo "*********************************************************************"
-fi
-
-exit $RETURN
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
deleted file mode 100755
index 5abc7137b3..0000000000
--- a/exercises/floating_ips.sh
+++ /dev/null
@@ -1,216 +0,0 @@
-#!/usr/bin/env bash
-
-# **floating_ips.sh** - using the cloud can be fun
-
-# Test instance connectivity with the ``nova`` command from ``python-novaclient``
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import project functions
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-test_secgroup}
-
-# Default floating IP pool name
-DEFAULT_FLOATING_POOL=${DEFAULT_FLOATING_POOL:-public}
-
-# Additional floating IP pool and range
-TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
-
-# Instance name
-VM_NAME="ex-float"
-
-# Cells does not support floating ips API calls
-is_service_enabled n-cell && exit 55
-
-# Launching a server
-# ==================
-
-# List servers for tenant:
-nova list
-
-# Images
-# ------
-
-# List the images available
-openstack image list
-
-# Grab the id of the image to launch
-IMAGE=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-# Security Groups
-# ---------------
-
-# List security groups
-nova secgroup-list
-
-# Create a secgroup
-if ! nova secgroup-list | grep -q $SECGROUP; then
-    nova secgroup-create $SECGROUP "$SECGROUP description"
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova secgroup-list | grep -q $SECGROUP; do sleep 1; done"; then
-        die $LINENO "Security group not created"
-    fi
-fi
-
-# Configure Security Group Rules
-if ! nova secgroup-list-rules $SECGROUP | grep -q icmp; then
-    nova secgroup-add-rule $SECGROUP icmp -1 -1 0.0.0.0/0
-fi
-if ! nova secgroup-list-rules $SECGROUP | grep -q " tcp .* 22 "; then
-    nova secgroup-add-rule $SECGROUP tcp 22 22 0.0.0.0/0
-fi
-
-# List secgroup rules
-nova secgroup-list-rules $SECGROUP
-
-# Set up instance
-# ---------------
-
-# List flavors
-nova flavor-list
-
-# Select a flavor
-INSTANCE_TYPE=$(nova flavor-list | grep $DEFAULT_INSTANCE_TYPE | get_field 1)
-if [[ -z "$INSTANCE_TYPE" ]]; then
-    # grab the first flavor in the list to launch if default doesn't exist
-    INSTANCE_TYPE=$(nova flavor-list | head -n 4 | tail -n 1 | get_field 1)
-    die_if_not_set $LINENO INSTANCE_TYPE "Failure retrieving INSTANCE_TYPE"
-fi
-
-# Clean-up from previous runs
-nova delete $VM_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while nova show $VM_NAME; do sleep 1; done"; then
-    die $LINENO "server didn't terminate!"
-    exit 1
-fi
-
-# Boot instance
-# -------------
-
-VM_UUID=$(nova boot --flavor $INSTANCE_TYPE --image $IMAGE --security-groups=$SECGROUP $VM_NAME | grep ' id ' | get_field 2)
-die_if_not_set $LINENO VM_UUID "Failure launching $VM_NAME"
-
-# Check that the status is active within ACTIVE_TIMEOUT seconds
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-    die $LINENO "server didn't become active!"
-fi
-
-# Get the instance IP
-IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
-die_if_not_set $LINENO IP "Failure retrieving IP address"
-
-# Private IPs can be pinged in single node deployments
-ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
-
-# Floating IPs
-# ------------
-
-# Allocate a floating IP from the default pool
-FLOATING_IP=$(nova floating-ip-create | grep $DEFAULT_FLOATING_POOL | get_field 1)
-die_if_not_set $LINENO FLOATING_IP "Failure creating floating IP from pool $DEFAULT_FLOATING_POOL"
-
-# List floating addresses
-if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova floating-ip-list | grep -q $FLOATING_IP; do sleep 1; done"; then
-    die $LINENO "Floating IP not allocated"
-fi
-
-# Add floating IP to our server
-nova add-floating-ip $VM_UUID $FLOATING_IP || \
-    die $LINENO "Failure adding floating IP $FLOATING_IP to $VM_NAME"
-
-# Test we can ping our floating IP within ASSOCIATE_TIMEOUT seconds
-ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME"
-
-if ! is_service_enabled neutron; then
-    # Allocate an IP from second floating pool
-    TEST_FLOATING_IP=$(nova floating-ip-create $TEST_FLOATING_POOL | grep $TEST_FLOATING_POOL | get_field 1)
-    die_if_not_set $LINENO TEST_FLOATING_IP "Failure creating floating IP in $TEST_FLOATING_POOL"
-
-    # list floating addresses
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova floating-ip-list | grep $TEST_FLOATING_POOL | grep -q $TEST_FLOATING_IP; do sleep 1; done"; then
-        die $LINENO "Floating IP not allocated"
-    fi
-fi
-
-# Dis-allow icmp traffic (ping)
-nova secgroup-delete-rule $SECGROUP icmp -1 -1 0.0.0.0/0 || \
-    die $LINENO "Failure deleting security group rule from $SECGROUP"
-
-if ! timeout $ASSOCIATE_TIMEOUT sh -c "while nova secgroup-list-rules $SECGROUP | grep -q icmp; do sleep 1; done"; then
-    die $LINENO "Security group rule not deleted from $SECGROUP"
-fi
-
-# FIXME (anthony): make xs support security groups
-if [ "$VIRT_DRIVER" != "ironic" -a "$VIRT_DRIVER" != "xenserver" -a "$VIRT_DRIVER" != "openvz" ]; then
-    # Test we can aren't able to ping our floating ip within ASSOCIATE_TIMEOUT seconds
-    ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME" Fail
-fi
-
-# Clean up
-# --------
-
-if ! is_service_enabled neutron; then
-    # Delete second floating IP
-    nova floating-ip-delete $TEST_FLOATING_IP || \
-        die $LINENO "Failure deleting floating IP $TEST_FLOATING_IP"
-fi
-
-# Delete the floating ip
-nova floating-ip-delete $FLOATING_IP || \
-    die $LINENO "Failure deleting floating IP $FLOATING_IP"
-
-# Delete instance
-nova delete $VM_UUID || die $LINENO "Failure deleting instance $VM_NAME"
-# Wait for termination
-if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q $VM_UUID; do sleep 1; done"; then
-    die $LINENO "Server $VM_NAME not deleted"
-fi
-
-# Delete secgroup
-nova secgroup-delete $SECGROUP || \
-    die $LINENO "Failure deleting security group $SECGROUP"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
deleted file mode 100755
index e8c8f62140..0000000000
--- a/exercises/neutron-adv-test.sh
+++ /dev/null
@@ -1,466 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright 2012, Cisco Systems
-# Copyright 2012, VMware, Inc.
-# Copyright 2012, NTT MCL, Inc.
-#
-# Please direct any questions to dedutta@cisco.com, dwendlandt@vmware.com, nachi@nttmcl.com
-#
-# **neutron-adv-test.sh**
-
-# Perform integration testing of Nova and other components with Neutron.
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-
-set -o errtrace
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-# Environment
-# -----------
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import neutron functions
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# If neutron is not enabled we exit with exitcode 55, which means exercise is skipped.
-neutron_plugin_check_adv_test_requirements || exit 55
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Neutron Settings
-# ----------------
-
-PROJECTS="DEMO1"
-# TODO (nati)_Test public network
-#PROJECTS="DEMO1,DEMO2"
-
-PUBLIC_NAME="admin"
-DEMO1_NAME="demo1"
-DEMO2_NAME="demo2"
-
-PUBLIC_NUM_NET=1
-DEMO1_NUM_NET=1
-DEMO2_NUM_NET=2
-
-PUBLIC_NET1_CIDR="200.0.0.0/24"
-DEMO1_NET1_CIDR="10.10.0.0/24"
-DEMO2_NET1_CIDR="10.20.0.0/24"
-DEMO2_NET2_CIDR="10.20.1.0/24"
-
-PUBLIC_NET1_GATEWAY="200.0.0.1"
-DEMO1_NET1_GATEWAY="10.10.0.1"
-DEMO2_NET1_GATEWAY="10.20.0.1"
-DEMO2_NET2_GATEWAY="10.20.1.1"
-
-PUBLIC_NUM_VM=1
-DEMO1_NUM_VM=1
-DEMO2_NUM_VM=2
-
-PUBLIC_VM1_NET='admin-net1'
-DEMO1_VM1_NET='demo1-net1'
-# Multinic settings. But this is fail without nic setting in OS image
-DEMO2_VM1_NET='demo2-net1'
-DEMO2_VM2_NET='demo2-net2'
-
-PUBLIC_NUM_ROUTER=1
-DEMO1_NUM_ROUTER=1
-DEMO2_NUM_ROUTER=1
-
-PUBLIC_ROUTER1_NET="admin-net1"
-DEMO1_ROUTER1_NET="demo1-net1"
-DEMO2_ROUTER1_NET="demo2-net1"
-
-# Various functions
-# -----------------
-
-function foreach_project {
-    COMMAND=$1
-    for PROJECT in ${PROJECTS//,/ };do
-        eval ${COMMAND//%PROJECT%/$PROJECT}
-    done
-}
-
-function foreach_project_resource {
-    COMMAND=$1
-    RESOURCE=$2
-    for PROJECT in ${PROJECTS//,/ };do
-        eval 'NUM=$'"${PROJECT}_NUM_$RESOURCE"
-        for i in `seq $NUM`;do
-            local COMMAND_LOCAL=${COMMAND//%PROJECT%/$PROJECT}
-            COMMAND_LOCAL=${COMMAND_LOCAL//%NUM%/$i}
-            eval $COMMAND_LOCAL
-        done
-    done
-}
-
-function foreach_project_vm {
-    COMMAND=$1
-    foreach_project_resource "$COMMAND" 'VM'
-}
-
-function foreach_project_net {
-    COMMAND=$1
-    foreach_project_resource "$COMMAND" 'NET'
-}
-
-function get_image_id {
-    local IMAGE_ID
-    IMAGE_ID=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-    die_if_not_set $LINENO IMAGE_ID "Failure retrieving IMAGE_ID"
-    echo "$IMAGE_ID"
-}
-
-function get_project_id {
-    local PROJECT_NAME=$1
-    local PROJECT_ID
-    PROJECT_ID=`openstack project list | grep " $PROJECT_NAME " | head -n 1 | get_field 1`
-    die_if_not_set $LINENO PROJECT_ID "Failure retrieving PROJECT_ID for $PROJECT_NAME"
-    echo "$PROJECT_ID"
-}
-
-function get_user_id {
-    local USER_NAME=$1
-    local USER_ID
-    USER_ID=`openstack user list | grep $USER_NAME | awk '{print $2}'`
-    die_if_not_set $LINENO USER_ID "Failure retrieving USER_ID for $USER_NAME"
-    echo "$USER_ID"
-}
-
-function get_role_id {
-    local ROLE_NAME=$1
-    local ROLE_ID
-    ROLE_ID=`openstack role assignment list | grep $ROLE_NAME | awk '{print $2}'`
-    die_if_not_set $LINENO ROLE_ID "Failure retrieving ROLE_ID for $ROLE_NAME"
-    echo "$ROLE_ID"
-}
-
-function get_network_id {
-    local NETWORK_NAME="$1"
-    local NETWORK_ID
-    NETWORK_ID=`openstack network show -f value -c id $NETWORK_NAME`
-    echo $NETWORK_ID
-}
-
-function get_flavor_id {
-    local INSTANCE_TYPE=$1
-    local FLAVOR_ID
-    FLAVOR_ID=`nova flavor-list | grep $INSTANCE_TYPE | awk '{print $2}'`
-    die_if_not_set $LINENO FLAVOR_ID "Failure retrieving FLAVOR_ID for $INSTANCE_TYPE"
-    echo "$FLAVOR_ID"
-}
-
-function confirm_server_active {
-    local VM_UUID=$1
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-        echo "server '$VM_UUID' did not become active!"
-        false
-    fi
-}
-
-function neutron_debug_admin {
-    local os_username=$OS_USERNAME
-    local os_project_id=$OS_PROJECT_ID
-    source $TOP_DIR/openrc admin admin
-    neutron-debug $@
-    source $TOP_DIR/openrc $os_username $os_project_id
-}
-
-function add_project {
-    openstack project create $1
-    openstack user create $2 --password ${ADMIN_PASSWORD} --project $1
-    openstack role add Member --project $1 --user $2
-}
-
-function remove_project {
-    local PROJECT=$1
-    local PROJECT_ID
-    PROJECT_ID=$(get_project_id $PROJECT)
-    openstack project delete $PROJECT_ID
-}
-
-function remove_user {
-    local USER=$1
-    local USER_ID
-    USER_ID=$(get_user_id $USER)
-    openstack user delete $USER_ID
-}
-
-function create_projects {
-    source $TOP_DIR/openrc admin admin
-    add_project demo1 demo1 demo1
-    add_project demo2 demo2 demo2
-    source $TOP_DIR/openrc demo demo
-}
-
-function delete_projects_and_users {
-    source $TOP_DIR/openrc admin admin
-    remove_user demo1
-    remove_project demo1
-    remove_user demo2
-    remove_project demo2
-    echo "removed all projects"
-    source $TOP_DIR/openrc demo demo
-}
-
-function create_network {
-    local PROJECT=$1
-    local GATEWAY=$2
-    local CIDR=$3
-    local NUM=$4
-    local EXTRA=$5
-    local NET_NAME="${PROJECT}-net$NUM"
-    local ROUTER_NAME="${PROJECT}-router${NUM}"
-    source $TOP_DIR/openrc admin admin
-    local PROJECT_ID
-    PROJECT_ID=$(get_project_id $PROJECT)
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    local NET_ID
-    NET_ID=$(openstack network create --project $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
-    die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PROJECT_ID $NET_NAME $EXTRA"
-    openstack subnet create --ip-version 4 --project $PROJECT_ID --gateway $GATEWAY --subnet-pool None --network $NET_ID --subnet-range $CIDR "${NET_NAME}_subnet"
-    neutron_debug_admin probe-create --device-owner compute $NET_ID
-    source $TOP_DIR/openrc demo demo
-}
-
-function create_networks {
-    foreach_project_net 'create_network ${%PROJECT%_NAME} ${%PROJECT%_NET%NUM%_GATEWAY} ${%PROJECT%_NET%NUM%_CIDR} %NUM% ${%PROJECT%_NET%NUM%_EXTRA}'
-    #TODO(nati) test security group function
-    # allow ICMP for both project's security groups
-    #source $TOP_DIR/openrc demo1 demo1
-    #$NOVA secgroup-add-rule default icmp -1 -1 0.0.0.0/0
-    #source $TOP_DIR/openrc demo2 demo2
-    #$NOVA secgroup-add-rule default icmp -1 -1 0.0.0.0/0
-}
-
-function create_vm {
-    local PROJECT=$1
-    local NUM=$2
-    local NET_NAMES=$3
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    local NIC=""
-    for NET_NAME in ${NET_NAMES//,/ };do
-        NIC="$NIC --nic net-id="`get_network_id $NET_NAME`
-    done
-    #TODO (nati) Add multi-nic test
-    #TODO (nati) Add public-net test
-    local VM_UUID
-    VM_UUID=`nova boot --flavor $(get_flavor_id m1.tiny) \
-        --image $(get_image_id) \
-        $NIC \
-        $PROJECT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
-    die_if_not_set $LINENO VM_UUID "Failure launching $PROJECT-server$NUM"
-    confirm_server_active $VM_UUID
-}
-
-function create_vms {
-    foreach_project_vm 'create_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
-}
-
-function ping_ip {
-    # Test agent connection.  Assumes namespaces are disabled, and
-    # that DHCP is in use, but not L3
-    local VM_NAME=$1
-    local NET_NAME=$2
-    IP=$(get_instance_ip $VM_NAME $NET_NAME)
-    ping_check $IP $BOOT_TIMEOUT $NET_NAME
-}
-
-function check_vm {
-    local PROJECT=$1
-    local NUM=$2
-    local VM_NAME="$PROJECT-server$NUM"
-    local NET_NAME=$3
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    ping_ip $VM_NAME $NET_NAME
-    # TODO (nati) test ssh connection
-    # TODO (nati) test inter connection between vm
-    # TODO (nati) test dhcp host routes
-    # TODO (nati) test multi-nic
-}
-
-function check_vms {
-    foreach_project_vm 'check_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
-}
-
-function shutdown_vm {
-    local PROJECT=$1
-    local NUM=$2
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    VM_NAME=${PROJECT}-server$NUM
-    nova delete $VM_NAME
-}
-
-function shutdown_vms {
-    foreach_project_vm 'shutdown_vm ${%PROJECT%_NAME} %NUM%'
-    if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q ACTIVE; do sleep 1; done"; then
-        die $LINENO "Some VMs failed to shutdown"
-    fi
-}
-
-function delete_network {
-    local PROJECT=$1
-    local NUM=$2
-    local NET_NAME="${PROJECT}-net$NUM"
-    source $TOP_DIR/openrc admin admin
-    local PROJECT_ID
-    PROJECT_ID=$(get_project_id $PROJECT)
-    #TODO(nati) comment out until l3-agent merged
-    #for res in port subnet net router;do
-    for net_id in `openstack network list -c ID -c Name | grep $NET_NAME | awk '{print $2}'`;do
-        delete_probe $net_id
-        openstack subnet list | grep $net_id | awk '{print $2}' | xargs -I% openstack subnet delete %
-        openstack network delete $net_id
-    done
-    source $TOP_DIR/openrc demo demo
-}
-
-function delete_networks {
-    foreach_project_net 'delete_network ${%PROJECT%_NAME} %NUM%'
-    # TODO(nati) add secuirty group check after it is implemented
-    # source $TOP_DIR/openrc demo1 demo1
-    # nova secgroup-delete-rule default icmp -1 -1 0.0.0.0/0
-    # source $TOP_DIR/openrc demo2 demo2
-    # nova secgroup-delete-rule default icmp -1 -1 0.0.0.0/0
-}
-
-function create_all {
-    create_projects
-    create_networks
-    create_vms
-}
-
-function delete_all {
-    shutdown_vms
-    delete_networks
-    delete_projects_and_users
-}
-
-function all {
-    create_all
-    check_vms
-    delete_all
-}
-
-# Test functions
-# --------------
-
-function test_functions {
-    IMAGE=$(get_image_id)
-    echo $IMAGE
-
-    PROJECT_ID=$(get_project_id demo)
-    echo $PROJECT_ID
-
-    FLAVOR_ID=$(get_flavor_id m1.tiny)
-    echo $FLAVOR_ID
-
-    NETWORK_ID=$(get_network_id admin)
-    echo $NETWORK_ID
-}
-
-# Usage and main
-# --------------
-
-function usage {
-    echo "$0: [-h]"
-    echo "  -h, --help              Display help message"
-    echo "  -t, --project            Create projects"
-    echo "  -n, --net               Create networks"
-    echo "  -v, --vm                Create vms"
-    echo "  -c, --check             Check connection"
-    echo "  -x, --delete-projects    Delete projects"
-    echo "  -y, --delete-nets       Delete networks"
-    echo "  -z, --delete-vms        Delete vms"
-    echo "  -T, --test              Test functions"
-}
-
-function main {
-
-    echo Description
-
-    if [ $# -eq 0 ] ; then
-        # if no args are provided, run all tests
-        all
-    else
-
-        while [ "$1" != "" ]; do
-            case $1 in
-                -h | --help )   usage
-                                exit
-                                ;;
-                -n | --net )    create_networks
-                                exit
-                                ;;
-                -v | --vm )     create_vms
-                                exit
-                                ;;
-                -t | --project ) create_projects
-                                exit
-                                ;;
-                -c | --check )   check_vms
-                                exit
-                                ;;
-                -T | --test )   test_functions
-                                exit
-                                ;;
-                -x | --delete-projects ) delete_projects_and_users
-                                exit
-                                ;;
-                -y | --delete-nets ) delete_networks
-                                exit
-                                ;;
-                -z | --delete-vms ) shutdown_vms
-                                exit
-                                ;;
-                -a | --all )    all
-                                exit
-                                ;;
-                * )             usage
-                                exit 1
-            esac
-            shift
-        done
-    fi
-}
-
-trap failed ERR
-function failed {
-    local r=$?
-    set +o errtrace
-    set +o xtrace
-    echo "Failed to execute"
-    echo "Starting cleanup..."
-    delete_all
-    echo "Finished cleanup"
-    exit $r
-}
-
-# Kick off script
-# ---------------
-
-echo $*
-main $*
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/sec_groups.sh b/exercises/sec_groups.sh
deleted file mode 100755
index 2f78e393eb..0000000000
--- a/exercises/sec_groups.sh
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-
-# **sec_groups.sh**
-
-# Test security groups via the command line
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-
-# Testing Security Groups
-# =======================
-
-# List security groups
-nova secgroup-list
-
-# Create random name for new sec group and create secgroup of said name
-SEC_GROUP_NAME="ex-secgroup-$(openssl rand -hex 4)"
-nova secgroup-create $SEC_GROUP_NAME 'a test security group'
-
-# Add some rules to the secgroup
-RULES_TO_ADD=( 22 3389 5900 )
-
-for RULE in "${RULES_TO_ADD[@]}"; do
-    nova secgroup-add-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/0
-done
-
-# Check to make sure rules were added
-SEC_GROUP_RULES=( $(nova secgroup-list-rules $SEC_GROUP_NAME | grep -v \- | grep -v 'Source Group' | cut -d '|' -f3 | tr -d ' ') )
-die_if_not_set $LINENO SEC_GROUP_RULES "Failure retrieving SEC_GROUP_RULES for $SEC_GROUP_NAME"
-for i in "${RULES_TO_ADD[@]}"; do
-    skip=
-    for j in "${SEC_GROUP_RULES[@]}"; do
-        [[ $i == $j ]] && { skip=1; break; }
-    done
-    [[ -n $skip ]] || exit 1
-done
-
-# Delete rules and secgroup
-for RULE in "${RULES_TO_ADD[@]}"; do
-    nova secgroup-delete-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/0
-done
-
-# Delete secgroup
-nova secgroup-delete $SEC_GROUP_NAME || \
-    die $LINENO "Failure deleting security group $SEC_GROUP_NAME"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/swift.sh b/exercises/swift.sh
deleted file mode 100755
index 8aa376b8a7..0000000000
--- a/exercises/swift.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-
-# **swift.sh**
-
-# Test swift via the ``python-openstackclient`` command line
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If swift is not enabled we exit with exitcode 55 which mean
-# exercise is skipped.
-is_service_enabled s-proxy || exit 55
-
-# Container name
-CONTAINER=ex-swift
-OBJECT=/etc/issue
-
-
-# Testing Swift
-# =============
-
-# Check if we have to swift via keystone
-openstack object store account show || die $LINENO "Failure getting account status"
-
-# We start by creating a test container
-openstack container create $CONTAINER || die $LINENO "Failure creating container $CONTAINER"
-
-# add a file into it.
-openstack object create $CONTAINER $OBJECT || die $LINENO "Failure uploading file to container $CONTAINER"
-
-# list the objects
-openstack object list $CONTAINER || die $LINENO "Failure listing contents of container $CONTAINER"
-
-# delete the object first
-openstack object delete $CONTAINER $OBJECT || die $LINENO "Failure deleting object $OBJECT in container $CONTAINER"
-
-# delete the container
-openstack container delete $CONTAINER || die $LINENO "Failure deleting container $CONTAINER"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
deleted file mode 100755
index e7c3560894..0000000000
--- a/exercises/volumes.sh
+++ /dev/null
@@ -1,225 +0,0 @@
-#!/usr/bin/env bash
-
-# **volumes.sh**
-
-# Test cinder volumes with the ``cinder`` command from ``python-cinderclient``
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import project functions
-source $TOP_DIR/lib/cinder
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If cinder is not enabled we exit with exitcode 55 which mean
-# exercise is skipped.
-is_service_enabled cinder || exit 55
-
-# Ironic does not currently support volume attachment.
-[ "$VIRT_DRIVER" == "ironic" ] && exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-vol_secgroup}
-
-# Instance and volume names
-VM_NAME=${VM_NAME:-ex-vol-inst}
-VOL_NAME="ex-vol-$(openssl rand -hex 4)"
-
-
-# Launching a server
-# ==================
-
-# List servers for tenant:
-nova list
-
-# Images
-# ------
-
-# List the images available
-openstack image list
-
-# Grab the id of the image to launch
-IMAGE=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-# Security Groups
-# ---------------
-
-# List security groups
-nova secgroup-list
-
-if is_service_enabled n-cell; then
-    # Cells does not support security groups, so force the use of "default"
-    SECGROUP="default"
-    echo "Using the default security group because of Cells."
-else
-    # Create a secgroup
-    if ! nova secgroup-list | grep -q $SECGROUP; then
-        nova secgroup-create $SECGROUP "$SECGROUP description"
-        if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova secgroup-list | grep -q $SECGROUP; do sleep 1; done"; then
-            echo "Security group not created"
-            exit 1
-        fi
-    fi
-fi
-
-# Configure Security Group Rules
-if ! nova secgroup-list-rules $SECGROUP | grep -q icmp; then
-    nova secgroup-add-rule $SECGROUP icmp -1 -1 0.0.0.0/0
-fi
-if ! nova secgroup-list-rules $SECGROUP | grep -q " tcp .* 22 "; then
-    nova secgroup-add-rule $SECGROUP tcp 22 22 0.0.0.0/0
-fi
-
-# List secgroup rules
-nova secgroup-list-rules $SECGROUP
-
-# Set up instance
-# ---------------
-
-# List flavors
-nova flavor-list
-
-# Select a flavor
-INSTANCE_TYPE=$(nova flavor-list | grep $DEFAULT_INSTANCE_TYPE | get_field 1)
-if [[ -z "$INSTANCE_TYPE" ]]; then
-    # grab the first flavor in the list to launch if default doesn't exist
-    INSTANCE_TYPE=$(nova flavor-list | head -n 4 | tail -n 1 | get_field 1)
-    die_if_not_set $LINENO INSTANCE_TYPE "Failure retrieving INSTANCE_TYPE"
-fi
-
-# Clean-up from previous runs
-nova delete $VM_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while nova show $VM_NAME; do sleep 1; done"; then
-    die $LINENO "server didn't terminate!"
-fi
-
-# Boot instance
-# -------------
-
-VM_UUID=$(nova boot --flavor $INSTANCE_TYPE --image $IMAGE --security-groups=$SECGROUP $VM_NAME | grep ' id ' | get_field 2)
-die_if_not_set $LINENO VM_UUID "Failure launching $VM_NAME"
-
-# Check that the status is active within ACTIVE_TIMEOUT seconds
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-    die $LINENO "server didn't become active!"
-fi
-
-# Get the instance IP
-IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
-
-die_if_not_set $LINENO IP "Failure retrieving IP address"
-
-# Private IPs can be pinged in single node deployments
-ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
-
-# Volumes
-# -------
-
-# Verify it doesn't exist
-if [[ -n $(cinder list | grep $VOL_NAME | head -1 | get_field 2) ]]; then
-    die $LINENO "Volume $VOL_NAME already exists"
-fi
-
-# Create a new volume
-start_time=$(date +%s)
-cinder create --display-name $VOL_NAME --display-description "test volume: $VOL_NAME" $DEFAULT_VOLUME_SIZE || \
-    die $LINENO "Failure creating volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not created"
-fi
-end_time=$(date +%s)
-echo "Completed cinder create in $((end_time - start_time)) seconds"
-
-# Get volume ID
-VOL_ID=$(cinder list | grep $VOL_NAME | head -1 | get_field 1)
-die_if_not_set $LINENO VOL_ID "Failure retrieving volume ID for $VOL_NAME"
-
-# Attach to server
-DEVICE=/dev/vdb
-start_time=$(date +%s)
-nova volume-attach $VM_UUID $VOL_ID $DEVICE || \
-    die $LINENO "Failure attaching volume $VOL_NAME to $VM_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep in-use; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not attached to $VM_NAME"
-fi
-end_time=$(date +%s)
-echo "Completed volume-attach in $((end_time - start_time)) seconds"
-
-VOL_ATTACH=$(cinder list | grep $VOL_NAME | head -1 | get_field -1)
-die_if_not_set $LINENO VOL_ATTACH "Failure retrieving $VOL_NAME status"
-if [[ "$VOL_ATTACH" != $VM_UUID ]]; then
-    die $LINENO "Volume not attached to correct instance"
-fi
-
-# Clean up
-# --------
-
-# Detach volume
-start_time=$(date +%s)
-nova volume-detach $VM_UUID $VOL_ID || die $LINENO "Failure detaching volume $VOL_NAME from $VM_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not detached from $VM_NAME"
-fi
-end_time=$(date +%s)
-echo "Completed volume-detach in $((end_time - start_time)) seconds"
-
-# Delete volume
-start_time=$(date +%s)
-cinder delete $VOL_ID || die $LINENO "Failure deleting volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not deleted"
-fi
-end_time=$(date +%s)
-echo "Completed cinder delete in $((end_time - start_time)) seconds"
-
-# Delete instance
-nova delete $VM_UUID || die $LINENO "Failure deleting instance $VM_NAME"
-if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q $VM_UUID; do sleep 1; done"; then
-    die $LINENO "Server $VM_NAME not deleted"
-fi
-
-if [[ $SECGROUP = "default" ]] ; then
-    echo "Skipping deleting default security group"
-else
-    # Delete secgroup
-    nova secgroup-delete $SECGROUP || die $LINENO "Failure deleting security group $SECGROUP"
-fi
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"

From 3cdff78fbac6a88c4864d4effa8126610bcce2fd Mon Sep 17 00:00:00 2001
From: Felipe Monteiro <felipe.monteiro@att.com>
Date: Mon, 9 Jul 2018 20:25:08 +0100
Subject: [PATCH 2315/3333] Rename "Member" role in tempest_roles to "member"

Recently, Keystone renamed "Member" role to "member"
(case-sensitive) with https://review.openstack.org/#/c/572243/14

Case-sensitivity role requirement in Keystone was recently
formalized with https://review.openstack.org/#/c/576640/

From the above reference:

"Role names are case-insensitive. for example, when keystone
bootstraps default roles, it creates `admin`, `member`, and
`reader`. If another role `Member` (note the upper case 'M') is
created, keystone will return a `409` Conflict since it considers
the name "Member" == "member". Note that case is preserved in these
cases."

It follows that Tempest should use "member" role by default.

Change-Id: Iebf04fdb4c195b6779c74f66da3f7822cf174494
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 60f571ceb3..a0f9dd8778 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -581,7 +581,7 @@ function configure_tempest {
     tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
             tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml

From 31c7d5c796fac2d3d67e893388166f7cf26c6a33 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 23 Jul 2018 09:25:08 -0400
Subject: [PATCH 2316/3333] cinder: configure backup_swift_url in subnodes

The tempest-multinode-full job is running the c-bak
service on the subnode where swift isn't running, and
because of the "is_enabled_service swift" check, cinder
on the subnode wasn't getting configured to talk to
swift so the c-bak service was down. Since chances are
good that we're running swift, just configure cinder
to always use it.

Change-Id: I86b090967dadeeefc017ff0311beeea9441b6ba6
Closes-Bug: #1783128
---
 lib/cinder | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 92d0295b5b..664f423c73 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -268,7 +268,12 @@ function configure_cinder {
         configure_cinder_image_volume_cache
     fi
 
-    if is_service_enabled swift; then
+    if is_service_enabled c-bak; then
+        # NOTE(mriedem): The default backup driver uses swift and if we're
+        # on a subnode we might not know if swift is enabled, but chances are
+        # good that it is on the controller so configure the backup service
+        # to use it. If we want to configure the backup service to use
+        # a non-swift driver, we'll likely need environment variables.
         iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
     fi
 

From 1481322d7466c2b53a6144963663173ff0404422 Mon Sep 17 00:00:00 2001
From: Matthew Edmonds <edmondsw@us.ibm.com>
Date: Fri, 27 Jul 2018 15:48:38 -0400
Subject: [PATCH 2317/3333] Correct neutron docs

The neutron guide refers to ENABLE_PROJECT_VLANS and
PROJECT_VLAN_RANGE but these are not present/checked in the code,
which uses ENABLE_TENANT_VLANS and TENANT_VLAN_RANGE. This
corrects the documentation to match.

Change-Id: I204356c861157e9fab357bb4dde55185bf18a707
---
 doc/source/guides/neutron.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 7f360c63cc..12c6d6902d 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -376,8 +376,8 @@ controller node.
 
         ## Neutron options
         Q_USE_SECGROUP=True
-        ENABLE_PROJECT_VLANS=True
-        PROJECT_VLAN_RANGE=3001:4000
+        ENABLE_TENANT_VLANS=True
+        TENANT_VLAN_RANGE=3001:4000
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
 

From 66b361b53884ef1755d18cbab1b6898ebd78caa1 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 13 Jun 2017 00:31:01 -0700
Subject: [PATCH 2318/3333] WSGI Neutron integration

This patch provides a new mechanism to deploy Neutron using
WSGI script. This also starts a Neutron RPC server process
when the Neutron API is loaded via a WSGI entry point to
serve the agents.

Co-Authored-By: Victor Morales <victor.morales@intel.com>
Co-Authored-By: Nguyen Phuong An <AnNP@vn.fujitsu.com>

Change-Id: I16a199b04858bfc03ef50d9883154dba8b0d66ea
Depends-On: https://review.openstack.org/#/c/580049/
Partially-implements: blueprint run-in-wsgi-server
---
 .zuul.yaml                    | 13 ++++++++
 files/apache-neutron.template | 36 ++++++++++++++++++++
 lib/neutron                   | 63 ++++++++++++++++++++++++++++-------
 lib/neutron-legacy            | 51 ++++++++++++++++++++++------
 4 files changed, 140 insertions(+), 23 deletions(-)
 create mode 100644 files/apache-neutron.template

diff --git a/.zuul.yaml b/.zuul.yaml
index 57cbf88e1d..67ffe0805b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -511,6 +511,16 @@
     #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
     #    things like cellsv2 and placement-api
+    # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
+    #    when neutron-api is served by uwsgi, it's in exprimental for testing.
+    #    the next cycle we can remove this  job if things turn out to be
+    #    stable enough.
+    # * neutron-functional-with-uwsgi: maintained by neutron for functional
+    #    test. Next cycle we can remove this one if things turn out to be
+    #    stable engouh with uwsgi.
+    # * neutron-tempest-with-uwsgi: maintained by neutron for tempest test.
+    #    Next cycle we can remove this if everything run out stable enough.
+
     experimental:
       jobs:
         - nova-cells-v1:
@@ -518,3 +528,6 @@
               - ^.*\.rst$
               - ^doc/.*$
         - nova-next
+        - neutron-fullstack-with-uwsgi
+        - neutron-functional-with-uwsgi
+        - neutron-tempest-with-uwsgi
\ No newline at end of file
diff --git a/files/apache-neutron.template b/files/apache-neutron.template
new file mode 100644
index 0000000000..c7796b93bf
--- /dev/null
+++ b/files/apache-neutron.template
@@ -0,0 +1,36 @@
+Listen %PUBLICPORT%
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" neutron_combined
+
+<Directory %NEUTRON_BIN%>
+    Require all granted
+</Directory>
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess neutron-server processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup neutron-server
+    WSGIScriptAlias / %NEUTRON_BIN%/neutron-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    ErrorLogFormat "%M"
+    ErrorLog /var/log/%APACHE_NAME%/neutron.log
+    CustomLog /var/log/%APACHE_NAME%/neutron_access.log neutron_combined
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+
+%SSLLISTEN%<VirtualHost *:443>
+%SSLLISTEN%    %SSLENGINE%
+%SSLLISTEN%    %SSLCERTFILE%
+%SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%</VirtualHost>
+
+Alias /networking %NEUTRON_BIN%/neutron-api
+<Location /networking>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup neutron-server
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/neutron b/lib/neutron
index 9f9b132377..4847e87f2f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -28,6 +28,12 @@ set +o xtrace
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
+# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
+# - False (default) : Run neutron under Eventlet
+# - True : Run neutron under uwsgi
+# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
+# enough
+NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
@@ -58,6 +64,8 @@ NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
+NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
+
 # By default, use the ML2 plugin
 NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
 NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
@@ -286,7 +294,7 @@ function configure_neutron_new {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
         iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
@@ -357,6 +365,15 @@ function configure_neutron_nova_new {
 
 # create_neutron_accounts() - Create required service accounts
 function create_neutron_accounts_new {
+    local neutron_url
+
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/networking/
+    else
+        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/
+    fi
+
+
     if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
 
         create_service_user "neutron"
@@ -364,8 +381,7 @@ function create_neutron_accounts_new {
         neutron_service=$(get_or_create_service "neutron" \
             "network" "Neutron Service")
         get_or_create_endpoint $neutron_service \
-            "$REGION_NAME" \
-            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/"
+            "$REGION_NAME" "$neutron_url"
     fi
 }
 
@@ -427,6 +443,7 @@ function install_neutronclient {
 function start_neutron_api {
     local service_port=$NEUTRON_SERVICE_PORT
     local service_protocol=$NEUTRON_SERVICE_PROTOCOL
+    local neutron_url
     if is_service_enabled tls-proxy; then
         service_port=$NEUTRON_SERVICE_PORT_INT
         service_protocol="http"
@@ -440,17 +457,24 @@ function start_neutron_api {
         opts+=" --config-file $cfg_file"
     done
 
-    # Start the Neutron service
-    # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
-
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
-        die $LINENO "neutron-api did not start"
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/networking/
+        enable_service neutron-rpc-server
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
+    else
+        # Start the Neutron service
+        # TODO(sc68cal) Stop hard coding this
+        run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port
+        # Start proxy if enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
+        fi
     fi
 
-    # Start proxy if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
+    if ! wait_for_service $SERVICE_TIMEOUT $neutron_url; then
+        die $LINENO "neutron-api did not start"
     fi
 }
 
@@ -497,6 +521,10 @@ function stop_neutron_new {
         stop_process $serv
     done
 
+    if is_service_enabled neutron-rpc-server; then
+        stop_process neutron-rpc-server
+    fi
+
     if is_service_enabled neutron-dhcp; then
         stop_process neutron-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
@@ -551,6 +579,13 @@ function neutron_deploy_rootwrap_filters_new {
 # neutron-legacy is removed.
 # TODO(sc68cal) Remove when neutron-legacy is no more.
 function cleanup_neutron {
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        stop_process neutron-api
+        stop_process neutron-rpc-server
+        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api"
+        sudo rm -f $(apache_site_config_for neutron-api)
+    fi
+
     if is_neutron_legacy_enabled; then
         # Call back to old function
         cleanup_mutnauq "$@"
@@ -566,6 +601,10 @@ function configure_neutron {
     else
         configure_neutron_new "$@"
     fi
+
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
+    fi
 }
 
 function configure_neutron_nova {
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 15bcfe36b9..9330b23802 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -86,6 +86,15 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
+# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
+# - False (default) : Run neutron under Eventlet
+# - True : Run neutron under uwsgi
+# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
+# enough
+NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
+
+NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -402,6 +411,13 @@ function create_nova_conf_neutron {
 
 # Migrated from keystone_data.sh
 function create_mutnauq_accounts {
+    local neutron_url
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/networking/
+    else
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
+    fi
+
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
         create_service_user "neutron"
@@ -409,8 +425,7 @@ function create_mutnauq_accounts {
         get_or_create_service "neutron" "network" "Neutron Service"
         get_or_create_endpoint \
             "network" \
-            "$REGION_NAME" \
-            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
+            "$REGION_NAME" "$neutron_url"
     fi
 }
 
@@ -460,6 +475,7 @@ function start_neutron_service_and_check {
     local service_port=$Q_PORT
     local service_protocol=$Q_PROTOCOL
     local cfg_file_options
+    local neutron_url
 
     cfg_file_options="$(determine_config_files neutron-server)"
 
@@ -468,16 +484,24 @@ function start_neutron_service_and_check {
         service_protocol="http"
     fi
     # Start the Neutron service
-    run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        enable_service neutron-api
+        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        neutron_url=$Q_PROTOCOL://$Q_HOST/networking/
+        enable_service neutron-rpc-server
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+    else
+        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+        neutron_url=$service_protocol://$Q_HOST:$service_port
+        # Start proxy if enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
+        fi
+    fi
     echo "Waiting for Neutron to start..."
 
-    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port"
+    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
     test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
-
-    # Start proxy if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-    fi
 }
 
 # Control of the l2 agent is separated out to make it easier to test partial
@@ -532,7 +556,12 @@ function stop_mutnauq_other {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    stop_process q-svc
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        stop_process neutron-rpc-server
+        stop_process neutron-api
+    else
+        stop_process q-svc
+    fi
 
     if is_service_enabled q-l3; then
         sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
@@ -715,7 +744,7 @@ function _configure_neutron_common {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
         iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True

From ed6e1d0996a910eca42a202f17dfeee53d250c00 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Wed, 1 Aug 2018 18:03:44 +0000
Subject: [PATCH 2319/3333] Set transport_url in proper keystone config section

The RPC transport_url for keystone was being set in the DEFAULT
section, even though keystone doesn't do anything with it. Instead,
keystone leans on the [oslo_messaging_notification] section from
oslo.messaging to register the transport_url option.

This change sets the transport_url in the proper section instead of
using the DEFAULT section.

Change-Id: I11590d0175da7ea310d5529f2d7c0bf8d7fb25b3
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 57cb24d4cb..02e28222b7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -217,7 +217,7 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend "dogpile.cache.memcached"
     iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
-    iniset_rpc_backend keystone $KEYSTONE_CONF
+    iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     local service_port=$KEYSTONE_SERVICE_PORT
     local auth_port=$KEYSTONE_AUTH_PORT

From b73fb370511563b5607db149dae66e33333dd445 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 2 Aug 2018 16:15:52 -0400
Subject: [PATCH 2320/3333] Remove devstack-single-node-fedora-27

There is no projects using this and allows openstack-infra to delete
fedora-27 images.

Change-Id: I37d482dd2b5e099c370ab693ff430cb9c56360f8
Depends-On: https://review.openstack.org/588369
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 .zuul.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 57cbf88e1d..99ab20d3d0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,16 +38,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-fedora-27
-    nodes:
-      - name: controller
-        label: fedora-27
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-fedora-latest
     nodes:

From 11b8649e839f55b1d7e17fa3636f7b160e6c5d22 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 7 Aug 2018 08:37:24 +0000
Subject: [PATCH 2321/3333] Fix TEMPEST_AUTH_VERSION comparision condition for
 identity v2

TEMPEST_AUTH_VERSION should be 'v3' or 'v2' not 'v2.0'.
To disable the identity v2 admin tests TEMPEST_AUTH_VERSION is
being compared with 'v2.0' which is incorrect.

Change-Id: I5f7e3bcf733edbbee06016bcad4845dda552815e
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 60f571ceb3..f83476d42f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -279,8 +279,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
     fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
-    if [[ "$TEMPEST_AUTH_VERSION" != "v2.0" ]]; then
-        # we're going to disable v2 admin unless we're using v2.0 by default.
+    if [[ "$TEMPEST_AUTH_VERSION" != "v2" ]]; then
+        # we're going to disable v2 admin unless we're using v2 by default.
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2_admin False
     fi
 

From 59f50c7967de9274d4c125e40fee8b2bfbe9cfc7 Mon Sep 17 00:00:00 2001
From: zhubx007 <zhu.boxiang@99cloud.net>
Date: Mon, 23 Jul 2018 11:42:07 +0800
Subject: [PATCH 2322/3333] BUG Fix: add sudo to run command arping

Set 'PUBLIC_INTERFACE' in local.conf, so the code will
be entered into _move_neutron_addresses_route of
neutron-legacy.

But if lack of sudo to run command arping, the information
"arping: socket: Operation not permitted" occurs. So add
'sudo' for 'ARP_CMD' of lib/neutron-legacy.

Change-Id: I8ac8a9bc2bbba049c45b28bf9b93d9a10e398fe6
Closes-Bug: #1783046
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9330b23802..be5b73ffa6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -633,7 +633,7 @@ function _move_neutron_addresses_route {
             IP_UP="sudo ip link set $to_intf up"
             if [[ "$af" == "inet" ]]; then
                 IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-                ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
+                ARP_CMD="sudo arping -A -c 3 -w 4.5 -I $to_intf $IP "
             fi
         fi
 

From 70be0d14a62680f415daf6e15af6dd01f38749fe Mon Sep 17 00:00:00 2001
From: Michal Rostecki <mrostecki@suse.de>
Date: Thu, 9 Aug 2018 15:19:17 +0200
Subject: [PATCH 2323/3333] gitignore: Ignore all log files

Before this change, only *.log and *.log.[0-9] patterns were
ignored, which was not enough. Examples of file names which were
not ignored:

    devstack.log.2018-08-09-100547
    wget-log
    wget-log.1

Patterns *.log.* and *-log.* work for every log file generated by
devstack.

Change-Id: I6f0de5de74f196ab9df66cf3f2f969e53da01c22
Signed-off-by: Michal Rostecki <mrostecki@suse.de>
---
 .gitignore | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 8553b3f849..e5e1f6aba0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,9 @@
 *~
 .*.sw?
 *.log
-*.log.[1-9]
+*-log
+*.log.*
+*-log.*
 *.pem
 *.pyc
 .localrc.auto

From 2c42fd09d555981234fd88b9522c366e42e4e7c6 Mon Sep 17 00:00:00 2001
From: Chang Liu <liuchang77@chinaunicom.cn>
Date: Fri, 3 Aug 2018 16:15:20 +0800
Subject: [PATCH 2324/3333] Modified the description of the doc directory

In the latest version of Contributing to
DevStack manual.There are a few words to
say that "tools/build_docs.sh is used to
generate the HTML versions of the DevStack
scripts".But build_docs.sh is not there
since Newton version.So I delete it for
good.

Change-Id: I69f7aa23e1efd8f8a63aa79628e67378d524e173
---
 HACKING.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d5d6fbcf02..ce1c1b5416 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -47,8 +47,7 @@ The DevStack repo generally keeps all of the primary scripts at the root
 level.
 
 ``doc`` - Contains the Sphinx source for the documentation.
-``tools/build_docs.sh`` is used to generate the HTML versions of the
-DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
+A complete doc build can be run with ``tox -edocs``.
 
 ``exercises`` - Contains the test scripts used to sanity-check and
 demonstrate some OpenStack functions. These scripts know how to exit

From 7711d7f196e946b0cf9a091fd6be0cf35e48fd31 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Aug 2018 06:13:29 +0000
Subject: [PATCH 2325/3333] Updated from generate-devstack-plugins-list

Change-Id: I610cf0be64cfcfba754e629e2a62e8dc2cb99ddf
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7ad65f741b..9ef2a32c88 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -158,6 +158,7 @@ panko                                  `git://git.openstack.org/openstack/panko
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
+qinling-dashboard                      `git://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__

From c617d476c2f6d7b86553e9a0cb5c9b229dc5e3af Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 23 Aug 2018 06:11:41 +0000
Subject: [PATCH 2326/3333] Updated from generate-devstack-plugins-list

Change-Id: Ice486739c1dfbcbf61db178be64075164e9f7ed5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9ef2a32c88..f0c6238e0b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -171,6 +171,7 @@ slogging                               `git://git.openstack.org/openstack/sloggi
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
+stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From e5cac49b04084407432b60c5670c25961bd7302a Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Fri, 24 Aug 2018 10:38:01 +0000
Subject: [PATCH 2327/3333] Update branches for stable/rocky

Change-Id: Ia6de4b83f56c5ac0af19b0ca4f12aa4d47fd963a
---
 stackrc                      |  2 +-
 tests/test_libs_from_pypi.sh | 12 ------------
 2 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/stackrc b/stackrc
index 2088bf45a3..2c464bd6be 100644
--- a/stackrc
+++ b/stackrc
@@ -15,7 +15,7 @@ source $RC_DIR/functions
 
 # Set the target branch. This is used so that stable branching
 # does not need to update each repo below.
-TARGET_BRANCH=master
+TARGET_BRANCH=stable/rocky
 
 # Cycle trailing projects need to branch later than the others.
 TRAILING_TARGET_BRANCH=master
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index c3b4457171..da2d970482 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -95,19 +95,7 @@ function test_libs_exist {
     echo "test_libs_exist PASSED"
 }
 
-function test_branch_master {
-    for lib in $ALL_LIBS; do
-        if [[ ${GITBRANCH[$lib]} != "master" ]]; then
-            echo "GITBRANCH for $lib not master (${GITBRANCH[$lib]})"
-            exit 1
-        fi
-    done
-
-    echo "test_branch_master PASSED"
-}
-
 set -o errexit
 
 test_libs_exist
-test_branch_master
 test_all_libs_upto_date

From ef72d1ea77e2d5b8f210f222bcaf41b0fc7520e2 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Fri, 24 Aug 2018 10:44:54 +0000
Subject: [PATCH 2328/3333] Update DEVSTACK_SERIES to stein

stable/rocky branch has been created now and
current master is for stein.

Change-Id: Id5d75e7a8a38a749f387f3ba670e3d2c10cb9719
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 2088bf45a3..34bd6771a6 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="rocky"
+DEVSTACK_SERIES="stein"
 
 ##############
 #

From 57bc01b3202e14ce8b722f7fcebddc8c8ae2159e Mon Sep 17 00:00:00 2001
From: "Jens Harbott (frickler)" <j.harbott@x-ion.de>
Date: Mon, 27 Aug 2018 13:23:18 +0000
Subject: [PATCH 2329/3333] Revert "Update branches for stable/rocky"

This reverts commit e5cac49b04084407432b60c5670c25961bd7302a.

Change-Id: Ieceb5030a6c21378adcb9bf9c51cd862e0b0d01a
---
 stackrc                      |  2 +-
 tests/test_libs_from_pypi.sh | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 2c464bd6be..2088bf45a3 100644
--- a/stackrc
+++ b/stackrc
@@ -15,7 +15,7 @@ source $RC_DIR/functions
 
 # Set the target branch. This is used so that stable branching
 # does not need to update each repo below.
-TARGET_BRANCH=stable/rocky
+TARGET_BRANCH=master
 
 # Cycle trailing projects need to branch later than the others.
 TRAILING_TARGET_BRANCH=master
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index da2d970482..c3b4457171 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -95,7 +95,19 @@ function test_libs_exist {
     echo "test_libs_exist PASSED"
 }
 
+function test_branch_master {
+    for lib in $ALL_LIBS; do
+        if [[ ${GITBRANCH[$lib]} != "master" ]]; then
+            echo "GITBRANCH for $lib not master (${GITBRANCH[$lib]})"
+            exit 1
+        fi
+    done
+
+    echo "test_branch_master PASSED"
+}
+
 set -o errexit
 
 test_libs_exist
+test_branch_master
 test_all_libs_upto_date

From 6465219ec39ea3ec75e796b3bd80b96550470546 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Wed, 29 Aug 2018 16:41:04 +0300
Subject: [PATCH 2330/3333] Fixed git show for upper-constraints.txt in
 lib/tempest

Change-Id: Id133108e0436018be81fca74a15ff29a4fe2e796
Closes-Bug: #1789643
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 0605ffb082..6da2330738 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -560,7 +560,7 @@ function configure_tempest {
     fi
 
     # The requirements might be on a different branch, while tempest needs master requirements.
-    (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
+    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
     tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:

From 41fe3ebd4b1570c83ddf45cb8c240528aa06a56c Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Sat, 8 Sep 2018 18:32:25 +0000
Subject: [PATCH 2331/3333] Update horizon wsgi wrapper to the recommended one

During Rocky cycle, horizon updates the path of the wsgi wrapper
to the one recommended by Django [1]. The old path will be dropped
in the T release.

[1] https://review.openstack.org/#/c/561802/

Related-Bug: #1763204
Change-Id: Ie942518b587d193a7de55ffcc0a2848406146eb2
---
 files/apache-horizon.template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index bfd75678e3..efcfc0360b 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -1,5 +1,5 @@
 <VirtualHost *:80>
-    WSGIScriptAlias %WEBROOT% %HORIZON_DIR%/openstack_dashboard/wsgi/django.wsgi
+    WSGIScriptAlias %WEBROOT% %HORIZON_DIR%/openstack_dashboard/wsgi.py
     WSGIDaemonProcess horizon user=%USER% group=%GROUP% processes=3 threads=10 home=%HORIZON_DIR% display-name=%{GROUP}
     WSGIApplicationGroup %{GLOBAL}
 

From a0d1016e5540791d63a09a80a49181c08725f011 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Sat, 8 Sep 2018 22:50:06 -0400
Subject: [PATCH 2332/3333] import zuul job settings from project-config

This is a mechanically generated patch to complete step 1 of moving
the zuul job settings out of project-config and into each project
repository.

Because there will be a separate patch on each branch, the branch
specifiers for branch-specific jobs have been removed.

Because this patch is generated by a script, there may be some
cosmetic changes to the layout of the YAML file(s) as the contents are
normalized.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: I9169d41d790ae874af29c8ceccf0c55ab0df7727
Story: #2002586
Task: #24327
---
 .zuul.yaml | 165 +++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 121 insertions(+), 44 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index feafa0c2e2..68b20930ea 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -120,46 +120,46 @@
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
       zuul_copy_output:
-        '{{ devstack_conf_dir }}/local.conf': 'logs'
-        '{{ devstack_conf_dir }}/localrc': 'logs'
-        '{{ devstack_conf_dir }}/.localrc.auto': 'logs'
-        '{{ devstack_conf_dir }}/.stackenv': 'logs'
-        '{{ devstack_log_dir }}/dstat-csv.log': 'logs'
-        '{{ devstack_log_dir }}/devstacklog.txt': 'logs'
-        '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs'
-        '{{ devstack_full_log}}': 'logs'
-        '{{ stage_dir }}/verify_tempest_conf.log': 'logs'
-        '{{ stage_dir }}/apache': 'logs'
-        '{{ stage_dir }}/apache_config': 'logs'
-        '{{ stage_dir }}/etc': 'logs'
-        '/var/log/rabbitmq': 'logs'
-        '/var/log/postgresql': 'logs'
-        '/var/log/mysql.err': 'logs'
-        '/var/log/mysql.log': 'logs'
-        '/var/log/libvirt': 'logs'
-        '/etc/sudoers': 'logs'
-        '/etc/sudoers.d': 'logs'
-        '{{ stage_dir }}/iptables.txt': 'logs'
-        '{{ stage_dir }}/df.txt': 'logs'
-        '{{ stage_dir }}/pip2-freeze.txt': 'logs'
-        '{{ stage_dir }}/pip3-freeze.txt': 'logs'
-        '{{ stage_dir }}/dpkg-l.txt': 'logs'
-        '{{ stage_dir }}/rpm-qa.txt': 'logs'
-        '{{ stage_dir }}/core': 'logs'
-        '{{ stage_dir }}/listen53.txt': 'logs'
-        '{{ stage_dir }}/deprecations.log': 'logs'
-        '/var/log/ceph': 'logs'
-        '/var/log/openvswitch': 'logs'
-        '/var/log/glusterfs': 'logs'
-        '/etc/glusterfs/glusterd.vol': 'logs'
-        '/etc/resolv.conf': 'logs'
-        '/var/log/unbound.log': 'logs'
+        '{{ devstack_conf_dir }}/local.conf': logs
+        '{{ devstack_conf_dir }}/localrc': logs
+        '{{ devstack_conf_dir }}/.localrc.auto': logs
+        '{{ devstack_conf_dir }}/.stackenv': logs
+        '{{ devstack_log_dir }}/dstat-csv.log': logs
+        '{{ devstack_log_dir }}/devstacklog.txt': logs
+        '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
+        '{{ devstack_full_log}}': logs
+        '{{ stage_dir }}/verify_tempest_conf.log': logs
+        '{{ stage_dir }}/apache': logs
+        '{{ stage_dir }}/apache_config': logs
+        '{{ stage_dir }}/etc': logs
+        /var/log/rabbitmq: logs
+        /var/log/postgresql: logs
+        /var/log/mysql.err: logs
+        /var/log/mysql.log: logs
+        /var/log/libvirt: logs
+        /etc/sudoers: logs
+        /etc/sudoers.d: logs
+        '{{ stage_dir }}/iptables.txt': logs
+        '{{ stage_dir }}/df.txt': logs
+        '{{ stage_dir }}/pip2-freeze.txt': logs
+        '{{ stage_dir }}/pip3-freeze.txt': logs
+        '{{ stage_dir }}/dpkg-l.txt': logs
+        '{{ stage_dir }}/rpm-qa.txt': logs
+        '{{ stage_dir }}/core': logs
+        '{{ stage_dir }}/listen53.txt': logs
+        '{{ stage_dir }}/deprecations.log': logs
+        /var/log/ceph: logs
+        /var/log/openvswitch: logs
+        /var/log/glusterfs: logs
+        /etc/glusterfs/glusterd.vol: logs
+        /etc/resolv.conf: logs
+        /var/log/unbound.log: logs
       extensions_to_txt:
-        conf: True
-        log: True
-        localrc: True
-        stackenv: True
-        auto: True
+        conf: true
+        log: true
+        localrc: true
+        stackenv: true
+        auto: true
     group-vars:
       subnode:
         devstack_localrc:
@@ -207,7 +207,7 @@
         # Multinode specific settings
         SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
         HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+        PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}'
       devstack_services:
         # Shared services
         dstat: true
@@ -225,7 +225,7 @@
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
           SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+          PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}'
           # Subnode specific settings
           DATABASE_TYPE: mysql
           RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
@@ -274,7 +274,7 @@
         SWIFT_START_ALL_SERVICES: false
         SWIFT_HASH: 1234123412341234
         CINDER_PERIODIC_INTERVAL: 10
-        DEBUG_LIBVIRT_COREDUMPS: True
+        DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
@@ -282,7 +282,7 @@
         post-config:
           $NEUTRON_CONF:
             DEFAULT:
-              global_physnet_mtu: "{{ external_bridge_mtu }}"
+              global_physnet_mtu: '{{ external_bridge_mtu }}'
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -479,6 +479,10 @@
     run: playbooks/unit-tests/run.yaml
 
 - project:
+    templates:
+      - integrated-gate
+      - integrated-gate-py35
+      - publish-openstack-sphinx-docs
     check:
       jobs:
         - devstack
@@ -488,10 +492,48 @@
         - devstack-platform-fedora-latest
         - devstack-multinode
         - devstack-unit-tests
+        - openstack-tox-bashate
+        - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
+            voting: false
+        - legacy-swift-dsvm-functional:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-linuxbridge:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - tempest-multinode-full:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack
         - devstack-unit-tests
+        - openstack-tox-bashate
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-linuxbridge:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.
@@ -520,4 +562,39 @@
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
-        - neutron-tempest-with-uwsgi
\ No newline at end of file
+        - neutron-tempest-with-uwsgi
+        - legacy-tempest-dsvm-full-devstack-plugin-ceph:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-py35-full-devstack-plugin-ceph:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-dvr:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-neutron-dvr-multinode-full:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-dvr-ha-multinode-full:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-lvm-multibackend:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-neutron-pg-full:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+    periodic:
+      jobs:
+        - legacy-periodic-tempest-dsvm-oslo-latest-full-master:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+

From 53db72c6c64229db62649fc31965e024fbfec365 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Sat, 8 Sep 2018 22:53:59 -0400
Subject: [PATCH 2333/3333] switch documentation job to new PTI

This is a mechanically generated patch to switch the documentation
jobs to use the new PTI versions of the jobs as part of the
python3-first goal.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: I338fc71919a41ec890bcb5edd0552ec7eb680eb5
Story: #2002586
Task: #24327
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 68b20930ea..88cb7a18c4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -482,7 +482,7 @@
     templates:
       - integrated-gate
       - integrated-gate-py35
-      - publish-openstack-sphinx-docs
+      - publish-openstack-docs-pti
     check:
       jobs:
         - devstack

From 770690eda1c4578dcca5c5cdfed6688e7e084b24 Mon Sep 17 00:00:00 2001
From: Steve Kowalik <steven@wedontsleep.org>
Date: Mon, 10 Sep 2018 16:17:54 -0600
Subject: [PATCH 2334/3333] Remove cgroup natty or less block

Given that Natty and other releases that don't use cgroups have been out
of support in Ubuntu for years now, it's high time we removed the
special case code block that sets up the cgroup mount.

Change-Id: I5403a4b1b64a95236b4dfcb66c35c594a3460cca
---
 lib/nova | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5e157c5f11..8609956400 100644
--- a/lib/nova
+++ b/lib/nova
@@ -303,17 +303,6 @@ function configure_nova {
             # to simulate multiple systems.
             if [[ "$LIBVIRT_TYPE" == "lxc" ]]; then
                 if is_ubuntu; then
-                    if [[ ! "$DISTRO" > natty ]]; then
-                        local cgline="none /cgroup cgroup cpuacct,memory,devices,cpu,freezer,blkio 0 0"
-                        sudo mkdir -p /cgroup
-                        if ! grep -q cgroup /etc/fstab; then
-                            echo "$cgline" | sudo tee -a /etc/fstab
-                        fi
-                        if ! mount -n | grep -q cgroup; then
-                            sudo mount /cgroup
-                        fi
-                    fi
-
                     # enable nbd for lxc unless you're using an lvm backend
                     # otherwise you can't boot instances
                     if [[ "$NOVA_BACKEND" != "LVM" ]]; then

From b4b6789848b485c6bbdc8cabab5134f0cc2a3828 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 10 Sep 2018 18:40:41 +0200
Subject: [PATCH 2335/3333] Follow job renames

the swift and devstack-plugin-ceph jobs have been renamed, follow rename
and use in-repo jobs.

Depends-On: https://review.openstack.org/543048
Change-Id: Idccc21e47b2cc04e5eeab4db7f7fb7cf156f8049
---
 .zuul.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 88cb7a18c4..7fa8d2a4e9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -495,7 +495,7 @@
         - openstack-tox-bashate
         - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
             voting: false
-        - legacy-swift-dsvm-functional:
+        - swift-dsvm-functional:
             voting: false
             irrelevant-files:
               - ^.*\.rst$
@@ -563,11 +563,11 @@
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
         - neutron-tempest-with-uwsgi
-        - legacy-tempest-dsvm-full-devstack-plugin-ceph:
+        - devstack-plugin-ceph-tempest:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-py35-full-devstack-plugin-ceph:
+        - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 6403b1447fd9e1bcb6fc6f3ebb77d9abd9b776fc Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Wed, 12 Sep 2018 11:37:48 +0200
Subject: [PATCH 2336/3333] Remove master only job

legacy-periodic-tempest-dsvm-oslo-latest-full-master
runs only on master, remove it. This needs to stay in project-config.

Change-Id: I81e66ddb0976bb4bb7a7cd8efbbae3bda551191d
---
 .zuul.yaml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 88cb7a18c4..36e25fc681 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -591,10 +591,3 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-    periodic:
-      jobs:
-        - legacy-periodic-tempest-dsvm-oslo-latest-full-master:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
-

From 147388466daef8e6589013d9bae684f9f8b8c57a Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Thu, 13 Sep 2018 17:50:29 +0200
Subject: [PATCH 2337/3333] Setup branch in setup-devstack-source-dirs

Allow the setup-devstack-source-dirs role to accept a target role
to be setup - when available - for the repos.

Change-Id: Iebcba0d4be6d9d71b783e10a82c35a406afbd6bf
---
 roles/setup-devstack-source-dirs/README.rst   |  5 ++++
 .../tasks/main.yaml                           | 29 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
index 4ebf8399c2..4129eae383 100644
--- a/roles/setup-devstack-source-dirs/README.rst
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -9,3 +9,8 @@ into it.
    :default: /opt/stack
 
    The devstack base directory.
+
+ .. zuul:rolevar:: devstack_branch
+    :default: None
+
+    The target branch to be setup (where available).
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index e6bbae23b7..c196c37e09 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -12,6 +12,35 @@
   with_items: '{{ found_repos.files }}'
   become: yes
 
+- name: Setup refspec for repos into devstack working directory
+  shell:
+    # Copied almost "as-is" from devstack-gate setup-workspace function
+    # but removing the dependency on functions.sh
+    # TODO this should be rewritten as a python module.
+    cmd: |
+      cd {{ devstack_base_dir }}/{{ item.path | basename }}
+      base_branch={{ devstack_sources_branch }}
+      if git branch -a | grep "$base_branch" > /dev/null ; then
+          git checkout $base_branch
+      elif [[ "$base_branch" == stable/* ]]; then
+          # Look for an eol tag for the stable branch.
+          eol_tag=${base_branch#stable/}-eol
+          if git tag -l |grep $eol_tag >/dev/null; then
+              git checkout $eol_tag
+              git reset --hard $eol_tag
+              if ! git clean -x -f -d -q ; then
+                  sleep 1
+                  git clean -x -f -d -q
+              fi
+          fi
+      else
+          git checkout master
+      fi
+  args:
+    executable: /bin/bash
+  with_items: '{{ found_repos.files }}'
+  when: devstack_sources_branch is defined
+
 - name: Set ownership of repos
   file:
     path: '{{ devstack_base_dir }}'

From 5ed05394ffddcd7db278db7c30b1315dcd37f724 Mon Sep 17 00:00:00 2001
From: melissaml <ma.lei@99cloud.net>
Date: Thu, 20 Sep 2018 10:45:10 +0800
Subject: [PATCH 2338/3333] fix a typo

Change-Id: I3cc4633b125ef3c5be40dd444cad78a888f832e4
---
 lib/neutron_plugins/bigswitch_floodlight | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 52c6ad58b5..d3f5bd5752 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Neuton Big Switch/FloodLight plugin
+# Neutron Big Switch/FloodLight plugin
 # ------------------------------------
 
 # Save trace setting

From dae1041c9412e76927614dcd1e1b3bc5600692d3 Mon Sep 17 00:00:00 2001
From: Lajos Katona <lajos.katona@ericsson.com>
Date: Fri, 21 Sep 2018 10:51:47 +0200
Subject: [PATCH 2339/3333] doc: Add USE_PYTHON3 to configuration guide

Change-Id: I8b6743c1dbdc00001691b2727bd0c344fb6ccd51
---
 doc/source/configuration.rst | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 46e50df6bb..022e6ba529 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -446,6 +446,16 @@ Python bindings added when they are enabled.
 
      ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
+Use python3
+------------
+
+By default ``stack.sh`` uses python2 (the exact version set by the
+``PYTHON2_VERSION``). This can be overriden so devstack will run
+python3 (the exact version set by ``PYTHON3_VERSION``).
+
+  ::
+
+     USE_PYTHON3=True
 
 A clean install every time
 --------------------------

From b38cb6d084ea2c38bc0de1b2d385935552b2bbfd Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 24 Sep 2018 06:19:33 +0000
Subject: [PATCH 2340/3333] Updated from generate-devstack-plugins-list

Change-Id: I4dba3ebf78333524185e84f94a2e7d52ad05a968
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f0c6238e0b..2361b4b54c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -62,7 +62,6 @@ freezer                                `git://git.openstack.org/openstack/freeze
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
 freezer-tempest-plugin                 `git://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
-fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__

From 61f6cafed7030a70e76b1836fba2390a22b052dd Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Mon, 24 Sep 2018 12:34:15 +0200
Subject: [PATCH 2341/3333] Switch to lioadm in openSUSE distros

This patch switches the CINDER_ISCSI_HELPER from tgtadm
to lioadm in openSUSE distros, as it increase the performance
and reduce the flakiness on some tests.

Change-Id: Ic3ee9c6baabe20f8f4d14246f6e29808796a5db9
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 lib/cinder | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 664f423c73..76bf928413 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -96,9 +96,9 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # https://bugs.launchpad.net/cinder/+bug/1180976
 CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
-# Centos7 switched to using LIO and that's all that's supported,
-# although the tgt bits are in EPEL we don't want that for CI
-if is_fedora; then
+# Centos7 and OpenSUSE switched to using LIO and that's all that's supported,
+# although the tgt bits are in EPEL and OpenSUSE we don't want that for CI
+if is_fedora || is_suse; then
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
         die "lioadm is the only valid Cinder target_helper config on this platform"

From 4e16c3dd5f4c5740ab92facf2083282440df9ac0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Suder?= <pawel@suder.info>
Date: Wed, 26 Sep 2018 15:52:13 +0200
Subject: [PATCH 2342/3333] Fix common systemd pitfalls die msg

That change introduces correct way of generating msg
for die in common systemd pitfalls.

Co-Authored-By: Szymon Datko <szymon.datko@corp.ovh.com>
Co-Authored-By: Piotr Bielak <piotr.bielak@corp.ovh.com>
Change-Id: I28aebffce6c5561360a9e44c1abc44b709054c30
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index fae936a3d0..d83cd4c3bb 100644
--- a/functions-common
+++ b/functions-common
@@ -1439,7 +1439,7 @@ function _common_systemd_pitfalls {
     # do some sanity checks on $cmd to see things we don't expect to work
 
     if [[ "$cmd" =~ "sudo" ]]; then
-        local msg=<<EOF
+        read -r -d '' msg << EOF || true  # read returns 1 for EOF, but it is ok here
 You are trying to use run_process with sudo, this is not going to work under systemd.
 
 If you need to run a service as a user other than $STACK_USER call it with:
@@ -1450,7 +1450,7 @@ EOF
     fi
 
     if [[ ! "$cmd" =~ ^/ ]]; then
-        local msg=<<EOF
+        read -r -d '' msg << EOF || true  # read returns 1 for EOF, but it is ok here
 The cmd="$cmd" does not start with an absolute path. It will fail to
 start under systemd.
 

From faaf96bfb15c5f4c45a72b149dc6fe1e1f907a71 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Thu, 20 Sep 2018 17:16:23 +0000
Subject: [PATCH 2343/3333] remove external_network_bridge option

The external_network_bridge option is deprecated/legacy and being
removed from neutron (see I07474713206c218710544ad98c08caaa37dbf53a).
This patch removes the external_network_bridge option iniset from
devstack scripts.

Change-Id: I4d9641cc9bb83719c9af1edabb89a63c4c2b1d96
---
 lib/neutron                  | 3 ---
 lib/neutron_plugins/ovs_base | 4 ----
 2 files changed, 7 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4847e87f2f..4e9691dfc0 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -95,9 +95,6 @@ NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
 NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
-# This is needed because _neutron_ovs_base_configure_l3_agent will set
-# external_network_bridge
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 # This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
 # an external network bridge
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 523024e2fe..558a7d5d07 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -96,10 +96,6 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    fi
-
     neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||

From d543ecb737507cae19d5e9d4b4c9fe1265ffbb6f Mon Sep 17 00:00:00 2001
From: Goutham Pacha Ravi <gouthampravi@gmail.com>
Date: Thu, 27 Sep 2018 09:59:24 -0700
Subject: [PATCH 2344/3333] Add a Bionic Beaver nodeset

I'm switching tempest/dsvm jobs to run on
Ubuntu 18.04 LTS (Bionic Beaver) on openstack/manila,
and I believe this nodeset can be here
so other projects can use it too.

Change-Id: Ib8279cde3e14d5378f27254188ee14dbb0800428
Needed-By: https://review.openstack.org/#/c/604929/
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9d73bede54..94da654193 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-bionic
+    nodes:
+      - name: controller
+        label: ubuntu-bionic
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-centos-7
     nodes:

From 991b1f13f0aed578dccec2e761be69005357444f Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 27 Sep 2018 18:30:38 +0000
Subject: [PATCH 2345/3333] Update cinder backup_driver to full class name

Legacy backup service support was recently dropped from cinder in
change I3ada2dee1857074746b1893b82dd5f6641c6e579 and we need to
adjust how we set the config option in devstack accordingly. This
updates the backup_driver option to specify a full class name instead
of only the module name.

Closes-Bug: #1794859

Change-Id: I3a72f38b564b8b83b233fccba7685833b6394d45
---
 lib/cinder_backends/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 00a0bb3b3d..33c9706d3d 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -65,7 +65,7 @@ function configure_cinder_backend_ceph {
         sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
-        iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph"
+        iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
         iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
         iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
         iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"

From 866efef17af8f0d04240bf05714cb12452185822 Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Fri, 28 Sep 2018 10:43:46 +0200
Subject: [PATCH 2346/3333] Allow ipv6 ECMP in devstack

It turns out that a host can have multiple valid default gateways,
something that's not common in ipv4.

This patches add supports for multiple default gateways in ipv6
environments.

Closes-Bug: #1786259

Change-Id: I30bf655f7160dd19c427ee79acdf145671a3e520
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 lib/neutron_plugins/services/l3 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 9be32b79aa..ec289f6656 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -103,7 +103,7 @@ SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
 die_if_not_set $LINENO default_v4_route_devs "Failure retrieving default IPv4 route devices"
 
-default_v6_route_devs=$(ip -6 route | grep ^default | awk '{print $5}')
+default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
@@ -395,6 +395,10 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
+        # if the Linux host considers itself to be a router then it will
+        # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
         # This is needed for neutron-based devstack clouds to work in
         # IPv6-only clouds in the gate. Please do not remove this without
@@ -405,8 +409,6 @@ function _neutron_configure_router_v6 {
             # device name would be reinterpreted as a slash, causing an error.
             sudo sysctl -w net/ipv6/conf/$d/accept_ra=2
         done
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
         IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')

From e991f7da457e0f1343ca13e8adeb0f6334b04990 Mon Sep 17 00:00:00 2001
From: imacdonn <iain.macdonnell@oracle.com>
Date: Thu, 4 Oct 2018 19:41:59 +0000
Subject: [PATCH 2347/3333] Use bash-style test for Fedora version

Old-style test fails on Ubuntu when python3 enabled, with:

.../devstack/inc/python: line 52: [: 16.04: integer expression expected

Use bash-style test, which doesn't attempt to evaluate the RHS if the
LHS evaluates to false

Change-Id: If18031ab98c9060e5825c3a8d3c647bd3705cd9c
Closes-Bug: #1796174
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 96be107dfa..d8b8169fa1 100644
--- a/inc/python
+++ b/inc/python
@@ -49,7 +49,7 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if python3_enabled && [ "$os_VENDOR" = "Fedora" -a $os_RELEASE -gt 26 ]; then
+    if python3_enabled && [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
         # Default Python 3 install prefix changed to /usr/local in Fedora 27:
         # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
         echo "/usr/local/bin"

From 9a543a81acb808e4275765da7ff0f613109b6603 Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Fri, 28 Sep 2018 08:55:49 +0200
Subject: [PATCH 2348/3333] Don't use ipv6 for DNS SAN fields with python3

Python2 match routines for x509 fields are broken and have to use
the DNS field for ip addresses.

The problem is that if you use ipv6 addresses in the DNS field,
urllib3 fails when trying to encode it.

Since python3 match routines for x509 fields are correct, this patch
disables the hack for python3, encoding the ip address in the
corresponding field only of the certificate.

Partial-Bug: #1794929
Depends-On: https://review.openstack.org/#/c/608468

Change-Id: I7b9cb15ccfa181648afb12be51ee48bed14f9156
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 lib/tls | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index e3ed3cc2ac..217f40e3a5 100644
--- a/lib/tls
+++ b/lib/tls
@@ -227,9 +227,13 @@ function init_CA {
 function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
-            # Lie to let incomplete match routines work
-            # see https://bugs.python.org/issue23239
-            TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
+            if python3_enabled; then
+                TLS_IP="IP:$TLS_IP"
+            else
+                # Lie to let incomplete match routines work with python2
+                # see https://bugs.python.org/issue23239
+                TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
+            fi
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 

From e8a6a0261c8118e8f89b51f1e31015a236a0fba3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 8 Oct 2018 15:20:34 +1100
Subject: [PATCH 2349/3333] Quote error messages

As a follow-on to I28aebffce6c5561360a9e44c1abc44b709054c30; make sure
we quote the error messages on the way through so they retain their
newlines.

Change-Id: I493317948264941b4788b100a0b0bc13d2698acf
---
 functions-common | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index d83cd4c3bb..038e9adf3d 100644
--- a/functions-common
+++ b/functions-common
@@ -228,9 +228,9 @@ function err {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[ERROR] ${BASH_SOURCE[2]}:$1 $2"
-    echo $msg 1>&2;
+    echo "$msg" 1>&2;
     if [[ -n ${LOGDIR} ]]; then
-        echo $msg >> "${LOGDIR}/error.log"
+        echo "$msg" >> "${LOGDIR}/error.log"
     fi
     $xtrace
     return $exitcode
@@ -283,7 +283,7 @@ function warn {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[WARNING] ${BASH_SOURCE[2]}:$1 $2"
-    echo $msg
+    echo "$msg"
     $xtrace
     return $exitcode
 }
@@ -1442,11 +1442,11 @@ function _common_systemd_pitfalls {
         read -r -d '' msg << EOF || true  # read returns 1 for EOF, but it is ok here
 You are trying to use run_process with sudo, this is not going to work under systemd.
 
-If you need to run a service as a user other than $STACK_USER call it with:
+If you need to run a service as a user other than \$STACK_USER call it with:
 
    run_process \$name \$cmd \$group \$user
 EOF
-        die $LINENO $msg
+        die $LINENO "$msg"
     fi
 
     if [[ ! "$cmd" =~ ^/ ]]; then
@@ -1456,7 +1456,7 @@ start under systemd.
 
 Please update your run_process stanza to have an absolute path.
 EOF
-        die $LINENO $msg
+        die $LINENO "$msg"
     fi
 
 }

From eb7d1ad198276821c3037cb6a23f995537572dcd Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Mon, 24 Sep 2018 10:17:16 +0200
Subject: [PATCH 2350/3333] Disable apparmor for openSUSE distros

Dnsmasq and haproxy are used frequently by neutron and nova, apparmor
profiles can block some operations and the deployed cloud can't
work properly so some tests are going to fail.

Some openSUSE distros has apparmor enabled by default so we need to
disable it.

Change-Id: I30fda684effb09810643e58bf0b31a73d7d9b378
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 tools/fixup_stuff.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 914793245e..a939e30b02 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -205,6 +205,19 @@ function fixup_fedora {
     fi
 }
 
+function fixup_suse {
+    if ! is_suse; then
+        return
+    fi
+
+    # Disable apparmor profiles in openSUSE distros
+    # to avoid issues with haproxy and dnsmasq
+    if [ -x /usr/sbin/aa-enabled ] && sudo /usr/sbin/aa-enabled -q; then
+        sudo systemctl disable apparmor
+        sudo /usr/sbin/aa-teardown
+    fi
+}
+
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
 # connection issues under proxy so re-install the latest version using
 # pip. To avoid having pip's virtualenv overwritten by the distro's
@@ -239,5 +252,6 @@ function fixup_all {
     fixup_uca
     fixup_python_packages
     fixup_fedora
+    fixup_suse
     fixup_virtualenv
 }

From 297a50ac86e597cb31c7f4347925ad0e5984960f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 20 Jun 2018 11:08:54 +0200
Subject: [PATCH 2351/3333] Convert to openSUSE Leap 15.0 platform testing

Leap 15.0 has been released May 25th, 2018 (see
https://en.opensuse.org/Portal:15.0 ) and we'd like to
transition devstack against it and remove Leap 42.3 from
the testing matrix. Leap 15.0 is newer than Leap 42.3 as
the numbering schema of openSUSE was changed.

Co-Authored-By: Antonio Ojea <itsuugo@gmail.com>

Change-Id: I078f9a2580160c564c33e575008516f5e92239d6
---
 .zuul.yaml          | 12 ++++++------
 functions-common    |  8 +++++---
 lib/databases/mysql |  2 +-
 stack.sh            |  3 ++-
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9d73bede54..87b8049403 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -19,10 +19,10 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-opensuse-423
+    name: devstack-single-node-opensuse-150
     nodes:
       - name: controller
-        label: opensuse-423
+        label: opensuse-150
     groups:
       - name: tempest
         nodes:
@@ -395,10 +395,10 @@
     voting: false
 
 - job:
-    name: devstack-platform-opensuse-423
+    name: devstack-platform-opensuse-150
     parent: tempest-full
-    description: openSUSE 43.2 platform test
-    nodeset: devstack-single-node-opensuse-423
+    description: openSUSE 15.0 platform test
+    nodeset: devstack-single-node-opensuse-150
     voting: false
 
 - job:
@@ -487,7 +487,7 @@
       jobs:
         - devstack
         - devstack-platform-centos-7
-        - devstack-platform-opensuse-423
+        - devstack-platform-opensuse-150
         - devstack-platform-opensuse-tumbleweed
         - devstack-platform-fedora-latest
         - devstack-multinode
diff --git a/functions-common b/functions-common
index fae936a3d0..fa571aecfd 100644
--- a/functions-common
+++ b/functions-common
@@ -374,8 +374,10 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
         DISTRO="opensuse-$os_RELEASE"
         # Tumbleweed uses "n/a" as a codename, and the release is a datestring
-        # like 20180218, so not very useful.
-        [ "$os_CODENAME" = "n/a" ] && DISTRO="opensuse-tumbleweed"
+        # like 20180218, so not very useful. Leap however uses a release
+        # with a "dot", so for example 15.0
+        [ "$os_CODENAME" = "n/a" -a "$os_RELEASE" = "${os_RELEASE/\./}" ] && \
+            DISTRO="opensuse-tumbleweed"
     elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
         # just use major release
         DISTRO="sle${os_RELEASE%.*}"
@@ -1376,7 +1378,7 @@ function zypper_install {
     [[ "$(id -u)" = "0" ]] && sudo="env"
     $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
-        zypper --non-interactive install --auto-agree-with-licenses "$@"
+        zypper --non-interactive install --auto-agree-with-licenses --no-recommends "$@"
 }
 
 function write_user_unit_file {
diff --git a/lib/databases/mysql b/lib/databases/mysql
index cf61056389..ac0c083c91 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -16,7 +16,7 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 register_database mysql
 
 MYSQL_SERVICE_NAME=mysql
-if is_fedora && ! is_oraclelinux; then
+if is_suse || is_fedora && ! is_oraclelinux; then
     MYSQL_SERVICE_NAME=mariadb
 fi
 
diff --git a/stack.sh b/stack.sh
index 56e00bfb67..be3c4be147 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
@@ -1137,6 +1137,7 @@ if is_service_enabled neutron; then
     echo_summary "Configuring Neutron"
 
     configure_neutron
+
     # Run init_neutron only on the node hosting the Neutron API server
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled neutron; then
         init_neutron

From 35485ca21f13788958a636829e135ee639881a76 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 9 Oct 2018 07:39:07 +0000
Subject: [PATCH 2352/3333] Remove setting of unnecessary tempest config
 options

Tempest have removed the volume-feature-enabled.api_v1
config options[1] and modified the default value of
volume-feature-enabled.api_v3 to True.

These config options not needed to be set from devstack
side.

[1] https://review.openstack.org/#/c/573135/

Change-Id: Ic35cf4482ab4d3c2e69348ec92568e68f6ea74ee
---
 lib/tempest | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 3fefa5b320..fba8826a2d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -456,9 +456,6 @@ function configure_tempest {
         TEMPEST_EXTEND_ATTACHED_VOLUME=${TEMPEST_EXTEND_ATTACHED_VOLUME:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_volume $(trueorfalse False TEMPEST_EXTEND_ATTACHED_VOLUME)
-    # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     # Reset microversions to None where v2 is running which does not support microversion.

From da863fab1d54f285fdf964c7d09602e4801b627d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 10 Oct 2018 06:20:08 +0000
Subject: [PATCH 2353/3333] Updated from generate-devstack-plugins-list

Change-Id: I53db3e407e9495cbff758e823ea95485c888e706
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2361b4b54c..0ebd0c32a1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -171,6 +171,7 @@ solum                                  `git://git.openstack.org/openstack/solum
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
+stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From 0d91c29d9e363ac09d98d17bae90da1acd5ee66a Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Mon, 8 Oct 2018 16:43:19 +0200
Subject: [PATCH 2354/3333] Add devstack ipv6 jobs

We can see that there is more demand on using ipv6 as the underlay
infrastructure to deploy new services, and OpenStack should be ready for
that.

These devstack ipv6 jobs are based on the work started by Jens Harbott in
https://review.openstack.org/#/c/608168/

Change-Id: I55bd067487665e5026e82a0737cb0f38a69499fb
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 .zuul.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9d73bede54..6e6d458d0c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -375,6 +375,19 @@
           VNCSERVER_LISTEN: 0.0.0.0
           VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
 
+- job:
+    name: devstack-ipv6
+    parent: devstack
+    description: |
+      Devstack single node job for integration gate with IPv6.
+    vars:
+      devstack_localrc:
+        SERVICE_IP_VERSION: 6
+        SERVICE_HOST: ""
+        # IPv6 and certificates known issue with python2
+        # https://bugs.launchpad.net/devstack/+bug/1794929
+        USE_PYTHON3: true
+
 - job:
     name: devstack-multinode
     parent: devstack
@@ -486,6 +499,8 @@
     check:
       jobs:
         - devstack
+        - devstack-ipv6:
+            voting: false
         - devstack-platform-centos-7
         - devstack-platform-opensuse-423
         - devstack-platform-opensuse-tumbleweed

From e9f3988a57498f8593ff51055be212402fec60ce Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 11 Oct 2018 07:02:16 +0000
Subject: [PATCH 2355/3333] Updated from generate-devstack-plugins-list

Change-Id: Iae7700901060efa7687138dc6adf93604afa3ef6
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0ebd0c32a1..b6b4058223 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -65,6 +65,7 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+gyan                                   `git://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 heat-dashboard                         `git://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__

From 7d0003ef7ed2c2609ffe6782e0ce6147f9c9a3bf Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 11 Oct 2018 08:59:26 -0700
Subject: [PATCH 2356/3333] Make sure nova-compute is not configured with
 database access

Apparently we're inheriting some database config from the main file,
which should not be set for nova-compute. If we're properly in superconductor
mode where we have a dedicated config for compute, remove those lines
if present.

Closes-Bug: #1797413

Change-Id: I4820abe57a023050dd8d067c77e26028801ff288
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index 5e157c5f11..8b49116147 100644
--- a/lib/nova
+++ b/lib/nova
@@ -922,6 +922,9 @@ function start_nova_compute {
         # RPC, we also disable track_instance_changes.
         iniset $NOVA_CPU_CONF filter_scheduler track_instance_changes False
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
+        # Make sure we nuke any database config
+        inidelete $NOVA_CPU_CONF database connection
+        inidelete $NOVA_CPU_CONF api_database connection
     fi
 
     # Console proxies were configured earlier in create_nova_conf. Now that the

From 2c90239acc840659d8ae08e66be01917a2395bac Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Fri, 12 Oct 2018 10:09:17 +0200
Subject: [PATCH 2357/3333] Use tempest-pg-full

The legacy job legacy-tempest-dsvm-neutron-pg-full is now named
tempest-pg-full - using the new tempest and Zuul v3 frameworks.

Change experimental job to use new job.

Change-Id: If16397724fb4facd2a0db8148bdf7ba427ca10b6
Depends-On: https://review.openstack.org/609530
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c21fc9e2bd..8520f21353 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -597,7 +597,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-neutron-pg-full:
+        - tempest-pg-full:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 1c75d2f06c03b0ed0517b499674d36052bcc3793 Mon Sep 17 00:00:00 2001
From: Laura Sofia Enriquez <lsofia.enriquez@gmail.com>
Date: Thu, 11 Oct 2018 19:13:17 -0300
Subject: [PATCH 2358/3333] Fedora version updated in Devstack doc

Docs say that you require Fedora 24/25 to run Devstack, but Devstack
is working in newer versions. Update document to say that Fedora 28
can be used instead.

Closes-Bug: #1797239

Change-Id: Ie5227db9943e5ddb93cd37440165eabbae22f4fc
Signed-off-by: Laura Sofia Enriquez <lsofia.enriquez@gmail.com>
---
 doc/source/index.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2ff4ff088a..fcf1e82d34 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -39,8 +39,9 @@ Install Linux
 -------------
 
 Start with a clean and minimal install of a Linux system. Devstack
-attempts to support Ubuntu 16.04/17.04, Fedora 24/25, CentOS/RHEL 7,
-as well as Debian and OpenSUSE.
+attempts to support the two latest LTS releases of Ubuntu, the
+latest/current Fedora version, CentOS/RHEL 7, as well as Debian and
+OpenSUSE.
 
 If you do not have a preference, Ubuntu 16.04 is the most tested, and
 will probably go the smoothest.

From 99cd16574604fc36e4fa9a8264100fe2ef17c808 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 18 Oct 2018 06:18:46 +0000
Subject: [PATCH 2359/3333] Updated from generate-devstack-plugins-list

Change-Id: I2ba736a97377ba1823b3d48983ebf6e4640c72aa
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b6b4058223..00c1255e2a 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -173,6 +173,7 @@ stackube                               `git://git.openstack.org/openstack/stacku
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From 606e6bc446a421646b84ae7c143dbfb76cb416da Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 25 Oct 2018 06:29:11 +0000
Subject: [PATCH 2360/3333] Updated from generate-devstack-plugins-list

Change-Id: Ie132b6898b44d24e71aa2f3534931ffac2a9efa1
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 00c1255e2a..b02061ed50 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -27,7 +27,6 @@ Plugin Name                            URL
 almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
 apmec                                  `git://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
-astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
 blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__

From 7ddd733b7251259ddd67b93be6305380582f7ce7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 9 May 2018 06:36:38 +0000
Subject: [PATCH 2361/3333] Drop devstack-platform-opensuse-tumbleweed

Builds of opensuse-tumbleweed nodes are currently failing, so these jobs
are receiving NODE_FAILURE.

Change-Id: I3c2d73a150df009e7dadc76277be36eb72e0dfa7
---
 .zuul.yaml | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6682142ed2..7ac30d8284 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,16 +38,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-opensuse-tumbleweed
-    nodes:
-      - name: controller
-        label: opensuse-tumbleweed
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-fedora-latest
     nodes:
@@ -424,13 +414,6 @@
     nodeset: devstack-single-node-opensuse-150
     voting: false
 
-- job:
-    name: devstack-platform-opensuse-tumbleweed
-    parent: tempest-full
-    description: openSUSE Tumbleweed platform test
-    nodeset: devstack-single-node-opensuse-tumbleweed
-    voting: false
-
 - job:
     name: devstack-platform-fedora-latest
     parent: tempest-full
@@ -513,7 +496,6 @@
             voting: false
         - devstack-platform-centos-7
         - devstack-platform-opensuse-150
-        - devstack-platform-opensuse-tumbleweed
         - devstack-platform-fedora-latest
         - devstack-multinode
         - devstack-unit-tests

From 0d4c9c9fa37c6f47523359044e5f65629321ff6d Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 10 Sep 2018 15:52:46 -0600
Subject: [PATCH 2362/3333] Have lib/tempest to create shared network

In order to make sure not possible to introduce a change in tempest
which breaks the shared network compatibility.

Depends-On: I6e3e53c4ac26b4fef09fefb9c590dfa91f577565

Change-Id: Ib2e7096175c991acf35de04e840ac188752d3c17
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index fba8826a2d..84177e82f2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -242,6 +242,9 @@ function configure_tempest {
     # and the public_network_id should not be set.
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
+        # make sure shared network presence does not confuses the tempest tests
+        openstack network create --share shared
+        openstack subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG

From 994e82e57f78a4c302d620e44bcdda36c4c0d5f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Fri, 19 Oct 2018 12:08:12 +0200
Subject: [PATCH 2363/3333] Update ETCD_DOWNLOAD_URL

Looks like https://github.com/coreos/etcd is redirecting to
https://github.com/etcd-io/etcd, so let's use that official address as
the download URL.

Change-Id: I39355b4deb17ae11927a5339e73fb8ec3a274cf7
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 34bd6771a6..5dd5602be6 100644
--- a/stackrc
+++ b/stackrc
@@ -763,7 +763,7 @@ else
 fi
 ETCD_PORT=${ETCD_PORT:-2379}
 ETCD_PEER_PORT=${ETCD_PEER_PORT:-2380}
-ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
+ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/etcd-io/etcd/releases/download}
 ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
 ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
 ETCD_DOWNLOAD_LOCATION=$ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE

From e3e9ea299601665a295e31a98e90dd9587165850 Mon Sep 17 00:00:00 2001
From: Derek Higgins <derekh@redhat.com>
Date: Fri, 9 Nov 2018 15:43:13 +0000
Subject: [PATCH 2364/3333] Revert "remove external_network_bridge option"

This reverts commit faaf96bfb15c5f4c45a72b149dc6fe1e1f907a71.

Ironic jobs were still using this option, it needs to be
switched to an alternative first.

Change-Id: I1683d7cfa81f5fe2497cc7045e87f8b20fed4968
---
 lib/neutron                  | 3 +++
 lib/neutron_plugins/ovs_base | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 4e9691dfc0..4847e87f2f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -95,6 +95,9 @@ NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
 NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
+# This is needed because _neutron_ovs_base_configure_l3_agent will set
+# external_network_bridge
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 # This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
 # an external network bridge
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 558a7d5d07..523024e2fe 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -96,6 +96,10 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
+    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
+        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
+    fi
+
     neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||

From 0f5a20fb79380806b7fd81d9e6d9c8afcd7dfbed Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 22 Nov 2018 06:19:15 +0000
Subject: [PATCH 2365/3333] Updated from generate-devstack-plugins-list

Change-Id: I992065186ed4a4c5811a7c82ac09a0bc85ca11e8
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b02061ed50..7ed24638fd 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -172,6 +172,8 @@ stackube                               `git://git.openstack.org/openstack/stacku
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-integ                              `git://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
+stx-nfv                                `git://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
 stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__

From 8d1b20b4c2334dc3045cea93441568657869f6d1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 22 Nov 2018 13:17:01 +0000
Subject: [PATCH 2366/3333] Enable universe repository on Ubuntu

The universe repository is not enabled when installing Ubuntu from an
ISO (at least for Bionic). This leads to some errors during the devstack
run that are not seen when running based on a cloud image which has that
repo enabled by default. Enable that repository unconditionally, the
operation is idempotent.

Change-Id: Ifcb7ecd78fb25ca2136f5848c19b74500e520873
Closes-Bug: 1792936
---
 tools/fixup_stuff.sh | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a939e30b02..4513af0a64 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -69,21 +69,29 @@ function fixup_keystone {
     fi
 }
 
-# Ubuntu Cloud Archive
-#---------------------
+# Ubuntu Repositories
+#--------------------
 # We've found that Libvirt on Xenial is flaky and crashes enough to be
 # a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
 # get newer Libvirt.
 # Make it possible to switch this based on an environment variable as
 # libvirt 2.5.0 doesn't handle nested virtualization quite well and this
 # is required for the trove development environment.
-function fixup_uca {
-    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
+# Also enable universe since it is missing when installing from ISO.
+function fixup_ubuntu {
+    if [[ "$DISTRO" != "xenial" && "$DISTRO" != "bionic" ]]; then
         return
     fi
 
     # This pulls in apt-add-repository
     install_package "software-properties-common"
+
+    # Enable universe
+    sudo add-apt-repository -y universe
+
+    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
+        return
+    fi
     # Use UCA for newer libvirt.
     if [[ -f /etc/ci/mirror_info.sh ]] ; then
         # If we are on a nodepool provided host and it has told us about where
@@ -249,7 +257,7 @@ function fixup_virtualenv {
 
 function fixup_all {
     fixup_keystone
-    fixup_uca
+    fixup_ubuntu
     fixup_python_packages
     fixup_fedora
     fixup_suse

From 80769c5714770c02c300ac9f3e9c06a44791dbfc Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Fri, 23 Nov 2018 05:18:40 +0900
Subject: [PATCH 2367/3333] Migration logic for neutron policy-in-code

Neutron is in a process to migrate to policy-in-code.
DevStack needs to be able to handle both cases with and
without policy.json in the neutron repo.

Note that nova assumes neutron API access with admin
so user_name:neutron needs to be included in context_is_admin
to make DevStack work properly. Hopefully this can be cleanup
but this is a separate topic from policy-in-code.

Needed-By: https://review.openstack.org/#/c/585037/
Change-Id: Id1b0600d92e839ade1790a15c372e82e8e16ee9f
---
 lib/neutron        | 9 +++++++--
 lib/neutron-legacy | 9 +++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4847e87f2f..62f7366e7e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -183,9 +183,14 @@ function configure_neutron_new {
     # Neutron API server & Neutron plugin
     if is_service_enabled neutron-api; then
         local policy_file=$NEUTRON_CONF_DIR/policy.json
-        cp $NEUTRON_DIR/etc/policy.json $policy_file
         # Allow neutron user to administer neutron to match neutron account
-        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
+        # NOTE(amotoki): This is required for nova works correctly with neutron.
+        if [ -f $NEUTRON_DIR/etc/policy.json ]; then
+            cp $NEUTRON_DIR/etc/policy.json $policy_file
+            sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
+        else
+            echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $policy_file
+        fi
 
         cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index be5b73ffa6..2fdb6db6f6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -699,10 +699,15 @@ function _configure_neutron_common {
     cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
 
     Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
-    cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
 
     # allow neutron user to administer neutron to match neutron account
-    sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
+    # NOTE(amotoki): This is required for nova works correctly with neutron.
+    if [ -f $NEUTRON_DIR/etc/policy.json ]; then
+        cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
+        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
+    else
+        echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $Q_POLICY_FILE
+    fi
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.

From 67394b02417802842021fdef95f68edbf723eb71 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sat, 24 Nov 2018 10:14:46 +0100
Subject: [PATCH 2368/3333] Remove is_in_projects_txt

This function is nowhere used as confirmed by codesearch:
http://codesearch.openstack.org/?q=is_in_projects_txt&i=nope&files=&repos=

We can remove the function.

Note that usage of this function was removed in change
I843208e2e982eb04931b76f5cb4bd219fbcd70de in 2015.

This came up in context of https://review.openstack.org/619089 where
requirements/projects.txt is getting removed.

Change-Id: I487d3f9e340bd45e83245b9ca91e8e3b5ac3ae02
---
 inc/python | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/inc/python b/inc/python
index d8b8169fa1..5fb7245623 100644
--- a/inc/python
+++ b/inc/python
@@ -490,17 +490,6 @@ function setup_develop {
     _setup_package_with_constraints_edit $project_dir -e $extras
 }
 
-# determine if a project as specified by directory is in
-# projects.txt. This will not be an exact match because we throw away
-# the namespacing when we clone, but it should be good enough in all
-# practical ways.
-function is_in_projects_txt {
-    local project_dir=$1
-    local project_name
-    project_name=$(basename $project_dir)
-    grep -q "/$project_name\$" $REQUIREMENTS_DIR/projects.txt
-}
-
 # ``pip install -e`` the package, which processes the dependencies
 # using pip before running `setup.py develop`
 #

From 23d33a8b5bc945bd98c8fffe86b38f97247afbd9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 21 Nov 2018 12:10:32 -0500
Subject: [PATCH 2369/3333] Set non-0 disk sizes for tempest flavors

Nova change https://review.openstack.org/603910/ is
going to change the default rule on policy
os_compute_api:servers:create:zero_disk_flavor to
admin-only, which will prevent non-admins from
creating image-backed servers with a flavor that
has disk=0 since it's a potential security exposure.

Therefore we need the test flavors that are created
for tempest to use non-0 disk values. Since the flavor_ref
and flavor_ref_alt can be aligned to the image_ref and
image_ref_alt in tempest.conf, we get the image sizes
from glance (in bytes) and convert those to GiB disk
sizes for each flavor, respectively. Since we're using
Cirros images by default, we need to make sure to round
up otherwise we'd still have a 0-disk flavor.

There are lots of ways the math could be done here
using numfmt, bash, awk, bc, etc, but it's simplest to
write and probably easiest to read by using python for
the size conversion code.

Change-Id: I537c299b0cd400982189f35b31df74755422737e
Related-Bug: #1739646
---
 lib/tempest | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index fba8826a2d..7526d3bb4e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -102,6 +102,14 @@ function remove_disabled_extensions {
     remove_disabled_services "$extensions_list" "$disabled_exts"
 }
 
+# image_size_in_gib - converts an image size from bytes to GiB, rounded up
+# Takes an image ID parameter as input
+function image_size_in_gib {
+    local size
+    size=$(openstack image show $1 -c size -f value)
+    echo $size | python -c "import math; print int(math.ceil(float(int(raw_input()) / 1024.0 ** 3)))"
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     if [[ "$INSTALL_TEMPEST" == "True" ]]; then
@@ -125,6 +133,7 @@ function configure_tempest {
     local public_network_id
     local public_router_id
     local ssh_connect_method="floating"
+    local disk
 
     # Save IFS
     ifs=$IFS
@@ -190,11 +199,15 @@ function configure_tempest {
         available_flavors=$(nova flavor-list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
-                openstack flavor create --id 42 --ram 64 --disk 0 --vcpus 1 m1.nano
+                # Determine the flavor disk size based on the image size.
+                disk=$(image_size_in_gib $image_uuid)
+                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
-                openstack flavor create --id 84 --ram 128 --disk 0 --vcpus 1 m1.micro
+                # Determine the alt flavor disk size based on the alt image size.
+                disk=$(image_size_in_gib $image_uuid_alt)
+                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 m1.micro
             fi
             flavor_ref_alt=84
         else

From 78a564bb0304b6f930e1491e7e116a0a0f6d9ab6 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Fri, 5 Oct 2018 10:17:56 +0100
Subject: [PATCH 2370/3333] Use openstack/placement instead of
 placement-in-nova

We introduce and set PLACEMENT_REPO, add a placement-manage command
to sync database tables (see one of the commits on which this
depends), use /etc/placement/placement.conf for config, and put the
uwsgi config file (pointing to placement-api instead of
nova-placement-api) in /etc/placement.

openstack/placement is also added to the required-projects in
the devstack zuul job.

Change-Id: I0b217e7a8c68a637b7a3445f6c44b7574117e320
---
 .zuul.yaml    |  5 ++--
 lib/placement | 81 ++++++++++++++++++++++++++-------------------------
 stack.sh      |  2 --
 stackrc       |  4 +++
 4 files changed, 48 insertions(+), 44 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7ac30d8284..38e663e933 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -241,8 +241,8 @@
       This base job can be used for single node and multinode devstack jobs.
 
       With a single node nodeset, this job sets up an "all-in-one" (aio)
-      devstack with the six OpenStack services included in the devstack tree:
-      keystone, glance, cinder, neutron, nova and swift.
+      devstack with the seven OpenStack services included in the devstack tree:
+      keystone, glance, cinder, neutron, nova, placement, and swift.
 
       With a two node nodeset, this job sets up an aio + compute node.
       The controller can be customised using host-vars.controller, the
@@ -265,6 +265,7 @@
       - git.openstack.org/openstack/keystone
       - git.openstack.org/openstack/neutron
       - git.openstack.org/openstack/nova
+      - git.openstack.org/openstack/placement
       - git.openstack.org/openstack/swift
     timeout: 7200
     vars:
diff --git a/lib/placement b/lib/placement
index a1602bab90..409ebecc4a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -3,9 +3,6 @@
 # lib/placement
 # Functions to control the configuration and operation of the **Placement** service
 #
-# Currently the placement service is embedded in nova. Eventually we
-# expect this to change so this file is started as a separate entity
-# despite making use of some *NOVA* variables and files.
 
 # Dependencies:
 #
@@ -29,23 +26,21 @@ set +o xtrace
 # Defaults
 # --------
 
-PLACEMENT_CONF_DIR=/etc/nova
-PLACEMENT_CONF=$PLACEMENT_CONF_DIR/nova.conf
-PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
-# Nova virtual environment
+PLACEMENT_DIR=$DEST/placement
+PLACEMENT_CONF_DIR=/etc/placement
+PLACEMENT_CONF=$PLACEMENT_CONF_DIR/placement.conf
+PLACEMENT_AUTH_CACHE_DIR=${PLACEMENT_AUTH_CACHE_DIR:-/var/cache/placement}
+PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-keystone}
+# Placement virtual environment
 if [[ ${USE_VENV} = True ]]; then
-    PROJECT_VENV["nova"]=${NOVA_DIR}.venv
-    PLACEMENT_BIN_DIR=${PROJECT_VENV["nova"]}/bin
+    PROJECT_VENV["placement"]=${PLACEMENT_DIR}.venv
+    PLACEMENT_BIN_DIR=${PROJECT_VENV["placement"]}/bin
 else
     PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
 fi
-PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/nova-placement-api
+PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/placement-api
 PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
-# The placement service can optionally use a separate database
-# connection. Set PLACEMENT_DB_ENABLED to True to use it.
-PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
-
 if is_service_enabled tls-proxy; then
     PLACEMENT_SERVICE_PROTOCOL="https"
 fi
@@ -70,27 +65,26 @@ function cleanup_placement {
     sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
+    sudo rm -f $PLACEMENT_AUTH_CACHE_DIR/*
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files
 function _config_placement_apache_wsgi {
     local placement_api_apache_conf
     local venv_path=""
-    local nova_bin_dir=""
-    nova_bin_dir=$(get_python_exec_prefix)
+    local placement_bin_dir=""
+    placement_bin_dir=$(get_python_exec_prefix)
     placement_api_apache_conf=$(apache_site_config_for placement-api)
 
-    # reuse nova's venv if there is one as placement code lives
-    # there
     if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
-        nova_bin_dir=${PROJECT_VENV["nova"]}/bin
+        venv_path="python-path=${PROJECT_VENV["placement"]}/lib/$(python_version)/site-packages"
+        placement_bin_dir=${PROJECT_VENV["placement"]}/bin
     fi
 
     sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
     sudo sed -e "
         s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$nova_bin_dir/nova-placement-api|g;
+        s|%PUBLICWSGI%|$placement_bin_dir/placement-api|g;
         s|%SSLENGINE%|$placement_ssl|g;
         s|%SSLCERTFILE%|$placement_certfile|g;
         s|%SSLKEYFILE%|$placement_keyfile|g;
@@ -110,19 +104,23 @@ function configure_placement_nova_compute {
     iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf placement project_name "$SERVICE_TENANT_NAME"
     iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    # TODO(cdent): auth_strategy, which is common to see in these
-    # blocks is not currently used here. For the time being the
-    # placement api uses the auth_strategy configuration setting
-    # established by the nova api. This avoids, for the time, being,
-    # creating redundant configuration items that are just used for
-    # testing.
+    iniset $conf placement auth_strategy $PLACEMENT_AUTH_STRATEGY
+}
+
+# create_placement_conf() - Write confg
+function create_placement_conf {
+    rm -f $PLACEMENT_CONF
+    iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
+    iniset $PLACEMENT_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
+    iniset $PLACEMENT_CONF api auth_strategy $PLACEMENT_AUTH_STRATEGY
+    configure_auth_token_middleware $PLACEMENT_CONF placement $PLACEMENT_AUTH_CACHE_DIR
+    setup_logging $PLACEMENT_CONF
 }
 
 # configure_placement() - Set config files, create data dirs, etc
 function configure_placement {
-    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
-        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
-    fi
+    sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
+    create_placement_conf
 
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
@@ -143,25 +141,28 @@ function create_placement_accounts {
         "$placement_api_url"
 }
 
+# create_placement_cache_dir() - Create directories for keystone cache
+function create_placement_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $PLACEMENT_AUTH_CACHE_DIR
+    rm -f $PLACEMENT_AUTH_CACHE_DIR/*
+}
+
 # init_placement() - Create service user and endpoints
-# If PLACEMENT_DB_ENABLED is true, create the separate placement db
-# using, for now, the api_db migrations.
 function init_placement {
-    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
-        recreate_database placement
-        # Database migration will be handled when nova does an api_db sync
-        # TODO(cdent): When placement is extracted we'll do our own sync
-        # here.
-    fi
+    recreate_database placement
+    $PLACEMENT_BIN_DIR/placement-manage db sync
     create_placement_accounts
+    create_placement_cache_dir
 }
 
 # install_placement() - Collect source and prepare
 function install_placement {
     install_apache_wsgi
     # Install the openstackclient placement client plugin for CLI
-    # TODO(mriedem): Use pip_install_gr once osc-placement is in g-r.
-    pip_install osc-placement
+    pip_install_gr osc-placement
+    git_clone $PLACEMENT_REPO $PLACEMENT_DIR $PLACEMENT_BRANCH
+    setup_develop $PLACEMENT_DIR
 }
 
 # start_placement_api() - Start the API processes ahead of other things
diff --git a/stack.sh b/stack.sh
index be3c4be147..497c8bc479 100755
--- a/stack.sh
+++ b/stack.sh
@@ -894,8 +894,6 @@ if is_service_enabled neutron; then
     stack_install_service neutron
 fi
 
-# Nova configuration is used by placement so we need to create nova.conf
-# first.
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
diff --git a/stackrc b/stackrc
index 34bd6771a6..746372d123 100644
--- a/stackrc
+++ b/stackrc
@@ -298,6 +298,10 @@ NOVA_BRANCH=${NOVA_BRANCH:-$TARGET_BRANCH}
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
 SWIFT_BRANCH=${SWIFT_BRANCH:-$TARGET_BRANCH}
 
+# placement service
+PLACEMENT_REPO=${PLACEMENT_REPO:-${GIT_BASE}/openstack/placement.git}
+PLACEMENT_BRANCH=${PLACEMENT_BRANCH:-$TARGET_BRANCH}
+
 ##############
 #
 #  Testing Components

From 3027c20545688a39c1db84a83e0e8252d238603c Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 20 Nov 2018 22:18:26 +0000
Subject: [PATCH 2371/3333] Address nits on lib/placement for extracted
 placement

Earlier review [1] suggested some cleanups which have been
done here:

* Removing a redundant call from cleanup_placement
* Fixing a typo in a comment

[1] https://review.openstack.org/#/c/600162/15/lib/placement

Change-Id: I8abd2f02b123c6c1937c026ff13eb4e600de3202
---
 lib/placement | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index 409ebecc4a..da69e39264 100644
--- a/lib/placement
+++ b/lib/placement
@@ -62,7 +62,6 @@ function is_placement_enabled {
 # cleanup_placement() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_placement {
-    sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
     sudo rm -f $PLACEMENT_AUTH_CACHE_DIR/*
@@ -107,7 +106,7 @@ function configure_placement_nova_compute {
     iniset $conf placement auth_strategy $PLACEMENT_AUTH_STRATEGY
 }
 
-# create_placement_conf() - Write confg
+# create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF
     iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`

From a6017b6eec743981fdbc9b50bf6b6752d1c86c0d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 16 Oct 2018 13:57:23 +0000
Subject: [PATCH 2372/3333] Add openstack-single-node-xenial nodeset

Allow other jobs to explicitly require a node running Xenial. This seems
clearer than having a generic openstack-single-node nodeset which
implicitly uses Xenial.

Change-Id: I013fb8abd4e6ab6539bd9410acbc8446e57ec70c
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7ac30d8284..f3fc87f23f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -18,6 +18,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-xenial
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-centos-7
     nodes:

From 4727aaa742e142427cc5138fe09b3c69c559b5e5 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 16 Oct 2018 13:57:23 +0000
Subject: [PATCH 2373/3333] Switch devstack jobs to run on Bionic

Switch the nodesets that devstack job run on from Xenial to Bionic,
i.e. the latest Ubuntu LTS release. Keep variants running on Xenial
in order to make sure that we stay backwards compatible while we keep
running Xenial jobs on the older stable branches.

Change-Id: I8749ed24d5f451d29f767ebb2761abd743b7d306
---
 .zuul.yaml | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 92 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f3fc87f23f..a1c570b78f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -88,6 +88,66 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-bionic
+    nodes:
+      - name: controller
+        label: ubuntu-bionic
+      - name: compute1
+        label: ubuntu-bionic
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
+- nodeset:
+    name: openstack-two-node-xenial
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+      - name: compute1
+        label: ubuntu-xenial
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - job:
     name: devstack-base
     parent: multinode
@@ -209,7 +269,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node
+    nodeset: openstack-single-node-bionic
     required-projects:
       - git.openstack.org/openstack/requirements
     vars:
@@ -268,7 +328,6 @@
 
       The run playbook consists of a single role, so it can be easily rewritten
       and extended.
-    nodeset: openstack-single-node
     required-projects:
       - git.openstack.org/openstack/cinder
       - git.openstack.org/openstack/glance
@@ -398,14 +457,31 @@
         # https://bugs.launchpad.net/devstack/+bug/1794929
         USE_PYTHON3: true
 
+- job:
+    name: devstack-xenial
+    parent: devstack
+    nodeset: openstack-single-node-xenial
+    description: |
+      Simple singlenode test to verify functionality on devstack
+      side running on Xenial.
+
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node
+    nodeset: openstack-two-node-bionic
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
 
+- job:
+    name: devstack-multinode-xenial
+    parent: devstack
+    nodeset: openstack-two-node-xenial
+    description: |
+      Simple multinode test to verify multinode functionality on devstack
+      side running on Xenial.
+      This is not meant to be used as a parent job.
+
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
@@ -431,6 +507,13 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
+- job:
+    name: devstack-platform-xenial
+    parent: tempest-full
+    description: Ubuntu Xenial platform test
+    nodeset: openstack-single-node-xenial
+    voting: false
+
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -502,12 +585,15 @@
     check:
       jobs:
         - devstack
+        - devstack-xenial
         - devstack-ipv6:
             voting: false
         - devstack-platform-centos-7
         - devstack-platform-opensuse-150
         - devstack-platform-fedora-latest
+        - devstack-platform-xenial
         - devstack-multinode
+        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
@@ -537,6 +623,9 @@
     gate:
       jobs:
         - devstack
+        - devstack-xenial
+        - devstack-multinode
+        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-grenade-multinode:

From 3492feeedda7accb58a179c64932d4b6d154473a Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 30 Nov 2018 13:57:17 +0000
Subject: [PATCH 2374/3333] Use trueorfalse for NEUTRON_DEPLOY_MOD_WSGI

Current code assumes the variable is being set to either "True" or
"False", which will lead to weird errors if it is being set to something
like "true" instead.

Change-Id: I88983c9150efad882cd867c2d14d86ba6b2522c9
---
 lib/neutron        | 2 +-
 lib/neutron-legacy | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4847e87f2f..5ef9280981 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -33,7 +33,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 # - True : Run neutron under uwsgi
 # TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
 # enough
-NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
+NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index be5b73ffa6..9513667dfe 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -91,7 +91,7 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # - True : Run neutron under uwsgi
 # TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
 # enough
-NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
+NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 

From 0137703825ea5f493e7486e19c2d83b328ca2998 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Fri, 30 Nov 2018 14:40:12 -0800
Subject: [PATCH 2375/3333] Allow IP-based subject alt names

... even when no other subject alt names provided

Previously, a non-voting job in barbican's gate would fail with something like

  X509 V3 routines:X509V3_parse_list:invalid null name:v3_utl.c:319:
  X509 V3 routines:DO_EXT_NCONF:invalid extension string:v3_conf.c:140:name=subjectAltName,section=DNS:pykmip-server,,IP:198.72.124.103
  X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=subjectAltName, value=DNS:pykmip-server,,IP:198.72.124.103

because we'd have an invalid empty string.

Change-Id: I5459b8976539924cd6cc6c1e681b6753a76b804c
---
 lib/tls | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 217f40e3a5..9b55099e43 100644
--- a/lib/tls
+++ b/lib/tls
@@ -252,7 +252,11 @@ function make_cert {
 
     if [ "$common_name" != "$SERVICE_HOST" ]; then
         if is_ipv4_address "$SERVICE_HOST" ; then
-            alt_names="$alt_names,IP:$SERVICE_HOST"
+            if [[ -z "$alt_names" ]]; then
+                alt_names="IP:$SERVICE_HOST"
+            else
+                alt_names="$alt_names,IP:$SERVICE_HOST"
+            fi
         fi
     fi
 

From d1fe5ad507c6dcb6955d66fab0b6bc9fb59a80f2 Mon Sep 17 00:00:00 2001
From: qingszhao <zhao.daqing@99cloud.net>
Date: Tue, 4 Dec 2018 13:03:28 +0000
Subject: [PATCH 2376/3333] Change openstack-dev to openstack-discuss

Mailinglists have been updated. Openstack-discuss replaces openstack-dev.

Change-Id: Id639a45680b149ca1ffe8e91fcdea713576b355d
---
 setup.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.cfg b/setup.cfg
index fcd2b13f41..825d386026 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -4,7 +4,7 @@ summary = OpenStack DevStack
 description-file =
     README.rst
 author = OpenStack
-author-email = openstack-dev@lists.openstack.org
+author-email = openstack-discuss@lists.openstack.org
 home-page = https://docs.openstack.org/devstack/latest
 classifier =
     Intended Audience :: Developers

From d2a927264aa71e3103a9b265f1e0d9911fd4653e Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Tue, 4 Dec 2018 21:59:55 +0100
Subject: [PATCH 2377/3333] Enable the SCL repository for CentOS

Enable the Software Collections (SCL) repository for CentOS. This
repository includes useful software (e.g. the Go Toolset) which is not
present in the main repository.

For example, Octavia uses a Go based testing tool and its CentOS-based
jobs got broken now with the update to CentOS 7.6 which no longer
provides golang.

Change-Id: Ic68a6d6cd7da41510e624b6bea7976d9a960af98
---
 stack.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/stack.sh b/stack.sh
index 497c8bc479..144c233f05 100755
--- a/stack.sh
+++ b/stack.sh
@@ -335,6 +335,13 @@ function _install_rdo {
     # no-op on other platforms.
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
+    # Enable the Software Collections (SCL) repository for CentOS.
+    # This repository includes useful software (e.g. the Go Toolset)
+    # which is not present in the main repository.
+    if [[ "$os_VENDOR" =~ (CentOS) ]]; then
+        yum_install centos-release-scl
+    fi
+
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
     fi

From 14a22dff3429b9bf237dcd6d92572f2e53b76d9a Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Thu, 6 Dec 2018 10:23:51 +0000
Subject: [PATCH 2378/3333] Fix README for rolevar name
 'devstack_sources_branch'

This commit fixes the name of role in README file
- https://review.openstack.org/#/c/549517

Change-Id: I0b7ada56339e5e3ff461c2b62e27f226720bb52f
---
 roles/setup-devstack-source-dirs/README.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
index 4129eae383..49d22c3c64 100644
--- a/roles/setup-devstack-source-dirs/README.rst
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -10,7 +10,7 @@ into it.
 
    The devstack base directory.
 
- .. zuul:rolevar:: devstack_branch
+ .. zuul:rolevar:: devstack_sources_branch
     :default: None
 
     The target branch to be setup (where available).

From 5a9e32afeb723dac3f0111b96cea7da77cdc722e Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 7 Dec 2018 10:26:18 -0500
Subject: [PATCH 2379/3333] Update comment about nova-cells-v1 job

Nova is moving nova-cells-v1 to its experimental
queue set of jobs so the comment in devstack should
be updated.

Depends-On: https://review.openstack.org/623538

Change-Id: Iefbaa9b809d1426640cbd47a42213f28c9ec5ff3
Related-Bug: #1807407
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 21d1a97046..4f91b5b997 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -557,7 +557,7 @@
     # pruned.
     #
     # * nova-cells-v1: maintained by nova for cells v1 (nova-cells service);
-    #    nova gates on this job, it's in experimental for testing cells v1
+    #    it's in experimental here (and in nova) for testing cells v1
     #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
     #    things like cellsv2 and placement-api

From e344c97c0eb93e1d96ca8ebe250bb08d227ef5ac Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 7 Dec 2018 14:49:15 -0800
Subject: [PATCH 2380/3333] Set apache proxy-initial-not-pooled env var

We've run into what appears to be a race with apache trying to reuse a
pooled connection to a backend when that pool connection is closing.
This leads to errors like:

  [Fri Dec 07 21:44:10.752362 2018] [proxy_http:error] [pid 19073:tid 139654393218816] (20014)Internal error (specific information not available): [client 104.130.127.213:45408] AH01102: error reading status line from remote server 127.0.0.1:60999
  [Fri Dec 07 21:44:10.752405 2018] [proxy:error] [pid 19073:tid 139654393218816] [client 104.130.127.213:45408] AH00898: Error reading from remote server returned by /image/v2/images/ec31a4fd-e22b-4e97-8c6c-1ef330823fc1/file

According to the internets this can be addressed (at the cost of some
performance) by setting the proxy-initial-not-pooled env var for mod
proxy. From the mod_proxy docs:

  If this variable is set, no pooled connection will be reused if the client
  request is the initial request on the frontend connection. This avoids the
  "proxy: error reading status line from remote server" error message caused
  by the race condition that the backend server closed the pooled connection
  after the connection check by the proxy and before data sent by the proxy
  reached the backend. It has to be kept in mind that setting this variable
  downgrades performance, especially with HTTP/1.0 clients.

Closes-Bug: #1807518

Change-Id: I374deddefaa033de858b7bc15f893bf731ad7ff2
---
 lib/tls | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tls b/lib/tls
index 217f40e3a5..0032449e13 100644
--- a/lib/tls
+++ b/lib/tls
@@ -547,6 +547,9 @@ $listen_string
     LimitRequestFieldSize $f_header_size
     RequestHeader set X-Forwarded-Proto "https"
 
+    # Avoid races (at the cost of performance) to re-use a pooled connection
+    # where the connection is closed (bug 1807518).
+    SetEnv proxy-initial-not-pooled
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=0 nocanon
         ProxyPassReverse http://$b_host:$b_port/

From 2dad33b4ba43c30b5c06bd52248fcdd49aeb2ad5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 11 Dec 2018 06:11:25 +0000
Subject: [PATCH 2381/3333] Updated from generate-devstack-plugins-list

Change-Id: Ia5998eaec8f470ec584079f4639a84b2bf1430e1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7ed24638fd..02d6911d4b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -180,6 +180,7 @@ tap-as-a-service                       `git://git.openstack.org/openstack/tap-as
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
 tatu                                   `git://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
 telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
+tobiko                                 `git://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__

From 0ce6ae813707678541697b2ffe24056f0f8e26b7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 21 Nov 2017 11:55:57 +0000
Subject: [PATCH 2382/3333] Update cirros version

This is the next release in the 0.3.x stable series, containing a fix
for getting out of disk errors when cirros reads metadata from a
config-drive[0].

[0] https://bugs.launchpad.net/cirros/+bug/1808119

Change-Id: Id2f20ebafdd78c2dadf81b8f80f22e7bd6db7755
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ffe405012d..d520f2f2e9 100644
--- a/stackrc
+++ b/stackrc
@@ -668,7 +668,7 @@ ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.5"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.3.6"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 584979ce2eeb0c2e590a996657e601bfd5543eee Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 13 Dec 2018 08:22:12 -0500
Subject: [PATCH 2383/3333] docs: cleanup install docs

This does a few things to the home page and all-in-one single
machine install guide:

* Uses code blocks for formatting
* Adds the customary "$" to the console blocks in the
  all-in-one single machine install guide
* Instructs to use "sudo su stack" and adds a note about
  "sudo visudo" in the all-in-one single machine doc
* Creates a symbolic link to the sample local.conf and links to
  it from the install guide (note that local.conf might be old
  by now)
* Fixes the .gitignore file to only ignore local.conf in the root
  of the repository, otherwise it would ignore local.conf everywhere
  including the samples and doc/source/assets directories.

Change-Id: I50ae7bd32c4c1caa2ac8551fc54b31dd2dfae568
---
 .gitignore                           |  2 +-
 doc/source/assets/local.conf         |  1 +
 doc/source/guides/single-machine.rst | 35 +++++++++++++++++-----------
 doc/source/index.rst                 | 16 ++++++++-----
 4 files changed, 34 insertions(+), 20 deletions(-)
 create mode 120000 doc/source/assets/local.conf

diff --git a/.gitignore b/.gitignore
index e5e1f6aba0..956e13e21c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,7 +28,7 @@ files/get-pip.py*
 files/ir-deploy*
 files/ironic-inspector*
 files/etcd*
-local.conf
+^local.conf
 local.sh
 localrc
 proto
diff --git a/doc/source/assets/local.conf b/doc/source/assets/local.conf
new file mode 120000
index 0000000000..cfc2a4e9d8
--- /dev/null
+++ b/doc/source/assets/local.conf
@@ -0,0 +1 @@
+../../../samples/local.conf
\ No newline at end of file
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 515ea9a9ee..168172c630 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -45,31 +45,37 @@ We need to add a user to install DevStack. (if you created a user during
 install you can skip this step and just give the user sudo privileges
 below)
 
-::
+.. code-block:: console
 
-    useradd -s /bin/bash -d /opt/stack -m stack
+    $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it will need
 to have sudo privileges:
 
-::
+.. code-block:: console
 
-    apt-get install sudo -y || yum install -y sudo
-    echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    $ apt-get install sudo -y || yum install -y sudo
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+
+.. note:: On some systems you may need to use ``sudo visudo``.
 
 From here on you should use the user you created. **Logout** and
-**login** as that user.
+**login** as that user:
+
+.. code-block:: console
+
+    $ sudo su stack && cd ~
 
 Download DevStack
 -----------------
 
 We'll grab the latest version of DevStack via https:
 
-::
+.. code-block:: console
 
-    sudo apt-get install git -y || sudo yum install -y git
-    git clone https://git.openstack.org/openstack-dev/devstack
-    cd devstack
+    $ sudo apt-get install git -y || sudo yum install -y git
+    $ git clone https://git.openstack.org/openstack-dev/devstack
+    $ cd devstack
 
 Run DevStack
 ------------
@@ -97,7 +103,7 @@ do the following:
 
 ``local.conf`` should look something like this:
 
-::
+.. code-block:: ini
 
     [[local|localrc]]
     FLOATING_RANGE=192.168.1.224/27
@@ -109,11 +115,14 @@ do the following:
     RABBIT_PASSWORD=flopsymopsy
     SERVICE_PASSWORD=iheartksl
 
+.. note:: There is a sample :download:`local.conf </assets/local.conf>` file
+    under the *samples* directory in the devstack repository.
+
 Run DevStack:
 
-::
+.. code-block:: console
 
-    ./stack.sh
+    $ ./stack.sh
 
 A seemingly endless stream of activity ensues. When complete you will
 see a summary of ``stack.sh``'s work, including the relevant URLs,
diff --git a/doc/source/index.rst b/doc/source/index.rst
index fcf1e82d34..6c42a5b4e9 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -55,14 +55,14 @@ are usually fine).
 
 You can quickly create a separate `stack` user to run DevStack with
 
-::
+.. code-block:: console
 
    $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it should
 have sudo privileges:
 
-::
+.. code-block:: console
 
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
     $ sudo su - stack
@@ -70,7 +70,7 @@ have sudo privileges:
 Download DevStack
 -----------------
 
-::
+.. code-block:: console
 
    $ git clone https://git.openstack.org/openstack-dev/devstack
    $ cd devstack
@@ -83,7 +83,8 @@ Create a local.conf
 
 Create a ``local.conf`` file with 4 passwords preset at the root of the
 devstack git repo.
-::
+
+.. code-block:: ini
 
    [[local|localrc]]
    ADMIN_PASSWORD=secret
@@ -93,12 +94,15 @@ devstack git repo.
 
 This is the minimum required config to get started with DevStack.
 
+.. note:: There is a sample :download:`local.conf </assets/local.conf>` file
+    under the *samples* directory in the devstack repository.
+
 Start the install
 -----------------
 
-::
+.. code-block:: console
 
-   ./stack.sh
+   $ ./stack.sh
 
 This will take a 15 - 20 minutes, largely depending on the speed of
 your internet connection. Many git trees and packages will be

From e0b375c8ce77ca256d108b2c558d57e17efab4f7 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Fri, 14 Dec 2018 17:29:27 +0900
Subject: [PATCH 2384/3333] Use volume v3 API in clouds.yaml by default

Volume API v2 has been deprecated for a long time.
There is no reason to use volume v2 in clouds.yaml by default.

This commit also drops "--os-identity-api-version 3" from
write_clouds_yaml in functions -common as "3" is the default value
of tools/update_clouds_yaml.py. They are hardcoded in DevStack
so there is no reason to pass it.

Change-Id: Ie84026a3d19f7711fc781b7012355096c7ff6b5a
---
 functions-common            | 3 ---
 tools/update_clouds_yaml.py | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index af95bfb879..9be1513b5d 100644
--- a/functions-common
+++ b/functions-common
@@ -92,7 +92,6 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username demo \
@@ -104,7 +103,6 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack-alt \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username alt_demo \
@@ -116,7 +114,6 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username admin \
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index eb7265f76c..3aad0e0a29 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -83,7 +83,7 @@ def main():
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
     parser.add_argument('--os-identity-api-version', default='3')
-    parser.add_argument('--os-volume-api-version', default='2')
+    parser.add_argument('--os-volume-api-version', default='3')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)

From 93a94f503b058a1452cc8b1eef389cbec5975863 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 14 Dec 2018 06:39:59 -0800
Subject: [PATCH 2385/3333] Enable direct-io on LVM loop devices

This enables direct-io on the loop devices that we create for LVM backing
stores. The goal here is to reduce the buffer cache overhead involved with
loop mounting a very large file on a filesystem, as well as potentially
providing a little more block-device-like behavior for things that expect
them. We are hoping this will address some of the very long LVM calls that
cinder does, which randomly take a very long time, causing timeouts.

The loop direct-io support was added in kernel 4.4.0, which was xenial,
but the losetup binary does not have the required flag. Thus, this patch
checks the "losetup -h" output for the flag before deciding to enable it.

Change-Id: Idc69cf3598d6ed6646c0145733c90ad0b1b60883
---
 lib/lvm | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index f0471816bf..d9e78a016f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -99,8 +99,15 @@ function _create_lvm_volume_group {
     if ! sudo vgs $vg; then
         # Only create if the file doesn't already exists
         [[ -f $backing_file ]] || truncate -s $size $backing_file
+
+        local directio=""
+        # Check to see if we can do direct-io
+        if losetup -h | grep -q direct-io; then
+            directio="--direct-io=on"
+        fi
+
         local vg_dev
-        vg_dev=`sudo losetup -f --show $backing_file`
+        vg_dev=$(sudo losetup -f --show $directio $backing_file)
 
         # Only create volume group if it doesn't already exist
         if ! sudo vgs $vg; then

From 16fe9646486d0b621c7fb2c15ffec0c004508f73 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>
Date: Tue, 18 Dec 2018 09:01:36 +0000
Subject: [PATCH 2386/3333] Ignore local.conf in root of repo

gitignore is not parsing regex, only shell globs,
so '^' has no meaning, and local.conf is being thus tracked.

This patch properly ignores only local.conf in root of repo but still
tracks samples/local.conf and others.

Change-Id: I93ef778f1f3ee8101ce21cce377f7b527b7153f3
---
 .gitignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 956e13e21c..8fe56ad6ab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,7 +28,7 @@ files/get-pip.py*
 files/ir-deploy*
 files/ironic-inspector*
 files/etcd*
-^local.conf
+/local.conf
 local.sh
 localrc
 proto

From b3ee6f46153c46e46493f187b3b246e2229ce208 Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Tue, 18 Dec 2018 11:19:59 +0100
Subject: [PATCH 2387/3333] Correcting typo in plugins section

Fixing the example of the plugin's name as the last component
of the git repo path should be foo.

Change-Id: I2f12d4d26993ec192517de7f5541c4219ee59ed9
---
 doc/source/plugins.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 89b9381813..c69472955c 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -58,7 +58,7 @@ directory. Inside this directory there can be 3 files.
   plugin's name, which is the name that should be used by users on
   "enable_plugin" lines.  It should generally be the last component of
   the git repo path (e.g., if the plugin's repo is
-  openstack/devstack-foo, then the name here should be "foo") ::
+  openstack/foo, then the name here should be "foo") ::
 
     define_plugin <YOUR PLUGIN>
 
@@ -148,7 +148,7 @@ An example plugin would look something as follows.
 
 ``devstack/settings``::
 
-    # settings file for template
+  # settings file for template
   enable_service template
 
 

From dc33485ff28989db389b57a7d1a9bce97259ad12 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Wed, 19 Dec 2018 04:23:30 +0000
Subject: [PATCH 2388/3333] Use renamed template 'integrated-gate-py3'

'integrated-gate-py35' template is going to be
renamed to 'integrated-gate-py3' in https://review.openstack.org/#/c/626078/

Integrated jobs are running on Bionic now where python 3.6 is available.
Which means gate jobs in 'integrated-gate-py35' template are
running on python 3.6 not on 3.5 which makes this template name confusing.

depends on commit rename the 'integrated-gate-py35' to 'integrated-gate-py3'
so that it can convey that template will use available python 3 version
in used distro. For example: 3.5 in xenial and 3.6 in bionic and so on.

This commit starts using the new template name so that old
template name can be removed.

Depends-On: https://review.openstack.org/#/c/626078/
Change-Id: I07048817eb826337dd5bd89a97711bb9d43495cf
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9aafcdbb84..02d3df9b9c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -581,7 +581,7 @@
 - project:
     templates:
       - integrated-gate
-      - integrated-gate-py35
+      - integrated-gate-py3
       - publish-openstack-docs-pti
     check:
       jobs:

From 7bb5fff85c0f7b4131bc669abe99c04391682a91 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 19 Dec 2018 14:16:41 +1100
Subject: [PATCH 2389/3333] setup-devstack-source-dirs: also copy github
 libraries

This will help us use standard mechanisms to install libraries that
Zuul has cloned from github

Change-Id: I8ecfeeba9133ce175fb72fc59be696879013d927
---
 .../tasks/main.yaml                           | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index c196c37e09..dfa934f68b 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,4 +1,4 @@
-- name: Find all source repos used by this job
+- name: Find all OpenStack source repos used by this job
   find:
     paths:
       - src/git.openstack.org/openstack
@@ -12,6 +12,30 @@
   with_items: '{{ found_repos.files }}'
   become: yes
 
+# Github projects are github.com/username/repo (username might be a
+# top-level project too), so we have to do a two-step swizzle to just
+# get the full repo path (ansible's find module doesn't help with this
+# :/)
+- name: Find top level github projects
+  find:
+    paths:
+      - src/github.com
+    file_type: directory
+  register: found_github_projects
+
+- name: Find actual github repos
+  find:
+    paths: '{{ found_github_projects.files | map(attribute="path") | list }}'
+    file_type: directory
+  register: found_github_repos
+  when: found_github_projects.files
+
+- name: Copy github repos into devstack working directory
+  command: rsync -a {{ item.path }} {{ devstack_base_dir }}
+  with_items: '{{ found_github_repos.files }}'
+  become: yes
+  when: found_github_projects.files
+
 - name: Setup refspec for repos into devstack working directory
   shell:
     # Copied almost "as-is" from devstack-gate setup-workspace function

From 15b6ac98cb932488bce77b267f0f27903f0d47d0 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 21 Nov 2017 11:55:57 +0000
Subject: [PATCH 2390/3333] Update default cirros version

Cirros has a new release 0.4.0, which fixes a couple of issues.

Change-Id: I419348f1784600e3989c8e86a99c04b24f3610c4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 8463313625..4b94386521 100644
--- a/stackrc
+++ b/stackrc
@@ -685,7 +685,7 @@ ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.6"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.4.0"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 6a7e3ec6479097f4918eb66d25b52cfa46953dec Mon Sep 17 00:00:00 2001
From: npraveen35 <npraveen35@gmail.com>
Date: Thu, 20 Dec 2018 18:25:36 +0530
Subject: [PATCH 2391/3333] typo fixed

Change-Id: Id777576d8876d7ba257f0243f3b4ce5756dd9b58
---
 clean.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index a29ebd94f0..d6c6b40608 100755
--- a/clean.sh
+++ b/clean.sh
@@ -123,7 +123,7 @@ if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
     sudo rm -rf $LOGDIR
 fi
 
-# Clean out the sytemd user unit files if systemd was used.
+# Clean out the systemd user unit files if systemd was used.
 if [[ "$USE_SYSTEMD" = "True" ]]; then
     sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
     # Make systemd aware of the deletion.

From 119ee66cded7d6e1ed04419a00e59c269eea1c54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Thu, 20 Dec 2018 18:55:29 +0100
Subject: [PATCH 2392/3333] Log debug on etcd if $ENABLE_DEBUG_LOG_LEVEL is on

Change-Id: I452a2e4882377d165e3c28fcec18e237e45db8a4
---
 lib/etcd3 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index 26d07fd19e..c65a522267 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -46,6 +46,9 @@ function start_etcd3 {
         cmd+=" --listen-peer-urls http://0.0.0.0:$ETCD_PEER_PORT "
     fi
     cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    if [ "$ENABLE_DEBUG_LOG_LEVEL" == "True" ]; then
+        cmd+=" --debug"
+    fi
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From 8e802da4069349a2f6ccdef348999304669a6cbe Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Fri, 4 Jan 2019 15:21:43 +0000
Subject: [PATCH 2393/3333] Cleanup LDAP integration guide

This commit fixes a grammar issue in the LDAP integration guide
and it adds prompts to the command-line examples to be more
explicit about where or how commands are being run.

Change-Id: Ic6a5adfbcf2841656929e6c3875889a31d314089
---
 doc/source/guides/devstack-with-ldap.rst | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/doc/source/guides/devstack-with-ldap.rst b/doc/source/guides/devstack-with-ldap.rst
index ec411419b5..4c54723c71 100644
--- a/doc/source/guides/devstack-with-ldap.rst
+++ b/doc/source/guides/devstack-with-ldap.rst
@@ -12,14 +12,14 @@ Introduction
 LDAP support in keystone is read-only. You can use it to back an entire
 OpenStack deployment to a single LDAP server, or you can use it to back
 separate LDAP servers to specific keystone domains. Users within those domains
-will can authenticate against keystone, assume role assignments, and interact
-with other OpenStack services.
+can authenticate against keystone, assume role assignments, and interact with
+other OpenStack services.
 
 Configuration
 =============
 
 To deploy an OpenLDAP server, make sure ``ldap`` is added to the list of
-``ENABLED_SERVICES``::
+``ENABLED_SERVICES`` in the ``local.conf`` file::
 
     enable_service ldap
 
@@ -35,9 +35,9 @@ Devstack will prompt you for a password when running ``stack.sh`` if
 
 At this point, devstack should have everything it needs to deploy OpenLDAP,
 bootstrap it with a minimal set of users, and configure it to back to a domain
-in keystone::
+in keystone. You can do this by running the ``stack.sh`` script::
 
-    ./stack.sh
+    $ ./stack.sh
 
 Once ``stack.sh`` completes, you should have a running keystone deployment with
 a basic set of users. It is important to note that not all users will live
@@ -63,7 +63,7 @@ Listing Users
 To list all users in LDAP directly, you can use ``ldapsearch`` with the LDAP
 user bootstrapped by devstack::
 
-    ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost -b dc=openstack,dc=org
 
 As you can see, devstack creates an OpenStack domain called ``openstack.org``
@@ -93,7 +93,7 @@ example LDIF that can be used to create a new LDAP user, let's call it
 
 Now, we use the ``Manager`` user to create a user for Peter in LDAP::
 
-    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost -c -f peter.ldif.in
 
 We should be able to assign Peter roles on projects. After Peter has some level
@@ -125,7 +125,7 @@ Deleting Users
 We can use the same basic steps to remove users from LDAP, but instead of using
 LDIFs, we can just pass the ``dn`` of the user we want to delete::
 
-    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost cn=peter,ou=Users,dc=openstack,dc=org
 
 Group Management
@@ -153,7 +153,7 @@ Let's define a specific group with the following LDIF::
 We can create the group using the same ``ldapadd`` command as we did with
 users::
 
-    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost -c -f guardian-group.ldif.in
 
 If we check the group membership in Horizon, we'll see that only Peter is a
@@ -167,7 +167,7 @@ Deleting Groups
 
 Just like users, groups can be deleted using the ``dn``::
 
-    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost cn=guardians,ou=UserGroups,dc=openstack,dc=org
 
 Note that this operation will not remove users within that group. It will only

From 5d7d891380f569deaf403aae46a9354eb0243999 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 3 Dec 2018 14:21:06 +0000
Subject: [PATCH 2394/3333] Drop the deprecated and now removed barrier XFS
 mount options

Both barrier and nobarrier were deprecated with the 4.10 kernel [1] and
then removed [2] with the 4.19 kernel as now used by Fedora >= 28. Both
should be safe to drop at this point.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4cf4573
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1c02d50

Change-Id: I6871a7765e3e04122d8d546f43d36bb8415383fc
---
 functions | 2 +-
 lib/swift | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 051c8160f7..187ad2311d 100644
--- a/functions
+++ b/functions
@@ -739,7 +739,7 @@ function create_disk {
 
     # Mount the disk with mount options to make it as efficient as possible
     if ! egrep -q ${storage_data_dir} /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,nobarrier,logbufs=8  \
+        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
             ${disk_image} ${storage_data_dir}
     fi
 }
diff --git a/lib/swift b/lib/swift
index 3b3e608e80..e2ee0cb470 100644
--- a/lib/swift
+++ b/lib/swift
@@ -607,7 +607,7 @@ function create_swift_disk {
     # Mount the disk with mount options to make it as efficient as possible
     mkdir -p ${SWIFT_DATA_DIR}/drives/sdb1
     if ! egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,nobarrier,logbufs=8  \
+        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
             ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1
     fi
 

From 77866259e4204eb08afd55e8a29994ad49c58e0b Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 7 Dec 2018 18:52:16 +0000
Subject: [PATCH 2395/3333] Update supported Fedora releases

Fedora 27 has now hit EOL [1] while Fedora 29 has been released [2].

[1] https://fedoramagazine.org/fedora-27-end-of-life/
[2] https://fedoramagazine.org/announcing-fedora-29/

Change-Id: I12e287e36f01581f1c7145545ab05be527ed15c6
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 144c233f05..54a4f985bd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 5690582073756bdc156550b90a8e284a8d4e0e5f Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 8 Jan 2019 15:29:16 +0000
Subject: [PATCH 2396/3333] Add devstack-system-admin for system scoped actions

Keystone is moving more things to require a system scoped token to
work. Getting one of those requires that domain and project information
are not set.

Change-Id: I2e1640e9f9ef6cdf56bef49d1ae8f0591570c3e6
---
 functions-common            | 11 +++++++++++
 tools/update_clouds_yaml.py | 14 +++++++++++---
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 9be1513b5d..e5962db42b 100644
--- a/functions-common
+++ b/functions-common
@@ -120,6 +120,17 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
 
+    # admin with a system-scoped token -> devstack-system
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-system-admin \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-system-scope all
+
     # CLean up any old clouds.yaml files we had laying around
     rm -f $(eval echo ~"$STACK_USER")/.config/openstack/clouds.yaml
 }
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 3aad0e0a29..9187c664d0 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -41,12 +41,19 @@ def __init__(self, args):
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
                 'password': args.os_password,
-                'project_name': args.os_project_name,
             },
         }
-        if args.os_identity_api_version == '3':
+        if args.os_project_name and args.os_system_scope:
+            print(
+                "WARNING: os_project_name and os_system_scope were both"
+                " given. os_system_scope will take priority.")
+        if args.os_project_name and not args.os_system_scope:
+            self._cloud_data['auth']['project_name'] = args.os_project_name
+        if args.os_identity_api_version == '3' and not args.os_system_scope:
             self._cloud_data['auth']['user_domain_id'] = 'default'
             self._cloud_data['auth']['project_domain_id'] = 'default'
+        if args.os_system_scope:
+            self._cloud_data['auth']['system_scope'] = args.os_system_scope
         if args.os_cacert:
             self._cloud_data['cacert'] = args.os_cacert
 
@@ -88,7 +95,8 @@ def main():
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)
     parser.add_argument('--os-password', required=True)
-    parser.add_argument('--os-project-name', required=True)
+    parser.add_argument('--os-project-name')
+    parser.add_argument('--os-system-scope')
 
     args = parser.parse_args()
 

From 6d103a7ff845076da984afbd317cd8cf4504fb7a Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 19 Dec 2018 11:53:16 +0000
Subject: [PATCH 2397/3333] Fix testing for the write-devstack-local-conf role

The test_plugin_deps function in the test code for the
write-devstack-local-conf role was missing the import part of actually
executing the code under test and asserting the expected result.

Change-Id: I125870b13d2581cdec0dede11157b19b702565cd
---
 roles/write-devstack-local-conf/library/test.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 791552d1ad..65d327b267 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -104,6 +104,22 @@ def test_plugin_deps(self):
                  plugins=plugins,
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'),
+                       p.get('projects'),
+                       p.get('project'))
+        lc.write(p['path'])
+
+        plugins = []
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('enable_plugin'):
+                    plugins.append(line.split()[1])
+        self.assertEqual(['foo', 'bar'], plugins)
 
     def test_libs_from_git(self):
         "Test that LIBS_FROM_GIT is auto-generated"

From 0b855007f8d44662ad4fd52bda7df85f94b241c2 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 19 Dec 2018 12:20:51 +0000
Subject: [PATCH 2398/3333] Allow plugin names to contain non-letter characters

There are already devstack plugins that contain a hyphen in the name,
like `networking-baremetal`. In order to allow ordering for these to
work properly, amend the regexes we are using to match any
non-whitespace characters instead of only alphanumerics.

Amend the test to cover this use case.

Change-Id: I91093a424f8d5e8007f140083e1ea36a81fe849f
Closes-Bug: 1809016
---
 .../library/devstack_local_conf.py                   |  4 ++--
 roles/write-devstack-local-conf/library/test.py      | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index bba7e31f96..b1ad2dd4b4 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -155,8 +155,8 @@ def loadPluginNames(self, base_dir):
                 continue
             self.loadDevstackPluginInfo(settings)
 
-    define_re = re.compile(r'^define_plugin\s+(\w+).*')
-    require_re = re.compile(r'^plugin_requires\s+(\w+)\s+(\w+).*')
+    define_re = re.compile(r'^define_plugin\s+(\S+).*')
+    require_re = re.compile(r'^plugin_requires\s+(\S+)\s+(\S+).*')
     def loadDevstackPluginInfo(self, fn):
         name = None
         reqs = set()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 65d327b267..88d404b856 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -78,12 +78,12 @@ def test_plugin_deps(self):
         with open(os.path.join(
                 self.tmpdir,
                 'foo-plugin', 'devstack', 'settings'), 'w') as f:
-            f.write('define_plugin foo\n')
+            f.write('define_plugin foo-plugin\n')
         with open(os.path.join(
                 self.tmpdir,
                 'bar-plugin', 'devstack', 'settings'), 'w') as f:
-            f.write('define_plugin bar\n')
-            f.write('plugin_requires bar foo\n')
+            f.write('define_plugin bar-plugin\n')
+            f.write('plugin_requires bar-plugin foo-plugin\n')
 
         localrc = {'test_localrc': '1'}
         local_conf = {'install':
@@ -94,8 +94,8 @@ def test_plugin_deps(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('bar-plugin', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo-plugin', 'git://git.openstack.org/openstack/foo-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
@@ -119,7 +119,7 @@ def test_plugin_deps(self):
             for line in f:
                 if line.startswith('enable_plugin'):
                     plugins.append(line.split()[1])
-        self.assertEqual(['foo', 'bar'], plugins)
+        self.assertEqual(['foo-plugin', 'bar-plugin'], plugins)
 
     def test_libs_from_git(self):
         "Test that LIBS_FROM_GIT is auto-generated"

From 36377f63e348200cd091b702c74350062a69fff9 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 4 Dec 2018 11:33:03 -0500
Subject: [PATCH 2399/3333] install under python3 by default when enabled

Remove the requirement that services explicitly enable python3 support
in order to be tested under python3 when running with python3
enabled. Keep the enable_python3_package() function for backwards
compatibility, for now, since it is called in some devstack plugins.

Explicitly add swift to the set of packages that should not be installed
using python3 by default until full support is available.

Change-Id: I8ab0a7c242bbf5bf3f091f5a85a98e2f4543f856
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 inc/python           | 39 +++++++++++----------------------------
 stackrc              |  8 +-------
 tests/test_python.sh |  7 +------
 3 files changed, 13 insertions(+), 41 deletions(-)

diff --git a/inc/python b/inc/python
index 5fb7245623..f1df101939 100644
--- a/inc/python
+++ b/inc/python
@@ -115,13 +115,12 @@ function check_python3_support_for_package_remote {
     echo $classifier
 }
 
-# python3_enabled_for() checks if the service(s) specified as arguments are
-# enabled by the user in ``ENABLED_PYTHON3_PACKAGES``.
+# python3_enabled_for() assumes the service(s) specified as arguments are
+# enabled for python 3 unless explicitly disabled. See python3_disabled_for().
 #
 # Multiple services specified as arguments are ``OR``'ed together; the test
 # is a short-circuit boolean, i.e it returns on the first match.
 #
-# Uses global ``ENABLED_PYTHON3_PACKAGES``
 # python3_enabled_for dir [dir ...]
 function python3_enabled_for {
     local xtrace
@@ -132,7 +131,9 @@ function python3_enabled_for {
     local dirs=$@
     local dir
     for dir in ${dirs}; do
-        [[ ,${ENABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
+        if ! python3_disabled_for "${dir}"; then
+            enabled=0
+        fi
     done
 
     $xtrace
@@ -163,42 +164,29 @@ function python3_disabled_for {
     return $enabled
 }
 
-# enable_python3_package() adds the repositories passed as argument to the
-# ``ENABLED_PYTHON3_PACKAGES`` list, if they are not already present.
+# enable_python3_package() -- no-op for backwards compatibility
 #
 # For example:
 #   enable_python3_package nova
 #
-# Uses global ``ENABLED_PYTHON3_PACKAGES``
 # enable_python3_package dir [dir ...]
 function enable_python3_package {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
-    local tmpsvcs="${ENABLED_PYTHON3_PACKAGES}"
-    local python3
-    for dir in $@; do
-        if [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]]; then
-            warn $LINENO "Attempt to enable_python3_package ${dir} when it has been disabled"
-            continue
-        fi
-        if ! python3_enabled_for $dir; then
-            tmpsvcs+=",$dir"
-        fi
-    done
-    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$tmpsvcs")
+    echo "It is no longer necessary to call enable_python3_package()."
 
     $xtrace
 }
 
-# disable_python3_package() prepares the services passed as argument to be
-# removed from the ``ENABLED_PYTHON3_PACKAGES`` list, if they are present.
+# disable_python3_package() adds the services passed as argument to
+# the ``DISABLED_PYTHON3_PACKAGES`` list.
 #
 # For example:
 #   disable_python3_package swift
 #
-# Uses globals ``ENABLED_PYTHON3_PACKAGES`` and ``DISABLED_PYTHON3_PACKAGES``
+# Uses global ``DISABLED_PYTHON3_PACKAGES``
 # disable_python3_package dir [dir ...]
 function disable_python3_package {
     local xtrace
@@ -206,16 +194,11 @@ function disable_python3_package {
     set +o xtrace
 
     local disabled_svcs="${DISABLED_PYTHON3_PACKAGES}"
-    local enabled_svcs=",${ENABLED_PYTHON3_PACKAGES},"
     local dir
     for dir in $@; do
         disabled_svcs+=",$dir"
-        if python3_enabled_for $dir; then
-            enabled_svcs=${enabled_svcs//,$dir,/,}
-        fi
     done
     DISABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$disabled_svcs")
-    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$enabled_svcs")
 
     $xtrace
 }
@@ -295,7 +278,7 @@ function pip_install {
                 if python3_disabled_for ${package_dir##*/}; then
                     echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
                 elif python3_enabled_for ${package_dir##*/}; then
-                    echo "Explicitly using $PYTHON3_VERSION version to install $package_dir based on ENABLED_PYTHON3_PACKAGES"
+                    echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                 elif [[ -d "$package_dir" ]]; then
diff --git a/stackrc b/stackrc
index 8463313625..8f66ba7975 100644
--- a/stackrc
+++ b/stackrc
@@ -129,15 +129,9 @@ fi
 # Control whether Python 3 should be used at all.
 export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
-# Control whether Python 3 is enabled for specific services by the
-# base name of the directory from which they are installed. See
-# enable_python3_package to edit this variable and use_python3_for to
-# test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,openstacksdk"
-
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.
-export DISABLED_PYTHON3_PACKAGES=""
+export DISABLED_PYTHON3_PACKAGES="swift"
 
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
diff --git a/tests/test_python.sh b/tests/test_python.sh
index 8652798778..1f5453c4c7 100755
--- a/tests/test_python.sh
+++ b/tests/test_python.sh
@@ -12,14 +12,9 @@ source $TOP/tests/unittest.sh
 echo "Testing Python 3 functions"
 
 # Initialize variables manipulated by functions under test.
-export ENABLED_PYTHON3_PACKAGES=""
 export DISABLED_PYTHON3_PACKAGES=""
 
-assert_false "should not be enabled yet" python3_enabled_for testpackage1
-
-enable_python3_package testpackage1
-assert_equal "$ENABLED_PYTHON3_PACKAGES" "testpackage1"  "unexpected result"
-assert_true "should be enabled" python3_enabled_for testpackage1
+assert_true "should be enabled by default" python3_enabled_for testpackage1
 
 assert_false "should not be disabled yet" python3_disabled_for testpackage2
 

From bab27cbff1431ebd9f72e595e86b5a1e902092f0 Mon Sep 17 00:00:00 2001
From: Iury Gregory Melo Ferreira <imelofer@redhat.com>
Date: Wed, 9 Jan 2019 15:55:47 +0100
Subject: [PATCH 2400/3333] Rename ironic job name to match zuulv3

Depends-On: https://review.openstack.org/#/c/629173/
Change-Id: Ifa8d075729c6347ecda41c79e4de09c71483b4c6
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 02d3df9b9c..afe400e1a4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -597,7 +597,7 @@
         - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
+        - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
             voting: false
         - swift-dsvm-functional:
             voting: false

From 772ade5368ff124d219f9e55b61bb9bc763e47a7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 11 Jan 2019 06:04:41 +0000
Subject: [PATCH 2401/3333] Updated from generate-devstack-plugins-list

Change-Id: I3b4c7e73b0f84f0604fa5e06e612a5bd775d7b02
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 02d6911d4b..9901c1ca39 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -150,6 +150,7 @@ octavia                                `git://git.openstack.org/openstack/octavi
 octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
 omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
 openstacksdk                           `git://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
+os-faults                              `git://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
@@ -173,6 +174,7 @@ storlets                               `git://git.openstack.org/openstack/storle
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
 stx-integ                              `git://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
+stx-metal                              `git://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
 stx-nfv                                `git://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
 stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__

From 698796f1aeb0d9a559488bad9f1d03e4941b061e Mon Sep 17 00:00:00 2001
From: Yi Wang <yi.c.wang@intel.com>
Date: Fri, 14 Dec 2018 10:35:26 +0800
Subject: [PATCH 2402/3333] Fix an issue in iniset function

Given the file to be configured, if user "stack" even doesn't have
read access, the result of configuration is not expected. iniset with
"-sudo" option will always create the section and the option which we
want to configure for each calling, no matter whether this section and
this option exist in the file or not. The root cause is the calling of
grep and ini_has_option in iniset don't use the "sudo" option.

Change-Id: I9d21322046b7be411c4c7c28fefc24894fa2e131
Signed-off-by: Yi Wang <yi.c.wang@intel.com>
---
 inc/ini-config           | 17 ++++++++++++-----
 tests/test_ini_config.sh |  4 ++--
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 6fe7788158..79936823d2 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -88,17 +88,22 @@ function iniget_multiline {
 }
 
 # Determinate is the given option present in the INI file
-# ini_has_option config-file section option
+# ini_has_option [-sudo] config-file section option
 function ini_has_option {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
     local line
 
-    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
+    line=$($sudo sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
     $xtrace
     [ -n "$line" ]
 }
@@ -173,8 +178,10 @@ function iniset {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
+    local sudo_option=""
     if [ $1 == "-sudo" ]; then
         sudo="sudo "
+        sudo_option="-sudo "
         shift
     fi
     local file=$1
@@ -187,11 +194,11 @@ function iniset {
         return
     fi
 
-    if ! grep -q "^\[$section\]" "$file" 2>/dev/null; then
+    if ! $sudo grep -q "^\[$section\]" "$file" 2>/dev/null; then
         # Add section at the end
         echo -e "\n[$section]" | $sudo tee --append "$file" > /dev/null
     fi
-    if ! ini_has_option "$file" "$section" "$option"; then
+    if ! ini_has_option $sudo_option "$file" "$section" "$option"; then
         # Add it
         $sudo sed -i -e "/^\[$section\]/ a\\
 $option = $value
@@ -228,7 +235,7 @@ function iniset_multiline {
         # the reverse order. Do a reverse here to keep the original order.
         values="$v ${values}"
     done
-    if ! grep -q "^\[$section\]" "$file"; then
+    if ! $sudo grep -q "^\[$section\]" "$file"; then
         # Add section at the end
         echo -e "\n[$section]" | $sudo tee --append "$file" > /dev/null
     else
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index f7dc89a28d..6ed1647f34 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -125,14 +125,14 @@ VAL=$(iniget ${TEST_INI} bbb handlers)
 assert_equal "$VAL" "33,44" "inset at EOF"
 
 # test empty option
-if ini_has_option ${TEST_INI} ddd empty; then
+if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"
 else
     failed "ini_has_option failed: ddd.empty not found"
 fi
 
 # test non-empty option
-if ini_has_option ${TEST_INI} bbb handlers; then
+if ini_has_option ${SUDO_ARG} ${TEST_INI} bbb handlers; then
     passed "ini_has_option: bbb.handlers present"
 else
     failed "ini_has_option failed: bbb.handlers not found"

From 58243f6203f3385039fe7124b037d5abf7e1d59e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 13 Dec 2018 14:05:53 +1100
Subject: [PATCH 2403/3333] Add options for development bindep install

This adds a -bindep option to the key development library install
functions.  With this option the bindep.txt file will be referenced
and the relevant packages installed.

Change-Id: I856f1f59fca49b6020920d8f859b797f3b904300
---
 functions-common | 29 +++++++++++++++++++++
 inc/python       | 67 ++++++++++++++++++++++++++++++++++++++----------
 stack.sh         |  5 ++++
 stackrc          |  7 +++++
 4 files changed, 95 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index af95bfb879..6651cc2661 100644
--- a/functions-common
+++ b/functions-common
@@ -1381,6 +1381,35 @@ function zypper_install {
         zypper --non-interactive install --auto-agree-with-licenses --no-recommends "$@"
 }
 
+# Run bindep and install packages it outputs
+#
+# Usage:
+#  install_bindep <path-to-bindep.txt> [profile,profile]
+#
+# Note unlike the bindep command itself, profile(s) specified should
+# be a single, comma-separated string, no spaces.
+function install_bindep {
+    local file=$1
+    local profiles=${2:-""}
+    local pkgs
+
+    if [[ ! -f $file ]]; then
+        die $LINENO "Can not find bindep file: $file"
+    fi
+
+    # converting here makes it much easier to work with passing
+    # arguments
+    profiles=${profiles/,/ /}
+
+    # Note bindep returns 1 when packages need to be installed, so we
+    # have to ignore it's return for "-e"
+    pkgs=$($DEST/bindep-venv/bin/bindep -b --file $file $profiles || true)
+
+    if [[ -n "${pkgs}" ]]; then
+        install_package ${pkgs}
+    fi
+}
+
 function write_user_unit_file {
     local service=$1
     local command="$2"
diff --git a/inc/python b/inc/python
index 5fb7245623..d4237674ed 100644
--- a/inc/python
+++ b/inc/python
@@ -445,7 +445,14 @@ function setup_lib {
 # another project.
 #
 # use this for non namespaced libraries
+#
+# setup_dev_lib [-bindep] <name>
 function setup_dev_lib {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local name=$1
     local dir=${GITDIR[$name]}
     if python3_enabled; then
@@ -455,10 +462,10 @@ function setup_dev_lib {
         # of Python.
         echo "Installing $name again without Python 3 enabled"
         USE_PYTHON3=False
-        setup_develop $dir
+        setup_develop $bindep $dir
         USE_PYTHON3=True
     fi
-    setup_develop $dir
+    setup_develop $bindep $dir
 }
 
 # this should be used if you want to install globally, all libraries should
@@ -469,11 +476,17 @@ function setup_dev_lib {
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
 #         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
+# bindep: Set "-bindep" as first argument to install bindep.txt packages
 # The command is like "pip install <project_dir>[<extras>]"
 function setup_install {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local project_dir=$1
     local extras=$2
-    _setup_package_with_constraints_edit $project_dir "" $extras
+    _setup_package_with_constraints_edit $bindep $project_dir "" $extras
 }
 
 # this should be used for projects which run services, like all services
@@ -485,9 +498,14 @@ function setup_install {
 #         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install -e <project_dir>[<extras>]"
 function setup_develop {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local project_dir=$1
     local extras=$2
-    _setup_package_with_constraints_edit $project_dir -e $extras
+    _setup_package_with_constraints_edit $bindep $project_dir -e $extras
 }
 
 # ``pip install -e`` the package, which processes the dependencies
@@ -506,6 +524,11 @@ function setup_develop {
 #         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <flags> <project_dir>[<extras>]"
 function _setup_package_with_constraints_edit {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local project_dir=$1
     local flags=$2
     local extras=$3
@@ -526,7 +549,7 @@ function _setup_package_with_constraints_edit {
             "$flags file://$project_dir#egg=$name"
     fi
 
-    setup_package $project_dir "$flags" $extras
+    setup_package $bindep $project_dir "$flags" $extras
 
     # If this project is in LIBS_FROM_GIT, verify it was actually installed
     # correctly.  This helps catch errors caused by constraints mismatches.
@@ -538,17 +561,30 @@ function _setup_package_with_constraints_edit {
 }
 
 # ``pip install -e`` the package, which processes the dependencies
-# using pip before running `setup.py develop`
+# using pip before running `setup.py develop`.  The command is like
+# "pip install <flags> <project_dir>[<extras>]"
 #
 # Uses globals ``STACK_USER``
-# setup_package project_dir [flags] [extras]
-# project_dir: directory of project repo (e.g., /opt/stack/keystone)
-# flags: pip CLI options/flags
-# extras: comma-separated list of optional dependencies to install
-#         (e.g., ldap,memcache).
-#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
-# The command is like "pip install <flags> <project_dir>[<extras>]"
+#
+# Usage:
+#  setup_package [-bindep[=profile,profile]] <project_dir> <flags> [extras]
+#
+# -bindep     : Use bindep to install dependencies; select extra profiles
+#               as comma separated arguments after "="
+# project_dir : directory of project repo (e.g., /opt/stack/keystone)
+# flags       : pip CLI options/flags
+# extras      : comma-separated list of optional dependencies to install
+#               (e.g., ldap,memcache).
+#               See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 function setup_package {
+    local bindep=0
+    local bindep_flag=""
+    local bindep_profiles=""
+    if [[ $1 == -bindep* ]]; then
+        bindep=1
+        IFS="=" read bindep_flag bindep_profiles <<< ${1}
+        shift
+    fi
     local project_dir=$1
     local flags=$2
     local extras=$3
@@ -564,6 +600,11 @@ function setup_package {
         extras="[$extras]"
     fi
 
+    # install any bindep packages
+    if [[ $bindep == 1 ]]; then
+        install_bindep $project_dir/bindep.txt $bindep_profiles
+    fi
+
     pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
     if [[ "$flags" == "-e" ]]; then
diff --git a/stack.sh b/stack.sh
index 144c233f05..ad1359e926 100755
--- a/stack.sh
+++ b/stack.sh
@@ -801,6 +801,11 @@ fi
 # Install required infra support libraries
 install_infra
 
+# Install bindep
+$VIRTUALENV_CMD $DEST/bindep-venv
+# TODO(ianw) : optionally install from zuul checkout?
+$DEST/bindep-venv/bin/pip install bindep
+
 # Extras Pre-install
 # ------------------
 # Phase: pre-install
diff --git a/stackrc b/stackrc
index 170d3b648f..c8e6c67909 100644
--- a/stackrc
+++ b/stackrc
@@ -149,6 +149,13 @@ export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.5}}
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
 export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
+# Create a virtualenv with this
+if [[ ${USE_PYTHON3} == True ]]; then
+    export VIRTUALENV_CMD="python3 -m venv"
+else
+    export VIRTUALENV_CMD="virtualenv "
+fi
+
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then
     # Old-style user-supplied config

From 16a10d7435be54c97982b93bbc07686ebeb536ac Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Mon, 14 Jan 2019 17:16:01 +0000
Subject: [PATCH 2404/3333] Configure nova's use of placement more correctly

This change addresses a few inconsistencies in how nova processes
are configured to speak to the placement service.

The initial inspiration was that region_name was not being set in the
[placement] section, despite $REGION_NAME being used when setting
the endpoint in the catalog. That's fixed.

While fixing that two other issues became clear:

* Configuring nova process to use placement should happen in lib/nova
  not lib/placement so the function has been moved.
* auth_strategy is not relevant in the [placement] section of a
  nova process

The name of the function is maintained, in case there are plugins which
call it, but a comment is added to indicate that other services besides
nova compute (such as the cell conductor) may use the function.

Change-Id: I4a46b6460596e9a445bd90de2d52dbb71fb963df
---
 lib/nova      | 15 +++++++++++++++
 lib/placement | 13 -------------
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/lib/nova b/lib/nova
index d1d0b3c16b..182ae1efef 100644
--- a/lib/nova
+++ b/lib/nova
@@ -597,6 +597,21 @@ function create_nova_conf {
     fi
 }
 
+# Configure access to placement from a nova service, usually
+# compute, but sometimes conductor.
+function configure_placement_nova_compute {
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+    iniset $conf placement auth_type "password"
+    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $conf placement username placement
+    iniset $conf placement password "$SERVICE_PASSWORD"
+    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
+    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement region_name "$REGION_NAME"
+}
+
 function configure_console_compute {
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
diff --git a/lib/placement b/lib/placement
index da69e39264..a89cd26939 100644
--- a/lib/placement
+++ b/lib/placement
@@ -93,19 +93,6 @@ function _config_placement_apache_wsgi {
     " -i $placement_api_apache_conf
 }
 
-function configure_placement_nova_compute {
-    # Use the provided config file path or default to $NOVA_CONF.
-    local conf=${1:-$NOVA_CONF}
-    iniset $conf placement auth_type "password"
-    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf placement username placement
-    iniset $conf placement password "$SERVICE_PASSWORD"
-    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
-    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement auth_strategy $PLACEMENT_AUTH_STRATEGY
-}
-
 # create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF

From fa9aadfdd8c5f67a47f5a4abafbae0671283affa Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 15 Jan 2019 18:31:05 +1100
Subject: [PATCH 2405/3333] Install from bindep.txt in plugins

This allows plugins to specify their binary dependencies in bindep
format.

Some thinking on the implementation: this is in contrast to the
files/[deb|rpm] installation, which is called from the external
install_prereqs.sh script.  This script being an externally callable
entry-point is really an artifact of the days when we would build
snapshot images for CI and wanted to pre-cache downloads.  These days
we use the mirror system to keep packages close to CI nodes.  Thus
rather than expand install_prereqs.sh to also be installing
virtualenvs and python dependencies, this seems to fit better as a
separate internal phase of stack.sh.

Documentation is updated

Change-Id: Icbdfbf97c17c906a7ae86f43e80eb2c445816228
---
 doc/source/plugins.rst | 56 ++++++++++++++++++++++++++++++++++++------
 functions-common       | 24 ++++++++++++++++++
 stack.sh               |  7 ++++++
 3 files changed, 80 insertions(+), 7 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 89b9381813..de7bdf22b0 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -222,14 +222,20 @@ dependency mechanism is beyond the scope of the current work.
 System Packages
 ===============
 
-Devstack provides a framework for getting packages installed at an early
-phase of its execution. These packages may be defined in a plugin as files
-that contain new-line separated lists of packages required by the plugin
 
-Supported packaging systems include apt and yum across multiple distributions.
-To enable a plugin to hook into this and install package dependencies, packages
-may be listed at the following locations in the top-level of the plugin
-repository:
+
+Devstack based
+--------------
+
+Devstack provides a custom framework for getting packages installed at
+an early phase of its execution.  These packages may be defined in a
+plugin as files that contain new-line separated lists of packages
+required by the plugin
+
+Supported packaging systems include apt and yum across multiple
+distributions.  To enable a plugin to hook into this and install
+package dependencies, packages may be listed at the following
+locations in the top-level of the plugin repository:
 
 - ``./devstack/files/debs/$plugin_name`` - Packages to install when running
   on Ubuntu, Debian or Linux Mint.
@@ -240,6 +246,42 @@ repository:
 - ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
   running on SUSE Linux or openSUSE.
 
+Although there a no plans to remove this method of installing
+packages, plugins should consider it deprecated for ``bindep`` support
+described below.
+
+bindep
+------
+
+The `bindep <https://docs.openstack.org/infra/bindep>`__ project has
+become the defacto standard for OpenStack projects to specify binary
+dependencies.
+
+A plugin may provide a ``./devstack/files/bindep.txt`` file, which
+will be called with the *default* profile to install packages.  For
+details on the syntax, etc. see the bindep documentation.
+
+It is also possible to use the ``bindep.txt`` of projects that are
+being installed from source with the ``-bindep`` flag available in
+install functions.  For example
+
+.. code-block:: bash
+
+  if use_library_from_git "diskimage-builder"; then
+     GITREPO["diskimage-builder"]=$DISKIMAGE_BUILDER_REPO_URL
+     GITDIR["diskimage-builder"]=$DEST/diskimage-builder
+     GITBRANCH["diskimage-builder"]=$DISKIMAGE_BUILDER_REPO_REF
+     git_clone_by_name "diskimage-builder"
+     setup_dev_lib -bindep "diskimage-builder"
+  fi
+
+will result in any packages required by the ``bindep.txt`` of the
+``diskimage-builder`` project being installed.  Note however that jobs
+that switch projects between source and released/pypi installs
+(e.g. with a ``foo-dsvm`` and a ``foo-dsvm-src`` test to cover both
+released dependencies and master versions) will have to deal with
+``bindep.txt`` being unavailable without the source directory.
+
 
 Using Plugins in the OpenStack Gate
 ===================================
diff --git a/functions-common b/functions-common
index 6651cc2661..2a5d13998a 100644
--- a/functions-common
+++ b/functions-common
@@ -1248,6 +1248,30 @@ function get_plugin_packages {
     $xtrace
 }
 
+# Search plugins for a bindep.txt file
+#
+# Uses globals ``BINDEP_CMD``, ``GITDIR``, ``DEVSTACK_PLUGINS``
+#
+# Note this is only valid after BINDEP_CMD is setup in stack.sh, and
+# is thus not really intended to be called externally.
+function _get_plugin_bindep_packages {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local bindep_file
+    local packages
+
+    for plugin in ${DEVSTACK_PLUGINS//,/ }; do
+        bindep_file=${GITDIR[$plugin]}/devstack/files/bindep.txt
+        if [[ -f ${bindep_file} ]]; then
+            packages+=$($BINDEP_CMD -b --file ${bindep_file} || true)
+        fi
+    done
+    echo "${packages}"
+    $xtrace
+}
+
 # Distro-agnostic package installer
 # Uses globals ``NO_UPDATE_REPOS``, ``REPOS_UPDATED``, ``RETRY_UPDATE``
 # install_package package [package ...]
diff --git a/stack.sh b/stack.sh
index ad1359e926..95e4df4277 100755
--- a/stack.sh
+++ b/stack.sh
@@ -805,6 +805,13 @@ install_infra
 $VIRTUALENV_CMD $DEST/bindep-venv
 # TODO(ianw) : optionally install from zuul checkout?
 $DEST/bindep-venv/bin/pip install bindep
+export BINDEP_CMD=${DEST}/bindep-venv/bin/bindep
+
+# Install packages as defined in plugin bindep.txt files
+pkgs="$( _get_plugin_bindep_packages )"
+if [[ -n "${pkgs}" ]]; then
+    install_package ${pkgs}
+fi
 
 # Extras Pre-install
 # ------------------

From 82537871376afe98a286e1ba424cf192ae60869a Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 18 Jan 2019 10:42:13 -0500
Subject: [PATCH 2406/3333] Restrict database access to nova-compute in
 singleconductor mode

Change I4820abe57a023050dd8d067c77e26028801ff288 removed access
to the database for the nova-compute process but only in
superconductor mode. Grenade runs in singleconductor mode though
so we are getting tracebacks in nova-compute logs during grenade
runs because nova-compute is running with nova.conf which is
configured with access to the nova API database.

This change handles removing database access for nova-compute
generically to cover both the singleconductor and superconductor
cases.

Change-Id: I81301eeecc7669a169deeb1e2c5d298a595aab94
Closes-Bug: #1812398
---
 lib/nova | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/nova b/lib/nova
index d1d0b3c16b..199550bf03 100644
--- a/lib/nova
+++ b/lib/nova
@@ -897,25 +897,26 @@ function start_nova_compute {
         local compute_cell_conf=$NOVA_CONF
     fi
 
+    cp $compute_cell_conf $NOVA_CPU_CONF
+
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
         # skip these bits and use the normal config.
-        NOVA_CPU_CONF=$compute_cell_conf
         echo "Skipping multi-cell conductor fleet setup"
     else
         # "${CELLSV2_SETUP}" is "superconductor"
-        cp $compute_cell_conf $NOVA_CPU_CONF
         # FIXME(danms): Should this be configurable?
         iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
         # Since the nova-compute service cannot reach nova-scheduler over
         # RPC, we also disable track_instance_changes.
         iniset $NOVA_CPU_CONF filter_scheduler track_instance_changes False
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
-        # Make sure we nuke any database config
-        inidelete $NOVA_CPU_CONF database connection
-        inidelete $NOVA_CPU_CONF api_database connection
     fi
 
+    # Make sure we nuke any database config
+    inidelete $NOVA_CPU_CONF database connection
+    inidelete $NOVA_CPU_CONF api_database connection
+
     # Console proxies were configured earlier in create_nova_conf. Now that the
     # nova-cpu.conf has been created, configure the console settings required
     # by the compute process.

From 29ab9b8e3065488842a2477a8a8c48020d955094 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 22 Jan 2019 16:23:42 +0100
Subject: [PATCH 2407/3333] Always start iscsid for nova-compute

Recently iscsid was disabled by default on Ubuntu 18.04 (bionic),
and it may be on Xenial too, see:

https://bugs.launchpad.net/ubuntu/+source/open-iscsi/+bug/1755858

On a local Bionic deployment with Python 3, the lack of iscsid makes
nova-compute fail with an exception when trying to attach a volume:

Invalid input received: Connector doesn't have required information: initiator

Asking for the service to be started even if it is already running should not
hurt, so remove the check for the distribution.

This does not seem to be an issue on CentOS 7 (but Python 2) where
the socket activation of iscsid seems to work, so maybe there is
another way to make this working. Also, the service could be
enabled, not just started.

Change-Id: Ifa995dcf8eb930e959f54e96af6f5fce3eac28ae
---
 lib/nova | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 199550bf03..0b08c0ac6c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -327,10 +327,8 @@ function configure_nova {
                 sudo chown -R $STACK_USER $NOVA_INSTANCES_PATH
             fi
         fi
-        if is_suse; then
-            # iscsid is not started by default
-            start_service iscsid
-        fi
+        # ensure that iscsid is started, even when disabled by default
+        start_service iscsid
     fi
 
     # Rebuild the config file from scratch

From 6757a9c5dec32f39b984ceaaa0eb9e903602769a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Fri, 21 Dec 2018 13:17:05 +0100
Subject: [PATCH 2408/3333] Add option to place etcd data dir on RAM disk

Seems like for etcd-heavy services like Kubernetes, the fsync
performance of gate VM's are too low [1]. This commit implements an
option to put etcd data directory on RAM disk (tmpfs) to work this
around.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2019-January/001849.html

Change-Id: I5a17099cb9d6941b1a009dc82daefd2c7946d892
---
 lib/etcd3 | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index c65a522267..0748ea01ee 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -27,6 +27,10 @@ set +o xtrace
 ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
+# Option below will mount ETCD_DATA_DIR as ramdisk, which is useful to run
+# etcd-heavy services in the gate VM's, e.g. Kubernetes.
+ETCD_USE_RAMDISK=$(trueorfalse False ETCD_USE_RAMDISK)
+ETCD_RAMDISK_MB=${ETCD_RAMDISK_MB:-512}
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -89,6 +93,9 @@ function cleanup_etcd3 {
 
     $SYSTEMCTL daemon-reload
 
+    if [[ "$ETCD_USE_RAMDISK" == "True" ]]; then
+        sudo umount $ETCD_DATA_DIR
+    fi
     sudo rm -rf $ETCD_DATA_DIR
 }
 
@@ -98,6 +105,9 @@ function install_etcd3 {
     # Create the necessary directories
     sudo mkdir -p $ETCD_BIN_DIR
     sudo mkdir -p $ETCD_DATA_DIR
+    if [[ "$ETCD_USE_RAMDISK" == "True" ]]; then
+        sudo mount -t tmpfs -o nodev,nosuid,size=${ETCD_RAMDISK_MB}M tmpfs $ETCD_DATA_DIR
+    fi
 
     # Download and cache the etcd tgz for subsequent use
     local etcd_file

From 8b9864d7bf2eaad3c42030cf8e7a2a0b764dc552 Mon Sep 17 00:00:00 2001
From: Michael Johnson <johnsomor@gmail.com>
Date: Thu, 24 Jan 2019 10:49:35 -0800
Subject: [PATCH 2409/3333] Update the devstack LBaaS guide for Octavia

The existing devstack guide for load balancing is out of date.
This patch updates the guide to reflect the current way to install
devstack with the Octavia plugin(s).

Change-Id: Id48b70b50e44ec7b965d969b2d93f77543d7364c
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 113 +++++++++++++------
 1 file changed, 76 insertions(+), 37 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index df3c7ce2ac..b1d88cb35c 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -1,39 +1,54 @@
-Configure Load-Balancer Version 2
-=================================
+Devstack with Octavia Load Balancing
+====================================
 
-Starting in the OpenStack Liberty release, the
-`neutron LBaaS v2 API <https://developer.openstack.org/api-ref/network/v2/index.html>`_
-is now stable while the LBaaS v1 API has been deprecated.  The LBaaS v2 reference
-driver is based on Octavia.
+Starting with the OpenStack Pike release, Octavia is now a standalone service
+providing load balancing services for OpenStack.
 
+This guide will show you how to create a devstack with `Octavia API`_ enabled.
+
+.. _Octavia API: https://developer.openstack.org/api-ref/load-balancer/v2/index.html
 
 Phase 1: Create DevStack + 2 nova instances
 --------------------------------------------
 
 First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space,
-make sure it is updated. Install git and any other developer tools you find useful.
+make sure it is updated. Install git and any other developer tools you find
+useful.
 
 Install devstack
 
 ::
 
     git clone https://git.openstack.org/openstack-dev/devstack
-    cd devstack
+    cd devstack/tools
+    sudo ./create-stack-user.sh
+    cd ../..
+    sudo mv devstack /opt/stack
+    sudo chown -R stack.stack /opt/stack/devstack
 
+This will clone the current devstack code locally, then setup the "stack"
+account that devstack services will run under. Finally, it will move devstack
+into its default location in /opt/stack/devstack.
 
-Edit your ``local.conf`` to look like
+Edit your ``/opt/stack/devstack/local.conf`` to look like
 
 ::
 
     [[local|localrc]]
-    # Load the external LBaaS plugin.
-    enable_plugin neutron-lbaas https://git.openstack.org/openstack/neutron-lbaas
     enable_plugin octavia https://git.openstack.org/openstack/octavia
+    # If you are enabling horizon, include the octavia dashboard
+    # enable_plugin octavia-dashboard https://git.openstack.org/openstack/octavia-dashboard.git
+    # If you are enabling barbican for TLS offload in Octavia, include it here.
+    # enable_plugin barbican https://github.com/openstack/barbican.git
+
+    # If you have python3 available:
+    # USE_PYTHON3=True
 
     # ===== BEGIN localrc =====
     DATABASE_PASSWORD=password
     ADMIN_PASSWORD=password
     SERVICE_PASSWORD=password
+    SERVICE_TOKEN=password
     RABBIT_PASSWORD=password
     # Enable Logging
     LOGFILE=$DEST/logs/stack.sh.log
@@ -41,27 +56,30 @@ Edit your ``local.conf`` to look like
     LOG_COLOR=True
     # Pre-requisite
     ENABLED_SERVICES=rabbit,mysql,key
-    # Horizon
-    ENABLED_SERVICES+=,horizon
+    # Horizon - enable for the OpenStack web GUI
+    # ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch
+    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
+    ENABLED_SERVICES+=,placement-api,placement-client
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
-    # Enable LBaaS v2
-    ENABLED_SERVICES+=,q-lbaasv2
+    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta,neutron
     ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api
     # Cinder
     ENABLED_SERVICES+=,c-api,c-vol,c-sch
     # Tempest
     ENABLED_SERVICES+=,tempest
+    # Barbican - Optionally used for TLS offload in Octavia
+    # ENABLED_SERVICES+=,barbican
     # ===== END localrc =====
 
 Run stack.sh and do some sanity checks
 
 ::
 
+    sudo su - stack
+    cd /opt/stack/devstack
     ./stack.sh
     . ./openrc
 
@@ -72,38 +90,59 @@ Create two nova instances that we can use as test http servers:
 ::
 
     #create nova instances on private network
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
-    nova list # should show the nova instances just created
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
+    openstack server creeate --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
+    openstack server list # should show the nova instances just created
 
     #add secgroup rules to allow ssh etc..
     openstack security group rule create default --protocol icmp
     openstack security group rule create default --protocol tcp --dst-port 22:22
     openstack security group rule create default --protocol tcp --dst-port 80:80
 
-Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
+Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)' or 'gocubsgo') and run
 
 ::
 
     MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
     while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
 
-Phase 2: Create your load balancers
-------------------------------------
+Phase 2: Create your load balancer
+----------------------------------
+
+Make sure you have the 'openstack loadbalancer' commands:
 
 ::
 
-    neutron lbaas-loadbalancer-create --name lb1 private-subnet
-    neutron lbaas-loadbalancer-show lb1  # Wait for the provisioning_status to be ACTIVE.
-    neutron lbaas-listener-create --loadbalancer lb1 --protocol HTTP --protocol-port 80 --name listener1
-    sleep 10  # Sleep since LBaaS actions can take a few seconds depending on the environment.
-    neutron lbaas-pool-create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
-    sleep 10
-    neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.3 --protocol-port 80 pool1
-    sleep 10
-    neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.5 --protocol-port 80 pool1
-
-Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes
-(in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be
-reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is
-"curl that-lb-ip", which should alternate between showing the IPs of the two nodes.
+    pip install python-octaviaclient
+
+Create your load balancer:
+
+::
+
+    openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer listener create --protocol HTTP --protocol-port 80 --name listener1 lb1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer pool create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer healthmonitor create --delay 5 --timeout 2 --max-retries 1 --type HTTP pool1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer member create --subnet-id private-subnet --address <web server 1 address> --protocol-port 80 pool1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer member create --subnet-id private-subnet --address <web server 2 address> --protocol-port 80 pool1
+
+Please note: The <web server # address> fields are the IP addresses of the nova
+servers created in Phase 1.
+Also note, using the API directly you can do all of the above commands in one
+API call.
+
+Phase 3: Test your load balancer
+--------------------------------
+
+::
+
+    openstack loadbalancer show lb1 # Note the vip_address
+    curl http://<vip_address>
+    curl http://<vip_address>
+
+This should show the "Welcome to <IP>" message from each member server.

From d6bbeabb5c5c35eb9ada92656c9b65fbef8aff07 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Wed, 23 Jan 2019 19:31:53 +0000
Subject: [PATCH 2410/3333] Fix installation of mkisofs on SUSE Linux
 Enterprise 12

It's provided by the cdrkit-cdrtools-compat package.

Change-Id: I4b57e03391d47bed777016ab1d735b8ba4aa5ceb
---
 files/rpms-suse/n-cpu | 3 ++-
 files/rpms-suse/nova  | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index c11e9f0763..9c724cb9d8 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,8 +1,9 @@
+cdrkit-cdrtools-compat # dist:sle12
 cryptsetup
 dosfstools
 libosinfo
 lvm2
-mkisofs
+mkisofs # not:sle12
 open-iscsi
 sg3_utils
 # Stuff for diablo volumes
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 4103a407d2..1d5812146b 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -1,3 +1,4 @@
+cdrkit-cdrtools-compat # dist:sle12
 conntrack-tools
 curl
 dnsmasq
@@ -11,7 +12,8 @@ kvm # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
 mariadb # NOPRIME
-mkisofs # required for config_drive
+# mkisofs is required for config_drive
+mkisofs # not:sle12
 parted
 polkit
 # qemu as fallback if kvm cannot be used

From bc2a88d1f493f4f0784650e5ac959e8677495669 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Thu, 24 Jan 2019 18:57:33 +0000
Subject: [PATCH 2411/3333] On SUSE-based systems, check whether we have
 mariadb or mysql service

Older mariadb packages on SLES 12 provided mysql.service.  The newer
ones on SLES 12 and 15 use mariadb.service; they also provide a
mysql.service symlink for backwards-compatibility, but let's not rely
on that.

Change-Id: Ife6bd007ba30af0b77d44832b19d518034bdb12b
---
 lib/databases/mysql | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index ac0c083c91..4d0f5f3e45 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -16,7 +16,13 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 register_database mysql
 
 MYSQL_SERVICE_NAME=mysql
-if is_suse || is_fedora && ! is_oraclelinux; then
+if is_fedora && ! is_oraclelinux; then
+    MYSQL_SERVICE_NAME=mariadb
+elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
+    # Older mariadb packages on SLES 12 provided mysql.service.  The
+    # newer ones on SLES 12 and 15 use mariadb.service; they also
+    # provide a mysql.service symlink for backwards-compatibility, but
+    # let's not rely on that.
     MYSQL_SERVICE_NAME=mariadb
 fi
 

From bbb6b0c2409278a4c9266c39bd1f5d91f7066bb8 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Fri, 25 Jan 2019 00:29:42 +0000
Subject: [PATCH 2412/3333] Fix version comparison for SUSE Linux Enterprise 12

The version comparison introduced in
I5152f2585c3d4d18853988d6290039d6b1713b99 was broken, because it tried
to use bash's -lt operator for floating point comparison, but bash
only supports integer arithmetic.

So instead use devstack's vercmp() function.

Change-Id: I8aac71c5bb6c2e82479d62831ea0672ba6a9a534
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 523024e2fe..fbe4c92139 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -69,7 +69,7 @@ function _neutron_ovs_base_install_agent_packages {
         restart_service openvswitch
         sudo systemctl enable openvswitch
     elif is_suse; then
-        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
+        if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
             restart_service openvswitch-switch
         else
             # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971

From 96269d8e758e168fb857fca6e96cbd9a50628ac0 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 17 Dec 2018 10:38:42 -0500
Subject: [PATCH 2413/3333] Change config-file to config-dir for g-api start

The glance-api service may use multiple config files, so
tell oslo.config about the config dir instead of a specific
config file when the service is started.

Change-Id: Iad3602d209cbb31e10683c67e1fd6b465d19f560
Partial-bug: #1805765
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 94f6a22931..b1c8c4dacc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -345,7 +345,7 @@ function start_glance {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         run_process g-api "$GLANCE_BIN_DIR/uwsgi --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
     fi
 
     echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."

From ee4b6a0128bad7ae64e9ae7a9c79470585e93dc6 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 29 Jan 2019 18:17:30 +0000
Subject: [PATCH 2414/3333] set owner and group to no for
 fetch-devstack-log-dir

As the user on the node under test may not exist on
the zuul executor node we do not copy the log owner
or group to avoid the rsync task failing when it
tries to chown the files.

Change-Id: I500cf3692a4d27b0c2a0a4f5586580d180a8778e
---
 roles/fetch-devstack-log-dir/tasks/main.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/roles/fetch-devstack-log-dir/tasks/main.yaml b/roles/fetch-devstack-log-dir/tasks/main.yaml
index 5a198b21b4..276c4e0eb5 100644
--- a/roles/fetch-devstack-log-dir/tasks/main.yaml
+++ b/roles/fetch-devstack-log-dir/tasks/main.yaml
@@ -1,5 +1,10 @@
+# as the user in the guest may not exist on the executor
+# we do not preserve the group or owner of the copied logs.
+
 - name: Collect devstack logs
   synchronize:
     dest: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}"
     mode: pull
     src: "{{ devstack_base_dir }}/logs"
+    group: no
+    owner: no

From b6f04ca5c9c09db2d567ecbf7fad757158fd0aba Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Wed, 23 Jan 2019 18:55:16 +0000
Subject: [PATCH 2415/3333] Fix distro detection for SUSE Linux Enterprise

On SUSE Linux Enterprise distributions, lsb_release -i typically
returns "SUSE" not "SUSE LINUX" as the vendor string.

To avoid duplication of the same regular expressions in multiple
places, add is_opensuse() and is_sle() helper functions, and modify
is_suse to invoke those.

This may also be helpful in the future for distinguishing some corner
cases where things are handled differently between openSUSE and SLE.

Change-Id: I43bf163bc963758ddbb6289928837f5f6512f265
---
 functions-common | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index e5962db42b..28b12b270b 100644
--- a/functions-common
+++ b/functions-common
@@ -379,14 +379,14 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then
         # For Fedora, just use 'f' and the release
         DISTRO="f$os_RELEASE"
-    elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
+    elif is_opensuse; then
         DISTRO="opensuse-$os_RELEASE"
         # Tumbleweed uses "n/a" as a codename, and the release is a datestring
         # like 20180218, so not very useful. Leap however uses a release
         # with a "dot", so for example 15.0
         [ "$os_CODENAME" = "n/a" -a "$os_RELEASE" = "${os_RELEASE/\./}" ] && \
             DISTRO="opensuse-tumbleweed"
-    elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
+    elif is_suse_linux_enterprise; then
         # just use major release
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
@@ -460,11 +460,30 @@ function is_fedora {
 # (openSUSE, SLE).
 # is_suse
 function is_suse {
+    is_opensuse || is_suse_linux_enterprise
+}
+
+
+# Determine if current distribution is an openSUSE distribution
+# is_opensuse
+function is_opensuse {
+    if [[ -z "$os_VENDOR" ]]; then
+        GetOSVersion
+    fi
+
+    [[ "$os_VENDOR" =~ (openSUSE) ]]
+}
+
+
+# Determine if current distribution is a SUSE Linux Enterprise (SLE)
+# distribution
+# is_suse_linux_enterprise
+function is_suse_linux_enterprise {
     if [[ -z "$os_VENDOR" ]]; then
         GetOSVersion
     fi
 
-    [[ "$os_VENDOR" =~ (openSUSE) || "$os_VENDOR" == "SUSE LINUX" ]]
+    [[ "$os_VENDOR" =~ (^SUSE) ]]
 }
 
 

From ec8285271e0c0b7c97fb6cd8816eca8ad844c5bd Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 30 Jan 2019 20:48:18 -0500
Subject: [PATCH 2416/3333] Change "Options pimp your stack" heading in
 multinode docs

Uses a less offensive and arguably better understood section
header in the multinode docs.

Change-Id: Ie6fd58e9abd5c1ce88d88ac55419807790f61851
Closes-Bug: #1810317
---
 doc/source/guides/multinode-lab.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index b4e2891c10..33820daec0 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -240,8 +240,8 @@ this when it runs but there are times it needs to still be done by hand:
     sudo rm -rf /etc/libvirt/qemu/inst*
     sudo virsh list | grep inst | awk '{print $1}' | xargs -n1 virsh destroy
 
-Options pimp your stack
-=======================
+Going further
+=============
 
 Additional Users
 ----------------

From 1516e720ce1d6eb6eca38feb1ca18dc7fc8c105c Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 5 Feb 2019 11:21:39 -0500
Subject: [PATCH 2417/3333] Set ETCD_USE_RAMDISK=True by default

Cinder and etcd are enabled by default and by default
cinder uses etcd as a distributed lock manager with
tooz as an intermediary. We see a lot of ToozConnectionErrors [1]
in the cinder logs when etcd is backed up [2] which results in
cinder operations timing out causing test failures, like
when a volume is not deleted within a given time.

This changes ETCD_USE_RAMDISK=True by default to try and
alleviate some of the pressure. An alternative is if we know
we're in a single-node job we could just not use a DLM for
Cinder.

[1] http://status.openstack.org/elastic-recheck/#1810526
[2] etcd[26824]: sync duration of 12.076762123s, expected less than 1s

Change-Id: I5f82aa40e9d84114e7b7b5cf19ec4942d6552490
Partial-Bug: #1810526
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 0748ea01ee..4f3a7a4349 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -29,7 +29,7 @@ ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
 # Option below will mount ETCD_DATA_DIR as ramdisk, which is useful to run
 # etcd-heavy services in the gate VM's, e.g. Kubernetes.
-ETCD_USE_RAMDISK=$(trueorfalse False ETCD_USE_RAMDISK)
+ETCD_USE_RAMDISK=$(trueorfalse True ETCD_USE_RAMDISK)
 ETCD_RAMDISK_MB=${ETCD_RAMDISK_MB:-512}
 
 if is_ubuntu ; then

From 4a3cc1ce341eca821ddf004ca484bd827d060507 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 30 Jan 2019 20:50:47 -0500
Subject: [PATCH 2418/3333] Remove hard-coded VOLUME_BACKING_FILE_SIZE from
 multinode docs

The default for VOLUME_BACKING_FILE_SIZE changes over time
and the docs referencing it are clearly not keeping pace so
rather than hard-code a default in the docs just remove it
since the doc already mentions the variable used to set that
size.

Change-Id: I4242584d13250872250689863d1b70c68594eefe
---
 doc/source/guides/multinode-lab.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 33820daec0..7978cd86ea 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -302,10 +302,10 @@ Volumes
 
 DevStack will automatically use an existing LVM volume group named
 ``stack-volumes`` to store cloud-created volumes. If ``stack-volumes``
-doesn't exist, DevStack will set up a 10Gb loop-mounted file to contain
-it. This obviously limits the number and size of volumes that can be
-created inside OpenStack. The size can be overridden by setting
-``VOLUME_BACKING_FILE_SIZE`` in ``local.conf``.
+doesn't exist, DevStack will set up a loop-mounted file to contain
+it.  If the default size is insufficient for the number and size of volumes
+required, it can be overridden by setting ``VOLUME_BACKING_FILE_SIZE`` in
+``local.conf`` (sizes given in ``truncate`` compatible format, e.g. ``24G``).
 
 ``stack-volumes`` can be pre-created on any physical volume supported by
 Linux's LVM. The name of the volume group can be changed by setting

From b43810a36635f1d0fe9291b157506fcf20272adf Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Thu, 7 Feb 2019 16:46:49 -0500
Subject: [PATCH 2419/3333] Glance should not reference Cinder v1

Cinder v1 was removed over a year ago.  Change the cinder template
URLs devstack defines in the glance-api.conf to use cinder v3
instead.

Change-Id: I4a68dc0b53631be0708e7411c37619dd6dfd4fa6
---
 lib/glance | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 94f6a22931..8001157e58 100644
--- a/lib/glance
+++ b/lib/glance
@@ -236,8 +236,8 @@ function configure_glance {
         CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
         CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 
-        iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
-        iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
+        iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
+        iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then

From bfd2a54c13b8f3235991e534d5aa822be2aeaf19 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Fri, 8 Feb 2019 14:49:16 -0500
Subject: [PATCH 2420/3333] Stop creating the cinderv1 endpoint

The cinder v1 api is disabled by default,
the catalog entry is confusing.

Change-Id: Ifea283d8aff9f7a70b68d601c5225c3d4fe250e6
---
 lib/cinder | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 76bf928413..d69b21efd0 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -349,18 +349,12 @@ function create_cinder_accounts {
 
         # block-storage is the official service type
         get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
-        get_or_create_service "cinder" "volume" "Cinder Volume Service"
         if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
-            get_or_create_endpoint \
-                "volume" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
-
             get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
             get_or_create_endpoint \
                 "volumev2" \
@@ -378,11 +372,6 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
 
-            get_or_create_endpoint \
-                "volume" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v1/\$(project_id)s"
-
             get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
             get_or_create_endpoint \
                 "volumev2" \

From e729976c82791c513feedd51c9c2c45d79b09f61 Mon Sep 17 00:00:00 2001
From: Nguyen Hai <nguyentrihai93@gmail.com>
Date: Wed, 13 Feb 2019 15:04:02 +0900
Subject: [PATCH 2421/3333] Add placement as default project in index webpage

Change-Id: I101ade5368fbdf108906e89e1c3ba03a46cd6f35
---
 doc/source/index.rst    | 4 ++--
 doc/source/overview.rst | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6c42a5b4e9..9186f6dba7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -114,8 +114,8 @@ Profit!
 You now have a working DevStack! Congrats!
 
 Your devstack will have installed ``keystone``, ``glance``, ``nova``,
-``cinder``, ``neutron``, and ``horizon``. Floating IPs will be
-available, guests have access to the external world.
+``placement``, ``cinder``, ``neutron``, and ``horizon``. Floating IPs
+will be available, guests have access to the external world.
 
 You can access horizon to experience the web interface to
 OpenStack, and manage vms, networks, volumes, and images from
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 2479cd0bc8..a609333289 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -64,7 +64,8 @@ Services
 
 The default services configured by DevStack are Identity (keystone),
 Object Storage (swift), Image Service (glance), Block Storage
-(cinder), Compute (nova), Networking (neutron), Dashboard (horizon)
+(cinder), Compute (nova), Placement (placement),
+Networking (neutron), Dashboard (horizon).
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call

From 72f632222f6d90d3545b5d7ca48297da4218e2ea Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 19 Feb 2019 14:06:18 +1100
Subject: [PATCH 2422/3333] Update cirros256 flavor to have some disk

It seems nova has changed defaults on who can create zero-sized disk
instances [1] and now some devstack jobs, like nodepool's, can't
create cirros images using this flavor.  It seems the easiest thing to
do is just to bump it up.

[1] https://review.openstack.org/#/c/603910/

Change-Id: I1172d4775d608568ccbeb27e2975d83add892ea9
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6c9b944ba0..033ebf3697 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1167,7 +1167,7 @@ function create_flavors {
     if is_service_enabled n-api; then
         if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q ds512M; then
             # Note that danms hates these flavors and apologizes for sdague
-            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 1 --vcpus 1 cirros256
             openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
             openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
             openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G

From f0dc93dcb4bc69442733056e88de9aff0f890664 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Apr 2018 10:42:07 +1000
Subject: [PATCH 2423/3333] Workaround pip10 uninstall of packages

As noted in comments, this is a hack to get pip10 to overwrite some
package installed libraries.

Change-Id: Iea24a3ea915e13f7e0882144028ec5ff5bfdfae1
---
 tools/fixup_stuff.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a939e30b02..1ff7bfa516 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -202,7 +202,19 @@ function fixup_fedora {
             # install requests with the bundled urllib3 to avoid conflicts
             pip_install --upgrade --force-reinstall requests
         fi
+
     fi
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -rf /usr/lib/python2.7/site-packages/enum34*.egg-info
+    sudo rm -rf /usr/lib/python2.7/site-packages/ipaddress*.egg-info
+    sudo rm -rf /usr/lib/python2.7/site-packages/ply-*.egg-info
+    sudo rm -rf /usr/lib/python2.7/site-packages/typing-*.egg-info
 }
 
 function fixup_suse {

From 543aed422fd89875113861e6a554da7980f8dd4f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Apr 2018 15:22:47 +1000
Subject: [PATCH 2424/3333] Don't install numpy packages

numpy is a python requirement of the websockify package (it appears
there was some disucssion over *removing* this in [1], but did not
happen).  Possibly these packages were installed a long time ago
before wheel support as it was taking a long time to build.  But we
have wheels today, and later versions than the distro provides are
being dragged in anyway.  Remove all distro installs.

[1] https://github.com/novnc/websockify/pull/163

Change-Id: I322dd9e1a07d8ce03c26cf3fcccebd6e21282fe4
---
 files/rpms-suse/n-novnc | 1 -
 files/rpms-suse/n-spice | 1 -
 files/rpms/n-novnc      | 1 -
 files/rpms/n-spice      | 1 -
 files/rpms/nova         | 1 -
 5 files changed, 5 deletions(-)
 delete mode 100644 files/rpms-suse/n-novnc
 delete mode 100644 files/rpms-suse/n-spice
 delete mode 100644 files/rpms/n-novnc
 delete mode 100644 files/rpms/n-spice

diff --git a/files/rpms-suse/n-novnc b/files/rpms-suse/n-novnc
deleted file mode 100644
index c8722b9f66..0000000000
--- a/files/rpms-suse/n-novnc
+++ /dev/null
@@ -1 +0,0 @@
-python-numpy
diff --git a/files/rpms-suse/n-spice b/files/rpms-suse/n-spice
deleted file mode 100644
index c8722b9f66..0000000000
--- a/files/rpms-suse/n-spice
+++ /dev/null
@@ -1 +0,0 @@
-python-numpy
diff --git a/files/rpms/n-novnc b/files/rpms/n-novnc
deleted file mode 100644
index 24ce15ab7e..0000000000
--- a/files/rpms/n-novnc
+++ /dev/null
@@ -1 +0,0 @@
-numpy
diff --git a/files/rpms/n-spice b/files/rpms/n-spice
deleted file mode 100644
index 24ce15ab7e..0000000000
--- a/files/rpms/n-spice
+++ /dev/null
@@ -1 +0,0 @@
-numpy
diff --git a/files/rpms/nova b/files/rpms/nova
index 4140cd7bae..8d73644025 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -13,7 +13,6 @@ libxml2-python
 m2crypto
 mysql-devel
 mysql-server # NOPRIME
-numpy # needed by websockify for spice console
 parted
 polkit
 rabbitmq-server # NOPRIME

From 29771c1c1e09e6bf2cad0f67cf4c176735f5ac0a Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Thu, 21 Feb 2019 10:36:18 +0100
Subject: [PATCH 2425/3333] Remove the usage of read_password from library
 files

The read_password function is defined inside stack.sh
and it cannot be used inside the "public library interface"
provided by DevStack.

Move the calls found inside library files to stack.sh,
following the same pattern of the other calls to read_password.

Change-Id: I8adc6723b677dfac2bef735f660e056c498bf773
---
 lib/database                          |  2 --
 lib/nova_plugins/hypervisor-xenserver |  1 -
 stack.sh                              | 19 ++++++++++++++++++-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/lib/database b/lib/database
index 0d720527df..7940cf2208 100644
--- a/lib/database
+++ b/lib/database
@@ -87,8 +87,6 @@ function initialize_database_backends {
 
     if [ -n "$MYSQL_PASSWORD" ]; then
         DATABASE_PASSWORD=$MYSQL_PASSWORD
-    else
-        read_password DATABASE_PASSWORD "ENTER A PASSWORD TO USE FOR THE DATABASE."
     fi
 
     # We configure Nova, Horizon, Glance and Keystone to use MySQL as their
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 6f79e4ff7c..cd4d3caa84 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -59,7 +59,6 @@ function configure_nova_hypervisor {
         die $LINENO "os-xenapi plugin is not specified. Please enable this plugin in local.conf"
     fi
 
-    read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
     iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
     iniset $NOVA_CONF xenserver connection_url "$XENAPI_CONNECTION_URL"
     iniset $NOVA_CONF xenserver connection_username "$XENAPI_USER"
diff --git a/stack.sh b/stack.sh
index 022d5b9438..8d4042dc23 100755
--- a/stack.sh
+++ b/stack.sh
@@ -691,7 +691,14 @@ function read_password {
 # The available database backends are listed in ``DATABASE_BACKENDS`` after
 # ``lib/database`` is sourced. ``mysql`` is the default.
 
-initialize_database_backends && echo "Using $DATABASE_TYPE database backend" || echo "No database enabled"
+if initialize_database_backends; then
+    echo "Using $DATABASE_TYPE database backend"
+    # Last chance for the database password. This must be handled here
+    # because read_password is not a library function.
+    read_password DATABASE_PASSWORD "ENTER A PASSWORD TO USE FOR THE DATABASE."
+else
+    echo "No database enabled"
+fi
 
 
 # Queue Configuration
@@ -729,6 +736,16 @@ if is_service_enabled keystone; then
 fi
 
 
+# Nova
+# -----
+
+if is_service_enabled nova && [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
+    # Look for the backend password here because read_password
+    # is not a library function.
+    read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
+fi
+
+
 # Swift
 # -----
 

From cf7fc9c757a53113405e8f52af1020e5d21b04fe Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Mon, 25 Feb 2019 10:46:52 +0100
Subject: [PATCH 2426/3333] Add 3 nodes nodeset based on Ubuntu bionic

It is needed for example in neutron-tempest-dvr-ha-multinode-full
job.

Change-Id: I1b9dbb256e338d7018adb8b2ee97999ebd8eda44
Related-Bug: #1804844
---
 .zuul.yaml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index afe400e1a4..ce1a300237 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -148,6 +148,41 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-three-node-bionic
+    nodes:
+      - name: controller
+        label: ubuntu-bionic
+      - name: compute1
+        label: ubuntu-bionic
+      - name: compute2
+        label: ubuntu-bionic
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+          - compute2
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+          - compute2
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+          - compute2
+
 - job:
     name: devstack-base
     parent: multinode

From 0d83e09464551a8eb4ee5c66dc82de7053b14d70 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Wed, 27 Feb 2019 11:10:05 +0000
Subject: [PATCH 2427/3333] Use master upper-constraints when installing
 tempest plugins

when tempst venv is build, it use the master upper_contraint[1]
but when we install tempest plugin, it use branch upper_contraint.

This leads to mismatch the dependency version between tempest and required
tempest plugins setup.

Current flow after this change is:

1. install tempest form master (until you explicitly change TEMPEST_BRANCH
   which is default to master in all stable branch). It applies the upper_constraint
   from the stable branch but that will be overridden in step2
2. configure tempest, here the created venv will install all dependency with
   master's upper_constraint.
3. install tempest plugins in same venv created above. Now tempest plugin
   will also use the master upper_constraint.

With this tempest venv which has all enabled plugin will be contsraint with
master.

[1] https://github.com/openstack-dev/devstack/blob/72f632222f6d90d3545b5d7ca48297da4218e2ea/lib/tempest#L590

Change-Id: I89314e8391e8f26c622fc090cbe27997b3cf049a
Closes-Bug: #1816022
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 7526d3bb4e..1e344c8567 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -673,7 +673,9 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt $TEMPEST_PLUGINS
+        # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
+        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
+        tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi

From 55f172961a2b5422baa6ce3d9e46989c7902bbd1 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Tue, 20 Nov 2018 19:22:01 +0000
Subject: [PATCH 2428/3333] Revert "Revert "remove external_network_bridge
 option""

This reverts commit e3e9ea299601665a295e31a98e90dd9587165850.

Change-Id: I23e1b98bd2839b79226b55700ee404a8fda83f83
---
 lib/neutron                  | 3 ---
 lib/neutron_plugins/ovs_base | 4 ----
 2 files changed, 7 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 62f7366e7e..b2414cfb1b 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -95,9 +95,6 @@ NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
 NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
-# This is needed because _neutron_ovs_base_configure_l3_agent will set
-# external_network_bridge
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 # This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
 # an external network bridge
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index fbe4c92139..2e63fe3c7b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -96,10 +96,6 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    fi
-
     neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||

From 30d48ff88782347e5deb31369aa228f7345cfc6f Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Wed, 12 Dec 2018 19:41:36 +0000
Subject: [PATCH 2429/3333] Remove admin_domain_scope tempest setting

Keystone is currently working through a bunch of changes to add proper
system, domain, and project scope support for its API. This includes
implementing ``admin``, ``member``, and ``reader`` roles for system,
domain, and project assignments. More informaiton on those specific
changes can be found here:

  https://review.openstack.org/#/q/(status:open+OR+status:closed)+project:openstack/keystone+branch:master+topic:implement-default-roles

One thing that was uncovered in implementing that support for the
project API was that setting tempest
``CONF.identity.admin_domain_scope = True`` meant domain admins of one
domain would be able to list projects in other domains, highlighted in
the following patch:

  https://review.openstack.org/#/c/624218/2

This commit doesn't set this option and assumes the proper
domain-scoping behavior being built into keystone natively.

Change-Id: I12a57cc43de0b17eababa19b7b94de5277689f82
Related-Bug: 1750660
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7526d3bb4e..e3ad7fed6a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -276,8 +276,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
     iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION
     iniset $TEMPEST_CONFIG identity user_unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
-    # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation
-    iniset $TEMPEST_CONFIG identity admin_domain_scope True
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"

From 8c5486993dec738a3e83746af2d62bdba648c999 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 11 May 2018 16:12:17 +0530
Subject: [PATCH 2430/3333] Bump noVNC to 1.0.0

This introduces a breaking change in the URLs used to access the console
[1]. This is updated in both the documentation and linked nova change.

[1] https://github.com/novnc/noVNC/commit/83391ffc

Change-Id: I14a0be0034f4a76ab37eb90325967500c3bf1ff9
Depends-On: I9a50a111ff4911f4364a1b24d646095c72af3d2c
Related-bug: #1682020
---
 doc/source/guides/multinode-lab.rst |  2 +-
 lib/nova                            | 11 ++++++++++-
 stackrc                             |  2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 7978cd86ea..5f5bb846eb 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -177,7 +177,7 @@ machines, create a ``local.conf`` with:
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
     ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol,placement-client
     NOVA_VNC_ENABLED=True
-    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
+    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
     VNCSERVER_LISTEN=$HOST_IP
     VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
 
diff --git a/lib/nova b/lib/nova
index 033ebf3697..c892c96fce 100644
--- a/lib/nova
+++ b/lib/nova
@@ -614,7 +614,16 @@ function configure_console_compute {
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
-        NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        if [ "$NOVNC_FROM_PACKAGE" == "True" ]; then
+            # Use the old URL when installing novnc packages.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        elif vercmp ${NOVNC_BRANCH} "<" "1.0.0"; then
+             # Use the old URL when installing older novnc source.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        else
+            # Use the new URL when building >=v1.0.0 from source.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_lite.html"}
+        fi
         iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
         iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
diff --git a/stackrc b/stackrc
index 53868f3d9d..2705c327fa 100644
--- a/stackrc
+++ b/stackrc
@@ -608,7 +608,7 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
+NOVNC_BRANCH=${NOVNC_BRANCH:-v1.0.0}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}

From c759706686abb421879148410adced34e44333f2 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 28 Feb 2019 11:20:36 +0000
Subject: [PATCH 2431/3333] support python 3 on centos 7

when installing with python 3.6 on centos7 pip installs
packages to /usr/local/bin as it does on new versions
of fedora.

this change updates the check to include centos

Change-Id: I7d16194d6ba1391ca31251d5b50cbb8de033fc38
---
 inc/python | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index ec7eb5b9bb..419d5c5701 100644
--- a/inc/python
+++ b/inc/python
@@ -49,7 +49,8 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if python3_enabled && [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
+    if python3_enabled && [[ "$os_VENDOR" == "CentOS" ]] || \
+    [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
         # Default Python 3 install prefix changed to /usr/local in Fedora 27:
         # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
         echo "/usr/local/bin"

From 36773b262e79c1eb66432cc19862f2097d94ec65 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 28 Feb 2019 17:30:47 -0500
Subject: [PATCH 2432/3333] Document the wonders of scale testing nova with the
 fake driver

Devstack has some little known variables for running nova
with the fake compute driver and running several nova-compute
services on a single host, which can be useful for testing
move operations and scale testing of controller services like
nova-api and nova-scheduler.

This adds documentation about the fake virt driver and related
variables and scaling considerations when using them.

Change-Id: Ic89d463d0f3f180b323edd6e2c8ff0404638ef07
---
 doc/source/guides/nova.rst | 66 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 0f105d7c58..65491d13e8 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -68,3 +68,69 @@ These config options are defined in `nova.conf.serial_console
 For more information on OpenStack configuration see the `OpenStack
 Compute Service Configuration Reference
 <https://docs.openstack.org/nova/latest/admin/configuration/index.html>`_
+
+
+Fake virt driver
+================
+
+Nova has a `fake virt driver`_ which can be used for scale testing the control
+plane services or testing "move" operations between fake compute nodes, for
+example cold/live migration, evacuate and unshelve.
+
+The fake virt driver does not communicate with any hypervisor, it just reports
+some fake resource inventory values and keeps track of the state of the
+"guests" created, moved and deleted. It is not feature-complete with the
+compute API but is good enough for most API testing, and is also used within
+the nova functional tests themselves so is fairly robust.
+
+.. _fake virt driver: http://git.openstack.org/cgit/openstack/nova/tree/nova/virt/fake.py
+
+Configuration
+-------------
+
+Set the following in your devstack ``local.conf``:
+
+.. code-block:: ini
+
+  [[local|localrc]]
+  VIRT_DRIVER=fake
+  NUMBER_FAKE_NOVA_COMPUTE=<number>
+
+The ``NUMBER_FAKE_NOVA_COMPUTE`` variable controls the number of fake
+``nova-compute`` services to run and defaults to 1.
+
+When ``VIRT_DRIVER=fake`` is used, devstack will disable quota checking in
+nova and neutron automatically. However, other services, like cinder, will
+still enforce quota limits by default.
+
+Scaling
+-------
+
+The actual value to use for ``NUMBER_FAKE_NOVA_COMPUTE`` depends on factors
+such as:
+
+* The size of the host (physical or virtualized) on which devstack is running.
+* The number of API workers. By default, devstack will run ``max($nproc/2, 2)``
+  workers per API service. If you are running several fake compute services on
+  a single host, then consider setting ``API_WORKERS=1`` in ``local.conf``.
+
+In addition, while quota will be disabled in neutron, there is no fake ML2
+backend for neutron so creating fake VMs will still result in real ports being
+created. To create servers without networking, you can specify ``--nic=none``
+when creating the server, for example:
+
+.. code-block:: shell
+
+  $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
+      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
+
+.. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
+          required to use ``--nic=none``.
+
+To avoid overhead from other services which you may not need, disable them in
+your ``local.conf``, for example:
+
+.. code-block:: ini
+
+  disable_service horizon
+  disable_service tempest

From 56946cfc5f88d8df3b4b9a1a2530ce2cc9a68cde Mon Sep 17 00:00:00 2001
From: Nate Johnston <nate.johnston@redhat.com>
Date: Mon, 12 Nov 2018 11:17:07 -0500
Subject: [PATCH 2433/3333] Replace deprecated brctl with ip commands

The bridge-utils package has been deprecated for some time now [1] and
'brctl' does not exist on some more recent distros like Fedora 28.
Replace references to brctl with the proper ip commands.

Calls to "brctl show" are not being replaced with calls to "bridge link"
because the output format is very different and in testing some bridges
were not listed.  So the simpler method of consulting /sys/class/net is
used.

In worlddump.py we try running both because failures are handled
gracefully by _dump_cmd(), as well as "ip link show type bridge" for
additional info.

[1] https://lwn.net/Articles/703776/ for example

Change-Id: Ie4c8ad6ce4a09c38023c9e4ec7834c249403145f
Partial-Bug: #1801919
---
 doc/source/guides/multinode-lab.rst   | 11 -----------
 lib/neutron_plugins/linuxbridge_agent | 16 +++++++++-------
 tools/worlddump.py                    |  2 ++
 3 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index b4e2891c10..05dd36edc0 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -369,17 +369,6 @@ To pull glance, OpenStack Image service, from an experimental fork:
 Notes stuff you might need to know
 ==================================
 
-Reset the Bridge
-----------------
-
-How to reset the bridge configuration:
-
-::
-
-    sudo brctl delif br100 eth0.926
-    sudo ip link set dev br100 down
-    sudo brctl delbr br100
-
 Set MySQL Password
 ------------------
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index f2302e37bf..fa3f86203d 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -8,21 +8,23 @@ _XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_lb_cleanup {
-    sudo ip link set $PUBLIC_BRIDGE down
-    sudo brctl delbr $PUBLIC_BRIDGE
+    sudo ip link delete $PUBLIC_BRIDGE
 
+    bridge_list=`ls /sys/class/net/*/bridge/bridge_id 2>/dev/null | cut -f5 -d/`
+    if [[ -z "$bridge_list" ]]; then
+        return
+    fi
     if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then
-        for port in $(sudo brctl show | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
+        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
             sudo ip link delete $port
         done
     elif [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vlan" ]]; then
-        for port in $(sudo brctl show | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
+        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
             sudo ip link delete $port
         done
     fi
-    for bridge in $(sudo brctl show |grep -o -e brq[0-9a-f\-]*); do
-        sudo ip link set $bridge down
-        sudo brctl delbr $bridge
+    for bridge in $(echo $bridge_list |grep -o -e brq[0-9a-f\-]*); do
+        sudo ip link delete $bridge
     done
 }
 
diff --git a/tools/worlddump.py b/tools/worlddump.py
index 750608210a..88af19d2e3 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -163,7 +163,9 @@ def _netns_list():
 def network_dump():
     _header("Network Dump")
 
+    _dump_cmd("bridge link")
     _dump_cmd("brctl show")
+    _dump_cmd("ip link show type bridge")
     ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)

From 5488336545ddc2dadadfae61a0367074cc16e5e2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 2 Mar 2019 06:14:21 +0000
Subject: [PATCH 2434/3333] Updated from generate-devstack-plugins-list

Change-Id: I3a9cbc9186b7555227f0ddef3da134e98b6cfc15
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9901c1ca39..ee278c7150 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -161,6 +161,7 @@ qinling                                `git://git.openstack.org/openstack/qinlin
 qinling-dashboard                      `git://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
+rsd-virt-for-nova                      `git://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
 scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__

From 8b003e0ed2f41fb1ab0007c969bba33c5701f625 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 4 Mar 2019 16:50:42 +1100
Subject: [PATCH 2435/3333] Switch GIT_BASE to https://

Infra are looking at implementing gitea for serving git, but this does
not have a git protocol handler ATM.  Switch GIT_BASE, and some
testing, to https:// to be in a better position to handle this.

Change-Id: I97a7b0de7b1ec2dd15d15c58699a631b09273df1
Story: #2004627
Task: #29701
---
 roles/write-devstack-local-conf/library/test.py | 14 +++++++-------
 stackrc                                         |  3 +--
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 88d404b856..45fae3da28 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -40,9 +40,9 @@ def test_plugins(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
-            ('baz', 'git://git.openstack.org/openstack/baz-plugin'),
+            ('bar', 'https://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'https://git.openstack.org/openstack/foo-plugin'),
+            ('baz', 'https://git.openstack.org/openstack/baz-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
@@ -94,8 +94,8 @@ def test_plugin_deps(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar-plugin', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo-plugin', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('bar-plugin', 'https://git.openstack.org/openstack/bar-plugin'),
+            ('foo-plugin', 'https://git.openstack.org/openstack/foo-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
@@ -227,8 +227,8 @@ def test_plugin_circular_deps(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('bar', 'https://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'https://git.openstack.org/openstack/foo-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
diff --git a/stackrc b/stackrc
index 53868f3d9d..652f2de0d5 100644
--- a/stackrc
+++ b/stackrc
@@ -237,8 +237,7 @@ WSGI_MODE=${WSGI_MODE:-"uwsgi"}
 # ------------
 
 # Base GIT Repo URL
-# Another option is https://git.openstack.org
-GIT_BASE=${GIT_BASE:-git://git.openstack.org}
+GIT_BASE=${GIT_BASE:-https://git.openstack.org}
 
 # The location of REQUIREMENTS once cloned
 REQUIREMENTS_DIR=$DEST/requirements

From 6509fd334e0956dc44870d19a80381578e3e3574 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 4 Mar 2019 17:26:20 +1100
Subject: [PATCH 2436/3333] Remove git:// openstack references

This updates various parts of documentation to use https, rather than
git, which is not implemented by gitea

Change-Id: I8d2a93128dcdaba0a00b43d18652781733f90cf0
Story: #2004627
Task: #29701
---
 README.rst                              |   2 +-
 doc/source/guides/neutron.rst           |   4 +-
 doc/source/plugin-registry.rst          | 352 ++++++++++++------------
 doc/source/plugins.rst                  |   4 +-
 tools/generate-devstack-plugins-list.sh |   4 +-
 5 files changed, 183 insertions(+), 183 deletions(-)

diff --git a/README.rst b/README.rst
index 6885546c94..ad7ede45c5 100644
--- a/README.rst
+++ b/README.rst
@@ -38,7 +38,7 @@ You can also pick specific OpenStack project releases by setting the appropriate
 `stackrc` for the default set).  Usually just before a release there will be
 milestone-proposed branches that need to be tested::
 
-    GLANCE_REPO=git://git.openstack.org/openstack/glance.git
+    GLANCE_REPO=https://git.openstack.org/openstack/glance.git
     GLANCE_BRANCH=milestone-proposed
 
 Start A Dev Cloud
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 12c6d6902d..80b2f85285 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -567,7 +567,7 @@ you do not require them.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
     Q_USE_PROVIDER_NETWORKING=True
 
-    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://git.openstack.org/openstack/neutron
 
     ## MacVTap agent options
     Q_AGENT=macvtap
@@ -622,7 +622,7 @@ For the MacVTap compute node, use this local.conf:
 
     # Services that a compute node runs
     disable_all_services
-    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://git.openstack.org/openstack/neutron
     ENABLED_SERVICES+=n-cpu,q-agt
 
     ## MacVTap agent options
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ee278c7150..9338d18819 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,182 +24,182 @@ official OpenStack projects.
 ====================================== ===
 Plugin Name                            URL
 ====================================== ===
-almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
-aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
-apmec                                  `git://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
-barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
-bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
-blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
-broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
-castellan-ui                           `git://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
-ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
-ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
-cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
-collectd-openstack-plugins             `git://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
-congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
-cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
-designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
-devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
-devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
-devstack-plugin-bdd                    `git://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
-devstack-plugin-ceph                   `git://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
-devstack-plugin-container              `git://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
-devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
-devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
-devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
-devstack-plugin-libvirt-qemu           `git://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
-devstack-plugin-mariadb                `git://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
-devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
-devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
-devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
-devstack-plugin-vmax                   `git://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
-devstack-plugin-zmq                    `git://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
-dragonflow                             `git://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
-drbd-devstack                          `git://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
-ec2-api                                `git://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
-freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
-freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
-freezer-tempest-plugin                 `git://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
-freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
-gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
-glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
-group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
-gyan                                   `git://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
-heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
-heat-dashboard                         `git://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
-horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
-ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
-ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
-ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
-ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
-karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
-karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
-keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
-kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
-kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
-kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
-magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
-magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
-manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
-manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
-masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
-meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
-meteos-ui                              `git://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
-mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
-mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
-mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
-mogan-ui                               `git://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
-monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
-monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
-monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
-monasca-events-api                     `git://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
-monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
-monasca-tempest-plugin                 `git://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
-monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
-murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
-networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
-networking-ansible                     `git://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
-networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
-networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
-networking-baremetal                   `git://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
-networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
-networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
-networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
-networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
-networking-cumulus                     `git://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
-networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
-networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
-networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
-networking-hpe                         `git://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
-networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
-networking-hyperv                      `git://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
-networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
-networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
-networking-lagopus                     `git://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
-networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
-networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
-networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
-networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
-networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
-networking-opencontrail                `git://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
-networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
-networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
-networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
-networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
-networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
-networking-spp                         `git://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
-networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
-networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
-neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
-neutron-classifier                     `git://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
-neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
-neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
-neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
-neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
-neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
-neutron-tempest-plugin                 `git://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
-neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-neutron-vpnaas-dashboard               `git://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
-nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
-nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
-nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
-nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
-oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
-octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
-octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
-omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
-openstacksdk                           `git://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
-os-faults                              `git://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
-os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
-osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
-oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
-panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
-patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
-picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
-qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
-qinling-dashboard                      `git://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
-rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
-rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
-rsd-virt-for-nova                      `git://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
-sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
-sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
-scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
-searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
-searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
-senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
-slogging                               `git://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
-solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
-stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
-storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
-stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
-stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
-stx-integ                              `git://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
-stx-metal                              `git://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
-stx-nfv                                `git://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
-stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
-tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
-tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
-tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
-tatu                                   `git://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
-telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
-tobiko                                 `git://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
-tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
-trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
-trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
-trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
-valet                                  `git://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
-vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
-vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
-vitrage-tempest-plugin                 `git://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
-vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
-vmware-vspc                            `git://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
-watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
-watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
-zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
-zaqar-ui                               `git://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
-zun                                    `git://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
-zun-ui                                 `git://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
+almanach                               `https://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
+aodh                                   `https://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
+apmec                                  `https://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
+barbican                               `https://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
+bilean                                 `https://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
+blazar                                 `https://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
+broadview-collector                    `https://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
+castellan-ui                           `https://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
+ceilometer                             `https://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
+ceilometer-powervm                     `https://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
+cloudkitty                             `https://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
+collectd-openstack-plugins             `https://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
+congress                               `https://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
+cyborg                                 `https://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
+designate                              `https://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
+devstack-plugin-additional-pkg-repos   `https://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
+devstack-plugin-amqp1                  `https://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
+devstack-plugin-bdd                    `https://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
+devstack-plugin-ceph                   `https://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
+devstack-plugin-container              `https://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
+devstack-plugin-glusterfs              `https://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
+devstack-plugin-hdfs                   `https://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
+devstack-plugin-kafka                  `https://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-libvirt-qemu           `https://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
+devstack-plugin-mariadb                `https://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
+devstack-plugin-nfs                    `https://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
+devstack-plugin-pika                   `https://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
+devstack-plugin-sheepdog               `https://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
+devstack-plugin-vmax                   `https://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
+devstack-plugin-zmq                    `https://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
+dragonflow                             `https://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
+drbd-devstack                          `https://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
+ec2-api                                `https://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
+freezer                                `https://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
+freezer-api                            `https://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
+freezer-tempest-plugin                 `https://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
+freezer-web-ui                         `https://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
+gce-api                                `https://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
+glare                                  `https://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
+group-based-policy                     `https://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+gyan                                   `https://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
+heat                                   `https://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
+heat-dashboard                         `https://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
+horizon-mellanox                       `https://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
+ironic                                 `https://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
+ironic-inspector                       `https://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
+ironic-staging-drivers                 `https://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
+ironic-ui                              `https://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
+karbor                                 `https://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
+karbor-dashboard                       `https://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
+keystone                               `https://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
+kingbird                               `https://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kuryr-kubernetes                       `https://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
+kuryr-libnetwork                       `https://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
+kuryr-tempest-plugin                   `https://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
+magnum                                 `https://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
+magnum-ui                              `https://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
+manila                                 `https://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+manila-ui                              `https://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
+masakari                               `https://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
+meteos                                 `https://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
+meteos-ui                              `https://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
+mistral                                `https://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+mixmatch                               `https://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
+mogan                                  `https://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
+mogan-ui                               `https://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
+monasca-analytics                      `https://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
+monasca-api                            `https://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+monasca-ceilometer                     `https://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
+monasca-events-api                     `https://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
+monasca-log-api                        `https://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
+monasca-tempest-plugin                 `https://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
+monasca-transform                      `https://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
+murano                                 `https://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
+networking-6wind                       `https://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-ansible                     `https://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
+networking-arista                      `https://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
+networking-bagpipe                     `https://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
+networking-baremetal                   `https://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
+networking-bgpvpn                      `https://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
+networking-brocade                     `https://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
+networking-calico                      `https://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
+networking-cisco                       `https://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-cumulus                     `https://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
+networking-dpm                         `https://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
+networking-fortinet                    `https://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
+networking-generic-switch              `https://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-hpe                         `https://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
+networking-huawei                      `https://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
+networking-hyperv                      `https://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
+networking-infoblox                    `https://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
+networking-l2gw                        `https://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
+networking-lagopus                     `https://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
+networking-midonet                     `https://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
+networking-mlnx                        `https://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
+networking-nec                         `https://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
+networking-odl                         `https://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
+networking-onos                        `https://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
+networking-opencontrail                `https://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
+networking-ovn                         `https://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
+networking-ovs-dpdk                    `https://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
+networking-plumgrid                    `https://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
+networking-powervm                     `https://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
+networking-sfc                         `https://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-spp                         `https://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
+networking-vpp                         `https://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
+networking-vsphere                     `https://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
+neutron                                `https://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-classifier                     `https://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
+neutron-dynamic-routing                `https://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
+neutron-fwaas                          `https://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
+neutron-fwaas-dashboard                `https://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
+neutron-lbaas                          `https://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
+neutron-lbaas-dashboard                `https://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
+neutron-tempest-plugin                 `https://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
+neutron-vpnaas                         `https://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+neutron-vpnaas-dashboard               `https://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
+nova-dpm                               `https://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
+nova-lxd                               `https://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
+nova-mksproxy                          `https://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
+nova-powervm                           `https://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
+oaktree                                `https://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
+octavia                                `https://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+octavia-dashboard                      `https://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
+omni                                   `https://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
+openstacksdk                           `https://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
+os-faults                              `https://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
+os-xenapi                              `https://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
+osprofiler                             `https://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+oswin-tempest-plugin                   `https://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
+panko                                  `https://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
+patrole                                `https://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
+picasso                                `https://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
+qinling                                `https://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
+qinling-dashboard                      `https://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
+rally                                  `https://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
+rally-openstack                        `https://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
+rsd-virt-for-nova                      `https://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
+sahara                                 `https://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
+sahara-dashboard                       `https://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
+scalpels                               `https://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
+searchlight                            `https://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
+searchlight-ui                         `https://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
+senlin                                 `https://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
+slogging                               `https://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
+solum                                  `https://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
+stackube                               `https://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
+storlets                               `https://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
+stx-config                             `https://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
+stx-fault                              `https://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-integ                              `https://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
+stx-metal                              `https://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
+stx-nfv                                `https://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
+stx-update                             `https://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
+tacker                                 `https://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
+tap-as-a-service                       `https://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
+tap-as-a-service-dashboard             `https://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
+tatu                                   `https://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
+telemetry-tempest-plugin               `https://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
+tobiko                                 `https://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
+tricircle                              `https://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
+trio2o                                 `https://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
+trove                                  `https://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
+trove-dashboard                        `https://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
+valet                                  `https://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
+vitrage                                `https://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
+vitrage-dashboard                      `https://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
+vitrage-tempest-plugin                 `https://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
+vmware-nsx                             `https://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
+vmware-vspc                            `https://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
+watcher                                `https://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
+watcher-dashboard                      `https://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
+zaqar                                  `https://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
+zaqar-ui                               `https://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
+zun                                    `https://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
+zun-ui                                 `https://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
 ====================================== ===
 
 
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index c69472955c..b1f2397454 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ They are added in the following format::
 
 An example would be as follows::
 
-  enable_plugin ec2-api git://git.openstack.org/openstack/ec2-api
+  enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api
 
 plugin.sh contract
 ==================
@@ -277,7 +277,7 @@ be needed in your ``jenkins/jobs/<project>.yaml`` definition in
   # note the actual url here is somewhat irrelevant because it
   # caches in nodepool, however make it a valid url for
   # documentation purposes.
-  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api git://git.openstack.org/openstack/ec2-api"
+  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api"
 
 See Also
 ========
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 95f13318b8..27c9c4118e 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -65,7 +65,7 @@ name_col_len=$(( name_col_len + 2 ))
 # ====================== ===
 # Plugin Name            URL
 # ====================== ===
-# foobar                 `git://... <http://...>`__
+# foobar                 `https://... <https://...>`__
 # ...
 
 printf "\n\n"
@@ -74,7 +74,7 @@ printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
 title_underline ${name_col_len}
 
 for plugin in ${sorted_plugins}; do
-    giturl="git://git.openstack.org/openstack/${plugin}"
+    giturl="https://git.openstack.org/openstack/${plugin}"
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done

From 363acd9d3d83af2ab088d84b069c1ffba2512e3b Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Mon, 4 Mar 2019 17:50:47 -0500
Subject: [PATCH 2437/3333] Cinder: install targetcli-fb for Bionic

The "targetcli" package no longer exists
in Bionic and has been superseded by
"targetcli-fb".

Change-Id: I99e4e8ad8fbb6e7c86571af8b0c222dafacf6447
---
 lib/cinder | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index d69b21efd0..48f3e45c55 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -434,7 +434,11 @@ function install_cinder {
     if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
         install_package tgt
     elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
-        install_package targetcli
+        if [[ ${DISTRO} == "bionic" ]]; then
+            install_package targetcli-fb
+        else
+            install_package targetcli
+        fi
     fi
 }
 

From 4eb455aa287155646f78a4621365b37f9df30793 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Fri, 22 Feb 2019 20:11:35 +0100
Subject: [PATCH 2438/3333] Capture the content of 'audit.log' file

On CentOS/ Fedora machines, this can be useful when QEMU silently fails
to start up due to SELinux denials.  For Debian-based machines, which
use AppAromor, DevStack already captures the output of 'kern.log' (via
`journalctl -t kernel` redirected into 'syslog.txt.gz').

Change-Id: I231b22664f0944b905e00568759785615a1d47c3
Acked-by: Clark Bolyan <clark.boylan@gmail.com>
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
---
 .zuul.yaml                                |  1 +
 roles/capture-system-logs/tasks/main.yaml | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index afe400e1a4..8ede2fce80 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -218,6 +218,7 @@
         '{{ stage_dir }}/core': logs
         '{{ stage_dir }}/listen53.txt': logs
         '{{ stage_dir }}/deprecations.log': logs
+        '{{ stage_dir }}/audit.log': logs
         /var/log/ceph: logs
         /var/log/openvswitch: logs
         /var/log/glusterfs: logs
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index de4f8eda08..905806d529 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -19,6 +19,17 @@
           rpm -qa | sort > {{ stage_dir }}/rpm-qa.txt
       fi
 
+      # NOTE(kchamart) The 'audit.log' can be useful in cases when QEMU
+      # failed to start due to denials from SELinux — useful for CentOS
+      # and Fedora machines.  For Ubuntu (which runs AppArmor), DevStack
+      # already captures the contents of /var/log/kern.log (via
+      # `journalctl -t kernel` redirected into syslog.txt.gz), which
+      # contains AppArmor-related messages.
+      if [ -f /var/log/audit/audit.log ] ; then
+          sudo cp /var/log/audit/audit.log {{stage_dir }}/audit.log &&
+          chmod +r {{ stage_dir }}/audit.log;
+      fi
+
       # gzip and save any coredumps in /var/core
       if [ -d /var/core ]; then
           sudo gzip -r /var/core

From 676957ffcff78e790134776f71035a3b14974896 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin034@gmail.com>
Date: Sun, 10 Mar 2019 14:55:48 +0000
Subject: [PATCH 2439/3333] Update etcd version to 3.3.12

The default version is 3.2.17 which seems to be too old.
Some external tools are not compatible with this old version.
For example, kubeadm cannot support external etcd version that is
older than 3.2.18.

This commit update the etcd version to 3.3.12 wich is the current
latest version.

Change-Id: Icfabbe580bb83a3babb98cc9fdbfb8eb388dc108
---
 stackrc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stackrc b/stackrc
index 53868f3d9d..d104beaa6c 100644
--- a/stackrc
+++ b/stackrc
@@ -737,10 +737,10 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.2.17}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"0a75e794502e2e76417b19da2807a9915fa58dcbf0985e397741d570f4f305cd"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"0ab4621c44c79d17d94e43bd184d0f23b763a3669056ce4ae2d0b2942410a98f"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"69e1279c4a2a52256b78d2a8dd23346ac46b836e678b971a459f2afaef3c275e"}
+ETCD_VERSION=${ETCD_VERSION:-v3.3.12}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"dc5d82df095dae0a2970e4d870b6929590689dd707ae3d33e7b86da0f7f211b6"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"170b848ac1a071fe7d495d404a868a2c0090750b2944f8a260ef1c6125b2b4f4"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"77f807b1b51abbf51e020bb05bdb8ce088cb58260fcd22749ea32eee710463d3"}
 # etcd v3.2.x doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture

From 610927f4255f0ed4877a3e85d628202e4af2f7d4 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 26 Feb 2019 18:39:51 +0100
Subject: [PATCH 2440/3333] zuul job: write the enable_plugin lines last

Plugins must be the last items in the local.conf file
otherwise the configuration set in the rest of the file
is not applied to them (for example a different value of DEST.)

Change-Id: Ia001badca179c3f3436d5ecd26b0755a3f3a3078
---
 .../library/devstack_local_conf.py                         | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index b1ad2dd4b4..1366a2274e 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -214,11 +214,14 @@ def __init__(self, localrc, localconf, base_services, services, plugins,
         self.base_dir = base_dir
         self.projects = projects
         self.project = project
-        if plugins:
-            self.handle_plugins(plugins)
         if services or base_services:
             self.handle_services(base_services, services or {})
         self.handle_localrc(localrc)
+        # Plugins must be the last items in localrc, otherwise
+        # the configuration lines which follows them in the file are
+        # not applied to the plugins (for example, the value of DEST.)
+        if plugins:
+            self.handle_plugins(plugins)
         if localconf:
             self.handle_localconf(localconf)
 

From 70d043dd6039fb55aa9d40d593839037bb8c43cf Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 12 Mar 2019 22:25:44 +0100
Subject: [PATCH 2441/3333] zuul: new variable to easily populate
 TEMPEST_PLUGINS

TEMPEST_PLUGINS contains the list of the tempest plugins installed
alongside tempest by lib/tempest.
If TEMPEST_PLUGINS is not explicitly set, the new tempest_plugins
variable is used to fill it by combining its items with
the base devstack path.

Change-Id: I9f1fa2755e16871ff9d6ba33fdeaf3023eedf8d4
---
 doc/source/zuul_ci_jobs_migration.rst         |  3 +-
 roles/write-devstack-local-conf/README.rst    |  9 ++
 .../library/devstack_local_conf.py            | 26 ++++-
 .../write-devstack-local-conf/library/test.py | 98 ++++++++++++-------
 .../write-devstack-local-conf/tasks/main.yaml |  3 +-
 5 files changed, 96 insertions(+), 43 deletions(-)

diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index c00f06e41a..633f951d3d 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -102,7 +102,6 @@ job.parent.
         tox_envlist: 'all'
         devstack_localrc:
           KURYR_K8S_API_PORT: 8080
-          TEMPEST_PLUGINS: '/opt/stack/kuryr-tempest-plugin'
         devstack_services:
           kubernetes-api: true
           kubernetes-controller-manager: true
@@ -114,6 +113,8 @@ job.parent.
           kuryr-kubernetes: https://git.openstack.org/openstack/kuryr
           devstack-plugin-container: https://git.openstack.org/openstack/devstack-plugin-container
           neutron-lbaas: https://git.openstack.org/openstack/neutron-lbaas
+        tempest_plugins:
+          - kuryr-tempest-plugin
         (...)
 
 Job variables
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index e9739cdea8..d0a51e77c2 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -88,3 +88,12 @@ Write the local.conf file for use by devstack
    If a plugin declares a dependency on another plugin (via
    ``plugin_requires`` in the plugin's settings file), this role will
    automatically emit ``enable_plugin`` lines in the correct order.
+
+.. zuul:rolevar:: tempest_plugins
+   :type: list
+
+   A list of tempest plugins which are installed alongside tempest.
+
+   The list of values will be combined with the base devstack directory
+   and used to populate the ``TEMPEST_PLUGINS`` variable. If the variable
+   already exists, its value is *not* changed.
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 1366a2274e..8df8dea6dd 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -207,13 +207,15 @@ def getPlugins(self):
 class LocalConf(object):
 
     def __init__(self, localrc, localconf, base_services, services, plugins,
-                 base_dir, projects, project):
+                 base_dir, projects, project, tempest_plugins):
         self.localrc = []
+        self.warnings = []
         self.meta_sections = {}
         self.plugin_deps = {}
         self.base_dir = base_dir
         self.projects = projects
         self.project = project
+        self.tempest_plugins = tempest_plugins
         if services or base_services:
             self.handle_services(base_services, services or {})
         self.handle_localrc(localrc)
@@ -246,12 +248,15 @@ def handle_services(self, base_services, services):
 
     def handle_localrc(self, localrc):
         lfg = False
+        tp = False
         if localrc:
             vg = VarGraph(localrc)
             for k, v in vg.getVars():
                 self.localrc.append('{}={}'.format(k, v))
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
+                elif k == 'TEMPEST_PLUGINS':
+                    tp = True
 
         if not lfg and (self.projects or self.project):
             required_projects = []
@@ -266,6 +271,19 @@ def handle_localrc(self, localrc):
                 self.localrc.append('LIBS_FROM_GIT={}'.format(
                     ','.join(required_projects)))
 
+        if self.tempest_plugins:
+            if not tp:
+                tp_dirs = []
+                for tempest_plugin in self.tempest_plugins:
+                    tp_dirs.append(os.path.join(self.base_dir, tempest_plugin))
+                self.localrc.append('TEMPEST_PLUGINS="{}"'.format(
+                        ' '.join(tp_dirs)))
+            else:
+                self.warnings.append('TEMPEST_PLUGINS already defined ({}),'
+                                     'requested value {} ignored'.format(
+                                         tp, self.tempest_plugins))
+
+
     def handle_localconf(self, localconf):
         for phase, phase_data in localconf.items():
             for fn, fn_data in phase_data.items():
@@ -300,6 +318,7 @@ def main():
             path=dict(type='str'),
             projects=dict(type='dict'),
             project=dict(type='dict'),
+            tempest_plugins=dict(type='list'),
         )
     )
 
@@ -311,10 +330,11 @@ def main():
                    p.get('plugins'),
                    p.get('base_dir'),
                    p.get('projects'),
-                   p.get('project'))
+                   p.get('project'),
+                   p.get('tempest_plugins'))
     lc.write(p['path'])
 
-    module.exit_json()
+    module.exit_json(warnings=lc.warnings)
 
 
 try:
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 88d404b856..377c6930b8 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -23,6 +23,20 @@
 from collections import OrderedDict
 
 class TestDevstackLocalConf(unittest.TestCase):
+
+    @staticmethod
+    def _init_localconf(p):
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'),
+                       p.get('projects'),
+                       p.get('project'),
+                       p.get('tempest_plugins'))
+        return lc
+
     def setUp(self):
         self.tmpdir = tempfile.mkdtemp()
 
@@ -51,14 +65,7 @@ def test_plugins(self):
                  plugins=plugins,
                  base_dir='./test',
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         plugins = []
@@ -104,14 +111,7 @@ def test_plugin_deps(self):
                  plugins=plugins,
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         plugins = []
@@ -145,14 +145,7 @@ def test_libs_from_git(self):
                  path=os.path.join(self.tmpdir, 'test.local.conf'),
                  projects=projects,
                  project=project)
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         lfg = None
@@ -184,14 +177,7 @@ def test_overridelibs_from_git(self):
                  base_dir='./test',
                  path=os.path.join(self.tmpdir, 'test.local.conf'),
                  projects=projects)
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         lfg = None
@@ -238,14 +224,50 @@ def test_plugin_circular_deps(self):
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
         with self.assertRaises(Exception):
-            lc = LocalConf(p.get('localrc'),
-                           p.get('local_conf'),
-                           p.get('base_services'),
-                           p.get('services'),
-                           p.get('plugins'),
-                           p.get('base_dir'))
+            lc = self._init_localconf(p)
             lc.write(p['path'])
 
+    def _find_tempest_plugins_value(self, file_path):
+        tp = None
+        with open(file_path) as f:
+            for line in f:
+                if line.startswith('TEMPEST_PLUGINS'):
+                    found = line.strip().split('=')[1]
+                    self.assertIsNone(tp,
+                        "TEMPEST_PLUGIN ({}) found again ({})".format(
+                            tp, found))
+                    tp = found
+        return tp
+
+    def test_tempest_plugins(self):
+        "Test that TEMPEST_PLUGINS is correctly populated."
+        p = dict(base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 tempest_plugins=['heat-tempest-plugin', 'sahara-tests'])
+        lc = self._init_localconf(p)
+        lc.write(p['path'])
+
+        tp = self._find_tempest_plugins_value(p['path'])
+        self.assertEqual('"./test/heat-tempest-plugin ./test/sahara-tests"', tp)
+        self.assertEqual(len(lc.warnings), 0)
+
+    def test_tempest_plugins_not_overridden(self):
+        """Test that the existing value of TEMPEST_PLUGINS is not overridden
+        by the user-provided value, but a warning is emitted."""
+        localrc = {'TEMPEST_PLUGINS': 'someplugin'}
+        p = dict(localrc=localrc,
+                 base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 tempest_plugins=['heat-tempest-plugin', 'sahara-tests'])
+        lc = self._init_localconf(p)
+        lc.write(p['path'])
+
+        tp = self._find_tempest_plugins_value(p['path'])
+        self.assertEqual('someplugin', tp)
+        self.assertEqual(len(lc.warnings), 1)
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index 9a6b083a2f..bfd086034b 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -10,4 +10,5 @@
     local_conf: "{{ devstack_local_conf|default(omit) }}"
     base_dir: "{{ devstack_base_dir|default(omit) }}"
     projects: "{{ zuul.projects }}"
-    project: "{{ zuul.project }}"
\ No newline at end of file
+    project: "{{ zuul.project }}"
+    tempest_plugins: "{{ tempest_plugins|default(omit) }}"

From deadc7c439f1126ba986b9c4f3c4d0b6d7774016 Mon Sep 17 00:00:00 2001
From: whoami-rajat <rajatdhasmana@gmail.com>
Date: Thu, 14 Mar 2019 11:01:18 +0530
Subject: [PATCH 2442/3333] Fix : sort variables fetched from env list

In bionic, when exporting env variables, the env list displays
variables in unsorted format.
While fetching we are getting 'https_proxy' before 'http_proxy'
which is failing in comparison to our expected values[1].
This patch sorts the variables fetched from env.

[1] http://logs.openstack.org/30/643130/3/check/devstack-unit-tests/effbf7a/job-output.txt.gz#_2019-03-13_23_12_35_465026

Change-Id: Ie504eabf0d3fec1b97bc711e2702c06bcf75d158
---
 tests/test_functions.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index adf20cdb80..08143d2a68 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -272,7 +272,7 @@ function test_export_proxy_variables {
 
     export_proxy_variables
     expected=$(echo -e "http_proxy=$http_proxy\nhttps_proxy=$https_proxy\nno_proxy=$no_proxy")
-    results=$(env | egrep '(http(s)?|no)_proxy=')
+    results=$(env | egrep '(http(s)?|no)_proxy=' | sort)
     if [[ $expected = $results ]]; then
         passed "OK: Proxy variables are exported when proxy variables are set"
     else

From f28c75f87abdda00dcfc2f673816728676313c95 Mon Sep 17 00:00:00 2001
From: whoami-rajat <rajatdhasmana@gmail.com>
Date: Wed, 13 Mar 2019 23:41:05 +0530
Subject: [PATCH 2443/3333] Cinder: create target directory for targetcli-fb
 package

While installing 'targetcli-fb' on bionic, a dependent package
'python-rtslib-fb' requires (but doesn't create) /etc/target
and fails[1] when this directory not found.
This patch creates the required directory.

[1] http://logs.openstack.org/26/641926/1/check/cinder-tempest-dsvm-lvm-lio-barbican/8f95df1/logs/devstacklog.txt.gz#_2019-03-13_03_36_44_623

Related-bug: #1819819
Change-Id: I7efefead873037da4aaacbdc6284458bdaad0f6b
---
 lib/cinder | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 48f3e45c55..047b25b3c5 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -435,6 +435,9 @@ function install_cinder {
         install_package tgt
     elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
         if [[ ${DISTRO} == "bionic" ]]; then
+            # TODO(frickler): Workaround for https://launchpad.net/bugs/1819819
+            sudo mkdir -p /etc/target
+
             install_package targetcli-fb
         else
             install_package targetcli

From bcd8a50cc688ee39b4b998efe959e35c4c5b1408 Mon Sep 17 00:00:00 2001
From: Vlad Gridin <vladyslav.gridin@nuagenetworks.net>
Date: Thu, 14 Mar 2019 14:40:55 +0100
Subject: [PATCH 2444/3333] Fix installing tempest plugins

When running stack.sh locally on stable branches
with tempest enabled and TEMPEST_PLUGINS set,
devstack will try to fetch master branch of requirements
and that fails if branch is not tracked.

Change-Id: Ia1ae6869a8fede2af5cd7c875e0946b6a75eb518
Closes-Bug: #1820051
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 1e344c8567..0e8bfe7404 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -674,7 +674,7 @@ function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
-        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
+        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
         tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins

From ddb6179b0479ea9478cf2a146fe9b0d7592acaec Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 19 Mar 2019 15:04:12 -0400
Subject: [PATCH 2445/3333] Ease python 3 classifier check in
 check_python3_support_for_package_local

This makes the grep match in check_python3_support_for_package_local
the same as check_python3_support_for_package_remote.

Change I0349de2026c49279ba7f262d5e86d37018d66326 in grenade started
setting the PYTHON3_VERSION variable, and then we recently started
using bionic nodes everywhere which means we're running python 3.6.

The etcd3gw package has a python 3 and 3.5 classifier, but not 3.6:

https://pypi.org/project/etcd3gw/

The pip_install function code that is dealing with installing py3
packages is hitting a problem installing etcd3gw if the package is
local because of the more restrictive grep in the
check_python3_support_for_package_local function, and since
PYTHON3_VERSION=3.6 now, we don't install from py3 and install
etcd3gw on python 2.7 which makes services like cinder-volume and
cinder-backup, which use etcd3gw, fail when they are running under
python 3 (they get module import errors).

This simply removes the $ restriction on the grep. Looking at the
change that added those local/remote functions:

  I243ea4b76f0d5ef57a03b5b0798a05468ee6de9b

There is no explanation for the difference, it just said:

  Also, since not many packages are classified correctly, fallback
  to looking for just "Programming Language :: Python :: 3" and
  log a message for the package to highlight the problem.

So that's what this change does.

Note that alternatives would be:

1. Update the etcd3gw package to add the 3.6 classifier and do
   a release (this should probably happen anyway).

2. Add etcd3gw to ENABLED_PYTHON3_PACKAGES but that would be a
   short-term hack workaround.

Change-Id: Icd3768870ba0f1659bb2e6f002043d975047b73e
Closes-Bug: #1820892
---
 inc/python | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 419d5c5701..0926330fdf 100644
--- a/inc/python
+++ b/inc/python
@@ -101,7 +101,7 @@ function check_python3_support_for_package_local {
     cd $name
     set +e
     classifier=$(python setup.py --classifiers \
-        | grep 'Programming Language :: Python :: 3$')
+        | grep 'Programming Language :: Python :: 3')
     set -e
     echo $classifier
 }
@@ -297,6 +297,8 @@ function pip_install {
                             echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on local package settings"
                             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                             cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                        else
+                            echo "WARNING: Did not find python 3 classifier for local package $package_dir"
                         fi
                     fi
                 else
@@ -307,6 +309,8 @@ function pip_install {
                         echo "Automatically using $PYTHON3_VERSION version to install $package based on remote package settings"
                         sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                    else
+                        echo "WARNING: Did not find python 3 classifier for remote package $package_dir"
                     fi
                 fi
             fi

From 245445b1bd35e580259f4decd9b0b047fe728794 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Thu, 21 Mar 2019 11:40:17 -0400
Subject: [PATCH 2446/3333] Use L3RouterPlugin alias

The 'router' alias for the L3RouterPlugin has been in
setup.cfg for a while, let's use it.

Change-Id: Ifa196bd33959f1425df9a34cdab4acf4c3b8071b
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c5a4c02cc5..127d46bcd7 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -44,7 +44,7 @@ fi
 # L3 Plugin to load for ML2
 # For some flat network environment, they not want to extend L3 plugin.
 # Make sure it is able to set empty to ML2_L3_PLUGIN.
-ML2_L3_PLUGIN=${ML2_L3_PLUGIN-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
+ML2_L3_PLUGIN=${ML2_L3_PLUGIN-router}
 
 function populate_ml2_config {
     CONF=$1

From a30dd1cc96a75d565ae924e4698c4208150e5564 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Thu, 14 Mar 2019 13:19:36 +0200
Subject: [PATCH 2447/3333] Fixed support python 2 on Fedora 27

I7d16194d6ba1391ca31251d5b50cbb8de033fc38 added wrong behavour
on Fedora > 26 and Centos 7 when python3 disabled
pip should install packages in /usr/bin

Closes-Bug: #1820070
Change-Id: I3a8efbc8eb6e311db9c7347577c5d2047ba523a9
---
 inc/python | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/inc/python b/inc/python
index 419d5c5701..ba2048dd84 100644
--- a/inc/python
+++ b/inc/python
@@ -49,16 +49,9 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if python3_enabled && [[ "$os_VENDOR" == "CentOS" ]] || \
-    [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
-        # Default Python 3 install prefix changed to /usr/local in Fedora 27:
-        # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-        echo "/usr/local/bin"
-    elif is_fedora || is_suse; then
-        echo "/usr/bin"
-    else
-        echo "/usr/local/bin"
-    fi
+    local PYTHON_PATH=/usr/local/bin
+    ( is_fedora && ! python3_enabled ) || is_suse && PYTHON_PATH=/usr/bin
+    echo $PYTHON_PATH
 }
 
 # Wrapper for ``pip install`` that only installs versions of libraries

From e2853bf2d0a2e63d53d0f2d0cb21fd406f6289b0 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 13 Mar 2019 13:16:51 +0000
Subject: [PATCH 2448/3333] Set ownership of /etc/pki/<console> files for TLS

OpenSSL 1.0.2 generates key files with default permissions: 644 and the
files are copied to the /etc/pki/* directories with sudo.

When the default CI node Ubuntu version was changed from Xenial =>
Bionic we changed from OpenSSL 1.0.2 => 1.1.0. And OpenSSL 1.1.0
generates key files with default permissions: 600. When we copy the key
file to /etc/pki/* using sudo, it becomes owned by root and then the
console-related users are unable to read it.

This sets the ownership of the /etc/pki/<console> files to the
user:group intended to read them.

Closes-Bug: #1819794

Change-Id: I437a46c875cf633272e8cad0811e5557f2ac3641
---
 lib/nova                           | 16 ++++++++++++++++
 lib/nova_plugins/functions-libvirt |  8 +++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 033ebf3697..137a249c65 100644
--- a/lib/nova
+++ b/lib/nova
@@ -665,6 +665,22 @@ function configure_console_proxies {
             sudo mkdir -p /etc/pki/nova-novnc
             deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
             deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
+            # OpenSSL 1.1.0 generates the key file with permissions: 600, by
+            # default, and the deploy_int* methods use 'sudo cp' to copy the
+            # files, making them owned by root:root.
+            # Change ownership of everything under /etc/pki/nova-novnc to
+            # $STACK_USER:$(id -g ${STACK_USER}) so that $STACK_USER can read
+            # the key file.
+            sudo chown -R $STACK_USER:$(id -g ${STACK_USER}) /etc/pki/nova-novnc
+            # This is needed to enable TLS in the proxy itself, example log:
+            # WebSocket server settings:
+            #   - Listen on 0.0.0.0:6080
+            #   - Flash security policy server
+            #   - Web server (no directory listings). Web root: /usr/share/novnc
+            #   - SSL/TLS support
+            #   - proxying from 0.0.0.0:6080 to None:None
+            iniset $conf DEFAULT key "/etc/pki/nova-novnc/client-key.pem"
+            iniset $conf DEFAULT cert "/etc/pki/nova-novnc/client-cert.pem"
         fi
     fi
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index fcb4777997..463986944f 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -155,9 +155,15 @@ EOF
             echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
 
             sudo mkdir -p /etc/pki/libvirt-vnc
-            sudo chown libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
             deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
             deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
+            # OpenSSL 1.1.0 generates the key file with permissions: 600, by
+            # default and the deploy_int* methods use 'sudo cp' to copy the
+            # files, making them owned by root:root.
+            # Change ownership of everything under /etc/pki/libvirt-vnc to
+            # libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
+            # file.
+            sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
         fi
     fi
 

From 315bc13595bf1ebae205f462fc6078f9fc3c840b Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 26 Mar 2019 18:47:06 +0000
Subject: [PATCH 2449/3333] Update DEVSTACK_SERIES to train

stable/stein branch has been created now and
current master is for train.

Change-Id: I119f0388891db44c9753e49cedfeb32c74f2a40d
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index c6304bba94..2924d3956c 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="stein"
+DEVSTACK_SERIES="train"
 
 ##############
 #

From e769348882ea3e6b4465e3a6af72029633b2485e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:26:03 +1100
Subject: [PATCH 2450/3333] Quote devstack_localrc arguments

If you have

 devstack_localrc:
   ARGUMENT: "argument with spaces"

The quotes get lost during YAML processing and the resulting file has

  ARGUMENT=argument with spaces

which is a shell error.

Quote all arguments to avoid this sort of thing.

Change-Id: Ia63a53d745dfea7262bcdb5d46425f431c3ccfe5
---
 .../write-devstack-local-conf/library/devstack_local_conf.py  | 2 +-
 roles/write-devstack-local-conf/library/test.py               | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 8df8dea6dd..3a8cd588b9 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -252,7 +252,7 @@ def handle_localrc(self, localrc):
         if localrc:
             vg = VarGraph(localrc)
             for k, v in vg.getVars():
-                self.localrc.append('{}={}'.format(k, v))
+                self.localrc.append('{}="{}"'.format(k, v))
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
                 elif k == 'TEMPEST_PLUGINS':
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 2900949105..22bf2da55d 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -185,7 +185,7 @@ def test_overridelibs_from_git(self):
             for line in f:
                 if line.startswith('LIBS_FROM_GIT'):
                     lfg = line.strip().split('=')[1]
-        self.assertEqual('oslo.db', lfg)
+        self.assertEqual('"oslo.db"', lfg)
 
     def test_plugin_circular_deps(self):
         "Test that plugins with circular dependencies fail"
@@ -265,7 +265,7 @@ def test_tempest_plugins_not_overridden(self):
         lc.write(p['path'])
 
         tp = self._find_tempest_plugins_value(p['path'])
-        self.assertEqual('someplugin', tp)
+        self.assertEqual('"someplugin"', tp)
         self.assertEqual(len(lc.warnings), 1)
 
 

From 59ce1d902e2137bb7346a0d1f223e0ce1cb83216 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:27:10 +1100
Subject: [PATCH 2451/3333] Export all journal logs

Currently we only export the devstack@ services, and then separately
export the kernel & sudo logs to syslog.txt.

This leaves a lot of logs potentially behind in the journal for
various daemons.  Just export the whole lot.

Using this output is currently very opaque and makes use of systemd
export tools that are very un-discoverable.  Add a README that will
appear alongside the journal explaining how to actually use it.  This
is a template as it would be nice to put into things like the list of
services that are in the journal, or maybe other magic.

Also make sure we export the logs since the start timestamp; currently
during a full run we drop the initial logs.

Change-Id: Id2626f9113d82c6d524039acda8a8ec74afb2081
---
 roles/export-devstack-journal/README.rst      | 14 +++---
 roles/export-devstack-journal/tasks/main.yaml | 45 +++++++++++++------
 .../templates/devstack.journal.README.txt.j2  | 33 ++++++++++++++
 3 files changed, 73 insertions(+), 19 deletions(-)
 create mode 100644 roles/export-devstack-journal/templates/devstack.journal.README.txt.j2

diff --git a/roles/export-devstack-journal/README.rst b/roles/export-devstack-journal/README.rst
index a34e0706a9..9e3c919627 100644
--- a/roles/export-devstack-journal/README.rst
+++ b/roles/export-devstack-journal/README.rst
@@ -1,11 +1,15 @@
 Export journal files from devstack services
 
-Export the systemd journal for every devstack service in native
-journal format as well as text.  Also, export a syslog-style file with
-kernal and sudo messages.
+This performs a number of logging collection services
 
-Writes the output to the ``logs/`` subdirectory of
-``stage_dir``.
+* Export the systemd journal in native format
+* For every devstack service, export logs to text in a file named
+  ``screen-*`` to maintain legacy compatability when devstack services
+  used to run in a screen session and were logged separately.
+* Export a syslog-style file with kernel and sudo messages for legacy
+  compatability.
+
+Writes the output to the ``logs/`` subdirectory of ``stage_dir``.
 
 **Role Variables**
 
diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index 6e760c1f6f..cbec4447b8 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -6,32 +6,49 @@
     state: directory
     owner: "{{ ansible_user }}"
 
-# TODO: convert this to ansible
-- name: Export journal files
+- name: Export legacy stack screen log files
   become: true
   shell:
     cmd: |
       u=""
       name=""
-      for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
+      for u in $(systemctl list-unit-files | grep devstack | awk '{print $1}'); do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
         journalctl -o short-precise --unit $u | gzip - > {{ stage_dir }}/logs/$name.txt.gz
       done
 
-      # Export the journal in export format to make it downloadable
-      # for later searching. It can then be rewritten to a journal native
-      # format locally using systemd-journal-remote. This makes a class of
-      # debugging much easier. We don't do the native conversion here as
-      # some distros do not package that tooling.
-      journalctl -u 'devstack@*' -o export | \
-          xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
-
-      # The journal contains everything running under systemd, we'll
-      # build an old school version of the syslog with just the
-      # kernel and sudo messages.
+- name: Export legacy syslog.txt
+  become: true
+  shell:
+    # The journal contains everything running under systemd, we'll
+    # build an old school version of the syslog with just the
+    # kernel and sudo messages.
+    cmd: |
       journalctl \
           -t kernel \
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
         | gzip - > {{ stage_dir }}/logs/syslog.txt.gz
+
+# TODO: convert this to ansible
+#  - make a list of the above units
+#  - iterate the list here
+- name: Export journal
+  become: true
+  shell:
+    # Export the journal in export format to make it downloadable
+    # for later searching. It can then be rewritten to a journal native
+    # format locally using systemd-journal-remote. This makes a class of
+    # debugging much easier. We don't do the native conversion here as
+    # some distros do not package that tooling.
+    cmd: |
+      journalctl -o export \
+          --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
+        | xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
+
+- name: Save journal README
+  become: true
+  template:
+    src: devstack.journal.README.txt.j2
+    dest: '{{ stage_dir }}/logs/devstack.journal.README.txt'
diff --git a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2 b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
new file mode 100644
index 0000000000..598eb7f3db
--- /dev/null
+++ b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
@@ -0,0 +1,33 @@
+Devstack systemd journal
+========================
+
+The devstack.journal file is a copy of the systemd journal during the
+devstack run.
+
+To use it, you will need to convert it so journalctl can read it
+locally.  After downloading the file:
+
+ $ /lib/systemd/systemd-journal-remote <(xzcat ./devstack.journal.xz) -o output.journal
+
+Note this binary is not in the regular path.  On Debian/Ubuntu
+platforms, you will need to have the "sytemd-journal-remote" package
+installed.
+
+It should result in something like:
+
+ Finishing after writing <large number> entries
+
+You can then use journalctl to examine this file.  For example, to see
+all devstack services try:
+
+ $ journalctl --file ./output.journal -u 'devstack@*'
+
+To see just cinder API server logs restrict the match with
+
+ $ journalctl --file ./output.journal -u 'devstack@c-api'
+
+There may be many types of logs available in the journal, a command like
+
+ $ journalctl --file ./output.journal --output=json-pretty | grep "_SYSTEMD_UNIT" | sort -u
+
+can help you find interesting things to filter on.
\ No newline at end of file

From 2bbc9bbbb8616711a0a52540f9a35d4394f0d0ad Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:25:38 +1100
Subject: [PATCH 2452/3333] Add service to tcpdump during run

This adds a service to run a tcpdump during the run.  This can be
useful to capture various network traffic for post analysis.

There didn't seem to quite be an appropriate place to document it, so
a new debugging file is started, with some terse explaination of our
various system-wide debugging services.

Change-Id: I09aaa57611c5047d09a9bce7932d34e9d50b30e6
---
 .zuul.yaml               |  1 +
 doc/source/debugging.rst | 46 ++++++++++++++++++++++++++++++++++++++++
 lib/tcpdump              | 43 +++++++++++++++++++++++++++++++++++++
 stack.sh                 |  7 ++++++
 4 files changed, 97 insertions(+)
 create mode 100644 doc/source/debugging.rst
 create mode 100644 lib/tcpdump

diff --git a/.zuul.yaml b/.zuul.yaml
index 7ee759818e..62e875350d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -232,6 +232,7 @@
         '{{ devstack_log_dir }}/dstat-csv.log': logs
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
+        '{{ devstack_log_dir }}/tcpdump.pcap': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
         '{{ stage_dir }}/apache': logs
diff --git a/doc/source/debugging.rst b/doc/source/debugging.rst
new file mode 100644
index 0000000000..fd0d9cdf74
--- /dev/null
+++ b/doc/source/debugging.rst
@@ -0,0 +1,46 @@
+=====================
+System-wide debugging
+=====================
+
+A lot can go wrong during a devstack run, and there are a few inbuilt
+tools to help you.
+
+dstat
+-----
+
+Enable the ``dstat`` service to produce performance logs during the
+devstack run.  These will be logged to the journal and also as a CSV
+file.
+
+memory_tracker
+--------------
+
+The ``memory_tracker`` service periodically monitors RAM usage and
+provides consumption output when available memory is seen to be
+falling (i.e. processes are consuming memory).  It also provides
+output showing locked (unswappable) memory.
+
+tcpdump
+-------
+
+Enable the ``tcpdump`` service to run a background tcpdump.  You must
+set the ``TCPDUMP_ARGS`` variable to something suitable (there is no
+default).  For example, to trace iSCSI communication during a job in
+the OpenStack gate and copy the result into the log output, you might
+use:
+
+.. code-block:: yaml
+
+   job:
+     name: devstack-job
+     parent: devstack
+     vars:
+       devstack_services:
+         tcpdump: true
+       devstack_localrc:
+         TCPDUMP_ARGS: "-i any tcp port 3260"
+       zuul_copy_output:
+         '{{ devstack_log_dir }}/tcpdump.pcap': logs
+
+
+
diff --git a/lib/tcpdump b/lib/tcpdump
new file mode 100644
index 0000000000..16e8269d02
--- /dev/null
+++ b/lib/tcpdump
@@ -0,0 +1,43 @@
+#!/bin/bash
+#
+# lib/tcpdump
+# Functions to start and stop a tcpdump
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - start_tcpdump
+# - stop_tcpdump
+
+# Save trace setting
+_XTRACE_TCPDUMP=$(set +o | grep xtrace)
+set +o xtrace
+
+TCPDUMP_OUTPUT=${TCPDUMP_OUTPUT:-$LOGDIR/tcpdump.pcap}
+
+# e.g. for iscsi
+#  "-i any tcp port 3260"
+TCPDUMP_ARGS=${TCPDUMP_ARGS:-""}
+
+# start_tcpdump() - Start running processes
+function start_tcpdump {
+    # Run a tcpdump with given arguments and save the packet capture
+    if is_service_enabled tcpdump; then
+        if [[ -z "${TCPDUMP_ARGS}" ]]; then
+            die $LINENO "The tcpdump service requires TCPDUMP_ARGS to be set"
+        fi
+        touch ${TCPDUMP_OUTPUT}
+        run_process tcpdump "/usr/sbin/tcpdump -w $TCPDUMP_OUTPUT $TCPDUMP_ARGS" root root
+    fi
+}
+
+# stop_tcpdump() stop tcpdump process
+function stop_tcpdump {
+    stop_process tcpdump
+}
+
+# Restore xtrace
+$_XTRACE_TCPDUMP
diff --git a/stack.sh b/stack.sh
index 022d5b9438..dfc9d24f51 100755
--- a/stack.sh
+++ b/stack.sh
@@ -614,6 +614,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 
 # Extras Source
@@ -1053,6 +1054,12 @@ fi
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+# Run a background tcpdump for debugging
+# Note: must set TCPDUMP_ARGS with the enabled service
+if is_service_enabled tcpdump; then
+    start_tcpdump
+fi
+
 # Etcd
 # -----
 

From 8213d7c03990c8134cbe12bb6c7dac32bb7a0c50 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:28:15 +1100
Subject: [PATCH 2453/3333] Add ISCSI_DEBUG option

This option adds a systemd override to start the iscsi daemon with
debugging enabled.

Change-Id: Ie27991776aa07a695026036e47513221220332a0
---
 lib/nova | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 7c6f8cd465..dee798cd5e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -183,6 +183,10 @@ TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 # and Glance.
 NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 
+# Enable debugging levels for iscsid service (goes from 0-8)
+ISCSID_DEBUG=$(trueorfalse False ISCSID_DEBUG)
+ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
+
 # Functions
 # ---------
 
@@ -327,8 +331,22 @@ function configure_nova {
                 sudo chown -R $STACK_USER $NOVA_INSTANCES_PATH
             fi
         fi
+
+        if [[ ${ISCSID_DEBUG} == "True" ]]; then
+            # Install an override that starts iscsid with debugging
+            # enabled.
+            cat > /tmp/iscsid.override <<EOF
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/iscsid -d${ISCSID_DEBUG_LEVEL}
+EOF
+            sudo mkdir -p /etc/systemd/system/iscsid.service.d
+            sudo mv /tmp/iscsid.override /etc/systemd/system/iscsid.service.d/override.conf
+            sudo systemctl daemon-reload
+        fi
+
         # ensure that iscsid is started, even when disabled by default
-        start_service iscsid
+        restart_service iscsid
     fi
 
     # Rebuild the config file from scratch

From 1124a055711c01ad61da8063de47eed9d9acffeb Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 13:35:43 +1100
Subject: [PATCH 2454/3333] Handle pcp-dstat transition

dstat is Python 2, never going to be updated and effectively
abandonded.  The replacement is pcp-dstat [1] which is mostly
compatible, with a few differences.  As distro start transitioning
(Fedora has), just drop the unsupported args for now.

[1] https://pcp.io/man/man1/pcp-dstat.1.html

Change-Id: Ibec8a37cb18a14656d97e2096c66bc8b21406068
---
 tools/dstat.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 01c6d9b7e9..e6cbb0f21c 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -12,8 +12,17 @@
 # Retrieve log directory as argument from calling script.
 LOGDIR=$1
 
+DSTAT_TOP_OPTS="--top-cpu-adv --top-io-adv --top-mem"
+if dstat --version | grep -q 'pcp-dstat' ; then
+    # dstat is unmaintained, and moving to a plugin of performance
+    # co-pilot.  Fedora 29 for example has rolled this out.  It's
+    # mostly compatible, except for a few options which are not
+    # implemented (yet?)
+    DSTAT_TOP_OPTS=""
+fi
+
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap --tcp"
+DSTAT_OPTS="-tcmndrylpg ${DSTAT_TOP_OPTS} --swap --tcp"
 
 # Command-line arguments for secondary background DStat process.
 DSTAT_CSV_OPTS="-tcmndrylpg --tcp --output $LOGDIR/dstat-csv.log"

From 7224a6b54d4114d1b82a63e702586951860bab95 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 1 Apr 2019 11:16:53 +0000
Subject: [PATCH 2455/3333] Update docs index page

- Switch from proposing Ubuntu 16.04 to 18.04 as the most tested
  platform.
- Make it clearer that creating an additional "stack" user is
  optional when running on a cloud image, as this step often leads
  to errors for new users.
- Fix some minor nits along the way.

Change-Id: I39aef1a230b668b932b1681fcd0deeb423b411f1
---
 doc/source/index.rst | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9186f6dba7..1ea1c5ddae 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,22 +38,23 @@ Quick Start
 Install Linux
 -------------
 
-Start with a clean and minimal install of a Linux system. Devstack
+Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
 latest/current Fedora version, CentOS/RHEL 7, as well as Debian and
 OpenSUSE.
 
-If you do not have a preference, Ubuntu 16.04 is the most tested, and
-will probably go the smoothest.
+If you do not have a preference, Ubuntu 18.04 (Bionic Beaver) is the
+most tested, and will probably go the smoothest.
 
-Add Stack User
---------------
+Add Stack User (optional)
+-------------------------
 
-Devstack should be run as a non-root user with sudo enabled
+DevStack should be run as a non-root user with sudo enabled
 (standard logins to cloud images such as "ubuntu" or "cloud-user"
 are usually fine).
 
-You can quickly create a separate `stack` user to run DevStack with
+If you are not using a cloud image, you can create a separate `stack` user
+to run DevStack with
 
 .. code-block:: console
 
@@ -76,12 +77,12 @@ Download DevStack
    $ cd devstack
 
 The ``devstack`` repo contains a script that installs OpenStack and
-templates for configuration files
+templates for configuration files.
 
 Create a local.conf
 -------------------
 
-Create a ``local.conf`` file with 4 passwords preset at the root of the
+Create a ``local.conf`` file with four passwords preset at the root of the
 devstack git repo.
 
 .. code-block:: ini

From 7f0b4f3001575d1419c5020e007ce2c841c88f2f Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 1 Apr 2019 11:43:28 +0000
Subject: [PATCH 2456/3333] Fix double quoting issue when writing localconf

When [0] introduced quoting all arguments, it broke existing consumers
that already quote their value themselves. Fix this by avoiding to add
additional quotes to the value when it already starts with a double
quote.

[0] https://review.openstack.org/636078

Change-Id: I92146e04731efc6dcc632ae6c3a7c374e783cdba
Closes-Bug: 1822453
---
 .../library/devstack_local_conf.py             |  6 +++++-
 .../write-devstack-local-conf/library/test.py  | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 3a8cd588b9..2f97d0e355 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -252,7 +252,11 @@ def handle_localrc(self, localrc):
         if localrc:
             vg = VarGraph(localrc)
             for k, v in vg.getVars():
-                self.localrc.append('{}="{}"'.format(k, v))
+                # Avoid double quoting
+                if len(v) and v[0]=='"':
+                    self.localrc.append('{}={}'.format(k, v))
+                else:
+                    self.localrc.append('{}="{}"'.format(k, v))
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
                 elif k == 'TEMPEST_PLUGINS':
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 22bf2da55d..7c526b34c8 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -187,6 +187,24 @@ def test_overridelibs_from_git(self):
                     lfg = line.strip().split('=')[1]
         self.assertEqual('"oslo.db"', lfg)
 
+    def test_avoid_double_quote(self):
+        "Test that there a no duplicated quotes"
+        localrc = {'TESTVAR': '"quoted value"'}
+        p = dict(localrc=localrc,
+                 base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 projects={})
+        lc = self._init_localconf(p)
+        lc.write(p['path'])
+
+        testvar = None
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('TESTVAR'):
+                    testvar = line.strip().split('=')[1]
+        self.assertEqual('"quoted value"', testvar)
+
     def test_plugin_circular_deps(self):
         "Test that plugins with circular dependencies fail"
         os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))

From e03bcb2c8b8f1ee1cbef579454a30776e43175b3 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 1 Apr 2019 12:19:45 -0400
Subject: [PATCH 2457/3333] Remove crusty old python 3 package version logic

If we are running with python3, just assume that any
package that is not blacklisted is available for py3
and just attempt to install it and let pip sort it out
whether it gets installed from a local or remote package.

Change-Id: Ic05d183e489320f6dfc721575d47e7e4d661f87c
Closes-Bug: #1820892
---
 inc/python | 70 ++++--------------------------------------------------
 1 file changed, 5 insertions(+), 65 deletions(-)

diff --git a/inc/python b/inc/python
index e2a042e452..19e1228d23 100644
--- a/inc/python
+++ b/inc/python
@@ -81,34 +81,6 @@ function pip_install_gr_extras {
     pip_install $clean_name[$extras]
 }
 
-# Determine the python versions supported by a package
-function get_python_versions_for_package {
-    local name=$1
-    cd $name && python setup.py --classifiers \
-        | grep 'Language' | cut -f5 -d: | grep '\.' | tr '\n' ' '
-}
-
-# Check for python3 classifier in local directory
-function check_python3_support_for_package_local {
-    local name=$1
-    cd $name
-    set +e
-    classifier=$(python setup.py --classifiers \
-        | grep 'Programming Language :: Python :: 3')
-    set -e
-    echo $classifier
-}
-
-# Check for python3 classifier on pypi
-function check_python3_support_for_package_remote {
-    local name=$1
-    set +e
-    classifier=$(curl -s -L "https://pypi.python.org/pypi/$name/json" \
-        | grep '"Programming Language :: Python :: 3"')
-    set -e
-    echo $classifier
-}
-
 # python3_enabled_for() assumes the service(s) specified as arguments are
 # enabled for python 3 unless explicitly disabled. See python3_disabled_for().
 #
@@ -259,52 +231,20 @@ function pip_install {
             cmd_pip=$(get_pip_command $PYTHON2_VERSION)
             local sudo_pip="sudo -H"
             if python3_enabled; then
-                # Look at the package classifiers to find the python
-                # versions supported, and if we find the version of
-                # python3 we've been told to use, use that instead of the
-                # default pip
-                local python_versions
-
                 # Special case some services that have experimental
                 # support for python3 in progress, but don't claim support
                 # in their classifier
                 echo "Check python version for : $package_dir"
                 if python3_disabled_for ${package_dir##*/}; then
                     echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
-                elif python3_enabled_for ${package_dir##*/}; then
+                else
+                    # For everything that is not explicitly blacklisted with
+                    # DISABLED_PYTHON3_PACKAGES, assume it supports python3
+                    # and we will let pip sort out the install, regardless of
+                    # the package being local or remote.
                     echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                elif [[ -d "$package_dir" ]]; then
-                    python_versions=$(get_python_versions_for_package $package_dir)
-                    if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
-                        echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on classifiers"
-                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                    else
-                        # The package may not have yet advertised python3.5
-                        # support so check for just python3 classifier and log
-                        # a warning.
-                        python3_classifier=$(check_python3_support_for_package_local $package_dir)
-                        if [[ ! -z "$python3_classifier" ]]; then
-                            echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on local package settings"
-                            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                        else
-                            echo "WARNING: Did not find python 3 classifier for local package $package_dir"
-                        fi
-                    fi
-                else
-                    # Check pypi as we don't have the package on disk
-                    package=$(echo $package_dir | grep -o '^[.a-zA-Z0-9_-]*')
-                    python3_classifier=$(check_python3_support_for_package_remote $package)
-                    if [[ ! -z "$python3_classifier" ]]; then
-                        echo "Automatically using $PYTHON3_VERSION version to install $package based on remote package settings"
-                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                    else
-                        echo "WARNING: Did not find python 3 classifier for remote package $package_dir"
-                    fi
                 fi
             fi
         fi

From 3ffc00940fdfddbef2c3bd4bc2298104ab606504 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 2 Apr 2019 12:28:31 +0200
Subject: [PATCH 2458/3333] sync-devstack-data: new argument
 devstack_data_base_dir

When the role is used by grenade, the data directory is shared among
different devstack executions, and the base directory is different,
for example: /opt/stack/data vs /opt/stack/{old,new}.
The new devstack_data_base_dir parameter allows user to specify
a base directory for the data/ directory which is unrelated
to the devstack directory. The default value is devstack_base_dir,
so the default behavior is unchanged.

Change-Id: Ie69b7b51947cbf1a8b31d2701783de2fb56a2d33
---
 roles/sync-devstack-data/README.rst         |  7 +++++++
 roles/sync-devstack-data/defaults/main.yaml |  1 +
 roles/sync-devstack-data/tasks/main.yaml    | 12 ++++++------
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/roles/sync-devstack-data/README.rst b/roles/sync-devstack-data/README.rst
index 500e8cccc4..388625c893 100644
--- a/roles/sync-devstack-data/README.rst
+++ b/roles/sync-devstack-data/README.rst
@@ -10,3 +10,10 @@ subnodes.
    :default: /opt/stack
 
    The devstack base directory.
+
+.. zuul:rolevar:: devstack_data_base_dir
+   :default: {{ devstack_base_dir }}
+
+   The devstack base directory for data/.
+   Useful for example when multiple executions of devstack (i.e. grenade)
+   share the same data directory.
diff --git a/roles/sync-devstack-data/defaults/main.yaml b/roles/sync-devstack-data/defaults/main.yaml
index fea05c8146..6b5017b811 100644
--- a/roles/sync-devstack-data/defaults/main.yaml
+++ b/roles/sync-devstack-data/defaults/main.yaml
@@ -1 +1,2 @@
 devstack_base_dir: /opt/stack
+devstack_data_base_dir: "{{ devstack_base_dir }}"
diff --git a/roles/sync-devstack-data/tasks/main.yaml b/roles/sync-devstack-data/tasks/main.yaml
index 46000159d4..e62be87ccd 100644
--- a/roles/sync-devstack-data/tasks/main.yaml
+++ b/roles/sync-devstack-data/tasks/main.yaml
@@ -1,7 +1,7 @@
 - name: Ensure the data folder exists
   become: true
   file:
-    path: "{{ devstack_base_dir }}/data"
+    path: "{{ devstack_data_base_dir }}/data"
     state: directory
     owner: stack
     group: stack
@@ -11,7 +11,7 @@
 - name: Ensure the CA folder exists
   become: true
   file:
-    path: "{{ devstack_base_dir }}/data/CA"
+    path: "{{ devstack_data_base_dir }}/data/CA"
     state: directory
     owner: stack
     group: stack
@@ -25,8 +25,8 @@
     dest: "{{ zuul.executor.work_root }}/{{ item | basename }}"
     mode: pull
   with_items:
-    - "{{ devstack_base_dir }}/data/ca-bundle.pem"
-    - "{{ devstack_base_dir }}/data/CA"
+    - "{{ devstack_data_base_dir }}/data/ca-bundle.pem"
+    - "{{ devstack_data_base_dir }}/data/CA"
   when: inventory_hostname == 'controller'
 
 - name: Push the CA certificate
@@ -34,7 +34,7 @@
   become_user: stack
   synchronize:
     src: "{{ zuul.executor.work_root }}/ca-bundle.pem"
-    dest: "{{ devstack_base_dir }}/data/ca-bundle.pem"
+    dest: "{{ devstack_data_base_dir }}/data/ca-bundle.pem"
     mode: push
   when: 'inventory_hostname in groups["subnode"]|default([])'
 
@@ -43,6 +43,6 @@
   become_user: stack
   synchronize:
     src: "{{ zuul.executor.work_root }}/CA/"
-    dest: "{{ devstack_base_dir }}/data/"
+    dest: "{{ devstack_data_base_dir }}/data/"
     mode: push
   when: 'inventory_hostname in groups["subnode"]|default([])'

From d5a68a6b7039a66455d7e320379a6b0b3879891c Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 2 Apr 2019 22:52:23 +0000
Subject: [PATCH 2459/3333] Configure console proxy ports in nova_cellN.conf

We're able to run multiple cells in devstack by setting the variable
NOVA_NUM_CELLS in the devstack local.conf. Since we run console
proxies per cell, we will start two console proxies if
NOVA_NUM_CELLS=2. However, we've not been configuring the console
proxy ports in the nova_cellN.conf files, so an attempt to start
more than one will result in a port conflict and failure to start
the subsequent console proxy services with error:

  ERROR nova error: [Errno 98] Address already in use

This adds configuration of the console proxy ports based on an offset
while looping across NOVA_NUM_CELLS. The base port values are taken
from the config option defaults in the nova code: nova/conf/vnc.py,
nova/conf/spice.py, and nova/conf/serial_console.py.

Closes-Bug: #1822873

Change-Id: I8934d0b9392f2976347391c8a650ad260f337762
---
 lib/nova | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index dee798cd5e..1b5132b018 100644
--- a/lib/nova
+++ b/lib/nova
@@ -607,8 +607,10 @@ function create_nova_conf {
     else
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             local conf
+            local offset
             conf=$(conductor_conf $i)
-            configure_console_proxies $conf
+            offset=$((i - 1))
+            configure_console_proxies $conf $offset
         done
     fi
 }
@@ -678,10 +680,17 @@ function configure_console_compute {
 function configure_console_proxies {
     # Use the provided config file path or default to $NOVA_CONF.
     local conf=${1:-$NOVA_CONF}
+    local offset=${2:-0}
+    # Stagger the offset based on the total number of possible console proxies
+    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # all are enabled.
+    offset=$((offset * 4))
 
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf vnc novncproxy_port $((6080 + offset))
         iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf vnc xvpvncproxy_port $((6081 + offset))
 
         if is_nova_console_proxy_compute_tls_enabled ; then
             iniset $conf vnc auth_schemes "vencrypt"
@@ -713,10 +722,12 @@ function configure_console_proxies {
 
     if is_service_enabled n-spice; then
         iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf spice html5proxy_port $((6082 + offset))
     fi
 
     if is_service_enabled n-sproxy; then
         iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf serial_console serialproxy_port $((6083 + offset))
     fi
 }
 

From 5fcb4447cf601905a795064e67cfb479c0af67a1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 14 Feb 2019 12:56:48 +0000
Subject: [PATCH 2460/3333] Make most platform jobs run with python3

python2.7 will be EOL soon, let's test on python3 instead.
Exclude CentOS 7, as there is no python3 easily available.

Change-Id: I24d8812c0c37b6d376fd5ae38067513bb62a2804
---
 .zuul.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index afe400e1a4..17723e7dd0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -496,21 +496,21 @@
 
 - job:
     name: devstack-platform-opensuse-150
-    parent: tempest-full
+    parent: tempest-full-py3
     description: openSUSE 15.0 platform test
     nodeset: devstack-single-node-opensuse-150
     voting: false
 
 - job:
     name: devstack-platform-fedora-latest
-    parent: tempest-full
+    parent: tempest-full-py3
     description: Fedora latest platform test
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
 - job:
     name: devstack-platform-xenial
-    parent: tempest-full
+    parent: tempest-full-py3
     description: Ubuntu Xenial platform test
     nodeset: openstack-single-node-xenial
     voting: false

From cc072fd32f72d4f05257d0b0c8c7c41fa1178f52 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 31 May 2017 20:27:59 -0700
Subject: [PATCH 2461/3333] Run devstack CA and cert setup early

Previously apache was configured and restarted before we configured
the CA and certs. In most cases this is fine because those specific
vhosts didn't use tls. However, if you had previously run devstack
and had leftover vhosts and an unconfigured CA or certs devstack would
fail.

This is a small corner case, but its simple to address by moving CA and
cert setup up in stack.sh to before we do anything related to web
servers.

Change-Id: I31dbaf9471088b9faff26c7b790da6f6feebb2d5
---
 stack.sh | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/stack.sh b/stack.sh
index dfc9d24f51..0d7e623c78 100755
--- a/stack.sh
+++ b/stack.sh
@@ -833,6 +833,18 @@ if is_service_enabled etcd3; then
     install_etcd3
 fi
 
+# Setup TLS certs
+# ---------------
+
+# Do this early, before any webservers are set up to ensure
+# we don't run into problems with missing certs when apache
+# is restarted.
+if is_service_enabled tls-proxy; then
+    configure_CA
+    init_CA
+    init_cert
+fi
+
 # Check Out and Install Source
 # ----------------------------
 
@@ -857,13 +869,6 @@ if is_service_enabled neutron nova horizon; then
     install_neutronclient
 fi
 
-# Setup TLS certs
-if is_service_enabled tls-proxy; then
-    configure_CA
-    init_CA
-    init_cert
-fi
-
 # Install middleware
 install_keystonemiddleware
 

From 1348ac990df40c504056a235156979629b844e8a Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Thu, 4 Apr 2019 22:30:24 +0900
Subject: [PATCH 2462/3333] stack.sh: Clear OpenStack related envvars

stack.sh usually fails when it is started in a shell session
where OpenStack related environment variables OS_* are set.
Most common failure scenarios are failures in keystone operations.

This commits clears OpenStack related environment variables
at the begining of stack.sh.

Change-Id: I3a924a0586dc9bb28f3bf3e151e100c24015efe5
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index dfc9d24f51..396d742c72 100755
--- a/stack.sh
+++ b/stack.sh
@@ -60,6 +60,9 @@ unset LANGUAGE
 LC_ALL=en_US.utf8
 export LC_ALL
 
+# Clear all OpenStack related envvars
+unset `env | grep -E '^OS_' | cut -d = -f 1`
+
 # Make sure umask is sane
 umask 022
 

From 56af9229a04b29c1ac70099e8361cec423096e99 Mon Sep 17 00:00:00 2001
From: Trinh Nguyen <dangtrinhnt@gmail.com>
Date: Fri, 14 Dec 2018 17:27:46 +0900
Subject: [PATCH 2463/3333] Remove pkg/elasticsearch.sh

The pkg/elasticsearch.sh is only used by Panko but Panko has
moved the script to its own repository [1].

[1] https://review.openstack.org/#/c/643262/

Change-Id: I0ce40f4299246b68624abd2072c2abce06f1e70b
Signed-off-by: Trinh Nguyen <dangtrinhnt@gmail.com>
---
 pkg/elasticsearch.sh | 148 -------------------------------------------
 1 file changed, 148 deletions(-)
 delete mode 100755 pkg/elasticsearch.sh

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
deleted file mode 100755
index bd4415315f..0000000000
--- a/pkg/elasticsearch.sh
+++ /dev/null
@@ -1,148 +0,0 @@
-#!/bin/bash -xe
-
-# basic reference point for things like filecache
-#
-# TODO(sdague): once we have a few of these I imagine the download
-# step can probably be factored out to something nicer
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-FILES=$TOP_DIR/files
-source $TOP_DIR/stackrc
-
-# Package source and version, all pkg files are expected to have
-# something like this, as well as a way to override them.
-ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.7.5}
-ELASTICSEARCH_BASEURL=${ELASTICSEARCH_BASEURL:-https://download.elasticsearch.org/elasticsearch/elasticsearch}
-
-# Elastic search actual implementation
-function wget_elasticsearch {
-    local file=${1}
-
-    if [ ! -f ${FILES}/${file} ]; then
-        wget $ELASTICSEARCH_BASEURL/${file} -O ${FILES}/${file}
-    fi
-
-    if [ ! -f ${FILES}/${file}.sha1.txt ]; then
-        wget $ELASTICSEARCH_BASEURL/${file}.sha1.txt -O ${FILES}/${file}.sha1.txt
-    fi
-
-    pushd ${FILES};  sha1sum ${file} > ${file}.sha1.gen;  popd
-
-    if ! diff ${FILES}/${file}.sha1.gen ${FILES}/${file}.sha1.txt; then
-        echo "Invalid elasticsearch download. Could not install."
-        return 1
-    fi
-    return 0
-}
-
-function download_elasticsearch {
-    if is_ubuntu; then
-        wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.deb
-    elif is_fedora || is_suse; then
-        wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
-    fi
-}
-
-function configure_elasticsearch {
-    # currently a no op
-    :
-}
-
-function _check_elasticsearch_ready {
-    # poll elasticsearch to see if it's started
-    if ! wait_for_service 120 http://localhost:9200; then
-        die $LINENO "Maximum timeout reached. Could not connect to ElasticSearch"
-    fi
-}
-
-function start_elasticsearch {
-    if is_ubuntu; then
-        sudo /etc/init.d/elasticsearch start
-        _check_elasticsearch_ready
-    elif is_fedora; then
-        sudo /bin/systemctl start elasticsearch.service
-        _check_elasticsearch_ready
-    elif is_suse; then
-        sudo /usr/bin/systemctl start elasticsearch.service
-        _check_elasticsearch_ready
-    else
-        echo "Unsupported architecture...can not start elasticsearch."
-    fi
-}
-
-function stop_elasticsearch {
-    if is_ubuntu; then
-        sudo /etc/init.d/elasticsearch stop
-    elif is_fedora; then
-        sudo /bin/systemctl stop elasticsearch.service
-    elif is_suse ; then
-        sudo /usr/bin/systemctl stop elasticsearch.service
-    else
-        echo "Unsupported architecture...can not stop elasticsearch."
-    fi
-}
-
-function install_elasticsearch {
-    pip_install_gr elasticsearch
-    if is_package_installed elasticsearch; then
-        echo "Note: elasticsearch was already installed."
-        return
-    fi
-    if is_ubuntu; then
-        is_package_installed default-jre-headless || install_package default-jre-headless
-
-        sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
-        sudo update-rc.d elasticsearch defaults 95 10
-    elif is_fedora; then
-        is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
-        yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
-        sudo /bin/systemctl daemon-reload
-        sudo /bin/systemctl enable elasticsearch.service
-    elif is_suse; then
-        is_package_installed java-1_8_0-openjdk-headless || install_package java-1_8_0-openjdk-headless
-        zypper_install --no-gpg-checks ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
-        sudo /usr/bin/systemctl daemon-reload
-        sudo /usr/bin/systemctl enable elasticsearch.service
-    else
-        echo "Unsupported install of elasticsearch on this architecture."
-    fi
-}
-
-function uninstall_elasticsearch {
-    if is_package_installed elasticsearch; then
-        if is_ubuntu; then
-            sudo apt-get purge elasticsearch
-        elif is_fedora; then
-            sudo yum remove elasticsearch
-        elif is_suse; then
-            sudo zypper rm elasticsearch
-        else
-            echo "Unsupported install of elasticsearch on this architecture."
-        fi
-    fi
-}
-
-# The PHASE dispatcher. All pkg files are expected to basically cargo
-# cult the case statement.
-PHASE=$1
-echo "Phase is $PHASE"
-
-case $PHASE in
-    download)
-        download_elasticsearch
-        ;;
-    install)
-        install_elasticsearch
-        ;;
-    configure)
-        configure_elasticsearch
-        ;;
-    start)
-        start_elasticsearch
-        ;;
-    stop)
-        stop_elasticsearch
-        ;;
-    uninstall)
-        uninstall_elasticsearch
-        ;;
-esac

From 70f5d91a616931790eea7e19028e1d097645ab3b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 12 Apr 2019 06:14:57 +0000
Subject: [PATCH 2464/3333] Updated from generate-devstack-plugins-list

Change-Id: Id100f77027445edf849cc295ecebb31c79601b40
---
 doc/source/plugin-registry.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9338d18819..f3aa1bffcc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -34,6 +34,7 @@ broadview-collector                    `https://git.openstack.org/openstack/broa
 castellan-ui                           `https://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
 ceilometer                             `https://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `https://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
+cinderlib                              `https://git.openstack.org/openstack/cinderlib <https://git.openstack.org/cgit/openstack/cinderlib>`__
 cloudkitty                             `https://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
 collectd-openstack-plugins             `https://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
 congress                               `https://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
@@ -82,6 +83,7 @@ kuryr-tempest-plugin                   `https://git.openstack.org/openstack/kury
 magnum                                 `https://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `https://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `https://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+manila-tempest-plugin                  `https://git.openstack.org/openstack/manila-tempest-plugin <https://git.openstack.org/cgit/openstack/manila-tempest-plugin>`__
 manila-ui                              `https://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `https://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 meteos                                 `https://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
@@ -174,6 +176,7 @@ stackube                               `https://git.openstack.org/openstack/stac
 storlets                               `https://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `https://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `https://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-ha                                 `https://git.openstack.org/openstack/stx-ha <https://git.openstack.org/cgit/openstack/stx-ha>`__
 stx-integ                              `https://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
 stx-metal                              `https://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
 stx-nfv                                `https://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__

From 28a62242843ff45315f4918062ed654a3f3e3b31 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 6 Dec 2017 09:21:43 -0600
Subject: [PATCH 2465/3333] Add openstacksdk functional job to devstack
 pipelines

openstacksdk gates on the new-style devstack functional base jobs. It
serves as a good test case to make sure the functional base jobs don't
break.

Change-Id: I817639ed30cda8ea51d156872a14bbcf10a4e63d
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9aafcdbb84..7c2a9d5073 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -621,6 +621,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - openstacksdk-functional-devstack:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack
@@ -641,6 +645,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - openstacksdk-functional-devstack:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.

From 7fbc70e2cb17b89259efb70ddcc8bb98ddd844e5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 15 Apr 2019 06:24:44 +0000
Subject: [PATCH 2466/3333] Updated from generate-devstack-plugins-list

Change-Id: I2798fe053669be212c47ee9c579ca4f6262af5a1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f3aa1bffcc..93c16f454c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -123,6 +123,7 @@ networking-midonet                     `https://git.openstack.org/openstack/netw
 networking-mlnx                        `https://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
 networking-nec                         `https://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `https://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
+networking-omnipath                    `https://git.openstack.org/openstack/networking-omnipath <https://git.openstack.org/cgit/openstack/networking-omnipath>`__
 networking-onos                        `https://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
 networking-opencontrail                `https://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
 networking-ovn                         `https://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__

From 10f44098825d1d13452117dc5ee31e3e895b495f Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen@gazlene.net>
Date: Thu, 28 Feb 2019 23:44:14 +0100
Subject: [PATCH 2467/3333] Add hack to fix ply installation on opensuse

The python3-ply package is indirectly a dependency of dhcp-client, which
is not exactly an optional package. Pip >=10 refuses to install ply from
global-requirements with this distro package is installed, so our only
option is to remove it manually.

Change-Id: I377fdd4a581eb4b6275584d92cafc0b783fe3b84
---
 tools/fixup_stuff.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 1ff7bfa516..748223902c 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -228,6 +228,14 @@ function fixup_suse {
         sudo systemctl disable apparmor
         sudo /usr/sbin/aa-teardown
     fi
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
 }
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From a9a51ca6382eb01c99fce51084f64a69f4c7d58a Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Mon, 15 Apr 2019 23:54:31 +0200
Subject: [PATCH 2468/3333] Fix is_neutron_legacy_enabled function

This function will now first filter out all "neutron-" strings from
DISABLED_SERVICES list before looking for "neutron" string in it.

Change-Id: I5cab6a3be553713e1257599fb72042c6001f2672
Close-Bug: #1824884
---
 lib/neutron | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 1066d8e342..947c491ec1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -117,7 +117,9 @@ function is_neutron_enabled {
 # Test if any Neutron services are enabled
 # is_neutron_enabled
 function is_neutron_legacy_enabled {
-    [[ ,${DISABLED_SERVICES} =~ ,"neutron" ]] && return 1
+    # first we need to remove all "neutron-" from DISABLED_SERVICES list
+    disabled_services_copy=$(echo $DISABLED_SERVICES | sed 's/neutron-//g')
+    [[ ,${disabled_services_copy} =~ ,"neutron" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
     return 1
 }

From a13474fd7892312ef42a211c344d8c785f9a5f93 Mon Sep 17 00:00:00 2001
From: Erik Olof Gunnar Andersson <eandersson@blizzard.com>
Date: Thu, 18 Apr 2019 12:18:23 -0700
Subject: [PATCH 2469/3333] Add region_name to ironic compute configuration

We should always pass on a region when talking to
ironic. This will also help detect and test issues
specific to regions.

Change-Id: Iaab3c1bcedc5aaa2106c0758cbb43bade3de2cf5
---
 lib/nova_plugins/hypervisor-ironic | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 49110a8643..1279256055 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -50,6 +50,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
+    iniset $NOVA_CONF ironic region_name $REGION_NAME
 
     iniset $NOVA_CONF ironic api_max_retries 300
     iniset $NOVA_CONF ironic api_retry_interval 5

From 666f5491b67e32b5f0e0f7a9eb5dc6ad72a1fd72 Mon Sep 17 00:00:00 2001
From: OpenDev Sysadmins <openstack-infra@lists.openstack.org>
Date: Fri, 19 Apr 2019 19:43:10 +0000
Subject: [PATCH 2470/3333] OpenDev Migration Patch

This commit was bulk generated and pushed by the OpenDev sysadmins
as a part of the Git hosting and code review systems migration
detailed in these mailing list posts:

http://lists.openstack.org/pipermail/openstack-discuss/2019-March/003603.html
http://lists.openstack.org/pipermail/openstack-discuss/2019-April/004920.html

Attempts have been made to correct repository namespaces and
hostnames based on simple pattern matching, but it's possible some
were updated incorrectly or missed entirely. Please reach out to us
via the contact information listed at https://opendev.org/ with any
questions you may have.
---
 .gitreview                                    |  4 ++--
 .zuul.yaml                                    | 22 +++++++++----------
 .../tasks/main.yaml                           |  6 ++---
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.gitreview b/.gitreview
index 570d31a987..e1bf63ba7a 100644
--- a/.gitreview
+++ b/.gitreview
@@ -1,4 +1,4 @@
 [gerrit]
-host=review.openstack.org
+host=review.opendev.org
 port=29418
-project=openstack-dev/devstack.git
+project=openstack/devstack.git
diff --git a/.zuul.yaml b/.zuul.yaml
index c20f55cb4a..8c0ce2f2ba 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -198,10 +198,10 @@
       job.group-vars.peers, which is what is used by multi node jobs for subnode
       nodes (everything but the controller).
     required-projects:
-      - git.openstack.org/openstack-dev/devstack
+      - opendev.org/openstack/devstack
     roles:
-      - zuul: git.openstack.org/openstack-infra/devstack-gate
-      - zuul: git.openstack.org/openstack-infra/openstack-zuul-jobs
+      - zuul: opendev.org/openstack/devstack-gate
+      - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
@@ -308,7 +308,7 @@
       less than the normal minimum set of required-projects.
     nodeset: openstack-single-node-bionic
     required-projects:
-      - git.openstack.org/openstack/requirements
+      - opendev.org/openstack/requirements
     vars:
       devstack_localrc:
         # Multinode specific settings
@@ -366,13 +366,13 @@
       The run playbook consists of a single role, so it can be easily rewritten
       and extended.
     required-projects:
-      - git.openstack.org/openstack/cinder
-      - git.openstack.org/openstack/glance
-      - git.openstack.org/openstack/keystone
-      - git.openstack.org/openstack/neutron
-      - git.openstack.org/openstack/nova
-      - git.openstack.org/openstack/placement
-      - git.openstack.org/openstack/swift
+      - opendev.org/openstack/cinder
+      - opendev.org/openstack/glance
+      - opendev.org/openstack/keystone
+      - opendev.org/openstack/neutron
+      - opendev.org/openstack/nova
+      - opendev.org/openstack/placement
+      - opendev.org/openstack/swift
     timeout: 7200
     vars:
       devstack_localrc:
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index dfa934f68b..f6d52ab3ad 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,9 +1,9 @@
 - name: Find all OpenStack source repos used by this job
   find:
     paths:
-      - src/git.openstack.org/openstack
-      - src/git.openstack.org/openstack-dev
-      - src/git.openstack.org/openstack-infra
+      - src/opendev.org/openstack
+      - src/opendev.org/openstack-dev
+      - src/opendev.org/openstack-infra
     file_type: directory
   register: found_repos
 

From e7f3d91a7ddb0a1d01a4394f42feb51ffc3b9b43 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 20 Apr 2019 09:11:58 -0500
Subject: [PATCH 2471/3333] Update repo namespace search list

With the new namespaces we have to look around a bit more to find
repos top copy into the DevStack working directory. Add:

* starlingx/
* x/
* zuul/

Depends-On: https://review.opendev.org/653988
Change-Id: I8a55522a5fee46f415f0c0ce580ded3476133460
Signed-off-by: Dean Troyer <dtroyer@gmail.com>
---
 roles/setup-devstack-source-dirs/tasks/main.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index f6d52ab3ad..1e5ce660f3 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -4,6 +4,9 @@
       - src/opendev.org/openstack
       - src/opendev.org/openstack-dev
       - src/opendev.org/openstack-infra
+      - src/opendev.org/starlingx
+      - src/opendev.org/x
+      - src/opendev.org/zuul
     file_type: directory
   register: found_repos
 

From dc9ba8b8aee4022ef1598cd0d8cfd7dfe34a4b6b Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 23 Apr 2019 13:02:00 +0000
Subject: [PATCH 2472/3333] Add opendev to repo search list

glean is in opendev and is used by nodepool devstack jobs.

Change-Id: I38dfd7cc531b20b26862193be14f4ebb53352efa
---
 roles/setup-devstack-source-dirs/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index 1e5ce660f3..160757ede9 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,6 +1,7 @@
 - name: Find all OpenStack source repos used by this job
   find:
     paths:
+      - src/opendev.org/opendev
       - src/opendev.org/openstack
       - src/opendev.org/openstack-dev
       - src/opendev.org/openstack-infra

From 4705861dd01fdb37bde2a9432571501599d20766 Mon Sep 17 00:00:00 2001
From: Artom Lifshitz <alifshit@redhat.com>
Date: Wed, 23 May 2018 10:08:56 -0400
Subject: [PATCH 2473/3333] Explicitly set scheduler_available_filters

Tempest's scheduler_available_filters has a special 'all' value that
is understood to mean 'all filters are enabled' by various tempest
tests. However, what it really means is 'the default nova filters are
enabled.' In an effort to help clean that up, this patch explicitly
sets scheduler_available_filters to nova's $FILTERS. Because $FILTERS
is now used in both lib/nova and lib/tempest, it is renamed
$NOVA_FILTERS.

Change-Id: I6ffc1e9989cd61d666f9c1db9c94fbabd7151918
Related-bug: 1628443
---
 lib/nova    | 6 +++---
 lib/tempest | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5e157c5f11..0003179a4d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -103,9 +103,9 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-filter_scheduler}
 
-# The following FILTERS contains SameHostFilter and DifferentHostFilter with
+# The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+NOVA_FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 
@@ -423,7 +423,7 @@ function create_nova_conf {
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF scheduler driver "$SCHEDULER"
-    iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
+    iniset $NOVA_CONF filter_scheduler enabled_filters "$NOVA_FILTERS"
     if [[ $SCHEDULER == "filter_scheduler" ]]; then
         iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     fi
diff --git a/lib/tempest b/lib/tempest
index 60f571ceb3..b8b313eb30 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -372,6 +372,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_back_and_forth ${LIVE_MIGRATE_BACK_AND_FORTH:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
+
+    if [[ -n "$NOVA_FILTERS" ]]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled scheduler_enabled_filters ${NOVA_FILTERS}
+    fi
+
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False

From 62e27d3b1c81cd8a45ee6a8e77dce9f68fc9ea1a Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 23 Apr 2019 13:44:37 -0400
Subject: [PATCH 2474/3333] Remove n-obj from zuul and docs

n-obj hasn't been around for many years and devstack
doesn't use it anymore anyway so this just cleans up
some vestigial use of the old service.

Change-Id: I04b2d2dc2b4e49fab90f5ef94f4e087e969aa24b
---
 .zuul.yaml                                   | 1 -
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c0ce2f2ba..60e3a14f14 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -412,7 +412,6 @@
         n-cond: true
         n-cpu: true
         n-novnc: true
-        n-obj: true
         n-sch: true
         placement-api: true
         # Neutron services
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index b1d88cb35c..a27a4d20b4 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -59,7 +59,7 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     # Horizon - enable for the OpenStack web GUI
     # ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
+    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg

From 87daf8abe64f9b51fb840a455088b18fd0a791ff Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 15 Apr 2019 12:00:07 -0400
Subject: [PATCH 2475/3333] End support for changing cinder periodic_interval

Support for changing the cinder periodic_interval config option
was added way back in havana as a workaround for bug #1180976
by change I20e52e66fcc94b224476cdd14c88bd6981b4e617.  As the fix
for that bug does not require modifying this config value, and
such modification may have unintentional adverse effects, end
the support.

Change-Id: I1ef1fe564123216b19582262726cdb1078b7650e
Partial-bug: #1824837
---
 .zuul.yaml | 1 -
 lib/cinder | 9 ---------
 2 files changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c0ce2f2ba..785cf910d6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -380,7 +380,6 @@
         SWIFT_REPLICAS: 1
         SWIFT_START_ALL_SERVICES: false
         SWIFT_HASH: 1234123412341234
-        CINDER_PERIODIC_INTERVAL: 10
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
diff --git a/lib/cinder b/lib/cinder
index 047b25b3c5..ed8349aad6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,14 +88,6 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
-# Cinder reports allocations back to the scheduler on periodic intervals
-# it turns out we can get an "out of space" issue when we run tests too
-# quickly just because cinder didn't realize we'd freed up resources.
-# Make this configurable so that devstack-gate/tempest can set it to
-# less than the 60 second default
-# https://bugs.launchpad.net/cinder/+bug/1180976
-CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
-
 # Centos7 and OpenSUSE switched to using LIO and that's all that's supported,
 # although the tgt bits are in EPEL and OpenSUSE we don't want that for CI
 if is_fedora || is_suse; then
@@ -237,7 +229,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
-    iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager

From 5fe60c1a342f78482042f34f9a6d1a6739cbb1b7 Mon Sep 17 00:00:00 2001
From: ZhongShengping <chdzsp@163.com>
Date: Tue, 30 Apr 2019 10:12:51 +0800
Subject: [PATCH 2476/3333] Option "lock_path" from group "DEFAULT" is
 deprecated

Option "lock_path" from group "DEFAULT" is deprecated. Use option
"lock_path" from group "oslo_concurrency".

Change-Id: I7c7501a4a351155eeba77bb7cd43c8d6f5ea73bc
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 65487cb444..d630c9a3b0 100644
--- a/lib/glance
+++ b/lib/glance
@@ -130,7 +130,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
-    iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
+    iniset $GLANCE_API_CONF oslo_concurrency lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2

From 9e3b3bf5244e0b62cd4ab9914c622e81ba08f4c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 4 Sep 2018 16:51:45 -0400
Subject: [PATCH 2477/3333] Add nova-status upgrade check call post-deploy

Once nova is setup and n-cpu on the host is reporting
a service record and discovered (the host is mapping in
the API DB), we should run the nova-status upgrade check
to verify the deployment.

Change-Id: I9683bf94233ebacb3057ce159cb3dc53aa55a2f4
Related-Bug: #1790721
---
 stack.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stack.sh b/stack.sh
index 4f6e5b6da1..b06f7bdcc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1442,6 +1442,12 @@ if is_service_enabled n-api; then
         # environment is up.
         echo_summary "SKIPPING Cell setup because n-cpu is not enabled. You will have to do this manually before you have a working environment."
     fi
+    # Run the nova-status upgrade check command which can also be used
+    # to verify the base install. Note that this is good enough in a
+    # single node deployment, but in a multi-node setup it won't verify
+    # any subnodes - that would have to be driven from whatever tooling
+    # is deploying the subnodes, e.g. the zuul v3 devstack-multinode job.
+    $NOVA_BIN_DIR/nova-status --config-file $NOVA_CONF upgrade check
 fi
 
 # Run local script

From 070e4ee65e73584bae5fdb23135abb972baf8ae9 Mon Sep 17 00:00:00 2001
From: Kota Tsuyuzaki <tsuyuzaki.kota@lab.ntt.co.jp>
Date: Thu, 13 Sep 2018 03:08:19 +0900
Subject: [PATCH 2478/3333] Deprecate swift3, use s3api in Swift repo

swift3 is no longer actively maintained in the upstream.
That has been moved to Swift repository as s3api so we should
use s3api middleware instead. As well as swift3, s3token is
also maintained in Swift upstream.

Change-Id: I4582d81da066ab53e6f11ad1df7af91425f2b0ca
---
 doc/source/configuration.rst |  4 ++--
 lib/nova                     |  2 +-
 lib/swift                    | 32 +++++++++-----------------------
 stack.sh                     |  6 ++----
 stackrc                      |  4 ----
 5 files changed, 14 insertions(+), 34 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 022e6ba529..9ca8441263 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -627,8 +627,8 @@ used when adding nodes to the Swift rings.
 Swift S3
 ++++++++
 
-If you are enabling ``swift3`` in ``ENABLED_SERVICES`` DevStack will
-install the swift3 middleware emulation. Swift will be configured to
+If you are enabling ``s3api`` in ``ENABLED_SERVICES`` DevStack will
+install the s3api middleware emulation. Swift will be configured to
 act as a S3 endpoint for Keystone so effectively replacing the
 ``nova-objectstore``.
 
diff --git a/lib/nova b/lib/nova
index 1fb50dfd76..4653d693eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -403,7 +403,7 @@ function create_nova_accounts {
     fi
 
     # S3
-    if is_service_enabled swift3; then
+    if is_service_enabled s3api; then
         get_or_create_service "s3" "s3" "S3"
         get_or_create_endpoint \
             "s3" \
diff --git a/lib/swift b/lib/swift
index e2ee0cb470..d9a7878652 100644
--- a/lib/swift
+++ b/lib/swift
@@ -49,7 +49,6 @@ fi
 
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
-SWIFT3_DIR=$DEST/swift3
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 SWIFT_DEFAULT_BIND_PORT=${SWIFT_DEFAULT_BIND_PORT:-8080}
@@ -68,8 +67,8 @@ SWIFT_DISK_IMAGE=${SWIFT_DATA_DIR}/drives/images/swift.img
 # Default is ``/etc/swift``.
 SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-/etc/swift}
 
-if is_service_enabled s-proxy && is_service_enabled swift3; then
-    # If we are using ``swift3``, we can default the S3 port to swift instead
+if is_service_enabled s-proxy && is_service_enabled s3api; then
+    # If we are using ``s3api``, we can default the S3 port to swift instead
     # of nova-objectstore
     S3_SERVICE_PORT=${S3_SERVICE_PORT:-$SWIFT_DEFAULT_BIND_PORT}
 fi
@@ -423,16 +422,19 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:proxy-logging reveal_sensitive_prefix ${SWIFT_LOG_TOKEN_LENGTH}
 
     # By default Swift will be installed with Keystone and tempauth middleware
-    # and add the swift3 middleware if its configured for it. The token for
+    # and add the s3api middleware if its configured for it. The token for
     # tempauth would be prefixed with the reseller_prefix setting `TEMPAUTH_` the
     # token for keystoneauth would have the standard reseller_prefix `AUTH_`
-    if is_service_enabled swift3;then
-        swift_pipeline+=" swift3 s3token "
+    if is_service_enabled s3api;then
+        swift_pipeline+=" s3api"
     fi
-
     if is_service_enabled keystone; then
+        if is_service_enabled s3api;then
+            swift_pipeline+=" s3token"
+        fi
         swift_pipeline+=" authtoken keystoneauth"
     fi
+
     swift_pipeline+=" tempauth "
 
     sed -i "/^pipeline/ { s/tempauth/${swift_pipeline} ${SWIFT_EXTRAS_MIDDLEWARE}/ ;}" ${SWIFT_CONFIG_PROXY_SERVER}
@@ -467,22 +469,6 @@ function configure_swift {
     # Allow both reseller prefixes to be used with domain_remap
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:domain_remap reseller_prefixes "AUTH, TEMPAUTH"
 
-    if is_service_enabled swift3; then
-        cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
-[filter:s3token]
-paste.filter_factory = keystonemiddleware.s3_token:filter_factory
-auth_uri = ${KEYSTONE_AUTH_URI}
-cafile = ${SSL_BUNDLE_FILE}
-admin_user = swift
-admin_tenant_name = ${SERVICE_PROJECT_NAME}
-admin_password = ${SERVICE_PASSWORD}
-
-[filter:swift3]
-use = egg:swift3#swift3
-location = ${REGION_NAME}
-EOF
-    fi
-
     cp ${SWIFT_DIR}/etc/swift.conf-sample ${SWIFT_CONF_DIR}/swift.conf
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-hash swift_hash_path_suffix ${SWIFT_HASH}
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_header_size ${SWIFT_MAX_HEADER_SIZE}
diff --git a/stack.sh b/stack.sh
index 4f6e5b6da1..cebd959ebc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -889,12 +889,10 @@ if is_service_enabled swift; then
     stack_install_service swift
     configure_swift
 
-    # swift3 middleware to provide S3 emulation to Swift
-    if is_service_enabled swift3; then
+    # s3api middleware to provide S3 emulation to Swift
+    if is_service_enabled s3api; then
         # Replace the nova-objectstore port by the swift port
         S3_SERVICE_PORT=8080
-        git_clone $SWIFT3_REPO $SWIFT3_DIR $SWIFT3_BRANCH
-        setup_develop $SWIFT3_DIR
     fi
 fi
 
diff --git a/stackrc b/stackrc
index 2924d3956c..2291e3c3d8 100644
--- a/stackrc
+++ b/stackrc
@@ -520,10 +520,6 @@ GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-$TARGET_BRANCH}
 GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
 GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 
-# s3 support for swift
-SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/openstack/swift3.git}
-SWIFT3_BRANCH=${SWIFT3_BRANCH:-$TARGET_BRANCH}
-
 # ceilometer middleware
 GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
 GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-$TARGET_BRANCH}

From 8b8158ed8f2f448a214ce3b1978b9cb5b039f6ed Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 5 Apr 2019 11:30:14 +0000
Subject: [PATCH 2479/3333] "raw_input()" deprecated in Python3

Built-in function "raw_input()" is deprecated in favor of "input()" [1].

[1] https://www.python.org/dev/peps/pep-3111/

Change-Id: I31c4c59373a2ad04987da3daffb3eed50916a6db
Closes-Bug: #1823321
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 8c6fa01c45..95b138c6bf 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -107,7 +107,7 @@ function remove_disabled_extensions {
 function image_size_in_gib {
     local size
     size=$(openstack image show $1 -c size -f value)
-    echo $size | python -c "import math; print int(math.ceil(float(int(raw_input()) / 1024.0 ** 3)))"
+    echo $size | python -c "import math; import six; print(int(math.ceil(float(int(six.moves.input()) / 1024.0 ** 3))))"
 }
 
 # configure_tempest() - Set config files, create data dirs, etc

From 9bf7e2654124205cd71343c2af175d730c634ab7 Mon Sep 17 00:00:00 2001
From: Swaminathan Vasudevan <SVasudevan@suse.com>
Date: Thu, 2 May 2019 13:45:46 -0700
Subject: [PATCH 2480/3333] DVR-Enable ARP Responder when DVR and L2pop is
 enabled

This patch enables ARP Responder with DVR routers along with
l2pop in devstack.

Related-Bug: #1774459

Change-Id: I82f628c32f6e38c2419b6ffe90d9f9adf96777b1
---
 lib/neutron             | 1 +
 lib/neutron_plugins/ml2 | 1 +
 2 files changed, 2 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 1066d8e342..17ffce7cb5 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -237,6 +237,7 @@ function configure_neutron_new {
             if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
                 iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
                 iniset $NEUTRON_CORE_PLUGIN_CONF agent enable_distributed_routing True
+                iniset $NEUTRON_CORE_PLUGIN_CONF agent arp_responder True
             fi
         fi
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c5a4c02cc5..a7466833e1 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -147,6 +147,7 @@ function neutron_plugin_configure_service {
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent l2_population=True
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent tunnel_types=vxlan
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent enable_distributed_routing=True
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE agent arp_responder=True
     fi
 }
 

From 4db9d567d19759ee090e506adf7ad77d8e64e452 Mon Sep 17 00:00:00 2001
From: Tom Barron <tpb@dyncloud.net>
Date: Wed, 9 Jan 2019 08:43:52 -0500
Subject: [PATCH 2481/3333] Safety check for python version in get_pip_command

We know empirically that some legacy gate jobs pass and appear
to be running with python3 but actually pip was invoked with
PYTHON3_VERSION unset so that they are actually ran with python2
packages.

As a followup to this discussion [1], add a safety check in the
get_pip_command function to ensure that a python version has been
set when it is invoked.

[1] https://review.openstack.org/#/c/622415/4/inc/python@283

Change-Id: I3a08406fb7d68282c6b98abb33a625821510046a
---
 inc/python | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/inc/python b/inc/python
index 19e1228d23..0e575ae9e9 100644
--- a/inc/python
+++ b/inc/python
@@ -29,6 +29,10 @@ declare -A -g PROJECT_VENV
 # get_pip_command
 function get_pip_command {
     local version="$1"
+    if [ -z "$version" ]; then
+        die $LINENO "pip python version is not set."
+    fi
+
     # NOTE(dhellmann): I don't know if we actually get a pip3.4-python
     # under any circumstances.
     which pip${version} || which pip${version}-python

From f745a0a7aa8cc86a02cd43012b307bb65df5b1aa Mon Sep 17 00:00:00 2001
From: Lucas Xu <hanxu@redhat.com>
Date: Thu, 30 May 2019 20:49:29 +0000
Subject: [PATCH 2482/3333] Fix Typo on Devstack-with-lbaas-v2.rst

Change "creeate" to "create" in thie CLI

Change-Id: Ic9997ad2b852ae25b28c5ad7481fad188b632a50
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index a27a4d20b4..db138ae2c5 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -91,7 +91,7 @@ Create two nova instances that we can use as test http servers:
 
     #create nova instances on private network
     openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
-    openstack server creeate --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
     openstack server list # should show the nova instances just created
 
     #add secgroup rules to allow ssh etc..

From 4b8cba77fe3444c925b5e4fe39743d54b0243eef Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 21 May 2019 14:17:11 +0100
Subject: [PATCH 2483/3333] Remove n-cells, n-net and n-cauth

Remove nova cells v1 support, which also allows/necessitates removing
support for nova networks (which was only supported with cells v1) and
nova-consoleauth (which was required by cells v1 but is unnecessary
otherwise).

The Depends-On isn't really necessary, but it's here to make sure this
doesn't merge until we _really_ have killed cells v1.

I honestly expected this patch would be bigger.

Change-Id: I90316208d1af42c1659d3bee386f95e38aaf2c56
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-On: Ib0e0b708c46e4330e51f8f8fdfbb02d45aaf0f44
---
 .zuul.yaml                            |  10 +-
 HACKING.rst                           |   4 +-
 doc/source/configuration.rst          |  14 ---
 doc/source/guides/multinode-lab.rst   |   6 -
 doc/source/guides/single-machine.rst  |   9 +-
 files/rpms/nova                       |   2 +-
 functions                             |   7 +-
 functions-common                      |   5 -
 lib/neutron-legacy                    |   2 -
 lib/nova                              | 168 ++------------------------
 lib/nova_plugins/hypervisor-xenserver |   3 -
 lib/tempest                           |  23 +---
 stack.sh                              |  29 +----
 stackrc                               |   3 +-
 14 files changed, 23 insertions(+), 262 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 60e3a14f14..9996f5aba7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -408,7 +408,6 @@
         # Nova services
         n-api: true
         n-api-meta: true
-        n-cauth: true
         n-cond: true
         n-cpu: true
         n-novnc: true
@@ -689,11 +688,8 @@
     # being experimental any more, so we can keep this list somewhat
     # pruned.
     #
-    # * nova-cells-v1: maintained by nova for cells v1 (nova-cells service);
-    #    it's in experimental here (and in nova) for testing cells v1
-    #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
-    #    things like cellsv2 and placement-api
+    #    things
     # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
     #    when neutron-api is served by uwsgi, it's in exprimental for testing.
     #    the next cycle we can remove this  job if things turn out to be
@@ -706,10 +702,6 @@
 
     experimental:
       jobs:
-        - nova-cells-v1:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
diff --git a/HACKING.rst b/HACKING.rst
index 3853eed9a1..968306a2c4 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -145,8 +145,8 @@ follows:
 * Global configuration that may be referenced in ``local.conf``, i.e. ``DEST``, ``DATA_DIR``
 * Global service configuration like ``ENABLED_SERVICES``
 * Variables used by multiple services that do not have a clear owner, i.e.
-  ``VOLUME_BACKING_FILE_SIZE`` (nova-compute, nova-volumes and cinder) or
-  ``PUBLIC_NETWORK_NAME`` (nova-network and neutron)
+  ``VOLUME_BACKING_FILE_SIZE`` (nova-compute and cinder) or
+  ``PUBLIC_NETWORK_NAME`` (only neutron but formerly nova-network too)
 * Variables that can not be cleanly declared in a project file due to
   dependency ordering, i.e. the order of sourcing the project files can
   not be changed for other reasons but the earlier file needs to dereference a
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 9ca8441263..5e8004dc44 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -663,20 +663,6 @@ Xenserver
 If you would like to use Xenserver as the hypervisor, please refer to
 the instructions in ``./tools/xen/README.md``.
 
-Cells
-~~~~~
-
-`Cells <https://wiki.openstack.org/wiki/Blueprint-nova-compute-cells>`__ is
-an alternative scaling option.  To setup a cells environment add the
-following to your ``localrc`` section:
-
-::
-
-    enable_service n-cell
-
-Be aware that there are some features currently missing in cells, one
-notable one being security groups.
-
 Cinder
 ~~~~~~
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c3574ac593..3c4acc8c7c 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -120,11 +120,8 @@ cluster controller's DevStack in ``local.conf``:
 
     [[local|localrc]]
     HOST_IP=192.168.42.11
-    FLAT_INTERFACE=eth0
     FIXED_RANGE=10.4.128.0/20
-    FIXED_NETWORK_SIZE=4096
     FLOATING_RANGE=192.168.42.128/25
-    MULTI_HOST=1
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
@@ -160,11 +157,8 @@ machines, create a ``local.conf`` with:
 
     [[local|localrc]]
     HOST_IP=192.168.42.12 # change this per compute node
-    FLAT_INTERFACE=eth0
     FIXED_RANGE=10.4.128.0/20
-    FIXED_NETWORK_SIZE=4096
     FLOATING_RANGE=192.168.42.128/25
-    MULTI_HOST=1
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 168172c630..cfbd6b1884 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -87,11 +87,8 @@ do the following:
 -  Set ``FLOATING_RANGE`` to a range not used on the local network, i.e.
    192.168.1.224/27. This configures IP addresses ending in 225-254 to
    be used as floating IPs.
--  Set ``FIXED_RANGE`` and ``FIXED_NETWORK_SIZE`` to configure the
-   internal address space used by the instances.
--  Set ``FLAT_INTERFACE`` to the Ethernet interface that connects the
-   host to your local network. This is the interface that should be
-   configured with the static IP address mentioned above.
+-  Set ``FIXED_RANGE`` to configure the internal address space used by the
+   instances.
 -  Set the administrative password. This password is used for the
    **admin** and **demo** accounts set up as OpenStack users.
 -  Set the MySQL administrative password. The default here is a random
@@ -108,8 +105,6 @@ do the following:
     [[local|localrc]]
     FLOATING_RANGE=192.168.1.224/27
     FIXED_RANGE=10.11.12.0/24
-    FIXED_NETWORK_SIZE=256
-    FLAT_INTERFACE=eth0
     ADMIN_PASSWORD=supersecret
     DATABASE_PASSWORD=iheartdatabases
     RABBIT_PASSWORD=flopsymopsy
diff --git a/files/rpms/nova b/files/rpms/nova
index 8d73644025..f69fc373d7 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,6 +1,6 @@
 conntrack-tools
 curl
-dnsmasq # for nova-network
+dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
 gawk
diff --git a/functions b/functions
index 187ad2311d..93035673b5 100644
--- a/functions
+++ b/functions
@@ -469,7 +469,7 @@ EOF
 
 
 # ping check
-# Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
+# Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``PRIVATE_NETWORK``
 # ping_check <ip> [boot-timeout] [from_net] [expected]
 function ping_check {
     local ip=$1
@@ -483,12 +483,9 @@ function ping_check {
     # if we don't specify a from_net we're expecting things to work
     # fine from our local box.
     if [[ -n "$from_net" ]]; then
+        # TODO(stephenfin): Is there any way neutron could be disabled now?
         if is_service_enabled neutron; then
             ping_cmd="$TOP_DIR/tools/ping_neutron.sh $from_net"
-        elif [[ "$MULTI_HOST" = "True" && "$from_net" = "$PRIVATE_NETWORK_NAME" ]]; then
-            # there is no way to address the multihost / private case, bail here for compatibility.
-            # TODO: remove this cruft and redo code to handle this at the caller level.
-            return
         fi
     fi
 
diff --git a/functions-common b/functions-common
index bace9e00e6..922ff6fa5f 100644
--- a/functions-common
+++ b/functions-common
@@ -1929,10 +1929,6 @@ function enable_service {
 #   For backward compatibility if we have **swift** in ENABLED_SERVICES all the
 #   **s-** services will be enabled. This will be deprecated in the future.
 #
-# Cells within nova is enabled if **n-cell** is in ``ENABLED_SERVICES``.
-# We also need to make sure to treat **n-cell-region** and **n-cell-child**
-# as enabled in this case.
-#
 # Uses global ``ENABLED_SERVICES``
 # is_service_enabled service [service ...]
 function is_service_enabled {
@@ -1955,7 +1951,6 @@ function is_service_enabled {
         # TODO(dtroyer): Remove these legacy special-cases after the is_XXX_enabled()
         #                are implemented
 
-        [[ ${service} == n-cell-* && ,${ENABLED_SERVICES} =~ ,"n-cell" ]] && enabled=0
         [[ ${service} == n-cpu-* && ,${ENABLED_SERVICES} =~ ,"n-cpu" ]] && enabled=0
         [[ ${service} == "nova" && ,${ENABLED_SERVICES} =~ ,"n-" ]] && enabled=0
         [[ ${service} == "glance" && ,${ENABLED_SERVICES} =~ ,"g-" ]] && enabled=0
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 82571151e4..87edc5ab81 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -50,8 +50,6 @@
 # See "Neutron Network Configuration" below for additional variables
 # that must be set in localrc for connectivity across hosts with
 # Neutron.
-#
-# With Neutron networking the NETWORK_MANAGER variable is ignored.
 
 # Settings
 # --------
diff --git a/lib/nova b/lib/nova
index 6ce1dcc4cc..2efe7cb9b4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -50,11 +50,9 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
-NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
 NOVA_COND_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
-NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 NOVA_UWSGI=$NOVA_BIN_DIR/nova-api-wsgi
 NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
@@ -111,7 +109,6 @@ QEMU_CONF=/etc/libvirt/qemu.conf
 
 # Set default defaults here as some hypervisor drivers override these
 PUBLIC_INTERFACE_DEFAULT=br100
-FLAT_NETWORK_BRIDGE_DEFAULT=br100
 # Set ``GUEST_INTERFACE_DEFAULT`` to some interface on the box so that
 # the default isn't completely crazy. This will match ``eth*``, ``em*``, or
 # the new ``p*`` interfaces, then basically picks the first
@@ -137,44 +134,6 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
     source $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER
 fi
 
-
-# Nova Network Configuration
-# --------------------------
-
-NETWORK_MANAGER=${NETWORK_MANAGER:-${NET_MAN:-FlatDHCPManager}}
-
-VLAN_INTERFACE=${VLAN_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
-FLAT_NETWORK_BRIDGE=${FLAT_NETWORK_BRIDGE:-$FLAT_NETWORK_BRIDGE_DEFAULT}
-
-# If you are using the FlatDHCP network mode on multiple hosts, set the
-# ``FLAT_INTERFACE`` variable but make sure that the interface doesn't already
-# have an IP or you risk breaking things.
-#
-# **DHCP Warning**:  If your flat interface device uses DHCP, there will be a
-# hiccup while the network is moved from the flat interface to the flat network
-# bridge.  This will happen when you launch your first instance.  Upon launch
-# you will lose all connectivity to the node, and the VM launch will probably
-# fail.
-#
-# If you are running on a single node and don't need to access the VMs from
-# devices other than that node, you can set ``FLAT_INTERFACE=``
-# This will stop nova from bridging any interfaces into ``FLAT_NETWORK_BRIDGE``.
-FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
-
-# ``MULTI_HOST`` is a mode where each compute node runs its own network node.  This
-# allows network operations and routing for a VM to occur on the server that is
-# running the VM - removing a SPOF and bandwidth bottleneck.
-MULTI_HOST=$(trueorfalse False MULTI_HOST)
-
-# ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
-# where there are at least two nova-computes.
-NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
-
-# Test floating pool and range are used for testing.  They are defined
-# here until the admin APIs can replace nova-manage
-TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
-TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
-
 # Other Nova configurations
 # ----------------------------
 
@@ -183,6 +142,10 @@ TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 # and Glance.
 NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 
+# ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
+# where there are at least two nova-computes.
+NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
+
 # Enable debugging levels for iscsid service (goes from 0-8)
 ISCSID_DEBUG=$(trueorfalse False ISCSID_DEBUG)
 ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
@@ -198,13 +161,6 @@ function is_nova_enabled {
     return 1
 }
 
-# Test if any Nova Cell services are enabled
-# is_nova_enabled
-function is_n-cell_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"n-cell" ]] && return 0
-    return 1
-}
-
 # is_nova_console_proxy_compute_tls_enabled() - Test if the Nova Console Proxy
 # service has TLS enabled
 function is_nova_console_proxy_compute_tls_enabled {
@@ -501,10 +457,6 @@ function create_nova_conf {
     if [ -n "$NOVA_INSTANCES_PATH" ]; then
         iniset $NOVA_CONF DEFAULT instances_path "$NOVA_INSTANCES_PATH"
     fi
-    if [ "$MULTI_HOST" != "False" ]; then
-        iniset $NOVA_CONF DEFAULT multi_host "True"
-        iniset $NOVA_CONF DEFAULT send_arp_for_ha "True"
-    fi
     if [ "$SYSLOG" != "False" ]; then
         iniset $NOVA_CONF DEFAULT use_syslog "True"
     fi
@@ -551,21 +503,6 @@ function create_nova_conf {
 
     iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    # Setup logging for nova-dhcpbridge command line
-    sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
-
-    if is_service_enabled n-net; then
-        local service="n-dhcp"
-        local logfile="${service}.log.${CURRENT_LOG_TIME}"
-        local real_logfile="${LOGDIR}/${logfile}"
-        if [[ -n ${LOGDIR} ]]; then
-            bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-            iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
-        fi
-
-        iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
-    fi
-
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
@@ -748,42 +685,6 @@ function conductor_conf {
     echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
 }
 
-function init_nova_cells {
-    if is_service_enabled n-cell; then
-        cp $NOVA_CONF $NOVA_CELLS_CONF
-        iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
-        rpc_backend_add_vhost child_cell
-        iniset_rpc_backend nova $NOVA_CELLS_CONF DEFAULT child_cell
-        iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
-        iniset $NOVA_CELLS_CONF cells enable True
-        iniset $NOVA_CELLS_CONF cells cell_type compute
-        iniset $NOVA_CELLS_CONF cells name child
-
-        iniset $NOVA_CONF cells enable True
-        iniset $NOVA_CONF cells cell_type api
-        iniset $NOVA_CONF cells name region
-
-        if is_service_enabled n-api-meta; then
-            NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
-            iniset $NOVA_CONF DEFAULT enabled_apis $NOVA_ENABLED_APIS
-            iniset $NOVA_CELLS_CONF DEFAULT enabled_apis metadata
-        fi
-
-        # Cells v1 conductor should be the nova-cells.conf
-        NOVA_COND_CONF=$NOVA_CELLS_CONF
-
-        time_start "dbsync"
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
-        time_stop "dbsync"
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
-        $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
-
-        # Creates the single cells v2 cell for the child cell (v1) nova db.
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
-            --transport-url $(get_transport_url child_cell) --name 'cell1'
-    fi
-}
-
 # create_nova_cache_dir() - Part of the init_nova() process
 function create_nova_cache_dir {
     # Create cache dir
@@ -791,18 +692,6 @@ function create_nova_cache_dir {
     rm -f $NOVA_AUTH_CACHE_DIR/*
 }
 
-function create_nova_conf_nova_network {
-    local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
-    iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
-    iniset $NOVA_CONF DEFAULT public_interface "$public_interface"
-    iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
-    iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
-    if [ -n "$FLAT_INTERFACE" ]; then
-        iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
-    fi
-    iniset $NOVA_CONF DEFAULT use_neutron False
-}
-
 # create_nova_keys_dir() - Part of the init_nova() process
 function create_nova_keys_dir {
     # Create keys dir
@@ -834,10 +723,6 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
-        if is_service_enabled n-cell; then
-            recreate_database $NOVA_CELLS_DB
-        fi
-
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
@@ -942,15 +827,6 @@ function start_nova_api {
     export PATH=$old_path
 }
 
-# Detect and setup conditions under which singleconductor setup is
-# needed. Notably cellsv1.
-function _set_singleconductor {
-    # NOTE(danms): Don't setup conductor fleet for cellsv1
-    if is_service_enabled n-cell; then
-        CELLSV2_SETUP="singleconductor"
-    fi
-}
-
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
@@ -958,11 +834,7 @@ function start_nova_compute {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    if is_service_enabled n-cell; then
-        local compute_cell_conf=$NOVA_CELLS_CONF
-    else
-        local compute_cell_conf=$NOVA_CONF
-    fi
+    local compute_cell_conf=$NOVA_CONF
 
     cp $compute_cell_conf $NOVA_CPU_CONF
 
@@ -1025,22 +897,7 @@ function start_nova_rest {
     export PATH=$NOVA_BIN_DIR:$PATH
 
     local api_cell_conf=$NOVA_CONF
-    if is_service_enabled n-cell; then
-        local compute_cell_conf=$NOVA_CELLS_CONF
-    else
-        local compute_cell_conf=$NOVA_CONF
-    fi
-
-    # ``run_process`` checks ``is_service_enabled``, it is not needed here
-    run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
-    run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
-
-    if is_service_enabled n-net; then
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
-    fi
-    run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
+    local compute_cell_conf=$NOVA_CONF
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
     if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
@@ -1049,9 +906,6 @@ function start_nova_rest {
         run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
-    # nova-consoleauth always runs globally
-    run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
-
     export PATH=$old_path
 }
 
@@ -1129,11 +983,7 @@ function is_nova_ready {
     # happen between here and the script ending. However, in multinode
     # tests this can very often not be the case. So ensure that the
     # compute is up before we move on.
-    if is_service_enabled n-cell; then
-        # cells v1 can't complete the check below because it munges
-        # hostnames with cell information (grumble grumble).
-        return
-    fi
+
     # TODO(sdague): honestly, this probably should be a plug point for
     # an external system.
     if [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
@@ -1145,8 +995,6 @@ function is_nova_ready {
 }
 
 function start_nova {
-    # this catches the cells v1 case early
-    _set_singleconductor
     start_nova_rest
     start_nova_console_proxies
     start_nova_conductor
@@ -1174,7 +1022,7 @@ function stop_nova_compute {
 
 function stop_nova_rest {
     # Kill the non-compute nova processes
-    for serv in n-api n-api-meta n-net n-sch n-cauth n-cell n-cell; do
+    for serv in n-api n-api-meta n-sch; do
         stop_process $serv
     done
 }
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 6f79e4ff7c..2fdbde1df8 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -24,9 +24,6 @@ set +o xtrace
 # Defaults
 # --------
 
-# Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
-FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
-
 VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
 
 
diff --git a/lib/tempest b/lib/tempest
index 95b138c6bf..9f1b677eba 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -342,7 +342,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
-    if ! is_service_enabled n-cell && ! is_service_enabled neutron; then
+    if ! is_service_enabled neutron; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi
 
@@ -391,24 +391,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled scheduler_enabled_filters ${NOVA_FILTERS}
     fi
 
-    if is_service_enabled n-cell; then
-        # Cells doesn't support shelving/unshelving
-        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
-        # Cells doesn't support hot-plugging virtual interfaces.
-        iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
-        # Cells v1 doesn't support the rescue/unrescue tests in Tempest
-        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
-
-        if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
-            # Cells supports resize but does not currently work with devstack
-            # because of the custom flavors created for Tempest runs which are
-            # not in the cells database.
-            # TODO(mriedem): work on adding a nova-manage command to sync
-            # flavors into the cells database.
-            iniset $TEMPEST_CONFIG compute-feature-enabled resize False
-        fi
-    fi
-
     if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
@@ -554,8 +536,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
-        elif ! is_service_enabled n-cell; then
-            # cells v1 does not support swapping volumes
+        else
             iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi
     fi
diff --git a/stack.sh b/stack.sh
index fa5b43ce38..7230c1f5cf 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1167,10 +1167,11 @@ if is_service_enabled neutron; then
     fi
 fi
 
+
 # Nova
 # ----
 
-if is_service_enabled n-net q-dhcp; then
+if is_service_enabled q-dhcp; then
     # Delete traces of nova networks from prior runs
     # Do not kill any dnsmasq instance spawned by NetworkManager
     netman_pid=$(pidof NetworkManager || true)
@@ -1182,12 +1183,6 @@ if is_service_enabled n-net q-dhcp; then
 
     clean_iptables
 
-    if is_service_enabled n-net; then
-        rm -rf ${NOVA_STATE_PATH}/networks
-        sudo mkdir -p ${NOVA_STATE_PATH}/networks
-        safe_chown -R ${STACK_USER} ${NOVA_STATE_PATH}/networks
-    fi
-
     # Force IP forwarding on, just in case
     sudo sysctl -w net.ipv4.ip_forward=1
 fi
@@ -1226,13 +1221,11 @@ if is_service_enabled nova; then
     init_nova
 
     # Additional Nova configuration that is dependent on other services
+    # TODO(stephenfin): Is it possible for neutron to *not* be enabled now? If
+    # not, remove the if here
     if is_service_enabled neutron; then
         configure_neutron_nova
-    elif is_service_enabled n-net; then
-        create_nova_conf_nova_network
     fi
-
-    init_nova_cells
 fi
 
 
@@ -1314,20 +1307,6 @@ elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
     configure_neutron_after_post_config
     start_neutron_service_and_check
-elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
-    NM_CONF=${NOVA_CONF}
-    if is_service_enabled n-cell; then
-        NM_CONF=${NOVA_CELLS_CONF}
-    fi
-
-    # Create a small network
-    $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF network create "$PRIVATE_NETWORK_NAME" $FIXED_RANGE 1 $FIXED_NETWORK_SIZE $NETWORK_CREATE_ARGS
-
-    # Create some floating ips
-    $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF floating create $FLOATING_RANGE --pool=$PUBLIC_NETWORK_NAME
-
-    # Create a second pool
-    $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF floating create --ip_range=$TEST_FLOATING_RANGE --pool=$TEST_FLOATING_POOL
 fi
 
 # Start placement before any of the service that are likely to want
diff --git a/stackrc b/stackrc
index 2291e3c3d8..3432fb6228 100644
--- a/stackrc
+++ b/stackrc
@@ -65,7 +65,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth,n-api-meta
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-api-meta
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
@@ -846,7 +846,6 @@ ENABLE_DEBUG_LOG_LEVEL=$(trueorfalse True ENABLE_DEBUG_LOG_LEVEL)
 FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
 IPV4_ADDRS_SAFE_TO_USE=${IPV4_ADDRS_SAFE_TO_USE:-10.0.0.0/22}
 FIXED_RANGE=${FIXED_RANGE:-$IPV4_ADDRS_SAFE_TO_USE}
-FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
 HOST_IP_IFACE=${HOST_IP_IFACE:-}
 HOST_IP=${HOST_IP:-}
 HOST_IPV6=${HOST_IPV6:-}

From 283e86fbb59aa11afb21b916d3a106e442baee0e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 22 May 2019 10:38:28 +0100
Subject: [PATCH 2484/3333] nova: Set '[neutron] default_floating_pool' instead

In change I2ce8ff3d7c33a402b8af50182ec01f512859c388, we duplicated the
'default_floating_pool' option, found in the '[DEFAULT]' group, to the
'[neutron]' group. This allowed us to continue with our deprecation
plans for the former option, which should be retired along with
nova-network.

Update the nova lib module so it'll set the new option, we can safely
assume to be the correct one now that we've removed support for cells v1
and nova-network.

Change-Id: If9a02b640e6c2e1300c7b11b7552ba13c1496d79
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 2efe7cb9b4..eebf170509 100644
--- a/lib/nova
+++ b/lib/nova
@@ -388,7 +388,7 @@ function create_nova_conf {
     if [[ $SCHEDULER == "filter_scheduler" ]]; then
         iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     fi
-    iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
+    iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
         iniset $NOVA_CONF DEFAULT use_ipv6 "True"

From a23e4153ef6711ebddc05290bb19c4c2d4fc2c18 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 22 May 2019 10:46:02 +0100
Subject: [PATCH 2485/3333] nova: Stop setting '[DEFAULT] use_ipv6'

Change I188fc2cd1b26fe7a71804f7e7d66b111d6f15e30 in nova stopped us
respecting this when generating the network templates injected into
instances on boot. With the removal of nova-network, there is no longer
any other reason to set this.

Change-Id: I925b7c6c23133cd5a835960f4507c979f615d78e
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index eebf170509..69364909ba 100644
--- a/lib/nova
+++ b/lib/nova
@@ -391,7 +391,6 @@ function create_nova_conf {
     iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
-        iniset $NOVA_CONF DEFAULT use_ipv6 "True"
     else
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
     fi

From 1b15176b0598f00c442c3b40985df30204dc6963 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 31 May 2019 16:23:57 +0200
Subject: [PATCH 2486/3333] Use neutron-legacy on subnodes in devstack zuul job

There are still some issues with lib/neutron thus neutron-legacy is used
on controller node in multinode jobs and in single node jobs.
But in "group-vars" in devstack job it was configured to use
lib/neutron which can cause some problems in multinode jobs.

So lets switch to neutron-legacy on subnodes also until lib/neutron
will be ready to use everywhere.

Change-Id: I0d7f9f2baaee2836a719f199939156bd4f53f778
---
 .zuul.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 60e3a14f14..34ee8cda91 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -460,7 +460,10 @@
           n-cpu: true
           placement-client: true
           # Neutron services
-          neutron-agent: true
+          # We need to keep using the neutron-legacy based services for
+          # now until all issues with the new lib/neutron code are solved
+          q-agt: true
+          # neutron-agent: true
           # Cinder services
           c-bak: true
           c-vol: true

From 16395949385356c4ab3c82227cd6c6a92496d356 Mon Sep 17 00:00:00 2001
From: shenjiatong <yshxxsjt715@gmail.com>
Date: Mon, 3 Jun 2019 10:52:01 +0800
Subject: [PATCH 2487/3333] remove duplicate entries under title guides in
 table of contents

right now, there are duplicate titles under contents --> guides
as shown in https://docs.openstack.org/devstack/latest/, although
they will forward to different pages, it is still a little confusing
for users. This change will hide toctree in guides.rst and users could
click links in page to jump to detail page to read more.

Change-Id: I2f3abeca7f56a3aedeabb48630ed2c61635b93cd
---
 doc/source/guides.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index 82e0dd6ac6..ca134c4520 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -10,6 +10,7 @@ Walk through various setups used by stackers
 
 .. toctree::
    :glob:
+   :hidden:
    :maxdepth: 1
 
    guides/single-vm

From 5e2d0e0bb5beffc23087383e7923dabaa2004a98 Mon Sep 17 00:00:00 2001
From: Alex Monk <krenair@gmail.com>
Date: Tue, 4 Jun 2019 01:21:44 +0100
Subject: [PATCH 2488/3333] Permit use of sudo-ldap instead of sudo package

If the sudo-ldap package is providing the sudo command instead of the plain
sudo package, accept that instead of breaking the system and requiring direct
root login intervention to fix things.

Change-Id: I45d7e4617bd59e72b4f0bf2e91750a6830e2a010
---
 stack.sh                   | 2 +-
 tools/create-stack-user.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index fa5b43ce38..9b3097ba23 100755
--- a/stack.sh
+++ b/stack.sh
@@ -247,7 +247,7 @@ disable_negated_services
 # --------------
 
 # We're not as **root** so make sure ``sudo`` is available
-is_package_installed sudo || install_package sudo
+is_package_installed sudo || is_package_installed sudo-ldap || install_package sudo
 
 # UEC images ``/etc/sudoers`` does not have a ``#includedir``, add one
 sudo grep -q "^#includedir.*/etc/sudoers.d" /etc/sudoers ||
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index c0b7ac70aa..919cacb036 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -32,7 +32,7 @@ GetDistro
 source $TOP_DIR/stackrc
 
 # Give the non-root user the ability to run as **root** via ``sudo``
-is_package_installed sudo || install_package sudo
+is_package_installed sudo || is_package_installed sudo-ldap || install_package sudo
 
 [[ -z "$STACK_USER" ]] && die "STACK_USER is not set. Exiting."
 

From fc207050988e236c32b0736f44c6bf2883cea95f Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 5 Jun 2019 08:24:45 +0000
Subject: [PATCH 2489/3333] Add setting of placement microversion on tempest
 conf

Tempest not support placement microversion setting so that
test can call APIs with specific placement microversion.

This commit adds the setting of placement API microversion on
Tempest conf.

Change-Id: Ie04aa993ec7a1495740d9267b076a40f4291e25e
---
 lib/tempest | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 9f1b677eba..6afed0eaf1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -513,6 +513,24 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
+    # Placement Features
+    # Set the microversion range for placement.
+    # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.
+    # NOTE- To avoid microversion tests failure on stable branch, we need to change "tempest_placement_max_microversion"
+    #       for stable branch on each release which should be changed from "latest" to max supported version of that release.
+    local tempest_placement_min_microversion=${TEMPEST_PLACEMENT_MIN_MICROVERSION:-None}
+    local tempest_placement_max_microversion=${TEMPEST_PLACEMENT_MAX_MICROVERSION:-"latest"}
+    if [ "$tempest_placement_min_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG placement min_microversion
+    else
+        iniset $TEMPEST_CONFIG placement min_microversion $tempest_placement_min_microversion
+    fi
+    if [ "$tempest_placement_max_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG placement max_microversion
+    else
+        iniset $TEMPEST_CONFIG placement max_microversion $tempest_placement_max_microversion
+    fi
+
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 58abccb89f46576b573733fd424056b2f5a0203d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 24 May 2019 15:09:01 -0400
Subject: [PATCH 2490/3333] Add nova-multi-cell job to experimental queue

Nova has had a multi-cell job (nova-multi-cell) since the
Train release but is currently non-voting in the check queue
for nova changes. This change adds the job to the experimental
queue for devstack changes so we can test changes to devstack
and make sure they work for the multi-cell job.

Change-Id: Icf31baf6fd4313aec5ecfb9e8f9cbcef1ff7f61d
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c516dd350..2dd0b9f4ef 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -701,9 +701,12 @@
     #    stable engouh with uwsgi.
     # * neutron-tempest-with-uwsgi: maintained by neutron for tempest test.
     #    Next cycle we can remove this if everything run out stable enough.
+    # * nova-multi-cell: maintained by nova and currently non-voting in the
+    #    check queue for nova changes but relies on devstack configuration
 
     experimental:
       jobs:
+        - nova-multi-cell
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi

From 6e5b1384665c0c039222ff6cbea5a120e60e89d1 Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Wed, 9 Jan 2019 17:00:45 -0800
Subject: [PATCH 2491/3333] Enable vlan networking for newer neutron plugin

Ironic's CI makes extensive use of VLAN based networking
and the newer neutron plugin hardcodes the tenant networking
type to vxlan which is naturally problematic. It also lacks the
ability to set the necessary constraints for vlan networking
which are added for vxlan networking.

This patch enables the type of tenant networking to be defined
as vlan, and enables for a physical network vlan range mapping
setting to be configured which is required for a vlan to be
allocated upon network creation.

Change-Id: I55874c1ce82898e9dfb81505d8f3b14abde33579
---
 lib/neutron | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 947c491ec1..763a906e52 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -100,6 +100,17 @@ NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FIL
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
+# Network type - default vxlan, however enables vlan based jobs to override
+# using the legacy environment variable as well as a new variable in greater
+# alignment with the naming scheme of this plugin.
+NEUTRON_TENANT_NETWORK_TYPE=${NEUTRON_TENANT_NETWORK_TYPE:-vxlan}
+
+NEUTRON_TENANT_VLAN_RANGE=${NEUTRON_TENANT_VLAN_RANGE:-${TENANT_VLAN_RANGE:-100:150}}
+
+# Physical network for VLAN network usage.
+NEUTRON_PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-}
+
+
 # Additional neutron api config files
 declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
@@ -203,9 +214,8 @@ function configure_neutron_new {
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
         configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
-        # Configure VXLAN
-        # TODO(sc68cal) not hardcode?
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
+        # Configure tenant network type
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types $NEUTRON_TENANT_NETWORK_TYPE
 
         local mech_drivers="openvswitch"
         if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
@@ -217,6 +227,9 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
+        if [[ "$NEUTRON_TENANT_NETWORK_TYPE" =~ "vlan" ]] && [[ "$NEUTRON_PHYSICAL_NETWORK" != "" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vlan network_vlan_ranges ${NEUTRON_PHYSICAL_NETWORK}:${NEUTRON_TENANT_VLAN_RANGE}
+        fi
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
             neutron_ml2_extension_driver_add port_security
         fi

From b57757ae14a54e78ebd533198564d24af77c51da Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 3 Jun 2019 16:08:09 -0400
Subject: [PATCH 2492/3333] Add NOVA_NOTIFICATION_FORMAT variable

Nova change https://review.opendev.org/603079/ changed the
default configuration to send only unversioned notfications rather
than both versioned and unversioned notifications. This could break
unsuspecting downstream projects (like Watcher) whose CI jobs are
not explicitly configuring nova for the types of notifications
they need but are just relying on getting both per the previous
default of the config option.

This adds a variable which defaults to "unversioned" to match the
nova default but allows downstream CI jobs to easily configure
another value.

Needed by https://review.opendev.org/663332/

Change-Id: Ied9d50b07c368d5c2be658c744f340a8d1ee41e0
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6ce1dcc4cc..7d66b68cfb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -187,6 +187,10 @@ NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 ISCSID_DEBUG=$(trueorfalse False ISCSID_DEBUG)
 ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
 
+# Format for notifications. Nova defaults to "unversioned" since Train.
+# Other options include "versioned" and "both".
+NOVA_NOTIFICATION_FORMAT=${NOVA_NOTIFICATION_FORMAT:-unversioned}
+
 # Functions
 # ---------
 
@@ -535,6 +539,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_notification_url)
+    iniset $NOVA_CONF notifications notification_format "$NOVA_NOTIFICATION_FORMAT"
     iniset_rpc_backend nova $NOVA_CONF
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"

From 5b8656e748dca1c822556b27f51d67ab238e0721 Mon Sep 17 00:00:00 2001
From: Kenichi Omichi <ken-oomichi@wx.jp.nec.com>
Date: Tue, 18 Jun 2019 23:38:28 +0000
Subject: [PATCH 2493/3333] Remove RetryFilter from config

Since Ic0a03e89903bf925638fa26cca3dac7db710dca3 RetryFilter has been
deprecated. So we should not enable the RetryFilter on our tests.

Change-Id: I48c2c4d0714f582af8948dc88b48df1c2c62fcd2
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8220e0f10b..0a091e3e60 100644
--- a/lib/nova
+++ b/lib/nova
@@ -103,7 +103,7 @@ SCHEDULER=${SCHEDULER:-filter_scheduler}
 
 # The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-NOVA_FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 

From f7302e1af10938a0ffc259ab9bfd3919693fe36b Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Wed, 19 Jun 2019 11:49:40 -0500
Subject: [PATCH 2494/3333] Fix configuration doc block formatting

Many of the code blocks in the configuration documentation had extra
leading spaces. This resulted in the blocks being both code block
formatted as well as blockquoted in the output.

This patch removes leading spaces and some minor cleanup to get the
formatted output correct.

Change-Id: Ic4dfb49c547d51e16b673bc88d7b2b1a907e3258
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 doc/source/configuration.rst | 146 +++++++++++++++--------------------
 1 file changed, 63 insertions(+), 83 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 5e8004dc44..098e994ccd 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -224,25 +224,22 @@ check out. These may be overridden in ``local.conf`` to pull source
 from a different repo for testing, such as a Gerrit branch
 proposal. ``GIT_BASE`` points to the primary repository server.
 
-    ::
+::
 
-        NOVA_REPO=$GIT_BASE/openstack/nova.git
-        NOVA_BRANCH=master
+    NOVA_REPO=$GIT_BASE/openstack/nova.git
+    NOVA_BRANCH=master
 
 To pull a branch directly from Gerrit, get the repo and branch from
-the Gerrit review page:
-
-    ::
-
-        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
+the Gerrit review page::
 
-    The repo is the stanza following ``fetch`` and the branch is the
-    stanza following that:
+    git fetch https://review.openstack.org/p/openstack/nova \
+        refs/changes/50/5050/1 && git checkout FETCH_HEAD
 
-    ::
+The repo is the stanza following ``fetch`` and the branch is the
+stanza following that::
 
-        NOVA_REPO=https://review.openstack.org/p/openstack/nova
-        NOVA_BRANCH=refs/changes/50/5050/1
+    NOVA_REPO=https://review.openstack.org/p/openstack/nova
+    NOVA_BRANCH=refs/changes/50/5050/1
 
 
 Installation Directory
@@ -255,9 +252,9 @@ By setting it early in the ``localrc`` section you can reference it in
 later variables.  It can be useful to set it even though it is not
 changed from the default value.
 
-    ::
+::
 
-        DEST=/opt/stack
+    DEST=/opt/stack
 
 Logging
 -------
@@ -271,21 +268,21 @@ runs. It can be sent to a file in addition to the console by setting
 timestamp will be appended to the given filename for each run of
 ``stack.sh``.
 
-    ::
+::
 
-        LOGFILE=$DEST/logs/stack.sh.log
+    LOGFILE=$DEST/logs/stack.sh.log
 
 Old log files are cleaned automatically if ``LOGDAYS`` is set to the
 number of days of old log files to keep.
 
-    ::
+::
 
-        LOGDAYS=1
+    LOGDAYS=1
 
 Some coloring is used during the DevStack runs to make it easier to
 see what is going on. This can be disabled with::
 
-        LOG_COLOR=False
+    LOG_COLOR=False
 
 When using the logfile, by default logs are sent to the console and
 the file.  You can set ``VERBOSE`` to ``false`` if you only wish the
@@ -317,12 +314,12 @@ Example Logging Configuration
 For example, non-interactive installs probably wish to save output to
 a file, keep service logs and disable color in the stored files.
 
-   ::
+::
 
-       [[local|localrc]]
-       DEST=/opt/stack/
-       LOGFILE=$LOGDIR/stack.sh.log
-       LOG_COLOR=False
+   [[local|localrc]]
+   DEST=/opt/stack/
+   LOGFILE=$LOGDIR/stack.sh.log
+   LOG_COLOR=False
 
 Database Backend
 ----------------
@@ -330,12 +327,10 @@ Database Backend
 Multiple database backends are available. The available databases are defined
 in the lib/databases directory.
 ``mysql`` is the default database, choose a different one by putting the
-following in the ``localrc`` section:
-
-   ::
+following in the ``localrc`` section::
 
-      disable_service mysql
-      enable_service postgresql
+  disable_service mysql
+  enable_service postgresql
 
 ``mysql`` is the default database.
 
@@ -347,11 +342,9 @@ backends may be available via external plugins.  Enabling or disabling
 RabbitMQ is handled via the usual service functions and
 ``ENABLED_SERVICES``.
 
-Example disabling RabbitMQ in ``local.conf``:
+Example disabling RabbitMQ in ``local.conf``::
 
-::
-
-    disable_service rabbit
+  disable_service rabbit
 
 
 Apache Frontend
@@ -370,34 +363,23 @@ override toggle available that can be set in your ``local.conf``.
 
 Keystone is run under Apache with ``mod_wsgi`` by default.
 
-Example (Keystone)
-
-::
+Example (Keystone)::
 
     KEYSTONE_USE_MOD_WSGI="True"
 
-Example (Nova):
-
-::
+Example (Nova)::
 
     NOVA_USE_MOD_WSGI="True"
 
-Example (Swift):
-
-::
+Example (Swift)::
 
     SWIFT_USE_MOD_WSGI="True"
 
-Example (Heat):
-
-::
+Example (Heat)::
 
     HEAT_USE_MOD_WSGI="True"
 
-
-Example (Cinder):
-
-::
+Example (Cinder)::
 
     CINDER_USE_MOD_WSGI="True"
 
@@ -413,9 +395,9 @@ system you can have devstack install it from upstream, or from local
 git trees by specifying it in ``LIBS_FROM_GIT``.  Multiple libraries
 can be specified as a comma separated list.
 
-   ::
+::
 
-      LIBS_FROM_GIT=python-keystoneclient,oslo.config
+  LIBS_FROM_GIT=python-keystoneclient,oslo.config
 
 Setting the variable to ``ALL`` will activate the download for all
 libraries.
@@ -431,9 +413,9 @@ Each entry in the ``PROJECT_VENV`` array contains the directory name
 of a venv to be used for the project.  The array index is the project
 name.  Multiple projects can use the same venv if desired.
 
-  ::
+::
 
-    PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
+  PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
 
 ``ADDITIONAL_VENV_PACKAGES`` is a comma-separated list of additional
 packages to be installed into each venv.  Often projects will not have
@@ -442,9 +424,9 @@ are 'optional' requirements, i.e. only needed for certain
 configurations.  By default, the enabled databases will have their
 Python bindings added when they are enabled.
 
-  ::
+::
 
-     ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
+  ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
 Use python3
 ------------
@@ -453,9 +435,9 @@ By default ``stack.sh`` uses python2 (the exact version set by the
 ``PYTHON2_VERSION``). This can be overriden so devstack will run
 python3 (the exact version set by ``PYTHON3_VERSION``).
 
-  ::
+::
 
-     USE_PYTHON3=True
+  USE_PYTHON3=True
 
 A clean install every time
 --------------------------
@@ -465,9 +447,9 @@ exist in ``$DEST``. ``stack.sh`` will freshen each repo on each run if
 ``RECLONE`` is set to ``yes``. This avoids having to manually remove
 repos in order to get the current branch from ``$GIT_BASE``.
 
-    ::
+::
 
-        RECLONE=yes
+  RECLONE=yes
 
 Upgrade packages installed by pip
 ---------------------------------
@@ -478,9 +460,9 @@ requirement. If ``PIP_UPGRADE`` is set to ``True`` then existing
 required Python packages will be upgraded to the most recent version
 that matches requirements.
 
-    ::
+::
 
-        PIP_UPGRADE=True
+  PIP_UPGRADE=True
 
 Guest Images
 ------------
@@ -494,11 +476,11 @@ their testing-requirements in ``stack.sh``.  Setting
 these default images; in that case, you will want to populate
 ``IMAGE_URLS`` with sufficient images to satisfy testing-requirements.
 
-    ::
+::
 
-        DOWNLOAD_DEFAULT_IMAGES=False
-        IMAGE_URLS="http://foo.bar.com/image.qcow,"
-        IMAGE_URLS+="http://foo.bar.com/image2.qcow"
+  DOWNLOAD_DEFAULT_IMAGES=False
+  IMAGE_URLS="http://foo.bar.com/image.qcow,"
+  IMAGE_URLS+="http://foo.bar.com/image2.qcow"
 
 
 Instance Type
@@ -517,9 +499,9 @@ KVM on Power with QEMU 2.4 requires 512 MB to load the firmware -
 running instances on ppc64/ppc64le can choose one of the default
 created flavors as follows:
 
-    ::
+::
 
-        DEFAULT_INSTANCE_TYPE=m1.tiny
+  DEFAULT_INSTANCE_TYPE=m1.tiny
 
 
 IP Version
@@ -530,19 +512,19 @@ IPv4, IPv6, or dual-stack self-service project data-network by with
 either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
 respectively.
 
-    ::
+::
 
-        IP_VERSION=4+6
+  IP_VERSION=4+6
 
 The following optional variables can be used to alter the default IPv6
 behavior:
 
-    ::
+::
 
-        IPV6_RA_MODE=slaac
-        IPV6_ADDRESS_MODE=slaac
-        IPV6_ADDRS_SAFE_TO_USE=fd$IPV6_GLOBAL_ID::/56
-        IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
+  IPV6_RA_MODE=slaac
+  IPV6_ADDRESS_MODE=slaac
+  IPV6_ADDRS_SAFE_TO_USE=fd$IPV6_GLOBAL_ID::/56
+  IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
 
 *Note*: ``IPV6_ADDRS_SAFE_TO_USE`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
 can be configured with any valid IPv6 prefix. The default values make
@@ -565,11 +547,9 @@ address.
 
 The default value for this setting is ``4``.  Dual-mode support, for
 example ``4+6`` is not currently supported.  ``HOST_IPV6`` can
-optionally be used to alter the default IPv6 address
-
-    ::
+optionally be used to alter the default IPv6 address::
 
-        HOST_IPV6=${some_local_ipv6_address}
+  HOST_IPV6=${some_local_ipv6_address}
 
 Multi-node setup
 ~~~~~~~~~~~~~~~~
@@ -671,11 +651,11 @@ set by ``VOLUME_GROUP_NAME``, the logical volume name prefix is set with
 ``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
 with ``VOLUME_BACKING_FILE_SIZE``.
 
-    ::
+::
 
-        VOLUME_GROUP_NAME="stack-volumes"
-        VOLUME_NAME_PREFIX="volume-"
-        VOLUME_BACKING_FILE_SIZE=24G
+  VOLUME_GROUP_NAME="stack-volumes"
+  VOLUME_NAME_PREFIX="volume-"
+  VOLUME_BACKING_FILE_SIZE=24G
 
 
 Keystone

From d5634c4723df4f6b597578a8588ad3730e4b5bbc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 4 Jun 2019 17:30:13 +1000
Subject: [PATCH 2495/3333] Fix plugin doc generation for opendev transition

Update the server to opendev and update paths for gitea, along with
any other references.

Switch to a blacklist where we just remove stackforge; this leaves all
the new namespaces like x/ and starlingx/ being checked.

Use a common session for checking for the plugin file which makes it a
*lot* faster.

Remove unsed "plugins" array variable

Regenerate the file

Change-Id: Ie3e615ba352a389da22e129c5c67cf6abd8cfdc8
---
 doc/source/plugin-registry.rst          | 369 ++++++++++++------------
 tools/generate-devstack-plugins-list.py |  25 +-
 tools/generate-devstack-plugins-list.sh |  10 +-
 3 files changed, 204 insertions(+), 200 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 93c16f454c..ea8c31807d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -21,189 +21,190 @@ available DevStack plugins.  This includes, but is not limited to,
 official OpenStack projects.
 
 
-====================================== ===
-Plugin Name                            URL
-====================================== ===
-almanach                               `https://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
-aodh                                   `https://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
-apmec                                  `https://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
-barbican                               `https://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
-bilean                                 `https://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
-blazar                                 `https://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
-broadview-collector                    `https://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
-castellan-ui                           `https://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
-ceilometer                             `https://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
-ceilometer-powervm                     `https://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
-cinderlib                              `https://git.openstack.org/openstack/cinderlib <https://git.openstack.org/cgit/openstack/cinderlib>`__
-cloudkitty                             `https://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
-collectd-openstack-plugins             `https://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
-congress                               `https://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
-cyborg                                 `https://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
-designate                              `https://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
-devstack-plugin-additional-pkg-repos   `https://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
-devstack-plugin-amqp1                  `https://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
-devstack-plugin-bdd                    `https://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
-devstack-plugin-ceph                   `https://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
-devstack-plugin-container              `https://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
-devstack-plugin-glusterfs              `https://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
-devstack-plugin-hdfs                   `https://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
-devstack-plugin-kafka                  `https://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
-devstack-plugin-libvirt-qemu           `https://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
-devstack-plugin-mariadb                `https://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
-devstack-plugin-nfs                    `https://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
-devstack-plugin-pika                   `https://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
-devstack-plugin-sheepdog               `https://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
-devstack-plugin-vmax                   `https://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
-devstack-plugin-zmq                    `https://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
-dragonflow                             `https://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
-drbd-devstack                          `https://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
-ec2-api                                `https://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
-freezer                                `https://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
-freezer-api                            `https://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
-freezer-tempest-plugin                 `https://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
-freezer-web-ui                         `https://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
-gce-api                                `https://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
-glare                                  `https://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
-group-based-policy                     `https://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
-gyan                                   `https://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
-heat                                   `https://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
-heat-dashboard                         `https://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
-horizon-mellanox                       `https://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
-ironic                                 `https://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
-ironic-inspector                       `https://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
-ironic-staging-drivers                 `https://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
-ironic-ui                              `https://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
-karbor                                 `https://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
-karbor-dashboard                       `https://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
-keystone                               `https://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
-kingbird                               `https://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kuryr-kubernetes                       `https://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
-kuryr-libnetwork                       `https://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
-kuryr-tempest-plugin                   `https://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
-magnum                                 `https://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
-magnum-ui                              `https://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
-manila                                 `https://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
-manila-tempest-plugin                  `https://git.openstack.org/openstack/manila-tempest-plugin <https://git.openstack.org/cgit/openstack/manila-tempest-plugin>`__
-manila-ui                              `https://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
-masakari                               `https://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
-meteos                                 `https://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
-meteos-ui                              `https://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
-mistral                                `https://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
-mixmatch                               `https://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
-mogan                                  `https://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
-mogan-ui                               `https://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
-monasca-analytics                      `https://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
-monasca-api                            `https://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
-monasca-ceilometer                     `https://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
-monasca-events-api                     `https://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
-monasca-log-api                        `https://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
-monasca-tempest-plugin                 `https://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
-monasca-transform                      `https://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
-murano                                 `https://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
-networking-6wind                       `https://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
-networking-ansible                     `https://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
-networking-arista                      `https://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
-networking-bagpipe                     `https://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
-networking-baremetal                   `https://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
-networking-bgpvpn                      `https://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
-networking-brocade                     `https://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
-networking-calico                      `https://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
-networking-cisco                       `https://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
-networking-cumulus                     `https://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
-networking-dpm                         `https://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
-networking-fortinet                    `https://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
-networking-generic-switch              `https://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
-networking-hpe                         `https://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
-networking-huawei                      `https://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
-networking-hyperv                      `https://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
-networking-infoblox                    `https://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
-networking-l2gw                        `https://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
-networking-lagopus                     `https://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
-networking-midonet                     `https://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
-networking-mlnx                        `https://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
-networking-nec                         `https://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
-networking-odl                         `https://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
-networking-omnipath                    `https://git.openstack.org/openstack/networking-omnipath <https://git.openstack.org/cgit/openstack/networking-omnipath>`__
-networking-onos                        `https://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
-networking-opencontrail                `https://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
-networking-ovn                         `https://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
-networking-ovs-dpdk                    `https://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
-networking-plumgrid                    `https://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
-networking-powervm                     `https://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
-networking-sfc                         `https://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
-networking-spp                         `https://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
-networking-vpp                         `https://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
-networking-vsphere                     `https://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
-neutron                                `https://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
-neutron-classifier                     `https://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
-neutron-dynamic-routing                `https://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
-neutron-fwaas                          `https://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
-neutron-fwaas-dashboard                `https://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
-neutron-lbaas                          `https://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
-neutron-lbaas-dashboard                `https://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
-neutron-tempest-plugin                 `https://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
-neutron-vpnaas                         `https://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-neutron-vpnaas-dashboard               `https://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
-nova-dpm                               `https://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
-nova-lxd                               `https://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
-nova-mksproxy                          `https://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
-nova-powervm                           `https://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
-oaktree                                `https://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
-octavia                                `https://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
-octavia-dashboard                      `https://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
-omni                                   `https://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
-openstacksdk                           `https://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
-os-faults                              `https://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
-os-xenapi                              `https://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
-osprofiler                             `https://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
-oswin-tempest-plugin                   `https://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
-panko                                  `https://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
-patrole                                `https://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
-picasso                                `https://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
-qinling                                `https://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
-qinling-dashboard                      `https://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
-rally                                  `https://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
-rally-openstack                        `https://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
-rsd-virt-for-nova                      `https://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
-sahara                                 `https://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
-sahara-dashboard                       `https://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
-scalpels                               `https://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
-searchlight                            `https://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
-searchlight-ui                         `https://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
-senlin                                 `https://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
-slogging                               `https://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
-solum                                  `https://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
-stackube                               `https://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
-storlets                               `https://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
-stx-config                             `https://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
-stx-fault                              `https://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
-stx-ha                                 `https://git.openstack.org/openstack/stx-ha <https://git.openstack.org/cgit/openstack/stx-ha>`__
-stx-integ                              `https://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
-stx-metal                              `https://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
-stx-nfv                                `https://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
-stx-update                             `https://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
-tacker                                 `https://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
-tap-as-a-service                       `https://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
-tap-as-a-service-dashboard             `https://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
-tatu                                   `https://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
-telemetry-tempest-plugin               `https://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
-tobiko                                 `https://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
-tricircle                              `https://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
-trio2o                                 `https://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
-trove                                  `https://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
-trove-dashboard                        `https://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
-valet                                  `https://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
-vitrage                                `https://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
-vitrage-dashboard                      `https://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
-vitrage-tempest-plugin                 `https://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
-vmware-nsx                             `https://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
-vmware-vspc                            `https://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
-watcher                                `https://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
-watcher-dashboard                      `https://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
-zaqar                                  `https://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
-zaqar-ui                               `https://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
-zun                                    `https://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
-zun-ui                                 `https://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
-====================================== ===
+======================================== ===
+Plugin Name                              URL
+======================================== ===
+openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
+openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
+openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
+openstack/ceilometer                     `https://opendev.org/openstack/ceilometer <https://opendev.org/openstack/ceilometer>`__
+openstack/ceilometer-powervm             `https://opendev.org/openstack/ceilometer-powervm <https://opendev.org/openstack/ceilometer-powervm>`__
+openstack/cinderlib                      `https://opendev.org/openstack/cinderlib <https://opendev.org/openstack/cinderlib>`__
+openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
+openstack/congress                       `https://opendev.org/openstack/congress <https://opendev.org/openstack/congress>`__
+openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
+openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
+openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
+openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
+openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
+openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
+openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
+openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
+openstack/dragonflow                     `https://opendev.org/openstack/dragonflow <https://opendev.org/openstack/dragonflow>`__
+openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
+openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
+openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
+openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
+openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
+openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
+openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
+openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
+openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
+openstack/karbor                         `https://opendev.org/openstack/karbor <https://opendev.org/openstack/karbor>`__
+openstack/karbor-dashboard               `https://opendev.org/openstack/karbor-dashboard <https://opendev.org/openstack/karbor-dashboard>`__
+openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
+openstack/kuryr-kubernetes               `https://opendev.org/openstack/kuryr-kubernetes <https://opendev.org/openstack/kuryr-kubernetes>`__
+openstack/kuryr-libnetwork               `https://opendev.org/openstack/kuryr-libnetwork <https://opendev.org/openstack/kuryr-libnetwork>`__
+openstack/kuryr-tempest-plugin           `https://opendev.org/openstack/kuryr-tempest-plugin <https://opendev.org/openstack/kuryr-tempest-plugin>`__
+openstack/magnum                         `https://opendev.org/openstack/magnum <https://opendev.org/openstack/magnum>`__
+openstack/magnum-ui                      `https://opendev.org/openstack/magnum-ui <https://opendev.org/openstack/magnum-ui>`__
+openstack/manila                         `https://opendev.org/openstack/manila <https://opendev.org/openstack/manila>`__
+openstack/manila-tempest-plugin          `https://opendev.org/openstack/manila-tempest-plugin <https://opendev.org/openstack/manila-tempest-plugin>`__
+openstack/manila-ui                      `https://opendev.org/openstack/manila-ui <https://opendev.org/openstack/manila-ui>`__
+openstack/masakari                       `https://opendev.org/openstack/masakari <https://opendev.org/openstack/masakari>`__
+openstack/mistral                        `https://opendev.org/openstack/mistral <https://opendev.org/openstack/mistral>`__
+openstack/monasca-analytics              `https://opendev.org/openstack/monasca-analytics <https://opendev.org/openstack/monasca-analytics>`__
+openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
+openstack/monasca-ceilometer             `https://opendev.org/openstack/monasca-ceilometer <https://opendev.org/openstack/monasca-ceilometer>`__
+openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
+openstack/monasca-log-api                `https://opendev.org/openstack/monasca-log-api <https://opendev.org/openstack/monasca-log-api>`__
+openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
+openstack/monasca-transform              `https://opendev.org/openstack/monasca-transform <https://opendev.org/openstack/monasca-transform>`__
+openstack/murano                         `https://opendev.org/openstack/murano <https://opendev.org/openstack/murano>`__
+openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
+openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
+openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
+openstack/networking-calico              `https://opendev.org/openstack/networking-calico <https://opendev.org/openstack/networking-calico>`__
+openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
+openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
+openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__
+openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
+openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
+openstack/networking-onos                `https://opendev.org/openstack/networking-onos <https://opendev.org/openstack/networking-onos>`__
+openstack/networking-ovn                 `https://opendev.org/openstack/networking-ovn <https://opendev.org/openstack/networking-ovn>`__
+openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
+openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
+openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
+openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
+openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__
+openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
+openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
+openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
+openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
+openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
+openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
+openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
+openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
+openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
+openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
+openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
+openstack/panko                          `https://opendev.org/openstack/panko <https://opendev.org/openstack/panko>`__
+openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
+openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__
+openstack/qinling-dashboard              `https://opendev.org/openstack/qinling-dashboard <https://opendev.org/openstack/qinling-dashboard>`__
+openstack/rally                          `https://opendev.org/openstack/rally <https://opendev.org/openstack/rally>`__
+openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
+openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
+openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
+openstack/searchlight                    `https://opendev.org/openstack/searchlight <https://opendev.org/openstack/searchlight>`__
+openstack/searchlight-ui                 `https://opendev.org/openstack/searchlight-ui <https://opendev.org/openstack/searchlight-ui>`__
+openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
+openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
+openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
+openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
+openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
+openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
+openstack/tricircle                      `https://opendev.org/openstack/tricircle <https://opendev.org/openstack/tricircle>`__
+openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
+openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
+openstack/vitrage                        `https://opendev.org/openstack/vitrage <https://opendev.org/openstack/vitrage>`__
+openstack/vitrage-dashboard              `https://opendev.org/openstack/vitrage-dashboard <https://opendev.org/openstack/vitrage-dashboard>`__
+openstack/vitrage-tempest-plugin         `https://opendev.org/openstack/vitrage-tempest-plugin <https://opendev.org/openstack/vitrage-tempest-plugin>`__
+openstack/watcher                        `https://opendev.org/openstack/watcher <https://opendev.org/openstack/watcher>`__
+openstack/watcher-dashboard              `https://opendev.org/openstack/watcher-dashboard <https://opendev.org/openstack/watcher-dashboard>`__
+openstack/zaqar                          `https://opendev.org/openstack/zaqar <https://opendev.org/openstack/zaqar>`__
+openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui <https://opendev.org/openstack/zaqar-ui>`__
+openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
+openstack/zun-ui                         `https://opendev.org/openstack/zun-ui <https://opendev.org/openstack/zun-ui>`__
+performa/os-faults                       `https://opendev.org/performa/os-faults <https://opendev.org/performa/os-faults>`__
+starlingx/config                         `https://opendev.org/starlingx/config <https://opendev.org/starlingx/config>`__
+starlingx/fault                          `https://opendev.org/starlingx/fault <https://opendev.org/starlingx/fault>`__
+starlingx/ha                             `https://opendev.org/starlingx/ha <https://opendev.org/starlingx/ha>`__
+starlingx/integ                          `https://opendev.org/starlingx/integ <https://opendev.org/starlingx/integ>`__
+starlingx/metal                          `https://opendev.org/starlingx/metal <https://opendev.org/starlingx/metal>`__
+starlingx/nfv                            `https://opendev.org/starlingx/nfv <https://opendev.org/starlingx/nfv>`__
+starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
+x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
+x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
+x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__
+x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
+x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__
+x/devstack-plugin-additional-pkg-repos   `https://opendev.org/x/devstack-plugin-additional-pkg-repos <https://opendev.org/x/devstack-plugin-additional-pkg-repos>`__
+x/devstack-plugin-bdd                    `https://opendev.org/x/devstack-plugin-bdd <https://opendev.org/x/devstack-plugin-bdd>`__
+x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-glusterfs <https://opendev.org/x/devstack-plugin-glusterfs>`__
+x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
+x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
+x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
+x/devstack-plugin-nfs                    `https://opendev.org/x/devstack-plugin-nfs <https://opendev.org/x/devstack-plugin-nfs>`__
+x/devstack-plugin-sheepdog               `https://opendev.org/x/devstack-plugin-sheepdog <https://opendev.org/x/devstack-plugin-sheepdog>`__
+x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
+x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
+x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__
+x/gce-api                                `https://opendev.org/x/gce-api <https://opendev.org/x/gce-api>`__
+x/glare                                  `https://opendev.org/x/glare <https://opendev.org/x/glare>`__
+x/group-based-policy                     `https://opendev.org/x/group-based-policy <https://opendev.org/x/group-based-policy>`__
+x/gyan                                   `https://opendev.org/x/gyan <https://opendev.org/x/gyan>`__
+x/horizon-mellanox                       `https://opendev.org/x/horizon-mellanox <https://opendev.org/x/horizon-mellanox>`__
+x/ironic-staging-drivers                 `https://opendev.org/x/ironic-staging-drivers <https://opendev.org/x/ironic-staging-drivers>`__
+x/kingbird                               `https://opendev.org/x/kingbird <https://opendev.org/x/kingbird>`__
+x/meteos                                 `https://opendev.org/x/meteos <https://opendev.org/x/meteos>`__
+x/meteos-ui                              `https://opendev.org/x/meteos-ui <https://opendev.org/x/meteos-ui>`__
+x/mixmatch                               `https://opendev.org/x/mixmatch <https://opendev.org/x/mixmatch>`__
+x/mogan                                  `https://opendev.org/x/mogan <https://opendev.org/x/mogan>`__
+x/mogan-ui                               `https://opendev.org/x/mogan-ui <https://opendev.org/x/mogan-ui>`__
+x/networking-6wind                       `https://opendev.org/x/networking-6wind <https://opendev.org/x/networking-6wind>`__
+x/networking-ansible                     `https://opendev.org/x/networking-ansible <https://opendev.org/x/networking-ansible>`__
+x/networking-arista                      `https://opendev.org/x/networking-arista <https://opendev.org/x/networking-arista>`__
+x/networking-brocade                     `https://opendev.org/x/networking-brocade <https://opendev.org/x/networking-brocade>`__
+x/networking-cisco                       `https://opendev.org/x/networking-cisco <https://opendev.org/x/networking-cisco>`__
+x/networking-cumulus                     `https://opendev.org/x/networking-cumulus <https://opendev.org/x/networking-cumulus>`__
+x/networking-dpm                         `https://opendev.org/x/networking-dpm <https://opendev.org/x/networking-dpm>`__
+x/networking-fortinet                    `https://opendev.org/x/networking-fortinet <https://opendev.org/x/networking-fortinet>`__
+x/networking-hpe                         `https://opendev.org/x/networking-hpe <https://opendev.org/x/networking-hpe>`__
+x/networking-huawei                      `https://opendev.org/x/networking-huawei <https://opendev.org/x/networking-huawei>`__
+x/networking-infoblox                    `https://opendev.org/x/networking-infoblox <https://opendev.org/x/networking-infoblox>`__
+x/networking-lagopus                     `https://opendev.org/x/networking-lagopus <https://opendev.org/x/networking-lagopus>`__
+x/networking-mlnx                        `https://opendev.org/x/networking-mlnx <https://opendev.org/x/networking-mlnx>`__
+x/networking-nec                         `https://opendev.org/x/networking-nec <https://opendev.org/x/networking-nec>`__
+x/networking-omnipath                    `https://opendev.org/x/networking-omnipath <https://opendev.org/x/networking-omnipath>`__
+x/networking-opencontrail                `https://opendev.org/x/networking-opencontrail <https://opendev.org/x/networking-opencontrail>`__
+x/networking-ovs-dpdk                    `https://opendev.org/x/networking-ovs-dpdk <https://opendev.org/x/networking-ovs-dpdk>`__
+x/networking-plumgrid                    `https://opendev.org/x/networking-plumgrid <https://opendev.org/x/networking-plumgrid>`__
+x/networking-spp                         `https://opendev.org/x/networking-spp <https://opendev.org/x/networking-spp>`__
+x/networking-vpp                         `https://opendev.org/x/networking-vpp <https://opendev.org/x/networking-vpp>`__
+x/networking-vsphere                     `https://opendev.org/x/networking-vsphere <https://opendev.org/x/networking-vsphere>`__
+x/neutron-classifier                     `https://opendev.org/x/neutron-classifier <https://opendev.org/x/neutron-classifier>`__
+x/nova-dpm                               `https://opendev.org/x/nova-dpm <https://opendev.org/x/nova-dpm>`__
+x/nova-lxd                               `https://opendev.org/x/nova-lxd <https://opendev.org/x/nova-lxd>`__
+x/nova-mksproxy                          `https://opendev.org/x/nova-mksproxy <https://opendev.org/x/nova-mksproxy>`__
+x/oaktree                                `https://opendev.org/x/oaktree <https://opendev.org/x/oaktree>`__
+x/omni                                   `https://opendev.org/x/omni <https://opendev.org/x/omni>`__
+x/os-xenapi                              `https://opendev.org/x/os-xenapi <https://opendev.org/x/os-xenapi>`__
+x/picasso                                `https://opendev.org/x/picasso <https://opendev.org/x/picasso>`__
+x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nova <https://opendev.org/x/rsd-virt-for-nova>`__
+x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
+x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
+x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
+x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
+x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
+x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
+x/tobiko                                 `https://opendev.org/x/tobiko <https://opendev.org/x/tobiko>`__
+x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
+x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
+x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
+x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
+zuul/nodepool                            `https://opendev.org/zuul/nodepool <https://opendev.org/zuul/nodepool>`__
+======================================== ===
 
 
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 56f12e7ab6..580560ccab 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -23,13 +23,14 @@
 #     working directory
 #   * network access to https://git.openstack.org/cgit
 
+import functools
 import logging
 import json
 import requests
 
 logging.basicConfig(level=logging.DEBUG)
 
-url = 'https://review.openstack.org/projects/'
+url = 'https://review.opendev.org/projects/'
 
 # This is what a project looks like
 '''
@@ -39,26 +40,30 @@
   },
 '''
 
-def is_in_openstack_namespace(proj):
-    # only interested in openstack namespace (e.g. not retired
+def is_in_wanted_namespace(proj):
+    # only interested in openstack or x namespace (e.g. not retired
     # stackforge, etc)
-    return proj.startswith('openstack/')
+    if proj.startswith('stackforge/') or \
+       proj.startswith('stackforge-attic/'):
+        return False
+    else:
+        return True
 
 # Check if this project has a plugin file
-def has_devstack_plugin(proj):
+def has_devstack_plugin(session, proj):
     # Don't link in the deb packaging repos
     if "openstack/deb-" in proj:
         return False
-    r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
+    r = session.get("https://opendev.org/%s/raw/branch/master/devstack/plugin.sh" % proj)
     return r.status_code == 200
 
 logging.debug("Getting project list from %s" % url)
 r = requests.get(url)
-projects = sorted(filter(is_in_openstack_namespace, json.loads(r.text[4:])))
+projects = sorted(filter(is_in_wanted_namespace, json.loads(r.text[4:])))
 logging.debug("Found %d projects" % len(projects))
 
-found_plugins = filter(has_devstack_plugin, projects)
+s = requests.Session()
+found_plugins = filter(functools.partial(has_devstack_plugin, s), projects)
 
 for project in found_plugins:
-    # strip of openstack/
-    print(project[10:])
+    print(project)
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 27c9c4118e..a3aa7ba63d 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -28,9 +28,9 @@
 #   * the environment variable git_dir pointing to the location
 #   * of said git repositories
 #   ) OR (
-#   * network access to the review.openstack.org Gerrit API
+#   * network access to the review.opendev.org Gerrit API
 #     working directory
-#   * network access to https://git.openstack.org/cgit
+#   * network access to https://opendev.org
 #   ))
 #
 # If a file named data/devstack-plugins-registry.header or
@@ -50,8 +50,6 @@ function title_underline {
 }
 
 (
-declare -A plugins
-
 if [[ -r data/devstack-plugins-registry.header ]]; then
     cat data/devstack-plugins-registry.header
 fi
@@ -74,8 +72,8 @@ printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
 title_underline ${name_col_len}
 
 for plugin in ${sorted_plugins}; do
-    giturl="https://git.openstack.org/openstack/${plugin}"
-    gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
+    giturl="https://opendev.org/${plugin}"
+    gitlink="https://opendev.org/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
 

From 371a25328525ac16677ad721f725e81628f9d941 Mon Sep 17 00:00:00 2001
From: Mark McClain <mark@mcclain.xyz>
Date: Tue, 7 May 2019 12:12:29 -0400
Subject: [PATCH 2496/3333] Change the GIT_BASE default to https://opendev.org

Change-Id: Ifcfce490edb3d77e4e436e002d35bc909e1a057c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 3432fb6228..4fc31a3d39 100644
--- a/stackrc
+++ b/stackrc
@@ -237,7 +237,7 @@ WSGI_MODE=${WSGI_MODE:-"uwsgi"}
 # ------------
 
 # Base GIT Repo URL
-GIT_BASE=${GIT_BASE:-https://git.openstack.org}
+GIT_BASE=${GIT_BASE:-https://opendev.org}
 
 # The location of REQUIREMENTS once cloned
 REQUIREMENTS_DIR=$DEST/requirements

From 9b6d2f20b47523ddc51349943dd76bb76d1c58d8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 18 Jun 2019 10:43:16 -0400
Subject: [PATCH 2497/3333] Update (git|review).openstack.org links to opendev

This updates links going to git.openstack.org and review.openstack.org
to go to their respective opendev locations to avoid redirects.

Change-Id: I78e3bb5303718962f591117f9c0ee11f2314b128
Closes-Bug: #1833256
---
 HACKING.rst                                  |  4 ++--
 README.rst                                   |  2 +-
 doc/source/configuration.rst                 |  6 +++---
 doc/source/faq.rst                           |  3 +--
 doc/source/guides/devstack-with-lbaas-v2.rst |  6 +++---
 doc/source/guides/lxc.rst                    |  2 +-
 doc/source/guides/multinode-lab.rst          |  2 +-
 doc/source/guides/neutron.rst                |  4 ++--
 doc/source/guides/nova.rst                   |  2 +-
 doc/source/guides/single-machine.rst         |  2 +-
 doc/source/guides/single-vm.rst              |  2 +-
 doc/source/index.rst                         |  5 ++---
 doc/source/plugins.rst                       | 15 +++++++++++----
 doc/source/zuul_ci_jobs_migration.rst        | 10 +++++-----
 inc/python                                   |  2 +-
 tools/fixup_stuff.sh                         |  2 +-
 tools/generate-devstack-plugins-list.py      |  4 ++--
 tools/install_pip.sh                         |  2 +-
 18 files changed, 40 insertions(+), 35 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index 968306a2c4..f6951064ae 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -11,7 +11,7 @@ Shell script was chosen because it best illustrates the steps used to
 set up and interact with OpenStack components.
 
 DevStack's official repository is located on git.openstack.org at
-https://git.openstack.org/openstack-dev/devstack.  Besides the master branch that
+https://opendev.org/openstack/devstack.  Besides the master branch that
 tracks the OpenStack trunk branches a separate branch is maintained for all
 OpenStack releases starting with Diablo (stable/diablo).
 
@@ -26,7 +26,7 @@ __ lp_
 .. _lp: https://launchpad.net/~devstack
 
 The `Gerrit review
-queue <https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z>`__
+queue <https://review.opendev.org/#/q/project:openstack/devstack>`__
 is used for all commits.
 
 The primary script in DevStack is ``stack.sh``, which performs the bulk of the
diff --git a/README.rst b/README.rst
index ad7ede45c5..f3a585a926 100644
--- a/README.rst
+++ b/README.rst
@@ -38,7 +38,7 @@ You can also pick specific OpenStack project releases by setting the appropriate
 `stackrc` for the default set).  Usually just before a release there will be
 milestone-proposed branches that need to be tested::
 
-    GLANCE_REPO=https://git.openstack.org/openstack/glance.git
+    GLANCE_REPO=https://opendev.org/openstack/glance.git
     GLANCE_BRANCH=milestone-proposed
 
 Start A Dev Cloud
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 098e994ccd..0105d5e636 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -205,7 +205,7 @@ Historical Notes
 Historically DevStack obtained all local configuration and
 customizations from a ``localrc`` file.  In Oct 2013 the
 ``local.conf`` configuration method was introduced (in `review 46768
-<https://review.openstack.org/#/c/46768/>`__) to simplify this
+<https://review.opendev.org/#/c/46768/>`__) to simplify this
 process.
 
 Configuration Notes
@@ -232,13 +232,13 @@ proposal. ``GIT_BASE`` points to the primary repository server.
 To pull a branch directly from Gerrit, get the repo and branch from
 the Gerrit review page::
 
-    git fetch https://review.openstack.org/p/openstack/nova \
+    git fetch https://review.opendev.org/openstack/nova \
         refs/changes/50/5050/1 && git checkout FETCH_HEAD
 
 The repo is the stanza following ``fetch`` and the branch is the
 stanza following that::
 
-    NOVA_REPO=https://review.openstack.org/p/openstack/nova
+    NOVA_REPO=https://review.opendev.org/openstack/nova
     NOVA_BRANCH=refs/changes/50/5050/1
 
 
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index efb315cbee..8214de0f6a 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -80,8 +80,7 @@ I'd like to help!
 ~~~~~~~~~~~~~~~~~
 
 That isn't a question, but please do! The source for DevStack is at
-`git.openstack.org
-<https://git.openstack.org/cgit/openstack-dev/devstack>`__ and bug
+`opendev.org <https://opendev.org/openstack/devstack>`__ and bug
 reports go to `LaunchPad
 <https://bugs.launchpad.net/devstack/>`__. Contributions follow the
 usual process as described in the `developer guide
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index db138ae2c5..07a9bb33cc 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -19,7 +19,7 @@ Install devstack
 
 ::
 
-    git clone https://git.openstack.org/openstack-dev/devstack
+    git clone https://opendev.org/openstack/devstack
     cd devstack/tools
     sudo ./create-stack-user.sh
     cd ../..
@@ -35,9 +35,9 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
 ::
 
     [[local|localrc]]
-    enable_plugin octavia https://git.openstack.org/openstack/octavia
+    enable_plugin octavia https://opendev.org/openstack/octavia
     # If you are enabling horizon, include the octavia dashboard
-    # enable_plugin octavia-dashboard https://git.openstack.org/openstack/octavia-dashboard.git
+    # enable_plugin octavia-dashboard https://opendev.org/openstack/octavia-dashboard.git
     # If you are enabling barbican for TLS offload in Octavia, include it here.
     # enable_plugin barbican https://github.com/openstack/barbican.git
 
diff --git a/doc/source/guides/lxc.rst b/doc/source/guides/lxc.rst
index 9549ed2974..dcaa4166c4 100644
--- a/doc/source/guides/lxc.rst
+++ b/doc/source/guides/lxc.rst
@@ -105,7 +105,7 @@ The commands in this section should all be run inside your container.
 
    ::
 
-       git clone https://git.openstack.org/openstack-dev/devstack
+       git clone https://opendev.org/openstack/devstack
 
 #. Configure
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 3c4acc8c7c..15f02a0e5e 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -103,7 +103,7 @@ Grab the latest version of DevStack:
 
 ::
 
-    git clone https://git.openstack.org/openstack-dev/devstack
+    git clone https://opendev.org/openstack/devstack
     cd devstack
 
 Up to this point all of the steps apply to each node in the cluster.
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 80b2f85285..2c25a1c350 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -567,7 +567,7 @@ you do not require them.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
     Q_USE_PROVIDER_NETWORKING=True
 
-    enable_plugin neutron https://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://opendev.org/openstack/neutron
 
     ## MacVTap agent options
     Q_AGENT=macvtap
@@ -622,7 +622,7 @@ For the MacVTap compute node, use this local.conf:
 
     # Services that a compute node runs
     disable_all_services
-    enable_plugin neutron https://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://opendev.org/openstack/neutron
     ENABLED_SERVICES+=n-cpu,q-agt
 
     ## MacVTap agent options
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 65491d13e8..2271e2321b 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -83,7 +83,7 @@ some fake resource inventory values and keeps track of the state of the
 compute API but is good enough for most API testing, and is also used within
 the nova functional tests themselves so is fairly robust.
 
-.. _fake virt driver: http://git.openstack.org/cgit/openstack/nova/tree/nova/virt/fake.py
+.. _fake virt driver: https://opendev.org/openstack/nova/src/branch/master/nova/virt/fake.py
 
 Configuration
 -------------
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index cfbd6b1884..a0e97edb37 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -74,7 +74,7 @@ We'll grab the latest version of DevStack via https:
 .. code-block:: console
 
     $ sudo apt-get install git -y || sudo yum install -y git
-    $ git clone https://git.openstack.org/openstack-dev/devstack
+    $ git clone https://opendev.org/openstack/devstack
     $ cd devstack
 
 Run DevStack
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 45b8f2dd89..8ebf2a638d 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -60,7 +60,7 @@ passed as the user-data file when booting the VM.
             DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
             sudo chown stack:stack /home/stack
             cd /home/stack
-            git clone https://git.openstack.org/openstack-dev/devstack
+            git clone https://opendev.org/openstack/devstack
             cd devstack
             echo '[[local|localrc]]' > local.conf
             echo ADMIN_PASSWORD=password >> local.conf
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 1ea1c5ddae..8f958585ee 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -23,8 +23,7 @@ everything from git master.  It is used interactively as a development
 environment and as the basis for much of the OpenStack project's
 functional testing.
 
-The source is available at
-`<https://git.openstack.org/cgit/openstack-dev/devstack>`__.
+The source is available at `<https://opendev.org/openstack/devstack>`__.
 
 .. warning::
 
@@ -73,7 +72,7 @@ Download DevStack
 
 .. code-block:: console
 
-   $ git clone https://git.openstack.org/openstack-dev/devstack
+   $ git clone https://opendev.org/openstack/devstack
    $ cd devstack
 
 The ``devstack`` repo contains a script that installs OpenStack and
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index b1f2397454..09ba980548 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ They are added in the following format::
 
 An example would be as follows::
 
-  enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api
+  enable_plugin ec2-api https://opendev.org/openstack/ec2-api
 
 plugin.sh contract
 ==================
@@ -264,10 +264,12 @@ integration of alternate RPC systems (e.g. zmq, qpid). In these cases
 the best practice is to build a dedicated
 ``openstack/devstack-plugin-FOO`` project.
 
+Legacy project-config jobs
+--------------------------
+
 To enable a plugin to be used in a gate job, the following lines will
 be needed in your ``jenkins/jobs/<project>.yaml`` definition in
-`project-config
-<http://git.openstack.org/cgit/openstack-infra/project-config/>`_::
+`project-config <https://opendev.org/openstack/project-config/>`_::
 
   # Because we are testing a non standard project, add the
   # our project repository. This makes zuul do the right
@@ -277,7 +279,12 @@ be needed in your ``jenkins/jobs/<project>.yaml`` definition in
   # note the actual url here is somewhat irrelevant because it
   # caches in nodepool, however make it a valid url for
   # documentation purposes.
-  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api"
+  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api https://opendev.org/openstack/ec2-api"
+
+Zuul v3 jobs
+------------
+
+See the ``devstack_plugins`` example in :doc:`zuul_ci_jobs_migration`.
 
 See Also
 ========
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 633f951d3d..dbb79893db 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -28,7 +28,7 @@ sahara Tempest plugin repo:
 
 .. code:: yaml
 
-  # In http://git.openstack.org/cgit/openstack/sahara-tests/tree/.zuul.yaml:
+  # In https://opendev.org/openstack/sahara-tests/src/branch/master/.zuul.yaml:
   - job:
       name: sahara-tests-tempest
       description: |
@@ -86,7 +86,7 @@ job.parent.
 
 .. code:: yaml
 
-  # https://git.openstack.org/cgit/openstack/kuryr-kubernetes/tree/.zuul.yaml:
+  # https://opendev.org/openstack/kuryr-kubernetes/src/branch/master/.zuul.d/base.yaml:
   - job:
       name: kuryr-kubernetes-tempest-base
       parent: devstack-tempest
@@ -110,9 +110,9 @@ job.parent.
           kuryr-kubernetes: true
           (...)
         devstack_plugins:
-          kuryr-kubernetes: https://git.openstack.org/openstack/kuryr
-          devstack-plugin-container: https://git.openstack.org/openstack/devstack-plugin-container
-          neutron-lbaas: https://git.openstack.org/openstack/neutron-lbaas
+          kuryr-kubernetes: https://opendev.org/openstack/kuryr
+          devstack-plugin-container: https://opendev.org/openstack/devstack-plugin-container
+          neutron-lbaas: https://opendev.org/openstack/neutron-lbaas
         tempest_plugins:
           - kuryr-tempest-plugin
         (...)
diff --git a/inc/python b/inc/python
index 0e575ae9e9..ea8ff67e08 100644
--- a/inc/python
+++ b/inc/python
@@ -346,7 +346,7 @@ function lib_installed_from_git {
     # The best option seems to be to use "pip list" which will tell
     # you the path an editable install was installed from; for example
     # in response to something like
-    #  pip install -e 'git+http://git.openstack.org/openstack-dev/bashate#egg=bashate'
+    #  pip install -e 'git+https://opendev.org/openstack/bashate#egg=bashate'
     # pip list --format columns shows
     #  bashate 0.5.2.dev19 /tmp/env/src/bashate
     # Thus we check the third column to see if we're installed from
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 748223902c..1fa053f457 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -255,7 +255,7 @@ function fixup_suse {
 # looking for the mirror config script before doing this, and just
 # skip it if so.
 
-# [1] https://git.openstack.org/cgit/openstack/diskimage-builder/tree/ \
+# [1] https://opendev.org/openstack/diskimage-builder/src/branch/master/ \
 #        diskimage_builder/elements/pip-and-virtualenv/ \
 #            install.d/pip-and-virtualenv-source-install/04-install-pip
 # [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 580560ccab..11062eab2b 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -19,9 +19,9 @@
 #
 # In order to function correctly, the environment in which the
 # script runs must have
-#   * network access to the review.openstack.org Gerrit API
+#   * network access to the review.opendev.org Gerrit API
 #     working directory
-#   * network access to https://git.openstack.org/cgit
+#   * network access to https://opendev.org/
 
 import functools
 import logging
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 1bd7392b9d..2b6aa4c2e8 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -35,7 +35,7 @@ FILES=$TOP_DIR/files
 # done by openstack-infra diskimage-builder elements as part of image
 # preparation [1].  This prevents any network access, which can be
 # unreliable in CI situations.
-# [1] http://git.openstack.org/cgit/openstack-infra/project-config/tree/nodepool/elements/cache-devstack/source-repository-pip
+# [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
 LOCAL_PIP="$FILES/$(basename $PIP_GET_PIP_URL)"

From 99e7445fb245deaa67d831a23c4e4ee21c13c855 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 21 Jun 2019 09:38:24 -0400
Subject: [PATCH 2498/3333] Adjust repo namespace for pbr

This is a follow up for change Ifcfce490edb3d77e4e436e002d35bc909e1a057c
where the GIT_BASE was changed to the opendev URL to avoid redirects.
The pbr namespace in stackrc was old and still getting redirected and
this change fixes that.

Change-Id: Ib444e928fa2ca7650670f97be6927202333a1dd7
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 4fc31a3d39..2661b5fa0b 100644
--- a/stackrc
+++ b/stackrc
@@ -498,7 +498,7 @@ GITREPO["tooz"]=${TOOZ_REPO:-${GIT_BASE}/openstack/tooz.git}
 GITBRANCH["tooz"]=${TOOZ_BRANCH:-$TARGET_BRANCH}
 
 # pbr drives the setuptools configs
-GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack-dev/pbr.git}
+GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack/pbr.git}
 GITBRANCH["pbr"]=${PBR_BRANCH:-$TARGET_BRANCH}
 
 

From 52c2886f7ede0e47f53b65fd1fd30f7d6ca7c086 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 20 Jun 2019 07:42:31 +0000
Subject: [PATCH 2499/3333] Add capability of adding additional network API
 extensions

Currently, devstack has NETWORK_API_EXTENSIONS var to define
the network API extensions. NETWORK_API_EXTENSIONS is defaulted
to 'all' for master and hard coded list of extensions per release.
Zuul jobs of network extensions (for example neutron-fwaas) need
add the some extra extensions in the default list. To do so, they
need to duplicate all the defaults extensions and then add the extra
extensions. Much difficult situation is when defaults extensions list
vary from release to release so they have to keep updating the
NETWORK_API_EXTENSIONS per release.

This commit defines a new var ADDITIONAL_NETWORK_API_EXTENSIONS which
will take extra extensions and append into the default list. This way
Zuul jobs do not need to duplicate the default extensions.

Change-Id: I7270c9b9e047a851970439522c0356c9089a5b74
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 9f1b677eba..3eb9803f6d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -618,6 +618,9 @@ function configure_tempest {
         # Remove disabled extensions
         network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
     fi
+    if [[ -n "$ADDITIONAL_NETWORK_API_EXTENSIONS" ]] && [[ "$network_api_extensions" != "all" ]]; then
+        network_api_extensions+=",$ADDITIONAL_NETWORK_API_EXTENSIONS"
+    fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
     # Swift API Extensions
     local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}

From 8ab64b3236c93c8449edf80165017898b83f1269 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 17 Nov 2017 19:52:29 +0100
Subject: [PATCH 2500/3333] Drop signing_dir option from
 configure_auth_token_middleware

This is no longer being used due to Keystone PKI tokens no longer
being implemented.

In order to not break backward compatibility we create a new function
that is to be used instead and deprecate the old one. Modify the old
function to ignore the 3rd argument and display a deprecation warning.
Adjust callers to no longer create and set that directory, calling the
new function instead.

Change-Id: Id0dec1ba72467cce5cacfcfdb2bc0af2bd3a3610
---
 lib/cinder         | 13 ++-----------
 lib/glance         | 24 +++---------------------
 lib/keystone       | 17 +++++++++++------
 lib/neutron        | 17 +++--------------
 lib/neutron-legacy | 14 ++------------
 lib/nova           | 13 ++-----------
 lib/placement      | 12 +-----------
 lib/swift          |  7 +------
 8 files changed, 25 insertions(+), 92 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index ed8349aad6..32e38c44da 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -51,7 +51,6 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
-CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -217,7 +216,7 @@ function configure_cinder {
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
     inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
 
-    configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
+    configure_keystone_authtoken_middleware $CINDER_CONF cinder
 
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
@@ -314,7 +313,7 @@ function configure_cinder {
     fi
 
     # Set nova credentials (used for os-assisted-snapshots)
-    configure_auth_token_middleware $CINDER_CONF nova $CINDER_AUTH_CACHE_DIR nova
+    configure_keystone_authtoken_middleware $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -380,13 +379,6 @@ function create_cinder_accounts {
     fi
 }
 
-# create_cinder_cache_dir() - Part of the init_cinder() process
-function create_cinder_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
-    rm -f $CINDER_AUTH_CACHE_DIR/*
-}
-
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     if is_service_enabled $DATABASE_BACKENDS; then
@@ -415,7 +407,6 @@ function init_cinder {
     fi
 
     mkdir -p $CINDER_STATE_PATH/volumes
-    create_cinder_cache_dir
 }
 
 # install_cinder() - Collect source and prepare
diff --git a/lib/glance b/lib/glance
index d630c9a3b0..54d3276433 100644
--- a/lib/glance
+++ b/lib/glance
@@ -44,7 +44,6 @@ fi
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
-GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -97,20 +96,14 @@ function is_glance_enabled {
 # cleanup_glance() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_glance {
-    # kill instances (nova)
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
 }
 
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
-    # We run this here as this configures cache dirs for the auth middleware
-    # which is used in the api server and not in the registry. The api
-    # Server is configured through this function and not init_glance.
-    create_glance_cache_dir
-
     # Set non-default configuration options for registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -120,7 +113,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
+    configure_keystone_authtoken_middleware $GLANCE_REGISTRY_CONF glance
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
@@ -132,7 +125,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF oslo_concurrency lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
-    configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
+    configure_keystone_authtoken_middleware $GLANCE_API_CONF glance
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -279,23 +272,12 @@ function create_glance_accounts {
     fi
 }
 
-# create_glance_cache_dir() - Part of the configure_glance() process
-function create_glance_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
-}
-
 # init_glance() - Initialize databases, etc.
 function init_glance {
     # Delete existing images
     rm -rf $GLANCE_IMAGE_DIR
     mkdir -p $GLANCE_IMAGE_DIR
 
-    # Delete existing cache
-    rm -rf $GLANCE_CACHE_DIR
-    mkdir -p $GLANCE_CACHE_DIR
-
     # (Re)create glance database
     recreate_database glance
 
diff --git a/lib/keystone b/lib/keystone
index 02e28222b7..5bd552f557 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -397,18 +397,17 @@ function create_service_user {
     fi
 }
 
-# Configure the service to use the auth token middleware.
+# Configure a service to use the auth token middleware.
 #
-# configure_auth_token_middleware conf_file admin_user signing_dir [section]
+# configure_keystone_authtoken_middleware conf_file admin_user IGNORED [section]
 #
 # section defaults to keystone_authtoken, which is where auth_token looks in
 # the .conf file. If the paste config file is used (api-paste.ini) then
 # provide the section name for the auth_token filter.
-function configure_auth_token_middleware {
+function configure_keystone_authtoken_middleware {
     local conf_file=$1
     local admin_user=$2
-    local signing_dir=$3
-    local section=${4:-keystone_authtoken}
+    local section=${3:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
@@ -419,10 +418,16 @@ function configure_auth_token_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers localhost:11211
 }
 
+# configure_auth_token_middleware conf_file admin_user IGNORED [section]
+# TODO(frickler): old function for backwards compatibility, remove in U cycle
+function configure_auth_token_middleware {
+    echo "WARNING: configure_auth_token_middleware is deprecated, use configure_keystone_authtoken_middleware instead"
+    configure_keystone_authtoken_middleware $1 $2 $4
+}
+
 # init_keystone() - Initialize databases, etc.
 function init_keystone {
     if is_service_enabled ldap; then
diff --git a/lib/neutron b/lib/neutron
index 947c491ec1..e1fd10ce1f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -36,7 +36,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
 # Distributed Virtual Router (DVR) configuration
@@ -62,7 +61,6 @@ NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
 NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
@@ -200,8 +198,8 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
-        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+        configure_keystone_authtoken_middleware $NEUTRON_CONF neutron
+        configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -292,7 +290,7 @@ function configure_neutron_new {
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
+        configure_keystone_authtoken_middleware $NEUTRON_META_CONF neutron DEFAULT
     fi
 
     # Format logging
@@ -389,13 +387,6 @@ function create_neutron_accounts_new {
     fi
 }
 
-# create_neutron_cache_dir() - Part of the init_neutron() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
@@ -405,8 +396,6 @@ function init_neutron_new {
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
     time_stop "dbsync"
-
-    create_neutron_cache_dir
 }
 
 # install_neutron() - Collect source and prepare
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 87edc5ab81..dbd6e2c06b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -71,7 +71,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
 if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
@@ -841,13 +840,13 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
 
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
-    _neutron_setup_keystone $NEUTRON_CONF keystone_authtoken
+    configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME
 
     # Configuration for neutron notifications to nova.
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -933,15 +932,6 @@ function _neutron_setup_rootwrap {
     fi
 }
 
-# Configures keystone integration for neutron service
-function _neutron_setup_keystone {
-    local conf_file=$1
-    local section=$2
-
-    create_neutron_cache_dir
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
-}
-
 function _neutron_setup_interface_driver {
 
     # ovs_use_veth needs to be set before the plugin configuration
diff --git a/lib/nova b/lib/nova
index 8220e0f10b..a394a64eef 100644
--- a/lib/nova
+++ b/lib/nova
@@ -46,7 +46,6 @@ fi
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
-NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
@@ -215,7 +214,7 @@ function cleanup_nova {
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
 
-    sudo rm -rf $NOVA_STATE_PATH $NOVA_AUTH_CACHE_DIR
+    sudo rm -rf $NOVA_STATE_PATH
 
     # NOTE(dtroyer): This really should be called from here but due to the way
     #                nova abuses the _cleanup() function we're moving it
@@ -443,7 +442,7 @@ function create_nova_conf {
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
-        configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR
+        configure_keystone_authtoken_middleware $NOVA_CONF nova
     fi
 
     if is_service_enabled cinder; then
@@ -690,13 +689,6 @@ function conductor_conf {
     echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
 }
 
-# create_nova_cache_dir() - Part of the init_nova() process
-function create_nova_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
-    rm -f $NOVA_AUTH_CACHE_DIR/*
-}
-
 # create_nova_keys_dir() - Part of the init_nova() process
 function create_nova_keys_dir {
     # Create keys dir
@@ -738,7 +730,6 @@ function init_nova {
         done
     fi
 
-    create_nova_cache_dir
     create_nova_keys_dir
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
diff --git a/lib/placement b/lib/placement
index a89cd26939..785b0ddfca 100644
--- a/lib/placement
+++ b/lib/placement
@@ -29,7 +29,6 @@ set +o xtrace
 PLACEMENT_DIR=$DEST/placement
 PLACEMENT_CONF_DIR=/etc/placement
 PLACEMENT_CONF=$PLACEMENT_CONF_DIR/placement.conf
-PLACEMENT_AUTH_CACHE_DIR=${PLACEMENT_AUTH_CACHE_DIR:-/var/cache/placement}
 PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-keystone}
 # Placement virtual environment
 if [[ ${USE_VENV} = True ]]; then
@@ -64,7 +63,6 @@ function is_placement_enabled {
 function cleanup_placement {
     sudo rm -f $(apache_site_config_for placement-api)
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
-    sudo rm -f $PLACEMENT_AUTH_CACHE_DIR/*
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files
@@ -99,7 +97,7 @@ function create_placement_conf {
     iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
     iniset $PLACEMENT_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
     iniset $PLACEMENT_CONF api auth_strategy $PLACEMENT_AUTH_STRATEGY
-    configure_auth_token_middleware $PLACEMENT_CONF placement $PLACEMENT_AUTH_CACHE_DIR
+    configure_keystone_authtoken_middleware $PLACEMENT_CONF placement
     setup_logging $PLACEMENT_CONF
 }
 
@@ -127,19 +125,11 @@ function create_placement_accounts {
         "$placement_api_url"
 }
 
-# create_placement_cache_dir() - Create directories for keystone cache
-function create_placement_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $PLACEMENT_AUTH_CACHE_DIR
-    rm -f $PLACEMENT_AUTH_CACHE_DIR/*
-}
-
 # init_placement() - Create service user and endpoints
 function init_placement {
     recreate_database placement
     $PLACEMENT_BIN_DIR/placement-manage db sync
     create_placement_accounts
-    create_placement_cache_dir
 }
 
 # install_placement() - Collect source and prepare
diff --git a/lib/swift b/lib/swift
index d9a7878652..5be9e3575e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -47,7 +47,6 @@ else
     SWIFT_BIN_DIR=$(get_python_exec_prefix)
 fi
 
-SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
@@ -452,7 +451,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
+    configure_keystone_authtoken_middleware $SWIFT_CONFIG_PROXY_SERVER swift filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
@@ -735,10 +734,6 @@ function init_swift {
         $SWIFT_BIN_DIR/swift-ring-builder container.builder rebalance 42
         $SWIFT_BIN_DIR/swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
-
-    # Create cache dir
-    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
-    rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
 function install_swift {

From 8b31dce38b630ba3ed1883bcf91a90d296ae44f2 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Fri, 21 Jun 2019 13:13:40 +0200
Subject: [PATCH 2501/3333] Fix rdo-release install

The URL for rdo-release package is version-less and redirects to latest
stable version. This becomes problematic when stacking older stable
versions as dependencies might not be met or newer and incompatibile
ones might get installed.

Closes-Bug: #1833696

Change-Id: Icb07dcb4c9a3950a3c31a3a8dcb8d0b4c713fdb1
---
 stack.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 9bda79a36b..80a7d0e7f5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -331,7 +331,13 @@ function _install_rdo {
     # Per the point above, it's a bunch of repos so starts getting a
     # little messy...
     if ! is_package_installed rdo-release ; then
-        yum_install https://rdoproject.org/repos/rdo-release.rpm
+        if [[ "$TARGET_BRANCH" == "master" ]]; then
+            yum_install https://rdoproject.org/repos/rdo-release.rpm
+        else
+            # Get latest rdo-release-$rdo_release RPM package version
+            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            yum_install https://rdoproject.org/repos/openstack-$rdo_release/rdo-release-$rdo_release.rpm
+        fi
     fi
 
     # Also enable optional for RHEL7 proper.  Note this is a silent

From 45ded1cca01bfa31dcb3ad1591125e4890d6f562 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 3 Jul 2019 06:12:23 +0000
Subject: [PATCH 2502/3333] Updated from generate-devstack-plugins-list

Change-Id: I1b4c9571b8f3dece270865fb336e73aca3a36a76
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ea8c31807d..1c1c5a5a25 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -204,7 +204,6 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
-zuul/nodepool                            `https://opendev.org/zuul/nodepool <https://opendev.org/zuul/nodepool>`__
 ======================================== ===
 
 

From d7d902f6b60298d56359a07a63b2355373e54956 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Fri, 24 May 2019 20:09:28 +0000
Subject: [PATCH 2503/3333] Configure console proxy ports in nova-cpu.conf

In change I8934d0b9392f2976347391c8a650ad260f337762, we began
configuring console proxy ports for multiple cells in the nova
controller config files to avoid "Address already in use" errors from
port collisions when running multiple cells on a single host.

This correspondingly configures the console proxy ports in the nova
compute config file based on what cell we're in, according to the
NOVA_CPU_CELL variable.

The base_url config for serial console is also added where the default
was previously used. The url is taken from the config option default in
the nova code: nova/conf/serial_console.py [1].

[1] https://github.com/openstack/nova/blob/8f00b5d/nova/conf/serial_console.py#L54

Change-Id: Id885fc5a769bce8111f1052a1b55d26be817c890
Closes-Bug: #1830417
---
 lib/nova | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index a394a64eef..18e7a7d98a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -572,23 +572,34 @@ function configure_placement_nova_compute {
 }
 
 function configure_console_compute {
+    # If we are running multiple cells (and thus multiple console proxies) on a
+    # single host, we offset the ports to avoid collisions.  We need to
+    # correspondingly configure the console proxy port for nova-compute and we
+    # can use the NOVA_CPU_CELL variable to know which cell we are for
+    # calculating the offset.
+    # Stagger the offset based on the total number of possible console proxies
+    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # all are enabled.
+    local offset
+    offset=$(((NOVA_CPU_CELL - 1) * 4))
+
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         if [ "$NOVNC_FROM_PACKAGE" == "True" ]; then
             # Use the old URL when installing novnc packages.
-            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_auto.html"}
         elif vercmp ${NOVNC_BRANCH} "<" "1.0.0"; then
-             # Use the old URL when installing older novnc source.
-            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+            # Use the old URL when installing older novnc source.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_auto.html"}
         else
             # Use the new URL when building >=v1.0.0 from source.
-            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_lite.html"}
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_lite.html"}
         fi
         iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
-        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
+        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:$((6081 + offset))/console"}
         iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
-        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:$((6082 + offset))/spice_auto.html"}
         iniset $NOVA_CPU_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
 
@@ -615,6 +626,7 @@ function configure_console_compute {
 
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CPU_CONF serial_console enabled True
+        iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6083 + offset))/"
     fi
 }
 

From 3446481a23d2c878297b4f535c7b9b44d07ed5fb Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 3 Jul 2019 13:16:04 +0000
Subject: [PATCH 2504/3333] Update docs about python-systemd pkg

The package has been renamed in order to avoid the namespace collision
with systemd, update our doc accordingly.

Change-Id: I1b9a434d9bb6a7d9dc38ef965017ed9f8773d595
Closes-Bug: 1825949
---
 doc/source/systemd.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 1bc9911879..7168768504 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -208,7 +208,8 @@ into the ``systemd`` namespace, which can cause some issues.
   the one you want.
 - ``systemd`` - a python 3 only library, not what you want.
 - ``python-systemd`` - another library you don't want. Installing it
-  on a system will break ansible's ability to run.
+  on a system will break ansible's ability to run. The package has now
+  been renamed to ``cysystemd``, which avoids the namespace collision.
 
 
 If we were using user units, the ``[Service]`` - ``Group=`` parameter

From 70fca49de75a77fd766d5b72f8757e4f7c0a7a48 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 26 Jun 2019 09:57:02 +0200
Subject: [PATCH 2505/3333] Add and switch to the newly created opensuse-15
 nodeset

opensuse-150 nodeset is referring to openSUSE 15.0, which is still in
maintenance but openSUSE 15.1 has been released already. "opensuse-15"
is going to refer to the "latest openSUSE 15.x" build released and
working for OpenStack going forward, so add this nodeset and use
it by default going forward.

Change-Id: Ic3f4d6998a66da5226bc95088d7e3c83dfe737ce
---
 .zuul.yaml | 12 ++++++------
 stack.sh   |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c516dd350..bcfd0c1a48 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -39,10 +39,10 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-opensuse-150
+    name: devstack-single-node-opensuse-15
     nodes:
       - name: controller
-        label: opensuse-150
+        label: opensuse-15
     groups:
       - name: tempest
         nodes:
@@ -532,10 +532,10 @@
     voting: false
 
 - job:
-    name: devstack-platform-opensuse-150
+    name: devstack-platform-opensuse-15
     parent: tempest-full-py3
-    description: openSUSE 15.0 platform test
-    nodeset: devstack-single-node-opensuse-150
+    description: openSUSE 15.x platform test
+    nodeset: devstack-single-node-opensuse-15
     voting: false
 
 - job:
@@ -627,7 +627,7 @@
         - devstack-ipv6:
             voting: false
         - devstack-platform-centos-7
-        - devstack-platform-opensuse-150
+        - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-xenial
         - devstack-multinode
diff --git a/stack.sh b/stack.sh
index 9bda79a36b..20938ada94 100755
--- a/stack.sh
+++ b/stack.sh
@@ -224,7 +224,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 705e9cb5dc8b63c902f588d29271686501be0c6e Mon Sep 17 00:00:00 2001
From: Vanou Ishii <ishii.vanou@fujitsu.com>
Date: Tue, 2 Jul 2019 00:40:24 -0400
Subject: [PATCH 2506/3333] Fix error in configure_nova_hypervisor with
 hardware Ironic node

Trying to deploy OpenStack environment consisting of ironic nova
hypervisor & hardware Ironic node (not VM Ironic node) with devstack
got failed.

Devstack error says error occurred while calling configure_libvirt
in configure_nova_hypervisor. This happens because libvirt related
packages are not installed when specifying "VIRT_DRIVER=ironic"
and "IRONIC_IS_HARDWARE=True".

To fix this problem, this commit add "if" statement to check
Ironic node is hardware or not using "is_ironic_hardware" function
in "function-common" file.

Change-Id: I1113478175fadec79d0f8bf6ae842ed86e5e686b
Closes-Bug: #1834985
---
 lib/nova_plugins/hypervisor-ironic | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 1279256055..9bc04e2122 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -36,7 +36,9 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    configure_libvirt
+    if ! is_ironic_hardware; then
+        configure_libvirt
+    fi
     LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
 
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver

From 764ccd07a7f30ecf6549bad618bc05ffb97fae35 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Thu, 11 Jul 2019 09:47:48 -0700
Subject: [PATCH 2507/3333] Remove Swift from default DISABLED_PYTHON3_PACKAGES

As of https://review.opendev.org/#/c/653548/ this is no longer
necessary.

Change-Id: Iab43d77c3444fa97f3339f0e5fa4ad24e87e3fd6
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 2661b5fa0b..4ac8c0338e 100644
--- a/stackrc
+++ b/stackrc
@@ -131,7 +131,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.
-export DISABLED_PYTHON3_PACKAGES="swift"
+export DISABLED_PYTHON3_PACKAGES=""
 
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that

From d51baee40d0e50675d8055cab67b262ef0fc9f1f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 12 Jul 2019 11:51:17 -0400
Subject: [PATCH 2508/3333] Add NOVA_SHUTDOWN_TIMEOUT variable

This adds a variable to control the [DEFAULT]/shutdown_timeout
config in nova to control whether or not a guest should have
a graceful shutdown of the OS or if it should just stop
immediately (no timeout). Since devstack uses CirrOS images
by default, the default value for the NOVA_SHUTDOWN_TIMEOUT
variable is 0 which should speed up tempest runs. The default
in nova.conf [1] is 60 seconds.

[1] https://docs.openstack.org/nova/latest/configuration/config.html#DEFAULT.shutdown_timeout

Change-Id: Ida83f70a1c4e61e5248f2bd42b4c24f7ac6d2310
Related-Bug: #1829896
---
 lib/nova | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index 29bce5a819..f423b570cd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -153,6 +153,11 @@ ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
 # Other options include "versioned" and "both".
 NOVA_NOTIFICATION_FORMAT=${NOVA_NOTIFICATION_FORMAT:-unversioned}
 
+# Timeout for servers to gracefully shutdown the OS during operations
+# like shelve, rescue, stop, rebuild. Defaults to 0 since the default
+# image in devstack is CirrOS.
+NOVA_SHUTDOWN_TIMEOUT=${NOVA_SHUTDOWN_TIMEOUT:-0}
+
 # Functions
 # ---------
 
@@ -401,6 +406,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
+    iniset $NOVA_CONF DEFAULT shutdown_timeout $NOVA_SHUTDOWN_TIMEOUT
 
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 

From dc01a8ab63aff1be170fb59c293ed4bddd03749a Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sun, 14 Jul 2019 22:33:13 +0200
Subject: [PATCH 2509/3333] Switch TLS tests to TLSv1.2+ only

This would more likely match a relevant production deployment.

Change-Id: I4ee2ff0c00a8e33fd069a782b32eed5fef62c01b
---
 files/apache-keystone.template | 1 +
 files/apache-neutron.template  | 1 +
 lib/tls                        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 128436027d..480fe06a9c 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -38,6 +38,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
 %SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%    SSLProtocol -all +TLSv1.3 +TLSv1.2
 %SSLLISTEN%</VirtualHost>
 
 Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
diff --git a/files/apache-neutron.template b/files/apache-neutron.template
index c7796b93bf..358e87f5da 100644
--- a/files/apache-neutron.template
+++ b/files/apache-neutron.template
@@ -24,6 +24,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
 %SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%    SSLProtocol -all +TLSv1.3 +TLSv1.2
 %SSLLISTEN%</VirtualHost>
 
 Alias /networking %NEUTRON_BIN%/neutron-api
diff --git a/lib/tls b/lib/tls
index 0032449e13..6f2a65a75b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -536,6 +536,7 @@ $listen_string
 <VirtualHost $f_host:$f_port>
     SSLEngine On
     SSLCertificateFile $DEVSTACK_CERT
+    SSLProtocol -all +TLSv1.3 +TLSv1.2
 
     # Disable KeepAlive to fix bug #1630664 a.k.a the
     # ('Connection aborted.', BadStatusLine("''",)) error

From 4106e46b2ed042ebeec533ac9022baa5d623ae06 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 24 Jul 2019 06:12:42 +0000
Subject: [PATCH 2510/3333] Updated from generate-devstack-plugins-list

Change-Id: Ie46214ed8a5a5887f04805b9157b76ebf44f9616
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1c1c5a5a25..5cbe4ed505 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -186,7 +186,6 @@ x/networking-vpp                         `https://opendev.org/x/networking-vpp <
 x/networking-vsphere                     `https://opendev.org/x/networking-vsphere <https://opendev.org/x/networking-vsphere>`__
 x/neutron-classifier                     `https://opendev.org/x/neutron-classifier <https://opendev.org/x/neutron-classifier>`__
 x/nova-dpm                               `https://opendev.org/x/nova-dpm <https://opendev.org/x/nova-dpm>`__
-x/nova-lxd                               `https://opendev.org/x/nova-lxd <https://opendev.org/x/nova-lxd>`__
 x/nova-mksproxy                          `https://opendev.org/x/nova-mksproxy <https://opendev.org/x/nova-mksproxy>`__
 x/oaktree                                `https://opendev.org/x/oaktree <https://opendev.org/x/oaktree>`__
 x/omni                                   `https://opendev.org/x/omni <https://opendev.org/x/omni>`__

From 420d3df48125a276974741a4f14a50df55184b8d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 25 Jul 2019 06:48:39 +0000
Subject: [PATCH 2511/3333] Make 'devstack-ipv6' job as voting

'devstack-ipv6' job set the devstack to deploy
the services on IPv6. As part of community goal
'Support IPv6-Only Deployments'[1], this is going
to be the base job for all project specific or tempest
IPv6 jobs. Running this as voting make sure any devstack
setting or changes would not break the IPv6 jobs.

Story: #2005477
Task: #35923

[1] https://storyboard.openstack.org/#!/story/2005477

Change-Id: Id6580e8b29b6b04e34c2c1eca3125fa08920eb1d
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2dd0b9f4ef..ee855bdf7f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -624,8 +624,7 @@
       jobs:
         - devstack
         - devstack-xenial
-        - devstack-ipv6:
-            voting: false
+        - devstack-ipv6
         - devstack-platform-centos-7
         - devstack-platform-opensuse-150
         - devstack-platform-fedora-latest
@@ -666,6 +665,7 @@
       jobs:
         - devstack
         - devstack-xenial
+        - devstack-ipv6
         - devstack-multinode
         - devstack-multinode-xenial
         - devstack-unit-tests

From b0b80d76e1b8787fbfa66aedaf700c2abe44e22d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 24 Jul 2019 10:31:27 +0000
Subject: [PATCH 2512/3333] Remove VNC server listen addresses seeting to IPv4
 from base job

'devstack' job set the VNC listen addresses 'VNCSERVER_LISTEN' and
'VNCSERVER_PROXYCLIENT_ADDRESS' IPv4 which makes 'devstack-ipv6' job
to either unset those or set for IPv6 values.

Let's remove the setting of those in base job and let lib/nova
set based on configured ip version from job.

'devstack-ipv6' base job will be used to define the IPv6-only jobs
on Tempest and project side gate.

Change-Id: Iea469128b15298aee61245e702d20603c8d376fb
Story: #2005477
Task: #35923
---
 .zuul.yaml | 4 ----
 lib/nova   | 4 ++--
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index ee855bdf7f..048d69d3e0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -382,8 +382,6 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
-        VNCSERVER_LISTEN: 0.0.0.0
-        VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -479,8 +477,6 @@
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
           NOVA_VNC_ENABLED: true
-          VNCSERVER_LISTEN: 0.0.0.0
-          VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
 
 - job:
     name: devstack-ipv6
diff --git a/lib/nova b/lib/nova
index f423b570cd..7b364a6b36 100644
--- a/lib/nova
+++ b/lib/nova
@@ -601,8 +601,8 @@ function configure_console_compute {
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS:-$NOVA_SERVICE_LOCAL_HOST}
         iniset $NOVA_CPU_CONF vnc server_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CPU_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
     else

From 352d58a7afd9e2261e639af78e4fb4c99d8f9f81 Mon Sep 17 00:00:00 2001
From: Graham Hayes <graham.hayes@hp.com>
Date: Mon, 20 Jul 2015 16:28:52 +0100
Subject: [PATCH 2513/3333] Only modify folders created by devstack

running chown and chmod on files and folders not created by
devstack causes a few issues:

* On nfs mounted directories it can take an extremely
  long time to chown -R some of the git repos, especially
  if any tox commands have been ran in the host
* chown can cause the host files to get into a weird state
  if nfs is set up wrong.

If files and folders are pre-existing we should assume
they are in the correct state, and not modify them.

Fix setup-devstack-log-dir to create the logs directory with
correct permissions in the first place.

Change-Id: I5ebdaded3ffd0a5bc70c5e9ab5b18daefb358f58
Signed-off-by: Graham Hayes <gr@ham.ie>
---
 roles/setup-devstack-log-dir/tasks/main.yaml |  3 +++
 roles/sync-devstack-data/tasks/main.yaml     | 11 +++++++++++
 stack.sh                                     | 17 +++++++++++------
 3 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/roles/setup-devstack-log-dir/tasks/main.yaml b/roles/setup-devstack-log-dir/tasks/main.yaml
index b9f38dfacb..d8e8cfe70a 100644
--- a/roles/setup-devstack-log-dir/tasks/main.yaml
+++ b/roles/setup-devstack-log-dir/tasks/main.yaml
@@ -2,4 +2,7 @@
   file:
     path: '{{ devstack_base_dir }}/logs'
     state: directory
+    mode: 0755
+    owner: stack
+    group: stack
   become: yes
diff --git a/roles/sync-devstack-data/tasks/main.yaml b/roles/sync-devstack-data/tasks/main.yaml
index e62be87ccd..a1d37c3951 100644
--- a/roles/sync-devstack-data/tasks/main.yaml
+++ b/roles/sync-devstack-data/tasks/main.yaml
@@ -46,3 +46,14 @@
     dest: "{{ devstack_data_base_dir }}/data/"
     mode: push
   when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Ensure the data folder and subfolders have the correct permissions
+  become: true
+  file:
+    path: "{{ devstack_data_base_dir }}/data"
+    state: directory
+    owner: stack
+    group: stack
+    mode: 0755
+    recurse: yes
+  when: 'inventory_hostname in groups["subnode"]|default([])'
diff --git a/stack.sh b/stack.sh
index c0216f4ce9..3c316448e1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -365,9 +365,12 @@ DEST=${DEST:-/opt/stack}
 
 # Create the destination directory and ensure it is writable by the user
 # and read/executable by everybody for daemons (e.g. apache run for horizon)
-sudo mkdir -p $DEST
-safe_chown -R $STACK_USER $DEST
-safe_chmod 0755 $DEST
+# If directory exists do not modify the permissions.
+if [[ ! -d $DEST ]]; then
+    sudo mkdir -p $DEST
+    safe_chown -R $STACK_USER $DEST
+    safe_chmod 0755 $DEST
+fi
 
 # Destination path for devstack logs
 if [[ -n ${LOGDIR:-} ]]; then
@@ -376,9 +379,11 @@ fi
 
 # Destination path for service data
 DATA_DIR=${DATA_DIR:-${DEST}/data}
-sudo mkdir -p $DATA_DIR
-safe_chown -R $STACK_USER $DATA_DIR
-safe_chmod 0755 $DATA_DIR
+if [[ ! -d $DATA_DIR ]]; then
+    sudo mkdir -p $DATA_DIR
+    safe_chown -R $STACK_USER $DATA_DIR
+    safe_chmod 0755 $DATA_DIR
+fi
 
 # Configure proper hostname
 # Certain services such as rabbitmq require that the local hostname resolves

From 97096e0a29fca0bc5194a8b5d7950bc244963267 Mon Sep 17 00:00:00 2001
From: Jan Gutter <jan.gutter@netronome.com>
Date: Fri, 26 Jul 2019 17:46:44 +0200
Subject: [PATCH 2514/3333] Fix benign epmd@0.0.0.0.socket failure

* The restart loop for rabbitmq-server can trigger socket activation
  of epmd without rabbitmq-server running. This can lead to 'systemctl
  status' reporting 'State: degraded' with no simple way to reset to
  'State: running'.
* It's important to note that this socket activation failure is benign
  and is not an indicator of system failure.

Change-Id: Iede4f5ebeffb59644dee4a17b6331b3cdd04d146
Signed-off-by: Jan Gutter <jan.gutter@netronome.com>
---
 lib/rpc_backend | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 1c7c82fcd3..743b4ae170 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -66,7 +66,12 @@ EOF
             sudo systemctl restart epmd.socket epmd.service
         fi
         if is_fedora || is_suse; then
-            sudo systemctl enable rabbitmq-server
+            # NOTE(jangutter): If rabbitmq is not running (as in a fresh
+            # install) then rabbit_setuser triggers epmd@0.0.0.0.socket with
+            # socket activation. This fails the first time and does not get
+            # cleared. It is benign, but the workaround is to start rabbitmq a
+            # bit earlier for RPM based distros.
+            sudo systemctl --now enable rabbitmq-server
         fi
     fi
 }

From 0fc6b2c5a87a1884bf3cff086081b3a253cd9302 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Tue, 30 Jul 2019 17:52:55 +0200
Subject: [PATCH 2515/3333] Update api-ref location

The api documentation is now published on docs.openstack.org instead
of developer.openstack.org. Update all links that are changed to the
new location.

Note that redirects will be set up as well but let's point now to the
new location.

For details, see:
http://lists.openstack.org/pipermail/openstack-discuss/2019-July/007828.html

Change-Id: I8a6c3403192d1416cb66cc9e92ec827b339f1270
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 07a9bb33cc..1cd85b4de9 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -6,7 +6,7 @@ providing load balancing services for OpenStack.
 
 This guide will show you how to create a devstack with `Octavia API`_ enabled.
 
-.. _Octavia API: https://developer.openstack.org/api-ref/load-balancer/v2/index.html
+.. _Octavia API: https://docs.openstack.org/api-ref/load-balancer/v2/index.html
 
 Phase 1: Create DevStack + 2 nova instances
 --------------------------------------------

From a54919180b1316b998739f8b2ba0cc4b79c6b759 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Wed, 31 Jul 2019 12:18:39 -0400
Subject: [PATCH 2516/3333] Un-quote metadata address if it is IPv6

In lib/neutron-legacy, the Nova metadata host address is
un-quoted if it is IPv6, i.e. 2001:db8::1, not [2001:db8::1].
We should be doing the same in lib/neutron.

Change-Id: I80c96603a41ef9d289712ef15b464859aa9257be
---
 lib/neutron | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index a6504e8dc2..0d23d97fcf 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -54,6 +54,7 @@ NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
 NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
+NEUTRON_META_DATA_HOST=${NEUTRON_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
 NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
@@ -296,7 +297,7 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $SERVICE_HOST
+        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $NEUTRON_META_DATA_HOST
         iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
         # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
         configure_root_helper_options $NEUTRON_META_CONF

From 99bcaf5721b89a7e74b6ac8888d82e3f83b04ef4 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 31 Jul 2019 12:39:49 +0000
Subject: [PATCH 2517/3333] Add 'tempest-ipv6-only' job on devstack gate

We recently added the 'tempest-ipv6-only' job on
tempest side which will use the devstack base job
'devstack-ipv6' job and add more verification and testing
for IPv6 deployment.

Let's add that job on devstack gate also to avoid any
break due to devstack changes.

Change-Id: Ib2c85ec262b027351872e2b5a39b06a4ba1b880a
Story: #2005477
Task: #35923
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 875aed390e..9853798963 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -657,6 +657,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - tempest-ipv6-only:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack
@@ -682,6 +686,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - tempest-ipv6-only:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.

From d33cdd01f83b891b010e0fd238f1816910f3fd77 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 1 Aug 2019 14:58:37 +0200
Subject: [PATCH 2518/3333] Add options to configure cache in nova

This patch adds new options:
* CACHE_BACKEND - with default "dogpile.cache.memcached"
* MEMCACHE_SERVERS - with default "localhost:1121"

to add possibility to configure various backends as cache in
Nova and Keystone.
It also adds options:
* KEYSTONE_ENABLE_CACHE - True by default
* NOVA_ENABLE_CACHE - True by default

To make possibility to enable and disable cache in those projects'
config files.

Default values configured there are the same as before were
hardcoded for Keystone config.

Nova has also enabled this cache by default.

Change-Id: I9082be077b59acd3a39910fa64e29147cb5c2dd7
Closes-Bug: #1836642
---
 lib/keystone |  9 ++++++---
 lib/nova     | 12 ++++++++++--
 stackrc      |  4 ++++
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 5bd552f557..9ceb829264 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -131,6 +131,9 @@ KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 # however may not be suitable for real production.
 KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 
+# Cache settings
+KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
+
 # Functions
 # ---------
 
@@ -213,9 +216,9 @@ function configure_keystone {
     iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"
 
     # Enable caching
-    iniset $KEYSTONE_CONF cache enabled "True"
-    iniset $KEYSTONE_CONF cache backend "dogpile.cache.memcached"
-    iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
+    iniset $KEYSTONE_CONF cache enabled $KEYSTONE_ENABLE_CACHE
+    iniset $KEYSTONE_CONF cache backend $CACHE_BACKEND
+    iniset $KEYSTONE_CONF cache memcache_servers $MEMCACHE_SERVERS
 
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
diff --git a/lib/nova b/lib/nova
index e3f8655b1a..0a2becb0dc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -91,6 +91,7 @@ NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
+NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
@@ -416,8 +417,8 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
-    # only setup database connections if there are services that
-    # require them running on the host. The ensures that n-cpu doesn't
+    # only setup database connections and cache backend if there are services
+    # that require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
         # If we're in multi-tier cells mode, we want our control services pointing
@@ -434,6 +435,13 @@ function create_nova_conf {
 
         iniset $NOVA_CONF database connection `database_connection_url $db`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
+
+        # Cache related settings
+        # Those settings aren't really needed in n-cpu thus it is configured
+        # only on nodes which runs controller services
+        iniset $NOVA_CONF cache enabled $NOVA_ENABLE_CACHE
+        iniset $NOVA_CONF cache backend $CACHE_BACKEND
+        iniset $NOVA_CONF cache memcache_servers $MEMCACHE_SERVERS
     fi
 
     if is_service_enabled n-api; then
diff --git a/stackrc b/stackrc
index 4ac8c0338e..10117f2700 100644
--- a/stackrc
+++ b/stackrc
@@ -770,6 +770,10 @@ ETCD_DOWNLOAD_LOCATION=$ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE
 # etcd is always required, so place it into list of pre-cached downloads
 EXTRA_CACHE_URLS+=",$ETCD_DOWNLOAD_LOCATION"
 
+# Cache settings
+CACHE_BACKEND=${CACHE_BACKEND:-"dogpile.cache.memcached"}
+MEMCACHE_SERVERS=${MEMCACHE_SERVERS:-"localhost:11211"}
+
 # Detect duplicate values in IMAGE_URLS
 for image_url in ${IMAGE_URLS//,/ }; do
     if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then

From 474f535a14598133728fedda884b437b1ce6e5e2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 8 Aug 2019 09:15:11 +1000
Subject: [PATCH 2519/3333] oscwrap: make a little quieter

A huge part of the logs is irrelevant bash aliases captured by the
openstack client timing wrapper from the run of "openstack complete",
which is only helpful on interactive systems where you'll interact
with the command line.  Call it directly to avoid capturing the logs.

While we're here, turn off tracing inside the oscwrap function, which
is called frequently.  It's not useful for debugging.

Change-Id: I1cb5399fe7ee6f0e547a9cfff70396aa2007632e
---
 functions-common | 5 +++++
 stack.sh         | 5 ++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index e234523fdd..a13d611415 100644
--- a/functions-common
+++ b/functions-common
@@ -2354,6 +2354,10 @@ function time_stop {
 }
 
 function oscwrap {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local out
     local rc
     local start
@@ -2368,6 +2372,7 @@ function oscwrap {
     echo $((end - start)) >> $OSCWRAP_TIMER_FILE
 
     echo "$out"
+    $xtrace
     return $rc
 }
 
diff --git a/stack.sh b/stack.sh
index 3c316448e1..a19799501b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1475,7 +1475,10 @@ fi
 # ===============
 
 # Prepare bash completion for OSC
-openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+# Note we use "command" to avoid the timing wrapper
+# which isn't relevant here and floods logs
+command openstack complete \
+    | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
 # If cinder is configured, set global_filter for PV devices
 if is_service_enabled cinder; then

From 6c7337e80ee10ed180df284e492d36fa1f60ebc2 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Wed, 7 Aug 2019 14:34:56 +0100
Subject: [PATCH 2520/3333] Make stop/disable of apparmor work on all SLE
 systems

The existing code to disable apparmor on SUSE systems only worked for
recent openSUSE / SLE releases.  On SLE12 (at least), aa-enabled and
aa-teardown are not available, so instead use systemd's interface for
stop/disable.  However on newer releases, systemctl stop apparmor is a
no-op:

    https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-325343
    https://gitlab.com/apparmor/apparmor/merge_requests/81
    https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/apparmor/apparmor.service?expand=1

So we still need to call aa-teardown if it's available.

Change-Id: I8d99c8d743cc1935324e2e4fcb67efaa5241199e
---
 tools/fixup_stuff.sh | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 037928f298..d7b824c048 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -230,12 +230,24 @@ function fixup_suse {
         return
     fi
 
-    # Disable apparmor profiles in openSUSE distros
-    # to avoid issues with haproxy and dnsmasq
-    if [ -x /usr/sbin/aa-enabled ] && sudo /usr/sbin/aa-enabled -q; then
-        sudo systemctl disable apparmor
+    # Deactivate and disable apparmor profiles in openSUSE and SLE
+    # distros to avoid issues with haproxy and dnsmasq.  In newer
+    # releases, systemctl stop apparmor is actually a no-op, so we
+    # have to use aa-teardown to make sure we've deactivated the
+    # profiles:
+    #
+    # https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-325343
+    # https://gitlab.com/apparmor/apparmor/merge_requests/81
+    # https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/apparmor/apparmor.service?expand=1
+    if sudo systemctl is-active -q apparmor; then
+        sudo systemctl stop apparmor
+    fi
+    if [ -x /usr/sbin/aa-teardown ]; then
         sudo /usr/sbin/aa-teardown
     fi
+    if sudo systemctl is-enabled -q apparmor; then
+        sudo systemctl disable apparmor
+    fi
 
     # Since pip10, pip will refuse to uninstall files from packages
     # that were created with distutils (rather than more modern

From 0a3288c1b40a4338df351a3fef9a346e78e12191 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Fri, 9 Aug 2019 15:57:50 +0000
Subject: [PATCH 2521/3333] Set console server host/address in nova-cpu.conf
 for multi-host

Currently, the console server host and listen address on the compute
host is always being set to localhost. This works fine in a single
node all-in-one deployment, but will not work properly when
nova-compute is running on a separate host in a multi-node deployment.

This sets the console server host and listen address on the compute
host to the nova host IP and service listen address instead of the
localhost.

Co-Authored-By: Matt Riedemann <mriedem.os@gmail.com>

Closes-Bug: #1669468

Change-Id: Id8b0b4159b98c7ff3c85ec3daa03d556d9897ce9
---
 lib/nova | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/lib/nova b/lib/nova
index 7cc408d764..fb106d7e29 100644
--- a/lib/nova
+++ b/lib/nova
@@ -88,7 +88,6 @@ NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
 NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
@@ -597,6 +596,11 @@ function configure_console_compute {
     local offset
     offset=$(((NOVA_CPU_CELL - 1) * 4))
 
+    # Use the host IP instead of the service host because for multi-node, the
+    # service host will be the controller only.
+    local default_proxyclient_addr
+    default_proxyclient_addr=$(iniget $NOVA_CPU_CONF DEFAULT my_ip)
+
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
@@ -620,8 +624,8 @@ function configure_console_compute {
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LOCAL_HOST}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS:-$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LISTEN_ADDRESS}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
         iniset $NOVA_CPU_CONF vnc server_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CPU_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
     else
@@ -631,8 +635,8 @@ function configure_console_compute {
     if is_service_enabled n-spice; then
         # Address on which instance spiceservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN:-$NOVA_SERVICE_LISTEN_ADDRESS}
         iniset $NOVA_CPU_CONF spice enabled true
         iniset $NOVA_CPU_CONF spice server_listen "$SPICESERVER_LISTEN"
         iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"

From 8dd89e52d04da2230914deceaee7c4d41e73ccc2 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sun, 11 Aug 2019 16:00:12 +0200
Subject: [PATCH 2522/3333] Update docs building

Switch to "modern" way of building docs using sphinx-build directly,
remove now unsed parts from setup.cfg.

Upgrade to openstackdocstheme 1.20 and remove obsolete variables from
conf.py.

Convert external links to internal RST links so that Sphinx can verify
that they are correct.

Replace redirected links with new targets.

Use opendev.org instead of github.com where appropriate.

Change-Id: Iedcc008b170821aa74acefc02ec6a243a0dc307c
---
 HACKING.rst                                  |  2 +-
 doc/requirements.txt                         |  2 +-
 doc/source/conf.py                           | 26 ++++----------------
 doc/source/configuration.rst                 |  4 ++-
 doc/source/guides/devstack-with-lbaas-v2.rst |  2 +-
 doc/source/guides/nova.rst                   |  4 +--
 doc/source/guides/single-vm.rst              |  2 +-
 doc/source/plugins.rst                       |  2 +-
 doc/source/systemd.rst                       |  2 +-
 doc/source/zuul_ci_jobs_migration.rst        |  2 +-
 setup.cfg                                    |  9 -------
 tools/xen/README.md                          |  2 +-
 tox.ini                                      |  3 ++-
 13 files changed, 20 insertions(+), 42 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index f6951064ae..f0bb269cb3 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -189,7 +189,7 @@ to enforce basic guidelines, similar to pep8 and flake8 tools for Python. The
 list below is not complete for what bashate checks, nor is it all checked
 by bashate.  So many lines of code, so little time.
 
-.. _bashate: https://pypi.python.org/pypi/bashate
+.. _bashate: https://pypi.org/project/bashate/
 
 Whitespace Rules
 ----------------
diff --git a/doc/requirements.txt b/doc/requirements.txt
index f65e9dfece..fffb83d96b 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -3,7 +3,7 @@ pbr>=2.0.0,!=2.1.0
 Pygments
 docutils
 sphinx>=1.6.2
-openstackdocstheme>=1.11.0
+openstackdocstheme>=1.20.0
 nwdiag
 blockdiag
 sphinxcontrib-blockdiag
diff --git a/doc/source/conf.py b/doc/source/conf.py
index e9708fae1d..9059f8c678 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -11,9 +11,6 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
-import sys
-import os
-
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
@@ -26,13 +23,16 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'sphinx.ext.autodoc', 'zuul_sphinx', 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+extensions = [ 'sphinx.ext.autodoc',
+               'zuul_sphinx',
+               'openstackdocstheme',
+               'sphinxcontrib.blockdiag',
+               'sphinxcontrib.nwdiag' ]
 
 # openstackdocstheme options
 repository_name = 'openstack-dev/devstack'
 bug_project = 'devstack'
 bug_tag = ''
-html_last_updated_fmt = '%Y-%m-%d %H:%M'
 
 todo_include_todos = True
 
@@ -119,11 +119,6 @@
 # pixels large.
 #html_favicon = None
 
-# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
-# using the given strftime format.
-git_cmd = "git log --pretty=format:'%ad, commit %h' --date=local -n1"
-html_last_updated_fmt = os.popen(git_cmd).read()
-
 # If true, SmartyPants will be used to convert quotes and dashes to
 # typographically correct entities.
 #html_use_smartypants = True
@@ -167,17 +162,6 @@
 
 # -- Options for LaTeX output --------------------------------------------------
 
-latex_elements = {
-# The paper size ('letterpaper' or 'a4paper').
-#'papersize': 'letterpaper',
-
-# The font size ('10pt', '11pt' or '12pt').
-#'pointsize': '10pt',
-
-# Additional stuff for the LaTeX preamble.
-#'preamble': '',
-}
-
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0105d5e636..45f4ffe6e9 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -259,6 +259,8 @@ changed from the default value.
 Logging
 -------
 
+.. _enable_logging:
+
 Enable Logging
 ~~~~~~~~~~~~~~
 
@@ -495,7 +497,7 @@ should be specified in the configuration file so Tempest selects the
 default flavors instead.
 
 KVM on Power with QEMU 2.4 requires 512 MB to load the firmware -
-`QEMU 2.4 - PowerPC <http://wiki.qemu.org/ChangeLog/2.4>`__ so users
+`QEMU 2.4 - PowerPC <https://wiki.qemu.org/ChangeLog/2.4>`__ so users
 running instances on ppc64/ppc64le can choose one of the default
 created flavors as follows:
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 1cd85b4de9..669a70d0bb 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -39,7 +39,7 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     # If you are enabling horizon, include the octavia dashboard
     # enable_plugin octavia-dashboard https://opendev.org/openstack/octavia-dashboard.git
     # If you are enabling barbican for TLS offload in Octavia, include it here.
-    # enable_plugin barbican https://github.com/openstack/barbican.git
+    # enable_plugin barbican https://opendev.org/openstack/barbican
 
     # If you have python3 available:
     # USE_PYTHON3=True
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 2271e2321b..5b427972c4 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -10,7 +10,7 @@ nova-serialproxy
 ================
 
 In Juno, nova implemented a `spec
-<http://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
+<https://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
 to allow read/write access to the serial console of an instance via
 `nova-serialproxy
 <https://docs.openstack.org/nova/latest/cli/nova-serialproxy.html>`_.
@@ -63,7 +63,7 @@ The service can be enabled by adding ``n-sproxy`` to
 Enabling the service is enough to be functional for a single machine DevStack.
 
 These config options are defined in `nova.conf.serial_console
-<https://github.com/openstack/nova/blob/master/nova/conf/serial_console.py>`_.
+<https://opendev.org/openstack/nova/src/master/nova/conf/serial_console.py>`_.
 
 For more information on OpenStack configuration see the `OpenStack
 Compute Service Configuration Reference
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 8ebf2a638d..7dac18b333 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -78,7 +78,7 @@ As DevStack will refuse to run as root, this configures ``cloud-init``
 to create a non-root user and run the ``start.sh`` script as that user.
 
 If you are using cloud-init and you have not
-`enabled custom logging <../configuration.html#enable-logging>`_ of the stack
+:ref:`enabled custom logging <enable_logging>` of the stack
 output, then the stack output can be found in
 ``/var/log/cloud-init-output.log`` by default.
 
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 2484569d35..a18a786c49 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -332,6 +332,6 @@ See Also
 ========
 
 For additional inspiration on devstack plugins you can check out the
-`Plugin Registry <plugin-registry.html>`_.
+:doc:`Plugin Registry <plugin-registry>`.
 
 .. _service types authority: https://specs.openstack.org/openstack/service-types-authority/
diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 1bc9911879..15b3f75660 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -194,7 +194,7 @@ Telnet to that port to enter the pdb session::
 
 See the `remote-pdb`_ home page for more options.
 
-.. _`remote-pdb`: https://pypi.python.org/pypi/remote-pdb
+.. _`remote-pdb`: https://pypi.org/project/remote-pdb/
 
 Known Issues
 ============
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index dbb79893db..ed97d4cf34 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -190,7 +190,7 @@ DEVSTACK_GATE_NET_OVERLAY                       zuul-jobs     A bridge called
                                                               br-infra is set up for
                                                               all jobs that inherit
                                                               from multinode with
-                                                              a dedicated `bridge role <https://docs.openstack.org/infra/zuul-jobs/roles.html#role-multi-node-bridge>`_.
+                                                              a dedicated `bridge role <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
 DEVSTACK_GATE_FEATURE_MATRIX                    devstack-gate ``test_matrix_features``
                                                               variable of the
                                                               test-matrix role in
diff --git a/setup.cfg b/setup.cfg
index 825d386026..4e27ad80d8 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -11,14 +11,5 @@ classifier =
     License :: OSI Approved :: Apache Software License
     Operating System :: POSIX :: Linux
 
-[build_sphinx]
-all_files = 1
-build-dir = doc/build
-source-dir = doc/source
-warning-is-error = 1
-
-[pbr]
-warnerrors = True
-
 [wheel]
 universal = 1
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 22263bb074..287301156e 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -1,3 +1,3 @@
 Note: XenServer relative tools have been moved to `os-xenapi`_ and be maintained there.
 
-.. _os-xenapi: https://github.com/openstack/os-xenapi/
+.. _os-xenapi: https://opendev.org/x/os-xenapi/
diff --git a/tox.ini b/tox.ini
index f643fdb930..d81107fe1a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -41,7 +41,8 @@ whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
 commands =
-  python setup.py build_sphinx
+  sphinx-build -W -b html -d doc/build/doctrees doc/source doc/build/html
+
 
 [testenv:venv]
 basepython = python3

From 0fe25e31a8ff40d76279e55c731fd31a93f0d21c Mon Sep 17 00:00:00 2001
From: Julia Kreger <jkreger@gmail.com>
Date: Thu, 20 Jun 2019 20:39:53 -0700
Subject: [PATCH 2523/3333] Add the IPv6 IP to the TLS cert

For some crazy reason, we've forgotten about trying
to use IPv6 addresses directly with the SSL certificates.

So lets add some logic so clients can connect directly
with the v6 IP.

Change-Id: Ie8b8a2d99945f028bebe805b83bfd863b7b72d57
---
 lib/tls | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tls b/lib/tls
index 0032449e13..65ffeb937d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -234,6 +234,9 @@ function init_cert {
                 # see https://bugs.python.org/issue23239
                 TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
             fi
+            if [[ -n "$HOST_IPV6" ]]; then
+                TLS_IP="$TLS_IP,IP:$HOST_IPV6"
+            fi
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 

From d3a2fcf48597ab7486a193567a02e650188370dc Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Tue, 13 Aug 2019 19:27:06 +0200
Subject: [PATCH 2524/3333] Use list tables

Reformat overlong table into a list-table to make it easier to edit.
The change contains no wording changes besides giving titles to the
list-tables.

Fix formatting for setup-devstack-source-dirs so that the variable does
not get displayed with a grey bar at
https://docs.openstack.org/devstack/latest/zuul_roles.html#role-setup-devstack-source-dirs

Change-Id: I7378d46c507b1d86f1d5319655a55f2a8c5a8f60
---
 doc/source/zuul_ci_jobs_migration.rst       | 256 +++++++++++---------
 roles/setup-devstack-source-dirs/README.rst |   6 +-
 2 files changed, 143 insertions(+), 119 deletions(-)

diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index ed97d4cf34..17e7e16fb7 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -180,123 +180,147 @@ the same or a similar behaviour in Zuul v3 jobs. For localrc settings,
 devstack-gate defined a default value. In ansible jobs the default is either the
 value defined in the parent job, or the default from DevStack, if any.
 
-==============================================  ============= ==================
-DevStack gate flag                              Repo          New implementation
-==============================================  ============= ==================
-OVERRIDE_ZUUL_BRANCH                            zuul          override-checkout:
-                                                              [branch]
-                                                              in the job definition.
-DEVSTACK_GATE_NET_OVERLAY                       zuul-jobs     A bridge called
-                                                              br-infra is set up for
-                                                              all jobs that inherit
-                                                              from multinode with
-                                                              a dedicated `bridge role <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
-DEVSTACK_GATE_FEATURE_MATRIX                    devstack-gate ``test_matrix_features``
-                                                              variable of the
-                                                              test-matrix role in
-                                                              devstack-gate. This
-                                                              is a temporary
-                                                              solution, feature
-                                                              matrix will go away.
-                                                              In the future services
-                                                              will be defined in
-                                                              jobs only.
-DEVSTACK_CINDER_VOLUME_CLEAR                    devstack      *CINDER_VOLUME_CLEAR: true/false*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_NEUTRON                           devstack      True by default. To
-                                                              disable, disable all
-                                                              neutron services in
-                                                              devstack_services in
-                                                              the job definition.
-DEVSTACK_GATE_CONFIGDRIVE                       devstack      *FORCE_CONFIG_DRIVE: true/false*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_INSTALL_TESTONLY                  devstack      *INSTALL_TESTONLY_PACKAGES: true/false*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_VIRT_DRIVER                       devstack      *VIRT_DRIVER: [virt driver]*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_LIBVIRT_TYPE                      devstack      *LIBVIRT_TYPE: [libvirt type]*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST                           devstack      Defined by the job
-                                                tempest       that is used. The
-                                                              ``devstack`` job only
-                                                              runs devstack.
-                                                              The ``devstack-tempest``
-                                                              one triggers a Tempest
-                                                              run as well.
-DEVSTACK_GATE_TEMPEST_FULL                      tempest       *tox_envlist: full*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_ALL                       tempest       *tox_envlist: all*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_ALL_PLUGINS               tempest       *tox_envlist: all-plugin*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_SCENARIOS                 tempest       *tox_envlist: scenario*
-                                                              in the job vars.
-TEMPEST_CONCURRENCY                             tempest       *tempest_concurrency: [value]*
-                                                              in the job vars. This
-                                                              is available only on
-                                                              jobs that inherit from
-                                                              ``devstack-tempest``
-                                                              down.
-DEVSTACK_GATE_TEMPEST_NOTESTS                   tempest       *tox_envlist: venv-tempest*
-                                                              in the job vars. This
-                                                              will create Tempest
-                                                              virtual environment
-                                                              but run no tests.
-DEVSTACK_GATE_SMOKE_SERIAL                      tempest       *tox_envlist: smoke-serial*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_DISABLE_TENANT_ISOLATION  tempest       *tox_envlist: full-serial*
-                                                              in the job vars.
-                                                              *TEMPEST_ALLOW_TENANT_ISOLATION: false*
-                                                              in devstack_localrc in
-                                                              the job vars.
-==============================================  ============= ==================
+.. list-table:: **DevStack Gate Flags**
+   :widths: 20 10 60
+   :header-rows: 1
+
+   * - DevStack gate flag
+     - Repo
+     - New implementation
+   * - OVERRIDE_ZUUL_BRANCH
+     - zuul
+     - override-checkout: [branch] in the job definition.
+   * - DEVSTACK_GATE_NET_OVERLAY
+     - zuul-jobs
+     - A bridge called br-infra is set up for all jobs that inherit
+       from multinode with a dedicated `bridge role
+       <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
+   * - DEVSTACK_GATE_FEATURE_MATRIX
+     - devstack-gate
+     - ``test_matrix_features`` variable of the test-matrix role in
+       devstack-gate. This is a temporary solution, feature matrix
+       will go away. In the future services will be defined in jobs
+       only.
+   * - DEVSTACK_CINDER_VOLUME_CLEAR
+     - devstack
+     - *CINDER_VOLUME_CLEAR: true/false* in devstack_localrc in the
+       job vars.
+   * - DEVSTACK_GATE_NEUTRON
+     - devstack
+     - True by default. To disable, disable all neutron services in
+       devstack_services in the job definition.
+   * - DEVSTACK_GATE_CONFIGDRIVE
+     - devstack
+     - *FORCE_CONFIG_DRIVE: true/false* in devstack_localrc in the job
+       vars.
+   * - DEVSTACK_GATE_INSTALL_TESTONLY
+     - devstack
+     - *INSTALL_TESTONLY_PACKAGES: true/false* in devstack_localrc in
+       the job vars.
+   * - DEVSTACK_GATE_VIRT_DRIVER
+     - devstack
+     - *VIRT_DRIVER: [virt driver]* in devstack_localrc in the job
+       vars.
+   * - DEVSTACK_GATE_LIBVIRT_TYPE
+     - devstack
+     - *LIBVIRT_TYPE: [libvirt type]* in devstack_localrc in the job
+       vars.
+   * - DEVSTACK_GATE_TEMPEST
+     - devstack and tempest
+     - Defined by the job that is used. The ``devstack`` job only runs
+       devstack. The ``devstack-tempest`` one triggers a Tempest run
+       as well.
+   * - DEVSTACK_GATE_TEMPEST_FULL
+     - tempest
+     - *tox_envlist: full* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_ALL
+     - tempest
+     - *tox_envlist: all* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_ALL_PLUGINS
+     - tempest
+     - *tox_envlist: all-plugin* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_SCENARIOS
+     - tempest
+     - *tox_envlist: scenario* in the job vars.
+   * - TEMPEST_CONCURRENCY
+     - tempest
+     - *tempest_concurrency: [value]* in the job vars. This is
+       available only on jobs that inherit from ``devstack-tempest``
+       down.
+   * - DEVSTACK_GATE_TEMPEST_NOTESTS
+     - tempest
+     - *tox_envlist: venv-tempest* in the job vars. This will create
+       Tempest virtual environment but run no tests.
+   * - DEVSTACK_GATE_SMOKE_SERIAL
+     - tempest
+     - *tox_envlist: smoke-serial* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_DISABLE_TENANT_ISOLATION
+     - tempest
+     - *tox_envlist: full-serial* in the job vars.
+       *TEMPEST_ALLOW_TENANT_ISOLATION: false* in devstack_localrc in
+       the job vars.
+
 
 The following flags have not been migrated yet or are legacy and won't be
 migrated at all.
 
-=====================================  ======  ==========================
-DevStack gate flag                     Status  Details
-=====================================  ======  ==========================
-DEVSTACK_GATE_TOPOLOGY                 WIP     The topology depends on the base
-                                               job that is used and more
-                                               specifically on the nodeset
-                                               attached to it. The new job
-                                               format allows project to define
-                                               the variables to be passed to
-                                               every node/node-group that exists
-                                               in the topology. Named topologies
-                                               that include the nodeset and the
-                                               matching variables can be defined
-                                               in the form of base jobs.
-DEVSTACK_GATE_GRENADE                  TBD     Grenade Zuul V3 jobs will be
-                                               hosted in the grenade repo.
-GRENADE_BASE_BRANCH                    TBD     Grenade Zuul V3 jobs will be
-                                               hosted in the grenade repo.
-DEVSTACK_GATE_NEUTRON_DVR              TBD     Depends on multinode support.
-DEVSTACK_GATE_EXERCISES                TBD     Can be done on request.
-DEVSTACK_GATE_IRONIC                   TBD     This will probably be implemented
-                                               on ironic side.
-DEVSTACK_GATE_IRONIC_DRIVER            TBD     This will probably be implemented
-                                               on ironic side.
-DEVSTACK_GATE_IRONIC_BUILD_RAMDISK     TBD     This will probably be implemented
-                                               on ironic side.
-DEVSTACK_GATE_POSTGRES                 Legacy  This flag exists in d-g but the
-                                               only thing that it does is
-                                               capture postgres logs. This is
-                                               already supported by the roles in
-                                               post, so the flag is useless in
-                                               the new jobs. postgres itself can
-                                               be enabled via the
-                                               devstack_service job variable.
-DEVSTACK_GATE_ZEROMQ                   Legacy  This has no effect in d-g.
-DEVSTACK_GATE_MQ_DRIVER                Legacy  This has no effect in d-g.
-DEVSTACK_GATE_TEMPEST_STRESS_ARGS      Legacy  Stress is not in Tempest anymore.
-DEVSTACK_GATE_TEMPEST_HEAT_SLOW        Legacy  This is not used anywhere.
-DEVSTACK_GATE_CELLS                    Legacy  This has no effect in d-g.
-DEVSTACK_GATE_NOVA_API_METADATA_SPLIT  Legacy  This has no effect in d-g.
-=====================================  ======  ==========================
+.. list-table:: **Not Migrated DevStack Gate Flags**
+   :widths: 20 10 60
+   :header-rows: 1
+
+   * - DevStack gate flag
+     - Status
+     - Details
+   * - DEVSTACK_GATE_TOPOLOGY
+     - WIP
+     - The topology depends on the base job that is used and more
+       specifically on the nodeset attached to it. The new job format
+       allows project to define the variables to be passed to every
+       node/node-group that exists in the topology. Named topologies
+       that include the nodeset and the matching variables can be
+       defined in the form of base jobs.
+   * - DEVSTACK_GATE_GRENADE
+     - TBD
+     - Grenade Zuul V3 jobs will be hosted in the grenade repo.
+   * - GRENADE_BASE_BRANCH
+     - TBD
+     - Grenade Zuul V3 jobs will be hosted in the grenade repo.
+   * - DEVSTACK_GATE_NEUTRON_DVR
+     - TBD
+     - Depends on multinode support.
+   * - DEVSTACK_GATE_EXERCISES
+     - TBD
+     - Can be done on request.
+   * - DEVSTACK_GATE_IRONIC
+     - TBD
+     - This will probably be implemented on ironic side.
+   * - DEVSTACK_GATE_IRONIC_DRIVER
+     - TBD
+     - This will probably be implemented on ironic side.
+   * - DEVSTACK_GATE_IRONIC_BUILD_RAMDISK
+     - TBD
+     - This will probably be implemented on ironic side.
+   * - DEVSTACK_GATE_POSTGRES
+     - Legacy
+     - This flag exists in d-g but the only thing that it does is
+       capture postgres logs. This is already supported by the roles
+       in post, so the flag is useless in the new jobs. postgres
+       itself can be enabled via the devstack_service job variable.
+   * - DEVSTACK_GATE_ZEROMQ
+     - Legacy
+     - This has no effect in d-g.
+   * - DEVSTACK_GATE_MQ_DRIVER
+     - Legacy
+     - This has no effect in d-g.
+   * - DEVSTACK_GATE_TEMPEST_STRESS_ARGS
+     - Legacy
+     - Stress is not in Tempest anymore.
+   * - DEVSTACK_GATE_TEMPEST_HEAT_SLOW
+     - Legacy
+     - This is not used anywhere.
+   * - DEVSTACK_GATE_CELLS
+     - Legacy
+     - This has no effect in d-g.
+   * - DEVSTACK_GATE_NOVA_API_METADATA_SPLIT
+     - Legacy
+     - This has no effect in d-g.
diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
index 49d22c3c64..0aa048b7d2 100644
--- a/roles/setup-devstack-source-dirs/README.rst
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -10,7 +10,7 @@ into it.
 
    The devstack base directory.
 
- .. zuul:rolevar:: devstack_sources_branch
-    :default: None
+.. zuul:rolevar:: devstack_sources_branch
+   :default: None
 
-    The target branch to be setup (where available).
+   The target branch to be setup (where available).

From 005004eded47ee840b78e6e0c94701c5bd253816 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 31 May 2019 13:50:55 -0400
Subject: [PATCH 2525/3333] Switch to fedora-29 for fedora-latest nodeset

F28 is EOL as of 5.29.19, so change to use fedora-29
and remove it from stack.sh.

Depends-on: https://review.opendev.org/#/c/662538/
Change-Id: I5ebdb68fcd01a1e63be4b3c0735a274783aad818
---
 .zuul.yaml | 2 +-
 stack.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9853798963..a01e405f0b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -52,7 +52,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-28
+        label: fedora-29
     groups:
       - name: tempest
         nodes:
diff --git a/stack.sh b/stack.sh
index 3c316448e1..10f3dc2b28 100755
--- a/stack.sh
+++ b/stack.sh
@@ -224,7 +224,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 5a30480ce188b4846a2f5c86ca38331b635d5b3b Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 16 Aug 2019 09:57:59 +0000
Subject: [PATCH 2526/3333] Update HACKING doc

Some minor updates.

Change-Id: I0d4e20e394f0fa420e896e0b1a90872ccf909b58
---
 HACKING.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index f6951064ae..78462c29bd 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -10,7 +10,7 @@ and so is limited to Bash (version 4 and up) and compatible shells.
 Shell script was chosen because it best illustrates the steps used to
 set up and interact with OpenStack components.
 
-DevStack's official repository is located on git.openstack.org at
+DevStack's official repository is located on opendev.org at
 https://opendev.org/openstack/devstack.  Besides the master branch that
 tracks the OpenStack trunk branches a separate branch is maintained for all
 OpenStack releases starting with Diablo (stable/diablo).
@@ -23,7 +23,7 @@ __ contribute_
 .. _contribute: https://docs.openstack.org/infra/manual/developers.html
 
 __ lp_
-.. _lp: https://launchpad.net/~devstack
+.. _lp: https://launchpad.net/devstack
 
 The `Gerrit review
 queue <https://review.opendev.org/#/q/project:openstack/devstack>`__
@@ -163,7 +163,7 @@ Documentation
 
 The DevStack repo now contains all of the static pages of devstack.org in
 the ``doc/source`` directory. The OpenStack CI system rebuilds the docs after every
-commit and updates devstack.org (now a redirect to docs.openstack.org/developer/devstack).
+commit and updates devstack.org (now a redirect to https://docs.openstack.org/devstack/latest/).
 
 All of the scripts are processed with shocco_ to render them with the comments
 as text describing the script below.  For this reason we tend to be a little

From d331fa7a2d027e98c08aba442c05ba54abc7d6d8 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 29 Jul 2019 10:42:24 +0000
Subject: [PATCH 2527/3333] Set cinder's my_ip based on SERVICE_IP_VERSION
 value

Devstack's lib/cinder set the my_ip on cinder side but it
hard-code it with HOST_IP[1]. It is no issue for IPv4 env
but when you build or run the IPv6 job then this ip is left
to set with IPv6. my_ip should be set to HOST_IP or HOST_IPV6
based on SERVICE_IP_VERSION value.

As part of Train community goal 'Support IPv6-Only Deployments',
we will expand the 'devstack-tempest-ipv6' job to do IPv6-only
deployments verification so we need fix the the my_ip setting.

Closes-Bug: #1838250

Depends-On: https://review.opendev.org/#/c/677524/

[1]https://github.com/openstack/devstack/blob/6aeaceb0c4ef078d028fb6605cac2a37444097d8/lib/cinder#L231

Change-Id: I71c74e46467a5d3c1bf9c7d683f364cba7cf9d80
---
 lib/cinder | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 32e38c44da..fd960535d9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -228,8 +228,11 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
-    iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
-
+    if [[ $SERVICE_IP_VERSION == 6 ]]; then
+        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IPV6"
+    else
+        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
+    fi
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 

From f1a794e1326b79aa5c5e67530f2169479b9bf1f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Harald=20Jens=C3=A5s?= <hjensas@redhat.com>
Date: Wed, 21 Aug 2019 10:49:57 +0200
Subject: [PATCH 2528/3333] flat_networks - Don't hardcode public network name

Use the PUBLIC_NETWORK_NAME variable instead of hardcoding
it when setting the [ml2_type_flat]/flat_networks option.

Change-Id: I8bfc37089ec90eb06ee41d85744dad0f3f734c16
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 0d23d97fcf..ea20e04d08 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -225,7 +225,7 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
 
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks $PUBLIC_NETWORK_NAME
         if [[ "$NEUTRON_TENANT_NETWORK_TYPE" =~ "vlan" ]] && [[ "$NEUTRON_PHYSICAL_NETWORK" != "" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vlan network_vlan_ranges ${NEUTRON_PHYSICAL_NETWORK}:${NEUTRON_TENANT_VLAN_RANGE}
         fi

From e273c0433f40ba581703dae4378a74af40410c9f Mon Sep 17 00:00:00 2001
From: Eric Fried <openstack@fried.cc>
Date: Tue, 13 Aug 2019 14:28:24 -0500
Subject: [PATCH 2529/3333] Set ksa retry conf options for n-cpu [ironic]

We're trying to get nova to talk to ironic through openstacksdk and need
to be able to specify retry limits/intervals there. We could reuse the
existing conf options, but better to support the standard ones exposed
from keystoneauth1 via [1] and [2].

Note that these will be ignored unless you have keystoneauth1 3.15.0
(for [1]) or 3.16.0 ([1] and [2]) and are building your adapter using
ksa-derived conf options (see the Needed-By).

Needed-By: https://review.opendev.org/642899

[1] https://review.opendev.org/#/c/666287/
[2] https://review.opendev.org/#/c/672930/

Change-Id: I79c416e25d635b0ffa419640b4bd91e36f78b1ab
---
 lib/nova_plugins/hypervisor-ironic | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 9bc04e2122..adcc278812 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -54,8 +54,14 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic project_name demo
     iniset $NOVA_CONF ironic region_name $REGION_NAME
 
+    # These are used with crufty legacy ironicclient
     iniset $NOVA_CONF ironic api_max_retries 300
     iniset $NOVA_CONF ironic api_retry_interval 5
+    # These are used with shiny new openstacksdk
+    iniset $NOVA_CONF ironic connect_retries 300
+    iniset $NOVA_CONF ironic connect_retry_delay 5
+    iniset $NOVA_CONF ironic status_code_retries 300
+    iniset $NOVA_CONF ironic status_code_retry_delay 5
 }
 
 # install_nova_hypervisor() - Install external components

From 2468ceaa724aa5c8c44fb87ae223eb6687ff85f2 Mon Sep 17 00:00:00 2001
From: Eric Fried <openstack@fried.cc>
Date: Thu, 25 Jul 2019 13:18:58 -0500
Subject: [PATCH 2530/3333] Merge (don't overwrite) $NOVA_CPU_CONF

Per the referenced bug, $NOVA_CPU_CONF was previously being initialized
by copying $NOVA_CONF, thereby trashing any values already configured in
$NOVA_CPU_CONF.

With this commit, we merge the values from $NOVA_CPU_CONF in after the
copy.

Note that this makes use of the merge_config_file function, which is
defined in inc/meta-config, which wasn't being sourced from every code
path that hit start_nova_compute; so this commit also moves that import
from stack.sh to functions (next to the other imports from inc/, which
makes sense anyway).

Change-Id: Id3e2baa2221e13f512f8dcf1248e1e15b6a7597f
Closes-Bug: #1802143
---
 functions | 1 +
 lib/nova  | 3 +++
 stack.sh  | 3 ---
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 93035673b5..f33fd25fee 100644
--- a/functions
+++ b/functions
@@ -18,6 +18,7 @@ declare -r -g _DEVSTACK_FUNCTIONS=1
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source ${FUNC_DIR}/functions-common
 source ${FUNC_DIR}/inc/ini-config
+source ${FUNC_DIR}/inc/meta-config
 source ${FUNC_DIR}/inc/python
 source ${FUNC_DIR}/inc/rootwrap
 
diff --git a/lib/nova b/lib/nova
index f423b570cd..1ec1a785e6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -838,7 +838,10 @@ function start_nova_compute {
 
     local compute_cell_conf=$NOVA_CONF
 
+    # Bug #1802143: $NOVA_CPU_CONF is constructed by first copying $NOVA_CONF...
     cp $compute_cell_conf $NOVA_CPU_CONF
+    # ...and then adding/overriding anything explicitly set in $NOVA_CPU_CONF
+    merge_config_file $TOP_DIR/local.conf post-config '$NOVA_CPU_CONF'
 
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
diff --git a/stack.sh b/stack.sh
index b8d597e11c..01469688eb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -167,9 +167,6 @@ LAST_SPINNER_PID=""
 # Import common functions
 source $TOP_DIR/functions
 
-# Import config functions
-source $TOP_DIR/inc/meta-config
-
 # Import 'public' stack.sh functions
 source $TOP_DIR/lib/stack
 

From f92c346131db2c89b930b1a23f8489419a2217dc Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 22 Aug 2019 12:15:09 -0400
Subject: [PATCH 2531/3333] Fix MySQL log collection

The mysql logs weren't being copied to logs and published.

Change-Id: I20740b468e4b310ac07e77f3930cae92026942fb
---
 .zuul.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9853798963..1b43611358 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -240,8 +240,7 @@
         '{{ stage_dir }}/etc': logs
         /var/log/rabbitmq: logs
         /var/log/postgresql: logs
-        /var/log/mysql.err: logs
-        /var/log/mysql.log: logs
+        /var/log/mysql: logs
         /var/log/libvirt: logs
         /etc/sudoers: logs
         /etc/sudoers.d: logs

From 28c498150d89a8a414a50ad307a79b764514e424 Mon Sep 17 00:00:00 2001
From: Szymon Datko <szymon.datko@corp.ovh.com>
Date: Thu, 22 Aug 2019 15:39:53 +0200
Subject: [PATCH 2532/3333] Select proper flavor_ref_alt for Tempest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently if user selects the default instance type for Tempest
tests, some of resize-related tests may fail due to resize attempt
into flavor with smaller disk size. It is because there is just
simple check if flavor_ref and flavor_ref_alt (IDs) aren't the same.
To ensure resize is really possible, there shall be additional
verification introduced.

Co-Authored-By: Michał Madarasz <michal.madarasz@corp.ovh.com>
Change-Id: Iaa1bfa9cb76cbe54be658d2d70d97d99e7fb5be9
---
 lib/tempest | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 4a192a0790..96c9ced14a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -130,6 +130,8 @@ function configure_tempest {
     local available_flavors
     local flavors_ref
     local flavor_lines
+    local flavor_ref_size
+    local flavor_ref_alt_size
     local public_network_id
     local public_router_id
     local ssh_connect_method="floating"
@@ -233,11 +235,24 @@ function configure_tempest {
             fi
             flavor_ref=${flavors[0]}
             flavor_ref_alt=$flavor_ref
+            flavor_ref_size=$(openstack flavor show --format value --column disk "${flavor_ref}")
 
             # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
             # Some resize instance in tempest tests depends on this.
             for f in ${flavors[@]:1}; do
                 if [[ "$f" != "$flavor_ref" ]]; then
+                    #
+                    # NOTE(sdatko): Resize is only possible when target flavor
+                    #               is not smaller than the original one. For
+                    #               Tempest tests, in case there was a bigger
+                    #               flavor selected as default, e.g. m1.small,
+                    #               we need to perform additional check.
+                    #
+                    flavor_ref_alt_size=$(openstack flavor show --format value --column disk "${f}")
+                    if [[ "${flavor_ref_alt_size}" -lt "${flavor_ref_size}" ]]; then
+                        continue
+                    fi
+
                     flavor_ref_alt=$f
                     break
                 fi

From 168ca7f0a474f1207ee01dab0ca2e70f34783e9c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Mon, 26 Aug 2019 10:11:03 +0100
Subject: [PATCH 2533/3333] Remove deprecated PostgreSQL database driver

This was deprecated for removal in Pike. It's probably time to drop it.
Note that the 'postgresql-devel'/'postgresql-server-dev-all' packages
are retained since some packages still include 'psycopg2' in their
general requirements.

Change-Id: I51e8354e99972757253ce259e6c03c91da24398c
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 doc/source/configuration.rst          |  22 ++---
 doc/source/zuul_ci_jobs_migration.rst |   5 +-
 functions                             |   3 +-
 lib/databases/postgresql              | 137 --------------------------
 stack.sh                              |   9 +-
 unstack.sh                            |   4 -
 6 files changed, 14 insertions(+), 166 deletions(-)
 delete mode 100644 lib/databases/postgresql

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 45f4ffe6e9..62571e0760 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -326,29 +326,23 @@ a file, keep service logs and disable color in the stored files.
 Database Backend
 ----------------
 
-Multiple database backends are available. The available databases are defined
-in the lib/databases directory.
-``mysql`` is the default database, choose a different one by putting the
-following in the ``localrc`` section::
+Support for the MySQL database backend is included. Addition database backends
+may be available via external plugins. Enabling of disabling MySQL is handled
+via the usual service functions and ``ENABLED_SERVICES``. For example, to
+disable MySQL in ``local.conf``::
 
   disable_service mysql
-  enable_service postgresql
-
-``mysql`` is the default database.
 
 RPC Backend
 -----------
 
-Support for a RabbitMQ RPC backend is included. Additional RPC
-backends may be available via external plugins.  Enabling or disabling
-RabbitMQ is handled via the usual service functions and
-``ENABLED_SERVICES``.
-
-Example disabling RabbitMQ in ``local.conf``::
+Support for a RabbitMQ RPC backend is included. Additional RPC backends may be
+available via external plugins.  Enabling or disabling RabbitMQ is handled via
+the usual service functions and ``ENABLED_SERVICES``. For example, to disable
+RabbitMQ in ``local.conf``::
 
   disable_service rabbit
 
-
 Apache Frontend
 ---------------
 
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 17e7e16fb7..66f8251039 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -302,10 +302,7 @@ migrated at all.
      - This will probably be implemented on ironic side.
    * - DEVSTACK_GATE_POSTGRES
      - Legacy
-     - This flag exists in d-g but the only thing that it does is
-       capture postgres logs. This is already supported by the roles
-       in post, so the flag is useless in the new jobs. postgres
-       itself can be enabled via the devstack_service job variable.
+     - This has no effect in d-g.
    * - DEVSTACK_GATE_ZEROMQ
      - Legacy
      - This has no effect in d-g.
diff --git a/functions b/functions
index f33fd25fee..8eeb03203e 100644
--- a/functions
+++ b/functions
@@ -400,7 +400,8 @@ function upload_image {
 # initialized yet, just save the configuration selection and call back later
 # to validate it.
 #
-# ``$1`` - the name of the database backend to use (mysql, postgresql, ...)
+# ``$1`` - the name of the database backend to use (only mysql is currently
+# supported)
 function use_database {
     if [[ -z "$DATABASE_BACKENDS" ]]; then
         # No backends registered means this is likely called from ``localrc``
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
deleted file mode 100644
index 618834b550..0000000000
--- a/lib/databases/postgresql
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/bin/bash
-#
-# lib/databases/postgresql
-# Functions to control the configuration and operation of the **PostgreSQL** database backend
-
-# Dependencies:
-#
-# - DATABASE_{HOST,USER,PASSWORD} must be defined
-
-# Save trace setting
-_XTRACE_PG=$(set +o | grep xtrace)
-set +o xtrace
-
-
-MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
-
-
-register_database postgresql
-
-
-# Functions
-# ---------
-
-function get_database_type_postgresql {
-    echo postgresql
-}
-
-# Get rid of everything enough to cleanly change database backends
-function cleanup_database_postgresql {
-    stop_service postgresql
-    if is_ubuntu; then
-        # Get ruthless with mysql
-        apt_get purge -y postgresql*
-        return
-    elif is_fedora || is_suse; then
-        uninstall_package postgresql-server
-    else
-        return
-    fi
-}
-
-function recreate_database_postgresql {
-    local db=$1
-    # Avoid unsightly error when calling dropdb when the database doesn't exist
-    psql -h$DATABASE_HOST -U$DATABASE_USER -dtemplate1 -c "DROP DATABASE IF EXISTS $db"
-    createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
-}
-
-function configure_database_postgresql {
-    local pg_conf pg_dir pg_hba check_role version
-    echo_summary "Configuring and starting PostgreSQL"
-    if is_fedora; then
-        pg_hba=/var/lib/pgsql/data/pg_hba.conf
-        pg_conf=/var/lib/pgsql/data/postgresql.conf
-        if ! sudo [ -e $pg_hba ]; then
-            sudo postgresql-setup initdb
-        fi
-    elif is_ubuntu; then
-        version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`
-        if vercmp $version '>=' 9.3; then
-            if [ -z "`pg_lsclusters -h`" ]; then
-                echo 'No PostgreSQL clusters exist; will create one'
-                sudo pg_createcluster $version main --start
-            fi
-        fi
-        pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
-        pg_hba=$pg_dir/pg_hba.conf
-        pg_conf=$pg_dir/postgresql.conf
-    elif is_suse; then
-        pg_hba=/var/lib/pgsql/data/pg_hba.conf
-        pg_conf=/var/lib/pgsql/data/postgresql.conf
-        # initdb is called when postgresql is first started
-        sudo [ -e $pg_hba ] || start_service postgresql
-    else
-        exit_distro_not_supported "postgresql configuration"
-    fi
-    # Listen on all addresses
-    sudo sed -i "/listen_addresses/s/.*/listen_addresses = '*'/" $pg_conf
-    # Set max_connections
-    sudo sed -i "/max_connections/s/.*/max_connections = $MAX_DB_CONNECTIONS/" $pg_conf
-    # Do password auth from all IPv4 clients
-    sudo sed -i "/^host/s/all\s\+127.0.0.1\/32\s\+ident/$DATABASE_USER\t0.0.0.0\/0\tpassword/" $pg_hba
-    # Do password auth for all IPv6 clients
-    sudo sed -i "/^host/s/all\s\+::1\/128\s\+ident/$DATABASE_USER\t::0\/0\tpassword/" $pg_hba
-    restart_service postgresql
-
-    # Create the role if it's not here or else alter it.
-    check_role=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='$DATABASE_USER'")
-    if [[ ${check_role} == *HERE ]];then
-        sudo -u root sudo -u postgres -i psql -c "ALTER ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
-    else
-        sudo -u root sudo -u postgres -i psql -c "CREATE ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
-    fi
-}
-
-function install_database_postgresql {
-    echo_summary "Installing postgresql"
-    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
-    local pgpass=$HOME/.pgpass
-    if [[ ! -e $pgpass ]]; then
-        cat <<EOF > $pgpass
-*:*:*:$DATABASE_USER:$DATABASE_PASSWORD
-EOF
-        chmod 0600 $pgpass
-    else
-        sed -i "s/:root:\w\+/:root:$DATABASE_PASSWORD/" $pgpass
-    fi
-    if is_ubuntu; then
-        install_package postgresql
-    elif is_fedora || is_suse; then
-        install_package postgresql-server
-        if is_fedora; then
-            sudo systemctl enable postgresql
-        fi
-    else
-        exit_distro_not_supported "postgresql installation"
-    fi
-}
-
-function install_database_python_postgresql {
-    # Install Python client module
-    pip_install_gr psycopg2
-    ADDITIONAL_VENV_PACKAGES+=",psycopg2"
-}
-
-function database_connection_url_postgresql {
-    local db=$1
-    echo "$BASE_SQL_CONN/$db?client_encoding=utf8"
-}
-
-
-# Restore xtrace
-$_XTRACE_PG
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/stack.sh b/stack.sh
index 9982c353c0..5064d5db1d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -695,14 +695,11 @@ function read_password {
 # Database Configuration
 # ----------------------
 
-# To select between database backends, add the following to ``local.conf``:
+# DevStack provides a MySQL database backend. Additional backends may be
+# provided by external plugins and can be enabled using the usual service
+# functions and ``ENABLED_SERVICES``. For example, to disable MySQL:
 #
 #    disable_service mysql
-#    enable_service postgresql
-#
-# The available database backends are listed in ``DATABASE_BACKENDS`` after
-# ``lib/database`` is sourced. ``mysql`` is the default.
-
 if initialize_database_backends; then
     echo "Using $DATABASE_TYPE database backend"
     # Last chance for the database password. This must be handled here
diff --git a/unstack.sh b/unstack.sh
index ccea0ef585..07dc2b1418 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -147,10 +147,6 @@ if [[ -n "$UNSTACK_ALL" ]]; then
         stop_service mysql
     fi
 
-    if is_service_enabled postgresql; then
-        stop_service postgresql
-    fi
-
     # Stop rabbitmq-server
     if is_service_enabled rabbit; then
         stop_service rabbitmq-server

From 951e14d6dd534236e2710a48fb3d86d66f5c0228 Mon Sep 17 00:00:00 2001
From: Bharat Kunwar <brtknr@bath.edu>
Date: Thu, 8 Aug 2019 16:20:19 +0000
Subject: [PATCH 2534/3333] Fix default security group in samples/local.sh

The script currently complains about multiple default security groups. This
obtains the default and uses it when creating security group rules.

Change-Id: I81e59eae5df79889ed1fb02d45af26e3a55aa0e9
---
 samples/local.sh | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/samples/local.sh b/samples/local.sh
index 9cd0bdcc17..a1c5c8143b 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -41,6 +41,13 @@ if is_service_enabled nova; then
         fi
     done
 
+    # Update security default group
+    # -----------------------------
+
+    # Add tcp/22 and icmp to default security group
+    default=$(openstack security group list -f value -c ID)
+    openstack security group rule create $default --protocol tcp --dst-port 22
+    openstack security group rule create $default --protocol icmp
 
     # Create A Flavor
     # ---------------
@@ -57,12 +64,4 @@ if is_service_enabled nova; then
         openstack flavor create $MI_NAME --id 6 --ram 128 --disk 0 --vcpus 1
     fi
 
-
-    # Other Uses
-    # ----------
-
-    # Add tcp/22 and icmp to default security group
-    openstack security group rule create --project $OS_PROJECT_NAME default --protocol tcp --ingress --dst-port 22
-    openstack security group rule create --project $OS_PROJECT_NAME default --protocol icmp
-
 fi

From 16bccbcea410ce426f83b5086424080b5bfaf925 Mon Sep 17 00:00:00 2001
From: Peter Penchev <openstack-dev@storpool.com>
Date: Mon, 9 Sep 2019 15:14:11 +0300
Subject: [PATCH 2535/3333] Revert "install LIBS_FROM_GIT using python 2 and 3
 where appropriate"

All the OpenStack projects should be able to run under Python 3 now so
the fallback installation of the Python 2 libraries should not be
needed any longer. This also avoids the problem of script files
installed by the libraries sometimes being overwritten by the Python 2
version leading to incorrect execution later, as discussed in
http://lists.openstack.org/pipermail/openstack-discuss/2019-September/009226.html

This reverts commit a2eb89417fbb6d61526b1819cbe3d0a60537eedd.

Change-Id: I1cdb7e4a209872f1620be556b7278879a4b86df5
---
 inc/python | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/inc/python b/inc/python
index ea8ff67e08..81b6a960a4 100644
--- a/inc/python
+++ b/inc/python
@@ -380,16 +380,6 @@ function setup_dev_lib {
     fi
     local name=$1
     local dir=${GITDIR[$name]}
-    if python3_enabled; then
-        # Turn off Python 3 mode and install the package again,
-        # forcing a Python 2 installation. This ensures that all libs
-        # being used for development are installed under both versions
-        # of Python.
-        echo "Installing $name again without Python 3 enabled"
-        USE_PYTHON3=False
-        setup_develop $bindep $dir
-        USE_PYTHON3=True
-    fi
     setup_develop $bindep $dir
 }
 

From ce396d374bc00f21671bcdae30e12c44cd1ef1eb Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 5 Sep 2019 08:51:33 +0000
Subject: [PATCH 2536/3333] Fix worlddump log collection

All credit for figuring this out goes to frickler (and that was the hard
bit so thank you!). The worlddump files were not being collected because
they weren't in our log collection list. Add worlddump to this list
so that we collect these files.

One thing that makes this slightly complicated is the worlddump files
are named with a timestamp and we can't have globs in our collection
list. To address this we create a copy of the file with a -latest.txt
suffix. This gives us a deterministic file name for log collection
without using globs.

Note we do not use a symlink here because some jobs gzip their log files
(breaking symlinks) and others do not. This makes it painful to always
have a valid link. Not having a valid link can break log collection.

Hardlinks may be another option but simply making a copy is easier to
manage as you don't have to worry about links preexisting and the
dumpfiles are not that large.

Change-Id: I96ae5f5290546ad25ca434c1106c01354d2d053c
---
 .zuul.yaml         | 1 +
 tools/worlddump.py | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 1b43611358..197942906f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -233,6 +233,7 @@
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
+        '{{ devstack_log_dir }}/worlddump-latest.txt': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
         '{{ stage_dir }}/apache': logs
diff --git a/tools/worlddump.py b/tools/worlddump.py
index 88af19d2e3..d1453ca076 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -25,6 +25,7 @@
 import fnmatch
 import os
 import os.path
+import shutil
 import subprocess
 import sys
 
@@ -248,6 +249,14 @@ def main():
         compute_consoles()
         guru_meditation_reports()
         var_core()
+    # Singular name for ease of log retrieval
+    copyname = os.path.join(opts.dir, 'worlddump')
+    if opts.name:
+        copyname += '-' + opts.name
+    copyname += '-latest.txt'
+    # We make a full copy to deal with jobs that may or may not
+    # gzip logs breaking symlinks.
+    shutil.copyfile(fname, copyname)
 
 
 if __name__ == '__main__':

From ba50347526ea76b501dacf774ea6f0997361358c Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Wed, 21 Nov 2018 15:28:27 +0100
Subject: [PATCH 2537/3333] Update for f29

In Fedora 29 dstat was merged with pcp-system-tools (see
https://pagure.io/fesco/issue/1956)

Work around a iscsi bug with external packages until we can get the
package fixed.

Obsolete F27

Change-Id: I2f16658c5a3e22cac70912a0f3ad65cdd7071a1e
---
 files/rpms/cinder  |  4 ++--
 files/rpms/dstat   |  3 ++-
 files/rpms/general |  4 ++--
 files/rpms/nova    |  2 +-
 files/rpms/swift   |  2 +-
 lib/nova           | 10 ++++++++++
 6 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 058c2354dc..e6b33dcc5e 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27,f28 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27,f28 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27,f28,f29 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index 0d9da4434f..b058c277cb 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,3 @@
-dstat
+dstat # not:f29
+pcp-system-tools # dist:f29
 python-psutil
diff --git a/files/rpms/general b/files/rpms/general
index c7863e4320..5bf1e9ac90 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27,f28
+iptables-services  # NOPRIME f25,f26,f27,f28,f29
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index f69fc373d7..639d793756 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27,f28
+kernel-modules # dist:f25,f26,f27,f28,f29
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index f2f5de69b0..be524d1367 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27,f28
+rsync-daemon # dist:f25,f26,f27,f28,f29
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/nova b/lib/nova
index 22f0706b3d..c8e6164916 100644
--- a/lib/nova
+++ b/lib/nova
@@ -296,6 +296,16 @@ function configure_nova {
             fi
         fi
 
+        if is_fedora; then
+            # There is an iscsi-initiator bug where it inserts
+            # different whitespace that causes a bunch of output
+            # matching to fail.  We have not been able to get
+            # fixed, yet :/  Exists in fedora 29 & 30
+            #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
+            sudo dnf copr enable -y iwienand/iscsi-initiator-utils
+            sudo dnf update -y
+        fi
+
         if [[ ${ISCSID_DEBUG} == "True" ]]; then
             # Install an override that starts iscsid with debugging
             # enabled.

From 0c9a6cab9118fd4ebcdb5277ccf66756fe4f2ec8 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 19 Sep 2019 13:57:43 +0000
Subject: [PATCH 2538/3333] Enable accept_ra before enabling forwarding

We need to enable accept_ra before we enable forwarding, otherwise
existing addresses and routes may get dropped until the next RA is
received, possibly causing connection errors in the meantime.

Change-Id: I1fdeede59547de896ed89222ecf121fd9e6b810d
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ec289f6656..69536bbe58 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -395,8 +395,6 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
@@ -409,6 +407,8 @@ function _neutron_configure_router_v6 {
             # device name would be reinterpreted as a slash, causing an error.
             sudo sysctl -w net/ipv6/conf/$d/accept_ra=2
         done
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
         IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')

From 1a46c898db9c16173013d95e2bc954992121077c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Sep 2019 08:11:08 +1000
Subject: [PATCH 2539/3333] Restrict iscsi package hack to Fedora

I forgot in I2f16658c5a3e22cac70912a0f3ad65cdd7071a1e that "is_fedora"
matches rhel/centos for historical reasons.  Restrict the install to
just the Fedora platforms by checking DISTRO matches

Change-Id: Ica4a690a4f2894a03ceb8557a947ed2ea4a60e53
---
 lib/nova | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index c8e6164916..c41f881fa1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -296,11 +296,11 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora; then
+        if is_fedora && [[ $DISTRO =~ f[0-9][0-9] ]]; then
             # There is an iscsi-initiator bug where it inserts
             # different whitespace that causes a bunch of output
             # matching to fail.  We have not been able to get
-            # fixed, yet :/  Exists in fedora 29 & 30
+            # fixed, yet :/  Exists in fedora 29 & 30 at least
             #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
             sudo dnf copr enable -y iwienand/iscsi-initiator-utils
             sudo dnf update -y

From 893817d30af5edded6cae9005ac6f00712fd787d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 25 Sep 2019 08:30:07 +1000
Subject: [PATCH 2540/3333] generate-devstack-plugins-list: Retry on
 opendev.org 500

A 500 error from gitea can occasionally show up as a project dropping
their devstack plugin (I543faced83a685d48706d004ae49800abfb89dc5).

To avoid noise in the proposal jobs, implement a small retry loop for
500 errors.

Change-Id: Ide23e4de819a2c751d887eeaa7f0b9d0437f8e2c
---
 tools/generate-devstack-plugins-list.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 11062eab2b..d39b8018ae 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -28,6 +28,9 @@
 import json
 import requests
 
+from requests.adapters import HTTPAdapter
+from requests.packages.urllib3.util.retry import Retry
+
 logging.basicConfig(level=logging.DEBUG)
 
 url = 'https://review.opendev.org/projects/'
@@ -63,6 +66,12 @@ def has_devstack_plugin(session, proj):
 logging.debug("Found %d projects" % len(projects))
 
 s = requests.Session()
+# sometimes gitea gives us a 500 error; retry sanely
+#  https://stackoverflow.com/a/35636367
+retries = Retry(total=3, backoff_factor=1,
+                status_forcelist=[ 500 ])
+s.mount('https://', HTTPAdapter(max_retries=retries))
+
 found_plugins = filter(functools.partial(has_devstack_plugin, s), projects)
 
 for project in found_plugins:

From c6f588df02bfc01bde463cb63f19f90a5935839b Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 25 Sep 2019 10:31:09 -0400
Subject: [PATCH 2541/3333] Fix target branch for pbr and diskimage-builder

The target branch was centralized in change
I82aa19e739eeda3721bac1cb5153ad0bf2d1125a but there
are two issues, pbr and diskimage-builder are using
TARGET_BRANCH which gets changed to stable/* for
each openstack stable branch that gets created for
devstack, e.g. I861068ae1a9902cef61c52c70dda7bb42f4371a0,
but pbr and diskimage-builder don't have stable branches
so they should be using BRANCHLESS_TARGET_BRANCH i.e. master.

Change-Id: I47ac7a7e194ca6d613d0ccaebfd557346644c2df
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 10117f2700..4b049413be 100644
--- a/stackrc
+++ b/stackrc
@@ -499,7 +499,7 @@ GITBRANCH["tooz"]=${TOOZ_BRANCH:-$TARGET_BRANCH}
 
 # pbr drives the setuptools configs
 GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack/pbr.git}
-GITBRANCH["pbr"]=${PBR_BRANCH:-$TARGET_BRANCH}
+GITBRANCH["pbr"]=${PBR_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 
 ##################
@@ -554,7 +554,7 @@ GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 # diskimage-builder tool
 GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
-GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-$TARGET_BRANCH}
+GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
 # neutron-lib library containing neutron stable non-REST interfaces

From 6eb2c5990d738612c4cec34daeb673092303a50a Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.de>
Date: Wed, 25 Sep 2019 12:51:23 -0700
Subject: [PATCH 2542/3333] Fix six package on opensuse for pip 10

openSUE Leap 15.0 and 15.1 both provide python3-six version 1.11.0.
Since version 1.12.0 was released, pip>=10 recognizes the version
difference and tries to uninstall the distro-provided version and fails.
This change adds another hack to remove the egg-info file for the six
library so that pip can manage it directly. We also have to wait to
install os-testr until after the fixup has happened since trying to
install it triggers the issue.

Change-Id: I4649abe06b5893a5251bfcdd4234abccde6ceda2
---
 stack.sh             | 6 +++---
 tools/fixup_stuff.sh | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 11783fd5bc..b7b37e2cf6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -796,9 +796,6 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
-# Install subunit for the subunit output stream
-pip_install -U os-testr
-
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Install Python packages into a virtualenv so that we can track them
@@ -816,6 +813,9 @@ fi
 source $TOP_DIR/tools/fixup_stuff.sh
 fixup_all
 
+# Install subunit for the subunit output stream
+pip_install -U os-testr
+
 if [[ "$USE_SYSTEMD" == "True" ]]; then
     pip_install_gr systemd-python
     # the default rate limit of 1000 messages / 30 seconds is not
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d7b824c048..d2989379fe 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -256,6 +256,7 @@ function fixup_suse {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
+    sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
 }
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From 12e5ddcc2d0058ead4de76053db698ed21d4e813 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Wed, 25 Sep 2019 12:23:16 +0900
Subject: [PATCH 2543/3333] Add PDF documentation build

This commit adds PDF documentation build target 'pdf-docs' that will
build PDF versions of our docs. As per the Train community goal:

 https://governance.openstack.org/tc/goals/selected/train/pdf-doc-generation.html

Change-Id: Iecb0fe5b957af7dae66bea04dfbd9c2fb4f74a99
Story: #2006070
Task: #35456
---
 doc/source/conf.py   | 2 +-
 doc/source/index.rst | 9 ++++-----
 tox.ini              | 8 ++++++++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 9059f8c678..56043ba6f7 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -165,7 +165,7 @@
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
-  ('index', 'DevStack-doc.tex', u'DevStack Docs',
+  ('index', 'doc-devstack.tex', u'DevStack Docs',
    u'OpenStack DevStack Team', 'manual'),
 ]
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 8f958585ee..6694022316 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -11,9 +11,8 @@
    and how to go beyond this setup. Both should be a set of quick
    links to other documents to let people explore from there.
 
-==========
- DevStack
-==========
+DevStack
+========
 
 .. image:: assets/images/logo-blue.png
 
@@ -32,7 +31,7 @@ The source is available at `<https://opendev.org/openstack/devstack>`__.
    are dedicated to this purpose.
 
 Quick Start
-===========
++++++++++++
 
 Install Linux
 -------------
@@ -153,7 +152,7 @@ with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
 
 Contents
---------
+++++++++
 
 .. toctree::
    :glob:
diff --git a/tox.ini b/tox.ini
index d81107fe1a..26baa2a1c5 100644
--- a/tox.ini
+++ b/tox.ini
@@ -43,6 +43,14 @@ setenv =
 commands =
   sphinx-build -W -b html -d doc/build/doctrees doc/source doc/build/html
 
+[testenv:pdf-docs]
+basepython = python3
+deps = {[testenv:docs]deps}
+whitelist_externals =
+   make
+commands =
+   sphinx-build -W -b latex doc/source doc/build/pdf
+   make -C doc/build/pdf
 
 [testenv:venv]
 basepython = python3

From 594885c80864710846f4fed35f19dc30a060f446 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 27 Sep 2019 16:45:09 -0400
Subject: [PATCH 2544/3333] Centralize and configure nova with cinder service
 user access

Since Queens [1] nova has been able to be configured with
cinder service user credentials for operating on cinder
resources without a user auth token similar to things nova
needs to do without a user auth token for working with neutron
and placement resources.

This change:

- centralizes the nova [cinder] section configuration
- adds the necessary auth configuration

Needed by: https://review.opendev.org/549130/

[1] I3c35bba43fee81baebe8261f546c1424ce3a3383

Change-Id: I5640ee431f6856853f6b00ec7ed1ea21d05117dd
---
 lib/nova | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index c41f881fa1..33d0a9f8a8 100644
--- a/lib/nova
+++ b/lib/nova
@@ -468,11 +468,7 @@ function create_nova_conf {
     fi
 
     if is_service_enabled cinder; then
-        if is_service_enabled tls-proxy; then
-            CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
-            CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
-            iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
-        fi
+        configure_cinder_access
     fi
 
     if [ -n "$NOVA_STATE_PATH" ]; then
@@ -520,8 +516,6 @@ function create_nova_conf {
     # don't let the conductor get out of control now that we're using a pure python db driver
     iniset $NOVA_CONF conductor workers "$API_WORKERS"
 
-    iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
-
     if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
         iniset $NOVA_CONF oslo_middleware enable_proxy_headers_parsing True
@@ -593,6 +587,29 @@ function configure_placement_nova_compute {
     iniset $conf placement region_name "$REGION_NAME"
 }
 
+# Configure access to cinder.
+function configure_cinder_access {
+    iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
+    iniset $NOVA_CONF cinder auth_type "password"
+    iniset $NOVA_CONF cinder auth_url "$KEYSTONE_SERVICE_URI"
+    # NOTE(mriedem): This looks a bit weird but we use the nova user here
+    # since it has the admin role and the cinder user does not. This is
+    # similar to using the nova user in init_nova_service_user_conf. We need
+    # to use a user with the admin role for background tasks in nova to
+    # be able to GET block-storage API resources owned by another project
+    # since cinder has low-level "is_admin" checks in its DB API.
+    iniset $NOVA_CONF cinder username nova
+    iniset $NOVA_CONF cinder password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF cinder user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF cinder project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF cinder project_domain_name "$SERVICE_DOMAIN_NAME"
+    if is_service_enabled tls-proxy; then
+        CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
+        CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
+        iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
+    fi
+}
+
 function configure_console_compute {
     # If we are running multiple cells (and thus multiple console proxies) on a
     # single host, we offset the ports to avoid collisions.  We need to

From c67a689fe56f55fa3cd288fba76f88d3aa5b9b8d Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 1 Oct 2019 20:14:22 +0200
Subject: [PATCH 2545/3333] Ensure that the zuul home can be traversed

The default permissions for the zuul home directory
are not the same in the various distributions.
As /home/zuul contains the sources, a 700 default may be
problematic when accessing those files, so make sure
that the executable permissions are set.

Closes-Bug: 1846251
Change-Id: Ic9769e56274d7205844b86d3b5200a6415e4acad
---
 playbooks/pre.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 4689a6354f..60f365aa7a 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -1,5 +1,12 @@
 - hosts: all
   pre_tasks:
+    - name: Fix the permissions of the zuul home directory
+      # Make sure that the zuul home can be traversed,
+      # so that all users can access the sources placed there.
+      # Some distributions create it with 700 by default.
+      file:
+        path: "{{ ansible_user_dir }}"
+        mode: a+x
     - name: Gather minimum local MTU
       set_fact:
         local_mtu: >

From deb3ff50f15bc89921ea548f5b53d49492c5ee65 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Wed, 24 Jul 2019 17:08:44 +0900
Subject: [PATCH 2546/3333] lib/horizon: no need to specify keystone v3 to API
 version

keystone v3 is the default API version in horizon now,
so there is no need to specify it in local_settings.py explicitly.

This commit also makes minor changes in lib/horizon
_horizon_config_set().

* Do not insert a blank line after each setting.
* Use the local variable $file to specify the target file
  consistently.

Change-Id: I5faea3e1f357726a256d2b48fc1afeabfead4998
---
 lib/horizon | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 293a627c78..b2bf7bcb49 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -43,8 +43,8 @@ function _horizon_config_set {
     local value=$4
 
     if [ -z "$section" ]; then
-        sed -e "/^$option/d" -i $local_settings
-        echo -e "\n$option=$value" >> $file
+        sed -e "/^$option/d" -i $file
+        echo "$option = $value" >> $file
     elif grep -q "^$section" $file; then
         local line
         line=$(sed -ne "/^$section/,/^}/ { /^ *'$option':/ p; }" $file)
@@ -84,6 +84,9 @@ function configure_horizon {
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
     cp $HORIZON_SETTINGS $local_settings
 
+    # Ensure local_setting.py file ends with EOL (newline)
+    echo >> $local_settings
+
     _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
@@ -91,7 +94,6 @@ function configure_horizon {
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
-    _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
     # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed

From 5c6b3c32791f6a1b6e3646e739d41ae86d866d45 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 4 Oct 2019 09:31:53 +1000
Subject: [PATCH 2547/3333] Add override variable for LIBVIRT_TYPE

Allow jobs to set LIBVIRT_TYPE, but retain the current default.  This
is for testing nested virt.

Change-Id: Ife215db3f59f011574a50b0d1cbd5565a7408dfe
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f7594d4ddc..cc94369988 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -219,8 +219,8 @@
         VERBOSE_NO_TIMESTAMP: true
         NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
-        # Gate jobs can't deal with nested virt. Disable it.
-        LIBVIRT_TYPE: qemu
+        # Gate jobs can't deal with nested virt. Disable it by default.
+        LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}'
       devstack_services:
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false

From dad5665036c83dfc25de28fe82ad7831b6f0915c Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 7 Oct 2019 17:21:46 +0000
Subject: [PATCH 2548/3333] Update DEVSTACK_SERIES to ussuri

stable/train branch has been created now and
current master is for ussuri.

Change-Id: I2bb84cb4b32e344572a7c3e6f300c1aa19e486df
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 10117f2700..e8ee4e09bd 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="train"
+DEVSTACK_SERIES="ussuri"
 
 ##############
 #

From 8c86e5a53e1c77fc17df7d979f6435b534021d13 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Thu, 17 Oct 2019 15:42:41 -0400
Subject: [PATCH 2549/3333] Cinder: only set volume_clear for LVM

This only applies to the LVM driver (when using
thick provisioning), and doesn't have any effect on
other backends like NFS, so only write the conf entry
for LVM.

Change-Id: I722ba2fa0010d9887ed9b7fdd9e050cd4694768e
---
 lib/cinder              | 3 ---
 lib/cinder_backends/lvm | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index fd960535d9..2e6e97a006 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -250,9 +250,6 @@ function configure_cinder {
                 default_name=$be_name
             fi
             enabled_backends+=$be_name,
-
-            iniset $CINDER_CONF $be_name volume_clear $CINDER_VOLUME_CLEAR
-
         done
         iniset $CINDER_CONF DEFAULT enabled_backends ${enabled_backends%,*}
         if [[ -n "$default_name" ]]; then
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 497081c9e4..e03ef14c55 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -52,7 +52,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
     iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
-
+    iniset $CINDER_CONF $be_name volume_clear "$CINDER_VOLUME_CLEAR"
 }
 
 # init_cinder_backend_lvm - Initialize volume group

From b14665f0dde0d0862d8755a796b9f680e42f790b Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 17 Oct 2019 19:34:05 +0000
Subject: [PATCH 2550/3333] Revert "Remove deprecated PostgreSQL database
 driver"

This reverts commit 168ca7f0a474f1207ee01dab0ca2e70f34783e9c.

Removing postgresql support from devstack was unnecessary
since it's not broken and not causing maintenance issues
as far as I know. The commit being reverted said that pg
support was deprecated in Pike but nothing in the docs or
commit message refer to official deprecation of postgres
support in devstack or openstack in general. Not to mention
that there are still postgres-based jobs that will no
longer work *and* the notification to the mailing list about
doing this happened *after* it was already done [1] leaving
stakeholders with no time to reply.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010196.html

Change-Id: Ie7036d37d79e6aba462b7c97f917e2e7aed108f9
---
 doc/source/configuration.rst          |  22 +++--
 doc/source/zuul_ci_jobs_migration.rst |   5 +-
 functions                             |   3 +-
 lib/databases/postgresql              | 137 ++++++++++++++++++++++++++
 stack.sh                              |   9 +-
 unstack.sh                            |   4 +
 6 files changed, 166 insertions(+), 14 deletions(-)
 create mode 100644 lib/databases/postgresql

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 62571e0760..45f4ffe6e9 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -326,23 +326,29 @@ a file, keep service logs and disable color in the stored files.
 Database Backend
 ----------------
 
-Support for the MySQL database backend is included. Addition database backends
-may be available via external plugins. Enabling of disabling MySQL is handled
-via the usual service functions and ``ENABLED_SERVICES``. For example, to
-disable MySQL in ``local.conf``::
+Multiple database backends are available. The available databases are defined
+in the lib/databases directory.
+``mysql`` is the default database, choose a different one by putting the
+following in the ``localrc`` section::
 
   disable_service mysql
+  enable_service postgresql
+
+``mysql`` is the default database.
 
 RPC Backend
 -----------
 
-Support for a RabbitMQ RPC backend is included. Additional RPC backends may be
-available via external plugins.  Enabling or disabling RabbitMQ is handled via
-the usual service functions and ``ENABLED_SERVICES``. For example, to disable
-RabbitMQ in ``local.conf``::
+Support for a RabbitMQ RPC backend is included. Additional RPC
+backends may be available via external plugins.  Enabling or disabling
+RabbitMQ is handled via the usual service functions and
+``ENABLED_SERVICES``.
+
+Example disabling RabbitMQ in ``local.conf``::
 
   disable_service rabbit
 
+
 Apache Frontend
 ---------------
 
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 66f8251039..17e7e16fb7 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -302,7 +302,10 @@ migrated at all.
      - This will probably be implemented on ironic side.
    * - DEVSTACK_GATE_POSTGRES
      - Legacy
-     - This has no effect in d-g.
+     - This flag exists in d-g but the only thing that it does is
+       capture postgres logs. This is already supported by the roles
+       in post, so the flag is useless in the new jobs. postgres
+       itself can be enabled via the devstack_service job variable.
    * - DEVSTACK_GATE_ZEROMQ
      - Legacy
      - This has no effect in d-g.
diff --git a/functions b/functions
index 8eeb03203e..f33fd25fee 100644
--- a/functions
+++ b/functions
@@ -400,8 +400,7 @@ function upload_image {
 # initialized yet, just save the configuration selection and call back later
 # to validate it.
 #
-# ``$1`` - the name of the database backend to use (only mysql is currently
-# supported)
+# ``$1`` - the name of the database backend to use (mysql, postgresql, ...)
 function use_database {
     if [[ -z "$DATABASE_BACKENDS" ]]; then
         # No backends registered means this is likely called from ``localrc``
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
new file mode 100644
index 0000000000..618834b550
--- /dev/null
+++ b/lib/databases/postgresql
@@ -0,0 +1,137 @@
+#!/bin/bash
+#
+# lib/databases/postgresql
+# Functions to control the configuration and operation of the **PostgreSQL** database backend
+
+# Dependencies:
+#
+# - DATABASE_{HOST,USER,PASSWORD} must be defined
+
+# Save trace setting
+_XTRACE_PG=$(set +o | grep xtrace)
+set +o xtrace
+
+
+MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
+
+
+register_database postgresql
+
+
+# Functions
+# ---------
+
+function get_database_type_postgresql {
+    echo postgresql
+}
+
+# Get rid of everything enough to cleanly change database backends
+function cleanup_database_postgresql {
+    stop_service postgresql
+    if is_ubuntu; then
+        # Get ruthless with mysql
+        apt_get purge -y postgresql*
+        return
+    elif is_fedora || is_suse; then
+        uninstall_package postgresql-server
+    else
+        return
+    fi
+}
+
+function recreate_database_postgresql {
+    local db=$1
+    # Avoid unsightly error when calling dropdb when the database doesn't exist
+    psql -h$DATABASE_HOST -U$DATABASE_USER -dtemplate1 -c "DROP DATABASE IF EXISTS $db"
+    createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
+}
+
+function configure_database_postgresql {
+    local pg_conf pg_dir pg_hba check_role version
+    echo_summary "Configuring and starting PostgreSQL"
+    if is_fedora; then
+        pg_hba=/var/lib/pgsql/data/pg_hba.conf
+        pg_conf=/var/lib/pgsql/data/postgresql.conf
+        if ! sudo [ -e $pg_hba ]; then
+            sudo postgresql-setup initdb
+        fi
+    elif is_ubuntu; then
+        version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`
+        if vercmp $version '>=' 9.3; then
+            if [ -z "`pg_lsclusters -h`" ]; then
+                echo 'No PostgreSQL clusters exist; will create one'
+                sudo pg_createcluster $version main --start
+            fi
+        fi
+        pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
+        pg_hba=$pg_dir/pg_hba.conf
+        pg_conf=$pg_dir/postgresql.conf
+    elif is_suse; then
+        pg_hba=/var/lib/pgsql/data/pg_hba.conf
+        pg_conf=/var/lib/pgsql/data/postgresql.conf
+        # initdb is called when postgresql is first started
+        sudo [ -e $pg_hba ] || start_service postgresql
+    else
+        exit_distro_not_supported "postgresql configuration"
+    fi
+    # Listen on all addresses
+    sudo sed -i "/listen_addresses/s/.*/listen_addresses = '*'/" $pg_conf
+    # Set max_connections
+    sudo sed -i "/max_connections/s/.*/max_connections = $MAX_DB_CONNECTIONS/" $pg_conf
+    # Do password auth from all IPv4 clients
+    sudo sed -i "/^host/s/all\s\+127.0.0.1\/32\s\+ident/$DATABASE_USER\t0.0.0.0\/0\tpassword/" $pg_hba
+    # Do password auth for all IPv6 clients
+    sudo sed -i "/^host/s/all\s\+::1\/128\s\+ident/$DATABASE_USER\t::0\/0\tpassword/" $pg_hba
+    restart_service postgresql
+
+    # Create the role if it's not here or else alter it.
+    check_role=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='$DATABASE_USER'")
+    if [[ ${check_role} == *HERE ]];then
+        sudo -u root sudo -u postgres -i psql -c "ALTER ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
+    else
+        sudo -u root sudo -u postgres -i psql -c "CREATE ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
+    fi
+}
+
+function install_database_postgresql {
+    echo_summary "Installing postgresql"
+    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
+    local pgpass=$HOME/.pgpass
+    if [[ ! -e $pgpass ]]; then
+        cat <<EOF > $pgpass
+*:*:*:$DATABASE_USER:$DATABASE_PASSWORD
+EOF
+        chmod 0600 $pgpass
+    else
+        sed -i "s/:root:\w\+/:root:$DATABASE_PASSWORD/" $pgpass
+    fi
+    if is_ubuntu; then
+        install_package postgresql
+    elif is_fedora || is_suse; then
+        install_package postgresql-server
+        if is_fedora; then
+            sudo systemctl enable postgresql
+        fi
+    else
+        exit_distro_not_supported "postgresql installation"
+    fi
+}
+
+function install_database_python_postgresql {
+    # Install Python client module
+    pip_install_gr psycopg2
+    ADDITIONAL_VENV_PACKAGES+=",psycopg2"
+}
+
+function database_connection_url_postgresql {
+    local db=$1
+    echo "$BASE_SQL_CONN/$db?client_encoding=utf8"
+}
+
+
+# Restore xtrace
+$_XTRACE_PG
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/stack.sh b/stack.sh
index c652f65403..b7b37e2cf6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -695,11 +695,14 @@ function read_password {
 # Database Configuration
 # ----------------------
 
-# DevStack provides a MySQL database backend. Additional backends may be
-# provided by external plugins and can be enabled using the usual service
-# functions and ``ENABLED_SERVICES``. For example, to disable MySQL:
+# To select between database backends, add the following to ``local.conf``:
 #
 #    disable_service mysql
+#    enable_service postgresql
+#
+# The available database backends are listed in ``DATABASE_BACKENDS`` after
+# ``lib/database`` is sourced. ``mysql`` is the default.
+
 if initialize_database_backends; then
     echo "Using $DATABASE_TYPE database backend"
     # Last chance for the database password. This must be handled here
diff --git a/unstack.sh b/unstack.sh
index 07dc2b1418..ccea0ef585 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -147,6 +147,10 @@ if [[ -n "$UNSTACK_ALL" ]]; then
         stop_service mysql
     fi
 
+    if is_service_enabled postgresql; then
+        stop_service postgresql
+    fi
+
     # Stop rabbitmq-server
     if is_service_enabled rabbit; then
         stop_service rabbitmq-server

From a676c4029e46743ccf2e81ebd17cd306ffc4960d Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 2 Aug 2017 16:46:35 +0000
Subject: [PATCH 2551/3333] Revert "Generate deprecation warning for
 postgresql"

Based on resolution [1], there's no clear indication that next
steps involve the removal of the DB from Devstack or from the gate.

[1] I332cef8ec4539520adcf37c6d2ea11488289fcfd

This reverts commit d9aaae95f2b84170bf35e037715e4963d89f940c.

Change-Id: I8410d65c0e0b24035aa035fac7560a686d53ec50
---
 lib/databases/postgresql | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 618834b550..1f347f5548 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -95,7 +95,6 @@ function configure_database_postgresql {
 
 function install_database_postgresql {
     echo_summary "Installing postgresql"
-    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
     local pgpass=$HOME/.pgpass
     if [[ ! -e $pgpass ]]; then
         cat <<EOF > $pgpass

From 1d378dcf6d3699d99838050cc804c64a1862ba8f Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 23 Oct 2019 04:20:23 +0000
Subject: [PATCH 2552/3333] Remove n-novnc service requirement for TLS
 configuration

When configuring TLS between the console proxy (where the n-novnc
service runs) and the compute host, some configuration for QEMU needs
to be done on the compute host. The existing code for this requires the
n-novnc service to be running, which it is in a single node all-in-one
deployment. However, when running in a multinode deployment, the
n-novnc service runs only on the controller and not on the subnode.
Yet, we need to configure QEMU on the subnode compute host as well.

This removes the n-novnc service requirement to enable TLS QEMU
configuration to occur on a compute subnode in a multinode deployment.

Closes-Bug: #1849418

Change-Id: I8b6970e91ad7f52ff489cb9f776ca216d8f86aa4
---
 lib/nova_plugins/functions-libvirt | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 463986944f..914ee7bcf7 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -150,21 +150,19 @@ EOF
     fi
 
     if is_nova_console_proxy_compute_tls_enabled ; then
-        if is_service_enabled n-novnc ; then
-            echo "vnc_tls = 1" | sudo tee -a $QEMU_CONF
-            echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
-
-            sudo mkdir -p /etc/pki/libvirt-vnc
-            deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
-            deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
-            # OpenSSL 1.1.0 generates the key file with permissions: 600, by
-            # default and the deploy_int* methods use 'sudo cp' to copy the
-            # files, making them owned by root:root.
-            # Change ownership of everything under /etc/pki/libvirt-vnc to
-            # libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
-            # file.
-            sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
-        fi
+        echo "vnc_tls = 1" | sudo tee -a $QEMU_CONF
+        echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
+
+        sudo mkdir -p /etc/pki/libvirt-vnc
+        deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
+        deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
+        # OpenSSL 1.1.0 generates the key file with permissions: 600, by
+        # default and the deploy_int* methods use 'sudo cp' to copy the
+        # files, making them owned by root:root.
+        # Change ownership of everything under /etc/pki/libvirt-vnc to
+        # libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
+        # file.
+        sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
     fi
 
     # Service needs to be started on redhat/fedora -- do a restart for

From da18895162bababea638b3f28c76cb9766e821b6 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Thu, 31 Oct 2019 14:49:23 -0400
Subject: [PATCH 2553/3333] Fix brctl calls

Some distros no longer ship brctl, iproute2 should be used
in its place. The linuxbridge agent plugin script was still
using it, as was worlddump, which generates this warning on
a failure:

    Running devstack worlddump.py
    /bin/sh: 1: brctl: not found

Conditionalizing worlddump based on whether brctl is installed
to make this go away.

Change-Id: Iafbf4038bab08c261d45d117b12d4629ba32d65e
---
 lib/neutron_plugins/linuxbridge_agent | 2 +-
 tools/worlddump.py                    | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index fa3f86203d..1f1b0e8e52 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -48,7 +48,7 @@ function neutron_plugin_configure_dhcp_agent {
 
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
-    sudo brctl addbr $PUBLIC_BRIDGE
+    sudo ip link add $PUBLIC_BRIDGE type bridge
     set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
 }
 
diff --git a/tools/worlddump.py b/tools/worlddump.py
index d1453ca076..d5ff5d1ab5 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -165,7 +165,8 @@ def network_dump():
     _header("Network Dump")
 
     _dump_cmd("bridge link")
-    _dump_cmd("brctl show")
+    if _find_cmd("brctl"):
+        _dump_cmd("brctl show")
     _dump_cmd("ip link show type bridge")
     ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:

From 6c15c38f1a9e8e833a29637598f373d7ea29bc62 Mon Sep 17 00:00:00 2001
From: Flavio Fernandes <flaviof@redhat.com>
Date: Wed, 6 Nov 2019 07:11:33 -0500
Subject: [PATCH 2554/3333] stackrc: Make REQUIREMENTS_DIR configurable

In cases where global REQUIREMENTS_DIR is set, use it
instead of overwriting it. This is particularly needed
in cases where users of pip_install wrapper have the
upper-constraints.txt at another location.

Change-Id: I34e9f94548c575e1af5bca9655a3b7d1915375a8
Signed-off-by: Flavio Fernandes <flaviof@redhat.com>
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 3fcdadffa3..0f80143f39 100644
--- a/stackrc
+++ b/stackrc
@@ -240,7 +240,7 @@ WSGI_MODE=${WSGI_MODE:-"uwsgi"}
 GIT_BASE=${GIT_BASE:-https://opendev.org}
 
 # The location of REQUIREMENTS once cloned
-REQUIREMENTS_DIR=$DEST/requirements
+REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 
 # Which libraries should we install from git instead of using released
 # versions on pypi?

From 0e02e7fd55276678ba839a098896b6142363147c Mon Sep 17 00:00:00 2001
From: Zane Bitter <zbitter@redhat.com>
Date: Thu, 14 Nov 2019 14:01:27 -0500
Subject: [PATCH 2555/3333] Don't install glance default policy

With Glance defining default policies in code, it's no longer necessary
to install policy.json from the repo.

Change-Id: I9f9160f5a2bf9fd77fb3807e12de219b7a49952d
Depends-On: https://review.opendev.org/693129
---
 lib/glance | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 54d3276433..740bcabf6a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -52,7 +52,6 @@ GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
 GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
-GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_IMAGE_IMPORT_CONF=$GLANCE_CONF_DIR/glance-image-import.conf
@@ -220,7 +219,6 @@ function configure_glance {
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
 
-    cp -p $GLANCE_DIR/etc/policy.json $GLANCE_POLICY_JSON
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
 
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR

From 277f29f68300a5598c02f48ebeb4039528435774 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Nov 2019 10:09:11 +0000
Subject: [PATCH 2556/3333] Drop centos7 platform job

The centos7 job is running with python2, which is no longer supported by
nova, so we can drop it in master.

Change-Id: Id9ef507dd6f4226d65c6ed3043666b0aa6a3bd1c
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc94369988..13b98eb923 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -520,13 +520,6 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
-- job:
-    name: devstack-platform-centos-7
-    parent: tempest-full
-    description: Centos 7 platform test
-    nodeset: devstack-single-node-centos-7
-    voting: false
-
 - job:
     name: devstack-platform-opensuse-15
     parent: tempest-full-py3
@@ -621,7 +614,6 @@
         - devstack
         - devstack-xenial
         - devstack-ipv6
-        - devstack-platform-centos-7
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-xenial

From 2d112db86b1b6861f6b4844bef324bda3a89248b Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 14 Nov 2019 11:35:29 +0100
Subject: [PATCH 2557/3333] Drop old neutron-grenade job

This job is still running python 2.7. As we are dropping py2 support in
Ussuri cycle, lets drop this job now.
There is same job called "grenade-py3" which runs on python 3 already
and this will be now used in project's CI.

Depends-On: https://review.opendev.org/#/c/695036/

Change-Id: I5cd8e137a3ae06e49a4351629c5eb207c4e6bf1a
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc94369988..7c32298a7a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -636,7 +636,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-grenade:
+        - grenade-py3:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -678,7 +678,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-grenade:
+        - grenade-py3:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 39082a3b4ede7ba84fcc01a6d00e9cd66e2f582d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 2 Apr 2019 11:03:06 +0000
Subject: [PATCH 2558/3333] Handle localrc early enough in stackrc

We need to source the environment overrides before they get evaluated.
Otherwise e.g. USE_PYTHON3 is factually being ignored for some settings.

Also fix creating python3 venvs by using the "virtualenv" command for
that task.

Change-Id: I16c78a7fef80372d9a1684c3256c5b50b052ecae
---
 stackrc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/stackrc b/stackrc
index 3fcdadffa3..ab55e13512 100644
--- a/stackrc
+++ b/stackrc
@@ -89,6 +89,15 @@ ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=osapi_compute,metadata
 
+# allow local overrides of env variables, including repo config
+if [[ -f $RC_DIR/localrc ]]; then
+    # Old-style user-supplied config
+    source $RC_DIR/localrc
+elif [[ -f $RC_DIR/.localrc.auto ]]; then
+    # New-style user-supplied config extracted from local.conf
+    source $RC_DIR/.localrc.auto
+fi
+
 # CELLSV2_SETUP - how we should configure services with cells v2
 #
 # - superconductor - this is one conductor for the api services, and
@@ -145,20 +154,11 @@ export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
 # Create a virtualenv with this
 if [[ ${USE_PYTHON3} == True ]]; then
-    export VIRTUALENV_CMD="python3 -m venv"
+    export VIRTUALENV_CMD="virtualenv -p python3"
 else
     export VIRTUALENV_CMD="virtualenv "
 fi
 
-# allow local overrides of env variables, including repo config
-if [[ -f $RC_DIR/localrc ]]; then
-    # Old-style user-supplied config
-    source $RC_DIR/localrc
-elif [[ -f $RC_DIR/.localrc.auto ]]; then
-    # New-style user-supplied config extracted from local.conf
-    source $RC_DIR/.localrc.auto
-fi
-
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From 48b519b5c62be33388b76fd25eebb5673d1e2c18 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 1 Apr 2019 12:22:42 -0400
Subject: [PATCH 2559/3333] Change USE_PYTHON3=True by default

Since Stein, gate jobs have been using bionic nodes so they
are running with python 3.6, so it makes sense to also default
devstack itself to run with python3 by default.

Depends-On: https://review.opendev.org/688731

Change-Id: I52b03caee0ba700da3a15035201ea6cd91baa06b
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ab55e13512..c796f3ae26 100644
--- a/stackrc
+++ b/stackrc
@@ -136,7 +136,7 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
 fi
 
 # Control whether Python 3 should be used at all.
-export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
+export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.

From 279a7589b03db69fd1b85d947cd0171dacef94ee Mon Sep 17 00:00:00 2001
From: "Jens Harbott (frickler)" <j.harbott@x-ion.de>
Date: Mon, 16 Apr 2018 12:08:30 +0000
Subject: [PATCH 2560/3333] Revert "Do not use pip 10 or higher"

This reverts commit f99d1771ba1882dfbb69186212a197edae3ef02c.

Added workarounds that might want to get split into their own patch
before merging:

- Don't install python-psutil
- Don't run peakmem_tracker

Change-Id: If4fb16555e15082a4d97cffdf3cfa608a682997d
---
 .zuul.yaml            | 4 ----
 files/debs/dstat      | 1 -
 files/rpms-suse/dstat | 1 -
 files/rpms/dstat      | 1 -
 tools/cap-pip.txt     | 1 -
 tools/install_pip.sh  | 6 +++---
 6 files changed, 3 insertions(+), 11 deletions(-)
 delete mode 100644 tools/cap-pip.txt

diff --git a/.zuul.yaml b/.zuul.yaml
index 7c32298a7a..19dee584fc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -320,14 +320,12 @@
         dstat: true
         etcd3: true
         mysql: true
-        peakmem_tracker: true
         rabbit: true
     group-vars:
       subnode:
         devstack_services:
           # Shared services
           dstat: true
-          peakmem_tracker: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -394,7 +392,6 @@
         dstat: true
         etcd3: true
         mysql: true
-        peakmem_tracker: true
         rabbit: true
         tls-proxy: true
         # Keystone services
@@ -450,7 +447,6 @@
           # This list replaces the test-matrix.
           # Shared services
           dstat: true
-          peakmem_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
diff --git a/files/debs/dstat b/files/debs/dstat
index 0d9da4434f..2b643b8b1b 100644
--- a/files/debs/dstat
+++ b/files/debs/dstat
@@ -1,2 +1 @@
 dstat
-python-psutil
diff --git a/files/rpms-suse/dstat b/files/rpms-suse/dstat
index 0d9da4434f..2b643b8b1b 100644
--- a/files/rpms-suse/dstat
+++ b/files/rpms-suse/dstat
@@ -1,2 +1 @@
 dstat
-python-psutil
diff --git a/files/rpms/dstat b/files/rpms/dstat
index b058c277cb..d7b272a93b 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,3 +1,2 @@
 dstat # not:f29
 pcp-system-tools # dist:f29
-python-psutil
diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
deleted file mode 100644
index f5278d7c86..0000000000
--- a/tools/cap-pip.txt
+++ /dev/null
@@ -1 +0,0 @@
-pip!=8,<10
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 2b6aa4c2e8..dcd546629f 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -89,9 +89,9 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    sudo -H -E python $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
-    if python3_enabled; then
-        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
+    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    if ! python3_enabled; then
+        sudo -H -E python $LOCAL_PIP
     fi
 }
 

From 2e6677869925c86c01cae883b3dde6cccad81d30 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 20 Nov 2019 10:41:34 +1100
Subject: [PATCH 2561/3333] Drop Xenial support

With the goals of Ussuri being Python 3.6 [1], the python 3.5
environment on Xenial is too old.  Remove testing and the most obvious
bits of support from devstack.

Also drop claimed support for artful, which is long EOL.

[1] https://governance.openstack.org/tc/reference/runtimes/ussuri.html

Change-Id: Iefcca99904dde76b34efbbfc0e04515dfa5a09e5
---
 .zuul.yaml                         | 29 -------------------------
 files/debs/nova                    |  5 ++---
 lib/nova_plugins/functions-libvirt | 18 +++------------
 stack.sh                           |  4 ++--
 stackrc                            |  3 ---
 tools/fixup_stuff.sh               | 35 ++----------------------------
 6 files changed, 9 insertions(+), 85 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc94369988..8f64620426 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -491,14 +491,6 @@
         # https://bugs.launchpad.net/devstack/+bug/1794929
         USE_PYTHON3: true
 
-- job:
-    name: devstack-xenial
-    parent: devstack
-    nodeset: openstack-single-node-xenial
-    description: |
-      Simple singlenode test to verify functionality on devstack
-      side running on Xenial.
-
 - job:
     name: devstack-multinode
     parent: devstack
@@ -507,15 +499,6 @@
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
 
-- job:
-    name: devstack-multinode-xenial
-    parent: devstack
-    nodeset: openstack-two-node-xenial
-    description: |
-      Simple multinode test to verify multinode functionality on devstack
-      side running on Xenial.
-      This is not meant to be used as a parent job.
-
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
@@ -541,13 +524,6 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
-- job:
-    name: devstack-platform-xenial
-    parent: tempest-full-py3
-    description: Ubuntu Xenial platform test
-    nodeset: openstack-single-node-xenial
-    voting: false
-
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -619,14 +595,11 @@
     check:
       jobs:
         - devstack
-        - devstack-xenial
         - devstack-ipv6
         - devstack-platform-centos-7
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
-        - devstack-platform-xenial
         - devstack-multinode
-        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
@@ -664,10 +637,8 @@
     gate:
       jobs:
         - devstack
-        - devstack-xenial
         - devstack-ipv6
         - devstack-multinode
-        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-grenade-multinode:
diff --git a/files/debs/nova b/files/debs/nova
index 5e14aec836..e5110e9c75 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -10,9 +10,8 @@ iputils-arping
 kpartx
 libjs-jquery-tablesorter # Needed for coverage html reports
 libmysqlclient-dev
-libvirt-bin # dist:xenial NOPRIME
-libvirt-clients # not:xenial NOPRIME
-libvirt-daemon-system # not:xenial NOPRIME
+libvirt-clients # NOPRIME
+libvirt-daemon-system # NOPRIME
 libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 914ee7bcf7..35666393ca 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,17 +24,10 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Currently fairly specific to OpenStackCI hosts
 DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
 
-# Only Xenial is left with libvirt-bin.  Everywhere else is libvirtd
-if is_ubuntu && [ ${DISTRO} == "xenial" ]; then
-    LIBVIRT_DAEMON=libvirt-bin
-else
-    LIBVIRT_DAEMON=libvirtd
-fi
-
 # Enable coredumps for libvirt
 #  Bug: https://bugs.launchpad.net/nova/+bug/1643911
 function _enable_coredump {
-    local confdir=/etc/systemd/system/${LIBVIRT_DAEMON}.service.d
+    local confdir=/etc/systemd/system/libvirtd.service.d
     local conffile=${confdir}/coredump.conf
 
     # Create a coredump directory, and instruct the kernel to save to
@@ -61,12 +54,7 @@ EOF
 function install_libvirt {
 
     if is_ubuntu; then
-        install_package qemu-system
-        if [[ ${DISTRO} == "xenial" ]]; then
-            install_package libvirt-bin libvirt-dev
-        else
-            install_package libvirt-clients libvirt-daemon-system libvirt-dev
-        fi
+        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev
         # uninstall in case the libvirt version changed
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
@@ -167,7 +155,7 @@ EOF
 
     # Service needs to be started on redhat/fedora -- do a restart for
     # sanity after fiddling the config.
-    restart_service $LIBVIRT_DAEMON
+    restart_service libvirtd
 
     # Restart virtlogd companion service to ensure it is running properly
     #  https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1577455
diff --git a/stack.sh b/stack.sh
index b7b37e2cf6..d0206ebac0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (16.04 Xenial or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
+# (Bionic or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/stackrc b/stackrc
index 3fcdadffa3..15150df43b 100644
--- a/stackrc
+++ b/stackrc
@@ -656,9 +656,6 @@ case "$VIRT_DRIVER" in
         ;;
 esac
 
-# By default, devstack will use Ubuntu Cloud Archive.
-ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
-
 # Images
 # ------
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d2989379fe..eb8a76f276 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -71,15 +71,9 @@ function fixup_keystone {
 
 # Ubuntu Repositories
 #--------------------
-# We've found that Libvirt on Xenial is flaky and crashes enough to be
-# a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
-# get newer Libvirt.
-# Make it possible to switch this based on an environment variable as
-# libvirt 2.5.0 doesn't handle nested virtualization quite well and this
-# is required for the trove development environment.
-# Also enable universe since it is missing when installing from ISO.
+# Enable universe for bionic since it is missing when installing from ISO.
 function fixup_ubuntu {
-    if [[ "$DISTRO" != "xenial" && "$DISTRO" != "bionic" ]]; then
+    if [[ "$DISTRO" != "bionic" ]]; then
         return
     fi
 
@@ -88,31 +82,6 @@ function fixup_ubuntu {
 
     # Enable universe
     sudo add-apt-repository -y universe
-
-    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
-        return
-    fi
-    # Use UCA for newer libvirt.
-    if [[ -f /etc/ci/mirror_info.sh ]] ; then
-        # If we are on a nodepool provided host and it has told us about where
-        # we can find local mirrors then use that mirror.
-        source /etc/ci/mirror_info.sh
-
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/queens main"
-    else
-        # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:queens
-    fi
-
-    # Disable use of libvirt wheel since a cached wheel build might be
-    # against older libvirt binary.  Particularly a problem if using
-    # the openstack wheel mirrors, but can hit locally too.
-    # TODO(clarkb) figure out how to use upstream wheel again.
-    iniset -sudo /etc/pip.conf "global" "no-binary" "libvirt-python"
-
-    # Force update our APT repos, since we added UCA above.
-    REPOS_UPDATED=False
-    apt_get_update
 }
 
 # Python Packages

From 8579f583077e5df3358605e4cdfe418b1d46f53b Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 4 Nov 2019 11:37:54 +0000
Subject: [PATCH 2562/3333] Dump the upper constraints for tempest in a
 temporary file

This will avoid the creation of an unneeded file in the "tempest"
repository directory.

TrivialFix

Change-Id: Id3f46b3537cd3232cb29c42808bde44c667565f1
---
 lib/tempest | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 96c9ced14a..ea5033a29d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -607,8 +607,11 @@ function configure_tempest {
     fi
 
     # The requirements might be on a different branch, while tempest needs master requirements.
-    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
-    tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
+    local tmp_u_c_m
+    tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
+    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+    tox -evenv-tempest -- pip install -c $tmp_u_c_m -r requirements.txt
+    rm -f $tmp_u_c_m
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "member"
@@ -697,8 +700,11 @@ function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
-        tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
+        local tmp_u_c_m
+        tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
+        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+        tox -evenv-tempest -- pip install -c $tmp_u_c_m $TEMPEST_PLUGINS
+        rm -f $tmp_u_c_m
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi

From d54a1c6869653c4af1d0dbd76e31b20879c675b5 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 10 Sep 2019 12:05:06 +0200
Subject: [PATCH 2563/3333] Add possibility to configure manually
 MYSQL_SERVICE_NAME

This variable can be now set in Devstack's config file and in
such case Devstack will not set it automatically to value most
likely correct for the distro.
By default this value is empty string and in such case Devstack
will work in exactly same way as it was before this patch and
will determine automatically what name should be used there.

In addition in case of Ubuntu package $MYSQL_SERVICE_NAME-server
will be now installed instead of mysql-server always.
This will allow to easy configure e.g. CI job which will run using
Mariadb instead of Mysql on Ubuntu.

Change-Id: I25af0b54ad235b08c6c399b4125c737acf57ee2e
---
 lib/databases/mysql | 44 ++++++++++++++++++++++++++++++++------------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 4d0f5f3e45..4e3cc72bdb 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -15,15 +15,17 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 
 register_database mysql
 
-MYSQL_SERVICE_NAME=mysql
-if is_fedora && ! is_oraclelinux; then
-    MYSQL_SERVICE_NAME=mariadb
-elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
-    # Older mariadb packages on SLES 12 provided mysql.service.  The
-    # newer ones on SLES 12 and 15 use mariadb.service; they also
-    # provide a mysql.service symlink for backwards-compatibility, but
-    # let's not rely on that.
-    MYSQL_SERVICE_NAME=mariadb
+if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
+    MYSQL_SERVICE_NAME=mysql
+    if is_fedora && ! is_oraclelinux; then
+        MYSQL_SERVICE_NAME=mariadb
+    elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
+        # Older mariadb packages on SLES 12 provided mysql.service.  The
+        # newer ones on SLES 12 and 15 use mariadb.service; they also
+        # provide a mysql.service symlink for backwards-compatibility, but
+        # let's not rely on that.
+        MYSQL_SERVICE_NAME=mariadb
+    fi
 fi
 
 # Functions
@@ -92,8 +94,23 @@ function configure_database_mysql {
     # because the package might have been installed already.
     sudo mysqladmin -u root password $DATABASE_PASSWORD || true
 
+    # In case of Mariadb, giving hostname in arguments causes permission
+    # problems as it expects connection through socket
+    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+        local cmd_args="-uroot -p$DATABASE_PASSWORD "
+    else
+        local cmd_args="-uroot -p$DATABASE_PASSWORD -h127.0.0.1 "
+    fi
+
+    # In mariadb e.g. on Ubuntu socket plugin is used for authentication
+    # as root so it works only as sudo. To restore old "mysql like" behaviour,
+    # we need to change auth plugin for root user
+    if [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+        sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
+        sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
+    fi
     # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
-    sudo mysql -uroot -p$DATABASE_PASSWORD -h127.0.0.1 -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
@@ -148,8 +165,11 @@ MYSQL_PRESEED
 [client]
 user=$DATABASE_USER
 password=$DATABASE_PASSWORD
-host=$MYSQL_HOST
 EOF
+
+        if ! is_ubuntu || [ "$MYSQL_SERVICE_NAME" != "mariadb" ]; then
+            echo "host=$MYSQL_HOST" >> $HOME/.my.cnf
+        fi
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
@@ -159,7 +179,7 @@ EOF
         install_package mariadb-server
         sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_ubuntu; then
-        install_package mysql-server
+        install_package $MYSQL_SERVICE_NAME-server
     else
         exit_distro_not_supported "mysql installation"
     fi

From 40f7579bb8ebd8082dc5f55785c0ae4644b062ec Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 26 Nov 2019 15:20:03 +0000
Subject: [PATCH 2564/3333] lib/tempest: Do not rely on six for
 image_size_in_gib

input() should work on both python versions for what we need. I
understand the concern about eval() on python2 but, in the case it's
used we should be fine, plus, python2 is being removed from OpenStack
projects.

Change-Id: I86a7c31374986f81132bc4f49aee0a76b90e6553
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 96c9ced14a..7d0a98275f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -107,7 +107,7 @@ function remove_disabled_extensions {
 function image_size_in_gib {
     local size
     size=$(openstack image show $1 -c size -f value)
-    echo $size | python -c "import math; import six; print(int(math.ceil(float(int(six.moves.input()) / 1024.0 ** 3))))"
+    echo $size | python3 -c "import math; print(int(math.ceil(float(int(input()) / 1024.0 ** 3))))"
 }
 
 # configure_tempest() - Set config files, create data dirs, etc

From 7ddbece508413592cbb7540408b3edbf04ca8d04 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 3 Dec 2019 14:35:03 -0800
Subject: [PATCH 2565/3333] Enable libvirt virtio rng device

We've seen jobs where tests fail due to what appears to be rng
starvation. Enable virtio rng device to try and alleviate this.

Change-Id: I70d800cdc45b6008f775110f22c0000736421529
---
 functions   |  6 +++---
 lib/nova    | 20 ++++++++++----------
 lib/tempest |  4 ++--
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/functions b/functions
index f33fd25fee..8ea634e753 100644
--- a/functions
+++ b/functions
@@ -292,7 +292,7 @@ function upload_image {
     local disk_format=""
     local container_format=""
     local unpack=""
-    local img_property=""
+    local img_property="--property hw_rng_model=virtio"
     case "$image_fname" in
         *.tar.gz|*.tgz)
             # Extract ami and aki files
@@ -364,11 +364,11 @@ function upload_image {
     esac
 
     if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
-        img_property="--property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
+        img_property="$img_property --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then
-        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
+        img_property="$img_property --property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
     fi
 
     if [ "$container_format" = "bare" ]; then
diff --git a/lib/nova b/lib/nova
index c41f881fa1..58a236a525 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1107,19 +1107,19 @@ function create_flavors {
     if is_service_enabled n-api; then
         if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q ds512M; then
             # Note that danms hates these flavors and apologizes for sdague
-            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 1 --vcpus 1 cirros256
-            openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
-            openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
-            openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
-            openstack --os-region-name="$REGION_NAME" flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 1 --vcpus 1 --property hw_rng:allowed=True cirros256
+            openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 --property hw_rng:allowed=True ds512M
+            openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 --property hw_rng:allowed=True ds1G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 --property hw_rng:allowed=True ds2G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 --property hw_rng:allowed=True ds4G
         fi
 
         if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q m1.tiny; then
-            openstack --os-region-name="$REGION_NAME" flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
-            openstack --os-region-name="$REGION_NAME" flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
-            openstack --os-region-name="$REGION_NAME" flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
-            openstack --os-region-name="$REGION_NAME" flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
-            openstack --os-region-name="$REGION_NAME" flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+            openstack --os-region-name="$REGION_NAME" flavor create --id 1 --ram 512 --disk 1 --vcpus 1 --property hw_rng:allowed=True m1.tiny
+            openstack --os-region-name="$REGION_NAME" flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 --property hw_rng:allowed=True m1.small
+            openstack --os-region-name="$REGION_NAME" flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 --property hw_rng:allowed=True m1.medium
+            openstack --os-region-name="$REGION_NAME" flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 --property hw_rng:allowed=True m1.large
+            openstack --os-region-name="$REGION_NAME" flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 --property hw_rng:allowed=True m1.xlarge
         fi
     fi
 }
diff --git a/lib/tempest b/lib/tempest
index 96c9ced14a..1bb9b52645 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -203,13 +203,13 @@ function configure_tempest {
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 m1.nano
+                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 m1.micro
+                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else

From ede8b1269cb03178c31f700200309dd76b00dd5a Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Mon, 9 Dec 2019 14:21:21 +0900
Subject: [PATCH 2566/3333] mysql: Don't bother to change auth plugin on centos

This partially reverts the previous change [1], which
broke networking-midonet jobs.

[1] https://review.opendev.org/#/c/681201/

Closes-Bug: #1855516
Change-Id: I0255c6acce72a8376dbc6d8f8d0314a7dabf019c
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 4e3cc72bdb..420a86e04e 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -105,7 +105,7 @@ function configure_database_mysql {
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
-    if [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
         sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
     fi

From f7a7076facbe8ef7c77863abf977af5cdafdeb6e Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 11 Dec 2019 09:51:58 +0100
Subject: [PATCH 2567/3333] Include dnsmasq-utils package on all Ubuntu
 versions

This package provides dhcp_release tool but in files/debs/neutron-common
it was listed to be installed only on Ubuntu Precise.
The same file is also in Nova's packages but there is no restriction to
Ubuntu Precise only there.
So on all Neutron jobs it was fine but on Ironic's job where Nova
wasn't enabled, this package was not installed and caused problems
in Neutron DHCP agent.

Change-Id: Idd0711cfe6d43f21754a2f0c230cd094ea33cb27
Closes-Bug: #1855910
---
 files/debs/neutron-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/debs/neutron-common b/files/debs/neutron-common
index e30f678f7a..b269f6330b 100644
--- a/files/debs/neutron-common
+++ b/files/debs/neutron-common
@@ -1,6 +1,6 @@
 acl
 dnsmasq-base
-dnsmasq-utils # for dhcp_release only available in dist:precise
+dnsmasq-utils # for dhcp_release
 ebtables
 haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables

From d6a7b73fc8d01d8118031f086d0ad20ab6186059 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Tue, 12 Nov 2019 15:54:32 +0200
Subject: [PATCH 2568/3333] Create OVS bridge even if OVS_BRIDGE_MAPPINGS is
 not empty

in complex cases when mapping is defined in local.conf OVS bridge
can be created automatically.

Change-Id: I2e5e1068e77291d1d199cd698cec4946480c7601
---
 lib/neutron_plugins/openvswitch_agent | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index b65a2587c2..100961196d 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -41,8 +41,10 @@ function neutron_plugin_configure_plugin_agent {
     # Setup physical network bridge mappings.  Override
     # ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc`` for more
     # complex physical network configurations.
-    if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
-        OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+    if [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
+        if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]]; then
+            OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+        fi
 
         # Configure bridge manually with physical interface as port for multi-node
         _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE

From 56b2e7fe8b676d0fd94f511529c731d9a6af5c4a Mon Sep 17 00:00:00 2001
From: Eyal <eyal.bar-ilan@nokia.com>
Date: Thu, 19 Dec 2019 13:32:55 +0200
Subject: [PATCH 2569/3333] fix a command typo

Change-Id: I01787641c887bfc0f4620b90b4ff488958dac53e
---
 .../templates/devstack.journal.README.txt.j2                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2 b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
index 598eb7f3db..fe36653102 100644
--- a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
+++ b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
@@ -10,7 +10,7 @@ locally.  After downloading the file:
  $ /lib/systemd/systemd-journal-remote <(xzcat ./devstack.journal.xz) -o output.journal
 
 Note this binary is not in the regular path.  On Debian/Ubuntu
-platforms, you will need to have the "sytemd-journal-remote" package
+platforms, you will need to have the "systemd-journal-remote" package
 installed.
 
 It should result in something like:

From f0dd9996cc635709276f51e4d94c5ebbf5d5b49f Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Mon, 26 Nov 2018 07:38:54 +0000
Subject: [PATCH 2570/3333] Fix DevStack to configure tempest's
 service_availability

Tempest's service_availability config option includes all the service
availability which is further used by tests to take decision of skip
or run the test.

For example, [service_availability].nova is true then, compute test will run
or if [service_availability].aodh is false then, all aodh related tests either
in aodh tempest plugin or any other plugins will be skipped.

Now question is what is the best way to set the each service availability for
tempest or tempest plugins tests. We have 2 category of service here-
1. Service tested by Tempest (nova, cinder, keystone, glance, swift, neutron)
   (let's say type1 service)
2. Services tested by Tempest plugins (all other than above list)
   (let's say type2 service)

We need the standard way to set both type of service so that we can maintain
the setting of service_availability config options in consistent way.

As discussed on bug#1743688/ and review https://review.openstack.org/#/c/536723/,
we will use devstack lib/tempest to set the type1 service which is services test
owned by Tempest and type2 service setting will be done by devstack plugins of
those service.

For example - [service_availability].ironic will be set by ironic's devstack plugin.
because that is best place we know ironic is installed and available.

To do that we need:
1. Add setting of [service_availability].* in devstack plugins
2. Remove setting of type2 service from devstack lib/tempest

This commit does the second part and all depends-on patches handle the first part.

Related-Bug: #1743688

Change-Id: If3aec9fd1c61e2bb53233be437b97b811dc82414
---
 lib/tempest | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index fba8826a2d..00e946e549 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -543,11 +543,15 @@ function configure_tempest {
 
     # ``service_available``
     #
-    # this tempest service list needs to be all the services that
-    # tempest supports, otherwise we can have an erroneous set of
+    # this tempest service list needs to be the services that
+    # tempest own, otherwise we can have an erroneous set of
     # defaults (something defaulting true in Tempest, but not listed here).
+    # services tested by tempest plugins needs to be set on service devstack
+    # plugin side as devstack cannot keep track of all the tempest plugins
+    # services. Refer Bug#1743688 for more details.
+    # 'horizon' is also kept here as no devtack plugin for horizon.
     local service
-    local tempest_services="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
+    local tempest_services="key,glance,nova,neutron,cinder,swift,horizon"
     for service in ${tempest_services//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"

From 7634c780027ad05e416c2a0c5ac688751aba4be6 Mon Sep 17 00:00:00 2001
From: Soniya Vyas <svyas@redhat.com>
Date: Thu, 26 Dec 2019 16:59:56 +0530
Subject: [PATCH 2571/3333] Removal of deprecated command and deprecated
 optional argument

lib/tempest uses 'tempest-account-generator'
which is deprecated 4 years back.
In addition to above, lib/tempest also uses
'os-tenant-name' which is also deprecated.

Use of 'tempest account-generator' and
'os-project-name' should be done now.

Signed-off by: Soniya Vyas<svyas@redhat.com>
Change-Id: I624e1dc57a3d3533322fb298c01f70241d0400ed
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index a91fe01fa3..ce0886bbd9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -617,9 +617,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From f8aa74bc045110b1ea53f3e358836b4b76faeb92 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.com>
Date: Fri, 27 Dec 2019 09:30:57 -0800
Subject: [PATCH 2572/3333] Enable access rules tempest tests

In Train, the access rules API was introduced in keystone. This change
enables testing it in tempest.

Depends-on: https://review.opendev.org/699519
Change-Id: I2af21868cbf584a6881c6208bc2afc3bdb323ab9
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index a91fe01fa3..c8a1ea0ec7 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -336,6 +336,10 @@ function configure_tempest {
     # so remove this once Tempest no longer supports Pike.
     iniset $TEMPEST_CONFIG identity-feature-enabled application_credentials True
 
+    # In Train and later, access rules for application credentials are enabled
+    # by default so remove this once Tempest no longer supports Stein.
+    iniset $TEMPEST_CONFIG identity-feature-enabled access_rules True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 4143ce6fc95ccd9bde88c22baaa3eeaba58183f8 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 13 Jan 2020 16:05:11 +1100
Subject: [PATCH 2573/3333] Create virtualenv with abstracted VIRTUALENV_CMD

Just calling "virtualenv" makes a Python 2 based environment;
setuptools just dropped Python 2 support (as Python 2 reached EOL in
Jan 2020) so this has now become a breakage.

Although the Python 2 path won't work, use the abstracted command.
This should stop us having to revisit this for any future cleanups (or
switing to venv, etc).

Change-Id: I531e971b78491a9276753c0d86b04c4adbd224aa
---
 lib/infra | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/infra b/lib/infra
index cf003cce01..b983f2b739 100644
--- a/lib/infra
+++ b/lib/infra
@@ -29,7 +29,7 @@ GITDIR["pbr"]=$DEST/pbr
 # install_infra() - Collect source and prepare
 function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
-    [ ! -d $PIP_VIRTUAL_ENV ] && virtualenv $PIP_VIRTUAL_ENV
+    [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR

From bcb2c30c317834f62cab470dc0b58670d945a6ef Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 13 Jan 2020 16:31:20 +1100
Subject: [PATCH 2574/3333] Remove TRACK_DEPENDS

This was added in 2012 with I89677fd54635e82b10ab674ddeb9ffb3f1a755f0,
but I can not see it being used anywhere currently.

It's use of virtualenv's has become problematic in a python2
deprecated world, but since it is not used, remove it to avoid further
confusion.

Change-Id: I65d44d24f449436ca6229928eee2c5a021793055
---
 functions-common |  8 +-------
 inc/python       | 51 ++++++++++++++++++++----------------------------
 stack.sh         | 24 -----------------------
 3 files changed, 22 insertions(+), 61 deletions(-)

diff --git a/functions-common b/functions-common
index a13d611415..6be07b42bb 100644
--- a/functions-common
+++ b/functions-common
@@ -27,7 +27,6 @@
 # - ``RECLONE``
 # - ``REQUIREMENTS_DIR``
 # - ``STACK_USER``
-# - ``TRACK_DEPENDS``
 # - ``http_proxy``, ``https_proxy``, ``no_proxy``
 #
 
@@ -44,7 +43,6 @@ declare -A -g GITREPO
 declare -A -g GITBRANCH
 declare -A -g GITDIR
 
-TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
@@ -2075,11 +2073,7 @@ function _safe_permission_operation {
         return 0
     fi
 
-    if [[ $TRACK_DEPENDS = True ]]; then
-        sudo_cmd="env"
-    else
-        sudo_cmd="sudo"
-    fi
+    sudo_cmd="sudo"
 
     $xtrace
     $sudo_cmd $@
diff --git a/inc/python b/inc/python
index 81b6a960a4..fd43cef932 100644
--- a/inc/python
+++ b/inc/python
@@ -175,7 +175,7 @@ function disable_python3_package {
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
-# ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
+# ``PIP_UPGRADE``, ``*_proxy``,
 # Usage:
 #  pip_install pip_arguments
 function pip_install {
@@ -219,37 +219,28 @@ function pip_install {
     # this works (for now...)
     local package_dir=${!#%\[*\]}
 
-    if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
-        # TRACK_DEPENDS=True installation creates a circular dependency when
-        # we attempt to install virtualenv into a virtualenv, so we must global
-        # that installation.
-        source $DEST/.venv/bin/activate
-        local cmd_pip=$DEST/.venv/bin/pip
+    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
     else
-        if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
-            local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
-            local sudo_pip="env"
-        else
-            local cmd_pip
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-            local sudo_pip="sudo -H"
-            if python3_enabled; then
-                # Special case some services that have experimental
-                # support for python3 in progress, but don't claim support
-                # in their classifier
-                echo "Check python version for : $package_dir"
-                if python3_disabled_for ${package_dir##*/}; then
-                    echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
-                else
-                    # For everything that is not explicitly blacklisted with
-                    # DISABLED_PYTHON3_PACKAGES, assume it supports python3
-                    # and we will let pip sort out the install, regardless of
-                    # the package being local or remote.
-                    echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
-                    sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                    cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                fi
+        local cmd_pip
+        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        local sudo_pip="sudo -H"
+        if python3_enabled; then
+            # Special case some services that have experimental
+            # support for python3 in progress, but don't claim support
+            # in their classifier
+            echo "Check python version for : $package_dir"
+            if python3_disabled_for ${package_dir##*/}; then
+                echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
+            else
+                # For everything that is not explicitly blacklisted with
+                # DISABLED_PYTHON3_PACKAGES, assume it supports python3
+                # and we will let pip sort out the install, regardless of
+                # the package being local or remote.
+                echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
+                sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                cmd_pip=$(get_pip_command $PYTHON3_VERSION)
             fi
         fi
     fi
diff --git a/stack.sh b/stack.sh
index d0206ebac0..089510fa48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -796,19 +796,6 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
-TRACK_DEPENDS=${TRACK_DEPENDS:-False}
-
-# Install Python packages into a virtualenv so that we can track them
-if [[ $TRACK_DEPENDS = True ]]; then
-    echo_summary "Installing Python packages into a virtualenv $DEST/.venv"
-    pip_install -U virtualenv
-
-    rm -rf $DEST/.venv
-    virtualenv --system-site-packages $DEST/.venv
-    source $DEST/.venv/bin/activate
-    $DEST/.venv/bin/pip freeze > $DEST/requires-pre-pip
-fi
-
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
 fixup_all
@@ -997,17 +984,6 @@ fi
 # osc commands. Alias dies with stack.sh.
 install_oscwrap
 
-if [[ $TRACK_DEPENDS = True ]]; then
-    $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
-    if ! diff -Nru $DEST/requires-pre-pip $DEST/requires-post-pip > $DEST/requires.diff; then
-        echo "Detect some changes for installed packages of pip, in depend tracking mode"
-        cat $DEST/requires.diff
-    fi
-    echo "Ran stack.sh in depend tracking mode, bailing out now"
-    exit 0
-fi
-
-
 # Syslog
 # ------
 

From d02fa6f856ac5951b8a879c23b57d5a752f28918 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 14 Jan 2020 15:47:51 +0000
Subject: [PATCH 2575/3333] do not gzip legacy service logs

This change removes the .gz extension from the
service and syslog logs exported via journalctl.
This change nolonger gzip compresses the exported
logs so that they can be rendered in the browser
directly when served from swift.

Change-Id: I4557a737cb13b9c2406056be08ab8a32ddd45162
---
 roles/export-devstack-journal/tasks/main.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index cbec4447b8..ef839edaaf 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -14,7 +14,7 @@
       name=""
       for u in $(systemctl list-unit-files | grep devstack | awk '{print $1}'); do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
-        journalctl -o short-precise --unit $u | gzip - > {{ stage_dir }}/logs/$name.txt.gz
+        journalctl -o short-precise --unit $u  > {{ stage_dir }}/logs/$name.txt
       done
 
 - name: Export legacy syslog.txt
@@ -29,7 +29,7 @@
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | gzip - > {{ stage_dir }}/logs/syslog.txt.gz
+         > {{ stage_dir }}/logs/syslog.txt
 
 # TODO: convert this to ansible
 #  - make a list of the above units

From 85c5ec11c9526e0429163db5701d3ea8c096a324 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Wed, 15 Jan 2020 10:58:29 +0900
Subject: [PATCH 2576/3333] Cleanup VM instances during unstack

Currently VMs created by a previous DevStack run still exists even
after re-run stack.sh. This leads to a failure in launching a VM after
the second run of stack.sh. We need to check the reason of the failure
by nova compute log and clean up remaining VMs. It is annoying.

IIRC we cleaned up existing VMs. While I failed to identify which commit
changed this behavior, I believe it is worth recovering it.

This commit changes unstack.sh to call cleanup_nova. cleanup_cinder()
already cleans up LVM volumes and some of them may be used by VMs,
so I believe it is reasonable to clean up VMs in unstack.sh.

Change-Id: I9fcbc5105e443037fada1ef6a76a078145964256
---
 unstack.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/unstack.sh b/unstack.sh
index ccea0ef585..276111edb9 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -99,6 +99,7 @@ run_phase unstack
 
 if is_service_enabled nova; then
     stop_nova
+    cleanup_nova
 fi
 
 if is_service_enabled placement; then

From d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 15 Jan 2020 18:30:36 +0100
Subject: [PATCH 2577/3333] Run Glance initialization when Glance is enabled,
 not just registry

Per [1] Glance registry should not be required to run since Queens.

[1] https://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance/deprecate-registry.html

Change-Id: I5477c8769ff4ae151d4d6ccb5e5d8dd5788909b0
Closes-bug: #1859847
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 089510fa48..dee84fa8e2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1155,7 +1155,7 @@ fi
 # Glance
 # ------
 
-if is_service_enabled g-reg; then
+if is_glance_enabled; then
     echo_summary "Configuring Glance"
     init_glance
 fi
@@ -1280,7 +1280,7 @@ fi
 # scripts as userdata.
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
-if is_service_enabled g-reg; then
+if is_glance_enabled; then
 
     echo_summary "Uploading images"
 

From d7dfcdb4674daae8a294848b1de6fa87c5d7d4eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 15 Jan 2020 18:36:20 +0100
Subject: [PATCH 2578/3333] Stop enabling g-reg by default

Per [1] Glance registry should not be required to run since Queens.

[1] https://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance/deprecate-registry.html

Change-Id: I93325cbd26dbc6a30062d9ba83acab248897b18e
Depends-on: https://review.opendev.org/702707
Related-bug: #1859847
---
 .zuul.yaml | 1 -
 stackrc    | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cbb9d99866..08513c23e9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -401,7 +401,6 @@
         key: true
         # Glance services
         g-api: true
-        g-reg: true
         # Nova services
         n-api: true
         n-api-meta: true
diff --git a/stackrc b/stackrc
index 2d3a599a36..9fd7f75335 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
-    ENABLED_SERVICES+=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Neutron

From 248d4bb8d2205de38e56ef1f92a4bf0870400a85 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 28 Nov 2019 12:57:12 +0000
Subject: [PATCH 2579/3333] Stop configuring '[DEFAULT] firewall_driver' for
 nova

This option has default to the 'NoopFirewallDriver' for some time and
will soon be removed. Stop configuring it entirely.

Change-Id: I4dbc0015cf26d7edf51d0d5fd978ccd3a1ad1b79
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/neutron                           | 2 --
 lib/neutron-legacy                    | 5 -----
 lib/neutron_plugins/nuage             | 2 --
 lib/nova_plugins/hypervisor-ironic    | 2 --
 lib/nova_plugins/hypervisor-libvirt   | 2 --
 lib/nova_plugins/hypervisor-openvz    | 2 --
 lib/nova_plugins/hypervisor-xenserver | 3 ---
 7 files changed, 18 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 888b5e864e..a86d83e170 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -365,8 +365,6 @@ function configure_neutron_nova_new {
     iniset $conf neutron auth_strategy $NEUTRON_AUTH_STRATEGY
     iniset $conf neutron region_name "$REGION_NAME"
 
-    iniset $conf DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
-
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf $conf
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index dbd6e2c06b..f0bdcf1da7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -384,11 +384,6 @@ function create_nova_conf_neutron {
     iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $conf neutron region_name "$REGION_NAME"
 
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-        iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    fi
-
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf $conf
 
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index f39c7c4f5b..8c75e15048 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -11,8 +11,6 @@ function neutron_plugin_create_nova_conf {
     local conf="$1"
     NOVA_OVS_BRIDGE=${NOVA_OVS_BRIDGE:-"br-int"}
     iniset $conf neutron ovs_bridge $NOVA_OVS_BRIDGE
-    LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-    iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 }
 
 function neutron_plugin_install_agent_packages {
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index adcc278812..113e2a75ea 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -39,10 +39,8 @@ function configure_nova_hypervisor {
     if ! is_ironic_hardware; then
         configure_libvirt
     fi
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
 
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
-    iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 
     # ironic section
     iniset $NOVA_CONF ironic auth_type password
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 3d676b9b8d..7d3ace8c1c 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -45,8 +45,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
     iniset $NOVA_CONF DEFAULT default_ephemeral_format "ext4"
     iniset $NOVA_CONF DEFAULT compute_driver "libvirt.LibvirtDriver"
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
     # Power architecture currently does not support graphical consoles.
     if is_arch "ppc64"; then
         iniset $NOVA_CONF vnc enabled "false"
diff --git a/lib/nova_plugins/hypervisor-openvz b/lib/nova_plugins/hypervisor-openvz
index 58ab5c11ac..57dc45c1c5 100644
--- a/lib/nova_plugins/hypervisor-openvz
+++ b/lib/nova_plugins/hypervisor-openvz
@@ -38,8 +38,6 @@ function cleanup_nova_hypervisor {
 function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver "openvz.OpenVzDriver"
     iniset $NOVA_CONF DEFAULT connection_type "openvz"
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
 }
 
 # install_nova_hypervisor() - Install external components
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index ccab18dc97..511ec1bc09 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -61,9 +61,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF xenserver connection_username "$XENAPI_USER"
     iniset $NOVA_CONF xenserver connection_password "$XENAPI_PASSWORD"
     iniset $NOVA_CONF DEFAULT flat_injected "False"
-    # Need to avoid crash due to new firewall support
-    XEN_FIREWALL_DRIVER=${XEN_FIREWALL_DRIVER:-"nova.virt.firewall.IptablesFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT firewall_driver "$XEN_FIREWALL_DRIVER"
 
     local dom0_ip
     dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)

From f9ff151549bfa57cfeec524cf06ae3d65c8ab0a8 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 16 Jan 2020 10:52:52 +0000
Subject: [PATCH 2580/3333] Stop configuring '[DEFAULT] use_neutron' for nova

This has now been removed and even prior to removal defaulted to True.

Change-Id: I847a873d833a4dbee96afa1d2726fea2b8045eeb
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a86d83e170..9e6a80cf08 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -354,7 +354,6 @@ function configure_neutron_rootwrap {
 # if not passed $NOVA_CONF is used.
 function configure_neutron_nova_new {
     local conf=${1:-$NOVA_CONF}
-    iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
     iniset $conf neutron username neutron
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0bdcf1da7..3d39d41b7e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -373,7 +373,6 @@ function configure_mutnauq {
 
 function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
-    iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"
     iniset $conf neutron username "$Q_ADMIN_USERNAME"

From ec3543a02883c3d9b288128e0a6cb941315e72cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Thu, 16 Jan 2020 19:58:37 +0100
Subject: [PATCH 2581/3333] Init Glance database only on the node with the
 database backend

Since [1] Glance init depends on either g-api or g-reg being
enabled.
This broke multinode g-api deployments with singlenode database
backend.
This commit aligns Glance with other services w.r.t when to
apply database init.

[1] d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a

Change-Id: Idc07764d6ba3a828f19691f56c73cbe9179c2673
Closes-bug: #1860021
---
 lib/glance | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/glance b/lib/glance
index 740bcabf6a..b4cab2ad74 100644
--- a/lib/glance
+++ b/lib/glance
@@ -276,16 +276,18 @@ function init_glance {
     rm -rf $GLANCE_IMAGE_DIR
     mkdir -p $GLANCE_IMAGE_DIR
 
-    # (Re)create glance database
-    recreate_database glance
+    if is_service_enabled $DATABASE_BACKENDS; then
+        # (Re)create glance database
+        recreate_database glance
 
-    time_start "dbsync"
-    # Migrate glance database
-    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
+        time_start "dbsync"
+        # Migrate glance database
+        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
-    # Load metadata definitions
-    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
-    time_stop "dbsync"
+        # Load metadata definitions
+        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
+        time_stop "dbsync"
+    fi
 }
 
 # install_glanceclient() - Collect source and prepare

From 6b6bdc7111aa6f953a29c5ffc8854039336ce660 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 9 Oct 2019 16:13:20 +0100
Subject: [PATCH 2582/3333] inc/python: Remove ability to mark packages as
 non-Python3

Everything in OpenStack *must* be Python 3 supporting now, which means
it's time to remove the functionality that allows us to blacklist
packages that didn't support Python 3.

Change-Id: I7c8cf538ec88bd4056b0109f19671e3d65f5da3a
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 inc/python           | 80 +++-----------------------------------------
 stackrc              |  4 ---
 tests/test_python.sh | 25 --------------
 3 files changed, 5 insertions(+), 104 deletions(-)
 delete mode 100755 tests/test_python.sh

diff --git a/inc/python b/inc/python
index fd43cef932..32dd72594f 100644
--- a/inc/python
+++ b/inc/python
@@ -85,60 +85,8 @@ function pip_install_gr_extras {
     pip_install $clean_name[$extras]
 }
 
-# python3_enabled_for() assumes the service(s) specified as arguments are
-# enabled for python 3 unless explicitly disabled. See python3_disabled_for().
-#
-# Multiple services specified as arguments are ``OR``'ed together; the test
-# is a short-circuit boolean, i.e it returns on the first match.
-#
-# python3_enabled_for dir [dir ...]
-function python3_enabled_for {
-    local xtrace
-    xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-
-    local enabled=1
-    local dirs=$@
-    local dir
-    for dir in ${dirs}; do
-        if ! python3_disabled_for "${dir}"; then
-            enabled=0
-        fi
-    done
-
-    $xtrace
-    return $enabled
-}
-
-# python3_disabled_for() checks if the service(s) specified as arguments are
-# disabled by the user in ``DISABLED_PYTHON3_PACKAGES``.
-#
-# Multiple services specified as arguments are ``OR``'ed together; the test
-# is a short-circuit boolean, i.e it returns on the first match.
-#
-# Uses global ``DISABLED_PYTHON3_PACKAGES``
-# python3_disabled_for dir [dir ...]
-function python3_disabled_for {
-    local xtrace
-    xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-
-    local enabled=1
-    local dirs=$@
-    local dir
-    for dir in ${dirs}; do
-        [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
-    done
-
-    $xtrace
-    return $enabled
-}
-
 # enable_python3_package() -- no-op for backwards compatibility
 #
-# For example:
-#   enable_python3_package nova
-#
 # enable_python3_package dir [dir ...]
 function enable_python3_package {
     local xtrace
@@ -150,25 +98,15 @@ function enable_python3_package {
     $xtrace
 }
 
-# disable_python3_package() adds the services passed as argument to
-# the ``DISABLED_PYTHON3_PACKAGES`` list.
-#
-# For example:
-#   disable_python3_package swift
+# disable_python3_package() -- no-op for backwards compatibility
 #
-# Uses global ``DISABLED_PYTHON3_PACKAGES``
 # disable_python3_package dir [dir ...]
 function disable_python3_package {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
-    local disabled_svcs="${DISABLED_PYTHON3_PACKAGES}"
-    local dir
-    for dir in $@; do
-        disabled_svcs+=",$dir"
-    done
-    DISABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$disabled_svcs")
+    echo "It is no longer possible to call disable_python3_package()."
 
     $xtrace
 }
@@ -231,17 +169,9 @@ function pip_install {
             # support for python3 in progress, but don't claim support
             # in their classifier
             echo "Check python version for : $package_dir"
-            if python3_disabled_for ${package_dir##*/}; then
-                echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
-            else
-                # For everything that is not explicitly blacklisted with
-                # DISABLED_PYTHON3_PACKAGES, assume it supports python3
-                # and we will let pip sort out the install, regardless of
-                # the package being local or remote.
-                echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
-                sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-            fi
+            echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
+            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
         fi
     fi
 
diff --git a/stackrc b/stackrc
index 9fd7f75335..b31fb395c7 100644
--- a/stackrc
+++ b/stackrc
@@ -138,10 +138,6 @@ fi
 # Control whether Python 3 should be used at all.
 export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 
-# Explicitly list services not to run under Python 3. See
-# disable_python3_package to edit this variable.
-export DISABLED_PYTHON3_PACKAGES=""
-
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
diff --git a/tests/test_python.sh b/tests/test_python.sh
deleted file mode 100755
index 1f5453c4c7..0000000000
--- a/tests/test_python.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-# Tests for DevStack INI functions
-
-TOP=$(cd $(dirname "$0")/.. && pwd)
-
-source $TOP/functions-common
-source $TOP/inc/python
-
-source $TOP/tests/unittest.sh
-
-echo "Testing Python 3 functions"
-
-# Initialize variables manipulated by functions under test.
-export DISABLED_PYTHON3_PACKAGES=""
-
-assert_true "should be enabled by default" python3_enabled_for testpackage1
-
-assert_false "should not be disabled yet" python3_disabled_for testpackage2
-
-disable_python3_package testpackage2
-assert_equal "$DISABLED_PYTHON3_PACKAGES" "testpackage2"  "unexpected result"
-assert_true "should be disabled" python3_disabled_for testpackage2
-
-report_results

From 98f3bbe509c2de9efaf4f3fc1b5dbc42d7a67987 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 17 Jan 2020 17:41:22 +0000
Subject: [PATCH 2583/3333] Revert "Stop enabling g-reg by default"

This reverts commit d7dfcdb4674daae8a294848b1de6fa87c5d7d4eb. A
subsquent change that depends on this,
d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a, has knock on effects for
devstack-gate and needs to be reverted. Revert this first.

Change-Id: Ic5402f57052648e10eacf3c3de67d2cdd2d42f63
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Partial-bug: #1860021
---
 .zuul.yaml | 1 +
 stackrc    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 08513c23e9..cbb9d99866 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -401,6 +401,7 @@
         key: true
         # Glance services
         g-api: true
+        g-reg: true
         # Nova services
         n-api: true
         n-api-meta: true
diff --git a/stackrc b/stackrc
index 9fd7f75335..2d3a599a36 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
-    ENABLED_SERVICES+=,g-api
+    ENABLED_SERVICES+=,g-api,g-reg
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Neutron

From 48d1f028c43dd26aab852715e451e1ec08421a2f Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 17 Jan 2020 17:23:11 +0000
Subject: [PATCH 2584/3333] Revert "Run Glance initialization when Glance is
 enabled, not just registry"

This reverts commit d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a. This has
knock on effects for devstack-gate, which configures g-api on subnodes
node but not mysql, resulting in failures. A longer term fix would be to
either a) stop configuring g-api on subnodes if we can determine it's
not necessary or b) only configure the database if on the main node.
However, both options are subject to debate so for now just unclog the
gate.

Change-Id: I58baa3b6c63c648836ae8152c2d6d7ceff11a388
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Closes-bug: #1860021
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index dee84fa8e2..089510fa48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1155,7 +1155,7 @@ fi
 # Glance
 # ------
 
-if is_glance_enabled; then
+if is_service_enabled g-reg; then
     echo_summary "Configuring Glance"
     init_glance
 fi
@@ -1280,7 +1280,7 @@ fi
 # scripts as userdata.
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
-if is_glance_enabled; then
+if is_service_enabled g-reg; then
 
     echo_summary "Uploading images"
 

From 8dd6f153d6b8dfd8ae976e7f1c9df06019a159b9 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Mon, 20 Jan 2020 07:24:17 +0100
Subject: [PATCH 2585/3333] Add LIBVIRT_CPU_MODE to set CPU mode

In same cases, the hypervisor presents to the guest OS a named CPU model
is similar to the host CPU and adds extra features to approximate the
host model. However, this does not guarantee all features will be
precisely match.

This patch adds LIBVIRT_CPU_MODE to allow users to define the CPU mode
they want to use, for example "host-passthrough".

Change-Id: I83792c776b50d1d22584be2a37cc6a166f09c72b
---
 lib/nova                            | 1 +
 lib/nova_plugins/hypervisor-libvirt | 2 +-
 stackrc                             | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 7557a51196..0893ed7084 100644
--- a/lib/nova
+++ b/lib/nova
@@ -259,6 +259,7 @@ function configure_nova {
                 if [ ! -e /dev/kvm ]; then
                     echo "WARNING: Switching to QEMU"
                     LIBVIRT_TYPE=qemu
+                    LIBVIRT_CPU_MODE=none
                     if which selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
                         # https://bugzilla.redhat.com/show_bug.cgi?id=753589
                         sudo setsebool virt_use_execmem on
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 7d3ace8c1c..d1b3d784b7 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -39,7 +39,7 @@ function cleanup_nova_hypervisor {
 function configure_nova_hypervisor {
     configure_libvirt
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
-    iniset $NOVA_CONF libvirt cpu_mode "none"
+    iniset $NOVA_CONF libvirt cpu_mode "$LIBVIRT_CPU_MODE"
     # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
     iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
diff --git a/stackrc b/stackrc
index 2d3a599a36..d581e48530 100644
--- a/stackrc
+++ b/stackrc
@@ -625,6 +625,7 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
+        LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-none}
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check

From 2e45f2c267c9ababdbdfc4c505b329398391c5f9 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Sat, 18 Jan 2020 19:59:29 -0600
Subject: [PATCH 2586/3333] Adding nova-live-migration job in devstack gate

nova-live-migration is legacy job and  and rely on
devstack-gate + devstack setting so any change in devstack can
break it. Example bug: 1860021

We can remove this job once it is migrated to zuulv3 native.

Change-Id: Ie34d4dc1ab30ced8161796fe32628db07de86cc9
Related-bug: #1860021
---
 .zuul.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index e86805f13d..3468f69e28 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -622,6 +622,15 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        # NOTE(gmann): Remove this job from devstack pipeline once it is
+        # migrated to zuulv3 native. This is legacy job and rely on
+        # devstack-gate + devstack setting so any change in devstack can
+        # break it.
+        - nova-live-migration:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack

From e18325ca67dcb70b01a29563432291e1baf9f46e Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 22 Jan 2020 05:54:06 +0000
Subject: [PATCH 2587/3333] Fix pip uncap fallout for nova and barbican

Need to make PyYAML overridable on Ubuntu, it is a dependency for e.g.
cloud-init, so we cannot remove it.

Depends-On: https://review.opendev.org/703792
Change-Id: I4423dfb2c30299903b52a2bb06d846dd487f5b8b
---
 tools/fixup_stuff.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index eb8a76f276..7e5ae75831 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -82,6 +82,14 @@ function fixup_ubuntu {
 
     # Enable universe
     sudo add-apt-repository -y universe
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -f /usr/lib/python3/dist-packages/PyYAML-*.egg-info
 }
 
 # Python Packages

From 09e860fc2c306774076c1814ba3ab7c44404066d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Sun, 19 Jan 2020 12:41:14 +0100
Subject: [PATCH 2588/3333] Run Glance initialization when Glance is enabled,
 not just registry (v2)

Per [1] Glance registry should not be required to run since Queens.

v2 improves on v1 [2] (now reverted [3]) by applying minor comments
from reviews so far and ensuring nova-live-migration job does not see
a change in behavior and hence does not break [4].
[5] tried to fix the issue but it did only partially, regarding
the database but not the image upload [6].
This patch ensures double cirros image upload does not happen as well.

[1] https://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance/deprecate-registry.html
[2] https://review.opendev.org/702707
[3] https://review.opendev.org/703131
[4] https://bugs.launchpad.net/devstack/+bug/1860021
[5] https://review.opendev.org/702960
[6] https://bugs.launchpad.net/devstack/+bug/1860021/comments/16

Change-Id: I61538acd6bd4c7b3da26c4084225b220d7d1aa2c
Closes-bug: #1859847
Related-bug: #1860021
---
 lib/glance | 18 ++++++++----------
 stack.sh   |  7 ++++---
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/lib/glance b/lib/glance
index b4cab2ad74..740bcabf6a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -276,18 +276,16 @@ function init_glance {
     rm -rf $GLANCE_IMAGE_DIR
     mkdir -p $GLANCE_IMAGE_DIR
 
-    if is_service_enabled $DATABASE_BACKENDS; then
-        # (Re)create glance database
-        recreate_database glance
+    # (Re)create glance database
+    recreate_database glance
 
-        time_start "dbsync"
-        # Migrate glance database
-        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
+    time_start "dbsync"
+    # Migrate glance database
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
-        # Load metadata definitions
-        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
-        time_stop "dbsync"
-    fi
+    # Load metadata definitions
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
+    time_stop "dbsync"
 }
 
 # install_glanceclient() - Collect source and prepare
diff --git a/stack.sh b/stack.sh
index 089510fa48..fe71eae36c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1155,7 +1155,8 @@ fi
 # Glance
 # ------
 
-if is_service_enabled g-reg; then
+# NOTE(yoctozepto): limited to node hosting the database which is the controller
+if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     echo_summary "Configuring Glance"
     init_glance
 fi
@@ -1280,8 +1281,8 @@ fi
 # scripts as userdata.
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
-if is_service_enabled g-reg; then
-
+# NOTE(yoctozepto): limited to node hosting the database which is the controller
+if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     echo_summary "Uploading images"
 
     for image_url in ${IMAGE_URLS//,/ }; do

From 89cb80d2120a7247dcc8b1f6a073cf9c9e488806 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Sat, 18 Jan 2020 15:41:17 +0000
Subject: [PATCH 2589/3333] Revert "Revert "Stop enabling g-reg by default""

This reverts commit 98f3bbe509c2de9efaf4f3fc1b5dbc42d7a67987.

This is no longer necessary as proper fix [1]
is now applied.

[1] https://review.opendev.org/703288

Change-Id: Ibc40f79b1daf30246ed24790e9b305caea497cb2
Related-bug: #1859847
Related-bug: #1860021
---
 .zuul.yaml | 1 -
 stackrc    | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3468f69e28..130b84a149 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -398,7 +398,6 @@
         key: true
         # Glance services
         g-api: true
-        g-reg: true
         # Nova services
         n-api: true
         n-api-meta: true
diff --git a/stackrc b/stackrc
index 412aca8f07..b31fb395c7 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
-    ENABLED_SERVICES+=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Neutron

From 78cf6f642aea91385dfbe6e1fa594e9f5373e69c Mon Sep 17 00:00:00 2001
From: Terry Wilson <twilson@redhat.com>
Date: Tue, 15 Oct 2019 19:45:09 +0000
Subject: [PATCH 2590/3333] Always install python3 and its dev package

Some distros do not install python3/python3-devel with the minimal
install. F29 doesn't install -devel, and neither Centos 7 or 8
install either. This patch ensures that these packages get installed.

Ideally, PYTHON3_VERSION would be set *after* ensuring that python3
was installed, but it gets a little tricky with all of the includes.
This sets it to 3.6 as nothing uses 3.5 anymore.

Change-Id: I7bdfc408b7c18273639ec26eade475856ac43593
---
 inc/python | 2 ++
 stack.sh   | 5 ++++-
 stackrc    | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/inc/python b/inc/python
index 32dd72594f..bf3aacaf8f 100644
--- a/inc/python
+++ b/inc/python
@@ -463,6 +463,8 @@ function install_python3 {
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     elif is_suse; then
         install_package python3-devel python3-dbm
+    elif is_fedora; then
+        install_package python3 python3-devel
     fi
 }
 
diff --git a/stack.sh b/stack.sh
index 089510fa48..de1499ddd6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -415,8 +415,11 @@ fi
 
 # Ensure python is installed
 # --------------------------
-is_package_installed python || install_package python
+install_python3
 
+if ! python3_enabled; then
+    is_package_installed python || install_package python
+fi
 
 # Configure Logging
 # -----------------
diff --git a/stackrc b/stackrc
index 412aca8f07..6cc328ea60 100644
--- a/stackrc
+++ b/stackrc
@@ -142,7 +142,7 @@ export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
-export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.5}}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.6}}
 
 # Just to be more explicit on the Python 2 version to use.
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"

From afd346a0a10d016e6ab95bdba3932eb6df8f636b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 23 Jan 2020 13:13:05 +1100
Subject: [PATCH 2591/3333] devstack-plugins-list: skip openstack/openstack

The proposal job to update the plugin list has been failing for a long
time as it gets a 500 error from gitea on the openstack/openstack
repo.  This is an odd "superrepo" with all projects as submodules;
thus openstack/openstack/devstack is actually a project, not the
directory with a plugin in it.

Skip this repo (gitea shouldn't return a 500, but that's another
thing...)

Regenerate the list manually for this run.

Change-Id: I6ed65bcb720d4cb10702cbf66106120e001ec35f
---
 doc/source/plugin-registry.rst          | 2 +-
 tools/generate-devstack-plugins-list.py | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5cbe4ed505..904400ece6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -147,7 +147,6 @@ x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
 x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
 x/devstack-plugin-nfs                    `https://opendev.org/x/devstack-plugin-nfs <https://opendev.org/x/devstack-plugin-nfs>`__
-x/devstack-plugin-sheepdog               `https://opendev.org/x/devstack-plugin-sheepdog <https://opendev.org/x/devstack-plugin-sheepdog>`__
 x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
 x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
 x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__
@@ -203,6 +202,7 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
+x/whitebox-tempest-plugin                `https://opendev.org/x/whitebox-tempest-plugin <https://opendev.org/x/whitebox-tempest-plugin>`__
 ======================================== ===
 
 
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index d39b8018ae..3ac9c4d9aa 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -45,9 +45,14 @@
 
 def is_in_wanted_namespace(proj):
     # only interested in openstack or x namespace (e.g. not retired
-    # stackforge, etc)
+    # stackforge, etc).
+    #
+    # openstack/openstack "super-repo" of openstack projects as
+    # submodules, that can cause gitea to 500 timeout and thus stop
+    # this script.  Skip it.
     if proj.startswith('stackforge/') or \
-       proj.startswith('stackforge-attic/'):
+       proj.startswith('stackforge-attic/') or \
+       proj == "openstack/openstack":
         return False
     else:
         return True

From 97d857593759f96f036a7e0a528cb6f2159e0fc7 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Thu, 19 Dec 2019 07:38:45 -0600
Subject: [PATCH 2592/3333] Remove Sheepdog plugin information

The Sheepdog project has been defunct for awhile now, and the Sheepdog
driver and os-brick connector is now being removed from Cinder. This
cleans up plugin references for the driver.

Change-Id: Ieb2d9cf653b2d3a4af30cab26b8428a7c7edff98
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 lib/cinder_plugins/sheepdog | 41 -------------------------------------
 1 file changed, 41 deletions(-)
 delete mode 100644 lib/cinder_plugins/sheepdog

diff --git a/lib/cinder_plugins/sheepdog b/lib/cinder_plugins/sheepdog
deleted file mode 100644
index 558de46c6d..0000000000
--- a/lib/cinder_plugins/sheepdog
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-#
-# lib/cinder_plugins/sheepdog
-# Configure the sheepdog driver
-
-# Enable with:
-#
-#   CINDER_DRIVER=sheepdog
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# configure_cinder_driver - make configuration changes, including those to other services
-
-# Save trace setting
-_XTRACE_CINDER_SHEEPDOG=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default directories
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_driver - Set config files, create data dirs, etc
-function configure_cinder_driver {
-    iniset $CINDER_CONF DEFAULT volume_driver "cinder.volume.drivers.sheepdog.SheepdogDriver"
-}
-
-# Restore xtrace
-$_XTRACE_CINDER_SHEEPDOG
-
-# Local variables:
-# mode: shell-script
-# End:

From 6808a3468dd157f9f0676f972aea54add4e33063 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Mon, 20 Jan 2020 15:52:33 +0000
Subject: [PATCH 2593/3333] Clean up remainders of USE_SYSTEMD and logging
 setup

We dropped the ability to override USE_SYSTEMD to False when we deleted
screen support in [0], so we can also clean up any conditionals based
on it.

Also clean up the logging setup functions, dropping local vars for
parameters that we don't actually support anymore.

[0] I8c27182f60b0f5310b3a8bf5feb02beb7ffbb26a

Change-Id: I5cbce9f2c42e111761e8689447b3f8cbb7ea2eb5
---
 clean.sh  | 10 ++++------
 functions | 43 ++++++++++++++++---------------------------
 stack.sh  | 25 ++++++++++---------------
 stackrc   |  4 +---
 4 files changed, 31 insertions(+), 51 deletions(-)

diff --git a/clean.sh b/clean.sh
index d6c6b40608..685a719cfb 100755
--- a/clean.sh
+++ b/clean.sh
@@ -123,12 +123,10 @@ if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
     sudo rm -rf $LOGDIR
 fi
 
-# Clean out the systemd user unit files if systemd was used.
-if [[ "$USE_SYSTEMD" = "True" ]]; then
-    sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
-    # Make systemd aware of the deletion.
-    $SYSTEMCTL daemon-reload
-fi
+# Clean out the systemd unit files.
+sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
+# Make systemd aware of the deletion.
+$SYSTEMCTL daemon-reload
 
 # Clean up venvs
 DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]} .config/openstack"
diff --git a/functions b/functions
index 8ea634e753..6da6bc52fa 100644
--- a/functions
+++ b/functions
@@ -635,40 +635,29 @@ function vercmp {
 # This sets up defaults we like in devstack for logging for tracking
 # down issues, and makes sure everything is done the same between
 # projects.
+# NOTE(jh): Historically this function switched between three different
+# functions: setup_systemd_logging, setup_colorized_logging and
+# setup_standard_logging_identity. Since we always run with systemd now,
+# this could be cleaned up, but the other functions may still be in use
+# by plugins. Since deprecations haven't worked in the past, we'll just
+# leave them in place.
 function setup_logging {
-    local conf_file=$1
-    local other_cond=${2:-"False"}
-    if [[ "$USE_SYSTEMD" == "True" ]]; then
-        setup_systemd_logging $conf_file
-    elif [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
-        setup_colorized_logging $conf_file
-    else
-        setup_standard_logging_identity $conf_file
-    fi
+    setup_systemd_logging $1
 }
 
 # This function sets log formatting options for colorizing log
 # output to stdout. It is meant to be called by lib modules.
-# The last two parameters are optional and can be used to specify
-# non-default value for project and user format variables.
-# Defaults are respectively 'project_name' and 'user_name'
-#
-# setup_colorized_logging something.conf SOMESECTION
 function setup_colorized_logging {
     local conf_file=$1
-    local conf_section="DEFAULT"
-    local project_var="project_name"
-    local user_var="user_name"
     # Add color to logging output
-    iniset $conf_file $conf_section logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
-    iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
+    iniset $conf_file DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+    iniset $conf_file DEFAULT logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
 }
 
 function setup_systemd_logging {
     local conf_file=$1
-    local conf_section="DEFAULT"
     # NOTE(sdague): this is a nice to have, and means we're using the
     # native systemd path, which provides for things like search on
     # request-id. However, there may be an eventlet interaction here,
@@ -676,16 +665,16 @@ function setup_systemd_logging {
     USE_JOURNAL=$(trueorfalse False USE_JOURNAL)
     local pidstr=""
     if [[ "$USE_JOURNAL" == "True" ]]; then
-        iniset $conf_file $conf_section use_journal "True"
+        iniset $conf_file DEFAULT use_journal "True"
         # if we are using the journal directly, our process id is already correct
     else
         pidstr="(pid=%(process)d) "
     fi
-    iniset $conf_file $conf_section logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
+    iniset $conf_file DEFAULT logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
 
-    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
+    iniset $conf_file DEFAULT logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 
 function setup_standard_logging_identity {
diff --git a/stack.sh b/stack.sh
index 089510fa48..f00bceb21d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -803,13 +803,11 @@ fixup_all
 # Install subunit for the subunit output stream
 pip_install -U os-testr
 
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    pip_install_gr systemd-python
-    # the default rate limit of 1000 messages / 30 seconds is not
-    # sufficient given how verbose our logging is.
-    iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"
-    sudo systemctl restart systemd-journald
-fi
+pip_install_gr systemd-python
+# the default rate limit of 1000 messages / 30 seconds is not
+# sufficient given how verbose our logging is.
+iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"
+sudo systemctl restart systemd-journald
 
 # Virtual Environment
 # -------------------
@@ -1521,14 +1519,11 @@ if [[ -n "$DEPRECATED_TEXT" ]]; then
     echo
 fi
 
-# If USE_SYSTEMD is enabled, tell the user about using it.
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    echo
-    echo "Services are running under systemd unit files."
-    echo "For more information see: "
-    echo "https://docs.openstack.org/devstack/latest/systemd.html"
-    echo
-fi
+echo
+echo "Services are running under systemd unit files."
+echo "For more information see: "
+echo "https://docs.openstack.org/devstack/latest/systemd.html"
+echo
 
 # Useful info on current state
 cat /etc/devstack-version
diff --git a/stackrc b/stackrc
index 2d3a599a36..6d8f594309 100644
--- a/stackrc
+++ b/stackrc
@@ -109,9 +109,7 @@ CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 
-# Whether to use SYSTEMD to manage services, we only do this from
-# Queens forward.
-USE_SYSTEMD="True"
+# Whether to use user specific units for running services or global ones.
 USER_UNITS=$(trueorfalse False USER_UNITS)
 if [[ "$USER_UNITS" == "True" ]]; then
     SYSTEMD_DIR="$HOME/.local/share/systemd/user"

From 29bf8523965b504624f9450f3dffe863994b4077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Fri, 24 Jan 2020 11:52:13 +0100
Subject: [PATCH 2594/3333] Do not try finding pip for python2 when not
 required

[1] stopped installing pip for py2 when py3 is being used.

This patch makes sure we check only for py3 pip then.

Also removed some no-longer-relevant comment and
made uninstall behave the same.

Check for pip>=6 removed too.

See also [2].

[1] 279a7589b03db69fd1b85d947cd0171dacef94ee
[2] http://lists.openstack.org/pipermail/openstack-discuss/2020-January/012182.html

Change-Id: I36ee53e57e468d760b80a7e621b90899867a8efd
---
 inc/python | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/inc/python b/inc/python
index 32dd72594f..37e8399f4a 100644
--- a/inc/python
+++ b/inc/python
@@ -162,16 +162,14 @@ function pip_install {
         local sudo_pip="env"
     else
         local cmd_pip
-        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         local sudo_pip="sudo -H"
         if python3_enabled; then
-            # Special case some services that have experimental
-            # support for python3 in progress, but don't claim support
-            # in their classifier
-            echo "Check python version for : $package_dir"
-            echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
+            echo "Using python $PYTHON3_VERSION to install $package_dir because python3_enabled=True"
             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
             cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+        else
+            echo "Using python $PYTHON2_VERSION to install $package_dir because python3_enabled=False"
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         fi
     fi
 
@@ -179,16 +177,6 @@ function pip_install {
     # Always apply constraints
     cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
 
-    # FIXME(dhellmann): Need to force multiple versions of pip for
-    # packages like setuptools?
-    local pip_version
-    pip_version=$(python -c "import pip; \
-                        print(pip.__version__.split('.')[0])")
-    if (( pip_version<6 )); then
-        die $LINENO "Currently installed pip version ${pip_version} does not" \
-            "meet minimum requirements (>=6)."
-    fi
-
     $xtrace
 
     # Also install test requirements
@@ -225,8 +213,13 @@ function pip_uninstall {
         local sudo_pip="env"
     else
         local cmd_pip
-        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         local sudo_pip="sudo -H"
+        if python3_enabled; then
+            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+        else
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        fi
     fi
     # don't error if we can't uninstall, it might not be there
     $sudo_pip $cmd_pip uninstall -y $name || /bin/true

From 4dc02f97e7a750bf97ec71ce7fedd49e96dc5bdb Mon Sep 17 00:00:00 2001
From: Witek Bedyk <witold.bedyk@suse.com>
Date: Fri, 24 Jan 2020 18:52:25 +0100
Subject: [PATCH 2595/3333] Remove fixup_python_packages

The hack has be around for pip 1.4.1 and older. It should be safe to
remove it by now. In fact it causes problems in my Ubutu Bionic VM when
trying to overwrite httplib2 library installed from the distro package.

Change-Id: I34b826f4e8f10f8d44b888120f19fcc7ba501b3d
---
 tools/fixup_stuff.sh | 37 -------------------------------------
 1 file changed, 37 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 7e5ae75831..a5c1667518 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -5,16 +5,6 @@
 # fixup_stuff.sh
 #
 # All distro and package specific hacks go in here
-#
-# - prettytable 0.7.2 permissions are 600 in the package and
-#   pip 1.4 doesn't fix it (1.3 did)
-#
-# - httplib2 0.8 permissions are 600 in the package and
-#   pip 1.4 doesn't fix it (1.3 did)
-#
-# - Fedora:
-#   - set selinux not enforcing
-#   - uninstall firewalld (f20 only)
 
 
 # If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
@@ -101,32 +91,6 @@ function get_package_path {
     echo $(python -c "import os; import $package; print(os.path.split(os.path.realpath($package.__file__))[0])")
 }
 
-
-# Pre-install affected packages so we can fix the permissions
-# These can go away once we are confident that pip 1.4.1+ is available everywhere
-
-function fixup_python_packages {
-    # Fix prettytable 0.7.2 permissions
-    # Don't specify --upgrade so we use the existing package if present
-    pip_install 'prettytable>=0.7'
-    PACKAGE_DIR=$(get_package_path prettytable)
-    # Only fix version 0.7.2
-    dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)
-    if [[ -d $dir ]]; then
-        sudo chmod +r $dir/*
-    fi
-
-    # Fix httplib2 0.8 permissions
-    # Don't specify --upgrade so we use the existing package if present
-    pip_install httplib2
-    PACKAGE_DIR=$(get_package_path httplib2)
-    # Only fix version 0.8
-    dir=$(echo $PACKAGE_DIR-0.8*)
-    if [[ -d $dir ]]; then
-        sudo chmod +r $dir/*
-    fi
-}
-
 function fixup_fedora {
     if ! is_fedora; then
         return
@@ -268,7 +232,6 @@ function fixup_virtualenv {
 function fixup_all {
     fixup_keystone
     fixup_ubuntu
-    fixup_python_packages
     fixup_fedora
     fixup_suse
     fixup_virtualenv

From 19e4d972884e422d691c4cc1fe9e7ed3a03a2c01 Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 24 Jan 2020 11:44:46 +0100
Subject: [PATCH 2596/3333] Install psutil required by tools/mlock_report.py
 script

'tools/mlock_report.py' script requires 'psutil' package to be
installed. This ensures it is done before memory_peak service is
started.

Partial-Bug: #1860753
Change-Id: I7b2b6eaf9856c6057e1a4a0054d15074150a6cb6
---
 lib/dstat | 9 +++++++++
 stack.sh  | 7 +++++++
 2 files changed, 16 insertions(+)

diff --git a/lib/dstat b/lib/dstat
index fe38d75585..f5bd2bb948 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -9,6 +9,7 @@
 
 # ``stack.sh`` calls the entry points in this order:
 #
+# - install_dstat
 # - start_dstat
 # - stop_dstat
 
@@ -16,6 +17,14 @@
 _XTRACE_DSTAT=$(set +o | grep xtrace)
 set +o xtrace
 
+# install_dstat() - Install prerequisites for dstat services
+function install_dstat {
+    if is_service_enabled memory_tracker; then
+        # Install python libraries required by tools/mlock_report.py
+        pip_install_gr psutil
+    fi
+}
+
 # start_dstat() - Start running processes
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
diff --git a/stack.sh b/stack.sh
index fe71eae36c..2a6e470f7e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -867,6 +867,13 @@ if is_service_enabled tls-proxy; then
     init_cert
 fi
 
+# Dstat
+# -----
+
+# Install dstat services prerequisites
+install_dstat
+
+
 # Check Out and Install Source
 # ----------------------------
 

From e727dd56821231677e398133a3f991dcc3931ff4 Mon Sep 17 00:00:00 2001
From: Witek Bedyk <witold.bedyk@suse.com>
Date: Mon, 27 Jan 2020 16:00:12 +0100
Subject: [PATCH 2597/3333] Remove conflicting packages in Ubuntu

Following packages conflict with pip installed versions:
* httplib2
* pyasn1-modules

Change-Id: Ic4f70f839765e67394509cc543560aac7f50e287
---
 tools/fixup_stuff.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a5c1667518..ae555d5861 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -79,6 +79,8 @@ function fixup_ubuntu {
     # manifest of what to remove.  However, in most cases, simply
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
+    sudo rm -f /usr/lib/python3/dist-packages/httplib2-*.egg-info
+    sudo rm -f /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
     sudo rm -f /usr/lib/python3/dist-packages/PyYAML-*.egg-info
 }
 

From 169f5dee475f49ca18cd5f803287797a6c1ee5c0 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 6 Jan 2020 13:45:33 +0000
Subject: [PATCH 2598/3333] libvirt: Support the use of the virt-preview repo
 when using Fedora

The virt-preview repo provides the latest rawhide versions of QEMU,
Libvirt and other virt tools for older releases of Fedora. This repo is
extremely useful when testing features in OpenStack that rely on these
latest builds well in advance of them landing in full Fedora, CentOS or
RHEL releases.

This change adds a ``ENABLE_FEDORA_VIRT_PREVIEW_REPO`` configurable
to control when this repo is enabled and used when deploying on Fedora.

Change-Id: I5c3e1b7b632fd73310c462530990cdb0e0c0ceea
---
 lib/nova_plugins/functions-libvirt | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 35666393ca..03df258e03 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,6 +24,10 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Currently fairly specific to OpenStackCI hosts
 DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
 
+# Enable the Fedora Virtualization Preview Copr repo that provides the latest
+# rawhide builds of QEMU, Libvirt and other virt tools.
+ENABLE_FEDORA_VIRT_PREVIEW_REPO=$(trueorfalse False ENABLE_FEDORA_VIRT_PREVIEW_REPO)
+
 # Enable coredumps for libvirt
 #  Bug: https://bugs.launchpad.net/nova/+bug/1643911
 function _enable_coredump {
@@ -61,6 +65,12 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
 
+        # Optionally enable the virt-preview repo when on Fedora
+        if [[ $DISTRO =~ f[0-9][0-9] ]] && [[ ${ENABLE_FEDORA_VIRT_PREVIEW_REPO} == "True" ]]; then
+            # https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/
+            sudo dnf copr enable -y @virtmaint-sig/virt-preview
+        fi
+
         # Note that in CentOS/RHEL this needs to come from the RDO
         # repositories (qemu-kvm-ev ... which provides this package)
         # as the base system version is too old.  We should have

From f6597b1b461b758c3984ad607d3a9559d273a66d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 29 Jan 2020 15:46:35 +0000
Subject: [PATCH 2599/3333] Undeprecate neutron-legacy scripts

Work on the new neutron scripts has stalled and they aren't in a useable
state yet. Given the ongoing decline in contributions, let us
acknowledge this and undeprecate the neutron-legacy scripts so that
people can continue to use them without feeling guilty about it.

Change-Id: I4bce19da861abf18ddb89d82fd312c5e49a4ee7c
---
 .zuul.yaml         | 15 +++------------
 lib/neutron-legacy |  2 --
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 130b84a149..7801297557 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -405,22 +405,15 @@
         n-cpu: true
         n-novnc: true
         n-sch: true
+        # Placement service
         placement-api: true
         # Neutron services
-        # We need to keep using the neutron-legacy based services for
-        # now until all issues with the new lib/neutron code are solved
         q-agt: true
         q-dhcp: true
         q-l3: true
         q-meta: true
         q-metering: true
         q-svc: true
-        # neutron-api: true
-        # neutron-agent: true
-        # neutron-dhcp: true
-        # neutron-l3: true
-        # neutron-metadata-agent: true
-        # neutron-metering: true
         # Swift services
         s-account: true
         s-container: true
@@ -449,12 +442,10 @@
           tls-proxy: true
           # Nova services
           n-cpu: true
+          # Placement services
           placement-client: true
           # Neutron services
-          # We need to keep using the neutron-legacy based services for
-          # now until all issues with the new lib/neutron code are solved
           q-agt: true
-          # neutron-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -464,7 +455,7 @@
           # s-*: false
           horizon: false
           tempest: false
-          # Test matrix emits ceilometer but ceilomenter is not installed in the
+          # Test matrix emits ceilometer but ceilometer is not installed in the
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3d39d41b7e..8fb8858eb8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -58,8 +58,6 @@
 # Neutron Network Configuration
 # -----------------------------
 
-deprecated "Using lib/neutron-legacy is deprecated, and it will be removed in the future"
-
 if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi

From e1c0406d10380f6ad3620fa9e12df8499a1010ac Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Wed, 29 Jan 2020 15:39:17 -0600
Subject: [PATCH 2600/3333] Support TEMPEST_BRANCH with tag name

TEMPEST_BRANCH which is mostly set as master so
that Tempest master is run to test the env. With
stable branch going to EM state and Tempest master
might not work due to incompatibility of code or
requirements. In that case we pin the Tempest so that
older Tempest can be used for their testing.

Till now for ocata, pike and, queens we used the gerrit style
ref to pin the Tempest which is not preferred way. We should be
able to use the tag name on TEMPEST_BRANCH.

This commit explicitly checkout the tag set in TEMPEST_BRANCH
as git_clone does not checkout the tag directly until RECLONE
is true or tempest dir does not exist.

After this stable branch or job can set the tag directly with name.
For exmaple: TEMPEST_BRANCH=23.0.0.

Change-Id: Ic777e4b56c4932dde135ac909cb5c6f4a7d5cc78
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index ce0886bbd9..ec61c184a0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -686,6 +686,11 @@ function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
     pip_install 'tox!=2.8.0'
     pushd $TEMPEST_DIR
+    # NOTE(gmann): checkout the TEMPEST_BRANCH in case TEMPEST_BRANCH
+    # is tag name not master. git_clone would not checkout tag because
+    # TEMPEST_DIR already exist until RECLONE is true.
+    git checkout $TEMPEST_BRANCH
+
     tox -r --notest -efull
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but

From 3555b48ff45a109e6456923d597fa174084387ab Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 24 Jan 2020 06:49:03 +0100
Subject: [PATCH 2601/3333] Switch to python3 for memory_peak service

When starting 'memory_peak' service is using python command instead of
python3, while psutil (required package) is most probably being
installed into the python3 environment (as we are dropping python2.7
support).

Closes-Bug: #1860753
Change-Id: Ia2b7e2e33d784560443131e2965f520b361a54e3
---
 tools/memory_tracker.sh | 2 +-
 tools/mlock_report.py   | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)
 mode change 100755 => 100644 tools/mlock_report.py

diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index 63f25ca2de..6c36534f01 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -14,7 +14,7 @@
 
 set -o errexit
 
-PYTHON=${PYTHON:-python}
+PYTHON=${PYTHON:-python3}
 
 # time to sleep between checks
 SLEEP_TIME=20
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
old mode 100755
new mode 100644
index 07716b04d6..b15a0bf80b
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-
 # This tool lists processes that lock memory pages from swapping to disk.
 
 import re

From 7611d3dfd2e1f68bf11027756fd5b217d5ae9640 Mon Sep 17 00:00:00 2001
From: Carlos Camacho <ccamacho@redhat.com>
Date: Thu, 30 Jan 2020 14:39:51 +0100
Subject: [PATCH 2602/3333] Add -r option when removing egg-info files/folders

We are hitting this error:
+ tools/fixup_stuff.sh:fixup_ubuntu:82 :
    sudo rm -f /usr/lib/python3/dist-packages/httplib2-0.11.3.egg-info
rm: cannot remove
    '/usr/lib/python3/dist-packages/httplib2-0.11.3.egg-info': Is a directory

This patch adds the -r option to allow removing folders.

Change-Id: Ib7bb8b0a3dcf747bcc06da1a2fb17fa9d8808484
---
 tools/fixup_stuff.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index ae555d5861..15b3ab767d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -79,9 +79,9 @@ function fixup_ubuntu {
     # manifest of what to remove.  However, in most cases, simply
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
-    sudo rm -f /usr/lib/python3/dist-packages/httplib2-*.egg-info
-    sudo rm -f /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
-    sudo rm -f /usr/lib/python3/dist-packages/PyYAML-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/httplib2-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
 }
 
 # Python Packages

From 64b3c5f468110e00a30216186e590e87f81bc328 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 14 Feb 2020 11:07:30 -0600
Subject: [PATCH 2603/3333] Drop the tempest-full py2 job

We have dropped the tempest-full from
Tempest gate and made this to run on py2
explicitly which is nothing but for stable gates.
- I75868d5c9b6630fe78958ff89e58a0aced09a6b3

This job is not supposed to run on ussuri onwards master
gate as everything will be python3-only.

Change-Id: I372bde6a1753884efaf15da5fab48f1bddb4dab5
---
 .zuul.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 130b84a149..40978e6bc2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -577,7 +577,6 @@
 
 - project:
     templates:
-      - integrated-gate
       - integrated-gate-py3
       - publish-openstack-docs-pti
     check:

From d05efc6ae92cea0a86ea5b0a848a99b5f8d51870 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 17 Feb 2020 12:32:12 +0100
Subject: [PATCH 2604/3333] Remove networking-calico from plugin-registry.rst

Networking-calico has been removed from openstack repositories, remove
it from docs.

Change-Id: I58d2964ee52d66fe89aa84c1d88c4d8d4d349b0d
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 904400ece6..652bf0b1cc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,7 +75,6 @@ openstack/murano                         `https://opendev.org/openstack/murano <
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
-openstack/networking-calico              `https://opendev.org/openstack/networking-calico <https://opendev.org/openstack/networking-calico>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
 openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
 openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__

From 2dcbc28abab7eb51b9e3fd549fab49d42c48e90f Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Wed, 5 Feb 2020 11:29:51 +0100
Subject: [PATCH 2605/3333] Install versioned python RPMs on RedHat distros

Set default python3 version as 3 for cases python3
is not installed before running DevStack.

Implements installation of required python3x package
for RedHat family distros with package name depending on
configurable ${PYTHON3_VERSION}. Examples:

  3 => python3 python3-devel (default one)
  3.6 => python36 python36-devel
  3.7 => python37 python37-devel

This should help in situations where there are more
than one python available for given platform and
DevStack is asked to pick one by its full 3.x version

Change-Id: I49d86bc9193165e0a41e8e8720be37d81a4e7ee0
---
 inc/python | 6 +++++-
 stackrc    | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/inc/python b/inc/python
index 9d9f38b5a9..cf61389709 100644
--- a/inc/python
+++ b/inc/python
@@ -457,7 +457,11 @@ function install_python3 {
     elif is_suse; then
         install_package python3-devel python3-dbm
     elif is_fedora; then
-        install_package python3 python3-devel
+        if [ "$os_VENDOR" = "Fedora" ]; then
+            install_package python${PYTHON3_VERSION//.}
+        else
+            install_package python${PYTHON3_VERSION//.} python${PYTHON3_VERSION//.}-devel
+        fi
     fi
 }
 
diff --git a/stackrc b/stackrc
index e11a34c8cc..4e33b6838f 100644
--- a/stackrc
+++ b/stackrc
@@ -142,7 +142,7 @@ export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
-export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.6}}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3}}
 
 # Just to be more explicit on the Python 2 version to use.
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"

From 21a10d3499abd6e9cd1950b3615502bef5ad6b45 Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 31 Jan 2020 07:43:30 +0100
Subject: [PATCH 2606/3333] Use python3 as default python command

After Python 2 is getting unsupported, new distros
like CentOS 8 and RHEL8 have stopped providing 'python'
package forcing user to decide which alternative to
use by installing 'python2' or 'python3.x' package
and then setting python alternative.

This change is intended to make using python3 command as
much as possible and use it as default 'python' alternative
where needed.

The final goals motivating this change are:
 - stop using python2 as much as possible
 - help adding support for CentOS 8 and RHEL8

Change-Id: I1e90db987c0bfa6206c211e066be03ea8738ad3f
---
 inc/python                              | 25 +++++++++++++++++++++++++
 stack.sh                                | 19 ++++++++-----------
 tests/test_worlddump.sh                 |  2 +-
 tools/generate-devstack-plugins-list.py |  2 +-
 tools/install_prereqs.sh                |  6 ------
 tools/outfilter.py                      |  4 ++--
 tools/update_clouds_yaml.py             |  2 +-
 tools/worlddump.py                      | 25 ++++++++++++++++++-------
 8 files changed, 56 insertions(+), 29 deletions(-)
 mode change 100755 => 100644 tools/outfilter.py
 mode change 100755 => 100644 tools/worlddump.py

diff --git a/inc/python b/inc/python
index cf61389709..52ad56520a 100644
--- a/inc/python
+++ b/inc/python
@@ -450,6 +450,31 @@ function python3_enabled {
     fi
 }
 
+# Provide requested python version and sets PYTHON variable
+function install_python {
+    # NOTE: install_python function should finally just do what install_python3
+    # does as soon Python 2 support has been dropped
+    if python3_enabled; then
+        install_python3
+        export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null ||
+                        which python3 2>/dev/null)
+        if [[ "${DISTRO}" =~ (rhel8) ]]; then
+            # Use Python 3 as default python command so that we have only one
+            # python alternative to use on the system for either python and
+            # python3
+            sudo alternatives --set python "${PYTHON}"
+        else
+            # Install anyway Python 2 for legacy scripts that still requires
+            # python instead of python3 command
+            install_package python
+        fi
+    else
+        echo "WARNING - Python 2 support has been deprecated in favor of Python 3"
+        install_package python
+        export PYTHON=$(which python 2>/dev/null)
+    fi
+}
+
 # Install python3 packages
 function install_python3 {
     if is_ubuntu; then
diff --git a/stack.sh b/stack.sh
index 0f9d57bc9a..7119e5f648 100755
--- a/stack.sh
+++ b/stack.sh
@@ -415,11 +415,8 @@ fi
 
 # Ensure python is installed
 # --------------------------
-install_python3
+install_python
 
-if ! python3_enabled; then
-    is_package_installed python || install_package python
-fi
 
 # Configure Logging
 # -----------------
@@ -497,14 +494,14 @@ if [[ -n "$LOGFILE" ]]; then
             _of_args="$_of_args --no-timestamp"
         fi
         # Set fd 1 and 2 to write the log file
-        exec 1> >( $TOP_DIR/tools/outfilter.py $_of_args -o "${LOGFILE}" ) 2>&1
+        exec 1> >( $PYTHON $TOP_DIR/tools/outfilter.py $_of_args -o "${LOGFILE}" ) 2>&1
         # Set fd 6 to summary log file
-        exec 6> >( $TOP_DIR/tools/outfilter.py -o "${SUMFILE}" )
+        exec 6> >( $PYTHON $TOP_DIR/tools/outfilter.py -o "${SUMFILE}" )
     else
         # Set fd 1 and 2 to primary logfile
-        exec 1> >( $TOP_DIR/tools/outfilter.py -o "${LOGFILE}" ) 2>&1
+        exec 1> >( $PYTHON $TOP_DIR/tools/outfilter.py -o "${LOGFILE}" ) 2>&1
         # Set fd 6 to summary logfile and stdout
-        exec 6> >( $TOP_DIR/tools/outfilter.py -v -o "${SUMFILE}" >&3 )
+        exec 6> >( $PYTHON $TOP_DIR/tools/outfilter.py -v -o "${SUMFILE}" >&3 )
     fi
 
     echo_summary "stack.sh log $LOGFILE"
@@ -521,7 +518,7 @@ else
         exec 1>/dev/null 2>&1
     fi
     # Always send summary fd to original stdout
-    exec 6> >( $TOP_DIR/tools/outfilter.py -v >&3 )
+    exec 6> >( $PYTHON $TOP_DIR/tools/outfilter.py -v >&3 )
 fi
 
 # Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
@@ -557,9 +554,9 @@ function exit_trap {
             generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
         fi
         if [[ -z $LOGDIR ]]; then
-            $TOP_DIR/tools/worlddump.py
+            ${PYTHON} $TOP_DIR/tools/worlddump.py
         else
-            $TOP_DIR/tools/worlddump.py -d $LOGDIR
+            ${PYTHON} $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
     else
         # If we error before we've installed os-testr, this will fail.
diff --git a/tests/test_worlddump.sh b/tests/test_worlddump.sh
index f407d407c0..919652536d 100755
--- a/tests/test_worlddump.sh
+++ b/tests/test_worlddump.sh
@@ -8,7 +8,7 @@ source $TOP/tests/unittest.sh
 
 OUT_DIR=$(mktemp -d)
 
-$TOP/tools/worlddump.py -d $OUT_DIR
+${PYTHON} $TOP/tools/worlddump.py -d $OUT_DIR
 
 if [[ $? -ne 0 ]]; then
     fail "worlddump failed"
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 3ac9c4d9aa..1cacd06bf8 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -1,4 +1,4 @@
-#! /usr/bin/env python
+#! /usr/bin/env python3
 
 # Copyright 2016 Hewlett Packard Enterprise Development Company, L.P.
 #
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index da59093581..a7c03d26cd 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -81,12 +81,6 @@ if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     fi
 fi
 
-if python3_enabled; then
-    install_python3
-    export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null || which python3 2>/dev/null)
-else
-    export PYTHON=$(which python 2>/dev/null)
-fi
 
 # Mark end of run
 # ---------------
diff --git a/tools/outfilter.py b/tools/outfilter.py
old mode 100755
new mode 100644
index cf091247d0..e910f79ff2
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -1,5 +1,5 @@
-#!/usr/bin/env python
-#
+#!/usr/bin/env python3
+
 # Copyright 2014 Hewlett-Packard Development Company, L.P.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 9187c664d0..7be995e8f3 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 # Licensed under the Apache License, Version 2.0 (the "License"); you may
 # not use this file except in compliance with the License. You may obtain
diff --git a/tools/worlddump.py b/tools/worlddump.py
old mode 100755
new mode 100644
index d5ff5d1ab5..1e6e176210
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright 2014 Hewlett-Packard Development Company, L.P.
 #
@@ -23,8 +23,8 @@
 import datetime
 from distutils import spawn
 import fnmatch
+import io
 import os
-import os.path
 import shutil
 import subprocess
 import sys
@@ -109,9 +109,10 @@ def _bridge_list():
 # This method gets max version searching 'OpenFlow versions 0x1:0x'.
 # And return a version value converted to an integer type.
 def _get_ofp_version():
-    process = subprocess.Popen(['ovs-ofctl', '--version'], stdout=subprocess.PIPE)
+    process = subprocess.Popen(['ovs-ofctl', '--version'],
+                               stdout=subprocess.PIPE)
     stdout, _ = process.communicate()
-    find_str = 'OpenFlow versions 0x1:0x'
+    find_str = b'OpenFlow versions 0x1:0x'
     offset = stdout.find(find_str)
     return int(stdout[offset + len(find_str):-1]) - 1
 
@@ -206,7 +207,7 @@ def process_list():
 
 def compute_consoles():
     _header("Compute consoles")
-    for root, dirnames, filenames in os.walk('/opt/stack'):
+    for root, _, filenames in os.walk('/opt/stack'):
         for filename in fnmatch.filter(filenames, 'console.log'):
             fullpath = os.path.join(root, filename)
             _dump_cmd("sudo cat %s" % fullpath)
@@ -234,12 +235,22 @@ def var_core():
         # tools out there that can do that sort of thing though.
         _dump_cmd("ls -ltrah /var/core")
 
+
+def disable_stdio_buffering():
+    # re-open STDOUT as binary, then wrap it in a
+    # TextIOWrapper, and write through everything.
+    binary_stdout = io.open(sys.stdout.fileno(), 'wb', 0)
+    sys.stdout = io.TextIOWrapper(binary_stdout, write_through=True)
+
+
 def main():
     opts = get_options()
     fname = filename(opts.dir, opts.name)
     print("World dumping... see %s for details" % fname)
-    sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)
-    with open(fname, 'w') as f:
+
+    disable_stdio_buffering()
+
+    with io.open(fname, 'w') as f:
         os.dup2(f.fileno(), sys.stdout.fileno())
         disk_space()
         process_list()

From 64ae08383a137d8b7fd18a8d8bc5c0fc191a186d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 12 Feb 2020 10:04:50 +0000
Subject: [PATCH 2607/3333] Amend python pkgs for debian-based distros

Drop python2 packages that are no longer needed. Replace other py2 pkgs
with their py3 variant.

Change-Id: Id5fc11d1ae0a7daf439c7d72f831f298f5d0ce31
---
 files/debs/general        | 3 ---
 files/debs/keystone       | 2 +-
 files/debs/ldap           | 2 +-
 files/debs/n-cpu          | 2 +-
 files/debs/neutron-common | 2 +-
 files/debs/nova           | 2 +-
 6 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index df872a0a6c..9f9d57cefb 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,9 +27,6 @@ openssh-server
 openssl
 pkg-config
 psmisc
-python2.7
-python-dev
-python-gdbm # needed for testr
 tar
 tcpdump
 unzip
diff --git a/files/debs/keystone b/files/debs/keystone
index fd0317b9b6..1cfa6ffa38 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -2,5 +2,5 @@ libkrb5-dev
 libldap2-dev
 libsasl2-dev
 memcached
-python-mysqldb
+python3-mysqldb
 sqlite3
diff --git a/files/debs/ldap b/files/debs/ldap
index aa3a934d95..54896bb845 100644
--- a/files/debs/ldap
+++ b/files/debs/ldap
@@ -1,3 +1,3 @@
 ldap-utils
-python-ldap
+python3-ldap
 slapd
diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 636644f10d..54d6fa3fd1 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -5,7 +5,7 @@ gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
 netcat-openbsd
 open-iscsi
-python-guestfs # NOPRIME
+python3-guestfs # NOPRIME
 qemu-utils
 sg3-utils
 sysfsutils
diff --git a/files/debs/neutron-common b/files/debs/neutron-common
index b269f6330b..e548396cd7 100644
--- a/files/debs/neutron-common
+++ b/files/debs/neutron-common
@@ -9,7 +9,7 @@ iputils-ping
 libmysqlclient-dev
 mysql-server #NOPRIME
 postgresql-server-dev-all
-python-mysqldb
+python3-mysqldb
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
diff --git a/files/debs/nova b/files/debs/nova
index e5110e9c75..dce8f6ac89 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -16,7 +16,7 @@ libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
 pm-utils
-python-mysqldb
+python3-mysqldb
 qemu # dist:wheezy,jessie NOPRIME
 qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME

From 08d84bc47f7341e64d6dd33f6f6a515f92840ac4 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 12 Feb 2020 10:07:36 +0000
Subject: [PATCH 2608/3333] Make database code work with mysql8

The GRANT command in mysql8 can no longer create a user implicitly.
Split that part into a dedicated CREATE USER command.

Also drop disabling the query_cache, it is off by default for some time
and the option got removed in mysql8.

Change-Id: I31bcc285ff8e373abbacb303c1269857c9cfa9ed
---
 lib/databases/mysql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 420a86e04e..e5865f2a69 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -109,8 +109,10 @@ function configure_database_mysql {
         sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
         sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
     fi
+    # Create DB user if it does not already exist
+    sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
     # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
-    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
@@ -120,8 +122,6 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024
-    iniset -sudo $my_conf mysqld query_cache_type OFF
-    iniset -sudo $my_conf mysqld query_cache_size 0
 
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"

From 79ffa1f04f00eaaa12fada6715738468a04ba8a8 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 5 Feb 2020 15:54:00 +0000
Subject: [PATCH 2609/3333] Fedora: Always install python3-devel

With the recent switch to py3 we need to ensure python3-devel is
installed on Fedora >= 29 before pip installing any dependencies.

Change-Id: I21417687db5b3827c5272ed22f6dc95db13f2870
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index 5bf1e9ac90..15d329dfd4 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,6 +27,7 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
+python3-devel # f29,f30
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python

From f1966d77630e62cb415a1c3bcb221897d3e7a1c6 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 6 Feb 2020 16:20:37 +0000
Subject: [PATCH 2610/3333] Add Fedora 30 as a supported distro

With Fedora 29 now officially EOL [1] we need to start the move to 30. A
later change will remove f29 support from devstack entirely once
fedora-latest moves to the based f30 image.

[1] https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org/thread/VUK3CJ5LO4ROUH3JTCDVHYAVVYAOCU62/

Change-Id: If87fe93757129f931a3417fc6275ffad280cdf46
---
 files/rpms/cinder  | 4 ++--
 files/rpms/dstat   | 4 ++--
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 stack.sh           | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index e6b33dcc5e..ef810cf93d 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27,f28,f29 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index d7b272a93b..ad5196617f 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,2 @@
-dstat # not:f29
-pcp-system-tools # dist:f29
+dstat # not:f29,f30
+pcp-system-tools # dist:f29,f30
diff --git a/files/rpms/general b/files/rpms/general
index 15d329dfd4..279546fa60 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27,f28,f29
+iptables-services  # NOPRIME f25,f26,f27,f28,f29,f30
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29,f30
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 639d793756..6c3e47870c 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27,f28,f29
+kernel-modules # dist:f25,f26,f27,f28,f29,f30
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index be524d1367..8aed8a4033 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27,f28,f29
+rsync-daemon # dist:f25,f26,f27,f28,f29,f30
 sqlite
 xfsprogs
 xinetd
diff --git a/stack.sh b/stack.sh
index 7119e5f648..ce4fc7560a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From c6f53dacd275d97cc32a5dd4258e2a86fc05d168 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 7 Feb 2020 10:37:08 +0000
Subject: [PATCH 2611/3333] nova: Use iscsi-initiator-utils 2.1.0 on Fedora 30
 and 31

I2f16658c5a3e22cac70912a0f3ad65cdd7071a1e worked around an open-iscsi
bug that remains unpatched in Fedora 30 and 31 by using a private copr
repo with the patch applied. Rawhide has finally been rebased to 2.1.0
where this issue and many others have been resolved.

We can now use a new repo that has been built for Fedora 30 and 31 that
provides this rebased package that we can either use until the rebase is
backported to 31 and 30 or 32 is supported.

Change-Id: I5ba5885bd9c784949602aeb4ddff9d75fecc6b3d
---
 lib/nova | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 0893ed7084..3f108a4a97 100644
--- a/lib/nova
+++ b/lib/nova
@@ -297,7 +297,7 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f[0-9][0-9] ]]; then
+        if is_fedora && [[ $DISTRO =~ f29 ]]; then
             # There is an iscsi-initiator bug where it inserts
             # different whitespace that causes a bunch of output
             # matching to fail.  We have not been able to get
@@ -305,6 +305,12 @@ function configure_nova {
             #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
             sudo dnf copr enable -y iwienand/iscsi-initiator-utils
             sudo dnf update -y
+        elif is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
+            # For f30 and f31 use the rebased 2.1.0 version of the package. We
+            # can't use this above as f29 is EOL and as a result we can't
+            # rebuild packages in copr for it.
+            sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
+            sudo dnf update -y
         fi
 
         if [[ ${ISCSID_DEBUG} == "True" ]]; then

From 1d1f53ddc1f70fbf0a3605031c1ffbbcb6f18002 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 6 Feb 2020 14:37:26 +0000
Subject: [PATCH 2612/3333] Use fedora-30 as the fedora-latest image

With the open-iscsi rebase we should now be able to move the
fedora-latest job to fedora 30 ahead of the removal of support for 29.

Change-Id: Ia80f03f275e595d3b26b52b3478f303036d59438
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 40978e6bc2..7a7d56fd4c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -52,7 +52,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-29
+        label: fedora-30
     groups:
       - name: tempest
         nodes:

From 347abd41ce860e1f33dd3870ddc54431c6427d10 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 7 Feb 2020 14:34:29 +0000
Subject: [PATCH 2613/3333] Drop Fedora 29 support

With fedora-latest now using Fedora 30 images and Fedora 29 itself EOL
we can now remove support for it from devstack. This change also cleans
up references to earlier Fedora releases under files/rpms/.

Change-Id: I24332f7016ebb549ea678acf677c477b55ec4d4b
---
 files/rpms/cinder  |  4 ++--
 files/rpms/dstat   |  4 ++--
 files/rpms/general |  6 +++---
 files/rpms/nova    |  2 +-
 files/rpms/swift   |  2 +-
 lib/nova           | 14 ++------------
 stack.sh           |  2 +-
 7 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index ef810cf93d..e1e1f6c5c0 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
+scsi-target-utils # not:rhel7,f30 NOPRIME
+targetcli # dist:rhel7,f30 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index ad5196617f..e63af317fd 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,2 @@
-dstat # not:f29,f30
-pcp-system-tools # dist:f29,f30
+dstat # not:f30
+pcp-system-tools # dist:f30
diff --git a/files/rpms/general b/files/rpms/general
index 279546fa60..e3d20b3360 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27,f28,f29,f30
+iptables-services  # NOPRIME f30
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29,f30
+java-1.8.0-openjdk-headless  # NOPRIME f30
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -27,7 +27,7 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
-python3-devel # f29,f30
+python3-devel # f30
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
diff --git a/files/rpms/nova b/files/rpms/nova
index 6c3e47870c..c590378677 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27,f28,f29,f30
+kernel-modules # dist:f30
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index 8aed8a4033..eb94d14339 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27,f28,f29,f30
+rsync-daemon # dist:f30
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/nova b/lib/nova
index 3f108a4a97..a842a61fd0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -297,18 +297,8 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f29 ]]; then
-            # There is an iscsi-initiator bug where it inserts
-            # different whitespace that causes a bunch of output
-            # matching to fail.  We have not been able to get
-            # fixed, yet :/  Exists in fedora 29 & 30 at least
-            #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
-            sudo dnf copr enable -y iwienand/iscsi-initiator-utils
-            sudo dnf update -y
-        elif is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
-            # For f30 and f31 use the rebased 2.1.0 version of the package. We
-            # can't use this above as f29 is EOL and as a result we can't
-            # rebuild packages in copr for it.
+        if is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
+            # For f30 and f31 use the rebased 2.1.0 version of the package.
             sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
             sudo dnf update -y
         fi
diff --git a/stack.sh b/stack.sh
index ce4fc7560a..9879bd43d4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 8d4ae4ffc4a351a72a24bdf5fe6f7ac17445985a Mon Sep 17 00:00:00 2001
From: LuyaoZhong <luyao.zhong@intel.com>
Date: Wed, 19 Feb 2020 08:16:03 +0000
Subject: [PATCH 2614/3333] bug-fix: 'bytes' type in python3 cause command fail

'str' type in python2 is 'bytes' type in python3,
when use python3, we will get a prefix 'b':

sudo ip netns exec b'qrouter-39cc2b45-a27c-49c5-94a6-26443a49ac63' ip
neigh
--------------------------------------------------------------------------
*** Failed to run 'sudo ip netns exec
b'qrouter-39cc2b45-a27c-49c5-94a6-26443a49ac63' ip neigh': Command 'sudo
ip netns exec b'qrouter-39cc2b45-a27c-49c5-94a6-26443a49ac63' ip neigh'
returned non-zero exit status 1.

The message above is raised by running tools/worlddump.py with python3.

Change-Id: Ic254af86fa27729839f00c0ad4a5bbbc9e545a09
---
 tools/worlddump.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 tools/worlddump.py

diff --git a/tools/worlddump.py b/tools/worlddump.py
old mode 100644
new mode 100755
index 1e6e176210..b21ed0c861
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -174,7 +174,7 @@ def network_dump():
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():
         for cmd in ip_cmds:
-            args = {'netns': netns_, 'cmd': cmd}
+            args = {'netns': bytes.decode(netns_), 'cmd': cmd}
             _dump_cmd('sudo ip netns exec %(netns)s ip %(cmd)s' % args)
 
 
@@ -195,7 +195,7 @@ def ovs_dump():
     _dump_cmd("sudo ovs-vsctl show")
     for ofctl_cmd in ofctl_cmds:
         for bridge in bridges:
-            args = {'vers': vers, 'cmd': ofctl_cmd, 'bridge': bridge}
+            args = {'vers': vers, 'cmd': ofctl_cmd, 'bridge': bytes.decode(bridge)}
             _dump_cmd("sudo ovs-ofctl --protocols=%(vers)s %(cmd)s %(bridge)s" % args)
 
 

From b4375af841c635209e4cd751d63123005745797a Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 6 Jan 2020 13:57:20 +0000
Subject: [PATCH 2615/3333] zuul: Add a
 devstack-platform-fedora-latest-virt-preview job

Building on I5c3e1b7b632fd73310c462530990cdb0e0c0ceea we can now add a
Fedora job using the virt-preview repo that will be used by Nova's
experimental queue.

Change-Id: Iad9d64912bb07f307e4897ece1621f275f1d5211
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7a7d56fd4c..65b9b0c75b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -512,6 +512,16 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
+- job:
+    name: devstack-platform-fedora-latest-virt-preview
+    parent: tempest-full-py3
+    description: Fedora latest platform test using the virt-preview repo.
+    nodeset: devstack-single-node-fedora-latest
+    voting: false
+    vars:
+      devstack_localrc:
+        ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
+
 - job:
     name: devstack-tox-base
     parent: devstack

From 96ddc69a2ef5caea7621d3b94d4fa2b0ef10977b Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 28 Jan 2020 14:04:02 +0000
Subject: [PATCH 2616/3333] zuul: Add the fedora-latest-virt-preview job to the
 experimental queue

Allowing the job to be tested outside of openstack/nova's own
experimental queue.

Change-Id: Ib07d9522d1cb6e288edb7f78ee1960ab48d89d76
---
 .zuul.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 65b9b0c75b..62cda04ac0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -683,6 +683,10 @@
     #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and currently non-voting in the
     #    check queue for nova changes but relies on devstack configuration
+    # * devstack-platform-fedora-latest-virt-preview: Maintained by lyarwood
+    #    for Nova to allow early testing of the latest versions of Libvirt and
+    #    QEMU. Should only graduate out of experimental if it ever moves into
+    #    the check queue for Nova.
 
     experimental:
       jobs:
@@ -719,3 +723,4 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - devstack-platform-fedora-latest-virt-preview

From 1e6b06ede00eca1087520abae8266142573733e3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 21 Feb 2020 06:12:07 +0000
Subject: [PATCH 2617/3333] Updated from generate-devstack-plugins-list

Change-Id: I543faced83a685d48706d004ae49800abfb89dc5
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 652bf0b1cc..1dc91ea33d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -102,7 +102,6 @@ openstack/panko                          `https://opendev.org/openstack/panko <h
 openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
 openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__
 openstack/qinling-dashboard              `https://opendev.org/openstack/qinling-dashboard <https://opendev.org/openstack/qinling-dashboard>`__
-openstack/rally                          `https://opendev.org/openstack/rally <https://opendev.org/openstack/rally>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__

From 6f91da9a2d0639daad3a6e1bce328c4c730511f9 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Thu, 17 Oct 2019 09:02:41 +0000
Subject: [PATCH 2618/3333] Glance: Add support to configure multiple file
 stores

From Train release Glance has added support [0][1] to configure multiple stores
of same or different types. This patch enables developers to configure
multiple file stores for glance. In order to configure multiple file stores
user need to set below options in local.conf

GLANCE_ENABLE_MULTIPLE_STORES=True/False
To enable multiple stores of glance.

GLANCE_MULTIPLE_FILE_STORES=veryfast,fast,cheap,verycheap,slow,veryslow
Comma separated list of store identifiers.

GLANCE_DEFAULT_BACKEND=fast
Default glance store in which image should be stored if store identifier not
specified explicilty. Should be one of the store identifier from
GLANCE_MULTIPLE_FILE_STORES config option.

NOTE: This support is added so that we can start adding tempest/CI tests for
glance multiple stores.

[0] 515412b59f5b3af07a1787b9f8e85a4d656d3e1c
[1] https://docs.openstack.org/glance/train/admin/multistores.html

Change-Id: I494f77555cfe9115356ce0ee75c7d7f192141447
---
 lib/glance | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 58 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 740bcabf6a..e8f846fbb9 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,9 +41,29 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+# Glance multi-store configuration
+# Boolean flag to enable multiple store configuration for glance
+GLANCE_ENABLE_MULTIPLE_STORES=$(trueorfalse False GLANCE_ENABLE_MULTIPLE_STORES)
+
+# Comma separated list for configuring multiple file stores of glance,
+# for example; GLANCE_MULTIPLE_FILE_STORES = fast,cheap,slow
+GLANCE_MULTIPLE_FILE_STORES=${GLANCE_MULTIPLE_FILE_STORES:-fast}
+
+# Default store/backend for glance, must be one of the store specified
+# in GLANCE_MULTIPLE_FILE_STORES option.
+GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
+
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
+
+# File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
+# identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
+# has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
+# and $DATA_DIR/glance/cheap.
+GLANCE_MULTISTORE_FILE_IMAGE_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/glance}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
+GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_staging_store}
+GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -97,6 +117,18 @@ function is_glance_enabled {
 function cleanup_glance {
     # delete image files (glance)
     sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
+
+    # Cleanup multiple stores directories
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        local store file_dir
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            file_dir="${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
+            sudo rm -rf $file_dir
+        done
+
+        # Cleanup reserved stores directories
+        sudo rm -rf $GLANCE_STAGING_DIR $GLANCE_TASKS_DIR
+    fi
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -117,6 +149,16 @@ function configure_glance {
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
+    # Configure multiple stores
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        local store enabled_backends
+        enabled_backends=""
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            enabled_backends+="${store}:file,"
+        done
+        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+    fi
+
     # Set non-default configuration options for the API server
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
@@ -141,8 +183,21 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT enable_v1_api False
     fi
 
-    # Store specific configs
-    iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    # Glance multiple store Store specific configs
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
+        local store
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            iniset $GLANCE_API_CONF $store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
+        done
+
+        # Glance configure reserved stores
+        iniset $GLANCE_API_CONF os_glance_staging_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_staging_store/"
+        iniset $GLANCE_API_CONF os_glance_tasks_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_tasks_store/"
+    else
+        # Store specific configs
+        iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    fi
     iniset $GLANCE_API_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # CORS feature support - to allow calls from Horizon by default
@@ -152,6 +207,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
     fi
 
+    # No multiple stores for swift yet
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift

From 2b6c2b41a03d1bb5de5df0ad7b84a2bbbbd76430 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 28 Feb 2020 06:11:43 +0000
Subject: [PATCH 2619/3333] Updated from generate-devstack-plugins-list

Change-Id: I03cd12d5b2de5c2ff4ee92d66a631da34d4255c5
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1dc91ea33d..6f79102aef 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -139,7 +139,6 @@ x/bilean                                 `https://opendev.org/x/bilean <https://
 x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
 x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__
 x/devstack-plugin-additional-pkg-repos   `https://opendev.org/x/devstack-plugin-additional-pkg-repos <https://opendev.org/x/devstack-plugin-additional-pkg-repos>`__
-x/devstack-plugin-bdd                    `https://opendev.org/x/devstack-plugin-bdd <https://opendev.org/x/devstack-plugin-bdd>`__
 x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-glusterfs <https://opendev.org/x/devstack-plugin-glusterfs>`__
 x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__

From 5837ce504bf546b9e4489c0046cb5b25c656e01c Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 28 Feb 2020 10:47:42 +0000
Subject: [PATCH 2620/3333] zuul: Remove devstack-plugin-ceph-tempest job

This job is now failing 100% of the time on master since the EOL of py2:

https://zuul.opendev.org/t/openstack/builds?job_name=devstack-plugin-ceph-tempest&branch=master

Change-Id: I0bb03190f39b5ae5494b2d10a0e819013d60bddf
---
 .zuul.yaml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 62cda04ac0..26b57a20d0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -695,10 +695,6 @@
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
         - neutron-tempest-with-uwsgi
-        - devstack-plugin-ceph-tempest:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$

From 4361ef1eb871c85ef6f05fdd8cd26c25e76c4c8e Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 11 Dec 2019 17:53:44 +0000
Subject: [PATCH 2621/3333] tempest: Enable stable_rescue tests with Libvirt

Enable the compute feature for stable device rescue on all but LXC and
Xen virt_types.

Depends-On: https://review.opendev.org/#/c/700812/
Depends-On: https://review.opendev.org/#/c/700813/
Change-Id: Icfc717b4932be050a169fc00dae720d29a6497f7
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 525abcb582..6e87e54801 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -570,6 +570,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
         else
+            iniset $TEMPEST_CONFIG compute-feature-enabled stable_rescue True
             iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi
     fi

From d0886f1ee9cd342d9d3dac0e3c9ee407dee3e697 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 5 Mar 2020 06:13:02 +0000
Subject: [PATCH 2622/3333] Updated from generate-devstack-plugins-list

Change-Id: I92025c92bae7a673aae16192cfe892f3bdee269f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6f79102aef..0d0a4208dd 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -50,6 +50,7 @@ openstack/heat                           `https://opendev.org/openstack/heat <ht
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
 openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
+openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
 openstack/karbor                         `https://opendev.org/openstack/karbor <https://opendev.org/openstack/karbor>`__
 openstack/karbor-dashboard               `https://opendev.org/openstack/karbor-dashboard <https://opendev.org/openstack/karbor-dashboard>`__

From e87428908ad2217e6bf4ac483c234891f535f4ec Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 11 Dec 2019 15:17:58 +0000
Subject: [PATCH 2623/3333] Add "OVN" debs and rpms package files

The networking-ovn code is being moved into the neutron repository as
part of the effort [0].

This change is needed so we are able to install OVN from packages
when running the networking-ovn functional tests along with
the Neutron ones (see [1]). In the old networking-ovn repository we did
compile OVN from source instead of installing it from packages but
that took time. We want to do better in the Neutron repository.

[0] https://blueprints.launchpad.net/neutron/+spec/neutron-ovn-merge
[1] https://review.opendev.org/#/c/697440/

Change-Id: I92ab727d9954eb729c41b9a67ecb60b56883097b
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 files/debs/ovn | 3 +++
 files/rpms/ovn | 3 +++
 2 files changed, 6 insertions(+)
 create mode 100644 files/debs/ovn
 create mode 100644 files/rpms/ovn

diff --git a/files/debs/ovn b/files/debs/ovn
new file mode 100644
index 0000000000..81eea5e633
--- /dev/null
+++ b/files/debs/ovn
@@ -0,0 +1,3 @@
+ovn-central
+ovn-controller-vtep
+ovn-host
diff --git a/files/rpms/ovn b/files/rpms/ovn
new file mode 100644
index 0000000000..698e57b0de
--- /dev/null
+++ b/files/rpms/ovn
@@ -0,0 +1,3 @@
+ovn-central
+ovn-host
+ovn-vtep

From d22a8bcb1fdcc8d6ddbd59c8ae0223a3eb33c2ed Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Sun, 15 Mar 2020 18:22:45 -0500
Subject: [PATCH 2624/3333] Use py3 version of Tempest Multinode job

tempest-multinode-full is py2 job and not needed to
run on ussuri onwards. Chaning this to its py3
version tempest-multinode-full-py3

Change-Id: Iff271eabcf1a39d6bf6c1fcd55ff2749cab2373f
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 26b57a20d0..0efca8c6c8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -617,7 +617,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - tempest-multinode-full:
+        - tempest-multinode-full-py3:
             voting: false
             irrelevant-files:
               - ^.*\.rst$

From 5ae8a3504ce0619eda5fceaa638b01ba123e5e14 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Tue, 17 Mar 2020 20:54:07 -0400
Subject: [PATCH 2625/3333] Drop DEVSTACK_GATE_FEATURE_MATRIX

DEVSTACK_GATE_FEATURE_MATRIX seems to be an old legacy thing that
is no longer being used.  It currently prevents using the jobs in
openstack/devstack without adding openstack/devstack-gate for the
role.

Change-Id: Iab9b4862c01043d2c158398bac4b3b289a0adba0
---
 doc/source/zuul_ci_jobs_migration.rst | 6 ------
 playbooks/pre.yaml                    | 1 -
 2 files changed, 7 deletions(-)

diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 17e7e16fb7..c43603ea17 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -195,12 +195,6 @@ value defined in the parent job, or the default from DevStack, if any.
      - A bridge called br-infra is set up for all jobs that inherit
        from multinode with a dedicated `bridge role
        <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
-   * - DEVSTACK_GATE_FEATURE_MATRIX
-     - devstack-gate
-     - ``test_matrix_features`` variable of the test-matrix role in
-       devstack-gate. This is a temporary solution, feature matrix
-       will go away. In the future services will be defined in jobs
-       only.
    * - DEVSTACK_CINDER_VOLUME_CLEAR
      - devstack
      - *CINDER_VOLUME_CLEAR: true/false* in devstack_localrc in the
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 60f365aa7a..ff97a1f501 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -26,7 +26,6 @@
       set_fact:
         external_bridge_mtu: "{{ local_mtu | int - 50 }}"
   roles:
-    - test-matrix
     - configure-swap
     - setup-stack-user
     - setup-tempest-user

From 90f0baf3cb84118e51bc5990ba6885f07b679090 Mon Sep 17 00:00:00 2001
From: ushen <yshxxsjt715@gmail.com>
Date: Wed, 18 Mar 2020 20:08:16 +0800
Subject: [PATCH 2626/3333] Bring back load balance v2 guide

Previous commit forgets to add an entry for load
balancer version 2. This ps brings them back.

Change-Id: Idac09e8259d58ed130b79b40528f733708000da7
---
 doc/source/guides.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index ca134c4520..e7ec629962 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -69,6 +69,11 @@ Nova and devstack
 
 Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
 
+Configure Load-Balancer Version 2
+-----------------------------------
+
+Guide on :doc:`Configure Load-Balancer Version 2 <guides/devstack-with-lbaas-v2>`.
+
 Deploying DevStack with LDAP
 ----------------------------
 

From 7db34f6caeec6293a87661202484fcff6dc04325 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 18 Mar 2020 15:35:27 -0400
Subject: [PATCH 2627/3333] Use MEMCACHE_SERVERS in
 configure_keystone_authtoken_middleware

The function was using a hard coded value of localhost:11211 when
we have an option MEMCACHE_SERVERS that can be defined and used
inside DevStack.

Change-Id: I4947928fe406a9844d5bdaa3c826d273952fa097
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 9ceb829264..366e6c7054 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -421,7 +421,7 @@ function configure_keystone_authtoken_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    iniset $conf_file $section memcached_servers localhost:11211
+    iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
 }
 
 # configure_auth_token_middleware conf_file admin_user IGNORED [section]

From 4af912d88953f406f4c3275de8c6ad370aade8ab Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 20 Mar 2020 08:33:13 +0000
Subject: [PATCH 2628/3333] Updated from generate-devstack-plugins-list

Change-Id: I86601bc3bf114583ccad7a301af4e5b71e3ba2bf
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0d0a4208dd..0c29bb2a91 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -38,6 +38,7 @@ openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
+openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
 openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
 openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
 openstack/dragonflow                     `https://opendev.org/openstack/dragonflow <https://opendev.org/openstack/dragonflow>`__
@@ -99,6 +100,7 @@ openstack/openstacksdk                   `https://opendev.org/openstack/openstac
 openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
 openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
+openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/panko                          `https://opendev.org/openstack/panko <https://opendev.org/openstack/panko>`__
 openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
 openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__

From 37659927923473c13f4bec88855205d0ee28bcfb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 21 Mar 2020 06:15:49 +0000
Subject: [PATCH 2629/3333] Updated from generate-devstack-plugins-list

Change-Id: Ide7724ed3b4b5bb709b7dd79a367a5d2420bcda2
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0c29bb2a91..e92929a809 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -38,6 +38,7 @@ openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
+openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
 openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
 openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
@@ -146,7 +147,6 @@ x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-
 x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
 x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
-x/devstack-plugin-nfs                    `https://opendev.org/x/devstack-plugin-nfs <https://opendev.org/x/devstack-plugin-nfs>`__
 x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
 x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
 x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__

From c26dfb0d6f165a567925390ac9c6f6ac32742fee Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 25 Mar 2020 08:32:26 -0500
Subject: [PATCH 2630/3333] Run pip check at end of devstack

The new pip depsolver is coming this summer. Until it's ready,
run pip check at the end of devstack to make sure we're not
somehow installing conflicting package versions. We shouldn't
be, because of constraints, but if we are, better to know and
start figuring it out.

Change-Id: Id98f0848ff5a252d93e5f8029df2d069924d603f
---
 inc/python | 24 ++++++++++++++++++++++++
 stack.sh   |  3 +++
 2 files changed, 27 insertions(+)

diff --git a/inc/python b/inc/python
index 52ad56520a..20f3c6040c 100644
--- a/inc/python
+++ b/inc/python
@@ -111,6 +111,30 @@ function disable_python3_package {
     $xtrace
 }
 
+
+function pip_check {
+    time_start "pip_check"
+
+    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
+    else
+        local cmd_pip
+        if python3_enabled; then
+            echo "Using python $PYTHON3_VERSION to check pip install because python3_enabled=True"
+            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+        else
+            echo "Using python $PYTHON2_VERSION to check pip install because python3_enabled=False"
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        fi
+    fi
+
+    $cmd_pip check
+    result=$?
+
+    time_stop "pip_check"
+    return $result
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``*_proxy``,
diff --git a/stack.sh b/stack.sh
index 9879bd43d4..352112a4af 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1421,6 +1421,9 @@ fi
 # Check the status of running services
 service_check
 
+# Run pip check to make sure we're forward compatible with the pip depsolver.
+pip_check
+
 # Configure nova cellsv2
 # ----------------------
 

From c2830fb26759678b1bfe90a77aa5c149599d6705 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 27 Mar 2020 11:08:27 -0500
Subject: [PATCH 2631/3333] Revert "Run pip check at end of devstack"

This reverts commit 79b8e79488a6268f37244188ab831e99a99648c8.

This is breaking things in various jobs, most notably because
we do not put constraints on linters - but we install
test-requirements which then can conflict with each other.

Change-Id: Ibc5603c61b38ce44db58fb27a27352f59123ad09
---
 inc/python | 24 ------------------------
 stack.sh   |  3 ---
 2 files changed, 27 deletions(-)

diff --git a/inc/python b/inc/python
index 20f3c6040c..52ad56520a 100644
--- a/inc/python
+++ b/inc/python
@@ -111,30 +111,6 @@ function disable_python3_package {
     $xtrace
 }
 
-
-function pip_check {
-    time_start "pip_check"
-
-    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
-        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
-    else
-        local cmd_pip
-        if python3_enabled; then
-            echo "Using python $PYTHON3_VERSION to check pip install because python3_enabled=True"
-            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-        else
-            echo "Using python $PYTHON2_VERSION to check pip install because python3_enabled=False"
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-        fi
-    fi
-
-    $cmd_pip check
-    result=$?
-
-    time_stop "pip_check"
-    return $result
-}
-
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``*_proxy``,
diff --git a/stack.sh b/stack.sh
index 352112a4af..9879bd43d4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1421,9 +1421,6 @@ fi
 # Check the status of running services
 service_check
 
-# Run pip check to make sure we're forward compatible with the pip depsolver.
-pip_check
-
 # Configure nova cellsv2
 # ----------------------
 

From 09b5b05c471985ad53c4b321e993101f007ee915 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 27 Mar 2020 11:22:39 -0500
Subject: [PATCH 2632/3333] Stop installing test-requirements with projects

This is a test of installing openstack and then seeing if it works.
OpenStack components do not need test-requirements to operate,
that's why they are test-requirements.

Additionally, as we look forward to depsolver pip, this is going
to screw us because we don't apply constraints to linters, which
are expressed in - you guessed it, test-requirements.

Change-Id: I8f24b839bf42e2fb9803dc7df3a30ae20cf264eb
---
 inc/python | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/inc/python b/inc/python
index 52ad56520a..30b9a30eca 100644
--- a/inc/python
+++ b/inc/python
@@ -179,13 +179,6 @@ function pip_install {
 
     $xtrace
 
-    # Also install test requirements
-    local install_test_reqs=""
-    local test_req="${package_dir}/test-requirements.txt"
-    if [[ -e "$test_req" ]]; then
-        install_test_reqs="-r $test_req"
-    fi
-
     # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
     # the same behaviour of setuptools before version 25.0.0.
     # related issue: https://github.com/pypa/pip/issues/3874
@@ -195,7 +188,7 @@ function pip_install {
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
-        $cmd_pip $upgrade $install_test_reqs \
+        $cmd_pip $upgrade \
         $@
     result=$?
 

From aa71ebf92c7bb7144ae64551ad649054f4797a0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 30 Mar 2020 12:06:30 +0200
Subject: [PATCH 2633/3333] Test also swift-dsvm-functional-py3

Swift keeps testing py2 but we should keep both in shape.

To fix stestr on py2:
Depends-on: https://review.opendev.org/715942

Change-Id: I616e39c64e22d467d7186dba98226cc5beef23ea
---
 .zuul.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0efca8c6c8..cc97b89980 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -602,9 +602,12 @@
             voting: false
         - swift-dsvm-functional:
             voting: false
-            irrelevant-files:
+            irrelevant-files: &dsvm-irrelevant-files
               - ^.*\.rst$
               - ^doc/.*$
+        - swift-dsvm-functional-py3:
+            voting: false
+            irrelevant-files: *dsvm-irrelevant-files
         - grenade-py3:
             irrelevant-files:
               - ^.*\.rst$

From be26306b4ab470e65cc93305453d2945aa33bf78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 30 Mar 2020 09:56:53 +0200
Subject: [PATCH 2634/3333] Support extras in Glance Store install

Recent change to devstack dropped installing test-requirements [1]
However, this caused gate failures due to lack of glance-store
deps for cinder and swift support.

This patch makes devstack install relevant extras depending on
enabled features.

Additionally, relevant functions are added/fixed to make this
possible.

glance-store = glance_store (for gerrit search match)

[1] https://review.opendev.org/715469

Change-Id: I0bf5792a6058b52936115b515ea8360f6264a7c9
---
 inc/python | 32 +++++++++++++++++++++++++++-----
 lib/glance | 15 ++++++++++++++-
 2 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/inc/python b/inc/python
index 30b9a30eca..dd77296049 100644
--- a/inc/python
+++ b/inc/python
@@ -21,6 +21,14 @@ set +o xtrace
 # project.  A null value installs to the system Python directories.
 declare -A -g PROJECT_VENV
 
+# Utility Functions
+# =================
+
+# Joins bash array of extras with commas as expected by other functions
+function join_extras {
+    local IFS=","
+    echo "$*"
+}
 
 # Python Functions
 # ================
@@ -80,9 +88,9 @@ function pip_install_gr {
 function pip_install_gr_extras {
     local name=$1
     local extras=$2
-    local clean_name
-    clean_name=$(get_from_global_requirements $name)
-    pip_install $clean_name[$extras]
+    local version_constraints
+    version_constraints=$(get_version_constraints_from_global_requirements $name)
+    pip_install $name[$extras]$version_constraints
 }
 
 # enable_python3_package() -- no-op for backwards compatibility
@@ -230,6 +238,19 @@ function get_from_global_requirements {
     echo $required_pkg
 }
 
+# get only version constraints of a package from global requirements file
+# get_version_constraints_from_global_requirements <package>
+function get_version_constraints_from_global_requirements {
+    local package=$1
+    local required_pkg_version_constraint
+    # drop the package name from output (\K)
+    required_pkg_version_constraint=$(grep -i -h -o -P "^${package}\K.*" $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
+    if [[ $required_pkg_version_constraint == ""  ]]; then
+        die $LINENO "Can't find package $package in requirements"
+    fi
+    echo $required_pkg_version_constraint
+}
+
 # should we use this library from their git repo, or should we let it
 # get pulled in via pip dependencies.
 function use_library_from_git {
@@ -278,7 +299,7 @@ function setup_lib {
 #
 # use this for non namespaced libraries
 #
-# setup_dev_lib [-bindep] <name>
+# setup_dev_lib [-bindep] <name> [<extras>]
 function setup_dev_lib {
     local bindep
     if [[ $1 == -bindep* ]]; then
@@ -287,7 +308,8 @@ function setup_dev_lib {
     fi
     local name=$1
     local dir=${GITDIR[$name]}
-    setup_develop $bindep $dir
+    local extras=$2
+    setup_develop $bindep $dir $extras
 }
 
 # this should be used if you want to install globally, all libraries should
diff --git a/lib/glance b/lib/glance
index e8f846fbb9..9398bd2daf 100644
--- a/lib/glance
+++ b/lib/glance
@@ -355,11 +355,24 @@ function install_glanceclient {
 
 # install_glance() - Collect source and prepare
 function install_glance {
+    local glance_store_extras=()
+
+    if is_service_enabled cinder; then
+        glance_store_extras=("cinder" "${glance_store_extras[@]}")
+    fi
+
+    if is_service_enabled swift; then
+        glance_store_extras=("swift" "${glance_store_extras[@]}")
+    fi
+
     # Install glance_store from git so we make sure we're testing
     # the latest code.
     if use_library_from_git "glance_store"; then
         git_clone_by_name "glance_store"
-        setup_dev_lib "glance_store"
+        setup_dev_lib "glance_store" $(join_extras "${glance_store_extras[@]}")
+    else
+        # we still need to pass extras
+        pip_install_gr_extras glance-store $(join_extras "${glance_store_extras[@]}")
     fi
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH

From 1587ba1bd59fe0115c273ee2382bf627fce937a3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Mar 2020 15:13:37 +1100
Subject: [PATCH 2635/3333] Remove fixup_virtualenv

This first came in with Id749c37ab7fefa96b35f11816b56b9def5ef4b08.  It
talks about ancient versions of pip; can't see we need it any more.

Change-Id: I9d4831955070990a81a809d988612d9d5b1aa672
---
 tools/fixup_stuff.sh | 30 ------------------------------
 1 file changed, 30 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 15b3ab767d..6c7123374b 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -202,39 +202,9 @@ function fixup_suse {
     sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
 }
 
-# The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
-# connection issues under proxy so re-install the latest version using
-# pip. To avoid having pip's virtualenv overwritten by the distro's
-# package (e.g. due to installing a distro package with a dependency
-# on python-virtualenv), first install the distro python-virtualenv
-# to satisfy any dependencies then use pip to overwrite it.
-
-# ... but, for infra builds, the pip-and-virtualenv [1] element has
-# already done this to ensure the latest pip, virtualenv and
-# setuptools on the base image for all platforms.  It has also added
-# the packages to the yum/dnf ignore list to prevent them being
-# overwritten with old versions.  F26 and dnf 2.0 has changed
-# behaviour that means re-installing python-virtualenv fails [2].
-# Thus we do a quick check if we're in the infra environment by
-# looking for the mirror config script before doing this, and just
-# skip it if so.
-
-# [1] https://opendev.org/openstack/diskimage-builder/src/branch/master/ \
-#        diskimage_builder/elements/pip-and-virtualenv/ \
-#            install.d/pip-and-virtualenv-source-install/04-install-pip
-# [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
-
-function fixup_virtualenv {
-    if [[ ! -f /etc/ci/mirror_info.sh ]]; then
-        install_package python-virtualenv
-        pip_install -U --force-reinstall virtualenv
-    fi
-}
-
 function fixup_all {
     fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse
-    fixup_virtualenv
 }

From 7a2c1c2b1b4eead11168a9e635be3e0d883a7c5f Mon Sep 17 00:00:00 2001
From: Witek Bedyk <witold.bedyk@suse.com>
Date: Tue, 31 Mar 2020 16:43:38 +0200
Subject: [PATCH 2636/3333] Add python3-dev package for Debian based distros

When stacking outside of Zuul CI the wheels have to be built locally and
python3-dev package is required.

Story: 2007491
Task: 39213

Change-Id: I0960269d5cf193c9ececc5490485522c74646382
---
 files/debs/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/general b/files/debs/general
index 9f9d57cefb..ac297435db 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,6 +27,7 @@ openssh-server
 openssl
 pkg-config
 psmisc
+python3-dev
 tar
 tcpdump
 unzip

From 497caf015729d451428d5b608853741689f153b3 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.com>
Date: Fri, 3 Apr 2020 10:14:07 -0700
Subject: [PATCH 2637/3333] Fix opensuse trusted certificates

There's a bug[1] with the combination of the p11-kit and
ca-certificates-mozilla packages available on the latest built
opensuse-15 node in nodepool (which has not been rebuilt for weeks due
to a separate issue[2]) which causes the standard CA bundle to not be
installed correctly and causes jobs that call to external HTTPS services
to fail. Upgrading both packages in sync fixes the issue.

[1] https://bugzilla.suse.com/show_bug.cgi?id=1154871
[2] http://bugzilla.suse.com/show_bug.cgi?id=1166139

Change-Id: Ia8fdfe12fd9089e178adcb2b5eec997eebada262
Needed-by: https://review.opendev.org/713566
---
 tools/fixup_stuff.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 15b3ab767d..5d3f610173 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -200,6 +200,11 @@ function fixup_suse {
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
     sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
+
+    # Ensure trusted CA certificates are up to date
+    # See https://bugzilla.suse.com/show_bug.cgi?id=1154871
+    # May be removed once a new opensuse-15 image is available in nodepool
+    sudo zypper up -y p11-kit ca-certificates-mozilla
 }
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From e16e925e120100156a08a0436040f42b901b361a Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 9 Apr 2020 11:00:28 +0100
Subject: [PATCH 2638/3333] Fedora: Do not start the lvmetad service after
 Fedora 30

This deprecated service has been removed from lvm2 in Fedora 31:

https://src.fedoraproject.org/rpms/lvm2/c/0469456b352530d9f507f2515e674bfb03671f48

Change-Id: I06d572a72969c5e5e8e038caef19e358e4f97b2b
---
 lib/lvm | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index d9e78a016f..92265f2af2 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -124,13 +124,15 @@ function init_lvm_volume_group {
     local vg=$1
     local size=$2
 
-    # Start the lvmetad and tgtd services
-    if is_fedora || is_suse; then
+    # Start the lvmetad on f30 (dropped from f31) or SUSE
+    if [[ $DISTRO =~ f30 ]] || is_suse; then
         # services is not started by default
         start_service lvm2-lvmetad
-        if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
-            start_service tgtd
-        fi
+    fi
+
+    # Start the tgtd service on Fedora and SUSE if tgtadm is used
+    if  is_fedora || is_suse  && [[ "$CINDER_ISCSI_HELPER" = "tgtadm" ]]; then
+        start_service tgtd
     fi
 
     # Start with a clean volume group

From e6852eadb192365093e8ef738cff87fe60e8434a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Mar 2020 15:18:11 +1100
Subject: [PATCH 2639/3333] Use venv for VIRTUALENV_CMD

Using venv, which is part of python3, we avoid an extra dependency on
the virtualenv package.  For Debuntu, which splits this out into a
separate package, add this to debs/general.

This is part of the infra efforts to ship "plain" nodes without any
dependencies installed.  While devstack can re-install virtualenv, we
don't need any features it provides and it means one less dependency.

Change-Id: I3c323640f288e57581a4eb8adba2a08d0b0cbd8f
---
 files/debs/general | 1 +
 stackrc            | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index ac297435db..fe0061337a 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -28,6 +28,7 @@ openssl
 pkg-config
 psmisc
 python3-dev
+python3-venv
 tar
 tcpdump
 unzip
diff --git a/stackrc b/stackrc
index 4e33b6838f..17641c343d 100644
--- a/stackrc
+++ b/stackrc
@@ -150,7 +150,8 @@ export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
 # Create a virtualenv with this
 if [[ ${USE_PYTHON3} == True ]]; then
-    export VIRTUALENV_CMD="virtualenv -p python3"
+    # Use the built-in venv to avoid more dependencies
+    export VIRTUALENV_CMD="python3 -m venv"
 else
     export VIRTUALENV_CMD="virtualenv "
 fi

From e0da11cec5324cc4c100f6e22b83f1addde06ce7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 14 Apr 2020 06:10:51 +0000
Subject: [PATCH 2640/3333] Updated from generate-devstack-plugins-list

Change-Id: I0c3950729380646e1a98a90ee82e8562cc8c33c1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e92929a809..70c18a88b1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -97,6 +97,7 @@ openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-
 openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
 openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
+openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
 openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__

From f9e81d34382083732b02b0cda87331e20e04d48d Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Sun, 12 Apr 2020 11:29:59 +0100
Subject: [PATCH 2641/3333] Fedora: Update required RPMs for Fedora 31

This includes the addition of the python3-virtualenv package required to
provide the virtualenv binary that is no longer present in the image.

Change-Id: Ie8e66d8b9f93063b97f88f41a626daddf235339b
---
 files/rpms/cinder  | 4 ++--
 files/rpms/dstat   | 4 ++--
 files/rpms/general | 7 ++++---
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index e1e1f6c5c0..a8201ea38b 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f30 NOPRIME
-targetcli # dist:rhel7,f30 NOPRIME
+scsi-target-utils # not:rhel7,f30,f31 NOPRIME
+targetcli # dist:rhel7,f30,f31 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index e63af317fd..a091cceb3a 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,2 @@
-dstat # not:f30
-pcp-system-tools # dist:f30
+dstat # not:f30,f31
+pcp-system-tools # dist:f30,f31
diff --git a/files/rpms/general b/files/rpms/general
index e3d20b3360..361416a910 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f30
+iptables-services  # NOPRIME f30,f31
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f30
+java-1.8.0-openjdk-headless  # NOPRIME f30,f31
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -27,7 +27,8 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
-python3-devel # f30
+python3-devel # dist:f30,f31
+python3-virtualenv # dist:f31
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
diff --git a/files/rpms/nova b/files/rpms/nova
index c590378677..0f3d10f53a 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f30
+kernel-modules # dist:f30,f31
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index eb94d14339..745cc2e09a 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f30
+rsync-daemon # dist:f30,f31
 sqlite
 xfsprogs
 xinetd

From c36e51b0ae541a983eb917a8746d07d10c723e40 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 9 Apr 2020 11:17:03 +0100
Subject: [PATCH 2642/3333] Fedora: Mark Fedora 31 as supported and use within
 fedora-latest

Change-Id: I06235eb5bf722e6f3ab05da577fa0f00638c87b1
---
 .zuul.yaml | 2 +-
 stack.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc97b89980..48c2d0d798 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -52,7 +52,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-30
+        label: fedora-31
     groups:
       - name: tempest
         nodes:
diff --git a/stack.sh b/stack.sh
index 9879bd43d4..4e1134b7e3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From c287e7ec3c22a9b4c2d89c1e36a6383b351f9b17 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 11 Dec 2019 16:55:41 +1100
Subject: [PATCH 2643/3333] Remove CentOS 7 as supported environment

We do not support CentOS 7 on master branch due to no Python 3 or
ongoing eco-system (i.e. RDO) support; see
Id9ef507dd6f4226d65c6ed3043666b0aa6a3bd1c.

Change-Id: If98581708568e7a8d15e6edc588a008df0cac0fb
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 4e1134b7e3..0f1ddb1b3f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 9b8b7021d0a8c7647b47e74a2cd4163a663acd40 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2020 13:03:56 +1000
Subject: [PATCH 2644/3333] Fedora: install python3-libguestfs

All platforms are python3 now

Change-Id: Ie9f4c7e52f23a45bb8cf70a5fddf1b21a40d7000
---
 lib/nova_plugins/hypervisor-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index d1b3d784b7..b0ae29e39b 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -117,7 +117,7 @@ function install_nova_hypervisor {
             # Workaround for missing dependencies in python-libguestfs
             install_package python-libguestfs guestfs-data augeas augeas-lenses
         elif is_fedora; then
-            install_package python-libguestfs
+            install_package python3-libguestfs
         fi
     fi
 }

From ad1635147c51f0b0e8264dd32d3be9461519e87d Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 8 Jul 2019 13:17:39 +0100
Subject: [PATCH 2645/3333] Bump noVNC to 1.1.0

v1.1.0 was released over a year ago now so move to it ahead of 1.2.0.

Change-Id: I13c5638f320b18c4f6f945528352471d2bb31313
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 17641c343d..70007a9a80 100644
--- a/stackrc
+++ b/stackrc
@@ -600,7 +600,7 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-v1.0.0}
+NOVNC_BRANCH=${NOVNC_BRANCH:-v1.1.0}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}

From 3cd41019b048349b42ec62d5602beb89bed9e975 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2020 13:06:07 +1000
Subject: [PATCH 2646/3333] lib/tls: use python3 to run inline script

We only need to run this fixup for the active python now we are 3 only.

Change-Id: I7616e5ee5693b2890fb7f6bd9052890a82904c22
---
 lib/tls  | 3 +--
 stack.sh | 3 ---
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/tls b/lib/tls
index 65ffeb937d..d05536b45d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -369,8 +369,7 @@ function deploy_int_CA {
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy; then
         local capath
-        local python_cmd=${1:-python}
-        capath=$($python_cmd -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+        capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
 
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
diff --git a/stack.sh b/stack.sh
index 0f1ddb1b3f..b59af404a4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -968,9 +968,6 @@ fi
 
 if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
-    if python3_enabled ; then
-        fix_system_ca_bundle_path python3
-    fi
 fi
 
 # Extras Install

From 812e7846c99e6e4445fdd115a6440fe999730bc1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2020 09:25:22 +1000
Subject: [PATCH 2647/3333] Cleanup rpm-distro mariadb install

We have lib/databases/mysql which is installing databases, remove it
from the bulk package lists.

Split is_fedora (fedora & centos8 -- soon) to install mariadb-server
and mariadb-devel to retain status-quo.

On suse this seems to be a meta-package

 'mariadb-server' not found in package names. Trying capabilities.

so split that out.  It seems it has never been installing the -devel
package, and things work (presumably clients are coming from wheels so
don't need to build against it).

Change-Id: I86433318e8f76c40c5c792b795411a5c9d8351d3
---
 files/rpms-suse/neutron-common | 1 -
 files/rpms-suse/nova           | 1 -
 files/rpms/general             | 1 -
 lib/databases/mysql            | 5 ++++-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/files/rpms-suse/neutron-common b/files/rpms-suse/neutron-common
index d1cc73f115..e3799a9353 100644
--- a/files/rpms-suse/neutron-common
+++ b/files/rpms-suse/neutron-common
@@ -5,7 +5,6 @@ ebtables
 haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
-mariadb # NOPRIME
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 1d5812146b..9923760750 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -11,7 +11,6 @@ kpartx
 kvm # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
-mariadb # NOPRIME
 # mkisofs is required for config_drive
 mkisofs # not:sle12
 parted
diff --git a/files/rpms/general b/files/rpms/general
index 361416a910..b150a570b4 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -17,7 +17,6 @@ libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
-mariadb-devel  # MySQL-python
 net-tools
 openssh-server
 openssl
diff --git a/lib/databases/mysql b/lib/databases/mysql
index e5865f2a69..d4969d713c 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -175,7 +175,10 @@ EOF
     # Install mysql-server
     if is_oraclelinux; then
         install_package mysql-community-server
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
+        install_package mariadb-server mariadb-devel
+        sudo systemctl enable $MYSQL_SERVICE_NAME
+    elif is_suse; then
         install_package mariadb-server
         sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_ubuntu; then

From 39bc71cedd96b45caec6e92dc8228da1cc3b1643 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2020 11:53:11 +1000
Subject: [PATCH 2648/3333] libs/rpms : update for CentOS 7 removal

With the removal of CentOS 7, we can re-evaluate the rpm
installations.

We should not need virtualenv after https://review.opendev.org/712609

There should be no need for python-devel as we're python3

pyOpenSSL was added to workaround memory issues in
9e98f9435ec36f2fffed0ac368befd520f07e0e1 (2015) ... I think we've
moved on.

pyxattr is not a package; remove it.

I don't see we need packaged m2crypto, which isn't a package on CentOS
8.  nor libxml2-python; these days it has wheels which should work
with the normal installation process.

centos8 has:

 * targetcli
 * pcp-system-tools (and no dstat)
 * iptables-services
 * java-1.8.0-openjdk-headless
 * kernel-modules
 * rsync-daemon

just as all supported fedora's do, so we can remove any matching here.

Change-Id: I542c426a67a98f331d2a29bacd220af81fab8cc4
---
 files/rpms/cinder         |  3 +--
 files/rpms/dstat          |  3 +--
 files/rpms/general        | 10 +++-------
 files/rpms/neutron-common |  2 --
 files/rpms/nova           |  6 +-----
 files/rpms/swift          |  3 +--
 6 files changed, 7 insertions(+), 20 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index a8201ea38b..c21ea08e89 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,4 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f30,f31 NOPRIME
-targetcli # dist:rhel7,f30,f31 NOPRIME
+targetcli
diff --git a/files/rpms/dstat b/files/rpms/dstat
index a091cceb3a..6524bed607 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1 @@
-dstat # not:f30,f31
-pcp-system-tools # dist:f30,f31
+pcp-system-tools
diff --git a/files/rpms/general b/files/rpms/general
index b150a570b4..ff77ce05af 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,8 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f30,f31
-java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f30,f31
+iptables-services
+java-1.8.0-openjdk-headless
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -25,10 +24,7 @@ pcre-devel # for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc
-pyOpenSSL # version in pip uses too much memory
-python3-devel # dist:f30,f31
-python3-virtualenv # dist:f31
-python-devel
+python3-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
 tar
diff --git a/files/rpms/neutron-common b/files/rpms/neutron-common
index 0cc8d11ceb..fe25f57ea6 100644
--- a/files/rpms/neutron-common
+++ b/files/rpms/neutron-common
@@ -5,8 +5,6 @@ ebtables
 haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
-mysql-devel
-mysql-server # NOPRIME
 openvswitch # NOPRIME
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 0f3d10f53a..2218330230 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,12 +7,8 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f30,f31
+kernel-modules
 kpartx
-libxml2-python
-m2crypto
-mysql-devel
-mysql-server # NOPRIME
 parted
 polkit
 rabbitmq-server # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 745cc2e09a..376c6f3df7 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,8 +1,7 @@
 curl
 liberasurecode-devel
 memcached
-pyxattr
-rsync-daemon # dist:f30,f31
+rsync-daemon
 sqlite
 xfsprogs
 xinetd

From f70cb70acb8050c49dd4cf5f3e4f7c70ba2d978d Mon Sep 17 00:00:00 2001
From: Bharat Kunwar <bharat@stackhpc.com>
Date: Mon, 20 Apr 2020 09:53:25 +0000
Subject: [PATCH 2649/3333] Support upload of qcow2.xz image format

Some images come in *.xz format [1] and this needs to be
uncompressed before being uploaded.

[1] https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/31.20200323.3.2/x86_64/fedora-coreos-31.20200323.3.2-openstack.x86_64.qcow2.xz

Change-Id: I11f8484ba939c4b2c0a98aa08ef7db730baf71e8
---
 functions | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/functions b/functions
index 8ea634e753..0d27515c20 100644
--- a/functions
+++ b/functions
@@ -341,6 +341,12 @@ function upload_image {
             disk_format=qcow2
             container_format=bare
             ;;
+        *.qcow2.xz)
+            image_name=$(basename "$image" ".qcow2.xz")
+            disk_format=qcow2
+            container_format=bare
+            unpack=unxz
+            ;;
         *.raw)
             image_name=$(basename "$image" ".raw")
             disk_format=raw
@@ -376,6 +382,16 @@ function upload_image {
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
         elif [ "$unpack" = "bunzip2" ]; then
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(bunzip2 -cdk "${image}")
+        elif [ "$unpack" = "unxz" ]; then
+            # NOTE(brtknr): unxz the file first and cleanup afterwards to
+            # prevent timeout while Glance tries to upload image (e.g. to Swift).
+            local tmp_dir
+            local image_path
+            tmp_dir=$(mktemp -d)
+            image_path="$tmp_dir/$image_name"
+            unxz -cv "${image}" > "$image_path"
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format --file "$image_path"
+            rm -rf $tmp_dir
         else
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi

From 4578f98944efac5ef0c2c1476d26efd5c880e367 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Sun, 19 Apr 2020 17:54:56 -0500
Subject: [PATCH 2650/3333] [ussuri][goal] Update contributor documentation

This patch updates/adds the contributor documentation to follow
the guidelines of the Ussuri cycle community goal[1].

[1] https://governance.openstack.org/tc/goals/selected/ussuri/project-ptl-and-contrib-docs.html
Story: #2007236
Task: #38554

Change-Id: I870955fda7ee6e0d7809faa309bbc31c2ddd653a
---
 CONTRIBUTING.rst                        | 19 +++++++++
 doc/source/contributor/contributing.rst | 56 +++++++++++++++++++++++++
 doc/source/index.rst                    |  7 ++++
 3 files changed, 82 insertions(+)
 create mode 100644 CONTRIBUTING.rst
 create mode 100644 doc/source/contributor/contributing.rst

diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
new file mode 100644
index 0000000000..bb511656f1
--- /dev/null
+++ b/CONTRIBUTING.rst
@@ -0,0 +1,19 @@
+The source repository for this project can be found at:
+
+   https://opendev.org/openstack/devstack
+
+Pull requests submitted through GitHub are not monitored.
+
+To start contributing to OpenStack, follow the steps in the contribution guide
+to set up and use Gerrit:
+
+   https://docs.openstack.org/contributors/code-and-documentation/quick-start.html
+
+Bugs should be filed on Launchpad:
+
+   https://bugs.launchpad.net/devstack
+
+For more specific information about contributing to this repository, see the
+Devstack contributor guide:
+
+   https://docs.openstack.org/devstack/latest/contributor/contributing.html
diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst
new file mode 100644
index 0000000000..5e0df569f7
--- /dev/null
+++ b/doc/source/contributor/contributing.rst
@@ -0,0 +1,56 @@
+============================
+So You Want to Contribute...
+============================
+
+For general information on contributing to OpenStack, please check out the
+`contributor guide <https://docs.openstack.org/contributors/>`_ to get started.
+It covers all the basics that are common to all OpenStack projects: the accounts
+you need, the basics of interacting with our Gerrit review system, how we
+communicate as a community, etc.
+
+Below will cover the more project specific information you need to get started
+with Devstack.
+
+Communication
+~~~~~~~~~~~~~
+* IRC channel ``#openstack-qa`` at FreeNode
+* Mailing list (prefix subjects with ``[qa][devstack]`` for faster responses)
+  http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss
+
+Contacting the Core Team
+~~~~~~~~~~~~~~~~~~~~~~~~
+Please refer to the `Devstack Core Team
+<https://review.opendev.org/#/admin/groups/50,members>`_ contacts.
+
+New Feature Planning
+~~~~~~~~~~~~~~~~~~~~
+If you want to propose a new feature please read `Feature Proposal Process`_
+Devstack features are tracked on `Launchpad BP <https://blueprints.launchpad.net/devstack>`_.
+
+Task Tracking
+~~~~~~~~~~~~~
+We track our tasks in `Launchpad <https://bugs.launchpad.net/devstack>`_.
+
+Reporting a Bug
+~~~~~~~~~~~~~~~
+You found an issue and want to make sure we are aware of it? You can do so on
+`Launchpad <https://bugs.launchpad.net/devstack/+filebug>`__.
+More info about Launchpad usage can be found on `OpenStack docs page
+<https://docs.openstack.org/contributors/common/task-tracking.html#launchpad>`_
+
+Getting Your Patch Merged
+~~~~~~~~~~~~~~~~~~~~~~~~~
+All changes proposed to the Devstack require two ``Code-Review +2`` votes from
+Devstack core reviewers before one of the core reviewers can approve the patch
+by giving ``Workflow +1`` vote. One exception is for patches to unblock the gate
+which can be approved by single core reviewers.
+
+Project Team Lead Duties
+~~~~~~~~~~~~~~~~~~~~~~~~
+All common PTL duties are enumerated in the `PTL guide
+<https://docs.openstack.org/project-team-guide/ptl.html>`_.
+
+The Release Process for QA is documented in `QA Release Process
+<https://wiki.openstack.org/wiki/QA/releases>`_.
+
+.. _Feature Proposal Process: https://wiki.openstack.org/wiki/QA#Feature_Proposal_.26_Design_discussions
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6694022316..7923cb88c7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -151,6 +151,13 @@ Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
 
+If you are a new contributor to devstack please refer: :doc:`contributor/contributing`
+
+.. toctree::
+   :hidden:
+
+   contributor/contributing
+
 Contents
 ++++++++
 

From 332992ace2bcb2a4d94c0ae3ccbc7c3a2a7bcb38 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Sun, 26 Apr 2020 12:39:05 -0400
Subject: [PATCH 2651/3333] setup-devstack-source-dirs: add var for paths

The paths for the devstack source directories are currently hardcoded,
this patch allows overriding that list.

Change-Id: I2b673b0d110d84658b89bb14663584330deaf3aa
---
 roles/setup-devstack-source-dirs/defaults/main.yaml | 8 ++++++++
 roles/setup-devstack-source-dirs/tasks/main.yaml    | 9 +--------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/roles/setup-devstack-source-dirs/defaults/main.yaml b/roles/setup-devstack-source-dirs/defaults/main.yaml
index fea05c8146..77a74d7b89 100644
--- a/roles/setup-devstack-source-dirs/defaults/main.yaml
+++ b/roles/setup-devstack-source-dirs/defaults/main.yaml
@@ -1 +1,9 @@
 devstack_base_dir: /opt/stack
+devstack_source_dirs:
+  - src/opendev.org/opendev
+  - src/opendev.org/openstack
+  - src/opendev.org/openstack-dev
+  - src/opendev.org/openstack-infra
+  - src/opendev.org/starlingx
+  - src/opendev.org/x
+  - src/opendev.org/zuul
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index 160757ede9..294c29cd29 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,13 +1,6 @@
 - name: Find all OpenStack source repos used by this job
   find:
-    paths:
-      - src/opendev.org/opendev
-      - src/opendev.org/openstack
-      - src/opendev.org/openstack-dev
-      - src/opendev.org/openstack-infra
-      - src/opendev.org/starlingx
-      - src/opendev.org/x
-      - src/opendev.org/zuul
+    paths: "{{ devstack_source_dirs }}"
     file_type: directory
   register: found_repos
 

From ccc58267257f48501030ad7e3c4b18a7435f9a1c Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 27 Apr 2020 06:13:34 +0000
Subject: [PATCH 2652/3333] Updated from generate-devstack-plugins-list

Change-Id: I04b13cb0114233afca9aa7987144bd69d6d0f185
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 70c18a88b1..42c5fc1324 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -138,6 +138,7 @@ starlingx/integ                          `https://opendev.org/starlingx/integ <h
 starlingx/metal                          `https://opendev.org/starlingx/metal <https://opendev.org/starlingx/metal>`__
 starlingx/nfv                            `https://opendev.org/starlingx/nfv <https://opendev.org/starlingx/nfv>`__
 starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
+vexxhost/openstack-operator              `https://opendev.org/vexxhost/openstack-operator <https://opendev.org/vexxhost/openstack-operator>`__
 x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
 x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
 x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__

From bc86e82a61d9aa74e6f455bb47003a96c548b2fc Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 27 Apr 2020 12:03:38 -0500
Subject: [PATCH 2653/3333] Update DEVSTACK_SERIES to victoria

stable/ussuri branch has been created now and
current master is for victoria.

Change-Id: I10bd20adf6ce43c6c73acaa646d425c6df6da199
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 17641c343d..c8c2738fef 100644
--- a/stackrc
+++ b/stackrc
@@ -255,7 +255,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="ussuri"
+DEVSTACK_SERIES="victoria"
 
 ##############
 #

From 1147300b9c572a19cf4c70ad3ba1fab7ccb965cc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 30 Apr 2020 10:09:47 +1000
Subject: [PATCH 2654/3333] Remove bridge-utils/brctl usage

This package isn't available on some distributions hasn't been
required in Neutron for several years
If679e79fa3242ee1cd8610b5525deca35b41c87e.  Remove it.

Change-Id: I7308a885c1d084efe2f0b9f542443d35966140ed
---
 files/debs/general                    | 1 -
 files/rpms-suse/general               | 1 -
 files/rpms/general                    | 1 -
 lib/neutron_plugins/linuxbridge_agent | 2 +-
 tools/worlddump.py                    | 2 --
 5 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index fe0061337a..2d8cd80473 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,7 +1,6 @@
 apache2
 apache2-dev
 bc
-bridge-utils
 bsdmainutils
 curl
 default-jre-headless  # NOPRIME
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index b870d72149..0af2b5b169 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -1,7 +1,6 @@
 apache2
 apache2-devel
 bc
-bridge-utils
 ca-certificates-mozilla
 curl
 gcc
diff --git a/files/rpms/general b/files/rpms/general
index ff77ce05af..303510cbd9 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,5 +1,4 @@
 bc
-bridge-utils
 curl
 dbus
 gcc
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 1f1b0e8e52..bdeaf0f3c6 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -38,7 +38,7 @@ function neutron_plugin_create_nova_conf {
 }
 
 function neutron_plugin_install_agent_packages {
-    install_package bridge-utils
+    :
 }
 
 function neutron_plugin_configure_dhcp_agent {
diff --git a/tools/worlddump.py b/tools/worlddump.py
index b21ed0c861..0a4df52337 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -166,8 +166,6 @@ def network_dump():
     _header("Network Dump")
 
     _dump_cmd("bridge link")
-    if _find_cmd("brctl"):
-        _dump_cmd("brctl show")
     _dump_cmd("ip link show type bridge")
     ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:

From 36705b52336a442dc05d9874638d269834ff93b7 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 9 Apr 2020 11:00:28 +0100
Subject: [PATCH 2655/3333] CentOS 8 support

This adds support for CentOS 8

Change-Id: If7ddbd6655086657db03074a27a2d47053fd88e0
---
 .zuul.yaml | 19 ++++++++++++
 stack.sh   | 85 +++++++++++++++---------------------------------------
 2 files changed, 43 insertions(+), 61 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 48c2d0d798..4a54a3a070 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,6 +38,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-8
+    nodes:
+      - name: controller
+        label: centos-8
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-opensuse-15
     nodes:
@@ -498,6 +508,14 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-centos-8
+    parent: tempest-full-py3
+    description: Centos 8 platform test
+    nodeset: devstack-single-node-centos-8
+    voting: false
+    timeout: 9000
+
 - job:
     name: devstack-platform-opensuse-15
     parent: tempest-full-py3
@@ -595,6 +613,7 @@
         - devstack-ipv6
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
+        - devstack-platform-centos-8
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/stack.sh b/stack.sh
index b59af404a4..aa898de9fb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
@@ -290,67 +290,20 @@ function _install_epel {
         uninstall_package epel-release || true
     fi
 
-    # This trick installs the latest epel-release from a bootstrap
-    # repo, then removes itself (as epel-release installed the
-    # "real" repo).
-    #
-    # You would think that rather than this, you could use
-    # $releasever directly in .repo file we create below.  However
-    # RHEL gives a $releasever of "6Server" which breaks the path;
-    # see https://bugzilla.redhat.com/show_bug.cgi?id=1150759
-    cat <<EOF | sudo tee /etc/yum.repos.d/epel-bootstrap.repo
-[epel-bootstrap]
-name=Bootstrap EPEL
-mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-7&arch=\$basearch
-failovermethod=priority
-enabled=0
-gpgcheck=0
-EOF
-    # Enable a bootstrap repo.  It is removed after finishing
-    # the epel-release installation.
-    is_package_installed yum-utils || install_package yum-utils
-    sudo yum-config-manager --enable epel-bootstrap
-    yum_install epel-release || \
-        die $LINENO "Error installing EPEL repo, cannot continue"
-    sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
+    # epel-release is in extras repo which is enabled by default
+    install_package epel-release
+
+    # RDO repos are not tested with epel and may have incompatibilities so
+    # let's limit the packages fetched from epel to the ones not in RDO repos.
+    sudo yum-config-manager --save --setopt=includepkgs=debootstrap,dpkg epel
 }
 
 function _install_rdo {
-    # There are multiple options for this, including using CloudSIG
-    # repositories (centos-release-*), trunk versions, etc.  Since
-    # we're not interested in the actual openstack distributions
-    # (since we're using git to run!) but only peripherial packages
-    # like kvm or ovs, this has been reliable.
-
-    # TODO(ianw): figure out how to best mirror -- probably use infra
-    # mirror RDO reverse proxy.  We could either have test
-    # infrastructure set it up disabled like EPEL, or fiddle it here.
-    # Per the point above, it's a bunch of repos so starts getting a
-    # little messy...
-    if ! is_package_installed rdo-release ; then
-        if [[ "$TARGET_BRANCH" == "master" ]]; then
-            yum_install https://rdoproject.org/repos/rdo-release.rpm
-        else
-            # Get latest rdo-release-$rdo_release RPM package version
-            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
-            yum_install https://rdoproject.org/repos/openstack-$rdo_release/rdo-release-$rdo_release.rpm
-        fi
-    fi
-
-    # Also enable optional for RHEL7 proper.  Note this is a silent
-    # no-op on other platforms.
-    sudo yum-config-manager --enable rhel-7-server-optional-rpms
-
-    # Enable the Software Collections (SCL) repository for CentOS.
-    # This repository includes useful software (e.g. the Go Toolset)
-    # which is not present in the main repository.
-    if [[ "$os_VENDOR" =~ (CentOS) ]]; then
-        yum_install centos-release-scl
-    fi
-
-    if is_oraclelinux; then
-        sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
-    fi
+    # NOTE(ianw) 2020-04-30 : when we have future branches, we
+    # probably want to install the relevant branch RDO release as
+    # well.  But for now it's all master.
+    sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    sudo dnf -y update
 }
 
 
@@ -395,15 +348,19 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-if [[ $DISTRO == "rhel7" ]]; then
+if [[ $DISTRO == "rhel8" ]]; then
     # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
     # node, where EPEL is installed (but disabled) and already
     # pointing at our internal mirror
     if [[ -f /etc/ci/mirror_info.sh ]]; then
         SKIP_EPEL_INSTALL=True
-        sudo yum-config-manager --enable epel
+        sudo dnf config-manager --set-enabled epel
     fi
 
+    # PowerTools repo provides libyaml-devel required by devstack itself and
+    # EPEL packages assume that the PowerTools repository is enable.
+    sudo dnf config-manager --set-enabled PowerTools
+
     if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
         _install_epel
     fi
@@ -411,6 +368,12 @@ if [[ $DISTRO == "rhel7" ]]; then
     # available in RDO repositories (e.g. OVS, or later versions of
     # kvm) to run.
     _install_rdo
+
+    # NOTE(cgoncalves): workaround RHBZ#1154272
+    # dnf fails for non-privileged users when expired_repos.json doesn't exist.
+    # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
+    # Patch: https://github.com/rpm-software-management/dnf/pull/1448
+    echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
 fi
 
 # Ensure python is installed

From 67fd81a484b2e9153e39d583c03ffc929ef6703e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 30 Apr 2020 09:24:04 +1000
Subject: [PATCH 2656/3333] Cleanup yum things

We no longer support platforms with Yum on master.  Cleanup old
references and convert to dnf.

We don't need any of the failure wrapper stuff as dnf runs in strict
mode by default.

There seem to be a few callers out there, so we'll leave it called
yum_install for now.

Change-Id: Ie71a48fd85b00a97a14bf260cd013b18af4cce06
---
 functions-common | 50 +++++++-----------------------------------------
 stack.sh         |  9 +--------
 stackrc          |  9 ---------
 3 files changed, 8 insertions(+), 60 deletions(-)

diff --git a/functions-common b/functions-common
index 6be07b42bb..f50ff56c7d 100644
--- a/functions-common
+++ b/functions-common
@@ -329,9 +329,6 @@ function _ensure_lsb_release {
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
-    elif [[ -x $(command -v yum 2>/dev/null) ]]; then
-        # all rh patforms (fedora, centos, rhel) have this pkg
-        sudo yum install -y redhat-lsb-core
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -1361,7 +1358,7 @@ function uninstall_package {
     if is_ubuntu; then
         apt_get purge "$@"
     elif is_fedora; then
-        sudo ${YUM:-yum} remove -y "$@" ||:
+        sudo dnf remove -y "$@" ||:
     elif is_suse; then
         sudo zypper remove -y "$@" ||:
     else
@@ -1369,8 +1366,11 @@ function uninstall_package {
     fi
 }
 
-# Wrapper for ``yum`` to set proxy environment variables
-# Uses globals ``OFFLINE``, ``*_proxy``, ``YUM``
+# Wrapper for ``dnf`` to set proxy environment variables
+# Uses globals ``OFFLINE``, ``*_proxy``
+# The name is kept for backwards compatability with external
+# callers, despite none of our supported platforms using yum
+# any more.
 # yum_install package [package ...]
 function yum_install {
     local result parse_yum_result
@@ -1378,44 +1378,8 @@ function yum_install {
     [[ "$OFFLINE" = "True" ]] && return
 
     time_start "yum_install"
-
-    # This is a bit tricky, because yum -y assumes missing or failed
-    # packages are OK (see [1]).  We want devstack to stop if we are
-    # installing missing packages.
-    #
-    # Thus we manually match on the output (stack.sh runs in a fixed
-    # locale, so lang shouldn't change).
-    #
-    # If yum returns !0, we echo the result as "YUM_FAILED" and return
-    # that from the awk (we're subverting -e with this trick).
-    # Otherwise we use awk to look for failure strings and return "2"
-    # to indicate a terminal failure.
-    #
-    # [1] https://bugzilla.redhat.com/show_bug.cgi?id=965567
-    parse_yum_result='              \
-        BEGIN { result=0 }          \
-        /^YUM_FAILED/ { result=$2 } \
-        /^No package/ { result=2 }  \
-        /^Failed:/    { result=2 }  \
-        //{ print }                 \
-        END { exit result }'
-    (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
-        | awk "$parse_yum_result" && result=$? || result=$?
-
+    sudo_with_proxies dnf install -y "$@"
     time_stop "yum_install"
-
-    # if we return 1, then the wrapper functions will run an update
-    # and try installing the package again as a defense against bad
-    # mirrors.  This can hide failures, especially when we have
-    # packages that are in the "Failed:" section because their rpm
-    # install scripts failed to run correctly (in this case, the
-    # package looks installed, so when the retry happens we just think
-    # the package is OK, and incorrectly continue on).
-    if [ "$result" == 2 ]; then
-        die "Detected fatal package install failure"
-    fi
-
-    return "$result"
 }
 
 # zypper wrapper to set arguments correctly
diff --git a/stack.sh b/stack.sh
index aa898de9fb..eac8079029 100755
--- a/stack.sh
+++ b/stack.sh
@@ -283,19 +283,12 @@ fi
 # to pick up required packages.
 
 function _install_epel {
-    # NOTE: We always remove and install latest -- some environments
-    # use snapshot images, and if EPEL version updates they break
-    # unless we update them to latest version.
-    if sudo yum repolist enabled epel | grep -q 'epel'; then
-        uninstall_package epel-release || true
-    fi
-
     # epel-release is in extras repo which is enabled by default
     install_package epel-release
 
     # RDO repos are not tested with epel and may have incompatibilities so
     # let's limit the packages fetched from epel to the ones not in RDO repos.
-    sudo yum-config-manager --save --setopt=includepkgs=debootstrap,dpkg epel
+    sudo dnf config-manager --save --setopt=includepkgs=debootstrap,dpkg epel
 }
 
 function _install_rdo {
diff --git a/stackrc b/stackrc
index cf501bb374..b189e206e1 100644
--- a/stackrc
+++ b/stackrc
@@ -813,15 +813,6 @@ SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 # Service graceful shutdown timeout
 WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
 
-# Choose DNF on RedHat/Fedora platforms with it, or otherwise default
-# to YUM.  Can remove this when only dnf is supported (i.e. centos7
-# disappears)
-if [[ -e /usr/bin/dnf ]]; then
-    YUM=${YUM:-dnf}
-else
-    YUM=${YUM:-yum}
-fi
-
 # Common Configuration
 # --------------------
 

From c104afec7dd72edfd909847bee9c14eaf077a28b Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 4 May 2020 08:21:02 +0200
Subject: [PATCH 2657/3333] Switch to new grenade job name

The integrated gate template (integrated-gate-py3) has been switched
to the new grenade name (grenade-py3 -> grenade). This repo uses the
template but also has for irrelevant files an extra entry.

Rename the job following the template change to avoid duplicate
grenade runs.

Details:
- http://lists.openstack.org/pipermail/openstack-discuss/2020-May/014602.html

Depends-On: https://review.opendev.org/725148
Change-Id: I73e67c0e01ca231678903b2460dab672f17251e3
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 4a54a3a070..602975a165 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -627,7 +627,7 @@
         - swift-dsvm-functional-py3:
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
-        - grenade-py3:
+        - grenade:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -676,7 +676,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - grenade-py3:
+        - grenade:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 53c2f6fe23318d16f311fde58901ad12e37049a0 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sat, 9 May 2020 13:30:10 +0200
Subject: [PATCH 2658/3333] Cleanup py27 support

This repo is now testing only with Python 3, so let's make
a few cleanups:
- Remove obsolete section from setup.cfg
- Use newer openstackdocstheme and Sphinx version for python 3
- Remove install_command from tox.ini, the default is fine
- Move basepython into testenv
- Update bashate version

Change-Id: I3d78b3787af2efce831d223dbcab6cf84c358028
---
 doc/requirements.txt | 4 ++--
 setup.cfg            | 3 ---
 tox.ini              | 8 ++------
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/doc/requirements.txt b/doc/requirements.txt
index fffb83d96b..6ca2d60eaa 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -2,8 +2,8 @@ pbr>=2.0.0,!=2.1.0
 
 Pygments
 docutils
-sphinx>=1.6.2
-openstackdocstheme>=1.20.0
+sphinx>=2.0.0,!=2.1.0
+openstackdocstheme>=2.0.0
 nwdiag
 blockdiag
 sphinxcontrib-blockdiag
diff --git a/setup.cfg b/setup.cfg
index 4e27ad80d8..146f010243 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -10,6 +10,3 @@ classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License
     Operating System :: POSIX :: Linux
-
-[wheel]
-universal = 1
diff --git a/tox.ini b/tox.ini
index 26baa2a1c5..ed28636d3a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,15 +5,14 @@ envlist = bashate
 
 [testenv]
 usedevelop = False
-install_command = pip install {opts} {packages}
+basepython = python3
 
 [testenv:bashate]
-basepython = python3
 # if you want to test out some changes you have made to bashate
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.5.1}
+   {env:BASHATE_INSTALL_PATH:bashate==2.0.0}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
@@ -35,7 +34,6 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
-basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
@@ -44,7 +42,6 @@ commands =
   sphinx-build -W -b html -d doc/build/doctrees doc/source doc/build/html
 
 [testenv:pdf-docs]
-basepython = python3
 deps = {[testenv:docs]deps}
 whitelist_externals =
    make
@@ -53,6 +50,5 @@ commands =
    make -C doc/build/pdf
 
 [testenv:venv]
-basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 commands = {posargs}

From 551848dd696b32a48946b6f0a22079d57907a27c Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Mon, 27 Apr 2020 08:39:37 +0800
Subject: [PATCH 2659/3333] Fix devstack default settings in aarch64

1. Lack qemu-efi in ubuntu
2. Lack edk2.git-aarch64 in Fedora/Centos
3. Remove NOVNC disable.

Change-Id: Ifbd0c386df6b28bc64cef20cab8e08f99a85c782
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova_plugins/functions-libvirt  | 7 +++++++
 lib/nova_plugins/hypervisor-libvirt | 2 --
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 03df258e03..d3827c30dd 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -59,6 +59,9 @@ function install_libvirt {
 
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev
+        if is_arch "aarch64"; then
+            install_package qemu-efi
+        fi
         # uninstall in case the libvirt version changed
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
@@ -78,6 +81,10 @@ function install_libvirt {
         install_package qemu-kvm
 
         install_package libvirt libvirt-devel
+        if is_arch "aarch64"; then
+            install_package edk2.git-aarch64
+        fi
+
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
     fi
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b0ae29e39b..b25bc0c367 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -52,8 +52,6 @@ function configure_nova_hypervisor {
 
     # arm64-specific configuration
     if is_arch "aarch64"; then
-        # arm64 architecture currently does not support graphical consoles.
-        iniset $NOVA_CONF vnc enabled "false"
         iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
     fi
 

From 782efb0f8a0b6c64e5b6a317ff5bf905e51da850 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.com>
Date: Mon, 11 May 2020 18:28:32 -0700
Subject: [PATCH 2660/3333] Fix pip distro package removal for focal

Ubuntu Focal doesn't have python-pip, only python3-pip. Trying to
uninstall a package that apt doesn't know about (installed or
uninstalled) results in a nonzero exit code so devstack fails. This
patch makes the package removal safer for both python2 and python3 cases
by checking first if the package exists.

Change-Id: I3b1118888cb0617ffb99b72c7e9a32308033783e
---
 tools/install_pip.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dcd546629f..5eb538ce84 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -133,8 +133,12 @@ get_versions
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
 if ! is_fedora  && ! is_suse; then
-    uninstall_package python-pip
-    uninstall_package python3-pip
+    if is_package_installed python-pip ; then
+        uninstall_package python-pip
+    fi
+    if is_package_installed python3-pip ; then
+        uninstall_package python3-pip
+    fi
 fi
 
 install_get_pip

From 8fd45dec50ca8872bf07563dcb41cffca3683965 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 12 May 2020 12:00:20 +0200
Subject: [PATCH 2661/3333] New TEMPEST_VOLUME_REVERT_TO_SNAPSHOT setting

Follow the pattern of the other configuration keys. The new variables
allows tests to enable/disable volume revert tests provided
by cinder-tempest-plugin.

Revert-to-snapshot was introduced in pike, and so the tests.

Change-Id: If137f201c2f646703f5a1ff96e71e48caed63b67
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6e87e54801..37b22065b4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -472,6 +472,11 @@ function configure_tempest {
         TEMPEST_EXTEND_ATTACHED_VOLUME=${TEMPEST_EXTEND_ATTACHED_VOLUME:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_volume $(trueorfalse False TEMPEST_EXTEND_ATTACHED_VOLUME)
+    # Only turn on TEMPEST_VOLUME_REVERT_TO_SNAPSHOT by default for "lvm" backends
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
+        TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     # Reset microversions to None where v2 is running which does not support microversion.

From 9cbd02d8c8a99612862ccd1c20e199797c6bcb47 Mon Sep 17 00:00:00 2001
From: Vladislav Kuzmin <vkuzmin@mirantis.com>
Date: Wed, 20 May 2020 12:14:04 +0400
Subject: [PATCH 2662/3333] Enable certificate check for glance_store+swift

Disable insecure option for glance_store with
swift backend when tls is enabled.
Specify swift_store_cacert option.

Change-Id: Ia1e8f596c95dd7b6e63cb21a94c8316dc71bf945
---
 lib/glance | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/lib/glance b/lib/glance
index 9398bd2daf..3f72c0b8bc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -212,25 +212,19 @@ function configure_glance {
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift
         iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
-        if python3_enabled; then
-            iniset $GLANCE_API_CONF glance_store swift_store_auth_insecure True
-        fi
 
         iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
         iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+        if is_service_enabled tls-proxy; then
+            iniset $GLANCE_API_CONF glance_store swift_store_cacert $SSL_BUNDLE_FILE
+        fi
         iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        if python3_enabled; then
-            # NOTE(dims): Currently the glance_store+swift does not support either an insecure flag
-            # or ability to specify the CACERT. So fallback to http:// url
-            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address ${KEYSTONE_SERVICE_URI/https/http}/v3
-        else
-            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        fi
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
     fi
 

From 54edc7aeef97df768477b5fa14f8fc45266a9c2e Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 22 May 2020 13:03:15 +0100
Subject: [PATCH 2663/3333] tempest: Increase m1.nano and m1.micro RAM by 64MB
 to avoid tmpfs exhaustion

tmpfs exhaustion has long been suspected as the root issue behind
failures to load ssh keys and other metadata from local config drives as
documented in bug #1808010. This can also lead to failures fetching
metadata from n-metadata-api leaving Tempest unable to SSH into
instances.

This change increases the RAM of the m1.nano and m1.micro flavors by
64MB to hopefully avoid these errors going forward. This is also ahead
of our eventual upgrade to Cirros 0.5.0 where 128MB becomes a
requirement.

Related-Bug: #1808010
Change-Id: I4b597579cf89939955d3c110c0bd58ca05de61f0
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 37b22065b4..05fcb1f1f3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -203,13 +203,13 @@ function configure_tempest {
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
+                openstack flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
+                openstack flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else

From 7f1a8c1c3edb532c1cc69fba74055ba58117b21c Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Tue, 19 May 2020 08:40:52 +0200
Subject: [PATCH 2664/3333] Switch to newer openstackdocstheme version

Switch to openstackdocstheme 2.2.1 version. Using
this version will allow especially:
* Linking from HTML to PDF document
* Allow parallel building of documents
* Fix some rendering problems

Update Sphinx version as well.

Set openstackdocs_pdf_link to link to PDF file. Note that
the link to the published document only works on docs.openstack.org
where the PDF file is placed in the top-level html directory. The
site-preview places the PDF in a pdf directory.

Set openstackdocs_auto_version to not auto-version the documents.

Set openstackdocs_auto_name to use 'project' as name.

openstackdocstheme renames some variables, so follow the renames
before the next release removes them. A couple of variables are also
not needed anymore, remove them.

Change pygments_style to 'native' since old theme version always used
'native' and the theme now respects the setting and using 'sphinx' can
lead to some strange rendering.

See also
http://lists.openstack.org/pipermail/openstack-discuss/2020-May/014971.html

Change-Id: I26887b175b9c1ced7347289b7d5d4f57a20ec36a
---
 doc/requirements.txt |  4 ++--
 doc/source/conf.py   | 14 ++++++++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/doc/requirements.txt b/doc/requirements.txt
index 6ca2d60eaa..ffce3ff74c 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -2,8 +2,8 @@ pbr>=2.0.0,!=2.1.0
 
 Pygments
 docutils
-sphinx>=2.0.0,!=2.1.0
-openstackdocstheme>=2.0.0
+sphinx>=2.0.0,!=2.1.0 # BSD
+openstackdocstheme>=2.2.1 # Apache-2.0
 nwdiag
 blockdiag
 sphinxcontrib-blockdiag
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 56043ba6f7..2e17da17f8 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -30,9 +30,15 @@
                'sphinxcontrib.nwdiag' ]
 
 # openstackdocstheme options
-repository_name = 'openstack-dev/devstack'
-bug_project = 'devstack'
-bug_tag = ''
+openstackdocs_repo_name = 'openstack-dev/devstack'
+openstackdocs_pdf_link = True
+openstackdocs_bug_project = 'devstack'
+openstackdocs_bug_tag = ''
+openstackdocs_auto_name = False
+# This repo is not tagged, so don't set versions
+openstackdocs_auto_version = False
+version = ''
+release = ''
 
 todo_include_todos = True
 
@@ -81,7 +87,7 @@
 show_authors = False
 
 # The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
+pygments_style = 'native'
 
 # A list of ignored prefixes for module index sorting.
 modindex_common_prefix = ['DevStack-doc.']

From e726ecb537ee09187169902f19840ab432eeb5ae Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Thu, 14 May 2020 11:35:03 +0200
Subject: [PATCH 2665/3333] Remove sgabios.bin workaround

The bug has been fixed since a while, also in recent distributions,
for example Ubuntu 20.04, the sgabios.bin ROM is provided directly
by qemu-system-data as an actual file under /usr/share/qemu and
it conflicts with the one provided by sgabios, so removing the
workaround is actually needed to prevent failures.

Change-Id: Ib5f23dbd8839a0927418692054f4ed4abd76babc
---
 lib/nova_plugins/hypervisor-ironic | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 113e2a75ea..b147c4327a 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -68,13 +68,6 @@ function install_nova_hypervisor {
         return
     fi
     install_libvirt
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] && is_ubuntu; then
-        # Ubuntu packaging+apparmor issue prevents libvirt from loading
-        # the ROM from /usr/share/misc.  Workaround by installing it directly
-        # to a directory that it can read from. (LP: #1393548)
-        sudo rm -rf /usr/share/qemu/sgabios.bin
-        sudo cp /usr/share/misc/sgabios.bin /usr/share/qemu/sgabios.bin
-    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From 7a0fa4fd9e5db7253fee0820fc002703d43bca3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20J=C3=B3zefczyk?= <mjozefcz@redhat.com>
Date: Thu, 5 Mar 2020 16:55:50 +0100
Subject: [PATCH 2666/3333] Update cirros image to cirros-0.5.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New cirros with recent fixes for metadata service
has been released. [1]
Let's update the image version in gate.

This also includes a fix to pass image name to SDK tests.

[1] https://github.com/cirros-dev/cirros/pull/11/commits/e40bcd2964aa496a9d03e1aaf95cf7a86938f129

Change-Id: I6ccd646f1c22a99bed0bebf6e363d2190241b667
Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
---
 functions-common | 5 +++++
 stackrc          | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index f50ff56c7d..dea5aa93a8 100644
--- a/functions-common
+++ b/functions-common
@@ -129,6 +129,11 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
+    cat >> $CLOUDS_YAML <<EOF
+functional:
+  image_name: $DEFAULT_IMAGE_NAME
+EOF
+
     # CLean up any old clouds.yaml files we had laying around
     rm -f $(eval echo ~"$STACK_USER")/.config/openstack/clouds.yaml
 }
diff --git a/stackrc b/stackrc
index b189e206e1..f898e8e229 100644
--- a/stackrc
+++ b/stackrc
@@ -676,7 +676,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.4.0"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.5.1"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 5b48e362af72bfc960d64c2a69b005856af47863 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 26 May 2020 16:21:45 -0700
Subject: [PATCH 2667/3333] swift: Fix s3api/keystone interaction

For a long time, swift3 recommended a pipeline like

   ... swift3 s3token authtoken keystoneauth ...

This led to inefficiencies where the proxy would first contact Keystone
to validate the S3 signature and issue a token, then contact Keystone
*again* to validate the token ID that was just issued.

After s3token moved into the swift3 repo, it was improved to be able
to put all of the headers into the WSGI environment that Swift's
keystoneauth middleware expected and the recommended pipeline was
changed to something like

   ... authtoken s3api s3token keystoneauth ...

At the time, the old order would still work, it would just be less
efficient. When support was added for Keystone v3, however, the new
order became mandatory.

All of that happened before swift3 moved back into Swift as s3api, but
the pipeline placement problems are the same: Keystone users won't be
able to use the S3 api with the current order.

Change-Id: Id0659f109cc2fc12ddb371df0b26812ba8c442d9
Related-Change: I21e38884a2aefbb94b76c76deccd815f01db7362
Related-Change: Ic9af387b9192f285f0f486e7171eefb23968007e
---
 lib/swift | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 5be9e3575e..b6c06c57bd 100644
--- a/lib/swift
+++ b/lib/swift
@@ -428,10 +428,11 @@ function configure_swift {
         swift_pipeline+=" s3api"
     fi
     if is_service_enabled keystone; then
+        swift_pipeline+=" authtoken"
         if is_service_enabled s3api;then
             swift_pipeline+=" s3token"
         fi
-        swift_pipeline+=" authtoken keystoneauth"
+        swift_pipeline+=" keystoneauth"
     fi
 
     swift_pipeline+=" tempauth "

From 6681a1f12651d7ee3930051e905d305042c93363 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 26 May 2020 20:11:24 -0700
Subject: [PATCH 2668/3333] swift: Configure s3token appropriately

We need an appropriate auth_uri for s3token to be able to contact
Keystone.

Since tempauth is always enabled, we want to delay the auth decision
until after tempauth has had a chance to try.

Change-Id: Ie4ff33a617b9dc74d51d037ec8ebd0d9787dd76d
---
 lib/swift | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/swift b/lib/swift
index b6c06c57bd..3c121ca6ec 100644
--- a/lib/swift
+++ b/lib/swift
@@ -431,6 +431,8 @@ function configure_swift {
         swift_pipeline+=" authtoken"
         if is_service_enabled s3api;then
             swift_pipeline+=" s3token"
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_AUTH_URI_V3}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
         fi
         swift_pipeline+=" keystoneauth"
     fi

From 65102e772e0fdbd5d3b0ac5eebb3179b461d6db0 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 27 May 2020 14:24:09 +0100
Subject: [PATCH 2669/3333] nova: Remove configuration of '[scheduler] driver'

This option was deprecated in Ussuri [1] as nova no longer provided any
schedulers aside from the filter scheduler and the existence of
third-party schedulers was very unlikely. Stop configuring this and
simply use the default.

[1] https://review.opendev.org/#/c/707225/

Change-Id: Iabdd1d00e00ee269334f0fe0db265a97207e2dc6
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/lib/nova b/lib/nova
index a842a61fd0..4da0462dae 100644
--- a/lib/nova
+++ b/lib/nova
@@ -96,10 +96,6 @@ NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
-# Nova supports pluggable schedulers.  The default ``FilterScheduler``
-# should work in most cases.
-SCHEDULER=${SCHEDULER:-filter_scheduler}
-
 # The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
 NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
@@ -398,11 +394,8 @@ function create_nova_conf {
     fi
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
-    iniset $NOVA_CONF scheduler driver "$SCHEDULER"
     iniset $NOVA_CONF filter_scheduler enabled_filters "$NOVA_FILTERS"
-    if [[ $SCHEDULER == "filter_scheduler" ]]; then
-        iniset $NOVA_CONF scheduler workers "$API_WORKERS"
-    fi
+    iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"

From 90c6c65987341c4f21595439be0afbc314067a3c Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 29 May 2020 06:06:08 +0000
Subject: [PATCH 2670/3333] Updated from generate-devstack-plugins-list

Change-Id: I77d03c088a6b5019ac69048becfff3f24573a0b3
---
 doc/source/plugin-registry.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 42c5fc1324..05a19ac4fc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -31,7 +31,6 @@ openstack/ceilometer                     `https://opendev.org/openstack/ceilomet
 openstack/ceilometer-powervm             `https://opendev.org/openstack/ceilometer-powervm <https://opendev.org/openstack/ceilometer-powervm>`__
 openstack/cinderlib                      `https://opendev.org/openstack/cinderlib <https://opendev.org/openstack/cinderlib>`__
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
-openstack/congress                       `https://opendev.org/openstack/congress <https://opendev.org/openstack/congress>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
 openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
@@ -84,7 +83,6 @@ openstack/networking-l2gw                `https://opendev.org/openstack/networki
 openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
 openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
 openstack/networking-onos                `https://opendev.org/openstack/networking-onos <https://opendev.org/openstack/networking-onos>`__
-openstack/networking-ovn                 `https://opendev.org/openstack/networking-ovn <https://opendev.org/openstack/networking-ovn>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__

From de41a18909a98b695642d0c4abc24d3d755cd8ff Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Fri, 29 May 2020 07:23:48 +0000
Subject: [PATCH 2671/3333] Update distros on the docs start page

Centos 7 is no longer supported, replace with Centos 8. Also Debian
hasn't been working for some time and progress in fixing it has stalled,
so drop it for now.

Change-Id: Ic1513b20f296978bca095c7aa79f022d7d9ab7ac
Closes-Bug: 1881183
---
 doc/source/index.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 7923cb88c7..8b8acde38c 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,8 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 7, as well as Debian and
-OpenSUSE.
+latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
 
 If you do not have a preference, Ubuntu 18.04 (Bionic Beaver) is the
 most tested, and will probably go the smoothest.

From 312517d5101206b33d3c395d27ec93d385b7fd24 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 22 Jun 2018 22:23:29 +1000
Subject: [PATCH 2672/3333] Use uwsgi binary from path

All these uwsgi invocations assume that the uwsgi binary is in the
same directory as their project binaries are installed into (probably
/usr/bin).  That may not be correct -- for example if using a packaged
uwsgi on Fedora the binary will live in /usr/sbin/uwsgi (not /usr/bin
where the project files from pip are).

Switch invocations to just find it in the path.

Change-Id: I298e3374e9c84e209ffcabbaaacda17f8df19f4f
---
 lib/cinder         | 2 +-
 lib/glance         | 2 +-
 lib/keystone       | 2 +-
 lib/neutron        | 2 +-
 lib/neutron-legacy | 2 +-
 lib/nova           | 4 ++--
 lib/placement      | 2 +-
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index fd960535d9..c2e55f9173 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -492,7 +492,7 @@ function start_cinder {
                 start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
             fi
         else
-            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
+            run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
             cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
         fi
     fi
diff --git a/lib/glance b/lib/glance
index 9398bd2daf..8ee422df43 100644
--- a/lib/glance
+++ b/lib/glance
@@ -392,7 +392,7 @@ function start_glance {
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process g-api "$GLANCE_BIN_DIR/uwsgi --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
+        run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
     fi
diff --git a/lib/keystone b/lib/keystone
index 366e6c7054..d2f72a37fe 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -523,7 +523,7 @@ function start_keystone {
         enable_apache_site keystone
         restart_apache_server
     else # uwsgi
-        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
+        run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."
diff --git a/lib/neutron b/lib/neutron
index 9e6a80cf08..885df97f7c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -463,7 +463,7 @@ function start_neutron_api {
     done
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/networking/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3d39d41b7e..4ddc05f2fe 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -477,7 +477,7 @@ function start_neutron_service_and_check {
     # Start the Neutron service
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         enable_service neutron-api
-        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/networking/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
diff --git a/lib/nova b/lib/nova
index a842a61fd0..c7ffe7f4b3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -864,7 +864,7 @@ function start_nova_api {
             start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
         fi
     else
-        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
+        run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
         nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
     fi
 
@@ -955,7 +955,7 @@ function start_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
         run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
     else
-        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
+        run_process n-api-meta "$(which uwsgi) --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
     export PATH=$old_path
diff --git a/lib/placement b/lib/placement
index 785b0ddfca..2a449bfa90 100644
--- a/lib/placement
+++ b/lib/placement
@@ -144,7 +144,7 @@ function install_placement {
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
+        run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
     else
         enable_apache_site placement-api
         restart_apache_server

From 076c9f1b4bf405994f311aaf4aba3ab179f178e3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 May 2018 16:13:38 +1000
Subject: [PATCH 2673/3333] Don't install uwsgi for keystone

This is already unconditionally installed via install_apache_uwsgi in
stack.sh; we don't need to install it again in keystone.  Since we
need workarounds on some platforms (see
I3bc5260e77cebe852cc8d70d9eddf84ef71d74bb) we only want to do this in
one place.

Change-Id: I40d84cbdf68cf6bb5cba143b6c0c126cdb8a84d4
---
 lib/keystone | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index d2f72a37fe..1910f348b7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -504,8 +504,6 @@ function install_keystone {
 
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         install_apache_wsgi
-    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
-        pip_install uwsgi
     fi
 }
 

From 4f2a6171056f9dc3adaaf6752f559bd95a586428 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20Beraud?= <hberaud@redhat.com>
Date: Tue, 2 Jun 2020 20:10:56 +0200
Subject: [PATCH 2674/3333] Stop to use the __future__ module.

The __future__ module [1] was used in this context to ensure compatibility
between python 2 and python 3.

We previously dropped the support of python 2.7 [2] and now we only support
python 3 so we don't need to continue to use this module and the imports
listed below.

Imports commonly used and their related PEPs:
- `division` is related to PEP 238 [3]
- `print_function` is related to PEP 3105 [4]
- `unicode_literals` is related to PEP 3112 [5]
- `with_statement` is related to PEP 343 [6]
- `absolute_import` is related to PEP 328 [7]

[1] https://docs.python.org/3/library/__future__.html
[2] https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html
[3] https://www.python.org/dev/peps/pep-0238
[4] https://www.python.org/dev/peps/pep-3105
[5] https://www.python.org/dev/peps/pep-3112
[6] https://www.python.org/dev/peps/pep-0343
[7] https://www.python.org/dev/peps/pep-0328

Change-Id: Icf8bd00b271f44b6bb0c932d6d49fe6de8a22537
---
 tools/worlddump.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 0a4df52337..6a618f5ee6 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -17,8 +17,6 @@
 
 """Dump the state of the world for post mortem."""
 
-from __future__ import print_function
-
 import argparse
 import datetime
 from distutils import spawn

From c3db92b9d74704f5bf171a50103f5735e411222b Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Thu, 4 Jun 2020 23:57:18 +0900
Subject: [PATCH 2675/3333] Doc: g-reg is no longer required

The glance-registry service was deprecated in Queeens release, and
no longer required.

Change-Id: I0d2b4604cd39d5131410b8038f92057128ca7b75
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 669a70d0bb..7fde6f14f8 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -62,7 +62,7 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance
-    ENABLED_SERVICES+=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api
     # Neutron
     ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta,neutron
     ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api

From c3b58f5335fb3545bf49b5d542ef9ed702de43c8 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 8 Jun 2020 11:58:29 +0200
Subject: [PATCH 2676/3333] Fix typos in networking document

The FLOATING_RANGE variable should specify the network address of the
used prefix for clarity.

Change-Id: I547bd42d8bdc5f0f2001d47f2d5b43729773b1bc
Closes-Bug: 1870204
---
 doc/source/networking.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 74010cd01a..e65c7ef195 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -40,7 +40,7 @@ updates. Tempest tests will work in this environment.
 Locally Accessible Guests
 =========================
 
-If you want to make you guests accessible from other machines on your
+If you want to make your guests accessible from other machines on your
 network, we have to connect ``br-ex`` to a physical interface.
 
 Dedicated Guest Interface
@@ -81,7 +81,7 @@ of addresses, and have them all exactly correct.
    [[local|localrc]]
    PUBLIC_INTERFACE=eth0
    HOST_IP=10.42.0.52
-   FLOATING_RANGE=10.42.0.52/24
+   FLOATING_RANGE=10.42.0.0/24
    PUBLIC_NETWORK_GATEWAY=10.42.0.1
    Q_FLOATING_ALLOCATION_POOL=start=10.42.0.250,end=10.42.0.254
 

From 729546a1adfa10c8591e834cc85004d977e1c3dd Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Thu, 12 Mar 2020 10:03:38 +0000
Subject: [PATCH 2677/3333] Remove tempest deprecated img_dir option

Tempest option scenario.img_dir has been deprecated more than 4 years, it's
time to remove it from devstack.
img_file option should contain the full path to the image.
This patch removes setting of img_dir option and makes img_file
one contain the full path of an image.

Change-Id: I71102095f3603915f0bc7d21f2e18c4eac4e95ec
Depends-On: https://review.opendev.org/#/c/710996/
Related-Bug: #1393881
---
 lib/tempest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 05fcb1f1f3..0d6bdc9dbc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -433,8 +433,7 @@ function configure_tempest {
         SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
         SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
     fi
-    iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
-    iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
+    iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_DIR/$SCENARIO_IMAGE_FILE
 
     # If using provider networking, use the physical network for validation rather than private
     TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME

From 84737ebd96327310ec5f8f7c312aeae12cbeb234 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 15 Jun 2020 09:48:46 +0200
Subject: [PATCH 2678/3333] Work around uwsgi breakage

uwsgi broke installation from source with their latest release [0].
Since we want to move away from source installation anyway, make
grenade based jobs non-voting for the moment so that we can backport
[1] properly.

[0] https://bugs.launchpad.net/bugs/1883468
[1] https://review.opendev.org/577955

Related-Bug: 1883468
Change-Id: I8e47bb7c70031a4df7f1af6b811df4c6cc784b2a
---
 .zuul.yaml | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 602975a165..0dc5f3e09d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -628,10 +628,12 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -668,18 +670,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - neutron-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - neutron-grenade-multinode:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - grenade:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$

From 2d903568ed4158aa668bbda6986307a8780c71a4 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 May 2018 10:51:30 +1000
Subject: [PATCH 2679/3333] Use packaged uwsgi on Fedora and Ubuntu

Building uwsgi from source was a workaround that was introduced a long
time ago, it doesn't seem like it is needed anymore and will actually
fail for Ubuntu 20.04.

Also it doesn't match what will happen for most real-world
installations, so let's try to get back to using distro packages. We'll
still use the source install for RHEL/Centos, it remains to be tested
whether we can get back to using distro versions there, too.

Change-Id: I82f539bfa533349293dd5a8ce309c9cc0ffb0393
---
 lib/apache | 68 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 47 insertions(+), 21 deletions(-)

diff --git a/lib/apache b/lib/apache
index 84cec73234..a31188bebb 100644
--- a/lib/apache
+++ b/lib/apache
@@ -82,26 +82,52 @@ function install_apache_uwsgi {
         apxs="apxs"
     fi
 
-    # Ubuntu xenial is back level on uwsgi so the proxy doesn't
-    # actually work. Hence we have to build from source for now.
+    # This varies based on packaged/installed.  If we've
+    # pip_installed, then the pip setup will only build a "python"
+    # module that will be either python2 or python3 depending on what
+    # it was built with.
     #
-    # Centos 7 actually has the module in epel, but there was a big
-    # push to disable epel by default. As such, compile from source
-    # there as well.
-
-    local dir
-    dir=$(mktemp -d)
-    pushd $dir
-    pip_install uwsgi
-    pip download uwsgi -c $REQUIREMENTS_DIR/upper-constraints.txt
-    local uwsgi
-    uwsgi=$(ls uwsgi*)
-    tar xvf $uwsgi
-    cd uwsgi*/apache2
-    sudo $apxs -i -c mod_proxy_uwsgi.c
-    popd
-    # delete the temp directory
-    sudo rm -rf $dir
+    # For package installs, the distro ships both plugins and you need
+    # to select the right one ... it will not be autodetected.
+    if python3_enabled; then
+        UWSGI_PYTHON_PLUGIN=python3
+    else
+        UWSGI_PYTHON_PLUGIN=python
+    fi
+
+    if is_ubuntu; then
+        install_package uwsgi \
+                        uwsgi-plugin-python \
+                        uwsgi-plugin-python3 \
+                        libapache2-mod-proxy-uwsgi
+    elif [[ $os_VENDOR == "Fedora" ]]; then
+        # Note httpd comes with mod_proxy_uwsgi and it is loaded by
+        # default; the mod_proxy_uwsgi package actually conflicts now.
+        # See:
+        #  https://bugzilla.redhat.com/show_bug.cgi?id=1574335
+        #
+        # Thus there is nothing else to do after this install
+        install_package uwsgi \
+                        uwsgi-plugin-python3
+    else
+        # Centos actually has the module in epel, but there was a big
+        # push to disable epel by default. As such, compile from source
+        # there.
+        local dir
+        dir=$(mktemp -d)
+        pushd $dir
+        pip_install uwsgi
+        pip download uwsgi -c $REQUIREMENTS_DIR/upper-constraints.txt
+        local uwsgi
+        uwsgi=$(ls uwsgi*)
+        tar xvf $uwsgi
+        cd uwsgi*/apache2
+        sudo $apxs -i -c mod_proxy_uwsgi.c
+        popd
+        # delete the temp directory
+        sudo rm -rf $dir
+        UWSGI_PYTHON_PLUGIN=python
+    fi
 
     if is_ubuntu || is_suse ; then
         # we've got to enable proxy and proxy_uwsgi for this to work
@@ -265,7 +291,7 @@ function write_uwsgi_config {
     # configured after graceful shutdown
     iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins python
+    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
@@ -318,7 +344,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi die-on-term true
     iniset "$file" uwsgi exit-on-reload false
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins python
+    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM

From a267c5f477d4b037a9f466305db8c8b93e105204 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 15 Jun 2020 09:53:27 +0200
Subject: [PATCH 2680/3333] Revert "Work around uwsgi breakage"

This reverts commit 84737ebd96327310ec5f8f7c312aeae12cbeb234.

Change-Id: I1544c1ad9cfe3ff199153736acadba0761b51fc4
---
 .zuul.yaml | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0dc5f3e09d..602975a165 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -628,12 +628,10 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -670,18 +668,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        # - neutron-grenade-multinode:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        # - grenade:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$

From 10c3ffd26557f1921841e456b003a77f6fb11948 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 15 Jun 2020 10:03:42 +0200
Subject: [PATCH 2681/3333] Handle uwsgi install for openSUSE

Add packages for openSUSE distribution for installation of uwsgi.

Change-Id: I2ce8959460a79b6472bd9dd59edd7d94eccbacf5
---
 lib/apache | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/apache b/lib/apache
index a31188bebb..41c2e3d8dd 100644
--- a/lib/apache
+++ b/lib/apache
@@ -109,6 +109,10 @@ function install_apache_uwsgi {
         # Thus there is nothing else to do after this install
         install_package uwsgi \
                         uwsgi-plugin-python3
+    elif [[ $os_VENDOR =~ openSUSE ]]; then
+        install_package uwsgi \
+                        uwsgi-python3 \
+                        apache2-mod_uwsgi
     else
         # Centos actually has the module in epel, but there was a big
         # push to disable epel by default. As such, compile from source

From 66c812d392a922a5b76780a515b0a065b6fa7cdf Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 16 Jun 2020 12:13:45 +0200
Subject: [PATCH 2682/3333] Remove neutron-fwaas from the jobs' required
 project

Neutron-fwaas is going to be deprecated in master branch with [1].

[1] https://review.opendev.org/#/c/735828/

Change-Id: I513ef36e681fc3f9e5aa9f81c9aedba716366729
---
 doc/source/plugin-registry.rst | 2 --
 stackrc                        | 4 ----
 2 files changed, 6 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 05a19ac4fc..3ab4db43ea 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -87,8 +87,6 @@ openstack/networking-powervm             `https://opendev.org/openstack/networki
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
-openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__
-openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
diff --git a/stackrc b/stackrc
index 07c4c4b472..e323cee843 100644
--- a/stackrc
+++ b/stackrc
@@ -281,10 +281,6 @@ KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-$TARGET_BRANCH}
 NEUTRON_REPO=${NEUTRON_REPO:-${GIT_BASE}/openstack/neutron.git}
 NEUTRON_BRANCH=${NEUTRON_BRANCH:-$TARGET_BRANCH}
 
-# neutron fwaas service
-NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
-NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-$TARGET_BRANCH}
-
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-$TARGET_BRANCH}

From 0ae5787611897a81d894d0f53b1ed63c452fe5ee Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 17 Feb 2020 06:11:15 +0000
Subject: [PATCH 2683/3333] Remove glance registry configuration

Glance has deprecated registry serivce for long and now efforts are placed to
remove the registry code from the glance repo.

To avoid regression on other projects, gate jobs etc. removing
configuring registry service from the devstack.

Change-Id: I6a7be6bdc97acc43c8e985060aeea05d92642e80
---
 lib/glance | 40 +---------------------------------------
 1 file changed, 1 insertion(+), 39 deletions(-)

diff --git a/lib/glance b/lib/glance
index 8ee422df43..fee2cfd80f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -67,9 +67,7 @@ GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_s
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
-GLANCE_REGISTRY_CONF=$GLANCE_CONF_DIR/glance-registry.conf
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
-GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
@@ -88,8 +86,6 @@ GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
-GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
@@ -135,31 +131,10 @@ function cleanup_glance {
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
-    # Set non-default configuration options for registry
-    iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-    iniset $GLANCE_REGISTRY_CONF DEFAULT workers $API_WORKERS
+    # Set non-default configuration options for the API server
     local dburl
     dburl=`database_connection_url glance`
-    iniset $GLANCE_REGISTRY_CONF database connection $dburl
-    iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
-    iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_keystone_authtoken_middleware $GLANCE_REGISTRY_CONF glance
-    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
-    iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
-    iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-    # Configure multiple stores
-    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
-        local store enabled_backends
-        enabled_backends=""
-        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
-            enabled_backends+="${store}:file,"
-        done
-        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
-    fi
 
-    # Set non-default configuration options for the API server
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -198,7 +173,6 @@ function configure_glance {
         # Store specific configs
         iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     fi
-    iniset $GLANCE_API_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
@@ -240,21 +214,13 @@ function configure_glance {
 
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-        iniset $GLANCE_REGISTRY_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-    fi
-
-    if is_service_enabled tls-proxy; then
-        iniset $GLANCE_API_CONF DEFAULT registry_client_protocol https
     fi
 
     # Format logging
     setup_logging $GLANCE_API_CONF
-    setup_logging $GLANCE_REGISTRY_CONF
 
-    cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     # Set non-default configuration options for the glance-cache
@@ -265,7 +231,6 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
-    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
@@ -387,10 +352,8 @@ function start_glance {
         if [[ "$WSGI_MODE" != "uwsgi" ]]; then
             start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
         fi
-        start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
-    run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
@@ -406,7 +369,6 @@ function start_glance {
 # stop_glance() - Stop running processes
 function stop_glance {
     stop_process g-api
-    stop_process g-reg
 }
 
 # Restore xtrace

From 744f50b970bf10f06e9d52de0b57d74ddcb18467 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 16 Jun 2020 22:28:28 +0200
Subject: [PATCH 2684/3333] Add neutron-ovn-tempest-ovs-release job to the
 check queue

During the Victoria cycle we plan to switch default Neutron backend in
Devstack from OVS to OVN.
As first step before we will start discussion about this change with
whole community, we want to add tempest ovn based neutron job to
the devstack check queue so that we can keep verifying that with
devstack changes.

Change-Id: I8484baa7398b28ed5ef62f86b55022c7d8703f56
---
 .zuul.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c18e7155d..e30bf22ff5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -632,6 +632,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - neutron-ovn-tempest-ovs-release:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - tempest-multinode-full-py3:
             voting: false
             irrelevant-files:

From c2c2b6b415a4289ab740e7506f68e820ecbc5818 Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Mon, 15 Jun 2020 12:48:38 +0200
Subject: [PATCH 2685/3333] Handle uwsgi install for CentOS/RHEL

Change-Id: Ifa876b3e5f89258f40055fa7ce03f5e9c601771c
---
 lib/apache | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/apache b/lib/apache
index 41c2e3d8dd..a3e9f95d4e 100644
--- a/lib/apache
+++ b/lib/apache
@@ -100,7 +100,7 @@ function install_apache_uwsgi {
                         uwsgi-plugin-python \
                         uwsgi-plugin-python3 \
                         libapache2-mod-proxy-uwsgi
-    elif [[ $os_VENDOR == "Fedora" ]]; then
+    elif is_fedora; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
@@ -114,9 +114,7 @@ function install_apache_uwsgi {
                         uwsgi-python3 \
                         apache2-mod_uwsgi
     else
-        # Centos actually has the module in epel, but there was a big
-        # push to disable epel by default. As such, compile from source
-        # there.
+        # Compile uwsgi from source.
         local dir
         dir=$(mktemp -d)
         pushd $dir

From 264d2a2e5fecd7ae94a4a71087ca93ea9cc25109 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 19 Jun 2020 10:31:38 -0500
Subject: [PATCH 2686/3333] Move process-stackviz role from Tempest to Devstack

process-stackviz role currently defined in Tempest repo[1] and used
in tempest jobs. Issue with having it in branchless Tempest is that any
fix in that role cannot be backported to older Tempest. Also stackviz is
not Tempest things it is only used by Tempest jobs.

Stackviz can be considered as a service similar to Tempest so inatlling it in
Devstack side make sense. Also that will give us advantage to handle the
branch specific fixes or backpoting the fixes.

This can solve the current issues we are facing on rocky branch
- https://zuul.opendev.org/t/openstack/build/c1e2da80537448bfb24331fb4198a931/console#4/0/29/controller

[1] https://opendev.org/openstack/tempest/src/branch/master/roles/process-stackviz

Change-Id: I0ba1fd05c6391cd8bb978119ecfbb891def2d497
---
 roles/process-stackviz/README.rst         | 22 +++++++
 roles/process-stackviz/defaults/main.yaml |  3 +
 roles/process-stackviz/tasks/main.yaml    | 70 +++++++++++++++++++++++
 3 files changed, 95 insertions(+)
 create mode 100644 roles/process-stackviz/README.rst
 create mode 100644 roles/process-stackviz/defaults/main.yaml
 create mode 100644 roles/process-stackviz/tasks/main.yaml

diff --git a/roles/process-stackviz/README.rst b/roles/process-stackviz/README.rst
new file mode 100644
index 0000000000..a8447d2355
--- /dev/null
+++ b/roles/process-stackviz/README.rst
@@ -0,0 +1,22 @@
+Generate stackviz report.
+
+Generate stackviz report using subunit and dstat data, using
+the stackviz archive embedded in test images.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: stage_dir
+   :default: "{{ ansible_user_dir }}"
+
+   The stage directory where the input data can be found and
+   the output will be produced.
+
+.. zuul:rolevar:: zuul_work_dir
+   :default: {{ devstack_base_dir }}/tempest
+
+   Directory to work in. It has to be a fully qualified path.
diff --git a/roles/process-stackviz/defaults/main.yaml b/roles/process-stackviz/defaults/main.yaml
new file mode 100644
index 0000000000..f3bc32b149
--- /dev/null
+++ b/roles/process-stackviz/defaults/main.yaml
@@ -0,0 +1,3 @@
+devstack_base_dir: /opt/stack
+stage_dir: "{{ ansible_user_dir }}"
+zuul_work_dir: "{{ devstack_base_dir }}/tempest"
diff --git a/roles/process-stackviz/tasks/main.yaml b/roles/process-stackviz/tasks/main.yaml
new file mode 100644
index 0000000000..c51c66cdb3
--- /dev/null
+++ b/roles/process-stackviz/tasks/main.yaml
@@ -0,0 +1,70 @@
+- name: Devstack checks if stackviz archive exists
+  stat:
+    path: "/opt/cache/files/stackviz-latest.tar.gz"
+  register: stackviz_archive
+
+- debug:
+    msg: "Stackviz archive could not be found in /opt/cache/files/stackviz-latest.tar.gz"
+  when: not stackviz_archive.stat.exists
+
+- name: Check if subunit data exists
+  stat:
+    path: "{{ zuul_work_dir }}/testrepository.subunit"
+  register: subunit_input
+
+- debug:
+    msg: "Subunit file could not be found at {{ zuul_work_dir }}/testrepository.subunit"
+  when: not subunit_input.stat.exists
+
+- name: Install stackviz
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+  block:
+    - include_role:
+        name: ensure-pip
+
+    - pip:
+        name: "file://{{ stackviz_archive.stat.path }}"
+        virtualenv: /tmp/stackviz
+        virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
+        extra_args: -U
+
+- name: Deploy stackviz static html+js
+  command: cp -pR /tmp/stackviz/share/stackviz-html {{ stage_dir }}/stackviz
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+
+- name: Check if dstat data exists
+  stat:
+    path: "{{ devstack_base_dir }}/logs/dstat-csv.log"
+  register: dstat_input
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+
+- name: Run stackviz with dstat
+  shell: |
+    cat {{ subunit_input.stat.path }} | \
+      /tmp/stackviz/bin/stackviz-export \
+        --dstat "{{ devstack_base_dir }}/logs/dstat-csv.log" \
+        --env --stdin \
+        {{ stage_dir }}/stackviz/data
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+    - dstat_input.stat.exists
+  failed_when: False
+
+- name: Run stackviz without dstat
+  shell: |
+    cat {{ subunit_input.stat.path }} | \
+      /tmp/stackviz/bin/stackviz-export \
+        --env --stdin \
+        {{ stage_dir }}/stackviz/data
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+    - not dstat_input.stat.exists
+  failed_when: False

From f1ed7c77c50ac28cb58c9f7ed885c6a3e0a75403 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 11 Jun 2020 05:51:26 +0000
Subject: [PATCH 2687/3333] Use python3 pip module instead of pip binary

Focal only provides a pip3 binary, no pip3.8. Instead of working around
that with a symlink, use the module instead.

Add version information output for this variant.

Change-Id: I7af194ecc40e4d43c10ce067a661bb6ab4ca37d4
---
 files/debs/general   |  1 +
 files/rpms/general   |  1 +
 inc/python           |  4 ++--
 tools/install_pip.sh | 17 +++++++++++------
 4 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 2d8cd80473..4bf1ff4039 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,6 +27,7 @@ openssl
 pkg-config
 psmisc
 python3-dev
+python3-pip
 python3-venv
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 303510cbd9..c42ce529e7 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -24,6 +24,7 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 python3-devel
+python3-pip
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
 tar
diff --git a/inc/python b/inc/python
index dd77296049..08f9959d5c 100644
--- a/inc/python
+++ b/inc/python
@@ -174,7 +174,7 @@ function pip_install {
         if python3_enabled; then
             echo "Using python $PYTHON3_VERSION to install $package_dir because python3_enabled=True"
             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+            cmd_pip="python$PYTHON3_VERSION -m pip"
         else
             echo "Using python $PYTHON2_VERSION to install $package_dir because python3_enabled=False"
             cmd_pip=$(get_pip_command $PYTHON2_VERSION)
@@ -217,7 +217,7 @@ function pip_uninstall {
         local sudo_pip="sudo -H"
         if python3_enabled; then
             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+            cmd_pip="python$PYTHON3_VERSION -m pip"
         else
             cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         fi
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 5eb538ce84..517669e282 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -5,7 +5,7 @@
 # Update pip and friends to a known common version
 
 # Assumptions:
-# - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
+# - PYTHON3_VERSION refers to a version already installed
 
 set -o errexit
 
@@ -53,6 +53,8 @@ function get_versions {
     else
         echo "pip: Not Installed"
     fi
+    # Show python3 module version
+    python${PYTHON3_VERSION} -m pip --version
 }
 
 
@@ -125,7 +127,14 @@ function configure_pypi_alternative_url {
 # Show starting versions
 get_versions
 
-# Do pip
+if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
+    configure_pypi_alternative_url
+fi
+
+# Just use system pkgs on Focal
+if [[ "$DISTRO" == focal ]]; then
+    exit 0
+fi
 
 # Eradicate any and all system packages
 
@@ -143,10 +152,6 @@ fi
 
 install_get_pip
 
-if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
-    configure_pypi_alternative_url
-fi
-
 set -x
 
 # Note setuptools is part of requirements.txt and we want to make sure

From 3480093b937b45e05f12d2af9df26d076f05067e Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Thu, 13 Feb 2020 09:38:35 +0000
Subject: [PATCH 2688/3333] Make devstack run on focal (Ubuntu LTS 20.04)

- Add a nodeset and a platform job
- Drop uwsgi-py2 pkg that no longer exists
- Blacklist tests that are currently failing

Change-Id: Ib4416dc2f5e003fd770f5240a8f78213c56af8e6
---
 .zuul.yaml | 19 +++++++++++++++++++
 lib/apache |  9 +++++----
 stack.sh   |  2 +-
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f3610afba0..5cb99ab6b6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-focal
+    nodes:
+      - name: controller
+        label: ubuntu-focal
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-single-node-bionic
     nodes:
@@ -512,6 +522,14 @@
     parent: tempest-full-py3
     description: openSUSE 15.x platform test
     nodeset: devstack-single-node-opensuse-15
+
+- job:
+    name: devstack-platform-focal
+    parent: tempest-full-py3
+    description: Ubuntu Focal Fossa platform test
+    nodeset: openstack-single-node-focal
+    vars:
+      tempest_black_regex: "(tempest.api.compute.volumes.test_attach_volume.AttachVolumeMultiAttachTest.test_resize_server_with_multiattached_volume|tempest.api.compute.servers.test_server_rescue_negative.ServerRescueNegativeTestJSON|tempest.api.compute.servers.test_server_rescue.ServerStableDeviceRescueTest.test_stable_device_rescue_disk_virtio_with_volume_attached)"
     voting: false
 
 - job:
@@ -605,6 +623,7 @@
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
+        - devstack-platform-focal
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/lib/apache b/lib/apache
index a3e9f95d4e..a5fbf75374 100644
--- a/lib/apache
+++ b/lib/apache
@@ -96,10 +96,11 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        install_package uwsgi \
-                        uwsgi-plugin-python \
-                        uwsgi-plugin-python3 \
-                        libapache2-mod-proxy-uwsgi
+        local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
+        if "$DISTRO" == 'bionic'; then
+            pkg_list="${pkg_list} uwsgi-plugin-python"
+        fi
+        install_package ${pkg_list}
     elif is_fedora; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
diff --git a/stack.sh b/stack.sh
index 80c6d4dd39..fa27743bb3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From cd57449c9f5d8f0ecac59da359108fdba80a31f7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 23 Jun 2020 08:08:13 +0200
Subject: [PATCH 2689/3333] Stop claiming to support Debian distros

We haven't had a working job for stretch or jessie in years, attempts
to get things fixed have been dropped, set let's be honest and drop
those from our support list.

Change-Id: Ia6152be79f8044f7ff039ec0911ad4938d6271f4
---
 files/debs/nova | 1 -
 stack.sh        | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/files/debs/nova b/files/debs/nova
index dce8f6ac89..a7aebbf946 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -17,7 +17,6 @@ mysql-server # NOPRIME
 parted
 pm-utils
 python3-mysqldb
-qemu # dist:wheezy,jessie NOPRIME
 qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 socat # used by ajaxterm
diff --git a/stack.sh b/stack.sh
index fa27743bb3..709b97b0ef 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 8b099c408b995ed65323a8cb58437b25cf374d5e Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Tue, 23 Jun 2020 10:30:20 -0500
Subject: [PATCH 2690/3333] Remove dragonflow reference

Dragonflow was retired in 2018 and is now being retired. This removes a
documentation reference to it.

Change-Id: I24ab79482306a7c816b5242a981f1b508ff8f6ec
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 3ab4db43ea..eda5773a25 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -41,7 +41,6 @@ openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
 openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
 openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
-openstack/dragonflow                     `https://opendev.org/openstack/dragonflow <https://opendev.org/openstack/dragonflow>`__
 openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__

From ca486c5259277db72c73c661ef3e9620a3b65d49 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 25 Jun 2020 18:22:28 +0000
Subject: [PATCH 2691/3333] Provide integer number to arping "-w" parameter

Some arping versions only accept an integer number for the
"deadline" (-w) parameter.

Change-Id: Ie21c9b5820262d049c0fcd8147d85cc110d88272
Closes-Bug: #1885169
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index bb1536aa9c..275dbf17e5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -622,7 +622,7 @@ function _move_neutron_addresses_route {
             IP_UP="sudo ip link set $to_intf up"
             if [[ "$af" == "inet" ]]; then
                 IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-                ARP_CMD="sudo arping -A -c 3 -w 4.5 -I $to_intf $IP "
+                ARP_CMD="sudo arping -A -c 3 -w 5 -I $to_intf $IP "
             fi
         fi
 

From 02da0c40f9511d0f52964e35145819bf9fc1eeff Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 25 Jun 2020 20:03:22 -0500
Subject: [PATCH 2692/3333] Add focal nodeset

This commit adds the focal nodeset for
multinode so that those can be used for
projects side jobs or testing.

We need to define these as first step to avoid
any conflict on nodeset name if project started
defining these.
Example: three node focal nodeset is already
defined in x/tobiko, fixing the same in depends on.
-I30a6bb63269f031a74f9bff6c765d59d91088797

Depends-On: https://review.opendev.org/#/c/738128/

Change-Id: I5ce49f7a7d52d00555c14b08864bc8975956b20c
Story: #2007865
Task: #40212
---
 .zuul.yaml | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5cb99ab6b6..f78f3f54c7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -108,6 +108,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-focal
+    nodes:
+      - name: controller
+        label: ubuntu-focal
+      - name: compute1
+        label: ubuntu-focal
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-bionic
     nodes:
@@ -168,6 +198,41 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-three-node-focal
+    nodes:
+      - name: controller
+        label: ubuntu-focal
+      - name: compute1
+        label: ubuntu-focal
+      - name: compute2
+        label: ubuntu-focal
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+          - compute2
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+          - compute2
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+          - compute2
+
 - nodeset:
     name: openstack-three-node-bionic
     nodes:

From 32c00890ed5f296ccb829196accfb437dbed8f6f Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 10 Apr 2019 10:33:39 +0000
Subject: [PATCH 2693/3333] Prepare for dropping keystone admin endpoint

Keystone no longer has any special functionality hidden behind the admin
endpoint. Stop referencing it in consumers, so it can later be dropped
completely.

Change-Id: I04a5d77908005268cc7c59e7e9ddeea70f6732e2
---
 functions-common                   | 2 +-
 lib/glance                         | 5 ++---
 lib/keystone                       | 4 ++--
 lib/neutron-legacy                 | 2 +-
 lib/nova_plugins/hypervisor-ironic | 2 +-
 lib/swift                          | 2 +-
 openrc                             | 4 ++--
 stack.sh                           | 2 +-
 8 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/functions-common b/functions-common
index dea5aa93a8..6595c3de53 100644
--- a/functions-common
+++ b/functions-common
@@ -47,7 +47,7 @@ KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
-    KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
+    KEYSTONE_SERVICE_URI \
     LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
     HOST_IPV6 SERVICE_IP_VERSION"
 
diff --git a/lib/glance b/lib/glance
index 4fa1b6a4e3..6d252e317c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -208,8 +208,7 @@ function configure_glance {
 
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-
-        iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+        iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_SERVICE_URI
     fi
 
     # Format logging
@@ -221,7 +220,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
diff --git a/lib/keystone b/lib/keystone
index 1910f348b7..d4c7b063bb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -115,7 +115,7 @@ KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/ide
 KEYSTONE_AUTH_URI=$KEYSTONE_SERVICE_URI
 
 # V3 URIs
-KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
+KEYSTONE_AUTH_URI_V3=$KEYSTONE_SERVICE_URI/v3
 KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 
 # Security compliance
@@ -413,6 +413,7 @@ function configure_keystone_authtoken_middleware {
     local section=${3:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
+    iniset $conf_file $section interface public
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
@@ -561,7 +562,6 @@ function stop_keystone {
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
 # - ``IDENTITY_API_VERSION``
-# - ``KEYSTONE_AUTH_URI``
 # - ``REGION_NAME``
 # - ``KEYSTONE_SERVICE_PROTOCOL``
 # - ``KEYSTONE_SERVICE_HOST``
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index bb1536aa9c..5e4251f9f6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -372,7 +372,7 @@ function configure_mutnauq {
 function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
-    iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"
+    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
     iniset $conf neutron username "$Q_ADMIN_USERNAME"
     iniset $conf neutron password "$SERVICE_PASSWORD"
     iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index b147c4327a..bda6ef6998 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -46,7 +46,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin
     iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_SERVICE_URI
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
diff --git a/lib/swift b/lib/swift
index 3c121ca6ec..a981dfc10a 100644
--- a/lib/swift
+++ b/lib/swift
@@ -527,7 +527,7 @@ function configure_swift {
         else
             iniset ${testfile} func_test auth_port 80
         fi
-        iniset ${testfile} func_test auth_uri ${KEYSTONE_AUTH_URI}
+        iniset ${testfile} func_test auth_uri ${KEYSTONE_SERVICE_URI}
         if [[ "$auth_vers" == "3" ]]; then
             iniset ${testfile} func_test auth_prefix /identity/v3/
         else
diff --git a/openrc b/openrc
index 99d3351d53..beeaebea42 100644
--- a/openrc
+++ b/openrc
@@ -87,9 +87,9 @@ export OS_AUTH_TYPE=password
 
 # If you don't have a working .stackenv, this is the backup position
 KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
-KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_URI:-$KEYSTONE_BACKUP}
+KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
-export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_AUTH_URI}
+export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
 
 # Currently, in order to use openstackclient with Identity API v3,
 # we need to set the domain which the user and project belong to.
diff --git a/stack.sh b/stack.sh
index 709b97b0ef..37e75185f1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1053,7 +1053,7 @@ cat > $TOP_DIR/userrc_early <<EOF
 
 # Set up password auth credentials now that Keystone is bootstrapped
 export OS_IDENTITY_API_VERSION=3
-export OS_AUTH_URL=$KEYSTONE_AUTH_URI
+export OS_AUTH_URL=$KEYSTONE_SERVICE_URI
 export OS_USERNAME=admin
 export OS_USER_DOMAIN_ID=default
 export OS_PASSWORD=$ADMIN_PASSWORD

From f6286cb586eb1f861866bfdf85c4f873c79fd592 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sat, 13 Jun 2020 11:40:09 +0200
Subject: [PATCH 2694/3333] Drop keystone dedicated ports

Those historic references to port 5000 and 35357 aren't being used
anymore for some time, so let us drop them.

Clean up some python2/3 wording along the way.

No longer mention Identity API v2, which is also a thing of the past.

Change-Id: Iafff097eee082f24ea2ae27ad038ad115aa36c61
---
 doc/source/configuration.rst   | 22 ++++---------
 files/apache-keystone.template | 30 -----------------
 lib/keystone                   | 59 +++-------------------------------
 openrc                         |  2 +-
 tools/create_userrc.sh         |  2 +-
 tools/fixup_stuff.sh           | 34 --------------------
 6 files changed, 12 insertions(+), 137 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 45f4ffe6e9..67c3b8a7d1 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -137,7 +137,7 @@ OS\_AUTH\_URL
 
     ::
 
-        OS_AUTH_URL=http://$SERVICE_HOST:5000/v3.0
+        OS_AUTH_URL=http://$SERVICE_HOST/identity/v3.0
 
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented
@@ -430,16 +430,16 @@ Python bindings added when they are enabled.
 
   ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
-Use python3
+Use python2
 ------------
 
-By default ``stack.sh`` uses python2 (the exact version set by the
-``PYTHON2_VERSION``). This can be overriden so devstack will run
-python3 (the exact version set by ``PYTHON3_VERSION``).
+By default ``stack.sh`` uses python3 (the exact version set by the
+``PYTHON3_VERSION``). This can be overriden so devstack will run
+python2 (the exact version set by ``PYTHON2_VERSION``).
 
 ::
 
-  USE_PYTHON3=True
+  USE_PYTHON3=False
 
 A clean install every time
 --------------------------
@@ -696,16 +696,6 @@ KEYSTONE_REGION_NAME to specify the region of Keystone service.
 KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
 it in the configuration of RegionOne.
 
-Disabling Identity API v2
-+++++++++++++++++++++++++
-
-The Identity API v2 is deprecated as of Mitaka and it is recommended to only
-use the v3 API. It is possible to setup keystone without v2 API, by doing:
-
-::
-
-    ENABLE_IDENTITY_V2=False
-
 .. _arch-configuration:
 
 Architectures
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 128436027d..cf26c216f5 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,39 +1,9 @@
-Listen %PUBLICPORT%
-Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
     Require all granted
 </Directory>
 
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess keystone-public processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup keystone-public
-    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    ErrorLogFormat "%M"
-    ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-<VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup keystone-admin
-    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    ErrorLogFormat "%M"
-    ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
 %SSLLISTEN%<VirtualHost *:443>
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
diff --git a/lib/keystone b/lib/keystone
index d4c7b063bb..29407a0e69 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -83,14 +83,10 @@ KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:
 
 # Set Keystone interface configuration
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
-KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
-KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
 KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Public facing bits
 KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
-KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
-KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
 KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
@@ -170,22 +166,14 @@ function _config_keystone_apache_wsgi {
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
-    local keystone_service_port=$KEYSTONE_SERVICE_PORT
-    local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
-    if is_service_enabled tls-proxy; then
-        keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
-        keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
-    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
     fi
 
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
-        s|%PUBLICPORT%|$keystone_service_port|g;
-        s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
@@ -222,21 +210,8 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
-    local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_port=$KEYSTONE_AUTH_PORT
-
-    if is_service_enabled tls-proxy; then
-        # Set the service ports for a proxy to take the originals
-        service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_port=$KEYSTONE_AUTH_PORT_INT
-    fi
-
     # Override the endpoints advertised by keystone (the public_endpoint and
-    # admin_endpoint) so that clients use the correct endpoint. By default, the
-    # keystone server uses the public_port and admin_port which isn't going to
-    # work when you want to use a different port (in the case of proxy), or you
-    # don't want the port (in the case of putting keystone on a path in
-    # apache).
+    # admin_endpoint) so that clients use the correct endpoint.
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
     iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
 
@@ -270,12 +245,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF credential key_repository "$KEYSTONE_CONF_DIR/credential-keys/"
 
-    # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
-    # The users from this project are globally admin as before, but it also
-    # allows policy changes in order to clarify the adminess scope.
-    #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
-    #iniset $KEYSTONE_CONF resource admin_project_name admin
-
     if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
         iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
@@ -510,14 +479,6 @@ function install_keystone {
 
 # start_keystone() - Start running processes
 function start_keystone {
-    # Get right service port for testing
-    local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_protocol=$KEYSTONE_AUTH_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_protocol="http"
-    fi
-
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
@@ -526,23 +487,13 @@ function start_keystone {
     fi
 
     echo "Waiting for keystone to start..."
-    # Check that the keystone service is running. Even if the tls tunnel
-    # should be enabled, make sure the internal port is checked using
-    # unencryted traffic at this point.
-    # If running in Apache, use the path rather than port.
-
+    # Check that the keystone service is running.
     local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
     fi
 
-    # Start proxies if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
-        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
-    fi
-
     # (re)start memcached to make sure we have a clean memcache.
     restart_service memcached
 }
@@ -561,11 +512,9 @@ function stop_keystone {
 # This function uses the following GLOBAL variables:
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
-# - ``IDENTITY_API_VERSION``
+# - ``KEYSTONE_AUTH_URI``
 # - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_PROTOCOL``
-# - ``KEYSTONE_SERVICE_HOST``
-# - ``KEYSTONE_SERVICE_PORT``
+# - ``KEYSTONE_SERVICE_URI``
 function bootstrap_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
         --bootstrap-username admin \
diff --git a/openrc b/openrc
index beeaebea42..28f388be4c 100644
--- a/openrc
+++ b/openrc
@@ -86,7 +86,7 @@ export OS_AUTH_TYPE=password
 #
 
 # If you don't have a working .stackenv, this is the backup position
-KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
+KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST/identity
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
 export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index f4a4edcbe2..c7bea4ac08 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v3/
+    export OS_AUTH_URL=http://localhost/identity/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index e1409291b9..2ac8a47ca7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -26,39 +26,6 @@ if [[ -z "$TOP_DIR" ]]; then
     FILES=$TOP_DIR/files
 fi
 
-# Keystone Port Reservation
-# -------------------------
-# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
-# being used as ephemeral ports by the system. The default(s) are 35357 and
-# 35358 which are in the Linux defined ephemeral port range (in disagreement
-# with the IANA ephemeral port range). This is a workaround for bug #1253482
-# where Keystone will try and bind to the port and the port will already be
-# in use as an ephemeral port by another process. This places an explicit
-# exception into the Kernel for the Keystone AUTH ports.
-function fixup_keystone {
-    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
-
-    # Only do the reserved ports when available, on some system (like containers)
-    # where it's not exposed we are almost pretty sure these ports would be
-    # exclusive for our DevStack.
-    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
-        # Get any currently reserved ports, strip off leading whitespace
-        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-        if [[ -z "${reserved_ports}" ]]; then
-            # If there are no currently reserved ports, reserve the keystone ports
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
-        else
-            # If there are currently reserved ports, keep those and also reserve the
-            # Keystone specific ports. Duplicate reservations are merged into a single
-            # reservation (or range) automatically by the kernel.
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
-        fi
-    else
-        echo_summary "WARNING: unable to reserve keystone ports"
-    fi
-}
-
 # Ubuntu Repositories
 #--------------------
 # Enable universe for bionic since it is missing when installing from ISO.
@@ -208,7 +175,6 @@ function fixup_suse {
 }
 
 function fixup_all {
-    fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse

From d7a82f41e469fc51fb021184c1fa6c98da428411 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 23 Jun 2020 10:21:09 +0200
Subject: [PATCH 2695/3333] Drop support for python2

python2 is EOL, let's move on and only support python3.

Change-Id: Ieffda4edea9cc19484c04420ed703f7141ef9f15
---
 .zuul.yaml                                   |  3 --
 doc/source/configuration.rst                 | 11 ----
 doc/source/guides/devstack-with-lbaas-v2.rst |  3 --
 inc/python                                   | 55 ++++----------------
 lib/apache                                   | 16 ++----
 lib/tls                                      |  8 +--
 stackrc                                      | 20 +++----
 tools/install_pip.sh                         |  6 ---
 8 files changed, 21 insertions(+), 101 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f78f3f54c7..5ae14708e1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -558,9 +558,6 @@
       devstack_localrc:
         SERVICE_IP_VERSION: 6
         SERVICE_HOST: ""
-        # IPv6 and certificates known issue with python2
-        # https://bugs.launchpad.net/devstack/+bug/1794929
-        USE_PYTHON3: true
 
 - job:
     name: devstack-multinode
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 67c3b8a7d1..ec4a9c84e4 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -430,17 +430,6 @@ Python bindings added when they are enabled.
 
   ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
-Use python2
-------------
-
-By default ``stack.sh`` uses python3 (the exact version set by the
-``PYTHON3_VERSION``). This can be overriden so devstack will run
-python2 (the exact version set by ``PYTHON2_VERSION``).
-
-::
-
-  USE_PYTHON3=False
-
 A clean install every time
 --------------------------
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 7fde6f14f8..5d96ca7d74 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -41,9 +41,6 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     # If you are enabling barbican for TLS offload in Octavia, include it here.
     # enable_plugin barbican https://opendev.org/openstack/barbican
 
-    # If you have python3 available:
-    # USE_PYTHON3=True
-
     # ===== BEGIN localrc =====
     DATABASE_PASSWORD=password
     ADMIN_PASSWORD=password
diff --git a/inc/python b/inc/python
index 08f9959d5c..727d52cd5b 100644
--- a/inc/python
+++ b/inc/python
@@ -62,7 +62,7 @@ function get_python_exec_prefix {
     $xtrace
 
     local PYTHON_PATH=/usr/local/bin
-    ( is_fedora && ! python3_enabled ) || is_suse && PYTHON_PATH=/usr/bin
+    is_suse && PYTHON_PATH=/usr/bin
     echo $PYTHON_PATH
 }
 
@@ -169,16 +169,9 @@ function pip_install {
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
     else
-        local cmd_pip
-        local sudo_pip="sudo -H"
-        if python3_enabled; then
-            echo "Using python $PYTHON3_VERSION to install $package_dir because python3_enabled=True"
-            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip="python$PYTHON3_VERSION -m pip"
-        else
-            echo "Using python $PYTHON2_VERSION to install $package_dir because python3_enabled=False"
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-        fi
+        local cmd_pip="python$PYTHON3_VERSION -m pip"
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
+        echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 
     cmd_pip="$cmd_pip install"
@@ -213,14 +206,8 @@ function pip_uninstall {
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
     else
-        local cmd_pip
-        local sudo_pip="sudo -H"
-        if python3_enabled; then
-            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip="python$PYTHON3_VERSION -m pip"
-        else
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-        fi
+        local cmd_pip="python$PYTHON3_VERSION -m pip"
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
     fi
     # don't error if we can't uninstall, it might not be there
     $sudo_pip $cmd_pip uninstall -y $name || /bin/true
@@ -457,37 +444,15 @@ function setup_package {
 }
 
 # Report whether python 3 should be used
+# TODO(frickler): drop this once all legacy uses are removed
 function python3_enabled {
-    if [[ $USE_PYTHON3 == "True" ]]; then
-        return 0
-    else
-        return 1
-    fi
+    return 1
 }
 
 # Provide requested python version and sets PYTHON variable
 function install_python {
-    # NOTE: install_python function should finally just do what install_python3
-    # does as soon Python 2 support has been dropped
-    if python3_enabled; then
-        install_python3
-        export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null ||
-                        which python3 2>/dev/null)
-        if [[ "${DISTRO}" =~ (rhel8) ]]; then
-            # Use Python 3 as default python command so that we have only one
-            # python alternative to use on the system for either python and
-            # python3
-            sudo alternatives --set python "${PYTHON}"
-        else
-            # Install anyway Python 2 for legacy scripts that still requires
-            # python instead of python3 command
-            install_package python
-        fi
-    else
-        echo "WARNING - Python 2 support has been deprecated in favor of Python 3"
-        install_package python
-        export PYTHON=$(which python 2>/dev/null)
-    fi
+    install_python3
+    export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null)
 }
 
 # Install python3 packages
diff --git a/lib/apache b/lib/apache
index a5fbf75374..cc282006df 100644
--- a/lib/apache
+++ b/lib/apache
@@ -89,11 +89,7 @@ function install_apache_uwsgi {
     #
     # For package installs, the distro ships both plugins and you need
     # to select the right one ... it will not be autodetected.
-    if python3_enabled; then
-        UWSGI_PYTHON_PLUGIN=python3
-    else
-        UWSGI_PYTHON_PLUGIN=python
-    fi
+    UWSGI_PYTHON_PLUGIN=python3
 
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
@@ -150,14 +146,10 @@ function install_apache_wsgi {
     if is_ubuntu; then
         # Install apache2, which is NOPRIME'd
         install_package apache2
-        if python3_enabled; then
-            if is_package_installed libapache2-mod-wsgi; then
-                uninstall_package libapache2-mod-wsgi
-            fi
-            install_package libapache2-mod-wsgi-py3
-        else
-            install_package libapache2-mod-wsgi
+        if is_package_installed libapache2-mod-wsgi; then
+            uninstall_package libapache2-mod-wsgi
         fi
+        install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
diff --git a/lib/tls b/lib/tls
index d05536b45d..baafb59c8b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -227,13 +227,7 @@ function init_CA {
 function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
-            if python3_enabled; then
-                TLS_IP="IP:$TLS_IP"
-            else
-                # Lie to let incomplete match routines work with python2
-                # see https://bugs.python.org/issue23239
-                TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
-            fi
+            TLS_IP="IP:$TLS_IP"
             if [[ -n "$HOST_IPV6" ]]; then
                 TLS_IP="$TLS_IP,IP:$HOST_IPV6"
             fi
diff --git a/stackrc b/stackrc
index e323cee843..4ffd537ef4 100644
--- a/stackrc
+++ b/stackrc
@@ -134,25 +134,17 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
 fi
 
 # Control whether Python 3 should be used at all.
-export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
+# TODO(frickler): Drop this when all consumers are fixed
+export USE_PYTHON3=True
 
-# When Python 3 is supported by an application, adding the specific
-# version of Python 3 to this variable will install the app using that
-# version of the interpreter instead of 2.7.
+# Adding the specific version of Python 3 to this variable will install
+# the app using that version of the interpreter instead of just 3.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
 export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3}}
 
-# Just to be more explicit on the Python 2 version to use.
-_DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
-export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
-
 # Create a virtualenv with this
-if [[ ${USE_PYTHON3} == True ]]; then
-    # Use the built-in venv to avoid more dependencies
-    export VIRTUALENV_CMD="python3 -m venv"
-else
-    export VIRTUALENV_CMD="virtualenv "
-fi
+# Use the built-in venv to avoid more dependencies
+export VIRTUALENV_CMD="python3 -m venv"
 
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 517669e282..f3fd1e2498 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -92,9 +92,6 @@ function install_get_pip {
         touch $LOCAL_PIP.downloaded
     fi
     sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
-    if ! python3_enabled; then
-        sudo -H -E python $LOCAL_PIP
-    fi
 }
 
 
@@ -142,9 +139,6 @@ fi
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
 if ! is_fedora  && ! is_suse; then
-    if is_package_installed python-pip ; then
-        uninstall_package python-pip
-    fi
     if is_package_installed python3-pip ; then
         uninstall_package python3-pip
     fi

From ee5cf747d8826b9f9dbf565a7a9ba2c1e25f068a Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Thu, 12 Dec 2019 15:52:22 -0500
Subject: [PATCH 2696/3333] Remove GLANCE_V1_ENABLED option

This option sets enable_v1_api in glance-api.conf, a setting that
was removed by change Ia086230cc8c92f7b7dfd5b001923110d5bc55d4d
in July 2018, so remove the devstack option from lib/glance.

It occurs in two other places:

This option is used in lib/cinder to set an option that was removed
from Cinder by change Ice379db9ae83420bacf9e96e242c7515930eae86 in
Queens, so remove the related code.

When this option is False, it is used in lib/tempest to set
[image-feature-enabled]/api_v1 to False in the tempest config file.
However, the default value of ths setting has been False since
change Iab3a209c744375bf2618afc00a3f7731b62f557e in Sept 2018,
so remove the related code.

Change-Id: I4b18a0a388ed7e7a392fabeac613778e0d23dee7
---
 lib/cinder  | 4 ----
 lib/glance  | 7 -------
 lib/tempest | 5 -----
 3 files changed, 16 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index c2e55f9173..b1ed593080 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -311,10 +311,6 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
-    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
-        iniset $CINDER_CONF DEFAULT glance_api_version 2
-    fi
-
     # Set nova credentials (used for os-assisted-snapshots)
     configure_keystone_authtoken_middleware $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
diff --git a/lib/glance b/lib/glance
index 4fa1b6a4e3..97af6e691d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -73,7 +73,6 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_IMAGE_IMPORT_CONF=$GLANCE_CONF_DIR/glance-image-import.conf
-GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -152,12 +151,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
 
-    # NOTE(flaper87): To uncomment as soon as all services consuming Glance are
-    # able to consume V2 entirely.
-    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
-        iniset $GLANCE_API_CONF DEFAULT enable_v1_api False
-    fi
-
     # Glance multiple store Store specific configs
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
         iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
diff --git a/lib/tempest b/lib/tempest
index 05fcb1f1f3..1ce2350620 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -346,11 +346,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
 
-    # Image Features
-    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
-        iniset $TEMPEST_CONFIG image-feature-enabled api_v1 False
-    fi
-
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From bde1804ee98d2bf1e3bd9e04c11dde53cbff119f Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 25 Jun 2020 20:19:03 -0500
Subject: [PATCH 2697/3333] Switch devstack base job to Ubuntu Focal

As per Victoria cycle testing runtime[1], we need
to test upstream CI/CD on Ubuntu 20.04(Focal). TC is
in the process of defining this as a community goal[2]

By moving the devstack base job to Ubuntu focal, all project side job
or devstack-tempest job will automatically migrate to the new distro
until they override the nodeset.

As devstack is branched, all the stable jobs derived from devstack jobs will
keep working on Bionic.

[1] https://governance.openstack.org/tc/reference/runtimes/victoria.html
[2] https://governance.openstack.org/tc/goals/proposed/migrate-ci-cd-jobs-to-ubuntu-focal.html

Depends-On: https://review.opendev.org/#/c/738328/

Story: #2007865
Task: #40212

Change-Id: I63e69e898376e728eaf6d857426276fc93a1a0e3
---
 .zuul.yaml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f78f3f54c7..cf56eae0e4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -391,7 +391,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-bionic
+    nodeset: openstack-single-node-focal
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -565,7 +565,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-bionic
+    nodeset: openstack-two-node-focal
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -589,12 +589,10 @@
     nodeset: devstack-single-node-opensuse-15
 
 - job:
-    name: devstack-platform-focal
+    name: devstack-platform-bionic
     parent: tempest-full-py3
-    description: Ubuntu Focal Fossa platform test
-    nodeset: openstack-single-node-focal
-    vars:
-      tempest_black_regex: "(tempest.api.compute.volumes.test_attach_volume.AttachVolumeMultiAttachTest.test_resize_server_with_multiattached_volume|tempest.api.compute.servers.test_server_rescue_negative.ServerRescueNegativeTestJSON|tempest.api.compute.servers.test_server_rescue.ServerStableDeviceRescueTest.test_stable_device_rescue_disk_virtio_with_volume_attached)"
+    description: Ubuntu Bionic platform test
+    nodeset: openstack-single-node-bionic
     voting: false
 
 - job:
@@ -688,7 +686,7 @@
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
-        - devstack-platform-focal
+        - devstack-platform-bionic
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate

From b066707d641696487fbd78773f191e2cfb4345f0 Mon Sep 17 00:00:00 2001
From: Xinliang Liu <xinliang.liu@linaro.org>
Date: Sun, 28 Jun 2020 08:55:28 +0000
Subject: [PATCH 2698/3333] Fix targetcli install error on ubuntu focal

No targetcli package on Ubuntu Focal, it should use targetcli-fb also
when "$CINDER_ISCSI_HELPER" == "lioadm".

Although Xenial only has targetcli, but Xenial is dropped from CI. And
starting from bionic, Ubuntu uses targetcli-fb to replace targetcli. So
here we can use is_ubuntu to make ubuntu use targetcli-fb.

Change-Id: I6d35b6651d486e716980dcd9f4d693bed560463a
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index c2e55f9173..b1e3d0d408 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -419,7 +419,7 @@ function install_cinder {
     if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
         install_package tgt
     elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
-        if [[ ${DISTRO} == "bionic" ]]; then
+        if is_ubuntu; then
             # TODO(frickler): Workaround for https://launchpad.net/bugs/1819819
             sudo mkdir -p /etc/target
 

From 59519ca5cc92d2d34363f2644e54fc4d7934a1b4 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 29 Jun 2020 10:24:21 +0200
Subject: [PATCH 2699/3333] Make opensuse platform job non-voting again

The non-voting flag was accidentally dropped in [0].

[0] Ib4416dc2f5e003fd770f5240a8f78213c56af8e6

Change-Id: If9519f1ac9afd66553e1c1410fdc16369f166b98
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index f78f3f54c7..4142d465bb 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -587,6 +587,7 @@
     parent: tempest-full-py3
     description: openSUSE 15.x platform test
     nodeset: devstack-single-node-opensuse-15
+    voting: false
 
 - job:
     name: devstack-platform-focal

From 3cbb33e5c6068d80c50f64a543550611eca8309a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Tue, 30 Jun 2020 17:52:10 +0200
Subject: [PATCH 2700/3333] Fix python3_enable to return true

Recent regression spotted by Dmitry Tantsur.
DevStack dropped Py2 support but the now-unused-in-devstack
python3_enable got its result nastily inversed.

Change-Id: I4b37cc847a24705c4955cec2e6e45f0514705f1b
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 727d52cd5b..f98d28d995 100644
--- a/inc/python
+++ b/inc/python
@@ -446,7 +446,7 @@ function setup_package {
 # Report whether python 3 should be used
 # TODO(frickler): drop this once all legacy uses are removed
 function python3_enabled {
-    return 1
+    return 0
 }
 
 # Provide requested python version and sets PYTHON variable

From 1e26508983a1ebf2c23560395ffca8b1f6f79462 Mon Sep 17 00:00:00 2001
From: Hirotaka Wakabayashi <hiwkby@yahoo.com>
Date: Thu, 2 Jul 2020 06:19:21 +0000
Subject: [PATCH 2701/3333] Use python3-mod-wsgi instead of mod_wsgi on CentOS8

This fixes a stack.sh execution error on CentOS8. We should use
python3-mod_wsgi instead of mod_wsgi since mod_wsgi is replaced by
python3-mod_wsgi. The following change may affect this issue.
https://git.centos.org/rpms/mod_wsgi/c/4a746b53e9e3fef74b227e016e785449160871b8?branch=c8s

Change-Id: I5344ecf519e1a79091b6158c2d711d09b21fae0c
Closes-Bug: #1885645
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index cc282006df..a121fb0e6f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -152,7 +152,7 @@ function install_apache_wsgi {
         install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
-        install_package httpd mod_wsgi
+        install_package httpd python3-mod_wsgi
         # For consistency with Ubuntu, switch to the worker mpm, as
         # the default is event
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf

From 8956006e519022bc9640476674e638c7dd080478 Mon Sep 17 00:00:00 2001
From: Xinliang Liu <xinliang.liu@linaro.org>
Date: Thu, 2 Jul 2020 08:31:10 +0000
Subject: [PATCH 2702/3333] Fix string comparison

String comparison should be included with square brackets.

Change-Id: I9a4fab7848e5dba8a5b3b09a75e7aac213368706
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index cc282006df..6670219a51 100644
--- a/lib/apache
+++ b/lib/apache
@@ -93,7 +93,7 @@ function install_apache_uwsgi {
 
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
-        if "$DISTRO" == 'bionic'; then
+        if [[ "$DISTRO" == 'bionic' ]]; then
             pkg_list="${pkg_list} uwsgi-plugin-python"
         fi
         install_package ${pkg_list}

From f8dbfd394a826779f3af403fd5316b9d86492802 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 6 Jul 2020 18:42:30 +0000
Subject: [PATCH 2703/3333] Revert "Drop keystone dedicated ports"

This reverts commit f6286cb586eb1f861866bfdf85c4f873c79fd592.

This patch is blocking glance as it needs mod_wsgi to perform new import workflow.

Change-Id: I4475247dfe986114d37678b3d3d552c0c7d02ddc
---
 doc/source/configuration.rst   | 12 ++++++-
 files/apache-keystone.template | 30 +++++++++++++++++
 lib/keystone                   | 59 +++++++++++++++++++++++++++++++---
 openrc                         |  2 +-
 tools/create_userrc.sh         |  2 +-
 tools/fixup_stuff.sh           | 34 ++++++++++++++++++++
 6 files changed, 132 insertions(+), 7 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index ec4a9c84e4..22f5999174 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -137,7 +137,7 @@ OS\_AUTH\_URL
 
     ::
 
-        OS_AUTH_URL=http://$SERVICE_HOST/identity/v3.0
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v3.0
 
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented
@@ -685,6 +685,16 @@ KEYSTONE_REGION_NAME to specify the region of Keystone service.
 KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
 it in the configuration of RegionOne.
 
+Disabling Identity API v2
++++++++++++++++++++++++++
+
+The Identity API v2 is deprecated as of Mitaka and it is recommended to only
+use the v3 API. It is possible to setup keystone without v2 API, by doing:
+
+::
+
+    ENABLE_IDENTITY_V2=False
+
 .. _arch-configuration:
 
 Architectures
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index cf26c216f5..128436027d 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,9 +1,39 @@
+Listen %PUBLICPORT%
+Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
     Require all granted
 </Directory>
 
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess keystone-public processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup keystone-public
+    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    ErrorLogFormat "%M"
+    ErrorLog /var/log/%APACHE_NAME%/keystone.log
+    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+<VirtualHost *:%ADMINPORT%>
+    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup keystone-admin
+    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    ErrorLogFormat "%M"
+    ErrorLog /var/log/%APACHE_NAME%/keystone.log
+    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
 %SSLLISTEN%<VirtualHost *:443>
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
diff --git a/lib/keystone b/lib/keystone
index 29407a0e69..d4c7b063bb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -83,10 +83,14 @@ KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:
 
 # Set Keystone interface configuration
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
+KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
+KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
 KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Public facing bits
 KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
+KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
+KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
 KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
@@ -166,14 +170,22 @@ function _config_keystone_apache_wsgi {
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
+    local keystone_service_port=$KEYSTONE_SERVICE_PORT
+    local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
+    if is_service_enabled tls-proxy; then
+        keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
+        keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
+    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
     fi
 
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
+        s|%PUBLICPORT%|$keystone_service_port|g;
+        s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
@@ -210,8 +222,21 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
+    local service_port=$KEYSTONE_SERVICE_PORT
+    local auth_port=$KEYSTONE_AUTH_PORT
+
+    if is_service_enabled tls-proxy; then
+        # Set the service ports for a proxy to take the originals
+        service_port=$KEYSTONE_SERVICE_PORT_INT
+        auth_port=$KEYSTONE_AUTH_PORT_INT
+    fi
+
     # Override the endpoints advertised by keystone (the public_endpoint and
-    # admin_endpoint) so that clients use the correct endpoint.
+    # admin_endpoint) so that clients use the correct endpoint. By default, the
+    # keystone server uses the public_port and admin_port which isn't going to
+    # work when you want to use a different port (in the case of proxy), or you
+    # don't want the port (in the case of putting keystone on a path in
+    # apache).
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
     iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
 
@@ -245,6 +270,12 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF credential key_repository "$KEYSTONE_CONF_DIR/credential-keys/"
 
+    # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
+    # The users from this project are globally admin as before, but it also
+    # allows policy changes in order to clarify the adminess scope.
+    #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
+    #iniset $KEYSTONE_CONF resource admin_project_name admin
+
     if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
         iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
@@ -479,6 +510,14 @@ function install_keystone {
 
 # start_keystone() - Start running processes
 function start_keystone {
+    # Get right service port for testing
+    local service_port=$KEYSTONE_SERVICE_PORT
+    local auth_protocol=$KEYSTONE_AUTH_PROTOCOL
+    if is_service_enabled tls-proxy; then
+        service_port=$KEYSTONE_SERVICE_PORT_INT
+        auth_protocol="http"
+    fi
+
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
@@ -487,13 +526,23 @@ function start_keystone {
     fi
 
     echo "Waiting for keystone to start..."
-    # Check that the keystone service is running.
+    # Check that the keystone service is running. Even if the tls tunnel
+    # should be enabled, make sure the internal port is checked using
+    # unencryted traffic at this point.
+    # If running in Apache, use the path rather than port.
+
     local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
     fi
 
+    # Start proxies if enabled
+    if is_service_enabled tls-proxy; then
+        start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
+        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
+    fi
+
     # (re)start memcached to make sure we have a clean memcache.
     restart_service memcached
 }
@@ -512,9 +561,11 @@ function stop_keystone {
 # This function uses the following GLOBAL variables:
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
-# - ``KEYSTONE_AUTH_URI``
+# - ``IDENTITY_API_VERSION``
 # - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_URI``
+# - ``KEYSTONE_SERVICE_PROTOCOL``
+# - ``KEYSTONE_SERVICE_HOST``
+# - ``KEYSTONE_SERVICE_PORT``
 function bootstrap_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
         --bootstrap-username admin \
diff --git a/openrc b/openrc
index 28f388be4c..beeaebea42 100644
--- a/openrc
+++ b/openrc
@@ -86,7 +86,7 @@ export OS_AUTH_TYPE=password
 #
 
 # If you don't have a working .stackenv, this is the backup position
-KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST/identity
+KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
 export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index c7bea4ac08..f4a4edcbe2 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost/identity/v3/
+    export OS_AUTH_URL=http://localhost:5000/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 2ac8a47ca7..e1409291b9 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -26,6 +26,39 @@ if [[ -z "$TOP_DIR" ]]; then
     FILES=$TOP_DIR/files
 fi
 
+# Keystone Port Reservation
+# -------------------------
+# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
+# being used as ephemeral ports by the system. The default(s) are 35357 and
+# 35358 which are in the Linux defined ephemeral port range (in disagreement
+# with the IANA ephemeral port range). This is a workaround for bug #1253482
+# where Keystone will try and bind to the port and the port will already be
+# in use as an ephemeral port by another process. This places an explicit
+# exception into the Kernel for the Keystone AUTH ports.
+function fixup_keystone {
+    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
+
+    # Only do the reserved ports when available, on some system (like containers)
+    # where it's not exposed we are almost pretty sure these ports would be
+    # exclusive for our DevStack.
+    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
+        # Get any currently reserved ports, strip off leading whitespace
+        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
+
+        if [[ -z "${reserved_ports}" ]]; then
+            # If there are no currently reserved ports, reserve the keystone ports
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+        else
+            # If there are currently reserved ports, keep those and also reserve the
+            # Keystone specific ports. Duplicate reservations are merged into a single
+            # reservation (or range) automatically by the kernel.
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+        fi
+    else
+        echo_summary "WARNING: unable to reserve keystone ports"
+    fi
+}
+
 # Ubuntu Repositories
 #--------------------
 # Enable universe for bionic since it is missing when installing from ISO.
@@ -175,6 +208,7 @@ function fixup_suse {
 }
 
 function fixup_all {
+    fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse

From 6184dea966d56f13f15d926dbb09e527ae3ba39e Mon Sep 17 00:00:00 2001
From: Rui Zang <rui.zang@intel.com>
Date: Mon, 6 Jul 2020 23:47:56 -0700
Subject: [PATCH 2704/3333] Remove n-api-metadata service from compute nodes

Starting up n-api-metadata service on every compute nodes does
not solve the problem of isolated networks (no route to metadata
service). It all depends on how 'enable_isolated_metadata' and
related options (e.g. force_metadata) are set in dhcp agent and
what is configured for the 'nova_metadata_host' option of q-meta
service. Having a global n-api-metadata service in the control
node is sufficient for a mult-node lab setup.
Besides, the n-api-metadata services on compute nodes are not
really working due to https://bugs.launchpad.net/nova/+bug/1815082

Change-Id: Ib8691c3eeee59758fbd98989d9460f1458ea422f
Related-Bug: 1815082
---
 doc/source/guides/multinode-lab.rst | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 15f02a0e5e..c0b3f58157 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -169,17 +169,12 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol,placement-client
+    ENABLED_SERVICES=n-cpu,q-agt,c-vol,placement-client
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
     VNCSERVER_LISTEN=$HOST_IP
     VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
 
-**Note:** the ``n-api-meta`` service is a version of the api server
-that only serves the metadata service. It's needed because the
-computes created won't have a routing path to the metadata service on
-the controller.
-
 Fire up OpenStack:
 
 ::

From 95634d990572fdaf94e199e06a2b3b04f7c27b3a Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 21 Feb 2019 12:24:17 +0000
Subject: [PATCH 2705/3333] Re-enable memory_tracker

The old peakmem_tracker service has been disabled in [0], now enable
the replacement memory_tracker.

Also fail when the old service is still configured, otherwise
consumers might never notice.

Depends-On: https://review.opendev.org/739995
Change-Id: I583caf3f36a8ff41d7d4106dabc6c5f24243085e
---
 .zuul.yaml | 4 ++++
 lib/dstat  | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 43e5d4cf8a..256ede98a6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -404,6 +404,7 @@
         # Shared services
         dstat: true
         etcd3: true
+        memory_tracker: true
         mysql: true
         rabbit: true
     group-vars:
@@ -411,6 +412,7 @@
         devstack_services:
           # Shared services
           dstat: true
+          memory_tracker: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -476,6 +478,7 @@
         # Shared services
         dstat: true
         etcd3: true
+        memory_tracker: true
         mysql: true
         rabbit: true
         tls-proxy: true
@@ -524,6 +527,7 @@
           # This list replaces the test-matrix.
           # Shared services
           dstat: true
+          memory_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
diff --git a/lib/dstat b/lib/dstat
index f5bd2bb948..eb03ae0fb2 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -35,10 +35,10 @@ function start_dstat {
     # to your localrc
     run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
 
-    # remove support for the old name when it's no longer used (sometime in Queens)
+    # TODO(jh): Fail when using the old service name otherwise consumers might
+    # never notice that is has been removed.
     if is_service_enabled peakmem_tracker; then
-        deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
-        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
+        die $LINENO "The peakmem_tracker service has been removed, use memory_tracker instead"
     fi
 }
 

From 0cbbefc0cb6f58b09a722d1230e7ae86113b2989 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Fri, 10 Jul 2020 13:21:45 +0200
Subject: [PATCH 2706/3333] zuul: clean up some legacy jobs

Replace legacy-tempest-dsvm-lvm-multibackend with its native version,
cinder-tempest-lvm-multibackend.

Remove legacy-tempest-dsvm-neutron-dvr-multinode-full, which was defined
as an experimental job in neutron and removed during the ussuri lifecycle.
See https://review.opendev.org/#/c/693630/

Change-Id: I76d1efaa3a6c1fe9825e8457438f514114b2ecad
---
 .zuul.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 43e5d4cf8a..fc3c4704d9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -803,15 +803,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-neutron-dvr-multinode-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - neutron-tempest-dvr-ha-multinode-full:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-lvm-multibackend:
+        - cinder-tempest-lvm-multibackend:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 73ad9760a384e3f872de07a174440fe8e3b174ec Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Tue, 16 Jun 2020 15:20:48 +0000
Subject: [PATCH 2707/3333] Use glance import workflow for creating image

Added new boolean option 'GLANCE_USE_IMPORT_WORKFLOW' default to False.
If this parameter set in local.conf as True then devstack will use the
new import workflow to create the image.

In order to use new import workflow of glance;
user need to set below options in local.conf

GLANCE_USE_IMPORT_WORKFLOW=True

Note that the import workflow does not work in uwsgi because of
some fundamental restrictions it has. Thus, devstack must be configured
with WSGI_MODE=mod_wsgi, otherwise glance will not be able to process
the imports. The new helper function will abort to avoid in that case
to avoid the image never being moved to "active" state by an import
task that will never be executed.

Co-Authored-By: Abhishek Kekane <akekane@redhat.com>
Co-Authored-By: Dan Smith <dansmith@redhat.com>
Needed-By: https://review.opendev.org/#/c/734184
Change-Id: I1306fe816b7a3eca1e2312c0c454be3d81118eca
---
 functions  | 79 ++++++++++++++++++++++++++++++++++--------------------
 lib/glance |  2 ++
 2 files changed, 52 insertions(+), 29 deletions(-)

diff --git a/functions b/functions
index 24700153a9..2d60a0821f 100644
--- a/functions
+++ b/functions
@@ -77,6 +77,41 @@ function get_extra_file {
     fi
 }
 
+# Upload an image to glance using the configured mechanism
+#
+# Arguments:
+#  image name
+#  container format
+#  disk format
+#  path to image file
+#  optional properties (format of propname=value)
+#
+function _upload_image {
+    local image_name="$1"
+    shift
+    local container="$1"
+    shift
+    local disk="$1"
+    shift
+    local image="$1"
+    shift
+    local properties
+    local useimport
+
+    for prop in $*; do
+        properties+=" --property $prop"
+    done
+
+    if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
+        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+            useimport="--import"
+        else
+            echo "*** Unable to use glance import workflow because WSGI_MODE=uwsgi! ***"
+        fi
+    fi
+
+    openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties < "${image}"
+}
 
 # Retrieve an image from a URL and upload into Glance.
 # Uses the following variables:
@@ -118,7 +153,7 @@ function upload_image {
     # OpenVZ-format images are provided as .tar.gz, but not decompressed prior to loading
     if [[ "$image_url" =~ 'openvz' ]]; then
         image_name="${image_fname%.tar.gz}"
-        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
+        _upload_image "$image_name" ami ami "$image"
         return
     fi
 
@@ -232,7 +267,8 @@ function upload_image {
         vmdk_adapter_type="${props[1]:-$vmdk_adapter_type}"
         vmdk_net_adapter="${props[2]:-$vmdk_net_adapter}"
 
-        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
+        _upload_image "$image_name" bare vmdk "$image" vmware_disktype="$vmdk_disktype" vmware_adaptertype="$vmdk_adapter_type" hw_vif_model="$vmdk_net_adapter"
+
         return
     fi
 
@@ -246,14 +282,9 @@ function upload_image {
             # Nova defaults to PV for all VHD images, but
             # the glance setting is needed for booting
             # directly from volume.
-            force_vm_mode="--property vm_mode=xen"
+            force_vm_mode="vm_mode=xen"
         fi
-        openstack \
-            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
-            image create \
-            "$image_name" --public \
-            --container-format=ovf --disk-format=vhd \
-            $force_vm_mode < "${image}"
+        _upload_image "$image_name" ovf vhd "$image" $force_vm_mode
         return
     fi
 
@@ -262,12 +293,7 @@ function upload_image {
     # Setting metadata, so PV mode is used.
     if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
         image_name="${image_fname%.xen-raw.tgz}"
-        openstack \
-            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
-            image create \
-            "$image_name" --public \
-            --container-format=tgz --disk-format=raw \
-            --property vm_mode=xen < "${image}"
+        _upload_image "$image_name" tgz raw "$image" vm_mode=xen
         return
     fi
 
@@ -278,12 +304,7 @@ function upload_image {
             die $LINENO "Unknown vm_mode=${vm_mode} for Virtuozzo image"
         fi
 
-        openstack \
-            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
-            image create \
-            "$image_name" --public \
-            --container-format=bare --disk-format=ploop \
-            --property vm_mode=$vm_mode < "${image}"
+        _upload_image "$image_name" bare ploop "$image" vm_mode=$vm_mode
         return
     fi
 
@@ -292,7 +313,7 @@ function upload_image {
     local disk_format=""
     local container_format=""
     local unpack=""
-    local img_property="--property hw_rng_model=virtio"
+    local img_property="hw_rng_model=virtio"
     case "$image_fname" in
         *.tar.gz|*.tgz)
             # Extract ami and aki files
@@ -370,18 +391,18 @@ function upload_image {
     esac
 
     if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
-        img_property="$img_property --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
+        img_property="$img_property hw_cdrom_bus=scsi os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then
-        img_property="$img_property --property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
+        img_property="$img_property hw_machine_type=virt hw_cdrom_bus=scsi hw_scsi_model=virtio-scsi os_command_line='console=ttyAMA0'"
     fi
 
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+            _upload_image "$image_name" $container_format $disk_format <(zcat --force "$image") $img_property
         elif [ "$unpack" = "bunzip2" ]; then
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(bunzip2 -cdk "${image}")
+            _upload_image "$image_name" $container_format $disk_format <(bunzip2 -cdk "$image") $img_property
         elif [ "$unpack" = "unxz" ]; then
             # NOTE(brtknr): unxz the file first and cleanup afterwards to
             # prevent timeout while Glance tries to upload image (e.g. to Swift).
@@ -390,10 +411,10 @@ function upload_image {
             tmp_dir=$(mktemp -d)
             image_path="$tmp_dir/$image_name"
             unxz -cv "${image}" > "$image_path"
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format --file "$image_path"
+            _upload_image "$image_name" $container_format $disk_format "$image_path" $img_property
             rm -rf $tmp_dir
         else
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
+            _upload_image "$image_name" $container_format $disk_format "$image" $img_property
         fi
     else
         # Use glance client to add the kernel the root filesystem.
@@ -406,7 +427,7 @@ function upload_image {
         if [ -n "$ramdisk" ]; then
             ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
-        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
+        _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index b9c23aad74..bbabb96f0f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -65,6 +65,8 @@ GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
 GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_staging_store}
 GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
 
+GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
+
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf

From 09eea0b20bf750baa10b4edb5cd52e31b19a4a3a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 9 Jul 2020 08:31:51 -0700
Subject: [PATCH 2708/3333] Make Glance standalone-ness a separate flag

Full Glance functionality requires Glance being run in a configuration
where it can spawn long-running task threads. The default uwsgi mode
does not allow this, and the current workaround is to set WSGI_MODE
to something other than uwsgi to get the devstack code to deploy
Glance as a standalone service. Since this affects the entire rest of
the deployment, this patch separates out a flag to control this behavior
specifically for Glance. When WSGI_MODE=uwsgi, control of the Glance
deployment mechanism is allowed via GLANCE_STANDALONE=True|False. If
WSGI_MODE!= uwsgi then we deploy standalone Glance anyway.

Change-Id: I79068ce0bd7414bc48ff534ee22f0de5d7b091cb
---
 functions  |  4 ++--
 lib/apache | 19 +++++++++++++++++++
 lib/glance | 12 ++++++++++--
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index 2d60a0821f..9b0ea671f5 100644
--- a/functions
+++ b/functions
@@ -103,10 +103,10 @@ function _upload_image {
     done
 
     if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+        if [[ "$GLANCE_STANDALONE" == "True" ]]; then
             useimport="--import"
         else
-            echo "*** Unable to use glance import workflow because WSGI_MODE=uwsgi! ***"
+            echo "*** Unable to use glance import workflow because glance is not standalone! ***"
         fi
     fi
 
diff --git a/lib/apache b/lib/apache
index 6670219a51..2e0a2495f5 100644
--- a/lib/apache
+++ b/lib/apache
@@ -372,6 +372,25 @@ function write_local_uwsgi_http_config {
     restart_apache_server
 }
 
+# Write a straight-through proxy for a service that runs locally and just needs
+# to be reachable via the main http proxy at $loc
+function write_local_proxy_http_config {
+    local name=$1
+    local url=$2
+    local loc=$3
+    local apache_conf
+    apache_conf=$(apache_site_config_for $name)
+
+    enable_apache_mod proxy
+    enable_apache_mod proxy_http
+
+    echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
+    echo "ProxyPass \"${loc}\" \"$url\" retry=0 " | sudo tee -a $apache_conf
+    enable_apache_site $name
+    restart_apache_server
+}
+
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/glance b/lib/glance
index bbabb96f0f..eebaec2a33 100644
--- a/lib/glance
+++ b/lib/glance
@@ -55,6 +55,13 @@ GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 
+# Full Glance functionality requires running in standalone mode. If we are
+# not in uwsgi mode, then we are standalone, otherwise allow separate control.
+if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+    GLANCE_STANDALONE=True
+fi
+GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
+
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
 # has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
@@ -240,9 +247,10 @@ function configure_glance {
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    if [[ "$GLANCE_STANDALONE" == False ]]; then
         write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
     else
+        write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
@@ -342,7 +350,7 @@ function start_glance {
         fi
     fi
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    if [[ "$GLANCE_STANDALONE" == False ]]; then
         run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"

From 2614c1bba103cb88c9a88a1dfe9c6af7ccc1cc55 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 15 Jul 2020 14:41:38 -0700
Subject: [PATCH 2709/3333] Fix ami/aki image create use of $img_property

This abstracts out the conversion of key=value,... property lists to a function
and makes both _upload_image() and the two ami/aki image create calls use it. The
move to bare key=value properties introduced a regression for ami/aki where
the --property flag stopped being passed to osc in that case.

Change-Id: Idf7fdfe3f5800f79f6c48f9d9606a7b53436a730
---
 functions | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index 9b0ea671f5..e687a9848d 100644
--- a/functions
+++ b/functions
@@ -77,6 +77,19 @@ function get_extra_file {
     fi
 }
 
+# Generate image property arguments for OSC
+#
+# Arguments: properties, one per, like propname=value
+#
+# Result is --property propname1=value1 --property propname2=value2
+function _image_properties_to_arg {
+    local result=""
+    for property in $*; do
+        result+=" --property $property"
+    done
+    echo $result
+}
+
 # Upload an image to glance using the configured mechanism
 #
 # Arguments:
@@ -98,9 +111,7 @@ function _upload_image {
     local properties
     local useimport
 
-    for prop in $*; do
-        properties+=" --property $prop"
-    done
+    properties=$(_image_properties_to_arg $*)
 
     if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
         if [[ "$GLANCE_STANDALONE" == "True" ]]; then
@@ -422,10 +433,10 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
         _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi

From 49ad4850c8d5be9c90b10f118853e0288997405d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 15 Jul 2020 14:54:22 -0700
Subject: [PATCH 2710/3333] Only set hw_rng_model by default if we're on
 libvirt

This makes no sense to set on _every_ devstack deployment, only
if we are using libvirt qemu or kvm. Make it conditional.

Change-Id: I860e899274646ff73b8f084a0583325239aee9cc
---
 functions | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index e687a9848d..c34e4874b3 100644
--- a/functions
+++ b/functions
@@ -324,7 +324,16 @@ function upload_image {
     local disk_format=""
     local container_format=""
     local unpack=""
-    local img_property="hw_rng_model=virtio"
+    local img_property=""
+
+    # NOTE(danms): If we're on libvirt/qemu or libvirt/kvm, set the hw_rng_model
+    # to libvirt in the image properties.
+    if [[ "$VIRT_DRIVER" == "libvirt" ]]; then
+        if [[ "$LIBVIRT_TYPE" == "qemu" || "$LIBVIRT_TYPE" == "kvm" ]]; then
+            img_property="hw_rng_model=virtio"
+        fi
+    fi
+
     case "$image_fname" in
         *.tar.gz|*.tgz)
             # Extract ami and aki files

From cc0821a5867358b34d7a9c156d02bd19b2f46dec Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 15 Jul 2020 08:44:00 -0700
Subject: [PATCH 2711/3333] Default Glance to standalone mode

A whole set of Glance functionality is not usable under uwsgi, including any
of the more powerful async import, customization, and copying functions.
In order to facilitate writing and running tempest tests for these features
in all environments covered by the various jobs across all the projects that
include Glance, we should default to this deployment method.

It is still possible to deploy glance in uwsgi mode by setting the flag to
False, and we can do that for some jobs to make sure that it continues to
work. However, the default should be what we expect deployers will use,
which is standalone mode.

Depends-On: https://review.opendev.org/741479
Change-Id: I141acab2a07a4eebd8d850f900058bc8cbf9c7bf
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index eebaec2a33..e941168d32 100644
--- a/lib/glance
+++ b/lib/glance
@@ -60,7 +60,7 @@ GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 if [[ "$WSGI_MODE" != "uwsgi" ]]; then
     GLANCE_STANDALONE=True
 fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
+GLANCE_STANDALONE=${GLANCE_STANDALONE:-True}
 
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES

From 442c57e16855863346806bd6b21e82515158b9e8 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 16 Jul 2020 10:41:13 -0700
Subject: [PATCH 2712/3333] Disable all import methods if glance is not
 standalone

Glance should not be exposing import methods that cannot work via its
API, but it does today. In order for tempest (et al) to be able to
properly detect whether import is possible, we must configure the
import methods in standalone mode, or disable them in wsgi mode. The
referenced Glance patch will make this a requirement.

Change-Id: I3bf3498d83607c5e98b70877c061dc54fc3c0a6e
Needed-By: https://review.opendev.org/#/c/741497/
---
 lib/glance | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/glance b/lib/glance
index e941168d32..0f7cd61d72 100644
--- a/lib/glance
+++ b/lib/glance
@@ -183,6 +183,11 @@ function configure_glance {
         iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
     fi
 
+    if [[ "$GLANCE_STANDALONE" == "False" ]]; then
+        # NOTE(danms): Do not advertise import methods if we are running in WSGI mode
+        iniset $GLANCE_API_CONF enabled_import_methods []
+    fi
+
     # No multiple stores for swift yet
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then

From f2577fc574d2d8299b3cfff458702321aca57e44 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Fri, 17 Jul 2020 08:19:40 +0000
Subject: [PATCH 2713/3333] Add missing glance multi-store configurations

While removing registry [1] we by mistake removed some code related to
multiple store configuration for glance. This must be happened during
resolving merged conflicts.

Adding it back.

[1] https://review.opendev.org/708062

Change-Id: I2b84f7b7c51b7b20765a06b48c75006fd2e8ab71
---
 lib/glance | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/glance b/lib/glance
index eebaec2a33..6c9c0dff71 100644
--- a/lib/glance
+++ b/lib/glance
@@ -143,6 +143,16 @@ function configure_glance {
     local dburl
     dburl=`database_connection_url glance`
 
+    # Configure multiple stores
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        local store enabled_backends
+        enabled_backends=""
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            enabled_backends+="${store}:file,"
+        done
+        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+    fi
+
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG

From fcbf3e976c8fa80099698693d37afa81058803c7 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 17 Jul 2020 10:14:14 -0700
Subject: [PATCH 2714/3333] Fix glance standalone when tls-proxy is disabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We always want to start glance on the internal port now,
regardless of whether or not tls-proxy is in use, because we
write_local_proxy_http_config() for the standalone case.

Change-Id: I47dea645d4a852e02e25af0e1df9c28fec92c42a
Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>
---
 lib/glance | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/glance b/lib/glance
index e941168d32..f08e2ed7ab 100644
--- a/lib/glance
+++ b/lib/glance
@@ -252,6 +252,7 @@ function configure_glance {
     else
         write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
 }

From 7700d5a825e48ea5f536e580df5c769a7224afcc Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 20 Jul 2020 17:01:41 -0700
Subject: [PATCH 2715/3333] Fix setting enabled_import_methods if glance is
 standalone

I forgot to update devstack with the section name when I did Grenade.

Change-Id: I928072e935e7a7ec24609cdc4522c96f65d3ba3b
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 5fc7a7f0c3..3e5ebde935 100644
--- a/lib/glance
+++ b/lib/glance
@@ -195,7 +195,7 @@ function configure_glance {
 
     if [[ "$GLANCE_STANDALONE" == "False" ]]; then
         # NOTE(danms): Do not advertise import methods if we are running in WSGI mode
-        iniset $GLANCE_API_CONF enabled_import_methods []
+        iniset $GLANCE_API_CONF DEFAULT enabled_import_methods []
     fi
 
     # No multiple stores for swift yet

From 33f8f6e68419702df3cb4b8d8af2f6587ebae527 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 21 Jul 2020 19:41:48 -0700
Subject: [PATCH 2716/3333] Remove standalone requirement for glance import

As of the referenced patch in glance, we can do import in wsgi mode.
Also remove the enforcement that import methods are disabled.

Change-Id: I8da4b4ad6105bb64c4045ca80db9742591d01564
Depends-On: https://review.opendev.org/#/c/742065
---
 functions  | 6 +-----
 lib/glance | 5 -----
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/functions b/functions
index c34e4874b3..cc1ca6cb25 100644
--- a/functions
+++ b/functions
@@ -114,11 +114,7 @@ function _upload_image {
     properties=$(_image_properties_to_arg $*)
 
     if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
-        if [[ "$GLANCE_STANDALONE" == "True" ]]; then
-            useimport="--import"
-        else
-            echo "*** Unable to use glance import workflow because glance is not standalone! ***"
-        fi
+        useimport="--import"
     fi
 
     openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties < "${image}"
diff --git a/lib/glance b/lib/glance
index 3e5ebde935..2118636a46 100644
--- a/lib/glance
+++ b/lib/glance
@@ -193,11 +193,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
     fi
 
-    if [[ "$GLANCE_STANDALONE" == "False" ]]; then
-        # NOTE(danms): Do not advertise import methods if we are running in WSGI mode
-        iniset $GLANCE_API_CONF DEFAULT enabled_import_methods []
-    fi
-
     # No multiple stores for swift yet
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then

From 32d5b1ea2f7908b3558dd38d32553abeaf5db40b Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 22 Jul 2020 20:52:48 -0500
Subject: [PATCH 2717/3333] Enable image import test

If glance is in standalone mode, image import works
fine so enable the tempest tests. Once we will have image
import or other async tasks working with glance under uwsgi
then we can remove this flag and run import tests by default.

Depends-On: https://review.opendev.org/#/c/741425/
Change-Id: I853e8a3815187f0aa8f05c70488ec948a97e55a6
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 47bdc22311..125749b314 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -345,7 +345,7 @@ function configure_tempest {
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
-
+    iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From dd3731c86a13334125715e44880491042526227c Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Tue, 28 Jul 2020 08:51:41 -0500
Subject: [PATCH 2718/3333] Install bindep packages when installing lib from
 src

Most libs maintain their own system packages in a local bindep.txt file.
We don't currently use those when installing packages from source, which
can result in broken package installs.

This adds a flag to always attempt to install bindep packages if the
bindep.txt file exists. If a file cannot be found, it will just emit a
warning and carry on.

Change-Id: Ia0570f837b8af1c3fee0a314b026a4a7ed27e6a9
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 functions-common | 3 ++-
 lib/libraries    | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 6595c3de53..d99ad9212f 100644
--- a/functions-common
+++ b/functions-common
@@ -1412,7 +1412,8 @@ function install_bindep {
     local pkgs
 
     if [[ ! -f $file ]]; then
-        die $LINENO "Can not find bindep file: $file"
+        warn $LINENO "Can not find bindep file: $file"
+        return
     fi
 
     # converting here makes it much easier to work with passing
diff --git a/lib/libraries b/lib/libraries
index b4f3c31d5e..c7aa8151ae 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -72,7 +72,7 @@ function _install_lib_from_source {
     local name=$1
     if use_library_from_git "$name"; then
         git_clone_by_name "$name"
-        setup_dev_lib "$name"
+        setup_dev_lib -bindep "$name"
     fi
 }
 

From 587e0a3510ea3b40abbdffcd1fe3204e416c4bc9 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Sat, 1 Aug 2020 21:47:55 +0200
Subject: [PATCH 2719/3333] Fix is_fedora RHEL 8 detection

While RHEL 7 is detected as RedHatEnterpriseServer, RHEL 8 is
RedHatEnterprise.

  $ lsb_release -i -s
  RedHatEnterprise

Change-Id: I3d750d808c6ebea9c230f0508cdbc016415b9922
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index d99ad9212f..acb3a6c920 100644
--- a/functions-common
+++ b/functions-common
@@ -451,6 +451,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
+        [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
         [ "$os_VENDOR" = "Virtuozzo" ]
 }

From 04fdd8c9eb37a34bb3155bee1f9d21c5dfb0d794 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sun, 2 Aug 2020 13:13:00 +0200
Subject: [PATCH 2720/3333] Fix propose-updates job

We need to use python3, our deps are no longer installed in python.

Includes the current set of updates to the plugin registry.

Change-Id: I4753ddf60ed066cc11fa74dbbd63210dbad733a8
---
 doc/source/plugin-registry.rst          | 4 +---
 tools/generate-devstack-plugins-list.sh | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index eda5773a25..4e7c2d7b2f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -81,7 +81,6 @@ openstack/networking-hyperv              `https://opendev.org/openstack/networki
 openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__
 openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
 openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
-openstack/networking-onos                `https://opendev.org/openstack/networking-onos <https://opendev.org/openstack/networking-onos>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
@@ -113,7 +112,6 @@ openstack/solum                          `https://opendev.org/openstack/solum <h
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
-openstack/tricircle                      `https://opendev.org/openstack/tricircle <https://opendev.org/openstack/tricircle>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
 openstack/vitrage                        `https://opendev.org/openstack/vitrage <https://opendev.org/openstack/vitrage>`__
@@ -121,6 +119,7 @@ openstack/vitrage-dashboard              `https://opendev.org/openstack/vitrage-
 openstack/vitrage-tempest-plugin         `https://opendev.org/openstack/vitrage-tempest-plugin <https://opendev.org/openstack/vitrage-tempest-plugin>`__
 openstack/watcher                        `https://opendev.org/openstack/watcher <https://opendev.org/openstack/watcher>`__
 openstack/watcher-dashboard              `https://opendev.org/openstack/watcher-dashboard <https://opendev.org/openstack/watcher-dashboard>`__
+openstack/whitebox-tempest-plugin        `https://opendev.org/openstack/whitebox-tempest-plugin <https://opendev.org/openstack/whitebox-tempest-plugin>`__
 openstack/zaqar                          `https://opendev.org/openstack/zaqar <https://opendev.org/openstack/zaqar>`__
 openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui <https://opendev.org/openstack/zaqar-ui>`__
 openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
@@ -199,7 +198,6 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
-x/whitebox-tempest-plugin                `https://opendev.org/x/whitebox-tempest-plugin <https://opendev.org/x/whitebox-tempest-plugin>`__
 ======================================== ===
 
 
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index a3aa7ba63d..3307943df9 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -54,7 +54,7 @@ if [[ -r data/devstack-plugins-registry.header ]]; then
     cat data/devstack-plugins-registry.header
 fi
 
-sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
+sorted_plugins=$(python3 tools/generate-devstack-plugins-list.py)
 
 # find the length of the name column & pad
 name_col_len=$(echo "${sorted_plugins}" | wc -L)

From 1d468d45dbb330c31c28e54d9c9abe5f8ec394ba Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 9 Jun 2020 14:35:52 +0100
Subject: [PATCH 2721/3333] [OVN] Move OVN module from Neutron to DevStack

As part of the Victoria PTG the Neutron team entertained the idea of
having the OVN driver as the default backend in DevStack (this hasn't
yet being decided by the community, this will be discussed within this
cycle).

For this to happen, we also would need to move the module that configures
OVN to the DevStack repository. This is what this patch is doing.

Note that we are updating the lib/neutron-legacy module instead of
lib/neutron in this patch, this is because as part of the PTG the
Neutron team has decided to un-deprecate the neutron-legacy module since
the "new" lib/neutron module is broken and nobody is current working on
it (also all services uses neutron-legacy).

Also, the ovsdbapp has been added to the ALL_LIBS list because a gate
job in the ovsdbapp project repository relies on installing the library
from source instead of pip to run.

Depends-On: https://review.opendev.org/#/c/740663/
Change-Id: Ib4194329474e8d68a90886d2a04f027eecd741df
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron-legacy            |  36 ++
 lib/neutron_plugins/ml2       |  12 +-
 lib/neutron_plugins/ovn_agent | 724 ++++++++++++++++++++++++++++++++++
 stack.sh                      |   5 +
 stackrc                       |   5 +
 tests/test_libs_from_pypi.sh  |   2 +-
 6 files changed, 777 insertions(+), 7 deletions(-)
 create mode 100644 lib/neutron_plugins/ovn_agent

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 59649ef84a..363c62e4c2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -362,6 +362,14 @@ function configure_mutnauq {
         _configure_neutron_ceilometer_notifications
     fi
 
+    if [[ $Q_AGENT == "ovn" ]]; then
+        configure_ovn
+        if is_service_enabled q-port-forwarding neutron-port-forwarding; then
+            configure_port_forwarding
+        fi
+        configure_ovn_plugin
+    fi
+
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
     # devstack is not a tool for running uber scale OpenStack
     # clouds, therefore running without a dedicated RPC worker
@@ -438,6 +446,10 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        install_ovn
+    fi
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
@@ -459,6 +471,22 @@ function configure_neutron_after_post_config {
     fi
 }
 
+# Start running OVN processes
+function start_ovn_services {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        init_ovn
+        start_ovn
+        if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
+            if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
+                echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "
+                echo "because NEUTRON_CREATE_INITIAL_NETWORKS is set to False"
+            else
+                create_public_bridge
+            fi
+        fi
+    fi
+}
+
 # Start running processes
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
@@ -575,6 +603,10 @@ function stop_mutnauq_other {
 function stop_mutnauq {
     stop_mutnauq_other
     stop_mutnauq_l2_agent
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        stop_ovn
+    fi
 }
 
 # _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
@@ -668,6 +700,10 @@ function cleanup_mutnauq {
     for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        cleanup_ovn
+    fi
 }
 
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 497b6c6bdc..ae4b251d83 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -7,6 +7,12 @@
 _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
+# Default openvswitch L2 agent
+Q_AGENT=${Q_AGENT:-openvswitch}
+if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
+    source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
+fi
+
 # Enable this to simply and quickly enable tunneling with ML2.
 # Select either 'gre', 'vxlan', or 'gre,vxlan'
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
@@ -17,12 +23,6 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
     Q_TUNNEL_TYPES=gre
 fi
 
-# Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-openvswitch}
-if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
-    source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
-fi
-
 # List of MechanismDrivers to load
 Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
 # Default GRE TypeDriver options
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
new file mode 100644
index 0000000000..e29b84fa48
--- /dev/null
+++ b/lib/neutron_plugins/ovn_agent
@@ -0,0 +1,724 @@
+#!/bin/bash
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+
+# Global Sources
+# --------------
+
+# There are some ovs functions OVN depends on that must be sourced from
+# the ovs neutron plugins.
+source ${TOP_DIR}/lib/neutron_plugins/ovs_base
+source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
+
+# Load devstack ovs base functions
+source $NEUTRON_DIR/devstack/lib/ovs
+
+
+# Defaults
+# --------
+
+# Set variables for building OVN from source
+OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
+OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
+OVN_REPO_NAME=${OVN_REPO_NAME:-ovn}
+OVN_BRANCH=${OVN_BRANCH:-v20.06.1}
+# The commit removing OVN bits from the OVS tree, it is the commit that is not
+# present in OVN tree and is used to distinguish if OVN is part of OVS or not.
+# https://github.com/openvswitch/ovs/commit/05bf1dbb98b0635a51f75e268ef8aed27601401d
+OVN_SPLIT_HASH=05bf1dbb98b0635a51f75e268ef8aed27601401d
+
+if is_service_enabled tls-proxy; then
+    OVN_PROTO=ssl
+else
+    OVN_PROTO=tcp
+fi
+
+# How to connect to ovsdb-server hosting the OVN SB database.
+OVN_SB_REMOTE=${OVN_SB_REMOTE:-$OVN_PROTO:$SERVICE_HOST:6642}
+
+# How to connect to ovsdb-server hosting the OVN NB database
+OVN_NB_REMOTE=${OVN_NB_REMOTE:-$OVN_PROTO:$SERVICE_HOST:6641}
+
+# ml2/config for neutron_sync_mode
+OVN_NEUTRON_SYNC_MODE=${OVN_NEUTRON_SYNC_MODE:-log}
+
+# Configured DNS servers to be used with internal_dns extension, only
+# if the subnet DNS is not configured.
+OVN_DNS_SERVERS=${OVN_DNS_SERVERS:-8.8.8.8}
+
+# The type of OVN L3 Scheduler to use. The OVN L3 Scheduler determines the
+# hypervisor/chassis where a routers gateway should be hosted in OVN. The
+# default OVN L3 scheduler is leastloaded
+OVN_L3_SCHEDULER=${OVN_L3_SCHEDULER:-leastloaded}
+
+# A UUID to uniquely identify this system.  If one is not specified, a random
+# one will be generated.  A randomly generated UUID will be saved in a file
+# 'ovn-uuid' so that the same one will be re-used if you re-run DevStack.
+OVN_UUID=${OVN_UUID:-}
+
+# Whether or not to build the openvswitch kernel module from ovs.  This is required
+# unless the distro kernel includes ovs+conntrack support.
+OVN_BUILD_MODULES=$(trueorfalse False OVN_BUILD_MODULES)
+
+# Whether or not to install the ovs python module from ovs source.  This can be
+# used to test and validate new ovs python features.  This should only be used
+# for development purposes since the ovs python version is controlled by OpenStack
+# requirements.
+OVN_INSTALL_OVS_PYTHON_MODULE=$(trueorfalse False OVN_INSTALL_OVS_PYTHON_MODULE)
+
+# GENEVE overlay protocol overhead. Defaults to 38 bytes plus the IP version
+# overhead (20 bytes for IPv4 (default) or 40 bytes for IPv6) which is determined
+# based on the ML2 overlay_ip_version option. The ML2 framework will use this to
+# configure the MTU DHCP option.
+OVN_GENEVE_OVERHEAD=${OVN_GENEVE_OVERHEAD:-38}
+
+# The log level of the OVN databases (north and south)
+OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
+
+OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
+OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
+
+OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+
+OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
+
+OVS_PREFIX=/usr/local
+OVS_SBINDIR=$OVS_PREFIX/sbin
+OVS_BINDIR=$OVS_PREFIX/bin
+OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
+OVS_SHAREDIR=$OVS_PREFIX/share/openvswitch
+OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
+OVS_DATADIR=$DATA_DIR/ovs
+
+OVN_DATADIR=$DATA_DIR/ovn
+OVN_SHAREDIR=$OVS_PREFIX/share/ovn
+OVN_SCRIPTDIR=$OVN_SHAREDIR/scripts
+OVN_RUNDIR=$OVS_PREFIX/var/run/ovn
+
+NEUTRON_OVN_BIN_DIR=$(get_python_exec_prefix)
+NEUTRON_OVN_METADATA_BINARY="neutron-ovn-metadata-agent"
+
+STACK_GROUP="$( id --group --name "$STACK_USER" )"
+
+# Defaults Overwrite
+# ------------------
+
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
+Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
+Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}
+Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,dns,qos}
+# this one allows empty:
+ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
+
+
+# Utility Functions
+# -----------------
+
+function use_new_ovn_repository {
+    if [ -z "$is_new_ovn" ]; then
+        local ovs_repo_dir=$DEST/$OVS_REPO_NAME
+        if [ ! -d $ovs_repo_dir ]; then
+            clone_repository $OVS_REPO $ovs_repo_dir $OVS_BRANCH
+        fi
+        # Check the split commit exists in the current branch
+        pushd $ovs_repo_dir
+        git log $OVS_BRANCH --pretty=format:"%H" | grep -q $OVN_SPLIT_HASH
+        is_new_ovn=$?
+        popd
+    fi
+    return $is_new_ovn
+}
+
+# NOTE(rtheis): Function copied from DevStack _neutron_ovs_base_setup_bridge
+# and _neutron_ovs_base_add_bridge with the call to neutron-ovs-cleanup
+# removed. The call is not relevant for OVN, as it is specific to the use
+# of Neutron's OVS agent and hangs when running stack.sh because
+# neutron-ovs-cleanup uses the OVSDB native interface.
+function ovn_base_setup_bridge {
+    local bridge=$1
+    local addbr_cmd="ovs-vsctl --no-wait -- --may-exist add-br $bridge -- set bridge $bridge protocols=OpenFlow13,OpenFlow15"
+
+    if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
+        addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
+    fi
+
+    $addbr_cmd
+    ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
+}
+
+function _start_process {
+    $SYSTEMCTL daemon-reload
+    $SYSTEMCTL enable $1
+    $SYSTEMCTL restart $1
+}
+
+function _run_process {
+    local service=$1
+    local cmd="$2"
+    local stop_cmd="$3"
+    local group=$4
+    local user=${5:-$STACK_USER}
+
+    local systemd_service="devstack@$service.service"
+    local unit_file="$SYSTEMD_DIR/$systemd_service"
+    local environment="OVN_RUNDIR=$OVS_RUNDIR OVN_DBDIR=$OVN_DATADIR OVN_LOGDIR=$LOGDIR OVS_RUNDIR=$OVS_RUNDIR OVS_DBDIR=$OVS_DATADIR OVS_LOGDIR=$LOGDIR"
+
+    echo "Starting $service executed command": $cmd
+
+    write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    iniset -sudo $unit_file "Service" "Type" "forking"
+    iniset -sudo $unit_file "Service" "RemainAfterExit" "yes"
+    iniset -sudo $unit_file "Service" "KillMode" "mixed"
+    iniset -sudo $unit_file "Service" "LimitNOFILE" "65536"
+    iniset -sudo $unit_file "Service" "Environment" "$environment"
+    if [ -n "$stop_cmd" ]; then
+        iniset -sudo $unit_file "Service" "ExecStop" "$stop_cmd"
+    fi
+
+    _start_process $systemd_service
+
+    local testcmd="test -e $OVS_RUNDIR/$service.pid"
+    test_with_retry "$testcmd" "$service did not start" $SERVICE_TIMEOUT 1
+    sudo ovs-appctl -t $service vlog/set console:off syslog:info file:info
+}
+
+function clone_repository {
+    local repo=$1
+    local dir=$2
+    local branch=$3
+    # Set ERROR_ON_CLONE to false to avoid the need of having the
+    # repositories like OVN and OVS in the required_projects of the job
+    # definition.
+    ERROR_ON_CLONE=false git_clone $repo $dir $branch
+}
+
+function get_ext_gw_interface {
+    # Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
+    # This function is copied directly from the devstack neutron-legacy script
+    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
+        echo $Q_PUBLIC_VETH_EX
+    else
+        # Disable in-band as we are going to use local port
+        # to communicate with VMs
+        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+            other_config:disable-in-band=true
+        echo $PUBLIC_BRIDGE
+    fi
+}
+
+function create_public_bridge {
+    # Create the public bridge that OVN will use
+    # This logic is based on the devstack neutron-legacy _neutron_configure_router_v4 and _v6
+    local ext_gw_ifc
+    ext_gw_ifc=$(get_ext_gw_interface)
+
+    ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
+    ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
+    if [ -n "$FLOATING_RANGE" ]; then
+        local cidr_len=${FLOATING_RANGE#*/}
+        sudo ip addr flush dev $ext_gw_ifc
+        sudo ip addr add $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
+    fi
+
+    # Ensure IPv6 RAs are accepted on the interface with the default route.
+    # This is needed for neutron-based devstack clouds to work in
+    # IPv6-only clouds in the gate. Please do not remove this without
+    # talking to folks in Infra. This fix is based on a devstack fix for
+    # neutron L3 agent: https://review.openstack.org/#/c/359490/.
+    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+    sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
+
+    sudo sysctl -w net.ipv6.conf.all.forwarding=1
+    if [ -n "$IPV6_PUBLIC_RANGE" ]; then
+        local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
+        sudo ip -6 addr flush dev $ext_gw_ifc
+        sudo ip -6 addr add $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
+    fi
+
+    sudo ip link set $ext_gw_ifc up
+}
+
+function _disable_libvirt_apparmor {
+    if ! sudo aa-status --enabled ; then
+        return 0
+    fi
+    # NOTE(arosen): This is used as a work around to allow newer versions
+    # of libvirt to work with ovs configured ports. See LP#1466631.
+    # requires the apparmor-utils
+    install_package apparmor-utils
+    # disables apparmor for libvirtd
+    sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd
+}
+
+
+# OVN compilation functions
+# -------------------------
+
+
+# compile_ovn() - Compile OVN from source and load needed modules
+#                 Accepts three parameters:
+#                   - first optional is False by default and means that
+#                     modules are built and installed.
+#                   - second optional parameter defines prefix for
+#                     ovn compilation
+#                   - third optional parameter defines localstatedir for
+#                     ovn single machine runtime
+function compile_ovn {
+    local build_modules=${1:-False}
+    local prefix=$2
+    local localstatedir=$3
+
+    if [ -n "$prefix" ]; then
+        prefix="--prefix=$prefix"
+    fi
+
+    if [ -n "$localstatedir" ]; then
+        localstatedir="--localstatedir=$localstatedir"
+    fi
+
+    clone_repository $OVN_REPO $DEST/$OVN_REPO_NAME $OVN_BRANCH
+    pushd $DEST/$OVN_REPO_NAME
+
+    if [ ! -f configure ] ; then
+        ./boot.sh
+    fi
+
+    if [ ! -f config.status ] || [ configure -nt config.status ] ; then
+        ./configure --with-ovs-source=$DEST/$OVS_REPO_NAME $prefix $localstatedir
+    fi
+    make -j$(($(nproc) + 1))
+    sudo make install
+    popd
+}
+
+
+# OVN Neutron driver functions
+# ----------------------------
+
+# OVN service sanity check
+function ovn_sanity_check {
+    if is_service_enabled q-agt neutron-agt; then
+        die $LINENO "The q-agt/neutron-agt service must be disabled with OVN."
+    elif is_service_enabled q-l3 neutron-l3; then
+        die $LINENO "The q-l3/neutron-l3 service must be disabled with OVN."
+    elif is_service_enabled q-svc neutron-api && [[ ! $Q_ML2_PLUGIN_MECHANISM_DRIVERS =~ "ovn" ]]; then
+        die $LINENO "OVN needs to be enabled in \$Q_ML2_PLUGIN_MECHANISM_DRIVERS"
+    elif is_service_enabled q-svc neutron-api && [[ ! $Q_ML2_PLUGIN_TYPE_DRIVERS =~ "geneve" ]]; then
+        die $LINENO "Geneve needs to be enabled in \$Q_ML2_PLUGIN_TYPE_DRIVERS to be used with OVN"
+    fi
+}
+
+# install_ovn() - Collect source and prepare
+function install_ovn {
+    echo "Installing OVN and dependent packages"
+
+    # Check the OVN configuration
+    ovn_sanity_check
+
+    # If OVS is already installed, remove it, because we're about to re-install
+    # it from source.
+    for package in openvswitch openvswitch-switch openvswitch-common; do
+        if is_package_installed $package ; then
+            uninstall_package $package
+        fi
+    done
+
+    # Install tox, used to generate the config (see devstack/override-defaults)
+    pip_install tox
+    remove_ovs_packages
+    sudo rm -f $OVS_RUNDIR/*
+
+    compile_ovs $OVN_BUILD_MODULES
+    if use_new_ovn_repository; then
+        compile_ovn $OVN_BUILD_MODULES
+    fi
+
+    # Ensure that the OVS commands are accessible in the PATH
+    OVS_BINDIR=${OVS_BINDIR:-/usr/local/bin}
+    export PATH=$OVS_BINDIR:$PATH
+
+    sudo mkdir -p $OVS_RUNDIR
+    sudo chown $(whoami) $OVS_RUNDIR
+    sudo mkdir -p $OVS_PREFIX/var/log/openvswitch
+    sudo chown $(whoami) $OVS_PREFIX/var/log/openvswitch
+    sudo mkdir -p $OVS_PREFIX/var/log/ovn
+    sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
+
+    # Archive log files and create new
+    local log_archive_dir=$LOGDIR/archive
+    mkdir -p $log_archive_dir
+    for logfile in ovs-vswitchd.log ovn-northd.log ovn-controller.log ovn-controller-vtep.log ovs-vtep.log ovsdb-server.log ovsdb-server-nb.log ovsdb-server-sb.log; do
+        if [ -f "$LOGDIR/$logfile" ] ; then
+            mv "$LOGDIR/$logfile"  "$log_archive_dir/$logfile.${CURRENT_LOG_TIME}"
+        fi
+    done
+
+    # Install ovsdbapp from source if requested
+    if use_library_from_git "ovsdbapp"; then
+        git_clone_by_name "ovsdbapp"
+        setup_dev_lib "ovsdbapp"
+    fi
+
+    # Install ovs python module from ovs source.
+    if [[ "$OVN_INSTALL_OVS_PYTHON_MODULE" == "True" ]]; then
+        sudo pip uninstall -y ovs
+        # Clone the OVS repository if it's not yet present
+        clone_repository $OVS_REPO $DEST/$OVS_REPO_NAME $OVS_BRANCH
+        sudo pip install -e $DEST/$OVS_REPO_NAME/python
+    fi
+}
+
+# filter_network_api_extensions() - Remove non-supported API extensions by
+# the OVN driver from the list of enabled API extensions
+function filter_network_api_extensions {
+    SUPPORTED_NETWORK_API_EXTENSIONS=$($PYTHON -c \
+        'from neutron.common.ovn import extensions ;\
+        print(",".join(extensions.ML2_SUPPORTED_API_EXTENSIONS))')
+    SUPPORTED_NETWORK_API_EXTENSIONS=$SUPPORTED_NETWORK_API_EXTENSIONS,$($PYTHON -c \
+        'from neutron.common.ovn import extensions ;\
+        print(",".join(extensions.ML2_SUPPORTED_API_EXTENSIONS_OVN_L3))')
+    if is_service_enabled q-qos neutron-qos ; then
+        SUPPORTED_NETWORK_API_EXTENSIONS="$SUPPORTED_NETWORK_API_EXTENSIONS,qos"
+    fi
+    NETWORK_API_EXTENSIONS=${NETWORK_API_EXTENSIONS:-$SUPPORTED_NETWORK_API_EXTENSIONS}
+    extensions=$(echo $NETWORK_API_EXTENSIONS | tr ', ' '\n' | sort -u)
+    supported_ext=$(echo $SUPPORTED_NETWORK_API_EXTENSIONS | tr ', ' '\n' | sort -u)
+    enabled_ext=$(comm -12 <(echo -e "$extensions") <(echo -e "$supported_ext"))
+    disabled_ext=$(comm -3 <(echo -e "$extensions") <(echo -e "$enabled_ext"))
+
+    # Log a message in case some extensions had to be disabled because
+    # they are not supported by the OVN driver
+    if [ ! -z "$disabled_ext" ]; then
+        _disabled=$(echo $disabled_ext | tr ' ' ',')
+        echo "The folling network API extensions have been disabled because they are not supported by OVN: $_disabled"
+    fi
+
+    # Export the final list of extensions that have been enabled and are
+    # supported by OVN
+    export NETWORK_API_EXTENSIONS=$(echo $enabled_ext | tr ' ' ',')
+}
+
+function configure_ovn_plugin {
+    echo "Configuring Neutron for OVN"
+
+    if is_service_enabled q-svc ; then
+        filter_network_api_extensions
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_geneve max_header_size=$OVN_GENEVE_OVERHEAD
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_connection="$OVN_NB_REMOTE"
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_connection="$OVN_SB_REMOTE"
+        if is_service_enabled tls-proxy; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_ca_cert="$INT_CA_DIR/ca-chain.pem"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_certificate="$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_private_key="$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_ca_cert="$INT_CA_DIR/ca-chain.pem"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_certificate="$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_private_key="$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key"
+        fi
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn neutron_sync_mode="$OVN_NEUTRON_SYNC_MODE"
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_l3_scheduler="$OVN_L3_SCHEDULER"
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group="$Q_USE_SECGROUP"
+        inicomment /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver
+
+        if is_service_enabled q-ovn-metadata-agent; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
+        else
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
+        fi
+
+        if is_service_enabled q-dns neutron-dns ; then
+            iniset $NEUTRON_CONF DEFAULT dns_domain openstackgate.local
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn dns_servers="$OVN_DNS_SERVERS"
+        fi
+
+        iniset $NEUTRON_CONF ovs igmp_snooping_enable $OVN_IGMP_SNOOPING_ENABLE
+    fi
+
+    if is_service_enabled q-dhcp neutron-dhcp ; then
+        iniset $NEUTRON_CONF DEFAULT dhcp_agent_notification True
+    else
+        iniset $NEUTRON_CONF DEFAULT dhcp_agent_notification False
+    fi
+
+    if is_service_enabled n-api-meta ; then
+        if is_service_enabled q-ovn-metadata-agent ; then
+            iniset $NOVA_CONF neutron service_metadata_proxy True
+        fi
+    fi
+}
+
+function configure_ovn {
+    echo "Configuring OVN"
+
+    if [ -z "$OVN_UUID" ] ; then
+        if [ -f ./ovn-uuid ] ; then
+            OVN_UUID=$(cat ovn-uuid)
+        else
+            OVN_UUID=$(uuidgen)
+            echo $OVN_UUID > ovn-uuid
+        fi
+    fi
+
+    # Metadata
+    if is_service_enabled q-ovn-metadata-agent && is_service_enabled ovn-controller; then
+        sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+
+        mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2
+        (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+        cp $NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample $OVN_META_CONF
+        configure_root_helper_options $OVN_META_CONF
+
+        iniset $OVN_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
+        iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
+        iniset $OVN_META_CONF DEFAULT state_path $NEUTRON_STATE_PATH
+        iniset $OVN_META_CONF ovs ovsdb_connection unix:$OVS_RUNDIR/db.sock
+        iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
+        if is_service_enabled tls-proxy; then
+            iniset $OVN_META_CONF ovn \
+                ovn_sb_ca_cert $INT_CA_DIR/ca-chain.pem
+            iniset $OVN_META_CONF ovn \
+                ovn_sb_certificate $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt
+            iniset $OVN_META_CONF ovn \
+                ovn_sb_private_key $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key
+        fi
+    fi
+}
+
+function init_ovn {
+    # clean up from previous (possibly aborted) runs
+    # create required data files
+
+    # Assumption: this is a dedicated test system and there is nothing important
+    # in the ovn, ovn-nb, or ovs databases.  We're going to trash them and
+    # create new ones on each devstack run.
+
+    _disable_libvirt_apparmor
+
+    mkdir -p $OVN_DATADIR
+    mkdir -p $OVS_DATADIR
+
+    rm -f $OVS_DATADIR/*.db
+    rm -f $OVS_DATADIR/.*.db.~lock~
+    rm -f $OVN_DATADIR/*.db
+    rm -f $OVN_DATADIR/.*.db.~lock~
+}
+
+function _start_ovs {
+    echo "Starting OVS"
+    if is_service_enabled ovn-controller ovn-controller-vtep ovn-northd; then
+        # ovsdb-server and ovs-vswitchd are used privately in OVN as openvswitch service names.
+        enable_service ovsdb-server
+        enable_service ovs-vswitchd
+
+        if [ ! -f $OVS_DATADIR/conf.db ]; then
+            ovsdb-tool create $OVS_DATADIR/conf.db $OVS_SHAREDIR/vswitch.ovsschema
+        fi
+
+        if is_service_enabled ovn-controller-vtep; then
+            if [ ! -f $OVS_DATADIR/vtep.db ]; then
+                ovsdb-tool create $OVS_DATADIR/vtep.db $OVS_SHAREDIR/vtep.ovsschema
+            fi
+        fi
+
+        local dbcmd="$OVS_SBINDIR/ovsdb-server --remote=punix:$OVS_RUNDIR/db.sock --remote=ptcp:6640:$OVSDB_SERVER_LOCAL_HOST --pidfile --detach --log-file"
+        dbcmd+=" --remote=db:Open_vSwitch,Open_vSwitch,manager_options"
+        if is_service_enabled ovn-controller-vtep; then
+            dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
+        fi
+        dbcmd+=" $OVS_DATADIR/conf.db"
+        _run_process ovsdb-server "$dbcmd"
+
+        echo "Configuring OVSDB"
+        if is_service_enabled tls-proxy; then
+            ovs-vsctl --no-wait set-ssl \
+                $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+                $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
+                $INT_CA_DIR/ca-chain.pem
+        fi
+        ovs-vsctl --no-wait set open_vswitch . system-type="devstack"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:system-id="$OVN_UUID"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+        # Select this chassis to host gateway routers
+        if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
+            ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
+        fi
+
+        # Note: ovn-controller will create and configure br-int once it is started.
+        # So, no need to create it now because nothing depends on that bridge here.
+
+        local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
+        _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
+
+        if is_provider_network || [[ $Q_USE_PROVIDERNET_FOR_PUBLIC == "True" ]]; then
+            ovn_base_setup_bridge $OVS_PHYSICAL_BRIDGE
+            ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
+        fi
+
+        if is_service_enabled ovn-controller-vtep ; then
+            ovn_base_setup_bridge br-v
+            vtep-ctl add-ps br-v
+            vtep-ctl set Physical_Switch br-v tunnel_ips=$HOST_IP
+
+            enable_service ovs-vtep
+            local vtepcmd="$OVS_SCRIPTDIR/ovs-vtep --log-file --pidfile --detach br-v"
+            _run_process ovs-vtep "$vtepcmd" "" "$STACK_GROUP" "root"
+
+            vtep-ctl set-manager tcp:$HOST_IP:6640
+        fi
+    fi
+}
+
+function _start_ovn_services {
+    _start_process "devstack@ovsdb-server.service"
+    _start_process "devstack@ovs-vswitchd.service"
+
+    if is_service_enabled ovs-vtep ; then
+        _start_process "devstack@ovs-vtep.service"
+    fi
+    if is_service_enabled ovn-northd ; then
+        _start_process "devstack@ovn-northd.service"
+    fi
+    if is_service_enabled ovn-controller ; then
+        _start_process "devstack@ovn-controller.service"
+    fi
+    if is_service_enabled ovn-controller-vtep ; then
+        _start_process "devstack@ovn-controller-vtep.service"
+    fi
+    if is_service_enabled q-ovn-metadata-agent; then
+        _start_process "devstack@q-ovn-metadata-agent.service"
+    fi
+}
+
+# start_ovn() - Start running processes, including screen
+function start_ovn {
+    echo "Starting OVN"
+
+    _start_ovs
+
+    local SCRIPTDIR=$OVN_SCRIPTDIR
+    if ! use_new_ovn_repository; then
+        SCRIPTDIR=$OVS_SCRIPTDIR
+    fi
+
+    if is_service_enabled ovn-northd ; then
+        if is_service_enabled tls-proxy; then
+            local tls_args="\
+                --ovn-nb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
+                --ovn-nb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
+                --ovn-nb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+                --ovn-sb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
+                --ovn-sb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
+                --ovn-sb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+                "
+        else
+            local tls_args=""
+        fi
+        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor $tls_args start_northd"
+        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
+
+        _run_process ovn-northd "$cmd" "$stop_cmd"
+        ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovs-appctl -t $OVS_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+        sudo ovs-appctl -t $OVS_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+    fi
+
+    if is_service_enabled ovn-controller ; then
+        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
+        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
+
+        _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+    fi
+
+    if is_service_enabled ovn-controller-vtep ; then
+        local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
+
+        _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+    fi
+
+    if is_service_enabled q-ovn-metadata-agent; then
+        run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
+        # Format logging
+        setup_logging $OVN_META_CONF
+    fi
+
+    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
+    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
+    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
+    if use_new_ovn_repository; then
+        sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
+    fi
+
+    _start_ovn_services
+}
+
+function _stop_ovs_dp {
+    sudo ovs-dpctl dump-dps | sudo xargs -n1 ovs-dpctl del-dp
+    modprobe -q -r vport_geneve vport_vxlan openvswitch || true
+}
+
+function stop_ovn {
+    if is_service_enabled q-ovn-metadata-agent; then
+        sudo pkill -9 -f haproxy || :
+        stop_process neutron-ovn-metadata-agent
+    fi
+    if is_service_enabled ovn-controller-vtep ; then
+        stop_process ovn-controller-vtep
+    fi
+    if is_service_enabled ovn-controller ; then
+        stop_process ovn-controller
+    fi
+    if is_service_enabled ovn-northd ; then
+        stop_process ovn-northd
+    fi
+    if is_service_enabled ovs-vtep ; then
+        stop_process ovs-vtep
+    fi
+
+    stop_process ovs-vswitchd
+    stop_process ovsdb-server
+
+    _stop_ovs_dp
+}
+
+function _cleanup {
+    local path=${1:-$DEST/$OVN_REPO_NAME}
+    pushd $path
+    cd $path
+    sudo make uninstall
+    sudo make distclean
+    popd
+}
+
+# cleanup_ovn() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_ovn {
+    local ovn_path=$DEST/$OVN_REPO_NAME
+    local ovs_path=$DEST/$OVS_REPO_NAME
+
+    if [ -d $ovn_path ]; then
+        _cleanup $ovn_path
+    fi
+
+    if [ -d $ovs_path ]; then
+        _cleanup $ovs_path
+    fi
+
+    sudo rm -f $OVN_RUNDIR
+}
diff --git a/stack.sh b/stack.sh
index 85640d5390..ba9da638a8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1267,6 +1267,11 @@ if is_service_enabled n-api; then
     start_nova_api
 fi
 
+if is_service_enabled ovn-controller ovn-controller-vtep; then
+    echo_summary "Starting OVN services"
+    start_ovn_services
+fi
+
 if is_service_enabled neutron-api; then
     echo_summary "Starting Neutron"
     start_neutron_api
diff --git a/stackrc b/stackrc
index 4ffd537ef4..bf1ad3d85d 100644
--- a/stackrc
+++ b/stackrc
@@ -549,6 +549,11 @@ GITDIR["neutron-lib"]=$DEST/neutron-lib
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
 GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
 
+# ovsdbapp used by neutron
+GITREPO["ovsdbapp"]=${OVSDBAPP_REPO:-${GIT_BASE}/openstack/ovsdbapp.git}
+GITBRANCH["ovsdbapp"]=${OVSDBAPP_BRANCH:-$TARGET_BRANCH}
+GITDIR["ovsdbapp"]=$DEST/ovsdbapp
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index c3b4457171..ab7583d042 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 52e52d8937e8e57b2bc16f67c3651a358fa6fb77 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Thu, 13 Aug 2020 09:55:08 +0200
Subject: [PATCH 2722/3333] Add a dependency file for os-brick (and add lsscsi)

There are a few dependencies which are really os-brick-specific.
They are listed in its bindep.txt file, but os-brick is usually
installed from pip, so its bindep.txt file is not available.

As those dependencies are needed by the various services
which use os-brick, move them to their own dependency file
(with the addition of the new lsscsi, required by the next
os-brick stable release) and make sure that file is parsed
when installing the services which require os-brick.

Side note: there should be a way to avoid this duplication
also for pip-installed libraries (normal services can use
files/ or even bindep, but in this case the source is not always
available), (temporarily?) duplicate them, as it has been
the case for the other os-brick dependencies already listed here.

Change-Id: I9ab6e215dbef9ebdb1946da2f9a40ce020ecc95b
---
 files/debs/cinder        | 2 --
 files/debs/os-brick      | 3 +++
 files/rpms-suse/cinder   | 1 -
 files/rpms-suse/os-brick | 2 ++
 files/rpms/cinder        | 1 -
 files/rpms/os-brick      | 2 ++
 functions-common         | 9 +++++++++
 7 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 files/debs/os-brick
 create mode 100644 files/rpms-suse/os-brick
 create mode 100644 files/rpms/os-brick

diff --git a/files/debs/cinder b/files/debs/cinder
index c1b79fda47..5d390e24bf 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,6 +1,4 @@
 lvm2
-open-iscsi
-open-iscsi-utils # Deprecated since quantal dist:precise
 qemu-utils
 tgt # NOPRIME
 thin-provisioning-tools
diff --git a/files/debs/os-brick b/files/debs/os-brick
new file mode 100644
index 0000000000..4148b0c421
--- /dev/null
+++ b/files/debs/os-brick
@@ -0,0 +1,3 @@
+lsscsi
+open-iscsi
+open-iscsi-utils # Deprecated since quantal dist:precise
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 189a232fa7..b39cc79a27 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,4 +1,3 @@
 lvm2
-open-iscsi
 qemu-tools
 tgt # NOPRIME
diff --git a/files/rpms-suse/os-brick b/files/rpms-suse/os-brick
new file mode 100644
index 0000000000..67b33a9861
--- /dev/null
+++ b/files/rpms-suse/os-brick
@@ -0,0 +1,2 @@
+lsscsi
+open-iscsi
diff --git a/files/rpms/cinder b/files/rpms/cinder
index c21ea08e89..375f93e090 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,4 +1,3 @@
-iscsi-initiator-utils
 lvm2
 qemu-img
 targetcli
diff --git a/files/rpms/os-brick b/files/rpms/os-brick
new file mode 100644
index 0000000000..14ff870557
--- /dev/null
+++ b/files/rpms/os-brick
@@ -0,0 +1,2 @@
+iscsi-initiator-utils
+lsscsi
diff --git a/functions-common b/functions-common
index d99ad9212f..549f7e8cdc 100644
--- a/functions-common
+++ b/functions-common
@@ -1219,10 +1219,16 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/glance ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/glance"
             fi
+            if [[ ! $file_to_parse =~ $package_dir/os-brick ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/os-brick"
+            fi
         elif [[ $service == c-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/cinder ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/cinder"
             fi
+            if [[ ! $file_to_parse =~ $package_dir/os-brick ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/os-brick"
+            fi
         elif [[ $service == s-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/swift ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/swift"
@@ -1231,6 +1237,9 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/nova ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/nova"
             fi
+            if [[ ! $file_to_parse =~ $package_dir/os-brick ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/os-brick"
+            fi
         elif [[ $service == g-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/glance ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/glance"

From 6fba3fdfa1e4d15c8e6128a3a426e499b221d2d2 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 18 Aug 2020 22:29:49 +0200
Subject: [PATCH 2723/3333] New get-devstack-os-environment role

The role reads the OS_* variables set by devstack through openrc
for the specified user and project and exports them as
the os_env_vars fact. It is meant to be used as a porting aid
for the jobs of the non-unified *clients only.

This is useful to run functional tests against the generated
environment. A slightly less generic version of this role
is currently used by python-cinderclient and python-novaclient
(get-os-environment).

In order to make this more useful, call it from
devstack-tox-functional and derived jobs. The role
execution is disabled by default and it can be enabled
by setting openrc_enable_export: true.

Change-Id: I15f5a187dbc54c82e8f4a08b4bb58d56e0d66961
---
 playbooks/tox/run-both.yaml                   |  4 +-
 playbooks/tox/run.yaml                        |  4 +-
 roles/get-devstack-os-environment/README.rst  | 40 +++++++++++++++++++
 .../defaults/main.yaml                        |  5 +++
 .../tasks/main.yaml                           | 14 +++++++
 5 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 roles/get-devstack-os-environment/README.rst
 create mode 100644 roles/get-devstack-os-environment/defaults/main.yaml
 create mode 100644 roles/get-devstack-os-environment/tasks/main.yaml

diff --git a/playbooks/tox/run-both.yaml b/playbooks/tox/run-both.yaml
index e85c2eee96..0528b46f00 100644
--- a/playbooks/tox/run-both.yaml
+++ b/playbooks/tox/run-both.yaml
@@ -7,4 +7,6 @@
       bindep_dir: "{{ zuul_work_dir }}"
     - test-setup
     - ensure-tox
-    - tox
+    - get-devstack-os-environment
+    - role: tox
+      tox_environment: "{{ os_env_vars|default({}) }}"
diff --git a/playbooks/tox/run.yaml b/playbooks/tox/run.yaml
index 22f82096c7..6e549d3655 100644
--- a/playbooks/tox/run.yaml
+++ b/playbooks/tox/run.yaml
@@ -1,3 +1,5 @@
 - hosts: all
   roles:
-    - tox
+    - get-devstack-os-environment
+    - role: tox
+      tox_environment: "{{ os_env_vars|default({}) }}"
diff --git a/roles/get-devstack-os-environment/README.rst b/roles/get-devstack-os-environment/README.rst
new file mode 100644
index 0000000000..68ddce8b5a
--- /dev/null
+++ b/roles/get-devstack-os-environment/README.rst
@@ -0,0 +1,40 @@
+Reads the OS_* variables set by devstack through openrc
+for the specified user and project and exports them as
+the os_env_vars fact.
+
+**WARNING**: this role is meant to be used as porting aid
+for the non-unified python-<service>client jobs which
+are already around, as those clients do not use clouds.yaml
+as openstackclient does.
+When those clients and their jobs are deprecated and removed,
+or anyway when the new code is able to read from clouds.yaml
+directly, this role should be removed as well.
+
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: openrc_file
+   :default: {{ devstack_base_dir }}/devstack/openrc
+
+   The location of the generated openrc file.
+
+.. zuul:rolevar:: openrc_user
+   :default: admin
+
+   The user whose credentials should be retrieved.
+
+.. zuul:rolevar:: openrc_project
+   :default: admin
+
+   The project (which openrc_user is part of) whose
+   access data should be retrieved.
+
+.. zuul:rolevar:: openrc_enable_export
+   :default: false
+
+   Set it to true to export os_env_vars.
diff --git a/roles/get-devstack-os-environment/defaults/main.yaml b/roles/get-devstack-os-environment/defaults/main.yaml
new file mode 100644
index 0000000000..73ecfe920c
--- /dev/null
+++ b/roles/get-devstack-os-environment/defaults/main.yaml
@@ -0,0 +1,5 @@
+devstack_base_dir: "/opt/stack"
+openrc_file: "{{ devstack_base_dir }}/devstack/openrc"
+openrc_user: admin
+openrc_project: admin
+openrc_enable_export: false
diff --git a/roles/get-devstack-os-environment/tasks/main.yaml b/roles/get-devstack-os-environment/tasks/main.yaml
new file mode 100644
index 0000000000..8c8df7f96d
--- /dev/null
+++ b/roles/get-devstack-os-environment/tasks/main.yaml
@@ -0,0 +1,14 @@
+- when: openrc_enable_export
+  block:
+    - name: Extract the OS_ environment variables
+      shell:
+        cmd: |
+          source {{ openrc_file }} {{ openrc_user }} {{ openrc_project }} &>/dev/null
+          env | awk -F= 'BEGIN {print "---" } /^OS_/ { print "  "$1": \""$2"\""} '
+      args:
+        executable: "/bin/bash"
+      register: env_os
+
+    - name: Save the OS_ environment variables as a fact
+      set_fact:
+        os_env_vars: "{{ env_os.stdout|from_yaml }}"

From b9fe9c74f68f1881c0602748301ec6b68ed508d6 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Thu, 20 Aug 2020 14:42:55 +0200
Subject: [PATCH 2724/3333] Make PyYAML overridable on Red Hat family distros

This patch fixes an early stack issue where the following error message
would be presented:

ERROR: Cannot uninstall 'PyYAML'. It is a distutils installed project
and thus we cannot accurately determine which files belong to it which
would lead to only a partial uninstall.

We also drop references to removal of Python 2 library egg infos now
that Python 2 is EOL.

Closes-Bug: #1892363
Change-Id: I2876ee58ab6b73682869d6b4e684e10ac5e56ad9
---
 tools/fixup_stuff.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index e1409291b9..bf31dcbebb 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -162,10 +162,7 @@ function fixup_fedora {
     # manifest of what to remove.  However, in most cases, simply
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
-    sudo rm -rf /usr/lib/python2.7/site-packages/enum34*.egg-info
-    sudo rm -rf /usr/lib/python2.7/site-packages/ipaddress*.egg-info
-    sudo rm -rf /usr/lib/python2.7/site-packages/ply-*.egg-info
-    sudo rm -rf /usr/lib/python2.7/site-packages/typing-*.egg-info
+    sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
 }
 
 function fixup_suse {

From f0c12bd4b54eec793cd73e0bf4d07dc2d7fee4ea Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 24 Jun 2020 07:26:35 +0200
Subject: [PATCH 2725/3333] Further py2 cleanup for Fedora

Change-Id: I2433e2ed067f866751bf49983c0a7efce4be8900
---
 tools/fixup_stuff.sh | 32 --------------------------------
 1 file changed, 32 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index bf31dcbebb..441075ddcb 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -87,12 +87,6 @@ function fixup_ubuntu {
 # Python Packages
 # ---------------
 
-# get_package_path python-package    # in import notation
-function get_package_path {
-    local package=$1
-    echo $(python -c "import os; import $package; print(os.path.split(os.path.realpath($package.__file__))[0])")
-}
-
 function fixup_fedora {
     if ! is_fedora; then
         return
@@ -130,32 +124,6 @@ function fixup_fedora {
         fi
     fi
 
-    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "22" ]]; then
-        # requests ships vendored version of chardet/urllib3, but on
-        # fedora these are symlinked back to the primary versions to
-        # avoid duplication of code on disk.  This is fine when
-        # maintainers keep things in sync, but since devstack takes
-        # over and installs later versions via pip we can end up with
-        # incompatible versions.
-        #
-        # The rpm package is not removed to preserve the dependent
-        # packages like cloud-init; rather we remove the symlinks and
-        # force a re-install of requests so the vendored versions it
-        # wants are present.
-        #
-        # Realted issues:
-        # https://bugs.launchpad.net/glance/+bug/1476770
-        # https://bugzilla.redhat.com/show_bug.cgi?id=1253823
-
-        base_path=$(get_package_path requests)/packages
-        if [ -L $base_path/chardet -o -L $base_path/urllib3 ]; then
-            sudo rm -f $base_path/{chardet,urllib3}
-            # install requests with the bundled urllib3 to avoid conflicts
-            pip_install --upgrade --force-reinstall requests
-        fi
-
-    fi
-
     # Since pip10, pip will refuse to uninstall files from packages
     # that were created with distutils (rather than more modern
     # setuptools).  This is because it technically doesn't have a

From e7625fc72cbbbfaf37a6682166bc2180d4e50855 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 26 Aug 2020 09:46:35 +0100
Subject: [PATCH 2726/3333] [OVN] Follow up of OVN module migration to DevStack

This patch is a follow-up of Ib4194329474e8d68a90886d2a04f027eecd741df.

This patch removes the configure_port_forwarding call from the
neutron-legacy module because port forwarding (just like other
extensions such as DNS, QOS, etc...) are already enabled in the
plugin.sh file in the neutron repository [0]. The
configure_port_forwarding method itself is also defined in the neutron
repository so calling it here may result in a failure in case the plugin
is not enabled.

We are also removing the "dns" extensions from the default
Q_ML2_PLUGIN_EXT_DRIVERS variable because this extension conflicts with
the default DNS extensions that is enabled by Neutron when
q-dns/neutron-dns service is enabled (also in [0]). The LP for this
conflict problem is: https://bugs.launchpad.net/neutron/+bug/1887163.

[0]
https://github.com/openstack/neutron/blob/945a244588b81064e4301b6f055a3c90f472bd7e/devstack/plugin.sh#L101-L103

Change-Id: Iafb9e45520798b2a612192cfc6cca28501465862
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron-legacy            | 3 ---
 lib/neutron_plugins/ovn_agent | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 363c62e4c2..2906f15736 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -364,9 +364,6 @@ function configure_mutnauq {
 
     if [[ $Q_AGENT == "ovn" ]]; then
         configure_ovn
-        if is_service_enabled q-port-forwarding neutron-port-forwarding; then
-            configure_port_forwarding
-        fi
         configure_ovn_plugin
     fi
 
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e29b84fa48..f647f85c3d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -118,7 +118,7 @@ Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
 Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}
-Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,dns,qos}
+Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,qos}
 # this one allows empty:
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
 

From 18b4251bf4f689923a19bf7fbc50d5c2ea422b21 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 31 Aug 2020 16:22:57 +1000
Subject: [PATCH 2727/3333] Use SETUPTOOLS_USE_DISTUTILS=stdlib for global pip
 installs

A new setuptools release has changed the way pip installs are done,
see [0]. With this change we switch back to using the distro
method for global pip installs.

Temporarily make grenade jobs non-voting in order to allow this
patch to be backported.

[0] http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html

Change-Id: I5d8aa0e58e0409c54451b51de5eb70ba9a68d849
---
 .zuul.yaml | 18 ++++++++++--------
 inc/python |  8 +++++++-
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index d387b0dd50..acf26e2ca8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -705,10 +705,12 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -750,18 +752,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - neutron-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - neutron-grenade-multinode:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - grenade:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$
diff --git a/inc/python b/inc/python
index f98d28d995..8941fd038d 100644
--- a/inc/python
+++ b/inc/python
@@ -170,7 +170,13 @@ function pip_install {
         local sudo_pip="env"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
-        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
+        # See
+        #  https://github.com/pypa/setuptools/issues/2232
+        #  http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html
+        # this makes setuptools >=50 use the platform distutils.
+        # We only want to do this on global pip installs, not if
+        # installing in a virtualenv
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8 SETUPTOOLS_USE_DISTUTILS=stdlib "
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 

From cb8a4a6882b0cf89590cd169c6dce2c01c1dee9f Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 1 Sep 2020 14:04:00 +0200
Subject: [PATCH 2728/3333] Make grenade jobs voting again

This reverts the changes made to the zuul config in [0]. Since the
backports to the stable branches have been merged, the jobs can be
voting again.

[0] I5d8aa0e58e0409c54451b51de5eb70ba9a68d849

Change-Id: I3f5972e05faea8f11d7e87f3f8b05e4979e6c328
---
 .zuul.yaml | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index acf26e2ca8..d387b0dd50 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -705,12 +705,10 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -752,18 +750,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        # - neutron-grenade-multinode:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        # - grenade:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$

From ae21b3556ff215c0f73bc0ebbc90d72fa59a3459 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 1 Sep 2020 14:11:45 +0000
Subject: [PATCH 2729/3333] move cleanup of pyc files

Previously pyc files were only cleaned if clean.sh was run.
with this change a new clean_pyc_files function was introduced
with the logic that was previously in clean.sh but it is now
invoked from unstack.sh

With the previous behavior you could not stack with horizon
enabled then unstack and stack again due to the presence of pyc
files that were owned by root.

By moving the clean to unstack in stead of clean.sh you can
now stack, unstack and stack again without hitting the pyc issue.
since unstack is invoked by clean the existing clean.sh behavior has
not changed in practice except for the fact the pyc files are
removed sooner in the process.

This change also removes support for findutils < 4.2.3
Ubuntu 12.04 and CentOS 6 both have 4.4.2 since they were
released 8 years ago and are now EOL its fair to assume
that all modern distros have 4.2.3+
https://repology.org/project/findutils/versions

Change-Id: I13c9aad9be7e0930a0d875b7d382090caf0b8982
---
 clean.sh         | 9 ---------
 functions-common | 7 +++++++
 unstack.sh       | 2 ++
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/clean.sh b/clean.sh
index 685a719cfb..cb0a8b4bef 100755
--- a/clean.sh
+++ b/clean.sh
@@ -145,12 +145,3 @@ done
 
 rm -rf ~/.config/openstack
 
-# Clean up all *.pyc files
-if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
-    find_version=`find --version | awk '{ print $NF; exit}'`
-    if vercmp "$find_version" "<" "4.2.3" ; then
-        sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
-    else
-        sudo find $DEST -name "*.pyc" -delete
-    fi
-fi
diff --git a/functions-common b/functions-common
index ffbd631fb2..547f6df038 100644
--- a/functions-common
+++ b/functions-common
@@ -2415,6 +2415,13 @@ function time_totals {
     $xtrace
 }
 
+function clean_pyc_files {
+    # Clean up all *.pyc files
+    if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
+        sudo find $DEST -name "*.pyc" -delete
+    fi
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/unstack.sh b/unstack.sh
index 276111edb9..3197cf136f 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -182,3 +182,5 @@ if is_service_enabled cinder && is_package_installed lvm2; then
     clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
     clean_lvm_filter
 fi
+
+clean_pyc_files

From 7f7f488bc385dd707a3a6d8dae7859bbe72182e5 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 20 Aug 2020 09:27:01 +0100
Subject: [PATCH 2730/3333] Bionic: Enable Train UCA for updated QEMU and
 libvirt

This is will allow the openstack/nova project to facilitate a minimum
required version bump of QEMU and libvirt within the libvirt virt driver
in I8e349849db0b1a540d295c903f1470917b82fd97 ahead of the planned switch
to focal later in Victoria.

Change-Id: I85eb45632ff229676f7c29708f4a7cc64b3d90e3
---
 tools/fixup_stuff.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index bf31dcbebb..550239a2d9 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -73,6 +73,18 @@ function fixup_ubuntu {
     # Enable universe
     sudo add-apt-repository -y universe
 
+    if [[ -f /etc/ci/mirror_info.sh ]] ; then
+        # If we are on a nodepool provided host and it has told us about
+        # where we can find local mirrors then use that mirror.
+        source /etc/ci/mirror_info.sh
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/train main"
+    else
+        # Enable UCA:train for updated versions of QEMU and libvirt
+        sudo add-apt-repository -y cloud-archive:train
+    fi
+    REPOS_UPDATED=False
+    apt_get_update
+
     # Since pip10, pip will refuse to uninstall files from packages
     # that were created with distutils (rather than more modern
     # setuptools).  This is because it technically doesn't have a

From 7ba26f5cf97b39bd0ddb53248ae4676866c10824 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 17 Sep 2020 11:13:52 +0200
Subject: [PATCH 2731/3333] Add possibility to not compile ovs and ovn if
 that's disabled

There is flag Q_BUILD_OVS_FROM_GIT which can be used to not compile
ovs from source.
But this wasn't respected in the ovn_agent's module in install_ovn
function which was always installing from source ovn and ovs.
We need to disable that e.g. on grenade jobs when new version is
installed.

Change-Id: I7d3f92365e880191dcfe7c618a6f79d5f741144f
---
 lib/neutron_plugins/ovn_agent | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index f647f85c3d..84df9181ea 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -28,6 +28,8 @@ source $NEUTRON_DIR/devstack/lib/ovs
 # Defaults
 # --------
 
+Q_BUILD_OVS_FROM_GIT=$(trueorfalse True Q_BUILD_OVS_FROM_GIT)
+
 # Set variables for building OVN from source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
@@ -322,6 +324,11 @@ function ovn_sanity_check {
 
 # install_ovn() - Collect source and prepare
 function install_ovn {
+    if [[ "$Q_BUILD_OVS_FROM_GIT" == "False" ]]; then
+        echo "Installation of OVS from source disabled."
+        return 0
+    fi
+
     echo "Installing OVN and dependent packages"
 
     # Check the OVN configuration

From 848aaf83edf66e0c5671b8e9e74414ee70fdba0e Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 4 Sep 2020 10:29:19 -0500
Subject: [PATCH 2732/3333] Add nova-ceph-multistore job in devstack gate

nova-ceph-multistore is defined in nova side to test the
glance multistore on ceph and it is voting on nova gate.

There are other multistore testing enhancement going on for
example- https://review.opendev.org/#/c/743800/. so to avoid
any regression, let's run exiting mutistore job on devstack
gate too.

Change-Id: Ie82b4057463df4b6138c53b14a582bd84866aebd
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index d387b0dd50..9ae5f3f804 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -734,6 +734,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - nova-ceph-multistore:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         # NOTE(gmann): Remove this job from devstack pipeline once it is
         # migrated to zuulv3 native. This is legacy job and rely on
         # devstack-gate + devstack setting so any change in devstack can
@@ -770,6 +774,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - nova-ceph-multistore:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.

From 057aaa6ec90d037661ec88ef8af2b477e28411b4 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Wed, 29 Jul 2020 07:37:16 +0000
Subject: [PATCH 2733/3333] Configure cinder store for glance

This patch will enable user to configure single cinder store as well as
multiple cinder stores for glance. Below are the parameters needs to be
added in local.conf.

A. For single store
USE_CINDER_FOR_GLANCE=True

B. For Multiple stores
USE_CINDER_FOR_GLANCE=True
GLANCE_ENABLE_MULTIPLE_STORES=True
CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2,nfs:nfsdriver-1,ceph:cephdriver-1}
GLANCE_CINDER_DEFAULT_BACKEND=lvmdriver-1

enable_plugin devstack-plugin-nfs https://opendev.org/openstack/devstack-plugin-nfs
enable_plugin devstack-plugin-ceph https://opendev.org/openstack/devstack-plugin-ceph

NOTE:
GLANCE_CINDER_DEFAULT_BACKEND should be one of the value from CINDER_ENABLED_BACKENDS.
If you need to configure nfs and ceph backend for cinder then you need to add respective plugins in
local.conf file.
If GLANCE_ENABLE_MULTIPLE_STORES is True then it will not configure
swift store for glance even if it is enabled in local.conf file.

Needed-by: https://review.opendev.org/#/c/750018
Change-Id: Id0d63c4ea41cce389eee8dc9a96913a7d427f186
---
 lib/glance | 192 +++++++++++++++++++++++++++++++++++++++++------------
 stack.sh   |  60 +++++++++--------
 2 files changed, 184 insertions(+), 68 deletions(-)

diff --git a/lib/glance b/lib/glance
index 2118636a46..a848fc7abe 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,6 +41,16 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+# Cinder for Glance
+USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
+# GLANCE_CINDER_DEFAULT_BACKEND should be one of the values
+# from CINDER_ENABLED_BACKENDS
+GLANCE_CINDER_DEFAULT_BACKEND=${GLANCE_CINDER_DEFAULT_BACKEND:-lvmdriver-1}
+GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
+# NOTE (abhishekk): For opensuse data files are stored in different directory
+if is_opensuse; then
+    GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/etc/glance
+fi
 # Glance multi-store configuration
 # Boolean flag to enable multiple store configuration for glance
 GLANCE_ENABLE_MULTIPLE_STORES=$(trueorfalse False GLANCE_ENABLE_MULTIPLE_STORES)
@@ -68,6 +78,7 @@ GLANCE_STANDALONE=${GLANCE_STANDALONE:-True}
 # and $DATA_DIR/glance/cheap.
 GLANCE_MULTISTORE_FILE_IMAGE_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/glance}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
+GLANCE_NFS_MOUNTPOINT=$GLANCE_IMAGE_DIR/mnt
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
 GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_staging_store}
 GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
@@ -135,6 +146,122 @@ function cleanup_glance {
     fi
 }
 
+# Set multiple cinder store related config options for each of the cinder store
+#
+function configure_multiple_cinder_stores {
+
+    local be be_name be_type enabled_backends
+    for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+        be_type=${be%%:*}
+        be_name=${be##*:}
+        enabled_backends+="${be_name}:cinder,"
+
+        set_common_cinder_store_params $be_name
+        iniset $GLANCE_API_CONF $be_name cinder_volume_type ${be_name}
+        if [[ "$be_type" == "nfs" ]]; then
+            mkdir -p "$GLANCE_NFS_MOUNTPOINT"
+            iniset $GLANCE_API_CONF $be_name cinder_mount_point_base "$GLANCE_NFS_MOUNTPOINT"
+        fi
+    done
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_CINDER_DEFAULT_BACKEND
+}
+
+# Set common cinder store options to given config section
+#
+# Arguments:
+# config_section
+#
+function set_common_cinder_store_params {
+    local config_section="$1"
+    iniset $GLANCE_API_CONF $config_section cinder_store_auth_address $KEYSTONE_SERVICE_URI_V3
+    iniset $GLANCE_API_CONF $config_section cinder_store_user_name glance
+    iniset $GLANCE_API_CONF $config_section cinder_store_password $SERVICE_PASSWORD
+    iniset $GLANCE_API_CONF $config_section cinder_store_project_name $SERVICE_PROJECT_NAME
+}
+
+# Configure multiple file stores options for each file store
+#
+# Arguments:
+#
+function configure_multiple_file_stores {
+    local store enabled_backends
+    enabled_backends=""
+    for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+        enabled_backends+="${store}:file,"
+    done
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+
+    # Glance multiple store Store specific configs
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
+    local store
+    for store in $(echo $glance_multiple_file_stores | tr "," "\n"); do
+        iniset $GLANCE_API_CONF $store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
+    done
+}
+
+# Set reserved stores for glance
+function configure_reserved_stores {
+    iniset $GLANCE_API_CONF os_glance_staging_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_staging_store/"
+    iniset $GLANCE_API_CONF os_glance_tasks_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_tasks_store/"
+}
+
+# Copy rootwrap file from glance_store/etc/glance to /etc/glance
+#
+# Arguments:
+# source_path Source path to copy rootwrap files from
+#
+function copy_rootwrap {
+    local source_path="$1"
+    # Make glance configuration directory if it is not exists
+    sudo install -d -o $STACK_USER $GLANCE_CONF_DIR
+    cp -r $source_path/rootwrap.* $GLANCE_CONF_DIR/
+}
+
+# Set glance_store related config options
+#
+# Arguments:
+# USE_CINDER_FOR_GLANCE
+# GLANCE_ENABLE_MULTIPLE_STORES
+#
+function configure_glance_store {
+    local use_cinder_for_glance="$1"
+    local glance_enable_multiple_stores="$2"
+    local be
+
+    if [[ "$glance_enable_multiple_stores" == "False" ]]; then
+        # Configure traditional glance_store
+        if [[ "$use_cinder_for_glance" == "True" ]]; then
+            # set common glance_store parameters
+            iniset $GLANCE_API_CONF glance_store stores "cinder,file,http"
+            iniset $GLANCE_API_CONF glance_store default_store cinder
+
+            # set cinder related store parameters
+            set_common_cinder_store_params glance_store
+            # set nfs mount_point dir
+            for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+                local be_name=${be##*:}
+                if [[ "$be_name" == "nfs" ]]; then
+                    mkdir -p $GLANCE_NFS_MOUNTPOINT
+                    iniset $GLANCE_API_CONF glance_store cinder_mount_point_base $GLANCE_NFS_MOUNTPOINT
+                fi
+            done
+        fi
+        # Store specific configs
+        iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    else
+        if [[ "$use_cinder_for_glance" == "True" ]]; then
+            # Configure multiple cinder stores for glance
+            configure_multiple_cinder_stores
+        else
+            # Configure multiple file stores for glance
+            configure_multiple_file_stores
+        fi
+        # Configure reserved stores
+        configure_reserved_stores
+    fi
+}
+
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
@@ -143,16 +270,6 @@ function configure_glance {
     local dburl
     dburl=`database_connection_url glance`
 
-    # Configure multiple stores
-    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
-        local store enabled_backends
-        enabled_backends=""
-        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
-            enabled_backends+="${store}:file,"
-        done
-        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
-    fi
-
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -170,21 +287,8 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
 
-    # Glance multiple store Store specific configs
-    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
-        iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
-        local store
-        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
-            iniset $GLANCE_API_CONF $store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
-        done
-
-        # Glance configure reserved stores
-        iniset $GLANCE_API_CONF os_glance_staging_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_staging_store/"
-        iniset $GLANCE_API_CONF os_glance_tasks_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_tasks_store/"
-    else
-        # Store specific configs
-        iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    fi
+    # Configure glance_store
+    configure_glance_store $USE_CINDER_FOR_GLANCE $GLANCE_ENABLE_MULTIPLE_STORES
 
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
@@ -194,24 +298,26 @@ function configure_glance {
     fi
 
     # No multiple stores for swift yet
-    # Store the images in swift if enabled.
-    if is_service_enabled s-proxy; then
-        iniset $GLANCE_API_CONF glance_store default_store swift
-        iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
-
-        iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
-        iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
-        iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
-        if is_service_enabled tls-proxy; then
-            iniset $GLANCE_API_CONF glance_store swift_store_cacert $SSL_BUNDLE_FILE
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
+        # Store the images in swift if enabled.
+        if is_service_enabled s-proxy; then
+            iniset $GLANCE_API_CONF glance_store default_store swift
+            iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
+
+            iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
+            iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
+            iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+            if is_service_enabled tls-proxy; then
+                iniset $GLANCE_API_CONF glance_store swift_store_cacert $SSL_BUNDLE_FILE
+            fi
+            iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
+
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
         fi
-        iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
-
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -342,9 +448,11 @@ function install_glance {
     if use_library_from_git "glance_store"; then
         git_clone_by_name "glance_store"
         setup_dev_lib "glance_store" $(join_extras "${glance_store_extras[@]}")
+        copy_rootwrap ${DEST}/glance_store/etc/glance
     else
         # we still need to pass extras
         pip_install_gr_extras glance-store $(join_extras "${glance_store_extras[@]}")
+        copy_rootwrap $GLANCE_STORE_ROOTWRAP_BASE_DIR
     fi
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
diff --git a/stack.sh b/stack.sh
index ba9da638a8..b7ecb643cb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1222,32 +1222,6 @@ if is_service_enabled swift; then
     start_swift
 fi
 
-# Launch the Glance services
-if is_service_enabled glance; then
-    echo_summary "Starting Glance"
-    start_glance
-fi
-
-
-# Install Images
-# ==============
-
-# Upload an image to Glance.
-#
-# The default image is CirrOS, a small testing image which lets you login as **root**
-# CirrOS has a ``cloud-init`` analog supporting login via keypair and sending
-# scripts as userdata.
-# See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
-
-# NOTE(yoctozepto): limited to node hosting the database which is the controller
-if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
-    echo_summary "Uploading images"
-
-    for image_url in ${IMAGE_URLS//,/ }; do
-        upload_image $image_url
-    done
-fi
-
 # NOTE(lyarwood): By default use a single hardcoded fixed_key across devstack
 # deployments.  This ensures the keys match across nova and cinder across all
 # hosts.
@@ -1315,6 +1289,40 @@ if is_service_enabled cinder; then
     create_volume_types
 fi
 
+# This sleep is required for cinder volume service to become active and
+# publish capabilities to cinder scheduler before creating the image-volume
+if [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+    sleep 30
+fi
+
+# Launch the Glance services
+# NOTE (abhishekk): We need to start glance api service only after cinder
+# service has started as on glance startup glance-api queries cinder for
+# validating volume_type configured for cinder store of glance.
+if is_service_enabled glance; then
+    echo_summary "Starting Glance"
+    start_glance
+fi
+
+# Install Images
+# ==============
+
+# Upload an image to Glance.
+#
+# The default image is CirrOS, a small testing image which lets you login as **root**
+# CirrOS has a ``cloud-init`` analog supporting login via keypair and sending
+# scripts as userdata.
+# See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
+
+# NOTE(yoctozepto): limited to node hosting the database which is the controller
+if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
+    echo_summary "Uploading images"
+
+    for image_url in ${IMAGE_URLS//,/ }; do
+        upload_image $image_url
+    done
+fi
+
 
 if is_service_enabled horizon; then
     echo_summary "Starting Horizon"

From 4a1186aa90570b9c25782b423c5abe31da0e9033 Mon Sep 17 00:00:00 2001
From: Alexandre Arents <alexandre.arents@corp.ovh.com>
Date: Thu, 17 Sep 2020 12:50:53 +0000
Subject: [PATCH 2734/3333] tempest: Enable shelve_migrate tests with Libvirt

Enable the compute feature for shelve_migrate on all but LXC and
Xen virt_types.

Related-Bug: #1732428
Depends-On: https://review.opendev.org/#/c/696084/
Change-Id: I31cd00c9117607682213cfa0399709e560f4ad0d
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 125749b314..58588b7663 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -569,6 +569,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
         else
+            iniset $TEMPEST_CONFIG compute-feature-enabled shelve_migrate True
             iniset $TEMPEST_CONFIG compute-feature-enabled stable_rescue True
             iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi

From fa5742f8e1d95802cf8c623e29fcbc4931903b68 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 8 Sep 2020 09:38:14 +0100
Subject: [PATCH 2735/3333] Add Fedora 32 to supported list and use as
 fedora-latest

This includes a workaround to a known dnsmasq >= 2.81 issue that
results in unanswered DHCP requests from instances as documented in the
following Neutron bug:

dnsmasq >= 2.81 not responding to DHCP requests with current q-dhcp configs
https://bugs.launchpad.net/neutron/+bug/1896945

For the time being we will attempt to downgrade to 2.80 to avoid this.

Related-Bug: #1896945
Change-Id: I3a760c43956221424926bd9dad0ebe9b28ae2b52
---
 .zuul.yaml           | 2 +-
 stack.sh             | 2 +-
 tools/fixup_stuff.sh | 7 +++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9105d7e27c..94410b42e4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -72,7 +72,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-31
+        label: fedora-32
     groups:
       - name: tempest
         nodes:
diff --git a/stack.sh b/stack.sh
index ba9da638a8..5f9b553536 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index c0e07dd51c..a3bda2b74f 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -143,6 +143,13 @@ function fixup_fedora {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
+
+    # NOTE(lyarwood): Workaround a known issue on Fedora with dnsmasq >= 2.81
+    # by downgrading to 2.80 for the time being.
+    # https://bugs.launchpad.net/neutron/+bug/1896945
+    if [[ "$DISTRO" == "f32" ]] && [[ $(rpm --queryformat %{VERSION} -q dnsmasq) != "2.80" ]]; then
+        sudo dnf downgrade dnsmasq-2.80 -y
+    fi
 }
 
 function fixup_suse {

From f966e287396538a563d80827dc7b77438e32eb6c Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 24 Sep 2020 14:47:39 +0100
Subject: [PATCH 2736/3333] Remove Fedora 30 support

Fedora 30 hit EOL earlier in the year and can be removed from devstack.

https://en.wikipedia.org/wiki/Fedora_version_history#Version_history

Change-Id: I47452700d520a544c93c0c187143ec763f026612
---
 lib/lvm  | 6 ------
 lib/nova | 4 ++--
 stack.sh | 2 +-
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index 92265f2af2..b826c1bc63 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -124,12 +124,6 @@ function init_lvm_volume_group {
     local vg=$1
     local size=$2
 
-    # Start the lvmetad on f30 (dropped from f31) or SUSE
-    if [[ $DISTRO =~ f30 ]] || is_suse; then
-        # services is not started by default
-        start_service lvm2-lvmetad
-    fi
-
     # Start the tgtd service on Fedora and SUSE if tgtadm is used
     if  is_fedora || is_suse  && [[ "$CINDER_ISCSI_HELPER" = "tgtadm" ]]; then
         start_service tgtd
diff --git a/lib/nova b/lib/nova
index c1354e79a9..9d7bbd8fca 100644
--- a/lib/nova
+++ b/lib/nova
@@ -293,8 +293,8 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
-            # For f30 and f31 use the rebased 2.1.0 version of the package.
+        if is_fedora && [[ $DISTRO =~ f31] ]]; then
+            # For f31 use the rebased 2.1.0 version of the package.
             sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
             sudo dnf update -y
         fi
diff --git a/stack.sh b/stack.sh
index 5f9b553536..139e754a63 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 471f1625bb3ae9b11d9da69404f945a19d8b010a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 26 Sep 2020 15:15:42 -0700
Subject: [PATCH 2737/3333] Update opensuse version

Nova has newer qemu requirements which needs opensuse 15.2 to meet. The
infra opensuse 15 images are 15.2 now to accomodate that. Update
opensuse's supported version to match.

Change-Id: I6f3c5234920b185b2b0cd9c358371402f7a7b922
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 139e754a63..14968386ea 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 155109df89b07f90c99ce5c6acb32c78b58cf9de Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 24 Jul 2020 06:49:01 -0700
Subject: [PATCH 2738/3333] Change glance default back to WSGI mode

The situation around glance under WSGI has changed a lot in a week.
We can now run tasks and imports under WSGI, so let's switch the
default back so that glance is consistent (by default) with the
other projects.

Change-Id: I3ae285b2ac4972c0b8abaccfc7c0ede0e1c49bf1
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index a848fc7abe..c2a8b7492e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -70,7 +70,7 @@ GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 if [[ "$WSGI_MODE" != "uwsgi" ]]; then
     GLANCE_STANDALONE=True
 fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-True}
+GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
 
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES

From 29efb7282296c183d5036bc64451a9469a053056 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 30 Sep 2020 11:06:04 -0500
Subject: [PATCH 2739/3333] Update DEVSTACK_SERIES to wallaby

stable/victoria branch has been created now and
current master is for wallaby.

Change-Id: I5f5b233127d6ef24452fcd05db990f9ddc244dc4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index bf1ad3d85d..a36f8970e6 100644
--- a/stackrc
+++ b/stackrc
@@ -245,7 +245,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="victoria"
+DEVSTACK_SERIES="wallaby"
 
 ##############
 #

From 8e74a617df7d53732c1ef395a97479ce58122731 Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Fri, 10 Apr 2020 10:48:15 +0200
Subject: [PATCH 2740/3333] Move supported distros to variable

Improve redability of the distro check using a variable to
store supported distributions.

Change-Id: Iffa1619065358d459bd04523b7eeae9049f8f2f0
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 3b2a331dea..bb4dfa2561 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,9 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8) ]]; then
+SUPPORTED_DISTROS="bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
+
+if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 3ebb95f9b5e82256e66fcedb23f8f0740349c898 Mon Sep 17 00:00:00 2001
From: Dan Radez <dradez@redhat.com>
Date: Fri, 2 Oct 2020 09:46:31 -0400
Subject: [PATCH 2741/3333] Removing fixup for f32 + dnsmasq 2.81

workaround reported https://bugs.launchpad.net/neutron/+bug/1896945
fixed by https://review.opendev.org/#/c/755356/

Change-Id: I86a0be548e344ed4e95eab7212ba432bf570d2ae
---
 tools/fixup_stuff.sh | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a3bda2b74f..c0e07dd51c 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -143,13 +143,6 @@ function fixup_fedora {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
-
-    # NOTE(lyarwood): Workaround a known issue on Fedora with dnsmasq >= 2.81
-    # by downgrading to 2.80 for the time being.
-    # https://bugs.launchpad.net/neutron/+bug/1896945
-    if [[ "$DISTRO" == "f32" ]] && [[ $(rpm --queryformat %{VERSION} -q dnsmasq) != "2.80" ]]; then
-        sudo dnf downgrade dnsmasq-2.80 -y
-    fi
 }
 
 function fixup_suse {

From 906d824a1985332949090583fdc3f4a5ce30125a Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Sun, 11 Oct 2020 21:59:07 +0200
Subject: [PATCH 2742/3333] Fix: do not lose the tox_environment value in func
 tests

The current code always overrides tox_environment when running
functional tests, but the correct behavior is to add
the discovered environment variables to tox_environments,
while keeping the user-specified value for it.

The current behavior breaks the devstack-tox-functional children
jobs, like openstacksdk-functional-devstack-ironic, which set
tox_environment.

Change-Id: I5dc9054a1495ca0ef7745c08316441ab153956f4
---
 playbooks/tox/run-both.yaml                          | 3 +--
 playbooks/tox/run.yaml                               | 3 +--
 roles/get-devstack-os-environment/defaults/main.yaml | 1 +
 roles/get-devstack-os-environment/tasks/main.yaml    | 4 ++--
 4 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/playbooks/tox/run-both.yaml b/playbooks/tox/run-both.yaml
index 0528b46f00..e4043d8231 100644
--- a/playbooks/tox/run-both.yaml
+++ b/playbooks/tox/run-both.yaml
@@ -8,5 +8,4 @@
     - test-setup
     - ensure-tox
     - get-devstack-os-environment
-    - role: tox
-      tox_environment: "{{ os_env_vars|default({}) }}"
+    - tox
diff --git a/playbooks/tox/run.yaml b/playbooks/tox/run.yaml
index 6e549d3655..0d065c6ca2 100644
--- a/playbooks/tox/run.yaml
+++ b/playbooks/tox/run.yaml
@@ -1,5 +1,4 @@
 - hosts: all
   roles:
     - get-devstack-os-environment
-    - role: tox
-      tox_environment: "{{ os_env_vars|default({}) }}"
+    - tox
diff --git a/roles/get-devstack-os-environment/defaults/main.yaml b/roles/get-devstack-os-environment/defaults/main.yaml
index 73ecfe920c..f68ea560d0 100644
--- a/roles/get-devstack-os-environment/defaults/main.yaml
+++ b/roles/get-devstack-os-environment/defaults/main.yaml
@@ -3,3 +3,4 @@ openrc_file: "{{ devstack_base_dir }}/devstack/openrc"
 openrc_user: admin
 openrc_project: admin
 openrc_enable_export: false
+tox_environment: {}
diff --git a/roles/get-devstack-os-environment/tasks/main.yaml b/roles/get-devstack-os-environment/tasks/main.yaml
index 8c8df7f96d..b2c5e93ed4 100644
--- a/roles/get-devstack-os-environment/tasks/main.yaml
+++ b/roles/get-devstack-os-environment/tasks/main.yaml
@@ -9,6 +9,6 @@
         executable: "/bin/bash"
       register: env_os
 
-    - name: Save the OS_ environment variables as a fact
+    - name: Append the the OS_ environment variables to tox_environment
       set_fact:
-        os_env_vars: "{{ env_os.stdout|from_yaml }}"
+        tox_environment: "{{ env_os.stdout|from_yaml|default({})|combine(tox_environment) }}"

From 0545b48f3b14f2951033b5e09db3190a95cf3527 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 13 Oct 2020 16:06:44 +0200
Subject: [PATCH 2743/3333] Add IPv6 route information to worlddump

The "ip route" command only outputs IPv4 routes, add a command to also
show IPv6 route information.

Drop output from "ip link" as that information is contained within the
"ip addr" output already.

Change-Id: Iae87f43c4b1c57f07de041e823da9d350c670389
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 6a618f5ee6..5a264d2508 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -165,7 +165,7 @@ def network_dump():
 
     _dump_cmd("bridge link")
     _dump_cmd("ip link show type bridge")
-    ip_cmds = ["neigh", "addr", "link", "route"]
+    ip_cmds = ["neigh", "addr", "route", "route -6"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():

From b107f9cf18c8112cce3f796995f3a5691be56259 Mon Sep 17 00:00:00 2001
From: "Walter A. Boring IV" <waboring@hemna.com>
Date: Mon, 1 Jul 2019 16:19:12 -0700
Subject: [PATCH 2744/3333] Add support for ceph_iscsi cinder driver

This patch adds support to configure the new ceph iscsi driver

Depends-On: https://review.opendev.org/#/c/662829/
Depends-On:https://review.opendev.org/668667
Change-Id: Ica180e00dedb8e7ed60e27e3f4841faa8fef938c
---
 lib/cinder_backends/ceph_iscsi | 56 ++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 lib/cinder_backends/ceph_iscsi

diff --git a/lib/cinder_backends/ceph_iscsi b/lib/cinder_backends/ceph_iscsi
new file mode 100644
index 0000000000..94412e0da6
--- /dev/null
+++ b/lib/cinder_backends/ceph_iscsi
@@ -0,0 +1,56 @@
+#!/bin/bash
+#
+# lib/cinder_backends/ceph_iscsi
+# Configure the ceph_iscsi backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,ceph_iscsi:ceph_iscsi
+#
+# Optional paramteters:
+#   CEPH_ISCSI_API_URL=<url to the rbd-target-api service>
+#
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# configure_ceph_backend_ceph_iscsi - called from configure_cinder()
+
+
+# Save trace setting
+_XTRACE_CINDER_CEPH_ISCSI=$(set +o | grep xtrace)
+set +o xtrace
+
+# Entry Points
+# ------------
+
+# configure_cinder_backend_ceph_iscsi - Set config files, create data dirs, etc
+# configure_cinder_backend_ceph_iscsi $name
+function configure_cinder_backend_ceph_iscsi {
+    local be_name=$1
+
+    CEPH_ISCSI_API_URL=${CEPH_ISCSI_API_URL:-http://$CEPH_ISCSI_API_HOST:$CEPH_ISCSI_API_PORT}
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.ceph.rbd_iscsi.RBDISCSIDriver"
+    iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF $be_name rbd_pool "$CINDER_CEPH_POOL"
+    iniset $CINDER_CONF $be_name rbd_user "$CINDER_CEPH_USER"
+    iniset $CINDER_CONF $be_name rbd_iscsi_api_user "$CEPH_ISCSI_API_USER"
+    iniset $CINDER_CONF $be_name rbd_iscsi_api_password "$CEPH_ISCSI_API_PASSWORD"
+    iniset $CINDER_CONF $be_name rbd_iscsi_api_url "$CEPH_ISCSI_API_URL"
+    iniset $CINDER_CONF $be_name rbd_iscsi_target_iqn "$CEPH_ISCSI_TARGET_IQN"
+    iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
+    iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
+    iniset $CINDER_CONF DEFAULT glance_api_version 2
+
+    pip_install rbd-iscsi-client
+}
+
+# Restore xtrace
+$_XTRACE_CINDER_CEPH_ISCSI
+
+# Local variables:
+# mode: shell-script
+# End:

From 7de6e0b2eca9ac661a92badef4488d8d6380b06f Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 21 Oct 2020 13:59:50 +0100
Subject: [PATCH 2745/3333] fix ipv6 flag order in worlddump

this change corrects the flag order from 'route -6'
to '-6 route' as the -6 flag is an option when used with
ip is an argument to the the ip command and not the route
subcommand.

-6 is accpeted as an argument to the standalone 'route'
commannd but not 'ip route' subcommand.

Change-Id: Ic2ae472e42b7b455693d0aade48dc5109e1f21ba
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 5a264d2508..22770f15b6 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -165,7 +165,7 @@ def network_dump():
 
     _dump_cmd("bridge link")
     _dump_cmd("ip link show type bridge")
-    ip_cmds = ["neigh", "addr", "route", "route -6"]
+    ip_cmds = ["neigh", "addr", "route", "-6 route"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():

From 6ecfe67d8e8166a3dc42332ba8d1615be6a14a68 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 23 Sep 2020 11:54:19 +0100
Subject: [PATCH 2746/3333] Configure os-vif ovsdb_connection

This patch set the os-vif "ovsdb_connection" configuration option so it
can connect to the local OVSDB. By default, this option points to
tcp:127.0.0.1:6640 and would fail if SERVICE_IP_VERSION == 6.

Also, if SERVICE_IP_VERSION is an IPv6 address, it should be wraped with
square brackets for it to work.

Change-Id: Ie6eec4e140c7464936cf0b0c6307026a94c9f4ee
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron_plugins/ovn_agent | 5 ++++-
 lib/nova                      | 5 +++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 84df9181ea..b7330db9db 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -91,7 +91,10 @@ OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
 OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
-OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
+    OVSDB_SERVER_LOCAL_HOST=[$OVSDB_SERVER_LOCAL_HOST]
+fi
 
 OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
 
diff --git a/lib/nova b/lib/nova
index 9d7bbd8fca..d7426039c4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -906,6 +906,11 @@ function start_nova_compute {
     # by the compute process.
     configure_console_compute
 
+    # Configure the OVSDB connection for os-vif
+    if [ -n "$OVSDB_SERVER_LOCAL_HOST" ]; then
+        iniset $NOVA_CPU_CONF os_vif_ovs ovsdb_connection "tcp:$OVSDB_SERVER_LOCAL_HOST:6640"
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From 3f28c272d0a3ae78329c81227a66c703d6a489d7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 28 Oct 2020 13:05:14 +0000
Subject: [PATCH 2747/3333] Remove deprecated tail_log function

This function has been deprecated for a long time, let's finally
remove it. It is only generating a warning anyway.

Change-Id: I7bd440adf2ce8283e3ad3d5d09e6b2b877e2b42e
---
 functions-common | 4 ----
 lib/placement    | 1 -
 lib/tls          | 8 --------
 3 files changed, 13 deletions(-)

diff --git a/functions-common b/functions-common
index 547f6df038..13749214ba 100644
--- a/functions-common
+++ b/functions-common
@@ -1609,10 +1609,6 @@ function service_check {
 }
 
 
-function tail_log {
-    deprecated "With the removal of screen support, tail_log is deprecated and will be removed after Queens"
-}
-
 # Plugin Functions
 # =================
 
diff --git a/lib/placement b/lib/placement
index 2a449bfa90..b7798669a1 100644
--- a/lib/placement
+++ b/lib/placement
@@ -148,7 +148,6 @@ function start_placement_api {
     else
         enable_apache_site placement-api
         restart_apache_server
-        tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
     fi
 
     echo "Waiting for placement-api to start..."
diff --git a/lib/tls b/lib/tls
index 861496d092..b3cc0b4159 100644
--- a/lib/tls
+++ b/lib/tls
@@ -570,14 +570,6 @@ EOF
     restart_apache_server
 }
 
-# Follow TLS proxy
-function follow_tls_proxy {
-    sudo touch /var/log/$APACHE_NAME/tls-proxy_error.log
-    tail_log tls-error /var/log/$APACHE_NAME/tls-proxy_error.log
-    sudo touch /var/log/$APACHE_NAME/tls-proxy_access.log
-    tail_log tls-proxy /var/log/$APACHE_NAME/tls-proxy_access.log
-}
-
 # Cleanup Functions
 # =================
 

From 47f76acbbac350ea18df6a9463876d38c3a13539 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 29 Oct 2020 10:42:38 +0000
Subject: [PATCH 2748/3333] Determine default IPv4 route device only when
 needed

Sometimes instances don't have an IPv4 default route, so only check for
it when we actually need it. In a followup patch we could extend the
code to check for an IPv6 default route instead or in addition.

Related-Bug: 1902002
Change-Id: Ie6cd241721f6b1f8e030960921a696939b2dab10
---
 lib/neutron-legacy | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2906f15736..436b0e3364 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -226,15 +226,17 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-default_route_dev=$(ip route | grep ^default | awk '{print $5}')
-die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the network interface to use for the physical
 # network.
 #
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
-LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-$default_route_dev}
+if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
+    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+    LB_PHYSICAL_INTERFACE=$default_route_dev
+fi
 
 # When Neutron tunnels are enabled it is needed to specify the
 # IP address of the end point in the local server. This IP is set

From 2bb62b43bf8b3d95e199b111d8f6de01890c0536 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 6 Nov 2020 17:34:53 -0500
Subject: [PATCH 2749/3333] Decrease MTU to account for IPv6 header

(MTU - 50) only supports VxLAN over IPv4, decrease it
to support IPv6 as well, which is 20 bytes larger.

Change-Id: I0cf258770f628c1b4fb590bd274b5433fbcc1450
---
 playbooks/pre.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index ff97a1f501..68cb1d8c7a 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -19,12 +19,13 @@
           {% endfor -%}
           {{- mtus|min -}}
     - name: Calculate external_bridge_mtu
-      # 50 bytes is overhead for vxlan (which is greater than GRE
+      # 30 bytes is overhead for vxlan (which is greater than GRE
       # allowing us to use either overlay option with this MTU.
+      # 40 bytes is overhead for IPv6, which will also support an IPv4 overlay.
       # TODO(andreaf) This should work, but it may have to be reconcilied with
       # the MTU setting used by the multinode setup roles in multinode pre.yaml
       set_fact:
-        external_bridge_mtu: "{{ local_mtu | int - 50 }}"
+        external_bridge_mtu: "{{ local_mtu | int - 30 - 40 }}"
   roles:
     - configure-swap
     - setup-stack-user

From efc04eec00bef94059a0e5b6f457263fc84876c1 Mon Sep 17 00:00:00 2001
From: Nate Johnston <nate.johnston@redhat.com>
Date: Tue, 3 Nov 2020 10:04:26 -0500
Subject: [PATCH 2750/3333] Look for ipv6 routes so ipv6-only jobs will not
 fail

For change 739139 [1] PS 12, the
neutron-tempest-plugin-scenario-linuxbridge died in devstack with
"/opt/stack/devstack/functions-common:237 Failure retrieving default
route device", which comes from
"/opt/stack/devstack/lib/neutron-legacy:237:die_if_not_set".

Looking at the worlddump.txt for that job [2] I see that there is a
default ipv6 route; the vm was not configured with ipv4 networking.

    ip route
    --------

    ip -6 route
    -----------

    ::1 dev lo proto kernel metric 256 pref medium
    2607:ff68:100:54::/64 dev ens3 proto kernel metric 256 expires 86380sec pref medium
    fe80::/64 dev ens3 proto kernel metric 256 pref medium
    default via fe80::f816:3eff:fe77:b05c dev ens3 proto ra metric 1024 expires 280sec hoplimit 64 pref medium

Looking at the devstack code that throws the error [3] it looks like
it only looks for a default route in the output of `ip route`, which
does not include ipv6 information.  This change should look in both
the ipv4 and ipv6 route table.  A similar check in the L3 setup code
is also updated.

[1] https://review.opendev.org/#/c/739139/
[2] https://d4eb7e3efe98cba79a4b-f4d168cdb20f40841821e4b213645c0f.ssl.cf2.rackcdn.com/739139/12/gate/neutron-tempest-plugin-scenario-linuxbridge/9a6b4f7/controller/logs/worlddump-latest.txt
[3] https://opendev.org/openstack/devstack/src/branch/master/lib/neutron-legacy#L236

Closes-Bug: #1902002
Change-Id: I839e8c222368df98fec308cf41248a9dd0a8c187
---
 lib/neutron-legacy              | 2 +-
 lib/neutron_plugins/services/l3 | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 436b0e3364..791ff18b10 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -233,7 +233,7 @@ OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 #
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
 if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
     die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
     LB_PHYSICAL_INTERFACE=$default_route_dev
 fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 69536bbe58..75a3567096 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -101,7 +101,6 @@ SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
-die_if_not_set $LINENO default_v4_route_devs "Failure retrieving default IPv4 route devices"
 
 default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
 

From 6766f71d62af10f8b59b5f829a49752775e9dabe Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 24 Jul 2020 15:44:34 -0700
Subject: [PATCH 2751/3333] Make create_disk() persistent

Right now a system configured with the ceph plugin will not survive
a reboot because the backing disk we create and mount isn't mounted
at startup, preventing ceph from starting and the rest of nova/glance
from working.

This makes create_disk() idempotently write an fstab rule for the
disk we make, and adds a destroy_disk() handler for cleanup.

Change-Id: I50cd4234f51a335af25be756bd2459dca5aa343c
---
 clean.sh  |  2 ++
 functions | 34 +++++++++++++++++++++++++++++-----
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/clean.sh b/clean.sh
index cb0a8b4bef..4cebf1d9ea 100755
--- a/clean.sh
+++ b/clean.sh
@@ -145,3 +145,5 @@ done
 
 rm -rf ~/.config/openstack
 
+# Clear any fstab entries made
+sudo sed -i '/.*comment=devstack-.*/ d' /etc/fstab
diff --git a/functions b/functions
index cc1ca6cb25..e679b0f9bc 100644
--- a/functions
+++ b/functions
@@ -751,12 +751,13 @@ if ! function_exists echo_nolog; then
 fi
 
 
-# create_disk - Create backing disk
+# create_disk - Create, configure, and mount a backing disk
 function create_disk {
     local node_number
     local disk_image=${1}
     local storage_data_dir=${2}
     local loopback_disk_size=${3}
+    local key
 
     # Create a loopback disk and format it to XFS.
     if [[ -e ${disk_image} ]]; then
@@ -777,11 +778,34 @@ function create_disk {
     # Swift and Ceph.
     sudo mkfs.xfs -f -i size=1024 ${disk_image}
 
-    # Mount the disk with mount options to make it as efficient as possible
-    if ! egrep -q ${storage_data_dir} /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
-            ${disk_image} ${storage_data_dir}
+    # Unmount the target, if mounted
+    if egrep -q $storage_data_dir /proc/mounts; then
+        sudo umount $storage_data_dir
     fi
+
+    # Clear any old fstab rules, install a new one for this disk, and mount it
+    key=$(echo $disk_image | sed 's#/.##')
+    key="devstack-$key"
+    sudo sed -i '/.*comment=$key.*/ d' /etc/fstab
+    echo "$disk_image $storage_data_dir xfs loop,noatime,nodiratime,logbufs=8,comment=$key 0 0" | sudo tee -a /etc/fstab
+    sudo mount -v $storage_data_dir
+}
+
+# Unmount, de-configure, and destroy a backing disk
+function destroy_disk {
+    local disk_image=$1
+    local storage_data_dir=$2
+
+    # Unmount the target, if mounted
+    if egrep -q $storage_data_dir /proc/mounts; then
+        sudo umount $storage_data_dir
+    fi
+
+    # Clear any fstab rules
+    sed -i '/.*comment=$key.*/ d' /etc/fstab
+
+    # Delete the file
+    sudo rm $disk_image
 }
 
 

From d7d87b0202212e21727f6ced4a1eaa38a66808dd Mon Sep 17 00:00:00 2001
From: Weronika Sikora <weronika.sikora@corp.ovh.com>
Date: Wed, 18 Sep 2019 13:45:53 +0000
Subject: [PATCH 2752/3333] Set image_alt_ssh_user during stack

At this moment, only image_ssh_user is present in the config
of Tempest. It's set to cirros by default and used for
SSH connections in tests. However, several tests build
instances with image_ref_alt, but still use image_ssh_user to
connect, which results in failure if image_ref_alt is set to
a non-cirros image. They should use image_alt_ssh_user instead,
which can be set to whichever user the image_ref_alt needs in
either local.conf or during plugin installation.

Change-Id: I899909fb71a9862c891e94ba54c6a8fa137f9769
Partial-Bug: #1844535
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 9f2ec30cb9..c55531b72e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -27,6 +27,7 @@
 # - ``USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION``
 # - ``DEFAULT_INSTANCE_TYPE``
 # - ``DEFAULT_INSTANCE_USER``
+# - ``DEFAULT_INSTANCE_ALT_USER``
 # - ``CINDER_ENABLED_BACKENDS``
 # - ``NOVA_ALLOW_DUPLICATE_NETWORKS``
 #
@@ -443,7 +444,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-True}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
     iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
-    iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
+    iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:=cirros}
+    iniset $TEMPEST_CONFIG validation image_alt_ssh_user ${DEFAULT_INSTANCE_ALT_USER:-$DEFAULT_INSTANCE_USER}
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume

From 6c03a85d8bebffb17ec923d9f94a499dd8c4854b Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 10 Nov 2020 14:10:11 +0000
Subject: [PATCH 2753/3333] enable ussuri cloud archive on ubuntu bionic

This change updates bionic installs to use the
ussuri cloud archive to enable the use of libvirt 6.0.0.
This is required to prevent a libvirt bug that causes intermittent
failures for the tempest test_live_block_migration_paused testcase.

Change-Id: I9c395c2b5fdfe6ad9a43477280e88e9a9b34f057
Related-Bug: 1901739
---
 tools/fixup_stuff.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index c0e07dd51c..cd7ee59c1d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -77,10 +77,10 @@ function fixup_ubuntu {
         # If we are on a nodepool provided host and it has told us about
         # where we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/train main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/ussuri main"
     else
-        # Enable UCA:train for updated versions of QEMU and libvirt
-        sudo add-apt-repository -y cloud-archive:train
+        # Enable UCA:ussuri for updated versions of QEMU and libvirt
+        sudo add-apt-repository -y cloud-archive:ussuri
     fi
     REPOS_UPDATED=False
     apt_get_update

From 7a5fda83264575aebe52b62e27aae1a0398be4da Mon Sep 17 00:00:00 2001
From: Victoria Martinez de la Cruz <victoria@redhat.com>
Date: Fri, 13 Nov 2020 12:56:00 -0300
Subject: [PATCH 2754/3333] [CI] Copy /etc/ceph output to logs

Change-Id: I91317c7d4972f07f741cdde2f406e290bb65467b
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index d387b0dd50..ec827c289c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -340,6 +340,7 @@
         '{{ stage_dir }}/listen53.txt': logs
         '{{ stage_dir }}/deprecations.log': logs
         '{{ stage_dir }}/audit.log': logs
+        /etc/ceph: logs
         /var/log/ceph: logs
         /var/log/openvswitch: logs
         /var/log/glusterfs: logs

From cdc2e9f656089217d28d0fff8d614dc84b755e2c Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 19 Nov 2020 09:17:37 +0000
Subject: [PATCH 2755/3333] zuul: Remove nova-live-migration from check queue

As documented in the associated TODO this job can be removed now that it
has been migrated to zuulv3 by Ib342e2d3c395830b4667a60de7e492d3b9de2f0a.

Change-Id: Id7c0fd8eec09386cd638956a46c1f75844194b9d
---
 .zuul.yaml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e71ac8d8c3..c1406716fe 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -737,15 +737,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        # NOTE(gmann): Remove this job from devstack pipeline once it is
-        # migrated to zuulv3 native. This is legacy job and rely on
-        # devstack-gate + devstack setting so any change in devstack can
-        # break it.
-        - nova-live-migration:
-            voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
     gate:
       jobs:
         - devstack

From 7a3a7ce876a37376fe0dca7278e41a4f46867daa Mon Sep 17 00:00:00 2001
From: Elod Illes <elod.illes@est.tech>
Date: Mon, 30 Nov 2020 18:30:02 +0100
Subject: [PATCH 2756/3333] Workaround for new pip 20.3 behavior

This patch caps pip version during bootstrap to avoid the issue:

"ERROR: Links are not allowed as constraints"

A proper fix would be to adapt to new pip behavior.

Depends-On: https://review.opendev.org/764811
Change-Id: I1feed4573820436f91f8f654cc189fa3a21956fd
---
 tools/cap-pip.txt    | 1 +
 tools/install_pip.sh | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 tools/cap-pip.txt

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
new file mode 100644
index 0000000000..8ee551b261
--- /dev/null
+++ b/tools/cap-pip.txt
@@ -0,0 +1 @@
+pip<20.3
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index f3fd1e2498..9afd2e53c2 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -91,7 +91,9 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    # TODO: remove the trailing pip constraint when a proper fix
+    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
+    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
 }
 
 

From e7c017bd8998d9cc8c4712efe992239c73f340d1 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Dec 2020 23:53:12 +0000
Subject: [PATCH 2757/3333] fix is_fedora for centos 8 stream

When deploying on the centos 8 stream variant
the output of "lsb_release -i -s" is
CentOSStream instead of CentOS

This breaks the is_fedora function in devstack
preventing package installation and removal.

Change-Id: I39ccefbd06f46adf5077f8d8001f37d3b190f040
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 13749214ba..87d8c64804 100644
--- a/functions-common
+++ b/functions-common
@@ -452,8 +452,8 @@ function is_fedora {
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
-        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
-        [ "$os_VENDOR" = "Virtuozzo" ]
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
+        [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]
 }
 
 

From 89acae97791a4f23a8b7e9550450cb4a3b986b01 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Wed, 16 Dec 2020 09:12:40 +0900
Subject: [PATCH 2758/3333] Use python3-guestfs in Ubuntu

This commit makes to use python3-guestfs instead of python-guestfs in
Ubuntu because python-guestfs package is not provided in focal[1][2].
This causes errors in some gate job if `ENABLE_FILE_INJECTION` is true
like the following.

```
...
Package python-guestfs is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
  python3-guestfs

E: Package 'python-guestfs' has no installation candidate
...
```
http://paste.openstack.org/show/801073/

[1] https://packages.ubuntu.com/search?lang=en&keywords=python3-guestfs
[2] https://packages.ubuntu.com/search?lang=en&suite=default&arch=any&searchon=names&keywords=python-guestfs

Change-Id: Iffe60aa0351b732d543927afa1f1e846ba2a89fd
---
 lib/nova_plugins/hypervisor-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b25bc0c367..321775d324 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -100,7 +100,7 @@ function install_nova_hypervisor {
 
     if [[ "$ENABLE_FILE_INJECTION" == "True" ]] ; then
         if is_ubuntu; then
-            install_package python-guestfs
+            install_package python3-guestfs
             # NOTE(andreaf) Ubuntu kernel can only be read by root, which breaks libguestfs:
             # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725)
             INSTALLED_KERNELS="$(ls /boot/vmlinuz-*)"

From e651d9ef8840bb7dd497b557125ce1cd5290993d Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 19 Nov 2020 14:50:01 +0000
Subject: [PATCH 2759/3333] [OVN] Use OVN from packages

This patch changes the OVN module from DevStack to allow for using the
OSapackaged version of OVN instead of compiling it from source.

A new variable called OVN_BUILD_FROM_SOURCE has been introduced and when
set to False (the default value) OVN will then use the packaged version
for setting up DevStack.

Note, in the stop_ovn() function, the OVN metadata agent service name
was wrong and the service wasn't being stopped as part of ./unstack.sh.
This patch also fixed it as well.

Change-Id: Ib41e3b486550200572afd6b3ba783d7644d70d44
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
Co-Authored-By: Slawek Kaplonski <skaplons@redhat.com>
---
 lib/neutron_plugins/ovn_agent | 262 +++++++++++++++++++++-------------
 tools/fixup_stuff.sh          |   8 ++
 2 files changed, 172 insertions(+), 98 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b7330db9db..b661f593a4 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -72,6 +72,7 @@ OVN_UUID=${OVN_UUID:-}
 # Whether or not to build the openvswitch kernel module from ovs.  This is required
 # unless the distro kernel includes ovs+conntrack support.
 OVN_BUILD_MODULES=$(trueorfalse False OVN_BUILD_MODULES)
+OVN_BUILD_FROM_SOURCE=$(trueorfalse False OVN_BUILD_FROM_SOURCE)
 
 # Whether or not to install the ovs python module from ovs source.  This can be
 # used to test and validate new ovs python features.  This should only be used
@@ -98,7 +99,10 @@ fi
 
 OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
 
-OVS_PREFIX=/usr/local
+OVS_PREFIX=
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    OVS_PREFIX=/usr/local
+fi
 OVS_SBINDIR=$OVS_PREFIX/sbin
 OVS_BINDIR=$OVS_PREFIX/bin
 OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
@@ -116,6 +120,24 @@ NEUTRON_OVN_METADATA_BINARY="neutron-ovn-metadata-agent"
 
 STACK_GROUP="$( id --group --name "$STACK_USER" )"
 
+OVN_NORTHD_SERVICE=ovn-northd.service
+if is_ubuntu; then
+    # The ovn-central.service file on Ubuntu is responsible for starting
+    # ovn-northd and the OVN DBs (on CentOS this is done by ovn-northd.service)
+    OVN_NORTHD_SERVICE=ovn-central.service
+fi
+OVSDB_SERVER_SERVICE=ovsdb-server.service
+OVS_VSWITCHD_SERVICE=ovs-vswitchd.service
+OVN_CONTROLLER_SERVICE=ovn-controller.service
+OVN_CONTROLLER_VTEP_SERVICE=ovn-controller-vtep.service
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    OVSDB_SERVER_SERVICE=devstack@ovsdb-server.service
+    OVS_VSWITCHD_SERVICE=devstack@ovs-vswitchd.service
+    OVN_NORTHD_SERVICE=devstack@ovn-northd.service
+    OVN_CONTROLLER_SERVICE=devstack@ovn-controller.service
+    OVN_CONTROLLER_VTEP_SERVICE=devstack@ovn-controller-vtep.service
+fi
+
 # Defaults Overwrite
 # ------------------
 
@@ -131,10 +153,26 @@ ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
 # Utility Functions
 # -----------------
 
+function wait_for_sock_file {
+    local count=0
+    while [ ! -S $1 ]; do
+        sleep 1
+        count=$((count+1))
+        if [ "$count" -gt 5 ]; then
+            die $LINENO "Socket $1 not found"
+        fi
+    done
+}
+
 function use_new_ovn_repository {
     if [ -z "$is_new_ovn" ]; then
         local ovs_repo_dir=$DEST/$OVS_REPO_NAME
         if [ ! -d $ovs_repo_dir ]; then
+            git_timed clone $OVS_REPO $ovs_repo_dir
+            pushd $ovs_repo_dir
+            git checkout $OVS_BRANCH
+            popd
+        else
             clone_repository $OVS_REPO $ovs_repo_dir $OVS_BRANCH
         fi
         # Check the split commit exists in the current branch
@@ -153,14 +191,14 @@ function use_new_ovn_repository {
 # neutron-ovs-cleanup uses the OVSDB native interface.
 function ovn_base_setup_bridge {
     local bridge=$1
-    local addbr_cmd="ovs-vsctl --no-wait -- --may-exist add-br $bridge -- set bridge $bridge protocols=OpenFlow13,OpenFlow15"
+    local addbr_cmd="sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge -- set bridge $bridge protocols=OpenFlow13,OpenFlow15"
 
     if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
         addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
     fi
 
     $addbr_cmd
-    ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
+    sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
 }
 
 function _start_process {
@@ -229,8 +267,8 @@ function create_public_bridge {
     local ext_gw_ifc
     ext_gw_ifc=$(get_ext_gw_interface)
 
-    ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
-    ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
+    sudo ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
+    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
     if [ -n "$FLOATING_RANGE" ]; then
         local cidr_len=${FLOATING_RANGE#*/}
         sudo ip addr flush dev $ext_gw_ifc
@@ -337,35 +375,46 @@ function install_ovn {
     # Check the OVN configuration
     ovn_sanity_check
 
-    # If OVS is already installed, remove it, because we're about to re-install
-    # it from source.
-    for package in openvswitch openvswitch-switch openvswitch-common; do
-        if is_package_installed $package ; then
-            uninstall_package $package
-        fi
-    done
-
     # Install tox, used to generate the config (see devstack/override-defaults)
     pip_install tox
-    remove_ovs_packages
-    sudo rm -f $OVS_RUNDIR/*
 
-    compile_ovs $OVN_BUILD_MODULES
-    if use_new_ovn_repository; then
-        compile_ovn $OVN_BUILD_MODULES
+    sudo mkdir -p $OVS_RUNDIR
+    sudo chown $(whoami) $OVS_RUNDIR
+    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
+    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
+    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
+    sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
+
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+        # If OVS is already installed, remove it, because we're about to
+        # re-install it from source.
+        for package in openvswitch openvswitch-switch openvswitch-common; do
+            if is_package_installed $package ; then
+                uninstall_package $package
+            fi
+        done
+
+        remove_ovs_packages
+        sudo rm -f $OVS_RUNDIR/*
+
+        compile_ovs $OVN_BUILD_MODULES
+        if use_new_ovn_repository; then
+            compile_ovn $OVN_BUILD_MODULES
+        fi
+
+        sudo mkdir -p $OVS_PREFIX/var/log/openvswitch
+        sudo chown $(whoami) $OVS_PREFIX/var/log/openvswitch
+        sudo mkdir -p $OVS_PREFIX/var/log/ovn
+        sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
+    else
+        fixup_ovn_centos
+        install_package $(get_packages openvswitch)
+        install_package $(get_packages ovn)
     fi
 
     # Ensure that the OVS commands are accessible in the PATH
-    OVS_BINDIR=${OVS_BINDIR:-/usr/local/bin}
     export PATH=$OVS_BINDIR:$PATH
 
-    sudo mkdir -p $OVS_RUNDIR
-    sudo chown $(whoami) $OVS_RUNDIR
-    sudo mkdir -p $OVS_PREFIX/var/log/openvswitch
-    sudo chown $(whoami) $OVS_PREFIX/var/log/openvswitch
-    sudo mkdir -p $OVS_PREFIX/var/log/ovn
-    sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
-
     # Archive log files and create new
     local log_archive_dir=$LOGDIR/archive
     mkdir -p $log_archive_dir
@@ -494,7 +543,7 @@ function configure_ovn {
         iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
         iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
         iniset $OVN_META_CONF DEFAULT state_path $NEUTRON_STATE_PATH
-        iniset $OVN_META_CONF ovs ovsdb_connection unix:$OVS_RUNDIR/db.sock
+        iniset $OVN_META_CONF ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
         iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
         if is_service_enabled tls-proxy; then
             iniset $OVN_META_CONF ovn \
@@ -533,51 +582,58 @@ function _start_ovs {
         enable_service ovsdb-server
         enable_service ovs-vswitchd
 
-        if [ ! -f $OVS_DATADIR/conf.db ]; then
-            ovsdb-tool create $OVS_DATADIR/conf.db $OVS_SHAREDIR/vswitch.ovsschema
-        fi
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            if [ ! -f $OVS_DATADIR/conf.db ]; then
+                ovsdb-tool create $OVS_DATADIR/conf.db $OVS_SHAREDIR/vswitch.ovsschema
+            fi
 
-        if is_service_enabled ovn-controller-vtep; then
-            if [ ! -f $OVS_DATADIR/vtep.db ]; then
-                ovsdb-tool create $OVS_DATADIR/vtep.db $OVS_SHAREDIR/vtep.ovsschema
+            if is_service_enabled ovn-controller-vtep; then
+                if [ ! -f $OVS_DATADIR/vtep.db ]; then
+                    ovsdb-tool create $OVS_DATADIR/vtep.db $OVS_SHAREDIR/vtep.ovsschema
+                fi
             fi
-        fi
 
-        local dbcmd="$OVS_SBINDIR/ovsdb-server --remote=punix:$OVS_RUNDIR/db.sock --remote=ptcp:6640:$OVSDB_SERVER_LOCAL_HOST --pidfile --detach --log-file"
-        dbcmd+=" --remote=db:Open_vSwitch,Open_vSwitch,manager_options"
-        if is_service_enabled ovn-controller-vtep; then
-            dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
+            local dbcmd="$OVS_SBINDIR/ovsdb-server --remote=punix:$OVS_RUNDIR/db.sock --remote=ptcp:6640:$OVSDB_SERVER_LOCAL_HOST --pidfile --detach --log-file"
+            dbcmd+=" --remote=db:Open_vSwitch,Open_vSwitch,manager_options"
+            if is_service_enabled ovn-controller-vtep; then
+                dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
+            fi
+            dbcmd+=" $OVS_DATADIR/conf.db"
+            _run_process ovsdb-server "$dbcmd"
+
+            # Note: ovn-controller will create and configure br-int once it is started.
+            # So, no need to create it now because nothing depends on that bridge here.
+            local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
+            _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
+        else
+            _start_process "$OVSDB_SERVER_SERVICE"
+            _start_process "$OVS_VSWITCHD_SERVICE"
         fi
-        dbcmd+=" $OVS_DATADIR/conf.db"
-        _run_process ovsdb-server "$dbcmd"
 
         echo "Configuring OVSDB"
         if is_service_enabled tls-proxy; then
-            ovs-vsctl --no-wait set-ssl \
+            sudo ovs-vsctl --no-wait set-ssl \
                 $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
                 $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
                 $INT_CA_DIR/ca-chain.pem
         fi
-        ovs-vsctl --no-wait set open_vswitch . system-type="devstack"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:system-id="$OVN_UUID"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+
+        sudo ovs-vsctl --no-wait set-manager ptcp:6640:$OVSDB_SERVER_LOCAL_HOST
+        sudo ovs-vsctl --no-wait set open_vswitch . system-type="devstack"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:system-id="$OVN_UUID"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname="$LOCAL_HOSTNAME"
         # Select this chassis to host gateway routers
         if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
-            ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
+            sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
         fi
 
-        # Note: ovn-controller will create and configure br-int once it is started.
-        # So, no need to create it now because nothing depends on that bridge here.
-
-        local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
-        _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
-
         if is_provider_network || [[ $Q_USE_PROVIDERNET_FOR_PUBLIC == "True" ]]; then
             ovn_base_setup_bridge $OVS_PHYSICAL_BRIDGE
-            ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
+            sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
         fi
 
         if is_service_enabled ovn-controller-vtep ; then
@@ -595,20 +651,20 @@ function _start_ovs {
 }
 
 function _start_ovn_services {
-    _start_process "devstack@ovsdb-server.service"
-    _start_process "devstack@ovs-vswitchd.service"
+    _start_process "$OVSDB_SERVER_SERVICE"
+    _start_process "$OVS_VSWITCHD_SERVICE"
 
-    if is_service_enabled ovs-vtep ; then
-        _start_process "devstack@ovs-vtep.service"
-    fi
     if is_service_enabled ovn-northd ; then
-        _start_process "devstack@ovn-northd.service"
+        _start_process "$OVN_NORTHD_SERVICE"
     fi
     if is_service_enabled ovn-controller ; then
-        _start_process "devstack@ovn-controller.service"
+        _start_process "$OVN_CONTROLLER_SERVICE"
     fi
     if is_service_enabled ovn-controller-vtep ; then
-        _start_process "devstack@ovn-controller-vtep.service"
+        _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
+    fi
+    if is_service_enabled ovs-vtep ; then
+        _start_process "devstack@ovs-vtep.service"
     fi
     if is_service_enabled q-ovn-metadata-agent; then
         _start_process "devstack@q-ovn-metadata-agent.service"
@@ -627,39 +683,47 @@ function start_ovn {
     fi
 
     if is_service_enabled ovn-northd ; then
-        if is_service_enabled tls-proxy; then
-            local tls_args="\
-                --ovn-nb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
-                --ovn-nb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
-                --ovn-nb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
-                --ovn-sb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
-                --ovn-sb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
-                --ovn-sb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
-                "
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_northd"
+            local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
+
+            _run_process ovn-northd "$cmd" "$stop_cmd"
         else
-            local tls_args=""
+            _start_process "$OVN_NORTHD_SERVICE"
         fi
-        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor $tls_args start_northd"
-        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
 
-        _run_process ovn-northd "$cmd" "$stop_cmd"
-        ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        # Wait for the service to be ready
+        wait_for_sock_file $OVS_RUNDIR/ovnnb_db.sock
+        wait_for_sock_file $OVS_RUNDIR/ovnsb_db.sock
+
+        if is_service_enabled tls-proxy; then
+            sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+            sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+        fi
+        sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
         sudo ovs-appctl -t $OVS_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
         sudo ovs-appctl -t $OVS_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then
-        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
-        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
+            local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
 
-        _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+            _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+        else
+            _start_process "$OVN_CONTROLLER_SERVICE"
+        fi
     fi
 
     if is_service_enabled ovn-controller-vtep ; then
-        local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
-
-        _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
+            _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+        else
+            _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
+        fi
     fi
 
     if is_service_enabled q-ovn-metadata-agent; then
@@ -668,13 +732,6 @@ function start_ovn {
         setup_logging $OVN_META_CONF
     fi
 
-    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
-    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
-    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
-    if use_new_ovn_repository; then
-        sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
-    fi
-
     _start_ovn_services
 }
 
@@ -683,26 +740,35 @@ function _stop_ovs_dp {
     modprobe -q -r vport_geneve vport_vxlan openvswitch || true
 }
 
+function _stop_process {
+    local service=$1
+    echo "Stopping process $service"
+    if $SYSTEMCTL is-enabled $service; then
+        $SYSTEMCTL stop $service
+        $SYSTEMCTL disable $service
+    fi
+}
+
 function stop_ovn {
     if is_service_enabled q-ovn-metadata-agent; then
         sudo pkill -9 -f haproxy || :
-        stop_process neutron-ovn-metadata-agent
+        _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
     if is_service_enabled ovn-controller-vtep ; then
-        stop_process ovn-controller-vtep
+        _stop_process "$OVN_CONTROLLER_VTEP_SERVICE"
     fi
     if is_service_enabled ovn-controller ; then
-        stop_process ovn-controller
+        _stop_process "$OVN_CONTROLLER_SERVICE"
     fi
     if is_service_enabled ovn-northd ; then
-        stop_process ovn-northd
+        _stop_process "$OVN_NORTHD_SERVICE"
     fi
     if is_service_enabled ovs-vtep ; then
-        stop_process ovs-vtep
+        _stop_process "devstack@ovs-vtep.service"
     fi
 
-    stop_process ovs-vswitchd
-    stop_process ovsdb-server
+    _stop_process "$OVS_VSWITCHD_SERVICE"
+    _stop_process "$OVSDB_SERVER_SERVICE"
 
     _stop_ovs_dp
 }
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index cd7ee59c1d..25f726892f 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -184,6 +184,14 @@ function fixup_suse {
     sudo zypper up -y p11-kit ca-certificates-mozilla
 }
 
+function fixup_ovn_centos {
+    if [[ $os_VENDOR != "CentOS" ]]; then
+        return
+    fi
+    # OVN packages are part of this release for CentOS
+    yum_install centos-release-openstack-victoria
+}
+
 function fixup_all {
     fixup_keystone
     fixup_ubuntu

From 04b0b61557f7dad6c32b566255c21a36e4b0aefa Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 22 Dec 2020 12:23:56 -0600
Subject: [PATCH 2760/3333] Install swift keystone extras requirements

Since the introduction of I8f24b839bf42e2fb9803dc7df3a30ae20cf264
s-proxy is no longer able to launch as keystonemiddleware (listed under
test-requirements.txt) has not been installed.

keystonemiddleware is listed as extras requirements in swift
- https://github.com/openstack/swift/blob/e0d46d77fa740768f1dd5b989a63be85ff1fec20/setup.cfg#L79

Let's install swift keystone extra requirements also.

Closes-Bug: #1909018
Change-Id: I02c692e95d70017eea03d82d75ae6c5e87bde8b1
---
 lib/swift | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index a981dfc10a..790fb99442 100644
--- a/lib/swift
+++ b/lib/swift
@@ -741,7 +741,9 @@ function init_swift {
 
 function install_swift {
     git_clone $SWIFT_REPO $SWIFT_DIR $SWIFT_BRANCH
-    setup_develop $SWIFT_DIR
+    # keystonemiddleware needs to be installed via keystone extras as defined
+    # in setup.cfg, see bug #1909018 for more details.
+    setup_develop $SWIFT_DIR keystone
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
     fi

From fc41717222da029274236714f1447fcba1277b06 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 23 Dec 2020 10:52:20 +0000
Subject: [PATCH 2761/3333] cinder: Double [DEFAULT]/rpc_response_timeout to
 120

Bug #1873234 documents a number of CI failures caused by RPC requests
from c-api to c-vol timing out due to `lvchange` taking longer than the
default rpc_response_timeout of 60 seconds to complete.

While the underlying reason for the slowness should be investigated by
the cinder team a trivial workaround to the fallout created by these
timeouts is to simply double the client RPC timeout used by c-api,
allowing c-vol to return and overall the request to succeed.

Change-Id: I53dc0ae10af6aa13f1349b58373932eb6a15ab02
Related-Bug: #1873234
---
 lib/cinder | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index b892b91791..6c97e114a6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -236,6 +236,11 @@ function configure_cinder {
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 
+    # Avoid RPC timeouts in slow CI and test environments by doubling the
+    # default response timeout set by RPC clients. See bug #1873234 for more
+    # details and example failures.
+    iniset $CINDER_CONF DEFAULT rpc_response_timeout 120
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""

From 7e3428b9872d5b4b01ee10f2d29c55e7e2accbbd Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 11 Dec 2020 15:40:32 +0100
Subject: [PATCH 2762/3333] Install systemd-python from distribution package

CentOS 8 support start to fail because of an issue [1]
compiling systemd python binding modules.
Let install it from distribution packages as documented by
python-systemd project Web page [2]

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1862714
[2] https://github.com/systemd/python-systemd

Closes-Bug: #1908386
Change-Id: Ic7cfd72ce1b875e75b1cdbdd44a902b25d51abb8
---
 doc/source/systemd.rst  | 25 -------------------------
 files/debs/general      |  1 +
 files/rpms-suse/general |  2 +-
 files/rpms/general      |  2 +-
 stack.sh                |  1 -
 5 files changed, 3 insertions(+), 28 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 4f83b36f92..78535202d8 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -196,31 +196,6 @@ See the `remote-pdb`_ home page for more options.
 
 .. _`remote-pdb`: https://pypi.org/project/remote-pdb/
 
-Known Issues
-============
-
-Be careful about systemd python libraries. There are 3 of them on
-pypi, and they are all very different. They unfortunately all install
-into the ``systemd`` namespace, which can cause some issues.
-
-- ``systemd-python`` - this is the upstream maintained library, it has
-  a version number like systemd itself (currently ``234``). This is
-  the one you want.
-- ``systemd`` - a python 3 only library, not what you want.
-- ``python-systemd`` - another library you don't want. Installing it
-  on a system will break ansible's ability to run. The package has now
-  been renamed to ``cysystemd``, which avoids the namespace collision.
-
-
-If we were using user units, the ``[Service]`` - ``Group=`` parameter
-doesn't seem to work with user units, even though the documentation
-says that it should. This means that we will need to do an explicit
-``/usr/bin/sg``. This has the downside of making the SYSLOG_IDENTIFIER
-be ``sg``. We can explicitly set that with ``SyslogIdentifier=``, but
-it's really unfortunate that we're going to need this work
-around. This is currently not a problem because we're only using
-system units.
-
 Future Work
 ===========
 
diff --git a/files/debs/general b/files/debs/general
index 4bf1ff4039..d64417f1b7 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -28,6 +28,7 @@ pkg-config
 psmisc
 python3-dev
 python3-pip
+python3-systemd
 python3-venv
 tar
 tcpdump
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0af2b5b169..0de0876dcd 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -20,10 +20,10 @@ openssl
 pcre-devel # python-pcre
 postgresql-devel  # psycopg2
 psmisc
+python3-systemd
 python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
 python-xml
-systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
diff --git a/files/rpms/general b/files/rpms/general
index c42ce529e7..cfcd7ff261 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -25,8 +25,8 @@ postgresql-devel  # psycopg2
 psmisc
 python3-devel
 python3-pip
+python3-systemd
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
-systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
diff --git a/stack.sh b/stack.sh
index bb4dfa2561..036afd7b00 100755
--- a/stack.sh
+++ b/stack.sh
@@ -761,7 +761,6 @@ fixup_all
 # Install subunit for the subunit output stream
 pip_install -U os-testr
 
-pip_install_gr systemd-python
 # the default rate limit of 1000 messages / 30 seconds is not
 # sufficient given how verbose our logging is.
 iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"

From 36a575b036e55c31ab624447c5d73bc56408a672 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 13 Nov 2020 06:57:33 -0800
Subject: [PATCH 2763/3333] Clean up create_disk() a little

The create_disk() helper had some redundant checks and dead code. This
refactors it to put all the stale cleanup at the top, and groups the
new actions together with more relevant comments to make it easier
to understand.

Change-Id: I1f6218a1994e66786ed9a8065e30bcceec7b8956
---
 functions | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/functions b/functions
index e679b0f9bc..fc87a5512d 100644
--- a/functions
+++ b/functions
@@ -759,16 +759,14 @@ function create_disk {
     local loopback_disk_size=${3}
     local key
 
-    # Create a loopback disk and format it to XFS.
-    if [[ -e ${disk_image} ]]; then
-        if egrep -q ${storage_data_dir} /proc/mounts; then
-            sudo umount ${storage_data_dir}
-            sudo rm -f ${disk_image}
-        fi
-    fi
+    key=$(echo $disk_image | sed 's#/.##')
+    key="devstack-$key"
 
-    sudo mkdir -p ${storage_data_dir}/drives/images
+    destroy_disk $disk_image $storage_data_dir
 
+    # Create an empty file of the correct size (and ensure the
+    # directory structure up to that path exists)
+    sudo mkdir -p $(dirname ${disk_image})
     sudo truncate -s ${loopback_disk_size} ${disk_image}
 
     # Make a fresh XFS filesystem. Use bigger inodes so xattr can fit in
@@ -778,16 +776,9 @@ function create_disk {
     # Swift and Ceph.
     sudo mkfs.xfs -f -i size=1024 ${disk_image}
 
-    # Unmount the target, if mounted
-    if egrep -q $storage_data_dir /proc/mounts; then
-        sudo umount $storage_data_dir
-    fi
-
-    # Clear any old fstab rules, install a new one for this disk, and mount it
-    key=$(echo $disk_image | sed 's#/.##')
-    key="devstack-$key"
-    sudo sed -i '/.*comment=$key.*/ d' /etc/fstab
+    # Install a new loopback fstab entry for this disk image, and mount it
     echo "$disk_image $storage_data_dir xfs loop,noatime,nodiratime,logbufs=8,comment=$key 0 0" | sudo tee -a /etc/fstab
+    sudo mkdir -p $storage_data_dir
     sudo mount -v $storage_data_dir
 }
 
@@ -795,6 +786,10 @@ function create_disk {
 function destroy_disk {
     local disk_image=$1
     local storage_data_dir=$2
+    local key
+
+    key=$(echo $disk_image | sed 's#/.##')
+    key="devstack-$key"
 
     # Unmount the target, if mounted
     if egrep -q $storage_data_dir /proc/mounts; then
@@ -802,10 +797,10 @@ function destroy_disk {
     fi
 
     # Clear any fstab rules
-    sed -i '/.*comment=$key.*/ d' /etc/fstab
+    sudo sed -i '/.*comment=$key.*/ d' /etc/fstab
 
     # Delete the file
-    sudo rm $disk_image
+    sudo rm -f $disk_image
 }
 
 

From b37240382dc300f30efd83894fb0a9077e98d0ec Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 8 Jan 2021 09:41:56 +0100
Subject: [PATCH 2764/3333] Drop opensuse platform job

It has been broken for over a month. Feel free to revert in combination
with a fix, better with a commitment to keep the job in working shape
permanently.

Change-Id: I2604374c23716d56de29e16a459b7c7f45b84891
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c1406716fe..bf32af070e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -584,13 +584,6 @@
     voting: false
     timeout: 9000
 
-- job:
-    name: devstack-platform-opensuse-15
-    parent: tempest-full-py3
-    description: openSUSE 15.x platform test
-    nodeset: devstack-single-node-opensuse-15
-    voting: false
-
 - job:
     name: devstack-platform-bionic
     parent: tempest-full-py3
@@ -686,7 +679,6 @@
       jobs:
         - devstack
         - devstack-ipv6
-        - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
         - devstack-platform-bionic

From edee6dc341e40939360b36ce9fd09052dea1ee4d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 12 Jan 2021 14:04:38 -0800
Subject: [PATCH 2765/3333] Add debug helper script

I'm not sure if others will find this useful, but I use this
script to run pieces of devstack while trying to write/debug
things. It saves me a lot of time being able to get to some
project-lib function without a full clean/re-stack.

Figured I'd share in case it's worth putting into the tree.

Change-Id: I9a92fa71d34f50c2f5ba7d11c1a45301bd4478bf
---
 tools/debug_function.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100755 tools/debug_function.sh

diff --git a/tools/debug_function.sh b/tools/debug_function.sh
new file mode 100755
index 0000000000..68bd85dc61
--- /dev/null
+++ b/tools/debug_function.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# This is a small helper to speed development and debug with devstack.
+# It is intended to help you run a single function in a project module
+# without having to re-stack.
+#
+# For example, to run the just start_glance function, do this:
+#
+#   ./tools/debug_function.sh glance start_glance
+
+if [ ! -f "lib/$1" ]; then
+    echo "Usage: $0 [project] [function] [function...]"
+fi
+
+source stackrc
+source lib/$1
+shift
+set -x
+while [ "$1" ]; do
+    echo ==== Running $1 ====
+    $1
+    echo ==== Done with $1 ====
+    shift
+done

From bcd0acf6c0b5d6501e91133c3a937b3fc40f7122 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 13 Jan 2021 12:28:18 -0800
Subject: [PATCH 2766/3333] Also cap pip in tempest tox venv

I am still unable to stack because of pip 20.3, but this time
because of the tempest venv build. This forces it to the same
capped pip, which further works around the problem.

Change-Id: Icfaaefe1aa576733764b393cba96d276c9b1cf68
Related-Bug: #1906367
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 552e1c22a3..8ee986d555 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -703,6 +703,9 @@ function install_tempest {
     git checkout $TEMPEST_BRANCH
 
     tox -r --notest -efull
+    # TODO: remove the trailing pip constraint when a proper fix
+    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
+    $TEMPEST_DIR/.tox/tempest/bin/pip install -U -r $RC_DIR/tools/cap-pip.txt
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements

From ed164289a57549fb2b2404fc77052bb09ceb5105 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 18 Jan 2021 09:57:00 -0800
Subject: [PATCH 2767/3333] Always verify os_glance reserved namespace

On master, we should always enable tempest's verification of Glance's
os_glance namespace enforcement.

Change-Id: Ia71878e6c53ee683a868112959876798e946e2ce
Depends-On: https://review.opendev.org/c/openstack/glance/+/771070
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 552e1c22a3..b2047000e0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -351,6 +351,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
+    iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From eef2a0d751f4d53fb7b475e69e229cb541f7af2c Mon Sep 17 00:00:00 2001
From: Vanou Ishii <ishii.vanou@fujitsu.com>
Date: Wed, 20 Jan 2021 14:15:57 +0900
Subject: [PATCH 2768/3333] Fix Early Use of die function in stack.sh

This commit fixes use of die function before it's defined.
die function can be used after sourcing $TOP_DIR/functions chain-
sources $TOP_DIR/functions-common.
Because fixed portion of stack.sh checks existence of $TOP_DIR/inc
and sourcing $TOP_DIR/function chain source $TOP_DIR/inc, this commit
uses echo & exit command instead of die function.

Closes-Bug: #1913021
Change-Id: I5ec174cf7b02269525b1bfd0bfa94ea889d16fce
---
 stack.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 036afd7b00..c334159550 100755
--- a/stack.sh
+++ b/stack.sh
@@ -96,19 +96,25 @@ fi
 # templates and other useful files in the ``files`` subdirectory
 FILES=$TOP_DIR/files
 if [ ! -d $FILES ]; then
-    die $LINENO "missing devstack/files"
+    set +o xtrace
+    echo "missing devstack/files"
+    exit 1
 fi
 
 # ``stack.sh`` keeps function libraries here
 # Make sure ``$TOP_DIR/inc`` directory is present
 if [ ! -d $TOP_DIR/inc ]; then
-    die $LINENO "missing devstack/inc"
+    set +o xtrace
+    echo "missing devstack/inc"
+    exit 1
 fi
 
 # ``stack.sh`` keeps project libraries here
 # Make sure ``$TOP_DIR/lib`` directory is present
 if [ ! -d $TOP_DIR/lib ]; then
-    die $LINENO "missing devstack/lib"
+    set +o xtrace
+    echo "missing devstack/lib"
+    exit 1
 fi
 
 # Check if run in POSIX shell

From b4bba2f2c817dd5c7594e8c7950021969704db5d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 4 Feb 2021 23:24:17 +0000
Subject: [PATCH 2769/3333] Increase volumes quota for service project

If we are backing glance with cinder, we will use more volumes and
if timing is right, we will clash with other tests and be unable
to create what we need. If we are backing glance with cinder, we
should increase the volumes quota, which this patch does (to 50 from
a default of 10).

Closes-Bug: #1914665
Change-Id: I2ad1c4d21f996ee1a9ce29ba4f1a4b8f5720f8fb
---
 lib/cinder | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 6c97e114a6..33deff61f2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -539,6 +539,14 @@ function create_volume_types {
                 OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key ${be_name} set volume_backend_name=${be_name}
             fi
         done
+
+        # Increase quota for the service project if glance is using cinder,
+        # since it's likely to occasionally go above the default 10 in parallel
+        # test execution.
+        if [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+            openstack --os-region-name="$REGION_NAME" \
+                      quota set --volumes 50 "$SERVICE_PROJECT_NAME"
+        fi
     fi
 }
 

From a2273cc4c86348d0dd17ff8c64b2f1edeb620225 Mon Sep 17 00:00:00 2001
From: Flavio Fernandes <flaviof@redhat.com>
Date: Sat, 6 Feb 2021 16:23:36 -0500
Subject: [PATCH 2770/3333] [OVN] Support for network-logging config

This patchset adds configuration support for network logging
when the OVN driver is enabled.

Depends-On: https://review.opendev.org/768129
Change-Id: I6fc0973bedfd1dcc72b01981cd64f9283662d37c
Signed-off-by: Flavio Fernandes <flaviof@redhat.com>
---
 lib/neutron_plugins/ovn_agent | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..f2baf4a08d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -149,6 +149,9 @@ Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,qos}
 # this one allows empty:
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
 
+Q_LOG_DRIVER_RATE_LIMIT=${Q_LOG_DRIVER_RATE_LIMIT:-100}
+Q_LOG_DRIVER_BURST_LIMIT=${Q_LOG_DRIVER_BURST_LIMIT:-25}
+Q_LOG_DRIVER_LOG_BASE=${Q_LOG_DRIVER_LOG_BASE:-acl_log_meter}
 
 # Utility Functions
 # -----------------
@@ -490,6 +493,12 @@ function configure_ovn_plugin {
         populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group="$Q_USE_SECGROUP"
         inicomment /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver
 
+        if is_service_enabled q-log neutron-log; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE network_log rate_limit="$Q_LOG_DRIVER_RATE_LIMIT"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE network_log burst_limit="$Q_LOG_DRIVER_BURST_LIMIT"
+            inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
+        fi
+
         if is_service_enabled q-ovn-metadata-agent; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else

From 30d9bf9a6d8af9590b04caa3757956522f2004d4 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 19 Jan 2021 12:10:52 -0800
Subject: [PATCH 2771/3333] Async task support

We have a *ton* of stuff in devstack that is very linear, specifically
the ten-ish minutes we spend loading osc to run a single API command
against something. We also generate configs, sync databases, and other
things that use one core of our worker and make our runtime longer
than it really needs to be.

The idea in this patch is to make it super simple to run some things
in the background and then wait for them to finish before proceeding
to something that will require them to be done. This avoids the
interleaving you would expect by redirecting the async tasks to a log
file, and then cat'ing that log file synchronously during the wait
operation. The per-task log file remains so it's easier to examine
it in isolation.

Multiple people have reported between 22-30% improvement in the
time it takes to stack with this. More can be done, but what is here
already makes a significant difference.

Change-Id: I270a910b531641b023c13f75dfedca057a1f1031
---
 .zuul.yaml             |  12 +++
 clean.sh               |   2 +-
 extras.d/80-tempest.sh |   3 +-
 functions              |   1 +
 inc/async              | 225 +++++++++++++++++++++++++++++++++++++++++
 lib/keystone           |  40 ++++----
 lib/nova               |  29 +++---
 stack.sh               |  46 ++++++---
 unstack.sh             |   1 +
 9 files changed, 315 insertions(+), 44 deletions(-)
 create mode 100644 inc/async

diff --git a/.zuul.yaml b/.zuul.yaml
index c1406716fe..7b0696bcd7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -598,6 +598,17 @@
     nodeset: openstack-single-node-bionic
     voting: false
 
+- job:
+    name: devstack-async
+    parent: tempest-full-py3
+    description: Async mode enabled
+    voting: false
+    vars:
+      devstack_localrc:
+        DEVSTACK_PARALLEL: True
+      zuul_copy_output:
+        /opt/stack/async: logs
+
 - job:
     name: devstack-platform-fedora-latest
     parent: tempest-full-py3
@@ -690,6 +701,7 @@
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
         - devstack-platform-bionic
+        - devstack-async
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/clean.sh b/clean.sh
index 4cebf1d9ea..870dfd4313 100755
--- a/clean.sh
+++ b/clean.sh
@@ -113,7 +113,7 @@ cleanup_rpc_backend
 cleanup_database
 
 # Clean out data and status
-sudo rm -rf $DATA_DIR $DEST/status
+sudo rm -rf $DATA_DIR $DEST/status $DEST/async
 
 # Clean out the log file and log directories
 if [[ -n "$LOGFILE" ]] && [[ -f "$LOGFILE" ]]; then
diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 15ecfe39eb..06c73ec763 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -6,7 +6,7 @@ if is_service_enabled tempest; then
         source $TOP_DIR/lib/tempest
     elif [[ "$1" == "stack" && "$2" == "install" ]]; then
         echo_summary "Installing Tempest"
-        install_tempest
+        async_runfunc install_tempest
     elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
         # Tempest config must come after layer 2 services are running
         :
@@ -17,6 +17,7 @@ if is_service_enabled tempest; then
         # local.conf Tempest option overrides
         :
     elif [[ "$1" == "stack" && "$2" == "test-config" ]]; then
+        async_wait install_tempest
         echo_summary "Initializing Tempest"
         configure_tempest
         echo_summary "Installing Tempest Plugins"
diff --git a/functions b/functions
index fc87a5512d..89bbab2085 100644
--- a/functions
+++ b/functions
@@ -21,6 +21,7 @@ source ${FUNC_DIR}/inc/ini-config
 source ${FUNC_DIR}/inc/meta-config
 source ${FUNC_DIR}/inc/python
 source ${FUNC_DIR}/inc/rootwrap
+source ${FUNC_DIR}/inc/async
 
 # Save trace setting
 _XTRACE_FUNCTIONS=$(set +o | grep xtrace)
diff --git a/inc/async b/inc/async
new file mode 100644
index 0000000000..d29168f2f5
--- /dev/null
+++ b/inc/async
@@ -0,0 +1,225 @@
+#!/bin/bash
+#
+# Symbolic asynchronous tasks for devstack
+#
+# Usage:
+#
+#  async_runfunc my_shell_func foo bar baz
+#
+#  ... do other stuff ...
+#
+#  async_wait my_shell_func
+#
+
+DEVSTACK_PARALLEL=$(trueorfalse False DEVSTACK_PARALLEL)
+_ASYNC_BG_TIME=0
+
+# Keep track of how much total time was spent in background tasks
+# Takes a job runtime in ms.
+function _async_incr_bg_time {
+    local elapsed_ms="$1"
+    _ASYNC_BG_TIME=$(($_ASYNC_BG_TIME + $elapsed_ms))
+}
+
+# Get the PID of a named future to wait on
+function async_pidof {
+    local name="$1"
+    local inifile="${DEST}/async/${name}.ini"
+
+    if [ -f "$inifile" ]; then
+        iniget $inifile job pid
+    else
+        echo 'UNKNOWN'
+        return 1
+    fi
+}
+
+# Log a message about a job. If the message contains "%command" then the
+# full command line of the job will be substituted in the output
+function async_log {
+    local name="$1"
+    shift
+    local message="$*"
+    local inifile=${DEST}/async/${name}.ini
+    local pid
+    local command
+
+    pid=$(iniget $inifile job pid)
+    command=$(iniget $inifile job command | tr '#' '-')
+    message=$(echo "$message" | sed "s#%command#$command#g")
+
+    echo "[Async ${name}:${pid}]: $message"
+}
+
+# Inner function that actually runs the requested task. We wrap it like this
+# just so we can emit a finish message as soon as the work is done, to make
+# it easier to find the tracking just before an error.
+function async_inner {
+    local name="$1"
+    local rc
+    shift
+    set -o xtrace
+    if $* >${DEST}/async/${name}.log 2>&1; then
+        rc=0
+        set +o xtrace
+        async_log "$name" "finished successfully"
+    else
+        rc=$?
+        set +o xtrace
+        async_log "$name" "FAILED with rc $rc"
+    fi
+    iniset ${DEST}/async/${name}.ini job end_time $(date "+%s%3N")
+    return $rc
+}
+
+# Run something async. Takes a symbolic name and a list of arguments of
+# what to run. Ideally this would be rarely used and async_runfunc() would
+# be used everywhere for readability.
+#
+# This spawns the work in a background worker, records a "future" to be
+# collected by a later call to async_wait()
+function async_run {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local name="$1"
+    shift
+    local inifile=${DEST}/async/${name}.ini
+
+    touch $inifile
+    iniset $inifile job command "$*"
+    iniset $inifile job start_time $(date +%s%3N)
+
+    if [[ "$DEVSTACK_PARALLEL" = "True" ]]; then
+        async_inner $name $* &
+        iniset $inifile job pid $!
+        async_log "$name" "running: %command"
+        $xtrace
+    else
+        iniset $inifile job pid "self"
+        async_log "$name" "Running synchronously: %command"
+        $xtrace
+        $*
+        return $?
+    fi
+}
+
+# Shortcut for running a shell function async. Uses the function name as the
+# async name.
+function async_runfunc {
+    async_run $1 $*
+}
+
+# Wait for an async future to complete. May return immediately if already
+# complete, or of the future has already been waited on (avoid this). May
+# block until the future completes.
+function async_wait {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local pid rc running inifile runtime
+    rc=0
+    for name in $*; do
+        running=$(ls ${DEST}/async/*.ini 2>/dev/null | wc -l)
+        inifile="${DEST}/async/${name}.ini"
+
+        if pid=$(async_pidof "$name"); then
+            async_log "$name" "Waiting for completion of %command" \
+                      "($running other jobs running)"
+            time_start async_wait
+            if [[ "$pid" != "self" ]]; then
+                # Do not actually call wait if we ran synchronously
+                if wait $pid; then
+                    rc=0
+                else
+                    rc=$?
+                fi
+                cat ${DEST}/async/${name}.log
+            fi
+            time_stop async_wait
+            local start_time
+            local end_time
+            start_time=$(iniget $inifile job start_time)
+            end_time=$(iniget $inifile job end_time)
+            _async_incr_bg_time $(($end_time - $start_time))
+            runtime=$((($end_time - $start_time) / 1000))
+            async_log "$name" "finished %command with result" \
+                      "$rc in $runtime seconds"
+            rm -f $inifile
+            if [ $rc -ne 0 ]; then
+                echo Stopping async wait due to error: $*
+                break
+            fi
+        else
+            # This could probably be removed - it is really just here
+            # to help notice if you wait for something by the wrong
+            # name, but it also shows up for things we didn't start
+            # because they were not enabled.
+            echo Not waiting for async task $name that we never started or \
+                 has already been waited for
+        fi
+    done
+
+    $xtrace
+    return $rc
+}
+
+# Check for uncollected futures and wait on them
+function async_cleanup {
+    local name
+
+    if [[ "$DEVSTACK_PARALLEL" != "True" ]]; then
+        return 0
+    fi
+
+    for inifile in $(find ${DEST}/async -name '*.ini'); do
+        name=$(basename $pidfile .ini)
+        echo "WARNING: uncollected async future $name"
+        async_wait $name || true
+    done
+}
+
+# Make sure our async dir is created and clean
+function async_init {
+    local async_dir=${DEST}/async
+
+    # Clean any residue if present from previous runs
+    rm -Rf $async_dir
+
+    # Make sure we have a state directory
+    mkdir -p $async_dir
+}
+
+function async_print_timing {
+    local bg_time_minus_wait
+    local elapsed_time
+    local serial_time
+    local speedup
+
+    if [[ "$DEVSTACK_PARALLEL" != "True" ]]; then
+        return 0
+    fi
+
+    # The logic here is: All the background task time would be
+    # serialized if we did not do them in the background. So we can
+    # add that to the elapsed time for the whole run. However, time we
+    # spend waiting for async things to finish adds to the elapsed
+    # time, but is time where we're not doing anything useful. Thus,
+    # we substract that from the would-be-serialized time.
+
+    bg_time_minus_wait=$((\
+            ($_ASYNC_BG_TIME - ${_TIME_TOTAL[async_wait]}) / 1000))
+    elapsed_time=$(($(date "+%s") - $_TIME_BEGIN))
+    serial_time=$(($elapsed_time + $bg_time_minus_wait))
+
+    echo
+    echo "================="
+    echo " Async summary"
+    echo "================="
+    echo " Time spent in the background minus waits: $bg_time_minus_wait sec"
+    echo " Elapsed time: $elapsed_time sec"
+    echo " Time if we did everything serially: $serial_time sec"
+    echo " Speedup: " $(echo | awk "{print $serial_time / $elapsed_time}")
+}
diff --git a/lib/keystone b/lib/keystone
index d4c7b063bb..66e867ca68 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -318,25 +318,25 @@ function create_keystone_accounts {
     local admin_role="admin"
     local member_role="member"
 
-    get_or_add_user_domain_role $admin_role $admin_user default
+    async_run ks-domain-role get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
     get_or_create_domain "$SERVICE_DOMAIN_NAME"
-    get_or_create_project "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME"
+    async_run ks-project get_or_create_project "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME"
 
     # Service role, so service users do not have to be admins
-    get_or_create_role service
+    async_run ks-service get_or_create_role service
 
     # The ResellerAdmin role is used by Nova and Ceilometer so we need to keep it.
     # The admin role in swift allows a user to act as an admin for their project,
     # but ResellerAdmin is needed for a user to act as any project. The name of this
     # role is also configurable in swift-proxy.conf
-    get_or_create_role ResellerAdmin
+    async_run ks-reseller get_or_create_role ResellerAdmin
 
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
     local another_role="anotherrole"
-    get_or_create_role $another_role
+    async_run ks-anotherrole get_or_create_role $another_role
 
     # invisible project - admin can't see this one
     local invis_project
@@ -349,10 +349,12 @@ function create_keystone_accounts {
     demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "default" "demo@example.com")
 
-    get_or_add_user_project_role $member_role $demo_user $demo_project
-    get_or_add_user_project_role $admin_role $admin_user $demo_project
-    get_or_add_user_project_role $another_role $demo_user $demo_project
-    get_or_add_user_project_role $member_role $demo_user $invis_project
+    async_wait ks-{domain-role,domain,project,service,reseller,anotherrole}
+
+    async_run ks-demo-member get_or_add_user_project_role $member_role $demo_user $demo_project
+    async_run ks-demo-admin get_or_add_user_project_role $admin_role $admin_user $demo_project
+    async_run ks-demo-another get_or_add_user_project_role $another_role $demo_user $demo_project
+    async_run ks-demo-invis get_or_add_user_project_role $member_role $demo_user $invis_project
 
     # alt_demo
     local alt_demo_project
@@ -361,9 +363,9 @@ function create_keystone_accounts {
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
-    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
-    get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
-    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
+    async_run ks-alt-member get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
+    async_run ks-alt-admin get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
+    async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
     # groups
     local admin_group
@@ -373,11 +375,15 @@ function create_keystone_accounts {
     non_admin_group=$(get_or_create_group "nonadmins" \
         "default" "non-admin group")
 
-    get_or_add_group_project_role $member_role $non_admin_group $demo_project
-    get_or_add_group_project_role $another_role $non_admin_group $demo_project
-    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
-    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
-    get_or_add_group_project_role $admin_role $admin_group $admin_project
+    async_run ks-group-memberdemo get_or_add_group_project_role $member_role $non_admin_group $demo_project
+    async_run ks-group-anotherdemo get_or_add_group_project_role $another_role $non_admin_group $demo_project
+    async_run ks-group-memberalt get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
+    async_run ks-group-anotheralt get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
+    async_run ks-group-admin get_or_add_group_project_role $admin_role $admin_group $admin_project
+
+    async_wait ks-demo-{member,admin,another,invis}
+    async_wait ks-alt-{member,admin,another}
+    async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 
     if is_service_enabled ldap; then
         create_ldap_domain
diff --git a/lib/nova b/lib/nova
index d7426039c4..0a28cd97aa 100644
--- a/lib/nova
+++ b/lib/nova
@@ -741,31 +741,36 @@ function create_nova_keys_dir {
     sudo install -d -o $STACK_USER ${NOVA_STATE_PATH} ${NOVA_STATE_PATH}/keys
 }
 
+function init_nova_db {
+    local dbname="$1"
+    local conffile="$2"
+    recreate_database $dbname
+    $NOVA_BIN_DIR/nova-manage --config-file $conffile db sync --local_cell
+}
+
 # init_nova() - Initialize databases, etc.
 function init_nova {
     # All nova components talk to a central database.
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
+        # (Re)create nova databases
+        async_run nova-cell-0 init_nova_db nova_cell0 $NOVA_CONF
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            async_run nova-cell-$i init_nova_db nova_cell${i} $(conductor_conf $i)
+        done
+
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
-        recreate_database nova_cell0
-
         # map_cell0 will create the cell mapping record in the nova_api DB so
-        # this needs to come after the api_db sync happens. We also want to run
-        # this before the db sync below since that will migrate both the nova
-        # and nova_cell0 databases.
+        # this needs to come after the api_db sync happens.
         $NOVA_BIN_DIR/nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
 
-        # (Re)create nova databases
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            recreate_database nova_cell${i}
-            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync --local_cell
+        # Wait for DBs to finish from above
+        for i in $(seq 0 $NOVA_NUM_CELLS); do
+            async_wait nova-cell-$i
         done
 
-        # Migrate nova and nova_cell0 databases.
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
-
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
diff --git a/stack.sh b/stack.sh
index 036afd7b00..dcfef6db48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -330,6 +330,9 @@ if [[ ! -d $DATA_DIR ]]; then
     safe_chmod 0755 $DATA_DIR
 fi
 
+# Create and/or clean the async state directory
+async_init
+
 # Configure proper hostname
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
@@ -1082,19 +1085,19 @@ if is_service_enabled keystone; then
 
     create_keystone_accounts
     if is_service_enabled nova; then
-        create_nova_accounts
+        async_runfunc create_nova_accounts
     fi
     if is_service_enabled glance; then
-        create_glance_accounts
+        async_runfunc create_glance_accounts
     fi
     if is_service_enabled cinder; then
-        create_cinder_accounts
+        async_runfunc create_cinder_accounts
     fi
     if is_service_enabled neutron; then
-        create_neutron_accounts
+        async_runfunc create_neutron_accounts
     fi
     if is_service_enabled swift; then
-        create_swift_accounts
+        async_runfunc create_swift_accounts
     fi
 
 fi
@@ -1107,9 +1110,11 @@ write_clouds_yaml
 
 if is_service_enabled horizon; then
     echo_summary "Configuring Horizon"
-    configure_horizon
+    async_runfunc configure_horizon
 fi
 
+async_wait create_nova_accounts create_glance_accounts create_cinder_accounts
+async_wait create_neutron_accounts create_swift_accounts configure_horizon
 
 # Glance
 # ------
@@ -1117,7 +1122,7 @@ fi
 # NOTE(yoctozepto): limited to node hosting the database which is the controller
 if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     echo_summary "Configuring Glance"
-    init_glance
+    async_runfunc init_glance
 fi
 
 
@@ -1131,7 +1136,7 @@ if is_service_enabled neutron; then
 
     # Run init_neutron only on the node hosting the Neutron API server
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled neutron; then
-        init_neutron
+        async_runfunc init_neutron
     fi
 fi
 
@@ -1161,7 +1166,7 @@ fi
 
 if is_service_enabled swift; then
     echo_summary "Configuring Swift"
-    init_swift
+    async_runfunc init_swift
 fi
 
 
@@ -1170,7 +1175,7 @@ fi
 
 if is_service_enabled cinder; then
     echo_summary "Configuring Cinder"
-    init_cinder
+    async_runfunc init_cinder
 fi
 
 # Placement Service
@@ -1178,9 +1183,16 @@ fi
 
 if is_service_enabled placement; then
     echo_summary "Configuring placement"
-    init_placement
+    async_runfunc init_placement
 fi
 
+# Wait for neutron and placement before starting nova
+async_wait init_neutron
+async_wait init_placement
+async_wait init_glance
+async_wait init_swift
+async_wait init_cinder
+
 # Compute Service
 # ---------------
 
@@ -1192,7 +1204,7 @@ if is_service_enabled nova; then
     # TODO(stephenfin): Is it possible for neutron to *not* be enabled now? If
     # not, remove the if here
     if is_service_enabled neutron; then
-        configure_neutron_nova
+        async_runfunc configure_neutron_nova
     fi
 fi
 
@@ -1236,6 +1248,8 @@ if is_service_enabled cinder; then
     iniset $CINDER_CONF key_manager fixed_key "$FIXED_KEY"
 fi
 
+async_wait configure_neutron_nova
+
 # Launch the nova-api and wait for it to answer before continuing
 if is_service_enabled n-api; then
     echo_summary "Starting Nova API"
@@ -1282,7 +1296,7 @@ fi
 if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
-    create_flavors
+    async_runfunc create_flavors
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
@@ -1331,6 +1345,8 @@ if is_service_enabled horizon; then
     start_horizon
 fi
 
+async_wait create_flavors
+
 
 # Create account rc files
 # =======================
@@ -1467,8 +1483,12 @@ else
     exec 1>&3
 fi
 
+# Make sure we didn't leak any background tasks
+async_cleanup
+
 # Dump out the time totals
 time_totals
+async_print_timing
 
 # Using the cloud
 # ===============
diff --git a/unstack.sh b/unstack.sh
index 3197cf136f..d9dca7c107 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -184,3 +184,4 @@ if is_service_enabled cinder && is_package_installed lvm2; then
 fi
 
 clean_pyc_files
+rm -Rf $DEST/async

From e11d367d8e31a4875301e2e890fa8ffede270ec2 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 30 Sep 2020 13:06:39 +0100
Subject: [PATCH 2772/3333] orchestrate-devstack: Copy controller ceph.conf and
 keyrings to subnode

This change introduces a basic role to copy the contents of /etc/ceph
between the controller and subnodes during orchestrate-devstack allowing
a multinode ceph job to be introduced by
I9ffdff44a3ad42ebdf26ab72e24dfe3b12b1ef8b.

Note that this role is only used when devstack-plugin-ceph is enabled.

Change-Id: I324c0f35db34f8540ca164bf8c6e3dea67c5b1b4
---
 roles/orchestrate-devstack/tasks/main.yaml        |  5 +++++
 .../sync-controller-ceph-conf-and-keys/README.rst |  3 +++
 .../tasks/main.yaml                               | 15 +++++++++++++++
 3 files changed, 23 insertions(+)
 create mode 100644 roles/sync-controller-ceph-conf-and-keys/README.rst
 create mode 100644 roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml

diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index f747943f3c..2b8ae01a62 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -18,6 +18,11 @@
       name: sync-devstack-data
     when: devstack_services['tls-proxy']|default(false)
 
+  - name: Sync controller ceph.conf and key rings to subnode
+    include_role:
+      name: sync-controller-ceph-conf-and-keys
+    when: devstack_plugins is defined and 'devstack-plugin-ceph' in devstack_plugins
+
   - name: Run devstack on the sub-nodes
     include_role:
       name: run-devstack
diff --git a/roles/sync-controller-ceph-conf-and-keys/README.rst b/roles/sync-controller-ceph-conf-and-keys/README.rst
new file mode 100644
index 0000000000..e3d2bb42a4
--- /dev/null
+++ b/roles/sync-controller-ceph-conf-and-keys/README.rst
@@ -0,0 +1,3 @@
+Sync ceph config and keys between controller and subnodes
+
+Simply copy the contents of /etc/ceph on the controller to subnodes.
diff --git a/roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml b/roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml
new file mode 100644
index 0000000000..71ece579e6
--- /dev/null
+++ b/roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: Ensure /etc/ceph exists on subnode
+  become: true
+  file:
+    path: /etc/ceph
+    state: directory
+
+- name: Copy /etc/ceph from controller to subnode
+  become: true
+  synchronize:
+    owner: yes
+    group: yes
+    perms: yes
+    src: /etc/ceph/
+    dest: /etc/ceph/
+  delegate_to: controller

From b516efedf973d290c22c9279cf83d2dd47dc37fc Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 15 Feb 2021 10:11:43 +0000
Subject: [PATCH 2773/3333] nova: Default NOVA_USE_SERVICE_TOKEN to True

Introduced in devstack by I2d7348c4a72af96c0ed2ef6c0ab75d16e9aec8fc and
long tested by nova-next this enabled by most deployment tools by
default now and should be enabled by default in devstack.

Change-Id: Ia76b96fe87d99560db947a59cd0660aab9b05335
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 0a28cd97aa..1999753a8c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -135,7 +135,7 @@ fi
 # ``NOVA_USE_SERVICE_TOKEN`` is a mode where service token is passed along with
 # user token while communicating to external RESP API's like Neutron, Cinder
 # and Glance.
-NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
+NOVA_USE_SERVICE_TOKEN=$(trueorfalse True NOVA_USE_SERVICE_TOKEN)
 
 # ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
 # where there are at least two nova-computes.

From 57b092dbceb95ed03f8d33f64a5cc60eabd57e50 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 8 Feb 2021 11:37:38 -0600
Subject: [PATCH 2774/3333] Stop configure 'member' role in tempest_roles

Config option auth.tempest_roles is used to set the
extra roles to all dynamic cred tests users.
- https://opendev.org/openstack/tempest/src/commit/9b6f441fdc2a970410ea631dc1318896349e010f/tempest/common/credentials_factory.py#L82

Devstack set the 'member' role in CONF.auth.tempest_roles
- https://opendev.org/openstack/devstack/src/commit/556f84aea90c572873fc9834292635b41e590224/lib/tempest#L628

This cause issue if any tests testing for speciifc rols and want
to exclude the 'member' role, basically this bug
- https://bugs.launchpad.net/devstack/+bug/1915740

Also with 'member' role assigned by default, Tempest will not be
able to test the secure RBAC new default 'reader' role.

Let's remove  this role assignment now and let test congfigure what
they want.

Closes-Bug: #1915740

Change-Id: I0b6ab9fb943c7b0925a0a0d2490a8bcdfa76cedc
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 8ee986d555..04540e5ea8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -625,7 +625,6 @@ function configure_tempest {
     rm -f $tmp_u_c_m
 
     # Auth:
-    iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
             tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml

From 48b7633ae84c5be77c6415d7f95ca696e4c0a2b6 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 16 Feb 2021 14:14:23 -0800
Subject: [PATCH 2775/3333] Fix nova db dependency

When I reordered the nova database creation for better performance
and cleaner arrangement, I broke the non-standard arrangement where
the super and cell conductors are squashed together. In devstack,
this is implemented by pointing the controllers at cell1 in the
config, which makes it hard to create and sync the databases in the
natural order. This manifested in a failure when running in this
mode (which apparently Trove is).

As a quick fix, this special-cases the setup for cell0 if that mode
is enabled. I will follow this up with a cleaner refactor of all that
stuff so this hack isn't required, but that will take a bit longer.

Change-Id: I5385157c281beb041bf67cba546be20cf9497cbe
---
 lib/nova | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 0a28cd97aa..6913040d26 100644
--- a/lib/nova
+++ b/lib/nova
@@ -754,7 +754,17 @@ function init_nova {
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova databases
-        async_run nova-cell-0 init_nova_db nova_cell0 $NOVA_CONF
+        if [[ "$CELLSV2_SETUP" == "singleconductor" ]]; then
+            # If we are doing singleconductor mode, we have some strange
+            # interdependencies. in that the main config refers to cell1
+            # instead of cell0. In that case, just make sure the cell0 database
+            # is created before we need it below, but don't db_sync it until
+            # after the cellN databases are there.
+            recreate_database nova_cell0
+        else
+            async_run nova-cell-0 init_nova_db nova_cell0 $NOVA_CONF
+        fi
+
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             async_run nova-cell-$i init_nova_db nova_cell${i} $(conductor_conf $i)
         done
@@ -771,6 +781,11 @@ function init_nova {
             async_wait nova-cell-$i
         done
 
+        if [[ "$CELLSV2_SETUP" == "singleconductor" ]]; then
+            # We didn't db sync cell0 above, so run it now
+            $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
+        fi
+
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations

From f361122798b9e3163790bee81abfa0486746fa8a Mon Sep 17 00:00:00 2001
From: Pierre Riteau <pierre@stackhpc.com>
Date: Wed, 17 Feb 2021 17:43:13 +0100
Subject: [PATCH 2776/3333] Fix DevStack setup on CentOS 8.3

CentOS 8.3 changed the name of the PowerTools repository to powertools:
https://wiki.centos.org/Manuals/ReleaseNotes/CentOS8.2011#Yum_repo_file_and_repoid_changes

With this repository disabled, DevStack fails to install libyaml-devel,
which causes a failure to install many packages. In my environment
DevStack stopped with an error caused by a missing wget.

Keep the command using the old repository name, for compatibility with
older CentOS releases.

Change-Id: I5541a8aee8467abf10ce8a10d770618bdd693f02
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index d3c1476429..6375c8e5e0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -365,6 +365,9 @@ if [[ $DISTRO == "rhel8" ]]; then
     # EPEL packages assume that the PowerTools repository is enable.
     sudo dnf config-manager --set-enabled PowerTools
 
+    # CentOS 8.3 changed the repository name to lower case.
+    sudo dnf config-manager --set-enabled powertools
+
     if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
         _install_epel
     fi

From 3bdc8f66ad243f7487ba494e6a71f63c4965413a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 9 Feb 2021 12:56:34 -0600
Subject: [PATCH 2777/3333] Add a variable to configure the Tempest venv upper
 constraints

We use Tempest master for testing the supported stable
branches so using master upper constraints works fine but
when we need to use old Tempest in the below cases then master
upper constraints do not work and devstack will not be
able to install Tempest in vnenv:

- Testing Extended Maintenance branch
- Testing py2.7 jobs until stable/train with in-tree tempest plugins

This commit adds a variable to set the compatible upper constraint
to use for Tempest's old version.

Few of the current failure which can be fixed by this new configurable var:
- networking-generic-switch-tempest-dlm-python2
  - https://zuul.opendev.org/t/openstack/build/ebcf3d68d62c4af3a43a222aa9ce5556
- devstack-platform-xenial on stable/steinand stable/train
  - https://zuul.opendev.org/t/openstack/build/37ffc1af6f3f4b44b5ca8cbfa27068ac

Change-Id: I5b2217d85e6871ca3f7a3f6f859fdce9a50d3946
---
 lib/tempest | 28 +++++++++++++++++++++++-----
 stackrc     |  1 +
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 8ee986d555..77197c2a28 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -111,6 +111,21 @@ function image_size_in_gib {
     echo $size | python3 -c "import math; print(int(math.ceil(float(int(input()) / 1024.0 ** 3))))"
 }
 
+function set_tempest_venv_constraints {
+    local tmp_c
+    tmp_c=$1
+    if [[ $TEMPEST_VENV_UPPER_CONSTRAINTS == "master" ]]; then
+        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_c
+    else
+        echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
+        cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c
+        # NOTE: setting both tox env var and once Tempest start using new var
+        # TOX_CONSTRAINTS_FILE then we can remove the old one.
+        export UPPER_CONSTRAINTS_FILE=$TEMPEST_VENV_UPPER_CONSTRAINTS
+        export TOX_CONSTRAINTS_FILE=$TEMPEST_VENV_UPPER_CONSTRAINTS
+    fi
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     if [[ "$INSTALL_TEMPEST" == "True" ]]; then
@@ -617,10 +632,9 @@ function configure_tempest {
         tox -revenv-tempest --notest
     fi
 
-    # The requirements might be on a different branch, while tempest needs master requirements.
     local tmp_u_c_m
     tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
-    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+    set_tempest_venv_constraints $tmp_u_c_m
     tox -evenv-tempest -- pip install -c $tmp_u_c_m -r requirements.txt
     rm -f $tmp_u_c_m
 
@@ -702,6 +716,10 @@ function install_tempest {
     # TEMPEST_DIR already exist until RECLONE is true.
     git checkout $TEMPEST_BRANCH
 
+    local tmp_u_c_m
+    tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
+    set_tempest_venv_constraints $tmp_u_c_m
+
     tox -r --notest -efull
     # TODO: remove the trailing pip constraint when a proper fix
     # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
@@ -709,8 +727,9 @@ function install_tempest {
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
-    $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    $TEMPEST_DIR/.tox/tempest/bin/pip install -c $tmp_u_c_m -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    rm -f $tmp_u_c_m
     popd
 }
 
@@ -718,10 +737,9 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
         local tmp_u_c_m
         tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+        set_tempest_venv_constraints $tmp_u_c_m
         tox -evenv-tempest -- pip install -c $tmp_u_c_m $TEMPEST_PLUGINS
         rm -f $tmp_u_c_m
         echo "Checking installed Tempest plugins:"
diff --git a/stackrc b/stackrc
index a36f8970e6..244acbbbb0 100644
--- a/stackrc
+++ b/stackrc
@@ -298,6 +298,7 @@ REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-$TARGET_BRANCH}
 # Tempest test suite
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+TEMPEST_VENV_UPPER_CONSTRAINTS=${TEMPEST_VENV_UPPER_CONSTRAINTS:-master}
 
 
 ##############

From 8903d8c1e211607ce6bf86ff974f90717e8e2cac Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 15 Jan 2021 09:26:44 +0000
Subject: [PATCH 2778/3333] [OVN] Fix Fedora/CentOS OVN configuration

When installing OVN from packages, the rpm for Fedora / CentOS pre set
some configurations that conflicts with the post configuration done by
DevStack.

This patch fixes this problem by erasing the pre-set configuration from
the packages and leaving it to DevStack to configure OVN for its use
(just like we would do when compiling it from source).

Change-Id: I9c18023c9aa79c0633748a6169f4f283e9d74ef0
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron_plugins/ovn_agent | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..0a8ca9761f 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -529,6 +529,14 @@ function configure_ovn {
         fi
     fi
 
+    # Erase the pre-set configurations from packages. DevStack will
+    # configure OVS and OVN accordingly for its use.
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]] && is_fedora; then
+        sudo truncate -s 0 /etc/openvswitch/default.conf
+        sudo truncate -s 0 /etc/sysconfig/openvswitch
+        sudo truncate -s 0 /etc/sysconfig/ovn
+    fi
+
     # Metadata
     if is_service_enabled q-ovn-metadata-agent && is_service_enabled ovn-controller; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR

From 8f3e51d79f392151023f3853a6c8a3f7b868ecfa Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:18:48 +0000
Subject: [PATCH 2779/3333] nova: Die if console TLS enabled with tls-proxy

We require the 'tls-proxy' service to set up certificates for us. Hard
fail if 'NOVA_CONSOLE_PROXY_COMPUTE_TLS' is enabled but the 'tls-proxy'
service is not.

Change-Id: I52fec12b78ecd8f76f835551ccb84dfb1d5b3d8a
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6913040d26..28d3ba45d7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -83,6 +83,11 @@ fi
 # services and the compute node
 NOVA_CONSOLE_PROXY_COMPUTE_TLS=${NOVA_CONSOLE_PROXY_COMPUTE_TLS:-False}
 
+# Validate configuration
+if ! is_service_enabled tls-proxy && [ "$NOVA_CONSOLE_PROXY_COMPUTE_TLS" == "True" ]; then
+    die $LINENO "enabling TLS for the console proxy requires the tls-proxy service"
+fi
+
 # Public facing bits
 NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}

From f548ce4816b58d7e65d64fc22a1066f1aea63824 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Thu, 4 Mar 2021 10:31:30 +0900
Subject: [PATCH 2780/3333] Allow to install os-ken from git repo

os-ken is used by neutron ML2/OVS agent.
We need to install os-ken from source to test os-ken changes
against neutron. We already have tempest-integrated-networking job
in os-ken repo but it turns out it consumes os-ken from PyPI :-(

Change-Id: Ibcff212591e9fed25f1316403627269d81455b09
---
 lib/neutron_plugins/openvswitch_agent | 4 ++++
 stackrc                               | 5 +++++
 tests/test_libs_from_pypi.sh          | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 100961196d..7fed8bf853 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -15,6 +15,10 @@ function neutron_plugin_create_nova_conf {
 
 function neutron_plugin_install_agent_packages {
     _neutron_ovs_base_install_agent_packages
+    if use_library_from_git "os-ken"; then
+        git_clone_by_name "os-ken"
+        setup_dev_lib "os-ken"
+    fi
 }
 
 function neutron_plugin_configure_dhcp_agent {
diff --git a/stackrc b/stackrc
index a36f8970e6..2b1511d04f 100644
--- a/stackrc
+++ b/stackrc
@@ -554,6 +554,11 @@ GITREPO["ovsdbapp"]=${OVSDBAPP_REPO:-${GIT_BASE}/openstack/ovsdbapp.git}
 GITBRANCH["ovsdbapp"]=${OVSDBAPP_BRANCH:-$TARGET_BRANCH}
 GITDIR["ovsdbapp"]=$DEST/ovsdbapp
 
+# os-ken used by neutron
+GITREPO["os-ken"]=${OS_KEN_REPO:-${GIT_BASE}/openstack/os-ken.git}
+GITBRANCH["os-ken"]=${OS_KEN_BRANCH:-$TARGET_BRANCH}
+GITDIR["os-ken"]=$DEST/os-ken
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index ab7583d042..5b53389073 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient ovsdbapp"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 3c6d1059298788d4ce35845fdb1bef2938046702 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:35:47 +0000
Subject: [PATCH 2781/3333] nova: Remove nova-xvpvncproxy

This was removed this service from nova in Ussuri [1]. There's no need
to keep this around.

[1] I2f7f2379d0cd54e4d0a91008ddb44858cfc5a4cf

Change-Id: Idc95c6467a8c6e0c0ed07a6458425ff0a10ff995
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/lib/nova b/lib/nova
index 28d3ba45d7..caa778060f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -612,10 +612,10 @@ function configure_console_compute {
     # can use the NOVA_CPU_CELL variable to know which cell we are for
     # calculating the offset.
     # Stagger the offset based on the total number of possible console proxies
-    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # (novnc, spice, serial) so that their ports will not collide if
     # all are enabled.
     local offset
-    offset=$(((NOVA_CPU_CELL - 1) * 4))
+    offset=$(((NOVA_CPU_CELL - 1) * 3))
 
     # Use the host IP instead of the service host because for multi-node, the
     # service host will be the controller only.
@@ -623,7 +623,7 @@ function configure_console_compute {
     default_proxyclient_addr=$(iniget $NOVA_CPU_CONF DEFAULT my_ip)
 
     # All nova-compute workers need to know the vnc configuration options
-    # These settings don't hurt anything if n-xvnc and n-novnc are disabled
+    # These settings don't hurt anything if n-novnc is disabled
     if is_service_enabled n-cpu; then
         if [ "$NOVNC_FROM_PACKAGE" == "True" ]; then
             # Use the old URL when installing novnc packages.
@@ -636,13 +636,11 @@ function configure_console_compute {
             NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_lite.html"}
         fi
         iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
-        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:$((6081 + offset))/console"}
-        iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
-        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:$((6082 + offset))/spice_auto.html"}
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:$((6081 + offset))/spice_auto.html"}
         iniset $NOVA_CPU_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
 
-    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LISTEN_ADDRESS}
@@ -665,7 +663,7 @@ function configure_console_compute {
 
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CPU_CONF serial_console enabled True
-        iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6083 + offset))/"
+        iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6082 + offset))/"
     fi
 }
 
@@ -674,15 +672,13 @@ function configure_console_proxies {
     local conf=${1:-$NOVA_CONF}
     local offset=${2:-0}
     # Stagger the offset based on the total number of possible console proxies
-    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # (novnc, spice, serial) so that their ports will not collide if
     # all are enabled.
-    offset=$((offset * 4))
+    offset=$((offset * 3))
 
-    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $conf vnc novncproxy_port $((6080 + offset))
-        iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf vnc xvpvncproxy_port $((6081 + offset))
 
         if is_nova_console_proxy_compute_tls_enabled ; then
             iniset $conf vnc auth_schemes "vencrypt"
@@ -714,12 +710,12 @@ function configure_console_proxies {
 
     if is_service_enabled n-spice; then
         iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf spice html5proxy_port $((6082 + offset))
+        iniset $conf spice html5proxy_port $((6081 + offset))
     fi
 
     if is_service_enabled n-sproxy; then
         iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf serial_console serialproxy_port $((6083 + offset))
+        iniset $conf serial_console serialproxy_port $((6082 + offset))
     fi
 }
 
@@ -986,7 +982,7 @@ function start_nova_rest {
 
 function enable_nova_console_proxies {
     for i in $(seq 1 $NOVA_NUM_CELLS); do
-        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+        for srv in n-novnc n-spice n-sproxy; do
             if is_service_enabled $srv; then
                 enable_service ${srv}-cell${i}
             fi
@@ -1004,7 +1000,6 @@ function start_nova_console_proxies {
     # console proxies run globally for singleconductor, else they run per cell
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
-        run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
         run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
         run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
     else
@@ -1013,7 +1008,6 @@ function start_nova_console_proxies {
             local conf
             conf=$(conductor_conf $i)
             run_process n-novnc-cell${i} "$NOVA_BIN_DIR/nova-novncproxy --config-file $conf --web $NOVNC_WEB_DIR"
-            run_process n-xvnc-cell${i} "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $conf"
             run_process n-spice-cell${i} "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $conf --web $SPICE_WEB_DIR"
             run_process n-sproxy-cell${i} "$NOVA_BIN_DIR/nova-serialproxy --config-file $conf"
         done
@@ -1104,13 +1098,13 @@ function stop_nova_rest {
 
 function stop_nova_console_proxies {
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
-        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+        for srv in n-novnc n-spice n-sproxy; do
             stop_process $srv
         done
     else
         enable_nova_console_proxies
         for i in $(seq 1 $NOVA_NUM_CELLS); do
-            for srv in n-novnc n-xvnc n-spice n-sproxy; do
+            for srv in n-novnc n-spice n-sproxy; do
                 stop_process ${srv}-cell${i}
             done
         done

From 970891a4ef863344fb1425727b3c3bf91b1c8bb5 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:45:39 +0000
Subject: [PATCH 2782/3333] Remove references to XenAPI driver

The XenAPI driver was removed during the Victoria release [1], while the
libvirt+xen driver has been removed in the Wallaby release [2]. Remove
references to Xen from DevStack since its all a no-op now.

[1] I42b302afbb1cfede7a0f7b16485a596cd70baf17
[2] I73305e82da5d8da548961b801a8e75fb0e8c4cf1

Change-Id: If7055feb88391f496a5e5e4c72008bf0050c5356
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 HACKING.rst                           |   3 +-
 MAINTAINERS.rst                       |   4 -
 doc/source/configuration.rst          |   6 --
 doc/source/plugins.rst                |   2 +-
 functions                             |  25 ------
 functions-common                      |   2 -
 lib/cinder_plugins/XenAPINFS          |  46 -----------
 lib/glance                            |   4 -
 lib/nova                              |   8 --
 lib/nova_plugins/hypervisor-xenserver | 107 --------------------------
 lib/tempest                           |  14 +---
 stack.sh                              |  10 ---
 stackrc                               |  17 +---
 tools/image_list.sh                   |   2 +-
 tools/uec/meta.py                     |  42 ----------
 tools/xen/README.md                   |   3 -
 16 files changed, 6 insertions(+), 289 deletions(-)
 delete mode 100644 lib/cinder_plugins/XenAPINFS
 delete mode 100644 lib/nova_plugins/hypervisor-xenserver
 delete mode 100644 tools/uec/meta.py
 delete mode 100644 tools/xen/README.md

diff --git a/HACKING.rst b/HACKING.rst
index f55aed8a07..0c4de303ce 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -74,8 +74,7 @@ of test of specific fragile functions in the ``functions`` and
 
 ``tools`` - Contains a collection of stand-alone scripts. While these
 may reference the top-level DevStack configuration they can generally be
-run alone. There are also some sub-directories to support specific
-environments such as XenServer.
+run alone.
 
 
 Scripts
diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index d4968a6051..3cf61a6875 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -77,10 +77,6 @@ SUSE
 Tempest
 ~~~~~~~
 
-Xen
-~~~
-* Bob Ball <bob.ball@citrix.com>
-
 Zaqar (Marconi)
 ~~~~~~~~~~~~~~~
 
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 22f5999174..2d0c894530 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -628,12 +628,6 @@ outside of tox. If you would like to install it add the following to your
     INSTALL_TEMPEST=True
 
 
-Xenserver
-~~~~~~~~~
-
-If you would like to use Xenserver as the hypervisor, please refer to
-the instructions in ``./tools/xen/README.md``.
-
 Cinder
 ~~~~~~
 
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index a18a786c49..7d70d74dd0 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -241,7 +241,7 @@ locations in the top-level of the plugin repository:
   on Ubuntu, Debian or Linux Mint.
 
 - ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
-  on Red Hat, Fedora, CentOS or XenServer.
+  on Red Hat, Fedora, or CentOS.
 
 - ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
   running on SUSE Linux or openSUSE.
diff --git a/functions b/functions
index 89bbab2085..ccca5cda51 100644
--- a/functions
+++ b/functions
@@ -280,31 +280,6 @@ function upload_image {
         return
     fi
 
-    # XenServer-vhd-ovf-format images are provided as .vhd.tgz
-    # and should not be decompressed prior to loading
-    if [[ "$image_url" =~ '.vhd.tgz' ]]; then
-        image_name="${image_fname%.vhd.tgz}"
-        local force_vm_mode=""
-        if [[ "$image_name" =~ 'cirros' ]]; then
-            # Cirros VHD image currently only boots in PV mode.
-            # Nova defaults to PV for all VHD images, but
-            # the glance setting is needed for booting
-            # directly from volume.
-            force_vm_mode="vm_mode=xen"
-        fi
-        _upload_image "$image_name" ovf vhd "$image" $force_vm_mode
-        return
-    fi
-
-    # .xen-raw.tgz suggests a Xen capable raw image inside a tgz.
-    # and should not be decompressed prior to loading.
-    # Setting metadata, so PV mode is used.
-    if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
-        image_name="${image_fname%.xen-raw.tgz}"
-        _upload_image "$image_name" tgz raw "$image" vm_mode=xen
-        return
-    fi
-
     if [[ "$image_url" =~ '.hds' ]]; then
         image_name="${image_fname%.hds}"
         vm_mode=${image_name##*-}
diff --git a/functions-common b/functions-common
index 87d8c64804..340da754a2 100644
--- a/functions-common
+++ b/functions-common
@@ -397,8 +397,6 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
-    elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
-        DISTRO="xs${os_RELEASE%.*}"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
diff --git a/lib/cinder_plugins/XenAPINFS b/lib/cinder_plugins/XenAPINFS
deleted file mode 100644
index 92135e7c4f..0000000000
--- a/lib/cinder_plugins/XenAPINFS
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/bash
-#
-# lib/cinder_plugins/XenAPINFS
-# Configure the XenAPINFS driver
-
-# Enable with:
-#
-#   CINDER_DRIVER=XenAPINFS
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# configure_cinder_driver - make configuration changes, including those to other services
-
-# Save trace setting
-_XTRACE_CINDER_XENAPINFS=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default directories
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_driver - Set config files, create data dirs, etc
-function configure_cinder_driver {
-    iniset $CINDER_CONF DEFAULT volume_driver "cinder.volume.drivers.xenapi.sm.XenAPINFSDriver"
-    iniset $CINDER_CONF DEFAULT xenapi_connection_url "$CINDER_XENAPI_CONNECTION_URL"
-    iniset $CINDER_CONF DEFAULT xenapi_connection_username "$CINDER_XENAPI_CONNECTION_USERNAME"
-    iniset $CINDER_CONF DEFAULT xenapi_connection_password "$CINDER_XENAPI_CONNECTION_PASSWORD"
-    iniset $CINDER_CONF DEFAULT xenapi_nfs_server "$CINDER_XENAPI_NFS_SERVER"
-    iniset $CINDER_CONF DEFAULT xenapi_nfs_serverpath "$CINDER_XENAPI_NFS_SERVERPATH"
-}
-
-# Restore xtrace
-$_XTRACE_CINDER_XENAPINFS
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/lib/glance b/lib/glance
index c2a8b7492e..fcf778d3f6 100644
--- a/lib/glance
+++ b/lib/glance
@@ -279,10 +279,6 @@ function configure_glance {
     configure_keystone_authtoken_middleware $GLANCE_API_CONF glance
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
-        iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,raw,iso"
-    fi
     if [ "$VIRT_DRIVER" = 'libvirt' ] && [ "$LIBVIRT_TYPE" = 'parallels' ]; then
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
diff --git a/lib/nova b/lib/nova
index caa778060f..216c3cff9e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1052,14 +1052,6 @@ function is_nova_ready {
     # happen between here and the script ending. However, in multinode
     # tests this can very often not be the case. So ensure that the
     # compute is up before we move on.
-
-    # TODO(sdague): honestly, this probably should be a plug point for
-    # an external system.
-    if [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
-        # xenserver encodes information in the hostname of the compute
-        # because of the dom0/domU split. Just ignore for now.
-        return
-    fi
     wait_for_compute $NOVA_READY_TIMEOUT
 }
 
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
deleted file mode 100644
index 511ec1bc09..0000000000
--- a/lib/nova_plugins/hypervisor-xenserver
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/bin/bash
-#
-# lib/nova_plugins/hypervisor-xenserver
-# Configure the XenServer hypervisor
-
-# Enable with:
-# VIRT_DRIVER=xenserver
-
-# Dependencies:
-# ``functions`` file
-# ``nova`` configuration
-
-# install_nova_hypervisor - install any external requirements
-# configure_nova_hypervisor - make configuration changes, including those to other services
-# start_nova_hypervisor - start any external services
-# stop_nova_hypervisor - stop any external services
-# cleanup_nova_hypervisor - remove transient data and cache
-
-# Save trace setting
-_XTRACE_XENSERVER=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
-
-
-# Entry Points
-# ------------
-
-# clean_nova_hypervisor - Clean up an installation
-function cleanup_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# configure_nova_hypervisor - Set config files, create data dirs, etc
-function configure_nova_hypervisor {
-    if [ -z "$XENAPI_CONNECTION_URL" ]; then
-        die $LINENO "XENAPI_CONNECTION_URL is not specified"
-    fi
-
-    # Check os-xenapi plugin is enabled
-    local plugins="${DEVSTACK_PLUGINS}"
-    local plugin
-    local found=0
-    for plugin in ${plugins//,/ }; do
-        if [[ "$plugin" = "os-xenapi" ]]; then
-            found=1
-            break
-        fi
-    done
-    if [[ $found -ne 1 ]]; then
-        die $LINENO "os-xenapi plugin is not specified. Please enable this plugin in local.conf"
-    fi
-
-    iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
-    iniset $NOVA_CONF xenserver connection_url "$XENAPI_CONNECTION_URL"
-    iniset $NOVA_CONF xenserver connection_username "$XENAPI_USER"
-    iniset $NOVA_CONF xenserver connection_password "$XENAPI_PASSWORD"
-    iniset $NOVA_CONF DEFAULT flat_injected "False"
-
-    local dom0_ip
-    dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
-
-    local ssh_dom0
-    ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
-
-    # install console logrotate script
-    tar -czf - -C $NOVA_DIR/tools/xenserver/ rotate_xen_guest_logs.sh |
-        $ssh_dom0 'tar -xzf - -C /root/ && chmod +x /root/rotate_xen_guest_logs.sh && mkdir -p /var/log/xen/guest'
-
-    # Create a cron job that will rotate guest logs
-    $ssh_dom0 crontab - << CRONTAB
-* * * * * /root/rotate_xen_guest_logs.sh >/dev/null 2>&1
-CRONTAB
-
-}
-
-# install_nova_hypervisor() - Install external components
-function install_nova_hypervisor {
-    # xenapi functionality is now included in os-xenapi library which houses the plugin
-    # so this function intentionally left blank
-    :
-}
-
-# start_nova_hypervisor - Start any required external services
-function start_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# stop_nova_hypervisor - Stop any external services
-function stop_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-
-# Restore xtrace
-$_XTRACE_XENSERVER
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/lib/tempest b/lib/tempest
index 8a5b785927..9ccd19b505 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -347,9 +347,6 @@ function configure_tempest {
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
-    if [ "$VIRT_DRIVER" = "xenserver" ]; then
-        iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
-    fi
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
     # Compute
@@ -425,15 +422,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
     # Scenario
-    if [ "$VIRT_DRIVER" = "xenserver" ]; then
-        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
-        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.vhd.tgz"
-        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
-        iniset $TEMPEST_CONFIG scenario img_container_format ovf
-    else
-        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
-        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
-    fi
+    SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
+    SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_DIR/$SCENARIO_IMAGE_FILE
 
     # If using provider networking, use the physical network for validation rather than private
diff --git a/stack.sh b/stack.sh
index 6375c8e5e0..ca9ecfa213 100755
--- a/stack.sh
+++ b/stack.sh
@@ -718,16 +718,6 @@ if is_service_enabled keystone; then
 fi
 
 
-# Nova
-# -----
-
-if is_service_enabled nova && [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
-    # Look for the backend password here because read_password
-    # is not a library function.
-    read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
-fi
-
-
 # Swift
 # -----
 
diff --git a/stackrc b/stackrc
index a36f8970e6..205481be08 100644
--- a/stackrc
+++ b/stackrc
@@ -605,10 +605,8 @@ ENABLE_VOLUME_MULTIATTACH=$(trueorfalse False ENABLE_VOLUME_MULTIATTACH)
 
 # Nova hypervisor configuration.  We default to libvirt with **kvm** but will
 # drop back to **qemu** if we are unable to load the kvm module.  ``stack.sh`` can
-# also install an **LXC**, **OpenVZ** or **XenAPI** based system.  If xenserver-core
-# is installed, the default will be XenAPI
+# also install an **LXC** or **OpenVZ** based system.
 DEFAULT_VIRT_DRIVER=libvirt
-is_package_installed xenserver-core && DEFAULT_VIRT_DRIVER=xenserver
 VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
@@ -633,14 +631,6 @@ case "$VIRT_DRIVER" in
     fake)
         NUMBER_FAKE_NOVA_COMPUTE=${NUMBER_FAKE_NOVA_COMPUTE:-1}
         ;;
-    xenserver)
-        # Xen config common to nova and neutron
-        XENAPI_USER=${XENAPI_USER:-"root"}
-        # This user will be used for dom0 - domU communication
-        #   should be able to log in to dom0 without a password
-        #   will be used to install the plugins
-        DOMZERO_USER=${DOMZERO_USER:-"domzero"}
-        ;;
     *)
         ;;
 esac
@@ -695,11 +685,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-$DEFAULT_IMAGE_NAME}
             IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/${DEFAULT_IMAGE_FILE_NAME}";;
-        xenserver)
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk}
-            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk.vhd.tgz}
-            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.5-x86_64-disk.vhd.tgz"
-            IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
         fake)
             # Use the same as the default for libvirt
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
diff --git a/tools/image_list.sh b/tools/image_list.sh
index 3a27c4acfd..81231be9f3 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -22,7 +22,7 @@ source $TOP_DIR/functions
 
 # Possible virt drivers, if we have more, add them here. Always keep
 # dummy in the end position to trigger the fall through case.
-DRIVERS="openvz ironic libvirt vsphere xenserver dummy"
+DRIVERS="openvz ironic libvirt vsphere dummy"
 
 # Extra variables to trigger getting additional images.
 export ENABLED_SERVICES="h-api,tr-api"
diff --git a/tools/uec/meta.py b/tools/uec/meta.py
deleted file mode 100644
index 1d994a60d6..0000000000
--- a/tools/uec/meta.py
+++ /dev/null
@@ -1,42 +0,0 @@
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-import BaseHTTPServer
-import SimpleHTTPServer
-import sys
-
-
-def main(host, port, HandlerClass=SimpleHTTPServer.SimpleHTTPRequestHandler,
-         ServerClass=BaseHTTPServer.HTTPServer, protocol="HTTP/1.0"):
-    """simple http server that listens on a give address:port."""
-
-    server_address = (host, port)
-
-    HandlerClass.protocol_version = protocol
-    httpd = ServerClass(server_address, HandlerClass)
-
-    sa = httpd.socket.getsockname()
-    print("Serving HTTP on", sa[0], "port", sa[1], "...")
-    httpd.serve_forever()
-
-if __name__ == '__main__':
-    if sys.argv[1:]:
-        address = sys.argv[1]
-    else:
-        address = '0.0.0.0'
-    if ':' in address:
-        host, port = address.split(':')
-    else:
-        host = address
-        port = 8080
-
-    main(host, int(port))
diff --git a/tools/xen/README.md b/tools/xen/README.md
deleted file mode 100644
index 287301156e..0000000000
--- a/tools/xen/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Note: XenServer relative tools have been moved to `os-xenapi`_ and be maintained there.
-
-.. _os-xenapi: https://opendev.org/x/os-xenapi/

From 3948fcb03c96bacc0c620de5b2c18a475e7afef2 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:51:49 +0000
Subject: [PATCH 2783/3333] Remove MAINTAINERS.rst

This file is mega out-of-date and no longer helpful. Remove it.

Change-Id: Ic7e215c3e48a9c453d19355ad7d683494811d2af
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 HACKING.rst     |  3 --
 MAINTAINERS.rst | 88 -------------------------------------------------
 2 files changed, 91 deletions(-)
 delete mode 100644 MAINTAINERS.rst

diff --git a/HACKING.rst b/HACKING.rst
index 0c4de303ce..6a91e0a6a8 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -274,9 +274,6 @@ your change
   even years from now -- why we were motivated to make a change at the
   time.
 
-* **Reviewers** -- please see ``MAINTAINERS.rst`` for a list of people
-  that should be added to reviews of various sub-systems.
-
 
 Making Changes, Testing, and CI
 -------------------------------
diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
deleted file mode 100644
index 3cf61a6875..0000000000
--- a/MAINTAINERS.rst
+++ /dev/null
@@ -1,88 +0,0 @@
-MAINTAINERS
-===========
-
-
-Overview
---------
-
-The following is a list of people known to have interests in
-particular areas or sub-systems of devstack.
-
-It is a rather general guide intended to help seed the initial
-reviewers list of a change.  A +1 on a review from someone identified
-as being a maintainer of its affected area is a very positive flag to
-the core team for the veracity of the change.
-
-The ``devstack-core`` group can still be added to all reviews.
-
-
-Format
-~~~~~~
-
-The format of the file is the name of the maintainer and their
-gerrit-registered email.
-
-
-Maintainers
------------
-
-.. contents:: :local:
-
-
-Ceph
-~~~~
-
-* Sebastien Han <sebastien.han@enovance.com>
-
-Cinder
-~~~~~~
-
-Fedora/CentOS/RHEL
-~~~~~~~~~~~~~~~~~~
-
-* Ian Wienand <iwienand@redhat.com>
-
-Neutron
-~~~~~~~
-
-MidoNet
-~~~~~~~
-
-* Jaume Devesa <devvesa@gmail.com>
-* Ryu Ishimoto <ryu@midokura.com>
-* YAMAMOTO Takashi <yamamoto@midokura.com>
-
-OpenDaylight
-~~~~~~~~~~~~
-
-* Kyle Mestery <mestery@mestery.com>
-
-OpenFlow Agent (ofagent)
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-* YAMAMOTO Takashi <yamamoto@valinux.co.jp>
-* Fumihiko Kakuma <kakuma@valinux.co.jp>
-
-Swift
-~~~~~
-
-* Chmouel Boudjnah <chmouel@enovance.com>
-
-SUSE
-~~~~
-
-* Ralf Haferkamp <rhafer@suse.de>
-* Vincent Untz <vuntz@suse.com>
-
-Tempest
-~~~~~~~
-
-Zaqar (Marconi)
-~~~~~~~~~~~~~~~
-
-* Flavio Percoco <flaper87@gmail.com>
-* Malini Kamalambal <malini.kamalambal@rackspace.com>
-
-Oracle Linux
-~~~~~~~~~~~~
-* Wiekus Beukes <wiekus.beukes@oracle.com>

From 9dc2b88eb42a5f98f43bc8ad3dfa3962a4d44d74 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 5 Mar 2021 09:32:19 -0600
Subject: [PATCH 2784/3333] Add enforce_scope setting support for keystone

Keystone-tempest-plugin has implemented the secure RBAC
tests and enabling the enforce_scope via keystone devstack
plugin. Doing those setting in devstack will help to manage
easily and in central place also avoid restarting the api
service.

Change-Id: I30da189474476d3397152a0a15c2e30a62d712ad
---
 lib/keystone | 11 +++++++++++
 lib/tempest  | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 66e867ca68..e282db0bfa 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,6 +134,12 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the Identity API policies to start checking the scope of token. By Default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -281,6 +287,11 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
+        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
+        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index 8a5b785927..f210e4014b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -601,6 +601,16 @@ function configure_tempest {
         fi
     done
 
+    # ``enforce_scope``
+    # If services enable the enforce_scope for their policy
+    # we need to enable the same on Tempest side so that
+    # test can be run with scoped token.
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope keystone true
+        iniset $TEMPEST_CONFIG auth admin_system 'all'
+        iniset $TEMPEST_CONFIG auth admin_project_name ''
+    fi
+
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes
         # so basically anything with cinder is out of the question.

From 8c93049220bd3551b53513426c5a7bfdb7bac1d9 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 5 Mar 2021 09:40:39 -0600
Subject: [PATCH 2785/3333] Add enforce_scope setting support for Glance

Glance started moving to new RBAC and glance-tempest-plugin
and Tempest need to set few configuration to enable the
scope checks on glance side and so does on Temepst side to tell
glance is ready with scope checks so that test can be run with
scoped token.

Change-Id: I09f513d08212bc80a3a86a750b29b1c6625d2f89
---
 lib/glance  | 12 ++++++++++++
 lib/tempest |  1 +
 2 files changed, 13 insertions(+)

diff --git a/lib/glance b/lib/glance
index c2a8b7492e..fd2f2cb902 100644
--- a/lib/glance
+++ b/lib/glance
@@ -85,6 +85,12 @@ GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_s
 
 GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the Image API policies to start checking the scope of token. By Default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+GLANCE_ENFORCE_SCOPE=$(trueorfalse False GLANCE_ENFORCE_SCOPE)
+
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
@@ -371,6 +377,12 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
+
+    if [[ "$GLANCE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $GLANCE_API_CONF oslo_policy enforce_scope true
+        iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
+        iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
diff --git a/lib/tempest b/lib/tempest
index f210e4014b..0a9f800bcc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -610,6 +610,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_system 'all'
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
+    iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes

From bd0d0fde24a5654507e02d32eea7ea0c1fc46821 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Sat, 6 Mar 2021 17:23:39 -0600
Subject: [PATCH 2786/3333] Add enforce_scope setting support for Cinder

Conder started moving to new RBAC and cinder-tempest-plugin
and Tempest need to set few configuration to enable the
scope checks on cinder side and on Temepst side to tell
cinder is all configured with scope checks and test can be run with
scoped token.

Change-Id: Ic7cd919c000c4e7b9a3a06638a5bd87b1617e749
---
 lib/cinder  | 11 +++++++++++
 lib/tempest |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 33deff61f2..da6f32728e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -125,6 +125,12 @@ CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
 # enable the cache for all cinder backends.
 CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_ENABLED_BACKENDS}
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the  Volume API policies to start checking the scope of token. by default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+CINDER_ENFORCE_SCOPE=$(trueorfalse False CINDER_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -326,6 +332,11 @@ function configure_cinder {
     elif is_service_enabled etcd3; then
         iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
     fi
+
+    if [[ "$CINDER_ENFORCE_SCOPE" == True ]] ; then
+        iniset $CINDER_CONF oslo_policy enforce_scope true
+        iniset $CINDER_CONF oslo_policy enforce_new_defaults true
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
diff --git a/lib/tempest b/lib/tempest
index f210e4014b..238e25f07b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -611,6 +611,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
 
+    iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"
+
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes
         # so basically anything with cinder is out of the question.

From 38fed19acc2aa232503f91424d6c732ed8c7ed3a Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 8 Mar 2021 08:50:53 +0000
Subject: [PATCH 2787/3333] Update Cirros to 0.5.2

This release [1] includes a single fix [2] pulling in the ahci module
which is required by Iad1adbc23b31dd54a96299e7a8a4b622c15eed8d, a
nova-next change introducing q35 testing to the job.

This depends on the following change caching the image within the CI
host image:

Depends-On: https://review.opendev.org/c/openstack/project-config/+/779178/

[1] https://github.com/cirros-dev/cirros/releases/tag/0.5.2
[2] https://github.com/cirros-dev/cirros/pull/65

Change-Id: I12e0bdb3699e5343592ab834468ba6b2fcdcaaf4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 205481be08..1bcc302846 100644
--- a/stackrc
+++ b/stackrc
@@ -657,7 +657,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.5.1"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 802259a49656170108dd79559166ad89c49e2ef7 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 12 Jan 2021 22:55:57 +0000
Subject: [PATCH 2788/3333] Simulate a remote/standalone g-api worker

In order to be able to test glance's distributed import function,
we need to have multiple workers in an arrangement like they
would be if one was on another host (potentially at another site).
This extra worker must be separate from the default image service
in order to repeatedly hit one and then the other to test cross-
service interactions.

This allows you to enable_service g-api-r, which will clone the main
g-api service, modify it to run on a different port, and start it.
The service will be registered in the catalog as image_remote.

Depends-On: https://review.opendev.org/c/openstack/glance/+/769976
Change-Id: I0e2bb5412701d515153c023873addb9d7abdb8a4
---
 lib/glance  | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/tempest |  5 ++++
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index c2a8b7492e..cf66023f5c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -131,7 +131,7 @@ function is_glance_enabled {
 # runs that a clean run would need to clean up
 function cleanup_glance {
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $(glance_remote_conf '')
 
     # Cleanup multiple stores directories
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
@@ -365,6 +365,11 @@ function configure_glance {
 
     if [[ "$GLANCE_STANDALONE" == False ]]; then
         write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+        # Grab our uwsgi listen address and use that to fill out our
+        # worker_self_reference_url config
+        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
+               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' \
+                    $GLANCE_UWSGI_CONF)
     else
         write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -460,6 +465,64 @@ function install_glance {
     setup_develop $GLANCE_DIR
 }
 
+# glance_remote_conf() - Return the path to an alternate config file for
+#                        the remote glance clone
+function glance_remote_conf {
+    echo "$(dirname ${GLANCE_CONF_DIR})/glance-remote/"$(basename "$1")
+}
+
+# start_glance_remote_clone() - Clone the regular glance api worker
+function start_glance_remote_clone {
+    local glance_remote_conf glance_remote_port
+
+    glance_remote_conf_dir=$(glance_remote_conf '')
+    glance_remote_port=$(get_random_port)
+
+    # Clone the existing ready-to-go glance-api setup
+    sudo rm -Rf $glance_remote_conf_dir
+    sudo cp -r "$GLANCE_CONF_DIR" $glance_remote_conf_dir
+    sudo chown $STACK_USER -R $glance_remote_conf_dir
+
+    # Point this worker at different data dirs
+    remote_data="${DATA_DIR}/glance-remote"
+    mkdir -p $remote_data/os_glance_tasks_store \
+          $remote_data/os_glance_staging_store
+    iniset $(glance_remote_conf 'glance-api.conf') os_glance_staging_store \
+           filesystem_store_datadir ${remote_data}/os_glance_staging_store
+    iniset $(glance_remote_conf 'glance-api.conf') os_glance_tasks_store \
+           filesystem_store_datadir ${remote_data}/os_glance_tasks_store
+
+    # Change our uwsgi to our new port
+    sed -ri "s/^(http-socket.*):[0-9]+/\1:$glance_remote_port/" \
+        $(glance_remote_conf $GLANCE_UWSGI_CONF)
+
+    # Update the self-reference url with our new port
+    iniset $(glance_remote_conf $GLANCE_API_CONF) DEFAULT \
+           worker_self_reference_url \
+           $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
+                $(glance_remote_conf $GLANCE_UWSGI_CONF))
+
+    # We need to create the systemd service for the clone, but then
+    # change it to include an Environment line to point the WSGI app
+    # at the alternate config directory.
+    write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
+                               --procname-prefix \
+                               glance-api-remote \
+                               --ini $(glance_remote_conf $GLANCE_UWSGI_CONF)" \
+                               "" "$STACK_USER"
+    iniset -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
+           "Service" "Environment" "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
+
+    # Reload and restart with the new config
+    $SYSTEMCTL daemon-reload
+    $SYSTEMCTL restart devstack@g-api-r
+
+    get_or_create_service glance_remote image_remote "Alternate glance"
+    get_or_create_endpoint image_remote $REGION_NAME \
+                $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
+                    $(glance_remote_conf $GLANCE_UWSGI_CONF))
+}
+
 # start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
@@ -475,6 +538,11 @@ function start_glance {
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
     fi
 
+    if is_service_enabled g-api-r; then
+        echo "Starting the g-api-r clone service..."
+        start_glance_remote_clone
+    fi
+
     echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
         die $LINENO "g-api did not start"
@@ -484,6 +552,7 @@ function start_glance {
 # stop_glance() - Stop running processes
 function stop_glance {
     stop_process g-api
+    stop_process g-api-r
 }
 
 # Restore xtrace
diff --git a/lib/tempest b/lib/tempest
index 8eab4f5ef2..7e7f0ab7a9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -352,6 +352,11 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
+    if is_service_enabled g-api-r; then
+        iniset $TEMPEST_CONFIG image alternate_image_endpoint \
+               "image_remote"
+    fi
+
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From 61b4fbf143b96365fa85456246bcadcaab3d76be Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 9 Mar 2021 08:05:37 -0800
Subject: [PATCH 2789/3333] Address feedback from glance-remote patch

This cleans up some of the quote and variable handling that was
pointed out in review of the previous patch. This is non-critical,
so I'm putting it in a subsequent patch to avoid disturbing the
careful alignment of patches across three projects that are mostly
approved.

Change-Id: I9b281efd74ba5cd78f97b84e5704b41fd040e481
---
 lib/glance  | 40 ++++++++++++++++++++++------------------
 lib/tempest |  3 +--
 2 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/lib/glance b/lib/glance
index cf66023f5c..3fb61b0268 100644
--- a/lib/glance
+++ b/lib/glance
@@ -130,8 +130,9 @@ function is_glance_enabled {
 # cleanup_glance() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_glance {
-    # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $(glance_remote_conf '')
+    # delete image files (glance) and all of the glance-remote temporary
+    # storage
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR "${DATA_DIR}/glance-remote"
 
     # Cleanup multiple stores directories
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
@@ -468,39 +469,41 @@ function install_glance {
 # glance_remote_conf() - Return the path to an alternate config file for
 #                        the remote glance clone
 function glance_remote_conf {
-    echo "$(dirname ${GLANCE_CONF_DIR})/glance-remote/"$(basename "$1")
+    echo $(dirname "${GLANCE_CONF_DIR}")/glance-remote/$(basename "$1")
 }
 
 # start_glance_remote_clone() - Clone the regular glance api worker
 function start_glance_remote_clone {
-    local glance_remote_conf glance_remote_port
+    local glance_remote_conf_dir glance_remote_port remote_data
+    local glance_remote_uwsgi
 
-    glance_remote_conf_dir=$(glance_remote_conf '')
+    glance_remote_conf_dir="$(glance_remote_conf "")"
     glance_remote_port=$(get_random_port)
+    glance_remote_uwsgi="$(glance_remote_conf $GLANCE_UWSGI_CONF)"
 
     # Clone the existing ready-to-go glance-api setup
-    sudo rm -Rf $glance_remote_conf_dir
-    sudo cp -r "$GLANCE_CONF_DIR" $glance_remote_conf_dir
-    sudo chown $STACK_USER -R $glance_remote_conf_dir
+    sudo rm -Rf "$glance_remote_conf_dir"
+    sudo cp -r "$GLANCE_CONF_DIR" "$glance_remote_conf_dir"
+    sudo chown $STACK_USER -R "$glance_remote_conf_dir"
 
     # Point this worker at different data dirs
     remote_data="${DATA_DIR}/glance-remote"
     mkdir -p $remote_data/os_glance_tasks_store \
-          $remote_data/os_glance_staging_store
-    iniset $(glance_remote_conf 'glance-api.conf') os_glance_staging_store \
-           filesystem_store_datadir ${remote_data}/os_glance_staging_store
-    iniset $(glance_remote_conf 'glance-api.conf') os_glance_tasks_store \
-           filesystem_store_datadir ${remote_data}/os_glance_tasks_store
+          "${remote_data}/os_glance_staging_store"
+    iniset $(glance_remote_conf "$GLANCE_API_CONF") os_glance_staging_store \
+           filesystem_store_datadir "${remote_data}/os_glance_staging_store"
+    iniset $(glance_remote_conf "$GLANCE_API_CONF") os_glance_tasks_store \
+           filesystem_store_datadir "${remote_data}/os_glance_tasks_store"
 
     # Change our uwsgi to our new port
     sed -ri "s/^(http-socket.*):[0-9]+/\1:$glance_remote_port/" \
-        $(glance_remote_conf $GLANCE_UWSGI_CONF)
+        "$glance_remote_uwsgi"
 
     # Update the self-reference url with our new port
     iniset $(glance_remote_conf $GLANCE_API_CONF) DEFAULT \
            worker_self_reference_url \
            $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
-                $(glance_remote_conf $GLANCE_UWSGI_CONF))
+                    "$glance_remote_uwsgi")
 
     # We need to create the systemd service for the clone, but then
     # change it to include an Environment line to point the WSGI app
@@ -508,10 +511,11 @@ function start_glance_remote_clone {
     write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
                                --procname-prefix \
                                glance-api-remote \
-                               --ini $(glance_remote_conf $GLANCE_UWSGI_CONF)" \
+                               --ini $glance_remote_uwsgi" \
                                "" "$STACK_USER"
     iniset -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
-           "Service" "Environment" "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
+           "Service" "Environment" \
+           "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
 
     # Reload and restart with the new config
     $SYSTEMCTL daemon-reload
@@ -520,7 +524,7 @@ function start_glance_remote_clone {
     get_or_create_service glance_remote image_remote "Alternate glance"
     get_or_create_endpoint image_remote $REGION_NAME \
                 $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
-                    $(glance_remote_conf $GLANCE_UWSGI_CONF))
+                    $glance_remote_uwsgi)
 }
 
 # start_glance() - Start running processes
diff --git a/lib/tempest b/lib/tempest
index 7e7f0ab7a9..bbd23bb63e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -353,8 +353,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
     if is_service_enabled g-api-r; then
-        iniset $TEMPEST_CONFIG image alternate_image_endpoint \
-               "image_remote"
+        iniset $TEMPEST_CONFIG image alternate_image_endpoint image_remote
     fi
 
     # Compute

From af79a934ef057ea6ef7690894d58d21f7818979e Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Mon, 15 Mar 2021 12:20:42 -0400
Subject: [PATCH 2790/3333] Use 'ip addr replace' in OVN code

Instead of doing a flush/add, use replace like the ML2/OVS
code does. Should have the same behavior of not failing if
the address is already present.

Change-Id: If9d8a848b079ccb8c0c9b8e6fb708107aa0d46c7
---
 lib/neutron_plugins/ovn_agent | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..abc9c63614 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -271,8 +271,7 @@ function create_public_bridge {
     sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
     if [ -n "$FLOATING_RANGE" ]; then
         local cidr_len=${FLOATING_RANGE#*/}
-        sudo ip addr flush dev $ext_gw_ifc
-        sudo ip addr add $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
+        sudo ip addr replace $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
     fi
 
     # Ensure IPv6 RAs are accepted on the interface with the default route.
@@ -286,8 +285,7 @@ function create_public_bridge {
     sudo sysctl -w net.ipv6.conf.all.forwarding=1
     if [ -n "$IPV6_PUBLIC_RANGE" ]; then
         local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-        sudo ip -6 addr flush dev $ext_gw_ifc
-        sudo ip -6 addr add $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
+        sudo ip -6 addr replace $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
     fi
 
     sudo ip link set $ext_gw_ifc up

From 1ed276c17791dba1f0b7ef4446d0efe09135553b Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 11 Mar 2021 13:10:28 +0100
Subject: [PATCH 2791/3333] Use (or set properly) system-id generated by
 openvswitch

In case when OVN_UUID isn't set by user, and it isn't stored
in /etc/openvswith/system-id.conf file, Devstack will reuse it.
If it's not, it will generate and store it in the
/etc/openvswitch/system-id.conf file so it can be set to same value
after openvswitch will be e.g. restarted.

In case when OVN_UUID is set by user, it will be also saved in
/etc/openvswitch/system-id.conf file to make it persistent when e.g
openvswitch will be restarted.

Closes-Bug: #1918656
Change-Id: I8e3b05f3ab83e204bc1ce895baec0e1ba515895b
---
 lib/neutron_plugins/ovn_agent | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..c6ac16d007 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -66,7 +66,9 @@ OVN_L3_SCHEDULER=${OVN_L3_SCHEDULER:-leastloaded}
 
 # A UUID to uniquely identify this system.  If one is not specified, a random
 # one will be generated.  A randomly generated UUID will be saved in a file
-# 'ovn-uuid' so that the same one will be re-used if you re-run DevStack.
+# $OVS_SYSCONFDIR/system-id.conf (typically /etc/openvswitch/system-id.conf)
+# so that the same one will be re-used if you re-run DevStack or restart
+# Open vSwitch service.
 OVN_UUID=${OVN_UUID:-}
 
 # Whether or not to build the openvswitch kernel module from ovs.  This is required
@@ -109,6 +111,7 @@ OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
 OVS_SHAREDIR=$OVS_PREFIX/share/openvswitch
 OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
 OVS_DATADIR=$DATA_DIR/ovs
+OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-/etc/openvswitch}
 
 OVN_DATADIR=$DATA_DIR/ovn
 OVN_SHAREDIR=$OVS_PREFIX/share/ovn
@@ -521,11 +524,17 @@ function configure_ovn {
     echo "Configuring OVN"
 
     if [ -z "$OVN_UUID" ] ; then
-        if [ -f ./ovn-uuid ] ; then
-            OVN_UUID=$(cat ovn-uuid)
+        if [ -f $OVS_SYSCONFDIR/system-id.conf ]; then
+            OVN_UUID=$(cat $OVS_SYSCONFDIR/system-id.conf)
         else
             OVN_UUID=$(uuidgen)
-            echo $OVN_UUID > ovn-uuid
+            echo $OVN_UUID | sudo tee $OVS_SYSCONFDIR/system-id.conf
+        fi
+    else
+        local ovs_uuid
+        ovs_uuid=$(cat $OVS_SYSCONFDIR/system-id.conf)
+        if [ "$ovs_uuid" != $OVN_UUID ]; then
+            echo $OVN_UUID | sudo tee $OVS_SYSCONFDIR/system-id.conf
         fi
     fi
 

From 30819e66ddad5b57b726684e62b511a938aaea98 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 22 Mar 2021 07:14:50 +0000
Subject: [PATCH 2792/3333] Set default OVS_SYSCONFDIR value depending on
 OVS_PREFIX

When OVN is built from source, the value of OVS_PREFIX is set to
"/usr/local". All other paths referring to OVS should be prefixed
with this value.

Closes-Bug: #1920634
Related-Bug: #1918656

Change-Id: I9a45a5379d1c47cdf67b9c6d3d0409a88501e61e
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 97c20fcda1..2f6d1ab10d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -111,7 +111,7 @@ OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
 OVS_SHAREDIR=$OVS_PREFIX/share/openvswitch
 OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
 OVS_DATADIR=$DATA_DIR/ovs
-OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-/etc/openvswitch}
+OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-$OVS_PREFIX/etc/openvswitch}
 
 OVN_DATADIR=$DATA_DIR/ovn
 OVN_SHAREDIR=$OVS_PREFIX/share/ovn

From 84b328c814fd5be8af53738128aa3f5ef75ca3c7 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 26 Mar 2021 07:17:42 -0700
Subject: [PATCH 2793/3333] Default to parallel execution

Several jobs have been running in parallel since the late Wallaby
cycle, and other developers have had it enabled locally. I have heard
no async-related stability or debug-ability complaints thus far.
I think that we should convert the default to parallel early in the
Xena cycle in an attempt to spread the speed improvements across the
board, while also collecting data on a wider set of configurations.

Change-Id: I83d56c9363d481bb6d5921f5e1f9b024f136044b
---
 inc/async | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/async b/inc/async
index d29168f2f5..c63bc2045a 100644
--- a/inc/async
+++ b/inc/async
@@ -11,7 +11,7 @@
 #  async_wait my_shell_func
 #
 
-DEVSTACK_PARALLEL=$(trueorfalse False DEVSTACK_PARALLEL)
+DEVSTACK_PARALLEL=$(trueorfalse True DEVSTACK_PARALLEL)
 _ASYNC_BG_TIME=0
 
 # Keep track of how much total time was spent in background tasks

From d207ba9015f3210812468bfbf7d06b1491392554 Mon Sep 17 00:00:00 2001
From: Toshiaki Takahashi <ts-takahashi@nec.com>
Date: Wed, 23 Dec 2020 17:40:57 +0000
Subject: [PATCH 2794/3333] Move gawk into general for post-config

Devstack script for setting post-config needs gawk.
So this patch moves gawk from files/*/nova into files/*/general.

Closes-Bug: #1909041
Change-Id: I06a1a5524f146a8d7337963e846b5a6b7561be13
---
 files/debs/general      | 1 +
 files/debs/nova         | 1 -
 files/rpms-suse/general | 1 +
 files/rpms-suse/nova    | 1 -
 files/rpms/general      | 1 +
 files/rpms/nova         | 1 -
 6 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index d64417f1b7..7e481b4072 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -5,6 +5,7 @@ bsdmainutils
 curl
 default-jre-headless  # NOPRIME
 g++
+gawk
 gcc
 gettext  # used for compiling message catalogs
 git
diff --git a/files/debs/nova b/files/debs/nova
index a7aebbf946..e19441453b 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -3,7 +3,6 @@ curl
 dnsmasq-base
 dnsmasq-utils # for dhcp_release
 ebtables
-gawk
 genisoimage # required for config_drive
 iptables
 iputils-arping
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0de0876dcd..f63611025c 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -3,6 +3,7 @@ apache2-devel
 bc
 ca-certificates-mozilla
 curl
+gawk
 gcc
 gcc-c++
 git-core
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 9923760750..1cc2f62ea5 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -4,7 +4,6 @@ curl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
-gawk
 iptables
 iputils
 kpartx
diff --git a/files/rpms/general b/files/rpms/general
index cfcd7ff261..33da0a5385 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,6 +1,7 @@
 bc
 curl
 dbus
+gawk
 gcc
 gcc-c++
 gettext  # used for compiling message catalogs
diff --git a/files/rpms/nova b/files/rpms/nova
index 2218330230..8ea8ccc5ca 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -3,7 +3,6 @@ curl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
-gawk
 genisoimage # required for config_drive
 iptables
 iputils

From 01a84d2d03cd871fb8734d5fdc9d149b9487e3e4 Mon Sep 17 00:00:00 2001
From: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
Date: Mon, 11 Jan 2021 13:42:46 -0500
Subject: [PATCH 2795/3333] Configure Cinder backup driver

This patch adds a new environment variable, CINDER_BACKUP_DRIVER for
configuring cinder backup driver used when c-bak service is enabled.
This gets cinder backup driver configurable with a similar pattern to
cinder backends. Although the current configurable backup drivers don't
need cleanup functions, the interface for cleanup is prepared for the
future.

The following backup drivers can be configured:
  swift:
  This is the default backup driver.
  ceph:
  This already can be configured if ceph backend driver is enabled. For
  backward compatibility, ceph backup driver is used if ceph backend
  driver is enabled and no backup driver is specified.
  s3_swift:
  The s3 backup driver gets configurable with this patch. By specifying
  's3_swift', the driver is configured for swift s3api.

In the future, lib/cinder_backups/s3 should be created separatedly for
external S3 compatible storage. This file will just set given parameters
such as a URL and credentials.

Change-Id: I356c224d938e1aa59c8589387a03682b3ec6e23d
---
 lib/cinder                  | 45 ++++++++++++++++++++++++-----
 lib/cinder_backends/ceph    | 32 ---------------------
 lib/cinder_backups/ceph     | 57 +++++++++++++++++++++++++++++++++++++
 lib/cinder_backups/s3_swift | 45 +++++++++++++++++++++++++++++
 lib/cinder_backups/swift    | 38 +++++++++++++++++++++++++
 5 files changed, 178 insertions(+), 39 deletions(-)
 create mode 100644 lib/cinder_backups/ceph
 create mode 100644 lib/cinder_backups/s3_swift
 create mode 100644 lib/cinder_backups/swift

diff --git a/lib/cinder b/lib/cinder
index 6c97e114a6..14ab291f8a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -31,6 +31,7 @@ set +o xtrace
 CINDER_DRIVER=${CINDER_DRIVER:-default}
 CINDER_PLUGINS=$TOP_DIR/lib/cinder_plugins
 CINDER_BACKENDS=$TOP_DIR/lib/cinder_backends
+CINDER_BACKUPS=$TOP_DIR/lib/cinder_backups
 
 # grab plugin config if specified via cinder_driver
 if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
@@ -98,6 +99,16 @@ else
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 fi
 
+# For backward compatibility
+# Before CINDER_BACKUP_DRIVER was introduced, ceph backup driver was configured
+# along with ceph backend driver.
+if [[ -z "${CINDER_BACKUP_DRIVER}" && "$CINDER_ENABLED_BACKENDS" =~ "ceph" ]]; then
+    CINDER_BACKUP_DRIVER=ceph
+fi
+
+# Supported backup drivers are in lib/cinder_backups
+CINDER_BACKUP_DRIVER=${CINDER_BACKUP_DRIVER:-swift}
+
 # Toggle for deploying Cinder under a wsgi server. Legacy mod_wsgi
 # reference should be cleaned up to more accurately refer to uwsgi.
 CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-True}
@@ -113,6 +124,15 @@ if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     done
 fi
 
+# Source the backup driver
+if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+    if [[ -r $CINDER_BACKUPS/$CINDER_BACKUP_DRIVER ]]; then
+        source $CINDER_BACKUPS/$CINDER_BACKUP_DRIVER
+    else
+        die "cinder backup driver $CINDER_BACKUP_DRIVER is not supported"
+    fi
+fi
+
 # Environment variables to configure the image-volume cache
 CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
 
@@ -189,6 +209,12 @@ function cleanup_cinder {
         done
     fi
 
+    if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+        if type cleanup_cinder_backup_$CINDER_BACKUP_DRIVER >/dev/null 2>&1; then
+            cleanup_cinder_backup_$CINDER_BACKUP_DRIVER
+        fi
+    fi
+
     stop_process "c-api"
     remove_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI"
 }
@@ -266,13 +292,12 @@ function configure_cinder {
         configure_cinder_image_volume_cache
     fi
 
-    if is_service_enabled c-bak; then
-        # NOTE(mriedem): The default backup driver uses swift and if we're
-        # on a subnode we might not know if swift is enabled, but chances are
-        # good that it is on the controller so configure the backup service
-        # to use it. If we want to configure the backup service to use
-        # a non-swift driver, we'll likely need environment variables.
-        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
+    if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+        if type configure_cinder_backup_$CINDER_BACKUP_DRIVER >/dev/null 2>&1; then
+            configure_cinder_backup_$CINDER_BACKUP_DRIVER
+        else
+            die "configure_cinder_backup_$CINDER_BACKUP_DRIVER doesn't exist in $CINDER_BACKUPS/$CINDER_BACKUP_DRIVER"
+        fi
     fi
 
     if is_service_enabled ceilometer; then
@@ -410,6 +435,12 @@ function init_cinder {
         done
     fi
 
+    if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+        if type init_cinder_backup_$CINDER_BACKUP_DRIVER >/dev/null 2>&1; then
+            init_cinder_backup_$CINDER_BACKUP_DRIVER
+        fi
+    fi
+
     mkdir -p $CINDER_STATE_PATH/volumes
 }
 
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 33c9706d3d..0b465730c0 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -6,12 +6,6 @@
 # Enable with:
 #
 #   CINDER_ENABLED_BACKENDS+=,ceph:ceph
-#
-# Optional parameters:
-#   CINDER_BAK_CEPH_POOL=<pool-name>
-#   CINDER_BAK_CEPH_USER=<user>
-#   CINDER_BAK_CEPH_POOL_PG=<pg-num>
-#   CINDER_BAK_CEPH_POOL_PGP=<pgp-num>
 
 # Dependencies:
 #
@@ -29,11 +23,6 @@ set +o xtrace
 # Defaults
 # --------
 
-CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
-CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
-CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
-CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
-
 
 # Entry Points
 # ------------
@@ -52,27 +41,6 @@ function configure_cinder_backend_ceph {
     iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
     iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
     iniset $CINDER_CONF DEFAULT glance_api_version 2
-
-    if is_service_enabled c-bak; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-        if [ "$REMOTE_CEPH" = "False" ]; then
-            # Configure Cinder backup service options, ceph pool, ceph user and ceph key
-            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
-            if [[ $CEPH_REPLICAS -ne 1 ]]; then
-                sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
-            fi
-        fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-
-        iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
-        iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
-        iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
-        iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
-        iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0
-        iniset $CINDER_CONF DEFAULT backup_ceph_stripe_count 0
-        iniset $CINDER_CONF DEFAULT restore_discard_excess_bytes True
-    fi
 }
 
 # Restore xtrace
diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
new file mode 100644
index 0000000000..26136bef96
--- /dev/null
+++ b/lib/cinder_backups/ceph
@@ -0,0 +1,57 @@
+#!/bin/bash
+#
+# lib/cinder_backups/ceph
+# Configure the ceph backup driver
+
+# Enable with:
+#
+#   CINDER_BACKUP_DRIVER=ceph
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# Save trace setting
+_XTRACE_CINDER_CEPH=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
+CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
+CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
+CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
+
+
+function configure_cinder_backup_ceph {
+    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
+    if [ "$REMOTE_CEPH" = "False" ]; then
+        # Configure Cinder backup service options, ceph pool, ceph user and ceph key
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
+        if [[ $CEPH_REPLICAS -ne 1 ]]; then
+            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+        fi
+    fi
+    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+    sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+
+    iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
+    iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
+    iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
+    iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0
+    iniset $CINDER_CONF DEFAULT backup_ceph_stripe_count 0
+    iniset $CINDER_CONF DEFAULT restore_discard_excess_bytes True
+}
+
+# init_cinder_backup_ceph: nothing to do
+# cleanup_cinder_backup_ceph: nothing to do
+
+# Restore xtrace
+$_XTRACE_CINDER_CEPH
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backups/s3_swift b/lib/cinder_backups/s3_swift
new file mode 100644
index 0000000000..6fb248606e
--- /dev/null
+++ b/lib/cinder_backups/s3_swift
@@ -0,0 +1,45 @@
+#!/bin/bash
+#
+# lib/cinder_backups/s3_swift
+# Configure the s3 backup driver with swift s3api
+#
+# TODO: create lib/cinder_backup/s3 for external s3 compatible storage
+
+# Enable with:
+#
+#   CINDER_BACKUP_DRIVER=s3_swift
+#   enable_service s3api s-proxy s-object s-container s-account
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# Save trace setting
+_XTRACE_CINDER_S3_SWIFT=$(set +o | grep xtrace)
+set +o xtrace
+
+function configure_cinder_backup_s3_swift {
+    # This configuration requires swift and s3api. If we're
+    # on a subnode we might not know if they are enabled
+    iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.s3.S3BackupDriver"
+    iniset $CINDER_CONF DEFAULT backup_s3_endpoint_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$S3_SERVICE_PORT"
+}
+
+function init_cinder_backup_s3_swift {
+    openstack ec2 credential create
+    iniset $CINDER_CONF DEFAULT backup_s3_store_access_key "$(openstack ec2 credential list -c Access -f value)"
+    iniset $CINDER_CONF DEFAULT backup_s3_store_secret_key "$(openstack ec2 credential list -c Secret -f value)"
+    if is_service_enabled tls-proxy; then
+        iniset $CINDER_CONF DEFAULT backup_s3_ca_cert_file "$SSL_BUNDLE_FILE"
+    fi
+}
+
+# cleanup_cinder_backup_s3_swift: nothing to do
+
+# Restore xtrace
+$_XTRACE_CINDER_S3_SWIFT
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backups/swift b/lib/cinder_backups/swift
new file mode 100644
index 0000000000..d7c977e1e3
--- /dev/null
+++ b/lib/cinder_backups/swift
@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# lib/cinder_backups/swift
+# Configure the swift backup driver
+
+# Enable with:
+#
+#   CINDER_BACKUP_DRIVER=swift
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# Save trace setting
+_XTRACE_CINDER_SWIFT=$(set +o | grep xtrace)
+set +o xtrace
+
+
+function configure_cinder_backup_swift {
+    # NOTE(mriedem): The default backup driver uses swift and if we're
+    # on a subnode we might not know if swift is enabled, but chances are
+    # good that it is on the controller so configure the backup service
+    # to use it.
+    iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.swift.SwiftBackupDriver"
+    iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
+}
+
+# init_cinder_backup_swift: nothing to do
+# cleanup_cinder_backup_swift: nothing to do
+
+
+# Restore xtrace
+$_XTRACE_CINDER_SWIFT
+
+# Local variables:
+# mode: shell-script
+# End:

From 110b9a9b1b05d9163a674e5bcc05fcd8d48cb5bf Mon Sep 17 00:00:00 2001
From: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Date: Thu, 1 Apr 2021 11:00:25 +0900
Subject: [PATCH 2796/3333] Fix typo in multinode-lab document

Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Change-Id: I1b6100d6b8231f1f96a7768e26ab83f010f1e4dc
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c0b3f58157..dc3568a845 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -395,7 +395,7 @@ SSH keys need to be exchanged between each compute node:
 
 3. Verify that login via ssh works without a password::
 
-        ssh -i /root/.ssh/id_rsa.pub stack@DESTINATION
+        ssh -i /root/.ssh/id_rsa stack@DESTINATION
 
 In essence, this means that every compute node's root user's public RSA key
 must exist in every other compute node's stack user's authorized_keys file and

From 362641b1b8b0596371f13db8448ab0f43bd53482 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 19 Mar 2021 10:33:24 +0000
Subject: [PATCH 2797/3333] cinder: Increase VOLUME_BACKING_FILE_SIZE

As reported in bug #1920136 the tempest-integrated-compute job has
started to see insufficient free virtual space errors being reported by
c-sch and c-vol when creating volumes. This change simply increases the
default size of the underlying LVM PV used to host these volumes within
the default LVM/iSCSI c-vol backend deployed by devstack.

Change-Id: I965d4a485215ac482403f1e83609452550dfd860
Closes-Bug: #1920136
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 648a028beb..81e0f12866 100644
--- a/stackrc
+++ b/stackrc
@@ -758,8 +758,8 @@ for image_url in ${IMAGE_URLS//,/ }; do
     fi
 done
 
-# 24Gb default volume backing file size
-VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-24G}
+# 30Gb default volume backing file size
+VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-30G}
 
 # Prefixes for volume and instance names
 VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}

From 25d37efb9154f2f08e094f4dda3366a7bcd0af31 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 6 Apr 2021 10:35:19 -0500
Subject: [PATCH 2798/3333] Update DEVSTACK_SERIES to xena

stable/wallaby branch has been created now and
current master is for xena.

Change-Id: I42f67361fe50795d929752434342effddf123486
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 648a028beb..9630221f4e 100644
--- a/stackrc
+++ b/stackrc
@@ -245,7 +245,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="wallaby"
+DEVSTACK_SERIES="xena"
 
 ##############
 #

From 6f2c807bfade2a218636e0ca441de45c5662aca0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Tue, 6 Apr 2021 14:15:34 +0000
Subject: [PATCH 2799/3333] gzip, not xz

xz may cause POST_FAILUREs due to memory pressure [1].

[1] http://lists.openstack.org/pipermail/openstack-discuss/2021-April/021609.html

Change-Id: I2ea3175ecf2508b62640bfffdd798d7072e55550
---
 roles/export-devstack-journal/tasks/main.yaml                   | 2 +-
 .../templates/devstack.journal.README.txt.j2                    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index ef839edaaf..db38b10a44 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -45,7 +45,7 @@
     cmd: |
       journalctl -o export \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
+        | gzip > {{ stage_dir }}/logs/devstack.journal.gz
 
 - name: Save journal README
   become: true
diff --git a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2 b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
index fe36653102..30519f63d7 100644
--- a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
+++ b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
@@ -7,7 +7,7 @@ devstack run.
 To use it, you will need to convert it so journalctl can read it
 locally.  After downloading the file:
 
- $ /lib/systemd/systemd-journal-remote <(xzcat ./devstack.journal.xz) -o output.journal
+ $ /lib/systemd/systemd-journal-remote <(zcat ./devstack.journal.gz) -o output.journal
 
 Note this binary is not in the regular path.  On Debian/Ubuntu
 platforms, you will need to have the "systemd-journal-remote" package

From 448db9ec41930d13a785c553e09a34417507f594 Mon Sep 17 00:00:00 2001
From: Francesco Pantano <fpantano@redhat.com>
Date: Fri, 19 Feb 2021 13:25:10 +0100
Subject: [PATCH 2800/3333] Rely on ceph.conf settings when cinder backup pool
 is created

Ceph adds the osd pool default size option on ceph.conf via [1];
this means we don't need to specify the size of this pool if
the same value (same variable) is used (CEPH_REPLICAS).
This change is an attempt of removing the size setting, relying
on the implicit declaration of the value provided by ceph.conf.

[1] https://github.com/openstack/devstack-plugin-ceph/blob/master/devstack/lib/ceph#L425

Change-Id: I5fa2105ceb3b97a4e38926d76c1e4028f1108d4a
---
 lib/cinder_backups/ceph | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 26136bef96..e4003c0720 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -27,12 +27,8 @@ CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
 
 function configure_cinder_backup_ceph {
     sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-    if [ "$REMOTE_CEPH" = "False" ]; then
-        # Configure Cinder backup service options, ceph pool, ceph user and ceph key
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
-        if [[ $CEPH_REPLICAS -ne 1 ]]; then
-            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
-        fi
+    if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
     fi
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring

From 580fec54c3a970de80ab66b3decca69704ff1179 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 8 Apr 2021 11:03:37 -0500
Subject: [PATCH 2801/3333] Make stackviz tasks not to fail jobs

Due to issue on stckviz side, job start
failing with POST_FAILURE. If we fix the
issue still we need to wait for periodic job
periodic-package-stackviz-element to publish
the latest tarball on https://tarballs.openstack.org/stackviz/dist/.

Let's not fail the job for any issue occur during
stackviz processing.

Closes-Bug: 1863161

Change-Id: Ifee04f28ecee52e74803f1623aba5cfe5ee5ec90
---
 roles/process-stackviz/tasks/main.yaml | 125 +++++++++++++------------
 1 file changed, 64 insertions(+), 61 deletions(-)

diff --git a/roles/process-stackviz/tasks/main.yaml b/roles/process-stackviz/tasks/main.yaml
index c51c66cdb3..3ba3d9c2e6 100644
--- a/roles/process-stackviz/tasks/main.yaml
+++ b/roles/process-stackviz/tasks/main.yaml
@@ -1,70 +1,73 @@
-- name: Devstack checks if stackviz archive exists
-  stat:
-    path: "/opt/cache/files/stackviz-latest.tar.gz"
-  register: stackviz_archive
+- name: Process Stackviz
+  block:
 
-- debug:
-    msg: "Stackviz archive could not be found in /opt/cache/files/stackviz-latest.tar.gz"
-  when: not stackviz_archive.stat.exists
+  - name: Devstack checks if stackviz archive exists
+    stat:
+      path: "/opt/cache/files/stackviz-latest.tar.gz"
+    register: stackviz_archive
 
-- name: Check if subunit data exists
-  stat:
-    path: "{{ zuul_work_dir }}/testrepository.subunit"
-  register: subunit_input
+  - debug:
+      msg: "Stackviz archive could not be found in /opt/cache/files/stackviz-latest.tar.gz"
+    when: not stackviz_archive.stat.exists
 
-- debug:
-    msg: "Subunit file could not be found at {{ zuul_work_dir }}/testrepository.subunit"
-  when: not subunit_input.stat.exists
+  - name: Check if subunit data exists
+    stat:
+      path: "{{ zuul_work_dir }}/testrepository.subunit"
+    register: subunit_input
 
-- name: Install stackviz
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
-  block:
-    - include_role:
-        name: ensure-pip
+  - debug:
+      msg: "Subunit file could not be found at {{ zuul_work_dir }}/testrepository.subunit"
+    when: not subunit_input.stat.exists
+
+  - name: Install stackviz
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
+    block:
+      - include_role:
+          name: ensure-pip
+
+      - pip:
+          name: "file://{{ stackviz_archive.stat.path }}"
+          virtualenv: /tmp/stackviz
+          virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
+          extra_args: -U
 
-    - pip:
-        name: "file://{{ stackviz_archive.stat.path }}"
-        virtualenv: /tmp/stackviz
-        virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
-        extra_args: -U
+  - name: Deploy stackviz static html+js
+    command: cp -pR /tmp/stackviz/share/stackviz-html {{ stage_dir }}/stackviz
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
 
-- name: Deploy stackviz static html+js
-  command: cp -pR /tmp/stackviz/share/stackviz-html {{ stage_dir }}/stackviz
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
+  - name: Check if dstat data exists
+    stat:
+      path: "{{ devstack_base_dir }}/logs/dstat-csv.log"
+    register: dstat_input
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
 
-- name: Check if dstat data exists
-  stat:
-    path: "{{ devstack_base_dir }}/logs/dstat-csv.log"
-  register: dstat_input
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
+  - name: Run stackviz with dstat
+    shell: |
+      cat {{ subunit_input.stat.path }} | \
+        /tmp/stackviz/bin/stackviz-export \
+          --dstat "{{ devstack_base_dir }}/logs/dstat-csv.log" \
+          --env --stdin \
+          {{ stage_dir }}/stackviz/data
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
+      - dstat_input.stat.exists
 
-- name: Run stackviz with dstat
-  shell: |
-    cat {{ subunit_input.stat.path }} | \
-      /tmp/stackviz/bin/stackviz-export \
-        --dstat "{{ devstack_base_dir }}/logs/dstat-csv.log" \
-        --env --stdin \
-        {{ stage_dir }}/stackviz/data
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
-    - dstat_input.stat.exists
-  failed_when: False
+  - name: Run stackviz without dstat
+    shell: |
+      cat {{ subunit_input.stat.path }} | \
+        /tmp/stackviz/bin/stackviz-export \
+          --env --stdin \
+          {{ stage_dir }}/stackviz/data
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
+      - not dstat_input.stat.exists
 
-- name: Run stackviz without dstat
-  shell: |
-    cat {{ subunit_input.stat.path }} | \
-      /tmp/stackviz/bin/stackviz-export \
-        --env --stdin \
-        {{ stage_dir }}/stackviz/data
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
-    - not dstat_input.stat.exists
-  failed_when: False
+  ignore_errors: yes

From aa5c38727b314b03cd7ab69612435aa206bd5e2c Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 14 Apr 2021 14:27:32 -0700
Subject: [PATCH 2802/3333] Work around CHILD_MAX bash limitation for async

Apparently bash (via POSIX) only guarantees a small (32ish) number of
children can be started and their statuses retrieved at any given
point. On larger jobs with lots of plugins and additional work, we
may go over that limit, especially for long-lived children, such
as the install_tempest task.

This works around that issue by creating a fifo for each child at
spawn time. When the child is complete, it will block on a read
against that fifo (and thus not exit). When the parent goes to wait
on the child, it first writes to that fifo, unblocking the child so
that it can exit near the time we go to wait.

Closes-Bug: #1923728
Change-Id: Id755bdb1e7f1664ec08742d034c174e87a3d2902
---
 inc/async | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/inc/async b/inc/async
index c63bc2045a..11bcdfa39e 100644
--- a/inc/async
+++ b/inc/async
@@ -57,6 +57,7 @@ function async_log {
 function async_inner {
     local name="$1"
     local rc
+    local fifo=${DEST}/async/${name}.fifo
     shift
     set -o xtrace
     if $* >${DEST}/async/${name}.log 2>&1; then
@@ -69,6 +70,8 @@ function async_inner {
         async_log "$name" "FAILED with rc $rc"
     fi
     iniset ${DEST}/async/${name}.ini job end_time $(date "+%s%3N")
+    # Block on the fifo until we are signaled to exit by the main process
+    cat $fifo
     return $rc
 }
 
@@ -86,12 +89,14 @@ function async_run {
     local name="$1"
     shift
     local inifile=${DEST}/async/${name}.ini
+    local fifo=${DEST}/async/${name}.fifo
 
     touch $inifile
     iniset $inifile job command "$*"
     iniset $inifile job start_time $(date +%s%3N)
 
     if [[ "$DEVSTACK_PARALLEL" = "True" ]]; then
+        mkfifo $fifo
         async_inner $name $* &
         iniset $inifile job pid $!
         async_log "$name" "running: %command"
@@ -119,17 +124,23 @@ function async_wait {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
-    local pid rc running inifile runtime
+    local pid rc running inifile runtime fifo
     rc=0
     for name in $*; do
         running=$(ls ${DEST}/async/*.ini 2>/dev/null | wc -l)
         inifile="${DEST}/async/${name}.ini"
+        fifo=${DEST}/async/${name}.fifo
 
         if pid=$(async_pidof "$name"); then
             async_log "$name" "Waiting for completion of %command" \
                       "($running other jobs running)"
             time_start async_wait
             if [[ "$pid" != "self" ]]; then
+                # Signal the child to go ahead and exit since we are about to
+                # wait for it to collect its status.
+                echo "Signaling exit"
+                echo WAKEUP > $fifo
+                echo "Signaled"
                 # Do not actually call wait if we ran synchronously
                 if wait $pid; then
                     rc=0
@@ -137,6 +148,7 @@ function async_wait {
                     rc=$?
                 fi
                 cat ${DEST}/async/${name}.log
+                rm -f $fifo
             fi
             time_stop async_wait
             local start_time

From 51e384554b4653a05abea435432431cdca4728fb Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 14 Apr 2021 07:23:10 -0700
Subject: [PATCH 2803/3333] Add some debug to async_wait failures

This dumps some data in the case where we fail to wait for a child
pid to help debug what is going on. This also cleans up a few review
comments from the actual fix.

Change-Id: I7b58ce0cf2b41bdffa448973edb4c992fe5f730c
Related-Bug: #1923728
---
 inc/async | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/inc/async b/inc/async
index 11bcdfa39e..56338f5343 100644
--- a/inc/async
+++ b/inc/async
@@ -48,7 +48,7 @@ function async_log {
     command=$(iniget $inifile job command | tr '#' '-')
     message=$(echo "$message" | sed "s#%command#$command#g")
 
-    echo "[Async ${name}:${pid}]: $message"
+    echo "[$BASHPID Async ${name}:${pid}]: $message"
 }
 
 # Inner function that actually runs the requested task. We wrap it like this
@@ -57,7 +57,7 @@ function async_log {
 function async_inner {
     local name="$1"
     local rc
-    local fifo=${DEST}/async/${name}.fifo
+    local fifo="${DEST}/async/${name}.fifo"
     shift
     set -o xtrace
     if $* >${DEST}/async/${name}.log 2>&1; then
@@ -116,6 +116,24 @@ function async_runfunc {
     async_run $1 $*
 }
 
+# Dump some information to help debug a failed wait
+function async_wait_dump {
+    local failpid=$1
+
+    echo "=== Wait failure dump from $BASHPID ==="
+    echo "Processes:"
+    ps -f
+    echo "Waiting jobs:"
+    for name in $(ls ${DEST}/async/*.ini); do
+        echo "Job $name :"
+        cat "$name"
+    done
+    echo "Failed PID status:"
+    sudo cat /proc/$failpid/status
+    sudo cat /proc/$failpid/cmdline
+    echo "=== End wait failure dump ==="
+}
+
 # Wait for an async future to complete. May return immediately if already
 # complete, or of the future has already been waited on (avoid this). May
 # block until the future completes.
@@ -129,18 +147,18 @@ function async_wait {
     for name in $*; do
         running=$(ls ${DEST}/async/*.ini 2>/dev/null | wc -l)
         inifile="${DEST}/async/${name}.ini"
-        fifo=${DEST}/async/${name}.fifo
+        fifo="${DEST}/async/${name}.fifo"
 
         if pid=$(async_pidof "$name"); then
             async_log "$name" "Waiting for completion of %command" \
-                      "($running other jobs running)"
+                      "running on PID $pid ($running other jobs running)"
             time_start async_wait
             if [[ "$pid" != "self" ]]; then
                 # Signal the child to go ahead and exit since we are about to
                 # wait for it to collect its status.
-                echo "Signaling exit"
+                async_log "$name" "Signaling child to exit"
                 echo WAKEUP > $fifo
-                echo "Signaled"
+                async_log "$name" "Signaled"
                 # Do not actually call wait if we ran synchronously
                 if wait $pid; then
                     rc=0
@@ -161,6 +179,7 @@ function async_wait {
                       "$rc in $runtime seconds"
             rm -f $inifile
             if [ $rc -ne 0 ]; then
+                async_wait_dump $pid
                 echo Stopping async wait due to error: $*
                 break
             fi

From d04e795b316f5be466532e60104a983bf6419716 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 19 Apr 2021 06:52:30 +0000
Subject: [PATCH 2804/3333] [TrivialFix] Delete symlink apts-debs

Follow up on old I0416180db5b6add996ce5b48c6966c1b68adbcb0

Change-Id: If2f6166cf7c585bf303d0f6c28a2745d85eabbed
---
 files/apts | 1 -
 1 file changed, 1 deletion(-)
 delete mode 120000 files/apts

diff --git a/files/apts b/files/apts
deleted file mode 120000
index ef926de053..0000000000
--- a/files/apts
+++ /dev/null
@@ -1 +0,0 @@
-debs/
\ No newline at end of file

From c062792709def9ef10ddac68867e1b7bf9009435 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 9 Mar 2021 22:36:57 +0000
Subject: [PATCH 2805/3333] cinder: Default CINDER_ISCSI_HELPER to lioadm

As outlined in bug #1917750 the use of tgtadm in multinode environments
with multiple c-vol services can cause volumes to use duplicate WWNs.

This has been shown to cause some encrypted volume test failures as
os-brick returns a /dev/disk/by-id path to n-cpu that can point to the
wrong underlying volume when multiple volumes with the same WWN are
connected to a host.

There is also some speculation that the duplicate WWNs are also causing
libvirt to fail to detach volumes from instances but as yet this has not
been proven.

This change aims to avoid all of the above by switching the default of
CINDER_ISCSI_HELPER to lioadm for all deployments instead of just EL and
SUSE based deployments.

The Bionic platform job however is pinned to tgtadm as there issues
installing python3-rtslib-fb.

Closes-Bug: #1917750
Change-Id: If5c860d1e69aaef9a9236303c370479a7714ad43
---
 .zuul.yaml |  3 +++
 lib/cinder | 10 +++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 67d4c24000..00129b5ca4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -590,6 +590,9 @@
     description: Ubuntu Bionic platform test
     nodeset: openstack-single-node-bionic
     voting: false
+    vars:
+      devstack_localrc:
+        CINDER_ISCSI_HELPER: tgtadm
 
 - job:
     name: devstack-async
diff --git a/lib/cinder b/lib/cinder
index f20631b56c..9c8d85cf59 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,15 +88,15 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
-# Centos7 and OpenSUSE switched to using LIO and that's all that's supported,
-# although the tgt bits are in EPEL and OpenSUSE we don't want that for CI
+# Default to lioadm
+CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
+
+# EL and SUSE should only use lioadm, we continue to allow Ubuntu based
+# deployments to use tgtadm for specific jobs in the cinder-tempest-plugin
 if is_fedora || is_suse; then
-    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
         die "lioadm is the only valid Cinder target_helper config on this platform"
     fi
-else
-    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 fi
 
 # For backward compatibility

From 0386c1cda61b57da3aedde05e317137c354fb4d9 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 28 Apr 2021 09:26:23 +0100
Subject: [PATCH 2806/3333] cinder: Default CINDER_ISCSI_HELPER to tgtadm on
 Bionic

If5c860d1e69aaef9a9236303c370479a7714ad43 attempted to move this default
to lioadm while pinning certain Bionic based jobs to tgtadm.

Unfortunately it missed the legacy dsvm based jobs within various
projects that do not inherit from the devstack-platform-bionic base job
and that are also not covered by devstack's gate.

This change simply forces CINDER_ISCSI_HELPER to tgtadm on Bionic based
hosts to ensure it is always used.

Closes-Bug: #1926411
Change-Id: Ib4b38b45f25575c92fb09b8e97fa1b24af0cc06a
---
 lib/cinder | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 9c8d85cf59..34d618674e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -91,8 +91,13 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # Default to lioadm
 CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
 
-# EL and SUSE should only use lioadm, we continue to allow Ubuntu based
-# deployments to use tgtadm for specific jobs in the cinder-tempest-plugin
+# Bionic needs to default to tgtadm until support is dropped within devstack
+# as the rtslib-fb-targetctl service doesn't start after installing lioadm.
+if is_ubuntu && [[ "$DISTRO" == "bionic" ]]; then
+    CINDER_ISCSI_HELPER=tgtadm
+fi
+
+# EL and SUSE should only use lioadm
 if is_fedora || is_suse; then
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
         die "lioadm is the only valid Cinder target_helper config on this platform"

From b02a43291cc5e2d5677ecbb80c0fd608d67a1374 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 27 Nov 2018 12:59:04 +1100
Subject: [PATCH 2807/3333] Handle disappearing pids in mlock_report.py

If a pid disappears on us while we're reading, we should just continue
on.

EnvironmentError is just an alias for OSError since Python 3.3, so use
the latter name. [0]

[0] https://docs.python.org/3/library/exceptions.html#OSError

Change-Id: I3a25cca328e1469f72c84a118a9691c1c0258bc4
Closes-Bug: #1926434
---
 tools/mlock_report.py | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index b15a0bf80b..1b081bbe6f 100644
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -24,17 +24,19 @@ def _get_report():
         # iterate over the /proc/%pid/status files manually
         try:
             s = open("%s/%d/status" % (psutil.PROCFS_PATH, proc.pid), 'r')
-        except EnvironmentError:
+            with s:
+                for line in s:
+                    result = LCK_SUMMARY_REGEX.search(line)
+                    if result:
+                        locked = int(result.group('locked'))
+                        if locked:
+                            mlock_users.append({'name': proc.name(),
+                                                'pid': proc.pid,
+                                                'locked': locked})
+        except OSError:
+            # pids can disappear, we're ok with that
             continue
-        with s:
-            for line in s:
-                result = LCK_SUMMARY_REGEX.search(line)
-                if result:
-                    locked = int(result.group('locked'))
-                    if locked:
-                        mlock_users.append({'name': proc.name(),
-                                            'pid': proc.pid,
-                                            'locked': locked})
+
 
     # produce a single line log message with per process mlock stats
     if mlock_users:

From 7ad4cd07c8bf4f302acc4fc6684e362309332c9d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 29 Apr 2021 09:24:38 -0500
Subject: [PATCH 2808/3333] Drop Bionic support

Since victoria cycle, we have moved upstream testing to
Ubuntu Focal (20.04) and so does no Bionic distro in
Xena cycle testing runtime[1]. Grenade jobs also started
running on Focal since victoria was released.

Only thing left was legacy jobs which were not migrated to
Ubuntu Focal in Victoria and as per another community-wide
goal[2], all the lgeacy jobs were suppsoed to be migrated
to zuulv3 native jobs in victoria cycle itself. One of the
pending job was in nova (nova-grenade-multinode) which is also
migrated to zuulv3 native now
- https://review.opendev.org/c/openstack/nova/+/778885

If there is any job running on bionic, we strongly recommend
to migrate it to Ubuntu Focal.

[1] https://governance.openstack.org/tc/reference/runtimes/xena.html
[2] https://governance.openstack.org/tc/goals/selected/victoria/native-zuulv3-jobs.html

Change-Id: I39e38e4a6c2e52dd3822c9fdea354258359a9f53
---
 .zuul.yaml           | 11 -----------
 lib/apache           |  3 ---
 lib/cinder           |  6 ------
 stack.sh             |  2 +-
 tools/fixup_stuff.sh | 38 --------------------------------------
 5 files changed, 1 insertion(+), 59 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 00129b5ca4..b65aeec4dd 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -584,16 +584,6 @@
     voting: false
     timeout: 9000
 
-- job:
-    name: devstack-platform-bionic
-    parent: tempest-full-py3
-    description: Ubuntu Bionic platform test
-    nodeset: openstack-single-node-bionic
-    voting: false
-    vars:
-      devstack_localrc:
-        CINDER_ISCSI_HELPER: tgtadm
-
 - job:
     name: devstack-async
     parent: tempest-full-py3
@@ -695,7 +685,6 @@
         - devstack-ipv6
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
-        - devstack-platform-bionic
         - devstack-async
         - devstack-multinode
         - devstack-unit-tests
diff --git a/lib/apache b/lib/apache
index 870a65a9d2..04259ba31f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -93,9 +93,6 @@ function install_apache_uwsgi {
 
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
-        if [[ "$DISTRO" == 'bionic' ]]; then
-            pkg_list="${pkg_list} uwsgi-plugin-python"
-        fi
         install_package ${pkg_list}
     elif is_fedora; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
diff --git a/lib/cinder b/lib/cinder
index 34d618674e..7d6e843a3d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -91,12 +91,6 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # Default to lioadm
 CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
 
-# Bionic needs to default to tgtadm until support is dropped within devstack
-# as the rtslib-fb-targetctl service doesn't start after installing lioadm.
-if is_ubuntu && [[ "$DISTRO" == "bionic" ]]; then
-    CINDER_ISCSI_HELPER=tgtadm
-fi
-
 # EL and SUSE should only use lioadm
 if is_fedora || is_suse; then
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
diff --git a/stack.sh b/stack.sh
index ca9ecfa213..9d854da581 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 25f726892f..19219435ad 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -59,43 +59,6 @@ function fixup_keystone {
     fi
 }
 
-# Ubuntu Repositories
-#--------------------
-# Enable universe for bionic since it is missing when installing from ISO.
-function fixup_ubuntu {
-    if [[ "$DISTRO" != "bionic" ]]; then
-        return
-    fi
-
-    # This pulls in apt-add-repository
-    install_package "software-properties-common"
-
-    # Enable universe
-    sudo add-apt-repository -y universe
-
-    if [[ -f /etc/ci/mirror_info.sh ]] ; then
-        # If we are on a nodepool provided host and it has told us about
-        # where we can find local mirrors then use that mirror.
-        source /etc/ci/mirror_info.sh
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/ussuri main"
-    else
-        # Enable UCA:ussuri for updated versions of QEMU and libvirt
-        sudo add-apt-repository -y cloud-archive:ussuri
-    fi
-    REPOS_UPDATED=False
-    apt_get_update
-
-    # Since pip10, pip will refuse to uninstall files from packages
-    # that were created with distutils (rather than more modern
-    # setuptools).  This is because it technically doesn't have a
-    # manifest of what to remove.  However, in most cases, simply
-    # overwriting works.  So this hacks around those packages that
-    # have been dragged in by some other system dependency
-    sudo rm -rf /usr/lib/python3/dist-packages/httplib2-*.egg-info
-    sudo rm -rf /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
-    sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
-}
-
 # Python Packages
 # ---------------
 
@@ -194,7 +157,6 @@ function fixup_ovn_centos {
 
 function fixup_all {
     fixup_keystone
-    fixup_ubuntu
     fixup_fedora
     fixup_suse
 }

From 06b7352478170521a07875154eef317bde0c5321 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 29 Apr 2021 11:46:35 -0700
Subject: [PATCH 2809/3333] Fix async race updating nova configs

The configure_neutron_nova function updates nova configs. While that is
still running we separately update nova configs in stack.sh. This can
result in unexpected configs (that don't work). Fix this by waiting for
configure_neutron_nova to complete its work before we do nova config
updates directly in stack.sh.

For specifics we say that:

  [neutron]
  project_domain_name = Default

was missing from both nova.conf and nova-cpu.conf and instances could
not be created because keystone complained about not finding domain in
project. The strong suspicion here is that on some systems
configure_neutron_nova would write out project_domain_name while the
stack.sh inisets were running resulting in stack.sh overwriting the
project_domain_name content.

One theory is that disabling swift makes this problem more likely as
there is swift work in the middle of the async period. This is supported
by the fact that our job that hits this problem does indeed disable
swift.

Change-Id: I0961d882d555a21233c6b4fbfc077cfe33b88499
---
 stack.sh | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index ca9ecfa213..163fc5b370 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1238,17 +1238,21 @@ fi
 # deployments.  This ensures the keys match across nova and cinder across all
 # hosts.
 FIXED_KEY=${FIXED_KEY:-bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec}
-if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key "$FIXED_KEY"
-    iniset $NOVA_CPU_CONF key_manager fixed_key "$FIXED_KEY"
-fi
-
 if is_service_enabled cinder; then
     iniset $CINDER_CONF key_manager fixed_key "$FIXED_KEY"
 fi
 
 async_wait configure_neutron_nova
 
+# NOTE(clarkb): This must come after async_wait configure_neutron_nova because
+# configure_neutron_nova modifies $NOVA_CONF and $NOVA_CPU_CONF as well. If
+# we don't wait then these two ini updates race either other and can result
+# in unexpected configs.
+if is_service_enabled nova; then
+    iniset $NOVA_CONF key_manager fixed_key "$FIXED_KEY"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$FIXED_KEY"
+fi
+
 # Launch the nova-api and wait for it to answer before continuing
 if is_service_enabled n-api; then
     echo_summary "Starting Nova API"

From 5c304d817682d6c807b532b50a2f105479ac3fa2 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 11 Jun 2020 11:00:56 +0100
Subject: [PATCH 2810/3333] Change Neutron's default ML2 driver to OVN

As part of the Victoria PTG the Neutron community [0] agreed on changing
the default backend driver from ML2/OVS to ML2/OVN in DevStack. A lot of
changes have been submitted towards this goal including but not limted
to:

* Moving the OVN module to DevStack:
  https://review.opendev.org/c/openstack/devstack/+/734621

* Updating the OVN module to use distro packages instead of compiling
  OVN from source: https://review.opendev.org/c/openstack/devstack/+/763402o

And now this patch is changing the the actual Q_AGENT,
Q_ML2_TENANT_NETWORK_TYPE and Q_ML2_PLUGIN_MECHANISM_DRIVERS values in
devstack to what is expected by OVN as well as updating the Zuul
templates to enable the OVN services.

[0] https://etherpad.opendev.org/p/neutron-victoria-ptg

Change-Id: I92054ce9d2ab7a42746ed5dececef583b0f8a833
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 .zuul.yaml              | 35 +++++++++++++++++++++++++++--------
 lib/neutron_plugins/ml2 |  6 +++---
 2 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 00129b5ca4..e133bfacd7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,6 +468,10 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
+        OVN_L3_CREATE_PUBLIC_NETWORK: true
+        OVN_DBS_LOG_LEVEL: dbg
+        ENABLE_CHASSIS_AS_GW: true
+        Q_USE_PROVIDERNET_FOR_PUBLIC: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -477,7 +481,11 @@
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
         # Shared services
-        dstat: true
+        #
+        # NOTE(lucasagomes): disable dstat until bug
+        # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
+        # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
+        dstat: false
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -496,13 +504,14 @@
         n-sch: true
         # Placement service
         placement-api: true
+        # OVN services
+        ovn-controller: true
+        ovn-northd: true
+        ovs-vswitchd: true
+        ovsdb-server: true
         # Neutron services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
         q-svc: true
+        q-ovn-metadata-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -527,15 +536,24 @@
           # Core services enabled for this branch.
           # This list replaces the test-matrix.
           # Shared services
-          dstat: true
+          #
+          # NOTE(lucasagomes): disable dstat until bug
+          # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
+          # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
+          dstat: false
           memory_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
           # Placement services
           placement-client: true
+          # OVN services
+          ovn-controller: true
+          ovn-northd: false
+          ovs-vswitchd: true
+          ovsdb-server: true
           # Neutron services
-          q-agt: true
+          q-ovn-metadata-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -549,6 +567,7 @@
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
+          ENABLE_CHASSIS_AS_GW: false
           # Subnode specific settings
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index ae4b251d83..a58ba5cbcd 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -8,14 +8,14 @@ _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
 # Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-openvswitch}
+Q_AGENT=${Q_AGENT:-ovn}
 if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
     source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
 fi
 
 # Enable this to simply and quickly enable tunneling with ML2.
 # Select either 'gre', 'vxlan', or 'gre,vxlan'
-Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 # This has to be set here since the agent will set this in the config file
 if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
     Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
@@ -24,7 +24,7 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
 fi
 
 # List of MechanismDrivers to load
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options

From 69a66fb62bcb77145b6eec21fc2d56d40a861d0d Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 11 May 2021 11:04:32 +0100
Subject: [PATCH 2811/3333] Fix docs job

Sphinx 4.0.0 added a new dependency [0] which is causing the job to fail
at the moment.

This patch fix the problem by adding UC to the docs jobs.

[0] https://www.sphinx-doc.org/en/master/changes.html (LaTeX: add
tex-gyre font dependency)

Change-Id: I28019331017405c06577ada88f8e9f6d9a2afc23
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 tox.ini | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index ed28636d3a..5bb2268c4f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -34,7 +34,9 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
-deps = -r{toxinidir}/doc/requirements.txt
+deps =
+  -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}

From 230f5c434c800c94935d5cd0dcfc1bd18329759f Mon Sep 17 00:00:00 2001
From: Anand Bhat <anandgvbhat@gmail.com>
Date: Wed, 12 May 2021 16:53:15 +0530
Subject: [PATCH 2812/3333] Changed minversion in tox to 3.18.0

The patch bumps min version of tox to 3.18.0 python in order to
replace tox's whitelist_externals by allowlist_externals option:
https://github.com/tox-dev/tox/blob/master/docs/changelog.rst#v3180-2020-07-23

Change-Id: Id8bdda703afc39d352e3a53877318dc30d91a5f7
---
 tox.ini | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tox.ini b/tox.ini
index 5bb2268c4f..ec764abc87 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-minversion = 1.6
+minversion = 3.18.0
 skipsdist = True
 envlist = bashate
 
@@ -13,7 +13,7 @@ basepython = python3
 # modified bashate tree
 deps =
    {env:BASHATE_INSTALL_PATH:bashate==2.0.0}
-whitelist_externals = bash
+allowlist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
          -not \( -type d -name doc -prune \)     \
@@ -37,7 +37,7 @@ commands = bash -c "find {toxinidir}             \
 deps =
   -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
   -r{toxinidir}/doc/requirements.txt
-whitelist_externals = bash
+allowlist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
 commands =
@@ -45,7 +45,7 @@ commands =
 
 [testenv:pdf-docs]
 deps = {[testenv:docs]deps}
-whitelist_externals =
+allowlist_externals =
    make
 commands =
    sphinx-build -W -b latex doc/source doc/build/pdf

From ff073a5643f01dda3200d2ce426f23dc24e28b8f Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Thu, 13 May 2021 16:25:17 +0000
Subject: [PATCH 2813/3333] Revert "Change Neutron's default ML2 driver to OVN"

This reverts commit 5c304d817682d6c807b532b50a2f105479ac3fa2.

Reason for revert: There are more things to fix/move like done in 791085 and 791282 Also let's change all required default in devstack scripts instead of devstack's zuul job side. Basically do this change without any change in .zuul.yaml

Change-Id: Ie0f59d1b9a4b97ad9fd8131819054dfb616f31fd
---
 .zuul.yaml              | 35 ++++++++---------------------------
 lib/neutron_plugins/ml2 |  6 +++---
 2 files changed, 11 insertions(+), 30 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e133bfacd7..00129b5ca4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,10 +468,6 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
-        OVN_L3_CREATE_PUBLIC_NETWORK: true
-        OVN_DBS_LOG_LEVEL: dbg
-        ENABLE_CHASSIS_AS_GW: true
-        Q_USE_PROVIDERNET_FOR_PUBLIC: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -481,11 +477,7 @@
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
         # Shared services
-        #
-        # NOTE(lucasagomes): disable dstat until bug
-        # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
-        # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
-        dstat: false
+        dstat: true
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -504,14 +496,13 @@
         n-sch: true
         # Placement service
         placement-api: true
-        # OVN services
-        ovn-controller: true
-        ovn-northd: true
-        ovs-vswitchd: true
-        ovsdb-server: true
         # Neutron services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
         q-svc: true
-        q-ovn-metadata-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -536,24 +527,15 @@
           # Core services enabled for this branch.
           # This list replaces the test-matrix.
           # Shared services
-          #
-          # NOTE(lucasagomes): disable dstat until bug
-          # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
-          # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
-          dstat: false
+          dstat: true
           memory_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
           # Placement services
           placement-client: true
-          # OVN services
-          ovn-controller: true
-          ovn-northd: false
-          ovs-vswitchd: true
-          ovsdb-server: true
           # Neutron services
-          q-ovn-metadata-agent: true
+          q-agt: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -567,7 +549,6 @@
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
-          ENABLE_CHASSIS_AS_GW: false
           # Subnode specific settings
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index a58ba5cbcd..ae4b251d83 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -8,14 +8,14 @@ _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
 # Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-ovn}
+Q_AGENT=${Q_AGENT:-openvswitch}
 if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
     source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
 fi
 
 # Enable this to simply and quickly enable tunneling with ML2.
 # Select either 'gre', 'vxlan', or 'gre,vxlan'
-Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
 # This has to be set here since the agent will set this in the config file
 if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
     Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
@@ -24,7 +24,7 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
 fi
 
 # List of MechanismDrivers to load
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options

From c19c1262c8b81f1cc543eafb9e5c3a34c4b632fe Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Mon, 17 May 2021 13:54:10 +0100
Subject: [PATCH 2814/3333] Replace dstat with pcp-dstat

The dstat project is no longer maintained.

The pcp-dstat package installs a dstat command so no further updates to
the scripts should be needed.

Change-Id: Ied8c9d29bed4f887c364db7080a0f2a0c02328af
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 files/debs/dstat | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/files/debs/dstat b/files/debs/dstat
index 2b643b8b1b..40d00f4aa4 100644
--- a/files/debs/dstat
+++ b/files/debs/dstat
@@ -1 +1,2 @@
-dstat
+dstat # dist:bionic
+pcp

From 6e9f7c25704afb5bcc33c6f17a01f62068664e40 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Tue, 13 Oct 2020 14:20:38 -0400
Subject: [PATCH 2815/3333] Support optimized cinder backend for glance

When Glance is configured with a cinder glance_store, Cinder can be
configured to allow cloning of image data directly in the backend
instead of transferring data through Glance.  Expose these
configuration options in devstack to facilitate testing this feature.

Adds:
- CINDER_ALLOWED_DIRECT_URL_SCHEMES
- GLANCE_SHOW_DIRECT_URL
- GLANCE_SHOW_MULTIPLE_LOCATIONS

Change-Id: Iee619b443088fd77cf7b1a48563203bdf4a93a39
---
 lib/cinder | 19 +++++++++++++++++++
 lib/glance | 15 +++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index cfa3693f03..fca01a2140 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -104,6 +104,22 @@ if is_fedora || is_suse; then
     fi
 fi
 
+# When Cinder is used as a backend for Glance, it can be configured to clone
+# the volume containing image data directly in the backend instead of
+# transferring data from volume to volume.  Value is a comma separated list of
+# schemes (currently only 'file' and 'cinder' are supported).  The default
+# configuration in Cinder is empty (that is, do not use this feature).  NOTE:
+# to use this feature you must also enable GLANCE_SHOW_DIRECT_URL and/or
+# GLANCE_SHOW_MULTIPLE_LOCATIONS for glance-api.conf.
+CINDER_ALLOWED_DIRECT_URL_SCHEMES=${CINDER_ALLOWED_DIRECT_URL_SCHEMES:-}
+if [[ -n "$CINDER_ALLOWED_DIRECT_URL_SCHEMES" ]]; then
+    if [[ "${GLANCE_SHOW_DIRECT_URL:-False}" != "True" \
+            && "${GLANCE_SHOW_MULTIPLE_LOCATIONS:-False}" != "True" ]]; then
+        warn $LINENO "CINDER_ALLOWED_DIRECT_URL_SCHEMES is set, but neither \
+GLANCE_SHOW_DIRECT_URL nor GLANCE_SHOW_MULTIPLE_LOCATIONS is True"
+    fi
+fi
+
 # For backward compatibility
 # Before CINDER_BACKUP_DRIVER was introduced, ceph backup driver was configured
 # along with ceph backend driver.
@@ -266,6 +282,9 @@ function configure_cinder {
     fi
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
+    if [[ -n "$CINDER_ALLOWED_DIRECT_URL_SCHEMES" ]]; then
+        iniset $CINDER_CONF DEFAULT allowed_direct_url_schemes $CINDER_ALLOWED_DIRECT_URL_SCHEMES
+    fi
 
     # Avoid RPC timeouts in slow CI and test environments by doubling the
     # default response timeout set by RPC clients. See bug #1873234 for more
diff --git a/lib/glance b/lib/glance
index e789affaf1..118fa7c863 100644
--- a/lib/glance
+++ b/lib/glance
@@ -51,6 +51,18 @@ GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
 if is_opensuse; then
     GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/etc/glance
 fi
+# When Cinder is used as a glance store, you can optionally configure cinder to
+# optimize bootable volume creation by allowing volumes to be cloned directly
+# in the backend instead of transferring data via Glance.  To use this feature,
+# set CINDER_ALLOWED_DIRECT_URL_SCHEMES for cinder.conf and enable
+# GLANCE_SHOW_DIRECT_URL and/or GLANCE_SHOW_MULTIPLE_LOCATIONS for Glance.  The
+# default value for both of these is False, because for some backends they
+# present a grave security risk (though not for Cinder, because all that's
+# exposed is the volume_id where the image data is stored.)  See OSSN-0065 for
+# more information: https://wiki.openstack.org/wiki/OSSN/OSSN-0065
+GLANCE_SHOW_DIRECT_URL=$(trueorfalse False GLANCE_SHOW_DIRECT_URL)
+GLANCE_SHOW_MULTIPLE_LOCATIONS=$(trueorfalse False GLANCE_SHOW_MULTIPLE_LOCATIONS)
+
 # Glance multi-store configuration
 # Boolean flag to enable multiple store configuration for glance
 GLANCE_ENABLE_MULTIPLE_STORES=$(trueorfalse False GLANCE_ENABLE_MULTIPLE_STORES)
@@ -283,6 +295,9 @@ function configure_glance {
     if [ "$VIRT_DRIVER" = 'libvirt' ] && [ "$LIBVIRT_TYPE" = 'parallels' ]; then
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
+    # Only use these if you know what you are doing!  See OSSN-0065
+    iniset $GLANCE_API_CONF DEFAULT show_image_direct_url $GLANCE_SHOW_DIRECT_URL
+    iniset $GLANCE_API_CONF DEFAULT show_multiple_locations $GLANCE_SHOW_MULTIPLE_LOCATIONS
 
     # Configure glance_store
     configure_glance_store $USE_CINDER_FOR_GLANCE $GLANCE_ENABLE_MULTIPLE_STORES

From 35cec0d7c0857d76d3ea0b52b97f2a166c04c13e Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 17 May 2021 18:58:59 -0400
Subject: [PATCH 2816/3333] Remove Block Storage API v2 support

The Block Storage API v2 was deprecated in Pike by change
I913c44799cddc37c3342729ec0ef34068db5b2d4 and is (finally)
being removed in Xena [0].  So remove v2 support from devstack.

[0] https://wiki.openstack.org/wiki/CinderXenaPTGSummary#Removing_the_Block_Storage_API_v2

Depends-on: https://review.opendev.org/c/openstack/devstack/+/792048
Change-Id: I856d78648d28ac4cad0fb212bef1ae6ad32fca90
---
 lib/cinder  | 12 ------------
 lib/tempest | 13 -------------
 2 files changed, 25 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index cfa3693f03..dab2aea1c6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -376,12 +376,6 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
-            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-            get_or_create_endpoint \
-                "volumev2" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
-
             get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
             get_or_create_endpoint \
                 "volumev3" \
@@ -393,12 +387,6 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
 
-            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-            get_or_create_endpoint \
-                "volumev2" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v2/\$(project_id)s"
-
             get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
             get_or_create_endpoint \
                 "volumev3" \
diff --git a/lib/tempest b/lib/tempest
index 29a62290ce..d835c68d4a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -459,13 +459,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
-    # Set the service catalog entry for Tempest to run on. Typically
-    # used to try different Volume API version targets. The tempest
-    # default it to 'volumev3'(v3 APIs endpoint) , so only set this
-    # if you want to change it.
-    if [[ -n "$TEMPEST_VOLUME_TYPE" ]]; then
-        iniset $TEMPEST_CONFIG volume catalog_type $TEMPEST_VOLUME_TYPE
-    fi
     # Only turn on TEMPEST_VOLUME_MANAGE_SNAPSHOT by default for "lvm" backends
     if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
@@ -489,12 +482,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
-    # Reset microversions to None where v2 is running which does not support microversion.
-    # Both "None" means no microversion testing.
-    if [[ "$TEMPEST_VOLUME_TYPE" == "volumev2" ]]; then
-        tempest_volume_min_microversion=None
-        tempest_volume_max_microversion=None
-    fi
     if [ "$tempest_volume_min_microversion" == "None" ]; then
         inicomment $TEMPEST_CONFIG volume min_microversion
     else

From 2a9673f0278699d03931d69b4da22e9709300026 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 19 May 2021 10:22:18 -0400
Subject: [PATCH 2817/3333] docs: recommend Ubuntu 20.04 instead of Bionic

Bionic support was dropped in I39e38e4a6c2e52dd3822c9fdea354258359a9f53.

Change-Id: I765aac352590fd2f74d3fd90676d6d098548e6b8
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 8b8acde38c..9f477ab911 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
 latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
 
-If you do not have a preference, Ubuntu 18.04 (Bionic Beaver) is the
+If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)

From f0736406f5ce055072a62a62fe9fdc7cead49671 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 18 May 2021 17:15:30 -0500
Subject: [PATCH 2818/3333] Fix unit test to use python3 command

unit test jobs staretd to run on ubuntu-focal now
and failing for using 'python' command.

Change-Id: Ie002faf4c96ac7f207207a481c057b8df0289e6c
---
 tests/test_write_devstack_local_conf_role.sh | 2 +-
 tests/unittest.sh                            | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/test_write_devstack_local_conf_role.sh b/tests/test_write_devstack_local_conf_role.sh
index b2bc0a2c46..71d8d51614 100755
--- a/tests/test_write_devstack_local_conf_role.sh
+++ b/tests/test_write_devstack_local_conf_role.sh
@@ -6,4 +6,4 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/functions
 source $TOP/tests/unittest.sh
 
-python ./roles/write-devstack-local-conf/library/test.py
+${PYTHON} $TOP/roles/write-devstack-local-conf/library/test.py
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 3703ece91d..fced2abe65 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -17,6 +17,8 @@ ERROR=0
 PASS=0
 FAILED_FUNCS=""
 
+export PYTHON=$(which python3 2>/dev/null)
+
 # pass a test, printing out MSG
 #  usage: passed message
 function passed {

From e38a39ad404637ca1649cea072883aa0a4592c4f Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 14 May 2021 09:14:24 +0100
Subject: [PATCH 2819/3333] Change default network backend driver to ML2/OVN

This patch is changing the default network backend driver in DevStack to
OVN.

This is a long effort from the Neutron community that has been
discussed on previous PTGs and agreed upon.

A similar patch to this one [0] have been merged in the past but got
reverted [1] because it did break some zuul jobs. This one also include
fixes for such jobs and was verified at [2]

[0] https://review.opendev.org/c/openstack/devstack/+/735097
[1] https://review.opendev.org/c/openstack/neutron/+/775632
[2] https://review.opendev.org/c/zuul/zuul-jobs/+/791117

Change-Id: I8c2be82f33ed9f6c36f5509b3b210ee1a38e87ca
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 .zuul.yaml                    | 20 ++++++++++++++------
 lib/neutron_plugins/ml2       | 11 ++++++-----
 lib/neutron_plugins/ovn_agent | 18 +++++++++++++-----
 stackrc                       |  4 +++-
 4 files changed, 36 insertions(+), 17 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b65aeec4dd..4ca0257cc6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,6 +468,8 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
+        OVN_L3_CREATE_PUBLIC_NETWORK: true
+        OVN_DBS_LOG_LEVEL: dbg
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -496,13 +498,14 @@
         n-sch: true
         # Placement service
         placement-api: true
+        # OVN services
+        ovn-controller: true
+        ovn-northd: true
+        ovs-vswitchd: true
+        ovsdb-server: true
         # Neutron services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
         q-svc: true
+        q-ovn-metadata-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -534,8 +537,12 @@
           n-cpu: true
           # Placement services
           placement-client: true
+          # OVN services
+          ovn-controller: true
+          ovs-vswitchd: true
+          ovsdb-server: true
           # Neutron services
-          q-agt: true
+          q-ovn-metadata-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -553,6 +560,7 @@
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
           NOVA_VNC_ENABLED: true
+          ENABLE_CHASSIS_AS_GW: false
 
 - job:
     name: devstack-ipv6
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index ae4b251d83..e1f868f0a7 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -7,15 +7,16 @@
 _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
-# Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-openvswitch}
+# Default OVN L2 agent
+Q_AGENT=${Q_AGENT:-ovn}
 if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
     source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
 fi
 
 # Enable this to simply and quickly enable tunneling with ML2.
-# Select either 'gre', 'vxlan', or 'gre,vxlan'
-Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
+# For ML2/OVS select either 'gre', 'vxlan', or 'gre,vxlan'.
+# For ML2/OVN use 'geneve'.
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 # This has to be set here since the agent will set this in the config file
 if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
     Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
@@ -24,7 +25,7 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
 fi
 
 # List of MechanismDrivers to load
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e4d0d75230..4af1340a26 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -21,10 +21,6 @@
 source ${TOP_DIR}/lib/neutron_plugins/ovs_base
 source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
 
-# Load devstack ovs base functions
-source $NEUTRON_DIR/devstack/lib/ovs
-
-
 # Defaults
 # --------
 
@@ -88,12 +84,18 @@ OVN_INSTALL_OVS_PYTHON_MODULE=$(trueorfalse False OVN_INSTALL_OVS_PYTHON_MODULE)
 # configure the MTU DHCP option.
 OVN_GENEVE_OVERHEAD=${OVN_GENEVE_OVERHEAD:-38}
 
-# The log level of the OVN databases (north and south)
+# The log level of the OVN databases (north and south).
+# Supported log levels are: off, emer, err, warn, info or dbg.
+# More information about log levels can be found at
+# http://www.openvswitch.org/support/dist-docs/ovs-appctl.8.txt
 OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
 
 OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
+# If True (default) the node will be considered a gateway node.
+ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
+
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
     OVSDB_SERVER_LOCAL_HOST=[$OVSDB_SERVER_LOCAL_HOST]
@@ -171,6 +173,9 @@ function wait_for_sock_file {
 }
 
 function use_new_ovn_repository {
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then
+        return 0
+    fi
     if [ -z "$is_new_ovn" ]; then
         local ovs_repo_dir=$DEST/$OVS_REPO_NAME
         if [ ! -d $ovs_repo_dir ]; then
@@ -390,6 +395,9 @@ function install_ovn {
     sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+        # Load devstack ovs base functions
+        source $NEUTRON_DIR/devstack/lib/ovs
+
         # If OVS is already installed, remove it, because we're about to
         # re-install it from source.
         for package in openvswitch openvswitch-switch openvswitch-common; do
diff --git a/stackrc b/stackrc
index 196f61fa3c..05016594eb 100644
--- a/stackrc
+++ b/stackrc
@@ -72,8 +72,10 @@ if ! isset ENABLED_SERVICES ; then
     ENABLED_SERVICES+=,g-api
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
+    # OVN
+    ENABLED_SERVICES+=,ovn-controller,ovn-northd,ovs-vswitchd,ovsdb-server
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
+    ENABLED_SERVICES+=,q-svc,q-ovn-metadata-agent
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services

From ddb66f2344b933f278b0b52be3ca59a4c511ab14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Sat, 18 Jul 2020 12:18:39 +0200
Subject: [PATCH 2820/3333] [CI] Add no-tls-proxy job

Some gates run devstack like this and it follows different code
paths.
Let's ensure we don't break it now and then.

Change-Id: I6ee1bfc30bced53f6d7fb841e01714069919fd88
Reference: http://lists.openstack.org/pipermail/openstack-discuss/2020-July/015997.html
Reference: http://eavesdrop.openstack.org/meetings/qa/2021/qa.2021-05-11-14.00.log.html
---
 .zuul.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index b65aeec4dd..1ede4448a0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -595,6 +595,17 @@
       zuul_copy_output:
         /opt/stack/async: logs
 
+- job:
+    name: devstack-no-tls-proxy
+    parent: tempest-full-py3
+    description: |
+      Tempest job with tls-proxy off.
+
+      Some gates run devstack like this and it follows different code paths.
+    vars:
+      devstack_services:
+        tls-proxy: false
+
 - job:
     name: devstack-platform-fedora-latest
     parent: tempest-full-py3
@@ -814,3 +825,7 @@
               - ^.*\.rst$
               - ^doc/.*$
         - devstack-platform-fedora-latest-virt-preview
+        - devstack-no-tls-proxy
+    periodic:
+      jobs:
+        - devstack-no-tls-proxy

From 7604e085b4542c50aefc9c23aa339958757a5770 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 25 May 2021 13:06:14 -0500
Subject: [PATCH 2821/3333] Pin nodeset for unit test job

devstack unit test job does not set any nodeset
and so does use default nodeset defined in base jobs
in opendev. When opendev switches the default nodeset to
the latest distro version, devstack unit test job can start
failing. Example:

- https://review.opendev.org/q/I01408f2f2959b0788fe712ac268a526502226ee9
- https://review.opendev.org/q/Ib1ea47bc7384e1f579cb08c779a32151fccd6845

To avoid such a situation in future, let's set the working nodeset
for this job also so that when we cut the stable branch we can
run it on the working distro version.

Change-Id: I302140778fedf08bc8ba72c453837fa7b8f8f9ae
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 4ca0257cc6..9a559ef776 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -676,6 +676,7 @@
 
 - job:
     name: devstack-unit-tests
+    nodeset: ubuntu-focal
     description: |
       Runs unit tests on devstack project.
 

From 22038a9a8c4418d6d49bed83024a3cd97e627860 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 27 May 2021 13:44:20 +0100
Subject: [PATCH 2822/3333] [OVN] Configure public bridge enabled by default

This patch makes the OVN_L3_CREATE_PUBLIC_NETWORK configuration True by
default. This option makes the OVN lib in DevStack create & configure
the external bridge, matching the same behavior from the OVS driver
in DevStack.

Change-Id: Icda53b95fdc3c169ac48a6ec4343c87ba404baa4
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 .zuul.yaml                    | 1 -
 lib/neutron_plugins/ovn_agent | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6484b2a6ce..5bc6a8b424 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,7 +468,6 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
-        OVN_L3_CREATE_PUBLIC_NETWORK: true
         OVN_DBS_LOG_LEVEL: dbg
       devstack_local_conf:
         post-config:
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 4af1340a26..f12e6a491d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -95,6 +95,7 @@ OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
+OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
 
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then

From 77835633c5d1daba37f453c5bf7c84fad0f2d68e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 13 May 2021 13:14:42 +1000
Subject: [PATCH 2823/3333] OVN : include source compliation functions

This patch moves the OVS compilation module from Neutron into DevStack.
It also renamed it to "ovs_source" to highlight its function, and the
include has been moved to where the rest of the includes are located.

Although this module is not required since by default DevStack installs
OVS/OVN from the host OS packages instead of compiling from source,
this is a nice to have as it avoids having bits and pieces of the code
scattered around multiple repositories.

Co-Authored-By: Lucas Alvares Gomes <lucasagomes@gmail.com>
Change-Id: I39ec9ce0a91bea05cf8c446a9767ab879ac8e8f3
---
 lib/neutron_plugins/ovn_agent  |   6 +-
 lib/neutron_plugins/ovs_source | 215 +++++++++++++++++++++++++++++++++
 2 files changed, 218 insertions(+), 3 deletions(-)
 create mode 100644 lib/neutron_plugins/ovs_source

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 4af1340a26..71a4c60129 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -21,6 +21,9 @@
 source ${TOP_DIR}/lib/neutron_plugins/ovs_base
 source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
 
+# Load devstack ovs compliation and loading functions
+source ${TOP_DIR}/lib/neutron_plugins/ovs_source
+
 # Defaults
 # --------
 
@@ -395,9 +398,6 @@ function install_ovn {
     sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
-        # Load devstack ovs base functions
-        source $NEUTRON_DIR/devstack/lib/ovs
-
         # If OVS is already installed, remove it, because we're about to
         # re-install it from source.
         for package in openvswitch openvswitch-switch openvswitch-common; do
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
new file mode 100644
index 0000000000..294171f18b
--- /dev/null
+++ b/lib/neutron_plugins/ovs_source
@@ -0,0 +1,215 @@
+#!/bin/bash
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# Defaults
+# --------
+
+# Set variables for building OVS from source
+OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}
+OVS_REPO_NAME=$(basename ${OVS_REPO} | cut -f1 -d'.')
+OVS_REPO_NAME=${OVS_REPO_NAME:-ovs}
+OVS_BRANCH=${OVS_BRANCH:-0047ca3a0290f1ef954f2c76b31477cf4b9755f5}
+
+# Functions
+
+# load_module() - Load module using modprobe module given by argument and dies
+#                 on failure
+#               - fatal argument is optional and says whether function should
+#                 exit if module can't be loaded
+function load_module {
+    local module=$1
+    local fatal=$2
+
+    if [ "$(trueorfalse True fatal)" == "True" ]; then
+        sudo modprobe $module || (dmesg && die $LINENO "FAILED TO LOAD $module")
+    else
+        sudo modprobe $module || (echo "FAILED TO LOAD $module" && dmesg)
+    fi
+}
+
+# prepare_for_compilation() - Fetch ovs git repository and install packages needed for
+#                             compilation.
+function prepare_for_ovs_compilation {
+    local build_modules=${1:-False}
+    OVS_DIR=$DEST/$OVS_REPO_NAME
+
+    if [ ! -d $OVS_DIR ] ; then
+        # We can't use git_clone here because we want to ignore ERROR_ON_CLONE
+        git_timed clone $OVS_REPO $OVS_DIR
+        cd $OVS_DIR
+        git checkout $OVS_BRANCH
+    else
+        # Even though the directory already exists, call git_clone to update it
+        # if needed based on the RECLONE option
+        git_clone $OVS_REPO $OVS_DIR $OVS_BRANCH
+        cd $OVS_DIR
+    fi
+
+    # TODO: Can you create package list files like you can inside devstack?
+    install_package autoconf automake libtool gcc patch make
+
+    # If build_modules is False, we don't need to install the kernel-*
+    # packages. Just return.
+    if [[ "$build_modules" == "False" ]]; then
+        return
+    fi
+
+    KERNEL_VERSION=`uname -r`
+    if is_fedora ; then
+        # is_fedora covers Fedora, RHEL, CentOS, etc...
+        if [[ "$os_VENDOR" == "Fedora" ]]; then
+            install_package elfutils-libelf-devel
+            KERNEL_VERSION=`echo $KERNEL_VERSION | cut --delimiter='-' --field 1`
+        elif [[ ${KERNEL_VERSION:0:2} != "3." ]]; then
+            # dash is illegal character in rpm version so replace
+            # them with underscore like it is done in the kernel
+            # https://github.com/torvalds/linux/blob/master/scripts/package/mkspec#L25
+            # but only for latest series of the kernel, not 3.x
+
+            KERNEL_VERSION=`echo $KERNEL_VERSION | tr - _`
+        fi
+
+        echo NOTE: if kernel-devel-$KERNEL_VERSION or kernel-headers-$KERNEL_VERSION installation
+        echo failed, please, provide a repository with the package, or yum update / reboot
+        echo your machine to get the latest kernel.
+
+        install_package kernel-devel-$KERNEL_VERSION
+        install_package kernel-headers-$KERNEL_VERSION
+
+    elif is_ubuntu ; then
+        install_package linux-headers-$KERNEL_VERSION
+    fi
+}
+
+# load_ovs_kernel_modules() - load openvswitch kernel module
+function load_ovs_kernel_modules {
+    load_module openvswitch
+    load_module vport-geneve False
+    dmesg | tail
+}
+
+# reload_ovs_kernel_modules() - reload openvswitch kernel module
+function reload_ovs_kernel_modules {
+    set +e
+    ovs_system=$(sudo ovs-dpctl dump-dps | grep ovs-system)
+    if [ -n "$ovs_system" ]; then
+        sudo ovs-dpctl del-dp ovs-system
+    fi
+    set -e
+    sudo modprobe -r vport_geneve
+    sudo modprobe -r openvswitch
+    load_ovs_kernel_modules
+}
+
+# compile_ovs() - Compile OVS from source and load needed modules.
+#                 Accepts two parameters:
+#                   - first one is False by default and means that modules are not built and installed.
+#                   - second optional parameter defines prefix for ovs compilation
+#                   - third optional parameter defines localstatedir for ovs single machine runtime
+#                 Env variables OVS_REPO_NAME, OVS_REPO and OVS_BRANCH must be set
+function compile_ovs {
+    local _pwd=$PWD
+    local build_modules=${1:-False}
+    local prefix=$2
+    local localstatedir=$3
+
+    if [ -n "$prefix" ]; then
+        prefix="--prefix=$prefix"
+    fi
+
+    if [ -n "$localstatedir" ]; then
+        localstatedir="--localstatedir=$localstatedir"
+    fi
+
+    prepare_for_ovs_compilation $build_modules
+
+    KERNEL_VERSION=$(uname -r)
+    major_version=$(echo "${KERNEL_VERSION}" | cut -d '.' -f1)
+    patch_level=$(echo "${KERNEL_VERSION}" | cut -d '.' -f2)
+    if [ "${major_version}" -gt 5 ] || [ "${major_version}" == 5 ] && [ "${patch_level}" -gt 5 ]; then
+        echo "NOTE: KERNEL VERSION is ${KERNEL_VERSION} and OVS doesn't support compiling "
+        echo "Kernel module for version higher than 5.5. Skipping module compilation..."
+        build_modules="False"
+    fi
+
+    if [ ! -f configure ] ; then
+        ./boot.sh
+    fi
+    if [ ! -f config.status ] || [ configure -nt config.status ] ; then
+        if [[ "$build_modules" == "True" ]]; then
+            ./configure $prefix $localstatedir --with-linux=/lib/modules/$(uname -r)/build
+        else
+            ./configure $prefix $localstatedir
+        fi
+    fi
+    make -j$(($(nproc) + 1))
+    sudo make install
+    if [[ "$build_modules" == "True" ]]; then
+        sudo make INSTALL_MOD_DIR=kernel/net/openvswitch modules_install
+        reload_ovs_kernel_modules
+    else
+        load_ovs_kernel_modules
+    fi
+
+    cd $_pwd
+}
+
+# action_service - call an action over openvswitch service
+#                  Accepts one parameter that can be either
+#                  'start', 'restart' and 'stop'.
+function action_openvswitch {
+    local action=$1
+
+    if is_ubuntu; then
+        ${action}_service openvswitch-switch
+    elif is_fedora; then
+        ${action}_service openvswitch
+    elif is_suse; then
+        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
+            ${action}_service openvswitch-switch
+        else
+            ${action}_service openvswitch
+        fi
+    fi
+}
+
+# start_new_ovs() - removes old ovs database, creates a new one and starts ovs
+function start_new_ovs {
+    sudo rm -f /etc/openvswitch/conf.db /etc/openvswitch/.conf.db~lock~
+    sudo /usr/share/openvswitch/scripts/ovs-ctl start
+}
+
+# stop_new_ovs() - stops ovs
+function stop_new_ovs {
+    local ovs_ctl='/usr/share/openvswitch/scripts/ovs-ctl'
+
+    if [ -x $ovs_ctl ] ; then
+        sudo $ovs_ctl stop
+    fi
+}
+
+# remove_ovs_packages() - removes old ovs packages from the system
+function remove_ovs_packages {
+    for package in openvswitch openvswitch-switch openvswitch-common; do
+        if is_package_installed $package; then
+            uninstall_package $package
+        fi
+    done
+}
+
+
+# load_conntrack_gre_module() - loads nf_conntrack_proto_gre kernel module
+function load_conntrack_gre_module {
+    sudo modprobe nf_conntrack_proto_gre
+}

From 58f6048dd488664aab6ae42efeb9deb90b051acf Mon Sep 17 00:00:00 2001
From: Anand Bhat <anandgvbhat@gmail.com>
Date: Fri, 28 May 2021 11:36:23 +0530
Subject: [PATCH 2824/3333] setup.cfg: Replace dashes with underscores

Setuptools v54.1.0 introduces a warning that the use of dash-separated
options in 'setup.cfg' will not be supported in a future version [1].
Get ahead of the issue by replacing the dashes with underscores. Without
this, we see 'UserWarning' messages like the following on new enough
versions of setuptools:

  UserWarning: Usage of dash-separated 'description-file' will not be
  supported in future versions. Please use the underscore name
  'description_file' instead

[1] https://github.com/pypa/setuptools/commit/a2e9ae4cb

Change-Id: I6b8e791c06319fa5fa0935337520c36800b1abd6
---
 setup.cfg | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 146f010243..a4e621f6df 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,11 +1,11 @@
 [metadata]
 name = DevStack
 summary = OpenStack DevStack
-description-file =
+description_file =
     README.rst
 author = OpenStack
-author-email = openstack-discuss@lists.openstack.org
-home-page = https://docs.openstack.org/devstack/latest
+author_email = openstack-discuss@lists.openstack.org
+home_page = https://docs.openstack.org/devstack/latest
 classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License

From 8ea11c2947753f988979330ecc5fab2a6362881c Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 31 May 2021 15:04:29 -0500
Subject: [PATCH 2825/3333] Update IRC network to OFTC

Change-Id: I260d9e65782add011f00d9087e0a5ac71e2be324
---
 doc/source/contributor/contributing.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst
index 5e0df569f7..4de238fbf8 100644
--- a/doc/source/contributor/contributing.rst
+++ b/doc/source/contributor/contributing.rst
@@ -13,7 +13,7 @@ with Devstack.
 
 Communication
 ~~~~~~~~~~~~~
-* IRC channel ``#openstack-qa`` at FreeNode
+* IRC channel ``#openstack-qa`` at OFTC.
 * Mailing list (prefix subjects with ``[qa][devstack]`` for faster responses)
   http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss
 

From 949f5ada608961fd05435e01bd9d06757b6c62c5 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Mon, 15 Mar 2021 18:25:04 +0100
Subject: [PATCH 2826/3333] Add route to IPv6 private subnets in ML2/OVN

Enable IPv6 private subnet routing in ML2/OVN, it uses the behavior that
already exists in ML2/OVS: add a route from the devstack node to the
CIDRs of the default IPv6 subnet pool. Any IPv6 subnet created using the
default subnet pool and plugged into the default router is reachable
from the host (ex: ipv6-private-subnet).

Change-Id: I02ca1d94e9f4d5ad4a06182f5ac9a2434941cf08
---
 lib/neutron_plugins/services/l3 | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 75a3567096..5d339a00aa 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -392,8 +392,8 @@ function _neutron_configure_router_v6 {
         openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+    # This logic is specific to using OVN or the l3-agent for layer 3
+    if ([[ $Q_AGENT == "ovn" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
@@ -420,6 +420,11 @@ function _neutron_configure_router_v6 {
 
             # Configure interface for public bridge
             sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+            # Any IPv6 private subnet that uses the default IPV6 subnet pool
+            # and that is plugged into the default router (Q_ROUTER_NAME) will
+            # be reachable from the devstack node (ex: ipv6-private-subnet).
+            # Some scenario tests (such as octavia-tempest-plugin) rely heavily
+            # on this feature.
             local replace_range=${SUBNETPOOL_PREFIX_V6}
             if [[ -z "${SUBNETPOOL_V6_ID}" ]]; then
                 replace_range=${FIXED_RANGE_V6}

From cbc0b64a343e31506b43a9395e6a77fcfd6eb70b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 3 Jun 2021 06:14:05 +0000
Subject: [PATCH 2827/3333] Updated from generate-devstack-plugins-list

Change-Id: I2d5b0c59d5dd33f639ec685b16768325d67e9dbf
---
 doc/source/plugin-registry.rst | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4e7c2d7b2f..691fffa846 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,6 +24,8 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
+inspur/venus                             `https://opendev.org/inspur/venus <https://opendev.org/inspur/venus>`__
+inspur/venus-dashboard                   `https://opendev.org/inspur/venus-dashboard <https://opendev.org/inspur/venus-dashboard>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
@@ -39,21 +41,18 @@ openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
-openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
-openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
 openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/glance                         `https://opendev.org/openstack/glance <https://opendev.org/openstack/glance>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
 openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
 openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
-openstack/karbor                         `https://opendev.org/openstack/karbor <https://opendev.org/openstack/karbor>`__
-openstack/karbor-dashboard               `https://opendev.org/openstack/karbor-dashboard <https://opendev.org/openstack/karbor-dashboard>`__
 openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
 openstack/kuryr-kubernetes               `https://opendev.org/openstack/kuryr-kubernetes <https://opendev.org/openstack/kuryr-kubernetes>`__
 openstack/kuryr-libnetwork               `https://opendev.org/openstack/kuryr-libnetwork <https://opendev.org/openstack/kuryr-libnetwork>`__
@@ -65,21 +64,15 @@ openstack/manila-tempest-plugin          `https://opendev.org/openstack/manila-t
 openstack/manila-ui                      `https://opendev.org/openstack/manila-ui <https://opendev.org/openstack/manila-ui>`__
 openstack/masakari                       `https://opendev.org/openstack/masakari <https://opendev.org/openstack/masakari>`__
 openstack/mistral                        `https://opendev.org/openstack/mistral <https://opendev.org/openstack/mistral>`__
-openstack/monasca-analytics              `https://opendev.org/openstack/monasca-analytics <https://opendev.org/openstack/monasca-analytics>`__
 openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
-openstack/monasca-ceilometer             `https://opendev.org/openstack/monasca-ceilometer <https://opendev.org/openstack/monasca-ceilometer>`__
 openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
-openstack/monasca-log-api                `https://opendev.org/openstack/monasca-log-api <https://opendev.org/openstack/monasca-log-api>`__
 openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
-openstack/monasca-transform              `https://opendev.org/openstack/monasca-transform <https://opendev.org/openstack/monasca-transform>`__
 openstack/murano                         `https://opendev.org/openstack/murano <https://opendev.org/openstack/murano>`__
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
 openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
-openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__
-openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
 openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
@@ -93,19 +86,13 @@ openstack/octavia                        `https://opendev.org/openstack/octavia
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
-openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
 openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
-openstack/panko                          `https://opendev.org/openstack/panko <https://opendev.org/openstack/panko>`__
 openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
-openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__
-openstack/qinling-dashboard              `https://opendev.org/openstack/qinling-dashboard <https://opendev.org/openstack/qinling-dashboard>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
-openstack/searchlight                    `https://opendev.org/openstack/searchlight <https://opendev.org/openstack/searchlight>`__
-openstack/searchlight-ui                 `https://opendev.org/openstack/searchlight-ui <https://opendev.org/openstack/searchlight-ui>`__
 openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
 openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
@@ -143,6 +130,7 @@ x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-
 x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
 x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
+x/devstack-plugin-tobiko                 `https://opendev.org/x/devstack-plugin-tobiko <https://opendev.org/x/devstack-plugin-tobiko>`__
 x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
 x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
 x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__
@@ -169,6 +157,7 @@ x/networking-fortinet                    `https://opendev.org/x/networking-forti
 x/networking-hpe                         `https://opendev.org/x/networking-hpe <https://opendev.org/x/networking-hpe>`__
 x/networking-huawei                      `https://opendev.org/x/networking-huawei <https://opendev.org/x/networking-huawei>`__
 x/networking-infoblox                    `https://opendev.org/x/networking-infoblox <https://opendev.org/x/networking-infoblox>`__
+x/networking-l2gw                        `https://opendev.org/x/networking-l2gw <https://opendev.org/x/networking-l2gw>`__
 x/networking-lagopus                     `https://opendev.org/x/networking-lagopus <https://opendev.org/x/networking-lagopus>`__
 x/networking-mlnx                        `https://opendev.org/x/networking-mlnx <https://opendev.org/x/networking-mlnx>`__
 x/networking-nec                         `https://opendev.org/x/networking-nec <https://opendev.org/x/networking-nec>`__
@@ -193,7 +182,6 @@ x/stackube                               `https://opendev.org/x/stackube <https:
 x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
 x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
-x/tobiko                                 `https://opendev.org/x/tobiko <https://opendev.org/x/tobiko>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__

From 4e916aeb060ecf99203f297a0ff726a65d27f50e Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 26 Apr 2021 08:52:23 -0700
Subject: [PATCH 2828/3333] Configure glance unified limit quotas

This makes us configure limits for glance and enable enforcement.

Depends-On: https://review.opendev.org/c/openstack/glance/+/794247
Change-Id: If58d8474cae95b1be3044bd52010b8288a7f5fcc
---
 lib/glance | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/lib/glance b/lib/glance
index e789affaf1..fd2e0afcc1 100644
--- a/lib/glance
+++ b/lib/glance
@@ -84,6 +84,7 @@ GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_stagi
 GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
 
 GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
+GLANCE_ENABLE_QUOTAS=$(trueorfalse True GLANCE_ENABLE_QUOTAS)
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -263,6 +264,45 @@ function configure_glance_store {
     fi
 }
 
+function configure_glance_quotas {
+
+    # NOTE(danms): We need to have some of the OS_ things unset in
+    # order to use system scope, which is required for creating these
+    # limits. This is a hack, but I dunno how else to get osc to use
+    # system scope.
+
+    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 1000 --region $REGION_NAME \
+                image_size_total; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 1000 --region $REGION_NAME \
+                image_stage_total; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 100 --region $REGION_NAME \
+                image_count_total; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 100 --region $REGION_NAME \
+                image_count_uploading"
+
+    # Tell glance to use these limits
+    iniset $GLANCE_API_CONF DEFAULT use_keystone_limits True
+
+    # Configure oslo_limit so it can talk to keystone
+    iniset $GLANCE_API_CONF oslo_limit user_domain_name $SERVICE_DOMAIN_NAME
+    iniset $GLANCE_API_CONF oslo_limit password $SERVICE_PASSWORD
+    iniset $GLANCE_API_CONF oslo_limit username glance
+    iniset $GLANCE_API_CONF oslo_limit auth_type password
+    iniset $GLANCE_API_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
+    iniset $GLANCE_API_CONF oslo_limit system_scope "'all'"
+    iniset $GLANCE_API_CONF oslo_limit endpoint_id \
+           $(openstack endpoint list --service glance -f value -c ID)
+
+    # Allow the glance service user to read quotas
+    openstack role add --user glance --user-domain Default --system all \
+              reader
+}
+
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
@@ -403,6 +443,11 @@ function create_glance_accounts {
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
         iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id $service_domain_id
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id $service_domain_id
+
+        if [[ "$GLANCE_ENABLE_QUOTAS" = True ]]; then
+            configure_glance_quotas
+        fi
+
     fi
 }
 

From 6843bc798c3fe5f17286e1c07ede95171bb49a25 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 14 May 2021 14:51:51 -0500
Subject: [PATCH 2829/3333] Temporary add feature pragma

OpenStackSDK has a feature branch "feature/r1" as a preparation for the
R1.0 release. Due to different branch naming functional tests with
devstack are not running. Add temporarily (for the duration of the
feature branch) pragma to the zuul.yaml to allow Zuul run functional
tests. It will be dropped once SDK gets next major release.

Change-Id: I671b589150fe731125e16316a994a5942219920b
---
 .zuul.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 00129b5ca4..9a675c64ce 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,3 +1,10 @@
+- pragma:
+   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
+   # be using devstack
+   # TODO(gtema): delete this once r1 branch is merged into master
+    implied-branches:
+      - feature/r1
+
 - nodeset:
     name: openstack-single-node
     nodes:

From 3ad1661384636eee78a4bf5196812b6223e1b0a6 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Fri, 4 Jun 2021 21:32:17 +0000
Subject: [PATCH 2830/3333] Revert "Temporary add feature pragma"

This reverts commit 6843bc798c3fe5f17286e1c07ede95171bb49a25.

Reason for revert: not sure why but this end up disabling the integration job on check pipeline,

Change-Id: Icfaf8ea17b3ce2e405414c23f8075b18d297bf8b
example: latest recheck on PS12 check pipeline job for neutron - https://review.opendev.org/c/openstack/neutron/+/790060
---
 .zuul.yaml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9a675c64ce..00129b5ca4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,10 +1,3 @@
-- pragma:
-   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
-   # be using devstack
-   # TODO(gtema): delete this once r1 branch is merged into master
-    implied-branches:
-      - feature/r1
-
 - nodeset:
     name: openstack-single-node
     nodes:

From 96509ea025459ac077d2c85289da7725c53235cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 21 Oct 2020 20:33:08 +0200
Subject: [PATCH 2831/3333] Check centos-8-stream

CentOS Stream 8 (aka CentOS 8 Stream) is the currently
supported runtime platform. [0]

Some background history:
The Manila team has asked QA to test centos-8-stream
in the common gate.
A bit later it turned out the point releases of CentOS 8 (aka
CentOS Linux 8) will stop happening entirely by the end of 2021.
[1]

Includes a workaround to the edk2-ovmf issue on CentOS Stream 8
x86_64.

[0] https://governance.openstack.org/tc/reference/runtimes/xena.html
[1] https://lists.centos.org/pipermail/centos-devel/2020-December/075451.html

Change-Id: Iee5a262af757f27f79ba1d6f790e949427dca190
---
 .zuul.yaml                         | 19 +++++++++++++++++++
 lib/nova_plugins/functions-libvirt | 12 +++++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5bc6a8b424..e45ff8febc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -58,6 +58,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-8-stream
+    nodes:
+      - name: controller
+        label: centos-8-stream
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-opensuse-15
     nodes:
@@ -591,6 +601,14 @@
     voting: false
     timeout: 9000
 
+- job:
+    name: devstack-platform-centos-8-stream
+    parent: tempest-full-py3
+    description: CentOS 8 Stream platform test
+    nodeset: devstack-single-node-centos-8-stream
+    voting: false
+    timeout: 9000
+
 - job:
     name: devstack-async
     parent: tempest-full-py3
@@ -704,6 +722,7 @@
         - devstack-ipv6
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
+        - devstack-platform-centos-8-stream
         - devstack-async
         - devstack-multinode
         - devstack-unit-tests
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d3827c30dd..58adde7cd4 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -81,7 +81,17 @@ function install_libvirt {
         install_package qemu-kvm
 
         install_package libvirt libvirt-devel
-        if is_arch "aarch64"; then
+        if is_arch "x86_64"; then
+            # NOTE(yoctozepto): recent edk2-ovmf on CentOS Stream 8 x86_64 started failing with
+            # "libvirt.libvirtError: internal error: unknown feature amd-sev-es",
+            # so reinstall a known working version until the relevant bugs get fixed:
+            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961558
+            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961562
+            # TODO(yoctozepto): Remove this code when the time is right.
+            if [ "$os_VENDOR" = "CentOSStream" ]; then
+                install_package edk2-ovmf-20200602gitca407c7246bf-4.el8
+            fi
+        elif is_arch "aarch64"; then
             install_package edk2.git-aarch64
         fi
 

From 81937a230a8adb5c028db5a9ba9abf59b122a2ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 7 Jun 2021 17:28:38 +0000
Subject: [PATCH 2832/3333] [CI] Drop CentOS Linux 8 job and nodeset

CentOS Stream 8 (aka CentOS 8 Stream) is the currently
supported runtime platform. [0]

DevStack works with CentOS Stream only now. [1]

The only usage of the nodeset being dropped is handled by the
Depends-On.

[0] https://governance.openstack.org/tc/reference/runtimes/xena.html
[1] https://review.opendev.org/c/openstack/devstack/+/759122

Depends-On: https://review.opendev.org/c/openstack/cinder-tempest-plugin/+/795159
Change-Id: Ic0f696b46dce3dba529b53a8f9de8cda6b913c7b
---
 .zuul.yaml | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e45ff8febc..74223d44f5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,16 +48,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-centos-8
-    nodes:
-      - name: controller
-        label: centos-8
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-8-stream
     nodes:
@@ -593,14 +583,6 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
-- job:
-    name: devstack-platform-centos-8
-    parent: tempest-full-py3
-    description: Centos 8 platform test
-    nodeset: devstack-single-node-centos-8
-    voting: false
-    timeout: 9000
-
 - job:
     name: devstack-platform-centos-8-stream
     parent: tempest-full-py3
@@ -721,7 +703,6 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-fedora-latest
-        - devstack-platform-centos-8
         - devstack-platform-centos-8-stream
         - devstack-async
         - devstack-multinode

From 2fb8c7a5eea6f9321eef36fb9b8fd8e55465c91e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 7 Jun 2021 17:44:54 +0000
Subject: [PATCH 2833/3333] Move verify-ipv6-only-deployments

from Tempest to DevStack as it tests DevStack side of things and
is useful for projects not using Tempest.

Verbatim copy except for the devstack- prefix and the /devstack/
path.

Change-Id: Ie166730843f874b9c99e37244e460d7ad33b7eeb
---
 .../README.rst                                | 16 ++++
 .../defaults/main.yaml                        |  1 +
 .../tasks/main.yaml                           |  4 +
 tools/verify-ipv6-only-deployments.sh         | 92 +++++++++++++++++++
 4 files changed, 113 insertions(+)
 create mode 100644 roles/devstack-ipv6-only-deployments-verification/README.rst
 create mode 100644 roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml
 create mode 100644 roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml
 create mode 100755 tools/verify-ipv6-only-deployments.sh

diff --git a/roles/devstack-ipv6-only-deployments-verification/README.rst b/roles/devstack-ipv6-only-deployments-verification/README.rst
new file mode 100644
index 0000000000..400a8da222
--- /dev/null
+++ b/roles/devstack-ipv6-only-deployments-verification/README.rst
@@ -0,0 +1,16 @@
+Verify the IPv6-only deployments
+
+This role needs to be invoked from a playbook that
+run tests. This role verifies the IPv6 setting on
+devstack side and devstack deploy services on IPv6.
+This role is invoked before tests are run so that
+if any missing IPv6 setting or deployments can fail
+the job early.
+
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml b/roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml b/roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml
new file mode 100644
index 0000000000..59d3b79bc1
--- /dev/null
+++ b/roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml
@@ -0,0 +1,4 @@
+- name: Verify the ipv6-only deployments
+  become: true
+  become_user: stack
+  shell: "{{ devstack_base_dir }}/devstack/tools/verify-ipv6-only-deployments.sh"
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
new file mode 100755
index 0000000000..2596395165
--- /dev/null
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -0,0 +1,92 @@
+#!/bin/bash
+#
+#
+# NOTE(gmann): This script is used in 'devstack-tempest-ipv6' zuul job to verify that
+# services are deployed on IPv6 properly or not. This will capture if any devstck or devstack
+# plugins are missing the required setting to listen on IPv6 address. This is run as part of
+# run phase of zuul job and before test run. Child job of 'devstack-tempest-ipv6'
+# can expand the IPv6 verification specific to project by defining the new post-run script which
+# will run along with this base script.
+# If there are more common verification for IPv6 then we can always extent this script.
+
+# Keep track of the DevStack directory
+TOP_DIR=$(cd $(dirname "$0")/../../devstack && pwd)
+source $TOP_DIR/stackrc
+source $TOP_DIR/openrc admin admin
+
+function verify_devstack_ipv6_setting {
+    local _service_host=''
+    _service_host=$(echo $SERVICE_HOST | tr -d [])
+    local _host_ipv6=''
+    _host_ipv6=$(echo $HOST_IPV6 | tr -d [])
+    local _service_listen_address=''
+    _service_listen_address=$(echo $SERVICE_LISTEN_ADDRESS | tr -d [])
+    local _service_local_host=''
+    _service_local_host=$(echo $SERVICE_LOCAL_HOST | tr -d [])
+    if [[ "$SERVICE_IP_VERSION" != 6 ]]; then
+        echo $SERVICE_IP_VERSION "SERVICE_IP_VERSION is not set to 6 which is must for devstack to deploy services with IPv6 address."
+        exit 1
+    fi
+    is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
+    if [[ "$is_service_host_ipv6" != "True" ]]; then
+        echo $SERVICE_HOST "SERVICE_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
+    if [[ "$is_host_ipv6" != "True" ]]; then
+        echo $HOST_IPV6 "HOST_IPV6 is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
+    if [[ "$is_service_listen_address" != "True" ]]; then
+        echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
+    if [[ "$is_service_local_host" != "True" ]]; then
+        echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    echo "Devstack is properly configured with IPv6"
+    echo "SERVICE_IP_VERSION: " $SERVICE_IP_VERSION "HOST_IPV6: " $HOST_IPV6 "SERVICE_HOST: " $SERVICE_HOST "SERVICE_LISTEN_ADDRESS: " $SERVICE_LISTEN_ADDRESS "SERVICE_LOCAL_HOST: " $SERVICE_LOCAL_HOST
+}
+
+function sanity_check_system_ipv6_enabled {
+    system_ipv6_enabled=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_ipv6_enabled())')
+    if [[ $system_ipv6_enabled != "True" ]]; then
+        echo "IPv6 is disabled in system"
+        exit 1
+    fi
+    echo "IPv6 is enabled in system"
+}
+
+function verify_service_listen_address_is_ipv6 {
+    local endpoints_verified=False
+    local all_ipv6=True
+    endpoints=$(openstack endpoint list -f value -c URL)
+    for endpoint in ${endpoints}; do
+        local endpoint_address=''
+        endpoint_address=$(echo "$endpoint" | awk -F/ '{print $3}' | awk -F] '{print $1}')
+        endpoint_address=$(echo $endpoint_address | tr -d [])
+        local is_endpoint_ipv6=''
+        is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
+        if [[ "$is_endpoint_ipv6" != "True" ]]; then
+            all_ipv6=False
+            echo $endpoint ": This is not ipv6 endpoint which means corresponding service is not listening on IPv6 address."
+            continue
+        fi
+        endpoints_verified=True
+    done
+    if [[ "$all_ipv6" == "False"  ]] || [[ "$endpoints_verified" == "False" ]]; then
+        exit 1
+    fi
+    echo "All services deployed by devstack is on IPv6 endpoints"
+    echo $endpoints
+}
+
+#First thing to verify if system has IPv6 enabled or not
+sanity_check_system_ipv6_enabled
+#Verify whether devstack is configured properly with IPv6 setting
+verify_devstack_ipv6_setting
+#Get all registrfed endpoints by devstack in keystone and verify that each endpoints address is IPv6.
+verify_service_listen_address_is_ipv6

From 95298788085de38342e789bf10c35849c7117dfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Tue, 8 Jun 2021 16:19:40 +0000
Subject: [PATCH 2834/3333] [OVN] Set up routing on public bridge like OVS did

This fixes various reported and unreported issues with the new
behaviour.

Removes code repetition as well to pay off some technical debt.

Closes-Bug: #1930360
Change-Id: I726c532e96ca434520838ae8a35d5b88b6dd337b
---
 lib/neutron_plugins/ovn_agent   | 42 ++-------------------------------
 lib/neutron_plugins/services/l3 |  6 ++---
 2 files changed, 5 insertions(+), 43 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 948fede3b9..cfcb01ee91 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -262,48 +262,10 @@ function clone_repository {
     ERROR_ON_CLONE=false git_clone $repo $dir $branch
 }
 
-function get_ext_gw_interface {
-    # Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
-    # This function is copied directly from the devstack neutron-legacy script
-    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
-        echo $Q_PUBLIC_VETH_EX
-    else
-        # Disable in-band as we are going to use local port
-        # to communicate with VMs
-        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
-            other_config:disable-in-band=true
-        echo $PUBLIC_BRIDGE
-    fi
-}
-
 function create_public_bridge {
     # Create the public bridge that OVN will use
-    # This logic is based on the devstack neutron-legacy _neutron_configure_router_v4 and _v6
-    local ext_gw_ifc
-    ext_gw_ifc=$(get_ext_gw_interface)
-
-    sudo ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
-    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
-    if [ -n "$FLOATING_RANGE" ]; then
-        local cidr_len=${FLOATING_RANGE#*/}
-        sudo ip addr replace $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
-    fi
-
-    # Ensure IPv6 RAs are accepted on the interface with the default route.
-    # This is needed for neutron-based devstack clouds to work in
-    # IPv6-only clouds in the gate. Please do not remove this without
-    # talking to folks in Infra. This fix is based on a devstack fix for
-    # neutron L3 agent: https://review.openstack.org/#/c/359490/.
-    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
-    sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
-
-    sudo sysctl -w net.ipv6.conf.all.forwarding=1
-    if [ -n "$IPV6_PUBLIC_RANGE" ]; then
-        local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-        sudo ip -6 addr replace $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
-    fi
-
-    sudo ip link set $ext_gw_ifc up
+    sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE protocols=OpenFlow13,OpenFlow15
+    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$PUBLIC_BRIDGE
 }
 
 function _disable_libvirt_apparmor {
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 5d339a00aa..b6bc02818c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -343,8 +343,8 @@ function _neutron_configure_router_v4 {
     # Configure the external network as the default router gateway
     openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3 || is_service_enabled neutron-l3;  then
+    # This logic is specific to using OVN or the l3-agent for layer 3
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
         # Configure and enable public bridge
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
@@ -393,7 +393,7 @@ function _neutron_configure_router_v6 {
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
-    if ([[ $Q_AGENT == "ovn" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.

From 5a684eb51b4c18aee2051c5a7c703f50bbcc41ca Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 9 Jun 2021 09:37:34 +0200
Subject: [PATCH 2835/3333] Drop broute from ebtables_dump

This table is no longer present on most installations, drop it
from the list to avoid error messages during log collection
that people mistake to be the real error why devstack is failing.

This may lose some debugging information in edge cases, but I
think the improvement of the general user experience is more
important.

Change-Id: Ibb9b247a018a788c8c4b40487762319fe470bf0f
Closes-Bug: 1885198
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 22770f15b6..e2921737db 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -134,7 +134,7 @@ def disk_space():
 
 
 def ebtables_dump():
-    tables = ['filter', 'nat', 'broute']
+    tables = ['filter', 'nat']
     _header("EB Tables Dump")
     if not _find_cmd('ebtables'):
         return

From 20d6a21e8a1daed9eee0a8413217b2f8e4e863dd Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 9 Jun 2021 14:20:01 -0400
Subject: [PATCH 2836/3333] Switch fedora-latest to use fedora-34

Fedora 32 is now EOL, we should test against the newly released
version of Fedora which is 34.

Depends-On: https://review.opendev.org/c/openstack/project-config/+/795604
Change-Id: I10d868aca20d1a10d3e7fcfeb78f6fda4c896ee8
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 74223d44f5..968d79f76a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -72,7 +72,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-32
+        label: fedora-34
     groups:
       - name: tempest
         nodes:

From 89baa314c1408251abd9f4d61d9cf5e5c945bc4e Mon Sep 17 00:00:00 2001
From: Artem Goncharov <Artem.goncharov@gmail.com>
Date: Fri, 11 Jun 2021 16:59:52 +0200
Subject: [PATCH 2837/3333] Temporary add feature pragma

OpenStackSDK has a feature branch "feature/r1" as a preparation for the
R1.0 release. Due to different branch naming functional tests with
devstack are not running. Add temporarily (for the duration of the
feature branch) pragma to the zuul.yaml to allow Zuul run functional
tests. It will be dropped once SDK gets next major release.
Previous attemp didn't work well for other projects, therefore
explicitly include master as well.

Change-Id: I3a5722873f395bc52cc55a0fd6bcea0ebe3b74fc
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 74223d44f5..3c490ff180 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,3 +1,11 @@
+- pragma:
+   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
+   # be using devstack
+   # TODO(gtema): delete this once r1 branch is merged into master
+    implied-branches:
+      - master
+      - feature/r1
+
 - nodeset:
     name: openstack-single-node
     nodes:

From 6af3cb9eb273c127c20bc07f65c9a5d7f8ba95cd Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Thu, 11 Mar 2021 11:28:47 -0800
Subject: [PATCH 2838/3333] nova ironic-hypevisor - support scoped auth config

The Secure RBAC effort has updated Ironic such that it
can support a mode where it is scope enforcing for all
interactions with the API. Due to the design, and operating
nature of Ironic's API, services speaking with it must
authenticate with a system scope to have a full picture
of the universe.

In this case, we need to update the nova configuration
accordingly such that the compute service understands
how to talk to ironic so that it can see the nodes under
management.

Ironic will likely update this again at a later point in
time to enable a "hybrid" mixed-mode as the operating model
and related permissions *should* allow nova to use a project
scoped "owner" account with Ironic, in order to access
and command nodes to deploy. But at this time, we're
focusing on the exclusive operating mode.

Change-Id: I1946725ce08c495178c419eaf38829f921c91bbe
Needed-By: https://review.opendev.org/c/openstack/ironic/+/778957
---
 functions-common                   | 5 +++++
 lib/nova_plugins/hypervisor-ironic | 9 ++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 340da754a2..11679e4aa3 100644
--- a/functions-common
+++ b/functions-common
@@ -1037,6 +1037,11 @@ function is_ironic_hardware {
     return 1
 }
 
+function is_ironic_enforce_scope {
+    is_service_enabled ironic && [[ "$IRONIC_ENFORCE_SCOPE" == "True" ]] && return 0
+    return 1
+}
+
 
 # Package Functions
 # =================
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index bda6ef6998..f058e9bb53 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,9 +47,13 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic username admin
     iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
     iniset $NOVA_CONF ironic auth_url $KEYSTONE_SERVICE_URI
-    iniset $NOVA_CONF ironic project_domain_id default
+    if is_ironic_enforce_scope; then
+        iniset $NOVA_CONF ironic system_scope all
+    else
+        iniset $NOVA_CONF ironic project_domain_id default
+        iniset $NOVA_CONF ironic project_name demo
+    fi
     iniset $NOVA_CONF ironic user_domain_id default
-    iniset $NOVA_CONF ironic project_name demo
     iniset $NOVA_CONF ironic region_name $REGION_NAME
 
     # These are used with crufty legacy ironicclient
@@ -82,7 +86,6 @@ function stop_nova_hypervisor {
     :
 }
 
-
 # Restore xtrace
 $_XTRACE_HYP_IRONIC
 

From 808331488dc16afdf9bd4c2c3103a4a8fc9a6209 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Fri, 18 Jun 2021 12:06:02 +0000
Subject: [PATCH 2839/3333] Revert edk2 workaround

It is not needed anymore.

Change-Id: I706a33b0a7c737a23b9a7270af1e53e5de83c66f
---
 lib/nova_plugins/functions-libvirt | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 58adde7cd4..d3827c30dd 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -81,17 +81,7 @@ function install_libvirt {
         install_package qemu-kvm
 
         install_package libvirt libvirt-devel
-        if is_arch "x86_64"; then
-            # NOTE(yoctozepto): recent edk2-ovmf on CentOS Stream 8 x86_64 started failing with
-            # "libvirt.libvirtError: internal error: unknown feature amd-sev-es",
-            # so reinstall a known working version until the relevant bugs get fixed:
-            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961558
-            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961562
-            # TODO(yoctozepto): Remove this code when the time is right.
-            if [ "$os_VENDOR" = "CentOSStream" ]; then
-                install_package edk2-ovmf-20200602gitca407c7246bf-4.el8
-            fi
-        elif is_arch "aarch64"; then
+        if is_arch "aarch64"; then
             install_package edk2.git-aarch64
         fi
 

From 5344885a61fe39565692014c15e0b4fb1055c835 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 17 Jun 2021 12:37:35 +0100
Subject: [PATCH 2840/3333] os_vif: Add support for configuring os_vif_ovs
 plugin

This change add an os-vif lib that declares two new variables
OS_VIF_OVS_OVSDB_INTERFACE and OS_VIF_OVS_ISOLATE_VIF

The former is introduced to workaround bug #1929446 which cause the nova
and neutron agents to periodically block waiting for ovs to respond.

OS_VIF_OVS_ISOLATE_VIF is added to address bug #1734320 when using
ml2/ovs vif isolation should always be used to prevent cross tenant
traffic during a live migration.  This makes devstack more closely
mirror reality by enabling it when ml2/ovs is used and disabling it
otherwise.

Related-Bug: #1734320
Related-Bug: #1929446
Related-Bug: #1912310
Change-Id: I88254c6e22b52585506ee4907c1c03b8d4f2dac7
---
 lib/os-vif | 29 +++++++++++++++++++++++++++++
 stack.sh   |  6 ++++++
 2 files changed, 35 insertions(+)
 create mode 100644 lib/os-vif

diff --git a/lib/os-vif b/lib/os-vif
new file mode 100644
index 0000000000..865645c0d5
--- /dev/null
+++ b/lib/os-vif
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# support vsctl or native.
+# until bug #1929446 is resolved we override the os-vif default
+# and fall back to the legacy "vsctl" driver.
+OS_VIF_OVS_OVSDB_INTERFACE=${OS_VIF_OVS_OVSDB_INTERFACE:="vsctl"}
+
+function is_ml2_ovs {
+    if [[ "${Q_AGENT}" == "openvswitch" ]]; then
+        echo "True"
+    fi
+    echo "False"
+}
+
+# This should be true for any ml2/ovs job but should be set to false for
+# all other ovs based jobs e.g. ml2/ovn
+OS_VIF_OVS_ISOLATE_VIF=${OS_VIF_OVS_ISOLATE_VIF:=$(is_ml2_ovs)}
+OS_VIF_OVS_ISOLATE_VIF=$(trueorfalse False OS_VIF_OVS_ISOLATE_VIF)
+
+function configure_os_vif {
+    if [[ -e ${NOVA_CONF} ]]; then
+        iniset ${NOVA_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
+        iniset ${NOVA_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
+    fi
+    if [[ -e ${NEUTRON_CONF} ]]; then
+        iniset ${NEUTRON_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
+        iniset ${NEUTRON_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
+    fi
+}
diff --git a/stack.sh b/stack.sh
index 6858ab8c42..44f1c8fa01 100755
--- a/stack.sh
+++ b/stack.sh
@@ -597,6 +597,7 @@ source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
+source $TOP_DIR/lib/os-vif
 
 # Extras Source
 # --------------
@@ -1159,6 +1160,11 @@ if is_service_enabled q-dhcp; then
     sudo sysctl -w net.ipv4.ip_forward=1
 fi
 
+# os-vif
+# ------
+if is_service_enabled nova neutron; then
+    configure_os_vif
+fi
 
 # Storage Service
 # ---------------

From 7befae663c6aa99343cb2c90e74ee2e3bc676559 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Sat, 19 Jun 2021 13:24:00 +0200
Subject: [PATCH 2841/3333] Delay horizon startup

Move the 'Starting Horizon' task after the end of the wait for
create_flavors.
The start_horizon function restarts the httpd server, the openstack
services are unavailable during a short period of time, so the
"openstack flavor create" calls might fail randomly.

Closes-Bug: #1932580
Change-Id: I32ee7457586e3de8ba4dfce3b1a12025f9776542
---
 stack.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6858ab8c42..ef1ad3d26a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1341,6 +1341,7 @@ if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     done
 fi
 
+async_wait create_flavors
 
 if is_service_enabled horizon; then
     echo_summary "Starting Horizon"
@@ -1348,8 +1349,6 @@ if is_service_enabled horizon; then
     start_horizon
 fi
 
-async_wait create_flavors
-
 
 # Create account rc files
 # =======================

From a5d52831dc4d357906f5514943e17ab535e9e578 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Fri, 18 Jun 2021 13:53:21 +0200
Subject: [PATCH 2842/3333] Fix updating setuptools in Centos

In RHEL-based distributions, updating setuptools using pip removes the
files from the python3-setuptools RPM. It breaks some tools such as
semanage (which is used by diskimage-builder) that use the -s flag of
the python interpreter (don't import modules from /usr/local).
This commit reinstalls python3-setuptools to fix those applications.

Change-Id: Ib44857e83f75acf37823fae912960a801c83cf7f
---
 tools/fixup_stuff.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 19219435ad..060abb1605 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -106,6 +106,16 @@ function fixup_fedora {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
+
+    # After updating setuptools based on the requirements, the files from the
+    # python3-setuptools RPM are deleted, it breaks some tools such as semanage
+    # (used in diskimage-builder) that use the -s flag of the python
+    # interpreter, enforcing the use of the packages from /usr/lib.
+    # Importing setuptools/pkg_resources in a such environment fails.
+    # Enforce the package re-installation to fix those applications.
+    if is_package_installed python3-setuptools; then
+        sudo dnf reinstall -y python3-setuptools
+    fi
 }
 
 function fixup_suse {

From 5c9affdd9a2baff2166146f4743fe75009b32eab Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Fri, 12 Mar 2021 11:19:52 -0800
Subject: [PATCH 2843/3333] Use specific credentials for tempest plugin setup

The tempest plugin expects the classic environment variables
to be present for credentials to access the cloud, but this is
wrong in cases where we're trying to setup system
scoped services and need to remove the environment variables
that was being used.

Instead, change the plugin to use the os-cloud entry definitions,
and specifically in this case devstack-admin which makes sense
until we begin to start to make tempest itself scope aware.

We likely will want to change the environment variables from being
registered in devstack at some point and completely shift towards
passing an-os-cloud parameter, but that is outside the scope of
this change as doing so will likely break all plugins.

Change-Id: I8d4ec68f116eea07bc7346f939e134fa2e655eac
---
 lib/tempest | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d835c68d4a..545018b4a4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -107,7 +107,7 @@ function remove_disabled_extensions {
 # Takes an image ID parameter as input
 function image_size_in_gib {
     local size
-    size=$(openstack image show $1 -c size -f value)
+    size=$(openstack --os-cloud devstack-admin image show $1 -c size -f value)
     echo $size | python3 -c "import math; print(int(math.ceil(float(int(input()) / 1024.0 ** 3))))"
 }
 
@@ -173,7 +173,7 @@ function configure_tempest {
                 image_uuid_alt="$IMAGE_UUID"
             fi
             images+=($IMAGE_UUID)
-        done < <(openstack image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+        done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
 
         case "${#images[*]}" in
             0)
@@ -209,23 +209,23 @@ function configure_tempest {
     local alt_username=${ALT_USERNAME:-alt_demo}
     local alt_project_name=${ALT_TENANT_NAME:-alt_demo}
     local admin_project_id
-    admin_project_id=$(openstack project list | awk "/ admin / { print \$2 }")
+    admin_project_id=$(openstack --os-cloud devstack-admin project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
         # Tempest creates its own instance types
-        available_flavors=$(nova flavor-list)
+        available_flavors=$(openstack --os-cloud devstack-admin flavor list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
+                openstack --os-cloud devstack-admin flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
+                openstack --os-cloud devstack-admin flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else
@@ -251,7 +251,7 @@ function configure_tempest {
             fi
             flavor_ref=${flavors[0]}
             flavor_ref_alt=$flavor_ref
-            flavor_ref_size=$(openstack flavor show --format value --column disk "${flavor_ref}")
+            flavor_ref_size=$(openstack --os-cloud devstack-admin flavor show --format value --column disk "${flavor_ref}")
 
             # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
             # Some resize instance in tempest tests depends on this.
@@ -264,7 +264,7 @@ function configure_tempest {
                     #               flavor selected as default, e.g. m1.small,
                     #               we need to perform additional check.
                     #
-                    flavor_ref_alt_size=$(openstack flavor show --format value --column disk "${f}")
+                    flavor_ref_alt_size=$(openstack --os-cloud devstack-admin flavor show --format value --column disk "${f}")
                     if [[ "${flavor_ref_alt_size}" -lt "${flavor_ref_size}" ]]; then
                         continue
                     fi
@@ -285,10 +285,10 @@ function configure_tempest {
     # If NEUTRON_CREATE_INITIAL_NETWORKS is not true, there is no network created
     # and the public_network_id should not be set.
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
-        public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
+        public_network_id=$(openstack --os-cloud devstack-admin network show -f value -c id $PUBLIC_NETWORK_NAME)
         # make sure shared network presence does not confuses the tempest tests
-        openstack network create --share shared
-        openstack subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
+        openstack --os-cloud devstack-admin network create --share shared
+        openstack --os-cloud devstack-admin subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG

From bf13075632b076d19b22f347aaa52cba7dcb7169 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 23 Jun 2021 13:02:57 +0000
Subject: [PATCH 2844/3333] Make explicit the network backend used in the CI
 jobs

All Neutron CI jobs (except for unit, functional and fullstack jobs),
have explicitly defined the network backend used:
- linuxbridge
- ovs
- ovn

That was discussed and approved during the Neutron CI meetings [1].

[1]https://meetings.opendev.org/meetings/neutron_ci/2021/neutron_ci.2021-06-15-15.00.log.html

Depends-On: https://review.opendev.org/c/openstack/neutron/+/797051
Change-Id: Ib14542311e9b1d49829bef54f433b8a04709a9fd
---
 .zuul.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c490ff180..f8435a55e4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -730,11 +730,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-grenade-multinode:
+        - neutron-ovs-grenade-multinode:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-linuxbridge:
+        - neutron-linuxbridge-tempest:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -767,11 +767,11 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - neutron-grenade-multinode:
+        - neutron-ovs-grenade-multinode:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-linuxbridge:
+        - neutron-linuxbridge-tempest:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -824,11 +824,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-dvr:
+        - neutron-ovs-tempest-dvr:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-dvr-ha-multinode-full:
+        - neutron-ovs-tempest-dvr-ha-multinode-full:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 2175ff31085972911d155144e02fb178cafaa638 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 25 Jun 2021 10:59:29 +0100
Subject: [PATCH 2845/3333] zuul: Add /etc/libvirt to log collection

Useful when debugging libvirtd issues such as bug #1912310.

Related-Bug: #1912310
Change-Id: Ic8504bd61316e44215672cc44436a3b9a19e114d
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c490ff180..b189849655 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -336,6 +336,7 @@
         /var/log/postgresql: logs
         /var/log/mysql: logs
         /var/log/libvirt: logs
+        /etc/libvirt: logs
         /etc/sudoers: logs
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs

From f0bf2bdff12b66eefbb2eae83e919611eb7cc76d Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 29 Jun 2021 09:18:47 +0100
Subject: [PATCH 2846/3333] libvirt: Stop installing python bindings from pip

As set out in bug #1933096 these bindings are dynamically built against
the version of libvirt present in the environment at build time.

As a result using a pre-built wheel can cause AttributeError's when the
bindings have previously been built elsewhere against an older version
of libvirt installed on the host. This is currently the case in CentOS 8
stream based CI jobs where we try to use 7.4.0 bindings that appear to
be built against libvirt <= 6.10 leading to bug #1933096.

This change seeks to avoid this by installing the bindings from packages
that will always be built against the correct corresponding version of
libvirt.

Change-Id: I76184c17a776c4e1ecaab9549d9d36c8c07c60fa
Closes-Bug: #1933096
---
 lib/nova_plugins/functions-libvirt | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d3827c30dd..e9ceae4dea 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -58,13 +58,10 @@ EOF
 function install_libvirt {
 
     if is_ubuntu; then
-        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev
+        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt
         if is_arch "aarch64"; then
             install_package qemu-efi
         fi
-        # uninstall in case the libvirt version changed
-        pip_uninstall libvirt-python
-        pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
 
@@ -79,14 +76,11 @@ function install_libvirt {
         # as the base system version is too old.  We should have
         # pre-installed these
         install_package qemu-kvm
+        install_package libvirt libvirt-devel python3-libvirt
 
-        install_package libvirt libvirt-devel
         if is_arch "aarch64"; then
             install_package edk2.git-aarch64
         fi
-
-        pip_uninstall libvirt-python
-        pip_install_gr libvirt-python
     fi
 
     if [[ $DEBUG_LIBVIRT_COREDUMPS == True ]]; then

From 1ab63132df6831bdf7ce180cf7923540305dcd02 Mon Sep 17 00:00:00 2001
From: Przemyslaw Szczerbik <przemyslaw.szczerbik@est.tech>
Date: Tue, 6 Jul 2021 14:26:40 +0200
Subject: [PATCH 2847/3333] Allow to install os-resource-classes from git repo

Example local.conf config snippet:

LIBS_FROM_GIT="os-resource-classes"
OS_RESOURCE_CLASSES_REPO="${LOCAL_GIT_BASE}/os-resource-classes"
OS_RESOURCE_CLASSES_BRANCH="dev_branch"

Closes-Bug: #1934784
Change-Id: I972a2a49aa816433152e5cfac4f672c0465d083f
---
 lib/libraries                | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 lib/libraries
 mode change 100644 => 100755 stackrc

diff --git a/lib/libraries b/lib/libraries
old mode 100644
new mode 100755
index c7aa8151ae..67ff21f41a
--- a/lib/libraries
+++ b/lib/libraries
@@ -59,6 +59,7 @@ GITDIR["tooz"]=$DEST/tooz
 # Non oslo libraries are welcomed below as well, this prevents
 # duplication of this code.
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["os-resource-classes"]=$DEST/os-resource-classes
 GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
@@ -122,6 +123,7 @@ function install_libs {
     #
     # os-traits for nova
     _install_lib_from_source "os-brick"
+    _install_lib_from_source "os-resource-classes"
     _install_lib_from_source "os-traits"
     #
     # python client libraries we might need from git can go here
diff --git a/stackrc b/stackrc
old mode 100644
new mode 100755
index 05016594eb..620b1fc04d
--- a/stackrc
+++ b/stackrc
@@ -548,6 +548,10 @@ GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git
 GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
+# os-resource-classes library containing a list of standardized resource classes for OpenStack
+GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO=:-${GIT_BASE}/openstack/os-resource-classes.git}
+GITBRANCH["os-resource-classes"]=${OS_RESOURCE_CLASSES_BRANCH:-$TARGET_BRANCH}
+
 # os-traits library for resource provider traits in the placement service
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
 GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 5b53389073..ce1b34461c 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 6f4eafb823e498a8d5eb344376c41f5bec8a1b04 Mon Sep 17 00:00:00 2001
From: zenkuro <zenkuro@protonmail.com>
Date: Thu, 15 Jul 2021 19:24:28 +0300
Subject: [PATCH 2848/3333] Added AlmaLinux to CentOS 8 family

Change-Id: I9fb6f010842a495c838d468b47dc5081596f41a2
---
 functions-common | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/functions-common b/functions-common
index 11679e4aa3..40567f8e1d 100644
--- a/functions-common
+++ b/functions-common
@@ -391,6 +391,7 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
+        "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
@@ -451,6 +452,7 @@ function is_fedora {
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
+        [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]
 }
 

From 5a642450d6ac94ff1ea2bea3e7ce3887ca79dcc4 Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Mon, 19 Jul 2021 07:01:29 -0700
Subject: [PATCH 2849/3333] Provide override for glance image size limit

The glance image size limitation was added and unfortuantely
does prevent larger images from being uploaded to glance. In the
case of all baremetal testing, this value is realistically smaller
than stock "cloud" images which support booting to baremetal with
often requisite firmware blobs, which forces some images over 1GB
in size.

Adds GLANCE_LIMIT_IMAGE_SIZE_TOTAL which allows users who need
larger images to be able to override the default while still
enabling limits enforcement in their deployment. The default
value is 1000.

Change-Id: Id425aa546f1a5973bae8be9c017782d18f0b4a47
---
 lib/glance | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/glance b/lib/glance
index fd2e0afcc1..b132f37834 100644
--- a/lib/glance
+++ b/lib/glance
@@ -108,6 +108,10 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
+
+# Glance default limit for Devstack
+GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-1000}
+
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
 # TODO(mtreinish): Remove the eventlet path here and in all the similar
 # conditionals below after the Pike release
@@ -273,11 +277,11 @@ function configure_glance_quotas {
 
     bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
         openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 1000 --region $REGION_NAME \
-                image_size_total; \
+                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
+                --region $REGION_NAME image_size_total; \
         openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 1000 --region $REGION_NAME \
-                image_stage_total; \
+                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
+                --region $REGION_NAME image_stage_total; \
         openstack --os-cloud devstack-system-admin registered limit create \
                 --service glance --default-limit 100 --region $REGION_NAME \
                 image_count_total; \

From c8b66ff33e14c8339c8146d3116b9ff672f912ec Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 19 Jul 2021 11:14:18 -0700
Subject: [PATCH 2850/3333] Add configuration notes about glance limits

Change-Id: I21a43584116f4b719cf99d3942044cbf13fefb9a
---
 doc/source/configuration.rst | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 2d0c894530..67456142de 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -689,6 +689,24 @@ use the v3 API. It is possible to setup keystone without v2 API, by doing:
 
     ENABLE_IDENTITY_V2=False
 
+
+Glance
+++++++
+
+The default image size quota of 1GiB may be too small if larger images
+are to be used. Change the default at setup time with:
+
+::
+
+    GLANCE_LIMIT_IMAGE_SIZE_TOTAL=5000
+
+or at runtime via:
+
+::
+
+    openstack --os-cloud devstack-system-admin registered limit update \
+      --service glance --default-limit 5000 --region RegionOne image_size_total
+
 .. _arch-configuration:
 
 Architectures

From 71bd10e45197a405cd497c8923db7442bde14a95 Mon Sep 17 00:00:00 2001
From: Pavan Kesava Rao <pkesavar@redhat.com>
Date: Mon, 19 Jul 2021 13:33:42 -0400
Subject: [PATCH 2851/3333] Enable tempest tests for hostname sanitization

Starting Wallaby release, nova sanitizes instance hostnames having
freeform characters with dashes. It should be tested in Devstack.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/795699
Change-Id: I54794e58b67620c36e8f2966ec3b62dd24da745b
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 4eacfa09ca..095361d4f4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -419,6 +419,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_back_and_forth ${LIVE_MIGRATE_BACK_AND_FORTH:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
 
+    # Starting Wallaby, nova sanitizes instance hostnames having freeform characters with dashes
+    iniset $TEMPEST_CONFIG compute-feature-enabled hostname_fqdn_sanitization True
+
     if [[ -n "$NOVA_FILTERS" ]]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled scheduler_enabled_filters ${NOVA_FILTERS}
     fi

From 524487728e85388c73ececae3f2eb272321cffc7 Mon Sep 17 00:00:00 2001
From: Marek Tamaskovic <mtamasko@redhat.com>
Date: Wed, 28 Jul 2021 16:54:50 +0200
Subject: [PATCH 2852/3333] Fix opening shell as user 'stack'

The usage of sudo with su is not recommended. It results in incosnistent
environment variables. Instead use just sudo with appropriate arguments.
The argument '-u stack' specifies that the sudo will execute as user 'stack'.
The last argument '-i' will launch an interactive shell.

Closes-Bug: #1938148

Change-Id: I42387660480377cdf9a0b04f190e7e1f21fb354f
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9f477ab911..08ce4cb061 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,7 +63,7 @@ have sudo privileges:
 .. code-block:: console
 
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
-    $ sudo su - stack
+    $ sudo -u stack -i
 
 Download DevStack
 -----------------

From 0456baaee5309431cd1f88ba4a0ceaa7f050b743 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 30 Jul 2021 19:29:57 +0530
Subject: [PATCH 2853/3333] Fix Usage of rdo-release rpm

rdo-release.el8.rpm rpm points to latest RDO release,
so use it for master, for stable releases use corresponding
release rpm.

Change-Id: I508eceb00d7501ffcfac73d7bc2272badb241494
---
 stack.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index c439a7217f..e3d67f571f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -300,10 +300,14 @@ function _install_epel {
 }
 
 function _install_rdo {
-    # NOTE(ianw) 2020-04-30 : when we have future branches, we
-    # probably want to install the relevant branch RDO release as
-    # well.  But for now it's all master.
-    sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    if [[ "$TARGET_BRANCH" == "master" ]]; then
+        # rdo-release.el8.rpm points to latest RDO release, use that for master
+        sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    else
+        # For stable branches use corresponding release rpm
+        rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+        sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+    fi
     sudo dnf -y update
 }
 

From ba68a49598309c5f6c5e4a0ec9d2b13b8229eee0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 31 Jul 2021 06:13:46 +0000
Subject: [PATCH 2854/3333] Updated from generate-devstack-plugins-list

Change-Id: I062b9a121c79650973c8d8d975e1c723d5798777
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 691fffa846..490132e0d7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -98,6 +98,7 @@ openstack/shade                          `https://opendev.org/openstack/shade <h
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
+openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a-service <https://opendev.org/openstack/tap-as-a-service>`__
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
@@ -179,7 +180,6 @@ x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nov
 x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
 x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
 x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
-x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
 x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__

From f44aa0c55a81e24a8ad321c0c741939e86705e09 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Wed, 4 Aug 2021 18:27:48 -0400
Subject: [PATCH 2855/3333] Allow cinder default quotas configuration

The default cinder quotas for volumes, backups, or snapshots may
be too low for highly concurrent testing, so make these configurable
in devstack.

Change-Id: Ie3cf3239b48f9905f5760ad0166eea954ecf5eed
---
 doc/source/configuration.rst | 6 ++++++
 lib/cinder                   | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 67456142de..8244525075 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -642,6 +642,12 @@ with ``VOLUME_BACKING_FILE_SIZE``.
   VOLUME_NAME_PREFIX="volume-"
   VOLUME_BACKING_FILE_SIZE=24G
 
+When running highly concurrent tests, the default per-project quotas
+for volumes, backups, or snapshots may be too small.  These can be
+adjusted by setting ``CINDER_QUOTA_VOLUMES``, ``CINDER_QUOTA_BACKUPS``,
+or ``CINDER_QUOTA_SNAPSHOTS`` to the desired value.  (The default for
+each is 10.)
+
 
 Keystone
 ~~~~~~~~
diff --git a/lib/cinder b/lib/cinder
index 7f2f29f892..9235428335 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -267,6 +267,11 @@ function configure_cinder {
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 
+    # set default quotas
+    iniset $CINDER_CONF DEFAULT quota_volumes ${CINDER_QUOTA_VOLUMES:-10}
+    iniset $CINDER_CONF DEFAULT quota_backups ${CINDER_QUOTA_BACKUPS:-10}
+    iniset $CINDER_CONF DEFAULT quota_snapshots ${CINDER_QUOTA_SNAPSHOTS:-10}
+
     # Avoid RPC timeouts in slow CI and test environments by doubling the
     # default response timeout set by RPC clients. See bug #1873234 for more
     # details and example failures.

From ac1b723c20fb67aaecd43cd08c6eee88c5f339f2 Mon Sep 17 00:00:00 2001
From: Roman Dobosz <gryf73@gmail.com>
Date: Fri, 6 Aug 2021 12:52:01 +0200
Subject: [PATCH 2856/3333] Fix displaying usage for make_cert.sh

Now, if no arguments are passed to make_cert.sh script, it will fail on:

  tools/make_cert.sh: line 30: [: missing `]'

and might go on with generating certs depending on the bash settings.
It is fixed within this patch.

Change-Id: I62bf9c972ebd1644da622439e05114f245f20809
---
 tools/make_cert.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/make_cert.sh b/tools/make_cert.sh
index e91464fc0f..0212d0033a 100755
--- a/tools/make_cert.sh
+++ b/tools/make_cert.sh
@@ -27,7 +27,7 @@ function usage {
 }
 
 CN=$1
-if [ -z "$CN" ]]; then
+if [ -z "$CN" ]; then
     usage
 fi
 ORG_UNIT_NAME=${2:-$ORG_UNIT_NAME}
@@ -52,5 +52,5 @@ init_CA
 make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME
 
 # Create a cert bundle
-cat $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/cacert.pem >$DEVSTACK_CERT
-
+cat $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+    $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/cacert.pem >$DEVSTACK_CERT

From 6b9a5646225a766f6240e2a1a93a92b82e088aa0 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 28 Jul 2021 11:19:57 +1000
Subject: [PATCH 2857/3333] Revert "Workaround for new pip 20.3 behavior"

This reverts commit 7a3a7ce876a37376fe0dca7278e41a4f46867daa and
bcd0acf6c0b5d6501e91133c3a937b3fc40f7122 and part of
f1ed7c77c50ac28cb58c9f7ed885c6a3e0a75403 which all cap our pip
installs.

Given the pip ecosystem can often incorporate major changes, tracking
upstream at least generally gives us one problem at a time to solve
rather than trying to handle version jumps when LTS distros update.

The new dependency resolver included some changes that disallow
setting URL's like "file:///path/to/project#egg=project" in
constraints.  Apparently the fact it used to work was an accident of
the requires/constraints mechanism; it does make some sense as the URL
doesn't really have a version-number that the resolver can put in an
ordering graph.

The _setup_package_with_constraints_edit function comment highlights
what this is trying to do

 # Updates the constraints from REQUIREMENTS_DIR to reflect the
 # future installed state of this package. This ensures when we
 # install this package we get the from source version.

In other words; if constraints has "foo==1.2.3" and Zuul has checked
out "foo" for testing, we have to make sure pip doesn't choose version
1.2.3 from pypi.

It seems like removing the entry from upper-requirements.txt is the
important part; adding the URL path to the on-disk version was just
something that seemed to work at the time, but isn't really necessary.
We will install the package in question which will be the latest
version (from Zuul checkout) and without the package in
upper-requirements.txt nothing will try and downgrade it.

Therefore the solution proposed here is to remove the adding of the
URL parts.

This allows us to uncap pip and restore testing with the new
dependency resolver.

Closes-Bug: #1906322
Change-Id: Ib9ba52147199a9d6d0293182d5db50c4a567d677
---
 inc/python           |  7 ++++---
 lib/tempest          |  3 ---
 tools/cap-pip.txt    |  1 -
 tools/fixup_stuff.sh | 15 +++++++++++++++
 tools/install_pip.sh |  9 +--------
 5 files changed, 20 insertions(+), 15 deletions(-)
 delete mode 100644 tools/cap-pip.txt

diff --git a/inc/python b/inc/python
index 8941fd038d..9382d352dc 100644
--- a/inc/python
+++ b/inc/python
@@ -378,12 +378,13 @@ function _setup_package_with_constraints_edit {
     project_dir=$(cd $project_dir && pwd)
 
     if [ -n "$REQUIREMENTS_DIR" ]; then
-        # Constrain this package to this project directory from here on out.
+        # Remove this package from constraints before we install it.
+        # That way, later installs won't "downgrade" the install from
+        # source we are about to do.
         local name
         name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
         $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
-            $REQUIREMENTS_DIR/upper-constraints.txt -- $name \
-            "$flags file://$project_dir#egg=$name"
+            $REQUIREMENTS_DIR/upper-constraints.txt -- $name
     fi
 
     setup_package $bindep $project_dir "$flags" $extras
diff --git a/lib/tempest b/lib/tempest
index 3fa7ce0fb2..a1c02ef183 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -718,9 +718,6 @@ function install_tempest {
     set_tempest_venv_constraints $tmp_u_c_m
 
     tox -r --notest -efull
-    # TODO: remove the trailing pip constraint when a proper fix
-    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
-    $TEMPEST_DIR/.tox/tempest/bin/pip install -U -r $RC_DIR/tools/cap-pip.txt
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
deleted file mode 100644
index 8ee551b261..0000000000
--- a/tools/cap-pip.txt
+++ /dev/null
@@ -1 +0,0 @@
-pip<20.3
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 19219435ad..8a2c337fc4 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -155,8 +155,23 @@ function fixup_ovn_centos {
     yum_install centos-release-openstack-victoria
 }
 
+function fixup_ubuntu {
+    if ! is_ubuntu; then
+        return
+    fi
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
+}
+
 function fixup_all {
     fixup_keystone
+    fixup_ubuntu
     fixup_fedora
     fixup_suse
 }
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 9afd2e53c2..0082e9f73c 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -91,9 +91,7 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    # TODO: remove the trailing pip constraint when a proper fix
-    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
-    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
+    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
 }
 
 
@@ -130,11 +128,6 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-# Just use system pkgs on Focal
-if [[ "$DISTRO" == focal ]]; then
-    exit 0
-fi
-
 # Eradicate any and all system packages
 
 # Python in fedora/suse depends on the python-pip package so removing it

From 2df2aa01584fb2a26112c60f0a16869e233cb7ee Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Aug 2021 13:50:08 +1000
Subject: [PATCH 2858/3333] install_pip: don't fail when not installed

On some platforms, "python -m pip" isn't available.  Currently this is
run undconditionally from the "get_versions" function; remove the call.

Change-Id: I91d6c66d055f02fa7b4368593b629933f82d8117
---
 tools/install_pip.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 0082e9f73c..eb0f6eba48 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -46,15 +46,13 @@ echo "Distro: $DISTRO"
 function get_versions {
     # FIXME(dhellmann): Deal with multiple python versions here? This
     # is just used for reporting, so maybe not?
-    PIP=$(which pip 2>/dev/null || which pip-python 2>/dev/null || true)
+    PIP=$(which pip 2>/dev/null || which pip-python 2>/dev/null || which pip3 2>/dev/null || true)
     if [[ -n $PIP ]]; then
         PIP_VERSION=$($PIP --version | awk '{ print $2}')
         echo "pip: $PIP_VERSION"
     else
         echo "pip: Not Installed"
     fi
-    # Show python3 module version
-    python${PYTHON3_VERSION} -m pip --version
 }
 
 

From 26bd94b45efb63683072006e4281dd34a313d881 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 10 Aug 2021 14:49:54 +0000
Subject: [PATCH 2859/3333] Revert "Add enforce_scope setting support for
 keystone"

This reverts commit 9dc2b88eb42a5f98f43bc8ad3dfa3962a4d44d74.

Reason for revert: Devstack creation/setup the things are not yet moved to scope tokens so we need to wait for that first and then do the scope check enable globally.

Change-Id: If0368aca39c1325bf90abd23831118b89e746222
---
 lib/keystone | 11 -----------
 lib/tempest  |  9 ---------
 2 files changed, 20 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index e282db0bfa..66e867ca68 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,12 +134,6 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
-# Flag to set the oslo_policy.enforce_scope. This is used to switch
-# the Identity API policies to start checking the scope of token. By Default,
-# this flag is False.
-# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
-
 # Functions
 # ---------
 
@@ -287,11 +281,6 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
-        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
-        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
-        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
-    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index 3fa7ce0fb2..d39fa1c52b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,15 +600,6 @@ function configure_tempest {
         fi
     done
 
-    # ``enforce_scope``
-    # If services enable the enforce_scope for their policy
-    # we need to enable the same on Tempest side so that
-    # test can be run with scoped token.
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
-        iniset $TEMPEST_CONFIG enforce_scope keystone true
-        iniset $TEMPEST_CONFIG auth admin_system 'all'
-        iniset $TEMPEST_CONFIG auth admin_project_name ''
-    fi
     iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"

From 00ac547acacc9fef86f9045a979adf523ab7617b Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 9 Aug 2021 05:54:32 +0000
Subject: [PATCH 2860/3333] Glance remote worker should use own cache directory

Earlier glance remote worker was using same cache directory used by
glance worker. Ideally both should use their own cache directory.

This patch makes provision for the same by setting different path
for image_cache_dir config option.

Change-Id: If2627e9c212fd765b96d925046c04e9cb1001c3d
---
 lib/glance | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/glance b/lib/glance
index cd26d97dc4..6848aa3c1b 100644
--- a/lib/glance
+++ b/lib/glance
@@ -552,6 +552,11 @@ function start_glance_remote_clone {
     iniset $(glance_remote_conf "$GLANCE_API_CONF") os_glance_tasks_store \
            filesystem_store_datadir "${remote_data}/os_glance_tasks_store"
 
+    # Point this worker to use different cache dir
+    mkdir -p "$remote_data/cache"
+    iniset $(glance_remote_conf "$GLANCE_API_CONF") DEFAULT \
+           image_cache_dir "${remote_data}/cache"
+
     # Change our uwsgi to our new port
     sed -ri "s/^(http-socket.*):[0-9]+/\1:$glance_remote_port/" \
         "$glance_remote_uwsgi"

From a20971850afb555ee4b04068a39a67a533b69901 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Aug 2021 14:11:12 +1000
Subject: [PATCH 2861/3333] install_pip: Use packaged pip on Fedora

This uses the python3-pip package for Fedora but maintains the status
quo for existing distributions (i.e. for Suse we run get-pip.py but
don't uninstall, and for everything else we uninstall python3-pip and
run get-pip.py to be running the latest pip).

As noted inline, installing get-pip.py over Fedora 34's package no
longer works, and likely won't ever work again.  Unlike the LTS
distributions, the Fedora pip should be more up-to-date, so I think
it's best we just avoid any package overwrites.

Change-Id: I84129aadfcf585bb150a3daa39616246d3d84bbd
---
 tools/install_pip.sh | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index eb0f6eba48..7ecea4e821 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -126,19 +126,31 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-# Eradicate any and all system packages
-
-# Python in fedora/suse depends on the python-pip package so removing it
-# results in a nonfunctional system. pip on fedora installs to /usr so pip
-# can safely override the system pip for all versions of fedora
-if ! is_fedora  && ! is_suse; then
+if is_fedora && [[ ${DISTRO} == f* ]]; then
+    # get-pip.py will not install over the python3-pip package in
+    # Fedora 34 any more.
+    #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935
+    #  https://github.com/pypa/pip/issues/9904
+    # You can still install using get-pip.py if python3-pip is *not*
+    # installed; this *should* remain separate under /usr/local and not break
+    # if python3-pip is later installed.
+    # For general sanity, we just use the packaged pip.  It should be
+    # recent enough anyway.
+    install_package python3-pip
+elif is_fedora || is_suse; then
+    # Python in suse/centos depends on the python-pip package; because
+    # of the split "system-python" uninstalling python3-pip also
+    # uninstalls the user python3 package which is bad and leaves us
+    # without a python to use.  Just install over.
+    install_get_pip
+else
+    # Remove packaged pip, and install the latest upstream.
     if is_package_installed python3-pip ; then
         uninstall_package python3-pip
     fi
+    install_get_pip
 fi
 
-install_get_pip
-
 set -x
 
 # Note setuptools is part of requirements.txt and we want to make sure

From 156ccbad85f30cd4c9c33d30b612b3151d542f8e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Aug 2021 14:19:28 +1000
Subject: [PATCH 2862/3333] Add Fedora 34 support

* update the support distro filter

* don't install xinetd which doesn't exist in F34 any more.  I think
  there is probably a bit more to do with swift ring-server but that
  can be a problem for another time.

* remove old F31 workaround

Change-Id:If2f74f146a166b9721540aaf3f1f9fce3030525c
---
 files/rpms/swift | 2 +-
 lib/nova         | 6 ------
 stack.sh         | 2 +-
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/files/rpms/swift b/files/rpms/swift
index 376c6f3df7..18c957c08a 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd
+xinetd # not:f34
diff --git a/lib/nova b/lib/nova
index 930529a433..de91517add 100644
--- a/lib/nova
+++ b/lib/nova
@@ -298,12 +298,6 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f31] ]]; then
-            # For f31 use the rebased 2.1.0 version of the package.
-            sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
-            sudo dnf update -y
-        fi
-
         if [[ ${ISCSID_DEBUG} == "True" ]]; then
             # Install an override that starts iscsid with debugging
             # enabled.
diff --git a/stack.sh b/stack.sh
index c439a7217f..47d6dc718a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 8dac135cb89fa5d27d7af344703db0a20cf550e1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 11 Aug 2021 14:56:05 +1000
Subject: [PATCH 2863/3333] Simplify pip install

The uninstall here has been around since
Ibb4b42119dc2e51577c77bbbbffb110863e5324d.  At the time, there might
have been conflicts between packaged and installed pip.  We don't need
it today; get-pip.py keeps itself separate enough in /usr/local on all
platforms.  Thus we can also remove the suse/centos special-casing.

python3-pip is in the RPM list so we don't need to
re-install for Fedora.

Add a note on why we are over-installing pip.

Remove some old setuptools workarounds that are commented out.

Change-Id: Ie3cb81a8ff71cf4b81e23831c380f83b0381de71
---
 stack.sh             | 14 +++++++++++++-
 tools/install_pip.sh | 22 ++--------------------
 2 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/stack.sh b/stack.sh
index 47d6dc718a..1aa96c9d49 100755
--- a/stack.sh
+++ b/stack.sh
@@ -752,7 +752,19 @@ git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
 echo_summary "Installing package prerequisites"
 source $TOP_DIR/tools/install_prereqs.sh
 
-# Configure an appropriate Python environment
+# Configure an appropriate Python environment.
+#
+# NOTE(ianw) 2021-08-11 : We install the latest pip here because pip
+# is very active and changes are not generally reflected in the LTS
+# distros.  This often involves important things like dependency or
+# conflict resolution, and has often been required because the
+# complicated constraints etc. used by openstack have tickled bugs in
+# distro versions of pip.  We want to find these problems as they
+# happen, rather than years later when we try to update our LTS
+# distro.  Whilst it is clear that global installations of upstream
+# pip are less and less common, with virtualenv's being the general
+# approach now; there are a lot of devstack plugins that assume a
+# global install environment.
 if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 7ecea4e821..a80c178f2a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -111,14 +111,6 @@ function configure_pypi_alternative_url {
 
 }
 
-# Setuptools 8 implements PEP 440, and 8.0.4 adds a warning triggered any time
-# pkg_resources inspects the list of installed Python packages if there are
-# non-compliant version numbers in the egg-info (for example, from distro
-# system packaged Python libraries). This is off by default after 8.2 but can
-# be enabled by uncommenting the lines below.
-#PYTHONWARNINGS=$PYTHONWARNINGS,always::RuntimeWarning:pkg_resources
-#export PYTHONWARNINGS
-
 # Show starting versions
 get_versions
 
@@ -135,19 +127,9 @@ if is_fedora && [[ ${DISTRO} == f* ]]; then
     # installed; this *should* remain separate under /usr/local and not break
     # if python3-pip is later installed.
     # For general sanity, we just use the packaged pip.  It should be
-    # recent enough anyway.
-    install_package python3-pip
-elif is_fedora || is_suse; then
-    # Python in suse/centos depends on the python-pip package; because
-    # of the split "system-python" uninstalling python3-pip also
-    # uninstalls the user python3 package which is bad and leaves us
-    # without a python to use.  Just install over.
-    install_get_pip
+    # recent enough anyway.  This is included via rpms/general
+    continue
 else
-    # Remove packaged pip, and install the latest upstream.
-    if is_package_installed python3-pip ; then
-        uninstall_package python3-pip
-    fi
     install_get_pip
 fi
 

From 6fecfd4fff79620596db45c9d22f8ec63a0d5522 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 11 Aug 2021 10:32:42 -0500
Subject: [PATCH 2864/3333] Add devstack-enforce-scope job to enable the rbac
 scope checks

keystone has system scope feature implemented since
queens release. Now Devstack also started moving towards the new RBAC.

This commit adds a new job 'devstack-enforce-scope' which enable the
scope checks on service side and see if devstack setting are fine or not.

This job will be expanded to enable the scope checks for the other service
also once they start supporting the system scope.

This will help us to test the scope check setting.

Change-Id: Ie9cd9c7e7cd8fdf8c8930e59ae9d297f86eb9a95
---
 .zuul.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c275d84dc..517e12bc1c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -580,6 +580,17 @@
         SERVICE_IP_VERSION: 6
         SERVICE_HOST: ""
 
+- job:
+    name: devstack-enforce-scope
+    parent: devstack
+    description: |
+      This job runs the devstack with scope checks enabled.
+    vars:
+      devstack_localrc:
+        # Keep enabeling the services here to run with system scope
+        CINDER_ENFORCE_SCOPE: true
+        GLANCE_ENFORCE_SCOPE: true
+
 - job:
     name: devstack-multinode
     parent: devstack
@@ -711,6 +722,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
         - devstack-async
@@ -765,6 +777,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate

From 60b5538c337dfa3c8f60fecdc64e671acd1f1cbe Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 6 Aug 2021 12:49:33 +0530
Subject: [PATCH 2865/3333] Set swap size to 4G for c8 jobs

Tempest is failing randomly with different reasons
as mentioned in the bug, updating swap size those
issues are not seen.

Before [1] default swap size used to be 8GB but was dropped
to 1G so need to configure it in required job itself.

Did couple of tests in [2] and with 4GB+ swap jobs are
running green. On investigation found that with qemu-5
both Ubuntu and CentOS jobs have memory crunch, currently
Ubuntu jobs are not impacted as they are running with
qemu-4.

[1] https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/750941
[2] https://review.opendev.org/c/openstack/devstack/+/803144

Closes-Bug: #1938914
Change-Id: I57910b5fde5ddf2bd37d93e06c1aff77c6e231e9
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c275d84dc..1295fed457 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -599,6 +599,8 @@
     nodeset: devstack-single-node-centos-8-stream
     voting: false
     timeout: 9000
+    vars:
+      configure_swap_size: 4096
 
 - job:
     name: devstack-async

From 26f814921898390eb263f1060fb99cddae1accdc Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Mon, 16 Aug 2021 10:36:03 +0200
Subject: [PATCH 2866/3333] Use MDB backend in Ubuntu

The MDB backend is the default in Ubuntu and specifying
HDB in debconf doesn't change it to HDB.

Closes-Bug: #1939700
Change-Id: If98f7fc8395678365fb73f0c5cd926cef083e470
---
 files/ldap/manager.ldif.in | 2 +-
 lib/ldap                   | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/files/ldap/manager.ldif.in b/files/ldap/manager.ldif.in
index 2f1f1395ee..d3b9be8b6e 100644
--- a/files/ldap/manager.ldif.in
+++ b/files/ldap/manager.ldif.in
@@ -1,4 +1,4 @@
-dn: olcDatabase={${LDAP_OLCDB_NUMBER}}hdb,cn=config
+dn: olcDatabase={${LDAP_OLCDB_NUMBER}}${LDAP_OLCDB_TYPE},cn=config
 changetype: modify
 replace: olcSuffix
 olcSuffix: ${BASE_DN}
diff --git a/lib/ldap b/lib/ldap
index 5a53d0eaee..ea5faa1fe9 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -33,14 +33,17 @@ LDAP_SERVICE_NAME=slapd
 
 if is_ubuntu; then
     LDAP_OLCDB_NUMBER=1
+    LDAP_OLCDB_TYPE=mdb
     LDAP_ROOTPW_COMMAND=replace
 elif is_fedora; then
     LDAP_OLCDB_NUMBER=2
+    LDAP_OLCDB_TYPE=hdb
     LDAP_ROOTPW_COMMAND=add
 elif is_suse; then
     # SUSE has slappasswd in /usr/sbin/
     PATH=$PATH:/usr/sbin/
     LDAP_OLCDB_NUMBER=1
+    LDAP_OLCDB_TYPE=hdb
     LDAP_ROOTPW_COMMAND=add
     LDAP_SERVICE_NAME=ldap
 fi
@@ -56,6 +59,7 @@ function _ldap_varsubst {
     local slappass=$2
     sed -e "
         s|\${LDAP_OLCDB_NUMBER}|$LDAP_OLCDB_NUMBER|
+        s|\${LDAP_OLCDB_TYPE}|$LDAP_OLCDB_TYPE|
         s|\${SLAPPASS}|$slappass|
         s|\${LDAP_ROOTPW_COMMAND}|$LDAP_ROOTPW_COMMAND|
         s|\${BASE_DC}|$LDAP_BASE_DC|
@@ -157,7 +161,7 @@ function configure_ldap {
     slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
     slapd slapd/domain string Users
     slapd shared/organization string $LDAP_DOMAIN
-    slapd slapd/backend string HDB
+    slapd slapd/backend string ${LDAP_OLCDB_TYPE^^}
     slapd slapd/purge_database boolean true
     slapd slapd/move_old_database boolean true
     slapd slapd/allow_ldap_v2 boolean false

From ed323805f26e51438fd08d6d51882d758551924c Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 17 Aug 2021 08:45:02 -0500
Subject: [PATCH 2867/3333] make swift-dsvm-functional job as voting

swift-dsvm-functional job test swift under python3 and
voting on swift gate whihc means this is a stable job now,
let's make this voting to devstack gate too.

Removing swift-dsvm-functional-py3 job as it does not exist anymore
after- https://review.opendev.org/c/openstack/swift/+/731318

swift-dsvm-functional itself is py3 job now.

Change-Id: I58847f74306194eaad132680815101a134fb4022
---
 .zuul.yaml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 517e12bc1c..772cc7b2d7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -731,14 +731,7 @@
         - openstack-tox-bashate
         - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
             voting: false
-        - swift-dsvm-functional:
-            voting: false
-            irrelevant-files: &dsvm-irrelevant-files
-              - ^.*\.rst$
-              - ^doc/.*$
-        - swift-dsvm-functional-py3:
-            voting: false
-            irrelevant-files: *dsvm-irrelevant-files
+        - swift-dsvm-functional
         - grenade:
             irrelevant-files:
               - ^.*\.rst$
@@ -789,6 +782,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - swift-dsvm-functional
         - grenade:
             irrelevant-files:
               - ^.*\.rst$

From 31f0418bad5a9542a38e8200131adf4ace08e01a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 17 Aug 2021 08:49:28 -0500
Subject: [PATCH 2868/3333] Make Ironic job as voting

ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa
job is voting on Ironic and neutron gate which mean it is
stable enough and make sense to make it voting on devstack gate too.

ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa is alias
job of ironic-tempest-bios-ipmi-direct-tinyipa so using the original
job instead of alias
- https://opendev.org/openstack/ironic/src/branch/master/zuul.d/ironic-jobs.yaml#L784

Change-Id: I95c67ad69e6eae6a72d25a851a71b7de85e56fd2
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 772cc7b2d7..f98107cb3f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -729,8 +729,7 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
-            voting: false
+        - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
             irrelevant-files:
@@ -782,6 +781,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
             irrelevant-files:

From 8b8a4c75b72eb44dd5c11950951cf6e6d9a1d778 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 18 Aug 2021 15:00:09 +0000
Subject: [PATCH 2869/3333] Remove libvirt-python from upper-constraints

... when installed from distribution.

This is mostly to fix Ironic's gate as their ecosystem is too
broad and complex to quickly remove libvirt-python from all
possible requirements.txt

More details inline.

See also: https://review.opendev.org/c/openstack/devstack/+/798514
aka f0bf2bdff12b66eefbb2eae83e919611eb7cc76d

Change-Id: Ic44daf15e952bbe3c424984ffb2474261e68008f
---
 lib/nova_plugins/functions-libvirt | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index e9ceae4dea..63882e05fe 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -56,6 +56,17 @@ EOF
 
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
+    # NOTE(yoctozepto): The common consensus [1] is that libvirt-python should
+    # be installed from distro packages. However, various projects might be
+    # trying to ensure it is installed using pip AND use upper-constraints
+    # with that, causing pip to try to upgrade it and to fail.
+    # The following line removes libvirt-python from upper-constraints and
+    # avoids the situation described above. Now only if installed packages
+    # explicitly depend on a newer (or, in general, incompatible) libvirt-python
+    # version, will pip try to reinstall it.
+    # [1] https://review.opendev.org/c/openstack/devstack/+/798514
+    $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
+            $REQUIREMENTS_DIR/upper-constraints.txt -- libvirt-python
 
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt

From 1e86a25cc28e34d7f73a4c6ccbbc3fc667598d50 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 19 Aug 2021 14:24:28 +0100
Subject: [PATCH 2870/3333] nova: Enable apic removal workaround for bug
 #1939108 when using QEMU

This change enables [workarounds]libvirt_disable_apic when devstack is
deployed using the libvirt virt driver and qemu virt type in an effort
to avoid issues outlined in bug #1939108 caused by the older kernel
currently used in Cirros 0.5.2.

Depends-On: https://review.opendev.org/c/openstack/nova/+/766043
Closes-Bug: #1939108
Change-Id: Ibb6c34133bb1c95ef11cc59d9b12a0f65502c61b
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index de91517add..f4f4797b86 100644
--- a/lib/nova
+++ b/lib/nova
@@ -926,6 +926,11 @@ function start_nova_compute {
         iniset $NOVA_CPU_CONF os_vif_ovs ovsdb_connection "tcp:$OVSDB_SERVER_LOCAL_HOST:6640"
     fi
 
+    # Workaround bug #1939108
+    if [[ "$VIRT_DRIVER" == "libvirt" && "$LIBVIRT_TYPE" == "qemu" ]]; then
+        iniset $NOVA_CPU_CONF workarounds libvirt_disable_apic True
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From 14b7fc500367a24ed995d6598738c6f42dfe49ad Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 20 Aug 2021 06:13:36 +0000
Subject: [PATCH 2871/3333] Updated from generate-devstack-plugins-list

Change-Id: I924cdf727818b33d71fe71ac110f224164c6b453
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 490132e0d7..4364dd9c72 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -46,7 +46,6 @@ openstack/freezer                        `https://opendev.org/openstack/freezer
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
-openstack/glance                         `https://opendev.org/openstack/glance <https://opendev.org/openstack/glance>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__

From 25f84277eab5291aa0fa8c12ac39a69594611e08 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Sat, 21 Aug 2021 21:38:43 +0900
Subject: [PATCH 2872/3333] swift: Fix the empty gid option in rsyncd.conf

This change fixes the empty value set to the gid option in rsyncd.conf,
which was caused by reference to the invalid USER_GROUP variable, and
ensures the option is set to the group which STACK_USER belongs to.

This also fixes duplicate declaration of the local user_group variable.

Closes-Bug: #1940742
Change-Id: Ifd0a5ef0bc5f3647f43b169df1f7176393971853
---
 lib/swift | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index 790fb99442..98852415da 100644
--- a/lib/swift
+++ b/lib/swift
@@ -335,7 +335,6 @@ function configure_swift {
     local node_number
     local swift_node_config
     local swift_log_dir
-    local user_group
 
     # Make sure to kill all swift processes first
     $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
@@ -353,7 +352,7 @@ function configure_swift {
     # partitions (which make more sense when you have a multi-node
     # setup) we configure it with our version of rsync.
     sed -e "
-        s/%GROUP%/${USER_GROUP}/;
+        s/%GROUP%/$(id -g -n ${STACK_USER})/;
         s/%USER%/${STACK_USER}/;
         s,%SWIFT_DATA_DIR%,$SWIFT_DATA_DIR,;
     " $FILES/swift/rsyncd.conf | sudo tee /etc/rsyncd.conf

From b1a89eb80be83fe8c47eeb0431d85a8452e3c70b Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 26 Aug 2021 21:42:32 +0200
Subject: [PATCH 2873/3333] Configure access to physical network also with
 ML2/OVN backend

Neutron L3 module in Devstack has way to conigure access to physical
network on the node. It can put physical interface to the physical
bridge or, in case when such physical device isn't set, it creates
NAT rule in iptables.

There was missing the same operation for ML2/OVN backend as L3 agent is
not used there at all.

This patch adds the same to be done in both L3 agent and ovn_agent
modules.

Closes-Bug: #1939627
Change-Id: I9e558d1d5d3edbce9e7a025ba3c11267f1579820
---
 lib/neutron-legacy              | 21 +++++++++++++++++++++
 lib/neutron_plugins/ovn_agent   |  1 +
 lib/neutron_plugins/services/l3 | 16 +---------------
 3 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 791ff18b10..31968498de 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -663,6 +663,27 @@ function _move_neutron_addresses_route {
     fi
 }
 
+# _configure_public_network_connectivity() - Configures connectivity to the
+# external network using $PUBLIC_INTERFACE or NAT on the single interface
+# machines
+function _configure_public_network_connectivity {
+    # If we've given a PUBLIC_INTERFACE to take over, then we assume
+    # that we can own the whole thing, and privot it into the OVS
+    # bridge. If we are not, we're probably on a single interface
+    # machine, and we just setup NAT so that fixed guests can get out.
+    if [[ -n "$PUBLIC_INTERFACE" ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
+
+        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+        fi
+    else
+        for d in $default_v4_route_devs; do
+            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
+        done
+    fi
+}
+
 # cleanup_mutnauq() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_mutnauq {
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index cfcb01ee91..1f737fb58b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -266,6 +266,7 @@ function create_public_bridge {
     # Create the public bridge that OVN will use
     sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE protocols=OpenFlow13,OpenFlow15
     sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$PUBLIC_BRIDGE
+    _configure_public_network_connectivity
 }
 
 function _disable_libvirt_apparmor {
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index b6bc02818c..98b96ac06c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -123,21 +123,7 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent $Q_L3_CONF_FILE
 
-    # If we've given a PUBLIC_INTERFACE to take over, then we assume
-    # that we can own the whole thing, and privot it into the OVS
-    # bridge. If we are not, we're probably on a single interface
-    # machine, and we just setup NAT so that fixed guests can get out.
-    if [[ -n "$PUBLIC_INTERFACE" ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
-        fi
-    else
-        for d in $default_v4_route_devs; do
-            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
-        done
-    fi
+    _configure_public_network_connectivity
 }
 
 # Explicitly set router id in l3 agent configuration

From a38d41ed9222c32eb7058f91b004b2ec16cd19e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 8 Sep 2021 07:51:47 +0000
Subject: [PATCH 2874/3333] Drop dep on libmysqlclient-dev

It was required to build MySQL-python bindings but, for some time,
we test and rely solely on PyMySQL which is pure Python and hence
does not require this dep.

This package is going away as distros move towards MariaDB.

Change-Id: I6004ccf28a23009a0fc07bfc9458b59a927b969a
---
 files/debs/general        | 1 -
 files/debs/neutron-common | 1 -
 files/debs/nova           | 1 -
 3 files changed, 3 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 7e481b4072..364f3cc6e2 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -14,7 +14,6 @@ iputils-ping
 libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
-libmysqlclient-dev  # MySQL-python
 libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
diff --git a/files/debs/neutron-common b/files/debs/neutron-common
index e548396cd7..f6afc5bf55 100644
--- a/files/debs/neutron-common
+++ b/files/debs/neutron-common
@@ -6,7 +6,6 @@ haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils-arping
 iputils-ping
-libmysqlclient-dev
 mysql-server #NOPRIME
 postgresql-server-dev-all
 python3-mysqldb
diff --git a/files/debs/nova b/files/debs/nova
index e19441453b..0194f00f2c 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,7 +8,6 @@ iptables
 iputils-arping
 kpartx
 libjs-jquery-tablesorter # Needed for coverage html reports
-libmysqlclient-dev
 libvirt-clients # NOPRIME
 libvirt-daemon-system # NOPRIME
 libvirt-dev # NOPRIME

From 6c8bd96f72eb913be5b1de5758b15f828fca5912 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 9 Sep 2021 06:10:23 +0000
Subject: [PATCH 2875/3333] Updated from generate-devstack-plugins-list

Change-Id: If2ea45a2cc7993a9a80187092f2750496e7c8ab7
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4364dd9c72..7c8d2b8aac 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -112,6 +112,7 @@ openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui
 openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
 openstack/zun-ui                         `https://opendev.org/openstack/zun-ui <https://opendev.org/openstack/zun-ui>`__
 performa/os-faults                       `https://opendev.org/performa/os-faults <https://opendev.org/performa/os-faults>`__
+skyline/skyline-apiserver                `https://opendev.org/skyline/skyline-apiserver <https://opendev.org/skyline/skyline-apiserver>`__
 starlingx/config                         `https://opendev.org/starlingx/config <https://opendev.org/starlingx/config>`__
 starlingx/fault                          `https://opendev.org/starlingx/fault <https://opendev.org/starlingx/fault>`__
 starlingx/ha                             `https://opendev.org/starlingx/ha <https://opendev.org/starlingx/ha>`__

From c9f3e5bdd76430a7c14b9f02c3f8ba47214037ae Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Thu, 16 Sep 2021 11:43:03 -0400
Subject: [PATCH 2876/3333] Fix stackrc os-resource-classes typo

Attempting to use LIBS_FROM_GIT="ALL" results in a failure
due to a typo in stackrc for os-resource-classes repo.

  Cloning into '/opt/stack/os-resource-classes'...
  fatal: protocol ':-https' is not supported
  <snip>
  [ERROR] /opt/stack/devstack/functions-common:629 git call failed: [git clone :-https://opendev.org/openstack/os-resource-classes.git /opt/stack/os-resource-classes --branch master]

Remove the extraneous '='.

Change-Id: I21f86324dc15fe808b38e366f7af18c96fd3890c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 620b1fc04d..16aa93ac94 100755
--- a/stackrc
+++ b/stackrc
@@ -549,7 +549,7 @@ GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
 # os-resource-classes library containing a list of standardized resource classes for OpenStack
-GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO=:-${GIT_BASE}/openstack/os-resource-classes.git}
+GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO:-${GIT_BASE}/openstack/os-resource-classes.git}
 GITBRANCH["os-resource-classes"]=${OS_RESOURCE_CLASSES_BRANCH:-$TARGET_BRANCH}
 
 # os-traits library for resource provider traits in the placement service

From 8d1bfcacf8ffc73f0aa8c8a8a9e0fee447a1c116 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 24 Sep 2021 18:01:09 -0500
Subject: [PATCH 2877/3333] Update DEVSTACK_SERIES to yoga

stable/xena branch has been created now and
current master is for yoga.

Change-Id: I0c7809bdac6482bb947f394b0c2535fabb4cf067
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 16aa93ac94..3dc800af2d 100755
--- a/stackrc
+++ b/stackrc
@@ -247,7 +247,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="xena"
+DEVSTACK_SERIES="yoga"
 
 ##############
 #

From 65b46a503a720f2438a6dc73c6f4670cdf89442f Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 28 Sep 2021 03:08:10 -0400
Subject: [PATCH 2878/3333] Remove cinder from service names

In devstack job, cinder is not a valid service name and logs error
in gate[1] so remove it.

2021-09-28 05:44:47.791807 | controller | + functions-common:service_check:1603      :   for service in ${ENABLED_SERVICES//,/ }
2021-09-28 05:44:47.795506 | controller | + functions-common:service_check:1605      :   sudo systemctl is-enabled devstack@cinder.service
2021-09-28 05:44:47.809647 | controller | Failed to get unit file state for devstack@cinder.service: No such file or directory

[1] https://e978bdcfc0235dcd9417-6560bc3b6382c1d289b358872777ca09.ssl.cf1.rackcdn.com/801989/7/check/tempest-integrated-storage/779d1e7/job-output.txt

Change-Id: I7ca105201d82b72c7e56778425d3bce7c76047db
---
 .zuul.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index d1e356f4ea..25cbf923f8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -524,7 +524,6 @@
         c-bak: true
         c-sch: true
         c-vol: true
-        cinder: true
         # Services we don't need.
         # This section is not really needed, it's for readability.
         horizon: false

From 56e75e4aef3ea42d13b192e805c48357b0071239 Mon Sep 17 00:00:00 2001
From: Jens Harbott <frickler@offenerstapel.de>
Date: Tue, 28 Sep 2021 20:02:34 +0200
Subject: [PATCH 2879/3333] Fix uwsgi config for trailing slashes

The apache mod_proxy documentation[0] says that trailing slashes need to
match for the ProxyPass statement. Since adding a slash to the redirected
url would break things that need to access endpoints like /identity
without anything added, we need to drop the trailing slash for the
target URL. See [1] for the discussion of the CVE fix that changed the
previous behavior.

[0] https://httpd.apache.org/docs/trunk/mod/mod_proxy.html#proxypass
[1] https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1945274

Depends-On: https://review.opendev.org/c/openstack/devstack/+/811389
Change-Id: Ia6b1a41957833fba87a2e6f048d2483267632385
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 04259ba31f..4bea07dc55 100644
--- a/lib/apache
+++ b/lib/apache
@@ -303,7 +303,7 @@ function write_uwsgi_config {
         apache_conf=$(apache_site_config_for $name)
         iniset "$file" uwsgi socket "$socket"
         iniset "$file" uwsgi chmod-socket 666
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi

From 982b03c605bc06e0bf9a03ff576995816155c64e Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 30 Sep 2021 13:08:35 +0100
Subject: [PATCH 2880/3333] zuul: Remove dedicated devstack-async job

I83d56c9363d481bb6d5921f5e1f9b024f136044b switched the default of
DEVSTACK_PARALLEL over to True so this dedicated job is no longer
required as *all* jobs should now be using it.

Change-Id: I0f475ab177c2cd49eeb6be861cdd11581e8e0b97
---
 .zuul.yaml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index d1e356f4ea..ab2f80ae1b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -613,17 +613,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-async
-    parent: tempest-full-py3
-    description: Async mode enabled
-    voting: false
-    vars:
-      devstack_localrc:
-        DEVSTACK_PARALLEL: True
-      zuul_copy_output:
-        /opt/stack/async: logs
-
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -727,7 +716,6 @@
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
-        - devstack-async
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate

From c7791301be5e19ec7a84dffbf62c40e805483f43 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Fri, 1 Oct 2021 17:24:10 +0000
Subject: [PATCH 2881/3333] Enable oslo.limit to be installed from git repo

oslo.limit isn't currently in the list of libraries that can be
installed from a git repo via LIBS_FROM_GIT.

This adds oslo.limit to enable integrated testing against unmerged
oslo.limit changes.

Change-Id: I26cc567fdf4c84014040ae586bbb029b8de7a236
---
 lib/libraries                | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 3 files changed, 7 insertions(+)

diff --git a/lib/libraries b/lib/libraries
index 67ff21f41a..9ea32304fc 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -38,6 +38,7 @@ GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.context"]=$DEST/oslo.context
 GITDIR["oslo.db"]=$DEST/oslo.db
 GITDIR["oslo.i18n"]=$DEST/oslo.i18n
+GITDIR["oslo.limit"]=$DEST/oslo.limit
 GITDIR["oslo.log"]=$DEST/oslo.log
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
 GITDIR["oslo.middleware"]=$DEST/oslo.middleware
@@ -102,6 +103,7 @@ function install_libs {
     _install_lib_from_source "oslo.context"
     _install_lib_from_source "oslo.db"
     _install_lib_from_source "oslo.i18n"
+    _install_lib_from_source "oslo.limit"
     _install_lib_from_source "oslo.log"
     _install_lib_from_source "oslo.messaging"
     _install_lib_from_source "oslo.middleware"
diff --git a/stackrc b/stackrc
index 3dc800af2d..e0d71dfa49 100755
--- a/stackrc
+++ b/stackrc
@@ -415,6 +415,10 @@ GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-$TARGET_BRANCH}
 GITREPO["oslo.i18n"]=${OSLOI18N_REPO:-${GIT_BASE}/openstack/oslo.i18n.git}
 GITBRANCH["oslo.i18n"]=${OSLOI18N_BRANCH:-$TARGET_BRANCH}
 
+# oslo.limit
+GITREPO["oslo.limit"]=${OSLOLIMIT_REPO:-${GIT_BASE}/openstack/oslo.limit.git}
+GITBRANCH["oslo.limit"]=${OSLOLIMIT_BRANCH:-$TARGET_BRANCH}
+
 # oslo.log
 GITREPO["oslo.log"]=${OSLOLOG_REPO:-${GIT_BASE}/openstack/oslo.log.git}
 GITBRANCH["oslo.log"]=${OSLOLOG_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index ce1b34461c..839e3a1328 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -45,6 +45,7 @@ ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
+ALL_LIBS+=" oslo.limit"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 959a7c262a65296a404252f8ec2014237196710d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sun, 2 May 2021 09:29:15 +0200
Subject: [PATCH 2882/3333] Enable running on Debian Bullseye
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some adaption in database handling is all that is missing. Also add a
platform job that tests this.

Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Change-Id: I6dd3e48444dd415d84df5e7f5c74540847cdd6db
---
 .zuul.yaml          | 54 +++++++++++++++++++++++++++++++++++++++++++++
 lib/databases/mysql |  4 +++-
 stack.sh            |  2 +-
 3 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index ab2f80ae1b..721897e9e5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -86,6 +86,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-debian-bullseye
+    nodes:
+      - name: controller
+        label: debian-bullseye
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -613,6 +623,49 @@
     vars:
       configure_swap_size: 4096
 
+- job:
+    name: devstack-platform-debian-bullseye
+    parent: tempest-full-py3
+    description: Debian Bullseye platform test
+    nodeset: devstack-single-node-debian-bullseye
+    voting: false
+    timeout: 9000
+    vars:
+      # NOTE(yoctozepto): With concurrency equal 2, there is a random event
+      # that this job will run out of memory at some point.
+      tempest_concurrency: 1
+      # NOTE(yoctozepto): Debian Bullseye does not yet offer OVN. Switch to OVS
+      # for the time being.
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        Q_ML2_TENANT_NETWORK_TYPE: vxlan
+      devstack_services:
+        # Disable OVN services
+        ovn-northd: false
+        ovn-controller: false
+        ovs-vswitchd: false
+        ovsdb-server: false
+        # Disable Neutron ML2/OVN services
+        q-ovn-metadata-agent: false
+        # Enable Neutron ML2/OVS services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Disable OVN services
+          ovn-controller: false
+          ovs-vswitchd: false
+          ovsdb-server: false
+          # Disable Neutron ML2/OVN services
+          q-ovn-metadata-agent: false
+          # Enable Neutron ML2/OVS services
+          q-agt: true
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -716,6 +769,7 @@
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
+        - devstack-platform-debian-bullseye
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/lib/databases/mysql b/lib/databases/mysql
index d4969d713c..d0fa1199a7 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -25,6 +25,8 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
         # provide a mysql.service symlink for backwards-compatibility, but
         # let's not rely on that.
         MYSQL_SERVICE_NAME=mariadb
+    elif [[ "$DISTRO" == "bullseye" ]]; then
+        MYSQL_SERVICE_NAME=mariadb
     fi
 fi
 
@@ -105,7 +107,7 @@ function configure_database_mysql {
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
-    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+    if is_ubuntu && [[ "$DISTRO" != "bullseye" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
         sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
     fi
diff --git a/stack.sh b/stack.sh
index 48f61fb3af..8a8e3ea6be 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 714826d1a27085ba2384ca495c876588d77f0d27 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 4 Oct 2021 18:07:17 +0100
Subject: [PATCH 2883/3333] nova: Ensure each compute uses a unique iSCSI
 initiator

The current initiator name embedded in our CI images is not unique at
present and can often cause failures during live migrations with
attached volumes. This change ensures the name is unique by running
iscsi-iname again and overwriting the existing name.

We could potentially do this during the image build process itself but
given that devstack systems are not supposed to be multi-purpose this
should be safe to do during the devstack run.

Closes-Bug: #1945983
Change-Id: I9ed26a17858df96c04be9ae52bf2e33e023869a5
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index f4f4797b86..bbb1039199 100644
--- a/lib/nova
+++ b/lib/nova
@@ -298,6 +298,9 @@ function configure_nova {
             fi
         fi
 
+        # Ensure each compute host uses a unique iSCSI initiator
+        echo InitiatorName=$(iscsi-iname) | sudo tee /etc/iscsi/initiatorname.iscsi
+
         if [[ ${ISCSID_DEBUG} == "True" ]]; then
             # Install an override that starts iscsid with debugging
             # enabled.

From bfc79dc98bfe68e22d3a58099bf550eda1a90a67 Mon Sep 17 00:00:00 2001
From: Michal Berger <michallinuxstuff@gmail.com>
Date: Tue, 5 Oct 2021 15:40:20 +0200
Subject: [PATCH 2884/3333] tools: Fix use of continue

continue is not used in a proper context here (outside of loop). Use
null cmd instead to simply fall through the pip installation.

Signed-off-by: Michal Berger <michallinuxstuff@gmail.com>
Change-Id: Iaea2e5c0177b475edf19d08d71933a74debbb5d9
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index a80c178f2a..c72dc89a55 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -128,7 +128,7 @@ if is_fedora && [[ ${DISTRO} == f* ]]; then
     # if python3-pip is later installed.
     # For general sanity, we just use the packaged pip.  It should be
     # recent enough anyway.  This is included via rpms/general
-    continue
+    : # Simply fall through
 else
     install_get_pip
 fi

From f758b60a4b70261393242b932063d2b6d705594c Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 6 Oct 2021 12:02:22 +0200
Subject: [PATCH 2885/3333] Rehome functions to enable Neutron's Trunk service
 plugin

Those functions were part of the neutron devstack plugin but we
discussed on the neutron team meeting [1] to move it to the Devstack
repo as it's mature enough now.

[1] https://meetings.opendev.org/meetings/networking/2021/networking.2021-10-05-14.00.log.html#l-156

Change-Id: I35446adad1d8a7fed142d834de20c48b611015a5
---
 lib/neutron-legacy                 | 9 +++++++++
 lib/neutron_plugins/services/trunk | 5 +++++
 2 files changed, 14 insertions(+)
 create mode 100644 lib/neutron_plugins/services/trunk

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 31968498de..7b20a96ed7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -275,6 +275,10 @@ source $TOP_DIR/lib/neutron_plugins/services/metering
 
 # L3 Service functions
 source $TOP_DIR/lib/neutron_plugins/services/l3
+
+# Additional Neutron service plugins
+source $TOP_DIR/lib/neutron_plugins/services/trunk
+
 # Use security group or not
 if has_neutron_plugin_security_group; then
     Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
@@ -369,6 +373,11 @@ function configure_mutnauq {
         configure_ovn_plugin
     fi
 
+    # Configure Neutron's advanced services
+    if is_service_enabled q-trunk neutron-trunk; then
+        configure_trunk_extension
+    fi
+
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
     # devstack is not a tool for running uber scale OpenStack
     # clouds, therefore running without a dedicated RPC worker
diff --git a/lib/neutron_plugins/services/trunk b/lib/neutron_plugins/services/trunk
new file mode 100644
index 0000000000..8e0f6944cf
--- /dev/null
+++ b/lib/neutron_plugins/services/trunk
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+function configure_trunk_extension {
+    neutron_service_plugin_class_add "trunk"
+}

From 61a37bff9a35337f5924ca7cc61c76e42e55d787 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 8 Oct 2021 10:59:09 +0200
Subject: [PATCH 2886/3333] Further fixup for Ubuntu cloud images

The official Ubuntu cloud images have some further python pkgs
preinstalled that conflict with our requirements. Allow to
overwrite them.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Closes-Bug: 1871485
Change-Id: I793c250cae5e7b9bc835b7016d790d1f9ae8a7f3
---
 tools/fixup_stuff.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 8a2c337fc4..197a12d8f5 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -167,6 +167,8 @@ function fixup_ubuntu {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/simplejson-*.egg-info
 }
 
 function fixup_all {

From b4e683e6b9a442ed9c37407cbc85288fe92aa85c Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 5 Oct 2021 20:44:57 +0200
Subject: [PATCH 2887/3333] Don't fail if there is no nf_conntrack_proto_gre
 module available

It may be that it is already compiled in the kernel so there is no
need to load kernel module in such case.

Change-Id: Ie1d32e3fd529e13958857cb3ced6710eebde1e4d
---
 lib/neutron_plugins/ovs_source | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 294171f18b..08951d175d 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -211,5 +211,5 @@ function remove_ovs_packages {
 
 # load_conntrack_gre_module() - loads nf_conntrack_proto_gre kernel module
 function load_conntrack_gre_module {
-    sudo modprobe nf_conntrack_proto_gre
+    load_module nf_conntrack_proto_gre False
 }

From 84901f563ef6b5d93a00a89f9cdb41a0380d493e Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 15 Oct 2021 15:04:49 +0200
Subject: [PATCH 2888/3333] Create clouds.yaml early enough

When using glance limits, the create_glance_accounts call needs access
to the devstack-system-admin cloud definition, so we need to create
the clouds.yaml file before that step.

Change-Id: Ie6d807c46b88b16b316aa166870a6a13f2bb346d
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 48f61fb3af..979867895f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1090,6 +1090,9 @@ fi
 
 source $TOP_DIR/userrc_early
 
+# Write a clouds.yaml file
+write_clouds_yaml
+
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
 
@@ -1118,9 +1121,6 @@ if is_service_enabled keystone; then
 
 fi
 
-# Write a clouds.yaml file
-write_clouds_yaml
-
 # Horizon
 # -------
 

From c027ddd3f895802f5cab37d2cb04162686a3a3cb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 16 Oct 2021 06:26:49 +0000
Subject: [PATCH 2889/3333] Updated from generate-devstack-plugins-list

Change-Id: I1abc356970a7f2427bc9683a7e64e54ab52a7651
---
 doc/source/plugin-registry.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7c8d2b8aac..3edd708d8b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,8 +24,6 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
-inspur/venus                             `https://opendev.org/inspur/venus <https://opendev.org/inspur/venus>`__
-inspur/venus-dashboard                   `https://opendev.org/inspur/venus-dashboard <https://opendev.org/inspur/venus-dashboard>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
@@ -101,6 +99,8 @@ openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
+openstack/venus                          `https://opendev.org/openstack/venus <https://opendev.org/openstack/venus>`__
+openstack/venus-dashboard                `https://opendev.org/openstack/venus-dashboard <https://opendev.org/openstack/venus-dashboard>`__
 openstack/vitrage                        `https://opendev.org/openstack/vitrage <https://opendev.org/openstack/vitrage>`__
 openstack/vitrage-dashboard              `https://opendev.org/openstack/vitrage-dashboard <https://opendev.org/openstack/vitrage-dashboard>`__
 openstack/vitrage-tempest-plugin         `https://opendev.org/openstack/vitrage-tempest-plugin <https://opendev.org/openstack/vitrage-tempest-plugin>`__

From ee1c614eda833b38ad0d526b4b1e493dfe5968be Mon Sep 17 00:00:00 2001
From: Jens Harbott <frickler@offenerstapel.de>
Date: Sat, 16 Oct 2021 17:33:12 +0200
Subject: [PATCH 2890/3333] Fix use of yaml.load()

The use of this function has been deprecated for a long time[0]. With
PyYAML==6.0 the call is now failing, so replace it with the safe
version.

[0] https://msg.pyyaml.org/load

Signed-off-by: Jens Harbott <frickler@offenerstapel.de>
Change-Id: I7a170262b50a5c80a516095b872d52e1bea5479d
---
 tools/update_clouds_yaml.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 7be995e8f3..74dcdb2a07 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -65,7 +65,7 @@ def run(self):
     def _read_clouds(self):
         try:
             with open(self._clouds_path) as clouds_file:
-                self._clouds = yaml.load(clouds_file)
+                self._clouds = yaml.safe_load(clouds_file)
         except IOError:
             # The user doesn't have a clouds.yaml file.
             print("The user clouds.yaml file didn't exist.")

From c2491bac9d3b3f0446e67b4ea960cb88da9aec0e Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sun, 14 Jun 2020 18:06:23 +0200
Subject: [PATCH 2891/3333] Stop creating a keystone admin site

Keystone no longer has any special functionality hidden behind the admin
site. KEYSTONE_AUTH_URI which used to point to the admin site has long
ago been changed to be a copy of KEYSTONE_SERVICE_URI, which points to
the public site.

Drop all KEYSTONE_AUTH_* variables except KEYSTONE_AUTH_URI which may
still be in use in some plugins.

This also allows to finally drop the fixup_keystone() function.

Change-Id: I549f3cadc27d137e014241cdd47e90267859c848
---
 doc/source/configuration.rst   |  1 -
 files/apache-keystone.template | 25 -------------------------
 lib/keystone                   | 32 ++++----------------------------
 lib/swift                      |  4 ++--
 stack.sh                       |  4 ++--
 tools/fixup_stuff.sh           | 34 ----------------------------------
 6 files changed, 8 insertions(+), 92 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 67456142de..d1144ae9ed 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -666,7 +666,6 @@ In RegionTwo:
 
     disable_service horizon
     KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
-    KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     REGION_NAME=RegionTwo
     KEYSTONE_REGION_NAME=RegionOne
 
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 128436027d..1a353e5f4a 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,5 +1,4 @@
 Listen %PUBLICPORT%
-Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
@@ -20,20 +19,6 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLKEYFILE%
 </VirtualHost>
 
-<VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup keystone-admin
-    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    ErrorLogFormat "%M"
-    ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
 %SSLLISTEN%<VirtualHost *:443>
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
@@ -49,13 +34,3 @@ Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
 </Location>
-
-Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
-<Location /identity_admin>
-    SetHandler wsgi-script
-    Options +ExecCGI
-
-    WSGIProcessGroup keystone-admin
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/lib/keystone b/lib/keystone
index 66e867ca68..096bafb41f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -50,9 +50,7 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
-KEYSTONE_ADMIN_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-admin
 
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
@@ -81,21 +79,12 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
-# Set Keystone interface configuration
-KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
-KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
-KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
-KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
-
 # Public facing bits
 KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
 KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
 KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
 KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
-# Bind hosts
-KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
-
 # Set the project for service accounts in Keystone
 SERVICE_DOMAIN_NAME=${SERVICE_DOMAIN_NAME:-Default}
 SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
@@ -106,7 +95,6 @@ SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols
 if is_service_enabled tls-proxy; then
-    KEYSTONE_AUTH_PROTOCOL="https"
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
 
@@ -154,11 +142,8 @@ function cleanup_keystone {
         sudo rm -f $(apache_site_config_for keystone)
     else
         stop_process "keystone"
-        # TODO: remove admin at pike-2
         remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
         sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
     fi
 }
 
@@ -171,12 +156,10 @@ function _config_keystone_apache_wsgi {
     local keystone_certfile=""
     local keystone_keyfile=""
     local keystone_service_port=$KEYSTONE_SERVICE_PORT
-    local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
     if is_service_enabled tls-proxy; then
         keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
-        keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
     fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
@@ -185,7 +168,6 @@ function _config_keystone_apache_wsgi {
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$keystone_service_port|g;
-        s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
@@ -223,12 +205,10 @@ function configure_keystone {
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_port=$KEYSTONE_AUTH_PORT
 
     if is_service_enabled tls-proxy; then
         # Set the service ports for a proxy to take the originals
         service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_port=$KEYSTONE_AUTH_PORT_INT
     fi
 
     # Override the endpoints advertised by keystone (the public_endpoint and
@@ -238,7 +218,7 @@ function configure_keystone {
     # don't want the port (in the case of putting keystone on a path in
     # apache).
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
-    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
+    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_SERVICE_URI
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
@@ -261,7 +241,6 @@ function configure_keystone {
         _config_keystone_apache_wsgi
     else # uwsgi
         write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
-        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin"
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -518,7 +497,7 @@ function install_keystone {
 function start_keystone {
     # Get right service port for testing
     local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_protocol=$KEYSTONE_AUTH_PROTOCOL
+    local auth_protocol=$KEYSTONE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
         service_port=$KEYSTONE_SERVICE_PORT_INT
         auth_protocol="http"
@@ -546,7 +525,6 @@ function start_keystone {
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
-        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
     fi
 
     # (re)start memcached to make sure we have a clean memcache.
@@ -569,9 +547,7 @@ function stop_keystone {
 # - ``ADMIN_PASSWORD``
 # - ``IDENTITY_API_VERSION``
 # - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_PROTOCOL``
-# - ``KEYSTONE_SERVICE_HOST``
-# - ``KEYSTONE_SERVICE_PORT``
+# - ``KEYSTONE_SERVICE_URI``
 function bootstrap_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
         --bootstrap-username admin \
@@ -580,7 +556,7 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
+        --bootstrap-admin-url "$KEYSTONE_SERVICE_URI" \
         --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 
diff --git a/lib/swift b/lib/swift
index 98852415da..b376993150 100644
--- a/lib/swift
+++ b/lib/swift
@@ -430,7 +430,7 @@ function configure_swift {
         swift_pipeline+=" authtoken"
         if is_service_enabled s3api;then
             swift_pipeline+=" s3token"
-            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_AUTH_URI_V3}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_SERVICE_URI_V3}
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
         fi
         swift_pipeline+=" keystoneauth"
@@ -521,7 +521,7 @@ function configure_swift {
         local auth_vers
         auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
-        if [[ "$KEYSTONE_AUTH_PROTOCOL" == "https" ]]; then
+        if [[ "$KEYSTONE_SERVICE_PROTOCOL" == "https" ]]; then
             iniset ${testfile} func_test auth_port 443
         else
             iniset ${testfile} func_test auth_port 80
diff --git a/stack.sh b/stack.sh
index 48f61fb3af..fc26e21627 100755
--- a/stack.sh
+++ b/stack.sh
@@ -876,7 +876,7 @@ fi
 install_keystonemiddleware
 
 if is_service_enabled keystone; then
-    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
+    if [ "$KEYSTONE_SERVICE_HOST" == "$SERVICE_HOST" ]; then
         stack_install_service keystone
         configure_keystone
     fi
@@ -1093,7 +1093,7 @@ source $TOP_DIR/userrc_early
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
 
-    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
+    if [ "$KEYSTONE_SERVICE_HOST" == "$SERVICE_HOST" ]; then
         init_keystone
         start_keystone
         bootstrap_keystone
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 71fba2e2a6..fe5dafa994 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -26,39 +26,6 @@ if [[ -z "$TOP_DIR" ]]; then
     FILES=$TOP_DIR/files
 fi
 
-# Keystone Port Reservation
-# -------------------------
-# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
-# being used as ephemeral ports by the system. The default(s) are 35357 and
-# 35358 which are in the Linux defined ephemeral port range (in disagreement
-# with the IANA ephemeral port range). This is a workaround for bug #1253482
-# where Keystone will try and bind to the port and the port will already be
-# in use as an ephemeral port by another process. This places an explicit
-# exception into the Kernel for the Keystone AUTH ports.
-function fixup_keystone {
-    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
-
-    # Only do the reserved ports when available, on some system (like containers)
-    # where it's not exposed we are almost pretty sure these ports would be
-    # exclusive for our DevStack.
-    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
-        # Get any currently reserved ports, strip off leading whitespace
-        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-        if [[ -z "${reserved_ports}" ]]; then
-            # If there are no currently reserved ports, reserve the keystone ports
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
-        else
-            # If there are currently reserved ports, keep those and also reserve the
-            # Keystone specific ports. Duplicate reservations are merged into a single
-            # reservation (or range) automatically by the kernel.
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
-        fi
-    else
-        echo_summary "WARNING: unable to reserve keystone ports"
-    fi
-}
-
 # Python Packages
 # ---------------
 
@@ -182,7 +149,6 @@ function fixup_ubuntu {
 }
 
 function fixup_all {
-    fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse

From eb37657d8e34e1d0f8ee639c3953a752ba615d8d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 24 Feb 2021 10:04:31 +0100
Subject: [PATCH 2892/3333] Make creation of keystone admin endpoint optional

The keystone admin endpoint technically isn't different any longer from
the other keystone endpoints in v3 of the API. However, some
applications like heat are still relying on it to exist.

So we make the creation of the admin endpoint during bootstrap optional
here, with the intention to change the default to False once all jobs
that still need this are modified to explicitly require it.

Change-Id: I7ab12141c558186e397c174c248a613d1810011b
---
 lib/keystone | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 096bafb41f..f8b5ccb009 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -122,6 +122,9 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
+# Whether to create a keystone admin endpoint for legacy applications
+KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse True KEYSTONE_ADMIN_ENDPOINT)
+
 # Functions
 # ---------
 
@@ -556,8 +559,16 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_SERVICE_URI" \
         --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
+    if [ "$KEYSTONE_ADMIN_ENDPOINT" == "True" ]; then
+        openstack endpoint create --region "$REGION_NAME" \
+            --os-username admin \
+            --os-user-domain-id default \
+            --os-password "$ADMIN_PASSWORD" \
+            --os-project-name admin \
+            --os-project-domain-id default \
+            keystone admin "$KEYSTONE_SERVICE_URI"
+    fi
 }
 
 # create_ldap_domain() - Create domain file and initialize domain with a user

From b538b3267cec11f0b345ce101607bbd36ada8f32 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 24 Feb 2021 10:24:03 +0100
Subject: [PATCH 2893/3333] Switch off creating a keystone admin endpoint by
 default

With the depending patch, the endpoint will still be created for
heat tests, so we can turn it off for everyone else.

Depends-On: https://review.opendev.org/c/openstack/openstacksdk/+/777343
Change-Id: I0dc7d6cedd07e942b9f23b26a785b386aff41fbc
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index f8b5ccb009..0609abd289 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -123,7 +123,7 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
 # Whether to create a keystone admin endpoint for legacy applications
-KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse True KEYSTONE_ADMIN_ENDPOINT)
+KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse False KEYSTONE_ADMIN_ENDPOINT)
 
 # Functions
 # ---------

From 4aa27976ebb2e4a4dc95a20f96e5d8f25b1ac10d Mon Sep 17 00:00:00 2001
From: Tristan Cacqueray <tdecacqu@redhat.com>
Date: Tue, 19 Oct 2021 21:47:27 +0000
Subject: [PATCH 2894/3333] [ci] Remove the implied-branches pragma

This change enables using devstack job with custom branche names.

Change-Id: I95c368f05042a6f8f208988af9a6d89a522a5526
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b756db3b22..d114053d26 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,11 +1,3 @@
-- pragma:
-   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
-   # be using devstack
-   # TODO(gtema): delete this once r1 branch is merged into master
-    implied-branches:
-      - master
-      - feature/r1
-
 - nodeset:
     name: openstack-single-node
     nodes:

From e06d954229fc4fca827105f5bb0809a19075d590 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 21 Oct 2021 08:15:12 -0700
Subject: [PATCH 2895/3333] Use Nehalem CPU model by default

CentOS/RHEL 9 are being compiled for the x86_64-v2 architecture which is
newer than the qemu default of qemu64. This means that for devstack to
boot these instances we need a newer CPU model. Nehalem is apparently
the oldest model that works for x86_64-v2 and is expected to work on
Intel and AMD cpus with kvm or qemu. Switch devstack to this model by
default.

Note that we cannot use host-passthrough or host-model because we want
to support live migration between devstack deployed nova-compute
instances and even within the CI instances that we get the host CPUs can
differ.

Also, we should run this change against as many clouds as possible to
ensure that the newer model works across all of our clouds. There is
some fear that the virtual CPUs presented to us in some clouds may not
be able to run these newer CPU models.

Change-Id: Ibd6e11b59f3c8655bc60ace7383a08458b2177f2
---
 lib/nova                            | 3 ++-
 lib/nova_plugins/hypervisor-libvirt | 3 +++
 stackrc                             | 3 ++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index bbb1039199..9aae2c4a9c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -260,7 +260,8 @@ function configure_nova {
                 if [ ! -e /dev/kvm ]; then
                     echo "WARNING: Switching to QEMU"
                     LIBVIRT_TYPE=qemu
-                    LIBVIRT_CPU_MODE=none
+                    LIBVIRT_CPU_MODE=custom
+                    LIBVIRT_CPU_MODEL=Nehalem
                     if which selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
                         # https://bugzilla.redhat.com/show_bug.cgi?id=753589
                         sudo setsebool virt_use_execmem on
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 321775d324..c1cd132548 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -40,6 +40,9 @@ function configure_nova_hypervisor {
     configure_libvirt
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
     iniset $NOVA_CONF libvirt cpu_mode "$LIBVIRT_CPU_MODE"
+    if [ "$LIBVIRT_CPU_MODE" == "custom" ] ; then
+        iniset $NOVA_CONF libvirt cpu_model "$LIBVIRT_CPU_MODEL"
+    fi
     # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
     iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
diff --git a/stackrc b/stackrc
index 3dc800af2d..ebe472c033 100755
--- a/stackrc
+++ b/stackrc
@@ -623,7 +623,8 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-none}
+        LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-custom}
+        LIBVIRT_CPU_MODEL=${LIBVIRT_CPU_MODEL:-Nehalem}
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check

From 7f6d9283b85bb743d3224981c031d331f5e9608a Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 27 Oct 2021 16:40:30 +0200
Subject: [PATCH 2896/3333] Rehome functions to enable Neutron's placement
 integration

Those functions were part of the neutron devstack plugin but we
discussed it during last PTG [1] and decided to move to the Devstack
repo as plugins which are used by e.g. CI jobs which are defined outside
of the neutron repository.
Placement integration is used e.g. in the tempest-slow job which is
defined in tempest and used by many different OpenStack projects.

[1] https://etherpad.opendev.org/p/neutron-yoga-ptg#L142

Change-Id: Ib86071881f16de1b69c0f9b1b19b6df8b7e66a07
---
 lib/neutron-legacy                     |  4 ++++
 lib/neutron_plugins/services/placement | 21 +++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 lib/neutron_plugins/services/placement

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7b20a96ed7..b41dfcae42 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -277,6 +277,7 @@ source $TOP_DIR/lib/neutron_plugins/services/metering
 source $TOP_DIR/lib/neutron_plugins/services/l3
 
 # Additional Neutron service plugins
+source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
 
 # Use security group or not
@@ -374,6 +375,9 @@ function configure_mutnauq {
     fi
 
     # Configure Neutron's advanced services
+    if is_service_enabled q-placement neutron-placement; then
+        configure_placement_extension
+    fi
     if is_service_enabled q-trunk neutron-trunk; then
         configure_trunk_extension
     fi
diff --git a/lib/neutron_plugins/services/placement b/lib/neutron_plugins/services/placement
new file mode 100644
index 0000000000..3ec185bae6
--- /dev/null
+++ b/lib/neutron_plugins/services/placement
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+function configure_placement_service_plugin {
+    neutron_service_plugin_class_add "placement"
+}
+
+function configure_placement_neutron {
+    iniset $NEUTRON_CONF placement auth_type "$NEUTRON_PLACEMENT_AUTH_TYPE"
+    iniset $NEUTRON_CONF placement auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $NEUTRON_CONF placement username "$NEUTRON_PLACEMENT_USERNAME"
+    iniset $NEUTRON_CONF placement password "$SERVICE_PASSWORD"
+    iniset $NEUTRON_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NEUTRON_CONF placement project_name "$SERVICE_TENANT_NAME"
+    iniset $NEUTRON_CONF placement project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NEUTRON_CONF placement region_name "$REGION_NAME"
+}
+
+function configure_placement_extension {
+    configure_placement_service_plugin
+    configure_placement_neutron
+}

From 325792d9b9238f9a8b8b493ba50572add99b9d82 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 15 Oct 2021 15:55:54 -0500
Subject: [PATCH 2897/3333] Clarify error message for ERROR_ON_CLONE=True

If ERROR_ON_CLONE is set to True which is case for
all the devstack based job, devstack does not clone the
repo instead raise error. From current error message, it
is difficult to know that ERROR_ON_CLONE is True until we
traceback the code or check devstack-base job set ERROR_ON_CLONE
to True.

Current error message is like:
-------
+ functions-common:git_clone:560           :   echo
'The /opt/stack/oslo.limit project was not found; if this is a gate job, add'
  The /opt/stack/oslo.limit project was not found; if this is a gate job, add
+ functions-common:git_clone:561           :   echo 'the project to the
 $PROJECTS variable in the job definition.'
the project to the $PROJECTS variable in the job definition.
+ functions-common:git_clone:562           :   die 562 'Cloning not
  allowed in this configuration'
--------

Adding ERROR_ON_CLONE info in error message will help to
know the reason of devstack not cloning the repo.

Change-Id: I9e9852f046fefb299b4ef4446323e9c86437212f
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 11679e4aa3..7a628db737 100644
--- a/functions-common
+++ b/functions-common
@@ -547,7 +547,7 @@ function git_clone {
             if [[ "$ERROR_ON_CLONE" = "True" ]]; then
                 echo "The $git_dest project was not found; if this is a gate job, add"
                 echo "the project to 'required-projects' in the job definition."
-                die $LINENO "Cloning not allowed in this configuration"
+                die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
             git_timed clone $git_clone_flags $git_remote $git_dest
         fi
@@ -559,7 +559,7 @@ function git_clone {
             if [[ "$ERROR_ON_CLONE" = "True" ]]; then
                 echo "The $git_dest project was not found; if this is a gate job, add"
                 echo "the project to the \$PROJECTS variable in the job definition."
-                die $LINENO "Cloning not allowed in this configuration"
+                die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
             # '--branch' can also take tags
             git_timed clone $git_clone_flags $git_remote $git_dest --branch $git_ref

From f8e00b86aee9a8f9646bf5aed2c618843307b963 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 29 Oct 2021 14:39:41 +0200
Subject: [PATCH 2898/3333] Run Bullseye with more swap

Since Bullseye like Centos 8 Stream needs more memory due to changed
default settings in newer qemu versions, set the swap size to 4G, which
is the same setting already being used for the CS8 jobs successfully.

Change-Id: I83ea34d6aa647d2ab9d4d78ed354904fce836e68
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
---
 .zuul.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cbcb8638c4..7a85266eaa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -630,9 +630,7 @@
     voting: false
     timeout: 9000
     vars:
-      # NOTE(yoctozepto): With concurrency equal 2, there is a random event
-      # that this job will run out of memory at some point.
-      tempest_concurrency: 1
+      configure_swap_size: 4096
       # NOTE(yoctozepto): Debian Bullseye does not yet offer OVN. Switch to OVS
       # for the time being.
       devstack_localrc:

From 021ae0bcc8f67b6fd307aaf3c8ac59ba6cbe23b6 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Thu, 11 Mar 2021 15:47:50 +0000
Subject: [PATCH 2899/3333] Update lib/keystone to add more system users

Keystone has supported system-scope since Queens and we already make
sure we create a cloud profile for system-admin in
/etc/openstack/clouds.yaml.

This commit ensures keystone creates a couple of new users to model
system-member and system-reader personas. Doing this by default in
devstack makes it easier for people to use.

We've already taken a similar approach in tempest by setting up the
various system personas for tempest clients to use.

Change-Id: Iceb7c5f517db20072e121dc7538abaa888423c67
---
 functions-common | 53 ++++++++++++++++++++++++++++++++++++++++++++++++
 lib/keystone     | 23 ++++++++++++++++++++-
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 11679e4aa3..111d339372 100644
--- a/functions-common
+++ b/functions-common
@@ -129,6 +129,28 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
+    # system member
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-system-member \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username system_member \
+        --os-password $ADMIN_PASSWORD \
+        --os-system-scope all
+
+    # system reader
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-system-reader \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username system_reader \
+        --os-password $ADMIN_PASSWORD \
+        --os-system-scope all
+
     cat >> $CLOUDS_YAML <<EOF
 functional:
   image_name: $DEFAULT_IMAGE_NAME
@@ -936,6 +958,37 @@ function get_or_add_user_domain_role {
     echo $user_role_id
 }
 
+# Gets or adds user role to system
+# Usage: get_or_add_user_system_role <role> <user> <system> [<user_domain>]
+function get_or_add_user_system_role {
+    local user_role_id
+    local domain_args
+
+    domain_args=$(_get_domain_args $4)
+
+    # Gets user role id
+    user_role_id=$(openstack role assignment list \
+        --role $1 \
+        --user $2 \
+        --system $3 \
+        $domain_args \
+        -f value -c Role)
+    if [[ -z "$user_role_id" ]]; then
+        # Adds role to user and get it
+        openstack role add $1 \
+            --user $2 \
+            --system $3 \
+            $domain_args
+        user_role_id=$(openstack role assignment list \
+            --role $1 \
+            --user $2 \
+            --system $3 \
+            $domain_args \
+            -f value -c Role)
+    fi
+    echo $user_role_id
+}
+
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
diff --git a/lib/keystone b/lib/keystone
index 0609abd289..065ca70ec3 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -285,20 +285,28 @@ function configure_keystone {
 # admins               admin            admin                 admin
 # nonadmins            demo, alt_demo   member, anotherrole   demo, alt_demo
 
+# System               User            Roles
+# ------------------------------------------------------------------
+# all                  admin           admin
+# all                  system_reader   reader
+# all                  system_member   member
+
 
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
     # The keystone bootstrapping process (performed via keystone-manage
-    # bootstrap) creates an admin user, admin role, member role, and admin
+    # bootstrap) creates an admin user and an admin
     # project. As a sanity check we exercise the CLI to retrieve the IDs for
     # these values.
     local admin_project
     admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
+    # These roles are also created during bootstrap but we don't need their IDs
     local admin_role="admin"
     local member_role="member"
+    local reader_role="reader"
 
     async_run ks-domain-role get_or_add_user_domain_role $admin_role $admin_user default
 
@@ -349,6 +357,18 @@ function create_keystone_accounts {
     async_run ks-alt-admin get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
     async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
+    # Create two users, give one the member role on the system and the other
+    # the reader role on the system. These two users model system-member and
+    # system-reader personas. The admin user already has the admin role on the
+    # system and we can re-use this user as a system-admin.
+    system_member_user=$(get_or_create_user "system_member" \
+        "$ADMIN_PASSWORD" "default" "system_member@example.com")
+    async_run ks-system-member get_or_add_user_system_role $member_role $system_member_user "all"
+
+    system_reader_user=$(get_or_create_user "system_reader" \
+        "$ADMIN_PASSWORD" "default" "system_reader@example.com")
+    async_run ks-system-reader get_or_add_user_system_role $reader_role $system_reader_user "all"
+
     # groups
     local admin_group
     admin_group=$(get_or_create_group "admins" \
@@ -365,6 +385,7 @@ function create_keystone_accounts {
 
     async_wait ks-demo-{member,admin,another,invis}
     async_wait ks-alt-{member,admin,another}
+    async_wait ks-system-{member,reader}
     async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 
     if is_service_enabled ldap; then

From 95555ba39827e2f3648eb89bde91b1342c493306 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 10 Nov 2021 06:22:52 +0100
Subject: [PATCH 2900/3333] Cleanup keystone library

IDENTITY_API_VERSION is hardcoded to 3 in most locations already, drop
the remaining occurrences, but keep the variable definition since some
plugins still depend on it. Drop ENABLE_IDENTITY_V2 which no longer
has any effect.

Amend variable list for bootstrap_keystone().

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I06f476d2105bc6ec2b511fc5effcfcc3973eaf97
---
 doc/source/configuration.rst | 11 -----------
 lib/keystone                 |  4 +---
 openrc                       |  2 +-
 stackrc                      | 18 +++---------------
 4 files changed, 5 insertions(+), 30 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index b4fff4f208..dd8f21faaf 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -684,17 +684,6 @@ KEYSTONE_REGION_NAME to specify the region of Keystone service.
 KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
 it in the configuration of RegionOne.
 
-Disabling Identity API v2
-+++++++++++++++++++++++++
-
-The Identity API v2 is deprecated as of Mitaka and it is recommended to only
-use the v3 API. It is possible to setup keystone without v2 API, by doing:
-
-::
-
-    ENABLE_IDENTITY_V2=False
-
-
 Glance
 ++++++
 
diff --git a/lib/keystone b/lib/keystone
index 065ca70ec3..349d2573b6 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -9,7 +9,6 @@
 # - ``tls`` file
 # - ``DEST``, ``STACK_USER``
 # - ``FILES``
-# - ``IDENTITY_API_VERSION``
 # - ``BASE_SQL_CONN``
 # - ``SERVICE_HOST``, ``SERVICE_PROTOCOL``
 # - ``S3_SERVICE_PORT`` (template backend only)
@@ -540,7 +539,7 @@ function start_keystone {
     # unencryted traffic at this point.
     # If running in Apache, use the path rather than port.
 
-    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
+    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v3/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
@@ -569,7 +568,6 @@ function stop_keystone {
 # This function uses the following GLOBAL variables:
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
-# - ``IDENTITY_API_VERSION``
 # - ``REGION_NAME``
 # - ``KEYSTONE_SERVICE_URI``
 function bootstrap_keystone {
diff --git a/openrc b/openrc
index beeaebea42..6d488bb0ba 100644
--- a/openrc
+++ b/openrc
@@ -74,7 +74,7 @@ else
 fi
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
+export OS_IDENTITY_API_VERSION=3
 
 # Ask keystoneauth1 to use keystone
 export OS_AUTH_TYPE=password
diff --git a/stackrc b/stackrc
index ebe472c033..62749a7005 100755
--- a/stackrc
+++ b/stackrc
@@ -175,21 +175,9 @@ else
     export PS4='+ $(short_source):   '
 fi
 
-# Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
-
-# Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
-# deployment will be deploying the Identity v2 pipelines. If this option is set
-# to ``False``, DevStack will: i) disable Identity v2; ii) configure Tempest to
-# skip Identity v2 specific tests; and iii) configure Horizon to use Identity
-# v3. When this option is set to ``False``, the option IDENTITY_API_VERSION
-# will to be set to ``3`` in order to make DevStack register the Identity
-# endpoint as v3. This flag is experimental and will be used as basis to
-# identify the projects which still have issues to operate with Identity v3.
-ENABLE_IDENTITY_V2=$(trueorfalse False ENABLE_IDENTITY_V2)
-if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-    IDENTITY_API_VERSION=3
-fi
+# Configure Identity API version
+# TODO(frickler): Drop this when plugins no longer need it
+IDENTITY_API_VERSION=3
 
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with

From 9c81321bfc694bd511dee8dd5d04273e368e5545 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Thu, 11 Mar 2021 16:29:31 +0000
Subject: [PATCH 2901/3333] Add additional project personas for secure RBAC

This commit formalizes some additional users to act as different project
users and updates clouds.yaml file so they're easy to use.

It creates:

  - a reader on the demo project
  - a reader on the alt_demo project
  - a member on the alt_demo project

With the adoption of secure RBAC personas, these are useful for using
OpenStack APIs as that work continues.

Change-Id: I3237a771275311377313b7d7d80ac059ac69d031
---
 functions-common | 51 +++++++++++++++++++++++++++++++++++++++---------
 lib/keystone     | 32 ++++++++++++++++++++++++------
 2 files changed, 68 insertions(+), 15 deletions(-)

diff --git a/functions-common b/functions-common
index 111d339372..996827f292 100644
--- a/functions-common
+++ b/functions-common
@@ -85,7 +85,7 @@ function write_clouds_yaml {
     if [ -f "$SSL_BUNDLE_FILE" ]; then
         CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
     fi
-    # demo -> devstack
+    # devstack: user with the member role on demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack \
@@ -96,7 +96,18 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
 
-    # alt_demo -> devstack-alt
+    # devstack-admin: user with the admin role on the admin project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name admin
+
+    # devstack-alt: user with the member role on alt_demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-alt \
@@ -107,18 +118,40 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name alt_demo
 
-    # admin -> devstack-admin
+    # devstack-alt-member: user with the member role on alt_demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
-        --os-cloud devstack-admin \
+        --os-cloud devstack-alt-member \
         --os-region-name $REGION_NAME \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
-        --os-username admin \
+        --os-username alt_demo_member \
         --os-password $ADMIN_PASSWORD \
-        --os-project-name admin
+        --os-project-name alt_demo
+
+    # devstack-alt-reader: user with the reader role on alt_demo project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-alt-reader \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username alt_demo_reader \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name alt_demo
+
+    # devstack-reader: user with the reader role on demo project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-reader \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username demo_reader \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
 
-    # admin with a system-scoped token -> devstack-system
+    # devstack-system-admin: user with the admin role on the system
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-system-admin \
@@ -129,7 +162,7 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
-    # system member
+    # devstack-system-member: user with the member role on the system
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-system-member \
@@ -140,7 +173,7 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
-    # system reader
+    # devstack-system-reader: user with the reader role on the system
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-system-reader \
diff --git a/lib/keystone b/lib/keystone
index 065ca70ec3..1ae950d0d1 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -346,19 +346,39 @@ function create_keystone_accounts {
     async_run ks-demo-another get_or_add_user_project_role $another_role $demo_user $demo_project
     async_run ks-demo-invis get_or_add_user_project_role $member_role $demo_user $invis_project
 
-    # alt_demo
+    # Create a user to act as a reader on project demo
+    local demo_reader
+    demo_reader=$(get_or_create_user "demo_reader" \
+        "$ADMIN_PASSWORD" "default" "demo_reader@example.com")
+
+    async_run ks-demo-reader get_or_add_user_project_role $reader_role $demo_reader $demo_project
+
+    # Create a different project called alt_demo
     local alt_demo_project
     alt_demo_project=$(get_or_create_project "alt_demo" default)
+    # Create a user to act as member, admin and anotherrole on project alt_demo
     local alt_demo_user
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
     async_run ks-alt-member get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
-    async_run ks-alt-admin get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
+    async_run ks-alt-admin get_or_add_user_project_role $admin_role $alt_demo_user $alt_demo_project
     async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
-    # Create two users, give one the member role on the system and the other
-    # the reader role on the system. These two users model system-member and
+    # Create another user to act as a member on project alt_demo
+    local alt_demo_member
+    alt_demo_member=$(get_or_create_user "alt_demo_member" \
+        "$ADMIN_PASSWORD" "default" "alt_demo_member@example.com")
+    async_run ks-alt-member-user get_or_add_user_project_role $member_role $alt_demo_member $alt_demo_project
+
+    # Create another user to act as a reader on project alt_demo
+    local alt_demo_reader
+    alt_demo_reader=$(get_or_create_user "alt_demo_reader" \
+        "$ADMIN_PASSWORD" "default" "alt_demo_reader@example.com")
+    async_run ks-alt-reader-user get_or_add_user_project_role $reader_role $alt_demo_reader $alt_demo_project
+
+    # Create two users, give one the member role on the system and the other the
+    # reader role on the system. These two users model system-member and
     # system-reader personas. The admin user already has the admin role on the
     # system and we can re-use this user as a system-admin.
     system_member_user=$(get_or_create_user "system_member" \
@@ -383,8 +403,8 @@ function create_keystone_accounts {
     async_run ks-group-anotheralt get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
     async_run ks-group-admin get_or_add_group_project_role $admin_role $admin_group $admin_project
 
-    async_wait ks-demo-{member,admin,another,invis}
-    async_wait ks-alt-{member,admin,another}
+    async_wait ks-demo-{member,admin,another,invis,reader}
+    async_wait ks-alt-{member,admin,another,member-user,reader-user}
     async_wait ks-system-{member,reader}
     async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 

From f9a896c6e6afcf52e9a50613285940c26e353ba3 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 27 Oct 2021 16:50:11 +0200
Subject: [PATCH 2902/3333] Rehome functions to enable Neutron's QoS service

Those functions were part of the neutron devstack plugin but we
discussed it during last PTG [1] and decided to move to the Devstack
repo plugins which are used by e.g. CI jobs which are defined outside
of the neutron repository.
QoS service is used e.g. in the tempest-slow job which is
defined in tempest and used by many different OpenStack projects.

[1] https://etherpad.opendev.org/p/neutron-yoga-ptg#L142

Change-Id: I48f65d530db53fe2c94cad57a8072e1158d738b0
---
 lib/neutron-legacy               |  8 ++++++++
 lib/neutron_plugins/services/qos | 30 ++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 lib/neutron_plugins/services/qos

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index be29f99024..a3f6f0788d 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -279,6 +279,7 @@ source $TOP_DIR/lib/neutron_plugins/services/l3
 # Additional Neutron service plugins
 source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
+source $TOP_DIR/lib/neutron_plugins/services/qos
 
 # Use security group or not
 if has_neutron_plugin_security_group; then
@@ -381,6 +382,13 @@ function configure_mutnauq {
     if is_service_enabled q-trunk neutron-trunk; then
         configure_trunk_extension
     fi
+    if is_service_enabled q-qos neutron-qos; then
+        configure_qos
+        if is_service_enabled q-l3 neutron-l3; then
+            configure_l3_agent_extension_fip_qos
+            configure_l3_agent_extension_gateway_ip_qos
+        fi
+    fi
 
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
     # devstack is not a tool for running uber scale OpenStack
diff --git a/lib/neutron_plugins/services/qos b/lib/neutron_plugins/services/qos
new file mode 100644
index 0000000000..af9eb3d5b4
--- /dev/null
+++ b/lib/neutron_plugins/services/qos
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+function configure_qos_service_plugin {
+    neutron_service_plugin_class_add "qos"
+}
+
+
+function configure_qos_core_plugin {
+    configure_qos_$NEUTRON_CORE_PLUGIN
+}
+
+
+function configure_qos_l2_agent {
+    plugin_agent_add_l2_agent_extension "qos"
+}
+
+
+function configure_qos {
+    configure_qos_service_plugin
+    configure_qos_core_plugin
+    configure_qos_l2_agent
+}
+
+function configure_l3_agent_extension_fip_qos {
+    plugin_agent_add_l3_agent_extension "fip_qos"
+}
+
+function configure_l3_agent_extension_gateway_ip_qos {
+    plugin_agent_add_l3_agent_extension "gateway_ip_qos"
+}

From f56f7a557ac4941b5204852f4173db9cf82b4dae Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 9 Nov 2021 10:57:25 +0100
Subject: [PATCH 2903/3333] Stop creating userrc_early

We can use the devstack-admin cloud configuration everywhere now
and don't need to set environment variables with cloud credentials
any longer.

Fix the swift setup, where some more options need to be explicitly
specified now and the default OS_CLOUD setting overridden.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I86ffa9cd52454f1c1c72d29b3a0e0caa3e44b829
---
 lib/swift | 15 +++++++++------
 stack.sh  | 28 +++-------------------------
 2 files changed, 12 insertions(+), 31 deletions(-)

diff --git a/lib/swift b/lib/swift
index b376993150..9c13701c6e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -866,12 +866,15 @@ function stop_swift {
 
 function swift_configure_tempurls {
     # note we are using swift credentials!
-    OS_USERNAME=swift \
-    OS_PASSWORD=$SERVICE_PASSWORD \
-    OS_USER_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
-    OS_PROJECT_NAME=$SERVICE_PROJECT_NAME \
-    OS_PROJECT_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
-    openstack object store account \
+    openstack --os-cloud "" \
+        --os-region-name $REGION_NAME \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username=swift \
+        --os-password=$SERVICE_PASSWORD \
+        --os-user-domain-name=$SERVICE_DOMAIN_NAME \
+        --os-project-name=$SERVICE_PROJECT_NAME \
+        --os-project-domain-name=$SERVICE_DOMAIN_NAME \
+        object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
 
diff --git a/stack.sh b/stack.sh
index b5ad81b081..ead56e68c0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1063,35 +1063,13 @@ fi
 # Keystone
 # --------
 
-# Rather than just export these, we write them out to a
-# intermediate userrc file that can also be used to debug if
-# something goes wrong between here and running
-# tools/create_userrc.sh (this script relies on services other
-# than keystone being available, so we can't call it right now)
-cat > $TOP_DIR/userrc_early <<EOF
-# Use this for debugging issues before files in accrc are created
-
-# Set up password auth credentials now that Keystone is bootstrapped
-export OS_IDENTITY_API_VERSION=3
-export OS_AUTH_URL=$KEYSTONE_SERVICE_URI
-export OS_USERNAME=admin
-export OS_USER_DOMAIN_ID=default
-export OS_PASSWORD=$ADMIN_PASSWORD
-export OS_PROJECT_NAME=admin
-export OS_PROJECT_DOMAIN_ID=default
-export OS_REGION_NAME=$KEYSTONE_REGION_NAME
-
-EOF
-
 if is_service_enabled tls-proxy; then
-    echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
     start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
 fi
 
-source $TOP_DIR/userrc_early
-
-# Write a clouds.yaml file
+# Write a clouds.yaml file and use the devstack-admin cloud
 write_clouds_yaml
+export OS_CLOUD=devstack-admin
 
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
@@ -1380,7 +1358,7 @@ fi
 # which is helpful in image bundle steps.
 
 if is_service_enabled nova && is_service_enabled keystone; then
-    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
+    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc --os-password $ADMIN_PASSWORD"
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"

From faed11d2a1c9a9bb06ba855d5b551b231dd6bf82 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 18 Nov 2021 10:36:57 +0100
Subject: [PATCH 2904/3333] Add missing ml2, L2 and L3 agent functions to
 devstack

Previously those functions were defined in the neutron's devstack plugin
but with [1] we moved qos related code into devstack and we missed about
moving them too.
This is follow up patch to fix that issue.

[1] https://review.opendev.org/c/openstack/devstack/+/815686

Change-Id: Icf459a2f8c6ae3c3cb29b16ba0b92766af41af30
---
 lib/neutron-legacy              | 9 +++++++++
 lib/neutron_plugins/ml2         | 4 ++++
 lib/neutron_plugins/services/l3 | 9 +++++++++
 3 files changed, 22 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index a3f6f0788d..a5a608df72 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1039,6 +1039,15 @@ function _ssh_check_neutron {
     test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
 }
 
+function plugin_agent_add_l2_agent_extension {
+    local l2_agent_extension=$1
+    if [[ -z "$L2_AGENT_EXTENSIONS" ]]; then
+        L2_AGENT_EXTENSIONS=$l2_agent_extension
+    elif [[ ! ,${L2_AGENT_EXTENSIONS}, =~ ,${l2_agent_extension}, ]]; then
+        L2_AGENT_EXTENSIONS+=",$l2_agent_extension"
+    fi
+}
+
 # Restore xtrace
 $_XTRACE_NEUTRON
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e1f868f0a7..f00feac6b4 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -156,5 +156,9 @@ function has_neutron_plugin_security_group {
     return 0
 }
 
+function configure_qos_ml2 {
+    neutron_ml2_extension_driver_add "qos"
+}
+
 # Restore xtrace
 $_XTRACE_NEUTRON_ML2
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 98b96ac06c..72f7a32b26 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -427,3 +427,12 @@ function is_networking_extension_supported {
     EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
+
+function plugin_agent_add_l3_agent_extension {
+    local l3_agent_extension=$1
+    if [[ -z "$L3_AGENT_EXTENSIONS" ]]; then
+        L3_AGENT_EXTENSIONS=$l3_agent_extension
+    elif [[ ! ,${L3_AGENT_EXTENSIONS}, =~ ,${l3_agent_extension}, ]]; then
+        L3_AGENT_EXTENSIONS+=",$l3_agent_extension"
+    fi
+}

From c96993d138ea9ba447fc3b3dbbbf4879fd8c20db Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Thu, 18 Nov 2021 10:39:36 -0800
Subject: [PATCH 2905/3333] Make OS_CLOUD be able to be configured

OS_CLOUD is used to communiate to CLI tools what cloud
credentials to utilize.
The change I86ffa9cd52454f1c1c72d29b3a0e0caa3e44b829
unfortunately set an explicit OS_CLOUD account which breaks
any jobs which are expecting a previosuly set OS_CLOUD which
may be different to work. For example, OS_CLOUD being set
as devstack-system-admin to facilitate Secure RBAC testing.

Change-Id: Iee900e552584dda622f57eea3508df48dff2e071
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index ead56e68c0..b5dc0ee05e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1069,7 +1069,7 @@ fi
 
 # Write a clouds.yaml file and use the devstack-admin cloud
 write_clouds_yaml
-export OS_CLOUD=devstack-admin
+export OS_CLOUD=${OS_CLOUD:-devstack-admin}
 
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"

From 1d8888dc24143d81c13557ffdfa615052e794ebe Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Thu, 11 Mar 2021 16:36:28 +0000
Subject: [PATCH 2906/3333] Remove unnecessary member role assignments from
 alt_demo

This user already has the admin role assignment on a project, which
implies the member role, making explicit calls to add the member role
redundant.

Change-Id: I398c5e2f098aeeb896de83872085cbce529a778a
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1ae950d0d1..2d48bb10bd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -342,6 +342,7 @@ function create_keystone_accounts {
     async_wait ks-{domain-role,domain,project,service,reseller,anotherrole}
 
     async_run ks-demo-member get_or_add_user_project_role $member_role $demo_user $demo_project
+
     async_run ks-demo-admin get_or_add_user_project_role $admin_role $admin_user $demo_project
     async_run ks-demo-another get_or_add_user_project_role $another_role $demo_user $demo_project
     async_run ks-demo-invis get_or_add_user_project_role $member_role $demo_user $invis_project
@@ -361,7 +362,6 @@ function create_keystone_accounts {
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
-    async_run ks-alt-member get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
     async_run ks-alt-admin get_or_add_user_project_role $admin_role $alt_demo_user $alt_demo_project
     async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
@@ -404,7 +404,7 @@ function create_keystone_accounts {
     async_run ks-group-admin get_or_add_group_project_role $admin_role $admin_group $admin_project
 
     async_wait ks-demo-{member,admin,another,invis,reader}
-    async_wait ks-alt-{member,admin,another,member-user,reader-user}
+    async_wait ks-alt-{admin,another,member-user,reader-user}
     async_wait ks-system-{member,reader}
     async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 

From 65a5db8e3376fbeb6871629cbfe5d77fe848e039 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Mon, 3 May 2021 00:08:15 +0900
Subject: [PATCH 2907/3333] keystone: Dot not set the removed admin_endpoint
 parameter

The admin_endpoint parameter has been removed from keystone[1], and
setting the parameter is no longer effective.

[1] 192cde56e57a06750641b319da8a72cdcaa554d0

Change-Id: I6ae6a3122668551acc018972624e914fcbb79a22
---
 lib/keystone | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1ae950d0d1..dafe005664 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -214,14 +214,11 @@ function configure_keystone {
         service_port=$KEYSTONE_SERVICE_PORT_INT
     fi
 
-    # Override the endpoints advertised by keystone (the public_endpoint and
-    # admin_endpoint) so that clients use the correct endpoint. By default, the
-    # keystone server uses the public_port and admin_port which isn't going to
-    # work when you want to use a different port (in the case of proxy), or you
-    # don't want the port (in the case of putting keystone on a path in
-    # apache).
+    # Override the endpoints advertised by keystone so that clients use the correct
+    # endpoint. By default, the keystone server uses the public_port which isn't
+    # going to work when you want to use a different port (in the case of proxy),
+    # or you don't want the port (in the case of putting keystone on a path in apache).
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
-    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_SERVICE_URI
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT

From 6822ff39444f8ebe01084e0d92bc05ac40db8216 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Wed, 1 Sep 2021 09:36:31 +0200
Subject: [PATCH 2908/3333] Fix OVN DBs cleanup on startup

When initializing OVN, clean up the correct database directory when
using OVN from packages (/var/lib/ovn/ instead of /opt/stack/data/ovn/).
The /opt/stack/data/ovn location is used only when building OVN from
sources, so a fresh devstack deployment with OVN packages may already
have hundreds of existing routers and ports, creating ARP collisions.

Closes-Bug: #1942201
Change-Id: Ic90d4f2f9d8aaef825ea3325c0ad8fef2a1c5e39
---
 lib/neutron_plugins/ovn_agent | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 1f737fb58b..999851e33d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -119,7 +119,13 @@ OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
 OVS_DATADIR=$DATA_DIR/ovs
 OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-$OVS_PREFIX/etc/openvswitch}
 
-OVN_DATADIR=$DATA_DIR/ovn
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    OVN_DATADIR=$DATA_DIR/ovn
+else
+    # When using OVN from packages, the data dir for OVN DBs is
+    # /var/lib/ovn
+    OVN_DATADIR=/var/lib/ovn
+fi
 OVN_SHAREDIR=$OVS_PREFIX/share/ovn
 OVN_SCRIPTDIR=$OVN_SHAREDIR/scripts
 OVN_RUNDIR=$OVS_PREFIX/var/run/ovn
@@ -562,13 +568,13 @@ function init_ovn {
 
     _disable_libvirt_apparmor
 
-    mkdir -p $OVN_DATADIR
+    sudo mkdir -p $OVN_DATADIR
     mkdir -p $OVS_DATADIR
 
     rm -f $OVS_DATADIR/*.db
     rm -f $OVS_DATADIR/.*.db.~lock~
-    rm -f $OVN_DATADIR/*.db
-    rm -f $OVN_DATADIR/.*.db.~lock~
+    sudo rm -f $OVN_DATADIR/*.db
+    sudo rm -f $OVN_DATADIR/.*.db.~lock~
 }
 
 function _start_ovs {

From c20cd8ed9d0294e99293cdcb5eea0885a5a12573 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 24 Nov 2021 01:35:29 +0900
Subject: [PATCH 2909/3333] cinder-backup: Ensure ca cert is defined when
 tls-proxy is enabled

Change-Id: Id679eb7061d8e609ce76fbb5b720a041990e8e86
---
 lib/cinder_backups/swift | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/cinder_backups/swift b/lib/cinder_backups/swift
index d7c977e1e3..c7ec306246 100644
--- a/lib/cinder_backups/swift
+++ b/lib/cinder_backups/swift
@@ -24,6 +24,9 @@ function configure_cinder_backup_swift {
     # to use it.
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.swift.SwiftBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
+    if is_service_enabled tls-proxy; then
+        iniset $CINDER_CONF DEFAULT backup_swift_ca_cert_file $SSL_BUNDLE_FILE
+    fi
 }
 
 # init_cinder_backup_swift: nothing to do

From afd0f84eae75fd5a5a7611cb6e8368ef7b845211 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Mon, 8 Nov 2021 19:53:40 +0000
Subject: [PATCH 2910/3333] Remove unnecessary unset for project-scoped token
 in glance

Before, we needed to unset a couple of parameters that would make the
client return a project-scoped token instead of a system-scoped token,
which we need when interacting with registered limits in keystone.

This commit removes those unsets since we no longer source those
variables by default. This commit also cleans up some of the redundant
parameters in the registered limit calls, like region.

Change-Id: I1af8a168a29e895d57504d41e30efea271ea232d
---
 lib/glance | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/lib/glance b/lib/glance
index f18bea9ccb..4c2755f76f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -288,24 +288,17 @@ function configure_glance_store {
 
 function configure_glance_quotas {
 
-    # NOTE(danms): We need to have some of the OS_ things unset in
-    # order to use system scope, which is required for creating these
-    # limits. This is a hack, but I dunno how else to get osc to use
-    # system scope.
-
-    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
-                --region $REGION_NAME image_size_total; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
-                --region $REGION_NAME image_stage_total; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 100 --region $REGION_NAME \
-                image_count_total; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 100 --region $REGION_NAME \
-                image_count_uploading"
+    # Registered limit resources in keystone are system-specific resources.
+    # Make sure we use a system-scoped token to interact with this API.
+
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL --region $REGION_NAME image_size_total
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL --region $REGION_NAME image_stage_total
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit 100 --region $REGION_NAME image_count_total
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit 100 --region $REGION_NAME image_count_uploading
 
     # Tell glance to use these limits
     iniset $GLANCE_API_CONF DEFAULT use_keystone_limits True

From b575af0cfe8aac71825b406394e9927a33ca51bd Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 26 Nov 2021 12:44:41 +0530
Subject: [PATCH 2911/3333] Do not use sudo with OVN_DATADIR when building from
 source

Jobs with OVN_BUILD_FROMS_SOURCE=True are broken
since [1] as ovn nortd not starting due to permission
issues. Fix it by not using sudo for creating OVN_DATADIR
when building from source.

[1] https://review.opendev.org/c/openstack/devstack/+/806858

Closes-Bug: #1952393
Change-Id: I00f0c8c8173b4d8270fbb3e6079d0d8b332e9de5
---
 lib/neutron_plugins/ovn_agent | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 999851e33d..56686f2741 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -568,7 +568,11 @@ function init_ovn {
 
     _disable_libvirt_apparmor
 
-    sudo mkdir -p $OVN_DATADIR
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+        mkdir -p $OVN_DATADIR
+    else
+        sudo mkdir -p $OVN_DATADIR
+    fi
     mkdir -p $OVS_DATADIR
 
     rm -f $OVS_DATADIR/*.db

From bd68251463b2a86e07643387b56deca53a90f3c5 Mon Sep 17 00:00:00 2001
From: Roman Dobosz <gryf73@gmail.com>
Date: Fri, 26 Nov 2021 15:34:50 +0100
Subject: [PATCH 2912/3333] Change a way for creating data dir in case of OVN.

Calculate the sudo usage with local variable.

Change-Id: I39dff770ff296dc06395acdb430a9cfe1722a30f
---
 lib/neutron_plugins/ovn_agent | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 56686f2741..3fc38288f1 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -567,12 +567,13 @@ function init_ovn {
     # create new ones on each devstack run.
 
     _disable_libvirt_apparmor
+    local mkdir_cmd="mkdir -p ${OVN_DATADIR}"
 
-    if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
-        mkdir -p $OVN_DATADIR
-    else
-        sudo mkdir -p $OVN_DATADIR
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then
+        mkdir_cmd="sudo ${mkdir_cmd}"
     fi
+
+    $mkdir_cmd
     mkdir -p $OVS_DATADIR
 
     rm -f $OVS_DATADIR/*.db

From 5ea4c3c18c558ec1fa37e0dd9b28ce66c3da1130 Mon Sep 17 00:00:00 2001
From: Alfredo Moralejo <amoralej@redhat.com>
Date: Tue, 16 Nov 2021 15:13:03 +0100
Subject: [PATCH 2913/3333] Support CentOS Stream 9

This patch includes changes required to run devstack on CentOS Stream 9
which has been already published in official repos by CentOS team [1]:

- Add RDO deps repository for CS9.
- remove xinetd package from installation for swift. Note that
  rsync-daemon is installed which should work fine.
- Replace genisoimage by xorriso in CS9.
- Use /etc/os-release to identify the distro in CS9 as it doesn't
  provide lsb_release command.
- Use pip from rpm package instead of from get-pip.py as done in Fedora.
- Add non-voting job devstack-platform-centos-9-stream to the check
  pipeline.

Change-Id: Ic67cddabd5069211dc0611994b8b8360bcd61bef
---
 .zuul.yaml           | 21 +++++++++++++++++++++
 files/rpms/ceph      |  2 +-
 files/rpms/n-cpu     |  3 ++-
 files/rpms/nova      |  3 ++-
 files/rpms/swift     |  2 +-
 functions-common     | 17 ++++++++++++-----
 lib/nova             |  3 ++-
 stack.sh             | 24 ++++++++++++++++--------
 tools/install_pip.sh |  2 +-
 9 files changed, 58 insertions(+), 19 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7a85266eaa..3945faf82e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -66,6 +66,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-9-stream
+    nodes:
+      - name: controller
+        label: centos-9-stream
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-opensuse-15
     nodes:
@@ -622,6 +632,16 @@
     vars:
       configure_swap_size: 4096
 
+- job:
+    name: devstack-platform-centos-9-stream
+    parent: tempest-full-py3
+    description: CentOS 9 Stream platform test
+    nodeset: devstack-single-node-centos-9-stream
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-debian-bullseye
     parent: tempest-full-py3
@@ -766,6 +786,7 @@
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
+        - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-multinode
         - devstack-unit-tests
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 64befc5f00..33a55f80ea 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core
+redhat-lsb-core # not:rhel9
 xfsprogs
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 68e5472685..7ce5a72d6b 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,9 +1,10 @@
 cryptsetup
 dosfstools
-genisoimage
+genisoimage # not:rhel9
 iscsi-initiator-utils
 libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes
 sysfsutils
+xorriso # not:rhel8
diff --git a/files/rpms/nova b/files/rpms/nova
index 8ea8ccc5ca..9522e5729d 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -3,7 +3,7 @@ curl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
-genisoimage # required for config_drive
+genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
 kernel-modules
@@ -13,3 +13,4 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
+xorriso # not:rhel8
diff --git a/files/rpms/swift b/files/rpms/swift
index 18c957c08a..b6009a321e 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f34
+xinetd # not:f34,rhel9
diff --git a/functions-common b/functions-common
index b1ca6ad3c0..bd029dd700 100644
--- a/functions-common
+++ b/functions-common
@@ -368,12 +368,19 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # We only support distros that provide a sane lsb_release
-    _ensure_lsb_release
+    # CentOS Stream 9 does not provide lsb_release
+    source /etc/os-release
+    if [[ "${ID}${VERSION}" == "centos9" ]]; then
+        os_RELEASE=${VERSION_ID}
+        os_CODENAME="n/a"
+        os_VENDOR=$(echo $NAME | tr -d '[:space:]')
+    else
+        _ensure_lsb_release
 
-    os_RELEASE=$(lsb_release -r -s)
-    os_CODENAME=$(lsb_release -c -s)
-    os_VENDOR=$(lsb_release -i -s)
+        os_RELEASE=$(lsb_release -r -s)
+        os_CODENAME=$(lsb_release -c -s)
+        os_VENDOR=$(lsb_release -i -s)
+    fi
 
     if [[ $os_VENDOR =~ (Debian|Ubuntu|LinuxMint) ]]; then
         os_PACKAGE="deb"
diff --git a/lib/nova b/lib/nova
index 9aae2c4a9c..31b7642efc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -479,7 +479,8 @@ function create_nova_conf {
     fi
 
     # nova defaults to genisoimage but only mkisofs is available for 15.0+
-    if is_suse; then
+    # rhel provides mkisofs symlink to genisoimage or xorriso appropiately
+    if is_suse || is_fedora; then
         iniset $NOVA_CONF DEFAULT mkisofs_cmd /usr/bin/mkisofs
     fi
 
diff --git a/stack.sh b/stack.sh
index b5ad81b081..fa4e7e9006 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -300,13 +300,17 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ "$TARGET_BRANCH" == "master" ]]; then
-        # rdo-release.el8.rpm points to latest RDO release, use that for master
-        sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
-    else
-        # For stable branches use corresponding release rpm
-        rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
-        sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+    if [[ $DISTRO == "rhel8" ]]; then
+        if [[ "$TARGET_BRANCH" == "master" ]]; then
+            # rdo-release.el8.rpm points to latest RDO release, use that for master
+            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+        else
+            # For stable branches use corresponding release rpm
+            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+        fi
+    elif [[ $DISTRO == "rhel9" ]]; then
+        sudo curl -L -o /etc/yum.repos.d/delorean-deps.repo http://trunk.rdoproject.org/centos9-master/delorean-deps.repo
     fi
     sudo dnf -y update
 }
@@ -385,6 +389,10 @@ if [[ $DISTRO == "rhel8" ]]; then
     # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
     # Patch: https://github.com/rpm-software-management/dnf/pull/1448
     echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
+elif [[ $DISTRO == "rhel9" ]]; then
+    sudo dnf config-manager --set-enabled crb
+    # rabbitmq and other packages are provided by RDO repositories.
+    _install_rdo
 fi
 
 # Ensure python is installed
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index c72dc89a55..259375a150 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -118,7 +118,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-if is_fedora && [[ ${DISTRO} == f* ]]; then
+if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # get-pip.py will not install over the python3-pip package in
     # Fedora 34 any more.
     #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935

From 31334f9a9b2edbdc4a7b45e2e04aaec827639d62 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 4 Nov 2021 18:30:29 +0000
Subject: [PATCH 2914/3333] nova: Use noVNC 1.3.0 when installing from source

Additionally make the repo name lowercase to match the project name in
our zuul config so that jobs can check the repo out.

Change-Id: Ic2d9c4fa837461bbc29e067a81912b5f72efd3ca
---
 lib/nova | 2 +-
 stackrc  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 9aae2c4a9c..3460c2145a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -831,7 +831,7 @@ function install_nova {
             NOVNC_WEB_DIR=/usr/share/novnc
             install_package novnc
         else
-            NOVNC_WEB_DIR=$DEST/noVNC
+            NOVNC_WEB_DIR=$DEST/novnc
             git_clone $NOVNC_REPO $NOVNC_WEB_DIR $NOVNC_BRANCH
         fi
     fi
diff --git a/stackrc b/stackrc
index 62749a7005..4fc09af9a8 100755
--- a/stackrc
+++ b/stackrc
@@ -590,8 +590,8 @@ IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironi
 IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
-NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-v1.1.0}
+NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/novnc.git}
+NOVNC_BRANCH=${NOVNC_BRANCH:-v1.3.0}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}

From fc8ef86fbe09a467ee8bcffa79760d3f1e699450 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 9 Mar 2021 17:32:25 +0000
Subject: [PATCH 2915/3333] Only write out uwsgi configs when deploying API
 services

Previously this would always happen for Nova and Cinder even if n-api
and c-api were not enabled on the host respectively.

This change stops this by placing both calls write_uwsgi_config behind
is_service_enabled checks.

Change-Id: I997685da771736dbad79bcfe4b00dbc63bd6d6b6
---
 lib/cinder | 4 +++-
 lib/nova   | 9 +++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index cefb609676..76314c1d1f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -353,7 +353,9 @@ function configure_cinder {
     # Format logging
     setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 
-    write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+    if is_service_enabled c-api; then
+        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+    fi
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
         configure_cinder_driver
diff --git a/lib/nova b/lib/nova
index 9aae2c4a9c..8109446572 100644
--- a/lib/nova
+++ b/lib/nova
@@ -488,8 +488,13 @@ function create_nova_conf {
 
     iniset $NOVA_CONF upgrade_levels compute "auto"
 
-    write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
-    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
+    if is_service_enabled n-api; then
+        write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
+    fi
+
+    if is_service_enabled n-api-meta; then
+        write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
+    fi
 
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"

From 418535883763cb31e54ab3882ee3eacc42afd4f3 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 6 Jul 2021 12:05:31 +0200
Subject: [PATCH 2916/3333] Install OVS from source when it was configured like
 that

Function _neutron_ovs_base_install_agent_packages always tried to
install openvswitch from packages and start it using systemd units.
That was failing when ovs was expected to be installed from source.
This patch fixes that.

Change-Id: Iae8625dd800d30061ea3dbed9eb0dfbe16f21572
---
 lib/neutron_plugins/ovn_agent  | 13 +++------
 lib/neutron_plugins/ovs_base   | 49 +++++++++++++++++++++-------------
 lib/neutron_plugins/ovs_source |  1 +
 3 files changed, 35 insertions(+), 28 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 1f737fb58b..c0bba2c370 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -24,11 +24,6 @@ source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
 # Load devstack ovs compliation and loading functions
 source ${TOP_DIR}/lib/neutron_plugins/ovs_source
 
-# Defaults
-# --------
-
-Q_BUILD_OVS_FROM_GIT=$(trueorfalse True Q_BUILD_OVS_FROM_GIT)
-
 # Set variables for building OVN from source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
@@ -74,6 +69,9 @@ OVN_UUID=${OVN_UUID:-}
 # unless the distro kernel includes ovs+conntrack support.
 OVN_BUILD_MODULES=$(trueorfalse False OVN_BUILD_MODULES)
 OVN_BUILD_FROM_SOURCE=$(trueorfalse False OVN_BUILD_FROM_SOURCE)
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    Q_BUILD_OVS_FROM_GIT=True
+fi
 
 # Whether or not to install the ovs python module from ovs source.  This can be
 # used to test and validate new ovs python features.  This should only be used
@@ -341,11 +339,6 @@ function ovn_sanity_check {
 
 # install_ovn() - Collect source and prepare
 function install_ovn {
-    if [[ "$Q_BUILD_OVS_FROM_GIT" == "False" ]]; then
-        echo "Installation of OVS from source disabled."
-        return 0
-    fi
-
     echo "Installing OVN and dependent packages"
 
     # Check the OVN configuration
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 2e63fe3c7b..8acf586189 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -7,6 +7,12 @@
 _XTRACE_NEUTRON_OVS_BASE=$(set +o | grep xtrace)
 set +o xtrace
 
+# Load devstack ovs compliation and loading functions
+source ${TOP_DIR}/lib/neutron_plugins/ovs_source
+
+# Defaults
+# --------
+
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
 # OVS recognize default 'system' datapath or 'netdev' for userspace datapath
 OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-system}
@@ -60,26 +66,33 @@ function _neutron_ovs_base_install_ubuntu_dkms {
 }
 
 function _neutron_ovs_base_install_agent_packages {
-    # Install deps
-    install_package $(get_packages "openvswitch")
-    if is_ubuntu; then
-        _neutron_ovs_base_install_ubuntu_dkms
-        restart_service openvswitch-switch
-    elif is_fedora; then
-        restart_service openvswitch
-        sudo systemctl enable openvswitch
-    elif is_suse; then
-        if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
+    if [ "$Q_BUILD_OVS_FROM_GIT" == "True" ]; then
+        remove_ovs_packages
+        compile_ovs False /usr /var
+        load_conntrack_gre_module
+        start_new_ovs
+    else
+        # Install deps
+        install_package $(get_packages "openvswitch")
+        if is_ubuntu; then
+            _neutron_ovs_base_install_ubuntu_dkms
             restart_service openvswitch-switch
-        else
-            # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
-            if [[ $DISTRO =~ "tumbleweed" ]]; then
-                sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
+        elif is_fedora; then
+            restart_service openvswitch
+            sudo systemctl enable openvswitch
+        elif is_suse; then
+            if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
+                restart_service openvswitch-switch
+            else
+                # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
+                if [[ $DISTRO =~ "tumbleweed" ]]; then
+                    sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
+                fi
+                restart_service openvswitch || {
+                    journalctl -xe || :
+                    systemctl status openvswitch
+                }
             fi
-            restart_service openvswitch || {
-                journalctl -xe || :
-                systemctl status openvswitch
-            }
         fi
     fi
 }
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 08951d175d..9c87dce551 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -14,6 +14,7 @@
 
 # Defaults
 # --------
+Q_BUILD_OVS_FROM_GIT=$(trueorfalse False Q_BUILD_OVS_FROM_GIT)
 
 # Set variables for building OVS from source
 OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}

From c3b7051387d4332f956148c5676383499fa31859 Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Fri, 6 Aug 2021 14:26:37 -0400
Subject: [PATCH 2917/3333] Add option to set chap algorithms for iscsid for
 FIPS

The default CHAP algorithm for iscsid is md5, which is disallowed
under fips.  We will set the chap algorithm to "SHA3-256,SHA256",
which should work under all configurations.

Change-Id: Ide186fb53b3f9826ff602cb7fb797f245a15033a
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index 5fcccffec1..1420183a19 100644
--- a/lib/nova
+++ b/lib/nova
@@ -315,6 +315,10 @@ EOF
             sudo systemctl daemon-reload
         fi
 
+        # set chap algorithms.  The default chap_algorithm is md5 which will
+        # not work under FIPS
+        iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
+
         # ensure that iscsid is started, even when disabled by default
         restart_service iscsid
     fi

From 24b65adc9cedff9c7a8ab412fb39613ef5d4a627 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 22 Jun 2021 15:31:46 +0200
Subject: [PATCH 2918/3333] Deploy Neutron with enforced new RBAC rules

This patch adds new config option NEUTRON_ENFORCE_NEW_DEFAULTS which
if set to True will deploy Neutron with enforce new rbac defaults and
scopes.
It will also use SYSTEM_ADMIN user to interact with Neutron where it is
needed.

Depends-On: https://review.opendev.org/c/openstack/neutron/+/798821

Change-Id: I14d934f0deced34d74003b92824cad3c44ec4f5e
---
 .zuul.yaml                      |  1 +
 lib/neutron                     | 19 ++++++++++
 lib/neutron-legacy              | 18 ++++++++++
 lib/neutron_plugins/services/l3 | 62 +++++++++++++++++++++------------
 lib/tempest                     | 10 ++++--
 5 files changed, 85 insertions(+), 25 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3945faf82e..b5ab1277b6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -609,6 +609,7 @@
         # Keep enabeling the services here to run with system scope
         CINDER_ENFORCE_SCOPE: true
         GLANCE_ENFORCE_SCOPE: true
+        NEUTRON_ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode
diff --git a/lib/neutron b/lib/neutron
index 885df97f7c..15d548e33d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -37,6 +37,11 @@ NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 
+# If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
+# and "enforce_new_defaults" to True in the Neutron's config to enforce usage
+# of the new RBAC policies and scopes.
+NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
+
 NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
 # Distributed Virtual Router (DVR) configuration
 # Can be:
@@ -232,6 +237,7 @@ function configure_neutron_new {
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
             neutron_ml2_extension_driver_add port_security
         fi
+        configure_rbac_policies
     fi
 
     # Neutron OVS or LB agent
@@ -612,6 +618,19 @@ function configure_neutron {
     fi
 }
 
+# configure_rbac_policies() - Configure Neutron to enforce new RBAC
+# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
+function configure_rbac_policies {
+    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
+        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+    else
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
+        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+    fi
+}
+
+
 function configure_neutron_nova {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index a5a608df72..b906a1b2ff 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -90,6 +90,11 @@ NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
+# If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
+# and "enforce_new_defaults" to True in the Neutron's config to enforce usage
+# of the new RBAC policies and scopes.
+NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -489,6 +494,19 @@ function configure_neutron_after_post_config {
     if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
         iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
     fi
+    configure_rbac_policies
+}
+
+# configure_rbac_policies() - Configure Neutron to enforce new RBAC
+# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
+function configure_rbac_policies {
+    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
+        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+    else
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
+        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+    fi
 }
 
 # Start running OVN processes
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 72f7a32b26..ccb5398f75 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -100,6 +100,11 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
+NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
+if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
+fi
+
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
 
 default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
@@ -151,6 +156,10 @@ function create_neutron_initial_network {
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
 
+    local admin_project_id
+    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
+    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
+
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
@@ -159,10 +168,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
             fi
         fi
     fi
@@ -170,14 +179,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -187,7 +196,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -197,7 +206,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -215,11 +224,11 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create $Q_ROUTER_NAME --project $admin_project_id | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
@@ -229,9 +238,9 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} --project $admin_project_id | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --project $admin_project_id | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -258,11 +267,12 @@ function _neutron_create_private_subnet_v4 {
     if [[ -n "$NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $NETWORK_GATEWAY "
     fi
+
     subnet_params+="${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} "
     subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -285,14 +295,17 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local subnet_params="--ip-version 4 "
+    local admin_project_id
+    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
+    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
+    local subnet_params="--ip-version 4 --project $admin_project_id"
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
@@ -300,26 +313,29 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
     subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip-version 6 "
+    local admin_project_id
+    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
+    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
+    local subnet_params="--ip-version 6 --project $admin_project_id "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
     subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
+    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -327,7 +343,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using OVN or the l3-agent for layer 3
     if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
@@ -354,7 +370,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+            ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
         fi
         _neutron_set_router_id
@@ -363,7 +379,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
+    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -375,7 +391,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
@@ -396,7 +412,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+        IPV6_ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -424,7 +440,7 @@ function _neutron_configure_router_v6 {
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
-    EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
+    EXT_LIST=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
 
diff --git a/lib/tempest b/lib/tempest
index 8fd54c5d5e..ab802171d1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -90,6 +90,10 @@ TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 # it will run tempest with
 TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 
+NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
+if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
+fi
 
 # Functions
 # ---------
@@ -287,8 +291,8 @@ function configure_tempest {
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack --os-cloud devstack-admin network show -f value -c id $PUBLIC_NETWORK_NAME)
         # make sure shared network presence does not confuses the tempest tests
-        openstack --os-cloud devstack-admin network create --share shared
-        openstack --os-cloud devstack-admin subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
+        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --share shared --project "$admin_project_id"
+        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet --project "$admin_project_id"
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
@@ -443,6 +447,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
+    iniset $TEMPEST_CONFIG enforce_scope neutron "$NEUTRON_ENFORCE_SCOPE"
+
     # Scenario
     SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
     SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME

From 7880ba665e2d594b2eabb0533e6dca52e042ca50 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Wed, 31 Mar 2021 04:58:28 +0000
Subject: [PATCH 2919/3333] openEuler 20.03 LTS SP2 support

openEuler is an open-source Linux based operating system. The current
openEuler kernel is based on Linux and supports multi arch, such as X86_64
and aarch64. It fully unleashes the potential of computing chips. As an
efficient, stable, and secure open-source OS built by global open-source
contributors, openEuler applies to database, big data, cloud computing,
and AI scenarios. openEuler is using RPM for package management.

Note:
Currently there is no available package for uwsgi-plugin-python3 and ovn, so that
openEuler needs manually install them from source.

Website: https://www.openeuler.org/en/

Change-Id: I169a0017998054604a63ac6c177d0f43f8a32ba6
Co-Authored-By: wangxiyuan <wangxiyuan1007@gmail.com>
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 .zuul.yaml                             | 25 +++++++++++++++++++++++++
 doc/source/index.rst                   |  2 +-
 files/rpms/ceph                        |  2 +-
 files/rpms/general                     |  4 +++-
 files/rpms/nova                        |  2 +-
 files/rpms/swift                       |  2 +-
 functions-common                       | 14 ++++++++++++--
 lib/apache                             | 16 +++-------------
 lib/nova_plugins/functions-libvirt     |  2 +-
 roles/apache-logs-conf/tasks/main.yaml |  1 +
 stack.sh                               |  8 +++++++-
 tools/fixup_stuff.sh                   | 24 ++++++++++++++++++++++++
 12 files changed, 80 insertions(+), 22 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3945faf82e..a4385572bc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -106,6 +106,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-openeuler-20.03-sp2
+    nodes:
+      - name: controller
+        label: openEuler-20-03-LTS-SP2
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -683,6 +693,20 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
+- job:
+    name: devstack-platform-openEuler-20.03-SP2
+    parent: tempest-full-py3
+    description: openEuler 20.03 SP2 platform test
+    nodeset: devstack-single-node-openeuler-20.03-sp2
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
+        # from source instead.
+        OVN_BUILD_FROM_SOURCE: True
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -788,6 +812,7 @@
         - devstack-platform-centos-8-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
+        - devstack-platform-openEuler-20.03-SP2
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 08ce4cb061..feb50ce4e9 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
+latest/current Fedora version, CentOS/RHEL 8, OpenSUSE and openEuler.
 
 If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 33a55f80ea..93b5746aa6 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core # not:rhel9
+redhat-lsb-core # not:rhel9,openEuler-20.03
 xfsprogs
diff --git a/files/rpms/general b/files/rpms/general
index 33da0a5385..163a7c8f24 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -16,6 +16,7 @@ libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
+make # dist:openEuler-20.03
 net-tools
 openssh-server
 openssl
@@ -27,7 +28,8 @@ psmisc
 python3-devel
 python3-pip
 python3-systemd
-redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
+redhat-rpm-config # not:openEuler-20.03    missing dep for gcc hardening flags, see rhbz#1217376
+systemd-devel # dist:openEuler-20.03
 tar
 tcpdump
 unzip
diff --git a/files/rpms/nova b/files/rpms/nova
index 9522e5729d..9e8621c628 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -6,7 +6,7 @@ ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
-kernel-modules
+kernel-modules # not:openEuler-20.03
 kpartx
 parted
 polkit
diff --git a/files/rpms/swift b/files/rpms/swift
index b6009a321e..faf0a3175a 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,5 +1,5 @@
 curl
-liberasurecode-devel
+liberasurecode-devel # not:openEuler-20.03
 memcached
 rsync-daemon
 sqlite
diff --git a/functions-common b/functions-common
index 80f43554d0..e593328f37 100644
--- a/functions-common
+++ b/functions-common
@@ -388,7 +388,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core
+        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -459,6 +459,10 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
+    elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
+        # The DISTRO here is `openEuler-20.03`. While, actually only openEuler
+        # 20.03 LTS SP2 is fully tested. Other SP version maybe have bugs.
+        DISTRO="openEuler-$os_RELEASE"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -510,6 +514,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
@@ -558,7 +563,12 @@ function is_ubuntu {
     [ "$os_PACKAGE" = "deb" ]
 }
 
-
+function is_openeuler {
+    if [[ -z "$os_PACKAGE" ]]; then
+        GetOSVersion
+    fi
+    [ "$os_VENDOR" = "openEuler" ]
+}
 # Git Functions
 # =============
 
diff --git a/lib/apache b/lib/apache
index 4bea07dc55..cbe61adf34 100644
--- a/lib/apache
+++ b/lib/apache
@@ -82,19 +82,10 @@ function install_apache_uwsgi {
         apxs="apxs"
     fi
 
-    # This varies based on packaged/installed.  If we've
-    # pip_installed, then the pip setup will only build a "python"
-    # module that will be either python2 or python3 depending on what
-    # it was built with.
-    #
-    # For package installs, the distro ships both plugins and you need
-    # to select the right one ... it will not be autodetected.
-    UWSGI_PYTHON_PLUGIN=python3
-
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
         install_package ${pkg_list}
-    elif is_fedora; then
+    elif is_fedora && ! is_openeuler; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
@@ -122,7 +113,6 @@ function install_apache_uwsgi {
         popd
         # delete the temp directory
         sudo rm -rf $dir
-        UWSGI_PYTHON_PLUGIN=python
     fi
 
     if is_ubuntu || is_suse ; then
@@ -283,7 +273,7 @@ function write_uwsgi_config {
     # configured after graceful shutdown
     iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
+    iniset "$file" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
@@ -336,7 +326,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi die-on-term true
     iniset "$file" uwsgi exit-on-reload false
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
+    iniset "$file" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 63882e05fe..3e7d2801d6 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -90,7 +90,7 @@ function install_libvirt {
         install_package libvirt libvirt-devel python3-libvirt
 
         if is_arch "aarch64"; then
-            install_package edk2.git-aarch64
+            install_package edk2-aarch64
         fi
     fi
 
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index bd64574c9b..6b7ea37857 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,6 +64,7 @@
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
       'RedHat': '/etc/httpd/conf.d/'
+      'openEuler': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:
diff --git a/stack.sh b/stack.sh
index a10e6eff25..cb16fda998 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
+SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -278,6 +278,12 @@ chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
 
+# TODO(wxy): Currently some base packages are not installed by default in
+# openEuler. Remove the code below once the packaged are installed by default
+# in the future.
+if [[ $DISTRO == "openEuler-20.03" ]]; then
+    install_package hostname
+fi
 
 # Configure Distro Repositories
 # -----------------------------
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index fe5dafa994..750849db68 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -148,8 +148,32 @@ function fixup_ubuntu {
     sudo rm -rf /usr/lib/python3/dist-packages/simplejson-*.egg-info
 }
 
+function fixup_openeuler {
+    if ! is_openeuler; then
+        return
+    fi
+
+    if is_arch "x86_64"; then
+        arch="x86_64"
+    elif is_arch "aarch64"; then
+        arch="aarch64"
+    fi
+
+    # Some packages' version in openEuler are too old, use the newer ones we
+    # provide in oepkg. (oepkg is an openEuler third part yum repo which is
+    # endorsed by openEuler community)
+    (echo '[openstack-ci]'
+    echo 'name=openstack'
+    echo 'baseurl=https://repo.oepkgs.net/openEuler/rpm/openEuler-20.03-LTS-SP2/budding-openeuler/openstack-master-ci/'$arch'/'
+    echo 'enabled=1'
+    echo 'gpgcheck=0') | sudo tee -a /etc/yum.repos.d/openstack-master.repo > /dev/null
+
+    yum_install liberasurecode-devel
+}
+
 function fixup_all {
     fixup_ubuntu
     fixup_fedora
     fixup_suse
+    fixup_openeuler
 }

From 588894753971c32f6fff9b2158c3427b012cf9ec Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 22 Dec 2021 16:00:29 +0100
Subject: [PATCH 2920/3333] Clean up compile_ovn function's parameters

That function was accepting 3 positional arguments and first
of them was boolean value "build_modules" which isn't used anywhere in
that function.
So this patch cleans it a bit by removing that not used parameter.

Change-Id: I5c57b9116338a63b7bfb170c02e33bb4eae725da
---
 lib/neutron_plugins/ovn_agent | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 3fc38288f1..099b639458 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -294,16 +294,13 @@ function _disable_libvirt_apparmor {
 
 # compile_ovn() - Compile OVN from source and load needed modules
 #                 Accepts three parameters:
-#                   - first optional is False by default and means that
-#                     modules are built and installed.
-#                   - second optional parameter defines prefix for
+#                   - first optional parameter defines prefix for
 #                     ovn compilation
-#                   - third optional parameter defines localstatedir for
+#                   - second optional parameter defines localstatedir for
 #                     ovn single machine runtime
 function compile_ovn {
-    local build_modules=${1:-False}
-    local prefix=$2
-    local localstatedir=$3
+    local prefix=$1
+    local localstatedir=$2
 
     if [ -n "$prefix" ]; then
         prefix="--prefix=$prefix"
@@ -381,7 +378,7 @@ function install_ovn {
 
         compile_ovs $OVN_BUILD_MODULES
         if use_new_ovn_repository; then
-            compile_ovn $OVN_BUILD_MODULES
+            compile_ovn
         fi
 
         sudo mkdir -p $OVS_PREFIX/var/log/openvswitch

From 353c3f9cb1e70929898116b0b6c0020c43d93aea Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 23 Dec 2021 12:01:44 +0100
Subject: [PATCH 2921/3333] Fix stacking without preconfigured
 DATABASE_PASSWORD

When we need to read a DATABASE_PASSWORD from the user, make sure we
actually use it in our database URLs.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5ebf6b0280e82f2c87a63cbee7a9957c6bd26898
---
 lib/database | 6 ++++--
 stack.sh     | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/database b/lib/database
index 7940cf2208..78563f6f6d 100644
--- a/lib/database
+++ b/lib/database
@@ -89,6 +89,10 @@ function initialize_database_backends {
         DATABASE_PASSWORD=$MYSQL_PASSWORD
     fi
 
+    return 0
+}
+
+function define_database_baseurl {
     # We configure Nova, Horizon, Glance and Keystone to use MySQL as their
     # database server.  While they share a single server, each has their own
     # database and tables.
@@ -100,8 +104,6 @@ function initialize_database_backends {
 
     # NOTE: Don't specify ``/db`` in this string so we can use it for multiple services
     BASE_SQL_CONN=${BASE_SQL_CONN:-$(get_database_type_$DATABASE_TYPE)://$DATABASE_USER:$DATABASE_PASSWORD@$DATABASE_HOST}
-
-    return 0
 }
 
 # Recreate a given database
diff --git a/stack.sh b/stack.sh
index a10e6eff25..6b5625e922 100755
--- a/stack.sh
+++ b/stack.sh
@@ -691,6 +691,8 @@ if initialize_database_backends; then
     # Last chance for the database password. This must be handled here
     # because read_password is not a library function.
     read_password DATABASE_PASSWORD "ENTER A PASSWORD TO USE FOR THE DATABASE."
+
+    define_database_baseurl
 else
     echo "No database enabled"
 fi

From 134205c1388ac69169698ff2fe36cba23044ff62 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 23 Dec 2021 12:26:36 +0100
Subject: [PATCH 2922/3333] Don't enable the dstat service in CI jobs

We still are seeing regular job failures because the pcp package fails
to install. Assume that we can still enable it on demand when someone
needs to debug specific job issues, let us just disable it by default.

Related-Bug: 1943184
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I32ef8038e21c818623db9389588b3c6d3f98dcad
---
 .zuul.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b5ab1277b6..e5ef7ee080 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -432,7 +432,7 @@
         PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}'
       devstack_services:
         # Shared services
-        dstat: true
+        dstat: false
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -441,7 +441,7 @@
       subnode:
         devstack_services:
           # Shared services
-          dstat: true
+          dstat: false
           memory_tracker: true
         devstack_localrc:
           # Multinode specific settings
@@ -507,7 +507,7 @@
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
         # Shared services
-        dstat: true
+        dstat: false
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -557,7 +557,7 @@
           # Core services enabled for this branch.
           # This list replaces the test-matrix.
           # Shared services
-          dstat: true
+          dstat: false
           memory_tracker: true
           tls-proxy: true
           # Nova services

From 05e622ead243325658ae5aff5b5b53ce60135c57 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 29 Dec 2021 12:30:01 +0530
Subject: [PATCH 2923/3333] Use upper-constraints from in review changes

Currently upper-constraints.txt is not getting used
from in-review changes of requirements project and
leading to merge of broken requirements[1].

Use master branch to fetch constraints instead of
the remote branch.

[1] https://review.opendev.org/c/openstack/requirements/+/822575

Depends-On: https://review.opendev.org/c/openstack/requirements/+/823128
Change-Id: I5d42ac6b54bf20804d7e5faa39d1289102318b64
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index ab802171d1..bdbd3caec8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -119,7 +119,7 @@ function set_tempest_venv_constraints {
     local tmp_c
     tmp_c=$1
     if [[ $TEMPEST_VENV_UPPER_CONSTRAINTS == "master" ]]; then
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_c
+        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > $tmp_c
     else
         echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
         cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c

From c1a75c6a504d720e9d46f924f5c3da07fddfee72 Mon Sep 17 00:00:00 2001
From: Miguel Lavalle <mlavalle@redhat.com>
Date: Fri, 31 Dec 2021 16:14:23 -0600
Subject: [PATCH 2924/3333] Fix mysqladmin failure for Fedora 34 and mariadb

mysqladmin is incorrectly installed in Fedora 34 with mariadb. This
causes the failure of Zuul Fedora based jobs. The issue is a conflict
between mariadb and community mysql that is described in [1] and [2].

The workaround is to explicitly install package "mariadb"

Also configure an increased swap size like for the other platform jobs
in order to avoid OOM issues.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2026933
[2] https://lists.launchpad.net/maria-discuss/msg06179.html

Closes-Bug: #1956116
Change-Id: Icf6d7e1af5130689ea10b29d37cc9b188b2c9754
---
 .zuul.yaml          | 3 +++
 lib/databases/mysql | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2c55b545e0..272018fa06 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -725,6 +725,8 @@
     description: Fedora latest platform test
     nodeset: devstack-single-node-fedora-latest
     voting: false
+    vars:
+      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview
@@ -733,6 +735,7 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
     vars:
+      configure_swap_size: 4096
       devstack_localrc:
         ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
 
diff --git a/lib/databases/mysql b/lib/databases/mysql
index d0fa1199a7..8edbf8c4a4 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -178,7 +178,7 @@ EOF
     if is_oraclelinux; then
         install_package mysql-community-server
     elif is_fedora; then
-        install_package mariadb-server mariadb-devel
+        install_package mariadb-server mariadb-devel mariadb
         sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_suse; then
         install_package mariadb-server

From 2ef4a4c8516bc6373bc7f4cafee62db715144952 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 3 Jan 2022 15:13:44 +0100
Subject: [PATCH 2925/3333] Fix tempest upper-constraints

When deploying devstack in a stable branch, the master branch is
available locally only in a CI environment where Zuul prepares all
available branches. For a non-CI deployment we need to stick to using
the remote branch as was the case before [0].

While the situation on the master branch isn't really broken, we apply
the fix here anyway so that future stable branches are created in a
working state.

[0] I5d42ac6b54bf20804d7e5faa39d1289102318b64

Closes-Bug: #1956219
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Ib7719cb2d48b34db70f885e0afe77d904abba3b5
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index bdbd3caec8..adffeda371 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -119,7 +119,9 @@ function set_tempest_venv_constraints {
     local tmp_c
     tmp_c=$1
     if [[ $TEMPEST_VENV_UPPER_CONSTRAINTS == "master" ]]; then
-        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > $tmp_c
+        (cd $REQUIREMENTS_DIR &&
+            git show master:upper-constraints.txt 2>/dev/null ||
+            git show origin/master:upper-constraints.txt) > $tmp_c
     else
         echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
         cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c

From 4448f243f396c502e34fda5bb148ba0224f934e7 Mon Sep 17 00:00:00 2001
From: Eduardo Santos <eduardo.experimental@gmail.com>
Date: Thu, 6 Jan 2022 14:03:16 -0300
Subject: [PATCH 2926/3333] Fix public subnet creation command

There was no space after the --project option in the command that
creates the public subnet, thus if any option follows, the option itself
will be parsed as part of the value passed to the --project option. This
change just adds the missing space.

Change-Id: I1e7375578342a82717222e902fcd65a4a62e33a7
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ccb5398f75..a8844c475e 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -305,7 +305,7 @@ function _neutron_create_public_subnet_v4 {
     local admin_project_id
     admin_project_id=$(openstack project list | grep " admin " | get_field 1)
     die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-    local subnet_params="--ip-version 4 --project $admin_project_id"
+    local subnet_params="--ip-version 4 --project $admin_project_id "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "

From ac958698d0e29cc0bc4bbad4476fc7bc01ed870d Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Wed, 5 Jan 2022 16:23:46 -0500
Subject: [PATCH 2927/3333] Only set chap algorithms if not openeuler

For some reason, setting the CHAPAlgorithms as in c3b705138
breaks OpenEuler.  Making this conditional so that tests continue
to pass.

Change-Id: Iaa740ecfbb9173dd97e90485bad88225caedb523
---
 lib/nova | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5a12da6731..4f98d4d52c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -320,8 +320,12 @@ EOF
         fi
 
         # set chap algorithms.  The default chap_algorithm is md5 which will
-        # not work under FIPS
-        iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
+        # not work under FIPS.
+        # FIXME(alee) For some reason, this breaks openeuler.  Openeuler devs should weigh in
+        # and determine the correct solution for openeuler here
+        if ! is_openeuler; then
+            iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
+        fi
 
         # ensure that iscsid is started, even when disabled by default
         restart_service iscsid

From 807330ac370e8d0130cea2a99363cd3299422837 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 7 Jan 2022 11:40:54 +0100
Subject: [PATCH 2928/3333] Fix cloning requirements when GIT_DEPTH is set

We always need the master branch of requirements in order to be able to
install tempest with it, so override GIT_DEPTH when cloning that repo.

Closes-Bug: 1956616
Change-Id: Id0b409bfadd73f2c30314724178d6e199121050b
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 0659212ab3..c92cc79b40 100755
--- a/stack.sh
+++ b/stack.sh
@@ -765,7 +765,9 @@ save_stackenv $LINENO
 # Bring down global requirements before any use of pip_install. This is
 # necessary to ensure that the constraints file is in place before we
 # attempt to apply any constraints to pip installs.
-git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
+# We always need the master branch in addition to any stable branch, so
+# override GIT_DEPTH here.
+GIT_DEPTH=0 git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
 
 # Install package requirements
 # Source it so the entire environment is available

From cc6e20b24d22475720f7b938aa08edf9ee7514fb Mon Sep 17 00:00:00 2001
From: Carlos Camacho <carloscamachoucv@gmail.com>
Date: Fri, 7 Jan 2022 15:30:56 +0100
Subject: [PATCH 2929/3333] Allow skip the database server installation

This patch allows to skip the installation
of the database backend packages (MySQL or Postgres)
with the introduction of the INSTALL_DATABASE_SERVER_PACKAGES
variable (defaulted to True).
This is useful in such environments that do not require
to install the MySQL/Postgres server packages directly but using
a container serving that purpose, for those cases all the
remaining steps should be executed just skipping the
packages install.

Change-Id: I26628a31fdda3ce95ed04a2b7ae7b132c288581f
---
 lib/databases/mysql      | 27 +++++++++++++++------------
 lib/databases/postgresql | 20 +++++++++++---------
 2 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 8edbf8c4a4..30e4b7c496 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -12,6 +12,7 @@ _XTRACE_DB_MYSQL=$(set +o | grep xtrace)
 set +o xtrace
 
 MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
+INSTALL_DATABASE_SERVER_PACKAGES=$(trueorfalse True INSTALL_DATABASE_SERVER_PACKAGES)
 
 register_database mysql
 
@@ -175,18 +176,20 @@ EOF
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
-    if is_oraclelinux; then
-        install_package mysql-community-server
-    elif is_fedora; then
-        install_package mariadb-server mariadb-devel mariadb
-        sudo systemctl enable $MYSQL_SERVICE_NAME
-    elif is_suse; then
-        install_package mariadb-server
-        sudo systemctl enable $MYSQL_SERVICE_NAME
-    elif is_ubuntu; then
-        install_package $MYSQL_SERVICE_NAME-server
-    else
-        exit_distro_not_supported "mysql installation"
+    if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
+        if is_oraclelinux; then
+            install_package mysql-community-server
+        elif is_fedora; then
+            install_package mariadb-server mariadb-devel mariadb
+            sudo systemctl enable $MYSQL_SERVICE_NAME
+        elif is_suse; then
+            install_package mariadb-server
+            sudo systemctl enable $MYSQL_SERVICE_NAME
+        elif is_ubuntu; then
+            install_package $MYSQL_SERVICE_NAME-server
+        else
+            exit_distro_not_supported "mysql installation"
+        fi
     fi
 }
 
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 1f347f5548..4f0a5a0a4c 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -13,7 +13,7 @@ set +o xtrace
 
 
 MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
-
+INSTALL_DATABASE_SERVER_PACKAGES=$(trueorfalse True INSTALL_DATABASE_SERVER_PACKAGES)
 
 register_database postgresql
 
@@ -104,15 +104,17 @@ EOF
     else
         sed -i "s/:root:\w\+/:root:$DATABASE_PASSWORD/" $pgpass
     fi
-    if is_ubuntu; then
-        install_package postgresql
-    elif is_fedora || is_suse; then
-        install_package postgresql-server
-        if is_fedora; then
-            sudo systemctl enable postgresql
+    if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
+        if is_ubuntu; then
+            install_package postgresql
+        elif is_fedora || is_suse; then
+            install_package postgresql-server
+            if is_fedora; then
+                sudo systemctl enable postgresql
+            fi
+        else
+            exit_distro_not_supported "postgresql installation"
         fi
-    else
-        exit_distro_not_supported "postgresql installation"
     fi
 }
 

From c994dc4de23620f74b750932e060306a27193add Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Thu, 6 Jan 2022 11:28:55 +0100
Subject: [PATCH 2930/3333] Deprecate lib/neutron

lib/neutron-legacy was recently undeprecated (see [0]), Openstack CI
uses neutron-legacy and latest work was done in it also.
To avoid double maintenance lib/neutron can be deprecated.

For latest discussion see [1] and [2].

[0]: https://review.opendev.org/c/openstack/devstack/+/704829
[1]: https://meetings.opendev.org/meetings/networking/2022/networking.2022-01-04-14.04.log.html#l-52
[2]: https://meetings.opendev.org/irclogs/%23openstack-qa/%23openstack-qa.2022-01-05.log.html#t2022-01-05T15:57:37

Related-Bug: #1955765
Change-Id: I3fc328b7f47ccd7c1a97cceeea98fb2fbd609017
---
 lib/neutron | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 15d548e33d..e7719d4ebc 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -146,6 +146,7 @@ fi
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
     if is_neutron_ovs_base_plugin; then
         neutron_ovs_base_cleanup
@@ -169,6 +170,7 @@ function configure_root_helper_options {
 
 # configure_neutron() - Set config files, create data dirs, etc
 function configure_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
     (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
@@ -359,6 +361,7 @@ function configure_neutron_rootwrap {
 # Takes a single optional argument which is the config file to update,
 # if not passed $NOVA_CONF is used.
 function configure_neutron_nova_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
@@ -385,6 +388,7 @@ function configure_neutron_nova_new {
 
 # create_neutron_accounts() - Create required service accounts
 function create_neutron_accounts_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local neutron_url
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
@@ -408,6 +412,7 @@ function create_neutron_accounts_new {
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     recreate_database neutron
 
     time_start "dbsync"
@@ -418,6 +423,7 @@ function init_neutron_new {
 
 # install_neutron() - Collect source and prepare
 function install_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
 
@@ -491,6 +497,7 @@ function start_neutron_api {
 
 # start_neutron() - Start running processes
 function start_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     # Start up the neutron agents if enabled
     # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
     # can resolve the $NEUTRON_AGENT_BINARY
@@ -528,6 +535,7 @@ function start_neutron_new {
 
 # stop_neutron() - Stop running processes
 function stop_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     for serv in neutron-api neutron-agent neutron-l3; do
         stop_process $serv
     done
@@ -550,6 +558,7 @@ function stop_neutron_new {
 
 # neutron_service_plugin_class_add() - add service plugin class
 function neutron_service_plugin_class_add_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local service_plugin_class=$1
     local plugins=""
 
@@ -574,11 +583,13 @@ function _neutron_ml2_extension_driver_add {
 }
 
 function neutron_server_config_add_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
 }
 
 # neutron_deploy_rootwrap_filters() - deploy rootwrap filters
 function neutron_deploy_rootwrap_filters_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local srcdir=$1
     sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
     sudo install -o root -g root -m 644 $srcdir/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d

From d5d0bed479497560489983ae1fc80444b44fe029 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 17 Jan 2022 12:04:16 +0530
Subject: [PATCH 2931/3333] Workaround CentOS 8-stream bug until fixed

Recent iputils release in CentOS 8-stream causing
ping failures with non root user. This needs a fix
in systemd package as mentioned in the Related Bugs,
until it's fixed and is in 8-stream mirrors let's
workaround it by setting net.ipv4.ping_group_range
setting manually.

Related-Bug: #1957941
Related-Bug: rhbz#2037807
Change-Id: I0d8dac910647968b625020c2a94e626ba5255058
---
 tools/fixup_stuff.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 750849db68..f24ac40ad5 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -83,6 +83,11 @@ function fixup_fedora {
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools
     fi
+    # Workaround CentOS 8-stream iputils and systemd Bug
+    # https://bugzilla.redhat.com/show_bug.cgi?id=2037807
+    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
+        sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
+    fi
 }
 
 function fixup_suse {

From 0a31630323cc172561d6544c8bee50004538cfb2 Mon Sep 17 00:00:00 2001
From: Pierre Riteau <pierre@stackhpc.com>
Date: Fri, 21 Jan 2022 10:07:07 +0100
Subject: [PATCH 2932/3333] Adapt compute node local.conf to OVN

The default Neutron configuration is now using OVN, but the multinode
lab was using an incompatible configuration:

    The q-agt/neutron-agt service must be disabled with OVN.

Change-Id: I518a739a3daac941880463cde6b47951331d0911
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c0b3f58157..f62e7a969c 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -169,7 +169,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,q-agt,c-vol,placement-client
+    ENABLED_SERVICES=n-cpu,c-vol,placement-client,ovn-controller,ovs-vswitchd,ovsdb-server,q-ovn-metadata-agent
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
     VNCSERVER_LISTEN=$HOST_IP

From d6909e41af4b776e68fb133a31ff086fdaff38ff Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sat, 22 Jan 2022 13:54:12 +0100
Subject: [PATCH 2933/3333] Use distro pip on Ubuntu

Running get-pip.py fails on Ubuntu when running twice, e.g. after a
unstack/stack cycle. Just use distro pip instead.

Closes-Bug: #1957048
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I87a8d53ed8860dd017a6c826dee6b6f4baef3c96
---
 tools/install_pip.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 259375a150..5d73a1f0d8 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -129,6 +129,8 @@ if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # For general sanity, we just use the packaged pip.  It should be
     # recent enough anyway.  This is included via rpms/general
     : # Simply fall through
+elif is_ubuntu; then
+    : # pip on Ubuntu 20.04 is new enough, too
 else
     install_get_pip
 fi

From ae40825df618a6b8164be8345f5cc1b11a2dc614 Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Tue, 26 Oct 2021 10:37:07 +0200
Subject: [PATCH 2934/3333] Use devstack-system-admin for keystone objects
 creation

This is needed so we can set keystone into enforcing secure RBAC.
This also adjusts lib/glance, which already partially used
devstack-system-admin.

Change-Id: I6df8ad23a3077a8420340167a748ae23ad094962
---
 functions-common | 46 +++++++++++++++++++++++-----------------------
 lib/glance       |  6 +++---
 2 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/functions-common b/functions-common
index 7042408f40..7a83b4bc5c 100644
--- a/functions-common
+++ b/functions-common
@@ -867,10 +867,10 @@ function get_or_create_domain {
     # Gets domain id
     domain_id=$(
         # Gets domain id
-        openstack domain show $1 \
+        openstack --os-cloud devstack-system-admin domain show $1 \
             -f value -c id 2>/dev/null ||
         # Creates new domain
-        openstack domain create $1 \
+        openstack --os-cloud devstack-system-admin domain create $1 \
             --description "$2" \
             -f value -c id
     )
@@ -885,7 +885,7 @@ function get_or_create_group {
     # Gets group id
     group_id=$(
         # Creates new group with --or-show
-        openstack group create $1 \
+        openstack --os-cloud devstack-system-admin group create $1 \
             --domain $2 --description "$desc" --or-show \
             -f value -c id
     )
@@ -904,7 +904,7 @@ function get_or_create_user {
     # Gets user id
     user_id=$(
         # Creates new user with --or-show
-        openstack user create \
+        openstack --os-cloud devstack-system-admin user create \
             $1 \
             --password "$2" \
             --domain=$3 \
@@ -921,7 +921,7 @@ function get_or_create_project {
     local project_id
     project_id=$(
         # Creates new project with --or-show
-        openstack project create $1 \
+        openstack --os-cloud devstack-system-admin project create $1 \
             --domain=$2 \
             --or-show -f value -c id
     )
@@ -934,7 +934,7 @@ function get_or_create_role {
     local role_id
     role_id=$(
         # Creates role with --or-show
-        openstack role create $1 \
+        openstack --os-cloud devstack-system-admin role create $1 \
             --or-show -f value -c id
     )
     echo $role_id
@@ -964,7 +964,7 @@ function get_or_add_user_project_role {
     domain_args=$(_get_domain_args $4 $5)
 
     # Gets user role id
-    user_role_id=$(openstack role assignment list \
+    user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --project $3 \
@@ -972,11 +972,11 @@ function get_or_add_user_project_role {
         | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --user $2 \
             --project $3 \
             $domain_args
-        user_role_id=$(openstack role assignment list \
+        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --user $2 \
             --project $3 \
@@ -991,17 +991,17 @@ function get_or_add_user_project_role {
 function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
-    user_role_id=$(openstack role assignment list \
+    user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --domain $3 \
         | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --user $2 \
             --domain $3
-        user_role_id=$(openstack role assignment list \
+        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --user $2 \
             --domain $3 \
@@ -1019,7 +1019,7 @@ function get_or_add_user_system_role {
     domain_args=$(_get_domain_args $4)
 
     # Gets user role id
-    user_role_id=$(openstack role assignment list \
+    user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --system $3 \
@@ -1027,11 +1027,11 @@ function get_or_add_user_system_role {
         -f value -c Role)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --user $2 \
             --system $3 \
             $domain_args
-        user_role_id=$(openstack role assignment list \
+        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --user $2 \
             --system $3 \
@@ -1046,17 +1046,17 @@ function get_or_add_user_system_role {
 function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
-    group_role_id=$(openstack role assignment list \
+    group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --group $2 \
         --project $3 \
         -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --group $2 \
             --project $3
-        group_role_id=$(openstack role assignment list \
+        group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --group $2 \
             --project $3 \
@@ -1072,9 +1072,9 @@ function get_or_create_service {
     # Gets service id
     service_id=$(
         # Gets service id
-        openstack service show $2 -f value -c id 2>/dev/null ||
+        openstack --os-cloud devstack-system-admin service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
-        openstack service create \
+        openstack --os-cloud devstack-system-admin service create \
             $2 \
             --name $1 \
             --description="$3" \
@@ -1087,14 +1087,14 @@ function get_or_create_service {
 # Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
 function _get_or_create_endpoint_with_interface {
     local endpoint_id
-    endpoint_id=$(openstack endpoint list \
+    endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint list \
         --service $1 \
         --interface $2 \
         --region $4 \
         -c ID -f value)
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
-        endpoint_id=$(openstack endpoint create \
+        endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint create \
             $1 $2 $3 --region $4 -f value -c id)
     fi
 
@@ -1128,7 +1128,7 @@ function get_or_create_endpoint {
 # Get a URL from the identity service
 # Usage: get_endpoint_url <service> <interface>
 function get_endpoint_url {
-    echo $(openstack endpoint list \
+    echo $(openstack --os-cloud devstack-system-admin endpoint list \
             --service $1 --interface $2 \
             -c URL -f value)
 }
diff --git a/lib/glance b/lib/glance
index 4c2755f76f..9bba938b9d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -311,11 +311,11 @@ function configure_glance_quotas {
     iniset $GLANCE_API_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
     iniset $GLANCE_API_CONF oslo_limit system_scope "'all'"
     iniset $GLANCE_API_CONF oslo_limit endpoint_id \
-           $(openstack endpoint list --service glance -f value -c ID)
+           $(openstack --os-cloud devstack-system-admin endpoint list --service glance -f value -c ID)
 
     # Allow the glance service user to read quotas
-    openstack role add --user glance --user-domain Default --system all \
-              reader
+    openstack --os-cloud devstack-system-admin role add --user glance --user-domain Default \
+        --system all reader
 }
 
 # configure_glance() - Set config files, create data dirs, etc

From 5f5002a3781e255a16711f99cb784a28d6f27258 Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Tue, 26 Oct 2021 10:50:37 +0200
Subject: [PATCH 2935/3333] Revert "Revert "Add enforce_scope setting support
 for keystone""

This reverts commit 26bd94b45efb63683072006e4281dd34a313d881.

Reason for revert: Devstack keystone creation/setup are moved to
scope tokens, so we can reintroduce the scope check enable.

Change-Id: I6e1c261196dbcaf632748fb6f04e0867648b76c7
---
 lib/keystone | 11 +++++++++++
 lib/tempest  |  9 +++++++++
 2 files changed, 20 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index b953972dd3..a4c8a52121 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -124,6 +124,12 @@ KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 # Whether to create a keystone admin endpoint for legacy applications
 KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse False KEYSTONE_ADMIN_ENDPOINT)
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the Identity API policies to start checking the scope of token. By Default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -259,6 +265,11 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
+        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
+        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index adffeda371..9d5e1fce9f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -608,6 +608,15 @@ function configure_tempest {
         fi
     done
 
+    # ``enforce_scope``
+    # If services enable the enforce_scope for their policy
+    # we need to enable the same on Tempest side so that
+    # test can be run with scoped token.
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope keystone true
+        iniset $TEMPEST_CONFIG auth admin_system 'all'
+        iniset $TEMPEST_CONFIG auth admin_project_name ''
+    fi
     iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"

From be7b5bf671b4cdc082fb9b7bb73ec55cab0054dd Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 27 Jan 2022 16:04:32 +0100
Subject: [PATCH 2936/3333] Disable enforcing scopes in Neutron temporary

After patch [1] was merged in Neutron, enforcing scopes there
is broken.
So lets disable it temporary to unblock Devstack's gate for now.

[1] https://review.opendev.org/c/openstack/neutron/+/821208

Related-Bug: #1959196
Change-Id: I24da6f3897a638749d16f738329a873a5f9a291d
---
 .zuul.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 248a56beb9..5a58d743fe 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -619,7 +619,9 @@
         # Keep enabeling the services here to run with system scope
         CINDER_ENFORCE_SCOPE: true
         GLANCE_ENFORCE_SCOPE: true
-        NEUTRON_ENFORCE_SCOPE: true
+        # TODO(slaweq): Enable enforce scopes in Neutron when bug
+        # https://bugs.launchpad.net/neutron/+bug/1959196 will be fixed
+        # NEUTRON_ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode

From 1fd45940f370dc3aab6a5e9492c36e735f673c8a Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Tue, 25 Jan 2022 16:44:36 -0500
Subject: [PATCH 2937/3333] Add openstack-two-node-centos-8-stream

This will allow multinode FIPS testing

Change-Id: I82b3b8fe56275aed72e13f6d1bd9170c50e5da0d
---
 .zuul.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 248a56beb9..ea7708f751 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -146,6 +146,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-centos-8-stream
+    nodes:
+      - name: controller
+        label: centos-8-stream
+      - name: compute1
+        label: centos-8-stream
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:

From 14a0c09001e8e2304eff4918206163cc7e6db1eb Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 28 Jan 2022 09:44:40 +0100
Subject: [PATCH 2938/3333] Fix deployment of Neutron with enforced scopes

After patch [1] new RBAC policies changed in the way that SYSTEM_ADMIN
user isn't anymore allowed to e.g. create resources in behalf of some
projects. Now PROJECT_ADMIN needs to create such resources instead.
So this patch basically reverts most of the changes which were done
in [2] some time ago.
It also introduces new entry in the clouds.yaml file -
"devstack-admin-demo" which is "admin" user in the "demo" project as
it's needed to create some resouces in the demo project now.

Additionally, because of bug [3] this patch changes way how IPv6
external gateway IP is found using Neutron API. This change may be
reverted in the future when bug [3] will be fixed.

[1] https://review.opendev.org/c/openstack/neutron/+/821208
[2] https://review.opendev.org/c/openstack/devstack/+/797450
[3] https://bugs.launchpad.net/neutron/+bug/1959332

Depends-On: https://review.opendev.org/c/openstack/neutron/+/826828

Closes-Bug: #1959196
Change-Id: I32a6e8b9b59269a8699644b563657363425f7174
---
 functions-common                | 11 +++++
 lib/neutron_plugins/services/l3 | 73 ++++++++++++++-------------------
 lib/tempest                     |  9 +---
 3 files changed, 44 insertions(+), 49 deletions(-)

diff --git a/functions-common b/functions-common
index 7042408f40..b407ca5fe6 100644
--- a/functions-common
+++ b/functions-common
@@ -107,6 +107,17 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
 
+    # devstack-admin-demo: user with the admin role on the demo project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin-demo \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
+
     # devstack-alt: user with the member role on alt_demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a8844c475e..cd98115746 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -100,11 +100,6 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
-NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
-if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
-    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
-fi
-
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
 
 default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
@@ -156,10 +151,6 @@ function create_neutron_initial_network {
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
 
-    local admin_project_id
-    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
-    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
@@ -168,10 +159,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
             fi
         fi
     fi
@@ -179,14 +170,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -196,7 +187,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -206,7 +197,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -224,11 +215,11 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create $Q_ROUTER_NAME --project $admin_project_id | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
@@ -238,9 +229,9 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} --project $admin_project_id | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --project $admin_project_id | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -262,8 +253,7 @@ function _neutron_create_private_subnet_v4 {
     if [ -z $SUBNETPOOL_V4_ID ]; then
         fixed_range_v4=$FIXED_RANGE
     fi
-    local subnet_params="--project $project_id "
-    subnet_params+="--ip-version 4 "
+    local subnet_params="--ip-version 4 "
     if [[ -n "$NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $NETWORK_GATEWAY "
     fi
@@ -272,7 +262,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -286,8 +276,7 @@ function _neutron_create_private_subnet_v6 {
     if [ -z $SUBNETPOOL_V6_ID ]; then
         fixed_range_v6=$FIXED_RANGE_V6
     fi
-    local subnet_params="--project $project_id "
-    subnet_params+="--ip-version 6 "
+    local subnet_params="--ip-version 6 "
     if [[ -n "$IPV6_PRIVATE_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     fi
@@ -295,17 +284,14 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local admin_project_id
-    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
-    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-    local subnet_params="--ip-version 4 --project $admin_project_id "
+    local subnet_params="--ip-version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
@@ -313,29 +299,26 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
     subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
-    local admin_project_id
-    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
-    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-    local subnet_params="--ip-version 6 --project $admin_project_id "
+    local subnet_params="--ip-version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
     subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
+    openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -343,7 +326,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+    openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using OVN or the l3-agent for layer 3
     if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
@@ -370,7 +353,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+            ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
         fi
         _neutron_set_router_id
@@ -379,7 +362,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
+    openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -391,7 +374,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+        openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
@@ -412,7 +395,13 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+        # NOTE(slaweq): when enforce scopes is enabled in Neutron, router's
+        # gateway ports aren't visible in API because such ports don't belongs
+        # to any tenant. Because of that, at least temporary we need to find
+        # IPv6 address of the router's gateway in a bit different way.
+        # It can be reverted when bug
+        # https://bugs.launchpad.net/neutron/+bug/1959332 will be fixed
+        IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router show $ROUTER_ID -c external_gateway_info -f json | grep -C 1 $ipv6_pub_subnet_id | grep ip_address | awk '{print $2}' | tr -d '"')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -440,7 +429,7 @@ function _neutron_configure_router_v6 {
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
-    EXT_LIST=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" extension list --network -c Alias -f value)
+    EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
 
diff --git a/lib/tempest b/lib/tempest
index adffeda371..9ca06acabf 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -90,11 +90,6 @@ TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 # it will run tempest with
 TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 
-NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
-if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
-    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
-fi
-
 # Functions
 # ---------
 
@@ -293,8 +288,8 @@ function configure_tempest {
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack --os-cloud devstack-admin network show -f value -c id $PUBLIC_NETWORK_NAME)
         # make sure shared network presence does not confuses the tempest tests
-        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --share shared --project "$admin_project_id"
-        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet --project "$admin_project_id"
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create --share shared
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG

From 081c9b716fc742ffc12263e46ae499d7a1f65a7e Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 28 Jan 2022 09:52:28 +0100
Subject: [PATCH 2939/3333] Revert "Disable enforcing scopes in Neutron
 temporary"

This reverts commit be7b5bf671b4cdc082fb9b7bb73ec55cab0054dd.

As related bug is fixed, lets enabled scope enforcement in Neutron
again.

Related-bug: #1959196
Change-Id: I72db7ef533e78a10734d105e6a0debef288e41a1
---
 .zuul.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5a58d743fe..248a56beb9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -619,9 +619,7 @@
         # Keep enabeling the services here to run with system scope
         CINDER_ENFORCE_SCOPE: true
         GLANCE_ENFORCE_SCOPE: true
-        # TODO(slaweq): Enable enforce scopes in Neutron when bug
-        # https://bugs.launchpad.net/neutron/+bug/1959196 will be fixed
-        # NEUTRON_ENFORCE_SCOPE: true
+        NEUTRON_ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode

From 099a048fb933649606e58310e8e705e7c7e29cd7 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 6 May 2021 00:09:33 +0000
Subject: [PATCH 2940/3333] Configure nova unified limits quotas

This enables the configuration of nova to use unified limits in
keystone and enforcement in oslo.limit.

Related to blueprint unified-limits-nova

Depends-On: https://review.opendev.org/c/openstack/nova/+/715271

Change-Id: Ifdef3510bc7da3098a71739814e35dbaf612ae34
---
 lib/nova | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)

diff --git a/lib/nova b/lib/nova
index 930529a433..9039c6b454 100644
--- a/lib/nova
+++ b/lib/nova
@@ -159,6 +159,9 @@ NOVA_NOTIFICATION_FORMAT=${NOVA_NOTIFICATION_FORMAT:-unversioned}
 # image in devstack is CirrOS.
 NOVA_SHUTDOWN_TIMEOUT=${NOVA_SHUTDOWN_TIMEOUT:-0}
 
+# Whether to use Keystone unified limits instead of legacy quota limits.
+NOVA_USE_UNIFIED_LIMITS=$(trueorfalse False NOVA_USE_UNIFIED_LIMITS)
+
 # Functions
 # ---------
 
@@ -384,6 +387,13 @@ function create_nova_accounts {
             "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
             "http://$SERVICE_HOST:$S3_SERVICE_PORT"
     fi
+
+    # Unified limits
+    if is_service_enabled n-api; then
+        if [[ "$NOVA_USE_UNIFIED_LIMITS" = True ]]; then
+            configure_nova_unified_limits
+        fi
+    fi
 }
 
 # create_nova_conf() - Create a new nova.conf file
@@ -719,6 +729,62 @@ function configure_console_proxies {
     fi
 }
 
+function configure_nova_unified_limits {
+    # Default limits. Mirror the config-based default values.
+    # Note: disk quota is new in nova as of unified limits.
+    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10 --region $REGION_NAME \
+                    servers; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 20 --region $REGION_NAME \
+                    class:VCPU; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit $((50 * 1024)) --region $REGION_NAME \
+                    class:MEMORY_MB; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 20 --region $REGION_NAME \
+                    class:DISK_GB; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 128 --region $REGION_NAME \
+                    server_metadata_items; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 5 --region $REGION_NAME \
+                    server_injected_files; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10240 --region $REGION_NAME \
+                    server_injected_file_content_bytes; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 255 --region $REGION_NAME \
+                    server_injected_file_path_bytes; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 100 --region $REGION_NAME \
+                    server_key_pairs; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10 --region $REGION_NAME \
+                    server_groups; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10 --region $REGION_NAME \
+                    server_group_members"
+
+    # Tell nova to use these limits
+    iniset $NOVA_CONF quota driver "nova.quota.UnifiedLimitsDriver"
+
+    # Configure oslo_limit so it can talk to keystone
+    iniset $NOVA_CONF oslo_limit user_domain_name $SERVICE_DOMAIN_NAME
+    iniset $NOVA_CONF oslo_limit password $SERVICE_PASSWORD
+    iniset $NOVA_CONF oslo_limit username nova
+    iniset $NOVA_CONF oslo_limit auth_type password
+    iniset $NOVA_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
+    iniset $NOVA_CONF oslo_limit system_scope "'all'"
+    iniset $NOVA_CONF oslo_limit endpoint_id \
+           $(openstack endpoint list --service nova -f value -c ID)
+
+    # Allow the nova service user to read quotas
+    openstack role add --user nova --user-domain Default --system all \
+              reader
+}
+
 function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user send_service_user_token True
     iniset $NOVA_CONF service_user auth_type password

From a756f4b9681d429f2612164eb01d57c800ff2d2a Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 31 Jan 2022 16:38:31 +0000
Subject: [PATCH 2941/3333] Add python3.6 pip support

Since pip v22, python3.6 is not supported (the minimum version is
python3.7). This patch adds the reference for the pip3.6 URL to be
used instead of the default one.

Closes-Bug: #1959600
Change-Id: Iab2c391d5388461fe9e9037cee81884ce8032e72
---
 tools/install_pip.sh | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 5d73a1f0d8..e9c52eacb7 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -38,7 +38,7 @@ FILES=$TOP_DIR/files
 # [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
-LOCAL_PIP="$FILES/$(basename $PIP_GET_PIP_URL)"
+PIP_GET_PIP36_URL=${PIP_GET_PIP36_URL:-"https://bootstrap.pypa.io/pip/3.6/get-pip.py"}
 
 GetDistro
 echo "Distro: $DISTRO"
@@ -57,12 +57,21 @@ function get_versions {
 
 
 function install_get_pip {
+    if [[ "$PYTHON3_VERSION" = "3.6" ]]; then
+        _pip_url=$PIP_GET_PIP36_URL
+        _local_pip="$FILES/$(basename $_pip_url)-py36"
+    else
+        _pip_url=$PIP_GET_PIP_URL
+        _local_pip="$FILES/$(basename $_pip_url)"
+    fi
+
+
     # If get-pip.py isn't python, delete it. This was probably an
     # outage on the server.
-    if [[ -r $LOCAL_PIP ]]; then
-        if ! head -1 $LOCAL_PIP | grep -q '#!/usr/bin/env python'; then
-            echo "WARNING: Corrupt $LOCAL_PIP found removing"
-            rm $LOCAL_PIP
+    if [[ -r $_local_pip ]]; then
+        if ! head -1 $_local_pip | grep -q '#!/usr/bin/env python'; then
+            echo "WARNING: Corrupt $_local_pip found removing"
+            rm $_local_pip
         fi
     fi
 
@@ -76,20 +85,20 @@ function install_get_pip {
     # Thus we use curl's "-z" feature to always check the modified
     # since and only download if a new version is out -- but only if
     # it seems we downloaded the file originally.
-    if [[ ! -r $LOCAL_PIP || -r $LOCAL_PIP.downloaded ]]; then
+    if [[ ! -r $_local_pip || -r $_local_pip.downloaded ]]; then
         # only test freshness if LOCAL_PIP is actually there,
         # otherwise we generate a scary warning.
         local timecond=""
-        if [[ -r $LOCAL_PIP ]]; then
-            timecond="-z $LOCAL_PIP"
+        if [[ -r $_local_pip ]]; then
+            timecond="-z $_local_pip"
         fi
 
         curl -f --retry 6 --retry-delay 5 \
-            $timecond -o $LOCAL_PIP $PIP_GET_PIP_URL || \
+            $timecond -o $_local_pip $_pip_url || \
             die $LINENO "Download of get-pip.py failed"
-        touch $LOCAL_PIP.downloaded
+        touch $_local_pip.downloaded
     fi
-    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    sudo -H -E python${PYTHON3_VERSION} $_local_pip
 }
 
 

From 85c7d8db4eef2e367a7466a39b4f1fba7a983eef Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 4 Feb 2022 08:29:32 +0000
Subject: [PATCH 2942/3333] revert stackrc execute permissions

This change reverts the execute permissions from
stackrc which is not meant to be run as a script but sourced
as part of stack.sh

Change-Id: I9a05051e5a297cfaf78d097fa5f90a7c5fd254a6
---
 stackrc | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 stackrc

diff --git a/stackrc b/stackrc
old mode 100755
new mode 100644

From 343e35162798af4c0399f2f7c0a733c568782686 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 Feb 2022 11:19:08 +1100
Subject: [PATCH 2943/3333] Bump fedora-latest to F35

Generally this is straight forward, but Horizon has a dependency issue
with pyScss (described in [1]) so it is disabled, for now.

[1] https://bugs.launchpad.net/horizon/+bug/1960204

Co-Authored-By: Dr. Jens Harbott <harbott@osism.tech>
Depends-On: https://review.opendev.org/c/openstack/devstack/+/827578
Change-Id: I7c4bf0945f9ac5bd563fe0a698c09b8571c97c5e
---
 .zuul.yaml       | 6 +++++-
 files/rpms/swift | 2 +-
 lib/apache       | 7 ++++++-
 stack.sh         | 2 +-
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5a58d743fe..3278eeb9e0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -90,7 +90,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-34
+        label: fedora-35
     groups:
       - name: tempest
         nodes:
@@ -729,6 +729,10 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      # Python 3.10 dependency issues; see
+      # https://bugs.launchpad.net/horizon/+bug/1960204
+      devstack_services:
+        horizon: false
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview
diff --git a/files/rpms/swift b/files/rpms/swift
index faf0a3175a..a838d7839e 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f34,rhel9
+xinetd # not:f35,rhel9
diff --git a/lib/apache b/lib/apache
index cbe61adf34..f29c7ea2cb 100644
--- a/lib/apache
+++ b/lib/apache
@@ -85,7 +85,12 @@ function install_apache_uwsgi {
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
         install_package ${pkg_list}
-    elif is_fedora && ! is_openeuler; then
+    # NOTE(ianw) 2022-02-03 : Fedora 35 needs to skip this and fall
+    # into the install-from-source because the upstream packages
+    # didn't fix Python 3.10 compatibility before release.  Should be
+    # fixed in uwsgi 4.9.0; can remove this when packages available
+    # or we drop this release
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f35 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/stack.sh b/stack.sh
index c92cc79b40..0082b99f11 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
+SUPPORTED_DISTROS="bullseye|focal|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From accd99e7cddabb60633bf7e8f8832c961a2805f4 Mon Sep 17 00:00:00 2001
From: Jakob Meng <jakobmeng@web.de>
Date: Tue, 8 Feb 2022 11:05:14 +0100
Subject: [PATCH 2944/3333] Made LVM backing disk persistent

Previously, loop devices for LVM volume groups backing files were not
created after reboots, causing e.g. Cinder to fail with messages such
as

  ERROR cinder.service [-] Manager for service cinder-volume
  devstack@lvmdriver-1 is reporting problems, not sending
  heartbeat. Service will appear "down".

Now, we use systemd services to manage loop devices for backing files.

Change-Id: I27ec027834966e44aa9a99999358f5b4debc43e0
---
 files/lvm-backing-file.template | 16 +++++++++++
 lib/lvm                         | 49 ++++++++++++++++++---------------
 2 files changed, 43 insertions(+), 22 deletions(-)
 create mode 100644 files/lvm-backing-file.template

diff --git a/files/lvm-backing-file.template b/files/lvm-backing-file.template
new file mode 100644
index 0000000000..dc519d7745
--- /dev/null
+++ b/files/lvm-backing-file.template
@@ -0,0 +1,16 @@
+[Unit]
+Description=Activate LVM backing file %BACKING_FILE%
+DefaultDependencies=no
+After=systemd-udev-settle.service
+Before=lvm2-activation-early.service
+Wants=systemd-udev-settle.service
+
+[Service]
+ExecStart=/sbin/losetup --find --show %DIRECTIO% %BACKING_FILE%
+ExecStop=/bin/sh -c '/sbin/losetup -d $$(/sbin/losetup --associated %BACKING_FILE% -O NAME -n)'
+RemainAfterExit=yes
+Type=oneshot
+
+[Install]
+WantedBy=local-fs.target
+Also=systemd-udev-settle.service
diff --git a/lib/lvm b/lib/lvm
index b826c1bc63..d3f6bf1792 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -53,28 +53,10 @@ function _remove_lvm_volume_group {
     sudo vgremove -f $vg
 }
 
-# _clean_lvm_backing_file() removes the backing file of the
-# volume group
-#
-# Usage: _clean_lvm_backing_file() $backing_file
-function _clean_lvm_backing_file {
-    local backing_file=$1
-
-    # If the backing physical device is a loop device, it was probably setup by DevStack
-    if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
-        local vg_dev
-        vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
-        if [[ -n "$vg_dev" ]]; then
-            sudo losetup -d $vg_dev
-        fi
-        rm -f $backing_file
-    fi
-}
-
 # clean_lvm_volume_group() cleans up the volume group and removes the
 # backing file
 #
-# Usage: clean_lvm_volume_group $vg
+# Usage: clean_lvm_volume_group() $vg
 function clean_lvm_volume_group {
     local vg=$1
 
@@ -83,11 +65,22 @@ function clean_lvm_volume_group {
     # if there is no logical volume left, it's safe to attempt a cleanup
     # of the backing file
     if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then
-        _clean_lvm_backing_file $DATA_DIR/$vg$BACKING_FILE_SUFFIX
+        local backing_file=$DATA_DIR/$vg$BACKING_FILE_SUFFIX
+
+        if [[ -n "$vg$BACKING_FILE_SUFFIX" ]] && \
+           [[ -e "/etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service" ]]; then
+            sudo systemctl disable --now $vg$BACKING_FILE_SUFFIX.service
+            sudo rm -f /etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service
+            sudo systemctl daemon-reload
+        fi
+
+        # If the backing physical device is a loop device, it was probably setup by DevStack
+        if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
+            rm -f $backing_file
+        fi
     fi
 }
 
-
 # _create_lvm_volume_group creates default volume group
 #
 # Usage: _create_lvm_volume_group() $vg $size
@@ -106,8 +99,20 @@ function _create_lvm_volume_group {
             directio="--direct-io=on"
         fi
 
+        # Only create systemd service if it doesn't already exists
+        if [[ ! -e "/etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service" ]]; then
+            sed -e "
+                s|%DIRECTIO%|${directio}|g;
+                s|%BACKING_FILE%|${backing_file}|g;
+            " $FILES/lvm-backing-file.template | sudo tee \
+                /etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service
+
+            sudo systemctl daemon-reload
+            sudo systemctl enable --now $vg$BACKING_FILE_SUFFIX.service
+        fi
+
         local vg_dev
-        vg_dev=$(sudo losetup -f --show $directio $backing_file)
+        vg_dev=$(sudo losetup --associated $backing_file -O NAME -n)
 
         # Only create volume group if it doesn't already exist
         if ! sudo vgs $vg; then

From 8c6710326eaf8114b579720185161091a0a9f38c Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 9 Feb 2022 18:01:46 +0000
Subject: [PATCH 2945/3333] Fix installation with OVN backend and compilation

This patch fixes several issues related to the installation with
OVN backend with the OVS/OVN compilation enabled.

The OVS/OVN local directories prefix, when both services are compiled,
is now "/usr/local".

The "ovn_agent._run_process" function is calling "ovs-appctl" to
configure the logging settings of several services. Instead of
using the service name, the ctl socket file is used instead. That
is more robust and does not fail in systems with previous
installations.

Closes-Bug: #1960514

Change-Id: I69de5333393957593db6e05495f0c3c758efefdf
---
 lib/neutron_plugins/ovn_agent  | 7 ++++++-
 lib/neutron_plugins/ovs_base   | 2 +-
 lib/neutron_plugins/ovs_source | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 09b28b6c3f..927896b70b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -253,7 +253,12 @@ function _run_process {
 
     local testcmd="test -e $OVS_RUNDIR/$service.pid"
     test_with_retry "$testcmd" "$service did not start" $SERVICE_TIMEOUT 1
-    sudo ovs-appctl -t $service vlog/set console:off syslog:info file:info
+    local service_ctl_file
+    service_ctl_file=$(ls $OVS_RUNDIR | grep $service | grep ctl)
+    if [ -z "$service_ctl_file" ]; then
+        die $LINENO "ctl file for service $service is not present."
+    fi
+    sudo ovs-appctl -t $OVS_RUNDIR/$service_ctl_file vlog/set console:off syslog:info file:info
 }
 
 function clone_repository {
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 8acf586189..cc41a8cd46 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -68,7 +68,7 @@ function _neutron_ovs_base_install_ubuntu_dkms {
 function _neutron_ovs_base_install_agent_packages {
     if [ "$Q_BUILD_OVS_FROM_GIT" == "True" ]; then
         remove_ovs_packages
-        compile_ovs False /usr /var
+        compile_ovs False /usr/local /var
         load_conntrack_gre_module
         start_new_ovs
     else
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 9c87dce551..9ae5555afb 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -188,12 +188,12 @@ function action_openvswitch {
 # start_new_ovs() - removes old ovs database, creates a new one and starts ovs
 function start_new_ovs {
     sudo rm -f /etc/openvswitch/conf.db /etc/openvswitch/.conf.db~lock~
-    sudo /usr/share/openvswitch/scripts/ovs-ctl start
+    sudo /usr/local/share/openvswitch/scripts/ovs-ctl start
 }
 
 # stop_new_ovs() - stops ovs
 function stop_new_ovs {
-    local ovs_ctl='/usr/share/openvswitch/scripts/ovs-ctl'
+    local ovs_ctl='/usr/local/share/openvswitch/scripts/ovs-ctl'
 
     if [ -x $ovs_ctl ] ; then
         sudo $ovs_ctl stop

From 17b1999eabab92a7820a2900853dc23d7150dbe9 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Feb 2022 22:14:24 +0000
Subject: [PATCH 2946/3333] Default CIRROS_ARCH to host arch

This change use uname -m to get the portable host arch and uses that
as a new default. on x86_64 hosts this should result in no visable change
in behavior however on a non x86 host it will cause devstack to attempt
to download a cirros image that matches the host.

Change-Id: I6d1495a23400ef4cf496302028324fa5794dd45f
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 681e9dee38..e48fd81d16 100644
--- a/stackrc
+++ b/stackrc
@@ -663,7 +663,7 @@ esac
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
 CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
-CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
+CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
 # which may be set in ``local.conf``.  Also allow ``DEFAULT_IMAGE_NAME`` and

From ef6fac7959b257bb08ff3014e9cbf9cbc6b28ec3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 16 Feb 2022 02:16:15 +0000
Subject: [PATCH 2947/3333] Updated from generate-devstack-plugins-list

Change-Id: If1b667cd4af88511cb1672645a980c9c4fc557ae
---
 doc/source/plugin-registry.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 3edd708d8b..6850553b52 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,6 +75,7 @@ openstack/networking-powervm             `https://opendev.org/openstack/networki
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
+openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
@@ -92,6 +93,7 @@ openstack/sahara                         `https://opendev.org/openstack/sahara <
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
 openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
 openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
+openstack/skyline-apiserver              `https://opendev.org/openstack/skyline-apiserver <https://opendev.org/openstack/skyline-apiserver>`__
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
@@ -112,7 +114,6 @@ openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui
 openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
 openstack/zun-ui                         `https://opendev.org/openstack/zun-ui <https://opendev.org/openstack/zun-ui>`__
 performa/os-faults                       `https://opendev.org/performa/os-faults <https://opendev.org/performa/os-faults>`__
-skyline/skyline-apiserver                `https://opendev.org/skyline/skyline-apiserver <https://opendev.org/skyline/skyline-apiserver>`__
 starlingx/config                         `https://opendev.org/starlingx/config <https://opendev.org/starlingx/config>`__
 starlingx/fault                          `https://opendev.org/starlingx/fault <https://opendev.org/starlingx/fault>`__
 starlingx/ha                             `https://opendev.org/starlingx/ha <https://opendev.org/starlingx/ha>`__

From c0882aeaae8ebdc692f2f0e005f8795bbb6c3d53 Mon Sep 17 00:00:00 2001
From: Victor Morales <chipahuac@hotmail.com>
Date: Wed, 16 Feb 2022 18:15:12 -0800
Subject: [PATCH 2948/3333] Add rsync deb package for swift

The rsync debian package is required for swift service. This
requirement has been covered by rpms but not for deb packages.

Change-Id: Iefd1302be9c7fd80e037bbae3638602d6d823580
---
 files/debs/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/swift b/files/debs/swift
index 4b8ac3d793..67c6c8ddb4 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -2,5 +2,6 @@ curl
 liberasurecode-dev
 make
 memcached
+rsync
 sqlite3
 xfsprogs

From e30620e9a62cd1243bded2b922b21c269d801aa6 Mon Sep 17 00:00:00 2001
From: Jakob Meng <jakobmeng@web.de>
Date: Fri, 4 Feb 2022 20:55:48 +0100
Subject: [PATCH 2949/3333] Made Swift backing disk persistent

Previously, Swift's backing disk were not be mounted after reboots,
causing swift-proxy-server service to fail with cryptic error
messages such as 'proxy-server: ERROR Insufficient Storage'. Now,
we use 	Dan Smith' create_disk function from functions to create
the backing disk for us and add it to /etc/fstab.

Change-Id: I9cbccc87bc94a55b58e9badf3fdb127d6f1cf599
---
 lib/swift | 32 ++++----------------------------
 1 file changed, 4 insertions(+), 28 deletions(-)

diff --git a/lib/swift b/lib/swift
index 9c13701c6e..ba92f3dcc3 100644
--- a/lib/swift
+++ b/lib/swift
@@ -179,12 +179,9 @@ function is_swift_enabled {
 # cleanup_swift() - Remove residual data files
 function cleanup_swift {
     rm -f ${SWIFT_CONF_DIR}{*.builder,*.ring.gz,backups/*.builder,backups/*.ring.gz}
-    if egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-        sudo umount ${SWIFT_DATA_DIR}/drives/sdb1
-    fi
-    if [[ -e ${SWIFT_DISK_IMAGE} ]]; then
-        rm ${SWIFT_DISK_IMAGE}
-    fi
+
+    destroy_disk ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1
+
     rm -rf ${SWIFT_DATA_DIR}/run/
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
         _cleanup_swift_apache_wsgi
@@ -575,28 +572,7 @@ function create_swift_disk {
     sudo install -d -o ${STACK_USER} -g ${user_group} ${SWIFT_DATA_DIR}/{drives,cache,run,logs}
 
     # Create a loopback disk and format it to XFS.
-    if [[ -e ${SWIFT_DISK_IMAGE} ]]; then
-        if egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-            sudo umount ${SWIFT_DATA_DIR}/drives/sdb1
-            sudo rm -f ${SWIFT_DISK_IMAGE}
-        fi
-    fi
-
-    mkdir -p ${SWIFT_DATA_DIR}/drives/images
-    sudo touch ${SWIFT_DISK_IMAGE}
-    sudo chown ${STACK_USER}: ${SWIFT_DISK_IMAGE}
-
-    truncate -s ${SWIFT_LOOPBACK_DISK_SIZE} ${SWIFT_DISK_IMAGE}
-
-    # Make a fresh XFS filesystem
-    /sbin/mkfs.xfs -f -i size=1024  ${SWIFT_DISK_IMAGE}
-
-    # Mount the disk with mount options to make it as efficient as possible
-    mkdir -p ${SWIFT_DATA_DIR}/drives/sdb1
-    if ! egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
-            ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1
-    fi
+    create_disk ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1 ${SWIFT_LOOPBACK_DISK_SIZE}
 
     # Create a link to the above mount and
     # create all of the directories needed to emulate a few different servers

From a2ff7545366b1be960c1175b47e20c5845c3a6e2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 2 Mar 2022 02:13:44 +0000
Subject: [PATCH 2950/3333] Updated from generate-devstack-plugins-list

Change-Id: Iff2bf021edee9be3bae21b67e66fe07c552f3a05
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6850553b52..2e8e8f53d7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,6 +75,7 @@ openstack/networking-powervm             `https://opendev.org/openstack/networki
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
+openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__
 openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__

From 2c96180ac8482d912c487c18d400f418bf933cab Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 3 Mar 2022 23:54:49 +0000
Subject: [PATCH 2951/3333] Clean up unified limits configuration for nova and
 glance

This is a followup for change Ifdef3510bc7da3098a71739814e35dbaf612ae34
which added configuration of unified limits for nova. This removes an
unnecessary wrapper unsetting of OS_ env variables, unnecessary quoting
on an iniset config value, and a hardcoding of user domain. The glance
code from which the nova code was originally copied is also cleaned up.

Change-Id: I4921af5cc0f624dd5aa848533f7049ee816be593
---
 lib/glance |  6 ++---
 lib/nova   | 67 +++++++++++++++++++++++-------------------------------
 2 files changed, 32 insertions(+), 41 deletions(-)

diff --git a/lib/glance b/lib/glance
index 9bba938b9d..b94c06dc93 100644
--- a/lib/glance
+++ b/lib/glance
@@ -309,13 +309,13 @@ function configure_glance_quotas {
     iniset $GLANCE_API_CONF oslo_limit username glance
     iniset $GLANCE_API_CONF oslo_limit auth_type password
     iniset $GLANCE_API_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
-    iniset $GLANCE_API_CONF oslo_limit system_scope "'all'"
+    iniset $GLANCE_API_CONF oslo_limit system_scope all
     iniset $GLANCE_API_CONF oslo_limit endpoint_id \
            $(openstack --os-cloud devstack-system-admin endpoint list --service glance -f value -c ID)
 
     # Allow the glance service user to read quotas
-    openstack --os-cloud devstack-system-admin role add --user glance --user-domain Default \
-        --system all reader
+    openstack --os-cloud devstack-system-admin role add --user glance \
+        --user-domain $SERVICE_DOMAIN_NAME --system all reader
 }
 
 # configure_glance() - Set config files, create data dirs, etc
diff --git a/lib/nova b/lib/nova
index 90289b139a..509cba6ff2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -746,42 +746,33 @@ function configure_console_proxies {
 }
 
 function configure_nova_unified_limits {
-    # Default limits. Mirror the config-based default values.
+    # Registered limit resources in keystone are system-specific resources.
+    # Make sure we use a system-scoped token to interact with this API.
+
+    # Default limits here mirror the legacy config-based default values.
     # Note: disk quota is new in nova as of unified limits.
-    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10 --region $REGION_NAME \
-                    servers; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 20 --region $REGION_NAME \
-                    class:VCPU; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit $((50 * 1024)) --region $REGION_NAME \
-                    class:MEMORY_MB; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 20 --region $REGION_NAME \
-                    class:DISK_GB; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 128 --region $REGION_NAME \
-                    server_metadata_items; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 5 --region $REGION_NAME \
-                    server_injected_files; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10240 --region $REGION_NAME \
-                    server_injected_file_content_bytes; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 255 --region $REGION_NAME \
-                    server_injected_file_path_bytes; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 100 --region $REGION_NAME \
-                    server_key_pairs; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10 --region $REGION_NAME \
-                    server_groups; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10 --region $REGION_NAME \
-                    server_group_members"
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10 --region $REGION_NAME servers
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 20 --region $REGION_NAME class:VCPU
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit $((50 * 1024)) --region $REGION_NAME class:MEMORY_MB
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 20 --region $REGION_NAME class:DISK_GB
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 128 --region $REGION_NAME server_metadata_items
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 5 --region $REGION_NAME server_injected_files
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10240 --region $REGION_NAME server_injected_file_content_bytes
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 255 --region $REGION_NAME server_injected_file_path_bytes
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 100 --region $REGION_NAME server_key_pairs
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10 --region $REGION_NAME server_groups
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10 --region $REGION_NAME server_group_members
 
     # Tell nova to use these limits
     iniset $NOVA_CONF quota driver "nova.quota.UnifiedLimitsDriver"
@@ -792,13 +783,13 @@ function configure_nova_unified_limits {
     iniset $NOVA_CONF oslo_limit username nova
     iniset $NOVA_CONF oslo_limit auth_type password
     iniset $NOVA_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
-    iniset $NOVA_CONF oslo_limit system_scope "'all'"
+    iniset $NOVA_CONF oslo_limit system_scope all
     iniset $NOVA_CONF oslo_limit endpoint_id \
            $(openstack endpoint list --service nova -f value -c ID)
 
     # Allow the nova service user to read quotas
-    openstack role add --user nova --user-domain Default --system all \
-              reader
+    openstack --os-cloud devstack-system-admin role add --user nova \
+        --user-domain $SERVICE_DOMAIN_NAME --system all reader
 }
 
 function init_nova_service_user_conf {

From 13e8db5a6f44a8f537988a102f9869e725bb97bb Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Mar 2022 20:17:31 +0000
Subject: [PATCH 2952/3333] ignore failures to copy the devstack cache

If the ci images do not have any cached data
we should ignore any error when trying to copying it.
This is requried when using unmodified cloud images.

Change-Id: Ia6e94fc01343d0c292b1477905f8a96a6b43bcf8
---
 roles/setup-devstack-cache/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/setup-devstack-cache/tasks/main.yaml b/roles/setup-devstack-cache/tasks/main.yaml
index 84f33f0e16..3adff17d5d 100644
--- a/roles/setup-devstack-cache/tasks/main.yaml
+++ b/roles/setup-devstack-cache/tasks/main.yaml
@@ -2,6 +2,7 @@
   # This uses hard links to avoid using extra space.
   command: "find {{ devstack_cache_dir }}/files -mindepth 1 -maxdepth 1 -exec cp -l {} {{ devstack_base_dir }}/devstack/files/ ;"
   become: true
+  ignore_errors: yes
 
 - name: Set ownership of cached files
   file:

From 35bc600da17c7342345fa9c4d0b8078a8388fad1 Mon Sep 17 00:00:00 2001
From: Michael Johnson <johnsomor@gmail.com>
Date: Mon, 28 Feb 2022 18:42:34 +0000
Subject: [PATCH 2953/3333] Fix tls-proxy on newer versions of openssl

Newer versions of openssl (CentOS9Stream for example) do not like using sha1.
Devstack will fail on these systems[1] with the following error:
801B93DCE77F0000:error:03000098:digital envelope routines:do_sigver_init:invalid digest:crypto/evp/m_sigver.c:333:
This patch updates the tls-proxy code in devstack to use sha256 instead of sha1 which allows devstack to complete when tls-proxy is enabled.

[1] https://zuul.opendev.org/t/openstack/build/1d90b22a39c74e24a8390861b3c5f957/log/job-output.txt#5535

Closes-Bug: #1962600

Change-Id: I71e1371affe32f070167037b0109a489d196bd31
---
 lib/tls | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index b3cc0b4159..5a7f5ae324 100644
--- a/lib/tls
+++ b/lib/tls
@@ -169,7 +169,7 @@ default_md              = default
 
 [ req ]
 default_bits            = 1024
-default_md              = sha1
+default_md              = sha256
 
 prompt                  = no
 distinguished_name      = req_distinguished_name
@@ -261,7 +261,7 @@ function make_cert {
     if [ ! -r "$ca_dir/$cert_name.crt" ]; then
         # Generate a signing request
         $OPENSSL req \
-            -sha1 \
+            -sha256 \
             -newkey rsa \
             -nodes \
             -keyout $ca_dir/private/$cert_name.key \
@@ -301,7 +301,7 @@ function make_int_CA {
     if [ ! -r "$ca_dir/cacert.pem" ]; then
         # Create a signing certificate request
         $OPENSSL req -config $ca_dir/ca.conf \
-            -sha1 \
+            -sha256 \
             -newkey rsa \
             -nodes \
             -keyout $ca_dir/private/cacert.key \

From 7943a92bdbdd2a3b2f75fe66ee8c69db65147692 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Mon, 14 Mar 2022 13:53:41 -0400
Subject: [PATCH 2954/3333] Do not use hardcoded IPv4 localhost value

There are a couple of places that still use a hardcoded
127.0.0.1 value, even if devstack is run with
SERVICE_IP_VERSION=6 in local.conf. While things still
work, SERVICE_LOCAL_HOST should be used instead since
everything else could be using IPv6.

Change-Id: I2dd9247a4ac19f565d4d5ecb2e1490501fda8bca
---
 lib/apache          |  9 +++++++--
 lib/databases/mysql | 14 +++++++++-----
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/lib/apache b/lib/apache
index f29c7ea2cb..02827d1f1b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -27,6 +27,11 @@ set +o xtrace
 APACHE_USER=${APACHE_USER:-$STACK_USER}
 APACHE_GROUP=${APACHE_GROUP:-$(id -gn $APACHE_USER)}
 
+APACHE_LOCAL_HOST=$SERVICE_LOCAL_HOST
+if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
+    APACHE_LOCAL_HOST=[$APACHE_LOCAL_HOST]
+fi
+
 
 # Set up apache name and configuration directory
 # Note that APACHE_CONF_DIR is really more accurately apache's vhost
@@ -323,7 +328,7 @@ function write_local_uwsgi_http_config {
     rm -rf $file
     iniset "$file" uwsgi wsgi-file "$wsgi"
     port=$(get_random_port)
-    iniset "$file" uwsgi http-socket "127.0.0.1:$port"
+    iniset "$file" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
     iniset "$file" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$file" uwsgi master true
@@ -359,7 +364,7 @@ function write_local_uwsgi_http_config {
     apache_conf=$(apache_site_config_for $name)
     echo "KeepAlive Off" | sudo tee $apache_conf
     echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
-    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
+    echo "ProxyPass \"${url}\" \"http://$APACHE_LOCAL_HOST:$port\" retry=0 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server
 }
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 30e4b7c496..0f45273d4b 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -86,10 +86,16 @@ function configure_database_mysql {
         exit_distro_not_supported "mysql configuration"
     fi
 
-    # Start mysql-server
+    # Change bind-address from localhost (127.0.0.1) to any (::)
+    iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
+
+    # (Re)Start mysql-server
     if is_fedora || is_suse; then
         # service is not started by default
         start_service $MYSQL_SERVICE_NAME
+    elif is_ubuntu; then
+        # required since bind-address could have changed above
+        restart_service $MYSQL_SERVICE_NAME
     fi
 
     # Set the root password - only works the first time. For Ubuntu, we already
@@ -102,7 +108,7 @@ function configure_database_mysql {
     if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         local cmd_args="-uroot -p$DATABASE_PASSWORD "
     else
-        local cmd_args="-uroot -p$DATABASE_PASSWORD -h127.0.0.1 "
+        local cmd_args="-uroot -p$DATABASE_PASSWORD -h$SERVICE_LOCAL_HOST "
     fi
 
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
@@ -119,9 +125,7 @@ function configure_database_mysql {
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
-    # Change bind-address from localhost (127.0.0.1) to any (::) and
-    # set default db type to InnoDB
-    iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
+    # Set default db type to InnoDB
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024

From 369042b74fe07e6f0f471fd50d7108586d55b97a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 21 Mar 2022 15:29:38 -0500
Subject: [PATCH 2955/3333] Make centos-9-stream job voting

bug#1960346 is fixed by the below series
- https://review.opendev.org/q/(topic:bug/1960346+OR+topic:wait_until_sshable_pingable)+status:merged
and now centos-9-stream job is passing and made voting
on tempest gate.

This commit makes devstack centos9 steam platform job
as voting and add it gate pipeline too.

Change-Id: Ic35420c5d58926ae90a136045a1558112accc533
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fc80e6c413..067d3f5b08 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -678,7 +678,6 @@
     parent: tempest-full-py3
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
-    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -894,6 +893,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-platform-centos-9-stream
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From cebd00aa0468a084d21fc6f43ed7d4c15db878f5 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 17 Feb 2022 11:57:30 +0100
Subject: [PATCH 2956/3333] Clean usage of project_id in the Neutron's L3
 service module

After patch [1] project_id in that module is no longer needed as to make
it working with new secure RBAC policies we had to hardcode "demo"
project to be used always.
This is small follow-up patch with cleaning after [1].

[1] https://review.opendev.org/c/openstack/devstack/+/826851/

Change-Id: Iddf9692817c91807fc3269547910e4f83585f07f
---
 lib/neutron_plugins/services/l3 | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index cd98115746..c0d74c7728 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -147,10 +147,6 @@ function _neutron_get_ext_gw_interface {
 }
 
 function create_neutron_initial_network {
-    local project_id
-    project_id=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
-
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
@@ -171,14 +167,14 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
         NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
             SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
@@ -188,7 +184,7 @@ function create_neutron_initial_network {
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
             IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
+            die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then
@@ -198,16 +194,16 @@ function create_neutron_initial_network {
         fi
     else
         NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
+            SUBNET_ID=$(_neutron_create_private_subnet_v4)
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
         fi
     fi
 
@@ -216,11 +212,11 @@ function create_neutron_initial_network {
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
             ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
+            die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
             ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
+            die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         fi
 
         EXTERNAL_NETWORK_FLAGS="--external"
@@ -249,7 +245,6 @@ function create_neutron_initial_network {
 
 # Create private IPv4 subnet
 function _neutron_create_private_subnet_v4 {
-    local project_id=$1
     if [ -z $SUBNETPOOL_V4_ID ]; then
         fixed_range_v4=$FIXED_RANGE
     fi
@@ -263,13 +258,12 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
     subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet"
     echo $subnet_id
 }
 
 # Create private IPv6 subnet
 function _neutron_create_private_subnet_v6 {
-    local project_id=$1
     die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
     die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
@@ -285,7 +279,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
     ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet"
     echo $ipv6_subnet_id
 }
 

From 189c7ff14222fe365a7376e7ef7171bfb2c74b24 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Fri, 25 Mar 2022 14:06:52 +0100
Subject: [PATCH 2957/3333] Update DEVSTACK_SERIES to zed

stable/yoga branch has been created now and
current master is for zed.

Change-Id: I8743a3440a0ce96acb24b34971548b43ae7c8d4c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index e48fd81d16..d22fa88373 100644
--- a/stackrc
+++ b/stackrc
@@ -235,7 +235,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="yoga"
+DEVSTACK_SERIES="zed"
 
 ##############
 #

From 8dc342d400e4e19541bdd0627a746052875364c3 Mon Sep 17 00:00:00 2001
From: zhouyanbing <zhouyanbing.zhou@huawei.com>
Date: Sat, 26 Mar 2022 10:44:40 +0800
Subject: [PATCH 2958/3333] remove unuseful local variable define

the local varibale: api_cell_conf in start_nova_rest function
is unuseful, so remove it now.

Change-Id: I0019ce807cf3905ee246b684fce2abcb46336306
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 509cba6ff2..4c14374d0f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1045,7 +1045,6 @@ function start_nova_rest {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    local api_cell_conf=$NOVA_CONF
     local compute_cell_conf=$NOVA_CONF
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"

From 5c51a95d10ba886fc9136e804844f60bc71aecf9 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 28 Mar 2022 14:00:54 +0200
Subject: [PATCH 2959/3333] Drop setup.py and setup.cfg

devstack isn't a python project, these were introduced only for docs
building and made redundant with [0]. We can remove them now.

[0] Iedcc008b170821aa74acefc02ec6a243a0dc307c

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I90ca1c6918c016d10c579fbae49d13fff1ed59af
---
 setup.cfg | 12 ------------
 setup.py  | 22 ----------------------
 2 files changed, 34 deletions(-)
 delete mode 100644 setup.cfg
 delete mode 100755 setup.py

diff --git a/setup.cfg b/setup.cfg
deleted file mode 100644
index a4e621f6df..0000000000
--- a/setup.cfg
+++ /dev/null
@@ -1,12 +0,0 @@
-[metadata]
-name = DevStack
-summary = OpenStack DevStack
-description_file =
-    README.rst
-author = OpenStack
-author_email = openstack-discuss@lists.openstack.org
-home_page = https://docs.openstack.org/devstack/latest
-classifier =
-    Intended Audience :: Developers
-    License :: OSI Approved :: Apache Software License
-    Operating System :: POSIX :: Linux
diff --git a/setup.py b/setup.py
deleted file mode 100755
index 70c2b3f32b..0000000000
--- a/setup.py
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) 2013 Hewlett-Packard Development Company, L.P.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# THIS FILE IS MANAGED BY THE GLOBAL REQUIREMENTS REPO - DO NOT EDIT
-import setuptools
-
-setuptools.setup(
-    setup_requires=['pbr'],
-    pbr=True)

From 45b029064f3f9ebb94cca97e572d9c0500abe21f Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 25 Mar 2022 22:23:04 -0500
Subject: [PATCH 2960/3333] Move openEuler job to experimental pipeline

OpenEuler job fails 100% of the time. As discussed in QA meeting,
we agreed to move OpenEuler job to experimental pipeline.
- https://meetings.opendev.org/meetings/qa/2022/qa.2022-03-22-15.00.log.html#l-76

Once it is fixed, we can think of adding back to regular pipeline.

Change-Id: I831889a09fabe5bed5522d17e352ec8009eac321
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 067d3f5b08..0dda2624d2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -849,7 +849,6 @@
         - devstack-platform-centos-8-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
-        - devstack-platform-openEuler-20.03-SP2
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -948,6 +947,7 @@
 
     experimental:
       jobs:
+        - devstack-platform-openEuler-20.03-SP2
         - nova-multi-cell
         - nova-next
         - neutron-fullstack-with-uwsgi

From f4a703661ebea05690fadf93fd13df6e54a49b59 Mon Sep 17 00:00:00 2001
From: afariasa <afariasa@redhat.com>
Date: Wed, 6 Apr 2022 15:23:11 +0000
Subject: [PATCH 2961/3333] Add OpenStack two nodes nodeset for Centos 9

Change-Id: I01c8e5e0e88d0dcfe778f19548a2e268406ef6bf
---
 .zuul.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0dda2624d2..1c517f1def 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -176,6 +176,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-centos-9-stream
+    nodes:
+      - name: controller
+        label: centos-9-stream
+      - name: compute1
+        label: centos-9-stream
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:

From eca9783a0ad9c7d7e2e8267457be8d4dd8b55502 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Mar 2022 23:26:13 +0000
Subject: [PATCH 2962/3333] ensure /usr/local/bin in in path

osc is typicaly installed in /usr/local/bin
to avoid command not found errors when invoking osc
in devstack ensure that /usr/local/bin is included
in the PATH.

Change-Id: I605fbc4b131149bf5d1b6307b360fe365c680b1a
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 0082b99f11..6e9ced985e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -67,7 +67,9 @@ unset `env | grep -E '^OS_' | cut -d = -f 1`
 umask 022
 
 # Not all distros have sbin in PATH for regular users.
-PATH=$PATH:/usr/local/sbin:/usr/sbin:/sbin
+# osc will normally be installed at /usr/local/bin/openstack so ensure
+# /usr/local/bin is also in the path
+PATH=$PATH:/usr/local/bin:/usr/local/sbin:/usr/sbin:/sbin
 
 # Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)

From bfbd2be00b38fbc4a5fd082cf44e0fdf06cc5330 Mon Sep 17 00:00:00 2001
From: Artur Angiel <arturangiel@gmail.com>
Date: Sun, 10 Apr 2022 11:31:21 +0200
Subject: [PATCH 2963/3333] Added recursive for deletion of $OVN_RUNDIR

After ./unstack.sh trying to 'enable_plugin venus https://opendev.org/openstack/venus' gived following error:

+lib/neutron_plugins/ovn_agent:install_ovn:363  sudo ln -s /var/run/openvswitch /var/run/ovn
ln: failed to create symbolic link '/var/run/ovn/openvswitch': File exists

which led to:

+lib/neutron_plugins/ovn_agent:cleanup_ovn:801  sudo rm -f /var/run/ovn
rm: cannot remove '/var/run/ovn': Is a directory

Change-Id: I1cafdc0c71093ed7249bb9748b57d51110986686
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 927896b70b..2938f472bc 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -798,5 +798,5 @@ function cleanup_ovn {
         _cleanup $ovs_path
     fi
 
-    sudo rm -f $OVN_RUNDIR
+    sudo rm -rf $OVN_RUNDIR
 }

From 676dcaf94487665882be048cfe1f3206d6807e0f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 13 Apr 2022 15:04:46 +1000
Subject: [PATCH 2964/3333] Mark our source trees as safe for git to use as
 other users

git commit [1] introduced a new behaviour to work around a CVE that
disallows any git operations in directories not owned by the current
user.

This may seem unrelated to installation, but it plays havoc with PBR,
which calls out to git to get to get revision history.  So if you are
"pip install"-ing from a source tree you don't own, the PBR git calls
in that tree now fail and the install blows up.

This plays havoc with our model.  Firstly, we checkout all code as
"stack" then install it globally with "sudo" (i.e. root) -- which
breaks.  We also have cases of essentially the opposite -- checkouts
we have installed as root, but then run tox in them as a regular user;
tox wants to install the source in its venv but now we have another
user conflict.

This uses the only available configuration option to avoid that by
globally setting the source directories we clone as safe.  This is an
encroachment of the global system for sure, but is about the only
switch available at the moment.  For discussion of other approaches,
see [2].

Related-Bug: https://bugs.launchpad.net/devstack/+bug/1968798

[1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
[2] https://review.opendev.org/c/openstack/devstack/+/837636

Change-Id: Ib9896a99b6d6c4d359ee412743ce30512b3c4fb7
---
 functions-common | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/functions-common b/functions-common
index b2cf9d99c6..ddef2e4980 100644
--- a/functions-common
+++ b/functions-common
@@ -673,6 +673,13 @@ function git_clone {
         fi
     fi
 
+    # NOTE(ianw) 2022-04-13 : commit [1] has broken many assumptions
+    # about how we clone and work with repos.  Mark them safe globally
+    # as a work-around.
+    #
+    # [1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
+    sudo git config --global --add safe.directory ${git_dest}
+
     # print out the results so we know what change was used in the logs
     cd $git_dest
     git show --oneline | head -1

From 4baeb3b51fcb6196fa311f823ad3f0ac13ccf341 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 13 Apr 2022 13:44:07 -0700
Subject: [PATCH 2965/3333] Write safe.directory items to system git config

This is necessary for more consistent behavior across multiple
distro versions. Apparently somewhere along the way, git started
looking at the current user's home directory instead of $HOME.

Related-Bug: https://bugs.launchpad.net/devstack/+bug/1968798

Change-Id: I941ef5ea90970a0901236afe81c551aaf24ac1d8
---
 functions-common | 7 ++++++-
 unstack.sh       | 5 +++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index ddef2e4980..8651604b79 100644
--- a/functions-common
+++ b/functions-common
@@ -677,8 +677,13 @@ function git_clone {
     # about how we clone and work with repos.  Mark them safe globally
     # as a work-around.
     #
+    # NOTE(danms): On bionic (and likely others) git-config may write
+    # ~stackuser/.gitconfig if not run with sudo -H. Using --system
+    # writes these changes to /etc/gitconfig which is more
+    # discoverable anyway.
+    #
     # [1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
-    sudo git config --global --add safe.directory ${git_dest}
+    sudo git config --system --add safe.directory ${git_dest}
 
     # print out the results so we know what change was used in the logs
     cd $git_dest
diff --git a/unstack.sh b/unstack.sh
index 4b57b6e344..813f9a8117 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -181,3 +181,8 @@ fi
 
 clean_pyc_files
 rm -Rf $DEST/async
+
+# Clean any safe.directory items we wrote into the global
+# gitconfig. We can identify the relevant ones by checking that they
+# point to somewhere in our $DEST directory.
+sudo sed -i "/directory=${DEST}/ d" /etc/gitconfig

From 28bed125a2555fb3da778898d6ae310175972d3c Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 20 Apr 2022 15:11:39 -0400
Subject: [PATCH 2966/3333] nova: unset cpu_model on aarch64

Without this, running DevStack on an `aarch64` environment will end
up in cpu_model set to "Nehalem" and cpu_mode set to "host-passthrough"
which does not work.

This patch drops that value under aarch64 environments.

Change-Id: I30be5a388dda5ccf08718670dbb14a28a4a8a8eb
---
 lib/nova_plugins/hypervisor-libvirt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index c1cd132548..6c6f4c4261 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -56,6 +56,10 @@ function configure_nova_hypervisor {
     # arm64-specific configuration
     if is_arch "aarch64"; then
         iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
+        # NOTE(mnaser): We cannot have `cpu_model` set if the `cpu_mode` is
+        #               set to `host-passthrough`, or `nova-compute` refuses to
+        #               start.
+        inidelete $NOVA_CONF libvirt cpu_model
     fi
 
     if isset ENABLE_FILE_INJECTION; then

From 7fa24750a676a44ab224206cc13096f904057d44 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 20 Apr 2022 15:42:43 -0400
Subject: [PATCH 2967/3333] ovn: use bundled ovs

We are using the latest OVS, however, OVN needs to build using the
OVS submodule since some of the signatures don't work[1].

[1]: https://github.com/ovn-org/ovn/issues/128

Change-Id: I3ad7e5e80f1141c3d94f7ce7c8b8f8fdb9fb7c3c
---
 lib/neutron_plugins/ovn_agent | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 927896b70b..bf1b23a82b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -320,8 +320,24 @@ function compile_ovn {
         ./boot.sh
     fi
 
+    # NOTE(mnaser): OVN requires that you build using the OVS from the
+    #               submodule.
+    #
+    #               https://github.com/ovn-org/ovn/blob/3fb397b63663297acbcbf794e1233951222ae5af/Documentation/intro/install/general.rst#bootstrapping
+    #               https://github.com/ovn-org/ovn/issues/128
+    git submodule update --init
+    pushd ovs
+    if [ ! -f configure ] ; then
+        ./boot.sh
+    fi
+    if [ ! -f config.status ] || [ configure -nt config.status ] ; then
+        ./configure
+    fi
+    make -j$(($(nproc) + 1))
+    popd
+
     if [ ! -f config.status ] || [ configure -nt config.status ] ; then
-        ./configure --with-ovs-source=$DEST/$OVS_REPO_NAME $prefix $localstatedir
+        ./configure $prefix $localstatedir
     fi
     make -j$(($(nproc) + 1))
     sudo make install

From c2772c2984e4f29aa6032725e4f7d8680a54ed19 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 8 Apr 2022 08:48:49 -0700
Subject: [PATCH 2968/3333] Gather performance data after tempest

This makes us gather a bunch of consistent statistics after we run
tempest that can be use to measure the impact of a given change. These
are stable metrics such as "number of DB queries made" and "how much
memory is each service using after a tempest run."

Note that this will always run after devstack to generate the JSON
file, but there are two things that control its completeness:

 - MYSQL_GATHER_PERFORMANCE must be enabled to get per-db stats
 - Unless tls-proxy is enabled, we will only get API stats for keystone

Change-Id: Ie3b1504256dc1c9c6b59634e86fa98494bcb07b1
---
 .zuul.yaml                                    |   1 +
 lib/databases/mysql                           |   9 +
 playbooks/post.yaml                           |   3 +
 roles/capture-performance-data/README.rst     |  25 +++
 .../defaults/main.yaml                        |   3 +
 .../capture-performance-data/tasks/main.yaml  |  15 ++
 stackrc                                       |   4 +
 tools/get-stats.py                            | 155 ++++++++++++++++++
 8 files changed, 215 insertions(+)
 create mode 100644 roles/capture-performance-data/README.rst
 create mode 100644 roles/capture-performance-data/defaults/main.yaml
 create mode 100644 roles/capture-performance-data/tasks/main.yaml
 create mode 100755 tools/get-stats.py

diff --git a/.zuul.yaml b/.zuul.yaml
index 0dda2624d2..329cb527f3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -389,6 +389,7 @@
         '{{ devstack_log_dir }}/worlddump-latest.txt': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
+        '{{ stage_dir }}/performance.json': logs
         '{{ stage_dir }}/apache': logs
         '{{ stage_dir }}/apache_config': logs
         '{{ stage_dir }}/etc': logs
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 0f45273d4b..6b3ea0287c 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -150,6 +150,15 @@ function configure_database_mysql {
         iniset -sudo $my_conf mysqld log-queries-not-using-indexes 1
     fi
 
+    if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" ]]; then
+        echo "enabling MySQL performance_schema items"
+        # Enable long query history
+        iniset -sudo $my_conf mysqld \
+               performance-schema-consumer-events-statements-history-long TRUE
+        iniset -sudo $my_conf mysqld \
+               performance_schema_events_stages_history_long_size 1000000
+    fi
+
     restart_service $MYSQL_SERVICE_NAME
 }
 
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 9e66f20e9e..d8d5f6833c 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -20,6 +20,9 @@
   roles:
     - export-devstack-journal
     - apache-logs-conf
+    # This should run as early as possible to make sure we don't skew
+    # the post-tempest results with other activities.
+    - capture-performance-data
     - devstack-project-conf
     # capture-system-logs should be the last role before stage-output
     - capture-system-logs
diff --git a/roles/capture-performance-data/README.rst b/roles/capture-performance-data/README.rst
new file mode 100644
index 0000000000..b7a37c223f
--- /dev/null
+++ b/roles/capture-performance-data/README.rst
@@ -0,0 +1,25 @@
+Generate performance logs for staging
+
+Captures usage information from mysql, systemd, apache logs, and other
+parts of the system and generates a performance.json file in the
+staging directory.
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory
+
+.. zuul:rolevar:: devstack_conf_dir
+   :default: /opt/stack
+
+   The base devstack destination directory
+
+.. zuul:rolevar:: debian_suse_apache_deref_logs
+
+   The apache logs found in the debian/suse locations
+
+.. zuul:rolevar:: redhat_apache_deref_logs
+
+   The apache logs found in the redhat locations
diff --git a/roles/capture-performance-data/defaults/main.yaml b/roles/capture-performance-data/defaults/main.yaml
new file mode 100644
index 0000000000..7bd79f4c4f
--- /dev/null
+++ b/roles/capture-performance-data/defaults/main.yaml
@@ -0,0 +1,3 @@
+devstack_base_dir: /opt/stack
+devstack_conf_dir: "{{ devstack_base_dir }}"
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/capture-performance-data/tasks/main.yaml b/roles/capture-performance-data/tasks/main.yaml
new file mode 100644
index 0000000000..2d2cfe4b8b
--- /dev/null
+++ b/roles/capture-performance-data/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: Generate statistics
+  shell:
+    executable: /bin/bash
+    cmd: |
+      source {{ devstack_conf_dir }}/stackrc
+      python3 {{ devstack_conf_dir }}/tools/get-stats.py \
+        --db-user="$DATABASE_USER" \
+        --db-pass="$DATABASE_PASSWORD" \
+        --db-host="$DATABASE_HOST" \
+        {{ apache_logs }} > {{ stage_dir }}/performance.json
+  vars:
+    apache_logs: >-
+      {% for i in debian_suse_apache_deref_logs.results | default([]) + redhat_apache_deref_logs.results | default([]) %}
+      --apache-log="{{ i.stat.path }}"
+      {% endfor %}
diff --git a/stackrc b/stackrc
index d22fa88373..c3254dcce4 100644
--- a/stackrc
+++ b/stackrc
@@ -193,6 +193,10 @@ ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
 # (currently only implemented for MySQL backend)
 DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 
+# This can be used to turn on various non-default items in the
+# performance_schema that are of interest to us
+MYSQL_GATHER_PERFORMANCE=$(trueorfalse True MYSQL_GATHER_PERFORMANCE)
+
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is
 # in the format for timeout(1);
diff --git a/tools/get-stats.py b/tools/get-stats.py
new file mode 100755
index 0000000000..dc0bd0f9e5
--- /dev/null
+++ b/tools/get-stats.py
@@ -0,0 +1,155 @@
+#!/usr/bin/python3
+
+import argparse
+import datetime
+import glob
+import itertools
+import json
+import os
+import psutil
+import re
+import socket
+import subprocess
+import sys
+import pymysql
+
+# https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion
+
+
+def tryint(value):
+    try:
+        return int(value)
+    except (ValueError, TypeError):
+        return value
+
+
+def get_service_stats(service):
+    stats = {'MemoryCurrent': 0}
+    output = subprocess.check_output(['/usr/bin/systemctl', 'show', service] +
+                                     ['-p%s' % stat for stat in stats])
+    for line in output.decode().split('\n'):
+        if not line:
+            continue
+        stat, val = line.split('=')
+        stats[stat] = int(val)
+
+    return stats
+
+
+def get_services_stats():
+    services = [os.path.basename(s) for s in
+                glob.glob('/etc/systemd/system/devstack@*.service')]
+    return [dict(service=service, **get_service_stats(service))
+            for service in services]
+
+
+def get_process_stats(proc):
+    cmdline = proc.cmdline()
+    if 'python' in cmdline[0]:
+        cmdline = cmdline[1:]
+    return {'cmd': cmdline[0],
+            'pid': proc.pid,
+            'args': ' '.join(cmdline[1:]),
+            'rss': proc.memory_info().rss}
+
+
+def get_processes_stats(matches):
+    me = os.getpid()
+    procs = psutil.process_iter()
+
+    def proc_matches(proc):
+        return me != proc.pid and any(
+            re.search(match, ' '.join(proc.cmdline()))
+            for match in matches)
+
+    return [
+        get_process_stats(proc)
+        for proc in procs
+        if proc_matches(proc)]
+
+
+def get_db_stats(host, user, passwd):
+    dbs = []
+    db = pymysql.connect(host=host, user=user, password=passwd,
+                         database='performance_schema',
+                         cursorclass=pymysql.cursors.DictCursor)
+    with db:
+        with db.cursor() as cur:
+            cur.execute(
+                'SELECT COUNT(*) AS queries,current_schema AS db FROM '
+                'events_statements_history_long GROUP BY current_schema')
+            for row in cur:
+                dbs.append({k: tryint(v) for k, v in row.items()})
+    return dbs
+
+
+def get_http_stats_for_log(logfile):
+    stats = {}
+    for line in open(logfile).readlines():
+        m = re.search('"([A-Z]+) /([^" ]+)( HTTP/1.1)?" ([0-9]{3}) ([0-9]+)',
+                      line)
+        if m:
+            method = m.group(1)
+            path = m.group(2)
+            status = m.group(4)
+            size = int(m.group(5))
+
+            try:
+                service, rest = path.split('/', 1)
+            except ValueError:
+                # Root calls like "GET /identity"
+                service = path
+                rest = ''
+
+            stats.setdefault(service, {'largest': 0})
+            stats[service].setdefault(method, 0)
+            stats[service][method] += 1
+            stats[service]['largest'] = max(stats[service]['largest'], size)
+
+    # Flatten this for ES
+    return [{'service': service, 'log': os.path.basename(logfile),
+             **vals}
+            for service, vals in stats.items()]
+
+
+def get_http_stats(logfiles):
+    return list(itertools.chain.from_iterable(get_http_stats_for_log(log)
+                                              for log in logfiles))
+
+
+def get_report_info():
+    return {
+        'timestamp': datetime.datetime.now().isoformat(),
+        'hostname': socket.gethostname(),
+    }
+
+
+if __name__ == '__main__':
+    process_defaults = ['privsep', 'mysqld', 'erlang', 'etcd']
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--db-user', default='root',
+                        help=('MySQL user for collecting stats '
+                              '(default: "root")'))
+    parser.add_argument('--db-pass', default=None,
+                        help='MySQL password for db-user')
+    parser.add_argument('--db-host', default='localhost',
+                        help='MySQL hostname')
+    parser.add_argument('--apache-log', action='append', default=[],
+                        help='Collect API call stats from this apache log')
+    parser.add_argument('--process', action='append',
+                        default=process_defaults,
+                        help=('Include process stats for this cmdline regex '
+                              '(default is %s)' % ','.join(process_defaults)))
+    args = parser.parse_args()
+
+    data = {
+        'services': get_services_stats(),
+        'db': args.db_pass and get_db_stats(args.db_host,
+                                            args.db_user,
+                                            args.db_pass) or [],
+        'processes': get_processes_stats(args.process),
+        'api': get_http_stats(args.apache_log),
+        'report': get_report_info(),
+    }
+
+    print(json.dumps(data, indent=2))

From 4423450eb334aad6f889ddae2ab9b9a2a2197a4a Mon Sep 17 00:00:00 2001
From: Zhou Yanbing <zhouyanbing.zhou@huawei.com>
Date: Thu, 21 Apr 2022 15:00:41 +0800
Subject: [PATCH 2969/3333] modify the sample value of LOGDAYS

the value of LOGDAYS in samples/local.conf is 2, so change the
value in the comment and the sample value in the document to
be consistent with it.

Change-Id: I5822bbf1d6ad347c67c886be1e3325113d079114
---
 doc/source/configuration.rst | 2 +-
 samples/local.conf           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index dd8f21faaf..40a8725b8d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -279,7 +279,7 @@ number of days of old log files to keep.
 
 ::
 
-    LOGDAYS=1
+    LOGDAYS=2
 
 Some coloring is used during the DevStack runs to make it easier to
 see what is going on. This can be disabled with::
diff --git a/samples/local.conf b/samples/local.conf
index 8b76137c38..55b729809d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -49,7 +49,7 @@ SERVICE_PASSWORD=$ADMIN_PASSWORD
 # path of the destination log file.  A timestamp will be appended to the given name.
 LOGFILE=$DEST/logs/stack.sh.log
 
-# Old log files are automatically removed after 7 days to keep things neat.  Change
+# Old log files are automatically removed after 2 days to keep things neat.  Change
 # the number of days by setting ``LOGDAYS``.
 LOGDAYS=2
 

From af75f689fa5d03446593c3b4c7724f0922f0f19a Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 14 Apr 2022 21:48:38 +0100
Subject: [PATCH 2970/3333] install mod_ssl on centos 9 stream by default

This change adds mod_ssl to the default set of rpms installed
on rpm based distros.

this is required if the tls-proxy service is enabled
for multi node centos based jobs.

Change-Id: I52652de88352094c824da68e5baf7db4c17cb027
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index 163a7c8f24..668705b1c3 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -17,6 +17,7 @@ libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
 make # dist:openEuler-20.03
+mod_ssl # required for tls-proxy on centos 9 stream computes
 net-tools
 openssh-server
 openssl

From 7191c5e7e7edb1e2f28c0ce71294f61b409cf16b Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Fri, 22 Apr 2022 12:01:13 +0200
Subject: [PATCH 2971/3333] Use proper sed separator for paths

I941ef5ea90970a0901236afe81c551aaf24ac1d8 added a sed command that
should match and delete path values but used '/' as sed separator. This
leads to error in unstack.sh runs when the path also contains '/':

+./unstack.sh:main:188 sudo sed -i '/directory=/opt/stack/ d' /etc/gitconfig
sed: -e expression #1, char 13: unknown command: `o'

So this patch replace '/' separator with '+'.

Change-Id: I06811c0d9ee7ecddf84ef1c6dd6cff5129dbf4b1
---
 unstack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/unstack.sh b/unstack.sh
index 813f9a8117..a36af3fb59 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -185,4 +185,4 @@ rm -Rf $DEST/async
 # Clean any safe.directory items we wrote into the global
 # gitconfig. We can identify the relevant ones by checking that they
 # point to somewhere in our $DEST directory.
-sudo sed -i "/directory=${DEST}/ d" /etc/gitconfig
+sudo sed -i "\+directory = ${DEST}+ d" /etc/gitconfig

From c6dfd169aeb3fbf2ba73ad8403cc1feb7c6ecf76 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 25 Apr 2022 15:19:06 -0500
Subject: [PATCH 2972/3333] Drop centos 8 stream testing

In Zed cycle testing runtime, we are targetting the centos 9 stream
- https://governance.openstack.org/tc/reference/runtimes/zed.html

With dropping the python 3.6 support, project started adding python 3.8
as minimum, example nova:
- https://github.com/openstack/nova/blob/56b5aed08c6a3ed81b78dc216f0165ebfe3c3350/setup.cfg#L13

with that, centos 8 stream job is failing 100%
- https://zuul.openstack.org/build/970d029dc96742c3aa0f6932a35e97cf
- https://zuul.openstack.org/builds?job_name=devstack-platform-centos-8-stream&skip=0

This commit drops centos-8-stream testing so that we focus on centos-9-stream.

Change-Id: I045e67b1ca79aba1b2a7be9f88d7804c69c6d781
---
 .zuul.yaml | 51 ---------------------------------------------------
 1 file changed, 51 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8fd4d0212c..a437c1cc02 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -56,16 +56,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-centos-8-stream
-    nodes:
-      - name: controller
-        label: centos-8-stream
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-9-stream
     nodes:
@@ -146,36 +136,6 @@
         nodes:
           - compute1
 
-- nodeset:
-    name: openstack-two-node-centos-8-stream
-    nodes:
-      - name: controller
-        label: centos-8-stream
-      - name: compute1
-        label: centos-8-stream
-    groups:
-      # Node where tests are executed and test results collected
-      - name: tempest
-        nodes:
-          - controller
-      # Nodes running the compute service
-      - name: compute
-        nodes:
-          - controller
-          - compute1
-      # Nodes that are not the controller
-      - name: subnode
-        nodes:
-          - compute1
-      # Switch node for multinode networking setup
-      - name: switch
-        nodes:
-          - controller
-      # Peer nodes for multinode networking setup
-      - name: peers
-        nodes:
-          - compute1
-
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -694,16 +654,6 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
-- job:
-    name: devstack-platform-centos-8-stream
-    parent: tempest-full-py3
-    description: CentOS 8 Stream platform test
-    nodeset: devstack-single-node-centos-8-stream
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-
 - job:
     name: devstack-platform-centos-9-stream
     parent: tempest-full-py3
@@ -877,7 +827,6 @@
         - devstack-ipv6
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
-        - devstack-platform-centos-8-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-multinode

From 8615563df47261d9c6dab7c5badbceb399d0e14d Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Mon, 18 Oct 2021 16:52:06 +0200
Subject: [PATCH 2973/3333] Global option for enforcing scope (ENFORCE_SCOPE)

This updates each devstack service library, to use it as the
default value for service-specific RBAC configuration.

Change-Id: I41061d042206c411ee3dd94ce91098e612af7ae7
---
 .zuul.yaml         |  5 +----
 functions-common   |  2 +-
 lib/cinder         |  2 +-
 lib/glance         |  2 +-
 lib/keystone       |  2 +-
 lib/neutron        |  2 +-
 lib/neutron-legacy |  2 +-
 lib/tempest        | 11 ++++++++---
 stackrc            |  4 ++++
 9 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fc80e6c413..0f047166fa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -646,10 +646,7 @@
       This job runs the devstack with scope checks enabled.
     vars:
       devstack_localrc:
-        # Keep enabeling the services here to run with system scope
-        CINDER_ENFORCE_SCOPE: true
-        GLANCE_ENFORCE_SCOPE: true
-        NEUTRON_ENFORCE_SCOPE: true
+        ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode
diff --git a/functions-common b/functions-common
index b2cf9d99c6..603e7d896d 100644
--- a/functions-common
+++ b/functions-common
@@ -1154,7 +1154,7 @@ function is_ironic_hardware {
 }
 
 function is_ironic_enforce_scope {
-    is_service_enabled ironic && [[ "$IRONIC_ENFORCE_SCOPE" == "True" ]] && return 0
+    is_service_enabled ironic && [[ "$IRONIC_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]] && return 0
     return 1
 }
 
diff --git a/lib/cinder b/lib/cinder
index b029fa0db4..52818a81eb 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -380,7 +380,7 @@ function configure_cinder {
         iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
     fi
 
-    if [[ "$CINDER_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $CINDER_CONF oslo_policy enforce_scope true
         iniset $CINDER_CONF oslo_policy enforce_new_defaults true
     fi
diff --git a/lib/glance b/lib/glance
index 9bba938b9d..04b901181c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -432,7 +432,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
 
-    if [[ "$GLANCE_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
         iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
         iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
diff --git a/lib/keystone b/lib/keystone
index a4c8a52121..80a136f78d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -265,7 +265,7 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $KEYSTONE_CONF oslo_policy enforce_scope true
         iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
         iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
diff --git a/lib/neutron b/lib/neutron
index e7719d4ebc..f24ccfb1a9 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -632,7 +632,7 @@ function configure_neutron {
 # configure_rbac_policies() - Configure Neutron to enforce new RBAC
 # policies and scopes if NEUTRON_ENFORCE_SCOPE == True
 function configure_rbac_policies {
-    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "ENFORCE_SCOPE" == "True" ]]; then
         iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
         iniset $NEUTRON_CONF oslo_policy enforce_scope True
     else
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b906a1b2ff..253b457ae1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -500,7 +500,7 @@ function configure_neutron_after_post_config {
 # configure_rbac_policies() - Configure Neutron to enforce new RBAC
 # policies and scopes if NEUTRON_ENFORCE_SCOPE == True
 function configure_rbac_policies {
-    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == True ]]; then
         iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
         iniset $NEUTRON_CONF oslo_policy enforce_scope True
     else
diff --git a/lib/tempest b/lib/tempest
index 45046632b4..1fd4184763 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -607,14 +607,19 @@ function configure_tempest {
     # If services enable the enforce_scope for their policy
     # we need to enable the same on Tempest side so that
     # test can be run with scoped token.
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope keystone true
         iniset $TEMPEST_CONFIG auth admin_system 'all'
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
-    iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
-    iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"
+    if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope glance true
+    fi
+
+    if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope cinder true
+    fi
 
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes
diff --git a/stackrc b/stackrc
index 681e9dee38..72180d07f2 100644
--- a/stackrc
+++ b/stackrc
@@ -179,6 +179,10 @@ fi
 # TODO(frickler): Drop this when plugins no longer need it
 IDENTITY_API_VERSION=3
 
+# Global option for enforcing scope. If enabled, ENFORCE_SCOPE overrides
+# each services ${SERVICE}_ENFORCE_SCOPE variables
+ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.

From 6964ba4a984691d79cff77506a37d0fa222a5599 Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Mon, 25 Apr 2022 08:48:20 -0700
Subject: [PATCH 2974/3333] Set public bridge up for v6 only configurations

A long time ago, Ironic's IPv6 only job started to fail working with
errors indicated the host was unreacable. Turns out, this was because
the $ext_gw_interface was not being set to up, and thus could
be found in a Down state, and thus the kernel would not accept routes
for it.

Adds an explicit step to turn up the public bridge, much as done in
the IPv4 router plugin code which would also be executed in 4+6.

That being said, Ironic's CI jobs are very intentionally IPv6 only
to ensure that we have no chances of v4 addressing getting used
at any point in time.

This should allow Ironic to return it's IPv6 only CI job back
to the normal check queue, once a ironic plugin issue has been
resolved which was introduced while it was removed.

Change-Id: I121ec8a2e9640b21a7126f2eeb23da36b4aa95bf
---
 lib/neutron_plugins/services/l3 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index c0d74c7728..fbd4692bba 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -403,7 +403,10 @@ function _neutron_configure_router_v6 {
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
 
-            # Configure interface for public bridge
+            # Configure interface for public bridge by setting the interface
+            # to "up" in case the job is running entirely private network based
+            # testing.
+            sudo ip link set $ext_gw_interface up
             sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
             # Any IPv6 private subnet that uses the default IPV6 subnet pool
             # and that is plugged into the default router (Q_ROUTER_NAME) will

From bab0c9210371e1cfa321b8528217a7f2e156d7a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Harald=20Jens=C3=A5s?= <hjensas@redhat.com>
Date: Tue, 26 Apr 2022 15:46:56 +0200
Subject: [PATCH 2975/3333] Use tryint() for stats value

In some cases the value is [not set], in this case
the conversion to integer does not work.

Closes-Bug: #1970431
Change-Id: I74df7d8bc9f5cbe0709a6471cf7639caea0b58e8
---
 tools/get-stats.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index dc0bd0f9e5..05f088ef8d 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -31,7 +31,7 @@ def get_service_stats(service):
         if not line:
             continue
         stat, val = line.split('=')
-        stats[stat] = int(val)
+        stats[stat] = tryint(val)
 
     return stats
 

From 1b601c7b1e8a3ec4816cb827ccd8bf909a05debb Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 25 Apr 2022 07:47:56 -0700
Subject: [PATCH 2976/3333] Tolerate missing deps in get-stats.py

In order to run on systems where not all requirements are present,
we should be tolerant of missing external dependencies, such as
psutil and pymysql. Print a warning (to stderr) and just leave out
those stats in that case.

Also make running the stats collector use ignore_errors:yes to avoid
failures in the future. I think the stats is not critical enough to
fail a job for bugs like this.

Related-Bug: #1970195
Change-Id: I132b0e1f5033c4f109a8b8cc776c0877574c4a49
---
 .../capture-performance-data/tasks/main.yaml  |  1 +
 tools/get-stats.py                            | 24 ++++++++++++++-----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/roles/capture-performance-data/tasks/main.yaml b/roles/capture-performance-data/tasks/main.yaml
index 2d2cfe4b8b..f9bb0f7851 100644
--- a/roles/capture-performance-data/tasks/main.yaml
+++ b/roles/capture-performance-data/tasks/main.yaml
@@ -13,3 +13,4 @@
       {% for i in debian_suse_apache_deref_logs.results | default([]) + redhat_apache_deref_logs.results | default([]) %}
       --apache-log="{{ i.stat.path }}"
       {% endfor %}
+  ignore_errors: yes
diff --git a/tools/get-stats.py b/tools/get-stats.py
index dc0bd0f9e5..2418c851f9 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -6,12 +6,24 @@
 import itertools
 import json
 import os
-import psutil
 import re
 import socket
 import subprocess
 import sys
-import pymysql
+
+try:
+    import psutil
+except ImportError:
+    psutil = None
+    print('No psutil, process information will not be included',
+          file=sys.stderr)
+
+try:
+    import pymysql
+except ImportError:
+    pymysql = None
+    print('No pymysql, database information will not be included',
+          file=sys.stderr)
 
 # https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion
 
@@ -144,10 +156,10 @@ def get_report_info():
 
     data = {
         'services': get_services_stats(),
-        'db': args.db_pass and get_db_stats(args.db_host,
-                                            args.db_user,
-                                            args.db_pass) or [],
-        'processes': get_processes_stats(args.process),
+        'db': pymysql and args.db_pass and get_db_stats(args.db_host,
+                                                        args.db_user,
+                                                        args.db_pass) or [],
+        'processes': psutil and get_processes_stats(args.process) or [],
         'api': get_http_stats(args.apache_log),
         'report': get_report_info(),
     }

From 42be2425d8782799d3d9f82c6f1789f8b05a4301 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Thu, 28 Apr 2022 18:15:50 +0530
Subject: [PATCH 2977/3333] Collect status of all services

Would be helpful in troubleshooting services
which either fails to start or takes time to
start.

Related-Bug: #1970679
Change-Id: Iba2fce5f8b1cd00708f092e6eb5a1fbd96e97da0
---
 .zuul.yaml                                | 1 +
 roles/capture-system-logs/README.rst      | 1 +
 roles/capture-system-logs/tasks/main.yaml | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index a437c1cc02..2935560951 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -398,6 +398,7 @@
         '{{ stage_dir }}/rpm-qa.txt': logs
         '{{ stage_dir }}/core': logs
         '{{ stage_dir }}/listen53.txt': logs
+        '{{ stage_dir }}/services.txt': logs
         '{{ stage_dir }}/deprecations.log': logs
         '{{ stage_dir }}/audit.log': logs
         /etc/ceph: logs
diff --git a/roles/capture-system-logs/README.rst b/roles/capture-system-logs/README.rst
index c28412457a..1376f63bfc 100644
--- a/roles/capture-system-logs/README.rst
+++ b/roles/capture-system-logs/README.rst
@@ -9,6 +9,7 @@ Stage a number of different logs / reports:
 - coredumps
 - dns resolver
 - listen53
+- services
 - unbound.log
 - deprecation messages
 
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index 905806d529..77b5ec5098 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -19,6 +19,9 @@
           rpm -qa | sort > {{ stage_dir }}/rpm-qa.txt
       fi
 
+      # Services status
+      sudo systemctl status --all > services.txt 2>/dev/null
+
       # NOTE(kchamart) The 'audit.log' can be useful in cases when QEMU
       # failed to start due to denials from SELinux — useful for CentOS
       # and Fedora machines.  For Ubuntu (which runs AppArmor), DevStack

From 1baa8905d5a3d677b5298e76621b9e08e0ed0f13 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 6 May 2022 17:53:54 +0530
Subject: [PATCH 2978/3333] Wait for OVN dbs also along with sockets

When OVN is setup from distro packages, the
main service is ovn-central which when restarted,
restarts ovn-northd, ovn nb and db services.

And during the restart ovn dbs(ovnnb_db.db and ovnsb_db.db)
are created, which may sometime takes time as seen with
ubuntu jammy tests[1].

We already checking for socket's file to be available,
let's also check for db files as without it ovn-*ctl
operations succeed but changes are not persisted until
db files are available and changes are lost with the restart.

[1] https://review.opendev.org/c/openstack/devstack/+/839389

Change-Id: I178da7af8cba8bcc8a67174e439df7c0f2c7d4d5
---
 lib/neutron_plugins/ovn_agent | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 927896b70b..9022f2d382 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -169,6 +169,17 @@ Q_LOG_DRIVER_LOG_BASE=${Q_LOG_DRIVER_LOG_BASE:-acl_log_meter}
 # Utility Functions
 # -----------------
 
+function wait_for_db_file {
+    local count=0
+    while [ ! -f $1 ]; do
+        sleep 1
+        count=$((count+1))
+        if [ "$count" -gt 5 ]; then
+            die $LINENO "DB File $1 not found"
+        fi
+    done
+}
+
 function wait_for_sock_file {
     local count=0
     while [ ! -S $1 ]; do
@@ -695,8 +706,11 @@ function start_ovn {
         fi
 
         # Wait for the service to be ready
+        # Check for socket and db files for both OVN NB and SB
         wait_for_sock_file $OVS_RUNDIR/ovnnb_db.sock
         wait_for_sock_file $OVS_RUNDIR/ovnsb_db.sock
+        wait_for_db_file $OVN_DATADIR/ovnnb_db.db
+        wait_for_db_file $OVN_DATADIR/ovnsb_db.db
 
         if is_service_enabled tls-proxy; then
             sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem

From 5c765cb8a1866bd3405946d097d7fb06066ae4d4 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 26 Apr 2022 13:08:21 +0200
Subject: [PATCH 2979/3333] Add Ubuntu 22.04 LTS (jammy) platform job

The new Ubuntu LTS release has been made last week, start running
devstack on it as a platform job.

Horizon has issues with py310, so gets disabled for now.

Run variants with OVS and OVN(default).

Co-Authored-By: yatinkarel <ykarel@redhat.com>
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I47696273d6b009f754335b44ef3356b4f5115cd8
---
 .zuul.yaml | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |  2 +-
 2 files changed, 77 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a437c1cc02..e87f410202 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -16,6 +16,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-jammy
+    nodes:
+      - name: controller
+        label: ubuntu-jammy
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-single-node-focal
     nodes:
@@ -718,6 +728,69 @@
         # from source instead.
         OVN_BUILD_FROM_SOURCE: True
 
+- job:
+    name: devstack-platform-ubuntu-jammy
+    parent: tempest-full-py3
+    description: Ubuntu 22.04 LTS (jammy) platform test
+    nodeset: openstack-single-node-jammy
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+      devstack_services:
+        # Horizon doesn't like py310
+        horizon: false
+
+- job:
+    name: devstack-platform-ubuntu-jammy-ovn-source
+    parent: devstack-platform-ubuntu-jammy
+    description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    vars:
+      devstack_localrc:
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "v21.06.0"
+        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
+
+- job:
+    name: devstack-platform-ubuntu-jammy-ovs
+    parent: tempest-full-py3
+    description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
+    nodeset: openstack-single-node-jammy
+    timeout: 9000
+    vars:
+      configure_swap_size: 8192
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        Q_ML2_TENANT_NETWORK_TYPE: vxlan
+      devstack_services:
+        # Horizon doesn't like py310
+        horizon: false
+        # Disable OVN services
+        ovn-northd: false
+        ovn-controller: false
+        ovs-vswitchd: false
+        ovsdb-server: false
+        # Disable Neutron ML2/OVN services
+        q-ovn-metadata-agent: false
+        # Enable Neutron ML2/OVS services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Disable OVN services
+          ovn-controller: false
+          ovs-vswitchd: false
+          ovsdb-server: false
+          # Disable Neutron ML2/OVN services
+          q-ovn-metadata-agent: false
+          # Enable Neutron ML2/OVS services
+          q-agt: true
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -829,6 +902,9 @@
         - devstack-platform-fedora-latest
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
+        - devstack-platform-ubuntu-jammy
+        - devstack-platform-ubuntu-jammy-ovn-source
+        - devstack-platform-ubuntu-jammy-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/stack.sh b/stack.sh
index 6e9ced985e..1970105c1d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From fe52d7f0a88de2dc330923cf6cf52c83ccb92bd6 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 28 Apr 2022 12:34:38 -0700
Subject: [PATCH 2980/3333] Change DB counting mechanism

The mysql performance_schema method for counting per-database queries
is very heavyweight in that it requires full logging (in a table) of
every query. We do hundreds of thousands in the course of a tempest
run, which ends up creating its own performance problem.

This changes the approach we take, which is to bundle a very tiny
sqlalchemy plugin module which counts just what we care about in
a special database.

It is more complex than just enabling the features in mysql, but it
is a massively smaller runtime overhead. It also provides us the
opportunity to easily zero the counters just before a tempest run.

Change-Id: I361bc30bb970cdaf18b966951f217862d302f0b9
---
 lib/databases/mysql            |  28 ++++++--
 stack.sh                       |  13 ++++
 tools/dbcounter/dbcounter.py   | 120 +++++++++++++++++++++++++++++++++
 tools/dbcounter/pyproject.toml |   3 +
 tools/dbcounter/setup.cfg      |  14 ++++
 tools/get-stats.py             |   6 +-
 6 files changed, 173 insertions(+), 11 deletions(-)
 create mode 100644 tools/dbcounter/dbcounter.py
 create mode 100644 tools/dbcounter/pyproject.toml
 create mode 100644 tools/dbcounter/setup.cfg

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 6b3ea0287c..b292da25bd 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -151,12 +151,16 @@ function configure_database_mysql {
     fi
 
     if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" ]]; then
-        echo "enabling MySQL performance_schema items"
-        # Enable long query history
-        iniset -sudo $my_conf mysqld \
-               performance-schema-consumer-events-statements-history-long TRUE
-        iniset -sudo $my_conf mysqld \
-               performance_schema_events_stages_history_long_size 1000000
+        echo "enabling MySQL performance counting"
+
+        # Install our sqlalchemy plugin
+        pip_install ${TOP_DIR}/tools/dbcounter
+
+        # Create our stats database for accounting
+        recreate_database stats
+        mysql -u $DATABASE_USER -p$DATABASE_PASSWORD -h $MYSQL_HOST -e \
+              "CREATE TABLE queries (db VARCHAR(32), op VARCHAR(32),
+                count INT, PRIMARY KEY (db, op)) ENGINE MEMORY" stats
     fi
 
     restart_service $MYSQL_SERVICE_NAME
@@ -218,7 +222,17 @@ function install_database_python_mysql {
 
 function database_connection_url_mysql {
     local db=$1
-    echo "$BASE_SQL_CONN/$db?charset=utf8"
+    local plugin
+
+    # NOTE(danms): We don't enable perf on subnodes yet because the
+    # plugin is not installed there
+    if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" ]]; then
+        if is_service_enabled mysql; then
+            plugin="&plugin=dbcounter"
+        fi
+    fi
+
+    echo "$BASE_SQL_CONN/$db?charset=utf8$plugin"
 }
 
 
diff --git a/stack.sh b/stack.sh
index 6e9ced985e..16dce81d3d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1512,6 +1512,19 @@ async_cleanup
 time_totals
 async_print_timing
 
+if is_service_enabled mysql; then
+    if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" && "$MYSQL_HOST" ]]; then
+        echo ""
+        echo ""
+        echo "Post-stack database query stats:"
+        mysql -u $DATABASE_USER -p$DATABASE_PASSWORD -h $MYSQL_HOST stats -e \
+              'SELECT * FROM queries' -t 2>/dev/null
+        mysql -u $DATABASE_USER -p$DATABASE_PASSWORD -h $MYSQL_HOST stats -e \
+              'DELETE FROM queries' 2>/dev/null
+    fi
+fi
+
+
 # Using the cloud
 # ===============
 
diff --git a/tools/dbcounter/dbcounter.py b/tools/dbcounter/dbcounter.py
new file mode 100644
index 0000000000..5057f0f393
--- /dev/null
+++ b/tools/dbcounter/dbcounter.py
@@ -0,0 +1,120 @@
+import json
+import logging
+import os
+import threading
+import time
+import queue
+
+import sqlalchemy
+from sqlalchemy.engine import CreateEnginePlugin
+from sqlalchemy import event
+
+# https://docs.sqlalchemy.org/en/14/core/connections.html?
+# highlight=createengineplugin#sqlalchemy.engine.CreateEnginePlugin
+
+LOG = logging.getLogger(__name__)
+
+# The theory of operation here is that we register this plugin with
+# sqlalchemy via an entry_point. It gets loaded by virtue of plugin=
+# being in the database connection URL, which gives us an opportunity
+# to hook the engines that get created.
+#
+# We opportunistically spawn a thread, which we feed "hits" to over a
+# queue, and which occasionally writes those hits to a special
+# database called 'stats'. We access that database with the same user,
+# pass, and host as the main connection URL for simplicity.
+
+
+class LogCursorEventsPlugin(CreateEnginePlugin):
+    def __init__(self, url, kwargs):
+        self.db_name = url.database
+        LOG.info('Registered counter for database %s' % self.db_name)
+        new_url = sqlalchemy.engine.URL.create(url.drivername,
+                                               url.username,
+                                               url.password,
+                                               url.host,
+                                               url.port,
+                                               'stats')
+
+        self.engine = sqlalchemy.create_engine(new_url)
+        self.queue = queue.Queue()
+        self.thread = None
+
+    def engine_created(self, engine):
+        """Hook the engine creation process.
+
+        This is the plug point for the sqlalchemy plugin. Using
+        plugin=$this in the URL causes this method to be called when
+        the engine is created, giving us a chance to hook it below.
+        """
+        event.listen(engine, "before_cursor_execute", self._log_event)
+
+    def ensure_writer_thread(self):
+        self.thread = threading.Thread(target=self.stat_writer, daemon=True)
+        self.thread.start()
+
+    def _log_event(self, conn, cursor, statement, parameters, context,
+                   executemany):
+        """Queue a "hit" for this operation to be recorded.
+
+        Attepts to determine the operation by the first word of the
+        statement, or 'OTHER' if it cannot be determined.
+        """
+
+        # Start our thread if not running. If we were forked after the
+        # engine was created and this plugin was associated, our
+        # writer thread is gone, so respawn.
+        if not self.thread or not self.thread.is_alive():
+            self.ensure_writer_thread()
+
+        try:
+            op = statement.strip().split(' ', 1)[0] or 'OTHER'
+        except Exception:
+            op = 'OTHER'
+
+        self.queue.put((self.db_name, op))
+
+    def do_incr(self, db, op, count):
+        """Increment the counter for (db,op) by count."""
+
+        query = ('INSERT INTO queries (db, op, count) '
+                 '  VALUES (%s, %s, %s) '
+                 '  ON DUPLICATE KEY UPDATE count=count+%s')
+        try:
+            with self.engine.begin() as conn:
+                r = conn.execute(query, (db, op, count, count))
+        except Exception as e:
+            LOG.error('Failed to account for access to database %r: %s',
+                      db, e)
+
+    def stat_writer(self):
+        """Consume messages from the queue and write them in batches.
+
+        This reads "hists" from from a queue fed by _log_event() and
+        writes (db,op)+=count stats to the database after ten seconds
+        of no activity to avoid triggering a write for every SELECT
+        call. Write no less often than every thirty seconds and/or 100
+        pending hits to avoid being starved by constant activity.
+        """
+        LOG.debug('[%i] Writer thread running' % os.getpid())
+        while True:
+            to_write = {}
+            total = 0
+            last = time.time()
+            while time.time() - last < 30 and total < 100:
+                try:
+                    item = self.queue.get(timeout=10)
+                    to_write.setdefault(item, 0)
+                    to_write[item] += 1
+                    total += 1
+                except queue.Empty:
+                    break
+
+            if to_write:
+                LOG.debug('[%i] Writing DB stats %s' % (
+                    os.getpid(),
+                    ','.join(['%s:%s=%i' % (db, op, count)
+                              for (db, op), count in to_write.items()])))
+
+            for (db, op), count in to_write.items():
+                self.do_incr(db, op, count)
diff --git a/tools/dbcounter/pyproject.toml b/tools/dbcounter/pyproject.toml
new file mode 100644
index 0000000000..d74d688997
--- /dev/null
+++ b/tools/dbcounter/pyproject.toml
@@ -0,0 +1,3 @@
+[build-system]
+requires = ["sqlalchemy", "setuptools>=42"]
+build-backend = "setuptools.build_meta"
\ No newline at end of file
diff --git a/tools/dbcounter/setup.cfg b/tools/dbcounter/setup.cfg
new file mode 100644
index 0000000000..f9f26f2175
--- /dev/null
+++ b/tools/dbcounter/setup.cfg
@@ -0,0 +1,14 @@
+[metadata]
+name = dbcounter
+author = Dan Smith
+author_email = dms@danplanet.com
+version = 0.1
+description = A teeny tiny dbcounter plugin for use with devstack
+url = http://github.com/openstack/devstack
+license = Apache
+
+[options]
+modules = dbcounter
+entry_points =
+    [sqlalchemy.plugins]
+    dbcounter = dbcounter:LogCursorEventsPlugin
diff --git a/tools/get-stats.py b/tools/get-stats.py
index 670e723e82..465afcab5a 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -83,13 +83,11 @@ def proc_matches(proc):
 def get_db_stats(host, user, passwd):
     dbs = []
     db = pymysql.connect(host=host, user=user, password=passwd,
-                         database='performance_schema',
+                         database='stats',
                          cursorclass=pymysql.cursors.DictCursor)
     with db:
         with db.cursor() as cur:
-            cur.execute(
-                'SELECT COUNT(*) AS queries,current_schema AS db FROM '
-                'events_statements_history_long GROUP BY current_schema')
+            cur.execute('SELECT db,op,count FROM queries')
             for row in cur:
                 dbs.append({k: tryint(v) for k, v in row.items()})
     return dbs

From 64d68679d9660e304ab3550929fe9892a124ac6f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 22 Apr 2022 07:58:29 -0700
Subject: [PATCH 2981/3333] Improve API log parsing

Two runs of the same job on the same patch can yield quite different
numbers for API calls if we just count the raw calls. Many of these
are tempest polling for resources, which on a slow worker can require
many more calls than a fast one.

Tempest seems to not change its User-Agent string, but the client
libraries do. So, if we ignore the regular "python-urllib" agent
calls, we get a much more stable count of service-to-service API
calls in the performance report.

Note that we were also logging in a different (less-rich) format for
the tls-proxy.log file, which hampers our ability to parse that
data in the same format. This switches it to "combined" which is used
by the access.log and contains more useful information, like the
user-agent, among other things.

Change-Id: I8889c2e53f85c41150e1245dcbe2a79bac702aad
---
 lib/tls            |  2 +-
 tools/get-stats.py | 77 ++++++++++++++++++++++++++++++++++------------
 2 files changed, 58 insertions(+), 21 deletions(-)

diff --git a/lib/tls b/lib/tls
index 5a7f5ae324..b8758cd6d3 100644
--- a/lib/tls
+++ b/lib/tls
@@ -557,7 +557,7 @@ $listen_string
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log
     ErrorLogFormat "%{cu}t [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
     LogLevel info
-    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log "%{%Y-%m-%d}t %{%T}t.%{msec_frac}t [%l] %a \"%r\" %>s %b"
+    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log combined
 </VirtualHost>
 EOF
     if is_suse ; then
diff --git a/tools/get-stats.py b/tools/get-stats.py
index 465afcab5a..ffe467691c 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -1,10 +1,12 @@
 #!/usr/bin/python3
 
 import argparse
+import csv
 import datetime
 import glob
 import itertools
 import json
+import logging
 import os
 import re
 import socket
@@ -25,6 +27,8 @@
     print('No pymysql, database information will not be included',
           file=sys.stderr)
 
+LOG = logging.getLogger('perf')
+
 # https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion
 
 
@@ -95,26 +99,56 @@ def get_db_stats(host, user, passwd):
 
 def get_http_stats_for_log(logfile):
     stats = {}
-    for line in open(logfile).readlines():
-        m = re.search('"([A-Z]+) /([^" ]+)( HTTP/1.1)?" ([0-9]{3}) ([0-9]+)',
-                      line)
-        if m:
-            method = m.group(1)
-            path = m.group(2)
-            status = m.group(4)
-            size = int(m.group(5))
-
-            try:
-                service, rest = path.split('/', 1)
-            except ValueError:
-                # Root calls like "GET /identity"
-                service = path
-                rest = ''
-
-            stats.setdefault(service, {'largest': 0})
-            stats[service].setdefault(method, 0)
-            stats[service][method] += 1
-            stats[service]['largest'] = max(stats[service]['largest'], size)
+    apache_fields = ('host', 'a', 'b', 'date', 'tz', 'request', 'status',
+                     'length', 'c', 'agent')
+    ignore_agents = ('curl', 'uwsgi', 'nova-status')
+    for line in csv.reader(open(logfile), delimiter=' '):
+        fields = dict(zip(apache_fields, line))
+        if len(fields) != len(apache_fields):
+            # Not a combined access log, so we can bail completely
+            return []
+        try:
+            method, url, http = fields['request'].split(' ')
+        except ValueError:
+            method = url = http = ''
+        if 'HTTP' not in http:
+            # Not a combined access log, so we can bail completely
+            return []
+
+        # Tempest's User-Agent is unchanged, but client libraries and
+        # inter-service API calls use proper strings. So assume
+        # 'python-urllib' is tempest so we can tell it apart.
+        if 'python-urllib' in fields['agent'].lower():
+            agent = 'tempest'
+        else:
+            agent = fields['agent'].split(' ')[0]
+            if agent.startswith('python-'):
+                agent = agent.replace('python-', '')
+            if '/' in agent:
+                agent = agent.split('/')[0]
+
+        if agent in ignore_agents:
+            continue
+
+        try:
+            service, rest = url.strip('/').split('/', 1)
+        except ValueError:
+            # Root calls like "GET /identity"
+            service = url.strip('/')
+            rest = ''
+
+        method_key = '%s-%s' % (agent, method)
+        try:
+            length = int(fields['length'])
+        except ValueError:
+            LOG.warning('[%s] Failed to parse length %r from line %r' % (
+                logfile, fields['length'], line))
+            length = 0
+        stats.setdefault(service, {'largest': 0})
+        stats[service].setdefault(method_key, 0)
+        stats[service][method_key] += 1
+        stats[service]['largest'] = max(stats[service]['largest'],
+                                        length)
 
     # Flatten this for ES
     return [{'service': service, 'log': os.path.basename(logfile),
@@ -131,6 +165,7 @@ def get_report_info():
     return {
         'timestamp': datetime.datetime.now().isoformat(),
         'hostname': socket.gethostname(),
+        'version': 2,
     }
 
 
@@ -152,6 +187,8 @@ def get_report_info():
                               '(default is %s)' % ','.join(process_defaults)))
     args = parser.parse_args()
 
+    logging.basicConfig(level=logging.WARNING)
+
     data = {
         'services': get_services_stats(),
         'db': pymysql and args.db_pass and get_db_stats(args.db_host,

From 92a34dbe951f2ab31fb3432e61cf34db034b0145 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Tue, 17 May 2022 20:10:48 +0530
Subject: [PATCH 2982/3333] Configure placement section in neutron conf

Without it segment plugin fails to connect with
placement api. Configure the placement section
if service is deployed.

Closes-Bug: #1973783
Change-Id: Ie7f37770a04f622735cf2263c601257669ab5064
---
 lib/neutron-legacy | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 253b457ae1..88ac991167 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -931,6 +931,9 @@ function _configure_neutron_service {
 
     configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
 
+    # Configuration for placement client
+    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
+
     # Configure plugin
     neutron_plugin_configure_service
 }

From 111a38b4d6e6f61c21570e0adba58f6c59c52900 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Fri, 13 May 2022 20:53:26 -0400
Subject: [PATCH 2983/3333] lib/tempest: add wait for Glance image import

Glance image import is asynchronous and may be configured to do image
conversion.  If image import is being used, it's possible that the
tempest configuration code is executed before the import has
completed and there may be no active images yet.  In that case,
we will poll glance every TEMPEST_GLANCE_IMPORT_POLL_INTERVAL seconds
(default: 1) to see if there are TEMPEST_GLANCE_IMAGE_COUNT active
images (default: 1) up to TEMPEST_GLANCE_IMPORT_POLL_LIMIT times
(default: 12).

You can see an example of the issue this patch addresses in real
life:
https://review.opendev.org/c/openstack/glance/+/841278/1#message-456096e48b28e5b866deb8bf53e9258ee08219a0

Change-Id: Ie99f12691d9062611a8930accfa14d9540970cc5
---
 lib/tempest | 73 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 1fd4184763..206b37b5bf 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -71,6 +71,17 @@ TEMPEST_VOLUME_VENDOR=${TEMPEST_VOLUME_VENDOR:-$TEMPEST_DEFAULT_VOLUME_VENDOR}
 TEMPEST_DEFAULT_STORAGE_PROTOCOL="iSCSI"
 TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-$TEMPEST_DEFAULT_STORAGE_PROTOCOL}
 
+# Glance/Image variables
+# When Glance image import is enabled, image creation is asynchronous and images
+# may not yet be active when tempest looks for them.  In that case, we poll
+# Glance every TEMPEST_GLANCE_IMPORT_POLL_INTERVAL seconds for the number of
+# times specified by TEMPEST_GLANCE_IMPORT_POLL_LIMIT.  If you are importing
+# multiple images, set TEMPEST_GLANCE_IMAGE_COUNT so the poller does not quit
+# too early (though it will not exceed the polling limit).
+TEMPEST_GLANCE_IMPORT_POLL_INTERVAL=${TEMPEST_GLANCE_IMPORT_POLL_INTERVAL:-1}
+TEMPEST_GLANCE_IMPORT_POLL_LIMIT=${TEMPEST_GLANCE_IMPORT_POLL_LIMIT:-12}
+TEMPEST_GLANCE_IMAGE_COUNT=${TEMPEST_GLANCE_IMAGE_COUNT:-1}
+
 # Neutron/Network variables
 IPV6_ENABLED=$(trueorfalse True IPV6_ENABLED)
 IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True IPV6_SUBNET_ATTRIBUTES_ENABLED)
@@ -127,6 +138,48 @@ function set_tempest_venv_constraints {
     fi
 }
 
+# Makes a call to glance to get a list of active images, ignoring
+# ramdisk and kernel images.  Takes 3 arguments, an array and two
+# variables.  The array will contain the list of active image UUIDs;
+# if an image with ``DEFAULT_IMAGE_NAME`` is found, its UUID will be
+# set as the value of *both* other parameters.
+function get_active_images {
+    declare -n img_array=$1
+    declare -n img_id=$2
+    declare -n img_id_alt=$3
+
+    # start with a fresh array in case we are called multiple times
+    img_array=()
+
+    while read -r IMAGE_NAME IMAGE_UUID; do
+        if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
+            img_id="$IMAGE_UUID"
+            img_id_alt="$IMAGE_UUID"
+        fi
+        img_array+=($IMAGE_UUID)
+    done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+}
+
+function poll_glance_images {
+    declare -n image_array=$1
+    declare -n image_id=$2
+    declare -n image_id_alt=$3
+    local -i poll_count
+
+    poll_count=$TEMPEST_GLANCE_IMPORT_POLL_LIMIT
+    while (( poll_count-- > 0 )) ; do
+        sleep $TEMPEST_GLANCE_IMPORT_POLL_INTERVAL
+        get_active_images image_array image_id image_id_alt
+        if (( ${#image_array[*]} >= $TEMPEST_GLANCE_IMAGE_COUNT )) ; then
+            return
+        fi
+    done
+    local msg
+    msg="Polling limit of $TEMPEST_GLANCE_IMPORT_POLL_LIMIT exceeded; "
+    msg+="poll interval was $TEMPEST_GLANCE_IMPORT_POLL_INTERVAL sec"
+    warn $LINENO "$msg"
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     if [[ "$INSTALL_TEMPEST" == "True" ]]; then
@@ -168,13 +221,21 @@ function configure_tempest {
     declare -a images
 
     if is_service_enabled glance; then
-        while read -r IMAGE_NAME IMAGE_UUID; do
-            if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
-                image_uuid="$IMAGE_UUID"
-                image_uuid_alt="$IMAGE_UUID"
+        get_active_images images image_uuid image_uuid_alt
+
+        if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
+            # Glance image import is asynchronous and may be configured
+            # to do image conversion.  If image import is being used,
+            # it's possible that this code is being executed before the
+            # import has completed and there may be no active images yet.
+            if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
+                poll_glance_images images image_uuid image_uuid_alt
+                if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
+                    echo "Only found ${#images[*]} image(s), was looking for $TEMPEST_GLANCE_IMAGE_COUNT"
+                    exit 1
+                fi
             fi
-            images+=($IMAGE_UUID)
-        done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+        fi
 
         case "${#images[*]}" in
             0)

From 083eeee5af61a19a932138b5035a916c7421beee Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 19 May 2022 13:55:35 +0200
Subject: [PATCH 2984/3333] Make jammy platform jobs non-voting

We missed to add the jobs to the gate queue and so they have already
regressed before they were actually in place. Make them non-voting for
now until the issues are fixed.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5d1f83dfe23747096163076dcf80750585c0260e
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index b449ea67be..0e114afb3e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -731,6 +731,7 @@
     parent: tempest-full-py3
     description: Ubuntu 22.04 LTS (jammy) platform test
     nodeset: openstack-single-node-jammy
+    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -742,6 +743,7 @@
     name: devstack-platform-ubuntu-jammy-ovn-source
     parent: devstack-platform-ubuntu-jammy
     description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    voting: false
     vars:
       devstack_localrc:
         OVN_BUILD_FROM_SOURCE: True
@@ -754,6 +756,7 @@
     parent: tempest-full-py3
     description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
     nodeset: openstack-single-node-jammy
+    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 8192

From 560ee16a85b22b4456177d289cf53c31c6a1ca6b Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 19 May 2022 13:58:11 +0200
Subject: [PATCH 2985/3333] Drop openEuler support

The job is broken since it is running with python3.7 and most services
now require at least python3.8.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Ie21f71acffabd78c79e2b141951ccf30a5c06445
---
 .zuul.yaml                             | 25 -------------------------
 doc/source/index.rst                   |  2 +-
 files/rpms/ceph                        |  2 +-
 files/rpms/general                     |  4 +---
 files/rpms/nova                        |  2 +-
 files/rpms/swift                       |  2 +-
 functions-common                       | 13 +------------
 lib/apache                             |  2 +-
 lib/nova                               |  6 +-----
 roles/apache-logs-conf/tasks/main.yaml |  1 -
 stack.sh                               |  9 +--------
 tools/fixup_stuff.sh                   | 24 ------------------------
 12 files changed, 9 insertions(+), 83 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b449ea67be..3beae1f822 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -106,16 +106,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-openeuler-20.03-sp2
-    nodes:
-      - name: controller
-        label: openEuler-20-03-LTS-SP2
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -712,20 +702,6 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
-- job:
-    name: devstack-platform-openEuler-20.03-SP2
-    parent: tempest-full-py3
-    description: openEuler 20.03 SP2 platform test
-    nodeset: devstack-single-node-openeuler-20.03-sp2
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-      devstack_localrc:
-        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
-        # from source instead.
-        OVN_BUILD_FROM_SOURCE: True
-
 - job:
     name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
@@ -1001,7 +977,6 @@
 
     experimental:
       jobs:
-        - devstack-platform-openEuler-20.03-SP2
         - nova-multi-cell
         - nova-next
         - neutron-fullstack-with-uwsgi
diff --git a/doc/source/index.rst b/doc/source/index.rst
index feb50ce4e9..08ce4cb061 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 8, OpenSUSE and openEuler.
+latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
 
 If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 93b5746aa6..33a55f80ea 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core # not:rhel9,openEuler-20.03
+redhat-lsb-core # not:rhel9
 xfsprogs
diff --git a/files/rpms/general b/files/rpms/general
index 668705b1c3..7697513149 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -16,7 +16,6 @@ libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
-make # dist:openEuler-20.03
 mod_ssl # required for tls-proxy on centos 9 stream computes
 net-tools
 openssh-server
@@ -29,8 +28,7 @@ psmisc
 python3-devel
 python3-pip
 python3-systemd
-redhat-rpm-config # not:openEuler-20.03    missing dep for gcc hardening flags, see rhbz#1217376
-systemd-devel # dist:openEuler-20.03
+redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 tar
 tcpdump
 unzip
diff --git a/files/rpms/nova b/files/rpms/nova
index 9e8621c628..9522e5729d 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -6,7 +6,7 @@ ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
-kernel-modules # not:openEuler-20.03
+kernel-modules
 kpartx
 parted
 polkit
diff --git a/files/rpms/swift b/files/rpms/swift
index a838d7839e..7d906aa926 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,5 +1,5 @@
 curl
-liberasurecode-devel # not:openEuler-20.03
+liberasurecode-devel
 memcached
 rsync-daemon
 sqlite
diff --git a/functions-common b/functions-common
index b660245337..be966e96a6 100644
--- a/functions-common
+++ b/functions-common
@@ -399,7 +399,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
+        sudo dnf install -y redhat-lsb-core
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -471,10 +471,6 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
-    elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
-        # The DISTRO here is `openEuler-20.03`. While, actually only openEuler
-        # 20.03 LTS SP2 is fully tested. Other SP version maybe have bugs.
-        DISTRO="openEuler-$os_RELEASE"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -526,7 +522,6 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
-        [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
@@ -576,12 +571,6 @@ function is_ubuntu {
     [ "$os_PACKAGE" = "deb" ]
 }
 
-function is_openeuler {
-    if [[ -z "$os_PACKAGE" ]]; then
-        GetOSVersion
-    fi
-    [ "$os_VENDOR" = "openEuler" ]
-}
 # Git Functions
 # =============
 
diff --git a/lib/apache b/lib/apache
index 02827d1f1b..94f3cfc95a 100644
--- a/lib/apache
+++ b/lib/apache
@@ -95,7 +95,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f35 ]]; then
+    elif is_fedora && ! [[ $DISTRO =~ f35 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/lib/nova b/lib/nova
index 4c14374d0f..da3a10edd0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -324,11 +324,7 @@ EOF
 
         # set chap algorithms.  The default chap_algorithm is md5 which will
         # not work under FIPS.
-        # FIXME(alee) For some reason, this breaks openeuler.  Openeuler devs should weigh in
-        # and determine the correct solution for openeuler here
-        if ! is_openeuler; then
-            iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
-        fi
+        iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
 
         # ensure that iscsid is started, even when disabled by default
         restart_service iscsid
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 6b7ea37857..bd64574c9b 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,7 +64,6 @@
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
       'RedHat': '/etc/httpd/conf.d/'
-      'openEuler': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:
diff --git a/stack.sh b/stack.sh
index e53280e00c..df283bbe50 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -280,13 +280,6 @@ chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
 
-# TODO(wxy): Currently some base packages are not installed by default in
-# openEuler. Remove the code below once the packaged are installed by default
-# in the future.
-if [[ $DISTRO == "openEuler-20.03" ]]; then
-    install_package hostname
-fi
-
 # Configure Distro Repositories
 # -----------------------------
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f24ac40ad5..daa1bc6301 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -153,32 +153,8 @@ function fixup_ubuntu {
     sudo rm -rf /usr/lib/python3/dist-packages/simplejson-*.egg-info
 }
 
-function fixup_openeuler {
-    if ! is_openeuler; then
-        return
-    fi
-
-    if is_arch "x86_64"; then
-        arch="x86_64"
-    elif is_arch "aarch64"; then
-        arch="aarch64"
-    fi
-
-    # Some packages' version in openEuler are too old, use the newer ones we
-    # provide in oepkg. (oepkg is an openEuler third part yum repo which is
-    # endorsed by openEuler community)
-    (echo '[openstack-ci]'
-    echo 'name=openstack'
-    echo 'baseurl=https://repo.oepkgs.net/openEuler/rpm/openEuler-20.03-LTS-SP2/budding-openeuler/openstack-master-ci/'$arch'/'
-    echo 'enabled=1'
-    echo 'gpgcheck=0') | sudo tee -a /etc/yum.repos.d/openstack-master.repo > /dev/null
-
-    yum_install liberasurecode-devel
-}
-
 function fixup_all {
     fixup_ubuntu
     fixup_fedora
     fixup_suse
-    fixup_openeuler
 }

From 50e3c06ec245e8a5e7ca24015b0c152e3bc40a5c Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 19 May 2022 13:36:43 -0700
Subject: [PATCH 2986/3333] Fix dbcounter installation on Jammy

There are two problems with dbcounter installation on Jammy. The first
is straightforward. We have to use `py_modules` instead of `modules` to
specify the source file. I don't know how this works on other distros
but the docs [0] seem to clearly indicate py_modules does this.

The second issue is quite an issue and requires story time. When
pip/setuptools insteall editable installs (as is done for many of the
openstack projects) it creates an easy-install.pth file that tells the
python interpreter to add the source dirs of those repos to the python
path. Normally these paths are appended to your sys.path. Pip's isolated
build env relies on the assumption that these paths are appeneded to the
path when it santizes sys.path to create the isolated environemnt.

However, when SETUPTOOLS_SYS_PATH_TECHNIQUE is set to rewrite the paths
are not appended and are inserted in the middle. This breaks pip's
isolated build env which broke dbcounter installations. We fix this by
not setting SETUPTOOLS_SYS_PATH_TECHNIQUE to rewrite. Upstream indicates
the reason we set this half a decade ago has since been fixed properly.

The reason Jammy and nothing else breaks is that python3.10 is the first
python version to use pip's isolated build envs by default.

I've locally fiddled with a patch to pip [1] to try and fix this
behavior even when rewrite is set. I don't plan to push this upstream
but it helps to illustrate where the problem lies. If someone else would
like to upstream this feel free.

Finally this change makes the jammy platform job voting again and adds
it to the gate to ensure we don't regress again.

[0] https://docs.python.org/3/distutils/sourcedist.html#specifying-the-files-to-distribute
[1] https://paste.opendev.org/show/bqVAuhgMtVtfYupZK5J6/

Change-Id: I237f5663b0f8b060f6df130de04e17e2b1695f8a
---
 .zuul.yaml                | 2 +-
 inc/python                | 1 -
 tools/dbcounter/setup.cfg | 2 +-
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0e114afb3e..fc3d76d2b3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -731,7 +731,6 @@
     parent: tempest-full-py3
     description: Ubuntu 22.04 LTS (jammy) platform test
     nodeset: openstack-single-node-jammy
-    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -950,6 +949,7 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-centos-9-stream
+        - devstack-platform-ubuntu-jammy
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests
diff --git a/inc/python b/inc/python
index 9382d352dc..d032a10eb9 100644
--- a/inc/python
+++ b/inc/python
@@ -194,7 +194,6 @@ function pip_install {
         https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
-        SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
         $cmd_pip $upgrade \
         $@
     result=$?
diff --git a/tools/dbcounter/setup.cfg b/tools/dbcounter/setup.cfg
index f9f26f2175..12300bf619 100644
--- a/tools/dbcounter/setup.cfg
+++ b/tools/dbcounter/setup.cfg
@@ -8,7 +8,7 @@ url = http://github.com/openstack/devstack
 license = Apache
 
 [options]
-modules = dbcounter
+py_modules = dbcounter
 entry_points =
     [sqlalchemy.plugins]
     dbcounter = dbcounter:LogCursorEventsPlugin

From 1d5be95196d31ba1a4ef125f4b06a5730f2af113 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 23 May 2022 08:46:05 -0700
Subject: [PATCH 2987/3333] Cleanup comment that should've been removed

The previous change, I237f5663b0f8b060f6df130de04e17e2b1695f8a, removed
a SETUPTOOLS flag, but not the comment explaining why that flag was
previously set. Clean up that comment.

Change-Id: I32b0240fd56310d7f10596aaa8ef432679bfd66a
---
 inc/python | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/inc/python b/inc/python
index d032a10eb9..3eb3efe80e 100644
--- a/inc/python
+++ b/inc/python
@@ -186,9 +186,6 @@ function pip_install {
 
     $xtrace
 
-    # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
-    # the same behaviour of setuptools before version 25.0.0.
-    # related issue: https://github.com/pypa/pip/issues/3874
     $sudo_pip \
         http_proxy="${http_proxy:-}" \
         https_proxy="${https_proxy:-}" \

From 1cdf413ac6f993dc2074741be4627acdc3f10304 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 23 May 2022 13:56:13 -0700
Subject: [PATCH 2988/3333] Do not barf stack trace if stats DB is missing

This can happen if devstack fails to run, but we still run the post
tasks. Also could happen if some sort of hybrid job configuration
does not run all of devstack but we still end up running post jobs.

Just warn to stderr and assume no DB info.

Change-Id: I211a331ab668dbb0ad7882908cca4363f865d924
---
 tools/get-stats.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index ffe467691c..e0c20f2db9 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -86,9 +86,17 @@ def proc_matches(proc):
 
 def get_db_stats(host, user, passwd):
     dbs = []
-    db = pymysql.connect(host=host, user=user, password=passwd,
-                         database='stats',
-                         cursorclass=pymysql.cursors.DictCursor)
+    try:
+        db = pymysql.connect(host=host, user=user, password=passwd,
+                             database='stats',
+                             cursorclass=pymysql.cursors.DictCursor)
+    except pymysql.err.OperationalError as e:
+        if 'Unknown database' in str(e):
+            print('No stats database; assuming devstack failed',
+                  file=sys.stderr)
+            return []
+        raise
+
     with db:
         with db.cursor() as cur:
             cur.execute('SELECT db,op,count FROM queries')

From c64ea4f213afebd1602d05cdd4d5bc14eaf5356b Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 20 Apr 2022 12:30:09 +0530
Subject: [PATCH 2989/3333] Fix doc and user create script to set homedir
 permissions

RHEL based distros set homedir permissions to 700,
and Ubuntu 21.04+ to 750[1], i.e missing executable
permission for group or others, this results into failures
as defined in the below bug.

Since in doc we add useradd command, it's good to
add instructions to fix the permissions there itself
instead of getting failures during installation and then
fixing it.

Also update user create script to fix permissions
by adding executable bit to DEST directory if missing.

[1] https://discourse.ubuntu.com/t/private-home-directories-for-ubuntu-21-04-onwards/19533

Closes-Bug: #1966858
Change-Id: Id2787886433281238eb95ee11a75eddeef514293
---
 doc/source/guides/multinode-lab.rst  | 8 ++++++++
 doc/source/guides/single-machine.rst | 8 ++++++++
 doc/source/index.rst                 | 8 ++++++++
 tools/create-stack-user.sh           | 9 +++++++++
 4 files changed, 33 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 81c5945307..79a76dedb1 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -75,6 +75,14 @@ Otherwise create the stack user:
 
     useradd -s /bin/bash -d /opt/stack -m stack
 
+Ensure home directory for the ``stack`` user has executable permission for all,
+as RHEL based distros create it with ``700`` and Ubuntu 21.04+ with ``750``
+which can cause issues during deployment.
+
+::
+
+    chmod +x /opt/stack
+
 This user will be making many changes to your system during installation
 and operation so it needs to have sudo privileges to root without a
 password:
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a0e97edb37..03d93743f7 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -49,6 +49,14 @@ below)
 
     $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
+Ensure home directory for the ``stack`` user has executable permission for all,
+as RHEL based distros create it with ``700`` and Ubuntu 21.04+ with ``750``
+which can cause issues during deployment.
+
+.. code-block:: console
+
+    $ sudo chmod +x /opt/stack
+
 Since this user will be making many changes to your system, it will need
 to have sudo privileges:
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index feb50ce4e9..a79a7e602c 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -57,6 +57,14 @@ to run DevStack with
 
    $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
+Ensure home directory for the ``stack`` user has executable permission for all,
+as RHEL based distros create it with ``700`` and Ubuntu 21.04+ with ``750``
+which can cause issues during deployment.
+
+.. code-block:: console
+
+    $ sudo chmod +x /opt/stack
+
 Since this user will be making many changes to your system, it should
 have sudo privileges:
 
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index 919cacb036..cb8d7aa328 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -44,6 +44,15 @@ fi
 if ! getent passwd $STACK_USER >/dev/null; then
     echo "Creating a user called $STACK_USER"
     useradd -g $STACK_USER -s /bin/bash -d $DEST -m $STACK_USER
+    # RHEL based distros create home dir with 700 permissions,
+    # And Ubuntu 21.04+ with 750, i.e missing executable
+    # permission for either group or others
+    # Devstack deploy will have issues with this, fix it by
+    # adding executable permission
+    if [[ $(stat -c '%A' $DEST|grep -o x|wc -l) -lt 3 ]]; then
+        echo "Executable permission missing for $DEST, adding it"
+        chmod +x $DEST
+    fi
 fi
 
 echo "Giving stack user passwordless sudo privileges"

From 599b241d32cd067a9a26c54fe178dd2bd28426d6 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 21 Oct 2021 12:07:17 +0200
Subject: [PATCH 2990/3333] Run debian platform job with OVN

Packages for OVN are now available in bullseye, so we can drop the
special handling.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5e5c78aa19c5208c207ddcf14e208bae8fbc3c55
---
 .zuul.yaml | 31 -------------------------------
 1 file changed, 31 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 001ac84f12..03553d3b57 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -670,37 +670,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      # NOTE(yoctozepto): Debian Bullseye does not yet offer OVN. Switch to OVS
-      # for the time being.
-      devstack_localrc:
-        Q_AGENT: openvswitch
-        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
-        Q_ML2_TENANT_NETWORK_TYPE: vxlan
-      devstack_services:
-        # Disable OVN services
-        ovn-northd: false
-        ovn-controller: false
-        ovs-vswitchd: false
-        ovsdb-server: false
-        # Disable Neutron ML2/OVN services
-        q-ovn-metadata-agent: false
-        # Enable Neutron ML2/OVS services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
-    group-vars:
-      subnode:
-        devstack_services:
-          # Disable OVN services
-          ovn-controller: false
-          ovs-vswitchd: false
-          ovsdb-server: false
-          # Disable Neutron ML2/OVN services
-          q-ovn-metadata-agent: false
-          # Enable Neutron ML2/OVS services
-          q-agt: true
 
 - job:
     name: devstack-platform-ubuntu-jammy

From e85c68e60ff460f0e16eefd5f084862628a3c54d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 26 May 2022 09:31:36 -0700
Subject: [PATCH 2991/3333] Add apache2 to the services we collect for memory

Change-Id: Ic6daef5b4df50ce43c6782542cb54c1958e54655
---
 tools/get-stats.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index ffe467691c..80e7c642a2 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -54,7 +54,8 @@ def get_service_stats(service):
 
 def get_services_stats():
     services = [os.path.basename(s) for s in
-                glob.glob('/etc/systemd/system/devstack@*.service')]
+                glob.glob('/etc/systemd/system/devstack@*.service')] + \
+                ['apache2.service']
     return [dict(service=service, **get_service_stats(service))
             for service in services]
 

From 6dd896feface3d0413437221a63e508b359ed615 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Tue, 26 Apr 2022 16:37:07 +0530
Subject: [PATCH 2992/3333] Allow to skip stop of ovn services

Grenade jobs stop services, check fip connectivity
for a nova server and then upgrade to next release.

But since ovn data plane and db services are stopped along
with other services, fip connectivity fails as a result.

We shouldn't stop these services along with other
neutron services. This patch adds a new variable
"SKIP_STOP_OVN" which can be used by grenade jobs
to skip stop of ovn services.

This will also fix the ovn grenade jobs.

Also source fixup_stuff.sh so function fixup_ovn_centos
is available. It's already sourced in stack.sh but
that's not used in grenade run.

Change-Id: I94818a19f19973779cb2e11753d2881d54dfa3bc
---
 lib/neutron-legacy            | 5 ++++-
 lib/neutron_plugins/ovn_agent | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 88ac991167..e9b55b6b02 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -138,6 +138,9 @@ Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
+# Allow to skip stopping of OVN services
+SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
+
 # The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
 # /etc/neutron is assumed by many of devstack plugins.  Do not change.
 _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
@@ -638,7 +641,7 @@ function stop_mutnauq {
     stop_mutnauq_other
     stop_mutnauq_l2_agent
 
-    if [[ $Q_AGENT == "ovn" ]]; then
+    if [[ $Q_AGENT == "ovn" && $SKIP_STOP_OVN != "True" ]]; then
         stop_ovn
     fi
 }
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 9022f2d382..dfd55deae5 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -395,6 +395,8 @@ function install_ovn {
         sudo mkdir -p $OVS_PREFIX/var/log/ovn
         sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
     else
+        # Load fixup_ovn_centos
+        source ${TOP_DIR}/tools/fixup_stuff.sh
         fixup_ovn_centos
         install_package $(get_packages openvswitch)
         install_package $(get_packages ovn)

From 35fb53423a68f8d156693ae79c1c6950538a33b7 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 3 Jun 2022 10:10:50 +0530
Subject: [PATCH 2993/3333] [ironic][swift]Temporary add sha1 to
 allowed_digests

Swift removed sha1 from supported digests with [1] and
that broked ironic tinyipa job. Temorary add sha1 to
allowed_digests until it's fixed in ironic.

[1] https://review.opendev.org/c/openstack/swift/+/525771

Story: 2010068
Task: 45539
Change-Id: I68dfc472ce901058b6a7d691c98ed1641d431e54
---
 lib/swift | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/swift b/lib/swift
index ba92f3dcc3..251c4625b5 100644
--- a/lib/swift
+++ b/lib/swift
@@ -402,6 +402,11 @@ function configure_swift {
     # Versioned Writes
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:versioned_writes allow_versioned_writes true
 
+    # Add sha1 temporary https://storyboard.openstack.org/#!/story/2010068
+    if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempurl allowed_digests "sha1 sha256 sha512"
+    fi
+
     # Configure Ceilometer
     if is_service_enabled ceilometer; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"

From f7d87aa433d344f5db0201aca047a987cba3a0af Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 2 Jun 2022 11:08:32 -0700
Subject: [PATCH 2994/3333] Capture QEMU core dumps when possible

Some of the hardest-to-debug issues are qemu crashes deep in a nova
workflow that can't be reproduced locally. This adds a post task to
the playbook so that we capture the most recent qemu core dump, if
there is one.

Change-Id: I48a2ea883325ca920b7e7909edad53a9832fb319
---
 .zuul.yaml          | 1 +
 playbooks/post.yaml | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 001ac84f12..fdcee59bc5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -377,6 +377,7 @@
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
         '{{ devstack_log_dir }}/worlddump-latest.txt': logs
+        '{{ devstack_log_dir }}/qemu.coredump': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
         '{{ stage_dir }}/performance.json': logs
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index d8d5f6833c..0047d78ea5 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -17,6 +17,12 @@
         dest: "{{ stage_dir }}/verify_tempest_conf.log"
         state: hard
       when: tempest_log.stat.exists
+    - name: Capture most recent qemu crash dump, if any
+      shell:
+        executable: /bin/bash
+        cmd: |
+          coredumpctl -o {{ devstack_log_dir }}/qemu.coredump dump /usr/bin/qemu-system-x86_64
+      ignore_errors: yes
   roles:
     - export-devstack-journal
     - apache-logs-conf

From 96dbf55016a22dc121589a70181e5c7e7e55f8c0 Mon Sep 17 00:00:00 2001
From: Francesco Pantano <fpantano@redhat.com>
Date: Fri, 18 Mar 2022 10:56:31 +0100
Subject: [PATCH 2995/3333] Do not create cinder backup pool and key when
 cephadm is used

When cephadm is used, if ENABLE_CEPH_C_BAK is True both pool and
key are created by devstack-plugin-ceph. This piece of code can
still stay here to make sure the cinder config is properly built.

Change-Id: I799521f008123b8e42b2021c1c11d374b834bec3
---
 lib/cinder_backups/ceph | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index e4003c0720..4b180490d7 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -26,12 +26,15 @@ CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
 
 
 function configure_cinder_backup_ceph {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-    if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+    # Execute this part only when cephadm is not used
+    if [[ "$CEPHADM_DEPLOY" = "False" ]]; then
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
+        if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
+            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+        fi
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-    sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"

From c869d59857c636d21ecd0329023038b24252627d Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 28 Feb 2020 14:55:08 -0500
Subject: [PATCH 2996/3333] Add support for IPv6 tunnel endpoints

Currently, neutron tunnel endpoints must be IPv4 addresses,
i.e. $HOST_IP, although IPv6 endpoints are supported by most
drivers.

Create a TUNNEL_IP_VERSION variable to choose which host IP
to use, either HOST_IP or HOST_IPV6, and configure it in the
OVS and Linuxbridge agent driver files. The default is still
IPv4, but it can be over-ridden by specifying TUNNEL_ENDPOINT_IP
accordingly.

This behaves similar to the SERVICE_IP_VERSION option, which
can either be set to 4 or 6, but not 4+6 - the tunnel overhead
should be consistent on all systems in order not to have MTU
issues.

Must set the ML2 overlay_ip_version config option to match
else agent tunnel sync RPC will not work.

Must set the OVN external_ids:ovn-encap-ip config option to
the correct address.

Updated 'devstack-ipv6-only' job definition and verification role
that will set all services and tunnels to use IPv6 addresses.

Closes-bug: #1619476

Change-Id: I6034278dfc17b55d7863bc4db541bbdaa983a686
---
 .zuul.yaml                                    |  4 ++-
 doc/source/configuration.rst                  | 25 ++++++++++++++++--
 functions-common                              |  2 +-
 lib/neutron                                   |  5 ++--
 lib/neutron-legacy                            |  7 -----
 lib/neutron_plugins/ml2                       |  1 +
 lib/neutron_plugins/ovn_agent                 |  6 +++--
 .../README.rst                                | 10 +++----
 stackrc                                       | 26 +++++++++++++++++++
 tools/verify-ipv6-only-deployments.sh         | 25 +++++++++++++-----
 10 files changed, 84 insertions(+), 27 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 001ac84f12..7322f78963 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -625,11 +625,13 @@
     name: devstack-ipv6
     parent: devstack
     description: |
-      Devstack single node job for integration gate with IPv6.
+      Devstack single node job for integration gate with IPv6,
+      all services and tunnels using IPv6 addresses.
     vars:
       devstack_localrc:
         SERVICE_IP_VERSION: 6
         SERVICE_HOST: ""
+        TUNNEL_IP_VERSION: 6
 
 - job:
     name: devstack-enforce-scope
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 40a8725b8d..757b4001d9 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -521,8 +521,8 @@ behavior:
 can be configured with any valid IPv6 prefix. The default values make
 use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
 
-Service Version
-~~~~~~~~~~~~~~~
+Service IP Version
+~~~~~~~~~~~~~~~~~~
 
 DevStack can enable service operation over either IPv4 or IPv6 by
 setting ``SERVICE_IP_VERSION`` to either ``SERVICE_IP_VERSION=4`` or
@@ -542,6 +542,27 @@ optionally be used to alter the default IPv6 address::
 
   HOST_IPV6=${some_local_ipv6_address}
 
+Tunnel IP Version
+~~~~~~~~~~~~~~~~~
+
+DevStack can enable tunnel operation over either IPv4 or IPv6 by
+setting ``TUNNEL_IP_VERSION`` to either ``TUNNEL_IP_VERSION=4`` or
+``TUNNEL_IP_VERSION=6`` respectively.
+
+When set to ``4`` Neutron will use an IPv4 address for tunnel endpoints,
+for example, ``HOST_IP``.
+
+When set to ``6`` Neutron will use an IPv6 address for tunnel endpoints,
+for example, ``HOST_IPV6``.
+
+The default value for this setting is ``4``.  Dual-mode support, for
+example ``4+6`` is not supported, as this value must match the address
+family of the local tunnel endpoint IP(v6) address.
+
+The value of ``TUNNEL_IP_VERSION`` has a direct relationship to the
+setting of ``TUNNEL_ENDPOINT_IP``, which will default to ``HOST_IP``
+when set to ``4``, and ``HOST_IPV6`` when set to ``6``.
+
 Multi-node setup
 ~~~~~~~~~~~~~~~~
 
diff --git a/functions-common b/functions-common
index be966e96a6..f299ef1cc9 100644
--- a/functions-common
+++ b/functions-common
@@ -49,7 +49,7 @@ KILL_PATH="$(which kill)"
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
     KEYSTONE_SERVICE_URI \
     LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
-    HOST_IPV6 SERVICE_IP_VERSION"
+    HOST_IPV6 SERVICE_IP_VERSION TUNNEL_ENDPOINT_IP TUNNEL_IP_VERSION"
 
 
 # Saves significant environment variables to .stackenv for later use
diff --git a/lib/neutron b/lib/neutron
index f24ccfb1a9..1b78493919 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -230,6 +230,7 @@ function configure_neutron_new {
             mech_drivers+=",linuxbridge"
         fi
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 overlay_ip_version $TUNNEL_IP_VERSION
 
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks $PUBLIC_NETWORK_NAME
@@ -251,10 +252,10 @@ function configure_neutron_new {
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
-            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $TUNNEL_ENDPOINT_IP
         elif [[ $NEUTRON_AGENT == "openvswitch" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver openvswitch
-            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $TUNNEL_ENDPOINT_IP
 
             if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
                 iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e9b55b6b02..5e6af0f249 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -246,13 +246,6 @@ if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
     LB_PHYSICAL_INTERFACE=$default_route_dev
 fi
 
-# When Neutron tunnels are enabled it is needed to specify the
-# IP address of the end point in the local server. This IP is set
-# by default to the same IP address that the HOST IP.
-# This variable can be used to specify a different end point IP address
-# Example: ``TUNNEL_ENDPOINT_IP=1.1.1.1``
-TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-$HOST_IP}
-
 # With the openvswitch plugin, set to True in ``localrc`` to enable
 # provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
 #
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index f00feac6b4..7343606aac 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -125,6 +125,7 @@ function neutron_plugin_configure_service {
     fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
         populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index dfd55deae5..24bdf92b60 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -99,8 +99,10 @@ ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
 OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
 
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+TUNNEL_IP=$TUNNEL_ENDPOINT_IP
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
     OVSDB_SERVER_LOCAL_HOST=[$OVSDB_SERVER_LOCAL_HOST]
+    TUNNEL_IP=[$TUNNEL_IP]
 fi
 
 OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
@@ -639,7 +641,7 @@ function _start_ovs {
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
-        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$TUNNEL_IP"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname="$LOCAL_HOSTNAME"
         # Select this chassis to host gateway routers
         if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
@@ -654,7 +656,7 @@ function _start_ovs {
         if is_service_enabled ovn-controller-vtep ; then
             ovn_base_setup_bridge br-v
             vtep-ctl add-ps br-v
-            vtep-ctl set Physical_Switch br-v tunnel_ips=$HOST_IP
+            vtep-ctl set Physical_Switch br-v tunnel_ips=$TUNNEL_IP
 
             enable_service ovs-vtep
             local vtepcmd="$OVS_SCRIPTDIR/ovs-vtep --log-file --pidfile --detach br-v"
diff --git a/roles/devstack-ipv6-only-deployments-verification/README.rst b/roles/devstack-ipv6-only-deployments-verification/README.rst
index 400a8da222..3bddf5ea60 100644
--- a/roles/devstack-ipv6-only-deployments-verification/README.rst
+++ b/roles/devstack-ipv6-only-deployments-verification/README.rst
@@ -1,10 +1,10 @@
-Verify the IPv6-only deployments
+Verify all addresses in IPv6-only deployments
 
 This role needs to be invoked from a playbook that
-run tests. This role verifies the IPv6 setting on
-devstack side and devstack deploy services on IPv6.
-This role is invoked before tests are run so that
-if any missing IPv6 setting or deployments can fail
+runs tests. This role verifies the IPv6 settings on the
+devstack side and that devstack deploys with all addresses
+being IPv6. This role is invoked before tests are run so that
+if there is any missing IPv6 setting, deployments can fail
 the job early.
 
 
diff --git a/stackrc b/stackrc
index 0c76de0531..f0039f0043 100644
--- a/stackrc
+++ b/stackrc
@@ -877,6 +877,32 @@ SERVICE_HOST=${SERVICE_HOST:-${DEF_SERVICE_HOST}}
 # This is either 127.0.0.1 for IPv4 or ::1 for IPv6
 SERVICE_LOCAL_HOST=${SERVICE_LOCAL_HOST:-${DEF_SERVICE_LOCAL_HOST}}
 
+# TUNNEL IP version
+# This is the IP version to use for tunnel endpoints
+TUNNEL_IP_VERSION=${TUNNEL_IP_VERSION:-4}
+
+# Validate TUNNEL_IP_VERSION
+if [[ $TUNNEL_IP_VERSION != "4" ]] && [[ $TUNNEL_IP_VERSION != "6" ]]; then
+    die $LINENO "TUNNEL_IP_VERSION must be either 4 or 6"
+fi
+
+if [[ "$TUNNEL_IP_VERSION" == 4 ]]; then
+    DEF_TUNNEL_ENDPOINT_IP=$HOST_IP
+fi
+
+if [[ "$TUNNEL_IP_VERSION" == 6 ]]; then
+    # Only die if the user has not over-ridden the endpoint IP
+    if [[ "$HOST_IPV6" == "" ]] && [[ "$TUNNEL_ENDPOINT_IP" == "" ]]; then
+        die $LINENO "Could not determine host IPv6 address.  See local.conf for suggestions on setting HOST_IPV6."
+    fi
+
+    DEF_TUNNEL_ENDPOINT_IP=$HOST_IPV6
+fi
+
+# Allow the use of an alternate address for tunnel endpoints.
+# Default is dependent on TUNNEL_IP_VERSION above.
+TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-${DEF_TUNNEL_ENDPOINT_IP}}
+
 REGION_NAME=${REGION_NAME:-RegionOne}
 
 # Configure services to use syslog instead of writing to individual log files
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
index 2596395165..0f0cba8afe 100755
--- a/tools/verify-ipv6-only-deployments.sh
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -23,32 +23,43 @@ function verify_devstack_ipv6_setting {
     _service_listen_address=$(echo $SERVICE_LISTEN_ADDRESS | tr -d [])
     local _service_local_host=''
     _service_local_host=$(echo $SERVICE_LOCAL_HOST | tr -d [])
+    local _tunnel_endpoint_ip=''
+    _tunnel_endpoint_ip=$(echo $TUNNEL_ENDPOINT_IP | tr -d [])
     if [[ "$SERVICE_IP_VERSION" != 6 ]]; then
         echo $SERVICE_IP_VERSION "SERVICE_IP_VERSION is not set to 6 which is must for devstack to deploy services with IPv6 address."
         exit 1
     fi
+    if [[ "$TUNNEL_IP_VERSION" != 6 ]]; then
+        echo $TUNNEL_IP_VERSION "TUNNEL_IP_VERSION is not set to 6 so TUNNEL_ENDPOINT_IP cannot be an IPv6 address."
+        exit 1
+    fi
     is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
     if [[ "$is_service_host_ipv6" != "True" ]]; then
-        echo $SERVICE_HOST "SERVICE_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $SERVICE_HOST "SERVICE_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
     is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
     if [[ "$is_host_ipv6" != "True" ]]; then
-        echo $HOST_IPV6 "HOST_IPV6 is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $HOST_IPV6 "HOST_IPV6 is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
     is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
     if [[ "$is_service_listen_address" != "True" ]]; then
-        echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
     is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
     if [[ "$is_service_local_host" != "True" ]]; then
-        echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
+        exit 1
+    fi
+    is_tunnel_endpoint_ip=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_tunnel_endpoint_ip'"))')
+    if [[ "$is_tunnel_endpoint_ip" != "True" ]]; then
+        echo $TUNNEL_ENDPOINT_IP "TUNNEL_ENDPOINT_IP is not IPv6 which means devstack will not deploy with an IPv6 endpoint address."
         exit 1
     fi
     echo "Devstack is properly configured with IPv6"
-    echo "SERVICE_IP_VERSION: " $SERVICE_IP_VERSION "HOST_IPV6: " $HOST_IPV6 "SERVICE_HOST: " $SERVICE_HOST "SERVICE_LISTEN_ADDRESS: " $SERVICE_LISTEN_ADDRESS "SERVICE_LOCAL_HOST: " $SERVICE_LOCAL_HOST
+    echo "SERVICE_IP_VERSION:" $SERVICE_IP_VERSION "HOST_IPV6:" $HOST_IPV6 "SERVICE_HOST:" $SERVICE_HOST "SERVICE_LISTEN_ADDRESS:" $SERVICE_LISTEN_ADDRESS "SERVICE_LOCAL_HOST:" $SERVICE_LOCAL_HOST "TUNNEL_IP_VERSION:" $TUNNEL_IP_VERSION "TUNNEL_ENDPOINT_IP:" $TUNNEL_ENDPOINT_IP
 }
 
 function sanity_check_system_ipv6_enabled {
@@ -72,7 +83,7 @@ function verify_service_listen_address_is_ipv6 {
         is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
         if [[ "$is_endpoint_ipv6" != "True" ]]; then
             all_ipv6=False
-            echo $endpoint ": This is not ipv6 endpoint which means corresponding service is not listening on IPv6 address."
+            echo $endpoint ": This is not an IPv6 endpoint which means corresponding service is not listening on an IPv6 address."
             continue
         fi
         endpoints_verified=True
@@ -80,7 +91,7 @@ function verify_service_listen_address_is_ipv6 {
     if [[ "$all_ipv6" == "False"  ]] || [[ "$endpoints_verified" == "False" ]]; then
         exit 1
     fi
-    echo "All services deployed by devstack is on IPv6 endpoints"
+    echo "All services deployed by devstack are on IPv6 endpoints"
     echo $endpoints
 }
 

From e6e7100e853f2ba06bf2157fd87ae948faba1d1f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 7 Jun 2022 10:12:59 +0200
Subject: [PATCH 2997/3333] Don't install pinned setuptools with distro pip

We are seeing failures when using an updated setuptools version
installed together with distro pip on Ubuntu 22.04. Install the version
from u-c only when we are also installing pip from upstream.

Change-Id: Ibb6e9424e5794ccbf9a937d2eecfa3bf60ed312e
---
 tools/install_pip.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index e9c52eacb7..7c5d4c6555 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -139,15 +139,18 @@ if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # recent enough anyway.  This is included via rpms/general
     : # Simply fall through
 elif is_ubuntu; then
-    : # pip on Ubuntu 20.04 is new enough, too
+    # pip on Ubuntu 20.04 is new enough, too
+    # drop setuptools from u-c
+    sed -i -e '/setuptools/d' $REQUIREMENTS_DIR/upper-constraints.txt
 else
     install_get_pip
+
+    # Note setuptools is part of requirements.txt and we want to make sure
+    # we obey any versioning as described there.
+    pip_install_gr setuptools
 fi
 
 set -x
 
-# Note setuptools is part of requirements.txt and we want to make sure
-# we obey any versioning as described there.
-pip_install_gr setuptools
 
 get_versions

From d5af514ac9485009229f3b594bccc09e905782fb Mon Sep 17 00:00:00 2001
From: Gorka Eguileor <geguileo@redhat.com>
Date: Wed, 8 Jun 2022 10:19:50 +0200
Subject: [PATCH 2998/3333] Reduce memory consumption in Cinder services

This patch reduces memory usage on the Cinder Volume and Backup services
by tuning glibc.

The specific tuning consist on disabling the per thread arenas and
disabling dynamic thresholds.

The Cinder Backup service suffers from high water mark memory usage and
uses excessive memory.  As an example just after 10 restore operations
the service uses almost 1GB of RAM and does not ever free it afterwards.
With this patch the memory consumption of the service is reduced down to
almost 130MB.  If we add a revert from Cinder (Change-Id
I43a20c8687f12bc52b014611cc6977c4c3ca212c) it goes down to 100MB during
my tests.

This glibc tuning is not applied to all Python services because I
haven't done proper testings on them and at first glance they don't seem
to have such great improvements.

Related-bug: #1908805
Change-Id: Ic9030d01468b3189350f83b04a8d1d346c489d3c
---
 functions-common | 22 ++++++++++++++++++----
 lib/cinder       |  9 +++++++--
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index be966e96a6..0b896dde59 100644
--- a/functions-common
+++ b/functions-common
@@ -1564,6 +1564,7 @@ function write_user_unit_file {
     local command="$2"
     local group=$3
     local user=$4
+    local env_vars="$5"
     local extra=""
     if [[ -n "$group" ]]; then
         extra="Group=$group"
@@ -1577,6 +1578,9 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "TimeoutStopSec" "300"
     iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
+    if [[ -n "$env_vars" ]] ; then
+        iniset -sudo $unitfile "Service" "Environment" "$env_vars"
+    fi
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1591,6 +1595,7 @@ function write_uwsgi_user_unit_file {
     local command="$2"
     local group=$3
     local user=$4
+    local env_vars="$5"
     local unitfile="$SYSTEMD_DIR/$service"
     mkdir -p $SYSTEMD_DIR
 
@@ -1605,6 +1610,9 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "NotifyAccess" "all"
     iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
 
+    if [[ -n "$env_vars" ]] ; then
+        iniset -sudo $unitfile "Service" "Environment" "$env_vars"
+    fi
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1652,10 +1660,14 @@ function _run_under_systemd {
     local systemd_service="devstack@$service.service"
     local group=$3
     local user=${4:-$STACK_USER}
+    if [[ -z "$user" ]]; then
+        user=$STACK_USER
+    fi
+    local env_vars="$5"
     if [[ "$command" =~ "uwsgi" ]] ; then
-        write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user"
+        write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
     else
-        write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+        write_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
     fi
 
     $SYSTEMCTL enable $systemd_service
@@ -1676,18 +1688,20 @@ function is_running {
 # If the command includes shell metachatacters (;<>*) it must be run using a shell
 # If an optional group is provided sg will be used to run the
 # command as that group.
-# run_process service "command-line" [group] [user]
+# run_process service "command-line" [group] [user] [env_vars]
+# env_vars must be a space separated list of variable assigments, ie: "A=1 B=2"
 function run_process {
     local service=$1
     local command="$2"
     local group=$3
     local user=$4
+    local env_vars="$5"
 
     local name=$service
 
     time_start "run_process"
     if is_service_enabled $service; then
-        _run_under_systemd "$name" "$command" "$group" "$user"
+        _run_under_systemd "$name" "$command" "$group" "$user" "$env_vars"
     fi
     time_stop "run_process"
 }
diff --git a/lib/cinder b/lib/cinder
index 52818a81eb..ca2c084aff 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -552,8 +552,13 @@ function start_cinder {
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
-    run_process c-bak "$CINDER_BIN_DIR/cinder-backup --config-file $CINDER_CONF"
-    run_process c-vol "$CINDER_BIN_DIR/cinder-volume --config-file $CINDER_CONF"
+    # Tune glibc for Python Services using single malloc arena for all threads
+    # and disabling dynamic thresholds to reduce memory usage when using native
+    # threads directly or via eventlet.tpool
+    # https://www.gnu.org/software/libc/manual/html_node/Memory-Allocation-Tunables.html
+    malloc_tuning="MALLOC_ARENA_MAX=1 MALLOC_MMAP_THRESHOLD_=131072 MALLOC_TRIM_THRESHOLD_=262144"
+    run_process c-bak "$CINDER_BIN_DIR/cinder-backup --config-file $CINDER_CONF" "" "" "$malloc_tuning"
+    run_process c-vol "$CINDER_BIN_DIR/cinder-volume --config-file $CINDER_CONF" "" "" "$malloc_tuning"
 
     # NOTE(jdg): For cinder, startup order matters.  To ensure that repor_capabilities is received
     # by the scheduler start the cinder-volume service last (or restart it) after the scheduler

From 8ff52ea12bb855adc9fe26de48b022310c1a5893 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 21 Jun 2022 17:31:50 +0200
Subject: [PATCH 2999/3333] Mark devstack-platform-centos-9-stream as n-v

Due to the below bug the job has been constantly failing.
Let's make it n-v until the bug is resolved:
  - https://bugs.launchpad.net/neutron/+bug/1979047

Change-Id: Ifc8cc96843a8eac5c98cd1e1f9e4b6287a7f2e7c
---
 .zuul.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5b93a77017..c3f8914eee 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -661,6 +661,9 @@
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
     timeout: 9000
+    # TODO(kopecmartin) n-v until the following is resolved:
+    # https://bugs.launchpad.net/neutron/+bug/1979047
+    voting: false
     vars:
       configure_swap_size: 4096
 
@@ -896,7 +899,9 @@
       jobs:
         - devstack
         - devstack-ipv6
-        - devstack-platform-centos-9-stream
+        # TODO(kopecmartin) n-v until the following is resolved:
+        # https://bugs.launchpad.net/neutron/+bug/1979047
+        # - devstack-platform-centos-9-stream
         - devstack-platform-ubuntu-jammy
         - devstack-enforce-scope
         - devstack-multinode

From 8a38a73ddf2930e9662cb22109f4a6ef341476d6 Mon Sep 17 00:00:00 2001
From: Vladislav Belogrudov <v.belogrudov@yadro.com>
Date: Wed, 25 May 2022 12:58:52 +0300
Subject: [PATCH 3000/3333] Correct hostname for OVN agent

Currently Devstack uses short hostname for configuration of OVN.
This leads to inability to start instances (failing port binding)
on hosts with full hostnames (including dots). Open vSwitch expects
hostname in external_ids that corresponds to one returned by
``hostname`` command.

Closes-Bug: #1943631
Change-Id: I15b71a49c482be0c8f15ad834e29ea1b33307c86
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 24bdf92b60..e8a9babc1c 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -642,7 +642,7 @@ function _start_ovs {
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$TUNNEL_IP"
-        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname="$LOCAL_HOSTNAME"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname=$(hostname)
         # Select this chassis to host gateway routers
         if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
             sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"

From fe7cfa6b8c7573d643d66d3684de03e4183651bb Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 23 Jun 2022 09:25:22 -0700
Subject: [PATCH 3001/3333] Avoid including bad service names in perf.json

Some of the API services are not properly mounted under /$service/
in the apache proxy. This patch tries to avoid recording data
for "services" like "v2.0" (in the case of neutron) by only adding
names if they're all letters. A single warning is emitted for any
services excluded by this check.

For the moment this will mean we don't collect data for those services,
but when their devstack API config is fixed, they'll start to show
up.

Change-Id: I41cc300e89a4f97a008a8ba97c91f0980f9b9c3f
---
 tools/get-stats.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index a3ed7f2625..b958af61b2 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -111,6 +111,7 @@ def get_http_stats_for_log(logfile):
     apache_fields = ('host', 'a', 'b', 'date', 'tz', 'request', 'status',
                      'length', 'c', 'agent')
     ignore_agents = ('curl', 'uwsgi', 'nova-status')
+    ignored_services = set()
     for line in csv.reader(open(logfile), delimiter=' '):
         fields = dict(zip(apache_fields, line))
         if len(fields) != len(apache_fields):
@@ -146,6 +147,10 @@ def get_http_stats_for_log(logfile):
             service = url.strip('/')
             rest = ''
 
+        if not service.isalpha():
+            ignored_services.add(service)
+            continue
+
         method_key = '%s-%s' % (agent, method)
         try:
             length = int(fields['length'])
@@ -159,6 +164,10 @@ def get_http_stats_for_log(logfile):
         stats[service]['largest'] = max(stats[service]['largest'],
                                         length)
 
+    if ignored_services:
+        LOG.warning('Ignored services: %s' % ','.join(
+            sorted(ignored_services)))
+
     # Flatten this for ES
     return [{'service': service, 'log': os.path.basename(logfile),
              **vals}

From ce1ae9ddef4dd05a294dc630bf81b264a4b5a703 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 29 Jun 2022 09:56:12 +0200
Subject: [PATCH 3002/3333] Fix missing "$" in the ENFORCE_SCOPE's variable
 name

Because of the missing "$" before ENFORCE_SCOPE in the lib/neutron
module, it was treated as an ENFORCE_SCOPE string instead of variable
and Neutron was deployed always with old defaults and disabled scope
enforcement.

Change-Id: Ibe67fea634c5f7abb521c0369ff30dd5db84db8c
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 1b78493919..2d77df699a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -633,7 +633,7 @@ function configure_neutron {
 # configure_rbac_policies() - Configure Neutron to enforce new RBAC
 # policies and scopes if NEUTRON_ENFORCE_SCOPE == True
 function configure_rbac_policies {
-    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "ENFORCE_SCOPE" == "True" ]]; then
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
         iniset $NEUTRON_CONF oslo_policy enforce_scope True
     else

From e1fb94f82a2a5bfdc3a0d56c69455e95e265195e Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Wed, 29 Jun 2022 10:43:33 +0200
Subject: [PATCH 3003/3333] Make devstack-platform-debian-bullseye voting

The job has been successfully passing lately, let's make it voting.

Change-Id: Ib3b803a26c8647fd49c89371516c0ac7baba2703
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c3f8914eee..c29cb31f31 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -672,7 +672,6 @@
     parent: tempest-full-py3
     description: Debian Bullseye platform test
     nodeset: devstack-single-node-debian-bullseye
-    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -902,6 +901,7 @@
         # TODO(kopecmartin) n-v until the following is resolved:
         # https://bugs.launchpad.net/neutron/+bug/1979047
         # - devstack-platform-centos-9-stream
+        - devstack-platform-debian-bullseye
         - devstack-platform-ubuntu-jammy
         - devstack-enforce-scope
         - devstack-multinode

From bd6e5205b115fb0cafed7f50a676699a4b9fc0fe Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 3 Jul 2022 22:27:15 +0200
Subject: [PATCH 3004/3333] Increase timeout waiting for OVN startup

We see some cases where OVN startup takes much longer than 5 seconds, up
to 28 seconds have been observed, so increase the limit to 40 to be on
the safe side.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Closes-Bug: 1980421
Change-Id: I6da4a537e6a8d527ff71a821f07164fc7d342882
---
 lib/neutron_plugins/ovn_agent | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e8a9babc1c..341b84d959 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -176,7 +176,7 @@ function wait_for_db_file {
     while [ ! -f $1 ]; do
         sleep 1
         count=$((count+1))
-        if [ "$count" -gt 5 ]; then
+        if [ "$count" -gt 40 ]; then
             die $LINENO "DB File $1 not found"
         fi
     done
@@ -187,7 +187,7 @@ function wait_for_sock_file {
     while [ ! -S $1 ]; do
         sleep 1
         count=$((count+1))
-        if [ "$count" -gt 5 ]; then
+        if [ "$count" -gt 40 ]; then
             die $LINENO "Socket $1 not found"
         fi
     done

From 85340e77f3d15b77dd0dc7c9df240428bfd2e30f Mon Sep 17 00:00:00 2001
From: Yadnesh Kulkarni <ykulkarn@redhat.com>
Date: Mon, 11 Jul 2022 17:14:40 +0530
Subject: [PATCH 3005/3333] delete __pycache__ directory with sudo privileges

Signed-off-by: Yadnesh Kulkarni <ykulkarn@redhat.com>
Change-Id: I9cf3cd8921347eacc1effb2b197b97bc6ff3e0df
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index e16bb27ef5..e5b07514e5 100644
--- a/functions-common
+++ b/functions-common
@@ -646,7 +646,7 @@ function git_clone {
             # remove the existing ignored files (like pyc) as they cause breakage
             # (due to the py files having older timestamps than our pyc, so python
             # thinks the pyc files are correct using them)
-            find $git_dest -name '*.pyc' -delete
+            sudo find $git_dest -name '*.pyc' -delete
 
             # handle git_ref accordingly to type (tag, branch)
             if [[ -n "`git show-ref refs/tags/$git_ref`" ]]; then

From cf0bf746e996b780714a085b0e6f38899c2c832e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 13 Jul 2022 22:34:47 +0900
Subject: [PATCH 3006/3333] Neutron: Set experimental option to use linuxbridge
 agent

Recently the experimental mechanism has been added to Neutron and now
it requires the [experimental] linuxbridge option when the linuxbridge
mechanism driver is used.

Depends-on: https://review.opendev.org/c/openstack/neutron/+/845181
Change-Id: Ice82a391cda9eb0193f23e6794be7ab3df12c40b
---
 lib/neutron             | 4 ++++
 lib/neutron_plugins/ml2 | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 1b78493919..6e787f213a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -229,6 +229,10 @@ function configure_neutron_new {
         else
             mech_drivers+=",linuxbridge"
         fi
+        if [[ "$mech_drivers" == *"linuxbridge"* ]]; then
+            iniset $NEUTRON_CONF experimental linuxbridge True
+        fi
+
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 overlay_ip_version $TUNNEL_IP_VERSION
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 7343606aac..fa61f1ea30 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -125,6 +125,9 @@ function neutron_plugin_configure_service {
     fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
+    if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then
+        iniset $NEUTRON_CONF experimental linuxbridge True
+    fi
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then

From 1a21ccbdf8eb66582a06f181f8c9af1f43bd52f5 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 8 Jul 2022 21:57:45 +0200
Subject: [PATCH 3007/3333] Add NEUTRON_ENDPOINT_SERVICE_NAME variable to set
 service name

This option can be used to set name of the service used in the
networking service endpoint URL.

Depends-On: https://review.opendev.org/c/openstack/grenade/+/850306

Change-Id: I9e9a06eadc1604214c627bd3bda010cc00aaf83d
---
 lib/neutron        | 18 +++++++++++++++---
 lib/neutron-legacy | 31 ++++++++++++++++++++++++++++---
 2 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 6e787f213a..a885fbf16e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -114,6 +114,12 @@ NEUTRON_TENANT_VLAN_RANGE=${NEUTRON_TENANT_VLAN_RANGE:-${TENANT_VLAN_RANGE:-100:
 # Physical network for VLAN network usage.
 NEUTRON_PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-}
 
+# The name of the service in the endpoint URL
+NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
+if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+fi
+
 
 # Additional neutron api config files
 declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
@@ -397,10 +403,13 @@ function create_neutron_accounts_new {
     local neutron_url
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/networking/
+        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/
     else
         neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
 
 
     if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
@@ -481,19 +490,22 @@ function start_neutron_api {
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/networking/
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
     else
         # Start the Neutron service
         # TODO(sc68cal) Stop hard coding this
         run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port/
         # Start proxy if enabled
         if is_service_enabled tls-proxy; then
             start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
         fi
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
 
     if ! wait_for_service $SERVICE_TIMEOUT $neutron_url; then
         die $LINENO "neutron-api did not start"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5e6af0f249..1a6995511b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -145,6 +145,12 @@ SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
 # /etc/neutron is assumed by many of devstack plugins.  Do not change.
 _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
+# The name of the service in the endpoint URL
+NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
+if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+fi
+
 # List of config file names in addition to the main plugin config file
 # To add additional plugin config files, use ``neutron_server_config_add``
 # utility function.  For example:
@@ -431,10 +437,13 @@ function create_nova_conf_neutron {
 function create_mutnauq_accounts {
     local neutron_url
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/networking/
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     else
         neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
 
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
@@ -538,17 +547,20 @@ function start_neutron_service_and_check {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/networking/
+        neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
     else
         run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port
+        neutron_url=$service_protocol://$Q_HOST:$service_port/
         # Start proxy if enabled
         if is_service_enabled tls-proxy; then
             start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
         fi
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
     echo "Waiting for Neutron to start..."
 
     local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
@@ -905,12 +917,25 @@ function _configure_neutron_plugin_agent {
     neutron_plugin_configure_plugin_agent
 }
 
+function _replace_api_paste_composite {
+    local sep
+    sep=$(echo -ne "\x01")
+    # Replace it
+    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
+}
+
 # _configure_neutron_service() - Set config files for neutron service
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
 
+    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+        _replace_api_paste_composite
+    fi
+
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
 

From facf15626e5776bc64a2f072bdccadbda714a8f2 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 13 Jul 2022 15:58:42 +0900
Subject: [PATCH 3008/3333] Neutron: Do not set removed allow_overlapping_ips

The parameter has been removed from neutron by [1].

[1] fde91e8059a9a23fb7ece6e3463984329c7ea581

Change-Id: I3b838ea741d19729d6fcf03c0478b1b4d8ec1213
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 6e787f213a..d4815cd5f8 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -213,7 +213,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_CORE_PLUGIN
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
-        iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
         iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5e6af0f249..d21be51dcd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -916,7 +916,6 @@ function _configure_neutron_service {
 
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
-    iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
 
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
     configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME

From b70d98fe75621d7c71197f82b9fde630d2fa50b2 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Wed, 20 Jul 2022 14:05:15 +0000
Subject: [PATCH 3009/3333] Fix doc for adding sudo privileges to stack user

Writing NOPASSWD directive into /etc/sudoers was throwing
permission denied errors. This commit writes the directive
to the /etc/sudoers.d/stack file instead.

Closes-Bug: #1981541
Change-Id: If30f01aa5f3a33dda79ff4a6892116511c8e1542
---
 doc/source/guides/multinode-lab.rst  | 2 +-
 doc/source/guides/single-machine.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 79a76dedb1..658422b0af 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -89,7 +89,7 @@ password:
 
 ::
 
-    echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 From here on use the ``stack`` user. **Logout** and **login** as the
 ``stack`` user.
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 03d93743f7..0529e30f08 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -63,7 +63,7 @@ to have sudo privileges:
 .. code-block:: console
 
     $ apt-get install sudo -y || yum install -y sudo
-    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 .. note:: On some systems you may need to use ``sudo visudo``.
 

From 79bef068b69c7e97a63aaa3e7fae13bcbc649ebd Mon Sep 17 00:00:00 2001
From: Hoai-Thu Vuong <thuvh87@gmail.com>
Date: Tue, 2 Aug 2022 14:41:59 +0700
Subject: [PATCH 3010/3333] remove duplicate line of REGION_NAME

Change-Id: I42b270749f057c5751e809aba282112b990b9f38
---
 stackrc | 2 --
 1 file changed, 2 deletions(-)

diff --git a/stackrc b/stackrc
index f0039f0043..b3130e5f7f 100644
--- a/stackrc
+++ b/stackrc
@@ -903,8 +903,6 @@ fi
 # Default is dependent on TUNNEL_IP_VERSION above.
 TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-${DEF_TUNNEL_ENDPOINT_IP}}
 
-REGION_NAME=${REGION_NAME:-RegionOne}
-
 # Configure services to use syslog instead of writing to individual log files
 SYSLOG=$(trueorfalse False SYSLOG)
 SYSLOG_HOST=${SYSLOG_HOST:-$HOST_IP}

From d266c87b1d3ecae1b40589832efc9bf7cf3e524c Mon Sep 17 00:00:00 2001
From: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Date: Mon, 8 Aug 2022 16:45:31 +0900
Subject: [PATCH 3011/3333] iniset: fix handling of values containg ampersand

Attempting to set a value containing the ampersand
character (&) by iniset would corrupt the value.
So, add an escaping process.

Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Closes-Bug: #1983816
Change-Id: Ie2633bacd2d761d110e6cb12f95382325c329415
---
 inc/ini-config           |  3 +++
 tests/test_ini_config.sh | 12 +++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/inc/ini-config b/inc/ini-config
index 79936823d2..f65e42d3a5 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -189,6 +189,9 @@ function iniset {
     local option=$3
     local value=$4
 
+    # Escape the ampersand character (&)
+    value=$(echo $value | sed -e 's/&/\\&/g')
+
     if [[ -z $section || -z $option ]]; then
         $xtrace
         return
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 6ed1647f34..6367cde441 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -44,6 +44,9 @@ empty =
 multi = foo1
 multi = foo2
 
+[fff]
+ampersand =
+
 [key_with_spaces]
 rgw special key = something
 
@@ -85,7 +88,7 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee key_with_spaces \
+assert_equal "$VAL" "default aaa bbb ccc ddd eee fff key_with_spaces \
 del_separate_options del_same_option del_missing_option \
 del_missing_option_multi del_no_options"
 
@@ -124,6 +127,13 @@ iniset ${SUDO_ARG} ${TEST_INI} bbb handlers "33,44"
 VAL=$(iniget ${TEST_INI} bbb handlers)
 assert_equal "$VAL" "33,44" "inset at EOF"
 
+# Test with ampersand in values
+for i in `seq 3`; do
+    iniset ${TEST_INI} fff ampersand '&y'
+done
+VAL=$(iniget ${TEST_INI} fff ampersand)
+assert_equal "$VAL" "&y" "iniset ampersands in option"
+
 # test empty option
 if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"

From 90e5479f382af1a5482f0acccdc36c6d18321634 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 16 Aug 2022 17:29:16 +0200
Subject: [PATCH 3012/3333] Remove forgotten LinuxMint occurrence

Right now we don't officialy support LinuxMint as our
documentation says [1], it seems LinuxMint is a relict
and got forgotten over time.

This patch removes LinuxMint from the code in order not to
confuse users.

[1] https://docs.openstack.org/devstack/latest/
Closes-Bug: #1983427

Change-Id: Ie1ced25f89389494b28a7b2e9bb1c4273e002dd5
---
 doc/source/plugins.rst | 2 +-
 functions-common       | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 7d70d74dd0..62dd15bfb1 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -238,7 +238,7 @@ package dependencies, packages may be listed at the following
 locations in the top-level of the plugin repository:
 
 - ``./devstack/files/debs/$plugin_name`` - Packages to install when running
-  on Ubuntu, Debian or Linux Mint.
+  on Ubuntu or Debian.
 
 - ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
   on Red Hat, Fedora, or CentOS.
diff --git a/functions-common b/functions-common
index e5b07514e5..92a6678de0 100644
--- a/functions-common
+++ b/functions-common
@@ -426,7 +426,7 @@ function GetOSVersion {
         os_VENDOR=$(lsb_release -i -s)
     fi
 
-    if [[ $os_VENDOR =~ (Debian|Ubuntu|LinuxMint) ]]; then
+    if [[ $os_VENDOR =~ (Debian|Ubuntu) ]]; then
         os_PACKAGE="deb"
     else
         os_PACKAGE="rpm"
@@ -444,9 +444,8 @@ declare -g DISTRO
 
 function GetDistro {
     GetOSVersion
-    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) || \
-            "$os_VENDOR" =~ (LinuxMint) ]]; then
-        # 'Everyone' refers to Ubuntu / Debian / Mint releases by
+    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) ]]; then
+        # 'Everyone' refers to Ubuntu / Debian releases by
         # the code name adjective
         DISTRO=$os_CODENAME
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then

From fdfc14451afc4d7f78edadb1b26a3a845eace715 Mon Sep 17 00:00:00 2001
From: Eliad Cohen <elicohen@redhat.com>
Date: Tue, 16 Aug 2022 13:00:45 -0400
Subject: [PATCH 3013/3333] Clean up use of get_field

Openstack client can return the id field for create/show commands using
`-f value -c id`. Cleaned up the use of grep 'id' with get_field

Change-Id: I2f4338f30c11e5139cda51c92524782b86f0aacc
---
 functions                       |  4 ++--
 lib/neutron_plugins/services/l3 | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/functions b/functions
index ccca5cda51..7ada0feba7 100644
--- a/functions
+++ b/functions
@@ -414,10 +414,10 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" -f value -c id)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" -f value -c id)
         fi
         _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index fbd4692bba..3dffc33d37 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -166,14 +166,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share -f value -c id)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} -f value -c id)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME"
         fi
 
@@ -183,7 +183,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} -f value -c id)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME"
         fi
 
@@ -193,7 +193,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" -f value -c id)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -211,11 +211,11 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME -f value -c id)
             die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME -f value -c id)
             die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         fi
 
@@ -225,9 +225,9 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} -f value -c id)
         else
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS -f value -c id)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -257,7 +257,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params -f value -c id)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet"
     echo $subnet_id
 }
@@ -278,7 +278,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params -f value -c id)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet"
     echo $ipv6_subnet_id
 }

From ca5f9195610a94ca0a567700a94f9417ca877336 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 21 Aug 2022 10:52:41 +0200
Subject: [PATCH 3014/3333] Clean up n-net remnants

In I90316208d1af42c1659d3bee386f95e38aaf2c56 support for nova-network
was removed, but some bits remained, fix this up.

Change-Id: Iba7e1785fd0bdf0a6e94e5e03438fc7634621e49
---
 files/debs/nova      |  2 --
 files/rpms-suse/nova |  2 --
 files/rpms/nova      |  2 --
 lib/nova             | 14 --------------
 stack.sh             | 10 +++-------
 5 files changed, 3 insertions(+), 27 deletions(-)

diff --git a/files/debs/nova b/files/debs/nova
index 0194f00f2c..5c00ad72d9 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -1,7 +1,5 @@
 conntrack
 curl
-dnsmasq-base
-dnsmasq-utils # for dhcp_release
 ebtables
 genisoimage # required for config_drive
 iptables
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 1cc2f62ea5..082b9aca22 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -1,8 +1,6 @@
 cdrkit-cdrtools-compat # dist:sle12
 conntrack-tools
 curl
-dnsmasq
-dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
 iptables
 iputils
diff --git a/files/rpms/nova b/files/rpms/nova
index 9522e5729d..f2824ee2c4 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,5 @@
 conntrack-tools
 curl
-dnsmasq # for q-dhcp
-dnsmasq-utils # for dhcp_release
 ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
diff --git a/lib/nova b/lib/nova
index da3a10edd0..6de1d3382f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -107,20 +107,6 @@ NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,Ima
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 
-# Set default defaults here as some hypervisor drivers override these
-PUBLIC_INTERFACE_DEFAULT=br100
-# Set ``GUEST_INTERFACE_DEFAULT`` to some interface on the box so that
-# the default isn't completely crazy. This will match ``eth*``, ``em*``, or
-# the new ``p*`` interfaces, then basically picks the first
-# alphabetically. It's probably wrong, however it's less wrong than
-# always using ``eth0`` which doesn't exist on new Linux distros at all.
-GUEST_INTERFACE_DEFAULT=$(ip link \
-    | grep 'state UP' \
-    | awk '{print $2}' \
-    | sed 's/://' \
-    | grep ^[ep] \
-    | head -1)
-
 # ``NOVA_VNC_ENABLED`` can be used to forcibly enable VNC configuration.
 # In multi-node setups allows compute hosts to not run ``n-novnc``.
 NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
diff --git a/stack.sh b/stack.sh
index df283bbe50..c99189e6dc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1152,7 +1152,8 @@ fi
 # ----
 
 if is_service_enabled q-dhcp; then
-    # Delete traces of nova networks from prior runs
+    # TODO(frickler): These are remnants from n-net, check which parts are really
+    # still needed for Neutron.
     # Do not kill any dnsmasq instance spawned by NetworkManager
     netman_pid=$(pidof NetworkManager || true)
     if [ -z "$netman_pid" ]; then
@@ -1212,12 +1213,7 @@ if is_service_enabled nova; then
     echo_summary "Configuring Nova"
     init_nova
 
-    # Additional Nova configuration that is dependent on other services
-    # TODO(stephenfin): Is it possible for neutron to *not* be enabled now? If
-    # not, remove the if here
-    if is_service_enabled neutron; then
-        async_runfunc configure_neutron_nova
-    fi
+    async_runfunc configure_neutron_nova
 fi
 
 

From ccd116d36447ba1c5efad58ee360eb7f276eb7c6 Mon Sep 17 00:00:00 2001
From: Alan Bishop <abishop@redhat.com>
Date: Wed, 10 Aug 2022 10:30:19 -0700
Subject: [PATCH 3015/3333] Cinder: add creator role when barbican is enabled

When barbican is enabled, add the "creator" role to cinder's service
user so that cinder can create secrets. Cinder needs to create
barbican secrets when migrating encryption keys from the legacy
ConfKeyManager to barbican. Cinder also needs to create barbican
secrets in order to support transferring encrypted volumes.

Implements: bp/transfer-encrypted-volume
Depends-On: I216f78e8a300ab3f79bbcbb38110adf2bbec2196
Change-Id: Ia3f414c4b9b0829f60841a6dd63c97a893fdde4d
---
 lib/cinder | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index ca2c084aff..7dd7539eca 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -388,16 +388,24 @@ function configure_cinder {
 
 # create_cinder_accounts() - Set up common required cinder accounts
 
-# Tenant               User       Roles
+# Project              User       Roles
 # ------------------------------------------------------------------
-# service              cinder     admin        # if enabled
+# SERVICE_PROJECT_NAME cinder     service
+# SERVICE_PROJECT_NAME cinder     creator (if Barbican is enabled)
 
 # Migrated from keystone_data.sh
 function create_cinder_accounts {
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
-        create_service_user "cinder"
+        local extra_role=""
+
+        # cinder needs the "creator" role in order to interact with barbican
+        if is_service_enabled barbican; then
+            extra_role=$(get_or_create_role "creator")
+        fi
+
+        create_service_user "cinder" $extra_role
 
         # block-storage is the official service type
         get_or_create_service "cinder" "block-storage" "Cinder Volume Service"

From e7d2623dca483497ec51c75dfe1b6162801eead0 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 21 Aug 2022 12:54:57 +0200
Subject: [PATCH 3016/3333] Clean up neutron cleanup code

neutron-ns-metadata-proxy was dropped from Neutron 5 years ago, no need
to keep trying to kill it.

Change-Id: I20b6d68dd8dde36057a2418bca0841bdea377b07
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 1f54e0e043..b3e3d72e8c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -567,7 +567,6 @@ function stop_neutron_new {
     fi
 
     if is_service_enabled neutron-metadata-agent; then
-        sudo pkill -9 -f neutron-ns-metadata-proxy || :
         stop_process neutron-metadata-agent
     fi
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9229b47988..baf67f209e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -628,7 +628,6 @@ function stop_mutnauq_other {
     fi
 
     if is_service_enabled q-meta; then
-        sudo pkill -9 -f neutron-ns-metadata-proxy || :
         stop_process q-meta
     fi
 

From b9b6d6b862ce69a875c152ad30da8f4717c75272 Mon Sep 17 00:00:00 2001
From: June Yi <june.yi@samsung.com>
Date: Sat, 2 Jul 2022 13:07:43 +0900
Subject: [PATCH 3017/3333] Respect constraints on tempest venv consistently

In case of online mode, there is a procedure to recreate tempest venv.
For consistency of tempest venv during the entire stack.sh process,
add logic to consider the TEMPEST_VENV_UPPER_CONSTRAINTS option here.

Closes-bug: #1980483
Signed-off-by: June Yi <june.yi@samsung.com>
Change-Id: I0cea282152fd363af8671cab1b5f733ebe2bd4df
---
 lib/tempest | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 206b37b5bf..87a2244784 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -695,13 +695,13 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    if [[ "$OFFLINE" != "True" ]]; then
-        tox -revenv-tempest --notest
-    fi
 
     local tmp_u_c_m
     tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
     set_tempest_venv_constraints $tmp_u_c_m
+    if [[ "$OFFLINE" != "True" ]]; then
+        tox -revenv-tempest --notest
+    fi
     tox -evenv-tempest -- pip install -c $tmp_u_c_m -r requirements.txt
     rm -f $tmp_u_c_m
 

From 3de92db6634a6d1455b7211ec869aed35508c58c Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 26 Aug 2022 12:58:29 +0200
Subject: [PATCH 3018/3333] Fix installation of OVS/OVN from sources

This patch changes user who runs ovsdb-server and ovn-nortd services
to root.
It also adds installation of the libssl dev package before compilation
of the openvswitch if TLS service is enabled.

Co-Authored-By: Fernando Royo <froyo@redhat.com>

Closes-Bug: #1987832
Change-Id: I83fc9250ae5b7c1686938a0dd25d66b40fc6c6aa
---
 lib/neutron_plugins/ovn_agent  | 4 ++--
 lib/neutron_plugins/ovs_source | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 341b84d959..8eb2993b94 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -616,7 +616,7 @@ function _start_ovs {
                 dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
             fi
             dbcmd+=" $OVS_DATADIR/conf.db"
-            _run_process ovsdb-server "$dbcmd"
+            _run_process ovsdb-server "$dbcmd" "" "$STACK_GROUP" "root"
 
             # Note: ovn-controller will create and configure br-int once it is started.
             # So, no need to create it now because nothing depends on that bridge here.
@@ -704,7 +704,7 @@ function start_ovn {
             local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_northd"
             local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
 
-            _run_process ovn-northd "$cmd" "$stop_cmd"
+            _run_process ovn-northd "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
         else
             _start_process "$OVN_NORTHD_SERVICE"
         fi
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 9ae5555afb..164d574c42 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -87,9 +87,15 @@ function prepare_for_ovs_compilation {
 
         install_package kernel-devel-$KERNEL_VERSION
         install_package kernel-headers-$KERNEL_VERSION
+        if is_service_enabled tls-proxy; then
+            install_package openssl-devel
+        fi
 
     elif is_ubuntu ; then
         install_package linux-headers-$KERNEL_VERSION
+        if is_service_enabled tls-proxy; then
+            install_package libssl-dev
+        fi
     fi
 }
 

From 97061c9a1f2a2989e0bacb5f7cc5910c75aaeb44 Mon Sep 17 00:00:00 2001
From: Gorka Eguileor <geguileo@redhat.com>
Date: Thu, 14 Oct 2021 09:55:56 +0200
Subject: [PATCH 3019/3333] Add LVM NVMe support

This patch adds NVMe LVM support to the existing iSCSI LVM configuration
support.

We deprecate the CINDER_ISCSI_HELPER configuration option since we are
no longer limited to iSCSI, and replace it with the CINDER_TARGET_HELPER
option.

The patch also adds another 3 target configuration options:

- CINDER_TARGET_PROTOCOL
- CINDER_TARGET_PREFIX
- CINDER_TARGET_PORT

These options will have different defaults based on the selected target
helper.  For tgtadm and lioadm they'll be iSCSI,
iqn.2010-10.org.openstack:, and 3260 respectively, and for nvmet they'll
be nvmet_rdma, nvme-subsystem-1, and 4420.

Besides nvmet_rdma the CINDER_TARGET_PROTOCOL option can also be set to
nvmet_tcp, and nvmet_fc.

For the RDMA transport protocol devstack will be using Soft-RoCE and
creating a device on top of the network interface.

LVM NVMe-TCP support is added in the dependency mentioned in the footer
and LVM NVMe-FC will be added in later patches (need os-brick and cinder
patches) but the code here should still be valid.

Change-Id: I6578cdc27489b34916cdeb72ba3fdf06ea9d4ad8
---
 doc/source/configuration.rst  | 29 +++++++++++
 lib/cinder                    | 95 +++++++++++++++++++++++++++++------
 lib/cinder_backends/fake_gate |  2 +-
 lib/cinder_backends/lvm       |  5 +-
 lib/lvm                       | 10 ++--
 lib/nova                      | 40 ++++++++++++---
 6 files changed, 154 insertions(+), 27 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..0d8773fb6a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -669,6 +669,35 @@ adjusted by setting ``CINDER_QUOTA_VOLUMES``, ``CINDER_QUOTA_BACKUPS``,
 or ``CINDER_QUOTA_SNAPSHOTS`` to the desired value.  (The default for
 each is 10.)
 
+DevStack's Cinder LVM configuration module currently supports both iSCSI and
+NVMe connections, and we can choose which one to use with options
+``CINDER_TARGET_HELPER``, ``CINDER_TARGET_PROTOCOL``, ``CINDER_TARGET_PREFIX``,
+and ``CINDER_TARGET_PORT``.
+
+Defaults use iSCSI with the LIO target manager::
+
+  CINDER_TARGET_HELPER="lioadm"
+  CINDER_TARGET_PROTOCOL="iscsi"
+  CINDER_TARGET_PREFIX="iqn.2010-10.org.openstack:"
+  CINDER_TARGET_PORT=3260
+
+Additionally there are 3 supported transport protocols for NVMe,
+``nvmet_rdma``, ``nvmet_tcp``, and ``nvmet_fc``, and when the ``nvmet`` target
+is selected the protocol, prefix, and port defaults will change to more
+sensible defaults for NVMe::
+
+  CINDER_TARGET_HELPER="nvmet"
+  CINDER_TARGET_PROTOCOL="nvmet_rdma"
+  CINDER_TARGET_PREFIX="nvme-subsystem-1"
+  CINDER_TARGET_PORT=4420
+
+When selecting the RDMA transport protocol DevStack will create on Cinder nodes
+a Software RoCE device on top of the ``HOST_IP_IFACE`` and if it is not defined
+then on top of the interface with IP address ``HOST_IP`` or ``HOST_IPV6``.
+
+This Soft-RoCE device will always be created on the Nova compute side since we
+cannot tell beforehand whether there will be an RDMA connection or not.
+
 
 Keystone
 ~~~~~~~~
diff --git a/lib/cinder b/lib/cinder
index ca2c084aff..bc704c1e5d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -43,6 +43,13 @@ GITDIR["python-cinderclient"]=$DEST/python-cinderclient
 GITDIR["python-brick-cinderclient-ext"]=$DEST/python-brick-cinderclient-ext
 CINDER_DIR=$DEST/cinder
 
+if [[ $SERVICE_IP_VERSION == 6 ]]; then
+    CINDER_MY_IP="$HOST_IPV6"
+else
+    CINDER_MY_IP="$HOST_IP"
+fi
+
+
 # Cinder virtual environment
 if [[ ${USE_VENV} = True ]]; then
     PROJECT_VENV["cinder"]=${CINDER_DIR}.venv
@@ -88,13 +95,32 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
-# Default to lioadm
-CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
+
+if [[ -n "$CINDER_ISCSI_HELPER" ]]; then
+    if [[ -z "$CINDER_TARGET_HELPER" ]]; then
+        deprecated 'Using CINDER_ISCSI_HELPER is deprecated, use CINDER_TARGET_HELPER instead'
+        CINDER_TARGET_HELPER="$CINDER_ISCSI_HELPER"
+    else
+        deprecated 'Deprecated CINDER_ISCSI_HELPER is set, but is being overwritten by CINDER_TARGET_HELPER'
+    fi
+fi
+CINDER_TARGET_HELPER=${CINDER_TARGET_HELPER:-lioadm}
+
+if [[ $CINDER_TARGET_HELPER == 'nvmet' ]]; then
+    CINDER_TARGET_PROTOCOL=${CINDER_TARGET_PROTOCOL:-'nvmet_rdma'}
+    CINDER_TARGET_PREFIX=${CINDER_TARGET_PREFIX:-'nvme-subsystem-1'}
+    CINDER_TARGET_PORT=${CINDER_TARGET_PORT:-4420}
+else
+    CINDER_TARGET_PROTOCOL=${CINDER_TARGET_PROTOCOL:-'iscsi'}
+    CINDER_TARGET_PREFIX=${CINDER_TARGET_PREFIX:-'iqn.2010-10.org.openstack:'}
+    CINDER_TARGET_PORT=${CINDER_TARGET_PORT:-3260}
+fi
+
 
 # EL and SUSE should only use lioadm
 if is_fedora || is_suse; then
-    if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
-        die "lioadm is the only valid Cinder target_helper config on this platform"
+    if [[ ${CINDER_TARGET_HELPER} != "lioadm" && ${CINDER_TARGET_HELPER} != 'nvmet' ]]; then
+        die "lioadm and nvmet are the only valid Cinder target_helper config on this platform"
     fi
 fi
 
@@ -187,7 +213,7 @@ function _cinder_cleanup_apache_wsgi {
 function cleanup_cinder {
     # ensure the volume group is cleared up because fails might
     # leave dead volumes in the group
-    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+    if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         local targets
         targets=$(sudo tgtadm --op show --mode target)
         if [ $? -ne 0 ]; then
@@ -215,8 +241,14 @@ function cleanup_cinder {
         else
             stop_service tgtd
         fi
-    else
+    elif [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
         sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
+    elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
+        # If we don't disconnect everything vgremove will block
+        sudo nvme disconnect-all
+        sudo nvmetcli clear
+    else
+        die $LINENO "Unknown value \"$CINDER_TARGET_HELPER\" for CINDER_TARGET_HELPER"
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -267,7 +299,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    iniset $CINDER_CONF DEFAULT target_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF DEFAULT target_helper "$CINDER_TARGET_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
@@ -275,11 +307,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
-    if [[ $SERVICE_IP_VERSION == 6 ]]; then
-        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IPV6"
-    else
-        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
-    fi
+    iniset $CINDER_CONF DEFAULT my_ip "$CINDER_MY_IP"
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
     if [[ -n "$CINDER_ALLOWED_DIRECT_URL_SCHEMES" ]]; then
@@ -465,9 +493,9 @@ function init_cinder {
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
-    if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
+    if [[ "$CINDER_TARGET_HELPER" == "tgtadm" ]]; then
         install_package tgt
-    elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
+    elif [[ "$CINDER_TARGET_HELPER" == "lioadm" ]]; then
         if is_ubuntu; then
             # TODO(frickler): Workaround for https://launchpad.net/bugs/1819819
             sudo mkdir -p /etc/target
@@ -476,6 +504,43 @@ function install_cinder {
         else
             install_package targetcli
         fi
+    elif [[ "$CINDER_TARGET_HELPER" == "nvmet" ]]; then
+        install_package nvme-cli
+
+        # TODO: Remove manual installation of the dependency when the
+        # requirement is added to nvmetcli:
+        # http://lists.infradead.org/pipermail/linux-nvme/2022-July/033576.html
+        if is_ubuntu; then
+            install_package python3-configshell-fb
+        else
+            install_package python3-configshell
+        fi
+        # Install from source because Ubuntu doesn't have the package and some packaged versions didn't work on Python 3
+        pip_install git+git://git.infradead.org/users/hch/nvmetcli.git
+
+        sudo modprobe nvmet
+        sudo modprobe nvme-fabrics
+
+        if [[ $CINDER_TARGET_PROTOCOL == 'nvmet_rdma' ]]; then
+            install_package rdma-core
+            sudo modprobe nvme-rdma
+
+            # Create the Soft-RoCE device over the networking interface
+            local iface=${HOST_IP_IFACE:-`ip -br -$SERVICE_IP_VERSION a | grep $CINDER_MY_IP | awk '{print $1}'`}
+            if [[ -z "$iface" ]]; then
+                die $LINENO "Cannot find interface to bind Soft-RoCE"
+            fi
+
+            if ! sudo rdma link | grep $iface ; then
+                sudo rdma link add rxe_$iface type rxe netdev $iface
+            fi
+
+        elif [[ $CINDER_TARGET_PROTOCOL == 'nvmet_tcp' ]]; then
+            sudo modprobe nvme-tcp
+
+        else  # 'nvmet_fc'
+            sudo modprobe nvme-fc
+        fi
     fi
 }
 
@@ -512,7 +577,7 @@ function start_cinder {
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi
-    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+    if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         if is_service_enabled c-vol; then
             # Delete any old stack.conf
             sudo rm -f /etc/tgt/conf.d/stack.conf
diff --git a/lib/cinder_backends/fake_gate b/lib/cinder_backends/fake_gate
index 3ffd9a6785..3b9f1d1164 100644
--- a/lib/cinder_backends/fake_gate
+++ b/lib/cinder_backends/fake_gate
@@ -50,7 +50,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeGateDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_TARGET_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
     if [[ "$CINDER_VOLUME_CLEAR" == "non" ]]; then
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index e03ef14c55..42865119da 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -50,7 +50,10 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_TARGET_HELPER"
+    iniset $CINDER_CONF $be_name target_protocol "$CINDER_TARGET_PROTOCOL"
+    iniset $CINDER_CONF $be_name target_port "$CINDER_TARGET_PORT"
+    iniset $CINDER_CONF $be_name target_prefix "$CINDER_TARGET_PREFIX"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
     iniset $CINDER_CONF $be_name volume_clear "$CINDER_VOLUME_CLEAR"
 }
diff --git a/lib/lvm b/lib/lvm
index d3f6bf1792..57ffb967c3 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -130,7 +130,7 @@ function init_lvm_volume_group {
     local size=$2
 
     # Start the tgtd service on Fedora and SUSE if tgtadm is used
-    if  is_fedora || is_suse  && [[ "$CINDER_ISCSI_HELPER" = "tgtadm" ]]; then
+    if  is_fedora || is_suse  && [[ "$CINDER_TARGET_HELPER" = "tgtadm" ]]; then
         start_service tgtd
     fi
 
@@ -138,10 +138,14 @@ function init_lvm_volume_group {
     _create_lvm_volume_group $vg $size
 
     # Remove iscsi targets
-    if [ "$CINDER_ISCSI_HELPER" = "lioadm" ]; then
+    if [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
         sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
-    else
+    elif [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
+    elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
+        # If we don't disconnect everything vgremove will block
+        sudo nvme disconnect-all
+        sudo nvmetcli clear
     fi
     _clean_lvm_volume_group $vg
 }
diff --git a/lib/nova b/lib/nova
index da3a10edd0..7902c5fdb9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -97,6 +97,12 @@ NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVI
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
+if [[ $SERVICE_IP_VERSION == 6 ]]; then
+    NOVA_MY_IP="$HOST_IPV6"
+else
+    NOVA_MY_IP="$HOST_IP"
+fi
+
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
@@ -219,6 +225,9 @@ function cleanup_nova {
         done
         sudo iscsiadm --mode node --op delete || true
 
+        # Disconnect all nvmeof connections
+        sudo nvme disconnect-all || true
+
         # Clean out the instances directory.
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
@@ -306,6 +315,7 @@ function configure_nova {
             fi
         fi
 
+        # Due to cinder bug #1966513 we ALWAYS need an initiator name for LVM
         # Ensure each compute host uses a unique iSCSI initiator
         echo InitiatorName=$(iscsi-iname) | sudo tee /etc/iscsi/initiatorname.iscsi
 
@@ -326,8 +336,28 @@ EOF
         # not work under FIPS.
         iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
 
-        # ensure that iscsid is started, even when disabled by default
-        restart_service iscsid
+        if [[ $CINDER_TARGET_HELPER != 'nvmet' ]]; then
+            # ensure that iscsid is started, even when disabled by default
+            restart_service iscsid
+
+        # For NVMe-oF we need different packages that many not be present
+        else
+            install_package nvme-cli
+            sudo modprobe nvme-fabrics
+
+            # Ensure NVMe is ready and create the Soft-RoCE device over the networking interface
+            if [[ $CINDER_TARGET_PROTOCOL == 'nvmet_rdma' ]]; then
+                sudo modprobe nvme-rdma
+                iface=${HOST_IP_IFACE:-`ip -br -$SERVICE_IP_VERSION a | grep $NOVA_MY_IP | awk '{print $1}'`}
+                if ! sudo rdma link | grep $iface ; then
+                    sudo rdma link add rxe_$iface type rxe netdev $iface
+                fi
+            elif [[ $CINDER_TARGET_PROTOCOL == 'nvmet_tcp' ]]; then
+                sudo modprobe nvme-tcp
+            else  # 'nvmet_fc'
+                sudo modprobe nvme-fc
+            fi
+        fi
     fi
 
     # Rebuild the config file from scratch
@@ -418,11 +448,7 @@ function create_nova_conf {
     iniset $NOVA_CONF filter_scheduler enabled_filters "$NOVA_FILTERS"
     iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
-    if [[ $SERVICE_IP_VERSION == 6 ]]; then
-        iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
-    else
-        iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
-    fi
+    iniset $NOVA_CONF DEFAULT my_ip "$NOVA_MY_IP"
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"

From f49b435e98cd9d119179d98829241954b8d73669 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Thu, 22 Sep 2022 11:22:21 +0900
Subject: [PATCH 3020/3333] [Doc] Fix Glance image size limit command

This commit fixes the configuration document which mentions how to
change Glance default image size quota at runtime because we don't have
`openstack registered limit update` command but
`openstack registered limit set` command[1].

[1] https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/registered-limit.html#registered-limit-set

Change-Id: I399685ed1f864f8f1ce7295ed6f83336cfccbd81
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..d0f2b02419 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -719,7 +719,7 @@ or at runtime via:
 
 ::
 
-    openstack --os-cloud devstack-system-admin registered limit update \
+    openstack --os-cloud devstack-system-admin registered limit set \
       --service glance --default-limit 5000 --region RegionOne image_size_total
 
 .. _arch-configuration:

From 1516997afe888ebc3cd06653a4f29a05bba7b346 Mon Sep 17 00:00:00 2001
From: Tom Weininger <tweining@redhat.com>
Date: Wed, 14 Sep 2022 17:16:00 +0200
Subject: [PATCH 3021/3333] Update user guide for Octavia

Change-Id: I8e3134c3b2d591f7ab72b8040e1b931e967e11be
---
 doc/source/guides.rst                         |   8 +-
 doc/source/guides/devstack-with-lbaas-v2.rst  | 145 ------------------
 .../guides/devstack-with-nested-kvm.rst       |   2 +
 doc/source/guides/devstack-with-octavia.rst   | 144 +++++++++++++++++
 4 files changed, 150 insertions(+), 149 deletions(-)
 delete mode 100644 doc/source/guides/devstack-with-lbaas-v2.rst
 create mode 100644 doc/source/guides/devstack-with-octavia.rst

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index e7ec629962..e7b46b6e55 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -20,7 +20,7 @@ Walk through various setups used by stackers
    guides/neutron
    guides/devstack-with-nested-kvm
    guides/nova
-   guides/devstack-with-lbaas-v2
+   guides/devstack-with-octavia
    guides/devstack-with-ldap
 
 All-In-One Single VM
@@ -69,10 +69,10 @@ Nova and devstack
 
 Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
 
-Configure Load-Balancer Version 2
------------------------------------
+Configure Octavia
+-----------------
 
-Guide on :doc:`Configure Load-Balancer Version 2 <guides/devstack-with-lbaas-v2>`.
+Guide on :doc:`Configure Octavia <guides/devstack-with-octavia>`.
 
 Deploying DevStack with LDAP
 ----------------------------
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
deleted file mode 100644
index 5d96ca7d74..0000000000
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ /dev/null
@@ -1,145 +0,0 @@
-Devstack with Octavia Load Balancing
-====================================
-
-Starting with the OpenStack Pike release, Octavia is now a standalone service
-providing load balancing services for OpenStack.
-
-This guide will show you how to create a devstack with `Octavia API`_ enabled.
-
-.. _Octavia API: https://docs.openstack.org/api-ref/load-balancer/v2/index.html
-
-Phase 1: Create DevStack + 2 nova instances
---------------------------------------------
-
-First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space,
-make sure it is updated. Install git and any other developer tools you find
-useful.
-
-Install devstack
-
-::
-
-    git clone https://opendev.org/openstack/devstack
-    cd devstack/tools
-    sudo ./create-stack-user.sh
-    cd ../..
-    sudo mv devstack /opt/stack
-    sudo chown -R stack.stack /opt/stack/devstack
-
-This will clone the current devstack code locally, then setup the "stack"
-account that devstack services will run under. Finally, it will move devstack
-into its default location in /opt/stack/devstack.
-
-Edit your ``/opt/stack/devstack/local.conf`` to look like
-
-::
-
-    [[local|localrc]]
-    enable_plugin octavia https://opendev.org/openstack/octavia
-    # If you are enabling horizon, include the octavia dashboard
-    # enable_plugin octavia-dashboard https://opendev.org/openstack/octavia-dashboard.git
-    # If you are enabling barbican for TLS offload in Octavia, include it here.
-    # enable_plugin barbican https://opendev.org/openstack/barbican
-
-    # ===== BEGIN localrc =====
-    DATABASE_PASSWORD=password
-    ADMIN_PASSWORD=password
-    SERVICE_PASSWORD=password
-    SERVICE_TOKEN=password
-    RABBIT_PASSWORD=password
-    # Enable Logging
-    LOGFILE=$DEST/logs/stack.sh.log
-    VERBOSE=True
-    LOG_COLOR=True
-    # Pre-requisite
-    ENABLED_SERVICES=rabbit,mysql,key
-    # Horizon - enable for the OpenStack web GUI
-    # ENABLED_SERVICES+=,horizon
-    # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
-    ENABLED_SERVICES+=,placement-api,placement-client
-    # Glance
-    ENABLED_SERVICES+=,g-api
-    # Neutron
-    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta,neutron
-    ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api
-    # Cinder
-    ENABLED_SERVICES+=,c-api,c-vol,c-sch
-    # Tempest
-    ENABLED_SERVICES+=,tempest
-    # Barbican - Optionally used for TLS offload in Octavia
-    # ENABLED_SERVICES+=,barbican
-    # ===== END localrc =====
-
-Run stack.sh and do some sanity checks
-
-::
-
-    sudo su - stack
-    cd /opt/stack/devstack
-    ./stack.sh
-    . ./openrc
-
-    openstack network list  # should show public and private networks
-
-Create two nova instances that we can use as test http servers:
-
-::
-
-    #create nova instances on private network
-    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
-    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
-    openstack server list # should show the nova instances just created
-
-    #add secgroup rules to allow ssh etc..
-    openstack security group rule create default --protocol icmp
-    openstack security group rule create default --protocol tcp --dst-port 22:22
-    openstack security group rule create default --protocol tcp --dst-port 80:80
-
-Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)' or 'gocubsgo') and run
-
-::
-
-    MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
-    while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
-
-Phase 2: Create your load balancer
-----------------------------------
-
-Make sure you have the 'openstack loadbalancer' commands:
-
-::
-
-    pip install python-octaviaclient
-
-Create your load balancer:
-
-::
-
-    openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer listener create --protocol HTTP --protocol-port 80 --name listener1 lb1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer pool create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer healthmonitor create --delay 5 --timeout 2 --max-retries 1 --type HTTP pool1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer member create --subnet-id private-subnet --address <web server 1 address> --protocol-port 80 pool1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer member create --subnet-id private-subnet --address <web server 2 address> --protocol-port 80 pool1
-
-Please note: The <web server # address> fields are the IP addresses of the nova
-servers created in Phase 1.
-Also note, using the API directly you can do all of the above commands in one
-API call.
-
-Phase 3: Test your load balancer
---------------------------------
-
-::
-
-    openstack loadbalancer show lb1 # Note the vip_address
-    curl http://<vip_address>
-    curl http://<vip_address>
-
-This should show the "Welcome to <IP>" message from each member server.
diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 3732f06fd8..ba483e9ec9 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -1,3 +1,5 @@
+.. _kvm_nested_virt:
+
 =======================================================
 Configure DevStack with KVM-based Nested Virtualization
 =======================================================
diff --git a/doc/source/guides/devstack-with-octavia.rst b/doc/source/guides/devstack-with-octavia.rst
new file mode 100644
index 0000000000..55939f0f12
--- /dev/null
+++ b/doc/source/guides/devstack-with-octavia.rst
@@ -0,0 +1,144 @@
+Devstack with Octavia Load Balancing
+====================================
+
+Starting with the OpenStack Pike release, Octavia is now a standalone service
+providing load balancing services for OpenStack.
+
+This guide will show you how to create a devstack with `Octavia API`_ enabled.
+
+.. _Octavia API: https://docs.openstack.org/api-ref/load-balancer/v2/index.html
+
+Phase 1: Create DevStack + 2 nova instances
+--------------------------------------------
+
+First, set up a VM of your choice with at least 8 GB RAM and 16 GB disk space,
+make sure it is updated. Install git and any other developer tools you find
+useful.
+
+Install devstack::
+
+    git clone https://opendev.org/openstack/devstack
+    cd devstack/tools
+    sudo ./create-stack-user.sh
+    cd ../..
+    sudo mv devstack /opt/stack
+    sudo chown -R stack.stack /opt/stack/devstack
+
+This will clone the current devstack code locally, then setup the "stack"
+account that devstack services will run under. Finally, it will move devstack
+into its default location in /opt/stack/devstack.
+
+Edit your ``/opt/stack/devstack/local.conf`` to look like::
+
+    [[local|localrc]]
+    # ===== BEGIN localrc =====
+    DATABASE_PASSWORD=password
+    ADMIN_PASSWORD=password
+    SERVICE_PASSWORD=password
+    SERVICE_TOKEN=password
+    RABBIT_PASSWORD=password
+    GIT_BASE=https://opendev.org
+    # Optional settings:
+    # OCTAVIA_AMP_BASE_OS=centos
+    # OCTAVIA_AMP_DISTRIBUTION_RELEASE_ID=9-stream
+    # OCTAVIA_AMP_IMAGE_SIZE=3
+    # OCTAVIA_LB_TOPOLOGY=ACTIVE_STANDBY
+    # OCTAVIA_ENABLE_AMPHORAV2_JOBBOARD=True
+    # LIBS_FROM_GIT+=octavia-lib,
+    # Enable Logging
+    LOGFILE=$DEST/logs/stack.sh.log
+    VERBOSE=True
+    LOG_COLOR=True
+    enable_service rabbit
+    enable_plugin neutron $GIT_BASE/openstack/neutron
+    # Octavia supports using QoS policies on the VIP port:
+    enable_service q-qos
+    enable_service placement-api placement-client
+    # Octavia services
+    enable_plugin octavia $GIT_BASE/openstack/octavia master
+    enable_plugin octavia-dashboard $GIT_BASE/openstack/octavia-dashboard
+    enable_plugin ovn-octavia-provider $GIT_BASE/openstack/ovn-octavia-provider
+    enable_plugin octavia-tempest-plugin $GIT_BASE/openstack/octavia-tempest-plugin
+    enable_service octavia o-api o-cw o-hm o-hk o-da
+    # If you are enabling barbican for TLS offload in Octavia, include it here.
+    # enable_plugin barbican $GIT_BASE/openstack/barbican
+    # enable_service barbican
+    # Cinder (optional)
+    disable_service c-api c-vol c-sch
+    # Tempest
+    enable_service tempest
+    # ===== END localrc =====
+
+.. note::
+    For best performance it is highly recommended to use KVM
+    virtualization instead of QEMU.
+    Also make sure nested virtualization is enabled as documented in
+    :ref:`the respective guide <kvm_nested_virt>`.
+    By adding ``LIBVIRT_CPU_MODE="host-passthrough"`` to your
+    ``local.conf`` you enable the guest VMs to make use of all features your
+    host's CPU provides.
+
+Run stack.sh and do some sanity checks::
+
+    sudo su - stack
+    cd /opt/stack/devstack
+    ./stack.sh
+    . ./openrc
+
+    openstack network list  # should show public and private networks
+
+Create two nova instances that we can use as test http servers::
+
+    # create nova instances on private network
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
+    openstack server list # should show the nova instances just created
+
+    # add secgroup rules to allow ssh etc..
+    openstack security group rule create default --protocol icmp
+    openstack security group rule create default --protocol tcp --dst-port 22:22
+    openstack security group rule create default --protocol tcp --dst-port 80:80
+
+Set up a simple web server on each of these instances. One possibility is to use
+the `Golang test server`_ that is used by the Octavia project for CI testing
+as well.
+Copy the binary to your instances and start it as shown below
+(username 'cirros', password 'gocubsgo')::
+
+    INST_IP=<instance IP>
+    scp -O test_server.bin cirros@${INST_IP}:
+    ssh -f cirros@${INST_IP} ./test_server.bin -id ${INST_IP}
+
+When started this way the test server will respond to HTTP requests with
+its own IP.
+
+Phase 2: Create your load balancer
+----------------------------------
+
+Create your load balancer::
+
+    openstack loadbalancer create --wait --name lb1 --vip-subnet-id private-subnet
+    openstack loadbalancer listener create --wait --protocol HTTP --protocol-port 80 --name listener1 lb1
+    openstack loadbalancer pool create --wait --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    openstack loadbalancer healthmonitor create --wait --delay 5 --timeout 2 --max-retries 1 --type HTTP pool1
+    openstack loadbalancer member create --wait --subnet-id private-subnet --address <web server 1 address> --protocol-port 80 pool1
+    openstack loadbalancer member create --wait --subnet-id private-subnet --address <web server 2 address> --protocol-port 80 pool1
+
+Please note: The <web server # address> fields are the IP addresses of the nova
+servers created in Phase 1.
+Also note, using the API directly you can do all of the above commands in one
+API call.
+
+Phase 3: Test your load balancer
+--------------------------------
+
+::
+
+    openstack loadbalancer show lb1 # Note the vip_address
+    curl http://<vip_address>
+    curl http://<vip_address>
+
+This should show the "Welcome to <IP>" message from each member server.
+
+
+.. _Golang test server: https://opendev.org/openstack/octavia-tempest-plugin/src/branch/master/octavia_tempest_plugin/contrib/test_server

From 0d5c8d6643d5f532ec4b0e9f4a588d604db51dba Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Wed, 28 Sep 2022 02:13:58 +0200
Subject: [PATCH 3022/3333] Update DEVSTACK_SERIES to 2023.1

stable/zed branch has been created now and
current master is for 2023.1 Antelope.

Change-Id: I6186d01b1bf8548425500cc9feee6ab494a3db03
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index b3130e5f7f..a05d1e5553 100644
--- a/stackrc
+++ b/stackrc
@@ -243,7 +243,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="zed"
+DEVSTACK_SERIES="2023.1"
 
 ##############
 #

From 9ece457b7b704d1218f8746829b7950b70e0a406 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 24 Aug 2022 14:43:00 +1000
Subject: [PATCH 3023/3333] Update to Fedora 36

Update the Fedora job to the latest release nodes

Depends-On: https://review.opendev.org/c/openstack/devstack/+/860634
Change-Id: If2d7f99e3665a2e3df4cf763efc64dd381f02350
---
 .zuul.yaml       | 2 +-
 files/rpms/swift | 2 +-
 lib/apache       | 2 +-
 stack.sh         | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6ad7148449..441a9cf1e9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -82,7 +82,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-35
+        label: fedora-36
     groups:
       - name: tempest
         nodes:
diff --git a/files/rpms/swift b/files/rpms/swift
index 7d906aa926..49a1833dc4 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f35,rhel9
+xinetd # not:f36,rhel9
diff --git a/lib/apache b/lib/apache
index 94f3cfc95a..705776c55b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -95,7 +95,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! [[ $DISTRO =~ f35 ]]; then
+    elif is_fedora && ! [[ $DISTRO =~ f36 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/stack.sh b/stack.sh
index c99189e6dc..cc90fca576 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (Bionic or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
+# (Bionic or newer), **Fedora** (F36 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From e3bc6b5f571a5b291617ee5227c153002ef8d9c3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 24 Sep 2019 12:44:16 +1000
Subject: [PATCH 3024/3333] get_or_create_domain: simplify with "--or-show"
 argument

Similar to other functions, this uses "--or-show" to avoid double
calls.

Co-Authored-By: Jens Harbott <harbott@osism.tech>
Change-Id: I548f9acd812687838e04b705f86f3b70d2b10caf
---
 functions-common | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index 92a6678de0..ed44186804 100644
--- a/functions-common
+++ b/functions-common
@@ -875,14 +875,9 @@ function policy_add {
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
     local domain_id
-    # Gets domain id
     domain_id=$(
-        # Gets domain id
-        openstack --os-cloud devstack-system-admin domain show $1 \
-            -f value -c id 2>/dev/null ||
-        # Creates new domain
         openstack --os-cloud devstack-system-admin domain create $1 \
-            --description "$2" \
+            --description "$2" --or-show \
             -f value -c id
     )
     echo $domain_id

From e69b78df6fc48a1e70c180d3878164e416adbbdd Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 24 Sep 2019 12:51:25 +1000
Subject: [PATCH 3025/3333] Simplify role addtion helper functions

Because adding the role is idempotent, we can save doing the initial
check for role assignment.  Also simplify the output matching by using
osc's filters where appropriate.

Co-Authored-By: Jens Harbott <harbott@osism.tech>
Change-Id: If2a661cc565a43a7821b8f0a10edd97de08eb911
---
 functions-common | 65 ++++++++++++++++++------------------------------
 1 file changed, 24 insertions(+), 41 deletions(-)

diff --git a/functions-common b/functions-common
index ed44186804..e9984fd65e 100644
--- a/functions-common
+++ b/functions-common
@@ -966,29 +966,22 @@ function _get_domain_args {
 # Usage: get_or_add_user_project_role <role> <user> <project> [<user_domain> <project_domain>]
 function get_or_add_user_project_role {
     local user_role_id
+    local domain_args
 
     domain_args=$(_get_domain_args $4 $5)
 
-    # Gets user role id
+    # Note this is idempotent so we are safe across multiple
+    # duplicate calls.
+    openstack --os-cloud devstack-system-admin role add $1 \
+        --user $2 \
+        --project $3 \
+        $domain_args
     user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --project $3 \
         $domain_args \
-        | grep '^|\s[a-f0-9]\+' | get_field 1)
-    if [[ -z "$user_role_id" ]]; then
-        # Adds role to user and get it
-        openstack --os-cloud devstack-system-admin role add $1 \
-            --user $2 \
-            --project $3 \
-            $domain_args
-        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
-            --role $1 \
-            --user $2 \
-            --project $3 \
-            $domain_args \
-            | grep '^|\s[a-f0-9]\+' | get_field 1)
-    fi
+        -c Role -f value)
     echo $user_role_id
 }
 
@@ -996,23 +989,18 @@ function get_or_add_user_project_role {
 # Usage: get_or_add_user_domain_role <role> <user> <domain>
 function get_or_add_user_domain_role {
     local user_role_id
-    # Gets user role id
+
+    # Note this is idempotent so we are safe across multiple
+    # duplicate calls.
+    openstack --os-cloud devstack-system-admin role add $1 \
+        --user $2 \
+        --domain $3
     user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --domain $3 \
-        | grep '^|\s[a-f0-9]\+' | get_field 1)
-    if [[ -z "$user_role_id" ]]; then
-        # Adds role to user and get it
-        openstack --os-cloud devstack-system-admin role add $1 \
-            --user $2 \
-            --domain $3
-        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
-            --role $1 \
-            --user $2 \
-            --domain $3 \
-            | grep '^|\s[a-f0-9]\+' | get_field 1)
-    fi
+        -c Role -f value)
+
     echo $user_role_id
 }
 
@@ -1051,23 +1039,18 @@ function get_or_add_user_system_role {
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
     local group_role_id
-    # Gets group role id
+
+    # Note this is idempotent so we are safe across multiple
+    # duplicate calls.
+    openstack role add $1 \
+        --group $2 \
+        --project $3
     group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --group $2 \
         --project $3 \
-        -f value)
-    if [[ -z "$group_role_id" ]]; then
-        # Adds role to group and get it
-        openstack --os-cloud devstack-system-admin role add $1 \
-            --group $2 \
-            --project $3
-        group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
-            --role $1 \
-            --group $2 \
-            --project $3 \
-            -f value)
-    fi
+        -f value -c Role)
+
     echo $group_role_id
 }
 

From 2e6756640c8e85cb924f9dfcd968aad303b481b3 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 6 Oct 2022 17:24:57 +0200
Subject: [PATCH 3026/3333] Re-enable horizon in jammy-based jobs

The issue that Horizon had with python3.10 has been fixed some time ago,
so we can stop disabling it for those jobs.

Also stop including roles from devstack-gate which we no longer need.

Change-Id: Ia5d0b31561adc5051acd96fcaab183e60c3c2f99
---
 .zuul.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6ad7148449..99b48dae45 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -335,7 +335,6 @@
     required-projects:
       - opendev.org/openstack/devstack
     roles:
-      - zuul: opendev.org/openstack/devstack-gate
       - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
       devstack_localrc:
@@ -676,9 +675,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_services:
-        # Horizon doesn't like py310
-        horizon: false
 
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
@@ -706,8 +702,6 @@
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
       devstack_services:
-        # Horizon doesn't like py310
-        horizon: false
         # Disable OVN services
         ovn-northd: false
         ovn-controller: false
@@ -752,10 +746,6 @@
     voting: false
     vars:
       configure_swap_size: 4096
-      # Python 3.10 dependency issues; see
-      # https://bugs.launchpad.net/horizon/+bug/1960204
-      devstack_services:
-        horizon: false
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview

From 7d1ba835c38839a62cee94dc281773b62c554932 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Tue, 11 Oct 2022 12:35:18 +0900
Subject: [PATCH 3027/3333] [Doc] Fix tox command option to run smoke tests

This commit fixes the tox command option to run the smoke tests. The
original arguments fail with the error[1], and `-efull` and
`tempest.scenario.test_network_basic_ops` are not for the smoke tests.

[1]
 $ tox -efull tempest.scenario.test_network_basic_ops
 ...
 tempest run: error: unrecognized arguments: tempest.scenario.test_network_basic_ops

Change-Id: I9c3dd9fb4f64bf856c5cab88a2aeaae355c84a65
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..3191ae824b 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -636,7 +636,7 @@ tests can be run as follows:
 ::
 
     $ cd /opt/stack/tempest
-    $ tox -efull  tempest.scenario.test_network_basic_ops
+    $ tox -e smoke
 
 By default tempest is downloaded and the config file is generated, but the
 tempest package is not installed in the system's global site-packages (the

From 781fbf47b557d92bcb71e60c535f6249e729637d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 11 Oct 2022 15:41:02 +0200
Subject: [PATCH 3028/3333] docs: Add warnings about password selection

Some services fail when using special characters in passwords, add some
warnings to our docs.

Closes-Bug: 1744985
Change-Id: I601149e2e7362507b38f01719f7197385a27e0a8
---
 doc/source/configuration.rst         | 3 +++
 doc/source/guides/single-machine.rst | 3 +++
 doc/source/index.rst                 | 5 ++++-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..d59c1edafd 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -181,6 +181,9 @@ values that most often need to be set.
 If the ``*_PASSWORD`` variables are not set here you will be prompted to
 enter values for them by ``stack.sh``.
 
+.. warning:: Only use alphanumeric characters in your passwords, as some
+   services fail to work when using special characters.
+
 The network ranges must not overlap with any networks in use on the
 host. Overlap is not uncommon as RFC-1918 'private' ranges are commonly
 used for both the local networking and Nova's fixed and floating ranges.
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 0529e30f08..a4385b5b4b 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -106,6 +106,9 @@ do the following:
 -  Set the service password. This is used by the OpenStack services
    (Nova, Glance, etc) to authenticate with Keystone.
 
+.. warning:: Only use alphanumeric characters in your passwords, as some
+   services fail to work when using special characters.
+
 ``local.conf`` should look something like this:
 
 .. code-block:: ini
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 0434d68838..ba7ea42943 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -101,7 +101,10 @@ devstack git repo.
 This is the minimum required config to get started with DevStack.
 
 .. note:: There is a sample :download:`local.conf </assets/local.conf>` file
-    under the *samples* directory in the devstack repository.
+   under the *samples* directory in the devstack repository.
+
+.. warning:: Only use alphanumeric characters in your passwords, as some
+   services fail to work when using special characters.
 
 Start the install
 -----------------

From 358987f065af05d166539982c282e2f587b5c952 Mon Sep 17 00:00:00 2001
From: Adrian Fusco Arnejo <afuscoar@redhat.com>
Date: Wed, 31 Aug 2022 19:38:49 +0200
Subject: [PATCH 3029/3333] Adding devstack support for Rocky Linux 9

Adding job and nodeset to run tempest-full-py3 in Rocky Linux 9 instance

Change-Id: I6fb390bfeec436b50a3ddc18d154bbce3f3b1975
---
 .zuul.yaml           | 20 ++++++++++++++++++++
 doc/source/index.rst |  2 +-
 functions-common     |  7 ++++++-
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c29cb31f31..8e6f8633ff 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -106,6 +106,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-rockylinux-9
+    nodes:
+      - name: controller
+        label: rockylinux-9
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -676,6 +686,15 @@
     vars:
       configure_swap_size: 4096
 
+- job:
+    name: devstack-platform-rocky-blue-onyx
+    parent: tempest-full-py3
+    description: Rocky Linux 9 Blue Onyx platform test
+    nodeset: devstack-single-node-rockylinux-9
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
@@ -852,6 +871,7 @@
         - devstack-platform-fedora-latest
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
+        - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 0434d68838..626d5e1a85 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
+latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and OpenSUSE.
 
 If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
diff --git a/functions-common b/functions-common
index 92a6678de0..e27518f559 100644
--- a/functions-common
+++ b/functions-common
@@ -418,6 +418,9 @@ function GetOSVersion {
         os_RELEASE=${VERSION_ID}
         os_CODENAME="n/a"
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
+    elif [[ "${ID}${VERSION}" =~ "rocky9" ]]; then
+        os_VENDOR="Rocky"
+        os_RELEASE=${VERSION_ID}
     else
         _ensure_lsb_release
 
@@ -466,6 +469,7 @@ function GetDistro {
         "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
+        "$os_VENDOR" =~ (Rocky) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
@@ -513,7 +517,7 @@ function is_oraclelinux {
 
 
 # Determine if current distribution is a Fedora-based distribution
-# (Fedora, RHEL, CentOS, etc).
+# (Fedora, RHEL, CentOS, Rocky, etc).
 # is_fedora
 function is_fedora {
     if [[ -z "$os_VENDOR" ]]; then
@@ -523,6 +527,7 @@ function is_fedora {
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
+        [ "$os_VENDOR" = "Rocky" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]

From 71c99655479174750bcedfe458328328a1596766 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Wed, 19 Oct 2022 14:08:43 -0400
Subject: [PATCH 3030/3333] Use separate OVS and OVN directories

If stack.sh is run on a system that already has OVN packages
installed, it could fail to find its DB sockets. This is because
the 'ln -s' will place the symlink inside of /var/run/ovn
instead of using a single directory as intended.

Change the code in neutron_plugins/ovn_agent to not make the
symlink and instead use separate directories for OVS and OVN.

Closes-bug: #1980421

Change-Id: Ic28a93bdc3dfe4a6159234baeabd0064db452b07
---
 lib/neutron_plugins/ovn_agent | 43 ++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 23 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 8eb2993b94..e64224cbaa 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -244,11 +244,12 @@ function _run_process {
     local cmd="$2"
     local stop_cmd="$3"
     local group=$4
-    local user=${5:-$STACK_USER}
+    local user=$5
+    local rundir=${6:-$OVS_RUNDIR}
 
     local systemd_service="devstack@$service.service"
     local unit_file="$SYSTEMD_DIR/$systemd_service"
-    local environment="OVN_RUNDIR=$OVS_RUNDIR OVN_DBDIR=$OVN_DATADIR OVN_LOGDIR=$LOGDIR OVS_RUNDIR=$OVS_RUNDIR OVS_DBDIR=$OVS_DATADIR OVS_LOGDIR=$LOGDIR"
+    local environment="OVN_RUNDIR=$OVN_RUNDIR OVN_DBDIR=$OVN_DATADIR OVN_LOGDIR=$LOGDIR OVS_RUNDIR=$OVS_RUNDIR OVS_DBDIR=$OVS_DATADIR OVS_LOGDIR=$LOGDIR"
 
     echo "Starting $service executed command": $cmd
 
@@ -264,14 +265,14 @@ function _run_process {
 
     _start_process $systemd_service
 
-    local testcmd="test -e $OVS_RUNDIR/$service.pid"
+    local testcmd="test -e $rundir/$service.pid"
     test_with_retry "$testcmd" "$service did not start" $SERVICE_TIMEOUT 1
     local service_ctl_file
-    service_ctl_file=$(ls $OVS_RUNDIR | grep $service | grep ctl)
+    service_ctl_file=$(ls $rundir | grep $service | grep ctl)
     if [ -z "$service_ctl_file" ]; then
         die $LINENO "ctl file for service $service is not present."
     fi
-    sudo ovs-appctl -t $OVS_RUNDIR/$service_ctl_file vlog/set console:off syslog:info file:info
+    sudo ovs-appctl -t $rundir/$service_ctl_file vlog/set console:off syslog:info file:info
 }
 
 function clone_repository {
@@ -370,10 +371,6 @@ function install_ovn {
 
     sudo mkdir -p $OVS_RUNDIR
     sudo chown $(whoami) $OVS_RUNDIR
-    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
-    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
-    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
-    sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
         # If OVS is already installed, remove it, because we're about to
@@ -616,12 +613,12 @@ function _start_ovs {
                 dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
             fi
             dbcmd+=" $OVS_DATADIR/conf.db"
-            _run_process ovsdb-server "$dbcmd" "" "$STACK_GROUP" "root"
+            _run_process ovsdb-server "$dbcmd" "" "$STACK_GROUP" "root" "$OVS_RUNDIR"
 
             # Note: ovn-controller will create and configure br-int once it is started.
             # So, no need to create it now because nothing depends on that bridge here.
             local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
-            _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
+            _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root" "$OVS_RUNDIR"
         else
             _start_process "$OVSDB_SERVER_SERVICE"
             _start_process "$OVS_VSWITCHD_SERVICE"
@@ -660,7 +657,7 @@ function _start_ovs {
 
             enable_service ovs-vtep
             local vtepcmd="$OVS_SCRIPTDIR/ovs-vtep --log-file --pidfile --detach br-v"
-            _run_process ovs-vtep "$vtepcmd" "" "$STACK_GROUP" "root"
+            _run_process ovs-vtep "$vtepcmd" "" "$STACK_GROUP" "root" "$OVS_RUNDIR"
 
             vtep-ctl set-manager tcp:$HOST_IP:6640
         fi
@@ -704,26 +701,26 @@ function start_ovn {
             local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_northd"
             local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
 
-            _run_process ovn-northd "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+            _run_process ovn-northd "$cmd" "$stop_cmd" "$STACK_GROUP" "root" "$OVN_RUNDIR"
         else
             _start_process "$OVN_NORTHD_SERVICE"
         fi
 
         # Wait for the service to be ready
         # Check for socket and db files for both OVN NB and SB
-        wait_for_sock_file $OVS_RUNDIR/ovnnb_db.sock
-        wait_for_sock_file $OVS_RUNDIR/ovnsb_db.sock
+        wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
+        wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
         wait_for_db_file $OVN_DATADIR/ovnnb_db.db
         wait_for_db_file $OVN_DATADIR/ovnsb_db.db
 
         if is_service_enabled tls-proxy; then
-            sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-            sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+            sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+            sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
         fi
-        sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovs-appctl -t $OVS_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
-        sudo ovs-appctl -t $OVS_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+        sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then
@@ -731,7 +728,7 @@ function start_ovn {
             local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
             local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
 
-            _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+            _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root" "$OVN_RUNDIR"
         else
             _start_process "$OVN_CONTROLLER_SERVICE"
         fi
@@ -740,7 +737,7 @@ function start_ovn {
     if is_service_enabled ovn-controller-vtep ; then
         if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
             local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
-            _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+            _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root" "$OVN_RUNDIR"
         else
             _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
         fi

From 5e7afb779c469f593a1628e8f63c66989b7e2c49 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Mon, 24 Oct 2022 12:17:48 +0200
Subject: [PATCH 3031/3333] Run dmesg command with sudo

It seems that setting "sysctl kernel.dmesg_restrict" was changed
in Ubuntu 22.04 (Jammy) to "1" and because of that running "dmesg"
command requires now root privileges.

Closes-bug: #1994023

Change-Id: I2adc76e3025fadf994bab2e2e1fd608e688874fc
---
 lib/neutron_plugins/ovs_source | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 164d574c42..ea71e60e68 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -33,9 +33,9 @@ function load_module {
     local fatal=$2
 
     if [ "$(trueorfalse True fatal)" == "True" ]; then
-        sudo modprobe $module || (dmesg && die $LINENO "FAILED TO LOAD $module")
+        sudo modprobe $module || (sudo dmesg && die $LINENO "FAILED TO LOAD $module")
     else
-        sudo modprobe $module || (echo "FAILED TO LOAD $module" && dmesg)
+        sudo modprobe $module || (echo "FAILED TO LOAD $module" && sudo dmesg)
     fi
 }
 
@@ -103,7 +103,7 @@ function prepare_for_ovs_compilation {
 function load_ovs_kernel_modules {
     load_module openvswitch
     load_module vport-geneve False
-    dmesg | tail
+    sudo dmesg | tail
 }
 
 # reload_ovs_kernel_modules() - reload openvswitch kernel module

From 47a429777ce71e4d69e1894f173cf87e731b3a6e Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Fri, 4 Nov 2022 14:31:03 +0100
Subject: [PATCH 3032/3333] Extend single-core-review for non-functional
 changes

Adding a second exception for single-core-review in Devstack
repository - changes which do not affect core functionality, like
f.e. job cleanups, can be reviewed by a single core.

Change-Id: Idb6cefa510fdbfed41379eb410f4884852d1177f
---
 doc/source/contributor/contributing.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst
index 4de238fbf8..8b5a85b3df 100644
--- a/doc/source/contributor/contributing.rst
+++ b/doc/source/contributor/contributing.rst
@@ -42,8 +42,9 @@ Getting Your Patch Merged
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 All changes proposed to the Devstack require two ``Code-Review +2`` votes from
 Devstack core reviewers before one of the core reviewers can approve the patch
-by giving ``Workflow +1`` vote. One exception is for patches to unblock the gate
-which can be approved by single core reviewers.
+by giving ``Workflow +1`` vote. There are 2 exceptions, approving patches to
+unblock the gate and patches that do not relate to the Devstack's core logic,
+like for example old job cleanups, can be approved by single core reviewers.
 
 Project Team Lead Duties
 ~~~~~~~~~~~~~~~~~~~~~~~~

From d1c2bf5e7c739bc5a7eeac602b477edb9f6630c2 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 2 Nov 2022 16:43:41 +0100
Subject: [PATCH 3033/3333] Add new service "file_tracker"

This new service periodically tracks the file open in the system.

Closes-Bug: #1995502
Change-Id: I02e097fef07655ff571af9f35bf258b2ed975098
---
 .zuul.yaml               |  4 ++++
 doc/source/debugging.rst |  6 +++++
 lib/dstat                |  6 +++++
 tools/file_tracker.sh    | 47 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 63 insertions(+)
 create mode 100755 tools/file_tracker.sh

diff --git a/.zuul.yaml b/.zuul.yaml
index 6dbb5bacbe..ce38760203 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -469,6 +469,7 @@
         dstat: false
         etcd3: true
         memory_tracker: true
+        file_tracker: true
         mysql: true
         rabbit: true
     group-vars:
@@ -477,6 +478,7 @@
           # Shared services
           dstat: false
           memory_tracker: true
+          file_tracker: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -544,6 +546,7 @@
         dstat: false
         etcd3: true
         memory_tracker: true
+        file_tracker: true
         mysql: true
         rabbit: true
         tls-proxy: true
@@ -593,6 +596,7 @@
           # Shared services
           dstat: false
           memory_tracker: true
+          file_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
diff --git a/doc/source/debugging.rst b/doc/source/debugging.rst
index fd0d9cdf74..3ca0ad94b4 100644
--- a/doc/source/debugging.rst
+++ b/doc/source/debugging.rst
@@ -20,6 +20,12 @@ provides consumption output when available memory is seen to be
 falling (i.e. processes are consuming memory).  It also provides
 output showing locked (unswappable) memory.
 
+file_tracker
+------------
+
+The ``file_tracker`` service periodically monitors the number of
+open files in the system.
+
 tcpdump
 -------
 
diff --git a/lib/dstat b/lib/dstat
index eb03ae0fb2..870c901d2a 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -40,12 +40,18 @@ function start_dstat {
     if is_service_enabled peakmem_tracker; then
         die $LINENO "The peakmem_tracker service has been removed, use memory_tracker instead"
     fi
+
+    # To enable file_tracker add:
+    #    enable_service file_tracker
+    # to your localrc
+    run_process file_tracker "$TOP_DIR/tools/file_tracker.sh"
 }
 
 # stop_dstat() stop dstat process
 function stop_dstat {
     stop_process dstat
     stop_process memory_tracker
+    stop_process file_tracker
 }
 
 # Restore xtrace
diff --git a/tools/file_tracker.sh b/tools/file_tracker.sh
new file mode 100755
index 0000000000..9c31b30a56
--- /dev/null
+++ b/tools/file_tracker.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+set -o errexit
+
+# time to sleep between checks
+SLEEP_TIME=20
+
+function tracker {
+    echo "Number of open files | Number of open files not in use | Maximum number of files allowed to be opened"
+    while true; do
+        cat /proc/sys/fs/file-nr
+        sleep $SLEEP_TIME
+    done
+}
+
+function usage {
+    echo "Usage: $0 [-x] [-s N]" 1>&2
+    exit 1
+}
+
+while getopts ":s:x" opt; do
+    case $opt in
+        s)
+            SLEEP_TIME=$OPTARG
+            ;;
+        x)
+            set -o xtrace
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done
+
+tracker

From a4680766515ed9317b71cfb39cd0d75dc04f3d9c Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 9 Nov 2022 10:11:46 -0800
Subject: [PATCH 3034/3333] Make debian-bullseye job non-voting

As noted in the QA meeting this week, this job is failing due to
something that seems outside of our control:

https://meetings.opendev.org/meetings/qa/2022/qa.2022-11-08-15.00.log.html

Make it non-voting until that is resolved.

Change-Id: Ia571d1dab45eb1bbb8665373d416515d3c95fb14
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6dbb5bacbe..1923444601 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -674,6 +674,8 @@
     description: Debian Bullseye platform test
     nodeset: devstack-single-node-debian-bullseye
     timeout: 9000
+    # TODO(danms) n-v until the known issue is resolved
+    voting: false
     vars:
       configure_swap_size: 4096
 

From 97b2a51d6beee4fd58b93027d823d6fd90f5c11f Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 9 Nov 2022 11:58:37 -0800
Subject: [PATCH 3035/3333] Fix dbcounter install on Debian Bullseye

The dbcounter install on Debian Bullseye is broken in a really fun way.
The problem is that we end up mixing pypi openssl and distro
cryptography under pip and those two versions of libraries are not
compatible.

The reason this happens is that debian's pip package debundles the pip
deps. This splits them out into /usr/share/python-wheels and it will
prefer distro versions of libraries over pypi installed versions of
libraries. But if a pypi version is installed and a distro version is
not then the pypi version is used. If the pypi version of library A does
not work with distro version of library B then debundled pip breaks.
This has happened with crypytography and pyOpenSSL.

This happens because urllib3 (a debundled pip dep) appears to use
pyopenssl conditionally. Novnc depends on python3-cryptography, and
openstack depends on cryptogrpahy from pypi ensuring we get both a
distro and a pypi version installed. However, pyOpenSSL is only pulled
in from pypi via openstack deps. This leaves debundled urllib3
attempting to use pypi pyOpenSSL with distro cryptography and that combo
isn't valid due to an interface change.

To fix this we install python3-openssl ensuring that debundled pip will
use distro pyOpenSSL with distro cryptography making everything happy
again. But we only do this when we install novnc as novnc is what pulls
in distro cryptography in the first place. We can't simply install
python3-openssl on all debuntu platforms because this breaks Ubuntu
Focal in the other direction. On Ubuntu focal distro pip uses distro
pyOpenSSL when no pypi pyOpenSSl is installed (prior to keystone
install) and is not compatible with pypi cryptography.

Honestly, this whole intersection between distro and pypi installs of
cryptography and pyOpenSSL could probably be made cleaner. One option
would be for us to always install the constraints version of both
packages from pypi and the distro pacakges very early in the devstack
run. But that seems far more complicated so I'm not attempting that
here.

Change-Id: I0fc6a8e66e365ac49c6c7ceb4c71c68714b9f541
---
 lib/nova | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6de1d3382f..5c619bb762 100644
--- a/lib/nova
+++ b/lib/nova
@@ -885,8 +885,23 @@ function install_nova {
         # a websockets/html5 or flash powered VNC console for vm instances
         NOVNC_FROM_PACKAGE=$(trueorfalse False NOVNC_FROM_PACKAGE)
         if [ "$NOVNC_FROM_PACKAGE" = "True" ]; then
+            # Installing novnc on Debian bullseye breaks the global pip
+            # install. This happens because novnc pulls in distro cryptography
+            # which will be prefered by distro pip, but if anything has
+            # installed pyOpenSSL from pypi (keystone) that is not compatible
+            # with distro cryptography. Fix this by installing
+            # python3-openssl (pyOpenSSL) from the distro which pip will prefer
+            # on Debian. Ubuntu has inverse problems so we only do this for
+            # Debian.
+            local novnc_packages
+            novnc_packages="novnc"
+            GetOSVersion
+            if [[ "$os_VENDOR" = "Debian" ]] ; then
+                novnc_packages="$novnc_packages python3-openssl"
+            fi
+
             NOVNC_WEB_DIR=/usr/share/novnc
-            install_package novnc
+            install_package $novnc_packages
         else
             NOVNC_WEB_DIR=$DEST/novnc
             git_clone $NOVNC_REPO $NOVNC_WEB_DIR $NOVNC_BRANCH

From 857f4993f35fbdc83771b9632d3525766de194a1 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 19 Oct 2022 20:15:42 -0500
Subject: [PATCH 3036/3333] Add RBAC scope and new defaults setting support for
 Nova & Tempest

Nova is ready with the scope and new defaults as per the new
RBAC design. Adding devstack flag to enable the scope checks
and new defaults enforcement in nova side.

Change-Id: I305ea626a4b622c5534d523f4b619832f9d35f8d
---
 lib/nova    | 10 ++++++++++
 lib/tempest |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/lib/nova b/lib/nova
index 8e8ea8a175..63c6a86a66 100644
--- a/lib/nova
+++ b/lib/nova
@@ -97,6 +97,12 @@ NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVI
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
+# Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
+# This is used to switch the compute API policies enable the scope and new defaults.
+# By Default, these flag are False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+NOVA_ENFORCE_SCOPE=$(trueorfalse False NOVA_ENFORCE_SCOPE)
+
 if [[ $SERVICE_IP_VERSION == 6 ]]; then
     NOVA_MY_IP="$HOST_IPV6"
 else
@@ -481,6 +487,10 @@ function create_nova_conf {
             NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
         fi
         iniset $NOVA_CONF DEFAULT enabled_apis "$NOVA_ENABLED_APIS"
+        if [[ "$NOVA_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
+            iniset $NOVA_CONF oslo_policy enforce_new_defaults True
+            iniset $NOVA_CONF oslo_policy enforce_scope True
+        fi
         if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
             # Set the service port for a proxy to take the original
             iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
diff --git a/lib/tempest b/lib/tempest
index 87a2244784..b232f24540 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -674,6 +674,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
 
+    if [[ "$NOVA_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope nova true
+    fi
+
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope glance true
     fi

From d00921a57bcd9b408817ac7feddfc49b49b9cea2 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <frickler@offenerstapel.de>
Date: Mon, 14 Nov 2022 06:50:45 +0000
Subject: [PATCH 3037/3333] Revert "Make debian-bullseye job non-voting"

This reverts commit a4680766515ed9317b71cfb39cd0d75dc04f3d9c.

Reason for revert: Debian job got repaired

Change-Id: I3ef969f6e373de103d26c9282cab94cea7ae87e5
---
 .zuul.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 1923444601..6dbb5bacbe 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -674,8 +674,6 @@
     description: Debian Bullseye platform test
     nodeset: devstack-single-node-debian-bullseye
     timeout: 9000
-    # TODO(danms) n-v until the known issue is resolved
-    voting: false
     vars:
       configure_swap_size: 4096
 

From 8d299efa4b6346ccfc3c6fcf9cf011b3c884bebc Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 9 Oct 2022 11:00:07 +0200
Subject: [PATCH 3038/3333] Switch devstack nodeset to Ubuntu 22.04 (jammy)

Depends-On: https://review.opendev.org/c/openstack/devstack-plugin-ceph/+/864948
Change-Id: I26b4784a4d772abbf8572f6273bda37f2fec5336
---
 .zuul.yaml | 54 +++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 39 insertions(+), 15 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 56acb37a03..76a70dc85c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -168,6 +168,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-jammy
+    nodes:
+      - name: controller
+        label: ubuntu-jammy
+      - name: compute1
+        label: ubuntu-jammy
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:
@@ -455,7 +485,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-focal
+    nodeset: openstack-single-node-jammy
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -526,6 +556,7 @@
       - opendev.org/openstack/swift
     timeout: 7200
     vars:
+      configure_swap_size: 4096
       devstack_localrc:
         # Common OpenStack services settings
         SWIFT_REPLICAS: 1
@@ -651,7 +682,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-focal
+    nodeset: openstack-two-node-jammy
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -669,8 +700,6 @@
     # TODO(kopecmartin) n-v until the following is resolved:
     # https://bugs.launchpad.net/neutron/+bug/1979047
     voting: false
-    vars:
-      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-debian-bullseye
@@ -693,13 +722,11 @@
       configure_swap_size: 4096
 
 - job:
-    name: devstack-platform-ubuntu-jammy
+    name: devstack-platform-ubuntu-focal
     parent: tempest-full-py3
-    description: Ubuntu 22.04 LTS (jammy) platform test
-    nodeset: openstack-single-node-jammy
+    description: Ubuntu 20.04 LTS (focal) platform test
+    nodeset: openstack-single-node-focal
     timeout: 9000
-    vars:
-      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
@@ -769,8 +796,6 @@
     description: Fedora latest platform test
     nodeset: devstack-single-node-fedora-latest
     voting: false
-    vars:
-      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview
@@ -779,7 +804,6 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
     vars:
-      configure_swap_size: 4096
       devstack_localrc:
         ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
 
@@ -839,7 +863,7 @@
 
 - job:
     name: devstack-unit-tests
-    nodeset: ubuntu-focal
+    nodeset: ubuntu-jammy
     description: |
       Runs unit tests on devstack project.
 
@@ -860,7 +884,7 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy
+        - devstack-platform-ubuntu-focal
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
         - devstack-multinode
@@ -910,7 +934,7 @@
         # https://bugs.launchpad.net/neutron/+bug/1979047
         # - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
-        - devstack-platform-ubuntu-jammy
+        - devstack-platform-ubuntu-focal
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From 818d1a225d54291d1da1f8011f92affb2998d0e9 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Mon, 28 Nov 2022 11:19:45 +0100
Subject: [PATCH 3039/3333] [doc] Update Ubuntu to 22.04

This updates documentation to reflect the switch to
Ubuntu 22.04 (jammy) in the CI:
https://review.opendev.org/c/openstack/devstack/+/860795

Change-Id: I8bee430029dcc719629bd92451c2791571f8a30c
---
 doc/source/index.rst | 2 +-
 tools/install_pip.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index ba53c6d279..3f206f411e 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
 latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and OpenSUSE.
 
-If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
+If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 7c5d4c6555..91b180c06f 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -139,7 +139,7 @@ if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # recent enough anyway.  This is included via rpms/general
     : # Simply fall through
 elif is_ubuntu; then
-    # pip on Ubuntu 20.04 is new enough, too
+    # pip on Ubuntu 20.04 and higher is new enough, too
     # drop setuptools from u-c
     sed -i -e '/setuptools/d' $REQUIREMENTS_DIR/upper-constraints.txt
 else

From db3eff7dd27acdc973e8d189bda80d642be92f03 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 30 Nov 2022 14:03:36 +0900
Subject: [PATCH 3040/3333] Stop setting [ovs_vif_ovs] ovsdb_interface

The option was already deprecated in os-vif 2.2.0[1]. The override is
no longer required since bug 1929446 was already resolved.

[1] https://review.opendev.org/c/openstack/os-vif/+/744816

Related-Bug: #1929446
Change-Id: I5bc55723a178b32d947da2ac91d2f62aa8124990
---
 lib/os-vif | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/os-vif b/lib/os-vif
index 865645c0d5..7c8bee3744 100644
--- a/lib/os-vif
+++ b/lib/os-vif
@@ -1,10 +1,5 @@
 #!/bin/bash
 
-# support vsctl or native.
-# until bug #1929446 is resolved we override the os-vif default
-# and fall back to the legacy "vsctl" driver.
-OS_VIF_OVS_OVSDB_INTERFACE=${OS_VIF_OVS_OVSDB_INTERFACE:="vsctl"}
-
 function is_ml2_ovs {
     if [[ "${Q_AGENT}" == "openvswitch" ]]; then
         echo "True"
@@ -19,11 +14,9 @@ OS_VIF_OVS_ISOLATE_VIF=$(trueorfalse False OS_VIF_OVS_ISOLATE_VIF)
 
 function configure_os_vif {
     if [[ -e ${NOVA_CONF} ]]; then
-        iniset ${NOVA_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
         iniset ${NOVA_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
     fi
     if [[ -e ${NEUTRON_CONF} ]]; then
-        iniset ${NEUTRON_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
         iniset ${NEUTRON_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
     fi
 }

From 16c2b389ed8efca70fa1e65395becdaea84f8b44 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 30 Nov 2022 14:24:07 -0600
Subject: [PATCH 3041/3333] Add RBAC scope and new defaults setting support for
 placement

Adding devstack flag to enable and test the Placement API policies
scope and new defaults.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/866212
Change-Id: I6f56fc28f2c1e4cdde946deb2ae06afddf85ff0d
---
 lib/placement | 10 ++++++++++
 lib/tempest   |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/lib/placement b/lib/placement
index b7798669a1..bc22c564f4 100644
--- a/lib/placement
+++ b/lib/placement
@@ -48,6 +48,12 @@ fi
 PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
 
+# Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
+# This is used to switch the Placement API policies scope and new defaults.
+# By Default, these flag are False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+PLACEMENT_ENFORCE_SCOPE=$(trueorfalse False PLACEMENT_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -111,6 +117,10 @@ function configure_placement {
     else
         _config_placement_apache_wsgi
     fi
+    if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
+        iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
+        iniset $PLACEMENT_CONF oslo_policy enforce_scope True
+    fi
 }
 
 # create_placement_accounts() - Set up required placement accounts
diff --git a/lib/tempest b/lib/tempest
index b232f24540..5cd4d18439 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -678,6 +678,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG enforce_scope nova true
     fi
 
+    if [[ "$PLACEMENT_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope placement true
+    fi
+
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope glance true
     fi

From 6440c6d7e69c6726c8d31ea225b90967c50528e8 Mon Sep 17 00:00:00 2001
From: wangxiyuan <wangxiyuan1007@gmail.com>
Date: Fri, 5 Aug 2022 14:18:13 +0800
Subject: [PATCH 3042/3333] Add openEuler 22.03 LTS support

openEuler 20.03 LTS SP2 support was removed from devstack in last
few months due to its python version is too old and the CI job
always fail. And openEuler 20.03 LTS SP2 was out of maintainer in May
2022 by openEuler community.

The newest LTS version was released in March 2022 called 22.03 LTS.
This release will be maintained for at least 2 years. And the python
version is 3.9 which works well for devstack.

This Patch add the openEuler distro support back. And add the related
CI job to make sure its works well.

Change-Id: I99c99d08b4a44d3dc644bd2e56b5ae7f7ee44210
---
 .zuul.yaml                             | 72 ++++++++++++++++++++++++++
 doc/source/index.rst                   |  3 +-
 files/rpms/ceph                        |  2 +-
 files/rpms/general                     |  4 +-
 files/rpms/nova                        |  2 +-
 functions-common                       | 13 ++++-
 lib/apache                             |  2 +-
 lib/nova_plugins/functions-libvirt     |  8 ++-
 roles/apache-logs-conf/tasks/main.yaml |  1 +
 stack.sh                               | 11 +++-
 10 files changed, 109 insertions(+), 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 471ca100c8..8e20f6ed34 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -108,6 +108,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-openeuler-22.03
+    nodes:
+      - name: controller
+        label: openEuler-22-03-LTS
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -777,6 +787,62 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
+- job:
+    name: devstack-platform-openEuler-22.03-ovn-source
+    parent: tempest-full-py3
+    description: openEuler 22.03 LTS platform test (OVN)
+    nodeset: devstack-single-node-openeuler-22.03
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
+        # from source instead.
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "v21.06.0"
+        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
+
+- job:
+    name: devstack-platform-openEuler-22.03-ovs
+    parent: tempest-full-py3
+    description: openEuler 22.03 LTS platform test (OVS)
+    nodeset: devstack-single-node-openeuler-22.03
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 8192
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        Q_ML2_TENANT_NETWORK_TYPE: vxlan
+      devstack_services:
+        # Disable OVN services
+        ovn-northd: false
+        ovn-controller: false
+        ovs-vswitchd: false
+        ovsdb-server: false
+        # Disable Neutron ML2/OVN services
+        q-ovn-metadata-agent: false
+        # Enable Neutron ML2/OVS services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Disable OVN services
+          ovn-controller: false
+          ovs-vswitchd: false
+          ovsdb-server: false
+          # Disable Neutron ML2/OVN services
+          q-ovn-metadata-agent: false
+          # Enable Neutron ML2/OVS services
+          q-agt: true
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -885,6 +951,8 @@
         - devstack-platform-ubuntu-focal
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1017,3 +1085,7 @@
     periodic:
       jobs:
         - devstack-no-tls-proxy
+    periodic-weekly:
+      jobs:
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 3f206f411e..1e932f88a5 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,8 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and OpenSUSE.
+latest/current Fedora version, CentOS/RHEL/Rocky Linux 9, OpenSUSE and
+openEuler.
 
 If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 33a55f80ea..19f158fd57 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core # not:rhel9
+redhat-lsb-core # not:rhel9,openEuler-22.03
 xfsprogs
diff --git a/files/rpms/general b/files/rpms/general
index 7697513149..b6866de62d 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,9 +26,9 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 python3-devel
-python3-pip
+python3-pip # not:openEuler-22.03
 python3-systemd
-redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
+redhat-rpm-config # not:openEuler-22.03  missing dep for gcc hardening flags, see rhbz#1217376
 tar
 tcpdump
 unzip
diff --git a/files/rpms/nova b/files/rpms/nova
index f2824ee2c4..e0f13b854a 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -4,7 +4,7 @@ ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
-kernel-modules
+kernel-modules # not:openEuler-22.03
 kpartx
 parted
 polkit
diff --git a/functions-common b/functions-common
index 0aee5d163e..4eed5d8407 100644
--- a/functions-common
+++ b/functions-common
@@ -399,7 +399,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core
+        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -474,6 +474,8 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
+    elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
+        DISTRO="openEuler-$os_RELEASE"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -525,6 +527,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "Rocky" ] || \
@@ -575,6 +578,14 @@ function is_ubuntu {
     [ "$os_PACKAGE" = "deb" ]
 }
 
+# Determine if current distribution is an openEuler distribution
+# is_openeuler
+function is_openeuler {
+    if [[ -z "$os_PACKAGE" ]]; then
+        GetOSVersion
+    fi
+    [ "$os_VENDOR" = "openEuler" ]
+}
 # Git Functions
 # =============
 
diff --git a/lib/apache b/lib/apache
index 705776c55b..dd8c9a0f06 100644
--- a/lib/apache
+++ b/lib/apache
@@ -95,7 +95,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! [[ $DISTRO =~ f36 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 3e7d2801d6..c0e45ebb85 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -82,11 +82,17 @@ function install_libvirt {
             sudo dnf copr enable -y @virtmaint-sig/virt-preview
         fi
 
+        if is_openeuler; then
+            qemu_package=qemu
+        else
+            qemu_package=qemu-kvm
+        fi
+
         # Note that in CentOS/RHEL this needs to come from the RDO
         # repositories (qemu-kvm-ev ... which provides this package)
         # as the base system version is too old.  We should have
         # pre-installed these
-        install_package qemu-kvm
+        install_package $qemu_package
         install_package libvirt libvirt-devel python3-libvirt
 
         if is_arch "aarch64"; then
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index bd64574c9b..6b7ea37857 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,6 +64,7 @@
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
       'RedHat': '/etc/httpd/conf.d/'
+      'openEuler': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:
diff --git a/stack.sh b/stack.sh
index cc90fca576..28576d1e14 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -394,6 +394,15 @@ elif [[ $DISTRO == "rhel9" ]]; then
     sudo dnf config-manager --set-enabled crb
     # rabbitmq and other packages are provided by RDO repositories.
     _install_rdo
+elif [[ $DISTRO == "openEuler-22.03" ]]; then
+    # There are some problem in openEuler. We should fix it first. Some required
+    # package/action runs before fixup script. So we can't fix there.
+    #
+    # 1. the hostname package is not installed by default
+    # 2. Some necessary packages are in openstack repo, for example liberasurecode-devel
+    # 3. python3-pip can be uninstalled by `get_pip.py` automaticly.
+    install_package hostname openstack-release-wallaby
+    uninstall_package python3-pip
 fi
 
 # Ensure python is installed

From 0a40648b3884c374e314105c33c2a20c85ab2f7f Mon Sep 17 00:00:00 2001
From: Miguel Lavalle <mlavalle@redhat.com>
Date: Wed, 7 Dec 2022 16:51:28 -0600
Subject: [PATCH 3043/3333] Fix the db user for mariadb in ubuntu 22.04

In Ubuntu 22.04, mariadb version 10.6 is installed. Per [0] and [1]
authentication management was changed in version 10.4. This change
adapts the way the db user is created to the new rules in versions
10.4 and later.

[0] https://mariadb.com/kb/en/authentication-from-mariadb-104/
[1] https://mariadb.org/authentication-in-mariadb-10-4/

Closes-Bug: #1999090
Change-Id: I77a699a9e191eb83628ad5d361282e66744b6e4a
---
 lib/databases/mysql | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index b292da25bd..fbad44e36a 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -100,8 +100,13 @@ function configure_database_mysql {
 
     # Set the root password - only works the first time. For Ubuntu, we already
     # did that with debconf before installing the package, but we still try,
-    # because the package might have been installed already.
-    sudo mysqladmin -u root password $DATABASE_PASSWORD || true
+    # because the package might have been installed already. We don't do this
+    # for Ubuntu 22.04 (jammy) because the authorization model change in
+    # version 10.4 of mariadb. See
+    # https://mariadb.org/authentication-in-mariadb-10-4/
+    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+        sudo mysqladmin -u root password $DATABASE_PASSWORD || true
+    fi
 
     # In case of Mariadb, giving hostname in arguments causes permission
     # problems as it expects connection through socket
@@ -115,13 +120,21 @@ function configure_database_mysql {
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
     if is_ubuntu && [[ "$DISTRO" != "bullseye" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
-        sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
-        sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
+        if [[ "$DISTRO" == "jammy" ]]; then
+            # For Ubuntu 22.04 (jammy) we follow the model outlined in
+            # https://mariadb.org/authentication-in-mariadb-10-4/
+            sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
+        else
+            sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
+            sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
+        fi
+    fi
+    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+        # Create DB user if it does not already exist
+        sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+        # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
+        sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
     fi
-    # Create DB user if it does not already exist
-    sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
-    # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
-    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 

From 30acfc6d14bb42db822352426cc2d4e337717c72 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 24 Nov 2022 14:12:08 +0100
Subject: [PATCH 3044/3333] [neutron] Don't configure firewall_driver for core
 ML2 plugin

In the past firewall_driver setting was configured for ML2 plugin
because it was used in the
neutron.agent.securitygroups_rpc.is_firewall_enabled() function but
currently it's not needed anymore as there is other config option
"enable_security_group" for that.

Related-bug: #1996748
Change-Id: I9b09c6afb3f1f1c33d1bdfea52ba6f4c0d0cf2dc
---
 lib/neutron_plugins/ml2 | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index fa61f1ea30..46edacdc54 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -111,18 +111,7 @@ function neutron_plugin_configure_service {
             fi
         fi
     fi
-    # REVISIT(rkukura): Setting firewall_driver here for
-    # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
-    # used in the server, in case no L2 agent is configured on the
-    # server's node. If an L2 agent is configured, this will get
-    # overridden with the correct driver. The ml2 plugin should
-    # instead use its own config variable to indicate whether security
-    # groups is enabled, and that will need to be set here instead.
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.not.a.real.FirewallDriver
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group=$Q_USE_SECGROUP
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
     if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then

From 9a1be7794bd3b1b06a89183a800f42f77cd1b1b9 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 8 Dec 2022 20:24:46 -0600
Subject: [PATCH 3045/3333] Pin tox<4.0.0 for <=stable/zed branch testing

Tox 4.0.0 has some incompatible changes, epecially more
strict on allowlist_externals. Tempest recently changed
allowlist_externals not to be *[1] causing the failure
on jobs where lib/tempest failing to run the tempest
as command in virtual env.

----------
venv: commands[0]> tempest verify-config -uro /tmp/tmp.qH5KgJHTF4
venv: failed with tempest is not allowed, use allowlist_externals to allow it
------

We do not need to test/fix the <=stable/zed branches with tox 4.0.0
and pinning them with the compatible tox version of the time stable
brnaches were releaased is better way.

This commit proposes:
1. Pinning the tox<4.0.0 for <=stable/ze branches testing
2. Workaround to unblock the master gate by pinning it <4.0.0 but
we should make our testing compatible with tox 4.0.0 soon.

Depends-On: https://review.opendev.org/c/openstack/devstack/+/867066

Related-Bug: #1999183

[1] https://review.opendev.org/c/openstack/tempest/+/865314 devstack based job started failing to run tempest command on venv.

Change-Id: I9a138af94dedc0d8ce5a0d519d75779415d3c30b
---
 lib/tempest            | 7 ++++++-
 playbooks/tox/pre.yaml | 8 +++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index b232f24540..ec2949ac38 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -779,7 +779,12 @@ function configure_tempest {
 # install_tempest() - Collect source and prepare
 function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
-    pip_install 'tox!=2.8.0'
+    # NOTE(gmann): Pinning tox<4.0.0 for stable/zed and lower. Tox 4.0.0
+    # released after zed was released and has some incompatible changes
+    # and it is ok not to fix the issues caused by tox 4.0.0 in stable
+    # beanches jobs. We can continue testing the stable/zed and lower
+    # branches with tox<4.0.0
+    pip_install 'tox!=2.8.0,<4.0.0'
     pushd $TEMPEST_DIR
     # NOTE(gmann): checkout the TEMPEST_BRANCH in case TEMPEST_BRANCH
     # is tag name not master. git_clone would not checkout tag because
diff --git a/playbooks/tox/pre.yaml b/playbooks/tox/pre.yaml
index d7e4670a80..68d5254251 100644
--- a/playbooks/tox/pre.yaml
+++ b/playbooks/tox/pre.yaml
@@ -5,4 +5,10 @@
       bindep_profile: test
       bindep_dir: "{{ zuul_work_dir }}"
     - test-setup
-    - ensure-tox
+    # NOTE(gmann): Pinning tox<4.0.0 for stable/zed and lower. Tox 4.0.0
+    # released after zed was released and has some incompatible changes
+    # and it is ok not to fix the issues caused by tox 4.0.0 in stable
+    # beanches jobs. We can continue testing the stable/zed and lower
+    # branches with tox<4.0.0
+    - role: ensure-tox
+      ensure_tox_version: "<4"

From a52041cd3f067156e478e355f5712a60e12ce649 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 18 Nov 2022 11:39:56 +0100
Subject: [PATCH 3046/3333] Drop lib/neutron module

Module lib/neutron was introduced long time ago as new module to deploy
neutron. It was intended to replace old lib/neutron-legacy module. But
since very long time it wasn't really finished and used by anyone and
lib/neutron-legacy is defacto standard module used by everyone to deploy
neutron with devstack.
In [1] unfinished lib/neutron was deprecated and now it's time to remove
it from the devstack code.

This patch also renames old "lib/neutron-legacy" module to be
"lib/neutron" now.

Previously "old" lib/neutron-legacy module was accepting neutron
services names wit "q-" prefix and "new" lib/neutron module was accepting
services with "neutron-" prefix. Now, as there is only one module it
accepts both prefixes.
For historical reasons and to be consistent with old lib/neutron-legacy
which was widely used everywhere, services will be named with "q-"
prefix but both prefixes will be accepted to enable or disable services.

This patch also moves _configure_neutron_service function to be called
at the end of the "configure_neutron" after all agents and service
plugins are already configured.

[1] https://review.opendev.org/c/openstack/devstack/+/823653

Related-bug: #1996748

Change-Id: Ibf1c8b2ee6b6618f77cd8486e9c687993d7cb4a0
---
 clean.sh                                 |    1 -
 lib/neutron                              | 1438 ++++++++++++++--------
 lib/neutron-legacy                       | 1097 +----------------
 lib/neutron_plugins/README.md            |    2 +-
 lib/neutron_plugins/bigswitch_floodlight |    2 +-
 lib/neutron_plugins/brocade              |    2 +-
 lib/neutron_plugins/linuxbridge_agent    |    2 +-
 lib/neutron_plugins/ml2                  |    2 +-
 lib/neutron_plugins/openvswitch_agent    |    2 +-
 lib/neutron_plugins/ovn_agent            |   18 +-
 lib/neutron_plugins/services/l3          |    4 +-
 lib/neutron_plugins/services/metering    |    2 +-
 lib/neutron_plugins/services/qos         |    2 +-
 lib/tempest                              |    4 +-
 14 files changed, 933 insertions(+), 1645 deletions(-)

diff --git a/clean.sh b/clean.sh
index 870dfd4313..6a31cc624a 100755
--- a/clean.sh
+++ b/clean.sh
@@ -50,7 +50,6 @@ source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
 
 set -o xtrace
 
diff --git a/lib/neutron b/lib/neutron
index b3e3d72e8c..c8ee8c5e76 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1,128 +1,311 @@
 #!/bin/bash
 #
 # lib/neutron
-# Install and start **Neutron** network services
+# functions - functions specific to neutron
 
 # Dependencies:
-#
 # ``functions`` file
 # ``DEST`` must be defined
+# ``STACK_USER`` must be defined
 
 # ``stack.sh`` calls the entry points in this order:
 #
-# - is_XXXX_enabled
-# - install_XXXX
-# - configure_XXXX
-# - init_XXXX
-# - start_XXXX
-# - stop_XXXX
-# - cleanup_XXXX
+# - install_neutron_agent_packages
+# - install_neutronclient
+# - install_neutron
+# - install_neutron_third_party
+# - configure_neutron
+# - init_neutron
+# - configure_neutron_third_party
+# - init_neutron_third_party
+# - start_neutron_third_party
+# - create_nova_conf_neutron
+# - configure_neutron_after_post_config
+# - start_neutron_service_and_check
+# - check_neutron_third_party_integration
+# - start_neutron_agents
+# - create_neutron_initial_network
+#
+# ``unstack.sh`` calls the entry points in this order:
+#
+# - stop_neutron
+# - stop_neutron_third_party
+# - cleanup_neutron
 
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
+# Functions in lib/neutron are classified into the following categories:
+#
+# - entry points (called from stack.sh or unstack.sh)
+# - internal functions
+# - neutron exercises
+# - 3rd party programs
 
-# Defaults
+
+# Neutron Networking
+# ------------------
+
+# Make sure that neutron is enabled in ``ENABLED_SERVICES``.  If you want
+# to run Neutron on this host, make sure that q-svc is also in
+# ``ENABLED_SERVICES``.
+#
+# See "Neutron Network Configuration" below for additional variables
+# that must be set in localrc for connectivity across hosts with
+# Neutron.
+
+# Settings
 # --------
 
+
+# Neutron Network Configuration
+# -----------------------------
+
+if is_service_enabled tls-proxy; then
+    Q_PROTOCOL="https"
+fi
+
+
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
+
+NEUTRON_DIR=$DEST/neutron
+NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+
+# Support entry points installation of console scripts
+if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
+    NEUTRON_BIN_DIR=$NEUTRON_DIR/bin
+else
+    NEUTRON_BIN_DIR=$(get_python_exec_prefix)
+fi
+
+NEUTRON_CONF_DIR=/etc/neutron
+NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
+export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
+
 # NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
 # - False (default) : Run neutron under Eventlet
 # - True : Run neutron under uwsgi
 # TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
 # enough
 NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
-NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
-NEUTRON_DIR=$DEST/neutron
+
+NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
 # If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
 # and "enforce_new_defaults" to True in the Neutron's config to enforce usage
 # of the new RBAC policies and scopes.
 NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
 
-NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
-# Distributed Virtual Router (DVR) configuration
-# Can be:
-# - ``legacy``          - No DVR functionality
-# - ``dvr_snat``        - Controller or single node DVR
-# - ``dvr``             - Compute node in multi-node DVR
-# - ``dvr_no_external`` - Compute node in multi-node DVR, no external network
-#
-# Default is 'dvr_snat' since it can handle both DVR and legacy routers
-NEUTRON_DVR_MODE=${NEUTRON_DVR_MODE:-dvr_snat}
-
-NEUTRON_BIN_DIR=$(get_python_exec_prefix)
-NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
-
-NEUTRON_CONF_DIR=/etc/neutron
-NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
-NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
-NEUTRON_META_DATA_HOST=${NEUTRON_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
-
-NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
-NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
-NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
-NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
+# Agent binaries.  Note, binary paths for other agents are set in per-service
+# scripts in lib/neutron_plugins/services/
+AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
+AGENT_L3_BINARY=${AGENT_L3_BINARY:-"$NEUTRON_BIN_DIR/neutron-l3-agent"}
+AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
+
+# Agent config files. Note, plugin-specific Q_PLUGIN_CONF_FILE is set and
+# loaded from per-plugin  scripts in lib/neutron_plugins/
+Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
+# NOTE(slaweq): NEUTRON_DHCP_CONF is used e.g. in neutron repository,
+# it was previously defined in the lib/neutron module which is now deleted.
+NEUTRON_DHCP_CONF=$Q_DHCP_CONF_FILE
+Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
+# NOTE(slaweq): NEUTRON_L3_CONF is used e.g. in neutron repository,
+# it was previously defined in the lib/neutron module which is now deleted.
+NEUTRON_L3_CONF=$Q_L3_CONF_FILE
+Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
+
+# Default name for Neutron database
+Q_DB_NAME=${Q_DB_NAME:-neutron}
+# Default Neutron Plugin
+Q_PLUGIN=${Q_PLUGIN:-ml2}
+# Default Neutron Port
+Q_PORT=${Q_PORT:-9696}
+# Default Neutron Internal Port when using TLS proxy
+Q_PORT_INT=${Q_PORT_INT:-19696}
+# Default Neutron Host
+Q_HOST=${Q_HOST:-$SERVICE_HOST}
+# Default protocol
+Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
+# Default listen address
+Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
+# Default admin username
+Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
+# Default auth strategy
+Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
+# RHEL's support for namespaces requires using veths with ovs
+Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
+Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
+Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
+# Meta data IP
+Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
+# Allow Overlapping IP among subnets
+Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
+Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
+Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
+VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
+VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
+
+# Allow to skip stopping of OVN services
+SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
+
+# The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
+# /etc/neutron is assumed by many of devstack plugins.  Do not change.
+_Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
-NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
+# The name of the service in the endpoint URL
+NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
+if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+fi
 
-NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
+# List of config file names in addition to the main plugin config file
+# To add additional plugin config files, use ``neutron_server_config_add``
+# utility function.  For example:
+#
+#    ``neutron_server_config_add file1``
+#
+# These config files are relative to ``/etc/neutron``.  The above
+# example would specify ``--config-file /etc/neutron/file1`` for
+# neutron server.
+declare -a -g Q_PLUGIN_EXTRA_CONF_FILES
+
+# same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
+declare -a -g _Q_PLUGIN_EXTRA_CONF_FILES_ABS
+
+
+Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
+if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+    Q_RR_COMMAND="sudo"
+else
+    NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
+    Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+    fi
+fi
 
-# By default, use the ML2 plugin
-NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
-NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
-NEUTRON_CORE_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_CORE_PLUGIN
-NEUTRON_CORE_PLUGIN_CONF=$NEUTRON_CORE_PLUGIN_CONF_PATH/$NEUTRON_CORE_PLUGIN_CONF_FILENAME
 
-NEUTRON_METERING_AGENT_CONF_FILENAME=${NEUTRON_METERING_AGENT_CONF_FILENAME:-metering_agent.ini}
-NEUTRON_METERING_AGENT_CONF=$NEUTRON_CONF_DIR/$NEUTRON_METERING_AGENT_CONF_FILENAME
+# Distributed Virtual Router (DVR) configuration
+# Can be:
+# - ``legacy``   - No DVR functionality
+# - ``dvr_snat`` - Controller or single node DVR
+# - ``dvr``      - Compute node in multi-node DVR
+# - ``dvr_no_external`` - Compute node in multi-node DVR, no external network
+#
+Q_DVR_MODE=${Q_DVR_MODE:-legacy}
+if [[ "$Q_DVR_MODE" != "legacy" ]]; then
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,l2population
+fi
 
-NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
-NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
-NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
-NEUTRON_METERING_BINARY=${NEUTRON_METERING_BINARY:-neutron-metering-agent}
+# Provider Network Configurations
+# --------------------------------
+
+# The following variables control the Neutron ML2 plugins' allocation
+# of tenant networks and availability of provider networks. If these
+# are not configured in ``localrc``, tenant networks will be local to
+# the host (with no remote connectivity), and no physical resources
+# will be available for the allocation of provider networks.
+
+# To disable tunnels (GRE or VXLAN) for tenant networks,
+# set to False in ``local.conf``.
+# GRE tunnels are only supported by the openvswitch.
+ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
+
+# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
+# specify the range of IDs from which tenant networks are
+# allocated. Can be overridden in ``localrc`` if necessary.
+TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
+
+# To use VLANs for tenant networks, set to True in localrc. VLANs
+# are supported by the ML2 plugins, requiring additional configuration
+# described below.
+ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
+
+# If using VLANs for tenant networks, set in ``localrc`` to specify
+# the range of VLAN VIDs from which tenant networks are
+# allocated. An external network switch must be configured to
+# trunk these VLANs between hosts for multi-host connectivity.
+#
+# Example: ``TENANT_VLAN_RANGE=1000:1999``
+TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
+
+# If using VLANs for tenant networks, or if using flat or VLAN
+# provider networks, set in ``localrc`` to the name of the physical
+# network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
+# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
+# agent, as described below.
+#
+# Example: ``PHYSICAL_NETWORK=default``
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
+
+# With the openvswitch agent, if using VLANs for tenant networks,
+# or if using flat or VLAN provider networks, set in ``localrc`` to
+# the name of the OVS bridge to use for the physical network. The
+# bridge will be created if it does not already exist, but a
+# physical interface must be manually added to the bridge as a
+# port for external connectivity.
+#
+# Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-# Public facing bits
-if is_service_enabled tls-proxy; then
-    NEUTRON_SERVICE_PROTOCOL="https"
+# With the linuxbridge agent, if using VLANs for tenant networks,
+# or if using flat or VLAN provider networks, set in ``localrc`` to
+# the name of the network interface to use for the physical
+# network.
+#
+# Example: ``LB_PHYSICAL_INTERFACE=eth1``
+if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
+    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
+    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+    LB_PHYSICAL_INTERFACE=$default_route_dev
 fi
-NEUTRON_SERVICE_HOST=${NEUTRON_SERVICE_HOST:-$SERVICE_HOST}
-NEUTRON_SERVICE_PORT=${NEUTRON_SERVICE_PORT:-9696}
-NEUTRON_SERVICE_PORT_INT=${NEUTRON_SERVICE_PORT_INT:-19696}
-NEUTRON_SERVICE_PROTOCOL=${NEUTRON_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
-NEUTRON_AUTH_STRATEGY=${NEUTRON_AUTH_STRATEGY:-keystone}
-NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
-NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
-NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
+# With the openvswitch plugin, set to True in ``localrc`` to enable
+# provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
+#
+# Example: ``OVS_ENABLE_TUNNELING=True``
+OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
+
+# Use DHCP agent for providing metadata service in the case of
+# without L3 agent (No Route Agent), set to True in localrc.
+ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
+
+# Add a static route as dhcp option, so the request to 169.254.169.254
+# will be able to reach through a route(DHCP agent)
+# This option require ENABLE_ISOLATED_METADATA = True
+ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
+# Neutron plugin specific functions
+# ---------------------------------
+
+# Please refer to ``lib/neutron_plugins/README.md`` for details.
+if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
+    source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
+fi
 
-# This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
-# an external network bridge
-PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
-PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
+# Agent metering service plugin functions
+# -------------------------------------------
 
-# Network type - default vxlan, however enables vlan based jobs to override
-# using the legacy environment variable as well as a new variable in greater
-# alignment with the naming scheme of this plugin.
-NEUTRON_TENANT_NETWORK_TYPE=${NEUTRON_TENANT_NETWORK_TYPE:-vxlan}
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/metering
 
-NEUTRON_TENANT_VLAN_RANGE=${NEUTRON_TENANT_VLAN_RANGE:-${TENANT_VLAN_RANGE:-100:150}}
+# L3 Service functions
+source $TOP_DIR/lib/neutron_plugins/services/l3
 
-# Physical network for VLAN network usage.
-NEUTRON_PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-}
+# Additional Neutron service plugins
+source $TOP_DIR/lib/neutron_plugins/services/placement
+source $TOP_DIR/lib/neutron_plugins/services/trunk
+source $TOP_DIR/lib/neutron_plugins/services/qos
 
-# The name of the service in the endpoint URL
-NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+# Use security group or not
+if has_neutron_plugin_security_group; then
+    Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
+else
+    Q_USE_SECGROUP=False
 fi
 
+# Save trace setting
+_XTRACE_NEUTRON=$(set +o | grep xtrace)
+set +o xtrace
 
-# Additional neutron api config files
-declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
 # Functions
 # ---------
@@ -136,310 +319,194 @@ function is_neutron_enabled {
 }
 
 # Test if any Neutron services are enabled
-# is_neutron_enabled
+# TODO(slaweq): this is not really needed now and we should remove it as soon
+# as it will not be called from any other Devstack plugins, like e.g. Neutron
+# plugin
 function is_neutron_legacy_enabled {
-    # first we need to remove all "neutron-" from DISABLED_SERVICES list
-    disabled_services_copy=$(echo $DISABLED_SERVICES | sed 's/neutron-//g')
-    [[ ,${disabled_services_copy} =~ ,"neutron" ]] && return 1
-    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
-    return 1
+    return 0
 }
 
-if is_neutron_legacy_enabled; then
-    source $TOP_DIR/lib/neutron-legacy
-fi
-
-# cleanup_neutron() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
-    if is_neutron_ovs_base_plugin; then
-        neutron_ovs_base_cleanup
+function _determine_config_server {
+    if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" != '' ]]; then
+        if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" = "$_Q_PLUGIN_EXTRA_CONF_PATH" ]]; then
+            deprecated "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        else
+            die $LINENO "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        fi
     fi
-
-    if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
+    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 ]]; then
+        deprecated "Q_PLUGIN_EXTRA_CONF_FILES is deprecated.  Use neutron_server_config_add instead."
     fi
-    # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
-        sudo ip netns delete ${ns}
+    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+        _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($_Q_PLUGIN_EXTRA_CONF_PATH/$cfg_file)
     done
-}
 
-# configure_root_helper_options() - Configure agent rootwrap helper options
-function configure_root_helper_options {
-    local conffile=$1
-    iniset $conffile agent root_helper "sudo $NEUTRON_ROOTWRAP_CMD"
-    iniset $conffile agent root_helper_daemon "sudo $NEUTRON_ROOTWRAP_DAEMON_CMD"
+    local cfg_file
+    local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+    for cfg_file in ${_Q_PLUGIN_EXTRA_CONF_FILES_ABS[@]}; do
+        opts+=" --config-file $cfg_file"
+    done
+    echo "$opts"
 }
 
-# configure_neutron() - Set config files, create data dirs, etc
-function configure_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
-
-    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
-
-    configure_neutron_rootwrap
-
-    mkdir -p $NEUTRON_CORE_PLUGIN_CONF_PATH
+function _determine_config_l3 {
+    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
+    echo "$opts"
+}
 
-    # NOTE(yamamoto): A decomposed plugin should prepare the config file in
-    # its devstack plugin.
-    if [ -f $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample ]; then
-        cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
+# For services and agents that require it, dynamically construct a list of
+# --config-file arguments that are passed to the binary.
+function determine_config_files {
+    local opts=""
+    case "$1" in
+        "neutron-server") opts="$(_determine_config_server)" ;;
+        "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
+    esac
+    if [ -z "$opts" ] ; then
+        die $LINENO "Could not determine config files for $1."
     fi
+    echo "$opts"
+}
 
-    iniset $NEUTRON_CONF database connection `database_connection_url neutron`
-    iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH
-    iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
-    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
-
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-
+# configure_neutron()
+# Set common config for all neutron server and agents.
+function configure_neutron {
+    _configure_neutron_common
     iniset_rpc_backend neutron $NEUTRON_CONF
 
-    # Neutron API server & Neutron plugin
-    if is_service_enabled neutron-api; then
-        local policy_file=$NEUTRON_CONF_DIR/policy.json
-        # Allow neutron user to administer neutron to match neutron account
-        # NOTE(amotoki): This is required for nova works correctly with neutron.
-        if [ -f $NEUTRON_DIR/etc/policy.json ]; then
-            cp $NEUTRON_DIR/etc/policy.json $policy_file
-            sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
-        else
-            echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $policy_file
-        fi
-
-        cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
-
-        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_CORE_PLUGIN
-
-        iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
-        iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
-
-        iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_keystone_authtoken_middleware $NEUTRON_CONF neutron
-        configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
-
-        # Configure tenant network type
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types $NEUTRON_TENANT_NETWORK_TYPE
-
-        local mech_drivers="openvswitch"
-        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
-            mech_drivers+=",l2population"
-        else
-            mech_drivers+=",linuxbridge"
-        fi
-        if [[ "$mech_drivers" == *"linuxbridge"* ]]; then
-            iniset $NEUTRON_CONF experimental linuxbridge True
-        fi
-
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 overlay_ip_version $TUNNEL_IP_VERSION
-
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks $PUBLIC_NETWORK_NAME
-        if [[ "$NEUTRON_TENANT_NETWORK_TYPE" =~ "vlan" ]] && [[ "$NEUTRON_PHYSICAL_NETWORK" != "" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vlan network_vlan_ranges ${NEUTRON_PHYSICAL_NETWORK}:${NEUTRON_TENANT_VLAN_RANGE}
-        fi
-        if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
-            neutron_ml2_extension_driver_add port_security
-        fi
-        configure_rbac_policies
-    fi
-
-    # Neutron OVS or LB agent
-    if is_service_enabled neutron-agent; then
-        iniset $NEUTRON_CORE_PLUGIN_CONF agent tunnel_types vxlan
-        iniset $NEUTRON_CORE_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        configure_root_helper_options $NEUTRON_CORE_PLUGIN_CONF
-
-        # Configure the neutron agent
-        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
-            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $TUNNEL_ENDPOINT_IP
-        elif [[ $NEUTRON_AGENT == "openvswitch" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver openvswitch
-            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $TUNNEL_ENDPOINT_IP
-
-            if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
-                iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
-                iniset $NEUTRON_CORE_PLUGIN_CONF agent enable_distributed_routing True
-                iniset $NEUTRON_CORE_PLUGIN_CONF agent arp_responder True
-            fi
-        fi
-
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
+    if is_service_enabled q-metering neutron-metering; then
+        _configure_neutron_metering
     fi
-
-    # DHCP Agent
-    if is_service_enabled neutron-dhcp; then
-        cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
-
-        iniset $NEUTRON_DHCP_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        # make it so we have working DNS from guests
-        iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
-
-        configure_root_helper_options $NEUTRON_DHCP_CONF
-        iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
-        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
+    if is_service_enabled q-agt neutron-agent; then
+        _configure_neutron_plugin_agent
+    fi
+    if is_service_enabled q-dhcp neutron-dhcp; then
+        _configure_neutron_dhcp_agent
+    fi
+    if is_service_enabled q-l3 neutron-l3; then
+        _configure_neutron_l3_agent
+    fi
+    if is_service_enabled q-meta neutron-metadata-agent; then
+        _configure_neutron_metadata_agent
     fi
 
-    if is_service_enabled neutron-l3; then
-        cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
-        iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
-        neutron_service_plugin_class_add router
-        configure_root_helper_options $NEUTRON_L3_CONF
-        iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
+    if [[ "$Q_DVR_MODE" != "legacy" ]]; then
+        _configure_dvr
+    fi
+    if is_service_enabled ceilometer; then
+        _configure_neutron_ceilometer_notifications
+    fi
 
-        # Configure the neutron agent to serve external network ports
-        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF linux_bridge bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
-        else
-            iniset $NEUTRON_CORE_PLUGIN_CONF ovs bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
-        fi
+    if [[ $Q_AGENT == "ovn" ]]; then
+        configure_ovn
+        configure_ovn_plugin
+    fi
 
-        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
-            iniset $NEUTRON_L3_CONF DEFAULT agent_mode $NEUTRON_DVR_MODE
+    # Configure Neutron's advanced services
+    if is_service_enabled q-placement neutron-placement; then
+        configure_placement_extension
+    fi
+    if is_service_enabled q-trunk neutron-trunk; then
+        configure_trunk_extension
+    fi
+    if is_service_enabled q-qos neutron-qos; then
+        configure_qos
+        if is_service_enabled q-l3 neutron-l3; then
+            configure_l3_agent_extension_fip_qos
+            configure_l3_agent_extension_gateway_ip_qos
         fi
     fi
 
-    # Metadata
-    if is_service_enabled neutron-metadata-agent; then
-        cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
-
-        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $NEUTRON_META_DATA_HOST
-        iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
-        # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
-        configure_root_helper_options $NEUTRON_META_CONF
-
-        # TODO(dtroyer): remove the v2.0 hard code below
-        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_keystone_authtoken_middleware $NEUTRON_META_CONF neutron DEFAULT
+    # Finally configure Neutron server and core plugin
+    if is_service_enabled q-agt neutron-agent q-svc neutron-api; then
+        _configure_neutron_service
     fi
 
-    # Format logging
-    setup_logging $NEUTRON_CONF
+    iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
+    # devstack is not a tool for running uber scale OpenStack
+    # clouds, therefore running without a dedicated RPC worker
+    # for state reports is more than adequate.
+    iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
-    # Metering
-    if is_service_enabled neutron-metering; then
-        cp $NEUTRON_DIR/etc/metering_agent.ini.sample $NEUTRON_METERING_AGENT_CONF
-        neutron_service_plugin_class_add metering
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
     fi
 }
 
-# configure_neutron_rootwrap() - configure Neutron's rootwrap
-function configure_neutron_rootwrap {
-    # Deploy new rootwrap filters files (owned by root).
-    # Wipe any existing rootwrap.d files first
-    if [[ -d $NEUTRON_CONF_DIR/rootwrap.d ]]; then
-        sudo rm -rf $NEUTRON_CONF_DIR/rootwrap.d
+function configure_neutron_nova {
+    create_nova_conf_neutron $NOVA_CONF
+    if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            conf=$(conductor_conf $i)
+            create_nova_conf_neutron $conf
+        done
     fi
+}
 
-    # Deploy filters to /etc/neutron/rootwrap.d
-    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
-    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
-
-    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
-    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $NEUTRON_CONF_DIR
-    sudo sed -e "s:^filters_path=.*$:filters_path=$NEUTRON_CONF_DIR/rootwrap.d:" -i $NEUTRON_CONF_DIR/rootwrap.conf
-
-    # Set up the rootwrap sudoers for Neutron
-    tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_CMD *" >$tempfile
-    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_DAEMON_CMD" >>$tempfile
-    chmod 0440 $tempfile
-    sudo chown root:root $tempfile
-    sudo mv $tempfile /etc/sudoers.d/neutron-rootwrap
-}
-
-# Make Neutron-required changes to nova.conf
-# Takes a single optional argument which is the config file to update,
-# if not passed $NOVA_CONF is used.
-function configure_neutron_nova_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
+function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username neutron
+    iniset $conf neutron username "$Q_ADMIN_USERNAME"
     iniset $conf neutron password "$SERVICE_PASSWORD"
-    iniset $conf neutron user_domain_name "Default"
-    iniset $conf neutron project_name "$SERVICE_TENANT_NAME"
-    iniset $conf neutron project_domain_name "Default"
-    iniset $conf neutron auth_strategy $NEUTRON_AUTH_STRATEGY
+    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
+    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $conf neutron region_name "$REGION_NAME"
 
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf $conf
 
-    if is_service_enabled neutron-metadata-agent; then
+    if is_service_enabled q-meta neutron-metadata-agent; then
         iniset $conf neutron service_metadata_proxy "True"
     fi
 
+    iniset $conf DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
+    iniset $conf DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
 }
 
+# create_neutron_accounts() - Set up common required neutron accounts
+
 # Tenant               User       Roles
 # ------------------------------------------------------------------
 # service              neutron    admin        # if enabled
 
-# create_neutron_accounts() - Create required service accounts
-function create_neutron_accounts_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
+# Migrated from keystone_data.sh
+function create_neutron_accounts {
     local neutron_url
-
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     else
-        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
     fi
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
 
-
-    if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
+    if is_service_enabled q-svc neutron-api; then
 
         create_service_user "neutron"
 
-        neutron_service=$(get_or_create_service "neutron" \
-            "network" "Neutron Service")
-        get_or_create_endpoint $neutron_service \
+        get_or_create_service "neutron" "network" "Neutron Service"
+        get_or_create_endpoint \
+            "network" \
             "$REGION_NAME" "$neutron_url"
     fi
 }
 
 # init_neutron() - Initialize databases, etc.
-function init_neutron_new {
-
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    recreate_database neutron
-
+function init_neutron {
+    recreate_database $Q_DB_NAME
     time_start "dbsync"
     # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
+    $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
     time_stop "dbsync"
 }
 
 # install_neutron() - Collect source and prepare
-function install_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
-    setup_develop $NEUTRON_DIR
-
+function install_neutron {
     # Install neutron-lib from git so we make sure we're testing
     # the latest code.
     if use_library_from_git "neutron-lib"; then
@@ -447,17 +514,12 @@ function install_neutron_new {
         setup_dev_lib "neutron-lib"
     fi
 
-    # L3 service requires radvd
-    if is_service_enabled neutron-l3; then
-        install_package radvd
-    fi
+    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
+    setup_develop $NEUTRON_DIR
 
-    if is_service_enabled neutron-agent neutron-dhcp neutron-l3; then
-        #TODO(sc68cal) - kind of ugly
-        source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
-        neutron_plugin_install_agent_packages
+    if [[ $Q_AGENT == "ovn" ]]; then
+        install_ovn
     fi
-
 }
 
 # install_neutronclient() - Collect source and prepare
@@ -469,152 +531,256 @@ function install_neutronclient {
     fi
 }
 
-# start_neutron_api() - Start the API process ahead of other things
-function start_neutron_api {
-    local service_port=$NEUTRON_SERVICE_PORT
-    local service_protocol=$NEUTRON_SERVICE_PROTOCOL
+# install_neutron_agent_packages() - Collect source and prepare
+function install_neutron_agent_packages {
+    # radvd doesn't come with the OS. Install it if the l3 service is enabled.
+    if is_service_enabled q-l3 neutron-l3; then
+        install_package radvd
+    fi
+    # install packages that are specific to plugin agent(s)
+    if is_service_enabled q-agt neutron-agent q-dhcp neutron-dhcp q-l3 neutron-l3; then
+        neutron_plugin_install_agent_packages
+    fi
+}
+
+# Finish neutron configuration
+function configure_neutron_after_post_config {
+    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
+        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
+    fi
+    configure_rbac_policies
+}
+
+# configure_rbac_policies() - Configure Neutron to enforce new RBAC
+# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
+function configure_rbac_policies {
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == True ]]; then
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
+        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+    else
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
+        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+    fi
+}
+
+# Start running OVN processes
+function start_ovn_services {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        init_ovn
+        start_ovn
+        if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
+            if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
+                echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "
+                echo "because NEUTRON_CREATE_INITIAL_NETWORKS is set to False"
+            else
+                create_public_bridge
+            fi
+        fi
+    fi
+}
+
+# Start running processes
+function start_neutron_service_and_check {
+    local service_port=$Q_PORT
+    local service_protocol=$Q_PROTOCOL
+    local cfg_file_options
     local neutron_url
+
+    cfg_file_options="$(determine_config_files neutron-server)"
+
     if is_service_enabled tls-proxy; then
-        service_port=$NEUTRON_SERVICE_PORT_INT
+        service_port=$Q_PORT_INT
         service_protocol="http"
     fi
-
-    local opts=""
-    opts+=" --config-file $NEUTRON_CONF"
-    opts+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
-    local cfg_file
-    for cfg_file in ${_NEUTRON_SERVER_EXTRA_CONF_FILES_ABS[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-
+    # Start the Neutron service
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/
+        neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
     else
-        # Start the Neutron service
-        # TODO(sc68cal) Stop hard coding this
-        run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port/
+        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+        neutron_url=$service_protocol://$Q_HOST:$service_port/
         # Start proxy if enabled
         if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
+            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
         fi
     fi
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
+    echo "Waiting for Neutron to start..."
 
-    if ! wait_for_service $SERVICE_TIMEOUT $neutron_url; then
-        die $LINENO "neutron-api did not start"
-    fi
+    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
+    test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
 }
 
-# start_neutron() - Start running processes
-function start_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    # Start up the neutron agents if enabled
-    # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
-    # can resolve the $NEUTRON_AGENT_BINARY
-    if is_service_enabled neutron-agent; then
-        # TODO(ihrachys) stop loading ml2_conf.ini into agents, instead load agent specific files
-        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
-    fi
-    if is_service_enabled neutron-dhcp; then
-        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
-        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_DHCP_CONF"
-    fi
-    if is_service_enabled neutron-l3; then
-        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_L3_CONF"
-    fi
-    if is_service_enabled neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
-        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
-        # of the code in lib/neutron_plugins/services/l3
-        if type -p neutron_plugin_create_initial_networks > /dev/null; then
-            neutron_plugin_create_initial_networks
-        else
-            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
-            source $TOP_DIR/lib/neutron_plugins/services/l3
-            # Create the networks using servic
-            create_neutron_initial_network
+function start_neutron {
+    start_l2_agent "$@"
+    start_other_agents "$@"
+}
+
+# Control of the l2 agent is separated out to make it easier to test partial
+# upgrades (everything upgraded except the L2 agent)
+function start_l2_agent {
+    run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+
+    if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
+        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
+        sudo ip link set $OVS_PHYSICAL_BRIDGE up
+        sudo ip link set br-int up
+        sudo ip link set $PUBLIC_INTERFACE up
+        if is_ironic_hardware; then
+            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $PUBLIC_INTERFACE
+                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
+            done
+            sudo ip route replace $FIXED_RANGE via $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
         fi
     fi
-    if is_service_enabled neutron-metadata-agent; then
-        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_META_CONF"
-    fi
+}
 
-    if is_service_enabled neutron-metering; then
-        run_process neutron-metering "$NEUTRON_BIN_DIR/$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
-    fi
+function start_other_agents {
+    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
+
+    run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
+
+    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
+    run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 }
 
-# stop_neutron() - Stop running processes
-function stop_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    for serv in neutron-api neutron-agent neutron-l3; do
-        stop_process $serv
-    done
+# Start running processes, including screen
+function start_neutron_agents {
+    # NOTE(slaweq): it's now just a wrapper for start_neutron function
+    start_neutron "$@"
+}
 
-    if is_service_enabled neutron-rpc-server; then
-        stop_process neutron-rpc-server
-    fi
+function stop_l2_agent {
+    stop_process q-agt
+}
 
-    if is_service_enabled neutron-dhcp; then
-        stop_process neutron-dhcp
+# stop_other() - Stop running processes
+function stop_other {
+    if is_service_enabled q-dhcp neutron-dhcp; then
+        stop_process q-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if is_service_enabled neutron-metadata-agent; then
-        stop_process neutron-metadata-agent
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        stop_process neutron-rpc-server
+        stop_process neutron-api
+    else
+        stop_process q-svc
     fi
-}
 
-# neutron_service_plugin_class_add() - add service plugin class
-function neutron_service_plugin_class_add_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    local service_plugin_class=$1
-    local plugins=""
+    if is_service_enabled q-l3 neutron-l3; then
+        sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
+        stop_process q-l3
+    fi
 
-    plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
-    if [ $plugins ]; then
-        plugins+=","
+    if is_service_enabled q-meta neutron-metadata-agent; then
+        stop_process q-meta
+    fi
+
+    if is_service_enabled q-metering neutron-metering; then
+        neutron_metering_stop
+    fi
+
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
     fi
-    plugins+="${service_plugin_class}"
-    iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 
-function _neutron_ml2_extension_driver_add {
-    local driver=$1
-    local drivers=""
+# stop_neutron() - Stop running processes (non-screen)
+function stop_neutron {
+    stop_other
+    stop_l2_agent
 
-    drivers=$(iniget $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers)
-    if [ $drivers ]; then
-        drivers+=","
+    if [[ $Q_AGENT == "ovn" && $SKIP_STOP_OVN != "True" ]]; then
+        stop_ovn
     fi
-    drivers+="${driver}"
-    iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers $drivers
 }
 
-function neutron_server_config_add_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
+# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
+# on startup, or back to the public interface on cleanup. If no IP is
+# configured on the interface, just add it as a port to the OVS bridge.
+function _move_neutron_addresses_route {
+    local from_intf=$1
+    local to_intf=$2
+    local add_ovs_port=$3
+    local del_ovs_port=$4
+    local af=$5
+
+    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
+        # Remove the primary IP address from $from_intf and add it to $to_intf,
+        # along with the default route, if it exists.  Also, when called
+        # on configure we will also add $from_intf as a port on $to_intf,
+        # assuming it is an OVS bridge.
+
+        local IP_REPLACE=""
+        local IP_DEL=""
+        local IP_UP=""
+        local DEFAULT_ROUTE_GW
+        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf\s/ { print \$3; exit }")
+        local ADD_OVS_PORT=""
+        local DEL_OVS_PORT=""
+        local ARP_CMD=""
+
+        IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
+
+        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
+            ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
+        fi
+
+        if [[ "$add_ovs_port" == "True" ]]; then
+            ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
+        fi
+
+        if [[ "$del_ovs_port" == "True" ]]; then
+            DEL_OVS_PORT="sudo ovs-vsctl --if-exists del-port $from_intf $to_intf"
+        fi
+
+        if [[ "$IP_BRD" != "" ]]; then
+            IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
+            IP_REPLACE="sudo ip addr replace $IP_BRD dev $to_intf"
+            IP_UP="sudo ip link set $to_intf up"
+            if [[ "$af" == "inet" ]]; then
+                IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
+                ARP_CMD="sudo arping -A -c 3 -w 5 -I $to_intf $IP "
+            fi
+        fi
+
+        # The add/del OVS port calls have to happen either before or
+        # after the address is moved in order to not leave it orphaned.
+        $DEL_OVS_PORT; $IP_DEL; $IP_REPLACE; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
+    fi
 }
 
-# neutron_deploy_rootwrap_filters() - deploy rootwrap filters
-function neutron_deploy_rootwrap_filters_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    local srcdir=$1
-    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
-    sudo install -o root -g root -m 644 $srcdir/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
+# _configure_public_network_connectivity() - Configures connectivity to the
+# external network using $PUBLIC_INTERFACE or NAT on the single interface
+# machines
+function _configure_public_network_connectivity {
+    # If we've given a PUBLIC_INTERFACE to take over, then we assume
+    # that we can own the whole thing, and privot it into the OVS
+    # bridge. If we are not, we're probably on a single interface
+    # machine, and we just setup NAT so that fixed guests can get out.
+    if [[ -n "$PUBLIC_INTERFACE" ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
+
+        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+        fi
+    else
+        for d in $default_v4_route_devs; do
+            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
+        done
+    fi
 }
 
-# Dispatch functions
-# These are needed for compatibility between the old and new implementations
-# where there are function name overlaps.  These will be removed when
-# neutron-legacy is removed.
-# TODO(sc68cal) Remove when neutron-legacy is no more.
+# cleanup_neutron() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
 function cleanup_neutron {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-api
@@ -623,153 +789,367 @@ function cleanup_neutron {
         sudo rm -f $(apache_site_config_for neutron-api)
     fi
 
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        cleanup_mutnauq "$@"
-    else
-        cleanup_neutron_new "$@"
+    if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
+
+        if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+            # ip(8) wants the prefix length when deleting
+            local v6_gateway
+            v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
+            sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
+            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False False "inet6"
+        fi
+
+        if is_provider_network && is_ironic_hardware; then
+            for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
+                sudo ip addr add $IP dev $PUBLIC_INTERFACE
+            done
+            sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+        fi
     fi
-}
 
-function configure_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        configure_mutnauq "$@"
-    else
-        configure_neutron_new "$@"
+    if is_neutron_ovs_base_plugin; then
+        neutron_ovs_base_cleanup
     fi
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
+    if [[ $Q_AGENT == "linuxbridge" ]]; then
+        neutron_lb_cleanup
+    fi
+
+    # delete all namespaces created by neutron
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
+        sudo ip netns delete ${ns}
+    done
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        cleanup_ovn
     fi
 }
 
-# configure_rbac_policies() - Configure Neutron to enforce new RBAC
-# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
-function configure_rbac_policies {
-    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
-        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+
+function _create_neutron_conf_dir {
+    # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
+    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+}
+
+# _configure_neutron_common()
+# Set common config for all neutron server and agents.
+# This MUST be called before other ``_configure_neutron_*`` functions.
+function _configure_neutron_common {
+    _create_neutron_conf_dir
+
+    # Uses oslo config generator to generate core sample configuration files
+    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
+
+    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
+
+    # allow neutron user to administer neutron to match neutron account
+    # NOTE(amotoki): This is required for nova works correctly with neutron.
+    if [ -f $NEUTRON_DIR/etc/policy.json ]; then
+        cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
+        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
     else
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
-        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+        echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $Q_POLICY_FILE
+    fi
+
+    # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
+    # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
+    neutron_plugin_configure_common
+
+    if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
+        die $LINENO "Neutron plugin not set.. exiting"
+    fi
+
+    # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
+    mkdir -p /$Q_PLUGIN_CONF_PATH
+    Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
+    # NOTE(slaweq): NEUTRON_CORE_PLUGIN_CONF is used e.g. in neutron repository,
+    # it was previously defined in the lib/neutron module which is now deleted.
+    NEUTRON_CORE_PLUGIN_CONF=$Q_PLUGIN_CONF_FILE
+    # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
+    # there is no config file in Neutron tree. They should prepare the file in each plugin.
+    if [ -f "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" ]; then
+        cp "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" /$Q_PLUGIN_CONF_FILE
+    elif [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
+        cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
+    fi
+
+    iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
+    iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
+    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
+    iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
+    iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
+
+    # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
+    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
+    if [ "$VIRT_DRIVER" = 'fake' ]; then
+        # Disable arbitrary limits
+        iniset $NEUTRON_CONF quotas quota_network -1
+        iniset $NEUTRON_CONF quotas quota_subnet -1
+        iniset $NEUTRON_CONF quotas quota_port -1
+        iniset $NEUTRON_CONF quotas quota_security_group -1
+        iniset $NEUTRON_CONF quotas quota_security_group_rule -1
+    fi
+
+    # Format logging
+    setup_logging $NEUTRON_CONF
+
+    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
+        # Set the service port for a proxy to take the original
+        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
+        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
+
+    _neutron_setup_rootwrap
 }
 
+function _configure_neutron_dhcp_agent {
 
-function configure_neutron_nova {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        create_nova_conf_neutron $NOVA_CONF
-        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
-            for i in $(seq 1 $NOVA_NUM_CELLS); do
-                local conf
-                conf=$(conductor_conf $i)
-                create_nova_conf_neutron $conf
-            done
-        fi
-    else
-        configure_neutron_nova_new $NOVA_CONF
-        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
-            for i in $(seq 1 $NOVA_NUM_CELLS); do
-                local conf
-                conf=$(conductor_conf $i)
-                configure_neutron_nova_new $conf
-            done
+    cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
+
+    iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    # make it so we have working DNS from guests
+    iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_local_resolv True
+    configure_root_helper_options $Q_DHCP_CONF_FILE
+
+    if ! is_service_enabled q-l3 neutron-l3; then
+        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
+        else
+            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
+                die "$LINENO" "Enable isolated metadata is a must for metadata network"
+            fi
         fi
     fi
+
+    _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
+
+    neutron_plugin_configure_dhcp_agent $Q_DHCP_CONF_FILE
 }
 
-function create_neutron_accounts {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        create_mutnauq_accounts "$@"
-    else
-        create_neutron_accounts_new "$@"
-    fi
+
+function _configure_neutron_metadata_agent {
+    cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
+
+    iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_host $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
+    configure_root_helper_options $Q_META_CONF_FILE
 }
 
-function init_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        init_mutnauq "$@"
-    else
-        init_neutron_new "$@"
-    fi
+function _configure_neutron_ceilometer_notifications {
+    iniset $NEUTRON_CONF oslo_messaging_notifications driver messagingv2
 }
 
-function install_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        install_mutnauq "$@"
-    else
-        install_neutron_new "$@"
+function _configure_neutron_metering {
+    neutron_agent_metering_configure_common
+    neutron_agent_metering_configure_agent
+}
+
+function _configure_dvr {
+    iniset $NEUTRON_CONF DEFAULT router_distributed True
+    iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
+}
+
+
+# _configure_neutron_plugin_agent() - Set config files for neutron plugin agent
+# It is called when q-agt is enabled.
+function _configure_neutron_plugin_agent {
+    # Specify the default root helper prior to agent configuration to
+    # ensure that an agent's configuration can override the default
+    configure_root_helper_options /$Q_PLUGIN_CONF_FILE
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+
+    # Configure agent for plugin
+    neutron_plugin_configure_plugin_agent
+}
+
+function _replace_api_paste_composite {
+    local sep
+    sep=$(echo -ne "\x01")
+    # Replace it
+    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
+}
+
+# _configure_neutron_service() - Set config files for neutron service
+# It is called when q-svc is enabled.
+function _configure_neutron_service {
+    Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
+    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+
+    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+        _replace_api_paste_composite
     fi
+
+    # Update either configuration file with plugin
+    iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
+
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
+
+    iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
+    configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME
+
+    # Configuration for neutron notifications to nova.
+    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
+    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
+
+    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
+
+    # Configuration for placement client
+    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
+
+    # Configure plugin
+    neutron_plugin_configure_service
 }
 
+# Utility Functions
+#------------------
+
+# neutron_service_plugin_class_add() - add service plugin class
 function neutron_service_plugin_class_add {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        _neutron_service_plugin_class_add "$@"
-    else
-        neutron_service_plugin_class_add_new "$@"
+    local service_plugin_class=$1
+    if [[ $Q_SERVICE_PLUGIN_CLASSES == '' ]]; then
+        Q_SERVICE_PLUGIN_CLASSES=$service_plugin_class
+    elif [[ ! ,${Q_SERVICE_PLUGIN_CLASSES}, =~ ,${service_plugin_class}, ]]; then
+        Q_SERVICE_PLUGIN_CLASSES="$Q_SERVICE_PLUGIN_CLASSES,$service_plugin_class"
     fi
 }
 
+# neutron_ml2_extension_driver_add() - add ML2 extension driver
 function neutron_ml2_extension_driver_add {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        _neutron_ml2_extension_driver_add_old "$@"
-    else
-        _neutron_ml2_extension_driver_add "$@"
+    local extension=$1
+    if [[ $Q_ML2_PLUGIN_EXT_DRIVERS == '' ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS=$extension
+    elif [[ ! ,${Q_ML2_PLUGIN_EXT_DRIVERS}, =~ ,${extension}, ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS="$Q_ML2_PLUGIN_EXT_DRIVERS,$extension"
     fi
 }
 
-function install_neutron_agent_packages {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        install_neutron_agent_packages_mutnauq "$@"
-    else
-        :
-    fi
+# neutron_server_config_add() - add server config file
+function neutron_server_config_add {
+    _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)
 }
 
-function neutron_server_config_add {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        mutnauq_server_config_add "$@"
-    else
-        neutron_server_config_add_new "$@"
+# neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
+function neutron_deploy_rootwrap_filters {
+    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+        return
     fi
+    local srcdir=$1
+    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
+    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
 }
 
-function start_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        start_mutnauq_l2_agent "$@"
-        start_mutnauq_other_agents "$@"
+# _neutron_setup_rootwrap() - configure Neutron's rootwrap
+function _neutron_setup_rootwrap {
+    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+        return
+    fi
+    # Wipe any existing ``rootwrap.d`` files first
+    Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
+    if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
+        sudo rm -rf $Q_CONF_ROOTWRAP_D
+    fi
+
+    neutron_deploy_rootwrap_filters $NEUTRON_DIR
+
+    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
+    # location moved in newer versions, prefer new location
+    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     else
-        start_neutron_new "$@"
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
+    sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
+    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
+
+    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
+    ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
+    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+
+    # Set up the rootwrap sudoers for neutron
+    TEMPFILE=`mktemp`
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
+    chmod 0440 $TEMPFILE
+    sudo chown root:root $TEMPFILE
+    sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
+
+    # Update the root_helper
+    configure_root_helper_options $NEUTRON_CONF
 }
 
-function stop_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        stop_mutnauq "$@"
-    else
-        stop_neutron_new "$@"
+function configure_root_helper_options {
+    local conffile=$1
+    iniset $conffile agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $conffile agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 }
 
-function neutron_deploy_rootwrap_filters {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        _neutron_deploy_rootwrap_filters "$@"
-    else
-        neutron_deploy_rootwrap_filters_new "$@"
+function _neutron_setup_interface_driver {
+
+    # ovs_use_veth needs to be set before the plugin configuration
+    # occurs to allow plugins to override the setting.
+    iniset $1 DEFAULT ovs_use_veth $Q_OVS_USE_VETH
+
+    neutron_plugin_setup_interface_driver $1
+}
+# Functions for Neutron Exercises
+#--------------------------------
+
+function delete_probe {
+    local from_net="$1"
+    net_id=`_get_net_id $from_net`
+    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
+    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
+}
+
+function _get_net_id {
+    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
+}
+
+function _get_probe_cmd_prefix {
+    local from_net="$1"
+    net_id=`_get_net_id $from_net`
+    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
+    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
+}
+
+# ssh check
+function _ssh_check_neutron {
+    local from_net=$1
+    local key_file=$2
+    local ip=$3
+    local user=$4
+    local timeout_sec=$5
+    local probe_cmd = ""
+    probe_cmd=`_get_probe_cmd_prefix $from_net`
+    local testcmd="$probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success"
+    test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
+}
+
+function plugin_agent_add_l2_agent_extension {
+    local l2_agent_extension=$1
+    if [[ -z "$L2_AGENT_EXTENSIONS" ]]; then
+        L2_AGENT_EXTENSIONS=$l2_agent_extension
+    elif [[ ! ,${L2_AGENT_EXTENSIONS}, =~ ,${l2_agent_extension}, ]]; then
+        L2_AGENT_EXTENSIONS+=",$l2_agent_extension"
     fi
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_NEUTRON
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index baf67f209e..e90400fec1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1,1097 +1,6 @@
 #!/bin/bash
-#
-# lib/neutron
-# functions - functions specific to neutron
 
-# Dependencies:
-# ``functions`` file
-# ``DEST`` must be defined
-# ``STACK_USER`` must be defined
+# TODO(slaweq): remove that file when other projects, like e.g. Grenade will
+# be using lib/neutron
 
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_neutron_agent_packages
-# - install_neutronclient
-# - install_neutron
-# - install_neutron_third_party
-# - configure_neutron
-# - init_neutron
-# - configure_neutron_third_party
-# - init_neutron_third_party
-# - start_neutron_third_party
-# - create_nova_conf_neutron
-# - configure_neutron_after_post_config
-# - start_neutron_service_and_check
-# - check_neutron_third_party_integration
-# - start_neutron_agents
-# - create_neutron_initial_network
-#
-# ``unstack.sh`` calls the entry points in this order:
-#
-# - stop_neutron
-# - stop_neutron_third_party
-# - cleanup_neutron
-
-# Functions in lib/neutron are classified into the following categories:
-#
-# - entry points (called from stack.sh or unstack.sh)
-# - internal functions
-# - neutron exercises
-# - 3rd party programs
-
-
-# Neutron Networking
-# ------------------
-
-# Make sure that neutron is enabled in ``ENABLED_SERVICES``.  If you want
-# to run Neutron on this host, make sure that q-svc is also in
-# ``ENABLED_SERVICES``.
-#
-# See "Neutron Network Configuration" below for additional variables
-# that must be set in localrc for connectivity across hosts with
-# Neutron.
-
-# Settings
-# --------
-
-
-# Neutron Network Configuration
-# -----------------------------
-
-if is_service_enabled tls-proxy; then
-    Q_PROTOCOL="https"
-fi
-
-
-# Set up default directories
-GITDIR["python-neutronclient"]=$DEST/python-neutronclient
-
-
-NEUTRON_DIR=$DEST/neutron
-NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-
-# Support entry points installation of console scripts
-if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
-    NEUTRON_BIN_DIR=$NEUTRON_DIR/bin
-else
-    NEUTRON_BIN_DIR=$(get_python_exec_prefix)
-fi
-
-NEUTRON_CONF_DIR=/etc/neutron
-NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
-export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
-
-# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False (default) : Run neutron under Eventlet
-# - True : Run neutron under uwsgi
-# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
-# enough
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
-
-NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
-
-# If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
-# and "enforce_new_defaults" to True in the Neutron's config to enforce usage
-# of the new RBAC policies and scopes.
-NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
-
-# Agent binaries.  Note, binary paths for other agents are set in per-service
-# scripts in lib/neutron_plugins/services/
-AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
-AGENT_L3_BINARY=${AGENT_L3_BINARY:-"$NEUTRON_BIN_DIR/neutron-l3-agent"}
-AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
-
-# Agent config files. Note, plugin-specific Q_PLUGIN_CONF_FILE is set and
-# loaded from per-plugin  scripts in lib/neutron_plugins/
-Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
-Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
-Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
-
-# Default name for Neutron database
-Q_DB_NAME=${Q_DB_NAME:-neutron}
-# Default Neutron Plugin
-Q_PLUGIN=${Q_PLUGIN:-ml2}
-# Default Neutron Port
-Q_PORT=${Q_PORT:-9696}
-# Default Neutron Internal Port when using TLS proxy
-Q_PORT_INT=${Q_PORT_INT:-19696}
-# Default Neutron Host
-Q_HOST=${Q_HOST:-$SERVICE_HOST}
-# Default protocol
-Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
-# Default listen address
-Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
-# Default admin username
-Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
-# Default auth strategy
-Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
-# RHEL's support for namespaces requires using veths with ovs
-Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
-Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
-Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
-# Meta data IP
-Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
-# Allow Overlapping IP among subnets
-Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
-Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
-VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
-VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
-
-# Allow to skip stopping of OVN services
-SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
-
-# The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
-# /etc/neutron is assumed by many of devstack plugins.  Do not change.
-_Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
-
-# The name of the service in the endpoint URL
-NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
-fi
-
-# List of config file names in addition to the main plugin config file
-# To add additional plugin config files, use ``neutron_server_config_add``
-# utility function.  For example:
-#
-#    ``neutron_server_config_add file1``
-#
-# These config files are relative to ``/etc/neutron``.  The above
-# example would specify ``--config-file /etc/neutron/file1`` for
-# neutron server.
-declare -a -g Q_PLUGIN_EXTRA_CONF_FILES
-
-# same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
-declare -a -g _Q_PLUGIN_EXTRA_CONF_FILES_ABS
-
-
-Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-    Q_RR_COMMAND="sudo"
-else
-    NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
-    Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
-    fi
-fi
-
-
-# Distributed Virtual Router (DVR) configuration
-# Can be:
-# - ``legacy``   - No DVR functionality
-# - ``dvr_snat`` - Controller or single node DVR
-# - ``dvr``      - Compute node in multi-node DVR
-#
-Q_DVR_MODE=${Q_DVR_MODE:-legacy}
-if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,l2population
-fi
-
-# Provider Network Configurations
-# --------------------------------
-
-# The following variables control the Neutron ML2 plugins' allocation
-# of tenant networks and availability of provider networks. If these
-# are not configured in ``localrc``, tenant networks will be local to
-# the host (with no remote connectivity), and no physical resources
-# will be available for the allocation of provider networks.
-
-# To disable tunnels (GRE or VXLAN) for tenant networks,
-# set to False in ``local.conf``.
-# GRE tunnels are only supported by the openvswitch.
-ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
-
-# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
-# specify the range of IDs from which tenant networks are
-# allocated. Can be overridden in ``localrc`` if necessary.
-TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
-
-# To use VLANs for tenant networks, set to True in localrc. VLANs
-# are supported by the ML2 plugins, requiring additional configuration
-# described below.
-ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
-
-# If using VLANs for tenant networks, set in ``localrc`` to specify
-# the range of VLAN VIDs from which tenant networks are
-# allocated. An external network switch must be configured to
-# trunk these VLANs between hosts for multi-host connectivity.
-#
-# Example: ``TENANT_VLAN_RANGE=1000:1999``
-TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
-
-# If using VLANs for tenant networks, or if using flat or VLAN
-# provider networks, set in ``localrc`` to the name of the physical
-# network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
-# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
-# agent, as described below.
-#
-# Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
-
-# With the openvswitch agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the OVS bridge to use for the physical network. The
-# bridge will be created if it does not already exist, but a
-# physical interface must be manually added to the bridge as a
-# port for external connectivity.
-#
-# Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
-
-# With the linuxbridge agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the network interface to use for the physical
-# network.
-#
-# Example: ``LB_PHYSICAL_INTERFACE=eth1``
-if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
-    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
-    LB_PHYSICAL_INTERFACE=$default_route_dev
-fi
-
-# With the openvswitch plugin, set to True in ``localrc`` to enable
-# provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
-#
-# Example: ``OVS_ENABLE_TUNNELING=True``
-OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
-
-# Use DHCP agent for providing metadata service in the case of
-# without L3 agent (No Route Agent), set to True in localrc.
-ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
-
-# Add a static route as dhcp option, so the request to 169.254.169.254
-# will be able to reach through a route(DHCP agent)
-# This option require ENABLE_ISOLATED_METADATA = True
-ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
-# Neutron plugin specific functions
-# ---------------------------------
-
-# Please refer to ``lib/neutron_plugins/README.md`` for details.
-if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
-    source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
-fi
-
-# Agent metering service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/metering
-
-# L3 Service functions
-source $TOP_DIR/lib/neutron_plugins/services/l3
-
-# Additional Neutron service plugins
-source $TOP_DIR/lib/neutron_plugins/services/placement
-source $TOP_DIR/lib/neutron_plugins/services/trunk
-source $TOP_DIR/lib/neutron_plugins/services/qos
-
-# Use security group or not
-if has_neutron_plugin_security_group; then
-    Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
-else
-    Q_USE_SECGROUP=False
-fi
-
-# Save trace setting
-_XTRACE_NEUTRON=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Functions
-# ---------
-
-function _determine_config_server {
-    if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" != '' ]]; then
-        if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" = "$_Q_PLUGIN_EXTRA_CONF_PATH" ]]; then
-            deprecated "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
-        else
-            die $LINENO "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
-        fi
-    fi
-    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 ]]; then
-        deprecated "Q_PLUGIN_EXTRA_CONF_FILES is deprecated.  Use neutron_server_config_add instead."
-    fi
-    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
-        _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($_Q_PLUGIN_EXTRA_CONF_PATH/$cfg_file)
-    done
-
-    local cfg_file
-    local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    for cfg_file in ${_Q_PLUGIN_EXTRA_CONF_FILES_ABS[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-    echo "$opts"
-}
-
-function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
-    echo "$opts"
-}
-
-# For services and agents that require it, dynamically construct a list of
-# --config-file arguments that are passed to the binary.
-function determine_config_files {
-    local opts=""
-    case "$1" in
-        "neutron-server") opts="$(_determine_config_server)" ;;
-        "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
-    esac
-    if [ -z "$opts" ] ; then
-        die $LINENO "Could not determine config files for $1."
-    fi
-    echo "$opts"
-}
-
-# configure_mutnauq()
-# Set common config for all neutron server and agents.
-function configure_mutnauq {
-    _configure_neutron_common
-    iniset_rpc_backend neutron $NEUTRON_CONF
-
-    if is_service_enabled q-metering; then
-        _configure_neutron_metering
-    fi
-    if is_service_enabled q-agt q-svc; then
-        _configure_neutron_service
-    fi
-    if is_service_enabled q-agt; then
-        _configure_neutron_plugin_agent
-    fi
-    if is_service_enabled q-dhcp; then
-        _configure_neutron_dhcp_agent
-    fi
-    if is_service_enabled q-l3; then
-        _configure_neutron_l3_agent
-    fi
-    if is_service_enabled q-meta; then
-        _configure_neutron_metadata_agent
-    fi
-
-    if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-        _configure_dvr
-    fi
-    if is_service_enabled ceilometer; then
-        _configure_neutron_ceilometer_notifications
-    fi
-
-    if [[ $Q_AGENT == "ovn" ]]; then
-        configure_ovn
-        configure_ovn_plugin
-    fi
-
-    # Configure Neutron's advanced services
-    if is_service_enabled q-placement neutron-placement; then
-        configure_placement_extension
-    fi
-    if is_service_enabled q-trunk neutron-trunk; then
-        configure_trunk_extension
-    fi
-    if is_service_enabled q-qos neutron-qos; then
-        configure_qos
-        if is_service_enabled q-l3 neutron-l3; then
-            configure_l3_agent_extension_fip_qos
-            configure_l3_agent_extension_gateway_ip_qos
-        fi
-    fi
-
-    iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
-    # devstack is not a tool for running uber scale OpenStack
-    # clouds, therefore running without a dedicated RPC worker
-    # for state reports is more than adequate.
-    iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
-}
-
-function create_nova_conf_neutron {
-    local conf=${1:-$NOVA_CONF}
-    iniset $conf neutron auth_type "password"
-    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username "$Q_ADMIN_USERNAME"
-    iniset $conf neutron password "$SERVICE_PASSWORD"
-    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
-    iniset $conf neutron region_name "$REGION_NAME"
-
-    # optionally set options in nova_conf
-    neutron_plugin_create_nova_conf $conf
-
-    if is_service_enabled q-meta; then
-        iniset $conf neutron service_metadata_proxy "True"
-    fi
-
-    iniset $conf DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
-    iniset $conf DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
-}
-
-# create_mutnauq_accounts() - Set up common required neutron accounts
-
-# Tenant               User       Roles
-# ------------------------------------------------------------------
-# service              neutron    admin        # if enabled
-
-# Migrated from keystone_data.sh
-function create_mutnauq_accounts {
-    local neutron_url
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
-    else
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
-    fi
-    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
-        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
-    fi
-
-    if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
-
-        create_service_user "neutron"
-
-        get_or_create_service "neutron" "network" "Neutron Service"
-        get_or_create_endpoint \
-            "network" \
-            "$REGION_NAME" "$neutron_url"
-    fi
-}
-
-# init_mutnauq() - Initialize databases, etc.
-function init_mutnauq {
-    recreate_database $Q_DB_NAME
-    time_start "dbsync"
-    # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-    time_stop "dbsync"
-}
-
-# install_mutnauq() - Collect source and prepare
-function install_mutnauq {
-    # Install neutron-lib from git so we make sure we're testing
-    # the latest code.
-    if use_library_from_git "neutron-lib"; then
-        git_clone_by_name "neutron-lib"
-        setup_dev_lib "neutron-lib"
-    fi
-
-    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
-    setup_develop $NEUTRON_DIR
-
-    if [[ $Q_AGENT == "ovn" ]]; then
-        install_ovn
-    fi
-}
-
-# install_neutron_agent_packages() - Collect source and prepare
-function install_neutron_agent_packages_mutnauq {
-    # radvd doesn't come with the OS. Install it if the l3 service is enabled.
-    if is_service_enabled q-l3; then
-        install_package radvd
-    fi
-    # install packages that are specific to plugin agent(s)
-    if is_service_enabled q-agt q-dhcp q-l3; then
-        neutron_plugin_install_agent_packages
-    fi
-}
-
-# Finish neutron configuration
-function configure_neutron_after_post_config {
-    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
-        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
-    fi
-    configure_rbac_policies
-}
-
-# configure_rbac_policies() - Configure Neutron to enforce new RBAC
-# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
-function configure_rbac_policies {
-    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == True ]]; then
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
-        iniset $NEUTRON_CONF oslo_policy enforce_scope True
-    else
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
-        iniset $NEUTRON_CONF oslo_policy enforce_scope False
-    fi
-}
-
-# Start running OVN processes
-function start_ovn_services {
-    if [[ $Q_AGENT == "ovn" ]]; then
-        init_ovn
-        start_ovn
-        if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
-            if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
-                echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "
-                echo "because NEUTRON_CREATE_INITIAL_NETWORKS is set to False"
-            else
-                create_public_bridge
-            fi
-        fi
-    fi
-}
-
-# Start running processes
-function start_neutron_service_and_check {
-    local service_port=$Q_PORT
-    local service_protocol=$Q_PROTOCOL
-    local cfg_file_options
-    local neutron_url
-
-    cfg_file_options="$(determine_config_files neutron-server)"
-
-    if is_service_enabled tls-proxy; then
-        service_port=$Q_PORT_INT
-        service_protocol="http"
-    fi
-    # Start the Neutron service
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        enable_service neutron-api
-        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/
-        enable_service neutron-rpc-server
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
-    else
-        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port/
-        # Start proxy if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-        fi
-    fi
-    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
-        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
-    fi
-    echo "Waiting for Neutron to start..."
-
-    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
-    test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
-}
-
-# Control of the l2 agent is separated out to make it easier to test partial
-# upgrades (everything upgraded except the L2 agent)
-function start_mutnauq_l2_agent {
-    run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-
-    if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
-        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
-        sudo ip link set $OVS_PHYSICAL_BRIDGE up
-        sudo ip link set br-int up
-        sudo ip link set $PUBLIC_INTERFACE up
-        if is_ironic_hardware; then
-            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
-                sudo ip addr del $IP dev $PUBLIC_INTERFACE
-                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
-            done
-            sudo ip route replace $FIXED_RANGE via $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-        fi
-    fi
-}
-
-function start_mutnauq_other_agents {
-    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
-
-    run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
-
-    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
-    run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
-}
-
-# Start running processes, including screen
-function start_neutron_agents {
-    # Start up the neutron agents if enabled
-    start_mutnauq_l2_agent
-    start_mutnauq_other_agents
-}
-
-function stop_mutnauq_l2_agent {
-    stop_process q-agt
-}
-
-# stop_mutnauq_other() - Stop running processes
-function stop_mutnauq_other {
-    if is_service_enabled q-dhcp; then
-        stop_process q-dhcp
-        pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
-        [ ! -z "$pid" ] && sudo kill -9 $pid
-    fi
-
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-rpc-server
-        stop_process neutron-api
-    else
-        stop_process q-svc
-    fi
-
-    if is_service_enabled q-l3; then
-        sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
-        stop_process q-l3
-    fi
-
-    if is_service_enabled q-meta; then
-        stop_process q-meta
-    fi
-
-    if is_service_enabled q-metering; then
-        neutron_metering_stop
-    fi
-
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
-    fi
-}
-
-# stop_neutron() - Stop running processes (non-screen)
-function stop_mutnauq {
-    stop_mutnauq_other
-    stop_mutnauq_l2_agent
-
-    if [[ $Q_AGENT == "ovn" && $SKIP_STOP_OVN != "True" ]]; then
-        stop_ovn
-    fi
-}
-
-# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
-# on startup, or back to the public interface on cleanup. If no IP is
-# configured on the interface, just add it as a port to the OVS bridge.
-function _move_neutron_addresses_route {
-    local from_intf=$1
-    local to_intf=$2
-    local add_ovs_port=$3
-    local del_ovs_port=$4
-    local af=$5
-
-    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
-        # Remove the primary IP address from $from_intf and add it to $to_intf,
-        # along with the default route, if it exists.  Also, when called
-        # on configure we will also add $from_intf as a port on $to_intf,
-        # assuming it is an OVS bridge.
-
-        local IP_REPLACE=""
-        local IP_DEL=""
-        local IP_UP=""
-        local DEFAULT_ROUTE_GW
-        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf\s/ { print \$3; exit }")
-        local ADD_OVS_PORT=""
-        local DEL_OVS_PORT=""
-        local ARP_CMD=""
-
-        IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
-
-        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
-            ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
-        fi
-
-        if [[ "$add_ovs_port" == "True" ]]; then
-            ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
-        fi
-
-        if [[ "$del_ovs_port" == "True" ]]; then
-            DEL_OVS_PORT="sudo ovs-vsctl --if-exists del-port $from_intf $to_intf"
-        fi
-
-        if [[ "$IP_BRD" != "" ]]; then
-            IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
-            IP_REPLACE="sudo ip addr replace $IP_BRD dev $to_intf"
-            IP_UP="sudo ip link set $to_intf up"
-            if [[ "$af" == "inet" ]]; then
-                IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-                ARP_CMD="sudo arping -A -c 3 -w 5 -I $to_intf $IP "
-            fi
-        fi
-
-        # The add/del OVS port calls have to happen either before or
-        # after the address is moved in order to not leave it orphaned.
-        $DEL_OVS_PORT; $IP_DEL; $IP_REPLACE; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
-    fi
-}
-
-# _configure_public_network_connectivity() - Configures connectivity to the
-# external network using $PUBLIC_INTERFACE or NAT on the single interface
-# machines
-function _configure_public_network_connectivity {
-    # If we've given a PUBLIC_INTERFACE to take over, then we assume
-    # that we can own the whole thing, and privot it into the OVS
-    # bridge. If we are not, we're probably on a single interface
-    # machine, and we just setup NAT so that fixed guests can get out.
-    if [[ -n "$PUBLIC_INTERFACE" ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
-        fi
-    else
-        for d in $default_v4_route_devs; do
-            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
-        done
-    fi
-}
-
-# cleanup_mutnauq() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_mutnauq {
-
-    if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
-        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
-
-        if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
-            # ip(8) wants the prefix length when deleting
-            local v6_gateway
-            v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
-            sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
-            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False False "inet6"
-        fi
-
-        if is_provider_network && is_ironic_hardware; then
-            for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
-                sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
-                sudo ip addr add $IP dev $PUBLIC_INTERFACE
-            done
-            sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-        fi
-    fi
-
-    if is_neutron_ovs_base_plugin; then
-        neutron_ovs_base_cleanup
-    fi
-
-    if [[ $Q_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
-    fi
-
-    # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
-        sudo ip netns delete ${ns}
-    done
-
-    if [[ $Q_AGENT == "ovn" ]]; then
-        cleanup_ovn
-    fi
-}
-
-
-function _create_neutron_conf_dir {
-    # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
-    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
-}
-
-# _configure_neutron_common()
-# Set common config for all neutron server and agents.
-# This MUST be called before other ``_configure_neutron_*`` functions.
-function _configure_neutron_common {
-    _create_neutron_conf_dir
-
-    # Uses oslo config generator to generate core sample configuration files
-    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
-
-    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
-
-    # allow neutron user to administer neutron to match neutron account
-    # NOTE(amotoki): This is required for nova works correctly with neutron.
-    if [ -f $NEUTRON_DIR/etc/policy.json ]; then
-        cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
-        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
-    else
-        echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $Q_POLICY_FILE
-    fi
-
-    # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
-    # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    neutron_plugin_configure_common
-
-    if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
-        die $LINENO "Neutron plugin not set.. exiting"
-    fi
-
-    # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
-    mkdir -p /$Q_PLUGIN_CONF_PATH
-    Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
-    # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
-    # there is no config file in Neutron tree. They should prepare the file in each plugin.
-    if [ -f "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" ]; then
-        cp "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" /$Q_PLUGIN_CONF_FILE
-    elif [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
-        cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
-    fi
-
-    iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
-    iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
-    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
-    iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
-    iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
-
-    # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
-    iniset $NEUTRON_CONF nova region_name $REGION_NAME
-
-    if [ "$VIRT_DRIVER" = 'fake' ]; then
-        # Disable arbitrary limits
-        iniset $NEUTRON_CONF quotas quota_network -1
-        iniset $NEUTRON_CONF quotas quota_subnet -1
-        iniset $NEUTRON_CONF quotas quota_port -1
-        iniset $NEUTRON_CONF quotas quota_security_group -1
-        iniset $NEUTRON_CONF quotas quota_security_group_rule -1
-    fi
-
-    # Format logging
-    setup_logging $NEUTRON_CONF
-
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
-    _neutron_setup_rootwrap
-}
-
-function _configure_neutron_dhcp_agent {
-
-    cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
-
-    iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    # make it so we have working DNS from guests
-    iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_local_resolv True
-    iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    if ! is_service_enabled q-l3; then
-        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
-            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
-            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
-        else
-            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
-                die "$LINENO" "Enable isolated metadata is a must for metadata network"
-            fi
-        fi
-    fi
-
-    _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
-
-    neutron_plugin_configure_dhcp_agent $Q_DHCP_CONF_FILE
-}
-
-
-function _configure_neutron_metadata_agent {
-    cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
-
-    iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_host $Q_META_DATA_IP
-    iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
-    iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-}
-
-function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF oslo_messaging_notifications driver messagingv2
-}
-
-function _configure_neutron_metering {
-    neutron_agent_metering_configure_common
-    neutron_agent_metering_configure_agent
-}
-
-function _configure_dvr {
-    iniset $NEUTRON_CONF DEFAULT router_distributed True
-    iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
-}
-
-
-# _configure_neutron_plugin_agent() - Set config files for neutron plugin agent
-# It is called when q-agt is enabled.
-function _configure_neutron_plugin_agent {
-    # Specify the default root helper prior to agent configuration to
-    # ensure that an agent's configuration can override the default
-    iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-
-    # Configure agent for plugin
-    neutron_plugin_configure_plugin_agent
-}
-
-function _replace_api_paste_composite {
-    local sep
-    sep=$(echo -ne "\x01")
-    # Replace it
-    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
-}
-
-# _configure_neutron_service() - Set config files for neutron service
-# It is called when q-svc is enabled.
-function _configure_neutron_service {
-    Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
-
-    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-        _replace_api_paste_composite
-    fi
-
-    # Update either configuration file with plugin
-    iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
-
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
-
-    iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
-    configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME
-
-    # Configuration for neutron notifications to nova.
-    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
-    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
-
-    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
-
-    # Configuration for placement client
-    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
-
-    # Configure plugin
-    neutron_plugin_configure_service
-}
-
-# Utility Functions
-#------------------
-
-# _neutron_service_plugin_class_add() - add service plugin class
-function _neutron_service_plugin_class_add {
-    local service_plugin_class=$1
-    if [[ $Q_SERVICE_PLUGIN_CLASSES == '' ]]; then
-        Q_SERVICE_PLUGIN_CLASSES=$service_plugin_class
-    elif [[ ! ,${Q_SERVICE_PLUGIN_CLASSES}, =~ ,${service_plugin_class}, ]]; then
-        Q_SERVICE_PLUGIN_CLASSES="$Q_SERVICE_PLUGIN_CLASSES,$service_plugin_class"
-    fi
-}
-
-# _neutron_ml2_extension_driver_add_old() - add ML2 extension driver
-function _neutron_ml2_extension_driver_add_old {
-    local extension=$1
-    if [[ $Q_ML2_PLUGIN_EXT_DRIVERS == '' ]]; then
-        Q_ML2_PLUGIN_EXT_DRIVERS=$extension
-    elif [[ ! ,${Q_ML2_PLUGIN_EXT_DRIVERS}, =~ ,${extension}, ]]; then
-        Q_ML2_PLUGIN_EXT_DRIVERS="$Q_ML2_PLUGIN_EXT_DRIVERS,$extension"
-    fi
-}
-
-# mutnauq_server_config_add() - add server config file
-function mutnauq_server_config_add {
-    _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)
-}
-
-# _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
-function _neutron_deploy_rootwrap_filters {
-    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-        return
-    fi
-    local srcdir=$1
-    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
-    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
-}
-
-# _neutron_setup_rootwrap() - configure Neutron's rootwrap
-function _neutron_setup_rootwrap {
-    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-        return
-    fi
-    # Wipe any existing ``rootwrap.d`` files first
-    Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
-    if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
-        sudo rm -rf $Q_CONF_ROOTWRAP_D
-    fi
-
-    _neutron_deploy_rootwrap_filters $NEUTRON_DIR
-
-    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
-    # location moved in newer versions, prefer new location
-    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
-    else
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
-    fi
-    sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
-    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
-
-    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
-    ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
-    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
-
-    # Set up the rootwrap sudoers for neutron
-    TEMPFILE=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
-    chmod 0440 $TEMPFILE
-    sudo chown root:root $TEMPFILE
-    sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
-
-    # Update the root_helper
-    iniset $NEUTRON_CONF agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_CONF agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-}
-
-function _neutron_setup_interface_driver {
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $1 DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $1
-}
-# Functions for Neutron Exercises
-#--------------------------------
-
-function delete_probe {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
-    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
-}
-
-function _get_net_id {
-    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
-}
-
-function _get_probe_cmd_prefix {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
-    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
-}
-
-# ssh check
-function _ssh_check_neutron {
-    local from_net=$1
-    local key_file=$2
-    local ip=$3
-    local user=$4
-    local timeout_sec=$5
-    local probe_cmd = ""
-    probe_cmd=`_get_probe_cmd_prefix $from_net`
-    local testcmd="$probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success"
-    test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
-}
-
-function plugin_agent_add_l2_agent_extension {
-    local l2_agent_extension=$1
-    if [[ -z "$L2_AGENT_EXTENSIONS" ]]; then
-        L2_AGENT_EXTENSIONS=$l2_agent_extension
-    elif [[ ! ,${L2_AGENT_EXTENSIONS}, =~ ,${l2_agent_extension}, ]]; then
-        L2_AGENT_EXTENSIONS+=",$l2_agent_extension"
-    fi
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
+source $TOP_DIR/lib/neutron
diff --git a/lib/neutron_plugins/README.md b/lib/neutron_plugins/README.md
index ed40886fda..728aaee85f 100644
--- a/lib/neutron_plugins/README.md
+++ b/lib/neutron_plugins/README.md
@@ -13,7 +13,7 @@ Plugin specific configuration variables should be in this file.
 
 functions
 ---------
-``lib/neutron-legacy`` calls the following functions when the ``$Q_PLUGIN`` is enabled
+``lib/neutron`` calls the following functions when the ``$Q_PLUGIN`` is enabled
 
 * ``neutron_plugin_create_nova_conf`` :
   optionally set options in nova_conf
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index d3f5bd5752..84ca7ec42c 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -67,7 +67,7 @@ function has_neutron_plugin_security_group {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 310b72e5ad..96400634af 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -72,7 +72,7 @@ function has_neutron_plugin_security_group {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index bdeaf0f3c6..a392bd0baf 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -97,7 +97,7 @@ function neutron_plugin_setup_interface_driver {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 46edacdc54..c2e78c65cc 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -67,7 +67,7 @@ function neutron_plugin_configure_common {
     Q_PLUGIN_CLASS="ml2"
     # The ML2 plugin delegates L3 routing/NAT functionality to
     # the L3 service plugin which must therefore be specified.
-    _neutron_service_plugin_class_add $ML2_L3_PLUGIN
+    neutron_service_plugin_class_add $ML2_L3_PLUGIN
 }
 
 function neutron_plugin_configure_service {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 7fed8bf853..6e79984e9b 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -68,7 +68,7 @@ function neutron_plugin_setup_interface_driver {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e64224cbaa..dc8129553c 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -348,7 +348,7 @@ function compile_ovn {
 
 # OVN service sanity check
 function ovn_sanity_check {
-    if is_service_enabled q-agt neutron-agt; then
+    if is_service_enabled q-agt neutron-agent; then
         die $LINENO "The q-agt/neutron-agt service must be disabled with OVN."
     elif is_service_enabled q-l3 neutron-l3; then
         die $LINENO "The q-l3/neutron-l3 service must be disabled with OVN."
@@ -461,7 +461,7 @@ function filter_network_api_extensions {
 function configure_ovn_plugin {
     echo "Configuring Neutron for OVN"
 
-    if is_service_enabled q-svc ; then
+    if is_service_enabled q-svc neutron-api; then
         filter_network_api_extensions
         populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_geneve max_header_size=$OVN_GENEVE_OVERHEAD
         populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_connection="$OVN_NB_REMOTE"
@@ -485,7 +485,7 @@ function configure_ovn_plugin {
             inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
         fi
 
-        if is_service_enabled q-ovn-metadata-agent; then
+        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
@@ -506,7 +506,7 @@ function configure_ovn_plugin {
     fi
 
     if is_service_enabled n-api-meta ; then
-        if is_service_enabled q-ovn-metadata-agent ; then
+        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
@@ -539,7 +539,7 @@ function configure_ovn {
     fi
 
     # Metadata
-    if is_service_enabled q-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
         mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2
@@ -551,7 +551,7 @@ function configure_ovn {
         iniset $OVN_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
         iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
-        iniset $OVN_META_CONF DEFAULT state_path $NEUTRON_STATE_PATH
+        iniset $OVN_META_CONF DEFAULT state_path $DATA_DIR/neutron
         iniset $OVN_META_CONF ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
         iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
         if is_service_enabled tls-proxy; then
@@ -680,7 +680,7 @@ function _start_ovn_services {
     if is_service_enabled ovs-vtep ; then
         _start_process "devstack@ovs-vtep.service"
     fi
-    if is_service_enabled q-ovn-metadata-agent; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
         _start_process "devstack@q-ovn-metadata-agent.service"
     fi
 }
@@ -743,7 +743,7 @@ function start_ovn {
         fi
     fi
 
-    if is_service_enabled q-ovn-metadata-agent; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
         # Format logging
         setup_logging $OVN_META_CONF
@@ -767,7 +767,7 @@ function _stop_process {
 }
 
 function stop_ovn {
-    if is_service_enabled q-ovn-metadata-agent; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         sudo pkill -9 -f haproxy || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 3dffc33d37..2bf884a8c4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -323,7 +323,7 @@ function _neutron_configure_router_v4 {
     openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using OVN or the l3-agent for layer 3
-    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-api) || is_service_enabled q-l3 neutron-l3; then
         # Configure and enable public bridge
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
@@ -372,7 +372,7 @@ function _neutron_configure_router_v6 {
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
-    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-api) || is_service_enabled q-l3 neutron-l3; then
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 5b32468d21..757a562ee6 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -12,7 +12,7 @@ AGENT_METERING_BINARY="$NEUTRON_BIN_DIR/neutron-metering-agent"
 METERING_PLUGIN="neutron.services.metering.metering_plugin.MeteringPlugin"
 
 function neutron_agent_metering_configure_common {
-    _neutron_service_plugin_class_add $METERING_PLUGIN
+    neutron_service_plugin_class_add $METERING_PLUGIN
 }
 
 function neutron_agent_metering_configure_agent {
diff --git a/lib/neutron_plugins/services/qos b/lib/neutron_plugins/services/qos
index af9eb3d5b4..c11c315586 100644
--- a/lib/neutron_plugins/services/qos
+++ b/lib/neutron_plugins/services/qos
@@ -6,7 +6,7 @@ function configure_qos_service_plugin {
 
 
 function configure_qos_core_plugin {
-    configure_qos_$NEUTRON_CORE_PLUGIN
+    configure_qos_$Q_PLUGIN
 }
 
 
diff --git a/lib/tempest b/lib/tempest
index eaad6d255e..44a9b6f29f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -737,12 +737,12 @@ function configure_tempest {
     # Neutron API Extensions
 
     # disable metering if we didn't enable the service
-    if ! is_service_enabled q-metering; then
+    if ! is_service_enabled q-metering neutron-metering; then
         DISABLE_NETWORK_API_EXTENSIONS+=", metering"
     fi
 
     # disable l3_agent_scheduler if we didn't enable L3 agent
-    if ! is_service_enabled q-l3; then
+    if ! is_service_enabled q-l3 neutron-l3; then
         DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
     fi
 

From aa47cb34ae25b66e46a216e1c9b7b668615b520b Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 27 Dec 2022 06:11:07 +0000
Subject: [PATCH 3047/3333] Add config options for cinder nfs backend

Currently the cinder nfs backend leaves out few options in a
multi backend deployment. It works in single nfs backend deployment
as devstack-plugin-nfs correctly configures all options[1].
We can clearly see the difference between what devstack-plugin-nfs
configures[1] and what devstack nfs configures[2].

Following options are missing which are added by this patch.
* nas_host
* nas_share_path
* nas_secure_file_operations
* nas_secure_file_permissions
* nfs_snapshot_support

[1] https://github.com/openstack/devstack-plugin-nfs/blob/dd12367f90fc86d42bfebe8a0ebb694dc0308810/devstack/plugin.sh#L60-L68
[2] https://github.com/openstack/devstack/blob/a52041cd3f067156e478e355f5712a60e12ce649/lib/cinder_backends/nfs#L32-L34

Change-Id: I03cad66abb3c6f2ae1d5cf943ac952a30961f783
---
 lib/cinder_backends/nfs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/cinder_backends/nfs b/lib/cinder_backends/nfs
index 89a37a1f02..f3fcbeff19 100644
--- a/lib/cinder_backends/nfs
+++ b/lib/cinder_backends/nfs
@@ -32,6 +32,15 @@ function configure_cinder_backend_nfs {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.nfs.NfsDriver"
     iniset $CINDER_CONF $be_name nfs_shares_config "$CINDER_CONF_DIR/nfs-shares-$be_name.conf"
+    iniset $CINDER_CONF $be_name nas_host localhost
+    iniset $CINDER_CONF $be_name nas_share_path ${NFS_EXPORT_DIR}
+    iniset $CINDER_CONF $be_name nas_secure_file_operations \
+        ${NFS_SECURE_FILE_OPERATIONS}
+    iniset $CINDER_CONF $be_name nas_secure_file_permissions \
+        ${NFS_SECURE_FILE_PERMISSIONS}
+
+    # NFS snapshot support is currently opt-in only.
+    iniset $CINDER_CONF $be_name nfs_snapshot_support True
 
     echo "$CINDER_NFS_SERVERPATH" | tee "$CINDER_CONF_DIR/nfs-shares-$be_name.conf"
 }

From 69d71cfdf9c24d48fbea366714f4595cbd120723 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 10 Jan 2023 20:13:47 -0600
Subject: [PATCH 3048/3333] Option to disable the scope & new defaults
 enforcement

In this release cycle, a few services are enabling the
enforce scope and new defaults by default. Example Nova:
- https://review.opendev.org/c/openstack/nova/+/866218)

Until the new defaults enalbing by default is not released we
should keep testing the old defaults in existing jobs and we can
add new jobs testing new defautls. To do that we can provide the
way in devstack to keep scope/new defaults disable by default which
can be enabled by setting enforce_scope variable to true.

Once any service release the new defaults enabled by default then
we can switch the bhavior, enable the scope/new defaults by default
and a single job can disbale them to keep testing the old defaults
until service does not remove those.

Change-Id: I5c2ec3e1667172a75e06458f16cf3d57947b2c53
---
 lib/cinder    | 3 +++
 lib/glance    | 4 ++++
 lib/keystone  | 7 ++++++-
 lib/nova      | 3 +++
 lib/placement | 3 +++
 5 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index bf2fe50e08..2424f928d1 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -411,6 +411,9 @@ function configure_cinder {
     if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $CINDER_CONF oslo_policy enforce_scope true
         iniset $CINDER_CONF oslo_policy enforce_new_defaults true
+    else
+        iniset $CINDER_CONF oslo_policy enforce_scope false
+        iniset $CINDER_CONF oslo_policy enforce_new_defaults false
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index ba98f4133e..041acafc92 100644
--- a/lib/glance
+++ b/lib/glance
@@ -436,6 +436,10 @@ function configure_glance {
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
         iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
         iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
+    else
+        iniset $GLANCE_API_CONF oslo_policy enforce_scope false
+        iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults false
+        iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac false
     fi
 }
 
diff --git a/lib/keystone b/lib/keystone
index 80a136f78d..6cb4aac46a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -265,10 +265,15 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
+
+    iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+
     if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $KEYSTONE_CONF oslo_policy enforce_scope true
         iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
-        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+    else
+        iniset $KEYSTONE_CONF oslo_policy enforce_scope false
+        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults false
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 14eb8fc3da..3aa6b9e3b3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -490,6 +490,9 @@ function create_nova_conf {
         if [[ "$NOVA_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
             iniset $NOVA_CONF oslo_policy enforce_new_defaults True
             iniset $NOVA_CONF oslo_policy enforce_scope True
+        else
+            iniset $NOVA_CONF oslo_policy enforce_new_defaults False
+            iniset $NOVA_CONF oslo_policy enforce_scope False
         fi
         if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
             # Set the service port for a proxy to take the original
diff --git a/lib/placement b/lib/placement
index bc22c564f4..c6bf99f868 100644
--- a/lib/placement
+++ b/lib/placement
@@ -120,6 +120,9 @@ function configure_placement {
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True
+    else
+        iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults False
+        iniset $PLACEMENT_CONF oslo_policy enforce_scope False
     fi
 }
 

From 7fecba2f135f16204050b627bb850a87aa597bad Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Thu, 12 Jan 2023 17:31:36 +0530
Subject: [PATCH 3049/3333] [OVN] Ensure socket files are absent in init_ovn

Just like we remove db files let's also remove
socket files when initializing ovn. Those will
reappear once service fully restarts along with
db files. Without it we see random issue as
described in the below bug.

Closes-Bug: #2002629
Change-Id: I726a9cac9c805d017273aa79e844724f0d00cdf0
---
 lib/neutron_plugins/ovn_agent | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index dc8129553c..f27777867d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -587,6 +587,7 @@ function init_ovn {
     rm -f $OVS_DATADIR/.*.db.~lock~
     sudo rm -f $OVN_DATADIR/*.db
     sudo rm -f $OVN_DATADIR/.*.db.~lock~
+    sudo rm -f $OVN_RUNDIR/*.sock
 }
 
 function _start_ovs {

From 5a6f0bbd4c3c3006a50e9e70c81f31ea1fa409c6 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Sat, 21 Jan 2023 20:21:26 +0100
Subject: [PATCH 3050/3333] Remove the neutron bash completion installation

The python-neutronclient CLI code is going to be removed from this
repository.

Change-Id: I39b3a43a7742481ec6d9501d5459bf0837ba0122
Related-Bug: #2003861
---
 lib/neutron | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c8ee8c5e76..9fb09ab9bb 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -527,7 +527,6 @@ function install_neutronclient {
     if use_library_from_git "python-neutronclient"; then
         git_clone_by_name "python-neutronclient"
         setup_dev_lib "python-neutronclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
     fi
 }
 

From 91efe177b170c3874989affc73842dc4ffbe062d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 29 Sep 2022 08:38:24 +0200
Subject: [PATCH 3051/3333] Bump cirros version to 0.6.1

Cirros has made a fresh release, let us use it. Switch the download URLs
to https and drop an old example that no longer is available.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/871271
Change-Id: I1d391b871fc9bfa825db30db9434922226b94d8a
---
 doc/source/guides/nova.rst |  2 +-
 stackrc                    | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 5b427972c4..d0fb274c13 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index b3130e5f7f..a71d843362 100644
--- a/stackrc
+++ b/stackrc
@@ -657,20 +657,19 @@ esac
 #     If the file ends in .tar.gz, uncompress the tarball and and select the first
 #     .img file inside it as the image.  If present, use "*-vmlinuz*" as the kernel
 #     and "*-initrd*" as the ramdisk
-#     example: http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-amd64.tar.gz
+#     example: https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.tar.gz
 #  * disk image (*.img,*.img.gz)
 #    if file ends in .img, then it will be uploaded and registered as a to
 #    glance as a disk image.  If it ends in .gz, it is uncompressed first.
 #    example:
-#      http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-armel-disk1.img
-#      http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
+#      https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.img
+#      https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
 #  * OpenVZ image:
 #    OpenVZ uses its own format of image, and does not support UEC style images
 
-#IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
-#IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
+#IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -687,11 +686,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)

From 71c3c40c269a50303247855319d1d3a5d30f6773 Mon Sep 17 00:00:00 2001
From: Bence Romsics <bence.romsics@gmail.com>
Date: Wed, 21 Dec 2022 13:50:54 +0100
Subject: [PATCH 3052/3333] 'sudo pkill -f' should not match the sudo process

pkill already takes care that it does not kill itself, however the
same problem may happen with 'sudo pkill -f' killing sudo. Use one
of the usual regex tricks to avoid that.

Change-Id: Ic6a94f516cbc509a2d77699494aa7bcaecf96ebc
Closes-Bug: #1999395
---
 lib/neutron                   | 4 +++-
 lib/neutron_plugins/ovn_agent | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index c8ee8c5e76..0d6a148c8e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -689,7 +689,9 @@ function stop_other {
     fi
 
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
+        # pkill takes care not to kill itself, but it may kill its parent
+        # sudo unless we use the "ps | grep [f]oo" trick
+        sudo pkill -9 -f "$NEUTRON_ROOTWRAP-[d]aemon" || :
     fi
 }
 
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index f27777867d..34903924b3 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -769,7 +769,9 @@ function _stop_process {
 
 function stop_ovn {
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
-        sudo pkill -9 -f haproxy || :
+        # pkill takes care not to kill itself, but it may kill its parent
+        # sudo unless we use the "ps | grep [f]oo" trick
+        sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
     if is_service_enabled ovn-controller-vtep ; then

From 7fe998109bda8cdd5cb5ba4a0e02c6c83cb0566d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 26 Jan 2023 22:28:07 -0600
Subject: [PATCH 3053/3333] Fix setting the tempest virtual env constraints env
 var

Devstack set the env var TOX_CONSTRAINTS_FILE/UPPER_CONSTRAINTS_FILE
which are used to use the constraints during Tempest virtual env installation.
Those env var are set to non-master constraint when we need to use non-master
constraints but when we need to use the master constraints we do not set/reset
them point to master constraints. This create the issue when running the grenade
job where we run Tempest on the old devstack as well as in the new devstack.
When tempest is installed on old devstack then old tempest is used and it sets
these env var to stable/<branch> constraints (this is the case when old devstack
(the stable branch is in EM phase) uses the old tempest not the master tempest),
all good till now. But the problem comes when in the same grenade script run
upgrade-tempest install the master tempest (when new devstack branches are in
the 'supported' phase and use the master tempest means) and are supposed to use
the master constraints. But the TOX_CONSTRAINTS_FILE/UPPER_CONSTRAINTS_FILE env
var set by old tempest is used by the tempest and due to a mismatch in constraints
it fails.

This happened when we tried to pin the stable/wallaby with Tempest 29.0.0
- https://review.opendev.org/c/openstack/devstack/+/871782

and table/xena grenade job failed (stable/xena use master tempest and supposed
to use master constraints)
- https://zuul.opendev.org/t/openstack/build/fb7b2a8b562c42bab4c741819f5e9732/log/controller/logs/grenade.sh_log.txt#16641

We should set/reset those constraint env var to master constraints if configuration
tell devstack to use the master constraints.

[1] https://github.com/openstack/devstack/blob/71c3c40c269a50303247855319d1d3a5d30f6773/lib/tempest#L124

Closes-Bug: #2003993
Change-Id: I5e938139b47f443a4c358415d0d4dcf6549cd085
---
 lib/tempest | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 44a9b6f29f..c3d3e9ac30 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -128,6 +128,13 @@ function set_tempest_venv_constraints {
         (cd $REQUIREMENTS_DIR &&
             git show master:upper-constraints.txt 2>/dev/null ||
             git show origin/master:upper-constraints.txt) > $tmp_c
+        # NOTE(gmann): we need to set the below env var pointing to master
+        # constraints even that is what default in tox.ini. Otherwise it can
+        # create the issue for grenade run where old and new devstack can have
+        # different tempest (old and master) to install. For detail problem,
+        # refer to the https://bugs.launchpad.net/devstack/+bug/2003993
+        export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/master
+        export TOX_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/master
     else
         echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
         cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c

From a84b2091cf2c84eb4b81e542233bf446440e02b1 Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Wed, 17 Nov 2021 11:52:56 +0100
Subject: [PATCH 3054/3333] Rehome functions to enable Neutron's segments
 integration

Those functions were part of the neutron devstack plugin but we
discussed it during last PTG [1] and decided to move to the Devstack
repo as plugins which are used by e.g. CI jobs which are defined outside
of the neutron repository.
Placement integration is used e.g. in the tempest-slow job which is
defined in tempest and used by many different OpenStack projects.

[1] https://etherpad.opendev.org/p/neutron-yoga-ptg#L142

Change-Id: I2c26063896ab2679cffd01227a40a3283caa3b17
---
 lib/neutron                           |  5 +++++
 lib/neutron_plugins/services/segments | 10 ++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 lib/neutron_plugins/services/segments

diff --git a/lib/neutron b/lib/neutron
index 8708bf43ca..368a1b9c55 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -294,6 +294,7 @@ source $TOP_DIR/lib/neutron_plugins/services/l3
 source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
 source $TOP_DIR/lib/neutron_plugins/services/qos
+source $TOP_DIR/lib/neutron_plugins/services/segments
 
 # Use security group or not
 if has_neutron_plugin_security_group; then
@@ -416,6 +417,10 @@ function configure_neutron {
             configure_l3_agent_extension_gateway_ip_qos
         fi
     fi
+    if is_service_enabled neutron-segments; then
+        configure_placement_neutron
+        configure_segments_extension
+    fi
 
     # Finally configure Neutron server and core plugin
     if is_service_enabled q-agt neutron-agent q-svc neutron-api; then
diff --git a/lib/neutron_plugins/services/segments b/lib/neutron_plugins/services/segments
new file mode 100644
index 0000000000..08936bae49
--- /dev/null
+++ b/lib/neutron_plugins/services/segments
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+function configure_segments_service_plugin {
+    neutron_service_plugin_class_add segments
+}
+
+function configure_segments_extension {
+    configure_segments_service_plugin
+}
+

From 48af5d4b1bf5332c879ee52fb4686874b212697f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 14 Feb 2023 17:11:24 +0100
Subject: [PATCH 3055/3333] Make rockylinux job non-voting

It is currently failing, let's unblock the CI until we have a fix.

Change-Id: I7f072ceef57c302eb6ce20e108043d2390e9f481
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8e20f6ed34..30e53976a5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -726,6 +726,7 @@
     description: Rocky Linux 9 Blue Onyx platform test
     nodeset: devstack-single-node-rockylinux-9
     timeout: 9000
+    voting: false
     vars:
       configure_swap_size: 4096
 

From fcc525f4fc5022a4b1f4e3d961e1b27cfbfa9d71 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Thu, 16 Feb 2023 10:26:32 +0100
Subject: [PATCH 3056/3333] Fix rockylinux and make it voting

Some rockylinux deployments have the curl-minimal package installed by
default (the latest GenericCloud image still has the curl package), it
triggers an error when devstack wants to install the curl package.
Fix this issue by swaping curl-minimal with curl before installing base
packages.

Change-Id: I969e8dc22e7d11c9917a843d9245f33a04fe197d
---
 .zuul.yaml | 1 -
 stack.sh   | 7 +++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 30e53976a5..8e20f6ed34 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -726,7 +726,6 @@
     description: Rocky Linux 9 Blue Onyx platform test
     nodeset: devstack-single-node-rockylinux-9
     timeout: 9000
-    voting: false
     vars:
       configure_swap_size: 4096
 
diff --git a/stack.sh b/stack.sh
index 28576d1e14..ccd2d16baa 100755
--- a/stack.sh
+++ b/stack.sh
@@ -394,6 +394,13 @@ elif [[ $DISTRO == "rhel9" ]]; then
     sudo dnf config-manager --set-enabled crb
     # rabbitmq and other packages are provided by RDO repositories.
     _install_rdo
+
+    # Some distributions (Rocky Linux 9) provide curl-minimal instead of curl,
+    # it triggers a conflict when devstack wants to install "curl".
+    # Swap curl-minimal with curl.
+    if is_package_installed curl-minimal; then
+        sudo dnf swap -y curl-minimal curl
+    fi
 elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # There are some problem in openEuler. We should fix it first. Some required
     # package/action runs before fixup script. So we can't fix there.

From ec07b343d25e9964db57ef9c3e2a89deeb5ac56e Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 24 Jan 2023 17:38:45 +0100
Subject: [PATCH 3057/3333] Remove support for opensuse

We haven't been testing the distro for a while in CI, e.g. in
Tempest, the jobs on opensuse15 haven't been executed for a year
now.
Therefore the patch removes opensuse support from devstack.

Closes-Bug: #2002900
Change-Id: I0f5e4c644e2d14d1b8bb5bc0096d1469febe5fcc
---
 doc/source/index.rst                |  3 +-
 doc/source/plugins.rst              |  3 --
 files/rpms-suse/baremetal           |  1 -
 files/rpms-suse/ceph                |  3 --
 files/rpms-suse/cinder              |  3 --
 files/rpms-suse/dstat               |  1 -
 files/rpms-suse/general             | 34 ---------------------
 files/rpms-suse/horizon             |  2 --
 files/rpms-suse/keystone            |  4 ---
 files/rpms-suse/ldap                |  3 --
 files/rpms-suse/n-api               |  1 -
 files/rpms-suse/n-cpu               | 10 ------
 files/rpms-suse/neutron-agent       |  1 -
 files/rpms-suse/neutron-common      | 12 --------
 files/rpms-suse/neutron-l3          |  2 --
 files/rpms-suse/nova                | 21 -------------
 files/rpms-suse/openvswitch         |  3 --
 files/rpms-suse/os-brick            |  2 --
 files/rpms-suse/q-agt               |  1 -
 files/rpms-suse/q-l3                |  1 -
 files/rpms-suse/swift               |  6 ----
 functions-common                    | 47 -----------------------------
 inc/python                          |  4 ---
 lib/apache                          | 25 +++------------
 lib/cinder                          |  9 ++----
 lib/databases/mysql                 | 15 ++-------
 lib/databases/postgresql            |  9 ++----
 lib/glance                          |  4 ---
 lib/horizon                         |  2 +-
 lib/ldap                            | 14 ---------
 lib/lvm                             |  4 +--
 lib/neutron_plugins/ovs_base        | 13 --------
 lib/neutron_plugins/ovs_source      |  6 ----
 lib/nova                            |  6 ++--
 lib/nova_plugins/functions-libvirt  |  6 ++--
 lib/nova_plugins/hypervisor-libvirt |  3 --
 lib/rpc_backend                     | 15 +--------
 lib/swift                           |  3 --
 lib/tls                             | 12 --------
 stack.sh                            |  2 +-
 tests/test_package_ordering.sh      |  2 +-
 tools/fixup_stuff.sh                | 40 ------------------------
 tools/install_prereqs.sh            |  2 --
 43 files changed, 25 insertions(+), 335 deletions(-)
 delete mode 100644 files/rpms-suse/baremetal
 delete mode 100644 files/rpms-suse/ceph
 delete mode 100644 files/rpms-suse/cinder
 delete mode 100644 files/rpms-suse/dstat
 delete mode 100644 files/rpms-suse/general
 delete mode 100644 files/rpms-suse/horizon
 delete mode 100644 files/rpms-suse/keystone
 delete mode 100644 files/rpms-suse/ldap
 delete mode 100644 files/rpms-suse/n-api
 delete mode 100644 files/rpms-suse/n-cpu
 delete mode 100644 files/rpms-suse/neutron-agent
 delete mode 100644 files/rpms-suse/neutron-common
 delete mode 100644 files/rpms-suse/neutron-l3
 delete mode 100644 files/rpms-suse/nova
 delete mode 100644 files/rpms-suse/openvswitch
 delete mode 100644 files/rpms-suse/os-brick
 delete mode 120000 files/rpms-suse/q-agt
 delete mode 120000 files/rpms-suse/q-l3
 delete mode 100644 files/rpms-suse/swift

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 1e932f88a5..ccd0fef330 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,8 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL/Rocky Linux 9, OpenSUSE and
-openEuler.
+latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and openEuler.
 
 If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 62dd15bfb1..dd75b5a22d 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -243,9 +243,6 @@ locations in the top-level of the plugin repository:
 - ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
   on Red Hat, Fedora, or CentOS.
 
-- ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
-  running on SUSE Linux or openSUSE.
-
 Although there a no plans to remove this method of installing
 packages, plugins should consider it deprecated for ``bindep`` support
 described below.
diff --git a/files/rpms-suse/baremetal b/files/rpms-suse/baremetal
deleted file mode 100644
index 61f73eeae3..0000000000
--- a/files/rpms-suse/baremetal
+++ /dev/null
@@ -1 +0,0 @@
-dnsmasq
diff --git a/files/rpms-suse/ceph b/files/rpms-suse/ceph
deleted file mode 100644
index 8c4955df90..0000000000
--- a/files/rpms-suse/ceph
+++ /dev/null
@@ -1,3 +0,0 @@
-ceph    # NOPRIME
-lsb
-xfsprogs
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
deleted file mode 100644
index b39cc79a27..0000000000
--- a/files/rpms-suse/cinder
+++ /dev/null
@@ -1,3 +0,0 @@
-lvm2
-qemu-tools
-tgt # NOPRIME
diff --git a/files/rpms-suse/dstat b/files/rpms-suse/dstat
deleted file mode 100644
index 2b643b8b1b..0000000000
--- a/files/rpms-suse/dstat
+++ /dev/null
@@ -1 +0,0 @@
-dstat
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
deleted file mode 100644
index f63611025c..0000000000
--- a/files/rpms-suse/general
+++ /dev/null
@@ -1,34 +0,0 @@
-apache2
-apache2-devel
-bc
-ca-certificates-mozilla
-curl
-gawk
-gcc
-gcc-c++
-git-core
-graphviz # docs
-iputils
-libffi-devel  # pyOpenSSL
-libjpeg8-devel # Pillow 3.0.0
-libopenssl-devel # to rebuild pyOpenSSL if needed
-libxslt-devel  # lxml
-lsof # useful when debugging
-make
-net-tools
-openssh
-openssl
-pcre-devel # python-pcre
-postgresql-devel  # psycopg2
-psmisc
-python3-systemd
-python-cmd2 # dist:opensuse-12.3
-python-devel  # pyOpenSSL
-python-xml
-tar
-tcpdump
-unzip
-util-linux
-wget
-which
-zlib-devel
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
deleted file mode 100644
index 753ea76e04..0000000000
--- a/files/rpms-suse/horizon
+++ /dev/null
@@ -1,2 +0,0 @@
-apache2-mod_wsgi  # NOPRIME
-apache2  # NOPRIME
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
deleted file mode 100644
index 66cfc23423..0000000000
--- a/files/rpms-suse/keystone
+++ /dev/null
@@ -1,4 +0,0 @@
-cyrus-sasl-devel
-memcached
-openldap2-devel
-sqlite3
diff --git a/files/rpms-suse/ldap b/files/rpms-suse/ldap
deleted file mode 100644
index 46d26f0796..0000000000
--- a/files/rpms-suse/ldap
+++ /dev/null
@@ -1,3 +0,0 @@
-openldap2
-openldap2-client
-python-ldap
diff --git a/files/rpms-suse/n-api b/files/rpms-suse/n-api
deleted file mode 100644
index 0f08daace3..0000000000
--- a/files/rpms-suse/n-api
+++ /dev/null
@@ -1 +0,0 @@
-python-dateutil
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
deleted file mode 100644
index 9c724cb9d8..0000000000
--- a/files/rpms-suse/n-cpu
+++ /dev/null
@@ -1,10 +0,0 @@
-cdrkit-cdrtools-compat # dist:sle12
-cryptsetup
-dosfstools
-libosinfo
-lvm2
-mkisofs # not:sle12
-open-iscsi
-sg3_utils
-# Stuff for diablo volumes
-sysfsutils
diff --git a/files/rpms-suse/neutron-agent b/files/rpms-suse/neutron-agent
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/rpms-suse/neutron-agent
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/rpms-suse/neutron-common b/files/rpms-suse/neutron-common
deleted file mode 100644
index e3799a9353..0000000000
--- a/files/rpms-suse/neutron-common
+++ /dev/null
@@ -1,12 +0,0 @@
-acl
-dnsmasq
-dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
-ebtables
-haproxy # to serve as metadata proxy inside router/dhcp namespaces
-iptables
-iputils
-rabbitmq-server # NOPRIME
-radvd # NOPRIME
-sqlite3
-sudo
-vlan
diff --git a/files/rpms-suse/neutron-l3 b/files/rpms-suse/neutron-l3
deleted file mode 100644
index a7a190c063..0000000000
--- a/files/rpms-suse/neutron-l3
+++ /dev/null
@@ -1,2 +0,0 @@
-conntrack-tools
-keepalived
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
deleted file mode 100644
index 082b9aca22..0000000000
--- a/files/rpms-suse/nova
+++ /dev/null
@@ -1,21 +0,0 @@
-cdrkit-cdrtools-compat # dist:sle12
-conntrack-tools
-curl
-ebtables
-iptables
-iputils
-kpartx
-kvm # NOPRIME
-libvirt # NOPRIME
-libvirt-python # NOPRIME
-# mkisofs is required for config_drive
-mkisofs # not:sle12
-parted
-polkit
-# qemu as fallback if kvm cannot be used
-qemu # NOPRIME
-rabbitmq-server # NOPRIME
-socat
-sqlite3
-sudo
-vlan
diff --git a/files/rpms-suse/openvswitch b/files/rpms-suse/openvswitch
deleted file mode 100644
index 53f8bb22cf..0000000000
--- a/files/rpms-suse/openvswitch
+++ /dev/null
@@ -1,3 +0,0 @@
-
-openvswitch
-openvswitch-switch
diff --git a/files/rpms-suse/os-brick b/files/rpms-suse/os-brick
deleted file mode 100644
index 67b33a9861..0000000000
--- a/files/rpms-suse/os-brick
+++ /dev/null
@@ -1,2 +0,0 @@
-lsscsi
-open-iscsi
diff --git a/files/rpms-suse/q-agt b/files/rpms-suse/q-agt
deleted file mode 120000
index 99fe353094..0000000000
--- a/files/rpms-suse/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-neutron-agent
\ No newline at end of file
diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
deleted file mode 120000
index 0a5ca2a45f..0000000000
--- a/files/rpms-suse/q-l3
+++ /dev/null
@@ -1 +0,0 @@
-neutron-l3
\ No newline at end of file
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
deleted file mode 100644
index 3663b98545..0000000000
--- a/files/rpms-suse/swift
+++ /dev/null
@@ -1,6 +0,0 @@
-curl
-liberasurecode-devel
-memcached
-sqlite3
-xfsprogs
-xinetd
diff --git a/functions-common b/functions-common
index 4eed5d8407..c7a1c6e0bf 100644
--- a/functions-common
+++ b/functions-common
@@ -454,16 +454,6 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then
         # For Fedora, just use 'f' and the release
         DISTRO="f$os_RELEASE"
-    elif is_opensuse; then
-        DISTRO="opensuse-$os_RELEASE"
-        # Tumbleweed uses "n/a" as a codename, and the release is a datestring
-        # like 20180218, so not very useful. Leap however uses a release
-        # with a "dot", so for example 15.0
-        [ "$os_CODENAME" = "n/a" -a "$os_RELEASE" = "${os_RELEASE/\./}" ] && \
-            DISTRO="opensuse-tumbleweed"
-    elif is_suse_linux_enterprise; then
-        # just use major release
-        DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
         "$os_VENDOR" =~ (AlmaLinux) || \
@@ -537,37 +527,6 @@ function is_fedora {
 }
 
 
-# Determine if current distribution is a SUSE-based distribution
-# (openSUSE, SLE).
-# is_suse
-function is_suse {
-    is_opensuse || is_suse_linux_enterprise
-}
-
-
-# Determine if current distribution is an openSUSE distribution
-# is_opensuse
-function is_opensuse {
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    [[ "$os_VENDOR" =~ (openSUSE) ]]
-}
-
-
-# Determine if current distribution is a SUSE Linux Enterprise (SLE)
-# distribution
-# is_suse_linux_enterprise
-function is_suse_linux_enterprise {
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    [[ "$os_VENDOR" =~ (^SUSE) ]]
-}
-
-
 # Determine if current distribution is an Ubuntu-based distribution
 # It will also detect non-Ubuntu but Debian-based distros
 # is_ubuntu
@@ -1168,8 +1127,6 @@ function _get_package_dir {
         pkg_dir=$base_dir/debs
     elif is_fedora; then
         pkg_dir=$base_dir/rpms
-    elif is_suse; then
-        pkg_dir=$base_dir/rpms-suse
     else
         exit_distro_not_supported "list of packages"
     fi
@@ -1444,8 +1401,6 @@ function real_install_package {
         apt_get install "$@"
     elif is_fedora; then
         yum_install "$@"
-    elif is_suse; then
-        zypper_install "$@"
     else
         exit_distro_not_supported "installing packages"
     fi
@@ -1487,8 +1442,6 @@ function uninstall_package {
         apt_get purge "$@"
     elif is_fedora; then
         sudo dnf remove -y "$@" ||:
-    elif is_suse; then
-        sudo zypper remove -y "$@" ||:
     else
         exit_distro_not_supported "uninstalling packages"
     fi
diff --git a/inc/python b/inc/python
index 3eb3efe80e..a24f4e910a 100644
--- a/inc/python
+++ b/inc/python
@@ -7,7 +7,6 @@
 # External functions used:
 # - GetOSVersion
 # - is_fedora
-# - is_suse
 # - safe_chown
 
 # Save trace setting
@@ -62,7 +61,6 @@ function get_python_exec_prefix {
     $xtrace
 
     local PYTHON_PATH=/usr/local/bin
-    is_suse && PYTHON_PATH=/usr/bin
     echo $PYTHON_PATH
 }
 
@@ -462,8 +460,6 @@ function install_python {
 function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
-    elif is_suse; then
-        install_package python3-devel python3-dbm
     elif is_fedora; then
         if [ "$os_VENDOR" = "Fedora" ]; then
             install_package python${PYTHON3_VERSION//.}
diff --git a/lib/apache b/lib/apache
index dd8c9a0f06..4d68b49767 100644
--- a/lib/apache
+++ b/lib/apache
@@ -44,10 +44,6 @@ elif is_fedora; then
     APACHE_NAME=httpd
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/conf.d}
     APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
-elif is_suse; then
-    APACHE_NAME=apache2
-    APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/vhosts.d}
-    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
 fi
 APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 
@@ -65,11 +61,6 @@ function enable_apache_mod {
             sudo a2enmod $mod
             restart_apache_server
         fi
-    elif is_suse; then
-        if ! a2enmod -q $mod ; then
-            sudo a2enmod $mod
-            restart_apache_server
-        fi
     elif is_fedora; then
         # pass
         true
@@ -104,10 +95,6 @@ function install_apache_uwsgi {
         # Thus there is nothing else to do after this install
         install_package uwsgi \
                         uwsgi-plugin-python3
-    elif [[ $os_VENDOR =~ openSUSE ]]; then
-        install_package uwsgi \
-                        uwsgi-python3 \
-                        apache2-mod_uwsgi
     else
         # Compile uwsgi from source.
         local dir
@@ -125,7 +112,7 @@ function install_apache_uwsgi {
         sudo rm -rf $dir
     fi
 
-    if is_ubuntu || is_suse ; then
+    if is_ubuntu; then
         # we've got to enable proxy and proxy_uwsgi for this to work
         sudo a2enmod proxy
         sudo a2enmod proxy_uwsgi
@@ -155,8 +142,6 @@ function install_apache_wsgi {
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
         sudo sed -i '/mod_mpm_event.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
         sudo sed -i '/mod_mpm_worker.so/s/^#//g' /etc/httpd/conf.modules.d/00-mpm.conf
-    elif is_suse; then
-        install_package apache2 apache2-mod_wsgi
     else
         exit_distro_not_supported "apache wsgi installation"
     fi
@@ -171,7 +156,7 @@ function install_apache_wsgi {
 # recognise it. a2ensite and a2dissite ignore the .conf suffix used as parameter. The default sites'
 # files are 000-default.conf and default-ssl.conf.
 #
-# On Fedora and openSUSE, any file in /etc/httpd/conf.d/ whose name ends with .conf is enabled.
+# On Fedora, any file in /etc/httpd/conf.d/ whose name ends with .conf is enabled.
 #
 # On RHEL and CentOS, things should hopefully work as in Fedora.
 #
@@ -187,7 +172,7 @@ function apache_site_config_for {
     if is_ubuntu; then
         # Ubuntu 14.04 - Apache 2.4
         echo $APACHE_CONF_DIR/${site}.conf
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         # fedora conf.d is only imported if it ends with .conf so this is approx the same
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         if [ -f $enabled_site_file ]; then
@@ -205,7 +190,7 @@ function enable_apache_site {
     enable_apache_mod version
     if is_ubuntu; then
         sudo a2ensite ${site}
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         # Do nothing if site already enabled or no site config exists
         if [[ -f ${enabled_site_file}.disabled ]] && [[ ! -f ${enabled_site_file} ]]; then
@@ -219,7 +204,7 @@ function disable_apache_site {
     local site=$@
     if is_ubuntu; then
         sudo a2dissite ${site} || true
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         # Do nothing if no site config exists
         if [[ -f ${enabled_site_file} ]]; then
diff --git a/lib/cinder b/lib/cinder
index 2424f928d1..602e8dad0e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -117,8 +117,8 @@ else
 fi
 
 
-# EL and SUSE should only use lioadm
-if is_fedora || is_suse; then
+# EL should only use lioadm
+if is_fedora; then
     if [[ ${CINDER_TARGET_HELPER} != "lioadm" && ${CINDER_TARGET_HELPER} != 'nvmet' ]]; then
         die "lioadm and nvmet are the only valid Cinder target_helper config on this platform"
     fi
@@ -595,11 +595,6 @@ function start_cinder {
             _configure_tgt_for_config_d
             if is_ubuntu; then
                 sudo service tgt restart
-            elif is_suse; then
-                # NOTE(dmllr): workaround restart bug
-                # https://bugzilla.suse.com/show_bug.cgi?id=934642
-                stop_service tgtd
-                start_service tgtd
             else
                 restart_service tgtd
             fi
diff --git a/lib/databases/mysql b/lib/databases/mysql
index fbad44e36a..ed8006e7db 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -20,12 +20,6 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
     if is_fedora && ! is_oraclelinux; then
         MYSQL_SERVICE_NAME=mariadb
-    elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
-        # Older mariadb packages on SLES 12 provided mysql.service.  The
-        # newer ones on SLES 12 and 15 use mariadb.service; they also
-        # provide a mysql.service symlink for backwards-compatibility, but
-        # let's not rely on that.
-        MYSQL_SERVICE_NAME=mariadb
     elif [[ "$DISTRO" == "bullseye" ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
@@ -54,7 +48,7 @@ function cleanup_database_mysql {
     elif is_oraclelinux; then
         uninstall_package mysql-community-server
         sudo rm -rf /var/lib/mysql
-    elif is_suse || is_fedora; then
+    elif is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
     else
@@ -74,7 +68,7 @@ function configure_database_mysql {
 
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
-    elif is_suse || is_oraclelinux; then
+    elif is_oraclelinux; then
         my_conf=/etc/my.cnf
     elif is_fedora; then
         my_conf=/etc/my.cnf
@@ -90,7 +84,7 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
 
     # (Re)Start mysql-server
-    if is_fedora || is_suse; then
+    if is_fedora; then
         # service is not started by default
         start_service $MYSQL_SERVICE_NAME
     elif is_ubuntu; then
@@ -212,9 +206,6 @@ EOF
         elif is_fedora; then
             install_package mariadb-server mariadb-devel mariadb
             sudo systemctl enable $MYSQL_SERVICE_NAME
-        elif is_suse; then
-            install_package mariadb-server
-            sudo systemctl enable $MYSQL_SERVICE_NAME
         elif is_ubuntu; then
             install_package $MYSQL_SERVICE_NAME-server
         else
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 4f0a5a0a4c..b21418b75e 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -32,7 +32,7 @@ function cleanup_database_postgresql {
         # Get ruthless with mysql
         apt_get purge -y postgresql*
         return
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         uninstall_package postgresql-server
     else
         return
@@ -66,11 +66,6 @@ function configure_database_postgresql {
         pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
         pg_hba=$pg_dir/pg_hba.conf
         pg_conf=$pg_dir/postgresql.conf
-    elif is_suse; then
-        pg_hba=/var/lib/pgsql/data/pg_hba.conf
-        pg_conf=/var/lib/pgsql/data/postgresql.conf
-        # initdb is called when postgresql is first started
-        sudo [ -e $pg_hba ] || start_service postgresql
     else
         exit_distro_not_supported "postgresql configuration"
     fi
@@ -107,7 +102,7 @@ EOF
     if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
         if is_ubuntu; then
             install_package postgresql
-        elif is_fedora || is_suse; then
+        elif is_fedora; then
             install_package postgresql-server
             if is_fedora; then
                 sudo systemctl enable postgresql
diff --git a/lib/glance b/lib/glance
index 041acafc92..5aeae16c61 100644
--- a/lib/glance
+++ b/lib/glance
@@ -47,10 +47,6 @@ USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # from CINDER_ENABLED_BACKENDS
 GLANCE_CINDER_DEFAULT_BACKEND=${GLANCE_CINDER_DEFAULT_BACKEND:-lvmdriver-1}
 GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
-# NOTE (abhishekk): For opensuse data files are stored in different directory
-if is_opensuse; then
-    GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/etc/glance
-fi
 # When Cinder is used as a glance store, you can optionally configure cinder to
 # optimize bootable volume creation by allowing volumes to be cloned directly
 # in the backend instead of transferring data via Glance.  To use this feature,
diff --git a/lib/horizon b/lib/horizon
index b2bf7bcb49..f76f9e557d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -129,7 +129,7 @@ function configure_horizon {
     if is_ubuntu; then
         disable_apache_site 000-default
         sudo touch $horizon_conf
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         : # nothing to do
     else
         exit_distro_not_supported "horizon apache configuration"
diff --git a/lib/ldap b/lib/ldap
index ea5faa1fe9..b0195db258 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -39,13 +39,6 @@ elif is_fedora; then
     LDAP_OLCDB_NUMBER=2
     LDAP_OLCDB_TYPE=hdb
     LDAP_ROOTPW_COMMAND=add
-elif is_suse; then
-    # SUSE has slappasswd in /usr/sbin/
-    PATH=$PATH:/usr/sbin/
-    LDAP_OLCDB_NUMBER=1
-    LDAP_OLCDB_TYPE=hdb
-    LDAP_ROOTPW_COMMAND=add
-    LDAP_SERVICE_NAME=ldap
 fi
 
 
@@ -76,8 +69,6 @@ function cleanup_ldap {
         sudo rm -rf /etc/ldap/ldap.conf /var/lib/ldap
     elif is_fedora; then
         sudo rm -rf /etc/openldap /var/lib/ldap
-    elif is_suse; then
-        sudo rm -rf /var/lib/ldap
     fi
 }
 
@@ -126,11 +117,6 @@ function install_ldap {
         configure_ldap
     elif is_fedora; then
         start_ldap
-    elif is_suse; then
-        _ldap_varsubst $FILES/ldap/suse-base-config.ldif.in >$tmp_ldap_dir/suse-base-config.ldif
-        sudo slapadd -F /etc/openldap/slapd.d/ -bcn=config -l $tmp_ldap_dir/suse-base-config.ldif
-        sudo sed -i '/^OPENLDAP_START_LDAPI=/s/"no"/"yes"/g' /etc/sysconfig/openldap
-        start_ldap
     fi
 
     echo "LDAP_PASSWORD is $LDAP_PASSWORD"
diff --git a/lib/lvm b/lib/lvm
index 57ffb967c3..57d2cd4e62 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -129,8 +129,8 @@ function init_lvm_volume_group {
     local vg=$1
     local size=$2
 
-    # Start the tgtd service on Fedora and SUSE if tgtadm is used
-    if  is_fedora || is_suse  && [[ "$CINDER_TARGET_HELPER" = "tgtadm" ]]; then
+    # Start the tgtd service on Fedora if tgtadm is used
+    if  is_fedora; then
         start_service tgtd
     fi
 
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index cc41a8cd46..adabc56412 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -80,19 +80,6 @@ function _neutron_ovs_base_install_agent_packages {
         elif is_fedora; then
             restart_service openvswitch
             sudo systemctl enable openvswitch
-        elif is_suse; then
-            if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
-                restart_service openvswitch-switch
-            else
-                # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
-                if [[ $DISTRO =~ "tumbleweed" ]]; then
-                    sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
-                fi
-                restart_service openvswitch || {
-                    journalctl -xe || :
-                    systemctl status openvswitch
-                }
-            fi
         fi
     fi
 }
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index ea71e60e68..288eb1d69b 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -182,12 +182,6 @@ function action_openvswitch {
         ${action}_service openvswitch-switch
     elif is_fedora; then
         ${action}_service openvswitch
-    elif is_suse; then
-        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
-            ${action}_service openvswitch-switch
-        else
-            ${action}_service openvswitch
-        fi
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 3aa6b9e3b3..f34e823074 100644
--- a/lib/nova
+++ b/lib/nova
@@ -448,8 +448,8 @@ function create_nova_conf {
 
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
-    if is_fedora || is_suse; then
-        # nova defaults to /usr/local/bin, but fedora and suse pip like to
+    if is_fedora; then
+        # nova defaults to /usr/local/bin, but fedora pip like to
         # install things in /usr/bin
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
@@ -523,7 +523,7 @@ function create_nova_conf {
 
     # nova defaults to genisoimage but only mkisofs is available for 15.0+
     # rhel provides mkisofs symlink to genisoimage or xorriso appropiately
-    if is_suse || is_fedora; then
+    if is_fedora; then
         iniset $NOVA_CONF DEFAULT mkisofs_cmd /usr/bin/mkisofs
     fi
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index c0e45ebb85..799230603c 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -74,7 +74,7 @@ function install_libvirt {
             install_package qemu-efi
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
 
         # Optionally enable the virt-preview repo when on Fedora
         if [[ $DISTRO =~ f[0-9][0-9] ]] && [[ ${ENABLE_FEDORA_VIRT_PREVIEW_REPO} == "True" ]]; then
@@ -121,8 +121,8 @@ cgroup_device_acl = [
 EOF
     fi
 
-    if is_fedora || is_suse; then
-        # Starting with fedora 18 and opensuse-12.3 enable stack-user to
+    if is_fedora; then
+        # Starting with fedora 18 enable stack-user to
         # virsh -c qemu:///system by creating a policy-kit rule for
         # stack-user using the new Javascript syntax
         rules_dir=/etc/polkit-1/rules.d
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index c1cd132548..87c3d3addc 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -114,9 +114,6 @@ function install_nova_hypervisor {
                     sudo dpkg-statoverride --add --update $STAT_OVERRIDE
                 fi
             done
-        elif is_suse; then
-            # Workaround for missing dependencies in python-libguestfs
-            install_package python-libguestfs guestfs-data augeas augeas-lenses
         elif is_fedora; then
             install_package python3-libguestfs
         fi
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 743b4ae170..bbb41499be 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -52,20 +52,7 @@ function install_rpc_backend {
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-        if is_suse; then
-            install_package rabbitmq-server-plugins
-            # the default systemd socket activation only listens on the loopback interface
-            # which causes rabbitmq to try to start its own epmd
-            sudo mkdir -p /etc/systemd/system/epmd.socket.d
-            cat <<EOF | sudo tee /etc/systemd/system/epmd.socket.d/ports.conf >/dev/null
-[Socket]
-ListenStream=
-ListenStream=[::]:4369
-EOF
-            sudo systemctl daemon-reload
-            sudo systemctl restart epmd.socket epmd.service
-        fi
-        if is_fedora || is_suse; then
+        if is_fedora; then
             # NOTE(jangutter): If rabbitmq is not running (as in a fresh
             # install) then rabbit_setuser triggers epmd@0.0.0.0.socket with
             # socket activation. This fails the first time and does not get
diff --git a/lib/swift b/lib/swift
index 251c4625b5..1ebf073318 100644
--- a/lib/swift
+++ b/lib/swift
@@ -547,9 +547,6 @@ function configure_swift {
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
     sudo rm -rf ${swift_log_dir}
     local swift_log_group=adm
-    if is_suse; then
-        swift_log_group=root
-    fi
     sudo install -d -o ${STACK_USER} -g ${swift_log_group} ${swift_log_dir}/hourly
 
     if [[ $SYSLOG != "False" ]]; then
diff --git a/lib/tls b/lib/tls
index b8758cd6d3..e0c7500b20 100644
--- a/lib/tls
+++ b/lib/tls
@@ -212,9 +212,6 @@ function init_CA {
     if is_fedora; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
         sudo update-ca-trust
-    elif is_suse; then
-        sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/trust/anchors/devstack-chain.pem
-        sudo update-ca-certificates
     elif is_ubuntu; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/local/share/ca-certificates/devstack-int.crt
         sudo cp $ROOT_CA_DIR/cacert.pem /usr/local/share/ca-certificates/devstack-root.crt
@@ -376,9 +373,6 @@ function fix_system_ca_bundle_path {
             elif is_ubuntu; then
                 sudo rm -f $capath
                 sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
-            elif is_suse; then
-                sudo rm -f $capath
-                sudo ln -s /etc/ssl/ca-bundle.pem $capath
             else
                 echo "Don't know how to set the CA bundle, expect the install to fail."
             fi
@@ -441,9 +435,6 @@ function enable_mod_ssl {
 
     if is_ubuntu; then
         sudo a2enmod ssl
-    elif is_suse; then
-        sudo a2enmod ssl
-        sudo a2enflag SSL
     elif is_fedora; then
         # Fedora enables mod_ssl by default
         :
@@ -560,9 +551,6 @@ $listen_string
     CustomLog $APACHE_LOG_DIR/tls-proxy_access.log combined
 </VirtualHost>
 EOF
-    if is_suse ; then
-        sudo a2enflag SSL
-    fi
     for mod in headers ssl proxy proxy_http; do
         enable_apache_mod $mod
     done
diff --git a/stack.sh b/stack.sh
index 28576d1e14..8d450aadc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f36|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
diff --git a/tests/test_package_ordering.sh b/tests/test_package_ordering.sh
index bfc2a1954f..f221c821a0 100755
--- a/tests/test_package_ordering.sh
+++ b/tests/test_package_ordering.sh
@@ -8,7 +8,7 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/tests/unittest.sh
 
 export LC_ALL=en_US.UTF-8
-PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms $TOP/files/rpms-suse -type f)
+PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms -type f)
 
 TMPDIR=$(mktemp -d)
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index daa1bc6301..0ec426b601 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -90,45 +90,6 @@ function fixup_fedora {
     fi
 }
 
-function fixup_suse {
-    if ! is_suse; then
-        return
-    fi
-
-    # Deactivate and disable apparmor profiles in openSUSE and SLE
-    # distros to avoid issues with haproxy and dnsmasq.  In newer
-    # releases, systemctl stop apparmor is actually a no-op, so we
-    # have to use aa-teardown to make sure we've deactivated the
-    # profiles:
-    #
-    # https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-325343
-    # https://gitlab.com/apparmor/apparmor/merge_requests/81
-    # https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/apparmor/apparmor.service?expand=1
-    if sudo systemctl is-active -q apparmor; then
-        sudo systemctl stop apparmor
-    fi
-    if [ -x /usr/sbin/aa-teardown ]; then
-        sudo /usr/sbin/aa-teardown
-    fi
-    if sudo systemctl is-enabled -q apparmor; then
-        sudo systemctl disable apparmor
-    fi
-
-    # Since pip10, pip will refuse to uninstall files from packages
-    # that were created with distutils (rather than more modern
-    # setuptools).  This is because it technically doesn't have a
-    # manifest of what to remove.  However, in most cases, simply
-    # overwriting works.  So this hacks around those packages that
-    # have been dragged in by some other system dependency
-    sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
-    sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
-
-    # Ensure trusted CA certificates are up to date
-    # See https://bugzilla.suse.com/show_bug.cgi?id=1154871
-    # May be removed once a new opensuse-15 image is available in nodepool
-    sudo zypper up -y p11-kit ca-certificates-mozilla
-}
-
 function fixup_ovn_centos {
     if [[ $os_VENDOR != "CentOS" ]]; then
         return
@@ -156,5 +117,4 @@ function fixup_ubuntu {
 function fixup_all {
     fixup_ubuntu
     fixup_fedora
-    fixup_suse
 }
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index a7c03d26cd..f2d57c8451 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -74,8 +74,6 @@ install_package $PACKAGES
 if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     if is_ubuntu || is_fedora; then
         install_package rsyslog-relp
-    elif is_suse; then
-        install_package rsyslog-module-relp
     else
         exit_distro_not_supported "rsyslog-relp installation"
     fi

From 7567359755a105e7278bbf97541332f28228b87d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 13 Feb 2023 14:41:40 +0000
Subject: [PATCH 3058/3333] Try to reduce mysql memory usage

These are a few tweaks I applied to my own memory-constrained cloud
instances that seemed to help. I have lower performance requirements
so this may make things worse and not better, but it's worth seeing
what the impact is. I'll admit to not knowing the full impact of these
as they're mostly collected from various tutorials on lowering memory
usage.

Enable this for now on devstack-multinode

Change-Id: I7b223391d3de01e3e81b02076debd01d9d2f097c
---
 .zuul.yaml          |  3 +++
 lib/databases/mysql | 10 ++++++++++
 stackrc             |  5 +++++
 3 files changed, 18 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8e20f6ed34..fa7f180797 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -696,6 +696,9 @@
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
+    vars:
+      devstack_localrc:
+        MYSQL_REDUCE_MEMORY: true
 
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
diff --git a/lib/databases/mysql b/lib/databases/mysql
index fbad44e36a..e805b3e73f 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -176,6 +176,16 @@ function configure_database_mysql {
                 count INT, PRIMARY KEY (db, op)) ENGINE MEMORY" stats
     fi
 
+    if [[ "$MYSQL_REDUCE_MEMORY" == "True" ]]; then
+        iniset -sudo $my_conf mysqld read_buffer_size 64K
+        iniset -sudo $my_conf mysqld innodb_buffer_pool_size 16M
+        iniset -sudo $my_conf mysqld thread_stack 192K
+        iniset -sudo $my_conf mysqld thread_cache_size 8
+        iniset -sudo $my_conf mysqld tmp_table_size 8M
+        iniset -sudo $my_conf mysqld sort_buffer_size 8M
+        iniset -sudo $my_conf mysqld max_allowed_packet 8M
+    fi
+
     restart_service $MYSQL_SERVICE_NAME
 }
 
diff --git a/stackrc b/stackrc
index a05d1e5553..442e9a0351 100644
--- a/stackrc
+++ b/stackrc
@@ -201,6 +201,11 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # performance_schema that are of interest to us
 MYSQL_GATHER_PERFORMANCE=$(trueorfalse True MYSQL_GATHER_PERFORMANCE)
 
+# This can be used to reduce the amount of memory mysqld uses while running.
+# These are unscientifically determined, and could reduce performance or
+# cause other issues.
+MYSQL_REDUCE_MEMORY=$(trueorfalse False MYSQL_REDUCE_MEMORY)
+
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is
 # in the format for timeout(1);

From 37d11d00e56ec6ff402a13a28ec308c13291a937 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 21 Feb 2023 21:41:40 +0000
Subject: [PATCH 3059/3333] Revert "Bump cirros version to 0.6.1"

This reverts commit 91efe177b170c3874989affc73842dc4ffbe062d.

Reason for revert: it broke tempest-slow job https://9afe3d390e4175b60a80-89b1085289883615a17bd93ef47f6ca9.ssl.cf5.rackcdn.com/871018/13/gate/tempest-slow-py3/d139ae1/testr_results.html

Change-Id: Ib74e51a780d3e8101f4147db9d24eebea4980fb1
---
 doc/source/guides/nova.rst |  2 +-
 stackrc                    | 15 ++++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index d0fb274c13..5b427972c4 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
+      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index a71d843362..b3130e5f7f 100644
--- a/stackrc
+++ b/stackrc
@@ -657,19 +657,20 @@ esac
 #     If the file ends in .tar.gz, uncompress the tarball and and select the first
 #     .img file inside it as the image.  If present, use "*-vmlinuz*" as the kernel
 #     and "*-initrd*" as the ramdisk
-#     example: https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.tar.gz
+#     example: http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-amd64.tar.gz
 #  * disk image (*.img,*.img.gz)
 #    if file ends in .img, then it will be uploaded and registered as a to
 #    glance as a disk image.  If it ends in .gz, it is uncompressed first.
 #    example:
-#      https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.img
-#      https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
+#      http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-armel-disk1.img
+#      http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
 #  * OpenVZ image:
 #    OpenVZ uses its own format of image, and does not support UEC style images
 
-#IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
+#IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
+#IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -686,11 +687,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)

From 0572d73f8561f3304f897bf9ee2f63c406cc21b7 Mon Sep 17 00:00:00 2001
From: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Date: Wed, 22 Feb 2023 10:38:49 +0900
Subject: [PATCH 3060/3333] Disable memory_tracker and file_tracker in
 unstask.sh properly

stop_dstat() calls stop_process() for dstat, memory_tracker and
file_tracker respectively. Inside stop_process(), a check for the
existence of the service is performed by is_service_enabled().

So even if we apply this seemingly dangerous commit,
is_service_enabled() is respected, so it's safe.

Closes-Bug: #1998990
Change-Id: Ica58cdb1d60c4c796f582d82ed2cde0be94b1a7e
Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
---
 unstack.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index a36af3fb59..33b069b6a3 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -168,9 +168,7 @@ if is_service_enabled etcd3; then
     cleanup_etcd3
 fi
 
-if is_service_enabled dstat; then
-    stop_dstat
-fi
+stop_dstat
 
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are

From 03c3fd763e301077ecfa0a2d3428a091bedd691d Mon Sep 17 00:00:00 2001
From: Yamato Tanaka <yatanaka@redhat.com>
Date: Fri, 10 Feb 2023 19:44:20 +0900
Subject: [PATCH 3061/3333] Support RHEL 9

This patch includes changes required to run devstack on RHEL 9.

- en_US.utf8 is provided by glibc-langpack-en
- iptables command is provided by iptables-nft
- Use /etc/os-release to identify the distro in RHEL 9 as it doesn't
  provide lsb_release command.
- CRB repository name is different from CentOS 9

Change-Id: I8f6d9263b24f9c2cf82e09258e2d14d7766ad337
---
 files/rpms/general | 2 ++
 functions-common   | 5 +++--
 stack.sh           | 3 +++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index b6866de62d..8a5755cc37 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -6,9 +6,11 @@ gcc
 gcc-c++
 gettext  # used for compiling message catalogs
 git-core
+glibc-langpack-en # dist:rhel9
 graphviz # needed only for docs
 httpd
 httpd-devel
+iptables-nft # dist:rhel9
 iptables-services
 java-1.8.0-openjdk-headless
 libffi-devel
diff --git a/functions-common b/functions-common
index 4eed5d8407..3e07a49e22 100644
--- a/functions-common
+++ b/functions-common
@@ -412,9 +412,9 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # CentOS Stream 9 does not provide lsb_release
+    # CentOS Stream 9 and RHEL 9 do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" == "centos9" ]]; then
+    if [[ "${ID}${VERSION}" == "centos9" ]] || [[ "${ID}${VERSION}" =~ "rhel9" ]]; then
         os_RELEASE=${VERSION_ID}
         os_CODENAME="n/a"
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
@@ -530,6 +530,7 @@ function is_fedora {
         [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
+        [ "$os_VENDOR" = "RedHatEnterpriseLinux" ] || \
         [ "$os_VENDOR" = "Rocky" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
diff --git a/stack.sh b/stack.sh
index ccd2d16baa..6e7b11a0bc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -391,7 +391,10 @@ if [[ $DISTRO == "rhel8" ]]; then
     # Patch: https://github.com/rpm-software-management/dnf/pull/1448
     echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
 elif [[ $DISTRO == "rhel9" ]]; then
+    # for CentOS Stream 9 repository
     sudo dnf config-manager --set-enabled crb
+    # for RHEL 9 repository
+    sudo dnf config-manager --set-enabled codeready-builder-for-rhel-9-x86_64-rpms
     # rabbitmq and other packages are provided by RDO repositories.
     _install_rdo
 

From f834f9adaf9c228ff4ec6a5e24e6d4cf3ca6a992 Mon Sep 17 00:00:00 2001
From: Michael Johnson <johnsomor@gmail.com>
Date: Mon, 6 Mar 2023 18:47:03 +0000
Subject: [PATCH 3062/3333] Fix NotImplementedError in dbcounter on SQLA 2.x

This patch fixes a NotImplementedError raised in the dbcounter plugin when using SQLAlchemy 2.x. The plugin signature has changed and now requires an "update_url" method as part of the plugin[1].
This patch also updates the do_incr() explicit SQL string to use a TextClause and the new requirement for named bound parameters[2].

Closes-Bug: #2009521

[1] https://docs.sqlalchemy.org/en/20/changelog/migration_14.html#changes-to-createengineplugin
[2] https://docs.sqlalchemy.org/en/20/changelog/migration_20.html#execute-method-more-strict-execution-options-are-more-prominent

Change-Id: Ie5484597057a3306757cc46b657446ad61ac2098
---
 ...ementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml |  5 +++++
 tools/dbcounter/dbcounter.py                          | 11 +++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml

diff --git a/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml b/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
new file mode 100644
index 0000000000..f815e14ccb
--- /dev/null
+++ b/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes a NotImplementedError when using the dbcounter SQLAlchemy plugin on
+    SQLAlchemy 2.x.
diff --git a/tools/dbcounter/dbcounter.py b/tools/dbcounter/dbcounter.py
index 5057f0f393..0ed7bb813a 100644
--- a/tools/dbcounter/dbcounter.py
+++ b/tools/dbcounter/dbcounter.py
@@ -40,6 +40,9 @@ def __init__(self, url, kwargs):
         self.queue = queue.Queue()
         self.thread = None
 
+    def update_url(self, url):
+        return url.difference_update_query(["dbcounter"])
+
     def engine_created(self, engine):
         """Hook the engine creation process.
 
@@ -77,12 +80,12 @@ def _log_event(self, conn, cursor, statement, parameters, context,
     def do_incr(self, db, op, count):
         """Increment the counter for (db,op) by count."""
 
-        query = ('INSERT INTO queries (db, op, count) '
-                 '  VALUES (%s, %s, %s) '
-                 '  ON DUPLICATE KEY UPDATE count=count+%s')
+        query = sqlalchemy.text('INSERT INTO queries (db, op, count) '
+                                '  VALUES (:db, :op, :count) '
+                                '  ON DUPLICATE KEY UPDATE count=count+:count')
         try:
             with self.engine.begin() as conn:
-                r = conn.execute(query, (db, op, count, count))
+                r = conn.execute(query, {'db': db, 'op': op, 'count': count})
         except Exception as e:
             LOG.error('Failed to account for access to database %r: %s',
                       db, e)

From 07a7293721736e1184ae7dc22da33b2ce7babf61 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 10 Mar 2023 20:30:53 -0600
Subject: [PATCH 3063/3333] Update DEVSTACK_SERIES to 2023.2

stable/2023.1 branch has been created now and
current master is for 2023.2.

Change-Id: Ibd499ac35a38a5c1818c1df6009c5273ef3e90f7
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 442e9a0351..b7ce238366 100644
--- a/stackrc
+++ b/stackrc
@@ -248,7 +248,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2023.1"
+DEVSTACK_SERIES="2023.2"
 
 ##############
 #

From 1898a683be78622445e48f1f071cf7188ab19450 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 14 Mar 2023 05:35:33 +0000
Subject: [PATCH 3064/3333] Create multiattach volume type for tempest

Creating multiattach volume is a non-admin operation but creating
multiattach volume type is an admin operation.
Previously cinder allowed creating multiattach volumes without a
volume type but that support is being removed with[1].
The change requires updating tempest tests[2] but some tempest
tests are non-admin, which require admin priviledges to create the
multiattach volume type.
Based on the last discussion with tempest team[3], the proposed
solution is to create a multiattach volume type in devstack,
if ENABLE_VOLUME_MULTIATTACH is True, and use it in tempest
tests. Similar to how admins create multiattach volume types
for non-admin users.

This patch creates a multiattach volume type if
ENABLE_VOLUME_MULTIATTACH is True. Also we set the multiattach
type name as a tempest config option 'volume_type_multiattach'.

[1] https://review.opendev.org/c/openstack/cinder/+/874865
[2] https://review.opendev.org/c/openstack/tempest/+/875372
[3] https://meetings.opendev.org/irclogs/%23openstack-cinder/%23openstack-cinder.2023-03-13.log.html#t2023-03-13T18:47:56

Change-Id: Icd3690565bf7b27898cd206641e612da3993703d
---
 lib/cinder  | 34 +++++++++++++++++++++++-----------
 lib/tempest |  4 ++++
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2424f928d1..c50a205f20 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -95,6 +95,7 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
+VOLUME_TYPE_MULTIATTACH=${VOLUME_TYPE_MULTIATTACH:-multiattach}
 
 if [[ -n "$CINDER_ISCSI_HELPER" ]]; then
     if [[ -z "$CINDER_TARGET_HELPER" ]]; then
@@ -649,6 +650,23 @@ function stop_cinder {
     stop_process c-vol
 }
 
+function create_one_type {
+    type_name=$1
+    property_key=$2
+    property_value=$3
+    # NOTE (e0ne): openstack client doesn't work with cinder in noauth mode
+    if is_service_enabled keystone; then
+        openstack --os-region-name="$REGION_NAME" volume type create --property $property_key="$property_value" $type_name
+    else
+        # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
+        # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
+        local cinder_url
+        cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
+        OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create $type_name
+        OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key $type_name set $property_key="$property_value"
+    fi
+}
+
 # create_volume_types() - Create Cinder's configured volume types
 function create_volume_types {
     # Create volume types
@@ -656,19 +674,13 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            # NOTE (e0ne): openstack client doesn't work with cinder in noauth mode
-            if is_service_enabled keystone; then
-                openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
-            else
-                # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
-                # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
-                local cinder_url
-                cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
-                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create ${be_name}
-                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key ${be_name} set volume_backend_name=${be_name}
-            fi
+            create_one_type $be_name "volume_backend_name" $be_name
         done
 
+        if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
+            create_one_type $VOLUME_TYPE_MULTIATTACH $VOLUME_TYPE_MULTIATTACH "<is> True"
+        fi
+
         # Increase quota for the service project if glance is using cinder,
         # since it's likely to occasionally go above the default 10 in parallel
         # test execution.
diff --git a/lib/tempest b/lib/tempest
index c3d3e9ac30..7da9f17052 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -604,6 +604,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
+    if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
+        iniset $TEMPEST_CONFIG volume volume_type_multiattach $VOLUME_TYPE_MULTIATTACH
+    fi
+
     # Placement Features
     # Set the microversion range for placement.
     # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.

From 80c3ffe154fd79e03d8c4258b500b77a26efa008 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 27 Mar 2023 20:56:20 +0000
Subject: [PATCH 3065/3333] Fix reboot on fedora like nodes

This change enables httpd in systemd so that it
starts after a reboot and updates how selinux is
disabled to use /etc/selinux/config in addtion
to setenforce.

Change-Id: I5ea8693c0b967937483bd921b1d9984ea14bc723
---
 lib/apache           | 2 ++
 tools/fixup_stuff.sh | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/lib/apache b/lib/apache
index dd8c9a0f06..771a7d7ec0 100644
--- a/lib/apache
+++ b/lib/apache
@@ -150,6 +150,8 @@ function install_apache_wsgi {
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd python3-mod_wsgi
+        # rpm distros dont enable httpd by default so enable it to support reboots.
+        sudo systemctl enable httpd
         # For consistency with Ubuntu, switch to the worker mpm, as
         # the default is event
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index daa1bc6301..fef47263de 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -36,6 +36,12 @@ function fixup_fedora {
     # Disable selinux to avoid configuring to allow Apache access
     # to Horizon files (LP#1175444)
     if selinuxenabled; then
+        #persit selinux config across reboots
+        cat << EOF | sudo tee /etc/selinux/config
+SELINUX=permissive
+SELINUXTYPE=targeted
+EOF
+        # then disable at runtime
         sudo setenforce 0
     fi
 

From fa42b3ca7bbac7746644693241ea1dd58a4939f0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 14 Apr 2023 02:16:59 +0000
Subject: [PATCH 3066/3333] Updated from generate-devstack-plugins-list

Change-Id: I84015f860155e5c8ec3bcf54353d91405a13e549
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2e8e8f53d7..b244ca5dd8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -88,7 +88,6 @@ openstack/openstacksdk                   `https://opendev.org/openstack/openstac
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
 openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
-openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__

From 42517968ff7bdced07c5bc08b6cb2b8d10d246cc Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 14 Apr 2023 19:06:03 +0530
Subject: [PATCH 3067/3333] [ovs] Reload ovs kernel module always

Irrespective of build_modules is True
or False reload ovs modules always.

If ovs is installed from package before(like
with multi-node-bridge role), then installing
ovs from source requires openvswitch kernel
module to be reloaded.

The issue was not seen before jammy as there
module was reloaded when build_modules was set
to True.

Closes-Bug: #2015364
Change-Id: I1785b49b2ef72ca1f817f504d5ea56021410c052
---
 lib/neutron_plugins/ovs_source | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index ea71e60e68..d0ca75334e 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -164,10 +164,8 @@ function compile_ovs {
     sudo make install
     if [[ "$build_modules" == "True" ]]; then
         sudo make INSTALL_MOD_DIR=kernel/net/openvswitch modules_install
-        reload_ovs_kernel_modules
-    else
-        load_ovs_kernel_modules
     fi
+    reload_ovs_kernel_modules
 
     cd $_pwd
 }

From 15b2e429685fc753759ef8f3773ac559424e028f Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Tue, 24 Jan 2023 14:44:13 +0100
Subject: [PATCH 3068/3333] Modify devstack-base to allow for fips

devstack-base is changed to descend from
openstack-multinode-fips which is defined in
project-config.

This allows jobs to execute the enable_fips playbook
to enable FIPS mode on the node, but only if they
opt-in by setting enable_fips to True.  Otherwise,
this is a no-op.

Change-Id: I5631281662dbd18056ffba291290ed0978ab937e
---
 .zuul.yaml          |  2 +-
 functions-common    |  5 +++++
 lib/databases/mysql | 11 ++++++++++-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fa7f180797..37625f3d11 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -370,7 +370,7 @@
 
 - job:
     name: devstack-base
-    parent: multinode
+    parent: openstack-multinode-fips
     abstract: true
     description: |
       Base abstract Devstack job.
diff --git a/functions-common b/functions-common
index 4eed5d8407..844fffac37 100644
--- a/functions-common
+++ b/functions-common
@@ -2545,6 +2545,11 @@ function clean_pyc_files {
     fi
 }
 
+function is_fips_enabled {
+    fips=`cat /proc/sys/crypto/fips_enabled`
+    [ "$fips" == "1" ]
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/lib/databases/mysql b/lib/databases/mysql
index e805b3e73f..bc6ce3d5c2 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -69,7 +69,7 @@ function recreate_database_mysql {
 }
 
 function configure_database_mysql {
-    local my_conf mysql slow_log
+    local my_conf mysql slow_log my_client_conf
     echo_summary "Configuring and starting MySQL"
 
     if is_ubuntu; then
@@ -86,6 +86,15 @@ function configure_database_mysql {
         exit_distro_not_supported "mysql configuration"
     fi
 
+    # Set fips mode on
+    if is_ubuntu; then
+        if is_fips_enabled; then
+            my_client_conf=/etc/mysql/mysql.conf.d/mysql.cnf
+            iniset -sudo $my_client_conf mysql ssl-fips-mode "on"
+            iniset -sudo $my_conf mysqld ssl-fips-mode "on"
+        fi
+    fi
+
     # Change bind-address from localhost (127.0.0.1) to any (::)
     iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
 

From 991a2794a3d6424f3b25cde471342846f9876470 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 17 Apr 2023 13:00:21 +0530
Subject: [PATCH 3069/3333] Fix name for neutron tempest uwsgi job

This was renamed long back in [1].

[1] https://review.opendev.org/c/openstack/neutron/+/797051

Change-Id: If11e975fd890f55f99efc2c7d8122256ff831ad8
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fa7f180797..98f3353319 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1047,7 +1047,7 @@
     # * neutron-functional-with-uwsgi: maintained by neutron for functional
     #    test. Next cycle we can remove this one if things turn out to be
     #    stable engouh with uwsgi.
-    # * neutron-tempest-with-uwsgi: maintained by neutron for tempest test.
+    # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
     #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and currently non-voting in the
     #    check queue for nova changes but relies on devstack configuration
@@ -1062,7 +1062,7 @@
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
-        - neutron-tempest-with-uwsgi
+        - neutron-ovn-tempest-with-uwsgi
         - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$

From e8915786e1e007742f47fee507b1b6288b6cedae Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 19 Apr 2023 16:57:44 -0400
Subject: [PATCH 3070/3333] git: support git checkout for a commit hash

git_clone assumes a branch or a tag is passed as the last argument, and
it fails when a commit hash is passed, as in:

timeout -s SIGINT 0 git clone https://github.com/ovn-org/ovn.git
/opt/stack/ovn --branch 36e3ab9b47e93af0599a818e9d6b2930e49473f0
Cloning into '/opt/stack/ovn'...
fatal: Remote branch 36e3ab9b47e93af0599a818e9d6b2930e49473f0 not found
in upstream origin

Change-Id: Id1328d7cba418fa7c227ae9db4fe83c09fd06035
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index c7a1c6e0bf..d8b15024a8 100644
--- a/functions-common
+++ b/functions-common
@@ -609,8 +609,9 @@ function git_clone {
                 echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
-            # '--branch' can also take tags
-            git_timed clone $git_clone_flags $git_remote $git_dest --branch $git_ref
+            git_timed clone $git_clone_flags $git_remote $git_dest
+            cd $git_dest
+            git checkout $git_ref
         elif [[ "$RECLONE" = "True" ]]; then
             # if it does exist then simulate what clone does if asked to RECLONE
             cd $git_dest

From b8f228620f6ad038ab8f31db861580f5e664a280 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Ribaud?= <rribaud@redhat.com>
Date: Mon, 24 Apr 2023 14:22:01 +0200
Subject: [PATCH 3071/3333] Add manila service to configuration

Manila is a service in OpenStack that enables shared filesystems. The
modifications add the manila section in nova configuration files
enabling the virtiofs feature.

Implements: blueprint libvirt-virtiofs-attach-manila-shares
Change-Id: Ia17c7a136cbe83efa1ef4e302d1c404034a50cda
---
 lib/nova | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/nova b/lib/nova
index f34e823074..f5f002dd10 100644
--- a/lib/nova
+++ b/lib/nova
@@ -507,6 +507,10 @@ function create_nova_conf {
         configure_cinder_access
     fi
 
+    if is_service_enabled manila; then
+        configure_manila_access
+    fi
+
     if [ -n "$NOVA_STATE_PATH" ]; then
         iniset $NOVA_CONF DEFAULT state_path "$NOVA_STATE_PATH"
         iniset $NOVA_CONF oslo_concurrency lock_path "$NOVA_STATE_PATH"
@@ -652,6 +656,18 @@ function configure_cinder_access {
     fi
 }
 
+# Configure access to manila.
+function configure_manila_access {
+    iniset $NOVA_CONF manila os_region_name "$REGION_NAME"
+    iniset $NOVA_CONF manila auth_type "password"
+    iniset $NOVA_CONF manila auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $NOVA_CONF manila username nova
+    iniset $NOVA_CONF manila password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF manila user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF manila project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF manila project_domain_name "$SERVICE_DOMAIN_NAME"
+}
+
 function configure_console_compute {
     # If we are running multiple cells (and thus multiple console proxies) on a
     # single host, we offset the ports to avoid collisions.  We need to

From 6764eab2644b2f76769e4492ab136ff65763d2ef Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Fri, 12 May 2023 16:34:08 -0400
Subject: [PATCH 3072/3333] Remove usage of neutron-debug since it has been
 removed

The neutron-debug command was deprecated and finally removed,
so tools/ping_neutron.sh can no longer rely on it to create
a probe namespace. Instead, just try and use any namespace
with the network ID in it, since it's either the DHCP (ML2/OVS)
or Metadata (OVN) namespace, which should work just as well.

As this code is rarely (never?) used, this best-effort attempt
is good enough.

Change-Id: I98c992a2a774ef1fb22cee2e90ee342ab2d537ac
Depends-on: https://review.opendev.org/c/openstack/neutron/+/883081
---
 lib/neutron           | 18 ------------------
 tools/ping_neutron.sh | 16 +++++++++++-----
 2 files changed, 11 insertions(+), 23 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 368a1b9c55..a6de7222db 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1112,24 +1112,6 @@ function _neutron_setup_interface_driver {
 # Functions for Neutron Exercises
 #--------------------------------
 
-function delete_probe {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
-    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
-}
-
-function _get_net_id {
-    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
-}
-
-function _get_probe_cmd_prefix {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
-    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
-}
-
 # ssh check
 function _ssh_check_neutron {
     local from_net=$1
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index 73fe3f3bdf..ab8e8dfca8 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -30,7 +30,8 @@ ping_neutron.sh <net_name> [ping args]
 
 This provides a wrapper to ping neutron guests that are on isolated
 tenant networks that the caller can't normally reach. It does so by
-creating a network namespace probe.
+using either the DHCP or Metadata network namespace to support both
+ML2/OVS and OVN.
 
 It takes arguments like ping, except the first arg must be the network
 name.
@@ -44,6 +45,12 @@ EOF
     exit 1
 }
 
+# BUG: with duplicate network names, this fails pretty hard since it
+# will just pick the first match.
+function _get_net_id {
+    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | head -n 1 | awk '{print $2}'
+}
+
 NET_NAME=$1
 
 if [[ -z "$NET_NAME" ]]; then
@@ -53,12 +60,11 @@ fi
 
 REMAINING_ARGS="${@:2}"
 
-# BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(openstack network show -f value -c id "$NET_NAME")
-PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
+NET_ID=`_get_net_id $NET_NAME`
+NET_NS=$(ip netns list | grep "$NET_ID" | head -n 1)
 
 # This runs a command inside the specific netns
-NET_NS_CMD="ip netns exec qprobe-$PROBE_ID"
+NET_NS_CMD="ip netns exec $NET_NS"
 
 PING_CMD="sudo $NET_NS_CMD ping $REMAINING_ARGS"
 echo "Running $PING_CMD"

From bfa43975bca48bb021fb266a206885c5b09f5f45 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 18 May 2023 12:54:19 -0500
Subject: [PATCH 3073/3333] Enable NOVA_ENFORCE_SCOPE to True by default

Nova antelope release has enabled the RBAC new defaults
by default
- https://review.opendev.org/c/openstack/nova/+/866218

With the latest release of Nova have new defaults enable,
we should test the same by default in devstack. This change
make NOVA_ENFORCE_SCOPE flag to True by default so that every
job will run with Nova new defaults.

As old defaults are still supported (in deprecated way), we will keep
NOVA_ENFORCE_SCOPE flag so that we can have a single job can disable
the new defaults and continue testing the old defaults.

Change-Id: Id56819f03c19a5b7fe30adf799ecd3b8aeb67695
---
 lib/nova | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index f34e823074..21067f302b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -98,10 +98,10 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
 # Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
-# This is used to switch the compute API policies enable the scope and new defaults.
-# By Default, these flag are False.
+# This is used to disable the compute API policies scope and new defaults.
+# By Default, it is True.
 # For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-NOVA_ENFORCE_SCOPE=$(trueorfalse False NOVA_ENFORCE_SCOPE)
+NOVA_ENFORCE_SCOPE=$(trueorfalse True NOVA_ENFORCE_SCOPE)
 
 if [[ $SERVICE_IP_VERSION == 6 ]]; then
     NOVA_MY_IP="$HOST_IPV6"

From cb1ec1834de0b1eaddb02b7847b21d1d617efb6e Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 18 May 2023 19:58:41 -0500
Subject: [PATCH 3074/3333] Enable GLANCE_ENFORCE_SCOPE to True by default

Glance antelope release has enabled the RBAC new defaults
by default
- https://review.opendev.org/c/openstack/glance/+/872522

With the latest release of Glance have new defaults enable,
we should test the same by default in devstack. This change
make GLANCE_ENFORCE_SCOPE flag to True by default so that every
job will run with Glance new defaults.

As old defaults are still supported (in deprecated way), we will keep
GLANCE_ENFORCE_SCOPE flag so that we can have a single job can disable
the new defaults and continue testing the old defaults.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/883701

Change-Id: Idde6f3cb766597575ca822f21b4bb3a465e5e753
---
 lib/glance | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/glance b/lib/glance
index 5aeae16c61..430d94d3a4 100644
--- a/lib/glance
+++ b/lib/glance
@@ -95,10 +95,10 @@ GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
 GLANCE_ENABLE_QUOTAS=$(trueorfalse True GLANCE_ENABLE_QUOTAS)
 
 # Flag to set the oslo_policy.enforce_scope. This is used to switch
-# the Image API policies to start checking the scope of token. By Default,
-# this flag is False.
+# This is used to disable the Image API policies scope and new defaults.
+# By Default, it is True.
 # For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-GLANCE_ENFORCE_SCOPE=$(trueorfalse False GLANCE_ENFORCE_SCOPE)
+GLANCE_ENFORCE_SCOPE=$(trueorfalse True GLANCE_ENFORCE_SCOPE)
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs

From a2943894031e5b1c7662512d54ffb75a3cd3ca9d Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 25 Apr 2023 21:50:31 +0200
Subject: [PATCH 3075/3333] Set dhcp_client based on cirros version

This change allows us to bump the default cirros version
in devstack. Since cirros version 0.6.0 dhcpcd is the default
dhcp client. The older cirros images used udhcpc client (the only
available client at that time) which is also the default client
in Tempest.
This patch makes devstack configure dhcpcd client in tempest.conf
if cirros >= 0.6.0 is going to be used in scenario tests.

The commit also introduces a new SCENARIO_IMAGE_TYPE option.
It is now a trigger for cirros specific settings, later it might
be used for any other image's settings.

Closes-Bug: #2007973
Change-Id: I2738c3b1d302c6656ce2c209671ea954fbc1b05b
---
 lib/tempest | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 7da9f17052..9fa989a2f6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -517,8 +517,19 @@ function configure_tempest {
     # Scenario
     SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
     SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
+    SCENARIO_IMAGE_TYPE=${SCENARIO_IMAGE_TYPE:-cirros}
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_DIR/$SCENARIO_IMAGE_FILE
 
+    # since version 0.6.0 cirros uses dhcpcd dhcp client by default, however, cirros, prior to the
+    # version 0.6.0, used udhcpc (the only available client at that time) which is also tempest's default
+    if [[ "$SCENARIO_IMAGE_TYPE" == "cirros" ]]; then
+        # the image is a cirros image
+        # use dhcpcd client when version greater or equal 0.6.0
+        if [[ $(echo $CIRROS_VERSION | tr -d '.') -ge 060 ]]; then
+            iniset $TEMPEST_CONFIG scenario dhcp_client dhcpcd
+        fi
+    fi
+
     # If using provider networking, use the physical network for validation rather than private
     TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME
     if is_provider_network; then

From b5f4b1148a3f646a82a759f1dde3da1f74eb803c Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 25 Apr 2023 20:01:42 +0000
Subject: [PATCH 3076/3333] Revert "Revert "Bump cirros version to 0.6.1""

This reverts commit 37d11d00e56ec6ff402a13a28ec308c13291a937.

Reason for revert: reverting this revert as the issue caused by the original patch (before the first revert) is fixed by:
https://review.opendev.org/c/openstack/devstack/+/881504

Therefore we can proceed with the cirros version bump.

Change-Id: I43e2b04a0142c19fb1a79da5a33cc444149e18f1
---
 doc/source/guides/nova.rst |  2 +-
 stackrc                    | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 5b427972c4..d0fb274c13 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index b7ce238366..a17d88ecbd 100644
--- a/stackrc
+++ b/stackrc
@@ -662,20 +662,19 @@ esac
 #     If the file ends in .tar.gz, uncompress the tarball and and select the first
 #     .img file inside it as the image.  If present, use "*-vmlinuz*" as the kernel
 #     and "*-initrd*" as the ramdisk
-#     example: http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-amd64.tar.gz
+#     example: https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.tar.gz
 #  * disk image (*.img,*.img.gz)
 #    if file ends in .img, then it will be uploaded and registered as a to
 #    glance as a disk image.  If it ends in .gz, it is uncompressed first.
 #    example:
-#      http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-armel-disk1.img
-#      http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
+#      https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.img
+#      https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
 #  * OpenVZ image:
 #    OpenVZ uses its own format of image, and does not support UEC style images
 
-#IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
-#IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
+#IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -692,11 +691,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)

From 814e659e32a919ea68c29451753aa49c993ce5ed Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 22 May 2023 10:25:38 -0700
Subject: [PATCH 3077/3333] Default MYSQL_REDUCE_MEMORY=True

We have lots of evidence that this is a net benefit, so enable it
by default instead of everyone having to opt-in.

Change-Id: I66fa1799ff5177c3667630a89e15c072a8bf975a
---
 .zuul.yaml | 3 ---
 stackrc    | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 316e89ae32..9cad5d4084 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -696,9 +696,6 @@
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
-    vars:
-      devstack_localrc:
-        MYSQL_REDUCE_MEMORY: true
 
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
diff --git a/stackrc b/stackrc
index b7ce238366..672679e0b2 100644
--- a/stackrc
+++ b/stackrc
@@ -204,7 +204,7 @@ MYSQL_GATHER_PERFORMANCE=$(trueorfalse True MYSQL_GATHER_PERFORMANCE)
 # This can be used to reduce the amount of memory mysqld uses while running.
 # These are unscientifically determined, and could reduce performance or
 # cause other issues.
-MYSQL_REDUCE_MEMORY=$(trueorfalse False MYSQL_REDUCE_MEMORY)
+MYSQL_REDUCE_MEMORY=$(trueorfalse True MYSQL_REDUCE_MEMORY)
 
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is

From a37b6abc8ecab1a32593aecdf8f74d54f3c4adb1 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Fri, 26 May 2023 13:46:42 +0200
Subject: [PATCH 3078/3333] Resolve distutils deprecation warning

The distutils package is deprecated and slated for removal in
Python 3.12. Let's use shutil.which which is also recomended
by PEP 632: https://peps.python.org/pep-0632/#migration-advice

Closes-Bug: #2009229
Change-Id: Ibb2a9731449e765c4a56952a9f02679e9618778b
---
 tools/worlddump.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index e2921737db..aadd33b634 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -19,7 +19,6 @@
 
 import argparse
 import datetime
-from distutils import spawn
 import fnmatch
 import io
 import os
@@ -76,7 +75,7 @@ def _dump_cmd(cmd):
 
 
 def _find_cmd(cmd):
-    if not spawn.find_executable(cmd):
+    if not shutil.which(cmd):
         print("*** %s not found: skipping" % cmd)
         return False
     return True

From b2ad00cb66bd38ec6179d3bd1bf41556b966dc8c Mon Sep 17 00:00:00 2001
From: Alfredo Moralejo <amoralej@redhat.com>
Date: Wed, 24 May 2023 21:03:28 +0200
Subject: [PATCH 3079/3333] Use RDO official CloudSIG mirrors for C9S
 deployments

Instead of using RDO Trunk repo server, CentOS official mirrors provide
a most reliable infrastructure and supports EMS which is required when
enabling FIPS in C9S.

In order to install the rdo-release rpm from repo.fedoraproject.org,
which does not support EMS, I'm using a workaround to wget, which works
with non-EMS servers because it uses gnutls instead of openssl, and
install it locally with rpm.

This is also consistent to CentOS 8 implementatioin.

Closes-Bug: #2020661
Closes-Bug: #2020434
Change-Id: Icd99f467d47aaafaaf3ee8f2a3c4da08842cb672
---
 stack.sh | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index be3c9dda11..1d32ed8156 100755
--- a/stack.sh
+++ b/stack.sh
@@ -311,7 +311,22 @@ function _install_rdo {
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
         fi
     elif [[ $DISTRO == "rhel9" ]]; then
-        sudo curl -L -o /etc/yum.repos.d/delorean-deps.repo http://trunk.rdoproject.org/centos9-master/delorean-deps.repo
+        install_package wget
+        # We need to download rdo-release package using wget as installing with dnf from repo.fedoraproject.org fails in
+        # FIPS enabled systems after https://bugzilla.redhat.com/show_bug.cgi?id=2157951
+        # Until we can pull rdo-release from a server which supports EMS, this workaround is doing wget, which does
+        # not relies on openssl but on gnutls, and then install it locally using rpm
+        TEMPRDODIR=$(mktemp -d)
+        if [[ "$TARGET_BRANCH" == "master" ]]; then
+            # rdo-release.el9.rpm points to latest RDO release, use that for master
+            wget -P $TEMPRDODIR  https://rdoproject.org/repos/rdo-release.el9.rpm
+        else
+            # For stable branches use corresponding release rpm
+            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            wget -P $TEMPRDODIR https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
+        fi
+        sudo rpm -ivh $TEMPRDODIR/rdo-release*rpm
+        rm -rf $TEMPRDODIR
     fi
     sudo dnf -y update
 }

From a13201646d7ca50d92c44b73ba3f20bbf0f3f1d3 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Tue, 30 May 2023 13:31:05 -0400
Subject: [PATCH 3080/3333] Install systemd-coredump on Debian-based distros

On Debian-based distros, the 'coredumpctl' command is
provided by the systemd-coredump package, which is not
installed by default. On failure, when "post" commands
are executed this error is seen:

  controller | /bin/bash: line 1: coredumpctl: command not found

Install it along with other libvirt packages to avoid
the error.

On Fedora distros it is in the systemd package, so the
problem is not seen since it is always installed.

Change-Id: I6012bd3240d68736a5db8ae49dc32098a086f320
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 799230603c..ba2e98e304 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -69,7 +69,7 @@ function install_libvirt {
             $REQUIREMENTS_DIR/upper-constraints.txt -- libvirt-python
 
     if is_ubuntu; then
-        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt
+        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt systemd-coredump
         if is_arch "aarch64"; then
             install_package qemu-efi
         fi

From fbc1865dc4e5b84ebafaf1d30cffc582ae3f0c0f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 7 Jun 2023 15:19:37 +0200
Subject: [PATCH 3081/3333] Drop Fedora support

Fedora 36 is EOL, also opendev is dropping support for Fedora images
completely since interest in running jobs on that platform is no longer
existing. CentOS 9 Stream has evolved as replacement platform for new
features.

Only drop the Zuul configuration and the tag in stack.sh for now plus
update some docs. Cleanup of the deployment code will be done in a
second step.

Change-Id: Ica483fde27346e3939b5fc0d7e0a6dfeae0e8d1e
---
 .zuul.yaml              | 33 ---------------------------------
 README.rst              |  8 ++++----
 doc/source/index.rst    |  6 +++---
 doc/source/overview.rst |  5 ++---
 stack.sh                |  4 ++--
 5 files changed, 11 insertions(+), 45 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9cad5d4084..a7be67153b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -78,16 +78,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-fedora-latest
-    nodes:
-      - name: controller
-        label: fedora-36
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-debian-bullseye
     nodes:
@@ -854,23 +844,6 @@
       devstack_services:
         tls-proxy: false
 
-- job:
-    name: devstack-platform-fedora-latest
-    parent: tempest-full-py3
-    description: Fedora latest platform test
-    nodeset: devstack-single-node-fedora-latest
-    voting: false
-
-- job:
-    name: devstack-platform-fedora-latest-virt-preview
-    parent: tempest-full-py3
-    description: Fedora latest platform test using the virt-preview repo.
-    nodeset: devstack-single-node-fedora-latest
-    voting: false
-    vars:
-      devstack_localrc:
-        ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
-
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -944,7 +917,6 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
-        - devstack-platform-fedora-latest
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
@@ -1048,10 +1020,6 @@
     #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and currently non-voting in the
     #    check queue for nova changes but relies on devstack configuration
-    # * devstack-platform-fedora-latest-virt-preview: Maintained by lyarwood
-    #    for Nova to allow early testing of the latest versions of Libvirt and
-    #    QEMU. Should only graduate out of experimental if it ever moves into
-    #    the check queue for Nova.
 
     experimental:
       jobs:
@@ -1080,7 +1048,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - devstack-platform-fedora-latest-virt-preview
         - devstack-no-tls-proxy
     periodic:
       jobs:
diff --git a/README.rst b/README.rst
index f3a585a926..86b85da956 100644
--- a/README.rst
+++ b/README.rst
@@ -4,7 +4,7 @@ from git source trees.
 Goals
 =====
 
-* To quickly build dev OpenStack environments in a clean Ubuntu or Fedora
+* To quickly build dev OpenStack environments in a clean Ubuntu or RockyLinux
   environment
 * To describe working configurations of OpenStack (which code branches
   work together?  what do config files look like for those branches?)
@@ -28,9 +28,9 @@ Versions
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a Pike OpenStack cloud::
+following to create a Zed OpenStack cloud::
 
-    git checkout stable/pike
+    git checkout stable/zed
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate
@@ -55,7 +55,7 @@ When the script finishes executing, you should be able to access OpenStack
 endpoints, like so:
 
 * Horizon: http://myhost/
-* Keystone: http://myhost/identity/v2.0/
+* Keystone: http://myhost/identity/v3/
 
 We also provide an environment file that you can use to interact with your
 cloud via CLI::
diff --git a/doc/source/index.rst b/doc/source/index.rst
index ccd0fef330..a5a11e251b 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -37,8 +37,8 @@ Install Linux
 -------------
 
 Start with a clean and minimal install of a Linux system. DevStack
-attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and openEuler.
+attempts to support the two latest LTS releases of Ubuntu,
+Rocky Linux 9 and openEuler.
 
 If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
@@ -113,7 +113,7 @@ Start the install
 
    $ ./stack.sh
 
-This will take a 15 - 20 minutes, largely depending on the speed of
+This will take 15 - 30 minutes, largely depending on the speed of
 your internet connection. Many git trees and packages will be
 installed during this process.
 
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index a609333289..4384081769 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -23,13 +23,12 @@ strategy to include the latest Ubuntu release and the latest RHEL
 release.*
 
 -  Ubuntu: current LTS release plus current development release
--  Fedora: current release plus previous release
--  RHEL/CentOS: current major release
+-  RHEL/CentOS/RockyLinux: current major release
 -  Other OS platforms may continue to be included but the maintenance of
    those platforms shall not be assumed simply due to their presence.
    Having a listed point-of-contact for each additional OS will greatly
    increase its chance of being well-maintained.
--  Patches for Ubuntu and/or Fedora will not be held up due to
+-  Patches for Ubuntu and/or RockyLinux will not be held up due to
    side-effects on other OS platforms.
 
 Databases
diff --git a/stack.sh b/stack.sh
index 1d32ed8156..e9617eee78 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (Bionic or newer), **Fedora** (F36 or newer), or **CentOS/RHEL**
+# (Bionic or newer) or **CentOS/RHEL/RockyLinux**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f36|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From f1c5442becad6fcdfb16676e8bc99835d4a75b22 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 10 Jun 2023 03:07:59 +0000
Subject: [PATCH 3082/3333] Updated from generate-devstack-plugins-list

Change-Id: Icc3aa69d7bbfa217676402682454cd4b37fb6c29
---
 doc/source/plugin-registry.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b244ca5dd8..ec502ea252 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,10 +69,6 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
-openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
-openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
-openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
-openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
 openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__

From 39228451b6542ff63f288affbda13897089eb16d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 15 Jun 2023 10:46:51 +0200
Subject: [PATCH 3083/3333] Bump default cirros version to 0.6.2

Cirros has made a new release, including a newer kernel that should fix
some issues when using nested virtualization.

Related-Bug: 2023559
Change-Id: I63469371b13801094a3ee1baae6e343999fbefa5
---
 doc/source/guides/nova.rst | 2 +-
 stackrc                    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index d0fb274c13..705d427e68 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.2-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index 8820c621e5..7160d0a390 100644
--- a/stackrc
+++ b/stackrc
@@ -674,7 +674,7 @@ esac
 
 #IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 7288df34f8513caf6f3985c75855feb572f6b004 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 16 Jun 2023 14:25:33 +0530
Subject: [PATCH 3084/3333] Add 10 second buffer for uwsgi service stop

Default for systemd TimeoutStopSec is 90 seconds
and that is same for default graceful shutdown of
uwsgi service(WORKER_TIMEOUT).

Due to the Related-Bug graceful stop attempt
fails and there is no room for force shutdown.
This patch reduces default for WORKER_TIMEOUT by
10 seconds so there is a buffer to force stop the
service.

Closes-Bug: #2020643
Related-Bug: #2015065
Change-Id: I6aacac94f9697088338b3d2f99d8eaa22c2be67b
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 8820c621e5..7465f54112 100644
--- a/stackrc
+++ b/stackrc
@@ -804,7 +804,7 @@ NOVA_READY_TIMEOUT=${NOVA_READY_TIMEOUT:-$SERVICE_TIMEOUT}
 SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 
 # Service graceful shutdown timeout
-WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
+WORKER_TIMEOUT=${WORKER_TIMEOUT:-80}
 
 # Common Configuration
 # --------------------

From ad029c0e8b66d81889c80d4a68b4654dd169fecf Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 26 Jun 2023 10:57:49 +0100
Subject: [PATCH 3085/3333] The AZ filter is deprecated and planned for removal
 this cycle

To facilitate that this change removes it form the default filter
list. By default nova has used placement for AZs so this filter
has not been requried since xena.

Change-Id: Ie5e216dd8c2a7ecf43cc6954ec4f73d4d67b5b3b
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 21067f302b..abf4eee465 100644
--- a/lib/nova
+++ b/lib/nova
@@ -115,7 +115,7 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
 # The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+NOVA_FILTERS="ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 

From 4a1b2808af68ab50a15a9c16bfe217fac50bf309 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 26 Jun 2023 12:23:58 +0200
Subject: [PATCH 3086/3333] Remove unused file

This was forgotten in [0]

[0] I20501fec140998b91c9ddfd84b7b10168624430a

Change-Id: Iacd86e3953f573a0fc38dc4898aafefccb3a9a79
---
 files/dnsmasq-for-baremetal-from-nova-network.conf | 3 ---
 1 file changed, 3 deletions(-)
 delete mode 100644 files/dnsmasq-for-baremetal-from-nova-network.conf

diff --git a/files/dnsmasq-for-baremetal-from-nova-network.conf b/files/dnsmasq-for-baremetal-from-nova-network.conf
deleted file mode 100644
index 66a375190e..0000000000
--- a/files/dnsmasq-for-baremetal-from-nova-network.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-enable-tftp
-tftp-root=/tftpboot
-dhcp-boot=pxelinux.0

From 27568ea33460b9ea4635a7d0a0bb06d32654150b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 27 Jun 2023 02:19:53 +0000
Subject: [PATCH 3087/3333] Updated from generate-devstack-plugins-list

Change-Id: I6fd6a718ce39d849342b30970ca39477ce285374
---
 doc/source/plugin-registry.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ec502ea252..f54fca92e6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,6 +69,9 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
+openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
+openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
+openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
 openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__

From e32715b2515fdae523a3d113a881f0a57fff9410 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 22 Jun 2023 21:10:31 -0500
Subject: [PATCH 3088/3333] Set two different image in tempest irespective of
 DEFAULT_IMAGE_NAME

In current logic to set two different image in Tempest in config
option image_ref and image_ref_alt, we consider if DEFAULT_IMAGE_NAME
is found in glance then set the same image in tempest for those
two config option. This means even we have two different image available
in glance, still we set same image in image_ref as well as image_ref_alt
and all the rebuild tests are rebuilt on the same image.

I could not find any reason why we set same image if DEFAULT_IMAGE_NAME
exist, below are the original change added this logic
- https://review.opendev.org/c/openstack/devstack/+/17553

We had a requirement of test to run on two different images
- https://review.opendev.org/c/openstack/tempest/+/831018

and for that we need to set DEFAULT_IMAGE_NAME to non exist image
name but that broke the Ironic which was reply on the valid name
in DEFAULT_IMAGE_NAME
- https://review.opendev.org/c/openstack/ironic/+/886790

As we do not have any reason not to set two different image
if DEFAULT_IMAGE_NAME is set, I am removing the condition of
DEFAULT_IMAGE_NAME from lib/tempest logic and always set two
different images if they are available.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/886796

Change-Id: I9d215f48d4440f2fa6dcc0d222a10896caf01215
---
 lib/tempest | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 9fa989a2f6..4f72a6d174 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -149,11 +149,10 @@ function set_tempest_venv_constraints {
 # ramdisk and kernel images.  Takes 3 arguments, an array and two
 # variables.  The array will contain the list of active image UUIDs;
 # if an image with ``DEFAULT_IMAGE_NAME`` is found, its UUID will be
-# set as the value of *both* other parameters.
+# set as the value img_id ($2) parameters.
 function get_active_images {
     declare -n img_array=$1
     declare -n img_id=$2
-    declare -n img_id_alt=$3
 
     # start with a fresh array in case we are called multiple times
     img_array=()
@@ -161,7 +160,6 @@ function get_active_images {
     while read -r IMAGE_NAME IMAGE_UUID; do
         if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
             img_id="$IMAGE_UUID"
-            img_id_alt="$IMAGE_UUID"
         fi
         img_array+=($IMAGE_UUID)
     done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
@@ -170,13 +168,12 @@ function get_active_images {
 function poll_glance_images {
     declare -n image_array=$1
     declare -n image_id=$2
-    declare -n image_id_alt=$3
     local -i poll_count
 
     poll_count=$TEMPEST_GLANCE_IMPORT_POLL_LIMIT
     while (( poll_count-- > 0 )) ; do
         sleep $TEMPEST_GLANCE_IMPORT_POLL_INTERVAL
-        get_active_images image_array image_id image_id_alt
+        get_active_images image_array image_id
         if (( ${#image_array[*]} >= $TEMPEST_GLANCE_IMAGE_COUNT )) ; then
             return
         fi
@@ -228,7 +225,7 @@ function configure_tempest {
     declare -a images
 
     if is_service_enabled glance; then
-        get_active_images images image_uuid image_uuid_alt
+        get_active_images images image_uuid
 
         if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
             # Glance image import is asynchronous and may be configured
@@ -236,7 +233,7 @@ function configure_tempest {
             # it's possible that this code is being executed before the
             # import has completed and there may be no active images yet.
             if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
-                poll_glance_images images image_uuid image_uuid_alt
+                poll_glance_images images image_uuid
                 if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
                     echo "Only found ${#images[*]} image(s), was looking for $TEMPEST_GLANCE_IMAGE_COUNT"
                     exit 1
@@ -258,7 +255,15 @@ function configure_tempest {
             *)
                 if [ -z "$image_uuid" ]; then
                     image_uuid=${images[0]}
-                    image_uuid_alt=${images[1]}
+                    if [ -z "$image_uuid_alt" ]; then
+                        image_uuid_alt=${images[1]}
+                    fi
+                elif [ -z "$image_uuid_alt" ]; then
+                    for image in $images; do
+                        if [[ "$image" != "$image_uuid" ]]; then
+                            image_uuid_alt=$image
+                        fi
+                    done
                 fi
                 ;;
         esac

From 58c80b2424623096e4a1f7a901f424be0ce6cb3f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 27 Jun 2023 12:16:32 -0700
Subject: [PATCH 3089/3333] nova: Bump timeout-per-gb for BFV rebuild ops

This increases the timeout we use to wait for cinder to perform a
volume reimage. Since devstack is often running on a single machine
with non-production IO performance, we should bump this limit to avoid
hitting it before the rebuild completes.

Change-Id: Ie2663b951acb0c1a65597a39e032948764e6ae6a
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index 21067f302b..e60b71c36d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1036,6 +1036,10 @@ function start_nova_compute {
     # by the compute process.
     configure_console_compute
 
+    # Set rebuild timeout longer for BFV instances because we likely have
+    # slower disk than expected. Default is 20s/GB
+    iniset $NOVA_CPU_CONF DEFAULT reimage_timeout_per_gb 60
+
     # Configure the OVSDB connection for os-vif
     if [ -n "$OVSDB_SERVER_LOCAL_HOST" ]; then
         iniset $NOVA_CPU_CONF os_vif_ovs ovsdb_connection "tcp:$OVSDB_SERVER_LOCAL_HOST:6640"

From 931b45defd07991890707b434638166800ec948a Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 19 Jul 2023 12:15:52 +0530
Subject: [PATCH 3090/3333] Handle more than 1 image while configuring tempest

[1] caused a regression causing failures when
more than 1 images are setup. Fixing it by correctly
using the array variable. Also add a break in the
for loop once if condition is met.

[1] https://review.opendev.org/c/openstack/devstack/+/886795

Closes-Bug: #2028123
Change-Id: I4f13c1239312bbcca8c65e875d65d03702161c18
---
 lib/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 4f72a6d174..4ba101f218 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -259,9 +259,10 @@ function configure_tempest {
                         image_uuid_alt=${images[1]}
                     fi
                 elif [ -z "$image_uuid_alt" ]; then
-                    for image in $images; do
+                    for image in ${images[@]}; do
                         if [[ "$image" != "$image_uuid" ]]; then
                             image_uuid_alt=$image
+                            break
                         fi
                     done
                 fi

From e261bd809e81c01c153cdcdb50be47ed3c89c46a Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Wed, 19 Jul 2023 16:04:12 -0400
Subject: [PATCH 3091/3333] Always set image_uuid_alt in configure_tempest()

When there is only a single image, configure_tempest()
needs to always set image_uuid_alt the same as image_uuid,
else it will fail trying to determine the size of the
flavor to use for it later in the function.

Introduced by [0], and subsequent change did not fix it.

[0] https://review.opendev.org/c/openstack/devstack/+/886795

Change-Id: Ibfe99ff732570dbd415772c5625f43e35b68c871
Related-bug: #2028123
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 4ba101f218..2f62f6ea62 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -249,8 +249,8 @@ function configure_tempest {
             1)
                 if [ -z "$image_uuid" ]; then
                     image_uuid=${images[0]}
-                    image_uuid_alt=${images[0]}
                 fi
+                image_uuid_alt=$image_uuid
                 ;;
             *)
                 if [ -z "$image_uuid" ]; then

From 770352beb05f63fb9192ad488b6b8344fd57c985 Mon Sep 17 00:00:00 2001
From: jskunda <jskunda@redhat.com>
Date: Tue, 18 Jul 2023 09:32:05 +0200
Subject: [PATCH 3092/3333] git: git checkout for a commit hash combinated with
 depth argument

This patch: https://review.opendev.org/c/openstack/devstack/+/882299
provides functionality, that commit hash can be passed as last arugment,
however when GIT_DEPTH is set, it fails, as in:

timeout -s SIGINT 0 git clone https://github.com/ovn-org/ovn.git ./ovn
--depth 1 --branch 03b95a4566a15f7544f4cdf35629dacede4dcf55
fatal: Remote branch 03b95a4566a15f7544f4cdf35629dacede4dcf55
not found in upstream origin

Closes-Bug: #2023020
Change-Id: I748354964a133e028e12458cc9014d6d014cbdb9
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 63144d6ed7..a668d55b8d 100644
--- a/functions-common
+++ b/functions-common
@@ -609,9 +609,10 @@ function git_clone {
                 echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
-            git_timed clone $git_clone_flags $git_remote $git_dest
+            git_timed clone --no-checkout $git_clone_flags $git_remote $git_dest
             cd $git_dest
-            git checkout $git_ref
+            git_timed fetch $git_clone_flags origin $git_ref
+            git_timed checkout FETCH_HEAD
         elif [[ "$RECLONE" = "True" ]]; then
             # if it does exist then simulate what clone does if asked to RECLONE
             cd $git_dest

From d115bfd72a61f23bba0eb5d2d82c2ad94eac15e2 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 31 Jul 2023 07:04:34 -0700
Subject: [PATCH 3093/3333] Reduce the flush frequency of dbcounter plugin

This relaxes the limits for dbcounter to make it flush stats to the
database less often. Currently every thirty seconds or 100 hits, we
write a stats line to the database. In some services (like keystone)
this can trigger more than one write per second because of the
massive number of SELECT calls that service makes.

This removes the hit limit and decreases the mandatory flush interval
to once a minute. Hopefully this will manifest as lower load on the
database triggered by what would be readonly operations.

Change-Id: I43a58532c0541075a2d36408abc50a41f7994bda
---
 tools/dbcounter/dbcounter.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/tools/dbcounter/dbcounter.py b/tools/dbcounter/dbcounter.py
index 0ed7bb813a..86e5529c97 100644
--- a/tools/dbcounter/dbcounter.py
+++ b/tools/dbcounter/dbcounter.py
@@ -96,20 +96,18 @@ def stat_writer(self):
         This reads "hists" from from a queue fed by _log_event() and
         writes (db,op)+=count stats to the database after ten seconds
         of no activity to avoid triggering a write for every SELECT
-        call. Write no less often than every thirty seconds and/or 100
-        pending hits to avoid being starved by constant activity.
+        call. Write no less often than every sixty seconds to avoid being
+        starved by constant activity.
         """
         LOG.debug('[%i] Writer thread running' % os.getpid())
         while True:
             to_write = {}
-            total = 0
             last = time.time()
-            while time.time() - last < 30 and total < 100:
+            while time.time() - last < 60:
                 try:
                     item = self.queue.get(timeout=10)
                     to_write.setdefault(item, 0)
                     to_write[item] += 1
-                    total += 1
                 except queue.Empty:
                     break
 

From 7a2021dfa01368a69e1e43785419ac68b62a9b5f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 7 Jun 2023 15:30:02 +0200
Subject: [PATCH 3094/3333] Add rocky job to gate

It was made voting some time ago, but we missed also running it in gate.

With that RHEL platform test in place, we can keep c9s permanently
non-voting, which is better suited to match its instability.

Change-Id: I6712ac6dc64e4fe2203b2a5f6a381f6d2150ba0f
---
 .zuul.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a7be67153b..948a9af8ca 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -697,8 +697,6 @@
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
     timeout: 9000
-    # TODO(kopecmartin) n-v until the following is resolved:
-    # https://bugs.launchpad.net/neutron/+bug/1979047
     voting: false
 
 - job:
@@ -968,11 +966,9 @@
       jobs:
         - devstack
         - devstack-ipv6
-        # TODO(kopecmartin) n-v until the following is resolved:
-        # https://bugs.launchpad.net/neutron/+bug/1979047
-        # - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-platform-ubuntu-focal
+        - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From a40f9cb91fbedddec89f0ffd6c7dd4b3828a232e Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 4 Apr 2018 14:02:30 -0700
Subject: [PATCH 3095/3333] Add option to install everything in global venvs

Since we are python3 only for openstack we create a single python3
virtualenv to install all the packages into. This gives us the benefits
of installing into a virtualenv while still ensuring coinstallability.
This is a major change and will likely break many things.

There are several reasons for this. The change that started this effort
was pip stopped uninstalling packages which used distutils to generate
their package installation. Many distro packages do this which meant
that pip installed packages and distro packages could not coexist in the
global install space. More recently git has made pip installing repos as
root more difficult due to file ownership concerns.

Currently the switch to the global venv is optional, but if we go down
this path we should very quickly remove the old global installation
method as it has only caused us problems.

Major hurdles we have to get over are convincing rootwrap to trust
binaries in the virtualenvs (so you'll notice we update rootwrap
configs).

Some distros still have issues, keep them using the old setup for now.

Depends-On: https://review.opendev.org/c/openstack/grenade/+/880266
Co-Authored-By: Dr. Jens Harbott <frickler@offenerstapel.de>
Change-Id: If9bc7ba45522189d03f19b86cb681bb150ee2f25
---
 .zuul.yaml                    |  8 ++++++++
 files/apache-horizon.template |  1 +
 functions-common              |  5 +++++
 inc/python                    | 34 +++++++++++++++++++++++++++++++---
 inc/rootwrap                  |  5 +++++
 lib/glance                    |  3 +++
 lib/horizon                   |  6 ++++++
 lib/tls                       |  7 +++++--
 stack.sh                      | 12 ++++++++++++
 stackrc                       |  8 ++++++++
 tools/install_prereqs.sh      |  2 ++
 tools/memory_tracker.sh       |  7 ++++++-
 12 files changed, 92 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a7be67153b..803db3a3fa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -700,6 +700,9 @@
     # TODO(kopecmartin) n-v until the following is resolved:
     # https://bugs.launchpad.net/neutron/+bug/1979047
     voting: false
+    vars:
+      devstack_localrc:
+        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-debian-bullseye
@@ -709,6 +712,9 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(frickler): drop this once wheel build is fixed
+        MYSQL_GATHER_PERFORMANCE: false
 
 - job:
     name: devstack-platform-rocky-blue-onyx
@@ -718,6 +724,8 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-ubuntu-focal
diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index efcfc0360b..da7a7d26c3 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -39,4 +39,5 @@
     CustomLog /var/log/%APACHE_NAME%/horizon_access.log combined
 </VirtualHost>
 
+%WSGIPYTHONHOME%
 WSGISocketPrefix /var/run/%APACHE_NAME%
diff --git a/functions-common b/functions-common
index 5e1aa34279..f752271976 100644
--- a/functions-common
+++ b/functions-common
@@ -1522,6 +1522,7 @@ function write_user_unit_file {
     mkdir -p $SYSTEMD_DIR
 
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "Environment" "\"PATH=$PATH\""
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "KillMode" "process"
@@ -1549,6 +1550,7 @@ function write_uwsgi_user_unit_file {
     mkdir -p $SYSTEMD_DIR
 
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "Environment" "\"PATH=$PATH\""
     iniset -sudo $unitfile "Service" "SyslogIdentifier" "$service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
@@ -1614,6 +1616,9 @@ function _run_under_systemd {
     fi
     local env_vars="$5"
     if [[ "$command" =~ "uwsgi" ]] ; then
+        if [[ "$GLOBAL_VENV" == "True" ]] ; then
+            cmd="$cmd --venv $DEVSTACK_VENV"
+        fi
         write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
     else
         write_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
diff --git a/inc/python b/inc/python
index a24f4e910a..cc6e01fede 100644
--- a/inc/python
+++ b/inc/python
@@ -32,6 +32,23 @@ function join_extras {
 # Python Functions
 # ================
 
+# Setup the global devstack virtualenvs and the associated environment
+# updates.
+function setup_devstack_virtualenv {
+    # We run devstack out of a global virtualenv.
+    if [[ ! -d $DEVSTACK_VENV ]] ; then
+        # Using system site packages to enable nova to use libguestfs.
+        # This package is currently installed via the distro and not
+        # available on pypi.
+        python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
+        pip_install -U pip
+    fi
+    if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
+        export PATH="$DEVSTACK_VENV/bin:$PATH"
+        export PYTHON="$DEVSTACK_VENV/bin/python3"
+    fi
+}
+
 # Get the path to the pip command.
 # get_pip_command
 function get_pip_command {
@@ -60,8 +77,11 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    local PYTHON_PATH=/usr/local/bin
-    echo $PYTHON_PATH
+    if [[ "$GLOBAL_VENV" == "True" ]] ; then
+        echo "$DEVSTACK_VENV/bin"
+    else
+        echo "/usr/local/bin"
+    fi
 }
 
 # Wrapper for ``pip install`` that only installs versions of libraries
@@ -166,6 +186,14 @@ function pip_install {
     if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
+    elif [[ "${GLOBAL_VENV}" == "True" && -d ${DEVSTACK_VENV} ]] ; then
+        # We have to check that the DEVSTACK_VENV exists because early
+        # devstack boostrapping needs to operate in a system context
+        # too bootstrap pip. Once pip is bootstrapped we create the
+        # global venv and can start to use it.
+        local cmd_pip=$DEVSTACK_VENV/bin/pip
+        local sudo_pip="env"
+        echo "Using python $PYTHON3_VERSION to install $package_dir"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
         # See
@@ -439,7 +467,7 @@ function setup_package {
 
     pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
-    if [[ "$flags" == "-e" ]]; then
+    if [[ "$flags" == "-e" && "$GLOBAL_VENV" == "False" ]]; then
         safe_chown -R $STACK_USER $1/*.egg-info
     fi
 }
diff --git a/inc/rootwrap b/inc/rootwrap
index 2a6e4b648f..4c65440a4e 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -60,6 +60,11 @@ function configure_rootwrap {
     sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.conf /etc/${project}/rootwrap.conf
     sudo sed -e "s:^filters_path=.*$:filters_path=/etc/${project}/rootwrap.d:" -i /etc/${project}/rootwrap.conf
 
+    # Rely on $PATH set by devstack to determine what is safe to execute
+    # by rootwrap rather than use explicit whitelist of paths in
+    # rootwrap.conf
+    sudo sed -e 's/^exec_dirs=.*/#&/' -i /etc/${project}/rootwrap.conf
+
     # Set up the rootwrap sudoers
     local tempfile
     tempfile=$(mktemp)
diff --git a/lib/glance b/lib/glance
index 430d94d3a4..e64f00027e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -47,6 +47,9 @@ USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # from CINDER_ENABLED_BACKENDS
 GLANCE_CINDER_DEFAULT_BACKEND=${GLANCE_CINDER_DEFAULT_BACKEND:-lvmdriver-1}
 GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
+if [[ "$GLOBAL_VENV" == "True" ]] ; then
+    GLANCE_STORE_ROOTWRAP_BASE_DIR=${DEVSTACK_VENV}/etc/glance
+fi
 # When Cinder is used as a glance store, you can optionally configure cinder to
 # optimize bootable volume creation by allowing volumes to be cloned directly
 # in the backend instead of transferring data via Glance.  To use this feature,
diff --git a/lib/horizon b/lib/horizon
index f76f9e557d..611329d619 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -115,6 +115,11 @@ function configure_horizon {
     local horizon_conf
     horizon_conf=$(apache_site_config_for horizon)
 
+    local wsgi_venv_config=""
+    if [[ "$GLOBAL_VENV" == "True" ]] ; then
+        wsgi_venv_config="WSGIPythonHome $DEVSTACK_VENV"
+    fi
+
     # Configure apache to run horizon
     # Set up the django horizon application to serve via apache/wsgi
     sudo sh -c "sed -e \"
@@ -124,6 +129,7 @@ function configure_horizon {
         s,%APACHE_NAME%,$APACHE_NAME,g;
         s,%DEST%,$DEST,g;
         s,%WEBROOT%,$HORIZON_APACHE_ROOT,g;
+        s,%WSGIPYTHONHOME%,$wsgi_venv_config,g;
     \" $FILES/apache-horizon.template >$horizon_conf"
 
     if is_ubuntu; then
diff --git a/lib/tls b/lib/tls
index a1e162d2e2..d35e9e2cee 100644
--- a/lib/tls
+++ b/lib/tls
@@ -364,8 +364,11 @@ function deploy_int_CA {
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy; then
         local capath
-        capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
-
+        if [[ "$GLOBAL_VENV" == "True" ]] ; then
+            capath=$($DEVSTACK_VENV/bin/python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+        else
+            capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+        fi
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
                 sudo rm -f $capath
diff --git a/stack.sh b/stack.sh
index ad88eab9d5..c8f7c9d79e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
 # **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
@@ -824,6 +825,17 @@ fi
 source $TOP_DIR/tools/fixup_stuff.sh
 fixup_all
 
+if [[ "$GLOBAL_VENV" == "True" ]] ; then
+    # TODO(frickler): find a better solution for this
+    sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/tox /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
+
+    setup_devstack_virtualenv
+fi
+
 # Install subunit for the subunit output stream
 pip_install -U os-testr
 
diff --git a/stackrc b/stackrc
index dcc0ce45e0..0d1880cec9 100644
--- a/stackrc
+++ b/stackrc
@@ -183,6 +183,14 @@ IDENTITY_API_VERSION=3
 # each services ${SERVICE}_ENFORCE_SCOPE variables
 ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)
 
+# Devstack supports the use of a global virtualenv. These variables enable
+# and disable this functionality as well as set the path to the virtualenv.
+# Note that the DATA_DIR is selected because grenade testing uses a shared
+# DATA_DIR but different DEST dirs and we don't want two sets of venvs,
+# instead we want one global set.
+GLOBAL_VENV=$(trueorfalse True GLOBAL_VENV)
+DEVSTACK_VENV=${DEVSTACK_VENV:-$DATA_DIR/venv}
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index f2d57c8451..bb470b2927 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -79,6 +79,8 @@ if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     fi
 fi
 
+# TODO(clarkb) remove these once we are switched to global venv by default
+export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null || which python3 2>/dev/null)
 
 # Mark end of run
 # ---------------
diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index 6c36534f01..2f404c26fb 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -14,7 +14,12 @@
 
 set -o errexit
 
-PYTHON=${PYTHON:-python3}
+# TODO(frickler): make this use stackrc variables
+if [ -x /opt/stack/data/venv/bin/python ]; then
+    PYTHON=/opt/stack/data/venv/bin/python
+else
+    PYTHON=${PYTHON:-python3}
+fi
 
 # time to sleep between checks
 SLEEP_TIME=20

From 0b79f6f7690773701a37921f626782e528fa9c36 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 4 Jul 2023 07:18:01 +0200
Subject: [PATCH 3096/3333] Add debian-bookworm job

Change-Id: Id5e54775e2be38a75db0bd1f55d1d3b5ae7ef71f
---
 .zuul.yaml          | 24 ++++++++++++++++++++++++
 lib/databases/mysql |  5 +++--
 stack.sh            |  2 +-
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 803db3a3fa..9cc95b607e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -78,6 +78,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-debian-bookworm
+    nodes:
+      - name: controller
+        label: debian-bookworm
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-debian-bullseye
     nodes:
@@ -704,6 +714,19 @@
       devstack_localrc:
         GLOBAL_VENV: false
 
+- job:
+    name: devstack-platform-debian-bookworm
+    parent: tempest-full-py3
+    description: Debian Bookworm platform test
+    nodeset: devstack-single-node-debian-bookworm
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(frickler): drop this once wheel build is fixed
+        MYSQL_GATHER_PERFORMANCE: false
+
 - job:
     name: devstack-platform-debian-bullseye
     parent: tempest-full-py3
@@ -926,6 +949,7 @@
         - devstack-ipv6
         - devstack-enforce-scope
         - devstack-platform-centos-9-stream
+        - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-focal
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 27d1ec600f..e069e128e9 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -20,7 +20,7 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
     if is_fedora && ! is_oraclelinux; then
         MYSQL_SERVICE_NAME=mariadb
-    elif [[ "$DISTRO" == "bullseye" ]]; then
+    elif [[ "$DISTRO" =~ bookworm|bullseye ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
 fi
@@ -122,7 +122,8 @@ function configure_database_mysql {
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
-    if is_ubuntu && [[ "$DISTRO" != "bullseye" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+    # TODO(frickler): simplify this logic
+    if is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         if [[ "$DISTRO" == "jammy" ]]; then
             # For Ubuntu 22.04 (jammy) we follow the model outlined in
             # https://mariadb.org/authentication-in-mariadb-10-4/
diff --git a/stack.sh b/stack.sh
index c8f7c9d79e..0434001b7a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 113689ee4694de20c019735fdace447225aa18f7 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 2 Aug 2023 12:58:45 +0530
Subject: [PATCH 3097/3333] Woraround systemd issue on CentOS 9-stream

systemd-252-16.el9 introduced a regression
where libvirtd process exits after 120s of
inactivity.
Add a workaround to unset 120s timeout for
libvirtd, the workaround can be removed once
the fix is available in systemd rpm.

Related-Bug: #2029335
Change-Id: Id6db6c17518b54d5fef7c381c509066a569aff6d
---
 tools/fixup_stuff.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..80a83bb128 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -94,6 +94,11 @@ EOF
     if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
         sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
     fi
+    # TODO(ykarel): Workaround for systemd issue, remove once fix is
+    # included in systemd rpm https://bugs.launchpad.net/devstack/+bug/2029335
+    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 9 ]]; then
+        echo 'LIBVIRTD_ARGS=""' | sudo tee /etc/sysconfig/libvirtd
+    fi
 }
 
 function fixup_ovn_centos {

From 3832ff52b4445324b58a5da123ef4e3880df1591 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 3 Aug 2023 09:16:55 -0700
Subject: [PATCH 3098/3333] Add SERVICE_REPORT_INTERVAL knob

Heavily-loaded workers in CI consistently fail to complete the
service checkin task, which is configured for every ten seconds in
nova and cinder. This generates additional load on the database server
as well as consumes a threadpool worker. If we're not making the
deadline, there's really no point in having it be so high. Further,
since the workers must remain up for all the tempest tests we're
running against them, there's really no benefit to a fast-fail
detection.

This sets the report_interval to 120s for nova and cinder, and sets
service_down_time to 6x that value, which is consistent with the
default scale.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/890448
Change-Id: Idd7aa1daf354256b143a3778f161cfc72b318ea5
---
 lib/cinder | 8 ++++++++
 lib/nova   | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index e37eff4019..f8682d5a71 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -76,6 +76,11 @@ CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 
+# We do not need to report service status every 10s for devstack-like
+# deployments. In the gate this generates extra work for the services and the
+# database which are already taxed.
+CINDER_SERVICE_REPORT_INTERVAL=120
+
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to auto, which will do thin provisioning if it's a fresh
 # volume group, otherwise it will do thick. The other valid choices are
@@ -325,6 +330,9 @@ function configure_cinder {
     # details and example failures.
     iniset $CINDER_CONF DEFAULT rpc_response_timeout 120
 
+    iniset $CINDER_CONF DEFAULT report_interval $CINDER_SERVICE_REPORT_INTERVAL
+    iniset $CINDER_CONF DEFAULT service_down_time $(($CINDER_SERVICE_REPORT_INTERVAL * 6))
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index 888a2e2b25..905788f28f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -75,6 +75,11 @@ NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 # mean "use uwsgi" because we'll be always using uwsgi.
 NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
 
+# We do not need to report service status every 10s for devstack-like
+# deployments. In the gate this generates extra work for the services and the
+# database which are already taxed.
+NOVA_SERVICE_REPORT_INTERVAL=120
+
 if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
 fi
@@ -448,6 +453,9 @@ function create_nova_conf {
 
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
+    iniset $NOVA_CONF DEFAULT report_interval $NOVA_SERVICE_REPORT_INTERVAL
+    iniset $NOVA_CONF DEFAULT service_down_time $(($NOVA_SERVICE_REPORT_INTERVAL * 6))
+
     if is_fedora; then
         # nova defaults to /usr/local/bin, but fedora pip like to
         # install things in /usr/bin

From c3b0b9034e6b35187a125283e55056ae90cbbc4a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 4 Aug 2023 06:41:30 -0700
Subject: [PATCH 3099/3333] Disable waiting forever for connpool workers

This will cause apache to no longer wait forever for a connection
pool member to become available before returning 503 to the client.
This may help us determine if some of the timeouts we see when
talking to the services come from an overloaded apache.

Change-Id: Ibc19fc9a53e2330f9aca45f5a10a59c576cb22e6
---
 lib/apache | 6 +++---
 lib/tls    | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/apache b/lib/apache
index 76eae9c057..cf7215bef2 100644
--- a/lib/apache
+++ b/lib/apache
@@ -290,7 +290,7 @@ function write_uwsgi_config {
         apache_conf=$(apache_site_config_for $name)
         iniset "$file" uwsgi socket "$socket"
         iniset "$file" uwsgi chmod-socket 666
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 " | sudo tee -a $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 acquire=1 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
@@ -351,7 +351,7 @@ function write_local_uwsgi_http_config {
     apache_conf=$(apache_site_config_for $name)
     echo "KeepAlive Off" | sudo tee $apache_conf
     echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
-    echo "ProxyPass \"${url}\" \"http://$APACHE_LOCAL_HOST:$port\" retry=0 " | sudo tee -a $apache_conf
+    echo "ProxyPass \"${url}\" \"http://$APACHE_LOCAL_HOST:$port\" retry=0 acquire=1 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server
 }
@@ -370,7 +370,7 @@ function write_local_proxy_http_config {
 
     echo "KeepAlive Off" | sudo tee $apache_conf
     echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
-    echo "ProxyPass \"${loc}\" \"$url\" retry=0 " | sudo tee -a $apache_conf
+    echo "ProxyPass \"${loc}\" \"$url\" retry=0 acquire=1 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server
 }
diff --git a/lib/tls b/lib/tls
index a1e162d2e2..48e5929a2b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -541,9 +541,11 @@ $listen_string
 
     # Avoid races (at the cost of performance) to re-use a pooled connection
     # where the connection is closed (bug 1807518).
+    # Set acquire=1 to disable waiting for connection pool members so that
+    # we can determine when apache is overloaded (returns 503).
     SetEnv proxy-initial-not-pooled
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=0 nocanon
+        ProxyPass http://$b_host:$b_port/ retry=0 nocanon acquire=1
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 0da88c4af096ab95ccf438960433bb113278181e Mon Sep 17 00:00:00 2001
From: Alfredo Moralejo <amoralej@redhat.com>
Date: Mon, 7 Aug 2023 14:13:41 +0200
Subject: [PATCH 3100/3333] Remove wget + rpm workaround to manage repos
 install in CentOS

RDO has moved rdo-release packages to a new infra which supports EMS so
we do not need to wget it and install it using local rpm install.

This partially reverts [1].

[1] https://review.opendev.org/c/openstack/devstack/+/884277/

Change-Id: I189d0c3da0e7b017e2568022c14e6c8fb28251f1
---
 stack.sh | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/stack.sh b/stack.sh
index ad88eab9d5..b03c3cda1f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -311,22 +311,14 @@ function _install_rdo {
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
         fi
     elif [[ $DISTRO == "rhel9" ]]; then
-        install_package wget
-        # We need to download rdo-release package using wget as installing with dnf from repo.fedoraproject.org fails in
-        # FIPS enabled systems after https://bugzilla.redhat.com/show_bug.cgi?id=2157951
-        # Until we can pull rdo-release from a server which supports EMS, this workaround is doing wget, which does
-        # not relies on openssl but on gnutls, and then install it locally using rpm
-        TEMPRDODIR=$(mktemp -d)
         if [[ "$TARGET_BRANCH" == "master" ]]; then
             # rdo-release.el9.rpm points to latest RDO release, use that for master
-            wget -P $TEMPRDODIR  https://rdoproject.org/repos/rdo-release.el9.rpm
+            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el9.rpm
         else
             # For stable branches use corresponding release rpm
             rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
-            wget -P $TEMPRDODIR https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
+            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
         fi
-        sudo rpm -ivh $TEMPRDODIR/rdo-release*rpm
-        rm -rf $TEMPRDODIR
     fi
     sudo dnf -y update
 }

From 4363b0bd84aad8984ee148b3b4868b311e5d855b Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Tue, 8 Aug 2023 08:38:00 -0400
Subject: [PATCH 3101/3333] Fix $LOGDIR owner to be stack.stack

I have seen this failure in the gate a few times:

[ERROR] /opt/stack/devstack/functions-common:2334 Neutron did not start
/opt/stack/devstack/functions-common: line 310:
  /opt/stack/logs/error.log: Permission denied

So whatever was trying to be written to error.log never
happened. Change to be like other directories in this
file and make the $LOGDIR owner stack.stack.

Change-Id: I673011aba10c8d03234100503ccc5876e75baff2
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index ad88eab9d5..e0caafafa6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -349,7 +349,9 @@ fi
 
 # Destination path for devstack logs
 if [[ -n ${LOGDIR:-} ]]; then
-    mkdir -p $LOGDIR
+    sudo mkdir -p $LOGDIR
+    safe_chown -R $STACK_USER $LOGDIR
+    safe_chmod 0755 $LOGDIR
 fi
 
 # Destination path for service data

From 26b5eddeaaeb3e142d483c12d9a501fdc6abaf10 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 11 Aug 2023 21:51:05 +0200
Subject: [PATCH 3102/3333] GLOBAL_VENV: add nova to linked binaries

This is being used in some nova jobs, so we need to add it. Also order
the list of linked binaries to allow easier maintenance.

Change-Id: Ief012f7842d6e14380c9575740d1856bc1f2355e
---
 stack.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index c8f7c9d79e..641c3c3b5a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -827,11 +827,12 @@ fixup_all
 
 if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
-    sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/nova /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/tox /usr/local/bin
-    sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
 
     setup_devstack_virtualenv
 fi

From 4c45bec6ebb965202d8d7d7832c093f47ecc2910 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sat, 12 Aug 2023 11:35:08 +0200
Subject: [PATCH 3103/3333] GLOBAL_VENV: add more binaries

glance and rally binaries are also needed.

Also make sure the cinder-rtstool is only called when cinder is actually
enabled.

Change-Id: I18113eabf2fa83e36bace276883775303f6a1e9a
---
 lib/lvm  | 20 +++++++++++---------
 stack.sh |  2 ++
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index 57d2cd4e62..162c491f22 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -137,15 +137,17 @@ function init_lvm_volume_group {
     # Start with a clean volume group
     _create_lvm_volume_group $vg $size
 
-    # Remove iscsi targets
-    if [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
-        sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
-    elif [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
-        sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
-    elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
-        # If we don't disconnect everything vgremove will block
-        sudo nvme disconnect-all
-        sudo nvmetcli clear
+    if is_service_enabled cinder; then
+        # Remove iscsi targets
+        if [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
+            sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
+        elif [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
+            sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
+        elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
+            # If we don't disconnect everything vgremove will block
+            sudo nvme disconnect-all
+            sudo nvmetcli clear
+        fi
     fi
     _clean_lvm_volume_group $vg
 }
diff --git a/stack.sh b/stack.sh
index 94d586e812..d8b70a2b39 100755
--- a/stack.sh
+++ b/stack.sh
@@ -828,10 +828,12 @@ fixup_all
 if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/glance /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/rally /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/tox /usr/local/bin
 
     setup_devstack_virtualenv

From 08b434e5b06a0f28a1779159df494d27db95704c Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Mon, 14 Aug 2023 17:05:45 +0000
Subject: [PATCH 3104/3333] Revert "GLOBAL_VENV: add nova to linked binaries"

This reverts commit 26b5eddeaaeb3e142d483c12d9a501fdc6abaf10.

Reason for revert: nova changed to use osc

- https://review.opendev.org/c/openstack/nova/+/891247/2

Resolving conflict due to
- https://review.opendev.org/c/openstack/devstack/+/891248

Change-Id: I69e179a90a241946b3f426a41c38ae72a66ba6dc
---
 stack.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index d8b70a2b39..a8f46bfeb9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -829,7 +829,6 @@ if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/glance /usr/local/bin
-    sudo ln -sf /opt/stack/data/venv/bin/nova /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin

From 220004fb5c529d84e2e8d909db71cf17a00c0815 Mon Sep 17 00:00:00 2001
From: Artom Lifshitz <alifshit@redhat.com>
Date: Wed, 16 Aug 2023 14:08:15 -0400
Subject: [PATCH 3105/3333] Allow others to override
 NOVA_SERVICE_REPORT_INTERVAL

While the patch where this was first introduced and set to 120 [1] is
sensible for the vast majority of jobs, it's conceivable that some
jobs might want a different value.

Specifically, the whitebox-tempest-plugin changes configurations and
restarts Nova services, and to do so it waits for the service status
to update in the API before continuing with the tests. With the report
interval set to 120 and the down time threshold set to 720, the
service would continue showing 'up' in the API long after it was
actually down, causing the wait to time out.

Whitebox is a low-traffic project with only a couple of devstack jobs
that run tempest tests sequentially (concurrency=1). Its CI is also
pretty stable. It seems legitimate for it to keep the old default
values of report_interval and service_down_time.

This patch keeps the 120 default for NOVA_SERVICE_REPORT_INTERVAL, but
makes it configurable by individual jobs. Since the original patch
also introduced CINDER_SERVICE_REPORT_INTERVAL as a constant, make
that configurable as well.

[1] https://review.opendev.org/c/openstack/devstack/+/890439

Needed-by: https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/891612
Change-Id: I64fa2059537ea072a38fb4900d3c7d2d8f0ce429
---
 lib/cinder | 2 +-
 lib/nova   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index f8682d5a71..768a069a12 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -79,7 +79,7 @@ CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $S
 # We do not need to report service status every 10s for devstack-like
 # deployments. In the gate this generates extra work for the services and the
 # database which are already taxed.
-CINDER_SERVICE_REPORT_INTERVAL=120
+CINDER_SERVICE_REPORT_INTERVAL=${CINDER_SERVICE_REPORT_INTERVAL:-120}
 
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to auto, which will do thin provisioning if it's a fresh
diff --git a/lib/nova b/lib/nova
index 905788f28f..da3118f4cd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -78,7 +78,7 @@ NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
 # We do not need to report service status every 10s for devstack-like
 # deployments. In the gate this generates extra work for the services and the
 # database which are already taxed.
-NOVA_SERVICE_REPORT_INTERVAL=120
+NOVA_SERVICE_REPORT_INTERVAL=${NOVA_SERVICE_REPORT_INTERVAL:-120}
 
 if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"

From 7c4a955c52ead024ef50f448b3894b5ef362508d Mon Sep 17 00:00:00 2001
From: yatin <ykarel@redhat.com>
Date: Mon, 21 Aug 2023 06:28:30 +0000
Subject: [PATCH 3106/3333] Revert "Woraround systemd issue on CentOS 9-stream"

This reverts commit 113689ee4694de20c019735fdace447225aa18f7.

Reason for revert: systemd-252-17.el9 which includes the fix is now available in CentOS 9-stream repos.

Change-Id: I6fe19838a75a30fd5d2434c03b7f403f1c7e4b50
---
 tools/fixup_stuff.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 80a83bb128..faea44f1e0 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -94,11 +94,6 @@ EOF
     if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
         sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
     fi
-    # TODO(ykarel): Workaround for systemd issue, remove once fix is
-    # included in systemd rpm https://bugs.launchpad.net/devstack/+bug/2029335
-    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 9 ]]; then
-        echo 'LIBVIRTD_ARGS=""' | sudo tee /etc/sysconfig/libvirtd
-    fi
 }
 
 function fixup_ovn_centos {

From 3a7a3cd8c5a5ac3f1655d6ff17974f8623fb3330 Mon Sep 17 00:00:00 2001
From: Jan Gutter <github@jangutter.com>
Date: Mon, 14 Aug 2023 21:02:04 +0100
Subject: [PATCH 3107/3333] Update etcd version to 3.4.27

* etcd 3.3 is no longer maintained.
* etcd 3.4 removes deprecated interfaces, and clients may
  need updated configs.
* The cinder backend coordination URL needs to explicitly
  specify the version, until tooz can be updated
  https://review.opendev.org/c/openstack/tooz/+/891355
* etcd only supports in-place upgrades between minor
  versions, so any jobs testing upgrades could fail if
  they skip from 3.2 directly to 3.4

Change-Id: Ifcecdffa17a3a2b1075aa503978c44545c4a2a3c
---
 lib/cinder |  4 +++-
 stackrc    | 10 +++++-----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index f8682d5a71..dad17980bc 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -414,7 +414,9 @@ function configure_cinder {
     if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then
         iniset $CINDER_CONF coordination backend_url "$CINDER_COORDINATION_URL"
     elif is_service_enabled etcd3; then
-        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
+        # NOTE(jan.gutter): api_version can revert to default once tooz is
+        # updated with the etcd v3.4 defaults
+        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT?api_version=v3"
     fi
 
     if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
diff --git a/stackrc b/stackrc
index 0d1880cec9..2d25e379fd 100644
--- a/stackrc
+++ b/stackrc
@@ -728,11 +728,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.3.12}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"dc5d82df095dae0a2970e4d870b6929590689dd707ae3d33e7b86da0f7f211b6"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"170b848ac1a071fe7d495d404a868a2c0090750b2944f8a260ef1c6125b2b4f4"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"77f807b1b51abbf51e020bb05bdb8ce088cb58260fcd22749ea32eee710463d3"}
-# etcd v3.2.x doesn't have anything for s390x
+ETCD_VERSION=${ETCD_VERSION:-v3.4.27}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"a32d21e006252dbc3405b0645ba8468021ed41376974b573285927bf39b39eb9"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"ed7e257c225b9b9545fac22246b97f4074a4b5109676e92dbaebfb9315b69cc0"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"eb8825e0bc2cbaf9e55947f5ee373ebc9ca43b6a2ea5ced3b992c81855fff37e"}
+# etcd v3.2.x and later doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then

From 7cd3a8eebe1830f94c02bb6ec010c0365f6ab6f1 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 22 Aug 2023 20:40:20 +0200
Subject: [PATCH 3108/3333] Set GLOBAL_VENV to false for centos and rocky

As a temporary workaround, let's set the GLOBAL_VENV to false
specifically for centos 9 stream and rocky distros where we
encountered issues after changing the default value
of GLOBAL_VENV to True in Devstack:
https://review.opendev.org/c/openstack/devstack/+/558930

Related-Bug: #2031639
Change-Id: I708b5a81c32b0bd650dcd63a51e16346863a6fc0
---
 .zuul.yaml |  5 -----
 stackrc    | 11 ++++++++++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e65dc5b7cf..8b60fc9936 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -708,9 +708,6 @@
     nodeset: devstack-single-node-centos-9-stream
     timeout: 9000
     voting: false
-    vars:
-      devstack_localrc:
-        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-debian-bookworm
@@ -745,8 +742,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_localrc:
-        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-ubuntu-focal
diff --git a/stackrc b/stackrc
index 0d1880cec9..bd4e2f17a2 100644
--- a/stackrc
+++ b/stackrc
@@ -188,9 +188,18 @@ ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)
 # Note that the DATA_DIR is selected because grenade testing uses a shared
 # DATA_DIR but different DEST dirs and we don't want two sets of venvs,
 # instead we want one global set.
-GLOBAL_VENV=$(trueorfalse True GLOBAL_VENV)
 DEVSTACK_VENV=${DEVSTACK_VENV:-$DATA_DIR/venv}
 
+# NOTE(kopecmartin): remove this once this is fixed
+# https://bugs.launchpad.net/devstack/+bug/2031639
+# This couldn't go to fixup_stuff as that's called after projects
+# (e.g. certain paths) are set taking GLOBAL_VENV into account
+if [[ "$os_VENDOR" =~ (CentOSStream|Rocky) ]]; then
+    GLOBAL_VENV=$(trueorfalse False GLOBAL_VENV)
+else
+    GLOBAL_VENV=$(trueorfalse True GLOBAL_VENV)
+fi
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.

From 5a51aa524c1f955a4650099c344756acc6c6b507 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 23 Aug 2023 10:43:32 -0700
Subject: [PATCH 3109/3333] Fix glance-remote with global venv

The base systemd unit file setup now writes an Environment= line to
the file for the venv. The glance-remote code was setting that to
point at the alternate config location, using iniset which was
clobbering the venv one. Switch to iniadd to fix.

Also, we need to explicitly put the --venv flag into the command since
we write our unit file ourselves. This probably needs a cleanup at
this point, but since the glance gate is blocked, do this for now.

Change-Id: I2bd33de45c41b18ed7d4270a7301b1e322134987
---
 lib/glance | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index e64f00027e..3cf8230f41 100644
--- a/lib/glance
+++ b/lib/glance
@@ -584,9 +584,10 @@ function start_glance_remote_clone {
     write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
                                --procname-prefix \
                                glance-api-remote \
-                               --ini $glance_remote_uwsgi" \
+                               --ini $glance_remote_uwsgi \
+                               --venv $DEVSTACK_VENV" \
                                "" "$STACK_USER"
-    iniset -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
+    iniadd -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
            "Service" "Environment" \
            "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
 

From ef53db76d029382dd8b3566224e51351b9d36280 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 24 Aug 2023 00:42:19 +0000
Subject: [PATCH 3110/3333] Fix configuration of LVM global_filter

As far as I could tell, the global_filter config added in change
I5d5c48e188cbb9b4208096736807f082bce524e8 wasn't actually making it
into the lvm.conf. Given the volume (or rather LVM volume) related
issues we've been seeing in the gate recently, we can give this a try
to see if the global_filter setting has any positive effect.

This also adds the contents of /etc/lvm/* to the logs collected by the
jobs, so that we can see the LVM config.

Change-Id: I2b39acd352669231d16b5cb2e151f290648355c0
---
 .zuul.yaml | 1 +
 lib/lvm    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8b60fc9936..46e1e45e39 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -430,6 +430,7 @@
         /var/log/mysql: logs
         /var/log/libvirt: logs
         /etc/libvirt: logs
+        /etc/lvm: logs
         /etc/sudoers: logs
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs
diff --git a/lib/lvm b/lib/lvm
index 162c491f22..b7e84d9505 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -200,7 +200,7 @@ function set_lvm_filter {
     filter_string=$filter_string$filter_suffix
 
     clean_lvm_filter
-    sudo sed -i "/# global_filter = \[*\]/a\    $global_filter$filter_string" /etc/lvm/lvm.conf
+    sudo sed -i "/# global_filter = \[.*\]/a\        $filter_string" /etc/lvm/lvm.conf
     echo_summary "set lvm.conf device global_filter to: $filter_string"
 }
 

From ffc1b76f64341e18b5a6e60783f1e33297623f99 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 28 Aug 2023 10:52:26 +0530
Subject: [PATCH 3111/3333] [neutron] Rely on PATH env set by devstack

This was missed as part of [1], neutron sets
exec_dirs in rootwrap.conf differently so that
also needs to be fixed.

Without it neutron openvswitch jobs relying on
neutron-keepalived-state-change scripts were
failing when deployed with GLOBAL_VENV=True as
binaries no longer found at /usr/local/bin.

[1] https://review.opendev.org/c/openstack/devstack/+/558930

Closes-Bug: #2031415
Change-Id: I9aa56bff02594f253381ffe47a70949079f4c240
---
 lib/neutron | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index a6de7222db..e90ada8929 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1075,7 +1075,10 @@ function _neutron_setup_rootwrap {
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
-    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
+    # Rely on $PATH set by devstack to determine what is safe to execute
+    # by rootwrap rather than use explicit whitelist of paths in
+    # rootwrap.conf
+    sudo sed -e 's/^exec_dirs=.*/#&/' -i $Q_RR_CONF_FILE
 
     # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
     ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"

From 427a4e1a9b7f20a8be0ad5091f2229945ce711a8 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 7 Jun 2023 15:26:07 +0200
Subject: [PATCH 3112/3333] Drop focal platform job and support

This was dropped in tempest, too[0], and we want to focus on getting and
keeping the jammy job stable.

Still retaining the nodeset definitions until we are sure they are not
needed in other projects.

[0] https://review.opendev.org/c/openstack/tempest/+/884952

Change-Id: Iafb5a939a650b763935d8b7ce7069ac4c6d9a95b
---
 .zuul.yaml | 9 ---------
 stack.sh   | 2 +-
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 46e1e45e39..356acec479 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -744,13 +744,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-platform-ubuntu-focal
-    parent: tempest-full-py3
-    description: Ubuntu 20.04 LTS (focal) platform test
-    nodeset: openstack-single-node-focal
-    timeout: 9000
-
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
     parent: devstack-platform-ubuntu-jammy
@@ -946,7 +939,6 @@
         - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-focal
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
         - devstack-platform-openEuler-22.03-ovn-source
@@ -995,7 +987,6 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bullseye
-        - devstack-platform-ubuntu-focal
         - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope
         - devstack-multinode
diff --git a/stack.sh b/stack.sh
index a8f46bfeb9..c8810cd2f0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|bullseye|jammy|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 16ac21f0da4f1b83963c4beb876f8494d9594b7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Harald=20Jens=C3=A5s?= <hjensas@redhat.com>
Date: Thu, 31 Aug 2023 15:06:52 +0200
Subject: [PATCH 3113/3333] Add OVN_BRIDGE_MAPPINGS - support extra bridge

Add's the OVN_BRIDGE_MAPPINGS variable to ovn_agent.
Uses the same format as OVS_BRIDGE_MAPPINGS, it defaults
to "$PYSICAL_NETWORK:$PUBLIC_BRIDGE".

This enables use of providernet for public network and
setting up additional bridges, for example a for baremetal.

Example:
  Q_USE_PROVIDER_NETWORKING="True"
  OVS_PHYSICAL_BRIDGE="brbm"
  PHYSICAL_NETWORK="mynetwork"
  PUBLIC_PHYSICAL_NETWORK="public"
  PUBLIC_BRIDGE="br-ex"
  OVN_BRIDGE_MAPPINGS="public:br-ex,mynetwork:brbm"

Change-Id: I37317251bbe95d64de06d6232c2d472a98c0ee4d
---
 lib/neutron                     | 5 +++++
 lib/neutron_plugins/ovn_agent   | 2 +-
 lib/neutron_plugins/services/l3 | 8 +++++++-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e90ada8929..ca9b788b2e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -303,6 +303,11 @@ else
     Q_USE_SECGROUP=False
 fi
 
+# OVN_BRIDGE_MAPPINGS - ovn-bridge-mappings
+# NOTE(hjensas): Initialize after sourcing neutron_plugins/services/l3
+# which initialize PUBLIC_BRIDGE.
+OVN_BRIDGE_MAPPINGS=${OVN_BRIDGE_MAPPINGS:-$PHYSICAL_NETWORK:$PUBLIC_BRIDGE}
+
 # Save trace setting
 _XTRACE_NEUTRON=$(set +o | grep xtrace)
 set +o xtrace
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 3526ccd354..c51b708130 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -288,7 +288,7 @@ function clone_repository {
 function create_public_bridge {
     # Create the public bridge that OVN will use
     sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE protocols=OpenFlow13,OpenFlow15
-    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$PUBLIC_BRIDGE
+    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=${OVN_BRIDGE_MAPPINGS}
     _configure_public_network_connectivity
 }
 
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2bf884a8c4..c6d4663114 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -47,7 +47,8 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 # used for the network.  In case of ofagent, you should add the
 # corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
 # For openvswitch agent, you should add the corresponding entry to
-# your OVS_BRIDGE_MAPPINGS.
+# your OVS_BRIDGE_MAPPINGS and for OVN add the corresponding entry
+# to your OVN_BRIDGE_MAPPINGS.
 #
 # eg.  (ofagent)
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
@@ -60,6 +61,11 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
 #
+# eg.  (ovn agent)
+#    Q_USER_PROVIDERNET_FOR_PUBLIC=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OVN_BRIDGE_MAPPINGS=public:br-ex
+#
 # The provider-network-type defaults to flat, however, the values
 # PUBLIC_PROVIDERNET_TYPE and PUBLIC_PROVIDERNET_SEGMENTATION_ID could
 # be set to specify the parameters for an alternate network type.

From a389128dba4ce7d7051b86f3ac7db4164d24b95f Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 18 Jul 2023 16:31:28 +0100
Subject: [PATCH 3114/3333] OVN: Let ironic manage the OVN startup in it's
 case.

In order for Ironic perform full testing with devstack, it uses
virtual machines attached to a ovs bridge network to simulate
bare metal machines. This worked great for OVS because often
OVS was already running on the nodes due to the package, and
we could just apply configuration and be done with it when
Ironic's devstack plugin was applying initial configuration and
setting up the test environment.

With OVN, and the requirement of a specific co-installed OVS
version, Ironic has discovered that we cannot perform this same
configuration without having already started OVN during the
initial system setup. Which is fine, but we can't initialize
and start OVN twice. It just doesn't work.

The original form of this patch was proposed by lucasgnomes
in order to validate that we, did, indeed, need to do this
to enable Ironic to successfully test an OVN based
configuration, and is now being revised to handle that case
automatically when Ironic is the selected virt plugin.

Co-Authored-By: Julia Kreger <juliaashleykreger@gmail.com>
Change-Id: Ifbfdaaa97fdbe75ede49dc47235e92a8035d1de6
---
 lib/neutron | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e90ada8929..5407f8a7b8 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -570,8 +570,15 @@ function configure_rbac_policies {
 # Start running OVN processes
 function start_ovn_services {
     if [[ $Q_AGENT == "ovn" ]]; then
-        init_ovn
-        start_ovn
+        if [ "$VIRT_DRIVER" != 'ironic' ]; then
+            # NOTE(TheJulia): Ironic's devstack plugin needs to perform
+            # additional networking configuration to setup a working test
+            # environment with test virtual machines to emulate baremetal,
+            # which requires OVN to be up and running earlier to complete
+            # that base configuration.
+            init_ovn
+            start_ovn
+        fi
         if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
             if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
                 echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "

From e1297193dcb93acc1f7b89f5fe91babbcc6dda49 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Sun, 10 Sep 2023 16:24:38 -0700
Subject: [PATCH 3115/3333] [nova][ironic] Support configuring 1 shard on n-cpu

Allows for testing of basic sharding configuration.

Change-Id: Idfb2bd1822898d95af8643d69d97d9a76b4d64cc
Needed-By: https://review.opendev.org/c/openstack/ironic/+/894460
---
 functions-common                   | 6 ++++++
 lib/nova_plugins/hypervisor-ironic | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/functions-common b/functions-common
index f752271976..c57c4cc054 100644
--- a/functions-common
+++ b/functions-common
@@ -1114,6 +1114,12 @@ function is_ironic_enforce_scope {
     return 1
 }
 
+function is_ironic_sharded {
+    # todo(JayF): Support >1 shard with multiple n-cpu instances for each
+    is_service_enabled ironic && [[ "$IRONIC_SHARDS" == "1" ]] && return 0
+    return 1
+}
+
 
 # Package Functions
 # =================
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index f058e9bb53..9a39c798a8 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -53,6 +53,10 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF ironic project_domain_id default
         iniset $NOVA_CONF ironic project_name demo
     fi
+    if is_ironic_sharded; then
+        iniset $NOVA_CONF ironic shard $IRONIC_SHARD_1_NAME
+    fi
+
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic region_name $REGION_NAME
 

From 290a02d1f80b4de1bdeaaddaef7f59402a767d02 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 12 Sep 2023 17:32:03 +0200
Subject: [PATCH 3116/3333] Remove openeuler job from periodic and check queue

The openeuler job running version 22.03 fails due to old libvirt.
Nova requires version 7.0.0 or greater.

Related-Bug: #2035224
Change-Id: I4ad6151c3d8555de059c9228253d287aecf9f953
---
 .zuul.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 356acec479..5a7edd6c93 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -941,8 +941,6 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1067,7 +1065,3 @@
     periodic:
       jobs:
         - devstack-no-tls-proxy
-    periodic-weekly:
-      jobs:
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs

From d3953db76641e825565390acc6f68501777c0f53 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 19 Sep 2023 02:15:19 +0000
Subject: [PATCH 3117/3333] Updated from generate-devstack-plugins-list

Change-Id: I18a47f5d604bbb83173151fb0b129deee2fcbe62
---
 doc/source/plugin-registry.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f54fca92e6..03c7469c8f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,7 +69,6 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
-openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
@@ -85,7 +84,6 @@ openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
-openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__

From f73d3127832798db8d7830d1456bdedd1a6a6903 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 20 Sep 2023 07:04:37 +0200
Subject: [PATCH 3118/3333] CI: Make bookworm platform job voting

It has been very stable for some time and it is going to be a major
platform for the next cycle.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Id2df9514b41eda0798179157282a8486b1e9ae23
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5a7edd6c93..1d1e3c9807 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -716,7 +716,6 @@
     description: Debian Bookworm platform test
     nodeset: devstack-single-node-debian-bookworm
     timeout: 9000
-    voting: false
     vars:
       configure_swap_size: 4096
       devstack_localrc:
@@ -984,6 +983,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope

From 5441b3df6e534101e66f8187ac9ff2bba2533fb5 Mon Sep 17 00:00:00 2001
From: Jake Yip <jake.yip@ardc.edu.au>
Date: Sat, 10 Jun 2023 00:17:53 +1000
Subject: [PATCH 3119/3333] Use OS_CLOUD in sample local.sh

local.sh, if present, will be executed at the end of stack.sh. The
sample file here is meant to be copied to devstack root if desired.

Unfortunately, due to Change I86ffa9cd52454f1c1c72d29b3a0e0caa3e44b829
changing to use OS_CLOUD in stack.sh, sourcing openrc here will cause
both OS_CLOUD and traditional OS_* env vars to be set, which causes a
conflict.

Change-Id: Id80b46acab7d600ad7394ab5bc1984304825a672
---
 samples/local.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/local.sh b/samples/local.sh
index a1c5c8143b..7e6ae70ad4 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -31,7 +31,7 @@ if is_service_enabled nova; then
     # ``demo``)
 
     # Get OpenStack user auth
-    source $TOP_DIR/openrc
+    export OS_CLOUD=devstack
 
     # Add first keypair found in localhost:$HOME/.ssh
     for i in $HOME/.ssh/id_rsa.pub $HOME/.ssh/id_dsa.pub; do

From 25cd7eb67286ba39060d05b3f3f9e785d125195a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 21 Sep 2023 07:12:15 -0700
Subject: [PATCH 3120/3333] Fix g-api-r for non-global venv

This makes the glance-api-remote setup honor the GLOBAL_VENV flag,
and not pass the --venv stuff to uwsgi if it is disabled. This should
fix the glance-multistore-cinder-import-fips job.

Change-Id: I2005da5ced027d273e1f25f47b644fecafffc6c1
---
 lib/glance | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 3cf8230f41..796ebdb68d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -543,7 +543,7 @@ function glance_remote_conf {
 # start_glance_remote_clone() - Clone the regular glance api worker
 function start_glance_remote_clone {
     local glance_remote_conf_dir glance_remote_port remote_data
-    local glance_remote_uwsgi
+    local glance_remote_uwsgi venv
 
     glance_remote_conf_dir="$(glance_remote_conf "")"
     glance_remote_port=$(get_random_port)
@@ -581,11 +581,14 @@ function start_glance_remote_clone {
     # We need to create the systemd service for the clone, but then
     # change it to include an Environment line to point the WSGI app
     # at the alternate config directory.
+    if [[ "$GLOBAL_VENV" == True ]]; then
+        venv="--venv $DEVSTACK_VENV"
+    fi
     write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
                                --procname-prefix \
                                glance-api-remote \
                                --ini $glance_remote_uwsgi \
-                               --venv $DEVSTACK_VENV" \
+                               $venv" \
                                "" "$STACK_USER"
     iniadd -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
            "Service" "Environment" \

From 3d37d13ee7aacd5594b351e324d8780e6d64d61b Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 28 Sep 2023 11:36:07 -0700
Subject: [PATCH 3121/3333] Update DEVSTACK_SERIES to 2024.1

stable/2023.2 branch has been created now and
current master is for 2024.1

Change-Id: I67eee1ba721a1ad99b3503312acc2f94a52c5552
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ff30d37721..464e935839 100644
--- a/stackrc
+++ b/stackrc
@@ -265,7 +265,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2023.2"
+DEVSTACK_SERIES="2024.1"
 
 ##############
 #

From 8c25a8586122d5f00bdcec9b6c4826309891ba62 Mon Sep 17 00:00:00 2001
From: Lukas Piwowarski <lpiwowar@redhat.com>
Date: Thu, 5 Oct 2023 08:11:05 +0000
Subject: [PATCH 3122/3333] Add support volume backup_driver config option

The depends-on patch adds a new backup_driver option to tempest.
The goal of this change is to be able to do a proper cleanup of
containers when swift is used as a backup driver.

Thich change makes sure that the new option is properly set to
"swift" when Swift is used as the driver.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/896011/13
Change-Id: I76e7fd712ee352051f8aa2f2912a29abad9ad017
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 2f62f6ea62..7b5fde170e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -29,6 +29,7 @@
 # - ``DEFAULT_INSTANCE_USER``
 # - ``DEFAULT_INSTANCE_ALT_USER``
 # - ``CINDER_ENABLED_BACKENDS``
+# - ``CINDER_BACKUP_DRIVER``
 # - ``NOVA_ALLOW_DUPLICATE_NETWORKS``
 #
 # ``stack.sh`` calls the entry points in this order:
@@ -571,6 +572,9 @@ function configure_tempest {
         TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
+    if [[ "$CINDER_BACKUP_DRIVER" == *"swift"* ]]; then
+        iniset $TEMPEST_CONFIG volume backup_driver swift
+    fi
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     if [ "$tempest_volume_min_microversion" == "None" ]; then

From ca4d5132e63752878620c4e4f374d98d433b3f52 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 10 Oct 2023 09:22:16 +0200
Subject: [PATCH 3123/3333] zuul: Drop neutron-linuxbridge-tempest job

Neutron has deprecated linuxbridge support and is only doing reduced
testing for the neutron-linuxbridge-tempest job, so we need no longer
run it in devstack, even less gate on it.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Ie1a8f978efe7fc9b037cf6a6b70b67d539d76fd6
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 1d1e3c9807..6ee8177a6d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -953,10 +953,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-linuxbridge-tempest:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - neutron-ovn-tempest-ovs-release:
             voting: false
             irrelevant-files:
@@ -994,10 +990,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-linuxbridge-tempest:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:

From 72cf4e60060d8024a9fb79c845babc621f35dd2f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 12 Oct 2023 11:08:30 -0700
Subject: [PATCH 3124/3333] Allow forcing nova compute_id

Developers that need to stack and re-stack non-AIO compute-only
environments will want to be able to keep the compute node uuid the
same across runs. This mimics the behavior of a deployment tool that
pre-creates the uuids, so it matches pretty well. Default to the
current behavior of create-on-start, but allow forcing it ahead of
time to something specific.

Change-Id: Icab0b783e2233cad9a93c04758a5bccac0832203
---
 lib/nova | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/nova b/lib/nova
index da3118f4cd..b04f94beef 100644
--- a/lib/nova
+++ b/lib/nova
@@ -58,6 +58,14 @@ NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
 NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
 NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
+# Allow forcing the stable compute uuid to something specific. This would be
+# done by deployment tools that pre-allocate the UUIDs, but it is also handy
+# for developers that need to re-stack a compute-only deployment multiple
+# times. Since the DB is non-local and not erased on an unstack, making it
+# stay the same each time is what developers want. Set to a uuid here or
+# leave it blank for default allocate-on-start behavior.
+NOVA_CPU_UUID=""
+
 # The total number of cells we expect. Must be greater than one and doesn't
 # count cell0.
 NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
@@ -1058,6 +1066,10 @@ function start_nova_compute {
         iniset $NOVA_CPU_CONF workarounds libvirt_disable_apic True
     fi
 
+    if [[ "$NOVA_CPU_UUID" ]]; then
+        echo -n $NOVA_CPU_UUID > $NOVA_CONF_DIR/compute_id
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From eb9b08a8833884b7c7c5b55813d7621715fe7adf Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 14 Oct 2023 02:26:11 +0000
Subject: [PATCH 3125/3333] Updated from generate-devstack-plugins-list

Change-Id: Ieecc17159ac36b65124598c36fc92b77c2a75399
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 03c7469c8f..b2e733337a 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -78,6 +78,7 @@ openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
+openstack/nova                           `https://opendev.org/openstack/nova <https://opendev.org/openstack/nova>`__
 openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
 openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__

From d2acd60870c63b486d4802cc3af0fdb27bd506c7 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 16 Oct 2023 15:02:08 +0900
Subject: [PATCH 3126/3333] Horizon: Install pymemcached

... so that we can use PyMemcacheCache backend. The MemcachedCache
backend, which has been used previously, has been removed in recent
Django, and we are switching the default backend in [1].

[1] https://review.opendev.org/c/openstack/horizon/+/891828

Change-Id: Ie1da8970628e34c41721198cdada8c7bb3b26ec0
---
 lib/horizon | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 611329d619..6f753f546f 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -169,6 +169,10 @@ function install_horizon {
     # Apache installation, because we mark it NOPRIME
     install_apache_wsgi
 
+    # Install the memcache library so that horizon can use memcached as its
+    # cache backend
+    pip_install_gr pymemcache
+
     git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH
 }
 

From cace4044316befbbef9bcb7af2003f3045350830 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 23 Oct 2023 11:21:24 -0700
Subject: [PATCH 3127/3333] Fix performance stats gathering for global VENV

Change-Id: I113c571ffddb241b29b1394e181ed0145b3c1e04
---
 roles/capture-performance-data/tasks/main.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roles/capture-performance-data/tasks/main.yaml b/roles/capture-performance-data/tasks/main.yaml
index f9bb0f7851..51a11b60bc 100644
--- a/roles/capture-performance-data/tasks/main.yaml
+++ b/roles/capture-performance-data/tasks/main.yaml
@@ -3,7 +3,9 @@
     executable: /bin/bash
     cmd: |
       source {{ devstack_conf_dir }}/stackrc
-      python3 {{ devstack_conf_dir }}/tools/get-stats.py \
+      source {{ devstack_conf_dir }}/inc/python
+      setup_devstack_virtualenv
+      $PYTHON {{ devstack_conf_dir }}/tools/get-stats.py \
         --db-user="$DATABASE_USER" \
         --db-pass="$DATABASE_PASSWORD" \
         --db-host="$DATABASE_HOST" \

From 29e73a215557b2d20d0d9611e0d5317e08cf9538 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 24 Oct 2023 06:18:22 +0200
Subject: [PATCH 3128/3333] Enable performance collection on Debian

Change-Id: I84f1432262138cc9ff0942e1a2b2abe7447afe34
---
 .zuul.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6ee8177a6d..12bef3bff1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -718,9 +718,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_localrc:
-        # TODO(frickler): drop this once wheel build is fixed
-        MYSQL_GATHER_PERFORMANCE: false
 
 - job:
     name: devstack-platform-debian-bullseye
@@ -730,9 +727,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_localrc:
-        # TODO(frickler): drop this once wheel build is fixed
-        MYSQL_GATHER_PERFORMANCE: false
 
 - job:
     name: devstack-platform-rocky-blue-onyx

From bacb8400942b2ed6b724bdd3d28797896e1054c6 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 25 Oct 2023 12:52:28 -0700
Subject: [PATCH 3129/3333] Enable NEUTRON_ENFORCE_SCOPE to True by default

Neutron bobcat release has enabled the RBAC new defaults
by default. With the latest release of Neutron have new
defaults enable, we should configure the same by default in
devstack. This change make NEUTRON_ENFORCE_SCOPE flag to
True by default so that every job will run with Neutron
new defaults.

As old defaults are still supported (in deprecated way),
we will keep this flag so that we can have one job disable
it and test the old defaults.

Change-Id: I3361d33885b2e3af7cad0141f9b799b2723ee8a1
---
 lib/neutron | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 808043cebe..3628bfc25e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -92,8 +92,9 @@ NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
 # If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
 # and "enforce_new_defaults" to True in the Neutron's config to enforce usage
-# of the new RBAC policies and scopes.
-NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
+# of the new RBAC policies and scopes. Set it to False if you do not
+# want to run Neutron with new RBAC.
+NEUTRON_ENFORCE_SCOPE=$(trueorfalse True NEUTRON_ENFORCE_SCOPE)
 
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/

From 67630d4c52aef5ddcb15cff4f3b6594d447e8992 Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Sun, 18 Jun 2023 14:46:06 +0200
Subject: [PATCH 3130/3333] Enable keystone token caching by OSC

SDK uses python keyring library to enable token caching. Normally this
is requiring a proper desktop (interactive) session, but there are some
backend plugins working in non-interactive mode. Store cache in an
unencrypted file on FS (this is not worse than storing passwords in
plaintext).

Change-Id: I42d698f15db5918443073fff8f27b926126d1d0f
---
 functions-common            | 10 +++++++++-
 lib/libraries               |  4 ++++
 tools/update_clouds_yaml.py | 27 ++++++++++++++++++++++-----
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index c57c4cc054..03d7c96417 100644
--- a/functions-common
+++ b/functions-common
@@ -1047,6 +1047,8 @@ function get_or_create_service {
             --description="$3" \
             -f value -c id
     )
+    # Drop cached token to invalidate catalog info in the token
+    remove_token_cache
     echo $service_id
 }
 
@@ -1064,7 +1066,6 @@ function _get_or_create_endpoint_with_interface {
         endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint create \
             $1 $2 $3 --region $4 -f value -c id)
     fi
-
     echo $endpoint_id
 }
 
@@ -1088,6 +1089,8 @@ function get_or_create_endpoint {
     if [[ -n "$5" ]]; then
         _get_or_create_endpoint_with_interface $1 internal $5 $2
     fi
+    # Drop cached token to invalidate catalog info in the token
+    remove_token_cache
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
 }
@@ -2517,6 +2520,11 @@ function is_fips_enabled {
     [ "$fips" == "1" ]
 }
 
+function remove_token_cache {
+    # Remove Keyring cache file
+    rm ~/.local/share/python_keyring/keyring_pass.cfg
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..146434e2b9 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -138,6 +138,10 @@ function install_libs {
     # doesn't pull in etcd3.
     pip_install etcd3
     pip_install etcd3gw
+
+    # Add libraries required for token caching by OpenStackSDK/CLI
+    pip_install keyring
+    pip_install keyrings.alt
 }
 
 # Restore xtrace
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 74dcdb2a07..918988245b 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -30,7 +30,9 @@ def __init__(self, args):
             self._clouds_path = os.path.expanduser(
                 '~/.config/openstack/clouds.yaml')
             self._create_directory = True
-        self._clouds = {}
+        self._keyringrc_path = os.path.expanduser(
+                '~/.config/python_keyring/keyringrc.cfg')
+        self._config = {}
 
         self._cloud = args.os_cloud
         self._cloud_data = {
@@ -65,14 +67,17 @@ def run(self):
     def _read_clouds(self):
         try:
             with open(self._clouds_path) as clouds_file:
-                self._clouds = yaml.safe_load(clouds_file)
+                self._config = yaml.safe_load(clouds_file)
         except IOError:
             # The user doesn't have a clouds.yaml file.
             print("The user clouds.yaml file didn't exist.")
-            self._clouds = {}
+        if "cache" not in self._config:
+            # Enable auth (and only auth) caching. Currently caching into the
+            # file on FS is configured in `_write_clouds` function.
+            self._config["cache"] = {"auth": True}
 
     def _update_clouds(self):
-        self._clouds.setdefault('clouds', {})[self._cloud] = self._cloud_data
+        self._config.setdefault('clouds', {})[self._cloud] = self._cloud_data
 
     def _write_clouds(self):
 
@@ -81,7 +86,19 @@ def _write_clouds(self):
             os.makedirs(clouds_dir)
 
         with open(self._clouds_path, 'w') as clouds_file:
-            yaml.dump(self._clouds, clouds_file, default_flow_style=False)
+            yaml.dump(self._config, clouds_file, default_flow_style=False)
+
+        # Enable keyring token caching
+        keyringrc_dir = os.path.dirname(self._keyringrc_path)
+        os.makedirs(keyringrc_dir, exist_ok=True)
+
+        # Configure auth caching into the file on FS. We do not bother of any
+        # expiration since SDK is smart enough to reauth once the token becomes
+        # invalid.
+        with open(self._keyringrc_path, 'w') as keyringrc_file:
+            keyringrc_file.write("[backend]\n")
+            keyringrc_file.write(
+                "default-keyring=keyrings.alt.file.PlaintextKeyring\n")
 
 
 def main():

From 5123700ea6fe25164bd51e967ce85aaefb5c364c Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 19 Oct 2023 17:04:56 +0000
Subject: [PATCH 3131/3333] ignore dbcounter sub dirs

currently id you run devstack with the dbcounter service enabled
the created subdirs show up in git status

this change justs add them to .gitgnore

Change-Id: Iee48eb4e12ac22734c8a2c1dcbe0b92a0a387eaa
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 8fe56ad6ab..ad153f4a07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,5 @@ stack-screenrc
 userrc_early
 AUTHORS
 ChangeLog
+tools/dbcounter/build/
+tools/dbcounter/dbcounter.egg-info/

From 0f402b8327cc3e501df93c735c1b049361ed3dbb Mon Sep 17 00:00:00 2001
From: tzing <tzing0013@gmail.com>
Date: Mon, 6 Nov 2023 02:24:14 +0000
Subject: [PATCH 3132/3333] Fix openEuler support

openEuler 22.03 LTS support was removed from devstack in last
few months due to its libvirt version is too old and the CI job
always fail.

This Patch add a yum repository for libvirt7.2.0, and add the
related CI job to make sure its works well.

Change-Id: Ic507f165cfa117451283360854c4776a968bbb10
---
 .zuul.yaml | 2 ++
 stack.sh   | 6 +++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 12bef3bff1..75930112ca 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -934,6 +934,8 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/stack.sh b/stack.sh
index 530fda48aa..dce15ac01c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -421,8 +421,12 @@ elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # 1. the hostname package is not installed by default
     # 2. Some necessary packages are in openstack repo, for example liberasurecode-devel
     # 3. python3-pip can be uninstalled by `get_pip.py` automaticly.
-    install_package hostname openstack-release-wallaby
+    # 4. Ensure wget installation before use
+    install_package hostname openstack-release-wallaby wget
     uninstall_package python3-pip
+
+    # Add yum repository for libvirt7.X
+    sudo wget https://eur.openeuler.openatom.cn/coprs/g/sig-openstack/Libvirt-7.X/repo/openeuler-22.03_LTS/group_sig-openstack-Libvirt-7.X-openeuler-22.03_LTS.repo -O /etc/yum.repos.d/libvirt7.2.0.repo
 fi
 
 # Ensure python is installed

From e7c12616e27ad2987c2dead1e1a413aaa2c632ee Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 14 Nov 2023 16:27:56 +0100
Subject: [PATCH 3133/3333] Add periodic-weekly pipeline with platform jobs

Originally we only had the openeuler jobs there, but the other platforms
could also do with some regular testing.

Change-Id: I93526a4c592d85acd4debf72eb59e306ab8e6382
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 75930112ca..47466cb3eb 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1053,3 +1053,13 @@
     periodic:
       jobs:
         - devstack-no-tls-proxy
+    periodic-weekly:
+      jobs:
+        - devstack-platform-centos-9-stream
+        - devstack-platform-debian-bookworm
+        - devstack-platform-debian-bullseye
+        - devstack-platform-rocky-blue-onyx
+        - devstack-platform-ubuntu-jammy-ovn-source
+        - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs

From 82c30cd82ee00012d21bee94dad2bcbc2c047f78 Mon Sep 17 00:00:00 2001
From: yatin <ykarel@redhat.com>
Date: Wed, 15 Nov 2023 12:44:50 +0000
Subject: [PATCH 3134/3333] Revert "Enable keystone token caching by OSC"

This reverts commit 67630d4c52aef5ddcb15cff4f3b6594d447e8992.

Reason for revert: Seeing random failures across jobs as sometimes
'keyring_pass.cfg' gets duplicated keys and that makes executions
of any openstackclient command to fail until the file is removed.
This should be handled before re enabling the token caching again.

Change-Id: I3d2fe53a2e7552ac6304c30aa2fe5be33d77df53
Related-Bug: #2042943
---
 functions-common            | 10 +---------
 lib/libraries               |  4 ----
 tools/update_clouds_yaml.py | 27 +++++----------------------
 3 files changed, 6 insertions(+), 35 deletions(-)

diff --git a/functions-common b/functions-common
index 03d7c96417..c57c4cc054 100644
--- a/functions-common
+++ b/functions-common
@@ -1047,8 +1047,6 @@ function get_or_create_service {
             --description="$3" \
             -f value -c id
     )
-    # Drop cached token to invalidate catalog info in the token
-    remove_token_cache
     echo $service_id
 }
 
@@ -1066,6 +1064,7 @@ function _get_or_create_endpoint_with_interface {
         endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint create \
             $1 $2 $3 --region $4 -f value -c id)
     fi
+
     echo $endpoint_id
 }
 
@@ -1089,8 +1088,6 @@ function get_or_create_endpoint {
     if [[ -n "$5" ]]; then
         _get_or_create_endpoint_with_interface $1 internal $5 $2
     fi
-    # Drop cached token to invalidate catalog info in the token
-    remove_token_cache
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
 }
@@ -2520,11 +2517,6 @@ function is_fips_enabled {
     [ "$fips" == "1" ]
 }
 
-function remove_token_cache {
-    # Remove Keyring cache file
-    rm ~/.local/share/python_keyring/keyring_pass.cfg
-}
-
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/lib/libraries b/lib/libraries
index 146434e2b9..9ea32304fc 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -138,10 +138,6 @@ function install_libs {
     # doesn't pull in etcd3.
     pip_install etcd3
     pip_install etcd3gw
-
-    # Add libraries required for token caching by OpenStackSDK/CLI
-    pip_install keyring
-    pip_install keyrings.alt
 }
 
 # Restore xtrace
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 918988245b..74dcdb2a07 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -30,9 +30,7 @@ def __init__(self, args):
             self._clouds_path = os.path.expanduser(
                 '~/.config/openstack/clouds.yaml')
             self._create_directory = True
-        self._keyringrc_path = os.path.expanduser(
-                '~/.config/python_keyring/keyringrc.cfg')
-        self._config = {}
+        self._clouds = {}
 
         self._cloud = args.os_cloud
         self._cloud_data = {
@@ -67,17 +65,14 @@ def run(self):
     def _read_clouds(self):
         try:
             with open(self._clouds_path) as clouds_file:
-                self._config = yaml.safe_load(clouds_file)
+                self._clouds = yaml.safe_load(clouds_file)
         except IOError:
             # The user doesn't have a clouds.yaml file.
             print("The user clouds.yaml file didn't exist.")
-        if "cache" not in self._config:
-            # Enable auth (and only auth) caching. Currently caching into the
-            # file on FS is configured in `_write_clouds` function.
-            self._config["cache"] = {"auth": True}
+            self._clouds = {}
 
     def _update_clouds(self):
-        self._config.setdefault('clouds', {})[self._cloud] = self._cloud_data
+        self._clouds.setdefault('clouds', {})[self._cloud] = self._cloud_data
 
     def _write_clouds(self):
 
@@ -86,19 +81,7 @@ def _write_clouds(self):
             os.makedirs(clouds_dir)
 
         with open(self._clouds_path, 'w') as clouds_file:
-            yaml.dump(self._config, clouds_file, default_flow_style=False)
-
-        # Enable keyring token caching
-        keyringrc_dir = os.path.dirname(self._keyringrc_path)
-        os.makedirs(keyringrc_dir, exist_ok=True)
-
-        # Configure auth caching into the file on FS. We do not bother of any
-        # expiration since SDK is smart enough to reauth once the token becomes
-        # invalid.
-        with open(self._keyringrc_path, 'w') as keyringrc_file:
-            keyringrc_file.write("[backend]\n")
-            keyringrc_file.write(
-                "default-keyring=keyrings.alt.file.PlaintextKeyring\n")
+            yaml.dump(self._clouds, clouds_file, default_flow_style=False)
 
 
 def main():

From bb0c273697bf54dd569ad38e459cd161b62f96cb Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Thu, 16 Nov 2023 11:30:04 +0100
Subject: [PATCH 3135/3333] Option for SQLAlchemy and alembic git source

Change-Id: If7ff0075834a1e9cee01713676166e56b797debd
Closes-Bug: #2042941
---
 lib/neutron | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 3628bfc25e..bc77f161d7 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -158,6 +158,14 @@ if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME
     NEUTRON_ENDPOINT_SERVICE_NAME="networking"
 fi
 
+# Source install libraries
+ALEMBIC_REPO=${ALEMBIC_REPO:-https://github.com/sqlalchemy/alembic.git}
+ALEMBIC_DIR=${ALEMBIC_DIR:-$DEST/alembic}
+ALEMBIC_BRANCH=${ALEMBIC_BRANCH:-main}
+SQLALCHEMY_REPO=${SQLALCHEMY_REPO:-https://github.com/sqlalchemy/sqlalchemy.git}
+SQLALCHEMY_DIR=${SQLALCHEMY_DIR:-$DEST/sqlalchemy}
+SQLALCHEMY_BRANCH=${SQLALCHEMY_BRANCH:-main}
+
 # List of config file names in addition to the main plugin config file
 # To add additional plugin config files, use ``neutron_server_config_add``
 # utility function.  For example:
@@ -525,6 +533,17 @@ function install_neutron {
         setup_dev_lib "neutron-lib"
     fi
 
+    # Install SQLAlchemy and alembic from git when these are required
+    # see https://bugs.launchpad.net/neutron/+bug/2042941
+    if use_library_from_git "sqlalchemy"; then
+        git_clone $SQLALCHEMY_REPO $SQLALCHEMY_DIR $SQLALCHEMY_BRANCH
+        setup_develop $SQLALCHEMY_DIR
+    fi
+    if use_library_from_git "alembic"; then
+        git_clone $ALEMBIC_REPO $ALEMBIC_DIR $ALEMBIC_BRANCH
+        setup_develop $ALEMBIC_DIR
+    fi
+
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
 

From 2211c778db0e18702c7177f7750571cba3697509 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Wed, 22 Nov 2023 06:21:55 +0000
Subject: [PATCH 3136/3333] Allow devstack to set cache driver for glance

Added new devstack variable `GLANCE_CACHE_DRIVER` default
to `sqlite` to set the cache driver for glance service.

Related blueprint centralized-cache-db

Change-Id: I76d064590356e2d65bfc6a3f57d1bdaeeb83a74a
---
 lib/glance | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/glance b/lib/glance
index 796ebdb68d..4ff9a34ca8 100644
--- a/lib/glance
+++ b/lib/glance
@@ -75,6 +75,7 @@ GLANCE_MULTIPLE_FILE_STORES=${GLANCE_MULTIPLE_FILE_STORES:-fast}
 GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
+GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-sqlite}
 
 # Full Glance functionality requires running in standalone mode. If we are
 # not in uwsgi mode, then we are standalone, otherwise allow separate control.
@@ -329,6 +330,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
+    iniset $GLANCE_API_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
     iniset $GLANCE_API_CONF oslo_concurrency lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_keystone_authtoken_middleware $GLANCE_API_CONF glance
@@ -392,6 +394,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
+    iniset $GLANCE_CACHE_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
     iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance

From 2e14add0fdbc749f40caf075e42221d85ff2f27e Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Wed, 29 Nov 2023 09:22:10 -0500
Subject: [PATCH 3137/3333] Add cinder-manage to /usr/local/bin/

This is useful in a dev environment.

Change-Id: I247eb4aea23a906d0e667ec6c5ac79f932bdca24
---
 stack.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stack.sh b/stack.sh
index 530fda48aa..4d649f6cec 100755
--- a/stack.sh
+++ b/stack.sh
@@ -821,6 +821,7 @@ fixup_all
 
 if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
+    sudo ln -sf /opt/stack/data/venv/bin/cinder-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/glance /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin

From d126330efebb98b7fe8ce74d8da333e13782576d Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 6 Dec 2023 09:58:18 +0000
Subject: [PATCH 3138/3333] lib/apache: Rename variable

This is a little more meaningful, IMO.

Change-Id: Ib9d3fdc54b1cdbd822c2a4eca0a3310ca3f6324c
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/apache | 84 +++++++++++++++++++++++++++---------------------------
 1 file changed, 42 insertions(+), 42 deletions(-)

diff --git a/lib/apache b/lib/apache
index cf7215bef2..9017e0a38a 100644
--- a/lib/apache
+++ b/lib/apache
@@ -238,7 +238,7 @@ function restart_apache_server {
 }
 
 function write_uwsgi_config {
-    local file=$1
+    local conf=$1
     local wsgi=$2
     local url=$3
     local http=$4
@@ -258,38 +258,38 @@ function write_uwsgi_config {
     local socket="$socket_dir/${name}.socket"
 
     # always cleanup given that we are using iniset here
-    rm -rf $file
-    iniset "$file" uwsgi wsgi-file "$wsgi"
-    iniset "$file" uwsgi processes $API_WORKERS
+    rm -rf $conf
+    iniset "$conf" uwsgi wsgi-file "$wsgi"
+    iniset "$conf" uwsgi processes $API_WORKERS
     # This is running standalone
-    iniset "$file" uwsgi master true
+    iniset "$conf" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
-    iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload false
+    iniset "$conf" uwsgi die-on-term true
+    iniset "$conf" uwsgi exit-on-reload false
     # Set worker-reload-mercy so that worker will not exit till the time
     # configured after graceful shutdown
-    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
-    iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,python3
+    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
+    iniset "$conf" uwsgi enable-threads true
+    iniset "$conf" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
-    iniset "$file" uwsgi thunder-lock true
+    iniset "$conf" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
-    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
+    iniset "$conf" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
     # Override the default size for headers from the 4k default.
-    iniset "$file" uwsgi buffer-size 65535
+    iniset "$conf" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
-    iniset "$file" uwsgi add-header "Connection: close"
+    iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
-    iniset "$file" uwsgi lazy-apps true
+    iniset "$conf" uwsgi lazy-apps true
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
-        iniset "$file" uwsgi http $http
+        iniset "$conf" uwsgi http $http
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        iniset "$file" uwsgi socket "$socket"
-        iniset "$file" uwsgi chmod-socket 666
+        iniset "$conf" uwsgi socket "$socket"
+        iniset "$conf" uwsgi chmod-socket 666
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 acquire=1 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
@@ -303,7 +303,7 @@ function write_uwsgi_config {
 # but that involves having apache buffer the request before sending it to
 # uwsgi.
 function write_local_uwsgi_http_config {
-    local file=$1
+    local conf=$1
     local wsgi=$2
     local url=$3
     name=$(basename $wsgi)
@@ -312,38 +312,38 @@ function write_local_uwsgi_http_config {
     # a private view of it on some platforms.
 
     # always cleanup given that we are using iniset here
-    rm -rf $file
-    iniset "$file" uwsgi wsgi-file "$wsgi"
+    rm -rf $conf
+    iniset "$conf" uwsgi wsgi-file "$wsgi"
     port=$(get_random_port)
-    iniset "$file" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
-    iniset "$file" uwsgi processes $API_WORKERS
+    iniset "$conf" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
+    iniset "$conf" uwsgi processes $API_WORKERS
     # This is running standalone
-    iniset "$file" uwsgi master true
+    iniset "$conf" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
-    iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload false
-    iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,python3
+    iniset "$conf" uwsgi die-on-term true
+    iniset "$conf" uwsgi exit-on-reload false
+    iniset "$conf" uwsgi enable-threads true
+    iniset "$conf" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
-    iniset "$file" uwsgi thunder-lock true
+    iniset "$conf" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
-    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
+    iniset "$conf" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
     # Set worker-reload-mercy so that worker will not exit till the time
     # configured after graceful shutdown
-    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
+    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     # Override the default size for headers from the 4k default.
-    iniset "$file" uwsgi buffer-size 65535
+    iniset "$conf" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
-    iniset "$file" uwsgi add-header "Connection: close"
+    iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
-    iniset "$file" uwsgi lazy-apps true
-    iniset "$file" uwsgi chmod-socket 666
-    iniset "$file" uwsgi http-raw-body true
-    iniset "$file" uwsgi http-chunked-input true
-    iniset "$file" uwsgi http-auto-chunked true
-    iniset "$file" uwsgi http-keepalive false
+    iniset "$conf" uwsgi lazy-apps true
+    iniset "$conf" uwsgi chmod-socket 666
+    iniset "$conf" uwsgi http-raw-body true
+    iniset "$conf" uwsgi http-chunked-input true
+    iniset "$conf" uwsgi http-auto-chunked true
+    iniset "$conf" uwsgi http-keepalive false
     # Increase socket timeout for slow chunked uploads
-    iniset "$file" uwsgi socket-timeout 30
+    iniset "$conf" uwsgi socket-timeout 30
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http
@@ -376,12 +376,12 @@ function write_local_proxy_http_config {
 }
 
 function remove_uwsgi_config {
-    local file=$1
+    local conf=$1
     local wsgi=$2
     local name=""
     name=$(basename $wsgi)
 
-    rm -rf $file
+    rm -rf $conf
     disable_apache_site $name
 }
 

From 6b0f055b4ed407f8a190f768d0e654235ac015dd Mon Sep 17 00:00:00 2001
From: Yadnesh Kulkarni <yadnesh_kulkarni@proton.me>
Date: Thu, 23 Nov 2023 11:59:49 +0530
Subject: [PATCH 3139/3333] Make multiple attempts to download image

Downloading an image can fail due to network issues, so let's
retry 5 times before giving up. We have seen issues in CI due
to network issues as described below and in the Related-Bug:-

Often times fetching Fedora image in FIPS jobs fails due to
"GnuTLS: One of the involved algorithms has insufficient security level."

This occurs when request to pull image is redirected to a mirror that's
incompatible with FIPS enabled system.

Making multiple attempts to download images could provide better chance of
pulling images from different mirrors and avoid failure of the job.
This will also save a few rechecks.

Related-Bug: #2045725
Change-Id: I7163aea4d121cb27620e4f2a083a543abfc286bf
---
 functions | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index 7ada0feba7..01e1d259ad 100644
--- a/functions
+++ b/functions
@@ -133,17 +133,28 @@ function upload_image {
 
     local image image_fname image_name
 
+    local max_attempts=5
+
     # Create a directory for the downloaded image tarballs.
     mkdir -p $FILES/images
     image_fname=`basename "$image_url"`
     if [[ $image_url != file* ]]; then
         # Downloads the image (uec ami+akistyle), then extracts it.
         if [[ ! -f $FILES/$image_fname || "$(stat -c "%s" $FILES/$image_fname)" = "0" ]]; then
-            wget --progress=dot:giga -c $image_url -O $FILES/$image_fname
-            if [[ $? -ne 0 ]]; then
-                echo "Not found: $image_url"
-                return
-            fi
+            for attempt in `seq $max_attempts`; do
+                local rc=0
+                wget --progress=dot:giga -c $image_url -O $FILES/$image_fname || rc=$?
+                if [[ $rc -ne 0 ]]; then
+                    if [[ "$attempt" -eq "$max_attempts" ]]; then
+                        echo "Not found: $image_url"
+                        return
+                    fi
+                    echo "Download failed, retrying in $attempt second, attempt: $attempt"
+                    sleep $attempt
+                else
+                    break
+                fi
+            done
         fi
         image="$FILES/${image_fname}"
     else

From 5e98509eaad724bb68d1a457bd690a387c51a114 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 12 Dec 2023 12:40:58 +0000
Subject: [PATCH 3140/3333] Increase timeout for reimage operation

Looking at the recent failures in the tempest-integrated-compute
job, the reimage operation seems to be taking longer than our
expected time of 60 seconds (which was increased because of a similar
failure in the past, default is 20 seconds).
The main culprit for this failure is the image conversion from qcow2
to raw which is taking ~159 seconds.

Dec 05 13:29:59.709129 np0035951188 cinder-volume[77000]: DEBUG oslo_concurrency.processutils [req-5113eccb-05ba-486a-8130-a58898c8ad35 req-0edf972a-109a-465f-a771-ceb87ecbda3e tempest-ServerActionsV293TestJSON-1780705112 None] CMD "sudo cinder-rootwrap /etc/cinder/rootwrap.conf qemu-img convert -O raw -t none -f qcow2 /opt/stack/data/cinder/conversion/image_download_dbe01f18-1c90-4536-a09a-b49f0811c7a0_copod3cm /dev/mapper/stack--volumes--lvmdriver--1-volume--073a98e8--3c89--4734--9ae5--59af25f8914a" returned: 0 in 159.272s {{(pid=77000) execute /opt/stack/data/venv/lib/python3.10/site-packages/oslo_concurrency/processutils.py:422}}

The recent run took ~165 seconds on the cinder side but it failed
early since the nova operation timed out in 60 seconds hence
deleting the volume.
To be on the safer side, 180 seconds seems to be a sane time for
the operation to complete which this patch configures.

Closes-Bug: 2046252
Change-Id: I8a9628216038f6d363cab5dd8177274c9cfc17c2
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index b04f94beef..17c90dfe26 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1054,7 +1054,7 @@ function start_nova_compute {
 
     # Set rebuild timeout longer for BFV instances because we likely have
     # slower disk than expected. Default is 20s/GB
-    iniset $NOVA_CPU_CONF DEFAULT reimage_timeout_per_gb 60
+    iniset $NOVA_CPU_CONF DEFAULT reimage_timeout_per_gb 180
 
     # Configure the OVSDB connection for os-vif
     if [ -n "$OVSDB_SERVER_LOCAL_HOST" ]; then

From 6fc0e74aa7369ed1503e2d0f12d7543d4835212e Mon Sep 17 00:00:00 2001
From: Fabian Wiesel <fabian.wiesel@sap.com>
Date: Tue, 19 Dec 2023 11:24:02 +0100
Subject: [PATCH 3141/3333] Fix spelling of `ADITIONAL_VENV_PACKAGES`

This preserved `ADITIONAL_VENV_PACKAGES` as an input for backwards
compatiblity, but takes `ADDITIONAL_VENV_PACKAGES` with priority.

Fixes spelling in comment.

Related-Bug: #2046936
Change-Id: I84151d8f71b12da134e8fb9dbf3ae30f2a171fe2
---
 stackrc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 464e935839..6cbadf9915 100644
--- a/stackrc
+++ b/stackrc
@@ -207,8 +207,9 @@ fi
 USE_VENV=$(trueorfalse False USE_VENV)
 
 # Add packages that need to be installed into a venv but are not in any
-# requirmenets files here, in a comma-separated list
-ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
+# requirements files here, in a comma-separated list.
+# Currently only used when USE_VENV is true (individual project venvs)
+ADDITIONAL_VENV_PACKAGES=${ADDITIONAL_VENV_PACKAGES:-""}}
 
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)

From 7699ce2d5c465f86f2aace7af6b150dceb0e6e1c Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 25 Dec 2023 03:14:20 +0000
Subject: [PATCH 3142/3333] Updated from generate-devstack-plugins-list

Change-Id: Ie5cbd87269a10d6abdf1d24f7e6224d9aac3bf5d
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b2e733337a..f70041162b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -85,6 +85,7 @@ openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
+openstack/ovn-bgp-agent                  `https://opendev.org/openstack/ovn-bgp-agent <https://opendev.org/openstack/ovn-bgp-agent>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
@@ -185,6 +186,7 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
+x/whitebox-neutron-tempest-plugin        `https://opendev.org/x/whitebox-neutron-tempest-plugin <https://opendev.org/x/whitebox-neutron-tempest-plugin>`__
 ======================================== ===
 
 

From a2da805f8107703e5f6738399ce5f5e358190fdc Mon Sep 17 00:00:00 2001
From: Fabian Wiesel <fabian.wiesel@sap.com>
Date: Mon, 8 Jan 2024 10:18:28 +0100
Subject: [PATCH 3143/3333] Fixup of 'Fix spelling of
 `ADITIONAL_VENV_PACKAGES`'

Introduced a dangling } in the environment variable.
This removes it.

Change-Id: If9413dc1751399e5b9c9a0094772394252e5a81c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 6cbadf9915..59ba9074f2 100644
--- a/stackrc
+++ b/stackrc
@@ -209,7 +209,7 @@ USE_VENV=$(trueorfalse False USE_VENV)
 # Add packages that need to be installed into a venv but are not in any
 # requirements files here, in a comma-separated list.
 # Currently only used when USE_VENV is true (individual project venvs)
-ADDITIONAL_VENV_PACKAGES=${ADDITIONAL_VENV_PACKAGES:-""}}
+ADDITIONAL_VENV_PACKAGES=${ADDITIONAL_VENV_PACKAGES:-""}
 
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)

From 6091df25a39c9b17883d86ccb091bf2b9c39aa15 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 20 Dec 2023 23:06:18 +0000
Subject: [PATCH 3144/3333] [OVN] Add support for the Neutron OVN agent service

The Neutron OVN agent is a service that could run in any node. The
functionality will depend on the extensions configured. This new
agent is meant to be the replacement for the Neutron OVN metadata
agent once the "metadata" extension is implemented in this service
[1].

[1]https://review.opendev.org/c/openstack/neutron/+/898238

Related-Bug: #2017871
Change-Id: I8f82f0047e89aac122a67f59db84f03e1a6bf519
---
 lib/neutron_plugins/ovn_agent | 62 ++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 12 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index c51b708130..e646258651 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -91,9 +91,14 @@ OVN_GENEVE_OVERHEAD=${OVN_GENEVE_OVERHEAD:-38}
 # http://www.openvswitch.org/support/dist-docs/ovs-appctl.8.txt
 OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
 
+# OVN metadata agent configuration
 OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
+# OVN agent configuration
+OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
+OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-}
+
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
 OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
@@ -132,6 +137,7 @@ OVN_RUNDIR=$OVS_PREFIX/var/run/ovn
 
 NEUTRON_OVN_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_OVN_METADATA_BINARY="neutron-ovn-metadata-agent"
+NEUTRON_OVN_AGENT_BINARY="neutron-ovn-agent"
 
 STACK_GROUP="$( id --group --name "$STACK_USER" )"
 
@@ -487,6 +493,8 @@ function configure_ovn_plugin {
 
         if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
+        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
         fi
@@ -508,6 +516,8 @@ function configure_ovn_plugin {
     if is_service_enabled n-api-meta ; then
         if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
+        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+            iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
 }
@@ -539,29 +549,42 @@ function configure_ovn {
     fi
 
     # Metadata
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    local sample_file=""
+    local config_file=""
+    if is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
+        sample_file=$NEUTRON_DIR/etc/neutron/plugins/ml2/ovn_agent.ini.sample
+        config_file=$OVN_AGENT_CONF
+    elif is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+        sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
+        config_file=$OVN_META_CONF
+    fi
+    if [ -n ${config_file} ]; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
         mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2
         (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
 
-        cp $NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample $OVN_META_CONF
-        configure_root_helper_options $OVN_META_CONF
+        cp $sample_file $config_file
+        configure_root_helper_options $config_file
 
-        iniset $OVN_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
-        iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
-        iniset $OVN_META_CONF DEFAULT state_path $DATA_DIR/neutron
-        iniset $OVN_META_CONF ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
-        iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
+        iniset $config_file DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $config_file DEFAULT nova_metadata_host $OVN_META_DATA_HOST
+        iniset $config_file DEFAULT metadata_workers $API_WORKERS
+        iniset $config_file DEFAULT state_path $DATA_DIR/neutron
+        iniset $config_file ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
+        iniset $config_file ovn ovn_sb_connection $OVN_SB_REMOTE
         if is_service_enabled tls-proxy; then
-            iniset $OVN_META_CONF ovn \
+            iniset $config_file ovn \
                 ovn_sb_ca_cert $INT_CA_DIR/ca-chain.pem
-            iniset $OVN_META_CONF ovn \
+            iniset $config_file ovn \
                 ovn_sb_certificate $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt
-            iniset $OVN_META_CONF ovn \
+            iniset $config_file ovn \
                 ovn_sb_private_key $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key
         fi
+        if [[ $config_file == $OVN_AGENT_CONF ]]; then
+            iniset $config_file agent extensions $OVN_AGENT_EXTENSIONS
+            iniset $config_file ovn ovn_nb_connection $OVN_NB_REMOTE
+        fi
     fi
 }
 
@@ -684,6 +707,9 @@ function _start_ovn_services {
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
         _start_process "devstack@q-ovn-metadata-agent.service"
     fi
+    if is_service_enabled q-ovn-agent neutron-ovn-agent ; then
+        _start_process "devstack@q-ovn-agent.service"
+    fi
 }
 
 # start_ovn() - Start running processes, including screen
@@ -750,6 +776,12 @@ function start_ovn {
         setup_logging $OVN_META_CONF
     fi
 
+    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+        run_process q-ovn-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_AGENT_BINARY --config-file $OVN_AGENT_CONF"
+        # Format logging
+        setup_logging $OVN_AGENT_CONF
+    fi
+
     _start_ovn_services
 }
 
@@ -774,6 +806,12 @@ function stop_ovn {
         sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
+    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+        # pkill takes care not to kill itself, but it may kill its parent
+        # sudo unless we use the "ps | grep [f]oo" trick
+        sudo pkill -9 -f "[h]aproxy" || :
+        _stop_process "devstack@q-ovn-agent.service"
+    fi
     if is_service_enabled ovn-controller-vtep ; then
         _stop_process "$OVN_CONTROLLER_VTEP_SERVICE"
     fi

From 224fe1b09adb3adcdd02d680a46eeed5b271f7e4 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 7 Aug 2023 19:30:31 +0000
Subject: [PATCH 3145/3333] add support for zswap and ksmtuned

This change add a new lib/host-mem file and moves the existing
ksm support to a new configure_ksm function.
Additional support for ksmtuned is added with a new flag
"ENABLE_KSMTUNED" which defaults to true.

This change also adds support for zswap. zswap is disabled
by default. When enabled on ubuntu lz4 will
be used as the default compressor and z3fold as the zpool.
On non debian distros the compressor and zpool are not set.
The default values should result in very low overhead although
the zstd compressor may provide better overall performance in ci
or with slow io due to the higher compression ratio.

Additionally memory and network sysctl tunings are optionally applied
to defer writes, prefer swapping and optimise tcp connection
startup and keepalive. The sysctl tunings are disabled by default
The base devstack job has been modifed to enable zram and sysctl
tuning.

Both ksm and zswap are wrapped by a tune_host function
which is now called very early in devstack to ensure
they are configured before any memory/network intensive
operations are executed.

The ci jobs do not enable this functionality by default.
To use this functionaltiy define

        ENABLE_SYSCTL_MEM_TUNING: true
        ENABLE_SYSCTL_NET_TUNING: true
        ENABLE_ZSWAP: true

in the devstack_localrc section of the job vars.

Change-Id: Ia5202d5a9903492a4c18b50ea8d12bd91cc9f135
---
 functions-common | 21 +++++++++++
 lib/host         | 98 ++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh         | 22 +++--------
 stackrc          |  9 -----
 4 files changed, 125 insertions(+), 25 deletions(-)
 create mode 100644 lib/host

diff --git a/functions-common b/functions-common
index c57c4cc054..5238dff30a 100644
--- a/functions-common
+++ b/functions-common
@@ -236,6 +236,27 @@ function trueorfalse {
     $xtrace
 }
 
+# bool_to_int <True|False>
+#
+# Convert True|False to int 1 or 0
+# This function can be used to convert the output of trueorfalse
+# to an int follow c conventions where false is 0 and 1 it true.
+function bool_to_int {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    if [ -z $1 ]; then
+        die $LINENO "Bool value required"
+    fi
+    if [[ $1 == "True" ]] ; then
+        echo '1'
+    else
+        echo '0'
+    fi
+    $xtrace
+}
+
+
 function isset {
     [[ -v "$1" ]]
 }
diff --git a/lib/host b/lib/host
new file mode 100644
index 0000000000..95c5b9bbcb
--- /dev/null
+++ b/lib/host
@@ -0,0 +1,98 @@
+#!/bin/bash
+
+# Kernel Samepage Merging (KSM)
+# -----------------------------
+
+# Processes that mark their memory as mergeable can share identical memory
+# pages if KSM is enabled. This is particularly useful for nova + libvirt
+# backends but any other setup that marks its memory as mergeable can take
+# advantage. The drawback is there is higher cpu load; however, we tend to
+# be memory bound not cpu bound so enable KSM by default but allow people
+# to opt out if the CPU time is more important to them.
+ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
+ENABLE_KSMTUNED=$(trueorfalse True ENABLE_KSMTUNED)
+function configure_ksm {
+    if [[ $ENABLE_KSMTUNED == "True" ]] ; then
+        install_package "ksmtuned"
+    fi
+    if [[ -f /sys/kernel/mm/ksm/run ]] ; then
+        echo $(bool_to_int ENABLE_KSM) | sudo tee /sys/kernel/mm/ksm/run
+    fi
+}
+
+# Compressed swap (ZSWAP)
+#------------------------
+
+# as noted in the kernel docs https://docs.kernel.org/admin-guide/mm/zswap.html
+# Zswap is a lightweight compressed cache for swap pages.
+# It takes pages that are in the process of being swapped out and attempts
+# to compress them into a dynamically allocated RAM-based memory pool.
+# zswap basically trades CPU cycles for potentially reduced swap I/O.
+# This trade-off can also result in a significant performance improvement
+# if reads from the compressed cache are faster than reads from a swap device.
+
+ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
+# lz4 is very fast although it does not have the best compression
+# zstd has much better compression but more latency
+ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
+ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
+function configure_zswap {
+    if [[ $ENABLE_KSMTUNED == "True" ]] ; then
+        # Centos 9 stream seems to only support enabling but not run time
+        # tuning so dont try to choose better default on centos
+        if is_ubuntu; then
+            echo ${ZSWAP_COMPRESSOR} | sudo tee /sys/module/zswap/parameters/compressor
+            echo ${ZSWAP_ZPOOL} | sudo tee /sys/module/zswap/parameters/zpool
+        fi
+        echo 1 | sudo tee /sys/module/zswap/parameters/enabled
+        # print curent zswap kernel config
+        sudo grep -R . /sys/module/zswap/parameters || /bin/true
+    fi
+}
+
+ENABLE_SYSCTL_MEM_TUNING=$(trueorfalse False ENABLE_SYSCTL_MEM_TUNING)
+function configure_sysctl_mem_parmaters {
+    if [[ $ENABLE_SYSCTL_MEM_TUNING == "True" ]] ; then
+        # defer write when memory is available
+        sudo sysctl -w vm.dirty_ratio=60
+        sudo sysctl -w vm.dirty_background_ratio=10
+        sudo sysctl -w vm.vfs_cache_pressure=50
+        # assume swap is compressed so on new kernels
+        # give it equal priority as page cache which is
+        # uncompressed. on kernels < 5.8 the max is 100
+        # not 200 so it will strongly prefer swapping.
+        sudo sysctl -w vm.swappiness=100
+        sudo grep -R . /proc/sys/vm/  || /bin/true
+    fi
+}
+
+function configure_host_mem {
+    configure_zswap
+    configure_ksm
+    configure_sysctl_mem_parmaters
+}
+
+ENABLE_SYSCTL_NET_TUNING=$(trueorfalse False ENABLE_SYSCTL_NET_TUNING)
+function configure_sysctl_net_parmaters {
+    if [[ $ENABLE_SYSCTL_NET_TUNING == "True" ]] ; then
+        # detect dead TCP connections after 120 seconds
+        sudo sysctl -w net.ipv4.tcp_keepalive_time=60
+        sudo sysctl -w net.ipv4.tcp_keepalive_intvl=10
+        sudo sysctl -w net.ipv4.tcp_keepalive_probes=6
+        # reudce network latency for new connections
+        sudo sysctl -w net.ipv4.tcp_fastopen=3
+        # print tcp options
+        sudo grep -R . /proc/sys/net/ipv4/tcp* || /bin/true
+        # disable qos by default
+        sudo sysctl -w net.core.default_qdisc=pfifo_fast
+    fi
+}
+
+function configure_host_net {
+    configure_sysctl_net_parmaters
+}
+
+function tune_host {
+    configure_host_mem
+    configure_host_net
+}
\ No newline at end of file
diff --git a/stack.sh b/stack.sh
index dce15ac01c..a816efda22 100755
--- a/stack.sh
+++ b/stack.sh
@@ -611,6 +611,12 @@ rm -f $SSL_BUNDLE_FILE
 source $TOP_DIR/lib/database
 source $TOP_DIR/lib/rpc_backend
 
+# load host tuning functions and defaults
+source $TOP_DIR/lib/host
+# tune host memory early to ensure zswap/ksm are configured before
+# doing memory intensive operation like cloning repos or unpacking packages.
+tune_host
+
 # Configure Projects
 # ==================
 
@@ -1079,22 +1085,6 @@ fi
 # Save configuration values
 save_stackenv $LINENO
 
-# Kernel Samepage Merging (KSM)
-# -----------------------------
-
-# Processes that mark their memory as mergeable can share identical memory
-# pages if KSM is enabled. This is particularly useful for nova + libvirt
-# backends but any other setup that marks its memory as mergeable can take
-# advantage. The drawback is there is higher cpu load; however, we tend to
-# be memory bound not cpu bound so enable KSM by default but allow people
-# to opt out if the CPU time is more important to them.
-
-if [[ $ENABLE_KSM == "True" ]] ; then
-    if [[ -f /sys/kernel/mm/ksm/run ]] ; then
-        sudo sh -c "echo 1 > /sys/kernel/mm/ksm/run"
-    fi
-fi
-
 
 # Start Services
 # ==============
diff --git a/stackrc b/stackrc
index 59ba9074f2..097913a4e9 100644
--- a/stackrc
+++ b/stackrc
@@ -121,15 +121,6 @@ else
     SYSTEMCTL="sudo systemctl"
 fi
 
-
-# Whether or not to enable Kernel Samepage Merging (KSM) if available.
-# This allows programs that mark their memory as mergeable to share
-# memory pages if they are identical. This is particularly useful with
-# libvirt backends. This reduces memory usage at the cost of CPU overhead
-# to scan memory. We default to enabling it because we tend to be more
-# memory constrained than CPU bound.
-ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
-
 # Passwords generated by interactive devstack runs
 if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password

From 5c1736b78256f5da86a91c4489f43f8ba1bce224 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 24 Jan 2024 10:53:12 +0000
Subject: [PATCH 3146/3333] fix zswap enable flag

zswap should only be enabled if ENABLE_ZSWAP is true.
The if condition was checking ENABLE_KSMTUNED.
That is now fixed.

Change-Id: I76ba139de69fb1710bcb96cc9f638260463e2032
---
 lib/host | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/host b/lib/host
index 95c5b9bbcb..2fa22e24ea 100644
--- a/lib/host
+++ b/lib/host
@@ -37,7 +37,7 @@ ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
 ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
 ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
 function configure_zswap {
-    if [[ $ENABLE_KSMTUNED == "True" ]] ; then
+    if [[ $ENABLE_ZSWAP == "True" ]] ; then
         # Centos 9 stream seems to only support enabling but not run time
         # tuning so dont try to choose better default on centos
         if is_ubuntu; then

From b485549efc9851bfb2cabd1fce40cf39c403c24e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 27 Jan 2024 18:58:11 +0900
Subject: [PATCH 3147/3333] Uncap bashate

The bashate tool has been very stable for a while and we rarely expect
changes which may break existing scripts.

This removes the current capping to avoid updating the upper limit when
when a new release is created in bashate.

Change-Id: Iae94811aebf58b491d6b2b2773db88ac50fdd737
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index ec764abc87..26cd68c031 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ basepython = python3
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==2.0.0}
+   {env:BASHATE_INSTALL_PATH:bashate}
 allowlist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \

From d251d12d71ebca758e8584204a0ba14d3c6bab6c Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 29 Jan 2024 18:20:06 +0000
Subject: [PATCH 3148/3333] Make `centralized_db` driver as default cache
 driver

Making newly introduced `centralized_db` driver as default cache
driver for glance so that it can be tested in available CI jobs.

New cache driver `centralized_db` needs `worker_self_reference_url`
in glance-api.conf file otherwise glance api service will fail to
start.

Related blueprint centralized-cache-db
Depends-On: https://review.opendev.org/c/openstack/glance/+/899871

Change-Id: I75267988b1c80ac9daa5843ce8462bbac49ffe27
---
 lib/glance | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 4ff9a34ca8..e4bfc8f5a3 100644
--- a/lib/glance
+++ b/lib/glance
@@ -75,7 +75,7 @@ GLANCE_MULTIPLE_FILE_STORES=${GLANCE_MULTIPLE_FILE_STORES:-fast}
 GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
-GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-sqlite}
+GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-centralized_db}
 
 # Full Glance functionality requires running in standalone mode. If we are
 # not in uwsgi mode, then we are standalone, otherwise allow separate control.
@@ -432,6 +432,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $GLANCE_URL
     fi
 
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then

From 4ddd456dd3e71bcdf9a02a12dd5914b82ec48e91 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 9 Feb 2024 14:11:44 +0100
Subject: [PATCH 3149/3333] Add support for the pyproject.toml file in setup
 with constraints

In the _setup_package_with_constraints_edit name of the package was
always discovered from the setup.cfg file. But as some projects
implements PEP-621 (see [1] for the SQLAlchemy for example) it is not
enough now.
This patch adds parsing pyproject.toml file also if name is not found in
the setup.cfg file.

[1] https://github.com/sqlalchemy/sqlalchemy/commit/a8dbf8763a8fa2ca53cc01033f06681a421bf60b

Closes-Bug: #2052509
Change-Id: Iee9262079d09a8bd22cd05a8f17950a41a0d1f9d
---
 inc/python | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inc/python b/inc/python
index cc6e01fede..43b06eb520 100644
--- a/inc/python
+++ b/inc/python
@@ -405,6 +405,9 @@ function _setup_package_with_constraints_edit {
         # source we are about to do.
         local name
         name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
+        if [ -z $name ]; then
+            name=$(awk '/^name =/ {gsub(/"/, "", $3); print $3}' $project_dir/pyproject.toml)
+        fi
         $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
             $REQUIREMENTS_DIR/upper-constraints.txt -- $name
     fi

From 402b7e89b60035b39b40e8886dee82487c54de97 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 23 Feb 2024 11:46:03 +0100
Subject: [PATCH 3150/3333] Drop nodesets with ubuntu-xenial

The ubuntu-xenial labels are going to disappear from opendev as that
image is EOL and will we deleted. Clean up our zuul config.

Update some example reference as well.

Change-Id: Id04110f7c871caa1739ff2b62e9796be4fb9aa00
---
 .zuul.yaml       | 80 ------------------------------------------------
 functions-common |  4 +--
 2 files changed, 2 insertions(+), 82 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 47466cb3eb..13b4633e13 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,13 +1,3 @@
-- nodeset:
-    name: openstack-single-node
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: openstack-single-node-jammy
     nodes:
@@ -38,16 +28,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: openstack-single-node-xenial
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-7
     nodes:
@@ -118,36 +98,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: openstack-two-node
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-      - name: compute1
-        label: ubuntu-xenial
-    groups:
-      # Node where tests are executed and test results collected
-      - name: tempest
-        nodes:
-          - controller
-      # Nodes running the compute service
-      - name: compute
-        nodes:
-          - controller
-          - compute1
-      # Nodes that are not the controller
-      - name: subnode
-        nodes:
-          - compute1
-      # Switch node for multinode networking setup
-      - name: switch
-        nodes:
-          - controller
-      # Peer nodes for multinode networking setup
-      - name: peers
-        nodes:
-          - compute1
-
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -268,36 +218,6 @@
         nodes:
           - compute1
 
-- nodeset:
-    name: openstack-two-node-xenial
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-      - name: compute1
-        label: ubuntu-xenial
-    groups:
-      # Node where tests are executed and test results collected
-      - name: tempest
-        nodes:
-          - controller
-      # Nodes running the compute service
-      - name: compute
-        nodes:
-          - controller
-          - compute1
-      # Nodes that are not the controller
-      - name: subnode
-        nodes:
-          - compute1
-      # Switch node for multinode networking setup
-      - name: switch
-        nodes:
-          - controller
-      # Peer nodes for multinode networking setup
-      - name: peers
-        nodes:
-          - compute1
-
 - nodeset:
     name: openstack-three-node-focal
     nodes:
diff --git a/functions-common b/functions-common
index 5238dff30a..8ea6df7c1d 100644
--- a/functions-common
+++ b/functions-common
@@ -401,9 +401,9 @@ function warn {
 # such as "install_package" further abstract things in better ways.
 #
 # ``os_VENDOR`` - vendor name: ``Ubuntu``, ``Fedora``, etc
-# ``os_RELEASE`` - major release: ``16.04`` (Ubuntu), ``23`` (Fedora)
+# ``os_RELEASE`` - major release: ``22.04`` (Ubuntu), ``23`` (Fedora)
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
-# ``os_CODENAME`` - vendor's codename for release: ``xenial``
+# ``os_CODENAME`` - vendor's codename for release: ``jammy``
 
 declare -g os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 

From 50c791c0ae3bd75335c89312a5595f0ad2864945 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 29 Feb 2024 17:02:55 +0900
Subject: [PATCH 3151/3333] Drop unused environments for TripleO and heat
 agents

TripleO was already retired. These environments are not actually used
by heat jobs.

Change-Id: I63b7413a1575a620f9d2cbd56e93be78816639e0
---
 stackrc | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/stackrc b/stackrc
index 464e935839..966e5ed69d 100644
--- a/stackrc
+++ b/stackrc
@@ -588,28 +588,6 @@ GITREPO["os-ken"]=${OS_KEN_REPO:-${GIT_BASE}/openstack/os-ken.git}
 GITBRANCH["os-ken"]=${OS_KEN_BRANCH:-$TARGET_BRANCH}
 GITDIR["os-ken"]=$DEST/os-ken
 
-##################
-#
-#  TripleO / Heat Agent Components
-#
-##################
-
-# run-parts script required by os-refresh-config
-DIB_UTILS_REPO=${DIB_UTILS_REPO:-${GIT_BASE}/openstack/dib-utils.git}
-DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
-
-# os-apply-config configuration template tool
-OAC_REPO=${OAC_REPO:-${GIT_BASE}/openstack/os-apply-config.git}
-OAC_BRANCH=${OAC_BRANCH:-$TRAILING_TARGET_BRANCH}
-
-# os-collect-config configuration agent
-OCC_REPO=${OCC_REPO:-${GIT_BASE}/openstack/os-collect-config.git}
-OCC_BRANCH=${OCC_BRANCH:-$TRAILING_TARGET_BRANCH}
-
-# os-refresh-config configuration run-parts tool
-ORC_REPO=${ORC_REPO:-${GIT_BASE}/openstack/os-refresh-config.git}
-ORC_BRANCH=${ORC_BRANCH:-$TRAILING_TARGET_BRANCH}
-
 
 #################
 #

From af57c0b778bb13a9b5ffd784fc456a21614e67b1 Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Mon, 4 Mar 2024 18:24:24 +0000
Subject: [PATCH 3152/3333] Drop the devstack-single-node-centos-7 nodeset

OpenDev is preparing to remove centos-7 nodes on March 15[*]. This
change drops one nodeset definition which is the last remaining
reference on DevStack's master branch.

[*] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/message/A2YIY5L7MVYSQMTVZU3L3OM7GLVVZPLK/

Change-Id: Icd487e1012263a9b0bc13b529d31ff2025108adf
---
 .zuul.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 13b4633e13..8bc082364c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -28,16 +28,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-centos-7
-    nodes:
-      - name: controller
-        label: centos-7
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-9-stream
     nodes:

From 1fe7707cf04852d024b64f695e40568696851b15 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 5 Mar 2024 08:30:19 -0800
Subject: [PATCH 3153/3333] Ignore 500 status code in generate plugin script

Due to various reasons, this script may encounter the
500 status code from some repo (x/fuel-plugin-onos in current case[1])
If that happen then it return failure status code to the
propose-updates job and fail that job

- https://zuul.openstack.org/builds?job_name=propose-updates&project=openstack%2Fdevstack&skip=0

It is better not to raise the 500 error in this script and just ignore those
repo to process further to detect the plugin.

[1] https://zuul.openstack.org/build/dba0aa41d145472397916dfcd13948de/log/job-output.txt#2442

Change-Id: Ibca0a2aac404161340e8fc00170018eecf5c8326
---
 tools/generate-devstack-plugins-list.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 1cacd06bf8..bc28515a26 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -73,8 +73,11 @@ def has_devstack_plugin(session, proj):
 s = requests.Session()
 # sometimes gitea gives us a 500 error; retry sanely
 #  https://stackoverflow.com/a/35636367
+# We need to disable raise_on_status because if any repo endup with 500 then
+# propose-updates job which run this script will fail.
 retries = Retry(total=3, backoff_factor=1,
-                status_forcelist=[ 500 ])
+                status_forcelist=[ 500 ],
+                raise_on_status=False)
 s.mount('https://', HTTPAdapter(max_retries=retries))
 
 found_plugins = filter(functools.partial(has_devstack_plugin, s), projects)

From 5e837d1f0d9078c58bc634474a1adf311bc2b491 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 6 Mar 2024 03:13:36 +0000
Subject: [PATCH 3154/3333] Updated from generate-devstack-plugins-list

Change-Id: Ic99b518ddf1045893991accaa089f44d0d4f4b0d
---
 doc/source/plugin-registry.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f70041162b..2d2a92c4a9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -28,8 +28,6 @@ openstack/aodh                           `https://opendev.org/openstack/aodh <ht
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
 openstack/ceilometer                     `https://opendev.org/openstack/ceilometer <https://opendev.org/openstack/ceilometer>`__
-openstack/ceilometer-powervm             `https://opendev.org/openstack/ceilometer-powervm <https://opendev.org/openstack/ceilometer-powervm>`__
-openstack/cinderlib                      `https://opendev.org/openstack/cinderlib <https://opendev.org/openstack/cinderlib>`__
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
@@ -69,7 +67,6 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
-openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
@@ -79,7 +76,6 @@ openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
 openstack/nova                           `https://opendev.org/openstack/nova <https://opendev.org/openstack/nova>`__
-openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
 openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__

From 5f5255bc011ef885f254c659009662870499de5a Mon Sep 17 00:00:00 2001
From: huicoffee <784657156@qq.com>
Date: Fri, 15 Mar 2024 17:15:33 +0800
Subject: [PATCH 3155/3333] Remove Glance uWSGI config in clean.sh

Updated clean.sh to remove Glance's Apache uWSGI config files in
APACHE_CONF_DIR, including /etc/apache2/sites-enabled/ on Ubuntu.

Test Plan:
- Run clean.sh.
- Confirm Glance uWSGI configs are removed from APACHE_CONF_DIR.

Closes-Bug: #2057999

Change-Id: I44475b8e084c4b20d7b7cb7f28574f797dbda7a2
---
 lib/glance | 1 +
 lib/host   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index e4bfc8f5a3..8ee842625f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -168,6 +168,7 @@ function cleanup_glance {
         # Cleanup reserved stores directories
         sudo rm -rf $GLANCE_STAGING_DIR $GLANCE_TASKS_DIR
     fi
+    remove_uwsgi_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI"
 }
 
 # Set multiple cinder store related config options for each of the cinder store
diff --git a/lib/host b/lib/host
index 2fa22e24ea..a812c39612 100644
--- a/lib/host
+++ b/lib/host
@@ -95,4 +95,4 @@ function configure_host_net {
 function tune_host {
     configure_host_mem
     configure_host_net
-}
\ No newline at end of file
+}

From e1b7cc0ef8db3f7363cd478effa8f7292b61b9bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Douglas=20Mendiz=C3=A1bal?= <dmendiza@redhat.com>
Date: Mon, 25 Mar 2024 12:09:04 -0400
Subject: [PATCH 3156/3333] Do not configure system-scope admin for keystone

This patch removes a couple of tempest.conf settings that are being
overwrriten when Keystone is set to enforce scope.

These settings are already being set by the keystone devstack plugin [1]
and do not need to be overwritten here.

Keystone is changing the default admin credentials to be project-admin
instead of system-admin to address some failing tests in services that
require project-scoped admin for their admin APIs. [2]  These overrides
are preventing that change from taking effect.

[1] https://opendev.org/openstack/keystone/src/branch/stable/2024.1/devstack/lib/scope.sh#L24-L25
[2] https://review.opendev.org/c/openstack/keystone/+/913999

Change-Id: I48edbcbaa993f2d1f35160c415986d21a15a4999
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7b5fde170e..6bd203e6f4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -702,8 +702,6 @@ function configure_tempest {
     # test can be run with scoped token.
     if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope keystone true
-        iniset $TEMPEST_CONFIG auth admin_system 'all'
-        iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
 
     if [[ "$NOVA_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then

From 99a96288eb14e66723d85e6ca24ff51babac7ec8 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Thu, 28 Mar 2024 23:38:19 +0100
Subject: [PATCH 3157/3333] Update DEVSTACK_SERIES to 2024.2

stable/2024.1 branch has been created now and
current master is for 2024.2.

Change-Id: I4af9e87318ef9cbfede7df7c23872a1a7e38c820
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 4e49b461d4..de81f01f38 100644
--- a/stackrc
+++ b/stackrc
@@ -257,7 +257,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2024.1"
+DEVSTACK_SERIES="2024.2"
 
 ##############
 #

From c336b873421c954921ee26c22bd9bfe65b330d0c Mon Sep 17 00:00:00 2001
From: Jaromir Wysoglad <jwysogla@redhat.com>
Date: Wed, 27 Mar 2024 11:36:26 +0100
Subject: [PATCH 3158/3333] Fix neutron empty string check

The variable should be in quotes for the check to work

Testing the behavior in bash:
current behavior:
$ config_file=""
$ if [ -n ${config_file} ]; then echo a; fi
a

$ config_file="abc"
$ if [ -n ${config_file} ]; then echo a; fi
a

behavior with quotes:
$ config_file=""
$ if [ -n "$config_file" ]; then echo a; fi

$ config_file="abc"
$ if [ -n "$config_file" ]; then echo a; fi
a

Change-Id: Iba956d9d4f43b925848174a632aabe58999be74b
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e646258651..699bd54f4e 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -558,7 +558,7 @@ function configure_ovn {
         sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
         config_file=$OVN_META_CONF
     fi
-    if [ -n ${config_file} ]; then
+    if [ -n "$config_file" ]; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
         mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2

From b6613b1e71fb6a0efb63ec9346bd2e67131657e0 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 6 Dec 2023 10:22:30 +0000
Subject: [PATCH 3159/3333] lib/apache: Use module paths instead of WSGI
 scripts

pbr's 'wsgi_scripts' entrypoint functionality is not long for this world
so we need to start working towards an alternative. We could start
packaging our own WSGI scripts in DevStack but using module paths seems
like a better option, particularly when it's supported by other WSGI
servers like gunicorn.

Currently only nova is migrated. We should switch additional projects as
they migrate and eventually remove the support for WSGI scripts
entirely.

Change-Id: I057dc635c01e54740ee04dfe7b39ef83db5dc180
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/nova/+/902687/
---
 lib/apache | 33 ++++++++++++++++++++++++++++-----
 lib/nova   |  8 ++++----
 2 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/lib/apache b/lib/apache
index 9017e0a38a..a314b76fb7 100644
--- a/lib/apache
+++ b/lib/apache
@@ -237,13 +237,17 @@ function restart_apache_server {
     restart_service $APACHE_NAME
 }
 
+# write_uwsgi_config() - Create a new uWSGI config file
 function write_uwsgi_config {
     local conf=$1
     local wsgi=$2
     local url=$3
     local http=$4
-    local name=""
-    name=$(basename $wsgi)
+    local name=$5
+
+    if [ -z "$name" ]; then
+        name=$(basename $wsgi)
+    fi
 
     # create a home for the sockets; note don't use /tmp -- apache has
     # a private view of it on some platforms.
@@ -259,7 +263,15 @@ function write_uwsgi_config {
 
     # always cleanup given that we are using iniset here
     rm -rf $conf
-    iniset "$conf" uwsgi wsgi-file "$wsgi"
+    # Set either the module path or wsgi script path depending on what we've
+    # been given. Note that the regex isn't exhaustive - neither Python modules
+    # nor Python variables can start with a number - but it's "good enough"
+    if [[ "$wsgi" =~ ^[a-zA-Z0-9_.]+:[a-zA-Z0-9_]+$ ]]; then
+        iniset "$conf" uwsgi module "$wsgi"
+    else
+        deprecated 'Configuring uWSGI with a WSGI file is deprecated, use module paths instead'
+        iniset "$conf" uwsgi wsgi-file "$wsgi"
+    fi
     iniset "$conf" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$conf" uwsgi master true
@@ -306,14 +318,25 @@ function write_local_uwsgi_http_config {
     local conf=$1
     local wsgi=$2
     local url=$3
-    name=$(basename $wsgi)
+    local name=$4
+
+    if [ -z "$name" ]; then
+        name=$(basename $wsgi)
+    fi
 
     # create a home for the sockets; note don't use /tmp -- apache has
     # a private view of it on some platforms.
 
     # always cleanup given that we are using iniset here
     rm -rf $conf
-    iniset "$conf" uwsgi wsgi-file "$wsgi"
+    # Set either the module path or wsgi script path depending on what we've
+    # been given
+    if [[ "$wsgi" =~ ^[a-zA-Z0-9_.]+:[a-zA-Z0-9_]+$ ]]; then
+        iniset "$conf" uwsgi module "$wsgi"
+    else
+        deprecated 'Configuring uWSGI with a WSGI file is deprecated, use module paths instead'
+        iniset "$conf" uwsgi wsgi-file "$wsgi"
+    fi
     port=$(get_random_port)
     iniset "$conf" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
     iniset "$conf" uwsgi processes $API_WORKERS
diff --git a/lib/nova b/lib/nova
index 17c90dfe26..a261fac8f6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,8 +53,8 @@ NOVA_COND_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
-NOVA_UWSGI=$NOVA_BIN_DIR/nova-api-wsgi
-NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
+NOVA_UWSGI=nova.wsgi.osapi_compute:application
+NOVA_METADATA_UWSGI=nova.wsgi.metadata:application
 NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
 NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
@@ -549,11 +549,11 @@ function create_nova_conf {
     iniset $NOVA_CONF upgrade_levels compute "auto"
 
     if is_service_enabled n-api; then
-        write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
+        write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute" "" "nova-api"
     fi
 
     if is_service_enabled n-api-meta; then
-        write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
+        write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}" "nova-metadata"
     fi
 
     if is_service_enabled ceilometer; then

From 9be4ceeaa10f6ed92291e77ec52794acfb67c147 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Tue, 23 Apr 2024 15:37:37 -0400
Subject: [PATCH 3160/3333] Fix datetime.utcnow() deprecation warning

Running stack.sh on a python 3.12 system generates this
warning from worlddump.py:

  DeprecationWarning: datetime.datetime.utcnow() is deprecated

Use datetime.now(timezone.utc) instead, which should be
backwards-compatible with older python versions.

TrivialFix

Change-Id: I11fe60f6b04842412045c6cb97f493f7fef66e1a
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index aadd33b634..edbfa268db 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -51,7 +51,7 @@ def get_options():
 
 
 def filename(dirname, name=""):
-    now = datetime.datetime.utcnow()
+    now = datetime.datetime.now(datetime.timezone.utc)
     fmt = "worlddump-%Y-%m-%d-%H%M%S"
     if name:
         fmt += "-" + name

From aee9b0ff9e68f9306d9a55bca5304366fb85e91b Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 9 May 2024 10:29:43 -0700
Subject: [PATCH 3161/3333] Make rocky 9 job non-voting

This job is currently failing with mirror or repo issues.

Change-Id: Ie0f862f933cd99cc9fe698d5a178b952e6e93ac4
---
 .zuul.yaml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8bc082364c..294dd48f4d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -644,6 +644,11 @@
     description: Rocky Linux 9 Blue Onyx platform test
     nodeset: devstack-single-node-rockylinux-9
     timeout: 9000
+    # NOTE(danms): This has been failing lately with some repository metadata
+    # errors. We're marking this as non-voting until it appears to have
+    # stabilized:
+    # https://zuul.openstack.org/builds?job_name=devstack-platform-rocky-blue-onyx&skip=0
+    voting: false
     vars:
       configure_swap_size: 4096
 
@@ -887,7 +892,9 @@
         - devstack-ipv6
         - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
-        - devstack-platform-rocky-blue-onyx
+        # NOTE(danms): Disabled due to instability, see comment in the job
+        # definition above.
+        # - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From 769adbd69daf89f05c96d877519efc81a25fd3c1 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 8 May 2024 16:58:46 +0000
Subject: [PATCH 3162/3333] Upload images with --file instead of stdin

This is more likely how people will actually upload their images, but
it also prevents the "osc as a service" feature from working because
stdin isn't proxied (of course). So just convert our uses of "image
create" to use --file instead of stdin.

Change-Id: I7205eb0100ba7406650ed609cf517cba2c8d30aa
---
 functions | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 01e1d259ad..f81e8f0a08 100644
--- a/functions
+++ b/functions
@@ -118,7 +118,7 @@ function _upload_image {
         useimport="--import"
     fi
 
-    openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties < "${image}"
+    openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties --file $(readlink -f "${image}")
 }
 
 # Retrieve an image from a URL and upload into Glance.
@@ -425,10 +425,10 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" -f value -c id)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki --file $(readlink -f "$kernel") -f value -c id)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" -f value -c id)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari --file $(readlink -f "$ramdisk") -f value -c id)
         fi
         _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi

From c80b9f4fc16997631696100a8e468d907a177f7d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 13 May 2024 11:04:45 +0200
Subject: [PATCH 3163/3333] Drop reno

devstack doesn't do releases, so there should be no release notes,
either. Drop the one that was accidentally created to avoid confusion.

Change-Id: I75a295e50c36925a0137a5458444fb48bd5d9f8a
---
 ...NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml

diff --git a/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml b/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
deleted file mode 100644
index f815e14ccb..0000000000
--- a/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-fixes:
-  - |
-    Fixes a NotImplementedError when using the dbcounter SQLAlchemy plugin on
-    SQLAlchemy 2.x.

From d5182ce3fcf5caf8f7dca84217b2c3cb70993df7 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 19 Apr 2024 12:27:14 +0100
Subject: [PATCH 3164/3333] lib/apache: Pass name, not path, to
 remove_uwsgi_config

We'd like to move from configuring uWSGI with '.wsgi' files to
configuring with module paths. Do this for all in-tree services and log
a deprecation warning for anyone still passing a path.

Note that since 'basepath foo' returns 'foo', this is effectively a
no-op for the services being converted here.

Change-Id: Ia1ad5ff160a9821ceab97ff1c24bc48cd4bf1d6f
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/apache    | 6 ++++++
 lib/cinder    | 2 +-
 lib/glance    | 2 +-
 lib/keystone  | 2 +-
 lib/neutron   | 2 +-
 lib/nova      | 4 ++--
 lib/placement | 2 +-
 7 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/apache b/lib/apache
index a314b76fb7..48438da6a1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -402,8 +402,14 @@ function remove_uwsgi_config {
     local conf=$1
     local wsgi=$2
     local name=""
+    # TODO(stephenfin): Remove this call when everyone is using module path
+    # configuration instead of file path configuration
     name=$(basename $wsgi)
 
+    if [[ "$wsgi" = /* ]]; then
+        deprecated "Passing a wsgi script to remove_uwsgi_config is deprecated, pass an application name instead"
+    fi
+
     rm -rf $conf
     disable_apache_site $name
 }
diff --git a/lib/cinder b/lib/cinder
index f7824eb6f4..ae898e9522 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -275,7 +275,7 @@ function cleanup_cinder {
     fi
 
     stop_process "c-api"
-    remove_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI"
+    remove_uwsgi_config "$CINDER_UWSGI_CONF" "cinder-wsgi"
 }
 
 # configure_cinder() - Set config files, create data dirs, etc
diff --git a/lib/glance b/lib/glance
index 8ee842625f..274687112e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -168,7 +168,7 @@ function cleanup_glance {
         # Cleanup reserved stores directories
         sudo rm -rf $GLANCE_STAGING_DIR $GLANCE_TASKS_DIR
     fi
-    remove_uwsgi_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI"
+    remove_uwsgi_config "$GLANCE_UWSGI_CONF" "glance-wsgi-api"
 }
 
 # Set multiple cinder store related config options for each of the cinder store
diff --git a/lib/keystone b/lib/keystone
index 6cb4aac46a..7d6b05fd41 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -150,7 +150,7 @@ function cleanup_keystone {
         sudo rm -f $(apache_site_config_for keystone)
     else
         stop_process "keystone"
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
         sudo rm -f $(apache_site_config_for keystone-wsgi-public)
     fi
 }
diff --git a/lib/neutron b/lib/neutron
index bc77f161d7..ed854fdd66 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -823,7 +823,7 @@ function cleanup_neutron {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-api
         stop_process neutron-rpc-server
-        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api"
+        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
         sudo rm -f $(apache_site_config_for neutron-api)
     fi
 
diff --git a/lib/nova b/lib/nova
index a261fac8f6..ee3f29eebf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -248,8 +248,8 @@ function cleanup_nova {
 
     stop_process "n-api"
     stop_process "n-api-meta"
-    remove_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI"
-    remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI"
+    remove_uwsgi_config "$NOVA_UWSGI_CONF" "nova-api"
+    remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "nova-metadata"
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
         clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME
diff --git a/lib/placement b/lib/placement
index c6bf99f868..63fdfb6c1a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -68,7 +68,7 @@ function is_placement_enabled {
 # runs that a clean run would need to clean up
 function cleanup_placement {
     sudo rm -f $(apache_site_config_for placement-api)
-    remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
+    remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "placement-api"
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files

From a6f3901a4bf81f3fe9f6132629bc552e179dd8c9 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 6 Dec 2023 17:20:37 +0000
Subject: [PATCH 3165/3333] lib/apache: Reshuffle lines

Make it a little more obvious what the difference between the two helper
functions is.

Change-Id: I07ec34ecfcd2b7925485145c4b4bf68eda385a32
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/apache | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/apache b/lib/apache
index 48438da6a1..1420f76ff2 100644
--- a/lib/apache
+++ b/lib/apache
@@ -345,15 +345,15 @@ function write_local_uwsgi_http_config {
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$conf" uwsgi die-on-term true
     iniset "$conf" uwsgi exit-on-reload false
+    # Set worker-reload-mercy so that worker will not exit till the time
+    # configured after graceful shutdown
+    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$conf" uwsgi enable-threads true
     iniset "$conf" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$conf" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
     iniset "$conf" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
-    # Set worker-reload-mercy so that worker will not exit till the time
-    # configured after graceful shutdown
-    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     # Override the default size for headers from the 4k default.
     iniset "$conf" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.

From 9a97326c3f3b04728cf4484df37ce7260f6367af Mon Sep 17 00:00:00 2001
From: Ben Nemec <bnemec@redhat.com>
Date: Mon, 12 Aug 2019 20:10:49 +0000
Subject: [PATCH 3166/3333] Use OSCaaS to speed up devstack runs

OpenStackClient has a significant amount of startup overhead, which
adds a non-trivial amount of time to each devstack run because it makes
a lot of OSC calls. This change uses the OSC service from [0] to run
a persistent process that handles openstack calls. This removes most
of the startup overhead and in my local testing removes about three
minutes per devstack run.

Currently this is implemented as an opt-in feature. There are likely a
lot of edge cases in projects that use a devstack plugin so turning it
on universally is going to require boiling the ocean. I think getting
this in and enabled for some of the major projects should give us a lot
of the benefit without the enormous effort of making it 100% compatible
across all of OpenStack.

Depends-On: https://review.opendev.org/c/openstack/nova/+/918689
Depends-On: https://review.opendev.org/c/openstack/ironic/+/918690
Change-Id: I28e6159944746abe2d320369249b87f1c4b9e24e
0: http://lists.openstack.org/pipermail/openstack-dev/2016-April/092546.html
---
 files/openstack-cli-server/openstack          | 119 ++++++++++++++++++
 .../openstack-cli-server/openstack-cli-server | 118 +++++++++++++++++
 functions-common                              |   5 +
 stack.sh                                      |   3 +
 unstack.sh                                    |   4 +
 5 files changed, 249 insertions(+)
 create mode 100755 files/openstack-cli-server/openstack
 create mode 100755 files/openstack-cli-server/openstack-cli-server

diff --git a/files/openstack-cli-server/openstack b/files/openstack-cli-server/openstack
new file mode 100755
index 0000000000..ef05f1b841
--- /dev/null
+++ b/files/openstack-cli-server/openstack
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import socket
+import sys
+import os
+import os.path
+import json
+
+server_address = "/tmp/openstack.sock"
+
+sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+
+try:
+    sock.connect(server_address)
+except socket.error as msg:
+    print(msg, file=sys.stderr)
+    sys.exit(1)
+
+
+def send(sock, doc):
+    jdoc = json.dumps(doc)
+    sock.send(b'%d\n' % len(jdoc))
+    sock.sendall(jdoc.encode('utf-8'))
+
+def recv(sock):
+    length_str = b''
+
+    char = sock.recv(1)
+    if len(char) == 0:
+        print("Unexpected end of file", file=sys.stderr)
+        sys.exit(1)
+
+    while char != b'\n':
+        length_str += char
+        char = sock.recv(1)
+        if len(char) == 0:
+            print("Unexpected end of file", file=sys.stderr)
+            sys.exit(1)
+
+    total = int(length_str)
+
+    # use a memoryview to receive the data chunk by chunk efficiently
+    jdoc = memoryview(bytearray(total))
+    next_offset = 0
+    while total - next_offset > 0:
+        recv_size = sock.recv_into(jdoc[next_offset:], total - next_offset)
+        next_offset += recv_size
+    try:
+        doc = json.loads(jdoc.tobytes())
+    except (TypeError, ValueError) as e:
+        raise Exception('Data received was not in JSON format')
+    return doc
+
+try:
+    env = {}
+    passenv = ["CINDER_VERSION",
+               "OS_AUTH_URL",
+               "OS_IDENTITY_API_VERSION",
+               "OS_NO_CACHE",
+               "OS_PASSWORD",
+               "OS_PROJECT_NAME",
+               "OS_REGION_NAME",
+               "OS_TENANT_NAME",
+               "OS_USERNAME",
+               "OS_VOLUME_API_VERSION",
+               "OS_CLOUD"]
+    for name in passenv:
+        if name in os.environ:
+            env[name] = os.environ[name]
+
+    cmd = {
+        "app": os.path.basename(sys.argv[0]),
+        "env": env,
+        "argv": sys.argv[1:]
+    }
+    try:
+        image_idx = sys.argv.index('image')
+        create_idx = sys.argv.index('create')
+        missing_file = image_idx < create_idx and \
+                not any(x.startswith('--file') for x in sys.argv)
+    except ValueError:
+        missing_file = False
+
+    if missing_file:
+        # This means we were called with an image create command, but were
+        # not provided a --file option. That likely means we're being passed
+        # the image data to stdin, which won't work because we do not proxy
+        # stdin to the server. So, we just reject the operation and ask the
+        # caller to provide the file with --file instead.
+        # We've already connected to the server, we need to send it some dummy
+        # data so it doesn't wait forever.
+        send(sock, {})
+        print('Image create without --file is not allowed in server mode',
+              file=sys.stderr)
+        sys.exit(1)
+    else:
+        send(sock, cmd)
+
+    doc = recv(sock)
+    if doc["stdout"] != b'':
+        print(doc["stdout"], end='')
+    if doc["stderr"] != b'':
+        print(doc["stderr"], file=sys.stderr)
+    sys.exit(doc["status"])
+finally:
+    sock.close()
diff --git a/files/openstack-cli-server/openstack-cli-server b/files/openstack-cli-server/openstack-cli-server
new file mode 100755
index 0000000000..f3d2747e52
--- /dev/null
+++ b/files/openstack-cli-server/openstack-cli-server
@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import socket
+import sys
+import os
+import json
+
+from openstackclient import shell as osc_shell
+from io import StringIO
+
+server_address = "/tmp/openstack.sock"
+
+try:
+    os.unlink(server_address)
+except OSError:
+    if os.path.exists(server_address):
+        raise
+
+sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+print('starting up on %s' % server_address, file=sys.stderr)
+sock.bind(server_address)
+
+# Listen for incoming connections
+sock.listen(1)
+
+def send(sock, doc):
+    jdoc = json.dumps(doc)
+    sock.send(b'%d\n' % len(jdoc))
+    sock.sendall(jdoc.encode('utf-8'))
+
+def recv(sock):
+    length_str = b''
+    char = sock.recv(1)
+    while char != b'\n':
+        length_str += char
+        char = sock.recv(1)
+
+    total = int(length_str)
+
+    # use a memoryview to receive the data chunk by chunk efficiently
+    jdoc = memoryview(bytearray(total))
+    next_offset = 0
+    while total - next_offset > 0:
+        recv_size = sock.recv_into(jdoc[next_offset:], total - next_offset)
+        next_offset += recv_size
+    try:
+        doc = json.loads(jdoc.tobytes())
+    except (TypeError, ValueError) as e:
+        raise Exception('Data received was not in JSON format')
+    return doc
+
+while True:
+    csock, client_address = sock.accept()
+    try:
+        doc = recv(csock)
+
+        print("%s %s" % (doc["app"], doc["argv"]), file=sys.stderr)
+        oldenv = {}
+        for name in doc["env"].keys():
+            oldenv[name] = os.environ.get(name, None)
+            os.environ[name] = doc["env"][name]
+
+        try:
+            old_stdout = sys.stdout
+            old_stderr = sys.stderr
+            my_stdout = sys.stdout = StringIO()
+            my_stderr = sys.stderr = StringIO()
+
+            class Exit(BaseException):
+                def __init__(self, status):
+                    self.status = status
+
+            def noexit(stat):
+                raise Exit(stat)
+
+            sys.exit = noexit
+
+            if doc["app"] == "openstack":
+                sh = osc_shell.OpenStackShell()
+                ret = sh.run(doc["argv"])
+            else:
+                print("Unknown application %s" % doc["app"], file=sys.stderr)
+                ret = 1
+        except Exit as e:
+            ret = e.status
+        finally:
+            sys.stdout = old_stdout
+            sys.stderr = old_stderr
+
+            for name in oldenv.keys():
+                if oldenv[name] is None:
+                    del os.environ[name]
+                else:
+                    os.environ[name] = oldenv[name]
+
+        send(csock, {
+            "stdout": my_stdout.getvalue(),
+            "stderr": my_stderr.getvalue(),
+            "status": ret,
+        })
+
+    except BaseException as e:
+        print(e, file=sys.stderr)
+    finally:
+        csock.close()
diff --git a/functions-common b/functions-common
index 8ea6df7c1d..84d281b21e 100644
--- a/functions-common
+++ b/functions-common
@@ -2438,6 +2438,11 @@ function time_stop {
     _TIME_TOTAL[$name]=$(($total + $elapsed_time))
 }
 
+function install_openstack_cli_server {
+    export PATH=$TOP_DIR/files/openstack-cli-server:$PATH
+    run_process openstack-cli-server "$PYTHON $TOP_DIR/files/openstack-cli-server/openstack-cli-server"
+}
+
 function oscwrap {
     local xtrace
     xtrace=$(set +o | grep xtrace)
diff --git a/stack.sh b/stack.sh
index c6652e5c6a..0c36e1034e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1022,6 +1022,9 @@ if use_library_from_git "python-openstackclient"; then
     setup_dev_lib "python-openstackclient"
 else
     pip_install_gr python-openstackclient
+    if is_service_enabled openstack-cli-server; then
+        install_openstack_cli_server
+    fi
 fi
 
 # Installs alias for osc so that we can collect timing for all
diff --git a/unstack.sh b/unstack.sh
index 33b069b6a3..1b2d8dd62a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -168,6 +168,10 @@ if is_service_enabled etcd3; then
     cleanup_etcd3
 fi
 
+if is_service_enabled openstack-cli-server; then
+    stop_service devstack@openstack-cli-server
+fi
+
 stop_dstat
 
 # NOTE: Cinder automatically installs the lvm2 package, independently of the

From 6971ccc49ad97216d97be46c70c241c5473aff92 Mon Sep 17 00:00:00 2001
From: MinhNLH2 <minh.nlh.work@gmail.com>
Date: Wed, 1 May 2024 21:29:15 +0700
Subject: [PATCH 3167/3333] Display backup dashboard on Horizon when c-bak is
 enabled

Currently, when enabling c-bak service, the backup tab will not
be shown on Horizon by default. This patch tells Horizon to
display backup dashboard when c-bak is enabled.

Closes-Bug: 2064496
Change-Id: I06295706e985bac58de2878c6d24c51f3267c205
Signed-off-by: MinhNLH2 <minh.nlh.work@gmail.com>
---
 lib/horizon | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 6f753f546f..7c0d443aa6 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -109,6 +109,10 @@ function configure_horizon {
         _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT "True"
     fi
 
+    if is_service_enabled c-bak; then
+        _horizon_config_set $local_settings OPENSTACK_CINDER_FEATURES enable_backup "True"
+    fi
+
     # Create an empty directory that apache uses as docroot
     sudo mkdir -p $HORIZON_DIR/.blackhole
 

From fadf63e4a962e4922cdf529c17231fbb49f91e89 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 May 2024 02:37:02 +0000
Subject: [PATCH 3168/3333] Updated from generate-devstack-plugins-list

Change-Id: Ifa6db2e765f5f15a1d7421eef061377e55b58ec7
---
 doc/source/plugin-registry.rst | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2d2a92c4a9..21cf52c736 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -37,7 +37,6 @@ openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
-openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
@@ -62,7 +61,6 @@ openstack/mistral                        `https://opendev.org/openstack/mistral
 openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
 openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
 openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
-openstack/murano                         `https://opendev.org/openstack/murano <https://opendev.org/openstack/murano>`__
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
@@ -84,12 +82,8 @@ openstack/osprofiler                     `https://opendev.org/openstack/osprofil
 openstack/ovn-bgp-agent                  `https://opendev.org/openstack/ovn-bgp-agent <https://opendev.org/openstack/ovn-bgp-agent>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
-openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
-openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
-openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
 openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
 openstack/skyline-apiserver              `https://opendev.org/openstack/skyline-apiserver <https://opendev.org/openstack/skyline-apiserver>`__
-openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
 openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a-service <https://opendev.org/openstack/tap-as-a-service>`__

From 608489cd59b0d0f6f82937abb6a317489ac4d7a4 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 28 May 2024 13:27:14 +0100
Subject: [PATCH 3169/3333] openrc: Stop setting OS_TENANT_NAME
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All clients - OSC included - use keystoneauth under the hood which
hasn't required this in a very long time. Stop setting it and remove the
warning.

We also remove references to 'NOVA_*' variables that haven't been a
thing since well before *I* started working on OpenStack 😅

Change-Id: I882081040215d8e32932ec5d03be34e467e4fbc2
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 openrc | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/openrc b/openrc
index 6d488bb0ba..b72bedbea4 100644
--- a/openrc
+++ b/openrc
@@ -7,9 +7,6 @@
 #   Set OS_USERNAME to override the default user name 'demo'
 #   Set ADMIN_PASSWORD to set the password for 'admin' and 'demo'
 
-# NOTE: support for the old NOVA_* novaclient environment variables has
-# been removed.
-
 if [[ -n "$1" ]]; then
     OS_USERNAME=$1
 fi
@@ -36,22 +33,14 @@ fi
 source $RC_DIR/lib/tls
 
 # The OpenStack ecosystem has standardized the term **project** as the
-# entity that owns resources.  In some places **tenant** remains
-# referenced, but in all cases this just means **project**.  We will
-# warn if we need to turn on legacy **tenant** support to have a
-# working environment.
+# entity that owns resources.
 export OS_PROJECT_NAME=${OS_PROJECT_NAME:-demo}
 
-echo "WARNING: setting legacy OS_TENANT_NAME to support cli tools."
-export OS_TENANT_NAME=$OS_PROJECT_NAME
-
 # In addition to the owning entity (project), nova stores the entity performing
 # the action as the **user**.
 export OS_USERNAME=${OS_USERNAME:-demo}
 
 # With Keystone you pass the keystone password instead of an api key.
-# Recent versions of novaclient use OS_PASSWORD instead of NOVA_API_KEYs
-# or NOVA_PASSWORD.
 export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
 
 # Region

From 9fff87fbc7c972d18b9bf59847b61b0bbd8e4dd9 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 28 May 2024 13:33:32 +0100
Subject: [PATCH 3170/3333] openrc: Group auth-related options together

Change-Id: I98f283b33c2350cc4388463571013896086b31fa
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 openrc | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/openrc b/openrc
index b72bedbea4..e20a5a56b9 100644
--- a/openrc
+++ b/openrc
@@ -32,18 +32,11 @@ fi
 # Get some necessary configuration
 source $RC_DIR/lib/tls
 
-# The OpenStack ecosystem has standardized the term **project** as the
-# entity that owns resources.
+# Minimal configuration
+export OS_AUTH_TYPE=password
 export OS_PROJECT_NAME=${OS_PROJECT_NAME:-demo}
-
-# In addition to the owning entity (project), nova stores the entity performing
-# the action as the **user**.
 export OS_USERNAME=${OS_USERNAME:-demo}
-
-# With Keystone you pass the keystone password instead of an api key.
 export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
-
-# Region
 export OS_REGION_NAME=${REGION_NAME:-RegionOne}
 
 # Set the host API endpoint. This will default to HOST_IP if SERVICE_IP_VERSION
@@ -65,9 +58,6 @@ fi
 # Identity API version
 export OS_IDENTITY_API_VERSION=3
 
-# Ask keystoneauth1 to use keystone
-export OS_AUTH_TYPE=password
-
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/project has access to - including nova, glance, keystone, swift, ...

From 5412dbfe7b797149f1f68100de8003b1876398fe Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 28 May 2024 13:35:28 +0100
Subject: [PATCH 3171/3333] stackrc: Remove USE_PYTHON3

This is no longer necessary and any users of this should be updated to
remove references.

Change-Id: Ice5083d8897376fd2ed6bd509419526e15baaf12
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 stackrc | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/stackrc b/stackrc
index de81f01f38..b37959712b 100644
--- a/stackrc
+++ b/stackrc
@@ -126,10 +126,6 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
 fi
 
-# Control whether Python 3 should be used at all.
-# TODO(frickler): Drop this when all consumers are fixed
-export USE_PYTHON3=True
-
 # Adding the specific version of Python 3 to this variable will install
 # the app using that version of the interpreter instead of just 3.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"

From b500d80c7641583039188baf62c215676e3d81db Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 14 Jun 2024 12:58:58 +0200
Subject: [PATCH 3172/3333] Fix deployment of the neutron with uwsgi

After patch [1] deploying neutron with uwsgi was not working correctly
due to the fact that there was different paths for the applications
set in the api-paste.ini file. Instead of default ones like:

/: neutronversions_composite
/healthcheck: healthcheck
/v2.0: neutronapi_v2_0

it was changing it to something like:

/networking/: neutronversions_composite
/networking/healthcheck: healthcheck
/networking/v2.0: neutronapi_v2_0

where 'networking' can be configured to something else.
This patch fixes deployment of neutron with uwsgi by not changing its
api-paste.ini file when NEUTRON_DEPLOY_MOD_WSGI=True.

[1] https://review.opendev.org/c/openstack/devstack/+/849145

Closes-bug: #2069418
Change-Id: I12b860d4d98442e2b5ac0c9fd854f1226633b518
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 808043cebe..021ffeb11e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1002,7 +1002,7 @@ function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
 
-    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" && -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
         _replace_api_paste_composite
     fi
 

From 4d69238383c45c862d588cfe1e0234e6a13a1220 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 21 Jun 2024 18:27:32 +0530
Subject: [PATCH 3173/3333] Fix rdo_release for unmaintained branches

Only branches with stable/ as prefix were considered
but now we have branches even with different
prefix like unmaintained/, fix it to consider
such cases by using a generic filter instead of
assuming branch name starts with stable.

Change-Id: I967de13094ff6df46737a22d4e1758f9900dfbc9
---
 stack.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 0c36e1034e..740682920c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -307,8 +307,8 @@ function _install_rdo {
             # rdo-release.el8.rpm points to latest RDO release, use that for master
             sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
         else
-            # For stable branches use corresponding release rpm
-            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            # For stable/unmaintained branches use corresponding release rpm
+            rdo_release=${TARGET_BRANCH#*/}
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
         fi
     elif [[ $DISTRO == "rhel9" ]]; then
@@ -316,8 +316,8 @@ function _install_rdo {
             # rdo-release.el9.rpm points to latest RDO release, use that for master
             sudo dnf -y install https://rdoproject.org/repos/rdo-release.el9.rpm
         else
-            # For stable branches use corresponding release rpm
-            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            # For stable/unmaintained branches use corresponding release rpm
+            rdo_release=${TARGET_BRANCH#*/}
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
         fi
     fi

From 56368c271d5915af76e8e5d2b0bd873d09ba3a49 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 17 Jun 2024 15:10:40 +0000
Subject: [PATCH 3174/3333] [Neutron] Add a new Neutron service:
 neutron-periodic-workers

This new service is spawned when using Neutron WSGI module. This new
service executes the plugin workers inside a wrapper executor class
called ``AllServicesNeutronWorker``. The workers are executed as
threads inside the process.

Depends-On: https://review.opendev.org/c/openstack/neutron/+/922110
Related-Bug: #2069581

Change-Id: I6b76b7bcee1365c80f76231e0311406831f8ce41
---
 lib/neutron | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 8b65980e90..e0b5d5d68c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -634,7 +634,9 @@ function start_neutron_service_and_check {
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
+        enable_service neutron-periodic-workers
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+        run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
     else
         run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
         neutron_url=$service_protocol://$Q_HOST:$service_port/
@@ -706,6 +708,7 @@ function stop_other {
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-rpc-server
+        stop_process neutron-periodic-workers
         stop_process neutron-api
     else
         stop_process q-svc
@@ -823,6 +826,7 @@ function cleanup_neutron {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-api
         stop_process neutron-rpc-server
+        stop_process neutron-periodic-workers
         remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
         sudo rm -f $(apache_site_config_for neutron-api)
     fi

From 41d253a6f94c1646f2bd28ac373d6aaf8bfa6089 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 20 Jun 2024 19:03:37 +0100
Subject: [PATCH 3175/3333] add ubuntu noble (24.04) support

This change installs setuptools in the requirements
and global venv to ensure that distutils is present

This change also adds new single and two node
nodeset for noble and a devstack platform job as nonvoting.

Change-Id: Ie1f8ebc5db75d6913239c529ee923395a764e19c
---
 .zuul.yaml | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 inc/python |  2 +-
 lib/infra  |  2 +-
 stack.sh   |  2 +-
 4 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 294dd48f4d..50a34ae0b3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-noble
+    nodes:
+      - name: controller
+        label: ubuntu-noble
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-single-node-focal
     nodes:
@@ -148,6 +158,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-noble
+    nodes:
+      - name: controller
+        label: ubuntu-noble
+      - name: compute1
+        label: ubuntu-noble
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:
@@ -652,6 +692,17 @@
     vars:
       configure_swap_size: 4096
 
+
+- job:
+    name: devstack-platform-ubuntu-noble
+    parent: tempest-full-py3
+    description: Ubuntu 24.04 LTS (noble) platform test
+    nodeset: openstack-single-node-noble
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 8192
+
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
     parent: devstack-platform-ubuntu-jammy
@@ -849,6 +900,7 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-ubuntu-noble
         - devstack-platform-openEuler-22.03-ovn-source
         - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
diff --git a/inc/python b/inc/python
index 43b06eb520..2339afdd6d 100644
--- a/inc/python
+++ b/inc/python
@@ -41,7 +41,7 @@ function setup_devstack_virtualenv {
         # This package is currently installed via the distro and not
         # available on pypi.
         python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
-        pip_install -U pip
+        pip_install -U pip setuptools
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"
diff --git a/lib/infra b/lib/infra
index b983f2b739..2aad00354a 100644
--- a/lib/infra
+++ b/lib/infra
@@ -31,7 +31,7 @@ function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
     [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
     # Unset the PIP_VIRTUAL_ENV so that PBR does not end up trapped
diff --git a/stack.sh b/stack.sh
index 0c36e1034e..6ae324bb0c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|bullseye|jammy|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|bullseye|jammy|noble|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From db305d2a4bb36c3d3a4ef4a108069cd77bca540e Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 24 Jun 2024 15:27:58 +0100
Subject: [PATCH 3176/3333] enable openstack-cli-server and other perfromace
 tunings

This commit enabeles a number of performance optimizations
to tune the host vms memory and io by leveraging zswap
and other kernel parmaters to minimize the effect of io
latency and memory pressure.

The openstack-cli-server has been enabled in the nova ci
for several months now and has proven to speed up devstack
signifcantly, while this change does not enable it by
default in devstack it does enable it by default in the ci
jobs.

simiarly the zswap and other tuning remain disabled by default
in devstack but are enabled by default in the devstack job.

This change limits the qemu tb_cache_size to 128MB form 1G,
this requires libvirt 8.0.0 or newer. as bullseye and
openeuler-22.03 do not meet that requirement they have been
removed. libvirt 8.0.0 will be the new min version supported
in nova in the 2025.1 release so the decions was made
to drop supprot for older release now instead of doing it
at the start of the 2025.1 cycle. debain coverage is still
provided by the newer bookworm relase. openeuler-22.03 has
been superseded by the openeuler-24.03 lts release.
openeuler-24.03 is not currnetly aviable in ci but supprot
could be readded if desired however that is out os scope of
this change.

Change-Id: Ib45ca08c7e3e833b14f7e6ec496ad2d2f7073f99
---
 .zuul.yaml | 148 +++++++++++++++++++++++------------------------------
 stack.sh   |   2 +-
 2 files changed, 64 insertions(+), 86 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 50a34ae0b3..06d76d0093 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -68,6 +68,9 @@
         nodes:
           - controller
 
+# Note(sean-k-mooney): this is still used by horizon for
+# horizon-integration-tests, horizon-integration-pytest and
+# horizon-ui-pytest, remove when horizon is updated.
 - nodeset:
     name: devstack-single-node-debian-bullseye
     nodes:
@@ -88,16 +91,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-openeuler-22.03
-    nodes:
-      - name: controller
-        label: openEuler-22-03-LTS
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -463,6 +456,7 @@
         file_tracker: true
         mysql: true
         rabbit: true
+        openstack-cli-server: true
     group-vars:
       subnode:
         devstack_services:
@@ -470,6 +464,7 @@
           dstat: false
           memory_tracker: true
           file_tracker: true
+          openstack-cli-server: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -517,7 +512,14 @@
       - opendev.org/openstack/swift
     timeout: 7200
     vars:
-      configure_swap_size: 4096
+      # based on observation of the integrated gate
+      # tempest-integrated-compute was only using ~1.7GB of swap
+      # when zswap and the host turning are enabled that increase
+      # slightly to ~2GB. we are setting the swap size to 8GB to
+      # be safe and account for more complex scenarios.
+      # we should revisit this value after some time to see if we
+      # can reduce it.
+      configure_swap_size: 8192
       devstack_localrc:
         # Common OpenStack services settings
         SWIFT_REPLICAS: 1
@@ -526,11 +528,33 @@
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
         OVN_DBS_LOG_LEVEL: dbg
+        # tune the host to optimize memory usage and hide io latency
+        # these setting will configure the kernel to treat the host page
+        # cache and swap with equal priority, and prefer deferring writes
+        # changing the default swappiness, dirty_ratio and
+        # the vfs_cache_pressure
+        ENABLE_SYSCTL_MEM_TUNING: true
+        # the net tuning optimizes ipv4 tcp fast open and config the default
+        # qdisk policy to pfifo_fast which effectively disable all qos.
+        # this minimizes the cpu load of the host network stack
+        ENABLE_SYSCTL_NET_TUNING: true
+        # zswap allows the kernel to compress pages in memory before swapping
+        # them to disk. this can reduce the amount of swap used and improve
+        # performance. effectively this trades a small amount of cpu for an
+        # increase in swap performance by reducing the amount of data
+        # written to disk. the overall speedup is proportional to the
+        # compression ratio and the speed of the swap device.
+        ENABLE_ZSWAP: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
             DEFAULT:
               global_physnet_mtu: '{{ external_bridge_mtu }}'
+          $NOVA_CPU_CONF:
+            libvirt:
+              # Use lower TB cache than default(1GiB), only applicable with
+              # libvirt>=8.0.0
+              tb_cache_size: 128
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -618,6 +642,30 @@
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
           NOVA_VNC_ENABLED: true
           ENABLE_CHASSIS_AS_GW: false
+          # tune the host to optimize memory usage and hide io latency
+          # these setting will configure the kernel to treat the host page
+          # cache and swap with equal priority, and prefer deferring writes
+          # changing the default swappiness, dirty_ratio and
+          # the vfs_cache_pressure
+          ENABLE_SYSCTL_MEM_TUNING: true
+          # the net tuning optimizes ipv4 tcp fast open and config the default
+          # qdisk policy to pfifo_fast which effectively disable all qos.
+          # this minimizes the cpu load of the host network stack
+          ENABLE_SYSCTL_NET_TUNING: true
+          # zswap allows the kernel to compress pages in memory before swapping
+          # them to disk. this can reduce the amount of swap used and improve
+          # performance. effectivly this trades a small amount of cpu for an
+          # increase in swap performance by reducing the amount of data
+          # written to disk. the overall speedup is porportional to the
+          # compression ratio and the speed of the swap device.
+          ENABLE_ZSWAP: true
+        devstack_local_conf:
+          post-config:
+            $NOVA_CPU_CONF:
+              libvirt:
+                # Use lower TB cache than default(1GiB), only applicable with
+                # libvirt>=8.0.0
+                tb_cache_size: 128
 
 - job:
     name: devstack-ipv6
@@ -669,15 +717,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-platform-debian-bullseye
-    parent: tempest-full-py3
-    description: Debian Bullseye platform test
-    nodeset: devstack-single-node-debian-bullseye
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-
 - job:
     name: devstack-platform-rocky-blue-onyx
     parent: tempest-full-py3
@@ -754,62 +793,6 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
-- job:
-    name: devstack-platform-openEuler-22.03-ovn-source
-    parent: tempest-full-py3
-    description: openEuler 22.03 LTS platform test (OVN)
-    nodeset: devstack-single-node-openeuler-22.03
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-      devstack_localrc:
-        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
-        # from source instead.
-        OVN_BUILD_FROM_SOURCE: True
-        OVN_BRANCH: "v21.06.0"
-        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
-        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
-
-- job:
-    name: devstack-platform-openEuler-22.03-ovs
-    parent: tempest-full-py3
-    description: openEuler 22.03 LTS platform test (OVS)
-    nodeset: devstack-single-node-openeuler-22.03
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 8192
-      devstack_localrc:
-        Q_AGENT: openvswitch
-        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
-        Q_ML2_TENANT_NETWORK_TYPE: vxlan
-      devstack_services:
-        # Disable OVN services
-        ovn-northd: false
-        ovn-controller: false
-        ovs-vswitchd: false
-        ovsdb-server: false
-        # Disable Neutron ML2/OVN services
-        q-ovn-metadata-agent: false
-        # Enable Neutron ML2/OVS services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
-    group-vars:
-      subnode:
-        devstack_services:
-          # Disable OVN services
-          ovn-controller: false
-          ovs-vswitchd: false
-          ovsdb-server: false
-          # Disable Neutron ML2/OVN services
-          q-ovn-metadata-agent: false
-          # Enable Neutron ML2/OVS services
-          q-agt: true
-
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -896,13 +879,10 @@
         - devstack-enforce-scope
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
-        - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
         - devstack-platform-ubuntu-noble
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -943,7 +923,6 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
-        - devstack-platform-debian-bullseye
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
         # - devstack-platform-rocky-blue-onyx
@@ -978,7 +957,9 @@
     # pruned.
     #
     # * nova-next: maintained by nova for unreleased/undefaulted
-    #    things
+    #    things, this job is not experimental but often is used to test
+    #    things that are not yet production ready or to test what will be
+    #    the new default after a deprecation period has ended.
     # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
     #    when neutron-api is served by uwsgi, it's in exprimental for testing.
     #    the next cycle we can remove this  job if things turn out to be
@@ -988,7 +969,7 @@
     #    stable engouh with uwsgi.
     # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
     #    Next cycle we can remove this if everything run out stable enough.
-    # * nova-multi-cell: maintained by nova and currently non-voting in the
+    # * nova-multi-cell: maintained by nova and now is voting in the
     #    check queue for nova changes but relies on devstack configuration
 
     experimental:
@@ -1026,9 +1007,6 @@
       jobs:
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
-        - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs
diff --git a/stack.sh b/stack.sh
index 77548105a7..ab3f01cdbd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|bullseye|jammy|noble|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From e825ba07a1b88ab0570053f92123aa451e4b2ec8 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@protonmail.com>
Date: Wed, 26 Jun 2024 18:10:43 +0200
Subject: [PATCH 3177/3333] Create parent directory in merge_config_file

The code accounts for the config file not existing but it does not
account for the parent directory missing. This is currently breaking any
Ironic jobs that disable Nova.

Change-Id: Ia5fcfe6c63f5cc40b11f7e1f3be244d7897f26f6
---
 inc/meta-config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/inc/meta-config b/inc/meta-config
index be73b60800..b9d9649e4b 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -90,6 +90,7 @@ function merge_config_file {
     local real_configfile
     real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
+        mkdir -p $(dirname $real_configfile) || die $LINENO "could not create the directory of $real_configfile ($configfile)"
         touch $real_configfile || die $LINENO "could not create config file $real_configfile ($configfile)"
     fi
 

From c707dd3fc2d601db5169508ed39e24dde89e9631 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 26 Apr 2023 14:59:25 +0000
Subject: [PATCH 3178/3333] [nova] Add flag to set libvirt tb_cache_size

A config option is being added in nova with [1]
in order to allow configuring lower tb-cache size
for qemu guest VMs.

This patch adds a flag in devstack so jobs can
utilize it to set required tb-cache size.

[1] https://review.opendev.org/c/openstack/nova/+/868419

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Related: blueprint libvirt-tb-cache-size
Change-Id: Ifde737eb5d87dfe860445097d1f2b0ce16b0de05
---
 .zuul.yaml | 18 ++++++------------
 lib/nova   |  6 ++++++
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 06d76d0093..3e6c42e68f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -544,17 +544,15 @@
         # increase in swap performance by reducing the amount of data
         # written to disk. the overall speedup is proportional to the
         # compression ratio and the speed of the swap device.
+        # NOTE: this option is ignored when not using nova with the libvirt
+        # virt driver.
+        NOVA_LIBVIRT_TB_CACHE_SIZE: 128
         ENABLE_ZSWAP: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
             DEFAULT:
               global_physnet_mtu: '{{ external_bridge_mtu }}'
-          $NOVA_CPU_CONF:
-            libvirt:
-              # Use lower TB cache than default(1GiB), only applicable with
-              # libvirt>=8.0.0
-              tb_cache_size: 128
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -659,13 +657,9 @@
           # written to disk. the overall speedup is porportional to the
           # compression ratio and the speed of the swap device.
           ENABLE_ZSWAP: true
-        devstack_local_conf:
-          post-config:
-            $NOVA_CPU_CONF:
-              libvirt:
-                # Use lower TB cache than default(1GiB), only applicable with
-                # libvirt>=8.0.0
-                tb_cache_size: 128
+          # NOTE: this option is ignored when not using nova with the libvirt
+          # virt driver.
+          NOVA_LIBVIRT_TB_CACHE_SIZE: 128
 
 - job:
     name: devstack-ipv6
diff --git a/lib/nova b/lib/nova
index ee3f29eebf..7c6ffb2239 100644
--- a/lib/nova
+++ b/lib/nova
@@ -173,6 +173,9 @@ NOVA_SHUTDOWN_TIMEOUT=${NOVA_SHUTDOWN_TIMEOUT:-0}
 # Whether to use Keystone unified limits instead of legacy quota limits.
 NOVA_USE_UNIFIED_LIMITS=$(trueorfalse False NOVA_USE_UNIFIED_LIMITS)
 
+# TB Cache Size in MiB for qemu guests
+NOVA_LIBVIRT_TB_CACHE_SIZE=${NOVA_LIBVIRT_TB_CACHE_SIZE:-0}
+
 # Functions
 # ---------
 
@@ -1071,6 +1074,9 @@ function start_nova_compute {
     fi
 
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
+        if [ ${NOVA_LIBVIRT_TB_CACHE_SIZE} -gt 0 ]; then
+            iniset $NOVA_CPU_CONF libvirt tb_cache_size ${NOVA_LIBVIRT_TB_CACHE_SIZE}
+        fi
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.

From 3a0c0b9ff4bb3568efc471e1bf98fc273e8bc767 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 24 Jun 2024 11:09:34 +0000
Subject: [PATCH 3179/3333] [Neutron] Add a new Neutron service:
 neutron-ovn-maintenance-worker

This new service is spawned when using Neutron WSGI module. This new
service executes the OVN maintenance task that syncs the Neutron
database and the OVN database.

Depends-On: https://review.opendev.org/c/openstack/neutron/+/922074
Related-Bug: #1912359

Change-Id: I495459cd9e35e2e76ba7fc9611a589e1685814f5
---
 lib/neutron | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index e0b5d5d68c..a8cc953b0e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -369,6 +369,24 @@ function _determine_config_l3 {
     echo "$opts"
 }
 
+function _enable_ovn_maintenance {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        enable_service neutron-ovn-maintenance-worker
+    fi
+}
+
+function _run_ovn_maintenance {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        run_process neutron-ovn-maintenance-worker "$NEUTRON_BIN_DIR/neutron-ovn-maintenance-worker $cfg_file_options"
+    fi
+}
+
+function _stop_ovn_maintenance {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        stop_process neutron-ovn-maintenance-worker
+    fi
+}
+
 # For services and agents that require it, dynamically construct a list of
 # --config-file arguments that are passed to the binary.
 function determine_config_files {
@@ -635,8 +653,10 @@ function start_neutron_service_and_check {
         neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
         enable_service neutron-periodic-workers
+        _enable_ovn_maintenance
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
         run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
+        _run_ovn_maintenance
     else
         run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
         neutron_url=$service_protocol://$Q_HOST:$service_port/
@@ -710,6 +730,7 @@ function stop_other {
         stop_process neutron-rpc-server
         stop_process neutron-periodic-workers
         stop_process neutron-api
+        _stop_ovn_maintenance
     else
         stop_process q-svc
     fi
@@ -827,6 +848,7 @@ function cleanup_neutron {
         stop_process neutron-api
         stop_process neutron-rpc-server
         stop_process neutron-periodic-workers
+        _stop_ovn_maintenance
         remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
         sudo rm -f $(apache_site_config_for neutron-api)
     fi

From eb0ac1d217fe8a545f2e697d09fbb650efecb9ef Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 8 Jul 2024 18:02:25 +0200
Subject: [PATCH 3180/3333] Drop remainders of identity API v2.0 references

keystone has dropped the v2.0 API in queens, time to drop all special
casing for it.

Change-Id: If628c4627f7c8b8c2ee9bca16ea6db693cf8526a
---
 files/openstack-cli-server/openstack |  1 -
 lib/tempest                          | 15 +--------------
 openrc                               | 17 ++---------------
 stackrc                              |  4 ----
 4 files changed, 3 insertions(+), 34 deletions(-)

diff --git a/files/openstack-cli-server/openstack b/files/openstack-cli-server/openstack
index ef05f1b841..47fbfc5e17 100755
--- a/files/openstack-cli-server/openstack
+++ b/files/openstack-cli-server/openstack
@@ -68,7 +68,6 @@ try:
     env = {}
     passenv = ["CINDER_VERSION",
                "OS_AUTH_URL",
-               "OS_IDENTITY_API_VERSION",
                "OS_NO_CACHE",
                "OS_PASSWORD",
                "OS_PROJECT_NAME",
diff --git a/lib/tempest b/lib/tempest
index 6bd203e6f4..7beaf21292 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -18,7 +18,7 @@
 #   - ``PUBLIC_NETWORK_NAME``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
-#   - ``KEYSTONE_SERVICE_URI``, ``KEYSTONE_SERVICE_URI_V3`` from lib/keystone
+#   - ``KEYSTONE_SERVICE_URI_V3`` from lib/keystone
 #
 # Optional Dependencies:
 #
@@ -381,7 +381,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume build_timeout $BUILD_TIMEOUT
 
     # Identity
-    iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_URI/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
     iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION
@@ -392,19 +391,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_project_name $admin_project_name
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
-    if [ "$ENABLE_IDENTITY_V2" == "True" ]; then
-        # Run Identity API v2 tests ONLY if needed
-        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True
-    else
-        # Skip Identity API v2 tests by default
-        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-    fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
-    if [[ "$TEMPEST_AUTH_VERSION" != "v2" ]]; then
-        # we're going to disable v2 admin unless we're using v2 by default.
-        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2_admin False
-    fi
-
     if is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
diff --git a/openrc b/openrc
index e20a5a56b9..5ec7634638 100644
--- a/openrc
+++ b/openrc
@@ -55,27 +55,14 @@ else
     GLANCE_HOST=${GLANCE_HOST:-$HOST_IP}
 fi
 
-# Identity API version
-export OS_IDENTITY_API_VERSION=3
-
-# Authenticating against an OpenStack cloud using Keystone returns a **Token**
-# and **Service Catalog**.  The catalog contains the endpoints for all services
-# the user/project has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the version 3 *identity api*.
-#
-
 # If you don't have a working .stackenv, this is the backup position
 KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
 export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
 
-# Currently, in order to use openstackclient with Identity API v3,
-# we need to set the domain which the user and project belong to.
-if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
-    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
-    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
-fi
+export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
+export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
 
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
diff --git a/stackrc b/stackrc
index b37959712b..0492c73d1f 100644
--- a/stackrc
+++ b/stackrc
@@ -162,10 +162,6 @@ else
     export PS4='+ $(short_source):   '
 fi
 
-# Configure Identity API version
-# TODO(frickler): Drop this when plugins no longer need it
-IDENTITY_API_VERSION=3
-
 # Global option for enforcing scope. If enabled, ENFORCE_SCOPE overrides
 # each services ${SERVICE}_ENFORCE_SCOPE variables
 ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)

From d714f7deaac8d56abe8b028385f5282d6c02d355 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 9 Jul 2024 17:14:54 +0200
Subject: [PATCH 3181/3333] Add devstack-platform-ubuntu-noble to periodic

Seems the platform is stable, let's add it to the periodic-weekly tests
that we run.

Change-Id: I185443c0fdb9e1248542a16fd877dc6b8ffd7683
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3e6c42e68f..af7e74b57b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -725,7 +725,6 @@
     vars:
       configure_swap_size: 4096
 
-
 - job:
     name: devstack-platform-ubuntu-noble
     parent: tempest-full-py3
@@ -1004,3 +1003,4 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-ubuntu-noble

From 696dbdf045cbf1c1525bb25c005ce767d1c9e9b8 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 9 Jul 2024 16:36:37 +0200
Subject: [PATCH 3182/3333] Make nova only use the nova account

Each service should only be using that service's user account within its
configuration, in order to reduce the possible impact of credential
leaks. Start with nova, other services will follow.

Change-Id: I6b3fef5de05d5e0cc032b83a2ed834f1c997a048
---
 lib/neutron | 2 +-
 lib/nova    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a8cc953b0e..da21d46079 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -485,7 +485,7 @@ function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username "$Q_ADMIN_USERNAME"
+    iniset $conf neutron username nova
     iniset $conf neutron password "$SERVICE_PASSWORD"
     iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
diff --git a/lib/nova b/lib/nova
index 7c6ffb2239..35c6893763 100644
--- a/lib/nova
+++ b/lib/nova
@@ -640,7 +640,7 @@ function configure_placement_nova_compute {
     local conf=${1:-$NOVA_CONF}
     iniset $conf placement auth_type "password"
     iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf placement username placement
+    iniset $conf placement username nova
     iniset $conf placement password "$SERVICE_PASSWORD"
     iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf placement project_name "$SERVICE_TENANT_NAME"

From 6df53719180c8d587e058a26ed3bb19562e55745 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 12 Jul 2024 20:08:58 +0100
Subject: [PATCH 3183/3333] bump guest ram to prevent kernel panics

one observation we had in down stream ci is
sometimes the cirros 0.6.2 image appared to
crash when using 128MB of ram.

upstream we have been dealing with semi random
kernel panics  which are losely corralated with
cinder volume usage.

Recently we optimisted the devstack jobs by using zswap
this has reduced memory pressure in the jobs.

This patch increase the ram allocated to a flavor
to see if we can afford that with the current conncurnace
level in an attempt to reduce kernel panics.

Two new parmaters are added to allow jobs or users
to set the desired ram size.
TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}

Change-Id: Ib6a2d5ab61a771d4f85bd2c2412052efadc77ac5
---
 lib/tempest | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7beaf21292..a14ed1af72 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -102,6 +102,9 @@ TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 # it will run tempest with
 TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 
+TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
+TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
+
 # Functions
 # ---------
 
@@ -295,13 +298,15 @@ function configure_tempest {
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack --os-cloud devstack-admin flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
+                ram=${TEMPEST_FLAVOR_RAM}
+                openstack --os-cloud devstack-admin flavor create --id 42 --ram ${ram} --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack --os-cloud devstack-admin flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
+                ram=${TEMPEST_FLAVOR_ALT_RAM}
+                openstack --os-cloud devstack-admin flavor create --id 84 --ram ${ram} --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else

From aaaa03718bdc05df197708f9354e985936f96853 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 19 Jul 2024 08:09:25 +0000
Subject: [PATCH 3184/3333] [Neutron] Do not execute RPC workers if
 "rpc_workers=0"

When the Neutron WSGI module is used, an independent service called
"neutron-rpc-server" is configured and executed. However it will fail
if the number of RPC workers is configured to zero. In that case,
the configuration and execution of this service should be skipped.

If the service is explicitly disabled in the devstack configuration,
it won't be executed neither.

Closes-Bug: #2073572
Change-Id: Idd023a2a8f588152221f20a13ae24fbb7d1618a4
---
 lib/neutron | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a8cc953b0e..474613926b 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -142,6 +142,7 @@ Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
+_Q_RUN_RPC_SERVER=True
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
@@ -464,6 +465,15 @@ function configure_neutron {
     # clouds, therefore running without a dedicated RPC worker
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
+    # The default value of "rpc_workers" is None (not defined). If
+    # "rpc_workers" is explicitly set to 0, the RPC workers process should not
+    # be executed. NOTE: this service is only executed when WSGI is enabled
+    # (NEUTRON_DEPLOY_MOD_WSGI=True) for the Neutron server.
+    local rpc_workers
+    rpc_workers=$(iniget_multiline /etc/neutron/neutron.conf DEFAULT rpc_workers)
+    if ! is_service_enabled neutron-rpc-server || [ "$rpc_workers" -eq "0" ]; then
+        _Q_RUN_RPC_SERVER=False
+    fi
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
@@ -651,10 +661,14 @@ function start_neutron_service_and_check {
         enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/
-        enable_service neutron-rpc-server
+        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+            enable_service neutron-rpc-server
+        fi
         enable_service neutron-periodic-workers
         _enable_ovn_maintenance
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+            run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+        fi
         run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
         _run_ovn_maintenance
     else

From 13888a31d2bac9aa46adf72a154be4aa4fbcd790 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Sat, 20 Jul 2024 15:50:30 +0000
Subject: [PATCH 3185/3333] [Neutron] neutron-rpc-server is not a configurable
 service

The "neutron-rpc-server" is not a configurable service that can be
enabled or disabled. This service is a dependant process of the
"neutron-api-server" service that is spawned when the Neutron API
uses the WSGI module. The execution of this child service will depend
on:
* The Neutron API service when running with the WSGI module. If
  the Neutron API uses the eventlet module, this service won't run
  (the RPC workers will be spawned by the eventlet server).
* The "rpc_workers" configuration variable. If this variable is
  explicitly set to "0", the server must not run.

Closes-Bug: #2073844
Related-Bug: #2073572
Change-Id: Ic019423ca033ded8609d82bb11841b975862ac14
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 474613926b..69bcb86d4d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -471,7 +471,7 @@ function configure_neutron {
     # (NEUTRON_DEPLOY_MOD_WSGI=True) for the Neutron server.
     local rpc_workers
     rpc_workers=$(iniget_multiline /etc/neutron/neutron.conf DEFAULT rpc_workers)
-    if ! is_service_enabled neutron-rpc-server || [ "$rpc_workers" -eq "0" ]; then
+    if [ "$rpc_workers" == "0" ]; then
         _Q_RUN_RPC_SERVER=False
     fi
 

From 0cd876384a77d2144c3ebc51a0228433fdb7facb Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 19 Apr 2024 12:12:16 +0100
Subject: [PATCH 3186/3333] lib/neutron: Migrate neutron to WSGI module path

Change-Id: Ie99ec3bf4198fa7cd7583d2dca648e1474f94aea
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/neutron/+/916407
---
 lib/neutron | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index a8cc953b0e..6336795f2e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -88,6 +88,7 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # enough
 NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 
+NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
 # If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
@@ -466,7 +467,7 @@ function configure_neutron {
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
+        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
     fi
 }
 

From 95697d84cb59dcbc53748ccdb472987cf61df1f4 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 23 Jul 2024 11:36:49 +0100
Subject: [PATCH 3187/3333] docs: Add a minimal Tempest guide

This can be fleshed out more in the future, including with information
about managing plugins, but this is a start.

Change-Id: I1094d093b704e37370e3e434ebf3697954e99da3
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/tempest.rst | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 doc/source/tempest.rst

diff --git a/doc/source/tempest.rst b/doc/source/tempest.rst
new file mode 100644
index 0000000000..65dd5b16b2
--- /dev/null
+++ b/doc/source/tempest.rst
@@ -0,0 +1,25 @@
+=======
+Tempest
+=======
+
+`Tempest`_ is the OpenStack Integration test suite. It is installed by default
+and is used to provide integration testing for many of the OpenStack services.
+Just like DevStack itself, it is possible to extend Tempest with plugins. In
+fact, many Tempest plugin packages also include DevStack plugin to do things
+like pre-create required static resources.
+
+The `Tempest documentation <Tempest>`_ provides a thorough guide to using
+Tempest. However, if you simply wish to run the standard set of Tempest tests
+against an existing deployment, you can do the following:
+
+.. code-block:: shell
+
+    cd /opt/stack/tempest
+    /opt/stack/data/venv/bin/tempest run ...
+
+The above assumes you have installed DevStack in the default location
+(configured via the ``DEST`` configuration variable) and have enabled
+virtualenv-based installation in the standard location (configured via the
+``USE_VENV`` and ``VENV_DEST`` configuration variables, respectively).
+
+.. _Tempest: https://docs.openstack.org/tempest/latest/

From 6990b06cd321930f69907ba42ee744755f8029fe Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Wed, 24 Jul 2024 18:01:51 +0200
Subject: [PATCH 3188/3333] Install simplejson in devstack venv

Workaround to avoid failure due to missing osc dependency
removed in [1]

[1] https://review.opendev.org/c/openstack/python-openstackclient/+/920001

Change-Id: I3f7541e691717186b7c73f10ffabae6fc0c5c9f9
---
 inc/python | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inc/python b/inc/python
index 2339afdd6d..1fd414773f 100644
--- a/inc/python
+++ b/inc/python
@@ -42,6 +42,9 @@ function setup_devstack_virtualenv {
         # available on pypi.
         python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
         pip_install -U pip setuptools
+        #NOTE(rpittau): workaround for simplejson removal in osc
+        #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
+        pip_install -U simplejson
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"

From 8784a3027fc3154aa2f6482d0127e45070e60b5a Mon Sep 17 00:00:00 2001
From: karolinku <kkula@redhat.com>
Date: Wed, 31 Jul 2024 12:34:00 +0200
Subject: [PATCH 3189/3333] Replacing usage of rdo-release rpm

with centos-release-openstack rpms follwing [1].

[1] https://issues.redhat.com/browse/RDO-311

Change-Id: I50951e077e73297d10b075677a440992d1e2fa91
---
 stack.sh | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/stack.sh b/stack.sh
index ab3f01cdbd..dcfd398c01 100755
--- a/stack.sh
+++ b/stack.sh
@@ -302,23 +302,14 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ $DISTRO == "rhel8" ]]; then
+    if [[ $DISTRO == "rhel9" ]]; then
+        rdo_release=${TARGET_BRANCH#*/}
         if [[ "$TARGET_BRANCH" == "master" ]]; then
-            # rdo-release.el8.rpm points to latest RDO release, use that for master
-            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+            # adding delorean-deps repo to provide current master rpms
+            sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
             # For stable/unmaintained branches use corresponding release rpm
-            rdo_release=${TARGET_BRANCH#*/}
-            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
-        fi
-    elif [[ $DISTRO == "rhel9" ]]; then
-        if [[ "$TARGET_BRANCH" == "master" ]]; then
-            # rdo-release.el9.rpm points to latest RDO release, use that for master
-            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el9.rpm
-        else
-            # For stable/unmaintained branches use corresponding release rpm
-            rdo_release=${TARGET_BRANCH#*/}
-            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
+            sudo dnf -y install centos-release-openstack-${rdo_release}
         fi
     fi
     sudo dnf -y update

From 92b65a84cc8135316922a0f8b91420ed221f3269 Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Mon, 5 Aug 2024 11:39:06 +0200
Subject: [PATCH 3190/3333] Handle_tags and branches for unmaintained also

Related-Bug: #2056276
Change-Id: Iaa34624d1d85cadf1b45bec780ef8d97dd054041
---
 roles/setup-devstack-source-dirs/tasks/main.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index 294c29cd29..cb7c6e3af8 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -43,9 +43,9 @@
       base_branch={{ devstack_sources_branch }}
       if git branch -a | grep "$base_branch" > /dev/null ; then
           git checkout $base_branch
-      elif [[ "$base_branch" == stable/* ]]; then
+      elif [[ "$base_branch" == stable/* ]] || [[ "$base_branch" == unmaintained/* ]]; then
           # Look for an eol tag for the stable branch.
-          eol_tag=${base_branch#stable/}-eol
+          eol_tag="${base_branch#*/}-eol"
           if git tag -l |grep $eol_tag >/dev/null; then
               git checkout $eol_tag
               git reset --hard $eol_tag

From 38dea33fe9a5e6bef39566295cc8d05fb1d88223 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 1 Aug 2024 23:41:43 +0000
Subject: [PATCH 3191/3333] oslo.log: Configure log color by $LOG_COLOR

Relatively recently oslo.log 6.1.0 was released and contains change
I7966d4f4977b267f620946de4a5509f53b043652 which added an option to
enable color in logs which defaults to False. This caused a change in
behavior for DevStack such that viewing logs with journalctl no longer
showed different colors for different log levels, which can make
debugging more difficult when developing with DevStack.

This adds olso.log color configuration based on the existing $LOG_COLOR
DevStack variable for log color which defaults to True for interactive
invocations.

Change-Id: If10aada573eb4360e81585d4fb7e5d97f15bc52b
---
 functions | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/functions b/functions
index f81e8f0a08..42d08d7c4a 100644
--- a/functions
+++ b/functions
@@ -694,6 +694,8 @@ function setup_colorized_logging {
     iniset $conf_file DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file DEFAULT logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file DEFAULT logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
+    # Enable or disable color for oslo.log
+    iniset $conf_file DEFAULT log_color $LOG_COLOR
 }
 
 function setup_systemd_logging {
@@ -715,6 +717,9 @@ function setup_systemd_logging {
     iniset $conf_file DEFAULT logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file DEFAULT logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file DEFAULT logging_exception_prefix "ERROR %(name)s %(instance)s"
+
+    # Enable or disable color for oslo.log
+    iniset $conf_file DEFAULT log_color $LOG_COLOR
 }
 
 function setup_standard_logging_identity {

From 79a812a69e4015f6c911aa54989970e35bfc241f Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 31 Jul 2024 14:41:33 +0000
Subject: [PATCH 3192/3333] Move the check of "rpc_workers" after the
 post-config phase

The configuration variable can be checked in the Neutron configuration
during the post-config phase when the configuration files and sections
are merged together.

Closes-Bug: #2075342
Change-Id: Ic42463e2f72488a1b14ce49e4e435cb4a2c0c855
---
 lib/neutron | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 2325188f94..bcef8a5042 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -143,7 +143,6 @@ Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
-_Q_RUN_RPC_SERVER=True
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
@@ -466,15 +465,6 @@ function configure_neutron {
     # clouds, therefore running without a dedicated RPC worker
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
-    # The default value of "rpc_workers" is None (not defined). If
-    # "rpc_workers" is explicitly set to 0, the RPC workers process should not
-    # be executed. NOTE: this service is only executed when WSGI is enabled
-    # (NEUTRON_DEPLOY_MOD_WSGI=True) for the Neutron server.
-    local rpc_workers
-    rpc_workers=$(iniget_multiline /etc/neutron/neutron.conf DEFAULT rpc_workers)
-    if [ "$rpc_workers" == "0" ]; then
-        _Q_RUN_RPC_SERVER=False
-    fi
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
@@ -657,17 +647,24 @@ function start_neutron_service_and_check {
         service_port=$Q_PORT_INT
         service_protocol="http"
     fi
+
     # Start the Neutron service
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        # The default value of "rpc_workers" is None (not defined). If
+        # "rpc_workers" is explicitly set to 0, the RPC workers process
+        # should not be executed.
+        local rpc_workers
+        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+
         enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/
-        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+        if [ "$rpc_workers" != "0" ]; then
             enable_service neutron-rpc-server
         fi
         enable_service neutron-periodic-workers
         _enable_ovn_maintenance
-        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+        if [ "$rpc_workers" != "0" ]; then
             run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
         fi
         run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"

From 84ce1984b1f0639025af599b426019a4b140fcb4 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 31 Jul 2024 19:04:08 +0000
Subject: [PATCH 3193/3333] Add os-test-images support in lib/tempest

This generates the test images in os-test-images and also configures
tempest to know where it is (and if image conversion is enabled in
glance).

Change-Id: Ib74002828a77838ab95d2322e92bdab68caac37c
---
 .zuul.yaml  |  1 +
 lib/tempest | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index af7e74b57b..59a577e522 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -510,6 +510,7 @@
       - opendev.org/openstack/nova
       - opendev.org/openstack/placement
       - opendev.org/openstack/swift
+      - opendev.org/openstack/os-test-images
     timeout: 7200
     vars:
       # based on observation of the integrated gate
diff --git a/lib/tempest b/lib/tempest
index a14ed1af72..24c8271132 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,6 +105,10 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
+OSTESTIMAGES_REPO=${OSTESTIMAGES_REPO:-${GIT_BASE}/openstack/os-test-images.git}
+OSTESTIMAGES_BRANCH=${OSTESTIMAGES_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+OSTESTIMAGES_DIR=${DEST}/os-test-images
+
 # Functions
 # ---------
 
@@ -357,6 +361,19 @@ function configure_tempest {
         fi
     fi
 
+    if is_service_enabled glance; then
+        git_clone $OSTESTIMAGES_REPO $OSTESTIMAGES_DIR $OSTESTIMAGES_BRANCH
+        pushd $OSTESTIMAGES_DIR
+        tox -egenerate
+        popd
+        iniset $TEMPEST_CONFIG image images_manifest_file ${OSTESTIMAGES_DIR}/images/manifest.yaml
+        local image_conversion
+        image_conversion=$(iniget $GLANCE_IMAGE_IMPORT_CONF image_conversion output_format)
+        if [[ "$image_conversion" ]]; then
+            iniset $TEMPEST_CONFIG image-feature-enabled image_conversion True
+        fi
+    fi
+
     iniset $TEMPEST_CONFIG network project_network_cidr $FIXED_RANGE
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}

From 3b0d76c30bf63332f494e8aae18dc2f1feed28dd Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Mon, 12 Aug 2024 17:01:12 +0000
Subject: [PATCH 3194/3333] Fix get_default_host_ip ipv6 address parsing

This is another occurrence of the issue fixed in bug
1786259 with change I30bf655f which occurs when there
are multiple IPv6 gateways present.

Before this change:
$ source openrc
+++++functions-common:get_default_host_ip:776  ip -f inet6 addr show 100
Device "100" does not exist.

This is because the ip route command returns:
default proto ra metric 100 expires 1497sec pref medium
	nexthop via fe80::4e16:fc01:298c:98ed dev ens3 weight 1
	nexthop via fe80::4e16:fc01:2983:88aa dev ens3 weight 1

Related-Bug: #1786259
Change-Id: I7729730df66a4dc7ee11df1d23b19b9c0794b575
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 84d281b21e..e265256ccf 100644
--- a/functions-common
+++ b/functions-common
@@ -771,7 +771,7 @@ function get_default_host_ip {
     if [ -z "$host_ip" -o "$host_ip" == "dhcp" ]; then
         host_ip=""
         # Find the interface used for the default route
-        host_ip_iface=${host_ip_iface:-$(ip -f $af route | awk '/default/ {print $5}' | head -1)}
+        host_ip_iface=${host_ip_iface:-$(ip -f $af route list match default table all | grep via | awk '/default/ {print $5}' | head -1)}
         local host_ips
         host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | sed /temporary/d |awk /$af'/ {split($2,parts,"/");  print parts[1]}')
         local ip

From d6e3d06001e7c4bb092cf9dc77188627bd2b9358 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Thu, 22 Feb 2024 00:11:15 +0530
Subject: [PATCH 3195/3333] Add config options for optimized upload volume

When glance is using cinder as a backend, we can use optimized
path for upload volume to image operation.
The config options image_upload_use_cinder_backend and
image_upload_use_internal_tenant are used to configure optimization
in the upload volume to image workflow where we create a cinder
volume in the internal service project and register the location
in glance.

Recently it was found that the glance location API workflow was
broken[1] for the upload volume case and it wasn't detected because we
are not testing it in our glance cinder job "cinder-for-glance-optimized".

This patch adds the config option to test the optimized path.

Note that the optimized upload functionality is only possible when glance
uses cinder as it's backend since it uses clone volume functionality to
clone the Image-Volume from the source volume.

[1] https://bugs.launchpad.net/glance/+bug/2054575

Change-Id: I521ed04696a5a545b2a2923cf8008bd64add7782
---
 lib/cinder | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index ae898e9522..f80542a35f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -183,6 +183,12 @@ fi
 # Environment variables to configure the image-volume cache
 CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
 
+# Environment variables to configure the optimized volume upload
+CINDER_UPLOAD_OPTIMIZED=${CINDER_UPLOAD_OPTIMIZED:-False}
+
+# Environment variables to configure the internal tenant during optimized volume upload
+CINDER_UPLOAD_INTERNAL_TENANT=${CINDER_UPLOAD_INTERNAL_TENANT:-False}
+
 # For limits, if left unset, it will use cinder defaults of 0 for unlimited
 CINDER_IMG_CACHE_SIZE_GB=${CINDER_IMG_CACHE_SIZE_GB:-}
 CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
@@ -192,6 +198,11 @@ CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
 # enable the cache for all cinder backends.
 CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_ENABLED_BACKENDS}
 
+# Configure which cinder backends will have optimized volume upload, this takes the same
+# form as the CINDER_ENABLED_BACKENDS config option. By default it will
+# enable the cache for all cinder backends.
+CINDER_UPLOAD_OPTIMIZED_BACKENDS=${CINDER_UPLOAD_OPTIMIZED_BACKENDS:-$CINDER_ENABLED_BACKENDS}
+
 # Flag to set the oslo_policy.enforce_scope. This is used to switch
 # the  Volume API policies to start checking the scope of token. by default,
 # this flag is False.
@@ -353,6 +364,14 @@ function configure_cinder {
             iniset $CINDER_CONF DEFAULT default_volume_type ${default_name}
         fi
         configure_cinder_image_volume_cache
+
+        # The upload optimization uses Cinder's clone volume functionality to
+        # clone the Image-Volume from source volume hence can only be
+        # performed when glance is using cinder as it's backend.
+        if [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+            # Configure optimized volume upload
+            configure_cinder_volume_upload
+        fi
     fi
 
     if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
@@ -729,6 +748,18 @@ function configure_cinder_image_volume_cache {
     done
 }
 
+function configure_cinder_volume_upload {
+    # Expect UPLOAD_VOLUME_OPTIMIZED_FOR_BACKENDS to be a list of backends
+    # similar to CINDER_ENABLED_BACKENDS with NAME:TYPE where NAME will
+    # be the backend specific configuration stanza in cinder.conf.
+    local be be_name
+    for be in ${CINDER_UPLOAD_OPTIMIZED_BACKENDS//,/ }; do
+        be_name=${be##*:}
+
+        iniset $CINDER_CONF $be_name image_upload_use_cinder_backend $CINDER_UPLOAD_OPTIMIZED
+        iniset $CINDER_CONF $be_name image_upload_use_internal_tenant $CINDER_UPLOAD_INTERNAL_TENANT
+    done
+}
 
 # Restore xtrace
 $_XTRACE_CINDER

From 80c1605a1df9687c7d1d842b258a3d99ec2eda35 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Wed, 28 Feb 2024 13:08:12 +0530
Subject: [PATCH 3196/3333] Configure cinder service token

Glance is implementing new location APIs, for which, cinder needs
to pass service token to register a location in glance.
This is required in the case when glance is using cinder as a backend
and cinder tries to upload a volume in the optimized path.

We are adding a new option, ``CINDER_USE_SERVICE_TOKEN`` that will
configure the service user section in cinder.conf. By default, it
is set to False.

Change-Id: I0045539f1e31a6d26c4f31935c5ddfaaa7607a48
---
 lib/cinder | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index f80542a35f..0adca4f4ec 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,6 +88,10 @@ CINDER_SERVICE_REPORT_INTERVAL=${CINDER_SERVICE_REPORT_INTERVAL:-120}
 # thin provisioning.
 CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-auto}
 
+# ``CINDER_USE_SERVICE_TOKEN`` is a mode where service token is passed along with
+# user token while communicating to external REST APIs like Glance.
+CINDER_USE_SERVICE_TOKEN=$(trueorfalse True CINDER_USE_SERVICE_TOKEN)
+
 # Default backends
 # The backend format is type:name where type is one of the supported backend
 # types (lvm, nfs, etc) and name is the identifier used in the Cinder
@@ -445,6 +449,10 @@ function configure_cinder {
         iniset $CINDER_CONF oslo_policy enforce_scope false
         iniset $CINDER_CONF oslo_policy enforce_new_defaults false
     fi
+
+    if [ "$CINDER_USE_SERVICE_TOKEN" == "True" ]; then
+        init_cinder_service_user_conf
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
@@ -761,6 +769,12 @@ function configure_cinder_volume_upload {
     done
 }
 
+function init_cinder_service_user_conf {
+    configure_keystone_authtoken_middleware $CINDER_CONF cinder service_user
+    iniset $CINDER_CONF service_user send_service_user_token True
+    iniset $CINDER_CONF service_user auth_strategy keystone
+}
+
 # Restore xtrace
 $_XTRACE_CINDER
 

From 1a336ef4aec1c908b139db3b67e766a437c2cbb9 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 12 Aug 2024 11:34:02 -0700
Subject: [PATCH 3197/3333] Trivial fixes from review of os-test-images

This fixes some trivial things from the review where this support was
added:

https://review.opendev.org/c/openstack/devstack/+/925425

Change-Id: I990a3816f425a1b4c8680ec43d698e32eea2238b
---
 lib/tempest | 6 +-----
 stackrc     | 3 +++
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 24c8271132..310db2daa6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,10 +105,6 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
-OSTESTIMAGES_REPO=${OSTESTIMAGES_REPO:-${GIT_BASE}/openstack/os-test-images.git}
-OSTESTIMAGES_BRANCH=${OSTESTIMAGES_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
-OSTESTIMAGES_DIR=${DEST}/os-test-images
-
 # Functions
 # ---------
 
@@ -369,7 +365,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image images_manifest_file ${OSTESTIMAGES_DIR}/images/manifest.yaml
         local image_conversion
         image_conversion=$(iniget $GLANCE_IMAGE_IMPORT_CONF image_conversion output_format)
-        if [[ "$image_conversion" ]]; then
+        if [[ -n "$image_conversion" ]]; then
             iniset $TEMPEST_CONFIG image-feature-enabled image_conversion True
         fi
     fi
diff --git a/stackrc b/stackrc
index 0492c73d1f..0b3e1c61da 100644
--- a/stackrc
+++ b/stackrc
@@ -304,6 +304,9 @@ TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 TEMPEST_VENV_UPPER_CONSTRAINTS=${TEMPEST_VENV_UPPER_CONSTRAINTS:-master}
 
+OSTESTIMAGES_REPO=${OSTESTIMAGES_REPO:-${GIT_BASE}/openstack/os-test-images.git}
+OSTESTIMAGES_BRANCH=${OSTESTIMAGES_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+OSTESTIMAGES_DIR=${DEST}/os-test-images
 
 ##############
 #

From 9e1348f81b84e3bef93d6998606e09725c585b1a Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 20 Aug 2024 17:23:02 +0900
Subject: [PATCH 3198/3333] etcd: Replace deprecated --debug option

... to resolve the following warning.

[WARNING] Deprecated '--debug' flag is set to true (use
'--log-level=debug' instead

Change-Id: Idb412cea64dfc42e3d1223b77f134804eeb7bd60
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 4f3a7a4349..0d22de8c73 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -51,7 +51,7 @@ function start_etcd3 {
     fi
     cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
     if [ "$ENABLE_DEBUG_LOG_LEVEL" == "True" ]; then
-        cmd+=" --debug"
+        cmd+=" --log-level=debug"
     fi
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"

From 5ed2b7c6b2e2a5da50c3db9cda9e9b8e4ae4402f Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 30 Aug 2024 14:15:40 +0100
Subject: [PATCH 3199/3333] make  devstack-platform-ubuntu-noble voting

devstack-platform-ubuntu-noble was added in
Ie1f8ebc5db75d6913239c529ee923395a764e19c
and has been runnning for a little over 2 months

in that time

https://zuul.openstack.org/builds?job_name=devstack-platform-ubuntu-noble

the job has been pretty stable so its time to make
this voting in advance of it becoming required in the
2025.1 release.

Change-Id: Iffd6ccf9603117d6720931e260afa2da13c26ec4
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 59a577e522..a1c251a398 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -732,7 +732,6 @@
     description: Ubuntu 24.04 LTS (noble) platform test
     nodeset: openstack-single-node-noble
     timeout: 9000
-    voting: false
     vars:
       configure_swap_size: 8192
 
@@ -917,6 +916,7 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
+        - devstack-platform-ubuntu-noble
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
         # - devstack-platform-rocky-blue-onyx

From 0ff627286297a3957143577412884dc50ff8a57a Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 2 Sep 2024 17:29:55 +0530
Subject: [PATCH 3200/3333] Run chown for egg-info only if the directory exists

9-stream jobs failing since [1] merged as these still use
GLOBAL_VENV=False.
egg-info directory is not created in project source
directory when pyproject.toml is used in the project.
pyproject.toml being added across projects[2] to support pip 23.1.

[1] https://review.opendev.org/c/openstack/nova/+/899753
[2] https://review.opendev.org/q/topic:%22pip-23.1-support%22

Change-Id: I53954a37461aee5dd7f487d6bd205caef4408392
---
 inc/python | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 1fd414773f..2083b74dc1 100644
--- a/inc/python
+++ b/inc/python
@@ -474,7 +474,10 @@ function setup_package {
     pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
     if [[ "$flags" == "-e" && "$GLOBAL_VENV" == "False" ]]; then
-        safe_chown -R $STACK_USER $1/*.egg-info
+        # egg-info is not created when project have pyproject.toml
+        if [ -d $1/*.egg-info ]; then
+            safe_chown -R $STACK_USER $1/*.egg-info
+        fi
     fi
 }
 

From d7c3c0accc89e4e99915c24fa7c3bff2e90a715e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 20 Sep 2024 10:56:04 +0100
Subject: [PATCH 3201/3333] lib/cinder: Remove 'volume3' endpoint

This was needed when 'block-storage' pointed to the v2 API. This is no
longer the case (and hasn't been for some time). This is unnecessary
duplication now.

Change-Id: I00cfb56d3e54d0162b1609f4bf58814e9000c103
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/tempest/+/930296
---
 lib/cinder | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 0adca4f4ec..2f9955b1d3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -483,23 +483,11 @@ function create_cinder_accounts {
                 "block-storage" \
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
-
-            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-            get_or_create_endpoint \
-                "volumev3" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
         else
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
-
-            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-            get_or_create_endpoint \
-                "volumev3" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
         fi
 
         configure_cinder_internal_tenant

From 2d487d8c7b424a76eb484d09f09530e24b7207fb Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 20 Sep 2024 11:00:39 +0100
Subject: [PATCH 3202/3333] lib/cinder: Strip project_id from URL

This is optional. There's no need to include it.

Change-Id: I2e745865696dbb317f819ecb74f5b5df88a9ed76
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/cinder | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2f9955b1d3..6da5d4579d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -482,12 +482,12 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3"
         else
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3"
         fi
 
         configure_cinder_internal_tenant

From 9b4439038144f380c1d1c8a8e87ad76cd26b72b5 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 20 Sep 2024 11:03:15 +0100
Subject: [PATCH 3203/3333] lib/cinder: Align endpoint creation code

Do this the same way we do it for Nova, to make for easier review.

Change-Id: I31877705894a21570f130723e0a27ff38f945eea
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/cinder | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 6da5d4579d..dc284920e0 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -476,20 +476,19 @@ function create_cinder_accounts {
 
         create_service_user "cinder" $extra_role
 
-        # block-storage is the official service type
-        get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
-        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-            get_or_create_endpoint \
-                "block-storage" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3"
+        local cinder_api_url
+        if [[ "$CINDER_USE_MOD_WSGI" == "False" ]]; then
+            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT"
         else
-            get_or_create_endpoint \
-                "block-storage" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3"
+            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume"
         fi
 
+        # block-storage is the official service type
+        get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
+        get_or_create_endpoint \
+            "block-storage" \
+            "$REGION_NAME" \
+            "$cinder_api_url/v3"
         configure_cinder_internal_tenant
     fi
 }

From 03bc214525c7d7f9dfb6cb855025b70053839a72 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 25 Sep 2024 12:03:40 -0700
Subject: [PATCH 3204/3333] Update DEVSTACK_SERIES to 2025.1

stable/2024.2 branch has been created now and
current master is for 2025.1.

Change-Id: If5c9de9ddfab1bff313c70cf2c40ce7fbe60473f
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0b3e1c61da..ab1f8a6ffd 100644
--- a/stackrc
+++ b/stackrc
@@ -249,7 +249,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2024.2"
+DEVSTACK_SERIES="2025.1"
 
 ##############
 #

From fec589a1ce6b1dd29e27ed2d5aa088390a7dfa92 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 26 Sep 2024 21:23:17 +0200
Subject: [PATCH 3205/3333] Bump cirros version to 0.6.3

This is the latest cirros release, featuring an updated kernel and some
fixes and added features, let's use it.

[0] https://github.com/cirros-dev/cirros/releases/tag/0.6.3

Change-Id: I2506fa713e0426789fa40a5f4f7fd4e963a158f0
---
 doc/source/guides/nova.rst | 2 +-
 stackrc                    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 705d427e68..6b8aabf8db 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.6.2-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.3-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index 0b3e1c61da..b9f86d1ae6 100644
--- a/stackrc
+++ b/stackrc
@@ -656,7 +656,7 @@ esac
 
 #IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.6.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.3"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -673,11 +673,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://github.com/cirros-dev/cirros/releases/download/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://github.com/cirros-dev/cirros/releases/download/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)
@@ -688,7 +688,7 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             # Use the same as the default for libvirt
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+            IMAGE_URLS+="https://github.com/cirros-dev/cirros/releases/download/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From 6512f0140c9a312f9455bfe420462c64635fd622 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 26 Aug 2024 12:19:06 +0100
Subject: [PATCH 3206/3333] doc: drop sphinxcontrib-nwdiag,
 sphinxcontrib-blockdiag usage

sphinxcontrib-nwdiag does not appear to be maintained anymore [1] and
there have been no releases in nearly 5 years. Statically generate the
images and include them this way. We can revert this change if the
maintainership issue resolves itself.

sphinxcontrib-blockdiag has had activity more recently [2], but it's
still been nearly 3 years. More importantly, we don't actually use it so
there's no reason to keep it around.

[1] https://pypi.org/project/sphinxcontrib-nwdiag/#history
[1] https://pypi.org/project/sphinxcontrib-blockdiag/#history

Change-Id: Ic5244c792acd01f8aec5ff626e53303c1738aa69
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/requirements.txt                          |   4 --
 .../assets/images/neutron-network-1.png       | Bin 0 -> 10251 bytes
 .../assets/images/neutron-network-2.png       | Bin 0 -> 11243 bytes
 .../assets/images/neutron-network-3.png       | Bin 0 -> 13293 bytes
 doc/source/conf.py                            |  12 ++--
 doc/source/guides/neutron.rst                 |  60 ++----------------
 6 files changed, 12 insertions(+), 64 deletions(-)
 create mode 100644 doc/source/assets/images/neutron-network-1.png
 create mode 100644 doc/source/assets/images/neutron-network-2.png
 create mode 100644 doc/source/assets/images/neutron-network-3.png

diff --git a/doc/requirements.txt b/doc/requirements.txt
index ffce3ff74c..7980b93ed7 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -4,8 +4,4 @@ Pygments
 docutils
 sphinx>=2.0.0,!=2.1.0 # BSD
 openstackdocstheme>=2.2.1 # Apache-2.0
-nwdiag
-blockdiag
-sphinxcontrib-blockdiag
-sphinxcontrib-nwdiag
 zuul-sphinx>=0.2.0
diff --git a/doc/source/assets/images/neutron-network-1.png b/doc/source/assets/images/neutron-network-1.png
new file mode 100644
index 0000000000000000000000000000000000000000..7730ca93f175651c1ec860f37ea6be33310e73e1
GIT binary patch
literal 10251
zcmeHtc~Fyi*CmZ8pt5M&;sOMeMn9!N1wk|<hzrmd(6%EYMnqYR5<p}NTSQP)RzX2P
zNFz494H^)TB`i@9FdZREgb)HmWH*E@Y#}81Zo0oerfTN>W~rH}si~LBQw6DK`91e{
z?>YCJ%e|A1wrZ=ltX5D^P_wr?`ip|XckdMx6i=wEf^VX(nAa#M>}a<?didASCxTuF
zKM$8nUlzidkw=wcJiM^Z&VT%_+j=qm!Uqca_3JeRgEd$7e@@kZt!VU<(jQiL6#me!
z$!oEB?PG*qE#0tX%|?USYAy4Mc7@JAx0?7|`?AjL#RTQg6RGsjz6`A(zu;d#_wP=7
zkYFc`Qh4ylV`?h(!+p||8*X@Z5MEIs!ZCDIP2pywL5hN={=bg@2V>x`jL)jns8@T<
z{r_oy9t7huP_xHhH`uc(>iHvqxQrj|+XY_nH>-XkjjG*@+ZgZ8?ybLp&obvuUgMfO
zu*}vu9zc4fAb-w26_K;4ub*GHG+9X~Ph3zn9Jh=fJhl04HDl)m;j1){?GGj5*!A-d
zt!J)0!*`>OZraX$V1_w8dwqO;UTnQVN}W(QpfmK5yLrv#pB+j{-JT4;$uD)fe!{%6
z5T8{?;C>9kjq*lT?jBc-9?YpUVHEAfv48Y*G5$t1?yhXTV|T72T5|E;qnKcp=)QPM
z3ntr^+8l@*xow10h#u4v3`8~IIH;wLhMz+ZDW%5DJbqhE*#594-_3mi{(Q+4f6p^4
zy!V>x&ReB?Sex{mPc>ka72&g<^U!0rjmK|Vmo2=Tj;B%_?ms<Ccw)Hk=r23_b5#t&
zG1?`;9r$hAR2Le1kzZb8vHQQ}pN-Q@HL&lVE#DqiS9a6lB5!5*K!fk0xvqC@`Qv`&
zLvhM})_TM}+`|#?H>p1$rV*->_f9Z^&3ZG|PqeMy?bnOSWmG$H0}z!oa=%xb@2izn
z-mB=Y<;m_nx%eR5LQUpHpEK1W%SQ2K#uM>ur22Uu1z#sU;_i9LmCpjr3qR2LUu&Ek
zo?C1-Hvh=;a@eW=7Oy+r)6g;<)Dsvz9cgji=i&jYck!N!+r)bP`+GJlAIZdY2H`wh
zI%74n+*NztAg4B)+67<bc_-tuqI}Im<6WI1CxjF(qK3%}Y4_uK?5lZRROFLoIB8;*
zG9eCb<X&1u&kx3~HRsVJkNJuLcdxs=IK!gwhwW1hT+%xl<F|+nh~rABxH2cc!UwPN
zwEo}n%`mn7FJzK?2FdBxWu~y37}g*@t26FEc^Lb5eAaR+Z@HCOA0e8lhch+b7DqnN
zkENjB&gEHrubW_9b}iR^p^L-e#JQyJKX&SQ{L`~T#0ztIKCQaMaqVY~lxK~9tY8ey
zbe-^^J;P^3EKj${Bu!0C;&RS-;LEex&e;8Z$g|#yI;h#ow@2351sCzD6$I|oIH#Q4
zgZh?M<+rG_+&3xd3mFlL#xA`)aKSi(H5X<@DJtr!qYWPM+l@4Hcs_oV9mKW0RX|z@
zAuX6Jos^c)qjjf=|G1-NNSoPBn;|(BvND2jT0yvxAe{G+4VT?}>Mm&_%@yg6KIlK@
zm7^>4W9Msmk_nQi5h0x_WSL1CTU%6yB^;?p)@~wcmt}amuxK5`TxVh~o0w}M59Xwo
z__O-;!M)$Z7O7lL_Y69<0qc^^m<~l|pD@fokd~)qQ_CV@$@%l=Bm9X(Vrsz{yAthY
z=C?7v3n80E$T$!OmMB8%@#<V66pxJx&LurQKR+LCu{<+6I(lhe=J}+S0T;OG)15{7
z>21+UY&Va%rQ)(!DkUC*kjos|p{1qe7A9R5IU&R6$9I#Xmd2dwL#MwsmY0`nc$IU)
z<D0(zgTg;WB7CHv%K{{Yq@_YxfL7iKmYJxAEUwWai84r{K1#EULzZyLX-mblFlzBM
zNx+U0$dHzn#Hg^arLn++^*b2>oJvCFxfcbna~>!%LIcgxw6W4n*0Qy=HOWOqE{%mx
z)-TYN5fM`e+U)Npk^%7~O%}sqvApGHFv`vk6EFOZ-}MlA)hlKEoR-a%8Dz<yW#=6Y
z(->)KX(Jex2abK)h*9)(XL=glqw=g#5}Q9)jn69MQv(<4&`bH~B@3v70o3-i0{l#(
zU&H{q0N))Y%;weEv1ZAA3yZX=HMA*-rj5AOFG?7pH6Z&|BK;=AZfFWPV3oh~evnIg
zF%z}Sp-W*CC02S|B$EwKGS6{zLlS2OMXW+6bmY?PShAy|W3Ce{OFuzBw)x+5^-{(^
z`hViP-+N`mz;Y`yaPqnchJ4TebY*Ym31buZ*%;q6ef3q=uh{)t)HkW>2R0t7nB-1R
zPajjsqnAB*OdTXoTv|3_e8VN8b(6gZrbAI%5;rz-Ly@_+HM`4<wB+C9IL5orchRgf
zF@>yhh?|z=gOCIFa6!E97+zm2Nk#^zpXL0~A3?1o9ATLevDl%odek|ijkZG3av+LK
zZu2T<Ngu|HU43=%+>0{<1^D}@)I6vssA4ur!X{0kyxj3whBQ$&O*C0%bZrLdrgiLP
zn=nGMgEX^4#)(XnZKX|bmD!T?K2VJq9g)d0SK6GbjAF!S^4Le@C{K#$bh;=M+3-PF
zH$gQv!+d{d=v$c)`-oX`Qj&22Ypm(hr%%Udh=2>}Lv=gv&uPAI6(4<j`Nx#;^E8uv
z0&;~A61S-6IDamz?A!}O#!vwDym4|mW9XCoMM~J7IQB6}%qjEOImpTk*<AKfLx3YF
z>JS>c<vKQfD8Ot>E2NT_%NY{imAB;VcTnmloA;CX9Xs_azz^h8!ts336|-|a1B<fo
zQyYq-<|Q+Wi;GQZJDhSCOy6X{Nn+1-gE1593mcB%V3}mkww8fuAG0k#!NqGGDjIM9
zX+ddPot$MoWByD+d;qOr9)bHDI0&Ehw5X`8sOS{p!*v{c=(t{--9~tmI(P-xemYaO
z%#=CNb&~yc($~<0Ig`sKk$cWSjzk3p1`-1UXXR@Ld<?;5NWYp$zmmk%0g{-@llqb>
zCN3d$nMp}W7aR*&@!{Gs-n{sRmLy<IG&VL?9<@sJ72v@0)CNZDX$u<_KpAYhCze$4
zt%&66?Q(|Drx9=&kJTg2Dy3F=o%PkBP*}8~NFyO60F@$?zMFeW;RAQqp;rf2oHs6n
zY<cFEZY5e`)1=n}j$FA@y8H&Q{6?m2GrAOW>x|^nlaU=ec6hVKX6rN<MFg%-&3WBc
zukszd#byg>EjLLf@FR(9CHpbX@N$;A$tH!YF?nLhbCqM2AoH`JWFAZ)T@MJDS*EA$
zU^+TEkqJsO9s9B6M%Rw0U{&%2-uJLHw+dB#AF}Mqu*y~-3Rfs<iyrSiu^*uzDhXU8
zh7Gq8%ML1rJ_hx~g=N-AJ_bP#sChEyaEk#jL0gQcEhch&<_$0`Qe+2vxe>kGNMa$z
zS$8zMpYH5zjH-?ro_mU}?|%xV&#mNKdifX-NFv8MQe;$=bjS=N%Pww~<?uu~lWNLK
zgTxCOBSdx6TF4Y6t#CRU$>g^lm>)og&kWKF8{e2qEE9{37+GeRY^gYE&YM)26ufxD
z^!`^BGV}#8U5g<ZzT^23bDfB;G&SYXwT$QSO_vUmnNDsE5u(1SU?Ne}=VN|o%<22g
z=WPC`(#e2<yPU8Av$%MGKW}&@aej7;<s=861=A9UdnrJmiLr6tAv9Vx)fBJgb`XA<
z@i7mV-}J8p8==X>G?_Do726+m&n5kp<PC~J_Xr?HL?GWyvs@EoZ$u(d2EY^9cw>B;
zdu9z<&Cs4@#yRj<zHi==MH6`H3|$U<R#sM$z{M@FqnRV3u)CK?O8!+ua!X=l!dn&g
zo|wVIYn}dVOek~v`Gk0=x#F+BjLN5)F@?~b_3Nd2RcHFqe$C#GNh6#;Z8n+VbtK&r
zgNUm%Vz`qB7*Q@WqCLWcmX?-VlUvFmt_64-l|0?%iS0QA-*8~Peq@^&hT9+b=+hN5
zBQA>fgwuOzdC&5RGNWSW;*LS;bexMHT3QHc$%JHU0@wuL>aH#s7`D=(mHM69)E}lu
zkD-3GU+S<7jYM`!6;hqc^C<k(N&+kKda4nl+Z}xoi_M4UW);xq5C0@j@WR4EG75m7
z6L>K46SHokery5S+y8)~874}bQUFPlYCwnj+ac+|w@W>iJFb|8?GKNLnRb@c{5G(=
znXH3Akktmrxw$Ab3KexdA|hh%mP9Y^$X-MHnHr(3PQ;3k?J47FCQqK^7T~!-xOQGY
ziqrE`N&&u|nSMd%(LpF3@#eEYtD^&_A9>bjC+*B}Ec9-CW7#;w0c?gs=&yStRa|LL
zlliHPd%|+$>?(;`u0T(DTWv|4@LU!}M75KZ!?@FK>7F%RcQ2RM$F8o^jrQQx-}fS&
zv<Jl8BOG7i^i$Eh=7!|FV4RUgr7-lL5pzob_AUV=?MR~!0c;Ne!dt@nAp<yMi?a)+
zEawb7pGx67sk#6eiUJQ>Ii(ti?vWSo$@V1hm{SvkWr2VuSOhd`MA<qN`lF$R|7csL
zrf*=M`fKB<#}YwSQJK+S>@VIbOS%)T?b~DT0ZS?~Vi0NQfa*JA#VgJ&ZDwnhIuDEx
z8*~$oX8`Ez6d9$EXvNb!53%?FYPMu`-)2R6-e@~BSHg`VmhqjmHY=V!gMGD$^4e7U
zyF*ArPzY$ur5s4x>f_($RcCs=52==DqwP}%B?~-R3ocPs!1Z(aVIrA@JaB-kr9Eom
zo}p%YTiy1KdZE2fu0}Pn<8iTL3e9(UEHErejtsa&5`wGIqXClTSX=(uNdI;N`?te1
ze*Y-DzfG^oQe&!U8jzfFrg)6fOe+y6_dT%=_*iL^_D+iNQyRR%NU2g~%tK^4f^ZqN
zTVxGYh|tLS!vP<+J*b{X-3jS+(u)5$oU<=@kF?$wJ+<^fuU~yhxUcbupK@uq)K>YX
zO0?3yj{gfWxC=-&n`dz=#5t=#aKvu~n@??9<9YWzB5XzI0%*LC*{^?SH^bb~qC?+g
zpStLI*h#Pd0pB~N<n7LfQ=6k>Z7CG~w%Cu*h{6X{dQ>O<R|Dc_xx^xg6#(b20}cXN
ztK_NbuN5bqHnrC^jrQ;!4@a&A8m`!R-_s>spDEmBpSmkH#lXIOp7CO8r>a41YSv-h
zJMr=H3s9ZU30%3VK%}2zA=saG>*)R%?XiPOF^xfLnp~(`ET!<ZK;P-d28TkqVxl5G
zsv{37(v68;RtnzU-UwJXP}>j3UhcYo>5-?4ihh?eJ>M{8JR$z1_8pK3CIF>bCk)Gh
zI5=jQJ`niSR_vM3i1UYIaCU+iq&77Cbh+{>VGlt22EC{3YxCp-TZ|rOvsh1~5qOmX
z?}^2F0<-K1pA`?h{N65fu&8KPanUYrWh=mqxmWVkKU58n0R-;G$W7%@!#k7oQmna^
zW6gL=JSl@5*Jl*!uc*3KtbKc(xeA=;da9yswN-TNp`Tf^IknV;Y{Nz^5m|9looh#&
z#o*5ek*gaMO88V}t8`*!L6A&nKy#>GWAoxm0~6~^9_qi9Z9=Yoc@a0a!2kM6^s;qL
z8PBUnz*L^kww@VX`=I;Sa|+j@hEcMn2kr2DYE@;-&ZwygAh}a_1&2;hToe-p&UL<=
zKw)IIZOw(bplAsYe7-+da^G*pvMLhczv+YCcX~Ge-6OhE#_}XxjIma<j<r^_hZOrs
zcUAIz>$lshf-=@Io`3w_?l%mpg3r?pbG_&%e{cO*-vQlpT&jVM>Vz_#`-L7%yRBIy
z?>JsKus-kGtzuAX4&<)|Y6CR4GC5*~juySqh?-(H$Rv|8Awn{0i<W@uOa@g#HqKz+
zacm;D5<c!^XLBhusLS~!BnclKF)9dEBdFx5>3;?>1nMIg=xbgoo|KgW@txYh2c>V<
zt);3+SD#}9<FX0}kjL<KnNh~ylF6i#KX<@B^%+Pa92<7tg&m|1fAZ(&MWTFpL!(i@
zE@bbAFLAshxg&6yR!d9E2%tNN+7HlZZv@>@_8k1JSLpRhslA)Nb^ea;zN49iWEP{6
z<SY>J>YUp3^MJ6|S!T!BLGCIZGcE=T)0>yjqAxKT(&;>lua)K*4&td-z(4XnG{@0I
z-a3JH5<(`sqz~<bvWora`(azFA+bU!HD~j@w_16NT%J1?j$pBgU=A(q7%ML-`m>S%
zS<Py-p7=vHyW36lCyg|k7^)+Qe`Fkc66$8cduGImjFNa9%*jm#J&ull9_IqqgDKJ=
z+9QLi`L?u<`UDDyN^t|`+i>jVK@<w*3e^I)rtr%s{0psH7Azm4=T4*NWT;v5o+kfw
zH{GGuSgk`73_0gOr!0>Pm|C84^XHtYt?nVH@yhvd?6Fg^)1eWWaN`l;{>&3zN3@}&
zDp%An8<sjsq-gLyOD>zH=*K!g(1zBE?y(O#EHEpK%Z-YcHb2{*@)s73rAqB<Nc$+M
z2AOg4=J-q+eGu056uoB$zwz<B^2qpH`HU?ha&|#}KlcNpUe$WmEJW$)Iop>M^ZCQ(
zuHaCeT5lIzK(g^Yq5^1xMQ8f}146$yXW9a$;6bICyeg4-A9w&qkgb<L63*{06lA>S
zL%$5Yx~2^a@r;#aHPZ#q_BpbXUZJMHww!LxDAQaspiAzawgihnOaAO@+r!*chMLE8
zd`T-6>6AH#AUvs_2`FtIo8tS^AG!}A0pYv__Z#$}YpUk!Y&Grrk_2gOaWs;<+N9>K
z%{Etb!?s>%`N5%}x3gtIrlsI_4}@HAXi)l*uE`&4LNm6_7)P4;mnfyi1^&aSEsomz
zT4!89?^2jbQChFC?Y}&<n^yb1@ej)CH~w*}b20J9`Ip?j4v+BVs{M}R(;+&D`A4K@
zrAHbu_e+)*F>h)nZj@{#u?Ko)BYT4*y1czoN{=|N{8qI2GtT==mD-ocgz_3fh=jWE
zDrd?(^YGgh)T{JqOvbjVnArk{EU%l$<BF=`!>Fgh>>oR`AAdKq3Ggz7uYPxoYW(=s
zo5n4^hm?Atc@^Nif}L0Ts$2|cU6-GojPX_Z7Bt{CXX&@EEi%H5n;advJ;h%+M9sjz
zdO2BLVV$Dt|Jos<(5%OY|5(`D7nvlg>{(!53h%)ss7;;K=}G%TA>sj9^|gd6S{tC5
zZPnz3%1-7=7l(P5lY1jhj0-3CNrOJ!OS}&5w3s$|SzJ{W<ZOz)*<v7|8uyNARex2L
zP<Je4zYW4}@>|`?PoTw5UOQCaN0o3VYw_I4i-j_C^;1~|7<Lc`IwGLO)WBNp<rl4b
zRccPlT&Hnvvi-JoT=NK{jnvvCQt!azSL1=Y33kJ-TYj1?6@1jfBt~z0u;l6b>RK~Q
znpk}}X5~!L@9%1<--K=<%i?qCb@(Ul1&akdS<q$P(CMW;zETl~X1;gvRskMbv1ouI
z!ZL?Yhps6(iCSFG$56VfGJJkA@ilg8))gBL@P@=x{FCBz+o~!VwdKN`X;)uvc0*iO
zs6rfgd6>A4w_ue@nc+lVd4z<jOGUD%oR^m-c^!)uR>5K+W$TXlmtFI`*{)h2ro6w%
zo|FjCJzw(_#6#W<^BsfXB(Vnlidhz@?n3?8gRvh088vOP4eYyeaeW<a-YIbtMb7$h
zQL$ID3SJygjJtAoV3@~jYeRuA^QSN($J0f}CUk#sL~n`kB2aWwUfiDM_-$Ws<)A3R
zJ(*|v;h}`nJ?+^+B|7%eN?*RTjtE(xw4b5<cVJlHxfsW?$pb2b1EzIU#Zd1LBf<f&
z(!sw1d^Tc~MY#=5MTCsF3?8bAcs~brd}UjZ(t*(8j;p_5JE{R#U{=7hN^hXw=!;Pf
z5PL`y8-uuf)I4>7_Tu`)J}IGc#26jNjSzr|Da|a2oHNf>E_H5LsFJ0uWxAn-uSyK%
zew8Gi!1a>2j#7;UyuMLBa`Cnzr7RM~n<qwD<g6v(kinL1IA%SuS5Wh9I^=G^KA=Xq
z5j9a(uOR;VcO-e@KGG-h*H3E;LubW$wbG~Gl?V=-?9b@wA6%~0#e}iftg53QczHu}
zQmC}ts?xWC>3TkWvZDanxm+@tL<EnT2}U{SEb3V!NAP*%t~C?lF%)2_lWq)Z67bk>
z`p*w2$51uiQfHO4I2kQnB*_VuK_TrEjX#qCjet!9ZI*W8@pvGhLkAC1<!C(}TDJ+l
z0mD-wZK0BM$CsF-7iwH?Ody4Nagktb5S1giR?#qq*IwA)mL1i5NJ-Q&lxd@ak!kqu
z*G&dzryC%&2nZW2;-aDpXR!OhK8JY#OpMeRTD8m4FE5uy^OL0@EE-Xpy>7w82y9D`
zegNHbOjjYOZA9X6;LCl8<Q7=R83{3^wfVMUpM-^+*nT_&*Iq}DOuX@^tC}s*uFUwo
zq`N@Vh8={<1}=JM9Q$z)L>pY#adkg%YCbfFR7zat<<7~ejkaA6$jfx{vYb%FUZ$y#
z#Y`cUw)6E>Fxueha=F_F2Jlkxx4KV`@9Wok7%8xE;@Q15-$wj9nBVU21?AZ-UH+}e
z?at^O4p_tBK>iy<`x~`QJYD`G{xR)^-)7xM8tCPzNkrJzd3q`G;D=RW;Z|^U|ATc<
z=^gWr0#gkvKkOcRm!yKZApF|RUb%n%adG<D$;(f&b!k>o4EF|Ru<r_D#J@=_MV#tY
zF57i~n_re8jMXX#*#vF1jpMGdy>e$eYW5?ywB=6xgOEnwr%;TZF6EIwb&3zzwKP1l
zsx0>8VkG1Ki>5kW`Pq|O-(KldsokIB$n-Afq{a0mMZOA3=^vTsxt<at{4!Uc_~W1y
zak@JQ$D&=lx_%)hR{3=L5D;j;rVmde;Oq~zO!48>2J~ihk$^_hPx5+D>Z%_*oLA+J
zz`Z<AP22jThEgiVg2JJVWug4*Ev#l{9&pB(KkL;b$xihPgtFe;(7-}_h1UcX1BIji
z?5IAe@H)D-RqgX-M6F;h*N@8jL}{*JyijxV4)?vZO4a{2bH7JgH%|NeQU{u_1CwD-
zvKvY)dULt^Vw4V?bY9v2H?=MN@PwOC9!c(D1Gf>i3{35AhJ404JPdK6CUDfdvX75Z
zOq+4ZrkZv)Z3ltgcn(=&^EPX}@A?k2bu?K)xavtxXYJ0Qme89Lutvf&GJCPnTNNLl
zzwvH#_;T9TTVcJ6&XH}|2{+h4CpRXpp`TeRj^C?YmD)QKukgQJCI5#aRQwVopO4O(
z``1(W>cQL6(X*=*>h4kax?$f}%RQt$sxWp1W%XN>i=yi5wpr8n&hE%(Cs!LN96HSo
zT4!^GWkz6`2~rL4Xubz^;lT#GFDEUdzW&#ekQGU`Uv1!@@}Eh<a0k8UBM<+XB)snD
zHl||W@Bg1k!nO<RVF7|k)7>Rca&jUc|J6^zWCXwictAh)BEsOcarJw;`+-A;!~x)&
z118AFSm3_HREEMm@7e359DaMnmrp<c6G`YbNlI2!)i(HVNJ3;Rk8G`2YKp}^f)8Li
zD2A=&E%iH66vj_*D~}<XpOY<hk7|D(t#mP?yAosJ$gmgJ+F8wd_1=f;92!wAF{%TQ
zGF_Q3cItkZx%w4pce9v~TNuJCC%cccbrvv{0t{^)r}GVyrV)_;UEiI^3+p3t2o9`S
zeG@_O$?}$WYuD>d6s7nudnij{%~HYjO7sY|#qao3!R7&i*KKD4D@kYk==eno?TgNo
z`xqlH_DcMrtBsc}(B49cbJI-0Xfvuo(%hSQSh435w*0N&B%y7i-=W6Zf4kxwDGd%J
z-cVHaw+&G}>0=(+@gY!n!}r|R#6<ms1;+Z_uhYAJ8TPt)$syzA5Q~d6-dM+Pn3%s@
z)k5{1uaR75l(0=>l<roy{xXa~)Z&kaWVE!Pg4v!}(+{<KWB!MHAc&fj8B?2({I}99
zJq`aAQ5D+Nx6V!>*o*J0ul(x6E{OFn*#&qu&1$x?=bn5!<YKcS4aBDM_dhShD5-bn
zAvvfs`mwt(tO63h-OTE-=b30F_09+s8fUbzMeZel-rOM@R7NkpL5rmeG#QgLn~#vp
z3P+e|YF%9fOmhlh#!BE06S%8(dms7)R=lQ7&Il3agx(+ky<s9K)d2VhE>zdAyFZvW
z9uI|~_dh2w)xU~FdTUJ=`xjD1L@=jng1H0Oll6~5gMmDN2@lK}+RX?Wo+N;ZIIn-W
zW)$GJ{xxr0Iv}602!XKPU9UO!q8Y>50O_rtLic{qBl8}$s;W8P9aqv?_Iyj?ak(;+
z&oF#I_Q|J#aBG<Vg3WSyV-33;x+eAZQuMXQRxqLk2idBm=;}i-aM1Q-EEZcya0UAC
zU6m^Cpq(9qkqt=aC_|D|Zt%mH3`S_VbLH>D9v=gQ;T?tI?zpXaXQ%@_*vyU~$u<zu
zJMVYM$0=d;y3SZE{67eoQCB;6K3wpwR(W0OlT|P_9I!A1k43|b7KV^s@YXQVvr!SC
znA*xvhfiKeF2GaWk-Bbw8$cMtG>&Eq^mqd60GauU%{HMw(EpxQLmv_$*UQjKkPlBt
z*1d<zpBj&mABuMjfH6f>$@}U4CD5M6e5&!%iW_C91U$*VEegFGQPBTecK<B}4C%FF
z2cn7E-KEU&5ybSk!VR8DRcrosf+ap>aD9gvrjx0CgdH@d`97|1*!DMW^;Ji%Ni-W8
z5>W7R@7=DjcY$-co%Xa__Co1yS5IMA+@1=;)=TbzS6e0sM<>_h^&F@l=s+=)d%IjU
z?Y?}hKX<Tq@x~4NN6Mu&gVa|_+2i8&Z`OLzAx*)Ww5cA$$F(<_Qt?%D(=kgcRSc#m
zGd=TD>bvf8wV$o1D^_2kXU2_qxG3D!wENfbe>w(>vhNoEbZlT2HGNiqANymDM=3TJ
GZ~Z%CB(@^}

literal 0
HcmV?d00001

diff --git a/doc/source/assets/images/neutron-network-2.png b/doc/source/assets/images/neutron-network-2.png
new file mode 100644
index 0000000000000000000000000000000000000000..919935119de1655ca6c7ffb4e943a5f517b57fb0
GIT binary patch
literal 11243
zcmeHtc~F!2wrx-poWOx2QHF?ggGXrwMNq^<u>rj;&^C>LGD!eY2q+R}NLo--z}T&V
z5+SYh0XraJkN^P^XohIh2sA=~7$TDlfiNZkLXx**pZls_)vLO7UcEowyLD2b%KH4i
z{HDFvUTf{|?zhg4TQ=_Ah(I8=oH_mVcL>B9KlnSVz8<c4uiKr2KpZGL^YzK^W1da(
z+QYx_^#3S{F-r<CdKlm)SzHYM#dF%9gr365iMKQvr+1p~4*ud4ah->a`kygdRQ^0M
ze*&YiM(n@Lt|#2;xw&pbd2aHSoYzGBe6t$&Ld?49;2=iLy#Ncs<*%1IwjJ*4`y#E#
zA06})Mf1e>+62|)=HQmBnYx5s{q!xn5Qw);sc01hvA}_-g80Iy9)Z}t1Lk^ngE@lO
zq>4nG@L#hTvByGXJ>tO=#9GAZv;V&Bzt4t5Z?y~7U(rPzN%-%xrhhF?O<v=4^jE&{
z<EL!Ru1Pw}rN?FlPKUiyC$fKu8Q(!njdBaEnC2bZpYm-utN2Q`ZOVfUhY(h~REE#=
zrx#b=eRV7$m!sfWIx**LPOhI#*<hag2wfYs%iB6ZXu?%572@qSf84O$&vutV$|r;0
z1osx+OfpPsmaZN$SU)?WZmwUKsw-kRV|LSb`R5y{<Z5ugo&93UH6c)E%$0-hv~&vP
zT1C+oHf^ilv8O)fy*RLcZa<D2<mT4aBf$4rIt@5JId_G~ZrA!kZQ4nSpAJdD^(Xu?
z;?_?WrERY_G^{^zT3S^c;!Z~$zw!!MKe)qB_fdhC57)}BXm<PzvC*jh2vS;`d*Dm1
z2SOJe^34(TApyIe-ZpRR+l|kO7BsHzU3bk-6&df6km$pudwOQ3W#CL!)OYwJ)J_mf
zIZYf<F}KAoMP-UL^xOpzV_n#NwZooc)AA(HvnR#Hed>Ta@p$00di*f;cwKr@U7wru
z&S9sA7oTXBuvC$nLC31}57Jle#Ae;7B4IydP45%jG&!_?eF^I9$)7%;g`*WNV-YAi
zD|f414leXlb{}KS$CJBM44)=$rcM9&f{w!+`U&6tvgZ?fk;b~Z`x=G$F1O7~MVyQ<
zyqid{9F7Y1*1lxj+=q5L$vne)8j=}^L;2Zl-lNC;w&aFX-#2{N$>ry|nUyv#>GXls
zgX<q;9`>8vIiU3@_26#053SX<U4X>$T((^-(kzL0sPFwX5hdGbkPu`ka5B6|?#kez
z;)7j(gagUz9FM5D;D-0s<~bB!;<xL3v@l=O@-WIfG?bYnO$^)k=u~=Ev%f_cH!3^O
zGjnX2K?(}_4H4x?Ed8cOOON<AAmUHV%RMO_Vl$q^1-6rjz+Q%PfMBsx7o5`F6*pz4
z-p5~U<F9@wbf*n$GI(v#!U<{cPsd5r-=?CSh>mB7r6IzP@l)_=gn5^lWCePf-h1JJ
zH|Rmi*7WM7&GtR+2*;UI+DRF|Ol57g6X(n%jImf%RWXEvPoKRDDj)8?diaA^I-j74
zTJciRH&khHuE6PJ=ij9y%)fOB!(4r^xH8i)BO91WjJC<iRX(wtfc7!XYV5x1)`R!9
zblNe!VSUNP{5^el>9|VN8Khh|BNzHc8i-jzYAbgdPIafw&{lt^t@4NGmb&BWOgRF4
zsSj-d%_!bTYtvJxRAJVn=kzkKM5on~k=O;^Op=7PI;crl>M}^dd`Li@j3Uq#GQvbw
z(uAUQp;qYAV}Gs))~IcNZY-85WLa}By4*1%^0xX-eUI{q&84-LdAYeAMrouz><o@v
zRxX$jGdI+nWoBxMuBxrI-C&S_mk!(ak-h(RhOo*etX|gE)^0E8nka|E3eGknS<oTZ
z?%%&}n%X#6n3tEA2ETJuSHl>t!f%T#f;7#Ey!qAesk4=Zab7geXhgNHb3xa`w6rv{
zS{TY0y*%>JjIcV##)#%eTQ%F?y+c1aYc$gqRGue_J3gLEE}7PUTDjVVk#!NO)3$Ch
z2*5~gU?lTqig`0Ww|kBtzDy8L(d3h~+?mNGmN<kZCgeVQR(s_5aaoM5zVG*Lhr_dt
zd`)%^Lku0vaVAL#UC80MBf9Tk);?&0e05kd5I>WriC+4MNgCYbyTq382@17>f&z-J
zo?ac5deuj(d4I~DCPY+|I<lsx1u1y3?>wx}F|Tv<?c29$jN%144x2kxSY|So*BN|}
z+;%^!b+n{dK*e!82p>?gPLzzi^*7GUA%BQb4ofalAnk&ga~a`YDO=?ei7173(x5gI
zg$-3+dp0w)#9Aq2tq>ju9-XNq?Q4zjbn71KvL-N|UOlHJ$iFgg(whBZU#4;>eUdLa
zUOd&jFxHMqlCLh4oSmJ0(jD?z(Y5~R6<_T`M14anJtTW*BXND;=Jr)~el_4_%GQ2}
z{{}yEoeYO8_-L2+O~sUYq@OSB{@Hh{J~mWpe3u!{X0x>|T5Q@E@R@;%NNsleLPA~P
zux4uG+iORjX{=B7R2+n3wrI(xQv2Y_efDq}N;bJB2Ikc6?Be1ZWq6sQi$YQGD)ioG
zH($#)`9+^SS>`HB`p&7ViBX&eDe+ZSYhGVylx2>y3q;gJz`>)_^skX-JJa$YxQYaf
zsl6t2oDQUTl8i%;NrYIfzo$HqeF~R<VnJ}5-t+g&94*^-Z<Mn7ma=+Tf?wq?W$>3U
zj9bE1Ds`tMah1RFioX&KN9B;$S!nvw=NWup1+6dk_29TIjAAS%=b~G88L3PexN|WH
z*CQh%J729OpLaX_Rcl0_nn&d(<~ehs-ZsA}ugaY!k>|cG;s^l8wq&-B2E&ehT3C)j
zQ&4SV3wfgvv9G;M3q^6>km!qMiB&RXgtC&d?rbm!U`cCO(mGS-PMC^Xa>HvXH8yul
z5T3L^R!n-66kL{!tGMWy2?3-HcdSoth%`t3A)H%M#6vv^Tb%8lo11IB+@4!E?oj6Q
zIIwyue_MG`{LSey6ONmkQ_Z=u2{?hxa3*eU<w+aM344VZV>ea(995BjPYLra>7e66
zvyEs18=8RO_3C{0)r#GbC#@hEyB&z4ZRbt1S_c!*nC!M7V~k<}qre14C!_>ma>Uc&
z1Sw(SW`G59bH1aaV;20;U~;cbS_8TCL2bgEwt`!ETwci(y_$(4iJxtO;OOk^EL83!
ziLI#Q#W6gsb7GR>;#SUBuMy9WkB_@~W-he7`qDqWkV-ud_``5KX3EG4gygYp_r<7<
zw7kzltnD>WaX2W83}78gl6)6wasEBtyO<+*!9~7?Ioo$x+DrER-jIMsLDW19>z^M9
z@s;*RmszKrMVS(2)d;f~Hj*3Gsdy1@`EeN%v@gaMJ@Z>2kOeegyV1k9<urm!py1(1
zidW%@f*Rh9{id+2gd@5>5XB1*A3iJ}9v&`_KO$%GV&1jLm$Z$Ijm>h8$BW-iOiUQ-
zsEAjN>MhuY!y=H_u8fFR4Ez;*`t^8)nV~P@u1AW?L4y=J*Rw9ef)43%CEKWdq1Unv
zzyPKms~r^U&5=<?<LZhbdVV1vBm*$7q_LLL_yBwDcIt{1M*DIqVJTISfAJ4~6Os&t
zN@nviY-BvJQudp@XJ#uPKwqd8gue)o@3KO)yu7S^N?p;0XDf2}fZ?J|%V{q>B+_Rh
zL)Uhg_H`FF4K9SYxJR$LD3@`a^@Pdo3i)v?R?qHb4NWSd7^I-9vZpJ2hBocdGxW2)
zlOZq-E!q|@`}3<0?b3BiGRu)rD;?PGE_a$w9f#%R<HNLmde)hNGjV7gjp(51abucB
z<FGon(_r^LkMULsNj681#&%}tzJd}77_&4qG*q{+u%PM7Ojy1J|1fhldN|fKvAD?P
z%f$q_l%<do+&K8D+?R~Dh1!Xo3++mXotwLk@<s87mQc?q6vEv6{QPpL)v<|!OEox~
zvaNRXIlmv4A^aoRgypHea#AjaAfJPCV#~&mo7XP@P$ov=NqcZoyf@iQW|=p;=5)I{
zQu76CLSpF8`~Kp1{;(YoH^@gi?$kN0LPoLFeh4oqm3<%N!@)D>p53;$#_w9NrPVA2
zQ>l}jgu2Q6X`e+yM+l0`jf2;|(`sfE0}Jw!u!Vcg`L+@&HAsdIGDykiJ7dj}i(T1f
zR*v~$*H?QL<dImWkIBwF@_jz3A5Lp&WMrf{#+HfHNbQ2u_fF{6>AKhViNfWtMf|zL
z&-P`=-j5>v@4cT{^4838@{R(Ja_UOS7!HWdwU*fw0ULQKu(`dpY}#I+oD5Vf6b7on
z!?~E%GM%H@%}7C5dy#xwih=YxvKz=wxk)P^GiEX>OOqE=kk;Tg8@DLXyU!XI+v)h+
zSbYm9<4IWU>gv)4@HZooNM?{00r4oBNh`XXklidoNKX+<UC@=wm(`zN;aa6xhzDom
z`hoM~^N!O{-A8ma%xbp%LcNmR+uTM4kW<`g0xak;W6n^R1^e#Vr<YDh+9s`tZ48ln
zV!d~eXJ+DTgBpM4K8kTm*4p5A&5TWPE->byg8^0mA%b+~+`?Tf)|3!bky0W45k9TO
z-OWv8co}ESsF>34Ub<T9p$q8S3E8yr?SXs#z&tJ|H~87?&M+kbCxP%OggUni;vkG)
zgtsmeuUtv!r{ikAI-o3{Hc+ZyPm+d=lZG&h>=}ob!s#XM7=b$sISD8I^nz+HVNH5+
zhrP!R>>p(&7e%C@1NUB_PG&2K!3E%TVJoFTg2XP#?{W8RXw<9yuhayTQ*)x5qOhiy
zn!j+^W-uq@W>fa?+&S?TqD)qNUtv1NZ|0mL6e6nDskA%~ZY;oeMs`KxDs${n<^avv
zqGRI{($7<T<Msu&%8W)RaDfWl46e=tI>q!)hIq*{GjN8bkYj|COEYoud_5J7WZb?Z
zN4PqSD3|MxB&7XQD9_&T;gV`p&!^%U4(>!;*Bp!wD6y;^jbD`>At1yQ#PA;PQj*8i
zO``zMoz^sgyz?RNjca+`X&E)9TDTPG`A$2nImVsMqAjTTu{M}%^q+qd;O^a}^TYhp
zD-3Q*t9Wj~)|bW+T!njP;2w<U+Ln_wd+pGbkDGg>m!mz6@opobQ^OT$!+gQ=+7e1S
zu|Y3V`crc%S`(o`*4glH<K+KSC&?q2Yh}B5W;W*5*6dWYT38SLm2VSb`vLtG)tJ?O
zdg8e2$K3`gMT##?QXT|)ej=}XKtv=P7wf3R>-pGi_LHb0ZLbSNjC2btgA}8bjv&vT
zg#Jq>LDJnpV6%$MY!OgVo{Yujj4khP@n9pR74Z$Hk@aEf=20#Ev_^9vi>+nP+}-{L
zB`wgCe$N6><S;Mt3xwn>vGhQLdhewwrDC((?F4LB7mzh+|H0KN<|E7c<2(GOzUI;$
z>NT2Lv&=BSCCniE{nMQkf6{ReWijW_2+3*Co5BxjAC)4}q_qr)KH%o>WnLq(`q=ay
z;^#?T4xNujzI*qM>5)0=590v24D{yMbLpix>&pfzRW4EWLE1MD`=w$JKD8yc1+ig4
zRUnr0ulQ@XGf9YJd+U35h16>_LQORT?sc_-I>~q^?KI<Kh`eonvrVtg7hVOi?9?@a
z<9^b~^F_eczz$x?F55(_)mh%|i#TRf|M6}}woz!P&h|2sLo)Re?3&HvoP-T##IKe6
zd$BWcW!oMVmG#kDb}^APjg>gTWt9_lN#kqk*lv#z@qaik*=~^CapTe{yXqLN{7OE3
zc_mbEbVsFcboX`19p!;8Bxe~9Qui=~GuF+WpSV_(YpYglo;(JTYpT-nu*<Q-)PFp`
z;!@3OEkbvv>w{Shdh$13D%W%z>SMMSU#NM^Gq;cFW)ze2|7Pu5xxDYK0BweFA#XF!
zP2m;`;<8B9(*i`j`oCnL1~V`?uI7U~|MXcs)t^^4*Qi``Q7+jarHz$+TlMq_qKcFH
z^JyRb6)!}ts>*s7uk_L_28)K5aG8M+e(ZbT=IUdt7i2rJUbnVR3jeXi;K^;(UJDTO
zPC#%#k0eAzi5nbIiHj~tv&pE{@)?3cs#tZztaQ4tK(T%UlBs<Rn17v*wo{iDsF_6l
zr!wHp3ucMaKt%^nQP>xQA*|A`duug=&~&~}BDD_?6f#t1V6{nW#4c=t-ld+KDpQ%@
zVKA<|vP$U~iS@|}tS+KnMeoiq0`2c#?WF;+Nu^!@!9gt+)Z(~Lz%Zi6$14<n0;M(9
zOxzybNjf3srvkwN&7d3tK)yNHG8+W1S!={oCAkYOQd`^ml}d~0qUinYt=UK{Oo*CB
zYlWiB^e|aj$_A}<$(sXgzErbhs!N^AUbEx^Iyjk-F#fRWRog_9X;HRqyE~Lrv_8oU
z#3gzci47umybP*4kR>Fx++t&p<z_!MRphZQn(?F~>vrQ{fUQ1-cE0drW}v6G%H_gt
z>ecLg5FnxJdvjM@SgWIE3TZ0(Ze?flH65&%QqDN+ZKnWj>ja{%v?9W^LV2W{#}|*T
zwLQNk-TNvwUA8!!0GZY!5Vb;90#^cpa#@*H7hX~6IFR4Iq`2uDcVzEfWbYNyj<IXn
zGNVG-Yk&1iH*A(7U^*0V1avbT9>Sxsxg3j@mN(k<LVy(i5MC$Mq*cjWV86jB$#BR!
zgYt#c<Eqfxne&fns~F8hjd1LtdjE8qVJMs?q<a8J1<;5fiMun1v8o5^@54|1qm4mM
ziZ1sJ^t8&bumaeC8-eDV*4&cBYWqCDn84yh%ghodz9A?&#%6b}*o$Ph3-OhE2;Ijw
zMwFJWFB-V8cKv6NIvd>x;sWY?VVGsn-&-Tjaqt5f3C+MyQGS|<?<(iOuh1K^(yEKX
za-{j>y*^{H@MYe!=;7^MZ5jV-WxvW^H`?vMPB}Kh2@bmrR<JL+B(#7$Yd%G3<o4g8
zw%_V)5$}-gxPfZ1R{e<BU>-#!|Gts8u;n%#2j)_5c7*Ldh%D5KuCVdbqmdr1KqIEo
zPx$dSael6hkFjRs)lcrk7QqbzEr(t2P4{pm3LV6(y1Myyal^vN)Dq#omZc|qM=cV+
zLa3c0&OOi&eImRZ+ftv~%WX4NLFga&-!x4Y_MJZcGvAwu<5n$8oZRbP5qRDt%H$FE
zI)yh$b5?8FK>gVJ<8|$0{)LkKpQ|UZ;WqMO(n3B>KxeDPP=RG=cx#{FWFUC>fN}Z{
zcoe(Owz4K^Kx*ScWdEj)wEbC-KQe%)h8>F;!2jN^zO!Do-LK@b&@fwQvu@eQp#&k!
zLL{q2blsHDae3#AiR=TfaW#teq|NbrQ#w8b223)DlWPyu3~oy$&yed3dc$nwc+`R^
zyP8A`ktQN?w*%;2;~>@&3#)!a{NHI9d6WuVpb=4K(%Mh2%jy-7qABdNqfEtDbW%+k
zb}d3O^D(Sv&G5o18Bu?!Z&}@AhT2IfbO^KJhfAl)1lDAtHGhmsVzthN-^(t%f1L|6
zWz7t)R<`5a4RMHinL3VpJ16O8$j!n02QjWlZ*8COjZZ6&%1xQY(;o4h1%48b{7$A3
z6^GM(vDJ=8$H_a!RO;VV)Y!(9Z7abgdW5DnilqVWU;jy$<J@n(_a+g#r2J;@`wMi6
zl<_7mb!j6``c&XV^uEMly+)Myf)AFc)|b4l7w?LT#`D;$>A9JZexVb4!jUl`60jzE
zqn96;)><i67q9Nnp}2A?wwV(hO;S3-R{O$g(KWQK@w0z_V_hAFbE6-Y(T^rZcT1VA
zb2Ib!x``tkCsY_k;WQJ^V>O7EYbQdgCSwrw1v}H4t0+!j4D%?Gh?x(|>b*e-F9|>V
zMp2;;t8kb#kywcl<_~*`=!Nf;PiHMuJE$AH=S#VSs^*$C^<8s^d}aS3u4BnkL(P$A
z!ADp?4%@W!HX%X%Jq+~xps!a`m_s7!F$DW19jHs-@il2963(N1$pp-?W73j+_uS5D
zfn^Tx!^!gxm&WRcZs~n~WU+&BZ+tzGt7Hn0Z#B}(Z^}X+kHz-Tr!P7xTZ&Z;kv7M1
zU?VVYEgPiRq;#|_iLsVzrY0r?dWfo96OnPx0zDssWex-6j>T5)EMidxVzs6^ooLs~
z>A3P&bxZ_N$7E+(Cm26qq?8p4UR=!88W_!8`KUs#^PFsHJWeJLi0Nz>{IeQeh1J-N
zEJ7+bK{y(5boD7MY1FDf4dK!vk&97fa{1EdT>w9h!|H|pN?jAcl4RbQGS*=2U-wR&
zbe=2qs=HF&NgfKwVpj_W_JqfyIduxX7iMJVf&#FRw4;yuB4RcseJb>Q%aqj3$h3Jo
zweYNU_Lb|4rmX@KLo`>u|GH1l3R5S@+cv{65Y*_7QIA&%ZzOlMy@_*u#v8gq_Mu!=
ze|{8$Q4E0<kbBn17+i!%D{{^sLFIGGE6xS%h2?|~nsuLDch?UuR$o~pSI)M9<;Gfh
z7tLJ2pci9jj~wq52tJX!3&>P(YVcqIfP)LQ&I*i8m}nNLd+<1wg7SRkXzfKsg-}?I
zlgx$V{o`xY6%6AhX4{THet`7oUOt|DS8DSPaORjQUr^wF2cUReCFpwl%2F>l8YnS=
zZf*<RS4BYVwm@qNYz}Z@XHtEmmqiV(qJKbLz}PMxosFqxq6<-PHyXT$GG%`bik(-a
zq<O;6{0UgD6HwhXQX7>`rZ7}V9M-Uh&DzqO*!0f3V0B=GdH+UE;r;k7R-^d!G=5AA
z8_K2QprVN^{)R0AvJ6l5`IkOPXAd|0)mgyIKaSp{(X2i7#zj8jB8Qr+rf<gKjNu$S
zK2sM4Hxdul-zO+#RBE=w3|a{c?>YXJZM{D0d)<Dx-gUza{Ut|s%u5oEZ?gbdO%7B1
z<Yt}TFV4FJ1Ru&R(Bfqni!nTQ(dEya$!~5Ok2Y#zR{wLP%c8DSS@8Kvmb<G~GdRug
zb<@TcPUp;)n;iQiXO<TC^(Aqpi+-YOiMI&NaXLA`zCN%h=duZ1%OAF$n|a+*L~xJ@
z_g;urq3>@k12Y7iek-Sk;kNyT7r5(cl)k=f{CWEi>{byzPyUw9O?v8_Uix;Sb|A_0
zjbo|0f*#HlNoTlYbpnflp%|RIu$0nz-vSCCSp5Fh-AL=)sD_u?Uwr)W?bJ^KLEJ^n
z?*!P;8-jxNTA??F@8f)O{#Py6B3`prKmAqB-&^8BsGV^8_io**{~Yz0?EO&7`vCg#
zSYm>PiUa-nIh;avV=ho@bJT$r56oXDUL4gH>0cuf$JeQBG`Fg|?kx2ltNnpoConAh
zXjDu));Ga=j2JeOJKkDcC9qAanc}90+!htY$LIg`O9<uL4%Gi3pdhOV^4`MSeM{6z
zo_IN^@}DJ@d_OU3VK6FpMTGC-NKL(dL8$Fd>F~ne7_XbSeWQy#5V`7&8gugH)Z}Vb
z4zH{fNj2gP{Sa!C44wCQ>w7f=Cxi!r!)`olyAhw&9<nHqS259wQpwv}8)r{@TQ^5!
z{aRNT%C8>~tryV^x7XNcR4!=IXwoB;T*TTKJK?ZV1m87D8l^ihfMqg;WVo0TcHzMX
zI?nP!Q%%fO4kwY61nt0EbX;Si-ezK@wq3AreyyCL<3(8eM{)JZFjlzuw$7vzn<c~!
zj2?-WG3b~Uo07t6=74NvyB~to;T`_qnszZwHl(BSuQk5^&)(xu&h!*TwVtbPU<thO
zLlKUfEVJi}Dij*aEBiqrBL+YyY9?;<GE8|OVvVG3g{rP0B#*B2`=%x(!g)sJ>pYK1
z#M(CLd?^(?pqZ(xuYU(3;9yHHbl|tzkpn#!CK3<oHaYzyi+aP!LafzzEGks<1Hk|u
zC3rI6`XR9_`u?fq)3*cygzl{9%X(sC0PfwTCxE|T>=aV(K_-Kn)r<tnn;pgoHmhc8
zG(Pw7eF{JJy}8|Wq^YUt01DW0{uO0g?=@xrMhx?q5Ia%D)M)y_$Jf)So_Oj#{nfU6
zYv+_bJI-IU9L#XmYaBNK<6~Lp?&X_0yp=|SbJpmV%L7I$%FD|&|DxEy_@Su<?sK|@
zP`X=>!%;c%QSc2>CH1Y*pQ(eOywm<7&jFUZmCY1*0f8HJBQsb5qko=d!QM3*-<CLx
zU4t5YS=qaSwL_y6y8Tl_LB1@KG|tCs5J97HRFT&n6m=fmT;3O2>t&h>LWC-?nQ=50
z%cPYvW9$MA(aP`e22agvP!Z6Mg1&ntjvSuuTz~A?h;l+Dhn%_|@iHuC9E>!EKE1hg
z<bPgG$-wE^Wd^EQ9B=y1tKZ17pCwmYM0~3uRz}{`A3aWUe)*|KHm4>e_Ni_DxSK3h
z=SjjjvQoadY9=CVW~F+Dio3{~@*TAB@vT|SF23=S!#SC2d19l~_8)UrV>|6)-V_8K
zec5?eOMh5Yv0QqWR*_u8Oed;%4Km1VarhEPCS#C0#Ox1?a<X-Ub%x1@pr+v;!qSsE
zS-(L(Z9mp45cs+1`nea^^m*YA)lB4<C%Ovw(F<5BUjnaf-pQI*IKY(sCXbooxKI9F
zcq&kJ^T+$eI{04ZT<Cp=4^gUvP7RSfb~r!ss242bE{zMXK1D}nkz3vJws0~MLX-X=
z=f5nrxlJAzz6P`Z#NJqHeQ4c=l2PifPug@k++5AvofIEF$%+~0c#E->{Aj6%bw*ey
zi?=w^7*oXIxUt9L9O@Cp*T}y<v96nTV#)ZUGFlwhyFf3)VM>#u4gdMCyl*x2U6<?%
zIWlU{PnkHM6W*`DPQC4`fh_~SLxiu{Ow8F}5Goga%)i?k4ogxd+^-ve6SkhBY$CNc
z{B_G+3%Wr{(l0OC%BDVsJ({AOVltJs0WtdeK1?WuiX4X5U82o!>VrS$-}Um9PJd2Q
z-6CLOHqiW4wy>AR^GNcynqVLh#4<1tD2j0~5GJ(Ed=e&<9SrDRfqDAkN;Z6hM+nBC
z&39nEwCzjvLH{bdPs$#2D&zqWfEJ`L{|n8)SN8=W;kLgk15@o+a#Zjsb*J1hJoJO8
z)K7o)g3X{UY2I2^M5Q)^Ar77rm!1JC5*NP}L(#Ou*u5v9fDeFhJ%&c3Q6#oDJocSi
zcP)?;_$44zDIyzy%2^K@4bV^RC99?aEV>qWd!TeO?0y#b5(%Xqi`MLA|579*CiG^d
zIsxJdrw9eXZl=0zB3IbLffmPZu-la_z=(+Xw@O71U1s35z(AUj<cxFo5_Ml)OPs#z
z7?)TFIFkIHCK-1${$E`K$*Gml&j#2d=y$Z~d?6`Jdu-KGwI6!28Cp5u6s+dK0BE3T
zynW3K)IVazZ!qr)LRhwR!GRrq^(rAs$DrfCat!{X>f8V&X~!Q){l+OJN4=wuLOZ|(
z`seq-0sxBj`Q4WCcEcTjQ2H@VpP{zBhw%VfnAbu7gYEb?`_kQjlJZYLgqexSBXZop
z9&9=-{3j)G1S6+$a8~J)Kyx!J#XlT%X?&$0Lz-Bb++hB3YlWxeRJHU{?eArwyRo6*
zFe<zD&^?aYl(!&kK{A><r83uLb5UBZbc=-`tYMKF|ES*|o8eqn;cyuR6rdGb!z_bi
zN~KDF_|T+;^7Fi4d)Lg-7ho6ZJiP;wPQHG*V{BFRwNA}X);z6&e=@A}QsK@s)>5?1
z;7b2Dq)#iqGyM6Aa@DHeK4p`I4oGtTU3VT5x1}Ur$GWbax6hic7E_l$cG5+>6GDBo
z)EkoMNF=Qw$x8m=+4dooQ0HAZCxbvK`ta*!QAMhLqq5$x{iU~;swudzCp9<P9=QOw
zIVE3T#nkV>)-qL*vmVQR;#rN!+cA#CwAAPhPL};rJr>`AdDa(SY&LMWZRlT0`hUNR
f`TxdSr!vLnS%)6&RKoxSe9qWAe_d?nck_P$>ZA$(

literal 0
HcmV?d00001

diff --git a/doc/source/assets/images/neutron-network-3.png b/doc/source/assets/images/neutron-network-3.png
new file mode 100644
index 0000000000000000000000000000000000000000..34f03ed5c9aa81863dda17be757d70daaa05735b
GIT binary patch
literal 13293
zcmeI3dpy*6|M$PxqPEa>poHv!y-Fk^r%~Fr`jynSNQ|k35-Ay{F=%ORskG~gGNH0d
z>ohrz;|y7(iAjUOU`QH_nZcMD=6JuSc7Koix*yl?ci)fuas74Qm&Z6fX1?E<&*^=5
zJ>PFPjvYO)dgZ2-2!gCWbnu(+5JY_uzK>`vhiB4a-XtQ3b>*RN_I@AzkUQL&_T?1b
zOcb5-(~HcPg}j{ZyI<V=f_qlSVWwFx$qs$XdG>Sf9sBS8Vsd)fNe8XZ7(cGMaremN
z#Fo>R+bFsUvtM_G?p0@8eb$`xXqoxqXsXWOz0viR>pC7xmGVko702DsGB$nkApL{~
zI&9#<Tn}60%ffBjcFzA^i1CUObYPs;WaY2eh#+^9Yxrs~I`M%fO(Zc{3&wj_SIrnf
zKKp!B1KH#HNgRS4{3%ffK~}7pRYSIzsG|_%%WwXD@xNE&AJ4|va#t-Oxg9|+umAV)
z`S0xG;Q1`m8JzCr^RQlS#&jFEoB;0%!WuQi*S(Cd)<j0Hdrx@(-rhO+SSZVjfi-e{
z@ks(Q>SmQhORC&B9k%v;*sK##fo5RIS8|(lkeTE}TGE?kQuL3KZ8?rq+aKa_xsP;^
zp>1lpnqMRz<A2eQ*>R`1u&{i!*v)iO0}&r=GK-NutfCyTBTzOjRPn&}n|D5N(n?v!
ztGGS)y@y8+){u~YgNygOtbs&*KAK*+?*g^<Al+u*^p5*P2B*A~)9~rih=&Hkb4}H5
z6x9i*b#@Jf4f<YSf9^()Hql0W35o8OhG#MI(hwp!&&wF8xtZurbo%u)CG?9)Jx`Vz
zV)4Z&-5_PiU1{naxE5X>@r&JCqkNoyq1=h)<>4_Ann2c@Mw+&%qcq)Xl$G#&xw)PJ
zH6+pm^I9`e^Jo+M(F$>9eaHhh6Jx}v`Ya0u6IgX>HS-wdj#Z#{M(^0Tb$H`W^+e5s
zd<)I-C%d?vBb1T-oJj^Y+i`9KVq~h8+c==TAYCOuA0$)tdH%-Y0LKN=H5cn59b}6B
zq{SfWr;7u|Z%*=BMB=rsPs?wo1_WgEeUf<YK{NZd{U4_(&h%lMPP4$bmRa{$aYv$*
z`$Ko8EZ`%3%|Aunn2id)-7E>-&D^UfznkE(=<@4^Y{ryD#=QV<`m(sa#>kt~4~|6g
zUbo0YeQo?%X2Y%JbrZW9`!y3ICYw`yqK7}tAisJKYrT^u*xGgyyZ!s4ZOanlt&?a+
z4J9*pt+BNgb40=eR!I9md<g3lHY>lQZG3JZxM~w@U!~s5l_{u8$Y^ljY|LwmPb&!G
zu&}Eh2+x1FpZSLL{0p!?0WmqmdcA<yd9_EmpTtETa*xtEQb14V{W_-WN*^9%<=)jn
zoWB^Yuy&)L^YB=2l8iMDsy?CT`a&^pshkh;BgZXyYCXPTMV@X=v$Ex`bd(yIBA556
zqv}mfjGocyblUqEzk30-=G5@x>skv}OR5HN$fTLsK>4=EKCyE$nXLcF?3ooN=UB4$
zcFGhzOTPx^?4!n=Y{7VM@UB6pfoiEC4_Aydb!sind{4J|T*_JOK42{G7ZqAJ#0>LC
zNeNOC#hK7)q`E~Q5OjpsZZ7dGDlaU2Qp!2+7Kcn)Zg-gZhHk^$)}2gQB2bpx2OlXZ
zLC)wa`NTRsPs(B{Ws#BI@oplv(SpIjmiZ9{7Co4CGj_!OPmzVBMB34il;@%^yByk1
zCP<kq1(B?j^OfIdjfrhZYZm!55lzWXP_UI0Ct8uH+T!L}k9DneU*FtH6JW*l1Ad!M
z)MzFu*31t4Zqd(<AzM(xcj>R{I*`{L;bfGH7Z6x7<6IP8QmdNz)yT-m&s-Oui^i`j
z81-K#E1QjF&AAQHb8kCBY;g@I&40wA*;Z|VJM>?r-MQ2CZC*DuFE3ATd~PwsW|Ny{
zQge)VMv=vgkA^WK*)~}f;5AtEq)ix$w#cM*huAvC%)M<*bHYm&4!B4r^Jw_Rv6S2d
z(ab=QySqE<!O?;+Si(GEtaC_~X`pvs<+gfr<z$*-(uKMIwT{U-7lE~lV1}lcp^Xgo
zDiS0G36cexQbx<2306{MREkXb@Zm!z{K8~+3an=9=^eX?90v@Xv#E&KorKOi^|=>r
zU2)!Y`~86f2WUA?G4o?SVU5COM}C9AIN{xa_;<!5@lr0|Id)+ZCY6_&)I8eo^-T}0
zy<q1?JCkUoyR6y@zrNWEZ)}{_9%N=_=3Z3z68saK;Fsl2@Em<9F22Fn;(&+8YDj5@
z$K#da1SKX#mmHUCVxN2$zeL3-(oB*iMHu;Xs_t`_I=);vM3WCi`QH+HQ6#<W`hKOQ
z{EelY65yQ^MfJ%DsNKA3d1@L(HrHBs^T|nY8A0Bjdi%>Z!)JAzo1d8*Z+FjC%_QB-
zJ^pfd_`GUQvCXKqlir`NMI?utf`SJ7e)ih#kkowoI78@7w=qe6{Vv9DbxO-pv=hqF
z(Gh2rOH0#BZH)$(RlgSHf6Gnl@ks09owPK}ANoa3G=_JEJP$qNLK6r}MJ}6e=jU~w
zx81DG9u9>Khhc*wPWv`*;M~r?)elHT%laaAK6r?N74&u#D7)w8<}Mh_>Jhd(Ncdph
zm6Oj-498Am(d~tWH^I10T4Wv&EXmH>5}dO-1Jm;9Q+bgcZ5?OJcAqlekXKmv()L|@
z{smVLk5;1WB~d2Azxp9Xw;Us_!bnLmIbQpZn^VhuH|#HywYbPylrpkNSwxW(DZOx?
zbHaD%oAYo=ih@H?gu%Itb26fYXh`Yl>FMme?#be>Z(`{-Wrc<PRgSBdCk5z9;5hpo
zF-_Nlvtc=ilBog=IE@+gc-(rQibdo#I21>Q=xvH^#0HMA&bP#~Wg^@joY)78Us_t~
zR(*%pI-Rn}Oo9XN>ERJU;$3gHls&hUQR|c6>AH%1C_*1TX)N9f%rB*7EM$lNL$F81
zAcHKzu&_$XoB?Gn;qL*pTdCo2$@`YE%c_MI*C>@0=G6UCUORPsd^{-4*d>0j>kkU}
zvw`Y?bKpR^E4nz%r*~WoS_*>Aae#YZw@0cL-^Gx565e(2c9v?nb|#gaw<-A-&Y~GH
z9v<+R02f{CS#-u=@c>5{`)ti@{auX8OjYxUL%A#s<jMz>_Vr^c9ntk2cI3I+%97O$
zsbiOSJ32Txz;~?uX6>K=Zwo^H3e3_=FGX*tSSchX$eG;Wy@KxZHqNR`9vtx-8doUY
zaHy7sP*RLyvO6zraHA|pwaV0TCzh{dXIsstRm<U^d2xg7Q$^LU1abG+G3)({ZJ*=w
zHNlM>Zerh_8pPHWF{?>WR!jH8$iYtzerkCS_Ted~?!4F7#+=+-_rQvQL(IOb^S@c*
zrw9WVe+bvRl^~8v5GUM#sBow;HFDPjHkfPyxP};mTYBKf;OhW=YGE#uBAZYu>ZD2u
zgQDQ7oaptIrSmopgd?Uj_oGLTrlqC1^Uo-i`NPU`bLu6fB|MjdikB_s9Y{06SFV}W
z8}2BN$zfQvdE6?y6g1_<jZyQsbp<EKS&Naoh}pn=Te5DJ=;c$lTV*$_`mnGAIqh|&
zUT$>r>AEiFXs(w>FW#KN5su1aaf8)=SDgw8-9=8vWFIX^+oz?RFK5ddS<=RY;hbWh
zc70B{c_!L8)=?lYMjOrV_s*c!l?s;PP=C95R%n(mZ>H=NuxT!9T^IQlOl6qjeHfXQ
z{nQ6yf)ATQ@J^5|&e3s$2@oV=t%pcb<s>)}<47}V^~FKUc_*T)mWLEik?6Zls^c4n
zFIo<1?Ai2cv_j7St7jX#fEgZKdsV>ugjwnqg!-`Pd6||Na_?|gSJz0^(E>B>PQo}?
z#!Rf(&U3~)%zW+A+jsBY<+Z07CoH_{NY_!VU9~l<sIGJzPFXwz1Rq+ii*lwSh!+2D
zNx;s9FreDYys)@&1LXu?*2R~>X|<x3-wp6iXUD)2;7~?sG;mP$mz86?M9MDJY$0%o
z&Y^O1BSQa!yYq>+mI-tB#>F^rQB1iD4rZ+Bp5wGM+nsm7IFe?yS(}#n<YeSyGWy!n
zDao{57~0^@X&vMO<h6bgkIM<&VLr!QnWdjWE;H|hv2$AsuGhn(H~W)QRcYK)`1!)Z
zd0}iesl<6db8xM|i8y%KM`w9bDO(Z1?3=G7ETQb}?G0~#OMmipANVf)@j7Od^z$!R
zo2B4XqBx5wy3?0xX=9iBtK?3@54|aE3V*S6haj%;q<Nbcmx5zF9#*EPqKjF2M=Ds-
zHfnhHkJ8{gt|?PiBX>lQH=mDIcx5KP^1AqpG)B7Qj^KA04BNPQGO+#q?isK~!e$~^
zHmq9m-O${>$A*W8OThAUz;npD&+Uxq>x!fK-}0yrj3cSLy@=OuD1s9OjwH><S@NjS
zA>_QJX_dZq3Net+f2Q1z+n(6{l{DAL*f=**ngG$2u5v@|?d_I7wv0vK45j8&)D<~m
zMpJKU*)n?dAPRfsH(gg4&j$aQAEt_`%XMA*x;!bT)(6>a%C52=O{y#PH^}i)MOUBh
zKnNF+W{jiYdAaL-^{m?JeC)`LO`d%sN|dE;7uefK3_F`&E!E-PsHcuyj<%HMb_SYp
zu}EpX5+d|z@)}+dcf)36^vs%B`v{_I0`9xX;2ruA)=D==M@ooSYfSA)^E+KMT03~T
z*NwVg-#lv%DS*nks!kCkF_5mp8}ByMPGNKF<~XA4Yp<8R%fFBnd8l(D+9}7)G@T7=
z<08p(kr>y>N!BysY9)6L6QzW(UzdX`u|sB`tyo-eHJIn<`)33U6#6X7|N7>o<#DkQ
z5ewn9zIO&i4<QrO_b;x;@*xy0!6~ScFS5DezYvce3=L|iM-;(I2xbryAdcF<L}@Q3
zkc#B209j}aOH5pe^joXtlFvVHpQ^gV^vQ~>?X=jU<5|?(P_KT8r0z~~%V8HqKIjNI
zzK$BXeNiY{mXno6cxO4B0E1zMQRF)HgGzKeal0n+?1*V&1-`i$!T`ho(pERpPB+r4
zckg3o30|R%GwSYM+yu~H2@2U#P-K--s_*h~Zf}-xCfjXyq?l9R2BM>i_?6adq3F<4
zz3byt5hi0|>1^43$ic+B;*rs@&t|8pN*+B#e@{11TU;Az&REgLl+xgI`w=x^Aow(6
zBszLwlzve!dB}ZxRc#eMG94vMbzNw45JCFWct`d6tI?L#m7Mu@e3}L_y7LF1SpVic
z|KC!tyRU8B`o&ugdO>C?)~`85xAB|Q*yDN=uamg2%dLWMa`^_hn8p_%5xg^&0@U`<
zRxHjoRaq|*e`o~!AU7Rt(IEK|srvqgu21)Axn%?h+wEPnmOdnP_3vbNj35!sgSZb#
zh*jIxw*G9#HLu=j>`{W?yEP(>zYn>oD!*T~ybR<(MnI9u%)N)JISAqmo_JgHs(2Tb
zMB>gxJC$%GpoBW>JhNw8BKY?<Aqzi&ezS4&UrsU0amI-Tgt2nSTFu)|Mv?L_OwXj4
z4XY#0CZiRHe>tP`FefM8mRb(UsfTw)Dqsf46ZG?pKtY<Q<z`=5Qx(74*;#%BUV~3E
z1PKCq*p2>2{=m!|HAM1!z4^fPN17BD$fL*q6e5r!6>}V_ExTk!YL8MtUVp0-@A8WM
zmqy(SUce5=7i%K&FI9_ls$_XlZ}2e&cErYwY=zT77VakM==h=;0R}UI$oGCAB#qY2
zj$JF_IE0vA+*EE(&(T1fO-D7*v_=S^D|F#C=1Sq<Rpb%-len74x~}0~QK4CFEOq2y
za+1UALmZD!5vOCN=cq}qJ8SIR1UCl6ggCOis#9v`LYX9|ig0@xKy4-OekR!ByRODk
zDl43AT&lW#FQ~MN#ckI>W_|#~M87_RPUaTH3Zj-85X5l1!(~n8HNR+0MAW$orSp7$
zqhMhDb{jomFQzxLB8K&Tt7E3KCDK%SznQ(a<`PDZHo7`2MUcpjRsS~td0Lc5<*Dyc
z{|iT-13|ZmpoTbafhE*)?U#K|&_)&>ChGK<B<DABapp*qq3S@k>JxNb?b2E2yn%h~
zNn0;9LZ;Sk(DAu-WxeauL7%m*uk$}FX2pq$ff-c_j&gR!vy*gCi*tNDAE#WbXUTak
zOU*j*vuoW!v5RMBW;!5SKiB97*(^NT@#Knyk}y1H7*gQFEEZ!t>ggS;KC3qD@pT+k
zMvg+E@KP>`0xlZ@Yrw5Jj~9$oFp#f+u7olV09%4&=4H9B_VOeFoUrU8rj{AhiLa^U
zAXUu!IKoGTg$)<7?gx1H+2E*|{G5jm<0{+RS@k@_zw^Y$*0qA@dIiaHt~*5Y@wsRR
z&^aK`0KZ(<4VHt3!T^+c{hPov`B=Mt(UY$|Lu*`AIksNvemx%iY<&u7@IqGqGTF@d
zT}oQ=k~<4xe?tHGIKMZr-pyc$0|weMHXFC|LBno)`=#>`s#HS!Pn~|NY~+5c9pO(}
zgm#It!>RNt<oin?b$~QgnFu04<xbaGaO$)PY6<R&0X9lpOBo&?kIKiF_5Pvn1$u@V
z^<9oj%>26~(AOUlNN*X|E|tQ!(m?FYz)m5FzeuxJiT#hJTx?El1)V$fk^1bV+r-dq
zh=E-3#swGU5=|+^qZDMUUfJ~EC08v1_q!m~cse>dDqw-PQ^SA$pmjPS$#z+>IP-@m
zOI&D9-M#6yD)WJ?^LG3A1w9_8u8X9hKsAa-aLP-$X{>vliN^kM>*qf*9C!Eya&<Sv
z*xs&DAGH-o?7^lWudL$L_d@Uc26)@1TJ^!aR8$Ux6LalFfo*?^=-psr{>vy9Ud$IQ
zEgDW8&Ei^|_oy-(DjoEQ*kIti*z2i-LSBCXs+Yd}r9&HRdUbG+0HlW=2r%v|JRq6~
zwFH(w3>3#HA@M3-O`we_{+(?e7dh3}gR|K&_t;AS46Dor`T|wrADqwcOS{=A4sHFN
z?^OyY^#{38W}7To1(2k1GK<h;k^3_F?FlQ+C4&6+I;3VhIK5yWXV;7Xtd@z5+lhAl
z7SF?7dpE9H&W7s=<pbpvz0cEEh(8>xu;-%v>2)-hUX5_AYc6dkxq`X+@IzF$3ZYQ0
zR7VmW*UZMG`{A%X`zED#tVaI!ZbUd2b~3kZCE^Q&4P_Wy)4-|G7E09-qeMJr*E$5L
zIq=WxOJ~;`_E+5A)*cA1mpPI^mt)vgOeQ8miRS@ccGUFh&*MH~;^XPkusUT?HRU{^
zh(}421MY5Lg_`Mh3wjpiJdXE1mM|=j8g@Z0CwvmO8?n3KUF&xEm4)G8G&1`5>W&|s
z>o2&((rxDM20qsbbwXxeuULF`fH0<TkWZ!bwZxwvS3}CpZQRz1oV9kZ0}o^oYHEj<
z?H^lwGB8UhF1<SN(vC5p$UoDFI}^^3U*xJKO1~Iw`O(f0DrY>x7WIF95e?$;BTH8;
zEW}0__Y<k5WRMU!ps$8R@BXCuVsMtJ-@1p_FCd8aA%4)TUC`@_+f9x3ghpp-{4k9~
z$p~F0;S$jiN^INJfpJoMc(y#uMe)+uNN--Cfk-}1^{4upt*cn3FDMq@W7hX$NV%yw
z%5vS9OgYPc2NxSU<e~NWB}x(V-Y({qTeT))^lM<IBVWEsfsME(ezI|?GZg9^`0MYe
zIYBrl$Tba<^OwG9be>GaFt9&YJ#LhWu?zD3*2wJpWZiP9woK>qQGQD))6tKlG$0?F
z`a%A_{qBk)5CbZ_-KNigSQ(woEh^lZq=Wc=o%}i^F2t5c<87NXqd%e7J~cG0|8+P}
zs^DE@OjS^3h7+k05pfgEgT>&S!e5$iL<^k|q`^M5_3RsLnu-vNH=e6F7dT65neiAC
znPTcY<9Ys7*_~WI2gm%(RjXH;AQane>`M~0S~g@Z#i$`s-4i!Jx&S6{KYI%lhM|A)
z*;}vyS8$Qa{9m$~`QwFVUXA;naoFoU!;ZetL@r%)JP<ecDL<f~pdfeq2T}}NAA4)A
zw^$LHTOhVx#IF((L{<ti<*5d8uoa?^5tv&j>QnEGl6fauR(>t^1s|^}xsp}L4){fd
z=ntl@>w4GoXB*_3pCu}1lT*mDuaKt4kT$hL`2$oEi0z4(98%*V+OK}jJf6t(si}oJ
zN=X$@4e3vBJ!|Dx;tAMS1<fkC%rT1x+$|c4wqN!N(LBnOf+)Dp8KR`lg~W5QOboj=
zlR7b(iizeswB${E;)9G@i~#nd)yagaRl&0zSxf%`gaw!CMo$(+7O?GWJR&T7l=6Hf
zc}jsH;n~=W-TYvuVTp{$RA7r%Vy~ZIV9Ox$Q86hC0|Nx9pHoQrN{E26`N_%232^QL
zP`q>%5(d6@Dq{ke)g|0~*h7&{six9`)5?F2)sS1XSH#SfFd9$R%&7YsFdH@nYdwxv
z390vjrMU<P=LfJ{@MlLHDi;#4@qv)YxcGR~)QCf2VIg3wnzn7!q}c9gW3s4<C{GQG
z7Z8+ma{J!Fo{jatlKX$tJcaQ}d7Nf>3c?h4Pa@DWW9^hbL7RgC&<2R`s%Og0X-tI_
zOBl}*&5<_sH!qWQVFM{7QX@}PFEVWt07&y2>z()+0D#YBzzg43>Ul!k#{lgF*32&I
zomP>-QU(W-!?Fum4LH5idMt*C<fRvRo~T$%Q!Y}5#k-^RNATid<ukt3T?=8W#qUJ-
z;2>6ot}C!R080?O_7my@KN8F!NCj*`azhLn#LgDo{uKRN#gX@J&+*mk!|j6V#S^IZ
ztKH)m#>=a{{*G2{puC}Y;i1<D0|Z42vjT(<uzRO3kpbk77swNclG8NT@DipA;-?cj
z%gv=wKS@=dW%-YdEtVNe%V2!^2QwvSGkX{Xp+CxizX0vU9WQFVyxYn016%E?_c^|<
zNK{xI75v<#CNUw?NMyJB)nRU|Q>Hx5V!DMAvI=rH7zi4J?Io}7iKtkDOd6njfQQGD
ziayHO1a`=;b)V7P74O^?tYL~$LR3mzhWY2Ce?mzIXo_KS`<}WUJ=i+b?-z+vf#Xae
zmjgTqur+Mn;4{h~`Ipd)fD3*dq9-Gw&fYV&xHpz{F7;ndjzmaPJzvxYH;A2cwz*2G
zypXzgbKrB_e7@n>jzW574q%*9cLxBbLD1FqbvTaYe6yypY?0jF)FSNj36q~@`ENl_
zr=q{Zcm)qOFd{<VShYE*s&_S)g18`FNS)a^Go$JX4{KH?J~UIz3N%%a+paQ0iM147
z@l3xkwpD*0-3C^_EVT88L8jZ$$i8^Oz3csE!gh<_Eh7)%(U&g%oNh4_W`S4Skn$vP
zntHQKkL|i6dp4XnpOqi%bGfj@^P#5IMal(W+<e?BC*SEb7|zTulDeEyVPGECj46vY
zrkRYUhpy`tv2$07b<S*11?_*hwEruvZD${Yzw7jh#gN!g8Uu}cE*UKiDs4eOb%9Zo
z9iHZV8!4&yY_|60K6#qt7$r<QN#dXRVcE6+*lWIh1%eFe{J+xzumW5fUPoPfzt-bR
zS#6)Pa<oi(q(&NE9D&kIh+Twv_pl{fMb1cK{rRjw*1pltOp=QU->g*WVj(Z{H?p?M
zDkOf8ha-;kuEa)%9iq8C9b>RF-{o=+H));@>f>NH`WNrh!fHM4C@)ql?%o)C<?g#@
zu<O6mgkOzn;3s5{|5v#zG)mFPU2y{A{0RJ%5hF8EXCZy0_rH?O<YD~X9xs=t@Qy^`
zy%mdl+?QFOme0OzO(nID&sCOkD!}A9Bh%V0P7X$A-yFv{KZdu>>GR5fYmIk-k}m!)
zlyr&VI$^Id9Q<j2Job~gM?`J0<u>9!71iU9#m@?fM#o^{X{w1!I`&H>V+#ul)*mxv
zRT<60!vpdwLZAT6Ysn)^_QH9?mk>d`kN7?QH2T>OMtzF=z~|ZE-c`B(hi-)a9|`;9
z&PLNUHHom&u_rM^t;Ic-Q)jp-z~{YzGC<YqY2j9WAVpg)j+z`F_g4+~B0d0iq`vYW
z<+pTMR6ficrCQLYt{yD9TC=Soduh70`R91m!2jH_={ju#s``)S)Yv(Ztz5MQAMdch
zIu|wC?|8FK^$DT)6^qEstG>Nuc41+39o17;@!p!or&H>xe&O$wRy2-;lZaHFi;Wxo
z{t<`Eq~Gb%r(EeHvNp@@Vt^owAgRmt)7~^{QakfT<Xry_PYk5g_-c)vu(Z%=YF_;l
zb0FU8@|LPd-K3fo){BT<O~~>KQblJ{w})mvwYokefl0#|k5i^&qF#LSX7x}d&lW9K
z6a~)~ZsPGApN;-TzVyglh}{zFgK0F}-BjuusarRxpenLM4WHTuF)f)qa$sp`Jxjy!
zE-ISzdp);3j4|ZF3=7K)?VY;T^=tTHe34~B0q@%;&6?+>%+rzf7qK2&9A6LYJjE!f
zx0}PQo1tHw6n-_t%HCj@xNV4i?Y*0E<>t-Oi@9nAmS$mBaVfqSuPWzoeBi8FwXbNy
zeCR1(KL!+q{FZnEZhOc`HJ=qfB=VVKD&OxI3K~WSx#)#fEG>CpBaRPW>6d(mVWv$)
zz8cl=9W7593Md-z6?43}(z-Ot9qFJ>SYPNguiW+~p|1%`@;V^@jclY1t8`b3|K{1@
z=^_`nZ_nqi;>-X1`~R@jEfHPFOxy4}P)}v|Ovz_|wZu6BP9T<T9J;Bp^-~{geJxOl
z%BZlbSNlKu2)MTYH;3fcl_Y%H^#zqFl2pe1%-X8WH2HOB@-CIX_)o`B)GtO5-V@7&
z5aUAq@vX_nsz`8E5vjJ9apuHd2Ql`ds)|cvw?k&hkDG1QbWt<{wlGc*1GX@8Sp;nH
zc8XrW&&keqws&#KEoN{4io+xN1>ZNG<HL#-AI3=Dh{eu#e4hH>!rr=qh5{87a8%Vd
zmZ~nF`JsnnqkkOs?#yA!B8h|k^kF>ryI)izZ|ot54kqhP1H^+;1^@x5_kJj!Kq(3$
zrU4Yup{)QcFHF^0kg=<?S%Hris|r(iowufS8(;kI_{B78p`wu3@`&8Su=wp1<^lM)
zV^I+oLGIit+j{eCuhC|jX?lmC^=!A{=Kl$07;dRZ)A=Q3QBRUf7IZm6zO>hu@t)bs
zy+-U3#O;DYl&Z!9Md>uv-E+}#w!lmvU2fIq-1dI9@8Rkb7)@9F??m)}RFeJH%wF@G
zmYCEJ5WzzNoS}IY_3i*%DE|Uq2d)E)&cvcqIyK&1lLX~ThuDfpR#MGv+hQB2OG1q>
z(sX_ax&%=7;YJ_^mD$UDqAE^HjRYP&j5EhE(-$+pD<U3g(u^&>VHFt`mYdc-J{8*-
z4{FXcW8&@N;$j4pGN9`42y(&;SzZ->DRGZvGPaA7FLwTsFlnJqZwxhb?GLfr{b$`Y
zM+Gl{Rl=U=`{Q3&W3~&iNKd9@@VDd-E;pzsEF5U+=G)%}L3*?Qcrg%)O2^%O*z7Rl
zEjj}@ej~66=O3B<PJ7z)F@|6M6WWnzIJ5HeY0m6ZOJUXFzx8@S<EZ3m$DqqguJJg$
zb%nk^I%DE2_;QtZcDC9crgQ7Dvpx5baw|p3t4|>Dt%h8q-grmty<g~jCbYNIwXA>g
zOi6X@Nu8f14(1<@SFrFNIOo@1T;q3tQIMADzbJ^8ih^jqz^5%ajKp$EP!`sVDeb$%
zE0VD}Y=BiCfpVeqp%T=>fTa+7w})}<1SVx4jIwYELhH1?zny_6JI2V;VTaM|oABJr
zP%(l$wx;BE(nx{!-wmkL-eFs*!Bo{#qDCHBJ6Gbc8OGwn_4&<&TJ8XnG5>e}TW2`i
zxqcs@h*1l^KaPsyY@aRG(QH40H?$FA@AojqbZ4)TndHfX;-!L-ecTo`>kpY0=}L!B
zALLg$O1;?&(;VdEBKASF`Sop;m)^`i*120{UYb8M4o>5aV>Hcv=kLcGKJ-hlR7c${
zBrC4)I5oyuWJQj|ftQj`q!f_vINEFC%05Am(f5C`(SM{2e{6NQtONREm)lwrpGj6?
zrTx94%-iV-&OZ5YzMuUnRb1MKNAK#}hn>|(-q+_xt|Lz>LdMgY_A?u%xERuEIlVwq
z-yzz(97KokH*&QxLoaZ4Oj{DZXNtPJ_5oSuC*8qpEl}kvmcn~g{;)x!GsT8##))=M
z+#&Q?o{H$dhq^9tQ>;avU48Cc-(%x8L%+2{Ug7P9e`*C@d8Q|@MsJ}uEchn6Zt@)q
z)pP34CdsesQ1yh6gl;*rF_y8UQAXtwH?gr4uSmX0Z|)#Y@LdV9sG8k*sFqwR74G{S
zU<*NU?FZ?vivF)YD5RFRdeGhcuWnri>T=rnFX}>yzeeZgU1j2j8Sx0R#X2bg2armt
zH7>4#HtH7=+a!uTvvK215})<(F)OEpH6$wMS}<86!ARhc-2lyvOiZn&Ozl=fCMh3_
zE~VqxGqO76$OvOUtxR4+6<zHmmpUrocP@)>xbVc5cS7qiupJgi!uvhODyjOF5bNJ*
z5j9e@QPx!&R8TJuOOe_Aj^hzfO2c-8toLh$qEYpD(Hu>&H=YF>`KP8BKB{F>&u?N;
z6BE*`d&G4_X@ocRHD_pEI{5*-IKNgFdw4v!b~@}oKgQW4IdI&+;z~j!W-rBVyTich
z*x3q$%0EKFuF~aU_2#EB)k?yTVona`a_`B~O?n{hNhi%s(WGy+9$#=7Ic&@6U8M-P
zCVV2b<Ku=I#6dCEI00=JGs19I+>x#{NuHKdBvOKtGlE3Ts^~(a(kmesdZ(r$9Ppp{
z`$8**zCX08RG6nSE2MV4Fk@6rS5fJ{^O`G7dY(HYO$7RNX(tW3+gzak0(!>+z%S^J
z7kSH>D0gDutaMcOxs(%qTobvhufhaCal-`OFUmteM)%otmh2-ZLbp2(n%9haq4kS<
zgJhDtHTm@)(NcSVHRad}9qiI!BypcLG`Cfl7lDX}*07fXr!d@HeM989w=5~lY%G44
zTY6{-RtIUyG2f6n2ijic452wORIDA<5z?V4OSRZgRrY0fRfdT}GS`kGs^by`L)3}z
z1(<SF_Lv%SS?9k;EQhN1vkPYlq3FMf3fKBetL3ZxzCWibV!&4_Cj>rPzW7#eggTO-
zlqZZ>{OpZAe6HGg(GAyK<a5||l=a^AyOdz-KPVP53hyP!U>O}EIh&T75Qxe(c86Zj
zfe_Jo=<QI|tpG^n09RtO+3CCzXc4<vSDJdUp}c2Y2l<sZy<=f+e^HkHIH+B$cLp2y
z0}3ht0Cs{@jZq)V{(cz~G0X(YrK`Sll)_U3KEHs6^(t$8UPS!@$`aM18}hoJp0_MM
z23<JNiDeG~8R9Gz5_bR)Nri=Hf$)n(-4+xVBoW04e7jG}BZsXb6%Z6cd0B8e1}^V@
z2(fSAyiFG5Eaw@`L|co9fCsPEp?k_J40*ss1JbyE=o6s+2SpI{$uuiZsQyEEiz_>M
z1oDB)jeePc8wj;D=2}!T4oPJ6uUh(8#SuO6gchu5n8R66)=?z5pX(9I?@6{C6~Btq
zi5K%zC9{^FivPFt!V6XX8SKkMoha*)Eg8)sL)+*_W?#5kTEyKp5a=CQux-GU8GOZ?
z`Z6+2g8g9*MWO^VQ;n|n3PPs3-e^O?i8sTA^)D=}OHi?h1C2riA-$<g&9gxhB5sv+
z2^xakD@#c3m5rgeqZ#2%?#&#}o?0F5Oq|#%g1<augs}`)Awm#4Qq_w?dLp|_l=2UJ
zR6I&8mv?rhk8%AmBGl)2hZwOH-F4}q@eP@5-O>JMjk1Y?;1+Wf(j-Ke_XGgo$E`l8
zj`BJV=uR9~V4d&TJ+?KUqlUx=7MNWI&>fbcvZ8;r<NfC$?!W7{|5yC$icD!sX!+%*
VukIJXKguA7_8<MG)b;ca{{zy}r~Uu{

literal 0
HcmV?d00001

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 2e17da17f8..bb0357286a 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -23,14 +23,14 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'sphinx.ext.autodoc',
-               'zuul_sphinx',
-               'openstackdocstheme',
-               'sphinxcontrib.blockdiag',
-               'sphinxcontrib.nwdiag' ]
+extensions = [
+    'sphinx.ext.autodoc',
+    'zuul_sphinx',
+    'openstackdocstheme',
+]
 
 # openstackdocstheme options
-openstackdocs_repo_name = 'openstack-dev/devstack'
+openstackdocs_repo_name = 'openstack/devstack'
 openstackdocs_pdf_link = True
 openstackdocs_bug_project = 'devstack'
 openstackdocs_bug_tag = ''
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 2c25a1c350..fb36b3ec5b 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -41,19 +41,8 @@ network and is on a shared subnet with other machines.  The
 `local.conf` exhibited here assumes that 1500 is a reasonable MTU to
 use on that network.
 
-.. nwdiag::
-
-        nwdiag {
-                inet [ shape = cloud ];
-                router;
-                inet -- router;
-
-                network hardware_network {
-                        address = "172.18.161.0/24"
-                        router [ address = "172.18.161.1" ];
-                        devstack-1 [ address = "172.18.161.6" ];
-                }
-        }
+.. image:: /assets/images/neutron-network-1.png
+   :alt: Network configuration for a single DevStack node
 
 
 DevStack Configuration
@@ -100,21 +89,8 @@ also want to do multinode testing and networking.
 Physical Network Setup
 ~~~~~~~~~~~~~~~~~~~~~~
 
-.. nwdiag::
-
-        nwdiag {
-                inet [ shape = cloud ];
-                router;
-                inet -- router;
-
-                network hardware_network {
-                        address = "172.18.161.0/24"
-                        router [ address = "172.18.161.1" ];
-                        devstack-1 [ address = "172.18.161.6" ];
-                        devstack-2 [ address = "172.18.161.7" ];
-                }
-        }
-
+.. image:: /assets/images/neutron-network-2.png
+   :alt: Network configuration for multiple DevStack nodes
 
 After DevStack installs and configures Neutron, traffic from guest VMs
 flows out of `devstack-2` (the compute node) and is encapsulated in a
@@ -222,8 +198,6 @@ connect OpenStack nodes (like `devstack-2`) together. This bridge is
 used so that project network traffic, using the VXLAN tunneling
 protocol, flows between each compute node where project instances run.
 
-
-
 DevStack Compute Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -268,30 +242,8 @@ to the neutron L3 service.
 Physical Network Setup
 ----------------------
 
-.. nwdiag::
-
-        nwdiag {
-                inet [ shape = cloud ];
-                router;
-                inet -- router;
-
-                network provider_net {
-                        address = "203.0.113.0/24"
-                        router [ address = "203.0.113.1" ];
-                        controller;
-                        compute1;
-                        compute2;
-                }
-
-                network control_plane {
-                        router [ address = "10.0.0.1" ]
-                        address = "10.0.0.0/24"
-                        controller [ address = "10.0.0.2" ]
-                        compute1 [ address = "10.0.0.3" ]
-                        compute2 [ address = "10.0.0.4" ]
-                }
-        }
-
+.. image:: /assets/images/neutron-network-3.png
+   :alt: Network configuration for provider networks
 
 On a compute node, the first interface, eth0 is used for the OpenStack
 management (API, message bus, etc) as well as for ssh for an

From 3362be9edabb7c882ae9948d210a18fadd25ebda Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 22 Aug 2024 16:24:21 +0100
Subject: [PATCH 3207/3333] docs: Add SSH guide

This is really easy win for people using DevStack for the first time.

Change-Id: I8de2d4d115d34e9d87dd461016b5b894d3f000e7
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/index.rst      |  2 ++
 doc/source/networking.rst | 40 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index a5a11e251b..70871ef876 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -133,6 +133,8 @@ there.
 You can ``source openrc`` in your shell, and then use the
 ``openstack`` command line tool to manage your devstack.
 
+You can :ref:`create a VM and SSH into it <ssh>`.
+
 You can ``cd /opt/stack/tempest`` and run tempest tests that have
 been configured to work with your devstack.
 
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index e65c7ef195..f7df4f2e46 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -68,7 +68,7 @@ Shared Guest Interface
 .. warning::
 
    This is not a recommended configuration. Because of interactions
-   between ovs and bridging, if you reboot your box with active
+   between OVS and bridging, if you reboot your box with active
    networking you may lose network connectivity to your system.
 
 If you need your guests accessible on the network, but only have 1
@@ -114,3 +114,41 @@ For IPv6, ``FIXED_RANGE_V6`` will default to the first /64 of the value of
 ``FIXED_RANGE_V6`` will just use the value of that directly.
 ``SUBNETPOOL_PREFIX_V6`` will just default to the value of
 ``IPV6_ADDRS_SAFE_TO_USE`` directly.
+
+.. _ssh:
+
+SSH access to instances
+=======================
+
+To validate connectivity, you can create an instance using the
+``$PRIVATE_NETWORK_NAME`` network (default: ``private``), create a floating IP
+using the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``), and attach
+this floating IP to the instance:
+
+.. code-block:: shell
+
+    openstack keypair create --public-key ~/.ssh/id_rsa.pub test-keypair
+    openstack server create --network private --key-name test-keypair ... test-server
+    fip_id=$(openstack floating ip create public -f value -c id)
+    openstack server add floating ip test-server ${fip_id}
+
+Once done, ensure you have enabled SSH and ICMP (ping) access for the security
+group used for the instance. You can either create a custom security group and
+specify it when creating the instance or add it after creation, or you can
+modify the ``default`` security group created by default for each project.
+Let's do the latter:
+
+.. code-block:: shell
+
+    openstack security group rule create --proto icmp --dst-port 0 default
+    openstack security group rule create --proto tcp --dst-port 22 default
+
+Finally, SSH into the instance. If you used the Cirros instance uploaded by
+default, then you can run the following:
+
+.. code-block:: shell
+
+    openstack server ssh test-server -- -l cirros
+
+This will connect using the ``cirros`` user and the keypair you configured when
+creating the instance.

From 14f60b951aa03ded3779057c7fef28f6c3ee15cc Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 26 Aug 2024 11:56:31 +0100
Subject: [PATCH 3208/3333] docs: Expand SSH guide

Detail how one can SSH into guests running on a remote DevStack host.

Change-Id: I9f988b1193d67859b129f05d08b32a23e50aee49
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/networking.rst | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index f7df4f2e46..93332f07a5 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -152,3 +152,41 @@ default, then you can run the following:
 
 This will connect using the ``cirros`` user and the keypair you configured when
 creating the instance.
+
+Remote SSH access to instances
+==============================
+
+You can also SSH to created instances on your DevStack host from other hosts.
+This can be helpful if you are e.g. deploying DevStack in a VM on an existing
+cloud and wish to do development on your local machine. To do this, you will
+either need to configure the guest to be `locally accessible <Locally
+Accessible Guests>`__ or you will need to enable tunneling for the floating IP
+address range of the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``)
+defined by ``$FLOATING_RANGE`` (default: ``172.24.4.0/24``). We're going to use
+a useful utility called `shuttle`__ here, but there are many other ways to
+accomplish this.
+
+First, ensure you have allowed SSH and HTTP(S) traffic to your DevStack host.
+Allowing HTTP(S) traffic is necessary so you can use the OpenStack APIs
+remotely. How you do this will depend on where your DevStack host is running.
+
+Once this is done, install ``sshuttle`` on your localhost:
+
+.. code-block:: bash
+
+    sudo apt-get install sshuttle || yum install sshuttle
+
+Finally, start ``sshuttle`` using the floating IP address range. Assuming you
+are using the default value for ``$FLOATING_RANGE``, you can do:
+
+.. code-block:: bash
+
+    sshuttle -r username@devstack-host 172.24.4.0/24
+
+(where ``username`` and ``devstack-host`` are the username and hostname of your
+DevStack host).
+
+You should now be able to create an instance and SSH into it, using the
+instructions provided :ref:`above <ssh>`.
+
+.. __: https://github.com/sshuttle/sshuttle

From 49933804c9d151ce4a220c188ba4301afa0bf98c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 27 Aug 2024 12:08:23 +0100
Subject: [PATCH 3209/3333] docs: Expand SSH guide further

smooney noted that using your DevStack host as a jump host is yet
another reasonable option. Add this option also.

Change-Id: I24887c254e131a8979653a7d17e64a708acf294a
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/networking.rst | 76 +++++++++++++++++++++++++++++++--------
 1 file changed, 61 insertions(+), 15 deletions(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 93332f07a5..05b4f34164 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -158,26 +158,66 @@ Remote SSH access to instances
 
 You can also SSH to created instances on your DevStack host from other hosts.
 This can be helpful if you are e.g. deploying DevStack in a VM on an existing
-cloud and wish to do development on your local machine. To do this, you will
-either need to configure the guest to be `locally accessible <Locally
-Accessible Guests>`__ or you will need to enable tunneling for the floating IP
-address range of the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``)
-defined by ``$FLOATING_RANGE`` (default: ``172.24.4.0/24``). We're going to use
-a useful utility called `shuttle`__ here, but there are many other ways to
-accomplish this.
+cloud and wish to do development on your local machine. There are a few ways to
+do this.
+
+.. rubric:: Configure instances to be locally accessible
+
+The most obvious way is to configure guests to be locally accessible, as
+described `above <Locally Accessible Guests>`__. This has the advantage of
+requiring no further effort on the client. However, it is more involved and
+requires either support from your cloud or some inadvisable workarounds.
+
+.. rubric:: Use your DevStack host as a jump host
+
+You can choose to use your DevStack host as a jump host. To SSH to a instance
+this way, pass the standard ``-J`` option to the ``openstack ssh`` / ``ssh``
+command. For example:
+
+.. code-block::
+
+    openstack server ssh test-server -- -l cirros -J username@devstack-host
+
+(where ``test-server`` is name of an existing instance, as described
+:ref:`previously <ssh>`, and ``username`` and ``devstack-host`` are the
+username and hostname of your DevStack host).
+
+This can also be configured via your ``~/.ssh/config`` file, making it rather
+effortless. However, it only allows SSH access. If you want to access e.g. a
+web application on the instance, you will need to configure an SSH tunnel and
+forward select ports using the ``-L`` option. For example, to forward HTTP
+traffic:
+
+.. code-block::
 
-First, ensure you have allowed SSH and HTTP(S) traffic to your DevStack host.
-Allowing HTTP(S) traffic is necessary so you can use the OpenStack APIs
-remotely. How you do this will depend on where your DevStack host is running.
+    openstack server ssh test-server -- -l cirros -L 8080:username@devstack-host:80
 
-Once this is done, install ``sshuttle`` on your localhost:
+(where ``test-server`` is name of an existing instance, as described
+:ref:`previously <ssh>`, and ``username`` and ``devstack-host`` are the
+username and hostname of your DevStack host).
+
+As you can imagine, this can quickly get out of hand, particularly for more
+complex guest applications with multiple ports.
+
+.. rubric:: Use a proxy or VPN tool
+
+You can use a proxy or VPN tool to enable tunneling for the floating IP
+address range of the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``)
+defined by ``$FLOATING_RANGE`` (default: ``172.24.4.0/24``). There are many
+such tools available to do this. For example, we could use a useful utility
+called `shuttle`__. To enable tunneling using ``shuttle``, first ensure you
+have allowed SSH and HTTP(S) traffic to your DevStack host. Allowing HTTP(S)
+traffic is necessary so you can use the OpenStack APIs remotely. How you do
+this will depend on where your DevStack host is running. Once this is done,
+install ``sshuttle`` on your localhost:
 
 .. code-block:: bash
 
     sudo apt-get install sshuttle || yum install sshuttle
 
-Finally, start ``sshuttle`` using the floating IP address range. Assuming you
-are using the default value for ``$FLOATING_RANGE``, you can do:
+Finally, start ``sshuttle`` on your localhost using the floating IP address
+range. For example, assuming you are using the default value for
+``$FLOATING_RANGE``, you can do:
 
 .. code-block:: bash
 
@@ -186,7 +226,13 @@ are using the default value for ``$FLOATING_RANGE``, you can do:
 (where ``username`` and ``devstack-host`` are the username and hostname of your
 DevStack host).
 
-You should now be able to create an instance and SSH into it, using the
-instructions provided :ref:`above <ssh>`.
+You should now be able to create an instance and SSH into it:
+
+.. code-block:: bash
+
+    openstack server ssh test-server -- -l cirros
+
+(where ``test-server`` is name of an existing instance, as described
+:ref:`previously <ssh>`)
 
 .. __: https://github.com/sshuttle/sshuttle

From 6a8f65b476883d5cccffbcad8650894850033231 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 21 Aug 2024 15:57:32 +0100
Subject: [PATCH 3210/3333] lib/swift: Consistently quota variables

Change-Id: I6c3245a77cdc2849067568cfda5a838afda687e3
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/swift | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/swift b/lib/swift
index 1ebf073318..3659624d5b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -844,14 +844,14 @@ function stop_swift {
 
 function swift_configure_tempurls {
     # note we are using swift credentials!
-    openstack --os-cloud "" \
-        --os-region-name $REGION_NAME \
-        --os-auth-url $KEYSTONE_SERVICE_URI \
-        --os-username=swift \
-        --os-password=$SERVICE_PASSWORD \
-        --os-user-domain-name=$SERVICE_DOMAIN_NAME \
-        --os-project-name=$SERVICE_PROJECT_NAME \
-        --os-project-domain-name=$SERVICE_DOMAIN_NAME \
+    openstack --os-cloud="" \
+        --os-region-name="$REGION_NAME" \
+        --os-auth-url="$KEYSTONE_SERVICE_URI" \
+        --os-username="swift" \
+        --os-password="$SERVICE_PASSWORD" \
+        --os-user-domain-name="$SERVICE_DOMAIN_NAME" \
+        --os-project-name="$SERVICE_PROJECT_NAME" \
+        --os-project-domain-name="$SERVICE_DOMAIN_NAME" \
         object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }

From 31980e436b73db18297a295969069cf00bd43754 Mon Sep 17 00:00:00 2001
From: Jan Hartkopf <jhartkopf@inovex.de>
Date: Mon, 10 Oct 2022 10:40:38 +0200
Subject: [PATCH 3211/3333] Configure option backup_ceph_max_snapshots in
 Cinder backup

Sets the config option backup_ceph_max_snapshots for the Cinder
Ceph backup driver to the specified value.

Depends-On: https://review.opendev.org/c/openstack/cinder/+/810457
Signed-off-by: Jan Hartkopf <jhartkopf@inovex.de>
Change-Id: I9e12e395288db1fe59490b4075bb2d933ccd4d78
---
 lib/cinder_backups/ceph | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 4b180490d7..ea9b44fe8c 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -19,6 +19,7 @@ set +o xtrace
 # Defaults
 # --------
 
+CINDER_BAK_CEPH_MAX_SNAPSHOTS=${CINDER_BAK_CEPH_MAX_SNAPSHOTS:-0}
 CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
 CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
 CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
@@ -38,6 +39,7 @@ function configure_cinder_backup_ceph {
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF DEFAULT backup_ceph_max_snapshots "$CINDER_BAK_CEPH_MAX_SNAPSHOTS"
     iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
     iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
     iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0

From f49d475bf2e186ef3d7800e2bb55c9c360e7ac95 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 2 Oct 2024 09:36:55 +0000
Subject: [PATCH 3212/3333] Catch and print the postgresql initdb error

The logs are stored, by default, in
/var/lib/pgsql/initdb_postgresql.log.

Related-Bug: #2083482
Change-Id: I2c83e896819b20cd7a1ee8d8ee33354fb047a6d9
---
 lib/databases/postgresql | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index b21418b75e..2aa38ccf76 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -46,6 +46,10 @@ function recreate_database_postgresql {
     createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
 }
 
+function _exit_pg_init {
+    sudo cat /var/lib/pgsql/initdb_postgresql.log
+}
+
 function configure_database_postgresql {
     local pg_conf pg_dir pg_hba check_role version
     echo_summary "Configuring and starting PostgreSQL"
@@ -53,7 +57,9 @@ function configure_database_postgresql {
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
         pg_conf=/var/lib/pgsql/data/postgresql.conf
         if ! sudo [ -e $pg_hba ]; then
+            trap _exit_pg_init EXIT
             sudo postgresql-setup initdb
+            trap - EXIT
         fi
     elif is_ubuntu; then
         version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`

From 803a7d44c49f6adbfa878ee520756869df1ffe8a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 1 Oct 2024 07:42:34 -0700
Subject: [PATCH 3213/3333] Add image format enforcement toggle

Related to blueprint glance-as-defender

Needed-By: https://review.opendev.org/c/openstack/tempest/+/931028
Change-Id: I8b22ed85eefde399f2e472780106dd39e51a5700
---
 lib/glance  | 4 ++++
 lib/tempest | 1 +
 2 files changed, 5 insertions(+)

diff --git a/lib/glance b/lib/glance
index 274687112e..2eb4954f4a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -104,6 +104,9 @@ GLANCE_ENABLE_QUOTAS=$(trueorfalse True GLANCE_ENABLE_QUOTAS)
 # For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
 GLANCE_ENFORCE_SCOPE=$(trueorfalse True GLANCE_ENFORCE_SCOPE)
 
+# Flag to disable image format inspection on upload
+GLANCE_ENFORCE_IMAGE_FORMAT=$(trueorfalse True GLANCE_ENFORCE_IMAGE_FORMAT)
+
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
@@ -343,6 +346,7 @@ function configure_glance {
     # Only use these if you know what you are doing!  See OSSN-0065
     iniset $GLANCE_API_CONF DEFAULT show_image_direct_url $GLANCE_SHOW_DIRECT_URL
     iniset $GLANCE_API_CONF DEFAULT show_multiple_locations $GLANCE_SHOW_MULTIPLE_LOCATIONS
+    iniset $GLANCE_API_CONF image_format require_image_format_match $GLANCE_ENFORCE_IMAGE_FORMAT
 
     # Configure glance_store
     configure_glance_store $USE_CINDER_FOR_GLANCE $GLANCE_ENABLE_MULTIPLE_STORES
diff --git a/lib/tempest b/lib/tempest
index 310db2daa6..eeeef67a8b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -368,6 +368,7 @@ function configure_tempest {
         if [[ -n "$image_conversion" ]]; then
             iniset $TEMPEST_CONFIG image-feature-enabled image_conversion True
         fi
+        iniset $TEMPEST_CONFIG image-feature-enabled image_format_enforcement $GLANCE_ENFORCE_IMAGE_FORMAT
     fi
 
     iniset $TEMPEST_CONFIG network project_network_cidr $FIXED_RANGE

From 9f9dccd608d5415e0de988a2aa0e74d049038e2a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 7 Oct 2024 11:57:58 -0700
Subject: [PATCH 3214/3333] Switch devstack nodeset to Ubuntu 24.04 (Noble)

Ref: https://governance.openstack.org/tc/goals/selected/migrate-ci-jobs-to-ubuntu-noble.html
Change-Id: I7ac8f9443c386e56c4ca45a171e104f0b350bc7f
---
 .zuul.yaml | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a1c251a398..6a6b686ac1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -439,7 +439,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-jammy
+    nodeset: openstack-single-node-noble
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -686,7 +686,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-jammy
+    nodeset: openstack-two-node-noble
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -727,18 +727,18 @@
       configure_swap_size: 4096
 
 - job:
-    name: devstack-platform-ubuntu-noble
+    name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
-    description: Ubuntu 24.04 LTS (noble) platform test
-    nodeset: openstack-single-node-noble
+    description: Ubuntu 22.04 LTS (Jammy) platform test
+    nodeset: openstack-single-node-jammy
     timeout: 9000
     vars:
       configure_swap_size: 8192
 
 - job:
-    name: devstack-platform-ubuntu-jammy-ovn-source
-    parent: devstack-platform-ubuntu-jammy
-    description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    name: devstack-platform-ubuntu-noble-ovn-source
+    parent: devstack-platform-ubuntu-noble
+    description: Ubuntu 24.04 LTS (noble) platform test (OVN from source)
     voting: false
     vars:
       devstack_localrc:
@@ -748,10 +748,10 @@
         OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
-    name: devstack-platform-ubuntu-jammy-ovs
+    name: devstack-platform-ubuntu-noble-ovs
     parent: tempest-full-py3
-    description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
-    nodeset: openstack-single-node-jammy
+    description: Ubuntu 24.04 LTS (noble) platform test (OVS)
+    nodeset: openstack-single-node-noble
     voting: false
     timeout: 9000
     vars:
@@ -853,7 +853,7 @@
 
 - job:
     name: devstack-unit-tests
-    nodeset: ubuntu-jammy
+    nodeset: ubuntu-noble
     description: |
       Runs unit tests on devstack project.
 
@@ -873,9 +873,9 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy-ovn-source
-        - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-ubuntu-noble
+        - devstack-platform-ubuntu-noble-ovn-source
+        - devstack-platform-ubuntu-noble-ovs
+        - devstack-platform-ubuntu-jammy
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1002,6 +1002,6 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy-ovn-source
-        - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-ubuntu-noble
+        - devstack-platform-ubuntu-noble-ovn-source
+        - devstack-platform-ubuntu-noble-ovs
+        - devstack-platform-ubuntu-jammy

From e8e3eb6dc9353a9df663bfdbb6448bb001ba6ee4 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:20:17 +0100
Subject: [PATCH 3215/3333] doc: Update WSGI section

Change-Id: Iaefe12e7fdeddb0fb6fe272cd4df3ce46470cc28
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/configuration.rst | 28 +++++++++++-----------------
 stackrc                      |  2 +-
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index a83b2de0df..f5f30c4d09 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -351,26 +351,21 @@ Example disabling RabbitMQ in ``local.conf``::
 
   disable_service rabbit
 
-
 Apache Frontend
 ---------------
 
-The Apache web server can be enabled for wsgi services that support
-being deployed under HTTPD + mod_wsgi. By default, services that
-recommend running under HTTPD + mod_wsgi are deployed under Apache. To
-use an alternative deployment strategy (e.g. eventlet) for services
-that support an alternative to HTTPD + mod_wsgi set
-``ENABLE_HTTPD_MOD_WSGI_SERVICES`` to ``False`` in your
-``local.conf``.
-
-Each service that can be run under HTTPD + mod_wsgi also has an
-override toggle available that can be set in your ``local.conf``.
-
-Keystone is run under Apache with ``mod_wsgi`` by default.
+The Apache web server is enabled for services that support via WSGI. Today this
+means HTTPD and uWSGI but historically this meant HTTPD + mod_wsgi. This
+historical legacy is captured by the naming of many variables, which include
+``MOD_WSGI`` rather than ``UWSGI``.
 
-Example (Keystone)::
-
-    KEYSTONE_USE_MOD_WSGI="True"
+Some services support alternative deployment strategies (e.g. eventlet). You
+can enable these ``ENABLE_HTTPD_MOD_WSGI_SERVICES`` to ``False`` in your
+``local.conf``.  In addition, each service that can be run under HTTPD +
+mod_wsgi also has an override toggle available that can be set in your
+``local.conf``. These are, however, slowly being removed as services have
+adopted standardized deployment mechanisms and more generally moved away from
+eventlet.
 
 Example (Nova)::
 
@@ -388,7 +383,6 @@ Example (Cinder)::
 
     CINDER_USE_MOD_WSGI="True"
 
-
 Libraries from Git
 ------------------
 
diff --git a/stackrc b/stackrc
index ab1f8a6ffd..33c18ce0a8 100644
--- a/stackrc
+++ b/stackrc
@@ -85,7 +85,7 @@ fi
 # Global toggle for enabling services under mod_wsgi. If this is set to
 # ``True`` all services that use HTTPD + mod_wsgi as the preferred method of
 # deployment, will be deployed under Apache. If this is set to ``False`` all
-# services will rely on the local toggle variable (e.g. ``KEYSTONE_USE_MOD_WSGI``)
+# services will rely on the local toggle variable.
 ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 
 # Set the default Nova APIs to enable

From 851d82ccca40d61cbfd2319c38e0128bdaea247e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:37:57 +0100
Subject: [PATCH 3216/3333] stackrc: Die if attempting to use mod_wsgi

We do not want to support this anymore.

Change-Id: I8823e98809ed6b66c27dbcf21a00eea68ef403e8
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 stackrc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stackrc b/stackrc
index 33c18ce0a8..c5a0fd4d2f 100644
--- a/stackrc
+++ b/stackrc
@@ -223,6 +223,9 @@ GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 # proxy uwsgi in front of it, or "mod_wsgi", which runs in
 # apache. mod_wsgi is deprecated, don't use it.
 WSGI_MODE=${WSGI_MODE:-"uwsgi"}
+if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+    die $LINENO "$WSGI_MODE is no longer a supported WSGI mode. Only uwsgi is valid."
+fi
 
 # Repositories
 # ------------

From dda40363e6a78b5f3f018a962e5dff14e2c12cd9 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:20:01 +0100
Subject: [PATCH 3217/3333] lib/nova: Remove NOVA_USE_MOD_WSGI

We are in the process of migrating away from Eventlet. Nothing
is setting this to a non-default value, meaning there is no
reason to keep it around any more. Drop it.

Change-Id: I036851810360539335502481955769b2308e3dcc
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/configuration.rst |  4 ----
 lib/nova                     | 38 ++++--------------------------------
 2 files changed, 4 insertions(+), 38 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index f5f30c4d09..6b8a80563d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -367,10 +367,6 @@ mod_wsgi also has an override toggle available that can be set in your
 adopted standardized deployment mechanisms and more generally moved away from
 eventlet.
 
-Example (Nova)::
-
-    NOVA_USE_MOD_WSGI="True"
-
 Example (Swift)::
 
     SWIFT_USE_MOD_WSGI="True"
diff --git a/lib/nova b/lib/nova
index 35c6893763..20e19da9a4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -75,14 +75,6 @@ NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
-# Toggle for deploying Nova-API under a wsgi server. We default to
-# true to use UWSGI, but allow False so that fall back to the
-# eventlet server can happen for grenade runs.
-# NOTE(cdent): We can adjust to remove the eventlet-base api service
-# after pike, at which time we can stop using NOVA_USE_MOD_WSGI to
-# mean "use uwsgi" because we'll be always using uwsgi.
-NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
-
 # We do not need to report service status every 10s for devstack-like
 # deployments. In the gate this generates extra work for the services and the
 # database which are already taxed.
@@ -393,11 +385,7 @@ function create_nova_accounts {
         create_service_user "nova" "admin"
 
         local nova_api_url
-        if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
-            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
-        else
-            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
-        fi
+        nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
 
         get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
         get_or_create_endpoint \
@@ -513,11 +501,6 @@ function create_nova_conf {
             iniset $NOVA_CONF oslo_policy enforce_new_defaults False
             iniset $NOVA_CONF oslo_policy enforce_scope False
         fi
-        if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
-            # Set the service port for a proxy to take the original
-            iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
-            iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
-        fi
 
         configure_keystone_authtoken_middleware $NOVA_CONF nova
     fi
@@ -998,17 +981,8 @@ function start_nova_api {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
-        run_process n-api "$NOVA_BIN_DIR/nova-api"
-        nova_url=$service_protocol://$SERVICE_HOST:$service_port
-        # Start proxy if tsl enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
-        fi
-    else
-        run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
-        nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
-    fi
+    run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
+    nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
 
     echo "Waiting for nova-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $nova_url; then
@@ -1114,11 +1088,7 @@ function start_nova_rest {
     local compute_cell_conf=$NOVA_CONF
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
-    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
-        run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
-    else
-        run_process n-api-meta "$(which uwsgi) --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
-    fi
+    run_process n-api-meta "$(which uwsgi) --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
 
     export PATH=$old_path
 }

From 7e8d5efdf2e0d1ff784e8aee2838e4bc7942856e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:34:18 +0100
Subject: [PATCH 3218/3333] lib/cinder: Remove CINDER_USE_MOD_WSGI

Like Nova, nothing is setting this to False nowadays so there's no
reason to persist with it.

Change-Id: I0e1550992dde81c601175ef04da771ce8ca1dd29
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/configuration.rst |  4 ----
 lib/cinder                   | 39 ++++++------------------------------
 2 files changed, 6 insertions(+), 37 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6b8a80563d..9a1fd4e179 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -375,10 +375,6 @@ Example (Heat)::
 
     HEAT_USE_MOD_WSGI="True"
 
-Example (Cinder)::
-
-    CINDER_USE_MOD_WSGI="True"
-
 Libraries from Git
 ------------------
 
diff --git a/lib/cinder b/lib/cinder
index dc284920e0..259018e7ab 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -160,10 +160,6 @@ fi
 # Supported backup drivers are in lib/cinder_backups
 CINDER_BACKUP_DRIVER=${CINDER_BACKUP_DRIVER:-swift}
 
-# Toggle for deploying Cinder under a wsgi server. Legacy mod_wsgi
-# reference should be cleaned up to more accurately refer to uwsgi.
-CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-True}
-
 # Source the enabled backends
 if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
@@ -393,14 +389,8 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
             # Set the service port for a proxy to take the original
-            if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-                iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
-            else
-                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
-                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
-            fi
+            iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+            iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
         fi
     fi
 
@@ -411,7 +401,7 @@ function configure_cinder {
     iniset_rpc_backend cinder $CINDER_CONF
 
     # Format logging
-    setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
+    setup_logging $CINDER_CONF
 
     if is_service_enabled c-api; then
         write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
@@ -477,11 +467,7 @@ function create_cinder_accounts {
         create_service_user "cinder" $extra_role
 
         local cinder_api_url
-        if [[ "$CINDER_USE_MOD_WSGI" == "False" ]]; then
-            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT"
-        else
-            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume"
-        fi
+        cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume"
 
         # block-storage is the official service type
         get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
@@ -609,10 +595,6 @@ function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
     local cinder_url
-    if is_service_enabled tls-proxy && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-        service_port=$CINDER_SERVICE_PORT_INT
-        service_protocol="http"
-    fi
     if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         if is_service_enabled c-vol; then
             # Delete any old stack.conf
@@ -629,17 +611,8 @@ function start_cinder {
     fi
 
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-            run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-            cinder_url=$service_protocol://$SERVICE_HOST:$service_port
-            # Start proxy if tls enabled
-            if is_service_enabled tls-proxy; then
-                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
-            fi
-        else
-            run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
-            cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
-        fi
+        run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
+        cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
     fi
 
     echo "Waiting for Cinder API to start..."

From e1465f1d73ad146c820d047932af1410dbc18675 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:38:42 +0100
Subject: [PATCH 3219/3333] lib/placement: Remove support for deploying with
 mod_wsgi

Change-Id: If17deabc35d35dca1d94b0d15d258769f347b130
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 files/apache-placement-api.template | 27 -----------------
 lib/placement                       | 47 ++---------------------------
 2 files changed, 3 insertions(+), 71 deletions(-)
 delete mode 100644 files/apache-placement-api.template

diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
deleted file mode 100644
index 011abb95fc..0000000000
--- a/files/apache-placement-api.template
+++ /dev/null
@@ -1,27 +0,0 @@
-# NOTE(sbauza): This virtualhost is only here because some directives can
-# only be set by a virtualhost or server context, so that's why the port is not bound.
-# TODO(sbauza): Find a better way to identify a free port that is not corresponding to an existing
-# vhost.
-<VirtualHost *:8780>
-    WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup placement-api
-    WSGIScriptAlias / %PUBLICWSGI%
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/placement-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-Alias /placement %PUBLICWSGI%
-<Location /placement>
-    SetHandler wsgi-script
-    Options +ExecCGI
-    WSGIProcessGroup placement-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/lib/placement b/lib/placement
index 63fdfb6c1a..6297ab24fe 100644
--- a/lib/placement
+++ b/lib/placement
@@ -71,32 +71,6 @@ function cleanup_placement {
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "placement-api"
 }
 
-# _config_placement_apache_wsgi() - Set WSGI config files
-function _config_placement_apache_wsgi {
-    local placement_api_apache_conf
-    local venv_path=""
-    local placement_bin_dir=""
-    placement_bin_dir=$(get_python_exec_prefix)
-    placement_api_apache_conf=$(apache_site_config_for placement-api)
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["placement"]}/lib/$(python_version)/site-packages"
-        placement_bin_dir=${PROJECT_VENV["placement"]}/bin
-    fi
-
-    sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
-    sudo sed -e "
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$placement_bin_dir/placement-api|g;
-        s|%SSLENGINE%|$placement_ssl|g;
-        s|%SSLCERTFILE%|$placement_certfile|g;
-        s|%SSLKEYFILE%|$placement_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $placement_api_apache_conf
-}
-
 # create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF
@@ -112,11 +86,7 @@ function configure_placement {
     sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
     create_placement_conf
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
-    else
-        _config_placement_apache_wsgi
-    fi
+    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True
@@ -147,7 +117,6 @@ function init_placement {
 
 # install_placement() - Collect source and prepare
 function install_placement {
-    install_apache_wsgi
     # Install the openstackclient placement client plugin for CLI
     pip_install_gr osc-placement
     git_clone $PLACEMENT_REPO $PLACEMENT_DIR $PLACEMENT_BRANCH
@@ -156,12 +125,7 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
-    else
-        enable_apache_site placement-api
-        restart_apache_server
-    fi
+    run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
 
     echo "Waiting for placement-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
@@ -175,12 +139,7 @@ function start_placement {
 
 # stop_placement() - Disable the api service and stop it.
 function stop_placement {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        stop_process "placement-api"
-    else
-        disable_apache_site placement-api
-        restart_apache_server
-    fi
+    stop_process "placement-api"
 }
 
 # Restore xtrace

From 169be464c2ac1c5fc16396e1c320465c4ce6a658 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:42:10 +0100
Subject: [PATCH 3220/3333] lib/keystone: Remove support for deploying with
 mod_wsgi

Change-Id: I2409385a87ee7cc7869bba9711bf95ab5fe77dc7
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/keystone | 46 ++++++----------------------------------------
 1 file changed, 6 insertions(+), 40 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 7d6b05fd41..8f4f4b1366 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -51,15 +51,6 @@ KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
 
-# KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
-# - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
-# - uwsgi : Run keystone under uwsgi
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    KEYSTONE_DEPLOY=uwsgi
-else
-    KEYSTONE_DEPLOY=mod_wsgi
-fi
-
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 
@@ -144,15 +135,9 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        # These files will be created if we are running WSGI_MODE="mod_wsgi"
-        disable_apache_site keystone
-        sudo rm -f $(apache_site_config_for keystone)
-    else
-        stop_process "keystone"
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
-        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-    fi
+    stop_process "keystone"
+    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
+    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
@@ -241,12 +226,7 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
-        _config_keystone_apache_wsgi
-    else # uwsgi
-        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
-    fi
+    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
@@ -543,10 +523,6 @@ function install_keystone {
     if is_service_enabled ldap; then
         setup_develop $KEYSTONE_DIR ldap
     fi
-
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # start_keystone() - Start running processes
@@ -559,12 +535,7 @@ function start_keystone {
         auth_protocol="http"
     fi
 
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        enable_apache_site keystone
-        restart_apache_server
-    else # uwsgi
-        run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
-    fi
+    run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
 
     echo "Waiting for keystone to start..."
     # Check that the keystone service is running. Even if the tls tunnel
@@ -589,12 +560,7 @@ function start_keystone {
 
 # stop_keystone() - Stop running processes
 function stop_keystone {
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        disable_apache_site keystone
-        restart_apache_server
-    else
-        stop_process keystone
-    fi
+    stop_process keystone
 }
 
 # bootstrap_keystone() - Initialize user, role and project

From 29545a5109df51f9e98b715b16968090a3928ab7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 16 Oct 2024 02:50:33 +0000
Subject: [PATCH 3221/3333] Updated from generate-devstack-plugins-list

Change-Id: I374de22c7c916f9497c55bf404141776fd17f6c8
---
 doc/source/plugin-registry.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 21cf52c736..8b9d1f2b96 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,9 +48,7 @@ openstack/ironic-inspector               `https://opendev.org/openstack/ironic-i
 openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
 openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
-openstack/kuryr-kubernetes               `https://opendev.org/openstack/kuryr-kubernetes <https://opendev.org/openstack/kuryr-kubernetes>`__
 openstack/kuryr-libnetwork               `https://opendev.org/openstack/kuryr-libnetwork <https://opendev.org/openstack/kuryr-libnetwork>`__
-openstack/kuryr-tempest-plugin           `https://opendev.org/openstack/kuryr-tempest-plugin <https://opendev.org/openstack/kuryr-tempest-plugin>`__
 openstack/magnum                         `https://opendev.org/openstack/magnum <https://opendev.org/openstack/magnum>`__
 openstack/magnum-ui                      `https://opendev.org/openstack/magnum-ui <https://opendev.org/openstack/magnum-ui>`__
 openstack/manila                         `https://opendev.org/openstack/manila <https://opendev.org/openstack/manila>`__

From 50b0b602279fc0eb8d2bb9cab1d235197df72ec6 Mon Sep 17 00:00:00 2001
From: Takashi Natsume <takanattie@gmail.com>
Date: Sun, 29 Sep 2024 21:28:47 +0900
Subject: [PATCH 3222/3333] Replace deprecated datetime.utcnow()

The datetime.utcnow() is deprecated in Python 3.12.
Replace datetime.utcnow() with
datetime.now(datetime.timezone.utc).replace(tzinfo=None).

Change-Id: I9bf6f69d9e174d490bb4f3eaef3b364ddf97a954
Signed-off-by: Takashi Natsume <takanattie@gmail.com>
---
 tools/outfilter.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index e910f79ff2..55f9ee1487 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -76,7 +76,8 @@ def main():
         # with zuulv3 native jobs and ansible capture it may become
         # clearer what to do
         if HAS_DATE.search(line) is None:
-            now = datetime.datetime.utcnow()
+            now = datetime.datetime.now(datetime.timezone.utc).replace(
+                    tzinfo=None)
             ts_line = ("%s | %s" % (
                 now.strftime("%Y-%m-%d %H:%M:%S.%f")[:-3],
                 line))

From 2e04d0fa20d2f6ceaf537423dad6b00d289b531c Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 24 Oct 2024 00:54:28 +0900
Subject: [PATCH 3223/3333] Globally skip devstack job for pre-commit config
 update

pre-commit has been introduced to number of projects like oslo to run
lint checks such as hacking. The pre-commit config file does not affect
functionality, so devstack job is not needed when only the file is
updated.

Change-Id: I4294fe0c4df2c36c8575613b05a1f9c2eb745d18
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index a1c251a398..b5477d1a8f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -432,6 +432,8 @@
       - ^releasenotes/.*$
       # Translations
       - ^.*/locale/.*po$
+      # pre-commit config
+      - ^.pre-commit-config.yaml$
 
 - job:
     name: devstack-minimal

From 2fdb729e04e8227ac5bfe619df20c1854bf255bc Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Tue, 12 Nov 2024 15:02:15 -0800
Subject: [PATCH 3224/3333] Use venv module for PROJECT_VENV building

Currently, if USE_VENV=True, PROJECT_VENVs are initialized using the
tools/build_venv.sh script; this script depends on the virtualenv
module, which is much less commonly available than the built-in venv
module which we already use many places.

This changes the build_venv.sh script to use `python -m venv` instead.

Needed-By: https://review.opendev.org/c/openstack/ironic/+/930776
Change-Id: I89fa2c0c4261e715064e77a766d98a34299532b3
---
 tools/build_venv.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build_venv.sh b/tools/build_venv.sh
index cfa39a82e0..a439163b5d 100755
--- a/tools/build_venv.sh
+++ b/tools/build_venv.sh
@@ -38,7 +38,7 @@ if [[ -z "$TOP_DIR" ]]; then
 fi
 
 # Build new venv
-virtualenv $VENV_DEST
+python$PYTHON3_VERSION -m venv --system-site-packages $VENV_DEST
 
 # Install modern pip
 PIP_VIRTUAL_ENV=$VENV_DEST pip_install -U pip

From f41479f370e75c7ea7f17a62135f3af99b91c781 Mon Sep 17 00:00:00 2001
From: Joel Capitao <jcapitao@redhat.com>
Date: Mon, 30 Sep 2024 15:14:20 +0200
Subject: [PATCH 3225/3333] Pull RDO Trunk repos when CentOS Stream official
 RPM not available

The RDO project releases centos-release-openstack-* RPM a couple of
weeks after the OpenStack upstream project cut master branch.
In order to fill the gap in the meantime, we have to pull the repos
from RDO Trunk.

Change-Id: If95a687f2d7579779129eeb689cfa46b92450dc5
---
 stack.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index dcfd398c01..bfa0573f21 100755
--- a/stack.sh
+++ b/stack.sh
@@ -308,8 +308,11 @@ function _install_rdo {
             # adding delorean-deps repo to provide current master rpms
             sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
-            # For stable/unmaintained branches use corresponding release rpm
-            sudo dnf -y install centos-release-openstack-${rdo_release}
+            if sudo dnf provides centos-release-openstack-${rdo_release} >/dev/null 2>&1; then
+                sudo dnf -y install centos-release-openstack-${rdo_release}
+            else
+                sudo wget https://trunk.rdoproject.org/centos9-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+            fi
         fi
     fi
     sudo dnf -y update

From c6c5e12f6b1b5f7dac3d9f942c5ab8135618112d Mon Sep 17 00:00:00 2001
From: Joel Capitao <jcapitao@redhat.com>
Date: Wed, 13 Nov 2024 10:33:28 +0100
Subject: [PATCH 3226/3333] Revert "Use SETUPTOOLS_USE_DISTUTILS=stdlib for
 global pip installs"

This partially reverts commit 18b4251bf4f689923a19bf7fbc50d5c2ea422b21.

Support for loading distutils from the standard library is now deprecated
since v70.3.0 [1]. It was needed initially to ease the transition and
can be removed now.

[1] https://setuptools.pypa.io/en/latest/history.html#v70-3-0

Change-Id: Ib929219ae81b802a4632963ef71a258edf4deee5
---
 inc/python | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/inc/python b/inc/python
index 2083b74dc1..c94e5a4952 100644
--- a/inc/python
+++ b/inc/python
@@ -199,13 +199,7 @@ function pip_install {
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
-        # See
-        #  https://github.com/pypa/setuptools/issues/2232
-        #  http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html
-        # this makes setuptools >=50 use the platform distutils.
-        # We only want to do this on global pip installs, not if
-        # installing in a virtualenv
-        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8 SETUPTOOLS_USE_DISTUTILS=stdlib "
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 

From b8cd9d11730206eb81c08b6d181503068b93c1d5 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Thu, 7 Nov 2024 08:27:13 +0000
Subject: [PATCH 3227/3333] Support for s3 backend of glance

This commit introduces support for s3 backend for glance.
You can enabled it in your deployment by adding below options in
your local.conf file.

For single store support:
enable_service s3api s-proxy s-account s-container
disable_service tls-proxy
GLANCE_USE_S3 = True

For multistore support:
enable_service s3api s-proxy s-account s-container
disable_service tls-proxy
GLANCE_USE_S3 = True
GLANCE_ENABLE_MULTIPLE_STORES: True

NOTE: At the moment devstack does not support tls with s3, this
support will be added soon.

Needed-By: https://review.opendev.org/c/openstack/glance/+/934311
Change-Id: Ic7264dc7faccb5e68c8df3b929eaa6d04149c6a2
---
 lib/glance | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 57 insertions(+), 4 deletions(-)

diff --git a/lib/glance b/lib/glance
index 2eb4954f4a..5c3643d008 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,6 +41,12 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+#S3 for Glance
+GLANCE_USE_S3=$(trueorfalse False GLANCE_USE_S3)
+GLANCE_S3_DEFAULT_BACKEND=${GLANCE_S3_DEFAULT_BACKEND:-s3_fast}
+GLANCE_S3_BUCKET_ON_PUT=$(trueorfalse True GLANCE_S3_BUCKET_ON_PUT)
+GLANCE_S3_BUCKET_NAME=${GLANCE_S3_BUCKET_NAME:-images}
+
 # Cinder for Glance
 USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # GLANCE_CINDER_DEFAULT_BACKEND should be one of the values
@@ -174,6 +180,34 @@ function cleanup_glance {
     remove_uwsgi_config "$GLANCE_UWSGI_CONF" "glance-wsgi-api"
 }
 
+# Set multiple s3 store related config options
+#
+function configure_multiple_s3_stores {
+    enabled_backends="${GLANCE_S3_DEFAULT_BACKEND}:s3"
+
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends}
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_S3_DEFAULT_BACKEND
+}
+
+# Set common S3 store options to given config section
+#
+# Arguments:
+# config_section
+#
+function set_common_s3_store_params {
+    local config_section="$1"
+    openstack ec2 credential create
+    iniset $GLANCE_API_CONF $config_section s3_store_host "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$S3_SERVICE_PORT"
+    iniset $GLANCE_API_CONF $config_section s3_store_access_key "$(openstack ec2 credential list -c Access -f value)"
+    iniset $GLANCE_API_CONF $config_section s3_store_secret_key "$(openstack ec2 credential list -c Secret -f value)"
+    iniset $GLANCE_API_CONF $config_section s3_store_create_bucket_on_put $GLANCE_S3_BUCKET_ON_PUT
+    iniset $GLANCE_API_CONF $config_section s3_store_bucket $GLANCE_S3_BUCKET_NAME
+    iniset $GLANCE_API_CONF $config_section s3_store_bucket_url_format "path"
+    if is_service_enabled tls-proxy; then
+        iniset $GLANCE_API_CONF $config_section s3_store_cacert $SSL_BUNDLE_FILE
+    fi
+}
+
 # Set multiple cinder store related config options for each of the cinder store
 #
 function configure_multiple_cinder_stores {
@@ -258,7 +292,6 @@ function configure_glance_store {
     local be
 
     if [[ "$glance_enable_multiple_stores" == "False" ]]; then
-        # Configure traditional glance_store
         if [[ "$use_cinder_for_glance" == "True" ]]; then
             # set common glance_store parameters
             iniset $GLANCE_API_CONF glance_store stores "cinder,file,http"
@@ -281,7 +314,7 @@ function configure_glance_store {
         if [[ "$use_cinder_for_glance" == "True" ]]; then
             # Configure multiple cinder stores for glance
             configure_multiple_cinder_stores
-        else
+        elif ! is_service_enabled s-proxy && [[ "$GLANCE_USE_S3" == "False" ]]; then
             # Configure multiple file stores for glance
             configure_multiple_file_stores
         fi
@@ -360,8 +393,15 @@ function configure_glance {
 
     # No multiple stores for swift yet
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
-        # Store the images in swift if enabled.
-        if is_service_enabled s-proxy; then
+        # Return if s3api is enabled for glance
+        if [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if is_service_enabled s3api; then
+                # set common glance_store parameters
+                iniset $GLANCE_API_CONF glance_store stores "s3,file,http"
+                iniset $GLANCE_API_CONF glance_store default_store s3
+            fi
+        elif is_service_enabled s-proxy; then
+            # Store the images in swift if enabled.
             iniset $GLANCE_API_CONF glance_store default_store swift
             iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
 
@@ -379,6 +419,12 @@ function configure_glance {
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
         fi
+    else
+        if [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if is_service_enabled s3api; then
+                configure_multiple_s3_stores
+            fi
+        fi
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -484,6 +530,13 @@ function create_glance_accounts {
             configure_glance_quotas
         fi
 
+        if is_service_enabled s3api && [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
+                set_common_s3_store_params glance_store
+            else
+                set_common_s3_store_params $GLANCE_S3_DEFAULT_BACKEND
+            fi
+        fi
     fi
 }
 

From 3f1cd9b076b1338d42031e3801cb6316d169c51e Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Tue, 19 Nov 2024 10:50:05 +0000
Subject: [PATCH 3228/3333] Remove the Neutron WSGI experimental jobs

Neutron is moving all the jobs to use the Neutron API WSGI module,
thus this module is no longer an experimental configuration.

Change-Id: Iaf708cd5e6ab414b262a0daecb3909ace2376f68
---
 .zuul.yaml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b5477d1a8f..3632dc03e8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -956,15 +956,6 @@
     #    things, this job is not experimental but often is used to test
     #    things that are not yet production ready or to test what will be
     #    the new default after a deprecation period has ended.
-    # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
-    #    when neutron-api is served by uwsgi, it's in exprimental for testing.
-    #    the next cycle we can remove this  job if things turn out to be
-    #    stable enough.
-    # * neutron-functional-with-uwsgi: maintained by neutron for functional
-    #    test. Next cycle we can remove this one if things turn out to be
-    #    stable engouh with uwsgi.
-    # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
-    #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and now is voting in the
     #    check queue for nova changes but relies on devstack configuration
 
@@ -972,9 +963,6 @@
       jobs:
         - nova-multi-cell
         - nova-next
-        - neutron-fullstack-with-uwsgi
-        - neutron-functional-with-uwsgi
-        - neutron-ovn-tempest-with-uwsgi
         - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$

From df0bfe4d5c3519d5c4deb5033bec2217c90c9425 Mon Sep 17 00:00:00 2001
From: 0weng <oweng@osuosl.org>
Date: Tue, 12 Nov 2024 11:44:13 -0800
Subject: [PATCH 3229/3333] Doc: Fix variable name in logging config example

$LOGDIR --> $DEST

Change-Id: I461422f48525edf4ecb388b2f962edb03795db50
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 9a1fd4e179..3cfba716ca 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -323,7 +323,7 @@ a file, keep service logs and disable color in the stored files.
 
    [[local|localrc]]
    DEST=/opt/stack/
-   LOGFILE=$LOGDIR/stack.sh.log
+   LOGFILE=$DEST/stack.sh.log
    LOG_COLOR=False
 
 Database Backend

From c1eeb773a85b0485b6329e325ac1685d8e3b2dc4 Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Thu, 10 Oct 2024 15:26:52 +0200
Subject: [PATCH 3230/3333] lib/keystone: Migrate Keystone to WSGI module path

Depends-on: https://review.opendev.org/c/openstack/keystone/+/932060
Change-Id: I10bea74fb0bce1888d324a61f23c25b8f7082e97
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 8f4f4b1366..76e2598ba3 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -49,7 +49,7 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
+KEYSTONE_PUBLIC_UWSGI=keystone.wsgi.api:application
 
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
@@ -226,7 +226,7 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
+    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "" "keystone-api"
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 

From 6578d6ad27f04bdbfd1c30a13a7fc7ae47c2fb49 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 23 Nov 2024 21:44:17 +0900
Subject: [PATCH 3231/3333] Remove unused python-etcd3

python-etcd3 can't be used since etcd3 driver was removed from tooz in
tooz 5.0.0 [1].

[1] 6bc02cda5b452bbf4821621eafc031bd676f8a2f

Change-Id: I30b895b4473e2676085e27969a43b91be9b1e413
---
 lib/libraries | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..fa418785dd 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -131,12 +131,7 @@ function install_libs {
     # python client libraries we might need from git can go here
     _install_lib_from_source "python-barbicanclient"
 
-
     # etcd (because tooz does not have a hard dependency on these)
-    #
-    # NOTE(sdague): this is currently a work around because tooz
-    # doesn't pull in etcd3.
-    pip_install etcd3
     pip_install etcd3gw
 }
 

From ef63c690f119e3d9a7890215ee8832da4f5fb4dc Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 24 Nov 2024 22:48:08 +0900
Subject: [PATCH 3232/3333] Drop redundant lib/oslo

It was kept for compatibility in renaming which was merged long ago[1],
and is no longer necessary.

[1] 3ed99c0b27122ff00e2d236086ab16b0cc1887c1

Depends-on: https://review.opendev.org/c/openstack/grenade/+/936095
Change-Id: I6a66359c19d0385beafb4c5e57b6ec3cd6d9cc54
---
 clean.sh      |  2 +-
 lib/libraries |  2 +-
 lib/oslo      | 11 -----------
 3 files changed, 2 insertions(+), 13 deletions(-)
 delete mode 100644 lib/oslo

diff --git a/clean.sh b/clean.sh
index 6a31cc624a..092f557a88 100755
--- a/clean.sh
+++ b/clean.sh
@@ -40,7 +40,7 @@ source $TOP_DIR/lib/rpc_backend
 
 source $TOP_DIR/lib/tls
 
-source $TOP_DIR/lib/oslo
+source $TOP_DIR/lib/libraries
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..9d5d65532e 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# lib/oslo
+# lib/libraries
 #
 # Functions to install libraries from git
 #
diff --git a/lib/oslo b/lib/oslo
deleted file mode 100644
index 3ae64c8210..0000000000
--- a/lib/oslo
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-#
-# lib/oslo
-#
-# Functions to install **Oslo** libraries from git
-#
-# We need this to handle the fact that projects would like to use
-# pre-released versions of oslo libraries.
-#
-# Included for compatibility with grenade, remove in Queens
-source $TOP_DIR/lib/libraries

From ec49b3e1672ef47d59509132e95f94d6be13abfe Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 27 Nov 2024 02:42:01 +0000
Subject: [PATCH 3233/3333] Updated from generate-devstack-plugins-list

Change-Id: I344c3492159d53c68002b78ac3c385c1beca0e61
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 8b9d1f2b96..2984a5c15f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -31,6 +31,7 @@ openstack/ceilometer                     `https://opendev.org/openstack/ceilomet
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
+openstack/designate-tempest-plugin       `https://opendev.org/openstack/designate-tempest-plugin <https://opendev.org/openstack/designate-tempest-plugin>`__
 openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__

From 451236381d4f6af0072b60fc65743b55ee33ab95 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 29 Nov 2024 07:39:37 +0000
Subject: [PATCH 3234/3333] Add start time (in seconds) to the WSGI
 configuration file

This new variable "start-time" is initialized when the WSGI
starts and is the timestamp in seconds.

Related-Bug: #2083570
Change-Id: I1b984b93d1352683097c1417b22d64341a68f72a
---
 lib/apache | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/apache b/lib/apache
index 1420f76ff2..1c034d3c7e 100644
--- a/lib/apache
+++ b/lib/apache
@@ -293,6 +293,8 @@ function write_uwsgi_config {
     iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
     iniset "$conf" uwsgi lazy-apps true
+    # Starting time of the WSGi server
+    iniset "$conf" uwsgi start-time %t
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
@@ -367,6 +369,8 @@ function write_local_uwsgi_http_config {
     iniset "$conf" uwsgi http-keepalive false
     # Increase socket timeout for slow chunked uploads
     iniset "$conf" uwsgi socket-timeout 30
+    # Starting time of the WSGi server
+    iniset "$conf" uwsgi start-time %t
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http

From 97ea68ec4611391de2e245a1def655cbebc7649d Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 2 Dec 2024 17:46:42 +0530
Subject: [PATCH 3235/3333] Fix the db user for mariadb in ubuntu 24.04

It was fixed in past for ubuntu 22.04 with [1],
removing the check for jammy so it applies to
all ubuntu versions since jammy.
The checks now only refer debian distros so those
can be adjusted with new debian releases.

[1] https://review.opendev.org/c/openstack/devstack/+/866944

Related-Bug: #1999090
Closes-Bug: #2090835
Change-Id: Iff843c5c3f9c081aa1cec6c399a6ed8c05e06abe
---
 lib/databases/mysql | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index e069e128e9..629014c1d8 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -104,10 +104,10 @@ function configure_database_mysql {
     # Set the root password - only works the first time. For Ubuntu, we already
     # did that with debconf before installing the package, but we still try,
     # because the package might have been installed already. We don't do this
-    # for Ubuntu 22.04 (jammy) because the authorization model change in
+    # for Ubuntu 22.04+ because the authorization model change in
     # version 10.4 of mariadb. See
     # https://mariadb.org/authentication-in-mariadb-10-4/
-    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
@@ -124,16 +124,11 @@ function configure_database_mysql {
     # we need to change auth plugin for root user
     # TODO(frickler): simplify this logic
     if is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
-        if [[ "$DISTRO" == "jammy" ]]; then
-            # For Ubuntu 22.04 (jammy) we follow the model outlined in
-            # https://mariadb.org/authentication-in-mariadb-10-4/
-            sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
-        else
-            sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
-            sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
-        fi
+        # For Ubuntu 22.04+ we follow the model outlined in
+        # https://mariadb.org/authentication-in-mariadb-10-4/
+        sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
     fi
-    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
         # Create DB user if it does not already exist
         sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
         # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:

From 320c2bf42ae41d751c72d80a6c85b26f3f6951bd Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 3 Dec 2024 17:04:39 +0000
Subject: [PATCH 3236/3333] Install setuptools 'core' extra

Under as-yet-unidentified conditions, we can end up with a version of
packaging that is too old for the version of latest version of
setuptools. This is a known issue and expected behavior and per [1]
$subject is the preferred resolution.

[1] https://github.com/pypa/setuptools/issues/4483#issuecomment-2237219597

Change-Id: I9232f3fae1598297e83c4ea37339896f7dcbd44f
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 inc/python | 4 ++--
 lib/infra  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index c94e5a4952..857f1f2d06 100644
--- a/inc/python
+++ b/inc/python
@@ -40,8 +40,8 @@ function setup_devstack_virtualenv {
         # Using system site packages to enable nova to use libguestfs.
         # This package is currently installed via the distro and not
         # available on pypi.
-        python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
-        pip_install -U pip setuptools
+        $PYTHON -m venv --system-site-packages "${DEVSTACK_VENV}"
+        pip_install -U pip setuptools[core]
         #NOTE(rpittau): workaround for simplejson removal in osc
         #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
         pip_install -U simplejson
diff --git a/lib/infra b/lib/infra
index 2aad00354a..f4760c352c 100644
--- a/lib/infra
+++ b/lib/infra
@@ -31,7 +31,7 @@ function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
     [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools[core]
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
     # Unset the PIP_VIRTUAL_ENV so that PBR does not end up trapped

From 9486709dc5e6f156dc5beb051f1861ea362ae10c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 3 Dec 2024 17:07:57 +0000
Subject: [PATCH 3237/3333] Revert "Install simplejson in devstack venv"

This reverts commit 6990b06cd321930f69907ba42ee744755f8029fe. This
should no longer be necessary as packages are requiring simplejson.

Change-Id: I74b0f93457f91e7d53d54737d52f67075088faca
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 inc/python | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/inc/python b/inc/python
index 857f1f2d06..bd58905e9e 100644
--- a/inc/python
+++ b/inc/python
@@ -42,9 +42,6 @@ function setup_devstack_virtualenv {
         # available on pypi.
         $PYTHON -m venv --system-site-packages "${DEVSTACK_VENV}"
         pip_install -U pip setuptools[core]
-        #NOTE(rpittau): workaround for simplejson removal in osc
-        #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
-        pip_install -U simplejson
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"

From 5bf9d13f2737ca9c8a15b7d250a48ef8be935a05 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 9 Dec 2024 14:03:44 +0000
Subject: [PATCH 3238/3333] lib/placement: Migrate placement to WSGI module
 path

Change-Id: If9e2cc9247d707a451ef394615e547515115f9e0
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/placement/+/919569
---
 lib/placement | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index 6297ab24fe..03aaa0344b 100644
--- a/lib/placement
+++ b/lib/placement
@@ -37,7 +37,7 @@ if [[ ${USE_VENV} = True ]]; then
 else
     PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
 fi
-PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/placement-api
+PLACEMENT_UWSGI=placement.wsgi.api:application
 PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 if is_service_enabled tls-proxy; then
@@ -86,7 +86,7 @@ function configure_placement {
     sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
     create_placement_conf
 
-    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
+    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement" "" "placement-api"
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True

From 05f7d302cfa2da73b2887afcde92ef65b1001194 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 7 Dec 2023 10:48:10 +0000
Subject: [PATCH 3239/3333] lib/cinder: Migrate cinder to WSGI module path

Change-Id: I494dae51c65318299d4fe2ff5887c97ac2be3224
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/cinder/+/902876
---
 lib/cinder | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 259018e7ab..b557d4b10b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -62,7 +62,7 @@ CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
-CINDER_UWSGI=$CINDER_BIN_DIR/cinder-wsgi
+CINDER_UWSGI=cinder.wsgi.api:application
 CINDER_UWSGI_CONF=$CINDER_CONF_DIR/cinder-api-uwsgi.ini
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
@@ -404,7 +404,7 @@ function configure_cinder {
     setup_logging $CINDER_CONF
 
     if is_service_enabled c-api; then
-        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume" "" "cinder-api"
     fi
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then

From b8cbcff693f3f1ddfa9c60c7c826629987a2d23e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 25 Mar 2024 20:00:10 +0900
Subject: [PATCH 3240/3333] Drop removed glance-cache.conf options

These were removed when glance-registry was removed[1].

[1] 30680961994b36ed12713c0f106b661535ce41c6

Change-Id: Iaa4a35fddcd4763e12e5140b71e4022421c476fc
---
 lib/glance | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/glance b/lib/glance
index 5c3643d008..6d6b158e74 100644
--- a/lib/glance
+++ b/lib/glance
@@ -446,10 +446,6 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/

From c9a4454450429491c34184d0ceb85eaba62cc525 Mon Sep 17 00:00:00 2001
From: Fernando Royo <froyo@redhat.com>
Date: Thu, 12 Dec 2024 11:01:36 +0100
Subject: [PATCH 3241/3333] Removing start_ovn_services call

The function _start_ovn is responsible for starting the
OVS/OVN services. However, its final action is a call
to _start_ovn_services, which restarts all OVS/OVN services
without any justified reason.

This patch removes that call to avoid unnecessarily
restarting all OVS/OVN services immediately after they
have been started.

Closes-Bug: #2091614
Change-Id: Ia791ecb734531fa933c570d687ac9224ed6b27e4
---
 lib/neutron_plugins/ovn_agent | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index be3a9e78b2..b7633c8c17 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -704,30 +704,6 @@ function _start_ovs {
     fi
 }
 
-function _start_ovn_services {
-    _start_process "$OVSDB_SERVER_SERVICE"
-    _start_process "$OVS_VSWITCHD_SERVICE"
-
-    if is_service_enabled ovn-northd ; then
-        _start_process "$OVN_NORTHD_SERVICE"
-    fi
-    if is_service_enabled ovn-controller ; then
-        _start_process "$OVN_CONTROLLER_SERVICE"
-    fi
-    if is_service_enabled ovn-controller-vtep ; then
-        _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
-    fi
-    if is_service_enabled ovs-vtep ; then
-        _start_process "devstack@ovs-vtep.service"
-    fi
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
-        _start_process "devstack@q-ovn-metadata-agent.service"
-    fi
-    if is_service_enabled q-ovn-agent neutron-ovn-agent ; then
-        _start_process "devstack@q-ovn-agent.service"
-    fi
-}
-
 # start_ovn() - Start running processes, including screen
 function start_ovn {
     echo "Starting OVN"
@@ -797,8 +773,6 @@ function start_ovn {
         # Format logging
         setup_logging $OVN_AGENT_CONF
     fi
-
-    _start_ovn_services
 }
 
 function _stop_ovs_dp {

From bf04bf517b839fa495384f636b7f8d4f05c6fa0e Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 27 Dec 2024 13:01:16 +0530
Subject: [PATCH 3242/3333] Switch to OVS/OVN LTS branches

As discussed in Epoxy PTG[1] switching jobs to run
with latest OVS/OVN LTS branches.
Ubuntu noble and CentOS 9-stream also including these
LTS versions.

[1] https://etherpad.opendev.org/p/oct2024-ptg-neutron

Change-Id: Iecb33628641cd33b6e46d09759e3180cc0bd55e9
---
 .zuul.yaml                     | 4 ++--
 lib/neutron_plugins/ovn_agent  | 2 +-
 lib/neutron_plugins/ovs_source | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2fbfa0417c..74ce39cdfa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -745,8 +745,8 @@
     vars:
       devstack_localrc:
         OVN_BUILD_FROM_SOURCE: True
-        OVN_BRANCH: "v21.06.0"
-        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVN_BRANCH: "branch-24.03"
+        OVS_BRANCH: "branch-3.3"
         OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index be3a9e78b2..ad5c1f3003 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -28,7 +28,7 @@ source ${TOP_DIR}/lib/neutron_plugins/ovs_source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
 OVN_REPO_NAME=${OVN_REPO_NAME:-ovn}
-OVN_BRANCH=${OVN_BRANCH:-v20.06.1}
+OVN_BRANCH=${OVN_BRANCH:-branch-24.03}
 # The commit removing OVN bits from the OVS tree, it is the commit that is not
 # present in OVN tree and is used to distinguish if OVN is part of OVS or not.
 # https://github.com/openvswitch/ovs/commit/05bf1dbb98b0635a51f75e268ef8aed27601401d
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 75e7d7cb36..6b6f531a01 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -20,7 +20,7 @@ Q_BUILD_OVS_FROM_GIT=$(trueorfalse False Q_BUILD_OVS_FROM_GIT)
 OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}
 OVS_REPO_NAME=$(basename ${OVS_REPO} | cut -f1 -d'.')
 OVS_REPO_NAME=${OVS_REPO_NAME:-ovs}
-OVS_BRANCH=${OVS_BRANCH:-0047ca3a0290f1ef954f2c76b31477cf4b9755f5}
+OVS_BRANCH=${OVS_BRANCH:-branch-3.3}
 
 # Functions
 

From b609c80a36f7ac77c1eb7ec256e6808ab483440b Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 7 Jan 2025 10:51:03 +0900
Subject: [PATCH 3243/3333] doc: Use dnf instead of yum

The yum command has been replaced by the dnf command in recent releases
of Fedora-based distributions. Use the native command instead of
the alias kept for compatibility.

Change-Id: I0a1dfdaca91164eff2c25795f66976ec70356574
---
 doc/source/guides/multinode-lab.rst  | 2 +-
 doc/source/guides/single-machine.rst | 4 ++--
 doc/source/guides/single-vm.rst      | 4 ++--
 doc/source/networking.rst            | 2 +-
 doc/source/plugins.rst               | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 658422b0af..4b50b2c4ae 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -24,7 +24,7 @@ Install a couple of packages to bootstrap configuration:
 
 ::
 
-    apt-get install -y git sudo || yum install -y git sudo
+    apt-get install -y git sudo || dnf install -y git sudo
 
 Network Configuration
 ---------------------
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a4385b5b4b..263fbb9d6f 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -62,7 +62,7 @@ to have sudo privileges:
 
 .. code-block:: console
 
-    $ apt-get install sudo -y || yum install -y sudo
+    $ apt-get install sudo -y || dnf install -y sudo
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 .. note:: On some systems you may need to use ``sudo visudo``.
@@ -81,7 +81,7 @@ We'll grab the latest version of DevStack via https:
 
 .. code-block:: console
 
-    $ sudo apt-get install git -y || sudo yum install -y git
+    $ sudo apt-get install git -y || sudo dnf install -y git
     $ git clone https://opendev.org/openstack/devstack
     $ cd devstack
 
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 7dac18b333..4272a4b180 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -56,8 +56,8 @@ passed as the user-data file when booting the VM.
     write_files:
       - content: |
             #!/bin/sh
-            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo yum update -qy
-            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
+            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo dnf update -qy
+            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo dnf install -qy git
             sudo chown stack:stack /home/stack
             cd /home/stack
             git clone https://opendev.org/openstack/devstack
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 05b4f34164..10e1c3ff2c 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -213,7 +213,7 @@ install ``sshuttle`` on your localhost:
 
 .. code-block:: bash
 
-    sudo apt-get install sshuttle || yum install sshuttle
+    sudo apt-get install sshuttle || dnf install sshuttle
 
 Finally, start ``sshuttle`` on your localhost using the floating IP address
 range. For example, assuming you are using the default value for
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index dd75b5a22d..fe567e2277 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -232,7 +232,7 @@ an early phase of its execution.  These packages may be defined in a
 plugin as files that contain new-line separated lists of packages
 required by the plugin
 
-Supported packaging systems include apt and yum across multiple
+Supported packaging systems include apt and dnf across multiple
 distributions.  To enable a plugin to hook into this and install
 package dependencies, packages may be listed at the following
 locations in the top-level of the plugin repository:

From 9a1cdbc3c809f785ad01a3bbdfef8f552eafce30 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Wed, 8 Jan 2025 18:43:40 +0530
Subject: [PATCH 3244/3333] Update glance image size limit

The image size limit for glance using the unified limits is
set to 1000MB (~1GB). This is pretty low given that a volume's
minimum size is 1GB and when uploaded to glance fills out the
whole limit.

The limit issue can also be seen by a recent tempest change[1]
where uploading two volumes failed[2] across various jobs due
to this limit.

We do have a config option in devstack
``GLANCE_LIMIT_IMAGE_SIZE_TOTAL`` but that will need to be
configured for various jobs and a 2GB seems to be a sensible
default which this patch configures.

[1] https://review.opendev.org/c/openstack/tempest/+/938592
[2] Jan 07 23:05:33 devstack-ceph cinder-volume[909965]: ERROR
oslo_messaging.rpc.server cinder.exception.ImageLimitExceeded:
HTTP 413 Request Entity Too Large: The request returned a 413
Request Entity Too Large. This generally means that rate limiting
or a quota threshold was breached.: The response body:: Project
dfe8648c188d46409349eac2c449c0b4 is over a limit for [Resource
image_size_total is over limit of 1000 due to current usage
1024 and delta 0]

Change-Id: I533b7444e5f71275ea3d5c18914e306b1dbbc5cb
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 5c3643d008..9655cc4103 100644
--- a/lib/glance
+++ b/lib/glance
@@ -137,7 +137,7 @@ GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 
 # Glance default limit for Devstack
-GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-1000}
+GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-2000}
 
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
 # TODO(mtreinish): Remove the eventlet path here and in all the similar

From ad698f0b8c658fcdddb11d5edae1e77f08b5d0b5 Mon Sep 17 00:00:00 2001
From: Jakub Libosvar <libosvar@redhat.com>
Date: Wed, 8 Jan 2025 15:26:41 -0500
Subject: [PATCH 3245/3333] Introduce SERVICES_FOR_TEMPEST variable for localrc

This variable overrides the `ENABLED_SERVICES` global variable only for
the `configure_tempest()` function from `lib/tempest`. If the
`SERVICES_FOR_TEMPEST` variable is not defined then `ENABLED_SERVICES`
is used as it had used it before.

This is useful for cases where Tempest is executed from a remote node.

Change-Id: Ic62e48f2f1eb861ec64f51e03353868076cbcc04
---
 doc/source/guides/multinode-lab.rst | 42 +++++++++++++++++++++++++++++
 lib/tempest                         |  2 ++
 2 files changed, 44 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 658422b0af..e6b0b96eb4 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -210,6 +210,48 @@ only needs to be performed for subnodes.
 
 .. _Cells v2: https://docs.openstack.org/nova/latest/user/cells.html
 
+Configure Tempest Node to run the Tempest tests
+-----------------------------------------------
+
+If there is a need to execute Tempest tests against different Cluster
+Controller node then it can be done by re-using the ``local.conf`` file from
+the Cluster Controller node but with not enabled Controller services in
+``ENABLED_SERVICES`` variable. This variable needs to contain only ``tempest``
+as a configured service. Then variable ``SERVICES_FOR_TEMPEST`` must be
+configured to contain those services that were enabled on the Cluster
+Controller node in the ``ENABLED_SERVICES`` variable. For example the
+``local.conf`` file could look as follows:
+
+::
+
+    [[local|localrc]]
+    HOST_IP=192.168.42.12 # change this per compute node
+    FIXED_RANGE=10.4.128.0/20
+    FLOATING_RANGE=192.168.42.128/25
+    LOGFILE=/opt/stack/logs/stack.sh.log
+    ADMIN_PASSWORD=labstack
+    DATABASE_PASSWORD=supersecret
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
+    DATABASE_TYPE=mysql
+    SERVICE_HOST=192.168.42.11
+    MYSQL_HOST=$SERVICE_HOST
+    RABBIT_HOST=$SERVICE_HOST
+    GLANCE_HOSTPORT=$SERVICE_HOST:9292
+    NOVA_VNC_ENABLED=True
+    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
+    VNCSERVER_LISTEN=$HOST_IP
+    VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
+    ENABLED_SERVICES=tempest
+    SERVICES_FOR_TEMPEST=keystone,nova,neutron,glance
+
+Then just execute the devstack:
+
+::
+
+    ./stack.sh
+
+
 Cleaning Up After DevStack
 --------------------------
 
diff --git a/lib/tempest b/lib/tempest
index eeeef67a8b..b8f9915a87 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -197,6 +197,8 @@ function configure_tempest {
         pip_install_gr testrepository
     fi
 
+    local ENABLED_SERVICES=${SERVICES_FOR_TEMPEST:=$ENABLED_SERVICES}
+
     local image_lines
     local images
     local num_images

From a976168235bd79c9a8c960aa4889fe9ab03570c0 Mon Sep 17 00:00:00 2001
From: Fernando Royo <froyo@redhat.com>
Date: Wed, 4 Dec 2024 16:44:52 +0100
Subject: [PATCH 3246/3333] Refactor readiness and custom config for ovn-nortd

Initially, this patch ensured that the custom configuration
and readiness checks were applied after every restart of the
OVN North services. However, after removing the call that
triggered the restarting of the OVN/OVS services in [1],
this patch now serves as a refactor, separating the readiness
checks and custom configuration into a dedicated function.

[1] https://review.opendev.org/c/openstack/devstack/+/937606

Related-bug: #2091614
Related-bug: #2091019
Change-Id: Icba271292830204da94aa3353e93d52088d82eec
---
 lib/neutron_plugins/ovn_agent | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b7633c8c17..8c5d82d3f0 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -704,6 +704,25 @@ function _start_ovs {
     fi
 }
 
+function _wait_for_ovn_and_set_custom_config {
+    # Wait for the service to be ready
+    # Check for socket and db files for both OVN NB and SB
+    wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
+    wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
+    wait_for_db_file $OVN_DATADIR/ovnnb_db.db
+    wait_for_db_file $OVN_DATADIR/ovnsb_db.db
+
+    if is_service_enabled tls-proxy; then
+        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+    fi
+
+    sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+    sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+    sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+    sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+}
+
 # start_ovn() - Start running processes, including screen
 function start_ovn {
     echo "Starting OVN"
@@ -725,21 +744,8 @@ function start_ovn {
             _start_process "$OVN_NORTHD_SERVICE"
         fi
 
-        # Wait for the service to be ready
-        # Check for socket and db files for both OVN NB and SB
-        wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
-        wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
-        wait_for_db_file $OVN_DATADIR/ovnnb_db.db
-        wait_for_db_file $OVN_DATADIR/ovnsb_db.db
+        _wait_for_ovn_and_set_custom_config
 
-        if is_service_enabled tls-proxy; then
-            sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-            sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-        fi
-        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
-        sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then

From 7129f3a45e66060d19a250e31fd35156e45a8af8 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Fri, 10 Jan 2025 11:02:35 -0500
Subject: [PATCH 3247/3333] Quiet regex SyntaxWarning in mlock_report

Use a raw string to avoid SyntaxWarnings being
issued by this script.

Change-Id: I81557158013aa36fe27235c461486dfbc37c9f27
---
 tools/mlock_report.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 1b081bbe6f..8cbda15895 100644
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -6,7 +6,7 @@
 
 
 LCK_SUMMARY_REGEX = re.compile(
-    "^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
+    r"^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
 
 
 def main():

From 497b4fdf97d8b4e5f1ea1130f4e145014bbb462c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 18 Oct 2024 13:47:55 +0100
Subject: [PATCH 3248/3333] lib/glance: Migrate Glance to WSGI module path

We also remove an out-of-date note from the called method.

Change-Id: I7cc9fd6a568246342395388c31ae0a0918a2c79a
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/glance/+/932701
---
 lib/apache | 4 +---
 lib/glance | 7 +++----
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/lib/apache b/lib/apache
index 1c034d3c7e..fc174f3901 100644
--- a/lib/apache
+++ b/lib/apache
@@ -313,9 +313,7 @@ function write_uwsgi_config {
 # For services using chunked encoding, the only services known to use this
 # currently are Glance and Swift, we need to use an http proxy instead of
 # mod_proxy_uwsgi because the chunked encoding gets dropped. See:
-# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
-# but that involves having apache buffer the request before sending it to
-# uwsgi.
+# https://github.com/unbit/uwsgi/issues/1540.
 function write_local_uwsgi_http_config {
     local conf=$1
     local wsgi=$2
diff --git a/lib/glance b/lib/glance
index 9655cc4103..4e519102ec 100644
--- a/lib/glance
+++ b/lib/glance
@@ -133,7 +133,7 @@ GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI=glance.wsgi.api:application
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 
 # Glance default limit for Devstack
@@ -472,12 +472,11 @@ function configure_glance {
     fi
 
     if [[ "$GLANCE_STANDALONE" == False ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
         # Grab our uwsgi listen address and use that to fill out our
         # worker_self_reference_url config
         iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
-               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' \
-                    $GLANCE_UWSGI_CONF)
+               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
     else
         write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS

From d84761e18676a04fc9d1b9e68dff9c573fdd3ba1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 28 Jan 2025 02:20:15 +0000
Subject: [PATCH 3249/3333] Updated from generate-devstack-plugins-list

Change-Id: Ic2239e12306226943c645b7c439d5636f8c3df0e
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2984a5c15f..f7873c962d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -38,6 +38,7 @@ openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
+openstack/devstack-plugin-prometheus     `https://opendev.org/openstack/devstack-plugin-prometheus <https://opendev.org/openstack/devstack-plugin-prometheus>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
@@ -169,7 +170,6 @@ x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nov
 x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
 x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
 x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
-x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__

From a08a53de424e3ed8cad4cbaf566d0b08f8ad5199 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 30 Jan 2025 12:43:30 +0100
Subject: [PATCH 3250/3333] Remove leftover from the usage of the removed
 lib/neutron module

In the patch [1] lib/neutron module was removed completely but it left
call to the non existing currently function 'start_neutron_api' when the
neutron-api service is enabled.
Devstack should start neutron in the same way in case when q-svc or
neutron-api service is enabled and this patch is removing that leftover
call to the 'start_neutron_api' function and make it behave the same way
for both service names.

Additionally this patch adds service "neutron-api" to be checked when
initial networks are going to be created. It is like that as just one of
the services "q-svc" or "neutron-api" is enough to create those initial
networks.

[1] https://review.opendev.org/c/openstack/devstack/+/865014

Related-bug: #2096912
Change-Id: I1287af6a31f60b4e522f0ce3ea525e3336ffd8ba
---
 stack.sh | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index bfa0573f21..b1c7df5d73 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1307,10 +1307,7 @@ if is_service_enabled ovn-controller ovn-controller-vtep; then
     start_ovn_services
 fi
 
-if is_service_enabled neutron-api; then
-    echo_summary "Starting Neutron"
-    start_neutron_api
-elif is_service_enabled q-svc; then
+if is_service_enabled q-svc neutron-api; then
     echo_summary "Starting Neutron"
     configure_neutron_after_post_config
     start_neutron_service_and_check
@@ -1327,7 +1324,7 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
+if is_service_enabled q-svc neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
     # Here's where plugins can wire up their own networks instead
     # of the code in lib/neutron_plugins/services/l3

From 12abc726e68b547258978c7fbe3630d133f72943 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Mon, 10 Feb 2025 13:48:37 -0500
Subject: [PATCH 3251/3333] Remove Neutron Linux Bridge agent code

Linux Bridge agent support was removed in the Neutron
master branch in [0], let's remove any code here now
as well since it will just fail.

[0] https://review.opendev.org/c/openstack/neutron/+/927216

Change-Id: Idffa6579000322acfeb860189fb83a317d56bb4e
---
 doc/source/guides/neutron.rst         |  40 +---------
 doc/source/overview.rst               |   2 +-
 lib/neutron                           |  19 +----
 lib/neutron_plugins/linuxbridge_agent | 104 --------------------------
 lib/neutron_plugins/ml2               |   3 -
 lib/neutron_plugins/services/l3       |  10 ---
 tools/worlddump.py                    |   1 -
 7 files changed, 3 insertions(+), 176 deletions(-)
 delete mode 100644 lib/neutron_plugins/linuxbridge_agent

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index fb36b3ec5b..a7adeeff73 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -451,44 +451,6 @@ by default. If you want to remove all the extension drivers (even
 'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 
 
-Using Linux Bridge instead of Open vSwitch
-------------------------------------------
-
-The configuration for using the Linux Bridge ML2 driver is fairly
-straight forward. The Linux Bridge configuration for DevStack is similar
-to the :ref:`Open vSwitch based single interface <single-interface-ovs>`
-setup, with small modifications for the interface mappings.
-
-
-::
-
-    [[local|localrc]]
-    HOST_IP=172.18.161.6
-    SERVICE_HOST=172.18.161.6
-    MYSQL_HOST=172.18.161.6
-    RABBIT_HOST=172.18.161.6
-    GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secret
-    DATABASE_PASSWORD=secret
-    RABBIT_PASSWORD=secret
-    SERVICE_PASSWORD=secret
-
-    ## Neutron options
-    Q_USE_SECGROUP=True
-    FLOATING_RANGE="172.18.161.0/24"
-    IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/24"
-    Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
-    PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-    PUBLIC_INTERFACE=eth0
-
-    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-
-    # Linuxbridge Settings
-    Q_AGENT=linuxbridge
-    LB_PHYSICAL_INTERFACE=eth0
-    PUBLIC_PHYSICAL_NETWORK=default
-    LB_INTERFACE_MAPPINGS=default:eth0
-
 Using MacVTap instead of Open vSwitch
 ------------------------------------------
 
@@ -556,7 +518,7 @@ the MacVTap mechanism driver:
 
     [[local|localrc]]
     ...
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,macvtap
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,macvtap
     ...
 
 For the MacVTap compute node, use this local.conf:
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 4384081769..81e58a341e 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -56,7 +56,7 @@ OpenStack Network
 -----------------
 
 -  Neutron: A basic configuration approximating the original FlatDHCP
-   mode using linuxbridge or OpenVSwitch.
+   mode using OpenVSwitch.
 
 Services
 --------
diff --git a/lib/neutron b/lib/neutron
index bcef8a5042..69ff212991 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -241,8 +241,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # If using VLANs for tenant networks, or if using flat or VLAN
 # provider networks, set in ``localrc`` to the name of the physical
 # network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
-# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
-# agent, as described below.
+# openvswitch agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
 PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
@@ -257,18 +256,6 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-# With the linuxbridge agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the network interface to use for the physical
-# network.
-#
-# Example: ``LB_PHYSICAL_INTERFACE=eth1``
-if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
-    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
-    LB_PHYSICAL_INTERFACE=$default_route_dev
-fi
-
 # With the openvswitch plugin, set to True in ``localrc`` to enable
 # provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
 #
@@ -889,10 +876,6 @@ function cleanup_neutron {
         neutron_ovs_base_cleanup
     fi
 
-    if [[ $Q_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
-    fi
-
     # delete all namespaces created by neutron
     for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
deleted file mode 100644
index a392bd0baf..0000000000
--- a/lib/neutron_plugins/linuxbridge_agent
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/bin/bash
-#
-# Neutron Linux Bridge L2 agent
-# -----------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-function neutron_lb_cleanup {
-    sudo ip link delete $PUBLIC_BRIDGE
-
-    bridge_list=`ls /sys/class/net/*/bridge/bridge_id 2>/dev/null | cut -f5 -d/`
-    if [[ -z "$bridge_list" ]]; then
-        return
-    fi
-    if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then
-        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
-            sudo ip link delete $port
-        done
-    elif [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vlan" ]]; then
-        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
-            sudo ip link delete $port
-        done
-    fi
-    for bridge in $(echo $bridge_list |grep -o -e brq[0-9a-f\-]*); do
-        sudo ip link delete $bridge
-    done
-}
-
-function is_neutron_ovs_base_plugin {
-    # linuxbridge doesn't use OVS
-    return 1
-}
-
-function neutron_plugin_create_nova_conf {
-    :
-}
-
-function neutron_plugin_install_agent_packages {
-    :
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    local conf_file=$1
-    :
-}
-
-function neutron_plugin_configure_l3_agent {
-    local conf_file=$1
-    sudo ip link add $PUBLIC_BRIDGE type bridge
-    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # Setup physical network interface mappings.  Override
-    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
-        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
-    fi
-    if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
-        fi
-    fi
-    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
-    fi
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
-    iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-
-    # Configure vxlan tunneling
-    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
-        if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "True"
-            iniset /$Q_PLUGIN_CONF_FILE vxlan local_ip $TUNNEL_ENDPOINT_IP
-        else
-            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
-        fi
-    else
-        iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
-    fi
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver linuxbridge
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c2e78c65cc..687167bf79 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -114,9 +114,6 @@ function neutron_plugin_configure_service {
     populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group=$Q_USE_SECGROUP
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
-    if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then
-        iniset $NEUTRON_CONF experimental linuxbridge True
-    fi
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index c6d4663114..bbedc57a44 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -334,16 +334,6 @@ function _neutron_configure_router_v4 {
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
-        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Get the device the neutron router and network for $FIXED_RANGE
-            # will be using.
-            if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-                # in provider nets a bridge mapping uses the public bridge directly
-                ext_gw_interface=$PUBLIC_BRIDGE
-            else
-                # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-                ext_gw_interface=brq${EXT_NET_ID:0:11}
-            fi
         fi
         if [[ "$ext_gw_interface" != "none" ]]; then
             local cidr_len=${FLOATING_RANGE#*/}
diff --git a/tools/worlddump.py b/tools/worlddump.py
index edbfa268db..26ced3f653 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -31,7 +31,6 @@
     'nova-compute',
     'neutron-dhcp-agent',
     'neutron-l3-agent',
-    'neutron-linuxbridge-agent',
     'neutron-metadata-agent',
     'neutron-openvswitch-agent',
     'cinder-volume',

From 4a1d242a1a274e6d5d93c3d06055d313f4170a88 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 5 Feb 2025 20:50:05 +0000
Subject: [PATCH 3252/3333] enable multinode supprot for spice and serial proxy

This change mirrors change Ie02734bb598d27560cf5d674c9e1d9b8dca3801f
which ensure that its posible to enable vnc for vms on compute nodes
without deploying the vnc proxy.

In this change two new flags are added NOVA_SPICE_ENABLED and
NOVA_SERIAL_ENABLED to enable configuration of the relevent console

create_nova_conf is also modifed to include the db url if the console
proxies are deployed on a host.

As spice supprot is nolonger avaible in qemu as packged by ubuntu 24.04
and centos 9 a devstack-two-node-debian-bookworm to allow testing with
spice in a multinode job.

Change-Id: Ie944e518122f2b0059f28acbf68fb7ad0a560ca4
---
 .zuul.yaml  | 30 ++++++++++++++++++++++++++++++
 lib/nova    |  9 ++++++---
 lib/tempest |  8 +++++++-
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 74ce39cdfa..6cf79f5f03 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -311,6 +311,36 @@
           - compute1
           - compute2
 
+- nodeset:
+    name: devstack-two-node-debian-bookworm
+    nodes:
+      - name: controller
+        label: debian-bookworm
+      - name: compute1
+        label: debian-bookworm
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - job:
     name: devstack-base
     parent: openstack-multinode-fips
diff --git a/lib/nova b/lib/nova
index 95ed4d035c..810a3d9554 100644
--- a/lib/nova
+++ b/lib/nova
@@ -127,6 +127,9 @@ QEMU_CONF=/etc/libvirt/qemu.conf
 # ``NOVA_VNC_ENABLED`` can be used to forcibly enable VNC configuration.
 # In multi-node setups allows compute hosts to not run ``n-novnc``.
 NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
+# same as ``NOVA_VNC_ENABLED`` but for Spice and serial console respectively.
+NOVA_SPICE_ENABLED=$(trueorfalse False NOVA_SPICE_ENABLED)
+NOVA_SERIAL_ENABLED=$(trueorfalse False NOVA_SERIAL_ENABLED)
 
 # Get hypervisor configuration
 # ----------------------------
@@ -464,7 +467,7 @@ function create_nova_conf {
     # only setup database connections and cache backend if there are services
     # that require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
-    if is_service_enabled n-api n-cond n-sched; then
+    if is_service_enabled n-api n-cond n-sched n-spice n-novnc n-sproxy; then
         # If we're in multi-tier cells mode, we want our control services pointing
         # at cell0 instead of cell1 to ensure isolation. If not, we point everything
         # at the main database like normal.
@@ -716,7 +719,7 @@ function configure_console_compute {
         iniset $NOVA_CPU_CONF vnc enabled false
     fi
 
-    if is_service_enabled n-spice; then
+    if is_service_enabled n-spice || [ "$NOVA_SPICE_ENABLED" != False ]; then
         # Address on which instance spiceservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
         SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
@@ -726,7 +729,7 @@ function configure_console_compute {
         iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
     fi
 
-    if is_service_enabled n-sproxy; then
+    if is_service_enabled n-sproxy || [ "$NOVA_SERIAL_ENABLED" != False ]; then
         iniset $NOVA_CPU_CONF serial_console enabled True
         iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6082 + offset))/"
     fi
diff --git a/lib/tempest b/lib/tempest
index b8f9915a87..29b01f186f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -514,9 +514,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    if is_service_enabled n-novnc; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
+    if is_service_enabled n-spice || [ "$NOVA_SPICE_ENABLED" != False ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled spice_console True
+    fi
+    if is_service_enabled n-sproxy || [ "$NOVA_SERIAL_ENABLED" != False ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled serial_console True
+    fi
 
     # Network
     iniset $TEMPEST_CONFIG network project_networks_reachable false

From 754f1c66f53240e3ebda53fbb95bfdeee05b5796 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 13 Feb 2025 08:39:24 +0000
Subject: [PATCH 3253/3333] [eventlet-removal] Remove "logger" mechanism from
 ML2/OVN CI jobs

The "logger" mechanism is a testing class that is still calling
monkey_patch. This mechanism driver is not relevant nor neccessary
for the ML2/OVN CI jobs.

Change-Id: I539b202ca81f62f4ae26b5275fd6b245d2066fe7
---
 lib/neutron_plugins/ovn_agent | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 01dc1edfdd..71b5e3350d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -161,8 +161,10 @@ fi
 
 # Defaults Overwrite
 # ------------------
-
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
+# NOTE(ralonsoh): during the eventlet removal, the "logger" mech
+# driver has been removed from this list. Re-add it once the removal
+# is finished or the mech driver does not call monkey_patch().
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}

From 1aac81ee881534276fd7d6540ed356a85d064a13 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Sat, 18 Jan 2025 08:40:51 +0000
Subject: [PATCH 3254/3333] Allow to enable atop

It may be required to troubleshoot performance related bugs during
tests exection, to have ability to inspect environment processes
and theirs status during test run this patch installs atop
by default if not explicitly disabled.

Related-Bug: #2095224

Change-Id: Iedbd61f3ce3cd2255ea5f2a7a93ba2f39ad28ff2
---
 .zuul.yaml |  1 +
 lib/atop   | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |  7 +++++++
 unstack.sh |  5 +++++
 4 files changed, 61 insertions(+)
 create mode 100644 lib/atop

diff --git a/.zuul.yaml b/.zuul.yaml
index 74ce39cdfa..aec7113ab4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -357,6 +357,7 @@
         '{{ devstack_conf_dir }}/.localrc.auto': logs
         '{{ devstack_conf_dir }}/.stackenv': logs
         '{{ devstack_log_dir }}/dstat-csv.log': logs
+        '{{ devstack_log_dir }}/atop': logs
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
diff --git a/lib/atop b/lib/atop
new file mode 100644
index 0000000000..e0b14cb039
--- /dev/null
+++ b/lib/atop
@@ -0,0 +1,48 @@
+#!/bin/bash
+#
+# lib/atop
+# Functions to start and stop atop
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - configure_atop
+# - install_atop
+# - start_atop
+# - stop_atop
+
+# Save trace setting
+_XTRACE_ATOP=$(set +o | grep xtrace)
+set +o xtrace
+
+function configure_atop {
+        cat <<EOF | sudo tee /etc/default/atop >/dev/null
+# /etc/default/atop
+# see man atoprc for more possibilities to configure atop execution
+
+LOGOPTS="-R"
+LOGINTERVAL=${ATOP_LOGINTERVAL:-"30"}
+LOGGENERATIONS=${ATOP_LOGGENERATIONS:-"1"}
+LOGPATH=$LOGDIR/atop
+EOF
+}
+
+function install_atop {
+    install_package atop
+}
+
+# start_() - Start running processes
+function start_atop {
+    start_service atop
+}
+
+# stop_atop() stop atop process
+function stop_atop {
+    stop_service atop
+}
+
+# Restore xtrace
+$_XTRACE_ATOP
diff --git a/stack.sh b/stack.sh
index bfa0573f21..c2a4b5dc9a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -641,6 +641,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/atop
 source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os-vif
@@ -1093,6 +1094,12 @@ save_stackenv $LINENO
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+if is_service_enabled atop; then
+    configure_atop
+    install_atop
+    start_atop
+fi
+
 # Run a background tcpdump for debugging
 # Note: must set TCPDUMP_ARGS with the enabled service
 if is_service_enabled tcpdump; then
diff --git a/unstack.sh b/unstack.sh
index 1b2d8dd62a..29c80718f8 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -73,6 +73,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/atop
 source $TOP_DIR/lib/etcd3
 
 # Extras Source
@@ -174,6 +175,10 @@ fi
 
 stop_dstat
 
+if is_service_enabled atop; then
+    stop_atop
+fi
+
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.

From 4ed29f85911642fb5d01f919703697746be19d7c Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Wed, 26 Feb 2025 11:40:10 +0100
Subject: [PATCH 3255/3333] Fix Swift rsync/replication configuration

Swift rsync and replication services are up and running, however they
fail to replicate any data if needed and if used with more than one
replica.

This patch removes a deprecated option setting[1] and replaces it with
the required setting to use the correct rsync module suffix.

Additionally it removes an outdated subdirectory suffix in the rsyncd
configuration that has been removed as well[2].

Closes-Bug: #2100272

[1] https://opendev.org/openstack/swift/commit/675145ef4a131d548cc1122689732b9b65e5def4
[2] https://opendev.org/openstack/devstack/commit/0e58d22897457831b9dbf02d66a2f29d43803597

Change-Id: I5283405d00883a4dd11b7c001b1bba3776e576b8
---
 files/swift/rsyncd.conf | 24 ++++++++++++------------
 lib/swift               |  4 ++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/files/swift/rsyncd.conf b/files/swift/rsyncd.conf
index c49f716fa7..937d6c4b9a 100644
--- a/files/swift/rsyncd.conf
+++ b/files/swift/rsyncd.conf
@@ -6,74 +6,74 @@ address = 127.0.0.1
 
 [account6612]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6612.lock
 
 [account6622]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6622.lock
 
 [account6632]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6632.lock
 
 [account6642]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6642.lock
 
 
 [container6611]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6611.lock
 
 [container6621]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6621.lock
 
 [container6631]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6631.lock
 
 [container6641]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6641.lock
 
 
 [object6613]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6613.lock
 
 [object6623]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6623.lock
 
 [object6633]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6633.lock
 
 [object6643]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6643.lock
diff --git a/lib/swift b/lib/swift
index 3659624d5b..862927437d 100644
--- a/lib/swift
+++ b/lib/swift
@@ -318,8 +318,8 @@ function generate_swift_config_services {
     iniuncomment ${swift_node_config} DEFAULT mount_check
     iniset ${swift_node_config} DEFAULT mount_check false
 
-    iniuncomment ${swift_node_config} ${server_type}-replicator vm_test_mode
-    iniset ${swift_node_config} ${server_type}-replicator vm_test_mode yes
+    iniuncomment ${swift_node_config} ${server_type}-replicator rsync_module
+    iniset ${swift_node_config} ${server_type}-replicator rsync_module "{replication_ip}::${server_type}{replication_port}"
 
     # Using a sed and not iniset/iniuncomment because we want to a global
     # modification and make sure it works for new sections.

From e650b827904fe8835800a96332937bb1c8f4516e Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Wed, 26 Feb 2025 00:38:26 +0530
Subject: [PATCH 3256/3333] Tempest: Add support for extend attached encrypted
 volumes tests

We've LUKSv1 and LUKSv2 tests[1] in tempest that requires the
``extend_attached_encrypted_volume`` option to be True but
currently there is no way to set it in devstack.
This patch adds the parameter
``TEMPEST_EXTEND_ATTACHED_ENCRYPTED_VOLUME`` to enable the tests.

[1] https://github.com/openstack/tempest/blob/cb03598a65f47c51406fc86c9c1503fe42424848/tempest/api/volume/admin/test_encrypted_volumes_extend.py

Change-Id: Id3a3483629794ac38cb314812eeff84b677f35cd
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 29b01f186f..c9486f6310 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -586,6 +586,7 @@ function configure_tempest {
         TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
+    iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_encrypted_volume ${TEMPEST_EXTEND_ATTACHED_ENCRYPTED_VOLUME:-False}
     if [[ "$CINDER_BACKUP_DRIVER" == *"swift"* ]]; then
         iniset $TEMPEST_CONFIG volume backup_driver swift
     fi

From 85576bbfd430a9f419fbd837dfa20a2ef687da94 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 26 Feb 2025 18:04:09 +0000
Subject: [PATCH 3257/3333] tools: Set user_domain_id in generated clouds.yaml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If you specify a username, you also need to specify a domain that the
user exists in. Failure to do so results in the following error:

  Expecting to find domain in user. The server could not comply with the
  request since it is either malformed or otherwise incorrect. The
  client is assumed to be in error. (HTTP 400)␏

This was mostly being masked for us in python-openstackclient by this
little helper in osc-lib [1], but we can't rely on that for openstacksdk
(and shouldn't really rely on it elsewhere either).

We also deprecate the '--os-identity-api-version' and
'--os-volume-api-version' options and will remove them shortly: both
services only have v3 APIs nowadays.

[1] https://github.com/openstack/osc-lib/blob/3.2.0/osc_lib/cli/client_config.py#L136-L147

Change-Id: I5537b0a7d58efb8a325ed61bad358f677f7a3cdf
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/keystone                |  2 +-
 tools/update_clouds_yaml.py | 29 ++++++++++++++++++++---------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 76e2598ba3..8371045026 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -592,7 +592,7 @@ function bootstrap_keystone {
 # create_ldap_domain() - Create domain file and initialize domain with a user
 function create_ldap_domain {
     # Creates domain Users
-    openstack --os-identity-api-version=3 domain create --description "LDAP domain" Users
+    openstack domain create --description "LDAP domain" Users
 
     # Create domain file inside etc/keystone/domains
     KEYSTONE_LDAP_DOMAIN_FILE=$KEYSTONE_CONF_DIR/domains/keystone.Users.conf
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 74dcdb2a07..c0a54838cc 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -14,14 +14,14 @@
 
 # Update the clouds.yaml file.
 
-
 import argparse
 import os.path
+import sys
 
 import yaml
 
 
-class UpdateCloudsYaml(object):
+class UpdateCloudsYaml:
     def __init__(self, args):
         if args.file:
             self._clouds_path = args.file
@@ -32,6 +32,14 @@ def __init__(self, args):
             self._create_directory = True
         self._clouds = {}
 
+        if args.os_identity_api_version != '3':
+            print("ERROR: Only identity API v3 is supported")
+            sys.exit(1)
+
+        if args.os_volume_api_version != '3':
+            print("ERROR: Only block storage API v3 is supported")
+            sys.exit(1)
+
         self._cloud = args.os_cloud
         self._cloud_data = {
             'region_name': args.os_region_name,
@@ -40,20 +48,23 @@ def __init__(self, args):
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
+                'user_domain_id': 'default',
                 'password': args.os_password,
             },
         }
+
         if args.os_project_name and args.os_system_scope:
             print(
-                "WARNING: os_project_name and os_system_scope were both"
-                " given. os_system_scope will take priority.")
-        if args.os_project_name and not args.os_system_scope:
+                "WARNING: os_project_name and os_system_scope were both "
+                "given. os_system_scope will take priority."
+            )
+
+        if args.os_system_scope:  # system-scoped
+            self._cloud_data['auth']['system_scope'] = args.os_system_scope
+        elif args.os_project_name:  # project-scoped
             self._cloud_data['auth']['project_name'] = args.os_project_name
-        if args.os_identity_api_version == '3' and not args.os_system_scope:
-            self._cloud_data['auth']['user_domain_id'] = 'default'
             self._cloud_data['auth']['project_domain_id'] = 'default'
-        if args.os_system_scope:
-            self._cloud_data['auth']['system_scope'] = args.os_system_scope
+
         if args.os_cacert:
             self._cloud_data['cacert'] = args.os_cacert
 

From 1c96b4ef5fbe5425d9c6e80b34bbb805a31a0808 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 26 Feb 2025 18:12:23 +0000
Subject: [PATCH 3258/3333] openrc: Stop setting OS_VOLUME_API_VERSION,
 CINDER_VERSION

We have not needed these in years.

Change-Id: I4d76a7d3a8513ce5a927d533b34fb609e5dacdfa
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 openrc | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/openrc b/openrc
index 5ec7634638..e800abeb3d 100644
--- a/openrc
+++ b/openrc
@@ -72,8 +72,3 @@ if [[ ! -v OS_CACERT ]] ; then
         export OS_CACERT=$DEFAULT_OS_CACERT
     fi
 fi
-
-# Currently cinderclient needs you to specify the *volume api* version. This
-# needs to match the config of your catalog returned by Keystone.
-export CINDER_VERSION=${CINDER_VERSION:-3}
-export OS_VOLUME_API_VERSION=${OS_VOLUME_API_VERSION:-$CINDER_VERSION}

From ca15453625638d2660b7fd2fce261096f9f15dd0 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 27 Feb 2025 13:24:31 +0000
Subject: [PATCH 3259/3333] tools: Remove --os-identity-api-version,
 --os-volume-api-version opts

There is only one volume API and one identity API, and their collective
number is 3.

Change-Id: Ie269817c5bb0eddd8cfcf279a46cffe4a56377b2
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/openstacksdk/+/942898
---
 tools/update_clouds_yaml.py | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index c0a54838cc..87312d9469 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -32,19 +32,9 @@ def __init__(self, args):
             self._create_directory = True
         self._clouds = {}
 
-        if args.os_identity_api_version != '3':
-            print("ERROR: Only identity API v3 is supported")
-            sys.exit(1)
-
-        if args.os_volume_api_version != '3':
-            print("ERROR: Only block storage API v3 is supported")
-            sys.exit(1)
-
         self._cloud = args.os_cloud
         self._cloud_data = {
             'region_name': args.os_region_name,
-            'identity_api_version': args.os_identity_api_version,
-            'volume_api_version': args.os_volume_api_version,
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
@@ -100,8 +90,6 @@ def main():
     parser.add_argument('--file')
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
-    parser.add_argument('--os-identity-api-version', default='3')
-    parser.add_argument('--os-volume-api-version', default='3')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)

From a0938e6dcf93d77530685391b7850d34ffa206fc Mon Sep 17 00:00:00 2001
From: Ivan Anfimov <lazekteam@gmail.com>
Date: Sat, 1 Mar 2025 20:46:26 +0000
Subject: [PATCH 3260/3333] Fix for CSS problems in Horizon

After installation DevStack icons are not displayed.

Change-Id: I1bedf97e4d2b7f13b4a0c5b98e29ac53cf502e96
Closes-Bug: #2093844
---
 files/apache-horizon.template | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index da7a7d26c3..98d02e168e 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -10,6 +10,7 @@
     DocumentRoot %HORIZON_DIR%/.blackhole/
     Alias %WEBROOT%/media %HORIZON_DIR%/openstack_dashboard/static
     Alias %WEBROOT%/static %HORIZON_DIR%/static
+    Alias /static %HORIZON_DIR%/static
 
     RedirectMatch "^/$" "%WEBROOT%/"
 

From 9f2f499ded039dc2545c4e8860204f013f460350 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Fri, 28 Feb 2025 07:47:11 +0000
Subject: [PATCH 3261/3333] Pre create logs directory for atop

The race may happen and atop can't start due to missing
logs directory. This patch pre-creates directory before
starting atop process.

Closes-Bug: #2100871

Change-Id: I89e3100dc86d60266913b5c5776db65e8882847c
---
 lib/atop | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/atop b/lib/atop
index e0b14cb039..25c8e9a83f 100644
--- a/lib/atop
+++ b/lib/atop
@@ -19,7 +19,8 @@ _XTRACE_ATOP=$(set +o | grep xtrace)
 set +o xtrace
 
 function configure_atop {
-        cat <<EOF | sudo tee /etc/default/atop >/dev/null
+    mkdir -p $LOGDIR/atop
+    cat <<EOF | sudo tee /etc/default/atop >/dev/null
 # /etc/default/atop
 # see man atoprc for more possibilities to configure atop execution
 

From ab9fb4eb8732b1cc5505b8c9e722a7310038efdf Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Wed, 5 Mar 2025 09:34:25 -0500
Subject: [PATCH 3262/3333] Remove openstack network section from overview

This section is old and doesn't make much sense
anymore, let's remove it. Neutron is already mentioned
as a default service and has its own config guide.

TrivialFix

Change-Id: I2a2ed574f9eca7b87fb9bb6422568ed4fc55f057
---
 doc/source/overview.rst | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 81e58a341e..c978e8d2cf 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -52,12 +52,6 @@ Web Server
 
 -  Apache
 
-OpenStack Network
------------------
-
--  Neutron: A basic configuration approximating the original FlatDHCP
-   mode using OpenVSwitch.
-
 Services
 --------
 

From 0572e59775c91494fb6009ac4be539fb892226c7 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 15 Mar 2025 10:44:05 +0900
Subject: [PATCH 3263/3333] Skip functional tests for .gitreview update

... because the file does not affect any functionality.

Also apply the consistent irrelevant files to skip functional tests to
avoid unnecessary jobs.

Change-Id: Ibce79d6b7627c26aa69989ed17ae32d7c3b63d19
---
 .zuul.yaml | 72 +++++++++++++++---------------------------------------
 1 file changed, 20 insertions(+), 52 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7d72ab101a..48dd55e2d2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -455,7 +455,7 @@
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
-    irrelevant-files:
+    irrelevant-files: &common-irrelevant-files
       # Documentation related
       - ^.*\.rst$
       - ^api-ref/.*$
@@ -465,6 +465,8 @@
       - ^.*/locale/.*po$
       # pre-commit config
       - ^.pre-commit-config.yaml$
+      # gitreview config
+      - ^.gitreview$
 
 - job:
     name: devstack-minimal
@@ -915,35 +917,21 @@
         - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovn-tempest-ovs-release:
             voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-multinode-full-py3:
             voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - openstacksdk-functional-devstack:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-ipv6-only:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - nova-ceph-multistore:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
     gate:
       jobs:
         - devstack
@@ -958,27 +946,17 @@
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-ovs-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - openstacksdk-functional-devstack:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-ipv6-only:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - nova-ceph-multistore:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.
@@ -995,25 +973,15 @@
         - nova-multi-cell
         - nova-next
         - devstack-plugin-ceph-tempest-py3:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-tempest-dvr:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-tempest-dvr-ha-multinode-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - cinder-tempest-lvm-multibackend:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-pg-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - devstack-no-tls-proxy
     periodic:
       jobs:

From da40accd158ed55200de93a4191dbe334c82db22 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 21 Mar 2025 10:33:51 -0700
Subject: [PATCH 3264/3333] Update DEVSTACK_SERIES to 2025.2

stable/2025.1 branch has been created now and
current master is for 2025.2.

Change-Id: Iba81d280ebf1bd488bd590bdc4e31c49782c7099
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index c05d4e2d98..0319fc8a50 100644
--- a/stackrc
+++ b/stackrc
@@ -252,7 +252,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2025.1"
+DEVSTACK_SERIES="2025.2"
 
 ##############
 #

From b9be941b9b96478e6bfcceb1e75ae5c66d467f07 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 26 Mar 2025 10:09:38 -0700
Subject: [PATCH 3265/3333] Reduce unnecessary apache restarts

Systemd limits the total number of restarts that a service can undergo
in a short period of time. On faster nodes all of our apache restarts
hit that limit and we eventually fail. Mitigate this by removing
unnecessary restarts.

Change-Id: I425bb9eec525d82372f05edc63e4fb931e5a4887
---
 lib/apache | 16 +++++++++++-----
 lib/tls    | 15 ++++++++++++---
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/lib/apache b/lib/apache
index fc174f3901..15b4297809 100644
--- a/lib/apache
+++ b/lib/apache
@@ -53,13 +53,16 @@ APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 # Enable apache mod and restart apache if it isn't already enabled.
 function enable_apache_mod {
     local mod=$1
+    local should_restart=$2
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Skip mod_version as it is not a valid mod to enable
         # on debuntu, instead it is built in.
         if [[ "$mod" != "version" ]] && ! a2query -m $mod ; then
             sudo a2enmod $mod
-            restart_apache_server
+            if [[ "$should_restart" != "norestart" ]] ; then
+                restart_apache_server
+            fi
         fi
     elif is_fedora; then
         # pass
@@ -113,15 +116,18 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        # we've got to enable proxy and proxy_uwsgi for this to work
-        sudo a2enmod proxy
-        sudo a2enmod proxy_uwsgi
+        if ! a2query -m proxy || ! a2query -m proxy_uwsgi ; then
+            # we've got to enable proxy and proxy_uwsgi for this to work
+            sudo a2enmod proxy
+            sudo a2enmod proxy_uwsgi
+            restart_apache_server
+        fi
     elif is_fedora; then
         # redhat is missing a nice way to turn on/off modules
         echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
             | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
+        restart_apache_server
     fi
-    restart_apache_server
 }
 
 # install_apache_wsgi() - Install Apache server and wsgi module
diff --git a/lib/tls b/lib/tls
index 0a598e14f7..cff5c630a5 100644
--- a/lib/tls
+++ b/lib/tls
@@ -452,6 +452,7 @@ function enable_mod_ssl {
 # ===============
 
 function tune_apache_connections {
+    local should_restart=$1
     local tuning_file=$APACHE_SETTINGS_DIR/connection-tuning.conf
     if ! [ -f $tuning_file ] ; then
         sudo bash -c "cat > $tuning_file" << EOF
@@ -494,7 +495,12 @@ ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>
 EOF
-        restart_apache_server
+        if [ "$should_restart" != "norestart" ] ; then
+            # Only restart the apache server if we know we really want to
+            # do so. Too many restarts in a short period of time is treated
+            # as an error by systemd.
+            restart_apache_server
+        fi
     fi
 }
 
@@ -509,7 +515,8 @@ function start_tls_proxy {
     # 8190 is the default apache size.
     local f_header_size=${6:-8190}
 
-    tune_apache_connections
+    # We don't restart apache here as we'll do it at the end of the function.
+    tune_apache_connections norestart
 
     local config_file
     config_file=$(apache_site_config_for $b_service)
@@ -558,7 +565,9 @@ $listen_string
 </VirtualHost>
 EOF
     for mod in headers ssl proxy proxy_http; do
-        enable_apache_mod $mod
+        # We don't need to restart here as we will restart once at the end
+        # of the function.
+        enable_apache_mod $mod norestart
     done
     enable_apache_site $b_service
     restart_apache_server

From cb177ba84bd90f70a02fbac8b60549e7323ec7d2 Mon Sep 17 00:00:00 2001
From: Ivan Anfimov <lazekteam@gmail.com>
Date: Sat, 1 Mar 2025 22:15:04 +0000
Subject: [PATCH 3266/3333] Fix for module proxy_uwsgi_module is already loaded

Rocky Linux 9.5 64 bit

httpd -t
[Sun Mar 02 01:10:49.272260 2025] [so:warn] [pid 201497:tid 201497] AH01574: module proxy_uwsgi_module is already loaded, skipping

Change-Id: Id6a88c2b7958789f7d4947d3259276f120f5f44e
---
 lib/apache | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/apache b/lib/apache
index 15b4297809..744c0f10b6 100644
--- a/lib/apache
+++ b/lib/apache
@@ -122,11 +122,6 @@ function install_apache_uwsgi {
             sudo a2enmod proxy_uwsgi
             restart_apache_server
         fi
-    elif is_fedora; then
-        # redhat is missing a nice way to turn on/off modules
-        echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
-            | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
-        restart_apache_server
     fi
 }
 

From f41a16c11801f986a6e799e02b5340adf6b04fbb Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 9 Apr 2025 18:14:00 +0530
Subject: [PATCH 3267/3333] Fix python3 version for rpm distros

pythonX.Y version is virtually provided since long[1], and
pythonXY-devel no longer provided in latest CentOS and Fedora
releases.
So switching to use pythonX.Y-devel as that will also pull pythonX.Y
as a dependency.

Additionally install pythonX.Y-pip as for rpm distros it don't install
pip via source.

[1] https://src.fedoraproject.org/rpms/python3/c/75005c20f68f3b4ceb734e876b37009c8c3b99f3

Change-Id: I990586cce876533c67e3da4c97d9e5995c762340
---
 inc/python | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/inc/python b/inc/python
index bd58905e9e..cd90ac82c6 100644
--- a/inc/python
+++ b/inc/python
@@ -489,11 +489,7 @@ function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     elif is_fedora; then
-        if [ "$os_VENDOR" = "Fedora" ]; then
-            install_package python${PYTHON3_VERSION//.}
-        else
-            install_package python${PYTHON3_VERSION//.} python${PYTHON3_VERSION//.}-devel
-        fi
+        install_package python${PYTHON3_VERSION}-devel python${PYTHON3_VERSION}-pip
     fi
 }
 

From c4340a64ee35b2b8b5395461b6702ef765786465 Mon Sep 17 00:00:00 2001
From: Gorka Eguileor <geguileo@redhat.com>
Date: Fri, 8 Jul 2022 14:08:03 +0200
Subject: [PATCH 3268/3333] Add support for shared os_brick file lock path

There can be problems with some os-brick connectors if nova and cinder
run on the same host with different lock path locations, which we
currently do, or if Cinder and Glance with cinder store run on the same
host, and a recent os-brick change
(Ic52338278eb5bb3d90ce582fe6b23f37eb5568c4) allows for an os-brick
specific lock_path to facilitate these kind of deployment.

This patch adds the ``lock_path`` configuration option in the
``[os_brick]`` section of the nova, cinder, and glance config files.

If the os-brick, cinder, nova, or glance-store changes are not present
then the new config option is be ignored in the respective service, and
it will be used otherwise, so there's no need to make this patch
dependent on any other since we won't be worse off than we are now.

Change-Id: Ibe7da160460151734224863cddec5e0d549b4938
---
 lib/cinder | 16 ++++++++++++++++
 stack.sh   |  5 +++++
 2 files changed, 21 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index b557d4b10b..2b565c9535 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -59,6 +59,7 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
+OS_BRICK_LOCK_PATH=${OS_BRICK_LOCK_PATH:=$DATA_DIR/os_brick}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -511,6 +512,21 @@ function init_cinder {
     mkdir -p $CINDER_STATE_PATH/volumes
 }
 
+
+function init_os_brick {
+    mkdir -p $OS_BRICK_LOCK_PATH
+    if is_service_enabled cinder; then
+        iniset $CINDER_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+    if is_service_enabled nova; then
+        iniset $NOVA_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+    if is_service_enabled glance; then
+        iniset $GLANCE_API_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+        iniset $GLANCE_CACHE_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+}
+
 # install_cinder() - Collect source and prepare
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
diff --git a/stack.sh b/stack.sh
index 04b5f4ca6a..afca5250d5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1005,6 +1005,11 @@ if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
 fi
 
+if is_service_enabled cinder || [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+    # os-brick setup required by glance, cinder, and nova
+    init_os_brick
+fi
+
 # Extras Install
 # --------------
 

From 3fe8873a15db27d2d8b7df4e708210ee3ca1465d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 26 Apr 2025 02:19:56 +0000
Subject: [PATCH 3269/3333] Updated from generate-devstack-plugins-list

Change-Id: I7932dc96301cb2a52607007aa6935bbf6aa66397
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f7873c962d..e84c946287 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,6 +24,7 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
+openstack/aetos                          `https://opendev.org/openstack/aetos <https://opendev.org/openstack/aetos>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__

From ea23079321231c63e78e84cd58088663e92134a8 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 30 Apr 2025 21:41:37 +0530
Subject: [PATCH 3270/3333] Fix cert detection with custom PYTHON3_VERSION

PYTHON3_VERSION was not considered for detecting
ca path with GLOBAL_VENV=False, this patch fixes it.

Related-Bug: #2109591
Change-Id: Ie597494a2a11293cbd20e6d0b23dcb31bf343957
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index cff5c630a5..fa0a448d7d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -367,7 +367,7 @@ function fix_system_ca_bundle_path {
         if [[ "$GLOBAL_VENV" == "True" ]] ; then
             capath=$($DEVSTACK_VENV/bin/python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
         else
-            capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+            capath=$(python$PYTHON3_VERSION -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
         fi
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then

From 24870ec45a9486a31239218d74d0fd3fa3e5f118 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 5 May 2025 14:13:06 +0530
Subject: [PATCH 3271/3333] Pass PYTHON env var to memory tracker

It was not honoring PYTHON3_VERSION when running
with GLOBAL_VENV=false, this patch fixes it.

Related-Bug: #2109591
Change-Id: Ib34c099b897e59fce24cab6e98dc31a505e4922e
---
 lib/dstat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dstat b/lib/dstat
index 870c901d2a..9bd0370847 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -33,7 +33,7 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root" "PYTHON=python${PYTHON3_VERSION}"
 
     # TODO(jh): Fail when using the old service name otherwise consumers might
     # never notice that is has been removed.

From bf1ef3278c30572f5b958c5f1d2f59839e3d2b87 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 5 May 2025 18:08:12 +0530
Subject: [PATCH 3272/3333] Honor PYTHON3_VERSION for mod_wsgi rpm installation

Different variants of mod_wsgi are provided like:-
python3-mod_wsgi.x86_64
python3.11-mod_wsgi.x86_64
python3.12-mod_wsgi.x86_64

Adjust script to also consider PYTHON3_VERSION var
to correctly install the package.

Related-Bug: #2109591
Change-Id: I6bbfd92ef727ef9b343cd5778bb78f43c13165ad
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 744c0f10b6..5ab74b7087 100644
--- a/lib/apache
+++ b/lib/apache
@@ -137,7 +137,7 @@ function install_apache_wsgi {
         install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
-        install_package httpd python3-mod_wsgi
+        install_package httpd python${PYTHON3_VERSION}-mod_wsgi
         # rpm distros dont enable httpd by default so enable it to support reboots.
         sudo systemctl enable httpd
         # For consistency with Ubuntu, switch to the worker mpm, as

From 74837e0b30ea782b073eb6d23b0aa3060068a3a1 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 16:15:47 +0100
Subject: [PATCH 3273/3333] lib/neutron: Deploy under uWSGI by default

Change-Id: I6256ca1725c56859947d957156d865949879b130
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/grenade/+/949166
---
 lib/neutron | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 69ff212991..78ff6cfb24 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -82,11 +82,9 @@ NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
 # NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False (default) : Run neutron under Eventlet
-# - True : Run neutron under uwsgi
-# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
-# enough
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
+# - False : Run neutron under Eventlet
+# - True (default) : Run neutron under uwsgi
+NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse True NEUTRON_DEPLOY_MOD_WSGI)
 
 NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini

From d040e15961050f6e3fe538d8d65f13df554870f7 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 16:18:19 +0100
Subject: [PATCH 3274/3333] lib/neutron: Remove NEUTRON_DEPLOY_MOD_WSGI

neutron no longer supports running under eventlet, so this option
is a no-op.

Change-Id: Ib2767c0e2bb5aad5d8173dc5653e44a42c2bd499
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/neutron | 111 +++++++++++++++-------------------------------------
 1 file changed, 32 insertions(+), 79 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 78ff6cfb24..ea2d8e728a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -62,11 +62,9 @@ if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
-
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
-
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
 
@@ -81,11 +79,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False : Run neutron under Eventlet
-# - True (default) : Run neutron under uwsgi
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse True NEUTRON_DEPLOY_MOD_WSGI)
-
 NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
@@ -153,7 +146,7 @@ _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
 # The name of the service in the endpoint URL
 NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+if [[ -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
     NEUTRON_ENDPOINT_SERVICE_NAME="networking"
 fi
 
@@ -451,9 +444,7 @@ function configure_neutron {
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
-    fi
+    write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
 }
 
 function configure_neutron_nova {
@@ -499,11 +490,7 @@ function create_nova_conf_neutron {
 # Migrated from keystone_data.sh
 function create_neutron_accounts {
     local neutron_url
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
-    else
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
-    fi
+    neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
@@ -634,34 +621,25 @@ function start_neutron_service_and_check {
     fi
 
     # Start the Neutron service
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        # The default value of "rpc_workers" is None (not defined). If
-        # "rpc_workers" is explicitly set to 0, the RPC workers process
-        # should not be executed.
-        local rpc_workers
-        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
-
-        enable_service neutron-api
-        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/
-        if [ "$rpc_workers" != "0" ]; then
-            enable_service neutron-rpc-server
-        fi
-        enable_service neutron-periodic-workers
-        _enable_ovn_maintenance
-        if [ "$rpc_workers" != "0" ]; then
-            run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
-        fi
-        run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
-        _run_ovn_maintenance
-    else
-        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port/
-        # Start proxy if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-        fi
-    fi
+    # The default value of "rpc_workers" is None (not defined). If
+    # "rpc_workers" is explicitly set to 0, the RPC workers process
+    # should not be executed.
+    local rpc_workers
+    rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+
+    enable_service neutron-api
+    run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+    neutron_url=$Q_PROTOCOL://$Q_HOST/
+    if [ "$rpc_workers" != "0" ]; then
+        enable_service neutron-rpc-server
+    fi
+    enable_service neutron-periodic-workers
+    _enable_ovn_maintenance
+    if [ "$rpc_workers" != "0" ]; then
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+    fi
+    run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
+    _run_ovn_maintenance
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
@@ -723,14 +701,10 @@ function stop_other {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-rpc-server
-        stop_process neutron-periodic-workers
-        stop_process neutron-api
-        _stop_ovn_maintenance
-    else
-        stop_process q-svc
-    fi
+    stop_process neutron-rpc-server
+    stop_process neutron-periodic-workers
+    stop_process neutron-api
+    _stop_ovn_maintenance
 
     if is_service_enabled q-l3 neutron-l3; then
         sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
@@ -841,14 +815,12 @@ function _configure_public_network_connectivity {
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-api
-        stop_process neutron-rpc-server
-        stop_process neutron-periodic-workers
-        _stop_ovn_maintenance
-        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
-        sudo rm -f $(apache_site_config_for neutron-api)
-    fi
+    stop_process neutron-api
+    stop_process neutron-rpc-server
+    stop_process neutron-periodic-workers
+    _stop_ovn_maintenance
+    remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
+    sudo rm -f $(apache_site_config_for neutron-api)
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
@@ -955,12 +927,6 @@ function _configure_neutron_common {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
     _neutron_setup_rootwrap
 }
 
@@ -1026,25 +992,12 @@ function _configure_neutron_plugin_agent {
     neutron_plugin_configure_plugin_agent
 }
 
-function _replace_api_paste_composite {
-    local sep
-    sep=$(echo -ne "\x01")
-    # Replace it
-    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
-}
-
 # _configure_neutron_service() - Set config files for neutron service
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
 
-    if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" && -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-        _replace_api_paste_composite
-    fi
-
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
 

From 5cb2abf79ef103838ab0f922643f4a62ddf16cfb Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Tue, 25 Feb 2025 22:54:05 -0500
Subject: [PATCH 3275/3333] Switch ZSWAP_ZPOOL to zsmalloc

The z3fold compressed pages allocator is on it's way
out of the Linux kernel and running this on newer
systems will give you an error:

+ lib/host:configure_zswap:45              :   echo z3fold
z3fold
tee: /sys/module/zswap/parameters/zpool: No such file or directory

So, get ahead of things and move to the much faster
recommended by the kernel developers alternative.

[1]: https://lore.kernel.org/all/20240904233343.933462-1-yosryahmed@google.com/T/#u

Change-Id: I7c137114dd7585d3179a8d5dee818bb379bbcb1f
---
 lib/host | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/host b/lib/host
index a812c39612..58062eff6b 100644
--- a/lib/host
+++ b/lib/host
@@ -35,7 +35,7 @@ ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
 # lz4 is very fast although it does not have the best compression
 # zstd has much better compression but more latency
 ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
-ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
+ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="zsmalloc"}
 function configure_zswap {
     if [[ $ENABLE_ZSWAP == "True" ]] ; then
         # Centos 9 stream seems to only support enabling but not run time

From cbae98949193085f0ef5cfc250d5e8cc7530de5f Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 12 May 2025 15:17:42 +0100
Subject: [PATCH 3276/3333] Remove libvirt apparmor workaround

This is triggering bug #2065685 [1] on Ubuntu 24.04 (Noble) if podman is
installed (since that brings in the broken paast and pasta packages).
Given the workaround is nearly 10 years old [2], it should not be
necessary anymore.

[1] https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685
[2] https://bugs.launchpad.net/networking-ovn/+bug/1466631

Change-Id: I525b1f30bca7093791f927ff647db7745d25df22
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Related-bug: #2065685
Related-bug: #1466631
---
 lib/neutron_plugins/ovn_agent | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 71b5e3350d..e58cd4fb38 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -300,18 +300,6 @@ function create_public_bridge {
     _configure_public_network_connectivity
 }
 
-function _disable_libvirt_apparmor {
-    if ! sudo aa-status --enabled ; then
-        return 0
-    fi
-    # NOTE(arosen): This is used as a work around to allow newer versions
-    # of libvirt to work with ovs configured ports. See LP#1466631.
-    # requires the apparmor-utils
-    install_package apparmor-utils
-    # disables apparmor for libvirtd
-    sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd
-}
-
 
 # OVN compilation functions
 # -------------------------
@@ -614,7 +602,6 @@ function init_ovn {
     # in the ovn, ovn-nb, or ovs databases.  We're going to trash them and
     # create new ones on each devstack run.
 
-    _disable_libvirt_apparmor
     local mkdir_cmd="mkdir -p ${OVN_DATADIR}"
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then

From f5b9596f24c03079c6ea2bcac29b1973bf5fe589 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 2 May 2025 15:51:01 +0530
Subject: [PATCH 3277/3333] Temporary fixes rhel 9 distros

With [1] py39 constraints drop can't run fips jobs on
centos 9-stream or rocky9.
As a workaround can run with PYTHON3_VERSION: 3.11 in affected
jobs.
Until centos 10-stream support is ready[1] we also need
to install libvirt-python and uwsgi from source as uwsgi and
libvirt rpms are bundled with python3.

[1] https://review.opendev.org/c/openstack/requirements/+/948285
[2] https://review.opendev.org/c/openstack/devstack/+/937251

Depends-On: https://review.opendev.org/c/openstack/devstack/+/946763
Depends-On: https://review.opendev.org/c/openstack/devstack/+/948558
Depends-On: https://review.opendev.org/c/openstack/devstack/+/948786
Depends-On: https://review.opendev.org/c/openstack/devstack/+/948797
Related-Bug: #2109591
Change-Id: I80d4c65ba0728c3e4b18738c6b0d539409f19976
---
 .zuul.yaml                         | 7 +++++++
 lib/apache                         | 2 +-
 lib/nova_plugins/functions-libvirt | 8 +++++++-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 48dd55e2d2..9552fa3b47 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -735,6 +735,10 @@
     parent: tempest-full-py3
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
+    vars:
+      devstack_localrc:
+        # TODO(ykarel) Remove this when moving to 10-stream
+        PYTHON3_VERSION: 3.11
     timeout: 9000
     voting: false
 
@@ -760,6 +764,9 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(ykarel) Remove this when moving to rocky10
+        PYTHON3_VERSION: 3.11
 
 - job:
     name: devstack-platform-ubuntu-jammy
diff --git a/lib/apache b/lib/apache
index 744c0f10b6..b971ecf8cd 100644
--- a/lib/apache
+++ b/lib/apache
@@ -89,7 +89,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36|rhel9 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index ba2e98e304..35840539da 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -93,7 +93,13 @@ function install_libvirt {
         # as the base system version is too old.  We should have
         # pre-installed these
         install_package $qemu_package
-        install_package libvirt libvirt-devel python3-libvirt
+        install_package libvirt libvirt-devel
+
+        if [[ $DISTRO =~ rhel9 ]]; then
+            pip_install_gr libvirt-python
+        else
+            install_package python3-libvirt
+        fi
 
         if is_arch "aarch64"; then
             install_package edk2-aarch64

From 7fedf7f78764542a05429a22e980de4a1486faa1 Mon Sep 17 00:00:00 2001
From: Ivan Anfimov <lazekteam@gmail.com>
Date: Wed, 7 May 2025 18:17:40 +0000
Subject: [PATCH 3278/3333] Remove temporary fix for problems with CSS styles

Fixed by Horizon side:
https://review.opendev.org/c/openstack/horizon/+/949036

Change-Id: I8acb029b0562381cdbe28f0ee32f3aed07de5784
---
 files/apache-horizon.template | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index 98d02e168e..da7a7d26c3 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -10,7 +10,6 @@
     DocumentRoot %HORIZON_DIR%/.blackhole/
     Alias %WEBROOT%/media %HORIZON_DIR%/openstack_dashboard/static
     Alias %WEBROOT%/static %HORIZON_DIR%/static
-    Alias /static %HORIZON_DIR%/static
 
     RedirectMatch "^/$" "%WEBROOT%/"
 

From 46e14fb1f70e25aada290f6f5648800ec7a147b3 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Sun, 18 May 2025 16:59:13 -0700
Subject: [PATCH 3279/3333] Bubble up image download failures

Currently, we're still returning 0 out of the upload_image method
despite the download failing. This changes behavior such that if the
image download fails, it returns an exit code of 1 to the caller to be
handled (or fail early) accordingly.

Change-Id: I901dc065b51946f363145ae888cca602946ceeea
---
 functions | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 42d08d7c4a..829fc86c55 100644
--- a/functions
+++ b/functions
@@ -147,7 +147,8 @@ function upload_image {
                 if [[ $rc -ne 0 ]]; then
                     if [[ "$attempt" -eq "$max_attempts" ]]; then
                         echo "Not found: $image_url"
-                        return
+                        # Signal failure to download to the caller, so they can fail early
+                        return 1
                     fi
                     echo "Download failed, retrying in $attempt second, attempt: $attempt"
                     sleep $attempt

From 5d41cb1f51cccdbecf375cf84f9893b29f8c3ffc Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Tue, 20 May 2025 13:17:49 -0400
Subject: [PATCH 3280/3333] Silence SyntaxWarnings in outfilter.py

Use raw strings for these regexes.

Change-Id: If5d35fa527b464f34a0d2335e5c6b388be726a54
---
 tools/outfilter.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index 55f9ee1487..c9907b072a 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -26,8 +26,8 @@
 import re
 import sys
 
-IGNORE_LINES = re.compile('(set \+o|xtrace)')
-HAS_DATE = re.compile('^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \|')
+IGNORE_LINES = re.compile(r'(set \+o|xtrace)')
+HAS_DATE = re.compile(r'^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \|')
 
 
 def get_options():

From 6ebe6f1b26b371b11ecd9cb6d0d154839ba6941e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 22 May 2025 02:13:55 +0000
Subject: [PATCH 3281/3333] Updated from generate-devstack-plugins-list

Change-Id: I443a7715aa85e4ffe65994dc77f7091c7f441876
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e84c946287..f3f11cfe16 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -44,6 +44,7 @@ openstack/freezer                        `https://opendev.org/openstack/freezer
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/grian-ui                       `https://opendev.org/openstack/grian-ui <https://opendev.org/openstack/grian-ui>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__

From 0e8042deff33bffbab732f70a66ece162aa470f7 Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Tue, 29 Apr 2025 15:36:28 +0200
Subject: [PATCH 3282/3333] Add SYSTEMD_ENV_VARS dictionary

This will allow to pass env variables from zuul job definitions to
to systemd service files via the local conf.

The first use case of this is to pass
OS_NOVA_DISABLE_EVENTLET_PATCHING=true to nova services that already
supports running in native threading mode instead of with Eventlet.
During the Eventlet removal effort this will allow us to have separate
jobs testing the same service in different concurrency mode.

Change-Id: I675043e42006286bb7e1190ea9462fb8d8daa38c
---
 functions-common | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/functions-common b/functions-common
index e265256ccf..db2367cef6 100644
--- a/functions-common
+++ b/functions-common
@@ -43,6 +43,9 @@ declare -A -g GITREPO
 declare -A -g GITBRANCH
 declare -A -g GITDIR
 
+# Systemd service file environment variables per service
+declare -A -g SYSTEMD_ENV_VARS
+
 KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
@@ -1642,6 +1645,9 @@ function _run_under_systemd {
         user=$STACK_USER
     fi
     local env_vars="$5"
+    if [[ -v SYSTEMD_ENV_VARS[$service] ]]; then
+        env_vars="${SYSTEMD_ENV_VARS[$service]} $env_vars"
+    fi
     if [[ "$command" =~ "uwsgi" ]] ; then
         if [[ "$GLOBAL_VENV" == "True" ]] ; then
             cmd="$cmd --venv $DEVSTACK_VENV"

From df3fa124689402831543a24fc036f55e9e0bab33 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 29 May 2025 02:49:43 +0000
Subject: [PATCH 3283/3333] Updated from generate-devstack-plugins-list

Change-Id: Ibebfa75ae6b233d6a913ffb3f8dced4290a8ab1b
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f3f11cfe16..9185263443 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -114,7 +114,6 @@ starlingx/nfv                            `https://opendev.org/starlingx/nfv <htt
 starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
 vexxhost/openstack-operator              `https://opendev.org/vexxhost/openstack-operator <https://opendev.org/vexxhost/openstack-operator>`__
 x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
-x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
 x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__
 x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
 x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__

From d2e309f0481f2e8577737bc2e5d6761a70b93dca Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 17 Jun 2025 21:15:16 +0900
Subject: [PATCH 3284/3333] Bump etcd to 3.25.x

The etcd project maintains release branches for the current version
and pevious release[1]. Because 3.26.0 was already released, 3.24.x is
no longer supported.
Bump it to the latest bug fix release of 3.25.x .

Also, the binary for s390x has been restored upstream so add it back.

[1] https://etcd.io/docs/v3.6/op-guide/versioning/

Change-Id: I108466c65bd1ebd1e42c75dfbe9b2173d04ba122
---
 stackrc | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/stackrc b/stackrc
index 0319fc8a50..817b445c7f 100644
--- a/stackrc
+++ b/stackrc
@@ -705,12 +705,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.4.27}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"a32d21e006252dbc3405b0645ba8468021ed41376974b573285927bf39b39eb9"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"ed7e257c225b9b9545fac22246b97f4074a4b5109676e92dbaebfb9315b69cc0"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"eb8825e0bc2cbaf9e55947f5ee373ebc9ca43b6a2ea5ced3b992c81855fff37e"}
-# etcd v3.2.x and later doesn't have anything for s390x
-ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
+ETCD_VERSION=${ETCD_VERSION:-v3.5.21}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"adddda4b06718e68671ffabff2f8cee48488ba61ad82900e639d108f2148501c"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"95bf6918623a097c0385b96f139d90248614485e781ec9bee4768dbb6c79c53f"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"6fb6ecb3d1b331eb177dc610a8efad3aceb1f836d6aeb439ba0bfac5d5c2a38c"}
+ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-"a211a83961ba8a7e94f7d6343ad769e699db21a715ba4f3b68cf31ea28f9c951"}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"
@@ -722,15 +721,8 @@ elif is_arch "ppc64le"; then
     ETCD_ARCH="ppc64le"
     ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
 elif is_arch "s390x"; then
-    # An etcd3 binary for s390x is not available on github like it is
-    # for other arches. Only continue if a custom download URL was
-    # provided.
-    if [[ -n "${ETCD_DOWNLOAD_URL}" ]]; then
-        ETCD_ARCH="s390x"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
-    else
-        exit_distro_not_supported "etcd3. No custom ETCD_DOWNLOAD_URL provided."
-    fi
+    ETCD_ARCH="s390x"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi

From 5822439d95b02a7033f6333cda1dfafdc342b852 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Wed, 18 Jun 2025 08:20:50 -0700
Subject: [PATCH 3285/3333] Update base OS recommendation to 24.04

This is what all of OpenStack tests on now, it's likely a better choice
for a default. Worth noting 22.04 doesn't work for latest-ironic (at
least).

Change-Id: Ibe4c1d4416dded4ac3280cb6ef423b0792b584ab
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 70871ef876..a07bb84922 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu,
 Rocky Linux 9 and openEuler.
 
-If you do not have a preference, Ubuntu 22.04 (Jammy) is the
+If you do not have a preference, Ubuntu 24.04 (Noble) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)

From 37c755e70721fa49d9c344158592761a75b124d3 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 23 Jun 2025 22:32:56 +0900
Subject: [PATCH 3286/3333] Drop logic for Python < 3

Python 2 support was removed globally multiple cycles ago.

Change-Id: I503ef9be68e59c8983d245f1fbb689651eb564ff
---
 tools/outfilter.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index 55f9ee1487..df03a779b5 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -90,13 +90,10 @@ def main():
 
         if outfile:
             # We've opened outfile as a binary file to get the
-            # non-buffered behaviour.  on python3, sys.stdin was
+            # non-buffered behaviour. on python3, sys.stdin was
             # opened with the system encoding and made the line into
             # utf-8, so write the logfile out in utf-8 bytes.
-            if sys.version_info < (3,):
-                outfile.write(ts_line)
-            else:
-                outfile.write(ts_line.encode('utf-8'))
+            outfile.write(ts_line.encode('utf-8'))
             outfile.flush()
 
 

From a8aecbad4f7f4cd4b6ddc57b78844cede5325d4d Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 23 Nov 2024 21:50:13 +0900
Subject: [PATCH 3287/3333] Allow installing etcd3gw from source

... to enable forward testing in etcd3gw.

Change-Id: I249243fc913a82c28d096ef48aacecd07f2c2694
---
 lib/libraries                | 9 +++++++--
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/libraries b/lib/libraries
index fa418785dd..c3248f11b2 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -27,6 +27,7 @@ GITDIR["castellan"]=$DEST/castellan
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
+GITDIR["etcd3gw"]=$DEST/etcd3gw
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["openstacksdk"]=$DEST/openstacksdk
 GITDIR["os-client-config"]=$DEST/os-client-config
@@ -131,8 +132,12 @@ function install_libs {
     # python client libraries we might need from git can go here
     _install_lib_from_source "python-barbicanclient"
 
-    # etcd (because tooz does not have a hard dependency on these)
-    pip_install etcd3gw
+    if use_library_from_git etcd3gw ; then
+        _install_lib_from_source "etcd3gw"
+    else
+        # etcd (because tooz does not have a hard dependency on these)
+        pip_install etcd3gw
+    fi
 }
 
 # Restore xtrace
diff --git a/stackrc b/stackrc
index c05d4e2d98..ddd623fc06 100644
--- a/stackrc
+++ b/stackrc
@@ -395,6 +395,10 @@ GITBRANCH["futurist"]=${FUTURIST_BRANCH:-$TARGET_BRANCH}
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
 GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-$TARGET_BRANCH}
 
+# etcd3gw library
+GITREPO["etcd3gw"]=${ETCD3GW_REPO:-${GIT_BASE}/openstack/etcd3gw.git}
+GITBRANCH["etcd3gw"]=${ETCD3GW_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+
 # helpful state machines
 GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
 GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 839e3a1328..9552c93c4f 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -45,7 +45,7 @@ ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
-ALL_LIBS+=" oslo.limit"
+ALL_LIBS+=" oslo.limit etcd3gw"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 06633c6c3033cc92329e1849266f4f2ed33d2124 Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Fri, 27 Jun 2025 15:05:51 +0200
Subject: [PATCH 3288/3333] Restart slapd after cleanup

A bug in openldap mdb (memory database) causes it to crash in an attempt
to delete nonexisting tree, which is exactly what we do in the cleanup.
After the coredump it does not start automatically (what maybe make
sense to change). The fix is merged in
https://bugs.openldap.org/show_bug.cgi?id=10336 but we do not have this
fix in Noble. For now try simply to restart the process.

Change-Id: Iae597aae345d12a2c82f66342ff40ac0a387eddf
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
---
 lib/ldap | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/ldap b/lib/ldap
index b0195db258..66c2afc4d5 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -82,6 +82,14 @@ function init_ldap {
 
     # Remove data but not schemas
     clear_ldap_state
+    if is_ubuntu; then
+        # a bug in OpenLDAP 2.6.7+
+        # (https://bugs.openldap.org/show_bug.cgi?id=10336) causes slapd crash
+        # after deleting nonexisting tree. It is fixed upstream, but Ubuntu is
+        # still not having a fix in Noble. Try temporarily simly restarting the
+        # process.
+        sudo service $LDAP_SERVICE_NAME restart
+    fi
 
     # Add our top level ldap nodes
     if ldapsearch -x -w $LDAP_PASSWORD -D "$LDAP_MANAGER_DN" -H $LDAP_URL -b "$LDAP_BASE_DN" | grep -q "Success"; then

From 47aa8d1744dad23c4ace34a7edbff78360fb0079 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 12 Jul 2025 00:25:42 +0900
Subject: [PATCH 3289/3333] Drop unused [service_user] auth_strategy

The option does not actually exist.

Change-Id: I659bba38ca038fa370a411ae43ca942b6390c779
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/cinder | 1 -
 lib/nova   | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index b557d4b10b..eb8a63dbfc 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -732,7 +732,6 @@ function configure_cinder_volume_upload {
 function init_cinder_service_user_conf {
     configure_keystone_authtoken_middleware $CINDER_CONF cinder service_user
     iniset $CINDER_CONF service_user send_service_user_token True
-    iniset $CINDER_CONF service_user auth_strategy keystone
 }
 
 # Restore xtrace
diff --git a/lib/nova b/lib/nova
index 810a3d9554..2357d87ee3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -843,7 +843,6 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF service_user project_name "$SERVICE_PROJECT_NAME"
     iniset $NOVA_CONF service_user project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
 function conductor_conf {

From e221349e56414e1cb89c75311bf659bd869e16a7 Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Mon, 14 Jul 2025 12:37:23 +0200
Subject: [PATCH 3290/3333] keystone: Set user_enabled_default for LDAP domain

When using the LDAP identity backend, stack.sh fails
during the create_keystone_accounts phase when trying
to verify the newly created demo user.

This is caused by a BadRequestException from the
Keystone API with the error, 'enabled' is a required
property. The error occurs because the default LDAP
user object created by the DevStack scripts does not
contain an attribute that Keystone can map to its
mandatory enabled property.

This change fixes the issue by adding
user_enabled_emulation = True to the domain-specific
LDAP configuration in the create_ldap_domain function.
This tells Keystone to assume a user is enabled if
the attribute is not explicitly defined in their LDAP
entry, which resolves the schema incompatibility and
allows the script to complete successfully.

Signed-off-by: Grzegorz Grasza <xek@redhat.com>
Change-Id: I15ddf0b88ee93615c318d4845a026ca1e25c3e69
---
 lib/keystone | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/keystone b/lib/keystone
index 8371045026..0311e24c67 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -608,6 +608,7 @@ function create_ldap_domain {
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_mail_attribute "mail"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_id_attribute "uid"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_enabled_emulation "True"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user "cn=Manager,dc=openstack,dc=org"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap url "ldap://localhost"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap suffix $LDAP_BASE_DN

From 9c180f2f060bfed65bc1b24c16010466b48dc0da Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmaan@ghanshyammann.com>
Date: Fri, 4 Jul 2025 11:40:38 -0700
Subject: [PATCH 3291/3333] Configure 'manager' role in tempest

In this release, nova is implementing the manager role in policy[depends-on],
and Tempest added (depends-on) a new config option to decide if new
defaults are present in testing env. Setting the manager role availability
in Tempest so that test can use manager role user to perform the required
operation in nova.

Depends-On: https://review.opendev.org/c/openstack/nova/+/953063
Depends-On: https://review.opendev.org/c/openstack/tempest/+/953265

Change-Id: I69e32c7de5a63df1c21979f748b77e512068eeec
Signed-off-by: Ghanshyam Mann <gmaan@ghanshyammann.com>
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index c9486f6310..286cb56d41 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -524,6 +524,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled serial_console True
     fi
 
+    # NOTE(gmaan): Since 2025.2, 'manager' role is available in nova.
+    local nova_policy_roles="admin,manager,member,reader"
+    iniset $TEMPEST_CONFIG compute-feature-enabled nova_policy_roles $nova_policy_roles
+
     # Network
     iniset $TEMPEST_CONFIG network project_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"

From 6180e73702cfef2011c32f315cde97128a4b7eec Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 26 Jun 2025 07:56:44 +0000
Subject: [PATCH 3292/3333] Replace the OVN Metadata agent with the OVN agent

The OVN Metadata agent is replaced in any CI job with the OVN
agent. This is an incremental step on the deprecation of the
OVN Metadata agent.

Related-Bug: #2112313
Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I4e8d12762099c91d773c4f5e5699bc9fed43a9c9
---
 .zuul.yaml                    | 4 ++--
 lib/neutron_plugins/ovn_agent | 3 ++-
 stackrc                       | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9552fa3b47..9f9c69c925 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -620,7 +620,7 @@
         ovsdb-server: true
         # Neutron services
         q-svc: true
-        q-ovn-metadata-agent: true
+        q-ovn-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -657,7 +657,7 @@
           ovs-vswitchd: true
           ovsdb-server: true
           # Neutron services
-          q-ovn-metadata-agent: true
+          q-ovn-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e58cd4fb38..b128fde2b6 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -96,8 +96,9 @@ OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 # OVN agent configuration
+# The OVN agent is configured, by default, with the "metadata" extension.
 OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
-OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-}
+OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-metadata}
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
diff --git a/stackrc b/stackrc
index 0319fc8a50..325af580ad 100644
--- a/stackrc
+++ b/stackrc
@@ -75,7 +75,7 @@ if ! isset ENABLED_SERVICES ; then
     # OVN
     ENABLED_SERVICES+=,ovn-controller,ovn-northd,ovs-vswitchd,ovsdb-server
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-ovn-metadata-agent
+    ENABLED_SERVICES+=,q-svc,q-ovn-agent
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services

From a8f98073b97a2485a7505ebe36dba9cad1e0a7e1 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 17 Jul 2025 10:20:27 +0000
Subject: [PATCH 3293/3333] Fix the nodeset "devstack-single-node-opensuse-15"

The label "opensuse-15" is no longer available since [1]. Since there
are pending references to this nodeset from older branches, use an
empty node list for it to fix the zuul config until all references
can be dropped.

[1]https://review.opendev.org/c/openstack/project-config/+/955214

Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I2f5105178482402aa108910d1bd1ec2f2c7c8933
---
 .zuul.yaml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9552fa3b47..693edffe6e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,15 +48,10 @@
         nodes:
           - controller
 
+# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
     name: devstack-single-node-opensuse-15
-    nodes:
-      - name: controller
-        label: opensuse-15
-    groups:
-      - name: tempest
-        nodes:
-          - controller
+    nodes: []
 
 - nodeset:
     name: devstack-single-node-debian-bookworm

From bfa9e547a901df5dd74926385010421157b6fca7 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Sat, 26 Jul 2025 00:58:51 +0000
Subject: [PATCH 3294/3333] Avoid setting iso image in tempest config

Tempest use image_ref and image_ref_alt as their base
image to run test against and perform ssh etc. Most of
the iso image require ssh to be enabled explicitly so
avoid setting them as image_ref and image_ref_alt unless
it is explicitly requested.

One example that how setting iso image in tempest can fail
tests- https://review.opendev.org/c/openstack/tempest/+/954404

Needed-By: https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/955950

Change-Id: Ic385a702758d9d38880ec92cfdce2528766fc95d
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/tempest | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index c9486f6310..cac2633324 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,6 +105,8 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
+TEMPEST_USE_ISO_IMAGE=$(trueorfalse False TEMPEST_USE_ISO_IMAGE)
+
 # Functions
 # ---------
 
@@ -161,12 +163,20 @@ function get_active_images {
     # start with a fresh array in case we are called multiple times
     img_array=()
 
-    while read -r IMAGE_NAME IMAGE_UUID; do
+    # NOTE(gmaan): Most of the iso image require ssh to be enabled explicitly
+    # and if we set those iso images in image_ref and image_ref_alt that can
+    # cause test to fail because many tests using image_ref and image_ref_alt
+    # to boot server also perform ssh. We skip to set iso image in tempest
+    # unless it is requested via TEMPEST_USE_ISO_IMAGE.
+    while read -r IMAGE_NAME IMAGE_UUID DISK_FORMAT; do
+        if [[ "$DISK_FORMAT" == "iso"  ]] && [[ "$TEMPEST_USE_ISO_IMAGE" == False ]]; then
+            continue
+        fi
         if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
             img_id="$IMAGE_UUID"
         fi
         img_array+=($IMAGE_UUID)
-    done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+    done < <(openstack --os-cloud devstack-admin image list --long --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2,$4 }')
 }
 
 function poll_glance_images {

From 5c338f47d57fe849215d6b9f5c1f4eb53c193ab1 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 4 Aug 2025 23:31:17 +0900
Subject: [PATCH 3295/3333] Fix uninialized os_VENDOR

... to fix the wrong libvirt group name detected.

Closes-Bug: #2119496
Change-Id: I2988fcb5010f333eab5a88b83ff14aab1cb15ebd
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 stackrc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/stackrc b/stackrc
index 0319fc8a50..44bc6b321d 100644
--- a/stackrc
+++ b/stackrc
@@ -615,6 +615,11 @@ case "$VIRT_DRIVER" in
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
         LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-custom}
         LIBVIRT_CPU_MODEL=${LIBVIRT_CPU_MODEL:-Nehalem}
+
+        if [[ -z "$os_VENDOR" ]]; then
+            GetOSVersion
+        fi
+
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check

From 90b0a6760ba95e8b2fa4a43dda1d0eeb56c00f2d Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 5 Aug 2025 12:55:21 +0900
Subject: [PATCH 3296/3333] Drop old libvirt group detection for Ubuntu/Debian

The "libvirtd" group was used in quite old Ubuntu such as Xenial, and
the "libvirt" group is used instead in recent versions.

Change-Id: I2df747d54d3cb395c245ecc2aa24dcbf395e7a46
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 stackrc | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/stackrc b/stackrc
index 44bc6b321d..811a285d19 100644
--- a/stackrc
+++ b/stackrc
@@ -621,11 +621,7 @@ case "$VIRT_DRIVER" in
         fi
 
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
-            # The groups change with newer libvirt. Older Ubuntu used
-            # 'libvirtd', but now uses libvirt like Debian. Do a quick check
-            # to see if libvirtd group already exists to handle grenade's case.
-            LIBVIRT_GROUP=$(cut -d ':' -f 1 /etc/group | grep 'libvirtd$' || true)
-            LIBVIRT_GROUP=${LIBVIRT_GROUP:-libvirt}
+            LIBVIRT_GROUP=libvirt
         else
             LIBVIRT_GROUP=libvirtd
         fi

From ec96b1a067684bf729f4dbd84dce9db02171b234 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Din=C3=A7er=20=C3=87elik?= <hello@dincercelik.com>
Date: Wed, 6 Aug 2025 12:27:15 +0300
Subject: [PATCH 3297/3333] Fix default settings for Ubuntu aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes-Bug: #2080957
Change-Id: I441897937253f8d44144fa7f5f4622f42bf74a5f
Signed-off-by: Dinçer Çelik <hello@dincercelik.com>
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 35840539da..c0713f9953 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -71,7 +71,7 @@ function install_libvirt {
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt systemd-coredump
         if is_arch "aarch64"; then
-            install_package qemu-efi
+            install_package qemu-efi-aarch64
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora; then

From 4f065ca80e4589513ca639cb39d3899943698b41 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 13 May 2025 14:56:44 +0100
Subject: [PATCH 3298/3333] Replace use of fgrep

It is deprecated.

Change-Id: Iad071865361d51c148fc157d715bdf517ec5b94b
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 04b5f4ca6a..a06c7be9a7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -356,7 +356,7 @@ async_init
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
 LOCAL_HOSTNAME=`hostname -s`
-if ! fgrep -qwe "$LOCAL_HOSTNAME" /etc/hosts; then
+if ! grep -Fqwe "$LOCAL_HOSTNAME" /etc/hosts; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 

From 67fa02fc5fd6a8786baff61695a578338462b3d3 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 6 Aug 2025 10:53:32 +0100
Subject: [PATCH 3299/3333] Remove requirement on system oslo.utils

This was only working because the noVNC package on Ubuntu pulls
in oslo.utils.

Change-Id: I3733df3e2667f16082b3ff57d39cf086d81fbe02
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 tools/verify-ipv6-address.py          | 41 +++++++++++++++++++++++++++
 tools/verify-ipv6-only-deployments.sh | 24 ++++++----------
 2 files changed, 49 insertions(+), 16 deletions(-)
 create mode 100644 tools/verify-ipv6-address.py

diff --git a/tools/verify-ipv6-address.py b/tools/verify-ipv6-address.py
new file mode 100644
index 0000000000..dc18fa6d8a
--- /dev/null
+++ b/tools/verify-ipv6-address.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+import argparse
+import ipaddress
+import sys
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Check if a given string is a valid IPv6 address.",
+        formatter_class=argparse.RawTextHelpFormatter,
+    )
+    parser.add_argument(
+        "address",
+        help=(
+            "The IPv6 address string to validate.\n"
+            "Examples:\n"
+            "  2001:0db8:85a3:0000:0000:8a2e:0370:7334\n"
+            "  2001:db8::1\n"
+            "  ::1\n"
+            "  fe80::1%eth0 (scope IDs are handled)"
+        ),
+    )
+    args = parser.parse_args()
+
+    try:
+        # try to create a IPv6Address: if we fail to parse or get an
+        # IPv4Address then die
+        ip_obj = ipaddress.ip_address(args.address.strip('[]'))
+        if isinstance(ip_obj, ipaddress.IPv6Address):
+            sys.exit(0)
+        else:
+            sys.exit(1)
+    except ValueError:
+        sys.exit(1)
+    except Exception as e:
+        print(f"An unexpected error occurred during validation: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
index 0f0cba8afe..a1acecbb3f 100755
--- a/tools/verify-ipv6-only-deployments.sh
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -33,28 +33,23 @@ function verify_devstack_ipv6_setting {
         echo $TUNNEL_IP_VERSION "TUNNEL_IP_VERSION is not set to 6 so TUNNEL_ENDPOINT_IP cannot be an IPv6 address."
         exit 1
     fi
-    is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
-    if [[ "$is_service_host_ipv6" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_host"; then
         echo $SERVICE_HOST "SERVICE_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
-    if [[ "$is_host_ipv6" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_host_ipv6"; then
         echo $HOST_IPV6 "HOST_IPV6 is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
-    if [[ "$is_service_listen_address" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_listen_address"; then
         echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
-    if [[ "$is_service_local_host" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_local_host"; then
         echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_tunnel_endpoint_ip=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_tunnel_endpoint_ip'"))')
-    if [[ "$is_tunnel_endpoint_ip" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_tunnel_endpoint_ip"; then
         echo $TUNNEL_ENDPOINT_IP "TUNNEL_ENDPOINT_IP is not IPv6 which means devstack will not deploy with an IPv6 endpoint address."
         exit 1
     fi
@@ -63,8 +58,7 @@ function verify_devstack_ipv6_setting {
 }
 
 function sanity_check_system_ipv6_enabled {
-    system_ipv6_enabled=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_ipv6_enabled())')
-    if [[ $system_ipv6_enabled != "True" ]]; then
+    if [ ! -f "/proc/sys/net/ipv6/conf/default/disable_ipv6" ] || [ "$(cat /proc/sys/net/ipv6/conf/default/disable_ipv6)" -ne "0" ]; then
         echo "IPv6 is disabled in system"
         exit 1
     fi
@@ -78,10 +72,8 @@ function verify_service_listen_address_is_ipv6 {
     for endpoint in ${endpoints}; do
         local endpoint_address=''
         endpoint_address=$(echo "$endpoint" | awk -F/ '{print $3}' | awk -F] '{print $1}')
-        endpoint_address=$(echo $endpoint_address | tr -d [])
-        local is_endpoint_ipv6=''
-        is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
-        if [[ "$is_endpoint_ipv6" != "True" ]]; then
+        endpoint_address=$(echo $endpoint_address | tr -d '[]')
+        if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$endpoint_address"; then
             all_ipv6=False
             echo $endpoint ": This is not an IPv6 endpoint which means corresponding service is not listening on an IPv6 address."
             continue

From b6bf0b126b46042341cc3d47a92ad9b0d9b9a523 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 5 Aug 2025 16:44:26 +0000
Subject: [PATCH 3300/3333] Use novnc from source by default

This change restores the default devstack behavior in the zuul jobs
by removing the override of NOVNC_FROM_PACKAGE from devstack-base.

When installed locally, devstack defaults to installing novnc from
git. As reported in bug #2109592, Ubuntu and possibly other distros
have a packaging bug where the python3-novnc package 1) exists and
2) depends on `oslo.config` and, as a result, `oslo.utils`. The
reason python3-novnc existing is a bug is that novnc has not had any
Python deliverable since the 0.6.0 release around 2016. So this
package is no longer used and is effectively empty since novnc fully
moved to using JavaScript.

For unrelated reasons, devstack creates the global venv with
--site-packages to install `libvirt-python`, which also means that
any other Python dependencies installed at the system level also
infect the devstack venv.

In the past, this was not a problem, but as of epoxy, Nova requires
a newer version of oslo than Ubuntu provides in the distro package.
This is where the python3-novnc package and its incorrect dependency
on oslo breaks CI.

This is not seen locally, as devstack uses novnc from git. This
change makes CI do that also.

Closes-Bug: #2109592

Change-Id: I8f018e1e57e3f54997d2cf55b1b3aa728e82899b
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 .zuul.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b42c800068..eee450a6ad 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -352,6 +352,12 @@
       nodes (everything but the controller).
     required-projects:
       - opendev.org/openstack/devstack
+      # this is a workaround for a packaging bug in ubuntu
+      # remove when https://bugs.launchpad.net/nova/+bug/2109592
+      # is resolved and oslo.config is not a dep of the novnc deb
+      # via the defunct python3-novnc package.
+      - novnc/novnc
+
     roles:
       - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
@@ -369,7 +375,6 @@
         LOG_COLOR: false
         VERBOSE: true
         VERBOSE_NO_TIMESTAMP: true
-        NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it by default.
         LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}'
@@ -442,7 +447,6 @@
           LOG_COLOR: false
           VERBOSE: true
           VERBOSE_NO_TIMESTAMP: true
-          NOVNC_FROM_PACKAGE: true
           ERROR_ON_CLONE: true
           LIBVIRT_TYPE: qemu
         devstack_services:

From 3b3aab52646e7a7ed737716efbfbe7fbef170911 Mon Sep 17 00:00:00 2001
From: Joel Capitao <jcapitao@redhat.com>
Date: Fri, 8 Nov 2024 16:11:06 +0000
Subject: [PATCH 3301/3333] Support CentOS Stream 10

This patch includes changes required to run devstack
on CentOS Stream 10 which has been already published
in official repos by CentOS team [1]:

- Add RDO deps repository for CS10.
- remove xinetd package from installation for swift. Note that
  rsync-daemon is installed which should work fine.
- Use python3-distro to identify the distro
- Add devstack-single-node-centos-10-stream nodeset
- Add devstack-platform-centos-10-stream job to the check
  pipeline.

Closes https://issues.redhat.com/browse/RDO-379

[1] https://mirror.stream.centos.org/10-stream/

Change-Id: I33a6c5530482c28a24f2043cd4195e7bcd46427d
Signed-off-by: Cyril Roelandt <cyril@redhat.com>
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 .zuul.yaml           | 50 ++++++++++++++++++++++++++++++++++++++++++++
 files/rpms/general   |  8 ++++---
 files/rpms/n-cpu     |  2 +-
 files/rpms/nova      |  2 +-
 files/rpms/swift     |  2 +-
 functions-common     | 11 +++++-----
 stack.sh             | 14 +++++++++----
 tools/install_pip.sh |  2 +-
 8 files changed, 74 insertions(+), 17 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index eee450a6ad..3deab35e87 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,6 +38,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-centos-9-stream
     nodes:
@@ -86,6 +96,36 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-two-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+      - name: compute1
+        label: centos-10-stream-8GB
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -729,6 +769,14 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-centos-10-stream
+    parent: tempest-full-py3
+    description: CentOS 10 Stream platform test
+    nodeset: devstack-single-node-centos-10-stream
+    timeout: 9000
+    voting: false
+
 - job:
     name: devstack-platform-centos-9-stream
     parent: tempest-full-py3
@@ -911,6 +959,7 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
+        - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
@@ -994,6 +1043,7 @@
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
+        - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
diff --git a/files/rpms/general b/files/rpms/general
index 8a5755cc37..6f4572c708 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -10,9 +10,10 @@ glibc-langpack-en # dist:rhel9
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-nft # dist:rhel9
+iptables-nft # dist:rhel9,rhel10
 iptables-services
-java-1.8.0-openjdk-headless
+java-1.8.0-openjdk-headless # not:rhel10
+java-21-openjdk-headless # dist:rhel10
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -23,7 +24,8 @@ net-tools
 openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
-pcre-devel # for python-pcre
+pcre2-devel # dist:rhel10 for python-pcre2
+pcre-devel # not:rhel10 for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 7ce5a72d6b..5683862ee0 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,6 +1,6 @@
 cryptsetup
 dosfstools
-genisoimage # not:rhel9
+genisoimage # not:rhel9,rhel10
 iscsi-initiator-utils
 libosinfo
 lvm2
diff --git a/files/rpms/nova b/files/rpms/nova
index e0f13b854a..3ed2943c1d 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,7 @@
 conntrack-tools
 curl
 ebtables
-genisoimage # not:rhel9 required for config_drive
+genisoimage # not:rhel9,rhel10 required for config_drive
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
diff --git a/files/rpms/swift b/files/rpms/swift
index 49a1833dc4..cf614335c1 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f36,rhel9
+xinetd # not:f36,rhel9,rhel10
diff --git a/functions-common b/functions-common
index db2367cef6..85ee294afa 100644
--- a/functions-common
+++ b/functions-common
@@ -423,7 +423,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
+        sudo dnf install -y python3-distro || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -436,9 +436,9 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # CentOS Stream 9 and RHEL 9 do not provide lsb_release
+    # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" == "centos9" ]] || [[ "${ID}${VERSION}" =~ "rhel9" ]]; then
+    if [[ "${ID}${VERSION}" =~ "centos" ]] || [[ "${ID}${VERSION}" =~ "rhel" ]]; then
         os_RELEASE=${VERSION_ID}
         os_CODENAME="n/a"
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
@@ -485,9 +485,8 @@ function GetDistro {
         "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Rocky) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
-        # Drop the . release as we assume it's compatible
-        # XXX re-evaluate when we get RHEL10
-        DISTRO="rhel${os_RELEASE::1}"
+        MAJOR_VERSION=$(echo $os_RELEASE | cut -d. -f1)
+        DISTRO="rhel${MAJOR_VERSION}"
     elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
         DISTRO="openEuler-$os_RELEASE"
     else
diff --git a/stack.sh b/stack.sh
index 04b5f4ca6a..2e130aec58 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9"
+SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9|rhel10"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -302,16 +302,17 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ $DISTRO == "rhel9" ]]; then
+    if [[ $DISTRO =~ "rhel" ]]; then
+        VERSION=${DISTRO:4:2}
         rdo_release=${TARGET_BRANCH#*/}
         if [[ "$TARGET_BRANCH" == "master" ]]; then
             # adding delorean-deps repo to provide current master rpms
-            sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+            sudo wget https://trunk.rdoproject.org/centos${VERSION}-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
             if sudo dnf provides centos-release-openstack-${rdo_release} >/dev/null 2>&1; then
                 sudo dnf -y install centos-release-openstack-${rdo_release}
             else
-                sudo wget https://trunk.rdoproject.org/centos9-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+                sudo wget https://trunk.rdoproject.org/centos${VERSION}-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
             fi
         fi
     fi
@@ -408,6 +409,11 @@ elif [[ $DISTRO == "rhel9" ]]; then
     if is_package_installed curl-minimal; then
         sudo dnf swap -y curl-minimal curl
     fi
+elif [[ $DISTRO == "rhel10" ]]; then
+    # for CentOS Stream 10 repository
+    sudo dnf config-manager --set-enabled crb
+    # rabbitmq and other packages are provided by RDO repositories.
+    _install_rdo
 elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # There are some problem in openEuler. We should fix it first. Some required
     # package/action runs before fixup script. So we can't fix there.
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 91b180c06f..79f97c5f7a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -127,7 +127,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
+if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel* ]]; then
     # get-pip.py will not install over the python3-pip package in
     # Fedora 34 any more.
     #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935

From 9c295d0da30b8e4d0809623e886dc9aaf6f52c25 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 7 Aug 2025 10:53:59 +0100
Subject: [PATCH 3302/3333] Remove dead checks for Python 3.6

Change-Id: I9fab7209955ebdfda0f309aa0160749bd0f962e6
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 tools/install_pip.sh | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 79f97c5f7a..027693fc0a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -38,7 +38,6 @@ FILES=$TOP_DIR/files
 # [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
-PIP_GET_PIP36_URL=${PIP_GET_PIP36_URL:-"https://bootstrap.pypa.io/pip/3.6/get-pip.py"}
 
 GetDistro
 echo "Distro: $DISTRO"
@@ -57,14 +56,8 @@ function get_versions {
 
 
 function install_get_pip {
-    if [[ "$PYTHON3_VERSION" = "3.6" ]]; then
-        _pip_url=$PIP_GET_PIP36_URL
-        _local_pip="$FILES/$(basename $_pip_url)-py36"
-    else
-        _pip_url=$PIP_GET_PIP_URL
-        _local_pip="$FILES/$(basename $_pip_url)"
-    fi
-
+    _pip_url=$PIP_GET_PIP_URL
+    _local_pip="$FILES/$(basename $_pip_url)"
 
     # If get-pip.py isn't python, delete it. This was probably an
     # outage on the server.

From fdc41d76abf353b6a9b206bf92c6b9adb90b253a Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 7 Aug 2025 10:54:45 +0100
Subject: [PATCH 3303/3333] Remove dead checks for Fedora 36

It is EOL.

Change-Id: I609cfce8a98f9933380ddbc719ed22e6fcda4785
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 files/rpms/swift | 1 -
 lib/apache       | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/files/rpms/swift b/files/rpms/swift
index cf614335c1..c3921a47d4 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,3 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f36,rhel9,rhel10
diff --git a/lib/apache b/lib/apache
index 449d2e70d4..c49da711e1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -89,7 +89,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36|rhel9 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ rhel9 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:

From 1a74605eb4c30e28a99edd2e824c2ce38d6315ad Mon Sep 17 00:00:00 2001
From: Douglas Mendizabal <dmendiza@redhat.com>
Date: Fri, 8 Aug 2025 10:44:41 -0400
Subject: [PATCH 3304/3333] Fix iniset to escape backslash characters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch fixes an issue in iniset where backslash (\) characters are
removed from the config value.

This patch ensures that backslash characters (\) are escaped in addition
to the ampersand (&) character that was already being escaped.

Closes-Bug: #2120180
Signed-off-by: Douglas Mendizábal <dmendiza@redhat.com>
Change-Id: Ica53ed42269931d151daf815d2e2c10c1f9e29a8
---
 inc/ini-config           |  6 ++++--
 tests/test_ini_config.sh | 15 ++++++++++++++-
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index f65e42d3a5..920d4775fa 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -189,8 +189,10 @@ function iniset {
     local option=$3
     local value=$4
 
-    # Escape the ampersand character (&)
-    value=$(echo $value | sed -e 's/&/\\&/g')
+    # Escape the ampersand (&) and backslash (\) characters for sed
+    # Order of substitution matters: we escape backslashes first before
+    # adding more backslashes to escape ampersands
+    value=$(echo $value | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g')
 
     if [[ -z $section || -z $option ]]; then
         $xtrace
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 6367cde441..fd3896d6ba 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -47,6 +47,9 @@ multi = foo2
 [fff]
 ampersand =
 
+[ggg]
+backslash =
+
 [key_with_spaces]
 rgw special key = something
 
@@ -88,7 +91,7 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee fff key_with_spaces \
+assert_equal "$VAL" "default aaa bbb ccc ddd eee fff ggg key_with_spaces \
 del_separate_options del_same_option del_missing_option \
 del_missing_option_multi del_no_options"
 
@@ -134,6 +137,16 @@ done
 VAL=$(iniget ${TEST_INI} fff ampersand)
 assert_equal "$VAL" "&y" "iniset ampersands in option"
 
+# Test with backslash in value
+iniset ${TEST_INI} ggg backslash 'foo\bar'
+VAL=$(iniget ${TEST_INI} ggg backslash)
+assert_equal "$VAL" 'foo\bar' "iniset backslash in value"
+
+# Test with both ampersand and backslash
+iniset ${TEST_INI} ggg backslash 'foo\bar&baz'
+VAL=$(iniget ${TEST_INI} ggg backslash)
+assert_equal "$VAL" 'foo\bar&baz' "iniset ampersand and backslash in value"
+
 # test empty option
 if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"

From 34689f587966f9fd512a03c85762bd79dd4a4e9d Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Wed, 27 Aug 2025 02:40:21 +0000
Subject: [PATCH 3305/3333] Configure nova 'service' role in tempest

In this release, nova is implementing the service role in
policy[depends-on], and Tempest being branchless needs to
decide if service defaults are present in testing release/
env (Needed-By). Setting the service role availability in
Tempest so that from this release onward, tests can use
service role user to perform the required operation in nova.

Depends-On: https://review.opendev.org/c/openstack/nova/+/957578
Needed-By: https://review.opendev.org/c/openstack/tempest/+/892639

Change-Id: I463cb85f3fcb9f2fdd7aa4a0a5f2ae49782e3fc1
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 53851209d2..1ebe9c5f1f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -535,7 +535,7 @@ function configure_tempest {
     fi
 
     # NOTE(gmaan): Since 2025.2, 'manager' role is available in nova.
-    local nova_policy_roles="admin,manager,member,reader"
+    local nova_policy_roles="admin,manager,member,reader,service"
     iniset $TEMPEST_CONFIG compute-feature-enabled nova_policy_roles $nova_policy_roles
 
     # Network

From 2aae15c93f4383c0a38dff276700c762e56a7134 Mon Sep 17 00:00:00 2001
From: Tobias Urdin <tobias.urdin@binero.com>
Date: Tue, 6 May 2025 08:54:39 +0200
Subject: [PATCH 3306/3333] Use profile rbd for Ceph authx for cinder-backup

Use the RBD profile instead of setting explicit
permissions.

Change-Id: Idc2258e3b69df3df57894c17018a2a35043c8fa9
Signed-off-by: Tobias Urdin <tobias.urdin@binero.com>
---
 lib/cinder_backups/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 4b180490d7..c46b90c5b9 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -32,7 +32,7 @@ function configure_cinder_backup_ceph {
         if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
             sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
         fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "profile rbd" osd "profile rbd pool=${CINDER_BAK_CEPH_POOL}, profile rbd pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
 

From 2d7ff93390ca3c0f47a8b37c5f4912de69ab5b2f Mon Sep 17 00:00:00 2001
From: Jan Jasek <jjasek@redhat.com>
Date: Mon, 1 Sep 2025 12:08:48 +0200
Subject: [PATCH 3307/3333] Remove debian-bullseye nodeset

Horizon no longer use debian-bullseye nodeset

Change-Id: I78094a9dd7e51641dfb9b1a851b46744184df702
Signed-off-by: Jan Jasek <jjasek@redhat.com>
---
 .zuul.yaml | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3deab35e87..7bfd3e33b6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -73,19 +73,6 @@
         nodes:
           - controller
 
-# Note(sean-k-mooney): this is still used by horizon for
-# horizon-integration-tests, horizon-integration-pytest and
-# horizon-ui-pytest, remove when horizon is updated.
-- nodeset:
-    name: devstack-single-node-debian-bullseye
-    nodes:
-      - name: controller
-        label: debian-bullseye
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-rockylinux-9
     nodes:

From f6d8dab0e885b8de8c0f44388d538da7d4f9b7ec Mon Sep 17 00:00:00 2001
From: Saikumar Pulluri <saikumar1016@gmail.com>
Date: Thu, 4 Sep 2025 08:48:42 -0400
Subject: [PATCH 3308/3333] Add service type to keystone authtoken middleware

Configuring devstack's configure_keystone_authtoken_middleware to set
service_type as an additional option.

Needed-By: https://review.opendev.org/c/openstack/barbican/+/958845
Needed-By: https://review.opendev.org/c/openstack/manila/+/955393

Change-Id: I140c8392465965d68f52489b5e5bf3e47ae979be
Signed-off-by: Saikumar Pulluri <saikumar1016@gmail.com>
---
 lib/keystone | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 0311e24c67..241909cb9d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -432,6 +432,7 @@ function configure_keystone_authtoken_middleware {
     local conf_file=$1
     local admin_user=$2
     local section=${3:-keystone_authtoken}
+    local service_type=$4
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section interface public
@@ -444,6 +445,9 @@ function configure_keystone_authtoken_middleware {
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
+    if [[ -n "$service_type" ]]; then
+        iniset $conf_file $section service_type $service_type
+    fi
 }
 
 # configure_auth_token_middleware conf_file admin_user IGNORED [section]

From 2145b0a0031977ef2809a3eaa9abe6937e4777e6 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Wed, 10 Sep 2025 10:24:17 +0200
Subject: [PATCH 3309/3333] Add Rocky Linux Red Quartz singlenode job (10)

Change-Id: Iaad9eb034348d559809108d254601d51719ff3e0
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 .zuul.yaml       | 21 +++++++++++++++++++++
 functions-common | 11 ++++-------
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3deab35e87..0a81dd82c2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -96,6 +96,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-rockylinux-10
+    nodes:
+      - name: controller
+        label: rockylinux-10-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node-centos-10-stream
     nodes:
@@ -815,6 +825,16 @@
         # TODO(ykarel) Remove this when moving to rocky10
         PYTHON3_VERSION: 3.11
 
+- job:
+    name: devstack-platform-rocky-red-quartz
+    parent: tempest-full-py3
+    description: Rocky Linux Red Quartz platform test
+    nodeset: devstack-single-node-rockylinux-10
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
@@ -963,6 +983,7 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
+        - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
         - devstack-platform-ubuntu-noble-ovs
         - devstack-platform-ubuntu-jammy
diff --git a/functions-common b/functions-common
index 85ee294afa..37c1862c28 100644
--- a/functions-common
+++ b/functions-common
@@ -438,13 +438,10 @@ function _ensure_lsb_release {
 function GetOSVersion {
     # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" =~ "centos" ]] || [[ "${ID}${VERSION}" =~ "rhel" ]]; then
+    if [[ "${ID}" =~ (centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
-        os_CODENAME="n/a"
+        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
-    elif [[ "${ID}${VERSION}" =~ "rocky9" ]]; then
-        os_VENDOR="Rocky"
-        os_RELEASE=${VERSION_ID}
     else
         _ensure_lsb_release
 
@@ -483,7 +480,7 @@ function GetDistro {
         "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
-        "$os_VENDOR" =~ (Rocky) || \
+        "$os_VENDOR" =~ (RockyLinux) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         MAJOR_VERSION=$(echo $os_RELEASE | cut -d. -f1)
         DISTRO="rhel${MAJOR_VERSION}"
@@ -544,7 +541,7 @@ function is_fedora {
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseLinux" ] || \
-        [ "$os_VENDOR" = "Rocky" ] || \
+        [ "$os_VENDOR" = "RockyLinux" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]

From 1aa22aa6d4b8dac710b50b6aabd3ce9ce8280a98 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 6 May 2025 17:28:37 +0100
Subject: [PATCH 3310/3333] lib/glance: Remove support for deploying in
 standalone mode

Change-Id: Ia70accd3e04bf9bea7fa50c18541fc71cff75f5f
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/glance/+/933614
---
 lib/glance | 52 ++++++++++++----------------------------------------
 1 file changed, 12 insertions(+), 40 deletions(-)

diff --git a/lib/glance b/lib/glance
index b596b53271..4dade5142d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -83,13 +83,6 @@ GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-centralized_db}
 
-# Full Glance functionality requires running in standalone mode. If we are
-# not in uwsgi mode, then we are standalone, otherwise allow separate control.
-if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-    GLANCE_STANDALONE=True
-fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
-
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
 # has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
@@ -139,14 +132,7 @@ GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 # Glance default limit for Devstack
 GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-2000}
 
-# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
-# TODO(mtreinish): Remove the eventlet path here and in all the similar
-# conditionals below after the Pike release
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
-else
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-fi
+GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
 
 # Functions
 # ---------
@@ -451,12 +437,11 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
     # Set default configuration options for the glance-image-import
-    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins []
+    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins "[]"
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
 
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
-
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR
 
     if is_service_enabled tls-proxy; then
@@ -467,19 +452,15 @@ function configure_glance {
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
-    if [[ "$GLANCE_STANDALONE" == False ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
-        # Grab our uwsgi listen address and use that to fill out our
-        # worker_self_reference_url config
-        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
-               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
-    else
-        write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
-        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $GLANCE_URL
-    fi
+    write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
+
+    # Grab our uwsgi listen address and use that to fill out our
+    # worker_self_reference_url config
+    iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
+
+    # Configure the Python binary used for "import" plugins. If unset, these
+    # will attempt the uwsgi binary instead.
+    iniset $GLANCE_API_CONF wsgi python_interpreter $PYTHON
 
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
@@ -664,17 +645,8 @@ function start_glance_remote_clone {
 # start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
-        fi
-    fi
 
-    if [[ "$GLANCE_STANDALONE" == False ]]; then
-        run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
-    else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
-    fi
+    run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
 
     if is_service_enabled g-api-r; then
         echo "Starting the g-api-r clone service..."

From 2df0d7ab8230a0cc7ca1c5a90c254717c9ff2dc6 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Thu, 28 Aug 2025 03:39:25 +0000
Subject: [PATCH 3311/3333] Configure glance user in cinder conf

Cinder talk to glance for new image location APIs which
are default to 'service' role[1]. That needs cinder to have
the glance service user configured. We need to assign admin
role also to service user so that it can access images from
glance.

Needed-By: https://review.opendev.org/c/openstack/glance/+/958715

[1] https://review.opendev.org/c/openstack/glance/+/958715

Change-Id: I52d118672c053b9d6890bc6289bf12dcf5d7dce3
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/cinder | 3 +++
 lib/glance | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index eb8a63dbfc..aef6854062 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -419,6 +419,9 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    # Set glance credentials (used for location APIs)
+    configure_keystone_authtoken_middleware $CINDER_CONF glance glance
+
     # Set nova credentials (used for os-assisted-snapshots)
     configure_keystone_authtoken_middleware $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
diff --git a/lib/glance b/lib/glance
index b596b53271..31a9ae9745 100644
--- a/lib/glance
+++ b/lib/glance
@@ -503,7 +503,9 @@ function configure_glance {
 function create_glance_accounts {
     if is_service_enabled g-api; then
 
-        create_service_user "glance"
+        # When cinder talk to glance service APIs user needs service
+        # role for RBAC checks and admin role for cinder to access images.
+        create_service_user "glance" "admin"
 
         # required for swift access
         if is_service_enabled s-proxy; then

From f09da620cb5973f9a77233a700b06612462678e5 Mon Sep 17 00:00:00 2001
From: Yatin Karel <ykarel@redhat.com>
Date: Mon, 15 Sep 2025 17:16:50 +0530
Subject: [PATCH 3312/3333] Restore os_CODENAME for old rhel distros

With [1] fips based jobs which runs on 9-stream started
to fail as os_CODENAME not applicable on those. This
patch adds fallback as before.

Moving fips jobs to 10-stream/rocky requires some more work
due to [2]

[1] https://review.opendev.org/c/openstack/devstack/+/960342
[2] https://fedoraproject.org/wiki/Changes/RemoveFipsModeSetup

Change-Id: I6d7ba4f5698e9b4837b29662b0b7f883b3c5de35
Signed-off-by: Yatin Karel <ykarel@redhat.com>
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 37c1862c28..0ae51e3df1 100644
--- a/functions-common
+++ b/functions-common
@@ -440,7 +440,7 @@ function GetOSVersion {
     source /etc/os-release
     if [[ "${ID}" =~ (centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
-        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*')
+        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*' || echo 'n/a')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
     else
         _ensure_lsb_release

From f72801c1081e9f63bb1a98a66950d65ee8cf6ecb Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 15 Sep 2025 12:54:09 +0100
Subject: [PATCH 3313/3333] lib/neutron: Prepare for move of api-paste,
 rootwrap conf

Change-Id: I70ba357f9af668fb7a7cb737d13fe24e572eb0ff
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/neutron | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index ea2d8e728a..dec15fb782 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -996,7 +996,13 @@ function _configure_neutron_plugin_agent {
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+    if test -r $NEUTRON_DIR/etc/neutron/api-paste.ini; then
+        cp $NEUTRON_DIR/etc/neutron/api-paste.ini $Q_API_PASTE_FILE
+    else
+        # TODO(stephenfin): Remove this branch once [1] merges
+        # [1] https://review.opendev.org/c/openstack/neutron/+/961130
+        cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+    fi
 
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
@@ -1076,6 +1082,8 @@ function _neutron_setup_rootwrap {
     if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     else
+        # TODO(stephenfin): Remove this branch once [1] merges
+        # [1] https://review.opendev.org/c/openstack/neutron/+/961130
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE

From e4cb49c690677b437d817ad8c736edcb96b674e3 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 21 Sep 2025 03:12:55 +0900
Subject: [PATCH 3314/3333] Remove option for apache < 2.4

apache 2.4 was released long time ago and is now available in recent
operating systems.

Change-Id: If367869e8490159f31c7d6c0207e182dd7ecb164
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 files/apache-cinder-api.template    | 12 ++----------
 files/apache-horizon.template       | 14 ++------------
 files/apache-nova-api.template      |  4 +---
 files/apache-nova-metadata.template |  4 +---
 4 files changed, 6 insertions(+), 28 deletions(-)

diff --git a/files/apache-cinder-api.template b/files/apache-cinder-api.template
index e1246f11b6..e401803abc 100644
--- a/files/apache-cinder-api.template
+++ b/files/apache-cinder-api.template
@@ -6,21 +6,13 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %CINDER_BIN_DIR%/cinder-wsgi
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%{cu}t %M"
     ErrorLog /var/log/%APACHE_NAME%/c-api.log
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
 
     <Directory %CINDER_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
+        Require all granted
     </Directory>
 </VirtualHost>
diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index da7a7d26c3..c6c55ecf27 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -21,19 +21,9 @@
     <Directory %HORIZON_DIR%/>
         Options Indexes FollowSymLinks MultiViews
         AllowOverride None
-        # Apache 2.4 uses mod_authz_host for access control now (instead of
-        #  "Allow")
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
+        Require all granted
     </Directory>
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%{cu}t %M"
     ErrorLog /var/log/%APACHE_NAME%/horizon_error.log
     LogLevel warn
     CustomLog /var/log/%APACHE_NAME%/horizon_access.log combined
diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index bcf406edf3..66fcf73cf2 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -6,9 +6,7 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/nova-api.log
     %SSLENGINE%
     %SSLCERTFILE%
diff --git a/files/apache-nova-metadata.template b/files/apache-nova-metadata.template
index 6231c1ced8..64be03166e 100644
--- a/files/apache-nova-metadata.template
+++ b/files/apache-nova-metadata.template
@@ -6,9 +6,7 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/nova-metadata.log
     %SSLENGINE%
     %SSLCERTFILE%

From a3e37c86cab4ec43a4a6d1c1386abf12bc034db7 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Mon, 22 Sep 2025 06:04:42 +0000
Subject: [PATCH 3315/3333] Update DEVSTACK_SERIES to 2026.1

stable/2025.2 branch has been created now and
current master is for 2026.1

Change-Id: Ibec78664417207ca7784c548ab15c1c6ef0e0663
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 1e306cc685..93f8b1cd6d 100644
--- a/stackrc
+++ b/stackrc
@@ -252,7 +252,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2025.2"
+DEVSTACK_SERIES="2026.1"
 
 ##############
 #

From 093bc57518a72b63a59389df63491d476069fc5c Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Mon, 22 Sep 2025 06:56:25 +0000
Subject: [PATCH 3316/3333] Cap stable/2025.2 network, swift, volume
 api_extensions for tempest

This commit cap the network, volume and swift extensions on
Tempest's config option api_extensions.

In 2025.2, no new extension in neutron.

and no new extensions in swift and cinder.

Change-Id: I1f9a2f53fa1e513f58d7dd8706d57f2481ab3d47
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/tempest | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 58 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 1ebe9c5f1f..892e7fd72a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -805,7 +805,48 @@ function configure_tempest {
         DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
     fi
 
-    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
+    DEFAULT_NET_EXT="address-scope,agent,allowed-address-pairs,auto-allocated-topology"
+    DEFAULT_NET_EXT+=",availability_zone,binding,default-subnetpools,dhcp_agent_scheduler"
+    DEFAULT_NET_EXT+=",dvr,ext-gw-mode,external-net,extra_dhcp_opt,extraroute,flavors"
+    DEFAULT_NET_EXT+=",l3-flavors,l3-ha,l3_agent_scheduler,multi-provider,net-mtu"
+    DEFAULT_NET_EXT+=",network-ip-availability,network_availability_zone,pagination"
+    DEFAULT_NET_EXT+=",port-security,project-id,provider,quotas,quota_details,rbac-policies"
+    DEFAULT_NET_EXT+=",revision-if-match,router,router_availability_zone,security-group,service-type,sorting"
+    DEFAULT_NET_EXT+=",standard-attr-description,standard-attr-revisions,standard-attr-tag,standard-attr-timestamp"
+    DEFAULT_NET_EXT+=",subnet-service-types,subnet_allocation,net-mtu-writable,ip-substring-filtering"
+    DEFAULT_NET_EXT+=",availability_zone_filter,filter-validation,empty-string-filtering,port-mac-address-regenerate"
+    DEFAULT_NET_EXT+=",port-security-groups-filtering,fip-port-details,binding-extended"
+    DEFAULT_NET_EXT+=",subnet_onboard,l3-port-ip-change-not-allowed,agent-resources-synced"
+    DEFAULT_NET_EXT+=",floatingip-pools,rbac-security-groups,subnetpool-prefix-ops,router-admin-state-down-before-update"
+    DEFAULT_NET_EXT+=",rbac-subnetpool,tag-ports-during-bulk-creation,stateful-security-group,address-group,extraroute-atomic"
+    DEFAULT_NET_EXT+=",port-numa-affinity-policy,rbac-address-scope,security-groups-remote-address-group,trunk,trunk-details"
+    DEFAULT_NET_EXT+=",rbac-address-group,port-device-profile"
+    DEFAULT_NET_EXT+=",multiple-external-gateways,qos-pps-minimum,l3-ext-ndp-proxy,rbac-bgpvpn"
+    DEFAULT_NET_EXT+=",qos-pps,ecmp_routes,bgp,floating-ip-port-forwarding-port-ranges"
+    # New in Yoga
+    DEFAULT_NET_EXT+=",security-groups-shared-filtering,security-groups-normalized-cidr,quota-check-limit"
+    DEFAULT_NET_EXT+=",port-resource-request-groups"
+    # New in Zed
+    DEFAULT_NET_EXT+=",port-mac-override,floating-ip-port-forwarding-detail,network-cascade-delete"
+    # New in 2023.1
+    DEFAULT_NET_EXT+=",port-hints,floating-ip-distributed"
+    # New in 2023.2
+    DEFAULT_NET_EXT+=",port-hint-ovs-tx-steering,enable-default-route-bfd"
+    DEFAULT_NET_EXT+=",enable-default-route-ecmp,standard-attr-fwaas-v2"
+    DEFAULT_NET_EXT+=",allowed-address-pairs-atomic,network_ha"
+    DEFAULT_NET_EXT+=",security-groups-rules-belongs-to-default-sg"
+    DEFAULT_NET_EXT+=",port-hardware-offload-type"
+    # New in 2024.1
+    DEFAULT_NET_EXT+=",vpn-aes-ccm-gcm,tap-mirror,subnet-external-network"
+    DEFAULT_NET_EXT+=",port-numa-affinity-policy-socket"
+    # New in 2024.2
+    DEFAULT_NET_EXT+=",tag-creation,quota-check-limit-default,port-trusted-vif"
+    DEFAULT_NET_EXT+=",uplink-status-propagation-updatable"
+    # New in 2025.1
+    DEFAULT_NET_EXT+=",qing,vpn-aes-ctr"
+    # New in 2025.2: None
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-$DEFAULT_NET_EXT}
+
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
@@ -817,7 +858,10 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
     # Swift API Extensions
-    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
+    DEFAULT_SWIFT_OPT="account_quotas,bulk_delete,bulk_upload,container_quotas"
+    DEFAULT_SWIFT_OPT+=",container_sync,crossdomain,formpost,ratelimit,slo"
+    DEFAULT_SWIFT_OPT+=",staticweb,tempauth,tempurl,versioned_writes"
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$DEFAULT_SWIFT_OPT}
     if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
@@ -826,7 +870,18 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
     # Cinder API Extensions
-    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
+    DEFAULT_VOL_EXT="OS-SCH-HNT,backups,capabilities,cgsnapshots,consistencygroups"
+    DEFAULT_VOL_EXT+=",encryption,os-admin-actions,os-availability-zone"
+    DEFAULT_VOL_EXT+=",os-extended-services,os-extended-snapshot-attributes"
+    DEFAULT_VOL_EXT+=",os-hosts,os-quota-class-sets,os-quota-sets"
+    DEFAULT_VOL_EXT+=",os-services,os-snapshot-actions,os-snapshot-manage"
+    DEFAULT_VOL_EXT+=",os-snapshot-unmanage,os-types-extra-specs,os-types-manage"
+    DEFAULT_VOL_EXT+=",os-used-limits,os-vol-host-attr,os-vol-image-meta"
+    DEFAULT_VOL_EXT+=",os-vol-mig-status-attr,os-vol-tenant-attr,os-volume-actions"
+    DEFAULT_VOL_EXT+=",os-volume-encryption-metadata,os-volume-manage"
+    DEFAULT_VOL_EXT+=",os-volume-transfer,os-volume-type-access"
+    DEFAULT_VOL_EXT+=",os-volume-unmanage,qos-specs,scheduler-stats"
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-$DEFAULT_VOL_EXT}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}

From a8fc640b674a744e887e641ca9addc85ac46e480 Mon Sep 17 00:00:00 2001
From: Fernando Ferraz <fernandoperches@gmail.com>
Date: Fri, 19 Sep 2025 12:10:50 -0300
Subject: [PATCH 3317/3333] Avoid timeout in capture-system-logs due to df
 command

The `df` command can stall indefinitely on stale NFS mounts,
causing the playbook to time out. This leads to the entire job
failing with POST_FAILURE status, discarding controller logs
and impacting troubleshooting.

This patch changes `capture-system-logs` to run `df` with a 60s
timeout to prevent hangs from stale NFS mounts. If 'df' times out,
the mount output may help debug which NFS share is unresponsive.

Change-Id: Ife3945802c93bd77d60b60e433ea09aade38a522
Signed-off-by: Fernando Ferraz <fernandoperches@gmail.com>
---
 .zuul.yaml                                | 1 +
 roles/capture-system-logs/tasks/main.yaml | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3b0e5dbde0..d81da3d8f5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -446,6 +446,7 @@
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs
         '{{ stage_dir }}/df.txt': logs
+        '{{ stage_dir }}/mount.txt': logs
         '{{ stage_dir }}/pip2-freeze.txt': logs
         '{{ stage_dir }}/pip3-freeze.txt': logs
         '{{ stage_dir }}/dpkg-l.txt': logs
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index 77b5ec5098..4b5ec4836b 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -4,7 +4,13 @@
     executable: /bin/bash
     cmd: |
       sudo iptables-save > {{ stage_dir }}/iptables.txt
-      df -h > {{ stage_dir }}/df.txt
+
+      # NOTE(sfernand): Run 'df' with a 60s timeout to prevent hangs from
+      # stale NFS mounts.
+      timeout -s 9 60s df -h > {{ stage_dir }}/df.txt || true
+      # If 'df' times out, the mount output helps debug which NFS share
+      # is unresponsive.
+      mount > {{ stage_dir }}/mount.txt
 
       for py_ver in 2 3; do
           if [[ `which python${py_ver}` ]]; then

From f8b3c902bef911938e03d4fc4f13fc9851a843f5 Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Thu, 25 Sep 2025 19:39:26 +0200
Subject: [PATCH 3318/3333] [nova-fake-virt]Restore compute restartability

Since the stable-compute-uuid nova feature the compute nodes created via
  VIRT_DRIVER=fake
cannot be restarted as these computes are not writing the compute_id
file to disk at first startup. Therefore any subsequent restart will
fail as nova-compute will refuse to start due to the missing compute_id
file but having a service already in the DB.

After this patch fake-virt uses a variant of the fake virt driver that
actually writes compute_id file to disk. To allow multiple fake computes
running on the same machine each compute now has a separate state_path
created so each can store a separate compute_id file.

Signed-off-by: Balazs Gibizer <gibi@redhat.com>
Change-Id: I813cab3c89554d1e319b2b3e5c3affd8ec5d887e
---
 lib/nova                         | 9 +++++++++
 lib/nova_plugins/hypervisor-fake | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 2357d87ee3..b289ec6d6d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1085,6 +1085,15 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT host "${HOSTNAME}${i}"
+            # Ensure that each fake compute has its own state path so that it
+            # can have its own compute_id file
+            local state_path
+            state_path="$NOVA_STATE_PATH/${HOSTNAME}${i}"
+            COMPUTE_ID=$(uuidgen)
+            sudo mkdir -p "$state_path"
+            iniset $fake_conf DEFAULT state_path "$state_path"
+            # use the generated UUID as the stable compute node UUID
+            echo "$COMPUTE_ID" | sudo tee "$state_path/compute_id"
             run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 87ee49fa4b..39cb45ca67 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -36,7 +36,7 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
+    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriverWithoutFakeNodes"
     # Disable arbitrary limits
     iniset $NOVA_CONF quota driver nova.quota.NoopQuotaDriver
 }

From 581d0a1d607538ffea0f41548fae25b4c6529cff Mon Sep 17 00:00:00 2001
From: Yatin Karel <ykarel@redhat.com>
Date: Mon, 29 Sep 2025 17:03:48 +0530
Subject: [PATCH 3319/3333] [subnode setup] Fail the playbook when any node
 setup fails

Currently on the multinode jobs, job continue to run even
if devstack setup fails on any of the subnode and then fails later
when required conditions are not met.
This patch changes it to fail if any of the node setup fails using
any_errors_fatal: true.

Change-Id: I2acd8a1fe0802ee1880df2ef794f8e7d7478b67b
Signed-off-by: Yatin Karel <ykarel@redhat.com>
---
 roles/orchestrate-devstack/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index 2b8ae01a62..b8ee7e35a7 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -4,6 +4,7 @@
   when: inventory_hostname == 'controller'
 
 - name: Setup devstack on sub-nodes
+  any_errors_fatal: true
   block:
 
   - name: Distribute the build sshkey for the user "stack"

From b20eaa6e142f2716eb1b85ed8eabd5bd71515a02 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 3 Oct 2025 09:40:46 +0200
Subject: [PATCH 3320/3333] Add AlmaLinux 10 platform job

AlmaLinux 10 has been introduced in OpenDev to increase hardware
coverage - it supports x86-64-v2 (compared to v3 required by
CentOS Stream 10 and Rocky Linux 10)

Change-Id: I5c91f2166bfce51cadef9c22a22a6031223604c7
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 .zuul.yaml       | 33 ++++++++++++++++++++++++++++-----
 functions-common |  2 +-
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3b0e5dbde0..927945d8f0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -39,10 +39,10 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-centos-10-stream
+    name: devstack-single-node-almalinux-10
     nodes:
       - name: controller
-        label: centos-10-stream-8GB
+        label: almalinux-10-8GB
     groups:
       - name: tempest
         nodes:
@@ -58,10 +58,15 @@
         nodes:
           - controller
 
-# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
-    name: devstack-single-node-opensuse-15
-    nodes: []
+    name: devstack-single-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
 
 - nodeset:
     name: devstack-single-node-debian-bookworm
@@ -73,6 +78,11 @@
         nodes:
           - controller
 
+# TODO(frickler): drop this dummy nodeset once all references have been removed
+- nodeset:
+    name: devstack-single-node-opensuse-15
+    nodes: []
+
 - nodeset:
     name: devstack-single-node-rockylinux-9
     nodes:
@@ -766,6 +776,16 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-almalinux-purple-lion
+    parent: tempest-full-py3
+    description: AlmaLinux 10 platform test
+    nodeset: devstack-single-node-almalinux-10
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-centos-10-stream
     parent: tempest-full-py3
@@ -966,6 +986,7 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
+        - devstack-platform-almalinux-purple-lion
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
@@ -1051,10 +1072,12 @@
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
+        - devstack-platform-almalinux-purple-lion
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
+        - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
         - devstack-platform-ubuntu-noble-ovs
         - devstack-platform-ubuntu-jammy
diff --git a/functions-common b/functions-common
index 0ae51e3df1..c2042c4fef 100644
--- a/functions-common
+++ b/functions-common
@@ -438,7 +438,7 @@ function _ensure_lsb_release {
 function GetOSVersion {
     # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}" =~ (centos|rocky|rhel) ]]; then
+    if [[ "${ID}" =~ (almalinux|centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
         os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*' || echo 'n/a')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')

From 8060e12a7bddf16179098e611f7052291eafa1e3 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 12 Oct 2025 13:41:57 +0900
Subject: [PATCH 3321/3333] Drop logic for CentOS (Stream) 8

Change-Id: I528652ced464fadd565e16e89a7e0ef826d42611
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 files/rpms/n-cpu              |  3 +--
 files/rpms/nova               |  3 +--
 lib/neutron_plugins/ovn_agent |  3 ---
 stack.sh                      | 31 +------------------------------
 tools/fixup_stuff.sh          | 13 -------------
 5 files changed, 3 insertions(+), 50 deletions(-)

diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 5683862ee0..3d50f3a062 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,10 +1,9 @@
 cryptsetup
 dosfstools
-genisoimage # not:rhel9,rhel10
 iscsi-initiator-utils
 libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes
 sysfsutils
-xorriso # not:rhel8
+xorriso
diff --git a/files/rpms/nova b/files/rpms/nova
index 3ed2943c1d..c323224279 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,7 @@
 conntrack-tools
 curl
 ebtables
-genisoimage # not:rhel9,rhel10 required for config_drive
+genisoimage
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
@@ -11,4 +11,3 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
-xorriso # not:rhel8
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b128fde2b6..e346f4d1cd 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -407,9 +407,6 @@ function install_ovn {
         sudo mkdir -p $OVS_PREFIX/var/log/ovn
         sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
     else
-        # Load fixup_ovn_centos
-        source ${TOP_DIR}/tools/fixup_stuff.sh
-        fixup_ovn_centos
         install_package $(get_packages openvswitch)
         install_package $(get_packages ovn)
     fi
diff --git a/stack.sh b/stack.sh
index c8be7fa216..67c7a74de9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -366,36 +366,7 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-if [[ $DISTRO == "rhel8" ]]; then
-    # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
-    # node, where EPEL is installed (but disabled) and already
-    # pointing at our internal mirror
-    if [[ -f /etc/ci/mirror_info.sh ]]; then
-        SKIP_EPEL_INSTALL=True
-        sudo dnf config-manager --set-enabled epel
-    fi
-
-    # PowerTools repo provides libyaml-devel required by devstack itself and
-    # EPEL packages assume that the PowerTools repository is enable.
-    sudo dnf config-manager --set-enabled PowerTools
-
-    # CentOS 8.3 changed the repository name to lower case.
-    sudo dnf config-manager --set-enabled powertools
-
-    if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-        _install_epel
-    fi
-    # Along with EPEL, CentOS (and a-likes) require some packages only
-    # available in RDO repositories (e.g. OVS, or later versions of
-    # kvm) to run.
-    _install_rdo
-
-    # NOTE(cgoncalves): workaround RHBZ#1154272
-    # dnf fails for non-privileged users when expired_repos.json doesn't exist.
-    # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
-    # Patch: https://github.com/rpm-software-management/dnf/pull/1448
-    echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
-elif [[ $DISTRO == "rhel9" ]]; then
+if [[ $DISTRO == "rhel9" ]]; then
     # for CentOS Stream 9 repository
     sudo dnf config-manager --set-enabled crb
     # for RHEL 9 repository
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..fbac5ad2f1 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -89,19 +89,6 @@ EOF
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools
     fi
-    # Workaround CentOS 8-stream iputils and systemd Bug
-    # https://bugzilla.redhat.com/show_bug.cgi?id=2037807
-    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
-        sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
-    fi
-}
-
-function fixup_ovn_centos {
-    if [[ $os_VENDOR != "CentOS" ]]; then
-        return
-    fi
-    # OVN packages are part of this release for CentOS
-    yum_install centos-release-openstack-victoria
 }
 
 function fixup_ubuntu {

From 84652d3cb8022f20cbcfaef747306c95763b8039 Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Wed, 22 Jan 2025 17:00:59 +0100
Subject: [PATCH 3322/3333] Follow up for creating parent dir for config files

The commit Ia5fcfe6c63f5cc40b11f7e1f3be244d7897f26f6 wanted to enable
config file creation even if its parent dir not exists. But missed that
the caller of merge_config_file, merge_config_group already checks for
hte missing directory. So creating the missing dir in merge_config_file
is too late.

This patch moves the dir creation to the caller.

Change-Id: Ied0f321f31bf8888dce71cc18749f35dde303390
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
---
 inc/meta-config           | 13 ++++++++-----
 tests/test_meta_config.sh | 24 +++++++++++++++++++-----
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index b9d9649e4b..1215bb8307 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -90,7 +90,6 @@ function merge_config_file {
     local real_configfile
     real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
-        mkdir -p $(dirname $real_configfile) || die $LINENO "could not create the directory of $real_configfile ($configfile)"
         touch $real_configfile || die $LINENO "could not create config file $real_configfile ($configfile)"
     fi
 
@@ -186,11 +185,15 @@ function merge_config_group {
                 break
             fi
             dir=$(dirname $realconfigfile)
-            if [[ -d $dir ]]; then
-                merge_config_file $localfile $group $configfile
-            else
-                die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir is not a directory)"
+
+            test -e $dir && ! test -d $dir && die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir exists but it is not a directory)"
+
+            if ! [[ -e $dir ]] ; then
+                sudo mkdir -p $dir || die $LINENO "could not create the directory of $real_configfile ($configfile)"
+                sudo chown ${STACK_USER} $dir
             fi
+
+            merge_config_file $localfile $group $configfile
         done
     done
 }
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 087aaf468b..30479f245a 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -137,6 +137,9 @@ foo=bar
 [some]
 random=config
 
+[[test12|run_tests.sh/test.conf]]
+foo=bar
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -389,13 +392,12 @@ EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
-echo -n "merge_config_group test10 not directory: "
+echo -n "merge_config_group test10 create directory: "
 set +e
-# function is expected to fail and exit, running it
-# in a subprocess to let this script proceed
-(merge_config_group test.conf test10)
+STACK_USER=$(id -u -n)
+merge_config_group test.conf test10
 VAL=$?
-EXPECT_VAL=255
+EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
@@ -414,9 +416,21 @@ random = config
 non = sense'
 check_result "$VAL" "$EXPECT_VAL"
 
+echo -n "merge_config_group test12 directory as file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test12)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
 
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \
     test-multi-sections.conf test-same.conf
 rm -rf test-etc
+rm -rf does-not-exist-dir
+

From eee708742af669833d6a85d4c7289accb49c18a2 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 31 Oct 2025 17:09:11 +0000
Subject: [PATCH 3323/3333] Remove use of pkg_resources

Change-Id: I5d0697f39bab0a5ff956c3cc41c26ffe601ef6b9
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 inc/python           | 3 +--
 tools/fixup_stuff.sh | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index cd90ac82c6..3969c1fa82 100644
--- a/inc/python
+++ b/inc/python
@@ -273,8 +273,7 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
-    safe_name=$(python -c "from pkg_resources import safe_name; \
-        print(safe_name('${name}'))")
+    safe_name=$(python -c "from packaging import canonicalize_name; print(canonicalize_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
     # be smart about finding the remote of the git repo the package
     # was installed from.  This doesn't work with zuul which clones
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..d8283b2591 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,7 +84,7 @@ EOF
     # python3-setuptools RPM are deleted, it breaks some tools such as semanage
     # (used in diskimage-builder) that use the -s flag of the python
     # interpreter, enforcing the use of the packages from /usr/lib.
-    # Importing setuptools/pkg_resources in a such environment fails.
+    # Importing setuptools in a such environment fails.
     # Enforce the package re-installation to fix those applications.
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools

From 1c86258e6b0ccf95e6119d3a6271afa38e05d0a3 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 2 Oct 2025 17:48:03 +0100
Subject: [PATCH 3324/3333] Enable response validation in Keystone

Unlike other projects, Keystone was previously enabling validation for
all responses. This is a bad idea (TM). Quoting from the Keystone docs
for the new '[api] response_validation' option added in [1]:

  'warn' is the current recommendation for production environments. If
  you find it necessary to enable the 'ignore' option, please report the
  issues you are seeing to the Keystone team so we can improve our
  schemas.

  'error' should not be used in a production environment. This is
  because schema validation happens *after* the response body has been
  generated, meaning any side effects will still happen and the call may
  be non-idempotent despite the user receiving a HTTP 500 error.

DevStack is not used for production environments and is instead the
test harness used for the bulk of our integration testing. We *do* want
failed response validation to result in an error, since it will
highlight bugs in our schemas. Thus, we should override the default
value for this option.

[1] https://review.opendev.org/c/openstack/keystone/+/962851

Change-Id: I9fc2c5dce9511165ad2c1ab18db5eb439d357d9b
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Related-bug: #2126676
---
 lib/keystone | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 241909cb9d..840103b9f4 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -195,6 +195,10 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend $CACHE_BACKEND
     iniset $KEYSTONE_CONF cache memcache_servers $MEMCACHE_SERVERS
 
+    # Enable errors if response validation fails. We want this enabled in CI
+    # and development contexts to highlights bugs in our response schemas.
+    iniset $KEYSTONE_CONF api response_validation error
+
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     local service_port=$KEYSTONE_SERVICE_PORT

From 3566a15b8eeebb0dfc36e47f87129b108d2980e1 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 2 Oct 2025 17:46:42 +0100
Subject: [PATCH 3325/3333] Enable response validation in Nova

Per inline description

Change-Id: I85c959461e4e96b69d252e06fc697a1c61488411
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index b289ec6d6d..460b4adc85 100644
--- a/lib/nova
+++ b/lib/nova
@@ -453,6 +453,10 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT shutdown_timeout $NOVA_SHUTDOWN_TIMEOUT
 
+    # Enable errors if response validation fails. We want this enabled in CI
+    # and development contexts to highlights bugs in our response schemas.
+    iniset $NOVA_CONF api response_validation error
+
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
     iniset $NOVA_CONF DEFAULT report_interval $NOVA_SERVICE_REPORT_INTERVAL

From a041a7fc66453958ce1d34421330fd27393bbd65 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Thu, 6 Nov 2025 18:39:36 +0000
Subject: [PATCH 3326/3333] Re-add the ironic job in gate

Ironic job ironic-tempest-bios-ipmi-direct-tinyipa
has been renamed to ironic-tempest-bios-ipmi-direct
- https://review.opendev.org/c/openstack/ironic/+/950192

Zuul did not give any error or warning when this jobs was
ignored to run and it went unnotice until I manually checked
the gate jobs.

Change-Id: I9b6bb94456ccfd17c2e38cdaa772aef372d169d0
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 927945d8f0..a751c70a6a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -998,7 +998,7 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-bios-ipmi-direct-tinyipa
+        - ironic-tempest-bios-ipmi-direct
         - swift-dsvm-functional
         - grenade:
             irrelevant-files: *common-irrelevant-files
@@ -1031,7 +1031,7 @@
         - openstack-tox-bashate
         - neutron-ovs-grenade-multinode:
             irrelevant-files: *common-irrelevant-files
-        - ironic-tempest-bios-ipmi-direct-tinyipa
+        - ironic-tempest-bios-ipmi-direct
         - swift-dsvm-functional
         - grenade:
             irrelevant-files: *common-irrelevant-files

From f8ebb4939c46eed2f69bece7a7d9c8ff31b61353 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 10 Jul 2025 21:15:21 +0200
Subject: [PATCH 3327/3333] Add support for trixie and platform job

Dropping libapache2-mod-proxy-uwsgi package for debuntu, which is no
longer needed for Jammy, Bookworm and beyond.

libpcre3-dev is removed form the set of packages pre installed
for debian systems.

This change adds both single and two node nodesets for trixie.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Signed-off-by: Sean Mooney <work@seanmooney.info>
Change-Id: Ib056d2ad64b31657ea8ef9359fed78e589b01b88
---
 .zuul.yaml          | 51 +++++++++++++++++++++++++++++++++++++++++++++
 files/debs/general  |  2 --
 lib/apache          |  2 +-
 lib/databases/mysql | 14 +++++++++++--
 stack.sh            |  3 +--
 5 files changed, 65 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 927945d8f0..357c085fe9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -68,6 +68,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-debian-trixie
+    nodes:
+      - name: controller
+        label: debian-trixie-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-debian-bookworm
     nodes:
@@ -383,6 +393,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: devstack-two-node-debian-trixie
+    nodes:
+      - name: controller
+        label: debian-trixie-8GB
+      - name: compute1
+        label: debian-trixie-8GB
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - job:
     name: devstack-base
     parent: openstack-multinode-fips
@@ -806,6 +846,15 @@
     timeout: 9000
     voting: false
 
+- job:
+    name: devstack-platform-debian-trixie
+    parent: tempest-full-py3
+    description: Debian Trixie platform test
+    nodeset: devstack-single-node-debian-trixie
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-debian-bookworm
     parent: tempest-full-py3
@@ -990,6 +1039,7 @@
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
+        - devstack-platform-debian-trixie
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
@@ -1021,6 +1071,7 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
+        - devstack-platform-debian-trixie
         - devstack-platform-ubuntu-noble
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
diff --git a/files/debs/general b/files/debs/general
index 364f3cc6e2..1e63e4f582 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -11,10 +11,8 @@ gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
 iputils-ping
-libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
-libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libsystemd-dev # for systemd-python
diff --git a/lib/apache b/lib/apache
index c49da711e1..b3379a7cde 100644
--- a/lib/apache
+++ b/lib/apache
@@ -82,7 +82,7 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
+        local pkg_list="uwsgi uwsgi-plugin-python3"
         install_package ${pkg_list}
     # NOTE(ianw) 2022-02-03 : Fedora 35 needs to skip this and fall
     # into the install-from-source because the upstream packages
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 629014c1d8..a47580ca3d 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -20,7 +20,7 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
     if is_fedora && ! is_oraclelinux; then
         MYSQL_SERVICE_NAME=mariadb
-    elif [[ "$DISTRO" =~ bookworm|bullseye ]]; then
+    elif [[ "$DISTRO" =~ trixie|bookworm|bullseye ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
 fi
@@ -107,7 +107,7 @@ function configure_database_mysql {
     # for Ubuntu 22.04+ because the authorization model change in
     # version 10.4 of mariadb. See
     # https://mariadb.org/authentication-in-mariadb-10-4/
-    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    if ! (is_ubuntu && [[ ! "$DISTRO" =~ trixie|bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
@@ -119,6 +119,16 @@ function configure_database_mysql {
         local cmd_args="-uroot -p$DATABASE_PASSWORD -h$SERVICE_LOCAL_HOST "
     fi
 
+    # Workaround for mariadb > 11.6.2,
+    # see https://bugs.launchpad.net/nova/+bug/2116186/comments/3
+    min_db_ver="11.6.2"
+    db_version=$(sudo mysql ${cmd_args} -e "select version();" -sN | cut -d '-' -f 1)
+    max_db_ver=$(printf '%s\n' ${min_db_ver} ${db_version} | sort -V | tail -n 1)
+    if [[ "${min_db_ver}" != "${max_db_ver}" ]]; then
+        iniset -sudo $my_conf mysqld innodb_snapshot_isolation OFF
+        restart_service $MYSQL_SERVICE_NAME
+    fi
+
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
diff --git a/stack.sh b/stack.sh
index a7f6a5e903..5ef98eb7b7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 
-
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
 # **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
@@ -230,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9|rhel10"
+SUPPORTED_DISTROS="trixie|bookworm|jammy|noble|rhel9|rhel10"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 9a0db4f4999e2aa5923ed32452f1d2e41ae4ea55 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 16 Jul 2025 11:38:12 +0000
Subject: [PATCH 3328/3333] [Neutron] Add TARGET_ENABLE_OVN_AGENT variable to
 enable OVN agent

The new flag ``TARGET_ENABLE_OVN_AGENT`` will be disabled by default.
If enabled:
* The OVN agent will be enabled, regardless of not being configured.
* The OVN Metadata agent will be disabled, regardless of being
  configured.

This variable will be used, initially, in the grenade jobs. It will
be used to test the migration from the OVN Metadata agent to the
OVN agent.

This variable will be removed in 2026.2, along with the OVN Metadata
agent, that is set as deprecated and marked for removal.

Related-Bug: #2112313
Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I8f91e1cb8543da489f495b8cf5196e606a0f5eea
---
 lib/neutron_plugins/ovn_agent | 44 ++++++++++++++++++++++++++++-------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b128fde2b6..0e87b473e9 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -99,6 +99,13 @@ OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 # The OVN agent is configured, by default, with the "metadata" extension.
 OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
 OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-metadata}
+# The variable TARGET_ENABLE_OVN_AGENT, if True, overrides the OVN Metadata
+# agent service (q-ovn-metadata-agent neutron-ovn-metadata-agent) and the OVN
+# agent service (q-ovn-agent neutron-ovn-agent) configuration, always disabling
+# the first one (OVN Metadata agent) and enabling the second (OVN agent).
+# This variable will be removed in 2026.2, along with the OVN Metadata agent
+# removal.
+TARGET_ENABLE_OVN_AGENT=$(trueorfalse False TARGET_ENABLE_OVN_AGENT)
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
@@ -301,6 +308,21 @@ function create_public_bridge {
     _configure_public_network_connectivity
 }
 
+function is_ovn_metadata_agent_enabled {
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && [[ "$TARGET_ENABLE_OVN_AGENT" == "False" ]]; then
+        return 0
+    fi
+    return 1
+}
+
+function is_ovn_agent_enabled {
+    if is_service_enabled q-ovn-agent neutron-ovn-agent || [[ "$TARGET_ENABLE_OVN_AGENT" == "True" ]]; then
+        enable_service q-ovn-agent
+        return 0
+    fi
+    return 1
+
+}
 
 # OVN compilation functions
 # -------------------------
@@ -498,9 +520,9 @@ function configure_ovn_plugin {
             inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
         fi
 
-        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+        if is_ovn_metadata_agent_enabled; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
-        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+        elif is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
@@ -521,9 +543,9 @@ function configure_ovn_plugin {
     fi
 
     if is_service_enabled n-api-meta ; then
-        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+        if is_ovn_metadata_agent_enabled; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
-        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+        elif is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
@@ -558,10 +580,10 @@ function configure_ovn {
     # Metadata
     local sample_file=""
     local config_file=""
-    if is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
+    if is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
         sample_file=$NEUTRON_DIR/etc/neutron/plugins/ml2/ovn_agent.ini.sample
         config_file=$OVN_AGENT_CONF
-    elif is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    elif is_ovn_metadata_agent_enabled && is_service_enabled ovn-controller; then
         sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
         config_file=$OVN_META_CONF
     fi
@@ -758,13 +780,13 @@ function start_ovn {
         fi
     fi
 
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+    if is_ovn_metadata_agent_enabled; then
         run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
         # Format logging
         setup_logging $OVN_META_CONF
     fi
 
-    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+    if is_ovn_agent_enabled; then
         run_process q-ovn-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_AGENT_BINARY --config-file $OVN_AGENT_CONF"
         # Format logging
         setup_logging $OVN_AGENT_CONF
@@ -786,13 +808,17 @@ function _stop_process {
 }
 
 function stop_ovn {
+    # NOTE(ralonsoh): this check doesn't use "is_ovn_metadata_agent_enabled",
+    # instead it relies only in the configured services, disregarding the
+    # flag "TARGET_ENABLE_OVN_AGENT". It is needed to force the OVN Metadata
+    # agent stop in case the flag "TARGET_ENABLE_OVN_AGENT" is set.
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         # pkill takes care not to kill itself, but it may kill its parent
         # sudo unless we use the "ps | grep [f]oo" trick
         sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
-    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+    if is_ovn_agent_enabled; then
         # pkill takes care not to kill itself, but it may kill its parent
         # sudo unless we use the "ps | grep [f]oo" trick
         sudo pkill -9 -f "[h]aproxy" || :

From e8a11f5070fef8b9d757155b51da16481bac9aed Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 21 Nov 2025 21:01:50 +0100
Subject: [PATCH 3329/3333] Drop lib/oslo from unstack.sh

This was missed in [0].

[0] I6a66359c19d0385beafb4c5e57b6ec3cd6d9cc54

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Idaee45beb63b2badc72c4a70442c5b9aa7fb19fe
---
 unstack.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/unstack.sh b/unstack.sh
index 29c80718f8..8e8996c63b 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -61,7 +61,6 @@ source $TOP_DIR/lib/tls
 
 # Source project function libraries
 source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/oslo
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone

From 5d602fef2a7f3ac153c907304a8f43b38c0c1a50 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmaan@ghanshyammann.com>
Date: Fri, 21 Nov 2025 20:40:07 +0000
Subject: [PATCH 3330/3333] Revert "Cap stable/2025.2 network, swift, volume
 api_extensions for tempest"

This reverts commit 093bc57518a72b63a59389df63491d476069fc5c.

Reason for revert:

This is done by mistake on master. It needs to be done on stable/2025.2 https://review.opendev.org/c/openstack/devstack/+/968073

Change-Id: I8bd7b732c181f3abb015a57b4445332614f8c6c9
Signed-off-by: Ghanshyam <gmaan@ghanshyammann.com>
---
 lib/tempest | 61 +++--------------------------------------------------
 1 file changed, 3 insertions(+), 58 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 892e7fd72a..1ebe9c5f1f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -805,48 +805,7 @@ function configure_tempest {
         DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
     fi
 
-    DEFAULT_NET_EXT="address-scope,agent,allowed-address-pairs,auto-allocated-topology"
-    DEFAULT_NET_EXT+=",availability_zone,binding,default-subnetpools,dhcp_agent_scheduler"
-    DEFAULT_NET_EXT+=",dvr,ext-gw-mode,external-net,extra_dhcp_opt,extraroute,flavors"
-    DEFAULT_NET_EXT+=",l3-flavors,l3-ha,l3_agent_scheduler,multi-provider,net-mtu"
-    DEFAULT_NET_EXT+=",network-ip-availability,network_availability_zone,pagination"
-    DEFAULT_NET_EXT+=",port-security,project-id,provider,quotas,quota_details,rbac-policies"
-    DEFAULT_NET_EXT+=",revision-if-match,router,router_availability_zone,security-group,service-type,sorting"
-    DEFAULT_NET_EXT+=",standard-attr-description,standard-attr-revisions,standard-attr-tag,standard-attr-timestamp"
-    DEFAULT_NET_EXT+=",subnet-service-types,subnet_allocation,net-mtu-writable,ip-substring-filtering"
-    DEFAULT_NET_EXT+=",availability_zone_filter,filter-validation,empty-string-filtering,port-mac-address-regenerate"
-    DEFAULT_NET_EXT+=",port-security-groups-filtering,fip-port-details,binding-extended"
-    DEFAULT_NET_EXT+=",subnet_onboard,l3-port-ip-change-not-allowed,agent-resources-synced"
-    DEFAULT_NET_EXT+=",floatingip-pools,rbac-security-groups,subnetpool-prefix-ops,router-admin-state-down-before-update"
-    DEFAULT_NET_EXT+=",rbac-subnetpool,tag-ports-during-bulk-creation,stateful-security-group,address-group,extraroute-atomic"
-    DEFAULT_NET_EXT+=",port-numa-affinity-policy,rbac-address-scope,security-groups-remote-address-group,trunk,trunk-details"
-    DEFAULT_NET_EXT+=",rbac-address-group,port-device-profile"
-    DEFAULT_NET_EXT+=",multiple-external-gateways,qos-pps-minimum,l3-ext-ndp-proxy,rbac-bgpvpn"
-    DEFAULT_NET_EXT+=",qos-pps,ecmp_routes,bgp,floating-ip-port-forwarding-port-ranges"
-    # New in Yoga
-    DEFAULT_NET_EXT+=",security-groups-shared-filtering,security-groups-normalized-cidr,quota-check-limit"
-    DEFAULT_NET_EXT+=",port-resource-request-groups"
-    # New in Zed
-    DEFAULT_NET_EXT+=",port-mac-override,floating-ip-port-forwarding-detail,network-cascade-delete"
-    # New in 2023.1
-    DEFAULT_NET_EXT+=",port-hints,floating-ip-distributed"
-    # New in 2023.2
-    DEFAULT_NET_EXT+=",port-hint-ovs-tx-steering,enable-default-route-bfd"
-    DEFAULT_NET_EXT+=",enable-default-route-ecmp,standard-attr-fwaas-v2"
-    DEFAULT_NET_EXT+=",allowed-address-pairs-atomic,network_ha"
-    DEFAULT_NET_EXT+=",security-groups-rules-belongs-to-default-sg"
-    DEFAULT_NET_EXT+=",port-hardware-offload-type"
-    # New in 2024.1
-    DEFAULT_NET_EXT+=",vpn-aes-ccm-gcm,tap-mirror,subnet-external-network"
-    DEFAULT_NET_EXT+=",port-numa-affinity-policy-socket"
-    # New in 2024.2
-    DEFAULT_NET_EXT+=",tag-creation,quota-check-limit-default,port-trusted-vif"
-    DEFAULT_NET_EXT+=",uplink-status-propagation-updatable"
-    # New in 2025.1
-    DEFAULT_NET_EXT+=",qing,vpn-aes-ctr"
-    # New in 2025.2: None
-    local network_api_extensions=${NETWORK_API_EXTENSIONS:-$DEFAULT_NET_EXT}
-
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
@@ -858,10 +817,7 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
     # Swift API Extensions
-    DEFAULT_SWIFT_OPT="account_quotas,bulk_delete,bulk_upload,container_quotas"
-    DEFAULT_SWIFT_OPT+=",container_sync,crossdomain,formpost,ratelimit,slo"
-    DEFAULT_SWIFT_OPT+=",staticweb,tempauth,tempurl,versioned_writes"
-    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$DEFAULT_SWIFT_OPT}
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
@@ -870,18 +826,7 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
     # Cinder API Extensions
-    DEFAULT_VOL_EXT="OS-SCH-HNT,backups,capabilities,cgsnapshots,consistencygroups"
-    DEFAULT_VOL_EXT+=",encryption,os-admin-actions,os-availability-zone"
-    DEFAULT_VOL_EXT+=",os-extended-services,os-extended-snapshot-attributes"
-    DEFAULT_VOL_EXT+=",os-hosts,os-quota-class-sets,os-quota-sets"
-    DEFAULT_VOL_EXT+=",os-services,os-snapshot-actions,os-snapshot-manage"
-    DEFAULT_VOL_EXT+=",os-snapshot-unmanage,os-types-extra-specs,os-types-manage"
-    DEFAULT_VOL_EXT+=",os-used-limits,os-vol-host-attr,os-vol-image-meta"
-    DEFAULT_VOL_EXT+=",os-vol-mig-status-attr,os-vol-tenant-attr,os-volume-actions"
-    DEFAULT_VOL_EXT+=",os-volume-encryption-metadata,os-volume-manage"
-    DEFAULT_VOL_EXT+=",os-volume-transfer,os-volume-type-access"
-    DEFAULT_VOL_EXT+=",os-volume-unmanage,qos-specs,scheduler-stats"
-    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-$DEFAULT_VOL_EXT}
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}

From fc31d8a37e59d6811b208b5dba6c312365abd2d8 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Tue, 9 Dec 2025 17:49:41 +0100
Subject: [PATCH 3331/3333] almalinux: Switch to build OVS from source

Since almalinux-10 label in OpenDev runs on both x86-64-v2 and v3,
and CentOS NFV SIG OVS packages are only build for v3, these jobs
have been only successful when spawned on v3 hardware.

In order to make the job passable on v2 hardware - we should be
building OVS from source.

Rename the jobs to reflect the change

Change-Id: I67b19c18b45af23cda7899f7c2edab21b8ed1ede
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 .zuul.yaml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0aa2530d77..2227f185dd 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -818,7 +818,7 @@
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
 - job:
-    name: devstack-platform-almalinux-purple-lion
+    name: devstack-platform-almalinux-purple-lion-ovn-source
     parent: tempest-full-py3
     description: AlmaLinux 10 platform test
     nodeset: devstack-single-node-almalinux-10
@@ -826,6 +826,11 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "branch-24.03"
+        OVS_BRANCH: "branch-3.3"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
     name: devstack-platform-centos-10-stream
@@ -1036,7 +1041,7 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
-        - devstack-platform-almalinux-purple-lion
+        - devstack-platform-almalinux-purple-lion-ovn-source
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
@@ -1124,7 +1129,7 @@
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
-        - devstack-platform-almalinux-purple-lion
+        - devstack-platform-almalinux-purple-lion-ovn-source
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm

From c11b16b44de613a15833e610ebf77d539e488856 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Wed, 13 Aug 2025 01:02:34 +0900
Subject: [PATCH 3332/3333] Fix ownership of keyring file

The file should be owned by the user(STACK_USER) to run the process.
Note that STACK_USER may not match the current user in case stack.sh is
run by root.

Also we should not assume that the group name always matches the user
name.

Change-Id: Iec300311cab1b1a2fa124879aa3dc6a57a6a706b
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/cinder_backups/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index e60efbb632..e4d6b96407 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -34,7 +34,7 @@ function configure_cinder_backup_ceph {
             sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
         fi
         sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "profile rbd" osd "profile rbd pool=${CINDER_BAK_CEPH_POOL}, profile rbd pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo chown $STACK_USER ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"

From 92a70ba9dda1669f7af00cacd6cc7f41b764f5da Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Tue, 6 Jan 2026 08:52:41 +0100
Subject: [PATCH 3333/3333] Fix centos/rhel 9/10 dependencies

An error was introduced in [0], it added an incorrect dependency on
genisoimage for nova, and kept a valid dependency on xorriso in n-cpu.
It breaks centos 10 deployments, the expected behavior is to use xorriso
on modern rhel/centos.

[0] https://review.opendev.org/c/openstack/devstack/+/963799

Change-Id: I0057f934c453ded198f8b5e58f4924260a3d2508
Signed-off-by: Gregory Thiemonge <gthiemon@redhat.com>
---
 files/rpms/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/rpms/nova b/files/rpms/nova
index c323224279..d0f843bb60 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,6 @@
 conntrack-tools
 curl
 ebtables
-genisoimage
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
@@ -11,3 +10,4 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
+xorriso